From a242cb5b44de6cc88f829e38c34218fd269fe192 Mon Sep 17 00:00:00 2001 From: Tim Hockin Date: Thu, 2 Jul 2015 13:29:35 -0700 Subject: [PATCH] remove top-level release-* dirs --- release-0.19.0/docs/.files_generated | 28 - release-0.19.0/docs/README.md | 29 - release-0.19.0/docs/accessing-the-cluster.md | 342 - release-0.19.0/docs/accessing_the_api.md | 81 - release-0.19.0/docs/admission_controllers.md | 112 - release-0.19.0/docs/annotations.md | 31 - release-0.19.0/docs/api-conventions.md | 593 -- release-0.19.0/docs/api.md | 74 - release-0.19.0/docs/architecture.dia | Bin 6522 -> 0 bytes release-0.19.0/docs/architecture.png | Bin 222407 -> 0 bytes release-0.19.0/docs/architecture.svg | 499 -- release-0.19.0/docs/authentication.md | 46 - release-0.19.0/docs/authorization.md | 109 - release-0.19.0/docs/availability.md | 136 - release-0.19.0/docs/cli-roadmap.md | 84 - release-0.19.0/docs/client-libraries.md | 20 - release-0.19.0/docs/cluster-admin-guide.md | 80 - release-0.19.0/docs/cluster_management.md | 65 - release-0.19.0/docs/container-environment.md | 94 - release-0.19.0/docs/containers.md | 95 - release-0.19.0/docs/design/README.md | 23 - release-0.19.0/docs/design/access.md | 254 - .../docs/design/admission_control.md | 85 - .../design/admission_control_limit_range.md | 138 - .../admission_control_resource_quota.md | 159 - release-0.19.0/docs/design/architecture.md | 50 - release-0.19.0/docs/design/clustering.md | 66 - .../docs/design/clustering/.gitignore | 1 - .../docs/design/clustering/Dockerfile | 12 - .../docs/design/clustering/Makefile | 29 - .../docs/design/clustering/README.md | 31 - .../docs/design/clustering/dynamic.png | Bin 72373 -> 0 bytes .../docs/design/clustering/dynamic.seqdiag | 24 - .../docs/design/clustering/static.png | Bin 36583 -> 0 bytes .../docs/design/clustering/static.seqdiag | 16 - .../command_execution_port_forwarding.md | 149 - .../docs/design/event_compression.md | 84 - release-0.19.0/docs/design/expansion.md | 391 - release-0.19.0/docs/design/identifiers.md | 96 - release-0.19.0/docs/design/namespaces.md | 340 - release-0.19.0/docs/design/networking.md | 114 - .../docs/design/persistent-storage.md | 220 - release-0.19.0/docs/design/principles.md | 61 - release-0.19.0/docs/design/secrets.md | 581 -- release-0.19.0/docs/design/security.md | 123 - .../docs/design/security_context.md | 163 - .../docs/design/service_accounts.md | 170 - .../docs/design/simple-rolling-update.md | 97 - release-0.19.0/docs/devel/README.md | 27 - release-0.19.0/docs/devel/api_changes.md | 348 - .../docs/devel/coding-conventions.md | 13 - release-0.19.0/docs/devel/collab.md | 46 - .../docs/devel/developer-guides/vagrant.md | 341 - release-0.19.0/docs/devel/development.md | 275 - release-0.19.0/docs/devel/faster_reviews.md | 183 - release-0.19.0/docs/devel/flaky-tests.md | 68 - release-0.19.0/docs/devel/issues.md | 25 - release-0.19.0/docs/devel/logging.md | 32 - release-0.19.0/docs/devel/profiling.md | 40 - release-0.19.0/docs/devel/pull-requests.md | 22 - release-0.19.0/docs/devel/releasing.dot | 113 - release-0.19.0/docs/devel/releasing.md | 171 - release-0.19.0/docs/devel/releasing.png | Bin 30693 -> 0 bytes release-0.19.0/docs/devel/releasing.svg | 113 - .../devel/writing-a-getting-started-guide.md | 105 - release-0.19.0/docs/developer-guide.md | 41 - release-0.19.0/docs/dns.md | 44 - release-0.19.0/docs/downward_api.md | 53 - .../docs/getting-started-guides/README.md | 66 - .../docs/getting-started-guides/aws-coreos.md | 220 - .../docs/getting-started-guides/aws.md | 89 - .../aws/cloud-configs/master.yaml | 177 - .../aws/cloud-configs/node.yaml | 81 - .../aws/cloudformation-template.json | 421 - .../getting-started-guides/aws/kubectl.md | 27 - .../docs/getting-started-guides/azure.md | 54 - .../getting-started-guides/binary_release.md | 29 - .../centos/centos_manual_config.md | 170 - .../docs/getting-started-guides/cloudstack.md | 96 - .../docs/getting-started-guides/coreos.md | 18 - .../coreos/azure/.gitignore | 1 - .../coreos/azure/README.md | 195 - .../influxdb/grafana-service.yaml | 14 - .../influxdb/heapster-controller.yaml | 24 - .../influxdb/influxdb-grafana-controller.yaml | 35 - .../influxdb/influxdb-service.yaml | 17 - .../fluentd-elasticsearch/es-controller.yaml | 37 - .../fluentd-elasticsearch/es-service.yaml | 16 - .../kibana-controller.yaml | 31 - .../fluentd-elasticsearch/kibana-service.yaml | 17 - .../coreos/azure/azure-login.js | 3 - .../kubernetes-cluster-etcd-node-template.yml | 60 - ...kubernetes-cluster-main-nodes-template.yml | 388 - .../coreos/azure/create-kubernetes-cluster.js | 15 - .../coreos/azure/destroy-cluster.js | 7 - .../coreos/azure/external_access.png | Bin 292367 -> 0 bytes .../coreos/azure/initial_cluster.png | Bin 173212 -> 0 bytes .../coreos/azure/lib/azure_wrapper.js | 271 - .../coreos/azure/lib/cloud_config.js | 43 - .../azure/lib/deployment_logic/kubernetes.js | 76 - .../coreos/azure/lib/util.js | 33 - .../coreos/azure/package.json | 19 - .../coreos/azure/scale-kubernetes-cluster.js | 10 - .../coreos/bare_metal_offline.md | 645 -- .../coreos/cloud-configs/master.yaml | 180 - .../coreos/cloud-configs/node.yaml | 105 - .../coreos/cloud-configs/standalone.yaml | 168 - .../coreos/coreos_multinode_cluster.md | 142 - .../coreos/coreos_single_node_cluster.md | 66 - .../docker-multinode.md | 51 - .../docker-multinode/master.md | 149 - .../docker-multinode/testing.md | 63 - .../docker-multinode/worker.md | 139 - .../docs/getting-started-guides/docker.md | 87 - .../fedora/fedora_ansible_config.md | 239 - .../fedora/fedora_manual_config.md | 188 - .../fedora/flannel_multi_node_cluster.md | 165 - .../docs/getting-started-guides/gce.md | 124 - .../docs/getting-started-guides/juju.md | 228 - .../getting-started-guides/k8s-docker.png | Bin 52545 -> 0 bytes .../k8s-singlenode-docker.png | Bin 31801 -> 0 bytes .../getting-started-guides/libvirt-coreos.md | 260 - .../docs/getting-started-guides/locally.md | 118 - .../docs/getting-started-guides/logging.md | 34 - .../docs/getting-started-guides/mesos.md | 305 - .../mesos/k8s-firewall.png | Bin 88722 -> 0 bytes .../mesos/k8s-guestbook.png | Bin 44000 -> 0 bytes .../docs/getting-started-guides/ovirt.md | 50 - .../docs/getting-started-guides/rackspace.md | 58 - .../docs/getting-started-guides/rkt/README.md | 95 - .../docs/getting-started-guides/ubuntu.md | 180 - .../docs/getting-started-guides/vagrant.md | 308 - .../docs/getting-started-guides/vsphere.md | 86 - release-0.19.0/docs/glossary.md | 61 - .../docs/high-availability/default-kubelet | 1 - .../docs/high-availability/init-kubelet | 126 - .../docs/high-availability/monit-docker | 9 - .../docs/high-availability/monit-kubelet | 11 - .../docs/high-availability/podmaster.json | 57 - release-0.19.0/docs/identifiers.md | 16 - release-0.19.0/docs/images.md | 38 - release-0.19.0/docs/kibana.png | Bin 82617 -> 0 bytes release-0.19.0/docs/kubeconfig-file.md | 155 - release-0.19.0/docs/kubectl.md | 73 - release-0.19.0/docs/kubectl_api-versions.md | 57 - release-0.19.0/docs/kubectl_cluster-info.md | 57 - release-0.19.0/docs/kubectl_config.md | 70 - .../docs/kubectl_config_set-cluster.md | 72 - .../docs/kubectl_config_set-context.md | 65 - .../docs/kubectl_config_set-credentials.md | 85 - release-0.19.0/docs/kubectl_config_set.md | 59 - release-0.19.0/docs/kubectl_config_unset.md | 58 - .../docs/kubectl_config_use-context.md | 57 - release-0.19.0/docs/kubectl_config_view.md | 77 - release-0.19.0/docs/kubectl_create.md | 70 - release-0.19.0/docs/kubectl_delete.md | 92 - release-0.19.0/docs/kubectl_describe.md | 70 - release-0.19.0/docs/kubectl_exec.md | 74 - release-0.19.0/docs/kubectl_expose.md | 91 - release-0.19.0/docs/kubectl_get.md | 95 - release-0.19.0/docs/kubectl_label.md | 89 - release-0.19.0/docs/kubectl_logs.md | 73 - release-0.19.0/docs/kubectl_namespace.md | 60 - release-0.19.0/docs/kubectl_port-forward.md | 75 - release-0.19.0/docs/kubectl_proxy.md | 87 - release-0.19.0/docs/kubectl_rolling-update.md | 91 - release-0.19.0/docs/kubectl_run.md | 86 - release-0.19.0/docs/kubectl_scale.md | 75 - release-0.19.0/docs/kubectl_stop.md | 82 - release-0.19.0/docs/kubectl_update.md | 70 - release-0.19.0/docs/kubectl_version.md | 58 - release-0.19.0/docs/labels.md | 110 - release-0.19.0/docs/logging.md | 52 - release-0.19.0/docs/making-release-notes.md | 36 - release-0.19.0/docs/man/Dockerfile | 7 - release-0.19.0/docs/man/README.md | 49 - release-0.19.0/docs/man/kube-apiserver.1.md | 198 - .../docs/man/kube-controller-manager.1.md | 141 - release-0.19.0/docs/man/kube-proxy.1.md | 78 - release-0.19.0/docs/man/kube-scheduler.1.md | 78 - release-0.19.0/docs/man/kubelet.1.md | 259 - release-0.19.0/docs/man/man1/.files_generated | 28 - release-0.19.0/docs/man/man1/kube-apiserver.1 | 259 - .../docs/man/man1/kube-controller-manager.1 | 182 - release-0.19.0/docs/man/man1/kube-proxy.1 | 98 - release-0.19.0/docs/man/man1/kube-scheduler.1 | 98 - .../docs/man/man1/kubectl-api-versions.1 | 130 - .../docs/man/man1/kubectl-cluster-info.1 | 130 - .../man/man1/kubectl-config-set-cluster.1 | 153 - .../man/man1/kubectl-config-set-context.1 | 143 - .../man/man1/kubectl-config-set-credentials.1 | 169 - .../docs/man/man1/kubectl-config-set.1 | 132 - .../docs/man/man1/kubectl-config-unset.1 | 131 - .../man/man1/kubectl-config-use-context.1 | 130 - .../docs/man/man1/kubectl-config-view.1 | 181 - release-0.19.0/docs/man/man1/kubectl-config.1 | 136 - release-0.19.0/docs/man/man1/kubectl-create.1 | 152 - release-0.19.0/docs/man/man1/kubectl-delete.1 | 194 - .../docs/man/man1/kubectl-describe.1 | 149 - release-0.19.0/docs/man/man1/kubectl-exec.1 | 164 - release-0.19.0/docs/man/man1/kubectl-expose.1 | 222 - release-0.19.0/docs/man/man1/kubectl-get.1 | 200 - release-0.19.0/docs/man/man1/kubectl-label.1 | 193 - release-0.19.0/docs/man/man1/kubectl-logs.1 | 160 - .../docs/man/man1/kubectl-namespace.1 | 133 - .../docs/man/man1/kubectl-port-forward.1 | 156 - release-0.19.0/docs/man/man1/kubectl-proxy.1 | 183 - .../docs/man/man1/kubectl-rolling-update.1 | 207 - release-0.19.0/docs/man/man1/kubectl-run.1 | 201 - release-0.19.0/docs/man/man1/kubectl-scale.1 | 163 - release-0.19.0/docs/man/man1/kubectl-stop.1 | 179 - release-0.19.0/docs/man/man1/kubectl-update.1 | 152 - .../docs/man/man1/kubectl-version.1 | 134 - release-0.19.0/docs/man/man1/kubectl.1 | 132 - release-0.19.0/docs/man/man1/kubelet.1 | 339 - release-0.19.0/docs/man/md2man-all.sh | 41 - release-0.19.0/docs/namespaces.md | 13 - release-0.19.0/docs/networking.md | 183 - release-0.19.0/docs/node.md | 142 - release-0.19.0/docs/overview.md | 35 - release-0.19.0/docs/ovs-networking.md | 20 - release-0.19.0/docs/ovs-networking.png | Bin 71412 -> 0 bytes release-0.19.0/docs/pod-states.md | 111 - release-0.19.0/docs/pods.md | 85 - release-0.19.0/docs/proposals/autoscaling.md | 260 - .../proposals/federation-high-level-arch.png | Bin 31793 -> 0 bytes release-0.19.0/docs/proposals/federation.md | 437 - .../docs/proposals/high-availability.md | 52 - release-0.19.0/docs/replication-controller.md | 71 - release-0.19.0/docs/resource_quota_admin.md | 107 - release-0.19.0/docs/resources.md | 214 - release-0.19.0/docs/roadmap.md | 97 - release-0.19.0/docs/salt.md | 104 - release-0.19.0/docs/secrets.md | 367 - release-0.19.0/docs/security_context.md | 9 - release-0.19.0/docs/service_accounts.md | 17 - release-0.19.0/docs/services-firewalls.md | 40 - release-0.19.0/docs/services.md | 468 -- release-0.19.0/docs/services_detail.png | Bin 68514 -> 0 bytes release-0.19.0/docs/services_detail.svg | 570 -- release-0.19.0/docs/services_overview.png | Bin 43306 -> 0 bytes release-0.19.0/docs/services_overview.svg | 417 - release-0.19.0/docs/sharing-clusters.md | 112 - release-0.19.0/docs/ui.md | 23 - release-0.19.0/docs/user-guide.md | 99 - release-0.19.0/docs/versioning.md | 51 - release-0.19.0/docs/volumes.md | 96 - release-0.19.0/examples/README.md | 16 - release-0.19.0/examples/cassandra/README.md | 271 - .../cassandra/cassandra-controller.yaml | 39 - .../examples/cassandra/cassandra-service.yaml | 12 - .../examples/cassandra/cassandra.yaml | 31 - .../examples/cassandra/image/Dockerfile | 22 - .../examples/cassandra/image/cassandra.list | 3 - .../examples/cassandra/image/cassandra.yaml | 764 -- .../cassandra/image/kubernetes-cassandra.jar | Bin 8219 -> 0 bytes .../examples/cassandra/image/run.sh | 19 - .../examples/cassandra/java/pom.xml | 47 - .../k8s/cassandra/KubernetesSeedProvider.java | 149 - .../cassandra/KubernetesSeedProvider$1.class | Bin 1088 -> 0 bytes .../cassandra/KubernetesSeedProvider$2.class | Bin 838 -> 0 bytes .../KubernetesSeedProvider$Address.class | Bin 582 -> 0 bytes .../KubernetesSeedProvider$Endpoints.class | Bin 749 -> 0 bytes .../KubernetesSeedProvider$Subset.class | Bin 745 -> 0 bytes .../cassandra/KubernetesSeedProvider.class | Bin 6341 -> 0 bytes .../target/kubernetes-cassandra-0.0.2.jar | Bin 6448 -> 0 bytes .../target/kubernetes-cassandra-0.0.3.jar | Bin 8219 -> 0 bytes .../java/target/maven-archiver/pom.properties | 5 - .../examples/celery-rabbitmq/README.md | 238 - .../celery-rabbitmq/celery-app-add/Dockerfile | 9 - .../celery-app-add/celery_conf.py | 29 - .../celery-rabbitmq/celery-app-add/run.sh | 21 - .../celery-app-add/run_tasks.py | 29 - .../celery-rabbitmq/celery-controller.yaml | 25 - .../celery-rabbitmq/flower-controller.yaml | 26 - .../celery-rabbitmq/flower/Dockerfile | 15 - .../celery-rabbitmq/flower/run_flower.sh | 17 - .../celery-rabbitmq/rabbitmq-controller.yaml | 25 - .../celery-rabbitmq/rabbitmq-service.yaml | 14 - release-0.19.0/examples/cluster-dns/README.md | 144 - .../examples/cluster-dns/dns-backend-rc.yaml | 22 - .../cluster-dns/dns-backend-service.yaml | 9 - .../cluster-dns/dns-frontend-pod.yaml | 16 - .../cluster-dns/images/backend/Dockerfile | 6 - .../cluster-dns/images/backend/server.py | 37 - .../cluster-dns/images/frontend/Dockerfile | 8 - .../cluster-dns/images/frontend/client.py | 46 - .../examples/cluster-dns/namespace-dev.yaml | 6 - .../examples/cluster-dns/namespace-prod.yaml | 6 - release-0.19.0/examples/doc.go | 18 - .../examples/downward-api/README.md | 39 - .../examples/downward-api/dapi-pod.yaml | 19 - .../examples/elasticsearch/Dockerfile | 18 - .../examples/elasticsearch/Makefile | 14 - .../examples/elasticsearch/README.md | 324 - .../elasticsearch/apiserver-secret.yaml | 8 - .../examples/elasticsearch/elasticsearch.yml | 385 - .../elasticsearch/elasticsearch_discovery.go | 97 - .../examples/elasticsearch/music-rc.yaml | 39 - .../examples/elasticsearch/music-service.yaml | 15 - release-0.19.0/examples/elasticsearch/run.sh | 25 - .../examples/environment-guide/README.md | 95 - .../environment-guide/backend-rc.yaml | 30 - .../environment-guide/backend-srv.yaml | 13 - .../environment-guide/containers/README.md | 26 - .../containers/backend/Dockerfile | 2 - .../containers/backend/backend.go | 37 - .../containers/show/Dockerfile | 2 - .../environment-guide/containers/show/show.go | 95 - .../examples/environment-guide/diagram.png | Bin 18765 -> 0 bytes .../examples/environment-guide/show-rc.yaml | 32 - .../examples/environment-guide/show-srv.yaml | 15 - release-0.19.0/examples/examples_test.go | 438 - release-0.19.0/examples/explorer/Dockerfile | 20 - release-0.19.0/examples/explorer/Makefile | 16 - release-0.19.0/examples/explorer/README.md | 133 - release-0.19.0/examples/explorer/explorer.go | 122 - release-0.19.0/examples/explorer/pod.json | 36 - release-0.19.0/examples/glusterfs/README.md | 89 - .../glusterfs/glusterfs-endpoints.json | 35 - .../examples/glusterfs/glusterfs-pod.json | 32 - .../examples/guestbook-go/README.md | 212 - .../guestbook-go/guestbook-controller.json | 38 - .../guestbook-go/guestbook-service.json | 23 - .../guestbook-go/redis-master-controller.json | 42 - .../guestbook-go/redis-master-service.json | 24 - .../guestbook-go/redis-slave-controller.json | 47 - .../guestbook-go/redis-slave-service.json | 24 - release-0.19.0/examples/guestbook/README.md | 549 -- .../guestbook/frontend-controller.json | 37 - .../examples/guestbook/frontend-service.json | 22 - .../examples/guestbook/php-redis/Dockerfile | 7 - .../guestbook/php-redis/controllers.js | 29 - .../examples/guestbook/php-redis/index.html | 25 - .../examples/guestbook/php-redis/index.php | 33 - .../guestbook/redis-master-controller.json | 37 - .../guestbook/redis-master-service.json | 22 - .../guestbook/redis-slave-controller.json | 37 - .../guestbook/redis-slave-service.json | 22 - .../examples/guestbook/redis-slave/Dockerfile | 7 - .../examples/guestbook/redis-slave/run.sh | 17 - release-0.19.0/examples/hazelcast/Dockerfile | 11 - release-0.19.0/examples/hazelcast/README.md | 214 - .../hazelcast/hazelcast-controller.yaml | 27 - .../examples/hazelcast/hazelcast-service.yaml | 12 - release-0.19.0/examples/iscsi/README.md | 65 - release-0.19.0/examples/iscsi/iscsi.json | 53 - release-0.19.0/examples/k8petstore/README.md | 117 - .../examples/k8petstore/Vagrantfile | 37 - .../k8petstore/bps-data-generator/README.md | 21 - .../k8petstore/build-push-containers.sh | 29 - release-0.19.0/examples/k8petstore/dev/README | 35 - .../examples/k8petstore/dev/Vagrantfile | 44 - .../examples/k8petstore/dev/hosts/Vagrantfile | 11 - .../examples/k8petstore/dev/test.sh | 47 - .../examples/k8petstore/k8petstore.dot | 9 - .../examples/k8petstore/k8petstore.sh | 287 - .../k8petstore/redis-master/Dockerfile | 17 - .../redis-master/etc_redis_redis.conf | 46 - .../k8petstore/redis-slave/Dockerfile | 15 - .../redis-slave/etc_redis_redis.conf | 46 - .../examples/k8petstore/redis-slave/run.sh | 30 - .../examples/k8petstore/redis/Dockerfile | 45 - .../k8petstore/redis/etc_redis_redis.conf | 46 - .../examples/k8petstore/web-server/Dockerfile | 21 - .../k8petstore/web-server/PetStoreBook.go | 204 - .../examples/k8petstore/web-server/dump.rdb | Bin 88 -> 0 bytes .../k8petstore/web-server/static/histogram.js | 39 - .../k8petstore/web-server/static/index.html | 47 - .../k8petstore/web-server/static/script.js | 72 - .../k8petstore/web-server/static/style.css | 69 - .../examples/k8petstore/web-server/test.sh | 25 - .../examples/kubectl-container/.gitignore | 2 - .../examples/kubectl-container/Dockerfile | 18 - .../examples/kubectl-container/Makefile | 30 - .../examples/kubectl-container/README.md | 24 - .../examples/kubectl-container/pod.json | 54 - .../examples/kubernetes-namespaces/README.md | 255 - .../kubernetes-namespaces/namespace-dev.json | 10 - .../kubernetes-namespaces/namespace-prod.json | 10 - release-0.19.0/examples/limitrange/README.md | 7 - .../examples/limitrange/invalid-pod.json | 22 - .../examples/limitrange/limit-range.json | 37 - .../examples/limitrange/valid-pod.json | 22 - release-0.19.0/examples/liveness/README.md | 82 - .../examples/liveness/exec-liveness.yaml | 21 - .../examples/liveness/http-liveness.yaml | 18 - .../examples/liveness/image/Dockerfile | 4 - .../examples/liveness/image/Makefile | 13 - .../examples/liveness/image/server.go | 46 - release-0.19.0/examples/logging-demo/Makefile | 34 - .../examples/logging-demo/README.md | 248 - .../examples/logging-demo/synth-logger.png | Bin 89284 -> 0 bytes .../logging-demo/synthetic_0_25lps.yaml | 29 - .../logging-demo/synthetic_10lps.yaml | 30 - release-0.19.0/examples/meteor/README.md | 171 - .../examples/meteor/dockerbase/Dockerfile | 18 - .../examples/meteor/dockerbase/README.md | 15 - .../examples/meteor/meteor-controller.json | 40 - .../examples/meteor/meteor-service.json | 21 - release-0.19.0/examples/meteor/mongo-pod.json | 42 - .../examples/meteor/mongo-service.json | 23 - .../examples/mysql-wordpress-pd/README.md | 314 - .../mysql-wordpress-pd/mysql-service.yaml | 13 - .../examples/mysql-wordpress-pd/mysql.yaml | 31 - .../mysql-wordpress-pd/wordpress-service.yaml | 14 - .../mysql-wordpress-pd/wordpress.yaml | 28 - release-0.19.0/examples/nfs/README.md | 43 - .../examples/nfs/exporter/Dockerfile | 11 - .../examples/nfs/exporter/README.md | 16 - release-0.19.0/examples/nfs/exporter/run_nfs | 72 - .../examples/nfs/nfs-data/Dockerfile | 5 - .../examples/nfs/nfs-data/README.md | 12 - .../examples/nfs/nfs-data/index.html | 1 - .../examples/nfs/nfs-server-pod.yaml | 15 - .../examples/nfs/nfs-server-service.yaml | 9 - release-0.19.0/examples/nfs/nfs-web-pod.yaml | 27 - .../examples/node-selection/README.md | 66 - .../examples/node-selection/pod.yaml | 13 - .../examples/openshift-origin/.gitignore | 2 - .../examples/openshift-origin/README.md | 161 - .../examples/openshift-origin/cleanup.sh | 25 - .../examples/openshift-origin/create.sh | 31 - .../openshift-controller.yaml | 33 - .../openshift-origin/openshift-service.yaml | 12 - .../examples/persistent-volumes/README.md | 117 - .../persistent-volumes/claims/claim-01.yaml | 10 - .../persistent-volumes/claims/claim-02.yaml | 10 - .../persistent-volumes/claims/claim-03.json | 17 - .../simpletest/namespace.json | 10 - .../persistent-volumes/simpletest/pod.yaml | 20 - .../simpletest/service.json | 19 - .../persistent-volumes/volumes/gce.yaml | 13 - .../persistent-volumes/volumes/local-01.yaml | 13 - .../persistent-volumes/volumes/local-02.yaml | 14 - .../persistent-volumes/volumes/nfs.yaml | 12 - release-0.19.0/examples/phabricator/README.md | 224 - .../phabricator/authenticator-controller.json | 31 - .../cloudsql-authenticator/Dockerfile | 8 - .../phabricator/cloudsql-authenticator/run.sh | 32 - .../phabricator/phabricator-controller.json | 37 - .../phabricator/phabricator-service.json | 22 - .../php-phabricator/000-default.conf | 12 - .../phabricator/php-phabricator/Dockerfile | 26 - .../phabricator/php-phabricator/run.sh | 28 - release-0.19.0/examples/phabricator/setup.sh | 21 - .../examples/phabricator/teardown.sh | 22 - release-0.19.0/examples/pod.yaml | 16 - release-0.19.0/examples/rbd/README.md | 50 - .../examples/rbd/secret/ceph-secret.yaml | 6 - .../examples/rbd/v1beta3/rbd-with-secret.json | 42 - release-0.19.0/examples/rbd/v1beta3/rbd.json | 40 - release-0.19.0/examples/redis/README.md | 120 - .../examples/redis/image/Dockerfile | 11 - .../examples/redis/image/redis-master.conf | 827 -- .../examples/redis/image/redis-slave.conf | 827 -- release-0.19.0/examples/redis/image/run.sh | 84 - .../examples/redis/redis-controller.yaml | 28 - .../examples/redis/redis-master.yaml | 33 - .../examples/redis/redis-proxy.yaml | 14 - .../redis/redis-sentinel-controller.yaml | 23 - .../redis/redis-sentinel-service.yaml | 13 - release-0.19.0/examples/replication.yaml | 23 - .../examples/resourcequota/README.md | 155 - .../examples/resourcequota/limits.yaml | 10 - .../examples/resourcequota/namespace.yaml | 4 - .../examples/resourcequota/quota.yaml | 14 - release-0.19.0/examples/rethinkdb/README.md | 138 - .../examples/rethinkdb/admin-pod.yaml | 25 - .../examples/rethinkdb/admin-service.yaml | 15 - .../examples/rethinkdb/driver-service.yaml | 13 - release-0.19.0/examples/rethinkdb/gen-pod.sh | 73 - .../examples/rethinkdb/image/Dockerfile | 14 - .../examples/rethinkdb/image/run.sh | 37 - release-0.19.0/examples/rethinkdb/rc.yaml | 34 - release-0.19.0/examples/secrets/README.md | 52 - .../examples/secrets/secret-pod.yaml | 18 - release-0.19.0/examples/secrets/secret.yaml | 7 - release-0.19.0/examples/simple-nginx.md | 50 - release-0.19.0/examples/simple-yaml.md | 95 - release-0.19.0/examples/spark/README.md | 177 - .../examples/spark/spark-master-service.json | 21 - .../examples/spark/spark-master.json | 28 - .../spark/spark-worker-controller.json | 43 - release-0.19.0/examples/storm/README.md | 174 - .../examples/storm/storm-nimbus-service.json | 21 - .../examples/storm/storm-nimbus.json | 28 - .../storm/storm-worker-controller.json | 55 - .../examples/storm/zookeeper-service.json | 21 - release-0.19.0/examples/storm/zookeeper.json | 28 - release-0.19.0/examples/update-demo/README.md | 121 - .../examples/update-demo/build-images.sh | 30 - .../update-demo/images/kitten/Dockerfile | 17 - .../update-demo/images/kitten/html/data.json | 3 - .../update-demo/images/kitten/html/kitten.jpg | Bin 14769 -> 0 bytes .../update-demo/images/nautilus/Dockerfile | 17 - .../images/nautilus/html/data.json | 3 - .../images/nautilus/html/nautilus.jpg | Bin 21231 -> 0 bytes .../examples/update-demo/kitten-rc.yaml | 20 - .../update-demo/local/LICENSE.angular | 21 - .../examples/update-demo/local/angular.min.js | 210 - .../update-demo/local/angular.min.js.map | 8 - .../examples/update-demo/local/index.html | 36 - .../examples/update-demo/local/script.js | 100 - .../examples/update-demo/local/style.css | 40 - .../examples/update-demo/nautilus-rc.yaml | 21 - release-0.19.0/examples/walkthrough/README.md | 118 - release-0.19.0/examples/walkthrough/k8s201.md | 157 - .../pod-with-http-healthcheck.yaml | 20 - release-0.19.0/examples/walkthrough/pod1.yaml | 8 - release-0.19.0/examples/walkthrough/pod2.yaml | 16 - .../examples/walkthrough/podtemplate.json | 22 - .../walkthrough/replication-controller.yaml | 24 - .../examples/walkthrough/service.yaml | 16 - release-0.20.0/docs/.files_generated | 28 - release-0.20.0/docs/README.md | 30 - release-0.20.0/docs/accessing-the-cluster.md | 251 - release-0.20.0/docs/accessing_the_api.md | 81 - release-0.20.0/docs/admission_controllers.md | 112 - release-0.20.0/docs/annotations.md | 31 - release-0.20.0/docs/api-conventions.md | 598 -- release-0.20.0/docs/api.md | 78 - .../docs/application-troubleshooting.md | 149 - release-0.20.0/docs/architecture.dia | Bin 6522 -> 0 bytes release-0.20.0/docs/architecture.png | Bin 222407 -> 0 bytes release-0.20.0/docs/architecture.svg | 499 -- release-0.20.0/docs/authentication.md | 46 - release-0.20.0/docs/authorization.md | 109 - release-0.20.0/docs/availability.md | 136 - release-0.20.0/docs/cli-roadmap.md | 84 - release-0.20.0/docs/client-libraries.md | 21 - release-0.20.0/docs/cluster-admin-guide.md | 80 - .../docs/cluster-troubleshooting.md | 33 - release-0.20.0/docs/cluster_management.md | 65 - release-0.20.0/docs/container-environment.md | 94 - release-0.20.0/docs/containers.md | 95 - release-0.20.0/docs/design/README.md | 23 - release-0.20.0/docs/design/access.md | 254 - .../docs/design/admission_control.md | 85 - .../design/admission_control_limit_range.md | 138 - .../admission_control_resource_quota.md | 159 - release-0.20.0/docs/design/architecture.md | 50 - release-0.20.0/docs/design/clustering.md | 66 - .../docs/design/clustering/.gitignore | 1 - .../docs/design/clustering/Dockerfile | 12 - .../docs/design/clustering/Makefile | 29 - .../docs/design/clustering/README.md | 31 - .../docs/design/clustering/dynamic.png | Bin 72373 -> 0 bytes .../docs/design/clustering/dynamic.seqdiag | 24 - .../docs/design/clustering/static.png | Bin 36583 -> 0 bytes .../docs/design/clustering/static.seqdiag | 16 - .../command_execution_port_forwarding.md | 149 - .../docs/design/event_compression.md | 84 - release-0.20.0/docs/design/expansion.md | 391 - release-0.20.0/docs/design/identifiers.md | 96 - release-0.20.0/docs/design/namespaces.md | 340 - release-0.20.0/docs/design/networking.md | 114 - .../docs/design/persistent-storage.md | 220 - release-0.20.0/docs/design/principles.md | 61 - release-0.20.0/docs/design/secrets.md | 582 -- release-0.20.0/docs/design/security.md | 123 - .../docs/design/security_context.md | 163 - .../docs/design/service_accounts.md | 170 - .../docs/design/simple-rolling-update.md | 97 - release-0.20.0/docs/devel/README.md | 37 - release-0.20.0/docs/devel/api_changes.md | 348 - .../docs/devel/coding-conventions.md | 13 - release-0.20.0/docs/devel/collab.md | 46 - .../docs/devel/developer-guides/vagrant.md | 341 - release-0.20.0/docs/devel/development.md | 292 - release-0.20.0/docs/devel/faster_reviews.md | 183 - release-0.20.0/docs/devel/flaky-tests.md | 68 - release-0.20.0/docs/devel/git_workflow.png | Bin 90004 -> 0 bytes release-0.20.0/docs/devel/instrumentation.md | 39 - release-0.20.0/docs/devel/issues.md | 25 - release-0.20.0/docs/devel/logging.md | 32 - .../docs/devel/making-release-notes.md | 36 - release-0.20.0/docs/devel/profiling.md | 40 - release-0.20.0/docs/devel/pull-requests.md | 34 - release-0.20.0/docs/devel/releasing.dot | 113 - release-0.20.0/docs/devel/releasing.md | 171 - release-0.20.0/docs/devel/releasing.png | Bin 30693 -> 0 bytes release-0.20.0/docs/devel/releasing.svg | 113 - .../devel/writing-a-getting-started-guide.md | 105 - release-0.20.0/docs/developer-guide.md | 41 - release-0.20.0/docs/dns.md | 44 - release-0.20.0/docs/downward_api.md | 53 - .../docs/getting-started-guides/README.md | 66 - .../docs/getting-started-guides/all-lines.png | Bin 226552 -> 0 bytes .../docs/getting-started-guides/aws-coreos.md | 220 - .../docs/getting-started-guides/aws.md | 102 - .../aws/cloud-configs/master.yaml | 177 - .../aws/cloud-configs/node.yaml | 81 - .../aws/cloudformation-template.json | 421 - .../getting-started-guides/aws/kubectl.md | 27 - .../docs/getting-started-guides/azure.md | 65 - .../bigquery-logging.png | Bin 57417 -> 0 bytes .../getting-started-guides/binary_release.md | 29 - .../centos/centos_manual_config.md | 178 - .../cloud-logging-console.png | Bin 87825 -> 0 bytes .../docs/getting-started-guides/cloudstack.md | 97 - .../docs/getting-started-guides/coreos.md | 18 - .../coreos/azure/.gitignore | 1 - .../coreos/azure/README.md | 210 - .../influxdb/grafana-service.yaml | 14 - .../influxdb/heapster-controller.yaml | 24 - .../influxdb/influxdb-grafana-controller.yaml | 35 - .../influxdb/influxdb-service.yaml | 17 - .../fluentd-elasticsearch/es-controller.yaml | 37 - .../fluentd-elasticsearch/es-service.yaml | 16 - .../kibana-controller.yaml | 31 - .../fluentd-elasticsearch/kibana-service.yaml | 17 - .../coreos/azure/azure-login.js | 3 - .../kubernetes-cluster-etcd-node-template.yml | 60 - ...kubernetes-cluster-main-nodes-template.yml | 388 - .../coreos/azure/create-kubernetes-cluster.js | 15 - .../coreos/azure/destroy-cluster.js | 7 - .../coreos/azure/external_access.png | Bin 292367 -> 0 bytes .../coreos/azure/initial_cluster.png | Bin 173212 -> 0 bytes .../coreos/azure/lib/azure_wrapper.js | 271 - .../coreos/azure/lib/cloud_config.js | 43 - .../azure/lib/deployment_logic/kubernetes.js | 76 - .../coreos/azure/lib/util.js | 33 - .../coreos/azure/package.json | 19 - .../coreos/azure/scale-kubernetes-cluster.js | 10 - .../coreos/bare_metal_offline.md | 663 -- .../coreos/cloud-configs/master.yaml | 180 - .../coreos/cloud-configs/node.yaml | 105 - .../coreos/cloud-configs/standalone.yaml | 168 - .../coreos/coreos_multinode_cluster.md | 142 - .../coreos/coreos_single_node_cluster.md | 66 - .../docker-multinode.md | 58 - .../docker-multinode/master.md | 149 - .../docker-multinode/testing.md | 63 - .../docker-multinode/worker.md | 114 - .../docs/getting-started-guides/docker.md | 105 - .../getting-started-guides/es-browser.png | Bin 40769 -> 0 bytes .../fedora/fedora_ansible_config.md | 249 - .../fedora/fedora_manual_config.md | 199 - .../fedora/flannel_multi_node_cluster.md | 183 - .../docs/getting-started-guides/gce.md | 204 - .../docs/getting-started-guides/juju.md | 239 - .../getting-started-guides/k8s-docker.png | Bin 52545 -> 0 bytes .../k8s-singlenode-docker.png | Bin 31801 -> 0 bytes .../getting-started-guides/kibana-logs.png | Bin 183775 -> 0 bytes .../getting-started-guides/libvirt-coreos.md | 274 - .../docs/getting-started-guides/locally.md | 137 - .../logging-elasticsearch.md | 234 - .../docs/getting-started-guides/logging.md | 199 - .../docs/getting-started-guides/mesos.md | 324 - .../mesos/k8s-firewall.png | Bin 88722 -> 0 bytes .../mesos/k8s-guestbook.png | Bin 44000 -> 0 bytes .../docs/getting-started-guides/ovirt.md | 60 - .../docs/getting-started-guides/rackspace.md | 71 - .../docs/getting-started-guides/rkt/README.md | 95 - .../docs/getting-started-guides/ubuntu.md | 191 - .../docs/getting-started-guides/vagrant.md | 337 - .../docs/getting-started-guides/vsphere.md | 94 - release-0.20.0/docs/glossary.md | 61 - release-0.20.0/docs/identifiers.md | 16 - release-0.20.0/docs/images.md | 159 - release-0.20.0/docs/kibana.png | Bin 82617 -> 0 bytes release-0.20.0/docs/kubeconfig-file.md | 155 - release-0.20.0/docs/kubectl.md | 73 - release-0.20.0/docs/kubectl_api-versions.md | 57 - release-0.20.0/docs/kubectl_cluster-info.md | 57 - release-0.20.0/docs/kubectl_config.md | 70 - .../docs/kubectl_config_set-cluster.md | 72 - .../docs/kubectl_config_set-context.md | 65 - .../docs/kubectl_config_set-credentials.md | 85 - release-0.20.0/docs/kubectl_config_set.md | 59 - release-0.20.0/docs/kubectl_config_unset.md | 58 - .../docs/kubectl_config_use-context.md | 57 - release-0.20.0/docs/kubectl_config_view.md | 77 - release-0.20.0/docs/kubectl_create.md | 70 - release-0.20.0/docs/kubectl_delete.md | 92 - release-0.20.0/docs/kubectl_describe.md | 74 - release-0.20.0/docs/kubectl_exec.md | 75 - release-0.20.0/docs/kubectl_expose.md | 91 - release-0.20.0/docs/kubectl_get.md | 96 - release-0.20.0/docs/kubectl_label.md | 89 - release-0.20.0/docs/kubectl_logs.md | 73 - release-0.20.0/docs/kubectl_namespace.md | 60 - release-0.20.0/docs/kubectl_port-forward.md | 75 - release-0.20.0/docs/kubectl_proxy.md | 92 - release-0.20.0/docs/kubectl_rolling-update.md | 91 - release-0.20.0/docs/kubectl_run.md | 86 - release-0.20.0/docs/kubectl_scale.md | 75 - release-0.20.0/docs/kubectl_stop.md | 82 - release-0.20.0/docs/kubectl_update.md | 74 - release-0.20.0/docs/kubectl_version.md | 58 - release-0.20.0/docs/labels.md | 110 - release-0.20.0/docs/logging.md | 74 - release-0.20.0/docs/man/Dockerfile | 7 - release-0.20.0/docs/man/README.md | 49 - release-0.20.0/docs/man/kube-apiserver.1.md | 198 - .../docs/man/kube-controller-manager.1.md | 141 - release-0.20.0/docs/man/kube-proxy.1.md | 78 - release-0.20.0/docs/man/kube-scheduler.1.md | 78 - release-0.20.0/docs/man/kubelet.1.md | 253 - release-0.20.0/docs/man/man1/.files_generated | 28 - release-0.20.0/docs/man/man1/kube-apiserver.1 | 259 - .../docs/man/man1/kube-controller-manager.1 | 182 - release-0.20.0/docs/man/man1/kube-proxy.1 | 98 - release-0.20.0/docs/man/man1/kube-scheduler.1 | 98 - .../docs/man/man1/kubectl-api-versions.1 | 130 - .../docs/man/man1/kubectl-cluster-info.1 | 130 - .../man/man1/kubectl-config-set-cluster.1 | 153 - .../man/man1/kubectl-config-set-context.1 | 143 - .../man/man1/kubectl-config-set-credentials.1 | 169 - .../docs/man/man1/kubectl-config-set.1 | 132 - .../docs/man/man1/kubectl-config-unset.1 | 131 - .../man/man1/kubectl-config-use-context.1 | 130 - .../docs/man/man1/kubectl-config-view.1 | 181 - release-0.20.0/docs/man/man1/kubectl-config.1 | 136 - release-0.20.0/docs/man/man1/kubectl-create.1 | 152 - release-0.20.0/docs/man/man1/kubectl-delete.1 | 194 - .../docs/man/man1/kubectl-describe.1 | 156 - release-0.20.0/docs/man/man1/kubectl-exec.1 | 165 - release-0.20.0/docs/man/man1/kubectl-expose.1 | 222 - release-0.20.0/docs/man/man1/kubectl-get.1 | 204 - release-0.20.0/docs/man/man1/kubectl-label.1 | 193 - release-0.20.0/docs/man/man1/kubectl-logs.1 | 160 - .../docs/man/man1/kubectl-namespace.1 | 133 - .../docs/man/man1/kubectl-port-forward.1 | 156 - release-0.20.0/docs/man/man1/kubectl-proxy.1 | 203 - .../docs/man/man1/kubectl-rolling-update.1 | 207 - release-0.20.0/docs/man/man1/kubectl-run.1 | 201 - release-0.20.0/docs/man/man1/kubectl-scale.1 | 163 - release-0.20.0/docs/man/man1/kubectl-stop.1 | 179 - release-0.20.0/docs/man/man1/kubectl-update.1 | 159 - .../docs/man/man1/kubectl-version.1 | 134 - release-0.20.0/docs/man/man1/kubectl.1 | 132 - release-0.20.0/docs/man/man1/kubelet.1 | 339 - release-0.20.0/docs/man/md2man-all.sh | 41 - release-0.20.0/docs/namespaces.md | 13 - release-0.20.0/docs/networking.md | 183 - release-0.20.0/docs/node.md | 187 - release-0.20.0/docs/overview.md | 35 - release-0.20.0/docs/ovs-networking.md | 20 - release-0.20.0/docs/ovs-networking.png | Bin 71412 -> 0 bytes release-0.20.0/docs/pod-states.md | 111 - release-0.20.0/docs/pods.md | 85 - release-0.20.0/docs/proposals/autoscaling.md | 260 - .../proposals/federation-high-level-arch.png | Bin 31793 -> 0 bytes release-0.20.0/docs/proposals/federation.md | 437 - .../docs/proposals/high-availability.md | 52 - release-0.20.0/docs/replication-controller.md | 74 - release-0.20.0/docs/resource_quota_admin.md | 107 - release-0.20.0/docs/resources.md | 214 - release-0.20.0/docs/roadmap.md | 97 - release-0.20.0/docs/salt.md | 104 - release-0.20.0/docs/secrets.md | 470 -- release-0.20.0/docs/security_context.md | 9 - release-0.20.0/docs/service_accounts.md | 96 - release-0.20.0/docs/service_accounts_admin.md | 87 - release-0.20.0/docs/services-firewalls.md | 40 - release-0.20.0/docs/services.md | 470 -- release-0.20.0/docs/services_detail.png | Bin 68514 -> 0 bytes release-0.20.0/docs/services_detail.svg | 570 -- release-0.20.0/docs/services_overview.png | Bin 43306 -> 0 bytes release-0.20.0/docs/services_overview.svg | 417 - release-0.20.0/docs/sharing-clusters.md | 112 - release-0.20.0/docs/troubleshooting.md | 10 - release-0.20.0/docs/ui.md | 23 - release-0.20.0/docs/user-guide.md | 110 - release-0.20.0/docs/versioning.md | 51 - release-0.20.0/docs/volumes.md | 110 - release-0.20.0/docs/working_with_resources.md | 64 - release-0.20.0/examples/README.md | 17 - release-0.20.0/examples/aws_ebs/README.md | 23 - .../examples/aws_ebs/aws-ebs-web.yaml | 21 - .../examples/blog-logging/counter-pod.yaml | 12 - .../examples/blog-logging/diagrams/0f64.ai | 6585 --------------- .../examples/blog-logging/diagrams/0f64.png | Bin 33414 -> 0 bytes .../examples/blog-logging/diagrams/0f64.svg | 842 -- .../examples/blog-logging/diagrams/20ej.ai | 6462 --------------- .../examples/blog-logging/diagrams/20ej.png | Bin 38533 -> 0 bytes .../examples/blog-logging/diagrams/20ej.svg | 956 --- .../blog-logging/diagrams/27gf-counter.ai | 6819 ---------------- .../blog-logging/diagrams/27gf-counter.png | Bin 41970 -> 0 bytes .../blog-logging/diagrams/27gf-counter.svg | 1312 --- .../examples/blog-logging/diagrams/27gf.ai | 6593 --------------- .../examples/blog-logging/diagrams/27gf.png | Bin 33205 -> 0 bytes .../examples/blog-logging/diagrams/27gf.svg | 842 -- .../examples/blog-logging/diagrams/README.md | 7 - .../blog-logging/diagrams/cloud-logging.ai | 7214 ----------------- .../blog-logging/diagrams/cloud-logging.png | Bin 144101 -> 0 bytes .../blog-logging/diagrams/cloud-logging.svg | 4295 ---------- .../examples/blog-logging/diagrams/pk22.ai | 6650 --------------- .../examples/blog-logging/diagrams/pk22.png | Bin 51028 -> 0 bytes .../examples/blog-logging/diagrams/pk22.svg | 1317 --- release-0.20.0/examples/cassandra/README.md | 264 - .../cassandra/cassandra-controller.yaml | 39 - .../examples/cassandra/cassandra-service.yaml | 11 - .../examples/cassandra/cassandra.yaml | 31 - .../examples/cassandra/image/Dockerfile | 22 - .../examples/cassandra/image/cassandra.list | 3 - .../examples/cassandra/image/cassandra.yaml | 764 -- .../cassandra/image/kubernetes-cassandra.jar | Bin 8418 -> 0 bytes .../examples/cassandra/image/run.sh | 19 - .../examples/cassandra/java/pom.xml | 47 - .../k8s/cassandra/KubernetesSeedProvider.java | 149 - .../examples/celery-rabbitmq/README.md | 233 - .../celery-rabbitmq/celery-app-add/Dockerfile | 9 - .../celery-app-add/celery_conf.py | 29 - .../celery-rabbitmq/celery-app-add/run.sh | 21 - .../celery-app-add/run_tasks.py | 29 - .../celery-rabbitmq/celery-controller.yaml | 24 - .../celery-rabbitmq/flower-controller.yaml | 25 - .../celery-rabbitmq/flower/Dockerfile | 15 - .../celery-rabbitmq/flower/run_flower.sh | 17 - .../celery-rabbitmq/rabbitmq-controller.yaml | 24 - .../celery-rabbitmq/rabbitmq-service.yaml | 12 - release-0.20.0/examples/cluster-dns/README.md | 183 - .../examples/cluster-dns/dns-backend-rc.yaml | 21 - .../cluster-dns/dns-backend-service.yaml | 9 - .../cluster-dns/dns-frontend-pod.yaml | 16 - .../cluster-dns/images/backend/Dockerfile | 6 - .../cluster-dns/images/backend/server.py | 37 - .../cluster-dns/images/frontend/Dockerfile | 8 - .../cluster-dns/images/frontend/client.py | 46 - .../examples/cluster-dns/namespace-dev.yaml | 6 - .../examples/cluster-dns/namespace-prod.yaml | 6 - release-0.20.0/examples/doc.go | 18 - .../examples/downward-api/README.md | 39 - .../examples/downward-api/dapi-pod.yaml | 19 - .../examples/elasticsearch/Dockerfile | 18 - .../examples/elasticsearch/Makefile | 14 - .../examples/elasticsearch/README.md | 324 - .../elasticsearch/apiserver-secret.yaml | 8 - .../examples/elasticsearch/elasticsearch.yml | 385 - .../elasticsearch/elasticsearch_discovery.go | 97 - .../examples/elasticsearch/music-rc.yaml | 39 - .../examples/elasticsearch/music-service.yaml | 15 - release-0.20.0/examples/elasticsearch/run.sh | 25 - .../examples/environment-guide/README.md | 95 - .../environment-guide/backend-rc.yaml | 30 - .../environment-guide/backend-srv.yaml | 13 - .../environment-guide/containers/README.md | 26 - .../containers/backend/Dockerfile | 2 - .../containers/backend/backend.go | 37 - .../containers/show/Dockerfile | 2 - .../environment-guide/containers/show/show.go | 95 - .../examples/environment-guide/diagram.png | Bin 18765 -> 0 bytes .../examples/environment-guide/show-rc.yaml | 32 - .../examples/environment-guide/show-srv.yaml | 15 - release-0.20.0/examples/examples_test.go | 438 - release-0.20.0/examples/explorer/Dockerfile | 20 - release-0.20.0/examples/explorer/Makefile | 16 - release-0.20.0/examples/explorer/README.md | 133 - release-0.20.0/examples/explorer/explorer.go | 122 - release-0.20.0/examples/explorer/pod.json | 36 - release-0.20.0/examples/glusterfs/README.md | 88 - .../glusterfs/glusterfs-endpoints.json | 33 - .../examples/glusterfs/glusterfs-pod.json | 32 - .../examples/guestbook-go/README.md | 223 - .../guestbook-go/guestbook-controller.json | 37 - .../examples/guestbook-go/guestbook-page.png | Bin 40028 -> 0 bytes .../guestbook-go/guestbook-service.json | 22 - .../guestbook-go/redis-master-controller.json | 41 - .../guestbook-go/redis-master-service.json | 23 - .../guestbook-go/redis-slave-controller.json | 46 - .../guestbook-go/redis-slave-service.json | 23 - release-0.20.0/examples/guestbook/README.md | 546 -- .../guestbook/frontend-controller.yaml | 20 - .../examples/guestbook/frontend-service.yaml | 15 - .../examples/guestbook/php-redis/Dockerfile | 7 - .../guestbook/php-redis/controllers.js | 29 - .../examples/guestbook/php-redis/index.html | 25 - .../examples/guestbook/php-redis/index.php | 33 - .../guestbook/redis-master-controller.yaml | 20 - .../guestbook/redis-master-service.yaml | 13 - .../guestbook/redis-slave-controller.yaml | 20 - .../guestbook/redis-slave-service.yaml | 12 - .../examples/guestbook/redis-slave/Dockerfile | 7 - .../examples/guestbook/redis-slave/run.sh | 17 - release-0.20.0/examples/hazelcast/Dockerfile | 11 - release-0.20.0/examples/hazelcast/README.md | 214 - .../hazelcast/hazelcast-controller.yaml | 27 - .../examples/hazelcast/hazelcast-service.yaml | 11 - release-0.20.0/examples/iscsi/README.md | 75 - release-0.20.0/examples/iscsi/iscsi.json | 53 - release-0.20.0/examples/k8petstore/README.md | 115 - .../examples/k8petstore/Vagrantfile | 37 - .../k8petstore/bps-data-generator/README.md | 21 - .../k8petstore/build-push-containers.sh | 29 - release-0.20.0/examples/k8petstore/dev/README | 35 - .../examples/k8petstore/dev/Vagrantfile | 44 - .../examples/k8petstore/dev/hosts/Vagrantfile | 11 - .../examples/k8petstore/dev/test.sh | 47 - .../k8petstore/k8petstore-loadbalancer.sh | 305 - .../k8petstore/k8petstore-nodeport.sh | 322 - .../examples/k8petstore/k8petstore.dot | 9 - .../examples/k8petstore/k8petstore.sh | 297 - .../k8petstore/redis-master/Dockerfile | 17 - .../redis-master/etc_redis_redis.conf | 46 - .../k8petstore/redis-slave/Dockerfile | 15 - .../redis-slave/etc_redis_redis.conf | 46 - .../examples/k8petstore/redis-slave/run.sh | 30 - .../examples/k8petstore/redis/Dockerfile | 45 - .../k8petstore/redis/etc_redis_redis.conf | 46 - .../examples/k8petstore/web-server/Dockerfile | 21 - .../k8petstore/web-server/PetStoreBook.go | 204 - .../examples/k8petstore/web-server/dump.rdb | Bin 88 -> 0 bytes .../k8petstore/web-server/static/histogram.js | 39 - .../k8petstore/web-server/static/index.html | 47 - .../k8petstore/web-server/static/script.js | 72 - .../k8petstore/web-server/static/style.css | 69 - .../examples/k8petstore/web-server/test.sh | 25 - .../examples/kubectl-container/.gitignore | 2 - .../examples/kubectl-container/Dockerfile | 18 - .../examples/kubectl-container/Makefile | 30 - .../examples/kubectl-container/README.md | 24 - .../examples/kubectl-container/pod.json | 53 - .../examples/kubernetes-namespaces/README.md | 255 - .../kubernetes-namespaces/namespace-dev.json | 10 - .../kubernetes-namespaces/namespace-prod.json | 10 - release-0.20.0/examples/limitrange/README.md | 7 - .../examples/limitrange/invalid-pod.json | 22 - .../examples/limitrange/limit-range.json | 37 - .../examples/limitrange/valid-pod.json | 22 - release-0.20.0/examples/liveness/README.md | 82 - .../examples/liveness/exec-liveness.yaml | 21 - .../examples/liveness/http-liveness.yaml | 18 - .../examples/liveness/image/Dockerfile | 4 - .../examples/liveness/image/Makefile | 13 - .../examples/liveness/image/server.go | 46 - release-0.20.0/examples/logging-demo/Makefile | 34 - .../examples/logging-demo/README.md | 220 - .../examples/logging-demo/synth-logger.png | Bin 89284 -> 0 bytes .../logging-demo/synthetic_0_25lps.yaml | 30 - .../logging-demo/synthetic_10lps.yaml | 30 - release-0.20.0/examples/meteor/README.md | 205 - .../examples/meteor/dockerbase/Dockerfile | 18 - .../examples/meteor/dockerbase/README.md | 15 - .../examples/meteor/meteor-controller.json | 40 - .../examples/meteor/meteor-service.json | 20 - release-0.20.0/examples/meteor/mongo-pod.json | 42 - .../examples/meteor/mongo-service.json | 23 - .../examples/mysql-wordpress-pd/README.md | 306 - .../mysql-wordpress-pd/mysql-service.yaml | 13 - .../examples/mysql-wordpress-pd/mysql.yaml | 31 - .../mysql-wordpress-pd/wordpress-service.yaml | 14 - .../mysql-wordpress-pd/wordpress.yaml | 28 - release-0.20.0/examples/nfs/README.md | 56 - .../examples/nfs/exporter/Dockerfile | 11 - .../examples/nfs/exporter/README.md | 16 - release-0.20.0/examples/nfs/exporter/run_nfs | 72 - .../examples/nfs/nfs-data/Dockerfile | 5 - .../examples/nfs/nfs-data/README.md | 12 - .../examples/nfs/nfs-data/index.html | 1 - .../examples/nfs/nfs-server-pod.yaml | 15 - .../examples/nfs/nfs-server-service.yaml | 9 - release-0.20.0/examples/nfs/nfs-web-pod.yaml | 25 - .../examples/node-selection/README.md | 66 - .../examples/node-selection/pod.yaml | 13 - .../examples/openshift-origin/.gitignore | 2 - .../examples/openshift-origin/README.md | 161 - .../examples/openshift-origin/cleanup.sh | 25 - .../examples/openshift-origin/create.sh | 31 - .../openshift-controller.yaml | 33 - .../openshift-origin/openshift-service.yaml | 12 - .../examples/persistent-volumes/README.md | 117 - .../persistent-volumes/claims/claim-01.yaml | 10 - .../persistent-volumes/claims/claim-02.yaml | 10 - .../persistent-volumes/claims/claim-03.json | 17 - .../simpletest/namespace.json | 10 - .../persistent-volumes/simpletest/pod.yaml | 20 - .../simpletest/service.json | 19 - .../persistent-volumes/volumes/gce.yaml | 13 - .../persistent-volumes/volumes/local-01.yaml | 13 - .../persistent-volumes/volumes/local-02.yaml | 14 - .../persistent-volumes/volumes/nfs.yaml | 12 - release-0.20.0/examples/phabricator/README.md | 229 - .../phabricator/authenticator-controller.json | 31 - .../cloudsql-authenticator/Dockerfile | 8 - .../phabricator/cloudsql-authenticator/run.sh | 32 - .../phabricator/phabricator-controller.json | 37 - .../phabricator/phabricator-service.json | 19 - .../php-phabricator/000-default.conf | 12 - .../phabricator/php-phabricator/Dockerfile | 26 - .../phabricator/php-phabricator/run.sh | 28 - release-0.20.0/examples/phabricator/setup.sh | 21 - .../examples/phabricator/teardown.sh | 22 - release-0.20.0/examples/pod.yaml | 12 - release-0.20.0/examples/rbd/README.md | 51 - .../examples/rbd/rbd-with-secret.json | 42 - release-0.20.0/examples/rbd/rbd.json | 40 - .../examples/rbd/secret/ceph-secret.yaml | 6 - release-0.20.0/examples/redis/README.md | 120 - .../examples/redis/image/Dockerfile | 11 - .../examples/redis/image/redis-master.conf | 827 -- .../examples/redis/image/redis-slave.conf | 827 -- release-0.20.0/examples/redis/image/run.sh | 84 - .../examples/redis/redis-controller.yaml | 28 - .../examples/redis/redis-master.yaml | 33 - .../examples/redis/redis-proxy.yaml | 14 - .../redis/redis-sentinel-controller.yaml | 23 - .../redis/redis-sentinel-service.yaml | 13 - release-0.20.0/examples/replication.yaml | 19 - .../examples/resourcequota/README.md | 155 - .../examples/resourcequota/limits.yaml | 10 - .../examples/resourcequota/namespace.yaml | 4 - .../examples/resourcequota/quota.yaml | 14 - release-0.20.0/examples/rethinkdb/README.md | 138 - .../examples/rethinkdb/admin-pod.yaml | 25 - .../examples/rethinkdb/admin-service.yaml | 15 - .../examples/rethinkdb/driver-service.yaml | 13 - release-0.20.0/examples/rethinkdb/gen-pod.sh | 73 - .../examples/rethinkdb/image/Dockerfile | 14 - .../examples/rethinkdb/image/run.sh | 37 - release-0.20.0/examples/rethinkdb/rc.yaml | 34 - release-0.20.0/examples/secrets/README.md | 52 - .../examples/secrets/secret-pod.yaml | 18 - release-0.20.0/examples/secrets/secret.yaml | 7 - release-0.20.0/examples/simple-nginx.md | 56 - release-0.20.0/examples/simple-yaml.md | 87 - release-0.20.0/examples/spark/README.md | 177 - .../examples/spark/spark-master-service.json | 21 - .../examples/spark/spark-master.json | 28 - .../spark/spark-worker-controller.json | 43 - release-0.20.0/examples/storm/README.md | 174 - .../examples/storm/storm-nimbus-service.json | 20 - .../examples/storm/storm-nimbus.json | 28 - .../storm/storm-worker-controller.json | 55 - .../examples/storm/zookeeper-service.json | 20 - release-0.20.0/examples/storm/zookeeper.json | 28 - release-0.20.0/examples/update-demo/README.md | 121 - .../examples/update-demo/build-images.sh | 30 - .../update-demo/images/kitten/Dockerfile | 17 - .../update-demo/images/kitten/html/data.json | 3 - .../update-demo/images/kitten/html/kitten.jpg | Bin 14769 -> 0 bytes .../update-demo/images/nautilus/Dockerfile | 17 - .../images/nautilus/html/data.json | 3 - .../images/nautilus/html/nautilus.jpg | Bin 21231 -> 0 bytes .../examples/update-demo/kitten-rc.yaml | 21 - .../update-demo/local/LICENSE.angular | 21 - .../examples/update-demo/local/angular.min.js | 210 - .../update-demo/local/angular.min.js.map | 8 - .../examples/update-demo/local/index.html | 36 - .../examples/update-demo/local/script.js | 100 - .../examples/update-demo/local/style.css | 40 - .../examples/update-demo/nautilus-rc.yaml | 21 - release-0.20.0/examples/walkthrough/README.md | 118 - release-0.20.0/examples/walkthrough/k8s201.md | 157 - .../pod-with-http-healthcheck.yaml | 20 - release-0.20.0/examples/walkthrough/pod1.yaml | 8 - release-0.20.0/examples/walkthrough/pod2.yaml | 16 - .../examples/walkthrough/podtemplate.json | 22 - .../walkthrough/replication-controller.yaml | 24 - .../examples/walkthrough/service.yaml | 16 - 1052 files changed, 138426 deletions(-) delete mode 100644 release-0.19.0/docs/.files_generated delete mode 100644 release-0.19.0/docs/README.md delete mode 100644 release-0.19.0/docs/accessing-the-cluster.md delete mode 100644 release-0.19.0/docs/accessing_the_api.md delete mode 100644 release-0.19.0/docs/admission_controllers.md delete mode 100644 release-0.19.0/docs/annotations.md delete mode 100644 release-0.19.0/docs/api-conventions.md delete mode 100644 release-0.19.0/docs/api.md delete mode 100644 release-0.19.0/docs/architecture.dia delete mode 100644 release-0.19.0/docs/architecture.png delete mode 100644 release-0.19.0/docs/architecture.svg delete mode 100644 release-0.19.0/docs/authentication.md delete mode 100644 release-0.19.0/docs/authorization.md delete mode 100644 release-0.19.0/docs/availability.md delete mode 100644 release-0.19.0/docs/cli-roadmap.md delete mode 100644 release-0.19.0/docs/client-libraries.md delete mode 100644 release-0.19.0/docs/cluster-admin-guide.md delete mode 100644 release-0.19.0/docs/cluster_management.md delete mode 100644 release-0.19.0/docs/container-environment.md delete mode 100644 release-0.19.0/docs/containers.md delete mode 100644 release-0.19.0/docs/design/README.md delete mode 100644 release-0.19.0/docs/design/access.md delete mode 100644 release-0.19.0/docs/design/admission_control.md delete mode 100644 release-0.19.0/docs/design/admission_control_limit_range.md delete mode 100644 release-0.19.0/docs/design/admission_control_resource_quota.md delete mode 100644 release-0.19.0/docs/design/architecture.md delete mode 100644 release-0.19.0/docs/design/clustering.md delete mode 100644 release-0.19.0/docs/design/clustering/.gitignore delete mode 100644 release-0.19.0/docs/design/clustering/Dockerfile delete mode 100644 release-0.19.0/docs/design/clustering/Makefile delete mode 100644 release-0.19.0/docs/design/clustering/README.md delete mode 100644 release-0.19.0/docs/design/clustering/dynamic.png delete mode 100644 release-0.19.0/docs/design/clustering/dynamic.seqdiag delete mode 100644 release-0.19.0/docs/design/clustering/static.png delete mode 100644 release-0.19.0/docs/design/clustering/static.seqdiag delete mode 100644 release-0.19.0/docs/design/command_execution_port_forwarding.md delete mode 100644 release-0.19.0/docs/design/event_compression.md delete mode 100644 release-0.19.0/docs/design/expansion.md delete mode 100644 release-0.19.0/docs/design/identifiers.md delete mode 100644 release-0.19.0/docs/design/namespaces.md delete mode 100644 release-0.19.0/docs/design/networking.md delete mode 100644 release-0.19.0/docs/design/persistent-storage.md delete mode 100644 release-0.19.0/docs/design/principles.md delete mode 100644 release-0.19.0/docs/design/secrets.md delete mode 100644 release-0.19.0/docs/design/security.md delete mode 100644 release-0.19.0/docs/design/security_context.md delete mode 100644 release-0.19.0/docs/design/service_accounts.md delete mode 100644 release-0.19.0/docs/design/simple-rolling-update.md delete mode 100644 release-0.19.0/docs/devel/README.md delete mode 100644 release-0.19.0/docs/devel/api_changes.md delete mode 100644 release-0.19.0/docs/devel/coding-conventions.md delete mode 100644 release-0.19.0/docs/devel/collab.md delete mode 100644 release-0.19.0/docs/devel/developer-guides/vagrant.md delete mode 100644 release-0.19.0/docs/devel/development.md delete mode 100644 release-0.19.0/docs/devel/faster_reviews.md delete mode 100644 release-0.19.0/docs/devel/flaky-tests.md delete mode 100644 release-0.19.0/docs/devel/issues.md delete mode 100644 release-0.19.0/docs/devel/logging.md delete mode 100644 release-0.19.0/docs/devel/profiling.md delete mode 100644 release-0.19.0/docs/devel/pull-requests.md delete mode 100644 release-0.19.0/docs/devel/releasing.dot delete mode 100644 release-0.19.0/docs/devel/releasing.md delete mode 100644 release-0.19.0/docs/devel/releasing.png delete mode 100644 release-0.19.0/docs/devel/releasing.svg delete mode 100644 release-0.19.0/docs/devel/writing-a-getting-started-guide.md delete mode 100644 release-0.19.0/docs/developer-guide.md delete mode 100644 release-0.19.0/docs/dns.md delete mode 100644 release-0.19.0/docs/downward_api.md delete mode 100644 release-0.19.0/docs/getting-started-guides/README.md delete mode 100644 release-0.19.0/docs/getting-started-guides/aws-coreos.md delete mode 100644 release-0.19.0/docs/getting-started-guides/aws.md delete mode 100644 release-0.19.0/docs/getting-started-guides/aws/cloud-configs/master.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/aws/cloud-configs/node.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/aws/cloudformation-template.json delete mode 100644 release-0.19.0/docs/getting-started-guides/aws/kubectl.md delete mode 100644 release-0.19.0/docs/getting-started-guides/azure.md delete mode 100644 release-0.19.0/docs/getting-started-guides/binary_release.md delete mode 100644 release-0.19.0/docs/getting-started-guides/centos/centos_manual_config.md delete mode 100644 release-0.19.0/docs/getting-started-guides/cloudstack.md delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos.md delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/.gitignore delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/README.md delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/grafana-service.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/heapster-controller.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-service.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-controller.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-service.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-controller.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-service.yaml delete mode 100755 release-0.19.0/docs/getting-started-guides/coreos/azure/azure-login.js delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-etcd-node-template.yml delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-main-nodes-template.yml delete mode 100755 release-0.19.0/docs/getting-started-guides/coreos/azure/create-kubernetes-cluster.js delete mode 100755 release-0.19.0/docs/getting-started-guides/coreos/azure/destroy-cluster.js delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/external_access.png delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/initial_cluster.png delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/lib/azure_wrapper.js delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/lib/cloud_config.js delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/lib/deployment_logic/kubernetes.js delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/lib/util.js delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/azure/package.json delete mode 100755 release-0.19.0/docs/getting-started-guides/coreos/azure/scale-kubernetes-cluster.js delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/bare_metal_offline.md delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/master.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/node.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/standalone.yaml delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/coreos_multinode_cluster.md delete mode 100644 release-0.19.0/docs/getting-started-guides/coreos/coreos_single_node_cluster.md delete mode 100644 release-0.19.0/docs/getting-started-guides/docker-multinode.md delete mode 100644 release-0.19.0/docs/getting-started-guides/docker-multinode/master.md delete mode 100644 release-0.19.0/docs/getting-started-guides/docker-multinode/testing.md delete mode 100644 release-0.19.0/docs/getting-started-guides/docker-multinode/worker.md delete mode 100644 release-0.19.0/docs/getting-started-guides/docker.md delete mode 100644 release-0.19.0/docs/getting-started-guides/fedora/fedora_ansible_config.md delete mode 100644 release-0.19.0/docs/getting-started-guides/fedora/fedora_manual_config.md delete mode 100644 release-0.19.0/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md delete mode 100644 release-0.19.0/docs/getting-started-guides/gce.md delete mode 100644 release-0.19.0/docs/getting-started-guides/juju.md delete mode 100644 release-0.19.0/docs/getting-started-guides/k8s-docker.png delete mode 100644 release-0.19.0/docs/getting-started-guides/k8s-singlenode-docker.png delete mode 100644 release-0.19.0/docs/getting-started-guides/libvirt-coreos.md delete mode 100644 release-0.19.0/docs/getting-started-guides/locally.md delete mode 100644 release-0.19.0/docs/getting-started-guides/logging.md delete mode 100644 release-0.19.0/docs/getting-started-guides/mesos.md delete mode 100755 release-0.19.0/docs/getting-started-guides/mesos/k8s-firewall.png delete mode 100755 release-0.19.0/docs/getting-started-guides/mesos/k8s-guestbook.png delete mode 100644 release-0.19.0/docs/getting-started-guides/ovirt.md delete mode 100644 release-0.19.0/docs/getting-started-guides/rackspace.md delete mode 100644 release-0.19.0/docs/getting-started-guides/rkt/README.md delete mode 100644 release-0.19.0/docs/getting-started-guides/ubuntu.md delete mode 100644 release-0.19.0/docs/getting-started-guides/vagrant.md delete mode 100644 release-0.19.0/docs/getting-started-guides/vsphere.md delete mode 100644 release-0.19.0/docs/glossary.md delete mode 100644 release-0.19.0/docs/high-availability/default-kubelet delete mode 100644 release-0.19.0/docs/high-availability/init-kubelet delete mode 100644 release-0.19.0/docs/high-availability/monit-docker delete mode 100644 release-0.19.0/docs/high-availability/monit-kubelet delete mode 100644 release-0.19.0/docs/high-availability/podmaster.json delete mode 100644 release-0.19.0/docs/identifiers.md delete mode 100644 release-0.19.0/docs/images.md delete mode 100644 release-0.19.0/docs/kibana.png delete mode 100644 release-0.19.0/docs/kubeconfig-file.md delete mode 100644 release-0.19.0/docs/kubectl.md delete mode 100644 release-0.19.0/docs/kubectl_api-versions.md delete mode 100644 release-0.19.0/docs/kubectl_cluster-info.md delete mode 100644 release-0.19.0/docs/kubectl_config.md delete mode 100644 release-0.19.0/docs/kubectl_config_set-cluster.md delete mode 100644 release-0.19.0/docs/kubectl_config_set-context.md delete mode 100644 release-0.19.0/docs/kubectl_config_set-credentials.md delete mode 100644 release-0.19.0/docs/kubectl_config_set.md delete mode 100644 release-0.19.0/docs/kubectl_config_unset.md delete mode 100644 release-0.19.0/docs/kubectl_config_use-context.md delete mode 100644 release-0.19.0/docs/kubectl_config_view.md delete mode 100644 release-0.19.0/docs/kubectl_create.md delete mode 100644 release-0.19.0/docs/kubectl_delete.md delete mode 100644 release-0.19.0/docs/kubectl_describe.md delete mode 100644 release-0.19.0/docs/kubectl_exec.md delete mode 100644 release-0.19.0/docs/kubectl_expose.md delete mode 100644 release-0.19.0/docs/kubectl_get.md delete mode 100644 release-0.19.0/docs/kubectl_label.md delete mode 100644 release-0.19.0/docs/kubectl_logs.md delete mode 100644 release-0.19.0/docs/kubectl_namespace.md delete mode 100644 release-0.19.0/docs/kubectl_port-forward.md delete mode 100644 release-0.19.0/docs/kubectl_proxy.md delete mode 100644 release-0.19.0/docs/kubectl_rolling-update.md delete mode 100644 release-0.19.0/docs/kubectl_run.md delete mode 100644 release-0.19.0/docs/kubectl_scale.md delete mode 100644 release-0.19.0/docs/kubectl_stop.md delete mode 100644 release-0.19.0/docs/kubectl_update.md delete mode 100644 release-0.19.0/docs/kubectl_version.md delete mode 100644 release-0.19.0/docs/labels.md delete mode 100644 release-0.19.0/docs/logging.md delete mode 100644 release-0.19.0/docs/making-release-notes.md delete mode 100644 release-0.19.0/docs/man/Dockerfile delete mode 100644 release-0.19.0/docs/man/README.md delete mode 100644 release-0.19.0/docs/man/kube-apiserver.1.md delete mode 100644 release-0.19.0/docs/man/kube-controller-manager.1.md delete mode 100644 release-0.19.0/docs/man/kube-proxy.1.md delete mode 100644 release-0.19.0/docs/man/kube-scheduler.1.md delete mode 100644 release-0.19.0/docs/man/kubelet.1.md delete mode 100644 release-0.19.0/docs/man/man1/.files_generated delete mode 100644 release-0.19.0/docs/man/man1/kube-apiserver.1 delete mode 100644 release-0.19.0/docs/man/man1/kube-controller-manager.1 delete mode 100644 release-0.19.0/docs/man/man1/kube-proxy.1 delete mode 100644 release-0.19.0/docs/man/man1/kube-scheduler.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-api-versions.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-cluster-info.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-config-set-cluster.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-config-set-context.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-config-set-credentials.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-config-set.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-config-unset.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-config-use-context.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-config-view.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-config.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-create.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-delete.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-describe.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-exec.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-expose.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-get.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-label.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-logs.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-namespace.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-port-forward.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-proxy.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-rolling-update.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-run.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-scale.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-stop.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-update.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl-version.1 delete mode 100644 release-0.19.0/docs/man/man1/kubectl.1 delete mode 100644 release-0.19.0/docs/man/man1/kubelet.1 delete mode 100755 release-0.19.0/docs/man/md2man-all.sh delete mode 100644 release-0.19.0/docs/namespaces.md delete mode 100644 release-0.19.0/docs/networking.md delete mode 100644 release-0.19.0/docs/node.md delete mode 100644 release-0.19.0/docs/overview.md delete mode 100644 release-0.19.0/docs/ovs-networking.md delete mode 100644 release-0.19.0/docs/ovs-networking.png delete mode 100644 release-0.19.0/docs/pod-states.md delete mode 100644 release-0.19.0/docs/pods.md delete mode 100644 release-0.19.0/docs/proposals/autoscaling.md delete mode 100644 release-0.19.0/docs/proposals/federation-high-level-arch.png delete mode 100644 release-0.19.0/docs/proposals/federation.md delete mode 100644 release-0.19.0/docs/proposals/high-availability.md delete mode 100644 release-0.19.0/docs/replication-controller.md delete mode 100644 release-0.19.0/docs/resource_quota_admin.md delete mode 100644 release-0.19.0/docs/resources.md delete mode 100644 release-0.19.0/docs/roadmap.md delete mode 100644 release-0.19.0/docs/salt.md delete mode 100644 release-0.19.0/docs/secrets.md delete mode 100644 release-0.19.0/docs/security_context.md delete mode 100644 release-0.19.0/docs/service_accounts.md delete mode 100644 release-0.19.0/docs/services-firewalls.md delete mode 100644 release-0.19.0/docs/services.md delete mode 100644 release-0.19.0/docs/services_detail.png delete mode 100644 release-0.19.0/docs/services_detail.svg delete mode 100644 release-0.19.0/docs/services_overview.png delete mode 100644 release-0.19.0/docs/services_overview.svg delete mode 100644 release-0.19.0/docs/sharing-clusters.md delete mode 100644 release-0.19.0/docs/ui.md delete mode 100644 release-0.19.0/docs/user-guide.md delete mode 100644 release-0.19.0/docs/versioning.md delete mode 100644 release-0.19.0/docs/volumes.md delete mode 100644 release-0.19.0/examples/README.md delete mode 100644 release-0.19.0/examples/cassandra/README.md delete mode 100644 release-0.19.0/examples/cassandra/cassandra-controller.yaml delete mode 100644 release-0.19.0/examples/cassandra/cassandra-service.yaml delete mode 100644 release-0.19.0/examples/cassandra/cassandra.yaml delete mode 100644 release-0.19.0/examples/cassandra/image/Dockerfile delete mode 100644 release-0.19.0/examples/cassandra/image/cassandra.list delete mode 100644 release-0.19.0/examples/cassandra/image/cassandra.yaml delete mode 100644 release-0.19.0/examples/cassandra/image/kubernetes-cassandra.jar delete mode 100644 release-0.19.0/examples/cassandra/image/run.sh delete mode 100644 release-0.19.0/examples/cassandra/java/pom.xml delete mode 100644 release-0.19.0/examples/cassandra/java/src/io/k8s/cassandra/KubernetesSeedProvider.java delete mode 100644 release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$1.class delete mode 100644 release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$2.class delete mode 100644 release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$Address.class delete mode 100644 release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$Endpoints.class delete mode 100644 release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$Subset.class delete mode 100644 release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider.class delete mode 100644 release-0.19.0/examples/cassandra/java/target/kubernetes-cassandra-0.0.2.jar delete mode 100644 release-0.19.0/examples/cassandra/java/target/kubernetes-cassandra-0.0.3.jar delete mode 100644 release-0.19.0/examples/cassandra/java/target/maven-archiver/pom.properties delete mode 100644 release-0.19.0/examples/celery-rabbitmq/README.md delete mode 100644 release-0.19.0/examples/celery-rabbitmq/celery-app-add/Dockerfile delete mode 100644 release-0.19.0/examples/celery-rabbitmq/celery-app-add/celery_conf.py delete mode 100644 release-0.19.0/examples/celery-rabbitmq/celery-app-add/run.sh delete mode 100644 release-0.19.0/examples/celery-rabbitmq/celery-app-add/run_tasks.py delete mode 100644 release-0.19.0/examples/celery-rabbitmq/celery-controller.yaml delete mode 100644 release-0.19.0/examples/celery-rabbitmq/flower-controller.yaml delete mode 100644 release-0.19.0/examples/celery-rabbitmq/flower/Dockerfile delete mode 100644 release-0.19.0/examples/celery-rabbitmq/flower/run_flower.sh delete mode 100644 release-0.19.0/examples/celery-rabbitmq/rabbitmq-controller.yaml delete mode 100644 release-0.19.0/examples/celery-rabbitmq/rabbitmq-service.yaml delete mode 100644 release-0.19.0/examples/cluster-dns/README.md delete mode 100644 release-0.19.0/examples/cluster-dns/dns-backend-rc.yaml delete mode 100644 release-0.19.0/examples/cluster-dns/dns-backend-service.yaml delete mode 100644 release-0.19.0/examples/cluster-dns/dns-frontend-pod.yaml delete mode 100644 release-0.19.0/examples/cluster-dns/images/backend/Dockerfile delete mode 100644 release-0.19.0/examples/cluster-dns/images/backend/server.py delete mode 100644 release-0.19.0/examples/cluster-dns/images/frontend/Dockerfile delete mode 100644 release-0.19.0/examples/cluster-dns/images/frontend/client.py delete mode 100644 release-0.19.0/examples/cluster-dns/namespace-dev.yaml delete mode 100644 release-0.19.0/examples/cluster-dns/namespace-prod.yaml delete mode 100644 release-0.19.0/examples/doc.go delete mode 100644 release-0.19.0/examples/downward-api/README.md delete mode 100644 release-0.19.0/examples/downward-api/dapi-pod.yaml delete mode 100644 release-0.19.0/examples/elasticsearch/Dockerfile delete mode 100644 release-0.19.0/examples/elasticsearch/Makefile delete mode 100644 release-0.19.0/examples/elasticsearch/README.md delete mode 100644 release-0.19.0/examples/elasticsearch/apiserver-secret.yaml delete mode 100644 release-0.19.0/examples/elasticsearch/elasticsearch.yml delete mode 100644 release-0.19.0/examples/elasticsearch/elasticsearch_discovery.go delete mode 100644 release-0.19.0/examples/elasticsearch/music-rc.yaml delete mode 100644 release-0.19.0/examples/elasticsearch/music-service.yaml delete mode 100755 release-0.19.0/examples/elasticsearch/run.sh delete mode 100644 release-0.19.0/examples/environment-guide/README.md delete mode 100644 release-0.19.0/examples/environment-guide/backend-rc.yaml delete mode 100644 release-0.19.0/examples/environment-guide/backend-srv.yaml delete mode 100644 release-0.19.0/examples/environment-guide/containers/README.md delete mode 100644 release-0.19.0/examples/environment-guide/containers/backend/Dockerfile delete mode 100644 release-0.19.0/examples/environment-guide/containers/backend/backend.go delete mode 100644 release-0.19.0/examples/environment-guide/containers/show/Dockerfile delete mode 100644 release-0.19.0/examples/environment-guide/containers/show/show.go delete mode 100644 release-0.19.0/examples/environment-guide/diagram.png delete mode 100644 release-0.19.0/examples/environment-guide/show-rc.yaml delete mode 100644 release-0.19.0/examples/environment-guide/show-srv.yaml delete mode 100644 release-0.19.0/examples/examples_test.go delete mode 100644 release-0.19.0/examples/explorer/Dockerfile delete mode 100644 release-0.19.0/examples/explorer/Makefile delete mode 100644 release-0.19.0/examples/explorer/README.md delete mode 100644 release-0.19.0/examples/explorer/explorer.go delete mode 100644 release-0.19.0/examples/explorer/pod.json delete mode 100644 release-0.19.0/examples/glusterfs/README.md delete mode 100644 release-0.19.0/examples/glusterfs/glusterfs-endpoints.json delete mode 100644 release-0.19.0/examples/glusterfs/glusterfs-pod.json delete mode 100644 release-0.19.0/examples/guestbook-go/README.md delete mode 100644 release-0.19.0/examples/guestbook-go/guestbook-controller.json delete mode 100644 release-0.19.0/examples/guestbook-go/guestbook-service.json delete mode 100644 release-0.19.0/examples/guestbook-go/redis-master-controller.json delete mode 100644 release-0.19.0/examples/guestbook-go/redis-master-service.json delete mode 100644 release-0.19.0/examples/guestbook-go/redis-slave-controller.json delete mode 100644 release-0.19.0/examples/guestbook-go/redis-slave-service.json delete mode 100644 release-0.19.0/examples/guestbook/README.md delete mode 100644 release-0.19.0/examples/guestbook/frontend-controller.json delete mode 100644 release-0.19.0/examples/guestbook/frontend-service.json delete mode 100644 release-0.19.0/examples/guestbook/php-redis/Dockerfile delete mode 100644 release-0.19.0/examples/guestbook/php-redis/controllers.js delete mode 100644 release-0.19.0/examples/guestbook/php-redis/index.html delete mode 100644 release-0.19.0/examples/guestbook/php-redis/index.php delete mode 100644 release-0.19.0/examples/guestbook/redis-master-controller.json delete mode 100644 release-0.19.0/examples/guestbook/redis-master-service.json delete mode 100644 release-0.19.0/examples/guestbook/redis-slave-controller.json delete mode 100644 release-0.19.0/examples/guestbook/redis-slave-service.json delete mode 100644 release-0.19.0/examples/guestbook/redis-slave/Dockerfile delete mode 100755 release-0.19.0/examples/guestbook/redis-slave/run.sh delete mode 100644 release-0.19.0/examples/hazelcast/Dockerfile delete mode 100644 release-0.19.0/examples/hazelcast/README.md delete mode 100644 release-0.19.0/examples/hazelcast/hazelcast-controller.yaml delete mode 100644 release-0.19.0/examples/hazelcast/hazelcast-service.yaml delete mode 100644 release-0.19.0/examples/iscsi/README.md delete mode 100644 release-0.19.0/examples/iscsi/iscsi.json delete mode 100644 release-0.19.0/examples/k8petstore/README.md delete mode 100644 release-0.19.0/examples/k8petstore/Vagrantfile delete mode 100644 release-0.19.0/examples/k8petstore/bps-data-generator/README.md delete mode 100755 release-0.19.0/examples/k8petstore/build-push-containers.sh delete mode 100644 release-0.19.0/examples/k8petstore/dev/README delete mode 100755 release-0.19.0/examples/k8petstore/dev/Vagrantfile delete mode 100644 release-0.19.0/examples/k8petstore/dev/hosts/Vagrantfile delete mode 100755 release-0.19.0/examples/k8petstore/dev/test.sh delete mode 100644 release-0.19.0/examples/k8petstore/k8petstore.dot delete mode 100755 release-0.19.0/examples/k8petstore/k8petstore.sh delete mode 100644 release-0.19.0/examples/k8petstore/redis-master/Dockerfile delete mode 100644 release-0.19.0/examples/k8petstore/redis-master/etc_redis_redis.conf delete mode 100644 release-0.19.0/examples/k8petstore/redis-slave/Dockerfile delete mode 100644 release-0.19.0/examples/k8petstore/redis-slave/etc_redis_redis.conf delete mode 100755 release-0.19.0/examples/k8petstore/redis-slave/run.sh delete mode 100644 release-0.19.0/examples/k8petstore/redis/Dockerfile delete mode 100644 release-0.19.0/examples/k8petstore/redis/etc_redis_redis.conf delete mode 100644 release-0.19.0/examples/k8petstore/web-server/Dockerfile delete mode 100644 release-0.19.0/examples/k8petstore/web-server/PetStoreBook.go delete mode 100644 release-0.19.0/examples/k8petstore/web-server/dump.rdb delete mode 100644 release-0.19.0/examples/k8petstore/web-server/static/histogram.js delete mode 100644 release-0.19.0/examples/k8petstore/web-server/static/index.html delete mode 100644 release-0.19.0/examples/k8petstore/web-server/static/script.js delete mode 100644 release-0.19.0/examples/k8petstore/web-server/static/style.css delete mode 100644 release-0.19.0/examples/k8petstore/web-server/test.sh delete mode 100644 release-0.19.0/examples/kubectl-container/.gitignore delete mode 100644 release-0.19.0/examples/kubectl-container/Dockerfile delete mode 100644 release-0.19.0/examples/kubectl-container/Makefile delete mode 100644 release-0.19.0/examples/kubectl-container/README.md delete mode 100644 release-0.19.0/examples/kubectl-container/pod.json delete mode 100644 release-0.19.0/examples/kubernetes-namespaces/README.md delete mode 100644 release-0.19.0/examples/kubernetes-namespaces/namespace-dev.json delete mode 100644 release-0.19.0/examples/kubernetes-namespaces/namespace-prod.json delete mode 100644 release-0.19.0/examples/limitrange/README.md delete mode 100644 release-0.19.0/examples/limitrange/invalid-pod.json delete mode 100644 release-0.19.0/examples/limitrange/limit-range.json delete mode 100644 release-0.19.0/examples/limitrange/valid-pod.json delete mode 100644 release-0.19.0/examples/liveness/README.md delete mode 100644 release-0.19.0/examples/liveness/exec-liveness.yaml delete mode 100644 release-0.19.0/examples/liveness/http-liveness.yaml delete mode 100644 release-0.19.0/examples/liveness/image/Dockerfile delete mode 100644 release-0.19.0/examples/liveness/image/Makefile delete mode 100644 release-0.19.0/examples/liveness/image/server.go delete mode 100644 release-0.19.0/examples/logging-demo/Makefile delete mode 100644 release-0.19.0/examples/logging-demo/README.md delete mode 100644 release-0.19.0/examples/logging-demo/synth-logger.png delete mode 100644 release-0.19.0/examples/logging-demo/synthetic_0_25lps.yaml delete mode 100644 release-0.19.0/examples/logging-demo/synthetic_10lps.yaml delete mode 100644 release-0.19.0/examples/meteor/README.md delete mode 100644 release-0.19.0/examples/meteor/dockerbase/Dockerfile delete mode 100644 release-0.19.0/examples/meteor/dockerbase/README.md delete mode 100644 release-0.19.0/examples/meteor/meteor-controller.json delete mode 100644 release-0.19.0/examples/meteor/meteor-service.json delete mode 100644 release-0.19.0/examples/meteor/mongo-pod.json delete mode 100644 release-0.19.0/examples/meteor/mongo-service.json delete mode 100644 release-0.19.0/examples/mysql-wordpress-pd/README.md delete mode 100644 release-0.19.0/examples/mysql-wordpress-pd/mysql-service.yaml delete mode 100644 release-0.19.0/examples/mysql-wordpress-pd/mysql.yaml delete mode 100644 release-0.19.0/examples/mysql-wordpress-pd/wordpress-service.yaml delete mode 100644 release-0.19.0/examples/mysql-wordpress-pd/wordpress.yaml delete mode 100644 release-0.19.0/examples/nfs/README.md delete mode 100644 release-0.19.0/examples/nfs/exporter/Dockerfile delete mode 100644 release-0.19.0/examples/nfs/exporter/README.md delete mode 100755 release-0.19.0/examples/nfs/exporter/run_nfs delete mode 100644 release-0.19.0/examples/nfs/nfs-data/Dockerfile delete mode 100644 release-0.19.0/examples/nfs/nfs-data/README.md delete mode 100644 release-0.19.0/examples/nfs/nfs-data/index.html delete mode 100644 release-0.19.0/examples/nfs/nfs-server-pod.yaml delete mode 100644 release-0.19.0/examples/nfs/nfs-server-service.yaml delete mode 100644 release-0.19.0/examples/nfs/nfs-web-pod.yaml delete mode 100644 release-0.19.0/examples/node-selection/README.md delete mode 100644 release-0.19.0/examples/node-selection/pod.yaml delete mode 100644 release-0.19.0/examples/openshift-origin/.gitignore delete mode 100644 release-0.19.0/examples/openshift-origin/README.md delete mode 100755 release-0.19.0/examples/openshift-origin/cleanup.sh delete mode 100755 release-0.19.0/examples/openshift-origin/create.sh delete mode 100644 release-0.19.0/examples/openshift-origin/openshift-controller.yaml delete mode 100644 release-0.19.0/examples/openshift-origin/openshift-service.yaml delete mode 100644 release-0.19.0/examples/persistent-volumes/README.md delete mode 100644 release-0.19.0/examples/persistent-volumes/claims/claim-01.yaml delete mode 100644 release-0.19.0/examples/persistent-volumes/claims/claim-02.yaml delete mode 100644 release-0.19.0/examples/persistent-volumes/claims/claim-03.json delete mode 100644 release-0.19.0/examples/persistent-volumes/simpletest/namespace.json delete mode 100644 release-0.19.0/examples/persistent-volumes/simpletest/pod.yaml delete mode 100644 release-0.19.0/examples/persistent-volumes/simpletest/service.json delete mode 100644 release-0.19.0/examples/persistent-volumes/volumes/gce.yaml delete mode 100644 release-0.19.0/examples/persistent-volumes/volumes/local-01.yaml delete mode 100644 release-0.19.0/examples/persistent-volumes/volumes/local-02.yaml delete mode 100644 release-0.19.0/examples/persistent-volumes/volumes/nfs.yaml delete mode 100644 release-0.19.0/examples/phabricator/README.md delete mode 100644 release-0.19.0/examples/phabricator/authenticator-controller.json delete mode 100644 release-0.19.0/examples/phabricator/cloudsql-authenticator/Dockerfile delete mode 100755 release-0.19.0/examples/phabricator/cloudsql-authenticator/run.sh delete mode 100644 release-0.19.0/examples/phabricator/phabricator-controller.json delete mode 100644 release-0.19.0/examples/phabricator/phabricator-service.json delete mode 100644 release-0.19.0/examples/phabricator/php-phabricator/000-default.conf delete mode 100644 release-0.19.0/examples/phabricator/php-phabricator/Dockerfile delete mode 100755 release-0.19.0/examples/phabricator/php-phabricator/run.sh delete mode 100755 release-0.19.0/examples/phabricator/setup.sh delete mode 100755 release-0.19.0/examples/phabricator/teardown.sh delete mode 100644 release-0.19.0/examples/pod.yaml delete mode 100644 release-0.19.0/examples/rbd/README.md delete mode 100644 release-0.19.0/examples/rbd/secret/ceph-secret.yaml delete mode 100644 release-0.19.0/examples/rbd/v1beta3/rbd-with-secret.json delete mode 100644 release-0.19.0/examples/rbd/v1beta3/rbd.json delete mode 100644 release-0.19.0/examples/redis/README.md delete mode 100644 release-0.19.0/examples/redis/image/Dockerfile delete mode 100644 release-0.19.0/examples/redis/image/redis-master.conf delete mode 100644 release-0.19.0/examples/redis/image/redis-slave.conf delete mode 100755 release-0.19.0/examples/redis/image/run.sh delete mode 100644 release-0.19.0/examples/redis/redis-controller.yaml delete mode 100644 release-0.19.0/examples/redis/redis-master.yaml delete mode 100644 release-0.19.0/examples/redis/redis-proxy.yaml delete mode 100644 release-0.19.0/examples/redis/redis-sentinel-controller.yaml delete mode 100644 release-0.19.0/examples/redis/redis-sentinel-service.yaml delete mode 100644 release-0.19.0/examples/replication.yaml delete mode 100644 release-0.19.0/examples/resourcequota/README.md delete mode 100644 release-0.19.0/examples/resourcequota/limits.yaml delete mode 100644 release-0.19.0/examples/resourcequota/namespace.yaml delete mode 100644 release-0.19.0/examples/resourcequota/quota.yaml delete mode 100644 release-0.19.0/examples/rethinkdb/README.md delete mode 100644 release-0.19.0/examples/rethinkdb/admin-pod.yaml delete mode 100644 release-0.19.0/examples/rethinkdb/admin-service.yaml delete mode 100644 release-0.19.0/examples/rethinkdb/driver-service.yaml delete mode 100755 release-0.19.0/examples/rethinkdb/gen-pod.sh delete mode 100644 release-0.19.0/examples/rethinkdb/image/Dockerfile delete mode 100644 release-0.19.0/examples/rethinkdb/image/run.sh delete mode 100644 release-0.19.0/examples/rethinkdb/rc.yaml delete mode 100644 release-0.19.0/examples/secrets/README.md delete mode 100644 release-0.19.0/examples/secrets/secret-pod.yaml delete mode 100644 release-0.19.0/examples/secrets/secret.yaml delete mode 100644 release-0.19.0/examples/simple-nginx.md delete mode 100644 release-0.19.0/examples/simple-yaml.md delete mode 100644 release-0.19.0/examples/spark/README.md delete mode 100644 release-0.19.0/examples/spark/spark-master-service.json delete mode 100644 release-0.19.0/examples/spark/spark-master.json delete mode 100644 release-0.19.0/examples/spark/spark-worker-controller.json delete mode 100644 release-0.19.0/examples/storm/README.md delete mode 100644 release-0.19.0/examples/storm/storm-nimbus-service.json delete mode 100644 release-0.19.0/examples/storm/storm-nimbus.json delete mode 100644 release-0.19.0/examples/storm/storm-worker-controller.json delete mode 100644 release-0.19.0/examples/storm/zookeeper-service.json delete mode 100644 release-0.19.0/examples/storm/zookeeper.json delete mode 100644 release-0.19.0/examples/update-demo/README.md delete mode 100755 release-0.19.0/examples/update-demo/build-images.sh delete mode 100644 release-0.19.0/examples/update-demo/images/kitten/Dockerfile delete mode 100644 release-0.19.0/examples/update-demo/images/kitten/html/data.json delete mode 100644 release-0.19.0/examples/update-demo/images/kitten/html/kitten.jpg delete mode 100644 release-0.19.0/examples/update-demo/images/nautilus/Dockerfile delete mode 100644 release-0.19.0/examples/update-demo/images/nautilus/html/data.json delete mode 100644 release-0.19.0/examples/update-demo/images/nautilus/html/nautilus.jpg delete mode 100644 release-0.19.0/examples/update-demo/kitten-rc.yaml delete mode 100644 release-0.19.0/examples/update-demo/local/LICENSE.angular delete mode 100644 release-0.19.0/examples/update-demo/local/angular.min.js delete mode 100644 release-0.19.0/examples/update-demo/local/angular.min.js.map delete mode 100644 release-0.19.0/examples/update-demo/local/index.html delete mode 100644 release-0.19.0/examples/update-demo/local/script.js delete mode 100644 release-0.19.0/examples/update-demo/local/style.css delete mode 100644 release-0.19.0/examples/update-demo/nautilus-rc.yaml delete mode 100644 release-0.19.0/examples/walkthrough/README.md delete mode 100644 release-0.19.0/examples/walkthrough/k8s201.md delete mode 100644 release-0.19.0/examples/walkthrough/pod-with-http-healthcheck.yaml delete mode 100644 release-0.19.0/examples/walkthrough/pod1.yaml delete mode 100644 release-0.19.0/examples/walkthrough/pod2.yaml delete mode 100644 release-0.19.0/examples/walkthrough/podtemplate.json delete mode 100644 release-0.19.0/examples/walkthrough/replication-controller.yaml delete mode 100644 release-0.19.0/examples/walkthrough/service.yaml delete mode 100644 release-0.20.0/docs/.files_generated delete mode 100644 release-0.20.0/docs/README.md delete mode 100644 release-0.20.0/docs/accessing-the-cluster.md delete mode 100644 release-0.20.0/docs/accessing_the_api.md delete mode 100644 release-0.20.0/docs/admission_controllers.md delete mode 100644 release-0.20.0/docs/annotations.md delete mode 100644 release-0.20.0/docs/api-conventions.md delete mode 100644 release-0.20.0/docs/api.md delete mode 100644 release-0.20.0/docs/application-troubleshooting.md delete mode 100644 release-0.20.0/docs/architecture.dia delete mode 100644 release-0.20.0/docs/architecture.png delete mode 100644 release-0.20.0/docs/architecture.svg delete mode 100644 release-0.20.0/docs/authentication.md delete mode 100644 release-0.20.0/docs/authorization.md delete mode 100644 release-0.20.0/docs/availability.md delete mode 100644 release-0.20.0/docs/cli-roadmap.md delete mode 100644 release-0.20.0/docs/client-libraries.md delete mode 100644 release-0.20.0/docs/cluster-admin-guide.md delete mode 100644 release-0.20.0/docs/cluster-troubleshooting.md delete mode 100644 release-0.20.0/docs/cluster_management.md delete mode 100644 release-0.20.0/docs/container-environment.md delete mode 100644 release-0.20.0/docs/containers.md delete mode 100644 release-0.20.0/docs/design/README.md delete mode 100644 release-0.20.0/docs/design/access.md delete mode 100644 release-0.20.0/docs/design/admission_control.md delete mode 100644 release-0.20.0/docs/design/admission_control_limit_range.md delete mode 100644 release-0.20.0/docs/design/admission_control_resource_quota.md delete mode 100644 release-0.20.0/docs/design/architecture.md delete mode 100644 release-0.20.0/docs/design/clustering.md delete mode 100644 release-0.20.0/docs/design/clustering/.gitignore delete mode 100644 release-0.20.0/docs/design/clustering/Dockerfile delete mode 100644 release-0.20.0/docs/design/clustering/Makefile delete mode 100644 release-0.20.0/docs/design/clustering/README.md delete mode 100644 release-0.20.0/docs/design/clustering/dynamic.png delete mode 100644 release-0.20.0/docs/design/clustering/dynamic.seqdiag delete mode 100644 release-0.20.0/docs/design/clustering/static.png delete mode 100644 release-0.20.0/docs/design/clustering/static.seqdiag delete mode 100644 release-0.20.0/docs/design/command_execution_port_forwarding.md delete mode 100644 release-0.20.0/docs/design/event_compression.md delete mode 100644 release-0.20.0/docs/design/expansion.md delete mode 100644 release-0.20.0/docs/design/identifiers.md delete mode 100644 release-0.20.0/docs/design/namespaces.md delete mode 100644 release-0.20.0/docs/design/networking.md delete mode 100644 release-0.20.0/docs/design/persistent-storage.md delete mode 100644 release-0.20.0/docs/design/principles.md delete mode 100644 release-0.20.0/docs/design/secrets.md delete mode 100644 release-0.20.0/docs/design/security.md delete mode 100644 release-0.20.0/docs/design/security_context.md delete mode 100644 release-0.20.0/docs/design/service_accounts.md delete mode 100644 release-0.20.0/docs/design/simple-rolling-update.md delete mode 100644 release-0.20.0/docs/devel/README.md delete mode 100644 release-0.20.0/docs/devel/api_changes.md delete mode 100644 release-0.20.0/docs/devel/coding-conventions.md delete mode 100644 release-0.20.0/docs/devel/collab.md delete mode 100644 release-0.20.0/docs/devel/developer-guides/vagrant.md delete mode 100644 release-0.20.0/docs/devel/development.md delete mode 100644 release-0.20.0/docs/devel/faster_reviews.md delete mode 100644 release-0.20.0/docs/devel/flaky-tests.md delete mode 100644 release-0.20.0/docs/devel/git_workflow.png delete mode 100644 release-0.20.0/docs/devel/instrumentation.md delete mode 100644 release-0.20.0/docs/devel/issues.md delete mode 100644 release-0.20.0/docs/devel/logging.md delete mode 100644 release-0.20.0/docs/devel/making-release-notes.md delete mode 100644 release-0.20.0/docs/devel/profiling.md delete mode 100644 release-0.20.0/docs/devel/pull-requests.md delete mode 100644 release-0.20.0/docs/devel/releasing.dot delete mode 100644 release-0.20.0/docs/devel/releasing.md delete mode 100644 release-0.20.0/docs/devel/releasing.png delete mode 100644 release-0.20.0/docs/devel/releasing.svg delete mode 100644 release-0.20.0/docs/devel/writing-a-getting-started-guide.md delete mode 100644 release-0.20.0/docs/developer-guide.md delete mode 100644 release-0.20.0/docs/dns.md delete mode 100644 release-0.20.0/docs/downward_api.md delete mode 100644 release-0.20.0/docs/getting-started-guides/README.md delete mode 100644 release-0.20.0/docs/getting-started-guides/all-lines.png delete mode 100644 release-0.20.0/docs/getting-started-guides/aws-coreos.md delete mode 100644 release-0.20.0/docs/getting-started-guides/aws.md delete mode 100644 release-0.20.0/docs/getting-started-guides/aws/cloud-configs/master.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/aws/cloud-configs/node.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/aws/cloudformation-template.json delete mode 100644 release-0.20.0/docs/getting-started-guides/aws/kubectl.md delete mode 100644 release-0.20.0/docs/getting-started-guides/azure.md delete mode 100644 release-0.20.0/docs/getting-started-guides/bigquery-logging.png delete mode 100644 release-0.20.0/docs/getting-started-guides/binary_release.md delete mode 100644 release-0.20.0/docs/getting-started-guides/centos/centos_manual_config.md delete mode 100644 release-0.20.0/docs/getting-started-guides/cloud-logging-console.png delete mode 100644 release-0.20.0/docs/getting-started-guides/cloudstack.md delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos.md delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/.gitignore delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/README.md delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/grafana-service.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/heapster-controller.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-service.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-controller.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-service.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-controller.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-service.yaml delete mode 100755 release-0.20.0/docs/getting-started-guides/coreos/azure/azure-login.js delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-etcd-node-template.yml delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-main-nodes-template.yml delete mode 100755 release-0.20.0/docs/getting-started-guides/coreos/azure/create-kubernetes-cluster.js delete mode 100755 release-0.20.0/docs/getting-started-guides/coreos/azure/destroy-cluster.js delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/external_access.png delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/initial_cluster.png delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/lib/azure_wrapper.js delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/lib/cloud_config.js delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/lib/deployment_logic/kubernetes.js delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/lib/util.js delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/azure/package.json delete mode 100755 release-0.20.0/docs/getting-started-guides/coreos/azure/scale-kubernetes-cluster.js delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/bare_metal_offline.md delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/master.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/node.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/standalone.yaml delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/coreos_multinode_cluster.md delete mode 100644 release-0.20.0/docs/getting-started-guides/coreos/coreos_single_node_cluster.md delete mode 100644 release-0.20.0/docs/getting-started-guides/docker-multinode.md delete mode 100644 release-0.20.0/docs/getting-started-guides/docker-multinode/master.md delete mode 100644 release-0.20.0/docs/getting-started-guides/docker-multinode/testing.md delete mode 100644 release-0.20.0/docs/getting-started-guides/docker-multinode/worker.md delete mode 100644 release-0.20.0/docs/getting-started-guides/docker.md delete mode 100644 release-0.20.0/docs/getting-started-guides/es-browser.png delete mode 100644 release-0.20.0/docs/getting-started-guides/fedora/fedora_ansible_config.md delete mode 100644 release-0.20.0/docs/getting-started-guides/fedora/fedora_manual_config.md delete mode 100644 release-0.20.0/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md delete mode 100644 release-0.20.0/docs/getting-started-guides/gce.md delete mode 100644 release-0.20.0/docs/getting-started-guides/juju.md delete mode 100644 release-0.20.0/docs/getting-started-guides/k8s-docker.png delete mode 100644 release-0.20.0/docs/getting-started-guides/k8s-singlenode-docker.png delete mode 100644 release-0.20.0/docs/getting-started-guides/kibana-logs.png delete mode 100644 release-0.20.0/docs/getting-started-guides/libvirt-coreos.md delete mode 100644 release-0.20.0/docs/getting-started-guides/locally.md delete mode 100644 release-0.20.0/docs/getting-started-guides/logging-elasticsearch.md delete mode 100644 release-0.20.0/docs/getting-started-guides/logging.md delete mode 100644 release-0.20.0/docs/getting-started-guides/mesos.md delete mode 100755 release-0.20.0/docs/getting-started-guides/mesos/k8s-firewall.png delete mode 100755 release-0.20.0/docs/getting-started-guides/mesos/k8s-guestbook.png delete mode 100644 release-0.20.0/docs/getting-started-guides/ovirt.md delete mode 100644 release-0.20.0/docs/getting-started-guides/rackspace.md delete mode 100644 release-0.20.0/docs/getting-started-guides/rkt/README.md delete mode 100644 release-0.20.0/docs/getting-started-guides/ubuntu.md delete mode 100644 release-0.20.0/docs/getting-started-guides/vagrant.md delete mode 100644 release-0.20.0/docs/getting-started-guides/vsphere.md delete mode 100644 release-0.20.0/docs/glossary.md delete mode 100644 release-0.20.0/docs/identifiers.md delete mode 100644 release-0.20.0/docs/images.md delete mode 100644 release-0.20.0/docs/kibana.png delete mode 100644 release-0.20.0/docs/kubeconfig-file.md delete mode 100644 release-0.20.0/docs/kubectl.md delete mode 100644 release-0.20.0/docs/kubectl_api-versions.md delete mode 100644 release-0.20.0/docs/kubectl_cluster-info.md delete mode 100644 release-0.20.0/docs/kubectl_config.md delete mode 100644 release-0.20.0/docs/kubectl_config_set-cluster.md delete mode 100644 release-0.20.0/docs/kubectl_config_set-context.md delete mode 100644 release-0.20.0/docs/kubectl_config_set-credentials.md delete mode 100644 release-0.20.0/docs/kubectl_config_set.md delete mode 100644 release-0.20.0/docs/kubectl_config_unset.md delete mode 100644 release-0.20.0/docs/kubectl_config_use-context.md delete mode 100644 release-0.20.0/docs/kubectl_config_view.md delete mode 100644 release-0.20.0/docs/kubectl_create.md delete mode 100644 release-0.20.0/docs/kubectl_delete.md delete mode 100644 release-0.20.0/docs/kubectl_describe.md delete mode 100644 release-0.20.0/docs/kubectl_exec.md delete mode 100644 release-0.20.0/docs/kubectl_expose.md delete mode 100644 release-0.20.0/docs/kubectl_get.md delete mode 100644 release-0.20.0/docs/kubectl_label.md delete mode 100644 release-0.20.0/docs/kubectl_logs.md delete mode 100644 release-0.20.0/docs/kubectl_namespace.md delete mode 100644 release-0.20.0/docs/kubectl_port-forward.md delete mode 100644 release-0.20.0/docs/kubectl_proxy.md delete mode 100644 release-0.20.0/docs/kubectl_rolling-update.md delete mode 100644 release-0.20.0/docs/kubectl_run.md delete mode 100644 release-0.20.0/docs/kubectl_scale.md delete mode 100644 release-0.20.0/docs/kubectl_stop.md delete mode 100644 release-0.20.0/docs/kubectl_update.md delete mode 100644 release-0.20.0/docs/kubectl_version.md delete mode 100644 release-0.20.0/docs/labels.md delete mode 100644 release-0.20.0/docs/logging.md delete mode 100644 release-0.20.0/docs/man/Dockerfile delete mode 100644 release-0.20.0/docs/man/README.md delete mode 100644 release-0.20.0/docs/man/kube-apiserver.1.md delete mode 100644 release-0.20.0/docs/man/kube-controller-manager.1.md delete mode 100644 release-0.20.0/docs/man/kube-proxy.1.md delete mode 100644 release-0.20.0/docs/man/kube-scheduler.1.md delete mode 100644 release-0.20.0/docs/man/kubelet.1.md delete mode 100644 release-0.20.0/docs/man/man1/.files_generated delete mode 100644 release-0.20.0/docs/man/man1/kube-apiserver.1 delete mode 100644 release-0.20.0/docs/man/man1/kube-controller-manager.1 delete mode 100644 release-0.20.0/docs/man/man1/kube-proxy.1 delete mode 100644 release-0.20.0/docs/man/man1/kube-scheduler.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-api-versions.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-cluster-info.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-config-set-cluster.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-config-set-context.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-config-set-credentials.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-config-set.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-config-unset.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-config-use-context.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-config-view.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-config.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-create.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-delete.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-describe.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-exec.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-expose.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-get.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-label.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-logs.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-namespace.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-port-forward.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-proxy.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-rolling-update.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-run.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-scale.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-stop.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-update.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl-version.1 delete mode 100644 release-0.20.0/docs/man/man1/kubectl.1 delete mode 100644 release-0.20.0/docs/man/man1/kubelet.1 delete mode 100755 release-0.20.0/docs/man/md2man-all.sh delete mode 100644 release-0.20.0/docs/namespaces.md delete mode 100644 release-0.20.0/docs/networking.md delete mode 100644 release-0.20.0/docs/node.md delete mode 100644 release-0.20.0/docs/overview.md delete mode 100644 release-0.20.0/docs/ovs-networking.md delete mode 100644 release-0.20.0/docs/ovs-networking.png delete mode 100644 release-0.20.0/docs/pod-states.md delete mode 100644 release-0.20.0/docs/pods.md delete mode 100644 release-0.20.0/docs/proposals/autoscaling.md delete mode 100644 release-0.20.0/docs/proposals/federation-high-level-arch.png delete mode 100644 release-0.20.0/docs/proposals/federation.md delete mode 100644 release-0.20.0/docs/proposals/high-availability.md delete mode 100644 release-0.20.0/docs/replication-controller.md delete mode 100644 release-0.20.0/docs/resource_quota_admin.md delete mode 100644 release-0.20.0/docs/resources.md delete mode 100644 release-0.20.0/docs/roadmap.md delete mode 100644 release-0.20.0/docs/salt.md delete mode 100644 release-0.20.0/docs/secrets.md delete mode 100644 release-0.20.0/docs/security_context.md delete mode 100644 release-0.20.0/docs/service_accounts.md delete mode 100644 release-0.20.0/docs/service_accounts_admin.md delete mode 100644 release-0.20.0/docs/services-firewalls.md delete mode 100644 release-0.20.0/docs/services.md delete mode 100644 release-0.20.0/docs/services_detail.png delete mode 100644 release-0.20.0/docs/services_detail.svg delete mode 100644 release-0.20.0/docs/services_overview.png delete mode 100644 release-0.20.0/docs/services_overview.svg delete mode 100644 release-0.20.0/docs/sharing-clusters.md delete mode 100644 release-0.20.0/docs/troubleshooting.md delete mode 100644 release-0.20.0/docs/ui.md delete mode 100644 release-0.20.0/docs/user-guide.md delete mode 100644 release-0.20.0/docs/versioning.md delete mode 100644 release-0.20.0/docs/volumes.md delete mode 100644 release-0.20.0/docs/working_with_resources.md delete mode 100644 release-0.20.0/examples/README.md delete mode 100644 release-0.20.0/examples/aws_ebs/README.md delete mode 100644 release-0.20.0/examples/aws_ebs/aws-ebs-web.yaml delete mode 100644 release-0.20.0/examples/blog-logging/counter-pod.yaml delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/0f64.ai delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/0f64.png delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/0f64.svg delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/20ej.ai delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/20ej.png delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/20ej.svg delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/27gf-counter.ai delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/27gf-counter.png delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/27gf-counter.svg delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/27gf.ai delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/27gf.png delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/27gf.svg delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/README.md delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/cloud-logging.ai delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/cloud-logging.png delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/cloud-logging.svg delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/pk22.ai delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/pk22.png delete mode 100644 release-0.20.0/examples/blog-logging/diagrams/pk22.svg delete mode 100644 release-0.20.0/examples/cassandra/README.md delete mode 100644 release-0.20.0/examples/cassandra/cassandra-controller.yaml delete mode 100644 release-0.20.0/examples/cassandra/cassandra-service.yaml delete mode 100644 release-0.20.0/examples/cassandra/cassandra.yaml delete mode 100644 release-0.20.0/examples/cassandra/image/Dockerfile delete mode 100644 release-0.20.0/examples/cassandra/image/cassandra.list delete mode 100644 release-0.20.0/examples/cassandra/image/cassandra.yaml delete mode 100644 release-0.20.0/examples/cassandra/image/kubernetes-cassandra.jar delete mode 100644 release-0.20.0/examples/cassandra/image/run.sh delete mode 100644 release-0.20.0/examples/cassandra/java/pom.xml delete mode 100644 release-0.20.0/examples/cassandra/java/src/io/k8s/cassandra/KubernetesSeedProvider.java delete mode 100644 release-0.20.0/examples/celery-rabbitmq/README.md delete mode 100644 release-0.20.0/examples/celery-rabbitmq/celery-app-add/Dockerfile delete mode 100644 release-0.20.0/examples/celery-rabbitmq/celery-app-add/celery_conf.py delete mode 100644 release-0.20.0/examples/celery-rabbitmq/celery-app-add/run.sh delete mode 100644 release-0.20.0/examples/celery-rabbitmq/celery-app-add/run_tasks.py delete mode 100644 release-0.20.0/examples/celery-rabbitmq/celery-controller.yaml delete mode 100644 release-0.20.0/examples/celery-rabbitmq/flower-controller.yaml delete mode 100644 release-0.20.0/examples/celery-rabbitmq/flower/Dockerfile delete mode 100644 release-0.20.0/examples/celery-rabbitmq/flower/run_flower.sh delete mode 100644 release-0.20.0/examples/celery-rabbitmq/rabbitmq-controller.yaml delete mode 100644 release-0.20.0/examples/celery-rabbitmq/rabbitmq-service.yaml delete mode 100644 release-0.20.0/examples/cluster-dns/README.md delete mode 100644 release-0.20.0/examples/cluster-dns/dns-backend-rc.yaml delete mode 100644 release-0.20.0/examples/cluster-dns/dns-backend-service.yaml delete mode 100644 release-0.20.0/examples/cluster-dns/dns-frontend-pod.yaml delete mode 100644 release-0.20.0/examples/cluster-dns/images/backend/Dockerfile delete mode 100644 release-0.20.0/examples/cluster-dns/images/backend/server.py delete mode 100644 release-0.20.0/examples/cluster-dns/images/frontend/Dockerfile delete mode 100644 release-0.20.0/examples/cluster-dns/images/frontend/client.py delete mode 100644 release-0.20.0/examples/cluster-dns/namespace-dev.yaml delete mode 100644 release-0.20.0/examples/cluster-dns/namespace-prod.yaml delete mode 100644 release-0.20.0/examples/doc.go delete mode 100644 release-0.20.0/examples/downward-api/README.md delete mode 100644 release-0.20.0/examples/downward-api/dapi-pod.yaml delete mode 100644 release-0.20.0/examples/elasticsearch/Dockerfile delete mode 100644 release-0.20.0/examples/elasticsearch/Makefile delete mode 100644 release-0.20.0/examples/elasticsearch/README.md delete mode 100644 release-0.20.0/examples/elasticsearch/apiserver-secret.yaml delete mode 100644 release-0.20.0/examples/elasticsearch/elasticsearch.yml delete mode 100644 release-0.20.0/examples/elasticsearch/elasticsearch_discovery.go delete mode 100644 release-0.20.0/examples/elasticsearch/music-rc.yaml delete mode 100644 release-0.20.0/examples/elasticsearch/music-service.yaml delete mode 100755 release-0.20.0/examples/elasticsearch/run.sh delete mode 100644 release-0.20.0/examples/environment-guide/README.md delete mode 100644 release-0.20.0/examples/environment-guide/backend-rc.yaml delete mode 100644 release-0.20.0/examples/environment-guide/backend-srv.yaml delete mode 100644 release-0.20.0/examples/environment-guide/containers/README.md delete mode 100644 release-0.20.0/examples/environment-guide/containers/backend/Dockerfile delete mode 100644 release-0.20.0/examples/environment-guide/containers/backend/backend.go delete mode 100644 release-0.20.0/examples/environment-guide/containers/show/Dockerfile delete mode 100644 release-0.20.0/examples/environment-guide/containers/show/show.go delete mode 100644 release-0.20.0/examples/environment-guide/diagram.png delete mode 100644 release-0.20.0/examples/environment-guide/show-rc.yaml delete mode 100644 release-0.20.0/examples/environment-guide/show-srv.yaml delete mode 100644 release-0.20.0/examples/examples_test.go delete mode 100644 release-0.20.0/examples/explorer/Dockerfile delete mode 100644 release-0.20.0/examples/explorer/Makefile delete mode 100644 release-0.20.0/examples/explorer/README.md delete mode 100644 release-0.20.0/examples/explorer/explorer.go delete mode 100644 release-0.20.0/examples/explorer/pod.json delete mode 100644 release-0.20.0/examples/glusterfs/README.md delete mode 100644 release-0.20.0/examples/glusterfs/glusterfs-endpoints.json delete mode 100644 release-0.20.0/examples/glusterfs/glusterfs-pod.json delete mode 100644 release-0.20.0/examples/guestbook-go/README.md delete mode 100644 release-0.20.0/examples/guestbook-go/guestbook-controller.json delete mode 100644 release-0.20.0/examples/guestbook-go/guestbook-page.png delete mode 100644 release-0.20.0/examples/guestbook-go/guestbook-service.json delete mode 100644 release-0.20.0/examples/guestbook-go/redis-master-controller.json delete mode 100644 release-0.20.0/examples/guestbook-go/redis-master-service.json delete mode 100644 release-0.20.0/examples/guestbook-go/redis-slave-controller.json delete mode 100644 release-0.20.0/examples/guestbook-go/redis-slave-service.json delete mode 100644 release-0.20.0/examples/guestbook/README.md delete mode 100644 release-0.20.0/examples/guestbook/frontend-controller.yaml delete mode 100644 release-0.20.0/examples/guestbook/frontend-service.yaml delete mode 100644 release-0.20.0/examples/guestbook/php-redis/Dockerfile delete mode 100644 release-0.20.0/examples/guestbook/php-redis/controllers.js delete mode 100644 release-0.20.0/examples/guestbook/php-redis/index.html delete mode 100644 release-0.20.0/examples/guestbook/php-redis/index.php delete mode 100644 release-0.20.0/examples/guestbook/redis-master-controller.yaml delete mode 100644 release-0.20.0/examples/guestbook/redis-master-service.yaml delete mode 100644 release-0.20.0/examples/guestbook/redis-slave-controller.yaml delete mode 100644 release-0.20.0/examples/guestbook/redis-slave-service.yaml delete mode 100644 release-0.20.0/examples/guestbook/redis-slave/Dockerfile delete mode 100755 release-0.20.0/examples/guestbook/redis-slave/run.sh delete mode 100644 release-0.20.0/examples/hazelcast/Dockerfile delete mode 100644 release-0.20.0/examples/hazelcast/README.md delete mode 100644 release-0.20.0/examples/hazelcast/hazelcast-controller.yaml delete mode 100644 release-0.20.0/examples/hazelcast/hazelcast-service.yaml delete mode 100644 release-0.20.0/examples/iscsi/README.md delete mode 100644 release-0.20.0/examples/iscsi/iscsi.json delete mode 100644 release-0.20.0/examples/k8petstore/README.md delete mode 100644 release-0.20.0/examples/k8petstore/Vagrantfile delete mode 100644 release-0.20.0/examples/k8petstore/bps-data-generator/README.md delete mode 100755 release-0.20.0/examples/k8petstore/build-push-containers.sh delete mode 100644 release-0.20.0/examples/k8petstore/dev/README delete mode 100755 release-0.20.0/examples/k8petstore/dev/Vagrantfile delete mode 100644 release-0.20.0/examples/k8petstore/dev/hosts/Vagrantfile delete mode 100755 release-0.20.0/examples/k8petstore/dev/test.sh delete mode 100755 release-0.20.0/examples/k8petstore/k8petstore-loadbalancer.sh delete mode 100755 release-0.20.0/examples/k8petstore/k8petstore-nodeport.sh delete mode 100644 release-0.20.0/examples/k8petstore/k8petstore.dot delete mode 100755 release-0.20.0/examples/k8petstore/k8petstore.sh delete mode 100644 release-0.20.0/examples/k8petstore/redis-master/Dockerfile delete mode 100644 release-0.20.0/examples/k8petstore/redis-master/etc_redis_redis.conf delete mode 100644 release-0.20.0/examples/k8petstore/redis-slave/Dockerfile delete mode 100644 release-0.20.0/examples/k8petstore/redis-slave/etc_redis_redis.conf delete mode 100755 release-0.20.0/examples/k8petstore/redis-slave/run.sh delete mode 100644 release-0.20.0/examples/k8petstore/redis/Dockerfile delete mode 100644 release-0.20.0/examples/k8petstore/redis/etc_redis_redis.conf delete mode 100644 release-0.20.0/examples/k8petstore/web-server/Dockerfile delete mode 100644 release-0.20.0/examples/k8petstore/web-server/PetStoreBook.go delete mode 100644 release-0.20.0/examples/k8petstore/web-server/dump.rdb delete mode 100644 release-0.20.0/examples/k8petstore/web-server/static/histogram.js delete mode 100644 release-0.20.0/examples/k8petstore/web-server/static/index.html delete mode 100644 release-0.20.0/examples/k8petstore/web-server/static/script.js delete mode 100644 release-0.20.0/examples/k8petstore/web-server/static/style.css delete mode 100644 release-0.20.0/examples/k8petstore/web-server/test.sh delete mode 100644 release-0.20.0/examples/kubectl-container/.gitignore delete mode 100644 release-0.20.0/examples/kubectl-container/Dockerfile delete mode 100644 release-0.20.0/examples/kubectl-container/Makefile delete mode 100644 release-0.20.0/examples/kubectl-container/README.md delete mode 100644 release-0.20.0/examples/kubectl-container/pod.json delete mode 100644 release-0.20.0/examples/kubernetes-namespaces/README.md delete mode 100644 release-0.20.0/examples/kubernetes-namespaces/namespace-dev.json delete mode 100644 release-0.20.0/examples/kubernetes-namespaces/namespace-prod.json delete mode 100644 release-0.20.0/examples/limitrange/README.md delete mode 100644 release-0.20.0/examples/limitrange/invalid-pod.json delete mode 100644 release-0.20.0/examples/limitrange/limit-range.json delete mode 100644 release-0.20.0/examples/limitrange/valid-pod.json delete mode 100644 release-0.20.0/examples/liveness/README.md delete mode 100644 release-0.20.0/examples/liveness/exec-liveness.yaml delete mode 100644 release-0.20.0/examples/liveness/http-liveness.yaml delete mode 100644 release-0.20.0/examples/liveness/image/Dockerfile delete mode 100644 release-0.20.0/examples/liveness/image/Makefile delete mode 100644 release-0.20.0/examples/liveness/image/server.go delete mode 100644 release-0.20.0/examples/logging-demo/Makefile delete mode 100644 release-0.20.0/examples/logging-demo/README.md delete mode 100644 release-0.20.0/examples/logging-demo/synth-logger.png delete mode 100644 release-0.20.0/examples/logging-demo/synthetic_0_25lps.yaml delete mode 100644 release-0.20.0/examples/logging-demo/synthetic_10lps.yaml delete mode 100644 release-0.20.0/examples/meteor/README.md delete mode 100644 release-0.20.0/examples/meteor/dockerbase/Dockerfile delete mode 100644 release-0.20.0/examples/meteor/dockerbase/README.md delete mode 100644 release-0.20.0/examples/meteor/meteor-controller.json delete mode 100644 release-0.20.0/examples/meteor/meteor-service.json delete mode 100644 release-0.20.0/examples/meteor/mongo-pod.json delete mode 100644 release-0.20.0/examples/meteor/mongo-service.json delete mode 100644 release-0.20.0/examples/mysql-wordpress-pd/README.md delete mode 100644 release-0.20.0/examples/mysql-wordpress-pd/mysql-service.yaml delete mode 100644 release-0.20.0/examples/mysql-wordpress-pd/mysql.yaml delete mode 100644 release-0.20.0/examples/mysql-wordpress-pd/wordpress-service.yaml delete mode 100644 release-0.20.0/examples/mysql-wordpress-pd/wordpress.yaml delete mode 100644 release-0.20.0/examples/nfs/README.md delete mode 100644 release-0.20.0/examples/nfs/exporter/Dockerfile delete mode 100644 release-0.20.0/examples/nfs/exporter/README.md delete mode 100755 release-0.20.0/examples/nfs/exporter/run_nfs delete mode 100644 release-0.20.0/examples/nfs/nfs-data/Dockerfile delete mode 100644 release-0.20.0/examples/nfs/nfs-data/README.md delete mode 100644 release-0.20.0/examples/nfs/nfs-data/index.html delete mode 100644 release-0.20.0/examples/nfs/nfs-server-pod.yaml delete mode 100644 release-0.20.0/examples/nfs/nfs-server-service.yaml delete mode 100644 release-0.20.0/examples/nfs/nfs-web-pod.yaml delete mode 100644 release-0.20.0/examples/node-selection/README.md delete mode 100644 release-0.20.0/examples/node-selection/pod.yaml delete mode 100644 release-0.20.0/examples/openshift-origin/.gitignore delete mode 100644 release-0.20.0/examples/openshift-origin/README.md delete mode 100755 release-0.20.0/examples/openshift-origin/cleanup.sh delete mode 100755 release-0.20.0/examples/openshift-origin/create.sh delete mode 100644 release-0.20.0/examples/openshift-origin/openshift-controller.yaml delete mode 100644 release-0.20.0/examples/openshift-origin/openshift-service.yaml delete mode 100644 release-0.20.0/examples/persistent-volumes/README.md delete mode 100644 release-0.20.0/examples/persistent-volumes/claims/claim-01.yaml delete mode 100644 release-0.20.0/examples/persistent-volumes/claims/claim-02.yaml delete mode 100644 release-0.20.0/examples/persistent-volumes/claims/claim-03.json delete mode 100644 release-0.20.0/examples/persistent-volumes/simpletest/namespace.json delete mode 100644 release-0.20.0/examples/persistent-volumes/simpletest/pod.yaml delete mode 100644 release-0.20.0/examples/persistent-volumes/simpletest/service.json delete mode 100644 release-0.20.0/examples/persistent-volumes/volumes/gce.yaml delete mode 100644 release-0.20.0/examples/persistent-volumes/volumes/local-01.yaml delete mode 100644 release-0.20.0/examples/persistent-volumes/volumes/local-02.yaml delete mode 100644 release-0.20.0/examples/persistent-volumes/volumes/nfs.yaml delete mode 100644 release-0.20.0/examples/phabricator/README.md delete mode 100644 release-0.20.0/examples/phabricator/authenticator-controller.json delete mode 100644 release-0.20.0/examples/phabricator/cloudsql-authenticator/Dockerfile delete mode 100755 release-0.20.0/examples/phabricator/cloudsql-authenticator/run.sh delete mode 100644 release-0.20.0/examples/phabricator/phabricator-controller.json delete mode 100644 release-0.20.0/examples/phabricator/phabricator-service.json delete mode 100644 release-0.20.0/examples/phabricator/php-phabricator/000-default.conf delete mode 100644 release-0.20.0/examples/phabricator/php-phabricator/Dockerfile delete mode 100755 release-0.20.0/examples/phabricator/php-phabricator/run.sh delete mode 100755 release-0.20.0/examples/phabricator/setup.sh delete mode 100755 release-0.20.0/examples/phabricator/teardown.sh delete mode 100644 release-0.20.0/examples/pod.yaml delete mode 100644 release-0.20.0/examples/rbd/README.md delete mode 100644 release-0.20.0/examples/rbd/rbd-with-secret.json delete mode 100644 release-0.20.0/examples/rbd/rbd.json delete mode 100644 release-0.20.0/examples/rbd/secret/ceph-secret.yaml delete mode 100644 release-0.20.0/examples/redis/README.md delete mode 100644 release-0.20.0/examples/redis/image/Dockerfile delete mode 100644 release-0.20.0/examples/redis/image/redis-master.conf delete mode 100644 release-0.20.0/examples/redis/image/redis-slave.conf delete mode 100755 release-0.20.0/examples/redis/image/run.sh delete mode 100644 release-0.20.0/examples/redis/redis-controller.yaml delete mode 100644 release-0.20.0/examples/redis/redis-master.yaml delete mode 100644 release-0.20.0/examples/redis/redis-proxy.yaml delete mode 100644 release-0.20.0/examples/redis/redis-sentinel-controller.yaml delete mode 100644 release-0.20.0/examples/redis/redis-sentinel-service.yaml delete mode 100644 release-0.20.0/examples/replication.yaml delete mode 100644 release-0.20.0/examples/resourcequota/README.md delete mode 100644 release-0.20.0/examples/resourcequota/limits.yaml delete mode 100644 release-0.20.0/examples/resourcequota/namespace.yaml delete mode 100644 release-0.20.0/examples/resourcequota/quota.yaml delete mode 100644 release-0.20.0/examples/rethinkdb/README.md delete mode 100644 release-0.20.0/examples/rethinkdb/admin-pod.yaml delete mode 100644 release-0.20.0/examples/rethinkdb/admin-service.yaml delete mode 100644 release-0.20.0/examples/rethinkdb/driver-service.yaml delete mode 100755 release-0.20.0/examples/rethinkdb/gen-pod.sh delete mode 100644 release-0.20.0/examples/rethinkdb/image/Dockerfile delete mode 100644 release-0.20.0/examples/rethinkdb/image/run.sh delete mode 100644 release-0.20.0/examples/rethinkdb/rc.yaml delete mode 100644 release-0.20.0/examples/secrets/README.md delete mode 100644 release-0.20.0/examples/secrets/secret-pod.yaml delete mode 100644 release-0.20.0/examples/secrets/secret.yaml delete mode 100644 release-0.20.0/examples/simple-nginx.md delete mode 100644 release-0.20.0/examples/simple-yaml.md delete mode 100644 release-0.20.0/examples/spark/README.md delete mode 100644 release-0.20.0/examples/spark/spark-master-service.json delete mode 100644 release-0.20.0/examples/spark/spark-master.json delete mode 100644 release-0.20.0/examples/spark/spark-worker-controller.json delete mode 100644 release-0.20.0/examples/storm/README.md delete mode 100644 release-0.20.0/examples/storm/storm-nimbus-service.json delete mode 100644 release-0.20.0/examples/storm/storm-nimbus.json delete mode 100644 release-0.20.0/examples/storm/storm-worker-controller.json delete mode 100644 release-0.20.0/examples/storm/zookeeper-service.json delete mode 100644 release-0.20.0/examples/storm/zookeeper.json delete mode 100644 release-0.20.0/examples/update-demo/README.md delete mode 100755 release-0.20.0/examples/update-demo/build-images.sh delete mode 100644 release-0.20.0/examples/update-demo/images/kitten/Dockerfile delete mode 100644 release-0.20.0/examples/update-demo/images/kitten/html/data.json delete mode 100644 release-0.20.0/examples/update-demo/images/kitten/html/kitten.jpg delete mode 100644 release-0.20.0/examples/update-demo/images/nautilus/Dockerfile delete mode 100644 release-0.20.0/examples/update-demo/images/nautilus/html/data.json delete mode 100644 release-0.20.0/examples/update-demo/images/nautilus/html/nautilus.jpg delete mode 100644 release-0.20.0/examples/update-demo/kitten-rc.yaml delete mode 100644 release-0.20.0/examples/update-demo/local/LICENSE.angular delete mode 100644 release-0.20.0/examples/update-demo/local/angular.min.js delete mode 100644 release-0.20.0/examples/update-demo/local/angular.min.js.map delete mode 100644 release-0.20.0/examples/update-demo/local/index.html delete mode 100644 release-0.20.0/examples/update-demo/local/script.js delete mode 100644 release-0.20.0/examples/update-demo/local/style.css delete mode 100644 release-0.20.0/examples/update-demo/nautilus-rc.yaml delete mode 100644 release-0.20.0/examples/walkthrough/README.md delete mode 100644 release-0.20.0/examples/walkthrough/k8s201.md delete mode 100644 release-0.20.0/examples/walkthrough/pod-with-http-healthcheck.yaml delete mode 100644 release-0.20.0/examples/walkthrough/pod1.yaml delete mode 100644 release-0.20.0/examples/walkthrough/pod2.yaml delete mode 100644 release-0.20.0/examples/walkthrough/podtemplate.json delete mode 100644 release-0.20.0/examples/walkthrough/replication-controller.yaml delete mode 100644 release-0.20.0/examples/walkthrough/service.yaml diff --git a/release-0.19.0/docs/.files_generated b/release-0.19.0/docs/.files_generated deleted file mode 100644 index ea5ef406c64..00000000000 --- a/release-0.19.0/docs/.files_generated +++ /dev/null @@ -1,28 +0,0 @@ -kubectl.md -kubectl_api-versions.md -kubectl_cluster-info.md -kubectl_config.md -kubectl_config_set-cluster.md -kubectl_config_set-context.md -kubectl_config_set-credentials.md -kubectl_config_set.md -kubectl_config_unset.md -kubectl_config_use-context.md -kubectl_config_view.md -kubectl_create.md -kubectl_delete.md -kubectl_describe.md -kubectl_exec.md -kubectl_expose.md -kubectl_get.md -kubectl_label.md -kubectl_logs.md -kubectl_namespace.md -kubectl_port-forward.md -kubectl_proxy.md -kubectl_rolling-update.md -kubectl_run.md -kubectl_scale.md -kubectl_stop.md -kubectl_update.md -kubectl_version.md diff --git a/release-0.19.0/docs/README.md b/release-0.19.0/docs/README.md deleted file mode 100644 index 137a5d1bd0f..00000000000 --- a/release-0.19.0/docs/README.md +++ /dev/null @@ -1,29 +0,0 @@ -# Kubernetes Documentation - -**Note** -This documentation is current for 0.19.0. - -Documentation for previous releases is available in their respective branches: - * [v0.18.1](https://github.com/GoogleCloudPlatform/kubernetes/tree/release-0.18/docs) - * [v0.17.1](https://github.com/GoogleCloudPlatform/kubernetes/tree/release-0.17/docs) - -* The [User's guide](user-guide.md) is for anyone who wants to run programs and services on an exisiting Kubernetes cluster. - -* The [Cluster Admin's guide](cluster-admin-guide.md) is for anyone setting up a Kubernetes cluster or administering it. - -* The [Developer guide](developer-guide.md) is for anyone wanting to write programs that access the kubernetes API, - write plugins or extensions, or modify the core code of kubernetes. - -* The [Kubectl Command Line Interface](kubectl.md) is a detailed reference on the `kubectl` CLI. - -* The [API object documentation](http://kubernetes.io/third_party/swagger-ui/) is a detailed description of all fields found in core API objects. - -* An overview of the [Design of Kubernetes](design) - -* There are example files and walkthroughs in the [examples](../examples) folder. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/README.md?pixel)]() diff --git a/release-0.19.0/docs/accessing-the-cluster.md b/release-0.19.0/docs/accessing-the-cluster.md deleted file mode 100644 index 0811b04534f..00000000000 --- a/release-0.19.0/docs/accessing-the-cluster.md +++ /dev/null @@ -1,342 +0,0 @@ -# User Guide to Accessing the Cluster - * [Accessing the cluster API](#api) - * [Accessing services running on the cluster](#otherservices) - * [Requesting redirects](#redirect) - * [So many proxies](#somanyproxies) - -## Accessing the cluster API -### Accessing for the first time with kubectl -When accessing the Kubernetes API for the first time, we suggest using the -kubernetes CLI, `kubectl`. - -To access a cluster, you need to know the location of the cluster and have credentials -to access it. Typically, this is automatically set-up when you work through -though a [Getting started guide](../docs/getting-started-guide/README.md), -or someone else setup the cluster and provided you with credentials and a location. - -Check the location and credentials that kubectl knows about with this command: -``` -kubectl config view -``` -. - -Many of the [examples](../examples/README.md) provide an introduction to using -kubectl and complete documentation is found in the [kubectl manual](../docs/kubectl.md). - -### Directly accessing the REST API -Kubectl handles locating and authenticating to the apiserver. -If you want to directly access the REST API with an http client like -curl or wget, or a browser, there are several ways to locate and authenticate: - - Run kubectl in proxy mode. - - Recommended approach. - - Uses stored apiserver location. - - Verifies identity of apiserver using self-signed cert. No MITM possible. - - Authenticates to apiserver. - - In future, may do intelligent client-side load-balancing and failover. - - Provide the location and credentials directly to the http client. - - Alternate approach. - - Works with some types of client code that are confused by using a proxy. - - Need to import a root cert into your browser to protect against MITM. - -#### Using kubectl proxy - -The following command runs kubectl in a mode where it acts as a reverse proxy. It handles -locating the apiserver and authenticating. -Run it like this: -``` -kubectl proxy --port=8080 & -``` -See [kubectl proxy](../docs/kubectl-proxy.md) for more details. - -Then you can explore the API with curl, wget, or a browser, like so: -``` -$ curl http://localhost:8080/api -{ - "versions": [ - "v1" - ] -} -``` -#### Without kubectl proxy -It is also possible to avoid using kubectl proxy by passing an authentication token -directly to the apiserver, like this: -``` -$ APISERVER=$(kubectl config view | grep server | cut -f 2- -d ":" | tr -d " ") -$ TOKEN=$(kubectl config view | grep token | cut -f 2 -d ":" | tr -d " ") -$ curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure -{ - "versions": [ - "v1" - ] -} -``` - -The above example uses the `--insecure` flag. This leaves it subject to MITM -attacks. When kubectl accesses the cluster it uses a stored root certificate -and client certificates to access the server. (These are installed in the -`~/.kube` directory). Since cluster certificates are typically self-signed, it -make take special configuration to get your http client to use root -certificate. - -On some clusters, the apiserver does not require authentication; it may serve -on localhost, or be protected by a firewall. There is not a standard -for this. [Configuring Access to the API](../docs/accessing_the_api.md) -describes how a cluster admin can configure this. Such approaches may conflict -with future high-availability support. - -### Programmatic access to the API - -There are [client libraries](../docs/client-libraries.md) for accessing the API -from several languages. The Kubernetes project-supported -[Go](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/pkg/client) -client library can use the same [kubeconfig file](../docs/kubeconfig-file.md) -as the kubectl CLI does to locate and authenticate to the apiserver. - -See documentation for other libraries for how they authenticate. - -### Accessing the API from a Pod - -When accessing the API from a pod, locating and authenticating -to the api server are somewhat different. - -The recommended way to locate the apiserver within the pod is with -the `kubernetes` DNS name, which resolves to a Service IP which in turn -will be routed to an apiserver. - -The recommended way to authenticate to the apiserver is with a -[service account](../docs/service_accounts.md). By default, a pod -is associated with a service account, and a credential (token) for that -service account is placed into the filetree of each container in that pod, -at `/var/run/secrets/kubernetes.io/serviceaccount`. - -From within a pod the recommended ways to connect to API are: - - run a kubectl proxy as one of the containers in the pod, or as a background - process within a container. This proxies the - kubernetes API to the localhost interface of the pod, so that other processes - in any container of the pod can access it. See this [example of using kubectl proxy - in a pod](../examples/kubectl-container/README.md). - - use the Go client library, and create a client using the `client.NewInContainer()` factory. - This handles locating and authenticating to the apiserver. - - -## Accessing services running on the cluster -The previous section was about connecting the Kubernetes API server. This section is about -connecting to other services running on Kubernetes cluster. In kubernetes, the -[nodes](../docs/node.md), [pods](../docs/pods.md) and [services](services.md) all have -their own IPs. In many cases, the node IPs, pod IPs, and some service IPs on a cluster will not be -routable outside from a machine outside the cluster, such as your desktop machine. - -### Ways to connect -You have several options for connecting to nodes, pods and services from outside the cluster: - - Access services through public IPs. - - Use a service with type `NodePort` or `LoadBalancer` to make the service reachable outside - the cluster. See the [services](../docs/services.md) and - [kubectl expose](../docs/kubectl_expose.md) documentation. - - Depending on your cluster environment, this may just expose the service to your corporate network, - or it may expose it to the internet. Think about whether the service being exposed is secure. - Does it do its own authentication? - - Place pods behind services. To access one specific pod from a set of replicas, such as for debugging, - place a unique label on the pod it and create a new service which selects this label. - - In most cases, it should not be necessary for application developer to directly access - nodes via their nodeIPs. - - Access services, nodes, or pods using the Proxy Verb. - - Does apiserver authentication and authorization prior to accessing the remote service. - Use this if the services are not secure enough to expose to the internet, or to gain - access to ports on the node IP, or for debugging. - - Proxies may cause problems for some web applications. - - Only works for HTTP/HTTPS. - - Described in [using the apiserver proxy](#apiserverproxy). - - Access from a node or pod in the cluster. - - Run a pod, and then connect to a shell in it using [kubectl exec](../docs/kubectl_exec.md). - Connect to other nodes, pods, and services from that shell. - - Some clusters may allow you to ssh to a node in the cluster. From there you may be able to - access cluster services. This is a non-standard method, and will work on some clusters but - not others. Browsers and other tools may or may not be installed. Cluster DNS may not work. - -### Discovering builtin services - -Typically, there are several services which are started on a cluster by default. Get a list of these -with the `kubectl cluster-info` command: -``` -$ kubectl cluster-info - - Kubernetes master is running at https://104.197.5.247 - elasticsearch-logging is running at https://104.197.5.247/api/v1/proxy/namespaces/default/services/elasticsearch-logging - kibana-logging is running at https://104.197.5.247/api/v1/proxy/namespaces/default/services/kibana-logging - kube-dns is running at https://104.197.5.247/api/v1/proxy/namespaces/default/services/kube-dns - grafana is running at https://104.197.5.247/api/v1/proxy/namespaces/default/services/monitoring-grafana - heapster is running at https://104.197.5.247/api/v1/proxy/namespaces/default/services/monitoring-heapster -``` -This shows the proxy-verb URL for accessing each service. -For example, this cluster has cluster-level logging enabled (using Elasticsearch), which can be reached -at `https://104.197.5.247/api/v1/proxy/namespaces/default/services/elasticsearch-logging/` if suitable credentials are passed, or through a kubectl proxy at, for example: -`http://localhost:8080/api/v1/proxy/namespaces/default/services/elasticsearch-logging/`. -(See [above](#api) for how to pass credentials or use kubectl proxy.) - -#### Manually constructing apiserver proxy URLs -As mentioned above, you use the `kubectl cluster-info` command to retrieve the service's proxy URL. To create proxy URLs that include service endpoints, suffixes, and parameters, you simply append to the service's proxy URL: -`http://`*`kubernetes_master_address`*`/`*`service_path`*`/`*`service_name`*`/`*`service_endpoint-suffix-parameter`* -##### Examples - * To access the Elasticsearch service endpoint `_search?q=user:kimchy`, you would use: `http://104.197.5.247/api/v1/proxy/namespaces/default/services/elasticsearch-logging/_search?q=user:kimchy` - - * To access the Elasticsearch cluster health information `_cluster/health?pretty=true`, you would use: `https://104.197.5.247/api/v1/proxy/namespaces/default/services/elasticsearch-logging/_cluster/health?pretty=true` - ``` - { - "cluster_name" : "kubernetes_logging", - "status" : "yellow", - "timed_out" : false, - "number_of_nodes" : 1, - "number_of_data_nodes" : 1, - "active_primary_shards" : 5, - "active_shards" : 5, - "relocating_shards" : 0, - "initializing_shards" : 0, - "unassigned_shards" : 5 - } - ``` - -#### Using web browsers to access services running on the cluster -You may be able to put a apiserver proxy url into the address bar of a browser. However: - - Web browsers cannot usually pass tokens, so you may need to use basic (password) auth. Apiserver can be configured to accespt basic auth, - but your cluster may not be configured to accept basic auth. - - Some web apps may not work, particularly those with client side javascript that construct urls in a - way that is unaware of the proxy path prefix. - -## Requesting redirects -Use a `redirect` request so that the server returns an HTTP redirect response and identifies the specific node and service that -can handle the request. - -**Note**: Since the hostname or address that is returned is usually only accessible from inside the cluster, -sending `redirect` requests is useful only for code running inside the cluster. Also, keep in mind that any subsequent `redirect` requests to the same -server might return different results (because another node at that point in time can better serve the request). - -**Tip**: Use a redirect request to reduce calls to the proxy server by first obtaining the address of a node on the -cluster and then using that returned address for all subsequent requests. - -##### Example -To request a redirect and then verify the address that gets returned, let's run a query on `oban` (Google Compute Engine virtual machine). Note that `oban` is running in the same project and default network (Google Compute Engine) as the Kubernetes cluster. - -To request a redirect for the Elasticsearch service, we can run the following `curl` command: -``` -user@oban:~$ curl -L -k -u admin:4mty0Vl9nNFfwLJz https://104.197.5.247/api/v1/redirect/namespaces/default/services/elasticsearch-logging/ -{ - "status" : 200, - "name" : "Skin", - "cluster_name" : "kubernetes_logging", - "version" : { - "number" : "1.4.4", - "build_hash" : "c88f77ffc81301dfa9dfd81ca2232f09588bd512", - "build_timestamp" : "2015-02-19T13:05:36Z", - "build_snapshot" : false, - "lucene_version" : "4.10.3" - }, - "tagline" : "You Know, for Search" -} -``` -**Note**: We use the `-L` flag in the request so that `curl` follows the returned redirect address and retrieves the Elasticsearch service information. - -If we examine the actual redirect header (instead run the same `curl` command with `-v`), we see that the request to `https://104.197.5.247/api/v1/redirect/namespaces/default/services/elasticsearch-logging/` is redirected to `http://10.244.2.7:9200`: -``` -user@oban:~$ curl -v -k -u admin:4mty0Vl9nNFfwLJz https://104.197.5.247/api/v1/redirect/namespaces/default/services/elasticsearch-logging/ -* About to connect() to 104.197.5.247 port 443 (#0) -* Trying 104.197.5.247... -* connected -* Connected to 104.197.5.247 (104.197.5.247) port 443 (#0) -* successfully set certificate verify locations: -* CAfile: none - CApath: /etc/ssl/certs -* SSLv3, TLS handshake, Client hello (1): -* SSLv3, TLS handshake, Server hello (2): -* SSLv3, TLS handshake, CERT (11): -* SSLv3, TLS handshake, Server key exchange (12): -* SSLv3, TLS handshake, Server finished (14): -* SSLv3, TLS handshake, Client key exchange (16): -* SSLv3, TLS change cipher, Client hello (1): -* SSLv3, TLS handshake, Finished (20): -* SSLv3, TLS change cipher, Client hello (1): -* SSLv3, TLS handshake, Finished (20): -* SSL connection using ECDHE-RSA-AES256-GCM-SHA384 -* Server certificate: -* subject: CN=kubernetes-master -* start date: 2015-03-04 19:40:24 GMT -* expire date: 2025-03-01 19:40:24 GMT -* issuer: CN=104.197.5.247@1425498024 -* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway. -* Server auth using Basic with user 'admin' -> GET /api/v1/redirect/namespaces/default/services/elasticsearch-logging HTTP/1.1 -> Authorization: Basic YWRtaW46M210eTBWbDluTkZmd0xKeg== -> User-Agent: curl/7.26.0 -> Host: 104.197.5.247 -> Accept: */* -> -* additional stuff not fine transfer.c:1037: 0 0 -* HTTP 1.1 or later with persistent connection, pipelining supported -< HTTP/1.1 307 Temporary Redirect -< Server: nginx/1.2.1 -< Date: Thu, 05 Mar 2015 00:14:45 GMT -< Content-Type: text/plain; charset=utf-8 -< Content-Length: 0 -< Connection: keep-alive -< Location: http://10.244.2.7:9200 -< -* Connection #0 to host 104.197.5.247 left intact -* Closing connection #0 -* SSLv3, TLS alert, Client hello (1): -``` - -We can also run the `kubectl get pods` command to view a list of the pods on the cluster and verify that `http://10.244.2.7` is where the Elasticsearch service is running: -``` -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED -elasticsearch-logging-controller-gziey 10.244.2.7 elasticsearch-logging kubernetes/elasticsearch:1.0 kubernetes-minion-hqhv.c.kubernetes-user2.internal/104.154.33.252 kubernetes.io/cluster-service=true,name=elasticsearch-logging Running 5 hours -kibana-logging-controller-ls6k1 10.244.1.9 kibana-logging kubernetes/kibana:1.1 kubernetes-minion-h5kt.c.kubernetes-user2.internal/146.148.80.37 kubernetes.io/cluster-service=true,name=kibana-logging Running 5 hours -kube-dns-oh43e 10.244.1.10 etcd quay.io/coreos/etcd:v2.0.3 kubernetes-minion-h5kt.c.kubernetes-user2.internal/146.148.80.37 k8s-app=kube-dns,kubernetes.io/cluster-service=true,name=kube-dns Running 5 hours - kube2sky kubernetes/kube2sky:1.0 - skydns kubernetes/skydns:2014-12-23-001 -monitoring-heapster-controller-fplln 10.244.0.4 heapster kubernetes/heapster:v0.8 kubernetes-minion-2il2.c.kubernetes-user2.internal/130.211.155.16 kubernetes.io/cluster-service=true,name=heapster,uses=monitoring-influxdb Running 5 hours -monitoring-influx-grafana-controller-0133o 10.244.3.4 influxdb kubernetes/heapster_influxdb:v0.3 kubernetes-minion-kmin.c.kubernetes-user2.internal/130.211.173.22 kubernetes.io/cluster-service=true,name=influxGrafana Running 5 hours - grafana kubernetes/heapster_grafana:v0.4 -``` - -##So Many Proxies -There are several different proxies you may encounter when using kubernetes: - 1. The [kubectl proxy](#kubectlproxy): - - runs on a user's desktop or in a pod - - proxies from a localhost address to the kubernetes apiserver - - client to proxy uses HTTP - - proxy to apiserver uses HTTPS - - locates apiserver - - adds authentication headers - 1. The [apiserver proxy](#apiserverproxy): - - is a bastion built into the apiserver - - connects a user outside of the cluster to cluster IPs which otherwise might not be reachable - - runs in the apiserver processes - - client to proxy uses HTTPS (or http if apiserver so configured) - - proxy to target may use HTTP or HTTPS as chosen by proxy using available information - - can be used to reach a Node, Pod, or Service - - does load balancing when used to reach a Service - 1. The [kube proxy](../docs/services.md#ips-and-vips): - - runs on each node - - proxies UDP and TCP - - does not understand HTTP - - provides load balancing - - is just used to reach services - 1. A Proxy/Load-balancer in front of apiserver(s): - - existence and implementation varies from cluster to cluster (e.g. nginx) - - sits between all clients and one or more apiservers - - acts as load balancer if there are several apiservers. - 1. Cloud Load Balancers on external services: - - are provided by some cloud providers (e.g. AWS ELB, Google Cloud Load Balancer) - - are created automatically when the kubernetes service has type `LoadBalancer` - - use UDP/TCP only - - implementation varies by cloud provider. - - - -Kubernetes users will typically not need to worry about anything other than the first two types. The cluster admin -will typically ensure that the latter types are setup correctly. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/accessing-the-cluster.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/accessing-the-cluster.md?pixel)]() diff --git a/release-0.19.0/docs/accessing_the_api.md b/release-0.19.0/docs/accessing_the_api.md deleted file mode 100644 index 910a012a562..00000000000 --- a/release-0.19.0/docs/accessing_the_api.md +++ /dev/null @@ -1,81 +0,0 @@ -# Configuring APIserver ports - -This document describes what ports the kubernetes apiserver -may serve on and how to reach them. The audience is -cluster administrators who want to customize their cluster -or understand the details. - -Most questions about accessing the cluster are covered -in [Accessing the cluster](../docs/accessing-the-cluster.md). - - -## Ports and IPs Served On -The Kubernetes API is served by the Kubernetes APIServer process. Typically, -there is one of these running on a single kubernetes-master node. - -By default the Kubernetes APIserver serves HTTP on 2 ports: - 1. Localhost Port - - serves HTTP - - default is port 8080, change with `-port` flag. - - defaults IP is localhost, change with `-address` flag. - - no authentication or authorization checks in HTTP - - protected by need to have host access - 2. Secure Port - - default is port 443, change with `-secure_port` - - default IP is first non-localhost network interface, change with `-public_address_override` - - serves HTTPS. Set cert with `-tls_cert_file` and key with `-tls_private_key_file`. - - uses token-file or client-certificate based [authentication](./authentication.md). - - uses policy-based [authorization](./authorization.md). - 3. Removed: ReadOnly Port - - For security reasons, this had to be removed. Use the service account feature instead. - -## Proxies and Firewall rules - -Additionally, in some configurations there is a proxy (nginx) running -on the same machine as the apiserver process. The proxy serves HTTPS protected -by Basic Auth on port 443, and proxies to the apiserver on localhost:8080. In -these configurations the secure port is typically set to 6443. - -A firewall rule is typically configured to allow external HTTPS access to port 443. - -The above are defaults and reflect how Kubernetes is deployed to GCE using -kube-up.sh. Other cloud providers may vary. - -## Use Cases vs IP:Ports - -There are three differently configured serving ports because there are a -variety of uses cases: - 1. Clients outside of a Kubernetes cluster, such as human running `kubectl` - on desktop machine. Currently, accesses the Localhost Port via a proxy (nginx) - running on the `kubernetes-master` machine. Proxy uses bearer token authentication. - 2. Processes running in Containers on Kubernetes that need to do read from - the apiserver. Currently, these can use a service account. - 3. Scheduler and Controller-manager processes, which need to do read-write - API operations. Currently, these have to run on the operations on the - apiserver. Currently, these have to run on the same host as the - apiserver and use the Localhost Port. In the future, these will be - switched to using service accounts to avoid the need to be co-located. - 4. Kubelets, which need to do read-write API operations and are necessarily - on different machines than the apiserver. Kubelet uses the Secure Port - to get their pods, to find the services that a pod can see, and to - write events. Credentials are distributed to kubelets at cluster - setup time. - -## Expected changes - - Policy will limit the actions kubelets can do via the authed port. - - Kubelets will change from token-based authentication to cert-based-auth. - - Scheduler and Controller-manager will use the Secure Port too. They - will then be able to run on different machines than the apiserver. - - A general mechanism will be provided for [giving credentials to - pods]( - https://github.com/GoogleCloudPlatform/kubernetes/issues/1907). - - Clients, like kubectl, will all support token-based auth, and the - Localhost will no longer be needed, and will not be the default. - However, the localhost port may continue to be an option for - installations that want to do their own auth proxy. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/accessing_the_api.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/accessing_the_api.md?pixel)]() diff --git a/release-0.19.0/docs/admission_controllers.md b/release-0.19.0/docs/admission_controllers.md deleted file mode 100644 index 9d302c0fa79..00000000000 --- a/release-0.19.0/docs/admission_controllers.md +++ /dev/null @@ -1,112 +0,0 @@ -# Admission Controllers - -## What are they? - -An admission control plug-in is a piece of code that intercepts requests to the Kubernetes -API server prior to persistence of the object, but after the request is authenticated -and authorized. The plug-in code is in the API server process -and must be compiled into the binary in order to be used at this time. - -Each admission control plug-in is run in sequence before a request is accepted into the cluster. If -any of the plug-ins in the sequence reject the request, the entire request is rejected immediately -and an error is returned to the end-user. - -Admission control plug-ins may mutate the incoming object in some cases to apply system configured -defaults. In addition, admission control plug-ins may mutate related resources as part of request -processing to do things like increment quota usage. - -## Why do I need them? - -Many advanced features in Kubernetes require an admission control plug-in to be enabled in order -to properly support the feature. As a result, a Kubernetes API server that is not properly -configured with the right set of admission control plug-ins is an incomplete server and will not -support all the features you expect. - -## How do I turn on an admission control plug-in? - -The Kubernetes API server supports a flag, ```admission_control``` that takes a comma-delimited, -ordered list of admission control choices to invoke prior to modifying objects in the cluster. - -## What does each plug-in do? - -### AlwaysAdmit - -Use this plugin by itself to pass-through all requests. - -### AlwaysDeny - -Rejects all requests. Used for testing. - -### DenyExecOnPrivileged - -This plug-in will intercept all requests to exec a command in a pod if that pod has a privileged container. - -If your cluster supports privileged containers, and you want to restrict the ability of end-users to exec -commands in those containers, we strongly encourage enabling this plug-in. - -### ServiceAccount - -This plug-in implements automation for [serviceAccounts]( service_accounts.md). -We strongly recommend using this plug-in if you intend to make use of Kubernetes ```ServiceAccount``` objects. - -### SecurityContextDeny - -This plug-in will deny any pod with a [SecurityContext](security_context.md) that defines options that were not available on the ```Container```. - -### ResourceQuota - -This plug-in will observe the incoming request and ensure that it does not violate any of the constraints -enumerated in the ```ResourceQuota``` object in a ```Namespace```. If you are using ```ResourceQuota``` -objects in your Kubernetes deployment, you MUST use this plug-in to enforce quota constraints. - -See the [resourceQuota design doc]( design/admission_control_resource_quota.md). - -It is strongly encouraged that this plug-in is configured last in the sequence of admission control plug-ins. This is -so that quota is not prematurely incremented only for the request to be rejected later in admission control. - -### LimitRanger - -This plug-in will observe the incoming request and ensure that it does not violate any of the constraints -enumerated in the ```LimitRange``` object in a ```Namespace```. If you are using ```LimitRange``` objects in -your Kubernetes deployment, you MUST use this plug-in to enforce those constraints. - -See the [limitRange design doc]( design/admission_control_limit_range.md). - -### NamespaceExists - -This plug-in will observe all incoming requests that attempt to create a resource in a Kubernetes ```Namespace``` -and reject the request if the ```Namespace``` was not previously created. We strongly recommend running -this plug-in to ensure integrity of your data. - -### NamespaceAutoProvision (deprecated) - -This plug-in will observe all incoming requests that attempt to create a resource in a Kubernetes ```Namespace``` -and create a new ```Namespace``` if one did not already exist previously. - -We strongly recommend ```NamespaceExists``` over ```NamespaceAutoProvision```. - -### NamespaceLifecycle - -This plug-in enforces that a ```Namespace``` that is undergoing termination cannot have new content created in it. - -A ```Namespace``` deletion kicks off a sequence of operations that remove all content (pods, services, etc.) in that -namespace. In order to enforce integrity of that process, we strongly recommend running this plug-in. - -Once ```NamespaceAutoProvision``` is deprecated, we anticipate ```NamespaceLifecycle``` and ```NamespaceExists``` will -be merged into a single plug-in that enforces the life-cycle of a ```Namespace``` in Kubernetes. - -## Is there a recommended set of plug-ins to use? - -Yes. - -For Kubernetes 1.0, we strongly recommend running the following set of admission control plug-ins (order matters): - -```shell ---admission_control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/admission_controllers.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/admission_controllers.md?pixel)]() diff --git a/release-0.19.0/docs/annotations.md b/release-0.19.0/docs/annotations.md deleted file mode 100644 index 070fe1e22e0..00000000000 --- a/release-0.19.0/docs/annotations.md +++ /dev/null @@ -1,31 +0,0 @@ -# Annotations - -We have [labels](labels.md) for identifying metadata. - -It is also useful to be able to attach arbitrary non-identifying metadata, for retrieval by API clients such as tools, libraries, etc. This information may be large, may be structured or unstructured, may include characters not permitted by labels, etc. Such information would not be used for object selection and therefore doesn't belong in labels. - -Like labels, annotations are key-value maps. -``` -"annotations": { - "key1" : "value1", - "key2" : "value2" -} -``` - -Possible information that could be recorded in annotations: - -* fields managed by a declarative configuration layer, to distinguish them from client- and/or server-set default values and other auto-generated fields, fields set by auto-sizing/auto-scaling systems, etc., in order to facilitate merging -* build/release/image information (timestamps, release ids, git branch, PR numbers, image hashes, registry address, etc.) -* pointers to logging/monitoring/analytics/audit repos -* client library/tool information (e.g. for debugging purposes -- name, version, build info) -* other user and/or tool/system provenance info, such as URLs of related objects from other ecosystem components -* lightweight rollout tool metadata (config and/or checkpoints) -* phone/pager number(s) of person(s) responsible, or directory entry where that info could be found, such as a team website - -Yes, this information could be stored in an external database or directory, but that would make it much harder to produce shared client libraries and tools for deployment, management, introspection, etc. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/annotations.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/annotations.md?pixel)]() diff --git a/release-0.19.0/docs/api-conventions.md b/release-0.19.0/docs/api-conventions.md deleted file mode 100644 index 0ee4d0d442c..00000000000 --- a/release-0.19.0/docs/api-conventions.md +++ /dev/null @@ -1,593 +0,0 @@ -API Conventions -=============== - -Updated: 4/16/2015 - -The conventions of the [Kubernetes API](api.md) (and related APIs in the ecosystem) are intended to ease client development and ensure that configuration mechanisms can be implemented that work across a diverse set of use cases consistently. - -The general style of the Kubernetes API is RESTful - clients create, update, delete, or retrieve a description of an object via the standard HTTP verbs (POST, PUT, DELETE, and GET) - and those APIs preferentially accept and return JSON. Kubernetes also exposes additional endpoints for non-standard verbs and allows alternative content types. All of the JSON accepted and returned by the server has a schema, identified by the "kind" and "apiVersion" fields. Where relevant HTTP header fields exist, they should mirror the content of JSON fields, but the information should not be represented only in the HTTP header. - -The following terms are defined: - -* **Kind** the name of a particular object schema (e.g. the "Cat" and "Dog" kinds would have different attributes and properties) -* **Resource** a representation of a system entity, sent or retrieved as JSON via HTTP to the server. Resources are exposed via: - * Collections - a list of resources of the same type, which may be queryable - * Elements - an individual resource, addressable via a URL - -Each resource typically accepts and returns data of a single kind. A kind may be accepted or returned by multiple resources that reflect specific use cases. For instance, the kind "pod" is exposed as a "pods" resource that allows end users to create, update, and delete pods, while a separate "pod status" resource (that acts on "pod" kind) allows automated processes to update a subset of the fields in that resource. A "restart" resource might be exposed for a number of different resources to allow the same action to have different results for each object. - -Resource collections should be all lowercase and plural, whereas kinds are CamelCase and singular. - - -Types (Kinds) -------------- - -Kinds are grouped into three categories: - -1. **Objects** represent a persistent entity in the system. - - Creating an API object is a record of intent - once created, the system will work to ensure that resource exists. All API objects have common metadata. - - An object may have multiple resources that clients can use to perform specific actions than create, update, delete, or get. - - Examples: Pods, ReplicationControllers, Services, Namespaces, Nodes - -2. **Lists** are collections of **resources** of one (usually) or more (occasionally) kinds. - - Lists have a limited set of common metadata. All lists use the "items" field to contain the array of objects they return. - - Most objects defined in the system should have an endpoint that returns the full set of resources, as well as zero or more endpoints that return subsets of the full list. Some objects may be singletons (the current user, the system defaults) and may not have lists. - - In addition, all lists that return objects with labels should support label filtering (see [labels.md](labels.md), and most lists should support filtering by fields. - - Examples: PodLists, ServiceLists, NodeLists - - TODO: Describe field filtering below or in a separate doc. - -3. **Simple** kinds are used for specific actions on objects and for non-persistent entities. - - Given their limited scope, they have the same set of limited common metadata as lists. - - The "size" action may accept a simple resource that has only a single field as input (the number of things). The "status" kind is returned when errors occur and is not persisted in the system. - - Examples: Binding, Status - -The standard REST verbs (defined below) MUST return singular JSON objects. Some API endpoints may deviate from the strict REST pattern and return resources that are not singular JSON objects, such as streams of JSON objects or unstructured text log data. - -The term "kind" is reserved for these "top-level" API types. The term "type" should be used for distinguishing sub-categories within objects or subobjects. - -### Resources - -All JSON objects returned by an API MUST have the following fields: - -* kind: a string that identifies the schema this object should have -* apiVersion: a string that identifies the version of the schema the object should have - -These fields are required for proper decoding of the object. They may be populated by the server by default from the specified URL path, but the client likely needs to know the values in order to construct the URL path. - -### Objects - -#### Metadata - -Every object kind MUST have the following metadata in a nested object field called "metadata": - -* namespace: a namespace is a DNS compatible subdomain that objects are subdivided into. The default namespace is 'default'. See [namespaces.md](namespaces.md) for more. -* name: a string that uniquely identifies this object within the current namespace (see [identifiers.md](identifiers.md)). This value is used in the path when retrieving an individual object. -* uid: a unique in time and space value (typically an RFC 4122 generated identifier, see [identifiers.md](identifiers.md)) used to distinguish between objects with the same name that have been deleted and recreated - -Every object SHOULD have the following metadata in a nested object field called "metadata": - -* resourceVersion: a string that identifies the internal version of this object that can be used by clients to determine when objects have changed. This value MUST be treated as opaque by clients and passed unmodified back to the server. Clients should not assume that the resource version has meaning across namespaces, different kinds of resources, or different servers. (see [concurrency control](#concurrency-control-and-consistency), below, for more details) -* creationTimestamp: a string representing an RFC 3339 date of the date and time an object was created -* deletionTimestamp: a string representing an RFC 3339 date of the date and time after which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. -* labels: a map of string keys and values that can be used to organize and categorize objects (see [labels.md](labels.md)) -* annotations: a map of string keys and values that can be used by external tooling to store and retrieve arbitrary metadata about this object (see [annotations.md](annotations.md)) - -Labels are intended for organizational purposes by end users (select the pods that match this label query). Annotations enable third-party automation and tooling to decorate objects with additional metadata for their own use. - -#### Spec and Status - -By convention, the Kubernetes API makes a distinction between the specification of the desired state of an object (a nested object field called "spec") and the status of the object at the current time (a nested object field called "status"). The specification is a complete description of the desired state, including configuration settings provided by the user, [default values](#defaulting) expanded by the system, and properties initialized or otherwise changed after creation by other ecosystem components (e.g., schedulers, auto-scalers), and is persisted in stable storage with the API object. If the specification is deleted, the object will be purged from the system. The status summarizes the current state of the object in the system, and is usually persisted with the object by an automated processes but may be generated on the fly. At some cost and perhaps some temporary degradation in behavior, the status could be reconstructed by observation if it were lost. - -When a new version of an object is POSTed or PUT, the "spec" is updated and available immediately. Over time the system will work to bring the "status" into line with the "spec". The system will drive toward the most recent "spec" regardless of previous versions of that stanza. In other words, if a value is changed from 2 to 5 in one PUT and then back down to 3 in another PUT the system is not required to 'touch base' at 5 before changing the "status" to 3. In other words, the system's behavior is *level-based* rather than *edge-based*. This enables robust behavior in the presence of missed intermediate state changes. - -The Kubernetes API also serves as the foundation for the declarative configuration schema for the system. In order to facilitate level-based operation and expression of declarative configuration, fields in the specification should have declarative rather than imperative names and semantics -- they represent the desired state, not actions intended to yield the desired state. - -The PUT and POST verbs on objects will ignore the "status" values. A `/status` subresource is provided to enable system components to update statuses of resources they manage. - -Otherwise, PUT expects the whole object to be specified. Therefore, if a field is omitted it is assumed that the client wants to clear that field's value. The PUT verb does not accept partial updates. Modification of just part of an object may be achieved by GETting the resource, modifying part of the spec, labels, or annotations, and then PUTting it back. See [concurrency control](#concurrency-control-and-consistency), below, regarding read-modify-write consistency when using this pattern. Some objects may expose alternative resource representations that allow mutation of the status, or performing custom actions on the object. - -All objects that represent a physical resource whose state may vary from the user's desired intent SHOULD have a "spec" and a "status". Objects whose state cannot vary from the user's desired intent MAY have only "spec", and MAY rename "spec" to a more appropriate name. - -Objects that contain both spec and status should not contain additional top-level fields other than the standard metadata fields. - -##### Typical status properties - -* **phase**: The phase is a simple, high-level summary of the phase of the lifecycle of an object. The phase should progress monotonically. Typical phase values are `Pending` (not yet fully physically realized), `Running` or `Active` (fully realized and active, but not necessarily operating correctly), and `Terminated` (no longer active), but may vary slightly for different types of objects. New phase values should not be added to existing objects in the future. Like other status fields, it must be possible to ascertain the lifecycle phase by observation. Additional details regarding the current phase may be contained in other fields. -* **conditions**: Conditions represent orthogonal observations of an object's current state. Objects may report multiple conditions, and new types of conditions may be added in the future. Condition status values may be `True`, `False`, or `Unknown`. Unlike the phase, conditions are not expected to be monotonic -- their values may change back and forth. A typical condition type is `Ready`, which indicates the object was believed to be fully operational at the time it was last probed. Conditions may carry additional information, such as the last probe time or last transition time. - -TODO(@vishh): Reason and Message. - -Phases and conditions are observations and not, themselves, state machines, nor do we define comprehensive state machines for objects with behaviors associated with state transitions. The system is level-based and should assume an Open World. Additionally, new observations and details about these observations may be added over time. - -In order to preserve extensibility, in the future, we intend to explicitly convey properties that users and components care about rather than requiring those properties to be inferred from observations. - -Note that historical information status (e.g., last transition time, failure counts) is only provided at best effort, and is not guaranteed to not be lost. - -Status information that may be large (especially unbounded in size, such as lists of references to other objects -- see below) and/or rapidly changing, such as [resource usage](resources.md#usage-data), should be put into separate objects, with possibly a reference from the original object. This helps to ensure that GETs and watch remain reasonably efficient for the majority of clients, which may not need that data. - -#### References to related objects - -References to loosely coupled sets of objects, such as [pods](pods.md) overseen by a [replication controller](replication-controller.md), are usually best referred to using a [label selector](labels.md). In order to ensure that GETs of individual objects remain bounded in time and space, these sets may be queried via separate API queries, but will not be expanded in the referring object's status. - -References to specific objects, especially specific resource versions and/or specific fields of those objects, are specified using the `ObjectReference` type. Unlike partial URLs, the ObjectReference type facilitates flexible defaulting of fields from the referring object or other contextual information. - -References in the status of the referee to the referrer may be permitted, when the references are one-to-one and do not need to be frequently updated, particularly in an edge-based manner. - -#### Lists of named subobjects preferred over maps - -Discussed in [#2004](https://github.com/GoogleCloudPlatform/kubernetes/issues/2004) and elsewhere. There are no maps of subobjects in any API objects. Instead, the convention is to use a list of subobjects containing name fields. - -For example: -```yaml -ports: - - name: www - containerPort: 80 -``` -vs. -```yaml -ports: - www: - containerPort: 80 -``` - -This rule maintains the invariant that all JSON/YAML keys are fields in API objects. The only exceptions are pure maps in the API (currently, labels, selectors, and annotations), as opposed to sets of subobjects. - -#### Constants - -Some fields will have a list of allowed values (enumerations). These values will be strings, and they will be in CamelCase, with an initial uppercase letter. Examples: "ClusterFirst", "Pending", "ClientIP". - -### Lists and Simple kinds - -Every list or simple kind SHOULD have the following metadata in a nested object field called "metadata": - -* resourceVersion: a string that identifies the common version of the objects returned by in a list. This value MUST be treated as opaque by clients and passed unmodified back to the server. A resource version is only valid within a single namespace on a single kind of resource. - -Every simple kind returned by the server, and any simple kind sent to the server that must support idempotency or optimistic concurrency should return this value.Since simple resources are often used as input alternate actions that modify objects, the resource version of the simple resource should correspond to the resource version of the object. - - -Differing Representations -------------------------- - -An API may represent a single entity in different ways for different clients, or transform an object after certain transitions in the system occur. In these cases, one request object may have two representations available as different resources, or different kinds. - -An example is a Service, which represents the intent of the user to group a set of pods with common behavior on common ports. When Kubernetes detects a pod matches the service selector, the IP address and port of the pod are added to an Endpoints resource for that Service. The Endpoints resource exists only if the Service exists, but exposes only the IPs and ports of the selected pods. The full service is represented by two distinct resources - under the original Service resource the user created, as well as in the Endpoints resource. - -As another example, a "pod status" resource may accept a PUT with the "pod" kind, with different rules about what fields may be changed. - -Future versions of Kubernetes may allow alternative encodings of objects beyond JSON. - - -Verbs on Resources ------------------- - -API resources should use the traditional REST pattern: - -* GET /<resourceNamePlural> - Retrieve a list of type <resourceName>, e.g. GET /pods returns a list of Pods. -* POST /<resourceNamePlural> - Create a new resource from the JSON object provided by the client. -* GET /<resourceNamePlural>/<name> - Retrieves a single resource with the given name, e.g. GET /pods/first returns a Pod named 'first'. Should be constant time, and the resource should be bounded in size. -* DELETE /<resourceNamePlural>/<name> - Delete the single resource with the given name. DeleteOptions may specify gracePeriodSeconds, the optional duration in seconds before the object should be deleted. Individual kinds may declare fields which provide a default grace period, and different kinds may have differing kind-wide default grace periods. A user provided grace period overrides a default grace period, including the zero grace period ("now"). -* PUT /<resourceNamePlural>/<name> - Update or create the resource with the given name with the JSON object provided by the client. -* PATCH /<resourceNamePlural>/<name> - Selectively modify the specified fields of the resource. See more information [below](#patch). - -Kubernetes by convention exposes additional verbs as new root endpoints with singular names. Examples: - -* GET /watch/<resourceNamePlural> - Receive a stream of JSON objects corresponding to changes made to any resource of the given kind over time. -* GET /watch/<resourceNamePlural>/<name> - Receive a stream of JSON objects corresponding to changes made to the named resource of the given kind over time. - -These are verbs which change the fundamental type of data returned (watch returns a stream of JSON instead of a single JSON object). Support of additional verbs is not required for all object types. - -Two additional verbs `redirect` and `proxy` provide access to cluster resources as described in [accessing-the-cluster.md](accessing-the-cluster.md). - -When resources wish to expose alternative actions that are closely coupled to a single resource, they should do so using new sub-resources. An example is allowing automated processes to update the "status" field of a Pod. The `/pods` endpoint only allows updates to "metadata" and "spec", since those reflect end-user intent. An automated process should be able to modify status for users to see by sending an updated Pod kind to the server to the "/pods/<name>/status" endpoint - the alternate endpoint allows different rules to be applied to the update, and access to be appropriately restricted. Likewise, some actions like "stop" or "scale" are best represented as REST sub-resources that are POSTed to. The POST action may require a simple kind to be provided if the action requires parameters, or function without a request body. - -TODO: more documentation of Watch - -### PATCH operations - -The API supports three different PATCH operations, determined by their corresponding Content-Type header: - -* JSON Patch, `Content-Type: application/json-patch+json` - * As defined in [RFC6902](https://tools.ietf.org/html/rfc6902), a JSON Patch is a sequence of operations that are executed on the resource, e.g. `{"op": "add", "path": "/a/b/c", "value": [ "foo", "bar" ]}`. For more details on how to use JSON Patch, see the RFC. -* Merge Patch, `Content-Type: application/merge-json-patch+json` - * As defined in [RFC7386](https://tools.ietf.org/html/rfc7386), a Merge Patch is essentially a partial representation of the resource. The submitted JSON is "merged" with the current resource to create a new one, then the new one is saved. For more details on how to use Merge Patch, see the RFC. -* Strategic Merge Patch, `Content-Type: application/strategic-merge-patch+json` - * Strategic Merge Patch is a custom implementation of Merge Patch. For a detailed explanation of how it works and why it needed to be introduced, see below. - -#### Strategic Merge Patch - -In the standard JSON merge patch, JSON objects are always merged but lists are always replaced. Often that isn't what we want. Let's say we start with the following Pod: - -```yaml -spec: - containers: - - name: nginx - image: nginx-1.0 -``` - -...and we POST that to the server (as JSON). Then let's say we want to *add* a container to this Pod. - -```yaml -PATCH /api/v1/namespaces/default/pods/pod-name -spec: - containers: - - name: log-tailer - image: log-tailer-1.0 -``` - -If we were to use standard Merge Patch, the entire container list would be replaced with the single log-tailer container. However, our intent is for the container lists to merge together based on the `name` field. - -To solve this problem, Strategic Merge Patch uses metadata attached to the API objects to determine what lists should be merged and which ones should not. Currently the metadata is available as struct tags on the API objects themselves, but will become available to clients as Swagger annotations in the future. In the above example, the `patchStrategy` metadata for the `containers` field would be `merge` and the `patchMergeKey` would be `name`. - -Note: If the patch results in merging two lists of scalars, the scalars are first deduplicated and then merged. - -Strategic Merge Patch also supports special operations as listed below. - -### List Operations - -To override the container list to be strictly replaced, regardless of the default: - -```yaml -containers: - - name: nginx - image: nginx-1.0 - - $patch: replace # any further $patch operations nested in this list will be ignored -``` - -To delete an element of a list that should be merged: - -```yaml -containers: - - name: nginx - image: nginx-1.0 - - $patch: delete - name: log-tailer # merge key and value goes here -``` - -### Map Operations - -To indicate that a map should not be merged and instead should be taken literally: - -```yaml -$patch: replace # recursive and applies to all fields of the map it's in -containers: -- name: nginx - image: nginx-1.0 -``` - -To delete a field of a map: - -```yaml -name: nginx -image: nginx-1.0 -labels: - live: null # set the value of the map key to null -``` - - -Idempotency ------------ - -All compatible Kubernetes APIs MUST support "name idempotency" and respond with an HTTP status code 409 when a request is made to POST an object that has the same name as an existing object in the system. See [identifiers.md](identifiers.md) for details. - -Names generated by the system may be requested using `metadata.generateName`. GenerateName indicates that the name should be made unique by the server prior to persisting it. A non-empty value for the field indicates the name will be made unique (and the name returned to the client will be different than the name passed). The value of this field will be combined with a unique suffix on the server if the Name field has not been provided. The provided value must be valid within the rules for Name, and may be truncated by the length of the suffix required to make the value unique on the server. If this field is specified, and Name is not present, the server will NOT return a 409 if the generated name exists - instead, it will either return 201 Created or 504 with Reason `ServerTimeout` indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). - -Defaulting ----------- - -Default resource values are API version-specific, and they are applied during -the conversion from API-versioned declarative configuration to internal objects -representing the desired state (`Spec`) of the resource. Subsequent GETs of the -resource will include the default values explicitly. - -Incorporating the default values into the `Spec` ensures that `Spec` depicts the -full desired state so that it is easier for the system to determine how to -achieve the state, and for the user to know what to anticipate. - -API version-specific default values are set by the API server. - -Late Initialization -------------------- -Late initialization is when resource fields are set by a system controller -after an object is created/updated. - -For example, the scheduler sets the pod.spec.nodeName field after the pod is created. - -Late-initializers should only make the following types of modifications: - - Setting previously unset fields - - Adding keys to maps - - Adding values to arrays which have mergeable semantics (`patchStrategy:"merge"` attribute in - go definition of type). -These conventions: - 1. allow a user (with sufficient privilege) to override any system-default behaviors by setting - the fields that would otherwise have been defaulted. - 1. enables updates from users to be merged with changes made during late initialization, using - strategic merge patch, as opposed to clobbering the change. - 1. allow the component which does the late-initialization to use strategic merge patch, which - facilitates composition and concurrency of such components. - -Although the apiserver Admission Control stage acts prior to object creation, -Admission Control plugins should follow the Late Initialization conventions -too, to allow their implementation to be later moved to a controller, or to client libraries. - -Concurrency Control and Consistency ------------------------------------ - -Kubernetes leverages the concept of *resource versions* to achieve optimistic concurrency. All Kubernetes resources have a "resourceVersion" field as part of their metadata. This resourceVersion is a string that identifies the internal version of an object that can be used by clients to determine when objects have changed. When a record is about to be updated, it's version is checked against a pre-saved value, and if it doesn't match, the update fails with a StatusConflict (HTTP status code 409). - -The resourceVersion is changed by the server every time an object is modified. If resourceVersion is included with the PUT operation the system will verify that there have not been other successful mutations to the resource during a read/modify/write cycle, by verifying that the current value of resourceVersion matches the specified value. - -The resourceVersion is currently backed by [etcd's modifiedIndex](https://coreos.com/docs/distributed-configuration/etcd-api/). However, it's important to note that the application should *not* rely on the implementation details of the versioning system maintained by Kubernetes. We may change the implementation of resourceVersion in the future, such as to change it to a timestamp or per-object counter. - -The only way for a client to know the expected value of resourceVersion is to have received it from the server in response to a prior operation, typically a GET. This value MUST be treated as opaque by clients and passed unmodified back to the server. Clients should not assume that the resource version has meaning across namespaces, different kinds of resources, or different servers. Currently, the value of resourceVersion is set to match etcd's sequencer. You could think of it as a logical clock the API server can use to order requests. However, we expect the implementation of resourceVersion to change in the future, such as in the case we shard the state by kind and/or namespace, or port to another storage system. - -In the case of a conflict, the correct client action at this point is to GET the resource again, apply the changes afresh, and try submitting again. This mechanism can be used to prevent races like the following: - -``` -Client #1 Client #2 -GET Foo GET Foo -Set Foo.Bar = "one" Set Foo.Baz = "two" -PUT Foo PUT Foo -``` - -When these sequences occur in parallel, either the change to Foo.Bar or the change to Foo.Baz can be lost. - -On the other hand, when specifying the resourceVersion, one of the PUTs will fail, since whichever write succeeds changes the resourceVersion for Foo. - -resourceVersion may be used as a precondition for other operations (e.g., GET, DELETE) in the future, such as for read-after-write consistency in the presence of caching. - -"Watch" operations specify resourceVersion using a query parameter. It is used to specify the point at which to begin watching the specified resources. This may be used to ensure that no mutations are missed between a GET of a resource (or list of resources) and a subsequent Watch, even if the current version of the resource is more recent. This is currently the main reason that list operations (GET on a collection) return resourceVersion. - - -Serialization Format --------------------- - -APIs may return alternative representations of any resource in response to an Accept header or under alternative endpoints, but the default serialization for input and output of API responses MUST be JSON. - -All dates should be serialized as RFC3339 strings. - - -Units ------ - -Units must either be explicit in the field name (e.g., `timeoutSeconds`), or must be specified as part of the value (e.g., `resource.Quantity`). Which approach is preferred is TBD. - - -Selecting Fields ----------------- - -Some APIs may need to identify which field in a JSON object is invalid, or to reference a value to extract from a separate resource. The current recommendation is to use standard JavaScript syntax for accessing that field, assuming the JSON object was transformed into a JavaScript object. - -Examples: - -* Find the field "current" in the object "state" in the second item in the array "fields": `fields[0].state.current` - -TODO: Plugins, extensions, nested kinds, headers - - -HTTP Status codes ------------------ - -The server will respond with HTTP status codes that match the HTTP spec. See the section below for a breakdown of the types of status codes the server will send. - -The following HTTP status codes may be returned by the API. - -#### Success codes - -* `200 StatusOK` - * Indicates that the request completed successfully. -* `201 StatusCreated` - * Indicates that the request to create kind completed successfully. -* `204 StatusNoContent` - * Indicates that the request completed successfully, and the response contains no body. - * Returned in response to HTTP OPTIONS requests. - -#### Error codes -* `307 StatusTemporaryRedirect` - * Indicates that the address for the requested resource has changed. - * Suggested client recovery behavior - * Follow the redirect. -* `400 StatusBadRequest` - * Indicates the requested is invalid. - * Suggested client recovery behavior: - * Do not retry. Fix the request. -* `401 StatusUnauthorized` - * Indicates that the server can be reached and understood the request, but refuses to take any further action, because the client must provide authorization. If the client has provided authorization, the server is indicating the provided authorization is unsuitable or invalid. - * Suggested client recovery behavior - * If the user has not supplied authorization information, prompt them for the appropriate credentials - * If the user has supplied authorization information, inform them their credentials were rejected and optionally prompt them again. -* `403 StatusForbidden` - * Indicates that the server can be reached and understood the request, but refuses to take any further action, because it is configured to deny access for some reason to the requested resource by the client. - * Suggested client recovery behavior - * Do not retry. Fix the request. -* `404 StatusNotFound` - * Indicates that the requested resource does not exist. - * Suggested client recovery behavior - * Do not retry. Fix the request. -* `405 StatusMethodNotAllowed` - * Indicates that that the action the client attempted to perform on the resource was not supported by the code. - * Suggested client recovery behavior - * Do not retry. Fix the request. -* `409 StatusConflict` - * Indicates that either the resource the client attempted to create already exists or the requested update operation cannot be completed due to a conflict. - * Suggested client recovery behavior - * * If creating a new resource - * * Either change the identifier and try again, or GET and compare the fields in the pre-existing object and issue a PUT/update to modify the existing object. - * * If updating an existing resource: - * See `Conflict` from the `status` response section below on how to retrieve more information about the nature of the conflict. - * GET and compare the fields in the pre-existing object, merge changes (if still valid according to preconditions), and retry with the updated request (including `ResourceVersion`). -* `422 StatusUnprocessableEntity` - * Indicates that the requested create or update operation cannot be completed due to invalid data provided as part of the request. - * Suggested client recovery behavior - * Do not retry. Fix the request. -* `429 StatusTooManyRequests` - * Indicates that the either the client rate limit has been exceeded or the server has received more requests then it can process. - * Suggested client recovery behavior: - * Read the ```Retry-After``` HTTP header from the response, and wait at least that long before retrying. -* `500 StatusInternalServerError` - * Indicates that the server can be reached and understood the request, but either an unexpected internal error occurred and the outcome of the call is unknown, or the server cannot complete the action in a reasonable time (this maybe due to temporary server load or a transient communication issue with another server). - * Suggested client recovery behavior: - * Retry with exponential backoff. -* `503 StatusServiceUnavailable` - * Indicates that required service is unavailable. - * Suggested client recovery behavior: - * Retry with exponential backoff. -* `504 StatusServerTimeout` - * Indicates that the request could not be completed within the given time. Clients can get this response ONLY when they specified a timeout param in the request. - * Suggested client recovery behavior: - * Increase the value of the timeout param and retry with exponential backoff - -Response Status Kind --------------------- - -Kubernetes will always return the ```Status``` kind from any API endpoint when an error occurs. -Clients SHOULD handle these types of objects when appropriate. - -A ```Status``` kind will be returned by the API in two cases: - * When an operation is not successful (i.e. when the server would return a non 2xx HTTP status code). - * When a HTTP ```DELETE``` call is successful. - -The status object is encoded as JSON and provided as the body of the response. The status object contains fields for humans and machine consumers of the API to get more detailed information for the cause of the failure. The information in the status object supplements, but does not override, the HTTP status code's meaning. When fields in the status object have the same meaning as generally defined HTTP headers and that header is returned with the response, the header should be considered as having higher priority. - -**Example:** -``` -$ curl -v -k -H "Authorization: Bearer WhCDvq4VPpYhrcfmF6ei7V9qlbqTubUc" https://10.240.122.184:443/api/v1/namespaces/default/pods/grafana - -> GET /api/v1/namespaces/default/pods/grafana HTTP/1.1 -> User-Agent: curl/7.26.0 -> Host: 10.240.122.184 -> Accept: */* -> Authorization: Bearer WhCDvq4VPpYhrcfmF6ei7V9qlbqTubUc -> - -< HTTP/1.1 404 Not Found -< Content-Type: application/json -< Date: Wed, 20 May 2015 18:10:42 GMT -< Content-Length: 232 -< -{ - "kind": "Status", - "apiVersion": "v1", - "metadata": {}, - "status": "Failure", - "message": "pods \"grafana\" not found", - "reason": "NotFound", - "details": { - "name": "grafana", - "kind": "pods" - }, - "code": 404 -} -``` - -```status``` field contains one of two possible values: -* `Success` -* `Failure` - -`message` may contain human-readable description of the error - -```reason``` may contain a machine-readable description of why this operation is in the `Failure` status. If this value is empty there is no information available. The `reason` clarifies an HTTP status code but does not override it. - -```details``` may contain extended data associated with the reason. Each reason may define its own extended details. This field is optional and the data returned is not guaranteed to conform to any schema except that defined by the reason type. - -Possible values for the ```reason``` and ```details``` fields: -* `BadRequest` - * Indicates that the request itself was invalid, because the request doesn't make any sense, for example deleting a read-only object. - * This is different than `status reason` `Invalid` above which indicates that the API call could possibly succeed, but the data was invalid. - * API calls that return BadRequest can never succeed. - * Http status code: `400 StatusBadRequest` -* `Unauthorized` - * Indicates that the server can be reached and understood the request, but refuses to take any further action without the client providing appropriate authorization. If the client has provided authorization, this error indicates the provided credentials are insufficient or invalid. - * Details (optional): - * `kind string` - * The kind attribute of the unauthorized resource (on some operations may differ from the requested resource). - * `name string` - * The identifier of the unauthorized resource. - * HTTP status code: `401 StatusUnauthorized` -* `Forbidden` - * Indicates that the server can be reached and understood the request, but refuses to take any further action, because it is configured to deny access for some reason to the requested resource by the client. - * Details (optional): - * `kind string` - * The kind attribute of the forbidden resource (on some operations may differ from the requested resource). - * `name string` - * The identifier of the forbidden resource. - * HTTP status code: `403 StatusForbidden` -* `NotFound` - * Indicates that one or more resources required for this operation could not be found. - * Details (optional): - * `kind string` - * The kind attribute of the missing resource (on some operations may differ from the requested resource). - * `name string` - * The identifier of the missing resource. - * HTTP status code: `404 StatusNotFound` -* `AlreadyExists` - * Indicates that the resource you are creating already exists. - * Details (optional): - * `kind string` - * The kind attribute of the conflicting resource. - * `name string` - * The identifier of the conflicting resource. - * HTTP status code: `409 StatusConflict` -* `Conflict` - * Indicates that the requested update operation cannot be completed due to a conflict. The client may need to alter the request. Each resource may define custom details that indicate the nature of the conflict. - * HTTP status code: `409 StatusConflict` -* `Invalid` - * Indicates that the requested create or update operation cannot be completed due to invalid data provided as part of the request. - * Details (optional): - * `kind string` - * the kind attribute of the invalid resource - * `name string` - * the identifier of the invalid resource - * `causes` - * One or more `StatusCause` entries indicating the data in the provided resource that was invalid. The `reason`, `message`, and `field` attributes will be set. - * HTTP status code: `422 StatusUnprocessableEntity` -* `Timeout` - * Indicates that the request could not be completed within the given time. Clients may receive this response if the server has decided to rate limit the client, or if the server is overloaded and cannot process the request at this time. - * Http status code: `429 TooManyRequests` - * The server should set the `Retry-After` HTTP header and return `retryAfterSeconds` in the details field of the object. A value of `0` is the default. -* `ServerTimeout` - * Indicates that the server can be reached and understood the request, but cannot complete the action in a reasonable time. This maybe due to temporary server load or a transient communication issue with another server. - * Details (optional): - * `kind string` - * The kind attribute of the resource being acted on. - * `name string` - * The operation that is being attempted. - * The server should set the `Retry-After` HTTP header and return `retryAfterSeconds` in the details field of the object. A value of `0` is the default. - * Http status code: `504 StatusServerTimeout` -* `MethodNotAllowed` - * Indicates that that the action the client attempted to perform on the resource was not supported by the code. - * For instance, attempting to delete a resource that can only be created. - * API calls that return MethodNotAllowed can never succeed. - * Http status code: `405 StatusMethodNotAllowed` -* `InternalError` - * Indicates that an internal error occurred, it is unexpected and the outcome of the call is unknown. - * Details (optional): - * `causes` - * The original error. - * Http status code: `500 StatusInternalServerError` - -`code` may contain the suggested HTTP return code for this status. - - -Events ------- - -TODO: Document events (refer to another doc for details) - - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/api-conventions.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/api-conventions.md?pixel)]() diff --git a/release-0.19.0/docs/api.md b/release-0.19.0/docs/api.md deleted file mode 100644 index b721b53f317..00000000000 --- a/release-0.19.0/docs/api.md +++ /dev/null @@ -1,74 +0,0 @@ -# The Kubernetes API - -Primary system and API concepts are documented in the [User guide](user-guide.md). - -Overall API conventions are described in the [API conventions doc](api-conventions.md). - -Complete API details are documented via [Swagger](http://swagger.io/). The Kubernetes apiserver (aka "master") exports an API that can be used to retrieve the [Swagger spec](https://github.com/swagger-api/swagger-spec/tree/master/schemas/v1.2) for the Kubernetes API, by default at `/swaggerapi`, and a UI you can use to browse the API documentation at `/swagger-ui`. We also periodically update a [statically generated UI](http://kubernetes.io/third_party/swagger-ui/). - -Remote access to the API is discussed in the [access doc](accessing_the_api.md). - -The Kubernetes API also serves as the foundation for the declarative configuration schema for the system. The [Kubectl](kubectl.md) command-line tool can be used to create, update, delete, and get API objects. - -Kubernetes also stores its serialized state (currently in [etcd](https://coreos.com/docs/distributed-configuration/getting-started-with-etcd/)) in terms of the API resources. - -Kubernetes itself is decomposed into multiple components, which interact through its API. - -## API changes - -In our experience, any system that is successful needs to grow and change as new use cases emerge or existing ones change. Therefore, we expect the Kubernetes API to continuously change and grow. However, we intend to not break compatibility with existing clients, for an extended period of time. In general, new API resources and new resource fields can be expected to be added frequently. Elimination of resources or fields will require following a deprecation process. The precise deprecation policy for eliminating features is TBD, but once we reach our 1.0 milestone, there will be a specific policy. - -What constitutes a compatible change and how to change the API are detailed by the [API change document](devel/api_changes.md). - -## API versioning - -Fine-grain resource evolution alone makes it difficult to eliminate fields or restructure resource representations. Therefore, Kubernetes supports multiple API versions, each at a different API path prefix, such as `/api/v1beta3`. These are simply different interfaces to read and/or modify the same underlying resources. In general, all API resources are accessible via all API versions, though there may be some cases in the future where that is not true. - -Distinct API versions present more clear, consistent views of system resources and behavior than intermingled, independently evolved resources. They also provide a more straightforward mechanism for controlling access to end-of-lifed and/or experimental APIs. - -The [API and release versioning proposal](versioning.md) describes the current thinking on the API version evolution process. - -## v1beta1, v1beta2, and v1beta3 are deprecated; please move to v1 ASAP - -As of June 4, 2015, the Kubernetes v1 API has been enabled by default. The v1beta1 and v1beta2 APIs were deleted on June 1, 2015. v1beta3 is planned to be deleted on July 6, 2015. - -### v1 conversion tips (from v1beta3) - -We're working to convert all documentation and examples to v1. A simple [API conversion tool](cluster_management.md#switching-your-config-files-to-a-new-api-version) has been written to simplify the translation process. Use `kubectl create --validate` in order to validate your json or yaml against our Swagger spec. - -Changes to services are the most significant difference between v1beta3 and v1. -* The `service.spec.portalIP` property is renamed to `service.spec.clusterIP`. -* The `service.spec.createExternalLoadBalancer` property is removed. Specify `service.spec.type: "LoadBalancer"` to create an external load balancer instead. -* The `service.spec.publicIPs` property is deprecated and now called `service.spec.deprecatedPublicIPs`. This property will be removed entirely when v1beta3 is removed. The vast majority of users of this field were using it to expose services on ports on the node. Those users should specify `service.spec.type: "NodePort"` instead. Read [External Services](services.md#external-services) for more info. If this is not sufficient for your use case, please file an issue or contact @thockin. - -Some other difference between v1beta3 and v1: -* The `pod.spec.containers[*].privileged` and `pod.spec.containers[*].capabilities` properties are now nested under the `pod.spec.containers[*].securityContext` property. See [Security Contexts](security_context.md). -* The `pod.spec.host` property is renamed to `pod.spec.nodeName`. -* The `endpoints.subsets[*].addresses.IP` property is renamed to `endpoints.subsets[*].addresses.ip`. -* The `pod.status.containerStatuses[*].state.termination` and `pod.status.containerStatuses[*].lastState.termination` properties are renamed to `pod.status.containerStatuses[*].state.terminated` and `pod.status.containerStatuses[*].state.terminated` respectively. -* The `pod.status.Condition` property is renamed to `pod.status.conditions`. -* The `status.details.id` property is renamed to `status.details.name`. - -### v1beta3 conversion tips (from v1beta1/2) - -Some important differences between v1beta1/2 and v1beta3: -* The resource `id` is now called `name`. -* `name`, `labels`, `annotations`, and other metadata are now nested in a map called `metadata` -* `desiredState` is now called `spec`, and `currentState` is now called `status` -* `/minions` has been moved to `/nodes`, and the resource has kind `Node` -* The namespace is required (for all namespaced resources) and has moved from a URL parameter to the path: `/api/v1beta3/namespaces/{namespace}/{resource_collection}/{resource_name}`. If you were not using a namespace before, use `default` here. -* The names of all resource collections are now lower cased - instead of `replicationControllers`, use `replicationcontrollers`. -* To watch for changes to a resource, open an HTTP or Websocket connection to the collection query and provide the `?watch=true` query parameter along with the desired `resourceVersion` parameter to watch from. -* The `labels` query parameter has been renamed to `label-selector`. -* The container `entrypoint` has been renamed to `command`, and `command` has been renamed to `args`. -* Container, volume, and node resources are expressed as nested maps (e.g., `resources{cpu:1}`) rather than as individual fields, and resource values support [scaling suffixes](resources.md#resource-quantities) rather than fixed scales (e.g., milli-cores). -* Restart policy is represented simply as a string (e.g., `"Always"`) rather than as a nested map (`always{}`). -* Pull policies changed from `PullAlways`, `PullNever`, and `PullIfNotPresent` to `Always`, `Never`, and `IfNotPresent`. -* The volume `source` is inlined into `volume` rather than nested. -* Host volumes have been changed from `hostDir` to `hostPath` to better reflect that they can be files or directories. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/api.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/api.md?pixel)]() diff --git a/release-0.19.0/docs/architecture.dia b/release-0.19.0/docs/architecture.dia deleted file mode 100644 index 26e0eed22e6ffdc7781055de4dfcc1e8d2b968d4..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6522 zcmV-=8HMH_iwFP!000021MOW~Z{x<2e)q2sJTEzbrp>-oUyjb?AUV6iIY2fWY_ix# zgO)fR?Z}cL(Q|v)-@e_XWLpv`QS5G-@|1y@gdT~drmE_zs{Xp_Z-4)CHyeD)maFMv z{_c{JT-S5`FP4j#?y?My9!92ao z-d*0L}HvzAM0#wi^VKU=cUwq`H;1jvl^!}t6~S2)&B19r+L0O^7-GVvsIG?l)rwoxKpk7b~&9K zHr}mQ)ZFFsbdrC#{&MJX(e{t4y!+QkcmFh9O>bsd)u*4%^I*6C8s_%9-%jDdpWg1N z4dvZxA!4F4$l!E{xP6#Tvegka+kQ>Woj$Bzc6IEj@4l|-gDHQt1K5R#S^70wu5bVI z6I2h@U+~)F4AOBv{j|Ay_DmKx|C^2T^aaU+}(VV?hR4_P0w>FtNSUKlm@`6bVOL_1-t z4~x&&6~W_iRIIk(t0#4Bt-sV;e+3akD(w@BslkG9uu?{n6JhmN*}tPIu;-$hs4z1z zRhHTZc8*&5XZ9t3rlxeQrYwM(It`+P#aGjWfR=p3t^NqEoKUV!%Wpe(&*MmFvGba` z@3qLqwqCcBy8X78WHpJ~foP{LbY9H!Dq-&TgZJs(boSMLrgXl#9IW!M4wkJ;D&P9g zZ1yS3r{nZ_^lW* z4|nTF*-%PlfOncvd@4TDu30>N6du4Q{W4p89)C!ec`bBuZ=WOyl}-~>RP3};Xdz|9 zZA@l{lt+&Ke3#WI03<@k#7|;s-NFlkX>Db1GTHX+du|T;4?iCtZtQoHBLYQ7AVsVf zU_={uT@XYgKv0k@O9X(5#5!?JMBF?Jh>=bV2N((KW95(mp$SCB3(vJR0SucmZdn1BAQw9x_kg!DYmzW!(|CunQPtTxI#mkNPN5kA!R#e>mr+$ZzzUlvwXhbt zT?gwjCZZS<#g2)_HdaZe^V$tnjEaIqMIs?gI^U3BR1_pCI*ugL8%Zpx8|P&OjSC|} zI4N8@46$(T)P&2Z2;#dkgb#!dgpUrBYC{xr!KDo{0THAl1W^GJYomrNA%;dS!W!np zXle5h>(zCkDfTLIX6?B+L=i-hH{+ispQft?f=Cx2!jck15{VcRxHenEEzsT=Vxgb9 zSY7d$5VDa%IgB1Jv}R}ELC|w_5q|FJAkqptr4>9rsQKKQuJtjiJ@eZ9%ix3cN^AAZ z7sU?I;OSrAUFv;8?9NTY_&yV$0^`^PCbI9_NGW`uCQMn7w3p}M{eE9e&;fR^slBg= z=m7h`t8yvU{g&VpIm*eg(+2x~YF|MBh~RtM%%`3b*>hLb4$BJTdb5!(ZKALDHquX( zT%GdAT4!bAf6}IUD~T1(<%F&ElMj#876CjCs_h#=yV4e=LA2iOT~zEu$I^R6xOv)f zmsYB**l~}h`+-*5O#2TNz9MP=q4HNRw7+p7>~JaU#?3<*X9#rjM@M-+)C zVTC7k+i40p66j4Ed(#?aMQ?gmB#9G?8q9l4nDaDR2{*k)MC@nd#PCuKFDe<_FyRLC z@TmPD{a4p$u$^ajeQW{Q!xl!%#h0(x#3*_XdQA)!#c&=F*hILaCc?~nlAAlV2LMAs zBoi_F2-~p6l!8DB7*TN5Z#k63WlZP@vBD#?-n*fEPZcWOOxJH#+izw;`g%7=X=Q*)Xri@hpGMSF^sE`%pDK^0@D@Yj1ff+`bGN5Qg%yI>7i;9X-&4DxC79eLf(>We4(j>?Z zVj;|ViihRCTGacGQ$)O<&Sninyf1$G4D-daDv+u^7fJRa>t{htwCEy`GISYj{A-?P z)=%UZZA6bYY--P_7`~;1g3&mXuWiNa{cL)F{b8}3eskv=W(U2@`*gNy>1GNsHh6Ig z8BNIQ;bvuTpIx^0R)Okw-lGd`Fs+2)Lzi*`6*^{2rilPhRutGsjERvoEvgK)$+tEj zBNy`O7h0cTcvS_kp4ZoU9^0wO(NpSqOvWhaH86D(z|;$^1|nk@^fUpRWjRTl)56f1 z)Q)uslVjc7-nI$FmVdh zbyou_JFxMJMb@6F+HLuU7XB(MocUPz?ujhgm4#Dp3pYeEEu&kwAs~~&#u#VZb^B&a zm&T-oif!SQi>zxajRyW*7`Qmez>~-ZUcK?oy^kQhWkeM?%3^YAoRqaO!-#=R&4*kO z#Z^=mx%b){oj=kf*=n95V(zsY*I4sevliWpB77KK_C6Q!)~0+#zn<25)l8YKm_m-y zR-37Gs%^D^>d4ycy}BmqY|VvksdLN|5sL8b`Z_-wbv{mt;@(_rnvg_-8Ztu^1rt%F zog`XHk`l~_Iu4}0=Crtusn$Uj*+jD~-mopr##5uOixjoY?q}0+TEu6rt<`cdn;qzD zg`1Y4j{0z7cw(J}>y(!m+_UWF94Ysv(+i@65Ulv(45*mtJ&|T3$>Pe$hOr4X_L>#f zQ5j4j7TE+}gbijC_`7^0-S!k;{uqDACJzWH9YBh-wyLRe{vi>GLP+TdQvA5*AIk>rBu=z7k@E{f84wR}fBK6P!>zXf26CtY;khGm|LY;UHrr9<2cQ;$#7uxa&>P_a56~8 z%f)InxJ$<$rt@qyyhv9AcZkHjZgBH;FrGaW_gPK9WduD_Y|m7y;Mn1y&m9ix9G*8r zngQWL2!~VUJ z(GQ{@e9eCFcs*4l{;gg$2hH7NOu^!|dR2NYh^wO2t1vsn>Yd7p6eJ2|LfoX`19h2`^9869IUeCr|H<0HiR|FuHj5uLPAt%$fIaE3!E zgzzuXm*m3uoM+~ypeW%&TLDasWYH^w6_T|Sk(*@HuCoSQW&3mY*d?R4(<$m3(j9M- zArAD=iP{E7!1)-tB#EK4upcd?7?~ouRcj-c{V{S)jMlEqFNr}zM?-&Z=)2u;y6R{r zybmyK4l{SqbAejRrnEG4*K@(0ETW<#L$6)uf&Dx*^w((UBBY^rhUnf$OCI+WnEfxr z?X9AWfI<-CYE(3)b^D#10FU0hvTm6N%-n;BgJ#}WGZ)mSf90;7cZTQQ2PzzqO{|G* zQ8%HiAg+KHa1NkGZeV1h9c@&KwtcOdTY1eYD^l~s;=Wd1#Of$kzRJ^Oe$39f_r2p8 z`g0+nOdVZe3|F`tw7@B@aFtiDyJ{U$ky>000HA#0jUJ4%Z{G5H8X3H95ha_0s1F_Q^8~12d%-hhCvk`YC zL?;%Kw&jzX?AvwokOz(?HpU(0XANG-DKQ{nNO!2H6|XE-Nj)g5CB5j{>BZ`l8FiKa zhJh9aTKx~SbQ1^6tLLCYM`0HDPfQ?EJN{v8$7|&jJV!w^wSL!TenLrJc;5JBrJ6+^ zINs&)I55WQt%b7|7G76WQXQR62No)mvZkiuW>RZGj;Ls0^dwg?g@@CTiB_kGNJTrF z!|8izYFAA?4ZSCr7of$ zJVQz@cvEt@vFV8_=DA5uW44WSl32o=B#?rS+^k3;=z4Bl>@2Kyoj9EG`{MA_hY&rO zO<5OzK#1wH?ihxOy0O2JLW{YxJSk6psB;KD2zGFd9(YtLA;ukNlYi0L3RYb2=gm|G zPI&2yVtT)|6pLSm!3YGAqT~{ugZKO1+#e;Ew=-#hV3DNtVW7efYWL=`j zMIdg*1-*ngEr$AJ)y?nJKhxwC=qf?H8(~cvFM9#ZMa3tnK|1XD*{c5}~bI1K|GkYbu`X z=p7~weNG&z+XPB)sxs$8&SN?sMhpy#zeiFKfFUqKV|E7gSW%OXfSi)8hJc3091Uqm z0{v@c9!7V)$)0Xp+|b5@QCVPC2!le(NEY=LNLm;D8Y-~ovYKcyGcmQ6+UInRidqxm zNftm;oe~Km<7=wxWMM-+aEDRdl{$-X@3+My!;mj}$XB6<829xq?mONeT5|ualO%Fz z-2{z_o>mGiq>Nnc*bKRf9R2w&t5FO{+Omt<4FtylHqr6tpZgPa6=n$lcc7vUn z0qp)9xchSrR`^poZ7@lPf?92f3Kl@LbYc|1NZ4e{UTAleIVxayudNAUC?dAZ3{*t? zkVHZVVK0!3HHdt?nTyr~8Kz(;z!3^#>a!}SicS!78qJ6hHvAUKT}IXE04r=Z9YbtS z$1q(+MHHi=*in(2-Iq@1c!s6}Dr@4JS_nx5#zh?sS&}jUlyEZ?t_wh19O1%AQF0`l z8w95(N=Akdzm*|=AbuczbeLDW!*HyK`3xY0bOj+QKpj>q=V*ECLab&^43pqMgzExC zn1smHSkJ{Fj3A7>8UHl-G+p6jzD`htCMAjpi6GL=bUqn`A5PtuMtS7(_SAWE;4pd= z$u!bQ(RI}5Ad(Bt<}9uhFLM}IngCUp#A+Uo?EOk9tn_}`b*}~|^gR6E?~4h#zz+7d z_Z1OcU?2EZF3Y;#5`5Ywx=MCG(s4gkaWoYO=X;yYhaPAncU99pz{O^p?R3eA(tF$K zr%JBQ`eUuLGWS1eYrU1k3g>dd2K%WZ>+1l=D*^SEwPytF%3F#C(R#OkQL!BzOYaq7 z=4snqy59H|+wReHKhSEMY5$?xS0wE}Q~~RS_BXDD9j=C*djINB?Px%EN=SF|_R7JC zpm})b9pJV39F;-d>0w?Q(fgrZWt$1mRU7tg1Xcxn4MV;*;_AY_V@0#W0cLgZ7aycp z5Rj5Y)7=g4SP12I@7Ejp7M|QBft?NgXy6oLm55A;Oo&XqMy5p6PyrB}ItC{m2%MPN z+eeRwPE2g50@7*mK2;zhJ_T4P0u%xi0#uIyN)uq!ECa-+koa_b_f3f)_+%pvzQ6Yy z2cAkO~QHOh+K^sGn{Cl)od_pmVMX|xhQzI??dM$sG5Yoe(zZibe@Ui86xK>j+NXH~Gl z19U;tZoFFTktRwohZ4px*8`G6QZ)D#ZJVIEoZ~v1Pl}bCy1oMqOg(xITXh-V?|za; z32pn~&nMUEa=G|i-`a{X&s$&5via>HSZwX*pF|u1-o_Hz^(f@qIqXgrSo3bWdAHhr zHw)e2u+Fx<2XH<5WE-8u3<)*ihDs+!3d2Xj8WV+LI+p#lj%?u7i>$9wd5r8r3-7Ci z+w{r9!gp(2v?~ku9!h3S4VaeEE!+?xlfuR%XWX5iq)eB_q=brX;gyT5J*bBU{yiAD zILW}1$Oc|lzV;p!B@-Jf4~6|(#SG9(F*XWT+V%W|qGat@D(Va}{K;bc5oZO(Pw}gD z@iip)uWS%}gUCY#m>mIH$s)DpRL7kk0W2x22U2iHPS8Tob?^~8y{KI$W*Fah4MFxQ z!>9{Dbch;4LG54=w}hZe@{y|^u%zT3sdI=v2*Jpsi_L{SCB(qve1^o(ml+bHy@$jA zC!3?s5#8Tf3U}KhFaqlbg_8;D9Ngdc=Km;>hT9(|HI)EbM|XdfN{H_74D&9Ngvh%@ z{0&<}gfd0R)o3G&f-l$7u^JOfp@W=D9N)CXdhd6XZb7f=y>;eI&&IqNH)}$M;f|4E zWI6SzgB{z3=DnT_iRO*wz01fDFH=o1-XvYej&mGV5!1K}8Qhu8Xd@2*r|n`PrBeSe zkLYtA@pJZVnl0U-;gOP79~pk%()j5vzK2OZGlN<-eVDxFAoL`LPg( zd*3@=jPqPbs3-@czz9*GIM{u==FNN)1n#_<2MGd?pVTtmv|N@D!?hYRMIffnwQ{sx z%Na3a{gx>LLmBm?R)EztIjZGYzmz?-nh_C?ZAp@B^|Vn8k8Q=y1^#WiTEAs-@jq#9 zZSrQ8UHp+Rmg#MFaq+|S?%sZNHZsg6gHO|RkmcjaUoe4)oj}+Ci3`Dp)}2s=r@T%* gNw1-a^ddc!fQo}7C@59B1%k97NDUAa z0R;g8F+hNT5D-ESE!2A+XP7U~%=@o*{r~;SUF*MR&8#rzIc4vCc0Xl)*Hpi~YD!L)+z+ zhqr~BHR9KsE|%6uuQ^%RSZi5Z+{E1eWUYYMd{gJz#b0%Ny2g5%-MBj|Sf||6Z?QM+ zIzNO$s8T21>3-_E`NZ+Q^ru#z=&{dZPuu&fZyhgh6ctC?WQNT@~YEjdZNDASiZYv zgj#;8Hk*sCprxYSz7>J!yMf-dD|+)r4+KI}Hw}SVa2q5Svig6dyY7=p8G51>FS`r0 z@SmqyJ$L($rije%XD;@NJ^E&YRcUbDCz%o)8o}r`1Q7H^nn}P$&1<#{tC;e+Fjy>m zy0(Ptz$QRI1gf*JKvR}!yyX+M9lJR<&F}~Y&Ocw!&T79v=wWNT<$gB5+!Rm3uO`%3 z?z>gcIqH>6pC1_+2|?YLso}y!2{wsEZG6OR*0 zU2`sOLNjRmf}!%D%%`N!?j`;Te3RUgfxN*Dn?OgrgA=^tJuWMy?&qg5S?xw!KhbTA z$$oS>_bPuW?i`k(2I@?@GQH^rpK#iJ@9kh-e*Z=|?8E!5vO_|TVu)Oi$d8+Uoxu`` zJD(~QIS=w5V{LG+T8WvU%9^0A3O}l_0^Ju=X)dtYQ6XFdk|tZ~9b|Y(wo>oSB{Nhb z{1ZkzxPPm*IH#ysF_KsQOGtxFuOjH&J;H60!2|yIvjk}f*LFyxTa={z!f0t}5mD`R zE@n@cmjA7RcujauMI>m}!7%z;7lGQiw*Hrv9=Y;@-X|v)ma`-=6=fVM)xym!!?q6{1OGi|xUf2C8RBIlxf|$aK&V ze8c^E(0!x$oQm!FR99o`M3zv+5*YrKnazN&K!+WirVX5#Kt8Iz(cEEF;kyv_#!R&| z)XT};EJttGy?5qkN9W2c$IZ_?%YIKKd59@VT$V_a(iR4D^b#&}im+}>2E?MWhRZ!} zg;5lcq%IUzH}J(#`q1cO=MkgiwxN4btp;hJ>8a%lJN}~wqC^8(d%I)*spg(f#MODS zWRm*UdL_+V<6KHZtVHp66K}u9!zK2g$ekvQ$}vl_E5BvfoMk-6%feE8yZ!x7H;<`e z!`({CNwoV^w^FACT9lRO-17z zq5v6l>aLSa0QT{zzK=Q2D5hXfYpw;2&MjqHVb~^IZXdML@dwR3VE7N1Y>TB_Kbw-6 z7>p(2&!=3?ouiTP#pA7S0PpmD!S}#cXHgSb`ztblP%5suh8fJAs;jFbd+mq;GR8AA zM}TP#{$sTrV(G;RG!|+~tU07pCQYkhSh?yWYkiT84_i**l>*lk!Y&`*y7bw3dkj%U zc#jScpT4Tx0od#%SzH6J;*z6D$%=j)f|0*}SJ*GJr6F8f#p)2yaOYBKJ}|zR_yYoJ z;pLY=M;T_2Xgg;g><+1(YLuZklIJ{C?9wj)uvp#1Bw$*~^aIy$&DT@-ihyNl4}xh8 zCU|KT>$AEvH#C#a)fm-!;XdeDAz?xMH#{?Lpq6BKswrw zMzK&kZKd{~qHJdHs0kV$i6n+0i*y0SQoG=bt4A)2lHq=&8|yZIWo=&&rv%zjJS8n^ z3nZ^1syJrD;nlM1h-rOD_4CZJXYb7S$|W@oxt*^4aT5Tb6Q@oE7;ltrk=k<->9xMb zu`{dD&BnkUG*I))6J_Fo*4qgN)(M9{kK(EdW3***aR4-NX@%fHd) zw$z_Cm+I<@^UpW~+8rvdgj1aMfor+OLkqn;f=kge&Fu{Aah6F;PIeYox+W~91EeTb z4o*BleTaB_?#%2w%oak9Sr!3Yt|@i_Mv7O)y+7uBMYPf)$>YE2WfhhxXdVWb+3#bP zG4m`gEAqGh@2RE=uUP=5Zdt8{@M}QizsltA$j1*y7`_C(tot>V z&m|8qP0p&88-ANIPQv4SKjCG;QTsbqVEPjMOEr!@Yp zXxQhlT=N||reu4(#@5D7h#)`WV-ayF9VP`IblNhkRE)76MOve$tOwsJczy1WRFZmi z8%_hCofh@|xDWr(7awd}p~RKS9=V7%w|EV;y=TDsObjfkzzmuivi1g2(aZ&KxMWK6 zq4XCVp_hDS20snWkc87Zg?x!;t1p?CA3?eMl(&ue>+m)=HSvA76RW;d<^S}`Z8S%3 zAs~~f|LZMGWOHm0cL6eg=yjfNMWrW0fRC2Hyf~Dh_`#~(z7U8ezC48PV2W3q_4AWX z$hkX&86+D{>|Ec}Pd7=ii5+;A(Vt++2mGJj3NW@h$r7gi^Mq@Cs7eWc>RQP|o@%%m zoN(I6mCEq={$o01S*o(f*Fz?W>+cV|l&#*~`$QpKA>k!+ls=%wC( zzg@@Yp25_uHL}(jSs{jBoo&<5FO%06ll`(XJJQxj6%tOX;q8?vEx^d0PagIgIp1qv zs3$P(7PKND9~P)CYmi)b^Ne9qtbFiiGft~hCcs~FthjZ6nSoP9YtNlZcWH1~o5U1S z#b@zmL~#kRPG)Rbv;raelz!7OkUXjotZ0|x?H_AGSVSMcVSVEsr3no<3u z*suueXL`r;dyFjCed1;i9~_10jzh>=JEZ3~a&w9j`^%QA79yuYq6j?`ML{#Sk#1b2 zN5n4-CWT`X8xa_+Dym7&1ncYT+h)P|Ft4q0;Lv8Ep^4vMjsd_KtX2G9YZbZq6L2hI zACtVbvfA~YPkZ{91g%)8;o2m5*j#qS5_fR+yFq?XpC*0|X0!}KkhMl$Ccg~(HAjGIUuB8$H!BG7irfMfYaMjg# zyzQOvkh73W5>c%YwrKCr5hu*}a7y5}93GJqAr0Z-;l<-}>cWp8lPcod2=flkb6AaWwngjJ zt~JZ*H1ByggAZ+9QN0g<@U7Hj*5l%58;&HYU%8Ze7kCfnO|jz1d)-9%ubasqY0NuYnazXaJ!bY6Y}I!rK)#9GUYq z1?^^R6ud<#mf6r)aEq1QUVmiV%lK02_p%;mpS2anklXRvb2`8rXFQJ6(gIwwQGzye zT7BLzlTz=Xv^pDUF3S@HLcRFLTL$8>RBCyPDlnRWJo70qV}En5aqAtoa}n%;6?~Up zwhX!DaBXe}X2AXnv-i_?zJ@EI=4*NP*r5T2FYwuoJtelWU766sVzFqnQF_!UWNViv zVeFd`!)3*GXGnUWvEhjeN#cq_?DCg19=2xJbGv~TN=-AG4rtW?YX&UE{0e0!%$9eU zA!`%YdU*=ND=0S2$-wb`QRQl0NXX{)$px8MqZ)5DZEN6w6Gxbp(bNOe-(>x2esBzQDl7GZ zsG!T zqx&S2ET(7Vs*LcYT`s-l!V*cisQ8~$y3TA9`}Qq%9Q_%aerQm}-R@HcA&slQe|hOj zLsYAYCxBFG2XjE;FNmzYRkHmF`+MHIgM~(79)zCukNwjMo4aGdY9}jT@=I5arAa~V zT89RV*-{L`-W(CXJJ{^CnxKw5;9Jp4I4WDETu=GM#>R%4CL^4dTn|hjc1eplcH%>a zz2Ortd&*wTX8OrpX2$b@LNj35eRnhj11BAW>j{}agqE)}d!|9G9)|__O&)hS)qw~o z=Y1ju;V<4cBBc8HZ`CwLx~iorgnZIaSAXx1GP_^Dwf;_> zcu2iWtPT*p`A8Tius%e73q^`MSBhPBAS0&^ZD#siPhDjjTlVf5YHf>Z)%nS!KbV=+l@$cqLN$%+JB(SVVCl>K8Co`O zsrzTxZ#w?S-1!fT&1I0aUP$VBj1_qelA&oI9w^G*6b(XVC}4>`sS5;s^(C{-sA97W zyJxv1?6@OpSiRDPQn@Gc)5TPtj40<~Lg`nXLx8K4U|c2h;186s1gCZSaC5bzG?}A( zONXB^_SDOl0Mop{N*yL88#L~gS{|1UvIP@a?eQ7&Q4ZX!@#U6Set_#?=EyNW}8S=CMgBvy|xFBwlclsv5cHI=7NvB%ll{q<{zBxW#p#O0!j z>vyqG0au*Yg>gBnSnWAB@WK0rJ|JO-1T*2Q-aSOlKOC`jHw9y_J26m>uOSZLWTr~r zQAle`^_nQj%I-VGdg?XltROJ%0YWekGjAj9srO&LeEDT^K^IEVW*meK(g(@SS7Cf1 zkWRkvLqPu_GI(GuQh$cVT_&8TppTg_pZ}cHJLnJ@=*AsF8E`k zuz_rlp=yEV&gehm0@gn6Kh(u+y^)G=CM3)3%n@~v@(en5rp5LZASU8`8caX33e*}% zq+>BTZ6m=Tm^$~*79lVArOTq&LzHzlmDE_i(FDOnhdYe4&$*&xjB@mTcmd_+8rtbt zRO*rYk97;G4@DM*zP^DzvU}Uk%~KXbDqyPROU%0c+?Lgu%OJm1f!5GPc;y+09t4~- zpUA8-T({?*_~@Qmj>c#0tYQOs*`ZbwKpS%+j1i(atQBeuWfVZ}Zb|!H~-+Q^&mQan9Oa^*Ft4WT^E_+FK}+hI8q8YrugC4vn|8 zEku5V@MAv?FZV1?5GD_9op|RskJffG1#X}@J8T7Yzjd4ZBz@jXv7~z3Pu+ZlnXCv@ zYv3v=aO7!jZgeCeN+PzQk@~v+A0{O;+pssI-Cl$RjAL4_tYVi5qA<8F2oiCKk?9&Q zdWaaaJ@d>_Jn5$v6=G&?1R~c!l%s!kwqiHqB4FRYnPY@&O^i6T^QX3k8*0|$-o4bk z)#>oS-N@SZkHsYH%5>cniMTe`Q#pgA1g@{zJiCE8+R*#Pww&USUWA zJ004-#ICgBN}~xY4O3QzWG256mnR6P7YGgX1^AX3OyLv;<|1U0ss_=VLa5|J%% znM`@FZx&EU4_F5ci0<20P!3ZO_(vL6s1%pwN}kscBS|nzBI2BZY*2t{T$yOdTW?us z&eE5Qp3iA&r7yiF=935yCYO9CxK9zAxfKQ-2HJimWrY6e0-ZZmx>@38>GHf>P!hp) z9po5x3#WMxXap{`MGv^A%6WI88%&Exbuk2|SQ33apQohBVzjV3N8Wo~TxmjSZ904^ zL}{hJ2gyLX8xU4H$b-wK#N?Ik^*MZ?Qvi0s@Lq_I6Tg=JM6>0a?UA4S7}GMBdIB&k zh$=o<&@6H~O{&M_fQXGY+o|CxIvzWhb($6kJU=}vG1ioZ=OcvrK;wzoq)GXZZ1*^V zXviD7y9g_eZZ(Wp6rXYUv=Cq#u_9nU^%{MI-9?HUB#0Tk`4C@XVbf$zsK~iVC%oQ1 zIjG)EZR$*rURYhGtgrReiG<|3clZ|US}dv)SHdzTU3?W2ex1;`aZh8q%g2XtMaC_| zzj~yI{|C@C^P$XYMAK7WYw!X!s)qxM1^E=e9)i+EHp^Iff6Bq{;tfd^B)2P*{DCXe zwFBN2l;!MqIA14)@_yHnoa+oth^g1%5-6n8q-Pc|*DfL%kYM__v~htF7-&u4$*BA^ zbX&$#r5P_2u3`EIR6tReV^@9M4P)JaU3dUGn!9N%{E7VS*cz@$ zDwa=q4fMCo!D`zA&|M(Os z)E~IM5Lh9NB6K=(Y`d4!IgM4Zdwv1x1czi?V3HI_sdVDGyxfzo0xA_S}*5D zA4zHRN3ny9dYI*?K^6+O|ZGaLH6d3g?@eFQagbxdzIJ9pnV>glxKuCi!%cDINnNTo-s_mB*|=bEgHV<-IiF{@_lOZtms%36`WXUQbVE4FNA z9r&og$Yo6oHc;Kj0=OF6T~V76Rs9cYwg!m+@!lw`$3Yf1Dre5?Wy_Zwo{V4~K@ji& zYc!i)T?sY;b-|W0TPSltU-kTOv<%qi^E}NuueWw13~b+l6oAjt?1vyAqe{F zSIn~J>S`GlYMGf+4EpeaElQt-mxn6QlRb+DrN=RRk)KW^CMETFE#`9_w*WGJ&JpG- zz55->7CK^$86O-xF}oa4vuWZITflHrKiNYr>C3p6GT3aG^Ih#RDKZd!?r(Hrms&@dMxrG$BFq^A{+rqTQST@Lg*>X^B2iyTbr^4LzzN1bwJv2xP z_SDnn%2+n>J4tc{>*LXigUX4&h2{<(5CC2J1mSo-M6x{`AyRGsR zSU(Qe#8JWKex^9E!KYzpq=Jpg^98zSzvX!+u+|SZcZY%y>@k$9GU7PCUQ)9XuarbP z4-#kHtbgxFsF^J)*UM@LyvYv2?K?q!V59s3k-`qK%ftZK=ZprPbjZy8{Y<0?5lxd4 zOV_6s@+^Js*9cl}1v z&WRpQ6(-2`UQn?!Ql&WN4)+Z^N^2kO>-|cb1N*SmU|+ka2jmZLBS%HH0zz=YybBe} zut-Z^XsPV8%rOO>I!F7^bIYq!OLH_QLes+*HIUK*$%;h-=A}ZMjP1Dt1S*+L&UlhM6U| z(%m2sY=6VkhXRf)(AB^H$EKNkMR#>%+(^U$#3Y{Ne4lPJvnNJ72b( z0vV|0c^;w2Pa+p9O~mopAOWBK?at~`rDCw_&|5^KMYTfN)*w?@NCOfd$l??H950KU z0Ip5p6K{WIN33f?M2LI1MR^yKhO^UY`9&8#%+8wZInXaF*70RJE^D?(gtjjgG- zDmX`y>WwG)eHngAh#anyRZ=2Omw@a&_M7->$K|y>HWtL+ns}1_Cb~i_b?=Df8-vE;;E$x4 zUst1AU-_W)*Q!f2WygqrYM6ita?LO{7kDyN(y-NA7&~KvI(3=IRj4tWC#w@rNDJ3e z32hh#_Uw=p*Y5XO`grMBjnL*wb`Uz}MZ#p<|d5NJ1Hi_(5Vb!W(o1=#krmFhBS5~kl71jWn7n{*XM5^d|3&>pwip*%5T`?* zLe!Y4o*LgpeFXMu1UxI!oR1%7KVS2tk(4?Kh7Z$gm*qdLHNc9Q3=n+GMRBh|g?jO2UrgTw+bA}+p8B1W1x8ud;T_2vz`EYONGGZFjLz4%G=wU{^j6DO1#-I0YHnO-{7QlSQ!lNsegW$ ze+`#1XBgJv0=Y-Mj}=TF<@{&VKu8&dt;Fq`1=9!kA#KLHs{kT7^c;;+)d)cqfC;*arrD4pmhRytFQ}8S=@zI=bg)VNA!y)ZptT&;@Qj+VSwcWk3g{WKTUqX>f zRhtp#tA7VV|5rJ~X~m-(l2RnDPB>gGsHFo=B+_v5?Vjy9k5jTd38S8N#bXT(4KLb8 z9yCy{Et%lVxNj&qodH?e4Cn8vOamQt7YMfSTy$V`FHBN~-$|68sHq1I{9M~`sF^`T zE*|a4r9->fvvAeI_hG~GYUQ1YUmwo54a?T7TyMQMy9;q}6)csj7qe8@{${ayai_n< z0pTrXZ;Tlu1K{Z1fc@M<8!vGUd0U*M;{9e}Et}%j;ZlyMW~GI@fKiXWVUB~&D+lkr z+}`iVNbITa)Oi>qAt4bc$7!|OA-53id6i`B*RvpxLWzTun=Q1t-QL#+rb`xA81AdH z*}j4PB|yAoVT&$Rmx}%V{rh{Jj*s9xWTbnj&&uyLP1K~(@Zt9O9N(s%o*so@^&6On zFE9!DqQml^@O{;L5QvqdFr*%E4ZM{z5lbPImhPL)e*)y4hnH7TcJ=*P8KV!>Kz$mv z-5rQ^4b}K6k;_uruXUWF<4%+YJlOYynUhitx6K`J@RI#aNXr1-)-~t}PQQ8n(4pn; zjh*~#D&hY^AE@Xc%(dFUUTl7fSS~q(zgxM=8}>;^8w@0?JAr`IP4zr1FC=*h#LXnOQtiY~`{&&9 za{^Av`6O5`3l0L;0&N(C6QTKU-ytWxc-6C_bE_W>%+MSvJeI=J4ZA566467yk^Vk< zD*};y3`Vn5u7MIce^XTKvG#*8)pBhkZ?T!(?+Qz9o2-E|0~|@}IIc&RA0@8;@+%|T zNKyY3FxToC&gIPfnR@5K_MB14+;7t}jDmuK+RKFO*t;_tDX4ahK=jJpyQb*aq*2MM zvESXB<>ll=#KpyjK#*dswEpR4zW6B(A>a08$=lIDqtZH<_t8_ITZY-ij$o(vrmeYp zdg|^DQQrJrXkgl>{j5}PwP$Hd6ID33vbo*;`ymQL*vX!pu8! z$?#$Qy&%ly?#$}gC5(mawJzahu$4F07Ffp>GU@XuT}9zOb>yxiadrie z0%MZ=4Q~s~vXWn6#QKv|=%`SSVl?ym1)T_%%w)5fqnlOwKbwqEbMab%t)(n?MA~A@hTTo@qfAkFR+$%4&r3+~->bo*JdXe0OJBp@RbDqiZmm zT$S%>!T9v)+UtAe2u?%b5Tz0GNQl|tT3w>S?FDoY(&pKqs zIq$KOLGuMDTg|*p{{2%VG3yz-DKIcq2@?r0Z{Tart_JM~3GZhPet$|lXiVwu{;FYC z%f-s-KaQF}W8=j;)y%y8{S}D0+80wEgNV%~ud&z<0EB(S5kk_S5J$_ZTAMUduH}pBwVKrTFmIk&L`}`j=?n z$&8IvUS;+!s@yMZf6dL$>2RU@tpld3eMwCIoV!o*j{5bclOE_X^IqfZfz1qup7d$* zGr&t74FM6bRgV?*^5xT|h3lGW$jh*Ay9cD=$Ttbmia>pR{j5rlLsnxpzE0i`12@xW zcOC5gBEyEKu)60BnIAMS@*#@NTP#H-*j&h4#A|%=#);FWrx_mSwMZ zady@VkR_+CJfkU?R`t}30t2YE=v31Qci4dCwU#!+H>Oo>{oLHn zP)bcqu#2?=(+a0jKtxm7U6Q(T-(h|FuKF8{!@XEl{@A3CK)te8r0iq%4yHH+g0Y@l z91dP$8eQY_3gQ|qXF^Vnt0#L!6U)m@77jx4e_niHirKe9^oj&WcsW#Ne2X1U_V)0Q zVsDTD`~bX3SN^g4J%CBA!jvPyB7YoQGli{3(S_|mb!B|(yxy!REBlPK5r@NF%4$DT z?k)99b;x3Ue0;nN*R4;Jsy!zy2E3@S3GyXomv^k*;rq;BxYAl&9hHT?s)A&=o)ZP; zBiXM@t#Aoh+xh{x3ug#soXj}pIfRy!o8^Ss^E%DMAB z-!rBTVy_5B1#n3J@>vi;3wa$C3N=(*yFGEJF#HLon7n#>(9GJfNqOe2v$L}_=9+Ko zrLf!fzM#*Z5+T^kQ@t0qS9})`5A-x&`!P5;c*Q(fug&Y16ji|*ABE(Q!Q$fLgvzl@ zqnBI*9Z>4$OX{*Kv$KWZ7Y>dn;tkyWIh?W-@c8j#?3N(_!ow!_C&y;$A{27K_VUQ} z$t+LPoI6P%yNTfTofKoXW__B$dyU$k7r%X6yqXMT?ut1$4m$LXF)*!}X6rAPw6^_| z*_#85e1iR+EKgo5QBzY0i%JRyGx=RJ?4MvVt2DeAtNi!q)Q>AjIs7_Czdk=Pn0**hwQ`%6NNPr*P+0Ao$;W1ZzaFq!*eX3l zs;PcFsI3psM`%o>!MJ5*)c!dJ*D?Kgh*j{?pj{UIwh>?v5U?Ps3Kkk+9PM`S!jFUO zcQ7uuRZm|UzC!$>bbRYz+joIuDc~GquOaAy4hR=zrcJ8dh3&%PE{E8kFlLZB1KulH z-JI<2e9q+RmHH?=LaJA2gHB_ECWlQgCFJ+Apu);@acRlOjG0~<#z0l`w+ib_j{|Y*(}X#@=6-Em12Ip)Jg%o; z%Lh&UUjz&^^uNW*5udF%!38`6M92jgCCLe2`MkrnKwJX_#<22V#SmbUf6H0s3r3KP zR6XC0ybOuqMhOxN-s{`mpF(v<)|!LJ5W&L&^K7AZ|CSn{&ELce>h@o>K2`JSa|Z;1 zliz?TT(`rxA}@_=;Ojw9e@^E=L(srL|CX+x&A%6YuYt-9Wy1oKva#A%|M~+M^}mmz z5DtG^n!keXn-15;sMRwjPkXZQc}1E~4Wq16AzKn4$xKUEtT;%9Lb4t6!-U2|ZV zgdyV~Gr`};yfcf)JCe2!)Ve-^u@Kbtzld?6q5no^Q1dsvJ9gPnY2Sq(+|cD@ez6Z+ zYCtLeRlJS{Yp$ovLfTyr((YICVcH$E`=4c+wx3Lciib1JaM65;17vCarC`keKMgLJ z|L??a0^(@%FF+krw*x92!NdK36as`_aug@HAtUs!IOR(g+q!5P$Vr)c z0@EdV#(!v-tFT&#_WykvhE+WH%UQ@-?1gPIAa=<=EXEbq^*F7e+PU=u%cmwF`1N3B zbCGoEVM$gy`MaO0L%1=1bz6J$q>h8m>U3bHr&i9LVrX@WVTu1L;t;uipxqcY6JQo6oxVYPJtV}i~(7|ZU(8!J&WXqM@zvpnMzc6&?=OksWmhKIp^ zE78z)!aZD{{C$eBIKN(2L1VMw7#1a_S2q~Gtrs!_MJJiPwIH094$7Ebcra*PH)m2H zxW!>$W|UEJNj2F^$wi6&^_eM@lI_?EQwLu~y-xExPJJx^@hMUL&7!-8$%ny#(eU+y z%|EAs1l3DGN2V+t{P9;gE$Vg9h4}qsak~m$)>v+V(!NBrPb&Yu{K~Xmz8B1b@Nx@0 z4Fj(I!uHkCsqxL&SxngNL6BQUmz9mJ~-9H!K!`gZ;lFW764yxe#BegJQys z(r0+jdkv!ur85wOn=m2sc_%-i=L{X~LwGg8tmahyJNebbpLxb0(*l_JaXk7n&*-;? z1gSgiHozU`xP`YcuzU=+KiB51oSeR50(N!o z_yr1L|Iq|lo8K|s^nJ57kQ(!pF&OLN-*)8qYvs(xQ0&1qwzyNE|MK4`msaCUy~pdH zb;k}kPVt56CZcJ*1?k9u%PRC&EE8EjsxpZ`!Ws8 zxKW5d?zGjb34`dS@7gmMeTWlg>;`_q(8Ys3VfZHp&4V@6+5VK%qN{#}F_bYbFq+1^ zd=|`Cz?$AT=z?QkH_RV%H;f7F0tqif@~pQWOwO|Fc5X~R5@>daIU=p{J$PyQ*3y)d z?@CU;llD(yaNr#wDcUI6R}5p;lTiNlnB`VB@L`Ha6((F~?VsskwPUDvdcem%**F+} z4qwmYtaLYlv8GJm-L3%iibtyX+Xg7shHKT2|3#C!+iUA}8byFDf`)HuK~lF-6rR2~ zmD`Z7kaqyoD9|Qx%t8~?sC}@8G28z#DX6ey-#YO7Wc{om_mH{Fz|jQ*fGs zs`HgFtqyAb8;u;8>~EeN1Q9&p^M4`w|22&i%BriY)o&bhke!&A7$S{(5$N>E-im^j z@C?eNL^sWP63R9D|G#G9s>rU+&XFiMmf(0V5%xxl~qJ_Z9|w>o2rJplmGlUwM_FO zB=x(V^Q$Z<+W`J9*GH@MbEDtu5 zXw~1o=?%}$zAYdS;;#`*De4ZaueoER)xBQU9?>}`Zw4swD)=7-YuC+E()lIN0jfk@b(w9oDj6jkY4AV+cB^&64&o_kqq{$=ySKh_1>mWpFa7kZRy*03n$>Cxab^OPiC39L~HZQ z(on+JO#zgXz+SH30zXBl3AaGBzX-WfLwkYQ3AYanT<;C^_d3VJ7E;~6$Q!;Wv!R$Z zgaj=(FHQGZwFFOwJd7(N(N_09)&Fh-PMI=j21hnwxXnWzl(OD?HY&>JEZ>@ZFc=SdctFAq9)8}*Ge zs^IFyPP@1yY^5)8e+x$YRC4ll(v@J!Tj?Zw^g3$pykZ5Kyo!s*3W9MGt}|PkMd)4@E^X;s3`JKy1L3_PL|t=U;^?NGaUxXoDPtb%Zq=kj;?|3A7KY$f`ks; z0S22L)oQz}kDbr2@|EK5@v9hZ&cSDCEUV*wCkaL4BI~lQmOuQGAeex|Crn7Zn6;+} zMt*AbbBRv`+eGJ4Xfl*?+9-?H4|(f9d|}Yw*}6zT1t6B9qD;M!`*g30N0nfrZM!eB zsv&>n^-JNe&he;Zbv}IhGkqn3k(rvbhLS!JEplPTxtP3EVOfU3lM;Au;~UbGfU?Q! z{2Rgz;6bVt%!lsVI?osI4?lgsol|n_>}~&+!D%1UOM`F3kIi@lXqRBUy-7gG7n&|9 z@R968zW{0cm~f4{K{oIkarNa)#O3bLu*)xj!lSF+%SK#vo=chQgQPmc}8LRUsnD9h^Hy6q{9oR#vqfxQyta!nvGS>zs9(;&Z6EX92 zIw=^fe=NeqIM!%R9&&Wy=kPQSL{^;M=Z1Ud6X{&+=kncWiBSfw_cG`YN;%c|!b!Tp ze6-d@`R@yYBWI6EY8*DCQj6_u_1Vl6KATu6=Ox-S+IMw3>G(s9NuYpSyu`mx zFXn>n#Rb8{y5%>{ol)+9)YA80?ko32O};mCFM{L`wKX2UXm+XXto}2dN=GMaNv>=U z%D$93?=aU2VGn@iQFb^B-B1$^e`&{p2_C+UJ@f4Ig$dnDAClC!;fc8vr*TgzNL)?m|>8t=+zHaJVfbyqyLPZ#2!# z6+YU8z&fz9vL=B;aHbU5$*TQ>C#%N# zo*CTbN|L{S^2cs-@na>s_TG^>I(BH5I$rWR^2DmPn69VH>*3!&y6SriXN@*w%k6G5 z7XJGzUy#g~RiJr;9>b63f+`Q#>20V{sugtP*?4yFQ{+A18DW+O!j5Sd0$0>oki%1N~XBqR@DGLa2Zx zDfYXyz^1-SlJ`EiwIpU>V1V(Q7>IK7boQ2chKbpQVoj zx*Zb4+b}w4ck!hL)cmI=n5_Hddx-%GX8lp-fIlJ*T|h7NF7v7PKQ)MHnl($3)F(oQ~YT{xrQGP8ff>_hFH z`N4_=DMt5E`uqEJ{T8SCWln!yo37*6Cn{oQZfd4@1}1FTb-)++Vrw#iDONF(vw|uQ zYZb6~D69$c8Wa{Hm1aU6`$n*l#5kjL&>+(J0;G{#SJek zaiv+0X;%YR&oLmofbznjsr1|GH!C00gr?`ZZccNhX1JJ!T*ZLmfhZ$UZps+pM||r- zX8ia}M?#p|v+In2BlA_2B2R~5zal(6n}?qKxgZU7C5u@Nbfcj4^~>0@ zBeX7@pFc4r1;3j|L*V(BVCe%xj>@SgCF3a}+awO$5?w8{_!!JX4`9i*Q&z@xN<41_ zuU&}kcK-J6o7(0VWX%-!S`6nIj@K4L-7j2S?Gw3grL1`CTbbU>cF#@tt-BZ*(yCvY zd#Nzf;n{!__e7&7Zqh4JD|E)#6lZ;BF;V&Mr-bqk7MyiWsI1!b&uJ^ktI|mavW7f! ze_2h>iNw5dth6DR(7%+T<`pp>9v)L<7ousqBY(<$rnOXs4!xT<$L-#k$*}o@iUHGEx5NAGF zcBmW2MSETA`dL9GL?H8Yq0eX5@`HgU6GJ}hRb6%Kjdw3J_*9GTz^6&cO zTDM~v0Uvj<)K?TutfZF+HLS;cwc7e0pjC}S_x|&)%%9XmH>E)j485zVsd?upolu+| z-@7eUKZhqN=r*tAXU_@@eJGRo)?^r5jA}>iu+80B7%SenPZthWHpKg~4moRn=| zX#}TT+fjx!#TmrrVd3_(!dcs0j9*`QrT$vql=wDGm-lL8w*iMrl4Ul{H#*NvUWkU| z8BKS$H8m@(HF4x*nhP0Qz5Q-Y30l|Ys%-WvNdpkl+up9YT(aV=WM2$XX^-_ z01y>99m|fXjHa7>b;&J=>6?FntY0j=Gcl_l?l-Et)UZZl>9L|jh9)CR=RMtl$G1^} zDj~rd`#oT16z7gnLC0sBR=ize7A^i}#s`N)vp6{!2`2hSRGQ}mQ;k?l_3x{@XZzMr zW)s})t2=kN5BZ#2lsj>eAVy$|#&OKazQQ`iNvm8f;w!jxHqk!Y*m}ZL=qjq6$9`Fa zq|X}oa!Vu4)pO1HN8zvw*+Ii>yuzT;#SHPp;UlKKj=#))PC7h^Q|BwudN;=-wWa0- z&yqQz-qD#|dv@nyBXtlbWf2h4U2Nj;M?Ujq~ ziokGQ?r+**b1&R&l}Aa)Apm(jqn%VZ)|*LF9PB!v>U{6r9MZx1KFxX*`&&0V8Rd1v z2d&>czaZB~v=`4A^)^izZ$NZ0%72vUw_88-%jb>t)ny1kM+`SgDnBI6@;jr6y)rnfuM!h}lfZpLw|QQ8BNH9}wXV^=QzKd7@LPK?hs-y*dv&DVNSKxT+&;_kEZmO9lA--*PI@%3P1d8QQo7T-O>#AkZWmjJPW#;W z7U)McU$xM;5(l_w9acS&wAx$kyO>VQA$~v)o>e^--8Fksp@iLnh`bQ1y)~GIturcJ zDymnZgBPQ&Z*Btf>%(lg=>iX!dtOuBaN6~zt9kMds>s3Y#7 zXzbh8aSl&T@dg+REyMcz``kSFIp3C<7G3faVzmWwC{pUv8Whf`F zCfVFNlHQxa?=p^LnpZW$=(6WD-8NO@S52nmTf)@6G_KFeeuJeG=F=i z(otx4oFwMNN^G;|)QVsif@ZK>d^%HTv2={PZ8+l4{R6qpnS>fDl`6BTY0LEn#>rIK z6IF?;d?qiq+Ue5cLIBweOFximYHqwjf z*ON(PQTG>KUS35-(gcI&^20h4_ub602_fz&_?^+=7>(SlHWYF8PXP#`Ez|HswzUtk=ngd^a7YPthw(`M&~`EcbDnp|JOymp;zqA!ESlu@KBF5Ps#28RWrF5LEZI9Y2|n@n7`vxF^u$o;}S zPs!pf7T14BS~LpuQ;*eQfsa_;Tt?Y)*j?Q-=#0h3OYb_|#7=%Tcu!zdvT4Sgzr`Ez z85z5^>Of_4=^;iUcN%5CidfdKq+gr9dh2E=4CmzpxiqDHb-jAZYYZt-cxo919L-++ z$J(s9zo18obFEljce)(0QjA6pe*sS{RE{_pinZw*@tV8P+{tMio)y{+Uo!%>MRRhB z##0g$hMiyVE^O&`&$YAeZuq5Kq0N0#bXR?NfJRX>y{PF=JU#m9qO-ijz%IWQVd&A0smv6y+tbp1;MeNFArZkB4uP+eF%M*J_ z-EH(pGb<}AgjMiT*jghhs|!R9V?TcUuwMqRDiGGXRzv2Ku;3_l3|a%56|VRyO^@d2 z_So+A$P2nZctzp;DjAs>9!o2I9cC9$9=0rJ6^D?Z)spZ|2ltp}Fj$CJuz|N2I-SNgpjxB)5IPrGwf(RfYMn<)ZW zjkk!t(G-DvkqPj^e*42l+I)jZX~SSKP_FMz58R5T%$BO>3ZLG}UXh$w{es^8t$r}H z=`}jQ=c7FpLhFt5N>}N#RT{mw7D!IEtWNI9fEdAH(S;3x&|&HBi9p;E_s?s zwGys`^YNAku2-&&Hg`JCYgzv}a7pg`y2e8LGN`)>)pcw=4O}@8@0~}pDwq+mIj5>J z_KQd~AIXC5>ui*6^`CLC)ea0FFK?q#?37Ry*UXED;GKZaO2b<@em?EK(e}>>^6|+* z47i@Ko;ZbTufOvqic@#6<`67oca?|!vx*OTC#3w+g;Z;6iy&J4E)giWUibI)%{;m> zB={|k111Ex&%vkyd(4GYz0<7Dnb}&&hwAy2u-O|8^8x~8$O}=x+6S3JFFgh+J~@vu zRO_&(R;djhe#)r>uCX;LQ~w;cO5NYFC{PzV=;!tGm9hDcV4IK~yodG<7$Ak4Y_7aJ zo(>zj-M-xq{jV`LN)QAHb2;D4{KCu6FLLmk*r4uzD}lj08-f@1E(G-H$4}ZYH#%SU zKL}FLbbvGQoPvUXswjYI>@JL6VIal}Ku^s{K)151#NoHaLG%Bo91b&f|L2ncg7!aW zRXQG79DdIl`owXrM6#x#_UIGs6yO&qO53(RSmIDhQ0RAkqPy#6K ztJ3<4`_$U1-~EmHpT8YXQkdVhf$CDtAX$eM-etobh@dAG+AQW5*6oYdhaHx)MS}wW z7klp+*5tM=3dfG!2m&faK`DZOC?Xvd!9r6MkS?Hz)X+OwHjt{)rP%-r5CMTu0w^US zO+^Sul@^f_Na*z&Z*URad!O&#bMAS*v!Ca?^M{L-Z;?o^>_WO-|x`5ofgbOPeD@9(89fAVGf1oVJ|mCew7X<`t2P*7QeVF;sLd`PwWS zoml*N1jzpWFTVaMyI9wWo&~U!~DZP`kf>umlwV{HFi8e-cS{2!oPC82`} z2o+i$sq{-Uce-7orTD$e+;tBtRs>ExvI{z0{kt6*th}kC6i7ldAwr=GXL>y%; z`~GlZGRM?hON83zAjIo+o*TU1^Ys{dk=yyyZ2vkAacciTs ze|gN21))r&{tx`E^cnvC=f40)`~w!l>;BVFoC24-aZ0e0 zcjuH_ww$^x>Y+gi&vDlP_Vqt&SU;V3q{)?YQ{?%rpU>~`eL8`0_^Gs^|5hXcyAA)> zZNf^Q*{PHaqq>aj)FhRXJJ3*XRd)6TKWGwUIP>TD`+;=#*0k7 zw4<|=p}8)g^w+_g&m|n&-mws z$Um=m-umyD1FT;kgfJXM2&jxB2J-;u*-RT`!NN@7LdhXzL)3NwEI~C$FU^HI8A|S_ zNck=rW!YFDZ@}8#$kywoa3_A5oSQ@_Nox{BYFS^ovX@pM2>RFOh%8oy_m5b7^rQIrd7>vBI1t?-CAn7(wrn=XrDlLx4daz5jXah3EbiTK!Wgf&UV)o4^Uz zG5{sOV-Y<({*SUJCH^(l)o%$!`T3d1vA6F0XO#Q*+6^r7KXH`w^Z518e-D7MGA_=} zSD9f>{NX=nB6|jO0+^T?9IQ@;FYPV*99mrDST#G8MCmO)KWNw#I6s_NXoz-VNOCGNI78T|3Tyf|1cb#?X3z`($a z{FGa_Zdtpy94*Mtr*4JRIqaWFE}u%Pt5qi;g3j8;CT(YQM+y|rlcbQrXL0%2=MT`_ z$5#4I|<&d|+1CpTBW4jgG-78ocM zjy#*^-^%L(?o+Hd<5`X%dsh$r@<6Sz4zT7T{Wf-Pr8H93n|#cnZDK*iofYjbHK-BGz7s@H$if;gdO zaCqCXM5(A2<>W*{{M&OY)r7-IunFvO20anD>gbp?4t_vch=R|CgD$y6n;2@bzH#Ff z`OvMhUQ1OUFq=-!BqOdDduGOUJ9`;I1tO!O^l`igpr~5*A>`2uI8s({aPS42PpH}4p&!sIL5R#0#caPsfG0CH))K)0hmG*S- zsji)+<;&@&Z{L1SxfgPyT~`mGohKn{qBW?nyU;X<3)emG-(WU$yliqf$F^0cFwr;a zI0-mnMa!Q0kA9Wm4ghCcM$$!zBE)A#9261BF;bD03%V}-e$c!>#puGf|Tt+bz6BDT0R|5`MJsfXldq+p{s7JXa86C>D zihAF#&+-i?**Sk=c-U6IjC0`BTzqVlo&{RSObefek9lvP6ySOC}AJsAlX}e-R z!#DKu1QDxzYvi(gfZcs>eTSo?V;Tv4x5Iq9>!F+wMVa6VnR~i2H%AP1dH9)L=NcH- zJIph3;V!8`adD!TG7y2gfmp16nv zXLo;tYF%k0aA>c>?HrKv7<(~5M!zCHr>c`E`{RR*3N=8kqo$>$U4<&vy!svV8Sfrv z+^^vB=hP!jA&Rn_aaE^z2cjW;K!LJ9IQyhWn^TRhX#9&?fd4VPedNt=&t`*Ta1a`Oq>=RX^=%%wUcR-ulTf<@3%_%(Q@-fn9%v!d$X!3i78|Rd7NXYnwhc3OP?UxTwg; zOu*cnJu*sjataC^tnn(EMscd`mNgL(5xz?8hel=Ft9ZwcC{gyMM{qGuvJbHGPT}jO zw)7vNHHE1ocj;oCT1o^loJz+NlcpQM?OcF2M5h{?-^lI~72oK)XzOUYq=u;fu7<1{ zG9H))>a#ZBDQ|lSs_;6bfN_VFpIqHkzP@K(3C}e-{^Rqrki@N-*SvDwlmrrrL$U*T zltN8peIgrdKz(|gk1+8&ckcXE>kf^_(~{$0?}{Sxi_6Z(mWTi!!6H<80Lp5c&GHlNqSbUlV<@6P~v-9y- z20ENH;2aB-zU1`RbR2F7*tpo`;tyYMlpC9~E-bY5l`X~F!~@1xbSTItQKl*T;oR^- zR#sNc-@jj}Gc!FqU0!|%p?=sWFB@*y;MD$9qMF;=hdrwU*+f?(bTa6VDxN51^J~}m z^bHM%+*M;n5YfW+&teO_UxjvscFMkYgs<55|Dh8EY2qw#7yJ6maYO` zh{39n2{QbN5J}NCk+4LvcltDdM5tcvQN~e?mpz#eWLWa)W-o1-}SSZ);7Qfpo z6hAjKTmqJIjrXp#kB|H;^z~|J?Fb8F-Ysq(tX#?mPdNQi$hVW5N5EKD_YIoY)J~;) zX676HCnNt`nm2>y!nDXZF!<+Ub^@Ls{VN0G;PCLEuy7M1IBx$VTO4`lzsJ}C6a9xG zKk}Bp$Ny65MSl2yv?P=5hO9=C*2v-fJrpgF(}ypb{!lO+{y-Mw$2%snmQ5bm%1i>m zhPgAcv9U2TCT8buAQ*5vZZVDzyB_QsyJJzgU#}neHI*#8!XHWuJc0em5KEC6U|jso zID_JA5iOp3*f8L{dxf0W!dx?g0Kn5s7^iFUp5Q%u)CxqUl^)P605Pz@wCe`=f5$xJ zGfl%kupIf-e`IGve*X9Pe?JrKmiA)bLZMWGy_2QX9*Fz%t#0}UaKdx!)NBl-wq zV?XxBYbR`v0x}9iOptMgpH8M&_6q*Jif(nrD!iRQOkRE@{kKO{ihqAZneoW}@R;8o z5n(){`5pvetu90khA|w=fW_HePI~TVk+$nFO1v2ot>PKUUrR2rKX~xqRcKJ#Nd(O& z3rc+tj*Wfg1FY0^XY7!@#3nf+r3`>#Ukq`I4{U5~u7VoS{1GCoC1CE04E~E+D;D%? z2d%}B;M7;p^z%f`Y~Pf9);_zY8GRdv!?^~(>861k(?h#OmZiN{OjsXWI}=;%NQ!8bG~yavMuX8ckWz`U{CqI z-b3ZG5La8{Pc$Qp&6HD^6N%o*T?E^BoZnZKKC@`J6s zJfS8sTg!OAsq<2Oc&e#=z zpWN5?2#gXazR+bdfX#5mU_P@xTpTAEufiRYkcgBuHK3cQ<3FTsHfBmp){UR zb@>|yoV;33%6>syInlqh@fbF|-2>^oHTUPJRENioG=EuN=-u_8eLyTFJP-;Nclw-q z%=z6#RZx_-YX~ZsJ6hi6B)V)Ul@V+|dAmKnHdw-J!!$zCoRz*$)5d5%q=0T}W#6IT zLM^cbb-}tiz;_dI1{1`yNp7x$h3c=E1_@G`>p{w0i6jG6K+k86pf=%1bti{3j|y;) zHF<4!-{no_3HKfQasH(QwZCt=ht}oZzhtvf{Y@uw?MvS4uF7kyuWzN?1hpzAT^4iW zFNh$$kbedqlW~o$Y`2VSKcmW9XExFb7qx#%CitUSu&$7tBwu>UBwY}Qwr0?6<)2+$ zPj^00xo>!MA2da|p~h1@VA<2wdhKi;f__}d;>@LX9=3-BwjR1H`<^OJ3ay}I2aDM3+FtZS zTzdMo#d(Tv>|PJ0AKmQXTcwj^O_8n!5|bx20m56WfRyOh(M$@0{PPRav{;V2?|MQk z8#PeswcOTT1wq?-b!LP)uC5~59(kW)x@%8Wp21RbAwc(YT!q}>!(kwYn)~_rdDq3< zzAt;pWoaj;S5f@40+~M)2rBmit>X-B>FBTvtdNwH%!2;YIc7OIIcE(eZ;p;hPv`f~ zSh~?^5(DS$c_|&mb`_nFcvT5Cg2D`qj3#6kNXEW3?F3KKrrmsd_tizjz`=@ISXv4~ zKZY6=Rc#K*X+k;giFnM8Fn-#s*Ti6qZw9E{s)yEwDin`1YrU&ixK&|3!c-)~$@b1o zBsoUqBA0@zi%UKi>74W(*{v=0FX-9<_6AacV`*sWNk`1(cKB35pUcH@SsxD%>DfBp zg)r~giL{+haA18I_wasN(Y;oPeC1$mf2B@S6~y&`5}9g+Vz&UEyERa(+v|a z)!uH@GT`4(&qN4g`dIJ$Wj&d$SzTmQ`@n`!A4}gH0iCu;tCIJv&*ZQnt#HXe?b0>* z_}J2|3`f@!0{?PV`i{O&_C2E^%QK^Xl6FiqIh3uuXXKay+g>-!ygC`tb|=3YUm=h z_Z+cXM_c=FcAGXZ3l8?zgI(-Un{2#2+~j?t>7;%+#OSDb;i7X8a)7cu@O}_*Op(00BF*oX0O>Fu$6xupGpV% z?S|w&oF;`4qk(r-@Cf^`xCD^Om=Z`B5;>RGeidkv+)2e`fapt&fB*aZ`3$}K`J$R)AV3- zRt~NE(dfeCE*ao?-e1PK5YzG^h()~3bu9*xZ39mES7&@=*P%=@lYIFGCD%isFt*a{ zx20^q;#SrJfT>%6erO3q9I<6o>!MIU$zWvuCMDt zAD;judnp)#8HCb5#Ja9s(-x!NW;M}Uq&7`D0}bR;nd?2?Z(L}O7_$|}8I{jQP*4xW z9I-bbDhE^xNIyRP_3Oo){QO7sE0(bFW1dy__VC1ngrg}BTsM5w8ihg@^L&X!y|(wm zPr*447p;zKpka&ZeCuD_xy}RK~a&dJX95;hE@h+I@(MJ{quR7)Qd@bZ&Gwt{P_MFc`TXp2xhg+1l5EZYj_)jcvYGB$_CTU!kd*M>}L#q-@% z`AR4#Xz}1AmrWi}?jQB$tyb?IWGa|dQ>642r9*uVbKT3AD?y5;q3aw+$>mct5x5i$ z45#;t`(7WX0Kc*zCOvBaQm zPN{wofq6mA5FW-I%gZ2PEWN_+HjNe&E~aS z4{6my8wGadEGJ@01=CaCGb3Efv5E`1f=ytY!K{zQkX)L zITbSVuPH5bm2ccD#k~I}75p!aG$`BBM+@avIGRZGEET`LPyWMbe?}W$oPx)g!0f{O zY&>Pu+i=NN%`VC))DrZ>ztT*68c?SIB#W?O&&hPD7%v+eHO*QjaFJQB>Aiv|l!|2F z>35|Mf~U=EACV}RJQ?HTcSKB-OY$roYhbM=UJT){;`FXCNb_=$O=b@(-FHBJEQExP zB=g)3dE=#PIx{U0QkU|Y%o9nO;H*k__wtIP)4opvbI6$@BZ$$3p@e-~Sm~mMP-1MX z6(Ph#<^);&i~S7LAESILpDIYy%~B1DPv1S6&`tumwxx%fIr#>;N?Z>-@|Ab~tF;Y( z20aicp2sp`l=sLod3t)<;LP;gQ|>iej&LMSZb$)JTo!2Ye^HV;+%b0jWH_N2;-UVr zasRLN_602x^{3^R?o8)mQ-N!H&KDtrl8&Q%r|z#%A_*$(RZtYaZ)A>s9&WHN?S;pN z&x+Xar&ul31E0%Z9$fMA<}KZy+n;Z1Ub{kg9{ZQTbEf;(l=kG>CK4v1*Qz;IWu|Qu zty|@_NAMsmQz^7K?Rx?J6*B^q)*bWvGCbJ7y1s0M%vD;VXo4gYG#6E zZz-epF1K@1);u-aHHl|BrO{X(PBWhCVxz1iCrZ1^aLqz{?CEuryT1=WPiqpl>O=zT zflyqqhG^&>kGbYb!5^a>#6&B96W3M>+0CDr_J{{jn^34~E+mN2gljXOE$%wqWG5!d zvj<4r{Fy6My|iSEa0E0Uo*npd+p;=SeSb& zNFJT*!tlQJ)_Uw^end*P@$H#T4EHm#zQp*PW9xXgvPPG4N1w#6SMyfU4B&{d)6(}V zGnFxzqYK$xO?>q`kzJcS3g{4&|6rz~SlBX@484vnGhd;;cugAc(e?T`J40xJEdH0D zuV3FZ<+%#w`ieA=bS*1}tJ`fup$d@LqUs(>dGVL+bojv=3Y?vsF0L&H72<%^QAx?F zlIeE%LcvQLma;(QJ{R-=cR2o?tBX^)7D)1%1 zKb^+Z^z=wr*)QqZ?Xxwf>G|{BM7E|3NYcj zf|nt4n0yb+T}wli?Fuzo+GvM>@#V{BKsmZPVt_O{Lq_x^##U5efoGthtf8UdrN%)D zB}yV&Ppx$6ci0$4ddNuQ^tAg<7Ruyogaq)9mvG1)g!C&*KP)kDdkWGieUxN^=ps_u zQZAW~12lj0<8d5lASegOb}8JdtD`4#vVeQr7A zx8%alagSanDrj*Z9|0c`w}&R(N09s#7}5HS-+j6FvKs`jhz@9mrV6UbO91vSfQU^l z0~?#91yC_GJXqQjtb8(TX&UUEQKjXO!>hTOnGeA@S#Kh?4XO5v4AzikE?4sYV`i$6 z!CYeO4e-ibNU1*qUDN-D*&RmsxA1e}D(Ui51-e4@Ma4x$3Hfd5l|4(dmAq#JgR`EE zyc*oq^+NacB?&mFmun4C$Q)2zw0!~C;9Y=r^yJP>T;G}v2*{}_MGUb3~8FrH1h4J$sw0l0GGMU$T zgz_?R*J0+|L(51I-%}6jz)zQg_Xx-i4>Go$C0v!Mmmyu=P<4@0K;dBHT{?ocra>%0 zZCzc}%W)wgq57>KH8kqKebc)PCN0=(v>XGn)qn%%4dU3Wil6SQcrHPc?GR~HB*IHN zhe1$q&~sm1!E0c&KRMFQ+B!TN`1CG7B(al>1C61%NKc=^jHl|p-f?wZzh8fk94Al^ z?5yO5C=g4MK`eeLQTknslY`^A2SEgJ0sQg!!>gAI@a!yBub)0QPR*9BlPRZGLKFbX z%>>P^0Bs^md%=aSWu^R`8g0Op4PVHLEU`uJk-eXVtB$^<-`GC=xdfapq3h?B4DICb zO@Z05WcO#ftLQ5s?)XkM!bO4Y4<-W=W(lUlRA}S&`3Njig-&0q<7MmWQoQn#55o&k zV#S%l11xNI0oj+&I{=O(kX7=Lw`3)Kz78GNA*dz=h}KI9vYk`U|oqXsEnW=qhuwArKs1Ngy`81&tPr>B)^s zc#tO3Qg?{J8R30@o9knyH66$)e*>AmAKFXp*GcLrT5BupHbepQjrvY~VK{bX81@r- zW|=>`ZMz)V5a@itz}qm@G7;L(TS?Z@lrz>!!&OAl>{vuXD|>+_L^y-R6DZY2#K+Le zyqtg0*?#qMqlidtVD_c+4tfk=2J)}$Ms5(5Dh?9x;y85S7B20Dpogo-C3IC;em`FF za-#V>yeIgCV8h!y#DbJho-0VlHp6QwT#`Xn_t!z(w3YTi}&(ATlq$JoqGb&$srN7 zuJdzzT-ePFrFiBgb}5lXS66&>r>$Za`DvOkuZ3fL*6vE6(tpwP&unI`?N z8Ev&)y6`4z%bciPPqk7B0S~8oT>0y0!@TlDpT))SRv{-Q_-510+nyDsB(BNjqJLk2T(cS%E&LIN)^I*ly9Om-hUjRlTSY!3D6l zB4M3l-Q0`EZ0zh(faVGUQoexyg3;5--8}|4R&rz6K3Y?0Fao1!^<{jS+IJ|vP?x{F zfmE&+b76aZWg^+V$S~E4bCpT^9L0C>92m-9Hd{xA8JK!pSN*^uz7FNa@vOv6)dkpX zoF4OcYFnG(cSOP60LKl=G^)Deoob{SSM`y=?%0G{WZ5P29y0NB0%}{s{JKrEEd*7K zWXW_%QX(3K1%!0c0Q?!3kYz&G{3kDzl!xf6BlWVF}o zr#-K9(=N}+#cN89+~-jQ9W~H37c6{VprU9+bw%+yN?Qm@$6xV6YVpE2uD=+p*cNTB zak3^XVr;N!d1notvAJne9{1Hmx`axvnlYc_V=J91F#>DJ^4N@!KM1GrKKQiHf=);bP{*+ z@kt*=p^Wi9qtNco@NFO^UFnJ|o9Z);nwac?A_76ExPiNX_hja9}+rn~H zAeLa#cH{cGVkW**O+S)NzTgw*2QB(j6z2QWD84M>zN1~IJSGM&PrJbdKhcMJW8y*B zx-~`e=+Ps62}&li?|VVBv2=8t!AbKNaCyEtj~oWivfzTfD}%c(PCV znM9sXzFK%$bt;rJ*S|ZLa%T~4FY8~+^j0`SBU)YL-CFx|^~q`*R*FWB+E1%#iTX|! zbR^joO($;(Jaw!e9NQXDE`6cvzWXS}b!W&=C+QOq#F=|!LsYTH_yMq*si)mzJ|PiX zcEWA&THE4))4ns&1U{jyePB{Aqi$CNh;70vmkGVD_!1pMaEA~RcjBObW|MN5 zu-$HvP(kuuzG$dUT)goX+u}szBqnMv4Pjc|-a~$?QDRqE*h2|Am+*5_Q^&vsz8>M9 z8yN)yBFkF(dk|_?>EwX*l#ohm9sAKM#w7xhfBX`$YMXrD8%CdX`KDF66dVMgi}9&b znLTk#L6o7POO2=SvJ+b8twceTsTN`^e5F}^W$uBqs{HHlC(-O&u0F#GxT<|OzoS(> z#(!SAil2jPP+>nkzbX<$lRer|2P{w5iVZt|R-0*YoC^FkF#%!9%Yza&Y>f&i$?!kUluWxpsskTRB zd)KeGWftM~#i?zKA>OWewP*GS+ExKN(XSc?8!g~}$rlRQOar)x_D&J*cn*OHwZu$c zfV>;ML@u5Fy)glpxOrvk4c!`fqbc>wei|YquHp+jD8AZwFLM@g?mO?G-+h(Xtl^#N zg0}QYanze5%AT1`8kdHWOgqN*&q@Lb|4o74xDQkm4EhZ2Rez7D8qCceR{wDgWU$)drm~dog=OujphO!;dY10F-!4HK0148roIn%1uIW~^N`cuhB6tQu;Z4I(j4sQ zir#Yr2!jMD0d7wJ$X&hnAWAOw>X?hP`=w~vX)oyi&QVCy~3oVz=L4$w%J_Joua}jQ|{Tj54tNOw0SFo()A&{w~J?GucR7($I*BWlN==h7qAq4 zVv(!wt3DRp5?1f42(iP;-rYD{!qXetqA)FkSogrJ|$0Q7G)?Tmr#x_%bA3 zT-qrDRvtvq^OT!~FrUt%KpLoraSOC7fUP+4FKp(X6kOaQUTj*tU11g^kB`iQ zNPA&G+ z!URgi$-dEDB0y0{8ChA57JF%xpSV!fH;?6gBu)efC+np}O2@0`P38##gN|(?DGl`? z&eYCx^S&#Z3Vh?W^XErOvqE_Gmuswi6^?aSp%}GAfG25HzLR1E&l>wRB|A`84|Hz8 z3ZVj6UY6*fPTzC7U?ZG#8f`h>Co}6toQl7)TdY%|j`yHD&EvL1V~$0n>s-uoupD-8 z*o8+TDuc2<=Z{d-i=rLnkLsgJ(?nRd7l@ypujmDIZV(}tx@p~N=OnH}$A}(0cxki| zBI+?-UV~5^a?>4k11_sD-2pJr%BD7+?gA0pSs2wn)uY4fljz z+h}q`SX8ulO6uul_P73-yy_k{lT0f6Pt-E$I6B^Hozz z3o{V1lez8pvei=^A(UemNgN#ot{-h8Fl;YIT=m@&V;BC=cp@%vrma%HSNEe7cl1H* z=k4gzl81y6ld@=6Z#TiNp4o@p@=wn<8-d)SO~T@#QvOoA`#x}?*o`x4^9l=vA+}`E z{_v|1P%2D4J!f_NfwYYnExRhGt_dc+*lhPPqu&0*nOgS@jsr?qG|Q+;E|bUi!-V}J ziBO{3WexWoeBrFGv6gu|i&?|H53+rGTu{LuiVVW;Rjp{?%g`YIX7%gE?^s`86a zIKaU7TNA)3Wx=Fd)bHsW&MnsR5oQwPLaStyvJOSP_e%ImBV`?akWRRaLLHY*#uRY5w=@J96Q?R z4%c*kIijRQ^0Z)0M0fIBw@>L_a<6||rCl{^$@RddXHhTWa7QF1b>iaVcWm9d)w{g6 zprC-4Tho=;c`KmW;@Y)Wu}WogAlU}Mt~BcNnl)05larHokpv;Mjn~s`58(2^vR|t+ zFeyCeqhHh6SLruyM49oD3omU++FlaM^rDjM%DRAwaylY>fSif z8rBlGdy3HNex7jVyS{NKI!Z;i?X4pS=jkp#xN`A@ygamF_BqJAF?rxV$hwPWMbt!@ zY)ei_c|EQR*7Uc#5&7g6-JlFN$(B%8-#NaSOm^$2NsuaW|}} zZL_;qMZ81_>27;44QY}c#r!<9rh`rp4)N{Kkv=sL;x?TiS11BJgE8)t-wuYrjsLM6 zB#hM_=HIT0`>Eo{j-BWvbXh}&)rXC*oy2i$$ zp!J^uS*xJY7Ve<1aACg70D`^01)6!?4F6&~ZLbrOZ#PcIUN4hm6yHg^PaHg|y#q>x z=X`k*LP!?H827lta9;Bz5pRW)G)rd zWx0Q?K++MNkXUM{%4WZ~C|(!-;zRnVu&eIw)8%zH&)+pH#(-<4qHNt+bPS-Yg3lbg zt~r;Zr@j3i)GE}BUI8ay7r3^wiB4VA+6+*Q%$H+vO0dtv8>{>TR!3PS*e)Szh(*>K zF?Sy6A-)3^7oDCy1NP9d_N+_s+)G#D=oMg_`Gh!tywX( z|LK!-SC#j-T>c z>wZwg7nE6u%70BtsS^S_vC%U38d)otG)~=XI+}0So>P_a$g%yPpWX(n!jH{1TrC&=qNDc2dcl%Xcd}@YD}(Uv5C+XyJJL9Jt#toM@}NU}C24 z=9$K_2hjVppjuRS>Rk6Jsh>G_3l9(tYNso#SA5!cGsqT{R=ztKU+z`$y4il4&up`0 z11C%ub?eWNYTmV>j}_j(@t*-aAlg1xdywbIf(pvT_YtLe8n@BWy0yJs8{fh)oE%9SUS4rX5kFv66#wcDr2Uj)n;*IOlITt0-fW$@l*joNC&FHR{#2*8U4 z`L#P@RCHN=i4dk8Xyuv8)^+y?_#%P_{=y4triz+w2BZ#JyL>yxP79_*Z9PBLV3X1; zLcCGyPEuVl!bKRpHn^H8jHj#Ht%exV+(o4{0F_kXr7=}$>*$yrG;C8+1S0<|EsGVn zr4VFE?~|TLa)Br5h+#+;HI%J4`ju4AD-K5~^6soPC7$EM+9LVp+si|m zfg#2l)=nD`9=PZA9R#@~5Xer&{nW~#p)>?cKWOI+O3e&Ez2*B+BzS*74iX9&ksmCV zG`a2=1B<%+H=`0IW;L(ubG6RTOy958msF;#_I)VmDCZgu3<&p`ck0fjxTn7Ic<$jo7m2`H40*S4(JX` zicnUoc_pfwx8Hk586JLRNM5%i2I*ENvlhE|hgHTD2kl$_5b%=d#Kc_NRq&$a{Ad%N zB!uP@9fV1;Z6ZWv`eBP*hn#a|wx`rOws+#sXs!+SsvstISE!7F0-NCG7?6q;cEx}l zNXM6mX%8y4fZc4O&P9 zzy!iebM;nCT_l{(6WIRflpD*aeK98Qv?YE~q=3!?(3xpCoQ~vP`>-u2_7LY52oD-M z6pxpcXD&yWC25&iilHx@)$c7;lVZJ*U>jj3NcOT$Mon!XoSz0PJ@Z$`5B>`qTuM07 zitF<~cr6R}N^zi_UK$)4+5xNw=p_41tGSvQH6&vPZyOj}R<_x+s|o5$gn>)SSn+Ri zS)zLm$R%%4jE7#x%SR_`tAPB!RzppRqt(Z@%b!@JBzBxS8_y|L-urCQb@u~z{^7p;o_FbLWbYB%bIWI|{~D+Iez=oFCfuX6HeIOo;Ch@leux@C|#Zzc5mOtxWC0 z$c5I)fcg-O0T|dg$A?(Gty2aGUuya41SN%kIld$#y@IO~?O1d~3*{BnzUPa2?}&UG z#$D?=$NABTi5$FF*|>6FuSe00X9q-y7iK7iF_Dz|N_0GZTr_0(TEJ}QygAfr65>L; zB|Ln5ilns>f9$P@F7B^z>dM2V)peq)DX#M=EmT@fKnw`8s69Y<vAfXNP3!0@~>WDg`VOV-6_y$4M|YJ#Ip20bYvi8 z({-99o*&gXD|5~uEKXfFhq@@baz? zz(ukvKmraWay<|iSFbJfF3HbkzV|&|3Y*uwxTt+ZN8TXP?8*20gg9D8%%dNq4`+c2 z-PKfL25nAsA@0x2POh_?F$Y`7hAsY!Xi{ zn$rmiyoFstFsa`mF2Yy#;LlrBnnNn&YqPtck2?iMqo-scQu~q{3nd%jS>5UB=>ZUb zf54nt6eo=KC3eh0jOw`S;>d_5m@-*`311Ru$1!z+sU~m;8pmX_;0TbP^z+)93>j(E zNIp|}w;l)Sd$N`N;5Dd~q{lfh1Gc?l{=ZYMO`bmwXRY#!b+B%f6)24_i1ip#o;TqsJZ>e+R@Cnp*^Z0dK4t+f%eh@?+5?8g{I!c1`2e&e2gY`#75ec){_eylre&M;Q=69# z;vW&4nKy~010^R!)GOV~FGV&ye5!Q7A_)-h(kbv2VRW8%*O~6H+q-;Mba7l1DL^~P@`Z=t`K48O~%x(J2%Dx2z zHqc#9>~9~-zY$PvCfVR~%G}4n;exfbH47+J<&ZG-fdhNbI1BQEzH-sV#x9ok#+yNd zz3s~qI{N{^qzLNw3=ZdpS}iGU$J%w*HefO6^CxqOM3u0WC#U3tr+$D!5gi|&CYQ{7 z;9iw`-N0*R&<&wOsSdOgKujif0oD3x+Ggg%-&U49H_+*-bJb<_JU$NDXzuNK;&WZUn5WtJA?% zx@{(^ZH3#S`u@?u^h7mMt-3+G6mU_#zYrRa46I!g7#DvjY7-8%1HEowT?~r#pYvFM z{tAA4cT~%ou;VX4HOq$7g663iD-X4V#6%rQxot74#MXDs>?Gk4(t(#v55^b0Is}=Bbr|lTyZ)iW6pHcY2f7;!*YD$WYUz7A+q`MY<=ooj-uu7=_HDze2wc7V4|jFB|$6&rq`tc$Jpg^+zZ z!l<``zgSOa<5k@=B;;f&mUu35GNKU|^hBW&1Mc-syV?@Z9NOgm%CB!t_eaOJ%q zl9oem^SF^S)W|X6SRxbfx+!tNq;Bf>r(n%In!u)T%V7s6ikbiBU0d`pu(()u_ABx6 z2f3kmVn`K%GQGk1f%|G_APm9h4a2}P+yxxMd<(am!pe@t%fjjUAXb&rB{$F`@*ADO zc!oW{Y@O?@PYUn*h|ZW&uc;q$uqMalethzDg$Yl?&;`p}2llN1!tN#}2Y_IbzaGfB zRL5pTUK)fKby2Bb26kbeuu4urKz(W#l4MpfU|`TK4c3Q}7t6x#$jb|72YOFl#BBV< zSLvX;yxN=a{U+y#Ng>#h{GDS@w1F_bCa=q(2)GQ0aytB71>hbw1=%7xCg!E>Qy%ek zCeh9}NAbfFhP1A0iop1hd#N0jV<;!!L`g2X46aX#pI6dQA824m@ptXHyAf$ ziYlz+T)cx3B*0QwF-YXaD4dbCt?hyff&PL`GRru9!E=xS&5C} zIpK!+Y@MyTK^3cR;Df=Oudc0aq?1EP6c4Q0sRw2vNZQ-cDM3h&H5$kmuqtc^qvNJ} zi)=h=`FKqY7G#gB%i{W4z9c6Dd4uq0wpRIJagM8dL$7T>EePB!G;$I0tIUA=eku#y zHNhOEQn<0yOAVA23NTMFC~)x;9%xOT@S%S-0n%SirX2L_7$N-6Vk1;O~TB^jmR${sEBG z0+uYOdgfb7q6Sjm`Q#cw?U!sLxF;_d_vC)~7mw*}9ql-w6?%vj-sTw-%KOLWfz=MT zc8u-~3Q$L4$&6Li)EdB!=_#aby3bjq50i#uyn%{yesFNGP*5DmOYnm{=uT{$ZRB}S zgpx|?n(0Zt0xBWH4or#sgU z$kL_+x^cVPp++u)-EV+oHIR*$uc@nB-0&IXYZ+wuSj-^{kj5ZBPaT0(hV##*`_~ia zTEl`WtN|Jom{`76(Z6%zASO@u9>%SP1mK^6U{arYO28!0!zX}EqJ}sLDFp?b{A76s za2dWW2&HnUy$0e2J7Mc#!L;zLq_)MhIj^v4B*eOed=4?sSe%+4?n!esgb| z;yX8~#Jp-#5>qRW#{lbI!_^zS3~uj6v$`ln3mhELQpK>5xa^br=86NK)qS zEZ9%E;a@;SKmT=IFUVY{Kqx6RHk{fi^LC|E;Ex|mcGDN{NBPi)0A?+DaT#9;-EOz@ zAnca=TP31xAQSUVhxTkN@sn?HZnRP(B?AdDyw&xM86iLx%XwKN`hrP$4oaVM zv}jHR9J>)IZw-o@`TOxfZ4wkBDRim*0rHcs;7WrB!riYV#f!lL1vM4|!1$tIpl=Le z>;X`o=YbSzl|HUKThP|$3riG8`#XTrHe_H3aF%t;wwKOJbPMQ>oI8(F^bv&gZb75g z?(537ed^HZDvfbhdRyGG{xERN!-AyxVRkQ2Qwsec)9KY@Yj^jvdutzyVrXE$16N%D zRBQTXhTxAHVv%G&vP>a@FPtUzmV))O2;=+EG34>wXVn!Yony+qHzhg`l0!R&ZVQT7 zJnY~Gk^njBX01B>H;aK>-cV@PD9h*eLbIv(EuWZkPjU7-DGI z5IgKHtR5!Kf1nJ^o>1ffGy^ZzAggm6LJ*g0vTd1G6oPX|l)EdIg0Kg~HjNl|rZ~{g z#}$*?AWmv=`z4vF^2c>vLW6+K1VSqRN-NkBG5>ffMf@P+ONPN{fB}f7tr+cqsSq?S~Xa zX|kkf6emTN!Le^GmJ)?*Weu%D$i7V_d(=S)5fxdJgRxH-Q`RIQTZk#j7_x8g{Y-Iw zzxRFpbI#{;I*oar`+I-y`?{|Cy8jTxkAQE9wLM7jz5D`*L-qadA*9(1{s&N5T3IOu zAS-;MRADIqL?i%R9r#r~w8DMcx`G1rsJgkom)Ch1myxqPrzpob7WfVP!RY`TnxBYF zr-k=H7J+K+R7-fuvC^>ZNELYe&Tj*x*2o--$szEmzTimku$i1Hyv4O?hm=$ladKgy z+isIiNXz1pyhG5ap^TA>y$pgZZh(jJN6|*OHzuGr->b|b@@LYtv4XGJKBVfHlOgsg zoZpb0vNj#?ghDP4n|_%qqhF;}1qJ#|O-+X5fdt{ew|v$vd4~#C73n-}xf9dZ7j_8p z_eSBN6Cd+IdtuTPNVNibLys07^Qx8lUa!V`zig#_S-V9>HQV>efJ1P>0U-ehLE!7p z{9h@co>%eXZ`LIgKCtH2C#&jm%=-@?{wdmvAVnKt%<lXqMzhPi_Cf8PDFpfd9p7Y}AIkNeFb6-0*2jdph@%)w%|v0j#M zMTCk%M|2;SaeQ@TF0+g@I+ex5=@Boepf1seEVtI(NV$fXP zi|Gs=$n6-~A_zqx{@q4(%X4BKZu$MNEO*3$2ID1Ad5n0Lw@6hxAe+vvuI(P?;-+_6 z+j$e#=4t5!0^u-d;=)k>f`GFXS3nmG$HcbS*uIRru31BXEI~s>~^T;E}C3u>e)ho;?q308SCTT@s`JaJTm<^YYam=$rU&c(z_$`+JVBycoQR zP3*2MN1*FGhu{L-D=1D(ln!}%@AZ!0+NQj$@w=+<@gPUBwpWwg`CL2*}+%S@{2Mrb*2abSNtGGZg;4we@+JsI`Bq?6O%A z5a;~*Bc^Zm9<}rGDxHlFX`Gv#_1_1x_g7ClGee7uf4GE;h7@+QZ)KpNRqkCAnvbLD zP_+4@^oc}&=+{ua2IsPOYtEk{F5-jN4^k_faic&|4=FDjlUF80oD116<6ahFAz{U# zbXhaP(!+MUHKDHAacFU`;3`n9zw!p8L07Z+N3vujb{oXYua%aj1 zio4kCF-Wx^y7Wfdt+5a4LnX1Us? z$OnLfX$O|0JVDERLg*;C1_4?@{|p58)j+!)syTAhI?iCUBX%;o4#eUhQCueb$=HK9Kp6G?7~(-pWHmfUD7&tCH_oL8gHr&=03z03X2 zCh>Cb-W?9ss8+UJb!)nPl#-CYhm)9bB9w9YE2L)soObA|wX`KTSU27=+sl{_#tS#k zLCJ11V#*n_i8vpAG%IeO0y8;}j8hgML}dP2Pu4>2M^r)E=B^gGFYI>Pr}AOXUipl| zXs>p!)bG7J-?%674{ed6JztQ|P)GJqxDZwUsz}$F+S(HZrKJl!ZjTc$1M{)5_=5Q0 z)E~P4n!=0gJGvVc$U8>19Y*32+Q>>5EjLkq%#Udiw-*3;I6hfdK?vIP>6qEyJ7o47YsoQ?$>ATvg@BXqOC!84QYkzhmUYUr_Ka_a;|3mdClH zC}Q#OCj8cR-V-30ejMWwqPLxA-)~_89Y-Af{{3ZFe?Pa_oA?w~MS1}T`0aH+5U`*; zFsQrwX?tco*GfE}*BE*{;_XS%hy=yhQB>qv^&n&VuY5G3gs_!@?jiBGeokH{V zv?WlBSGU#&SbXGN7j=<TX@Dl^}LwcaBn>Q6d3*{E7JTuri>LnxwZgcp}K5oCd{8#zLrQmjR<4y${l)XACOMsR~oP244oE~%n z?I=bje<~nf?#=(>SJHK!1D~SUW)PU9+h!1gz$lHS`Hl)xTVO-M{D%aipZtzv(~nsM zp`Zz?tWiZBla5(spMUOL58VX`uRi)1% zN0aAW{NyD6BJ#Uwody8ky^hJdRj^NT9^62->`GYcsa{EZw^?X)d9R!n>U|T@2!1y!8f`#je%vu7-2$^=5MM$1+Sjsu<;BT{&Fv;5uap#g`>nu=eZhn&EP1z)EMZf7Dw(9uGLf9anlm0tb+D zhb}&enE|ovT%ryJNFDr>OYg>lp2>epj@z*X(EI9xLtF)!j%ZP-RNZYvCH06s4=M1R zxS~3}{)owvajh*aI(sLdx}I^;Ta{Rwk|4pXHUI}5bJYJ-Z}jfZzBWW;m~Uo&{%YFo zhr1to_I^C1I$odmRTqYGvSlvt@g7hFt!}|NG;fvhU;RP9#@V1qzY*?Yj0Uo;S!`d@ zbV9-%i2$cOPInRJdi5WlK+$F*pW*kdY;x!d9Pk5onnL~&_{+(L;_{{N(|*j^`upOF z!$o~wRveU<6L5A3OgxvIYa<9=^#LB#Uf5GleT=p*3?AY9;_G;0h7MN?sgCschFLya)qQv3mYDl|9AGN3Vf#oOE@GGhCNX zBE<{^4hP7dn{=SIp?rNrr`JzXE1C`9whomHAR-zMIF&4`ip^dT_~zg4{VFC`yvGnU zu?y~6qfqj%LWQx5LJX+u>7Ih2SP2 zfrcRze_)2Xwn`MFDkg(7LMDk!O$aZdHKdFeqeE6ZDn9cZFN{J4E+;1tG#w0 znN^Id6FeH--{%I*P`_V)NRf5UmDQ!{weqqB4dp7b)k=qz(VCq44Q$jJb!|m0K%aPW zemZ5%{N6}k%KhL6q+l9Jdb*x_Q0G6LW;QmBWo7u|GfmMf@>U8O(alHQd z^p#mvv_;zC`2BJpbp#eKL1YYc~jHO zRS&lySL|dmrD#59?(<#;usu_(r(8oOz3dG}M>p8+)br@wK@bLIMK)bofzRhIxAzF2 zXU0=8O4FMEa$1=Jf##u}w5R+ssQ@ER+VL1Vj631-YH$M@Q!=429QyVx6O=sJjuCD7 zU3=!getp&jqso^-w{L+T4%!P+vJPE&q-v_-)A@ALc8M`in9-5oQW0pXc{Wzg;Xw)u z4Bo$dZUadwO$zyOC$<6(UK+Bi9Kx~6%7gH$oSA$%sC{&TEbAZq(4J_6u5pM#*+R~i=GfY^VS<}dg-dz1Bdhe6p zI?w5RH$vX&CzUE!KjLf|=4y~c8PWvgZ1}h61|n;6xA5~m2qJh=e<`&pXz8t9eSzSq zzu^<&&9NW1y3d+pDRW&TeAXZT)))oEjzm|X9CCbg>wgO3zMO+94u)72tw_zd$LjF^ zl*psXu82+R&;Tm&X&;e4vgT=sQUN^*6fx))*}~@;eVyVDA7|omgaRMlzq3gbOizHh zka2mEQvRm&96G!SvoD;GIYAjMIC<*{(-vB{qGJ$7uI6eO^ryE___uQ?30jJV^_GID z4(OR|irh%%QhgT)6I@!Z0RGD(OS?Dg2$v4eb`&#F@Igyu@#@M-z1Bn!+Ig0VD z_mX;Un0y36K}*d_%N!Ldz!Z?&lYpTuyHWXr=EHSZCEgS$2cSDG=bAfuTtr8cs6Zg$ zA_Sg%=XM53?SY{Nmi~mJVuDDy}cR*L8;e2qN4nU=zzvY*Hu4_07pHd8(_pD84CJg(p11m`k`F_7Ku`aJ- z14h-*_hRk6m`U0KBj{Z&PA(|x$GQ8R>2 zPXBjy)klvGDB9d8l-rX4>Ve`!KxUV&j8?3E5EsIWup_+>5 z%-_)fM3d3Zy_AlS;~Jw!O8{NH-pob02RiWj;h|AAXaCo#n~Xg~L2Qd|#CDf93_uAMKgn6TY*G%>3lv*8N)cJ}cf94w9XCZ} z0K70(e*l^Tj4Go}Sx6H|2Uw1Rv=|0oP4r*R$mz^dX!6x{+eLHWJ?L+s+w}(8*Pi=^ zIJrS@4CtMCOLvJX1O6fR!;2;JHD&v*Gt@6t41_j9X#f&z`(uGoLkID3zxm_DmX~e< zQvZWJzTRo`P(de;aGOMRT;-tLZ&?(Dpq>}s2Pp3wG<8h4DZ~F zHZo&*oEuNu?d+9Ag)JSQ9ZHleVK>0Cz6UgGAOEBQw4F*6m?k7>owF0i-g|c;h2*2! zBAB1s3N=IkG*Ocs=(8fqC&+GwEQjkxQx8G(ztn@WkP+c5#xGu2_G`hc22MdBD5B3D zjw$~?%Pp1h( z_k@23a<2ehf-w0)bNktKor-nuFVM$}Fvlyyy+Cc&^!LLROA8SbKWdDkfdKp*N*=rz z;9~erXO)F+_;FJr<*)pm+d8y`6HavXC#YFcHkLL-fQa3jCVe=+N9tP^U%0{*H!cMC z$UEJ|N}W00JbC~3BF~qF(k}>nUmOIasF816TQ=Qq+BpBf4At@^%MB&9oll{2*U;B| zf>M2c!#dph+4Gnk4XD=J&ukTjt}J&9)G#9T#>2-iAbH%UME?;&EaZe$Gow%1Loe zHaQxW421oGiZ2X@H(gx*bOmj-A)<$!oeM)tOBI|IkjZNs(R)%G1(jYb+xE?30Y&{v z$D(l)L#&ia&_L<35d(crn`4!1-Q5+KzpQ|ioaOlcM=_F|eeqwlYUq}XoV|K|)6M`N zF*M~lKn69$-Hm;&nrA>6Jse?>HDP9wi{@tlY!Td60rT$%|7J){2Nrd^mSxYLX?hyN zSp!(YE+7@<>K6FYxhnF@M+IKZvlYR^qa5(6KpYJtYX!jF?Bk{E1TbQwO&2`){9hy0 z-Wc2B(eEHC{hGv&e#ohHFaq&*qeh_DD8`QI0m60$KyOIC$#K7h@tDN=1;sn(9x6oS z5l+E86kKxmDR|Fn^7ex$+Ugs)e%0{o`JGxomNfrk1e8L9yi|l(7aH;m*j0RI-X7oy z3IrYbc*~PONvx`+KH4YgnUwhZ)bEBqRh5^>5;A9>v}tH%;8#D~c_=fPP3UbFMDTMP z!<8o_&@qqsS=+vnzMc`&W(9uqt})Pv_@FD#NTfoV1$4)Tj+q0j3glB*BSY0>Z!c#8 zOxFQP`@fO^4B>%kN+or&6-L*Wew&uFL=AKPsUz=nXT&O;< zN}X7C3RzRZo!N*Mz0<-P2WC(rQMb53GS0P1@*G0^Yy5tLpa28jzs@lZ$|^rd-G4Do z%0R4yya@m_7W}C=p;iH1A)wcs31k_BN8DLD1=?oNTN{~A)T<#xvyJ=iX{^C#F&GBZ zpUZtYjm~WNnr%bkJ%Oy;8H`MFqj~f%G#D4#%cXyTMB>z-1!O%)5U8^EXU(3@+ac%t zBJqP>)np&3{&93dhwSFKEC^)#f1GO&Xiey&b5VPDbhjut0UwG_8Djlf={BrcG4^Ai-eeDBMb)FtOEncY)7hurTt;)kzXx=+{#<(IQvA-1)S59L`CiiaCb$j$0h(tdW5SZ}!_$Jc|+fV(RD z_VY@HV)thZm$?uRXA166rm;g7F>3)-?so<6B1qbH*= z_ta<1uyrBHsWkMT$I@cuQH`>RuEs7LNGb^IeiY>!i7;F5^xhs@{@d|k%k2YndK*K>=8?zbt~X=Cn_mX?cf5GS*On*`ZV)oca0>3V`; ziPeE=V0-fpOq)h9dCt#GIk2vMBwyx!vI)7f?rAXj3~r=LJrZm4d6(vlx&iRE_uhtl zx!kNhax8um{@CLuPbQc!!=URYnB%uv&r=1*xL~4PDqvyi(v`Ms(+74Q9-V$$l~X-a zW~5{x;FfNQ5-t2@I!s8rt$ZMOzh^2YFPXYcJ;fS_YO! za-KzLk-j7qCuKJEeJ@=nj zn~z$XOdFA2x8xv3pAy!X`kr|s|AKo;tXNhwbqs>KN8@JxJ3D6tdt7bMg+U14_Cd_9 zs-mK|Xs=5mIxz3#l#i0FQo&m98@ojNqiOyTbDkB|4BlJ}KUq|@PL}VPjLaWi!XQ++ zIzF=2VZ{qc=?($DYIi=UExbEh7F3iNkfB&5ri^{_Q{)D=bzD`TZlw^chT1#TmIv9x z2i8{SNU)w$RY?|mxQCn9#1_ujy|5j}`DHc`8(q9UWDCyP8h zSl1iHm6d&7?DYjTBSZ%Q&%V>C<=aB$_J%}Gx&~JJY1@AYbV+`O8+2W%Z zx%nyw!-V%u#pQXj+C*T6YfJKMv)lkDxMsDg?Hf3KQkikAId$=Dz+$^S<^F7=)#_`G zPkCxjSgw|A?(J#W6D1=O+}XMi4z|J<4$?gRD-Dn4j~~**UYznysVhLOm-1C!%$L)a z$6KHGOy3A|HMu=CuTn=%SEQz_bfruVG-QG97b`{!b-Rp)dx_$?_(18Cfo1K2>A zExP^+QGOv3^YJvn+)W1*{3X>`si?{Jr8#OixUQhGbd{7tjCsK0A0M4WYztAcJEznAs<0*e7)7(@fZ~bN^+$vf;65?=On0mVsqX zN>`L$c;=|hzhTdVJrcmcafwDzI$_z(;?@|gFG`EAR^x}dSjsy|3R$X|zm^C?rS%J& z-<59o(oP;W&@LPq{c{2w4p1ucGr&y6(cOJ^asT)aoec1%&C>hu?%lil3@@@2U))q6 z&R-3B!^|ahR@jZZEzG_iLM<{#wa({IzZ^!KI;&biAbbmivE|KF$^C!V_F#VG1(zoZ z@a%g!+Vgkq2h6Lg?-d7XKFz$krIOj_-r^~0H1kUq^LIXV4b1(0#-jZhN1DldTBl!- zKYk)NQ@VANO7<8A|MAX)8kIQ?D9)fv|G5xuyJB0XcEcDc|9KP&9F$v?3g!iYpGUuwq^y~x<%G9+V56-$H`#lQXqOqBFs%4F zyXW}G%yfT7jl0T8)lAp^S=X_u<*7#A>=4$w(m5M9>TPX+u@ci?7d3AiIMQ<*#)Ho? zAj%Oe+8@CU2bYsJbSZyuDyu;OiS~**$9|Vx#16~Q4YKK>gU%{Fr zUBI#cbof!>0VM6My%D8k7L7R$WB#uLmEkF?zcNTp0ZTph1NPb0J8Cz)702ESl~D7RM9g(k%jX#ywKm>y~p&evWQf9hRv=46Uk3t zWcXvRc+{Lug;kdAZJGhQ!yLydy79xQ*NQ!R!2N~=6QMkrl1KTW!Sqg0&vF6m3jK4P z&^Pw!y`OZ<8c*!N)7}65QqN)pif&mJ7oXR-a>?hRtL*R&C&akBBh(y zI^BN!>?u(J%QF!QuIX`pn`iPS_Kfq+%T))aGv6x1P2@!tM{go&{j7VwLna=@@XayK&qKeJR5c7F;4OBhOc%nz|YTnlVWlmg61q+yozt^0v;+V=X|bt z*Th=*sR>=i14wNKRy+V4B0Gl#e(dhByVtnqa&zZp*PJcNIhWrm*PMq{DO7VSfSbKl zTY*<{2Ja2K7WJ(93mEZghqe??E1tMF-?D>?Yrz6O+idNO1o`jQCAe<-7Ci)VEY;?~ z<8;`*qlUU&+3_*K>*r z3fg4Mu~gP!DIPz})jX3PN7gd{DOfTNHBZ+Ml;(!bwffH%+FPyt0u#m`Niz>T40lw& zwDDGsS_*8al?Yg9w6`L+-Z19MH~Bk?;%T;4H=Uz4u{aQX46{C`xQIf5X3zfleA&e+ z)P6u5VO z+V9C!T|GY(ZvS+eC8p#aG4TL(-Ul<3$6PsFP~RF#(GSHfS{xst&5aGt%6mxvja?dF z(O>y-IYjlzm0!nHzF}`ql`D%AbQ=`L0RyuB+v%!-qKMqg*`IQaK1n6sFsF@RfBE|s z_tvR+nJt8#6cLM=qg>v?P&@0?dAw91C!p0gG?AoEiC@lXwZ5gXQ$S>-1N?Gt3AwhH z%9<}NPEJl1j!htJB`lH}GmR`%H;xWzm`YU?t2sMqXp^KLkgKUD!{|=@7SgJn<=$RI zk;NE91#k@Yix%gdjc6o@=GkKesvXQn7n#!!-Dzpo9_&+RQM?eCk)02DY@mOsB9_I4 zyzoTD=Tn*5@xG4M35_HQEUsF)a%`T()8q}6B}i`5cq~g!0PJ0=<~EO-?#OufEgTZ|mXYCQnyYuNBDS?K#Xr!0!zHamTlnXr#ANYu6A(svZ$+#Lpg%TW zQWObhAQD0!SV4brKnU65w(=5MFr6j1^M_!ycyd@%r6TADfm6QMw1<_pSm|Ky4tg-4 z6#OsjXW`k7;aSUHTg*R$FWXa-S2I`{R9c=ax7y43hT63|mQZfQTKzp~CTuWv-e39C z(w2tt)@m#dT3#u|0?)RW{}}CR^G@#&avOCzuv}Zx6QYaf9q;3q$Ohe&X!6e~>=oTs zl(aiat5fvs})8;1(R2ts9tn7^p{_V@Sw&T@(=Z zr{|q3vgpm+%;LwNkGaC{k=({%Uum+viD=laPKh~BwsM#pG9zCq_@*uDcpi{gWl^*! zv5v7ALqE@x2c|_`Tn&m}KI#Jo=-%s6IjHb#nzcnSnjtul-`-*Aoq=oYi|uQk_v)nSoINxLbK6mXd^e2PkYKG; z#!%q{g<2uYM5lqOpB4Rr=KZ=APXx`eU9#9I?v@VkPjF%?u9>bU>w* ze&G1F=E)>I1|&LbTik%*f$8~qQvx6UP!j)^Sa>xYCfAMbBAG|)ais{E2Aj%-f_Q>k(L1(@`NM*k-tq>21?lt)6UF0(A?_=~ zPf0dgX{A6soawyjRiQaNvnSsx#Thvou<@;GKqS}De69QP1$V9Q4c$r8FP|_XJbsdI z%D(^lsK<_c1~>t>3XOT2GyNPg9fUf3#sAeFsQ_5eN7*X}TAOJvpfymX)|q=(54d6* zK^}hyhh-JKb>2o31EP__!LH86hMDn;R^TkECz} zBB|nx!V49%c~4(grj+D zZ!S|W{$i!c4{j+Z@iXqxEbt*7Zf->!KknP7Jy5v&w~9*N)(CRt60l#L!=m%xJ-+Vl zjF*fv@YZ*XZ1^PGKALtzKiSs=x`c>BkUIz|-UMGzq0hv##KH0OxTAwfyIaO$E^BoT zsr96q-UIY)b+9%VHDcr#`gsV|{-%BaR40XZT$Q! z-X{5kZVs?Xf;AF7^>!Tv2=4nv*fr6?l>hrM*@c9z=?aZ)BCbF>g$X83J4S0!s?7Ms zNstNd5Vga0Hp8mMGWQSBo|V0_LQ1NttA7hkC$J#VIvbDZBvV6Uvwrs@Gk2?)b#U*U zl$u(=&++&h+YvU+z(&EOe_<*JMm&qK=h&sTzGc8gKIS5iADA9h`K~K~ehQk)ilm?a zWp}34_Vs+laIxfhQA<6z7@{>dK1f~rT5)euTy8GYTj%b}t}P7`U^$qCPZJ0`;=eQs7^c*L5WD8<_ywa04^tlsypGn-});O&Pr($(L zr>FvoiU$jTBr3AL)R6ZK2(UUD-&$`6Ji0|xPk;Y}@8w-&@1MXXZM+JYv2br}KGT@@ zC#mfMlRkT65nx4kS#QEK8*WapIS`k4N5?2u2admxKD_Y0at{(LXe|?O`hYgx96JEK zE_$Gla{nFFRN?IWs<-w@tbw{kFm@$_Gw9nNb|W6RBZ7bm54dYJ$z+oq6TIYDNIO%Oyk2bIbAwZE?DL zD>A$h1e!X3`nOzBvU`hyNK7IuEFsEBUaOk;^>ME{GRfIFY?%dG07q!ikDgEg`+!N) zoJ(-%3$0J99hhd>?!lT+Zt{c;BOW#2R^eY(>24!=2L=ew!X^$L=8f-l{Qs#8@UoIy z%g)HiBA%beU5pMEb^={2e8`N*Tbjmrk_n3iT{Vc5%vJTa~woMM4(h(7^g8>sL)2PN$< z-zS7wEFT{yP;19WIbbe6clvR6SJyYFgzhn?z4oi9hiO~4y@=q(PLv>XZQ&1U6yPan zx6F&X!R$o`EPoFRb;@akY)3r3jo>zO>J!P<u-Q^Cq$qBYv6dM;gd1<#ozagDa=tD z156Gyo%M!WK2@ukUPwXH#|>aVEkGf8vrS+Vnc}vKbzc4Xk|W?b z+v})m^|mx`Mvxw?-)1L7K(puQe!<-$)&cxuU&MjOC>hod7Ukb-sDA#M2dRD0d2<0g z!_|xwfK_W}OMp2j6#BKb9WGp=^ngPKYeG~4ON16-8KfuU;|FR+^xsrL84v`^DSl^T zP@#Uf)qSQ>tvFVVuu-f1IwGXdsXO*{Hon(t_aF?|Xu`9raR5)kT(WwI7~>6yZCv~k zNrX-H?E}<=3)~=$VZWDI*NwV5s<IVI{E9Vwk}i2a$k+Z!?d3|A24emeu|i%09C?Z++FRSZRu2 zm?8W`Euep9?nVJW5|ps?vx=>wKd^9QpEco$(=Z0AZEzmL&#yGSwqJ;Yo$BAHuwgVc~_+ci#}) zX92rUK)A(kMX+m%7QeB`i=(I&g1vpVyvmH#sk37K{IqhyHD%Nd4lE?xEjc8yoA4PM zn9kY#=xIUg7~8876lF8nLLUez0!%a7Td~G&B6?=lpr*kjkQs*jx3ic{}J$!oW)kynxQY`zPBviz3QG>*>YQPWXAQOW`@Rq{vpFa8)uP#1o;X z8r>ijDQ-sUPZ|oMHi@9dhJ0?#G|?tVr>*>#O)CP{{H+g66I#dw{2*_X#>_&dGJifp zwIG5GM*|Ai@VN0>%Q(DSBnZH?vKv|>`~%Rtiu9Pbc%kLk33q(IT`AVh_&>wi0y$*DVLSGt83RQ^7(y6WJcl%`eGH$giEhchXjx_ zbPx4x{_y$o|*QbemI42+gVl85FvsuRad5zh^5b&`k-kwoFW}R@286v zIUHQ0Rshc{pegd$M)ArVWAIr-P6?9np4We%Jmq4Ru#T77Taf7VZHH%eiRWh}L9Wb( z8y^q~i@S{ue@gu!paM{~GO&sNq+v?bfJp>=jgQSRVSfl(&9MMvi^h7HggyHIeJPwa zHlE21CJ4?8*2=(PF5A+QcITR*1gzk~x9QUxXfUm%c&kA%1G4Z|%$C$`aRGp+!*DO4 z`i9X_BnI^AXIhUio>wsjf8B~~kR5ovlyjp{fpSh|GeSHUx^>h||Nh51J0xBQvm^WW zOPRlB%vbI7))%V$bH|kKv=p4Y|6pN7T}_i;liq30!~^wlhM?>p2SMB$yOFoRM)>8t zte$H7YoGiZtO^uY`bUIqZPd-k_@u&!KV@Xp@I%Jj5>57+XQkn?9|h9sOwkXBs5##! zrl}y9J^R-8Xxf?$?Fn21d4p5mroU0;W&Hz?_Zu__4>*+cxJ*~U>vsgRz9W~;tzr;7 ztnH3UyeRo}YAJNef!3kO>BMy(SZlVPsryo8kG8NW!DH1c0dEFUyd#k0y7 ziG-JVCD7ardwZskE(GbCkJtKv>^N5V{P?1n5v;xP&dyX3wpH3N`3%=jz-Vlj zQ$No(4?pB#Moq+i-=YNHq}_`Q);HG+1nT&xp1TLQ_+6lv+Gs13pg~vzx$bSKMNOpV5k8C+Kk~9N& z6z;Ly-@?D~xCWo3XICKgc|KeEP%?5k9T>L?^aeEMe;n=s(YE&N8rdRQIvo)AOZ}xD=PLH0i-z|l7=ccK> zx)-N*UYw0@+KxnfQ{SHk8?*FU0&?1%;3Yg4n@)TA>m>Ad~^QFrrm!MQc=`QhK|W~vk%v($0o+}WX3S9wp%kOle}2iu~Y zBjrs>URf9l?>@|IZAfNwj>2}9n|>6l-vNvMk{@{XRQky|-v{&Q^_nY(Lnl&iW_5M7 za$-%(D1vpUR4YK!Dzd>;6zj^=$KdI^e%RmNRWmNVfBvaMp{?!08cR$Hh!_yfQ-vZQ z58rFBmAa+FM;%oioD$K&M(35^dw0SJe8hw-xH5sd`@Xjdru}%zj-F#`w@G>*-V+(_ z3XQTG<2N}Y0jIHpI{o9eAk5vX1jr%5N=-pQxWCfJq{4e9EC0a)7*TdU@KWm>cK+6S z{b@>1y-i2KSz-Ux#l^*wemgef#5ax^xA60mp?r^W9k?4Ww|Kq05r>|Aed&g$Q#(0G zPKh@x?={-GEI1s<_l{QEf%j1rJ z+G?kL9_n4Woj5PO=X`kQPdW0cArHLFqlQ24>HJCKT}dLaGv`M@`eG;}JC1VcB~mP?j8#S;flT85tb zDXDJ;7iL*FV!~8s^DxeFltNMJoMw?#d9yN<;e0eO%dtFf;8L%ov~>Gcg3;=b#A@0+ zOhQ=!zxnNic}6;k@~CaGG*XtjV%wx&h);O~4EaR&+D0B9pjVmczIQo1yy-Eb{LzmR?!s}Kmhh-glJ#%Kkqqx`)_<+) zS{)8-K$j;)3)Y;{FU@xRDAcR5xiEg-x1H&G@GBto5^ilrdi`@FQ{Ow>enE!aR5(a> z6YZUt%&?sm&fuX@J+GX;Eq*`_s>TnneP-FqfNX=Ah@{oqirSoGk7XV_`=u(d!H1ei z{f3rv@Iw%P&MB=afa~WztaiBP4!WXsI5l^hkxmo#pk%j#NUG|KOzy=lH4a46$UIvx zmD4tYMT_kAuP#%#jdM1Xz*>8v)QMSe?NUGKm7>2x@Vv6^rAyCUe?~gj0zw}K_j8K? zJXTbmQ}Ye#dvwPCN4DM^Q64#c~m!!e)0AGMHIySE9{NWZ;ZrSFK*yB3p0TB%r2=2_|!6`?9t{K?B z)G{+$u)91|lH{N^T|nMPn~qQdG2P4qFW)>G+)P6Nt0j;108W(tj|bq^hU)w?1*X5w zGEJ6)m}CJZC>N)TN$y*O{T-KA5l_$cBR;7G<1sFU?XSnPZe%N5Id~iDR;A|aBk4RM z`NywEX%y)pgf+LN7e~*9Gz>=V6OV!eO?LEIj*{Vqvw=*g_Gg;VK|^qKUX>_7_rye8 z(v-2Y+*}U|X*IK}uU0Dnd7<)&M^(2wjnKYP$ZW4S>4>b~-a?jW$@ehnS|Z6?zxZC# zbRIy;)_lz^EtX5(oF_&OFq%O76EK;=F<5eWCqMGdipyXODB;dU|JqX?&T#+OKUgZr zip@6If!u9_Izn#-t)8vjQ8o* zob}2f1tLNlbsLA+bIz@gr$Ni{NM5|>M$3XBv<0|4XbUnmWwJOt`O_~f*cz)d<4@_a zqkHhO#+^YgpKLpPVfp>w)ckq5%^BGA3#B4}wA~!KV95^R9p=4KQTE`@znU%@;%Y_n z6lAI@ENpixs4~5E=!q4VdbO_aC(eLF#SY=S-Ob+PRHHAPKTl)a?0Izk9qHu!>4DA8 zKc!=O)gOU@i733BsT^@VQ&|YBW>@55)WGm%uuev{#su?ijC(XJRX?y83uI1*4oKKf zFh3bucnOavit^%tm+0(=Y!ttef%SgkDEqq5dx`V-sAO?y>s`pgoihvduHk_B{LuB= zllH-DS>cI~tB%LHwe#=UzYIPjyoKH-;_G%@ZPt;|SF4p%*hAmZIq~ zK}l?=wZ0t2Gt73vpsoC8Rfe!ghTI7~H%ulhapawMjnZ(@bbH8;@R;aZDAltYl?(Iu zMFWz2=Dp$trj}ruYY}7@XP($H`5T$j;Sjv=oQ_J&J-`SBv|pOL?xj|m9f#B}D!$TViJgP) zROqbEwkL^+<+GKUuV!L6V)=&#UYAR4#UMdvp@=Z$5sJK49yzCE95R;FmzAo;qAcRn zZxZ#X55vB;O$Dz}*D;LMK? z)AOSG(Q(O$sqJTaztfqjo9&ghP2yc*J=ye@>oD~oAl1Y!D|YT}Pp7I_Vr%PGeY}2- zJ7@l*5ORGa3(Qj{%V231NXQgnvBFsWxRX{kmRqMtk%wOM(ek zGyiFc@MX3;t(WmV@NN6$2HFnN?^7fqJ;p$^F~IO&<_25i`W*B^T@KJcmgUHoWmjJ} zdQqMkzFeBkCG%|C-q&!aZ#60k)wnEh6#Mi}CY!ejX5Nuk5O{|)5R7+Jl5H3PWIR6{ zZ<-^-O%A2K1MXIdwF^k%(ZbfNj=NaL`F^9r$+R2O74aU=74j{wQ9??#Cm3rm%f%6|6q~#e4XlD zpaAgiY?aNToi=J-ep=648Cg3aa(ujvUH|^R)Kkx)+^2*3JR`hGgmyYclIm4GU)*~G zgieC=g*ZUDEjm_Cm`ku8S+x5loRE}JGG1Kt%1j3`MFDYFwJG0q!i*QyN zc_DG4EdKtz8wlRgkYV~*V3S}HY`jdrzL;8f<&@-^&;9+_`RS-_6PSOQukI3|Ryv_I zFkZjvO{kIz{W8s3s*C@*^EM4Y`2xOG1Fr$kXBmjl)ZT(WL0mC+1ZKiZX?Ucju0)_fPzlB{qaZw`%qzO@ZR7`pzzOa-c==0 zP66kUBS$QG5Zo55z(-h(Jl(?hck_Fr>hSJNxS!axBXq}(O#`H&lzipEf$8d{^6De2 zBUY=IQd`fNa{m72Rq3E4!(-e(yR;8au!HoXW|?M*o51uijxb*`+j$sJwjL7GAPh#> z5Aeom_eoe*90pfHA63=k^e9xd5q$+VI!Q@MoTx5(i%SdO_@8LU13Q=6s5AuWgR#+d zi0lfD$g}ik?4jdI%0lng-{MiUm+Cu@$JHB1PK447ML)GiRWD{&@138HAn$5r$FI_l zuHX^M4~_%y%Wefx@{y`sZw>Wo6zE$iUDnweYa-fBw}noBSubR)pwVqOGSUHVf)u=ls`W3)%|&=OWvuJ4L7f zStE?qo1dzebR+0(6F2lFFE!8;tQO#^tq%bmTM=aL_GUBo5Hp|m7E2U z0{7i*32Wa|R4er~RtNRXOcsxo*dxcM9R^^`a{Ei0A$ zgmvdPXr-ro#dom|s1ujL6+HR+7pMM;@1kk#*3V4ITzK@KF z5u`$TnN5phkf-DC=;?VchtpSPJx(AzON$cTc*&~Qc=nn%e7Nsv-c2DIiNxJ>Stwgh zt7wC73(MPNhL?(S)3wZ|&r)6(jxyWr@!Wt>Xo1Wl*`-ifx7^wSNPl#WHKLQ+w{Fxw z(MF7Vk&VVBcNXNk<0Y36qu%#}g?6Kqq$FDzp7kx!tbn*^s1&>zqoDDqgnKw2O2$F~ zGwC|hr?KoIZ@+72>WAHjf&`!O$03~!ihbD3_(Sf?6|QRzAmBgN863hdk>muP4I}Hx zQia1nui4QBYNjCD^!{}5vn$PWmLp8Uw&{kDssBWWp0`FA95>Zf9q8zj4M>Fcu^ZsV zux|PEK2Eg{ieuU{%Q3E_3#^hTl}ob_FHp8{ze(+FuQ~||3Sc1ZG0V#f9G+Lrd4}jf zSq+#tp+6i)nn(j!P4@1~lkO4lUO0;}L&lJRFPe1V$tJHc;Om_W+37p==LOJN;D1Fr zFpS9pzxTDv)+%dJpR5euA3ZkAG{C8#RwByh`h?+CZG@?nRf7<80n$Zm_UoXEr1!Pg z^?WW)XY-?*E+L>qG&mohoQJIQ4K?3qNCIW1+7~o=Wr4bdEoQHs7EB<-t}VsZ65YIJ zs#&U$8Y$jsN4H6p>l9xIGc?^*3=GX8pOe5|G}^ZYIgFzDAtHRqP)=pdYi17TFzm5OZ z!dXRxnrb{eMKEh{}1HsR`tisNUkP`Dl0RLKi)gaVX2*xCuu7WLyiA?ZT=h1^nGTU+w9>;9u#jHfHfwa?DMz=uo< zb;Y1Tit+c6sE{W=?O!ffS&jTM2=9v=8S)%2f{**e%`+{25uK#n2tfnLTIVQz;A2_Q z5usc5@9VybyTj@ko!}wD3jL!1G5a=4jgCPP?9uyqT7_VJ0F$cjEP*Try36j_l?vEy zv6V8ivYmh(g2~3r1^aw*X%P@^tFSLHW~U?Ay^C3b)L9*PyCQPkTeA@GBy)hz?~m+) z4igO3^f;@Hi+Q5a2*FbL=aK82Kc{UVTI`*<&5b0=gNX@V54$iPN!*vW5h6S7x##K+ zD$rD@o%_sSwK?vbq-3f6cVXmBL*qnZE+o>Nfb=mLFIzLSUwZqAh0QN9th?3)WQRUN z*Fd=IkR{m)f+gJhBkeNOt{jIhC~%_hhdiGkD81&j?ca^Uk}})FkcJ7hK)!;w-?4?$ z@Eb8TF*|$vnN&hMaAxi|Wa(si3*gJg&%i7v+yauK1W=M@=b+G^3Y^WDi0e@AN|Mg_ zk(VM1{4ZR>3}~$7<2!-t-fD%L9suQvRY1)xZJpw!5W4=^3m~TgXZ{gCnH9bsNZA$0SCO{ut_XJs-Zp}urbrM<(;H&G`i5-%NDCdL z$pVcdKhT7fd@@VE2YZD^REFlaK=IN%xdr*9Z_D}_CWk{fJLmY;7J(7)C(4ac=z$=; zh?tYt&eVhi?t|##G2H9S7~jfwFXJ_Ts&)Um2}zbnpmg*CeCl3+p+NaT$QQX3p09tb z^tBTL`(Y!P>p2rfqRbnd5yqLZCsext&N?t@)Y0DyTdr%_-&d}VT9>#PA@SsKYCIV; zgs%={>8ylyzrgTEE@6}PpBF=gxYB#%5w0_O&X5owf-g@*o-YNEl=r-JJC$Q@oWFjM ze$%=-DqnJz5An{_V(i56o?v#vaA-#q_V;=WHBJlR<6Tm}4Krid&3wNJ3}#@;;l6&I z>v>3WC_-c##&H!Hhwnf0u&u3(px^E&kdl1qz%mGn{DfKtQ0?dCBx)JlzN>w5!RHk9 zK0Wk4UVAq;-HEBGezFu;y{x~70&4RM3PxBUHi4i>j@^S#CQ(XiMbp_TgvTqa`(}+d z0oc&U^_&?w!3VA&Sy3B$Md&Pc|0I&rI2*vs1b)yk`jmGJFT+80fD8=uf(uP<5PZR4 zhtb5wIVibi&U6cXl<{eFf>eJ&{!H{%MW$izG&?tGCC(6N2kSNfNg}YK=l>&*oS(6d zTS1^U>}^Z(T4<|A5!lCY3G-1uYwvym1m^bfp0I;CN722dCetJl(%lntux?4}B^Zwt!8kxDgtN`Cukgo!6am<%cto`PVQn21X!5{s99 zSadsS6}Cr_-WbACd_+wMuw#)?7&}rwCe1LjJZoDx)W~vqhz}26IQjGjV<;dPMVtv& zVFrb-poBI0FZUa!bRJtlsw9$1;(HbL6(sk;WFwEdM17PE@GZtG!OuZj3Tm8R5&TIs z{5X6bj2@smLuS&}Jr9VW1no(ukqq$N0B0=~bV{Sv-x9>6=uz$z4@7Q<1uv66BDOJL|TJC#8`;iEBvp zv%)p#2b(SI27MS2iwF||%IAOECXRd8wzTeBgM>=t+98Wbi}CSGDda-S5y(tkfhYqm z+sg--ws>JTdGuR)|D=BP2xzafUNFUAGJHkz*^vkNwxHya9YJM}$|A$+$@{hHd(xmz zI8?q)DBfhbw5r=}I2@HI2fvK@eBpx=O+yQ_p|bI|#kPQWp1P2`MFns@kn-_rQhfpL zuXqz3T`^xkQykAXqvK7HGW&899oxf9eAEp`_?U0mW+^L!gBM`6;KDMXV)F!0kCW(B zuqyg2e&VwE;iXkr9YuNt$1Y|n{s12%6z7pdl5D`xibCEY?8wPIk%>w|Fw!**Iy~5v zHUCLY#2Qp@_yE!W{-39n#eSyv{>|1+(5wa67*dsnF*PJo3hY1`Tj)n z!FDA2@9;t}Z)o2Hj-rXZeNJ&{sbya*G{EXX3q2`G# z7)+L*dqoVS&xAvZ1=Sv4yevZx4ERBUGuSNi5GxRLsS^ zlh?-wr89M%hzkVVLVmS$3lOh+@i4HxKYxDmHvnEEReRn?=R{-3g(eUWj=1#w!s#$7yhHWQJ2=}5N}6z%X$C)MSrDNPb>3+v=3#j6U*2Ev%E~k$NGGSFoFB@z%kDL_|i8 zyQvo32h0CCh`{p?e+F#+f;Qk#!H3Lh?F1lqOIx>F&b>PbyCoW8VCMVdl!Q5h79*8s z&SODZYca-OZ+(T+4gi6@mr*geYOY0_DMzN6J2 z+Nv~U+d6vL`1r`C8&}`mmyX!3V^A&s&!9F?XK^%ReNgwTtWHY1&mJ%6nT#oPA@nE0 zcIqR+gtNE+kdt3n_)7Uy6B)W2q-k;QVf@uq`t+JztIVa2EFh_S)`lP08U z@A~UGoal4X@4o91-R`9O&J?93$i9{vDQGKkH_ZjZ?)c@YqUXm*yvL z{^;#h0?9FG0FrbbB;_yo_lGR@`fXt>Eo8|aqFA&Mym>e?fT_q)1DmtPxW*Wxgj!a{ zV@`k>Wo3;)vn1pAw(+^y-z^E~jsq7y8oVuy68#P}P%4|Nw`sXd^`3R=i*Q{Tt_!`V zYh*;|;Uv_)8vq|{hbCnVW@mJMvZos#5c=gj}k3I9T# zBf5E`F%h*mG=$PZYi}Pzzxex<7NA4!{X$_^Euf>~Fr6;w71v91spYLaEVY+#5vTR_ z*G`LANOZ_rsoQ0UemOea^zN5Mq_IA2gR(#w{=Yts6?v+Pn5=9p1Z((TrRo5F`91Sy z(d^?pmar|evbEF0pjXLvNG($B0sodc>nWmMgk?n376BUL%^tGd2D)QPSBPhgnU@Y? zWv9F-%VGyXTKTzTJby2HnycGY)qQFyL}V<^;h+!{s?1z0HOM| z1o(KESa|pNH$56!EaH|4kHz*vIqhz-QHjEZ(bnWFYlXQCCKe!O%0fD)4BfhZj(Dm=fk00Mb(FxO;e4Mt>dK(b>f~+hz#Ve~T z!E+qyB*&Jof{XF3=lSGZdXiY(5lzkoSvMH@-w)Sa{RV^Gk*1w~Cv=#ORYfVvV{R-g z7>v;;P-Rz7N9Qtt(9+gSDNo0SVS7n}Ka-`S`JfbNxY|r(rhlW&O&!!xu&ZVOMPYM=aQ*@G6Y& ztPkBYhL_+9&E>;6%75KZFx&~8BK>~>eE!FV0J(6yvW${Bi{(y%dtYr4`&x>e2eML9 zj{j^}*N|pAHe>0RLIly7!mz5q3CUUBA#~j^y*(FOf<(5I!Vj1N?rYE)HkvK8f1 z+i9tHal~!O_bez{M9m@(X1rZFjSE65pgXdqIydtJ)#PY-?W?bU|>IrTK1tGEmHPSOqUBh$b+ zz{Zk6O{DhJsh;LE`#3F(lf43{fX7rK9A}{0s7IO~%|gZ=03DPU-~ooMv~_`=!1gOI zsq(5Z1zi`9?|WY$ zo<8xU{$fIl-7PwRE#Ux*fFo=#>VSbb4j3UejqwT;mQ9BKnRjkIy_y)G0Du1m*+t9K zKQDHAsGaBI+0*>>YZQNV-G`YH&^`}}x?e~2cK4$P&;_OIg4&gDm?=}?gCFz}Y?Str z8|x{&18W{o6T*FdLf5jWN7|auUvX{DT{?`qww?M)6G40$MK*nGt`v~T*b;B^NW9zX zirX^e!D~Y0dVj_;Log6ZQ~sW+^?ZQdyKsyP2nr^F88x3Db~SOf)5s?gYD*w`?#yK+ zB85z-%Hz|VaZpRXfTS{bq^a%9Z9L~P$l<&PzUi}jCd_OtBK#|^uQQew>%Jw z%?}M0gTfDLyL&np>slqZ)S9fS3a#fctok!DX?-^4jI-3YWg$|GTy{f{4V9=E!g=TC zlXy@u$x!rPld5>IFP5dF*3*`=V%Bdk&DYD!FD{NSgglp4ZP3B7KC7=GO(OwT6XUHR z6=wxyrN=8265g7kZx{%myal@)F5k#Qd_&NG_#Naz#uQo>ycwHw#|5~PkjgG zZfIwtnFh^0*}v}870<`>8PeB~H`T||EEQ}ubTo9S2=@1+o(VVBM_Jqf?#lNB#Sru; z@}Mj`{pjmc9=WdzTLuotnYRWM&S_XLxSp?XGdpW!Rc~Y){y9EHz&6ToY1R1=T)B`YUd}p8<4#B<8rYMhm2Kg08-nv<#agwi3ey$8%HXsO^ zO)>!|0%Kgh+!qLjCi>$WXh0MG7;%+0{B-9V`MJ6OY8@8}Z$M7Wfo-2DI;omt?m|uN|T8nXNH^YhzC-t^4il(j+!Ib;EfO{y(N5VwrFWLaO-6tCuL+d2K`;;DoGX_>RPR^}Bukqv74I}WEq1;nHi9|ZE zGT<^Ur`Z_3&u;u>&_GjL-GOp_!SUnp{H^Lc!u*SUs0&cDu6H8t0>EVfiNv-&V307Q zlS70aEequ?;P%qC!M63;+?(2Nd57*1>P#Yf1S~_?Pbmp71Rk9Ny-D{>8ceCb6R|gu zkqut@Vr*k02r-JeeECC%`FiA$AV+AXda7fE&1tsv`SGRgQDHUMS=w)r8r-O|eL%Wj zl7T!wNp9wW@yrV}G=MQ)`SZOwrKNAcQbuA!@V_2n?7Abtb+L|Hu0Y8>yl>gPeuFR`(nnL;*Xy-2kUhR(lSdZm}Fauqm?V z+{&-iZo^<3HL^SN#vK2g;B2%LT(~-baa*9jzkz0Ydp*rn7N(gH*f1z!pnUDxwbVYF zg?wvUTk{9V$|o6#XnMC?9hq5jl{o6*Qu)Ls<=#ka3@hx6}Sd*li zmtl(36z>q-ou#qigGewKxqn&{SxHgP)s?f*11T9IYgr>;qFKPoTFEvOiNrd5jFj7{ zZwtSw#$k%Riooy8t|Zhp`*GY@6^%X?JO?C$iwhc_Jj)5i6@X}%fi+KvEel$~lPLRY z*9JcL#SAqOd_0@oC=wI@5^!op?4M$4&j-()YO1p!?~R=-n$$6Wv8D`%oWmu#Ll-uJ zzH7G>1NUhgGDM{ZaMbY+dofj$tBQH0#=TEH9D-jQ<}{>YojXvCw)|AihW<6=JpS|8 zJP<7BSpMrAlR5o|==!cOkvXo(Wb`xDvOSoRC_I1ZkYtDKq-YB#!Dac>vUQhNP#p2- z9O0c2d$^a1Br=-fB*{()d4WI7k9m=Op;Ha4a$h-`YS%b4_0y)WH0*H+6kurD@hCP4 zjC*LpO7bS=&#xOHpAfU$_aOtF;vtuB!gl5q65mbLhYaLh>Q^K`ey40`tsV-tn~4i+ z9P%)woF`j+^K!C&z7Q4VV&GVK?hBl>`bJbubpkzHU_tp0A!{}3ir7ty)3=tPKAJlq z70XCj9nDnDTym8{g2*><6H5GwdBUD$h$f^igdS9lm2tX&tTJZc45HTL&gX0(fuq_A zO09KfW~Pn^F60CySjB0qVIJf@)T`J5uYy|`!h0XN+q>1Gw$cZZG4Aw@S!dVCJA(3k#*vT(h%A zzG+A+IyB`%OqF*)t--{nV(%xJ55cLL4aCT4hI&A17Yew55&vZavK5tLVZ|rYD!cJD z&=OzmQP*WgUkzEOn}38bWTX2KLzS5*69#dv^2y|`7{)o3c!mqHPD(Azd%aY~Lw4W# z>4`aep$$K$LH`fw!*pI+9DYH}Xoh_1(sfTj35T8N6S;+@tvhQZn(N#;n@>{+07SKn z(qrPU8mIy4c3}gP42;dVR6fq*&Yh9oxg&>G$J)~!!TbgZ`VM%q_NbJ16B!|5@IU2z zJA3}~#fE?$bZ#-5(THmDQ|zSM{#+8>goW_s%j9xXLGAph8|`JWo&$>+e7`9jRXdnm zy@|tDI_+bbkH^khnd;+*%O`6@SWbddV@Ju%%8FsbK&?ZWf&f&Bp5S|-SnP3q29pcP z42V}Yfh$K?9S6tCh8~!quf`IPu&-|vLnCx`F>e5iz1d)`eD~DR1E;4w3|S?8zA|NS zp1!oQI5U*hNr6cz@-VzhK5|5kGFTlrfeVH-p}FW#PwVI7Q9Jg$j4j+E0Gt^z;05BZ z*FZq19^2v!clsqb=CE^nwQ7g@ZF}R@VRhk}_CVFEa1{6ip|MbuJlU*DQR}=UpXXYW zIB)91IjF31WB0iYBMDtq>80W|_9}v+!@ymfwGfZ&zO>N^bwQ67dUv0(adUx@?$HWzn_bP5z#n7d~l<+Tg|Wfp;x=eo>^&Kf6R zz=MT^0Q`RAH=?D|TEy6b)*YvvTB(|VzpFx#>au*oQ?lwp4DvdRod~ip*eV&H)!w;f zIPNT9ZoYn-zN5KcXtNiua;5AMtkhkueL%kN9@mD6N0($y`=pM-wrW4F;)6{Fbk;*H7+uJplMwswI|o#}NV z{v0`by?g;9~NH~@roN(p)`fdoCkfqf2N?fZfA|MH1du95$~(O zG%xxC{>asKbZBd%aN9?t6C8e))(U8uMr zu;J@coF{!m^SHl6RyjZp!FP;6@XOMk+upl(`{yWpqRk-kiNpfEOlYwa4s=JDhFm$NT)*wN3!Ww(3ab?2t2~Emw&#RG z>^x&XSV!EVo;YlPxIe)Bso8D`dV~r_p3L0d;BC0zV#QUpuIR=(EAHibU@#%Kdg;XcMfyS#*}4B;#vr4P0+D)> z#3&w&(>j*WRRS&Uhr~iQ;Aw8JT@s}DgC}&tOXVZ%F=@yDkqv`u_TUMcWIr8G7t7TRYscA^J z*8Mep*rjs8C5sEbQ-QuF;m1t`?}m8gE%Bu)s(*;_hUvHh4zRSx{6tZah^%ZjH#+IY zm)2DdyBRgYlwup_dFRft?NQqiW7JM2-2u6P95`cg}+a85t1L%?R z$9888D{juvPQU0QD6_Y{34M!i%Q_K+ePDW87;%u{_=_n7BR@mZjUM@t@yq&=`)Qry z-JiZbVOn^P&JFfA%{9e}u{@Xo&FN@o_pNn)`sb&%d*XS{@SEZt_RR6o@2m7&`rgVMx{x4QvUM45 zcz&})Uj^peqpMr@|Go#x>z|4A^g+L9cC?lMy3Cm~$qC5#_Smbk?QduvJbxGd5BxD| zswb?4GGuG;zzXuCMl#5)`2$kQHe_r!0KXQ2L$MMfmhBZM(fjlt$~t}+jn{*IpUQx% zIBxLuP|13hqO%=4SLqYDbqT6Wj3V$ioX+V)a4oQxo>`7Gnu#9d;Bc(qS|~yvg8jWU zEcRzhf}$j{kPA`z+Y#y{-N2iGt&2>ovXYWx7J*|nOvhs*BU=%FQ|V=j0_Q@;jNDh} zGB0A~mfKWUb7YZ*{rir#z4pYRz`uGz3z8~;F*d1|w$kJ$L;!=EiwekvUqZsEa3y`C zqWoiNzdB}sJ-~0rsfB~TH~ts)xf!Fv_I0Oj1U)d}U$C=x|EE)!Ush(d2eAV+j-`d2 ziENzkhLaVpVh9smTm-tm(&vpBo0qKQ+3hDVcJ|2UJ-F6-_cVgmInrar+Fl#`I6AhW z=B}JuqIwH_Cib)F7XNtJ)kW^@;k6sw)EZ@&0q_JI8_T*wc=JZVbz)tT92~ab*L(F? z7U+qOR#G>kF`w&u5#i&v=-~#462cA7Km4~twz8<+LGrhIpyK~zY9l&U=;H#AAntiR%$5b3=XCh4e%;vhS7joCb{7CmRT04B5;PLMiWD8} zK@711P!syRu)!>#JFOz7+izA$a5JFF5JfN*hS_1I=E{J@wHuH!FprZ^MWCMg@^Re| zk;Lj1eAk?i4vEJ_QsZx!NliZzPrp&d%?oZBJ*!~hqshFu+q4pZ}&H)!x zW1MLMH1PY(jD6wC%2I3228`VZqIu<(kbry-;OTkTrQY5s2+7l~fueOyvmZd#|B!k} z&}{k>G^G9(YfDCKGq|veU=QT~1vY{D(natu>ZSjZhA#=5!L9;xdT!^-8|m#Cl4!h( z_M-%pM|KwCA}Uas%K}pEtV+Dd&Jf}L`lC6oyxfym!mApyW42<6u)H{9inE4#An641 z4Czp9*qW00GgAsc7uUUJn`PH-d(8m!Q0aC0%e+d@8ihi+$6if&?xZqK#*HR;A|RCy zx%4TCoqR6K>K;ce8$KI%_Gxns**>_&&6^IBm5?F_EaBMT;9&P3ARx@gLy#CT?Rs91 zLY%8Ym)XzbS~uh|y$hbV1L6S!9!=mZrokfA*jUCi9drlWVjwp}m1XJ_wKAH|wIG(O zOsNCD2}?c@D=iRr@H|-usKXH4Up`$}893lPi?isI*FO_m;-c~O=N1}tlC3gP0 z?_I)#5r_E%4g%Rp%PSi&`j6Y&+h-vVR*6JV8j$b-^)hZl4zYonz!$cfQJn8KICxV$ z6MtWE(vFjYl9RI6I7k)`i17?OipNOj$*1QXUIgIm`9EoIuKMC6G9ePx(HZI;Lhrl?={2~zy{seaaFMZi6bV1 z8xWeP^H|bIYx$JC*zYEp;dF02E+m%x%-4>0n1hUv7qU$Gw0UGter2zH!^oj{jQBfr zW!{90>r7lAxNeY6v#%rFzU5FYUcfK zNVi5AiWQ0%U@{HHY9@)V`j$x#C2^Qm$3qE99b@fM!>=M?EK9$=p zic!wL%llq-aU;Wi#=O|-$`C@smI2d9KkYVXz5J``#?N2^p~$wyzl9~**sW?Pde$n# zH6z+Vr`%BTJZWXM8lN-+tN0v1bnQ|Xf+4DwP+x%-l&6jon}{H-0}3af+#o&Z_70d_ z5}rC5fFbGD?z3LH+C%wRz9i>H9~&5!NVXPTi#FGi<1&-2Z6{P4yFN;9miz_yMo-{} zl`EAs0U+ZG<&;1>*UGEQ`Oz>%_6T4ICuIfXjVEWqvI5Ygncay*vuT$p%}$QHC&S;P zD&s4?Gobym>ba@bOT}ln0%U~jdjHA3@1?hCww&~Etc6g$tus7P$BkU>b&`{yTPtbN z*+t;6nvsksByGnC?^5%ETDUTk6BD!fz+O&LNcd+H)gVINW~`4`D#a~FCfsT0tCS0c z^f52=_P4kx-NV1Y-gK#G@=tD7*C%Auw=(5&9=$A`_1(>YBoQX~8z0x*In3du*bE9^#`LbF`2; z5ZeR2eA7`Va4o>t_R&2!F;YZVowQk3csNKY8(Tu1gM!9%n$s>ZV(j)JQM&)X&P1!V z*_1OZg3HI4KLsSL$4w=#I=eszWDVzm51j?3)`J<8fd+xPP4)O+za0Ntz8eT*&6nNU z%S$?))9VeCa!LmG#atHh#1g?>4w9NaC(w@NmRMQ9`IOyFnr37FEZklb*qH$V3OfyX zV^1Vj0$$2BsK=2?Go7g)n1wP-&uBlo8+Z!`5#U*XUqW9Hiswz$5s!Qr&#1Vx$jVXUvZBYSmI1tA6M)2#py)u+B&cB|RL=WHc?pZGCVc5UVK(>SNfhYL_<<~8G%rk&QH2h`QhpMj7_jdO(=G>EkDPCN`mf`bIaVj{-Jl z3isnWw{kPy94*0B>c3*xiTA5z%AI2I4mPdh(txtqhuTYoKFKftMl$oWxujfQM1NXY z3ifqP7Lq*jJVv&^p|nQ9EdzqUW8Jmh=a(h2TNsx}oSijVe{>E6DJs0kh3h&8QUVeY zQ=fW8+(l#UHfao>6fos`zf3-QWID?G5NA~7-FTrWIu3T!Cj<+5*qLMaD3$c{XI^1h zPR>7@oSU~ZDjJt)j7mPNKun}&rU`*3af&B=dZP&;GUtT8a8TH5#Z?l<61r3-JXWKk zopzn0XzsWRYbicv8Z<}R|7GZhboLRiM(sg zOYkry&qyC+diw0pP7L;t$;9rTeWV(GrX9f;>qqWGcu%n@ZYYef2Y--QDS=sd<8 zunCWku_zsIaXs;nU#&tU?Uce(^B2b8JQ03tJ_+`{NADJB%|r|mc9Ic>u5N%0nD)hY z*?49Z_ce*f6CLTpx9n%^Ju3hWlPd!fjUJD6WjEOyXbrfwdF{hb5vtajg41!If(I#! zmBk7w1%au-i8Z$Gc|#rBw-BRcrQ8agBmkMzq!MctH|kWFO@~5#Ky<<86fMtV`)a9>f)?$@p`3}NPHZFJr23?JjkB1Mabkdt{phSx8Zmv z6V41l)nVI*B0z}JFNHJhAT-zBvH8ZJY^iTBL(m%VYKEO2)pK|CF@@D9m@E}vdJkxD z=6FRbUn)2-!25tm@SXNLpmtDUq`zGZz1@8HOET~KQki42m0-)*`5o-=uqK9Et zHbAck*OEqEvV;h9ck7Ek>V80SHy^LYj^{2PhnKFqvAU$JbY$K%$R>rg2@Qg&Y~kj1 z7D?w6K>QvmDH?TRpNX* z<@tUEj%m|OX2X>%;QHv_^7pknF?zX-V*eMnk)X*D3E&h*c zLwz=;6Utk^_S{5-^Tg$GQDA#L`EicWwMShf!99E-*hPqiZ_c{Fxxazi6BSvdDv+U! zR<^QK!^eAOd-U4guy-lc9tQ+rJ-JS)?33` z_wNaL?3I=6=(N!H}b&p4Y8J!z^i!&qN;oCRo_1YQQU4-x7$2`oTSB={3ThLB5{mbX#%5hLGDv}uCj-22bh%$+=V)J+NLA~go(+q|zC;!DG{TGJu zaP%PdlEGLd_;R;z5h09W;Chp3PxF=r=!Kdmt6g1%yc;{GMkS=W4@kJBA@$_tg+mRnb6+1`xaEa_%1)04 z0e4r8xxSZy`dGBZNWSToE>;|7ltRin%*1tuN~Uw z!(Zw&-hqv6Ub8=;baB9)s`_q22LG>;aU{x+Y>5I8c60H|t^i+e*|G)6$PfcN4-Tlf z1Q_ce1j;&7dugF(P@BV+wq^GMh_oZg}WAni)y>YZgMrUO$c<|Jfo{9-;KOm%b9j`GqKS&wLXutU;7(qmZagYSmZ16kH|9Anfd_7+jZwOe<-$*%0!n~$C}f<~~oz!mu8N551= zE$}3HrENi1;+gWN&Xh>-ymjX3*(IvT%M&{v$+eGki|F8ELSC9{+DqQO_qJ(lfP)=` zrMULGH@}%!E^`PW?!9j+_zeys|FQ9|s^8-g{Jq&v6($@ed@}Z~?Yci@^3j%`($Q=y z)I<=ba14s(WPf_nOD9~&+TJyo>(d!M=W)jSMyP*ir;>CmH=7eJrmS6~a(Gs*?{9A~?vIo)()CfGG?FL8fX8^F*ohC9ip7SGi1~1UnEHVYQ11aalD}a>Fb<0Gabt0HWeON z-osb*z%OiNz@$s|z2m;M;?uu;nU$6zY>+GvrxXZuq7r|Noqnr#Z&l-BzjqZo3Aj=6)tKv5gy0!D@2HkkaW^#<>0g8P!?nllcbQa?dIBB7 zxNNHnH=jLIa|9*w1C?Lj2M#->nGm@u_E)QYyv#<4tWm>TZp}2vd>jIAhWA>zpo}h$ zcO80k4zaY?B0)qHoCN3)9Di;*#MWr#;feos@w-Tg#IKY~KOdDxTw>d+e$K(rWY3rz z$&pC%8+534lc`<^I6UjUtbA1P$$Qg>Rvd~G1h)XPqv3l>M*TSc8Kp^eIfx>t!ZtOb zG2!8jTb^^8>6JIy$Lr|d^qFAd>;275J14d!mS@*S;i;VJV((6;n!VLt&%HuM@^NrH z>%2U<{1)d@D{-j5nXC19y1e0R#8AbG6uzk|9e44OBwnDZ@zyU7_CS;u4)k+7X*i;U zmy9mWY)@L;ZhyVHIcCA}=at=Lj;j1ElxjA=0-ZG%G6SMw7o`CwPnW4gBHa`OJb^6aNk@_b1Bk61o##HeKKRJ(N#9(6U$W zp7XW3_N0WiJ0~0N@U>dMxn8in)rG)}7P$Y4u@$ zQLdfMTOIq)k~R!fdnr0t*)v?65e>AlY7;oaqv&UwQ&(h(tA5g}i`Sf}E4h}kl6CQP z{kT}R%kRPhK_3@;{-R9zrwW6E=C8IGewBPe-nE@h&U)s>kHHh!PDPVN<(aJSOGEC5 zkjfqO=J7(~QGr(MxJGN7gH~VR7ncOsQDPBnN;@~-JM)%ke$=}}z1(!VJa9(JrNVSt z^68NYU@3G9Wtm0$NOAR4d6C8Ewx34kYruZzX1{mc_jrI-67}O%k_8c<9$rZLWk$}V zAgvgc)7ea7`#f}Pwugn2{mjJTUw!&jG)H+^ByhjH#YbbmnGn~-slo@$_LXiIZQF^U=QiiLhpVr39*I2W3 z46Y6ep1C73TDJJ6b~nq9L3955OhKk0LjslAuAGbp?C7^mmG;>%ALrWTuh9ec?8N?T9ESoD}~@VQB2gMMj(Lk}Uf-4v^*zCURbbn&7N0-#oCAhZj2>?%`?Xua&IF9VM?+;Zy;r zdkhAf@zDOr%i(7!C+2V7bBsO{@wT^D(n`;*B*#rHP$`yAl<%GLMWCMws^#AVFD9<7}_$#vizrdsEy~$%Zv&!^dBi2ftoe z{OQkS)5rM!>>%#nw72ez2RAJ0ki90n{6LhFHg7EEqJ{spd17T&0sT(3ws^w>nMdaL zp>60}7=9O9HP81u;fanr#{XKCq_DsJ)G^gl>7 zV_mrT*0?koJXl|%k(u1aoFR7?DWl1;W}Cl;&-FD%s#Gsa$jTZO-&zsjv`>)tP0kRA z`BWg7MOs_I%O;uf5Z5CwRv`i8&QBuFn`~_s>U`Q* zk=x->LwX0dOSmuP6mC04^-fQgliJCV4~cG0try2ZjlxdbVQfGP8%__KEH8pR4-1%7 z2<<3uKOjQdIU;44?N6skr;^mdlB4}i7MBI-Nb(`cUBdb{f`(8EmE|YVhca$d2XX08 zh-D3j$gY05@N4A6FZ(PoJ!9OOTyzOU8Tha+`X0y3z}*^3HBrZG9QV%2NyW=NjqTLU zu;sveaemap#K9g({ospNrbdB%c||!xkd);pFww2AwVqyrtepGy_P5aW(yM+k@3TsZ zO`OQ%*t`bOu#d`_)kDuHy&W$+!)t!YH)p~Kqh4_mnq{-4T0CEy;FwN@ocJ}ugOi9c z`9`V48MqBDWtH9TPUG6~K;=rNctLSe&22*Y+q0|eAw*3=?p+SU{H>Dn`$Jada>Qp|k2sWOM?4MN z@+ra1%`kxoIMOObDtxAI1h2UdUu%ZYWAA%Y=$J00vzKSl+&e~_A zr7k(xDDh^uTcWBnlVxXq(c|LueaUyi+3gxys|jpaLH~MFpONcsORn6m6~AW$-FLV> zJ=f3vlTf}S!Dhn+rciT!wytvJNWoLt+MIr#4fEA=u3uBf`GI9;`2C)^0R8km%RuY$ zj_R5H;}7LOYP)3KiMddj<<`eiTYNc4b46yTxBc+=iH}PE4Rc4#$L-fZ7D4Hm9tf%J zb|j|BxxGoM1KTBc>j(;WOR=&lnmX3r@CvFRN^_AY}T*A zrYBS*`2r@ZYr5rEhPc)iSMhhh2QA%O8d3{Hz0dYdJw{4b zW1X@v?`;aI#SO;;=wecY0_c+YMAYv0pUu81lEPdok^L)xkhJJ>%kbMy%yp39He>8O zjUzIk277lRt1>)1T%!kK(V^Z|v5*XY6WPi!(ZqLzSfACiR+j}-I6};N?p_W~`k{aN zBuiv)1Kn@3`0jAO-y=Nzz&9AGX|`7y+1xGB?<#0(DJXuiS!36yTDNA&!ZJQM4y#tw zyMG^)ttHJE3=eYD#~K+1>XHK$X1Z=Hk#%pMV!>pj6?P3<^<_l%zYO7RO6H&sa0tYE zgVL<0?CZ1-Gw})((_Zy@WmU9jGbk1Kp@2a&_2T-WMT?NXcZ5bbb$k=uW#Rnw1kvvh-Lx857ad)yibNL@h|AxHcPQU4Pw!Anm^7#+2Lydua%k9%zhSdlq1?|e zWhG52IL<}jpIN?ddK!~qYMo=zSt@U9vX?GXp68OnBom%#JTF7?cK6`9KvR9k!8;i( zUY4TkbKOHDd-x`PNe(eGG*q$f>FZNo1+RQ~cDC&Ts2=Q^e8L2P7`dtPT6Di$W!^kX zXA3qxqONqmzR&5DYkSVi1)rXoS0TK%o`(7VlwMup;B;4!R$3c+3--a|`WoOp@s zE5*gkc}W?yg^OQ_??f;wS8?MyeAwqWi#g9JV&^O>R;|??e3w6; z-C!v!)>YVUoFyHY9du;`Q5Trr9#<(9C_8ArxqgUc6KL!I0{R&3--*Z29}UQC_5+X< zwXwdRZu~erwfG19#-y9mGN4>KCY|%Ju3B;BEq9NC$M)BgIv&wvYdbrtot(>}m3Tr^ zC!89Q zJXG$q@QtFL#tlPS4~P(bd#=F!;IH3k(9&?ep5_e68y%i>KKELQN2BLlw90qFLMY^J z<{*zkFJtA3d?>yGm*#;Tn|0&LEhRyVcFz(a2NpTLsF!ggViX9s0-z`!w!5QybaXW6 z1rh_!9e^AjMrb^cQjnGu+BrV=u5_?v%W+pp^q7T2Lu7iW*q1vA&dGk z1ih1sb2J~-L7Z5pgfcvQw2W^5`dyg!>lyW5Kw}OsE=n9g%w1TDr0^mj79(Z|^18{bK1o|MiT(n zm?Qjv>Z5C5*4m)Vi-Il4uY4P6%a0Y^_h7~>Pxrv_Y+(Eh=>N6)g|t*|tmvu#u>`6r zD!Fn?{rxf3e>g|J0yEzsdhmK1f}IyZ2#Q^InV$2V zQrnA()1$A6Y&5$QR}PeVr!XXOo_5_s8ku5@6O?&E*=3;(7^Zh!20YT7w?RKJ-8lXK zC;*tAaoXp0sr>)nElMRv8gDny*FOprue2R6&#(pY+X?;`nZh)$e=su~#=1HyfXsxg z3mlk@f6Z|7=WEn+`~5-U=n(WIKvq@Ry#h4^{tMwtiP8l9-UGlvhJjuh_Wuxd*Cd*S zEZ*fR)sz$p9$?{pkL1=X%M@>QC{jSputVlXN`q#qVa)>GyVBS5hSs$eo>mTp36%VA z`i!X?8_NT2y{|#&i*MryV5J9w6#j~z%hkL?rr5Olc2h3mcWuPnE0}SOQs!NQko3qr zL{5&;{7l-KETTo6y7(Zk^9TlWGaa@F&s)}0HffXlXPGfCE8bH#I#^>C>Pdfi4 z$(Ud6w}7Y&S4RU(-^XD{SAE>+s;q0|K4j!XZErw=1ikb!pfKBhhAq&RGg_lqMVcSh!+S13OU;!uBN$Ayd>TLYf$ z8E=)=ws;JNJsC$Ze?UYH4KL+%L%n05-%tm(ld(qF#Sy68$h-;DbsVbw!|8G! zc1X+J+jGHx?U3o~=<~0>-1rlNY0hM}6pyT1T5=nihoebZ7%_9vXc+ovS7CHF9Yg%> zcLDF)B$=F{6V=V^&TI1v3!y;SQbG@8pln1b3;$6N7#(VrnPbo~9oFszR8+tHlc?oi zGK5sS&D#PND=Tc0osLkn1U(bLc+yqgQ-B6c(f49cp;{Ts*JfG3uZbKB%A+eYwOpaF zG`BU*F3iuzOh}lhyL+0+oH)(nw*kX{(|cniZB;TjpZ!2EqZrcKxs8vC&vN^|*@!xo z7%|rOp6JKd55Fb$LKH8r78n;Qk(N<`W@Uqf){S)5PzD`fWB8};>h0fAw9w*#=n8<$OeO) z5Gf@ng()`ohM{OXB=a=vxiym_4V0kd!bFQVD-dPq-f2C^^B>m|6N37RI;jjdwUkdb z@BcI+a%V*_;1;nDMlL4{vKCXKRQm6p{udVK?{#zKLv_S^OW40iVSHOJ zW%`e%^{$WdP14Nib4)heRgx<#%)sIJ&Cl5GNN{M|5F90K zZX@!(=Hlg5@o#ewPT+InK*vuw>%}0AnX$gXSL4cclY%*+Bk>eF#pZkKq~60TOCevenr^r7MTX6 zt`-P{l@g{^;Qdv?av2WtoUzx4ghs;klZcQF=vRQvNV_t=qYhMtAGp-YTs~Jt5~UE~ zSZETZ3w=GZuCw z{s101?J}nB1?x-GmM$&}S7c7g@P0JLU|dAlf^tXy4_jXz57qzuKb30UQPP6SQdCN^ z6xqg-LaQia-z6ej_FYBFHocRm>?*Qm%}$C5St3i;GRDYmEQ7K9&K>nJ@89El|LDEM zy|4Sa=XKWSd7c5_6{VR8)?#ENv*LIQ}t2U$Hv;x9`#W+XUWx46(OjV{;M8 zJ|gd?xGgQH?!w21A*1slu zAY~HFT@4T48^nbAo?Te@0?W4wO$^LbVCIH)Ivqp9YnwK0qEkOZTF8sZ;~(?)vosf> z0hFWtMh)eA3!y}T&JUnISvBsPoU~(=C?5&{ZT9!dr5WQU`-Ena;^tf)jx8v=moPIm zO=>`tNDdsA;9HtDlICjI^+dMR52bh`yt6A-rxNb8@3l!ZX(R*uBZ}f4}By zLnD)LOmlu%k@WVhUj>kJA|M9~i(^m#{uST_Q`w;kh``R7=>&F2X>B_K?KJ&9b|D;{ zakbFex1XCkGfhPngNcGTA^Xh#o`UM34HzG?7(+i$7M9sKj6xNngK)vYuYpVhI}WW1 zb)5wP>p$*(5AoQWzVUn!lag{DYy?6vgxN9bJ>c2Lp%(}VU_O;W$O41Nf32(w($Mj> zWl3L4wz_po$zKh1FbCj8)z#I_P;KO=$a&5Sr>byS(>>`i?MYKS9Zt_JiE3--4#9oj zym=VdF|fU-mlj7dwO`%4w}H-anxWzL;!Z>z;oyp8VcO(7GWPT5!K+uUyasxdHvqNZ zp2I(|N|18PrCS@8wl>X2aqT~U8ja0;(|}zo=sg3)`{4oL`bh3B2QYu$zWw{N*TWI{ zYqV@dQ8f^VT(-s@-|9PZf=lqUtZWQeJ)aJ7*lBO-m^gFX`g1a9ZB%hqz*yU!qQPaI za1y#+fx7i(YYogB#ulyurVvlJ0~xfjk#VWt-yQ3`r09T(bNMV&5iRY4z-7EU*qEbX zCiMjvP(c?*6d)50QN9_w_I?2)e_$MOkAS}};{`~z=$SLmf#duC+UtzOSR_T)bal&? zE!mdD5Cv0^(Tdq!;dsKtDhyO(ruLr|g<*+6hE<6K)Tr$+5LX*U-O7Nz_7Fx5xzU8otJ|4lz!%=!*4s$SCfTF%_T~VSCS0nDSVjel+-Miz!rWc1-bRxUH{|XH#{HbA} z!px1yWG}G7f36BAKt#d67pbXpg&bS}m`_eSyqmmj5aQp0^q!zJ*4Gz8I~WS}a{s=4 z7olpX>AVC-ny{MB(tpSe_E&|;F?rthDQaBOw{E@xUYh+U7n9(c`pDyvU|roPSV>%A z=0r8U0>N6U_kn&W;tFyG%F4zK$%qclV`5@@ot2e!LfRW6kr`IK2~|J>91`;&7nAP@ zfe-QZ9aBqm3R7OgO^_4%-ZfDkVU5FeAuC(Enj)b|LcTpn_;+RHeScpoft2t~?Jdxo zvGsC=SV<#pcmO_8%plX>pGT?w;oNQ#Ng&SysWn0jKwN?39{`^Jdu&u&u05yy+7N?U z^b&w^z{3SXt{KP*z6I7*y13bwl{VG}I#=EyG9@AsPZt?fY(`X_djqIjLYJW?HjD*EtG{%ow~m77;FKUabTyoLFbppUH#LxC+I&s z@V~u5X`X|b!*KnqjMj+8B&)2u=yvvhf8h!!0MHpg4TPq1(CtM2{{4CQ`!%XmWx5Cc zy#Hs5a>MB#7_GSWz&LC5^*9+dgrOZB6pHkgZX@MM*Vp0~3AQyf;M%&SUahssRJ@>H zZxiRA_2~TP78KRBTO?m~qP-~X7QW+u__I~(mX=EBm#2T>&wi-0?16oRg8#ejO!_66 z|KW17IF=IDSLl#*O0~DI?>|4m_UDQ7XJKCuL+nJ3k3U4Gotu8GMWVi@fKP$HrP&yG zSeDPNTh%nTBdP_m-E$KYZYiJm&2tOmC2oGI#Z5@i&gO&wYXI7R7 z{RW@&&ZY&&P1J-_3xF;BQ_GZc3{*ey%uYi`+h=!B?{_g6~kcCFHr-j8A zI+s#!)0)7`<2t&!E}NQ~{)UdpHFc8C%zASB($R8O1Iz|2~ZYwmZCjpTbY#Es3 zNGu;WJNx@}bBt>LL%Hvml`JKD`ZVH*TrY%2FvLK z{1y;T19l4Nj?7zY=-=hbpS|Q9hrLV(34osNht>$k=i1vCt=}~24_OQ+BACdw($%p@ao0v6i{4bY``}hCzeI&yFd~;*OGX@+m^gN|?Ls#lcc=~@_8z5m+`phMPDkf)N1nZGjAH+ov+45|YtdC#3Yhp;gLkI~Be@-=Be z!VLk(bu)xAr%hD+J_m#xxuvCEJX!!%);Qt!;fDGFp)Iw%@0XD#-<<}m#^lIzesu(M zHHMZAKTpAMmjCS1m8)0H#t^Dox)&qSc-eCWQta9E&5{An{Cl2)4%GCoIZ%Iy|0Rhh za^-gmA0L}9qXPu3ATBv61Z1!7oQAyux}WCGPM!U5{4CbDD%YRpt!EWsF$vn%;6i9T~-$3U&F@A+D!8(5ut#94jTV2f)Zd|_gZ}Ok)}3Ok%r{g zl{%sF+?fT0H%eC!yd8OI;-M+Tkw=ch8JK2%+tyYHj)&G785(Ulg0z}KQ}*=3LZM6Q zg0`*D4z<655!EmZr;hP4SS~&!e8}I&$$1r=Jz(!Rxt)ngiw1~Udmq8CjfgX3(F#>D zl@jRDSP2hK)H1`sq_tZUdmr@I!-%zpe>TTK%cBOuA4oe$eSLkgc`ssO^67Mv-Zn&q z_&z@`Hi5Qflkr-dxm3MtZ*$PSIVkeK1z$7?hRy*2!x274-^(zW>V=Y$5)uyWUsKw^ z%SNw|3e;&w<|Io;Xq>ZOK7rB=tUT$pKc`-lm6e^gw*RUG%wRcoZr|XP=KS z8g*aPMZcO%Db<)DyLlv`mfjGVVCl|KkHC%))q*{<)mH4nK)Sc&qO% z#JmYFz?Oo{8JoR=DSM#tq1%B@V+;Y199;2w#rYzY_f(KyIfh(-KSyoOmR1AQzUA-& zhYI5hApMYKtlcCZ4u=#8q^j}wmX#H6vsW zy3E?t3%o{CE3kvvmVG^O?5BJv*y__U&&# zscPi^o|w3X_^5DFAPlCLb152sXjAsxom3DR%~PQuM+9q723Ne!6Ui!(jHqZ+I30{( zpv7N<8%#TKV1Vv}fA#lj`t6+$4u^cI_X05@bRQl-7ct8*tD|l3PP1+8?JbadfE0{v z$1O+483}sr)}w&4TF0K+CM?XzVbE&AT-3w)Y$nO120&;7N+wjzmDfxBs)H;3%A<=FgwcLki>? zv?_*MZ`ryPF-Hi)H!Frt$kq}rxoJ1}!=VHf!(ImrHJ3kS zrFu%-P9qrn?5n`S51n6il>^__YbdCq7i+3e<()bg0muqvrVJRW5J0AXU81|2w%-@i zzK{dr-sm_W`jIL`$&4bN74(W3li_=vxr5Be5^&|R-U_y8y-5(I4?LCbT7Ivg86|t{ zJb0&)lo(pr>C8(tdhLQXW_PX<*GH#TysHDVc%N6c|LFE9>S+{u*tw8wQ{U z2VbuINSfc*FubOw2D-0aE#GN{?$ew`B?(U7-WyC|h_ghmV6E1x1*pJ0vf-kzON)KgP2G>NN7Zwo#1op5Q1e7_&?*-AGa@S%!+lU5-8c11tvxHQosZc_*B5=~+=>42*rF&m|~# z_3H<g-BORhI{mPO}$_vU%ci28S=5DqOZh3FgsrAAo zDhiU!xo5MA<^cWk6uTe`yq8&uPD9BZ(Luv4Ecx)P+F!%T*TI$cN+_35;z+e*!jk!0 z-F(!>in|TJ-QF;W4r9Y}O$RRQr3S4aOvWY#EVnZDn=(Yz9io!iky_=pVK-_@-pCpI z?Ry$8E^v^hPsW6$%%&FIG8r?i-=A*C0r1qg8$cX$^OxO!#Ev=su0#@=%(|(8B||Xa z-Z`$Pp|OQ2Mz#$3LD<*4qnuvA7)Ci?ETJ?Lv9->W!|8q{)cWKYx~Er64DAiD*i6%m zstUK@Oibp^Wn~|tY-+XEj?0=MQ^S7!ElRln2^m<7Y) zt}Jq;?EU+L^k2dnxHd@YI}F$!lwhF+iELgMKZ3?;ZvO7Tq9B`Io?^dS zf^ra16vghNbV@jfg+IW7|Ka;{IhMaz7$7{U&4(7d8**I&?>PfoOJ4ccUSm8! zQemu8jw@srl{?AQV-ZZ;HdH0=*drP7X`(0Xho@-_aoeDxy=)-1cO)vThy*Eo2p%BM zYD@;Tk8ppVVG4sz>}~7V0aS$~%%+x9{P}_1F7#421U~ceJT9D7@116}nM`Aymy{08 zCfxcpU{b79yJ1p_kZP%!maiY>5S*#~hN3ap{M#hMsd6eQ@3`S>}HXarjaW~{?1y=bLNh;m{_=f4fMys4n$SkrsRp9S(TbbIrwsHm?S2i2;8XZaZ7p}QI~ zcz_=CS}M}&DPfnN*i$uC)zQTQ%sj)o{{(*U@ap8eUM^5IYh`v7`YZ>yRT>WSUmYJC z(}ui`3XGY?aI65u;Ehd02-a@{-81!yUn6}I;Aj6oAZQ3N6{OJ3y1=1rnS*ou8)CU| zYT$&je1VFEbSDvC4*J%=A&;G(+37)z+8Y^e(>qmeidag&-Y`QVFRFK3)$PN>v^r*< zWQY3CdRTrE#-_LAxZV!b+@=C^_PvrHMoPX% zUrstM7k6;uQhF4#1=i1}5^S7*-3DK)la&Kg<<%d>6p;Y!=kROl{+sTP9{;KNc3bPTW zCPZ+zHV~5s45H3WO)o?SS?!#bJju>U9q~&D`Z$|h>!o9Xsb+6&ELM{o>KlFeIB%pa zWz_K@dWYh%V|=hddg5?C{8BT+-~)`73B|77#?~OgC>TgM6S_LOx=2<^kk)auw!8ub z1)`k_%SNGxg}`W_x^Fb3eQE`iacEzVu#?~YAcT>*By^62A=JoGaAVWAcEoIk5)v>V zPv_AXZe_`2jzi;GK_-#F1&THGq>T4GZvSQ|8O-GnN-?Qx9~UJ$g*1kL8e%aJ3e8g6 zyrA--puly>LyvDk?8Y7vUz=D1Ta+fu^Se+G1)P3v;8Xmr4mrTLVlbCIU(D(ddUECY zw_*|nPBbfn)MuydVfa%0?$xSK{zx_`mwy5Ba0pdXzS08e?}oz(PvwKtyYuX%$wA3V zYnIXaPx4vV&0clJ!#jUXnp}`Lzf&{;TqyW__(QTkD~e(`~4 zr_o^%By5y}J?yG0PtRKz(6gl4fn#AP{IC1ctWO1OxH)eAKz zD)8>&x^fa%3w7N7wUdlE$tCr4_3G&0#9fqByAx9w9y2}MZ*TkI{rjd|ez$J!mANik zglxJP8Rz)-l7g|?;3cHhogHZz_&AEDXgn5n?0MoklT})(Pwg0cY0HsgV>W{p#(TcX zdv}_YEZ>`!sprQy5-idgzGs0+l%OW_7?>EU&z+39Y|(nVwKmAFuJ8h|C^hCUN$+%5 z?3RYil$q|5^;W@lC&n<+S%~QGAr0B1D`TQ+;SfuZV9^k?5|Ck4f3N5<@WIEz13HJd zyt}sh?8Bjnw6lddp82i(Z7dq0>H5ZHMGiJ*KvkEyEj&Vu(YjUgRurYB!7FE(B*Vv2 zoq4(;d01D^K_VzwqgTN3S&(y<;!YV^ws=Pg+&othKXJh&mY;}<()2^pJsFVEtNf{^ zjoF9*kMd-vp_~tOqksLs(DJafHPOlv6=J*3euZ=$cX?UhCCbdhB6wSM!6bcT-c*_Q z^2=qw(p9+WCDjhNVW*%^A1P6bZGQ$uza%1&h=eSJKw6LT+H1NHLlGBgY({ ziF}Y;@;n6iI3FA`6)f*bl=cbQBS@J3U+fSy;`>Y?Ac#`T)I7RcXSj0Rjk)dX&!0c- z70Lhp%fg1BHRS`eKs_KS`Hj9AuP2dAJtX?aKSH8k$sB4}LncIdS3d#75a#2yA(I*K znNUf&%_135qO+iVpLn()D(BHw%k%FsS5#Eact%#ks&T0=fPsT6pph^=63h1To+F(c7CL);7O{s4YX~)rErodm;-upZCN3 z)iYy4v9>D}{(3X}bbG9l^hesSwsW^%6AGw--iGYeiappWpfk7h$tW*hmAD{#=FA`u z^5ur)&6g+aVZ0%i$nlEr#yEdzomgl0+K2yLwNAv!qoX zndjGC9W|!<{9QI76P2*OSaj`Re<|h(70ln;WhFzFrITA)>ZsEb-SaA;sve1x9)e{_ ziH#UxL$NY6aq!omRR8I3=B-h6gy4$F+ssD`(PLbOB4`8F5gn$-c*)1A4k!8-k8k-h zU0zj1>8D6-_}!nkn_wZ9tWPRx!0p!kDw8o*z$Ik0EVaBySo{r!0MjF)FyQtCsaMRI zPakwETNg@H=@?WPn|gSBu}u6*KPMsTewUd!;TmLF3XLKRbuTw_#D|vXxJjRXzXUW0 z+TmZ(7td<@nNBx3c?LwYJ~LqPqsxXCravlUUXWV#n0|CCeM>*U`DV$H_W|E1kY#G;Q08*{<7boyMD;1N6Rk& zuE8A{k^_BWIeCxD=+lZn-Jxn1SEnfUJz2*?=SWjRGXMTo#YP>Ly(zhgprvbxqSu-3 zw!hmFed3`R!I(pBuVjSgF`RE6tbS+C22ex>4U5F z=ar?BJ(Njql4_ckf$Ftt(az*Way*ET&ns4!~bMrbd+PYyRT19(}$}Q@iLoal$4cEZbZq{ ztulWG^g;m%%K1=dBp`EAW_-~&MOBeXZIDAx#dHCq}BluPHSR znsi+XMlFE*-0)o!oZtNi4qRTHWL~xFkF`ZKW6|ZMVjd_kLUIWd7pfB}qc=&Dx4nT> zjNBcTUAvEwcoc`I32Rb)8)m!v*INnlV@NvN`=6hX&>RzbsLeZ|!{kBQ(An=|lLH_9 z5gT562ZeZcT8~S~_HZ>@A1OWUMsyy(rcL?RY1iJVz3rl_(ylMb``fqcDV2xt2jZQu zCHaBzQ~XuS=IPfBN^JUzB&>Ty@|CPySw`A_w{w@C05=l#FMvlJZ^mJmLx7abjB?f9 zaQCkX2$Du+%{@IajGypc*HZ71UEQaU%=w#m9ZQj1?t#3{2& zDCD@I3OQsmTFhrOGi(gR`V!cww~c4muVH)#vU9CG?XT`>)a(gJI**o?izPbT?JSBt znh}QC8I4O#>37bp$s}q8ghhvMQBu>!r0=3RX&V|{OtE+?o|J<{Pv3 zm#I6YoAnb>j~V*QBn#YMqCd9XHr%m+4X2&)v{%5dJGl`(H5hwxZr?=fKec#Fg0%>f z9xF9bp9_QA>CTa=tvFKGoG}%CZUK8}yoj`rJH3ze=11XiSe{XkL^6bdW2(EV;rqWJm%07hn{7x|%DNed#n4jR+%L%Ba6r?=al+L5&Jv~^T zrf|G;0uxUz+Aukk!_Fnhl{4?rv+^?UYuo;iSVMW&f``sL@Zt@-5WER&kIMnYK!dD8_fxS z;u%d)Hd+8@e)~B*&~={NSP8jFV~|_XbQZV5&7TU@RERmqwqcPetJ$g@$!X zzR)&je6HPRxm`y31Gr-ln>*@-V+_`#TvYBSC^7jOh+!}Sj~r@{kDdgxI#!D&3Fjj* zDNcZiHqRuuNL)Q}Z%pcAo5rH_SPmO!LP!%C8BJspD(|4)D5&Yl44Gw5-VVfgo(_oi zu=Y$3Jm?hFw^UMH5@>o-J>|0hiACRq=9g@|-V)K&K=#>>QD;&^y|D`P=de(QxHRadrR7!Hn3{No0Zv5WNn5 z_5h#jMI>2Fs zz{1Z8+#`>i*w~?HzCBRfN|WhM#HOExCOh+ABsX_ka8<1!A^zPZel<1ejb&=UVmCB& zzCyC?U}cl$yYcxzt9=uOjzmh4sZi)~xmEiHvO|=ns4ZTOkyOZ03~e zuHlN?vrOlKd`BoYa~1vGbY6{&O1PU`628+}vZLoh)>FqvwI2$hFv_*cb+)%?LpM1q z$cxnnCp*I6XWCoe`8UC!Yam7yh5Q2Fpv$*Tu`;sQw_3Lb9Jj9Yr|%*S{aVu^do$Bb zCYRFi7PC6R&I_JUr*Mg1)4=JwKM}Fy_imVHeB%!Nv5AI0%VIJ)h9VPU^`f#;YT9ICcs{VM6ivOUL zb;I?VMND{3<6XfnkutJ-Te_V-#>IX|rwql!0>gcSiyvniEw1j}J92b&NiluRsQ2s= zY=mO%Yd`@Ih6z9pRmcAVkfZN^n}dVe4AffLvi)TjXX%ppalpofva=aWxh{A`<#d&> zb!zLIM0fJ-voqusu#hWuqb6Es?&sA5L8&+So8%Yn=oVCI$)E8(=# z+sj|RrYA?(1AA8t6N+JTjzw);+jSj?HiZ-}%PT;kI9OP_|j7gEQ^a(*uCo`0Dabg07 z-1aK9B*~56urQLPw)KnYl|twAF#t0>ZU?W*vqM2oe8F8*hZ>|+u2Q~I5K|3IT$Tia z-rte@dLX_OUByZj2&g1DKpRuIY3lH4<~O8eMbs(g>FWL8-#K%7v65898d9EkNe*!J z&sQ}@YfP19IEM%=&I2#!VC1Mb6vc5cVEe1&GH=YTWKp}s5XkD)756~sU|<9k}#D*UeT z-G&s7+H~D?jO^}@KT_gcvBfR-%UOnO_DI=&_lB9o-{;(7>(8r7R%xJ$(4E z8H%OOa(Td4`S$JGm)?UARQxE7u%jzr=*cM%EBudXgnd1c`jUAjMkDnZV_3_MDkB?p z^^6mhDF|DZ6EWqzt-402k#)4HRW2lFJ=!!A1HWepg=%If7$h~`-6_r--M)RNW__WW z)3mGH96oF0VPMyrXhPk&nk+1~DOAjQHY!TfO~r}-Yb-G~V5#U`kuzbrz-IsETA{m$ zntRa1_=_wIWpJ5MzLW?6(7pk%=tFBbkS8F)_P?uLwQtp0xk@~t2)h*f??r9b@11%f zkdg!hk9U7*Vj?eNiz3gHDWH2ErJ%X=&p)d5oGkUq<0+Vd6snFj?-i~MGeO&)D)+%i zO?)P}r#aV%Gf!@P{awPfd z&3R~8gWIv?3z7~U^*+M&s3{Oq1!uqeH_h2T);GG^9;)Q;?#J~EW*}Gckm^^rZW7`?Ag;?vEA=;ekx_NKuz`?k$mvVGn`KF4 z8-arFZ%B6hn1FUMR)+S2?Mj*cbwCr>0)9*L_wVYT&aen_gOwSl0Ng;2E~VDQ>sK4U zwFE#82=_90(Yw2#Mx8yJo>i{zh0sYFD|Vn42gZ2jZ_IjgZQ(EHUT#z4xEzi8<<|DL zbwPb$=JyTfDDo8VlU)jPmq>e=vo4WI3Ge&QJUpR{($>eii zY>9%S`s1yz$g4vBbpa0_W>X8%5#lL&fWnLfoO);%UBapds^3Lg49|Jhkx@>yaV~x% zJgS`F!A7GT7{acNoDO{vklVORV`4Dxwqly8U#v+GL46EInHI_4?-$&7KCZNf@K7oc zTkBs_XbI*}yOlg|fK6XA0SZ5)Dk7q5Yq$Nb{;W;`hCc!(*}R5gM=fj?0_SUUc5rCf z{6C>aq4c3ZT%_*zcsej7Jy$OMrBm+hBSxGb2UVD!8-DK0bzjoLqx0KYtk}m!xXN#| zM~@uJM08=&BfHxSbr0Y>nFF8?%(gXs<|Tq8EWO#-e7j;jsRnDEUO@nS`OKA zBuCb>y8h)+Jy6CeQZHPb9T>RT+1slE2Lj&(EeF zKRX07DT-9pD+M(^hT7Tty@qN14*)%<3y+G_i`Zxbr6u%JC? zD;ksuqIzo2fQCRCL!cW*mktXyv`c~5eBcUVtagXffxUbi0JRF6(adto8|c+uQ0D=Oh4Yzs!{0Hc^(s{h zZz2J6$l}5P>4l7#iNv#>C1<0ffK(kBjSQ%&TXg8DxJ^qp|A~`UR4syNFg3SFKy(>& zjFm%;)ii(t^=i!FUv7om--pbkn0D|K_(8@U|H!f$l51wk90d>Ip?0{$Q090^+ou$&kKky}yWONa9Ez5MpNq~i+&5aqfIb(a|cf!;XR zQqS+nCU?MiNNVrLMBvym%m;UU;`*S$4nxCg_-FznT4I^#kMJ1ln}L zm6-B7q*{;T6KvWdF~U#}1XW%$kbgieYYEtst^yWQZWNb7bQ$li;eSpSWYXR z2ZYK`ifSPWe5ElTD(sk5I|p4)?+#5QqkBVD-RuR`TB*6d6hINbY?$R~d%HJlM^&7s zU+t?|?rDB^m}4G<$f0|E%5wmsCF{^R7!encCrDN-gGbEGZ=!q<(_3s$P+~<11)*Gi z(A-z3wbd;i%MW?t%+SCa933R=o}=p4%C4YJ6b$rraub~T5oyXLA(tLVQB1$uv)~6Q zy=CEtDNnq=^0gJPOX1`fv^Oon$&7vrHUk<_kuDxUMww)-pVpuE{|P@A@wmxeBsh9& zDRpr%^aJ_?-h<^y=uXIj&OH`(9>qCVUFv1oVW_8vu}>S~t!#HI2a_zz(i|#VcWBte zrx2||^4fF40Z)Qz!NMnzAcx}`yKz%ujNxEWzDHl{&EROliBS#b#z}lntxCD=@|?ug zG8hOxsL>i8Y4)n?&wX!RRy*U%F&BDk_m2}sF4o64KA+NO8s(AP_Wpy| z`^&F`w+G#sXu6(o6YtVn`(co^wbk+5YFsMS?RDGN@3&KmnUhjge#}bR=Jzc%5+4kj zEiU?iSGwy8OV2qXS(Y#&2k^B~MYb5|h)6~X_t<%)dczP@6UE=zd7*%*DGR74pn3!hn&EB(?eFXj<8DQbcBpqjTg_c} z_m^M4e$CB`j*U(FHBBIx(ve)CHqlxR!=7phq3) zkdm0E2vRbfwKdQxPiJv{G^erG7We))U#us&Y%Idi`*#5jomA~jZp7gOxVQQ0|1@vf{w`km12}5sXT_;*bZ0g7*cNAklS%nhQK_F>z#$KxZ<=Pmrd$oRJ4$X? zNS9}(;rh*MJ54?2+?ls;Fh>@O=Euttrkfkkgs>XVK&RE0+#4|B z%`c62rt`9@%>9h437f|H7){n(&bI;sT~=m8)J4%Q&CFl(9oI1B?UQ$tnmm4ZZ`EHe zZO;-Nl^w#ruXfE`4)Y)L=rLc~G2Kd#UYKdQHc?`0lnq$CP_ z&y_MDV5BtGDE#b6xq>gtshAY+^K>wem0O;n{uGbdI9`|{Ch;!9=hxtrpHzT?jIReTn4EkaC z0Ap=!4Qgp3^(CDR?4fP8J;xAL9H9fd+AtCzDF6&!BcAj9M6?Z422138O#+1QEM0Zxp(f+{vyQK7r*pR~uM(zs%k~-4E?TbD5Sz;lk{n z^ME?i?Sj6}Y-qUR;NqfjcmL5ILkh?okjJ~?TTSfpk8$URke+YWpXNbFF>fOItdvpI zn9j0wO@HiAQ`Z%I=ueoPppH(hOpgI$p99`YQErf$e1#!m`WL}~I#ssJ+OV$I50XY099%mD^La(fhX!e z`xw0@v_<~zyq+&JExX4SUU;G~m7gj82E3!4b>2aZ`<(NLCbJ})vxI(9gU=v-GC9X0M1@O|>O1TU*-}JYWKg%KDZjyqdhw!AS^p zVoc0Y0QOp2Bi>{y`PHif^m-EJE^I(Wva9`5s4F&*jE;$5ZthK*FQM}D;vItSb$U}I z(F;GVOUeyoJ(A*Vy$!#SO1BgTWx5$Yk)7+hEH_7vG7f&DHuKRm*d&BAu2J+GJtcSx(p^!b#xmU0(o24FtuS}eQ^Nnoya3Z@JfPm~o;PoSGXO}0-Mp58b( z<@(i%c#imKWgJB?gRTKdVDy1;CN$yLkAc>x?`nUo3JUdvHpokT--p2JL?#uIoJV=4 zbg~y#k_nUHC9Gn)1mhpCc>@DW=-EYdB%XKU7+^Vk94j~?WdR3q+s+ekd+F&wI00lq zfbFNh^W-Y>Misuq6USUm|FfYpz_a)4N}6o)!)tQOq6@$g+HAJ~hrLC_m-`poTN$GC zmz!pI?h_CW5=ffqc0oqvuZp27{k@GrRLqSNl_eiOe89PTLXQF`h597Ub)^uyolWj_ zvvZd1(Icudu>LfW6?PWE)#234rx4V>rmg}xYV#8}K*7y4vKe~Dn@Be0KDQ zvaphtl)TslunoF_N~jwM?}zWZreSNRhOSUea zmX>}6`r#;~6=CFu#tFBne#K5Y|GNeJZ+PKdt^ZDM_-@ns!NfpzfM719Lth38P7 zu7?nHRFlDf`d3#b45I6WRA@$-ka`UBc4cm7#%8>E1C?ASbV4Syx{z5(q}t(W0L3QYJxc5633>LEcG_{T>0&0DI2%Xh8LI49OVJDt1ubAVN3KoNe z$}AX5mEsn28fA-jr-i<^&QfrCfiCeT*YH^z_oCZb!5EpTZx}($PeXYQh5b;^l1Jm> z;oZhF{iGF;w(%utSxs$K8Ck0ml``r}-zt7{Ht^06)@%pH0qtmvjw})knki z3oyi2vwUIjRR$F&e5XW-A&*z!RiC*?$AQKmqq|GmZ|7siQ@wkG(2J~c=SuL*V2_ur zpz(4^gwm%0Zy!?C!-EV^8v0nEkeJ=to5mlic_3j2ywe|`6r+6Ihp&)2lwsTg5BLL!*Rx{2pPFK@!_45!Y4lBthkvR zg5?He_Iw(n)KpIPlcm(y5=Bo(GZZ6m2JDYuHLSQ(nL#x)hI+++i4J8 zSv?1uAQziBepDfA%3*4{YSK>q6mD7Zr_1+yN*V01S{&cI)QYW=xt0y22l)v7kzP+>sLqemK{vJaL8XF0ZWJ2439mIWfpC_1a@-}!NiDd??e|D4V7fJ=%iI>oZ&cQkxJLc7#x>P{Ac5~ihAo(x zP>aXhC!%nOrqj^X)zPuEl9rOX^ne7o@byuQ;Em7*4ay(6iLFHT-z~U^i zJ$w_>C#a~0LE7vlRIVH5(9biW*LyEr`Xw%9ZEaR8hs#TW0TujSIGk4kQ0Kz1M})T2 zor7t=0_z7NE*trABNWf*{`hv+2E?r%axwf{a|Mhd^kI=prO8znWIka;<-%-0FwM>1_sfwC7q=>IPDKisj7-|n0V1Aqv!>5v1tA}A>6xa)sEg);p^ zrtCfmS*~WI1@KIDvh?1s$M(MVv{q;oN+!@~0g4=9U>c;mbkm<3(VdgOci}REu~y*7 zjIjUzCp?%oF%gAwjicTt0=~EA*RObb0ll-N#HP9z!X-XrZKk~UiNL&g+ldT1O4=H{ zmgQ+^jiMJ!K0b97GstBPA*B?fGzfa$?ycKQSFK?;=SD{J!XrT?uVn{5k|8q?hWx*^ z%k}!&*Jw(DpMdOhTYgSXq7L1AT^klJ^0nV1ZW7Vsw_OpAMh$!gDd_0F)htKY@FNSJ zZS<`DAV>jf0m>H9`J;WH=jfOD?{0o`0c6;_xbeA6!jbz#7UA-;GL;Wi2@LRR6G$On zm|xrOzdJs4PY{)2;pZ(}2X1FoSe^41O9Y`dTKDH8R~`z=I5Rfs`vBp`%$~ zKN5d8j@*B13BHs^?C$WdK(&Ja?gtFI$9UhY#kileLRPz0>B!s9BCXwFCv%?nt>Ekeoqu4yZxPJH5N%;e>Pa>s5p9&7%!4E-0+jS^Z)kFh?QX#RzBY zb|g0-&&MKw@D{ntyx^nv9S(wHzS|rObowsYOGq2BQ(^L@GRP~JA^K^k3YY+38o*Kd zUui;K^R{|xEpLf8WSkz>Bo=j#j;1vr@A(n(SN}O5`{VB#@lM`{D4vi(vDFeWx3yHuI6-f0P#WBzyy)AHS6BzE2 z*W`<_Hsr3Ikk~Jb&D#PrLitr>7k_H=u6(guJ)cPu8R1^vhXZlxIVQ z3EI2|MmLY9M$hSb@!wY$Xi+ZoMAv}9a)Q)M@I5Gq+=SxHyH?BJyo0M#7H3|;KWC?W zQ{X^VjeHl-@^)}Yq|;tQz#3%4e?Ic{H;b8>Zp8CwEHIW!;i|4*un+S#V9-n$o1fPb zgSIPnUT`>ER=R)uI37J=9$ud#XS!l*(^vpEh9O)9Ir>#}hNTFk^=%~x7ZM8qC1yrr zy~2@0Hr2RSNCxqDp&LxVgZyNWVvI>vQot~)l%bZ^h0IOaPu!-ixmt>_ zf@pQJs_dqdji0h0dg_l34D+%hnb+CEDm%-iJL-pVs_s*yY4I_}=bu_0PsAH7+zg7d z;|Lx$q>K z&OSG#{&o1?scN)I=IJEZ8r?mAiRTP^bnwB(%9yD3o$co1f|gf(v7^O$(W?D&uHNu)q^U}PdEH`meDgW+5M zYj9Ru+E~TO;;*i9Zf^=eZ&lhUR9TKRJmb=%HxduUY+Z2h@{_F7Gc@Fb=&1&wU?9P% zK>`)2?MHulaQBhyceTbZD<4xjlA&gLFDD^VPJ0Hl_@B!c15%&j$QU)VYvmE?bIOw1 zRIY`&IbW&0T*}DCrdI+NxWaEG*3N*sEj>%d7$4_4eU#y=F?n#_%waldXV5i8q6PbG zVJ1kdqvOqtb*w{$2l6E!%g=k=3o|&eO=(i3(%h_7l~BFhfisenH#a+r*!!(xyrHD2 z=_iz?;n|IYs$OdQFb&5E$kcHBE_N|`ABZNZ4PLFa9^1nM(3$6l(hM>`9d99aHEHXYvk{p#tqquhVF-qcC_v#`N2Wq^J1P_r082!yr)-jb})3sX!vve401HP zxDO~u!enx2r0dF87Cxyk3@KG9&PW}WFCi)E54JsJ!;ys3vXFaDKWnWeEb?S98gVq- zqqh;ykdvgM&MuT{bKo8xA6Rj-yTFhs^@C3OO)oEf$kFq&l!Tyc80>kU6zAleet*#I zmW@qDCgDt&brW`U^Vj(O{UxfI?Xd%S1owlX%)&dy8K2`N>Aur%pys&p2JN*+5j*Am zIfM$e?+Qm*iysmd*E!h@jge3$eLXQJ7Z(xV^mh*fGO72+PXo)r`+7! z!^w3Wk4GA_6Ou@(iL!X2)>p*}j_OA6#V$0muo$s5ndwz^2*6Sk%&SlS@0Jxa$ZlxJ-r03%5*^2+ z;8&Yq;wF;I)zH}3VzkiO8g7VEy$E}JjrDLNcMf6pmuzCjEg_>FghUvU1lEt&<0R>D z^$U8%x(~jWr6N4)6%!;63>d!iY8g0BuRuUT1*aUl^DH@ekprI(t`FZoPe~yO8^v1L z4mE1|{ydJ3{M6Fb)pcOe>NC&v#I(R2xFd9CR33u%w>qpF_cjb8zHZ+ve%~ zwko>E&F;eD7ozHh>F*HRp`?HB3 zU-wVlc?L6k)x94Y1b^DdAaV=3+`^J$SQ+hf&EUb#b`L^xH9a!3s;_4Zc z()4LtBrc_2H0+2%Z&j0?979dKI}F)81s`*ASqbH0Wp%mrF2A(x$Q}WlWILpx=wg;g zVFe=U+ToP_N=kk^JY6d9}5utf!LMbvCWg5sy&2?=H})^AK8>>Wed#UcvWq~ z+19%${H*661rq7?Qy3t-em*u6pNjCm0nDi_sNe$&_fi6fBeE_il`p1?);k7m{-?Gf zhxw4+)>cZ#rG6HrMplo&LMn_|$cBE;MLlfYJF?hq?e`^p{@Uwe&dv=hH$7PVxIE3h zzozE#&I76!!7xF}gt<3DRdU&Vh<$O))+hD<(RI~fQFcv#B?JsWPy|K50z^_pQc}gB zq&q}JQM#m4F%a~jr9}{yRJvDCP?i#;Q`X%jBv(LK;+q>4y}s-F?mxWreV@J0xzCw1 zXXZCEzp*~4JQD9|VS$sEWp3~nPuh0@@2HK9eSfF@r5^7)>A#B3>=f9wA&&re_`$vI zQ8m=Xa=19-?E&pQAY+=z(xDDW0)HP%S5+%m;2t4CKGKEl6T@qR!!FrD^6 zoV(7HC`I)i^@$IPbr^MSg_LX8#1+0)g;r!+---9dNymQ*z<<8^jxrfYn`htB3!zb_N84tU>bIeGmb%UIhVNdplGwX_qBYT90dwa)A zTW@i8O3Q?*{Xw%<@EzUpf_$-t-*zP*kZhv1_So)sTPLeCYIx0I!l0~1g8J9=LZtLZ zWKR%Y$+jIw;ZC3r)jvJ3N9M$1xp)vD2j;_NCKULT?oZ1T6KISe<+&0Wg1i2Q`B4dp zEWJdAWXjIAoIb~(8ct1ZX`gAxd>Vhrd;!uL#BBjqSw1e@HR|DHVUcR%*|eZ_5^;5Y zJsHp?!%qZuo;E(>z6Nwyr0Vs1v*%qZ{2XnFTgM$*R*yZ~KEHLc7Q(6K zvvXhdvWt$2y3&8$Q?~Ox?%p2l7Kle&?S~HW9Ym;5S-v3Lbv>lsDEHDo9$WH@m$u6` zK7nti%UVuExO9tQG#^1ri?aa3^z|KK-!Jws}4A=IytWh?`JK3r z?)B9uYAmjDqVliE{ThO|*4k3+M=-R~5L=*B6wQ!xAKN?f6e>qd0?fzGOmmb!^EZ=F zexMgI4oyJD-8{7Npdqk!1T{8c30b6H4?1&k+97V3vC|HBQGLioH79E9pjrF}6|#fT z2t4yq&Ye4;61-NoVj!w<&gR}7$oTd1=<;cWG=|+#!L-5k%i^`k zEgvw7=e6fEB21)xZh(zCtgGRhA-)bU(Lk@Or)O5jc)vHX>XyZinlQa=ie%pP3iD6C zr=`133lC}ryLD4>(<>JlpY%-2{ciYx07%$5PSd zw93Rc>9D2`lWfi$a0@lQmY~fTZT^_cN{g~3tip#cdq)&y*gj&Vctc`Rv{mJ(I1{lk zxMlo)BU`#EvC4;dU)reG?GP$CkOTu`%l&U}G9V&@D#u+{U7<9lQ1^D|@X-?Ce|&Hi zcX0!fV-l!-SnB!Dt7q>zw84V0>}jkwmOb*FEhU%sHSvNaMtuJgvmOn1KV%_!toA^T zrqqKQ4M@SFboq6OU5fEbjRZdt(-8NgzrGCl69)-#W(wy&egiQTc*yi_9)QlyQ9q@F zH$mw9yr2MXt%kgNNkQnyd$vwr8i{EttiKQF?)1*2P4xlg*zGuFX_|WZcq!ZgSgNNi z@_*mXDtoPDbyHoR*)82>(q%jh=I7yXaUBHISKp>?=CKP12p)Nh!W|xR@*Xw=G|zEx z{wX=#5?Vg&xgOT$&JXm{Q$P2n47`=_?im`IKG63R*WB3Hm|z3?N;29XOK`ZbM_jka z>t|#2q(cY__0YW*;?q7I%N2J5EYH=Q$?CM8J0$Ls^ZVLVe)3llpi3cxD69U0<(HQk zUiZAb_}jKSi$Xg(*8$K)Vf;StKDI{J9dHZ4W4J=EIS2{{$xXAXjrQ#8#A0b9Pt%hw zzMKC_GNwUEKDwU)mg9U}P-CnI-0_m@!`oAm!o5x_aHADlTy~X4!kpcY@xnVq zWJBDqe+CNj^0wc1A~Kp9m@H-r7pT8vTrzRB@TF2e@|{5NNp8xZ#K+PeqKiCjUB`}m zM{=m9h@Gi{0iR7+V<2HMBrt}DrQvo~=ap9XdY)hNhCeYKV7tcHJ6LRN+5@F!vU~^W zPjl_iQhO~2ebMXN!uHSg&F;1Ei2-SlS1*c3KfK=z`SE?Z=MqR;Z$TwOs2j8QA!Y!& z&0V47eR@&xC)GXQY~Gy_4Yhj#B$K4&xSY?p;^<_753xP;n2ca7O9*fz?KAPe^g zVI6>q;$qsQ48~m@Q`K^1ILaUJpRz`nWFc{Y3I4?MR9K5u7fIqTosZ05_6%sj^h-KL z`Ff&)=VQ+F-S0D7p^c~;YpFw)!8yyo#ML&~L7W(C`ZpXT4Q%*+Cz!Qyql91Pl-N(J zcTQ%K@Vi^!5eI(Bv6hftkeK=TvlMRObIqs!j&~8+fE^d|p=e)tGh+lXs1!Tl@{5XKRc!CfmBKYLM(+77{w-(-S53rTS zI64F(EhDc6@;HRo*q=~lfnRgNw+r9U#sUS#mHy463rVse9!6c03+;DQE%t1^!VFoy zdz{uMcP6qQI&>V+!2lcKZB&isUajwt<8YyK9>R2?Qw|~5isG+5L4UJ+H!nW?FKVz0 zd^%Jn|CeGUe&Fipc%*0hJ|1;?oG(2KKg~szPREM^EK+qd~ofk z9@1w9K=TAD3)N(Hv=Yc$I?!YPVAVX^+8QbfuWEdw#~uv+6(M8mH7G@JtK^if9nbxK zaU;K|2!GR;73>RjV`S=tWeDAT0!#dM1uXi6m)pI2J;iIl@nrn%uSxIs4)$)u#39v} zN)X9BDBpUhFK928!FbC|OBVc-|ZFj(?yQCw5Ae!7YY9c>?*Cw4Y`SBiG|u5~$WzW25x#ud z*NKUVQ92@bA>D#n(aag7fEYd?bV3KW+EXLa-|HLH8u<^ped$=COtv@*& z4pH8`JRU^R(ybg*r@sMT{u-vAiX`se_`UVQ^;@H(I3RV#&;N1UI+nuL{LY<|HZ&YO z6h;(yITNp$R7d;gW)i~6Aoo|^i0fCG*!6SlWH&N08spk}fgcAly!{^gCvjxZFnxXC zj06pg>=~8XH!R@qn9SRf1+g%jerl}0xhAL$IIedqs_z1V#Oj>**MJ>+3YtR^3BW&4 zYNX(Xb-w*kfPz=fZ4YnQj53wgJXNEA6GR8#H9RTsIZULX>-p04(WJi%A!lbj!%?!l z8%*Hw=9tRKcmtKq+l~1v6su>D!_4gX9UUAUHTn>eb)ERd;e>nHs!s$uCl{RWs-)8P zH`MM^-`k;WlYbS3qAY+E9wbN(^0BMSNckhd~ASMs>j&QZ>~vQ*XNZ!F23cvK9PmBi@TVRnk&|3IBwSQlkC&?c1xI zbLgu|Kc)GUg@lAAg*{lD2#`tfZEP&Vrs+aHlIym$?Xx^ZZejha4`?+i9_{xte_|c9 zhk|!Isul<^4)E`xFzY+d%S|xP(V1*n%$PpGN-3>FC7SAZ=QE@ddfa_vU5iR(bXuj2 z-cOW_g;*Q(ewP%S;}Y>jIFT#TL&_G;grtc_L!e;Og1=*iLX8i20P0>dzB(vvuHP!$ zY+YpFMWfoB^lM%GZePploL(h^{fyCk7)L((t+=Xcu*=okJ7GKJC;7^ zK@hk07(l7YohaJ~bBHrG)Lj23n=O>G3mdh84BHkt& zQr$`IGoWfUZ>Ni(tOKkr@9R@lRc+5V)H)q>8QK?0?*p|z@cs=C;UZ9zr%j=w zNY9)GHY4HCa&C3&9Vkt(fc)Mtb?(63+}OmT%uBLgN@&H(Nz8r$&Err>|B$Z(9o3P? zdepKz94w05<6DC4mkGWPMh{ra`FB@bpcSjN{Yn_P_zmWJ1d8og>R51 z++PHmEMa(SWWU>xiGk^PoZk<2W_!MkNzgWkq(ggZ7pBPe6Y7xS@T?eiNX;P^ZqIrZ zA#Eg`i8`oEmtUHZ^nJAF5eeu|e?OQraQ&KPUr;}W7TX_)HwQV}T_?Y9U_Wn|2nb|e zxF649*yt>{1OfDDmxw^)BOZOA1IT{P;8crU?$N)WbQ?kin4TvS&2a16XcKCoC3~OX zY`yp-3vU=^Cq@%4gL-YS21RP%HX`R9x2QIDJ=6=c{)z9N93Nb{iWkI{FnZt9%@9lz0-W8 z9xf-L4!IVXQd5QugBFWcJIn6p2y+7&qZZJ^-ld<^DCF0pXD~B>O0E1oq@}7I1Yb!3BvA8Y}>c>t1PZ@}b9WM!UPt z?`gA&+`O)8!hW*FX6yHuGsq4476JPGY(@4m0`f|I=^hgtiB|ysqUAarIgSuUMRK|`#^{Tv$YY3Ly+l0cl#w_3Nxxa2MA*4Be^$ld;Ko6yn9Yd1(D;DA}|sP zty5+Xx>Mj$p^=yyP}Lpu2%Ed77Qxu#o%rK8=7yC3Mr~M+XPL3Gw8Xa*_xBst$f3B5 zrEmWq_twI115`Liri~h)pA7!}@8)T#_FfPzr)5CuQ+PEL{zFwg5+-aq2Q-4e1*Wu=Q~@uIaMxSv^dn{_ zm8!J*osQi*Iz(7rUSCFl9K;T~4b~HYwGz5B98%?QvPU-FxNTHld*#mI*Z+F=*+2)! zulcxdr*0N~^E-2C|DkMWMSHrd0fAC<+_h}abmLn4^FMmNo(vJ&|d2zSL3JA#S@yQu-RtXIcqCDLP__?i#8hy zz9_xpbV0BBjL-~S8V=feW(z)?RDdLq^j}QWfcATNsZ@HH+R-B9EadD=`wlHD8`?5( z%6#`;8gvUzRMQ4x1T~G&OqVflU*BO>N>rcie}&{p_gd=He^hMN7gQ*F#~tdQAk@W7kAAf=@g47U0b=R8OkE| zRvE9KW&z280FJ!jgj=}^SlfR<%4UbV6lilAlbVkgpQgoU@u(&KJRa9RU|R0{Dd^9+ z$wxfX#zlY4OWKLUxK}rUEbT z+e#)cFW~=7Ap+@e=*BWcp7;Z=X=5R1OPnX=iEd8~T`Bszzr1q=v@> znMZQ3mrDG3wciD#7BCVDmzU}&=$N~iSZ~!H;|~jx(|B6Vtxhjo)~XMtf0g=hNSVBeCO=dSMPO1QjI(4ncOVqf` zF>MJ-(>XoXfgoWmZZ|4C@-f~e-|NmD?E61&Lxmt6XfIweGqbXKy#!^?90pO=&U7E& zK-<7=s?#Lhe0Du@J}IY{KsE%BxfX>{m>ct=fyjM z=(w%QMlhp{yfos=t>&D?@>UZaiWnxk~@%|y<$ zft$Up=8aPk~avp&U;0Hz#-@A{OcN!0_(47RHN- zmnNpB6;hJT*fI^O4Tksh2jG{7z7nb^)S~8o=io~0;wEMhxR0C**C7RgQ^kuuJ|EY4ms&x-$&r%>dy@hc7U&*!i&1~{di6BD zs!5lSqhB+y1vBw8!^Vog3>wk!&d4{qQaju-n*@ZA2;X{qO7AkDP}&Z!7M3Q*At#QonXV$=JSQiU0~{%oJmP6mrp^C zM)#GGf(Y;M#@VMo%7z%8C%aROTk@VG7u#^ARn0FQ%geMo@NC(-_;=_Qg~B3DHbM{Y z8wV)gfbvKf$GHhOmKPYOgTNHwZy^?$N#r*TAJh^s_38Bm?JqNHWXt}{A|A)8eDM$; zr>=2=r&e;su6VV#Z{7NG0^1uR^PP=9RSn%NlioJ%pt#(jv%T@Otd0MM20Ai&9~RrK zgbt0CCwZ(H1Q1+)ZgG1@A??E0HJN{FQ1B+1f~4f(wtliyCIG7Qv^F-{wA$(mS*+pB zfc-AXTF(Nu4&lNDQEPnZSR z*ESU#R;SPZnS=vP`Bt;Y%N?JN0?GsFAFI$_)r-^LLee%vnnTvdYlNuPFx1yK0l4l0 zCtVCtguLn75)a)FMRZ>y~%P&!$N9t6w7xKq@wG&0^dU(dsd&Vc+||3ULxl6m&0SJS`n&6 z(;&eNUN#g2_hZ?WK*zwijbuqHuVxX7JzKGTCfZWwkGGPHfLqG)0rrq`6dZtm{y0#- z#hFkgpq{Ayl8YX5-6t1LZS{$H3R1iA6HTz|_ z#AqHoWWKJ3k^VaG(NDVZ9F2~H{NZ1ZI8sj`d_0pkrcKFE_}Duu`G8LcSa|o3(&&9} zb%V2|T`dcG-U~vc4Bk9LRBaFjg^RMot13-YmWo8rS~f?k6>IqxDFQ`eJ#YKv0V7Z54t;fsCB zAEmXMCjA^0KDlrbE_5?G*Q-Cs3Om@CbmM0^y`S2Ve3MYS`06Mzp+Dd5X9*xYN;ArA z89+i$xcQ_Dv+3&SqBs*^%n7d{WXzWkK|!wD9Y=%F_$NyV`2u>0Ga`$JojX{@1SyA& zkz{H}<6H>?%PPcZ1K3W2(NV3b@G@tEyu>;!>!c5^6&YFSZZ>47{7+iC&0)z}#cmof zYFs-?m$Vbg@P0k{*~mq4k%{Hj&bqX|ks03&^3dX9@#O=GwSjc);2UMr!)A02l)Gec z3L-bqwkdl``KNZ;!6n9vo)a?8$N}O7QUaQ(B4n zUWdMMxcPAFmz~od#g~1%1SxooMrlK1(b*aPH5lC?j<*P3pDwpw4Y_&fWty z9G_c3pP3FQ-{U@9`vTbx&Z_{aYC95|VtvN+U{k~&KwBwN8%a0U$iV`|Itq~ynt*D$ z-OvDI5pLmB;rwE`IM-#3DTc7!J_B-wmdn zAE;e$9!=@#HoD2eWTAJC4MIQTs9u2a)zc%sm%;~r@jNT|wWJ#xe~t6FhU{HqU3^Qc z`}#ncQ&Q4Zaf!~tU^W)L#A2$-j$z5Y32%-2MQq-U1u=F8c z;!08@NP@tpF0Me!XrO0|24yj5PyC*bidvH6C?e*`qUf#MSG^ms?e?`y+@)YCrVzpO=wW!D_IMD@ z%u8d&h$yM2XoJMocf%X&OA3und?_1V`?K*6P}P*RrpJxqM;s~Y>l6l+o)-grzB0wI zLz=kEzX7$&!Q0~t`2F#@hZk;NmVF`8`E{OKE1~Rrdux+hm)*{}*K2oQ-$`EOb^1cJ zOuCgNH?(T|iZc+M+kGnPJGL@+TIsZ`aRBkpKIebz^6~y2tybwxF82L;4kc_zxA)bk z8Q;z>9SLy(b$YpO+!*9)F`V-SIrJGjrER_~suTKIuMj^#iE<8>q#x7zi7GZ$h;EJN zl1ZZqh2!^$w>58vz+z*NE~%-pyS~k@m=rQ-+R7{#^9PdEGX{QWO#CIgll zqnUAzAOuy(DW%}&@-MK1(z4eI!28WG!)5paamavM*Zr1nmB&J(&z1v);=Tyh6hWPt zuhey_4}4sIekT`se@9g4)qHli-Y$g4ZTlu=*6(xWpAs!U9AeZ;M9s<>@=n8>*Cqn6 zEP~*gm}vm;4LabAgp8$W=Zk||Hw+5Jj&OT6l?9DLg4O2(6lK60)lMY`(i~GSqV;R2 ze%+gE||d+ z+S;9)9f0NlY>AFvD<5vyyq= z&G&)5;{j$k_up_KYaDz!KjdIAAK5%Xme9QNI}MJBG1je)0zbYHc~bZLT@*LqeIs1j zSfXL53f($G-#=ke93ZZK)RAa^n|Gzq<6%J%ywvW_$&1vD%tqV%ZUgKp4t~UP)GtfK zn}}5@WiR-1Fi?IDo1bu1cp8{c?(X(As`06+@frg85N2pld*|pEs3nkOihv^tK>dqx z+ML}#)llWgW>ZI-Db@D4eB?@$@s`xx_Z^T8fHpBk$k@s-w)4u5@gca!8K%M^6=o=D zW7UfJ@9sMzH~rOQx~LNEeO?O_okl@8jnBesdqHAM0Ldr>gK_=XY?7Hfkb#h7RsJ|n zP+o@^+5C^R@~(=L`-<*>UBVvCSbO=t%-g{r5;ReA9&ra*RfU9ZIVo5=wa}}*fAA zv<~r@0aEbOFZ)?soxT zc+u|@MIM2663m?B`uYcATQ{>af)t(n2FshXtt<$`ym)DLH3Jj^kSgO*gCS^xb?8O2 zzU1#EgwjEHG(MBTGX~C!pjt3&hR2I+4$mTXo{tTiTpoFA7xJx()ci^Zb`DxRea@SI0YECnz|AC}!^fQJmHips{v|oE7Y>$660>f+8CXJL0-0 zY=F4FE_6#abfCBsm7O1Sj%ioTFJ=8HLBc7$rt&GwBMXr*X>=6j)1X@Hm9KR7dDvx? z+1S;1tGw1S)IAPKx8A{;N&a~kh7S%k3ei(lK)AKuMxqPhITp?TZPAQM3XU#qN8ioKuFr*4fn+cGvcQ4v1f?3H*6Em> zeTDeXJ_r?h+F2a zpWKY=ANHI6FirC9?_yhADYg-tJZ6UIsxC$+g^zTaR_}Fy*Y?RFA7RAYvZxU9~Yckk+lRY+C`oZA$KdX;o z8MFgz+1SR;Zs{cU%_>s_ISe`p3?b)>{oZ=b`eY4#4tWVG5v!1lfbSbV`3IPyngYY4 zTW`#q6W7lyC4-Gm*?L@W9VyCK!;Rbdk`2SDoJN~sPp>T<=gG@7NL;(-``{uvipMLF z#7<1emu8|>ldGg#px=2v+I;jBW8#Jwwq2DkrkjaLFtARAw<-cp$LQ9Xy#ZM15KyGJ zd@sAzcTmTsDq>_2a3_NX!@Ta}4-=lb5Wc~|QY4E#UH(*_iY^f&i{RW>e>%)SS23l; z$sbujPse>}103^|&Z$2lV|EQ3%rDGv2?+MI`Q+W*h)j_p!7&qqi+`0-E-pXAXR)gGU z5`00(d~Y2zMn`lWUYYcfL{a=%rn{<)<9&_o-u(9rDM z0~$_0p$nwe(e1O{DcT*Gc9o7R`YWMW-J|zrv3AL|nw#nu=H#)HZ7bpv`Hm}RGYszC z$i~kXFY}2;)&xT=W8+%N`t4>lih(-5ux@Q&#ee(ObH8PBWoDs_H9KCfvHOos#k~Fb z^aN@o10iM`0`N-t{o|j*P)sXPUO+Qu~oV6lRK0 zat}cg0lk1)=X_8rct4)|1&xHw^Zi~tbJP4>F5qXRQ(?Q4gSenl>M@}1A#ix%t;S-q zjM^3BH4m+}GLE_ob$8?Yo^3HoMW>sWKi#`H6@3Zg>EuMh_)MLuCM=;>&#~?c5h8be zPfh=ioIm>)`+}l#R4D)c6{JD*dCY%T&47@(`#k@{goH!kC{#_OTO>GTu@9*`v;puZyFps zfZ-^~Ddw99B-{bo;BOwc^RA*iv}nEhNFA0<&r$Ade4MWpyxc7U9E$bxqHT8kMKF}t zTYhDzl3ryR_<+yRg$M8ix;9m$(DNrtmKy3r2yP?^+Zm!H&2fZfs*f~P)i#F4=kCpp zkZ_<*m=Aigg(N!bxkr5^;+oXD8wvV(+5gF?W>i+bk;~4>aoGgr{*vvmBwX3dpvDYb zD`Jn*WM;9WsK|6qNWK@5GHdQX%YQN}K`bxtq<`2B1D?GJ`SZ|X;pVBuQ?HD+rxQER z5Uf~mEZhGCVEkOck3yu<3Ch*Hh21ZV0~Lh|T|*d<9=;lJv}(PZQ!APj@K~ zmpWMB7hBH|l|~LCzd;`8__Zn3!rlMBR7>bSsMR#Cq>p&r_%q`Q9zUt6QgQpW&A~LP zG$@y&fySsrh?&jELPCSAuDt2Kj>IGf1$=nM_r&3}A0*x|?aGv2gTbHJDY5j;f9O%E zbk57JjjL4w-gd|!5sjxy0&2J=L8DT$S~Jy7|2gixGPm3X{O6=!bR*=+r1upLBD1-~H3Xyzjr;J^6JaR@l)3#ZsOil*2(Cv21bT--E$}Bz2q?KFO z9Dcy5yBO5JBvEoju{QhN}cVAn%ByAMKYkXjUNORG&@$<rU&=NcZf6aj@! z#}rrbTk3M=)y!e%=wq-J-t$Z6v;0qFWp% z=MvCKXCuaRG08QUNDLC_0!y`ivhKkj8$}Y(9+7==h*jn zB2%cU6fmSqwV6a&Rh759_C`}h$1Q4Xt1y{?jy*Jq*hQvxTa$t}ZydPv5~gH57w=Ax zZ@eIN+^SFPE-5nJ-pRZpPw}U5ni?b)$T0G&_0v6z?r&N@5lDy)^w{_{H>fjs3l1pq zkEr?#G#(-y6Nuf3xGu4ali+u+nMurwxrmOLcQ#a1`m{Nv1w~Y7rKrj>#i-I&UQMdc zOi#GdW2`vZ>$7t0LF((<1|-c;9`hObcaVUF3z5oG;jGX()GE_-cFSJaY_bFcUbO^c z9dUUP>fM$?Yj*`apf#r%3hJb@PCj+py#cASb)QoC62$gpGbiTOwdqIkb`&Z(L9Yg$-c(BzxauGZ#FRS}%zUO~9+xl=NL+bgv zM_XUZD&;)hazUS5pXzS#Sw1gVs4U8f%E148wsYhl@Kuiw!VU1=Z%Kyd21I$?=0-nI zwoc8=#Id4&YPaZu5w)~T1S@wbEFn8FsGdZg1!txU58(L(V)aoHI)EjvYeVet5>-gPU#lzhUbhV1 z`u|a zesmPWjz|DhRI?9kc^)VXQg#dv=1QDv=e&H%yn4=-lZ1+){`F0MLq9;hfLS^A7O>10 zUdRtNAG2TlS18o_@T;sShAfStkBgxi+y41Dq~#PmevPltQNVV|li@SjB@n)~pD5+u z29Vs7%US|6OnhNrWh^TGwarl-n{38V9r)e>-T=%D)|>O)93E2$?m6tLa{ zkpu#GMrg~yf3rIID%Of_KI)7)bjAXdM zgQ1d!&Pi?%fEcO);uN)4RS4z-@sdaPMXG!^s+WLMeF&t`6EK2c4oG!b!y}M^@)mz{ z{;6Nu9Tf_ho3A;!H>N9QJdpkpxB4@6)*;Cx=EfM;;W?^L(C*3u@e?5qT9Ug2&el2< zzAgA*qz^m)`9MEQBufGwdn#xvF@~H44=T<;oPjd%Ti`LX zM8*|}RX@m$c6o7y=)RTVhI#p0a##Ff<7lsco~?p$zSJJ4X^yK7v;Zod^3kQ%KLZ01#rj% zk`x!CU-xxpTUMyZYMi(ed&9))T(P4JEZXWkrIXzkqRz5@`S+wdS!Z;jCcP(CDWiY| zT~$^Y;j>#%94c7cJlB4UILD*%bH&2$aa#Op7f2V^b$$?<4>E81GRVU610femM^#~z z?mwP^0!YvBgnpot9+{4j2ou_xoT2_4{I`Cc&~PSr2+%JNsAT*Ool)k_lV2K0urC71 zEPLr;Gd8A~m$^EEzcy?0y~t73xgvN*2J|V0Ynh8Kh9_vc_Btvip4~9+N{d8Sz%ZRz zB6tWwYm7@XKsSmQ{e+ila0OINP1#7%?66Fht_FVdHzpgwva2Z@w<5&$HK}Zma|)Ml zC2rJxv%8%6YAAbH+HokHNGd^JYwU&`t8o%Z!nAR?tZzjRJ6!8XdSA|27JI#qbIHz9 zrKUaUZPlugPN)#sL`L?m@69SlBTLyeo2@etstT!kk)O4Ag@p1|7SJGMOJFZDNW)d) zfmn}_uB1!T_woK4W5GpgzuSCa#u7K#PC~*W663ULi64i6lil=6RI(?R|dR zS?!R9EP8eAgs)QLQS<3yyt~ZT@zp9IDkg~16^0$KQ|M_v+ov$tYrFCsub+oq6&15- znw)s%=3`qg%KvSMd+q8y>AXDh=N|>J9S;4#X7%fVBc^vab4bg?{>8ICaN#|`0unE@ z732mY3Rl_6DBr7PAK^s$;TI6S5V+|KLU)eWZjdQ61PIn9nm$(z8~J7ldgV#ct()pw zN;64wh}p;2Fo=qs@_^Xn8}gT++zOpe)yP=~g`VYpt?0(l@dk0ROLx0CyTWp9TyJNc z;q@9$r)#X3JNjp4AyCZf7kN#`;);5ufbtOcKCI^F%I8naD@^vn<%b!)967&pzu=Et zqq6qAU5SiKAha`x-5IQ^DY68ogNH>@jd}sB!k%lhSwhu6UoJHR#qYX=Z%J=Y&zSC< zZC2B{(1B<9baBz0O;{pnLqmphq7k=zP^)&L`Ob^(&NbD153LXLt14)^2r;qqcPA~r z9G+VBo`lVzS$Qt!z3i5ke&k-9yv0ef`cSfnMWYIbQs&7-Fe8(FnHPmNqM~J-W4AD; z5j!7?9Vk8OOd~Cm8wMu){TBou2%MC|D|FA-n!-2hGyvX5P9a^Ity~1%_JeY)x#qdL z2eeOCeZ>IK>V&Lc&4WtKvhvk_HRhYP6zyfV&A!b@xVVrmqfe&2wzCmC+vMbaY<1{I z5uLeM%6Ib#;d=tUJ5L7o-7bg?)ad(|`n@5UZ)~BbZ{?YpXK}c@>X>K5k2kwEh($Iy zHP7bitENZE6_Z|DnjZX!{38?S3z^qNLyhtcOze$J#W!k`NI+AGx+KgNp=cH zln&itR?Z|xcN3SX?$*cR-pab$820O1^^}I)(IDF~Ih`I~W?OQ*&NQ=jxw-C4i+&h6 z_S-5YL6KR~jxT}uT-}{RrE^eAvh`?W3+YlCNxIwvfIA{aGP|5AR@2|JXE(}8FjC1$ z`feyWTsruULd#RC+bXOWpgGN^>pQ3H(BtLcLClHpp-A_b0`S zp8aK4B}`K(MpamSDj)BQ@v;VMd86w^ zBVnP&GL0m=vE0hd^th(~+YEj4^5=|v2ls*2IT>FywtbZxY1N;NyLa^U+IB>L{0wCh6FyX-&_uqcaA;8iz$syWfDG? zYq@LK0q4ws7*`0=IDqu@IXP*NPEULKvXF$sh+HkQW)8>iCN?BrAp#++#SGFfS9!12 ziygi0NyuHkAv>|%OG38wsg>h^^z^df(ZkcZ^2C*!nsqI@CTf2?;d%!YOs!Mbh3`0vr}!pml&~Wj zoHnx89y^Y*XJy&zXEJKtj_zj?+uxgBMb$UCc%`mBJYU1z+>!8V7go%F`Ryq!W-m}u zno|W@OCtLP#Ujflc4(1qv^$-?D|=Jsl#ogVPDhF+bcrL5K(4C1eVO^jZ4L>JFWRq2 zY?3*s_pidPx{MU%Km6m-+{Fur+dk4$WH4OY)n|(?8|ATDgWLbw1Ks7I5%BR zVHx_tICOVGk8ej}+~uZL2OpmD>Ln`?2GTwHQLrKUfn{;f7Zr%V7j0q2me0X*N_Kj; zeWMfEfzK*QD{_iJ2yzeE@kPzz?m}4;@bJBESXo(VbN!?I{anEw%?=3)YHZU!Mit4W z=5)>4>F^ZfG97eTAQ>gc%c*U={TL91T9o0i*=7_aAG8KqU>i^GwEW9ti7(x=+p-h*zQBbQmOHS zYIv`sVw~u@UbZ`=n9iQG-IE>6~A)4QU6TW{mVS*%T0Wch@jc9oBS)2R%m zp38AR26pv_xm?;66E8UPM!#~ngOG3SrEkLV#4#k+Ip%tML)uE|sqds}o8?0Eo06xZ zWEZUsrY3lDVa2CT^ZdZ3)}j&<|jMW3F5l=k4SqvF_`8M3w0HbqX>6!8)WA!sH~) zw7atLvhM?Iit2#QaXuWc(8Fnu6#L$Wate<_g)^rJlB+Td=^|ov^$g0b8B0C+;15F-2_1-hBjvRzJ z_V>#)C~R(arT3SE@4gUeVCF62HebYIU%X#-UQdji_!juhPNi(wlq0iGCMT}VxyoOs zKHi5N|J7^LX+^#XVdXPBE~;JN^z}BMhUos!^x;p;oJ4FX2t}uw;IF~jigw5JI*nFe z$n0tt4HEqxfRjWGrTN-SM(#f!ZK1kxk$P7H8Wk$6LEbBIW9NY_m6c59T7Z0Xtl z^fY-ogUs+}tHvPN!!I&=r(WEXTX8$@1mACBMxlk81nQ*2=~dKTR;|1oc>B0JUkP2n zVEvl@*3;9&q#FmED4Sk`R8{!gy75?wuHGJ9}Ut7I~7XxqI+HBO1gm3IYCa*8zzae-)6Xt!#Z4M%O{&}ZqFosg>;;? z8qeKQHEf;TlETB5ciFo07bZv_bH(O9{cI#1B`W@zcN^lf7xF3+G6%Fwzm-F--AF*^ z{050N`$heSBFi|O(cN=1DUN3D&HZHW7fHb#(t^j&RF{>x^Nzi+upo(Nu6e}2QI+hG zWw0=)FVjzVw}-l|@N3)i`}v&Rt_A0Zc{s&N?ixxH8YclvEwiyYRWi&`;ppK$^dBin z5TXYRHWL!#Oe374>mJ#uD{Wo2^=C7$Y*kd{e+OIJEXZi2yrjf!Y_vDGGdwDiYcIwe z7sSRg<#c9S7#teD?+&>7r)5bSm#bZSeZ->OZJQ`j{7K*eR5~cP=r+(rS*@MoN_aL8 zptGfEd)PH!*~Z;*+}?u5i6zI(WF`pW2*TXkDv3&TzxrWbzC7fdqh`a!F3zHvQ>J)V z>{e(6RR_Vge5S@LXr)ZOeG3=RPYjAq??=6+AYbFa-*3iWXva|T#udyrKn~ZG2)wdMK@OoJ3)KdTnEbNXnawq8kP3wq`k!sflVwiC z6<lw;{rr<4yZFliOv}?3?G2~yCEz@w(W9wfY+f-e zh<7C2r0=WmSR71`kK?x^lt#=QdzC2S_FM$A&~NQ5v#LH7I=@|a*>La}VXLXG4wCqL zGG*7cL!v>_{Fk&$Rwc8qbX?A)90{kr-mRTi{sMSX#a_ugE!#%u0QF(q-{gTOcE74a zhf52lCE3WwA?Jg>h+8~duHmv4o%Dp>nSX>pouexEMqm(n{C zOOyQOfj`ARZa3j`P~zmlb5Q;3VHP<*zZ}nV#->xuw9&)m<2hmnomsSZ#z|YEi!sHN zF)_9Bvu4Zq=^;n*xY}tNHqVwB?96c$U+jzkonNjaPLMp8kDg9eHEkE~|_pS544x{kmB9Tn>s^G-hO&L>Xt_R;FdnE|7;YFk9fvnoT{>O0oNVh{+e&Y5RwSs#!VI72I+?Qj@^QBr#qW)n)4K(*{ z`a)wnoFm>8Pi48I?cqq2gg6x_*Bot;N1454dI^2er5Mwv`G_U%Q~9{H414D)TZL(3 zJC4YON%bX%<2^(8)#Ic{8)AGWb|7s~(0sZudWPP(^+|hhF3~VHFW2S|bdT~yN*b^5 z3SF_uD($;)2z`?B%EE;_s7_()H7RQ;tTQO%Ev*zTySni*{`HSHcX6c_95)86Um7=@ z!v5aA<$(#NT>|~eo^=#`4dx&f^!~T#O1+Bv^M9iXd;^9ghAtgU^?!wMfy#oGl@&>1ivJE<=TkHXwYc`U6NVAxl zshn8d71_*_l8H(zo}9AMFHYcclSnVmbFa2BdBNz@Un#opecUszW$)`f>|$%psRD&V z-wSRxZ)I<1Qy>6_g5W~|p_ReDz5^%q5*M)Q?t;&96!G|0eP2B;Nt@zk#3!NU_uiA6Yrc11(vCOy3wpf&x zcBsjrkFQ^qw^CZ^)39q_wc#!)x04NqGX=RRK7S;1MEKWd8{`PhtH@0PuC_L-YA7eT zEr;I_a%T6=-p-2ADj6;`Hj$2-x=}$lAnLen2G}6W9+uK~l~8XmU8!&$Z}+!15bU#= zv=BTa2zk5TBSeU0-0`9lqr>GMIwrcUzKbfo4LF^#`1%19={C#ElGn6ogP(blakJHE zVJ#Zm$WDtE)`>TGry7Zy#e-(A1_)erw#uijcuQa5><{RPB{wOS)tufS{gjXaS^wzd z6hHjv!tx;p(ER)b@fA@-LyE6|zQ`VFlc2{&H~7W>rBTm|*_QhHix6y_!W{KaD>k@eGoxbbT9SAUIR< zLgG!?t(#VLg&!KTbOjG1G{0K4$r#thNOQN}aNXTeZkVmLc?q@P*{f!~CfM4eHtk}eJ@8SQ z0g=NnJR#KI7}PB$`QU7`?N;-ALg@ejb=MqDKYY9U^Wp1UN6_`?TX8%@D3_u5cUnzQ z;=RYSNym;g%yg}0?CK9nI(di7_NY)a@~+pgf1GixQAp}Ohakh3@+dH3zNp>i}3=JI~x2v^h#hiqr?M87N(8z zOU5b6x4pzCU`sIlw;cbL=|cUz4I&!Fkgg zn9kb{Rc4w`rgt}}EP?|Y4Q_47;o5AwkMufu3j9`ebze9J9M)9G^rQEcp1bAOQ9}14 zYI%`s84qte9UXzbdHw4?O_e}Xyo%ZPVtZc*pofioa$^*|D_y>SdQvh@v&wp4Pt;HOfi($!!8`ejk9z$Z)N$CmlggwD3KIyK_CZNgpSQYfPQN6XvZN@#1pVJG2+J}aQ z3g%x%0dlx^TZ7{<#?s`|x3Eo3O_wtv{iJ1XWH*H{-0#t{67H^sDdmfo<~SHJ9le;n z^0%ig?aNYKsj-*lKbxq8f!MB6^X&(VZ=r&}Haq&n+@Cu??K=P z{wYsBtMsyhIR4~7m5Uz(o<3CcSkMA;hoE4(M(zzwaM;;z4E4LLfIi_;A#6VArt^_y zU;Jr=qP^lRy$;DU_qd0ssEeINwp}YFP1K*|4$zZXx}$5h0j#J3sB%@%%#jYwJ1>eh zVJJ)YO^g0M417+*5D+7apo2q0LtD_+x2iLgoFCPr4oT1bcF(@!Ok=m^r`A+GRn0o6 zoQs6It)b7AzvbH*S}sM-MMT+@mzQS%&kL3s(L51-n|imK8tL^;7}c1WDd_#~pCg%L z0kV|f*IVf+%RCVL-9hTt-KHcO(DMz9Xk2jk5nR|B;bc zzoe6W0E?fSHW8fb?ugfNJTBF|^dZ={N;Nee-56zSqgHWFjaXQ_J89(ZT$lQ6vieeJ z_oE;GdTsamYk%u&Y@58pSN6)xH5kyzw750NHODk`{Mj-^TqX9-)$I^7 z{k8h)urqzt0T05GQ?T2c?^hjUPRvwSS6c(`z_8fxz?@J)y#uXW%PoRuI^%DAm&$Rm z_@k?Fg|!2_XYYKitdEQSPOU6{zN$u0{8uly=)Ir}r*;7}QafPT56+eIckg2aPOzYz z1M0US(_!cq?yJq~n{gDpP2{P$2NQC6pSl|nt`Tzu#E3~0Ar2B!-^^d3J|Nh=Ra76+ zjNtmG03y=q2Eom%k1Ah(h)q1`*8J=1(>@+(v^&%frWrqBI%M)h;qtGjdsoYD zXg$60X8%yaul(1p7_{byzYL$f{D?{EmB)^qMBLQ)*j+!$!Z$@r%g6GSLVp{uHpfU) z;&KbFEzbyoDPk$a_!>BdqPZpP*fImty%rL=Rcd`g9csd!*GgCX7D-7-S=^92;u*voTdzZ^^klC$xU4rdSk>EX z33$Hfn0&IU@QxYtHrp3Fs2AF|tg`j@rAUHJ!79ppL}-p(Ndx=k{f-d`AO-g<%^((d zE_PbUqxbnUB`Op#rorbwTc}h4Dy{078~AAEnjzz2*d|c!Ud+=pDEjeOar8|}_x;Nf z^TB;-d3jk2AOAF|8Zs}=aIzF!FDp+Txo*Q|llt4SkVz`!@aWoWjJ@ie6vCBO;W7(M{5E{6#EIipA^+qbHIq<@{$f{%IYrQjA|6 zj%2x}VLr$@B6O*r?uf)Is+=CT8wt@+9%5@H*Gngh2hBMR@8oXQ%XDLtd)DL}d$Cuv zd0}!Sg+38xt)JtckeeN*?$$7z`IHiHu<}&UcV}Db0?#O*7vlC>@QM(vg8`FA9fNgs>y+u>AoMY}O6MOo z-TA`ba>nKm{&XzGR`wg?x&VZpTn)VG)uLY}O!QZj1X>GmF4&a)_lSQ($@jKmm{iv) zf7@)V&oC@|v)xw)C7CX$EJ%NWM0&O1m=phAR^fiq#~M=Tfa¬^&ndFqLoL?s9fg zuah;`W9H5Yw3J1?3-(NV`kD8Ir-z48sv|Ywb4g!}Zke^pA)ZGa#QD?@11WArxqmXZ zWu0s8%r<5z*G>VcQ6ko`Jokj6`K9J-h`^8q*|O<+Hr^X?ULQ|wO&5{ANEiaXIrt{< z@^C%;;k;v}Q#dX}qX!gWSeZH26~HcoRt!;MA!EqZvV*T8>VkWw?zNkj8M(Bbp15do zyKyn9?yH+3XP0F#(kR{LMiWx&;k0=Nh)zP*Ne_MJ!XQOWct>D_>x9snmtZfB9B^^# zdb{DV&oOl? zxLh(NQqybooSNd*+gBB9HJj<_UbXZ3rjk@+ta%21tjn^|5?EI_G|m%B^x9AvPJ&}i zqJeYyWp;~^k1Lz$6`*2XZQ1^v!tz4KmPL5f8KkWN(eySW!MKd(6-1ox9m=0~&74PP z?saQ^=k1bgxOKQwvIp6u4^&EpSUIa{llVR6uYozYxjcej*en|H@5~!}^qRRZu*ydG zA&DVKS?PRJC^riwM3nbgxBatXT|vuoR!JtBa@F}l>{4HgO%APcSgJw1CKu`1hbhs& zo59QVxRSKDB97sB5qn;F^V@-nj^waq)r09zi*O^HrXTPVHuAO4ZI0pJx3B1Sh{T1g zq&@9b`7VBQZsi@Z8z=l=(AoGYviUQLp8kXqe0qFzOKqpDvkybdtpzW>xGhN-)Qa1C z)Ben-h|JP^6vt;icSa5W*nOO)yU(Du^rU{bV4J}>-ZqZ-nKkoM%UDN`>bH4l>ZrKx zP%Vee@f*n#<{764SZszmj>=feKTB{dS0)!k#bNwsS8o{`kB#(b2MA=RdaPY|Qs(ET zc=MKOHr1uf=6r+usg(~t7d&rmo!6^=-^}?-=xF_F-u2!2g=NH>IxyK;Ks(g5x9gH~ z%gP8x0)rCnmDo2}dV8;-NgxEnf1fntWCURho+3y}qB)DL{KUAqY@T7ifBznYx@?wjm@~UE(r)!`wWwz!FN4`f)UKq+ah~rm9%m=MHna_i_p692 zHtnmtR)e;PdC*X7(vP-SyRh36CtVv!eAG1Mfwrg8`kCDl%GwJ8qLRoF#Acd-XE`@UP*s?mfXoI%)}q@aKz)_imz$?!SC-`&v(S^b>ZF3K5}(ey6&!N z7h`Ohfer@?{se~F=P^`j(LnIc^(%=u;C(sQf4@Hd5+Y3R1((I8mim*#JV zMl<$_w-0yM^jNr~<8{Z9yhz!(&aJ{Je9a{5G40Suz2j%?QRC*M^FvY<<$7CNm>L~e ziGEoNjyd#be$9_&P#!pe{gaC!i04kaj}t#p(k&+@S@@5X=ktRxBb zyGfPc46xsqbi?*mlVzM`yp1Ae7iYztS*U8|t2n!%qSUQIn5y45b0rfBr*po8H8A$* z>j@^s+RCAc%=w8cqa?uvwrNlF&?vjO8a4YtWw{Wu!Pv3CF!eIM?NOz_JhqIBtvvLt zGFzML$9Q4fbWcSucI@5vNspk^NS8%}5JxJzKr`t~X@%(l>sS|*VqvHYTlRxkf+w=t zm z@l!$_M;`tVz~4DU{gKlV`V^Hopj-LMTZWA}YST}QgIPO|Da`*6-B|A9I^2d4u60)9h3QQEtEG9IYia$F}2`UMn z8~no~YOh3cQqoeCP4YK*Kk^7(%zxzCu1^&iceQMU%Yq}`j0~oL4TG}8$lXv-16vBO z2zF-R?A!>&bGp!!!9kCzw#4<-K9XzwEp+2!GxJv|eh=qw+(}|LdIQP^cY5Ga8HRVs z=9#BCiy~}*hr^RiAY}1!(R6;Ovu|WQO{U4Ppx#B2nJWaz`^AJx6O~`H%_j2ooZoyb zB7a_Zqa!|3ZL0V3>@HY8wLdccnjtKi>gHRgV-+#o-rjB)FMRPw3%^|H3zz+`nEE`% zk8gc_++U-A{b!LR^gf4q!Ud_L*x2}ZeA-i#A&v(h>RdF@Z*nH&_$vl`70TqH3lmVN zF+$mMTp)zU%`NWc$#1I*Q{>uaFk|g@_v|J9?a?!V)h@Za_4wjz$y@WhGdQ&r)sk5n z*D1_sJO7)2rVT5(?G61kFr&SvD}22$UMn(R=dMJ`8k=@y$~EaUote1To6dTg>6MD> z3a|nI{G_!UPrJ4ad8svf6Kq^yoDC9}J-3G0r(v#ta<}gB)AMJVWfc{@DO5EXEWzXTR#*SAxK3tt*;9Iuhb}Y- z>}bp1<=B>}qa_jH;sYo9OYh08j>=!1UOkH6=(+czQW!Elt}I@BfWr6qo9G1LX&sLG z)RmMnU9j*8rG|#*X2uMRz*7HnaSb0`LpLXxv$Kfu#A#-7Ng!ghkMnc&7vs3jQ@4HWagBnJM zXyMFaSlT+p?ts`mM4guZ!&t|N^1x(>X5&Ry#BSfbkC5p3o9mY{-GZlI1>t)R^0w(G z+x0Ui1?AXg@PCS1mjt;NY_uz#=f}Pn>2f%Nk$hzN?4^+*XI@ZIy=wH{NNxnzIAjhqgAvow=VSzc%J0M9MDQG2oT2> zx>j7N0KTJW6V2P|r6_4kJuSDcLT5Z8O6pq{E4@qec37|RVZH{s^UEy<& zoa4t_K0%V;WA@GZvrOu4o3x4MW4SevEK_0gu|Zdpewl~~eo?$LXRV)G^N*kI?X<03 zVZQa-U8l9oPzIN{*jVw>14X~~C~FlSsOr7hr7q2tS<0(YC02;_nAWICwC3nI^0A9y zuyFrmZw zq}{*bvm@M3W12F1&s(?$;`y}{z{Dy29Pws4rJW~x%bTG@R9{&szAm{8iOw~jK0T^K zh;#tvy+2fbNZ6K@mj1~)*$sBu+M4W}lh34NWeE%R&l1SCkK(EP9aG@?tZioQ2ps=} z2sHyJ3BXmHT-EysFpE=ASm%U`z^o~nU%0(F>}C&!HWJ*G#;*9tF#_n~NEV%X?WVcND$9YS3SJ$Kw2$A(=uX z8vnAraXsFY=)-^PeBM$Zx6{8AP9&8dRNb8T03_%2qxC1j$LwagkI(bp9!`J2W!m*4 zz{!$KR#oCs@aWv!jNrbn+?$ecs%d)q0TPAMjfsz!1j_EfB!<7Rw7IUX*VL_QX&=Ld zD;qvvGmpzTTSrd>0{up3W0`He9HA5h2c_-b)_-XGFDLf@#W$_I-HlN52QI%WK2fsL z(%L^!Q=qS3V01-90dpm7>mCYyt|J3$hLBRi&Sab?s-}+u#JCKp;o;`b(Z*$PKR6&)8&Er!4 zM^x|sWT*en4d4HJ(*HqO{NEhR(M{t&#SbVXt{@QW3wcYvqBeD7+h;)7JNk3I7JoP0 zmch+?wM;iP_ttk22=V!V4ZRo`4?y&NfS~j11zXRx)e5kaRd9tsnYzXg1;|DK+2Gwf z_@l4yt(3fcqolX?@yL6px1S%{n4Go#%-XL&^nrA8dUvR;8hthrypwi@j7_uS^m0HLhyiv_Zl=)x69p{i+W3hvu(?<^qh zum8e&4G5?O%l^Wk=hCD=q48|p;^V(L$UZL%a&oi)vv8nx9@rxL`uZ+D+`0)Nuz65N zD0kEMSg83+vV~XHEG?D(eA$i78cjrCIix6CpwXpP1PBVU6Smrn7~IlatZo2s<6e(& zb2_8=uhtygYE5oVe*TSekHrsG1fUto{qW&W;LG9L){RQ+n^RNO*$E8vbj-v2vDw*t zz*@htttWgWwx9OE!9hz+Q&ZB`eQnj#a_hv5KuB)sXUl#n$y*pI#_a9`=`Mez_ga?H zcK3l4di`g!(X)brM*%|hK43+qwWko0rL4g>ATMvL4xTGSgf201Z; zV22&qeo^GT&7oEjY-nse3PloSxt>;5sl~;`T0C2CGqczl$b#I;N)rH8C|{pA-fhrj zgh=YvY#4MA2xq(iqBO}C(8l>CBqfh-dE^k0SGV4l+0f8%WbfX+l7$$65B!(Vn)PjU zuHd|+q+U7Xq}0v>2m8N-*5^4L;EaB?wE{rEhR{NMnh$t6j{JNd-`4wVfg1A&4u?}G ztU_731!TA&w|eLEd@Jdutpk`Fc=h8T?@t#m3IkuVv*+KeH3B$iFOjk?8^S9cv^KW~%}RhOf|(~O1?Itd*E@twd? zG#&y)l#=4&!A)Oe!q$1)=lO@cJRLdoY>E|OXviwj5)8t%qi?1`TKG5j={BED(^Uis zddnZe?@6{0!8!|T3Woa|x1#szSqTY=Bbz3J^_FUil-kw>0IFREgSAWsK)|5QDH7@3 z5}W5hF8@;{&=>LAQDR-9&8BTCQn`I&!T)S))$c&8GB?)@0lhN-+k5nvjcKdhvROr1 zpp_d zF{|hm8nAIZeGms{2g!>gV8f_~0NHe9^(e9j;!HT#DVnV;MCBIq`a7Ap^bjLTKqi0jI+3tmixRu&BSbf2p+A z*>Ph&eP~-d&}0aZHYsDLdw}w2OW4s1ljgbL(_3-hodIbTU#YHcMKcT`lpWJrdm3>$ z&K&sR9`N+3?-*wlenc9I?3b}rf>Ebl4X<&Jtc?M5Fx?bo#5wxl0bqPb{@73LefZ48C(e)4CjGHxWl!=| zt+ZsDRv=tDLZa8O&qRv$g7|eK;~COblBaJv4*otC9M^nwuX=!;03-2($Ojz>6F@|T!Z$<=KeNax^nq~1Wf9)x_gzj}}U=<#-?$y{`R~9SF zlumI>k-;-0ZyW-vJh#%7?wQ-!Ww}zviT_l7hxsq|TitVq&{i@T=Ywijax3zjNkHoo z=YxdEsc>DVLq$7rY_9n6tuwF^JBVTpPyYFWJnL5KA zzbC_epAV(g0WEWc06aa}-lWdX zd%wErwW}h^ak-yJ8zc2~i;-GsFMV%>gruM`Kv@xhgeTY=Bd@k($}u`a$^V?3vhamj zIjOif*)geJ)vEG{8SG+KR@M^w-42h9M->Zi>S}~BeFuf?)RKSfpk{rSzsNl5e-9$W zLI+Dg8?hk(s?DZm=1irn}J=vRC1f}VF3TCw2(7m%1*1YTb@}DRbzIBF;Z(<>{=qTM;#$>(; z-=O^QGdL-|%g=CEcJve}ji%BSfcM0FR{+DUWX>vHA7bV% zSFRf&2ZvxKH9I&(smPiB(ZJPOP$O5y$>OLU&GrtvC7$4qo@EyZ@jeh}Uy~I8YIwwM z*jh~-?n*{)nGZPpLhBQlq=srN!wH&EEIA#A9f^F(= zW*A;kV*fS_S_FS8`;Li)`zrU(TpG4IR1qs>T58&GzP9P{q$plrWoe>VJL2X)G*sL( zZ@GrGhadb2PEs2ZU)#KG4E!{z4_ko;bh?sR3E*lDeq-hl#{5T?%Z*Pin9$vwCU@uf zbzy9P@RZOc67zhMY+TXwNH*pec(m0&PA|k<1rn2zqzf~w7~&?8;x`3`FqSL0qT5tR zEe;v#k1pCAYSfltOk0?;%q=QPhL!R8d9&)}yW?pmzj6|5c=L@>K%Y$xrbSpf=arZD zF!<{oeK;-U(w;>Y4Kbof57hrqxc948Jgp-eCM8z8J@YQkSYmp%E;LoH(O{$; z=Lxav2NrVr1`spY5bHcUeo7%5>E+ccCA2cCoI0xJ`0Yp#kLxm-M0d;Wn1Ti|`e7^IFZlhPMoQR#4hh82%|S@Ptbxqv z?4nKe0cuX0*A>K72o|WFys~ead%LRNj6h!=yXc)FWcp}mKy&D4%dd_b8@-P?E_IpP z>X{s)zsn44yWy5Mj>fjYs`3Y&m4pS<5C5^Tu{haetOsP+*ab?0my&e?#8fauHH2R_ zn?fK{G)}(arbNca+n0n3pn_KF$iUGS-4PZX-IQxOX3b3ra+^Kb5#Cf`O-#>_uWib< zYCBm$ZS^$F(S0+Jidizy#GSeOksAj z7iqov#m5@RH~dvXxWsK`<>hUi&Ti^c1cLRKi~Tj;JKwe3E^iaaAY9+AO71*FdJr3| z-QUTOQRzDM_O_H{ZIFY595)TM-?Mfm*L1gvVWZ-s6j77W!)u)R`j>XwS&n*S^&6aw zZV0o}iBX)c&#W?VI2(2<=uXMA(IL&iiEKmInbY1I* zqcK>6a8io_b*M;5+L$|7Y$A?otKg@bq_pBc#td4@W4Wsyl4HW2cz>on#^1*sqAA$5iJ;Zgai+oy+}TajrdRDEwQ zucmlStUBi2ccGCZGlODwMfk7Az4b-0cXg?YmFvTMWZOqDw&^4I$1=E>A_tLjS=6r@ zyC}M4uP7%6y97sXJ?%+XAZ6A&`1)pNWwC_-GkoR9k%xG%M{`!0C!Kl(tGZRqFrno_ z#EaF7MmV?m^EWHQ1#BjqOlwe@*`A|>A(J6z?t*U2^|2YxR`vVpkx4@jKWUy!zd$u6c%9 z;-3<%e8glf#aG!mBljLPXsn(G+i2JEyZWtF6SliLSAyH?D=VH3?L`^8$J)e54j6R&p4rIP zF;of4*i-tV@Hlxxh21+wtOJ%)e{d*_*iOxW1EOAIV10Cnn3Hl`9|_Y&MXx8me>dkn+ntu@cKl?}nsTxD#dk%F zfA#9JdT6yS_DXz{P05u(6>=rNuxAs%jL0x9^`;PLoyM4Tc}FyYtIYl z1S;-0T{-vp3@HT#JKw8`yO3pv>~}kn%R$W4zq>9uMkB`g{9N2$8-{5)8;^($mv5}M z6+j!a=?e3>ef#~toJQX?7{ZDmjDGG*l*_4*rvCS74<~NymV{Gbw*vRWc?R!V^6+pP zMPpEux|#hHM25OicFX?nRDC?0uJ^RQm$p7i8K$&oGOAn?HqM_h2zj7i8bLcrEFwnL zzSlriL`-Z>$U-*5i?t~%w>sgiW65S#1k6X3@#2+z1_3^UKyFQ@F#M%bEc+lfWiHMyp2teO)Kk*T<1VtwNB#*)rwA=UvEu|F8)M)tJne%0KPk}lVE zxd@B`&OyGNyyOk1u`W2^d<+i>*z-Q>h4w&}1VcHV#}(}%B_}t^rZ#bGT)jGhS!?3h zZa7NY?)KQroS|{$Q1NxWxs(e|7lk0pgLKVDGE4XP&ENvPeFw2#V7210+}zw$`J1;A zm$}$=7md<;aYOWBB0CG~Ax$UNE4!7}U4gLwP65=lw>kk_CWa7=5#w5KWa96Ye20~X zyZ{M0^&Lx3aG#k_AdPn?ll$k`#gW3g`@)lLLgwC?=8FiS*oxds z{AuWo9Y_Xb=nTD%#gYbR`owAgH`}avGg?4pKbh%a*)~Mbbz2NDEp)iS6WkA z)-K->XJBm1xkytS=o#W_jBn1SNVQwVjQ6KeX`U4uYbq9SmstLF>fdb7fdDPHy)a>n zM#@ssjC^`wds|poSnPfEczcc$AgB225ewlJ@cIl&y%4)ybk>={z33d6p(tS7k32uk4<&w*)mcL`}KUCX;F9`>r09pN{M#kuXR> zLufJw<(kcJsIrj)DzCM62OsA2^vH4Qg>=M1ahp}oc)wkCv-zevD9S4;(pv_=Jas~) z$Ks!WSSPUURunmMv7hs@NS-dX*K1b<^R!xs;I0Px=`e)BrM8ekM&<4doCT5&Ql>mc zBb=WF=Qx#W`ufzbv?6C59Jm(L@y7mIw$jSIS7e&pAm8Ff;yH(yIN4y;>Jn`~$Sra& ziCc6_>|p*TOpyU&`9`w7Wx7m_zT4FbUE)k|N9KTtf1g570oF5;l<3x3nxTzm0*s>C zA(O17C5~Czy6Z(mYWqC?U%qNqsW;O?2ETl<$JIzaiqkD+!%72z@{U$JN&wG&u4iNK z4ty;fDeO%nJ0&|}<oGPeds^6z4YS!;u_W0Qd9VJlBT=A(3!h3b zs$c0Qs*-OcBTFLED;4&xY^>x19T2*if-)&~LPU7De?Y+gU)GyP7lS?5Q_2J6z7n(C z-E?m|od49n*g0k7Bp+;M)g2?&ctWo{u!`Em*3|vTEZQXcJIkCs?k;?(EO3wLZEkENd51*X{nYS7&kMm`%{! zD^riJs*Nfo8e|7y>hu!FkIk`i{a<)cwgk1UjTDmZRJ|E)O*xnJ?%SajRK#L=UB zsC=MTStFxLr&$B}d2Tae z=Zp8Zb4pGeQqIdM3YUx<9lf>N{WSZBNhLF}Lkv-kUko+Pei#d}<#2q_xHGD#be?Q1 zF{OWk<*!32*`#?vPZexCvHj1Y()JZOt$bZ$8C}%yjk0!Q40?Tppx;t-_C5OL!=F=9 zatqWYMKPeYX?u@J~ zFA;BWpnyv)_9w0NK{}}k{W9~XgMJo2=&yU|25u#O2yHlRuVn`aZ7AWPwn1B0*QFG8 z{SEg@WCGN`S(uxDuPO&>o}-XfCiC;4*q!aP(WxpYY3QY-z83%-?3zjRUj(h2TU?wH zia-opE??Ufd(8-A+KspFU%}@ePp*sQ1P*zVHU5`n>}x1=HXhAK#6rS}sP7+@#8%{A#$&I0rbI zoEx3ow>{WJ<>f{_74Ag~P;fm@fm8iax=SBy0_1QTf9!6A$mu@$Z{UFs_EG4Y_!5OeK1OU2ez6CRh3TLr_jkATb(+52YhkGTLU|O^QS-H z%T};1MhUi6$iDjY&<)lSKOJ87%1?pa%Mf;#&L`OyAY93pWr{I*b$jvSY}eg*R6M;h z{#0R5?kd_HP}RRB#A=C#50hERjDc1O_%&*xOmgc?n>$^sr50gI^zPrk?;*0ry*9;- z`YE42T8rEs5C*IPKTX-2Ou7%ax?jC=b!lXLh7QZQC-2npO+MfO0zG>P{K~s#yw+%> z5!Q|QhSLV(&2%sz$2unih0nn`cV>|go~0ZNcHwe+d+AOa4(|0EBT*pcH9!r8+Ro(p zitF*KOFZXxgI^OUq%vLMh^(#K{*dlHs1fxCJKsBpUXEKfL${)UIL6X@RT#6} z$_POM`la>>{E9^u+sRc*p(TuADyV6I&$L*hFa%DFj&d*rP!E5faq3FB5m&geP90)k znfn7A@X)r}__oUt+?xXZsSM9may(c;=@W+s#5V=O?60>5i%<5mC`6iuzdyHe2!WT2 zUE^jmQiJkM+9NCHEYf`l&?WSZa zP8_*2IkEg{kVQ|(5^6Dpf-UZrQBzbVLE@;FdNaYPD~Zf%%S0Kd%*R3^I&+Fln~@AJYVC)Q^IJ|azZ zW#l1l9fhJ}vgR~HwVa>b881oO5vV2(svjF4zX>Ex>C>xrQ5G~PUL`oj<_4p?=y>A9 zO6@F3+nLt)s+rwj8C#KH_6rS)j@FBFrpvmFA6O>p-_bIikABN!iP`&n1z?_?NQHfo zR}6=oRcKf%BXVwU$TCMjs`}cTY;$*TCAxvbFWzAUaIwi5K8DwSn^Sk#O?)i;CShC!5xHS<=;Ma^o1uB-}TggK&7X{Fz8)cJ0&xTf@2O#1vP~x0zh+25i`d zgq7fxz?Gn1Ggdy&hdfYBGB?VXAMn$r>JgB?=~~frld@}&);PNgBb_Hd5=Ylkuq3Ib z*7ymE-;@3 zeCu6=KmFeCc_JO+SfOs)TZ~MEyc6lK17LiVnXef57Dsj0KfbMQONa25RU|%Lrdn_h z_rn2!B&E0-n=Q+TQs(|#+KN&!y%PU^WV~In#okR{uuyhv0*-Gh(FZ?I+g^Hq+Dfig zq5UDY6W>WmvOFK?wEVf)e=3Z`$s253TETpsvkfDp=n5Rw=NmiiAyxOJa;)wLt|BVo6t zXPp3Jd|X_^cKU|pQUBCH zJB)_+YG()G&g*VK4@N-&d0c(%Of`p}2eIO^_knJT$AMWw$f2)MmFiG-0qpOiYylX3f4GpIt|)uWQTpv56`yQrEoh_ocl8m z+TP6bq}rqzv$kyaP&T@$;_%mJ7x_if0weB081Y@>#yWXDFb3-+{(rGfVw91d76HwQ zGz}!DwvnH&D6BP+GiQ>!4Ie zbkXrJ#hG81a3E5wu9g|m;y+@noX_UZd z^rd6A=l-kPZW@v>HVDMbsjR(0{*=dA`@jq5b8Duh+@(tDQomKs*#p07x3}`>dgzPZ zM_6-=$g4%$?({tI$?Wk?^F$d9W@pt)&X0Hcs?+|Ws(a*!-6#F{h#@9iMkba!}fZKMxAMId0nyi0=Cl5b@2T%1_gNs)M1dErEPs0nsqFr!i4QoK254$;&)EOiBf)wuBz34);!pkduslLBkq8i&H}N(_hAZn70%v z8>>4TV9DBa{{~R`^{h!>ED&wCd|T=GBPZ+wVO%f&I5uq@eMu?Et( zT(mO-)HWCOuG2?152G7@3&Odl$uCn>aTou_3}D`Xfr&uSpFBFWcza75%@xQv??gGpQ=VDsG7GZ%$@kfUMo{)_tM>F!q&HRX_ATX_Y5Nb!5;8L^ zvdwE55gP*>&a$9IPe=A~n{Fu|bJ!iws-&%R$V#7XwBGCu+Y5-&sSZ zJ)*)_V#Dyykn!{;)*`bSaV6D%uVLsr*1!c_UG`YN(_Nz}Mp=O74425v^vLA2g|K$Q zyGo&DID*h-$V(p}Wn@ATpRKQLl>DktM-$1Y(=g$(g3gaNiRQv3j1UvM(WM^u?^X(n z);zHNywpl^B*NmT8eO=@JWE@N~#iv_wPliYBCKn(@GTWozFrICU}^~m%!FT zD{vpZ%FA<1M^~2^uOc`v+^x{?YR`V0rGgqOwfKw|KvlL3^nhL9MXy(tKL{#(Ecj(o znQ|>7*Ai!ld2qY=85i!270qagW;5Z{=w6roSGMYTx47=&?!k6FBekw`K7$E6a=*9c z!&$u3`femrKRx1yHm1e;j|BG_`KPxkW7xz| z8ZsD*^q&!|y(;hA%7p3boKKhOneW6t7(&WlPx0U&+jCHG@33_H?Nzq<>HcNex<%2Z z!latB!Fg6CaM6&(ViEPyO zts&f;3zo24Od1g*FC~{hGsqqx@@mBuGGh!Ubc~pyObBr-IwM841zx{gfTv2i(d~V2 zj^sCgGq7+beX?7A7`G?1k7+Vr;Lg&7exdCPfi)5H&a$!~%L+fM^WkUeKgibjajA2Q z`GOHNzL(YQN=sYH#e0i;6{|fQbS6~QhUR~8cjxc>t=3g`yz2YATC(=%*rOu~_Kq`t zU@%pZ2XnAqH-2u(XbzfK9X`iOdVN2hF^ayKC)JeHB4t7yK(3qSQa5zx(p*h*<%(Js z%V;rN>;AMm>PDDXCN%k!UtP|cnnIO#1X$wZEP{XUxBC%>&4)hFT0DBq`&R#Nvrc-N}smT~v1xX~giacBZgT@KTYw^QU+tD4r#n$})${~jKs zr6V8^lXOsrS$?&%d99ec@Z271r>zzeEAM5i7mJQ1-vg@Q&&YM97|Mmi6>F+gy#6HBv~HWq;gj0`$0Q5s z>e@PS#r-FbMFyADyKafzxnd;DhW7-dhNJkW@z5^(U5*)bUr-+4vJOx7w?(4$Ym?Dy?M8g zkYIbI*Q0CUu`K4Wp~s;YUap6Bq+U4DA(s;8b?pAWjI&R~2=}|ex5<~O+_FHq&zE{EB^jR;G=G3tr4~`VV zjZ~L8tt|y%mKT>hHLKV6>LF42EKjy}o6h{0bxj7!Ht`n6UEFeI z&(3pOH#WsVRuNVCXX+n(JA(J5d>ku2nA(VXldFcYCNhsV?f-J1v{zy$Wl{Wz`rBA1 z;?SJlROH?+cVqUjqL%DKhUkhE0eS{l9wpJOcd^*U$Yg99a$kueIyi31l#0{t&)~3d z;2Ax#6yI~7{p@!*H;#ey zekHUpqKK0aPIb9|w?Wo%K+Q6;KwWpyJGdlrCit3s@JwzfH|?JNkvB`)AsA$= zW+(@a+?}jl@l?HjT^IIHy2YZ}krF}5E2WYl>$Xd6Dt#063v0@ckVh4rt-me5?$l_A zDt^i*@U%#Du)9SrqqopUyW7slv?JZ;+6`{afRxX3_mJ{1I)*yPd=GCNYEIw>GvNh` zF{}x*`5QyCV8dI-(TUnioyQEqsFw(-GuY`W6lAb75y!zdP)g|d0S94PeeAjsADvy+ zNavTfhP;Kx&TmOitt^2xh!&|BQAA89!l9Q#U&u>%$u83KIr3Z@nZx$IXIJ`|2Yd9= z1N~685Wl0e9;ea0Py@d-cQ-JsaIC}90aOK?aIVKE%_{WCXWX>@9+$fT!kROnkr^6D^21yQrP%2!>H2S2lTJjm~RyiobH? z?=_)uz9sbiBA;lDw2uT$mAWp3S6|eTjVl{i!&dpHyf9bzj|%@fNYbX^_>A|0+=e=iV<_yJ9Kp zmi|6Q@AE>sjHLHoViV7oiX9Dmtb_ytl3bANzY7@GPRyoh#rezr4ZAHNq~FEa`Du3? z*}%R>KD$xDFXeZ(F>zht;7S{vm*V3NEVh>oZO5JQg?~BS*U2Xo3f#|^9SrtGc^7ph z7rIDt_+1OaR{L8XU1=};)!9=68+lwz!LsB6O;=blrNW$Q^@?l{v}*5aXN%{pZe*L| z9;^=|zC@z&4k|`HQ5!SfNM2ui$n-Sp#F@$8qbt6?mY7@j&WU8Eov^!j4DVb}@iaA) z+j|+gMyfW77i;*iBJh$D)<7%J4!GX0oh!$3^lNlDC>t|pk9Yff114J`dQi3_&&1nE z#eqLAAfXey&m#!O6+cuyH>A<2ID3d3YQ9pI%b0jBcrM9S!ZSges*QPJ#5T}ebS5r9 zqK}#wTN>oSZQXv8DxN2EfQr_88LCs5MT%_vlsdOF>*=piL8 zdAs!1($BaYq3*FmD2WM+Tj4gP>xp0AE?G&@`0$V3f1f?2{!81*-$@e7u|g~aj*ruA zU{W#NUr$i2x-Sqwz1={i`;7Dr3|h~NTmc_x@5iHfZSBoJg z*97TGiOzdo3`8go-E?)sY`tLh*4%sRYWiMo&MKKvw|<8dv&>q2$-zgr*l|zbbot!z z2RJQhijd543^MfFL=j(ALYj{z+sTgDc+?gI0WbBHDR4cGV|ah(dLq0eU00Ag^ke4BcW!rlk$*PE}gC*(IK>cSNsy922?{tjVeQpWFsr8vi^? z1BbA9R`$V1MK5o1hnRVlGBO+38-N`7bV0yFM`)aZ6$kpmX%Av!QPyUqr3E!rhu(L- zA*8oa)W^fz{>cV)bW)<#dc;k(gyB{4j>%cJWI#E1IOzp!(s^qW_p*DRc8<#&;{NVT zcWe4|0W7V~S%rkuiL-;d*fxikBQfRXs!X&??%8^Ax?)2hCQaBTgB_er9+pSQ-S8Ug zE~xFN`V%|fYI@Sri#>>C z@BQ#s?EC-Lyj46?oNAN`OP4hJNm=z_+W`JYGB^PN%?^Uw_fNm<+K(`+`(Zxmx+Zb; z$j7Us$I2%H89XEfSsqRq+&CYi_))T)q+0Q-`H!Ptc&`HE z^%1=6d)?L<|AC5kJLd1n7D`?mI?=64fZf7uo*}II2!Tla|JeHSK&bcb{}H#`7Me<2 zYf(zdR@s*pOG%f}QmpoveE%RC)Y#ZV1y$aga0Sw0^!j!3KTvgifTqe}v4;GCP~~fw;#CMl>GLyb3KZ)&XywBg86Rk7#LO}0#Vb8Oi{}T5qOMjUCszy;Fueih348SDX9|6ioj)5yq7Bgebn}8nW}KoNDENOP^j;V z?#=D;g*UuI5uE0u3BBgOQdyZA*9zfOS-Am!3m?)!eWd1jF!*<^0xCzJ;TY&XA%qGPru+R#`~WpGoXWgwx9x~(+}#HIbRrqc?-2*yviwK+PWu| z^18XYdPF1mo{zKM%2=9#@X+$CRoHUGg!ZwI!;WXhmLu#dAn3A$&**>Qj-~SeeIVpd z<-RjDt*$z>bQT_Y1L?lGb_Ju`8qEJCY<}53-9#>6)zJu~1H9Vuu@!j9;h=Zc*z7Dp z?|Y>??Pw&@(>x`&) zTmXn+vZ{IE?Q*+m_=80-nZcd2=W{rbRoV12tN72aZ~|RmULg{~m9S-ql`Oohv^@Kz zw?7bKj*3F*;F-ym+?&YHFFsRL<(SZ8DRm%1+2Hfe#@Gv8x2)H`|7QpaOzF}Uy~CVH zkL!&=s?i8fB#bfTYV09IHK$hZ3S;n z3aBIq)&GV3y?W~ZZyO|tKKdW96MY}_^gi*c#nhd@|Mvce^}82teD&MxY%>n3=o5-` z!&}9SU=*qtT96}!N)~2U{-BYB)J^f+@GfILes8b0Am?jX?T%vYDO{>ZjwJ3N;DEm9V(p!03DR3~O=IVli%)8UPx6OPn_}0Tat47wc3nX6umwJ&%5j@9FY->jbYwkGJ0jW$9-|YKg zUKi==lW0e+qT@ZmCoGc1Wwaj|i?7}G_SA+LO6luYj3~Z#Pp=rwD!Xo!`)fZcaN&{R zbX1DaRkQGY?ksqXgV`z3)(hn?eD0Bb$E>@ganPy!1x*4 zva!*VaM1CAtTE=L?sgD1y`}M`XMzqdO4N=+GL=|~|?Y$7KF2=j~OQH0+@g8v_ zpPoNTV&?~rRQi4HD!bi(rl>;NOG`Ndn13>UOZ#6c?29iB$2fW2qUtVEf!R~)NXk95 z{P9?lz$$;eq{49NS-;aiT8T4@UELKvy!Fm{q{C7EUDigc+NFM7Zo-87({pSs&Z%6{ z!E!1uDx|+T-gJ|hs4mB9;p4RHPj{;1U$QF;UYNo@&dYZ+qf8YB$8R1Z%9^Pl?`vVK zuV3&Dy<@-iaTe4t?cAgKHUYS!QWNzqxl(dj;9Uq|E zIqRKaZdMmt61?o{ewpO*Sa@bpGD7y!Ao@C^3+cYMug^5Nr$w6N zOPziiT5R^BH>jGc!$)Y^Je=s@Ywe5NA7vrm1YBgLUzoUd=VrbUvhRJm)r!PeEvH55 z{ND#FQDNe>0~d0z!(%-9=knRS3VVp(>ryvkG?0(%bl@?_VV+nn^txQ1XK22oGs;`J zP=_0wpHK#H%W~ zu_4mYNLZ(#U_BEFHn9svK8}W;y5*M-ICW(jj3o2vAB#>k7YFdK*kFN(#w z?EcU_J&vmmdvJZ_pz$qdzy2$EZczTP8vgd`%Hfd{J*SR51`}`F%%Q4tvVY_pR?VKYyMf(?J$66Mz4qA4U z6Sp`z(6OEBl~E+#=trKd9np4wwPf8aVtY)n&L+l=kcLw&$&PbRr?#Q3%AU?TC;G2x z+C#vuCnN>ut(hTkdai(Sv8b%|N*kK1a8Wwlt)<9Gd^Ok+)H<-#IV~SF zpRM&F8Q+s8Vme}~t?jc}_#Iojx?T-0SVs6%%y@MLFC_oYMbT#D89;`?me~bB8ve03 zBwR{%gM>z<2|7eCh_g=J#re2fbO`E=8Jn9^OK#n|f_)9}s=cTQQVxoYsUVI^vopvP zQ!$>AzurSn;TzSj%d%D%$J{~+Hy=}pBFR7_hF{^oC}vgyn{!l@+V9qRcJ_iRrtZnl zdtEWTtM$Z6i$}rO>gjs#);s}Vo))-5hv0@9*d~4tfdWjDgAnzRnKhPoePNc7K&Y*U zKAuM;%6Hg1#`&6UXWWyq8`D5*D6qT!U3h_}D=8mic#GfNt9Lr;(*m`Sqw9e|Y?R|@k$?-O zFI{0LyXcX@^pQxvUToxj!L8XNkPio?=R{qDe+x%@tQq9 zv&J_j?)$H^jvNrUNJu>M)VzGEXU)9Y(@0*s|6e`Ny#LYm$ly)?8Rc`xMR zs)%+!{fyqBd8^x`u-Jy^hNOR$PS3OFT?NlU?ym-gb z_fLLrW?fAee2@_IA$r%5l%Pr3Y~_U3kzi$e@y<)mArnvmeurepwWc2zjmNcof0SQp zcw3&aW?Ycfv3Nfyt+xXG&!}4-l8DPNvnfMA0dgKhLCKbWsAuJw-CCmlOuC)tL%rhd zu6D)E9Q7`Z!q+>ah=+>~ox#~n$n5AJRMFVy6{oX&RDsaJ?(bgQk;0mtVLb;*WwRLa z3|`P?DxB22nWdP_Q_kG!yn}NsTfavAm=HwqjS1Y)ygT0FNe}uFB;EF*WhGk2c~JqA z>GyFakT1#9fMN{vpUOkVp^Ts`xxMwc+gdlv4 z7AVNEQ@&9#D;L#qINJx&1tTQssb#AEbwvS^N5QY}D?X-^Wg0tTE?Fr?rJ6@CAp-65 zPu*9IAxR{K?M@|+u#U3Bx{4#|=(kl9s>5&1{vf=6?!{OvixY!lddUXo*`T*WkA#(3 zzx2t&ELgROt;)bcXQT- zgtb<5%YnsAEZ=9*B#mc^RGiW9Iy8Ak2KK*c>E%(p?>c9RylRvaWMy>-j&_LdN#NEa z&q}oY`jxuVa@O4+eON&HHTK&gH}Yg* zgb_d}_Hq1w=_cMLNULhGFuNDiQsw$6^RmL>TM33X{O|qv`}op_9ZLz*bAp+1hSS=$ zG{+inCiGTEyqykEhJWXVMlrGr%w2;S9 z`abmRiwgknVi|+>RJ^4lnLU^;sFf6q7HZ|DS!H*?GOu|G%b_cpO9$I|mbklGU!^=f zF*7F{Wz^--A$Tfj*0jPI165pg&PNG35Hl#NRD~51=7(1lcL6c zz3V)j{aB#hyOG?*SAUS2$E7jE#ieKIlb9z^uasU-E;hHOCCJuL1rC1qXM9^uc6M-5 zFz1ia`-Jyd8&cdi(Lm5kJD#i(UDcNT__=_BB z`y$R}Jom1}V7?)b&u_Jhd~eh`5+*r)un(Y z)8eU2OT~;PvKka-(Yf2~MotYp(=4iHaXicCr>qI2gwBaP?;Z#9s9mQBY8G#se9n$q z=bge-us@Q$;n{q?YN`ws#+8`aoyay zSD=2R9ufnJc{?0N-#ni&8eKo;>-5bNo@C==c-Qm)YRU-+<(mcX5Xwy45=|;$y{kSi zekR)^P;xL0Uq@Hu;_0u=+{1&P-RfCK_f|e~vSw2*;34Cvq4gCj))~4W$u^b!1(f^KsIy8~8aBI#Bw;y9H@Ufc zHsz=HEupA@_igXRXC|F_4hzhT)SrkLa*1zs7|mRz%Kf>nNgo;L>+2m^E$`22QqhwF zW@h~g+Bwts%DoN{YA+w4s%=Goi z=euLy9+gpGPqBGt?mlb#`Qheg&8q^ineBD|Zf5ODGc=E>g$hcK?WpOmBsVp_yX(O7 zC-IPn$r!!qeNr?1oFNlwdU=jWT`e>8uv>ejUzTadD?SgJir`%@t^qCNr>A_+kgLAa zApyJ=25VQW(js|e+yTbIg>aF%v^U)o|B;x1{QNz14~=MouPIxlW?sf3?A97*QH8K& zZJ6SoiPnEvd*mOsLx^yS^PU(1I5Zy*c#@#0d97^-dvys=vF7=Gu!Yk-GV_V(z1reOul1lzCW zhF68CK12YVg=Z$bpcc!gE6}$`9BC~8ySB~@p`uXl zo+Vw$(B^|or)EoAnflV zqq^hvw__gZ6}Ng1T{r4&S%d1R;N5p7kp&4Bz#h&uDfw2cbq}usRY=R%;hAw}8_&GC zM%W#dQJlGM^yI>N2&HcVdRK%)(FwBTO4Vef;K+$s*|Q_I{w=(d7NgTFN*i==p#pm} zcXH=Z{M6(1u!ihY=*Zz@K~He56d@!lbsV81mQ8Z>!iz`Z>(u4HtZZ$(*L9;o;ZMxu<0A5iLq{or0Zd0t_t(z)C4ni__l z=|_?#AsNQX&hC6O`~lT?73HxCYXF5(KV#NQ%&1U1IprO&mubrE zMRo}f3!J_8OFZvM_TU&TG)B8~tUs6b475`CVD?Y*mFHm)J(9S)LQ`3FQ_d7<$`A{q8hw6PD&(L z7{(F3jNyU9F9gL|tGe_a;X2tvS8cd=FAL^~x|0x;0hZQ!Vy`^o46}6^6y- zm8W%%mX(xbwZN+eG1{(GnPg=TTT=Sf5O3S{4?zg~K3`qJt%_pj`-2B)%_`zpS^{xT zhIY~sXsdT0>NKa-o4WNyXiQymb;>S3A)f^nR_jrA zw$>H-oZMV~S%Yocwk=-QOfS!dx;3)-UJ$oi{=G<595n88*dD*_C=-e|g*5{7TXU@p z(XZvW$qIC98W?VSwS*{+FA0ojf*a_6NU2H-$}j*c&<J(nQ7C9pHG2)8jq;0^gZBBs7j(81=ESk*Oxp`z--zQ#F9~ZQQb7v;GSZ5T+ zUwOnD3*j(GoPsA#>}Q<$!OQykdGhQjGKvL^n5GIS7=gy{KB<;hxw0#lR;Mr3;$Zc> zs@02}dX8Y1N6guK4DLOF;>rUyY^d821Iz8tZZAMJWNH5th-l=!U%;?TKQa{MJfadW827%g(11SO za>@Vh`Rb4d7?ybD<>{6I03SX1g7DH3@@TGT9+q0);!Da4FJ0m*Dk{b!1BMafGsx(- zhH?Y<<(&I^u;|))un6Vz`79ai)H`jt58o^YgHMToEwKA`LZF~2*>qflxxS1Z3_=8q)sWj$a}W3Ffx0(dH#^^IR9bMBt6_()!z zF<;fEk9*-nS3s~}L=D{>eiZIpxsZNssN66v>pV+hvLfc&4!J+!$-HJPb)@Ah<%dRQ zut%LXdq9OQY!Hqa2zEXZp}bn?<8C_S4K9PlP^L zGsDd)tK~d?@*cyFAIPCjZG*DTkxKS!FeB+NvFL<_nn*vZA23XL2tu3|HyB{%)C)uz z&V88bj=gRqhER-`(cIcDo7l-gls)DKwGV(-S&(i!xC^ly3~^O%?z z|GeDaM;e1!gX<@qc8f*3eA_ci5RHl!v_Yz*U(mcR$k6%k9NzDSlEq%6{z+Q(7Z!~= z-Q7*eNWl)nr_Jd@W8mQ+JV^;ild7YP5dndl_4SoT6&3Laf9eQ9+*8N?F3Vy?A2(?N;3!qc*g)NC?7bym?OU+-%Ya>lpx3cM~Pp?-T5A|+6v$W*aKkKQ00cj zihuVyeuTt?_zcU5>}+*zDV!J847!yVLAPB(6%%SudpY@NuQ|-a&Uc9~wrhpDvND-J zCX^w_Av?qfZa)jo&K5MvUw4)aksvBW1W8*ZTgKyfZ7t+MHc-wyV$s<@FUDvs{dN5l z{Z(G&kqwpc3=t2B=z(SZ^5E6M1m`e-aMEHlh=D$LVuO?fiH)M@XVLH+w0qgV+&CuA z>-z(VcZb+x=cb?%e}ELN(wpas<-&ZTBiOf+K7}86bV+&WFMH=*r$u1PERx%(p9d;h zpCvH!k(a?BR=s3|ud7guXfP@JW8^x)9k{T!zw5CkxfSr`C6#5p?oy9e6jvysmUAsu zX+#sfdtE7~Q{G(S zJLg24bDpd`{DcFknoi$PsPA?3^-a*l-SM+;Gn7T}Q^}zD;>8YqLVsU{g>#8I0{(BjP+69$-cv zl)(*cezT4V0^>2Od#SMqWT>PP2P$+b0QgqD-#9J%!CU-+@ot@H^;{3kSNSzm7Xd<( zzkg>Sh(*$%GYB7@I(4023Mo<#qgF2E7Q@oGK!2z9u^LYm-&rlN(QzVRZJCL<+9prL zhw(QjQ^7u4Jl)vy2jI4U$9O+PGK0Fn>#|T*vp8_@1YQDee@J&hiv4c%5gRiIW8hM^ zmc8MC_zV%}PivA9=(flPjRcr!4ai8?ZD>nbeA3XxjXYC}6;+)B930905~R$FvRS!) zn8f}murg47CtSER%7b4;bxH(GoR<4VBaN*{3gW_I`*-#B}Sah9d{R zsNx9eox6S&GB@a*O4wYcec;&z^q;?WGhKgq*rfF3rk5|3VHA^p(;{Ieu!L(Oh4N6H zP+*LcjqgniZKdIef!<7+z) zv>!yr8mfr8&(x7!Ab?Y)vFkTWQl&snw7yUtNto2b*eRvGx4s9b@9e#O6{=*vdqp*5 zz{1yUl!otknA-3w_`;YbcDma*l^X6@W_rufF=lmK5OkcL@*xxGqzes+3S2O+t*v&n zC~-nDv{1>k=?H+HEt8Pr924 zHyCnK`c;uZL1X=oqGS+SWX%eY&s@qC4>-tR~ z2Mk%V+PHpBO?|8Kduy-9-#_twc}e4zzl)15&zssf=;|Kf4{O*vvL*sv%GEJtck8$? z;>;+4f~e2}brupjwj-2>Sfph_*Yut35YMkGE-Mq|j#MARJaV_*2lu6= z5gz)cgs|^xQz!ss0+$58;MGvR3qIt;M-Lacaew?g6q6xz!hDQg(ap6#kUicPx5Te{ z&mA4WHzInaM>05=kSGQI%ptwc!i{u{N%goR-C7b=WntF>2m zp+i%oK%TuV=lZxp{WoWYr_2)F7(+cazbu1S`XJi+9X~e@?hb7*2a0kn_Y_*h6;QOS zpPhL9Nzv&5+97&;ztomE?H8^=CF+0utUHDDFRH5xVq%7NJtuGKt=I;wGrK5dZ9>Tp zOmU8)5>d`r9aR2QjZ>|@=Mme-s<-wim?tMDK4!YCf=;Y&LSq-mu~KJJHlqVI-f;9A zbl>ZPQ5evf?I?8e4~G^vv|Pi z>D;%@W9|GsZeU1<89UrZ%JGcKXmA@5N%KDo34KPY6{duQ~%k z7x?%n6;#zeE2Y`a&SRd(&97baRffa-?8xkK+==aLn~8cPN-4MBQ)#9tvcfO6SpNRU zf`a_qB|-QYWiy!?;eK`IZZ=nCliBWsRC!c=U;J#HPm0wFL!c! zTF;jNjgc|Q4kLLo;UUBV*@4w4)T*uOp1q_WN`mrRETnQ@!Jr1B>DjS;O}2SGAYqu~ z8E_S}Dj#2-$tp;su?wg^T7A2oDTGqi(6q~--M)&Eube4*?6z{_9x6zxBdp<$IA__; zqOLKDN_dEJY$lyj8`X_I6pAN`c`}cw54vm@l8WZht6{2|N5>r3bSMHSGUes!>Dm4a z2&8-5CyuNhKMM~I;xA@Y+|ITnl#uj&mz~dbSu`dU${6RF z3Oxq5&yhB7#o|_{E2AfG78sM`x_f#!K(mqAo}6 zT!$)L7B1YmT+<9ndtgd=QEd=3CRzJA0!daAzk5v6>E++y4FKE~j6_{^tMRc0L*#kU z<@W6fKd=fCNgIy{btUNTKB-WDg`B3YX;;t6go?loYm-mYKg)&%mhc>g%#uIq#D z`kU&*w2jcM;n0KJARQAd$D2R%QiG{(um(GHk_VyOEGgYVs&AV{0IY%>mpo#`5{ znV>s_0rU%Rtt00k3`2Y3#+k^ zdV0ib$pRTNn*|JPlwqU@;SwZg)xvNz949JnQ`3!ibVXNh@2g+{T5~zU9;GycqzOM_ ztW;&YI;A*Iu_*4c{a@S=ztWFv5c(E)e)m_}GZ#$xA*)!oUYXvuPl^L?pgyAW)a&1X zq8P^2>;cbhPw0q03(4it)6#;ofL?&_Y;engcej|@&twgAs*KfMZs4H{Jj5nNkO3a6SvAC#nEZZ(1En~Hh?keF4ZLK%gD%pj-B4N7`aSY z?$vna?&>Niwz{c}uijUPR*H+p3a&pz#PdibPV}K1O6y4op45r;@-pO!RZ&vn0QEpN z?)&xY6LMBrHa4C0lU$KJ`rQr0ZJGO^QE}F3@=yR!4qFk z)KIma^xD<`{hA1k5GxcPkA79{~`xqaF ze(2`p$?qh3sa|HeIf4yUHJ?>?cHlz#MH#W^p0~C)ZY(CdLAM)#ETMRn(;oGcma2nz zJf5tb0W>_BEqzcfaK$S3o-U-ctC>_57hf&g95NE%N62>qJ2H8I@tCh~JLQs(H0Qj0 z9JPH1s>&N3Q=Mm3G#U~&H#=KH7J6xJgN3<3Fmt7&&Str0JPoi0+#HSwmvjE!@DZZ_+B{24o2O=$9kMMNAiGJ+7RG8f%W*iB+a~mxtT*fy1UybO?+nPa6Y9ei|j(K`}&kvX8_#*0KapSgDu7v!UE`yZVsLPrc z)`Utgb!uOxO()0{TC^kdFa}y(y_~KMF!Xr1(9qCOrE*A+7D9jlDGd{^X(a}Lh^=8% z4y7$&Qvqmhk1nuqr(r?R!i)t$KX!BS;O~sdAYJoiV7^7G4q`Uz@jK>s$ssY2bP%SV zs_Sd!{PKX<>LTu)lMTP5H^t2X26yPH-*66XtiJHDglh*%-Fb(^r;B&2diJK=88GQ^ zgV4jp4P0rekVGn+>h`1DTswd|JC3R4PgJl*8|SoFxs;rWfeV}BtZpx=|FXmyq8K)IOJ&kn(~-r{byIMVS$Y@$-mMP1il7Qzs)6}FH@rap%b zN3ejkFsp{>CMd>$7xUa3OU^7uNhO>un{xLfDSw<=1M^R_bul{?Klb^Mkj{IR6jhVn z9;PcM%2+oWXB$KtY_^M3PnFgjIdrC=^b>t>u)a+G>PwK~N+yZn9f@hx?NBH?H#zwg7_zD@yBWrf>$6;dD0T<_)$Ca&nHe(ea-hzb$RRt=L-MDNw0 zFFh$%BwUvY;Perq5o{?iit7cvB6HjK;Tmc<@GU{BKMv=nx%lUnNfU`gPDrF{rhvy$ zEyU0hlWn8CZH{8rqJ@aR%*EH1)NuFNjCE6UbHE%WOfe}iqj^2#%KtFhM`7-hDs2947--et@%{7X z^NuF`GM+Lh6G({H%E7u|(u zPTR5m{-(VA{A^&biKm%(wNjupBWK6oRdWNvDwCC=JQb~`0YYM4XZN8{-U1sss)XTB z=RE%Q52%lMpSA~?+}un8ODjAFfI5^VL{?ojQLX@VhIrGRoky69=X=6fwQbm1`e8;_ zZNa{YROtKa%D1=Ua|nLK-I>*<396u-4>308&j)V3RK-NYB~g?dMFNiE^46p;SrqAzNWl*Lqcgd`{eUBSj1E5OJ1*NJ3(*mJc(^cP0} z;5g@8cGN@$&!*af*@BbT{CdN{iwcb0xZ|0hiPj2FZv5xDHa}$b0bDa`a(E`ky!_od zGHi6S?ryy{wLv7l3la;~4ch_K37%L4Lk9uIOq)2EUwc>EWIUjL%w-(lAY$7#G+^95 zkfwCZyXFhNB56B>SWpul*<~>reyn~KPA2^OZ}(`oR6PHuI5Bo@e-WY~F*zCb7Y=~e zm0hTGpQgRw2RIZ$Ur-A2_SB8H{|Ij{`lLr$ykOld_c^G3|AHsHlQ0%!iAqq~&K=wJ z$D`AFUc3RIR$+n*=ng>Ib7T)Sph!+&bA23}JORv@iI*XV47XtpSQ_L6){L<&Vsa3b zJ+UBoX3WFa*FndEWyjiWQ*2at z{J=8|`o<4{t~|vo@o<295tuipB7Cu8Zg_4e;P>8P`JWu!7Tn+2Q6kK#14)BMQIk z`#jLek`eQI$J+a9{irVUjsAxP4lgN@gPq)syAkejHT7$zl6Y=7jy`n(lj{I6q?U6G zzHawX3O#53+U|Uu}!ai z0ljjQ1X_?QdZZIzCnjkW;RIo{mN(*#r-w3p1Yr}x!du##E=pSJ@1v@S7Ml(;y?JNy zD^D!${k9wH(7%T47cv}0qDD3r0hT9r6sy-#Uw`5aJU`#f(eW8vL`ZH*qspOU>rd*K z0FFJeq5t=M`n|iPgu&lXYeG(tW%OX@-N`*J7%$Go)1;}8fd16nV-*jfz#1Vma0%c# zfYS*8V#*8PT-8e$H*(DRCx;8B=cHtAfXmoOGN7VIT8wpSvCeSoHb@S4{+5Iwt!DJ| zGkL6B_tGUQOBJrM?E#XXr%VX3bZooY;JW)f&!-HQ9;|ct`Wd!{CQvTN6oH$8F$jyvyIn9Qlu|er zRR{iEI55vpo;ZuKQ%Gw)0T4hy^kb!c`M#Q^I2Y+Uzx#j~2d1Xp!teqvS+U@}IH9tK zn8s*uscT^tVtz%1()&+}y<1Qc*&x&n7VB^W&=fS*J%h)^1r-kRC) zuapf`Gb%>0GJb8DCM+LqAqwh$#f0BQ+%E=%pgN=x$s&4udBH3s;SiuQuG$fElhgs) znj}-_=jRu0oKiLfNI$;ufcvh59Drrb7h=~L)(Mwv-4fIHmaZP8DOPvzHt@!kr(LrOcNB87mz%#jNHyrhdDG%{>3nxG94YgilH5okzn1#{3~9*Jn)LqWGXQ=Eq>Zbm?&w4=DVvbMkxf*`ds z#^psh9pEt>VwmPQD^T7+v-XqLS9{NijB$aG^@pE(J`9+&s%j5da&&+DAI0ddIwt~r z4Y{*DvQcO=uCh{$4dxVr7Z1=LytIOcB|L9X6F)i%=M!hY!Ag~0uh@*LlHCxk$9Or7 z53S<+RJ25LxRGbPQvdUXYn(Q^KMWtQ`WvwxJ-TO2C0z+Jcy&-}OWzfD=goUu792(j z5Ryb9o3S#d?vZl{)h;Qqgv*+^wKop?o*N6DDmtL%K4HK$e;2gcdj-Iba*{i;v&Vc1 zVOl!JJfWI+?Y15r7UDS_1Kb=P8L~3DUT|ysja!RQc*|nU^})*5tF2r4APqe>J@5m; zI2KT5>NEw7>lWm{^V|hWeg_ya$TNaDu_o7;=D*Dtn>-pYaghV;tjZ9Q>CRugMKP4U z3L3~JZodTX>S4Bhs;~E)zNK1-{@#v`J$`>(?$x@H4b^0F+8w53wZJ`h#`d{j8bv%m+I+*V!eOmJ z_%GzJmWYl5d%(IlEa=u@iV7+)D}x<{cFOj7YCV8o|3C%iFW(3tq+UO0Z1|1{=?p_V`Hz7@Q@2>$@R8QN!-cFJr9^y2!P>Ft_2SMglS0Ij4~X zx^l{22!x|zfO}U*^rJ_Qph-^Ux*f6TuII5s|Y# zyE~p1pVvfO<9~x&a^;Fy8f4zTu1s-r(H=&_ZnAyl1q9DsZB#iKQ3Et2m`F{!+5 z^u^F$psNtJ3jxjzBSm1&P6N^|UTHN&LRCnP4FV_ngcxul&=^jq=k&T?hOlaIbW#i> z8?0?D(M%HtXo9EL$33ytcxnv77R-Z1Z~=M_npNRMq;M4#IgyQ~^-P&hlah|*sq}#3 z0H!rh#3eW332cGx#ukLHMY~@4Gbpt_3c`Mgy|IJ7p*%hFcG(5ZwmUtr3r`-~b{)mJGKKmDeCgbmuPwPV=A3#t5hB z%&B|&Bz+HtO+%Hd0({-=Td$<@#A@(fDT8?Xc=xT|JLWUM)C%uFue9}KK2Ise zoE??sk-5Dyp7{&)ou{hJ3Z1P52Qr_J+X`2HyFZcr7WIw8o~bNmQ3UiIR}O zb9ah~w6*2%z<1WG0O{;u-TVJ8=3NX&xT5HJ=c^AF>gv>C3i;1cb_sHdk=3#X5~u=v zaUfT~#i@H5Vr#vyz3Zg*_M?>Y7HES?> ze`!->S=RUB1sDUzV9Saen)N@=w=!_sT64A^L-3a_U2!!On+`wXsl9RJ@z%ZqzNnqf(7H|Hw(&pps`>WhT6Jl%R zkDi&5&wqzWw9VO!I%TMtwb*J*dH3u3%z1_1o;Aw(A2;l%A~-2Pv(G&K_7LG|OmM7K zVrf+xL*pj=3P&|$%`$qNIKe$7=QetZ1%Du#S13fOC@MZKBfz6^c86%7%P2{WLRwMc z_cgBaQ%%cSqPEb4C;0PM!bU#z_L^Z*A7Vi!Ubg}BA;K_IeNBKDGt|82Sp%7F&Va7E#**Erv!KY@^Evr)(I3x-*KqP0e|lAgIp`VZ)Bu?TWNgY zZ9sf|DQ-Zn@CpcoH!=xNydyctY$^q-2t0W*aQJ}`VOSS63obw%{)i9iVgn&uGoy1k zx!5@htMnh{Rff$MfJJg~$*0Om8hYFX-Ru{!9*OHMg4lo`6}vRsbc#7*(%6xqlgo)n zWc_aj`1dYKbkn=UlSImzx-69T-Wg8Ku$qLy^&(e`J*xNi(7t~D{5kx?KgGPt&P`v$ zrJPT27f`>J&N+hKB9?(r3AzPJn!TzmU;bu12Jxz^5bQJS0MOL4q04lBCX#sU6gI5Y zsQ~b9_cs$^T{%SHPMq{i7lg21H+}g~&kbxKrGK>%0lz86rM;W%q0Yu21jBoTng1?!W!+q9pv`B& zYfZiNrAMNcJW-JSaG|>Ttjjue&bf{l5NtrFo7k{PY_^JuDpnk%6la}F0yH=!kEVp- znNaD$jOCwaUE>cE-|(WIsr$v_3~S<0sjqpCRvZ-bs@^`oIOpiR7FbQwtE{)yzPuJ865)v zRkeo^8$k&S+<#O4aGjD2*wwEe^J^E^Apj{KTi4j~vYx%M)vUN^q4mQlb%ytb4ZkIP zed>qJ^M5xdN*2|ZLzv?G9OBwZiBZ9etNOXI<^sYL-Y$pnX^frty2lf6dD#k=)DU2X zOCqYFCoojp_x>qpfb^``50Y#wwhF!WS__FF^FmnauxW`6qUSs+os=W#FG$} z@V7f6JFXkYmOTdH|B<-fd+N1@t+!EH1TWo*Pcu{Os5@x!{f_B03gmUKPkKshZ!gwgO_5av~D+jdIR5ONsxL0L8b6U2(C#2 z**wu4>Y<|=0buC*r^E36vTz>BouY#sad{&(<)gx9^X6X<6c=OW5=jt_^+${JIhAUNl`^b0HRfktKyyxTeviO z5>RR;W-^DoI_xAnkRV2c^u~jR5RbOnDJ51LKErMsN-M|S-6q4;!WeikNMBRlqFwbf zYc0HUMU&i}kHf7F(KP4^OcC$mRIIhJc1fP=^tuu9{<0glJ?Ki%NDB5$i3O#DcvBYK zwN6Rvs7yk?)MWuoGDN#u<`Uz0)GkQynT0j3pJA(UAa@Q^qVpmendF%xvNfd3lEy>Br4GEs^B(SrUQ5y=`RgQ8vO?t7s_1qfU zCUH^l>M#&M^ZKe6atualZ;DLUkw0GACrIn%qC=qVCJ-*iCB;h~{vk02OxuFQ;CEmq zD=F|-NSa*ACB{LDxR*$~PO*Ho25S&bRx8|IPweuhc{3SR?gL`f@emQQEj}H_5YD92 z=|K1j(&B89pgE6Gjo( z)MOm26nmiE+qHx_$&~h{G)ZSjm_YL7s_HMu*`}_;5>&+F$KL>_RZLC$Q?541i2}(z z7)`BYMVATIa$aGoJFlt%Z+d@Ww5Nl`n)QmX)l1fTXcubVj0{>MeU*h!*$(cBY}O`g z><~Zt^h!irfYq^YO4%~IHpSVv2tB(RP`e{w7(6FVpy9t7!DBV&4)w)dcPv$ zv`E-r)|_lw!4vYYVnhmuOgNq}i#H0qaJ9HR_>Q{5TUK^5;UY6FO49ve;E?1wK*Trd zqTTSTR01y6MLWX7gcnrs<{hX$j=SpQfE$_XD;%f`IY{l8 zt7E)v$1ZS-98}{#Nqo&#cw6ffR~|WmLh7l!_9)BAiI66-g0e^ih0iUEF?yF?Dl62xCziRomFF%cF?d&eb5m1{LmiAMfN9fOHf#|& ztaaAdh?0CKv(aAEVM3%FJNV>`_#H~!Y>jjnr+qV8KM#-6xns8I%2nM~4gAZ^o+W9( zwNG>!9NQpHh=v!?F8{a65VmrPz(B6qdzh6@_0_H+OHzzdnNak^JpyMSJr23*PHPUO z)81UgELOT5B`5k{*&BixC=)+Z1Dz!=q)&4`{D2V5f#{jl72>Ms3MF8Lvd|1N)_pzp zgQ^b4^O#9yvniyasumVfCAJuyvV#$u>lLQn|I7locsj;7w{ydt+f6E zt>pqz*vkq9q2M8zB(nY_Nr}h+|8v8Jfg{Zm6fmb&8RC!lqrn_0(Zy@ zI`Q1AOF863@c`L>)l&H5%XIONv9-~b7{4oC`d8UP8i>N4?qPhg>tAP)I8S6+wfT}s zZ{Gg9{7*s*8(x>N<}#=bB8Xu9>eFDDc8k|P6P@MR*ZGTkzmv{TD2|QakJ9%(ah};= zwb%bYV2Tp-`&L{Upu>;@w_0L|8G1>h7ZFBc)&K0v7&N?#5_|G(l7!8OaGWF9unG6K}Ah|BtTs4y5}3{=i=% zyh}r7Wkf~UN+Gi{8i=xYgd&@`cBRaygeyV|5kgkhjm&FQl5}k@BI90r#P7V6Tc6+e z_w#Svdta~T^Nhzi=W)(40SO&@m^}mGc(Y~K04#h2^=Nd3CR1X?g?WU1_SknI7C_EH z8;S$$VhHw4i&5#5Cx7U)0Xe@zf@PEphJr?1k->;oWY6ra_v4 zyaBv8O=##qujR;9TwU;96D76XT13bwkbW24SkWA&t6`TcTc33!x(m+gBjdCs%@c9e zO+Lgu!u=#alq&tF4wn)~vGI1&!`8!3-<5q)>t^{R`VZ*M~a zu2FJ~eDBc&G*=Ht2{S;-0ijzTOm7I#u|L@HlsfQyjv)9E_Eb#fdLaes!Gewt-~LY2 zg*4vW(SH3n9=_HLt;kJ(A(P3|fI(U*3E1#5fRy{)f0t2yatMQA3C{@j_EJthR71ti z*~NbCJ_HjD!N;g-tT?}mu2;FY9a{z)D-3i-I1Kd%(o@$gR=tEp{?sz0`Qswt;VEDQ z(msnuq_GHM+Z!LbmtW9(l1c}V+>aSuOM`I27Ha=4rRSTzw>^nWX7KiL@= z+J64LF6~%tGqN7mG@d1O$TYLWQX^3s8$MkvJi(P&7ed=V%r|yPQuUne3ot$GCQwd( zX(A2|55V`gj0vgL?m8bJ!gPvDeXS6W4Q;%6*)Jclgt|<`>F(hrj~@?=!YREj18zgGB&_vr=(-7o z6v%1;*H{@Mu{i3}Y}02OwIJ114fF|=FcZ0`3e`C^0g3~4_S=dlP(o<)1nq&V;!Wnf zqcjVnm^4X|Y*#-&)4Ne!Ce2iQCy${#L@rmm&hP=?%r(UXB%wH=+fAq+<<)#I<{x^3 z0?w#Ylp}hP;F^ar-cJ++{T8Jcd!lQb3y|A_|_f9N_ zm;?@3gX2aM?zwdw3)dLKYfBkjwYr)_`lsi=fB%k()4<FW9JZa zA*FyzMEp-=KsrfPP5LSnyq8cC1~uOejc~L#0CHc<5TXO?)N*@%iI`aM#5P~Fb^^Er zB?fW1hR3h{&kwu?d0qC)ckR?O4RuU0-GW}mPMK#qi@RiS3#0e&?GT8!$N=r(D4&xB|%&XcBMX z_$Zpht2ue>Mb0H@+(MW+1S_whz;_6W0cer%MG*&91sI#dP+Vm6{@N7hZV`0(fwb62 zC)4!l4=8k*D-FhHw!nn+zshXdES;XwCNFyI;<NZFt|v(vIgKey%1H3 zd-+d@Rl*x#Yj6W+=zt1$zve#RN!jM3Jtg0ZI+qv__P-`x;I|1sTuDZ`{wfB6A}GB$ zDpgX%%-HxRILhN8DlNyRez@( z!=FKOgwI({^W0;=YBS}K5b-bx$ZmJk8}l2Jl6TzJRr33e9oc{pD=j&6^?|fn(n*I^ zCf6E}Pgh`Ii=Cq+z`m^K2Z5h75dR{!(giVRRxY~O=E$#x@Ue_f*JxN zl>WM6C^=j}uzw(}pA_wSrb}G_Qm+lO2J^=M7MfCY@_rY){ZWGIwjEF~1NkUl&J%q} zt=19r%{s62DWq<@Gf0rS>veBq_kmRp zZ*0u5Ff0qCS};NAjA~$|3mpkMY?xH-qXifcYqMU8`=`?MWl315XN2QIbZo!Tvvt9I zxIo5a)6-I6HGtYsB4Y{JvhMQLh{e4BQCqHx(o%_!VkgJ)u%i8UnL*}n$fLZ52!QPJ z@sxM41&$Nf)%*ombj|Gb>{Ce*e;*$SCuCCdUZZO>7)a$DlVTClZwF;l=M_;2-tEkT-figU|Rg zcF%;0(V0KaVq*mE$I&4`F}sD}8swWdD%<~u!xH|~I?upoc`h>?Ki0iQDn8avhEXnL zIH|uCr0jxgGeO%u_4z7(%~pg4NZBsEdMAYU4X*E6xW9T50HmM z?s)AV9qcYeb9xr|5P<3Duee@Ej*s}cVyt|`vJL?B396F7L*yk zr(A#DTAswUQI?yifySJc4bm0zWkFadk`tdKAPUWZ=Rtmb?u@cED(^#9UemMCh2Y^U zl02m8ddGmzMJbnw7bg8JhZh@xgH{=k;~L9E)5S%d_xvHkqa0G{zG04@XU4)yfyBcv zW57+w8~Hew#*R=2%#YR(QMlgNsMg~O1}-!||CqBhF4*@tkW5L%y}wDO!jSv#VUDZa zUg!RxSejej%%hBD(nfNX3b}iB17J*r_EeIg6=V-s*4{i}VPW5S8xZoUT*$Vi6m=e> zH-8I{&#eNe#qZp!g!zFJJf?SAm?nqyfGIs}fI;3@gM} z!YUTR$cyY@Cs((7t@(Pb8F=|m!1wtt-mx;LoRH*iJ{Mrdvxn^=K?yZKw)za2s1DAZ z0gZw)j1CnhwEw`ZrVPE;KGd?y=vVN476yC^WmK}*gb$8U@|Dg-ChxbZ$IJAi5u zR>a|%7yNd=PlRU49!zc0z+y12XV;P1Vn*d!#6q<@OHUxlaa zvvG&(Tx%MWjEwW#t5ZS43Tx|AP#o9h9Ep!plNN?w?X6ny2pcXLAbs5@yXrfTM6}uD zL;v@6z=emcqWBSQED4Cz?aEwP%k!8&=N#`(eK%hfY5s4DUm9urASV{}rML3h&6>kE z8z#h_m{7g!LNZN|{G-$}B!sS)CqeOggkrXTXmv*POA}!sZoFxGV+8f`z8fs{pS|41 z7$>QmT6xde?uo5+K8K?b!-fLcP0r89Cjqit{Ez~YTkp35>Q0O3#~#u@$tjfdfl^2U_Q?xm?2cZoVD7i%NA?P}Za zOzT)Y>HNAJkg(wmd$*Ja5mR3}*6KtDp{kOiJfa2NG8QipCqZ(+Vcx2D2H5F<`kz?j zcDC$*rvmRZiA4Iz4x8=ob6!#!aw6_aTKhWkYz!2i zq+FX@SXp!>!>|oJsp}LexE23k33}@ZF}ovywqc!fgOsn7V8T+UCw$b@rjf(ccxbFW zn_#^wa{lWT+L>pjx5>fvVPgksD*V^V$K9)2YEK+0PkJ|R$c%5gO*)qsSNbwWQF!)|ML|?W)Sfr+#QB?JH z*WuS9p>^-120VrGIPM3@N{H5cCAl)Xdl*@lCVD=pSY5Is6wzl}#$lj#o@tA5_uAI5 ze<{LU-^WB;{?`06eT{N1m$K3V&+MG*Jkoj_WJ09qnS}a)?ZOWw{q0C+F1>U^qwaQ` z$st;`u70wVpRy1=u4?J}#qjq~i(6tvb6y9*o)&cybF zjP-|Gj9UN`aHWvL2de9QEG(XpT>7z4;7Ec#rvs2ysD~0z9f#M><;y>B13{?1uI>yG z8;rMHYpC5+H3oC8?9Dv3K08hGX;G+Gr{Sohq=9vLr?Jvt_0AOmyijv!_W^;5bDCUQ zevR6uvs{nM3&`H%1rELG8=x9#f0S~~xLWFob`a6~>rTXpso~_^H=6>MlR<(}K%^Dk zIB@hl%_Rsz>OX(Jc;Ue!pfCF?T$0DA(qYC;x}7mFi=x6KBl#goT@QOSG9}ngRb!>C z=S7-XP5Ez;*$G$Ta!NHU!$P0BAFBCYZB;WV8kxDPLQ=i;Ckf`vMOflbVn$dW1-U%x z8FbgV7baDv@w$p{%`AEEhOJlRcB99qLZeT?F&bpX=)-R1Q=vC>@`{aAkwX3?Qtnyf z#1@zBxGKFw=TdHzHmLU5Ha~aZEX~`9!&3u(Y|AP?T>(bq4?w?8p1)miPQMGg2oWiL z1y6O;tu?un@GV0mFC@4fp2Tx{NWDGj-gMkEDbZ`>1sGR#LWItNQsz&-0NRgdxzMx~ zf>%F5)mFv{(pvvB3^HNL6$>*3+M6RVZf=h@-$c(&)=^Y-2&gI@uNy91x+Eto7{R~Z ztDVO9egUd9(AgRT=``JlkiEx0_&ti;eD}1tb;NF5{3vrYTP)_u?t(BLOhrt`_&jr& z&tmQXLqD;7^Zb(yLzEo(S)yxouGXUZ5@Sq7?p-9nFGTU#A#3krQS8Wk8<6Z+V^t3v z5}`}hP#UUcmsM{qR~d4a{Z1fEcZ57;eed~`F2}KLTn{R(&>@Pye5TWlx$AsdcS}-P zC`_2+=T`8$zHHjYFeH{nkrv;tJVIvn`G#9TR6g!-zU*Pp_>&Hq*9pAE_}}q+_-TV? zDt3n_ywmS2&vuclTwRZ1V8}FUnw;N?{*~sBlSVma)$+&0#kHjQ9L(9Ai{n>uRk{hY zC9$|t0z-FMM8?uD*pRKNxeAk=24T`BepO~3#&aHo@fCJ&!#&HK%Uz;XNgkEz6u8#YM~v4bwRbf6HbVp6cqQaG-ZW`Aq}L{ZWudNaUSv zZEgKt*XbN|nULDw!vr;=hY;2^h%c)9lXGxY7a0n@|HCQxE@>|ti)&9xWC?AWct4u6QaXoz}C06yF~Q&-Si7DIkW~ z6UL0S&)U4ZcUW|~33jx`?tbd!T#OEBix*ybmz}pV-KC^$%FtnHz<4V*+RP@ZUB{H4 z^gR?G5KoB#i!S$6ky}3(4xD>^8Uha|PGXv@H3N0PNu6+fYD$W2EetWXvaBW|62Cf` zA6)0UUF&QOi9pA7a+?cyVCCuL@Q4WOVZ)pjw~`-`(?{5S7$w+j2w7pNVJ#kEAMp5a zQkV7ADvYTkl*9bi#T|Gdm2PoY&(x0319Hav0y|(kgZ=UeKbyAj{%V7!0pA-&3MA98 z?6QSvrzpzR7FwQQgb2cymCYeGPJBl|kdu#$tgITO9f5ck7Pi${8qt$)X13v|aJW*Q zoBL2rL&KVJqO&uhE`jb~!PrWQg1a+@R4P>9Z!QMAlgr1)&;>I=Q_|qTCy68v@jZ^Y zjXnNrWk+Ztrxqq_BVzcCXs8@E)c~9yakMooD2QVv9~LeAbp4 zOEqWT!HNow&$Zt7W;MgR_8+Qfu)Cdc_2o5NNJ*^!b>4!Wq^0r5D#yr>&zIPGxYo|M zeqot%`t|Ge_^IGv&6L#COza-UQ6OHw^=-*NAa>t>KHs;jq$K_h!%C3@2OB~=UwW*P z^!)kr@8bLS?>G3s{9s>a^f!(D>G*1OMvLXmwC6k14$O6}0FlS*CGkVfVR`?-NUS*L z-M&&GhvuD@39;{cLp~PE8hJhmP99(+xvkCu(8|tlG!E>{d951Br6bR+<+17=A52_< zF}?~)Q;Z(NpFEWMh~{!^@0Va+*=N?QT5@P!N)UasWgN-olKWWZiu^#nKg{DDDb!l) zCiryu9F0o(v4i_e(?)FLbiQ15ptXl<_+=`2H(oXKAd;*{jGJi;ro)|PVhbKV8hb%a zO*j;kKit}_9Gzfej(Co^&=I_7e!Z%It+mB_<$=s_k zb-x7I_-$x!1=7vy7}w_L&}&zcsEgU}-(cmwi-e!Gz_} zJg+Gp1#IPdEDg1j!98tmUrCh1ey!ZvJsFRSkkyyfV}u+NvAXQP4CG-7}$kO6qmMsViA<|`muO}wKn!B6P=)o)J#r16hcUf^u0R_k=ny8~bcQ!}-*C$b&W zm0Y^e9hS2I8>MpNKHzy3BQ<5Yh&$yz*!`F-JEf5SSt5UZnlp%&gF!}HXh!Ics5R@u zq9=aMVOP15sLLje?AcCz2$y#L#M{l!GcZlizgoe$1b zy?voqWg~7gK5P%!EwO*o%)CM&PeC5NiYsG6&G9X=J|st>#pet2irKsuBP-7Lr!bRj zXvW134O^k80}#nL7TVB$7O_jNQ3Yg7O_nvaH%T77_LwWC;#$fd{$GI1{gi8JCdZz9 zY1DVvMun(H+u(jOf2G2m&IN4Vb>^UT9mnq7uQ)94sv!=iooh%%m(6H2+T-e1V9Zg6 zS}F-6da4V!+Jj?y^E|}Wq}b{kW*(*mzdekNrF{$HBuOz69)sTc@_M8%N*Qh6Q6tOO z0DZGfRAOq6mDCu2fbB05Cf2PiEJ(r5j0=#uv5VBv=^r`-sa#%H+RBlUs|8)Pm<|A3 z<3)h>3drnsGPD7NznJ$lyqn*$WlsMq4A{z#O2)w^H^2l|BVyX2jF-TO*KESsAFA#B z71}s3ZQf~Yg z9Tf7nf{S(Ue>TROgY)M-M1vDQvZ*Y^8AIbMZYhLx&XO{u1{Q#<0MwEzK(Sg5mynd? zKQgSLcHx4}d(Z25cY^cvJO~A1EvW)lDfykw{ot9Ngr@2mWq!Q{5LEkci#GH`UM|o< z4jrl?LcsYOTIPu3i_zzI;}BFCGAs8v3q49vU^%Y*#`SsqkesYbkYORXT(4z}jSLUh zj*vcaq5;_Y^03VVnW0cmdK1sKy79c)jxP)(B8t&2+FZtN+Yp7&LynG)qS8`QXF$mX zYL%Rze~eFruD4rY{i2OBb&sER<5+9l)ufIeAVWF#dy#BG3xuB#Vd7>f-hYAz6`3&l zEj2YY-^=+CB*2TYu{tOBnlaZWE~Im~B~S-gOYhuki%*E7-)9j6Y5BsO@tV2lTB192 zK;`ZoE$-Wa82|IUyTBus1@~qiIt4Q~^WelAd-v3ShY2}?+XB2rBO9kt{P|PAy`>JC zr!I7!H!JM;mIcI)hoH9KU2|9NDu}ZpBNS}g%Y_o~)T{6OQWnRvAs<(y_I&C>W6$Hq zb)|<^R%B5u5=$-iruLnm$`Ax%>M-u|Q4?1gnki2eB~QN&#>;d~@kipHL{TX^Qq*$3 zbNMde)J6DoLL_`y#s^@4CHwv?box!z-OULS)N=BR4^;raQW_0hUuMc6N zM)W>Ph$O|u6(-GIN;VutDHn+G1tlkESs22Sxos4BbUqLf*}4`iD5XiK(ZO3iKuNJ_TP-c_h}Jwjkbv?=jE13fAPO&>le5!ywb(FTm|<>XX{f&9^&dht+= z__+yp8W8gU))Ru1&E;qkHlz`%q#O!A(tm98w;+V(teVgul9%FJz61J1$Zs z`+GqXIzRs%HAMC*ad&O@-ni`7udmd$NOjk|{=)0}I5Da%WL%)1%)UH3rYE=^*+tP} z9Ez<#gI9UkdZ`uHh&-1#Z1yK)LV*Aq{oP_#%$156>?5ckcNZsd77VL^>dTdfNF9=!`hb-z__)9|7ea>b zg|FajuRsTzix9#Pzs3|$CUe(*KYo%;l5O-5((j0`4R2>P}jjNj57sV*spA~wP2{B6?dolf4;-*o)_W_q!;MQ7zM zC#7>Ql+GO;9Hy4lJRPAjxIYuKr($w>V;U;*MW09C&)Dk>yvmTK+GjI;{gINE7hd2N z%A9~e)c0}UrR;MlPSVJ#-!IEL*;R+8+}C?)(W%b*Jkw4Fb)CgGRzECrPx|^K#>B+X zPB8V60n9y_+=@(ZtYSryhnjB@$1pO&atGidT+@s*OIv@8Fe61oS7*^W30t_UGfS1d zQCs4AN<6Z?9sFQoe&Lb)`-?uliT#i3VBq3i7_FMOD=F$*VVA?01Y(`IF`E*{P?sxY zEt7fh77-Dfx8QaABpcL#r}A#AMT*8<$x?mfG?(qjOwxHg&om5?J^+*7)nEvZihMH+ zz#_u}BL^#6p6SKB;^L07Dpsob{if0_c>6 z*v<<7ie>4%UYOasv7i7kze^8-Pt?R*EhL(iyF zB)=M)1FSskgEKP{u(U(IhYhj5N%>xeUFi1~l$LfD+JBZov@eJnufj0aE0-@{?v)2$ zT@S0b1MyV7dm313`5BL(^%LC^Q-D0+MOMn>sFNP(2lkE=3hRM)g!AP!=9(-68T&iQ z)?DSk7;4-~Xh^g2sjD!J3${43iO>ZYEg2Pa9P$6PvKu{mbtRjBjKVRxdG6)Wxt4i-+V_VJ%Mu6+M5mtx|(BP@eS3i6hdX|>r?&9*y z5=rh4?L&)pPnUtcco6n#ppW}sQc%#HM(Dj&mDdPt-0xXhR@SwRJM|ij7d=`g{xytE zRK(;bKP#gc7j?46#$;V&D8L+Y<*{i6x+z|)$QRYX? zQ|h~X9P?KZd7av32kWCI*af?%FZYrAJsZ9MQ*5IsdgFiZT@aY+DIj{`2CD#FfLCIx z>b6*zIpZLuj{OfwNoA)^(ym*9c)n}elLiZGJ_n3V#dC@jONSXnDr{w0EhPuUk#x0< zNX0w?>`zARP5s#A6lZ*)057Gpv>6Hih!j>E9S>pp~zgJ50jVKRSU zqo6<~QBQd85=W%+9d9IU&&C|m0O|c;A*P>l2%!7pM@2WCV>ArIJqFRxzOa5rFu612 zP9xOSN}gJW)pY&x6zUGjsIf$M_R zmWoX?wzdG-n7}C9x)ysUE)bt8nBEctckC4HQcXG=i1OGULS^BKudf{VEob50m=DX} z_C^W|2{CjI_x2|56`360iWI6-Zn4?QfHg0%{o(ufesJdgAg8_8uF0f@&+ON=!6kMcCrjv_MF_> z3PXK2rtKn525)3bQETC4dpzEkz!yP{^BK7l2g9wMtzN2uwMxq}tt(}tU7PAVO@;x` zaJ?`F+kr!D^QVeWh2mUc^R`%YY(2;FmRM@1y%a4OLBF%(=;Tu}c`R~@18IbD`H98` zhcAH@9(``?ypqB*4XQXHwNJfuLSM1YhdilQs;A}bhZ;+7#>vy7K;mjWuyNWrX;eLg ziJG$jn~lp>v8CIP=`8)ju8*8BG;JUN$y~#W7Im`t+(9r~U9PKOxb$m7a{}%!x+$6a zcz8%k%gS;rl{3RS4^c$z_J-X-d{I+zUML)RqX{& ztGR>Npa+dKtSu#>OrHm&X9Y?(DRx!&ABAGU{viAShg8PR9QrEdqkNmpxn@ocm5D6? z7a6TeloTV?oWVy2DrD; zf)PCuSIXh!Oz!j5Y;*QwIZ|OLYRttl7&N=My6RVG=DoZL=l)kz4}uJ&Wn(!^wPQ6g zjt||m2SNkdO>}nLtDpQ7#P~u+PHvp`2h5UJo)T<^f?T<}uAUy<1k-S(0Rx&#zfsFo zb}re2MMPBO$~0_7a8SM&)`2*&wKInDOzV5{30!l$e*FM2W#JMa1JFSrFdgBxl-)HD zU|QsZ9clH9w03^VjiiV+<*NN&v<-dy5A%@4nt-4PazTt$+-|kbS(~?xyh?#QybL&V z#)rW;r3b|a#JJbKTAuRc+;mR-lPq7-{D;9=tORG&$JAfmB7QekUSnx`n5aqwv_&@u z5cZt@P%L)qYn9T$rnEG<(c(Rs@&mZ52AVvXIaDGC*Go-F@mQCqZoBS z`jevrrR{dr74fxH zu!_=%j+_mvV8pyYoPytq=Lq)lHz^B$e+9G-kqaY5bO;gkgI2Ae8c7UWqk=|G z>o_7Ic}JU*i+A1&GKOo#Orl_0vN+$oZ9~#FT6E zlk=EuakX}l?VP@t4*j2>o~sTocjp&rFePn9(l>SnApv&92lTn};tWxfz)9RfcpjLZ zKA5iPp(YV|c8HN??=fRjhA7q9Pxud4#_0p7kY9j3)8x+3JnrW(idMW7&Y~h08<~5* zv8a!%RW*1r8lbDX^p!*_gTm1{*a&b}gjZ5+<(K><&-4gBgLNsyZ}eXEgxBTw&!6w# zI!mP;OtBa3H&}(t>Iv6=JjLpW0D@rA%F^ay@){e=wIwPOofgsUP?wXOD+lHH6sU2^ zWs2@Jm3Qyp!)~UOZ1=8SuzB=mP6v+03&7(*1by?pJ$#c|FF67*nhduu9J$hc{dmdn zXGzEI@VC9jU9}eCUyE#ojyIo@YTY%d)x|1BgVni~;Q6PQp_i|@av*asRSeVd)nI|c zVIc3DBqJ~1{+Ntuva0yCqkP7!apyPX9p;?lI7V4yDPpgD5w{ z_j%G@or;Nf>1>F$NnpXVrK@lC2d%L5p^z>x)t?$-UDcIc17F$RwIwMw#MPhXO}Grw zJCQ}D6gIZo*}G$*{|KZ@HWM`RM3M70>QEJ~^2b>DvG6ttT|m zRE*zRqvPn7ET%Jv$^Tbn?*T42$oKVO7z@5CLqc70b{Eq5%WX0@OSWa(v$>=3HfdrJ4(e50sHmxSC_C9Guo4w2onQ`EjorJYo_+B!({0Q^VrTA-;~!A9|B)pugK=nJb{= zAVou!5;o)aVr2GAInm&g02dX>Xg$eDi-<~nKKj)@RKSo?mKsrM-6~Pte=K(MV-WWV zA=reVk)00wb(voKPRMG`u1A}W_V(_zyo_%mrYBzqHV({wunTd*%rw2p(G0{tzhK!z zV7A10?w~4?p+G-1wHPa{8y3R5IfVQnS(*i!SfZ7s3lv}5#XTZh)6^etF+`l?suf!y z%#s@JR>^NnOvC!MSsc^iaqqMxN2k5OSdgU5q*qQ$Umli%iJnJzDw}x3*1w7O2tx5_?+zeY|xj8rv?BJ3enUEQ^ z3j@$_Cen{fb>;QQX~eyXlbT<}YwcdEQzt}gerPWh#c zeTYbk06w>A#o7*cT5J0OftYx48l-UFrqALX#c3Kk`JpK$nZ}@Y*evV}H&s@KK&-0H zN7Lx(Yk(z6W)@nrbmg1cX%PlpSTogE6*LGYLNfgdSJ+3TWYL=Kj5QHC8ama}VaoQ2 za^5%k47HrYnYS)gAA3mOx8ov1VC^dDd(gPd8SN;#-WwE@DduhvGtPJWHc{N@Fr;z3 zAXdya{`D&BDS0PTaw-qsrJlFE0x-GLv}gqusda^R-3FEAhvw)@u!pC3E!VcMb&IUB zzKM<;QsjLbcAYG!2WHip81o6ZLRMQ({t8#NbfR8qH=cFE8(^si2kY|oE#Yj-{HETe z-Q7i_xg?$7Eu^gXNTGN-ASSK)RtG?u^zN)8|FFm*2W?eiidY|besc4n?@+^CW$-z@&I$5LJ#q1~! zy6BiejI#8X{6Px{ch0rCsftqJW&rhz=M*QN&BObRyNw1@ z*+jS{5<`9gTU}+fBd6#B%cePGnz8~Yz{s6d$Z>G|Dy}NB6*M89oQ#NV7XMKwB%s=+ zqrE*Wq&+GZTEO2xzYhVDCG5|YH0|`y2yQaaBDp>UlYx`|sUMZ4n+1mIi;*~>vJr^6 z2f>7Q+4c+sHd}FEa%T+XV6}=K8!vg+sYtCV)KAs))L>T4<96>d+vtS-(;*jbR?E$sNch?XAVlF zB`i-z1^66b$rRtdo-dH0y3;_Fd~0|K^4kt2KYh4aj#(zrTbRsxv{>=duu^5|m!=2_ zxTpk-rt}wUH4-Mh$KSOJTWG}>)pXev`gZZwC@>~Q?pqW?8v*4XI4yz& z4#eL)ADwN#?2qg7jq<*4)p18bR%e5r-m9TxF6(Hw80$^V6+vbjmr#%Q+Jf+97+a+` zM>kZxNRQ6AxE*PeYgfI0_*S=`&iecw+6N97+op5R#YLsBA7f*=MK#Iv;55B@?QD>9 z4HM%~H-RuFa@}=p_18px7<-h`x8>skaq~60T6cWENnPJ{lf3hnJ6l@^)et3-hj{$9 z3*NZX;u-1DDL)>A>#09XmumC$oVD5suH!iv?Mf3w(;ni>z?{1wA9ZN59CnGoJjzL3 zxuhCwA6Nr{A5=Jw(EAv1hE-T150Mzq@=GjZuZeJc+v;OhP}ibvQc$!5iTZ2jpTHV) zj9=cd-ly2Ond86JEQ&D-8)p4<(--xO^_QPLF{#QfcuW6zARd@}V|Kq1=p%P*u~z>0 zgYRVe<;(66ls*!SU^|VD+}_X45Bk5a8M1XzP>Gw+zh=lYt;M!j90H`@t!q?jTK`z` zD#5iGYEud_v@WsE2{hcNVJX%t58o9 zA^9T5GKSEY`%~$H_~7(@ZF$2@RuM=N$gsxB{#_cao4e?~%nYlF-Rm8>IGMv{Ue|~*6 zq(!y|Oyrj-7ZjbKZj^jV{RVOYlT4GAjb!Qg4X*|U)@hoZ@x>uGLU8}FIW@j)S1x;`?DgX3RU-w zqGV(K8;$x!DYB-anv0c{mD=daZav6(i!&rzbts)468{=<$Nkx5k#TCM)$om2jrnt00#(stO282v zW7VPIH+{%4m72>B)DcC3q(`UK#SJ`T!gsNvz{a`-I(Q^!03Jw?ENeYq$=0yHG{nd{ z@a#o;MVLL2o848&x353mfc(H~Wwx@riG z08x;ZESEc%PxeG1MDmv3srkq;QAnU)^6kzk0-|h$8ZKJu>52^|9!yg~!VG zD2HeCOK&qg#E9i4+I|0%QvmT6=y`QfdgHksSaqE3wy62o9S{^tW@W)k&N3s$!ke^| z^H_5u>H|ULsJTnhpB;i^6%-FHfV*@!HpQ$UnEq^DiDf-gZ@K*@9D@k&8_t0QC@D@< zO8rUHwsDR<%HH2q05rjJadxEruau2nL8T0m16O$*vjJ#+I*&LNyI7?fyzb;YnU{;D zvEOwB`9eUA3soE_ip=679B$W}HY>}Bw3KUb^~uc^qy&q)6||*ba%K@4O}24(P>G$O zKpWe`_}s3Qp_APjbh0Z_>aA&pSsd)J_h@@`?O?CL(KN&2`dUQO5mq$+piO{6B24;G zGA}JW)RJsVOn(GB<9M@nS09V&hRWCL$2j@cetLkigx#bu1E=JO`Qjhj0Wk{vsrf(1Fl?>}e1ibKMWO@XT#?Eayf_nOMz=}fMy9RbK47a(9Y++O zRDa{k+6$MWGbat*cODsO)MAMe_#(bzBk}9f-dMi&+vO0p zaf|7zZTFe#J=xBi{leU@t(jlXbBS#kv(S8xp#f}!gA@v}m zT~vYew_N7KgI?wJtgX)1SHPG8GpW=y*gzlcl_*}b5MQwvKanX;*O{d+)zGh{{a{S~ zi$Qq4h1#VVw2O)miZ+<+Uqm;a%W&TIh2?GaNxwRhFsAaiR6?1OJW&g3FJ-ZxOZo^|JyuJEdA!klw$)8IgQ(eI+RY!E)B@74v0$w*+$) zY&fYr6oZ4)UApKTY#8Ryi3le)g}-O7N*dX)2-fN`R{R({;JI*2IcbaeKS_C&3sarf z{~9+_psR`VedbaX_v(EgSi$Ez4->)<+*3I{j96aFH>^kBBaNzJ zm?|v~G&~Fepf5?JshN=`L&71eki`SQ}`P zq-<_X@;;qb$_2i4^J63}Q@>6nIpl;(SI|2dY3Uz+5&XLknVFhuJZ`d{FLK_y4Sw_8 z-{0J7bD7j6p>9-vp^tp$vk2pH$3z`r$1!naNLlThFzrd1ClMNGMyc1BrUF*5Ik<%b zt!Em+bOLp2R6oFokCF~CuFt&=oO=3ulSB5!GfvkF$+bzt%i|-$$k0i(e&M?f1be#- z^sJ|%U<^VIH4zffzB+XStN|q(TYq7bZpgX8Ymc)ID(DFH9FpT;X*5faE63>efg96( z{%M3zey!~=`W@C)Fbe_}rg;$k0MGeSk;$`sNcu@ia-!Icm9 zlNAzuOvNWlq%j@)(}=aLfv#%@d=bv)TUVEQqP(wH-zv-qou2X(Jp)6{(y9>Kzp+d) zc-aZ4AKe-N(b#`=^@RV5mEW>)8{`Qe{C364&h{g~l|obV6ci<=$2C%)Uqat)NIS6M`9(}%oemEj zmec>)hKTm^8^p-9IC2e+d*Z6jV`OBvCQ{?n4(nlU^9`Z02+Mpl>>V8VpwV&@5jncC zrWrxDH1=7;epTyTcBDS9*MCQRl`0fJ=I>HLsJ*A}KTS5Z#$xqSKQr2L=%faRo|nb<8M{Edeh88IH@f|Noe z?YVVcN1^Z^VaubWei0RkQ*GpzrDf`^Zv2j6UJL;z4hJ=C2rUw@n-WAImV2JsE)J9` zw~^J$HY=JyO#HhdyZ-)xl=nBTqSwKL?g^;3>UQseFHE>jpy|IfN zqIM_U{L%-7zj#Vs4~_diPHCAgNUKHC(t*;rb>961Cns!7hQFf}NkSYB;d7%(Gl$LO z>j7kW@V8yi|d+$1t^BC{wlxu>H>T-M2E3 zL8D6}xbj?rO81FtkL9y370LQ%*>ztI=+NFC4c&fY%BoDzJx}JhR5BDYM?^8ad zw;3MCtXl2gEo^N1^37cHLG;m*Qve>rG}4 zV7y(E8X8$0OMvY3`|{JoDXN_I<`j{v;({rXm2D)9<>BV0jb59|+vbyb`&Aa{QK0$qO3X`y7w%`?jRTVS5Ih_$(|zcV+c)zrALWh-P5Dl{)?s7KJ)xjk&{_Q z+vne=O7jv$WHm3Lpp%t{w2bkNGv*pKtpjm4WuqR#7$tmkEk66_@ek<0jpo_3k`)g zPJmK&K#q>Q_F9}SJw|SdE-h12*@{&SmPyCXpBgggHpCD@G(Eb%W-Y9q)fE&~5QVES z0v#+Q*#Ccgj|e{ZMt7p|e)I0U$Az_ES_%toPEI!)e3MOote{|Lw>Y5HwbI0F76Gp# zY=B;xY}$@1>jnJf@gt zjMex`ib<)cdTaGysuSkP+;uC6Y0+{b|O-xDG*LA3YXr88s z4-Qy0}P`rN>P}cb2sU{|Lv%;%V6TcX$(V>m{iyF%TejW`RjiAlmisvHk1LvB8IR4zuym z66lY%*%HOd0I>gZ^iJIm{c1c$8xY9@}I0kNfU&XA%A7xWyGcfpIa7yc^g z`8Clnx!4!P{m`*|k&m@;#7<#tv880b0+yEl9A@m9hclkx6fGE7eP?KBIEq@Wjqhz_ zX9!qYh!fcm<{GW^i(HqaOJ)UckIs9%N$?7gDY4 z91im5_QKXsXV+6Q?>{1fO4tsHgqa%)!^wnNJaf{%JsL84v0|ZGROBaHls`Tyz<&{M zb|d2qv4YTSq@5<<=kIuND!IO@Y*bHKihkYcmss>!_DUm zmDrFN1jJ&rM`@{(X(>{Q1jOxPx*Mc(N8rLKE(t2k{r)R`*yI(EsOfRIP`{s+H6&V{ z*7SD}4weH2Yn+-cKs;z&%dntl$NmCX2nW(Ou|$PdEKig?U1sLrtjdy(@*rMVsz$$h z#_hLoxmSF^vwBpw>cfYAE&m(Qk20b`V>dLxnt@hPZso7dM|7eg2^$GR6Ms#tj5+ho zn-(}?D#>Xz9fblA;-WEOIm8M7KFn+~C0&PzNuvFztF!8S^Q`=b*&=sGr>W?)YhpgZ z>W678ada6L(d%xg|Rkt#3ohak5-DgIGla(*8%*wf`bpc(PEYn>}UTlH~bcQ&l@o zM_x*R4+r)+`}sw$yB9d*+nfLYJ}VC`oYUEsE|Y02DGgC!{-iK7hLsZ$(hV>Auz|+y z_0`b$?Mrx~QA@WKtkQ<%m7?ecV(!4qzbOa|#8AUzNC*xr+4$m|O_J|dy_e}ejs4|S z;kg%dV2IYbo8uPx^Y*CF^#3C?#f(fh6_!RIn#CF$XQ}ASRkNAR*sqaeD@tdu;?4`p zlNH=vrJg>I&Nk_^{XzM@MgN@nmVXbk!K23)3>fsl^R4>=kiPO|%Ux6aNj{$?7p3@E zV+FOhofsNU^6!4~$XM1|yF7H+D=IpS>EYN5AjE=?`fc}7iER6eA(6&t5J0KLwrsyP z4>Rrip&=ixJx(kn5B4sUXIHFx4O-6e@y|!hPbaOFdYc9R*8nU-cc7eh76PjH9|`%N zr`1sVc~9UHc#pl9wVstB$=Hb=nIRqd<)3+j?G>x;nakP6nXvzGQIqQLQ?dN}R4=iE z%Vv;x?-I}^xf^7kYIF2oCTwj>Q;{B0<@WtDukT1E9b&qlk+qHu!HpjJ=N2me=CUA* zT@-ds!wgo4D@C&DWcFkAI6WTurrX-v3$Ih?|KK=a=qhttP@EKMDECD-{NWG5CZqFt z9i>i5w!f{hrU?ZFf%F^{cql3)G}F~?oBsz5YCoc&LGYD=dV(l;L9-GFB5-aaF9T3G z2l`@WQJ0MVi=sOPT7wBHPndOid>!iH`KM|2&G_HHkgG1b~*Q=(8Y-oBw$jCt(-{?^v?lAAA_H!KbZIbY45tDn##8RMSX}fqN0NZ5Owe|DpEuO zf;0!gMi3Q|8WAkC&?HC^h{Fsjh%hRM6amrDiHIP*j9^s6h?F2*A|OP-&^zBwLdc!( z&9|28t#7^e)?3^^C?_}f?z7K1`|R`E&EN+5Lql*vQ;EJghhKd6r?=JB)uE5tC|@>! zH^2|KW*&5@o%aX_)GUZ~LgS(jiEB~3ad^m8n^ zVAx}TQx|L;;=xWEpkc+$UpIRaK8P`b+(mvNW?2N(CQ*{hhXn`K3slrM7Hj zWILbpMZ`Dslz;l$!_-ZiP3qOQZ%%$B=@75rmh!f5KSA&B_DKe=428qFPDFj|j{L8S zw_Q8End#QZoYg41>4e#EOUuUpR(jFO%|9Od^d@@mb$2&s9~CG&zg&D@Kd4ByA}b)f zXO!OR(>l5v$;o0Nx5hC{dv1kct7GTo>!PL8b zXP9(KJCvpxgKSpH(JJEmh9F$GVtZ$;O$VgOs&E}}FG$#aoBIStHk&Ti58`n$Ez-YC zLZRp-1i%M?+o$fPGf-!E4073dbzq98M@)C!(-n!)kc>WHw2}Qa>)=CN)fqv|gsNXa zBH1vXR;tFV+0Rgw zwYL>wc3lsvuwVC%=LiK5&#-49r17>t*R>n0U#u&ScY;AmbayFFefo6v?_F~oCpz#> zkcb=&-0~r#B5mA*-|tE#n>ykO)D4f{Su5-S`^MhAKEM?-85q-N3QIH&mx{Z&?71bDp*ozALO=~r6f&w2h; z)J-{IFbI~8j{Q26Rogh|Kp$!tobd5g)++d^Jg9er|B*uh4_Sk~jxp?64)Hcwt+I2H zsTrkCwdwHt?Sq8aPlqOpz(dAn8)wpd4nyq~N{V7D0)2{$YrJ%~bKYNzlD4tJtU}08 z%8O2$+rUd~(HsuIk(C6)l%Pa|G1Q-LghIP;8S$Y+smbp3%LBmLp+n|Cy8!38>u;mjwpJ z+|T=UB{Wo2lD);*pBZgL(WSDR-EZHHT&N=~%Arka-sTIsK?1~z2S8k1H;t9;wyrJ= z%br3+VUz@kJyD2r6xq3w1mDru^KK2!7i&>pRLRKBKEGxxl1{gZ zENLB@oVHXIZxqn119R!&opf8~1#Q})AnKSE?tySc3*jNxb2t4JpZ=>!s>5@11y=u^BGn-!)^dJ7Q{~ap($XP5n!6qmPZZdl1TwhB z;;X*e6V5SXZd~ElIQqNn=6~a?8Et~YrV*%Q<{p>FzQzp>7P&Lq2QEX1n$%tzc;7X< zA{LLbZceb7>C}o^yiFH1riV_%cd>gwyowrIY4P31w)!BC2>UGm&Izth!w9>#Fs@Fvk&;INRf}Wu46dn-9Mfx(Q@fF{ZW6g*Zp)%bC>IYDw3L3ht4qQt<=tgU>aY9e-*9wRU zCNi)2HwtVxsr4~)|DcV+v#{5r+Ml--$wZ!`*E93ni>|w$R%j$qWXdsR5^p!2Nicpt zc$acxdr#oQ${e956M(aaH86}!Q@!hOl)`J?D`Za>?Zg%P6nVZnhR+C~=1Eqo&~qyEhNGToRMaf)U^GT7|1g4~G@SqKUUIv-+sR9dIP{$G zS=%S(N8JhypugBZ z;F1RUwyKx4b}+gynh9}V-FqK&HjH^R=r*}pdNo67XG#%iQY<)JCsa=(c$HT(rlvVR z=f10KyU^{#_w>-x5$#dgx5h2E>#6m$f$$35>_wV*=jMh73~Juk4QUNVPn}WSnnwbo z4=FbW>%0|7R0{26?boBtxhc1`st?^(a;~;Z&kuX5cYSh|-O=C;qf%)Q5N<1k==&v= z)>t5!s6E(qbA*0%h^xZ718aI9#5lb`CgNcHhAey4oBTD}x67+T+zZGeCF$y?1mkE) zc3ac^AIFzs(k1Hh4-&9}zw{1Dl4Vyj^hABEnrlfPU9cG=u6Tl%dEupub+!I|`iefM z77t;6dQMTX(!i`({J5vV@?;F*oZ2ySt5h}dO!W$~gl+WD`izx?uA3^G?;j;6RoeWH zH@m1BqgS<)LC(|IYS5BDl*1#PfRYg=hWM>P=d1HVE^ZgWRmaGFM@*pHd{O7R+R*cD zO@U6ct(A+y7ztZMpy-LZTrfY;@G@UF@$!f59ktUYHFx$pl2b-y>f{||e^wAm=+YGp z=}J5Efw4prU!{Z3cumdoprp<06f`nFfDwE8Iif+`HK?EPc5 zRh#Y^8&J#+h|iJl0{2iu(!~wy)PUiw0B5o%R%D4T6>I2XGZ| zSn~KugQai`;Sy%&?KjGu^h&^Ys*d|i2 zur}#X)t&q|3VrUr;BXt)<62mun_}yNw@FleyJla%LcREvktZ1{H)*b`4Vpb5)?5j% zmmcYPQc;?sL01)$A%7qKjL_eSCAB*!LvmqthYAb1cV^2|pJuxY#1M{cDxYXy+0fMG z6%?UW$rsC}Lf>y+r1*z<^`1ESk%Y}Xmzdu-p1!|+ub{&zYVn&-!`eTFuwoo+pbXAn zX2jF@QsqB7f;VZTHwV9$=bKb){T@lV)p)_Y=J2kQ^6FjdYOzXbds#}2tsHTZXYqwC z{My%xqScAX)o-;#ig1z^Ev{-d&z-Vzb1L;cw*S$=68Yed7x3!raqx$B6Os2F`1C52 zR-UEqHDce1k&u%3~@nGI43U(D1&?zO-_2iV1meRsA9a z6Ap~#*Uv)jRSm*hdY|kYgUHD=u}l$uR@OXGrPUNjh^FQoWqnYuHPWY0*Xm-mU7-I* zmN{pFpe(KSODl6`;BxKtPW%qhFbQk%2On~mKcjfIGX^fu3NO`O@5&@Syf|tPY9Ne1 zzzXBzx!9!+S=ld{nKJ1KshGn;W&xh@69>-qJuj5ejy|5&sDCjLLVfv>@=aL%lw#NKzWf;(rwF?tXQ`3X?b6w0A?vDVQfy4_~~cd&+_*D zhLiYM>BZE+hvcN9;wTxMi6YV5+dHd!l*BN16YTJ+AnecV#s1u3LwBr>olNC#?ZFxR z^#krzr3752qGOQ z`QG*YCc-Y<>?{$Q9t04^}25kJ}UiUbOhsmKOjcQ#z#*L5?Kx~1YS}m zD>~^z7ii7>uH@ts1@H(kX9xLzvQC!P z&U9&TH51f4{p?DP$bPaSv&egL8{?Vy*)k7bEXIPMg^x3K*>lRO?Y)y2FXclXjk{GtDJ~esvRyHHqg>^#xtA1 zj%(}{<+{ny^oz5}h0xKbCdK8`*X^*+?S#%B|7!_-#ai5FdSW=V>%j(0gf-*_Bn3k< zuG2QzL2ZPr(wqh-uV%z;*xQC~m)l|+@A{!ED*f5z(+aO;M4iY`t1)1LP~K3z%s7MG z-9SI4=#!8JY4RHk{+G`X~ZK)duTbNWFDRG%ZfkB~$&CBg0`=l3fX5DfN6dq5!S$5|^o@Bd9 zRjO!ER&95y&DdTaHx`|RRjH=YPk-3Llw<_?f3$vLZdf3T7n6yx(=t1q#k_R?$uajj zpD?du=KVXF6Sh{6tgO7Dy~w)`GcBPg^v+g(qr7c!&dvIm?4A&rGVefwVzm2)N!Ms7 zF2vbHN}i+ezjtxgccwvbB&-SSS@ec^Sz!$gBSukp82-t?#7*A4*(8|~^Q@)E^Yx1^ zQcw*cndVe&ces28XJ)2LQ)lEbFHfnaJ0J6N%3GI7N~KWSqiPRXK}HL^z{xS=bulz& zwZQa8Q+~TL-u7gbQQK84kG{7$N#1+E_=xXjQUS@m23ve%IGLl7gT|6xL6-CL$+Du*x8@hvAVi>D|P^T%?@onMO|F()ar{foyoCc^ap(AwA# zIs0t)J>3_zKVf+m4E9+G`8S?VIRq>KE&tWn4@w*7jQ777A*;{hrhrBe!!vB8sa^;1 zS%=uJu=qQ;F071%Jz{Zgij;WBXUCFZyN&g%o`WiRidpmTQ90v7r27bGYf+RJ7ZU|muJzFA%)S=8+o(rtHnQyC!+AxklUpe`nr<0P4~{atIB|VHC^>mB!dqbNL7YC#2I1` z$GwYNW9qiB&^ipbCGO&(Dx9gcfQA2s8RI`tM58S$u6B5Qr6htxt7vGPVx!oIh2)%R zcTPINuWysQD7c(B0@j*!pq-=yAtJMH!M)SZ&(BhBeLc%U#Fm=xP_7i3fnXl(v_#nQ ztr~2200&#QFNiLlq4r3eWA!iGh}hc*#61|gbts#G0|gMI3VyWg()I)PvavoKyOfgrxm z(o=+>QblLqV&ukWJoofD_e7%1!s_EP7x|XKSP+%->{^gb^Q=G?<_?M%e-tfxdWoX5 z{10T+lHac`+Vl&Q~tyersXR=W=3U&*yOh{#ua9Ja#N- z(>z}M=btqU*Kn!*ig_V7r+1Z&{R86iEk`X=EcaPXM< - - - - - - - - - - - - Node - - - - - - kubelet - - - - - - - - - - - container - - - - - - - container - - - - - - - cAdvisor - - - - - - - Pod - - - - - - - - - - - container - - - - - - - container - - - - - - - container - - - - - - - Pod - - - - - - - - - - - - container - - - - - - - container - - - - - - - container - - - - - - - Pod - - - - - - - Proxy - - - - - - - kubectl (user commands) - - - - - - - - - - - - - - - Firewall - - - - - - - Internet - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - replication controller - - - - - - - Scheduler - - - - - - - Scheduler - - - - Master components - Colocated, or spread across machines, - as dictated by cluster size. - - - - - - - - - - - - REST - (pods, services, - rep. controllers) - - - - - - - authorization - authentication - - - - - - - scheduling - actuator - - - - APIs - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - docker - - - - - - - - .. - - - ... - - - - - - - - - - - - - - - - - - - - - - - - Node - - - - - - kubelet - - - - - - - - - - - container - - - - - - - container - - - - - - - cAdvisor - - - - - - - Pod - - - - - - - - - - - container - - - - - - - container - - - - - - - container - - - - - - - Pod - - - - - - - - - - - - container - - - - - - - container - - - - - - - container - - - - - - - Pod - - - - - - - Proxy - - - - - - - - - - - - - - - - - - - docker - - - - - - - - .. - - - ... - - - - - - - - - - - - - - - - - - - - - - - - - - Distributed - Watchable - Storage - - (implemented via etcd) - - - diff --git a/release-0.19.0/docs/authentication.md b/release-0.19.0/docs/authentication.md deleted file mode 100644 index a1e8b91de64..00000000000 --- a/release-0.19.0/docs/authentication.md +++ /dev/null @@ -1,46 +0,0 @@ -# Authentication Plugins - -Kubernetes uses client certificates, tokens, or http basic auth to authenticate users for API calls. - -Client certificate authentication is enabled by passing the `--client_ca_file=SOMEFILE` -option to apiserver. The referenced file must contain one or more certificates authorities -to use to validate client certificates presented to the apiserver. If a client certificate -is presented and verified, the common name of the subject is used as the user name for the -request. - -Token authentication is enabled by passing the `--token_auth_file=SOMEFILE` option -to apiserver. Currently, tokens last indefinitely, and the token list cannot -be changed without restarting apiserver. We plan in the future for tokens to -be short-lived, and to be generated as needed rather than stored in a file. - -The token file format is implemented in `plugin/pkg/auth/authenticator/token/tokenfile/...` -and is a csv file with 3 columns: token, user name, user uid. - -When using token authentication from an http client the apiserver expects an `Authorization` -header with a value of `Bearer SOMETOKEN`. - -Basic authentication is enabled by passing the `--basic_auth_file=SOMEFILE` -option to apiserver. Currently, the basic auth credentials last indefinitely, -and the password cannot be changed without restarting apiserver. Note that basic -authentication is currently supported for convenience while we finish making the -more secure modes described above easier to use. - -The basic auth file format is implemented in `plugin/pkg/auth/authenticator/password/passwordfile/...` -and is a csv file with 3 columns: password, user name, user id. - -When using basic authentication from an http client the apiserver expects an `Authorization` header -with a value of `Basic BASE64ENCODEDUSER:PASSWORD`. - -## Plugin Development - -We plan for the Kubernetes API server to issue tokens -after the user has been (re)authenticated by a *bedrock* authentication -provider external to Kubernetes. We plan to make it easy to develop modules -that interface between kubernetes and a bedrock authentication provider (e.g. -github.com, google.com, enterprise directory, kerberos, etc.) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/authentication.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/authentication.md?pixel)]() diff --git a/release-0.19.0/docs/authorization.md b/release-0.19.0/docs/authorization.md deleted file mode 100644 index 80f42173f34..00000000000 --- a/release-0.19.0/docs/authorization.md +++ /dev/null @@ -1,109 +0,0 @@ -# Authorization Plugins - - -In Kubernetes, authorization happens as a separate step from authentication. -See the [authentication documentation](./authentication.md) for an -overview of authentication. - -Authorization applies to all HTTP accesses on the main apiserver port. (The -readonly port is not currently subject to authorization, but is planned to be -removed soon.) - -The authorization check for any request compares attributes of the context of -the request, (such as user, resource, and namespace) with access -policies. An API call must be allowed by some policy in order to proceed. - -The following implementations are available, and are selected by flag: - - `--authorization_mode=AlwaysDeny` - - `--authorization_mode=AlwaysAllow` - - `--authorization_mode=ABAC` - -`AlwaysDeny` blocks all requests (used in tests). -`AlwaysAllow` allows all requests; use if you don't need authorization. -`ABAC` allows for user-configured authorization policy. ABAC stands for Attribute-Based Access Control. - -## ABAC Mode -### Request Attributes - -A request has 4 attributes that can be considered for authorization: - - user (the user-string which a user was authenticated as). - - whether the request is readonly (GETs are readonly) - - what resource is being accessed - - applies only to the API endpoints, such as - `/api/v1/namespaces/default/pods`. For miscellaneous endpoints, like `/version`, the - resource is the empty string. - - the namespace of the object being access, or the empty string if the - endpoint does not support namespaced objects. - -We anticipate adding more attributes to allow finer grained access control and -to assist in policy management. - -### Policy File Format - -For mode `ABAC`, also specify `--authorization_policy_file=SOME_FILENAME`. - -The file format is [one JSON object per line](http://jsonlines.org/). There should be no enclosing list or map, just -one map per line. - -Each line is a "policy object". A policy object is a map with the following properties: - - `user`, type string; the user-string from `--token_auth_file` - - `readonly`, type boolean, when true, means that the policy only applies to GET - operations. - - `resource`, type string; a resource from an URL, such as `pods`. - - `namespace`, type string; a namespace string. - -An unset property is the same as a property set to the zero value for its type (e.g. empty string, 0, false). -However, unset should be preferred for readability. - -In the future, policies may be expressed in a JSON format, and managed via a REST -interface. - -### Authorization Algorithm - -A request has attributes which correspond to the properties of a policy object. - -When a request is received, the attributes are determined. Unknown attributes -are set to the zero value of its type (e.g. empty string, 0, false). - -An unset property will match any value of the corresponding -attribute. An unset attribute will match any value of the corresponding property. - -The tuple of attributes is checked for a match against every policy in the policy file. -If at least one line matches the request attributes, then the request is authorized (but may fail later validation). - -To permit any user to do something, write a policy with the user property unset. -To permit an action Policy with an unset namespace applies regardless of namespace. - -### Examples - 1. Alice can do anything: `{"user":"alice"}` - 2. Kubelet can read any pods: `{"user":"kubelet", "resource": "pods", "readonly": true}` - 3. Kubelet can read and write events: `{"user":"kubelet", "resource": "events"}` - 4. Bob can just read pods in namespace "projectCaribou": `{"user":"bob", "resource": "pods", "readonly": true, "ns": "projectCaribou"}` - -[Complete file example](../pkg/auth/authorizer/abac/example_policy_file.jsonl) - -## Plugin Development - -Other implementations can be developed fairly easily. -The APIserver calls the Authorizer interface: -```go -type Authorizer interface { - Authorize(a Attributes) error -} -``` -to determine whether or not to allow each API action. - -An authorization plugin is a module that implements this interface. -Authorization plugin code goes in `pkg/auth/authorization/$MODULENAME`. - -An authorization module can be completely implemented in go, or can call out -to a remote authorization service. Authorization modules can implement -their own caching to reduce the cost of repeated authorization calls with the -same or similar arguments. Developers should then consider the interaction between -caching and revocation of permissions. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/authorization.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/authorization.md?pixel)]() diff --git a/release-0.19.0/docs/availability.md b/release-0.19.0/docs/availability.md deleted file mode 100644 index 4ac0da8a061..00000000000 --- a/release-0.19.0/docs/availability.md +++ /dev/null @@ -1,136 +0,0 @@ -# Availability - -This document collects advice on reasoning about and provisioning for high-availability when using Kubernetes clusters. - -## Failure modes - -This is an incomplete list of things that could go wrong, and how to deal with them. - -Root causes: - - VM(s) shutdown - - network partition within cluster, or between cluster and users. - - crashes in Kubernetes software - - data loss or unavailability of persistent storage (e.g. GCE PD or AWS EBS volume). - - operator error misconfigures kubernetes software or application software. - -Specific scenarios: - - Apiserver VM shutdown or apiserver crashing - - Results - - unable to stop, update, or start new pods, services, replication controller - - existing pods and services should continue to work normally, unless they depend on the Kubernetes API - - Apiserver backing storage lost - - Results - - apiserver should fail to come up. - - kubelets will not be able to reach it but will continute to run the same pods and provide the same service proxying. - - manual recovery or recreation of apiserver state necessary before apiserver is restarted. - - Supporting services (node controller, replication controller manager, scheduler, etc) VM shutdown or crashes - - currently those are colocated with the apiserver, and their unavailability has similar consequences as apiserver - - in future, these will be replicated as well and may not be co-located - - they do not have own persistent state - - Node (thing that runs kubelet and kube-proxy and pods) shutdown - - Results - - pods on that Node stop running - - Kubelet software fault - - Results - - crashing kubelet cannot start new pods on the node - - kubelet might delete the pods or not - - node marked unhealthy - - replication controllers start new pods elsewhere - - Cluster operator error - - Results: - - loss of pods, services, etc - - lost of apiserver backing store - - users unable to read API - - etc - -Mitigations: -- Action: Use IaaS providers automatic VM restarting feature for IaaS VMs. - - Mitigates: Apiserver VM shutdown or apiserver crashing - - Mitigates: Supporting services VM shutdown or crashes - -- Action use IaaS providers reliable storage (e.g GCE PD or AWS EBS volume) for VMs with apiserver+etcd. - - Mitigates: Apiserver backing storage lost - -- Action: Use Replicated APIserver feature (when complete: feature is planned but not implemented) - - Mitigates: Apiserver VM shutdown or apiserver crashing - - Will tolerate one or more simultaneous apiserver failures. - - Mitigates: Apiserver backing storage lost - - Each apiserver has independent storage. Etcd will recover from loss of one member. Risk of total data loss greatly reduced. - -- Action: Snapshot apiserver PDs/EBS-volumes periodically - - Mitigates: Apiserver backing storage lost - - Mitigates: Some cases of operator error - - Mitigates: Some cases of kubernetes software fault - -- Action: use replication controller and services in front of pods - - Mitigates: Node shutdown - - Mitigates: Kubelet software fault - -- Action: applications (containers) designed to tolerate unexpected restarts - - Mitigates: Node shutdown - - Mitigates: Kubelet software fault - -- Action: Multiple independent clusters (and avoid making risky changes to all clusters at once) - - Mitigates: Everything listed above. - -## Choosing Multiple Kubernetes Clusters - -You may want to set up multiple kubernetes clusters, both to -have clusters in different regions to be nearer to your users; and to tolerate failures and/or invasive maintenance. - -### Scope of a single cluster - -On IaaS providers such as Google Compute Engine or Amazon Web Services, a VM exists in a -[zone](https://cloud.google.com/compute/docs/zones) or [availability -zone](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html). -We suggest that all the VMs in a Kubernetes cluster should be in the same availability zone, because: - - compared to having a single global Kubernetes cluster, there are fewer single-points of failure - - compared to a cluster that spans availability zones, it is easier to reason about the availability properties of a - single-zone cluster. - - when the Kubernetes developers are designing the system (e.g. making assumptions about latency, bandwidth, or - correlated failures) they are assuming all the machines are in a single data center, or otherwise closely connected. - -It is okay to have multiple clusters per availability zone, though on balance we think fewer is better. -Reasons to prefer fewer clusters are: - - improved bin packing of Pods in some cases with more nodes in one cluster. - - reduced operational overhead (though the advantage is diminished as ops tooling and processes matures). - - reduced costs for per-cluster fixed resource costs, e.g. apiserver VMs (but small as a percentage - of overall cluster cost for medium to large clusters). - -Reasons to have multiple clusters include: - - strict security policies requiring isolation of one class of work from another (but, see Partitioning Clusters - below). - - test clusters to canary new Kubernetes releases or other cluster software. - -### Selecting the right number of clusters -The selection of the number of kubernetes clusters may be a relatively static choice, only revisted occasionally. -By contrast, the number of nodes in a cluster and the number of pods in a service may be change frequently according to -load and growth. - -To pick the number of clusters, first, decide which regions you need to be in to have adequete latency to all your end users, for services that will run -on Kubernetes (if you use a Content Distribution Network, the latency requirements for the CDN-hosted content need not -be considered). Legal issues might influence this as well. For example, a company with a global customer base might decide to have clusters in US, EU, AP, and SA regions. -Call the number of regions to be in `R`. - -Second, decide how many clusters should be able to be unavailable at the same time, while still being available. Call -the number that can be unavailable `U`. If you are not sure, then 1 is a fine choice. - -If it is allowable for load-balancing to direct traffic to any region in the event of a cluster failure, then -then you need `R + U` clusters. If it is not (e.g you want to ensure low latency for all users in the event of a -cluster failure), then you need to have `R * U` clusters (`U` in each of `R` regions). In any case, try to put each cluster in a different zone. - -Finally, if any of your clusters would need more than the maximum recommended number of nodes for a Kubernetes cluster, then -you may need even more clusters. Our [roadmap](http://docs.k8s.io/roadmap.md) -calls for maximum 100 node clusters at v1.0 and maximum 1000 node clusters in the middle of 2015. - -## Working with multiple clusters - -When you have multiple clusters, you would typically create services with the same config in each cluster and put each of those -service instances behind a load balancer (AWS Elastic Load Balancer, GCE Forwarding Rule or HTTP Load Balancer), so that -failures of a single cluster are not visible to end users. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/availability.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/availability.md?pixel)]() diff --git a/release-0.19.0/docs/cli-roadmap.md b/release-0.19.0/docs/cli-roadmap.md deleted file mode 100644 index 402eb0aecfe..00000000000 --- a/release-0.19.0/docs/cli-roadmap.md +++ /dev/null @@ -1,84 +0,0 @@ -# Kubernetes CLI/Configuration Roadmap - -See also issues with the following labels: -* [area/config-deployment](https://github.com/GoogleCloudPlatform/kubernetes/labels/area%2Fconfig-deployment) -* [component/CLI](https://github.com/GoogleCloudPlatform/kubernetes/labels/component%2FCLI) -* [component/client](https://github.com/GoogleCloudPlatform/kubernetes/labels/component%2Fclient) - -1. Create services before other objects, or at least before objects that depend upon them. Namespace-relative DNS mitigates this some, but most users are still using service environment variables. [#1768](https://github.com/GoogleCloudPlatform/kubernetes/issues/1768) -1. Finish rolling update [#1353](https://github.com/GoogleCloudPlatform/kubernetes/issues/1353) - 1. Friendly to auto-scaling [#2863](https://github.com/GoogleCloudPlatform/kubernetes/pull/2863#issuecomment-69701562) - 1. Rollback (make rolling-update reversible, and complete an in-progress rolling update by taking 2 replication controller names rather than always taking a file) - 1. Rollover (replace multiple replication controllers with one, such as to clean up an aborted partial rollout) - 1. Write a ReplicationController generator to derive the new ReplicationController from an old one (e.g., `--image-version=newversion`, which would apply a name suffix, update a label value, and apply an image tag) - 1. Use readiness [#620](https://github.com/GoogleCloudPlatform/kubernetes/issues/620) - 1. Perhaps factor this in a way that it can be shared with [Openshift’s deployment controller](https://github.com/GoogleCloudPlatform/kubernetes/issues/1743) - 1. Rolling update service as a plugin -1. Kind-based filtering on object streams -- only operate on the kinds of objects specified. This would make directory-based kubectl operations much more useful. Users should be able to instantiate the example applications using `kubectl create -f ...` -1. Improved pretty printing of endpoints, such as in the case that there are more than a few endpoints -1. Service address/port lookup command(s) -1. List supported resources -1. Swagger lookups [#3060](https://github.com/GoogleCloudPlatform/kubernetes/issues/3060) -1. --name, --name-suffix applied during creation and updates -1. --labels and opinionated label injection: --app=foo, --tier={fe,cache,be,db}, --uservice=redis, --env={dev,test,prod}, --stage={canary,final}, --track={hourly,daily,weekly}, --release=0.4.3c2. Exact ones TBD. We could allow arbitrary values -- the keys are important. The actual label keys would be (optionally?) namespaced with kubectl.kubernetes.io/, or perhaps the user’s namespace. -1. --annotations and opinionated annotation injection: --description, --revision -1. Imperative updates. We'll want to optionally make these safe(r) by supporting preconditions based on the current value and resourceVersion. - 1. annotation updates similar to label updates - 1. other custom commands for common imperative updates - 1. more user-friendly (but still generic) on-command-line json for patch -1. We also want to support the following flavors of more general updates: - 1. whichever we don’t support: - 1. safe update: update the full resource, guarded by resourceVersion precondition (and perhaps selected value-based preconditions) - 1. forced update: update the full resource, blowing away the previous Spec without preconditions; delete and re-create if necessary - 1. diff/dryrun: Compare new config with current Spec [#6284](https://github.com/GoogleCloudPlatform/kubernetes/issues/6284) - 1. submit/apply/reconcile/ensure/merge: Merge user-provided fields with current Spec. Keep track of user-provided fields using an annotation -- see [#1702](https://github.com/GoogleCloudPlatform/kubernetes/issues/1702). Delete all objects with deployment-specific labels. -1. --dry-run for all commands -1. Support full label selection syntax, including support for namespaces. -1. Wait on conditions [#1899](https://github.com/GoogleCloudPlatform/kubernetes/issues/1899) -1. Make kubectl scriptable: make output and exit code behavior consistent and useful for wrapping in workflows and piping back into kubectl and/or xargs (e.g., dump full URLs?, distinguish permanent and retry-able failure, identify objects that should be retried) - 1. Here's [an example](http://techoverflow.net/blog/2013/10/22/docker-remove-all-images-and-containers/) where multiple objects on the command line and an option to dump object names only (`-q`) would be useful in combination. [#5906](https://github.com/GoogleCloudPlatform/kubernetes/issues/5906) -1. Easy generation of clean configuration files from existing objects (including containers -- podex) -- remove readonly fields, status - 1. Export from one namespace, import into another is an important use case -1. Derive objects from other objects - 1. pod clone - 1. rc from pod - 1. --labels-from (services from pods or rcs) -1. Kind discovery (i.e., operate on objects of all kinds) [#5278](https://github.com/GoogleCloudPlatform/kubernetes/issues/5278) -1. A fairly general-purpose way to specify fields on the command line during creation and update, not just from a config file -1. Extensible API-based generator framework (i.e. invoke generators via an API/URL rather than building them into kubectl), so that complex client libraries don’t need to be rewritten in multiple languages, and so that the abstractions are available through all interfaces: API, CLI, UI, logs, ... [#5280](https://github.com/GoogleCloudPlatform/kubernetes/issues/5280) - 1. Need schema registry, and some way to invoke generator (e.g., using a container) - 1. Convert run command to API-based generator -1. Transformation framework - 1. More intelligent defaulting of fields (e.g., [#2643](https://github.com/GoogleCloudPlatform/kubernetes/issues/2643)) -1. Update preconditions based on the values of arbitrary object fields. -1. Deployment manager compatibility on GCP: [#3685](https://github.com/GoogleCloudPlatform/kubernetes/issues/3685) -1. Describe multiple objects, multiple kinds of objects [#5905](https://github.com/GoogleCloudPlatform/kubernetes/issues/5905) -1. Support yaml document separator [#5840](https://github.com/GoogleCloudPlatform/kubernetes/issues/5840) - -TODO: -* watch -* attach [#1521](https://github.com/GoogleCloudPlatform/kubernetes/issues/1521) -* image/registry commands -* do any other server paths make sense? validate? generic curl functionality? -* template parameterization -* dynamic/runtime configuration - -Server-side support: - -1. Default selectors from labels [#1698](https://github.com/GoogleCloudPlatform/kubernetes/issues/1698#issuecomment-71048278) -1. Stop [#1535](https://github.com/GoogleCloudPlatform/kubernetes/issues/1535) -1. Deleted objects [#2789](https://github.com/GoogleCloudPlatform/kubernetes/issues/2789) -1. Clone [#170](https://github.com/GoogleCloudPlatform/kubernetes/issues/170) -1. Resize [#1629](https://github.com/GoogleCloudPlatform/kubernetes/issues/1629) -1. Useful /operations API: wait for finalization/reification -1. List supported resources [#2057](https://github.com/GoogleCloudPlatform/kubernetes/issues/2057) -1. Reverse label lookup [#1348](https://github.com/GoogleCloudPlatform/kubernetes/issues/1348) -1. Field selection [#1362](https://github.com/GoogleCloudPlatform/kubernetes/issues/1362) -1. Field filtering [#1459](https://github.com/GoogleCloudPlatform/kubernetes/issues/1459) -1. Operate on uids - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/cli-roadmap.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/cli-roadmap.md?pixel)]() diff --git a/release-0.19.0/docs/client-libraries.md b/release-0.19.0/docs/client-libraries.md deleted file mode 100644 index d5e087801d9..00000000000 --- a/release-0.19.0/docs/client-libraries.md +++ /dev/null @@ -1,20 +0,0 @@ -## kubernetes API client libraries - -### Supported - * [Go](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/pkg/client) - -### User Contributed -*Note: Libraries provided by outside parties are supported by their authors, not the core Kubernetes team* - - * [Java](https://github.com/fabric8io/fabric8/tree/master/components/kubernetes-api) - * [Ruby1](https://github.com/Ch00k/kuber) - * [Ruby2](https://github.com/abonas/kubeclient) - * [PHP](https://github.com/devstub/kubernetes-api-php-client) - * [Node.js](https://github.com/tenxcloud/node-kubernetes-client) - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/client-libraries.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/client-libraries.md?pixel)]() diff --git a/release-0.19.0/docs/cluster-admin-guide.md b/release-0.19.0/docs/cluster-admin-guide.md deleted file mode 100644 index 388636c74a4..00000000000 --- a/release-0.19.0/docs/cluster-admin-guide.md +++ /dev/null @@ -1,80 +0,0 @@ -# Kubernetes Cluster Admin Guide - -The cluster admin guide is for anyone creating or administering a Kubernetes cluster. -It assumes some familiarity with concepts in the [User Guide](user-guide.md). - -## Planning a cluster - -There are many different examples of how to setup a kubernetes cluster. Many of them are listed in this -[matrix](getting-started-guides/README.md). We call each of the combinations in this matrix a *distro*. - -Before chosing a particular guide, here are some things to consider: - - Are you just looking to try out Kubernetes on your laptop, or build a high-availability many-node cluster? Both - models are supported, but some distros are better for one case or the other. - - Will you be using a hosted Kubernetes cluster, such as [GKE](https://cloud.google.com/container-engine), or setting - one up yourself? - - Will your cluster be on-premises, or in the cloud (IaaS)? Kubernetes does not directly support hybrid clusters. We - recommend setting up multiple clusters rather than spanning distant locations. - - Will you be running Kubernetes on "bare metal" or virtual machines? Kubernetes supports both, via different distros. - - Do you just want to run a cluster, or do you expect to do active development of kubernetes project code? If the - latter, it is better to pick a distro actively used by other developers. Some distros only use binary releases, but - offer is a greater variety of choices. - - Not all distros are maintained as actively. Prefer ones which are listed as tested on a more recent version of - Kubernetes. - - If you are configuring kubernetes on-premises, you will need to consider what [networking - model](networking.md) fits best. - - If you are designing for very [high-availability](availability.md), you may want multiple clusters in multiple zones. - -## Setting up a cluster - -Pick one of the Getting Started Guides from the [matrix](getting-started-guides/README.md) and follow it. -If none of the Getting Started Guides fits, you may want to pull ideas from several of the guides. - -One option for custom networking is *OpenVSwitch GRE/VxLAN networking* ([ovs-networking.md](ovs-networking.md)), which -uses OpenVSwitch to set up networking between pods across - Kubernetes nodes. - -If you are modifying an existing guide which uses Salt, this document explains [how Salt is used in the Kubernetes -project.](salt.md). - -## Upgrading a cluster -[Upgrading a cluster](cluster_management.md). - -## Managing nodes - -[Managing nodes](node.md). - -## Optional Cluster Services - -* **DNS Integration with SkyDNS** ([dns.md](dns.md)): - Resolving a DNS name directly to a Kubernetes service. - -* **Logging** with [Kibana](logging.md) - -## Multi-tenant support - -* **Namespaces** ([namespaces.md](namespaces.md)): Namespaces help different - projects, teams, or customers to share a kubernetes cluster. - -* **Resource Quota** ([resource_quota_admin.md](resource_quota_admin.md)) - -## Security - -* **Kubernetes Container Environment** ([container-environment.md](container-environment.md)): - Describes the environment for Kubelet managed containers on a Kubernetes - node. - -* **Securing access to the API Server** [accessing the api]( accessing_the_api.md) - -* **Authentication** [authentication]( authentication.md) - -* **Authorization** [authorization]( authorization.md) - -* **Admission Controllers** [admission_controllers]( admission_controllers.md) - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/cluster-admin-guide.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/cluster-admin-guide.md?pixel)]() diff --git a/release-0.19.0/docs/cluster_management.md b/release-0.19.0/docs/cluster_management.md deleted file mode 100644 index 56470f0d978..00000000000 --- a/release-0.19.0/docs/cluster_management.md +++ /dev/null @@ -1,65 +0,0 @@ -# Cluster Management - -This doc is in progress. - -## Upgrading a cluster - -The `cluster/kube-push.sh` script will do a rudimentary update; it is a 1.0 roadmap item to have a robust live cluster update system. - -## Updgrading to a different API version - -There is a sequence of steps to upgrade to a new API version. - -1. Turn on the new api version -2. Upgrade the cluster's storage to use the new version. -3. Upgrade all config files. Identify users of the old api version endpoints. -4. Update existing objects in the storage to new version by running cluster/update-storage-objects.sh -3. Turn off the old version. - -### Turn on or off an API version for your cluster - -Specific API versions can be turned on or off by passing --runtime-config=api/ flag while bringing up the server. For example: to turn off v1 API, pass --runtime-config=api/v1=false. -runtime-config also supports 2 special keys: api/all and api/legacy to control all and legacy APIs respectively. For example, for turning off all api versions except v1, pass --runtime-config=api/all=false,api/v1=true. - -### Switching your cluster's storage API version - -KUBE_API_VERSIONS env var controls the API versions that are supported in the cluster. The first version in the list is used as the cluster's storage version. Hence, to set a specific version as the storage version, bring it to the front of list of versions in the value of KUBE_API_VERSIONS. - -### Switching your config files to a new API version - -You can use the kube-version-change utility to convert config files between different API versions. - -``` -$ hack/build-go.sh cmd/kube-version-change -$ _output/local/go/bin/kube-version-change -i myPod.v1beta3.yaml -o myPod.v1.yaml -``` - -### Maintenance on a Node - -If you need to reboot a node (such as for a kernel upgrade, libc upgrade, hardware repair, etc.), and the downtime is -brief, then when the Kubelet restarts, it will attempt to restart the pods scheduled to it. If the reboot takes longer, -then the node controller will terminate the pods that are bound to the unavailable node. If there is a corresponding -replication controller, then a new copy of the pod will be started on a different node. So, in the case where all -pods are replicated, upgrades can be done without special coordination. - -If you want more control over the upgrading process, you may use the following workflow: - 1. Mark the node to be rebooted as unschedulable: - `kubectl update nodes $NODENAME --patch='{"apiVersion": "v1", "spec": {"unschedulable": true}}'`. - This keeps new pods from landing on the node while you are trying to get them off. - 1. Get the pods off the machine, via any of the following strategies: - 1. wait for finite-duration pods to complete - 1. delete pods with `kubectl delete pods $PODNAME` - 1. for pods with a replication controller, the pod will eventually be replaced by a new pod which will be scheduled to a new node. additionally, if the pod is part of a service, then clients will automatically be redirected to the new pod. - 1. for pods with no replication controller, you need to bring up a new copy of the pod, and assuming it is not part of a service, redirect clients to it. - 1. Work on the node - 1. Make the node schedulable again: - `kubectl update nodes $NODENAME --patch='{"apiVersion": "v1", "spec": {"unschedulable": false}}'`. - If you deleted the node's VM instance and created a new one, then a new schedulable node resource will - be created automatically when you create a new VM instance (if you're using a cloud provider that supports - node discovery; currently this is only GCE, not including CoreOS on GCE using kube-register). See [Node](node.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/cluster_management.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/cluster_management.md?pixel)]() diff --git a/release-0.19.0/docs/container-environment.md b/release-0.19.0/docs/container-environment.md deleted file mode 100644 index 2e1cf3d2821..00000000000 --- a/release-0.19.0/docs/container-environment.md +++ /dev/null @@ -1,94 +0,0 @@ - -# Kubernetes Container Environment - -## Overview -This document describes the environment for Kubelet managed containers on a Kubernetes node (kNode).  In contrast to the Kubernetes cluster API, which provides an API for creating and managing containers, the Kubernetes container environment provides the container access to information about what else is going on in the cluster.  - -This cluster information makes it possible to build applications that are *cluster aware*.   -Additionally, the Kubernetes container environment defines a series of hooks that are surfaced to optional hook handlers defined as part of individual containers.  Container hooks are somewhat analogous to operating system signals in a traditional process model.   However these hooks are designed to make it easier to build reliable, scalable cloud applications in the Kubernetes cluster.  Containers that participate in this cluster lifecycle become *cluster native*.  - -Another important part of the container environment is the file system that is available to the container. In Kubernetes, the filesystem is a combination of an [image](./images.md) and one or more [volumes](./volumes.md). - - -The following sections describe both the cluster information provided to containers, as well as the hooks and life-cycle that allows containers to interact with the management system. - -## Cluster Information -There are two types of information that are available within the container environment.  There is information about the container itself, and there is information about other objects in the system. - -### Container Information -Currently, the only information about the container that is available to the container is the Pod name for the pod in which the container is running.  This ID is set as the hostname of the container, and is accessible through all calls to access the hostname within the container (e.g. the hostname command, or the [gethostname][1] function call in libc).  Additionally, user-defined environment variables from the pod definition, are also available to the container, as are any environment variables specified statically in the Docker image. - -In the future, we anticipate expanding this information with richer information about the container.  Examples include available memory, number of restarts, and in general any state that you could get from the call to GET /pods on the API server. - -### Cluster Information -Currently the list of all services that are running at the time when the container was created via the Kubernetes Cluster API are available to the container as environment variables.  The set of environment variables matches the syntax of Docker links. - -For a service named **foo** that maps to a container port named **bar**, the following variables are defined: - -```sh -FOO_SERVICE_HOST= -FOO_SERVICE_PORT= -``` - -Going forward, we expect that Services will have a dedicated IP address.  In that context, we will also surface services to the container via DNS.  Of course DNS is still not an enumerable protocol, so we will continue to provide environment variables so that containers can do discovery. - -## Container Hooks -*NB*: Container hooks are under active development, we anticipate adding additional hooks as the Kubernetes container management system evolves.* - -Container hooks provide information to the container about events in its management lifecycle.  For example, immediately after a container is started, it receives a *PostStart* hook.  These hooks are broadcast *into* the container with information about the life-cycle of the container.  They are different from the events provided by Docker and other systems which are *output* from the container.  Output events provide a log of what has already happened.  Input hooks provide real-time notification about things that are happening, but no historical log.   - -### Hook Details -There are currently two container hooks that are surfaced to containers, and two proposed hooks: - -*PreStart - ****Proposed*** - -This hook is sent immediately before a container is created.  It notifies that the container will be created immediately after the call completes.  No parameters are passed. *Note - *Some event handlers (namely ‘exec’ are incompatible with this event) - -*PostStart* - -This hook is sent immediately after a container is created.  It notifies the container that it has been created.  No parameters are passed to the handler. - -*PostRestart - ****Proposed*** - -This hook is called before the PostStart handler, when a container has been restarted, rather than started for the first time.  No parameters are passed to the handler. - -*PreStop* - -This hook is called immediately before a container is terminated.  This event handler is blocking, and must complete before the call to delete the container is sent to the Docker daemon. The SIGTERM notification sent by Docker is also still sent. - -A single parameter named reason is passed to the handler which contains the reason for termination.  Currently the valid values for reason are: - -* ```Delete``` - indicating an API call to delete the pod containing this container. -* ```Health``` - indicating that a health check of the container failed. -* ```Dependency``` - indicating that a dependency for the container or the pod is missing, and thus, the container needs to be restarted.  Examples include, the pod infra container crashing, or persistent disk failing for a container that mounts PD. - -Eventually, user specified reasons may be [added to the API](https://github.com/GoogleCloudPlatform/kubernetes/issues/137). - - -### Hook Handler Execution -When a management hook occurs, the management system calls into any registered hook handlers in the container for that hook.  These hook handler calls are synchronous in the context of the pod containing the container. Note:this means that hook handler execution blocks any further management of the pod.  If your hook handler blocks, no other management (including health checks) will occur until the hook handler completes.  Blocking hook handlers do *not* affect management of other Pods.  Typically we expect that users will make their hook handlers as lightweight as possible, but there are cases where long running commands make sense (e.g. saving state prior to container stop) - -For hooks which have parameters, these parameters are passed to the event handler as a set of key/value pairs.  The details of this parameter passing is handler implementation dependent (see below). - -### Hook delivery guarantees -Hook delivery is "at least one", which means that a hook may be called multiple times for any given event (e.g. "start" or "stop") and it is up to the hook implementer to be able to handle this -correctly. - -We expect double delivery to be rare, but in some cases if the ```kubelet``` restarts in the middle of sending a hook, the hook may be resent after the kubelet comes back up. - -Likewise, we only make a single delivery attempt. If (for example) an http hook receiver is down, and unable to take traffic, we do not make any attempts to resend. - -### Hook Handler Implementations -Hook handlers are the way that hooks are surfaced to containers.  Containers can select the type of hook handler they would like to implement.  Kubernetes currently supports two different hook handler types: - - * Exec - Executes a specific command (e.g. pre-stop.sh) inside the cgroup and namespaces of the container.  Resources consumed by the command are counted against the container.  Commands which print "ok" to standard out (stdout) are treated as healthy, any other output is treated as container failures (and will cause kubelet to forcibly restart the container).  Parameters are passed to the command as traditional linux command line flags (e.g. pre-stop.sh --reason=HEALTH) - - * HTTP - Executes an HTTP request against a specific endpoint on the container.  HTTP error codes (5xx) and non-response/failure to connect are treated as container failures. Parameters are passed to the http endpoint as query args (e.g. http://some.server.com/some/path?reason=HEALTH) - -[1]: http://man7.org/linux/man-pages/man2/gethostname.2.html - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/container-environment.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/container-environment.md?pixel)]() diff --git a/release-0.19.0/docs/containers.md b/release-0.19.0/docs/containers.md deleted file mode 100644 index c77ea80ca6e..00000000000 --- a/release-0.19.0/docs/containers.md +++ /dev/null @@ -1,95 +0,0 @@ -# Containers with Kubernetes - -## Containers and commands - -So far the Pods we've seen have all used the `image` field to indicate what process Kubernetes -should run in a container. In this case, Kubernetes runs the image's default command. If we want -to run a particular command or override the image's defaults, there are two additional fields that -we can use: - -1. `Command`: Controls the actual command run by the image -2. `Args`: Controls the arguments passed to the command - -### How docker handles command and arguments - -Docker images have metadata associated with them that is used to store information about the image. -The image author may use this to define defaults for the command and arguments to run a container -when the user does not supply values. Docker calls the fields for commands and arguments -`Entrypoint` and `Cmd` respectively. The full details for this feature are too complicated to -describe here, mostly due to the fact that the docker API allows users to specify both of these -fields as either a string array or a string and there are subtle differences in how those cases are -handled. We encourage the curious to check out [docker's documentation]() for this feature. - -Kubernetes allows you to override both the image's default command (docker `Entrypoint`) and args -(docker `Cmd`) with the `Command` and `Args` fields of `Container`. The rules are: - -1. If you do not supply a `Command` or `Args` for a container, the defaults defined by the image - will be used -2. If you supply a `Command` but no `Args` for a container, only the supplied `Command` will be - used; the image's default arguments are ignored -3. If you supply only `Args`, the image's default command will be used with the arguments you - supply -4. If you supply a `Command` **and** `Args`, the image's defaults will be ignored and the values - you supply will be used - -Here are examples for these rules in table format - -| Image `Entrypoint` | Image `Cmd` | Container `Command` | Container `Args` | Command Run | -|--------------------|------------------|---------------------|--------------------|------------------| -| `[/ep-1]` | `[foo bar]` | <not set> | <not set> | `[ep-1 foo bar]` | -| `[/ep-1]` | `[foo bar]` | `[/ep-2]` | <not set> | `[ep-2]` | -| `[/ep-1]` | `[foo bar]` | <not set> | `[zoo boo]` | `[ep-1 zoo boo]` | -| `[/ep-1]` | `[foo bar]` | `[/ep-2]` | `[zoo boo]` | `[ep-2 zoo boo]` | - - -## Capabilities - -By default, Docker containers are "unprivileged" and cannot, for example, run a Docker daemon inside a Docker container. We can have fine grain control over the capabilities using cap-add and cap-drop.More details [here](https://docs.docker.com/reference/run/#runtime-privilege-linux-capabilities-and-lxc-configuration). - -The relationship between Docker's capabilities and [Linux capabilities](http://man7.org/linux/man-pages/man7/capabilities.7.html) - -| Docker's capabilities | Linux capabilities | -| ---- | ---- | -| SETPCAP | CAP_SETPCAP | -| SYS_MODULE | CAP_SYS_MODULE | -| SYS_RAWIO | CAP_SYS_RAWIO | -| SYS_PACCT | CAP_SYS_PACCT | -| SYS_ADMIN | CAP_SYS_ADMIN | -| SYS_NICE | CAP_SYS_NICE | -| SYS_RESOURCE | CAP_SYS_RESOURCE | -| SYS_TIME | CAP_SYS_TIME | -| SYS_TTY_CONFIG | CAP_SYS_TTY_CONFIG | -| MKNOD | CAP_MKNOD | -| AUDIT_WRITE | CAP_AUDIT_WRITE | -| AUDIT_CONTROL | CAP_AUDIT_CONTROL | -| MAC_OVERRIDE | CAP_MAC_OVERRIDE | -| MAC_ADMIN | CAP_MAC_ADMIN | -| NET_ADMIN | CAP_NET_ADMIN | -| SYSLOG | CAP_SYSLOG | -| CHOWN | CAP_CHOWN | -| NET_RAW | CAP_NET_RAW | -| DAC_OVERRIDE | CAP_DAC_OVERRIDE | -| FOWNER | CAP_FOWNER | -| DAC_READ_SEARCH | CAP_DAC_READ_SEARCH | -| FSETID | CAP_FSETID | -| KILL | CAP_KILL | -| SETGID | CAP_SETGID | -| SETUID | CAP_SETUID | -| LINUX_IMMUTABLE | CAP_LINUX_IMMUTABLE | -| NET_BIND_SERVICE | CAP_NET_BIND_SERVICE | -| NET_BROADCAST | CAP_NET_BROADCAST | -| IPC_LOCK | CAP_IPC_LOCK | -| IPC_OWNER | CAP_IPC_OWNER | -| SYS_CHROOT | CAP_SYS_CHROOT | -| SYS_PTRACE | CAP_SYS_PTRACE | -| SYS_BOOT | CAP_SYS_BOOT | -| LEASE | CAP_LEASE | -| SETFCAP | CAP_SETFCAP | -| WAKE_ALARM | CAP_WAKE_ALARM | -| BLOCK_SUSPEND | CAP_BLOCK_SUSPEND | - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/containers.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/containers.md?pixel)]() diff --git a/release-0.19.0/docs/design/README.md b/release-0.19.0/docs/design/README.md deleted file mode 100644 index befb6da3099..00000000000 --- a/release-0.19.0/docs/design/README.md +++ /dev/null @@ -1,23 +0,0 @@ -# Kubernetes Design Overview - -Kubernetes is a system for managing containerized applications across multiple hosts, providing basic mechanisms for deployment, maintenance, and scaling of applications. - -Kubernetes establishes robust declarative primitives for maintaining the desired state requested by the user. We see these primitives as the main value added by Kubernetes. Self-healing mechanisms, such as auto-restarting, re-scheduling, and replicating containers require active controllers, not just imperative orchestration. - -Kubernetes is primarily targeted at applications composed of multiple containers, such as elastic, distributed micro-services. It is also designed to facilitate migration of non-containerized application stacks to Kubernetes. It therefore includes abstractions for grouping containers in both loosely coupled and tightly coupled formations, and provides ways for containers to find and communicate with each other in relatively familiar ways. - -Kubernetes enables users to ask a cluster to run a set of containers. The system automatically chooses hosts to run those containers on. While Kubernetes's scheduler is currently very simple, we expect it to grow in sophistication over time. Scheduling is a policy-rich, topology-aware, workload-specific function that significantly impacts availability, performance, and capacity. The scheduler needs to take into account individual and collective resource requirements, quality of service requirements, hardware/software/policy constraints, affinity and anti-affinity specifications, data locality, inter-workload interference, deadlines, and so on. Workload-specific requirements will be exposed through the API as necessary. - -Kubernetes is intended to run on a number of cloud providers, as well as on physical hosts. - -A single Kubernetes cluster is not intended to span multiple availability zones. Instead, we recommend building a higher-level layer to replicate complete deployments of highly available applications across multiple zones (see [the availability doc](../availability.md) and [cluster federation proposal](../proposals/federation.md) for more details). - -Finally, Kubernetes aspires to be an extensible, pluggable, building-block OSS platform and toolkit. Therefore, architecturally, we want Kubernetes to be built as a collection of pluggable components and layers, with the ability to use alternative schedulers, controllers, storage systems, and distribution mechanisms, and we're evolving its current code in that direction. Furthermore, we want others to be able to extend Kubernetes functionality, such as with higher-level PaaS functionality or multi-cluster layers, without modification of core Kubernetes source. Therefore, its API isn't just (or even necessarily mainly) targeted at end users, but at tool and extension developers. Its APIs are intended to serve as the foundation for an open ecosystem of tools, automation systems, and higher-level API layers. Consequently, there are no "internal" inter-component APIs. All APIs are visible and available, including the APIs used by the scheduler, the node controller, the replication-controller manager, Kubelet's API, etc. There's no glass to break -- in order to handle more complex use cases, one can just access the lower-level APIs in a fully transparent, composable manner. - -For more about the Kubernetes architecture, see [architecture](architecture.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/README.md?pixel)]() diff --git a/release-0.19.0/docs/design/access.md b/release-0.19.0/docs/design/access.md deleted file mode 100644 index 6bded9e2dc2..00000000000 --- a/release-0.19.0/docs/design/access.md +++ /dev/null @@ -1,254 +0,0 @@ -# K8s Identity and Access Management Sketch - -This document suggests a direction for identity and access management in the Kubernetes system. - - -## Background - -High level goals are: - - Have a plan for how identity, authentication, and authorization will fit in to the API. - - Have a plan for partitioning resources within a cluster between independent organizational units. - - Ease integration with existing enterprise and hosted scenarios. - -### Actors -Each of these can act as normal users or attackers. - - External Users: People who are accessing applications running on K8s (e.g. a web site served by webserver running in a container on K8s), but who do not have K8s API access. - - K8s Users : People who access the K8s API (e.g. create K8s API objects like Pods) - - K8s Project Admins: People who manage access for some K8s Users - - K8s Cluster Admins: People who control the machines, networks, or binaries that make up a K8s cluster. - - K8s Admin means K8s Cluster Admins and K8s Project Admins taken together. - -### Threats -Both intentional attacks and accidental use of privilege are concerns. - -For both cases it may be useful to think about these categories differently: - - Application Path - attack by sending network messages from the internet to the IP/port of any application running on K8s. May exploit weakness in application or misconfiguration of K8s. - - K8s API Path - attack by sending network messages to any K8s API endpoint. - - Insider Path - attack on K8s system components. Attacker may have privileged access to networks, machines or K8s software and data. Software errors in K8s system components and administrator error are some types of threat in this category. - -This document is primarily concerned with K8s API paths, and secondarily with Internal paths. The Application path also needs to be secure, but is not the focus of this document. - -### Assets to protect - -External User assets: - - Personal information like private messages, or images uploaded by External Users - - web server logs - -K8s User assets: - - External User assets of each K8s User - - things private to the K8s app, like: - - credentials for accessing other services (docker private repos, storage services, facebook, etc) - - SSL certificates for web servers - - proprietary data and code - -K8s Cluster assets: - - Assets of each K8s User - - Machine Certificates or secrets. - - The value of K8s cluster computing resources (cpu, memory, etc). - -This document is primarily about protecting K8s User assets and K8s cluster assets from other K8s Users and K8s Project and Cluster Admins. - -### Usage environments -Cluster in Small organization: - - K8s Admins may be the same people as K8s Users. - - few K8s Admins. - - prefer ease of use to fine-grained access control/precise accounting, etc. - - Product requirement that it be easy for potential K8s Cluster Admin to try out setting up a simple cluster. - -Cluster in Large organization: - - K8s Admins typically distinct people from K8s Users. May need to divide K8s Cluster Admin access by roles. - - K8s Users need to be protected from each other. - - Auditing of K8s User and K8s Admin actions important. - - flexible accurate usage accounting and resource controls important. - - Lots of automated access to APIs. - - Need to integrate with existing enterprise directory, authentication, accounting, auditing, and security policy infrastructure. - -Org-run cluster: - - organization that runs K8s master components is same as the org that runs apps on K8s. - - Nodes may be on-premises VMs or physical machines; Cloud VMs; or a mix. - -Hosted cluster: - - Offering K8s API as a service, or offering a Paas or Saas built on K8s - - May already offer web services, and need to integrate with existing customer account concept, and existing authentication, accounting, auditing, and security policy infrastructure. - - May want to leverage K8s User accounts and accounting to manage their User accounts (not a priority to support this use case.) - - Precise and accurate accounting of resources needed. Resource controls needed for hard limits (Users given limited slice of data) and soft limits (Users can grow up to some limit and then be expanded). - -K8s ecosystem services: - - There may be companies that want to offer their existing services (Build, CI, A/B-test, release automation, etc) for use with K8s. There should be some story for this case. - -Pods configs should be largely portable between Org-run and hosted configurations. - - -# Design -Related discussion: -- https://github.com/GoogleCloudPlatform/kubernetes/issues/442 -- https://github.com/GoogleCloudPlatform/kubernetes/issues/443 - -This doc describes two security profiles: - - Simple profile: like single-user mode. Make it easy to evaluate K8s without lots of configuring accounts and policies. Protects from unauthorized users, but does not partition authorized users. - - Enterprise profile: Provide mechanisms needed for large numbers of users. Defense in depth. Should integrate with existing enterprise security infrastructure. - -K8s distribution should include templates of config, and documentation, for simple and enterprise profiles. System should be flexible enough for knowledgeable users to create intermediate profiles, but K8s developers should only reason about those two Profiles, not a matrix. - -Features in this doc are divided into "Initial Feature", and "Improvements". Initial features would be candidates for version 1.00. - -## Identity -###userAccount -K8s will have a `userAccount` API object. -- `userAccount` has a UID which is immutable. This is used to associate users with objects and to record actions in audit logs. -- `userAccount` has a name which is a string and human readable and unique among userAccounts. It is used to refer to users in Policies, to ensure that the Policies are human readable. It can be changed only when there are no Policy objects or other objects which refer to that name. An email address is a suggested format for this field. -- `userAccount` is not related to the unix username of processes in Pods created by that userAccount. -- `userAccount` API objects can have labels - -The system may associate one or more Authentication Methods with a -`userAccount` (but they are not formally part of the userAccount object.) -In a simple deployment, the authentication method for a -user might be an authentication token which is verified by a K8s server. In a -more complex deployment, the authentication might be delegated to -another system which is trusted by the K8s API to authenticate users, but where -the authentication details are unknown to K8s. - -Initial Features: -- there is no superuser `userAccount` -- `userAccount` objects are statically populated in the K8s API store by reading a config file. Only a K8s Cluster Admin can do this. -- `userAccount` can have a default `namespace`. If API call does not specify a `namespace`, the default `namespace` for that caller is assumed. -- `userAccount` is global. A single human with access to multiple namespaces is recommended to only have one userAccount. - -Improvements: -- Make `userAccount` part of a separate API group from core K8s objects like `pod`. Facilitates plugging in alternate Access Management. - -Simple Profile: - - single `userAccount`, used by all K8s Users and Project Admins. One access token shared by all. - -Enterprise Profile: - - every human user has own `userAccount`. - - `userAccount`s have labels that indicate both membership in groups, and ability to act in certain roles. - - each service using the API has own `userAccount` too. (e.g. `scheduler`, `repcontroller`) - - automated jobs to denormalize the ldap group info into the local system list of users into the K8s userAccount file. - -###Unix accounts -A `userAccount` is not a Unix user account. The fact that a pod is started by a `userAccount` does not mean that the processes in that pod's containers run as a Unix user with a corresponding name or identity. - -Initially: -- The unix accounts available in a container, and used by the processes running in a container are those that are provided by the combination of the base operating system and the Docker manifest. -- Kubernetes doesn't enforce any relation between `userAccount` and unix accounts. - -Improvements: -- Kubelet allocates disjoint blocks of root-namespace uids for each container. This may provide some defense-in-depth against container escapes. (https://github.com/docker/docker/pull/4572) -- requires docker to integrate user namespace support, and deciding what getpwnam() does for these uids. -- any features that help users avoid use of privileged containers (https://github.com/GoogleCloudPlatform/kubernetes/issues/391) - -###Namespaces -K8s will have a have a `namespace` API object. It is similar to a Google Compute Engine `project`. It provides a namespace for objects created by a group of people co-operating together, preventing name collisions with non-cooperating groups. It also serves as a reference point for authorization policies. - -Namespaces are described in [namespace.md](namespaces.md). - -In the Enterprise Profile: - - a `userAccount` may have permission to access several `namespace`s. - -In the Simple Profile: - - There is a single `namespace` used by the single user. - -Namespaces versus userAccount vs Labels: -- `userAccount`s are intended for audit logging (both name and UID should be logged), and to define who has access to `namespace`s. -- `labels` (see [docs/labels.md](/docs/labels.md)) should be used to distinguish pods, users, and other objects that cooperate towards a common goal but are different in some way, such as version, or responsibilities. -- `namespace`s prevent name collisions between uncoordinated groups of people, and provide a place to attach common policies for co-operating groups of people. - - -## Authentication - -Goals for K8s authentication: -- Include a built-in authentication system with no configuration required to use in single-user mode, and little configuration required to add several user accounts, and no https proxy required. -- Allow for authentication to be handled by a system external to Kubernetes, to allow integration with existing to enterprise authorization systems. The kubernetes namespace itself should avoid taking contributions of multiple authorization schemes. Instead, a trusted proxy in front of the apiserver can be used to authenticate users. - - For organizations whose security requirements only allow FIPS compliant implementations (e.g. apache) for authentication. - - So the proxy can terminate SSL, and isolate the CA-signed certificate from less trusted, higher-touch APIserver. - - For organizations that already have existing SaaS web services (e.g. storage, VMs) and want a common authentication portal. -- Avoid mixing authentication and authorization, so that authorization policies be centrally managed, and to allow changes in authentication methods without affecting authorization code. - -Initially: -- Tokens used to authenticate a user. -- Long lived tokens identify a particular `userAccount`. -- Administrator utility generates tokens at cluster setup. -- OAuth2.0 Bearer tokens protocol, http://tools.ietf.org/html/rfc6750 -- No scopes for tokens. Authorization happens in the API server -- Tokens dynamically generated by apiserver to identify pods which are making API calls. -- Tokens checked in a module of the APIserver. -- Authentication in apiserver can be disabled by flag, to allow testing without authorization enabled, and to allow use of an authenticating proxy. In this mode, a query parameter or header added by the proxy will identify the caller. - -Improvements: -- Refresh of tokens. -- SSH keys to access inside containers. - -To be considered for subsequent versions: -- Fuller use of OAuth (http://tools.ietf.org/html/rfc6749) -- Scoped tokens. -- Tokens that are bound to the channel between the client and the api server - - http://www.ietf.org/proceedings/90/slides/slides-90-uta-0.pdf - - http://www.browserauth.net - - -## Authorization - -K8s authorization should: -- Allow for a range of maturity levels, from single-user for those test driving the system, to integration with existing to enterprise authorization systems. -- Allow for centralized management of users and policies. In some organizations, this will mean that the definition of users and access policies needs to reside on a system other than k8s and encompass other web services (such as a storage service). -- Allow processes running in K8s Pods to take on identity, and to allow narrow scoping of permissions for those identities in order to limit damage from software faults. -- Have Authorization Policies exposed as API objects so that a single config file can create or delete Pods, Controllers, Services, and the identities and policies for those Pods and Controllers. -- Be separate as much as practical from Authentication, to allow Authentication methods to change over time and space, without impacting Authorization policies. - -K8s will implement a relatively simple -[Attribute-Based Access Control](http://en.wikipedia.org/wiki/Attribute_Based_Access_Control) model. -The model will be described in more detail in a forthcoming document. The model will -- Be less complex than XACML -- Be easily recognizable to those familiar with Amazon IAM Policies. -- Have a subset/aliases/defaults which allow it to be used in a way comfortable to those users more familiar with Role-Based Access Control. - -Authorization policy is set by creating a set of Policy objects. - -The API Server will be the Enforcement Point for Policy. For each API call that it receives, it will construct the Attributes needed to evaluate the policy (what user is making the call, what resource they are accessing, what they are trying to do that resource, etc) and pass those attributes to a Decision Point. The Decision Point code evaluates the Attributes against all the Policies and allows or denies the API call. The system will be modular enough that the Decision Point code can either be linked into the APIserver binary, or be another service that the apiserver calls for each Decision (with appropriate time-limited caching as needed for performance). - -Policy objects may be applicable only to a single namespace or to all namespaces; K8s Project Admins would be able to create those as needed. Other Policy objects may be applicable to all namespaces; a K8s Cluster Admin might create those in order to authorize a new type of controller to be used by all namespaces, or to make a K8s User into a K8s Project Admin.) - - -## Accounting - -The API should have a `quota` concept (see https://github.com/GoogleCloudPlatform/kubernetes/issues/442). A quota object relates a namespace (and optionally a label selector) to a maximum quantity of resources that may be used (see [resources.md](/docs/resources.md)). - -Initially: -- a `quota` object is immutable. -- for hosted K8s systems that do billing, Project is recommended level for billing accounts. -- Every object that consumes resources should have a `namespace` so that Resource usage stats are roll-up-able to `namespace`. -- K8s Cluster Admin sets quota objects by writing a config file. - -Improvements: -- allow one namespace to charge the quota for one or more other namespaces. This would be controlled by a policy which allows changing a billing_namespace= label on an object. -- allow quota to be set by namespace owners for (namespace x label) combinations (e.g. let "webserver" namespace use 100 cores, but to prevent accidents, don't allow "webserver" namespace and "instance=test" use more than 10 cores. -- tools to help write consistent quota config files based on number of nodes, historical namespace usages, QoS needs, etc. -- way for K8s Cluster Admin to incrementally adjust Quota objects. - -Simple profile: - - a single `namespace` with infinite resource limits. - -Enterprise profile: - - multiple namespaces each with their own limits. - -Issues: -- need for locking or "eventual consistency" when multiple apiserver goroutines are accessing the object store and handling pod creations. - - -## Audit Logging - -API actions can be logged. - -Initial implementation: -- All API calls logged to nginx logs. - -Improvements: -- API server does logging instead. -- Policies to drop logging for high rate trusted API calls, or by users performing audit or other sensitive functions. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/access.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/access.md?pixel)]() diff --git a/release-0.19.0/docs/design/admission_control.md b/release-0.19.0/docs/design/admission_control.md deleted file mode 100644 index eee3c94a77c..00000000000 --- a/release-0.19.0/docs/design/admission_control.md +++ /dev/null @@ -1,85 +0,0 @@ -# Kubernetes Proposal - Admission Control - -**Related PR:** - -| Topic | Link | -| ----- | ---- | -| Separate validation from RESTStorage | https://github.com/GoogleCloudPlatform/kubernetes/issues/2977 | - -## Background - -High level goals: - -* Enable an easy-to-use mechanism to provide admission control to cluster -* Enable a provider to support multiple admission control strategies or author their own -* Ensure any rejected request can propagate errors back to the caller with why the request failed - -Authorization via policy is focused on answering if a user is authorized to perform an action. - -Admission Control is focused on if the system will accept an authorized action. - -Kubernetes may choose to dismiss an authorized action based on any number of admission control strategies. - -This proposal documents the basic design, and describes how any number of admission control plug-ins could be injected. - -Implementation of specific admission control strategies are handled in separate documents. - -## kube-apiserver - -The kube-apiserver takes the following OPTIONAL arguments to enable admission control - -| Option | Behavior | -| ------ | -------- | -| admission_control | Comma-delimited, ordered list of admission control choices to invoke prior to modifying or deleting an object. | -| admission_control_config_file | File with admission control configuration parameters to boot-strap plug-in. | - -An **AdmissionControl** plug-in is an implementation of the following interface: - -```go -package admission - -// Attributes is an interface used by a plug-in to make an admission decision on a individual request. -type Attributes interface { - GetNamespace() string - GetKind() string - GetOperation() string - GetObject() runtime.Object -} - -// Interface is an abstract, pluggable interface for Admission Control decisions. -type Interface interface { - // Admit makes an admission decision based on the request attributes - // An error is returned if it denies the request. - Admit(a Attributes) (err error) -} -``` - -A **plug-in** must be compiled with the binary, and is registered as an available option by providing a name, and implementation -of admission.Interface. - -```go -func init() { - admission.RegisterPlugin("AlwaysDeny", func(client client.Interface, config io.Reader) (admission.Interface, error) { return NewAlwaysDeny(), nil }) -} -``` - -Invocation of admission control is handled by the **APIServer** and not individual **RESTStorage** implementations. - -This design assumes that **Issue 297** is adopted, and as a consequence, the general framework of the APIServer request/response flow -will ensure the following: - -1. Incoming request -2. Authenticate user -3. Authorize user -4. If operation=create|update, then validate(object) -5. If operation=create|update|delete, then admission.Admit(requestAttributes) - a. invoke each admission.Interface object in sequence -6. Object is persisted - -If at any step, there is an error, the request is canceled. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/admission_control.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/admission_control.md?pixel)]() diff --git a/release-0.19.0/docs/design/admission_control_limit_range.md b/release-0.19.0/docs/design/admission_control_limit_range.md deleted file mode 100644 index 9ed98e1c535..00000000000 --- a/release-0.19.0/docs/design/admission_control_limit_range.md +++ /dev/null @@ -1,138 +0,0 @@ -# Admission control plugin: LimitRanger - -## Background - -This document proposes a system for enforcing min/max limits per resource as part of admission control. - -## Model Changes - -A new resource, **LimitRange**, is introduced to enumerate min/max limits for a resource type scoped to a -Kubernetes namespace. - -```go -const ( - // Limit that applies to all pods in a namespace - LimitTypePod string = "Pod" - // Limit that applies to all containers in a namespace - LimitTypeContainer string = "Container" -) - -// LimitRangeItem defines a min/max usage limit for any resource that matches on kind -type LimitRangeItem struct { - // Type of resource that this limit applies to - Type string `json:"type,omitempty"` - // Max usage constraints on this kind by resource name - Max ResourceList `json:"max,omitempty"` - // Min usage constraints on this kind by resource name - Min ResourceList `json:"min,omitempty"` - // Default usage constraints on this kind by resource name - Default ResourceList `json:"default,omitempty"` -} - -// LimitRangeSpec defines a min/max usage limit for resources that match on kind -type LimitRangeSpec struct { - // Limits is the list of LimitRangeItem objects that are enforced - Limits []LimitRangeItem `json:"limits"` -} - -// LimitRange sets resource usage limits for each kind of resource in a Namespace -type LimitRange struct { - TypeMeta `json:",inline"` - ObjectMeta `json:"metadata,omitempty"` - - // Spec defines the limits enforced - Spec LimitRangeSpec `json:"spec,omitempty"` -} - -// LimitRangeList is a list of LimitRange items. -type LimitRangeList struct { - TypeMeta `json:",inline"` - ListMeta `json:"metadata,omitempty"` - - // Items is a list of LimitRange objects - Items []LimitRange `json:"items"` -} -``` - -## AdmissionControl plugin: LimitRanger - -The **LimitRanger** plug-in introspects all incoming admission requests. - -It makes decisions by evaluating the incoming object against all defined **LimitRange** objects in the request context namespace. - -The following min/max limits are imposed: - -**Type: Container** - -| ResourceName | Description | -| ------------ | ----------- | -| cpu | Min/Max amount of cpu per container | -| memory | Min/Max amount of memory per container | - -**Type: Pod** - -| ResourceName | Description | -| ------------ | ----------- | -| cpu | Min/Max amount of cpu per pod | -| memory | Min/Max amount of memory per pod | - -If a resource specifies a default value, it may get applied on the incoming resource. For example, if a default -value is provided for container cpu, it is set on the incoming container if and only if the incoming container -does not specify a resource requirements limit field. - -If a resource specifies a min value, it may get applied on the incoming resource. For example, if a min -value is provided for container cpu, it is set on the incoming container if and only if the incoming container does -not specify a resource requirements requests field. - -If the incoming object would cause a violation of the enumerated constraints, the request is denied with a set of -messages explaining what constraints were the source of the denial. - -If a constraint is not enumerated by a **LimitRange** it is not tracked. - -## kube-apiserver - -The server is updated to be aware of **LimitRange** objects. - -The constraints are only enforced if the kube-apiserver is started as follows: - -``` -$ kube-apiserver -admission_control=LimitRanger -``` - -## kubectl - -kubectl is modified to support the **LimitRange** resource. - -```kubectl describe``` provides a human-readable output of limits. - -For example, - -```shell -$ kubectl namespace myspace -$ kubectl create -f examples/limitrange/limit-range.json -$ kubectl get limits -NAME -limits -$ kubectl describe limits limits -Name: limits -Type Resource Min Max Default ----- -------- --- --- --- -Pod memory 1Mi 1Gi - -Pod cpu 250m 2 - -Container memory 1Mi 1Gi 1Mi -Container cpu 250m 250m 250m -``` - -## Future Enhancements: Define limits for a particular pod or container. - -In the current proposal, the **LimitRangeItem** matches purely on **LimitRangeItem.Type** - -It is expected we will want to define limits for particular pods or containers by name/uid and label/field selector. - -To make a **LimitRangeItem** more restrictive, we will intend to add these additional restrictions at a future point in time. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/admission_control_limit_range.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/admission_control_limit_range.md?pixel)]() diff --git a/release-0.19.0/docs/design/admission_control_resource_quota.md b/release-0.19.0/docs/design/admission_control_resource_quota.md deleted file mode 100644 index 1ea19b75dee..00000000000 --- a/release-0.19.0/docs/design/admission_control_resource_quota.md +++ /dev/null @@ -1,159 +0,0 @@ -# Admission control plugin: ResourceQuota - -## Background - -This document proposes a system for enforcing hard resource usage limits per namespace as part of admission control. - -## Model Changes - -A new resource, **ResourceQuota**, is introduced to enumerate hard resource limits in a Kubernetes namespace. - -A new resource, **ResourceQuotaUsage**, is introduced to support atomic updates of a **ResourceQuota** status. - -```go -// The following identify resource constants for Kubernetes object types -const ( - // Pods, number - ResourcePods ResourceName = "pods" - // Services, number - ResourceServices ResourceName = "services" - // ReplicationControllers, number - ResourceReplicationControllers ResourceName = "replicationcontrollers" - // ResourceQuotas, number - ResourceQuotas ResourceName = "resourcequotas" -) - -// ResourceQuotaSpec defines the desired hard limits to enforce for Quota -type ResourceQuotaSpec struct { - // Hard is the set of desired hard limits for each named resource - Hard ResourceList `json:"hard,omitempty"` -} - -// ResourceQuotaStatus defines the enforced hard limits and observed use -type ResourceQuotaStatus struct { - // Hard is the set of enforced hard limits for each named resource - Hard ResourceList `json:"hard,omitempty"` - // Used is the current observed total usage of the resource in the namespace - Used ResourceList `json:"used,omitempty"` -} - -// ResourceQuota sets aggregate quota restrictions enforced per namespace -type ResourceQuota struct { - TypeMeta `json:",inline"` - ObjectMeta `json:"metadata,omitempty"` - - // Spec defines the desired quota - Spec ResourceQuotaSpec `json:"spec,omitempty"` - - // Status defines the actual enforced quota and its current usage - Status ResourceQuotaStatus `json:"status,omitempty"` -} - -// ResourceQuotaUsage captures system observed quota status per namespace -// It is used to enforce atomic updates of a backing ResourceQuota.Status field in storage -type ResourceQuotaUsage struct { - TypeMeta `json:",inline"` - ObjectMeta `json:"metadata,omitempty"` - - // Status defines the actual enforced quota and its current usage - Status ResourceQuotaStatus `json:"status,omitempty"` -} - -// ResourceQuotaList is a list of ResourceQuota items -type ResourceQuotaList struct { - TypeMeta `json:",inline"` - ListMeta `json:"metadata,omitempty"` - - // Items is a list of ResourceQuota objects - Items []ResourceQuota `json:"items"` -} - -``` - -## AdmissionControl plugin: ResourceQuota - -The **ResourceQuota** plug-in introspects all incoming admission requests. - -It makes decisions by evaluating the incoming object against all defined **ResourceQuota.Status.Hard** resource limits in the request -namespace. If acceptance of the resource would cause the total usage of a named resource to exceed its hard limit, the request is denied. - -The following resource limits are imposed as part of core Kubernetes at the namespace level: - -| ResourceName | Description | -| ------------ | ----------- | -| cpu | Total cpu usage | -| memory | Total memory usage | -| pods | Total number of pods | -| services | Total number of services | -| replicationcontrollers | Total number of replication controllers | -| resourcequotas | Total number of resource quotas | - -Any resource that is not part of core Kubernetes must follow the resource naming convention prescribed by Kubernetes. - -This means the resource must have a fully-qualified name (i.e. mycompany.org/shinynewresource) - -If the incoming request does not cause the total usage to exceed any of the enumerated hard resource limits, the plug-in will post a -**ResourceQuotaUsage** document to the server to atomically update the observed usage based on the previously read -**ResourceQuota.ResourceVersion**. This keeps incremental usage atomically consistent, but does introduce a bottleneck (intentionally) -into the system. - -To optimize system performance, it is encouraged that all resource quotas are tracked on the same **ResourceQuota** document. As a result, -its encouraged to actually impose a cap on the total number of individual quotas that are tracked in the **Namespace** to 1 by explicitly -capping it in **ResourceQuota** document. - -## kube-apiserver - -The server is updated to be aware of **ResourceQuota** objects. - -The quota is only enforced if the kube-apiserver is started as follows: - -``` -$ kube-apiserver -admission_control=ResourceQuota -``` - -## kube-controller-manager - -A new controller is defined that runs a synch loop to calculate quota usage across the namespace. - -**ResourceQuota** usage is only calculated if a namespace has a **ResourceQuota** object. - -If the observed usage is different than the recorded usage, the controller sends a **ResourceQuotaUsage** resource -to the server to atomically update. - -The synchronization loop frequency will control how quickly DELETE actions are recorded in the system and usage is ticked down. - -To optimize the synchronization loop, this controller will WATCH on Pod resources to track DELETE events, and in response, recalculate -usage. This is because a Pod deletion will have the most impact on observed cpu and memory usage in the system, and we anticipate -this being the resource most closely running at the prescribed quota limits. - -## kubectl - -kubectl is modified to support the **ResourceQuota** resource. - -```kubectl describe``` provides a human-readable output of quota. - -For example, - -``` -$ kubectl namespace myspace -$ kubectl create -f examples/resourcequota/resource-quota.json -$ kubectl get quota -NAME -quota -$ kubectl describe quota quota -Name: quota -Resource Used Hard --------- ---- ---- -cpu 0m 20 -memory 0 1Gi -pods 5 10 -replicationcontrollers 5 20 -resourcequotas 1 1 -services 3 5 -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/admission_control_resource_quota.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/admission_control_resource_quota.md?pixel)]() diff --git a/release-0.19.0/docs/design/architecture.md b/release-0.19.0/docs/design/architecture.md deleted file mode 100644 index 92f73a72894..00000000000 --- a/release-0.19.0/docs/design/architecture.md +++ /dev/null @@ -1,50 +0,0 @@ -# Kubernetes architecture - -A running Kubernetes cluster contains node agents (kubelet) and master components (APIs, scheduler, etc), on top of a distributed storage solution. This diagram shows our desired eventual state, though we're still working on a few things, like making kubelet itself (all our components, really) run within containers, and making the scheduler 100% pluggable. - -![Architecture Diagram](../architecture.png?raw=true "Architecture overview") - -## The Kubernetes Node - -When looking at the architecture of the system, we'll break it down to services that run on the worker node and services that compose the cluster-level control plane. - -The Kubernetes node has the services necessary to run application containers and be managed from the master systems. - -Each node runs Docker, of course. Docker takes care of the details of downloading images and running containers. - -### Kubelet -The **Kubelet** manages [pods](../pods.md) and their containers, their images, their volumes, etc. - -### Kube-Proxy - -Each node also runs a simple network proxy and load balancer (see the [services FAQ](https://github.com/GoogleCloudPlatform/kubernetes/wiki/Services-FAQ) for more details). This reflects `services` (see [the services doc](../services.md) for more details) as defined in the Kubernetes API on each node and can do simple TCP and UDP stream forwarding (round robin) across a set of backends. - -Service endpoints are currently found via [DNS](../dns.md) or through environment variables (both [Docker-links-compatible](https://docs.docker.com/userguide/dockerlinks/) and Kubernetes {FOO}_SERVICE_HOST and {FOO}_SERVICE_PORT variables are supported). These variables resolve to ports managed by the service proxy. - -## The Kubernetes Control Plane - -The Kubernetes control plane is split into a set of components. Currently they all run on a single _master_ node, but that is expected to change soon in order to support high-availability clusters. These components work together to provide a unified view of the cluster. - -### etcd - -All persistent master state is stored in an instance of `etcd`. This provides a great way to store configuration data reliably. With `watch` support, coordinating components can be notified very quickly of changes. - -### Kubernetes API Server - -The apiserver serves up the [Kubernetes API](../api.md). It is intended to be a CRUD-y server, with most/all business logic implemented in separate components or in plug-ins. It mainly processes REST operations, validates them, and updates the corresponding objects in `etcd` (and eventually other stores). - -### Scheduler - -The scheduler binds unscheduled pods to nodes via the `/binding` API. The scheduler is pluggable, and we expect to support multiple cluster schedulers and even user-provided schedulers in the future. - -### Kubernetes Controller Manager Server - -All other cluster-level functions are currently performed by the Controller Manager. For instance, `Endpoints` objects are created and updated by the endpoints controller, and nodes are discovered, managed, and monitored by the node controller. These could eventually be split into separate components to make them independently pluggable. - -The [`replicationcontroller`](../replication-controller.md) is a mechanism that is layered on top of the simple [`pod`](../pods.md) API. We eventually plan to port it to a generic plug-in mechanism, once one is implemented. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/architecture.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/architecture.md?pixel)]() diff --git a/release-0.19.0/docs/design/clustering.md b/release-0.19.0/docs/design/clustering.md deleted file mode 100644 index 43cb31645da..00000000000 --- a/release-0.19.0/docs/design/clustering.md +++ /dev/null @@ -1,66 +0,0 @@ -# Clustering in Kubernetes - - -## Overview -The term "clustering" refers to the process of having all members of the kubernetes cluster find and trust each other. There are multiple different ways to achieve clustering with different security and usability profiles. This document attempts to lay out the user experiences for clustering that Kubernetes aims to address. - -Once a cluster is established, the following is true: - -1. **Master -> Node** The master needs to know which nodes can take work and what their current status is wrt capacity. - 1. **Location** The master knows the name and location of all of the nodes in the cluster. - * For the purposes of this doc, location and name should be enough information so that the master can open a TCP connection to the Node. Most probably we will make this either an IP address or a DNS name. It is going to be important to be consistent here (master must be able to reach kubelet on that DNS name) so that we can verify certificates appropriately. - 2. **Target AuthN** A way to securely talk to the kubelet on that node. Currently we call out to the kubelet over HTTP. This should be over HTTPS and the master should know what CA to trust for that node. - 3. **Caller AuthN/Z** This would be the master verifying itself (and permissions) when calling the node. Currently, this is only used to collect statistics as authorization isn't critical. This may change in the future though. -2. **Node -> Master** The nodes currently talk to the master to know which pods have been assigned to them and to publish events. - 1. **Location** The nodes must know where the master is at. - 2. **Target AuthN** Since the master is assigning work to the nodes, it is critical that they verify whom they are talking to. - 3. **Caller AuthN/Z** The nodes publish events and so must be authenticated to the master. Ideally this authentication is specific to each node so that authorization can be narrowly scoped. The details of the work to run (including things like environment variables) might be considered sensitive and should be locked down also. - -**Note:** While the description here refers to a singular Master, in the future we should enable multiple Masters operating in an HA mode. While the "Master" is currently the combination of the API Server, Scheduler and Controller Manager, we will restrict ourselves to thinking about the main API and policy engine -- the API Server. - -## Current Implementation - -A central authority (generally the master) is responsible for determining the set of machines which are members of the cluster. Calls to create and remove worker nodes in the cluster are restricted to this single authority, and any other requests to add or remove worker nodes are rejected. (1.i). - -Communication from the master to nodes is currently over HTTP and is not secured or authenticated in any way. (1.ii, 1.iii). - -The location of the master is communicated out of band to the nodes. For GCE, this is done via Salt. Other cluster instructions/scripts use other methods. (2.i) - -Currently most communication from the node to the master is over HTTP. When it is done over HTTPS there is currently no verification of the cert of the master (2.ii). - -Currently, the node/kubelet is authenticated to the master via a token shared across all nodes. This token is distributed out of band (using Salt for GCE) and is optional. If it is not present then the kubelet is unable to publish events to the master. (2.iii) - -Our current mix of out of band communication doesn't meet all of our needs from a security point of view and is difficult to set up and configure. - -## Proposed Solution - -The proposed solution will provide a range of options for setting up and maintaining a secure Kubernetes cluster. We want to both allow for centrally controlled systems (leveraging pre-existing trust and configuration systems) or more ad-hoc automagic systems that are incredibly easy to set up. - -The building blocks of an easier solution: - -* **Move to TLS** We will move to using TLS for all intra-cluster communication. We will explicitly idenitfy the trust chain (the set of trusted CAs) as opposed to trusting the system CAs. We will also use client certificates for all AuthN. -* [optional] **API driven CA** Optionally, we will run a CA in the master that will mint certificates for the nodes/kubelets. There will be pluggable policies that will automatically approve certificate requests here as appropriate. - * **CA approval policy** This is a pluggable policy object that can automatically approve CA signing requests. Stock policies will include `always-reject`, `queue` and `insecure-always-approve`. With `queue` there would be an API for evaluating and accepting/rejecting requests. Cloud providers could implement a policy here that verifies other out of band information and automatically approves/rejects based on other external factors. -* **Scoped Kubelet Accounts** These accounts are per-minion and (optionally) give a minion permission to register itself. - * To start with, we'd have the kubelets generate a cert/account in the form of `kubelet:`. To start we would then hard code policy such that we give that particular account appropriate permissions. Over time, we can make the policy engine more generic. -* [optional] **Bootstrap API endpoint** This is a helper service hosted outside of the Kubernetes cluster that helps with initial discovery of the master. - -### Static Clustering - -In this sequence diagram there is out of band admin entity that is creating all certificates and distributing them. It is also making sure that the kubelets know where to find the master. This provides for a lot of control but is more difficult to set up as lots of information must be communicated outside of Kubernetes. - -![Static Sequence Diagram](clustering/static.png) - -### Dynamic Clustering - -This diagram dynamic clustering using the bootstrap API endpoint. That API endpoint is used to both find the location of the master and communicate the root CA for the master. - -This flow has the admin manually approving the kubelet signing requests. This is the `queue` policy defined above.This manual intervention could be replaced by code that can verify the signing requests via other means. - -![Dynamic Sequence Diagram](clustering/dynamic.png) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/clustering.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/clustering.md?pixel)]() diff --git a/release-0.19.0/docs/design/clustering/.gitignore b/release-0.19.0/docs/design/clustering/.gitignore deleted file mode 100644 index 67bcd6cb58a..00000000000 --- a/release-0.19.0/docs/design/clustering/.gitignore +++ /dev/null @@ -1 +0,0 @@ -DroidSansMono.ttf diff --git a/release-0.19.0/docs/design/clustering/Dockerfile b/release-0.19.0/docs/design/clustering/Dockerfile deleted file mode 100644 index 3353419d843..00000000000 --- a/release-0.19.0/docs/design/clustering/Dockerfile +++ /dev/null @@ -1,12 +0,0 @@ -FROM debian:jessie - -RUN apt-get update -RUN apt-get -qy install python-seqdiag make curl - -WORKDIR /diagrams - -RUN curl -sLo DroidSansMono.ttf https://googlefontdirectory.googlecode.com/hg/apache/droidsansmono/DroidSansMono.ttf - -ADD . /diagrams - -CMD bash -c 'make >/dev/stderr && tar cf - *.png' \ No newline at end of file diff --git a/release-0.19.0/docs/design/clustering/Makefile b/release-0.19.0/docs/design/clustering/Makefile deleted file mode 100644 index f6aa53ed442..00000000000 --- a/release-0.19.0/docs/design/clustering/Makefile +++ /dev/null @@ -1,29 +0,0 @@ -FONT := DroidSansMono.ttf - -PNGS := $(patsubst %.seqdiag,%.png,$(wildcard *.seqdiag)) - -.PHONY: all -all: $(PNGS) - -.PHONY: watch -watch: - fswatch *.seqdiag | xargs -n 1 sh -c "make || true" - -$(FONT): - curl -sLo $@ https://googlefontdirectory.googlecode.com/hg/apache/droidsansmono/$(FONT) - -%.png: %.seqdiag $(FONT) - seqdiag --no-transparency -a -f '$(FONT)' $< - -# Build the stuff via a docker image -.PHONY: docker -docker: - docker build -t clustering-seqdiag . - docker run --rm clustering-seqdiag | tar xvf - - -docker-clean: - docker rmi clustering-seqdiag || true - docker images -q --filter "dangling=true" | xargs docker rmi - -fix-clock-skew: - boot2docker ssh sudo date -u -D "%Y%m%d%H%M.%S" --set "$(shell date -u +%Y%m%d%H%M.%S)" diff --git a/release-0.19.0/docs/design/clustering/README.md b/release-0.19.0/docs/design/clustering/README.md deleted file mode 100644 index a81b5660e99..00000000000 --- a/release-0.19.0/docs/design/clustering/README.md +++ /dev/null @@ -1,31 +0,0 @@ -This directory contains diagrams for the clustering design doc. - -This depends on the `seqdiag` [utility](http://blockdiag.com/en/seqdiag/index.html). Assuming you have a non-borked python install, this should be installable with - -```bash -pip install seqdiag -``` - -Just call `make` to regenerate the diagrams. - -## Building with Docker -If you are on a Mac or your pip install is messed up, you can easily build with docker. - -``` -make docker -``` - -The first run will be slow but things should be fast after that. - -To clean up the docker containers that are created (and other cruft that is left around) you can run `make docker-clean`. - -If you are using boot2docker and get warnings about clock skew (or if things aren't building for some reason) then you can fix that up with `make fix-clock-skew`. - -## Automatically rebuild on file changes - -If you have the fswatch utility installed, you can have it monitor the file system and automatically rebuild when files have changed. Just do a `make watch`. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/clustering/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/clustering/README.md?pixel)]() diff --git a/release-0.19.0/docs/design/clustering/dynamic.png b/release-0.19.0/docs/design/clustering/dynamic.png deleted file mode 100644 index 92b40fee36281ad3bdb474a52c12d2150eb40b53..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 72373 zcmeFZcR1GZ+deK)q7afzQYbSsdl!YsmXR$xBbiYWZpny{y>BZra+@W$viDtNC7UFB zf3LUttmk;1?{WN&-*No@`91ePm2U6x8rOAR=XqYQkXvfkP7%`)lO?8#!)OJ*UkrQX zK(J>j7ie~xkF}2wO{Ddem^G1}>cX=?Rvw38DK32KCr=8Sf|?2k2gr0n4boZh0}7(Q z{#@Ug*uBqO8BHEl6Y0%flkETN`crX%2N&5ztUDy9eF=?lwD1sknWWuwjL2Ue4anjj zhd*DKy=Z`^!po##b4Gs7dF%uO{2>$i|F{3f-d!X8rAeh2#g@PEy)6rkZjAh(@no}v z`ulND7QaW=(9IF4^O*h}WRUO*Uwo)yH|L@Y=P|6X|M=`QQ^fK38QY6Qa$MAgC1y?U zTqbIai~Fm4sh=^Eob!8h9IjFJc=K+aVL-3D5&4t3xj9q5FL}4wgBv5$dD+}g1g3Jd zj5h}7qtRCc1ZLUI*3`Tc;R4cm~>1qpIzI^%o`Nlcl ztCUw6NVT-;WiYPwT7yyWkxJ?J#t|=`3!o$j zkYldL%ZXmDXr6FU)R^JB6l&J8M@23jE3=D7_L1xtIl=pJ=RO?H#Cx%vG*~`%vN4!! z)E#FemBJeoHM{m$1+ zbak8W1qHnHo3M77iJVC{qvHI0lHf+FpM5vs-Bf&@UA?fJVN197fpRX_rvH2{dN8U* zmPEu(!0Vh^PVX+auR{%on5`m;`ytFcGI>OSFJ8VpLqw3v{9H(Ds$irzRwbU%fnpE; z%fZ=l#$NYY3`UHc$WwwzIcjFc_BGX;s@oLO=^S+JA`U~x=TaQ@)zwHuCL&kmqUy4k zGHyqe#s66qq8eoBT&)S&d%qgVqS*RzxcX%*J!dyr+~5g@_tP}_UF^fKR!AAe_^{s` zD;vjOuyJ0H+NT?2kVd0bqE<(|mtMYnshFXmt$j40;e3RI+|r|LTR~>)m|~c0sv!Q0 zq3QgqY(yWbm+HKm&ggFL`I-CM2(0+hJ6ZV{XAYAqmV6e!6v|2@*OM%`CFim5rNnn< zeQRa9x3Om)U0nR2>W+X_+ozV6&?d9DR_*B#Iicwi>tD>v@N5(P2dq7J@z`PFGTcVT zofTLk0|W7MdgJBxoEOK<);;|Eha`<~cK7bV3z(JA_&!svn$Sp`2rf+*8SykclHSj|AzF73c@y&C7V=<|I?~JNF_Eu63zSVj^sB|1g&06I@D7>0y6mX+zw152? zZf$#e+eR=UHa44sm{I2T?`bx!+qxV8d^Nd|^qlS@DQc_Z_-`;lp?j)~q@q>|? zhdgm%{IS>BtU6xPhASOENyF#)%M|G6Y?0UB z4gVx0p%zW*a2DMiv@5o>vidnvD^5i$`K#e*xb*EgjGE#8-jYAFgy%2j{a?XXU8nf4 z1hOpdlVMUn>RlnF1OR=qxn|lI-M-( z?IUHvMo~2xYsjYj+pD(QrmUvsHNVGF?M8ygil+psWO1nS?3pvZzdy5Mzx3_z?aaDb zutsw5@H}sxNXQPS7jgVrYMIVar2lqmJeXNH#p=T9Y1h5&wW_MB2+8#?KZmPrvpZ`P z?y*LuzSSz_(mnj#o*+7?4u;_Rj9D}Yhsa;PB0(5GjAqU?XBBeAF3SjY8`j}=GrM~;=kw4M`M8+_L?tjjpa5+g`{ux+~DO$ zUZ1Dt*9W`eT45?;OH0dcc4>ofNs5pf`1J?F?zmLh$1}_BMjKwWU%!6ET7@VC?%TD! z;&+|y5L(YPsfT5?)+@N!l_oFgwfd}iB8ts@w#TwJTQxu?wW30poqamsI8*BUI*l~r zcHZLGw>jP$KLc4lnw9+i{X6AgcY1bq7H(R~bt8%@qS?CRHD_z73no@fQSCFm=hJ2~ zXSv;mJhS9SY0=M1UO;(B!KCF)vvo;Au$P@mq)Ojx@CG1%fpXCnmB{z8F z?;k_f*4Esr9}1*%gbpq0P+g!1xwRE=@4o!glMnaSa7H|5lZeO(WHn-J1XUR2l(`w* z_O*J;V8VHgYeYpvDr;(X3oA#=PW6(Z(Z*i0S(kN-GIcE^K5>2?`Lkf9DQfTf%8Hc@ z3S({s95tS*qojYj8KK%+ma_YUol)Gw0(FW>Vl&zMXQX9(hg=Vpm!hH~uE=PXL~MsP zqWOH}vyxmxRaI3*MZ!}h#DQITw{xNnKTMKdGnoC=UiDr|+Qjb0p0cFI@h-t|x+NtP z&2q8--eqy|ME>i3`0JHEQ=n#~a!Ov;#W z)%D_{g@#7=lK+9Xxw!@vBk46OtBdAsvu+oYLMI;{?fkKMMC}>#CO-ty>uhq<45;%t z!kQNq`9ocnvKBH*6_~Fr1PH&0Mi^aXAgMB9l2iQ(2zUyCK>KZ>>|7tD0 zx7u63-CxX8^&?7;ODWt2RnnbtErM16JF&blT>StxN_>1g8l9b!voVk3g^z&1N=Ag# z{p#VBsdjPCU#X)@ORy`Ajgt}Vum$<&t_sr&`_#NzR zxOJTfZWQ_E+?W+-jDh5F`n-~bl~qstElftXZ6Hg{@0QDF?>HZEuezGl(Vi%xtF6r$ z`g{1nX!r43l|$S_auQ7bV*$rUd{$Jk5Mw+y$AcM3gNL8n;C0DyZ|(H|Zl^KFUQu3` z82=(y_ES@op{Tfc!&8DZ__36I@1@5&OT+%M_&8Sf?UHh~?4dUWZ?|R_sQFD(ANTzl zZ`||qmtcys+^XC8S-mxtct(*HVrcK|w>n>MKAJlf_Oz;Lb?bw6f~^W8+Rx-_G({g3Z3C~}9 zo_UujrE>#I@3b&le=uO^RG6PHkT8N`r<3v#HAf97UoCVJ*|k}aus$xGOubKBxhoQuynG%2yMR%M!3urqy$%S6hpGOwKY1KXZ<4|H_7a3hO? zx6?;FX@Eh(ldtg12Rc6`o;bVl4?%7ug-Lebg0PIAU`s;8tL(uk`|GzSo}s2rc<`7% z_T@`U38@gJ3?U(*`u(-yCCog}1U57Gm!|~f#hZNVulcPOJbEU)C6Zx-Wr`f(w>m!c zxIuY-Ls>*qF*bqD*7E&Dk;Z^5$+QV|eSKQ-_oKYqfd*VQZz1{hRAL{qDPEUgI%s6x zzhz`JoTHusiGV)%U1mGV%b1Hg!Q%1K)S6UbRz%T7=Qq%LF~c`T6<9uwr4YV_XIb^a1ji zp_(RKChDf1l3|)`u3wSH<@t)FD))7(qsko=H8Nj5v0)wF%%e@b;F~MN%z_f{(I}5^ zkBaRPlCI;IK6CPzZGVIn^?vFNQTovy8Iv9%;}H9vK@nm&<4CI$QII+jb$?P+8TcDSNi*oOzp5&j>| z_~Tj?6(d7KiDCIgr|h!PgXn)7P5`t+?v*Apq>n-Ns`lX~-j* zY0Y=m7ri0lbzYrj$auZ}ky8B*q%#COdap0&8yKKPxZWpx+&$jEX=h+y;00j)$JCUu z-`3<(%?hbG7exr*$y7-5SFc_LNS>N&@W%AL5bloa#_)rUg|Dt#zb6aQN~k(y1izZ5 zG@g2GuzD>kJNx47ro822h)Ijz!+1MBf2O@+aa~n49F2B&cW-KHf`qU%Qo95Aj3R`f z>FMZFPTy%tNCwu!JHQ#j!Mrkjs*Gmpvu?_g7L@ ze*fmFUG0HAs>$iNI9LwP2e|9u!-sHft5ZR{3aoegM(CWBO4vfpyu2`{NDPjN`P!=u zFI=5M5q~=|i}~p$Ha|aqu)k3+z46Vp+h%nQXX3xweNDH}08q#pq#2bcH-JnU$B^O(ku*QhDolfA6kz<_MT|+qivsb9ZCZ{{Y~ami8h9VzhRCXjm9L&*e*( zjD6Sop%l8^YwUfGOH!cRfuid3b7dQUHzR3yl9f(rCkFp}c6LyB^<>=;cbiF_-+sk! z&gAp!y>*JO2OuAagTZ9X08+I~quKH@GcC4PXE8<6%O5FG{0w>>458_6KfgT$Fj8E< zzl{y2H{#KSeD1Q(4jAcq5l3kA#8-?vPy$GHU0)ocHRr9{G<*24icJ|H?`y#IQ|*b6 zEVph=+^-raGTOUr%OsXW>eK$({Un zh8`a$)6vo*3j7rZ%Wy8g_-9`prMZ2>qa$T~Xx#iFycGx499#va&86i4Hqg`?2(A!$ z;1+ImjWiFgd)=E$RZ-cp2IvZ_IAwn|hfLy^jEBei@lwcb3Dmz&!qxVW=aPZlJ{6w#bKZsDj|>3|=6JC|MIOke%p zqLZ$PZ#hRO%zXuO2>Z8bI0Bmxc&4!uf8BS*)d zFr#6ip}Fo!JWZ!h9`luAR?K+#@yPL5kDD4X1qB5owcfWgDqP4@-;39ej(YZVwB>3@ z?r%;&HR1N%IEqcRcjmEdbfU&{j!?5W9wT75B;QtQ1rXoqo!PY&r1RaHj3Z-`xGtjh zif{ZgdkO4Xs zDSP8&{xrh&dZG*?u)7z&zI8V`m`ZdCd_VTRDXbpwoAkj}C&Y%meq9qu(}qV-7GuSo zm;{d+hBQyW$ZbQhLSv380)WxXZQYSGnaZ&Y8 z3@o+p4fikR=H+cQ@%k+TXe6WIGo5UC2~g_tg&7ES3E8koG`@J&jsS#HPZUB867-%t2hc6(?e%w+d_D{uYHK@_RWxU=W#On2I?naFEQCDY{c zDl+&uK{0;})Y;#@eFJJLuJuCbcgPkiu**9Vg!17(;!OM==BOpHDW|u%vXH-E`@9*q zZ_Hy-x4T$5s>Vj4F0uRsH($F{x6{+xJDb6$8gL`fks2rkC5Jf$JIKID@KT{*_D#fr30Y0AUZzk6s%A@o(Cw|ZlC~=apOCN zOXBaxa@dr$e!@;zt^B&^A+q&Ki8g|oBh3l0jSD7{G<%g-@^q4Lc#|0fQYKhW9ZBME z-@diwT5f(g`|EuA;}DnKS*VhIefJ7PB6C*hzs-&{V2U&H_p3+UGtRK_Aee7+RTf$^(FTznNmCwC7i(voU-kDq7c{a&P19uK)9<1yDJd? zM~!`!o07!b=lb$)TUl8Fc$=*D*q_`jnaEMb&YgscauPB;^NPR2Fs2-X@dB(+US1A6 zE#1Nn*bb-KHJ#??jDUW~i3no3^fdvu=;~HN+MQ^Q0KVo76%`*AfQ8Z6T_mR*bAs}2 zHY*P3K*)pgVJC6Gc5ct*zc+P;6j-K3U~a$sy@}*3PeD-;>9NNUlbL;2PlrEEdYVG_ zeVPj9dTVoH&5QGPaY2Dw^{}n2t=lUz)CF$Ez8@L-o~E|vK6Y~6-H-2Cz*kg+`mJ&N zy1KduYs>UXP~%zNegMF)=r6Z2@4 zybDB1B-8-w${_7mW8Im&>JD^>;#ng>*QvIYy#;GVF}GB*%5~IbpD{a1jQgQe=9(W0BdB4sv36OcCfYbJ)U+qeDoGa zOk`vl2eD)Z3(x0^ghR(FhWI3Sa&7A>`x4vj4%(C}aZ3`#(MbVCke8 z!noVHxbV9do?@1gh`i1q>E+g!s}Y*sHvmYWI(BMb*lENEO04rI zP@H0aE$5)t^ZS(6G0K~l6DczktoP%D=!{P9d*`iMN!{1LS~+Ik7-V)eh%Ylx7>a%U zs26)EB5W*;rWC!KT=uNnp1Ukd?zfUS%4JaYj6XIq5-R9qpWmMoo$BJLzoGNZbk-d6YDru3!C4%mel4>jX2Bo@F1YQKDsI4~7`55{5?YF|@6QOlN?Q}n{$ z+s8=9)Y48%n79&ebvoig#0jQU{nxD=Kb{_#qEb}8abu{& z{CE;7HJW7E^V_1wkfCwuBXQs@6BDPK!dp4ZBPP@Sg09eEw7 zD{e!t!y&vAGL%BSeLfTN;?K2oFR5t2&t4c!T`s1lIkdaL@Ncm(_}&hQ)x zLAYETkR}!uK%Yl>g`SW61i{00^8kvK&XyK4RP8@_B(?;(y-xrAw@|8m|Nh;S@7>+T zr}@Qo7~Nvy2&ruj$xlG5%6ZFm*1@AdV88doT6FXX-V0V_c#mQp!;HDv`Rv_x6|HTsnvOuaa6Fk`kjnMj-24 zb*BO&@iqR@hy&rVb2Y^;c`f6*tmB)m6eP|JHqQz{_ZvMN1YF4hv0 zO@5>NX>umX%S_^XFNzBbvu>0NyDpzdl;73EUpA+F#%%Yw)Mw!fKb>3@o3eJl)~-t? z!?puN{F@2vH?HO-HC$yNRgNmE+rEeKcu_RJ>V&4cZmUbbk(fhZzTZ80UjygU;`>}- zSC44f{OZSua@1zpxn(`BSoj$5o^$VBD(IcHm(Yxr(-aEG7&WdRJ=mx}s4Xfgs;H<) zPyY@pPI~v3Jh03F*nNF{C73{m(@C*j7f)7+(lRvk-uyL=Q1l@RANK1jr&?*m8AuKK zSubA>D;fqKrR@w+Vm-sh&e`D25|5N<7C$bF=P5wQTxa`@Fvm~VCf|SA;G* zsF4$_91#={=$%-8cZX+NF#b}G0J*e|?CuwW@6B>kn^4$CUe7Eo?OF7AFx%6#=wVp< zz&ahf=j`#ESss1SS%I8DKlY4bn#nOhCCi?`{uk;eTxXl9U${CU&q(HWGE^yp(}h*u zX3Sai4o@6zUiHR}m7P5ZlF!rf+*ywU*`a_&pX1mxrxieNPX zuTDnNIY79?J8^(Gr{5x z2@An*T}P~7+&VS|fqtts=57Binxs}gs?O~1Ak`;-qONiL&5D}vMIwAgH&ngh>bWno zZek42`?d*Cn^*V9rG*1PH($JDq|8f2j1c~SK>;9*`t2-Is!Ig;z3ZKTm+@*OJhsT7 z#+lO4%}yis=n9sBG`M+!|9Nsnq5mA_r$;qX+CXTS0gUesO2h;S!`Im5ieCP{iDl1P zW3fjU%hSFv9Bz$P7`I1PG>mW{m3B_g_hf~QE=4G?MzKAtHC}DhZ_+dA+TV-eeBD4h z{bm+VrM`bP(R3w)-TWrb9mb9{SdvK{l6bAL6G)n0{h8%w`R=WrCduO?#DWShx2s12 zBb8AV{ymuPg0EBxn=(Y45QXo+1p;WLGN1C+uWUVN`cjf9dDC{)0D?P}V#)MSGFuR( zsFj!D>_%*MblI_jyJ_cdY?RnS9acMnLY;&g69?tm_0J{UvG4rv$B{fX;+z1X*@5 zwUMA9UuUC;XtvbP-geY1-kY6v6N_ND`WqMuC}ZJy);L94+vtpXMmA4Qc~rynC@Cp% zP_=Y)kOs-Y-~&|kc|LMcb5j?0(`M!xe|^=uG%7SbH|KYjy_(kz^dI{LtO|QMDn+Qy zkKZk@NE1$-Ox4!T;s(Yt-km>t9@9E`Uo6S7a%l4Y=hD}q8kr&mM{^R7skKM*mkEa_ z;m+E#pJ1?C9kN^LP!V%v5_L{3D|7qs^-v!%5a@PY4i(gPh`-5eV_Yd`vMVg~MZ2dS`2%2C6ZQ6dV_%OUB{ zvgp#<5A{TIdAL8Is<2FmjVnax$;Fp~O?Qlp7VlR9I^|MvDHzVG;8#oTsZ=7pR{W`^ zF0~}Ua%V8c<4RCMx|@;u8YkZy^20o5A66;VuoN4JOc$jZpUk3lY`d2?>*i;9}6KmXs^hlmnH0=6T~;a8NeCZTt8 zlS-M5Q0ov6Y0Ww6^$AbBe#u984DN*7@I?>c1aO$$NDH*1gjMl`3IFdM#{%HGd_ngv z+zdE^ID%w$Wrj?N`!9m9duUiA#NCJQ2mIUjIkggH@U1Vbk{>#VV01DC4{dB+nz>_x z1TeR0!FY&!3-R!z2HIV{nPza}pRe5|{7SC;gw`00f2#Yf_vH)}qIRkO`aW`Jc*zrz z1b>GKkMq=_H?EB8(mUY*f)16Lb9i7MIDGirF$2=uxjG-HXyB=lhbcRieaiv=j3`{( zhEdCzJD8w@?%%$T+_`2+r__P$2;=B%WsDHRsGl!Y*!&H+lW^zJxWe}BI()ZwG`_1U&yR5BEVe~zH{*b86RudQ zOf+jz1^vuL&yBr*d;q$11iweS5N>x?-M`0u57CkYZ8bTlwn4j-xvGC-z2bs;=+p_O zSF8jud^Yqq(*_Af+!9qTJ$)#_RE*2FHQ=IN+46xW#1vUuS`Sg^)vr` z($+Q7*41SX{hlCXcOO2kt{|0o{QUNr2CBJc5LO1?T6Y3Hr0RL z*pC*=mq;DAf=TWJ>|V-$-Cy(^Ux!9V3Jijd*a(E@e@T-w@ueg}i) zb|#=u{r-JlIZD{^8^Q|$JqkmDgpDXRZ7nU(u=YVJBR=-{!i5XHIqEp~y%6?fQ+L- zm5#2Ew^oG8t(n=s#&6FnuGMlkj;j@%EQny#JyQWPDG2j7Q>2VEsAS1Ud^d(YB}UTZ zgZuM!fqgmfs2)b6HMcLc-beHXA&L;NVCiwKg9k6ke}Bt=tJQ>o^qQ(_JJ`-(6yOoR zMJ0iXp%o9-$8~2=nn1q!4z#xS+MIjiDUlfrNIcoL?Gm;?*#n#9;^G3jHeyzTBx?Rl z7UwRu;js1`4^J?hv=728$R{A9%aFa+b|&suY2P3hOg;n78SQ>p>PEP{pNcbVdD*u0 z2YXAyjvFB9?SrB={o}_sAS-y{T1D6LYz_EmR=0en=IG3C_LhO&0j3tbHo(~GQ7OV; z6tKxfpNhGnsb;m1%t8c2jqv6Fq8wQ0QxlA5s*8E8+IZz+Fqq7pnZg3+%=<6UG83F4F(CfYFn+xhH zGv|kC4gE6WOpJ`cYBl4%R9l&v`pB=29gR&pjDmQBM|MXBNf`}cQ~}i^Iu~%?pGzek z{)W<=Js+JA8Tp=0?JXLO=)p#~YLCTBL~^W=um13=({1stKzd#Zy+87BdT%vH8mP(b zeyg@uz(Uzjxndk^n-*1Tu(=c zn!{k(EIPl)pvC%#7Ci^U=hxadLC3;?`i#BWt&m3z!S{`2j-wBL)eX zTkMF%6nJ{KkE3IR^p zn+V(iEJRSg)j8a61+-^9ifRY97aEPNY=5Sdf#NsFW1CgNzQWA|;RNUxXi(sR;Qc^k zk1f%=8N~*4kYEw`C@zsFuU29{vj-`#c7yrZ;QUkm*pw7$m+v0~0|T*!6%u}Ubn?4+ z(go*juGXySh-r`oWZObHRmjx}mX6}%Lh0S{w=>eM?CsfZmVt{YhK4g#E`O75h+bDH ztLHfj5wNmP&sDB!VtHGC5kZRTF{O z7GKuRX`?d{ZGDGRo))7Yt%L-eiPpv~-RqAABY1{I+(pH2jt?Z5c)7X3?}&q40RB8@ zo-=q{!2nzu5*@QB*T~=9DLO%U@%8@Rkyc5NhJoQ5cm7lg;Y~iR>thIIa|AOpaS)BU z@>hDVTmQf@RRY_nmy-#z=NblQtf{sY40UxM>~Br$>gZg-0-Fl6zcDnrAFC;{vgXjf zAxB1BM*IEv;4vHmI%b7~MuP>28OaqjfCUFC;kBqsdL*Ws&uL=e6kdZIf@J*96a?6v zmNVyx%g@aG0W#BT@du6^ROu(kf*W1Zi>@K?1`w4gqikZsjw1rU(vGI%=92&>+T~)B zR^L23G*&{;C1!XOE_mDhDBhc+TFwX_LJ(P0*_;KzA2R6pUySiDcTm{|j(p zbJmd~JMtH3$*9O5HZpJr0UlxrcuV0$bT~{1>ih36E<*?v1D?TgBvJ*uJ@#+kM<5$u z)h>Cw|HZ2R!nO!j{of(~|GYf-e?R1@XJ(E@fS*ELN_iC24D=;)F6yw)rS^5^J=kz& zRj01ahs*jTcne4Wxf3*FScuSQ;y@W!JruucFUm69cud2w`z(H`P`5*2c1HA3bjE8=22y}LHxmSBLoXM-n?vV= z*r=d!=dG2hnwpxUqoc9$2)MyHM=2EfB_)$OyhGFVZr?scoZ=n}H0JhGhxpk71;Cv? z0+I9exTr%EyddR6IRjXhlwPj$%_B(g{9ARhOfp=( z&jvocb2M$9gT4H;2uXzr2q(AMH#@I2uPHYU9A8VT~MY$eOFcvX&fhS zIyk^l9~Slv$jpvYp@q8SUxZrdcXV{rfe3j)xkpfystJGxeR zH8j#}2SH?nv;$%(3lVs2iSGxp+&X6EC+G!!u5L(-hEBEp6U%N3Um{7LH$FY(z1(yb zbkboMF?z>$?>)(%ZU$7y?c$Xk&22bRM%B)srK2;4aYV(HKAofyRP_c+IWTzOpA^$S zG?MVziB62Ui4n^F+Svmepd_7YVGnm7MGi-3>!cY9@Lz#pC69;*(9u~yte0|`vm!YZ z$bw(*Tj{hEI6(;K=1$_fi$Bne22o~cPlSIsVF4{uw08WfJ)@X zNAp_RAIM!G=K!x9`YtA?r`aVFTpnm^Lm5sW+bh_z^56M7u#Du=T~?y|cw|U6TdIas z@xp)rDXiUorN7OU4<@xlxi1cCQ#C2D@&iJg?acuG?;qt_ekCe)o6e#o1t78~z8Qi!G<``X7r zYh})RfwBM;*u&GJbXT%mQvsZH#0!H*FSNAs(6UJ{ov=l1UVa*@=k6{fsR4VirU!N4s$0!Qb z@!*T=E7|ND2^5vTa63Ce?Hc;kQ^0(}gF*V2xjaxiP)<{N_KrVkvtBj`^J{F!QH*_E z&`Pt0_dpjFb+ojk82&Ae$4(~E) zVUy1Z1D{?A*$u!3KBEX835 zc9Lxb6g5!Rw!fbjj0Y}p_h`8KS_0nPEMoEF#Nj%?m!a>otxy zcv53uZ9R88*1Id(etqyRCQCgGAerO5eL~(VUxPzrk;mSbyQ~Qz4M)!P9%nL$O1PP$zlKqy;~ReF2pe zH5C=Ky8V|Pra3<-UJ(akt??4bf523qkGwuw=L_M;5CmAD(V-AhPnOV+$^=2&ey9SB z!(ex!K700BhQ^9j^hH&KBXV$9WIotz2BRpl$WbLwMS;imw8 zwtPyt5EE6bWn8Ne>_l)yNP)i;Xb8wNdpjGQpFV9uMI>ST*J)U&?XD-tY{d z@POL(frOWa_bzzy!0h)8FUK~4O<7sp3wWN)tgM%@u_{qe27sw8G&J-WDFaQo(gD*_}4*QD0^ZUfboEtj-R(RLy$pd0!!NQ@8eU)wNzulW+b7vL!G&7X8j?UDNA7H<>14mYh|NcV`Dl-%^gnmCFuOXff zQ@-nD^u$4CC9jI+AsvGdNJ7oUr-t8BYCnQfvjOWnlxbjv`Ksskn13Bv9@zBm87QYJ zVKjlT;taiyn9AxvJOUEQr#oFS#;(UZF*X*|E2f7(PRF&b!Mb^6;yqC&L{4<80zA(! z$woYJ*|y-2TZia#{1lzVx9<5hD{E^Kq^DHT+8b<68j2dwp>!4d1$Kwm#!pGtshe@F z{aH8SGULd@VVHAEoM7<{=v&jem-Cxr+mgg_?=ry4hLG%%8+TkYDE`!jsf;p&KilMJ z!4T&Q8`Smi!?|Ts8m5n10~>sc#2p@8K{}|@5Bs-JPg%ixsimFe21ujpKq*6G;EgDe z_-g#S;?5EP#*VztRY7?OM&@zy%D7_OH}Br0mKr_hq}Vsd_b6LIRcWB!;2okk-5!urNK%CGAy^KNDWM7 zPF5%RZ$16tCPo?ZgoOxT7`mWf7cd&FIXJYk2sFqE#9Wkjly1yE2k#VEqo*$Ef?fp- zHpsrkVV8;IpdSpRdE9(fxSgFHv^n(7X3nvkX#~bdOB4C@WLzUN!ln3a+j>1oNJxNZ z)z*Ie-c*9A9$Y4)(9F8>xY>-~{MmbsO|WOJuMatiEEz&W>Xvf&Ww&l|r-JZnwO#=- zEYxANt@s)LB=ZmPxy~9nQJ|?*HLlGH%uRCeV8A;5_qLjxWG^(huhk{j`XKB8J9av( z34$f??KWeGa~>MYI@;TlL|wjv_hb}y2{3n!vuBoZRX%>^< zX0)-h2MKaKhVwS;Drlb+x%+|OKm9$3Gon-a;115c#neBf;^HmR?vsR8Z-nsJ@M$O{RBQN-~MAS$j_=qzdL>{RzU@zDnj9SBCa z=;WB5@`MDs75oc7Po&;^0>1P4>q9UiY=ySuwk41moA?PuiH zt>{<@NKlp>eC)FQoGVr_qZSqxFa!~E56jx+$t3&WF&u^}lH3RMk-o_O2Y+lykkddG zf!@;rcrc8kcF#QGl>l0v30$?8OaO$U@7dbULeK}~0qL6*G9)mPiH?}h|oRZwHxqZ(IiVxp~mfhe$Z8rpyn@c~-+W~kVcLey^D z5HOaDUb>oOrRt>_*V;r=4Q;(B<|CH2h>0J@EG#VS@%u5L!VnYaiEo@FAY~265aKR6 zb8_3wUZM|&Uo%^?jkgBOWrJ-#EUM2qTL=#W9K8v z$8(aG2)}#_lpk7oJRrH^-F@3TZwyoNzs z-RIMb3hFKU-r*+ZgOAsBz}~4+fFLSvn0E0;qlThs7vH8|*>F-S^?G*jMc9%kJHC>OySeN90Rd_2?dFU2)AnMvtJW&TwKdL>(%jFhGbFdE3-s!1G9zz#oYjPm_*9^tv*8Eh!Bi-YyLQafGM2 zr%e`6rO)&T`0LGokYHC>b<*v`lF9-aYT~(C+35%$38<1x98Xn7^f#{aW|X-NU+J`m zXYf@3@d98=ClO1d0^OKe?vLi`(!+%BItRdP3zDLV^Ls)F3R=)f)Lrl7_@f!OxHHct z1}W$$LJERx`m4?`FP;hiyt^UBZ8qw{4dC}@sUw=r1((@Rokz3qj!omja#JX2<| zqM&nH*q~M5-15hKj;1U*dKN5PNGax>5 z=f7z3P%Co-;eGio@yWkh{NOQ!Eh0t^nkgd%l2#ty`qaNPd@@9a{15G(B@0ZNU;&7Q z<@leP{2{|}7X&e|Km5_+11jD_&6Rq{2^T*8V^lc$PYwSMPxT+#{dL>xWAGrUS%3G> zzo_M35SQ))`$>`A@Rw3fMK&l5A>v<{N915O=K-02QqhOi-hWWghdUH5Zo`T21^+=U zAJ)y;w+jE=aDlw|CFB^ME-{3LKk*ufn}1Nz63CtZ!!Gf^L;knG{(m~;ZV5RJf~u5? znG1`@vxx%09P(#DN>5j0i=;Y1-KG5!s_G^SeYHWZ+2_iYt)*N@kAEqbU4ln~G0acd zwZHRY&?BE}o6z-0lV2HFQaYh~F++pK+2T>7OSXWi0C zLTZF!UlyFsZYUdqOj0t#NU-Ere!F5%i;+ zHwtSq14aHP6H?0jhyURPl+mCq=b|qu_t^SWIfwogF*WHf@q1(<5dn~F_4m-rU`Ie2 zApxM?x(~+|AuWDS1)<9w+-d)66?JgnHixDGp8qg4oC#52Q|@seUfM{U_kf`&M06L# zhXMiE%_wKkP*(OmpfW&ly8xP0W}(3VK9vqb>(C?HjfDebpieXH)^*$(Qpv;%Oy}h! zg98A3v(P$v*l`VRMs4l0+y;Wa+in1ZJ-?s8@U}SRkxFtL8gY<72u>YA2!up|K%0V- z8@R{4-jsbei2X6?wh7Rl3FLL%!Tt^~Y#!CnBZ)@e&QV(&C>(+&J$DeKuVDYlhK5tA z;@tIP!Rm=dgOQzoYGq4p!|v(r<9}|~MLI@>UhFFApLLUhlW+dnp$9QOkmXrAhjJ80 zC}gN*uiA8uy0rnre{a51V~sRDMR^j+iI|n{MmXR`wKwp6YUi~4`Y}Ab!~GBM@wzNn zrnd|ltw8E^fDRah-+^Y(S!2@R^9-aQU3!7gj4A<#1KjduOboc#p~j}+b`(rCy_ptu zi=zzATmc2KE2BGplKRlBUl0g zS!@!(zwxf6r3Eoz%;VH?YcebiG?WDA$cbLv7TG5BhC#meoZ)lV-hlBRcMuZUti>q^ z-cQ~~yzfALlt~fU(Kwo-fJ%i=FE>~^c!eDXwV*%TqZ;bW^llDwE@-ZT)>A|1HL}~x zRXBh%2_#p$sxs)q0Se;PT6G#PEf04gv6XTbLJfS6W_GS@R ztD96MaynCwr+R{gy;AkruqK!w4O@LIpPbp7iPKzZn5_I0Hm@)V(~ ze{xZ1D>F2mrZ_Gc{2gGbfEg`@29CW4s;kY9IOPrvYlx@^2DI->=epc$K^g)-`0ix| zyJxR-mn~5z0!@uA6sVf?xWG9v4jMX~2_hgaE>2F=1&*7^3O6IC`vMd1!+T?tAF!3_ zvM0p?JBfYOJIes*3iuO!sHInJrj7%ZJo`K}{Ym3EbSuNbCeU8@Y1|o#7(qXumB)hq z+2za8bRu-caraW7rx@5lX_R4t|K}WnKXe9?_TLJ*o+|i!%I0n)Y~3|DPUBRN95fj} z>YR>dvjyp4sL}~e(SgHDT&wP&z>LZdJz8*30Q84~!$kla%WG2SJpKXn8i+~O78X9x z>4)Wg+L_=7!?|G-9|7E2z$#IRy>=U{eR~5NL@-4_>`D4YO`f8^?h! z1XTl7FWG7;+yM<}#n#*05F%C-e5&Y;GV-@E`CXrM(5%o`AT=!AfX59P1$T>cKU z*c?U*;wp$ngpc1RK{5UHZS(YsB5S0fV-=j4SB#?%S88o-r8S4+0*W6BL^LD2w+Jb*dOgua#4ba6S@E9uUgp~9id>F2j9Z1O5>VK^5mAshIpT%ehjJ?}(i@)%+4 z2g^d%x&Isp^{K55937dN%}C?G2vD$4v%{eVqj~~apG6eNpSJL-OShZQj zpgzzPo{$5B>`f=qJwmVVA?z2`UW;0MdI4+@RC&Ekmr#o*!ZW6zMa5GN&1Wiww zH=yS|m^)YMN}gWWK(Px=vAwdjY4qFxNe7ghp0`Kw%5ETlkh!Ly+lTCkuOtj4%(0tUU1 zpvvYwfW~w16hcFx9b-N0W~~5oRQC?7shJC1tehx*Ofr{UZbP?mJcwTwr;eTiVy@Q+mmjgbuypPh9I^8{8}Kosgr{>?sw~p(3>7*2h8J>V)z*(_I1LP; zqrfwzB#8Y2dl=gL;D+nK7XcsD)^-yP3Fz(JS(^uN5Emc61sWSP%7KCeSL|BafTJd^ z^72NsnEKU^ezAuRO~=Y=3}&!qios~-E^MDDHs9^p9LSKh93Y24;0BR;9MI@6s8k>& z%qWM?EAe5e6i*P~g8`I_i)#V&4hbe^L7Q6;zd-H={sQ{<5Vappjt~RufX5nQ$Az=b zpi9vis0)59*!z+|e}w)aEUI7g=dFl1|pPo^1~@0`aggE+%4EX zz0#g6naFSDcLGbopMvcdT(JD54?)q68Cc0g;S?f{J8Nk({efz#Y!H zw^eJe>eYL%)!~nOJzJ3PTi;r9j@d`=zp;vn3B;-?M6qMBgsxiZg|<)3^?jj#miC)O z^u&5-;LZ;5AAsW*$}HI+*?d9U0GJRA6ohx7>Iq((1TL_KrWYRCl~hcb77Vl{e=2!p z?Hi8{qIZ#*mWHl)d#V4Eo|GsC+pycWs}>}@?Wg=mY!aP&7)D)KHqk=}wa)v9vjfYf zo)3?Qwx9nnh;_NP2ri9evG${CDAyqL#S|u_f;x(Ouib|}oEtA$RpA-vtX0cWhrzkd7eeNc3$NUxE zT;5||v+d5<(q;j2C=ajAUOBUr?4xDlD`Z743l}k+SW7h+QuyeCFg|x;+9iAH@SF|n zz=f%);L*fVsw6hu)X0PPh2|=5!047A5=M+?wd{|##3!(!GA)+mDtxB6^{KE8UzV}$ z$?Hw;fS>$Ke_p)Dw7;qOM{@W*lSX`Gg9OLyht{*tY z6K0ciF6O~+Znf>K$#+ZJA70OTf}XRSe{4wWP*Nd$6AWj(d4D63#_Vk{^1b+tTHDjr|w~PDLtjn<~F^wf+7~5IR4!TPK^}*XbH&s0Mx8P3BF zA?ZeOpQuwY=4;?Bwk?{t-dHSkeLd?>&?FFt%Ojw~DXX7X_9w2qj$8CRlrE%>E~DLiY0&74PcfeQCqAodWE}B9mCQK1@P&&ffHqSETad(_d}3%ke#Tee0!a(HnjbJZJh0u^ae3c>er3UWh=Q zTMoVJtpy>-rOtXyF_oSA__B4T85y%M=>h{PVAKz+8|aT~dt}-RE>NUW6C0x0c`Mb= z520dmM+Ueu=B)X$iXqr!0+$D$7aW*h=5x;+23>itn;Bt_(EF_W%TGlzCcH324X+B# zuwjikF|V4E)Jn6DX@(6&>Kc+pS@X-a_+>({~l3%|3?j+TYm<= zT+%Z*Am>$d`s&tl`SC5JJ?umjCmPY|28T~7HUUc`+;}von#5oaa4WI-S(JPK+#hdL?h&udd9_<0GQXPvNl9tM;8bK_LstK|Mpe`Uzc?u_Jlsb5oXZ!$C839BR zWMwlybX7GVO2H~dTKR(f50e<-+Dfs&`i{d_yK}(`c&mu!>(X|2AtLu+nNr;mwGZ&( zpk7;ks2fLLd;14$zQ|z1xQN~aw)gFV=D$~T=oYz6pnm}R(B#;6B%=st1yUI4STCPp zgC7CDpR}}FFu`$F*yLSAt3SjESk5PHGs^$&ml-z4ff;?<(=syGC**9O4$64H*ywYF z@Nxb$^MI3ZQJhJBWYLRBacRH0mKOC@92*aUND7jsRs$iJ_#8>d$mk6a`<4cZr)weU zETfH?)HjKw;Q4`O@DfqVO$?SX&znuM9(P6(TJp9HHxgXFJ?<*chRpyjm)hD|7$cFF zK``OJbfZ{_H>2ALsxU;CnDea`;yv>;slZofh!<(UHA9T-qw$%`&P#|$w&GWguR?9Y z8b^5?@zcWiN+GHxXY}IWUPdQo_em=DpnHmP48xjh*#4Fu0uj6Xk3UZN^&pz|1zQW+ z`1nG87x5p^snF>>0i_te0qm+EE~eH!Mu!=m9V=A7!{hVO=>Gn*Ly3g40-;8w8I>iH zTLt=AIMO|x{#gMK%sXq*71vQ+kaGp?uVCWY=RJ6f9z_`$ktqf^-a=I1+YfmW;Uwx`1d#PBuK;rXl~wXF-W+u2iaroPApGK~fM#A# zsD8L0rSI@c70!Q$oj`8>3+kt%fhTJB9_OLNSM7u7X^$cy6*re4lLx%*1bs(j>d0L$ zXJYv{ye4=j^CK0c$MR`v>#kHl_c(2LRo_Q1x7FxUOGhu1@sF) zm3U1|Ow3FB=*YXFz=c#ZHTIo+JD4u8?3qg(k zh`dmd$V)UjP4i)dvU4F+Bva;?rBRmyCn6#uzz3ntj!S^sNhd75LXUcRUJJpGBke;t zF%&&$j(ZR%LJ+10gCWae8AM)7sP)2pPZ2p}?bi(G-ktpxqHq5BNLqi{P!fs0Li_)u zl(+b@_g04UC2KjXI230kfcUkY2#Xwls{ZhUh}_d4W6LTmsbiLIuQ{TY^hBUE?ddV$ z$W>drb<+^-3630l=~BCS#{KBx>iuUqllsBOSI^n5d~E&TGHZ16@Y_~h8hycL^I+~^ zvUySAYkztpB%NZEb**0L3n(=ACx!o>s@OL(*4FmWEHEPjKIY<^B!K$t9n=R zPNq%}k1;%8dlbTO$aA=RW4}PF@z98zN)8o_#?xJr#hsB>Sckz`z}*^LJ5jxN?5euN zkg3u)Mr&A=-aN77JRUUshtffI(r@acMCkSWVm>*@JQAwd5jDrh`u)WUCiBTxGEsN#H!5xAe<6$X-_qP!eGCjz70 zV6$3^Ge|{|v^sj{Bo5xLc!SwtvX;f52|UzMz(m{NjKPtH5oS4fDtAz87dWzW8HvGE z1IOwQxRYR#I)l9dN;-7U(3dQ79PI3%9TjBt0kpTA3=%=KpdZ35G>6|aGH}iZrC1AF z9E^NNkG?|AQPgwRjpLP2E1&#GWtTSGs&DY3@#x;uey|H#ErPjx`ypf@w}yN4uJ!|H zNv=6CQ%(aB9LACkhPANp7&Zw|_Z6FkOK-IdFfC~H7toR@y;afSihnGeQ|Bk_HWM?m zI97q1?gH`Pvz>NW2d;eH-;t_G>R%$ZNZMKAqWo%sizI$2%V((vH5t<$j56<&uWIua zVcVV&*C&oWh<+efC&Mc7uiZEhI0Q=J2O1@P$J-K5AhZB@y6kRIJeec%-v(`QB>UIU zEMw{!#_v%VxC6^+k?$mcJCX}O_ZS38NR>r!O6@#+oiqSIuGg2gZ1r{jfj)3DS0Sw(Sd@&aAAf`U@b1zlUL^N5;-e-swp zI~5%X4%rYvDmbbKLT;;%zW>^OBf-4i`cA9drB3qcxc$gp>Ar!Rho?-wv3jMM=CtY- zP|=_+R_3vWwoxX_58H|}fvCRkcqXbE+?H_PlVmyuub}dA8^8bJGl6pAvF3&nGCApL z`2z%07|*iq+<_%BA1CR_(E+gq9%qsnAC>R^$F`+`aEKe5ncYZ$@s1F+Nlk<}0{{ka zHTGb2eoHs?{;kI-2#M<$_d|pRYfGCm_slC_w5v3>2Pl89Jxo6(b9miw-a|B?>DJZm zhd&tRmAc_=?Gkz{88ytBp?B_6=o(2p16{$7)P^K&f>kQ6ITF zS(%^XDIN$EqW4kj2(q~*xF_!0b0o2bP!!4MTJKyd!P+d@$X7DCwdruU*;x5C# zm~iw4Dy)Qz-e8r32jE0SnOu=A4saZ*H_~a%uHe?7>43hC#Un~hSKvFN(OE2Hkc2q6 zxC)V9BBtei_nro2*~Ny3r?SbTAcCe?LMJd9*1B!zcC5wVvg)c&^6MH)2^B&?4%=h1KFx`Qj0EP6x@wny=r#E7Qxc|}iMn8_$}uy?0vWQsdh z0B~Zyk7<-Q+|?5{Qi(K_xymP#n2mCE z=E`?^t_~>7{jO<}b5{Nq#2$Xt1*|?$p-&0SDdzSL|-Aq*KOFl zJfFwnpwsRIHYlTyhn;ZBfI~QuUL`W;q95N;HS>wQq%Qg9JhUlN-Qo4rF^e&I8kUqQ z!1T<;p;F9e+-v_~9K^`d+(dv9v88NQd~;SGY|a`LsV)&4TtQnI_z=+q9# z^qN*>x!g{OD72nXSSbQO50|&ekxZ}9O!!C2j+@6*KU(q;z6*n>XKo!=k{H=7#Gv1! z9cNpW<@d&qfl(qm#X{-iZ_g|9d8}pD{>CD~@RwO`fiYsVS!s4jFw1N0?yC$RyMLy1 zHmE?8_I`nmCS1;24IDSF7p@jRTf2+BG*4-RARR+ncw?T`Iim&F=_(34X;$md8%K8G zf%DDCAm6Wa3-r@B1zGoW9}#e&-vjtdvEtpFyo$T%KKfyYsPXXX>FaOvm%&mGp{~tU z{5Hx|MCdHaL)ho%Sa{%XP~T$d!(SNt{Vn{kay^5lsw#|TH!Ew3)Gia$9qgqJ^h@VaZpyZh@@f~OI^=XEIV{YSkX?CoQDA{mB<0q;P6#O$B0xO z=2O5r38yjb(F;g+zaj0pqfZX4{R7cNL!7*EKuPU5S}CZ6NPjgBbw6?Jbn32tcB}U2 zv=rknXpXF@zE=@iVe>7x#{^O$cBr_RvjQ~T<60wVO$?W178Q9^MIV5LMdzu@Ae!W2 zPQ5SbF8*t4%qkN1>@CTobzdBiGepe^ZY-7-pbC~r-1{}y<-uLVw%+A|2(aZ09S-Z{eSLvbv{JxCx6<+qyuH@D9~JWCNFQhkLt*8v7cVTv}ltc zoI_*hw4kJX_OB7AZ5EJ^J-wXbNcoRVp>rNi9- zoI7qUc<*ueeRt1LGO$eG{5O5MAR?}y(2m?^2MvB6eKZhuzzMv|3y5^#{^3WWKvQ4$ zTarc^ilspDpR!=HW4sF(%3W_`nK2va?QQq>CgIj_(`P=c(tUhxk3nu9+Cb>AW^=B+ zd>_ypqaA{hl5^l%WBwC|8G1@gf!=%NfHX6s$EcElOBd)j4i%}1j{nu|L8rK39xx9H z3XXK##IO$eXrz@;L2oIcz9MADcj}XU?Kod7F903nKF4FLr>4dS<=`08h2>898fn+U zg=Gu;Xa$lDHN6FF1U;i1+k%<07$sl%beh>ud+mQgeT8f=B)nfH*X}LPA5y@jlMQNN zkPY~Smv?~PwbpsEva#~f)1bzW*7__~1AB5K-PCopuS%~dW4`1}QJhCH;19e6q6H|E z6}3x}D=mX25DrF%KCMdTW!IC4T?seGCu(DaKpcQ~Ha^I4#Q z^2zug_f3!uO3LU3YA7}~R%NSx_AqUUg>?9jUNCPU9d-MjTvx^{Ld*NkhJY;yCCZ%N zqkCNs1daXJCXU|NVvQLsLi*GiS`Byx5vF_Z8?&NskHIloyjWtbjWdWJ-3x9dR3vC8 zHYgZ~dWHlV!c03TVFys7S;rS`aYRkAyp^JP9kCV)lQcF3)0;9XgMM*I^5uyiTW}bI zdYnVYxgq~jJ1|?=KD!sd3C9$^c-M+>RDfpK+CGR08*!^P&;>|VAJ>+7x%WrPvK+IJ zG&P3vbxOh!w#zBZ(Lm$!&Z1oCY`CG>-@p9CA1g&}HkJmm$X(u%mLcDC$Xj4r0OH|) zJMZS~_fU0NCa}#D9;DO~uKx)2|2q&6s+Cpsq8ctP8QAs@1{<#i%~9&*azVPc zO8;%+mNMt~0eutheajXt*8@PomYNB;xnFl17<7ScQ4s7K z$lDk#m#ozwa;b4K2oay?O(7C3=&}4zoE)E<`(8IL-(5zES`AV=FfIa5BPo4URZk_^ z_ZNR2UnagB|NOE=nJ1dfLr`f72Lw7JQlL#v$Sh@$ znH%u`>S}5V!bgG%WBHXs4$WnD(@SLSNuFNVHvzUE3pD9TEnZ;XF5~vGsJJ!9A{ayW z&ZPkJ;HPYhG7Yq@b6~a;cc-a|zVt;R)}8w88ACzV+RNnKp(sg-|V-^$C#7pZu9hyf6-@Y6+9549jdAF~it_Op4 zpn5uBz9_vBMiF4H#uQja3h7ZP7WJ%6&&QXTuiPX8=*@=e4H1E<Jsyw^=UI_~J0KNK0M)CywGcGzrtJQ8TIfY$h?_bYok(*>A627Fd;vb5?Y;8uc&Vq{hUttIT`}D(qI5Gbn z)9^p5mmX?^UW;JKkn89F)f|vIAXQHnTnkX{~zbJVMHFjVd20KMr4sm zx|<|1LPIm--vL9xvgsy^&$lW%gdfm1jo~*bN8Kh4p9dy@W?y$@O4_v$!TgoNsr7NC z)YNKla!2F=K*pmO>p)~c{iS5T@sSz+tFrhUF&0EKaagdkArF>=Qc*N>PFsYsyaGy z2bd*5O@|wtZr!BYLE}HO9Mv0OPGUz?11L%yy)l%+(5XR7&>4faUwo$Yet|vvw)h2p zqq7YeS~zpUfbCK234u)JMpQ;d5DUFV8VktVIuBPKUWefK>IJ{O%#g;ZNU#t1ak*jG zIp154SSzP~zAAc>bxXZU%0u^oZoPwYespXW`neDU$-Gr32?7+Ihq-jt`yV__#$vz@ zXx#0g;J$z=U1)c?=aD;W9$$}kq^^?_%m*No3au07EnNuZ^@L$K&sMPY5DZ@!Rg!aG z_W1F}w%O4N1CarvgFCwZ)H zdGVh3MCs3u2>zy~`h-U}?zY}&lzY5=C51T`F>C>^7L(&$lD{SF0ApewA6;O{te7n? z_v>mAFANJG6t#n&JK>#6d#<(fnnCfcdpuL;E^kg9nmLUZfGFd943Oj`1`Thh&W}LG zhmxDTLFRUo@$;tUH_AJ~Ae!i8jD5Rx-AcVD<3D=Z^x7}LC=paZ<=Joc@)0MYC@-pi zG?p0&m9Sw>;+_NYSR{r~sMfw+@Q(cr``LPNH;(zC)QlUv{i9#Jt8{BCjUw2W49Ih< z-|zhnOisImMbHEK0nBzJiv!RXy933a(*6($@ex=r%0i2M^$({bjN3;E-`Shm9 z`me;D@${stx>6l{U#)OVBZ73@A)TVSm1yCbpE3_!C`DD*{4_{NLK;VYxQnNuMn`>D zM)D!gc+TB9u*w@ySs*T81-J-WI;3LK5~qWD31lC0%00HMNiX&=G0HF0r6( zK;F2GTLVK9#=msL2*c+Xy9e7b+dZN0 zCxcaV4Grhe0zy;n2Sgb7W01Bw82cTc4&1O~^hRh5NLt6r*UV!^vHGT}S}U2`C9MBo zGX`z`2kd}167sQ}!ia7enF~AV|I9hm!#n->a{p;Y5oby@>BR{ELMod5b)}tKkB&iG zTt9GsVmJ#_uB&s!(wzS*BMm5-Khtnfk4^%zn*6T&1SH zui)E=E955sH{F)dpBLdJ?}Fi6z#vbRx*X`T5F&Ro1u6v919(Dc$VJ#Y#4*eqiXVy2 z4Z9F3H24-0a1#>;^p!*HH4Nb$D-MbDWj;)kmN7d@Z-kZ!XfB#R65kl>z+s#dy{2#( ziU-(kW*|&q@RE4xJ6K?d35my`KvOLwDI78Cj{F?k9NlbiGlEV-9|z3X#K_ypfNJFx z>>J2D4fSk``o%^jQpcKTp-7;n4pxJ1A}&n62rCNB#?17BfD{YvaE19n*6T-*O-WXU z^vSuUqN*wYQ*pMIhW1-5d5me8MW5XNZANx!aHO!nXf+w_180-@rAvPskR6T*X=epS z{gqWg?#6>v+Xr{o;~kXP7_@j8{A&|y`uNuvm0q?Jw3D*kQ0Rq*@=KiCyw}kOg@@-| z7&0x;K3co0#;{6^6WNmU1BXbC|;jEG>iXa)C^vsk}zPfGw~0I<<(beu7o5A)^Jb~6~A#UD|W zK%fMc8|fe&aM?04FkTT41F}=ZCxn|73);UzOH2SQu|12_4tHLQfq{Xwad16f=hzgs zr+sp@KtN4mmAruo>t{r^6@9+WNCvW^5fezqclmZm)!9u))ll}}?ne$6@M+q>GEj&> z^#H!_0gPW&n^c1t5Tt?;ynzb*0Syel2cTn{0YOfDjY*_Mx=CIx2>p7Z zTLNE>PNwp0@rekt+hqO&Dq2A$P@b`TnEFK+ULKULOtlBZQ9+>(r1`-lEas9QJutn> z!FO-PPnbmT{LBLSVm3EBgKZYFhh*;uD}^tsJ{=)UNun2nFFVVwiI^>83%pJ+KQg&| zTB1e+jtC5Eh>@U)pKVfMzGejYu0-~Fx!}DpF5KGk3AhGqIQKF#kWpsVGry1LD!58F@Rnl67yNPUFnEb?^6_JqoQ0DL0oYAGaNSJ6vN(=e@D^>* zeQIL{6WBUj(e)uH2^=TdJuz);4wD^dwr&N>1(#+Rbte`E1lFSWTSva_(u0{}2lXjG z1H1^Eyr?V=bh_6hvH*HEhYIA6Y(;uII5}}6vY%*A>cZsm9s?nj+mU1bzL(KyM^9mm zgaw%v&nY3{j>2rh~G#V4cOKsJFn|<%^Xb3GX5Ck^hx*UzGj!u zN5?JB`4`mfws_mpwsZBq_+<#Y3d;0F*R7iEq?*+}Rt=R`uP0=fn$1`G#3Qry3bxf0 zUK7C3W%bqj@c5ol-)~g)!%ytCqd=pohrn!;ib2fNi|TWFIug zVQEY|oia$jj#R_81xk;uB$b)py26YObn0}rsa>bk^rdIob~*X^+Ve>Un7Q`(sd>uB{E;Rj_vAm2Q46djxD$*to{p7~%9`VaU>>CuTHA%;2%$YpBF{N8q<`KAhz z4vFUA5C~m9U`w#@i7kt$4ua8F3xUdZWS7_S4UzVE+;9h{q^3FqM3qFW9$coBP}&CZ zYc1?}ILbc7^8@AY*w*Gl3AX!WKlT67aZc$L@3Y=QiYIr{(zH=a+#Om~tqavs2A&{T z_wJz?fGVeMX+&qmC}7ND1SyTfn%#v{<}0^L;ba}UQsj~}2E@ei={~!}H+s)=<_`90 zzT?{3@6fI^jl3s}0S_H^*ME6nNi-PoW8xQ{r=B3ZPbg6ZHTmBXmdy7Qwo_1iQe>_8 ziFjK~NP$q@@O5_0ig@rlGL6?S1`XbrXZJSJk%IT@&BZ=1*+t~YVcZ}n$@xBYPXxvM zB#rx9QfwT*;CxGZ2kUm9Z#?vmVIK2FZl=Ev@%X<1hx7)EL0T;h*j_<*c;XGme`pzh zy0aFBlKhfJ{$gbR2T<~hUHtzU6XvXPo#37GOU}*@lPT#*jAHp{?zXQ2acl$Fy}oWB*FP39A-V;yt~7g4$i-_3tEC=73lg zntT|7mhf)a(6apyC@CT9+!0NVX5cw7M4P ze_fmo{^H$asv~^uF9Smne2wrFvq@t8096TzfP$=JyKdsJm4#Me-^fYWGhw5KbMFdK zW+Iqb8T^rjII0GO$pWi(a6A$jP#VhRl`0t)k!-%G?hCSPv75maN2DnP2sctLC!j1c zt@zJ@FW-{;Lwy4`%`VN+OQaQm$ z+S%D@gJ5+pEQ9|_OW^|Cba>d2;|sh#zF)wLbog_&%lFndba&u@c>Ov;(4rO=HG52@ z2Vn5w^`MYfk1>ruwERcBdGsv2v6Yhc6N2m zjph}TT*tgG6j8(}kqBnP6r*1v`zJ&=c;9ehd7Etpw<#%}<}C!FVJF{9#( zod~=l!q&|M3|Ns3ONW-0|B+pOV1xr|fipWTnZ5(hFP*r{{RB2t|Jj_7m3_|uUTl^*xI%1x$iOA$t^P}wFZDv*H;rSWezq}kqX@y9LwUZ*Xc4&|TtRq| z?qu{jiV7*MU3moqfgqE1^U(qnz2~MZU2qaS5rowUvocP}y#z{mlcfhtbG;n%o17Im z?jY`;_%J7A)CuDh`$iZ7<(z<3-vUb%+$nu9c$ZK3S<^vRr&t(|umH*G5=?wwi`dPx z9>~?bBHnxc?;;!|{?!?QeTh`wG~6F?$>u4>{_X#kwEY&>)5foG36{xD&q_ zbBP7XSQF2muUQ2pCZSi0##G@0RWrq4IyKWe!8ZfW0AFJyvz-Xr#d(AW?)j4-FZ(7$ z79SWEqFb;+-h|7de^Eak;IUoRnN`1fPaRZn`W)01AtgBi}Ht@bY zwP#vs1rwJa^N?vaC+nL>&*;~d#n$4VVD<}hvp z!p6fvr!rFLM&!-G*8_^CoHKa9BA@neiiQke83~^_wOkPB!O&n$!VPjyJzLuTb9HH8 ziGCk{ZQ@=}DYLsvchA+jz`0|cVnUg(-OmayOfJyvaeodOoqn(H43vLWr zxAW-E!pUUiwl>)j=V%0+*4h@#4~SEyK>`kjob&Ll^J{&iGpg_8toVt?4~YV+ZFX<% zO4;klUV*c!jhp}8@xkg3Yyw)v{eI;x_*^ilg?8F*JiUGUwv74gDUn&Jwbc=A=(1xyE$jaM#Uu2$Y(=G>NSnzTBF%(f&V$Yj z05gt==_RclQG_?A*M0e=`e03-m-H<2wJ+w?1%{QqMfD!*+M5n&4Cy1>!dec#)q`7q z&~GSXHV@tVb~FJZH2gpFZnA?O=I<}VkBKidXSiWrf^Bfy1~Lxz>Wt$zj(2PJ*kLf6 z=cSEQ6zpZ+wuewu?{^$w1V+RFFCD!58Mr0gJ~}l$kV%zB1at$L?&8*)O=>%0H!v6zMfr+dwTKUyz+8b_*TeiqFJ%;9HUowoe#W)6xn`s;yN= zk$n_7zlw$K3dWxld(14r`@egPJplx0-{G!T0GUyP&A}9h)jg2U(^Kx^Y!9I6feuAdseDPEaX9Wh5qpt%`aDvf{ zg{SSOuP`gkH~Ujn?~-|)HEz?@>{ZYtx6;zOqZTO0+UJ|lHwiELV5PuY4AO(-jKTx` z-pP5q-QS2#0II&CyNJROB@OE9J9nafA)!#1b{;eGgLCq6e!d8qm2wjSD>U?7#1DcG zA{T_&vp5N$&8B_$3GKTzxc&na9=1!G?=G|AD0Zlp#bH>~P^!&op9 z;SLpn>cpeFHj3Ip(yi!Fr|Ce9Kt)C6gjNIU+LpZU(4sI2r2;BH!XES-cDYvgJ8tg5_t4(VLxofzacPyqe@pP68X9)qU1^|K=uzp zmHC^EL#A@)&;E3N=ptT(D}r)GI{c^)>l}88GXCeDe3X%R`_2!B=F7LQF%?f( zS;7@V;6dOgP0ls77M2~;in%doc#-?H;x_?(zjGUHC1`mmn{_p%?}q4Pgy;7c{ZAMthj!1WZxP8b8?r{R^5G<(bhORoKx(OX700<<9Fkr*VcO- z-uI1_O=iCpT)p#kZPxbjr*l6Z2_XA#<`yJ=VRR^SKwNmpTv;ac!rqwH-%4P|=|`n0BV0i7%XOo7l&QtB))iV5KwhLQSb4Ye<& ze^c&qMq!Npf-DOb<#Ra1X1GU3<;d*Xh)G-c#&h`~qERjf6JaQ!thZ2qVqzKQ4*MrA zHCu^yQWG`)z*_8rc9W+T6^Yj%9aMuQ-V>2`+~QaVx7-H|NQk{JQm5O}(jq@<*roMGUw{HYVt(=DL3Km>Y$A9BEw znqCp!<5x^3Bj!xb!HBAO_UW|+sUz#k8!9iy zPUby4U(K2`|D_%F2rxf(6AcZG!-ua}xAckti*FY&amR2b9yw2>*^`A0`l15mFF4SAB!+S7308FlGVdZ3Ni5jERF0;tl)%*Vaff-+o3|7 zuOb_J&R)e^yk}lg?tGb7G;$Y%2jnOR!DB$$rZ4jlq@VFrV3+Oka)u$i&ZMDm`NM#LI706B0%Sd`kqi#D)}`0V=` z6~W(PC99!s?#aJux%gm*nIx;HYjR*Ra`c@DVgbW+YF^xTpvt8)zPni1N>mKP;)4;2 z&;@f-QcANqAJs;cwbLUF%S-1Nz@Dsm=h;WRwr8hQt?yVy2(VQTTvX#p+8>Z())};? z9E_H%f?kfDFPn;I3FojbijWO{nZO2JKL zpR^Ne15n@LtFr9L{`Ncl_FDj%L+a5#MUFdGd4=D}8Q{CHT%PfV8M;N*OYJ(W1s zP+Ot9ufPte*2=06$s3Fh4fLFD$8CaA(>6rOvLNyLWzYrxCPveIKq>VTDOZddBG=ar@Kw+Rs{|>hw zd5-aL=;{_Y59o$|z=8|G7J_hj`(ToKI@XSsTnW^Gfn~w6EFM3uFvGC%A$I`DZRN*C zosZMi-=mZL7+rW!GC`L_7Vn!F3YUf&fX6h_>tUjV0Y6eXwRq6qc6u<-lhC|0(lsIR z#lj>{;3dR!DaRTk2rXsjkwb^Ps8KA4bnPX(Ltz-;z;NfcrS2hgmC5j7?Y zSuuW}`@uGZ;Z3Webqo#fT~}%FcF3%X<(QuK0t~;@o<}p7Wo*~gl{4c$W$h6Me6jGH zNz+XQ4Z5t|-bru8M4*C`qjlB^@r4dQO<cYXQMs}W}6q$_iT67(KCNO)P;jygv^R60ySn8SZTi3Or1R|Ug?b4eK@ zrrf*F=!7}sW-L(-T^T4hJ$-0S_S?1I4J>wh2ba-^9!wlR&>PrZ*{@`9)k(MR;77)H zW=wA`)F`Jmz1Zh0ns>YHkJO8u%a%%dR!jCWngRBwFD=wJKIzrL6a+`_=Q>~J_a7zh zfzs2NM$=hX6oRk#>a)8$H`DltYTO| z*&`H9O-yD!t&*g}*#{CD?%x6s8&uhl(ES0p@KzccM@L684SdjLdY|D$ITlK+6&Ei~ z70yM77Vjy? z!J$<%=pQTmh+kHg$yAVkwq?|{5Gm6SWQ>m{#|V~ma@c$G<_(g46ZhsO?_s@-ifUvZx7?Y?l zd*cTNj!okSOWSmuOxT z4JY%E1CaD@Zz1>+&G&G;YF-yg$~zgZu#l-7oG@+@X1wtV_!L+64pJB>Piaij1RCNd zKSaf9jA^hA(2}Y)8|Gum8=qLV&irdt$pe`gC1i-dVCYeK z`Z=F(S!p;zKgx_O2n{RfD?#iOM`i;jvkY=~SiZ&lRO}=uVQe5Qs+Z%4p(?@TF9SPT zZI2@xO>cMic=?H<1P;3|b`e0i);jD^JXb|v z#o*jBwN8?sLRywx%i)#U`Sz1(HYMIRWWTR*m`)SZ8F5=KboqD1y;@7R`paCS#%4!G z(7G0Sj=x|&I6DsGSh##L@wS4LCBnn=Jt56vC+}PY~8)OeK zcO>w9qca!DyjApb7ZrcHxZ+3Qd%_mmX!YB>y##!imUdUiO5X*Vos&~Bwa#+I?|^^2 z-V?q})X^MK_<@0et@?H_aK=b_df>UhNOBJlPvqG_Lglw=# zuDlOHihHeFKmtJ^)fE;`)DH#5uQxdv)>qQDi^jlU`BBAlQbXukf$NAR&J>6=!&Hlc zc-U~Z!w^AO9Uc0^>tc6#%u1=X-NGG9#tCK{zXq-AXkdc~S%#Nav3OjPK1MZI*K=I$ zSo62GH!C$q_ZBej9r(P_Y)ZDPPT`ouhL*w)Vd@!%h1>_2bCs;`JpPVF4ql&@Tu1}( zm}WE8id;XXkAG`j(Go1_e#}C~aiv@N`}EQ^Z&@ouFAZwk=> z8p&L1GCxB4HykZi@3geC3M?oD4(1V8a{s7(V3|Xbdw{DVx>IMzM%-LQgmb3~xst^@ zLNvsg-X3Fi&w$#p$Iqi1*x!Eu`1NbkFqT4B#&jP4=5r35t@+HW@Xeze&?w4nBRkb}i)Y9wo zHBX#)8!I^nh`|jLoeW)`{H+;QcB>oKamPzzDy%z!(}EA=iV4L@^y|H-vD)I4Vs2r9 zBHFUB)J{ZSP0b!>k!vqLS4z;Iv0J@KB)EI$r2wWctPg|ztaG1y3{&45EC(B8(9r3Y z`rMG(?_)5w#-1x@zbT7aVS_h0vww$kmcyy9-b;RI*Ctc|H%kuTmv4VbMHBiv79FUA z_`;w%RwspI^^^BtEI5}%L3fNQntqsCYT-Kza6Hz6q*db~T0- z0Ru0$&<}Nvv$i`3`><T`rjD^F3=&fqdl z3(L2olz0t})RNsvDq6x=B>7&R+NAWd`p`6f>6KZq?@{rup`e(&z9!3_#m*GeiG}a4 z#*iR|-%BEnP%XhvqO#1tKhy!-bUNJuMB@Nxe zrHb<;KT49@akgon7>+F{42xGwF}`5=>S(z?KXu-?o8(QkCS30O$9o{BF{~L%XV$D+ zxKz~u_!cY&PK=^j7`yXsFM%sq0vE5=;^Ok>i>Iq5Gn=Gr$?;*~eqQ_lz<1rIk+zp_ z#mdF|f|>j%nKaeSh)aI6B;wGoPh4u1M%q6=>UHKUh5yNdUPhS-Yt;452l#cM$HW zZEI#xe@;~M!@BTYyDx$ywG{Z}G*1|$ASsmfGTx)~|jvseMS6v*K3|y2@`Sct`a`?fS0|jD6E&eU+-Wg@+ z_rt|QSe5(s5gZ315MVqmsBJ1^mpLc>$+fbH=MF6zu2q1tr7S1+`s(VP}mqw)`o|1>YQt~NRNVPJ6?oE9BAxexoZK$tz1jiEN zm#4l4s}zAN@ntZdIw3xOXQ(_G=~H7qe8X`1%;Cc?iUIug9K2zeV=WdcKQZIsbaaHV zZM+mcCg>$Ml~Z}Z$b|4oCRM;D26hQ**{?)=`0zoWy#uKzd>hesB;c>ElFK+7_%DmG zjj7IYlrZSg+ddh{1&HqW8Yo9bLSCc!gzR?VHPTD ze_dX_N&4&8uOec1mh&+MBCRszCs5^r8Bh3>SvI9-W!=V!bh)tdF8JP3*Hz{YDDV_Ietv$f*9rAA ze{3I|R44EK5|Jw1xc_DK(67oJfcc0GtUk07CE)S^^OT?yQ~3m9Jl`H7Rmcthpxr+L#|K84|i{o15|s z1c@CUC6uvVAwNmK5vL>A`te1;stqR)G8DL%mvJWzbu+@0)f$VPGe{H|tzGjwT zigf*Mj?;Kgy*HsMZB`aJL^%j^+z6t4Q1&tM0!dYP)V!ohCOk8)@2tmAI2?|Zxx2Rs z3~jXkTF(`ud}rhc|7Ibq&}yg*E^Z{%-1e7&73pnN5hu6=JPq&Ax?*fvu0xmd&X+{1 z$35-rDxXSwUf_Fo^}uce!$DbAnH5dz$E%l6*u`Y|Xm;+#YMMJhGRDydhGbQGCMsI{ ztCx{I;N_{63#CSx{U*uS$*FVS`m=`46@F0i=O2Fhu&iA!wGJOngyN{(nOM=rjgG4i zo+nizxyS(%;}i9p*E-Fqz6tN^ut9rbC}l(<8UVw>_nXU@X74Sd&_5>M<7jSTV|=jn zMHQ9+1RtR1_kHduJP?_%X92+{_rbViqkFo!ZO%X{2a|kd$`0)0u zzSQ~wv4LS6jQ_TUIj8EmY#*Z4A8X%~@vHD%w#y@0=ymi+Wl{(_)YO#dQllBf?^j7% zRe#1b%miBMeqrG@(1dzbt85^b%I%;=GXQaC$Pv(LWRD?FgIiQNOyk6f@ZeyFS~=GA zppz%UOlY@m6;sH^2qq-$U=hYiPtV-iTI+@@y64g#Jp>`#7pB`73ev3chc)5lW);Vu z3T7Sq&45lO`AFE5mS1@W6D$s{1_(h|zWTk=p>LRd#nL5RDcTXo9&%Rb2rI{&M8gVP zSA=CTQfV{gazp|MG4auJ{n*m&Kj`C8iH@hrGc^uqNjjx}J0>|<0~aL6RS>=Iz(ExFiR zc^-eo1lcg+1|;1fxO4G%%gOmTFLI+lz(iN$yXp#iNQmQRS%@J6=o)nvTWlM z6L({N8B?H21b@eTuZn0}ReB;=4DmZq0N_;;R1>B9AEuIH4}P80Bk){GdRof6qMh}otSmbytl2Ju zXV^Q?IZ+Y$d=(R?ZoEQ*3q3PN28Pb67~oXZ**ne`4aFeJC(n)wqHS*W{G+d#A^b7Q zTeog)YHGS;1Ph@4g^tke+qYwdp83#qFkF@eQ$nH>4eVdhl1@>`Pb}NrS1dSw$Qr z6~+g;U_TNR6vO~OF&mMBDL3N0P9w$#hlM zVsLk|W@r-gO!u+gHN;YZuckX5Uw(+1smnh)bJs)%1t^At!N7-}2Y!Q*MWna|$~X2x(~1*2s0j#_lM|tzxXAr~h(}sBv>~^HC1e6oc1#>AEiHu_ zYe30o|K%kLHgtH3Mui$~q7?o1bVzw*3#6F+7+uMpjD23r`K*r4`@G^AYbUPkmOSb; z*Rt}z_@Xt11{FFRc=(GTCz(atUw5sMWdStb2{<+r5A$AHVB9}CWOg@o|C6-u6R2A7p}?vhQ*Sw%yfOY0)wY+=VM%J>HY) zY~9V;tvCt5j)Z3huHfqGIMLSyMb~z3Kg4uf5-xiMh(~G4aswZnghb5p97VCdTDNSt zCS4`b|D>UZ!7A^V#*;@mIkN0A3doTISPd{G_>u==9D>+2&&U0FLNAk)^r*i#2RkrU zXY|Yr4B{V3TMBv{(4@fK^dpnQt z()AB-xk}9x*!9_)nIK>bU?jqs3ZpR1%*>cY>`E@I<+yZx6WAtpMCl_y8`qhAv+4agmXRgf(^RqfV{&mFww!|c>p&u zHtpbGEXxHa(WeF-!|dNvHSeoPQ(oj=mUq>=`Z08SQAaZ3`gxO&>_7C$9pdP z26E#2T=%l==g}_1y3Bgp<;>SVZd$tgLyB|y$+32$^t9((+Z^%El1Xq0H@E?_;N;+d zMmA6G{rKGjA3kW$rihz_nGm->k`2&0BQd)gDNWL#gQIJD+RZ5kG0{`JY*$GF6X8uS zD8KkZH?i>X;|r)%u+MGYs|b@k?9<4QNKe01C`bvX$SG5L zm5!o6tI?i<<7+Fwm;%dZvv>V^$WZwQJd8`rw_ zK35J&2WJhdl;M#Vj$s>nhLsy?MBO(?Fx#OkhY}t{>JHP<6v$!Egei!|!?)whu~C}` z4=O)uGBi2GqF%twj3{&3)gD9$`;fGaxeQgJm_$}VwdO-zDxUgO zhl(WAi(D1uew&5ome@sq+LZB24&n}EPBlEKMpe!|=Bge(LBo3NwZ7%E+yPu@*Z^^g zLyJn5eQuy_R>{QnBh%f!8_uGiZYpa#KW1&X*(#m7`CzY&L~N9ajz@8Eml$7~XSv%M zDxT(%9@M?x$Aa%XUOy*ELBZXSE+2B?Uh3|Fx`EdY4>u$dHI` zy}6;G_~Yc)wC{IRnvBtT`l$a*g6T(m)JvM3o!n z(f?Ehugt2^<|EAPSrNtsJIQWZ5smSE%OMB7vDbR$#0pK2WuMMr*jTsE{KhP_{zpVC z{mP~7eU#EW{}cfe!;#F*(GBYubiuAVx0-cjoG=l!KH8}Z-)lmd{GIr8NT28$b;y?h z2mK{>t2ttSokE7GC9B-7H1!d}y)LnG+(MtH>)_adhLWn`7W?Fuj-&ZYPi<@S{w0NN z6Y?Og5u9f$vdb$fu%QmV6&KD2LWldA_Xdh_W+>q>0N_Xle;`1s6VJC6{VtzOR>R6r zTl;9$hDMaF->M_&DHhk0b2~oVpe73n^nRljXa0z%m@5s3X&V>d2sCS8q``*m#OkyS zfbl@<7I=I>c{`KJm~n1JiO50MU&o6Af948eh9TMrPL+MA9vNUsyu4zqUo_K)>n$hp zNl@<7oLbW#_%8J473Ae1)f~^%wr|ui3k?s)nS8a(hCl^8OBw_I7vl?-Fc8{>+{2c60N71Uu<-B1kVu#n``lo=>tu!rSt%CLn98maDqrMh)fT>6%NxNanxS7N zLAQfw^*$?w;KFF^ILO}E39RiN7)f12pP^1wR0e!~fudH_-feOR2N$q0BT<)Vsu#aWm zz5C|E5y$i_CwGugHqOJLF;Zm0OF^`#KGmg_2}JH0mkDf?u5 z*TQcks{e;9WCllZ2S{Jt!ql=7&_V|oPVA<|u$PQ5;!$Er@XHLY~u#w6; zVw}?Vu{(!#!a^?yvT{{S^CJql6T=}qAfXC2;6ZTRug23>TwOcsm8`P%Gxa~E#VhO zosKRX>LU0ZrGJxU`7$&C&QVgx18o8_L)pH1)*F_N}2YONIQw5PO?N&3XwrVXgLx!BYXB1qK(Q@Q)J&p6fw3?N97cekTRB} zsF5UV*5`c0E%EpGl#~>Z7{N=@ zo8&av;h!)8Ffv9_gg8v9k0ZMUmG1e%MnKD7zqz4gi>qp((dk+-)P`fPTDsK56os{2 zT@lbF;8TFD3AEJITPzj}=xk9c!F+*A#Ls=^HYM0R!O4ovDr^)(J_YqvbR z;LLI7&M_n~;~(Ypu)$%GjHpQy$k>LATV~73xO^7f9#>9%ifO*bM-4M0Ooc7uLc3Ad zESqt5k3=_sF^3WF6T_4P-sJTZ$h;W-nl9?GI;G9wAZ6h=xKg zlpct(ls{Ol7!V`R1n2DbG8 z17NvA`0J}zyQ6PeUE~5BjrfybDttfIOu!0l`r*T}!vh_dNX$E{dJ`lN zSi+>5pYK~h2h2`=3jF2FnTcI|+ev%g;3k12 zV+@EsH@WRDOrkeV`hcvk!6=U}L$HB$g&%ozpz38Yy*I^|a$7`^T(k?UO$A}=qeo|{ zd;(~XyP5!#i##`Hfc7wLQCS-B1os`SE?@%)Fb#Lp>2!clU>g8=-(_l=oR@QyoqYRt z+d6Lw?|7630H#3vggqoRp#n%RMk{lt`2fUVCcB6n@2 z!+8Qt9|$mr&drI4XaMi#<_2rim9w%@&49{?v@}Q%zqyH*cu}zYTa1z2jW$Do z5D*_z|326WqtiK_YszL-W*CYGVPf)cT6Keq@))G;5YtTvbjbpQ0k9wsR7BXSd4fpx zupw-Ss;>Xa7~Cs#>`iSv&Y2Iicq1M!2XZB! zSe?5YAO8V7Bx0llj0H_1tj6>|e`r6hcjUUde}&r?S)n?7LO4N@0oBLyIFe?KRd1J? z289q%M&LAxSGb#0v`H7;XOOijM0C&IB{vqXG; zj@IYpg8!}lvEv(#3;-GPK!62>^wXzL*pD;A!x!0YSRdJ5I$$=Ar*LD}3K#BFtP4r% zSu;{`0416LS|iL;d^02;!IC~7n-?5z zB#hFwtIt3G=r`*+1t3?XGrxp(QD3j<*)y02h&PbX2hv6ZW{t_sbw_Tc)nFE&5KMpG z;w%cmSOF#tpnv;<>w%~8nCv|e`OiycZ=afm$aFqYL_$u`m$$DYu;ADCMMOUPgQHuy zPiN1bOwgo2XbPg^fG2r%<@CaD+EZhB%g!n&9Iv|(dUoVQX|ZH1&B>X&Uz&k9y(&}J zB+6SZIT6S)n$S=6`JMpu$iW(E3m#kKlJzG+L9v$$#S3gY(|8u^H-No}MuZsy*Tp^r z)M2o~^^z;lf8xcyci^mDx^i;==Gcm$mSrnprt#Lv1O zrvdQwgh6SzX(?q~bZ}fepPsvw;35rf755>OcJ;RP*Fj$W&2Pxlo{GRt3&{&EB@4 z^4i$}8{ULGNv-}VqI%u2c^&e(6N*wpYNg9l?d6i@wCO7?^h;ZCEJU|{8o>3R+^tH^ zh0b|z?h-1C__0IrBAKX6T39~H<|d%#)n?hnnH!SU4OyXrWBjt1If+F-X2f2$j}!b*k&5cjACf(NL~G=QgT(z1yZ~r*ilFsrapY~D*I;Z<(sY* zA-AsPEbMUc6A`l3Q%Ga6K&gApQgq-{V5#j4mD3lB5L6pb7Qq-2G%Y!*z)7Qo3~3{#&85&q3$o)xeB@T%h_TaJ0Q8# z*-wkjLu`a>50%3I3}aE^^$Tu$3LFa~BUSVpv)$(?Y7$CK^R^K-7QBIdRAL3`z8_=*3sT5z~v&Y~qoYSnWw?(pfC#R*}lo&Cq&-;MfceIbn|4yj87a zKMhlUj#dur*crr^X9BxkG|6*(bTfoK@@FXF zGU_bknfROjJ~(9%oecybIB>FWtdWW9m586>1n>(nB);Jdg+f1gJE5Io4okrI0xO{N z7e>~9Ni*V%CF2NWcuRPN4;-5OH{<9Bu5`NhKg&4!4}%L+=TX(gD|vV}kk$h%Id_ie zt^^>0IKCO0LjhXTCASGoCNRt>!Oy-z_*8KP!XoRA6-*V_)EoY0lB5@WC9uA}qj%hu5=h<&;2}c0pVf@i-tr~-4GDfw8dWg`ekc`VK#?B1Bm0>E(&f{xKrEOjq2%B zyM5jZ6@i(@_<^dnykdoFE;j%WhK{15vJ%W3E`#|fdyWc3k8#=AM(PZ$IAT$XH-MRC zcY79%?FeHV*AgFE1`P~f8|Nuu)A9VLObeM$RWC}#G|<4rB-j4qi(&`+ieb#=$svwn zukBUJ7T*1ayRknh2oFEe_JC_*1_1W_dh4%K?@z$*_1vf*ID|ni`sbFe>zfwx&x1N+ zjLVKxzi>;?lTh(0r>}F)twWMfW^8N|w%`ys2WFtOu)lFIh&>GhJ3`fCUTxZxQE4Up z(cT4BH1^?TgOVFJuuL**SG!yTm$K${E=aMs%CLl9wTg`m7mXaiKvZF&m2aenJNNfz zR_~sFU;2mEvbJ*E} zFC+42H>-GTc~_o~a*U0d$y}bo*)F?4mmC$oxP2IRTKA$IYYfjCZ|qfj&&ou3t}=AZ zHBH^XyIaLa7?21I6#v4V{G0#zH~;fL%K!Yn8%K{>HzD?|YWgPGz71~gy!OULMckga zYv8`OugG`us#-%d-J~OF$i3XiCx$9E>b592WbK$N-}XF_7}NvDyXuAjS$h{?9aMRk2ikcfr1hqSW#u_5;RjXGo1p5qv{HWn=J&(#rEdz{MfzR$JTWfhh?U1fC<0wFpez#`%`fqhT zc`IV>L26xiVZI%{GhyC>wfh!e-#)e@aH^m599X(wU4Tr)KT*W>QwnSyP`RTKhb#ly zc~2zPUf%u=!qt9|7sO-kf%nr?8WyG=gY`qGKrwC@-{afI9-0E~@^0kaR#(G49%f}L zG_OG$lu)9!Od0fq%*@QZJk!u)u&4#5_qwbs1x%Jw_s@1`RU?yxoP13fw@uu#g?mz6~b-veJ5id-@AX)oZ0Jmg zc;?;Zxcho)!~Z0g=Q|-hEoeu2Wvr8*cegQ>8+owEYwSxa*f_GE#4I6m3 z0)FE-;BY=Af$-W^^qsRb;q>OB)B%rSi0NgVW{%^`utM)4G#lgqqIe0**-_g~i7vOq z(BE^Yba*~^XAp-&#!V8;A<>^K3VeqI(&M_qcrd^H@dAW(U!rb{Dg&rpioFUX1RQrp zsLhRyZ^-$Y8(J+7ho>@jS!BxU0L}$&J~!{ng!Nloz|kXW2rQ0}wFl1x5(^4zybs<` z`iKr-uqVI2NWBH4P<@k>**^IPAshshUU6@$j!qdltsu|C3)CHxTo(|UG3H*sGe*rS zPgH0cI)sDRfQYdOP!N5wI_I+g2bA>(yDBNr7NtM1VUqiS`*a7b%h#{A`eitFO^~w< zhkI}%K-eT^?J(UguC4HWY|)=Tpu3g3S8{ z379)D(SR^dy~Z7oC=%S{mI)g5(iwOtaC@LA9r^-}l!5uV{DJpU9UUF)>S_;YD9Ba- z02`m{!9MO9#NWWDnX}qxX$+oMh;VL#C4r+r?jorq3_P$vVNk$83VaPPYqki7n1FFD=FzW;KooUm!b*@SDL?ftIy(rkA{s2J_#IPTb za=?unIoMbLu!4*ZZ7WWp-RVbuSShH-+`uRSkMzg11)gdL!UKHN9_SI-(fe;HQ*tHn;4(5Y z0&_I_Yf-VcQpi+?16alwFM8zHJC~75cpFsW+W zAdQV?OpQp8ctO!8Y}xk>6OICbML$Y%VS?)IU0z(GnBqRD^Txn>?QlZUmD6~~D# z{(Suso6k9yoCU_&^qv`S;xu!lTClVhXECX=sd-_QRHTchob|pf( z`r1yyI3YQemD`%m%f&U^+bm{YRU4um+j82ZJ^@w~vFlu3(RggmJi)5q*IkPm+C*PJ z9f}38k|ify-oV3hQeNT@4^m0Wdx6nttBZ%zPdz&-95wBy=ny^{q zw>&Zz@~PO_9UW+8Zwc``AlVSudcJ*h9`JR1wvJ5xT87GmiR(P1vUS9Rn90ez6RW6; zA6Eyb#+?FmHV2_yl? z^k&poD28FCeEMVzh|buDt!B?w=1sxI0%s$DF`CQe<>dZoAjJ^efa10#$(vhuuGvg< znk&CttJoqi=15dy{7`-Cm-yU;J$hTCV`APTX97nm!FAm*uO`>a>GSfc^;#eHt8nF< zZXYBc^^Eg7XLf&Ag_NFuA^ff}!9;@)Qn9o4k)MP}m>dwDb`#n}n23Ox8VVsOo|tez_w6_s?L-nsN3d&5!hBTV(i~a*8govR`=^;5B|;{N}2Iv8HgVn zcOp zcKHwiL=_~XuI-B`yF3Sd3p^*LxC_zc&2Xr^J=q#X9~Xue-P{mI%LoHDW>U#4I1%|( zY=Nu~;{HwuW(EeDm2M{{&Q$4j+fH=t5%Ob@-Uy;hHu28VRVinp=N~lgM+HM0{{%sK_TG? zip5|m+A70bQ_pR&&iO$5Mc~`Wb_?&NX8Sd4i{} z-Ql?5v6Mi@1|r`?Fi7AH?K* z62cVlccEJ{Boqy`n`3nsYT?L)abhy!~ z-%FD>H`3p%lYhd*mLRq{#`rqp1ZT_kz?y@Zu|wSuziDDJ2=>WdjP6u?mpCjN$Mc0j z6y*e1em3h`Rm*IjM4P*Zo;`J=6mE>=jUWg{$)M!_d+`tu5q3>KjH{?Z2b8L!CXiQR`xX6s%QvIG;;ScKSzYZyRFN4O z!$tW6=ONg~tLDMC%DS$@jGT=iO7#y8dTQKn_k!!i7bVPUAiGFT#_uQSamd66SRJrH zMd4BeC7MFh0e26e9--jJLFovCv|-e9<4)d3CxZWh03xU+pEY-Yso#LLn&x}ts&|3@wR1ylpyqO*pLFO-A<@!*Co_2YjY#~k*k87L zNt7)kZV)!ny*gKAk^lFe(1dWDhfZ?AzcFkZ#Q4aSh>EKM3!;!KMxQ z8?jvv50nlMlsM%r@j4EG4VaIF7ra-p;7kO;H`=b;PHIz`7X=6l{NU;6%;30%7~-4T zm&(b>N#+mOLhsK%@nFg;pbaagnYDUPu>l=D_0abn$z{G0D1*BfyRdPiq(oQ4k;oL7FJYv73{Y; zKJ{{PDKKyq-(t&&4r$Qn>9b(EfIkYjX{37x;ysTa?vc%44+5jwgKipsFMMqC0iqs& z56Q?T?N|5EUr-v^r#O;QC4veFyai{WNz;UURTmQ{$>jmT=1>g-20@obP3EGPgC6;U zYP%})ilY)DjjGhVDA1*Y*2PAw$*SA;QZbfT61t%H?c@_0Uw%^W?FLk%bkZYIGr$pr zc~>uNuz*Zops_*Lg-hpE^*=zPy$iA=#84oj41V!ZBC8eleaLI*BW{0S2JU`hxK6Nj z-FXTcRADIIa8w3_0#LSWW)|}@mw2&+6;2K|HOE0|qR_(ne zmTd{0laI+N{Nr#^a?V=0`;pGsv7OQ)nL>7JcazRjpGOgp~P2 zMQ*YXGT^z;xZwWxC4&9$K*}rVP>>a)`q*VLW6JsXsTLW@NBm^{EKT;gpKdxI9{Q`>|B!?` zI_%szXzKLa!-o1!z!pTuZf$Ka98HyMW+s|rc|T2+5POgL{Wn17h|FmPgO4Hg?o+H5 zyRF9>Xf-f5hQ=kKk4t4r<66p8w|(2CC>f(S`{9Hsb70+IXT3Xf&RH3ra3zT%Te<=2 zDb>X=3^?fOigc6K(U(+Lc@%+_?_maCOIcr#O1&NB0O9OLEv^o>2Qtux!y5+pFg<~!HNHRN&`skejrb0*%}vZIzEi%tjsvFomzwU+ z`_}wvV#oz0XLCKGMsGEn72wl#?2@0KAGeU)gdrSR8Y;e!%@e_niZ5mfaA?IAy&gR? zsDsGT0Iw9KYA<$jz3O%N4Wjgh5y+!+v$g26&OZtiPAWk9iAZO#C4VT95(#>C%XuP(0$tfO?Qj`@En(+()Ag66Nvu**3KPv2hJpw4 zkqZCqq@F#8+Ap+MX9xA4CCgzjWcg=lHQ?1S5TD_x2s$Hi{*H)<0DOvan4ALZ|4S)z zy?yykHM!go9r~|=W-!AX6{~SdMF$c;WC#mE?l3kmsH&?=uDc#+i#t5nf6ULBv&02E zIDGI{#Jr2UBo?SRhG%$-iQlaR@|vy!NgsS@6Ez}3lSP>>uYj=vXwMsLwN5;88C%NW zDTAUfM!_(#9Rcex83DMT0d+qnwHa8Tqh2T#F_oC9AfB{%W2%C};2lW9lXI4F8P?F^ z*VRdSfnNx>QKape1>;3S z;k-FV*^V&frLp^a+MqEwseIymoC(=8aKef*U}cIuV^b25MFCjF{l=sbV+Lk`X3}a4 z!`(VMm#bQWhBH<7R+ZnO^@HmNpf@6r8hZBnnh*B7OECSdZtG#Q7Ebnt*AHHP_AZLW zBC>x`2&>h49)QqXtGUKTesf1}b(%&EmQ zoSvMlWv&B32Ek(CS3okI{eIh@ohz>=XUdGb3^ZDZIu57w{W!9?zTZ4owz z-TV#wYJvNZSvb_&d*CR&cdr|MA7S)h*@q2&vLJHu5wluS?trC(@f#Uly#{fLdEpqm z5;~eo=lYcI)K@CnJ6}>>-W4t|m=qUd#Eu7j_|GN&@RBea4a3u-WjIYYcY1u1(ZR;|)Ve*gnZykF4jjT2B+MVhV^nx-L!eQ+-CcnobI z>-VM*+u#+kj=ERPD~C)1m|9gCsUuojnJH) z=#HtvdaJ;|7tYDzLkZ1tg&W~K=tbeQ-wbOx3WI8`ey3VkB9zf4tlW$SoR|jsaRBy{_oLCUhloi^e$F1Z zTIg|m**Kn|lguXx_0NuqD6yYn;$#dmfqD!PtojSD&Q2SrP8^7Tn(=f}lo70oM#0=&C#+EOB$SRbFNATDV)y;Z;TlD=ev*`PW{vJgZ*F^b0=qOpbR*EpPK9+uX zGdh9(Zr514wwRDNC%82cE6O*LTCOf}n;gW;(u`;eB;OmZdc}1;% zaE+|dG>I*)*=30smSFRZ8v{TYnb<6b(W)@|WslODoiPU>8fxj1+;eA#mdA+h(wZ3o0Bu$PdBu)iwVM7-lJscGx8zHmTpa{Zk3gWNQPUTiw~ zp2*y2f*wQ`=1Qa>f!4()bIx``5Sn?E9ZdbHw!EC2!B4^Yjan1v1rTy2rR@4 z3l|gK5%JJip|t*4={kVmLw}tb6BTt3ES7&1EMk5g9f;vJ5SS#e)mpbNJz)3}Uam2L zxWuUD#Cf6vNj!#Wk3oK)J_fMjL071BI76nTtwW|xR2fVjULEv@^&VdG+InisZHps6 zabs4vxMSlXG+dAvDUd_Zp%nEiSSDdMkLTaM_w`(9Gu$X~V8CG}A<*`D_-6FYnCXI- zL@nJ(OafILSg%>3fQiukv*|fBl-HQTqe!5t!}LW3Gg;#G$3L+iZnB^~Ny4IlOeIJV z;EEZ1MX3`7gx$bMlX=Ne;aUNjpt3{#7AS3}s+U4@MbC`c?IkMOneHE2JiYR#y6Nq}2)r!+>=L9sHdc)q^?q7gn|2x+$D%1MTUC|arcR4jW9prc2-)!IxeG}ml=Ml zWh@2&`<5LUIrMDu@laukZX@dh`y|i}^rdTZ& zWoS-=lo;5~Y!wBdg(|+-4`8c_I}T;~nKNeq*x)(Db=b9X)-=>Oe%qqp61B^q}uu)0`$E4pa z4-;#kwFug&!P>BLI9uFk@494CvsvZfybvicG&?$rSJ?7Zh7y;MV^^2F*JSh*L2nA& zirJOaY|%BKt=RUmYkJU&%9k&x57wU-sQqDD9CwwWCgr3XFy^hU;N*|b%CIK0Co)<6 zDS9`ooLcGyt%)E0q@U)rg@K#WuV;PPx~xaVVN&pP4DFnLU@#9GjMWd(eG7ITETNmQ zi$c`&rhbCyB#D^=Pf8Dam@GpZT29y)!3iK>hlOR0rn{U`hJaj#5vO4*hB1M*&^V&I zn&YEkqbS5|Igd|EFu_q*N576<9qatu+`*T|)-=E`T}zvXJ~MV6vdS3s={v$X=PAUy zYs1YeR1f&0gef?GZOy2!gHaY#XLRBlH|Q~pmKt-qH(>RyKHJrFIFx?wl5=$l+s3h_ zdu!!197K%f@a0sQxMjEaOU^^2@C#UI6H@4JZU|ISy!JA6+joDxbgSgRR6rb3Qrf&& zn7j`CWxzwgaVcK*dc;xosRO$34`oq^1yEfvhMJ|*ME?iLKU51j@2+T6Bu$gn)>L<{ zh%#SpY-N)P%{BkT)kRP;q|(?eT}YOiEc&*+mwc&@TWM?}p~Lu%8GIeIVU8dP6cG=Cc6@FPj#~z7q+J4*(+ebctL@x>;t$P5c zy(xfM!4aVYaRMF$P@2S_`im&J^?rdE+AtVvh_J1Hfo-~w8@TcIVZ&fK+a|g=ABdm2 zPS>4eEp9mLq_=SKctY51e5?ox6*l~sH=G9u8*BksmPL76KRj4Z`cM2kC@@e@Uq3;s zFj=a)tV{=NNLux}E)NhTV2ImMs&v~=35*ng%1|16_LY-Jsu$5a@K7OJd$*c=$*RoH zBz$AEbvY>OfnU>E&>a)VX@yTZEFZpEtp!#!EpEP6ZT9`P9vnR+_z*`6#Op=4rXE1` zrC<<%kVJ5kVO#*tnhq#(=&F|w**v<4S?NV)AO@*2tBjEMB#$1^%A(aLs};@8;F328M>t5P#gy_C`Ix&z8Q{LI`zC)~Z^0@Yv!F4c@^VvM(V z)@0%ah-eS&-5`fp9X(21FUh1GBH*niMu;Dv@`b$BRDwi5r-crf0S^GI)Mgj}L4**f z%-Q%_1fFbXiWy2y|Bk?|yvW>D2X z|K?V4PbIGO>1%M`M)mcV>~i|(UB}WiL$9>$k#NMJMi{^Iutq?J1x8=7{&lhxM?(6l zRvgA7869^@;+DpIa#`CqFZs>1S%oDcrsJl-^@+5&?&m}-vSddHKkLk|#jk`M@H%}P$D<42qs95`EpvkQLz20V{| zP=6QR<$h*F1J8Ae)A~^zICW#V|BHlv>$91^bGbjsEfLcG!B?+3!P=3441kXeL4qfe zUCcW8L`juuHuUu>nsNLEd>l;Upr?m7#4ZQf_3h!)DnD-3|6KXv#SGZqZUTUZkxnnd zO)8dEz!gJ{H-dADaXRhoHCzV?w;v-!SWb=bJ0MSkH^3+4c}4UO@4Evb|Eo{i=f`o? za(xgvkO#_axUcFe04+RnNC$90ngOcf5XWjug56A-ztQ#`<}X-5gro_C8!A?^fKZoV zI(Ct=7-=1lQ5;-EISvym5;vy0IK{EG8oM)$I1#{xA;&?`=d3c|j-qzaJ9%#wVh&J< zCfdu~&5NPO!}DUOYPioV)UW%mIZbf-gV_k`J5t1;vTP;6Gw`}1EL?GMl86Ey5j}AS zgxL5AZG0h?v{8!r;x^$0BHMHu>L1)VV!9lPVjjY8;5Dd+gVZl#aEa|jg?If+agrHz z=gy@Yk=c{y-hDP&dNszk2RH|u*}n8E80Ui{Jd}PsZua1SX5~+-T0m8=?1}Z@8#RFw zkFvte(l{4imkQDg|3pv`AsqpC)K23x0mq)BKIBqXsy8p&K`yCC_+4XAMXNq~(Q}@< zY`R|Byh=hsZ;-~YxRP~YyIiPa-Ko1@jGNjaSix%~P6{mmY~{d|tZKQqEef+f6yjDJ z^iPtqwlJpTW$G=EbpiWIfJZax&*|a|cQ3vA!7T!cY4FZXFTPgVj6xDE;p&cY*Ub&F z)=I9DS;pO@7grG=mZ!IX1Jb8VJx3wZ&ygep(ew|s*ry3=ZL!b#gMA~)d|I-j%UP)Y zi)Grnx5Cv@R_Jq|Hbcq+QB~t%fy+EjEVO=R5~!8Joa{TFC!TrZr|1%#!LV~h?OQ6@ zAn2`}C2c#!p!0;a3eWxFsNnl1DF+C>-;3grZ}!Z9>4Kfg6^ZH9A4|r_o=JFrifd-} z_F?ky!`VD{5!W)BRS@OVYqPuXIBeD7E|gEeD6eeGLq8Rh*AyHww;hUFdf`pfcWgR} z-K%3@kZan8c^^@xw?P>K6Y1mlXJdP&Icak+VSF|3fO1<`Q^}m(W|Goi9~-=bNFe_~ z1PPCVz$@8B?H3$YV$jCT#6qzOcu&nC%RJVGI1h~ zSIv4E0qbXb9%bzitB~Hp_l3t48YiEy(fi}sF7HwZK8W+YP@eVL=Nhm(?3D7jXDao2 z!T6S4*%SYj0-KCrf6dtVnNRT@Qu`bH`u`OC3ZLnqU)yOIo2AM+)Cey)dS&0a^E~wyo-Z5BwUCV9z_f{! zCoRudi!*&w4*hh&l$zJchvS=T8wica$q|B|Z*{d1%fEGmb|=k98+@fXY7$)FqF!!8T?xtMlAl2{Wghg#Yxvsw0`JaphXJ!CG654y9SA0n&@?m8!7c*R>vImVS)70(Y+#M?zt}D) z> +yv|6E`_j>YNEB1=maaprJU;QvWa1SGn0(c$BN%oY!2SUS504rul6;CUtl}X? z_CG>fHVb4YWjhd&4^m!6Kh+|S=Vv)S@H1C?R`+Hi30qO_ly*Q)*I#p3xVg2zbffy8d&g5`?=4z0^bHf4AMf_J{Q7VC_5XA7?`6@H31G4;p%u z-j8QJh~dcyNtHD0Jfl%kJUl1HoY9Eq;o%v_PvWTV^K2m_r8W020gmV4Uqc?5|L%{9 bhXv-PK3X(=MY$aQ2+xkKTB^w^`%e8Ic1I?; diff --git a/release-0.19.0/docs/design/clustering/dynamic.seqdiag b/release-0.19.0/docs/design/clustering/dynamic.seqdiag deleted file mode 100644 index 95bb395e886..00000000000 --- a/release-0.19.0/docs/design/clustering/dynamic.seqdiag +++ /dev/null @@ -1,24 +0,0 @@ -seqdiag { - activation = none; - - - user[label = "Admin User"]; - bootstrap[label = "Bootstrap API\nEndpoint"]; - master; - kubelet[stacked]; - - user -> bootstrap [label="createCluster", return="cluster ID"]; - user <-- bootstrap [label="returns\n- bootstrap-cluster-uri"]; - - user ->> master [label="start\n- bootstrap-cluster-uri"]; - master => bootstrap [label="setMaster\n- master-location\n- master-ca"]; - - user ->> kubelet [label="start\n- bootstrap-cluster-uri"]; - kubelet => bootstrap [label="get-master", return="returns\n- master-location\n- master-ca"]; - kubelet ->> master [label="signCert\n- unsigned-kubelet-cert", return="retuns\n- kubelet-cert"]; - user => master [label="getSignRequests"]; - user => master [label="approveSignRequests"]; - kubelet <<-- master [label="returns\n- kubelet-cert"]; - - kubelet => master [label="register\n- kubelet-location"] -} diff --git a/release-0.19.0/docs/design/clustering/static.png b/release-0.19.0/docs/design/clustering/static.png deleted file mode 100644 index bcdeca7e6f56222e00e8e6f23d9ea1ef3bf23a34..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 36583 zcmeFZc{rBq-#01^git9eLnu;0C^M1LV5*d4E<%|y&l*IQA{3dT0V$E8+f1c0g`|kv zJY**G%=@`$t=9AG=lx?p$3FHx-hDid^;^G{%6(nubza}^_cNWo>Z(fXXtvT&P*AKp zc2w~c1;xsP6cm*0)Rg#6`oc&n1%-doF-3U|r^tauXE%+`x~aw4&p}$L6|boeUrnf? zVPSGV^X)Hfv!e$!7-`SG*nDMu!s-SZ>U5gTE3TiKoRN+#BywjxC|Q~ zrO6fe{}|V!EyOSB*0NGi9Q5bBzLJ8Xc;60dd{4rA6+H#T_M&@l@drCtHi%PDTw^^% zNku_%@8bV~e@V8HDrR?ZiBq0lqtew5VU_BxvesQ(9%Eb{F*l~J|D_YaQAo0AEW(Xn zvn+0HI87aRbO*cJuXit#vUju41^KdH@HX5LTvEj0=~ka^_E`PsWb4?f;iv0|S8n>i zpuxIknA;|U(u7PhWLdXvUEtAY`UM`c(Sk~z_Zo~@j_?H6<+(b#ySpDd<~w({TlRSp zmq$AH@+U|7b0}GAwwROI#jRWX1oK&Z6`fYF;?us>*6KU8-U>1HC1vbrr1~!NA>ar; zicwCz^+SMJILSgg#F*?*F<#jDqm^`#Ofn14bDb2}z5A;>zYY$cD0K6&9^!B-sX6|-6Q6`5M6X-?bok1Rfn0U-SX`uaj}C#9+Nq( z*5W=vJ%yatZyq68@NV!m66Ra%`{16GOA*7o^yx1A!6hACT?KO^WmTpc6NM$=k#j=# zHqKj1Sl^C{89psVCPhRfqN$=t>Yr6yL& zE#{I)6HfzV&y&oxq}glTO{qde!Y=XJbauK-1xDL#+q%_dymzM;^(so)=*qtFpC5|! zsfM4@E?xb%5_ZMtO6GtfrMp`@CueP+a|~j=8s_HMC(Ox~=H}*>mJ`!%SOiAuj)vLw zfA1*zzx?N|E9}xDG+9apRta?Jz4YNAleEvD-{7n0;o-p(9M~mj(>WQmr^uOQX(PRR z_ce(_Rp1o&g6*xX8CQD@*%%)WZNQ2KmuT$%p0eU&c>%W=2YLOisp~XtR8)c047`i> zA@NrS;&14vw6w6tnUx-NOfutk@=*v~FQ+a)*J7}*o|-eLZ86^X!pMN>A zCY$bR&fUSA3Ke*!H>Tb(f6&rbPdd(BWb8G&b@Q>7nB6%;USjHY%a1Ofde}*tJz#d; zLv34Ye&0aQ+j;FArdisVGsePOIK4J9MsZZiG8}yLV8~6B2T%FSWiKU4<|CoGf$l7p zuCA27KK7JG2PIkYWREViU-C9Ae)*J?p1$g)d~_wRU=`2HtJwjAa=*kDno~W+^cz}^ z)sDWH|9D(e@2HWLW&4ZnQrT<$&&n;V)Wk&_q)mJTRhgNKyJsY~`cyYZo#WpeP_(Y_ zULWm@n=G?Oe&^v?D__O;Sp&mPZNr(>o5)Ey7d$7$GbWu27@xd(GyaZ>Be(03tDf8N z;i`#}OVRvgmrYGgGg#8i$Dbz>Uv>)-^D3PMd-v|O{rTC<%&bIKW2@qrjhbCaLCxK} zckS)%@$U-lQ_}2Krl!^wIRcVZAF1oQqOix>ho4oOWwFdJ93Xcs1U~JEIK=CDyyI?v zdE}yG_S8bPrAS@cuKKuD`L8)n`dW~Oopea=N@$;Di}W9B@nTf)u6lCVPav~}(pk5o zw6ru>RWczq_G2o)iSS2f$FfIfuBzT0NV`*IDZ;6E`0&T*g|YbNg^3J>+wKb~_qAQ5 zADvc}=&VxWu%}mRGGqC)QB69H{~dvO{y85 z=XDjSd(}PelBYM+Q4+lJ`nBdExgBzrYCD3Dgqxj@|s?0 zX9(zI{`#(|zi!P<1?sGqD3%5D16C%FoPW-Y_a$ex(S#<;`I`%0l4e(%(7tY(qiX8l zRXp3*+e=rtOF&@4N!nNO!n+%*w~1NO-BQSL7}&c1^0$ZkE_Q@qf5}ECKYxC7AtN?+ zr<|O=tTZcqS&O`C@Q_5D*_xa0!o$N&MSF*xE~K3E@W?l05q9U}C%!&cR))qi%}xyL zIlU#IsQTNt`z1zCs-EY%X%$U!Oq-O|Dd&IJID6Le$Lm&K-bd7HZem#-o829EF{L&- zI(*gAdEGv9V^Bh4xAkI3iBbN@gXI2(ERoHAw+dVH-DhXq@-_9{$H%JGI3(>%&CGg2 z_G)*ywwYlEElhWXhJ>g-6ngylu{`xY$H9gy+b$Z;%a<=#NRNL0^y!l_&*%V_|Nd#! zEz(ZEGOxDd7R<>ZSMMEL?Y2}Hn~qW67N6}n`5N35a)-WohMYK2GU0> zq^!EXJl4*z95}bOh_fZA`}mFxw9EoJuMOT^Td@*F{`*VKReibTmUBzeT z{(4U#Je02Is*;)P#zWnE2zil5j5)P{fb|jPL zJv_Mrr~334UCQ^@>R{9%UIh!XUfLxUclY@StNbhrGU?#Xm8;&lM|l>N!kMQ;kC&8Q4=E8)mqoPo&4oWOpcaI7#PU zsZGLu5t3@%s35&C)y}Nv)QZm?tu0vCAErDr@4>Z0^9QMM@KsDg!m&9Mug_s3MO~xi z5BEJyNx3>X*m&m5nX-_*qtkBJ4;s{^8sn>Z>XX=D!Qw*7#Uh>!zH2w~%>D9_yC0D^ zQGZ2Edf1EcNo;IvcD4&PwGzEx)HnyXIsi5y|5C!zUcvBZm!fqV8`ob>GK>&1d}auEbwD1g3Kx^ zMn^_!lJytM^cRF()10LBPM#e0)1P}16VsAX#IB8zWf#+iBxymxJ#0xb&bxQ& zY31r%EIbuG>(s*R5V8Gq<-E}n1vdN5w@}GVbp)%uc=>W&p%Y$g;(Ad)*K!{5XXT?} zQh59Y@6VH}?zh)h($dmK$=(bP-x^)nm5Ub_J?ZdJQ(ot>%~~rQEEL(3P%KYvXDk+Y zU80+ZnQ!OLomK_&4*Z*4C+bWDbNYoVp8TXClhT@LI*wI3tQR)_ffv|o?M4sW_2&q& zp)2~c^*cj#E|5w6L%ts`;KezU98}U#CRpIs=F2O)I5&zqnUrMNSMzEkuPVkbb}5H` ztW@8N(?`|U-#tR??+1G{J$}8Tx^?T80(C$UchTNXE3N#M>FMciqY=&h)$sw0ZIQMW z&ONcAfBp5>#9*T<3P~};UBSFDwD%ztiHQoV!}xd2$^N=(%QOR_bGo_~S~c;}9$W7o zx%niMNJx}b|5Fcq%$`>Cw;v+X_*!ID9fouHr%oQm@D^2WxU*u~slnOG|-26p~F))3%!=aSQ6R@2P!_-!v~e)iz9coVrsgc~d;YSZ=sO}|chYvN@o!GE zAiv?3Q=$}83}xgJ6ih}}D;I0N-zDEsz~Md?i1s`2>dr=1i-Ica4xO#b=vCnf;1nnbPC`{Sthm$0F#Ozj%8(G~4+(+`f9T=0!# zy+3s4oq;ue58sVAU{RlDq9(-RHaA>^0+nZ8mpU^u!zSgR<2H=Bp^mk_p@G#`vE!?7 z9aT%DoNk`WIB&EY*HEOa`^-pZS#s`3X_$z~U{fBsZ(Mftv&h9ych+0T?5Zdj>ExXZ zJ03eT*2As8&E}?qh_U#Gbfr*3meifo*?mc~6L{xC3+6udjiWuFpHOkQ{X&n^%Cd=V z80mf*kdHRhSf_Qzz0_lmsf9(OzE?j!q-#{=p-?Naxv^2ce*MZ7ACC8_{>>FEA)tl* z@JHro+X@MyoyfS@khX3)QlMw*QBGl_*P4&<&))DkiKx+5&6wzgI~g9xLvE~YEk6R zhNdjjmzWkJsJ}oob##sFw7=q{&EB}rPGC8(19Eev1Bz@>d=_!B#3G`CNnt`o9dgdo z(;5^I5D2OE8_}=R8UIztP%zczm!NUEBxvVj_3ob$Rsz^$&Icy~+Zn6bb)W3b($BOu z6k=hOb<5-*Y4n&KK&!3pJ{HapFPyWlQ_x82tZW_aA5F2Y8y?$hZ zY}IUCxDI1|*Qm_+x6`O!HbTx7krEyS1#xkogzgv!Wf~T)iT`z0UH#XmZC3c3eiuqw zVw4qD+qZYm9x|Zwm&b?jr1`u| z&CR7}x}O4U?|u-z@8YNax-@i^@BNd}7+z0Tq)A1ThwtyhXnQpF6b82|HHm0lw9!;d zotFjgrzL*siH}~GELfD;;QKuOm+<|l;0I`|!fHV)b%3>#x?7dMmC0Y>^b$EK80vw| zh)H}Tz*tvT7X`YqGN7ov)jBgNDG3vtX0l$1k?>}}!%wUFxkJS+U%5iQJ6~HQX-ubB~07HJ? z_m{QIlaY*aRDo%kcSg@L(%droIiPskt%y;f_)Rz_erdLX$~@!b16*Fa`1pEQ?z*g( zqdGh>q){PI{QP-x^5nD|%D$>1#@BQFA*%76k4udeJ6vxwaxu|h*zq5dvq=bdh+u1r zz8W2Q%Lco5acFTN8MpuD&6`6$^ba!n`ufz+qcN6wOqb~oq8p&6{^jS_xJ6T=WkKar zO4_fOx!Ld%qmFPkuDW>) zGE6z)veM*pP0Ibqa$`!=pl zi|J2Xi}p>S9a0aCwFa6FO-wITUllp#@Uev99@V6eYgcs@2v9+r(Zt{8RzF=mWQG9_T zwj!Kfx$K4S76bi-c33ag4CW>18Yb@1?=>n@9qgIGbq=I1%CtCk%xf}-Dr#zyb{w^- zkZq>w)3m(Y29=EF&~QiJP5vm6(u+Cc9>;Rp(6Q=MH{sWs)0-FCOREkx^`-oo{2$;TIIC z*7CK-4xL9bDkQXaQx<8^Hiz~>2aR*%gSfajWuA7OL#I3Hg9UGMsNCiV-R?1VJiZ!5 zr{b2WO7-WD`brgn$u-&8*>;kzX3yR4aG>lOozB%GDlGQDu@)e#r)})P-3+Vlg-JYuQpQ2OuY#MNBjDI8`uE#+Sb_CV}QP*9M8(8JJBUOAPYr9E_QO3ZCV zJ8yH`O>O68q5IT6jAcByUC7|=wS(JZX1o0r*=AcCSmpe|gY763!b1YPCb$M2jBZU~ zt2IyX@U$CHn@35Mh-_-Rd_ENbex!JyVLHC=?CktleHU&tCT2SmP08e!2FXDAIo1mw z0$ds8>fiW9+eyw7j08<&HACoAmA?kNI=;;I`2_3R3{VO2Wo#7Z^eSo}Mp6B!qpp5W zHGW+o0Jg6pS8xd??#TDnj{%_{xs8-a4A+FI$acv_tL0x0xqqLDi3ucFL38x{T5;Yb znzntzhX99)%2Vggbq_mvGjIsFrkzS)nz#1(EQ_0q%#g5=x^63bcY1z7eb){X=Q$5g zdHL&eQ+*?k*~409-DJf$jFiByiLrGJh0HPbPtLl_>RY-~@_5k8EUjH$$73L*YSE`v z-JkAmyK?z5Aek&0&(0GeUl<%s`;$3To2;G1JKZRG<=z#GsdIW&cG0f6S&RjLHYAVD6GGk<2y6(2W%GS%B$I7jjv)nFn zatR`ev$6{r9K?Jf%|7Xp_gMY5hq!L!`0B=HwXnjqk+$^O`PWM|-?;6}oNGKyZAf+y zV!8A2!aIXsC-i4d?P4l@ET%pjJ@k0Q;#&{*0UJXaWk$L4>*Y}N>m|x9gguO&8i}(` zxa0wZBxv-GR>}!tO4t`Nzsuccjw5pA6-O@#l?8qC4Go~Cr&Z7U&wqDU*X`7JAY+lL^j1gDw&Dm;6ik)oGUXlS ziU;?UrH+h@fMV(Q*~q3)e5UpO)A$ytuFnGE(WMQnssuA%k=C#AOjl~U^PW`<-XAoi zk<&Sqp%)8i+vPfI<}?qqDbcnmakmx882uXejInh(La4%>@V5Aua6pTJp3U*VCf&%VwYED;c;ehr})B>O8QkUo0)+W z0~GJEJ742S9_@c??85G$B24+#m0j4YEb|dKdqMaa>jkQLY zTN8~8Nr7eZ5pjGOcAJ@*W-fdt4WR7d-KAcIMaH`v{eh?I|-uODdWf*c0uw$vMe|A7DIZ{n$V1u~Ub=q4B#1rG%qe>Y+ zdvB6+QZHS%qar?stt|Dtw)U+)<_HPO&JW2qr>?$=oU&(>vkY!z;PtYmksIOS7-4$B zUuGtK)aNs|t?69s)Be%;Cl>riWXY(9_^LQ8+c3RV!h9ptIGbBlq}@KszL9qCj`2nI ztIXcMV?oBEzIf3K^q4c4-M4k?RvXc~Wgc6jXd-pOrDpkG)b`nHPev$G#s?R*8zvkX zV<9w(09xb8!p_dllEbI4W~oZ*Z!$DX`F?`($<57u>MwabPTYkd!6Y&`exyK^p4an9 z|M=>tb?Iz<`K&yrpG%aI26Un+Z!T+7NjuX-C9HcBX$KySuQsNf9LyOyd-iNam`FT{ zbU-=HcG(uY6FaMOO(WYLsbl1k%_-PSI}>sd@_p!={M z5TszGTvELx-j(;!ZuR*nd1LlsM=>5^>*?r2k$gfiR7(PrPDN)Q?awj%Zm@PAZ4gAu zmLr2Y`oDgiQ?mAK_(kVf)jImDi!1IeA@|X=@pfhI&M;t;ALzbb?aL=bC{#D51^czTA-=}AK5x0KL>W&dvkKo|((aTWXRlftsXE5E^s5gH_o@jI z_Mqm;clK*Hh(~pEUW2Sd{9xirPe1?j@!ebE)OByrK;P|V-__jx$Va4(X9$bC; zxqv)n{KkJirbCp_dB2>|u-3h?N|o1zdU>^|cH?@Am|mzVUzaC@#19NE-h3LNF@zeN z?StFcVeRte5XJKSs=s4;apKu>uhC<@*szGWHGR9ij0hAQ?3ZJ(u-HT7E&p}d@ zi!}SEv-I1>VwP@9!}`rdnlte$Rj-G|@m;y3mkj2Dnpo@Fz6a4xa~=f^zH`Y-EwgTt zn$t}-8br1$ImdAbkIfnckz+$aL%-kbvEjo8e=%Y?#^`X1?}7*Q2>x9!ELftWPchE& z$-u3SIn7=t@UNhVM!N_k18|>O*|lf)?)t8U6%^vzu~sLqS0Cch1Iu2YZQnQ6Q!V9j zBZa@Leb~G{y$6HWMg`P-e0{h8`p7jgH+L>jiG95S|M~P?Of+vuq>3mhu`p#lyQ;&X zIySz|L(RZ#V49&vY-gP6QS%HB4Xyq0L)>lZSAguyE*3g(g~wnNnrzDUD%`%iO-vS) zAFwI#+VN-4QhZ9bzfLmRCfL{wx$a1qFj0t z011JhAh|QqtmQ;&WPFmJ?*T3V^8$yOchU*ps+5cu{?8T z(m6F%%XnZx-6=_P#Psh9QzEk+D(91}=NZ1DW1O)PD zdS7B!=1;sy#-8%uB610=T8|wumJ8d1jSev`j}WthCjq)#Fq;)#MvIP0%_oTV zw(F`Lq91gg+5FX_UPa20o? zwc*f2sAO}2z`%=}-84%(`8rLU`kQtXxZa(nUA0|0ztY?1XB*C??`7^EcL^?eR@+ye zFRfWbRXXoS&u73}R6U-DOD|{^e0i#Y{w;$EZc{LFE=TPx-N99cLTbbebXTWt+Tuv*Njwr^kXLc zDP3T~13bo_K0f4QS(kd4It7GWwW^c_gfz$>&>sTFNhZ zE=Ifb@=d!#QtFS3;|VAlh4SE#FBbN>j-;!u{&ws8#={IW%Z>M{gCID;x1+w0i6lTD zLbW$H&u#l_4^cBgm(gtz?zqVy`^zQo`}gnhk6e0ZhYAF}SRksRctgYa0HjhaYC%qV zPJB6`!Em_t@5{;<@2g!L2`xx`@nXa!53k=N5t9mtQGMesVEjd#ezl-h!a@`sEx2Gi zBY(CYKRMyd%d>fSms6kXX=tQ_lms#4n4h7(%P9OOUNA>U2tP=9MkO1v)I#r^rJ$&9 zJx_G5r0NA1>JA!<2TNas$d_r|`rbh3$JOs*WYR21W(iVs6ZV1{u}6^@9M_E_qN^bBFS0 zp*G&*JhXeyo^^%4oTP;ZwgK)#5V7aX!lxGWXQyHQ1L$vce0-K9+!1B|uM zELiC|TI(X*vgtFoEPeJ;;k4ZG^7IIk$;3RH&p~6^4m#ITswCYU$i4?Q_$F#+fUOh| z6hsdM<(Qe7>GbihP0$ouu}Ubi=43DzV4+Lz^93I5c;q^`1*$1_Lg-%Ykomht>ngJ% zL#1CvxSI=6{yPdBZCq_bPDdb0O>9~kKw*P*=H=_Xc44*(SaVbBQC`bz?xA5c5< zC>&UQKE!^N>`Dro)mWqFZ+og9@V&0^VR>dP&RQA-y29%mgk~_Z9%EHX&7O<%E2-%3 zOH_l>rCPW3Te7}fbY+HJ&#AD9P0Y;6T4_A2^sds6lzBuf8!`zal@bJ+eMPLc-%ctu z;zCA*z&VmTwd;y_PG|2)%6#(VNgHvE#LtIbjBTI``5Nr{z=}y8x%tX4k*?mC$(xlf zPe$DF!R&tmYF3!ZqrfaD-tXdZ)Q^d=8I|;%LO%K)=LdlWJ$QqH=}N}GqnYU(`5;=Z zm*=uG_!wlp(P?N(FI~ZGpGbf8g=Zn{1#h3;NQ$@Ns+;ey-^mVm(LFpCR)qd~pyFi1 z^(Hg(oWTCtk9h-DvCZ6GbAcCA&cP^Wto8KB-I-PfPw~s&c1_3ne;42U)eBX&_Z;Q~rGKze|`sJR$<6OVQc) zhpDK`Xt~%T)Y*Fp5xEVAa|Wb*Ibt@Vhn{@*-9KJ0Ue$%#=?v@14i1fgqSKn1nx{?) zqbTy)2lojL*>-y^O*_{jKS^3&)9&c(+^bFM&zo%0er+Hxy0zR$*e0cu`|@_?Yh@|^ zF(=f2R{6419u+ zWTp254&CyEg;JdESGGNOS*k2VPqcEmUvF1phESk}^Oog^WK?8*!XYCg#zPt#YT0wt%>bhjatr+{KlwFeEhAiH# z<1TR0w4pwtP+t1>{3Kx|Jys|L1}iF{EKJ#(tW<14VZC;FxIW!QKv8%JQOcYjb6_OYw>R*To!5_F4!5K-l;MPc-NEUBEy z6fd;I$5_)e?R5IusLFF$_-;;rYFX;gDvE=&crmM1#w$6xQs?R=8?xAl5393sG~E6D z3_(n^IM*iR$gE;&y0`qzYmrA*|93az|GeXW*R=nV*!iDj{eOxt`n~jSKhS`e;KEy=-x-Xe3bFT%SW<^CyQ&rWI}k5 z_%{b1HYe=-HruL2qlzvGZ|Q2SSP7ACcBU^`ia{~y=~CVNn<})wLIc{|NH_~NnASp{ zf|1fa?lWVc9wwX?xL0TJzigB_wfh0^SD1{egEYH7j4De+nWVVf$}z+LK(ieg=?p9} zvdkGEfpQ5A6@%XZRL~6gAHq9tYdd<2S?`>N#u$7L(69)!nw&Qg&iEuT(Y*ghio$J0 zuHjU03A&#B1>Mu9xWGElIHnA$D%u1 zxQEg$q?l;Nd#a0s?!eN-ylGP%iH&-d$4GEAHRlH34?sb=P#aM3jD^E~vt)rs6=e@Z zsVZ>=LYwotedK9fqfN2ya_{R9-EE!3&8zJ9*Ix^uRTf~@;DB<8Iq>}X^InX2?5FrZ zb(l9aG~^n*y8(QbcrN8aS49-;N*gRVlF94#6~BMv&p}OLJr#4KZ-YjQ9YK}xt55dT zTEPkeN8>hOquUl_x!JnP4$W=bw!M7$QlVZrJ;dG{RV!4 zCr@-V!q}HP{Aq7SLlB}iF5Qp8N>Ow2ml3ushddSkI9P)XfyBTfq=By5e`WI_x-7rt zk+hH^Sz9cXAo-%~z8=HARf#;t&>PGDrlw3F%a>c{URg=u;*GI7ab>)Z&Mu?cBwaM#C|JH$_!-V>x4hD( zFI8<>(|DI-`?leg_KDoj+0^n>qb3=__Xz63U7bqBtfoVgaHxx5e1EJqvK&-4#2HdUbNrKjs@*{)J1JUjzh5TO z?HFCD>tAiSkRj3XbYk*H#bmT&g_!r zRBA@(Y)_`x^bpwDCO}Ha8izYu9^Y76#xEi|wBONRZ6ktpF}rN>UQf3Mmj9&)Q;4y1 zUQ=6J+q_IoYNCdNN6Yn{LOg#+*__wE!)jt3O``i z{RM6=0FC0xx;ocj257nPFFyi}fxN-h8ZDFkVq!qO>$V+$JsN-bF-Tq;trkTt&Ph4^ z65mJQ#Cd1ZjT@8&&5MU+E zB5=)96PX4E*{QdE<7YKB;ZG-wWZ0?RhIS3)M>4M9q};lq9K++ZV3WYr&(C$qc}{nR zVt0et62gyLoQ__chR06^{|$Lidb6L(Bk4M!J9y;@`~)l3YYSJ{&TKUAH`B}f&7-f4 z+*VQ@_@7ChhmHO`YL0L$U}RH+=N~Zy+ra=uE_hd6K^Y+rkycz>^GZ9~W5z5iBWEZd zwI{Z^2isN0vC$rJuSdIIB_^`s%0LWodp(qP9s!*Lhy4OPOGAY3c;)qjJ2q@NV15oZ zQaJ1(nDTEHQ4wJepyfV6pVmFK%f~Dn z%rlDn;`d~a{jliUN$Q?E_fVOKu;JF%pV#t1JqjMGg4Yg!+b*Z@UaV}P5XL?W@}^Cj zUY>mw#BA`O+#0$BJGO(B$7sZGdr{Ga6kOUUTzw%N1^>7tw_Fe(``73$SeDw6d97Rh z(nbrbcaR2pzQ#hV$btD0EdoUeK={sT+Rc$3Gd*F-KfN}pvWQ#9H2B);QW4&U;5{>& znVF?(tzPqAfnuU?8+8pXR(Ry4;rT-WD)e55w_&zK&7*B}8Y*Z$o_~ps#osw=QWQOb{*zzLD8}-BA`kpl%YT^IRGrE^AxJ10HVD-&+s_ZcG+;b1md6q$hLNqIm ziSsHS_A&P8>|Lps9C}}s_V2Cd>1g{%`BAE%edp+OKYx_;Sr4z$rX!ck>uPgD7fYqm zHtsJJ>WDqhaD3tt`9Np~CB@`LHhE}&@zwJEoTg&UU&i;;l+ly=S0A64{*g5FnySOm z%CS!1-+Um%s$+RR2kCbe*FVg42vNQn8K7vRCvOxr{5k(L_3+mdf>BpLZK=r8FcEM6LL2f12x@2J7|Z2Psqd2HGaCOop-AHOYA4 z&XRHmZBkD4-^0uvw0-!Bz@`L59&PNp*y)!xN^4RQYL{bG^&l_yR01ps)1zIG6XCej z@;`3ZszgO$dT6z#6eMW7t2Cdd2kfL%cGZqJ4Q6!_ZkKcX6XjMOws^M0)<1c&YOpaU zlwT|8cr4}hw{0K&j9(x;^Pi_5muc9AL-t-VHN|)Xp9z}Yk&`D+Ub)hTzzbA3h+(1* z{pXfKf}rrKpusD#J1bIOg^9lSih{UOTjY##>?t7IV?4nXAK4|FBP__Ua#%@5$+q7S z0sg!wp&(`ZQ(5*a8{=s&f~+6}LZ@DPNdpFX-gSl}UOfmGEn;+lbVg9|u(?=WzI;B_ zs01`M%wRB8whvEz@ZAV^@I~?jC|Xr$Znz-7kML;vST?mdCpYB^dGFug8^;2%}vT+RbjWD**Q zB^p0mTB_JmFzmR^kJl2z7v~4COM9wSnwYYe8x*Lg=wp)@=U`=tJ3exGj4fjy-9n?m0_t_F`O?5_OHVYH(`@jEe6;vzwgFuxegF48#%K-pF;5g^$8x6h#*ADhx8t zH6wT*D~yC0WXA3>UO=}h^kImWae%-mKUe~aU=KCkMua<#prV1gC2~k3E)!6CK@iT*4|&SLn1)eE-1S84sXAS|e^kpM zyaK;k3p+cm>ogwH6FgJjmGZHDc!_i^fyoa>SxaISwvo8?IBa-_xG>uLi_<=uVgv z;>?b41tPoVCy;Flv2)~vO-6~)*DX@kA=BMX#KIu}^v>XmmZUiJZ`kRhhRU5mzXOp} zjI+~!t#$I$q_6LdK={F^Xs{&7OYY(qD9!^3re@ z4M#JptjMP(@W-YkC1%ak!H&x`BaPE9UM3-qr-4@-F-rs?FjvrUe$ZbS37wmBD@z4& z8wZzyIyI;jHLy?zw$#q{Nk4Ns6V15Wsd97#(M1u&a3-htqf8Nln%_R{2p}m z+0{?qc~v7H!dSIukLIiM_Pq)5m=8Cyi)a34I^I+(M2CCw3kQo%h1TtHSQ8doZZc$l z&G6^;GS-6KZ0c7lM3V;CHL$QpmSYiRvA0v@*s2OwZBl-GS;-@&dg1sNc>NGr1!&k| z-MuPa=(XC&)(@ESklRm99dRs}Z3Jc@&`ST2)$rxSi?1F6Pi+ZYD&{_8*Qm5&yU!U- zP4I9;q0>vba7#xlLU=Dd7pCx&EmiH;YPpOA=%QNAhjbrJ+PTBa2@@l3?G__O76bt| zuzh+6qYg0^6X0Qt@z;xkyd4|{XnncYHwX!-j6$ZVMQ~!T7Yp(jn)xG}st(xXSH9cs z@(>jpx+oN^pTTjc}cfkP}On~0t?|H`XBE7|8T?A|6h1Hwl+Q?LU5aK zDz0bPsJvcb^=~0&O55YvJwb_pqC=(h6zYoD!5hS7vVR;h2)`s5r5az26r3w0Z42^< zs)^=EL7W*Whc`;K%xXtk2GBzO!c3pdwdaisCA~I(0~F#F8cq65W#<8*N4UqkB}~nG zOzVe*Ni05)Y{IN`A?3&1G%+s0RMS5?P2~TwJUbZw9;Vkuoel82z=3oLFn(7Q(pM(!)|1cw1sBL@12&=^uJa-fOAcwu2?w)U379?hgkm>Mj| znDqsjKFmQ-vay$uui}!mXV$w3F-)x%qEMj zv-dXs8A1sE;A|via6uqu$7Hw8J(xGZGgXAb>Y<9HR7R6aS=MNXw&gV7VC^eyUa#jb zUPxl#hhc2MRCKr3YyLiXETn+12yq;P&st8){OL=aA6}e!>BR`ThZkfJ$Kq5G(q{71 zSBd!L0ND}KH^PaHJ(`)DmxkkIm*pcnF=4vG)I{hyUPpJ}oQzqwe6)6n(w5J=yb2AS zkEeSsE}-G}jc+Ab5yI#K>lp|e5TsO;E3h|YO1Br>VpT$}T2VM`jED$aM*eWCrxC?L z`rq;(6$Go7Z$PWi+=`S!Am<;4n9A9f4oi%|NZO9Ut2fzGtwcTib|r(jvo=?tkV+an z3QRNzxU+mhY?XhHwF0$7&GG5Iy#MmzNDoO4r1`uRx}(f;_k;WltZ|B8hL zo5-cl-BnMkd&a<681?=n^!RYdMoS*C2p*}XPj|N10@C1Afd4RHUHz&2XYj!Y`WewN zM12Y5Am{YUpe*%$>n~*fb}pnHrwU!>khjP0`_OV^WMw&qS9h{SM#)E6qf-x}qYF%{ zo>+_XdqI=;HY75}dU=v8bl6JDJi*6f@pA|_*uTf3FUMM-H4z*qk?t02v3)14Jj7&+^rE_)mPAc1wxaGM_KF9KEU z2u#m5X{L47(D3o7ezhpl!vHZk{I1(dtt6Jk?WOhz6RzD`J|Q^KT5iB+s(Y0!=S<`Y zVeyDM(q6d@C1e}d>4VdK4ymFhi%(w7mZ$PNGgzz}EMnpW0{`7f8^14k%h-zOCG~vY zIUD3qY8TCymFjEym!~EQSgxfI|4cBXa&KK&6WMPla;4xJ3DT;EpSg|cZ09L%fMcO8Kh-NASL zhTr_kvX?g)ESnpxe^EQEn0JfXQ{(pPYgVkQnmCR+g31Al{>X_67n_PtVai7wzPXRT z)R#ddx~npp!|!8iL10>#w0S{u0iYf1N=S>S_FC5kG&VOWp4C-vvLciC*Qq{|mSCiQ zom%qS83rSAq%BlgoHP(z2V@Gl6tgHQh0S4oG6_}=1Wg#*9$xgv_>SLO$^|uR2|P1M8zxkWc9iVsYAZO3*jMP4bpw6}(Fn2=4`^Gzit5=7yAK7Sbooib~k^Y;mAPRek zaV*&`H5kwZ)3-7YB9zlhZnK}D{~ZT)I2Bb?%Ha&z;`b3IC24jJ8JDr&ejLOrbmLV1 z!)Xlz9Y>IAp7uv>M#jVnE*k(Ahd2AWOgrt*-(oB=O3lr614BvJ%0ON0^15Br&Q{O^ znt(W`V4G#8A$}97nAeHxw|bvEcdq!J3hzJFve)DgN7$3`sT7h$?YD2N2*(0awHE~} zb_#m(71*`k6;q9p{7xE>ah+fVuMNC})R3Hm28i$>r;wwRRyzTN1n=8g@z-3n z0&$*V;fiHKRQ))_6?}*^d#GHv1sRSb<;q8q++N4$DBue}l7AQ{BFuvDNVAC8_4QV2 z{Qrg6R6uoYlu*=SfbwuuORElPg*}yr0Y;}O)A&yaP(~h)#la~V`Qxvk3Y&d>hRp!W zVgXW&UC z`JAUV2Sik=|K#9vg+IvJ3wyTot60`FG?9hyt6*DeP97}XxsU$r zTuZSc95l<5$x;^=J-CD~55wO!%2F+gDE=Yv75Z?q@@)Oa1i3A8l*!`vcB3@E)ByHG*SL0yyLrK5SHjShweN z!Z)CQ@X_!q!;y+pCwA3pY{L<0*q9DDXB+`AQcV3W4X9f7U zw7(!2u#4%%t5-N1XynwS&BJv3Mx0XM(GNsadUuw*ippI>7Qz!q_0#<9sZ(u<2Wkh4 zN@Ood91EY{n;N>_EJLhLf|+g&dERay|FC9s1M80Hx99lrM=xmAfR7-KPVwKm|F}oO z#r=cVhF97VmcED+W?3r{EIClir5J*f!mx_o-fN~`@bB3ZvG1a{a{Gku(urX*hbX%U z3=E!)u*KCXa2Lwje7LYr;+|mF?Tlql99ViaL^+|g`73fMy{|K(khspLF;L7f);-5` zWcLFX_!>_qFs*G^zY}jKj460KFPVXxNiE8S6%zs;&aSbph_#`iBQWT1fIJ&PSyomS z0sii>9J^`8|Hcy+hY7L%=V8_*gs_sxv4mbo>blLfhYP#GW=a(L>eDL143Cpat}8c2 z`Z7{{Df@Z;`QY2&q|>}It8&@>ca5y8Y9Idg{W~0m;0+6pH3C2ARA;t7{iiHnR`Pp5 zWN?Dk>Tm@*!P=gj^)nnZyC3P>tKfvyOW65$-*fY82{jHfDhnz(|B#GTfc)tPnQBVf6*lUhdj+e!afQQ&A)O> zgpp2z$OBC->#z)ek~;*2^6!8U;g*7hE$Io=U>LgpajdBm1ujnA{=)L&Z}<2jLO|e6 zL>@>6To?EC>YIPOaYUx*-vOawGvd(5n3umTSAR@1#P#rLL_MUuxy&pqt&aSX8;1e6 zakOPD=1(9B)}4P_@Q^Pd&ZX?$z3g-N6H@|fMZ|=7|4wtkc@L>norqaA5?lt5;2#^I z0bG0k&RxL_^ncW{O5k8h*j64!tG62SB_QUwTYjlfuplUn}C^_g*@F@Hs>7F^W(@Pu&u6Z#w$m&?ZRiDCM znJ;HrwUjovSN;5LmOsQ|I~N@9L~x=|0p~pmD!a;vSkv021H90>>q!>jKSA{Z+n9&* zWH8i{kvDiON%{5+u@4W?xxg91@`>nOu&=|@($Ay*-|)rJL~yQggx;luGLbr3(l<^} z+L$+SI^1WJRdX^RvbQ0swIqk5a2Vav!Ym^-YnB%KJ|cSdzca=a4A{*6%3nv31gYO4 zQsMj4zIe0_Ub%f%n0{I4P_0WvRg!C6O&PWbykCwfR$O9}Z-lthTgvoM`J2&J$2#Ls z<7QuO)+Ka{tQ~u1Lkp}zh4%`5vjbLBSa)1lvaR-fYhW`t#)xctdSJrCTI6=} zf_c^GS5bNtG}oQ7Z0|qYbTK^67BLfu3Ybe^G#Htk|JG{5_6KbL<_g&Z;&Im8qe*_k z8IzNmY6Eqcu-^-@@FTnjpA#H4###VqBnzddCwX;G@C3J7pOcl|dKYX6)Mw&N|2NLv zr&8TF&i~z zBn5Glr!gEEa30`@h7Ag$Vq(ZpIRUo8Jo8D*Bx+MY5r|C-G7c4}vzJ16*AKIWI-;b} zgoUuIo{W0tFxcP>7!8MX>HQ?6MvxmpN|P`xcYrkbiLpB1$WxMqzUTZncmu)>XcmqL z5phOilw%X07xgWLII||uK>)2j7UUBl{DA?nb0K~I8lq530mi)z;RFNlHfhRr28#R) z^Rw|^m$c4e&NbE|EG?p2*DW2XD_TzE262AW5TGUCIUf<2L^;nw#yye=r!PQ{_4}w? zeW$2h;kLE7+jGxLtkTOEgLRGgtzOBIyzfJkf;f2-&*MaV^&xM%gv3Nqy2AEh1U>_b zM4-5;@9G$KLW-tY*R~voDiX)VVIgtuN4km-M#7RvwZWQy0Gv?WHj1Sw4C9Nq0by$* z>~4s({IzLMg=AkMI#QVu&RkeVK#&mEay|ks!JsIpO-hW3F#v_C>KDPPZXKr{YbrW} z02|0!-9eS4qc?OE|1Qu=adE<}XRHO?6O9nsQEzQB0yf&&b_vGd2mc8IZSywNssX)+ zoD>Xqg1Xl4R+B8CAQG-`oEuu9+SoyB4(|z$9DEZqJ76vUCm_dNC9RIGx2ESRQbHiMWvqJW9=p6P4$?0Ly0bo|rMl;!THAc{k7%cDL!7WyJ9p{QKn<5!hG*ST_#}RUKnp0sxlcyXl^|lDO`VSUt-lkKanjFkl@prXsl?GW zmVbxGp(ersFoTyGLyOk#2Q;fF5qF!Iofj6lQo9=`M*rIkk^(*zr^?pXyFg3CVUsw? z6cj^jYL@(<923o6olGG{>JRP1I03E;Rt1R0WE|xvVasCy1D+Q#0TU_!60mm;%+9@# zF2fO$YDwo(6c#k&OhLmVxeEpr3^o{7P+D8Oi<`9nD}g|&d0N%oJ&*AMR0K?N`{^!% zpR-v6_1-*P;Rqfd#4c>MN!h(GV0S`_TpMB3n=yYSt^DHw18_+g<$H~g_R$?i`Dad@ z`YLcYxFGY7CSdo!+B@@bs`s|-uWA=XQ7IabcAJ!`Qf3Op&QPHck&wvBP(+djqFs?} zw6f4hny_TaT&YZDNM%@tGPEirl%ZvK&hJuo`#$dbexBoa-{XCb<2~;6Z-Zs6-|zdo zuJbz2&oy_UhsAg@9JlOJ3I z18~VQQV%S6tGl=oL0a(4^Z$&Gce|KiEvPIO2J<31*~cv&mCTd8v-v6R4p+vqL@*{6 zu}l+tv11Lu>IMVTB*=XYI4VdgES!5YwbhX}VW_WxsRm3}W*xE@%9Be1KM)&TCzIu10`C1% zq4UDp>EjV|$B9l(;Q|7|1u*uWw~Q@pS;2qx+O<{!vT{8YgGm?UL|GOy|LYyM=X4cQ z-kHFtEQNc5YqyT&_c+8S@f)Wyoj1`W|_2fvRM zcYw!XcMnmOtp*WBTgnDhSlvsQYo2}ThkATW6^u6bgR-pu#t=TUXE z;pdI~oWsYwa?%>si>hW;F=XyK2vGDS;Xvr-u?RcyO6Q#Z62KDU^q1&bMO*bvXD?8R z@#?s-|5NyCW;LGOcoJGM98TRn>(nL1ImYOS_Mh;&ETCrCzpCTJv%DrnqfA2&FtzSh zP2>5iI?W;zQeFP?q-ld3@P!tAfO zT?q)Re>q^Ft#_a68IiOV=2pc$n@2~6+svt~s6orV-Twg4hA$(#^}K<@E79$CsiDEzKUn-B`~5MSQoCx?*f*|*A}nvXWELI`z?4EyCZoVE&}1`k=U%z83nnWj6_!Gx7i0R<^A-bz zNmKZ5+_{rZRTB&Aa!bPzJj`V6V>P{{CD8Pjz$Hu?eSCqKz(3uU8tP}2w)-rVh48#O z=<%o;AXK;D3aWHvX}-H)f2gl@p@dm84=M9|WWT}gW6N}+!I-gluLPe zBWINwm7#&e0dnW-;)QAlbC!dBt{FyJM2HquLdBSB@l4Uk*ZHNpGTl&;Ftl*02QHPD z$AIX7sc98~Q$tyQ2jGbR>+0$Z77M0qSej};|Ay!e$@=v^HDTAkm$p+*(A6hX`U$TG z?)Vge7eW^bTb%dpBdh`ZUU%+9#yWUXrF3gg3r1wUr0Yw^Pe5Y8i*SP4Bfr-e~88m@m6%Q(Ge}JzMAJ+n0;JD~x zsW|wm+s|&eit2&7Z(o!SKh$4*;-#7?=rcgyA2HAW_6js-2>;3pXG}RE+AmpaX?m|G zAHoxy^t6?~%|F}dRlS3M#euOpd95)Li#9vv?ZTuP4la-i2M4-a2)Y68-<6RY@f|OU zHHMM@E)ET}5S~Wq$0qS;f?`aT7=Y`79^&pE#Vnu`NN^O_aeH-g6WF8p?&!veq~qxF z@A5-!gkf@jQ$T)odqav{0SbNkb7*Xi8EaD(OY-#T|ATu(vG=H%W62R zaK^yq4}0iWrFlv!OoD^Out1eBK=*1Tu08IsfV%nVTJ`V`@r5*q?J1dmMyY|?PNa6zOeqsl+s#97cnP^m z|BW?#*lb5B#oAa0W0%HH`P#fRGnL-B4Kdy^r*5BKdXE)TQ$5FA?cG+<+1bXS)Ocqa z{ptImYzk$@3b0p@4i7s~qjN5{;$C*cr;FP=KZVo3Sr$H5tz~HjAb@ZaCkF1M_JIff zVpfHsC95}gjOMtw=;%yxwEx~Ie3zuZN-L;bI!8<`B@QdSSx-7*eJ4s)W6=h1I~dQT zTF7Ldl*$ONJ|Ep0rzW0=^Au7Z@v{(TL*O~^M%`-lnuml$mG&NVWms5PS@}JjEDV_c zA51OnGW%F@Y!NC_OY8Tx*u{;$5h0{)jc?^a^kv;X^t7`*tqCtbok`rENM+$!gRc?e z$u>05+iY#+t4F-nl;))*)u-hI1n4#Qa}teWykU35sI}CuuG1*NwDzE?A0C3WF`d0A z{%}#_7aw6YjbMtiIAC#Rvqzu6Z(-XSrG*to7RPy0ly?yT*s^$4(Ujmz_H3HYJ2}E$ zCvKtBPx1zzyOF&O1aAzk75=9m_$iAVpVVg&K=x2G8UVRP*nj|mFrLx+QlW$Uaqqr; zdDv@!)LA2HBHWs&00FdxVnHmw7?t976bsXWB_0o>F!i1g!Dd)#!>a?`LmwxdLo� z*>Cx=hM7Po!Q_s(2#yAlO!R$*8wq_VP{AVnWCDbG5+z^Hvb*rD0zfrKn-t&%(Q?#- zt{7KhU^TKR@cxH{n2E=Z=9E2#sS`gYbMw-BV4$pBBzXD>DdNydkXjWPWkfbUDC>LF zjOD^fzOmu$VDR%{*upA)XVY%WV*EXlKhmB*!VVZ=qvG?&XFpfYdMVeUxsqlGCMr0} z${xFrccfBt|Jy(z?pqz50-Q(KY&2_H5M*=}c*I#u*!sT*3fV$;YBuS`%DgP5Vy6fG zGT~o>h%E6KM+hi1zjMJ0{jpt#6R~yx083_J3qBnfK=WI#Jj5q~QU0*4#N(GqrfFe! zxZGqS@;nZindVd;`eav+8rcW1eA{h7Z4Ajv8|s)EShvC>=ChX91C0#Sr7d$m&Uh;S zeEpdIqRgLiCd4>4tQ)JAbQjxoIDJj$2Eh~IC)iVQ>42*2Dkj;(5T?<0p&nHYC_Ao2 z=OoaJ0{#xr>Zn@)$BLcB*JHLDaZUoQ2Nz6e&K!8LGTWkv@()8eyu{hw)5SH1;Cm3% zJ`9t|FsEr$?3Avm${Jtws>Dsg+V!w-X@~r+d&5o(_eWFF+yOSl!V@O|-)%=PJ9qFM zY$Z`z+I^`i_BXqIh%OT_(i`vh^&`5SgE&^Z>N8EnYOo*%@bP@i2Sc+;nKXe*uN!j`iIJvjlkm)9+KB2InNElGh5cFp$zq z_Xoj)xBzYtnBI;cb}(h)gepay%N1xyIQY$uz)bQSD3D$vkSKx?dH;ySw7JGfDV z>H=Ig7*Wn2Gzm9P>hh7>YOGLHu7hBh&9j|9IsUcd42876{Lc*k`rF>Q~!a<|q#O`>~;$b|PpRG0|-lpB98Vu1x~CvXYKvF!tYCr(C_`0umNj>+vH`np|)A z>7fd=Mpy#QgSov4VtUu*{he{YFph8CycsR5@EMU6SI`@x z?7M)$5k4Ut!cp<@NL6CaTv}2BZ#8^#b#q2l#jL301(9QK+o|eDj~=0qA;`3RxJQu^ zCW9%o{)lGdI)?V?OVkd-lx?>ywpd#a72=O^{r$dV77Q8{NbCj*!q>^E8Nreep!Wh$ zqLZU~loK%8MRG54a%2M>?ie4~+61^Aa)L<`A~&!D-bKwYcOufcmS2S_S;nCkz4Fcu zEwSCY^@+3@!QYwCv?J#v0pEA?{{0$7Bb7~yX5S}NeViXKfe{nk{@g*b7z!}3$c@Mx zbixQ1kwzO&%AT}?>k-8t?$nQZTHm%nY~d^YkvaI&KXuT%P||58NsuC)K*gm4+ZJ?j zBxkg6(;UGa4$V_OTp#p7Q{&4dI|3Dkgp}Zot7%?JwpW{rmN) zqEHN#!2)w}`SwKqhzF!?*rbY{UML$iahEmg^m(!4=IK-Ew{sn}O3*&^J6ejQQLXas zwFbQf>Pqo)!`CETtMGE^oKv@Nxq7vIb+(L36G|D9gC&t6!`7#}eOwq<=^c59edTLU zYNzK)c1`Osl_qUDTbX2SiSk9I>ka8wBX0#S{BpZeqhn2$z%MGN2G-$LXeN~=nJU5~ z7K~8Ep)Y%Um)Qrz=O#hHoNO%cH0AOq$b}pPo1}Oi9{sfVNXjOfVFDrx$Z~R$663bp z*yQD}zCh@Grpd%EBvbkg78XalQ~V1!y+}MDUZ#hp@u9HCq4~iY%{-#q1zo{_AG*JJ zfPpH+NoPDqg>4U~T6gt^eB9!pHA`6ug%tj1EG*9_AL^{!sc7?O{TttZY zfh)j_qnpH!?Z#8FwVBdca*u>Hj_DCXk;MX0o+WA(NwJrlLc|>+uI|(h!M&EqV8Gh7 zWy^{^6^knE9>f!+_V6vfDyC1oG99w&k|r2QiBEXXb(H zBO0Ik<;`|(Tn?7<(D6V8sBmY9JJ~Z;DpTDwTQ+kpS05XvnR3GwQ)#!eR$S;fLOd5o z-(UL}b#`oyGENU#r`B*Yiwv6Jeb}@3R(;qVA!2#Y!689NaeSkdV37hAkq zQPCo*t=k8iMO<0L@~7ll^O;cc;0l(Nle57R7#o{7$TBW2I0Ug0MYDuS&FqCkj>R!PxK?kC}`gw~R7k`WC42Cu{umukFD{A*OBz}NXl$6Q9p$q{h zIfURtOajeNa{2P*s6-GBSssX`E9q1Y2Cy2)`a&TOp1y$T&+(=O&Lf`TrKgp99=AiY zz~(3G?b}s>ti|)$h_|w$LID&?%vR$NtcEtT4Q1^>c?7c}q<$WSau7*kxPJgbNhXoP zX+a>9kQG|QAUJQ;Q^n^vyLaO8j^>VN#SnTzHTr5|_GKldr@vzNA~_9%IF5QhD1O=@ z0M=o8v*qfB&ic$=*f+7%RM7|_Y<&25k-#yWwGmAo_{d33a_iVKgPC~or$|aD3VU?2yhi}})r3Cvr`a`@6`!?TlENUW6^|c7&L(n`Slmk?P z#e#C^Fj-9W1(6^t*VSbm?6MiG;RX&IoMId;G4zJxlZKiPG=xd-KI(88LaSMIvsR`w3n>H1O>uxpzPN6X3=li4 z^p;WSdny;xI;Rq5wev-M$FasplR&j3lXCc+&|^V|IBADq1MYxsA2@-ryM`WHTDGQ? zF<0JZ;k2OEPE>ESUeOnc6rM-zbMZBXmmV&v-Bijz!vU|el4olXESOGiO#I^cO#v`~ z8(&mRx^_*MSHejcRKQ=uLkOG^$Y5}ooe3VMHnaFZ@x_f|#jN$t{HSgPk%>r2G2R#CV;&0eXAZwd91Xd5If~5O{7>B(OSTQJ~g<2OWZjFE>AX)JEWok+mtxqaWN(f0u>|>zZOcn=L%b3Y@(@@e<12LIR#t>34g|sJCulMh z=cmiu0+s={y{3NllViX6e%orS!YiQ-8?X?AY9+Vlg@<3%%*xP2F?=D;8GpoB9|c;v zV@@3;XmkPuGV3cH1S$p3iHAtUlwXH$m@M`2vqKMfCz;-;>%P`LUU}TNEHv1z5}oR~Mnq{Jy_}7f)Jip040I3Fiy$B~`qRq! zRFrKatL@!Ka0%7z@G$5|w3dPcbOM~~x>LV@VV<$8_8$uI;G)$gQ1q_I?H1cnZ)iLv z(HQq|CY`2j6IQ}S?^zo9I^>YL+1a|huFx7(U*8e>}spm6<6hDTrQnRK?1Xig=HRwpXDaUxZ%3~sxSxI{grtk;BMotRY@OTH}?4^HY7y2Et9{IPGFaNtN&n{SW9JJVU+|C5Wb!u z?KDnUXjD&IJZdZ3teYB~Yoh-eN~I;-9VkCW@qH_eA>g-H$q@U|%aw;c*;U(ARBOm< zXBh=RI~)|qlA-a`RIABiC`t9UD_?vwq+GU}GnC+Y0+A7ae$U0L{kA_UdhscSd@6rE zIPnVtF91j@?GxOMpfY1*f`E_tbId~Ko-UrF7^?D4#CNa~{|Q>n+$Awwgx2|~M&lEz z*kAPDZTOezmuS@@O-KiT4|F&f$jyMw`)5**O{S#&N*Y}&;7GQci{)$F7K*^>W!juV zoaxt@h>qaE0sU74qR)@rwDchTYrp0kZ=Yf|ZoyUVXes2*vDP3&2J20+15T81E}?4| zL^~vk=4iis`H~KBDr8iy;Q;3ivC5Oq0+Z3{1z7Pq?{CAb#BY)MOXyvDL{8T4@7uj{ z>T;|;HNSXJSue)lB)z2(Bcb3KT#^rBG8^Ssuj}fTbrFP$xX+sj5|7D#SD5{$i>iXA zZ~(%j=j;0|N@&S}wULpRkJfVAyZ2UMi!Wrn))721F+37%#%ZE~1*n8qPoUHdS+8mr z)W31}YnVt0br%a`A8p@T!<6Ma2hk9*Ia}FeomX{r9~BFV4TJ}VM}SfwZ5SRl4G?=U zx!i=!u*DHlqiEZamN?^lkt_~HKKyBzIOxu`Oox@eSOa^Y9>=8PUzR5;Z~7AVGWPB+ zDq<=aC;?|vh{bv2=LO>St;aM3S-a0;Pkd6kh~Pd39st%&cwGT~X~Kz)wdCC~*md*| zPg{IcE&x-KClfFTB&weK<;B=0PSAhI{5dtX8x9Cx2!N9i|hQ z_rj;$zi!gQVh+5fN#N=6D2T63x-wMw%NHMY9MIAjieiar+vKaQG+pRb()tAoNGD(v z_&OtR4*wJ>ql@>Tx!^IZ1bz7XW4JBp72!7hV(gh9j)!w(Xbj$rh0N}Y2{InoriPCR z)|HaIPFuN46C6f2v^IiaHUd}yvB1g8%g;iWx~2oAjwn7KLL9*nPgu>h%3N~uCq%k% zQDUKId{&DRZYyxvO{6WOV1dJkwkE}n)OLc+@Tim_%_Jv|a6G|%VBJ-8bo8*I*wZ=n z)@Z(d)D&5Bw0gRRg%7C*|Kr%LZFwdm)lLM{By6{8X%k#nHbkcSs*WW>?7{HfX`OM) zomN#T!jDWS)Q>Z*hc&$z8Lpk@6M?TI8;jwM_>Q`Uv#M347HKt0hcdmdMz@lUZpvQ2#*7$;=i|M?wg-a~ppDl34zQ%AZkf#^5BxTo$(m@K2yY$RYWOXN(Q+ma*+-t3~)V zK^O$#6iWa0tOL&Q?g0dX!QM$cunn=DbYCC-&-I}}SX~2|6B)ds1FN$0ev`ieUj-Q; z+-hhfP@^LE%X(~%0r-p2hPN<}$hi#7Iu5w->@agqRD7O22~_5OWj zHGy~hN4>52wo2Vy&r5FS1GBVhZ6UdG2q6$LVz_c?2G^gEt2MW6mzleZeaN)oe zW=q@h3SZZ6>mA&P=`2VaHT=V!3R+rCnG>CHuo~`J91b2JS|ra&v?bFQDsR?2R<;{A zgJ|Mxx|d;{sFjo-YDg4hjC@&+K5|FsBnM~GgPIuqw%k_}9(@igYcUZyr3(f*kc{^B z_L31FUfqhWH{A9HxbWTs#aG+5-`MvcVg_YE0Qt#04#@)(oLA`?_$GHM;CWHCGQJA# zMeL^@VdVz|u$hLo_@_h3ITGj+lzZ=#X?VIx(cO>d$dUBL`G-F>wV4?x>HNXVD=m#rc3p8h_|cvDH&Bhg<4AzBlB*5+rbq;;dzk;&nMB`vtyvI3qVab5*fjE02>i6y=-)0D zBDAmnxbXkiUHIdT!2gXf*9q@dYXf1W1lVAHURzc4jz0qN9?K~BEt;Z!B+){x8KG4b z6=a1p*}05%Ik$1rwiY4|jo;5tCbSg7lh?`(;$Xgvsu4N{Ua^TDe{V`+ABTZh7^avJ z7RZ88hS%=mZVwMU`60m@A_5IBJYCWFL8Lx?0%dgfSnlzAW(lWby=D&b@ct<4{M5zB zju5PlNO0aqSS3s1k;FBMy9+H_V$Rml7bc5yFh^g%nhNlaqAGK#u@s^9bHs7ztz@}pwIEXIm10-+$~9p z^U16=;PVObqL-i?)JjF4T}9z;!8&rhHhr(K#xL(DaN~*&5#1FvH5Ml1HMTGSxhyDm zD%o|PwwSqpZBF`ea6yM>LLUNWb_aa*a3IX3CM_7G#jL;rxCh||b8D~~9P`}=VSdp27pT>Zid~W21tl?3PCpoeqQruhEYGbG!1$ly4)>-MJs;J?5;H? zkNHvtQiogjeBtMA<{MiKNb%%P+&lqGBKb*zc5SEx$;Og@OrcOzPLg|JQQ)zGgdHlZs;t%1q diff --git a/release-0.19.0/docs/design/clustering/static.seqdiag b/release-0.19.0/docs/design/clustering/static.seqdiag deleted file mode 100644 index bdc54b764e2..00000000000 --- a/release-0.19.0/docs/design/clustering/static.seqdiag +++ /dev/null @@ -1,16 +0,0 @@ -seqdiag { - activation = none; - - admin[label = "Manual Admin"]; - ca[label = "Manual CA"] - master; - kubelet[stacked]; - - admin => ca [label="create\n- master-cert"]; - admin ->> master [label="start\n- ca-root\n- master-cert"]; - - admin => ca [label="create\n- kubelet-cert"]; - admin ->> kubelet [label="start\n- ca-root\n- kubelet-cert\n- master-location"]; - - kubelet => master [label="register\n- kubelet-location"]; -} diff --git a/release-0.19.0/docs/design/command_execution_port_forwarding.md b/release-0.19.0/docs/design/command_execution_port_forwarding.md deleted file mode 100644 index 68b71dc2bd3..00000000000 --- a/release-0.19.0/docs/design/command_execution_port_forwarding.md +++ /dev/null @@ -1,149 +0,0 @@ -# Container Command Execution & Port Forwarding in Kubernetes - -## Abstract - -This describes an approach for providing support for: - -- executing commands in containers, with stdin/stdout/stderr streams attached -- port forwarding to containers - -## Background - -There are several related issues/PRs: - -- [Support attach](https://github.com/GoogleCloudPlatform/kubernetes/issues/1521) -- [Real container ssh](https://github.com/GoogleCloudPlatform/kubernetes/issues/1513) -- [Provide easy debug network access to services](https://github.com/GoogleCloudPlatform/kubernetes/issues/1863) -- [OpenShift container command execution proposal](https://github.com/openshift/origin/pull/576) - -## Motivation - -Users and administrators are accustomed to being able to access their systems -via SSH to run remote commands, get shell access, and do port forwarding. - -Supporting SSH to containers in Kubernetes is a difficult task. You must -specify a "user" and a hostname to make an SSH connection, and `sshd` requires -real users (resolvable by NSS and PAM). Because a container belongs to a pod, -and the pod belongs to a namespace, you need to specify namespace/pod/container -to uniquely identify the target container. Unfortunately, a -namespace/pod/container is not a real user as far as SSH is concerned. Also, -most Linux systems limit user names to 32 characters, which is unlikely to be -large enough to contain namespace/pod/container. We could devise some scheme to -map each namespace/pod/container to a 32-character user name, adding entries to -`/etc/passwd` (or LDAP, etc.) and keeping those entries fully in sync all the -time. Alternatively, we could write custom NSS and PAM modules that allow the -host to resolve a namespace/pod/container to a user without needing to keep -files or LDAP in sync. - -As an alternative to SSH, we are using a multiplexed streaming protocol that -runs on top of HTTP. There are no requirements about users being real users, -nor is there any limitation on user name length, as the protocol is under our -control. The only downside is that standard tooling that expects to use SSH -won't be able to work with this mechanism, unless adapters can be written. - -## Constraints and Assumptions - -- SSH support is not currently in scope -- CGroup confinement is ultimately desired, but implementing that support is not currently in scope -- SELinux confinement is ultimately desired, but implementing that support is not currently in scope - -## Use Cases - -- As a user of a Kubernetes cluster, I want to run arbitrary commands in a container, attaching my local stdin/stdout/stderr to the container -- As a user of a Kubernetes cluster, I want to be able to connect to local ports on my computer and have them forwarded to ports in the container - -## Process Flow - -### Remote Command Execution Flow -1. The client connects to the Kubernetes Master to initiate a remote command execution -request -2. The Master proxies the request to the Kubelet where the container lives -3. The Kubelet executes nsenter + the requested command and streams stdin/stdout/stderr back and forth between the client and the container - -### Port Forwarding Flow -1. The client connects to the Kubernetes Master to initiate a remote command execution -request -2. The Master proxies the request to the Kubelet where the container lives -3. The client listens on each specified local port, awaiting local connections -4. The client connects to one of the local listening ports -4. The client notifies the Kubelet of the new connection -5. The Kubelet executes nsenter + socat and streams data back and forth between the client and the port in the container - - -## Design Considerations - -### Streaming Protocol - -The current multiplexed streaming protocol used is SPDY. This is not the -long-term desire, however. As soon as there is viable support for HTTP/2 in Go, -we will switch to that. - -### Master as First Level Proxy - -Clients should not be allowed to communicate directly with the Kubelet for -security reasons. Therefore, the Master is currently the only suggested entry -point to be used for remote command execution and port forwarding. This is not -necessarily desirable, as it means that all remote command execution and port -forwarding traffic must travel through the Master, potentially impacting other -API requests. - -In the future, it might make more sense to retrieve an authorization token from -the Master, and then use that token to initiate a remote command execution or -port forwarding request with a load balanced proxy service dedicated to this -functionality. This would keep the streaming traffic out of the Master. - -### Kubelet as Backend Proxy - -The kubelet is currently responsible for handling remote command execution and -port forwarding requests. Just like with the Master described above, this means -that all remote command execution and port forwarding streaming traffic must -travel through the Kubelet, which could result in a degraded ability to service -other requests. - -In the future, it might make more sense to use a separate service on the node. - -Alternatively, we could possibly inject a process into the container that only -listens for a single request, expose that process's listening port on the node, -and then issue a redirect to the client such that it would connect to the first -level proxy, which would then proxy directly to the injected process's exposed -port. This would minimize the amount of proxying that takes place. - -### Scalability - -There are at least 2 different ways to execute a command in a container: -`docker exec` and `nsenter`. While `docker exec` might seem like an easier and -more obvious choice, it has some drawbacks. - -#### `docker exec` - -We could expose `docker exec` (i.e. have Docker listen on an exposed TCP port -on the node), but this would require proxying from the edge and securing the -Docker API. `docker exec` calls go through the Docker daemon, meaning that all -stdin/stdout/stderr traffic is proxied through the Daemon, adding an extra hop. -Additionally, you can't isolate 1 malicious `docker exec` call from normal -usage, meaning an attacker could initiate a denial of service or other attack -and take down the Docker daemon, or the node itself. - -We expect remote command execution and port forwarding requests to be long -running and/or high bandwidth operations, and routing all the streaming data -through the Docker daemon feels like a bottleneck we can avoid. - -#### `nsenter` - -The implementation currently uses `nsenter` to run commands in containers, -joining the appropriate container namespaces. `nsenter` runs directly on the -node and is not proxied through any single daemon process. - -### Security - -Authentication and authorization hasn't specifically been tested yet with this -functionality. We need to make sure that users are not allowed to execute -remote commands or do port forwarding to containers they aren't allowed to -access. - -Additional work is required to ensure that multiple command execution or port forwarding connections from different clients are not able to see each other's data. This can most likely be achieved via SELinux labeling and unique process contexts. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/command_execution_port_forwarding.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/command_execution_port_forwarding.md?pixel)]() diff --git a/release-0.19.0/docs/design/event_compression.md b/release-0.19.0/docs/design/event_compression.md deleted file mode 100644 index f769d890a90..00000000000 --- a/release-0.19.0/docs/design/event_compression.md +++ /dev/null @@ -1,84 +0,0 @@ -# Kubernetes Event Compression - -This document captures the design of event compression. - - -## Background - -Kubernetes components can get into a state where they generate tons of events which are identical except for the timestamp. For example, when pulling a non-existing image, Kubelet will repeatedly generate ```image_not_existing``` and ```container_is_waiting``` events until upstream components correct the image. When this happens, the spam from the repeated events makes the entire event mechanism useless. It also appears to cause memory pressure in etcd (see [#3853](https://github.com/GoogleCloudPlatform/kubernetes/issues/3853)). - -## Proposal -Each binary that generates events (for example, ```kubelet```) should keep track of previously generated events so that it can collapse recurring events into a single event instead of creating a new instance for each new event. - -Event compression should be best effort (not guaranteed). Meaning, in the worst case, ```n``` identical (minus timestamp) events may still result in ```n``` event entries. - -## Design -Instead of a single Timestamp, each event object [contains](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/pkg/api/types.go#L1111) the following fields: - * ```FirstTimestamp util.Time``` - * The date/time of the first occurrence of the event. - * ```LastTimestamp util.Time``` - * The date/time of the most recent occurrence of the event. - * On first occurrence, this is equal to the FirstTimestamp. - * ```Count int``` - * The number of occurrences of this event between FirstTimestamp and LastTimestamp - * On first occurrence, this is 1. - -Each binary that generates events: - * Maintains a historical record of previously generated events: - * Implmented with ["Least Recently Used Cache"](https://github.com/golang/groupcache/blob/master/lru/lru.go) in [```pkg/client/record/events_cache.go```](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/pkg/client/record/events_cache.go). - * The key in the cache is generated from the event object minus timestamps/count/transient fields, specifically the following events fields are used to construct a unique key for an event: - * ```event.Source.Component``` - * ```event.Source.Host``` - * ```event.InvolvedObject.Kind``` - * ```event.InvolvedObject.Namespace``` - * ```event.InvolvedObject.Name``` - * ```event.InvolvedObject.UID``` - * ```event.InvolvedObject.APIVersion``` - * ```event.Reason``` - * ```event.Message``` - * The LRU cache is capped at 4096 events. That means if a component (e.g. kubelet) runs for a long period of time and generates tons of unique events, the previously generated events cache will not grow unchecked in memory. Instead, after 4096 unique events are generated, the oldest events are evicted from the cache. - * When an event is generated, the previously generated events cache is checked (see [```pkg/client/record/event.go```](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/pkg/client/record/event.go)). - * If the key for the new event matches the key for a previously generated event (meaning all of the above fields match between the new event and some previously generated event), then the event is considered to be a duplicate and the existing event entry is updated in etcd: - * The new PUT (update) event API is called to update the existing event entry in etcd with the new last seen timestamp and count. - * The event is also updated in the previously generated events cache with an incremented count, updated last seen timestamp, name, and new resource version (all required to issue a future event update). - * If the key for the new event does not match the key for any previously generated event (meaning none of the above fields match between the new event and any previously generated events), then the event is considered to be new/unique and a new event entry is created in etcd: - * The usual POST/create event API is called to create a new event entry in etcd. - * An entry for the event is also added to the previously generated events cache. - -## Issues/Risks - * Compression is not guaranteed, because each component keeps track of event history in memory - * An application restart causes event history to be cleared, meaning event history is not preserved across application restarts and compression will not occur across component restarts. - * Because an LRU cache is used to keep track of previously generated events, if too many unique events are generated, old events will be evicted from the cache, so events will only be compressed until they age out of the events cache, at which point any new instance of the event will cause a new entry to be created in etcd. - -## Example -Sample kubectl output -``` -FIRSTSEEN LASTSEEN COUNT NAME KIND SUBOBJECT REASON SOURCE MESSAGE -Thu, 12 Feb 2015 01:13:02 +0000 Thu, 12 Feb 2015 01:13:02 +0000 1 kubernetes-minion-4.c.saad-dev-vms.internal Minion starting {kubelet kubernetes-minion-4.c.saad-dev-vms.internal} Starting kubelet. -Thu, 12 Feb 2015 01:13:09 +0000 Thu, 12 Feb 2015 01:13:09 +0000 1 kubernetes-minion-1.c.saad-dev-vms.internal Minion starting {kubelet kubernetes-minion-1.c.saad-dev-vms.internal} Starting kubelet. -Thu, 12 Feb 2015 01:13:09 +0000 Thu, 12 Feb 2015 01:13:09 +0000 1 kubernetes-minion-3.c.saad-dev-vms.internal Minion starting {kubelet kubernetes-minion-3.c.saad-dev-vms.internal} Starting kubelet. -Thu, 12 Feb 2015 01:13:09 +0000 Thu, 12 Feb 2015 01:13:09 +0000 1 kubernetes-minion-2.c.saad-dev-vms.internal Minion starting {kubelet kubernetes-minion-2.c.saad-dev-vms.internal} Starting kubelet. -Thu, 12 Feb 2015 01:13:05 +0000 Thu, 12 Feb 2015 01:13:12 +0000 4 monitoring-influx-grafana-controller-0133o Pod failedScheduling {scheduler } Error scheduling: no minions available to schedule pods -Thu, 12 Feb 2015 01:13:05 +0000 Thu, 12 Feb 2015 01:13:12 +0000 4 elasticsearch-logging-controller-fplln Pod failedScheduling {scheduler } Error scheduling: no minions available to schedule pods -Thu, 12 Feb 2015 01:13:05 +0000 Thu, 12 Feb 2015 01:13:12 +0000 4 kibana-logging-controller-gziey Pod failedScheduling {scheduler } Error scheduling: no minions available to schedule pods -Thu, 12 Feb 2015 01:13:05 +0000 Thu, 12 Feb 2015 01:13:12 +0000 4 skydns-ls6k1 Pod failedScheduling {scheduler } Error scheduling: no minions available to schedule pods -Thu, 12 Feb 2015 01:13:05 +0000 Thu, 12 Feb 2015 01:13:12 +0000 4 monitoring-heapster-controller-oh43e Pod failedScheduling {scheduler } Error scheduling: no minions available to schedule pods -Thu, 12 Feb 2015 01:13:20 +0000 Thu, 12 Feb 2015 01:13:20 +0000 1 kibana-logging-controller-gziey BoundPod implicitly required container POD pulled {kubelet kubernetes-minion-4.c.saad-dev-vms.internal} Successfully pulled image "kubernetes/pause:latest" -Thu, 12 Feb 2015 01:13:20 +0000 Thu, 12 Feb 2015 01:13:20 +0000 1 kibana-logging-controller-gziey Pod scheduled {scheduler } Successfully assigned kibana-logging-controller-gziey to kubernetes-minion-4.c.saad-dev-vms.internal - -``` - -This demonstrates what would have been 20 separate entries (indicating scheduling failure) collapsed/compressed down to 5 entries. - -## Related Pull Requests/Issues - * Issue [#4073](https://github.com/GoogleCloudPlatform/kubernetes/issues/4073): Compress duplicate events - * PR [#4157](https://github.com/GoogleCloudPlatform/kubernetes/issues/4157): Add "Update Event" to Kubernetes API - * PR [#4206](https://github.com/GoogleCloudPlatform/kubernetes/issues/4206): Modify Event struct to allow compressing multiple recurring events in to a single event - * PR [#4306](https://github.com/GoogleCloudPlatform/kubernetes/issues/4306): Compress recurring events in to a single event to optimize etcd storage - * PR [#4444](https://github.com/GoogleCloudPlatform/kubernetes/pull/4444): Switch events history to use LRU cache instead of map - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/event_compression.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/event_compression.md?pixel)]() diff --git a/release-0.19.0/docs/design/expansion.md b/release-0.19.0/docs/design/expansion.md deleted file mode 100644 index 83ab9aeb523..00000000000 --- a/release-0.19.0/docs/design/expansion.md +++ /dev/null @@ -1,391 +0,0 @@ -# Variable expansion in pod command, args, and env - -## Abstract - -A proposal for the expansion of environment variables using a simple `$(var)` syntax. - -## Motivation - -It is extremely common for users to need to compose environment variables or pass arguments to -their commands using the values of environment variables. Kubernetes should provide a facility for -the 80% cases in order to decrease coupling and the use of workarounds. - -## Goals - -1. Define the syntax format -2. Define the scoping and ordering of substitutions -3. Define the behavior for unmatched variables -4. Define the behavior for unexpected/malformed input - -## Constraints and Assumptions - -* This design should describe the simplest possible syntax to accomplish the use-cases -* Expansion syntax will not support more complicated shell-like behaviors such as default values - (viz: `$(VARIABLE_NAME:"default")`), inline substitution, etc. - -## Use Cases - -1. As a user, I want to compose new environment variables for a container using a substitution - syntax to reference other variables in the container's environment and service environment - variables -1. As a user, I want to substitute environment variables into a container's command -1. As a user, I want to do the above without requiring the container's image to have a shell -1. As a user, I want to be able to specify a default value for a service variable which may - not exist -1. As a user, I want to see an event associated with the pod if an expansion fails (ie, references - variable names that cannot be expanded) - -### Use Case: Composition of environment variables - -Currently, containers are injected with docker-style environment variables for the services in -their pod's namespace. There are several variables for each service, but users routinely need -to compose URLs based on these variables because there is not a variable for the exact format -they need. Users should be able to build new environment variables with the exact format they need. -Eventually, it should also be possible to turn off the automatic injection of the docker-style -variables into pods and let the users consume the exact information they need via the downward API -and composition. - -#### Expanding expanded variables - -It should be possible to reference an variable which is itself the result of an expansion, if the -referenced variable is declared in the container's environment prior to the one referencing it. -Put another way -- a container's environment is expanded in order, and expanded variables are -available to subsequent expansions. - -### Use Case: Variable expansion in command - -Users frequently need to pass the values of environment variables to a container's command. -Currently, Kubernetes does not perform any expansion of varibles. The workaround is to invoke a -shell in the container's command and have the shell perform the substitution, or to write a wrapper -script that sets up the environment and runs the command. This has a number of drawbacks: - -1. Solutions that require a shell are unfriendly to images that do not contain a shell -2. Wrapper scripts make it harder to use images as base images -3. Wrapper scripts increase coupling to kubernetes - -Users should be able to do the 80% case of variable expansion in command without writing a wrapper -script or adding a shell invocation to their containers' commands. - -### Use Case: Images without shells - -The current workaround for variable expansion in a container's command requires the container's -image to have a shell. This is unfriendly to images that do not contain a shell (`scratch` images, -for example). Users should be able to perform the other use-cases in this design without regard to -the content of their images. - -### Use Case: See an event for incomplete expansions - -It is possible that a container with incorrect variable values or command line may continue to run -for a long period of time, and that the end-user would have no visual or obvious warning of the -incorrect configuration. If the kubelet creates an event when an expansion references a variable -that cannot be expanded, it will help users quickly detect problems with expansions. - -## Design Considerations - -### What features should be supported? - -In order to limit complexity, we want to provide the right amount of functionality so that the 80% -cases can be realized and nothing more. We felt that the essentials boiled down to: - -1. Ability to perform direct expansion of variables in a string -2. Ability to specify default values via a prioritized mapping function but without support for - defaults as a syntax-level feature - -### What should the syntax be? - -The exact syntax for variable expansion has a large impact on how users perceive and relate to the -feature. We considered implementing a very restrictive subset of the shell `${var}` syntax. This -syntax is an attractive option on some level, because many people are familiar with it. However, -this syntax also has a large number of lesser known features such as the ability to provide -default values for unset variables, perform inline substitution, etc. - -In the interest of preventing conflation of the expansion feature in Kubernetes with the shell -feature, we chose a different syntax similar to the one in Makefiles, `$(var)`. We also chose not -to support the bar `$var` format, since it is not required to implement the required use-cases. - -Nested references, ie, variable expansion within variable names, are not supported. - -#### How should unmatched references be treated? - -Ideally, it should be extremely clear when a variable reference couldn't be expanded. We decided -the best experience for unmatched variable references would be to have the entire reference, syntax -included, show up in the output. As an example, if the reference `$(VARIABLE_NAME)` cannot be -expanded, then `$(VARIABLE_NAME)` should be present in the output. - -#### Escaping the operator - -Although the `$(var)` syntax does overlap with the `$(command)` form of command substitution -supported by many shells, because unexpanded variables are present verbatim in the output, we -expect this will not present a problem to many users. If there is a collision between a varible -name and command substitution syntax, the syntax can be escaped with the form `$$(VARIABLE_NAME)`, -which will evaluate to `$(VARIABLE_NAME)` whether `VARIABLE_NAME` can be expanded or not. - -## Design - -This design encompasses the variable expansion syntax and specification and the changes needed to -incorporate the expansion feature into the container's environment and command. - -### Syntax and expansion mechanics - -This section describes the expansion syntax, evaluation of variable values, and how unexpected or -malformed inputs are handled. - -#### Syntax - -The inputs to the expansion feature are: - -1. A utf-8 string (the input string) which may contain variable references -2. A function (the mapping function) that maps the name of a variable to the variable's value, of - type `func(string) string` - -Variable references in the input string are indicated exclusively with the syntax -`$()`. The syntax tokens are: - -- `$`: the operator -- `(`: the reference opener -- `)`: the reference closer - -The operator has no meaning unless accompanied by the reference opener and closer tokens. The -operator can be escaped using `$$`. One literal `$` will be emitted for each `$$` in the input. - -The reference opener and closer characters have no meaning when not part of a variable reference. -If a variable reference is malformed, viz: `$(VARIABLE_NAME` without a closing expression, the -operator and expression opening characters are treated as ordinary characters without special -meanings. - -#### Scope and ordering of substitutions - -The scope in which variable references are expanded is defined by the mapping function. Within the -mapping function, any arbitrary strategy may be used to determine the value of a variable name. -The most basic implementation of a mapping function is to use a `map[string]string` to lookup the -value of a variable. - -In order to support default values for variables like service variables presented by the kubelet, -which may not be bound because the service that provides them does not yet exist, there should be a -mapping function that uses a list of `map[string]string` like: - -```go -func MakeMappingFunc(maps ...map[string]string) func(string) string { - return func(input string) string { - for _, context := range maps { - val, ok := context[input] - if ok { - return val - } - } - - return "" - } -} - -// elsewhere -containerEnv := map[string]string{ - "FOO": "BAR", - "ZOO": "ZAB", - "SERVICE2_HOST": "some-host", -} - -serviceEnv := map[string]string{ - "SERVICE_HOST": "another-host", - "SERVICE_PORT": "8083", -} - -// single-map variation -mapping := MakeMappingFunc(containerEnv) - -// default variables not found in serviceEnv -mappingWithDefaults := MakeMappingFunc(serviceEnv, containerEnv) -``` - -### Implementation changes - -The necessary changes to implement this functionality are: - -1. Add a new interface, `ObjectEventRecorder`, which is like the `EventRecorder` interface, but - scoped to a single object, and a function that returns an `ObjectEventRecorder` given an - `ObjectReference` and an `EventRecorder` -2. Introduce `third_party/golang/expansion` package that provides: - 1. An `Expand(string, func(string) string) string` function - 2. A `MappingFuncFor(ObjectEventRecorder, ...map[string]string) string` function -3. Make the kubelet expand environment correctly -4. Make the kubelet expand command correctly - -#### Event Recording - -In order to provide an event when an expansion references undefined variables, the mapping function -must be able to create an event. In order to facilitate this, we should create a new interface in -the `api/client/record` package which is similar to `EventRecorder`, but scoped to a single object: - -```go -// ObjectEventRecorder knows how to record events about a single object. -type ObjectEventRecorder interface { - // Event constructs an event from the given information and puts it in the queue for sending. - // 'reason' is the reason this event is generated. 'reason' should be short and unique; it will - // be used to automate handling of events, so imagine people writing switch statements to - // handle them. You want to make that easy. - // 'message' is intended to be human readable. - // - // The resulting event will be created in the same namespace as the reference object. - Event(reason, message string) - - // Eventf is just like Event, but with Sprintf for the message field. - Eventf(reason, messageFmt string, args ...interface{}) - - // PastEventf is just like Eventf, but with an option to specify the event's 'timestamp' field. - PastEventf(timestamp util.Time, reason, messageFmt string, args ...interface{}) -} -``` - -There should also be a function that can construct an `ObjectEventRecorder` from a `runtime.Object` -and an `EventRecorder`: - -```go -type objectRecorderImpl struct { - object runtime.Object - recorder EventRecorder -} - -func (r *objectRecorderImpl) Event(reason, message string) { - r.recorder.Event(r.object, reason, message) -} - -func ObjectEventRecorderFor(object runtime.Object, recorder EventRecorder) ObjectEventRecorder { - return &objectRecorderImpl{object, recorder} -} -``` - -#### Expansion package - -The expansion package should provide two methods: - -```go -// MappingFuncFor returns a mapping function for use with Expand that -// implements the expansion semantics defined in the expansion spec; it -// returns the input string wrapped in the expansion syntax if no mapping -// for the input is found. If no expansion is found for a key, an event -// is raised on the given recorder. -func MappingFuncFor(recorder record.ObjectEventRecorder, context ...map[string]string) func(string) string { - // ... -} - -// Expand replaces variable references in the input string according to -// the expansion spec using the given mapping function to resolve the -// values of variables. -func Expand(input string, mapping func(string) string) string { - // ... -} -``` - -#### Kubelet changes - -The Kubelet should be made to correctly expand variables references in a container's environment, -command, and args. Changes will need to be made to: - -1. The `makeEnvironmentVariables` function in the kubelet; this is used by - `GenerateRunContainerOptions`, which is used by both the docker and rkt container runtimes -2. The docker manager `setEntrypointAndCommand` func has to be changed to perform variable - expansion -3. The rkt runtime should be made to support expansion in command and args when support for it is - implemented - -### Examples - -#### Inputs and outputs - -These examples are in the context of the mapping: - -| Name | Value | -|-------------|------------| -| `VAR_A` | `"A"` | -| `VAR_B` | `"B"` | -| `VAR_C` | `"C"` | -| `VAR_REF` | `$(VAR_A)` | -| `VAR_EMPTY` | `""` | - -No other variables are defined. - -| Input | Result | -|--------------------------------|----------------------------| -| `"$(VAR_A)"` | `"A"` | -| `"___$(VAR_B)___"` | `"___B___"` | -| `"___$(VAR_C)"` | `"___C"` | -| `"$(VAR_A)-$(VAR_A)"` | `"A-A"` | -| `"$(VAR_A)-1"` | `"A-1"` | -| `"$(VAR_A)_$(VAR_B)_$(VAR_C)"` | `"A_B_C"` | -| `"$$(VAR_B)_$(VAR_A)"` | `"$(VAR_B)_A"` | -| `"$$(VAR_A)_$$(VAR_B)"` | `"$(VAR_A)_$(VAR_B)"` | -| `"f000-$$VAR_A"` | `"f000-$VAR_A"` | -| `"foo\\$(VAR_C)bar"` | `"foo\Cbar"` | -| `"foo\\\\$(VAR_C)bar"` | `"foo\\Cbar"` | -| `"foo\\\\\\\\$(VAR_A)bar"` | `"foo\\\\Abar"` | -| `"$(VAR_A$(VAR_B))"` | `"$(VAR_A$(VAR_B))"` | -| `"$(VAR_A$(VAR_B)"` | `"$(VAR_A$(VAR_B)"` | -| `"$(VAR_REF)"` | `"$(VAR_A)"` | -| `"%%$(VAR_REF)--$(VAR_REF)%%"` | `"%%$(VAR_A)--$(VAR_A)%%"` | -| `"foo$(VAR_EMPTY)bar"` | `"foobar"` | -| `"foo$(VAR_Awhoops!"` | `"foo$(VAR_Awhoops!"` | -| `"f00__(VAR_A)__"` | `"f00__(VAR_A)__"` | -| `"$?_boo_$!"` | `"$?_boo_$!"` | -| `"$VAR_A"` | `"$VAR_A"` | -| `"$(VAR_DNE)"` | `"$(VAR_DNE)"` | -| `"$$$$$$(BIG_MONEY)"` | `"$$$(BIG_MONEY)"` | -| `"$$$$$$(VAR_A)"` | `"$$$(VAR_A)"` | -| `"$$$$$$$(GOOD_ODDS)"` | `"$$$$(GOOD_ODDS)"` | -| `"$$$$$$$(VAR_A)"` | `"$$$A"` | -| `"$VAR_A)"` | `"$VAR_A)"` | -| `"${VAR_A}"` | `"${VAR_A}"` | -| `"$(VAR_B)_______$(A"` | `"B_______$(A"` | -| `"$(VAR_C)_______$("` | `"C_______$("` | -| `"$(VAR_A)foobarzab$"` | `"Afoobarzab$"` | -| `"foo-\\$(VAR_A"` | `"foo-\$(VAR_A"` | -| `"--$($($($($--"` | `"--$($($($($--"` | -| `"$($($($($--foo$("` | `"$($($($($--foo$("` | -| `"foo0--$($($($("` | `"foo0--$($($($("` | -| `"$(foo$$var)` | `$(foo$$var)` | - -#### In a pod: building a URL - -Notice the `$(var)` syntax. - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: expansion-pod -spec: - containers: - - name: test-container - image: gcr.io/google_containers/busybox - command: [ "/bin/sh", "-c", "env" ] - env: - - name: PUBLIC_URL - value: "http://$(GITSERVER_SERVICE_HOST):$(GITSERVER_SERVICE_PORT)" - restartPolicy: Never -``` - -#### In a pod: building a URL using downward API - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: expansion-pod -spec: - containers: - - name: test-container - image: gcr.io/google_containers/busybox - command: [ "/bin/sh", "-c", "env" ] - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: "metadata.namespace" - - name: PUBLIC_URL - value: "http://gitserver.$(POD_NAMESPACE):$(SERVICE_PORT)" - restartPolicy: Never -``` - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/expansion.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/expansion.md?pixel)]() diff --git a/release-0.19.0/docs/design/identifiers.md b/release-0.19.0/docs/design/identifiers.md deleted file mode 100644 index 1eaa301a80a..00000000000 --- a/release-0.19.0/docs/design/identifiers.md +++ /dev/null @@ -1,96 +0,0 @@ -# Identifiers and Names in Kubernetes - -A summarization of the goals and recommendations for identifiers in Kubernetes. Described in [GitHub issue #199](https://github.com/GoogleCloudPlatform/kubernetes/issues/199). - - -## Definitions - -UID -: A non-empty, opaque, system-generated value guaranteed to be unique in time and space; intended to distinguish between historical occurrences of similar entities. - -Name -: A non-empty string guaranteed to be unique within a given scope at a particular time; used in resource URLs; provided by clients at creation time and encouraged to be human friendly; intended to facilitate creation idempotence and space-uniqueness of singleton objects, distinguish distinct entities, and reference particular entities across operations. - -[rfc1035](http://www.ietf.org/rfc/rfc1035.txt)/[rfc1123](http://www.ietf.org/rfc/rfc1123.txt) label (DNS_LABEL) -: An alphanumeric (a-z, and 0-9) string, with a maximum length of 63 characters, with the '-' character allowed anywhere except the first or last character, suitable for use as a hostname or segment in a domain name - -[rfc1035](http://www.ietf.org/rfc/rfc1035.txt)/[rfc1123](http://www.ietf.org/rfc/rfc1123.txt) subdomain (DNS_SUBDOMAIN) -: One or more lowercase rfc1035/rfc1123 labels separated by '.' with a maximum length of 253 characters - -[rfc4122](http://www.ietf.org/rfc/rfc4122.txt) universally unique identifier (UUID) -: A 128 bit generated value that is extremely unlikely to collide across time and space and requires no central coordination - - -## Objectives for names and UIDs - -1. Uniquely identify (via a UID) an object across space and time - -2. Uniquely name (via a name) an object across space - -3. Provide human-friendly names in API operations and/or configuration files - -4. Allow idempotent creation of API resources (#148) and enforcement of space-uniqueness of singleton objects - -5. Allow DNS names to be automatically generated for some objects - - -## General design - -1. When an object is created via an API, a Name string (a DNS_SUBDOMAIN) must be specified. Name must be non-empty and unique within the apiserver. This enables idempotent and space-unique creation operations. Parts of the system (e.g. replication controller) may join strings (e.g. a base name and a random suffix) to create a unique Name. For situations where generating a name is impractical, some or all objects may support a param to auto-generate a name. Generating random names will defeat idempotency. - * Examples: "guestbook.user", "backend-x4eb1" - -2. When an object is created via an API, a Namespace string (a DNS_SUBDOMAIN? format TBD via #1114) may be specified. Depending on the API receiver, namespaces might be validated (e.g. apiserver might ensure that the namespace actually exists). If a namespace is not specified, one will be assigned by the API receiver. This assignment policy might vary across API receivers (e.g. apiserver might have a default, kubelet might generate something semi-random). - * Example: "api.k8s.example.com" - -3. Upon acceptance of an object via an API, the object is assigned a UID (a UUID). UID must be non-empty and unique across space and time. - * Example: "01234567-89ab-cdef-0123-456789abcdef" - - -## Case study: Scheduling a pod - -Pods can be placed onto a particular node in a number of ways. This case -study demonstrates how the above design can be applied to satisfy the -objectives. - -### A pod scheduled by a user through the apiserver - -1. A user submits a pod with Namespace="" and Name="guestbook" to the apiserver. - -2. The apiserver validates the input. - 1. A default Namespace is assigned. - 2. The pod name must be space-unique within the Namespace. - 3. Each container within the pod has a name which must be space-unique within the pod. - -3. The pod is accepted. - 1. A new UID is assigned. - -4. The pod is bound to a node. - 1. The kubelet on the node is passed the pod's UID, Namespace, and Name. - -5. Kubelet validates the input. - -6. Kubelet runs the pod. - 1. Each container is started up with enough metadata to distinguish the pod from whence it came. - 2. Each attempt to run a container is assigned a UID (a string) that is unique across time. - * This may correspond to Docker's container ID. - -### A pod placed by a config file on the node - -1. A config file is stored on the node, containing a pod with UID="", Namespace="", and Name="cadvisor". - -2. Kubelet validates the input. - 1. Since UID is not provided, kubelet generates one. - 2. Since Namespace is not provided, kubelet generates one. - 1. The generated namespace should be deterministic and cluster-unique for the source, such as a hash of the hostname and file path. - * E.g. Namespace="file-f4231812554558a718a01ca942782d81" - -3. Kubelet runs the pod. - 1. Each container is started up with enough metadata to distinguish the pod from whence it came. - 2. Each attempt to run a container is assigned a UID (a string) that is unique across time. - 1. This may correspond to Docker's container ID. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/identifiers.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/identifiers.md?pixel)]() diff --git a/release-0.19.0/docs/design/namespaces.md b/release-0.19.0/docs/design/namespaces.md deleted file mode 100644 index cf67b56acae..00000000000 --- a/release-0.19.0/docs/design/namespaces.md +++ /dev/null @@ -1,340 +0,0 @@ -# Namespaces - -## Abstract - -A Namespace is a mechanism to partition resources created by users into -a logically named group. - -## Motivation - -A single cluster should be able to satisfy the needs of multiple user communities. - -Each user community wants to be able to work in isolation from other communities. - -Each user community has its own: - -1. resources (pods, services, replication controllers, etc.) -2. policies (who can or cannot perform actions in their community) -3. constraints (this community is allowed this much quota, etc.) - -A cluster operator may create a Namespace for each unique user community. - -The Namespace provides a unique scope for: - -1. named resources (to avoid basic naming collisions) -2. delegated management authority to trusted users -3. ability to limit community resource consumption - -## Use cases - -1. As a cluster operator, I want to support multiple user communities on a single cluster. -2. As a cluster operator, I want to delegate authority to partitions of the cluster to trusted users - in those communities. -3. As a cluster operator, I want to limit the amount of resources each community can consume in order - to limit the impact to other communities using the cluster. -4. As a cluster user, I want to interact with resources that are pertinent to my user community in - isolation of what other user communities are doing on the cluster. - -## Design - -### Data Model - -A *Namespace* defines a logically named group for multiple *Kind*s of resources. - -``` -type Namespace struct { - TypeMeta `json:",inline"` - ObjectMeta `json:"metadata,omitempty"` - - Spec NamespaceSpec `json:"spec,omitempty"` - Status NamespaceStatus `json:"status,omitempty"` -} -``` - -A *Namespace* name is a DNS compatible label. - -A *Namespace* must exist prior to associating content with it. - -A *Namespace* must not be deleted if there is content associated with it. - -To associate a resource with a *Namespace* the following conditions must be satisfied: - -1. The resource's *Kind* must be registered as having *RESTScopeNamespace* with the server -2. The resource's *TypeMeta.Namespace* field must have a value that references an existing *Namespace* - -The *Name* of a resource associated with a *Namespace* is unique to that *Kind* in that *Namespace*. - -It is intended to be used in resource URLs; provided by clients at creation time, and encouraged to be -human friendly; intended to facilitate idempotent creation, space-uniqueness of singleton objects, -distinguish distinct entities, and reference particular entities across operations. - -### Authorization - -A *Namespace* provides an authorization scope for accessing content associated with the *Namespace*. - -See [Authorization plugins](../authorization.md) - -### Limit Resource Consumption - -A *Namespace* provides a scope to limit resource consumption. - -A *LimitRange* defines min/max constraints on the amount of resources a single entity can consume in -a *Namespace*. - -See [Admission control: Limit Range](admission_control_limit_range.md) - -A *ResourceQuota* tracks aggregate usage of resources in the *Namespace* and allows cluster operators -to define *Hard* resource usage limits that a *Namespace* may consume. - -See [Admission control: Resource Quota](admission_control_resource_quota.md) - -### Finalizers - -Upon creation of a *Namespace*, the creator may provide a list of *Finalizer* objects. - -``` -type FinalizerName string - -// These are internal finalizers to Kubernetes, must be qualified name unless defined here -const ( - FinalizerKubernetes FinalizerName = "kubernetes" -) - -// NamespaceSpec describes the attributes on a Namespace -type NamespaceSpec struct { - // Finalizers is an opaque list of values that must be empty to permanently remove object from storage - Finalizers []FinalizerName -} -``` - -A *FinalizerName* is a qualified name. - -The API Server enforces that a *Namespace* can only be deleted from storage if and only if -it's *Namespace.Spec.Finalizers* is empty. - -A *finalize* operation is the only mechanism to modify the *Namespace.Spec.Finalizers* field post creation. - -Each *Namespace* created has *kubernetes* as an item in its list of initial *Namespace.Spec.Finalizers* -set by default. - -### Phases - -A *Namespace* may exist in the following phases. - -``` -type NamespacePhase string -const( - NamespaceActive NamespacePhase = "Active" - NamespaceTerminating NamespaceTerminating = "Terminating" -) - -type NamespaceStatus struct { - ... - Phase NamespacePhase -} -``` - -A *Namespace* is in the **Active** phase if it does not have a *ObjectMeta.DeletionTimestamp*. - -A *Namespace* is in the **Terminating** phase if it has a *ObjectMeta.DeletionTimestamp*. - -**Active** - -Upon creation, a *Namespace* goes in the *Active* phase. This means that content may be associated with -a namespace, and all normal interactions with the namespace are allowed to occur in the cluster. - -If a DELETE request occurs for a *Namespace*, the *Namespace.ObjectMeta.DeletionTimestamp* is set -to the current server time. A *namespace controller* observes the change, and sets the *Namespace.Status.Phase* -to *Terminating*. - -**Terminating** - -A *namespace controller* watches for *Namespace* objects that have a *Namespace.ObjectMeta.DeletionTimestamp* -value set in order to know when to initiate graceful termination of the *Namespace* associated content that -are known to the cluster. - -The *namespace controller* enumerates each known resource type in that namespace and deletes it one by one. - -Admission control blocks creation of new resources in that namespace in order to prevent a race-condition -where the controller could believe all of a given resource type had been deleted from the namespace, -when in fact some other rogue client agent had created new objects. Using admission control in this -scenario allows each of registry implementations for the individual objects to not need to take into account Namespace life-cycle. - -Once all objects known to the *namespace controller* have been deleted, the *namespace controller* -executes a *finalize* operation on the namespace that removes the *kubernetes* value from -the *Namespace.Spec.Finalizers* list. - -If the *namespace controller* sees a *Namespace* whose *ObjectMeta.DeletionTimestamp* is set, and -whose *Namespace.Spec.Finalizers* list is empty, it will signal the server to permanently remove -the *Namespace* from storage by sending a final DELETE action to the API server. - -### REST API - -To interact with the Namespace API: - -| Action | HTTP Verb | Path | Description | -| ------ | --------- | ---- | ----------- | -| CREATE | POST | /api/{version}/namespaces | Create a namespace | -| LIST | GET | /api/{version}/namespaces | List all namespaces | -| UPDATE | PUT | /api/{version}/namespaces/{namespace} | Update namespace {namespace} | -| DELETE | DELETE | /api/{version}/namespaces/{namespace} | Delete namespace {namespace} | -| FINALIZE | POST | /api/{version}/namespaces/{namespace}/finalize | Finalize namespace {namespace} | -| WATCH | GET | /api/{version}/watch/namespaces | Watch all namespaces | - -This specification reserves the name *finalize* as a sub-resource to namespace. - -As a consequence, it is invalid to have a *resourceType* managed by a namespace whose kind is *finalize*. - -To interact with content associated with a Namespace: - -| Action | HTTP Verb | Path | Description | -| ---- | ---- | ---- | ---- | -| CREATE | POST | /api/{version}/namespaces/{namespace}/{resourceType}/ | Create instance of {resourceType} in namespace {namespace} | -| GET | GET | /api/{version}/namespaces/{namespace}/{resourceType}/{name} | Get instance of {resourceType} in namespace {namespace} with {name} | -| UPDATE | PUT | /api/{version}/namespaces/{namespace}/{resourceType}/{name} | Update instance of {resourceType} in namespace {namespace} with {name} | -| DELETE | DELETE | /api/{version}/namespaces/{namespace}/{resourceType}/{name} | Delete instance of {resourceType} in namespace {namespace} with {name} | -| LIST | GET | /api/{version}/namespaces/{namespace}/{resourceType} | List instances of {resourceType} in namespace {namespace} | -| WATCH | GET | /api/{version}/watch/namespaces/{namespace}/{resourceType} | Watch for changes to a {resourceType} in namespace {namespace} | -| WATCH | GET | /api/{version}/watch/{resourceType} | Watch for changes to a {resourceType} across all namespaces | -| LIST | GET | /api/{version}/list/{resourceType} | List instances of {resourceType} across all namespaces | - -The API server verifies the *Namespace* on resource creation matches the *{namespace}* on the path. - -The API server will associate a resource with a *Namespace* if not populated by the end-user based on the *Namespace* context -of the incoming request. If the *Namespace* of the resource being created, or updated does not match the *Namespace* on the request, -then the API server will reject the request. - -### Storage - -A namespace provides a unique identifier space and therefore must be in the storage path of a resource. - -In etcd, we want to continue to still support efficient WATCH across namespaces. - -Resources that persist content in etcd will have storage paths as follows: - -/{k8s_storage_prefix}/{resourceType}/{resource.Namespace}/{resource.Name} - -This enables consumers to WATCH /registry/{resourceType} for changes across namespace of a particular {resourceType}. - -### Kubelet - -The kubelet will register pod's it sources from a file or http source with a namespace associated with the -*cluster-id* - -### Example: OpenShift Origin managing a Kubernetes Namespace - -In this example, we demonstrate how the design allows for agents built on-top of -Kubernetes that manage their own set of resource types associated with a *Namespace* -to take part in Namespace termination. - -OpenShift creates a Namespace in Kubernetes - -``` -{ - "apiVersion":"v1", - "kind": "Namespace", - "metadata": { - "name": "development", - }, - "spec": { - "finalizers": ["openshift.com/origin", "kubernetes"], - }, - "status": { - "phase": "Active", - }, - "labels": { - "name": "development" - }, -} -``` - -OpenShift then goes and creates a set of resources (pods, services, etc) associated -with the "development" namespace. It also creates its own set of resources in its -own storage associated with the "development" namespace unknown to Kubernetes. - -User deletes the Namespace in Kubernetes, and Namespace now has following state: - -``` -{ - "apiVersion":"v1", - "kind": "Namespace", - "metadata": { - "name": "development", - "deletionTimestamp": "..." - }, - "spec": { - "finalizers": ["openshift.com/origin", "kubernetes"], - }, - "status": { - "phase": "Terminating", - }, - "labels": { - "name": "development" - }, -} -``` - -The Kubernetes *namespace controller* observes the namespace has a *deletionTimestamp* -and begins to terminate all of the content in the namespace that it knows about. Upon -success, it executes a *finalize* action that modifies the *Namespace* by -removing *kubernetes* from the list of finalizers: - -``` -{ - "apiVersion":"v1", - "kind": "Namespace", - "metadata": { - "name": "development", - "deletionTimestamp": "..." - }, - "spec": { - "finalizers": ["openshift.com/origin"], - }, - "status": { - "phase": "Terminating", - }, - "labels": { - "name": "development" - }, -} -``` - -OpenShift Origin has its own *namespace controller* that is observing cluster state, and -it observes the same namespace had a *deletionTimestamp* assigned to it. It too will go -and purge resources from its own storage that it manages associated with that namespace. -Upon completion, it executes a *finalize* action and removes the reference to "openshift.com/origin" -from the list of finalizers. - -This results in the following state: - -``` -{ - "apiVersion":"v1", - "kind": "Namespace", - "metadata": { - "name": "development", - "deletionTimestamp": "..." - }, - "spec": { - "finalizers": [], - }, - "status": { - "phase": "Terminating", - }, - "labels": { - "name": "development" - }, -} -``` - -At this point, the Kubernetes *namespace controller* in its sync loop will see that the namespace -has a deletion timestamp and that its list of finalizers is empty. As a result, it knows all -content associated from that namespace has been purged. It performs a final DELETE action -to remove that Namespace from the storage. - -At this point, all content associated with that Namespace, and the Namespace itself are gone. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/namespaces.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/namespaces.md?pixel)]() diff --git a/release-0.19.0/docs/design/networking.md b/release-0.19.0/docs/design/networking.md deleted file mode 100644 index 2bbfba40dbd..00000000000 --- a/release-0.19.0/docs/design/networking.md +++ /dev/null @@ -1,114 +0,0 @@ -# Networking - -## Model and motivation - -Kubernetes deviates from the default Docker networking model. The goal is for each pod to have an IP in a flat shared networking namespace that has full communication with other physical computers and containers across the network. IP-per-pod creates a clean, backward-compatible model where pods can be treated much like VMs or physical hosts from the perspectives of port allocation, networking, naming, service discovery, load balancing, application configuration, and migration. - -OTOH, dynamic port allocation requires supporting both static ports (e.g., for externally accessible services) and dynamically allocated ports, requires partitioning centrally allocated and locally acquired dynamic ports, complicates scheduling (since ports are a scarce resource), is inconvenient for users, complicates application configuration, is plagued by port conflicts and reuse and exhaustion, requires non-standard approaches to naming (e.g., etcd rather than DNS), requires proxies and/or redirection for programs using standard naming/addressing mechanisms (e.g., web browsers), requires watching and cache invalidation for address/port changes for instances in addition to watching group membership changes, and obstructs container/pod migration (e.g., using CRIU). NAT introduces additional complexity by fragmenting the addressing space, which breaks self-registration mechanisms, among other problems. - -With the IP-per-pod model, all user containers within a pod behave as if they are on the same host with regard to networking. They can all reach each other’s ports on localhost. Ports which are published to the host interface are done so in the normal Docker way. All containers in all pods can talk to all other containers in all other pods by their 10-dot addresses. - -In addition to avoiding the aforementioned problems with dynamic port allocation, this approach reduces friction for applications moving from the world of uncontainerized apps on physical or virtual hosts to containers within pods. People running application stacks together on the same host have already figured out how to make ports not conflict (e.g., by configuring them through environment variables) and have arranged for clients to find them. - -The approach does reduce isolation between containers within a pod -- ports could conflict, and there couldn't be private ports across containers within a pod, but applications requiring their own port spaces could just run as separate pods and processes requiring private communication could run within the same container. Besides, the premise of pods is that containers within a pod share some resources (volumes, cpu, ram, etc.) and therefore expect and tolerate reduced isolation. Additionally, the user can control what containers belong to the same pod whereas, in general, they don't control what pods land together on a host. - -When any container calls SIOCGIFADDR, it sees the IP that any peer container would see them coming from -- each pod has its own IP address that other pods can know. By making IP addresses and ports the same within and outside the containers and pods, we create a NAT-less, flat address space. "ip addr show" should work as expected. This would enable all existing naming/discovery mechanisms to work out of the box, including self-registration mechanisms and applications that distribute IP addresses. (We should test that with etcd and perhaps one other option, such as Eureka (used by Acme Air) or Consul.) We should be optimizing for inter-pod network communication. Within a pod, containers are more likely to use communication through volumes (e.g., tmpfs) or IPC. - -This is different from the standard Docker model. In that mode, each container gets an IP in the 172-dot space and would only see that 172-dot address from SIOCGIFADDR. If these containers connect to another container the peer would see the connect coming from a different IP than the container itself knows. In short - you can never self-register anything from a container, because a container can not be reached on its private IP. - -An alternative we considered was an additional layer of addressing: pod-centric IP per container. Each container would have its own local IP address, visible only within that pod. This would perhaps make it easier for containerized applications to move from physical/virtual hosts to pods, but would be more complex to implement (e.g., requiring a bridge per pod, split-horizon/VP DNS) and to reason about, due to the additional layer of address translation, and would break self-registration and IP distribution mechanisms. - -## Current implementation - -For the Google Compute Engine cluster configuration scripts, [advanced routing](https://developers.google.com/compute/docs/networking#routing) is set up so that each VM has an extra 256 IP addresses that get routed to it. This is in addition to the 'main' IP address assigned to the VM that is NAT-ed for Internet access. The networking bridge (called `cbr0` to differentiate it from `docker0`) is set up outside of Docker proper and only does NAT for egress network traffic that isn't aimed at the virtual network. - -Ports mapped in from the 'main IP' (and hence the internet if the right firewall rules are set up) are proxied in user mode by Docker. In the future, this should be done with `iptables` by either the Kubelet or Docker: [Issue #15](https://github.com/GoogleCloudPlatform/kubernetes/issues/15). - -We start Docker with: - DOCKER_OPTS="--bridge cbr0 --iptables=false" - -We set up this bridge on each node with SaltStack, in [container_bridge.py](cluster/saltbase/salt/_states/container_bridge.py). - - cbr0: - container_bridge.ensure: - - cidr: {{ grains['cbr-cidr'] }} - ... - grains: - roles: - - kubernetes-pool - cbr-cidr: $MINION_IP_RANGE - -We make these addresses routable in GCE: - - gcloud compute routes add "${MINION_NAMES[$i]}" \ - --project "${PROJECT}" \ - --destination-range "${MINION_IP_RANGES[$i]}" \ - --network "${NETWORK}" \ - --next-hop-instance "${MINION_NAMES[$i]}" \ - --next-hop-instance-zone "${ZONE}" & - -The minion IP ranges are /24s in the 10-dot space. - -GCE itself does not know anything about these IPs, though. - -These are not externally routable, though, so containers that need to communicate with the outside world need to use host networking. To set up an external IP that forwards to the VM, it will only forward to the VM's primary IP (which is assigned to no pod). So we use docker's -p flag to map published ports to the main interface. This has the side effect of disallowing two pods from exposing the same port. (More discussion on this in [Issue #390](https://github.com/GoogleCloudPlatform/kubernetes/issues/390).) - -We create a container to use for the pod network namespace -- a single loopback device and a single veth device. All the user's containers get their network namespaces from this pod networking container. - -Docker allocates IP addresses from a bridge we create on each node, using its “container†networking mode. - -1. Create a normal (in the networking sense) container which uses a minimal image and runs a command that blocks forever. This is not a user-defined container, and gets a special well-known name. - - creates a new network namespace (netns) and loopback device - - creates a new pair of veth devices and binds them to the netns - - auto-assigns an IP from docker’s IP range - -2. Create the user containers and specify the name of the pod infra container as their “POD†argument. Docker finds the PID of the command running in the pod infra container and attaches to the netns and ipcns of that PID. - -### Other networking implementation examples -With the primary aim of providing IP-per-pod-model, other implementations exist to serve the purpose outside of GCE. - - [OpenVSwitch with GRE/VxLAN](../ovs-networking.md) - - [Flannel](https://github.com/coreos/flannel#flannel) - -## Challenges and future work - -### Docker API - -Right now, docker inspect doesn't show the networking configuration of the containers, since they derive it from another container. That information should be exposed somehow. - -### External IP assignment - -We want to be able to assign IP addresses externally from Docker ([Docker issue #6743](https://github.com/dotcloud/docker/issues/6743)) so that we don't need to statically allocate fixed-size IP ranges to each node, so that IP addresses can be made stable across pod infra container restarts ([Docker issue #2801](https://github.com/dotcloud/docker/issues/2801)), and to facilitate pod migration. Right now, if the pod infra container dies, all the user containers must be stopped and restarted because the netns of the pod infra container will change on restart, and any subsequent user container restart will join that new netns, thereby not being able to see its peers. Additionally, a change in IP address would encounter DNS caching/TTL problems. External IP assignment would also simplify DNS support (see below). - -### Naming, discovery, and load balancing - -In addition to enabling self-registration with 3rd-party discovery mechanisms, we'd like to setup DDNS automatically ([Issue #146](https://github.com/GoogleCloudPlatform/kubernetes/issues/146)). hostname, $HOSTNAME, etc. should return a name for the pod ([Issue #298](https://github.com/GoogleCloudPlatform/kubernetes/issues/298)), and gethostbyname should be able to resolve names of other pods. Probably we need to set up a DNS resolver to do the latter ([Docker issue #2267](https://github.com/dotcloud/docker/issues/2267)), so that we don't need to keep /etc/hosts files up to date dynamically. - -[Service](http://docs.k8s.io/services.md) endpoints are currently found through environment variables. Both [Docker-links-compatible](https://docs.docker.com/userguide/dockerlinks/) variables and kubernetes-specific variables ({NAME}_SERVICE_HOST and {NAME}_SERVICE_BAR) are supported, and resolve to ports opened by the service proxy. We don't actually use [the Docker ambassador pattern](https://docs.docker.com/articles/ambassador_pattern_linking/) to link containers because we don't require applications to identify all clients at configuration time, yet. While services today are managed by the service proxy, this is an implementation detail that applications should not rely on. Clients should instead use the [service IP](http://docs.k8s.io/services.md) (which the above environment variables will resolve to). However, a flat service namespace doesn't scale and environment variables don't permit dynamic updates, which complicates service deployment by imposing implicit ordering constraints. We intend to register each service's IP in DNS, and for that to become the preferred resolution protocol. - -We'd also like to accommodate other load-balancing solutions (e.g., HAProxy), non-load-balanced services ([Issue #260](https://github.com/GoogleCloudPlatform/kubernetes/issues/260)), and other types of groups (worker pools, etc.). Providing the ability to Watch a label selector applied to pod addresses would enable efficient monitoring of group membership, which could be directly consumed or synced with a discovery mechanism. Event hooks ([Issue #140](https://github.com/GoogleCloudPlatform/kubernetes/issues/140)) for join/leave events would probably make this even easier. - -### External routability - -We want traffic between containers to use the pod IP addresses across nodes. Say we have Node A with a container IP space of 10.244.1.0/24 and Node B with a container IP space of 10.244.2.0/24. And we have Container A1 at 10.244.1.1 and Container B1 at 10.244.2.1. We want Container A1 to talk to Container B1 directly with no NAT. B1 should see the "source" in the IP packets of 10.244.1.1 -- not the "primary" host IP for Node A. That means that we want to turn off NAT for traffic between containers (and also between VMs and containers). - -We'd also like to make pods directly routable from the external internet. However, we can't yet support the extra container IPs that we've provisioned talking to the internet directly. So, we don't map external IPs to the container IPs. Instead, we solve that problem by having traffic that isn't to the internal network (! 10.0.0.0/8) get NATed through the primary host IP address so that it can get 1:1 NATed by the GCE networking when talking to the internet. Similarly, incoming traffic from the internet has to get NATed/proxied through the host IP. - -So we end up with 3 cases: - -1. Container -> Container or Container <-> VM. These should use 10. addresses directly and there should be no NAT. - -2. Container -> Internet. These have to get mapped to the primary host IP so that GCE knows how to egress that traffic. There is actually 2 layers of NAT here: Container IP -> Internal Host IP -> External Host IP. The first level happens in the guest with IP tables and the second happens as part of GCE networking. The first one (Container IP -> internal host IP) does dynamic port allocation while the second maps ports 1:1. - -3. Internet -> Container. This also has to go through the primary host IP and also has 2 levels of NAT, ideally. However, the path currently is a proxy with (External Host IP -> Internal Host IP -> Docker) -> (Docker -> Container IP). Once [issue #15](https://github.com/GoogleCloudPlatform/kubernetes/issues/15) is closed, it should be External Host IP -> Internal Host IP -> Container IP. But to get that second arrow we have to set up the port forwarding iptables rules per mapped port. - -Another approach could be to create a new host interface alias for each pod, if we had a way to route an external IP to it. This would eliminate the scheduling constraints resulting from using the host's IP address. - -### IPv6 - -IPv6 would be a nice option, also, but we can't depend on it yet. Docker support is in progress: [Docker issue #2974](https://github.com/dotcloud/docker/issues/2974), [Docker issue #6923](https://github.com/dotcloud/docker/issues/6923), [Docker issue #6975](https://github.com/dotcloud/docker/issues/6975). Additionally, direct ipv6 assignment to instances doesn't appear to be supported by major cloud providers (e.g., AWS EC2, GCE) yet. We'd happily take pull requests from people running Kubernetes on bare metal, though. :-) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/networking.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/networking.md?pixel)]() diff --git a/release-0.19.0/docs/design/persistent-storage.md b/release-0.19.0/docs/design/persistent-storage.md deleted file mode 100644 index aadd5b7391e..00000000000 --- a/release-0.19.0/docs/design/persistent-storage.md +++ /dev/null @@ -1,220 +0,0 @@ -# Persistent Storage - -This document proposes a model for managing persistent, cluster-scoped storage for applications requiring long lived data. - -### tl;dr - -Two new API kinds: - -A `PersistentVolume` (PV) is a storage resource provisioned by an administrator. It is analogous to a node. - -A `PersistentVolumeClaim` (PVC) is a user's request for a persistent volume to use in a pod. It is analogous to a pod. - -One new system component: - -`PersistentVolumeClaimBinder` is a singleton running in master that watches all PersistentVolumeClaims in the system and binds them to the closest matching available PersistentVolume. The volume manager watches the API for newly created volumes to manage. - -One new volume: - -`PersistentVolumeClaimVolumeSource` references the user's PVC in the same namespace. This volume finds the bound PV and mounts that volume for the pod. A `PersistentVolumeClaimVolumeSource` is, essentially, a wrapper around another type of volume that is owned by someone else (the system). - -Kubernetes makes no guarantees at runtime that the underlying storage exists or is available. High availability is left to the storage provider. - -### Goals - -* Allow administrators to describe available storage -* Allow pod authors to discover and request persistent volumes to use with pods -* Enforce security through access control lists and securing storage to the same namespace as the pod volume -* Enforce quotas through admission control -* Enforce scheduler rules by resource counting -* Ensure developers can rely on storage being available without being closely bound to a particular disk, server, network, or storage device. - - -#### Describe available storage - -Cluster administrators use the API to manage *PersistentVolumes*. A custom store ```NewPersistentVolumeOrderedIndex``` will index volumes by access modes and sort by storage capacity. The ```PersistentVolumeClaimBinder``` watches for new claims for storage and binds them to an available volume by matching the volume's characteristics (AccessModes and storage size) to the user's request. - -PVs are system objects and, thus, have no namespace. - -Many means of dynamic provisioning will be eventually be implemented for various storage types. - - -##### PersistentVolume API - -| Action | HTTP Verb | Path | Description | -| ---- | ---- | ---- | ---- | -| CREATE | POST | /api/{version}/persistentvolumes/ | Create instance of PersistentVolume | -| GET | GET | /api/{version}persistentvolumes/{name} | Get instance of PersistentVolume with {name} | -| UPDATE | PUT | /api/{version}/persistentvolumes/{name} | Update instance of PersistentVolume with {name} | -| DELETE | DELETE | /api/{version}/persistentvolumes/{name} | Delete instance of PersistentVolume with {name} | -| LIST | GET | /api/{version}/persistentvolumes | List instances of PersistentVolume | -| WATCH | GET | /api/{version}/watch/persistentvolumes | Watch for changes to a PersistentVolume | - - -#### Request Storage - -Kubernetes users request persistent storage for their pod by creating a ```PersistentVolumeClaim```. Their request for storage is described by their requirements for resources and mount capabilities. - -Requests for volumes are bound to available volumes by the volume manager, if a suitable match is found. Requests for resources can go unfulfilled. - -Users attach their claim to their pod using a new ```PersistentVolumeClaimVolumeSource``` volume source. - - -##### PersistentVolumeClaim API - - -| Action | HTTP Verb | Path | Description | -| ---- | ---- | ---- | ---- | -| CREATE | POST | /api/{version}/namespaces/{ns}/persistentvolumeclaims/ | Create instance of PersistentVolumeClaim in namespace {ns} | -| GET | GET | /api/{version}/namespaces/{ns}/persistentvolumeclaims/{name} | Get instance of PersistentVolumeClaim in namespace {ns} with {name} | -| UPDATE | PUT | /api/{version}/namespaces/{ns}/persistentvolumeclaims/{name} | Update instance of PersistentVolumeClaim in namespace {ns} with {name} | -| DELETE | DELETE | /api/{version}/namespaces/{ns}/persistentvolumeclaims/{name} | Delete instance of PersistentVolumeClaim in namespace {ns} with {name} | -| LIST | GET | /api/{version}/namespaces/{ns}/persistentvolumeclaims | List instances of PersistentVolumeClaim in namespace {ns} | -| WATCH | GET | /api/{version}/watch/namespaces/{ns}/persistentvolumeclaims | Watch for changes to PersistentVolumeClaim in namespace {ns} | - - - -#### Scheduling constraints - -Scheduling constraints are to be handled similar to pod resource constraints. Pods will need to be annotated or decorated with the number of resources it requires on a node. Similarly, a node will need to list how many it has used or available. - -TBD - - -#### Events - -The implementation of persistent storage will not require events to communicate to the user the state of their claim. The CLI for bound claims contains a reference to the backing persistent volume. This is always present in the API and CLI, making an event to communicate the same unnecessary. - -Events that communicate the state of a mounted volume are left to the volume plugins. - - -### Example - -#### Admin provisions storage - -An administrator provisions storage by posting PVs to the API. Various way to automate this task can be scripted. Dynamic provisioning is a future feature that can maintain levels of PVs. - -``` -POST: - -kind: PersistentVolume -apiVersion: v1 -metadata: - name: pv0001 -spec: - capacity: - storage: 10 - persistentDisk: - pdName: "abc123" - fsType: "ext4" - --------------------------------------------------- - -kubectl get pv - -NAME LABELS CAPACITY ACCESSMODES STATUS CLAIM -pv0001 map[] 10737418240 RWO Pending - - -``` - -#### Users request storage - -A user requests storage by posting a PVC to the API. Their request contains the AccessModes they wish their volume to have and the minimum size needed. - -The user must be within a namespace to create PVCs. - -``` - -POST: -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: - name: myclaim-1 -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 3 - --------------------------------------------------- - -kubectl get pvc - - -NAME LABELS STATUS VOLUME -myclaim-1 map[] pending - -``` - - -#### Matching and binding - - The ```PersistentVolumeClaimBinder``` attempts to find an available volume that most closely matches the user's request. If one exists, they are bound by putting a reference on the PV to the PVC. Requests can go unfulfilled if a suitable match is not found. - -``` - -kubectl get pv - -NAME LABELS CAPACITY ACCESSMODES STATUS CLAIM -pv0001 map[] 10737418240 RWO Bound myclaim-1 / f4b3d283-c0ef-11e4-8be4-80e6500a981e - - -kubectl get pvc - -NAME LABELS STATUS VOLUME -myclaim-1 map[] Bound b16e91d6-c0ef-11e4-8be4-80e6500a981e - - -``` - -#### Claim usage - -The claim holder can use their claim as a volume. The ```PersistentVolumeClaimVolumeSource``` knows to fetch the PV backing the claim and mount its volume for a pod. - -The claim holder owns the claim and its data for as long as the claim exists. The pod using the claim can be deleted, but the claim remains in the user's namespace. It can be used again and again by many pods. - -``` -POST: - -kind: Pod -apiVersion: v1 -metadata: - name: mypod -spec: - containers: - - image: nginx - name: myfrontend - volumeMounts: - - mountPath: "/var/www/html" - name: mypd - volumes: - - name: mypd - source: - persistentVolumeClaim: - accessMode: ReadWriteOnce - claimRef: - name: myclaim-1 - -``` - -#### Releasing a claim and Recycling a volume - -When a claim holder is finished with their data, they can delete their claim. - -``` - -kubectl delete pvc myclaim-1 - -``` - -The ```PersistentVolumeClaimBinder``` will reconcile this by removing the claim reference from the PV and change the PVs status to 'Released'. - -Admins can script the recycling of released volumes. Future dynamic provisioners will understand how a volume should be recycled. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/persistent-storage.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/persistent-storage.md?pixel)]() diff --git a/release-0.19.0/docs/design/principles.md b/release-0.19.0/docs/design/principles.md deleted file mode 100644 index 8a596cd78bf..00000000000 --- a/release-0.19.0/docs/design/principles.md +++ /dev/null @@ -1,61 +0,0 @@ -# Design Principles - -Principles to follow when extending Kubernetes. - -## API - -See also the [API conventions](../api-conventions.md). - -* All APIs should be declarative. -* API objects should be complementary and composable, not opaque wrappers. -* The control plane should be transparent -- there are no hidden internal APIs. -* The cost of API operations should be proportional to the number of objects intentionally operated upon. Therefore, common filtered lookups must be indexed. Beware of patterns of multiple API calls that would incur quadratic behavior. -* Object status must be 100% reconstructable by observation. Any history kept must be just an optimization and not required for correct operation. -* Cluster-wide invariants are difficult to enforce correctly. Try not to add them. If you must have them, don't enforce them atomically in master components, that is contention-prone and doesn't provide a recovery path in the case of a bug allowing the invariant to be violated. Instead, provide a series of checks to reduce the probability of a violation, and make every component involved able to recover from an invariant violation. -* Low-level APIs should be designed for control by higher-level systems. Higher-level APIs should be intent-oriented (think SLOs) rather than implementation-oriented (think control knobs). - -## Control logic - -* Functionality must be *level-based*, meaning the system must operate correctly given the desired state and the current/observed state, regardless of how many intermediate state updates may have been missed. Edge-triggered behavior must be just an optimization. -* Assume an open world: continually verify assumptions and gracefully adapt to external events and/or actors. Example: we allow users to kill pods under control of a replication controller; it just replaces them. -* Do not define comprehensive state machines for objects with behaviors associated with state transitions and/or "assumed" states that cannot be ascertained by observation. -* Don't assume a component's decisions will not be overridden or rejected, nor for the component to always understand why. For example, etcd may reject writes. Kubelet may reject pods. The scheduler may not be able to schedule pods. Retry, but back off and/or make alternative decisions. -* Components should be self-healing. For example, if you must keep some state (e.g., cache) the content needs to be periodically refreshed, so that if an item does get erroneously stored or a deletion event is missed etc, it will be soon fixed, ideally on timescales that are shorter than what will attract attention from humans. -* Component behavior should degrade gracefully. Prioritize actions so that the most important activities can continue to function even when overloaded and/or in states of partial failure. - -## Architecture - -* Only the apiserver should communicate with etcd/store, and not other components (scheduler, kubelet, etc.). -* Compromising a single node shouldn't compromise the cluster. -* Components should continue to do what they were last told in the absence of new instructions (e.g., due to network partition or component outage). -* All components should keep all relevant state in memory all the time. The apiserver should write through to etcd/store, other components should write through to the apiserver, and they should watch for updates made by other clients. -* Watch is preferred over polling. - -## Extensibility - -TODO: pluggability - -## Bootstrapping - -* [Self-hosting](https://github.com/GoogleCloudPlatform/kubernetes/issues/246) of all components is a goal. -* Minimize the number of dependencies, particularly those required for steady-state operation. -* Stratify the dependencies that remain via principled layering. -* Break any circular dependencies by converting hard dependencies to soft dependencies. - * Also accept that data from other components from another source, such as local files, which can then be manually populated at bootstrap time and then continuously updated once those other components are available. - * State should be rediscoverable and/or reconstructable. - * Make it easy to run temporary, bootstrap instances of all components in order to create the runtime state needed to run the components in the steady state; use a lock (master election for distributed components, file lock for local components like Kubelet) to coordinate handoff. We call this technique "pivoting". - * Have a solution to restart dead components. For distributed components, replication works well. For local components such as Kubelet, a process manager or even a simple shell loop works. - -## Availability - -TODO - -## General principles - -* [Eric Raymond's 17 UNIX rules](https://en.wikipedia.org/wiki/Unix_philosophy#Eric_Raymond.E2.80.99s_17_Unix_Rules) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/principles.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/principles.md?pixel)]() diff --git a/release-0.19.0/docs/design/secrets.md b/release-0.19.0/docs/design/secrets.md deleted file mode 100644 index c339b181c17..00000000000 --- a/release-0.19.0/docs/design/secrets.md +++ /dev/null @@ -1,581 +0,0 @@ - -## Abstract - -A proposal for the distribution of secrets (passwords, keys, etc) to the Kubelet and to -containers inside Kubernetes using a custom volume type. - -## Motivation - -Secrets are needed in containers to access internal resources like the Kubernetes master or -external resources such as git repositories, databases, etc. Users may also want behaviors in the -kubelet that depend on secret data (credentials for image pull from a docker registry) associated -with pods. - -Goals of this design: - -1. Describe a secret resource -2. Define the various challenges attendant to managing secrets on the node -3. Define a mechanism for consuming secrets in containers without modification - -## Constraints and Assumptions - -* This design does not prescribe a method for storing secrets; storage of secrets should be - pluggable to accommodate different use-cases -* Encryption of secret data and node security are orthogonal concerns -* It is assumed that node and master are secure and that compromising their security could also - compromise secrets: - * If a node is compromised, the only secrets that could potentially be exposed should be the - secrets belonging to containers scheduled onto it - * If the master is compromised, all secrets in the cluster may be exposed -* Secret rotation is an orthogonal concern, but it should be facilitated by this proposal -* A user who can consume a secret in a container can know the value of the secret; secrets must - be provisioned judiciously - -## Use Cases - -1. As a user, I want to store secret artifacts for my applications and consume them securely in - containers, so that I can keep the configuration for my applications separate from the images - that use them: - 1. As a cluster operator, I want to allow a pod to access the Kubernetes master using a custom - `.kubeconfig` file, so that I can securely reach the master - 2. As a cluster operator, I want to allow a pod to access a Docker registry using credentials - from a `.dockercfg` file, so that containers can push images - 3. As a cluster operator, I want to allow a pod to access a git repository using SSH keys, - so that I can push and fetch to and from the repository -2. As a user, I want to allow containers to consume supplemental information about services such - as username and password which should be kept secret, so that I can share secrets about a - service amongst the containers in my application securely -3. As a user, I want to associate a pod with a `ServiceAccount` that consumes a secret and have - the kubelet implement some reserved behaviors based on the types of secrets the service account - consumes: - 1. Use credentials for a docker registry to pull the pod's docker image - 2. Present kubernetes auth token to the pod or transparently decorate traffic between the pod - and master service -4. As a user, I want to be able to indicate that a secret expires and for that secret's value to - be rotated once it expires, so that the system can help me follow good practices - -### Use-Case: Configuration artifacts - -Many configuration files contain secrets intermixed with other configuration information. For -example, a user's application may contain a properties file than contains database credentials, -SaaS API tokens, etc. Users should be able to consume configuration artifacts in their containers -and be able to control the path on the container's filesystems where the artifact will be -presented. - -### Use-Case: Metadata about services - -Most pieces of information about how to use a service are secrets. For example, a service that -provides a MySQL database needs to provide the username, password, and database name to consumers -so that they can authenticate and use the correct database. Containers in pods consuming the MySQL -service would also consume the secrets associated with the MySQL service. - -### Use-Case: Secrets associated with service accounts - -[Service Accounts](http://docs.k8s.io/design/service_accounts.md) are proposed as a -mechanism to decouple capabilities and security contexts from individual human users. A -`ServiceAccount` contains references to some number of secrets. A `Pod` can specify that it is -associated with a `ServiceAccount`. Secrets should have a `Type` field to allow the Kubelet and -other system components to take action based on the secret's type. - -#### Example: service account consumes auth token secret - -As an example, the service account proposal discusses service accounts consuming secrets which -contain kubernetes auth tokens. When a Kubelet starts a pod associated with a service account -which consumes this type of secret, the Kubelet may take a number of actions: - -1. Expose the secret in a `.kubernetes_auth` file in a well-known location in the container's - file system -2. Configure that node's `kube-proxy` to decorate HTTP requests from that pod to the - `kubernetes-master` service with the auth token, e. g. by adding a header to the request - (see the [LOAS Daemon](https://github.com/GoogleCloudPlatform/kubernetes/issues/2209) proposal) - -#### Example: service account consumes docker registry credentials - -Another example use case is where a pod is associated with a secret containing docker registry -credentials. The Kubelet could use these credentials for the docker pull to retrieve the image. - -### Use-Case: Secret expiry and rotation - -Rotation is considered a good practice for many types of secret data. It should be possible to -express that a secret has an expiry date; this would make it possible to implement a system -component that could regenerate expired secrets. As an example, consider a component that rotates -expired secrets. The rotator could periodically regenerate the values for expired secrets of -common types and update their expiry dates. - -## Deferral: Consuming secrets as environment variables - -Some images will expect to receive configuration items as environment variables instead of files. -We should consider what the best way to allow this is; there are a few different options: - -1. Force the user to adapt files into environment variables. Users can store secrets that need to - be presented as environment variables in a format that is easy to consume from a shell: - - $ cat /etc/secrets/my-secret.txt - export MY_SECRET_ENV=MY_SECRET_VALUE - - The user could `source` the file at `/etc/secrets/my-secret` prior to executing the command for - the image either inline in the command or in an init script, - -2. Give secrets an attribute that allows users to express the intent that the platform should - generate the above syntax in the file used to present a secret. The user could consume these - files in the same manner as the above option. - -3. Give secrets attributes that allow the user to express that the secret should be presented to - the container as an environment variable. The container's environment would contain the - desired values and the software in the container could use them without accommodation the - command or setup script. - -For our initial work, we will treat all secrets as files to narrow the problem space. There will -be a future proposal that handles exposing secrets as environment variables. - -## Flow analysis of secret data with respect to the API server - -There are two fundamentally different use-cases for access to secrets: - -1. CRUD operations on secrets by their owners -2. Read-only access to the secrets needed for a particular node by the kubelet - -### Use-Case: CRUD operations by owners - -In use cases for CRUD operations, the user experience for secrets should be no different than for -other API resources. - -#### Data store backing the REST API - -The data store backing the REST API should be pluggable because different cluster operators will -have different preferences for the central store of secret data. Some possibilities for storage: - -1. An etcd collection alongside the storage for other API resources -2. A collocated [HSM](http://en.wikipedia.org/wiki/Hardware_security_module) -3. An external datastore such as an external etcd, RDBMS, etc. - -#### Size limit for secrets - -There should be a size limit for secrets in order to: - -1. Prevent DOS attacks against the API server -2. Allow kubelet implementations that prevent secret data from touching the node's filesystem - -The size limit should satisfy the following conditions: - -1. Large enough to store common artifact types (encryption keypairs, certificates, small - configuration files) -2. Small enough to avoid large impact on node resource consumption (storage, RAM for tmpfs, etc) - -To begin discussion, we propose an initial value for this size limit of **1MB**. - -#### Other limitations on secrets - -Defining a policy for limitations on how a secret may be referenced by another API resource and how -constraints should be applied throughout the cluster is tricky due to the number of variables -involved: - -1. Should there be a maximum number of secrets a pod can reference via a volume? -2. Should there be a maximum number of secrets a service account can reference? -3. Should there be a total maximum number of secrets a pod can reference via its own spec and its - associated service account? -4. Should there be a total size limit on the amount of secret data consumed by a pod? -5. How will cluster operators want to be able to configure these limits? -6. How will these limits impact API server validations? -7. How will these limits affect scheduling? - -For now, we will not implement validations around these limits. Cluster operators will decide how -much node storage is allocated to secrets. It will be the operator's responsibility to ensure that -the allocated storage is sufficient for the workload scheduled onto a node. - -For now, kubelets will only attach secrets to api-sourced pods, and not file- or http-sourced -ones. Doing so would: - - confuse the secrets admission controller in the case of mirror pods. - - create an apiserver-liveness dependency -- avoiding this dependency is a main reason to use non-api-source pods. - -### Use-Case: Kubelet read of secrets for node - -The use-case where the kubelet reads secrets has several additional requirements: - -1. Kubelets should only be able to receive secret data which is required by pods scheduled onto - the kubelet's node -2. Kubelets should have read-only access to secret data -3. Secret data should not be transmitted over the wire insecurely -4. Kubelets must ensure pods do not have access to each other's secrets - -#### Read of secret data by the Kubelet - -The Kubelet should only be allowed to read secrets which are consumed by pods scheduled onto that -Kubelet's node and their associated service accounts. Authorization of the Kubelet to read this -data would be delegated to an authorization plugin and associated policy rule. - -#### Secret data on the node: data at rest - -Consideration must be given to whether secret data should be allowed to be at rest on the node: - -1. If secret data is not allowed to be at rest, the size of secret data becomes another draw on - the node's RAM - should it affect scheduling? -2. If secret data is allowed to be at rest, should it be encrypted? - 1. If so, how should be this be done? - 2. If not, what threats exist? What types of secret are appropriate to store this way? - -For the sake of limiting complexity, we propose that initially secret data should not be allowed -to be at rest on a node; secret data should be stored on a node-level tmpfs filesystem. This -filesystem can be subdivided into directories for use by the kubelet and by the volume plugin. - -#### Secret data on the node: resource consumption - -The Kubelet will be responsible for creating the per-node tmpfs file system for secret storage. -It is hard to make a prescriptive declaration about how much storage is appropriate to reserve for -secrets because different installations will vary widely in available resources, desired pod to -node density, overcommit policy, and other operation dimensions. That being the case, we propose -for simplicity that the amount of secret storage be controlled by a new parameter to the kubelet -with a default value of **64MB**. It is the cluster operator's responsibility to handle choosing -the right storage size for their installation and configuring their Kubelets correctly. - -Configuring each Kubelet is not the ideal story for operator experience; it is more intuitive that -the cluster-wide storage size be readable from a central configuration store like the one proposed -in [#1553](https://github.com/GoogleCloudPlatform/kubernetes/issues/1553). When such a store -exists, the Kubelet could be modified to read this configuration item from the store. - -When the Kubelet is modified to advertise node resources (as proposed in -[#4441](https://github.com/GoogleCloudPlatform/kubernetes/issues/4441)), the capacity calculation -for available memory should factor in the potential size of the node-level tmpfs in order to avoid -memory overcommit on the node. - -#### Secret data on the node: isolation - -Every pod will have a [security context](http://docs.k8s.io/design/security_context.md). -Secret data on the node should be isolated according to the security context of the container. The -Kubelet volume plugin API will be changed so that a volume plugin receives the security context of -a volume along with the volume spec. This will allow volume plugins to implement setting the -security context of volumes they manage. - -## Community work: - -Several proposals / upstream patches are notable as background for this proposal: - -1. [Docker vault proposal](https://github.com/docker/docker/issues/10310) -2. [Specification for image/container standardization based on volumes](https://github.com/docker/docker/issues/9277) -3. [Kubernetes service account proposal](http://docs.k8s.io/design/service_accounts.md) -4. [Secrets proposal for docker (1)](https://github.com/docker/docker/pull/6075) -5. [Secrets proposal for docker (2)](https://github.com/docker/docker/pull/6697) - -## Proposed Design - -We propose a new `Secret` resource which is mounted into containers with a new volume type. Secret -volumes will be handled by a volume plugin that does the actual work of fetching the secret and -storing it. Secrets contain multiple pieces of data that are presented as different files within -the secret volume (example: SSH key pair). - -In order to remove the burden from the end user in specifying every file that a secret consists of, -it should be possible to mount all files provided by a secret with a single ```VolumeMount``` entry -in the container specification. - -### Secret API Resource - -A new resource for secrets will be added to the API: - -```go -type Secret struct { - TypeMeta - ObjectMeta - - // Data contains the secret data. Each key must be a valid DNS_SUBDOMAIN. - // The serialized form of the secret data is a base64 encoded string, - // representing the arbitrary (possibly non-string) data value here. - Data map[string][]byte `json:"data,omitempty"` - - // Used to facilitate programmatic handling of secret data. - Type SecretType `json:"type,omitempty"` -} - -type SecretType string - -const ( - SecretTypeOpaque SecretType = "Opaque" // Opaque (arbitrary data; default) - SecretTypeKubernetesAuthToken SecretType = "KubernetesAuth" // Kubernetes auth token - SecretTypeDockerRegistryAuth SecretType = "DockerRegistryAuth" // Docker registry auth - // FUTURE: other type values -) - -const MaxSecretSize = 1 * 1024 * 1024 -``` - -A Secret can declare a type in order to provide type information to system components that work -with secrets. The default type is `opaque`, which represents arbitrary user-owned data. - -Secrets are validated against `MaxSecretSize`. The keys in the `Data` field must be valid DNS -subdomains. - -A new REST API and registry interface will be added to accompany the `Secret` resource. The -default implementation of the registry will store `Secret` information in etcd. Future registry -implementations could store the `TypeMeta` and `ObjectMeta` fields in etcd and store the secret -data in another data store entirely, or store the whole object in another data store. - -#### Other validations related to secrets - -Initially there will be no validations for the number of secrets a pod references, or the number of -secrets that can be associated with a service account. These may be added in the future as the -finer points of secrets and resource allocation are fleshed out. - -### Secret Volume Source - -A new `SecretSource` type of volume source will be added to the ```VolumeSource``` struct in the -API: - -```go -type VolumeSource struct { - // Other fields omitted - - // SecretSource represents a secret that should be presented in a volume - SecretSource *SecretSource `json:"secret"` -} - -type SecretSource struct { - Target ObjectReference -} -``` - -Secret volume sources are validated to ensure that the specified object reference actually points -to an object of type `Secret`. - -In the future, the `SecretSource` will be extended to allow: - -1. Fine-grained control over which pieces of secret data are exposed in the volume -2. The paths and filenames for how secret data are exposed - -### Secret Volume Plugin - -A new Kubelet volume plugin will be added to handle volumes with a secret source. This plugin will -require access to the API server to retrieve secret data and therefore the volume `Host` interface -will have to change to expose a client interface: - -```go -type Host interface { - // Other methods omitted - - // GetKubeClient returns a client interface - GetKubeClient() client.Interface -} -``` - -The secret volume plugin will be responsible for: - -1. Returning a `volume.Builder` implementation from `NewBuilder` that: - 1. Retrieves the secret data for the volume from the API server - 2. Places the secret data onto the container's filesystem - 3. Sets the correct security attributes for the volume based on the pod's `SecurityContext` -2. Returning a `volume.Cleaner` implementation from `NewClear` that cleans the volume from the - container's filesystem - -### Kubelet: Node-level secret storage - -The Kubelet must be modified to accept a new parameter for the secret storage size and to create -a tmpfs file system of that size to store secret data. Rough accounting of specific changes: - -1. The Kubelet should have a new field added called `secretStorageSize`; units are megabytes -2. `NewMainKubelet` should accept a value for secret storage size -3. The Kubelet server should have a new flag added for secret storage size -4. The Kubelet's `setupDataDirs` method should be changed to create the secret storage - -### Kubelet: New behaviors for secrets associated with service accounts - -For use-cases where the Kubelet's behavior is affected by the secrets associated with a pod's -`ServiceAccount`, the Kubelet will need to be changed. For example, if secrets of type -`docker-reg-auth` affect how the pod's images are pulled, the Kubelet will need to be changed -to accommodate this. Subsequent proposals can address this on a type-by-type basis. - -## Examples - -For clarity, let's examine some detailed examples of some common use-cases in terms of the -suggested changes. All of these examples are assumed to be created in a namespace called -`example`. - -### Use-Case: Pod with ssh keys - -To create a pod that uses an ssh key stored as a secret, we first need to create a secret: - -```json -{ - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "ssh-key-secret" - }, - "data": { - "id-rsa": "dmFsdWUtMg0KDQo=", - "id-rsa.pub": "dmFsdWUtMQ0K" - } -} -``` - -**Note:** The serialized JSON and YAML values of secret data are encoded as -base64 strings. Newlines are not valid within these strings and must be -omitted. - -Now we can create a pod which references the secret with the ssh key and consumes it in a volume: - -```json -{ - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "secret-test-pod", - "labels": { - "name": "secret-test" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "ssh-key-secret" - } - } - ], - "containers": [ - { - "name": "ssh-test-container", - "image": "mySshImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } -} -``` - -When the container's command runs, the pieces of the key will be available in: - - /etc/secret-volume/id-rsa.pub - /etc/secret-volume/id-rsa - -The container is then free to use the secret data to establish an ssh connection. - -### Use-Case: Pods with pod / test credentials - -This example illustrates a pod which consumes a secret containing prod -credentials and another pod which consumes a secret with test environment -credentials. - -The secrets: - -```json -{ - "apiVersion": "v1", - "kind": "List", - "items": - [{ - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "prod-db-secret" - }, - "data": { - "password": "dmFsdWUtMg0KDQo=", - "username": "dmFsdWUtMQ0K" - } - }, - { - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "test-db-secret" - }, - "data": { - "password": "dmFsdWUtMg0KDQo=", - "username": "dmFsdWUtMQ0K" - } - }] -} -``` - -The pods: - -```json -{ - "apiVersion": "v1", - "kind": "List", - "items": - [{ - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "prod-db-client-pod", - "labels": { - "name": "prod-db-client" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "prod-db-secret" - } - } - ], - "containers": [ - { - "name": "db-client-container", - "image": "myClientImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } - }, - { - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "test-db-client-pod", - "labels": { - "name": "test-db-client" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "test-db-secret" - } - } - ], - "containers": [ - { - "name": "db-client-container", - "image": "myClientImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } - }] -} -``` - -The specs for the two pods differ only in the value of the object referred to by the secret volume -source. Both containers will have the following files present on their filesystems: - - /etc/secret-volume/username - /etc/secret-volume/password - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/secrets.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/secrets.md?pixel)]() diff --git a/release-0.19.0/docs/design/security.md b/release-0.19.0/docs/design/security.md deleted file mode 100644 index 352079cedbc..00000000000 --- a/release-0.19.0/docs/design/security.md +++ /dev/null @@ -1,123 +0,0 @@ -# Security in Kubernetes - -Kubernetes should define a reasonable set of security best practices that allows processes to be isolated from each other, from the cluster infrastructure, and which preserves important boundaries between those who manage the cluster, and those who use the cluster. - -While Kubernetes today is not primarily a multi-tenant system, the long term evolution of Kubernetes will increasingly rely on proper boundaries between users and administrators. The code running on the cluster must be appropriately isolated and secured to prevent malicious parties from affecting the entire cluster. - - -## High Level Goals - -1. Ensure a clear isolation between the container and the underlying host it runs on -2. Limit the ability of the container to negatively impact the infrastructure or other containers -3. [Principle of Least Privilege](http://en.wikipedia.org/wiki/Principle_of_least_privilege) - ensure components are only authorized to perform the actions they need, and limit the scope of a compromise by limiting the capabilities of individual components -4. Reduce the number of systems that have to be hardened and secured by defining clear boundaries between components -5. Allow users of the system to be cleanly separated from administrators -6. Allow administrative functions to be delegated to users where necessary -7. Allow applications to be run on the cluster that have "secret" data (keys, certs, passwords) which is properly abstracted from "public" data. - - -## Use cases - -### Roles: - -We define "user" as a unique identity accessing the Kubernetes API server, which may be a human or an automated process. Human users fall into the following categories: - -1. k8s admin - administers a kubernetes cluster and has access to the undelying components of the system -2. k8s project administrator - administrates the security of a small subset of the cluster -3. k8s developer - launches pods on a kubernetes cluster and consumes cluster resources - -Automated process users fall into the following categories: - -1. k8s container user - a user that processes running inside a container (on the cluster) can use to access other cluster resources indepedent of the human users attached to a project -2. k8s infrastructure user - the user that kubernetes infrastructure components use to perform cluster functions with clearly defined roles - - -### Description of roles: - -* Developers: - * write pod specs. - * making some of their own images, and using some "community" docker images - * know which pods need to talk to which other pods - * decide which pods should share files with other pods, and which should not. - * reason about application level security, such as containing the effects of a local-file-read exploit in a webserver pod. - * do not often reason about operating system or organizational security. - * are not necessarily comfortable reasoning about the security properties of a system at the level of detail of Linux Capabilities, SELinux, AppArmor, etc. - -* Project Admins: - * allocate identity and roles within a namespace - * reason about organizational security within a namespace - * don't give a developer permissions that are not needed for role. - * protect files on shared storage from unnecessary cross-team access - * are less focused about application security - -* Administrators: - * are less focused on application security. Focused on operating system security. - * protect the node from bad actors in containers, and properly-configured innocent containers from bad actors in other containers. - * comfortable reasoning about the security properties of a system at the level of detail of Linux Capabilities, SELinux, AppArmor, etc. - * decides who can use which Linux Capabilities, run privileged containers, use hostDir, etc. - * e.g. a team that manages Ceph or a mysql server might be trusted to have raw access to storage devices in some organizations, but teams that develop the applications at higher layers would not. - - -## Proposed Design - -A pod runs in a *security context* under a *service account* that is defined by an administrator or project administrator, and the *secrets* a pod has access to is limited by that *service account*. - - -1. The API should authenticate and authorize user actions [authn and authz](http://docs.k8s.io/design/access.md) -2. All infrastructure components (kubelets, kube-proxies, controllers, scheduler) should have an infrastructure user that they can authenticate with and be authorized to perform only the functions they require against the API. -3. Most infrastructure components should use the API as a way of exchanging data and changing the system, and only the API should have access to the underlying data store (etcd) -4. When containers run on the cluster and need to talk to other containers or the API server, they should be identified and authorized clearly as an autonomous process via a [service account](http://docs.k8s.io/design/service_accounts.md) - 1. If the user who started a long-lived process is removed from access to the cluster, the process should be able to continue without interruption - 2. If the user who started processes are removed from the cluster, administrators may wish to terminate their processes in bulk - 3. When containers run with a service account, the user that created / triggered the service account behavior must be associated with the container's action -5. When container processes run on the cluster, they should run in a [security context](http://docs.k8s.io/design/security_context.md) that isolates those processes via Linux user security, user namespaces, and permissions. - 1. Administrators should be able to configure the cluster to automatically confine all container processes as a non-root, randomly assigned UID - 2. Administrators should be able to ensure that container processes within the same namespace are all assigned the same unix user UID - 3. Administrators should be able to limit which developers and project administrators have access to higher privilege actions - 4. Project administrators should be able to run pods within a namespace under different security contexts, and developers must be able to specify which of the available security contexts they may use - 5. Developers should be able to run their own images or images from the community and expect those images to run correctly - 6. Developers may need to ensure their images work within higher security requirements specified by administrators - 7. When available, Linux kernel user namespaces can be used to ensure 5.2 and 5.4 are met. - 8. When application developers want to share filesytem data via distributed filesystems, the Unix user ids on those filesystems must be consistent across different container processes -6. Developers should be able to define [secrets](http://docs.k8s.io/design/secrets.md) that are automatically added to the containers when pods are run - 1. Secrets are files injected into the container whose values should not be displayed within a pod. Examples: - 1. An SSH private key for git cloning remote data - 2. A client certificate for accessing a remote system - 3. A private key and certificate for a web server - 4. A .kubeconfig file with embedded cert / token data for accessing the Kubernetes master - 5. A .dockercfg file for pulling images from a protected registry - 2. Developers should be able to define the pod spec so that a secret lands in a specific location - 3. Project administrators should be able to limit developers within a namespace from viewing or modifying secrets (anyone who can launch an arbitrary pod can view secrets) - 4. Secrets are generally not copied from one namespace to another when a developer's application definitions are copied - - -### Related design discussion - -* Authorization and authentication http://docs.k8s.io/design/access.md -* Secret distribution via files https://github.com/GoogleCloudPlatform/kubernetes/pull/2030 -* Docker secrets https://github.com/docker/docker/pull/6697 -* Docker vault https://github.com/docker/docker/issues/10310 -* Service Accounts: http://docs.k8s.io/design/service_accounts.md -* Secret volumes https://github.com/GoogleCloudPlatform/kubernetes/4126 - -## Specific Design Points - -### TODO: authorization, authentication - -### Isolate the data store from the nodes and supporting infrastructure - -Access to the central data store (etcd) in Kubernetes allows an attacker to run arbitrary containers on hosts, to gain access to any protected information stored in either volumes or in pods (such as access tokens or shared secrets provided as environment variables), to intercept and redirect traffic from running services by inserting middlemen, or to simply delete the entire history of the custer. - -As a general principle, access to the central data store should be restricted to the components that need full control over the system and which can apply appropriate authorization and authentication of change requests. In the future, etcd may offer granular access control, but that granularity will require an administrator to understand the schema of the data to properly apply security. An administrator must be able to properly secure Kubernetes at a policy level, rather than at an implementation level, and schema changes over time should not risk unintended security leaks. - -Both the Kubelet and Kube Proxy need information related to their specific roles - for the Kubelet, the set of pods it should be running, and for the Proxy, the set of services and endpoints to load balance. The Kubelet also needs to provide information about running pods and historical termination data. The access pattern for both Kubelet and Proxy to load their configuration is an efficient "wait for changes" request over HTTP. It should be possible to limit the Kubelet and Proxy to only access the information they need to perform their roles and no more. - -The controller manager for Replication Controllers and other future controllers act on behalf of a user via delegation to perform automated maintenance on Kubernetes resources. Their ability to access or modify resource state should be strictly limited to their intended duties and they should be prevented from accessing information not pertinent to their role. For example, a replication controller needs only to create a copy of a known pod configuration, to determine the running state of an existing pod, or to delete an existing pod that it created - it does not need to know the contents or current state of a pod, nor have access to any data in the pods attached volumes. - -The Kubernetes pod scheduler is responsible for reading data from the pod to fit it onto a node in the cluster. At a minimum, it needs access to view the ID of a pod (to craft the binding), its current state, any resource information necessary to identify placement, and other data relevant to concerns like anti-affinity, zone or region preference, or custom logic. It does not need the ability to modify pods or see other resources, only to create bindings. It should not need the ability to delete bindings unless the scheduler takes control of relocating components on failed hosts (which could be implemented by a separate component that can delete bindings but not create them). The scheduler may need read access to user or project-container information to determine preferential location (underspecified at this time). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/security.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/security.md?pixel)]() diff --git a/release-0.19.0/docs/design/security_context.md b/release-0.19.0/docs/design/security_context.md deleted file mode 100644 index 19aff2bb2a2..00000000000 --- a/release-0.19.0/docs/design/security_context.md +++ /dev/null @@ -1,163 +0,0 @@ -# Security Contexts -## Abstract -A security context is a set of constraints that are applied to a container in order to achieve the following goals (from [security design](security.md)): - -1. Ensure a clear isolation between container and the underlying host it runs on -2. Limit the ability of the container to negatively impact the infrastructure or other containers - -## Background - -The problem of securing containers in Kubernetes has come up [before](https://github.com/GoogleCloudPlatform/kubernetes/issues/398) and the potential problems with container security are [well known](http://opensource.com/business/14/7/docker-security-selinux). Although it is not possible to completely isolate Docker containers from their hosts, new features like [user namespaces](https://github.com/docker/libcontainer/pull/304) make it possible to greatly reduce the attack surface. - -## Motivation - -### Container isolation - -In order to improve container isolation from host and other containers running on the host, containers should only be -granted the access they need to perform their work. To this end it should be possible to take advantage of Docker -features such as the ability to [add or remove capabilities](https://docs.docker.com/reference/run/#runtime-privilege-linux-capabilities-and-lxc-configuration) and [assign MCS labels](https://docs.docker.com/reference/run/#security-configuration) -to the container process. - -Support for user namespaces has recently been [merged](https://github.com/docker/libcontainer/pull/304) into Docker's libcontainer project and should soon surface in Docker itself. It will make it possible to assign a range of unprivileged uids and gids from the host to each container, improving the isolation between host and container and between containers. - -### External integration with shared storage -In order to support external integration with shared storage, processes running in a Kubernetes cluster -should be able to be uniquely identified by their Unix UID, such that a chain of ownership can be established. -Processes in pods will need to have consistent UID/GID/SELinux category labels in order to access shared disks. - -## Constraints and Assumptions -* It is out of the scope of this document to prescribe a specific set - of constraints to isolate containers from their host. Different use cases need different - settings. -* The concept of a security context should not be tied to a particular security mechanism or platform - (ie. SELinux, AppArmor) -* Applying a different security context to a scope (namespace or pod) requires a solution such as the one proposed for - [service accounts](./service_accounts.md). - -## Use Cases - -In order of increasing complexity, following are example use cases that would -be addressed with security contexts: - -1. Kubernetes is used to run a single cloud application. In order to protect - nodes from containers: - * All containers run as a single non-root user - * Privileged containers are disabled - * All containers run with a particular MCS label - * Kernel capabilities like CHOWN and MKNOD are removed from containers - -2. Just like case #1, except that I have more than one application running on - the Kubernetes cluster. - * Each application is run in its own namespace to avoid name collisions - * For each application a different uid and MCS label is used - -3. Kubernetes is used as the base for a PAAS with - multiple projects, each project represented by a namespace. - * Each namespace is associated with a range of uids/gids on the node that - are mapped to uids/gids on containers using linux user namespaces. - * Certain pods in each namespace have special privileges to perform system - actions such as talking back to the server for deployment, run docker - builds, etc. - * External NFS storage is assigned to each namespace and permissions set - using the range of uids/gids assigned to that namespace. - -## Proposed Design - -### Overview -A *security context* consists of a set of constraints that determine how a container -is secured before getting created and run. A security context resides on the container and represents the runtime parameters that will -be used to create and run the container via container APIs. A *security context provider* is passed to the Kubelet so it can have a chance -to mutate Docker API calls in order to apply the security context. - -It is recommended that this design be implemented in two phases: - -1. Implement the security context provider extension point in the Kubelet - so that a default security context can be applied on container run and creation. -2. Implement a security context structure that is part of a service account. The - default context provider can then be used to apply a security context based - on the service account associated with the pod. - -### Security Context Provider - -The Kubelet will have an interface that points to a `SecurityContextProvider`. The `SecurityContextProvider` is invoked before creating and running a given container: - -```go -type SecurityContextProvider interface { - // ModifyContainerConfig is called before the Docker createContainer call. - // The security context provider can make changes to the Config with which - // the container is created. - // An error is returned if it's not possible to secure the container as - // requested with a security context. - ModifyContainerConfig(pod *api.Pod, container *api.Container, config *docker.Config) - - // ModifyHostConfig is called before the Docker runContainer call. - // The security context provider can make changes to the HostConfig, affecting - // security options, whether the container is privileged, volume binds, etc. - // An error is returned if it's not possible to secure the container as requested - // with a security context. - ModifyHostConfig(pod *api.Pod, container *api.Container, hostConfig *docker.HostConfig) -} -``` - -If the value of the SecurityContextProvider field on the Kubelet is nil, the kubelet will create and run the container as it does today. - -### Security Context - -A security context resides on the container and represents the runtime parameters that will -be used to create and run the container via container APIs. Following is an example of an initial implementation: - -```go -type type Container struct { - ... other fields omitted ... - // Optional: SecurityContext defines the security options the pod should be run with - SecurityContext *SecurityContext -} - -// SecurityContext holds security configuration that will be applied to a container. SecurityContext -// contains duplication of some existing fields from the Container resource. These duplicate fields -// will be populated based on the Container configuration if they are not set. Defining them on -// both the Container AND the SecurityContext will result in an error. -type SecurityContext struct { - // Capabilities are the capabilities to add/drop when running the container - Capabilities *Capabilities - - // Run the container in privileged mode - Privileged *bool - - // SELinuxOptions are the labels to be applied to the container - // and volumes - SELinuxOptions *SELinuxOptions - - // RunAsUser is the UID to run the entrypoint of the container process. - RunAsUser *int64 -} - -// SELinuxOptions are the labels to be applied to the container. -type SELinuxOptions struct { - // SELinux user label - User string - - // SELinux role label - Role string - - // SELinux type label - Type string - - // SELinux level label. - Level string -} -``` -### Admission - -It is up to an admission plugin to determine if the security context is acceptable or not. At the -time of writing, the admission control plugin for security contexts will only allow a context that -has defined capabilities or privileged. Contexts that attempt to define a UID or SELinux options -will be denied by default. In the future the admission plugin will base this decision upon -configurable policies that reside within the [service account](https://github.com/GoogleCloudPlatform/kubernetes/pull/2297). - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/security_context.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/security_context.md?pixel)]() diff --git a/release-0.19.0/docs/design/service_accounts.md b/release-0.19.0/docs/design/service_accounts.md deleted file mode 100644 index 2c7f2fa2b31..00000000000 --- a/release-0.19.0/docs/design/service_accounts.md +++ /dev/null @@ -1,170 +0,0 @@ -#Service Accounts - -## Motivation - -Processes in Pods may need to call the Kubernetes API. For example: - - scheduler - - replication controller - - minion controller - - a map-reduce type framework which has a controller that then tries to make a dynamically determined number of workers and watch them - - continuous build and push system - - monitoring system - -They also may interact with services other than the Kubernetes API, such as: - - an image repository, such as docker -- both when the images are pulled to start the containers, and for writing - images in the case of pods that generate images. - - accessing other cloud services, such as blob storage, in the context of a larged, integrated, cloud offering (hosted - or private). - - accessing files in an NFS volume attached to the pod - -## Design Overview -A service account binds together several things: - - a *name*, understood by users, and perhaps by peripheral systems, for an identity - - a *principal* that can be authenticated and [authorized](../authorization.md) - - a [security context](./security_context.md), which defines the Linux Capabilities, User IDs, Groups IDs, and other - capabilities and controls on interaction with the file system and OS. - - a set of [secrets](./secrets.md), which a container may use to - access various networked resources. - -## Design Discussion - -A new object Kind is added: -```go -type ServiceAccount struct { - TypeMeta `json:",inline" yaml:",inline"` - ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty"` - - username string - securityContext ObjectReference // (reference to a securityContext object) - secrets []ObjectReference // (references to secret objects -} -``` - -The name ServiceAccount is chosen because it is widely used already (e.g. by Kerberos and LDAP) -to refer to this type of account. Note that it has no relation to kubernetes Service objects. - -The ServiceAccount object does not include any information that could not be defined separately: - - username can be defined however users are defined. - - securityContext and secrets are only referenced and are created using the REST API. - -The purpose of the serviceAccount object is twofold: - - to bind usernames to securityContexts and secrets, so that the username can be used to refer succinctly - in contexts where explicitly naming securityContexts and secrets would be inconvenient - - to provide an interface to simplify allocation of new securityContexts and secrets. -These features are explained later. - -### Names - -From the standpoint of the Kubernetes API, a `user` is any principal which can authenticate to kubernetes API. -This includes a human running `kubectl` on her desktop and a container in a Pod on a Node making API calls. - -There is already a notion of a username in kubernetes, which is populated into a request context after authentication. -However, there is no API object representing a user. While this may evolve, it is expected that in mature installations, -the canonical storage of user identifiers will be handled by a system external to kubernetes. - -Kubernetes does not dictate how to divide up the space of user identifier strings. User names can be -simple Unix-style short usernames, (e.g. `alice`), or may be qualified to allow for federated identity ( -`alice@example.com` vs `alice@example.org`.) Naming convention may distinguish service accounts from user -accounts (e.g. `alice@example.com` vs `build-service-account-a3b7f0@foo-namespace.service-accounts.example.com`), -but Kubernetes does not require this. - -Kubernetes also does not require that there be a distinction between human and Pod users. It will be possible -to setup a cluster where Alice the human talks to the kubernetes API as username `alice` and starts pods that -also talk to the API as user `alice` and write files to NFS as user `alice`. But, this is not recommended. - -Instead, it is recommended that Pods and Humans have distinct identities, and reference implementations will -make this distinction. - -The distinction is useful for a number of reasons: - - the requirements for humans and automated processes are different: - - Humans need a wide range of capabilities to do their daily activities. Automated processes often have more narrowly-defined activities. - - Humans may better tolerate the exceptional conditions created by expiration of a token. Remembering to handle - this in a program is more annoying. So, either long-lasting credentials or automated rotation of credentials is - needed. - - A Human typically keeps credentials on a machine that is not part of the cluster and so not subject to automatic - management. A VM with a role/service-account can have its credentials automatically managed. - - the identity of a Pod cannot in general be mapped to a single human. - - If policy allows, it may be created by one human, and then updated by another, and another, until its behavior cannot be attributed to a single human. - -**TODO**: consider getting rid of separate serviceAccount object and just rolling its parts into the SecurityContext or -Pod Object. - -The `secrets` field is a list of references to /secret objects that an process started as that service account should -have access to to be able to assert that role. - -The secrets are not inline with the serviceAccount object. This way, most or all users can have permission to `GET /serviceAccounts` so they can remind themselves -what serviceAccounts are available for use. - -Nothing will prevent creation of a serviceAccount with two secrets of type `SecretTypeKubernetesAuth`, or secrets of two -different types. Kubelet and client libraries will have some behavior, TBD, to handle the case of multiple secrets of a -given type (pick first or provide all and try each in order, etc). - -When a serviceAccount and a matching secret exist, then a `User.Info` for the serviceAccount and a `BearerToken` from the secret -are added to the map of tokens used by the authentication process in the apiserver, and similarly for other types. (We -might have some types that do not do anything on apiserver but just get pushed to the kubelet.) - -### Pods -The `PodSpec` is extended to have a `Pods.Spec.ServiceAccountUsername` field. If this is unset, then a -default value is chosen. If it is set, then the corresponding value of `Pods.Spec.SecurityContext` is set by the -Service Account Finalizer (see below). - -TBD: how policy limits which users can make pods with which service accounts. - -### Authorization -Kubernetes API Authorization Policies refer to users. Pods created with a `Pods.Spec.ServiceAccountUsername` typically -get a `Secret` which allows them to authenticate to the Kubernetes APIserver as a particular user. So any -policy that is desired can be applied to them. - -A higher level workflow is needed to coordinate creation of serviceAccounts, secrets and relevant policy objects. -Users are free to extend kubernetes to put this business logic wherever is convenient for them, though the -Service Account Finalizer is one place where this can happen (see below). - -### Kubelet - -The kubelet will treat as "not ready to run" (needing a finalizer to act on it) any Pod which has an empty -SecurityContext. - -The kubelet will set a default, restrictive, security context for any pods created from non-Apiserver config -sources (http, file). - -Kubelet watches apiserver for secrets which are needed by pods bound to it. - -**TODO**: how to only let kubelet see secrets it needs to know. - -### The service account finalizer - -There are several ways to use Pods with SecurityContexts and Secrets. - -One way is to explicitly specify the securityContext and all secrets of a Pod when the pod is initially created, -like this: - -**TODO**: example of pod with explicit refs. - -Another way is with the *Service Account Finalizer*, a plugin process which is optional, and which handles -business logic around service accounts. - -The Service Account Finalizer watches Pods, Namespaces, and ServiceAccount definitions. - -First, if it finds pods which have a `Pod.Spec.ServiceAccountUsername` but no `Pod.Spec.SecurityContext` set, -then it copies in the referenced securityContext and secrets references for the corresponding `serviceAccount`. - -Second, if ServiceAccount definitions change, it may take some actions. -**TODO**: decide what actions it takes when a serviceAccount definition changes. Does it stop pods, or just -allow someone to list ones that out out of spec? In general, people may want to customize this? - -Third, if a new namespace is created, it may create a new serviceAccount for that namespace. This may include -a new username (e.g. `NAMESPACE-default-service-account@serviceaccounts.$CLUSTERID.kubernetes.io`), a new -securityContext, a newly generated secret to authenticate that serviceAccount to the Kubernetes API, and default -policies for that service account. -**TODO**: more concrete example. What are typical default permissions for default service account (e.g. readonly access -to services in the same namespace and read-write access to events in that namespace?) - -Finally, it may provide an interface to automate creation of new serviceAccounts. In that case, the user may want -to GET serviceAccounts to see what has been created. - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/service_accounts.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/service_accounts.md?pixel)]() diff --git a/release-0.19.0/docs/design/simple-rolling-update.md b/release-0.19.0/docs/design/simple-rolling-update.md deleted file mode 100644 index c5a10c59343..00000000000 --- a/release-0.19.0/docs/design/simple-rolling-update.md +++ /dev/null @@ -1,97 +0,0 @@ -## Simple rolling update -This is a lightweight design document for simple rolling update in ```kubectl``` - -Complete execution flow can be found [here](#execution-details). - -### Lightweight rollout -Assume that we have a current replication controller named ```foo``` and it is running image ```image:v1``` - -```kubectl rolling-update rc foo [foo-v2] --image=myimage:v2``` - -If the user doesn't specify a name for the 'next' controller, then the 'next' controller is renamed to -the name of the original controller. - -Obviously there is a race here, where if you kill the client between delete foo, and creating the new version of 'foo' you might be surprised about what is there, but I think that's ok. -See [Recovery](#recovery) below - -If the user does specify a name for the 'next' controller, then the 'next' controller is retained with its existing name, -and the old 'foo' controller is deleted. For the purposes of the rollout, we add a unique-ifying label ```kubernetes.io/deployment``` to both the ```foo``` and ```foo-next``` controllers. -The value of that label is the hash of the complete JSON representation of the```foo-next``` or```foo``` controller. The name of this label can be overridden by the user with the ```--deployment-label-key``` flag. - -#### Recovery -If a rollout fails or is terminated in the middle, it is important that the user be able to resume the roll out. -To facilitate recovery in the case of a crash of the updating process itself, we add the following annotations to each replicaController in the ```kubernetes.io/``` annotation namespace: - * ```desired-replicas``` The desired number of replicas for this controller (either N or zero) - * ```update-partner``` A pointer to the replicaiton controller resource that is the other half of this update (syntax `````` the namespace is assumed to be identical to the namespace of this replication controller.) - -Recovery is achieved by issuing the same command again: - -``` -kubectl rolling-update rc foo [foo-v2] --image=myimage:v2 -``` - -Whenever the rolling update command executes, the kubectl client looks for replication controllers called ```foo``` and ```foo-next```, if they exist, an attempt is -made to roll ```foo``` to ```foo-next```. If ```foo-next``` does not exist, then it is created, and the rollout is a new rollout. If ```foo``` doesn't exist, then -it is assumed that the rollout is nearly completed, and ```foo-next``` is renamed to ```foo```. Details of the execution flow are given below. - - -### Aborting a rollout -Abort is assumed to want to reverse a rollout in progress. - -```kubectl rolling-update rc foo [foo-v2] --rollback``` - -This is really just semantic sugar for: - -```kubectl rolling-update rc foo-v2 foo``` - -With the added detail that it moves the ```desired-replicas``` annotation from ```foo-v2``` to ```foo``` - - -### Execution Details - -For the purposes of this example, assume that we are rolling from ```foo``` to ```foo-next``` where the only change is an image update from `v1` to `v2` - -If the user doesn't specify a ```foo-next``` name, then it is either discovered from the ```update-partner``` annotation on ```foo```. If that annotation doesn't exist, -then ```foo-next``` is synthesized using the pattern ```-``` - -#### Initialization - * If ```foo``` and ```foo-next``` do not exist: - * Exit, and indicate an error to the user, that the specified controller doesn't exist. - * If ```foo``` exists, but ```foo-next``` does not: - * Create ```foo-next``` populate it with the ```v2``` image, set ```desired-replicas``` to ```foo.Spec.Replicas``` - * Goto Rollout - * If ```foo-next``` exists, but ```foo``` does not: - * Assume that we are in the rename phase. - * Goto Rename - * If both ```foo``` and ```foo-next``` exist: - * Assume that we are in a partial rollout - * If ```foo-next``` is missing the ```desired-replicas``` annotation - * Populate the ```desired-replicas``` annotation to ```foo-next``` using the current size of ```foo``` - * Goto Rollout - -#### Rollout - * While size of ```foo-next``` < ```desired-replicas``` annotation on ```foo-next``` - * increase size of ```foo-next``` - * if size of ```foo``` > 0 - decrease size of ```foo``` - * Goto Rename - -#### Rename - * delete ```foo``` - * create ```foo``` that is identical to ```foo-next``` - * delete ```foo-next``` - -#### Abort - * If ```foo-next``` doesn't exist - * Exit and indicate to the user that they may want to simply do a new rollout with the old version - * If ```foo``` doesn't exist - * Exit and indicate not found to the user - * Otherwise, ```foo-next``` and ```foo``` both exist - * Set ```desired-replicas``` annotation on ```foo``` to match the annotation on ```foo-next``` - * Goto Rollout with ```foo``` and ```foo-next``` trading places. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/simple-rolling-update.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/design/simple-rolling-update.md?pixel)]() diff --git a/release-0.19.0/docs/devel/README.md b/release-0.19.0/docs/devel/README.md deleted file mode 100644 index 9d74004b0fb..00000000000 --- a/release-0.19.0/docs/devel/README.md +++ /dev/null @@ -1,27 +0,0 @@ -# Developing Kubernetes - -Docs in this directory relate to developing Kubernetes. - -* **On Collaborative Development** ([collab.md](collab.md)): info on pull requests and code reviews. - -* **Development Guide** ([development.md](development.md)): Setting up your environment tests. - -* **Hunting flaky tests** ([flaky-tests.md](flaky-tests.md)): We have a goal of 99.9% flake free tests. - Here's how to run your tests many times. - -* **GitHub Issues** ([issues.md](issues.md)): How incoming issues are reviewed and prioritized. - -* **Logging Conventions** ([logging.md](logging.md)]: Glog levels. - -* **Pull Request Process** ([pull-requests.md](pull-requests.md)): When and why pull requests are closed. - -* **Releasing Kubernetes** ([releasing.md](releasing.md)): How to create a Kubernetes release (as in version) - and how the version information gets embedded into the built binaries. - -* **Profiling Kubernetes** ([profiling.md](profiling.md)): How to plug in go pprof profiler to Kubernetes. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/README.md?pixel)]() diff --git a/release-0.19.0/docs/devel/api_changes.md b/release-0.19.0/docs/devel/api_changes.md deleted file mode 100644 index a063e5795ec..00000000000 --- a/release-0.19.0/docs/devel/api_changes.md +++ /dev/null @@ -1,348 +0,0 @@ -# So you want to change the API? - -The Kubernetes API has two major components - the internal structures and -the versioned APIs. The versioned APIs are intended to be stable, while the -internal structures are implemented to best reflect the needs of the Kubernetes -code itself. - -What this means for API changes is that you have to be somewhat thoughtful in -how you approach changes, and that you have to touch a number of pieces to make -a complete change. This document aims to guide you through the process, though -not all API changes will need all of these steps. - -## Operational overview - -It is important to have a high level understanding of the API system used in -Kubernetes in order to navigate the rest of this document. - -As mentioned above, the internal representation of an API object is decoupled -from any one API version. This provides a lot of freedom to evolve the code, -but it requires robust infrastructure to convert between representations. There -are multiple steps in processing an API operation - even something as simple as -a GET involves a great deal of machinery. - -The conversion process is logically a "star" with the internal form at the -center. Every versioned API can be converted to the internal form (and -vice-versa), but versioned APIs do not convert to other versioned APIs directly. -This sounds like a heavy process, but in reality we do not intend to keep more -than a small number of versions alive at once. While all of the Kubernetes code -operates on the internal structures, they are always converted to a versioned -form before being written to storage (disk or etcd) or being sent over a wire. -Clients should consume and operate on the versioned APIs exclusively. - -To demonstrate the general process, here is a (hypothetical) example: - - 1. A user POSTs a `Pod` object to `/api/v7beta1/...` - 2. The JSON is unmarshalled into a `v7beta1.Pod` structure - 3. Default values are applied to the `v7beta1.Pod` - 4. The `v7beta1.Pod` is converted to an `api.Pod` structure - 5. The `api.Pod` is validated, and any errors are returned to the user - 6. The `api.Pod` is converted to a `v6.Pod` (because v6 is the latest stable - version) - 7. The `v6.Pod` is marshalled into JSON and written to etcd - -Now that we have the `Pod` object stored, a user can GET that object in any -supported api version. For example: - - 1. A user GETs the `Pod` from `/api/v5/...` - 2. The JSON is read from etcd and unmarshalled into a `v6.Pod` structure - 3. Default values are applied to the `v6.Pod` - 4. The `v6.Pod` is converted to an `api.Pod` structure - 5. The `api.Pod` is converted to a `v5.Pod` structure - 6. The `v5.Pod` is marshalled into JSON and sent to the user - -The implication of this process is that API changes must be done carefully and -backward-compatibly. - -## On compatibility - -Before talking about how to make API changes, it is worthwhile to clarify what -we mean by API compatibility. An API change is considered backward-compatible -if it: - * adds new functionality that is not required for correct behavior - * does not change existing semantics - * does not change existing defaults - -Put another way: - -1. Any API call (e.g. a structure POSTed to a REST endpoint) that worked before - your change must work the same after your change. -2. Any API call that uses your change must not cause problems (e.g. crash or - degrade behavior) when issued against servers that do not include your change. -3. It must be possible to round-trip your change (convert to different API - versions and back) with no loss of information. - -If your change does not meet these criteria, it is not considered strictly -compatible. There are times when this might be OK, but mostly we want changes -that meet this definition. If you think you need to break compatibility, you -should talk to the Kubernetes team first. - -Let's consider some examples. In a hypothetical API (assume we're at version -v6), the `Frobber` struct looks something like this: - -```go -// API v6. -type Frobber struct { - Height int `json:"height"` - Param string `json:"param"` -} -``` - -You want to add a new `Width` field. It is generally safe to add new fields -without changing the API version, so you can simply change it to: - -```go -// Still API v6. -type Frobber struct { - Height int `json:"height"` - Width int `json:"width"` - Param string `json:"param"` -} -``` - -The onus is on you to define a sane default value for `Width` such that rule #1 -above is true - API calls and stored objects that used to work must continue to -work. - -For your next change you want to allow multiple `Param` values. You can not -simply change `Param string` to `Params []string` (without creating a whole new -API version) - that fails rules #1 and #2. You can instead do something like: - -```go -// Still API v6, but kind of clumsy. -type Frobber struct { - Height int `json:"height"` - Width int `json:"width"` - Param string `json:"param"` // the first param - ExtraParams []string `json:"params"` // additional params -} -``` - -Now you can satisfy the rules: API calls that provide the old style `Param` -will still work, while servers that don't understand `ExtraParams` can ignore -it. This is somewhat unsatisfying as an API, but it is strictly compatible. - -Part of the reason for versioning APIs and for using internal structs that are -distinct from any one version is to handle growth like this. The internal -representation can be implemented as: - -```go -// Internal, soon to be v7beta1. -type Frobber struct { - Height int - Width int - Params []string -} -``` - -The code that converts to/from versioned APIs can decode this into the somewhat -uglier (but compatible!) structures. Eventually, a new API version, let's call -it v7beta1, will be forked and it can use the clean internal structure. - -We've seen how to satisfy rules #1 and #2. Rule #3 means that you can not -extend one versioned API without also extending the others. For example, an -API call might POST an object in API v7beta1 format, which uses the cleaner -`Params` field, but the API server might store that object in trusty old v6 -form (since v7beta1 is "beta"). When the user reads the object back in the -v7beta1 API it would be unacceptable to have lost all but `Params[0]`. This -means that, even though it is ugly, a compatible change must be made to the v6 -API. - -As another interesting example, enumerated values provide a unique challenge. -Adding a new value to an enumerated set is *not* a compatible change. Clients -which assume they know how to handle all possible values of a given field will -not be able to handle the new values. However, removing value from an -enumerated set *can* be a compatible change, if handled properly (treat the -removed value as deprecated but allowed). - -## Changing versioned APIs - -For most changes, you will probably find it easiest to change the versioned -APIs first. This forces you to think about how to make your change in a -compatible way. Rather than doing each step in every version, it's usually -easier to do each versioned API one at a time, or to do all of one version -before starting "all the rest". - -### Edit types.go - -The struct definitions for each API are in `pkg/api//types.go`. Edit -those files to reflect the change you want to make. Note that all non-online -fields in versioned APIs must have description tags - these are used to generate -documentation. - -### Edit defaults.go - -If your change includes new fields for which you will need default values, you -need to add cases to `pkg/api//defaults.go`. Of course, since you -have added code, you have to add a test: `pkg/api//defaults_test.go`. - -Do use pointers to scalars when you need to distinguish between an unset value -and an an automatic zero value. For example, -`PodSpec.TerminationGracePeriodSeconds` is defined as `*int64` the go type -definition. A zero value means 0 seconds, and a nil value asks the system to -pick a default. - -Don't forget to run the tests! - -### Edit conversion.go - -Given that you have not yet changed the internal structs, this might feel -premature, and that's because it is. You don't yet have anything to convert to -or from. We will revisit this in the "internal" section. If you're doing this -all in a different order (i.e. you started with the internal structs), then you -should jump to that topic below. In the very rare case that you are making an -incompatible change you might or might not want to do this now, but you will -have to do more later. The files you want are -`pkg/api//conversion.go` and `pkg/api//conversion_test.go`. - -## Changing the internal structures - -Now it is time to change the internal structs so your versioned changes can be -used. - -### Edit types.go - -Similar to the versioned APIs, the definitions for the internal structs are in -`pkg/api/types.go`. Edit those files to reflect the change you want to make. -Keep in mind that the internal structs must be able to express *all* of the -versioned APIs. - -## Edit validation.go - -Most changes made to the internal structs need some form of input validation. -Validation is currently done on internal objects in -`pkg/api/validation/validation.go`. This validation is the one of the first -opportunities we have to make a great user experience - good error messages and -thorough validation help ensure that users are giving you what you expect and, -when they don't, that they know why and how to fix it. Think hard about the -contents of `string` fields, the bounds of `int` fields and the -requiredness/optionalness of fields. - -Of course, code needs tests - `pkg/api/validation/validation_test.go`. - -## Edit version conversions - -At this point you have both the versioned API changes and the internal -structure changes done. If there are any notable differences - field names, -types, structural change in particular - you must add some logic to convert -versioned APIs to and from the internal representation. If you see errors from -the `serialization_test`, it may indicate the need for explicit conversions. - -Performance of conversions very heavily influence performance of apiserver. -Thus, we are auto-generating conversion functions that are much more efficient -than the generic ones (which are based on reflections and thus are highly -inefficient). - -The conversion code resides with each versioned API. There are two files: - - `pkg/api//conversion.go` containing manually written conversion - functions - - `pkg/api//conversion_generated.go` containing auto-generated - conversion functions - -Since auto-generated conversion functions are using manually written ones, -those manually written should be named with a defined convention, i.e. a function -converting type X in pkg a to type Y in pkg b, should be named: -`convert_a_X_To_b_Y`. - -Also note that you can (and for efficiency reasons should) use auto-generated -conversion functions when writing your conversion functions. - -Once all the necessary manually written conversions are added, you need to -regenerate auto-generated ones. To regenerate them: - - run -``` - $ hack/update-generated-conversions.sh -``` - -If running the above script is impossible due to compile errors, the easiest -workaround is to comment out the code causing errors and let the script to -regenerate it. If the auto-generated conversion methods are not used by the -manually-written ones, it's fine to just remove the whole file and let the -generator to create it from scratch. - -Unsurprisingly, adding manually written conversion also requires you to add tests to -`pkg/api//conversion_test.go`. - -## Update the fuzzer - -Part of our testing regimen for APIs is to "fuzz" (fill with random values) API -objects and then convert them to and from the different API versions. This is -a great way of exposing places where you lost information or made bad -assumptions. If you have added any fields which need very careful formatting -(the test does not run validation) or if you have made assumptions such as -"this slice will always have at least 1 element", you may get an error or even -a panic from the `serialization_test`. If so, look at the diff it produces (or -the backtrace in case of a panic) and figure out what you forgot. Encode that -into the fuzzer's custom fuzz functions. Hint: if you added defaults for a field, -that field will need to have a custom fuzz function that ensures that the field is -fuzzed to a non-empty value. - -The fuzzer can be found in `pkg/api/testing/fuzzer.go`. - -## Update the semantic comparisons - -VERY VERY rarely is this needed, but when it hits, it hurts. In some rare -cases we end up with objects (e.g. resource quantities) that have morally -equivalent values with different bitwise representations (e.g. value 10 with a -base-2 formatter is the same as value 0 with a base-10 formatter). The only way -Go knows how to do deep-equality is through field-by-field bitwise comparisons. -This is a problem for us. - -The first thing you should do is try not to do that. If you really can't avoid -this, I'd like to introduce you to our semantic DeepEqual routine. It supports -custom overrides for specific types - you can find that in `pkg/api/helpers.go`. - -There's one other time when you might have to touch this: unexported fields. -You see, while Go's `reflect` package is allowed to touch unexported fields, us -mere mortals are not - this includes semantic DeepEqual. Fortunately, most of -our API objects are "dumb structs" all the way down - all fields are exported -(start with a capital letter) and there are no unexported fields. But sometimes -you want to include an object in our API that does have unexported fields -somewhere in it (for example, `time.Time` has unexported fields). If this hits -you, you may have to touch the semantic DeepEqual customization functions. - -## Implement your change - -Now you have the API all changed - go implement whatever it is that you're -doing! - -## Write end-to-end tests - -This is, sadly, still sort of painful. Talk to us and we'll try to help you -figure out the best way to make sure your cool feature keeps working forever. - -## Examples and docs - -At last, your change is done, all unit tests pass, e2e passes, you're done, -right? Actually, no. You just changed the API. If you are touching an -existing facet of the API, you have to try *really* hard to make sure that -*all* the examples and docs are updated. There's no easy way to do this, due -in part to JSON and YAML silently dropping unknown fields. You're clever - -you'll figure it out. Put `grep` or `ack` to good use. - -If you added functionality, you should consider documenting it and/or writing -an example to illustrate your change. - -Make sure you update the swagger API spec by running: - -```shell -$ hack/update-swagger-spec.sh -``` - -The API spec changes should be in a commit separate from your other changes. - -## Incompatible API changes -If your change is going to be backward incompatible or might be a breaking change for API -consumers, please send an announcement to `kubernetes-dev@googlegroups.com` before -the change gets in. If you are unsure, ask. Also make sure that the change gets documented in -`CHANGELOG.md` for the next release. - -## Adding new REST objects - -TODO(smarterclayton): write this. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/api_changes.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/api_changes.md?pixel)]() diff --git a/release-0.19.0/docs/devel/coding-conventions.md b/release-0.19.0/docs/devel/coding-conventions.md deleted file mode 100644 index 5f58079d6cc..00000000000 --- a/release-0.19.0/docs/devel/coding-conventions.md +++ /dev/null @@ -1,13 +0,0 @@ -Coding style advice for contributors - - Bash - - https://google-styleguide.googlecode.com/svn/trunk/shell.xml - - Go - - https://github.com/golang/go/wiki/CodeReviewComments - - https://gist.github.com/lavalamp/4bd23295a9f32706a48f - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/coding-conventions.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/coding-conventions.md?pixel)]() diff --git a/release-0.19.0/docs/devel/collab.md b/release-0.19.0/docs/devel/collab.md deleted file mode 100644 index 28173059cbd..00000000000 --- a/release-0.19.0/docs/devel/collab.md +++ /dev/null @@ -1,46 +0,0 @@ -# On Collaborative Development - -Kubernetes is open source, but many of the people working on it do so as their day job. In order to avoid forcing people to be "at work" effectively 24/7, we want to establish some semi-formal protocols around development. Hopefully these rules make things go more smoothly. If you find that this is not the case, please complain loudly. - -## Patches welcome - -First and foremost: as a potential contributor, your changes and ideas are welcome at any hour of the day or night, weekdays, weekends, and holidays. Please do not ever hesitate to ask a question or send a PR. - -## Code reviews - -All changes must be code reviewed. For non-maintainers this is obvious, since you can't commit anyway. But even for maintainers, we want all changes to get at least one review, preferably (for non-trivial changes obligately) from someone who knows the areas the change touches. For non-trivial changes we may want two reviewers. The primary reviewer will make this decision and nominate a second reviewer, if needed. Except for trivial changes, PRs should not be committed until relevant parties (e.g. owners of the subsystem affected by the PR) have had a reasonable chance to look at PR in their local business hours. - -Most PRs will find reviewers organically. If a maintainer intends to be the primary reviewer of a PR they should set themselves as the assignee on GitHub and say so in a reply to the PR. Only the primary reviewer of a change should actually do the merge, except in rare cases (e.g. they are unavailable in a reasonable timeframe). - -If a PR has gone 2 work days without an owner emerging, please poke the PR thread and ask for a reviewer to be assigned. - -Except for rare cases, such as trivial changes (e.g. typos, comments) or emergencies (e.g. broken builds), maintainers should not merge their own changes. - -Expect reviewers to request that you avoid [common go style mistakes](https://github.com/golang/go/wiki/CodeReviewComments) in your PRs. - -## Assigned reviews - -Maintainers can assign reviews to other maintainers, when appropriate. The assignee becomes the shepherd for that PR and is responsible for merging the PR once they are satisfied with it or else closing it. The assignee might request reviews from non-maintainers. - -## Merge hours - -Maintainers will do merges of appropriately reviewed-and-approved changes during their local "business hours" (typically 7:00 am Monday to 5:00 pm (17:00h) Friday). PRs that arrive over the weekend or on holidays will only be merged if there is a very good reason for it and if the code review requirements have been met. Concretely this means that nobody should merge changes immediately before going to bed for the night. - -There may be discussion an even approvals granted outside of the above hours, but merges will generally be deferred. - -If a PR is considered complex or controversial, the merge of that PR should be delayed to give all interested parties in all timezones the opportunity to provide feedback. Concretely, this means that such PRs should be held for 24 -hours before merging. Of course "complex" and "controversial" are left to the judgment of the people involved, but we trust that part of being a committer is the judgment required to evaluate such things honestly, and not be -motivated by your desire (or your cube-mate's desire) to get their code merged. Also see "Holds" below, any reviewer can issue a "hold" to indicate that the PR is in fact complicated or complex and deserves further review. - -PRs that are incorrectly judged to be merge-able, may be reverted and subject to re-review, if subsequent reviewers believe that they in fact are controversial or complex. - - -## Holds - -Any maintainer or core contributor who wants to review a PR but does not have time immediately may put a hold on a PR simply by saying so on the PR discussion and offering an ETA measured in single-digit days at most. Any PR that has a hold shall not be merged until the person who requested the hold acks the review, withdraws their hold, or is overruled by a preponderance of maintainers. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/collab.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/collab.md?pixel)]() diff --git a/release-0.19.0/docs/devel/developer-guides/vagrant.md b/release-0.19.0/docs/devel/developer-guides/vagrant.md deleted file mode 100644 index 9e829903507..00000000000 --- a/release-0.19.0/docs/devel/developer-guides/vagrant.md +++ /dev/null @@ -1,341 +0,0 @@ -## Getting started with Vagrant - -Running kubernetes with Vagrant (and VirtualBox) is an easy way to run/test/develop on your local machine (Linux, Mac OS X). - -### Prerequisites -1. Install latest version >= 1.6.2 of vagrant from http://www.vagrantup.com/downloads.html -2. Install one of: - 1. The latest version of Virtual Box from https://www.virtualbox.org/wiki/Downloads - 2. [VMWare Fusion](https://www.vmware.com/products/fusion/) version 5 or greater as well as the appropriate [Vagrant VMWare Fusion provider](https://www.vagrantup.com/vmware) - 3. [VMWare Workstation](https://www.vmware.com/products/workstation/) version 9 or greater as well as the [Vagrant VMWare Workstation provider](https://www.vagrantup.com/vmware) - 4. [Parallels Desktop](https://www.parallels.com/products/desktop/) version 9 or greater as well as the [Vagrant Parallels provider](https://parallels.github.io/vagrant-parallels/) -3. Get or build a [binary release](/docs/getting-started-guides/binary_release.md) - -### Setup - -By default, the Vagrant setup will create a single kubernetes-master and 1 kubernetes-minion. Each VM will take 1 GB, so make sure you have at least 2GB to 4GB of free memory (plus appropriate free disk space). To start your local cluster, open a shell and run: - -```sh -cd kubernetes - -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -The `KUBERNETES_PROVIDER` environment variable tells all of the various cluster management scripts which variant to use. If you forget to set this, the assumption is you are running on Google Compute Engine. - -If you installed more than one Vagrant provider, Kubernetes will usually pick the appropriate one. However, you can override which one Kubernetes will use by setting the [`VAGRANT_DEFAULT_PROVIDER`](https://docs.vagrantup.com/v2/providers/default.html) environment variable: - -```sh -export VAGRANT_DEFAULT_PROVIDER=parallels -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -Vagrant will provision each machine in the cluster with all the necessary components to run Kubernetes. The initial setup can take a few minutes to complete on each machine. - -By default, each VM in the cluster is running Fedora, and all of the Kubernetes services are installed into systemd. - -To access the master or any minion: - -```sh -vagrant ssh master -vagrant ssh minion-1 -``` - -If you are running more than one minion, you can access the others by: - -```sh -vagrant ssh minion-2 -vagrant ssh minion-3 -``` - -To view the service status and/or logs on the kubernetes-master: -```sh -vagrant ssh master -[vagrant@kubernetes-master ~] $ sudo systemctl status kube-apiserver -[vagrant@kubernetes-master ~] $ sudo journalctl -r -u kube-apiserver - -[vagrant@kubernetes-master ~] $ sudo systemctl status kube-controller-manager -[vagrant@kubernetes-master ~] $ sudo journalctl -r -u kube-controller-manager - -[vagrant@kubernetes-master ~] $ sudo systemctl status etcd -[vagrant@kubernetes-master ~] $ sudo systemctl status nginx -``` - -To view the services on any of the kubernetes-minion(s): -```sh -vagrant ssh minion-1 -[vagrant@kubernetes-minion-1] $ sudo systemctl status docker -[vagrant@kubernetes-minion-1] $ sudo journalctl -r -u docker -[vagrant@kubernetes-minion-1] $ sudo systemctl status kubelet -[vagrant@kubernetes-minion-1] $ sudo journalctl -r -u kubelet -``` - -### Interacting with your Kubernetes cluster with Vagrant. - -With your Kubernetes cluster up, you can manage the nodes in your cluster with the regular Vagrant commands. - -To push updates to new Kubernetes code after making source changes: -```sh -./cluster/kube-push.sh -``` - -To stop and then restart the cluster: -```sh -vagrant halt -./cluster/kube-up.sh -``` - -To destroy the cluster: -```sh -vagrant destroy -``` - -Once your Vagrant machines are up and provisioned, the first thing to do is to check that you can use the `kubectl.sh` script. - -You may need to build the binaries first, you can do this with ```make``` - -```sh -$ ./cluster/kubectl.sh get minions - -NAME LABELS -10.245.1.4 -10.245.1.5 -10.245.1.3 -``` - -### Interacting with your Kubernetes cluster with the `kube-*` scripts. - -Alternatively to using the vagrant commands, you can also use the `cluster/kube-*.sh` scripts to interact with the vagrant based provider just like any other hosting platform for kubernetes. - -All of these commands assume you have set `KUBERNETES_PROVIDER` appropriately: - -```sh -export KUBERNETES_PROVIDER=vagrant -``` - -Bring up a vagrant cluster - -```sh -./cluster/kube-up.sh -``` - -Destroy the vagrant cluster - -```sh -./cluster/kube-down.sh -``` - -Update the vagrant cluster after you make changes (only works when building your own releases locally): - -```sh -./cluster/kube-push.sh -``` - -Interact with the cluster - -```sh -./cluster/kubectl.sh -``` - -### Authenticating with your master - -When using the vagrant provider in Kubernetes, the `cluster/kubectl.sh` script will cache your credentials in a `~/.kubernetes_vagrant_auth` file so you will not be prompted for them in the future. - -```sh -cat ~/.kubernetes_vagrant_auth -{ "User": "vagrant", - "Password": "vagrant" - "CAFile": "/home/k8s_user/.kubernetes.vagrant.ca.crt", - "CertFile": "/home/k8s_user/.kubecfg.vagrant.crt", - "KeyFile": "/home/k8s_user/.kubecfg.vagrant.key" -} -``` - -You should now be set to use the `cluster/kubectl.sh` script. For example try to list the minions that you have started with: - -```sh -./cluster/kubectl.sh get minions -``` - -### Running containers - -Your cluster is running, you can list the minions in your cluster: - -```sh -$ ./cluster/kubectl.sh get minions - -NAME LABELS -10.245.2.4 -10.245.2.3 -10.245.2.2 -``` - -Now start running some containers! - -You can now use any of the cluster/kube-*.sh commands to interact with your VM machines. -Before starting a container there will be no pods, services and replication controllers. - -``` -$ cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS - -$ cluster/kubectl.sh get services -NAME LABELS SELECTOR IP PORT - -$ cluster/kubectl.sh get replicationcontrollers -NAME IMAGE(S SELECTOR REPLICAS -``` - -Start a container running nginx with a replication controller and three replicas - -``` -$ cluster/kubectl.sh run my-nginx --image=nginx --replicas=3 --port=80 -``` - -When listing the pods, you will see that three containers have been started and are in Waiting state: - -``` -$ cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -781191ff-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.4/10.245.2.4 name=myNginx Waiting -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Waiting -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Waiting -``` - -You need to wait for the provisioning to complete, you can monitor the minions by doing: - -```sh -$ sudo salt '*minion-1' cmd.run 'docker images' -kubernetes-minion-1: - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE - 96864a7d2df3 26 hours ago 204.4 MB - kubernetes/pause latest 6c4579af347b 8 weeks ago 239.8 kB -``` - -Once the docker image for nginx has been downloaded, the container will start and you can list it: - -```sh -$ sudo salt '*minion-1' cmd.run 'docker ps' -kubernetes-minion-1: - CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES - dbe79bf6e25b nginx:latest "nginx" 21 seconds ago Up 19 seconds k8s--mynginx.8c5b8a3a--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1.etcd--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1--fcfa837f - fa0e29c94501 kubernetes/pause:latest "/pause" 8 minutes ago Up 8 minutes 0.0.0.0:8080->80/tcp k8s--net.a90e7ce4--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1.etcd--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1--baf5b21b -``` - -Going back to listing the pods, services and replicationcontrollers, you now have: - -``` -$ cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -781191ff-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.4/10.245.2.4 name=myNginx Running -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Running -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Running - -$ cluster/kubectl.sh get services -NAME LABELS SELECTOR IP PORT - -$ cluster/kubectl.sh get replicationcontrollers -NAME IMAGE(S SELECTOR REPLICAS -myNginx nginx name=my-nginx 3 -``` - -We did not start any services, hence there are none listed. But we see three replicas displayed properly. -Check the [guestbook](/examples/guestbook/README.md) application to learn how to create a service. -You can already play with scaling the replicas with: - -```sh -$ ./cluster/kubectl.sh scale rc my-nginx --replicas=2 -$ ./cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Running -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Running -``` - -Congratulations! - -### Testing - -The following will run all of the end-to-end testing scenarios assuming you set your environment in `cluster/kube-env.sh`: - -```sh -NUM_MINIONS=3 hack/e2e-test.sh -``` - -### Troubleshooting - -#### I keep downloading the same (large) box all the time! - -By default the Vagrantfile will download the box from S3. You can change this (and cache the box locally) by providing a name and an alternate URL when calling `kube-up.sh` - -```sh -export KUBERNETES_BOX_NAME=choose_your_own_name_for_your_kuber_box -export KUBERNETES_BOX_URL=path_of_your_kuber_box -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -#### I just created the cluster, but I am getting authorization errors! - -You probably have an incorrect ~/.kubernetes_vagrant_auth file for the cluster you are attempting to contact. - -```sh -rm ~/.kubernetes_vagrant_auth -``` - -After using kubectl.sh make sure that the correct credentials are set: - -```sh -cat ~/.kubernetes_vagrant_auth -{ - "User": "vagrant", - "Password": "vagrant" -} -``` - -#### I just created the cluster, but I do not see my container running! - -If this is your first time creating the cluster, the kubelet on each minion schedules a number of docker pull requests to fetch prerequisite images. This can take some time and as a result may delay your initial pod getting provisioned. - -#### I changed Kubernetes code, but it's not running! - -Are you sure there was no build error? After running `$ vagrant provision`, scroll up and ensure that each Salt state was completed successfully on each box in the cluster. -It's very likely you see a build error due to an error in your source files! - -#### I have brought Vagrant up but the minions won't validate! - -Are you sure you built a release first? Did you install `net-tools`? For more clues, login to one of the minions (`vagrant ssh minion-1`) and inspect the salt minion log (`sudo cat /var/log/salt/minion`). - -#### I want to change the number of minions! - -You can control the number of minions that are instantiated via the environment variable `NUM_MINIONS` on your host machine. If you plan to work with replicas, we strongly encourage you to work with enough minions to satisfy your largest intended replica size. If you do not plan to work with replicas, you can save some system resources by running with a single minion. You do this, by setting `NUM_MINIONS` to 1 like so: - -```sh -export NUM_MINIONS=1 -``` - -#### I want my VMs to have more memory! - -You can control the memory allotted to virtual machines with the `KUBERNETES_MEMORY` environment variable. -Just set it to the number of megabytes you would like the machines to have. For example: - -```sh -export KUBERNETES_MEMORY=2048 -``` - -If you need more granular control, you can set the amount of memory for the master and minions independently. For example: - -```sh -export KUBERNETES_MASTER_MEMORY=1536 -export KUBERNETES_MINION_MEMORY=2048 -``` - -#### I ran vagrant suspend and nothing works! -```vagrant suspend``` seems to mess up the network. It's not supported at this time. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/developer-guides/vagrant.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/developer-guides/vagrant.md?pixel)]() diff --git a/release-0.19.0/docs/devel/development.md b/release-0.19.0/docs/devel/development.md deleted file mode 100644 index c04ae02153a..00000000000 --- a/release-0.19.0/docs/devel/development.md +++ /dev/null @@ -1,275 +0,0 @@ -# Development Guide - -# Releases and Official Builds - -Official releases are built in Docker containers. Details are [here](../../build/README.md). You can do simple builds and development with just a local Docker installation. If want to build go locally outside of docker, please continue below. - -## Go development environment - -Kubernetes is written in [Go](http://golang.org) programming language. If you haven't set up Go development environment, please follow [this instruction](http://golang.org/doc/code.html) to install go tool and set up GOPATH. Ensure your version of Go is at least 1.3. - -## Clone kubernetes into GOPATH - -We highly recommend to put kubernetes' code into your GOPATH. For example, the following commands will download kubernetes' code under the current user's GOPATH (Assuming there's only one directory in GOPATH.): - -``` -$ echo $GOPATH -/home/user/goproj -$ mkdir -p $GOPATH/src/github.com/GoogleCloudPlatform/ -$ cd $GOPATH/src/github.com/GoogleCloudPlatform/ -$ git clone https://github.com/GoogleCloudPlatform/kubernetes.git -``` - -The commands above will not work if there are more than one directory in ``$GOPATH``. - -If you plan to do development, read about the -[Kubernetes Github Flow](https://docs.google.com/presentation/d/1HVxKSnvlc2WJJq8b9KCYtact5ZRrzDzkWgKEfm0QO_o/pub?start=false&loop=false&delayms=3000), -and then clone your own fork of Kubernetes as described there. - -## godep and dependency management - -Kubernetes uses [godep](https://github.com/tools/godep) to manage dependencies. It is not strictly required for building Kubernetes but it is required when managing dependencies under the Godeps/ tree, and is required by a number of the build and test scripts. Please make sure that ``godep`` is installed and in your ``$PATH``. - -### Installing godep -There are many ways to build and host go binaries. Here is an easy way to get utilities like ```godep``` installed: - -1) Ensure that [mercurial](http://mercurial.selenic.com/wiki/Download) is installed on your system. (some of godep's dependencies use the mercurial -source control system). Use ```apt-get install mercurial``` or ```yum install mercurial``` on Linux, or [brew.sh](http://brew.sh) on OS X, or download -directly from mercurial. - -2) Create a new GOPATH for your tools and install godep: -``` -export GOPATH=$HOME/go-tools -mkdir -p $GOPATH -go get github.com/tools/godep -``` - -3) Add $GOPATH/bin to your path. Typically you'd add this to your ~/.profile: -``` -export GOPATH=$HOME/go-tools -export PATH=$PATH:$GOPATH/bin -``` - -### Using godep -Here's a quick walkthrough of one way to use godeps to add or update a Kubernetes dependency into Godeps/_workspace. For more details, please see the instructions in [godep's documentation](https://github.com/tools/godep). - -1) Devote a directory to this endeavor: -``` -export KPATH=$HOME/code/kubernetes -mkdir -p $KPATH/src/github.com/GoogleCloudPlatform/kubernetes -cd $KPATH/src/github.com/GoogleCloudPlatform/kubernetes -git clone https://path/to/your/fork . -# Or copy your existing local repo here. IMPORTANT: making a symlink doesn't work. -``` - -2) Set up your GOPATH. -``` -# Option A: this will let your builds see packages that exist elsewhere on your system. -export GOPATH=$KPATH:$GOPATH -# Option B: This will *not* let your local builds see packages that exist elsewhere on your system. -export GOPATH=$KPATH -# Option B is recommended if you're going to mess with the dependencies. -``` - -3) Populate your new GOPATH. -``` -cd $KPATH/src/github.com/GoogleCloudPlatform/kubernetes -godep restore -``` - -4) Next, you can either add a new dependency or update an existing one. -``` -# To add a new dependency, do: -cd $KPATH/src/github.com/GoogleCloudPlatform/kubernetes -go get path/to/dependency -# Change code in Kubernetes to use the dependency. -godep save ./... - -# To update an existing dependency, do: -cd $KPATH/src/github.com/GoogleCloudPlatform/kubernetes -go get -u path/to/dependency -# Change code in Kubernetes accordingly if necessary. -godep update path/to/dependency -``` - -5) Before sending your PR, it's a good idea to sanity check that your Godeps.json file is ok by re-restoring: ```godep restore``` - -It is sometimes expedient to manually fix the /Godeps/godeps.json file to minimize the changes. - -Please send dependency updates in separate commits within your PR, for easier reviewing. - -## Hooks - -Before committing any changes, please link/copy these hooks into your .git -directory. This will keep you from accidentally committing non-gofmt'd go code. - -``` -cd kubernetes/.git/hooks/ -ln -s ../../hooks/pre-commit . -``` - -## Unit tests - -``` -cd kubernetes -hack/test-go.sh -``` - -Alternatively, you could also run: - -``` -cd kubernetes -godep go test ./... -``` - -If you only want to run unit tests in one package, you could run ``godep go test`` under the package directory. For example, the following commands will run all unit tests in package kubelet: - -``` -$ cd kubernetes # step into kubernetes' directory. -$ cd pkg/kubelet -$ godep go test -# some output from unit tests -PASS -ok github.com/GoogleCloudPlatform/kubernetes/pkg/kubelet 0.317s -``` - -## Coverage - -Currently, collecting coverage is only supported for the Go unit tests. - -To run all unit tests and generate an HTML coverage report, run the following: - -``` -cd kubernetes -KUBE_COVER=y hack/test-go.sh -``` - -At the end of the run, an the HTML report will be generated with the path printed to stdout. - -To run tests and collect coverage in only one package, pass its relative path under the `kubernetes` directory as an argument, for example: -``` -cd kubernetes -KUBE_COVER=y hack/test-go.sh pkg/kubectl -``` - -Multiple arguments can be passed, in which case the coverage results will be combined for all tests run. - -Coverage results for the project can also be viewed on [Coveralls](https://coveralls.io/r/GoogleCloudPlatform/kubernetes), and are continuously updated as commits are merged. Additionally, all pull requests which spawn a Travis build will report unit test coverage results to Coveralls. - -## Integration tests - -You need an [etcd](https://github.com/coreos/etcd/releases/tag/v2.0.0) in your path, please make sure it is installed and in your ``$PATH``. -``` -cd kubernetes -hack/test-integration.sh -``` - -## End-to-End tests - -You can run an end-to-end test which will bring up a master and two minions, perform some tests, and then tear everything down. Make sure you have followed the getting started steps for your chosen cloud platform (which might involve changing the `KUBERNETES_PROVIDER` environment variable to something other than "gce". -``` -cd kubernetes -hack/e2e-test.sh -``` - -Pressing control-C should result in an orderly shutdown but if something goes wrong and you still have some VMs running you can force a cleanup with this command: -``` -go run hack/e2e.go --down -``` - -### Flag options -See the flag definitions in `hack/e2e.go` for more options, such as reusing an existing cluster, here is an overview: - -```sh -# Build binaries for testing -go run hack/e2e.go --build - -# Create a fresh cluster. Deletes a cluster first, if it exists -go run hack/e2e.go --up - -# Create a fresh cluster at a specific release version. -go run hack/e2e.go --up --version=0.7.0 - -# Test if a cluster is up. -go run hack/e2e.go --isup - -# Push code to an existing cluster -go run hack/e2e.go --push - -# Push to an existing cluster, or bring up a cluster if it's down. -go run hack/e2e.go --pushup - -# Run all tests -go run hack/e2e.go --test - -# Run tests matching the regex "Pods.*env" -go run hack/e2e.go -v -test --test_args="--ginkgo.focus=Pods.*env" - -# Alternately, if you have the e2e cluster up and no desire to see the event stream, you can run ginkgo-e2e.sh directly: -hack/ginkgo-e2e.sh --ginkgo.focus=Pods.*env -``` - -### Combining flags -```sh -# Flags can be combined, and their actions will take place in this order: -# -build, -push|-up|-pushup, -test|-tests=..., -down -# e.g.: -go run hack/e2e.go -build -pushup -test -down - -# -v (verbose) can be added if you want streaming output instead of only -# seeing the output of failed commands. - -# -ctl can be used to quickly call kubectl against your e2e cluster. Useful for -# cleaning up after a failed test or viewing logs. Use -v to avoid suppressing -# kubectl output. -go run hack/e2e.go -v -ctl='get events' -go run hack/e2e.go -v -ctl='delete pod foobar' -``` - -## Conformance testing -End-to-end testing, as described above, is for [development -distributions](../../docs/devel/writing-a-getting-started-guide.md). A conformance test is used on -a [versioned distro](../../docs/devel/writing-a-getting-started-guide.md). - -The conformance test runs a subset of the e2e-tests against a manually-created cluster. It does not -require support for up/push/down and other operations. To run a conformance test, you need to know the -IP of the master for your cluster and the authorization arguments to use. The conformance test is -intended to run against a cluster at a specific binary release of Kubernetes. -See [conformance-test.sh](../../hack/conformance-test.sh). - -## Testing out flaky tests -[Instructions here](flaky-tests.md) - -## Keeping your development fork in sync - -One time after cloning your forked repo: - -``` -git remote add upstream https://github.com/GoogleCloudPlatform/kubernetes.git -``` - -Then each time you want to sync to upstream: - -``` -git fetch upstream -git rebase upstream/master -``` - -If you have write access to the main repository, you should modify your git configuration so that -you can't accidentally push to upstream: - -``` -git remote set-url --push upstream no_push -``` - -## Regenerating the CLI documentation - -``` -hack/run-gendocs.sh -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/development.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/development.md?pixel)]() diff --git a/release-0.19.0/docs/devel/faster_reviews.md b/release-0.19.0/docs/devel/faster_reviews.md deleted file mode 100644 index cd6cb5ff445..00000000000 --- a/release-0.19.0/docs/devel/faster_reviews.md +++ /dev/null @@ -1,183 +0,0 @@ -# How to get faster PR reviews - -Most of what is written here is not at all specific to Kubernetes, but it bears -being written down in the hope that it will occasionally remind people of "best -practices" around code reviews. - -You've just had a brilliant idea on how to make Kubernetes better. Let's call -that idea "FeatureX". Feature X is not even that complicated. You have a -pretty good idea of how to implement it. You jump in and implement it, fixing a -bunch of stuff along the way. You send your PR - this is awesome! And it sits. -And sits. A week goes by and nobody reviews it. Finally someone offers a few -comments, which you fix up and wait for more review. And you wait. Another -week or two goes by. This is horrible. - -What went wrong? One particular problem that comes up frequently is this - your -PR is too big to review. You've touched 39 files and have 8657 insertions. -When your would-be reviewers pull up the diffs they run away - this PR is going -to take 4 hours to review and they don't have 4 hours right now. They'll get to it -later, just as soon as they have more free time (ha!). - -Let's talk about how to avoid this. - -## 1. Don't build a cathedral in one PR - -Are you sure FeatureX is something the Kubernetes team wants or will accept, or -that it is implemented to fit with other changes in flight? Are you willing to -bet a few days or weeks of work on it? If you have any doubt at all about the -usefulness of your feature or the design - make a proposal doc or a sketch PR -or both. Write or code up just enough to express the idea and the design and -why you made those choices, then get feedback on this. Now, when we ask you to -change a bunch of facets of the design, you don't have to re-write it all. - -## 2. Smaller diffs are exponentially better - -Small PRs get reviewed faster and are more likely to be correct than big ones. -Let's face it - attention wanes over time. If your PR takes 60 minutes to -review, I almost guarantee that the reviewer's eye for details is not as keen in -the last 30 minutes as it was in the first. This leads to multiple rounds of -review when one might have sufficed. In some cases the review is delayed in its -entirety by the need for a large contiguous block of time to sit and read your -code. - -Whenever possible, break up your PRs into multiple commits. Making a series of -discrete commits is a powerful way to express the evolution of an idea or the -different ideas that make up a single feature. There's a balance to be struck, -obviously. If your commits are too small they become more cumbersome to deal -with. Strive to group logically distinct ideas into commits. - -For example, if you found that FeatureX needed some "prefactoring" to fit in, -make a commit that JUST does that prefactoring. Then make a new commit for -FeatureX. Don't lump unrelated things together just because you didn't think -about prefactoring. If you need to, fork a new branch, do the prefactoring -there and send a PR for that. If you can explain why you are doing seemingly -no-op work ("it makes the FeatureX change easier, I promise") we'll probably be -OK with it. - -Obviously, a PR with 25 commits is still very cumbersome to review, so use -common sense. - -## 3. Multiple small PRs are often better than multiple commits - -If you can extract whole ideas from your PR and send those as PRs of their own, -you can avoid the painful problem of continually rebasing. Kubernetes is a -fast-moving codebase - lock in your changes ASAP, and make merges be someone -else's problem. - -Obviously, we want every PR to be useful on its own, so you'll have to use -common sense in deciding what can be a PR vs what should be a commit in a larger -PR. Rule of thumb - if this commit or set of commits is directly related to -FeatureX and nothing else, it should probably be part of the FeatureX PR. If -you can plausibly imagine someone finding value in this commit outside of -FeatureX, try it as a PR. - -Don't worry about flooding us with PRs. We'd rather have 100 small, obvious PRs -than 10 unreviewable monoliths. - -## 4. Don't rename, reformat, comment, etc in the same PR - -Often, as you are implementing FeatureX, you find things that are just wrong. -Bad comments, poorly named functions, bad structure, weak type-safety. You -should absolutely fix those things (or at least file issues, please) - but not -in this PR. See the above points - break unrelated changes out into different -PRs or commits. Otherwise your diff will have WAY too many changes, and your -reviewer won't see the forest because of all the trees. - -## 5. Comments matter - -Read up on GoDoc - follow those general rules. If you're writing code and you -think there is any possible chance that someone might not understand why you did -something (or that you won't remember what you yourself did), comment it. If -you think there's something pretty obvious that we could follow up on, add a -TODO. Many code-review comments are about this exact issue. - -## 5. Tests are almost always required - -Nothing is more frustrating than doing a review, only to find that the tests are -inadequate or even entirely absent. Very few PRs can touch code and NOT touch -tests. If you don't know how to test FeatureX - ask! We'll be happy to help -you design things for easy testing or to suggest appropriate test cases. - -## 6. Look for opportunities to generify - -If you find yourself writing something that touches a lot of modules, think hard -about the dependencies you are introducing between packages. Can some of what -you're doing be made more generic and moved up and out of the FeatureX package? -Do you need to use a function or type from an otherwise unrelated package? If -so, promote! We have places specifically for hosting more generic code. - -Likewise if FeatureX is similar in form to FeatureW which was checked in last -month and it happens to exactly duplicate some tricky stuff from FeatureW, -consider prefactoring core logic out and using it in both FeatureW and FeatureX. -But do that in a different commit or PR, please. - -## 7. Fix feedback in a new commit - -Your reviewer has finally sent you some feedback on FeatureX. You make a bunch -of changes and ... what? You could patch those into your commits with git -"squash" or "fixup" logic. But that makes your changes hard to verify. Unless -your whole PR is pretty trivial, you should instead put your fixups into a new -commit and re-push. Your reviewer can then look at that commit on its own - so -much faster to review than starting over. - -We might still ask you to clean up your commits at the very end, for the sake -of a more readable history. - -## 8. KISS, YAGNI, MVP, etc - -Sometimes we need to remind each other of core tenets of software design - Keep -It Simple, You Aren't Gonna Need It, Minimum Viable Product, and so on. Adding -features "because we might need it later" is antithetical to software that -ships. Add the things you need NOW and (ideally) leave room for things you -might need later - but don't implement them now. - -## 9. Push back - -We understand that it is hard to imagine, but sometimes we make mistakes. It's -OK to push back on changes requested during a review. If you have a good reason -for doing something a certain way, you are absolutely allowed to debate the -merits of a requested change. You might be overruled, but you might also -prevail. We're mostly pretty reasonable people. Mostly. - -## 10. I'm still getting stalled - help?! - -So, you've done all that and you still aren't getting any PR love? Here's some -things you can do that might help kick a stalled process along: - - * Make sure that your PR has an assigned reviewer (assignee in GitHub). If - this is not the case, reply to the PR comment stream asking for one to be - assigned. - - * Ping the assignee (@username) on the PR comment stream asking for an - estimate of when they can get to it. - - * Ping the assignee by email (many of us have email addresses that are well - published or are the same as our GitHub handle @google.com or @redhat.com). - -If you think you have fixed all the issues in a round of review, and you haven't -heard back, you should ping the reviewer (assignee) on the comment stream with a -"please take another look" (PTAL) or similar comment indicating you are done and -you think it is ready for re-review. In fact, this is probably a good habit for -all PRs. - -One phenomenon of open-source projects (where anyone can comment on any issue) -is the dog-pile - your PR gets so many comments from so many people it becomes -hard to follow. In this situation you can ask the primary reviewer -(assignee) whether they want you to fork a new PR to clear out all the comments. -Remember: you don't HAVE to fix every issue raised by every person who feels -like commenting, but you should at least answer reasonable comments with an -explanation. - -## Final: Use common sense - -Obviously, none of these points are hard rules. There is no document that can -take the place of common sense and good taste. Use your best judgment, but put -a bit of thought into how your work can be made easier to review. If you do -these things your PRs will flow much more easily. - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/faster_reviews.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/faster_reviews.md?pixel)]() diff --git a/release-0.19.0/docs/devel/flaky-tests.md b/release-0.19.0/docs/devel/flaky-tests.md deleted file mode 100644 index a82d0c3b5de..00000000000 --- a/release-0.19.0/docs/devel/flaky-tests.md +++ /dev/null @@ -1,68 +0,0 @@ -# Hunting flaky tests in Kubernetes -Sometimes unit tests are flaky. This means that due to (usually) race conditions, they will occasionally fail, even though most of the time they pass. - -We have a goal of 99.9% flake free tests. This means that there is only one flake in one thousand runs of a test. - -Running a test 1000 times on your own machine can be tedious and time consuming. Fortunately, there is a better way to achieve this using Kubernetes. - -_Note: these instructions are mildly hacky for now, as we get run once semantics and logging they will get better_ - -There is a testing image ```brendanburns/flake``` up on the docker hub. We will use this image to test our fix. - -Create a replication controller with the following config: -```yaml -apiVersion: v1 -kind: ReplicationController -metadata: - name: flakecontroller -spec: - replicas: 24 - template: - metadata: - labels: - name: flake - spec: - containers: - - name: flake - image: brendanburns/flake - env: - - name: TEST_PACKAGE - value: pkg/tools - - name: REPO_SPEC - value: https://github.com/GoogleCloudPlatform/kubernetes -``` -Note that we omit the labels and the selector fields of the replication controller, because they will be populated from the labels field of the pod template by default. - -``` -kubectl create -f controller.yaml -``` - -This will spin up 24 instances of the test. They will run to completion, then exit, and the kubelet will restart them, accumulating more and more runs of the test. -You can examine the recent runs of the test by calling ```docker ps -a``` and looking for tasks that exited with non-zero exit codes. Unfortunately, docker ps -a only keeps around the exit status of the last 15-20 containers with the same image, so you have to check them frequently. -You can use this script to automate checking for failures, assuming your cluster is running on GCE and has four nodes: - -```sh -echo "" > output.txt -for i in {1..4}; do - echo "Checking kubernetes-minion-${i}" - echo "kubernetes-minion-${i}:" >> output.txt - gcloud compute ssh "kubernetes-minion-${i}" --command="sudo docker ps -a" >> output.txt -done -grep "Exited ([^0])" output.txt -``` - -Eventually you will have sufficient runs for your purposes. At that point you can stop and delete the replication controller by running: - -```sh -kubectl stop replicationcontroller flakecontroller -``` - -If you do a final check for flakes with ```docker ps -a```, ignore tasks that exited -1, since that's what happens when you stop the replication controller. - -Happy flake hunting! - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/flaky-tests.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/flaky-tests.md?pixel)]() diff --git a/release-0.19.0/docs/devel/issues.md b/release-0.19.0/docs/devel/issues.md deleted file mode 100644 index e65b5071fa7..00000000000 --- a/release-0.19.0/docs/devel/issues.md +++ /dev/null @@ -1,25 +0,0 @@ -GitHub Issues for the Kubernetes Project -======================================== - -A list quick overview of how we will review and prioritize incoming issues at https://github.com/GoogleCloudPlatform/kubernetes/issues - -Priorities ----------- - -We will use GitHub issue labels for prioritization. The absence of a priority label means the bug has not been reviewed and prioritized yet. - -Definitions ------------ -* P0 - something broken for users, build broken, or critical security issue. Someone must drop everything and work on it. -* P1 - must fix for earliest possible binary release (every two weeks) -* P2 - should be fixed in next major release version -* P3 - default priority for lower importance bugs that we still want to track and plan to fix at some point -* design - priority/design is for issues that are used to track design discussions -* support - priority/support is used for issues tracking user support requests -* untriaged - anything without a priority/X label will be considered untriaged - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/issues.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/issues.md?pixel)]() diff --git a/release-0.19.0/docs/devel/logging.md b/release-0.19.0/docs/devel/logging.md deleted file mode 100644 index b389b9d352b..00000000000 --- a/release-0.19.0/docs/devel/logging.md +++ /dev/null @@ -1,32 +0,0 @@ -Logging Conventions -=================== - -The following conventions for the glog levels to use. [glog](http://godoc.org/github.com/golang/glog) is globally preferred to [log](http://golang.org/pkg/log/) for better runtime control. - -* glog.Errorf() - Always an error -* glog.Warningf() - Something unexpected, but probably not an error -* glog.Infof() has multiple levels: - * glog.V(0) - Generally useful for this to ALWAYS be visible to an operator - * Programmer errors - * Logging extra info about a panic - * CLI argument handling - * glog.V(1) - A reasonable default log level if you don't want verbosity. - * Information about config (listening on X, watching Y) - * Errors that repeat frequently that relate to conditions that can be corrected (pod detected as unhealthy) - * glog.V(2) - Useful steady state information about the service and important log messages that may correlate to significant changes in the system. This is the recommended default log level for most systems. - * Logging HTTP requests and their exit code - * System state changing (killing pod) - * Controller state change events (starting pods) - * Scheduler log messages - * glog.V(3) - Extended information about changes - * More info about system state changes - * glog.V(4) - Debug level verbosity (for now) - * Logging in particularly thorny parts of code where you may want to come back later and check it - -As per the comments, the practical default level is V(2). Developers and QE environments may wish to run at V(3) or V(4). If you wish to change the log level, you can pass in `-v=X` where X is the desired maximum level to log. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/logging.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/logging.md?pixel)]() diff --git a/release-0.19.0/docs/devel/profiling.md b/release-0.19.0/docs/devel/profiling.md deleted file mode 100644 index 33ed0279012..00000000000 --- a/release-0.19.0/docs/devel/profiling.md +++ /dev/null @@ -1,40 +0,0 @@ -# Profiling Kubernetes - -This document explain how to plug in profiler and how to profile Kubernetes services. - -## Profiling library - -Go comes with inbuilt 'net/http/pprof' profiling library and profiling web service. The way service works is binding debug/pprof/ subtree on a running webserver to the profiler. Reading from subpages of debug/pprof returns pprof-formatted profiles of the running binary. The output can be processed offline by the tool of choice, or used as an input to handy 'go tool pprof', which can graphically represent the result. - -## Adding profiling to services to APIserver. - -TL;DR: Add lines: -``` - m.mux.HandleFunc("/debug/pprof/", pprof.Index) - m.mux.HandleFunc("/debug/pprof/profile", pprof.Profile) - m.mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol) -``` -to the init(c *Config) method in 'pkg/master/master.go' and import 'net/http/pprof' package. - -In most use cases to use profiler service it's enough to do 'import _ net/http/pprof', which automatically registers a handler in the default http.Server. Slight inconvenience is that APIserver uses default server for intra-cluster communication, so plugging profiler to it is not really useful. In 'pkg/master/server/server.go' more servers are created and started as separate goroutines. The one that is usually serving external traffic is secureServer. The handler for this traffic is defined in 'pkg/master/master.go' and stored in Handler variable. It is created from HTTP multiplexer, so the only thing that needs to be done is adding profiler handler functions to this multiplexer. This is exactly what lines after TL;DR do. - -## Connecting to the profiler -Even when running profiler I found not really straightforward to use 'go tool pprof' with it. The problem is that at least for dev purposes certificates generated for APIserver are not signed by anyone trusted and because secureServer serves only secure traffic it isn't straightforward to connect to the service. The best workaround I found is by creating an ssh tunnel from the kubernetes_master open unsecured port to some external server, and use this server as a proxy. To save everyone looking for correct ssh flags, it is done by running: -``` - ssh kubernetes_master -L:localhost:8080 -``` -or analogous one for you Cloud provider. Afterwards you can e.g. run -``` -go tool pprof http://localhost:/debug/pprof/profile -``` -to get 30 sec. CPU profile. - -## Contention profiling - -To enable contention profiling you need to add line ```rt.SetBlockProfileRate(1)``` in addition to ```m.mux.HandleFunc(...)``` added before (```rt``` stands for ```runtime``` in ```master.go```). This enables 'debug/pprof/block' subpage, which can be used as an input to ```go tool pprof```. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/profiling.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/profiling.md?pixel)]() diff --git a/release-0.19.0/docs/devel/pull-requests.md b/release-0.19.0/docs/devel/pull-requests.md deleted file mode 100644 index bc8083b487f..00000000000 --- a/release-0.19.0/docs/devel/pull-requests.md +++ /dev/null @@ -1,22 +0,0 @@ -Pull Request Process -==================== - -An overview of how we will manage old or out-of-date pull requests. - -Process -------- - -We will close any pull requests older than two weeks. - -Exceptions can be made for PRs that have active review comments, or that are awaiting other dependent PRs. Closed pull requests are easy to recreate, and little work is lost by closing a pull request that subsequently needs to be reopened. - -We want to limit the total number of PRs in flight to: -* Maintain a clean project -* Remove old PRs that would be difficult to rebase as the underlying code has changed over time -* Encourage code velocity - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/pull-requests.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/pull-requests.md?pixel)]() diff --git a/release-0.19.0/docs/devel/releasing.dot b/release-0.19.0/docs/devel/releasing.dot deleted file mode 100644 index fe8124c36da..00000000000 --- a/release-0.19.0/docs/devel/releasing.dot +++ /dev/null @@ -1,113 +0,0 @@ -// Build it with: -// $ dot -Tsvg releasing.dot >releasing.svg - -digraph tagged_release { - size = "5,5" - // Arrows go up. - rankdir = BT - subgraph left { - // Group the left nodes together. - ci012abc -> pr101 -> ci345cde -> pr102 - style = invis - } - subgraph right { - // Group the right nodes together. - version_commit -> dev_commit - style = invis - } - { // Align the version commit and the info about it. - rank = same - // Align them with pr101 - pr101 - version_commit - // release_info shows the change in the commit. - release_info - } - { // Align the dev commit and the info about it. - rank = same - // Align them with 345cde - ci345cde - dev_commit - dev_info - } - // Join the nodes from subgraph left. - pr99 -> ci012abc - pr102 -> pr100 - // Do the version node. - pr99 -> version_commit - dev_commit -> pr100 - tag -> version_commit - pr99 [ - label = "Merge PR #99" - shape = box - fillcolor = "#ccccff" - style = "filled" - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - ci012abc [ - label = "012abc" - shape = circle - fillcolor = "#ffffcc" - style = "filled" - fontname = "Consolas, Liberation Mono, Menlo, Courier, monospace" - ]; - pr101 [ - label = "Merge PR #101" - shape = box - fillcolor = "#ccccff" - style = "filled" - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - ci345cde [ - label = "345cde" - shape = circle - fillcolor = "#ffffcc" - style = "filled" - fontname = "Consolas, Liberation Mono, Menlo, Courier, monospace" - ]; - pr102 [ - label = "Merge PR #102" - shape = box - fillcolor = "#ccccff" - style = "filled" - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - version_commit [ - label = "678fed" - shape = circle - fillcolor = "#ccffcc" - style = "filled" - fontname = "Consolas, Liberation Mono, Menlo, Courier, monospace" - ]; - dev_commit [ - label = "456dcb" - shape = circle - fillcolor = "#ffffcc" - style = "filled" - fontname = "Consolas, Liberation Mono, Menlo, Courier, monospace" - ]; - pr100 [ - label = "Merge PR #100" - shape = box - fillcolor = "#ccccff" - style = "filled" - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - release_info [ - label = "pkg/version/base.go:\ngitVersion = \"v0.5\";" - shape = none - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - dev_info [ - label = "pkg/version/base.go:\ngitVersion = \"v0.5-dev\";" - shape = none - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - tag [ - label = "$ git tag -a v0.5" - fillcolor = "#ffcccc" - style = "filled" - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; -} - diff --git a/release-0.19.0/docs/devel/releasing.md b/release-0.19.0/docs/devel/releasing.md deleted file mode 100644 index 4769f48ca48..00000000000 --- a/release-0.19.0/docs/devel/releasing.md +++ /dev/null @@ -1,171 +0,0 @@ -# Releasing Kubernetes - -This document explains how to create a Kubernetes release (as in version) and -how the version information gets embedded into the built binaries. - -## Origin of the Sources - -Kubernetes may be built from either a git tree (using `hack/build-go.sh`) or -from a tarball (using either `hack/build-go.sh` or `go install`) or directly by -the Go native build system (using `go get`). - -When building from git, we want to be able to insert specific information about -the build tree at build time. In particular, we want to use the output of `git -describe` to generate the version of Kubernetes and the status of the build -tree (add a `-dirty` prefix if the tree was modified.) - -When building from a tarball or using the Go build system, we will not have -access to the information about the git tree, but we still want to be able to -tell whether this build corresponds to an exact release (e.g. v0.3) or is -between releases (e.g. at some point in development between v0.3 and v0.4). - -## Version Number Format - -In order to account for these use cases, there are some specific formats that -may end up representing the Kubernetes version. Here are a few examples: - -- **v0.5**: This is official version 0.5 and this version will only be used - when building from a clean git tree at the v0.5 git tag, or from a tree - extracted from the tarball corresponding to that specific release. -- **v0.5-15-g0123abcd4567**: This is the `git describe` output and it indicates - that we are 15 commits past the v0.5 release and that the SHA1 of the commit - where the binaries were built was `0123abcd4567`. It is only possible to have - this level of detail in the version information when building from git, not - when building from a tarball. -- **v0.5-15-g0123abcd4567-dirty** or **v0.5-dirty**: The extra `-dirty` prefix - means that the tree had local modifications or untracked files at the time of - the build, so there's no guarantee that the source code matches exactly the - state of the tree at the `0123abcd4567` commit or at the `v0.5` git tag - (resp.) -- **v0.5-dev**: This means we are building from a tarball or using `go get` or, - if we have a git tree, we are using `go install` directly, so it is not - possible to inject the git version into the build information. Additionally, - this is not an official release, so the `-dev` prefix indicates that the - version we are building is after `v0.5` but before `v0.6`. (There is actually - an exception where a commit with `v0.5-dev` is not present on `v0.6`, see - later for details.) - -## Injecting Version into Binaries - -In order to cover the different build cases, we start by providing information -that can be used when using only Go build tools or when we do not have the git -version information available. - -To be able to provide a meaningful version in those cases, we set the contents -of variables in a Go source file that will be used when no overrides are -present. - -We are using `pkg/version/base.go` as the source of versioning in absence of -information from git. Here is a sample of that file's contents: - -``` - var ( - gitVersion string = "v0.4-dev" // version from git, output of $(git describe) - gitCommit string = "" // sha1 from git, output of $(git rev-parse HEAD) - ) -``` - -This means a build with `go install` or `go get` or a build from a tarball will -yield binaries that will identify themselves as `v0.4-dev` and will not be able -to provide you with a SHA1. - -To add the extra versioning information when building from git, the -`hack/build-go.sh` script will gather that information (using `git describe` and -`git rev-parse`) and then create a `-ldflags` string to pass to `go install` and -tell the Go linker to override the contents of those variables at build time. It -can, for instance, tell it to override `gitVersion` and set it to -`v0.4-13-g4567bcdef6789-dirty` and set `gitCommit` to `4567bcdef6789...` which -is the complete SHA1 of the (dirty) tree used at build time. - -## Handling Official Versions - -Handling official versions from git is easy, as long as there is an annotated -git tag pointing to a specific version then `git describe` will return that tag -exactly which will match the idea of an official version (e.g. `v0.5`). - -Handling it on tarballs is a bit harder since the exact version string must be -present in `pkg/version/base.go` for it to get embedded into the binaries. But -simply creating a commit with `v0.5` on its own would mean that the commits -coming after it would also get the `v0.5` version when built from tarball or `go -get` while in fact they do not match `v0.5` (the one that was tagged) exactly. - -To handle that case, creating a new release should involve creating two adjacent -commits where the first of them will set the version to `v0.5` and the second -will set it to `v0.5-dev`. In that case, even in the presence of merges, there -will be a single commit where the exact `v0.5` version will be used and all -others around it will either have `v0.4-dev` or `v0.5-dev`. - -The diagram below illustrates it. - -![Diagram of git commits involved in the release](./releasing.png) - -After working on `v0.4-dev` and merging PR 99 we decide it is time to release -`v0.5`. So we start a new branch, create one commit to update -`pkg/version/base.go` to include `gitVersion = "v0.5"` and `git commit` it. - -We test it and make sure everything is working as expected. - -Before sending a PR for it, we create a second commit on that same branch, -updating `pkg/version/base.go` to include `gitVersion = "v0.5-dev"`. That will -ensure that further builds (from tarball or `go install`) on that tree will -always include the `-dev` prefix and will not have a `v0.5` version (since they -do not match the official `v0.5` exactly.) - -We then send PR 100 with both commits in it. - -Once the PR is accepted, we can use `git tag -a` to create an annotated tag -*pointing to the one commit* that has `v0.5` in `pkg/version/base.go` and push -it to GitHub. (Unfortunately GitHub tags/releases are not annotated tags, so -this needs to be done from a git client and pushed to GitHub using SSH.) - -## Parallel Commits - -While we are working on releasing `v0.5`, other development takes place and -other PRs get merged. For instance, in the example above, PRs 101 and 102 get -merged to the master branch before the versioning PR gets merged. - -This is not a problem, it is only slightly inaccurate that checking out the tree -at commit `012abc` or commit `345cde` or at the commit of the merges of PR 101 -or 102 will yield a version of `v0.4-dev` *but* those commits are not present in -`v0.5`. - -In that sense, there is a small window in which commits will get a -`v0.4-dev` or `v0.4-N-gXXX` label and while they're indeed later than `v0.4` -but they are not really before `v0.5` in that `v0.5` does not contain those -commits. - -Unfortunately, there is not much we can do about it. On the other hand, other -projects seem to live with that and it does not really become a large problem. - -As an example, Docker commit a327d9b91edf has a `v1.1.1-N-gXXX` label but it is -not present in Docker `v1.2.0`: - -``` - $ git describe a327d9b91edf - v1.1.1-822-ga327d9b91edf - - $ git log --oneline v1.2.0..a327d9b91edf - a327d9b91edf Fix data space reporting from Kb/Mb to KB/MB - - (Non-empty output here means the commit is not present on v1.2.0.) -``` - -## Release Notes - -No official release should be made final without properly matching release notes. - -There should be made available, per release, a small summary, preamble, of the -major changes, both in terms of feature improvements/bug fixes and notes about -functional feature changes (if any) regarding the previous released version so -that the BOM regarding updating to it gets as obvious and trouble free as possible. - -After this summary, preamble, all the relevant PRs/issues that got in that -version should be listed and linked together with a small summary understandable -by plain mortals (in a perfect world PR/issue's title would be enough but often -it is just too cryptic/geeky/domain-specific that it isn't). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/releasing.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/releasing.md?pixel)]() diff --git a/release-0.19.0/docs/devel/releasing.png b/release-0.19.0/docs/devel/releasing.png deleted file mode 100644 index 935628deddc5ba9c608cd7f97d7c587bf519e333..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 30693 zcmag`1yq%7)HRH5O1ebp1_433r8}fUx}~H`q#FdJI|P*O?hfhhM!LKEzj)sNJ7aw3 z9cP@a4q>zJx?-)l=A4UQ1vv>+Bzzr*OP^<*{YR|u zv(-H3?zhmw1`SOb^ZIvM@zFXO(F*<_=6Ytk2Oplk-wpi=4LKd;Wlg;vD4gMPh#xus z!tXHbGJH))7$y#bf$#;l)2|wW0PD*<3P&2bibgUGefR0}=jnqvs_5u(b>vm;hK7$; zmPOBZ1LziH7z})7vT0CaTu{-KFwsZMh>@h9gVjRJQBfOl#5enf;9gGeH z8t+ID$6GLv=YP)pzuwk9hJGW>>Epf7>cwre<^w~A081D!J`{qD2upaDSt`)+*LXe% zU4w5N5q9w>9y9~P#M$|TIvE672&cpu%71Y1rldq}gFR_6E(vdBd`n5W4-c;jhp_+! zr6__(Yk`7~!tZKFG5GiDL#D*c1%sA);^CGF8brNyd1Jk&76PG-Tl>e9HddLOvR`YJ zBH&ijb#+)nPao!yBS>n-EUK;F|Hf}}(rm-Y)it%|>H`NGEg9M2Mpb1NWvR2{Ri0ui zy-q`RK|zsozVmT(bybdXe(Xp(vWjZ8urNcBE?;F)Q6%%oPzv?t#v2NX*0s|LA0N{@ z86Uw>!yk3t`S~8&i!d8b?hhhZF##8~d;5iad^jm71B2iHMT&GF)Su(x(Fr3?J`(RBoy`Ha&&Bf-nfm(rcXf6#!XoFx zX{elRRfs4u=^R6oqoaY$=wagbSH()7KSM!CsdLrU)TVggel@=Gfk5hLa!$4pkV9n? zGg6Z97-?vV3JTuQ(#mR$&)YZF4 zh{8V52vFqbf6-m$wHXd{dBD)Ev-I>>i5XN z?=dsUXJ7G5#r#-)Wm1ePTyh2ogo(L4BFuyI!-sw@LI~tXuvDP`m-jSzFp&8LsiC1u z$&Y8JISNmYqN}#N0(}CcH@9$yhcoxLM20d=9t+zY0ag$Qm;y;@JG-NHKPbNbHCryc zB<889O(dkR?Cftd#rv-141{09o>2t${(wOAEiLc&rY5?&dc?(Re(vVvTtPuCTUmA8 z-R%+aU@tbgM4#%2h@{Y|T~$|CfBROW*SK{#@bD<1ppe)6t1Gd>y}lN2@!hB<5jwbWP|NL1K7+LZ9{{6dK1eLvgbgmqGNpUd- zRtyGC&vRZ;;r?oLbd$^Z1|4n4OcD2}DH5zNHkb9B9~VFW)7d8JE-(n^sp5^P?*aQ8>~HWdamHxp0xog=a6v6suAY-^a&r3f-JNT461RRa z0<-~V=Mvm>$z^n8+rokc7Z29S%~+w@ai=CGY=?E=Fe~&H1~xXID;oj`N(k{N*DVlO zXdecM4~laJvLIEbJoP?4Tf~E3*y|M_kmzOs^{n<6d-`_ttSnAnA-w}#74jkR!xT_SaDopwT0!|xG zuZ4|+lbewNcF@l(g?tqckH@DOK@v>Ts@hrsucwFUVlA@*e?fJKqmLIe6BC!y-egxW zR(5ta6vW=%9vT|@k#TrnAoK#xmTPfmEOT>XqsDTMC1V*D))#T{A}eyr{r>83^tT8i zBI4V(Z$q)^E2^pp73}!=`CkW9g79Es5}%Ne@aq>JDVC35nQzKx)beE2!p}pg+*mG? z^1l_#*zieK+O*GxQaC?;{OIfJdvtVUVq$W2bycK@ah8Mudshwcax0kfO-;PM~#OpK9y zXjoVntLg9u8XA3h2aH}pyl);pI*s2B7wcoJupyAh*jN=66@NcygdUbAZBj5}O--qf z3;vy8{9^FLDWEBBPsTDO_V)HHt?|*2NK*%y_K*qr-Dl_Kk{+=k|1uyQb0`T!J>wG- zSl|g_V#;58qaZmtI+neL_&oeDU?wMx>6^%vZ}ohpwPlb9xOZtgDkS34#0RZ4b6v$81n_v8qe4Pki**qNDi z%MH1WLekUq#KiuBfth^|1AY5$uuc#}fi%9J)YNa4!lR@A1`_^sbR?{<{{9)f(&E9& z&OS6W^jG>V>^QZ|Fj_c1ySV%aq0V~|L}unb@HxKM#$UcrQd07JKK$r&KtkA%KnZn$ z8g3sRK000RQ7`lse1dU=s;SU#_mzksHYkRMzC|B}o9(Z&TTf0-E+{N4$A92>0?ctNAK0%ddm|t1%EZ0LYs~MMsaQuXmA=L75gN zjXV~_X@k5hk~d}zkbrSn(tlUS&m$FcFz}xNPC&{g_#3zbzSxk^^YRZJs6r>HaLvL( zsKaB0)z;40+|Df*hBzc9B{jR>Ry3x(yM~3vquIHJV_{uyZ1@;8^Tl4x#DsTGmMJ<} zdbl^E`MaXAzP`u7>^$)f!W!ET?k-dVj%c)+AK3EVnYiN zUFiIOVZzCjoiKm@s+fskkn@%eFf+v;YaDmu3koWhvzMDcO^+wbWh?P}F({}`AtBb6 zxn2%dR0wzTa@wTD#wh>%`4G}G@ak3Cd-_M)gV|&lcxa3jZb!3s4!$o7hdbjK8svUE zJM_qz(^GU=8SL?ug3{8f3vEkl23D_@=!66Z9i6ujZ^1S`FJePOaw+m^LcWIX4#U{y z=DSK$Az0{=kq3|QNfjJIcU=t^XtbdH)6Z@^@5#vpVm?B%Mt~Eis&IEao+^;P$J${4j<(yS+W>?2LAKc|Y>P z`B)bomQtsos<1KTVP`BiGV-9Ps4IQLR8-Fk*2kNbGa)z_@%*e|jN+GI8y4M|C-zP=p=1)6{U zJf}U!M4hs{-+d2Z=q-(oX6X&R+>ely?(gc6@b~|Mj2sFLSzK%aK*}>VJ!(>gh0%sY zO-TNDZw~>r+5WD|O+n$6QQ+yi6ByJtZ`pO5>I!pBOY)_5&h0^_IpfY9GgG03lai4N zKD)e3W$qjw8ghfwZne(N&homPi7G3{?BbJRsOa~#_)$?^m6xOY2Z-SX!9XBjcSlBk zfP-^_2)gm)*VhwEN$@YfK?+F23R=IFdV*>nVKlR8T^>2cFj_lY;KyOGgn{hrd#$); z)p1?_YxgELw&P0uIheS&XAcKgotzw^n7LujHvc!2CnVHiIJN$H!KOfF=eLoCMWgHG zS9$r7b`=o8iQ|iKm^f-YF89n0*NiAAw7MOYmG8YF$2A;=9v+wBM99|5ynQz%zkd(K z(cRC_Yx3|clPpg@p8bIt%Gf z15#39hBD3$=UeORmDQ>m6{4Ty|-g9su$;mY+=iggo=YiDe~QT;p3R4ZK$0w3!f7%0rm4O-QBkAd(n zuQC{{j0j@X4o$em@|v2b?R2l7VPP+4Xt7n$)BkP=wgVnsa5YkI*{cRfH(2{&gxnQb zS+Evlk*grQAAo}bc`${UU>hJ;VD+{2k|P9ysGTMiL*?=GkR(ZINDs>*>XI;!U)LGNOj{0Zg?>gedmSI#ZS%iGx6GAuSO)2_D%0MQr>tva#~3QwJzZd+$( zW^;2hz_x{j$QJZ|a3%QO`fxanf(8Z#ngExJudlDW-Cxm9+rJ8pj#d&85m8pg0*R^< zjo}*C)Nct5W>L(0RG5)mOUEG#Vj-%DLRQIZlZ z%;@<8J^ku87z~ciVhU)8ptEyrP*Bj%pM(C0Sm2^omX?8Sh$Jp9E&vYU<4+J`So`>W zBP5`4cXtPqFc43l!X8Ql|EB_;p1wFbI{NDB8yOi{QMF(ovNkt)#`)#|4jdd@k!r@z z-@gr%lwMEMl6E2-ee)?OC}1|~)-Q%O{&y~nkg{rslc7MPLK~NmfMY>MV`N}}iG}3{ z))$j+s7^*hgX@kHECd41Pfkv**Mjna0}t8&pW&Miqh8BTP`X;Y{a`Sh%B`rV2rvi= zPTeeA|G+@d@+4^oz`CoG5PvJ%a%7a%mbNPMiHgd~#>U2%wT%5gZ$cOuOG`?u!A!o) z88o=L-}5+-mnjN+`9R-05l2wn&AtK?Ze)}R(C9R+dO%Z?yM%;K9*GneAHT)*GQ>@!m243j zr?D;a7#RTpA+N9y-6s>9ln|}9p>5PtMiSnd57q!i`v6+RQxx(KJOw>iGAKbVP!R9H z!0wq+JuNM*m*?mQZv%Y#aJ68gUZ@XWX*v=f5z(Uw_l2gjm|=8mjCo@QnY0aH)hXLW z;;yBoCGP)TaBwbgaJOP&?|%LI#YKqbef$x#nU}X|Ybz%?IfhDRbP}Ld9Go5{HafD` z!2q4ggZT!fA{nARZ2s{TAf`hBErdauT17x|A0kENQ?V} z`qOG>LRMBS7h&n|-{tkUgr7bQke%m(YRb^i@XsIe&Q6k_gzpW_@>mUgeH$8lljqgp z;53NS(jMzd7|wF#;{pPV#l$x2>(iB$>_LfYVaDb55FMhV0SC$G4;*@K6Y zW+&boGV(`^3LD#1Q?r08@VL%%W&(pC{!J*5IjjW`++>Cz?j*jz>_ouS5l&0Hpbf39U`}pQb{a{&fXc!qmQKRB` z5xO}*pTL-&Sr9U;LJ~ELjfweuy)t6P_5=fu1`6jtO7sigAMdJbucM}?yQd0^2?=HX z{uNWqzZyu`Td2+S^-UW|Hm)-r@dS%Wr62$WmC4oz6k{SmXjIhHRtsBohJP0^Db(#* zq+Rdsv8bW<_av$1(?G$iFNU=f9Tl~@TdyqWU1O6T>eK$_Gn>$F1rd?Vk+kOGV!o+` z`z(O9=`?+8i7cIBPEe_UoyNpS+qZPc z5Xevbcb5;hVlFP8BArR8w*MrYoGuUM0->R^>goi_UuxHj-5A~0C%O*@$JG{U&Q4AS z?_hlCi(WSWl~^b?^e8TohsI~@k?|T&L{PCL%;4J`uh7#El^wpqdHXggX=u6JXe?jZ z+T9&Dy)3XNRKUYk_jA0>lRF)G)Q@6Z1gf%8ID7(v?cwS~ex2L#>_bpyR;bL4+lx!~ zuD<((O+`tmPfp6m2U4hur)T5Ap)3>TC;=hb_F=QZsxY5}Lriiqe$l4jENbBv9N=66 z0(S2%r|Hx*EB`zRo!y?#+@3o>UCyk4%2(gC5d?woaJ1{=^hB;Gtn^s{cU-RnbwCj| zfkJXxlk~vv-AnK=FgC7ttq!O>=bfaJ2pvgp9Zsn|JX*R}&MDhib+LrV;W_!tL^|>F)+}@#{CT^)Ch7N0?YB#bF+VaY|PG5T}?|* z&*tmbgZ;*-*~E#23%xp9p7;4X?S2SXyh8!{Xm`&;Y9-n^3dvk6fE9uD-O5+qPhfQZ zavAK+hClSz`0vruz<)nlsAWuud;8I84;F-DOK4*pu$?Yfyq=vN@1PtDjfu{;3Gi@# zu2hS4KT|?f zQK8=xzGgq?Z-c=WIT$BQF>KoSGyC`ilw*xaRM?jIkuS~y?Z`;czQl9fE-j5AgGS~ z)x*c-e9LmBrL9AlByN6IUP}w!r;L_%?_Eer^7Pac9=C`L`OF|>>9gLaAN-eI6l5#^6BCZhKoJh9o=Eb^)q0|LDa`*6@R!r-+sAG z497cYhwWq%{sT6TyR3G#0J1koPW^ATdwbPYYE}S`m&mPre7Ha=)Sh-vWsh^b;-y)+ z1-QrEmxGbs+(Fx{w7iQ-u3G|U1~JFl`ih@_TQUD|Z;FmiZFv0~*n(zX3nV{u`t`%Zddr|z{@tCO@o~-gglmIHbmTmhy_?go=H@f?u3UoKn*%=u zo`0esyZr#9!6#fxy^QK=b_Ry&>1o`z?1>aKy#hANgFk+>Kh;Z!iS6#1qoIP!4W<>R zBqV65sRjLaP!Y1IC~s9ca~rQDu~_P_?N_gs3BSApKvTUw+JPef6%tyIgCkq3+cnzf z;%n-Kzo9saE_r=j;y02LGH*68UhP907&s@;R|<+D1!d%No=)UO=j2f3SO9WUMpl-c z{a4^0+Chzm$+f3PH}%3BJacn%S65fR(jJg$3veHxX3iOs!7u6{ z6AdQCaGM&vRlya|%`YejF_M>mx;i8vj*xhVa5kB*tj-?x)-O6ODJegbHLb9;RbEEM zQMcu%LBq{Jf*lprN1DA=43nX8&&$2HpHkXZZ2|2P7ZnAv!_C7j>$(y4rqA0G$th=!I{Sc#b59pq*{`wdBM?s|vq;Y;gs`2a`2`nqb{q<3Ig$pm$y z?ZKo*V%S&~@g?GOVNp>0YCn*OkHj$j!Un6;HmlA<=Ce71oRXXjxN#H|lp0VY$QPBA zaBy<2G&or(Dq<$dfag;F_U#*>HTXodwHFWODgpihXdfApp_C7>>pmcjYps737X#+T z+{7d&B&5H=X$59kuhsKcY^-SJ7%wj`IR%AYv+LzXA6ECaF`%=#2utef>aw!Fbp5~t z-%7elNlD4c4gcbCzB*j!0T0?xSy@?8F+Mx{eIiE|j7`|LlYi}R={`@+%m{cse1Cp= zY}R^+67~nA<7M4431Vn?xXIo9cLjN*1O}Zdr^3shcri&OK1O4s>Ssqf{8%H%=4{D; z@d4x#or=Lg5PG&&?bGd=*oXaOFvB35OYz`za-rn8<Toah)hiUe!eA(A2yx&m;dd!7ZIPUW5oX7_0#46 zRC_~v1rHxUg32Uj@Pg^aW@m?U&9xR(`TW_iu9E8$9;daXR3G(K)!)uek!+>i*1NmA z63yzbV2A;C!Hj-JPD|TAKK>d)N<&j;HueX|4FCS=tEs6$yunl%7?6bl&|+3xT#Sc@ zCyChwq7vYt<{F&#JA=^aKX`KW4T1C8IB)bud9QLqH}4YP?o#t}b8%@mI3h;$xVgDq z&#gtgA-`~G_CO*)8Ek~aNn2T4uU1K{aS?u$AT~3jaeugp3ic%t@SGe~5EX-Qcz8fV z*?KxTJv}==2ND~zj)+&C=cB8d8pzDsVLyNFkZ_2IbY@CKm>3&_={sDgEd?KIZeAJ~ zKz6wXVc~qs!;1mzCPG}?8&L9r5(MH6O4Hg}&L~N+&UMT5+xudk5ec%#%#e_fjC#VC zTD`nJf5tXyo$c@c3K(9>*TJIXhd+99FaD1gV5xDYzrSGQSgSi{cWvYskLlO1As6re zWM%@E-@?equgfs9Z-bcrDxZmp>J_sP0YM7!%sqv{1-VRH6VRkpnNPD5l9MG!xsVZu zRFt)D{s|GTYdt-!{`AW1?k?dX^m*#6lG{>Hj$vdl$zfCg05GRp23J^sFd% zet=?7N1L#5=BltD{P7~VdI<_YjEatqfP}>B_RP535fc;B%j>zMqy*%T_cSy+dwckR zd>M1LT3Qs1xvp+*=clLnd3k2$=I?1~$F)@|5k50>cgB-YVW%Mo5*uLz88-MQSd zX?CBkTL+;xdfsDWy6^x;2#ix%W|bF!GHsDwpbu(2J4rn0>^g$%fgq^FeI zcdZY8?iYX}l~0eHA>nsdP*XGgg)8UHH#6Y=k~&pYRLn8})7)73y_}nb1eBUV1$(Vg z4-yei)h_2=-)PLu%<$Ny3nWg7co^hT^Uf|UHpVgurb`9FDFHeR^7EU^m5(?-liuO3 zwQ1#YshF>|VFnwM*Y@9t&)yp>EUMR9uQZV$qw~_>8$7doPhEb|}G_^tlO4+N`~7IGFA zmkgw&Z&2jr#u>HQ&k5)NxR4($?oyB&GMPskiFdnEmXGj^Za4oKGvjgo7)JQM!n4^! zT6$TqR8B_bM>Ye-n~P9~Y(OcUd~XU2eB~pE3smJtyCsDHaPvKmeSl5Kshv1DaCf*p zM)^ycxVOFO#j&G4iQvUB^vLk_k0|?yQF4e^=n5z z5=_5Ff{@bDp+X|#Io0w;sPPq(d>lX zfv9MDqzU;)aBy`E+AJKEjQYjN>cH@DNk)b#*cRl$7k$(l?9q9J`;OPvDsFDuQ-#-v z{)m!);--o!P5m^r7CJiDtEyYCJ#%FzF0Q>KDQj-;ma{p(7#rJOSz-iFdhSmvW5ry; zOi58jcXhpbAcF!vjxfsC@K;uI&jav~59&+djXR=6qL|`lV$eakt-xzkpN#jH{K|jrEtq!^5bks88`9@MMN)#+R1D zKFmM%NmRA8cs@PczJC20Bvc?@{-G{%OU3Gl@bxJA0Ast9PIBd;(dKb#>clL!XGYY^j5Is(-z+l zKFFv}4UZ~F2zsXr|AvOhrP_`R(Z|PC^Exx^%$A3}JaY|L+fV!M%@|k&bMqm>>GdPv znF;w1l4F!9DU675Z_xRg!A`i>Risf767saNVt`F1sK`jcr$@y!5RU<_0c@x0=g(I_lfH07 z3Q*G4ez@G9>HhBput=G*DoJ*tHF`wP%oHlu!*s9NSGnP(nwl964YGy?EZ3$_&s4Aw zTwIyH5%hOay6@h>W`=t>Ks-9lGHK0!(KZfq-T314ULRVE)K_Gxs zMMg#z3E_3W!PrG8BNNOMI5{~1W&pxl9LOk7B;puwX_y!otkP@M_y+||48+I9ot~X( zYG{NJ@qF9tk87sZCIINWNS*B6J9g{EI^Z~2mrz@393w8c!!zt^LhkMBQ&mNs8#3j0 zzxnf1pmh@d*vyh35gLXk7HdKzc==1T=-+-ttA@e!Ly8+RRPNfAbTO+fTc4k)0dSE1GFk|XPKMl*VS>ocJ1l~ z&>C>BfCL02?8NxEr{h#J!QtI6^8W_ts5A&K=DknPuA_v>n@S0APs;(wcZ`(;NT!qbQ z_H5!#PSvTYsXu;59v2=h?X*1+JdI@h37(vsZiFNPO=Si9+!yfdPzF*pD9>BghpW1%E^>4;*-^7#s^y5u$OL3?`nP*+T?@ z!(#pF3RD>v@*e~QTD`r2U*rB{6{Z=n+szkY|GdDBv!Bq<9tv7Wfc^4O|LZ@QuNDNN zqM|pqNsFS|8XEa|JIDngT)vZ&ygE9LHH!O0loK#4Nk5xxZEbHO2eyW=!?kIyTBP5Er!{Zg6nW$dJYJSH!}PFj-E{^iD@R)=KWNG4q#7^G_!0 zD+evyT_VcPn-TzCqoZG+;YakO0JEW#lx*UO2SZXelrZ0pmmcH-=?gT774BS&jPkm= zEp>G_Z9XtBcLaQPKy9d~t_E^|jkWcW9b)ez2m^rLPhv3+0T@ocq`^7!=LKt*nZh|V zs5?|u^UIhVyAZZ!NbN~2X42HF%$7h!n?#ou9c};guv%8O-a6dR2c%rPbwVVhki;W$ z<}=_j0&*0YQAtOKFksTZNTLVAoufe?s9iwz0XQ^5E<_=~4jUZ(;>@Nv7JYro*4q8xANx3FvHBYt8mMFxMg|&( z9KT@ZmVZ0!yFLFERZo~BB`I0we%tkUZPvz&i3gi7S0{K_?dc8hbxvkW%`>3d>{$qU{!{44=EIMz=AkeBB^#0;e z+}euI6CHp+y1KgJKWMl<-WjQU?ToB6wQ+Opm}~rv@{xhbVM~UXn2d_!YK>4b>uMs` zZ*&iV)N-L_eQ)X{@Ri9ohINeS7>5>5tG)6C_%A=0XH8)p`}_O1hFIn0Ti=tj{G*rR z_OV)UfAb~>90jxVwNwus5Q1}I1ovab@qCeeORlc1@bEz_I8*4W*a|#mDvFABebL6I z!?2lveCr#a3y$!rHJ`wqw9sw7yY}@BiH+5sv@n55U<^u5R2M|XJ`a=Fs2R9#R$)5G z(36A0fmJpzAfQy!>1QzC52i2c-4keNpESMzE0dMgVHiPek-8m%Sf?>? z-W~*D2Ed9QK!z}(h;VSI-@pI2UWs~{Job)^%wnlQ`Set(_lfmGc1z20ui5lm<CYckp2VT|| z=#dcn>-zmhRD!jh{*4=#*VDJJd%14cMXYl_t)vE zzasqo7lCeMtd$A8Z`a2Hi)E`Qk6)POD40&tGcxiTokhk%NCR!*iq70HF{4aJbo~RG z`R)DJuU2JbhbpU=JRa|g@mNjD>UV)tai!7OYgef>fsxxff{G-)F@aH{={u(1!8R%$ zf7usZZ#fBxo(kje)<>!}FamRwBo5>hE0#-p4$n`WAQBj4|IW+n9Uk7AEq6jgBP{1i z7tcIgIZlW=y>0gkI{DqkVcZ`pBD4< z)D;y8NYYO?`cj&j3+nIN=s}K5uk>$IUGkLuHmL+qa;)s0T&}Kq`rf;zCF%DS_#j9>8x#0h2{8CwBHQ zyYWOl&MHWhEtH z>j7XZ0CDr?CUCOP4gFh(*9 z7)XYPLGGC`d`YdBuGM6M+?5K~PdMFEbMc_~NYtkhQ&qf1jM485a9y zV!nA}X=4M-2>x2&VDE?5vpC);ujHJeW-)ir%NQYeC}4hUl`;g{S|DGTY#Wf40Xonmz}XG( zU#^7n|6XYnE)e>^OTK(@f(HezcSPKUV5|FY8(6_=tEvFJcfUP*M@1C~Y_l>lGTPeO zz!fr=h6|jt;5N$`+Ypju=0m7*VEC9){9O_B{(3~KF{uMYio0l5iDg89*?C#|VRBo(4rG;L1 zUFN*RBYy%(Q_*u9y$cGyN=YG3)6R+lcvJIhf#3bEY=1=OYs}Q_gqfv!(F#Uzc(IwZEVr)v8TomZyB4!5Dx$3pg}LCv zubvDlb^*0N6RyLv{H6Ic>@-d_(zq2Og(p?o+B|MJ{!=C_oP@7s((e5|yC9Q)<~?+$ zL7xJc%Ir8}ijq_NL1UQ@-r;HW%h`FKOc~Sp><=ds7Z(@*Iez&5*EaW1r{+NG z$;sKl<;ueQ+1-lyfS33K-+{(84;N^wmjOzN@F~KXm=crFp|a_5EMi^a5sNh5abAm= z(#;bINemTl25%@(O6FkaScI1(8M6Zenn2gOuLQE0-NHs7kSzy*i_SVvrC^<^c+>QsZQYWZ^R`$2b@M@JH8z69%ZJcN_&#KlZ`Ms=T9CB{+Q6=ymaTg|U7Fh4 zvjDySga3q%{*NIvK%|I2V6CpM`&36hk$<3dzqlHUYb~`jGi%dC_E)v7LawT*LCbD| z1dG})tZlvB`HP4ScOOv@U(iVvMAYc4PY>Hc`|^0RKlEE?Joi_M9bd?Fhwj3e>S#|JiJ@%0o1HjUUaRDMVE{g>`kl>~eKRTK28`6JKDB>@h@0o$OcHzIcarT1ZYu>G{ zUMW+Z@B>sTsC9?uC~XdAS3otINW(SbTH=@6sgjwW_sNje>)^>K`HZbL%=Z0QT0L40Q#1#t-gsv320B4@17@najm@5O0Z0+wCcP=O*I;dY=?Pf)Ckw}PH%4H zo2DH#h<%`$>MH=2v@T5qSlJBZGHjM4(6VC`698%LRq|}5h){W`r+bJjdTLK zCwPe?`gu2j6Nog2gNQ483Gm^-h2~3ZWlao~u5J93SB>MaMfWnH_H}N7J0vWE{<7?-tt=SpTS&W# z6#zGdCqWKcPJodPB>ooQT!MfemOy|1A|MPeH8_E30>CIKDG8t4d`&OyZc z-S%(D+sn&K&=Ujfp8}8!=THG91jx?0;r%2w5mDG@uZMdZIS^ z`DW8v{~G^ImQT}C9U+}^L42Iw@o{lcT4)K;)RdF}CR0*V%PlCFpPcOK>|{0Wj|B^L zV|#m`zdxLq?;{V7+h8J~^nig#Lqh|2TFIk0Y?j>tn+9rr;M4^EH_&PYWOAPWMle>C zd~81c9d0HphV9s zF7g6_A6N!EJ16GnL#h_En*RJTw6LIylOF2rrJj&| z)8}7#onv~gzWd*uy&chfU;qDf_KG1PA;)&pmA5WMB9l3M*-n(ax;~|Z;{2BsT8?i7 z*j9MWy=_3Uf*!Js>eABV0@Xs$X9WwBxS1v6MLP7RtQrsVIupt275fXN@x_)+Wc&xEH zHyw$eZCR?x-gK+2ajt1sR#C~y`^}X>zO-?aX%UY919vumKD#HIA{gbBWQLdFO4Ijs zu0Ff?lcMaHgdEYwZS%P)KQ)-wFlnm1BAc{#qIOM&LIzNp)jF-7pzn1b?0#`^@!p`J z(a{soLI)NPVCpzHI6&hZ0LfN1HrHoo!Xdn%xof%U*o~8ihX?-EE1;crjE!MJ^lfa8 z4-aK2UxN*Z^FiJAY(uKM#*8f)G)#atF;I%6$Hj>qBWr1B00bK$N**Pd)$Dc+i0;c< zyqK7Q6nn3Ni-iSz0ryR_{MBT)iuKQr_CD{GQIwQ3 zqh@w@?dInXW?7Ymh3EUsO{JuCkF9Ja!tShg$LRqd(fp~|Eukoz{g-sM`;&G?LBZSC z_6C=GNyf&{x6=(S=UJ(#hF><+cy&3LPEa5jBbI)-&CMPeba2okuli|w`RUynPG`Fd z;Y-Pb@z}Z^S(-$etUk|^1_x=QS@E1`9cY79DuN&o0AggbDb{I06Gy^rjiFqz%W2U zk{%Kg5+8rFm$CGJya4flx%UV`g9_>d1sRAQz?`pBXY2E%czt^MTPYvJJHWF6yUb5% zTmwrSAxTL|Ik_XCz5q2HWQ~o!7(n|0atbiY=UYP{s~f+}f|-GVP_`225u9B&^vXi* zi|BuR{@Vn)XNpS&*1Cdu0ILLg7O5crx`Hno8Y-`k_0p21LDg7TTFUQW;$ULZ6dCy= zJbX2t-ZU$F69IOy+^F4j*wXc`>fqtlN=iz;tBVq}pzmyMMn?(lS0XfvK|=*iE`shP zeAms*ffF9*W#*j!TB^aRJ+6-~>mAVXrd}iP4S{Cp+3@fh;GmrtfQB3#fd0|+_q1O@ zfIb9ylvp=0jd+Gf%jOjuc7Cx-=|5e8a|*8Ak4us*W7{U8)p6BYTUPZ?dkwvk zn2@%!_XC{27DbufHF;c4o92!j9xPm>!V;4CUD;4Otc-iGoUssuTb~FVtjK*`Io~FR zw1va*u;rL>9ojZ{KHL>g)Z(6B2Zcl<>2a>i;*`VCPEm6$GKLR&02Bc-B1qOy5YRgb z@=qSRI2XJOLyevX6b#IMY;4| zmpt~7loWJt>MSj7NJQ`l_F@oX6npUog0rC} z)pv}=^#7}|KMUa(i3i!l1ZV~n7AZ~TKO}y0k#1A=zq+pGuCs8$#6|9WfPqTdcU8V`)D4uDIcKQLRb7i1>C*HxWoru$atIpUFRl{_ykl^-OCY z7_b0o8E9jm#sy2EcfH{^5*5zE3TvpW%z=>+3HYrB$%!An$lzebpdj`sDJZ~0s%m4B zQ(8-_1^E|##w2kOj*Ns}ka&6ux!qrSdIsTQ*{odE+Zqr+1VNizw32qJ+ljtlLQZZmG{wzmzhwk2aUFVs1uCWdE%Fp%0^vW{JL>f@yh%KtRn? z6<@@~&Hc#hmzTH0_{*@@yYKIn^OO(h?<-W3$HF2Zz?);qNlBiEhy7k#jk&*H=zO4V zd%oqhWdzn^iT2#g^fd6ac^)RKd4*hH2?_na`u5tW|7??(T5hqr)_JHmqp$CMclY#V zjrX%&sE(*8U}nO8Ab{pGqd%8Vq*PSX;+6zv`E$r7D<2&Si>nXEE+zJqCwF&)Bd|<| z?nknU{xqyjwB`Of{52wy_Uta93`6IaQ7Lqob(LG2R>G+fLHSi~!hPqtENu4M%=OXB zQl0-{^~dmF_EkZT=p%sKt}df+0FIh^DPK7(@^=@QIyFvoo8#Z2a&o}_*J56SXPc&;5cyT^d1LuP_dL#Dco1}rnXRMnMsAsS0 zIPCavMdHrH^U)y@OfRuSsT97ttAA~J0*y%5SVw>B|HfCu3vK&y5HI|owEkGXt8v20 zqsl`hLgWeMNo%ZMIYdbw%%>$hzV05m=?Xw%d3pIoCnosC0u&S!2_H0A5|b6PKwYdc zdyf^GUs?((i56h50zQa{%LL_IxxbI;s017rl^yM!^VNRA!4W-SDQqS`Ss)ojMYanZ z3n#V=X-h;q^FrBn(&!;1Wpe0&?)}df*DbBjE*IzvnppzUiToZ70D&C0KBGat0}eTj z&kgwM=BU=U0gU4%)&q{yo^`LP4p%_p0V)`@FPxs7w5^|BY@)nDg42)%jm)r+f7{zQ z*w{z%0e(T%|4(0E9aUA=^?O7>+Cz7j(hZUl0!j%=NJ~q1mxMG(s-%EYA}Jt9tANtd zAt~M6a3}9KzWdKR?%jjo;Cb}GKI^Q#)||guPN<+T6LtIDke!`ZUHxZdWT4CTPVeU7 zt6S~-eOo&A+0_;9(UWhDmMAg&(Erd~G2|jRIXMx{73Q7bB74mM2)CRlO4kGAOWIqj z`{8t}te_PIXkOtG4Y42VDkA_}9Y|_Cf#8QCX}~ z;$ysHqW{aNNAtV#TZ8)Jrv>NwV7*J(KDn^$-bq~^KFKYhM<6QjxVgD+Bg!CjsVc(AtRjc@BX&C_BX^imLuUO2t&U5usHSjj4{y0GFY z&WG&VsAQz1P>VsVKn$gDPj@$NIXe7Sf1-l#aFIz5nyNq9qCbt(k~oNU1z8jzNI+J? zpD==u#SmSw0$M^4l?ez7S6X5b%9B*S-dUYj!hTe))k5$H`w>8v0T~W-=X|eU^*~4r znCuuC7?$^fg5&5=u5bsRN7Jp|_)IEQROa!45HF09-$L2T>mK5LPL7P><@Bu~VA%@` z3p;H5{rv$AsFwH{$ki-^gNrlGT>o7c?bNl}V_0jjsEDtU`%G<_|Me^U|KicRt^HKvI|_G2L4ds<4Hflq;UF;gP}go>iR6F=0eYXsr6nLPfZ6tJ2|{bIk>w2v z$6rR_kW)~|7b*2zRzWW2{aaNVQD_*Ky!m1o1P<(X@6wmXiE=0D|0c>Y?#Lr~QI^oqo9{1yu78iT$Ed;~Vo@N8^-tN)=}sdx zb%*X$NrrE?zL!N(nBe_~?+!l&ND)ATS`rtdt33)p4HC~ePFQno^2oK+WxIGiHubf{ z8DYS5Q@HhL{8&?o8$^nak2e_&QR2kcWJqD&iPL~tOPUTTA4encCHK|a`Ieh095QPT z0{9{KASeSG#7csSS6%-9dT(ZxxBIno8PM|jahbMak&==EL>v$hP#k(5_2I(@Angg! zf`fu-SS6NFN1Rv9wixB+4A8a6kz?gMQ7a1 zM~I6xJecs1cC5j@{QgZ(knS_Pj@IPo|Bs7rSO#7Bq2WVSlh_G);s4-k ztaZ&GWY^Ve+Hz20h~J#74gO5?r4RCW%G|zIq;5o44RAt(HX|>8EOpQO`SO}cIVZ*qlvYB@6AR(q2A?@hw%=JJ; zLh!}w#Mv+etadMjZ#qynX=;tO?^shQh6JD*v1WZs69WR8BV=Bmj-S8s(G67X7pMd2R5^DSz|GfJy}u^ z)f8?!DzYCQ7iZMubwSG;pcs?Vs;e~pK|cSocCYt%)Dxa{FreySw;!Or!UPaU^6S!! z>O=;vAg+$hN^o&Vag-jHym)vZ2@h2uZ|K|EFRd>?37gg}OnY0bM8FW!=HAurotggm zPjQ4Mgfpvw&r#N~jUz&9L$8PfdeJf+j2eFG0?P}MkeSMs_z}ij#@uW)9NPET#?kTd z{R83oZ-fl6BnhK8s8p0pJ2OLl8W;S1$oCQ&-MGy}5C#YzNISV&JV>iMuQRCr2IV48 z|MuaK-pI3(sLv#~ZlOnoha2bI2qJbg3}i&&<73vr8cp=iVtw)Jkkf2iXz{3FiJC5j zZpnJ1My8SfRgWL^*@psHvv-V*0)rjh-Fpqjt~o+EQ~X4FG#DClS}~{fxW56*sjFO5UvxBW$}DfF*WE4TE#$2+O)z5G z+u1cYw}3!|YzDH{q2{XK^jJVuE-%gmSzicM38>Vhm)PWq4S5#54u5=QQ}DT1B~GO` z`d6272RI^(HY!q;S;Ry|VP1jdZF_I8QdK;J9TIS2S%BvNl`tgt6#gn)SXcm*uKy^f z*FltHx2OkeSHqH%ay#X6jL{{#D5j-||f5NA#Pd+G>on-3*+Z1i982Y|F4Hz!ni1(P9*=j%$ehUi;azcTf^3D1-q$0%nPAS~oxg!OW|r zm7<;EapZdR+8bW8j8pd^gb6P!@lB$(x<>!N5Qv=zhK7=plFpf&A3O++iBa+K5hICm zb8-TaP+%{bJpVC$pa#qfP{cv$g9wc8^qJZ51b_~%!yph_^4BP>ZfpSJ29`*GM2W&M zWrMK&QQr4AHwQ*VDcP)r6}E?S?=rHoD&+RREq%zO0rp!U7Ap+yqo8Wt5C9Q!NpUfi zcP@h=8V_05wq9UnW@dPJIPh7F6WC05jEV1OfRQ2Z!v`RVajP8Xc_m4rsJ%JCY+YQe zOov2np%Gwg*CJK{0_K@Ml+}CSl#4a9bDWYw0unuOnkLBdfQ{wHw?I_1dXoDYp#21f z7yw8;X!$@1rmP%Iso4xhmd;LiH#We$-@6x7r-TxM;mH{&4=$D$4h~@Wi)(1OfZQn} zVq*NQIWS9gk)onJ2fGan%H%TKK^fM2{7@N)cjIPbOGr+Z@HynrJ|iF{HL7)9NM_dt zY@lr@mToY}1Jw%Haa&8v_DVZlVcSv1h2O+j54MF=f{-^pAt)Zm%Y*YI((>=@j;E#N z62R}72N>B{#V7>>!^4MAp+Z@-Q!xPc6A?q>!5~e98^FyF=%PX6fXe4ICr3=2yuNO0 z=#G_*3a@cFSk*L~!o$JD!;^HHL)|(HJ;u|z;R&WHHJeJ{}%NsC}U#*=4^0P#bJ}o16Cj%!nN{_}c`) zIo8*^+BXoe68QQ0g0=oQ8S#S@hC~sdBU*=BZ-wk9p`84g{jj^w3h@b{3lua2PeI+Y zBa92htDfFONC@g>-i;lCVic=u$9}>}1CZAMfBy3zL2fm(1(Njl_xqBw@FYNc@a4c8NbnVIau_Sb#Enh0XJk;l&T%>X%TX=rE|8TD?- z(HRD623~=`2L=Fu!sacxOIq~cF~}7HpV)B*#t-Z=tZgIkhl9cs+>uR$C*iQ(0BHEj zjIW9C*((N4&IYqz2@u7wD~2DwW=uR&2|pDkU9|`KT#-te&^6vw8->sG zO7 zd89#y0sl82NC1AaXu#C`Sy7zub+s61si=wz3a$-LDk`||lo=8q!j2Aa7cg}`J`r;A zbm-?n>kW#nxwOL_{5WlLbG65h`{3t5Q*{DwlamZRxTUnw#@ael(l7PhyUeVtcH_P; zRf7Bb0+^_pRCrO}pPQS3cbZ^DB4SX9;b3^U`svg9PbL1WEG&}dkyQ;BuAqE_u%20BR8;WU+e(Dcp$9()C2V>+_=tM8^yx}wWQje`4((iBpW50A;IT@Wwk47C z7u(vhJbdK8CYD|5K*#>+j-VhnC#QpPV4ca&N3>ZB%j7<18^AR{ABJY~eiIx^psa*i z{rcXC#XqA!d5CrU_S&-5!EWlx!a`Buuayf&6_xoao4X*7rw~@PX^%C6XA}QdqA=JC zF) zcSi@0kPt~R0Rk~v=f+MY&6M<218r{3zWd$0`~EVR@-IGoINp8%nI2yMIu^l9)0MvB zx@AbPMR?37P|Wum9TrQzcTjqD!9x{7AE1CFai@c|2}GW&tB*S5Exu3GbStHtuP#)v z@$iIC*ZKnV3FOB!EiI5mq|ob4b8&HP04w-K zkGkCLtWFcYozny#Y?)4>UQMfz-7aWDX8pFHF$HEd$Ph*c6-63k8DPbRd+nGhzyc5J z@#$&0DDj8lXazQUdrD!|h3(lGc5SYFjY9EFii}Uu6}L*HnUqC}P!!@`O^lM&)sE36 z<2rEYFBg}Vx*x8S8@dBD_U!RvIwXHaV`xT(0T>rye6D9*^QFs6&|Pjdd2rtePe@6T z6Jn)VUh#6UyO7l#C(Ptjb_9os$JP`)bvt=tG+*5}blu&BCTry|%8bw^CoRy?d(tHI znz>M4ogYAKk;&}AT8-zxU)W|%O-%Op_dN%wZ$G|61ZxazZZFf2H~fOS#e(2_iqG1P zN{~l7#y4_$YCTo_>6yMh2TUwwW?&+?xEg^%1lVK`R_G_ThS*>0M7O4!oL8R`{ve$D zI5{ND+P}U2I}0 z;G?RFmpsnC3_qX8^wmM5pElsf=GNA~8w~FdJ@WOff6uY_cY1mny0E^!KHx|OM@Rdo zrXGS_@`oxzIXDC>KSjwg@RH%+pno^!;X&*l96^9WM7ZxljuSQz^C(gpWXNHVF3vQ%X}CU{1IaI?P@?d`OHIS`NNV&w2`)QYP-W zH=uV({@M9^&Pk-cxOn|7Z#dKaYz;9VZ_$SzdNOHD)Nb#&*;rbdDkxybkIFDr<42I; z$Ct0J!i0;u-}h&Dm;uS6{PsQ_64jN9#JXG`4XRFC+dL>RnW^U63ZACEY)Qz;83CGC zf3I?61JJ?z$w9oFh#jzF?z9=jr7#zYhZMQD` z#CU+GfR&-@VCzr{q0jJTV_#xp_u2QTq@-M3S>HD(Ha4@d@z;lku*w4wk&qB{^nlpA zOdpNQ;1tqY>tSX4nuOf48*_%$Bc(=ITL|0M#>U0b@%U&uz)N4i$J^T(j31SidxrI% z1{yg`+z!u;jkELfOFw=T_CFW7(KNbANmc+4h38rI*Sfm*_2-&iwE(|`hW-@Lo7l3o zjgF3P^bSM8ZFeSyCQ2kgvadO?Im7puPU=cUv7<`NW7CE47?51x%8$U+9W#>!sZF2; z^Vy$~c6UF#A8;k`!QtV6VMFACp^Wcy7O|IcD6bOue`u#il{9M7yYr$c9d~Ceuoz(Q-ztsK@cZ_t- z!aKUUTpf{t1_C;QcBx=WkBy4Lu6Pcg7c`Y$pI$2wuOcIAscGYA`7O#52ZpG{FihK> za~WSUvapFhGYY6^^e?M9q6ojt>0ZE`r^$km18Q8Q8zCl$sFPodY4-e-_ zIc1Ljwt8rnvLq)TgoaYf3)vbQL!vix1!dxs!a*25eQ}SH$_BrM^|2^@efhoi%bMJQ zm3u#b27Jtu^u3&PnQe9R_lJ3Ru8PG8BQrcq5)l#hxFU}(sHkY_^D`F#Mn>$Gw>NLz z1Yt_4Q4>vYU$6&73<)8%-||e$ma?+Hep$2bYf_FmMrVhus-&d78V5=;%B|bjgcUb3 z)}PPD2DTUjdxT|#i9kSQH#pSrK*&NvBLPN4gLwvuEbu|7^^XJqmh34gC}$F@%BQn_ ziiSPhofRM^;RmiO_kny`NoUls?>l1L{wA~7$)J_O#eM4gJ)}j4o*D_wk}MMeesshj zTkgfhg%ldv1_sut&DNAs(|M~krZErMJ2W&h_D>4ESpl7Hv~5_k0eY^j#yr>=8Q8fw z`%Yh9XlcRfwcsIt{zHZsvfl%FTS2}_z@Dbv)T%ckQEWh z$>Ce3qxWP0G(cV)Za?n%`N;tAsnHLQCBRne>+2%X1Jlz|0h{`^4qF3Jq_|a8W8p~e zl|RFYtTzxo+=i1UxRrr5rTUnNw-6-OLF-o?KOtK8Z3+EWC)|reXG%|IrkcO??0j%} zg~{bu^J%diNbv(dD$RdyMG>-9JU(*>(I64$c={5|LMkf5C1~zjjmFkRXPbX7ekI}_ zZeC=J6?_tF`j#fXJA+Hv>b`mYQc)SSFAKM&Lii{_B41p(b(ho5)a;80=LT9OesBvD zlUYGg9gtWjN7L38rh0ly>ti=W(u3c<8;K%i=2*Z)^bJ0J0jbCb#a9G`g!2mvKc6Gf zgUiikWh_nSFZ}&Ya&p$u?)mI3e%^LO+;_EF{^)T0Kx%#KHt+)5R-_ zP}xiufPR-lWK=;_m4(ju*`we57L4)7A{@2@9l=pirQEvz7?_!PZH7I%_;^JWcaEee zD1F|4VmIw1$vRlOjYoa{@1gXApVLt!-Ny@WD!Wp${6(MJ77vWRrJ|^7>D`*?I5uKo zkJ=#LQU6{IQ?pp2tjKJ|%2#t9AM_b3!(L?B4rug?gGJ2I*xVrM2UvmM)Lj|-zU8X07QXc-#h`<2;p=Pg4G z2kwchM{HPFPGNXxw&R1H(#V#d8pO*jvpSR>{gact{`C~-rXLFn$45sGV=O~M^v9b5 zZXzI*x;}gMWpZ--hYum8rI4|7a}NQZo!gr8voT(O|4hiGvJhfnT>_;QO4xV*s|M5O zvw|tRz|=VYf$eyxQgZEoI>+=<6C(fRzH+e51sA9Cw=?n}5s&rN>G^F(yL$6g)e8n! zfBa}29qo#f`bV2CiHq>`+gr4xB*$sn#3uE%=-u=@KkkVjY|50nTCn==cQ{GUKKZva z{{t)zuHNgxx7J8F;EBbxv+Giz*Iivz+1U6V=diL|CLj=vh5Na|M;q8t7f+G2D|v9g zxC#g~)>KBxkA2{tGS0?&{fmj5JVjxo-%0?Taf`Ak?nD3b<)y;@L6wl*>9%yzyJyCB z8&TiyDJlgBgsQ8kU?SdsV45B}nEgC4HkSK=sn^9a z4-IK1C1T&kQ2f=s;P}jsRH^fvlv^Z%?!8U{3Uqe@6gGMnG1Q+Xr>4*l1ts=m!kg^9 zM0bda-i-7VK2bTpc!MVh+jdmbRmI{W5#LE}{#OXDMg$%nazRv^MN|b}V^#7+*tr0O zLDFBJtyxHHfKcS6-mKo|RJ^?9YEw+>FE-ZGO&x9{6z};QdahsHzR2shk}Z9pL-nF* zdnrrp;^0kA`s7R6fOG3Fe~vxn4QUv;x0-sW8JOwIJAN)`SzC8qoUKVn+(3}wSQJ+{ z`?>HVW(<^~+S(J}8zv=*2VBfPdMu-_uOSok{q9Y_n>Pt^optE3H4$Nn%<($kY@9u6 z8XW0MzNPuj$rXpSYty`S7<2aRp*maW{2L~Who`}!@@Hd4ma8@EI6dzF~)nFo8yn(rQ_x8@9tK4^eFPXhz^IAw0e2? zd?}~J`7z@jp~e$Ux8pRk*oKQ9m!%Gn6WzS&1A$NfB9eMP52|Ksz{Jg6>J50-;0^yI zI2{fQNR~gd7Rc+(6gv+j-rQ6_+Wh!$k?UgGq z&*~^S-7+_uhi-0HGc%1*q)Td9J-bak?IrmiyWa{%eWwcwuVTB;a#T(v!SsV$_$WCq z4+4L_Pc_gsTDBS&zcnJnYcLiKkhEX;-O$yReb{t$X?L)Sg;11)=ysQtnkOh$R`SR+?w0{r9B& z)7!?hI-5$KCGPLvMbO=4UmFB%J3LjNk4@T8iDyNVO#cFQU$y+g_!E>1@@H7P1B zwHtkEY`Q5B&0R5+D>&!~V@QUTIy>#b#v68YSz}2Iz@D>mIqeDxs*#(6+Oqc{^2X0r zj5$hS`+DD#I~?l+*!O0UM6Q2+n*W-_Z#w1h0;wAa7Loe;wj(_m<|ilR^z;NqdZSyN zJX%_^Bma~=`1n=8Puw1hhDaJ3>c+<7`sSCmaoiz4-(Xp4_*v4EhyLzEBcrV8+U*xp{IrD#+9T z@@W#YHNy)Emz$e1_(qeTx2a$Ir*la2_>y#c^xN=oaD4n&sZkh}2;|qG_~(DOEWY5w z$Iz9P^$3Ape&a_(dJhknsqdSe_E|y#O!~b5$-B%8>Msh*-;C_ojMV+gA`iv&8;`6Ku^ti3Ma{RD-r#ZXOvxIJg|IEa;XnWj zLI9-lIvm%M#%=f&Nl9pGYP||kW1@DcL`P!8u0y!EH3I|le0*j*o>w!*5M|^kAsAA{ z_BtcO?{vR~Quxq?o4)ZazvbG?o2*^k-D9yxz;m;*0#*m_qE?>rLDo@9iu>B>0r*P_ zSy(m)@@mIM3tBjDhQZ9{hP0X2X+Fa2O3E6}I~C?pZ#eobY^?JfO+RDd;Nek_Eo*AE zVLqY$__*NoREdq;w-P_rvCBb6-tUW1BA@IY-;+Jn~U~_U=Ea( z74}o-5E4UH%?M;XMCN}Dq$PBaQrFf#0!nnfs|%vTB20LM5?P+Dtfj52yiSzxF!PpmfacgLEQ?o zkvJ)P5C@xxwKn>lZF~9}8`A|nb1G?QkN^W0^jwN}sb$;bhb2aWj`K)VgjVdS@ zl$x3Xv`tY_T>=3`(aqo%tBrMAduU^=i>|+*jeSvQV{5y$`iD$xxUcW=^z~QYj~_ty z-`W&wrFVB{$Hl_p;eVpjkeb_4eaC52UtjiSaH3!b1Vi}(F?)Q)8ApE~a0ov?KWGQx zvQts9b31@MA()cWO#$3oEO`*b1zZXfYgqd%k)ud`bXTAKHFE6C$HzbxogR&Y9vpx5 z>V&jQBI;J*;E|sn5nJ-)gi^M~JH2H01Vv!L5|uB@^j_Go?eBNPKTG*tgU>fv$^?wZLNdWFu$r~8{8sT6S`(mQNNH= zQ9%a|Q1t5ZG9=ucm$}@FAB7YYMJ9^m@qq!^`~k>%Ajgr{_BhhM`RI|Nak&myl|f4$ z9u?Ku(GeaIHBU?=dENql5`owsG$eApJd;Kml}YL1Mg4pgLWO}N-ZPsJSFeyiaB&eA z8b&+s*cAYb+ELzZX=HENiK}DBc-1F2H*=5m`_6iX_7hcW9(>PM|NY`mM+N-?+%BXm zJ3C_(Yhg(H{#Y^nTxrQYI<8t-C0JFH6|E>UnUbEqckHy2$eM1i2C4RpN=iyPD0KAA zDS$VE0_o|4ng^Sqxdj2%uOY#} zS_Oo)ps+{RyS)M6x4>C+4`=8<_#n?-z$bIr*Y{;Dg0`c{`GbOM;1sHFO##UG!0@$= z4Ol9cN(|2OTvfv8F0Hd>rBX|(LUeO~94_qaf>CX%JBEFI6Yk}mnHj!&fmZ*JN*4y6CTMX;k{4R0$4l9oU1D*~-oiR3`!SW}Y}YiFV~a@_IA z`EO4Tm+;Zgx4fw&B#o9mlk01gGloWH&RgZCQS1z%9K%kWlz&`IOn<++QI&P|w{M?6Fr8iVUg(=s-Qu1+1c-jf zA_TQa=0xskcUKqm)R?F!+CDGoXy#uKlkI}We|fp%%a^Buf)5lFTzq^$#u4%8(XNq1 z`Nz=XUGtNHd~SX|tcV|(@AwUJb4);K=QZDkYrmwgqjNl|8X32fkA(xF zE8gcKoc#O^Ku6{V7v%D*Dp*qCvBq38SI~ShY0&UX z$Bz&mrLMlRwl+~^14z_FZL0NuFs6^CrF7lduiiVfEV1!WWvG^dpP;ai{^~XYjIh5t zt}iQCs$RT^sb_`!Kgbk;b9>^#!{15;NWO8VBqQVD;kk~Ceal;aoOd(G6Z1i*MPzt5 zyr!})i^^r87d9DiK0)#vcFT%Nk)1)jksr^aTjEE0HgPv z0D&nyTL`ypWHb%n1nNyNfV4hGdEG}?#5S|Me0|Q;)KskEml}s@n9A3od<3{bkCh6F zpw9<90#joT8!V^r$XW>?GxLL$!7s_KRov0ty}*MP+yeZTs+yX%rse}CUJMz|>^d-g z!ob7F0W69$87nxIT0<~lMbCX%rgJx_sCY88xSrE>mg_(LpCsWc6I>Dh9?_dUWSE;b-;p8&gv0fD|s5wHwkEL8zL24{Q#oe5sIkJmOkFd7?U2Fep> ze}*9iSBA|TJBlD0<`ynT~ z5agx_Vn}Z8Ey}pKsHnaDeJFb=>_Td>5G1$on$^GeEi?VoGzKOIsD-l>YAo2s3ZE9i zHg>xri0&!=E*l*)^8)POoSmykIJZ2!CVa zz&8>A8iVDn4tP4K$eLoI@DkwRfg%8|8FPDh`ylA7U&jxUpIZ?Qh1C=mBy@BO@wNDf z7USs2UEi;lmy)6xuYUgC<^Vz_`B95;L2d1``gNk~S5$%7Ik2`?#nTgoTkOH-Oq#hA z&dTEqG}M@&B@`s8A9*nfQeeD=4I!ON{r~wkI|r-J>M1*WS80>KKy<(e7cDzGPK^A5 ze4LgR*me*}5$1tRqLvq-R?d^}wPZ$^10xrF5Ei5{NRTmbLQ@E!A zNbvsWi$$F5)R}??hcL#7LtF(FVd4u{(a(8{Dz@uRf>k>YA68*vCTnPzav5OVK!m)y zcf0+Er!|KnfF{=i;ix}NGHL$07E|Xra$>D?(}9TjaFJd@bMu;H2=ohn~^R~ zBm^;5W?!Emzh#l9w`zTW)HwXb*t`_1oDwXHZ>y_kJ67cV{I&=QxZt#j|BTW-XS2Pm z0Gcn=B#Z=la6X@Q@hBWz35$h6!|9vBK|Ms^`FV7F3^GLZP7#W`J56t<1RR*+Dk{Os zIyOA)x2$jruh_*k-Q&pKPFWd_kL-DQbM5U0w~>WWX%_DjLX{tbJ6zvN7!Qd0aM{dTiiBcG_wknr`)4GYT)3R+EIPID9yhwO}hs~z&Na1en% zCNMD(PQeo=VdsaE2muFdnwny_#btrLbIoV^@5OUY%th~HW z4eGyoc!ElTHIDW+Izl;vt;g1Dhv5L;HUU9G*9dA5#Lj7GSerq`Kp43Rrr_AvJut`f z@o$NUbWu)iuCIHY?7o~b)KE~^Q^@x1- zSjg326Y&(Dv%xjDnCc%Aq!!bnL_mls36=QP;Rc`Cw;A+BUD?pkt8FoSt1q%6RS2KR z$O=5#DLJOr47-eO`dBirOg$%hdnNsluEi;xqF)(s4b4P)ZK_x&I(`hR}wDQc}KFQ51I_+9=I zs-b(N2@dFZ{Fe~Y^%*Lt(nzcpF_iy(?dBCi(4r^+UFaDI1Q3Xa4^-t!WQ>FU51c`T A2LJ#7 diff --git a/release-0.19.0/docs/devel/releasing.svg b/release-0.19.0/docs/devel/releasing.svg deleted file mode 100644 index f703e6e2ac9..00000000000 --- a/release-0.19.0/docs/devel/releasing.svg +++ /dev/null @@ -1,113 +0,0 @@ - - - - - - -tagged_release - - -ci012abc - -012abc - - -pr101 - -Merge PR #101 - - -ci012abc->pr101 - - - - -ci345cde - -345cde - - -pr101->ci345cde - - - - -pr102 - -Merge PR #102 - - -ci345cde->pr102 - - - - -pr100 - -Merge PR #100 - - -pr102->pr100 - - - - -version_commit - -678fed - - -dev_commit - -456dcb - - -version_commit->dev_commit - - - - -dev_commit->pr100 - - - - -release_info -pkg/version/base.go: -gitVersion = "v0.5"; - - -dev_info -pkg/version/base.go: -gitVersion = "v0.5-dev"; - - -pr99 - -Merge PR #99 - - -pr99->ci012abc - - - - -pr99->version_commit - - - - -tag - -$ git tag -a v0.5 - - -tag->version_commit - - - - - diff --git a/release-0.19.0/docs/devel/writing-a-getting-started-guide.md b/release-0.19.0/docs/devel/writing-a-getting-started-guide.md deleted file mode 100644 index 9333cd1856a..00000000000 --- a/release-0.19.0/docs/devel/writing-a-getting-started-guide.md +++ /dev/null @@ -1,105 +0,0 @@ -# Writing a Getting Started Guide -This page gives some advice for anyone planning to write or update a Getting Started Guide for Kubernetes. -It also gives some guidelines which reviewers should follow when reviewing a pull request for a -guide. - -A Getting Started Guide is instructions on how to create a Kubernetes cluster on top of a particular -type(s) of infrastructure. Infrastructure includes: the IaaS provider for VMs; -the node OS; inter-node networking; and node Configuration Management system. -A guide refers to scripts, Configuration Management files, and/or binary assets such as RPMs. We call -the combination of all these things needed to run on a particular type of infrastructure a -**distro**. - -[The Matrix](../../docs/getting-started-guides/README.md) lists the distros. If there is already a guide -which is similar to the one you have planned, consider improving that one. - - -Distros fall into two categories: - - **versioned distros** are tested to work with a particular binary release of Kubernetes. These - come in a wide variety, reflecting a wide range of ideas and preferences in how to run a cluster. - - **development distros** are tested work with the latest Kubernetes source code. But, there are - relatively few of these and the bar is much higher for creating one. - -There are different guidelines for each. - -## Versioned Distro Guidelines -These guidelines say *what* to do. See the Rationale section for *why*. - - Send us a PR. - - Put the instructions in `docs/getting-started-guides/...`. Scripts go there too. This helps devs easily - search for uses of flags by guides. - - We may ask that you host binary assets or large amounts of code in our `contrib` directory or on your - own repo. - - Setup a cluster and run the [conformance test](../../docs/devel/conformance-test.md) against it, and report the - results in your PR. - - Add or update a row in [The Matrix](../../docs/getting-started-guides/README.md). - - State the binary version of kubernetes that you tested clearly in your Guide doc and in The Matrix. - - Even if you are just updating the binary version used, please still do a conformance test. - - If it worked before and now fails, you can ask on IRC, - check the release notes since your last tested version, or look at git -logs for files in other distros - that are updated to the new version. - - Versioned distros should typically not modify or add code in `cluster/`. That is just scripts for developer - distros. - - If a versioned distro has not been updated for many binary releases, it may be dropped from the Matrix. - -If you have a cluster partially working, but doing all the above steps seems like too much work, -we still want to hear from you. We suggest you write a blog post or a Gist, and we will link to it on our wiki page. -Just file an issue or chat us on IRC and one of the committers will link to it from the wiki. - -## Development Distro Guidelines -These guidelines say *what* to do. See the Rationale section for *why*. - - the main reason to add a new development distro is to support a new IaaS provider (VM and - network management). This means implementing a new `pkg/cloudprovider/$IAAS_NAME`. - - Development distros should use Saltstack for Configuration Management. - - development distros need to support automated cluster creation, deletion, upgrading, etc. - This mean writing scripts in `cluster/$IAAS_NAME`. - - all commits to the tip of this repo need to not break any of the development distros - - the author of the change is responsible for making changes necessary on all the cloud-providers if the - change affects any of them, and reverting the change if it breaks any of the CIs. - - a development distro needs to have an organization which owns it. This organization needs to: - - Setting up and maintaining Continuous Integration that runs e2e frequently (multiple times per day) against the - Distro at head, and which notifies all devs of breakage. - - being reasonably available for questions and assisting with - refactoring and feature additions that affect code for their IaaS. - -## Rationale - - We want want people to create Kubernetes clusters with whatever IaaS, Node OS, - configuration management tools, and so on, which they are familiar with. The - guidelines for **versioned distros** are designed for flexibility. - - We want developers to be able to work without understanding all the permutations of - IaaS, NodeOS, and configuration management. The guidelines for **developer distros** are designed - for consistency. - - We want users to have a uniform experience with Kubernetes whenever they follow instructions anywhere - in our Github repository. So, we ask that versioned distros pass a **conformance test** to make sure - really work. - - We ask versioned distros to **clearly state a version**. People pulling from Github may - expect any instructions there to work at Head, so stuff that has not been tested at Head needs - to be called out. We are still changing things really fast, and, while the REST API is versioned, - it is not practical at this point to version or limit changes that affect distros. We still change - flags at the Kubernetes/Infrastructure interface. - - We want to **limit the number of development distros** for several reasons. Developers should - only have to change a limited number of places to add a new feature. Also, since we will - gate commits on passing CI for all distros, and since end-to-end tests are typically somewhat - flaky, it would be highly likely for there to be false positives and CI backlogs with many CI pipelines. - - We do not require versioned distros to do **CI** for several reasons. It is a steep - learning curve to understand our our automated testing scripts. And it is considerable effort - to fully automate setup and teardown of a cluster, which is needed for CI. And, not everyone - has the time and money to run CI. We do not want to - discourage people from writing and sharing guides because of this. - - Versioned distro authors are free to run their own CI and let us know if there is breakage, but we - will not include them as commit hooks -- there cannot be so many commit checks that it is impossible - to pass them all. - - We prefer a single Configuration Management tool for development distros. If there were more - than one, the core developers would have to learn multiple tools and update config in multiple - places. **Saltstack** happens to be the one we picked when we started the project. We - welcome versioned distros that use any tool; there are already examples of - CoreOS Fleet, Ansible, and others. - - You can still run code from head or your own branch - if you use another Configuration Management tool -- you just have to do some manual steps - during testing and deployment. - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/writing-a-getting-started-guide.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/devel/writing-a-getting-started-guide.md?pixel)]() diff --git a/release-0.19.0/docs/developer-guide.md b/release-0.19.0/docs/developer-guide.md deleted file mode 100644 index 1bc77402d07..00000000000 --- a/release-0.19.0/docs/developer-guide.md +++ /dev/null @@ -1,41 +0,0 @@ -# Kubernetes Developer Guide - -The developer guide is for anyone wanting to either write code which directly accesses the -kubernetes API, or to contribute directly to the kubernetes project. -It assumes some familiarity with concepts in the [User Guide](user-guide.md) and the [Cluster Admin -Guide](cluster-admin-guide.md). - - -## Developing against the Kubernetes API - -* API objects are explained at [http://kubernetes.io/third_party/swagger-ui/](http://kubernetes.io/third_party/swagger-ui/). - -* **Annotations** ([annotations.md](annotations.md)): are for attaching arbitrary non-identifying metadata to objects. - Programs that automate Kubernetes objects may use annotations to store small amounts of their state. - -* **API Conventions** ([api-conventions.md](api-conventions.md)): - Defining the verbs and resources used in the Kubernetes API. - -* **API Client Libraries** ([client-libraries.md](client-libraries.md)): - A list of existing client libraries, both supported and user-contributed. - -## Writing Plugins - -* **Authentication Plugins** ([authentication.md](authentication.md)): - The current and planned states of authentication tokens. - -* **Authorization Plugins** ([authorization.md](authorization.md)): - Authorization applies to all HTTP requests on the main apiserver port. - This doc explains the available authorization implementations. - -* **Admission Control Plugins** ([admission_control](design/admission_control.md)) - -## Contributing to the Kubernetes Project - -See this [README](../docs/devel/README.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/developer-guide.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/developer-guide.md?pixel)]() diff --git a/release-0.19.0/docs/dns.md b/release-0.19.0/docs/dns.md deleted file mode 100644 index ecdde9b27ce..00000000000 --- a/release-0.19.0/docs/dns.md +++ /dev/null @@ -1,44 +0,0 @@ -# DNS Integration with Kubernetes - -As of kubernetes 0.8, DNS is offered as a cluster add-on. If enabled, a DNS -Pod and Service will be scheduled on the cluster, and the kubelets will be -configured to tell individual containers to use the DNS Service's IP. - -Every Service defined in the cluster (including the DNS server itself) will be -assigned a DNS name. By default, a client Pod's DNS search list will -include the Pod's own namespace and the cluster's default domain. This is best -illustrated by example: - -Assume a Service named `foo` in the kubernetes namespace `bar`. A Pod running -in namespace `bar` can look up this service by simply doing a DNS query for -`foo`. A Pod running in namespace `quux` can look up this service by doing a -DNS query for `foo.bar`. - -The cluster DNS server ([SkyDNS](https://github.com/skynetservices/skydns)) -supports forward lookups (A records) and service lookups (SRV records). - -## How it Works - -The DNS pod that runs holds 3 containers - skydns, etcd (which skydns uses), -and a kubernetes-to-skydns bridge called kube2sky. The kube2sky process -watches the kubernetes master for changes in Services, and then writes the -information to etcd, which skydns reads. This etcd instance is not linked to -any other etcd clusters that might exist, including the kubernetes master. - -## Issues - -The skydns service is reachable directly from kubernetes nodes (outside -of any container) and DNS resolution works if the skydns service is targeted -explicitly. However, nodes are not configured to use the cluster DNS service or -to search the cluster's DNS domain by default. This may be resolved at a later -time. - -## For more information - -See [the docs for the cluster addon](../cluster/addons/dns/README.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/dns.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/dns.md?pixel)]() diff --git a/release-0.19.0/docs/downward_api.md b/release-0.19.0/docs/downward_api.md deleted file mode 100644 index a5b097c357e..00000000000 --- a/release-0.19.0/docs/downward_api.md +++ /dev/null @@ -1,53 +0,0 @@ -# Downward API - -The downward API allows containers to consume information about the system without coupling to the -kubernetes client or REST API. - -### Capabilities - -Containers can consume the following information via the downward API: - -* Their pod's name -* Their pod's namespace - -### Consuming information about a pod in a container - -Containers consume information from the downward API using environment variables. In the future, -containers will also be able to consume the downward API via a volume plugin. The `valueFrom` -field of an environment variable allows you to specify an `ObjectFieldSelector` to select fields -from the pod's definition. The `ObjectFieldSelector` has an `apiVersion` field and a `fieldPath` -field. The `fieldPath` field is an expression designating a field on the pod. The `apiVersion` -field is the version of the API schema that the `fieldPath` is written in terms of. If the -`apiVersion` field is not specified it is defaulted to the API version of the enclosing object. - -### Example: consuming the downward API - -This is an example of a pod that consumes its name and namespace via the downward API: - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: dapi-test-pod -spec: - containers: - - name: test-container - image: gcr.io/google_containers/busybox - command: [ "/bin/sh", "-c", "env" ] - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - restartPolicy: Never -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/downward_api.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/downward_api.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/README.md b/release-0.19.0/docs/getting-started-guides/README.md deleted file mode 100644 index c621e43a565..00000000000 --- a/release-0.19.0/docs/getting-started-guides/README.md +++ /dev/null @@ -1,66 +0,0 @@ -If you are not sure what OSes and infrastructure is supported, the table below lists all the combinations which have -been tested recently. - -For the easiest "kick the tires" experience, please try the [local docker](docker.md) guide. - -If you are considering contributing a new guide, please read the -[guidelines](../../docs/devel/writing-a-getting-started-guide.md). - -IaaS Provider | Config. Mgmt | OS | Networking | Docs | Support Level | Notes --------------- | ------------ | ------ | ---------- | ---------------------------------------------------- | ---------------------------- | ----- -GKE | | | GCE | [docs](https://cloud.google.com/container-engine) | Commercial | Uses K8s version 0.15.0 -Vagrant | Saltstack | Fedora | OVS | [docs](../../docs/getting-started-guides/vagrant.md) | Project | Uses latest via https://get.k8s.io/ -GCE | Saltstack | Debian | GCE | [docs](../../docs/getting-started-guides/gce.md) | Project | Tested with 0.15.0 by @robertbailey -Azure | CoreOS | CoreOS | Weave | [docs](../../docs/getting-started-guides/coreos/azure/README.md) | Community ([@errordeveloper](https://github.com/errordeveloper), [@squillace](https://github.com/squillace), [@chanezon](https://github.com/chanezon), [@crossorigin](https://github.com/crossorigin)) | Uses K8s version 0.17.0 -Docker Single Node | custom | N/A | local | [docs](docker.md) | Project (@brendandburns) | Tested @ 0.14.1 | -Docker Multi Node | Flannel | N/A | local | [docs](docker-multinode.md) | Project (@brendandburns) | Tested @ 0.14.1 | -Bare-metal | Ansible | Fedora | flannel | [docs](../../docs/getting-started-guides/fedora/fedora_ansible_config.md) | Project | Uses K8s v0.13.2 -Bare-metal | custom | Fedora | _none_ | [docs](../../docs/getting-started-guides/fedora/fedora_manual_config.md) | Project | Uses K8s v0.13.2 -Bare-metal | custom | Fedora | flannel | [docs](../../docs/getting-started-guides/fedora/flannel_multi_node_cluster.md) | Community ([@aveshagarwal](https://github.com/aveshagarwal))| Tested with 0.15.0 -libvirt | custom | Fedora | flannel | [docs](../../docs/getting-started-guides/fedora/flannel_multi_node_cluster.md) | Community ([@aveshagarwal](https://github.com/aveshagarwal))| Tested with 0.15.0 -KVM | custom | Fedora | flannel | [docs](../../docs/getting-started-guides/fedora/flannel_multi_node_cluster.md) | Community ([@aveshagarwal](https://github.com/aveshagarwal))| Tested with 0.15.0 -Mesos/GCE | | | | [docs](../../docs/getting-started-guides/mesos.md) | [Community](https://github.com/mesosphere/kubernetes-mesos) ([@jdef](https://github.com/jdef)) | Uses K8s v0.11.2 -AWS | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/coreos.md) | Community | Uses K8s version 0.17.0 -GCE | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/coreos.md) | Community (@kelseyhightower) | Uses K8s version 0.15.0 -Vagrant | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/coreos.md) | Community ( [@pires](https://github.com/pires), [@AntonioMeireles](https://github.com/AntonioMeireles) ) | Uses K8s version 0.15.0 -Bare-metal (Offline) | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/coreos/bare_metal_offline.md) | Community([@jeffbean](https://github.com/jeffbean)) | Uses K8s version 0.15.0 -CloudStack | Ansible | CoreOS | flannel | [docs](../../docs/getting-started-guides/cloudstack.md)| Community (@runseb) | Uses K8s version 0.9.1 -Vmware | | Debian | OVS | [docs](../../docs/getting-started-guides/vsphere.md) | Community (@pietern) | Uses K8s version 0.9.1 -Bare-metal | custom | CentOS | _none_ | [docs](../../docs/getting-started-guides/centos/centos_manual_config.md) | Community(@coolsvap) | Uses K8s v0.9.1 -AWS | Juju | Ubuntu | flannel | [docs](../../docs/getting-started-guides/juju.md) | [Community](https://github.com/whitmo/bundle-kubernetes) ( [@whit](https://github.com/whitmo), [@matt](https://github.com/mbruzek), [@chuck](https://github.com/chuckbutler) ) | [Tested](http://reports.vapour.ws/charm-tests-by-charm/kubernetes) K8s v0.8.1 -OpenStack/HPCloud | Juju | Ubuntu | flannel | [docs](../../docs/getting-started-guides/juju.md) | [Community](https://github.com/whitmo/bundle-kubernetes) ( [@whit](https://github.com/whitmo), [@matt](https://github.com/mbruzek), [@chuck](https://github.com/chuckbutler) ) | [Tested](http://reports.vapour.ws/charm-tests-by-charm/kubernetes) K8s v0.8.1 -Joyent | Juju | Ubuntu | flannel | [docs](../../docs/getting-started-guides/juju.md) | [Community](https://github.com/whitmo/bundle-kubernetes) ( [@whit](https://github.com/whitmo), [@matt](https://github.com/mbruzek), [@chuck](https://github.com/chuckbutler) ) | [Tested](http://reports.vapour.ws/charm-tests-by-charm/kubernetes) K8s v0.8.1 -AWS | Saltstack | Ubuntu | OVS | [docs](../../docs/getting-started-guides/aws.md) | Community (@justinsb) | Uses K8s version 0.5.0 -Vmware | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/coreos.md) | Community (@kelseyhightower) | Uses K8s version 0.15.0 -Azure | Saltstack | Ubuntu | OpenVPN | [docs](../../docs/getting-started-guides/azure.md) | Community | -Bare-metal | custom | Ubuntu | flannel | [docs](../../docs/getting-started-guides/ubuntu.md) | Community (@resouer @WIZARD-CXY) | use k8s version 0.18.0 -Docker Single Node | custom | N/A | local | [docs](docker.md) | Project (@brendandburns) | Tested @ 0.14.1 | -Docker Multi Node | Flannel| N/A | local | [docs](docker-multinode.md) | Project (@brendandburns) | Tested @ 0.14.1 | -Local | | | _none_ | [docs](../../docs/getting-started-guides/locally.md) | Community (@preillyme) | -libvirt/KVM | CoreOS | CoreOS | libvirt/KVM | [docs](../../docs/getting-started-guides/libvirt-coreos.md) | Community (@lhuard1A) | -oVirt | | | | [docs](../../docs/getting-started-guides/ovirt.md) | Community (@simon3z) | -Rackspace | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/rackspace.md) | Community (@doublerr) | use k8s version 0.18.0 - - -*Note*: The above table is ordered by version test/used in notes followed by support level. - -Definition of columns: - - **IaaS Provider** is who/what provides the virtual or physical machines (nodes) that Kubernetes runs on. - - **OS** is the base operating system of the nodes. - - **Config. Mgmt** is the configuration management system that helps install and maintain kubernetes software on the - nodes. - - **Networking** is what implements the [networking model](../../docs/networking.md). Those with networking type - _none_ may not support more than one node, or may support multiple VM nodes only in the same physical node. - - Support Levels - - **Project**: Kubernetes Committers regularly use this configuration, so it usually works with the latest release - of Kubernetes. - - **Commercial**: A commercial offering with its own support arrangements. - - **Community**: Actively supported by community contributions. May not work with more recent releases of kubernetes. - - **Inactive**: No active maintainer. Not recommended for first-time K8s users, and may be deleted soon. - - **Notes** is relevant information such as version k8s used. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/README.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/aws-coreos.md b/release-0.19.0/docs/getting-started-guides/aws-coreos.md deleted file mode 100644 index ebd4fea8b80..00000000000 --- a/release-0.19.0/docs/getting-started-guides/aws-coreos.md +++ /dev/null @@ -1,220 +0,0 @@ -# Getting started on Amazon EC2 with CoreOS - -The example below creates an elastic Kubernetes cluster with a custom number of worker nodes and a master. - -**Warning:** contrary to the [supported procedure](aws.md), the examples below provision Kubernetes with an insecure API server (plain HTTP, -no security tokens, no basic auth). For demonstration purposes only. - -## Highlights - -* Cluster bootstrapping using [cloud-config](https://coreos.com/docs/cluster-management/setup/cloudinit-cloud-config/) -* Cross container networking with [flannel](https://github.com/coreos/flannel#flannel) -* Auto worker registration with [kube-register](https://github.com/kelseyhightower/kube-register#kube-register) -* Kubernetes v0.17.0 [official binaries](https://github.com/GoogleCloudPlatform/kubernetes/releases/tag/v0.17.0) - -## Prerequisites - -* [aws CLI](http://aws.amazon.com/cli) -* [CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/) -* [kubectl CLI](aws/kubectl.md) - -## Starting a Cluster - -### CloudFormation - -The [cloudformation-template.json](aws/cloudformation-template.json) can be used to bootstrap a Kubernetes cluster with a single command: - -```bash -aws cloudformation create-stack --stack-name kubernetes --region us-west-2 \ ---template-body file://aws/cloudformation-template.json \ ---parameters ParameterKey=KeyPair,ParameterValue= \ - ParameterKey=ClusterSize,ParameterValue= \ - ParameterKey=VpcId,ParameterValue= \ - ParameterKey=SubnetId,ParameterValue= \ - ParameterKey=SubnetAZ,ParameterValue= -``` - -It will take a few minutes for the entire stack to come up. You can monitor the stack progress with the following command: - -```bash -aws cloudformation describe-stack-events --stack-name kubernetes -``` - -Record the Kubernetes Master IP address: - -```bash -aws cloudformation describe-stacks --stack-name kubernetes -``` - -[Skip to kubectl client configuration](#configure-the-kubectl-ssh-tunnel) - -### AWS CLI - -The following commands shall use the latest CoreOS alpha AMI for the `us-west-2` region. For a list of different regions and corresponding AMI IDs see the [CoreOS EC2 cloud provider documentation](https://coreos.com/docs/running-coreos/cloud-providers/ec2/#choosing-a-channel). - -#### Create the Kubernetes Security Group - -```bash -aws ec2 create-security-group --group-name kubernetes --description "Kubernetes Security Group" -aws ec2 authorize-security-group-ingress --group-name kubernetes --protocol tcp --port 22 --cidr 0.0.0.0/0 -aws ec2 authorize-security-group-ingress --group-name kubernetes --protocol tcp --port 80 --cidr 0.0.0.0/0 -aws ec2 authorize-security-group-ingress --group-name kubernetes --source-security-group-name kubernetes -``` - -#### Save the master and node cloud-configs - -* [master.yaml](aws/cloud-configs/master.yaml) -* [node.yaml](aws/cloud-configs/node.yaml) - -#### Launch the master - -*Attention:* replace `` below for a [suitable version of CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/). - -```bash -aws ec2 run-instances --image-id --key-name \ ---region us-west-2 --security-groups kubernetes --instance-type m3.medium \ ---user-data file://master.yaml -``` - -Record the `InstanceId` for the master. - -Gather the public and private IPs for the master node: - -```bash -aws ec2 describe-instances --instance-id -``` - -``` -{ - "Reservations": [ - { - "Instances": [ - { - "PublicDnsName": "ec2-54-68-97-117.us-west-2.compute.amazonaws.com", - "RootDeviceType": "ebs", - "State": { - "Code": 16, - "Name": "running" - }, - "PublicIpAddress": "54.68.97.117", - "PrivateIpAddress": "172.31.9.9", -... -``` - -#### Update the node.yaml cloud-config - -Edit `node.yaml` and replace all instances of `` with the **private** IP address of the master node. - -### Launch 3 worker nodes - -*Attention:* Replace `` below for a [suitable version of CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/#choosing-a-channel). - -```bash -aws ec2 run-instances --count 3 --image-id --key-name \ ---region us-west-2 --security-groups kubernetes --instance-type m3.medium \ ---user-data file://node.yaml -``` - -### Add additional worker nodes - -*Attention:* replace `` below for a [suitable version of CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/#choosing-a-channel). - -```bash -aws ec2 run-instances --count 1 --image-id --key-name \ ---region us-west-2 --security-groups kubernetes --instance-type m3.medium \ ---user-data file://node.yaml -``` - -### Configure the kubectl SSH tunnel - -This command enables secure communication between the kubectl client and the Kubernetes API. - -```bash -ssh -f -nNT -L 8080:127.0.0.1:8080 core@ -``` - -### Listing worker nodes - -Once the worker instances have fully booted, they will be automatically registered with the Kubernetes API server by the kube-register service running on the master node. It may take a few mins. - -```bash -kubectl get nodes -``` - -## Starting a simple pod - -Create a pod manifest: `pod.json` - -```json -{ - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "name": "hello", - "labels": { - "name": "hello", - "environment": "testing" - } - }, - "spec": { - "containers": [{ - "name": "hello", - "image": "quay.io/kelseyhightower/hello", - "ports": [{ - "containerPort": 80, - "hostPort": 80 - }] - }] - } -} -``` - -### Create the pod using the kubectl command line tool - -```bash -kubectl create -f pod.json -``` - -### Testing - -```bash -kubectl get pods -``` - -Record the **Host** of the pod, which should be the private IP address. - -Gather the public IP address for the worker node. - -```bash -aws ec2 describe-instances --filters 'Name=private-ip-address,Values=' -``` - -``` -{ - "Reservations": [ - { - "Instances": [ - { - "PublicDnsName": "ec2-54-68-97-117.us-west-2.compute.amazonaws.com", - "RootDeviceType": "ebs", - "State": { - "Code": 16, - "Name": "running" - }, - "PublicIpAddress": "54.68.97.117", -... -``` - -Visit the public IP address in your browser to view the running pod. - -### Delete the pod - -```bash -kubectl delete pods hello -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/aws-coreos.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/aws-coreos.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/aws.md b/release-0.19.0/docs/getting-started-guides/aws.md deleted file mode 100644 index d89199fdf44..00000000000 --- a/release-0.19.0/docs/getting-started-guides/aws.md +++ /dev/null @@ -1,89 +0,0 @@ -# Getting started on AWS EC2 - -## Prerequisites - -1. You need an AWS account. Visit [http://aws.amazon.com](http://aws.amazon.com) to get started -2. Install and configure [AWS Command Line Interface](http://aws.amazon.com/cli) -3. You need an AWS [instance profile and role](http://docs.aws.amazon.com/IAM/latest/UserGuide/instance-profiles.html) with EC2 full access. - -## Cluster turnup -### Supported procedure: `get-kube` -```bash -#Using wget -export KUBERNETES_PROVIDER=aws; wget -q -O - https://get.k8s.io | bash - -#Using cURL -export KUBERNETES_PROVIDER=aws; curl -sS https://get.k8s.io | bash -``` - -NOTE: This script calls [cluster/kube-up.sh](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/kube-up.sh) -which in turn calls [cluster/aws/util.sh](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/aws/util.sh) -using [cluster/aws/config-default.sh](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/aws/config-default.sh). - -This process takes about 5 to 10 minutes. Once the cluster is up, the IP addresses of your master and node(s) will be printed, -as well as information about the default services running in the cluster (monitoring, logging, dns). User credentials and security -tokens are written in `~/.kube/kubeconfig`, they will be necessary to use the CLI or the HTTP Basic Auth. - -By default, the script will provision a new VPC and a 4 node k8s cluster in us-west-2a (Oregon) with `t2.micro` instances running on Ubuntu. -You can override the variables defined in [config-default.sh](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/aws/config-default.sh) to change this behavior as follows: - -```bash -export KUBE_AWS_ZONE=eu-west-1c -export NUM_MINIONS=2 -export MINION_SIZE=m3.medium -export AWS_S3_REGION=eu-west-1 -export AWS_S3_BUCKET=mycompany-kubernetes-artifacts -export INSTANCE_PREFIX=k8s -... -``` - -It will also try to create or reuse a keypair called "kubernetes", and IAM profiles called "kubernetes-master" and "kubernetes-minion". -If these already exist, make sure you want them to be used here. - -NOTE: If using an existing keypair named "kubernetes" then you must set the `AWS_SSH_KEY` key to point to your private key. - -### Alternatives -A contributed [example](aws-coreos.md) allows you to setup a Kubernetes cluster based on [CoreOS](http://www.coreos.com), either using -AWS CloudFormation or EC2 with user data (cloud-config). - -## Getting started with your cluster -### Command line administration tool: `kubectl` -Copy the appropriate `kubectl` binary to any location defined in your `PATH` environment variable, for example: - -```bash -# OS X -sudo cp kubernetes/platforms/darwin/amd64/kubectl /usr/local/bin/kubectl - -# Linux -sudo cp kubernetes/platforms/linux/amd64/kubectl /usr/local/bin/kubectl -``` - -An up-to-date documentation page for this tool is available here: [kubectl manual](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/kubectl.md) - -By default, `kubectl` will use the `kubeconfig` file generated during the cluster startup for authenticating against the API. -For more information, please read [kubeconfig files](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/kubeconfig-file.md) - -### Examples -See [a simple nginx example](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/simple-nginx.md) to try out your new cluster. - -The "Guestbook" application is another popular example to get started with Kubernetes: [guestbook example](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/examples/guestbook) - -For more complete applications, please look in the [examples directory](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples) - -## Tearing down the cluster -Make sure the environment variables you used to provision your cluster are still exported, then call the following script inside the -`kubernetes` directory: - -```bash -cluster/kube-down.sh -``` - -## Further reading -Please see the [Kubernetes docs](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/docs) for more details on administering -and using a Kubernetes cluster. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/aws.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/aws.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/aws/cloud-configs/master.yaml b/release-0.19.0/docs/getting-started-guides/aws/cloud-configs/master.yaml deleted file mode 100644 index af8d61078a7..00000000000 --- a/release-0.19.0/docs/getting-started-guides/aws/cloud-configs/master.yaml +++ /dev/null @@ -1,177 +0,0 @@ -#cloud-config - -write_files: - - path: /opt/bin/waiter.sh - owner: root - permissions: 0755 - content: | - #! /usr/bin/bash - until curl http://127.0.0.1:2379/v2/machines; do sleep 2; done - -coreos: - etcd2: - name: master - initial-cluster-token: k8s_etcd - initial-cluster: master=http://$private_ipv4:2380 - listen-peer-urls: http://$private_ipv4:2380,http://localhost:2380 - initial-advertise-peer-urls: http://$private_ipv4:2380 - listen-client-urls: http://$private_ipv4:2379,http://localhost:2379 - advertise-client-urls: http://$private_ipv4:2379 - fleet: - etcd_servers: http://localhost:2379 - metadata: k8srole=master - flannel: - etcd_endpoints: http://localhost:2379 - locksmithd: - endpoint: http://localhost:2379 - units: - - name: etcd2.service - command: start - - name: fleet.service - command: start - - name: etcd2-waiter.service - command: start - content: | - [Unit] - Description=etcd waiter - Wants=network-online.target - Wants=etcd2.service - After=etcd2.service - After=network-online.target - Before=flanneld.service fleet.service locksmithd.service - - [Service] - ExecStart=/usr/bin/bash /opt/bin/waiter.sh - RemainAfterExit=true - Type=oneshot - - name: flanneld.service - command: start - drop-ins: - - name: 50-network-config.conf - content: | - [Service] - ExecStartPre=-/usr/bin/etcdctl mk /coreos.com/network/config '{"Network": "10.244.0.0/16", "Backend": {"Type": "vxlan"}}' - - name: docker-cache.service - command: start - content: | - [Unit] - Description=Docker cache proxy - Requires=early-docker.service - After=early-docker.service - Before=early-docker.target - - [Service] - Restart=always - TimeoutStartSec=0 - RestartSec=5 - Environment=TMPDIR=/var/tmp/ - Environment=DOCKER_HOST=unix:///var/run/early-docker.sock - ExecStartPre=-/usr/bin/docker kill docker-registry - ExecStartPre=-/usr/bin/docker rm docker-registry - ExecStartPre=/usr/bin/docker pull quay.io/devops/docker-registry:latest - # GUNICORN_OPTS is an workaround for - # https://github.com/docker/docker-registry/issues/892 - ExecStart=/usr/bin/docker run --rm --net host --name docker-registry \ - -e STANDALONE=false \ - -e GUNICORN_OPTS=[--preload] \ - -e MIRROR_SOURCE=https://registry-1.docker.io \ - -e MIRROR_SOURCE_INDEX=https://index.docker.io \ - -e MIRROR_TAGS_CACHE_TTL=1800 \ - quay.io/devops/docker-registry:latest - - name: docker.service - drop-ins: - - name: 51-docker-mirror.conf - content: | - [Unit] - # making sure that docker-cache is up and that flanneld finished - # startup, otherwise containers won't land in flannel's network... - Requires=docker-cache.service - After=docker-cache.service - - [Service] - Environment=DOCKER_OPTS='--registry-mirror=http://$private_ipv4:5000' - - name: get-kubectl.service - command: start - content: | - [Unit] - Description=Get kubectl client tool - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=network-online.target - After=network-online.target - - [Service] - ExecStart=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kubectl - ExecStart=/usr/bin/chmod +x /opt/bin/kubectl - Type=oneshot - RemainAfterExit=true - - name: kube-apiserver.service - command: start - content: | - [Unit] - Description=Kubernetes API Server - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd2-waiter.service - After=etcd2-waiter.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-apiserver - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver - ExecStart=/opt/bin/kube-apiserver \ - --insecure-bind-address=0.0.0.0 \ - --service-cluster-ip-range=10.100.0.0/16 \ - --etcd-servers=http://localhost:2379 - Restart=always - RestartSec=10 - - name: kube-controller-manager.service - command: start - content: | - [Unit] - Description=Kubernetes Controller Manager - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-controller-manager - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager - ExecStart=/opt/bin/kube-controller-manager \ - --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - - name: kube-scheduler.service - command: start - content: | - [Unit] - Description=Kubernetes Scheduler - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-scheduler - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler - ExecStart=/opt/bin/kube-scheduler \ - --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - - name: kube-register.service - command: start - content: | - [Unit] - Description=Kubernetes Registration Service - Documentation=https://github.com/kelseyhightower/kube-register - Requires=kube-apiserver.service fleet.service - After=kube-apiserver.service fleet.service - - [Service] - ExecStartPre=-/usr/bin/wget -nc -O /opt/bin/kube-register https://github.com/kelseyhightower/kube-register/releases/download/v0.0.3/kube-register-0.0.3-linux-amd64 - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-register - ExecStart=/opt/bin/kube-register \ - --metadata=k8srole=node \ - --fleet-endpoint=unix:///var/run/fleet.sock \ - --api-endpoint=http://127.0.0.1:8080 - Restart=always - RestartSec=10 - update: - group: alpha - reboot-strategy: off diff --git a/release-0.19.0/docs/getting-started-guides/aws/cloud-configs/node.yaml b/release-0.19.0/docs/getting-started-guides/aws/cloud-configs/node.yaml deleted file mode 100644 index 9d3d61d868a..00000000000 --- a/release-0.19.0/docs/getting-started-guides/aws/cloud-configs/node.yaml +++ /dev/null @@ -1,81 +0,0 @@ -#cloud-config - -write_files: - - path: /opt/bin/wupiao - owner: root - permissions: 0755 - content: | - #!/bin/bash - # [w]ait [u]ntil [p]ort [i]s [a]ctually [o]pen - [ -n "$1" ] && [ -n "$2" ] && while ! curl --output /dev/null \ - --silent --head --fail \ - http://${1}:${2}; do sleep 1 && echo -n .; done; - exit $? - -coreos: - etcd2: - listen-client-urls: http://localhost:2379 - advertise-client-urls: http://0.0.0.0:2379 - initial-cluster: master=http://:2380 - proxy: on - fleet: - etcd_servers: http://localhost:2379 - metadata: k8srole=node - flannel: - etcd_endpoints: http://localhost:2379 - locksmithd: - endpoint: http://localhost:2379 - units: - - name: etcd2.service - command: start - - name: fleet.service - command: start - - name: flanneld.service - command: start - - name: docker.service - command: start - drop-ins: - - name: 50-docker-mirror.conf - content: | - [Service] - Environment=DOCKER_OPTS='--registry-mirror=http://:5000' - - name: kubelet.service - command: start - content: | - [Unit] - Description=Kubernetes Kubelet - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=network-online.target - After=network-online.target - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kubelet - ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet - # wait for kubernetes master to be up and ready - ExecStartPre=/opt/bin/wupiao 8080 - ExecStart=/opt/bin/kubelet \ - --api-servers=:8080 \ - --hostname-override=$private_ipv4 - Restart=always - RestartSec=10 - - name: kube-proxy.service - command: start - content: | - [Unit] - Description=Kubernetes Proxy - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=network-online.target - After=network-online.target - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-proxy - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy - # wait for kubernetes master to be up and ready - ExecStartPre=/opt/bin/wupiao 8080 - ExecStart=/opt/bin/kube-proxy \ - --master=http://:8080 - Restart=always - RestartSec=10 - update: - group: alpha - reboot-strategy: off diff --git a/release-0.19.0/docs/getting-started-guides/aws/cloudformation-template.json b/release-0.19.0/docs/getting-started-guides/aws/cloudformation-template.json deleted file mode 100644 index 7617445125c..00000000000 --- a/release-0.19.0/docs/getting-started-guides/aws/cloudformation-template.json +++ /dev/null @@ -1,421 +0,0 @@ -{ - "AWSTemplateFormatVersion": "2010-09-09", - "Description": "Kubernetes 0.17.0 on EC2 powered by CoreOS 681.0.0 (alpha)", - "Mappings": { - "RegionMap": { - "eu-central-1" : { - "AMI" : "ami-4c4f7151" - }, - "ap-northeast-1" : { - "AMI" : "ami-3a35fd3a" - }, - "us-gov-west-1" : { - "AMI" : "ami-57117174" - }, - "sa-east-1" : { - "AMI" : "ami-fbcc4ae6" - }, - "ap-southeast-2" : { - "AMI" : "ami-593c4263" - }, - "ap-southeast-1" : { - "AMI" : "ami-3a083668" - }, - "us-east-1" : { - "AMI" : "ami-40322028" - }, - "us-west-2" : { - "AMI" : "ami-23b58613" - }, - "us-west-1" : { - "AMI" : "ami-15618f51" - }, - "eu-west-1" : { - "AMI" : "ami-8d1164fa" - } - } - }, - "Parameters": { - "InstanceType": { - "Description": "EC2 HVM instance type (m3.medium, etc).", - "Type": "String", - "Default": "m3.medium", - "AllowedValues": [ - "m3.medium", - "m3.large", - "m3.xlarge", - "m3.2xlarge", - "c3.large", - "c3.xlarge", - "c3.2xlarge", - "c3.4xlarge", - "c3.8xlarge", - "cc2.8xlarge", - "cr1.8xlarge", - "hi1.4xlarge", - "hs1.8xlarge", - "i2.xlarge", - "i2.2xlarge", - "i2.4xlarge", - "i2.8xlarge", - "r3.large", - "r3.xlarge", - "r3.2xlarge", - "r3.4xlarge", - "r3.8xlarge", - "t2.micro", - "t2.small", - "t2.medium" - ], - "ConstraintDescription": "Must be a valid EC2 HVM instance type." - }, - "ClusterSize": { - "Description": "Number of nodes in cluster (2-12).", - "Default": "2", - "MinValue": "2", - "MaxValue": "12", - "Type": "Number" - }, - "AllowSSHFrom": { - "Description": "The net block (CIDR) that SSH is available to.", - "Default": "0.0.0.0/0", - "Type": "String" - }, - "KeyPair": { - "Description": "The name of an EC2 Key Pair to allow SSH access to the instance.", - "Type": "AWS::EC2::KeyPair::KeyName" - }, - "VpcId": { - "Description": "The ID of the VPC to launch into.", - "Type": "AWS::EC2::VPC::Id" - }, - "SubnetId": { - "Description": "The ID of the subnet to launch into (that must be within the supplied VPC)", - "Type": "AWS::EC2::Subnet::Id" - }, - "SubnetAZ": { - "Description": "The availability zone of the subnet supplied (for example eu-west-1a)", - "Type": "String" - } - }, - "Conditions": { - "UseEC2Classic": {"Fn::Equals": [{"Ref": "VpcId"}, ""]} - }, - "Resources": { - "KubernetesSecurityGroup": { - "Type": "AWS::EC2::SecurityGroup", - "Properties": { - "VpcId": {"Fn::If": ["UseEC2Classic", {"Ref": "AWS::NoValue"}, {"Ref": "VpcId"}]}, - "GroupDescription": "Kubernetes SecurityGroup", - "SecurityGroupIngress": [ - { - "IpProtocol": "tcp", - "FromPort": "22", - "ToPort": "22", - "CidrIp": {"Ref": "AllowSSHFrom"} - } - ] - } - }, - "KubernetesIngress": { - "Type": "AWS::EC2::SecurityGroupIngress", - "Properties": { - "GroupId": {"Fn::GetAtt": ["KubernetesSecurityGroup", "GroupId"]}, - "IpProtocol": "tcp", - "FromPort": "1", - "ToPort": "65535", - "SourceSecurityGroupId": { - "Fn::GetAtt" : [ "KubernetesSecurityGroup", "GroupId" ] - } - } - }, - "KubernetesIngressUDP": { - "Type": "AWS::EC2::SecurityGroupIngress", - "Properties": { - "GroupId": {"Fn::GetAtt": ["KubernetesSecurityGroup", "GroupId"]}, - "IpProtocol": "udp", - "FromPort": "1", - "ToPort": "65535", - "SourceSecurityGroupId": { - "Fn::GetAtt" : [ "KubernetesSecurityGroup", "GroupId" ] - } - } - }, - "KubernetesMasterInstance": { - "Type": "AWS::EC2::Instance", - "Properties": { - "NetworkInterfaces" : [{ - "GroupSet" : [{"Fn::GetAtt": ["KubernetesSecurityGroup", "GroupId"]}], - "AssociatePublicIpAddress" : "true", - "DeviceIndex" : "0", - "DeleteOnTermination" : "true", - "SubnetId" : {"Fn::If": ["UseEC2Classic", {"Ref": "AWS::NoValue"}, {"Ref": "SubnetId"}]} - }], - "ImageId": {"Fn::FindInMap" : ["RegionMap", {"Ref": "AWS::Region" }, "AMI"]}, - "InstanceType": {"Ref": "InstanceType"}, - "KeyName": {"Ref": "KeyPair"}, - "Tags" : [ - {"Key" : "Name", "Value" : {"Fn::Join" : [ "-", [ {"Ref" : "AWS::StackName"}, "k8s-master" ] ]}}, - {"Key" : "KubernetesRole", "Value" : "node"} - ], - "UserData": { "Fn::Base64": {"Fn::Join" : ["", [ - "#cloud-config\n\n", - "write_files:\n", - "- path: /opt/bin/waiter.sh\n", - " owner: root\n", - " content: |\n", - " #! /usr/bin/bash\n", - " until curl http://127.0.0.1:2379/v2/machines; do sleep 2; done\n", - "coreos:\n", - " etcd2:\n", - " name: master\n", - " initial-cluster-token: k8s_etcd\n", - " initial-cluster: master=http://$private_ipv4:2380\n", - " listen-peer-urls: http://$private_ipv4:2380,http://localhost:2380\n", - " initial-advertise-peer-urls: http://$private_ipv4:2380\n", - " listen-client-urls: http://$private_ipv4:2379,http://localhost:2379\n", - " advertise-client-urls: http://$private_ipv4:2379\n", - " fleet:\n", - " etcd_servers: http://localhost:2379\n", - " metadata: k8srole=master\n", - " flannel:\n", - " etcd_endpoints: http://localhost:2379\n", - " locksmithd:\n", - " endpoint: http://localhost:2379\n", - " units:\n", - " - name: etcd2.service\n", - " command: start\n", - " - name: fleet.service\n", - " command: start\n", - " - name: etcd2-waiter.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=etcd waiter\n", - " Wants=network-online.target\n", - " Wants=etcd2.service\n", - " After=etcd2.service\n", - " After=network-online.target\n", - " Before=flanneld.service fleet.service locksmithd.service\n\n", - " [Service]\n", - " ExecStart=/usr/bin/bash /opt/bin/waiter.sh\n", - " RemainAfterExit=true\n", - " Type=oneshot\n", - " - name: flanneld.service\n", - " command: start\n", - " drop-ins:\n", - " - name: 50-network-config.conf\n", - " content: |\n", - " [Service]\n", - " ExecStartPre=-/usr/bin/etcdctl mk /coreos.com/network/config '{\"Network\": \"10.244.0.0/16\", \"Backend\": {\"Type\": \"vxlan\"}}'\n", - " - name: docker-cache.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Docker cache proxy\n", - " Requires=early-docker.service\n", - " After=early-docker.service\n", - " Before=early-docker.target\n\n", - " [Service]\n", - " Restart=always\n", - " TimeoutStartSec=0\n", - " RestartSec=5\n", - " Environment=TMPDIR=/var/tmp/\n", - " Environment=DOCKER_HOST=unix:///var/run/early-docker.sock\n", - " ExecStartPre=-/usr/bin/docker kill docker-registry\n", - " ExecStartPre=-/usr/bin/docker rm docker-registry\n", - " ExecStartPre=/usr/bin/docker pull quay.io/devops/docker-registry:latest\n", - " # GUNICORN_OPTS is an workaround for\n", - " # https://github.com/docker/docker-registry/issues/892\n", - " ExecStart=/usr/bin/docker run --rm --net host --name docker-registry \\\n", - " -e STANDALONE=false \\\n", - " -e GUNICORN_OPTS=[--preload] \\\n", - " -e MIRROR_SOURCE=https://registry-1.docker.io \\\n", - " -e MIRROR_SOURCE_INDEX=https://index.docker.io \\\n", - " -e MIRROR_TAGS_CACHE_TTL=1800 \\\n", - " quay.io/devops/docker-registry:latest\n", - " - name: get-kubectl.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Get kubectl client tool\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=network-online.target\n", - " After=network-online.target\n\n", - " [Service]\n", - " ExecStart=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kubectl\n", - " ExecStart=/usr/bin/chmod +x /opt/bin/kubectl\n", - " Type=oneshot\n", - " RemainAfterExit=true\n", - " - name: kube-apiserver.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes API Server\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=etcd2-waiter.service\n", - " After=etcd2-waiter.service\n\n", - " [Service]\n", - " ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-apiserver\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver\n", - " ExecStart=/opt/bin/kube-apiserver \\\n", - " --insecure-bind-address=0.0.0.0 \\\n", - " --service-cluster-ip-range=10.100.0.0/16 \\\n", - " --etcd-servers=http://localhost:2379\n", - " Restart=always\n", - " RestartSec=10\n", - " - name: kube-controller-manager.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes Controller Manager\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=kube-apiserver.service\n", - " After=kube-apiserver.service\n\n", - " [Service]\n", - " ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-controller-manager\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager\n", - " ExecStart=/opt/bin/kube-controller-manager \\\n", - " --master=127.0.0.1:8080\n", - " Restart=always\n", - " RestartSec=10\n", - " - name: kube-scheduler.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes Scheduler\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=kube-apiserver.service\n", - " After=kube-apiserver.service\n\n", - " [Service]\n", - " ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-scheduler\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler\n", - " ExecStart=/opt/bin/kube-scheduler \\\n", - " --master=127.0.0.1:8080\n", - " Restart=always\n", - " RestartSec=10\n", - " - name: kube-register.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes Registration Service\n", - " Documentation=https://github.com/kelseyhightower/kube-register\n", - " Requires=kube-apiserver.service fleet.service\n", - " After=kube-apiserver.service fleet.service\n\n", - " [Service]\n", - " ExecStartPre=-/usr/bin/wget -nc -O /opt/bin/kube-register https://github.com/kelseyhightower/kube-register/releases/download/v0.0.3/kube-register-0.0.3-linux-amd64\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-register\n", - " ExecStart=/opt/bin/kube-register \\\n", - " --metadata=k8srole=node \\\n", - " --fleet-endpoint=unix:///var/run/fleet.sock \\\n", - " --api-endpoint=http://127.0.0.1:8080\n", - " Restart=always\n", - " RestartSec=10\n", - " update:\n", - " group: alpha\n", - " reboot-strategy: off\n" - ]]} - } - } - }, - "KubernetesNodeLaunchConfig": { - "Type": "AWS::AutoScaling::LaunchConfiguration", - "Properties": { - "ImageId": {"Fn::FindInMap" : ["RegionMap", {"Ref": "AWS::Region" }, "AMI" ]}, - "InstanceType": {"Ref": "InstanceType"}, - "KeyName": {"Ref": "KeyPair"}, - "AssociatePublicIpAddress" : "true", - "SecurityGroups": [{"Fn::If": [ - "UseEC2Classic", - {"Ref": "KubernetesSecurityGroup"}, - {"Fn::GetAtt": ["KubernetesSecurityGroup", "GroupId"]}] - }], - "UserData": { "Fn::Base64": {"Fn::Join" : ["", [ - "#cloud-config\n\n", - "coreos:\n", - " etcd2:\n", - " listen-client-urls: http://localhost:2379\n", - " initial-cluster: master=http://", {"Fn::GetAtt" :["KubernetesMasterInstance" , "PrivateIp"]}, ":2380\n", - " proxy: on\n", - " fleet:\n", - " etcd_servers: http://localhost:2379\n", - " metadata: k8srole=node\n", - " flannel:\n", - " etcd_endpoints: http://localhost:2379\n", - " locksmithd:\n", - " endpoint: http://localhost:2379\n", - " units:\n", - " - name: etcd2.service\n", - " command: start\n", - " - name: fleet.service\n", - " command: start\n", - " - name: flanneld.service\n", - " command: start\n", - " - name: docker.service\n", - " command: start\n", - " drop-ins:\n", - " - name: 50-docker-mirror.conf\n", - " content: |\n", - " [Service]\n", - " Environment=DOCKER_OPTS='--registry-mirror=http://", {"Fn::GetAtt" :["KubernetesMasterInstance" , "PrivateIp"]}, ":5000'\n", - " - name: kubelet.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes Kubelet\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=network-online.target\n", - " After=network-online.target\n\n", - " [Service]\n", - " ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kubelet\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet\n", - " ExecStart=/opt/bin/kubelet \\\n", - " --api-servers=", {"Fn::GetAtt" :["KubernetesMasterInstance" , "PrivateIp"]}, ":8080 \\\n", - " --hostname-override=$private_ipv4\n", - " Restart=always\n", - " RestartSec=10\n", - " - name: kube-proxy.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes Proxy\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=network-online.target\n", - " After=network-online.target\n\n", - " [Service]\n", - " ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-proxy\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy\n", - " ExecStart=/opt/bin/kube-proxy \\\n", - " --master=http://", {"Fn::GetAtt" :["KubernetesMasterInstance" , "PrivateIp"]}, ":8080\n", - " Restart=always\n", - " RestartSec=10\n", - " update:\n", - " group: alpha\n", - " reboot-strategy: off\n" - ]]} - } - } - }, - "KubernetesAutoScalingGroup": { - "Type": "AWS::AutoScaling::AutoScalingGroup", - "Properties": { - "AvailabilityZones": {"Fn::If": ["UseEC2Classic", {"Fn::GetAZs": ""}, [{"Ref": "SubnetAZ"}]]}, - "VPCZoneIdentifier": {"Fn::If": ["UseEC2Classic", {"Ref": "AWS::NoValue"}, [{"Ref": "SubnetId"}]]}, - "LaunchConfigurationName": {"Ref": "KubernetesNodeLaunchConfig"}, - "MinSize": "2", - "MaxSize": "12", - "DesiredCapacity": {"Ref": "ClusterSize"}, - "Tags" : [ - {"Key" : "Name", "Value" : {"Fn::Join" : [ "-", [ {"Ref" : "AWS::StackName"}, "k8s-node" ] ]}, "PropagateAtLaunch" : true}, - {"Key" : "KubernetesRole", "Value" : "node", "PropagateAtLaunch" : true} - ] - } - } - }, - "Outputs": { - "KubernetesMasterPublicIp": { - "Description": "Public Ip of the newly created Kubernetes Master instance", - "Value": {"Fn::GetAtt": ["KubernetesMasterInstance" , "PublicIp"]} - } - } -} diff --git a/release-0.19.0/docs/getting-started-guides/aws/kubectl.md b/release-0.19.0/docs/getting-started-guides/aws/kubectl.md deleted file mode 100644 index 473947855da..00000000000 --- a/release-0.19.0/docs/getting-started-guides/aws/kubectl.md +++ /dev/null @@ -1,27 +0,0 @@ -# Install and configure kubectl - -## Download the kubectl CLI tool -```bash -### Darwin -wget https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/darwin/amd64/kubectl - -### Linux -wget https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kubectl -``` - -### Copy kubectl to your path -```bash -chmod +x kubectl -mv kubectl /usr/local/bin/ -``` - -### Create a secure tunnel for API communication -```bash -ssh -f -nNT -L 8080:127.0.0.1:8080 core@ -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/aws/kubectl.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/aws/kubectl.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/azure.md b/release-0.19.0/docs/getting-started-guides/azure.md deleted file mode 100644 index 4fefe919bc2..00000000000 --- a/release-0.19.0/docs/getting-started-guides/azure.md +++ /dev/null @@ -1,54 +0,0 @@ -## Getting started on Microsoft Azure - -### Azure Prerequisites - -1. You need an Azure account. Visit http://azure.microsoft.com/ to get started. -2. Install and configure the Azure cross-platform command-line interface. http://azure.microsoft.com/en-us/documentation/articles/xplat-cli/ -3. Make sure you have a default account set in the Azure cli, using `azure account set` - -### Prerequisites for your workstation - -1. Be running a Linux or Mac OS X. -2. Get or build a [binary release](binary_release.md) -3. If you want to build your own release, you need to have [Docker -installed](https://docs.docker.com/installation/). On Mac OS X you can use -[boot2docker](http://boot2docker.io/). - -### Setup -The cluster setup scripts can setup Kubernetes for multiple targets. First modify `cluster/kube-env.sh` to specify azure: - - KUBERNETES_PROVIDER="azure" - -Next, specify an existing virtual network and subnet in `cluster/azure/config-default.sh`: - - AZ_VNET= - AZ_SUBNET= - -You can create a virtual network: - - azure network vnet create --subnet= --location "West US" -v - -Now you're ready. - -You can then use the `cluster/kube-*.sh` scripts to manage your azure cluster, start with: - - cluster/kube-up.sh - -The script above will start (by default) a single master VM along with 4 worker VMs. You -can tweak some of these parameters by editing `cluster/azure/config-default.sh`. - -### Getting started with your cluster -See [a simple nginx example](../../examples/simple-nginx.md) to try out your new cluster. - -For more complete applications, please look in the [examples directory](../../examples). - -### Tearing down the cluster -``` -cluster/kube-down.sh -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/azure.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/azure.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/binary_release.md b/release-0.19.0/docs/getting-started-guides/binary_release.md deleted file mode 100644 index cd9746bdd43..00000000000 --- a/release-0.19.0/docs/getting-started-guides/binary_release.md +++ /dev/null @@ -1,29 +0,0 @@ -## Getting a Binary Release - -You can either build a release from sources or download a pre-built release. If you don't plan on developing Kubernetes itself, we suggest a pre-built release. - -### Prebuilt Binary Release - -The list of binary releases is available for download from the [GitHub Kubernetes repo release page](https://github.com/GoogleCloudPlatform/kubernetes/releases). - -Download the latest release and unpack this tar file on Linux or OS X, cd to the created `kubernetes/` directory, and then follow the getting started guide for your cloud. - -### Building from source - -Get the Kubernetes source. If you are simply building a release from source there is no need to set up a full golang environment as all building happens in a Docker container. - -Building a release is simple. - -```bash -git clone https://github.com/GoogleCloudPlatform/kubernetes.git -cd kubernetes -make release -``` - -For more details on the release process see the [`build/` directory](../../build) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/binary_release.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/binary_release.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/centos/centos_manual_config.md b/release-0.19.0/docs/getting-started-guides/centos/centos_manual_config.md deleted file mode 100644 index 4853bbb33eb..00000000000 --- a/release-0.19.0/docs/getting-started-guides/centos/centos_manual_config.md +++ /dev/null @@ -1,170 +0,0 @@ - -##Getting started on [CentOS](http://centos.org) - -This is a getting started guide for CentOS. It is a manual configuration so you understand all the underlying packages / services / ports, etc... - -This guide will only get ONE minion working. Multiple minions requires a functional [networking configuration](http://docs.k8s.io/networking.md) done outside of kubernetes. Although the additional kubernetes configuration requirements should be obvious. - -The kubernetes package provides a few services: kube-apiserver, kube-scheduler, kube-controller-manager, kubelet, kube-proxy. These services are managed by systemd and the configuration resides in a central location: /etc/kubernetes. We will break the services up between the hosts. The first host, centos-master, will be the kubernetes master. This host will run the kube-apiserver, kube-controller-manager, and kube-scheduler. In addition, the master will also run _etcd_. The remaining host, centos-minion will be the minion and run kubelet, proxy, cadvisor and docker. - -**System Information:** - -Hosts: -``` -centos-master = 192.168.121.9 -centos-minion = 192.168.121.65 -``` - -**Prepare the hosts:** - -* Create virt7-testing repo on all hosts - centos-{master,minion} with following information. - -``` -[virt7-testing] -name=virt7-testing -baseurl=http://cbs.centos.org/repos/virt7-testing/x86_64/os/ -gpgcheck=0 -``` - -* Install kubernetes on all hosts - centos-{master,minion}. This will also pull in etcd, docker, and cadvisor. - -``` -yum -y install --enablerepo=virt7-testing kubernetes -``` - -* Note * Using etcd-0.4.6-7 (This is temperory update in documentation) - -If you do not get etcd-0.4.6-7 installed with virt7-testing repo, - -In the current virt7-testing repo, the etcd package is updated which causes service failure. To avoid this, - -``` -yum erase etcd -``` - -It will uninstall the current available etcd package - -``` -yum install http://cbs.centos.org/kojifiles/packages/etcd/0.4.6/7.el7.centos/x86_64/etcd-0.4.6-7.el7.centos.x86_64.rpm -yum -y install --enablerepo=virt7-testing kubernetes -``` - -* Add master and minion to /etc/hosts on all machines (not needed if hostnames already in DNS) - -``` -echo "192.168.121.9 centos-master -192.168.121.65 centos-minion" >> /etc/hosts -``` - -* Edit /etc/kubernetes/config which will be the same on all hosts to contain: - -``` -# Comma separated list of nodes in the etcd cluster -KUBE_ETCD_SERVERS="--etcd_servers=http://centos-master:4001" - -# logging to stderr means we get it in the systemd journal -KUBE_LOGTOSTDERR="--logtostderr=true" - -# journal message level, 0 is debug -KUBE_LOG_LEVEL="--v=0" - -# Should this cluster be allowed to run privileged docker containers -KUBE_ALLOW_PRIV="--allow_privileged=false" -``` - -* Disable the firewall on both the master and minon, as docker does not play well with other firewall rule managers - -``` -systemctl disable iptables-services firewalld -systemctl stop iptables-services firewalld -``` - -**Configure the kubernetes services on the master.** - -* Edit /etc/kubernetes/apiserver to appear as such: - -``` -# The address on the local server to listen to. -KUBE_API_ADDRESS="--address=0.0.0.0" - -# The port on the local server to listen on. -KUBE_API_PORT="--port=8080" - -# How the replication controller and scheduler find the kube-apiserver -KUBE_MASTER="--master=http://centos-master:8080" - -# Port minions listen on -KUBELET_PORT="--kubelet_port=10250" - -# Address range to use for services -KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16" - -# Add your own! -KUBE_API_ARGS="" -``` - -* Edit /etc/kubernetes/controller-manager to appear as such: -``` -# Comma separated list of minions -KUBELET_ADDRESSES="--machines=centos-minion" -``` - -* Start the appropriate services on master: - -``` -for SERVICES in etcd kube-apiserver kube-controller-manager kube-scheduler; do - systemctl restart $SERVICES - systemctl enable $SERVICES - systemctl status $SERVICES -done -``` - -**Configure the kubernetes services on the minion.** - -***We need to configure the kubelet and start the kubelet and proxy*** - -* Edit /etc/kubernetes/kubelet to appear as such: - -``` -# The address for the info server to serve on -KUBELET_ADDRESS="--address=0.0.0.0" - -# The port for the info server to serve on -KUBELET_PORT="--port=10250" - -# You may leave this blank to use the actual hostname -KUBELET_HOSTNAME="--hostname_override=centos-minion" - -# Add your own! -KUBELET_ARGS="" -``` - -* Start the appropriate services on minion (centos-minion). - -``` -for SERVICES in kube-proxy kubelet docker; do - systemctl restart $SERVICES - systemctl enable $SERVICES - systemctl status $SERVICES -done -``` - -*You should be finished!* - -* Check to make sure the cluster can see the minion (on centos-master) - -``` -kubectl get minions -NAME LABELS STATUS -centos-minion Ready -``` - -**The cluster should be running! Launch a test pod.** - -You should have a functional cluster, check out [101](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/walkthrough/README.md)! - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/centos/centos_manual_config.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/centos/centos_manual_config.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/cloudstack.md b/release-0.19.0/docs/getting-started-guides/cloudstack.md deleted file mode 100644 index 3c83ad7e4a0..00000000000 --- a/release-0.19.0/docs/getting-started-guides/cloudstack.md +++ /dev/null @@ -1,96 +0,0 @@ -## Deploying Kubernetes on [CloudStack](http://cloudstack.apache.org) - -CloudStack is a software to build public and private clouds based on hardware virtualization principles (traditional IaaS). To deploy Kubernetes on CloudStack there are several possibilities depending on the Cloud being used and what images are made available. [Exoscale](http://exoscale.ch) for instance makes a [CoreOS](http://coreos.com) template available, therefore instructions to deploy Kubernetes on coreOS can be used. CloudStack also has a vagrant plugin available, hence Vagrant could be used to deploy Kubernetes either using the existing shell provisioner or using new Salt based recipes. - -[CoreOS](http://coreos.com) templates for CloudStack are built [nightly](http://stable.release.core-os.net/amd64-usr/current/). CloudStack operators need to [register](http://docs.cloudstack.apache.org/projects/cloudstack-administration/en/latest/templates.html) this template in their cloud before proceeding with these Kubernetes deployment instructions. - -There are currently two deployment techniques. - -* [Kubernetes on Exoscale](https://github.com/runseb/kubernetes-exoscale). - This uses [libcloud](http://libcloud.apache.org) to launch CoreOS instances and pass the appropriate cloud-config setup using userdata. Several manual steps are required. This is obsoleted by the Ansible playbook detailed below. - -* [Ansible playbook](https://github.com/runseb/ansible-kubernetes). - This is completely automated, a single playbook deploys Kubernetes based on the coreOS [instructions](http://docs.k8s.io/getting-started-guides/coreos/coreos_multinode_cluster.md). - -#Ansible playbook - -This [Ansible](http://ansibleworks.com) playbook deploys Kubernetes on a CloudStack based Cloud using CoreOS images. The playbook, creates an ssh key pair, creates a security group and associated rules and finally starts coreOS instances configured via cloud-init. - -Prerequisites -------------- - - $ sudo apt-get install -y python-pip - $ sudo pip install ansible - $ sudo pip install cs - -[_cs_](http://github.com/exoscale/cs) is a python module for the CloudStack API. - -Set your CloudStack endpoint, API keys and HTTP method used. - -You can define them as environment variables: `CLOUDSTACK_ENDPOINT`, `CLOUDSTACK_KEY`, `CLOUDSTACK_SECRET` and `CLOUDSTACK_METHOD`. - -Or create a `~/.cloudstack.ini` file: - - [cloudstack] - endpoint = - key = - secret = - method = post - -We need to use the http POST method to pass the _large_ userdata to the coreOS instances. - -Clone the playbook ------------------- - - $ git clone --recursive https://github.com/runseb/ansible-kubernetes.git - $ cd ansible-kubernetes - -The [ansible-cloudstack](https://github.com/resmo/ansible-cloudstack) module is setup in this repository as a submodule, hence the `--recursive`. - -Create a Kubernetes cluster ---------------------------- - -You simply need to run the playbook. - - $ ansible-playbook k8s.yml - -Some variables can be edited in the `k8s.yml` file. - - vars: - ssh_key: k8s - k8s_num_nodes: 2 - k8s_security_group_name: k8s - k8s_node_prefix: k8s2 - k8s_template: Linux CoreOS alpha 435 64-bit 10GB Disk - k8s_instance_type: Tiny - -This will start a Kubernetes master node and a number of compute nodes (by default 2). -The `instance_type` and `template` by default are specific to [exoscale](http://exoscale.ch), edit them to specify your CloudStack cloud specific template and instance type (i.e service offering). - -Check the tasks and templates in `roles/k8s` if you want to modify anything. - -Once the playbook as finished, it will print out the IP of the Kubernetes master: - - TASK: [k8s | debug msg='k8s master IP is {{ k8s_master.default_ip }}'] ******** - -SSH to it using the key that was created and using the _core_ user and you can list the machines in your cluster: - - $ ssh -i ~/.ssh/id_rsa_k8s core@ - $ fleetctl list-machines - MACHINE IP METADATA - a017c422... role=node - ad13bf84... role=master - e9af8293... role=node - - - - - - - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/cloudstack.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/cloudstack.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/coreos.md b/release-0.19.0/docs/getting-started-guides/coreos.md deleted file mode 100644 index d9cef74a817..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos.md +++ /dev/null @@ -1,18 +0,0 @@ -## Getting started on [CoreOS](http://coreos.com) - -There are multiple guides on running Kubernetes with [CoreOS](http://coreos.com): - -* [Single Node Cluster](coreos/coreos_single_node_cluster.md) -* [Multi-node Cluster](coreos/coreos_multinode_cluster.md) -* [Setup Multi-node Cluster on GCE in an easy way](https://github.com/rimusz/coreos-multi-node-k8s-gce/blob/master/README.md) -* [Multi-node cluster using cloud-config and Weave on Vagrant](https://github.com/errordeveloper/weave-demos/blob/master/poseidon/README.md) -* [Multi-node cluster using cloud-config and Vagrant](https://github.com/pires/kubernetes-vagrant-coreos-cluster/blob/master/README.md) -* [Yet another multi-node cluster using cloud-config and Vagrant](https://github.com/AntonioMeireles/kubernetes-vagrant-coreos-cluster/blob/master/README.md) (similar to the one above but with an increased, more *aggressive* focus on features and flexibility) -* [Multi-node cluster with Vagrant and fleet units using a small OS X App](https://github.com/rimusz/coreos-osx-gui-kubernetes-cluster/blob/master/README.md) -* [Resizable multi-node cluster on Azure with Weave](coreos/azure/README.md) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/coreos.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/coreos.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/.gitignore b/release-0.19.0/docs/getting-started-guides/coreos/azure/.gitignore deleted file mode 100644 index c2658d7d1b3..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/.gitignore +++ /dev/null @@ -1 +0,0 @@ -node_modules/ diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/README.md b/release-0.19.0/docs/getting-started-guides/coreos/azure/README.md deleted file mode 100644 index e96524648f7..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/README.md +++ /dev/null @@ -1,195 +0,0 @@ -# Kubernetes on Azure with CoreOS and [Weave](http://weave.works) - -## Introduction - -In this guide I will demonstrate how to deploy a Kubernetes cluster to Azure cloud. You will be using CoreOS with Weave, which implements simple and secure networking, in a transparent, yet robust way. The purpose of this guide is to provide an out-of-the-box implementation that can ultimately be taken into production with little change. It will demonstrate how to provision a dedicated Kubernetes master and etcd nodes, and show how to scale the cluster with ease. - -## Let's go! - -To get started, you need to checkout the code: -``` -git clone https://github.com/GoogleCloudPlatform/kubernetes -cd kubernetes/docs/getting-started-guides/coreos/azure/ -``` - -You will need to have [Node.js installed](http://nodejs.org/download/) on you machine. If you have previously used Azure CLI, you should have it already. - -First, you need to install some of the dependencies with - -``` -npm install -``` - -Now, all you need to do is: - -``` -./azure-login.js -u -./create-kubernetes-cluster.js -``` - -This script will provision a cluster suitable for production use, where there is a ring of 3 dedicated etcd nodes, Kubernetes master and 2 nodes. The `kube-00` VM will be the master, your work loads are only to be deployed on the minion nodes, `kube-01` and `kube-02`. Initially, all VMs are single-core, to ensure a user of the free tier can reproduce it without paying extra. I will show how to add more bigger VMs later. - -![VMs in Azure](initial_cluster.png) - -Once the creation of Azure VMs has finished, you should see the following: - -``` -... -azure_wrapper/info: Saved SSH config, you can use it like so: `ssh -F ./output/kube_1c1496016083b4_ssh_conf ` -azure_wrapper/info: The hosts in this deployment are: - [ 'etcd-00', 'etcd-01', 'etcd-02', 'kube-00', 'kube-01', 'kube-02' ] -azure_wrapper/info: Saved state into `./output/kube_1c1496016083b4_deployment.yml` -``` - -Let's login to the master node like so: -``` -ssh -F ./output/kube_1c1496016083b4_ssh_conf kube-00 -``` -> Note: config file name will be different, make sure to use the one you see. - -Check there are 2 nodes in the cluster: -``` -core@kube-00 ~ $ kubectl get nodes -NAME LABELS STATUS -kube-01 environment=production Ready -kube-02 environment=production Ready -``` - -## Deploying the workload - -Let's follow the Guestbook example now: -``` -cd guestbook-example -kubectl create -f redis-master-controller.json -kubectl create -f redis-master-service.json -kubectl create -f redis-slave-controller.json -kubectl create -f redis-slave-service.json -kubectl create -f frontend-controller.json -kubectl create -f frontend-service.json -``` - -You need to wait for the pods to get deployed, run the following and wait for `STATUS` to change from `Unknown`, through `Pending` to `Running`. -``` -kubectl get pods --watch -``` -> Note: the most time it will spend downloading Docker container images on each of the nodes. - -Eventually you should see: -``` -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -frontend-controller-0133o 10.2.1.14 php-redis kubernetes/example-guestbook-php-redis kube-01/172.18.0.13 name=frontend,uses=redisslave,redis-master Running -frontend-controller-ls6k1 10.2.3.10 php-redis kubernetes/example-guestbook-php-redis name=frontend,uses=redisslave,redis-master Running -frontend-controller-oh43e 10.2.2.15 php-redis kubernetes/example-guestbook-php-redis kube-02/172.18.0.14 name=frontend,uses=redisslave,redis-master Running -redis-master 10.2.1.3 master redis kube-01/172.18.0.13 name=redis-master Running -redis-slave-controller-fplln 10.2.2.3 slave brendanburns/redis-slave kube-02/172.18.0.14 name=redisslave,uses=redis-master Running -redis-slave-controller-gziey 10.2.1.4 slave brendanburns/redis-slave kube-01/172.18.0.13 name=redisslave,uses=redis-master Running - -``` - -## Scaling - -Two single-core nodes are certainly not enough for a production system of today, and, as you can see, there is one _unassigned_ pod. Let's scale the cluster by adding a couple of bigger nodes. - -You will need to open another terminal window on your machine and go to the same working directory (e.g. `~/Workspace/weave-demos/coreos-azure`). - -First, lets set the size of new VMs: -``` -export AZ_VM_SIZE=Large -``` -Now, run scale script with state file of the previous deployment and number of nodes to add: -``` -./scale-kubernetes-cluster.js ./output/kube_1c1496016083b4_deployment.yml 2 -... -azure_wrapper/info: Saved SSH config, you can use it like so: `ssh -F ./output/kube_8f984af944f572_ssh_conf ` -azure_wrapper/info: The hosts in this deployment are: - [ 'etcd-00', - 'etcd-01', - 'etcd-02', - 'kube-00', - 'kube-01', - 'kube-02', - 'kube-03', - 'kube-04' ] -azure_wrapper/info: Saved state into `./output/kube_8f984af944f572_deployment.yml` -``` -> Note: this step has created new files in `./output`. - -Back on `kube-00`: -``` -core@kube-00 ~ $ kubectl get nodes -NAME LABELS STATUS -kube-01 environment=production Ready -kube-02 environment=production Ready -kube-03 environment=production Ready -kube-04 environment=production Ready -``` - -You can see that two more nodes joined happily. Let's scale the number of Guestbook instances now. - -First, double-check how many replication controllers there are: - -``` -core@kube-00 ~ $ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -frontend php-redis kubernetes/example-guestbook-php-redis:v2 name=frontend 3 -redis-master master redis name=redis-master 1 -redis-slave slave kubernetes/redis-slave:v2 name=redis-slave 2 -``` -As there are 4 nodes, let's scale proportionally: -``` -core@kube-00 ~ $ kubectl scale --replicas=4 rc redis-slave -scaled -core@kube-00 ~ $ kubectl scale --replicas=4 rc frontend -scaled -``` -Check what you have now: -``` -core@kube-00 ~ $ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -frontend php-redis kubernetes/example-guestbook-php-redis:v2 name=frontend 4 -redis-master master redis name=redis-master 1 -redis-slave slave kubernetes/redis-slave:v2 name=redis-slave 4 -``` - -You now will have more instances of front-end Guestbook apps and Redis slaves; and, if you look up all pods labeled `name=frontend`, you should see one running on each node. - -``` -core@kube-00 ~/guestbook-example $ kubectl get pods -l name=frontend -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -frontend-controller-0133o 10.2.1.19 php-redis kubernetes/example-guestbook-php-redis kube-01/172.18.0.13 name=frontend,uses=redisslave,redis-master Running -frontend-controller-i7hvs 10.2.4.5 php-redis kubernetes/example-guestbook-php-redis kube-04/172.18.0.21 name=frontend,uses=redisslave,redis-master Running -frontend-controller-ls6k1 10.2.3.18 php-redis kubernetes/example-guestbook-php-redis kube-03/172.18.0.20 name=frontend,uses=redisslave,redis-master Running -frontend-controller-oh43e 10.2.2.22 php-redis kubernetes/example-guestbook-php-redis kube-02/172.18.0.14 name=frontend,uses=redisslave,redis-master Running -``` - -## Exposing the app to the outside world - -To makes sure the app is working, you probably want to load it in the browser. For accessing the Guesbook service from the outside world, an Azure endpoint needs to be created like shown on the picture below. - -![Creating an endpoint](external_access.png) - -You then should be able to access it from anywhere via the Azure virtual IP for `kube-01`, i.e. `http://104.40.211.194:8000/` as per screenshot. - -## Next steps - -You now have a full-blow cluster running in Azure, congrats! - -You should probably try deploy other [example apps](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/examples) or write your own ;) - -## Tear down... - -If you don't wish care about the Azure bill, you can tear down the cluster. It's easy to redeploy it, as you can see. - -``` -./destroy-cluster.js ./output/kube_8f984af944f572_deployment.yml -``` - -> Note: make sure to use the _latest state file_, as after scaling there is a new one. - -By the way, with the scripts shown, you can deploy multiple clusters, if you like :) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/coreos/azure/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/coreos/azure/README.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/grafana-service.yaml b/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/grafana-service.yaml deleted file mode 100644 index 76e49087231..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/grafana-service.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - kubernetes.io/cluster-service: "true" - kubernetes.io/name: "Grafana" - name: monitoring-grafana -spec: - ports: - - port: 80 - targetPort: 8080 - selector: - name: influxGrafana - diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/heapster-controller.yaml b/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/heapster-controller.yaml deleted file mode 100644 index bac59a62c7f..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/heapster-controller.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: v1 -kind: ReplicationController -metadata: - labels: - name: heapster - kubernetes.io/cluster-service: "true" - name: monitoring-heapster-controller -spec: - replicas: 1 - selector: - name: heapster - template: - metadata: - labels: - name: heapster - kubernetes.io/cluster-service: "true" - spec: - containers: - - image: gcr.io/google_containers/heapster:v0.12.1 - name: heapster - command: - - /heapster - - --source=kubernetes:http://kubernetes?auth= - - --sink=influxdb:http://monitoring-influxdb:8086 diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml b/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml deleted file mode 100644 index 92ee15d0c23..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: v1 -kind: ReplicationController -metadata: - labels: - name: influxGrafana - kubernetes.io/cluster-service: "true" - name: monitoring-influx-grafana-controller -spec: - replicas: 1 - selector: - name: influxGrafana - template: - metadata: - labels: - name: influxGrafana - kubernetes.io/cluster-service: "true" - spec: - containers: - - image: gcr.io/google_containers/heapster_influxdb:v0.3 - name: influxdb - ports: - - containerPort: 8083 - hostPort: 8083 - - containerPort: 8086 - hostPort: 8086 - - image: gcr.io/google_containers/heapster_grafana:v0.7 - name: grafana - env: - - name: INFLUXDB_EXTERNAL_URL - value: /api/v1/proxy/namespaces/default/services/monitoring-grafana/db/ - - name: INFLUXDB_HOST - value: monitoring-influxdb - - name: INFLUXDB_PORT - value: "8086" - diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-service.yaml b/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-service.yaml deleted file mode 100644 index 8301d782597..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-service.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - name: influxGrafana - name: monitoring-influxdb -spec: - ports: - - name: http - port: 8083 - targetPort: 8083 - - name: api - port: 8086 - targetPort: 8086 - selector: - name: influxGrafana - diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-controller.yaml b/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-controller.yaml deleted file mode 100644 index f4cda7b032a..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-controller.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: v1 -kind: ReplicationController -metadata: - name: elasticsearch-logging-v1 - namespace: default - labels: - k8s-app: elasticsearch-logging - version: v1 - kubernetes.io/cluster-service: "true" -spec: - replicas: 2 - selector: - k8s-app: elasticsearch-logging - version: v1 - template: - metadata: - labels: - k8s-app: elasticsearch-logging - version: v1 - kubernetes.io/cluster-service: "true" - spec: - containers: - - image: gcr.io/google_containers/elasticsearch:1.3 - name: elasticsearch-logging - ports: - - containerPort: 9200 - name: es-port - protocol: TCP - - containerPort: 9300 - name: es-transport-port - protocol: TCP - volumeMounts: - - name: es-persistent-storage - mountPath: /data - volumes: - - name: es-persistent-storage - emptyDir: {} diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-service.yaml b/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-service.yaml deleted file mode 100644 index 3b7ae06e7aa..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-service.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: elasticsearch-logging - namespace: default - labels: - k8s-app: elasticsearch-logging - kubernetes.io/cluster-service: "true" - kubernetes.io/name: "Elasticsearch" -spec: - ports: - - port: 9200 - protocol: TCP - targetPort: es-port - selector: - k8s-app: elasticsearch-logging diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-controller.yaml b/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-controller.yaml deleted file mode 100644 index 677bc5f664a..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-controller.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: v1 -kind: ReplicationController -metadata: - name: kibana-logging-v1 - namespace: default - labels: - k8s-app: kibana-logging - version: v1 - kubernetes.io/cluster-service: "true" -spec: - replicas: 1 - selector: - k8s-app: kibana-logging - version: v1 - template: - metadata: - labels: - k8s-app: kibana-logging - version: v1 - kubernetes.io/cluster-service: "true" - spec: - containers: - - name: kibana-logging - image: gcr.io/google_containers/kibana:1.3 - env: - - name: "ELASTICSEARCH_URL" - value: "http://elasticsearch-logging:9200" - ports: - - containerPort: 5601 - name: kibana-port - protocol: TCP diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-service.yaml b/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-service.yaml deleted file mode 100644 index ac9aa5ce320..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-service.yaml +++ /dev/null @@ -1,17 +0,0 @@ - -apiVersion: v1 -kind: Service -metadata: - name: kibana-logging - namespace: default - labels: - k8s-app: kibana-logging - kubernetes.io/cluster-service: "true" - kubernetes.io/name: "Kibana" -spec: - ports: - - port: 5601 - protocol: TCP - targetPort: kibana-port - selector: - k8s-app: kibana-logging diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/azure-login.js b/release-0.19.0/docs/getting-started-guides/coreos/azure/azure-login.js deleted file mode 100755 index 624916b2b56..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/azure-login.js +++ /dev/null @@ -1,3 +0,0 @@ -#!/usr/bin/env node - -require('child_process').fork('node_modules/azure-cli/bin/azure', ['login'].concat(process.argv)); diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-etcd-node-template.yml b/release-0.19.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-etcd-node-template.yml deleted file mode 100644 index cb1c1b254dd..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-etcd-node-template.yml +++ /dev/null @@ -1,60 +0,0 @@ -## This file is used as input to deployment script, which ammends it as needed. -## More specifically, we need to add peer hosts for each but the elected peer. - -write_files: - - path: /opt/bin/curl-retry.sh - permissions: '0755' - owner: root - content: | - #!/bin/sh -x - until curl $@ - do sleep 1 - done - -coreos: - units: - - name: download-etcd2.service - enable: true - command: start - content: | - [Unit] - After=network-online.target - Before=etcd2.service - Description=Download etcd2 Binaries - Documentation=https://github.com/coreos/etcd/ - Requires=network-online.target - [Service] - Environment=ETCD2_RELEASE_TARBALL=https://github.com/coreos/etcd/releases/download/v2.0.11/etcd-v2.0.11-linux-amd64.tar.gz - ExecStartPre=/bin/mkdir -p /opt/bin - ExecStart=/opt/bin/curl-retry.sh --silent --location $ETCD2_RELEASE_TARBALL --output /tmp/etcd2.tgz - ExecStart=/bin/tar xzvf /tmp/etcd2.tgz -C /opt - ExecStartPost=/bin/ln -s /opt/etcd-v2.0.11-linux-amd64/etcd /opt/bin/etcd2 - ExecStartPost=/bin/ln -s /opt/etcd-v2.0.11-linux-amd64/etcdctl /opt/bin/etcdctl2 - RemainAfterExit=yes - Type=oneshot - [Install] - WantedBy=multi-user.target - - name: etcd2.service - enable: true - command: start - content: | - [Unit] - After=download-etcd2.service - Description=etcd 2 - Documentation=https://github.com/coreos/etcd/ - [Service] - Environment=ETCD_NAME=%H - Environment=ETCD_INITIAL_CLUSTER_TOKEN=etcd-cluster - Environment=ETCD_INITIAL_ADVERTISE_PEER_URLS=http://%H:2380 - Environment=ETCD_LISTEN_PEER_URLS=http://%H:2380 - Environment=ETCD_LISTEN_CLIENT_URLS=http://0.0.0.0:2379,http://0.0.0.0:4001 - Environment=ETCD_ADVERTISE_CLIENT_URLS=http://%H:2379,http://%H:4001 - Environment=ETCD_INITIAL_CLUSTER_STATE=new - ExecStart=/opt/bin/etcd2 - Restart=always - RestartSec=10 - [Install] - WantedBy=multi-user.target - update: - group: stable - reboot-strategy: off diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-main-nodes-template.yml b/release-0.19.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-main-nodes-template.yml deleted file mode 100644 index 16638e87199..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-main-nodes-template.yml +++ /dev/null @@ -1,388 +0,0 @@ -## This file is used as input to deployment script, which ammends it as needed. -## More specifically, we need to add environment files for as many nodes as we -## are going to deploy. - -write_files: - - path: /opt/bin/curl-retry.sh - permissions: '0755' - owner: root - content: | - #!/bin/sh -x - until curl $@ - do sleep 1 - done - - - path: /opt/bin/register_minion.sh - permissions: '0755' - owner: root - content: | - #!/bin/sh -xe - minion_id="${1}" - master_url="${2}" - env_label="${3}" - until healthcheck=$(curl --fail --silent "${master_url}/healthz") - do sleep 2 - done - test -n "${healthcheck}" - test "${healthcheck}" = "ok" - printf '{ - "id": "%s", - "kind": "Minion", - "apiVersion": "v1beta1", - "labels": { "environment": "%s" } - }' "${minion_id}" "${env_label}" \ - | /opt/bin/kubectl create -s "${master_url}" -f - - - - path: /etc/kubernetes/manifests/fluentd.manifest - permissions: '0755' - owner: root - content: | - apiVersion: v1 - kind: Pod - metadata: - name: fluentd-elasticsearch - spec: - containers: - - name: fluentd-elasticsearch - image: gcr.io/google_containers/fluentd-elasticsearch:1.5 - env: - - name: "FLUENTD_ARGS" - value: "-qq" - volumeMounts: - - name: varlog - mountPath: /varlog - - name: containers - mountPath: /var/lib/docker/containers - volumes: - - name: varlog - hostPath: - path: /var/log - - name: containers - hostPath: - path: /var/lib/docker/containers - -coreos: - update: - group: stable - reboot-strategy: off - units: - - name: systemd-networkd-wait-online.service - drop-ins: - - name: 50-check-github-is-reachable.conf - content: | - [Service] - ExecStart=/bin/sh -x -c \ - 'until curl --silent --fail https://status.github.com/api/status.json | grep -q \"good\"; do sleep 2; done' - - - name: docker.service - drop-ins: - - name: 50-weave-kubernetes.conf - content: | - [Service] - Environment=DOCKER_OPTS='--bridge="weave" -r="false"' - - - name: weave-network.target - enable: true - content: | - [Unit] - Description=Weave Network Setup Complete - Documentation=man:systemd.special(7) - RefuseManualStart=no - After=network-online.target - [Install] - WantedBy=multi-user.target - WantedBy=kubernetes-master.target - WantedBy=kubernetes-minion.target - - - name: kubernetes-master.target - enable: true - command: start - content: | - [Unit] - Description=Kubernetes Cluster Master - Documentation=http://kubernetes.io/ - RefuseManualStart=no - After=weave-network.target - Requires=weave-network.target - ConditionHost=kube-00 - Wants=apiserver.service - Wants=scheduler.service - Wants=controller-manager.service - [Install] - WantedBy=multi-user.target - - - name: kubernetes-minion.target - enable: true - command: start - content: | - [Unit] - Description=Kubernetes Cluster Minion - Documentation=http://kubernetes.io/ - RefuseManualStart=no - After=weave-network.target - Requires=weave-network.target - ConditionHost=!kube-00 - Wants=proxy.service - Wants=kubelet.service - [Install] - WantedBy=multi-user.target - - - name: 10-weave.network - runtime: false - content: | - [Match] - Type=bridge - Name=weave* - [Network] - - - name: install-weave.service - enable: true - content: | - [Unit] - After=network-online.target - Before=weave.service - Before=weave-helper.service - Before=docker.service - Description=Install Weave - Documentation=http://docs.weave.works/ - Requires=network-online.target - [Service] - Type=oneshot - RemainAfterExit=yes - ExecStartPre=/bin/mkdir -p /opt/bin/ - ExecStartPre=/opt/bin/curl-retry.sh \ - --silent \ - --location \ - https://github.com/weaveworks/weave/releases/download/latest_release/weave \ - --output /opt/bin/weave - ExecStartPre=/opt/bin/curl-retry.sh \ - --silent \ - --location \ - https://raw.github.com/errordeveloper/weave-demos/master/poseidon/weave-helper \ - --output /opt/bin/weave-helper - ExecStartPre=/usr/bin/chmod +x /opt/bin/weave - ExecStartPre=/usr/bin/chmod +x /opt/bin/weave-helper - ExecStart=/bin/echo Weave Installed - [Install] - WantedBy=weave-network.target - WantedBy=weave.service - - - name: weave-helper.service - enable: true - content: | - [Unit] - After=install-weave.service - After=docker.service - Description=Weave Network Router - Documentation=http://docs.weave.works/ - Requires=docker.service - Requires=install-weave.service - [Service] - ExecStart=/opt/bin/weave-helper - Restart=always - [Install] - WantedBy=weave-network.target - - - name: weave.service - enable: true - content: | - [Unit] - After=install-weave.service - After=docker.service - Description=Weave Network Router - Documentation=http://docs.weave.works/ - Requires=docker.service - Requires=install-weave.service - [Service] - TimeoutStartSec=0 - EnvironmentFile=/etc/weave.%H.env - ExecStartPre=/opt/bin/weave setup - ExecStartPre=/opt/bin/weave launch $WEAVE_PEERS - ExecStart=/usr/bin/docker attach weave - Restart=on-failure - Restart=always - ExecStop=/opt/bin/weave stop - [Install] - WantedBy=weave-network.target - - - name: weave-create-bridge.service - enable: true - content: | - [Unit] - After=network.target - After=install-weave.service - Before=weave.service - Before=docker.service - Requires=network.target - Requires=install-weave.service - [Service] - Type=oneshot - EnvironmentFile=/etc/weave.%H.env - ExecStart=/opt/bin/weave --local create-bridge - ExecStart=/usr/bin/ip addr add dev weave $BRIDGE_ADDRESS_CIDR - ExecStart=/usr/bin/ip route add $BREAKOUT_ROUTE dev weave scope link - ExecStart=/usr/bin/ip route add 224.0.0.0/4 dev weave - [Install] - WantedBy=multi-user.target - WantedBy=weave-network.target - - - name: download-kubernetes.service - enable: true - content: | - [Unit] - After=network-online.target - Before=apiserver.service - Before=controller-manager.service - Before=kubelet.service - Before=proxy.service - Description=Download Kubernetes Binaries - Documentation=http://kubernetes.io/ - Requires=network-online.target - [Service] - Environment=KUBE_RELEASE_TARBALL=https://github.com/GoogleCloudPlatform/kubernetes/releases/download/v0.18.0/kubernetes.tar.gz - ExecStartPre=/bin/mkdir -p /opt/ - ExecStart=/opt/bin/curl-retry.sh --silent --location $KUBE_RELEASE_TARBALL --output /tmp/kubernetes.tgz - ExecStart=/bin/tar xzvf /tmp/kubernetes.tgz -C /tmp/ - ExecStart=/bin/tar xzvf /tmp/kubernetes/server/kubernetes-server-linux-amd64.tar.gz -C /opt - ExecStartPost=/bin/chmod o+rx -R /opt/kubernetes - ExecStartPost=/bin/ln -s /opt/kubernetes/server/bin/kubectl /opt/bin/ - ExecStartPost=/bin/mv /tmp/kubernetes/examples/guestbook /home/core/guestbook-example - ExecStartPost=/bin/chown core. -R /home/core/guestbook-example - ExecStartPost=/bin/rm -rf /tmp/kubernetes - ExecStartPost=/bin/sed 's/\("createExternalLoadBalancer":\) true/\1 false/' -i /home/core/guestbook-example/frontend-service.json - RemainAfterExit=yes - Type=oneshot - [Install] - WantedBy=kubernetes-master.target - WantedBy=kubernetes-minion.target - - - name: apiserver.service - enable: true - content: | - [Unit] - After=download-kubernetes.service - Before=controller-manager.service - Before=scheduler.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kube-apiserver - Description=Kubernetes API Server - Documentation=http://kubernetes.io/ - Wants=download-kubernetes.service - ConditionHost=kube-00 - [Service] - ExecStart=/opt/kubernetes/server/bin/kube-apiserver \ - --address=0.0.0.0 \ - --port=8080 \ - $ETCD_SERVERS \ - --service-cluster-ip-range=10.1.0.0/16 \ - --cloud_provider=vagrant \ - --logtostderr=true --v=3 - Restart=always - RestartSec=10 - [Install] - WantedBy=kubernetes-master.target - - - name: scheduler.service - enable: true - content: | - [Unit] - After=apiserver.service - After=download-kubernetes.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kube-scheduler - Description=Kubernetes Scheduler - Documentation=http://kubernetes.io/ - Wants=apiserver.service - ConditionHost=kube-00 - [Service] - ExecStart=/opt/kubernetes/server/bin/kube-scheduler \ - --logtostderr=true \ - --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - [Install] - WantedBy=kubernetes-master.target - - - name: controller-manager.service - enable: true - content: | - [Unit] - After=download-kubernetes.service - After=apiserver.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kube-controller-manager - Description=Kubernetes Controller Manager - Documentation=http://kubernetes.io/ - Wants=apiserver.service - Wants=download-kubernetes.service - ConditionHost=kube-00 - [Service] - ExecStart=/opt/kubernetes/server/bin/kube-controller-manager \ - --cloud_provider=vagrant \ - --master=127.0.0.1:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - [Install] - WantedBy=kubernetes-master.target - - - name: kubelet.service - enable: true - content: | - [Unit] - After=download-kubernetes.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kubelet - Description=Kubernetes Kubelet - Documentation=http://kubernetes.io/ - Wants=download-kubernetes.service - ConditionHost=!kube-00 - [Service] - ExecStartPre=/bin/mkdir -p /etc/kubernetes/manifests/ - ExecStart=/opt/kubernetes/server/bin/kubelet \ - --address=0.0.0.0 \ - --port=10250 \ - --hostname_override=%H \ - --api_servers=http://kube-00:8080 \ - --logtostderr=true \ - --cluster_dns=10.1.0.3 \ - --cluster_domain=kube.local \ - --config=/etc/kubernetes/manifests/ - Restart=always - RestartSec=10 - [Install] - WantedBy=kubernetes-minion.target - - - name: proxy.service - enable: true - content: | - [Unit] - After=download-kubernetes.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kube-proxy - Description=Kubernetes Proxy - Documentation=http://kubernetes.io/ - Wants=download-kubernetes.service - ConditionHost=!kube-00 - [Service] - ExecStart=/opt/kubernetes/server/bin/kube-proxy \ - --master=http://kube-00:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - [Install] - WantedBy=kubernetes-minion.target - - - name: kubectl-create-minion.service - enable: true - content: | - [Unit] - After=download-kubernetes.service - Before=proxy.service - Before=kubelet.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kubectl - ConditionFileIsExecutable=/opt/bin/register_minion.sh - Description=Kubernetes Create Minion - Documentation=http://kubernetes.io/ - Wants=download-kubernetes.service - ConditionHost=!kube-00 - [Service] - ExecStart=/opt/bin/register_minion.sh %H http://kube-00:8080 production - Type=oneshot - [Install] - WantedBy=kubernetes-minion.target diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/create-kubernetes-cluster.js b/release-0.19.0/docs/getting-started-guides/coreos/azure/create-kubernetes-cluster.js deleted file mode 100755 index 70248c596c6..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/create-kubernetes-cluster.js +++ /dev/null @@ -1,15 +0,0 @@ -#!/usr/bin/env node - -var azure = require('./lib/azure_wrapper.js'); -var kube = require('./lib/deployment_logic/kubernetes.js'); - -azure.create_config('kube', { 'etcd': 3, 'kube': 3 }); - -azure.run_task_queue([ - azure.queue_default_network(), - azure.queue_storage_if_needed(), - azure.queue_machines('etcd', 'stable', - kube.create_etcd_cloud_config), - azure.queue_machines('kube', 'stable', - kube.create_node_cloud_config), -]); diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/destroy-cluster.js b/release-0.19.0/docs/getting-started-guides/coreos/azure/destroy-cluster.js deleted file mode 100755 index ce441e538a5..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/destroy-cluster.js +++ /dev/null @@ -1,7 +0,0 @@ -#!/usr/bin/env node - -var azure = require('./lib/azure_wrapper.js'); - -azure.destroy_cluster(process.argv[2]); - -console.log('The cluster had been destroyed, you can delete the state file now.'); diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/external_access.png b/release-0.19.0/docs/getting-started-guides/coreos/azure/external_access.png deleted file mode 100644 index 6541309b0ac87c4081315c071295400d52614447..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 292367 zcma&N1z42d);>%aAP5K|(g*?~-CZKx-QA6J4=AB@Hw@j~4T^MkcQXvlkOSX%&JXoH z=l!nt?{zuX!_3~#+Iu}~uXV3`t>>GZjOg=cc+cSA;GT<%eN=#hdnN@3_ec!s3G5q* zE!#pkIMi3>LPB!lLP8{R_O>SGR>p8}V&7uppDIQ7zUtnlrt*6mBk(BOZ|TvlvO7J( z*mn^z1V2n6lKh!b;m6Z-neW~=B4qApz^S8<2KfuO>)?D;Qkm-f{5+Oj9L}q?ZabBI zdmvu-V8LUXKRS_~8SdRoh5rvJr58Rlf~D`6+LN(?5j~_(cnkqV$8>a-*%X2d)sG+F zU3Q-wygCcmZ1jIS&3^-(&iuK#X$L1jN;?XD1dn%*=y zjLm5EEJjco8xQ&x3;0__-D;;z0QwVo(xL}t2u)|zvi_6IPp*jR%k;879I~Fy99H3#kNnejARxmb}zS;$SeD0Qf|&BW|NIzze{~ zgYgk?hsgV0n*MYRt$eQeHq`&l>@`38JNKAqVFyyt(=4}Ug0_4{nf1s1VOv_{J*fEW zCofw87)JGDBkNb@qo0^k%_NEV*-)7X?L}oolzQ^-vu;^{<&4CU915AUa3}LGBLUe1 zPZj(7aPe_Wdi5n)^93OT(!ppkod(CvDVHOR)>>(0KqSVZTb=Ec9R`7poJ?!SN$V(mt ziz>ej2VLM^Tr&m_yEy#x2fpEVHz+DMRHJrAYYIvIu?LUB9n7j{J!6g>Ugk$R7RxZD znXRPxWT1oiw4$(LukQMmxTQ)I`)hU^d(Y-zf2Qb2-ZXW91bLj%Rz{sqE0S9;pgGtw%oSs2P2#<0E*4hDwI?;e#0xqP(ahhR{!f z3c(Z%m!Ig!!laRp-Xe<&Kl=Jw{VR=VP-JM2vk|&N=xtES$Dudzkun=}V_(k5$|7ao z1t`d4E1|G{pv;oV$HDt7lEpl##DYI4s+w*&s!)x<`*kW~d!%Sbx*Ffh7fl~7x;r6( z&cv5fpHGb=?rV-7sTHG&U#uRs8toJk00dHFXY=v;`Hch7boG^;*ON6yj;F(2IO~>2 zU{`FNz`B*`VPGR4G3xHlv=2&x<`3Hx<{;<{Nuj$)g@< zB?O_QjC#C*V2^wScZJ#zd>g_;llRW_-8Lx>U3Y9UeVvRAP%CSJwSlieKM1okVNK*) zZnk2ayaZKE3`)$?81|Es6Zey$lkttK6Uj}<&F~)GsKdy6G3DGOd9Qrte1km=3-X$8 z?(x?FB3ZbjJm%l3wdOQ5SiwBt7huFx!Mg0HqYY=|XH4#dEx~sRf->LbzDw%IeQ5pg z?FXa3cbGk26Li^k@pU~G0X~!OR3jH7*UnMfjF4#ROE0V}OtmQ9t9P0b+J(f15J;f_&9x>(ZgM#zGt{I%Y_HwnlYd4Dd`|P~iw^OR^a5^-)20BsgJLej^K|9`+YtNwLmrF5T zitdYN3o|wz3yq8F2jT}!i%q*(X=vgPzz*K>NI)hG0tiUix>v z?iJzhv~MON@*}`+!i5Gu2xo*Ujuw1ZWS92BFnLXZRD}L?Rd6-=2eHU&Q6te?wondQ z1C810yvV6Y6f(`M*YZ_aXdhdGAz?Z=Ui@8eMF_?TiZHmzYPld@DYgq;^#_-|$H8l5 z6lQOau<$U&zg2v@!3xa1kzQtMu?>KR{J^a=0oDU}TszG7NlV~&jkSoTzmS{#4n z=BVyeH|J^Yp#%WXbw9TW*WM;s0OhHER${70Oz-+S9e!!H0?Nc zuUP0OwCk<(he^wXJzkLoN8_;5kLp$$h%b-%t~9C>gXw#SFC_f>Ni8Ft5s;U zM{g9{Wm)~tKFF_vV@s)BN`9ywtJaj&YPVRQPm|h=#u^l@MXe26a#)t$T0tFlhsi7z zr)tX_)Kpv3>UGNRrk;d9SH_QJ+p^tXWN}hlG@07U9JH+)Sh8>US!y(`(x-AfbuczE z7GV8ke#-Wynb-Pekm<0pgPX;rclxK&h%M|jFhpOn0qJ|j-~RK6Z@m=T~6 zJjWZD7#JMxL$*c+xJx<%m1MmUO%CTIEaJ6s_3TFO`j*L+ZR5SD=cVE0BJ@FMyLTme zFtjw3(!1)mxpmMx0Z#p$2Mg5b>hSl9{28I53d&7i7%V1UVAuyaDkY%hPdE*~} z5>I!n%d@;U=?;mS&ryumrUN#wIp*9Ic1$+1-PB^W&EI=xE@reGB(2v3plyeB4N;|< zHu5wMXAB&8H7O{8OI4=b?IBi2h<`-S+UDB2Zn{W1XmReSCB#AMIUh*n=s-1|P z%6Agy0tgPAclZ|9=f@!&d&f{6nZsa8PFcQ-5?2WijT5PD^>c^h?YwK~4fkEjo#`^l zYVfM>kG7b*x#O{o&Eq!SdmH=^;(ZTtch(d4LHu*}SX=NC8@ezmuY3Ht&864q({prX z;#9s`@1UDAE7t?lvF$PXTwT1j08cN5C{`v?qu`mbEVw7sNl^&xAPG1#Ap!1HC3;W`ihyG6{t_kCN7t_961t4q`Jk2V6Z(oE zOU`smojX{ffNUqG?f?h(iu~7qcyWcdM{scPKyxKEM>T0FE<;;uI(;Ks17kW@YdhFz zI5-|xF4(2Dv7AyyB!LEOOO;1YluOW_>yrgQjZC-{K8pM^9rhP5shOjr9Tz>li;D}L3p1Uqy(v8-CnqO80~0+H6D@26 zt%IA5qrNMxjRV=gZ}M=TkH!v$_U3ku=C(E@zwWDVVC&?_OG^4n(C>f$UZ=6E`5#F( z4*zTmwn6$|ztA(%G0^|MH*6};uWz~J%w3JG)IOS98{0U*WbiSuF|+afYr=p1^he}h zQ`P@WWn|#|A5;JO>7S`Q^uM<7*OvaRuYY|DQyAYf9{S(P=X>U?E2aVmCjck@QBcVh zet+?)E4K1n`!UXk9SnEr9pNC-7RkskpT`&<_bs7Haxa^T8$lY*PEMVl*Mf|(v6bWm zB9@9I=*NQ3FeUJgQeA#XZ7nS%FT7>%l|JDg);XA9HuYu)F*9$cUThR8lw1pEkodqM zApOUOQA4}`={9dzB0tT5VH)lu3;{U!Umw0HZ`z%-hb~ji$p6Qj2x5faWBxVp|NbDU zL&0E3oCoL+q5t25|1JHWaehAHcSsK_`hT2DGW|;$2w)(C@&7pEK_pVbhV8@k|Eo~@ z76D%^K)@UC&*ytnv1z=Gnk8DzMg_$hEnM@O3k`~t4b7j(8eHW!)@Au3nN5d`Jd(}+ z`yu?tGx3XSUlIJ0ZQy@`iH}cB?0G3~#u_&D*Ps<4A0Khzcj^s0rQC-R`a*#kfhotQ zQVr|$fZo228=k3gS)Mn~@!1&Qqj5^~#GfY(l;r3xw_?6{@dkMtYh$6|_0?S<@t9ZP zW?x)v9?(;vHHAYyj#fAAzGtDeWEG~kv*`pc4|_tO z7lZ)!K~#?gJOV|P#sbLo`1p7z>hhAql#82kO$*EcSoL&fBUcP7VYfYOISs3}oELe9 zL%07ag#G@ikw&-Tg9zVs{yzUvUUy@R$u;DFwyfnk=wl2GRc89XF877xLvRZ$3SCgT|_EOca=1fiIRfhMEq0BfkeYm<+xol>XT70}stH+@|9^ z;VH&iA^vUmzEW8AmEu@ems#jJav2}&S3UQk*fR;$EaruJ-#?FKczGmp8U|>& zbO_8=I$4fM@GIVXo-5<>n5AzF1DEI4*8EYtYmFEm?)I=dH$}aLn?v!#G+uJuR!=H~ z7#j5tbJaGq%0)`ZJ83+feU+{`VLb9V_Qu=!T$#c$Jm}kx68<^su*cBD;+x+iMx~h> z;+H7UBM|&V^%cF&4=Wnz`##chu33>TNc^Oq!*bu z`~oR%p~j<5Dw(h2nt;>(=kYsZE>=Fq`CO$Z=y-4YU(rUrVMlZROs+VW=JcOVXhYcd zK52l{%l-TWDUQeeEdTa;-nP>07*oAvOO?~{vYgcqc%3r*8RrGJ%iddJ0Ef&}vQ^wL z@2O)Ue}8nAX#eeOmGS7U8^ycIs9|t;f&-WPenQnj2(F3e@*Q-D2kS3^GYH#5sa2FE zwu55{5fKqNuX;*Bm)tf@(yhR=l49*DjYj9)lmkc=*>7zN%suX5 zNOWd~^kg6aLx|~(rE8zk;?V2F)Ggyumo-C@x@SF^?#OnX&nKrUE#&1-=&SA`yNOO` zwji3ev8(Lp(bwmDZZxJ(9!&rDBj9;_(6mj|&}gY@y82xxaAQ+dC$_BZs!QEOmc?qM z9d(vhp-{CfZr3+JmjBp~#cHOVtJ=g@s^APXuX@mSK?E}HO_-T^S#`bOunf&41b#aH z#AJTrg4&&mNdx-h&S-oS5?=2vHHBL(w-QELVfO5ST%}J=Hg>vm%tkX+fX3$*lU2I| zoHP$xj$nU0_L89h$2zsNQ6lIiRZ>wkUBbZQ(a}-++n=A*Til&Wx!7eWdsQ6q;&t8h%I!tHO0X?sA+bA!FJPvz{=-X)Y_4O4R z9nE(qvjRQ2-70Imjtx3fp^#+#nkBD$MBMx3`@V2~&qEqhg#R*&pYHG#7L(cgp^CY8 zJM3zh^nbk2$jf}a>!&~hs2_6NKo0av{AcX>n#sHG$FpPn3H*S&k=tW)><2Z#{6vEi z$qMyRhERZ!Te*?z=5bWpjBTO_Fd{;436FdAk>sB5d)3mn(`Vpl^X}}m{TF6a)ddbK zS134KxMZpRrO4oRPOH!FYj&h9U?(W02A|zFDm0m`mwA|%o_4;r>N9z2tkhpY>ffHp zM;3l?r2cwZ*Q>NY%zvA{g`=pO&jX?rBt6sWkXNO15zOf_mH21lJzxYO8-k?G?@_DD zd_zfhf~qFneX-Qz{0Z~-2|_!!jz-*+!7b*~$A;ZP`A#g49~9ODMSwR=C{}MViL=!D zN==W0C1Kq6iFNR5cRa6CE0m(BO%VE|H_rIt^Jq9P1s6|s?&dTJ-=M{18+}`4()sGm zp`?;h_RsF_ezGj0Xj;v>+?j=Voy($X^F<97y))vnRtksh!P6!$wL1pOMP-wGe^Jq} zi2l9l__faHN}4^nEzp#01pD%J9gSA?j4kg0_Lry6qvmaJ>CQou(LelAxQk@cxX9b? z@0xhd_Z=#|Zk$csL@1NkEh#1oh1Dl_2D@(`qbL?D*eW>h&rrp_SE;UT$~@j2f}n?c z{!BFaZ_7}4(Gx#BM*_UEnalp>2_0lF*vFXJJLA!G1;+x!#;MC<9JURz^*gdn`FY(P z^D}P6$6&g97(Cbj zyL4%s)+KEdvZJ?%pKK0O@=GV%Od6KdpM{s5w|Jb#M56Q3)L2fRxXNULM;d{y*XAzR z-g)PY>OJANW>qLbSa*5$GlP2>B7VBhNubiVik5&T<5Tq|% zn|B?G-p--B&ZoL)Oatqd-HTA$+!B<^bhMx0yf>Q6m`>v2xgIm_-++1T3%Argke09i|*?a6GmaZibfR&74dc-1(8rp`HrXJ$CAPFH{@rvvItTmCpa5dA+f zp}kI^9X@)N@#V!;7Sywj>x<-YDmUf!K!*V!M=Ua%gby%pw0ROp>?wCQto0W3xbl_P zNQ=#)yQPM$3YW8)?PEp@2E7|+u)^~MtHsJ#mim1rkU?{9gPRzYoEmW{IRc*uErv=RRGRLG`{o@Gw*n_VM8V}Eek%^VLjwoZ`z zG#x5^zg+ zYlu>*7H9NsRhc7rOqd98BA$4=c(IhsdAcdJvRa2lDUr%mlWKf`Y@Mgm1lgMva(6s5 z(Qe{n-zqzhPBE`DG|}!Z^4AG2@^>lFDM{+i#O&m)6W?{$Et_`&NUNN7-rvRVUoT}D znEZ_aU}3GLWlEcd7XLIBqLaeB6`WwQx2<6AZV?^xExguLXisxlZEPS6g6KZDGjrbv z;-zywe@@ku(q^}mc6LLEL%dxqY3}j7oxpiqj{589((2D|Sd|XbbRc*)R)^yf!7z<8 zaNfL4L#Gj#$FNeR)x!4RnAhQ&#e9Z@>dTj<*XG)R=)^C)gerpE#L9$i_0m{pvBH2H zxG@7*)=~m_smN<98DHR?28y*B6wajC7G(qV^OcKK$YnY3 z@orU2S=+6`ljpc=R-m-YLs4Rh3!BA-;E%dKi&ZXV$nG?6Yb>U!nN;_x@V(wl(alXg zI^FNkZgc{_mklKXuT~8kq0a$Ue9kLNYo~cnzIy29{)2o-Y>|ptprq_&qF3XUP$9*%@Wj@%^x&For`o&S4D|xTt2lf zh9$ZYmOa5^D6p8+g8ox<3L=JcE6dp(jLC4;lHy>5iQ@~VSY3r-C_GlmHcAaqb$VR zD&|~HC!E)PB1;fC!I3!IXSYYpauf~Y*|TUaQl-pU)kREL338`D(Y<13u|DvFy#RQAJW zXx#ZeS(l?7c-)Vg$ymH`fET_vx8Nw zqC962qUG6TjgB34OP)fdZ4ixc8FgL4x$uN|XRw}v7g~VsEtoR3e(Z zfry}&f1qFpikX1^0Ovi~`eS!LJuO`ehK==Hz>v4O*q75Tud~SJvx|7%qzu8>EF!O; zy#fXEmKb^x!ibMqPaEP0xt)8m!o%Z?`{O2F0ngZ(X){C?d?>(yR=lK$`?|UQgpK{+APy3aj`R!Yv zbPN9`EB>8%kWeC<<>|G-BW{eWcF0sY_0<2$*p^kxqMjZ!4XdY(eJlsk{-k_s>@H;| zePi*(B)_8n@pvLQHFi`dKF!ukum*@L{D?PUM-P2%9v}pmcJnqoT)&&TCM{B_d1Y>TF>|pb`wF)7Wd`4rlKHxL zTj^T4KPD^C_1JOdbX)o}CZRKDPIy>AoJMcYdCnBHuOHx2$z$;$QdERDjz&$P&f@}l zVO%bLl1cwEr)Eb|fRM{Y9CqJxROYPN!4%g1g33nRYmbq3-=St1p5x1PiXwwGr=lUi zDY%Zwb!WurdsO3ru5ByTbTVAWc%Ce%IM)0mt!=?r+H?aL!Ubej2ZINa=gno zW4%YE>I{di7p=eMwdowX>`csVb7{*8{#NnPOQc<&Ued=WlHqtc!fmGtqbw)uQb*~j z&N{Yi2aLA-B{0&gANLIYin^>Nj>a&%>5Xmcd7RZu`KbCtjU>)!;J&llk?&2((;Kcb zp$}Jmb9%Nno2ppGr(3jB#U{ng-yQLcs?G8~YfstE=*gb^@ih+|i8@L8tZY)P8CAb( z@exN7TKL5TR+jPc=PQa}DavrCCFWVE)pr}&a@|5tz(Sxmu%TG3Va!b=vzy-0-1S2f zEuw9`&U=-7y}`ZHWE|-!;zKEBNbNN=Tvhkn)q7pXR5lP>3@>D>9r$#=)06DC)b|n7 z*H6#!PVu5AJz=QJn;&|kO_s{#EOqYE({pYd+ZUT{9Q+gYt9yFyG61+H$uwts1P zsO@d>HDPSK{~ovy93>sjlt{Shkwb`-u#D)rF)-Y$5ZuBT=RFALKL3Y>V<*V zkfvUlxX)js$a5@W-%s(mua8w4OPb#IF5j<6-6X5kl2Spvjn^YbD*^ZL;-K<5%E5Al zg6D)0qs|rl|LKC=#8(=9zid!Nb8a84k`d*VbliDCdI82TPRos^&h*3T?B~TeJ#S(T zyY{}R1cg*;l@do4c8dfKzxo!v^4{t!`ecjQ2Fv*2fhb5VEO(ojz>?}pmn~_rf|3#<~CHco=T>;sV7`W*y}R+GV8E)>80PZ zbpN$CrPZ|;(?g{%p8im(&U#Vfy-Km!pe6s3->|}A$3!UWe4~lcbS8Wuv~<@}I&T|x zHu5$ToIn#V1_cU*4}+UUuOub4t%CnVzPEBD=1eTPd-1gIr>AM@pZ8Jd+?p2!`ESRA zK(Wzb@-I%Vu7xVE^&HJu*m_F7%8Er$ZCRHnym+B9h(~j^V;Js{orZq$MzO@^bZfA{ zCJSE*$R|WZ%qjuPV6tT=b0WNxVTsqrH74c~cDn9x;<|uYw0>ffl8d|TYTQE5{;b1P z?X?}>_k{ZX6m{m3)eKC`p(Y#;DIA*DbkVIhGDP@LznW%=*uJU3@Sz!YY$EQu|15rb&E~ojNGsCZV z-Vb--aw|%?C(AK3r&ocBbxpX(siX-QzZc%=U`(!#tCp#g@iw~D71lR@GE`?Ut!+L# z;Wz3U=Fd~2{Y_x`qM~f<-U*HqU#?yrQ$ZwmCF!x+t|)}JLv(asQ75suFU-|g8uw3? zP!Y+hrtx5>7Sj(e%eWJAnJ)1Fig@G7)EfHw5DG4k_4UQQf|SXMxMc9)V5hB@=;kVU z)N+y6<08nUVR|jKWpUZNHO_QmRyFl5ZZL^g6D=VG3c=VAvTc?x6c+CNDoP~I*woy1 zt@fKPB8hm1!2};|9Q-l@v=;aj$oa|TLC2_D$qq}1Lv z!Xu_oSe9?V_!FQ(p@-?ZR0@atnVLWiXkLeLdr19zqLDh6UuapZDakQ=YD4FfO3b5H=yk>#w7nCpBXN{~Q-rcmCwQ7l@ ztZJ2?dl}TrY_zF;6st-t1H@>%Wm7Po`=M4_EjCJ*T8;gjYtF`{rEek68ZzfS;9vGs z)B$V~%dD8eQeLBm-u41|?w0%S99N&_s;gCcArBr;APuJn@}?p9We+{q0z{I~GUqkT z?p+Sc%?9kcNBTMS*8?Da|7ZW;jVk)qo+-s~{P^YRl0iBAW<>OH4fRM;|4uZOiSz;1 zwmS-siv!8ytb!w#{e{&Vxvi8jjWg+r@w}|@M*R8Tp8vPt_Xu?h-hsb}St7#J=X6a{ zzhJWIupXbL-TUXh-~9Ztad^fj38tCDK5uPK>b>-WjMaFc&(?y`!}nP1PIf7Q5f325 zknj&ya(}c#ETvF|2p1ifZTlYP(2h$%mHPvgDc%HYLk{`% z9xLoMF9OWUB*8ZWv)LlBEMrfk^qS&vlLsA+J^wvLXsp-Cf*#?L8dXr${497do}MRHy&PP zzkNP!E|)0AVLoa@9ZyE1`5hazNLW0{sCP<4%YrtEPabNsz&Xr?;9?TvxCXW#V|DW? z+@TY3O*GB133$4v!CDd2mqzgu;mbPlZIC7l^aNMfGWC%nbhw#Ty0i}p!Q?0e} z3~k*^@YV0VjlC7P*GsBD+2|71${PHY96`X#wwy8axsW`ZVf z9p*%eo3jJj9MUKet77e@IM1uA?Gp&M;b!c#PQQ4bu;#-V@U_B1qH(9`8624|#i*o zbHh@xgj+{-$z)wLo>p9pH-AnGtH0N`wayZ0M2@cn#&l#Y&$5Ieg$7_F@Y*qSQ@@x3{Wrcl*d-5+TfS3Yq$jXG4^ zGS>YKSuyfqr{7n?c-VRMaTMml&&1YNz4#v#R}x^!>C1x2#at(9Q>48e#Ze;MUB&t7 zW%rASbirAdVtj#Rwl7m!|v2-2RRed@g@a${FdKgu(ZQ*IE9rud)T+@cYQB| zB!YHb9Vl5(k{p&AS+&KjW;{MxWq)aPM2z;d$jf)iLHhpA+|>*;bBn;Giuu$ zi%mIqo}IG^$PaG39chIB^&H?y6J*~RPpuBt5zUqJ4F<+OBECVSawpWNwMrCVi>1cX zJ+N|-k75#{({7X+0`l9I1c!uFM`d&1=Q7EcT5*~NAHj)cJ2)d%AbV95INd-_mXWbi zJl+v<9>yixqE*C=5j;pFVR>9huBSjnVarKM2AHKlftb*2Uga8YZ`ew@^w%$=sj+Kh z^b)uhL5MFEZJNy!e*XNa#=Se(@dceH!eGQm%hMn|-)6p4I{78~RIQUGm3E_J(0sir zo8{aDFUX})b2>Y41E$YvCV`!{^Fd=UI@0UrNGH_7-^K7LYrSi98;G9K*Upu~El{m1wM3!#eS{|-!~E^y zyQW$W$DIg=onPetulRR*M1-Q`Coax4|? z=;+uyXj|BX(PkfR?kpzqZLBk=s~ol|ClklKGg=RJO@YzsZMSPIRVIUYLo9z)Ebksy z^5|76Dp4`NbYUzKzNScg!o^pmm)FbTHUyydD(1AO6XavKx%29!o3*Nxw4fr0lf{db zES~SC<1`s9YlBh%7z-xA#b2FAHegiH&M5(1ifrG+Y@sqWaDE1*25oQ*!>m9dCy4c@ zg2X&OEEAOJb7|>KI9qfX+Dbas+bYgRacXJUBhrf#C;WA)APWsL%3OX*hdR8eZinBx zMMLdFoDb&6i&V-WOMY$-=JHpt&^t;Ogtv;V7w?7;rdWp)aql&UB;pRg8e>{W_YgZm z!HG)y&JjA8`|S$l6_;qKTE^#{)5MrQShg;?E+S4iOl1wSUEG_rOhIM4tJUXxNFG)s zeeMKx-;4J@%g#8YGcQ|_kxsfz9cM52{xypTH*pQVP^t7S;`O=YC;Y=$7{e`713aox zy?gT*eh2!@4KFP zPQZyh_me7-T5|uGme!{IN~cf8eC=(HOabXwu7#f&v>{`FtwVsH#UT6b+qdp!BO8X{ ze5B~mWyD??S;Uv%x|?(OtH8rHpcTIM(IEh;n8b?mD>MGA8L&(f9_~KT(vt|wkyq{S zTP`?G@$@)W$A?qgQeDr_r&B@_lhC~P=WWHO=~8)XKMgN>kM3{{tXQ!Y~NZE*NTe{FGO zR1`<+X&txOzr;2y9Y(;pMsVSKa}e8f*f^f(B5Ss?w+w>{o%>O+qaB?%p4VG+?>gI3 z)Ll)~;r-$QM#@wggH*!L2Y%NU?qCq;jFM~$1IAELLiDee-=9vKAwhdkS&6oTR?dzG0fLv)rCww!QmoG@W9&>@|!V z*JPLR;pECs_I4@{TN+jfaVX310sy@s4T=C~=^aV^r_!}jv~y1vt_q7h*@Ur1X|(I* z4(h>dK#-IEa2jul)4a>RU2fu^diD{$T>E|DfVSe`BS{rz!Dvu;N~D{IjM)BFunOEp zA%9kmY6;U=l?g7DMmuww!{m3fD=VlV=ialzVl^7Ay%@Upt5?xWKYAD9Otry^-na67 zF|=g#VYr68Au^~*o=OJmYa3AXF3#tPW&t0s+nyf8OT-66PVIk#wX(#7-`{*QgENHn zU}WF3PK*62D0q!AWpqyt#I(3WVyF}WF|ab8M2q|RMpCQSMo>R}9ohjVMR%Q*oW%39!qZDg6+00fBj)OI>a2IIQ6xJ+OWQn#E zNnG5%P@MMYl3ETJKc&*FEgk?ei+U$8DSIceNf#!b-Eq;x!uYwTu#lP<=+KBh6!xE% zwjmD>j+lt&26~?$gUIE;?emS+$@}wl!+m(;XMNPdq6zP`>dVO-M^GPM_86wkVt#>I z>EHVz4ju1J6&N~YdK>7#wG;|HH6Pn}*3juFw#QhL!h=nlCmopU`~<}855uLFIzNg@ zVF_}42K&;xe$~ge-zSqhF}uIke(xA9tUud+xge(1aT5C>TKY49C> z3s2f|_CzbJW5#?Y-S><&(LIh%ldeCGKH3^^`{p^FCCRj|OUceii1Tdu8>*cNoi6qV zcM*{ULqom(XPvQB%YehTqT;Q>Yf%XLkEH1q|Zu;=I4T>{<1fmidExMrMI#)Fu=F=z_D#hX4bBP=@o}#H& z8WmtqG~Ty+Hx#ZbkF_ncPC?_QGA?w2L#Te2<^@Qce63Its*`ht%%D9$nKkFU<@ zdnhH-ki$bBetUGN+RsNNb8Yc_9lOR%lRMq2quUfNOI~$l$~3>*@(?h4K+rF9qMLNi z3NJ61bjKs(qrxsVa6*iKA^%ZXUhwF)T9t{k+sIp+W93)LaD37;3K^bmmQE7TFiM%U z>d&~WU$S*v_UgEkvzxqI=wG|8V{DUCTyUj&yKazS>X2wXIg=&8)B>Hl5Lz8J!J4>m zJ*gUkTWGl3SjUZ%r%F<@Ibp34FQI0$6%Kjl*6Ashj?XD3hhf2waZCn*17Id>ThPmgPcxwI57> zYi&T=cC&OdfT3}J_L{D58tvxdFrNJmYP;(Ku4z>Sl(_yQaxA(VWcmS_%DgsqaW_p>IAHk1K5K}{c}#B zTWgB%?zQP;@;sME9V&5RhhI|Jho4{$dGOJX>J27VnOqHAuY0FO&pD(`OnKCib6r8Ikey&6ZoxL8PN>oWxcRvqiRIy-|sc0^g#%k3h6CPqr%#;TnX zSQg^GATJq~zMbs0{|C?Y%pW;2fiSnF$^<*}WTDFvFu~n-#i>!tfd+V$g_sZT|UO`P9 zn{=(ts|_R1hVXG^uH@ZBc_OXd)7Q zOcR zk9T=-nzpz$Es@F$JX&jmp`CA-V@ za&hCVD)Dq&zk@q5nUK(4Yx%kobYnhuhFZs*v)(wpdsS_=wD9OlTEtk6MDP>uyBl!b zVlu;jRxSi`pJ^RE8|WwA0=)eyWi9qfsWef}v3}d$xL@2=@O0qEqkY25Qy3f+vCH0r#Hn}LO0I#(3TP6~a@w*)wB`PI}jB)2<<+~f@A zO4PG@s3xpvlGN!;w_FTy6Hzu#ouS+G0bNU0D@bD#Bld}T8sz)lra;WxWDbbWI3h^~ zVO_i`?vR}~vDB)S*QY~CK0V4s(~ms0^E*Q6b(?$e{OKqtMBH`9hmrj}jea5(Xcxu3 zq){4aWFPTvM3-*MDziE*NDW&u)#BFkF?%w!P8p^N^?oXyzVTTY1sWC>uaT-=qZ0~a z#QRh zj;I> z$l>tsWAm9NLbD813A^i^cx5pl!bd!rXS}rqk)kR21*q0`InBH~%iyn!3E>424FY3C z5|dl9z!!4n23)1^-_ZNPL%@)dK-kOrIirN?{xn{XeevIolfDty=>P^J03KezpIHK7 z*gcH!(VQv?0sqBJ{u&iAhyd_7eq5kbkvSQJf#GJKU~Z$iGu;2#j{6(Q|Js$#i+2&K zGBKwgf9H;W5VQaZJMu({q9}~CeAgdO6A5e4>x;^fG+ytLuC#%=e+vqUDb;Qi3nyCq z1!x@RlC)29;&q+3{sQ5D-3%t+Bnl2b+HH4wOY0%Qe;~$xjk6CGX!X1*b{IW`HSDSb zV`S(k*i_PpPgN5+Vb$#93ba3iebZ5Pg1P@x%|QbY5aqC=kf|l)rl!y*{{waZH+}!IrmwI) zaBc)=H#anYFr7Q8K1cIvr=eP2s0EXmwDavKy`D4DNSAd?L2`!JnM(jUWZ!J~c&^y$q9x zh;I7%4!!;rO3!YU=|(ruJF1AwF{Ur}J?{3S#FO=KOswcje8<+p@tn=H^N+x=xKMod zzS6~})VU@X5XEL+jPz|uN=_PMyAihD{kA^X16!RiDZ&QQkJn50U-i_F+ zL$Aj&-I%|HhQ@#J|6zPQmIG@pMr&(wv04@+B_kUI?mu=&IrRnv?@bnpccXzztPKnd zplMk*02pVZ5Rc4JVETnhu?mhW!^`7==7@QQ{uR>GGZD>a-m= z#0K*<(Fa@J9CUO#KL(&%F8rSKFUTdcL04bOJk-5PGcK+GR`)_vx7S4uTB%1hEiHoX zhh82R`{b~P5aqBvBo0d)jlkFEOxD+qO&Z~cLD+r$BX5LCPQ6b{>OA?dPG)?6zxPJs z_bABxex=iah_=z}`f-Uj-Stymt=mDn)B&f;wzlVSf1;vM=&ueo%U<)*aBY@+S}raP zx@)AEs=8Hfc@n_g?O3@WBG!m%k4Cw7hx=^3xgt{czlm2=COf!kiAfSbs}dTK|`eWqRZOxSBmW`R4lb#i?e2g5eiS z#Oy< zHES>QJ6*#HPD6-pixia>%D8sY{FbLxCaJF$m$d`w#_Qm~#*i-_E{jPo##JloI1eqN zJ(>dISz)=YQ^ON#i;?^?gXtX5e(mMl&@|H_M7dOHwvS*HhNo#YxV}e0+;zLh(BkHsQQw0Icg#OxSyV%+|Djz4!Ld_HU8u50w|k*_R!ov1r^5v_e9>?!7>r zJQvVn4-c1f2;0FnI)urC+lvAdKlx=yKD`7QAJG_L|H7o#0KKvo5GH zuR*5P|8GnVE3Y98F*I0p+VAQINSx4BR8-h^J(AzdJ?UTIO!Vd|QYndw8`M-o2eGdE zphfQgf9!o{SX0~9t{|X@Ac}y1QdB@iK)Q64-j&`#>Ai!LP((pNiuB%l?=4gjkzN8s z5(pqQK#0@;q1?qjM>l65_jmXA^FGi02U%+-bImp89QA#Nk5QSw-D#aJEaM7HvqVlr zt*T6Fr51?)YKGkuG%Fd;XiYNk$l=jHsXVyG%hR{=&H*jBnGuvzO+~G9{;nbDXh)%& z_8U<0gkdN_#xm(HqOGA!x~aqXu+ z2?DY%mW3~|VYf60!njeN|0@-qO+U0>sB{X`v?gk9Jzky*7fKDvF1HpdI{wz8FS5U_ zY7Hld(`Vu%p^kps_`2InyVQotS=8rqR_cdI?8-&@u_E=V6^OIPswny^k}I!Y=31!9 zk97a>%|J7gcWJrGWVew1uYYRdc?tiVUe#r~rs(uL%&Bo@yo0Gx`$qvSVMV?5O1sP* zKcfbxru1ueQis59*(j!7z*82|Nq=J0a32s!0$=Vc6`Ex_D96+Ujx6!JY4y=HTtY&V z$cN?OIaE}x4YB8aY0GKr;j1cGHqzAV=k~IwRN%MXA*~Gst!LkEz1O}1vW@y^nwY`y zfRjT!i=--Nf}%zuAtN`0QvPP)gF8E3XzL5|uwK`To8{$?yv7g4Nr;KB)dVoAa$3Q- zIcC(jB-dcgy(<(I?fA4W zR#q14)+upED4stowQ~EWfR?OSZ00f!ARu(ZmaGelI2|J_jl zQ-LH({!U5G(zbG%$epCuW1{tUtg#oSmU>+|q224P7k(MwTnw@R>D#}!0C4asrRWuL zqF{GHy$|C3-vUtPs9qXg8O+4`WDQq7O4eO`q+%{Oh9yTIUaJwI-%rg`{P5j@(X{Z* zx&do~*VWOSro9Q%_cf{qjsf`a#Kjm)?<^ zvD7b>{IiUL6<5<8xnk3T3Kumw_&_z_{fK!Raex4$W3QQAe|N2uOuA-h>FTsX;{29~ z@EuGGA>sQwt`=?cX%}|AlBI0)ih1nu6%sSrraEbn9nBwpg@5Qr@d2PHJpl!UXmrJK zyFS=0;W&7W$mQ}ly3^Gu@-DPnmO|lIwaG=3QnAGIOaW5>c!s$ALo|@(@B6ww(O722 zAmqLG4gmGY0zh>We1OEv-|O)@3hplB?XA~_8l7oLvTNd)*!4_C=PAk73RO|ob8*uO zxO}BfUD-~6IBm|~x0bQ#N94oTrs~+26(=k!1#gNve!2`&|3Y=F8*XdfG)fXGDNi8_ z=uB@~T~-<%D~l2c!`1N;xRGnA%|xRlHJ_CYzDlhHqOV7wfM(%}e9wG>0|TlfX>}tr z^ERlKQJAPhVO)XL&=*@WX;t~k0y$Nccesm1kGoi%Sa_|Bm&{dYtEpYbiK4yzXR7sI z`Z!xs4Bgp!G8Uk=& zN(mAwAuSQ?cOodoG4oF7bFhU*ziM74O8Zw_?x)=-Q{`u-*R-%Wy9pqJ5Bm1v7cVut z4cSCucTsV#-+s#RZrB_@szwk^3mls5&qI`>h*L_ySTJS`I|E=XO{V1GLBr-3b?fY6 z*qN28DfbWAUP^hU|9RG%r23@{3vPu))bIc%YYpNi@y}ltqqirzD`{q$C0^alsr~74 ze+uPkJ|SDW&TgQ562C9N{g#|=2uV@1E1cI_V91yI>n7j>mSp7V)XDXkJZtghw=@rI zGiY+LOdrED6(o)>)+|d^)m&0akq|}X_#7P!ILsqfIXMmUpFJ7&8>JO)l&^Pe21pX- z_JaUA21|7;P@k?ny?-}tu%nv0Lld6kS+lbFX=@N(HBgtr;0z>gon{a5%{@9d$&-;{ z%-rSA1?`*UfpqJ_mnQ*DlzEoNNwQHn22-Bn&%PgEa-I|()J3XnKvSc4U;Ki4|8(^c zxSl5sCKH^N6HN^s_lNK}6PKR*4RewaVbpsH}lVwf>(L=OpfMo^sN0`}cK8 z539se#k)01C&c{Ab$JsZHgeXieSYHScq+5>6I@Sy=u=Nh1p0w`SN-ha_^Jr4xbL&pKB0sbw^gmQQmcC0{ ze`YmMgNvJj=N3^x%x%d_Nk%P=1-7xJJC2TyUmT-q>}ARBd2A_)mss{cu6QN;@>~H` zJd5^Jr^1r7n#q_+Z!_g`1Khs=cHcN|(JX)cQ?4=NjZQ-`bDfp(t)q49XNJM*egNNF zEl@C`asmF=vZ@GLoc>tnp z$f!J}?rd~R6kV>;&R$;v-(VJP^I)mjYtE@olETp??jVvQq(LY5uh@^@)qGk2$d0@c z`!Ko#dtoQs?{r=F!*PDyA+~$b#JbHSM~*xjlvGP4u*JgO`l%-|E<>);V`KGfvsh)UCtVuR){ zmenH4`9L~^D-Bp{C493_*iOioP#S@vod!R5Srh_;0jl2@3e{=p`sE4$pSMKGRiN;# zzRNxI${5-Cd&b6d^UD=;yARHsOdrH@f^&V#ZIdo*0}$EGo71BC=k%D(mk0e)&cwxK z;>2P}y7l`mgG=l~)C;v_3niuG5=M}{ua-qrOXdQt%VL0FM33DTzwK*m*h2Y*;Z;Sc zuRb8`<0nC$J_48hNw$)QHvv@3=8u3YI_X{!3QoUnlD=qxupAl~0kjwuR!p;of^MCM-Dh)~Dn4 zbgiVu4$R^=4Hx@jJ+>fe3!lKO{sX@J8`f09R?%J4iLD^(vEut6Ps}xpZX)3Z;U?q* zvRfeiaIF2TOZ0~=Gl@H`xc>yu$o=J$3nfc9rw(<~@fVu$Ex&CcUk7Lj0-T31tQFre!x8{FxbqYMWn|~%0 z?C*#Fn)VU@t06I#cS`5s-pvhk4!tAwFOGUwuv2$tRmMA5na2sc|YE|1-nVR3H3r#3b!i&B^t zHxObPq9`SEWLvZBs9R%&Y<_=J&_|DgO~;1S-P}URW%*g9k?hp+JHnTz)G!d)ktR#k zgjR=)dib1m{(6Tr3HD07i)n}hHvdT)qPe8j^4a3lR74*I<9^q?>v3>$|HO z&oV?r8!_wPh5kB3rNMyw>edCc@k(zzaJp_A*a*8P2)o-=E&#s9nAbdzz2_gK0qS-c z4k|)KeD`L%3U-UPQbs`Fs;hsx7$jsjgq~q9tZIQ|){hhVL_$4x&Lin2naElRGmf8> zMl~o6teqG?`x9U#7K|%<)&0I5#a>S&Q;`7>3oR*j!S5iFyXRdkeDMC>bIu=R-QQW` zSe1JY@~=#4mdYi%^L3`=JP(*&`)=P*dNLu@1pN@B!@c?>$PHC&iA{U+=JSi}sSZo{ z>YDwnf&GpRI^8E9cR8`TaIjUsRi3kW9JEv&V!&$cgY8e)P1V}69%)Qu%F3X?G`zAe z+j4Y#kJ_nWV_HnE(yC&BnZ{7@4L*Q|M_x^ z{=K^*FxsQ#9kYAnr!SEtr&SvEXS7Aq-&?&%F_9s;hT;MHy9o?s&4L7*g`pUa)klk`A<*RNsQJ(Dqny_D zRG#HwcKiN}X8&PC&a>j6R|_$O~4X82L%WH{yYjLXL@^;bo9NQZ55{o5Q6 zqb2*g3Uzg#as-bSYO~z+-I*L0{p#u@bDS`I@0Z!{fAcQsHbX;r0v`rQ8qh@I0daq# zZnuSMsawKslO`6AQz3~dtSDjfTdW8FO;0BV!*d$hx&V@O8bo{^zB}R;YxB#gpC|D* z&YjM;Nr+giLbk)0{{PM56PIvW1VgJJn=v|%v2EP3q_fvNM{OLdb!qfEg>z?scq4{OK{LPJj z8TTd~NK7;AWewf^?`i)$W`3JtyI2YgY~RV|{ojsz0_4)fe@JJ@{$HNxFB7FF)jLhX zt;*W|Z^ymH#Zw5J34a>(+vhk98vgzQeLXOc02&4R{pG(OhlhVL{&G9rTc*EQSATt? zpDx7D2NH8Q9azd-^S>Q;@e=7Hs@I~I6wf3(|8{z3F8I%!4%Ab&`c<*_&mPsE^g2+M zf#-WY@qa6)?Wgq|^{J!3t>^e3Bo@e*x0(DUU;cOR?aTuL@nDu`=`TAkwU>PS&1>{0 zz54jok7w_y-3hU?l^G3{)znA)u6XNC1d*!H}^k&=i7`s`A zBmXa6zCT}m#1cMRvMBmR#6RT36bqC+CivSQ`~3xgrt z;cqVVc9-O#F3#Kf$5$+YjhL-ZbVJJ1n5>9G}_k)|txzY&XnFUpLv z(R69bv4(c92V2VRD=cRM7hlJ4J#KfHl+g+c`FzgLmqD81Rs&V5q|~?oKW>Ds9W4|2 zgXk-v1jE5Dgr`+;RQxLyE~s9m-!Av>W?)h)miiU&l4sgX!l)(q0U9ZjUTt7&PuzJ{ zX(D@yzI~|Os7ArAohTeSlTSr4lrGDP?B-6G4NwJ~bdvo3Pvrt`2J5qCPoDi*Y_|x_M8oP> zB~av>wyO2+ADm)hZkOiw7#euAHdonC%t1cKNM@?}9;Sl!NaIw{cwQNSR@hCBr!F*L zfW~&@Em29Ig-+hM;*)d!#gy*=&IADo_bCC_%Hx@v9QSY&IE3ns`E*X;r`Ojghy1=) zF0dRNl0Hm0YQ4hx_r~EbRrrJTU-jRhvP(xfZspnT=lX#Ql2(t6U-NgsS>le6b+ZEU-Ujh8Ut>*a?21|V@%s?T5PhEEj3!s}P z%yV(V{4e+G*La4iDR1}t9z*axPa7S3HMJkQd%WB0AxXAkwDA+8xb!($IPR@T0ssf-19eH)K&Vb_$F!Q3|Lk9|x4X$?WjsKhT6?c9iuF$4y=L7q1X) z#h;;wr8mFmpiimO3Te?7RJD0VKbWIh>=$!ZLL-dvowg$;spppgP*v+20uj#(qPg2d zJ1Y|%OI9Ut%_9*$GX_A~g8j(*Y&eyCL`{Ql3b;I04SSN)PI-}Ai!wkz|GOVl3G=eF4V`0>tENW9cJe+AN+oR11(IdXsFCHxWufX3X0{Oho| zQ<2`Is(6o+YXBN1Tp^94!^<%&aZpj*iI4Y*R)3?mW^DVl#z&m#`gPM zO^qa|rdQo6=7vm9rRi&?2d7l}m3Tp42FLAJ3{q+GoL3?yr@eP#s%;^#Ic9!v zyJXT4ZcE$i%2e~=_4?(g^%Ow1N;VLUj14iT&I9)s4f%G{tw%{L7ZOtN_UB4V@6B!_h!$Tn@dJ)%RnvZc<3W>`+Lx z)(%cV9hylV=0{NBbwPfm$6q|~>%q>dDXMX26ChUPhhO02_&zLM(%;0T80N97jRX=N z^y=lrxEHfkXEu9jdga+$A_kg;-MtnkmP}AE*Hof}f8w>!6X82~w`J?FYBzFEM3f)` zX?Sg-JIw@HQ3^A99f8D6d>ipln>W!zrwp`~Hf^;Q*zV$G7X=k@%bzP%)S;se#v z7XSC&h zQm(UT3-xi)i9-tbN>))xB@_on50Sp(*2WJ|2cU>##fACIN%-7;N>z#)`4QX-Uc7ww zmFZfZXGziGga&7vq};*`OVhGZbMrfm8q@ZwB=K9mPL}>~;JdqizNMfrbZ)N$fj{BZ z9l?-KuS#liom4IQzLMIcjo!Up|1EM!M;wxy56Mlm#df83N%0d*(TWLZ4<#>SAUmrA z8_90%2x4-d#x`4yAdb<_p3+GuM>?E-3oZ_TQ1+Unm_6^__uev-*-S~=RfuDjboj=N zybgg>n(IPZH~zs%TmJ{f?FD4dX8oM0=07tlZ1a z8~EzGpEH#zPD2Al_8i`o4S$et$AwKD1f&Q|$W?_qcI|vK73()Y>a>nINaBKm!y!bi)`Kx<}A?yn&?$cE?g5D0T zpwS=mEFi<0!4PtGCV+$K*$_g6g=RJ(X*C-HY)AfLZq(W3^J*{1;4={q>X zo=@QzV-2;oo-JTi)b@T0CTIEl*cwQinHuHzaF+Xu&XQE#NGL_ViGLu@B;DC#?KxvJ zDV`pWY}5xYlO&0V^V&~*=Lq%BrhMj$$sMCNCMsENQp%CVEWGrxJ0Fjh)~I)0WLc@v zHx~;3CpzGdZB$Q$r}tLY_fw>&Ur6lUG!Hs3lx9lt6+obb^DyGRDpNy|y8Q5^ii6}> zZ`|V+QNw=P{Yyrk7kJ9djvoHXtNst0^wdrvZNkOTe8Krj8DBb<)Ia`#%ojCBP6oJ9 zLfdtjJC?Z4T>%zl02f2lyhZhE2OD+&D3h$>>;Ghd0bN5sga4ZMkv7;&u~k_qCz$*w zkx$6G&TxwZs9x6-^ndqmD_4FU>Cz1%R%!>JX^eO823hyYj;XuJ$h@^^!Hnh1drS9n6#xsC0Ranjz3T@ya&{61=~^xmMEcM6&ep9=Z5MxM0<_(Q==1I zSHCofm;u_(nmIiK=oWO6T0YMsfDdqKY=3i-2|M`|MN3xdM9<%N+|r|O;`o18n}5v5 z|N1>rpxYo&2-B^3M@lAYv0t(y>IKC7^Vfq}FSP7{)`O48YMioWin+}WX&=@a1(`~( zGJ{PoEv*k*95^_5rOj=Ck~i(EcXayx`Mq^3SAolwCKOM-L9tea#Mlq=H-=3nvYB=P zG5<7rfR`sG=H6X0+kG5BAZr0(5*Z8&bo~-a%X)gioR(y9gloi(mS+!;snUozW#44> zCMQ#l{BSbU!5{*~el`yGaM@XPW)hVi0J3`;#d^r4$-dYT{OU_XB-hR`gA;8fky=+)SriYoNBDcwh8H|5)Wm0ZNA-8a<7PaVC6o=ae>iQQl|l^ zW)u-|5Bumt^d=~%3+CF04X)N*{03WO)qR=NSAFiEon1bVLB?aH-(9G`kgda<6Z0dz~cB2y9+x_cuJ zryDr5zMVL}Wpr&1CV%ki;b2=0xz@5e19yg3)~pWNE`Y3&Ef(yCd-dwlLY-`sX(HkB z)z~JtrFO4gYQ53&1}_$%Z^-t_a0f{3b(*N%gZ`C+NjOmOICa6}Pwuq8Gai5H-w(Jr zbn!OO+LG(6I(NUES6Id)URZ9lye}>$9+u^^_k@I2C_4Sth+j$|V>8%Hd8kKgIq{MO z{xGl^4DzpgDk_VAph1gTJgc?@IHID=GBSq0beT(}z-lC+bBJoe-Oq&v$QFatza&Kd z_OJm&vCX}E3gEK2E6DYJBE}{XW%5901CSxxXKW%thwVY)-?;?0avgAouE&lUV2>iyhT9nyLooRYiw;i-?N9F)@p7-5`^$Fp~&_Q2GOfNqr_&A0i~d#Xg4!7h#^ zB>+O?6la1p%(DhpIGG}cGMZEB8WN=bk;#{H5zpmq_grq08L`USH}gM!jIw$0*-YNc zP)vIDA>5MQ=HM~_KzvzU+Uz>jNK1Wsp5hRH=}+X61{mQ>r`tc^S^bD1*7yedWa3oB?v zV$7~k{NrtWNGhXR|LQ%9PhVW7d4Wlz-{_@}O3y|><~1r4k#C8z)cGMER#O^- zQs9H}9@BQxuMO9Jm_v{Heh6vdSFfadL4Isimp>xYQ<@^jgJe5u680?}91G1KVRC@* zy(Z`!-b7hq1o_>pwgxWqC`W7Ax&qQI=h3{h%Q5hkaSl=Ww|8HOtL7cCfeb-vcn=dEpZAb#nu<4ZrBQ(9HJ zx#;}6=N-*h&R9lxnWwr7#lDBm)ip%70qCl^BmLxkz^I_YtM;7vw*rcKVQq7pAHVvg z{pnua`}%RD$O~hE?y5kA1j4abs3qR<^4`s5h)}@Qxy7mVK!S;kD(N4X6*4by3o<`t zC$jTQIZ?9eeD0)Eb)PJydOc4_&J-{&L9qXV`wDT4Hc%u9Xp{&#%R>@&tp^I8bTt~u zmwA?&luC3KK@IuWxlU3r<|TIvSo`p%c-E98W$lFn&r8zZU{N3l205)UlQTt$C)l2z znFZ2*auNkgdd}JZUINld+(W&%$^mwACe`tMBl|OEtc)yf0n?*|$e}1_!;1<`dA#ta z^p5zic^)Oy%M}y*N8cAS;xtW-`wU~jje5`6?fJ)0HDK+x1b)fOYjMA{)z@=EPS?*Y zIX&qiu4TXpDgT)=)H5PHh=6gZvU6c{|7i&R<-WiE>#s%+tPOdx3CUlZcKy#^<3GvotG8ia}Db-iq_NjCp#!m$;TJC#(c0e93-x+4+{IgHSnFaB` z{@};rYJkbNp$wqa4)QVP*-7c%M#L4#xQt)h6Oauthl|A}SLy{&mJ1bZ`jMuZW{PQS0HNx~3v|nOiK%&%Vr_GCL%HjlTcRI6f68gzeH#fu z_O6}+G*1nWd(MjkF?XcHbC^iNc;wQ3n&E42gVq*5y_TWgItd2w1WL8GaHcA=!S{(F zLD9DzRL2T82WIMo+?W9dJg1e>``SRuxTYjr#!1Qm@HnnAUWDsq!mee5{#o4k?Q?7iQT5 z%ICBOeZ>4L{hik1#lrEcBNNdQ~L7i`=Iz=Zs&s_ga==!7FJaja= z%1qloNxCH-UyBw76Vytu8GN{WL{5#w93%|79wjO~7{X?fHdP`8bj-+kGUo)@-PnI|euV?@|n zvI7Y1WSi3n5f$eQpPgSBE7Ihm40Dzcj07BVne$s7VX6AtI@sZ}X-fF`=z5IyN_H~C(J@{v72>lq7cr73D zX_P)>R!Y9;*Q}VTKf2Kilm~=-vwX@cHgODmJ=-S5JPvY+g z_W;o8-RJI{1<K$i#JWu9e zM*_fDa*k{S>~X_9oR&V)*xj@Dm1#J`=z;3m4g z^b|L$yJzsrnMMBha{K#{TX=W*c4}`XwDMH*jNR@ErK2nF>IggQZ-{LY-IX`01eh3i zzYfHM%h#w!J%zW2jd59t0Qisj(1aeI|{p0?^D51RF;VOH= zu9w#L5+T3w`6k*FsKGguXC$gH(6Ra!zmr7E@h(`a&Ut(Jxu8C{=H0t@#X1zLxEsmw zqpRUd>v*5n4ieYL^1_QEvo+4A@)$SHbA$t@pKPS@w?+_{*ka{YOP*4S!nW<*odYsZ zP_st7T3Vh#(tGD;=Z9belF1>?hg*CeY zl5IIsKi*DuR)l3hxZT&{M=u2cg_#rU!d{0e$A=K*Y#>0A>oxbmsq+vHILb&^a}x2o zi^a4Ot;aIMednVcH~kvx@n~5xrgz6aRa0+ldlJ{1ofrEo10gbHslxLU=Bcsg7sEHM z2yf;$?H|yC5e1OkZZEpSLAJ6vAfkImG>n#&F_@BXsvp5>3CXU3r*N5<3T+*34ex5l zSpr~BlfL-wH^d__yLRTo-6WwQq>py%ivXeN60mgw2H~M=SELKoP?d`lX-*b$RB6E; zV=boMfhjJgGXpN%b(DsFl19un-@^iZo+88c*Z7Kct;n?o2owkfteQ@2F0lFI;%_Fb zWQQ)iMy7f+5?a-?EYZT7^9jVbZwSJZ(`*-$1yKmE^;$^YVEl_ha)cSwcYl*ywPZcB zSQ|W`(d)eEO6%HkDHj%-+6%-XzY>z+B?`Kyc6quQOvMrG(8wUXJs3mx^T@fBQv`ry z4Qo`AePegaqKgR1rwMX&%l4w_(ZNoole&Yucxl&K5t4tvrg3VV;>9QXikk7Gtnpy zl8o6-^WE?Cw%2@wZgrKIz5wt-Gi!62zjr+v5Kvh$ek!6om@s3_qKa|_x;#X7G>KZm zn@mH5rkjIS50Oh&ab0wA{YiYiQG-IOj(h8ANuq~)S(mZ%WLwSZlLM;dVmJw#a0#ze zA8KJKDW9#-u1duD#!`y@B>CE6ZN*0dPXUfqQx+w!!KKSreCCJ=iEXV0lfodTX8p%# zZ)?m7(D~=1{_N~77eaeIw@`f{rQJRO+J%oCugY6}Of%^N-UcBVhiO<-dD2h-C6q#w z=t+t#-bj{Dt7n}Edy|E)8TI4z*8Mek7WSqg_?<@+E&961;Vkg=N938Vje#c8ppyW@ zDR*n~S#--jOrvrXbG7-S(fAtw=Deyhd}_#9HOq`x*Iz5Ib^9qDTzC&KN3zAcluGq) zaU9BHx1w6EEHAYjd+&@w2EWp7O^E$2ZUAg(RKKf2^B3Q>Zyee{mX+Ja0jyTyWL#}M z7WQHH(k_4tl|!oJpm?mCTONO3wVwytp$yh%;IKwK^zR1fNJ9cCs~=3vzbDIv1YBu+5bLpO8NV1_{^+#BZP#7m#r{Wg zy35>(hT?6_+mTI4ys_b|k=fO1!`eu}P9A*1gI6Rn{Y;vaJb*985z)pIf}GmLjG}d}KoqzRyFNq0hP6aIzm~h~g$5M(&S_ zb#^e_O+w%)rQ~i+8^3m&^EuZ3)Zq?)rvLG_q>V#fKL|4+ZEo=KLuMHRaovDn`4CT| zeiF8CH@G2i=RJYEPSQ|Zpp!<~`?W@Z^wUaZ@QuL^r3of?sZrwnwNhxB669!v^dm3v zOzwDFHbG1^)|Tgi$?FQMgVi_h$2*VY$BVU#GYsa3a=(NbQXCl^h_Bts#LrYnF-?Jn z478dcRRkMlW^YHrlUsF|Bv8jX!yt!&l(HSc)p-s(|3W^5h51NCmY0^(nzATtCIL&m zE$kjmsJMfID!0(=G+$>^d-f?;sb=XbNTfuziB|5GRHJ+~Kk;M6eO9g;6 z|B_fi>0n0_x|CfiCW_v{j%g!mRJJ6F5|mOObHE01Z+~0@ONHt(R(GbxUbOz_EY5`+HOov1n^(5O_Ez?DitsBz51vL+zeQbeU9NVc*AkZK_I4Z zkVP; zld$VNIEysdJ^_I$Q14WYe20Lr+LB}slqDo>3}{-y4puzpcHG2YYE+tH(X!mny0tX$ zk%AS?$ya!Y`mp#r&k^urmv=r3)L2d2(KioPw}^ONCcCl+1k<{8?ORb9L#4L59?;49 z)#JK*DRs(ascs_ZRQu|^?xR}*uZr&!HEe*bsY&2(<*d>miIy0<1k8}TG zSuO=8@p1kE-?VBy2HMpUrq~3y@mPDaX!2uL*V@*%7K@xVf}K^c&y%qS z=241%R_&kO=DwWa2V2OJi4{9qo6vV1v568twwFKc4g>G@+%(DmH6J+llzp4M&joasT(1&EavYf z&7M*#eY1!nv{ZQXBz3{}*pfwI9bPwWXAJZ?cJm>oD>110qM@kU^78GiIGxsqC(dts zTU-iMYGFkNZ4UN8_gx-!fjD@uyMV!YE*(jmjxV9Lo_S#qXhN#)5hCGbVF#N*Ac3|mhtL+oz|4LI15}$#dqo~I4juNmNZMoCnXOG zYyonPiST)f!(8w&Tm)fs^O_VBgpmawUVyQlIXqMk-!z_S!BVOey`C zGRQ8-xe_v0kd{P!_r&V643;)83X>Go{5mrtEZRB8I(hg!<4+>cxQbEk~u(&!Y zLk*5EQH`#oKB+H7P! zzRu>Lmw=8ZJzud%!}9GtThSyrHEO9*UgzV#e1lPl=C30F9kG^T||We-jDib4HD#G{!}x%=qWlL`f(5CTy4m*5W^Ju6-gXLdS`BwxrY(W+5#TmOdSPy)Y(Lf^Yh z6_-htSRlFegA5++W2Q?6^0lDo#P`g!xSlOOY1j5!7DS$iuPD{^ANZVh#F*%&R*HA!Au}6|@DNeWsk2Su<^7gRw$ogD;)hc^Qr^PeIK5v~b_L~gG?Ejt*&cMVl`mC1 zTTjJxQcn3PIn-iiH!3{v8-{o)%xg@Z*x0fT;yK%ASpjHaW=7EitjCJaufi9(0#c1)^6pzuTte2Vhr!w}& zKCCUHK_xCLlfA>(0acYz-us)dkO6%K44kYVQ(TMWGW(j=8w-<*bx#OR+p)7Z%2kZk zU`1EsdAAkxK*-b=^Uys3DZW)H(U~^CCndVD+Fns`X-R&P}qde=* z{tOnRQ`8rk%40DCM}U1VKY^>7F6ng>lG;}NqkF`(x47MTP{_7S5Lq*f5!p-g22h{3 zM6Gvk0v(Ob$x>bHJ|j!eDp%lcFy;> zQ$)a!+o9ZO_BQ-&9hVXd$qKu%rvmk|B?vRcJ2^|c?6^q$S(>;dH&nn-$-T$%RuDwL z(X%0l(UqV0t0lf{iP_SsQgf@~kKyLGXoT(gsP(zzC8Zi^^H*D~y4iXSl}?>_NN$C= z`&on&lFfG9HzwL$kVRwL)ksH6$W|pIAu1Q(kxi zy!s6F9d%V=u_a!AP3HRSS)n}BuQU7O)jceq%h;(H{k7cY(3Sb8=uGoIJ-kE`a6 zSRJP;@+)t?jiYrUm>n97}YRwC1LZIRww>}F~GKx4fQ3-zAvPv(zW71m!G zepJCrJk)=YDC(3CNgjlS0cj;rt81cL!Wsf7VX$e`DquFeaw2z${DH}Ilz89afpFe* znNsdm?6i*FC}@ z(#`f?YP~7QV%-exQ2ROCw}=P=d~l}c%MT2WcERX|LAx|-%sTaFSA?@>nSrr*B#ao` zQY(;X=e&&tK}#LF<3!Vl*H$`5XcTyKK&{Z8JXOUU9Sj9@sTJGQzN^l@Ss z;*E73)J`Wh-|`|EolWX?bvQ;mrd?wzxEewC)gE#B6-`GSY)w@ui`wR;3cHWjAQTos z?O@YjPhsR9Cp6Bn*?u{c;{_xaHcMnS9Zb$@MLE`Uj^An7tJ6TR@3%W-hGHlwd*`66 zR#db2`V!L&+V@a)ox|4)(kkfUap*-Pfsj9eKb6q_VfKN|FkOGYB*$c(kX{x0_BH6a#cuUue?>P4{fw}JE> z?m>cC`r$$0H{FDx%sPdJV7nGH!VAT24P?J%AWWgAz_uRwa>z-stjGdJvgc6Cjmf1Q zR|_>b!zZf2`i6=D!Z2XR*?oHUaciXFfLSUSmb?N~3s6f^0ScAZ^A!C-kxw(lj*;3RTs(`VM+3e}pWj=Xz zM5ju#{UvEJdHO+J{E9<^0{+ZtssyFL$2{k|uMODK3-J`rp(iULgE^8_Cl9n5nIwcA z8%^B5*iW}ic~D1(SAbG|HWoBXjYW(e+_sh(X|~+!(*)n>#TJ(BA5m$7HCUnMOR3GN z=()xwjQJ8P-?WW*`GLnwk>^IKKKOP3n(4X+m~cpmYZe~sUQ0?msKKNDVRcFax<2lr z`o8ibQZ6sM0o>%6C7A7y@yV@umPw{SU1dsFFYRP~ivaH2{H@5gwc)-|2%&^wm?!bF z`Mj;`9oFXX2|`J)@G`A}OlviTDL3;+lx4=&jmcY825&F%?In-x>+SM?{P?Gs{Q1`t z<{!lcH;~t5hFk9k+E1I=SGoqrF5_5V;r7fbJD!sB${VRYX*;%nN`&c5DxRv2roo3FvBi+`cMY1jBoKGXqM?P*Y*CKIy5l&#<3#6R9y zZB?)pvR(Sa0ZZgU{k}yRj9KHwDYJ6Z2dWz%`ob1^55M0`g6tXk)U?miuxQq1jJ?dY zGO_XRmLf(wyk)E@+9}Dkc0-M8ia#5;m4kqX43%@C3h}ugyTZJ~l{v=t7Wr7cp)i{1o}I}VnQCOmr7Xm;}?;|FJfL#7-}cz{TE z_pjrbLIcR{5rPMK@ph?1@zA0c&C&WD4VwJX9X7*_JkcU$@~!15jH#l!xor>$ZDouY zz(8sowA1XiU%3$3{$_kCNyA_~qOfc+8GIU^rIBK)|1>(#M5PcnO>=Sp^uOI-E*78G z^x+X@*|%!+K}Qso?cWGGdo=x9=16bi65F><&50#j4-I4~jkYoiAI=1D_Nhg#V56F=6mwj*8>83Y zG+|dq$)F2PCHS^`=)9 zH#Flq^z>ZTVPTfJ0K@LPz||elXxiWakb>!*OA&+@MpOHFF9{FYH2@I=V-`}Yg%`xz zE7n_Oib)El-SBLWs%KcL=0TUP7MBUmEf3uh4aPAHjV-L-{o6Lxu7}mhsn@wbbL6fc zdqi-#e7aZXiSD%fPUa@id6bSlH%Jk@V}&s(P(t;Uoz9LR68KA;u_8%|p&?g6MX!os zYppj-x31EjDWJUQjdLQmsK4NN8jI5gJH6drLrf9;ANJlmuBk3-8x{o=1uTdNNK*j? z1*A$x5s{7{oe+`Udk{iEKtZL0^xk_BNRSR9z1IMtDZPXq0)Zs&ah{pE^`3j?o%hf0 z`#t|1I48+IyR5bL+Sj@+?xa!Jej{w&|C5Sw9ejc|f`pxyIhI?+pCz(AaI3)sm;P6{64dNkF#dPSxeoMeP-rntf+_R~J` zXbownjes9x=(@EzY!_$H2*S<6Q7$-os=8Z>W0a0cAVqMR$CBG1CwLXI-&htCz=VQZ znG~|F?Za{sHS8G94|REN7XM5T-sDnVaAhlqekQBTcLy%wHiB#cwA)_tD8F!Wx_T#E zjX@stasc`GEk%=+5(@@jR2uU2-TCSz_Y}+6>!QlKdWnz;{YlcW`Qab>K3-$d`pZlJ zPVJrnvtF{=8O!MupP7bI^aRsHuk!_(H(u%PymVpS{lP-fcV>m6-@+yF3sJihoT*=O zY!vfO+|6unoX^h*!kkRF)#z4+~f#HNeGTm1JMD+NMDLLlKe#QQ@*t9PgU+df#DZ7 zC5^|j>69=;k_r|9^FG&NUbsYOvUnBR$bcIpJ&+%zoGhX6lz8aBZc+BYq`fQEr=;wL zj{^=RW#r%uIob()&isUh>L^t?X*;O>A=X!GY55`Es4wPzVK8pfz(uyzXKPU{&ZXLs zV0hOBw$T5iCMkv6Zm}!6DhwwF4(jXoD{a^4_gl*I?GEp`VT*k}7H;E(-{wr(7Bsv~DP zfHXmq5%M4gg)pgQ(wZW@*NFS!f;7b&nEB%{pqAg@SBJ8rXLuWK&$oqDfj%$sFJfgAg+CAXrAXc?)}LL!w?;G> zVc8qbR3lI0Uls>si{3+_&u zM;iT~$^GlVE&83dffTPdr)!bgDkDv)%di%Qss_ct9Ggx zzpqu0Ro_wtY$s@>q%FVdi-MM&{f~?W5s+!IV_4q0=juBtVTsb_FAjhxw-~~~q0qov z@`QWB?r{P`o3k{w@3<25oD%#>zfrrJ^6k>rvXxhu+0eq>-AV4!@l(kusX{rZwSA7P zqSVZWgn-GUy`AGvcM%1fmNYd%`39InFUVRi894qzYCZIzj81UYXPIfQE>{wH)C=_$ zE*8W&&+33`g{_8euTB&v!X&L|I{}I!loi9+R0DttK(4(Pvbo8dRC6sD{Q354t|sKcWLG5=qX0hL11axShTvlqSOWR@jb9yvl*5n7MFk5l7$X zvaE`%n^E(|SydKaEfG=uB%t+1CmtE$Eo>dGQ9i{WxgtzcgQS8~nlY0Hn$M z&@x;QC>u2*S`QY*+v-+K9%w8XhK+=*xwY>v)d>Bz@K1wT?VN9X1q5mAIuxq1+2Sq@ zzsuFWIGkg)ZBS*!4Lx`YAx^ZDGB@JwKT)Ap_8*g7sCgV9-ovsAN7?6MU}zzO`-*`= zj=Af7k?a-865m|O@_o-+BxuJB<$OP7rkW(KzR!#%Mtu+&~f!{+$AB$&XdTs%5IL}%LXoB zz(kpf!`hUQ>reby8NLngWv5G^5eA9Ov+kKsJB?hV;MI)*a3x(dmp-Zn!)RD4pDdra zXL(j*g3b+953Qx zm85)4U4wQdNN{=T$a`c55ic%ZZ=k%6O$qxxPPSjK?+@@LDr2Vv`nzt^#0{6>9?(F> za!8II=P2f-$Wndd1;p_}rJWb@U|YR$4>F583YRq+IhXqqIn@#{mc!ViR28jPOr^8Z zo_!UjeK#}PgK4QStDxYo!<8HbwPM+Qvn1lbSxnAP∾^*s<$@7TQ-t(eaByz zRx#{|epU2SdDOeSegl{k0O?!ARLwY}!@L8;=s4j8rYGF~V$#NSR4B(-SL{)8FLL(A?D@pywmgM9#M#ZhY zNUvhjMoBY=;NIJR+~JcbIDx^&b7|REMkT^+7rDmMkjY6lT~W&4ui+C@gqIzBJYk=^ zht*IvCSpdV7OR+Nc*gLVp3*Q+m=cls(XTiG-zK`h!P-|kGj5CVptWmzFi2Dh1DtUT z3=pESg~SQxPFLlqrS_d%xmo`5`(u<@RjCJy@U-M|M~bZAsbyyUk8aFF(m8=2Vvc9cACp(bm-!A?GA?^@cxAK~kwkr)xo9EY zz&y%Rod~SLQz3-iJYjt%)fShAgqfY(WqJQAj3NYfK-ytf$RILo7&gX}1-Fvpr-I|G zkMW@mB|GitmrZX2PW zjou7w(JjO0zgVBL0BUO~yoleL?-W2uZ^tK{ zzARCKzJ0LoV$sKOz!e39xdVXJuIT$VRfQswULtGIM(iW*HzIaJ-}*|WF9h>Wp-hQ9I0~N0*H66D# zRz4S*V;{rmUHoTyPG(%yVK47c5;vpsE> z&)xKup;RWnEFI|Aq(wn0`*OG7l%JRJ>8MBEexedU;+{30?6Ad?-@iiiA6b0X52T0H zJRe@_-T!A>f9~AFJ5ER7Uvcg#`g^zmdDv&n-rJ81^c(@A&T=23cfLVxD86*M-&(7V zw~>LlhxEq(BV!l|CjjRr$-NhH_gEXQNP9dB+X`LlctIQ9BYOz}X8Y9j{TO7~DqTS?DE&SgB+~{+4wS+i)Zf8wC)4wz`D${FXNT zBOmr}uN3Zw=Q!?M(TViDRYaVm0CeMx#Jv!~OpPUsj7;2;Tc<^gF|k726+h*Z=a$5A>$Vv@F#)^y06_CBFm^ z|L%L#UHa>b{x|RTzeDyf^X`9#?3dO1|L0XUbQXWv`OUvI?EiD)cDhV{WVYm3 z3demRB?*~7u}EmVKh;>A9Zu71|DQe3zuc7>qEI*HU$xZ}_|3Ea*`djBUAm(Vh><I8GNa{N4|L zUci8{9H%A```bL;=k=064L)KP1JBHGW3Poe`N$B;c?tOVb?3em-WngKT(x4 zER)w1c7RmptG^%Nj^}I&3!TR5yzHvv^RY0K`p1H7lAY^YO8-|=#Tp(5EI}I0D7Rm0 zQUA6x{7Ck+Wc=JK1_!HoO-$# zefY$m=uO^awf=>1`@-N`Wlp5A&>e!|w|Y>vH5*bJQXiN9lXH@Z{8{1b{7U%G{!wQ8 zyydpjVBf7BsitNZks$4ytUq_rZy)Jo2aIQR)&%vRedwb*e9oOvlI9lm{^O47eHc(QeQ5cB_xC2tG+nS%cV5XTE`Ql>JjfNOTBs=@ zVytksrN14<*?%OOyEOq!hE3>clm9RSPWj%x#L5>>n%4>M+Mb3koE+^%NJCp#8m-`t;lZpXI2mAogZ?mJ71NYLFun{e-z@M1ePL_#p&3J zH*L5_*G8h`Yb5Ri`BEL)MQdd5?r&ow!*|}R{#9(9m`PNBnW^?Lm3z?ck%`1cZ=hPY ziFD}|SQdMVjPFML6$i7TU(}iZ)danlWu2kr@JW==s*ykng^qp{w3&S3edzfmONDVu z**s~Tx{@AYKg%;4jBDOJD5dd^iiKh$0mOq5#@MtwX0#;JvDq(@LnWcmh=u!i$LOc^ za&7kPLSnSIi9{Vr@tYw?gIkF@WiM<)nwD*vqckc^f98(ao@tO1DBtRFeBDIpnqz5y z$h;OwIp2Ti(r-$vGgbg#k{<{6od*Q9fpX=O1d#!Yp@KwiozjRc@54?=1R5q$U0SQU zyZGT`-k?pH{x%5bI#Xdd$~P)e`Z4U?uM>o|gY4(T1lHw^_2-B?bS`e4=|PCDM){l2 z=L0-h$Erjn!6yndC^?VhAJsI%rCbQ*|O!BlcHZWb3h;|2v@6g;iSRg3yr%$p)n z%`SgXSlATtnEJTDeZKvH30iE^VRo|s*?RuBpu{(hG=OJ@VfePVQSG~i>as1PQ*9-v zTgHhOU*9W@=4d1U1slbhT_#@EOqT8@#(I@|&+0CMr%l$$C1x;jv{P%#ayet1r$=FaQi{KAJj zX&@)@Q8p8OyNc@tO7>D-`ck0s-sM-)4&%4%RMgAVLzSg+b8{jXgzHN+jGxo^7>ot4 zF7)Qmo+Kw9U3wOMIKz4V8rs{4Eb=)1fYtK)85Y@BumsT(QH0hNaaS|*} zkNV`3IQgtpGc*-6Yf%SP-Md#EH%ljYUI(%#&)rV%w1Fs&|2oS^cz-T+y?X3hTPfEr zw|i!L=Gf~Hm2JB|-hFF=bJm;af3+iZ7NTji*w&?y?&Se>61Qzr7KJSpE%e9gtc@1W>xb># z_QKi&LN5*XbnC|Lv4H$W#&p8$X!*M-7o9>Zn0=02ta1{ZxJ^*`BupbK%Zs}A3gzA8potvb?I28t@o;7 z@$2BFh8W`;ryEH3#k!ujpqD@8E3On;xwUn3NO*LsXu(uecjh4hfv9zbn#{$n7=@i< zsF3&<%N-5Im=U)dQqKF<+O6e(4CQZEGD)X9uf+j)e~x^pJWZ;2mU|DFkL25O%G!^F zl6f)dqhOnHd}khud^d)JR4>z02s>DAjux|m68)VAUeG!^h!K`4Xcm1#(Tn(Ihe`D; z0ocSY?XD}58M2*;osH&|5B&t7z(k|anLNbr?WrBXcN-Nj2KI>gN~J6khdOqESYSU6 z8|{4t)KZG|=_Th7`gY{pNCKIegj*{z?ak&Z<_lb;$K_Lct=l1;H`TtH6W9P=IVE$o z)Ft=W8GV)Sa9@XxT(H+_1J|)vThRpn<}%oH!mm1#Tc^)*ILi60yRP%NJkiB2bRa9p zkMq~JpUZs%slxZw^?LWAp@_HwCC`5RPKMnT#L=7fl`l28gE-M>N+7J1-)|(>gP+bF zK5yQC52LskaU-YZHkEH7t*%|k@JdL&>M-Nu(psKa)2_Hq(#_B~#i+{%ZR6`ovCifc zU)t{z?cv8oB8S&_m-JSJvzdAZP1-klyU$WHM=qtSWGOCoG1ulr-)bj{4I0v+*vv{A zjW+9RquX62)eI2!(ZTcr32Tw=ua!;yBIf&>9erl|(}KKiJp zU{%GA4=rX+(+dzRkb50if?7;h#dZUA!rA@YrIS0eM8T)!=Dl1FjZyVKk`5rzgcGc9=JsYlamlx4KlUte5e6 zfy^#hr`CT+`^(EmNCf)a9=lgR^K!l`^uVfm!j^crL-S)Jj9lhy!%>Wv)c&o;g2&#X zKWxIv7P?`c6K_^kHC6U1cmrz@(Mf8rE+~mLD?EN}8acr5 zBdE}dPavlx2b&Un?xXbw2Ky=J!(dZQ8k*PlKHbtZy!TlZxrtbH7T3PX!J$64GHAj- zJ!QC7IlvLJn8PI^=6~QcJWG5Zz~y4vzxhBaocyc1ybxPP~3`t}s@&sSAX&hC_!1u&6$DPA!5}W6#AeN}7Mw`RK5Ib~{2Ou zrCiB_4p~HG*6}okP8o@kG*_s1&Xl~m z8OD3C#s>3rb~_VMdL!G*ko~cvqJOA1;Y^#&U)! zCvOM6UFi7UpcuBC+n=;^ea!b(PHnml*z-}1#6ezr>j}_lSredQG-Mf|6o4mgekpit zt@E9RLj{2vz{iW)Mar}LEvI@Y#+2&b6?MKn%R=>Y2(JUULW*B;g)&Vnz74~~T?>Tn zvZxCovhoD-p}`-2CwCIL^Fw>j^v+C~m!-DbcNy#QP=0DI?a7`xHw5oa*ygqdX2SHV;^JY z$M8s$-*JtU{i5Fe0T@I7W2Gf$W(#21ABX zLy2b7rRay;Ah>z4Ex@26`l>+R=)vqI;BY$f=DQ2=_L+X1Ud279(uruc^U z2IWOMben!6IVD_w$=L<1a{y-%`kG|ODmAE7$7a6sZN6l2@=f`r|Jq^(M5Im!ZU1U;@v&AhJiA|NN{Q8-V=~^|O zIL1ggK;jtAFj{a#xm3g3?edQV$nT!x+zsEt^U64A9Gj@DVTIKGYq}%5lQ_#qQb@|B zP9S>QNQ21Xm&CUe8g-1ELAsFCeh&ibQ+}T&P!Z-6%?`TN8wHRB+!2Ypu$oAixVL=M zi)f5y*92*tc{hV@>x#C;Jey{zXO#M!=&q~5d$K0yi1s__7|bl`wYtt<64SiV2oWzq zV^;;9)Us`jq$h(x9_{eWL)9=f-61`ZbOm`o`Cl9UUO}b>qA+OB9nnsExF>Q?kHcYC zYfEjzB;^3>9o7{&vyQayK+WimXZkJWzYi)mpQYH+LvPQC-gFQOF+%r4&8e)ZQ)=~8 z6Xh9B?_3^e0)0E$gItDc~ zMY51_+bG8iT_h>RaKctO@43*Jc0}tgfH28}kCh_sYMQs%%z_FMDQw zM%Yf2PcXkqn#*OfY5=$^TcsocjcY3965VP=!bDxGk;5?F(J!y>b+TURqSd+KdZvet z>J1D>ArixjPMtp>G`pRexuzpw((&h$bEhms0xZmSD`!FT`*nhO;C|YH6SE(;kqy=6 z{A#YEu<64B(={oUf0OuPbtKKmJ%gWeFD5+n8FTHlVaE8u-CZs+ueGj6vVTOCWWy6v zxT?lta(l^o1I63~+1ge>x8e0waLOaoI8Zhuy_h)5FfywhdQW$*(VC@CSm@7yJ;4guZdts~?bmMfJ*_y--p`Uph9b40CH1(Db%*-+2KtM4NI?2yNZwR-!${Q=)ZsHoi)qe@c$0dD#ID~Ajnz1PU4G;OlF z^}cI^B|8tfhnr^TZawY#KobEnv=Bkc*;nTmpjS=ClB$KTzwUawQF+riWNmcg72uFu z-m!Oo;<=x#6nlk=l84_|o=Vd?+?hx?vt&MZ6XK2i7~Tg_in(KKKQ3uem8nJ3PUL?? z5L$OjAm8pX1nY+;tVJ`NDBFbIw-}*n|6WThY$z~Rs4vNuEL-umCVL{uQGYG>`xD8S z@dSNQV}x` zXQAfH;Vf6C^ss%g57SB6@%LJX#0%NcpbKkqCdsp_)M(Wq2&3|wKd{KXdJn17-Wl9I3PaZ%^Y!XU2IeW;=!M*aE!${i? zVyd;=o~xtYOPkoi4+tZwq&1e)Nj$@F{-sP%3SxcBp}@^rS8FRvt?OVu&Iy76iVtWx zPtm8MMY~S~AxRXGsA6PB@hiUA^yIJYQtHrur1E20-m7X}PAC=S5FH zpb)h43baKvOlw(b6w-Ka52{0>Ea8a`9}(l9tc**_vI2;LhO3nT`D&*Q*vF(LkYU3` zAEL?h*}3)nP>~f)*t!uwx)fuTBXZHMJ(R_TjANSnv31^F#98qPp4?=N)yqK&CF^aq z+LfQkSpmJZk%GHGsuJETM@4UaXTYjzG~bR}My$otfA{2F&_-J6`M5r>zD#ZSNKW@E z6~fbYl1r!H4wXYGZ)_${Kr$a{#t>-q>}D-FNil`CF3M)=CT9;zd^3onN3X+>xU%Vjk0sz z9!Teh{iq@V_d#i$EnjWRbFdiDV2M<@t0$H3^;IeIgCd7{-;2~U27as8Pd8M zjMh)(Vdr$tT*UZl>j-LQ5J>5$N?ha`4V+t3FPHa6>yVNvS(7XDzR$~k+nMniF9fT@ zyPz>z{+Pm)EN%4lUN z$k20{BoTy+2?lr`++|?y8lxxei*ta7^^CM>r7C!A z{?+kbi(17ZqIUDMEPf?w!=VlzTDQ}sgisT??Y;=;ySKMaqaEejTMR0Zrc{SZj^?MC z`Ygxi)OusveSLztw8~9mE@r=ax9jXai&}_bEQ$SW{yII;zOm&1?mTLJ zhiYeT0s7GFCT*~JvTdumA02}x3z3_2lbhcBE%LR&{yqtmk*Sn8W$JjMp@L-i8dZHU zNpwk8+^MeAUcLz%B;FXX3s

TxTV%n5YCt*s|b<6>Qpkvn^jvN!1RW;EWG!d09(a zL@mtDb+}-r3Z)Ge_0Xv5)|qvdK>sHgafG6|?rM)>0fqHQq~+wNfw`% zY2-2m+1IF;Z#Xa;jj;~ZIeDP@@o-hk2ebf~w8BwGHG2-d*E0 z>QQZvmr>N&$9o^+3C^LNb@>y|{+*E#CmU*{mFQ~ERde&1B1%@D3^7Bx#oafBTQ1sN zsHMZb+styx%zji~gXsGhU0BBppVr)B6eh4U=z7$BY9!7qP(7ciMbgsyv11+rs^Oo| zErZ4>JoO7V<0ZUz#msAJqoSLgAF=B{nP)r&lEMY@<}@#L#@57&;=mhfziw#paEhMuzE>r@59BmHDl&yN&? z3^uFhA%n`nC6;B$QfURvo(XOPv{dI$x=FWI-5+dPbdOb@5-ZM>HM2PyB-Lv;SR$I@ zdh|G6Iw#xCe!c~)?e$N0HTBQOrK#K}*uKvdbTE&t2G?A~;iF?RmeOAmy=%mpOL+{k zrQRo~=O}MmAHgsTwaNl4*LY*D?Z>7^IyA@IpjNCc}BhFt0TN?zt6*_ zojU{7MjrGBsJ62B%O;XJ@itXU&&smwv0IV~pX~{NGCck5#+6aUHr`_t`NL}={hXXS z_t-#dX9+~8He~mm759RyfFSlHMBMaSMu^_3pYXXS>}eN2c<-;W4xW9o zO4@0auTdR&B$ZWzowIYyWq76wxF^OZ5AE8N9o%4h1NMOO`Nk#Gaa5#f2VKiX4Y0ii zLaB*MHbyb8c`7!O^04ed|Q*2)HI`cF^=w z5oc7c@}3_T4Gp%ti7mC8sR|G7IHl|Z&H2^F{*e=yJG|22+>~YR;#Dlx9dW`LSO|-Nw4Cb=-mmg%c5Gi8JASM0+Kj(#Vjg| z{iz^cV1F>%&CM&tn+vzLO8q(ux2dA!2fv_ZlKMJ^n^#su}Q;S^hN81{yjb+%K7xpmvSg~GZTs8z@5tG^~5WaeI99q4%?OhMiMP3!61U~ons^jeCRsXz%&wLn1 z$0Y5swB{TYhCtipYu0ZTDWhP|gQ(Z1uww>K&X9oUiRdRH^p_l$`vX?`BlDv1zJaY7 z9ptP1+IofNROp*&MFK5Owdu|4BPH}@JVVO)k?d%9*91wY?Ez!+*XT;0C;;$ZMiK>> zqid2g6_fA~u1lKrH>s+M@p9+$DBX*`$JqGjKc-)CH`3p)cb9cVku`v4iHA|i!(u`z z+qRB_J)cC3bXvR|5ZVDg7`WTmsqSPBnb8ninyCPf-}>R7Q{|x)S@{jV{J`T4AES@2 zM{*Ii#%DM%-Oui0rT3qW;~W}r1y{wBFlEmoz6u|1Conot=rtD6N3QGyvh4ETu_l%# z%ynrM`osdoTU{yj&}=M5B*3=t!ZcyUHSeVwh}lr%Viq~??oy(#3ULT@h7%*-Eubc0 zeum>BvzTQ=o|?lJLT{YX#C6^c>B*zkxSg@0Cdh7>>S;?hKabYj!I^sH4dF(#ofWW~ z>Dr%v*NcD1Lt5hST!k=|e0#R!8ROub?!+oYh@UzgTC|af3In1B1?Iifm|eMfS@Wo= zZx*Usllsf$w`c1c(&KZSAthJ{RZ&lBSA!I(N5D z$){m8@zLG@FN{TDkv7~qK#WH=%Nt8$4GSQDbiuVU;sD(jUMe33xB1bFl_x}g@oDV+ zxZ03v~*p(yYYn(p1t)82+RBX1t}W?e6^Z0lU5X^e2`QzQ-<1ddbd*jMj(#*3O|FsXKe zIh#qJt1^o`P4U_{CjNM{%E|2UOlp;A)D*QV*W+EIF<|6e2ExU(KrRnkNjhAJ~yYs%w*0+)= zBb0T%V)DT!M&|s`0B&9hd{*$utM^aD#vJYRey@hPp>#SdNlV95uxp~|{e-AgFHgR2 zQoHA1PZCSNfrXDzQo~p3R;Ids7JL$7W|Xnw<78|+@3BSLN>_DJVy|E?GjWs`xOX`hz`_jG4Q>u;c8`cjD7MIpb1;G3c;j&B8 z_kl?$6wgDm5w6&5*C)Qbp&Tafe}OZMg=R|dr4iO+ev5mdw2>$bu3Hi!`9Nj|Q7O(s zxBKADWMCqhV0G-8N4()kaiZP2Etgi&3fke$mLtsC2jBt^obvAOUAlPIfPI28q$JyN z@TNx1i@T+2Rj}VSDnQ7pHwWY@vt97cyYD&!9uAudOj+>XVn%C>Q(8?|+j~@(EPiIW zN8hy+@j=PdvQ#@m*2O0Nvw2~#?xz$G{|m+#Hb+4+fVkI0B-XP0MqeDJ9!~+st1i{X zCkPD%7>u0-V`^#f-p{(jIApWQ<=3zrJh#$$N;Rs>8=jeIB5A3*phs|#DcdHS5bIT9 zpFnp&-o*xlwbRFw?O|I~pn1)Rx6sRew10PB-lHU*?K11=O4zQ0u0J(KTs4L%Z^0$&<(c#rJOb!nHXc~37uHZS z>{hRw>E9H8Q2V{5(HdD`mTL%6XL3HqUnD23U8%Te!a1y%2Q#Jr^>B+d zoaVG!_tne2!gn=vT<@$#8w@emb$@8cT%BJ~^lfQ;I=rM?P=SoA2i&^E>}OvL)L361 z0ynW@nTVw^NDDm*m9J3V6p?)z$R$*u6BWuNW_sASTEOi&Srp2Um)C0cVZ@3lrDpUl zXJT5{c`+N5_1qk9BTw1hW~|gkVf=NWifpNcwbPrfctCr^P6%I8*zr9=!B8CQX^s-G z<(ui*@^K8Rd#NxTD4?He9&0m~f@;(kvU%+`{mqDmZ*>fr4;sEteVm|PQ)!v1Zz!J3 zV-mA2+c@f_M=x|rvp68+P|+|v3py$c(CPBo^$jYNj+AH(dt2l-hnM7KchBhNsk2#) zl%?N0M2l2Sl3T8|)FrGAp`(bp71n98@3Gap=jr)fb#Vk1?>B&W2krpoB5S+uZPV%C zrx$ef?uKL@`n0ZFGIcl17|C;)Wpd2(_mJt=P+>QY7dkw|$DDfHZ}cw=H8PZ^(Z~Jg z^^On5gzO-lWIov!;p<$&#p;GLYh&N2XJOd!{Zn_Uq&UI3)2>fdA?`g`A;`(wH?WZi zNoQH7_UNegOp+*6kK-V&;8yI)zzD;sIK9E|r6TccRrAV>y*S+*<@hp^P_a*yq0AZC zFFr&<&TaPK!p!S8_gL1EN-1?70@Hz(xS*U+<{)ZtiZiR+`FLOqi}HMfBR*0$7dHnd z7(bWiz6&lf%vuvZd>|^?8d`Ftpk#7u5{_yB13(+N@5jsHJxhwU#6aqg=3kWgF1}iK zY9x%I+UDMT;svXgpkZ1~*97M@<*NouZe7IBGHby8E0lKl%@^tBCii z(&vAB#gdBqf=$1P=sHP^}|lBiRK)smp+r2TJ&``HEfP#Uw!yy$)H)>pu_= zEH)+LA0CMho)y_Ap@eNOjKti}a%m4`t6C1#L;)+pKp+0F6|z`0X;B_j<=`IBdERK$ zuB~BBmf152+Ux(|?%lIlEfW?B)#Vhsm^i0{hi<5dj|YWz<<4qM`QS0Oa7NM-BKh=A zR@QCQSq#@FUS2pLL@|`DRIPPobt-*XxEBJh*B2`F-hQH?5veS)TyHgO(UsGixY6Q9 zk=@+^qv2$=F^gl7k*U$cFz_h)F8+%8vc`3s#Am9VwA3ZjC z%K@H~L7PUS+5Oq!yS<4DDB;{d*uaCS#^_s4Dp-~(BCZfM1dYPEt#>Ic|Cy)Ts@jPs~VQ?d~E3!0%@v(S`or|PLsNs0CA22@AU7F<#dX~oFiV6Go5 zcc0ECMr5|V_o&!7&c-TvGViAD!TawH=b!?M@I+z1s_Z=+z2or@slD{c!}WJ-^0BSf z>sy>-E_*)#-S+3&a z*@Q9|RzA<0wsvVj7}QTua`C( zsydUarn#~ev!#_Qth&vs=Vy-n3(0$CJ@-O(xBanaNgWCGR#8))%aR9S%OuggJ?&@C zqU2J&$JJ`$rB{xFh!0btYfii``Ns<|`NgLD?|GGTHut3$HwAp}gh}Iz+>>aYhE+a_ z?(a@POP%;EsJ-@Vdx|qsaW`*B?w#Hz#t6eClMxr)J9FFMJQ+dN@0pi%5i^p#_`pX z6;V0=Z}5%T)Z4s`gn$!lNEQDJmV?D-9=j9Ei|J=Kqo7+GjE?qusCBn=m-ap7Q!fky zq*NEkyfYoC3H{4c9*wV&V7#*H!$O!$lj*kG-UKHL_B00`neT|g<;~U}q?3VIrjQFe zCSS>wamNSXGt&^kJJ>Fp(x1D=8aa|u&wCXXsuzxA{Ir9YX3bPV!~S97FXb=xuMk3S z98}|_Zi=$YIj>{H#`-M;w=}nphG(CGFwA_Nq#T4mQp&>T)Ex7@i>y?W3D?E@hDowTu_wNehSwA;$nV{AEV)?n} z$fKn0WRh_gh}8MVObv%*F5u53Ux*oD^*53{)40&L39$~e)DL(AOPll z_JzlRH1CA14B_38GI_c>JC8$Br{cA7sTcJ~A~saeZgkRo-D$lAvpTlEUW=Csw=jA= zXzn!P(K|JorWX_rXtB>k7dm{=lR8|X5wQW|+v&Hu>*#GU^Bbc4hkLxIC&^hX2q#Bp z#svINoz|l}M-aJQkbBJH2~Y|$I{chT*F`;pPu2(9ZLbL;XR83t+-gwGJIWYWH^K07 zSbN{@yjsO{#=UxT3xfpFqIoj9r<5@x$x60K z(Dyr_!C+0?JTGQ_6t0)tq54C|_HDq2w~`KmOa~hDdMjA!>Mgq zQfM-tZxaR2Ktb!>-5)Of@2M@s4)@YY=v!yd#Pr@bE1W|vO-*4^;X~Pqowj>2I26>|ljRYwT4`g=m*qKtKc1o1~V09HNkfGKvLzBQ{Be{bjr5cLizRhOYu!d|l1v&}fl7UAh{|H}ZHbd_n)IiUoBYe$F3LGy zUsROt`G8o}5@mL;MhU4YHC`m|s5@$`0hN~~?34k-lo>7GtwA~*acR$)627#{(bdS+ zwXt4WUls@`5qL3b^DLDcI$``?n)%_KxmiE*1B=DU7~@;!zU1)fA#5LIp%EW)Y)K`t zW6Tb<*gjEVwo-PPe(kM+V`b?o&Y{v{IH%kiW9@O0Z&Byd{qtZ1NcU8>d`LZqT-TLO z9ZZpyt?&1gs!Q8D+692olcRl;X7!`*xO+Qp5%#PdA%MWQd-rlnfW-Gt6*cs=jj?dgP0Nl&&`WG@vt1XS(AEUGKcxp6wa5ssorPDrGDEc{qwN-+imqU z8InQi@%txs5k-1ceUwDRECSgSSfEw#4A5D~dZwOJ5GO2S_V>uN<2ec5e-Fs;e)}Y9 zyI3&FKR4{_e0*P|wUT$)?V&t_h*&3L@XZap38acyvR-OGYz|O_iu#!aGg#u#PjW8r zmB^C)-j+xie^Hw736!mupQP7b( zJf!j1nb@D>sFJAAq1rq_-U{nxrFl<#V`_DB&6!v>i)+VL&A|FE#Er+)wDgdJvXGA!hpEq;tHw@}0R8mc4BaWxB{{&*4MR5!@mrjI_SxUP&pz+@zJLBc zpZC8t!&-|q>v^90x#PO8>y!Si`|*dGUXSrbz3bKavw3E`8OJ!1H{NrC>)k15v+P2i zRk6I*(4H(t)$Nu8x%ylTlC9DXws++Y*$+mRmv&WZm7n-PT{g6C{k5vAOg6bl4?8#@ zb?7{G@4w9csDObPZ(T=2=)ZDP2E_3V30OX`3* zDwi9|iSg5eGP#vd`@+*KrckBhyGotPv=Sh+gMv&CNYO-$+i_Qt3tGvGE5qE@lUes} z_Xd0yw;Nn`Y4K(}Tm!a!NrjGB1rni7I8=q|6#>`7*a7Q?AIoYO62G0isxvTOJt7^r z7;VQ+{6(Wao0H03<;m}yC<1D*QZ>&qj~jCjQIc&CbAtPD`puOT>#iB(DuNeNx}3Bd zxTkB?Pu2I>^;@%235WJR8nj+6BxtbenCLLnhWLn*!M63xuV5pa{i37pxL;4Ei5f$E z+(q}qnow;1lf3Fzb@AH;`|=(Q=Yub^{iU$DDR3WK-6T32J_~6f{mF0D41scF3_PmC zfXdKHI-JS_5}XG*^`3P;Z*xZ39K#AHs|Pj@Kir}VhQOP6Da$ZIyUbDq!kT(1G-CWBYZl(=2c95MrtlRo&yJ8Us$4TFu z_-aZs@H}St*gb)Qq0%JOBf}V(9KAgNf8|ocyWIytzC^6Fd-GX?S|zwMNqdfOd(5u) zGfA?Fo#(Fh`jB3}uHOzG)$N=00*%V(@`zhr2jJMnLLZ}+BQAp9s~Vuc9ndSlW4@I8 z* z7p}?og)q6(VL~Hx+_3Fb#IqeA9`I&=i9*EXZSKTFjtixp3jKeJRsS5;D&F&Z_^c&1 zwFwd{2idmu8QdC^0^AGmVmEKp@?F}$;%$A**^7P9@Vk)hXh(%=CLfLrv)%`6XiG{*>9x}zq~V~>IQDi@b!un)Qk+8(gQY7R78 z*{^*DF}U^d9G!0#k5+_P=Ny@?HM8XQK2v(JI*S3nwqGVLHgbRd99Xf*h)-chug>MU zX>>Q??hIp{;Y7?CNMrdEdw0&07+Yo zq#r`lDm>b(^kxcsbw_qML#iE@(;!FQQj>K}6Q|_PZ(6k`bV^5xCQ~~ea~ujXt2m~X z?57+BQWqHnkHy|+yf7+ivqUPrI1I;W9(!L1 z(3)?lGd`x?Q$R5AWSYkG##{ycNHs@hx-cuRC>|SA({7~o5@S}+TR;oD2XOmB@0M8Xx-F_jwb*B8!hKd|-V!z@E%QW{)(b6Q6CFl6HfFHc5W zRHYG#-X}Qx2>v|;9FERaF$<_@)y(UN zH9!*x7r9do4j5xH{~i(WFQ5>x>r20B1;_NaU|uhO0C1lkVj{p#Rt%)9B{NVf544%D}l>>iXFk9MZVL zN(qFA!;7tbF|6yX#>hyhp~1fBRgJK{PuOjdiRz~SMkvTClgyLbqf?F1QQ%xI5H{iX zjXCif-!#Fl9%+e}q8)SM(F~R2po3J!FFty=P6Xa-dWgw2m|Zcfd)@CLUE z*T<2-*vHeA!kHmI6C5=~qcCev@;9~VF>o$s$d_P+S9l60W=T=&H}-+?Fws%H;vY?; zEdNb^9LP8%n+N*60OT%~8sC zUlIDMRla$6F~qIZ!(P!6*Biq$eNWD3twxX@wle31;Mxv76?wm80;)sD??@z7K?oG9 z%hfgP*&2w|%sNBl6ZmEU-7VnFhKg6@D46{6#WU&7r8ezm%lAlI|Gu8;K4a1*G7Eb` zNqidh66|&aR81cFtWAN}2cneMpNQlF^30>wxss)wWa6^koo+h;L3_t}W+`AQ-^VDFFC1QWF+8cM0s00@5LvL`yaV>r6Um5>gqJ>Bwc z8h-0%eUC+ww0?e|;)9+XT&dmCljy_q;yseRpTnB=yY| zKM(N$)r5;zqr`tCivIrS=>sBmgBdd&0Q6kc6B&Q1ny1|M)s{zf(3<_4!6?N-V|Thq zm+Iq2gl_?>qM+bA19Kh(3_>s9uyfdPiZ>0{V2RMRYn;RF*kRISF`QGF7R&HCIk5oE zDX?hQv(OxABux~fT-u*JZK@a3n|Cxf6z(_4sxOkf=a>BG*FBI3UXgxv_lV6Gj8=Pn1MeS7J#5rz&`=Pp(AR~4 zSF(uipmPJ}=1-f&FY!;Fz4m5}YEFtw*|mXXdMUJAl~ZLP<=i&k8i3|cv;w>?V)%WY z%D+0gI2QirNEf%8HTW7__k*D)5_@_&xh@L%#sRR?I4vsiVeEOqw*MCOg%(w5WqV9egDci#T*I!9a^!$Z$%b1#atV8GpAO+%VXJYkvksUZ`HO^&ufek#{Z4r!*%trCX8vaLbQQq5p4 zZ63!=baBHu1Q}@di->z~F7;_e0;8%tasB&e%>*Kbbs0#8ltUt21Fx?O+CWoNv8h7_ zxAVetrv{gM@N)0=*M#?7!T{N|myxO}CZ7^+KQ6qh+xnjBa;`Ig{sMFZsU9e0mrh(} zrBM>S45y7Z);d90y~XgM*#L0Jgok?MTRQ1TD>pQXpf1H<-z-GILY1X0dXDV_Tn>}# z8Gg|%0P{Zoymz3FbN879^Lb#XAt0y>BwH~c`nB6V?l^NTVlpatIT)&)t09D5_n)c_ zuhz^tWzMX?a+yn-2hD7Erj`j9Es^_=6Pq2z_tv=iyIFiB0Ieaif?wNPMY#i{_~^$f=aj5sWp3R%#}O^$AnbD% zxCbwgiLk2@nFqUA$$<WHV%+a00jaOEUOG)ZIw0~cUuW?t&EosGGLI*VW~c$vI%NbzD-3Jw0vrd;C0oLC ziWO_t1w~p?r*~Q0at(cCxR92~_D_MN5BhfM1O&Qb!l<90SP5WmX_C^-;u?3iM3GKr z<@2ni94lrmN*?2R5|<>Z)W zJRtrhHr9Nx#muMm^kYg=n3>iu4OYd7FhmQ`{;Xj?P=4&LIS;d`E(9=a&x{bv?0bxm z#57DFd$X+NV^LOn9VF8ZdCq#od9P zjh|a&EP{3`aZ`h1#2=m&RknADT`gR5SsuC?#5O9kBz7F93ftjnt+psymd>v*jv`OM zgBR|`*o!=((g|4i7(XyS5M6oUd%R<@LH?kS@4}E z9S_?dzf4rsMK_BZ>rLdE5DzImH{w+p)!%R5e`I2f2)ao~1VKT#>zm(wEOvoBIsnctyji>~3#2+; zyS8@&*MmisBJ!G{n=4iqhK-jF^^2ph7AZ4~m z4Rrt->W%$~_puhIl0FA8L|nt>o34$ml~c`@w>)5_lRN{-=^oJ-$< z)wompiqopFi~e&lYoY#QTEo_QbPvtvU~ekN5V<%ex^)+Uu7TdQ*Gct$Nt#a|420e#q-I7O(kAy^Ggi$ z-^+Y7zO4rg`>UFn00tBZ)Kv#LdhT%j^K?g;c2)d4j@|b@at5HyuJ@#?AL*&D_~3n@ zxl-!5FFzAU0YLYE zN#?nNr*jB3z3j%KrQeO)5q6mz(sGdf4rn!mL-e`=hsc0MqP}QCnAe2gY>bFCP}@-cw`q_$eOq-=l|rM+f||&i;8s!+#&2BY}KQDirCzKJp*Kb$9gi z0X_$5L}1L{S>OM|cR(5cetbX9-qWssWv~Bxy!(&)Jw&@7AKcw8`(H9vfBlKwILN5- zYXPni#(#ePzn=GRfA#wcT=;tBJ>7rvE&lTSE9gkb^p5Qf-JE~Fe7wv(M&${eKwfzq=Lw zTj0X4FN*%2sNv5K_dlkr-wX{4)2 z#ori2f%1Pj_^*h73;*9T{P&^!f6MTHOz1zqp8p>$!*F(f3e-O=w~6{fxaB!ChqauY zQwEn(h_)k$IHDXgn^s9fIE(UswR9+=kU7!hcc+q`4>fU$tKd=f+jG!;e-ts1%M*dS zqhqSo^)F$7R(AZ&)TeA9gM8(Z;7ZGJc>r^{0a{bQBNx$LyQ-fY1jBaKHYaa*Kq)>F zHAh!T)KeaD9-umvUWVvXjXk*;cFEU@;j4uc-_R8rUw4p|cHaH#cww*l6d@!OI=4zU^OiaO}{Y+u&ji3{USCISs;Wiw_MEmPI z8QWam8XMSV{lcR^Pn7>KgB<+Cp9&5C+Wr{6iw6<2Dn?7L3j9xRWdZf!SHX8G`aCmfX5-)K!_%?= zHT$|o9y?_@gT322oJ76%$j>q3D|xQ|N!jXmAGz&}NTXgf7jP}B?+icq8e9)%1mLn zq++WWjBktboZyp#cFzEK)$8CCt5epn*{)$i^Th20a@({{oThrYe1Z-eYInWmX2i=_ zh|V)c4BW|OChf+&WY;xIl@=FgkZ>7A3-tNVpTXd@K6&G)%F3mwz`d1u2T){Z`WA$5*HKS=Dt>+ zYP4N(zGN)xu{qXrGm`WK%^_})|+)uBQP8c4ozpFNFp z644Ft7U{u$(%gBfS^kmJu}MVtIQEcH%kT5mzJyQewZuH!ml)O zRxJ6XHbd`aH0$XvYe2EV!}eY#R($a4xjuCpq~LnDtKD?qQVd1o+RmRl)x+3VKL;_9 zZY#(B&Y@$^XVQ3L`7}&rjY-bC%UON_1H;C(1D*K){*NmPyZclD|SI>Z^el(*#6(LW)=`}dX zWaN0tVK*VyY?@vT4QFW#elzl@kXuj5dA66=r(4nsa^g>awyki?<$ypSW@nh2=0IO( zM%D@PozDR?-t@Jva&vlv_jo6)nFG%~*^-JXVHJlx)nvEJDdlwh>@roQO2rNO%3;a- zCp;MQf8(}>O8T*2$P)`CcPNJetOZTR{uj7eIn%+)xjZF%Z#SrS5O`FUD7d^li;btn z+3#n`xJ)PXk`CT}!ft*nGKJo6c@K;gTcjrXQYf+hfF9rI^onjR>WYGPMg$){4og;@c~6ZIu*)bx6TI+mUDR}JOxAhxy0WL{}Gv_iXRwBWjW<9@dag?DPyy_d*y3a zWhARXVh3K;Ih;`QSvyojZJ}$Pteqr&OvmK8IuGJ>nW`D}i8Sn&B#4U-4iTdG$kHLw zoeotU*e|+{9;E?KvJJMR4naZ5qZshz53xy2hJN82JQL_PlbgIfmv`gL$;M z_UbNVJ!VhmgDjR`pIGxRT-fTYjPAz^uOe|hjI63~#oh~@Z?5uW{v`zFCu!A6i1ykii~W2?Z% zvHnQmevbH(WEWY&eC^`Mq$){$n7AyVyz7ucQXv@*~V8=wik&| zs}!hAPG$7cWqBQJ;~D(24MW()7Uv@Q;awSm7)_DyS6PIc2Ib(`bV?1-3SM`)@!jVT z`TR>G=pqiC_l3PRxP2;Jv0_JzOo)k9YlH$?ta%nrMz19qgl=i2oW?9P=33dcS8h{Z zy{rC-f~PN=cy_Ru{=AKHRG;7A$u)XNC25h~wK62puV5#Cpi#ZO%X8f{vwkb`sDoPT z5Yi0ozU@aKx;hn3o2Hsv!9>g|lh%cje&*Ru!jKf4*sOtvw28gbksuCa$_^?8{uPUdg;q7J^6&G*PSTf0vcN{)-=8z^kfW>&;8 z>I9BY*i5Q3$3z*BIG5v*e6}L7OPGtgg6WCP+ArYEOh{9CY>G69$!Qj!AkzoMr}gfp zOncxtS@^^-M^~Njlsa?`&PH1KGwIXhz*5m))nhzn<8QZRprR_!gThN!poSmPi>KSM zXN%8NndKKY43ny-t(#6`2+y9`8UEpX-dOr|2&?v^l=yiJ*P6U*HD1t(XgQ;fRzRqt z5NkeOeLV0ImOU5;G!0Fg9`YcKXlVY!ioR8?A$+6BLX?7hi1+o9^;W5 zRv3yu9c0JNPj6(E1tNF7>%Q4L?$WIG%}8bB%ECVT1`sz-Nwm~X#-$LT(XH95loV;` zeAcO0t(`E_=rO)yHx)~)HC3(d$gVX~3=NJ>ER*STA#_>@z;uOI98UL`l#Xpjl~@pW zp7`XLG6EJ;n2e(-eIS1Ha?6*hUz z|qQPYF7U840hF{2npcW8cTtt}sN0C}N)vFLb^!y*Z8c zy_~+Oq3nrBd=u$r!1GbKeIi?=pRnx7f6n-YYWuO6#*bwVKS>TsEc)a~!ghd64tNiy z{f0A01;u zDagzc390Q`jVFQLmb1-U=vc+&JNna0ZnOI48PVkT0ZXB3MuIo?*R|=T%krm8dy}3q zSe;!S?e7u99#N0_=-wDCud&;;B=Q%m8*VGau^9B@UKGC!ZaCXMi8Xi5c(dq#DuQJ< zUuuApWIBfCj0!RTN3CE1m4pNOzUkEZTVJ8({C>7n6grp394O-qAB&j1#_t#vM#ScQQm#W? zP(sQ+nlfq$KH-8gt%<#XeN*0=!Y|XwZ8bCMA83-Fw}dN}@y0t_SenKCd|8t1QqXy+ zco3u|pJ#nWX$+fxaaMeJ&>>CH%QI8`gB7nP1qGvN{P2b1Kr8m!(@PA z<(Xn01+WCsOl&7s>QN6?dnec2!-(VxSx!T`p2LCm! zx*$MspOQ6h3MoF#_gY3KLz2n5Bvbh)``Z5Vp%npJ2{nHPGdmzi@Nrvzql(XDwg??r~5M=Yt2?mRN)w` zZQaya%Iz}=w|ESR%5cF(Rr207dO5c&$uC$J(Iq3k&)=5nTM`#ZYVb~^=KrJRBU~5l zSVwrq#A_@AS_f?Mu+29u--#J%^@nVk4VB{Qg;q}TFuAvz#2p-*{K8n1c%uQ=dwRRe zopKC=zzFL-c8jaW8GY{_oNw}hJ4+M0;5@q1mVZnkRIa7X@S7O3$$9Ds^p)i;I+xW}e+c~n!x#f=ek1=XVm)!ObR>SZ43r~gKS4kto7cyNr#&;b%GH)<-|66cWpI`{Q_Pva z&8+)xVUr@ZpYqES_hPr5>mie)2}K2FOmG;eiW!j79`-v zZzyWRTqTg5YJ&Po;k^3wt^siTjN&Y5R)wkY_!FK*Z8zRr8ZXZuF2TUvXJWZ%NNoI5 z==0R)**37UzQW8Cye=Wx?>+DG+Y%V~OF&TT{bk=FX}78P$~lru`W`E8&)isz0mVcA zhdj&CvHJ9|v3Qw^?aG@(0k7%}7h}e0&8YVF0F1p)r$;G0!Ge~Z$?;)gGooV<{aJD< zkL?w0dic03WQ(@q)={3ribZNZE_6p1MxXfTxXK%xAfK?gCYE@%2eY(n%X`#I_a>oT z`$fAg|(xOawe{(R~aTpaP@|BiE9{J zBtK{aMlrjF_|zO7H+M1i;#b+L(_I*-VZu7Yz?_6#32TjAwcu4K`Vk2bS=dQKGAq`u zta4AF=X>5?FARQKQ*^v4Ix~LjB=hKh6+p@P72)*Q;-36^iNpVf{j%$vx!yIpMwG$| zg#sh=F~ixcLrn5qMj7UVco6ri;#X}eupO16yh)8pmz;Q0_`xK@gr|;f2Rc))KAsbtN0ki4l(RUq7^cznZ1qDr9x|O|9*{!Eb zLwWL4XD=;%3(!l5`6Y|srSpTd5YCorb4~K|{2lm2fmzsFIE3?Mepusqi5vLA6pfnC zZF-|q6M9_znNP!JyO;mgSe{j&?%7!z&z;}V`t2Eq)7Z~a3|Nk-YElTN%@+=40@=9m zivFtGh6Kk(vKzRno?f!eRJAG)Z}#Z!fqx-Fsq}{q*n3Z%PI^~&Q1BB!xNV&|nx3); z^-EIcla{OoHZq%B(qAJ|n|Y2Hp_(jb#tCP#IR7@5-Nncrr`r+IRBo>>Pj{G|;S&SJ zfjuAo75w~W^^#kW(^c6`(T)7?AFdC9(=}qguV!5=ZifkdUhCzB+ommFn`!NI;#hf{ z@GcCZt*Udkp|B?MmBM>t7ww8V z=8_Wd8b<*uk-X=+<`nn7?^sbd)NpvfEN@IGaZ&l~B?|YDSi`_#nm7&uo9TUMm9O9p z!*0`C9z-UyyIwusw44Z`UY-;RTZV`?jHVxQnhR!`6|Snewv5sDIGw(Sg_F~G^Bs%M zu(_6lwFB3f$|}2B_^f|)1i>@KKZ{Vww32dLYEF9LXbb7e-uq-WGZLBT{tI1hi_=9I zqMultFc`(3nR&V%a9XWcjS-bFhWcY>29eS3*!WvwmF9GMCPPNjEpLxE0bQ<>C(j&W0zw1((|JV&h)(=7V8GqJ><#{{d;iT3_6$o@{e%C5(08 zquYR~KFY2X4@!k-seN0W?T)hsir_#DPbquFUfY?z-Mpm8c0@B<6C}Bw8gqto?cXdX z4L_zu>59JVEZx!iP+Y@av#v&wRzwnRnDJj@i`EA#oJihm!}AXrhUFuLW^#ye_6scn zJSKcw7BUj<^WL%a$P%-gp)mNvYu$DnGdC-Mig=`jKTTocJ$W3nU^NX0?0G)@XcoPF zfqsRoy_Q5)&J*aA*SSX!5Y~B>sHNLzUnSoYF#9un|D>-GSH#-p!Na;sLIQBUZLdIdEi)JD2tvU9 z2)E9$V0CB3dl1q8P2uy-GlpI1A1;Fr{<$8$YQNh)$3(Kd1CVkI$=BZn`~$9H-wr1s z4RmxCD^cc&343Avu3VTv@Q>54_PuTh*63Ctf6gtFa}`5WTB4f$QLw?Y5g=0MYe!+y zt+t8SK}4=3d}%C^554Ho2YY^QGR0>m?_fLy<;W?Ix+ne2@?Ob%i3C@>D36F5Hf~zgSWES{x z9};klEeZ2WfNXBeGxaifhRDquN=tF6oiy7J@QXgaVR;QUgmIRrKhzRjmiUt_+7d-= zz@;FOM&_TmkFM{&W@QuLO#K3l@1h>2ihH_>Ghr*oqQlg`hey8R6R44qktTa{UQfua z`3?!_MqXoLYWscR#PU2p$aT1t40}^ZoZD><#t#3?RVGqNafEJpSJ|a7^%LG}RMjZa zV=UAtE(aurq7p45(|R(mUYGt$hy1rHi{CS*@TwtB!fM@hYPnD{ZTS@M|O7|)7Q2zp31 z5D4A%@0x&n`ek}jeM3*nO{TbDJphVkHeakIsWiCQg7)-& z(Y8B!(EgP!kYXJGDNr$h7E+tOl>-^A!wKK?Lx}l&WS4=v(p@T+GF2BZy|yRR8K}{O zMrFR||DPq7-wR6R%*r&PUXw%0Ubb`f|KN+`0Xf$LL=sQc9>r1;zfn+#i7E7s13>uE z3TBVblubK&D}$};OSH-|(hExOD7*xA(e5X{*qxWa{r#T*vNwiUz~$Itikd{zTkU?axWkfc_+Q=&Wa<{&4NEj7o{k zl&`GY;Yx&(*hfP?n=91^#4OLNtS0Vj4c$?EgeRfu{mQ}}9@w9$+e}&2`inVJ0{{!l zD~`X)Em4NSUf&R=d(E!|-=(^T0pKH3LRrcvzsS%ksMNa5nc_~CeY(HhL&(4T=;Hmz zg_@990Kjw6@|`qkcQTPy7x0=tfBqcITv2MWGhG$QZYWxp>G00jOUwCa?K)%Xz8tVh zYY(ZD3-$8-lN~iYj;`gNfY^mx1f=a+R_W{V%-OXoTvDz{g>T5~mdfRtgygfZEX1>z zFOJq-qmUqUveEe0>32H=ga5skQ4BvC`Z@m$f?&wGXL%c1ai))g*B8r3cNd}88NbjP z875%ar2QkC^!xkpD|$dnPv1M&|kzBRY>nP zBkZ)xjK0+Td#*f`0f|eVN@Y* z`@wjU9*3MSntM>-+4iNerPN(3?CTRNzV?;!N6fY^@&jXaL#SS%obAfgLQZdhwhz6n zu@X9fOF+l0KamdbNn-lg;ZN3699>$|i{?w;z7C;eo>xerht=$rl8W)h=jcKQM~dal zL2vARG8cA$25nt${Zi%Ep;XVXNLV9Tb!%iSql%A4f*Rz)g6icwJCE1xs?EC z6pxLvq09CR<0nzXj5T67_mj;mP%Yx-an%vlzW|8iii|xykv2#2Gex{1!;6?Aa}k-Z z`|>!KX@Qzxwe38cv(q}yQRPrEPQ+tTq9V&7R zMDB=R{W4jBaUxAcSoBqh{Am-o=l6_GymciaGTZRa-~W~)p&-oD6SVc*X3f9&Ddt&j zmu8Ym#QjuylLDqOkjR^DUq(>d15y zvDmvlNeIEMORC!vC;9V>D>(@2*f8nN@?7unaNdsx>0RK;m!V`=bqh68NL{5+6M__wKff3?-;8x8;WdV* zjgQmi@kFi+`B7#liYV!G$>zsqqSmHa`bm5$`k;@rSB^2?r=w6Tqq5Q+XOKbV2^*qCtKl_U*kyZz+ zQD*Nz=kJU1x8m1tZ@>Jha%d2O60ji_X+Nk`*1mHJoj_H{I>7pEs}SE2HOUuK>n z3Xq~=mLjtN)kdVgu+;?9KFw~Gqs(meK4OCfeZT{Rpz)sXtwQJaaTo7ktpHJI()L$N zNl$ByF5SIG=>S~n#qm3sdzRZM{pt1N!w&m|i)%cW*;TKS7$wn<^ClkKOXDY?^|IX5 zgV=dzL~+K;1ZE#YR=bP4Rzb8lJ*H6xg>WN!$82UYwU2gjc6|G9<2FUbZn`DuGflkR z0J@2tL!ePx1{&nieWpq;mo9;3J6hZLK_%f`xaUF%=r=_^FIcMp zj~~_?_R*d75~COYwIcR7ywba?i!X1jmMHj%#-YP1Wj!*moF z*@+V=_tY#%*5_+!^if$fwxbUFLMf!OUZegEgH9Agl~3Sf18zA!uOi|>=+Lqqxtf4w zWFzC<-$eFXXFm>AfbVhcWXy)b2y1+#mJZ{q?JPT?4E-&OPvBA6o{NoKb*7w*;V9co z74}L6Jd9-K*>n!o~@TYes{N< zQhBa$GOE;uU!7&&PKxlUomNF!kinsc82N5CEvNPQTL$4*`d`aBpFuV)}cEjY0o~wY%RzDPn1@Quk7f#9# zNFHFzes@aFUz^vI?e)v6S-x~Y#EJQcvcKytK57{RxP#nwif?=JS#^7_>Fqnvde7k| zraFNTR`miCd4-e+J|-=WD~>8oXIWF!P*tRXEvXUF z0(v45ky)ig2cXUwD0QU!1%ZON!SQ;LFK*~zu$h+U%D3FcVt@~MHpzvMjob)eTQ`~M zX3qv1ELbPXeA812%!Dw7n{fA%sSXIfEjPF zd80bhE0|PJZ)-e%`Q*bC9my0+P!KVDRa+R)6lNSS)jXzq+X>qPrXk*(M~%g6dDoP> zEX0??J!x<_p4i3ML;{cLcS@=mYa4pK);uD5g6 z6s>?ZMNUc3{Lw;-t?o7N!nNxw6ea!5x#B`SPdE1AWjH{t<8X8WmD$nZH9d-DHAu@b zYrQ&dznQCR1{gPbMO=?#=AlL3J`Om*{((snAVWq~pu#b&{!Ie;cL$BeJ`3&X=M`WPuV`w85bw(mbast(I@Pg5h~CO?V`~42Kcu=B&zk95+y~LfA>Uaet%Kx zIsb5GWO&cL33GbXr{;EO&aGAYt@GO}33uf5H+xMaXlSq89}!u)d{=qJhzz)JG;auz zq=+82`J-*#zyGx98&L$Cy89j-YGmu#?2*g-_V%_-c>^ZF;v6{15;EXpHpjL*0&T(Jn2ep8q?AnUd-E|RS z0imqKR9;Q}H)+%4Yz-k0R44`s=$f)_?PHiw$JvXdG+JRkgXWjn2@0dmnij%GvP{2L zTYXCEIFWTZ?D~J0dh15n6Zmqhg;l}F;vkxk&N&A*D8vweOt7T^R$ImYC}>`HF5k%> zN)Rs$5*0ysVpze_30bu&&qJ3=9nb6}diwy~wAr`oF_8?8%xg9C=c2uaMMPdA2Ocef z4}Oe$fp`eLd9b_vH5p=qy6lQkB_W@3@tHKm5{z) z%wFdBbnP(E3YsZ4QLG8H!LoG^hJ_T32k+#Ic|(3iPNt81tho0G_bav6Vg6gQwP+bT zBN?wW+d}jE60cG9o|3TY=S=L}q~TO(5tx=&7_a|4FeK|>aImsZ##ma(S3N$+H69Zh zF;41;oWxvQ5e7Av=rNRCFR$cV&1lthP7YI(8_7_N8p#ytjy4*DA!T;$-~c(3c~Ma9 zH@e~18ZN;UoK9bdX8<2^+}+|$o59(`~H?FUFtXi!zqkXRF0 z^lD2vQ<*hOl!sD9EQhE9Gs`}RYy9IUONigUe|O&RAF?Eny)o&hXyDa?CT*sNc40f5 z{FZBs^Iue5g&`}+J`>TU*>Z#TRBG9h(C1EDHS0$eJ4X-T`A2=T(aG~U`);vD5i>(w z6hqdvc%dO{SWbywHY;j(P0b#)!#&=qZ%Cf2g3jCE$IpZAxf;|iKGFJI>jHl?B&rJv zNq^`8$>&T6Bph0uhmp#mXg#+eDXyJM(=T)SGSoq_v7YqlgIY*RP_e|1h!@Qh52$~$k(;=<^#HBjjkWnZ#m7&Z+Sfr7|MMSB-lk=yW4g@ zw=_=QU`kK*hYXEvVkObfU1NfpzvfS}ZYn%{xEOkzVbvZeX0N&}X2Idrl|d-*DMiF}E>P#y%^0lofSpOJ z9J>L%MS5CL-W5505R?4FPV^>so=dwlb`6)l_vYavwJHq}opy%b~fZ&U!bxGQJ1I z-Jq<)xdwA~{ko;|gT(-`Tdu^7D+!Et?UBhIW_)7NPPWjmw`JXg5=z#sFDu?Rxlhb8 zmWv?b++GV0B-JO=g`_m9G}~xPQn-c8Qv(`(hFml3^W*}P?}~AIsqZGBI1@chMvt23 z2NR3GPD)^ghSU0GIcCvKeI}|MM@@tH^-UuYvv{+KPT!AQM{F7xr!5Y~`__e&K3-~|xhb5_ zy-XLc3U4Xpo1vEsT@Z;eNu}wrM4X+~ZB+5}NaCv8bERE9D{>!~iv8Enc0QF94etdc zx^B00M}B7|Z1M|Eb@v7D0^LIT?|J8e9aTaBc%-k!socXC*1n7#f=+fIxXzn54|4Tc z_a?w4gd2z0SaCGbpToz%z6(bKu83j&`D;L~Lw#F+O{d7>?f3U(w0cV}yVEHwBs@Ny z&rHAg;@5KDKi-&5aCh2~08|-|-6ePnL|$2ry59`ZSKwc_^~MmS_yDqSue0T1l=noE zYHZZ);wGqd#d$UqzJ^}Yor|=wi2n37RuGHy{p313&AZt@<=9z=dQdw&bScJP;6;8r zo%J(zB6>lcN&WPrAs3miH{_Z6%J?8te>|HPT)4pu!U8VFI~qJYK+QJ!kDFp z%u_x60jX+P{0@GrX^E8i!db%{rWmTyCi)(V0yPq3U;$)3M}jBYdC$KY4$b2H9|rml zYt8tkHQP$2?R9p3G=qKHWows2(ks<3b;U|iviQrlo61FNky>TknH`4}_uP-D&L;1{p*jiv`G)V~>>nbY zpi>O2=NM~kzH#^Oi2VA^G$ZfY#YISH6JG$=1j)3ipY8q6kHi978?6#kuG$@`} z^(^#b64O&G&neV+{4492%ey3LM4OC+n80(ZW)m-Tzv}vA;_5HojBK(+Hc@m8#@>9V z8{V{TfQ+CiVuW^6L0*Bbx5g)i%BdP(%T=Oe;79|p%85J*1l%P+YE)X zVFk5@$ErMC#r)aPK`Ma)!qsM+hqu6t`o{~$vb&gB1YSfJg+??Vvx;@NZ~TI~+oyY8 z#28owZ)Rj{K&QC1X;nuaI|2fsc}!Rp1AgpE(!pf5V+ljf4@j8us;NP9(Uk4}dHT77 zvK(A7v$TeryZFi(t&JC0YJydw)1X=j)9 zn6MyX#^jlF882YCci$mX<5G2Jbjv6A3KqyA#GCCp-gUInQ>;1ea4@oJ2Wz%l5INQOqW$>6qOpo`{>E`PF}13`C>$I!EI5uJvP;Q`frr#{{z@M9Ny&9nQqq;T3!!eb9pS zI)qG0>Y_`O;BRa*;AL?8-3GrqME9w4sX@o?`Jtw0it$NU4dhZ|FxRlu_)MPP*2JnC z&pRkT&RqH@L{9o`rWoXx4E3m`@f&>l=GvWt`3yOqEgZ3rA$9`XQ6doxV+t&rIDOMW zm_%@SIh-14*4VMtmgkS8vK0-pKH8oAT1|5L62dzo$QzoVeNqdyBVhA@An#hff|pxx z5e8umb+`}iiD>I-N0OGm&z8o1{{OM{mQhiLjk>TPAR#TykOI;o(kb0YcL>tWFhheh zNK3;264Kq>p#nqq&@ps(p7Gt^S>M`wpPww?56?X}*K;L-{E&)KZbsHL>~BdUw$e`| zDHOQ1f4eikg$1frBYT8@F*t41{mNx9B@)lGqG*#N`SnllVmcH@=75WbEgm{{u~e{$ z*~$d;mkVv25;ES@E;>eoXTsR49K{n!!e2l)_Ue026B z9(+kvI9G`9BVCC1W43(P?}@1KtR1w51y?Rzndcd2E?jt=TfQORy9)^C(Cl;sB$0#Q zM`kSoky-nZ{FBL0wHng8LvD*A73 zlcTN*2fxv;sk`Qru-#Ug&*8omm@c_X4{5Z5lDQ5K)qd@RF5$PJw)5?MVRw=Ze_X-m zFQvGt$v06MqP~A0tDsYLs-@XcH=lo@Uu%<|i%8w;e~qx?J*pl5i+Ztt+`$)oE?2wU z;w!tnl6Kd=BrDqL{gUM#aWmh{Vub6SnaFYg{)1EhFaG?m>rEV!P;T6bY-Nc;@m1wg zKFX7Sa+2=W1h)yPLu|8r&{e-WdZe5v3zdADUa(m-{=rUt7OH^UE1@Wj8n0xUzrV2$ ztkgy*4%X{4rAb8ebuInY7|k$(Oa>e#&I z!VPAj$geU<;hN0g!rF7PU~%kPv`IP9S9WO_vK!W$Pj-;dYyUp9xHnXgP~$bX`a@Sw zKjy;w73W>F_TILqfQbPz&)h(3>uTqcH-}AZW613TD$a#-wugxtZm8qxtqxodV)C~- zJ3g?#Z$M}+`l~j=+odW28t<{_(ra4hO~FpJ=8PPeECmND`e5_G*rR- z;l+wKU$ZofF7K9nVF^g87MrPq0S%L;3o7DlUA}d#TyMK`UBSAgiU?7Ne(4igpsLue z_gZ@?_vma(uv7;5VdL1NY-yDWHWWQ&7QAQNMB>kBv8n3{{cp&F$m= z6^n0Kg0jDN*CoIEmPuk)BT2uF3j@q1s9)%zp{De(s_@ObvMIs5jzU$}jMN!Li`Tg$!p4vf+n?Vf2hkUJ&RX|bqOQx-cAb72 zYPYO#4Pg3eGG-?Fw524B4ZnSU*GaNll*JG{kQn6#{5Cas_vZW0gk~pofR+B~ZXspc zg-h$!n=Ge#^m=9Ee4IvBi%#4q(e3N5Y}LVWu1Qkh3FR$L?5}Q-qfv-2tNS*hA=lq3 zrFIfB!1?JHZF{AUK#TJl9pWuGyq}x);$5K+Hr9C?_4DS1H^OL`gP7ut7hot&Qx{W|Axt>qsxO}#p|G_#xD{6DrUh^aN3yWwo+Xzt5g zz@(VR@MP0)faEK!%qX%C>KRtq1?khJWQXZGaU8dZof@0NQ0(t^3myd}4?hZ?P5@ibq)0kCN-^Fp$d+o?FT7%r zwTHRqrAC{bF#6Y4(7uJ!dMc>R-;1=8;#c$1H8S-j5j=L3i#^41peZvFIXfC6`||?j zL{rz}j>o#^u1`VZV)xeuk&BMc$BfU4;=V=Blnu*v+X|;Hr-_NW1Y2Ac2(n}{O0Ra> zH~gOT{CQGUR7IJb?*j_wb_4AI>jyD9__)w&}>mRLPvq%r%`dVe=GkA?I< zLGIBTWafgtori0!^kcU=`CKQkMB(j0fvJq z(x^D`N$}|exd~OX3?c4-XL#6ChjUPRS*yfMT}@GJ1NGxRri0iq0mB|R{_IK=ES1s4 zoLc`LZP3rcWrSLISx)1}w;R{k+jM3*pmz@teJ}e}JW^=p4v?^U(i81ECjGr^B z>q0g5V_1nImK>3)SKPx4k>C2BP!p?(Hq(X**2tX#h)-zyk1yzt;88&RKjyPvEHPaS zmOv@kIr$txr%Hm9vOwK;^|`KId`MqP%em?nrm`x4fgwUBHNVkwbz1jxhUVEDtJ@7H zFLe@4$9*U_bp1sF3M|44`IIG;{0FhoYHtiV&Tq3U)OM^6Qr#nFLG~8-d-J-3_2em{ z&~i>AOAM^rZAu_|&XvrPX5gRvBQ5ko<3+z|$)b?+z|Zzw(ROulldtwqE(Q0`o;V%> zvGu-q_w#>FDS>r_N*n^zPB5n}z2A1kN_VcuQ5#m?hkCP*-?<>$@EtyQty}v2bfA0` zTwAzuXL4l@c!`#z>ldGGah>kLu?%xbf`2o;3)N7|cnO3hKtE1 zRNZfj0;;4S(UhiITJr0{WuL5-I-2tww(hUv?29o(vli@;@%a3idu-_Sk>qI-Q^0TL zOmV6iFSmxOiU1rLh_?<)e4cF&z`2JoJoD&>o^Jl(z9Avhbewl!TbZA%$D-xzej<<% zr=UfZjpW=HS5_(izGF7=h+)60k?eTY) zK8i|aChy?qeV-i1;j*oxsY4T8O;jc#fL$`Dc4;9LQjlVNRIEPv>9q}0sua0KcreXs zaeuDp;X>}>cLfsZ3|^-kFlXB)EtSMVYk*{!XMWN&D1Q60zHxaxW55*&3+2^oDhaIZ zVcuXa{w9kdUX{{&79RgH46L&lwMxE~4|~F&yVqh0hQx&I;1m91c|Z4`f??%Q@RXm=x*yiy}eK!CrL z`2PC$&;!h7>j}%h^ z;*Qhc3#B8o#=AMe&hks8cq;W?9qr|x?Y0jD*j_~aa^wU}7*&0nY}~ikJOTEvoX+vY z?&HS16!5LeG$qK@^zCF%$9b>w=fz1q<4+$QXO+WA2G^C*F-d0dNh>1 zB@fo5oCA|awgb*nDJ?8 zn2QA`;{DX||IIKFoa(|DNrsP@a5+uWS@>CJ%O>aVNW8HlT0J~m?BIV3LaMiU4)ko) z9|VOgZmAM>x+q>p2a$1G%1s#!=W#6~;lD@rIbt<2F26r}rDEa1+2w12-A4VIiWg#e zPHAsx$!N7~=(9<^EB=Cr)^H)tjB4^zQKf(GCAUt?=)Q0RNzG(I3a39q(&` z^7Ytm{r;eXX@O1CpXPGu(Hp{fk=AGfJ1fsXU{(_!Rl_iND{)o;Bj5=2ssP2qzV2Pk3UtpL5a9zh2B3y(EuQU8y5J*~tTz{ZUj zQOoN-O?@^`vDR-Oi+FQO70yy~S}f2^Z9CefJCDAbziTarO2O+GLartGV3+dB0u77dcaT!zl1*(q1}h z1S4+~EL0U&&4N|@dGPD-deLg{3X0=Hu`*YvE&(j=ie%&WABneiC?6c_kOtNJsEA!{ zs=s#c)Y-ytEnTZ2f1plxJ^&s{|4wI2NY&+cZsn?uiaD!xolbN3xG{u9FS6Eov|$(^ zk$K}M(K&Mh7c|(vt2sROXsa(42yKpQCgS1#B9ejMu`I+h_lq+dT;DG!qmF3-voS|2FH~1YmY(P0YZ>d;!!7O zFDai<2^VySl(UB!E8NHc{%Iclfi+P>=qzbpkK&`D0cvau_OQD?TUyw0Efn_D>%*QY zsTLEbdgfy-qGPm@ZP5m-Q5wAdCY4cn4zPdqj78z9@Fp`NSvE0YapD{aS{@D znvyn|7@iLvAuq8B2d0bNzD98C(DKsJPD-b6hSQMK*$vUcTd~ofGo$={-*3$7<`Y!$ zrC0?edMUF*XueIF{mEKtshXT6%+Cb5k%eQ@Cie-%QVBqapFU(5AIur^Nw*sxOX6{- zz3d^a)pb4j=6A6O%hqZUH9CsWc1Y6Yj?x$huU`qeyJD!Rp)DE-wu_I}J4$!c;&eEZ z`;=S)5y!;dQaMeE+wbnvuL|jQY9`ej{5%M)!A`7JreX@m zUalx7t+Chnk{{wX=|*f4I&{Pc@?QVnE`W`lrP@|mp@1lgXsMbE>fGaR0Saspr`O*5 z$~;H5jGty6P&AmPq{d?Ej;x)|*VU^FlS`DZ zxGjc@{^~w=rPa9=6WH=?i=sQk0>nOfpzZV6=0eF3gHRw}Z2sAGUnDg|!}g+W>T#X! zS+sFwk>}NY9f=Rqhy*gQKZ;Bg?1HJ{@0a^kU%C-emwdwiduca zhfsss`gf}r`TKu(nJBQ+Zr)czhNiK1zwVcHD!rPEz;gZJ#|DD{D|^?RID}FT&93E9 zg5PzD#$}y_2<3lpB6^+2cp%&yoykP2eY+#hcFB6+Dx#4D@jrmDjtq{k>l~=-Ev9wU z^I_poJb8wIYvXXu$^Yb*$Zt`ms@8t9LT=@y`|Ko@CTANzvetJiI2+_)1M?d^4e;R@ z@)#bv4FR*%ke*QrRj(P&Xh$&4sJEc1pV2w+=jw*iq#Mv?(w-a)*%+}t9^q+FS%tMt zANc4+YsmH@X$*!z6mBpQgsAQeJw>~%2Kkntp2S$RJOXqSSi^o+vWn-rw6-G-HSt(q zVJ)2P!DC?KUl*D%W^2joA*i9cikF;)-?wI>j}a>KFA|>Cfs(gm>ynV-O`&F$e*YX5L@OtE&Z}rDkPL6F)#!et~DtDhEqNvEc z{%rKaR1aJJ!)<`u#XBJ+dYTDdtorIolL&O%AAP`ZS9JbT4p7V8I@v)yr%R4SCEeP^ z2NNd1Am(GN?W2o4h8gYmM~FsWuRPyamrt(rqI0`%Vt>3Bhj@nEba|${esY%c^VOA~yOH_xVbJ##GRg+;T!s^OCwHfhI1`A;B)UF2_RL;L zMOuCgUwSdA>o<0`n9INd;8+MWFolx{lA35&8a`wYpmlqmWkjrK+`|`&rp6H*jI>L? z#k|vbF~TcrOR-zreR~s;AS%>R{QUtgSeOW_ogH_Kt;kHm(~KpegQj>G#^YC5vBbIT zcU%ytxM=9Lr3M&9d3C_F1fZW*F=r==xh=;^MT`qBb`2dTZq%Rd<;9BkaDfXh=u-q( z;aFasw+(8W=c=L~Dwx6RE%i2+Q7*!92rzv01p$U{#`0IBecIhuIc~!Wi{&U`}3vmvoY6~V=H|DiRWisGe+#Xb{HF$m0B=Sy={#+s&(iq;zhYJnbbdHqLUONs#;4yEf&VEBIXG}*Z+xeh=uM35RvAKI6<$SIAH18^T ztS9NA<#1fQnCx*LB4za6@0~`z^QV$8cWao-FA>~2!KGL4>1|_op0ds7=Z?R>1VpG? zeQrM#Vy#FWUr>v4>6jG_lx#Vw>@);b%|}op?d)7X(L9}wzQe@ERudEN@zysBXhCrH zx){8t<|X%~GoLR@waR}L|; z=deUZ2mOU+JHBU{KbQ2h!|?y8DFKVp;(b3FBik-m|NRg6A8@?!`wPVp_g1K^`h+7-bOrtENRKD3cmXW z)Z;d&%FrcfrIi8bPcT&Jd(3R1Sr;Eo7R)mc5Q&rG)H&ZAYV$*eq4~A3{gVfi6;Cy1 zbMCXls|Z;p^J@5b(f8-j^K8o6+84Lf$<`VBRac9E-drv8Bz5>dYsT)MWOi735MHHX zp-QOtd{4jP>&B|=0u>z#+ElWs&TQI;aqK$3Z5zY`EA_kTZC8%!j@oEmR$2(}ANQktsF35XJZ9fEAAOlt0?;H0WTN zs5>d1AYS8xF({s*854?$)78=H|im^)iX##$z5~s%f+Uzw#9op3Dl+Bmuv5*2rJmIx<={y_uWJ=Mm zc@nL%V?=W&o{&9#d!bT)esQv-tn2d!%}h+zY$nljPRNS-`+NziZ;JHy74Y_ z^_q_M>6hpYM;~ogq<;3edCyn<_DWVpYHTdvr5ir+-h)Nis~R(KL@?po?YWi%ajYB?{VhO%U6kv;76UhFVh}fH z71Q|YiRGVNWS|rK!pa6ntvd*pX)3eh`#QWusu4h7F-6KMtUH3|vv;=5EBfRXwf^nw zHZmzUR5_gteh$s3Ed2X%bNh6t1#w-ub0Fa>E;r9=LzVsqjetb!%tvVI-`-`$+v?-s z+H#Q-62o>Dz&ca@owvDHxX*nDD=>lXpa{JiA4UAR>O(1iq2CPiSK1eX!z_QvgpGk+ z^O4Uc1?r8In{8uw`sq=)2zASjpu)W9={43-S$qnG#G*EL1F#Cs4XrP@)p&UC{t-ZRf@(3TD6)Oi2DRdT~ozw6epM zC${!YA!zgqec#JxCSdTmF7eG5SR{XaouACerLR#~?KYoEm~r^Q_A)$U(fa4*dq03K z_2-Etd=HbHjH%VwA%#TW^d-H*YP@@wg!8fryGCKBbfB41$&u`w$T>~x3;MVT?{}lG zF8KjB4XhYb8K~D`x1e~dsrxF=&*mKdVnNg?6oGleA`2)KVv&*B1;c@=XSDxi2|ONLKA)QgiVDX_?kS?J~dl~?TvzPT*9d!M(rc~VBft^Vr6 zjETa}_F*4x)<4%(rhX}UT$Q%V^ZqkVb8^|S_Y?eoZfgrz-KEWCF)QoVI1S3zh1`(3 z2?pLiq^kp3w-g%Y6ZK-}Rs63EQ& zpuafyB9V1NHDOwJqR5@MzT`>#=4LK0n%Q8c%=X?3vLQlYQdGEgDvt8KE^Y?h4Ymzl zz0jz0{&LPyU!ftsj&)-)*Nj{2dg(dxe95PUcJy;KP7}iKsZJDdL)^2J-!r_Bz5hC; z1)>X7?Yqh-_l!*)4*W|Id-xkIZbtJk|f` ztJK`S-aPMrLbH^@D~vHd@H+;HJ`g=l*fJAe8> zpoyTq_flB`9d?LvLb+Bujy(j&aqfnn)je?HJeEC@=%Kz6c=A`Y)V8RtApr(Y=7ttEYdgCgxhjBTE@BecVVN&k?;{M;Dz_gSLP|Q2ss${Ib%b9 zBP)oI$?#xp*dDv>mG3~zriW9?e=r~n2bnIp4KVdf^?xd32$Xokhwf1_=W_s}#|m+) zEc zvDK|ixSE^4P~!FM+?;-297>CsY7!}3@c zuLQ|l&_lm&TqZ$vrnJjaqabYk{Ulq_n{t>bXc6*fAzUuOOmNIg#vGbNe$X+;SlAke zwp+XACzRGd5T3`F!_yE{X6taE^fvkAJ{UY2Omi_BX2=X>J@=^&3<;Um(~R~+240b> z03DTMeUpiLL9-?WSSqg+s>pR&0`=$7f0au{oSj+FZb!Y#%BwtYOV&+yvGbO9Ft?v% z$LTCOxB2s~<$73p%buba{t~~ASQFWh37?8TRU|{HGdbLVZ1-kJ z*(sjYN~KX!4(oBS1!PMtr7VY7lMD`<$MOIfgkX`>fGl5QVg0&4YEJFRxCwNpDO3nfMMwSwnAQ6x z;IR`%Mfcg4GLQzHk=7J&_w<5Z`F?DT9)lAdTgZKHXS;@QrwNp;Yq`p~eb`4Jhjfb& zA|_V9^x80DmETqMGWHefn48<2eGI#|_67@mDBR<1v@>35vnX8%_O`vUpC1mhpGEw? zlS{b0TRdK9(96|T3v8tgu6>FbZ0P=abOB$MFDW&6Y`gnAEetJsmr`2oDK=BT+S9VK za)?F3!SdzR-ls0UwMZ_7+ta1&mj-Z1`(YWi?be*+brTz->3 zyd5c2kzu>2xwb&9noin{uR#$#ZdgJFNIOjC=?YhGB~avctk@V5tS}#SG!of66_r?5x7D_{hdub1^F~SF z8BQj8-tD~*I?cK>ce=6H&X9Uc*7VD+`)%KWhbLAzkoMtVssm7XCi?ez2KZpdX{0Im z6qV8M@jP*PnsrOm>FzK5@KVtG3bIG&yH;DwDeNXx^X8vUl>ZR{_6k0#*{J?6tcS1x z5+cp=S^gmN(Np-NYXVo;yGKMW{;XQCdtRg;X^aet!Eb|MoLy zd$c~TK5KYTS&nq{%;R!HdxURW(ly9GQNsuI{BJa_#m}n)zlJNs%vB_7^PU^>w6JeP zOO;)|3N9pKv=&Ebq#w~RlnIc?pHH1k*(dFCjFC=Viff-mw~55ZlWcF~P8JpLh$ddj zUZzKFs>qmAk6kom^w*4|75;EMcz531W8GDu3*z)~*%XZCz?UbC?I&BGNbzw_krJBC zB*B@@h^9)260Za%*dL&EU*o`J%j08(W-4M3hj&3+!Tuh2{C1k!5#Qeu&p%toq&a<1 zF9U$rj=G(r;1&Q zZcbfVx|lk0@&PZExene43b1Li-=c-hyQx>B^V@f!I{3mE5)4CC8agF`M7!%*ksQDJQ7p-e_Nheb9cjk#1y z>BlB*u~Lg|OeY_uuiqah9ME7~o0|4}OYN6)*>>>oVY+yNIWnRLpYO?LaS4YljxH|e z=Ik0T-mIaZ%YJam0U#!B?J&jKR~A2DwSL;;)But3zhPvYkZOiCyH->Dgu{XwPNeI2 z+I}I|CHI2O%&1$>o(?8eq?{jalZ_Y<19G1bO(g2d;{3N}jZ_M30_JD2GG43i!6K9c z%zvF$1FEDXB-%2D%;g<>Etgi%Z}HQCv^*dz>O;mFVMR{7q3?=2T{%7Qs^%d?&>9bvYQNrW89S$1Q#|vM-k1n1Vs^|T<4k>?#LudHn2j8* z?{sN8tM6+x-WMO+_}qG(Z!0faab&@f?8=@eK{%CH9`lm+foGgxYgNLICvA~JxmaHl z&lGbe58;I~mo1NonpCm7j?04bDzw27wR#02zVXJ}RFFvZ$I6+S8He*ntav-Q@ck8? z7Pc%B_SCj6jvwi?+s4C{66-|#wd!HVp*&G$K4Sy z$6w@xhdXydM~6S|&io4g$5gG(5Fk|K@-5c#|Lxxi?mA>zy=9MzHD~EM@^Rh^GPPnU zBnbU&=N#WRc@2pkB-!A#t$KSWMLje+SWEHq{&`M@hjKE;droE4mOh-6RygSQE0x%c z5&`wwxd@-K;-+ylx>Sm)@pgV3!RPdTS;tpx_W2uV@s1QN5YMDZjX!T(OC(vG07M^N zjlTx-za*J8_D$R&H$kpd!Ia4Qvz50aTC;+%gKtXnLA^~N{i9UK&NbIy+?cFsiGgLxs?Xld-hK-^UE6vI?~b;0G7Yt`y4 zH+y=yJigV=?sR#+ho!SWmz)_{NHT9T&JlNJENhu%f{e`rNN2HwYfN&O^JH~)3iTrY zRXzZdTZ??u&J2MoW)|nv+Mrg9N1CIqTLVq8kUOwuo1CZy!79HV#p~b(gH8}*!!Q+% ztp1O?#P3ywTWA)xT}(SdmkAUB&Otnp40g5j+p`viIG`3tBSY3~?}361oG#LSHl@iI z1;R+{iu-ZZuM7}ETi3X%F_L>LhgB2p!>)7Q7Tk5(!9bVzvXbgA6|oL4KTvOEt7HuD z1YZ)ZWJRJ>r)u;mAbJ$OWGYcR%#j+sTL7W60+s?|o-wpRSIXSrKaMaJe3$C8Iir za$@(698u<<=On;Gr~c~sBdEnSPIAeGutQrVv0Ya<3GrZEg3nW~mUE>}%|hjD21aX( zzdU*cGax&!W3%H3yikJE4d-@WikHXLxj@W%3F5NVbt<< zDQUBz5^;fGFa3WPh?z=2UXjsi)(n!G^iP+|J*_;Jtj15&KGyaII@)FW${t&$g=OOV zpWfSabWRANa?f=1^oorB6D3OK20D4iLn2AE_SEg#%MBV!jXXpzxZ}8j>^ep_l}c^P z!=7p^MoUltJRvpV4ARqhl8j#x>oDYh8?gl+CxG&0Ae!rO>9% zl~*fGDgr%H?>+feC|r;JOO;$zLGaZ_!e15t9}wV337Hrp?3n4+=jc5{2Sv+b{1G{G zL9gE7M2Zo{A@W2bc8cR?9z_N7@UL;XAB*SunUfCJUl+EE4ir1!=lJjn%x7Ye7r3#R zeZtfUw}hUuhRHXXI}WCQ*P%Ywd0o8kX&`~30U@%K6N#*q_Hy(`Nmy7L;b3s|Y`6~^ zL$|=GD#FBZ2Im5zMj|aE;$(cJPUY_6It@x|*FFH6HceaNE6Gq20%Q`(XoF|#5>77` zu1fb{v9);U64QyK?q(Z3z9%$7XXRhj2#$g(V+P1Y% znvjf_SPqUB(CG=BQm-O2bvY?&M_UYgD za$;-P++_XvW0N2piwE1`8|cHzf;EEDN!UjiYQ^DsbQW^$3{lgm>`! zImUp?`I8W+U9A^Qvr`37qW1g+^j(fCdJ2Z?B|n0l(zyWPzkyDF1+r zJT_?syD{&R8WTg}l?HMvfVd3;z zMZelLspQNjL%Tsjuk}hnP+AF(<8Z!pbOdR%!pF6u*2sIt7Xkb9R~)?$@38mMb&qkw zH-2FH9|M41Hgy030tv*!R#wXAb$_bF#88)n|0YfqA|d}~@U^4OQv~MV@>+@49wrBb z3)~^9!qBwJ)%BLVn}J)ei>MYx1}Z{G`L;J47TxEThvcS9BqLc^m;5^sEukJUW$PZp z8;Z%5pDn1os=g}(e8=Xu+T$OEeh1?Nc|uh(g%4e%^)2fa3hOQKI5 zm~jZzSF4P(_dw{l(Vsa^hA8pMLIjA!oSi9qi@gumQO*ti(lG<(LgNN0e_pxaq-+Et z`usS4Yzi7Km5u*E{Vq8Deqv^wXs4;%fvMq9-FUFsRO+RG2%n=Yj9TPu9?Sc1!Rzy#q)|)->+Ht!%F(T!^ z>PjcISbXXkQsv1K=~I3>-n}2X!wZP4#S(&(*$J35tR*)EW@@iB*!r?}hykKEHKzrQ zH$Gm!o6JrLn2|IfnkW14mziqiH?aGdu~CU~(C36Kn;v;qT1cALoKM@Ho)K^bi3~gJ zRMCN)15s6W%lm)hre|eV-WZ#)=NPP}d8Wag9}lF=%vR^1$j0mo98fwn|Nb8(_)n7= z*`E89VTaw`M%SPr`-{l1=&_n+(uL$C)3}qW-(e z^-4`^>4koe4mpcl_Toi62wy$beYud=wP)mky1#0Mz>u8k;>GxYLU>@yFNNgK%Hq!d zx@qiy16NNkUqxRUw5u11BjrWn%J^*ZfVe3SR=-)|9R9e1oA@&$72WER7M`$gKMt2OH0$u5r%E*z-@PRHo2H~= zMNcT1cKCTj)YPnHp_WpK^eHK(@vg(ln|g0Umk}q`6DtRY_$eG>M1-l9$s)i~Ri*MT&rXXzmkUp#3873bk;e zN|tK`eKp~%+i=tA9)EDs0y9Ce&Kfv;=hBio*2;7#R7~$ZzZSr0VH006%CM|xf1d2m zwYo&${-Ze2wpeOyo%3g`#rW^{i`10I>_M+C&JEZi8rC>&`)@F)u9=}On?G|RLJYU#9fj&8R%#;q|46{U1JWKP+YN0KD z3bk;fY`hkcn|p@zzFfs{$+(L8?ra_FUcJE-i@2-{3$FN>ZfSb#0NmhD(=$c|mnoDM zYS#&pv&Bci z;Oa{2u)q24J_1od>KZZah$}xq{7R{mF$M5nIDtUSSFW-1MYEkaji&Iaigw+;^VJf? zk8^#ke8;RE4|Kl6Y&5PYXz$70=N=<@2g7~uvA(Eacc>`yAM&DjyhrPAZf~89Ctrjq z{M_JejGq!jF(6}St~;+DGR7ARc05GnzPHg0QHc||^8XIwBV5ytO*s9j=8B?LQa@+) zw64}-J2y^e-a>b16TGcu{dlcvzL5sl=>$~f@p095UaK$=@7egywVd-=vtwP(oVGXg zF|R5|kFrv#-5*6VBRT|#3%4`og;%r;f%46bxqvC((OtUc-I^hzQ}RW;*su6- z8e)rucIRjs%(_U8woZcVgsl6u1>Klz6Wa69C>tdFRn=ag}g_hLs*7_9` zE(pu&S9u~zs=orZyP zsn1V+P!g16ofAS)(L3porE|@T$p9A=YE^Pu`)A2e660>tp>jBFauHi!xb!*1t~9gs zKhCt*t7Rt9j6$u5aMtbL->KfP^*~@I)L4CN^6`?D*&=V!SuaFXTC*{pmEE`S>hN^{ z*evR$NOD}4Qx7z}5ubd|e8$4;@?=cD*US&c4$X83;d|YPP?CaWuyHOZDQ}O>c|qAS(u)oLtSHQe={l@8+qECSJ`xvjCwZvnxLC>My7K>2cZ3^& zRaR{&nGKPf#Y65Oc>jFDJVSSMRgcZg^k0^tXPf}H-3fd{#-S8WPUw$k9M@gx|Hs>z z<4dFzKuB!n;vaB_DO26xhWYE$b!XzRE|F4ttdW|U3_V|B%_lDyZC{{AHD#n=Sx&#^ zgGjWbfH`~DBA+hdq?K%$mmY4X`db(~w(V|F-4w6?J74cHT7m#`7$Jor9ifp)E7jg% zqW;2e1`Qr%Z-pyf!P-Y!n!V;jmdiS~y}Q3dpr0&Q&%{E2V@s-Nrnb)&ub**WH+5YO zQ_Gysr@1zAvme!HU}$bkG3dPHwR0ADIT@>G8j->?Q5$4zMeKP;h=;T$)LIUA{Jam$ zY8%(Cl)w)iV~cai!xrk8bHa`)Bx^PB+i1geZUZjoFENZT&v$$7weJ?uM)uL9_SFZy z_{$b3(TX=i`vaH>V1N5Gi{SovoZ9Zr>UDnys?OvWpL>NI59$yc8v`z{mjg1a`GW#J zlU5e$7KOe0Yg4@cRYkV(-cu`RO{}S5JN5T9w((3+m&7E={1?9BlL3)pug0?*3e;X* zA9yOObBCl}Q%s7$drlShY-n4g9~*^qlAcGH)r;9GGOUZTQ-Z=|-oiYYmdnv0>2WNm z04`4R@nIChm1eE>FC5gKs20oX{-6}638oYgI1}(?JOqBHT;W9Gyi}iYe@f}=@07?z zGCy5^#660&ZSJu>_<>raQSzgndvxLII!1?8iGUGbMvWc3_2CKKN@cj$>C~ITc-d@0 ze%7}sU`2NA^J^y6CY3-|_V+>WVI!YwPZ6e3D_ zvN(Kwk@e)f1zM5*8aCkG-rgeBHGQ9o}hOqYt}^Ckc@M-CYpjz&GkV)%^f?WR8mTIP#}lFlCa)lr0X zA`}2A#pHK6l%iJ9EJ+XA<>PA(kauxHOPCY;wro|*grMH&fs-Jm9SG!@}Q!kZ~PVvPH(C$Ux;uF|mVeFv!JkfgG2YV!>gX%hD zQTTP(!l>A7>fVVrGD>>w_OKQw5YR5_H*6(iRC~YPmD7t}*=N=b(bL?0`raVD`tLKc znkumQ_%vYn6%kG5&AR2v6U|*(_Q`{--wl;bOu;A{-YB8cSwgsyUK~Q^XCCGTnSHwn|%=NIa6Qs z`}gV_`9T_$5KP)vX7+#NY}1FfB#MWAmdCKU23TYENmJiXY4C}fvr^|qoWAY zv##Ilw*K24sM7jPaURHa!G`@So_V46rp}UglyH2b&)UB zqsQx8W#Lv)v&H>t9F3|_rF>uT$BjOkHjYINzu+FZGmyfNrAN7r@ORUA*7m-<)b+ML z_%ESj6U6NGh+a{mrgcRNCFNDa)NgU3)JUV%mbA=0UW|@|q)-^o4w8Im24fd7 z&x`RAa5!{Z>KqvsrLjTVL)n3~mvrqEtb&Z~|D-T3r)ghQ1-;;sdWQW77er-u&3>fU z0lNvq$*qff8(12N!?rL_fftwqCAp=k!JMCMr};LvhyKa!6Y0Dm;MT5Pduede%EKm# z=9|&l#_a90ZM*LfQ<{Y;8a9hx-KXSZtS(%zW*(TP!wuuh-r>%0svqGhxkZUlA+C!T zo45^ps)O_9#6b`?&Mg$eWX$SYcFTmv5QBW&97!nQmt%K0NFUcGLtp5=bn4lA4`9^gOXMHaCQ}a{y|rY7ooq(>Cy=EVif|Ag#C$kIKN8* zIi0KmJggm>@z!v3q#~s%PpR#Z!My810%O!DlDCviTfW)-R%*P1QxV?^gUg&AprF4(T_8buxGB9D`m`vx5(bo!_=0GyJgqXLI7f)kunBK zSDQ`(Kl`WEPvjz|Xqn(sF?<|hL$UEE<7{lb3V9U{=bqZuhmE*eauu$2(Ufo}W~?z{ z!E!{yg|i`}KBNMifT}4@IbkuV?Zk3uteAG&WY}~pafQ{|U5!tCJMGSeLASzr>$EGC zCE(DY<-eT!bnbJo0KR&5y1Y37ibApdt(y+$&s6n(NObp1l}0z!3HH!2 z8(++ci^MO7#=P5MmX8s9DyWY0_3!jK0{=v;O#moMB1YOcDv&~wJ!g?f+ZnKgri_$eNO&8jfl8VeX z{9>O7eexU$$XY<_haZz7zlUr!HyC8d;pffhz0E#s6s%Nqhay?=B^_5phwvtGJ>G1! zdrphEK86guLrSCRjM`)IB8i4LmmcPKm?P{!-mGxXDn$c|;^e~fEnR*aXLI72BVX@J z>bj5?u)`^;!8524354gU8v&b&Bb{{~o0hjnU`3Wur|(njqG0Zim}(L^hiu3|OTVaM^s!}{c-Uh-CW3CCxZEeV~+>OGq3 zqoAN5IWouBzAxe6(vw&#=AqsovBPIU2?i?i%gevfABmwV|JF^LrPpk`LwB|3SlQ&) zm7qGPhkP5W6ef5%7++~D&ivJ!!6xT()N7wc>2bC2(>+!hKAS)(0XU6TqDU-O-}(!moxTuI!Ihpwdz#=mmYEY^k7 z!@7dqSrj+8c_(fX8OFwVV&wW~XmQ2giDyKb+=VkkEkIh4Lk z>`dhDyzwyLvKxxW>`);P;(x2Z@x&Yzy)5*OGUJr~zJ7DJdheY1i5tmgB~_e=?qlAF z)U`UnZ|Bf{oI#M#?jB@CMm@Z3FLW)L(EGh@(2xK9UXv!Q0rsfSuD8o(hY|ceAN==& z#Lt1p%xRt@ir)@vK@&Gmc@ow#w`bL|eLa$R`_ikXwhdmA|Lsn2$o@|z$kO2zLi_rn z)8auZ&g#0T!Xn{^$Vdo`WmsYG z--r7zBLu!G91X@2U+`N_`=93U-xlak1N+Zg4^2S`;+iT;OOulSZ8d)BO>JQOZ^>%C z{(rs0vIhxRNgR)W4Y0qj{-5^Y ze-8~T(i;Bn*z*5wXbv2JFfN_MDoaZLs|@{$06?OG{rdbNz0`QM??PI4fL35ePhLK@ zM4M3AB9XpOsH8l>n3K5~0#FnEQ>_!>nL=a?41*?DFJGQSy=MFE?9^@|G_`V_|FBja z&&kP4`9eX){zQ_{n=;i_*A1v4tz)cgiO3l9$0K4!w{t`&=(Bx`W$rtpMPFEBN(oHv z!2xN7W!gtjbKTDY0qNrLbOkn~idm4^5{Xq(!8E!L%TJF&Hd{}kN{)l|)|**Ce;=o$ zP&*;heMZ#=SMY~wC;DVA8{fTdX`qZRkGGjk{vo{pSGN&`<2=r?cy}hBFP`3Tyz%db zK^6sAQ zcV~+EczJod4=cBZ$0p3?G3Jjhosu;V9xKX=l|oWkcmXyhoq6YUgW|VNdo`M~*E7Vs z<7*22&Lf=iwTcpaZ&^?LL;^w(H@I()L5=S%LE(9G&F5#zHG_k*TR>lod-?c5ZmAdV z`j~GO%}L*xbCxVZ9WnJ+xR}$?Ori%emh?b% zx4HXVWhRYtp=$se;UGp8JUON1c9;BW$4K5%f1yf0Xi41m#=iA2Dl9DQ1I8Y25_ETq zX* zEw$Q=jn*ON{$R`pjMon}tP$*rHfqjp{pT29hGJkJ^DK`(fA$~sBZCfN?{T|)sgQr} zIadob{yv{EIMNx9T6u3vP4U;w#76<#iynCk3mri3{Z#}0O%9H=2*biGec*7}vV0%* zETDJJXh@`i``om0!{ZtWFjaeZ@(?ZETr2c#jHPQ!=2BQqYW%cia4a8hfFQ=#zifov zZRbm0?61TAf7?4qc=*g2iFbg)V)5vc%M;XbFV$HQ z&KmkgEdz{7)|^w_d$+)lkR0EOy?irB)R`iUt?JMsmC8|ncwcn=J2-S65{Q{e#I2;=nX!DXL zlNyqKqU9l`<$e+DJQTlWJzsT6^m{{@KjwzdhyZMpaUB%hi$6a5KlnFG2*eMM%1D?` zH-_C9yuDvbHWA~X@@u@ zx>&jY@z7FfL4};*V1|HL%nLf0TDGnrRN9(a^ZEBhB!)$TgfY=&qtfK-;x;K!NQS=K zFoF%I0%EaFmLk-l-?J+-OU{0p9(NiS-iaSX{dK5vDHH!DdtKl4tV>#y@2{W#uZevC zp-SWwRAVm62Drj(2gHw&@KgDzdC*xhUkCa>ry3R#3JYoE$cqq-1_2>CP)DkCheoL? z4gtp|>+NFX-C*ZFhM;V}Hyeb{0rL{>M3JNK0caV{&>uyn(XT8OP>vbQs)S88g7Y9C zAgBu8Xx7u!GX^Ue9+C&NHwFg>ug96e@;W8eC;*!()|hZqXlczbbGBRz{hiYPV;XG- z#4D#ht&4==kG~Gu>M|kM`;vnML$M{BotwlTmhi;C=WB;c#X^;~ud;*42nZHR&p2HU zv4@g25X9fPs(9m29O(2_Y{=J1^EUDs<9+n~tpzO5i#ULV8;@BtfTmed_*>g@qdf-E zJ8vAV_MA!OU|%yuCX2-kuuP+gxx002R_iF>+<~s#gqspR2flJLv&jpAT!0deGky8| z&!XlfFW&YTX+w@%1|#vykjv`{)eGe2Y=T)UBpYs|S^?A#biKVZppj=Tc@@YLk$Pn= z(w?=@uC-(V<;j~GxO?B54lFh{WnIGGuJAc;)?ec4yUtpjf389HrsMGmu*BH&?xX@%ZQ9?HRBfIi* zdt|A;6{GR2bXg)X^t-34)+da;mZG$KpewwBOdZzn z^$vvU^?>PGwQW1ixsH(EHlp_+aM=CL>^=pJLna8NB_+@iB|@LC^BpMzh2Q;Ia ztWc37m#xDmdb5xQxE~D3&j=iwgDIV*m5YF<8oIOdDwwE~;R6bve1#s;s(8=4u1hB$ z>-S5pffl#80L1(5=kQ>$M2AwHr<>;OAGXVp7=SMK{V7xw$!u=EilsL`#8QdoQC;<1 zV;S{xk^$w^YAq2XSIkpOLr?Wd*jSUre9?Gyskkm#<)T(0lj{n`lj*B`FUFcT23Wfi z=(h(-TWGtP(vH}9R#-fRg9n7X805Pg%r3EGI6Z#Mk{dfcJ0i z4Ik`r4Q%BN1}>@~w`59&rhV?2bEy*KHx849I;+lxfv>(RvO;G)3EK*_`eOtFc|Z@G zDz_fV1O_K^yQ8_;gSth*q1~yx3wo)st4QK`9OAP$=X3YPnnC|`pPd_~Vp20zA@5e6 z9!x|;US?(WKu?4UySotc2i^}2=2O;Cx-F@pk8veht;6poy9&gQxGWl@r?7z5ykQ9p z=2^^<>cp`ca4^<8w#AY_3W==HdN1x7r(LP(x6D##eM+|n`fmF4$5NSanHKr^`N`bXm`yQ(`T4=&rH@K0VVX@_JA;9x zJS-h%%G#`HBVXYlW9vl?BoGCan`?S?ZuGwA`!G@?;o4#bQ?6&-jrj_D@ZI?5P4k86 za8z}nH$fC0w})5>Ebo)3O#DS>O4LQoQruLPZn#~pp5qCebUnY%z5;pk+76#BOUtsvJLgumT z!de)RH#f^@8tm0+Q2O`d6GXf3ems1f0Qn}6+c@Ouh9)p1Ap2Dpl+5xKTU?VhZie{1 z8}6r%z5@+z4K=wZt@i@qGPGYj7_hILv?{7aZZfm`LNr%Hhze^*Pw3Icn-saa{Chv# zn(tzZzM6UHB3UGpqIPiF?6wTpymFaiR zwC7fqC6S{E#^whMADD?AqSu92!VXyUgb`H^3cuIypMIZTuR92ZQZW%kPgEMm=RMh_ z&az|6z<_|)aH6*M_QYr>J`t=Sp*}tVxo@O|#ltYT78e;kbO)0%)0O^Mp6~CM^0L*B zgMkgrvdA4w4-)hyx;bS%rMouDBX8eJw8zQ9%caROB>1{2(0?(1WpsOw@+Ce&`uoU! z8$${RlMWlE*3rW0dT9X66m7W`G0l2+G6bD+1O+lxT<8}q`7S)UWIZ=2c%=$jdSyDo z9ztTN=`V1)QiX|m6-|rKUdG5f>e0p+8JUs5N-8bkK`IV)%_po;fGGWjnxNMG%g2eMOkUWD%cV{~)?1zJ& z-AK=b4C$A>NqsHlr!xEmi}|<%!8T#V&dL_Xn5+1TTT(KF#+H_2Bh$JFZ5J~5r|LLn zgWQjPN>1L45AGxx#^j8BL;G-kGcdE!LICd8HzYtW0UyfBF@Z?ghokp>Mtv<=!PpEc zMbcdTsWV~*3#Ri`aIlB-0&a2ZVJ`<_ZJk+QeiP=ujrO~S{%tz=1JH4)?`6R_PZ<(6 zk>N_zG3p}Ub#{=+fN@x=G#EhF2O2SG2($H#=pVqzaiy{>hw z++nSBLXweij{qHcF}++_C_Hw{JNE{wEnERXfdOsM(uI`C5*1D#t|%tQPd~=I(gp6w zv8t7k*Bj>e>5$7&{5@j$`r&TI#0fYplYdA+^t`bmob(kAhkMMhW|Qc~gP8PGp#J(L z`xV~UWwQ`zsRM4o>k1`mRE+Y}Pane_Qq)gZL&}aJBiF(+Nk%5}&tmOv<>0z?gW7QJ z`Z|Xca2k)fhMzgDY-7-J)#LZzaU8Dl4ELk-OP{@992|Dd$0p${?XMFx>YN#To+Z_F zVNE<-709YfbHH`2I%B@XM>3*80H?E|D^GqT1%9?MRgzPgl)|JQ+hY})`muL#1GtkW z6WD8+cke*#K8$(xM^O^rwYVK27SA{M;evBV?}fm@$=BW{vgxufwLcs{vb{6>V)%xD zF7O-DtFF7PcNfO;ueLNqYc{m*<7X@G(m2d*#bIXW<^u62?vC4CoE1d(n6JD129I`W2#^xRmSQ;ru^FN zrIoS$Sofkh?!lh}e>3zCe(e=Y?Q4eozWG?j(O>Hv*_?Nq)VIjUShY{T?m#0Ghp4p8 z^x%IznXISy!iz?$BWg*c4VXRB2L|1AOpbKhVYlOQ78@j}pF@r(Y4Zxke%sgXDuPg;J%*EO!s-*q zP{b%J@A1^}_Mt}jb=FhXH+hj`9Dk4&ocucR4%a7b>t9U`C@IjKa;mmBbvZ~DNCg9snKlULq* zi4Is%KLL9oYL17T#9rJkj5n;x5zxykTPr@Q3ZP%2mb&y~Qls~32Y9*{AwpybttJ|H zhx(&PVo8#bF#K3tA}ZtN8s`%A$t1xfW2mzG*s{Rhew{VGjZP+cs*qUfj`xYG(7OZ2IZb!&pJOf{?=|O#Ol=J$ocmXI{nu-D*k}n@Hf* zbJnqT&lj88zh1FHFc_ny)HHlZ2RY~ejOBXjn8SukJDoZnJ5B=uu4=RqEG{k{rO+Qs z{hD6&6qIOS#w>CT**$MP12Tb9p~-(-BBzDR^`2kv+a#EHLgdSZr1IEIpJo`kf{hDdt-=SEZ3YdNLO$2Bx7wiCB8G9 zTKx3ohN9gut5vaurr1bAj z&I9PtN;2NvxaEoYZGMqcwOLgg8roGtdmes5cc&ZCi#ydIg2PIbQ51GxD6+UK-z=*F z?8%t-&3aXY2em5I9Xuk2cOc3zjRy1aUZH)W@Mg-lgr<~fzj$>4lSOSfT`u52DI zJmayl9Cc~}It6kJ(v27Q-aqUt{sb7ynk^3o_ngah7EFiBDWy0E{wj5-!?%4RQ3T!q zjuhb|2YPPLv4;aiwyor8NB-Oj42tLaqW%zk1=3upQJ*JMuUt}FQW*GBt~z_9=&7{n z$W`ejSfz@Gyu7jaHw9P~YFI3AU9uIwP5|3hDuv5N1A^j|)RQe)9r!IhzQMXa4V_&9 zVdiNlij^*oj+R!$d`l~)N(L(k9FF5)`Anmq0tCJOI4+pp+h!HNkLJ!JEd;~Qbuzl; z$t?vYY{6kY3MOuyM~eD>?%*KC*x$tIBz}|{?($Nn|LDVwbV!6kRF4-Eg6P2RZxDWY+63&AhK6-IXz8)t$w)f0fA!6iszEsA?D)Ztt15@*41HTzK(Xg zS5?!CSuc9WQT(mA5x(m@25o1*%VZbU{D6`ho28vdM!YsoX5-MO=gS0L#!vM>J_Wx{ ze+d^cAwE#tCp=_mwSA4@L}yMQ90EE!NVTA}*KG$=kjscm`ys6R1unEz*_%*_LvE;? z2_16F6ed*<=Us*dkt=gJ{3I?5R=1M_3x>;FZllF%d<+0LOri1y-%E?Ab}f|8luw}P zD<$by>YsKJi7sRB&t-URdLij!wW^K_HgbkiMQe*J4Ntg0aKlC`+>0Sc&UW$fUs^u~ zAn6Wz_swA4Gw`>dIec-95)(JYE}koss}9GC^f)nm%_c}s4Ew6Rf%%AIbSYT>&#?FB z9RCJCzQgKOke&Xw`O3#p{&+3(s!LxqYs@J$TJ59^o~u?m)yCP+tLWjL$`$0?Ii|YFHUxIlt4wtqub?sK(L}6I+!w9rOEgW{~7YnU#HW;2Yml2 zs+<8glshqA!Utlyd#kX8MTqv(mFWJP+&!1s**;!_g5iDoEeL^_l3B_T_R7#`#it~v zlVZi-yeh4+s)GK9&5-7({Qe;SouPw$7{4IN4%Jp=V71^|bv{)o1>~YDb^BoR7lMuN z%8#qA7Ofi6Xhy@&V6)h(av<9zkVjDom?cccV35}r6b40N=brMhh0BaFm>tsfAM8j5 z@5*NzqYQkw@D=zu>c8W(zxwUo01#h?wh60f&3eu}t*hGgsIY-)^Jw14y_)^kDYtKn z+d2WU8{1rjn94kX^^kI4wzjrS3sSNun5WlG7xm<34O+7-({tpHN@8@BvJ$lXG3bpuf{L0AqLU2b`svQCym@6vckStIFq=HbiKK zJ(E~Q2i1D}`nts*DUI#kpz20cGVGd96{(E-su90=V@S+Ao&VK<+=qm_SC{CqXKnnw zj`2D8z|2ImU;Ak@i`6ATGBP)g8e$0PY$-2_X0LnGQ3AfAp<43hsJ$(pj4_Tv

x|V8l99BH`CfU>K7!K2Uj?g zhDMVr>_&Jo{0&WX`8XeEVyY?$BvTNRc2r2toVQTDyizuk3M6sFdNhF;neBm;Vj(qO zM+8gPjfj{i|9Kt&N^)hpps@;bDucP{vCprsMIg=QoOnVcZq${)53^(~kaN^^7W%SP z9(D=V9PQX#za^nV9A*Ph|7NLJxz&fQ)`Vbh1??v+``vZL{X1n!B==51t0fg>ec_IDM z@#9RSAA;?ZOj&y;X1>I8jSOYpWbHnP(9~Xh&O>^NnDdZkqqznbENc?eklf&Hi^ z8U~JcjZiVaC{BJa<8a>gG4~i!tBXWF#?j=iC{{pNDRy5F&;yP6X5PR`S@o*K){(}0 z)g7d-ZLQaQp#7AYoJ^%cBz5ArzRt?XvkLeQ+&g0gLjXb4Uz^h-|VuFFI9pRCzd*MCyNA{sEUp7qc8smqwsaXjd#I?=H}+4 zc`#aG*!}ZQAn`mwnd(1&5*lwPcG;kNnya`2y2uop3v2rOe~u8l4-*uQBd$B_t9+YK zuN@89A}>gMTdeuu?A)ViS6~F9coXP&k4Bjzw$-tB7HcN$!&jZ#SCbXIKlz0w<#0iY z<7>x8fAD;j=>e17e)qg&QnR?0R01!&PwFYT*+O|L(0#ll1j#A!adMTzJ^6Nq+xDUx zXNgLz35Xea^;ovNPtx?-XnqR7|Fny&if#9-Mc`h+kRM^(F-4zB7LAd=i0VCeF0>=G zOHG7)x3bT}F|<1TAY}A3Cilgz8)k>^)9KBq9pZiO^DwOdvbtn!98v<-y{z%}v#h8# z&|$7@@f%M2Q%VfISpaqwD6L7vXIrlZ@;D*69k%ZEE)IR_Aj}YdLCx`sdAd}+RllQy%tOei*d$r@rW=@N`uW8Fk$r5GYHWS%P_>*_0&_ZPZH&C+GN0b`!#y zD4@d2Bt@+Srty(%0}+!oD>0KKXOq3OHbyJ+HW0$nky><=dPMr6+k6bv9{5Z>r;C5k zB4IXDqH7w@IYEC(9>q-)eMup@MYD_#N0)To1JX~GQ|XS1Swi0;Dh|i6uB$rU{k7iM zVsEkl@!|N6193D?*sqI^>Hg8NuCf1_(o(ky0SXds=Be_@aX_WDD;mWTA5q~Osjh>y z=%9`+<+G(uZA7q!!2N^$FV_>ATMvbbxnokC>B2#51># z`anq>H@G!)Prfj0GyKL2=0S(X8>DNS*MmNr33nAHlJjXs5q5OlkAp>dylXaGm7yql zK}|F@cvmso`mt+Dm$W_NqKhTlv(&)YN=>bEOXhQO>0H30H#+ESfHs$pj&UQez#7&# z`{iw!jatDgY1M;$BjGq~`V*D{o4cHGU%Z?#Y5?!fopsXRegc(k-GAckkE10ExaNq` z?hD)y{Z3v~sI=dc=}O~5ldlcyd^(#L4PA;%1%(S+_Y|YHIynJ4lt4ta5P8!V$_v+P zs=RFdpL+9CMtSgsUMdG@w?{FA7-(WbKzs}|BE1o$UtYKzUL&hKk24;|$ONbtN)Q5( zh2!DO7etm15TPm3{PGN4JtU)80#Mug^wW4VTUaZu>chxc8rLk$hYPWZ`}}3^!o6GO z8tr0O@xQff2UQBzv#^H8*7-(RLM9g||KwQlAt1AW1s+&4s&TqCchAUhEceb2f$kt6 z*pWG=k4K5bd)BwH8e{emSUP|(j$UKAw6V8N>i`!IEkyXgobd+z^5GP`}gWKiR|t5Cf^cWJW1G!(SyJ{|aTsQF+?*<^=Pe z|5^n4m*Mg-p#fiJ@&L8E{mbY7%^Ci6&_70yMdj()R~0M``j;8~b$I_KgkGl9z?V%Q zUwk|NHJ|#|5eTb2dmd?omHy(V)%m{}|ExOj<=K1KFFSwRj9(ghSj{sK;t8gAuzzgr ze+M}K`l5<@;LCDOpqZJvq?Qu~s*SJ1zJ2>9n;-BWx;v_^((pA<8KiCRP+ne+jDjOU zOIvPG+b4>0(?pn=F>W{1J({k?q;yOWV zycef0YJ1`LLw#2G(h#ZtlOCPdjnO^(m0w&(~3_*(o>ZXw=lx%lG%Er z$n`;{L7r@Pz7Rr1MFnGW>)D7$3{~zC$pe3ADu>LK6gGFv?fHF}sj2BC@UA3Ihm=h! zRdJ8u_(DZHJFE2PsjlLj4Gx4BG&FWD#?Xni=9$As9>U9?ZxU`j7MQCG*zTy+8~8OE zuF_m@PRHgp#3t+x*>D1)&s|@z)Y+VHKaG#bdC0-uGzh`r2`(=0kuOOZJ{(Gv7_J+( zt@D=sqSR~F^E3c-ARebEP)8E*N2J*0Npbg;iKp27_w=FX*qJe0z`oHjhzx;fgf@HCckkVsY<8rtsu06SB% zoL1WXIX1BwxJYpX0^T*3OD93Rm{5&DOx0WoN%dixC5hJgcN?>CO#|db549YRz8W3sG{nGdtiO z?+}Bb$3%P61)h`?+~^%n9V|OB&r1b=E#u`(U~`JN&qtTmZ04f;DVfLLKscf=J@%&MhHiuN z6#Qx@wfm}^A6?qtF)Dw*Q*$~K+*D7vo#l$VyCnaaCh%uW3aD{xY<0uLE_Bg@x$)TL`ous5!f0un0FdToqM zL`0PBEDEfr@P+o*m%ru!O4acXCIyHkPm(2Z^iYWpcszk6O~3jAyI;9QJsMp&BjB4w zC|@dRhQz7&Fr-Ovop$GRu^Zuw>hMzPXkrScFY zt0>18L`+QbO59VH_2V&JpbFS7^5KZxGA!o4ad7?d{P0>%kC7pUQMNHvE_WoaJph}M zb+ZuBSbAfD+t9ylOwtC+Fw4op}ux?_prP9fU_e`Iv@aAqVa`E~) z7kzSuk^}}6OHg&Ec-NIO>iXn{wnsesK;J|BlNagD0g0wi8qP5cnehFq{nS>+U&J7e zHt!%LfUUShCR2~gc{r_<{Y0(Nl0mKe{10!4jYH(n_78my^0PR*{m zPW9+pTnsKMF3NYCXZnIce{gVMH)oAn2-w4j;$oa?quC^EZ0z+%v>iFtXUoT1Cd$?J zIGl*Qi0|L80##evMb25=hHwL@V(sPqp zwu)0OFd!2_m>N*mD?-COTLY*=ix&R8;h->ZkM?*LOs_pVj z)QPrx)ntt;7gcZQ|G;Qf|twCKQh| zkXY(I#CmI(s8%TGBr%()Io0a}Z3?^lw~rj^%PE{)=tGvIi8DQZ*KTo~4qOL_sj;Ch zR}7G(8*p@|^x8WYnK=KX7XQ8HP3q4(8wY6|?;EcU^C#X|x24*zwte~}7BgO}D})6b zx31mKl?oRo!BnhKjPy3Y3g_xV3AxS*S|W}?rO{-rMi=dYI460b;(f5>GjIs`kUR4X z7>+n@7gVZOJhpaamkS)y#g@7R#cAiuQvm}2WNi$A@ z7YT~q;5zC9hs{=$Yq~0mxC1`zG4yZBX&v>OAJ zkxb^!n{`FH4|BFiMAzDOlA||G!_NnLZ>E?Kl$cO}Y5(h2Wk!7I{GR33NcR*1CD!Xu zyswVor!xyqw)c((5Stm}uL{&)!ZagBq zYF)nY`0h5Ur6Pl6XRVHp5iwbvlZt5F2TA+45@+yJh$i(9z*~q9Jo)8j z@)o-%Pm^w-*Qwo)Gl6@Uatibd59|ptvvPBDIku>D8q9RP(wZjv`b4Hz{bbHTb?9&D z@!>ye{aVxzMg>L*7sugri_GbG?SHuFf$za0Cw1rWC*x|I`DU#p=63EZYBRnF{Ey?!Pp!_CaH zP2a)}X*GOU3RmsXLbgHd?sPVNGE1G7rcki4g3-9c^5{6YO?6{8-A{!S1e1k+GdW^e z%&-N){sIn5GE`vn4FqDyjq%66G_h<6<5FzLEBDZ)3aC)NrJYII>Rp2)F>!JEy@UqT zYVUwg7hZ|$QIk!Lay^&piOi(|39}~j+`_Mj<)(zQxx%k;6o07u1bDGd85`zTrrRV+ZFaUcRZ70kTLBe4E^=O=|O{2D4Ly zB~4B1)Y#srcvbDZe7I?I$SiYCMz17}rEBYL1UZGujZ63?F^mDL>BF0#n9)U-s|`>N z`lkfGJ zuWlS&u=b_Bp<(Plm^l`@vHLs|SV|t5Q7TltMV**1^oHyPFn&11_6@HCKzuMdm!S?N zj7Kd$y={QU`hnd_3!iy}a>2pH#A=O~)`|Fzmc6Z~p=Q!_L(r*=Yf*`3yPGf1)Xy=B z#EC0k>(R=2WyrGL(H=X8fj!iR5Kj?nplYP+=X|>#zkq$ePL@s5sb^|RDe-FS;%stR z&&9o0Z(@#72g*d^S$?^$evesFds0s#pyAkbHM zVad!5c|5s8Z#>-|>U@>u?hJ4Lb#|_gib**nch872f;O8FTvKv zj+V_})mO5Q*EJt!uxoa9A0{&CeYsU3&@ouA$KGtGw`EZt-=k#`F5K+uq?45*hLR5b z&MJ)5;^@gr%gJn&z=Z`O+2Gs|f4*b&%P&zOO`G4>11JRZJiT=s;PK252n_Scmz}KB z$LgCs%XF`@=wU*HS&3V1x;evWJ+ZJbl%l2{&c~$zYBvS18WVcYKU7sLb)TQd$HisU z3?~m<*IRzN{^(eZi~5tT8HIeqDRqMzj5v!d5q(`3bu<r*E$N8a8h|;BR zUI{EGPQAS&p8M#(%7dywDPzCIh)-G-sow>_`luAQcv^a=(0FiS?T6ue@beuZx2Q$7 z()WFG`n#qKHbk#qw+|-xPVvL=`J##4HQ8KIM^mVEZ{KjZ7sZ=TZcCbe{M~Ce<$#0` zgpCah1PSYzEFo3Ja-q%=M4N^{y);BxKtX<^6olsClcbTfUbTQt*|+gEAo5hG1pTJk zvQM`D0=OIk12*n+a8Tr3^ye{-C6QwBWTs@6z12~#R77sd_5pwj0R|Z=Q%xQXn_#`N zyySMbaT$mL0#hQ@+74XAGN~TYn@a1O+{SR=12M(=_MSDC>Y{p?ZTYzBH(+5#77)NRdlbN9P zRTpdlE{7|>f!a8{HRMZJ#=OKxrt8~H1$xuGQQ?v*67EyJV3uWXD6ciDpSOB)|c>AMnog^dgig`Vyk#SMbincSS+ zg;Q{GGqmtD8A*Zr4|3l7a7C(+!rBMIDiWA%)GkZOI=GS1i2=Eme4bU=x@WTun;pEiy(_ok z{m|`2fyk%Rjb6>B9*i3d;f>L+zsT6CsN?g2664_DeCW6?pUlt@a+=i&#t;JTSdsC0 zo)J+gYaQ0<;}>dczI!I|l$!Gx(^apze}3)T44{|&kGXsMOVvTVsHDTljOHCzH1_ya zKjP7KX)m^F<9>=YQ!o0*Bne%i;K};&4INC=VcVfkxu%=iUC$r5#`7~PS9fZ*5< zPHttBitd^Gj%Uw1;HVg-(v7<4U97BqpVIIsz)lr~6iWK%*8xq&ptpvnF_ij(RkqQj z=yA!G=p7uc#5pN0(Em`% z8^lAcBs~#<#fLHZNSSaS>^WQK#F8LNQFTD#gnhX1s6ipueX(zYe3*RUaf&o?AYu-` zRwp_pSPi>YtBKR7)+=h*asS86p&ZjFMC?xGQ!$^~&P*6Qidg9+n8Nj{0Y{2qA7qhu zZWR44MlCRwM*20Ff=x5D8J>j-tuLr z{~I{(N$R0Qrtk^tvzo)^+wo1a`He#$&c);enh;Z-->kH+Z|;&`oiMEFw%mjSMv;pt z>`f}=#qQ0`2tJDHKfHl7dFYVU9_L z+du2Dl2)~1H_XK5uu5P&+Y-5-KyU7TX~bO#A30~(wl67-_$#{n46LGwr-5GFc-fTM zzB4g51Dhj_dnkonOYf?pvq zJcqiy19Fn3u_<<9cSTyYAuy!+cyQPU=dD-cHp-Jfs(IHxcvZD%IjJ53&O7H+p+L+} zMz;s)=>yvE@O7udT3>g!po>jItW#3u`!$2=#TuN(-c~&kyTu6bVQJRA(B(Yct&$3- zEpt3{+s^isqlY66J9Y@U5|vV?XP+t!Q`kMcuAif@yRcUeKQ&xQ#|BebK3h#s(;%3r z_A6hsP6QgmMFz{ww!?QHe+?Zdm@@hBr7S%^)i2;A$=bi}+HtPj22CRMBDO+gYig?N z({za{ai!Ppe%l{b>VJm{O_v}$!*BET*iSF}GwHjsYV?3;e7iQ4QBIW0{q!S~*(|Zc z8FK8NB4w_*2Ahde>;R|$YFe6EV*ZEl4xqkOPj`}L3zSlmv+BALDK-FJG_IEw5-bSmGW4Y3dRiOFrN_7?|DnpudL* z__Iu!pXq6blI6A&2OH*f+NYyb-(;Kd;rROpq zJCsskVv3QuBrDzgTpiUgS6aiAP#&LnOt0wL)HG#MOoEGTWiz2S%%B)sOLpXyZe$y#5JpEy zsSXDAHO#M(-N`X-*imowb%kr?_BJ{zPJM82wPjhRYm1Yzrs@hp@C$i;L;ExcSm+>9Yxdzo@L+dbzCFeuThO4d*9eBm!A5_EKR`zS)u zSOHRp^M#>@>*+ZeYY>F+_4A;8MaMxTOjPm`+EB^2+d=9=%F5`#d6s@!SZo|h-#5hTGZK&m?pDcZBvDgS`-b;N8Rh>PSR77&;LlzFf7e(#rDtQ# z@q0l_{~XRxA`1%#ra@ojjCYPcM1>(2Pl%nJ&aXQw4}#Bm+{h)nHOc0*JtL25^jTF5vk7R3YXLA^kY$R@ea^ViMVvByW95_5>mc$ zc?N(djHPK_zxJY5Z{qKfOv*x_h4zZfBn0xNGC&)Uyebbea`n8hIiSEY3LrMJaVMsy zW4^7e=|6ygpUR~y)K4`idwLQaudMR1Iq!olHhQG$=m2(3%Dg}}|J6-2X^A|oV|5m+ zLx)n7gu~eQ{RQochGQv6mQodVBrBqT3n{ zxoo}CKqL`c*iXz^00c75Rp6L~@;__(C*9=P1-YHD%++Mqy(0KPr^`8p^~Yn58sGq> z-`CZpqS=z1ytvozx#!ChgM!ZasHR$NP&~V3NO|luvgCF?J36ATU6mhFW1%i(p$Hk) zSZg{D+_&OkP(W^HIurB#=(#`;GOY>(yC&Xqxb9@uI}1!k`=+s=Lmy52LC&Ki$&wgeM6#JrbP#RP?JDuWeOTE1 za)4F1En*~r$jll6gPJG^GV30VJ}3!6^4}80-C*};7evfL+{qf$a02-`%M8h8P2col zr4~`8w@pM{af?gNyn~}7ha1XKh(1)9FE(`B>;7j+eyFjYjh8GD<5PDL0+9Fo{}?;# zxT>~q?Mo|4Nl7D0r=&CnUDDmTX*Qi3M3C<8?(PnyHYqJ#8<6gQ|@9*4m-_QM* zX018L9OD_!_|C|vJei_?AWsVtVwWywvv#tbL=>_^LcdCQeQ5#^_N>i3_VV5(O&T(? z%KuE6VwrTFpMy-ws-4PJw(Sno4p*$d@keYPRrK0JeG!1~xi7VZ=~QN`<3BFTYp)^t zSx(-$J3z`FQ&LimR3}s!hVL<8NhS1;MYR%hzDKIeM&nv<1uRSGKwbHHzfJTfACVS_ z)+oR|oC{p<_K0uxB|8b0pwgp-%)_AGfcUHMZtg5q7nm8a?n_Fp58^7| z$0=Mxd_Ij}`HoG{~9!mrnOM{k^1q1S~*N*`GVNj>}6VSPRQ;I<#5IM1<|sCuO$@Naa^| zNw(m`-7AOf@VYvD4-R8K%b7-LnF%dG3|EuAj;q)ynz^n>u0k3;R#SM%0LrTFqDRzL zY`+rb6>|Gulr-3TZ_nGSk(I6>yOo^f#D6})_D^0<+f9v(j53i&S`koywqokr>mRM; zKDy#oJHP=0R52NVPXX;}#Uf^=r#GfQ3fXf;b`ZyT?Fcu}-=E#|Gg?{P1C&|P?=4!? zs*y;}sC(YG*W$rH;-9%5ofM!Nh$r2yunqe9Ktw$Sq=3Ev$=S|A3Y}6hxr&Q~OODOb zfe#ACT472G6?Rc2Mp@ZsFUm9y$(d%-#QMHCTCXQj%nC$3zo%6GGc#e)NO!rkq}uN8 z>Ka-8D*9uxL<0w(%(^nQGV87HgF@9e$2}fK8fIk=W2K}~uK)bwLPK~{S-HS9Nv9;d0@lGbLS(y(D;+urL-H z9LPHJ>HfOo_84a#gOs1Wm(a8ti*sG|=UD9unE@poow`-1e{i&d9)6xan7_p`GBVP1 zV#c9zmp6rnzd6;z-LJzDD@>kPmyFrO;L!Nbd) zLM{6Bo!&dln7|0Xj>jqP>HcEc&CN~aJ<>Ap)4d;{u-Ce5Tk^Q=eSEVGNCabmd&Y?T zrOCvVdnZjIzjf=ImNj~1IiE%cG!Ha z0TiX2_8kMx062x%b3a=C`||+|5)2~eR5d~GP1 z`A|{^lf64No61#ylg)PR`eGJw_GBh# z41X)!r|h)fDq=bIF^Z&Xz1xrdZXU$!2N1{Hdu|OTH|NHn;Xt=U*4!CW6ahSXeZB+M zw6f*uqZt%pEZ`!RY$_lkkK31H z{4?+SYk@7rJlbiyDHy6Szmk68BnoL@TnGl$I}j#S=*yJ9bi&5O^hy_JgIC1&tfhuxcj>R`L9txs26fDt|Q{Wn8AHy;}wW?^zFs#x?uhDgm;65hnC z)6EjnI{7YC9C}t8H4Tk^OF-O@Df{Vl3Rvwa9J7w2-IbkhwCCjEXEq6Xd}B=sD6=B9 zyN8}!eUzlVnxqvfEvF!yKo$k9(T$WQc$=#2PpeS|7cNFh& zL`;^1MD(+NuVD-ydlyo?1JwHl=~Q}@?HuI+v{=QfZ|I4NwJm*90FuD<;s6VPrv<<5 z8szn)Tb!OwK*gt{@kA|12-iO227h}qTelD~CNo(qr39{SV8*hjLwOMaZ> zn`zi^OHIi7@?WH#o9U|Fp~+ay&UbJD0RgOIM?X6<$Ct}_I=zE~Ap*DgvV|L;Q@BOR zONJ9G=xee=Dm=^4;5V^=8ppNz1OC4*T5?HLoAT^3Ywe&R#+HuAzBke7;zqYh%|~cK zAU5NXpG`Cu=T^8jx9waN&X%m8penw)8~rP$weC!4)Zcw9XCwI1($Y>fDsG#nZ=%X} zEZeF>R(3IEWMU%xj=`Gi$qn*|TwqKEv4GO422>V_=Gx1|kX&^j2nJ1a8 zp}2K#MA>CH~|0$S)lc*i_P-rZWJu>*_QQ zT5xyXnU2NTj0gYIl;??nJOUW~V5i_Sk)f6RlmbPvFUg#IDO@O*tI)**gZ_c~cX=Ep0el=w& zPIN0!jt(aYtX5C};mp66n6QU%l0K9%K^y5%6{S+Gwl^{66Vk^A5m*t?@!|2tEd!;P z1UU%{^i^R#cYnpsb}$^Gw7S*jSZ>iJgI8$hgR^y@y^q4IHlOnP*T0Neo!=~ZaIh2t z4Rv;x6(@F!PC$(59a;5g{yl8s~7(5%auH(4Ja?GZBfF^Kw4bp2HhUX(Un?a{# zehA~OH~KWwsXtc8EnByef zBZWmxX?X72*7o8v-W)tYx#hH)7CCcKGh``KZx{`73_4R&ZJ!%XJfr+M5Xc|<{D1;J zk*|Sy6k+D~RP;Y&2y!CSX47(5QL|y{$0oP^Xxb7W4HDW`X37f63mq8@GTA&zz{dIM znmF3yEjwbjwfHNg>-B>Nip9ef+780Llesu%ogqJ!PYQlQSBS6sVa!pjdACiqa*Nvh zz%+?SSPpthle~pRabwBU=lRVq&@9%b>`L3^$Q;F{H`tAC`>mCa03*8)IyTL&j)XRr z$?9ymZB>`bRC;S~=eZ}>&%XN#DCTm}`eAH!Jew#NpX<#hLI!A+STawu;Giz_q*~lH zHCw>c?gN>s8YqCE2z3-)ryNeAesJIOAg+i{guX$d7BeHIO ze$8hO^B-xw2K9ZB$|4Ce= z@Xxp}yznsj-+k;}r9v5VBx2V+L*4J{KKhzZ^Q%TOUuP=&m35?@=8fk%!Is4TR%?V@ zkucd4v|o)67r^tyCZ5dK!E{EMCnW7LJE)Q)BJ*JD`bI`EW*$3$+*w)XRTYIDa&u$n z0!K_fU+uu_dU8<#eJmj*#omCyOCBEEp6EbiNG@O!n|wHnvm(_CiaDvRsIASd{3+9eV!S{0In*;j`)-*2a@gbCtOCMjolItw4^(bE`+W@i6^$2W}8D8ywgq=e5=5CsSE!XK@IJ$CNG1(H;%UEgT+l|D^n20&pFD5 z`_i1b)IIikS(VBP@oSgl5Z<$~&=%4Bx6|_DH3n>w7$J^-(ztdC?_^8{D1K^uIQVNw z+5jX1eDULzdfoGIN2FcKRH}Z!Lnv_>gEQvFk=a;d9&j4{Y9Xb`3Di@{k5dg1h zqtl_o0@uN%+AVavO1T@UK<0OOnL{cR`^v;yoBZGiQD0xbK=?Y80@E!28Oj6|HMOYA zfd@s=q_1Qm?PiRH&1!3s7}C)OJ{%RvxW$4>nO0u9$F&hr&O$%08}TD}Oy>ju3CNW* zWZee92g}ldJX)^6OX6o*I9{L8+e%$|N9_-(0<`9D9Y7^?%-oil6SO{-gbS~|PP?MY z{eEckhuFt-{BhA8+rgNY6*IawhcWGqz<|MG2*IE89 z+4U^ylNrdvOTD0f=uDuDwu@}uHE4`u;yi;*2$ihf{<4Do>X}C)t!H7ITCBSV;M@>r z_-zO`O!s2V6_b)+{V~x)kIzx65VF9aGOC+afX2Pct93X+W|zVP@x?2B$gW$C#Z?}J zbCPq$xTPRK#_V&O(D0m!Q~7S08ptz9DDF&TT<{2=n~S^`PEa6m_+11#hajElY?j!a z!uhsR{ZtB`8on<#G~AKqakwT*IWAONVNN-XtB@~Nl{;m5*Y@m944pC#*UlK15w~pE zgmpXlOr^)?nYhYw%N{0zc4r#XIKl@kYjvP4G>n|oqejp+C*k!V;!FiM%lt-#{wd+s z{JugC{pl&JV2s^zodIyEKLr$&phl8k;{E{`*twVB7TanS`tTFJ0DWO{i49nREIn{O z09u}+Y#|Ww6uTF7WHS2UUM5>^A4g=t#+$=P1!4)>>sd|4%tnd}EP6c51a~qWW1GV# zfr?)hAX~BOv?m9LCkvmQ>rg2yzeU;v{5*Y8SNZosQPlWkWY%CZN1=AW2x&Ex%FFD; z4B%!jdK3%PvUp0gTB9R7Tk3!w#w4#Xf>W0>>^F zP^>8_)3UM#<_=#;-W_zK!mS0|GnV0?m%~0|hC8TXLDkBbkB<|oU^X0TZ^+jUZP6^93{0tP4vBe8-+3<^_b)L+`ZT`?@2FPVYOiZ!-x25xBe`al2blMe7=d+ef zR+`+f2X$IIc80XioUWFmHb6(gzV=7S>jmH{S#}cKF}C%U_Azq`yEEph*l(#m)T6f1 z!6jx!#;sNZBGDClKhS<9f8kL`Uoy+0&SY1PO@o-ZUI09UjxCPtK?>86IVlmKR>?{{CEP@m3?;av1nSqIix}&p?Kob*@tOo^B4O)y-0zUt z=!h=)x;?l$maJ|1JPpd+t3-KKBl9XWS*_90w(bMeJ(kLuO-p*c0)F8_%4CEdB{FC? z*SkKI$c6UDvF-1_*y<>M;2rmJ>1Cx|jpe)qf1+bK>><`cg~cH}H!j_xhQ){?HYPM? zIJF5F5^%&(tE;or%rl;;tgWOnF)^9WODWM~N~%69qV@rbnx&ja^)K%slhfR%&)_u< z?>B**JBuV~vgpm|74_!U%3Fh0!Z)7kiy1P|gv)tNt&<`H5_lf?fBDBDw}jCYIG0b}H5p-z4v`9!-Q8V}tD@}pMmb!Vwri0C z3QBK#Ng$@s>T_h0-wlNDTSQhmRaSbfhO7&>$sGcSzYtX9sM@)YVdzsQ*Q@R@QsEl& zNfwtzzFZOkv+5z~+qBj+K!0#4w7fdql?FV}3V9hY64^9?EIA#|H^k%lDRP-EW8FV} z9|_+2dGV!5d7Eb^QrCXHB|xIv9BX#@B3#P!i(lK)YNM=)f4H_W<@Yz>eK1xE>n_ z2Y1v_79ReA8?CM;9=C6DQl^vU^@qK=h9`}n$$BjQCdjNVFQ<@@PJ873L&+IavO2Y> zZu>i!oa@PJ)mze&!?VfKOeU2wbz#p~G8B{`i>Qc|)|i@`g#jQhyto%?{2DRtSrN{U z$Z!eZ9;n<*ml&#&yc}r|u9O@mL$L)wT7SDY8s{ug1iu9VM zTs6ZzTCfcN=iu)QXURLCYsZND^pz|U9^1(spVs1i`@5_HpB5^~nw0sX%N|m}A95^d z7`T0DaS}L;VgP3(afYjmx#VK~{1KLE;C}=5q+|6405zYRM&EE4lYi1PK$uqGgwnp4 zwRinYSZDDrZ}=IR?C}|38iI22mB0oT^R|Gsj*en$PzK8KJ5t)bIj0pI`R0va|B=!~ zN1Kd{kW-B9l-MMpxhN(;9%R1bkP{!ML2GxPSO7?%vxSPTQLXpJ$(k*;$9P)xpKMF@ zeg0|zmq`HO;C(Js{UT3XM3rT*p<|#iKxfx}0>~jk*XqIXj9xt#9=#&#vJ7 zjtut@rU~b1Q*0VRan$w*aLf{-#SS#6gwgkl!{6NI-txy!)*L!z98GWROCw6=Qu^Hj zJ**h@Q(W?dl5#UxcGcyx( zSU5=0Zy5QIf#zix1YkDIw4Oh73CP>f;4Gz_h4w+)&dB(sufvjaZLl5<`-aI4wISAk zZZ7UfJzrJO>gH?F9*Qx)}Ae`Oe9sGABeji{CLzw{nFo689eZLZa6&AYF4evq@W-_nXe6*;L#i& z{j#}rDj9>CskW{0o7L9q^>wOilxWc zjSfX^AeLIi?r0Mx?HvDJnoClb`i2iJgfX2iagmmn__9Sq`)zmC9T*0!)|UF(m_bJ(5?VDP6Uz^$P_#K}@A(;i!Rk4uO6 zqu3+{7hPHNa+u<$TFkK;mQaXrS?e$B>D7Am z>Zb1PuNuc0xHawDOIGRDEhqS%ztNrlB|%6cvNGx(UF}}8n|DZzVticMq*t+?69+hv z8E`ENN(h)2uyJJviX2K+Wfhd(6`eP9nR^M40*#_fC?5DAaFPWQ?efj%rHCQT6~A#f)qL%>RL3o8^ex9C z{WQor-|pb6S858hM>0x)mxoFQEu4=Lp5^48rdd4sIt3+c)5l32bo%KJ@<-}XXLr}; z&gfk!zvp@;Ax z48LsT3$8a$4-6L_9ac~(im@quMv(+7MdXzp%Y} z>$BO|kY+2Wljlj+Oj!k@^DrDYcXx;9pL#67F~LQ2!{b))L}H@!>uU8+jw^uoqtGpn zZKRh99`Ss|Dl+S_RIe_2t@m`nd2iGqvCg8!-RphHOFU(Z@1-q;OnIlIcEacfPjE0+ zP4SH^T<(q>wkCwxv&VCmQv^|41W~;XfJ425$9$wego@y-TndXB__Hc zgU|1f++Kuh<3yKh2hXW2!?O)4v2lc+ZcqKZCTOA%gd_>>dU&|h6A(o`!P%USD0RgB zBP~v*OQl-A%9VqsR?xq8cTPC%$+K*kI)1<|3Fd)TWQi1-bSoIyE`!Q%C1VuplB#R~ z;YXdhQXv)KHFH|d8_QrvIXvz15!HO{W|$RQ(&ap(wy|%f?E)SHd}!lmCc`Pztunt> zVJ{*44NH#W@=L=1$rAG}W(uc;i*nDp9QG{&MEydFV*_cd^k-NEj6Rgy2IIG)9o435 zR2=@{))x1Cc38qedHoI1G|E8IQ$WYYx6AGPaWBy8T@j2=@aBXk?kGp{Lx{wh;aS1j zb}cmNE}0{e?fvC7E-t~Rg=nrDW}P-hjY+KO&rdta^cQI&b!s<+#F@^{YRwjJhA#!z z8C85Jg91TsfqakY?Np!4eGS$R`T$^--Aq?DVY*L*FJpMjgE~+U*(MxOmVTyI zjUV-KSUP0NA_jfqz2l1^)wS&?QBv$b9%>e*gM<SET+?yqCPOL1#{kVFX~e#{L~Y z0Dy@#2G1fy~u-|^U4P8suY(Km%)x~;u0vi zF<-HBBNzc-l{M#2J}7m&+%J7lxLNFAUKkFnH~G{i>mNOBD7aRo0{Sc;+2!&qr7NO8 zgn7vi<@b80(N9^&P1R^1`hksQL{Z$PHwJv^Cs5P@;8}+8sd?{}Ip=;PoZnU6pg}8A zKUeSeng%r=@+x`PV~V7;Sb(hMrLyY?YU#1aN0bCp$)@g$AEOTE4yE_IYU%X)z`uCCm7cYVc94)V3F35%?iIOkZN4+L(r*lE`i$ zlov*ty$IZ0VBMDXvMG_rl83{3<~dEUxkP*mHkuD$2Nb72rBX*Q3d%c-$SKt$2x>yy`ME zkDwKIyLz5eaaJ9>0RTot^$Vq$l;9=CnsyUuCf-kGp6R3ZlCM}uB%em+Ight;miBVZ zp`2|-63>XkXg^Zt20f5M*R8kT#e=6(lKwpo&JHg(l9-g5yqtir!0B&`h$0M5*Q&aj zK#PAZ7TR{s@y4g|I%famsqo`KAqf-i!6VNIxevU$M@tn|tl`7TbIB#dOU&2IOWV>{ z26%T1X?zA5#P|n3q?&~)bo6awE>FHFvORO!__#V$}rd zIuyoR>&L!979jvGFJ0f41H&diWUQin3Mw+(b^rRc?QH5-`-2ODX#_z`c_l=&T;=bz z0Pyk1HJTw%xGQ>@5BDmK;#)M^+fV*G!8hqWF1FGVc!N9>bbak|dr4&lAD=~euo;CC z2`37<8HI$o5ZAmhL|XfD-HNj+ zzSjKTfQr=cYTUY!2>cBP=5=)%g{zfE6fBCgvhUu;2ye|)_$G2U*I(?U|2}=gtA2`L zST95{Wk)Q{2=|ihC(zN++3lAe5Io`5KT&l7HJu?Az(w`d`1$$f@GvQC9d3sS$^tD> zE#VJOOp1#&3n*ONT%yA2@Nb*+aZkzk6q^F3`;#}1;>aMF7<`lo7TDCREhy3S=3qg` zU+cCXOQ;;yZ`&>RTh{r#NXd^8S^0D$txa|6UEifvtc$n;^{O?DXoEz9Gkfv<8D%R0 zWbKNiP_^_W3Er5d-Ey#ubj?S~HIWt_IEt#5_~?D^46G7Jf@rwYnW=s4k0?JVfHDn( zSBj%oY(TNACQMKsVvBDTMhHGvj6@R@=*>$Y=3&kHTx=HTRQGh~g%Yjst`}}_E^XAOwNn(|o^>$g_S02vlIkmkEP+vBm;~D`MJPHKv z7~9~O8e{PWDpH~v3sr?Yjn-5=G_x(Ks=<9)LB%gQUJnZufoFq!7}WDQ=Qa?EViIk6 zRd%)iO7_vv{v-VRr(OQmv7()#{SMTkD0DOe)X8!H;Mbp+Yyk^n-9|4@iO5m@Gv4VF z(nLAd5W5!K?Yc*Gv8>OcrvALPULJU-)Vn-8Ru_K4@RX3xL!5TXuf@Pu_FoU9xGhh& zJE;TP-udp0PiwL`xuu*IR~|vm_7DUDSAq~OUbI9YK5PNl_4_SOwDQ?B@`~jTu2AIO z%YAr*1&8z=YqRCk&(EDF3K7yCq;bWmovDMJUSdWr-Uvc16B1Hx_Y!6W&(EZeW$5Wu8}IU{30r$2lcbeM1*tAe z+V5Tn2%{G{u|4Rx3Rnqv%*+_8(iB2(?|qvOWr}}ykag+W2@q#F3toKO0w?TIwCa>| zu)Q#Gnyc9NfAWFvB|L$-BAqmT>0J192{%r;2<5voQGtgj0y6j333JwtA9y+QuOE8S zz%(LG50qkw)!0Tg7>Pazsn53NFF;P%8MRxW3_qfJia%1hsHH^JxV?~-bt*MhTxr5r zBp?qV>?&1l?B>&|BOKF?5RZba(1pC$-FSpm4OL@uBI6Tr>y#D85}Ga6R$`<9dgn(z zJjwh~c^jnsdOQ_+V~rCQo?%@a$UDEsp2_tPW#-~d$0N#A-h76q3gK~q#vJ5p81j^6 z6S5GHkO0ZmWi*?i81sIf3%3T|yIMQ+Y|S=X?3RgE66;!ZK*5mA8zv;>+nU*AtOBe} z&O4otigp=ymmtgv(*j)9(}1aXA+uPGRiiNQmnkG15fPIi0g(yb?;mZv2k?(5!fD{5 z%nX@U$OIU1@AOlAu%xTrfamL5g*I-10WJmCBEyJ1t5W@$?eXYWO%@@n!~RW6@HP0{yrR$rfIf?H#1_J_%tnFjB}v&jw*Ef@jfeol?Xx#IO!ilx`M+0}?P^N^4_gOqS0lewONqQedP%WmS9QJc&>y|Ahg2cMq4GZg(f^S&`pd9sL3** zRe187`bY%|MaazEpD2H4Kjh(vNU^1=;=pZ1I11JnPrW~PPXiU~4d!sL+P&!uX1U_{ zScfLzs$6!n0VnVx_1D()72zOx;7*j9MziJChxt-*oF(cpWj(T~(H`6Tr=g_0GK(SC zBl+6y^zO0)9dUp*7xgA(F@#7~(BnSES-0nA5nDEuhjFj}MS;EeyV#S9t8UM~{u(h= zI7CURVrtjlOYpb(%zKJn_l`OI5ew-ZiW*bh-a_5?*{E<9#tW~u_>Ih&xrXz0eWDuM z+gko3N$Vla@#B*9XhA2(8c9UnImo6^_xFq-5D8iTYQBZY7CE0x>RtrkC0I+BP{RL% z80%yXf90W`R7KIfm}DD*niCY@1r4#^Sa{cHcmF&^0HUUxuihFRTX9hRFi^20GQ?aZ zV@9dpEQLX{A>gbtYVbo*u|_XuxZmq%%oV7DERmCoTnhzIMv}DsQOBNC?DIqIx>^d= zQBmbJ-67^q#YH~LdeCyayreLHXXaww-u6Z6uzbY{WqppT84(J!aP?$sJQ8(%FvC&J zLprWIPGDzD+&KKnT(btUFqjPB%jSM`0e>L0-MgWLOx1?a@MUsZ&e(d@?g-HAi(`-o zzQ}vZtoE{P;_mmbEwH0rB6;gT(j;!iHd06x^Ni7et8<6|N951>T+@|oXtl=%lV$uw zq4H$xF>FYf4Ba`+^X`-j^$}W*nFGD_e$!8HjR$e*!s_2&R;nW`J+eC z^lI_3$W|Gq5x$2y5#lU#bP_VJv})f!w~W4V8Sa|xk22f*NXcz_@O|@GonP{Ct~bPt zZp&>&VC8HcC7SjfkK~}XD-jAOkNVqpUjrcZ;|0pvk7Hq{yKZ5%xWLPwB3m^VM^o-uuEYJ=M7jA5!hyILZ885Dd2&D z>bPmZ_amC@*3&$m5~6N4q7%y~&cFo_Z*e8?a}FtHX;4g&1<~c24pILG6}1yl9Q+u0 zcL>}N{3P~TVoR7m`^zefT;#4o`7Vj$9U>nd%gpU`c!&M=8A)Q3ZpNGdtZKPa@G4Ru zW!ZC55>fALZ`wzI^sHg-cB0N80AfKqoGO_0%vP{8&~q-C!0xUMqEO-|4ch}|D?fZ) z2VewQDjvL9B){N;-tV!6$_+C|G7bL3pTFO&a|k?oju?!&2cUa0vWXqBf8N^I3Yk68 zbnlo;H>PxvAWl9Q8;5LmWcAF@0&K+ONvmnbDK?{rm}6HL{ZC|TielN!vMOI6bw`;n zLpPsZ)<4hilLD~73)$)4nJXLaX(7y$m5P0#`Ve7Z(f%Bk2;6|49^W3LlJO#KZ$*|L zX?C%r0OGZ#kdNddx(%OzRWq=F<+KA&o$_}bLmqC3c)`{pcE<I#_lz8Ia^{?JjE!Lc1~vaJY%GfK0VaeYyss>#}_KGNV)ZHu&<>FtLIv3 zr*S}H&e{WAU;7&1^x?1}W`mU_tg_(wrgcXLTsUQmN|C=}EW*M({MT;Q%-JEA$c(Em zr?}l$h;R3=7me`bv~{XL_=7qXBQz|d_FD&46dz*uw@Hy(>SfXJ$AXSsY?lj${$z;G zRfuPMv$E#!Q&hbe=P~1wz^pR}c90QGpLe=5OLnp^`q|Ms54gB6Atm&)vnlLc$1_(A zB14J$45SV^KtX`^^k`Ul=3UR8%zh%1E(#B;<6=x^ONwQTFWR-k9#{SoDzK0`UhZh5UZeN5+*_iW%_&WI zxvzE@Qs5HRJ)W(H0QhF`d_~{;LwN0;V_;zPg$uOj^Dn+|*!q?Vm}q1G{7c07$7D4= z$@KyC7SXyV)3c{Nu=aroN&HQ&1V)pAaBt5`TVfCX6^Q-$9Y437Tq zqF<+kEfSEr*0=undkFCNf%O1UyUgny0o5uYD`a_SEu~H!=nUZ2Xqyl$;K%I<1T7hoW#$dzIjWIcpae*g>iZMzDH(*isgobeMW`{@cZ9n!xE$s z5fw`gC|KSad5!X5KDMH;A&g7(g*;84Mv0?i?YL!|k*7mSCgwdP~3yKFH zbS|_r#8V1qQrcI;KU}U^w`xvz;S6>eD&d=~YUHk;nww(C@r>6y#^9f` zWeVc@_jvm`bhQKzcJ*DV^T;M$_0 zyXM?APVDI=K8gTX2oxI(H(p`n0qQvi6}}D_NKHfgkvpGsxcZV#wGuqNqR4o*FfguE zTL&Jx2_N_dH?I?{VaTx|pj2*HppPVMoXuVtWTD2IpV8|j;Sd7e=zaTcVfQUx>yypV zK9$nmbJs1xL)(S@g`ph*rESbV)1J-pa5`acv+r$X)-p&0MMHOH!1~NT!nzE;g$2av zI2}r-BvzXAivYxf%((_|ANf1CJCeZtwR#V4_e(=EHC7YWt8|At)bt!a2kB52QcqsH+L^YHA@)nXG6e22@qO*~0q<5|3qHiqx1 zQitft*npW=Zf^9yofW@jv-an3tCy4{Tks+O6x4p#K7anO1w-#QKFD$l%`R)SfW{%+ z8u^U(*AD)#FYTmUdO9WZr-c8nPyF@w3CUwQKeY{&&yk?~9M#=a?H=Mn`X)n`ISFlK zjDxL#=Nh`3AzSug;MgXMXQ+S=I?JCohlh(TwJcW`e0CgI=f(tJ0)cgiEG(oE*l zImcY#ze{52c9w<5{omhBHYTt{a>E~ojQzdx{`0q4Cki3A^@)4-T7P*K#Ychs@4xZq zGg!iXq${zff*A7kKYzmS=k=ZX!|Q&O%8vOZEu341xz_Fg%_KHSaCtVN0Rm{wRYWq|H=RVkBU73o*k7R-PP|$*RJO+8upQfhi7K_td<>i z_ktpI6u79~vcO7(gtU#H@_A3j5IqB*US3i4M&iNcfvmpHJGWrDe;+RR$Jz(}opyMp zTGoL?{?BJ*d}5_crR-*%8-T;vvVs=EEpW8`3WpF+0=Tz5%c-%=vVzna2Fin5QR$ZvH&Q6-X>0~TK=1s#@PQhAc_Z62#!b9f}l>7ELxk( zr-dI%i{%&>?sx0SXf+WL)UTgRa{2rFvox7Zm%BW^eYMK0UgemgTw@yXcDziM%xp0i zx1pgWo>RO?cl8T^GTV&O)A@Er!VB6zV}$Kn-?pv~%{Q^%mbGnOlR+k3nbk61pYG3o zo~br_z8_Le!pT4^;2Q0j#+kCtq?$ibs#S&T!Dfbt%cS~Y)_DJ|`_%hWr?o95^=5nS zTTUawdA9>0%UtEbB)R?6`2w>wi5bp6#m>JhrTZ8Q7Ndtv;2;(DzNX7MbG$0>-CL z%@ItZ8(nvK)&`@Jl9MfDtDyu*TbyPRfOk8{&NQoy_|5I&F188DPY?B93#y&G+X=FR+I`1-hzwdWt179wnh8GLPvu$8yHt@h@Am7SqFm;ZdcNVEsu+ zoJgg$S0DUA9yLSfIQ=T6xdOK+ebQH}g*;bNSv{c&gUBJLNx`x7N;I;^_qVg_wgVdV z{tF}r-g0DDF-nqn@@s*(CrK9SwQGqsqRG;g;1V8N?YMii>u6*Q){F1G%Wa3I z7?FRexOH0@c#zXwq@5zq9Z?ljrMc$ie|Ni(lb=shqtOapdOz~TH@H^s?|A+I&H(PN zS+mND-{bu2g)`avrC9CM)RSeeJ22s{V!=Qa-*Ii##_(A6Cfk~~*+j8SfdUa}_e1i zT=hoq^Ok5;1QW8GKlh@bmG9}x)RGcx;RKD_rDY?l|N)!RjDKLC6O_i5$a(+I>d5nMNy^WSY z6NJw!lE7;G?W_QaV~|odjfBMD;$xdSaMk)+33{{uxsVc@>sqn&Hm5~4w!X!ijyJHR znK+498YTo}@J1gkKv<^Aeb^?#cAv^PJ74dTv_6m`3mOGT;f60K3Y4N)vt_NvP2LtG zA|VAGYcaF(H^^6YqXCrX`QljwiifAg2mRsC5hid~KL{_@8dXu*DCU2~pw z32YzyL?;@S_N}qd=(z?L3QeumbaL(f9AzF+oBd_rz(qbsWqJ6wsZSVKgiq`F8dt_JZ^V< zN;KybM)$kCPHXm2b1DG4R+v2FkOi39rkyP`D40S^s{NL4-I_B296C9HxZ}nv%uDxN zX6(|5tV*-FczDbjOl+j5kU9*2=bYfIrSnsfttG5?7tchLT4;fUEf8Hix2>f@_p8QX zfqLiLtqJhg*LmvEk7~-QozW0FpmHv%LpQ zO!kqD71;Hlv!5lE`6Gxc1_TF2=JHKkCAa1F>&oK}6mHqL)!rVTi;w3TJ+4u6t2uWC zp;i2P2(;>6f*8_1hbdj`qoFwHb7|}@ffh4OCQf~^96?(1hR|ea>6K;z8S;oAroJSK z?_=EP3FpL}hR1kN6f#BLJBE9YnKbak@M2tZOUpP@P+9U}l4NNzH;tt6yKlLmuE;K( zxu(NctMrdtq%TxeI&YB{AA>8-6MIE2{*Q1#Ofez2rgf2lWZEpwn$^r4NpV3+4rXSZ z8g=xNz=v1#3XRd6NUP`((_%U@sRAV>U@ed3rDnWc9m~pl55V2*C>_4Rp>Q({*XZV+HTr2yZ%sjsW+u1Gl8% zHIub@N2I%_0whJOA8#OswoT^S(D`D+asIj6ZAdQ6UScg9$F0bUM>uOKQSWiz_sye^E<#b52h*B|Z zIyrPX)b-XPnf{Q#rj79wBgW=(F~1D7bCLGmagW|!$}nhWZk1%$JF+56RKfk6;Cyc} z?$(CN)X9mf!QzTOq^)f;SEcgqWK&_L(vr8v%(@9Qa-AdxAlGtPl zr6TFDDN)uB*^_}+kQ4S9Ev|_8q)x=peISZAPIF^3`)76+qEY*ND4gAT`7I%zY5D+D zgUOCT($lPJdm!2Zzua!icXbw>de?J@A%&+lz@%4MyukUyd=IJoB|hDeoSc- zAma{nM%@8wfvYcL8exQo4RTbXw|8-Bwb5&~gEOb#M(Mq}ntFk@8+I9Fg~C;KtM6V{ zCq(2v&$-=TG7*o)?RgxO>a5FBPX^;&RGTZ6N`Y)i=s)z-x%JWs-m(VVB?w6On}POE z<$F4QYjqijq=GJQ+wS#x2QC~p>Z;vPG_E!nCJcIR#i(TnN!KsZA%eSX-(t_sCYMoO z12ed<_@yZbZ*NK;lo^$j*3V2vR}Yv2_1n&6M9b-Qx~NDNYV30O+y*~JW=hZSz8 zKd4luEWf{GqXYv;>J=VxEw6`Q7DSAE&YQL7P5T775jit1VS$kG*j=rqcIj03q$>GM zNNky=@QB;J6%~#hkk+UrM3Ou@9L+t<`&NF?$-{p2`x5s5?Rfc}RDEaARq+$w*W4`f(u^+4UxWeTN=!#MF=nrC-sinp2qxP7i9uf) zbD3GJX&Eu`Oxt3U$VNL#5FT6tDXAYr+#{ERx|upQ-btV`pkd&wQUuyIP_CMeg_C-M z(LCzZKDVLfOA6EH1HDQUyZ2T)Mbl}o**3-nO?o$Fm;(ylNnXcc-i2y0JMjIEOxns` zWDnx`b}^>W1XbmV#juhZf5LuGiB2M(9IPVW2z}{1Ts1^CO5(98f4W$dUp#n|{T%YCviIYNET%$9Ff?7^9?FVUZSR-OdHim7?KuyZ^`8 zS4U;Ft$T}rAP9&O3P^WKcS=Zim(tyxBGTO*N_Tf7-HnuVcQ<^Kv$yB$v%h`L-S;}) zKh|KNu6NBfpZUZu-f_Jmg;ZcoyNJqDG+di6TWy#sYLX>t9jrp?Au8=u9_mg@#Q^L9Zy4x9)u5mv*PD3au`WsaeYqnC}7AzGE2OQ*hXnt)bco|SA$`V>veEFT7832R8MAIg)O2^woJ~qXR&h1_~P{D zPR`DTr{d@%Fi^2(;k?g{(l{qYD}Ke41zl)~6jsq0`@QhFgWE?i+wF=MZfTaiOez(~ zOUEvu)%sGhYR2p@9PrrK;ssrg3wEM#YJU_v5$X1Y^0JEnnI2O0X@;>{ZT;5_H9$U@ zs;p9>yY+Kb%;}&x{P;^#*$1ddBdbG&c3ow;rVeh=e7V=`&-Gh~ht5DAlD$WWI)Y<-)V~pb<9Q!mXHQ7h8I)$hTO--lU&Mx7rA0V8yyC7h!;Acn>m3Df0mag#J?-LcGT zGa8Ob6&{VvS-MW-x+WgR(VMD}OXF{!Zc`>oTTQ2Ht~{sKtRV-+KG$qMp4$JV&G&~I zg9i@Xmm47hI&}%3o)CuEB6I~JjP^))XRPn?Xe|?Ks_b<|Hd?~z!QCy4%|;jU<#$vJ z-_2_AGM*etZw`TshEb_Z(S+zb<`Y?ri=TDnPP;0g+0tT#b+hU+Xg{B&dwfsNo;=K> zIV{pP3TsKo?GwDVWa3t%rsXME^L?2_@&(K{6^d&l?8rKiC`w)~uAh42OGbmT#<@$I zhOuThx`i=Y@V|gJLeTi2%lE)xKgPfx3f+fZBBxM<8L5Nh3YBMpTmno$8I`c%LwQu1 zLG(D>M z=_s3DgGQs;>)q#Og@w~}e*vxj>zA%brTOc#2*c6zuRU5$`qY{(m#E@5r_438mGTr; zjFi)`ZY2{;YG?q@KAB$coz=`^u@#>Ku;I zp;yJ>zQ^J9X3N%L8TIg?Q*?~~WrQu#Ai zK?w!=u`j0HR+-J?UE83IM&%lgp293H$QbLkZ!ub-!}Nd&kTf+(+i9sC$8SXv1Z*3L z#p<*?8*t3XpQ!!_8IWR{i!{JAcbfFms=_U4y4+>4UJaey#=BpZOO~5{lL^9p1=H|B5Oc4GuQ%r6Yh4h-3_n^6Jl48lt#o^1{w_!zZ z*{kfN{&ura3mVHGZN)@L9Fv)FK%vbe)QD{lW4te`b!DLk2w@rWx&k9hTxDEMuCjno z5=Cm$nIDJT%1PegWpB2!zPsJ5w4)#9Le7unxt6l^M9{S@;r64jbZL(8Ewf9CF^AZ88pwd@z zbercnHj7I{WouZ0N9%pcR?cbOr`?mx6>4@TPH}G@{Te19!tVU2QLS9M4)X`vUsKB6WW{>P>y*KZaS!d%d98$>JEwlYQNCy3%E;R+Z$C-ko!Q8G_ku13Mcs-ylEH_!s zyghVidVTFV+jo{3*CoCUc*1}EzW({Ap|Ot?4MJl^#n$ki}V*-N_DYNB)W@lC1XhyH%3Y&Y0`(+R6mDy|vXsJTN zA-EnA-TUCU3j$0S_v@Wb2!xx}n@f0fGK)DU*YjzsMh?gF)#g*o6-OX)9SrZq5}x|hi?uNhYgbv6APY&5~$jdtE7jj-Q9Jj7*6c4(k(=soBycy0+i2}gJDZQ zZ#DKcRJ^KcPt&_c?^07!Khy+yQnuRp{h)z)_|kIS9+x$?Nd zz8$Gude+N&gr3<~bL{5~+IMzBXcr%Y_te>XGjEE8Z7sRWKot*%Hfm_CxBJ@t{@okk zeNyXoKgV@MAJfTwv~5nR-||haQAK?BF5r55CNC@B{jQa0>wfVAkcSFWn+G&KMx$XB z>SIsxAk6xU9d7GAEZv@{kkVBuQtV2l%r}F>UZyklGGQ{S2Hi)fCqN9;5eXSMl66WZ zrXw!7TxbOJvUAq9vzykYY4foEsZIRnb^ldReWC)h4!Ke}66eZ%xlB1>Dq}o-R7I@>KR)M8v|IyM&_l^6)Hvixv6lVng_-9Fwl(?4r(=xT|m`Q;c{f z*UXz?bH&~?K^F-Q`6_Y0z2k#h)i zt}+knT%`>C&UL4h0C(aU!VP48sf>(F5d({}RtBOX&<5hfP1$Y3`n^M53EXI_IEaa^ z-wOe!!pypITf}&ipOv1Kg_^N%_nenfQRJ~2G;%pLe%EZxe7r?JVNfx>? zff;7@$)AB+&Ohae ze>kRpyR1iq@Sz9T;xQnkHqoJ0BtaFx8>+^e@-Zx{pHeY1a$>*+&p5iT+}0J>mBHZC zCUuQQogP9w?XGKC2CLDONfiHXzW1CWm5W{A znMNX!8Wggi@6M>2KN__OgKb5IcaEzIrD*F#rC?&jgT^#HL5FnItiXj(_oJ2C1|niM;wJ@ZBPGOC}&?p3xu*M1YWxcy#ro()5;}k!qlS+E7!na3os1ad<$E#PH)PD$ z4%g51lLPaznP!{HBCP9Am$!N+TwVG=@!_`sMPjK@7|ANz;o!+(va34od_wB`x$Ptw z;FPSkj-I_9iKvRgl}v7}*BI4%n3POc>k&m!D}Rn;hw(pPDbw%O8+|3uu38v_LGfz~ z2&;d}>Xpd9hT2Q;(;!9C4ZXZV{^Twuy!To2OqpG>Y zRnXATvT`;k8A!0jDxE*yxZJ=XVfS2zWZ}n-&-7jcTkR=!iLu`?uY`;qQF)L--fc)~ z-~Nz{*E>EAK%*hCM`AWzs4f~ME&dg4et)NNg`cu;5S{0-z$0QU;Hdg1BqTiJD$gj) zU4D-_J~6DwMJ)L>DV8V*mU0zGIlogx>CI=(y(=t6D6d!Mx}Nd; zz`%gz6CSIkGZ)0`YgM;L?KUoF`7_oo&Q}8J|HC5wx-lNUhdZ+8LwI!ihwt(CFFo4O zfPS48e46{;{15+acWcx==$u~@Iov|}`UN}QdN#xU4@Km^{q^5}*N+tFKJvG@%GRD8 z9fiLG9=ndR-hr0?LGbLqMVp-$JYN#k)w+vHeSFwWl^XCblU@zL{>_Zy*CPeDnEIfG z{^kkV?*aKgok4%~WuCuJ1}dOp$&;x6C*SQ)5|3o9w%->2XBfpFzCSL}Q+^?#e`GUc z>%9p+0QM54BYA%mMFDh51g6UL0DC5ckX_>0vwuAT+)bdfO1G(j8Tf}E{^8&J_e+QV z$Gp5P<@*b~Y}RL3obGpt9J6!X>NhJrah^b@j0dzn-1`Y!YQAd%lUZ_wB5|&tKW$9z zv5(Hroof(Z=GcOMYsKD=I8fnmMD!H!Xd=Myk4Hj6;;6~oczqA} z5!2GrMzY&ei|j6ID+ED?NP?Oj1_|dYsCtf04nkWxr^<9QTD{<8f_J7Wm~NO?d&cvo zY1P%#NJXF?TNhhRMuxRXR<2X7b2Td9K$PN}r;3iKdGs@- z`{pr8+334w9lE+ymN$Q6w=Aqev+(R!k&SL7lyJ9AO|>0z56vXa`qsCwVU9r`FA zaKT)-Uw?PFTFiQ?XG;Ft>|gas&$d0=hF;L&NM$EQyNKNDS_Z3(B{owK^$EaK*BW>qS%f>T9R zA{Ra&nmX-qyU1|1J08I05|apTF&_RNf=pX6I6oNSI5&aiwcv&k?5>A$imCYns) zqb7TAH(D9crua17bQjB~&Tbn?dX0#cj_rEgeV(RaxRpX*{-GP-Lx#g0tv9|y?Dvvm z&HlJEGanLCDPGZk$MsDYeoY1x6f2gEnCArI$!A$^N=g!Xj~(2J%i!Zb zOTfG)mK|#E$oV^A%M$)Tu4XkC<1=UVT5OS^4Dj*o>Kz@;UQ83>E&p)%;^^>@X*wB2 z5!kzkoVS&K=h&qIelZ7ppCIcmgdPTAthcPzXt!_m7*6-5)SEew0cHA6~u2HNrjy~^abLR#Eqxi;oQ95A%0*9Vib zfR0fblajFGV_-}WL9z?vBh}fPbfJdIEeU9Coe^txuK-t*3o&)2)uaA9_vH@*ksbS5 z+cdfik)B%)&U*5*%EiH6;9=XdW~y3&a{q=wR=pc{zGU8oXp&XwzPaVyG#4e|A0C4c zvdqYM$1fN6|9ZMAK(oO5)9YDYnzn|}Ime9mpxIeG>W;72-T+a-N@N7&NtokHw;sT= zT*~6@c&_vu<#yt9lgX+P&|H7sB7-NFVMVlcqyQ5zRl|b0mfKum17r^U{etmmXe7xs z%1JAX=lpMOZ&ynA_`Vx-7OGoex!=;OK5_E)@{;yjYR|T4`7F4+ob$OzqfW5tjw^~< zqn4j~fI3nc%Bf+lCIan)_86`mXhf=)7%?URg$x&0SHCR70>vyeM&prK7ul@JF@7`a z@+3naaOmJiOgSN^FN>I&6^@BPA#Xwsi#>D)Xb75REsy2CtFhpkwqES(en@X{_4dC< zq>5TwYQo%0f$TS%Zy>l=t&~HWk@5c2V}|tt!~P&Y;8^fqmhrg%6znA=XM!* zw(U-re*+|*p%>ETT|S;G?;svlC%d^~d)1Q7*2EkovKtemr-I|Ta+#oA(LG3ph}AK# z+Z~nfws;$tPp$9I_8MR#vwMRg{&K3}M+2}=9&OyP!M}0~o>CN2)k>364w}TV1cHP4 z8)&QI#F7Bd+Z`%k#>D{K4{Kdk$)Tw=`7$9Q>fL|%(p21D89K3U6q#mG)AK{Dn*|m4aXV%l#o;b>-&r&-Clzk$ChC`!KAjr;+&sB zSzhBI!!npAp3S|mY7KVkPdqGfG@soD%3NR6i`na$5+rj)&9J1U0yESpH2a^w{$<0b2=%+g=WlJs7=m<(Kj$Nx6t*=WL+gLZ9m6qIV21pa^qa0n$DKW%adT! z!;t3!efIs6RB;aq!_E#{hPyi2Qfz&G*Pl4qHI~IXAab6_ z7eDiWLSLZFSG#EH7d+i=lDkiopC~t(t5i2z`XJ1$$vrx!B>C~Na+yvhPDfz0e!sg9 z_w9{)IY@fqyyR~C?`#fyA_2}zxsxpFC2Ji^@9He8waS=GOO#O-fhh|lEjoA8SR|M0 zr>&k1Mxn|bt2vu1$21Wo$291JJC`&XO@C|-IXUkE?vMS4 z!2LoKR|IMv)Mwq0%Dqxu5I|*+n;zpCOb}?49A}hb6wVa;+3nAfT#xIA_a%@p7icyl ziYR2`(>t0@mx_y3&4mvnveRr^HBYp%mQ|1`!mkZVawHY?ES)M`+m&KVM!AA+-<8e5 zhppKX&*6(xidh^S8X>!Pp`yTo#$Y`fVXR)WKQNEaj7NB;%$9Y3${chxzi!o(wp%`+jm|P;vVl%uI3CYaquW}&k4$Ok z|K*e)85RyvBGgUx+5uBsyAPrnK87+wTDvjgmf1*2Q_RxbRpc7#H58j80o2dUJEmLK zW135Qhv}2JHtyVm`CUAmXJcHR4!Ju+Qr~U%Z))^JEz`x{zxUl?J2FJ!44}PJlj{r& zF4?`v<K5TYNzJeY_ zR7%5gT05^Y_73^RH@8t}lsQ|_z8@05raTMFTNg;x^Nnqd>g<#KY;CAiR0z9dLKJh_ z1lm@D1U^Vn53nnmtVO%>q()5*J5-2-mu|N~cQ?k-v+YxpwYHl&DhS)p-=jdFO6{&u z)73aRvbhBI<3Dnm9en8r8P;^S=S(h>i`Bq<@NNnRrsZKwoAyb>2kDEqdHJLJIjqBR zW;&&C$uIMmH*r!qe2$J9H>}P3n26P@R)EQ58gEw9(pq%=4FTN^iJg_5b!^SVWTDY( zuR>h05Tmq&jWuJW@*|$((}ml(`a*pXHcXvZF=0i_^~esfH^*C0pUU)^A& z`fD^*2=nIPc(PsQtwPbH)XYhLHu4w%9+?8!SBI#_A3rXxtgWpL;js>x_MI>HO-~f4 zM-T_&2mv4+!;B9CndArC1-5tw-CPdKf%NMKgvFrGYMz2@m4@r8K0ip|vYjUfv@q;7 zU(0px(-?a}F4ko4ga(&Cg?)SSarad{r}^Hj)p^7Zp6lu@t@#A9Pv`3ij&pB~@S((( z)PJ3G|Lv*q@W8Uvv55NkW=ZyQaB$2TUVGb4pV8xYmB<9KP1mNuU-d=fef@f}xT`2@!Uz=%82`};pi+n139Fp=@I@k}A=(Hugz68+i7#?b*xoVuvbxjiK z1O+Po=5!q0u2>B{+%=Q>N)(~#mAFwo{H>X!* zw54^6C^WNqE!7KzDl#?QnRPT|XAa;%Q-~A`Gqew)4R{OKURXRxkR+SiM=3*G*N=L# z*&2j=5cXk=(ElDAtAD~U^1OK-Fc7KA((g=Et4ydB-wB`z-CbV+BIsog=Acp>)Adbz zKqa;q^oK-PCY$FtQ+y@P`cYRsG;m8Cf=S}{&8ZX@1sDmc&~_V~qV*S37_84r zoyN)0+(8@s<5=J5s3)LB3i{aXr$Srb4WB(Q1=`zQWui|qb(A%)-yAHy3#b6*3Lh)g zb(d$W9RsGgDi&wG;Ekl6ZOfA;Jd~8`w8&1khQ-Y=PW!7)Is=Pnt@@S}D`Gg5#o z>^-*jNtO1d8{R{ z$sGBBn;VzzFeWgR4U=`Z76SBu@hb)RL|2Qsjv%Xw64)~vD?W$tQsLkt@HTbk#n%r$ zbq@!z2o={qyN_xBV-uG*MsK^lAIhnhH}5h$vKla8*RRZ1sVSX38>MNIl9DPOcB{~$dd0h2q?$)8o^TSNc6xYN65HQ9 z&bXH!YrPhiV$R1t%{)w#{2+5kXhg%Dly zgVOQfVgdoU?ELzBzoxC3ZlPL((b!r?zpB>N-uwzv zRK-Xb69oRUMZlW4F1KdTrGf-S5%*BAdfjGQ_vnKG0BUc{IMC3id(nJN|608d#f}^i zMvMzx3dnF|!7G{#UG`3H?%fKt&1hr-FPG7n<*Z>}oXnxL)J~dF`ETVxD9opTv>eGj zY{wO*JNSuOy+OF?w&D{IRB$zvbq)@w{k`=&iT9zGvmJ&!J7R28D z;`1~f0mO1ORD)P-7DB==ETP`;O`xLdUVR`~WGf*eg`|c`E$8c~EdoAHCYV_cJ=WZt zYm(%=s;BVOaJWysyY&sKE;k=lX|!rqO7a%p*eF@HN^+lTwDx%*me?$vy18B(OtoW~ zcHU;U&X1R#&br@?(A~No9A+`txA4hB7d?M3=h1<%9dWgP1_&>5#r&`1t1OT?pDU|e z?nB)-EZifqSkzi{m)elp87=X@L1B}$dyJ*?v%py2QDd9Q?Au_|jYwnB#Xg%p(;Ln+ zn0R{g#@YECZRa?ua77kTTJ$^i`P_FTfFxb1w$Aiso=IoDKZ+hkzCa6hVm&FiT-tqb zP_vrJN9o%P^W7eruLY#{p0^M;8}S^-u?QVj7e58A;;ghdyJ4ES+yHk2&;( zag!P>#wlZIqK39-Gm)bx!{_mY5M!}`+z_YxSs>Te4A2gFzb?h?H@?waGRk1T$u{Ns zT_q~VtisCAD%%~c@M~Ju0J1Z&fDb>bq0Mh82bo0kgfm>D{N+{_cN_PTz;o^-&aH^X zm8G4;rFx6jUr8RJqqvdN%r^vlig?~0rRd8@}_(H;;>MqAe$KXuEOTdT`o;U z-qiIfzsaym|9ge4#)Z?${R2|I+onEOW^S6%@OviusHr>K#XF3v!w+eFQ4ftkjr~(a z@s-#Hj)uSvx{tHx4}-S?L>iWnU`R{AlOm_L+1h1!g9!oboUK5ZGWdCp*6 zICiYBWOXFoobNJEkL?3#s}F=QukQ~=p+xI~Dj(`-)SlO+JC@INL%8;()1I6fo&|E3 zf6z*MqU6Do{|IKja_`4O>7hUV#S@3QK$(aeM~>)@nZz};adZBpf+AYxvQ$^j_R`24 z^A2&pcUaqC$-Jrej4naP%W7I5#@%dpx;AViL)_Q~E1wYOp?Nh}A!ewrrRd$gK=PI0 zYJJnDgRhwIyXDI2txvRU+YDSU?`Jg`)*PbmPBIs}WHNPm;bgbHx4iCHFUTKDP7VWE zj$wLa+*}&$J@5N>z|xNV=8VP*_lx~1oWx6nTNQ{SnbVpAM34NwSCS+X|fLg1C%$Omn31Bt1deOUB784fj zqj?Y@Y>!9HTtZm7UYc|XF{~GDP7^2h$U%!vpvig-#-7!oJ(I0>kTzADZGwxYl+7h9 zP_Fy|V5jUmvtJ=k9qIxmm}#;fNitTjgqU|`p2{^zm?}%+P_nxAm_Kl%08K?LN4yuU z9PET#w1kYn&U~C+?{SL0&qQxb*CTuU>g(%Qew^5GQ0*Lf9W(C#yuHHI-H1dufPZWU z>(JRaSg+NTP&^S?R)7dffoYU#nJ3&Txt$O?0Ie=~dAv4m=j>0`Py;Zq6O|t!9#25A z1k69Qc0oyAsiX_!J<45|*>;b4<(GVz*X}rFuk)qcM=z~E-!mmV5w&7>p0NY+MU{^$C14aH;&E9x^(*}6qBk3(0I%3d-+MU3Hw1UC;aQo%fq{`i*0#0;n)72zyyou?k}L2m>JqBV zy2(nkwUVU=u%=9V2s?N8e%47!ONY_%gh687-rP`PuMMZ+9-3$2E%92TUoO;CIOWpn zYX=4f;v*+`aVJXO=XiTa#&Xgs0)KWpzY%~=wlG(@gr^|Q3`V)6a6+9?%CLvDr{9dp{(2Y2GhZZd*(C6{9mBIP=dUf}Snv4}=T zTyP^~wrfIt`6W6Tp7x309L1%`W3Xf8!mOF~KcrT;oA3wcj-aS2cTSz9cCIu*tmsYb zu3XL#UY5MkHeNId1f@U+U{7Rr+JlZJw~|luHrm1YIeqWZd2Q#HWfB^QJ2hdP=N~48 zEiqNOW#u}9%NLuSgt*wpXb-Q};6Wn1rujY6<_Qywn15$X*Hrh}>w4B%%hQe|E&n~- zT*ZdRy4?mhLf0EP$L053!sL-O%<^Q4vp>|Z0`6nYe%gjs?y{n=>)Mj{#8J`Pnn+9P zX#n>xw{7ZznOdRrQlxJOzOb)(Qz%r?fO1Q;vO3q^S`y5L^nvyiw7x@M3NeJ zw%4zR2R%rldQh@z$9sFZmaZ$-hn})ou04*TAse}dxfsQwUF*cdD^+Hr9jH>7$of>? zaj(B~)&SFbg{$6RDXJEeRZ6XoU`m!xukUc^Cbev%HK#jTD__9?Onj^-tf4BmZH-*Tw9jf)XWI)UqiwQE`u&kD z93PHW9NAp&-~>2=7~tg=Qk&=XsX|+xUo}elKkA_AluX0hxBL1G!W-q#88JE4E01X_ zuX{C(WKd?#Xtn&4@SgRNCj92nsj8suyYKk?Jxj}S6)sPEV)5SO&{|uhHqO>we=7Cw zi^sAc#Xrc-gl+C3+_IK7WqJFSkWlQ2bZ+JBJ<#a!Tj-z0=P7xmUhN`&VyUnjZ5xuz zMly*5%^8hm&yU-AIEvmSpDtl0mG_NF{XE0C%3y0gfK*USxsb*skjR*6G}*J$@Iw)z z%I$&gdn%rzSXh+RW`5VFv!w}z^Nm7tGt9&0mDMhLON@>U7x9PJpE%{8BGidvCGIAhb5CaT`RQ7Ru-Y9bzc&zdXC*fZ|t(J?SNkqOQQuR$`l%Mbq326Zg)OIrC0~UUDK&f{pFN-logTAqg1BkAGFr&du0;iR!2Wr%k;uuGmW22 zT{Vt7av`^bC;FA~_KTc+Op%Z)vwBU%z5+ZCHiZpd0iz7jC*~`IN$Q9}LS0h@?Xt1V zMVjgpx=7SmMm2;M0cc9OI3)WtDsPMOH7of)YDAqz7tE1+62Y(blAX&_s*BB3xy&)u z^fjfA?ht{d;_8LU0gEWg0L`|=qy73-%oV!dIKj=^$O}z_cJs2av&;wUhT}&>IVxT< zM?T!5RW^+=>3*BWgpYg79@VUNLJ!L7ZUU#Gh6l1L)S=sj-h1F8JWfc2ldR1a0xx8?@L}TXt zAurL%6{nwSQyX)I1r@HW{J4aYo&Bo<1N`rp#0S)}Ka)9d>x&2GSyWQGMhhTHtx!f< z#}r0ru%Exl@YYi6-;z(0U8f#pr6mTlLL>6bxk?6c8?n9svG7DxQC-EIk%#g~3--~< zp$l=MTM}1{L$35dYqv*SPD4YWcaQcZ50oWFD^0uHqFW>W^4ep^0eu>c@lst3KvQkq zt+O|P`{1emOAA2oMq{CMay90MwkG-jhae*EDH;SB73Ks(4|cq~TG7VFt0l1z-WEwx z;>yAu(lc}z{@lPAj$1Z;m}TpwR@rFlPoy!GT3dTQye%W4kX+-IissWqF_$VXgaeAY z5WCZrVX*@VzGaS9?$Xl3U36qbhwuPE16JK(${9`*$NZ4>c!?L0D}XV<-k4-m7?`%` zGl}JFw@(qZn z>iVNc7R?$jvqc4+N0Aavj$3AoUW!_&0#PS?QU*q7PQ)uNFLFr|Z8jC*pDV^`T| zWub;~Kc+W+%ReD}wjn6XJIU|c5P$mI{$VVR(5KqPcEYC|up!^J9LMEDnwKO!# zr>>H-5SmffPR&;A{PH?JB+irJc&$&uM=}xg`w}WkY}LiD)pHFX0>m$V4B(d$=&QKA zcwwZ_DJo`eCf8OyHa0Ifv#h*mI3ga902{pWZP2%SyLZAY?Ts^1@A;FW8JXERbt=V| z%d3yxyGk!l;wZ9mqA0%?x_K+0`Q|tHAyC47v6Q@&1N%9V)!d7NeE|Pbq4#P!j*Z>& zZPV8sP8&6-eVoZNP&fVRGyD%3h({#R2YYW}PDvgWZa@sAvNh0UKfkQ(4KFt@a|to%Vp zN8Yn!C&Z+}4kIafu1MEz(?^dO6jWyslygss{8~s87!HXpi-Nj#D6?xVKlBWR#?nm# zd#xqj^0cKT!Uby-2f2nkKOai3V;t`{<71w0PwV?Q+fRU>%7mfY`>#NU?r6WU!Xw^| zINKI+w%l(2<1Y^WUp1Kjd@?WezbNMX{5JTQT(R^m5YF`qPG%EIT-}U|MN`3HGob1k zG>XArXlds=z?0ks@B_1neBOS4InA3Lc9(Dk(;vJa7m-2AN1#$|_3|Mx&$}nRDEVk) zW-8iBt;8mojDJ1dKSSe+yXVteP0=4iG6R(zQV1q*e`A}&ErcoA;m?ja z#tDKd2XK<;T()OgWhRk_Zxm7l=n89l9uB0jZ@j0~xmq~?c>4)?Aw%_AJfM>4Od8 zKUUW6=?`bgk2%L6Iu31#v#%D;PSMK-iDdNWI#$<($?oWXk5-52KhuW%+Yy6I=s^u( zVBkT)^yJpOjQ{O485}}DsL1dzZMlq&Er;XTH#Nzaju5#|-+F8uPF9pl?!#vXZ~J2F z`1Cv?G4pSxi%o%iiUZ$Fo$Ed_@>|FEg)r&IS%I%dx@pBOmbq&!E^8HNM8qsM{$?bWf}U3(LMHmEiA z62@4LR9$X6sd~Y!0V<`8n4EmV&ub)x!If zhO$RROGd2+ZR#ZpFJ?d2fj_e8JgRqSD(Q0BRXk+nQYwi{dm6L;b?jdrS;pM=)lBt| zuXMbBJby5|GiAN@qb^}3{CYP~abPF1e^lMH*Y|TkSwv#ASCNoJl44A;>pX33Sny~0 zHMt@|B34ZYe!_m`YVX!og0ag>CztaXd^V@6Zz?{IVLv^B1*&r-q2cE!S9v-g?{0K4 zecdOEl^TV7){YvWo4BPlI6{&N5Kt+?HSL;g_wfoQt~mRn)~V;yyXWsE25&Wlaamvpe1>jJl-d=;hrJhA^m6 zD@ZL7yn>VMXVI-e>99ho=x^C0^%F9L4wTVkbX26@v=R14r7gocs~s+NFJ%OBbcR3E zonBJh^N`(WCx_ufvjsp-DMhlTsv5Hv<_}$InKZ1a!4%;2QKR)G1hC-i$;mOiVR7=7 zNN%8%vFLoo-ywIF$yr=tYgCm$PN6-XucqM3FgP3#b9b_lLnD4`iS1ZhCxRT*Dy+(H zXv6_jA0L(~oyKFOKI?5|xbC)nE^^}K`4n>#HG{=5b)@8-#_m`yvMaN5n9IC{$W8Ly z{t_eb`OM@wO!k-;?V9f-b}Pbs<`4J3SgA)Il%mZ$uo0BRq?)<07@RWhosL$zS(fjd zr5a~h$BEG{8S@m?Q4dPqdI%tReR*4~(q1|;INf9M6zgj^0dy$~9YY|2fMHuW<#Q}{ z!jFh(?@JdvsOZQ=P(`g6at8RYq}#J1O_piIL3YcPq}uad)@5M%iH|`?|JtI68Fjp6 zb&$AUa1QI}HTi@t0aW~zLVFeiD=QnU<%fLo=#>T=!%-z)p}dW1`mE`3@@(4e0LLYm%#us3LZ2Dt*Yc zAjfS>jOvY%o00nM)pt0Ck~vD|Qzp8{Uh+Y}hL?7c(bF!tY-mH05PLP3Vzqh@sjkIu zBXT#F>PtisNyW=r>PX0lHO>17isx^CN?9P_@jftMlhcL;S)z14Lgow;@Ta8g!;{gm z{vssXVVJ(p=|rAj`h}(F0~d{KA=@d|)6h}*GTdMSzEaZBSj#cd`)1sdC&pH&o2hei zYJoL5wvw*5I<*pLCMzgQPlKPt$!I%ZRrq_M1J{+*_^96D-RqEyw__@>jBsnc1w@Vv zi9~N%zTEIL@U!DR>Ryf_kk-s#9t4s!FSU4y;32H_&fkw?M_P_9UmW-q`BLTp5&W=5 z2ARQ=*lr84Mt5v(XFSXcl@+wj9%V6j$bSTlE)J;h>ty^23dNuF2P`+(9kcTdIZ5cZ z|9UdbC>{Xgy2VgoHl?8qvYsD&7MEYNkaO= z4gZY=r9*=F&e0jCZ>se4*RB5Zp8xhmIuO+$9)%)!^1q6}e~i^#eNecuVxD;~(a}kS zN-8C!y^k4`Ab@?w|0YiS;g{bBK0UU`=exKu*U|J33L;X)#H4p>hW=l?=l`}N z7Q|nE`ap-^tE#Gud^TP|L1?AobXYLj>?FbPQHGaCBv2xDMH-~k-K3(miS>55|`;jgv=!v zNQ3HENWUJHIiyEy>?=SQ4lM%0kyRf>x3Gh;*d^wi&eKA;F6H(lO}iFaQ`~93d3+Zf zs)u&hKM-LUg?R!k{eC0C)jUGO`iK(?1C6-I-o}P}{zlh7FQQZ+9eqBsfOyxLY%sqi$ zNDK`$x8q&`gYU9Xty8IMOimI4lS7)YMSL_#aiV=j>PLbFZ~F>dP|!rfv=Aimp)G#h zgO2oLO7a=^1I_7TM~VWqG6j8f0GLQ`Cd@s-#Nr}@5VkqTDpptcZ-BHkZ|d>zVeJI`oZ zR^=;?ebM_d;Q-H2xC*ATG`o(UD;9o?5_r{O)2NH$1@o2ICyrFbRJ#^rSP0R5`*X&CO3uJ8x zl9|wSqP(D7>wRjc@;7szdy@B7BKx<^K+xhp3GA?9Q3+2|7|MYC8b!HoVscLYB&oIf z^BD@pOX}?>E8SSq88&FXFMq!W2Tv%L7n(824e}*A8E{+-E?v0fp)@$kGe3sB0%A5M zYno)=Tllu*DkYwKJ^!%@AN~wW`cM!SK(|CuMUTF0eS|Q>OR%Dg<7Bj>ite=n*72pBb@9IoARM0@BRgE`$Zk<l(^~OcKZu#+ zR}b#P^R9AvlIHr~&sd4U16=re>L7`$NHCw0QJ;y4>Be9adXI76F6Wn2739048vL78 zgTiI*S9!_Sn5wb98%jlXRQDz`u#2-m{cefkjm`fw1%xPyq6Gf?^HgUT3Q~oD2 z7^9{YHC=nS-P>jcvgFwDK>WQE4ObZ|oGMmM&>rPm*R8x-sThi|?p$WD`zzrv&LbmI zQ)dh!fk;dWHd$HcL^&K98c(#c?O{J=PHpLh`Oi#s`zgKc=pge~W|^#% z7mYA}2HbeUw7G|nQ{rqS1R(ZYY!^ImPXe=FIQxkFl&TKFM`+&-@TE{G=juUjJy9vz9EE# zF9Sbzg*H<%LF6>P^0{F%^AI4Sa}jWZ0&7r^(D7Q`;5jE z6uIhkOpcDLPTI#>`2X5aU4c;KiiL@H+t$be) zI8*ekT;k`NxVHK4xx~Q}SbhPaZe^B{>FVJ$o3`+tlZlB5x#6sOi4ztxYrl|LJ+g1S z6vHc#Tr9*PJVstHSY#(Drla>5^ChB69EkAR zr7x@M^P7Y;<93N4kdPFJou zqEIgYaB#Gd4C)+Bk6nsd7|<<65? zq+Y3&VZ&;1@Vo$ZGlgm?t-8W+DpARy4Gj%VLMRv~>m493t>!7}zR7AcC30c2Hz@L_ z*7dw-4SQ<8H}!5}f@!Q#oB|H^S^B(NiqJLU9fgdjb9i0=1%R#w0jt+k8(J37upagn zPcR&fHbr^!Qk+BcP1seHWXK-hm@Y>{FL_9?RDAu z`>J@x+|k%D0-I{$ac_d@)4|#@MFU?VlkcV_0Qinvo*_6*n=x!zq$^-{DvUlYa^16fKtojgn=v+B>5zV zPgu9>{bKRbM?zDy&#mrxb+2F%NZ`M&gu{gS*E!V_@JG%`_zZ>e*)in2r@K!r4A#SiX(biCHck5>5yOyCb`rN7He=UEk+OWuW>T8LhZ~14$rUqdmolyY zA7^g?6jz&VfhHsb0!e^i!QCymOQ3P5ad!>w4j}}0_uvk}9fG?zZo%E%-{H?cQ*$RX z_rCY4QeEAr1KphSo&D{-_S$RBH(ByZK3>4gwwN_YW$|jYpr56FNXvX_czX6-hiGXk zAqYl=t|J`CT5Pd`3TExLbVvL)Z0mCku@MvjLj}O8(IyXuk`KeVzXr@aQii)vJR?7UC zyJ&-nV?8EowJ#?sIp1fWRdEa`vvE8hN(`u1PJ0{l!^ z|JpDL#?V@0DI-@Tg2)hG??C0TnaMAW$iE7$VV$>kl|(Er{{d%nEHgcKL%q!}D*uB+N_ z4b0e*I_eskiMM}ylYzwlGRNGF$7Wh)XDOFeWzP7kM7mCT0X#f5YsrIOb&*QPkw*tk`(m9EZapiEmh%+u8H|xw4q%dz(a##et=b_reMg7PLl%(m5GaafidP z1VFtSvc~}yi2;$b(eG{x+@Tv5hu}TuohsCiJ(eJ#$LY; zN6O6d3cQuNw}YCQC4uc>)6K3{wpn@PiPU@Kwk*+4!z?3~egO25Fpfj}GnZVY;d+%j zCJF>?OEOwOvuhBckmwf)*Xuh~yJJz~=&tL128N~44ZdHA=Zyql5ST=8EQflA-QDwL zPZfdF4^Avqt&V3YRuR>5=MltN@l2C?4>iR*VM}YgR1v6LZd6lpwmf|qkjY(M8<`p5 za5%07q{>%VipAgUAE}XbCv|Na*Qu07r5QaZFgO`gfABd@CNHgzvDw=f?|jQJ4&`&^ za|^(I~u`?rCuXi|;*bbkBx}fSXN}PZhgotJs#` z`~NNedHtLd=gWL2()!Q_>f2jZ;`hChuCe_pg2z_imC`Fe{nkcxyscb{Bc*ErHaqX? zSy1Ofk#Ug7I1N+GSPqKycT-_z-M(DHrc0zpRjg~8&r=Y8=|YXpO<-F`+Y zYo1b^VGv}I+J(uWgqF6_rkCGzwl;#pFh&eDA5^9b$pI_P>>owwk!CW7VqD`&BI$~T zj<6lv%Z{augQXKMe5q|aI?wruyY#S}RpT^p-!FJld0cZ+H~Jz3XvlIuZiZbK#4GX!>T5&{ zHD%X^abE7xWCjcYx`YuzO(~-ETVIwuGo|+Dwk2Bhrf``FiQqp9zriWW$>*tbL=VBf z^+o~Hsy9ZzIzKeC`JD2JacgaCo$91{Wt&X$ssn$WW6IChPh5vMP9=})bLEE7tF(&s z!BxS+SlaZlY%x>H$g93D;{aJ+luioIk`m7JD>*{ ztQGk5dtXD>i(BY_fg}IKF-7phbz6x&No$p|dRYv!lZ!*(NHzATw}u(&b$juVG;ECS z*zSHl*2BHl6~&!X0VL@QzP@mGqL3GggghIFl>RqozRJyZIRzer~iN z7ikR-S2*nJ2!rxKyIyt;#+;t6Z8^_Ltq8Nl01v9JtQ6~zNq>w;QrDdf%-@-`O2o6E zSPM-KVJ-JtZW`5kbqjAnr@Ni;iUtXqlyQH=5a=jCbf2IDY5h!40vaCWJ8IBFB+smt zvfWInV=1xV7cfZ7OprSNtW=}oTX1p@|4(!ex(R3Y`mFcop;H5+Bc(6#7k$=GupJ`c&3n|l3 zOL0Mi+%o}$Dm`zyCBNAz?-snPMU^HCAM9Hop-fQySZ8?ustz5EJMsPUiTeVe7Edtg zE~cqj2MTm@t+!b(xZxfq)I>AEL(`Q-`$T3C@g*IYx3U8t(B1O@ABK!%v%90ze=6YW z@LrgUdFmiwE52~DB=ccqGx}ke88=hD_q|Qtvq!!a*j#EZzo&ZfXM@;JB9`PnmBy^E z)3ccG?`n_{T+M8d^TqEd?zyyd@_M*_Tx@lIs@dpKzvPiXDO$9Dhr2(n!%KdiRz$pJ4Re-)k`;kq>Tsn7=w$8Q7@iUti#6LkxrCjGNy33ntK_qopQtsja0C=*9U4wC z(t}OQbNAaVe~hZ`0=c?KiS!{|4m8sbjG?9lo`-_3mqwhB@_iADcw7&}XD_L4VPIei z+cg^P5(*UZi&Bkp+WM7BjXV1$Y((8%E|@4#*0=$@x4d=i{;ShvH%7%)81G}G`6`)* zP|{S1Sd>WCD1BGyYw3=upYhhj3-m<7{<|0g56>Suw%459KjXQdP^55retJ-cpw(hx z!Pr0L@<+7Dd3wjm*gZYNDi7cYCvn8@&T85y5f$UkHlclj))AUQa|YRNzZ6f&D!ja& zVRR~AH}$pfCb3!?*3+r}?~99p`DtbC;L@G?}0lP5Nifq`=%`?G~~_YICl<%CORP8RElRZO}AFug*(+u7XQ^C1_7@~wVo zTU9?s0z!NPu-}eETXSfE9Ufa>B%X9mRhsOwfN4p0H8hwb!p?A_&me+9s3d6Fn2cy~ z>-}af8eKQ!_Pd}CiO!1yUi=J;=5Sfox}nL*P>0Ukn~lmIYQrRj01$JqV43BK~w`z27E5bb%9_xy)svfPv<+44KSCn^(X(+vjMs#%MUT|B$GJ z*WvDEOre~{5=nn@zpI2l?#yhBdCH#s>E%yWEjKCYG@hs>qZ-R40yJ5d^}d)b<#&Yq z1`&jU#KL6A8Pj*pr=y{gyV=I^ExEuX=BLaq_vo!!Kp~b?3a3=nHAA-DulH=1x=6G9 z4sVC5V?@DM8SQs-MmyPyF!l|p860YV+Ij_in)U``e$ZmWOQX;wYS-MPEoC@qiuiL zWtt3;>Bx^^*I+NbJT1);PfuPc_0;Fp%gI6*iX*G(?eU$L4v5zO{03}~y>Ho6OBy(s zz^X-o$vyON@3=G3R2W=o0wD;YeB^YL3XOh$tSc7#J>}*WFnZ_}YZ^GU=5Vgg0`{ck zx;m4uWq0YQORKY8U;6K^PfV4v^Y*rk$?GLX`Ap^m*vq`ai*rOSH3#N61sOkfN33kZ z!bh=da0O{ZzL&7UBPri&A;j5*M=EAf8cOCk8@#tjMisDX;UhS3ojOG?@-Ga*5s@>eYtC~GJ<$CnP7ZC%T0GyEh(P&;H z+{a~yFJ2jH9%_kl9p2Fc%k!EC3iyQ5iBSG7f7OECHIdJRVUtg0Ue3Dy@`1nU`C%(Q!`l-1ACQ(N@2|69AbOW~(4ft@F)Nu*mGF6%-ZdNJqg5Z99;JM{+{K zG2>YasY5q$(5!gLJynM{HJjdQUJ@=Tp^av(mFUevy}J_Vout+=`VwPu;O$i}7@z>& z>j$An^?TiGXlUr`%No+3PA%ot)GjHX8J18W(c|$t3jy#MffACzMEsN3djx=?A;X_W zn-%UC&il>US65f>Y!BeI3+Bs)=y}`(mVt-KE4CZ!|jHxWV2k=DU*+@#6}m`rZ@IzW`Ab`V}4#fRU`^0Ht9rR zP-8|=!HJYm=_{XzLZb&;;Mpkp_>2u1-J@C$f^?NNN9*RBF+c~3R(uVX@ z&IdfE$OGTb_dzcu-MM;n zMOiH9ma_sBdsjsF&*tY-6$V%tLNitvgV1ftvJQht{7IY<28ggt>MQ!zJ2-xqjAP-? za@*`}Y@&&}I)zuj-!>6QW`eVO+{t;0^jGs-$4Na4h+@}ng5pY#2nLJfMMHW*z|yvq z8hTwwCk|b?d6O0h@Cdn_j!a)V5xRmi0Nd|v|JE-ZFv#e%8e<2#4t0j-rekrPv0WXB z^F0xSD%$bbt4()R#sPbBdD_os%Prm(t29Hl%=*7E?~ItSewOdwmesb-e@`<$bt&i~ zq4SY6*LlO=_cL`)68$Z!&sNy0luAmtwc*lK9Bv1GnqBnNTb^8?0nuxUj{HUap2uxy zmrA8E{&T(CxoL)3f03@J=3Ot?XbtyD{M__)1olLqK8jSzgS1NpUxH^>yq>vgbvUo| zbR1FhVzcd3vIWJ7^U;w`29!ytRd1K9sLt;@mx5@d%*o-VPF5E4AS#J;l3WB@eel*j zynKeCL`h#i%PD@d%FWl;*Jz$!V&HCmD$aD$5`z?bshwUdX);+k2~_m%cUPONVd;BjqGQwpq_$s zLd?&2dc7Vss`3`X#75^+LqiRQN$9_`yuYK%U(vjmG<^AsC_;qCEGFHKL$zx`KlP5jHR)X3k{j9P2%g>T(1Iu&vhU*XPe7Y5HqWW=yN{wEphr1Tp<=sH zu$>kohW26TTCds0^x}A9f6lbBg@@bqLx_6*8^uZyqylhZ4wpua2hnw>aJKyH_(>0v zKjqC;4?$Q8o5_!*%4BiZBAzCfyj(`lBynU?=@_J7h*%TUk`J|}c7F_2E~W9^L3i5r z!;5y247U`Ilv_UzF#xfK*vLV1a;i~kN)W{-*Zi`?SRYr$LzCrlzLCh?22?954}Z3- zxE>Wqxw|BTK%nqQeoare#mAdLHGO;8!?rbz+8@n9L+nBM=Pie*FwKu1$@JjV`ntOC z+}zx;=&gv%Z&FuRMBD9cTdxLHb5xJCspZg0!+bvkDikPxq9_nvcZsG_lM-T6z>@i0 z&&s@Z61?h#%p~)u-73VmZ8xdw$b%qD^)>-RX)SyaVHR>qQ+zusn4r$Kw4E!nONG8v zS??XLc`fG!w8Jolq``zsGUqr7I<4^>�MLVZV2H*=DRvZApUtis2`GD0C3TMn75V zVnW(nhXKyZgHZtOT`Qjqf<0<&CFpxU;eV>0{>axghWaSN>w$25mT+)OWB&~0DILX+ zLb5`Ouwm~b21O<8wP~~e>ze!h+(Zn&9XhHg23zr`)B)?cPlH7H#0;_LG^{>Df7IdH!w62Qtshk3u4$+NW0BR)fe3Y#IE8v|zJgbP~Yy z+mtM&ps7YY6mdLwZ+(B|ohW}cQ+JklsTK)D{{pYSPunx^8n2%%!l5!j4mkPXu*FK} zIR}iY5MO=lx7IVfg?SE{IXkpeyRZF}`FguXkr8mX#i*}zy-7Sr3bIHy{5^Sx6D7q! z)rC`~V4y8CfnYe%3RdZfVI+HtJFOMkwret-fqJa|Ir%0mbKnev36#3)S%$g|4H(`T zoWF?}bAD{~%$^Rq9egw+XnI_Bx~DZvv)wV2iW{s3ltJhxAGc;sH&2p%RgiPtq$)Ou zwYd5Sr8*N?O^Q%LaA|00OhmY_nsJl+IJt{KZcLp(*^cN*eoq>l$yRbJe7ej&+}+jz zr(ibrir{3mN3@wvvj<%mZ{1A2R$fK5*|bU>Q&=R0X&G6?kjEaAIa7o1eg1psozYb? zCbzQ>sz0pC&M;`l#?YyDX!qAyvJUFpXE+?U!u7?Z zLXYHY^;Kr8_2PoR_pOLNcyKsv0Wyh8%Bc9#NnGqI+YGnoJE98>cCowK9zbU&^B9>o zGboN${5iGOrYj-pU7|e}G3$1GPaN=O-ysZI_Q~$1N{d`sIVyy_iYAfyNnCF$_~*)K z6QGyCfkt?GiT>tkv*hE8;|rDiGCUgV0%u;S!v1nWX9dO32n`bt$S42(^iPeBfx?PW*n$=!RqH9Bd-iXO|)Qa@0MTu0}uefsh8IVeLN3V z*v#X|8&8s1_J@nYM2c(VVPpt+S@rg&NV$QA$Am%eu48b!R!BO9-e3`e(&qF*5~($c zKBQvc3}G`fvla4?WV9qfWolgJDcuZY&ktX_AI{^_@*D&PRiB);?!*QvFZBn)ct;ev zei?fP@{Puq%5}HVHnUK}-hp8s0i)6EC#UylLEOHDCIgt zYJfS(q<`i^5ccMUG+fVPZr7ULVY3kS*3G0V1Q{|puXGb~Y+s(>ZY?@`je1C8F{7;X zg@sg;DE4N|l;%pN59fFgEWB!ArKES9x!5^3Q>g8pqGFCkS%OEW&2I;^HbXfo&5MyG zC#S-E{SmUH6UMUTmpb6?njo&fw4-RB2pND@Zv1D~$)8Kownq2-2K~{1j7xJgEw#Qv zM^V>}RZ5e4n}Cj6iQCe_f@k=Z!N8U30RNsKEkuRHMz+#Wt$|Wh_LHQjpyfus^ zdC!Yze=_oX1%??8l~Tk6Rg|HLr3ayRZ>cH;3JQu`jYYZwuki!d_q40WfDLYw{P&&q zvFNzCp9beDLv~IcxfB&w5PU5Yjs-~Xo}sr$Z(hb$SHDIAEtMDRa^fFNBFTWF zk~7o-a*DDxQ|a|yp#}{bA5EHLWBpl^IFZ2;b20^JxQT$&sNj!b2G{7z8AiSRW)x-; zZqR;^fCbQyC~7@vm%lUW=t-N+Dvif9CI?%#3*DuZd45u(Z13wpiBF16hCpV|{g}I@ z=Zvz$kSBUdm}T$06m`YLsn}(Cj0P9adZ#CY?LKa>+*@L6U-yfEvYeX+T|U>#jFbNabvMCdER7r!-Ux-?N#R=++AJlVIb; zVmN`Q(Cw?6E(EQW=A(b`mL8Uyr z_Vd7dz%JZ#?MHg0$)H%~sx4<}zT>5ZdbGpt1&*`+a#@W?VJfD0AYG6;su|Ft@D>U8 zB@cY^{H93cI=R#pEvB!+xps|cLEue0Gl{&cci_z)m@++cZC|@&^n8pj2gHT?%^WUw zNB|k|uc1kLcibgl49_+_3*^hz0)rsIdUK^0=x7EN$M&P4iUz;@{~klA7fG$`YvXh- zjqj_ZEGe3CpPY-%;!aiAsuoz35KM+n-eonPbYA+&Uj=Y!dPFu7OvEav;`#V&1=f9%P%^EliF{Mb-$beLIC_M>0cNe%){?5 z@-?&}lZsF;HG!||0}$^%e=kdyUN`BA+URlG6ZfARfGR8Ck|IhgSZ8#7i%&@z2?*Gv z=swRc>t$PamzS^nTwYOud}-w1b8Pg$636ps%He)83RCcXa$4C$p?irDJ3FXFc)U-u znmF?K1ITx5hPVa zk|(n&5&I1|}I zZ3!d3qNK=7rv`6I2a5doce~vw4%TXx9Rb1dTI`^iJrTP_B0;G{JtuLjI8`u#0?Ckr zZ91sOT2y#Me7lYDi=fz4VxmVfLjw5Te6~Ksa3Gb4$0^kWvFao9YSMVz;kKJI7|oor zsT3@?yMl0Vxi?2wGt+2-Y+IdVnilQWLd6-uMI=0Tl%`q5u%J|8x!#GrfoL=5KE^?yufw$acQAF?gH7K(&g=36Kp(wjYPa zntdL}02iGscwTDROjYKcnPTxsgn?=Qys*YYAORe^z-iceXou;z?~kDoz?rLJuGch| zy89^#piIFugWnGxd|>P(J}%$0nnOf*_}UTp_huWExUNtMIwJwi%%O!!mj##O<_T30 zR7l1wvsob1PWL){i<0U5_vY4VvCb#n79@f3q%z`&@zR?HZR%jYDK6CCSu?P5|MT4s zsVAk+5Rs(=!mlznT~p>h{@V2>{Vahf+mP!|^vy#rZqJd-O493v0fPxe>lQ)bZvUqJ z$a4UX$`llj>xE584&<(z(!jxnMttV|hTuCW5rQU3$nE$|9Zmx7k8(a-=w)Q7ghXZl z{hPm`;@`0+i{$yk$3(D1g|-dAc!6kUZCOz99Qh^)du1{J@STLvvpzVayn#7|$%}fA z)12U|-iE7VS~b!EqB(D-jU}b=%bI@-EhpbXT96% z$@B_VQ-?D&jF?>tit9_IF5g^Qzgx_c*p8Ho2ka+#ne0aRe3nR(OKz9ih4ot^I~`v? z$_W{1HQS&{0>qt}YV&qgig^8HwFcUSZD66iav##FC0`0-Hiv}A(%py)`}fM00{mO5 zTQ{HqGxMbvNPA>5H;UJMUfv)-I392TKyaE<G4ErQj%C@n1}n; zb}#uC8pe3ph(Wm)gD2TcCOhahX~}Z;Ys)^QczubNQ%g*itxGm}QGV~@N#fTk_kF&F z$>&V5pSZ8kfWjvVj0s~XL)^F6TB$-T>6#<4yq$7iz z8{eQwiOvSnFT4G_Pq!OYX8xI}Z49x`f@EH`o-^t>h5%xg0GW0WF)wO3 z#KS^fUYI(6Ai2Hu+qc`boB(Dxz`H0^%sz*A@rl|^d$BtKexNlP)jGsoSf5pCyjYsC z<+#=Uv<`C^Cb#Rb9RM5iEqp{ql?+!%hiXS7zCf{rxL=k(Ynu+YR$Gsrkhiv+-=8Q~ z;tn)F^mv?Ap21qi(?-uVEG`G#h6{{L$(#X)k%Sm=TpYm5t5VJiK#b;~PRl zN{<_1wT7?JMJz0dMGP1GGCkY*sNclW08c8p)obMhxx!VF z2w-vsbL~O@o_YHpyaewee*9&+XcdD_WwL*{yw6~X`M;}eN&zymWZgwXb|U)XmRSKr zB&bx0N3By>2`EwV#6Q~tHPo00VTEB}qCAYBeyg{muNShQ>_zR7yk#8N%8@eFC;9Vx z&u_KzEHFEtBYbl38q#*ympYy$2?m;Vsxny?p!o6?dy|_H-qPF}WlNBmQ^?s8 zQ>!$70J?ioXmnbi4&UPF9{uV7vM_zl%WJEFThmGrDFqx_IeohOU1?K_4f!tf(W3m| zj_GoDGWJ21h}b&EFbmTL21lE)Il9Cxy6>ZN&hXsE9H2 zArfx7vjqex?CoRB=UdEo6(N=OoX$hCXu@x>beT>_f`q|(&?lR@;zm-v(erPUYNFMh z9}GMn^V@S3`Zt)&Z)$8PLz6A2tF8m0auuGN3?FFN-z2H7maUROasaLsV9B_fzv%;W zhHNrK_r6q?-otCvCyb0d_iPH!7C?EkzYx_s?k$3a=+{N!+CeB_G>a0|YUTRiv?~l6 zg#t)&!#zm|NhRK5Cs&nML+STr5Kzx4-Au2-B>Nrs5*4U@n`CV zI9$R9Y7$wor-lwgB?vHjE%eu!CCyuZxQ zrRJGnY5qnXslQrf#UyI3_h>*U$$@n!%IjNQUFtBy!;?X#)!(N(eA6|G2h0IX>_p`b zBj!>Wt@fk?8?wS&Z8(vu!_D@bC8YkvBd%P(`iPVUE|%V1;+EY{U@DR?7XQ0HDUu0; zxH>KM`+rZU_dwv>?A$joKTY;CPR zyU{+R;W#7b!%2gV-nG0D{j_fWD09-gE%6qP*uPu8TSAeIc8t1WI-=M!P1E$H2+w9- z7&d!&2w3iL!BZx-s)fmHOqqM3Ok9b)hrdZOsiyBD6lXR9NYx7H(9eADkqB4TcBdZf zE*IUA1Z9ztn26cF>SpNK-DIzQ?R1=+tnamHYbVXIL5NgHj=h}@h?*UIGJ6C7wcMgr zl)apbtZ~s~uFLZn1+I;$rTg%#aQpE|^BqK-x!pjLm{*|(y|Q96Y%AmdCiZIq|JmqT zgLO)o_}_WwKLe7J+Uu={m}Bz=l8gV;Hh3zW!q;Kt3sqxMxm`;t4#sn(cazC3v+^2V ztlO4lRt)=?9A_H=j4ZQ)sNtB&rK3y{B*-}qT5}5LtjSOIKV16>g?%W2I|@x>%g%8>7_ADL z6{dKyfmhq0Sa~<= zm(LNMIA3o)7D2+|ZygRW8~(&bdUk-B+kqV=#9f#_dbxjv@S1q9xHt>>_R8skrWlfm zfmN~W3eK@snCF%1SzEMghSJWy;bUELtg~9G196&q#=@9u>^m$bsax`Z({Hx8Qi+^k z+DSoLF#k+T8j1vu$4M|P+;i-pbLF#gK)!fe3DWQ}hDJkdza2WY!8PrHFvOAHP8i3J ziHF^8jT~UVaw}vCz4p$fSlx<2rMl`tftW<_&qKI2CIOiWQG!*vmIonD$3vuTNZJ$Y zo}7|0Ft%8k!p{WQ0WeX=ldZ+$C`AG8Zf@v;YyLr+RD#eGtBq6gZpo=HYEImITq@t3 zl0Sck8qT}5bvBnAs0SN6Uw-Mlyqzx7+ny{|+o4TKPBz{cNRTgzC*3KU_4=(-@%y&^ z$D=+26rzM-IsBLPzw7LOyz$SMjTlfC)%?V9{RtMgexj{wNeRsRhBIYm(&aE}b%w>E z+L17MYPqo-LjZuCt$hNxLz&KQ0uV|ma!e#x2LYRfA65J&nof9CC@f2NaWR@m*x|&= zF}G}$Hy!o(i@5y}3Yv0qK27Z2bP3Hl8Wb-Y;zm!bhLF!^NO@IaA{WUx&V9>;GvoFfI!6re>V z8~~VCBio4g4B|ZXGI3^Ues(QJuuevla1-li8*Gwcug@c8aTOkw?qb5Xx&3!;b5vm3> z)Bv{ZxAGvKKmdU7d4;eg439>e1LRGkkYQ3d?^GeK9zE6~EotkR?pp-Byo{!@Oreoz zX);9N0tgE_y3zi)e2jD|N9Kjr(XAyU-<=c40SCTZrbf^BlSk%I6El6)?8;4Yu#s?~ z2CrrrxLZf?tBb}pJ6-caifzeeo6TyH2`zEy3KS}Y0&{GUD7qUQ4#>5-rINFNNw#oZ zFq+}eo%y@LyJJ@heg!$3Q}q@UBIcl>@ta^ccEwR!U$6nCQjB6b>dmxmQWz(*(%yWHrq1X6EcyRzjS zf(aRSE}Jd`CO(;*v^}?PSJuUKBa*9CU=>J&&GlC=0M7164$a(}bN9P_a)35cUgWk+ z?iXl{0&*`S7RG9{I*we4+*v&a=dOLAo?m5x++3VYP{sIqBwbts5v@|%zK961WAyY z+}2{FeNx6MIBpZ5HHQx8&z>J9$V&%52kMJ*Y~b`%%#*Z#`LpnlK=jfcd-*~BPj12Q zGpNr46)GjQlR-#GNRE%s$1Po8HA6>CfnLR}3Nmd(M=VJ-s&3n{-<==W(ok|-<9 zC*;f%IX%581HqJ3ibt}7w)d|PGE-bH`bg10<=^GzDu+wq3DTN@x$V%AX;`J9}M zg@FM{Lzz|BxUHF*x;pkfn_iAXOz%n7aLae`xY7@mfJw5~1M4!Q$|3au9a>5=h3m;4 z#xbshia;4!=t-~ckfHf(VcQ5GVV|(0TmAraVNfv93`Y*Omp=i_#=`Ty^ND7oE)S;E z)Z3c^o>^$LB8!D)a6{jBY#d~B89xB6^ez&3rrTR&Tl_=r-*?Ps-dV5tJ|-{`IsNu2M^nTt17BR*kc%XwXvP#mc~N@AjQ<5XyT@F`(c1bL7%^InqGP zHnO{3GI6}1YBy^nw$rEKaz7Vt!mMzV1m^ru{Q6`=(k2}H!>)h{kdztx}R49{>Ck6_W#;)w0DiKA$$?}1MXI2fquC@yJO_)5P zQt#ef?9}B$}zK4!@_r;!$rkN!4n0GpHO?&dwJJN+whbDDP=&dNqg~R+7gZ>Y$Qfd$m<2 zCcD{V(o6Ort+a=Mg)UA%`uftR?AY#A0I%pk7!ezbsZ3gIi84h~x7!)-3i{m8AXZ+Y zk%5Y0vmG!uvq5vE#-9D$-L)`7sA??uOH@=Q%C`$VhWR{J#?+H-5OW53>1pm^&N#p& z(bpGmCcAlqsar{>RNhh@L#L(4y?##RdS$bt@8c?M4+18f@xe%5$_!wQchrACntb>n zu=s8InBE;9|2)aRkEr4Az5qNhd%S|EL8wxvHNjB_-P2% zpV%oXIXR`LPc=#|DMjU|AU-qGM=n~Jtk`b%;=;icOIT&T!kv-1$TFTX2|810C^dF> z;~fC4k0TvW=#|5sO}92NIZo2;)Xw^9c|HKS9%oYJ=DLG8yts{{V_eCNUame}Uov2y zm`;}?AtyCKBzyy@86y!d*d9CGIL^SFDA;a@w=YT2RcmQKBJkNddRQQ=H^fcJ*<0b6 zZZL;;=h+6Qxa>#er%7fBo_dmri!bmpqtmHIE7Gdu?Nj!b(AM)CynuP?6X?T1A&MIY z_InBb8AGyO0G)|STXl}$Ac8+5^lyMD691>{LuIjj{|1mxC5dYH#}<#B5;~75z#}la zW)Bt1Y$2b#bESsaUMjWRdDY+6^u)yWO-l=Q>Op#AyFQRm(%^h?#}54pI-)9uxvrru zBG>4o^b#mx&IT^oXJ$-633W}41A$`+Kz-&>s@XznMnGwAYfr*jM&{mNdx@)1qM)Sc z33LjcT3|O%%!b*|sdVHbL@3oYHDm|`u*_s)Cd$fe+%9+VD;>NnMr1~P2}BLbt}CL! zwRl>rR8-;wB30<_Ht|iGPx=%3Z-7k++~xioRX@^xwm6j?Oyu&^ApO^Wd@jf$ccm)Z z+?-wiIhTGyM3@M}gW5zg*8?+q^2k%<`%IX8If9MkzpHx0!5OK>B8{M1~t`K~<8Twk9UXnBBEs~5*#Fs3umg{&qCMbG9;4$vIo zo5X)sraxILrA+cazZ~#I`TCx=1{;U1*MEemzgSrK;jdw*XJ=&fK`+-)zVu>Sr=uW# z5WyBbl#Gu&xt1L8Wnbim0%p!kX3s3wyOLN$x{&3>DyR97jP*8`{>^M&986Jq{p3`jJga#Ky+znu;gJ|7bQzU2ne| zI~#=u7td}>ib|y@Q7rJEWD?3bfZDy{2DRhnKd9nQ&<;K8W!qs1Jp?B~T4#KEwG4P*Ok>wX4&A0r*u<_3l{@) zUsZHvAAf2)haGXh__O|d`a<5UqTe+dsx56e2L2nG^LHGAh9wsNh=GX0zci=`8l|Tf zs_B9fYf*YGG&fMJKS~m&r<0JV9J4VL%f$=B$yw#2^iH}eIg(%73f6qVHX6$3i?Q+H zJAD(A{C9emMpXTPg2LL`+V@E#W$&rwEqv&x1B)R;VWVH??f-3+{U68i84*QdwQV|Y za0-;m`4d(k^@UU2Ytp$I*0T zBMKH4#Y#1qR=2u**9KCClMDwxVQF`h%NDY&PH|5-cmy(l*abLZAlREu{QMcW$!&G^ zrs*AQw1Cyu?hIcz89%i1-myNpl7#N%t%Nws`E>ARiHx0HrLiTSApB-#l^TNo*$f&a z-{1w1DaUTNJEzU(YK(K7@n;b))t)}{{pQ<$yr7|xr`P{Y9^aDI`QgMKf1k@r!e%*e zWaOi2vqzji0|wP(gjV^l`#nyZ#B$eKaDP{o9U(_KtaVcS;ayA;3Mwi|_nO^IRl(H< zt6-GwWINqsTYVhU8zlh!Ry zF=WQpU-KG9PC}wcWXW8bdzO`~;R>?CF~s&iu>F6#{{PEM?>G3`&DwI*Lxeo<3E^)p z?p)<^LZm(qK58@yd4D2^o}$W4*FNc^sdw1r0fxCTVegekE^k+uJ68D38wg(pr#&*I z@n9|{*%)4iOOib_NC1MU;|@{lfD*XODu;r6D{&aRY(p0@Uqx^oOz#G98qM}QBLhmJ(|m5GLqo~=IpW$kjd2Yr4xE7mY;e7%w4 zw{t#*CSkGU7<_@pT|Dkrx@`%sv6KjgcXhF;e42s zf+^TPI3uLtU7ri58rIHi4t)sbNDSsgzF76jJU{4*{O5<0kOJkg_Jx=m2NRO+VukER zlrIIl0a}cgtMphCC4`%_@l)bL)AD0RW?{v9j3WLd>>P#_H_XQKBdPK&h9t}!Yd8Ba z`t4#a9sI(_1>&+0-XOP75V4R_g|hg%0hKb1d_(e)H~_yjMrr& zuJ4DNq_Dp|$K&saU|QMH$~`w8__kqdFMGEm;=^G8 z(};7U4XkWtu}A`r&|6bQMX(_Hz@{J#CPaqJ{c4SUq4`!O)fI4mX}`6TpM!%XAkJMi zTxD7bv}PI{^{JOF*-I5eh4%ZJZ=eT#aJqb?X^MwNZiCVngXJi$DJ-q=eM48nJQ0#! z$a**`Sw<=xA=OYN(qL{vyuhAYqZmByA>7^3GrsuOrmQQ5>`urw_+UoD?Y1J0?HlEr z0Ehvba-uuY==u7CBf{$&>H__f%+^vZ=bgU`^+UF!dtO(}Rv-GGY3uBM9et7YGn&e! z(o#&5y*z(^?6uZ^T$}&*LHrl5<8gH4RP+FSVUry{fjqloLa`W>o%@eQuW@*sHH*c~ z)4~1U3Y6tA3Jr)teuQ_rB&TvvQYHer&ibdz;LYuaOryZUq2r@oc)1TfU%EU9%d^ph($M*kLJMiCAEk0F5k!tNoGJCrpxz86=$GeGcWtX9x*Ep0RH6~Lnb`O1$&Z&uX z)JLaQj`SbeBta=_=t)&EB!J~`-b!ou$j2M=Wz!pn3qlU(gFq>*^r&b>P|-x|qEzl6 zBp{MuPQIbc#Zjr9xk6;TLEG)d+<>5qgG@Fz>%K%Lr&d-vb&irJ#Yx7>-#aYRA1Yr@ zmqu*IGR1{anr(qqZ(V7$?fQ*twvAi+bJ>3or2mgS_;*(IFOL*t;e@SO3>ps7teB&v zjP_=8pb*VkgG++I5J?e|;w#cis|MvmVbvass}=!uEw7p7p=_$d~2) z?%iufD@(-|4)@b-@}04qvS5$icg-H9Ci|239L=RKpbShcQu>&<=&PlrBJPg@j^&qo z6B4_1Tz7VjfLy~W50TvTYr=-mC=-W_4OM5olZ76juqN|=4AB4Ao9eH0F=IdB5RkkJ z4Go|-27^2t@wi4!R$+mRabY}voM+hs*m+AdNc#PxlA}hc*xv%T8?@bQU5Tpi7}I$> zK}Q7L4Ahq|>$0LogM@uaj<|jGXIC}{<;#hH$Z`%GoVW`*Q~ab@78+|eFvMd-tFGW1 zF?&Ch+)_|3JCqL1`)^v5 zEYe4Q9D!=;mHdz9)sypGvKht>fwJh)=uqm{=b{I;(8qyzj9~X+S`@LQa(%6GgSc=K zBnq*6HPPyD;*1nf`B!QJwOHzzDmwm|82*da4-cD;hN(seO}0iGLmzyvlc&r!c>0~I zFKrLa?OHA!_0PXq?%54ttB^<^VB74RVO(qXVVfv7l%r6|{VWM$5->>%3&edtkD+*r z3--3Dc#UZ)V>=HS&RV^HJ9v#=c8`F=PI?+w5)rGKGNwM9U8&*v7`}ZPE7~tqwdb|s zihvzm7G*f6@hai}VedV|np(Ft&}G9KEQkmQhzdv%lqwy?LPzNxl-@f50z^bXK>_JC zh;%T7-U5k;NGJ5r15!du0t6Bulsnz~?6q9$>~+pQ_vd}?A08lc5;DK>jc<&1yyG2( z$#X7Is7t0F@dbp6+E7{A!9|c{VGg=Ig@q2T4S%VYQrkmemb3}?vL93Pu!>+m1=+*O zw_or)TQS#_uI*ukamW+GBi>Cf=6vz4?X2a9W0R(~k8>5}xTo_`qQ`=8*R^eg>e9k& zaVM_6`0eoDe$g-aLX?GA5q3Z^-vb`$<>}pOgUK3yvPF82i5u?Esf?fx&XOgkcxfY( zT{)_%fY@q|!hXP87xY#{&N`+y>jJYMFkcKVaP0I0XwX9K^xIe->**g{7cO3O!l+}@ zrNMd?A0sG2y6cbHlCOv1xesX~a5c(4#8Ixy%x6BSWc>9mTPSCYw7v$fX<_#E86ikL zO$tK!+(`>~w&C*>p92U1#dHS@Esdp-qlBBCT#%cWc)e%dqfB?Zj{`$Hfj;G!*zZd6 z)t@1nw>*ipKUPQ!Ps!Vbi+OttOXR`2%}>;gFTwIRmhQ*-(OV^^s>H`gRXVEVzGGHj zi?5-6l}wt91rUB^fDOOmzTumvkscEr{bcMRb~&&+Rywi47Ep}z5}!MN=;%3x-~RC> z_~^02^lD3HFV)X!9SQBn-`YfK?;Y2SfH;nNv#b{xZVR%m_pi>rS|oFM=DHbsKRNIP zMzTgFpHArb%IHXt*V9OkWDhrv>dmz`WmOs|OgK)@E_|sA!Pq&M z2>P2gcUs`i-PUb|Aj;XLwf^~$Ok~K*z8b{<4tYa4<>0mmrd{)h}8 z-kDxT!Od5qt4V?aJ7;~-j)N!n{ znW-*YOU>w%AHP3W(;~aNf)V|D69a5dVd>m(jeUg75E)8&&V)(5K3A6bp88eu@q^Yc zoQiXMXXQ4=@Y`~MbCsMS+5I5|^`72?1?RA+D<6i~*gdMD1z68@G!Hu%pZ->Ue^;A* zv9~{YlQvvQR$Sl8nmByQ-k)gkW41upd*=-1p;& zFG&74upTlBhL_KW;$9q%4IW(xT#$B)UKwp@VMmyyL#+D3ED5&Xh$oZYqUrZ;MIDfs zkxC@EYre;jt!IvBH4&ETt3HNrO1Ew%8`VpF>(mj&nio7jMmAh9M3C39)W|WHc&r(- zz>bpQKaJ(5#a!h)ba3!#wfr^RRaai!uXMEC&j|s39__KFMyZ7%wG)GY)o54NvrhG2 zO%L4&PqMJ69doVP>)Ts{klM6+Io03;`GW$osd_E%s*^3Azd32QQzh+s z%el}cH}R(Sbl*wUrAoV!5}P^chPoo{9FOYSj$M#FyF<6w`y!sc0&mL#IBb4vbfEvF zYN0(k52;l3xmTBGf^GSM41W0xIbGa&s@4$GV>@XgIlHDo9a}A6e?$s~#llR1++iGl zUyFjEWpe&c4(No*#NkZ#*AI3Bi|0*%&(9*}y2zL?Q26p}6+|KYqTsAotSyB4!7PwA zhGCg_&CcLBR7_4{*!FGbxiD?}4O!7RnGrFeQs{yG7$K|Rg71rCGMGl{Bt4tlH4THZy(4hKo|ixxhF+GM)zSm`a7Si*e*w^Udvc@< zh0h5LAdO&gK|Ga95^*20aDD3bzj)nm{L$Z!UfxSoc?V`FZTx1L>;H*vR@5M=qM`N#=Dxi0Of>}k9TB6=bwC(#{z{+9 z{JZHGF;#Bp#JDwd*SnP-4{t<`*OrYrL=)R@XxyAEat*X9k`pg7H|0yXbsbHZbUiqf z)#S(|=$8I?_71TdU~O{&J+$$+$x+_}{5-jau_H!NwT_rW+THTs=(s)coj%IgsTHag zyZ6>wdG2UV0t$_C3zA6k=cQR0|LzR`%Pkgr2VKT5{yrM6qguV5}ZN zx{iE$zB4X-uA`PLmB|4XZ$Q7_-Nc&PoLC?brJ#XOT&-&Rq-isSS$xZSv9BO2eTcId zIp@Wjzx{p6+)BTnT6h;TdBlkTVQtrxcl8#p z#{O`e@}q}QDL{RBcE73=OWEn+?3>?Dh?xZX^eaeeTwNwMNu&Vm93y7Wck*-|g1q2o z=Iw}$X=C_at1Cn$;DlToB);>zE$ftcRpEa*VGd~qzu;H%cga>XVQSBK9L~ghbz8kv zD6=HnC9m-wp-4VBl*?NhWI1W@xnx3v-{3pe!v^!5cCkG}qPHZQI8!$+>3r~fKEP{X zCC-86(tuv)QMyf|h#MCY22d=k11~bA9%0`P-%Kth6|9K2vJ_I_2+W&4Rou_+*sXLtjY+6QdH3b(+1@9f>H}CwH z*+fQ-=7fQGBWA6p7*rS8Y^#`@hDo}UCC!o{C=@M^ zJ`?Eo!rOD_eE^wo7jxd0E$WxOdV~M=N!I`IJo_0?x$zzbdTiZ__`oLnp8M#}nh?atMF|G<=!%P0ynEBQA4g>1=e_H6@_wpYn+LSrda8+O!q!Soe zitI-**!Sl$vW1VB_fMzD!=wg_3-zh&ZE2F_0}VX>=07nN=O|6zr>sV82513P%k!iHC)|E2vUu-^bA6#g9sh-- z%i_;psU?XTeh<3axW90F47%%gJNQ<;zWr30!<@?G>EvHd=`T^g1uM(nR5qQB`-p{p z?)~4M!BzL*!^hT<>4IinJbN1BPd>deE#_=ZM_MYr!tJew7>|@FXN6X2Ca1c_#7I1# zX2^IO#qd9H*dl6Z6P}JGxS~F66|#)dukH3t;oL;VYhZ}}GMla+YIRW>$CTJ&>Ys0W z`1k>Q&xuXd=Y_U)r(jg*e89o8A>f7daUsO}eNYcc-e)o<9FyVJxt$SEs>mF~OoXG+Pcw z*N(Zc6sXL9^0Ax3EWk9T#7^;7+bbNX+GfDJDJZKNzkocL0$-rAbvN$gFWyEucZG<{up^{jiImB^0>XX z`Dt*nNNg#))pV(f#Er#%NhJN&9WEz86it9IS`nkn?JMQc7pul(W>h0vi60**2C2#h7 z{#V;*JA8b9OVI^YP=Oik= zN~v(V#WH?nbAGI^YH;ta?*=SfYlZFYFi}LkV9vpzQ;TA}fUgh9auIzI4*? zLy{Oy#GZ3e$0W0e-nDDp->Rj$*Q0ney{X1Hox(HXueH5=moWIwI79+;db9ttd)D2t z3~5$gd^gN9k%`aX2>>fI5d}pVfbD{@-p{q|-tNTxIGUJ~t*)V6>OSj;7@dIwsiwog zd)5n^^@$kjB0s*n*$n!UC*?lBK76|!q^5_^<7yk^)m{)C2K~O)Uv#gYqv>W8O<74k z{2xz1U(1f?Zh7E zrOQLjV2gue^c}K}6x;Q${Ric`yy=@e3y}S8Dfk<|0`YEC+E4zj(hP*PbsWQVH=>^1 zJ89$89Pt83$3eF<&wSyQ;&D*LJ#9=ROZL0)x^uQ~*0ze9J&n`5_wTB_L<~PiY<1U@2 z-!B&R3p^3cca&Q*T@b*DDw>R>nM|^uaPoSR)rD)I<^_6rC{r1)trH^^))Bj;w=K>+ zE_mX^x(PzgrSdVzKs?{Lg)&j=SS?^sF{~kxZ>|pvGG1C44IIcsirp@7-hcVpJ+u-g zy2(&WtgH9n;3PM>(v;q%>V@rD|pi<9czLPhMo-HOw=xhRf ztZJ-_RI?}EW_KT&k?IMK9E7Xl@8WaQIS73Z{be>Q2-QI|j|yxHP5s63yO^}Ma2PX; z)8rHrpKqHutfki;H+n+lYo!h?%JWH?~@8p=-DL>e0}z( zC(8V^{YYI;6F1cBX2(zOUCP})oaLu^f_^Kov36+oie~j7;gjHlxBEw=dZ^d%N%~8c zR}qyr$?_i8u4Bejx2kd4u|MYhV4R%xgmc_$&KwKmVLupG6?!YO$>Z<#TyV$rkGk~f z6bjAq0aRwJW6!KCxXrkITtFmGBjJ+s=;&aF-sg*ZYtAeQ10PLyHWpV3n^hC*Om{&M zaDLT`LM~rDxt!y_7xde-GE8uISNFbEH%2AU#(Y+daz()7K1J^W@wXT@_&=2&lGr<# z(jb5KT@dJ3Ndof4@V(CO1-~T&>0ZF3-sIwsO@nRXDdO&{D4q`4N{2eK)HG?AU+<<6 zHN_!XLp59-cyq3$fEBU3G&lCsvlt#rT#$C17j)ckcGFg{Gj9$_S6xIF_sg4Q1g)R+D8twtOZ1j-~Y&g>637bGi@z z8b1!*;;KT-x+D$ES7DmCNkA%R)cnRO{h465~yiKsLTO zSs5YfIy&t7WvN5A$Qr;}VwW~mi#YHCv5ZhY`wj%r?HP=-j|zJvX~nWI0^p`pD#qf4~OO^xQ23z0k+f)ql& z{Kg$5f@|ONZP#Jmq#(^2q^n%{73nsj$m~q5WZ%VbA?tVBdaFzw`ZctGish#DCp4dV z=nKEIZ$HVgtVWV#zfJ@vmmI)vH#J;DqVn<2bAQ=_e?AvuZk}_IJEE5Fr|0t7u%U3b z#yV^Jpq11*e3r-8Irji(9Og50_W8Q3oIjPp{1vWkJBVhC+yLPKH}&QJgQJ5~<7=$L$u(Wy%}EfS@vA{u!~ z$EI^H*p~2io_~Idau+{0Rt<#h6j(tiL+&P_N#>V>0e0BFvl{svJvmp){bJFZRlMC& zHp8PSs)H#|uo~wdfx8vOF3Y`{D(YD@x$V;jeHBn^^(;J0M^s0YM1D<_NKbRUwoUi5 zXPoDh48DEdcyfGdM>JuO+N~SCn)s1GOu_

cgf{Bj!`^beXjlZFMY4cD+g+8W7FnF zTWfKevv2bFynD#|pV`x)vN@4z|{2D4yRc8tu6hL(d%SEQIKzuj&5* z=|%S)RxZ9>aOm4ZbAk9wL<7v?c02ijSc&k$;4_zl-1jW)o|^LZ`h6_76G7NZSf7;_|BZ^b*ma`}Y-RL)I9a zE~{g!QHY1(VO)duTdY}oY;uj(Z4-ix>D-ocIhSElfunJ=Q6Ol;z_R4_Z~NE(r3KLI z`if0H=>86f-9S1U^gt4ww-W_@DZl%aP+R=#1Fg0k5LMQUzH0a-?`~R@3DfIc) zG~U>SvxFt49*2}2#b0vgDU}OK9u^+d$%ejC)#@9jA@uH2;7PnsYF+Lb+Aw(1>xfJs z1bvlRU2-$goS9oXXp9$t@m1?}`C>hK7|n}M-4!UH4Ti_E)Py7K?=C-PSlwR4!@1M6 zTjTazFPUSlgv^maA!_Mz*W1Q;z{ndMH$Q*`n^#*hf_y?;73nCkkC8Gf?9QVt4B2ae za3>3odgfwdte@VAL5ojSOM`{OoJoO4Vu_JjcGsSeX6yBK)1QBA>35x%ge&atc3Z`8 z#6pBN#6BIW+V+&&Je9WScAixa;l^JRbbJ4L!PClcP}gD`7uDA&-h+rgy|THjSDbd6 zB5U7MQ5)E>8<->Q^_>E*YIk_L}!dm|epR|JPg$Qq`|u zEk-BTdomS$$gn6dxGAQ4pD&Idj|!t>NgFzstM>ztlr(r+z$6k^U9S0SeEsLc{V!lZ zF&g%%LZ7=`P-or>DN{-tkDJe#zTsf+P)YUSwD}3>rAYBGu`GRZs^|p*@$K z&1zg*I}lbi<#u_)J*w9MjMMq1L5FvC2O!)P*~lr&0$#GrJk6gQLeGA9_ko zu~-4gSfVU?^$hb$7MWkNCF0$?I4;%15mQkS(h(TrVl>4~Pwgl`tpdp!?RyE7XtcWO$%f%=HSdhR<*n^55yZRB2-DTfa(tifkN zgrSvuH^h&4l!cC7RHnhD>5*Z%_>Qbg{>c#sg)wt!0D%pt^?xs5Qt`ltG+~KcfIOd5 zVa&NVAr&K`$&ToX8O1qT+WckV|Mo}02!)svAg}B& zCZUAD`Zr0s)*jzKkN7~1Om72?mS(geX11@?k;%Xx0_IMKwU30=UyHzZy=Q3c{Vg7S zPB$(6Xo*FC0)pYpfSqp#v+yVw4CFp>oK2w}gGuKhy<>I^lZq@C4nFplIf0Lvty{`(DGmsg z6E+rx1}9QOJ#ehj-QBirDTZI08jgT9T1rZ48VzktRb;par6m!J81k77U*PTHh?;VQ z+5&i}6fx_q&&Ury&ukM)nb|T!it<~?wCe$IewH>BX2|&U9o>1(9}EQV#}9VKLLY42 zog>xtG>G1Y`nPt~*)KNrg)C`g6)&xxU=lJY_8L7BR4)v7hlhAjFlgv`L z3ih;jDs!uFNx#9XR^Ls3!YJZ=zK(}5(Lm8rc>zC=DkuZgeZ8b9stg%6=S#TrY@GX+ zv9T%!w6Uj-I~$4?Hjo0ZOcnRxi|ZVVNVdby)mbeM6fl-E0W^5^C^h4$E6Vxn*!zZ; z;ebkT7CoOYte&rm4V^CfPG*Nc>#kyxuBB1Ni%>i;IkxFdSp2{~ zjAqI57kB%2KTfTmya7=nW~XV@c|BWSIe=B9+Fj1`4vSm|YLzMBo=Ej6_k31^-sw6Z zm&8{tgIj{8fC7*mcFl4!{&hxIjE}R?ND%GpF0VStm5arw{)&3jV<1$=5bFSZ+ylJ5 z?oQ8O&lkle>pvjqI#lyPja^;?wG~jz%)ND|n#7P1#;WDQ`R1!`8JEbHQpisAe}RNCfmA zw{{+;#I)jNCd0S>V{MX?wVwF#rbRd0ehPit%68C&g>zjnTHjIx42YN31(QUyZ8Xva zOr^XxRvhwTN9A+O9f4B7lbsFd2%QbUmw1sb7bt}w4=DKTad(ZEWRp>aB*U!Gv*ieP z42T}k{v0UAwSp9U2)oe&DbmK@>%~S16g32s^QOA(y$5Ow#yBC-qw=2JCI$T^Z>^BU zA9aeoqhz*M$e-fbWQ{*!X4s?To=fy+4iya*IyS8U*syl4TB;zm`aQj~-c4{Kj_QD! zS=^Ao1(HIiX%ynz=H!o!LF$Jxu)cd!Or?WP>|!j>=mGua^4`n-u0S;hC|HsEZ~e_* zUJyho#PF+eQ{MryyiP^+pv$}AcDllQYfkZ`;+sM;WO>ZPG9VsVoB+Qt&As=n_qrJa z{CM5c^TG?pPGHD1I>KpG`5uV7j9PpQ+}e|Nof8Y zOFpipb!k$KsmENqJzp)T;#n3!I!I)&*QHmt%6=FDM8OesP|=D3QnT415Odl%A#H|x zBY*G;?aXC6Wd7#LqBg;M;cx>C;O8jk6-R~ZQO{Hyd!GNSYCq7wquS=p)XyR!r%~Q| zs%IM3ob8%ek-oPL!SY+Oi1_6K5f-4$YUU(jbDKODzZfeg9#5z0e@nByb8dqIW>=Pl z=@|@gzz^p)J#tJHa}FPO3eDEgP$f3JAsMjrKsMGEzEn_p3tzx)T(-b*z-tjRQHRz!R3w8$&w7&SZZJ({m~s6ROy40tizwN zHOaDwN4JPzA7_ru2CsRZ*gcd!#Ag8C1i%Wz4_Q_|n`VXL9i-uiW?M7gUekTz!iT=P zxj{?MMJU*2mcS`uwPK8tE-3;NB8(2-#Ok}Xv{M377^&k7Z_OS(tusk zwCSuMv*@t^=re1A7qEK$qx73_vJvl!M}?*>rW83iWeQ&!+-1MdZ|Bf_2UC*WU;1p% zzuPLUh1wFh5PCeJsxKCCMTOBIQ7!{4){%%YfUc_ev@oD@f z;tG=yU--=Ci;@SHp?EpBsk6pUJpnFaP_^OnufZCdo%gsa zbV>sx(R%?*++gX3OCT?6B@V(|tvQ@H1fX3fL7;fcmZ&jZ7PrEuUC5NIa&^@5x(dKj zoG8gFAIDjK43(PoDWb3u1Vz)N+{ce|zcA_xMP0gO$ahwL)KqkL_@lii`HJDvFJE)_ok%)=#!L0mp7BJmh-`T)YXMNp%-8ZQ?s z99SC(o;-S!Cs4Qxroy5;IgeA^#TLD7#miJXKUz~dS z9kEb^#mmx7#Kbpf;235dgi?4#XfUviI2p9?> zM7HfJAwi_hRH1MSWV0gp(kd{*s3PV=Q)nHAHq)Y6L!C*^^RMfeK?;Jbq;3Jdq-9{7 z+}n5WKr^}OtOED$_0~c_e8h=r+$(KQ--fe}jNh5H<$R8iswcI+qj2`ohQb zU(k_=?$Y$f@TuV{OIwL=!_`=F)mO_Q0YkMKPqYk{#idu9|xqVv8 zv53TBYZgJcsfdfWvgtOyF~lW6p-qbcRhNk6&KoO0|=bOoo6oT$Kq`%U*JyxS%; zz#k9Y=lQruylr#;h$5hjQa#;>KyMET-ZJ}C1CraO4Elk1FSTZ1aD{g}4&NELok2fX ztR9lmaVbd9&jas6%~8Ay$dst3RQi7j<*rOI!$-1>Z|-x8R&2I^*?{z*eD-lscXXpj&G(i>@ySq7PtxVv+1sO#CaV&kQyjo)2k>EHjTtoL?Rw$ zo#d7KY1&dyxxT<4^QDFw-?dLC2SG8_I1bAwPyG?;&L^Fu7FH!y;#&9PW&`qP{gX0^^gEw4k!MxB$4H89MZ)dBDD*Nc|p* z$i+RqtLPLbhO)tiAN!WaH1p8g`{Rz;=TGJNUJDFk(Pq1g;bBjHZR#$(za$aUf#1}DDv09zd{-*ZWY1d$ zD^Eewuw|br$C3JileG6`MZ2%JMANc3^WvPO>Wk>faJX*7{2IM!k)j55QKE;^pP8Mf z39|}~LG^YoBW7&gEMI$lx;CCi%pm996VM5J+RhkhB`ST5tjhn*-f?_&(#jc(mIMQ< zc)4IO@Ye2?M#zVmnzp0*7?>=+dMQ=!*!VL(aqgkRVjEYu>kWFZ1%a0h2ercJB88@A zk)?RIuEowCq6QL(3$>piUWu^cpN62?YBeLlX>8nOS8Fj53Q>te^{^Cihon}+H`r)` zasv}f@v^+#8`gw?{l&c5WS)#S)XFR%NP=X@8jBmh*9j@vG1+AL7J1k65h~mdg!5Ux zMT9(fPBp{u-&Bu2nmV0Z>Ab(=*gKuX;NQ(vi6%;LnLF0WV{#eA_;o+q9f>vTP=E0> zHMDed({SngFqIDz)LlXEO{f@DWs1-m%Kqc21fwze1^1JE%R!NS@QvZh3#DFryd2p;2ww>mCp<;rT-(2 z2`(~y(f&lA#x}eAH^sPMNA0Py#zu@O83 zUpZGHMH<_vlTVgwf(H!&45r?m7`*_sZXZALH+p9RL;y-=>`08gGxL4Sa|i;ULF4Ty z{#^iWvR++_EmHsiba?&Bf%nj{+73sK?suVU16rwi^QSA;Cvv-boA?}il$(r$t7a$j zvi+s;WLFN1WHD(bXFQ^ES)z3TJXwwe2p|ZVp~?snai)`p>dT^rTrQUWnXw5&8}IvN zlNH@xCL?_aKIV^s+$q9y<<+HZRi=45`b6k<&J}4NnZ{FZfbG(v(S}VSRW2+mVn*z{ zmvgo@vC`FEv&@(C{3{9RL;3)uiLqnq ztKyjn1N$cl5#GP19e?)jzi>r>7kGu-Mu7FuLN@BG_fKmw37K-UO1PHZG>YP9J`f)-KxW6SCa6tis1TlND?*M#s^=H~o^~1Z8vnl8}Y>J-WAhr2N^YbIoFnsp(pnXPnMFhZQ z?FGf-JChYvCeQ5!?JljJ*J^NJG!7mDSU^676bCL%eB}suszVE|VvSaG;sDD30AIyZ zF=uCz;3Q$U0LY8&A3JGTI(zs26nCszV=`}*8#^?J>kG) ze|vH5K$aiME@OuuL?xaCZHFqzR)ce6pC?IbbN^&+_-KRf>lPS31_(NnI<3;&P!6dZ zGxD$-@KM=?6(e>?b_DB>fpE`3IAfTVUetCGTlS@d@ITQZy&wLl^}`wI=;g|E4(zDs&k*eH>v7}jlS z-Bvc2piP3}f}eDTUbFAT&aaP02(<~J_xV^Z4&YI!M|l9|1xO)R;Ird(Q$_2s8p}ePL6b-2D;FK% z{^>hq-;R!4zt%lW?U7ewoWeeejPXgYdo$Vc*|1zG%BA;^D=1R$vyryA)2P6QT#u4a zzRgX^?bt=F^`SB%B!g%i)lZo2ma-37m(B1q^TPQ@8Wog2i=d5TZ2;hsa!Pyj{f}*L zO*jiNWis&i@B#ONr*hGweG8apCCT|FP=-k-^nbEvaKBF_KC=0NH?JBsWQ(K?8DA*A zTrehmu-AuQGmS55rONNxA!b%a$|*)h)ufw1u3Je1067f#`G1c0p8j?V9skbqQF@e$ zTM00vVW^Sd*ROle~cVVFk_mW2Obm6@AmG*Ub}E#2m)72Ug?vZwyq_ zeRNd~&vY5<(h2WZh|%L5yqd_cwLU>|RHSQjmgCHe&C?hOPeTQ!Z^I@y;%(luN|hfh zT0Td_A8gD%r-!9M&c|_!L*Ro7n>?8m4|Jm1IYbd5CT(UhR7!xF1fGnufq!bMf@K=v zhfyTn?sWxru?-2o-MjXqWtD*%->F7DFLJ8@^BBMy)fBYfr8J$S@Sv8H*L%aXu0rJy zgDf9^Mj}qbPt2v^YEzi%MMxpJ&Sk7FUckJzo$kqIr6Iyy1V;?QOM_Rg{_Oe#xTz!5 zb5PQCqsnrX9ORx0$@Lj*yjDHFrL7N`=7*F*9dO&}K4rTkck?F2uYh$y%z3z?&7~;F zu-vK?$V>g#wr!o2v~U@sqDEb>)B=s;+vCR{0uYHy>(O5rD}V7RfBNx@HPfm_>?^q^i|bkmpdB~r z$j6#_hoxJkbyZ^`@%dwmON~}Pigx{77Sg`PGH_34AZ?{4p?1n(P_Cv!q zCm!MZTh27XgV|e#%;j+a1)>`)pQAc?6X$Hg52(IxnsWUF1=!>RZ2?WJcmS$;!=TbP zr+jB%f3fd%+rZnIxryHE6NSNby;~esA5c*GDl=Q_)#;cXxSZ5 z@~VE6dexH|(ch!6@UD#`g6>3Ms*A{C(^)6C{&E!rMHQe!kdCFIjjThKP_)7ApC~e* zP4uuSet+}>G;*{V9N(b$_3QmT?=_=b(j77|)eabX>~{-nvk~B+7Zr#AcD1d%%wO`$ zzddkFf`UbJf9Q>`zewD!0Yb~z8J@_oEUPn^ng@e5{=co7^+x*q(J&vKZS$eH@#UQDj?^ z_^Lzfza38(U3Nq3B$0#R2lEI8T;bk`fpXWX?W-@f^-4(hZaJ%wxyplL(C~p zkqh7Xq5o)9ECjM0L}KT;2^_e+hnm>w7(i&r+N8y2!BgC_>vad%aJ#gvo+ z4<9I72yfo;Z2r?8{RfVqU~=eith>6w%YUH?Chrd))hDja%OSY8d~4F(`aItdn#`Cp_rC zTi>7V&b}60X5Eqdsc25?*A(@t*oi04gvG|Ki+^p#`qjYyJ?kV`M^M2+I9~oxO~C(t z@vqNBE9AG}wgI=q+DHG#`)YyvboP%mpX6^AV&E#U5dW_h zFj_p`Ts|@CPiAs;>Uzn}f?oz#=QTINX`QzAgKM=ElCb`pKVS8S^NJolmVY~WG~Shnw}1-5B}oWzobj0(WyMg^Z#|n@ zdqw6ZbbmXq!mf85BI)^ysr}go^|Jww$G=|XruFYG(J)wFX}-EGsV+X^eJATd?#YDc zh^HQkJ?^!OKjaTi#o$V;IzIrD1U3h7!_Q2qoWBe3%vQ!L$6y+z%MmJ1p7cO{ z9CoUAnj@|OvHG4ZK058lvL9l{0e(fwt957avzfXFAbXrJ3>}hu9 z6Z1x{XwoPbz{-z)H$A=HG!FtYw1k7%80fxrkxrpslq_W)q4zda0ufqu@P(tVWIM17 zp#D+4067p(^`qRFB&>QrZEV=F-;oa}_)%GsfA_P+7k_@J_Vg*4zkI0OQ)#tV%P4l) zruw&x-yCfTpj^axprvb1U4n^V{Z@7#wlVq>pfx^>`~oty>_E|7dveFajN2EDMV^k@RT&F2;XQzG_j=h0Q}$qkWtsoR4H>gn~C#*i2;RU4{NG3D** z>KV#~3#VAj3E0-{|8ja?25%`?tS_OUX@3qF-E>bSIRPm&)$gq^$Hj{(Oafr5Na$9v z7`MQ7Z?PvuDkA%A!m|2ppbe~p&|b8H-7ja#ree-NFEjMeuCnmUT!7Lt`*pv!ESk+6 zetcuVEHjh~qI>g(@!5)%9dz zwC^eY(A>B5N=ptH1M7f}8FoUu`Fe}t`B=8fTcV6-aPxkTgQNrR(YZ!ME2;N>7Y)>? zH@Mbtv17`wCB0H6S3I~U;;GL~mj)Nw`fXRbf)(qSQ5Q*U#Lv@tmE)wH0l?~pm07mX z`>nU}%)OVGyehiQF>#t6Vtq1A##;pjEk&roZfm>@>5|v8(|@NByt{2R*}2H;BZpV> z-X6*5s-#7TPPcXR_9YjlajARn0$H09Fbi0yg>#ta_j6j|8W0;X9C|MH`)~dc9VoP) zvJ+fAt!>(8|AG5-<(fg9PP@N1bX63OP)hckO3MbRTqh;8o#XkfuIuQLumhh*-4D#- zICJ_{gS|?heF40Wl9b3rs-MV>YG!X4T`|x@l&_*cq9q7h^?MP`{zD;g zZmw?F$^KK=w@J_4cV`T%ACFGNJ-)QJANC+EN@HZ`1DZ=U)MC5;jAi1ruIxlYSe8b( zBrN^W!(<*lLfMIY0<3|i7QOpvwmn{3*t#=mc4i^^T}vceVsvzc)~b22T*_>$^$}n( zr%s)}EbCtZQe9fK^Ns15W%RJT`=0;4#af?rnZ?=#`+<-9jP7!2-{#JrP)^l*+5hO^ zx~OSgNry)?P@8TCs)OneJL_W_b-veMG9K{ThkMd*;x2rdK?7FwfXrLq8YNu#wWk$Z)T;q{)T1Cq3FOGYOfMa3YJi&J=J|!KA!Lb)-(k z2pE=qtKFYziAud%b#Rt{vuUJblhZAYLHWl^oDVT>UDsh4ZpJ41q|PVk=3B@)<6{o< zX_y=OkypyxyHwgz#ELaz!0mLvuKgk=xcZGjbNI`wD|*ic5!W*-7SvQ*|KjK+K%psX zGD!cDfRTWvJXW=R!cY(Bcw+0Rf&q#@+eY(31~<`8d%D85-2y+`#7D)7R23P%bOQY$ zw%8ZBRD%3f?OgRlR}{@mFeT9X4s^M~-Y?_lz;GSQsJ)i_phMPcOsaDWrIuRNKF+lk z`;&pRhCAzfQSvIIQxzV2n-AwQDTM3?YtMtCAR7yJwynPBt#`FffeRzNhr~$+Q zo_0bHel~o8QpK6GWVFitb$gfDfqLSVJLWdMmN>24cV0_98US&IMD?w^&8znl`go{{ zx(z*>7Y_{AQ!y~`YVD=UBouFH$!)p41l?SM7eP+x8qZXWYnSI*VPIW?xCYxO5GIJWclJ}`mov!J?F|-u1cp$SJ zmD>+0m|KtM|Jg(7v$=l+=zq5tSrOl<4gk1t<6Rr1T}FQWHl_}}R^Y?mxOr2_1K-W{ zp6F~rTdcPwH<)3(rQrB_pFO(rsByCvL$rG=5Gtttls|)L{^T0TX^L2PS~;@|Qwz14 zPoa?IWT}8{U|5P(=30~t6K{*=mBdjo2PH?cOub&n#~@CFe?_DEIY2m5v|i=j_or~? z%OL-4D#G)}>@mg8gBfgQ5;grcrwRjiCp)fYT)%NH_iXt76Ta4fyNp+8+i{Tj|A)Hw zjB7I6+J_YsL@1MkOr&_Sh;H^^2t166ze zB&i#LJTTidV%*N>bq{9sIx_VrGC{@!)L=#;{owU24CG*<@D6u@z8Lt32m=5%5pS9S zXu5W>M$klcfM(-u0DOGMlyUX8jVqjEM(X(U`NOX>4oHSwex;c8ULN1yeYta5GOb!h zHrn9{PuYkS-k}6}<2ZEg(GFu-=~E8?{vO(cRVRMO?{`bJ9?6}fizlGBnyh!H{M;Kb z{0yrBqg5Op0K8$YDAuh-g1T|NzuqZhWJo&m_rNKDrcyD|;dqdKq&{Bg7D5oV%%;go zxUVDqVhjJ}1SHdE8+h{}mp*QCd8rifI$+afy;{u<0Gi+I<+p3OTG?YIdCU#~b}MBY z?fjcoiYfq9Qqc(;R6LNvN(S0*_!q0jB>4_R zmi>W}WjDFXq$%e2mBI7SJG=0e{Z%&IwS!lZ?l@hDSWv_Xx@+&|C3jmW9Rm!^NsQ)U!Yhk4)hFEp=m&l;s2w2RTP?I-&9_r-&yC^!$O6!ISd$?rcGMp(3*zu@X~A zS1E^80l$zbU$B0QY|AG4X?O%><&8!>nvT_Yv?TerRx@|PPT-R0i{~Qqy-td9ePs*A zK)&gu_-%+?^D@Pawy_L^rl3f^r3{0Qe+}8w)o=IULc`N)rLu(pHnCnW%e=~cH!rr= zZzUyCfP13qfxO|)=bMK0)^DZ&Dz}XfZ;-snytPAT0mvNQdVDrzqw#3aWrkKz&WxVF zLyB}*p%pTDov>4w-1VIgJK1at@M@USpi48LxV^9XBwf_8-kz{Vpcd3`zFI#IztuO% z8Skk5#!+3Edk?_lRRD<9fSF#&(eoMJ^nyDL=Dj<%d?TuoTrb5)quiQEo>V*71H4fu zS@Maxebs>MYHe6eSZO0C;t)OrWG#c#t1w^V{=m+x3w2%XO=*J?vHe*(Sx0x~5uzkW zFyqeh52gDbRr~lMxw8l(>ubJut$H0GkEMDPo;XO08NAUmE;O3&#mmt!P(g|uxLqp;PaK*fX!;vNm6>mqAj>$^UyHOy`I z-JQYubE31qL5F*&()NxJ3LOcbhq@RbR(+;p>eAOZwsr%aYW37R8G~1EPAxbLho_##vp?>SWM;M#$yXWv)bZOTei1K(%nHb8v z_3yg(kUMv4@0-`R$peiwt=X_+4%(Cl7TRLRq(Myf-Uu&e^ymdzd$Vrn`4UQE5nNC0 z6xAd1prG8tS>wpQcYo-S*{5s;0!Yu(VFqEOsOsvGvxuWz@qx!*KIBE8_`zvf#uZ-m z_8~6VroD)&hSF!KCa;2ck7b5hRMc$4*Vb66I`*v&$IGokz8P@7Lb#Vm|_vTgVMt zds`O(rs~Y(oz8o;J1Jgx%3_(EhVvGe`q#3FLzgM1O0I*0hJ0I!+9&TyM(3wJwt7y$ zYXdne7j%jT3QST5^|JEc$+q4g-k*?p%VREq1yPGQKOzp%>5d!6j}|&%ZSqM`(Imps zX%Z790h<{1yx~{E4KSk$ZZVSr*^dw%c2zylg@zh>)x@}aw)Wonj_+V$eF`z_6M3HP zlofVZGup%603o%>;;z>C8$tfH%i~n-Cz&j-LPZ;)kowRCGY2l_Q9It)@K6tKAwxd=X2=K(Ryh7WM7;j8hhE?7(Q@X>eccH^0l5oK3M*0f|$Uaj~9>| zhNc5NYAxn&n^FK)9uxt6y|gEvr~XEZW1U)HSRU>s7p`HTtu$DY#9l06a7&l}nIb7U zi`q)Xam=}a5MBLVh+b4$P%i$Oh6&#AwoY7P4;=FpUhL?!Fmo{TObYSt82}0I)2DjhM`U7c6|xEtj-Qz zzEDHxm(uWzv8aIX59xjyhPHE9^)|_W(JF9^Ng17bTcx3dV)T8 zwG$F3scpkRPuB%EnU{6tr_E+j-p|xR*?wpglV`^JeK8c~#yAfhg$em+_qmN_P4_;+ zmj~3AxEc%^8Z@aSiCkfc%@(=gxztl@x{t?f0Mm8hx9hwmueR9wY0`pPTUWRbnnVlp z3GU#TwC7}Xe1`9`T)eIm9w`ZvUII$d{Cp!W3}RX+HE2rPZyyTTsSSmGKtSaykG~FS zniXCmSM~Ri3X$56Hd^kz*I8d#ZtkHAwo_h*FZq3;P4=o8TYj(zh%vp5N>JBKBS&~{Y_FF} z@%jy1V!_J$D^$mKPq(!~-SUYBm`*iWehf5LQ&gE=veEhWKt58VF!@eXk?=zfw2-{% z8jdD9FTsSZ3R4yGNIJp&>Sw>W6R_8S)7x&kUskOb5NBZnO=K8&>{S9;(Xnd!+E5zR&iwl9pDS#Q5%M!%Cmb3^4{tkEd?g3*BI6w3Nmv{n&@& zcHh05^wB^esH8&Il6upV_r30|pr@*v67>qLTArLAQJiV>{yk(}ec|aECUGh4g2D@_uyYv_G_37CnvSmfH|znh3aUAm zGTL_```z1CZj#AefV&i+(?}Lv8%0`fg{=UTpY-_q^QPbFieF}O-t~KYQC3=7w9Cilsp>bz*#!6Zt z#_hRUaa1KhFup{*bdK=F52$DE602mQh*=e#ez;3X_)<%vl6ewD_UY&V3Qv@QuFDJk zUs$y3A1V5kO%wan$>nEb-)({cjNc**i>NK!KG+l>Ab_fRaGk1M`t#?Y3hN1e!zSBe zQAB%N;-=F|P02vRP>5&x9Ta#y?man8k^EZnoxE>NJFEf%!y9X& zZ(3b=j4E`8v4O*WYkF^e-3!c$qlWoq&j*?Pjx$#Z?ayUtVIdkIl4J~0SnAGXH?DO7 z$n*m`8hBIE2Z$aWyFSj?Mi5$zKA@}KK072O^){WH9S@;j3zWNaOJGUW1v&)O&9M!S zU}^$~KfW z!xLBb8sRMmhbyIurqAQwr*ftpjaFXxv8U@Uogq5rI#3ZY?mhkEy+4BUvmY+^1J+mT zz?I(Z%3Pe`po$t)Q!Q9i#rk|QR((f?;n1ZZ{wy&wu zR&iBGn%$7y%`+PLt0A-B$JVX5t)kbR9Axt-lC*cb3$|k#ui+yp7sX-Joh$$-LUVC!Wj4n)RopnHs!uf%&aF)+{Ie6NewCCtg~ z%NBSNOyeItfwk&{uU?`a3i-N$+35|CAMB10aOyRo{r*vvADdp9tNnRM5?tApHZbVd zzYcTnt|JqAK2$s7X$oT7!AQ&8i#ZyuoaE^{^2s8b%Q!h^I281X(%f7(oY-YFcd4f& zUK$7~*pWzKYev*0@o3MK^s|n*DvU?Sn9|fn@5c)1ts;N)vF}9Mj{1riH#d<7wIe;SiAQa!sJvUP6hJ zO0-S+p}TS%A1-zkB;?Iuu1rk}G~*_g&8p^oxOA?1nE>d=*V#0IyyfMrLBf?l&CWBE z&>W=P5qUEvfNaI9*R2s3Z-RRBuE-eifK3C!>0ra<^`ve4h^06_$pY?S)7f!66QcjI zl{jQ(D4?P0$;2R?QjUKn|9)Nj<&i9x42L|)HHnlRRW{m8WBDz`__@!~5P+GjHZ<`R zETg6q$^FtlI8Ag5P2prSnjwmt%1POf%$wN~tY4+u3!L-4&&86TuYRw~=fkE|LFK*g zHDDsH9q>TynGaho2|8>3v1xjubWFZtTUC=ff2MaboKIu(<=6=;*QtKq>^WNJiUepG zsF+kKJwe~-1~+0^aLw4rjl!+LRw0AIuv8cq_(`e&DA(4+t5XjI6+Vhe;ITDYla{>6 z)T*8g%D*mX$O~rt7A!hJU;WB%RM{?j%Ae}u{I#!Izp*8}xGEW4X{Eh%saCK+dQS7Z zlK<+1tNUjcvb?jExr_Shq-<4z$uVbN8^BM$e#MUTZG9jz>1#0g;F96ILDG zT#|nE%x}+%`$@5BU-&9*x)8?=>H!ji5AOwkm!_9k(Otb9*hk@yw2s|A!oG4V%e7tD zd)yJgAGmUnaLNeJB5z1!t34Y+pzoF5qjA-8aYzoZ~|sMMKO{kz?L{@8@en z?3LeV`e@fW#N|+P`#l`uTL0$lsJ#3IPU7ZIqUuwRWu(O;&-oRhT3r#6{*oLZ+u+5L zweOq$v$Dc*4@}MdzK8|{Ppj{$q2GqZj)B(~^wvZo8n>Vqg77Z&i%|M$|Gu*n9gWZ) zZ?kq^Y_agd@eC99hV)a*goR?X>zqjF8I_=O1W=b z^_?BHNES=@G*xw8;AnkVQAr88GiJ(#xMOxZq3xABY=8DxDls>AnAf6#p1*!}D*OYX z^I-_IevFArZ`_6M!Uz18Q3m)BTY){Sb=4F}KH3=+f^f9=pf6?2>Me`yZ>H$9<2F*f ze`Fl|_RP$pEvA`Dg{Woyg*Z=occH(R<72BFpO#UF>$B0- z?`)otC0^fhYqW39O%|c<*u$lX_;owOnpuF><-&Xro}tbX`$rt=(C+5bFKXr`zOwM` zO}s!W&o#}bOl|ldvGm2h9%x&JWxj}y!xh;>l?X;$1js$a_s-x|cYh=fXsxrg<$)wr?jTaud;)NwnX# zhC;sAY=1#=1NzX5)4{G=OnqVdK6Re$tJNC6uBEZm^~740cGPCskoBrA#NjN_s!)D+ z>H)+AAigjiA?*`m-9aB8u*6CYbd5SNQMbn=lkBWb?C9M|OLwR+zQ0wovF?AoY@X;; z(x9^aWv|y1W({zM)|i0|V)j?$K|R*E%aQ)UvC@<301$n_HpRr1-(*$Z{m$yZP8eZ2 zv`2%%EnccA`y%>+MtEePMUXcW#iflyUn(+k)gw38$lZ+vj2%gbQufOV7q8B(waF@> zpj({+v9sf%<~?yA9)7T=saerop&QRJ%(@N8S;mM+qu(08Ic*c95|=_Pu-7Y&Rn8PU z3R`v9QIsUwGtJQ~&BDDxekeBA_T9|WKhRJ*J`OQW7h?PBQvLFpsLEztb%Jh*?m(gG z6Ed;DomaKa(@E;QG(DZEW(6Ue^*)s|;%bM15mVmnE~nGij`5iR;h_}#?~AnHjVmdt z+rbXs+gTPrlJ|nKV_y0cy#YJL;K2<=)2oNu2_``{I;B4JLar4<22P8DOJ*Db!`)sM zW}+^O-u>JqPxGhD^J-yP*};3uVM>fi>l(+!2&R3Tn>_}5QF~4Hff!b{X#2XcFFTAo z)t3pQOIf-bRiBd8dM}nhW`Jor!WDFSrZurGXj=YHrhUC~Ub=}HAv1ovV5^lfOCeC; zi@6y@t&UXo=1igOvcdZA$=4HT%>q=WS1PEp=k=iQFNsn3<^G%|LDF~@>`isLRx|In zivyDnaLUEQ`kFfVEia4&+T8pvo=*13XAaJAg3bmnzO<*+M!eVM$vP-Eh!u5!9Vb3; z>3Y`Hl*B>|XDqtJA?PXc9`t-jxe`;Jxc=H-BN|WI>-u_yA#!CTg(S*HXy|dQ{Y4hA zUi4#-#->D|oY4N6yZ#$1l^*#Rmcr6B#nyu-tXJHp&j*{MSCJ8p<8B zl3btJzZ+7h#MWukm4eDSJ^kJgA|Rp_PA#drjB-mNY;LX_F7i0lWV~Ub1druwT*H#6 ziY4vm>?OoTh!)bqkFibQDU16q>uOdapVdBZB))Dv?xRTdS`~OK15$Dv2n`(xIkZXf zj`C!$%p-X$))MdYZtqRYyM5*<4ww%ssp{(f;wySsOMLGxz=oz$oF*|>E? z>eKYv@A)PzcR>=}^*3Qf8aXTDWYjLnZ>-put;$v!qE=JW=Be6Tdoxua2kZi>eier>3cZQutnth>i`@-HAE^Mc~XKk*fdUwAUH~ZUekE&6Xzkt>oskKwXEt^d{XcrG`xalJLxMspzaFADeC$PcoYJi>akE>#Kfz0<<5x2mQ z!tzW0m@EwbQg4R@Xv#KhT#FY{?$D~l;A~?gz^O*ZBCjYthwx#$-2;NA%>x*`+{rmK@ z9=$PV2GmlsK7V?NTs~&lDpK*RSA;yqI6q;_j34k5-Kf}tA9c9z*?X>Du9!?AQH9$- zF^Ohn@9WUOuNy0$J?~kTYvz&Z)8O^_gLa7uMS)gRO-2aD2Db~t!VnZ`d0OFwCmf3J z-ZiDI$?p@BQguoj*K}kx1x&lpy1rQAoiy^(INE@Pyd#3GZXW1}@g z1w4ZNx}aNE?idY^1|9Y|4`AAe)yGzRdWnGj92av+HUTqRRv>fEm!u~TESILfKbkHM zoyZ05Fxj-dxKc{&+Uo@TQ9Lf8ZG}h6GU5*YmY~!HKR5d~|)h)Z?RhiQU%Cvhx3v3CWVUv*M zj(*Dma|`#Fgi#oYvR;AdSk{(}e(hrr6&$}y{}#fX89$__f!JqMyZFvlOM->f*cEXa ziSHNe71KYuYuFN-s})C)A&h}eR|2HJ(4Mq8D%atz}%t4xc(?ont<~2*xjR< zL_@gLn~U?&;}4i%hEvtGaoRw-L@gxa%IQ{n0)JVqG zc38h#Z`>~HzB|@MMj~mko1NrwSmm-h;kya(>{=D(!^t~ zdmc0J7Ey-v8iR&byoQ7P@oFGnzW!j1=@WNPwY2F*=4PYu_Kl!wP;c@+jo_usw_;iY zn38Jy9DuqmiAb>A+wu)EYzc{#nAOi66(b5a|+uV0K8y(PIWM2pPz$I zl+&zINyuq>RBB<2bfj06n1oIUK85MDJs7x>xim?ZA>#GDtjZPLLPEoBbfD9G>a!{@ zyh9CQFtYouT^j)>&hiB5HIOPBK95#C4AERBG>pSD`7nf$;?ioX!w$8>0vn7QqU()( zMqTCcO zU9Rw*$|Lc+Ip`r*+vU_pe3$5wahCjxx#CrB?Bq+q^R`u^91S6c6~nG0MMIv5eK~$hnTyxS|mebOk+eW{7AnjxlM>}Qx8oCk0#%6I(X zlcO9OHQ%23$p5 zOZDS!UK-}kz9g7 z#okXaz+SL*IJ=(r5IgJe^-<%Cv`O&SrxFCaj2<=z+kEfvD?9G8kvQa#WMo6g zzk{3~w|K%7z%6}q|2i9MaGTGXc=3)Q+u;|^1X`U~!B6XjehS;79cBA`mn>(T@~nf0 zH_#i(RlJg$&6RKS>KFyW;|D~=P}TX2f;Vk)L^UZcqg)P{%-t0}_FTJ^aqo1D_op*A zG2>DM_8E9!U#;`N%Tn`DSCHwI+XmY02lmy<{HnG_uOr|@``G3h`ET*>$)DAk1U=ND z{*-bsdoW(^`{McYDyp!)4*|9jI?^PMhB#=mgP{oXnlu>~$u&9o1mbf7S_6>%NzZ`0 zUCUXXK6iVFYrKg>h+VcX`1D5((_UduNRW~Vo==jsooqWZz`c&Ei20Nl~s4s=PKl5DNF$juCe=UB{mS7H+D{y8PffB`U*O*UZA-sHs`P zNvV>>I3N>KfS(&jb@uJsn=V@Bwh?B4S-8MU-JEJBy1ZVwo}%jmImR=JCtF~N1?)Gg zJQfF0cY0jtKJCsJyLFHsW((57sm6W2eEChg#F-YcJ_KAL{wP6v?eLBLbi$dQl51D5 zx+0vlyAKE@i?yE%!qRF!&bI@h&D@##<&LO4X%wd2J7F`#{~2yGC{D=}%xA!LSkXCi zeB_P?Uo}cqn+;n9RW^C#Md9Z0=t)eO;KfD*wFjOvNW+#LBkVLx6X>*NU2#7G5-@4M zrI;D7Q48@O%Ng5lgJ#;xV6wZC$N3bLlng_f+|;lJ{!C+pZ;WpzWOwj#2xr~53ho>_ z4OI;KIaZFL#qdE+O}xL{_M-82mVV_&aKj$kM6FwP6O>QUD%T66U4!{Pz!C(uWcU%| z>ChoMqqbDg)nf6}y%P3>wQN<(#YEdc3~a^m22$xxP%O zOI&}M)e^sGCAaYA!;CEJh9-H6In}LB+k~V+4ollr7xs5@6bXCfpE1AjciD+KOMal0 z^AM*Vy7Fb+VihE&)VERaj%L8hfqAKmO&kgeW;dvKOB)dFVae~2fUlae`<&XH2Bpr= zT;9vFDKT}UR!AGz@$3~J$5%aJB|seNoUZIhR9XZ;gDkH;e!?2-cSLTkEIV24;#AR8 z)m2^@GOgCNqPCGw)lDijq)%t|ILlAjyjS8oFITpD7Uwi07P9nBpr5UY+q!pq)WOF> z=$5bAPNo@b-PQBSb?=7GswfhvVd2xKH3l%9kraNK{t~#dKneesA`^^)GT&kXu);g0 z8{rN?{Y82H)s7V_uzFnUM@8H|Dty|ZJ>>}AtuZaSnef}-2Srbm4&^x0>)E^G+t)rv(^L{xaEJIQRu|*ic(MexF3)f?AA&#N1TPGcQClCayQ$rS-mc9$ z3#h(k{ZNbh=D&^p*3lT6P|Uj(kc-wPrrSwEeU1@l9kM8EAMAcgH+;<*=}>49Te=}w z2h!qr$f>uTgi=H}=eDF9W#qJXU*EDmG+Qwcc&=l9`A>CulN_XA9#g( zEn^HiTMOqm78sa|+==oRbhCa!LvK1Osh%vPTsY%o7n{_suC-9k`MP4p+GNTNnij*~ z@-jcYC}mOd-CfDaY+4!|q?QlML6aq4NPEe^&rvr2 zxbaZ3*LsU+nwveGT###i4BcI0MkClL!xk*o$vdQ8Fy2fRmk=MHUq9;bmWoj#v6%EA zgxmZEjrsW9S??hWwGHV)MdFK@9QCEn{`F*cogsN80`i0Oyi^s2e)j_Tjm&}%)lq%3 zKsQh*eF;q;H-xVH{gBA2)AT+C?qgSJ=Qgk1dtA0 zQXMm`?UqUSqMLAw`sQ84u@a61gWBMCfk&Td1`FoZW${SLbIe*IXU-*aUmt^1{#+4u zzTwpAgtLd|J%26TD+wjx%d+9;Ced+B3vEf80fpzoU?hxsI1MSx$jq&V#I0yjVUkkH zCng0pZRTB82V#8Rwl@k+CzPkn48GG93QJDXeB{B`!z}tXETrsxdz^s+vwfJU(xnA^ z?Jrpo;`UW)n`J=+O7QB6xa-CO4R^sbQ0&fc;ntftmFD0+fm+xZqH2-Gh3yq;1bZhHJwYzp6{mWqVF|+aUp(f`;3CWe<3~up(x&l7t2x z1h%CZo=^3PfkJM%tv+rVE;5uaaSbXiHrpCAvIAj(xKwD$sg`)N>qS6>iiC(yu?cYw zBI_yirQ~Qua{s zG3{10`AzG(sw)RF%-Q6+ytJ$j-rVrGeM2oFMx!-(oXr`Baw%DETR!!OQ(`@JZfrdca?-~g$$AN_#{?#8IF7PKf zJm{Ls4tZTpeGq;#mhn|eKES2zQnAk>Az>nLO*fhZ49B&l$ET)VD}y}@DM>~rAAWI- zjuz(xB3&M1k~F=A=6$9kIcj&rKGy)9Ff@oMD4T#r956bDD?n3Y|ND_@VLf zYPwq&uWGUw%(rRHS5V$2FtE}1csWflcuZB;F%&vv$CvOq{-h@P`}vF97_N_EKx&=! zG53sGtwkpSRdcoxtL!Ab`nP&X5eQM(v0Na(QgiuFx75ic#;kNUcsl#m7MQKG3Bi!u zuHTO2qK}=FLBdiPlPO5!iID=D#$zAY`I4+-vTkJFnB{%!)^z@DDg4!k&a;cr0fPNI zwdo_t!M4VTdn1iCn9k^wvAEzAy=s?0{Em}J2N!25CSxt@K|5!l$fMlGt(l7xHc!su z*C)6VplS)wJ4X2&UM+qU3g$*aE=R_6rUTt1QmX=Jp!;KdtWxajHP=Sbo&0 z1F$5NUQ-oRAMm6M?Ef8zG%7GzJug|bO` z&&$jGba?>66em)Y*Um4V_Fkx47n_?lE`NS=u+}G0_b&GGne$PhwkcjJ)$y+@ya=*( z551;29;)W@kbc;j9&<=wLML201i9GaC8F*rbpiL|9YAYVno1ty3g4D?U+$R_aqbB4 zuuR}`_UxG%ZwMkqm5-F@E48#cavx$yxHn=YXmTMV|#xj%O(b~zwNYR2!FctAe~*FB`!pyMDu z^in)4Y!X3OO7{_SwKHA@`XfIq)ayD4e?L4Vk>K6O-N{-mX@3#*GO>OOUdxNFX$Z!A zrnwKq$%$Rw0?c0L3jjUyZ2P0<)+dKg;JnQhT1kK+kFFbPw6@8Lg6Z`{-8OStB3hJEF)KR%DsY zF|wpi!LW&4BiUJeL2$5Cc>OgiTPRL>&VA2ogtFA7;VofRXc~MZO*p7o9*HVTbVw5< zwtNnWnyP&o!D_byxD#Ke6N`5Ounjs=*A9}+ndsh&_)X>W2MwM98$TtB-{!7%9F42y z3KrHeL(dtyqzE>>j~9(59Kwrd)}< zyuwwmUQ@hD|891WSSOdN?cx4%1Fg6uY85x4FPOAfiAc89XCqA&L$!8$&A2u4E8hze z=q|toU_H>1xWy{ul8Nf1i&!zZo!;%M)3R>k!GR29cS7Vv6pre)&*ayWoUdxA1@fbJ zljzTFfphMXUFJiFQXUAde#~vI|E2i0j!1f4)hoqNCa3J231d2)mN$Q&VSeupH(<9_JCJf9Yr}EDY2#!gS-&}%DeFC=AM zcP0QIMG|}u5-OERIf<-Gg(OJ%tfx93;-v!ur!@hyB&TQUHeq)og#qR>Sum74chIXLbgO;jkxu-;Ps zZA;VI`e`Cx7=%wTnq*2)N@_+e1a3U6p~^?CWz?WskW*sZ98;ihDvXF#rp$VjXF0I| zbc>&JNA>*Fm`%^?rk@md*wodI1M|C{0k^jQOhEsoAArmCB2jz1Mh4CT$sA!kn|4o0 z>He$Lk%~Yw8+D6pc!iOGr>##6Q@6XI&bx$SJ`f@4wwcLx(uDR0-J%t)@k?}coFj!c zM|28l4)t96AFi!i+5=znOc@ZEoL9N%!yi`c@7gCP?)>+@5gp|lA}&9@|A%S{J7CFa ziAPbkFK3?yY5(y7Tpe&Y{SJuuBz_(ccKtVI3x1_*m@_}TtG|UBX06FYTH=9noFW#F z>wk_fIY9nc=f^;Kc&fzNmFt)OVXn-+ zr|G%!Kvts~~tUuNKUjn`S zIBZKJ`ZXGSy~Yl6MwPM4s({s4m-k_FDN%mp$*rK3dL|n)t5`m78Q?8 z-FmP7_dGj)7 z|M@WPc__)PONpsUJS45Zir|m!0I1%28D%LZ>DGS`#6LaqulM*bGq+ktCue~tY8)%i$3<&(F2FLD3PF#7pfzl`|f&)dU*gMW3ks}K24lKD$U zzrH$g8&dzlZTQD8`P)2lw8)-?7k%+j@J-sd+Y_dJgp%``fbzI!V0r2^s#d{+A z#}#Mf}#b}|IQ%Dz4( zV$)0$BK_4!It4fq7Q}2lUQoKpS31`+i-s+;klc@|x4>@pNVL2v6rGx@j0(V9JTgsQotv;67M6Pjv&5|&*^ zm9af0WLS~rviy7@{xqKsFp+g?H#p_x>3^q)LS@PT4MxIs@0arSpC0~CD+7EX5ZZ*P zwuSyXjVZ%y0IYWSm3Kc=4g7gFf0gN<|5y+Q#%)crS~dU6U2(Ap2*tES4g8<%O}}gt zTqZDXZ!@0H;{Rja|7mH?>4kqD~ec{^wDej*KKe+;!Vg`JZ|8}pzsey55Q+|?v%Y@c){^DKQqH7!f zcCVpN0;yOYTH<^E$7%j$0m3W*O>#l+nW&80m%QV#ZpXc#E2UW)BY{y-QsqF5*-Fyt;Rn&5&wHThkd+rQLj!jyYgp&;7Xcb*NIHjxWF!R zXe)fsExBcB8Thnob>t&|p~w2~e!{P!{h_`tUk?jRu;iDLG6SNy^k1t(j*qU_-;_SY z6())`Md=op>Ia+d8`lsH>=$mM%uga+CDX9VX>+qR=KLny^=UZj8Y(G7oYa4?al_NM$wS-D1U>)#Jd(#1j`RIyq9RRA}{zG zRw7=~9fec?z}H)xoGOl^?-{+A@;yj?F7$FeRmCTPd(^xvxZ)mIa0pz9QEfnF9V?6+cDhV#0C; zow+RB?E;l5Mf}UC^9QVNGdyycejJ_ub>KUK!U9t)`6c81m$O(#3LjR}vW*p)vfsad z-^ag&#oZnE45ESk^n%)>#c%okhLNC6=Q3y^@)`MJ|C?41)pq(kzsf@EEp$j%tn?vw z+I^^Br7h4hupl(j7-9LY`@09UJ7edSl-M7CLO2*fo9YOIE+|mORg8EqQlFIDeBqGhit$?xx3~ z_t+$1S(p^T&UJh+G$X86U}Cu0xS{9Cgl>+J$MP6#g49-n(b~MhjEQ- z5-Dt_tgwj*djnPDmNLLdCC%IP{U&T<**sZ!Y%>eNylvG~K`r zI=T6dh;wDXq~-EKkSE~jzai~u@e>LhfciE8nDRfhv1#@dQ?U@Xne3TJ%mGM^A&?uy zOygG431IqYJLvD@of^8iJ!eJ3>k!Mx_+l-u{`ueH0*MDQH#(ZJG|>jDYiOpfPc zuMFlHgZntCKh>*=p~pUt`emu!GlSvRU#Giao$>h9{-Tw73jUU2bD)Rg70uFF*WUGN z53t2wrD#Cr>pzuDjAeZVLw3qf>e)AUwP=t9gnNAfwiLrBnI42y?DfNfM#9qCATn^E zU|PMl4qvAsPq9uf=3MuZX{Wr(Irx>13!3`UC8EuD^xg;ndsAzkMMprM!)FCd*(Iz8 zHQFgLr4gKh92~5P1O%0Jq(khHok6A30|(c3Fd~?NwflA>L1TnPK3n6~2%0+Y7M_)z z27F5-@g_7o(h(9m5UnEx^PP!A+?_R~zfHU1*(b4O^FGBaU^;LU!jr_AwK)dXnuhWz=U@~ycvuof2 z9ve6M^3@hE%K?QxpFUkqYOotF4-4PFtE)rer^1L%sK zta<~rmrZyt00D#dQ*lhc5ZNlVKi+h_Ia67?(#63mEv?1*@WXB1ru_y2?d(8%0J4u9 z4o1AsbrEd#%tl@

dbgD&O3dIsnM57l0NJ)jMf^+TphZQMt(<9&)0J5&&>v)!M#1 zzG-2Oe6cw!+~dVw(Hl0S3V(DVfutcHF>3wwzzyZ&_jwAmc6b0_C`O^ODL{S12$uma zEC5>rS;1q`ya`Z^EyDVoAJfsgCvRQ5r_{S5km23T{o-TS1Sj#STU*QB9w6OSO2g`o z;yxu&8_c7!|8>p%u|{#&v**>Cb8T5M!pwr9WdPzPn5LbKxk$JCNq2_OXNhygkMf5# zPCA9H8T0vkwA*YoqBtTvn!F|Y&c~&8!W2AZ%Otj%I19O>@i>21*k#UFlu*>*qn{aJ z3~CZFLsNV^uqUB z+fq=6GroRtQ(*A28vYFhDb-#xMRFkSMY{qhK+KR|@cY)EMKVj>>Fi?=%qdA#pOPdy zY3@HgfoG;N;i$HlV>J~BCNW6$(W56-h+U%>QBhUt$)yIEU^g?WM7zTW;?>0J(EolHQrpb-{(|uo218; zfIP982!0pGks`}Aqx68~$N&jfY|suPE>bbNar2IM!}7at-}r4mJ$9I`sHb0fkDp58 zsPHCG)?`B};jd9WK~*GjQqyZ>#`!}J&_j8Jrdd*ZAOOW31Y6%@Da1Fy@!Q$yeZ*pd zbvk0xfeD9!?oL=8c8jJ_xg^qj;1K%UwOHt(RreF~2iEu6fy=~!gF z2CbCWbN#a1QJPmV$+hMoBeuQnlbPN44RN0iacqbMRRPr-$#B+cZDRIpzy14!GUKs! zjnv!il2ENNvHUXu#Tkdbf4NJ_S5|;4ryjA!5?pFW3TFn$C%x%6CzI0N9N^ksOIabLF#>gf#jywg^e0C~oJKpouqb7y@0!MDn<0CHuvN6?4W_aC_Nl-x za_tY;m+hnIz)1$_>UxlX4-W>vKG~YK5+$ct9RtZ$mG^!?6NdZR_JWo;LM9ymhO$Uk z)B{^1w?j23tN2ydNDlIrV5v?QRrI&=zqP;nNofB$&mm`VroefY5M65|2f9_Q{$3~H zvn1-VwUIgP9I-F+_~5{4&Kw-%3{lJ^Rll@hMZ zHFmiA$VycOwl+EWftt;LU#r<#uOw-i&)~1f%{h%61>~hoN&td!^VoS}u4H-l$xOQw zi85NdLg7BO0wm*wDKLV zqM)@IBLuUi{A>}Ms12h&Oea@72u5I3ZJ(}G0;5;eik(iqyLxya(4l6$Nq-^Dj9pBy zKH+et)|A4kcmi8pWDM&)e59{;Cy>zB37Ane+YBsg|9B++bEBLh+SAWzRznu2@&${&>4a|APTv&o^Bl3ylDFgvh2;N7MT+XNB$# zmOfBXw6?|#M>)9k74M6HBpY-9+eWbj{-I!fvZ=iwUW@v|2Z-beQhn4x=7VkjFtbWu ze3H{*y>!=KQ$y+)9Dm&q)*d}`Yjt}Vt_TtkQw$#w2z47;LTnTsDZa{eN+INJZPccP zegb9uKhC~7E~>Q)_ke^63IZajfJ#eCqaYp99nv)*odW_2A`Q|K(%m%-Dc!=*snRvn zz)-{7jVC;MJm=o;{^M_E)IEFN{l05GYprKJ%M@}zNu0n(yi6StapT_Jahvn)760WF zs_iqLy8=&uL6=For?XsFzPboAg%_Lk#Q<&OFSbNcw{bKhMowlgI>^hvFcn84zTEio zIFte62J~0eXwC(I5v42ZnajAH=Ro4}Vo&yznVA(k{JaGRg9mDT%+-lcJ`#Hpbr}gw=0; zcp9h zavXm#IEKB<6%Jt5wrQ7?L`5FnTHOl>L=U%?Z@tSX`0Q+%3bGgqo!%R)eb1m-zqMbN zZ99~sSTqf@@|UcS;hDBi^r!`&2;V=hogdZCP}tH_+Cf}~a}NL-4+kDa$IN57sy)Rl z`NRzr*d8GY{+V01G{0N2A94KetJm51XUuG`ot@a`qE$a#ht(nA%M{j5#TBsI|0*uA zL%w(`81pVZl~Cj?98%R6f2M%H4Ulgpt;G^ZISSM8n}bMLV@6H?#v+qX6WO;MF&=br zSPXa_w6I@|+vEFGcru+81qOPc2DRG3>`$~Rw^R5|Xz|!!0YkaPTR^aXEd~&9NfsF0 zd_MTH5g73;oja}pKwf$vC}@>Mu1-7zJlUm7fi^tA7!c>!3(UsL$$HtxXC9j=+~uZ? z7y}clko{Xm?Q-E3u*UGMh9hafpMG)CNWu}UFFTCYKjk(X`BXn-$^&GY=WspL+(N2fFWz)i!cfeD3*@_8C#KkL&+ zL@^V$SfKx%|9bxfC?|3F%x$0U%>=wn?+A?rf;_D0bpVE>;p;k-i#>fR-GN83affq$ z5om>C0TL=+0px6!?+SD(CyRy3i2|i^@#VwXJItJUrr^GN15s-ud6SEPzK^ySn@^I@ zTcP(!XN$6d_+@Aju;Tap>U9l~^54Y8#Ia^ql=EQ>9`c17)}z5uu{;*m>gnlevfQo1 zvP%;XTgT&pLKli^<_MVNf3VZTHGU-9uO);I zc&$|ZSo8?UQX}cnXZ7aug2Bdp7w6K;%5xxkjqTg)p$DD`H}UTlT}Xmt8NO#$R08t zP)v3T1vU5>-*E~H`fz1rY_Trr_5|w#i|Yjk`OBzwV4&kGsVI<(DucST1H*OzC0JIE zJLLkRJk+aSqtrecQfzx4$RC*@3w87Tbs`AF@`)x&ODIg|C2X`!jm$UR{^|t(^;via zmXdPILa9&E+byRi{PHedpBHm7x; zJpx0R#Nw!c`wfL*CRABb*(8m`ZUBI@p^!}@%;WwXYB3Gb|bV#tNjfDFhtUH?U z{#2^N0GWBV%bch3TN1`4n{GJRNDJ8u$LRGnORRt=32qf9f!Bxg=zw19n@NURJxNHR z&(^!{WAu40TL&qob@rLk2Qp&r3I&=lGN79fKDII>b1p%{J$~*sAYcV5LS+?Bk40Ui z@QPDW|J&IB6ggZTE#84<$*J; z1YNhMYyI>xfbo%CPoCJLzWpvY(>i|0VwRso&SKt8I2R+8%4<7WV75Nd%*FZ0ckg!R z*Q2@ao&o#{eS+P3voUd?f!btY8+~pH-8c0oJbk(@vGlEhi=A_jh~uLt7r4Pe?yQ;! zKTkH3G$=hEU$<_*`IlPmLYVdLXB4vA*R4Dg=;Oke@_cy6%wHrz<^jmec^ec19zZ!-z%s zzCce5J!7*#&d9ulc&c}mb%fESOG>S$gruZ)()DGAO+tU}l9x2wb5)>z!`iK*qchFy zFSFI&jeQS_kS|N=WD-&V#qJsy-_FJ?Pu7U7{P5OPwZ1ca(xm)}jHlio)-nnxp(osOFJBEcOQzo{1_+gn*MDB$Q*aIFW7%zF^ZumD+Nr1m~ zKpCRiL{HRmsy1`X-Agwf!g!|i9N0=vsg#8$Y_fJWFj!jdv*I)O zI=j;@=a1y6-H6|m?ag)!0U=5~L^R1;d7>5VP@om!20iS#m73(h)z}6Qht>ex&EMZY zp+I1So$u<@_o~b88xf$$kXCFUewH;Q1s7 z_Q&l_^$C^WaOKk!;4p_*^Rlxmtqm6~s;9)i-Ow=3LL(*@{7u|DjL7~Q@SNSaXk)W} z>Y#`1m65PXSI-XU6Kg^&D?#=hh1JqKhHXPu{oMbz`pb_H`*OuOXJmVK&C!i0Z!88- z#E9+lMl%Nn2EsL0INuC3BHjudi?LQ0DR+>~nEcIkeRpF2{^~(6rfgRdezCiulKo3# zASoKyP@yw|xXkOg5`GG32#t|~5si0b12*YC{ulf0uYmN=4J-2eoIEL1x0Wdr9qG_t zw9d8bHaCF095eh|_j%3&;LX=fmi|a_J-qx#zkBGoCSBrpjjlhh^_LI&+rbp^x&H0? z!6rTLBCs9IdI0^Kh2qL}W1t5wGCZ7mXQv}WC0BzNYNMO0S}ramz~TP`KP3A}s#Y`u zyHz_Uuh(f!*E9Wnm8(8R{|)b`!`ILGNqly2id3D6vNYBoS0tRmr?XQMa`@4IV$~P? zeG~q2@jLg<*L|7w#)bc_^8cI920&Z+|Kmn9y_Ah4Wqc*T-}u z+H_Lfd}P!c{JqZn9R>m{?t;k_YN`8m3TM;fFSahHRBlRy^@OHN=~WV?wPffR-zerA zh;E&~zc6qiFj&G+l$6IQJb8b#H3$EX<_>htc2Gd#Tkp{k` zf<0HR^`_K35wNO@^`1+l-m7Z!P^~JsMXw$mhREB~2^418U2T6fzz}$e@$SGVjls~B z*F^vJom7`H_Ocf|9f_|J{o8$g|J6Ufl9T}0S&lEhwMzfv2>oi?|M3~NDDeM$?I?J! z{L4-K_%+|x>i_=>shNsX+Jocuy8uB1TEI9?>QAXX5fw%GzmJQ10L${eb1CqW5(BrI z7I&k#*YTqIM2$t1n3!0%6G$r_c@a7XG_u*PCxyzte{|;$lfbyBz~7e}Lq*II$*f&H zDKsse@>dm)tOn13>uJd|s`qDCc76q7)R06TnVqj~nV|d_r3}d% zjojzGn~Z9OWmA@8d2~RZXH#*AnrpJmiPe;(MjU!^xO62Bk4nh;1XfyQIVfP@t>s3` zBH!?E>CT-Gk>M|7fsWyZ_li*Grh{_Rfr$E(gLvma`$eKyDPYL%g{r**od(0q)6;c= ziQ_qMAmF6r&$>O5F9YjIkn}s=w}$n;kDXu9v2}9nSM}EK29iPm;Ca2dm8yxh9OWTU zq7@5Gd1T`qhCp^z7tECm25*kZqWT}5tnJ&*7R0|}(e2Lt`d4H3_owvluc+}aA4-fb zmOjQq9}>nl8hoG_!44vm1kxm@;)h6K?FB%;s&e0DcC-tJHT2l=eej8O+B-&N@uG&Z zT(XC&!zWIWN`s99%0uZ>E%yu_wr&V_9Ym;UXEzLH#!BwxCw7JE@-GhFcb`}TO0C#e zGMb}+wN%FHK?Y9XOZ9@;NN-(nZn|CUh@o_f=>u3bQ8`*75iwf zmX?4!@Kz^LcJWA*XV~O0pk7QGbx$L#_x)Hlp->c1zk6d;9GbkGw=c(PYj|>EJH=h> zz~{RCtuiz0m(9csMEPzt9fXh3{VSCXHIAZi9$wW>DcOIhyx{ zuO*fKZ2rUPeFTK*kTm#Cb_#&F+EaMh^2f9`VMxBq^kkPQGm~Cjoc1#0vt}_V-Fg1{ zTDZfc0MNa*yEs<9VL8IkMM}u1TJU*9oQF6l@J8X7Qogv8M{mie;X~N=_6ukqGQh#J z4{_@Obm2UaY#=p*lyI=oBFT9K#-3anew`p2!N&G9Np%9^QQdpwoD79SQkxTKB)r!& z=@c>8*(@*IPlZ_sOk(-Aw^2B$)z9)+Pt!V)aUuXGYaNO2;wGY{=TNDxt=rY>M#P-p zDW421;F{)^n{EYK4}2VG8iioK5z(b730?m!5t4(frVM+3Cv-_fv01HmVQ zE<2P*moQ^&*P&0n$&`QPk>%;tpZh(0dM_>QG2v;zL!LoqJnPJ}=+G zJiWraVg6j%hL_ZHI(NB++Cj~kG=<4u&@OTI>NQk9h>%R%Z!h4$cmhhfm| zI9?7q4V5t%!)*=TuTg_ltl1%^C8xjypZBUr!8>;zQ@Yk9LcM@~(DOXw0#uX31gOTD zoUTNaO=t+s?Cp?qIO50jKLHYh*qoAPBqtsV%kdoOPnQ&M55zWmLL{b9Vu+!{Q#RscH6=gI_eq$mfbY@vI}ChVrzG z4bn)+A3v%_*DEHQdqgAZs^U){f_9~Zy~J_f3wi}l>lJ5Rtx5MIACEe9DGxq)eqKm_ z_6fTPg1kYmULWI;fF)OZlj$d~d6W9vs*M7PlhOqs!5c&6eLN8~=fDRaW!82DT`@HY zJDT4O-Q=Iq^}K+dzGnL61q&*|4d`Gmvmdea$Vs%RnUyCgVze-^t+?iQ_~CI}!gHmb zR(j?71A!OYsh+#58rm)ZiN_tZr)yVcU^&{IXj}JKOD9R7@L<>iW`ax>)az?Z7M#-c zUayR$V_+E49WcLhmtAKl;oj6Gy}lg$xy=*>a@N~5xtRkTC}8H&W`o?2j)JX#1-upK zpU#{*7RxIc6)oWSwB@S)mhebRe^#VS%f)e!q-2~n6~XN_mgU#jDCk_wzSYLFQRWlf zs(9JB-%}(JIdO*eQ+u`qoL#Ixb&!bo5Oq_EfMaJs@8g}PIcn^hKT?4VvM5i^JR+yC*5){_nC8dyft)*I?(t_6 z@9$kTAE|0&mg#4isGCrIter z&D1mtLRSpg;P&#&8#54HVlOs1?lZ{U?AmYSxX&3EuXDO7#qnPJG1zOOzbT2zL(-Fr zi3g0*mlWH&B-QPv-u%_mWgREJH6R{S$C*)>ysemDg#Kn z5|KZ!dHI^2qwjCFkX3R1${JH6YZqPZ^YkIK5IHZHQP8y(Hv)9@(*lgP*jaE&X>-UN zxQqRjq-D4H4ND_S;d7R!+{7Q>-hKME)5sP~4Xs9*neqfi zULMI?&iPo?m$;#_FuA%}e$ z6=hb|y=nL9AM=1AcfyY@woE^AzYeZq*SyMQpp?CMwi>H1*JR9Zmo?8qOh}`yXQz3+ z9@{3bIr2ivDw(Sh%NPrwqmcNeY<00~InBEcG+L2+EzYrwM{g|4DMsQvHUtPvEFf8t zmEK~rt`~%Fa$!lf;}uefL#@fg-}(?)G%jTZYmU>)$>5m215Hl8NgP9%9KR~fRsb|0Qy3ERDS7q+Qy%i-tw(|;Ux#p*ynOY$L4i8+XaH#HZ@3s|YjodET zzIp=48r3R&@N}!zt#|0ZQ7`{Jjrph9@6`3Vpv^61=$a$oSc|qh*bI$5Y!!>JEIlJD ze^zeRGe&M5g;Sc zSr4r!5sIwtk!)Oj!FAoX`&DU~E!qombkJW_DZgK!Nyv5KOBd7a)WeB|T=<~LZ=Dbj< z7BdZg*HkC~PTaNMt z5Gp*?;L@ebcMaI3wmy2_=Rs3uSqg+SX`km0!j-TuCdlTxgt~pNc71bdVszn#XNK7^ z+3@kA!mH$`rKh{=wq^YnyZJp2ZNVUlsp^oOvL~ys>}bQMK`WoD`_{)KEBW^KHD>hP zpL%ImYpIBs$jV6OM098j%V*-qPrx_EN;>&j+4pLWT6`~%(1~t z32?ZLQto3Th|~UCYu!p&JnI>zYFoY7hct&3OM9SyaGZ zkB#sOGaVN#6^r0EERBh0szK#K2P$duhoOM6jlwDQ$+~B3oqj z({ko4A+s>5h^TqSeXO3T)Qc9OxOvO^bcaXau+TX0E4y`P0N<^>gs)MLbXODTOjI2kFQu-e9`py7ld9?fnjua06`f_i0NYJv( zv26TPY;yVApLm7}LbvAb%QT>*{d;woNXv{vhP}+ksMry&xg*w8+gPtGOBWJ{PN|$k z%s>~`A8+Nzxvd9D?XLUs?k=}qbDul4+x_e{alEJGR_n&N%59!=<0Yw^g%wfip-IZ@ z?m#Kc((}=BKCh8rs*snT%rciHT3UrceED*q@!Rj*^WNSVKAgLJzY4^*!|S&FQkMKv z2V9`rZhESCjc*Z@EQ6gG>IwBzo@=-8@K~+ULvN@y8MENeGm(~eUx3DB%%vP%`EghNoV;60fP9bHN1Ml!;~-7?|MLl#vIEf5`8`l~`yNeFqpp-Mx+yJULjU z%LmL#`zQUC`Q2|rk;Yd*n5V6KUM~{5h!n!<}ZOT(5aa(%V$iP^&%} z6F1L18`1jWm~0l^%G$a)?o->R{A0yzzDMpd#712Xs=mRj=(C5`C9`V6d_;0m#YdSm5jHPN5tRX@ zIu)A04s#}Yl@m$hv!q{N1!}i6 z!W5RM8%F~(9t9tgEuIZbhSm%&Oo*$E0F#aPtK68?L|j;e4S-VB|1cGL2i^5RlXB_xZkW71_} zLGTh)eIcfhnF3ldOD?|P+6ErG^E;WKCAmUj%)~LGo!JRWv)L;|E0)AAJT5zE7h#zt zSvBfH&~?jK1ImaG-CtWCUl6NLRta>~a}cT>Y!2&<|7zRCirb?6`k!S1F~;qd68y#d zGh1=@UUESl-wR30E!HS;eMXHT0jcIllZ@zyLPetJ*GeYVoI%~Au1ni@>ZejgNs=^` z3eya=Evv2X?@u~a6x!D&G205Q3cA-3FDIM6k8TDd0sGm)j^iK-adRIp$?Lgr5 z8H@S06WB6&p$tuXNrB1*MloLK5Ug1jxPen}$qnU{ivj%8`-t5bf!9GRRl8j4T7Zg% zS*5_CQD#p9RN&kIcS$#0P3YB1E#WF|g1Q)wN^Et$p5NIY!L~Bz{<*UA#>MAm^m8R$ za6_Hj;_(s3;FG#3BuFvrO`B%@S~li#110*kmzaS3W_~K){+lA>ffza5rwwR5Z=-?ZT>Anj~ zz?j7pThNV)qvfi;D%H^{#=TO$a-V-bs*LLxl{XQvJ}ut&psu&7A;+b)eJzJiiZq=; z8Xz0#q|r?pRAG;`_4pTTO@1qX$T|YDzYcB_raqPFzQG?|q#~yxlG%Oz2nkP0Q^VNV z-VPTe8`IX!=RCI6w8`I{3t@unb~*^^MP@2DL}<6qrQ6Kam@@THB-3*k>PwuI?$~k4 zx7K>N*sS)(=6Q{d5762UepNaRyien7L9|oFg+~Hww0m2xZP2Oa=I})pJTc6PQ1gC^YGI#2o!o?)-jEZ?s-OR_mIkn zE`qb21jI@@m!#IryF?NJS`Oz@n0*s4u_>&URX3|HW1TM>zclpKIVo*CFjwKGsHU8z z!!j49s&;pK+uqYYtCcID48ZHPmwhdkD&1AkVuWenmYhE#T4fBLQibbZR?vQttHbfc zKU$(D8YY8Ay?&aj&6)pz4(HDoh~Mh!z>Wt`iO5NJZlsJYz~LVP7`4vmclP(f_CDPa z2gWBo)s^_*9h=4NN2{t2SJy>x`9uX;!YW z>%Q)k)YfG5LYPy2NL+fSPjTQwF8T9&t)bm+((v_I`s`)Dx}ccf7`8Jv?@SeT51K*u z5$DGn7qLGVRDjHqF8#t}oI7@+XU*)2*!$SnLT~nZ{Vw<|dB7hj{gvL-bMuhpzBj2#dNSI>eiAg0hN#3dI9HmIG{*3yBP4wf`w5!2LIKvo zj(qpapU~*eWn)uU%qxl z*&|2gBm%UYEW4~!JwtlUFf4{N_Pb1Iyh{m&K%bt)Bi8XOjwZE7D`LEaHRY+!dM3@j z-4`Avmdw2XXcPHQ2IVUt17oa%&HGE~4j&1zCLKI&lP3Z@V_wVlD^9^pt&5+ZX6zsF_g#2t&%!l zmOD48#ygYDwx-PMv|^BPAcKA%LnVxQHkQ8;ZjwJ*a;%c0Ixu!muVl+7K%ED$W!_aC2nq-mg3c|s zPsUAZ4R-o{-k%5BcwX67uRbI;`ALB7Tk^}t_|Ep{0}#DhN$RU*8b^W57ICWLmsdl{ zlqEMuu8;)FzMUhJk5`sReI*NHOBS+Xf|2Oqa(V1Oxx->O)Sk6#QuWqtE$V|b$t7=qjxRAvKb(%qj4 zxUj%aYQU{MU`gqhbw+E!VOq8}EUtp1SUGX+t8vHJoWAsJnK$__rHDT9W>{&@DEFBR zM^=t1%4B=etbNI;@JcUU02joi-&;H1B4UKV78%Upz44R1x_h~V*5$6D1H-R=XDi_g z2NyyrDykjCP6%R~eN82CElMdUAi!$wwVI69Nw%DkuIaI?CZb9~#uJ3{^L_vBAs$L>i3pd}8wFG-HKr_;JzlPr! z@>qDZbFd#cTo98F7jlh5ByATO_aw3^LG#Q3L&NTV;$b}}59Sm4^KeQD5YUZ(cl@60+vEG| z59&ME)BQ=p09%w2*G$0WprEMm*#}=gwYFIP^ieli)oTBSqO1QFfwIe6Z=|9QL|f}6Bx$(J*1HoMQ> zy3fY0!yD|oISO^B(rX=hIv=_%FFDz{AUQF~z;s4c8()dPoQYK&f%h*TmD$?r3L1|Z z8g;F)+as6cAf`;2n~Ox0I?PkPYi`q8EI8KTh> z^oub}8Z|1Op7n*RSuu0#1y>AzS3>-AktOLc54^9*(~-29{8Tmk{cS21yKyJA1*Pj7 z=#6I<+5#VaY5iPsrYj1K`P(s9gM;6!-55(NdnO(o$X>g{vD{0c8%t|3U~U}csCEj= zAlgqozf6}DHE>5!QP>VY)uJSm0Pa{;KQLPFCrA11%Wq)<6O6;xks&X;yg5h`9wdM8 ziEIgYDFyR0`~5Urj9K6UF8_CDy8Yl{jqqiXF0P+x3qSt5M#f(;)mwuQSS2;!*7^UjGxKE#rdw1(zr>-(3Kkx&0g;RiGUFP z5;OVIBW}@OVldzm&X^+!oFuCb}P$WwuZeIfBG>#t^@#cP~b89)gM;# z$3^>nNBsC1tv&|3?7caUmfl}2&fSXwbuKc#l#}Z2rrVKdVz(+=Wsmr2-^HOMT<2@? zr^6|2(;I8nE}p@~q_{J+7TR=rc^>YpP(J5hUG3XvN}<3)(l6_=DgX0ve2yS_KpOP2 zZKDC6M#)B>4CKVyFScg<>b}2ymO%-$rYH~8FG&CM>wHugUjV22ePjh&ZNrI8a@iEW zRdA?cQkbjhn;katA6MaT-w=L^ZFn$pyx=X^`xANL-{@!GH`NN9<{FI#uC7*_qq$5sSrWz=Ckrm5i$lCM6|r1c3Hsq=QxE8qt*_F z7zv1pW17s&T>tri{(T92h97Kq8pqXvmqUY5_P)UsXjRL)u-v5t`6MA`TO<`Vnb*v% z)db8_6wL^oW7`)0SvbA$=>yGjW4RUOHp^2Fit#$Uwoc9(?c*+pE#!FpI&*#d~4#K0N$cyr6A^40ygA z#&K<}C%@kPZ9ss8Cti=n|8g6_SV~S!3#Ie-jXO(jlmUY4w?2I0wZpDDYtYpL?}2#T z)*QbkkH0R5K(muo*9Y`#K7S;-FH2G;b1#@N{l9JD-xuTMI%Y1r!EX0RKA?)^;(p0y zjD97495dkTO#8fQ#iU)zUaEkSOx_w=>BZy!yl%|Mo7z9M0DiDn;h!;c?;0pE*8{mG zrX$0TtysA8Sfzv)uU(7Qg(5p+3GYWJvOB*b|7Gy^Z(HIzuFp-fhi>Z!pouc4M9=-c z>N1O-(MQ)`m_NC!Q{$>QT7-V;e@j!Cm5fw`euwc>1IX$;0W0GNKX#~=L9Lu?Oa6V0 z|LbjrxX(?ZhorY|<&@v-*RRpYI(@{3`V8;k(#MDoq)}@oP%0 zj4agD`^Gn|M>9&_3)^ujPJ=z`OxDm@GIK7t;vNkJ@f?ZGLT}w`;{0fIt!dh1T7sa>Me37@804`U1yEwFtN`qUUNh@UpR6=!p%?2*f7~t?{#N%i<53*t^T{Y_~)~2 zReD)rTl#ALA=X!IgPkE0`;{%4LA*qMbv%o~I*SUFHGd5h5)=@z%9fYb-j^(>t)grG zml)vxgCkHX5Xrk1M~*%+=LIjYx_#ZTr$1QAI0(!)$@JE%6LCg2@K)+uR*bm-`)AZYwc{|vwV z>et0LBOCvQUw(CL!h&C#S=I~zyI*{?{%mOX$TYI8Q_EaCP1}FGigoG|V=B9J=n+>dkwq3Yb_UTM{_CM_VC=AFOXA1wojpc!%r;rb9zoNqo1A__ zGI%4>^0Gu2Rha3$yDnQZ-*OaFVZacd|L21vB7O6PLSU3>|HTX(pE%=Ka-jv9oxQz~ zeUrIHZ{bO!eD%VQk<)_=gWq+e{vBKViLvv}k>h?p+ty9i5`!)Rz?K2$LJ=s@<|^l# zR-nF4Hjj1OFA{wr@V_jBHK1QATUG5Jm}%;xU2W5K7^n|*3>3v_WSyOzW!ZNcrGNBb zT$6DBfB5lDGeDmr>Cb0j^E{4o&qy&y9SLq5L|+KMFsC3s4>kJZ5<@>+n;^J z-r3uau5;VfnAZawWYJvBoryBj=-zmC&Hb=RadYz=EFA2>#uWWXz2h$BY}yBpG+W&|~eO!qTmp6DJ?)!N) zP-ss}0De+vQNyzjn01$lnW%x{ncXC7DOqTW0DUw-N&zfS*;d#bov1$|Q1JClw+6sh zE`~IqjN!gdM^6L14jwsFzRkqZdZ6;Y=?XDtTI|m)LEz~OO;dsaJXj=#J^&FkRQVm z`Bp(qvc!SyKh=)I3C=fipi2mEwg$%j*9wiK?D;Q|AUv z-Y@17dX7uVmv2jq^<^HM;8S+)%y;Onty^XT>J{BQfMCU@{t8Q5x6lXS z&e>}8%lrTs{vXDN;9081;9YkF(1QHts6pec*Mz)xQ>mskkIGRrJSq0M(rUk7Qr^G zjxkK)pNu_kMw_&^z-Wa0?fLw*e0Nrl2Rhfm$6b|HV@U_;f7)sSz0WfZwmtiMW(%>Z zj0F;a4?zS?a5uhm-S}26=&hI#a(gXuPY@1b~1_GhG=!b69 zWSHl-()X3+zJViWjZbvF25sP4wFQ^}+K)u-XEy=d8JUGPRZ0?fyYAH*8hh})*nUjSLY13>64okgv zHnplFr4)q$=DbKCqTrffh3q z36J^|{%oGyODRi*UQyp!5d&Q0J|4PiJ~aY)4S27C{ISmcb)JGbq-kILeFZhwC%(ZR zV;PE~J4ZY<{ex~QN$lFyU(_e|mu(oL$vz7WktDNlSxePM%PG496Xmt}mx)!kAR7~9t5)7s&o4ml0687UgFYZCyz9L& zNoUFHu;1WO>cK;=DR5eE;qtOHeKvoOn1y||c*-%#y_g%cTae?OE{4>4`-u4DKR1c} zO<=e4&Jr!XTf^#4<}Vh$>Ad){maNAP3hmI}9ZOB6R+lH+0t1sDnH77&t8HO?vmK^? zw$V!7@)>C-=mPP(gmBhe&PjZ9q`f+lo_O`hARO;~tqZ!LZg81`qQsQ4#0p8d3a}k# z!RY!kK7(CEJcl@rWk-(~db^R7-L(mNZua`_7@`Es&M@6_k%@Sr`o>uD?$TSaEz6mF ztqXj87)fEQ=M!)1D(ow`LKG(9Q)^D^ znE*xfuH4g^tyDj2zIPPy=oHW?C=PXVIV_^{?Y!p3AKGBq?4#9^_*DyXL1 zZJpa~v#`N=1b_<#$dN-27i&UcBa0X1IVX=61E}`j_wwx*%(}p`WMh`^Vx>`@u7`8l z&h*3gGmi5!VF4lJbigFBXdUq;x?d3v{=&$TU6?y0(b17aar~HY>TJ?Kvf`A>j<=Qs#!bedM--nG3?2%}v7` z@DCv`tVV@272Kg}U^S8m`P6Ki$L>-@zB@u9DoOWrG7N0Rch35tE;!6y$B_)PcS9>CwMM&8X!B#c$n^WC2gEWijNZd*6 z0Zj^PZkw69Oyt^V5j{iPvl%iIvlyO}{n*c+4IFr8lP?5sr1XU_MdkJCS9Eq7x=-0y zR|;Ff1$4hLI{7>|Cr9Lg5^KavdB*ww=dpOsL-e$qtx`eY%I@HdZc3xTu0tji&eh1wz2%i&`5j&s zqd($Pk<&{8uGb%Id6Op}$%B22X5N}a(kqLvW9^yA$GYG&6myv7U-f68aX#}rLPSpH z!2q|lZta6QK}6tzrZhToL$0pE)?XHdZcg6nA@I-u?V0w64-qk}p^Wa!-;T%HjP0%B z6EC;h8KQHmR}h|&!M5|lN5&1`u-M)(6xEhk||H4S<54k z>RTfEv~ooJSZ2&Ebvg$8ndauO@qRhC{DRr?lO15JMMITo{+_cuqWIZYBytbJpm)%{7dM*dfa3da~HQ9w4eJ+`uY4bDKA$za**B+NS2 z=)}Wjw__w)K zy`+`ewwn59KA2@*i}p!u=3AkKy8!%N9R6~_{;X9I;<@xn=V&=YN7!53+cjUPNp*@u zo^k}mU8G6RK+^{#z&j4>mN2HOw!%}?i`iV<{t%t?F@CU(jG*BgmzM+Ws?To%Fg7VM zF)>Hh+4RU{{+pE)(0KAjsZK*tae_}(v&1z}!1M5#ZT@m5+SE+FIPCOjcglyr9qC@9?> zO6SnsA|0dD07EIw5E4Vjch5P;bJX`d&-=aqZ5)0w``&A>b**b%Yc2FE-2C$#1_W+w z>Vs>Uv8HOIRifyz%$jx5YFK1EpD<(DkB5s?hU(PlYhr#K4DuU9&ol&uxa|4*&dI38 zS4S<*tL(5cDS?@Wy!ozF{^{cGp{@o4<4{{i8z2|x&L`C zRI366+W<+#H-9Tnt=_4@1X>~6@n~gSKD1VTO#Dqq<8GmwOBHiVT>hGE7pmc;k1r0=#+cg^SMU9t(d3lVQgEiN4#cLT}G+L z0W(F?d|;YdH^!yu5#b6LL=UW&h(p*;RG8sf#@Zq4tv2KI28)YPYG#H;x7C?E71b}- zqMAnMa`!4s2bXVTgi^=f+gJ1C?%Cs8;`{Ua_%a?~0eWhZH-$IhCtdSn}aYs}tIgA|v4c1M2fw`_trvvq6#-~@}a?**b z&bI<|@rD-smf!xBc)X*YU0Bb8B9-6JeCq6ke|1%nw4Xv3DJ$2oI+mRM~S_gvUz zF&Shu^cx!rG@rxP9gU%}{hHaDI*apkN=OkSE@DBa;AlqOzV4BFT@rY0t(SinzY29H zGryat)w4{(m|FQeG2;qGMrs=U)u&A&n*|rzathS!O{u}I(}%ulLCb|3y{d)LsZ+Y) zGFnxuo*c4sVpti(G>>aJLg%Sdv{=fDeMZLPkvY@``dMZxLjI+5_iy|m zL{4>;a)XAGPWUzVgPUP!46vH2+em{q*L&uSdOyu2+_K7@thMV|TM_IrG3ZzgC@|41 zHRAw@=Zi0YX4F2Ecr}iQs!Db{59zO?>+r$31+}8*-H$pVKaJ$8#s(9xzCB|VYd&N3 zTwHscLeI{wOy+$&KoZyauHP}=C=E&?_@H1E5)&p!0%6OCow z0;5`@dr~&ggk~X}^FrMD+*nKJtjh<-y+LB5(56l7=;Ee?!sgkX5m*%R1AR~ygT~}7 z#95skzr?u7w;HJER9s0($+IE(&C0jEuHvgt(a|{3?$C!5^!WS9{BB-93Ijfd4{kbQ z#u~CpWcvWlRKE9uY|>ejl#+L?iCp7wid0IJFinhpzIR&nF2*E8)&xiv?al=VOtq2e zWPh@p@93Tz$HN;OleFtR+P~)c`S~q`rPMpX+XBA!B6-$cD!G3BCd#mEHB>h;c=~2Q zvG5sgcPvN2hU4y-ZPIipoSjXYnXQaUtXkPcyLbo+RZA3vJw2PO(pcXN%`F8gs;;{+l&Q_g!IGNI5 zotEQOGN|%qmDRD%X0_?~6AY_5o|gs`-xYzmHn_s~%4~;>8)rUP5}mH~guQNPh9nDe z@6zcO#w!;nYM3b(5Uwa7RtUvf4A15t$}Ij@>iLrtCKn$!=SeCEh~t5KZoKkikLE0sMecJXQtL&&Ff&s+vimk+gQmK zmjb~Z6@~Ew;+VHm7m|cu(fjF7H@L20k9*I)w}3abL6|vtISSNZ0ePjIRugy&H@6&9 zRw>Q6!H{RdVrU$-3}Ha4CoX?_qPE8XQ~pl8o?=ba<3=yf-AC?w8$-|{E%vyNZ!kMv5|@`V?8DZQl%dlC zy5GL8;4Td<^&}`s#xO!U6%x2p(9iQ(UMu{tsb9qff4;K+$Y2D=F>{U3b?C4{vM_e$ z2i7HFhA?p^C_m_}WA2wif3DqZJCxPr@YldHpHFwXqIlzWS!3B%jpmp1mIG=(Rbr-U z*1CmMtnd0-d1niI(rG;4tC3X6wTJ?{UWY83?+M2^hgim_Xr6j|KYRHW((HlE?@Op| z(OgtRuc$Pek*ID*iudOfNP$#s_aUgt10Et)Gl5#=73@S*s?aFaz&(XQ6%q@ZUS&8> z<~Nbq_uq2w4^$~Yo{<=E+pr;wl}Sfiu{mGxa$$(nD&HZ#U3i@5UcefZXw{$VJO3}WJ1+?AvzhZO6 z>rc;D6cnN1I~3t)=))Mx*F$iYbm)qLah&-1`E^zj838EJ>0NL|&Awk~a`QE+cpC?TqxnAYndWU?oQz z&_iY+vXS-j3M+>_=62&<4wkWF+Buk4PfhoT>2?gMx{uXuO+RNQ+-6kJ#4yRX)$?2t zeH3>ktfwv6uY75&ub-HKopN~6VdW4I$Xcg~Rb~t$h|#$8EV4L!wH-iJ9c!q-az^uN8d zfD3F@rZ7pVro0UJ4UF9@O*Skg4 zD@bS1>7A8h?LISyaJ%=!2Rg)lH+>9) zM8wB8DcHCp2oZF>y|ufk*O2QlJ^Ou0(Qw+uB;8j!}X(k9X(|f|I6k6{q!SgT`}}QK)T(KslOUk*vjUF!7-lMCl7aUbP{%I%S{}sG4IgV4DxI2x_&2@2jh_+thP1h1|HpXJkHh=_5A)+!ovq_ zP?3C-&ymhws(EG$dSBL92}RxI@f_qe)P^HNKx!AVw`Rt@K_DnC@r8`f|IHhTCDKO2 z_8yflx|_>i(SKA06E5G^{|_9roNY$lEv;sJ%#E(?F?m5p7N+Iy3 zypI}vPz62iC9;gVSBxF_5y>%y8fA~o17U7RDq6MXt9OPFeesX{asvve=);yf-mXlh z6G1iVH6{5>Le~Zo$?}fkr)M%d6bSh37y58Fhro@2g5;;;nj1f`^}o7cN(|J?JKYNDW#OL5}a zK8oo@G4Zl+(`Vyo<}hoU6||mcIws)%?eeVcHg?G$%7>B(ZVcW&4as6K&;krE3x!x% z#0r~ zx1+Du)H+7R?qC_Zuwy${B(TsE8?h)u7*t={H`UsV-M!|z%ys=GCdOQNTX+{FFs-mqoQN%L|vch%@%FHGBoVK+|Z+qg0%$J6xbq zyUsxawTBCx4ufb@6duWe@b2}FrPr8zxF5;yzOSKk)Wju^sz-aycuf6IweP<{pTGW1 zF%8tcwru27F3h`=dC)3(#b=B6rZ5Eboor#yDb++FN%MX~;aEGhX*nrIty3 z030v2+#|PxoWTrp{HeQyg!JzFWZ@eujp>^(E2$MwJ$tSim@_lDR?u;_ zJJ+h1Z+NY|XQezK0$B+RaT|GHTL)bzP+Rzz6(oB+^k4D#Z(dyQ)r~0Ih5$3V4crdJ z$^6_`5L*MW)t0V!Z15w;Ttmv5*#@EKP9x0%k%g(U@DPcmjO$4Yy$!yL%+Dqbe1+yBh?-sar?ADQH zo#BvP?)hfat6ewG$)xr658Y6deU5du$EKZFepo_WMFzx$yua0h{4l2=Ds8dYfPG^RHhC_XU;s;JJQY&@Ve)VN^i60Q4C# z6=Ed@(t(--?jK=MM&HBb9*|T4*5L49=59KKXx z%X|J}dyOz%HwEP@jeg!Fk&8uejf*CW7eMYCrB5N=y=o-Y?PQw%scolrXK4XMc;*o0 zN;|5!qxQ<7(_@_7o7ZrY0c~wuQo^v~(a{AlyRuz3sE7VOU+B5YFk&XAFG3*%u|jYt z=qxCk_5tVGvs>gVgV{l=HWUBFA^eS`{&a2RZ?1zL7h>yK;Cptj(u+(1MzzzWA|lNj zFnI!7F5DVb&mk7Ns0o_-fw_-VTr)O#%j}SZ^`%4ESU7#j+jHzBjN<_89PSltDdsCn zkVNl6$L$r1WIah36R63BvSm{Z8Sk7Wc?j6mkS?v&ULVXkcgG_nG~==|n^e#cih~?z zOgL`P6WA|~gn{}{Fa9m+o;N{T)i-uhJ&(1&DeY%~xgX5P5c3?P4#zn6{IUUULRhIq zm|ChOk5g$;pq-YHUXg00WVGi4PTfbWQi(n-sKTK_iP5Lh;WH5P7eK|H#~l%o(U}P} z!}Gn~akt3$U#RDI9jq+Z<^BK5{d{bEy69lx?;={j$WMdenW}P4e|X>L{TKTX6oJgc zmbt1__S7~{F)xzcbX?Me>EwBrd>(Rl2s@6Q^yn+b;PHZPl}K+inb+_!y}acVw3o`g z%EGM~q~UJwtnaL4v!WPc=|FrYGiM9432yg|hKlt`D#bKfi4;0c{!6Q+Ti29WFCiuXQ0`5VGiet z#FQong=+c#LEo7t{fD>su!z@&%62z5@iV>vpQp30mOzQoGz0~dDn@ts{YH>7<7^WB>q zkE_^CaY=0mN7@}%r zgc9mW!H9V6*ui;>0nn1(Q{#aeHQ7lPtKe-?$a9FNUu*|p{FYhcmVyf~*h^Atm zm}R{@2uC**r-FOU_?3D z$i=6=b+{-)<$2_Q9p>JktwC|g5ZB!F+uM{xPA|?u#gBjsjg88YML;eI++!3ECFSsK z{aF4zuh3IhSGNq5Y^S_{2<5FvcH-%#cf2w8Q)dOwX-_$z-(aAB#=(gqNg~SBd5D%k zcE@Wj8SUn{$?Jsp07W_=%@pewhZNJ*6}lt%>kkNon*}<|AJfvRGwU>2G>GkYzo0m9 z>KxE1O@)85HK1q|GhiJvGBDlfRfF71P_Q2-SzP&gAgBlQLN+xX`?D7}dwN;+q5-z0 zc+cABB6rHvCKehCXv&`OuW1rsC1R!soYQIP`F~C5emyqDuvc?$GluOw-#JkU`?TWW z5q{e~R5q5x!NHkoR(^+veW^h?1C;k%T>SU#*!(HGeKNj> zTuLK5ei%Ni?$aJ|#S+{p56fs{q4J{(1{S<$p1bkuR?+Y`n77}S@jn8})CtDb2>C2P z(FJEMFm#x?;Dnvy&0fL45GTw)jcYhPAt>;g_7&a!W?tMosttFKzb!8f-uq&JzRV*W>9Py!N0KT;;obm3_9L z$f85~2#}`xjXh(4H%`-eaX6{^gIVtX?l3An+XsJCeYZa9taOeylW~&%DKa7HqkNL;^UQHWUEWt5A13 ztL3c{5p|v9ry-!r;Cn0ff52(BD6qU0dw6`<-Qqm`B_o$H3Q5Gp;Y-ZIOES_&pU0!j z<$F(Myvj46lyUoRBgs~0u!jAgBRAd$wT9H%EmrtGZa#7=8%rH>Lbb)fH?r&2KZk$6 z0rLEKOy&?7h2F%?@p@R6h>F-?&1Kv=he*neU4S82&BkcH&CT6fN^mfn86eCMg=24b zLIjIW-xBGjDwxFYZU;_!fhz2w!#pj2G^Vjk5~s{3{c%*o;s0N-_fdX;%2X!1#IO)j za8)McGmxspzA#D)=ib5Z0$|c%u?r=p{Ma5;<}z+arvULisionoku~ySFITFvm{Ev5 zZ|Lb^&+{ed3?^cs5Ilbpc02&Lu5VB->FI-^IJe}UKCbU=Ve71Vsm(SD{x^v37x6ea z)hIjjg;O5h?0K(~G|CL6puU)gi_vItxr_AZ_}M43fMd}hzQq!O5A=S1zPHSlpUu&? zF*O&)pqRg;B(2Q7F=e1HRRS;~6Q|LBAAVok5&%U7*`T+nz4lK+-dG~dA`H?qykWPKOpT8_@OZlr$wWmI|0aG z7xa=dDhwptqft1A*zVSAyhu*6|4;AiUoXT>1@b+_f*3Jf!bT^1?{f=g5%d6=d%T*U zEJ2ac5jrH&FnlbNBZ7_*fKi&a79B+s9ETDNG^Nz-M*|(JV&1o?GOM=Y(XEt;>KIUf zS3fpu(-?hLuGHydX#`aJJnjpih$PCN>e7&$%)JwqD;=M&oTp9K?&(4hg`?%}4 zR0zd~bDwPWYKX(l2$P^F%GFBjm>A9&`vrR~Q=}X3Yi~QRX=vOk5Ks1wDWtu_BzAHR zJHNNK2<3=yU>kaeNw2z4{>T8?Hay-*LTaLe(B z6A((jN-XHANI#NWbk1J_q__sB^``04qwP_-ED?F$_;v<+53w4gW6fz6>Xq85rZ-715R^7!`k&Z*zCfo~ zQ!7r^n>M?jJkZzvC_m`qgKp|?o{6{uAU+#i&M*xFvsl)DVC1q z$~(4r@)E!pyU0cg+%=#mp8v)=|l9ujO6RJ?2vNx!3;EuHWb{g!~F(Oh}?Ab!H~lqkG<61W5+kwE}{IdZ+iZ7(A8C$zp_A znSs(hNUF|Z1?ZW8c1&n*T;35Pe}}I8+|cfNsPqdw*&nz) zPrIe};Iy;t!1pb^VS(%dS5oi)lJ&Fzv2A4B#UE}Gg;UgLTUwh9x5^d(0<{8ck018U zLdCpv)N=>V$=rE?*J&fth`}qi8Jpy8Oac#B*t9y5Mx#ekL;kKm$?3AUaW?@BnCcf|cp4sQK;`-k!NN!jKfD9J$_D z%VsICB{0*fDA5j(4Pfg{$m`esU0FeKj{A8-*-{~9Dhtz%?uyN_B;ZBJ;0Rt7wEp^F zyum05Qg5)v1>~9)7SoI!z0xxeA>N~tuG_sGGZk%2ZACfy3Yj+g2#*2I7k1uOQ%y{O zw#CK4kuyEhHn8OO8sx$wzD-FGVr~v32SCmd3lzxRry?!x#c|wma_+38^B=C`P?&F}*9CV@@t@Hb-e85xlvr@z~GCV?86IpP7k z%2=qI)0E8TsOjdg{y-|0Ij&c&SaaPh!>&EY5H++@X+PC&cJ_WfXC<4}?z5G_(nb|Q z=d&j(Bga^ITJ_nuug8UsuvS^Bl{!(qC#o!3^tHjSgw=Y;>d&H&LXyPBIm{RP$~=dP zBkzm273f)PKxf3mB(n%Bk@vueMwDb!b1s3%Z`!l71VZJQYHFc6&R?uotKAdFU_O!} zU@z9AQfRg=K6#ICR>$=?WLnknsWaP!!9o_0rsCckmlh!7n&#=4%mpLZq?5Lp5(H&# zrt09?Ae*7gSg~(YoK9;yH!MPkI4a;K|0F-;Mpu7~gXrFNPZ4eXA@BLqafcUPo{So? zi2r2>z$XnMBk#3SCqV{vMRf9f@|N}H(+5g4a(H*5O=5w5(saBj185sr1+74+s zFc7;jG_^6=$bgl|K9oS%KgT!8Pf6aQx0%lvp3j&fD9&lE&LBf1Sg>DhIdgx3K@HX# z3Gm0rQW_gYL-FeO?(fj~K$-BYYPkapDOCB&k4i=8+Y<_T`=!_!!?j#oH)&*sRG2Q% zL)(uwxoW#nFl6_{-z$A;0ZpQ*ZmNn%!>+7D4M&tF-meWN+SXGA?g{kUz>c4hQz zwGt7sP}f$T)*71$dk7af;~MYvM8>3x#saUwil7)JlfYOYQtlEU3- zYO`MAR;Fn|6_}N(q97bk;qO%l%^N62n;VX&zq!>XXhIbvb0J5d!O7b>?vGc*7Oq7j1V4^~@ zK9;X|a^P1ox+I0_7>)p?%KX?PI^BxgsZv~Lpsu)~lZD0tD^!1hgr>2iotRy|E-;hb z=tyP}77})x!PuPgSeK8#?fkIXqLq(M=R>+<;wH7H5hDv}>S3AIlI-@wwGX?V*6%^E ztw!||_c$fo_jF6SQ(;ig>7>E8)Ss*$;@qdMdV0P#buC%Ok*H;>bFF~jxJf(~^Ihhf zs}WC=C?`}VD3P&FF?(;SRkHBzKiQg)q-7dqq~g`+Yzi3<*yl4zo}1>~pRQ%I@0?6H zJQYl{g&uA$xkGfV`BR(gGaA<0wV5|+5!eKKAMN+{ZTBiRGl3o`esdmi?bbp*125c? zS)}$~c0~M~V3EVn4CDJa2rm8fk5{!X_A_&PeWSGZGZ`tM@C&AhEP5_s4%64yH~yZy zciM54Z+P%95ZlfZN~(%~ywhM0jac&M)1MAwLmS(5c?km>)%W48krSwLgY)zRbS?X$ z@BWN^^$;oHaIv)s9-qr{IKpA^v{&q=&eNwgO7O$}#6VJ(A|nuvWyf(+c#d465?nuS zBt%BW@PEnwyp+siS?7A(6C|?!T%w>+q`oTs_)FP~1^R-C^(D|WxK^9$?e><0(bSQd zgovTdU%+~5BJIpgkWd}Wid~&|dtGCEGMqjWv7u&!{weWJ2g^Eh{cs(-pHfj$;2rvS z@mwu&b1ft&B4ukBVE&i|z|kz|*4%zIez$VjdG6~m#$!*e^o;c2=c9$2p~X9&fAnJg zbZ)=k7(Mi^hbslQPk;KH77Z;g&$Mj#D)sR8=T{evzo+L|(&S`z9bpmmEeeQTNHHf* z=75;T4Qzib84`b?g&Z|W8pYR)+cN=+CtY=#Jh=1J?=!GvOuf{89bkkml6cWc?E41; z)2aL{_0AW(qlijKmbf%nD67o=zT|z+^yzW%Tvm0$klymtZ|)Y z0(Tgh94mtVG_u4bj2~tcr@dCC^=5maeB^lU^yQu$tS`aM!ZjKh6xWC{7VXs!2K7gzg}QkNX@g|mD=t!m|{GKG1H`0ku} z6KS$rTV0-g!`)w$K*93Tw#oH!<(19a*qXsC`x_1L8vP7PYSQYkAg2_H=KWA;gT0z> z!$A*%G-tR)%(^{MDr^s;Oy~YRH?+U2uZy!i!9@_XIQJMAT?_(Sp4r3NohFA9y+_U2COi zXBUb%9^?`fw(N{*Fwt|UZXL`ru)mRMu76p(qod<77Hls0db-EM6H71>*FQpkdlz?l zlqVq}L9t#{1~G~-(KM?|wt0MIvedpK&v{Wj2Zny?H8?b+6X)Pw+!;9Ix_N$MAnTdDokt=ODaQ z*4Csse5*lU?4&l6GTkcktxN`+)STB>D~pZEJ=XiH`?uC7bmjuvEBKNO4e}_b)%xf&(FrFSiL6| z!FcJzmHk5_QtJPhOwp=eTpDITufJRVORh(7b9oAJ#r{tJ%dsYVHI2O`O!pBH(EL{d zn_>5*Jb#3+s;SCRno%h@FFQ6w1!x)Bj4o-mk6wT@=k4MX~o8 zQteBNC`nXA#C^g-7x$Sa<4x-vFB*|lci}yvRMqj65^;ZQcNIu;Z7~>vR^)Z0!NaKv zS+@<*;IQ3R2K`LVpLm#0m%n6e5ATQ=brg<=imV}oTm?flSep~r$GsL~3RHud7=GOx z`S*+Xx4DQ41EM9-sGO;}_u0e3G(i$$SGardf(%%%4s6(#QlxDm~bhe0)?NsEwLX=3N?Nu7u z?UYw#&Bn&IZZ3yUNN&1*9EqLslugd;aFf?M(AcspZ18soH*tDZCuYs|Tt5 zN}V^fOnkVC*iz-%8M4)jz{MSW@8wy3mbc_DIiAna|ES>X2wsS=S7Jdqf7hY}CPdnh zG>^jyHC8aRqn{<*`7CK+@o~=hct4Btj8{^Ekz$fASDA!r0lejERfDKm%G6T<;={Zo zTn!ahPeD=|zLD@KZ)5+R<2>D>!~|QV071@q)4Y-Qr4?+xwn*`2F77*WVyUb4iD5sw zHvjPzzg}&lXj$Fidp~=QSJx+9rYc#z_ipe$W7#^eMHSfrZi%br2wi~~3$|9m9OB;C zFLhB_GP5GibjwFK+`Y=PS)CUhR$w{RQ+h1ElIRl3%F!B2ZpoFZnwF)Hz8I6i^wQ-* zLc+qFEm=cxH;p!Q*d%y1v^E`CQh0U0vS%yjDYEV+SyI%hg%yim&<9%7+1+K2$gL1b9H~`(zSP2uI8T| z7WME*?mMvxT)tQE(k3U?B<&>ZWNSyRL*W|-6(gUyWkHzN;=<|c*M=l&kR5b%lk;ZJ zJ3Vn+aaZ|~g`tQQ$M1Pt5fQk?QKY;AUb}I2uJGPIcTbi?9mSbb8y3L%|TPMj$rn##pMZ=Litt$ zJ#Q`#u2XM2_|$$+ObSoW7*voWtYg%mwQ_m7Kp8TB+hxhhlV9<8xilj(!SxAfrHKLU z=yizLBH6I9QHy{_UlclO2FE9&qLhLuYJsqW{c~C2qvAWe2}SnUcg&Iv4G)G*2KhUl z*5lASa>?j7k(mpQ?n{Ies1?ws`Z5=tc|5SmzU*rlz)JeX zX*OS1AHVFGP}30c=%Ku%x_bO@p#p^({EKwxQ4~DAHGVqKShG-}v96j~pgN($)dBnU zepJ$C6qNQ4tt{VF5AGud9Hu6fnTg_JYm$}!I1ftx!R4~Fe$@x0Ndf=Ym9&wlVQvy` za6X2gVw$bxswcq|5 zlc(g59x0G|9q5mj=(iDQgo*xSQh&VmkB89io45&&{>r~iUaP3htqdkW=0!88srvf) zO*wwR{xiXBzQ$gk{$W_4IuUk=SG5+Wk#@3Li4*eYAHI!$kwM*Vt|NriW>&~`f66(_ z>-4C7Vao;k_o9%r&nukx$qGl_V$6RMS04*Bq#3MBRb2GT-CWhmz-632+g5$p?%&j- zQ{4^t(etE%Mj;k_6DxK&y*28xjB)MvpHCHh6`?J>*=HNykOHoRzyD!y06usR!V?qe zF>pwGww7EJ6|doLtv}jdn_|GPv}7^L9}Wj?LP*P-jeqw8c? z6o~BoIAgeegq01CGwAF_^1DB?v9Spa{bP(vV7-vEbnweq39RJF3e%{=8r9E~o%ZpZ}d066Ho^+@In9WH3|3j ziDhC5FEi>{^iF>u(599l5V5_`BjM)eRz*Xnl`Y-GMr$=)rlMIXYLNNnYeBQps5YRz^$AI3!+C;n&!;X21R6Qy_<7!{jlRjLwZJ|5 zJYWIqzaqTf@cn&oe?H1r7#Bn5_b!NV{Pg1f`4|2KbmUANI)jQsm<|Q^@3-!qeE9HT zkK<3I+pgAvnK*uq_~bjsgVvIG2?yOC`K)t`kTsA=hMcj)yR9tgcJFj=eTF5f`B?YvNrOB#DGw!2lia4R-4GVcy)U!YWK%ccv`zaE z874U2;&W-SPo+RPB8b_7YO2mDVl4h%IWryixJO46ja;I55Esv}1#CTjUp$N?O2ghO zd@~ywo>K2bAf6f*gF>z#JV`<~)RH(MmmCMi!63)ZsK~4rZ?^4L+AYD$fn;@E-7oWK z$3%6^a6?n7_t=)U9EfX*q2KBR_QA7w)r?;FULtg9ubT0L%iJ&t{$3> z-k`Ww>N|8mHzOCtyFoCkY%=A6M7rduRYOq8n?|LgyL`=zfDOm@+MgGaYv(IMwg{FxH>3qfZOo!%Ni1 zk1_VpN3qMDZrvrN*Z-=|Z6)JJD0n_kvEsCjWjuqg=PJ|TwUt2fJx2oz^yp1gn)Mj? zT}dQ(ki>39>%PBMeu>GkQ-Xk-ob_`Mi##_{$<{aI>jr?e2(F16;k`+)Lbw;3-a_^plEP!d?D+~wzY1&)lX zZj^>>x`xzFTYEFI!Ygfazs5a}Z#?>TeNUI2mSdu8dK{Gu(kfn}sN}P_tZEj%9JaIA zYoZs-iEtoEIi4`DOWHq@vPx?w?Lr4GM7{;>vdrCw4~KpZ({E14C0JST(@r8F5?cEIvj4t>9Cyva~!THdp!g* zylxp*GpqF+yo;J|3Lt&t9!89;ReJwHm6}x0%ZxgrSj_VQkC+txT$eQ#qXn$Cz*W#- z(Sm^QyFN%e@?FpCaX-C`>7MIM^el4s90hq?l5mo0N;T9HUd@Xx#j_#OiEP@svI5ec zFYo1;CED8o{7W?9H&v|He>>d2;>Ihz%e!Ms^&9nq@G#QWl*q^z z#UC^X((dtf-IyQhX_dPXQBlEuXum+ub|8l!1QBW=`1_RVC>nql%*9PtKo z3@Od1-MTZL6*nW39jBh*&5#@6;ziUs(3~`vN$l7P!o*Z($PHIM21EuaT@&y9Rx?&# z;qtPlt948R)>bere4Z-cmjM^FWN4tLdieYRKEC(CGLg>iV?0ZdReI+;b0-<+g`u$N zYCo!?J%sySNf_l!g=sk@bt?94vKF0nI|Ni(*T3VlNvFBfTts9JGn}Pq|o)#wyB83)-hJEw0 zX=z+^wDLN1hC3ZEBU1V6q);Ry7VNnU{|h)hK?1>O)@hz_7}tK?mnP?inzhKFb$EFA z5XRE7!Z%I!aIoilI($w-!l`*uJ2Nx0Co@l}|NiRdB6Iw(HkSH>7u?MnO68ty9Ws#- z5vLmLC5mirb+Mq)dS#l4K`YxlsX4XXQFjC7hP*LvvaiU=EdJF>_{0AI{CZhB)ztPk z0Q=W{wuGS(8rC>1u#Pty6s*CU+E+~a1GDhR$l@$3A!<%#<@`;6R%Eqqg&LC~Xg4e_ z+2z{wmE?9R>$xkD?Oe6w7lR+wo-Jz4@15-@u$kJ-?UC?K4G_B08)TYi)RRlE+qYHn zuS4pbkZvZu0cjre*WCBUkWIRV#)gSH9Bsx9%F&(rZl4a(bINSYV!P%#%P~w<3p7>O z9}nu}X=Vl1n>7mr!O?S3*~AI$d!O&2?OWd0i4nEGH++zXU!FWCsu!BL@BT~X^AD;h zM*FJ&6_1#hG12u4vU5rZ%g%LcJSQcQl$BL#agWw2=NhpU`vv=j{1I6}KvdW)-;Yd9 z-Ec^QB?0|zPxLiCUM#Zhwd;eq?! zCvs&l4f@SVNf|}=dfog?QA37GFluZw__Z7yDsGSoXs^PGtzovms}6<8F_Q)Asc$-W zrv9rPKE8woFnJ`ERP20>;?h8h-I|gzkHuuexM@L99COtC{Oxza!8ZBOb(ye&dWm90 zaf}03r?Qs4X^G*f8?q4Y;ayd~rZ`^pl`Mhd7{hh77Qb(<)^QN!%7-^|dQZ67vUI0- z1d8ojx?X9hx6eQo)uF8b7|8RXUyWr<-Hgfk)wm=h0d}BTvD_*A*$@AT3NN5pp$`rY zZacg#hj#}GEu=QOXTg}NdDeG9FfklnE}lPg-*C#`U!bO7Yuj)Fe8GH=EXn#Ynnz^KR<64J|}n~d)t8c!_l#C?ci|-QQvV+8W}x6i`1~7r=nux1|6Pk3akx= zaTUCGXWK>bt0Kuvq@(+dY{25~bZ8!s z1}uWE>-f&5L(8t-@_A>O4wQ3-fYmc~fi^!BA%7jPyfSc9jQQ4~p8x8=pI?3bCV)_| z31dwrnNQTXFVS*>e`_p5OkV#Ih(Y(^Wt%C^N#geKI~{Kfu5?EaD|b@w)M<{;JAKYF z&L`$~(ykIvZErvq?A>_HKWf<|$YnYGK%%>Qd=X?O!R-8-eD%{>P7>?4Z{Mc;V?($1 z=Q+8a2nz8vcfk{)YtxRx_Raf zG5FX&yToEGYNr%0lY>eVPp7Nr`YhCB%TeYCmCH?|Y&lzm=+{#dQUF89%4nN7_JaSi z-k;AqT;{!`bo{cM1S3o1Q5~$)%2D__9f_9a2HE4Tjs4c|&XlaIADfyRXP8*09~*1> zT?}a2POLC@PavSpB>{!Oc~**tig3IzvN&db2wSHLt(xpz7H#saEn6|pPWy$qeSi4H z1cMHlhrV}d#&&phU%!5QZr`q~MStA) zY!Fy=(?t8_AGyXK%G&q2*K8=A72FNh@PCBBU!uJTIprAl^5AG=lsrG2uz1z z#{~MYT!F`t&(XdX_cgcY_EX-QL#s+)MfVOX54EPR$fSwy4JUP);rp}Os}P++(=yL# zdl*TX%`}c;qoztdQ(xC@)0o`cXNbYGLhZcBzBD!^FuhW=eqiefzjzbZlMb*A=&R;L zsRW>h30gC@jCBCG;Jae#|HePja~N7Wzo$XmX&3Sb)_L_@!rP4X=gJUx_(J5@q9-cd zo%ihBCf96W11ZLqL3f!ZD-?f%g+kpo$5O&)hy1peOw!{2n7@7?(*pArIJOiPl&Ls@ z#>leijAWG$c}g@N+U=@w<5jSRK4;ddvIsr3TebNP&-vL{ zxp*XCMGb2FKvU(mtOh*^nbt80zf&Lf8lzfO@Tc~6Zl^7HrExB*PEHJ5_5cAc?tP=+ z7SYZdiLM%q{f`GcmLOANce}~iT-a%8pXICOy&x4%jXU%pP?Cp!>z&v|MS0~{&$}Bu zaj4}IsK4Uo_-!BB>r4|9{B&#JU~X5uvi8PmeDBAH7jB6o@8py218Ru27s<D8Nz z8V_{Ya8PLTF9;2;qF?$9EiFX9yh8e~`@w#gC2cKm@v)Q6(5PR1Ih6#c+eGeGx&DtS zIX{DfmXMaWxDxJZ` z{eS&dS1%WWV1M!0Z0z38_xjIW|9NF&eEG$T7f;KjIV~rm`yx&JlU08H*5ILG3X^Bv z95s~q2bulLmCuD+CBD>`EVL|sd%Z7QY`zw*KWH5-{eRgLfckDe^z!qp(i>y7QmPOz z0rM6fB^8It$0s6Lb_`J#aHih8Qmz1 zL`G6J7K?~8(SEo{OZ-L194%jrvH=UA3~rha0F3CiYBoxeUw8#`0A5V)LfotbzNM~fD+YmJkxb(XU!cJl#}MI(3EnNqCI@{B!Sb^_vNe1yD(Sn&K1w0oq-r}(gr=yk8OCx zqYg2ro^#PEPWQ`rVO^P$IKlB@j@6~7m2F#@nZ&25_xPS&5qK!{v8|0HE`n_FjPjJs zr7Ld$nQgLPu#j565q@1ucXnbPIgO7mE~U4({mmZQb!mUkxqbuabTXy(Q_G-NpH(zz z5r(g5dT4ao23KZt48SLOWc{3qn-A~q99x7`F1kA{OObjDzDz^7X;T0>56vA0>|7QE?mUmiV_<|=#gE8 z&i+{^MHW=1k#ewWdI|FSGOyBJ^ZCU?WDXe>BV(VAGo2bUL%BYflb^z>UpHW|?id## zBk#9gvAi?swBKk7GvO}SH%rc=t?nJI_>ZxXYo$$W_&K=cO*CFH7>w-?7}XR@IPon|qms zJvyPOx1l^L-g#O(u;N0dOyA{27J)l3(};Pe2d)FiwU>swHyky!F4>){H$1yLaQcOg ze9YFe^Hd{hMS#R|)N+hG&SBY*BWb1@5ao&ERQN=)f+y@ytGVCm9jIJ<5>(0ra}1dO z#kc+8|9$Y7XNec^-`}(MiU)j2D5%_0*ldaMK9sFKIqDTL8klr7cItln)+XU_$}orK z3!^6qq(O2NGDB{k?M=g^mApB;u_1QpQ5+C1aG7@WG>;Z;nHFMC)R+bZlkyIjt4glt z5RgpWaZbQMa;p|(wL4W_d(v)`$L7|J1{sq-c^XxQ0D0OaSit@F2>mQ=uyrP4PfY2jg)&+^8Fx zvgipcmbaMGy;{3hy?i7X!>HDsTNoA3{JLni$2;+q9fB2H-aY z;*G59P5={zkl+48ZSVa70cKXglLAjcGoUGPJz6@MdYsl0dw;dJB7h0%v&!4m*||3= zsDLDjA0OZWH{38omXYyxeV;e9M>l(386=IJAe&`^utD<;<03zv_JMj5``s4t=Ct?UR zHNRzI-r;f>9~~WL^7G;-tN+RB=X7=4K{>Qsggjj%=u7OvU`|XLv6=f|;ESvq-T%Jq zG_HkQ`Dl^KhT0e!S&$p(R$q5DBqJhk*wyzQW#gVA14!O1?B;!3sCCC-*R9bic68v( zwo4^ZQC40#-7hft&PmV8Di$GE{Xr4gxh|K)y=F!PZTINr+q5b%S0&-(dl9;72SQ0t zm6@$1+RydwKz*;oQrVonwDT#pkSCwXVhd@wXs7LtB@ApSsVFmnl6O@=L0DLoL+9Un zApfa~0$Ly;Xt&5;=H_VVO-)siUaY7%y@56X98B8!e&|yoOD?xo?$sDUZ+HT@oDf4B5{fW`BxJu>v zsUtO|=olDXh)erd9sTjVI>*~{TdoRUSvunK`;vCUOCqwHw!vKb9o{wtD)o?R^I|)o zouWTON{s(yJGK_90{s{6wTHy*oB&}R)oX2h|yM_y8GvQWdbwGy%C&q zeeSz;dIq)}hEv_9dCT?3HS(!`R+`}n>UtAP|2BpH^`6-JQ{ukV$~6|d36r+@wTA?f z`7$$IK%azI>&R^yc~vu6hBV+GEa(`U>+SU+;&5Ab73|ya<1SOMpNw%X$qpwxem$-< zpP2AFE{snne`*qXOp=(pzZA;Cw(E|Vx0~4dXfAzWJ^3WD6D8*B4-?u3|+x-cikR`?*Nm9wR>VbIk=RyXg*r+|$L7px`+`Oz4|l`F>& zl9J#I#EjZ|-(2PtL}yvG%T#^!PxIHk69FIoqsBw~+QWHNUlyOikZ6&mU+s(;sIvAn zeVlD``QbKiQ1kWIQDInu&&vb+>L51>mS4()fA_8bZ+P^;bh*tjz*FhW{gTM@pj5)H z=?1>6eOdu|D14^+d!~J%+k3U|qTX)4mSUmc>U(G|{@zgT(6_yS*R8QSRGZVL+i$^l zWINqECGO4p^y*qCYkr@V&ngrPz#KP(Y%tIVw0T&pomG~?dqu7Z|i{d1B z-8|^+ZM=!11w%5GtG>x0r-eE9Dd*LbrM*R}+Qiq)oSFms61Vx>=}uFBs6@yQ^uD|5 zC*ko>%$B{JpX~wqveA($gj~pSfO?gHEH}T7G%@ej6$~Ti^RqL3+qfE()O#{|5?*h1 z9;UTg;Lyk=EAGcN?2BU%=VUQbjv6a79x6_Ust=`&0SekK5~>o&fAc;5lY>Qs|vQV zVJ>WCNUJlSBTFdz7P9V2o1cHNEdqz&1q=W@J(6zR9wY8bAH41<-lP3HRWH6R3-9QRASyM$84nT6yj9**s zaW=`oxB0EaJn;hFF?B;&+phGQbIQNzHiHIkI+1@$7XHn*k3OS4_pixKK2`-{spn2E z9sE31aHR;f!_7`^JuZrE*-&Q_mmK76d+q!~+L;CMaw#C9m)t$&2FLs%6Bmq`30Hj$ zgr?s)%?SRGaPPI|-7X-G(zLX+@M8Cs3i8s3;gEIn^=sdLURVY&3(mGfhgK2oaypsP zDck;m>I*kkHoS5~I@R*fUBanXg;fq;dPA)X4+Xha7;YeQyvH#o9y4!X$B2rwhuk+@ zk1a2KDy66>p(BD^00$i{RN?Pv+;rT?Xu9Z5EuZ@MbY`OHsYAqR@$5Uh0bL7wmt;CY z=DGcG*j5hx$-u=?^mUXk$ScXYK(|sGFoUtyHyAtQI|H={3>g}@|Ii?wC_PV!7w|3U zO*{-ZYC__adwy#RSV_OH1K)~wn{ci9&t>pHaxi7aE5m$~w z{~j_hINjgDlYvel6);<(I}>oxWf>n{{tgAS61>%z#w^@u>>%vZ!>X@RD%srt?Kwd& zky{YtbIN+(?~toE*KYfC-)&q5hPh08sp=+H*jyyx?rFAu=*4g*sIObN;Nu?18;2<} zUZB<1a14*D7c_uS> z=6RykC}ZLim+=#=DKSowlg5X_Rf%PwbL(ikpSd9~_+4W#oXw~EfL2pUaqTaGDc?*+xoSM?VS7?Rceg%Y*3U`BYp+9|*baTUl`C zoLiuMP(R{qIhW~Z(kn!ydeX7xF`;-}BM22*HET zo}+a(PIZI)W9>3Op1C0Z@*sq>&ljlbA;ru=fkE-h$j?B8p72Vx znF&W655dE46_DL|hW)gv;hRv|6|#CEw)v{x;2o^Gl894a=1SjtOX3&Q`%l>0ubWnJ z5={&kaT!4<+7~+&6~e3cff(1(mS5n+ZE99gn4Yqm5Z{=Y7-KapY-No-G3OHW_VI85iw*B z((?9RkB$(uCg*K*oAaXj%_(?l9OllN3kV}ebM)sncq?|wLT4shA`HSw=>WOIu}>0Ak9NnzShn++wCsST?vXLD(F55dNW0KDUykh&cJ&i0_BTs+vLLorC z%#TMNWB>#19g}G_CZ6NzXG}lq+RIe$AFu9badti>o@+~|kr6bvAER14*_pDC z&s})#ti6%m-#M>AD$;U(8(N*Kb2|bN6mnmp&X){V}&LQHZQXXupu@>1qph) zUSC`6h)8nG#*@i?`XRXkX$iEI9^Lvm9f3BOvUAl}mhac^Pzgun0UlQ6Z_3eFIDdP0 zz9NN3NNCirrr2Dw^J97>v2x24=+mv1^<3*d2Ydlv7S|KEl+A}cd6^67;reQ-t0|#7I#;^>#br_EeDS9N94k< zUQmpd7PE2z?KP*}fQK?2`E@65%R-)4!lftE)XO5tGmI;skrW}87*5g0P7^ z=01>tiv0bFm`;Can85EXdq2fnI;)PVcei041c0pseut)uy%7PbN3TTrT)MjTttxe( zUKL&oNe*T9h=Js?4{lpdSrztU!xunBe(YJ>fH1phzj*t|bB%-<&i+g@48Hr28+x)j zQ-&shz#?He$~kvVKP8}M8rM1R1n7Eou_Lk}{Seuk`{bE_z-qXPK`yG#VH<-|Lf2i1(OH?7w<|)qgK- z)O`!_`INrR1|a0X+i-U$O-NafP(0?NFhDl4D^r78v94`wV%*E9AYo)fv1Y@H&55%7 zZRahOqDE*jSDia{An8S?h}G1Rk8{BmYn+}_X%vG?x_}`%n#$kY) zO*tqqFj1n-`+ki;G-{;s=-CcHca!$=N(>ANk^*G!wKzV4Bi`nM{{`XQdu{0c`h&s< zW-Am5nx;TndipySp{WYZhbEE(D zD>0=sNs=zT$3|1^|M(dHHa`C2CD3mM#rq$!O#Zjd;6Hua$C1E=80b9}|MOw=k2m=B z^&as6#3aoAdPBPZ<%NnOH%$LWOe6mrR2+B@k)MF+1|iSxhm>DG%D?=K|Medtx3C_) z)DkI?4gJq<_%N>yX^`?ltzZ*%&D58%(^T&|!-@W(WfA$WKqAe5u4)wZ4@mCZ{Za7%s z4zU)0X2bn`a zZRQP`W`BQQxztz;CNzr<`Ie`LZ;IS;SWz6taW*ka&+DmGvyVBu4^I;P-UiTdq7pC_mG4OadY@)J&rd08 z!*eVgk;*9D375yB(L3*baz=W=sb$jVFE7H}o?9M-IhEg#JbqHA`AOZl9N!QL78kYr zN~x)-Rns#lX;}KN{Tvt9OHI z59Ns6B7^2z{?WW4XVn3$E#UExL_2Vrlnm7g)a!w}5+fiT$g2LKk1LYKbN7a(*Y3wI zbptt1bkr6)kZ<^i-2q5mvEMt^nBOa34|i7(vYU-Q%`k(0YJLn1u6|RyU$?aa7>md> z*10z9ZDF-=z2)rw0oE6m3UxlPe64 z{2`}hVM!EwMkZ_h@N)gN{$X{2R=GG!Qw_F+E9wJeK&TcAQURf~90qq@S}1j~Y@C{+ z%kf#iyP<PEslk^gm!A8z7AyYVC=^HgW`!w$d0Gw{YSsG& zsKNIS0T2dW%gNf~%-X~RU)xoAKaumIaw19UOx8StCB z&9{xNz4LX#g!1Ipn(IQ?pCyvNE~^N|Ai6YSx{-gYx1PkU%4SWzTms;tIjs}&^r6Bi zI)NJ#230*fk<23*=!|i_13qYIv3|9PhflE0(WLB>6L{wiVN1+cWg0%&y!Id&45}J1 zSlA!XYjmEwZc$UQzsTW)O)Z5LM4I))MA0vww&mm$TtCyxmThnhTyd0A7`PWCC(XwK zxbw!EtU5+WG|B@!2x{*WM0ClZB9-NVajsT*(8LwTsvZT*u)E|K}a#{Zp{H!Zd?Fd*D_tyQ!&*8y8|LL9BWU|;U3iz4scIC9^_xHULq%nQ21)!rCuwfq&Y@K$}{31ai# z&_2@NlrQ%kLjf+#)tWTy{J+GKVfqU&Em4$djs?vGi1EpN4 zJPry@C38i&q(j?b1Hhc9EG1`v>N=J}4{D?zJ#aa!Cn5U0|K!F-|Nl0M}i>QTc6CH;H_M%Zr<{6KS{K5nyIoo*vv1kv&rt4@UOI)IG>ER2bk`7=(Muu z>N}u!hW^5Nm@-1w!!HTo%KME39Eg}>~EfA-bW?%scV_Ff8G^}?(JS1a+I zDh@TjMef0xHv{HfN9`*92X@D(Bgoz04Pownnm+%dO(( zu6^nOEs?giFs4*-^VDSg9*;xobu$xAM5FZ>6`QR=S%J~N&7GzWcXbe4TMwiiMy4=}j74A!YK9;XmnRjuXJLR-XwrAJ` zh;-zv23PFd7hWWivX6Eer>Zb)Bb}$o|IX$Av6w$4@ylFMaCtQeTf{7j<*6mrPo)5| zLuC#Rr;b-thw!UqHqSYsTrIxWd=m^*aq1C0JuW}oWaV4HiArVWUp9du2l&mzfrO&* ze8reX_ETkQ5YM}q(f~izd?1x7h2Ndhk`3zcyt)NkmwfZLCn%g!3h4&W)Vprcl9Ym0 z4KguhHlrpht;fIs&Aq$zYa2xZ#B zdf%+8Y!*WSARz?{oPUobnb>r6<-VcNo2GWguy*($Dw{DWj{SZ|oYWI=-Uugr3`ECNJaRBYNnt)mRbhz=`Ig<;QJdm`8LBl#Wb)yQh9n>#!?yicF# z)pbn+13HguYbU-O9N|aE#CFGS3*CrpfkB2eZTfyAMb7T8c6yYY%wXX=i3hsX{hdPd z=VizG9S@1mlV^ufw85^Y?3>{!^(#|fS-Swrq9+M4J}GlEYrKtVd%H6VqX`Ga zqn~I^SBJcVWF}|O7b#UPYH|JYCx0L#J;weo(}wRGBi*O}<2m~NTBY=H{o^0EK@SSB+vU?aNf3lIaWk=$6s;5!2j_ zyNsAwzwGVRnML6nnQ^!%RislYu41lebj&Q)3b&@R#v#OtjhS5xhZ+&h`qY5Ax++n8 zF!R$ybka9TYzqA{(_HFjEuvN%8)W83`XHO;rg{FA!9=KG7fE(D@10xjEnvP(zw3f; z^lWmgze%#A-C|1X5cE6kf|0rBXwg{s3X1`l{c@E;0^7bgg&CdILQ!Fq)~hKy@_eUk z-1rS<&4Yc>+c&93rYgf)bDApPlSAgcVnp@1tW1E%vV>EwY5-Tfz5T_s!A><(^!b`p zAKFG?82M$b%Z`Uw6^oa^sRenXgE<}7E#k9ZK70y9sI6qK?mLrRv}3MDh4 zz{7&(F)pMwb2h)_2qg)bNHNL8vEcXdtrT%s&34+9m@1!(p1oMqNod>=K0uA*ioaWt z<&CcxN@e6qF9Q`mt&g~(**dwRxX;!2JR{B}j(l8@p+5X#W3*#GTdfD;wEx47B!AmR zFjeO^BSX{uQ!342?LI)~_()|UkL`n*f~4`Lo#9HD1eyY zbhNG%;T`<>bEGDf2^7-)g;-`RPc3Uc_d4Z}=W~$pi@kwqS2AcJAbuKNZM`p8wU%vk z(=hY-c&Jn!zP#XfLW+fr?OM?7R(R{Pf}oHlpb<+c?8`evo(TKg+p9SDMqMD?2mCXM z&^=E`t38SBtA2EJbR7;nh(g^F+N|2W@ea%GOM)lUekrefdVD^`1q@#OYfbvcX!Jw! zhAL>`z)SDtQ`sDXDP1(}q3cFhGqAp7m7?bzZ8o7F#hHZP$HJK}A)PU;gh#OCM(xlwsmfiC8bxzx7?Z{`S z`H_$2smW!VWE&pG_m%6n&8F%+@84W!0MPtx`b?gdV`sKL?qtv$Hcs4+a265Gkk*iC z3(?T&TV0!O99e-1jwEj$iAOBS_sI6BD-4=)fpyikUxhES6o6+8rRFRE#Gw}fD_}{0rK8kzX~SJ zl5ZEiy}gh79(jywSxBLd5m~lVW#)p-kNy1Lw7Ykz)NUQm+^DcroQpR791r8<3$XZz zIxL|J1-Y(U$a1B&@;;{M)DN_k`s_-;$P4cjI+(a1j!s0+u_~GGo-e~LjdSL54d9R@ zgV1gh3!s{dU3kjePw-M}a;tuZ?jM%$e_WkEtleX}8_$^wvrlW+@kwz{OC2SgiUMfn z3d{TA=|=BDY;Doy&hyvHAu;c};62wd50)jJCzJunK|}(L#`cA@8;RC7-*?s%wWWSX zVkRrOBGG6-t@^l+aYK^>l}gqJ3VyQ}Y2q!_e9Wn-%>K3xvgydIo4=yj%`)XV$tx4P ztTa1?`RoZ`SEG^8Soh{wIwSkA);VSK{)>83ec<%?g3nF6xk z9NIleIUSeYYL%ORA$Ycvgi$n2E3;=SXBOCqA85Z-mXIPYoVw!NMaJkH8xjHks`GrK+ zg~i8FUKbWW0zct=;gi*YT3`mt3)Gj4H+nLFG@8R^Q>aG~_}hELpzylD8B~19z2VZ9 zm-Tj6?Q!sT2h9M`HI!#2!=REK=4#_-KV6}Phc`>kZ12wK|Fj8HW;L!INpJ6ds3jU* zM<;D~e}ztS*ozH2@#1H|!vY;4(BnNC&EZ7p09wwrB9kH6=r~=cV3Q{kzIYyoecXM^ zgNI4H191pyI=Y_DC@T1F^Yt;{xfPNt0?1V^4orcexzWM|tou9~<=JbVw$2l2TAhNi zpmr#8^)63})vQW$@}@IiUV}KxhhWam^2+@+3829*fR7)+&k39y@=1&TtTg{w4gKLO ze`ETeI?{2kefFq=6Y!o!H)kM8s>#XmDdY4Xu@YCqI-71=wGYK4g!l34OT0yw`RHUc zToZmBzFb8xX2FbQ))s`cCoj+aWGE#V#Lt>Q)Aq)Au4q}4kbs1Sl(>mn-2l5+w`7A| ztJ=M4cG^1eZQyrax42_*NSXtkf@9uD5>S^CNjSTAs~af4=vOTHwJ8 ze184as3$>9rGde~mov+KiIU7pfdpD+tOemaI3)By!BBRGnuaFW^+C1X#yin$sXJk4 z4L2r5pfI;vEXy3OfC*P`0=q;aht-nmfLs@D4q!`XK<3ug{)KD}U}Tl4=4+3c)Yk`f z$1+N_VIs`{nd(j=ytsKn@=zDks7}7ZvP*e_5!GZCdPvjV*_xPiGiWkmj0@J4N8j+@6$-C#@1DMw5`0}R*7mH~Nh1V1wmeZx(pK{`HO#!bWkq(%omvk( z!cHT&oJk_x|4y5ggSzvRDEvlXQ&Cb1aPp4<-t;pYz5uwpq`fxkpJYrEX-|@ch)C~{@n&30buO}W z+nH@emQju4s!WY{ znbq2Cps45)tfIWV11w4-?%$DK>DzC})wM64i*?6g#cId49$pZA2*a;2c^%OATUY$c zwf7zCpC1iDiOkAY7u-0+!0hrXo`nrK7w!sq>*WL|Wu83{+lU;Au<>F8VV%p;QS{(@ z%r5|3TA3xUNmqRrOREZ$Ng~zdJ8LYdm^u2nSuu}TI6O;d`Fgs#L)pD&{I+n9L47l4 z0G-ZgjaYw?N9}1w9f#7Sjv_*eXsCB4Nl@`N!ePLpn zz%+F$+JaG2dEt%m<||%?+UrK?!OTqzb%xJ|Qd?M9i51jNC%o39^ixf9&V!N5wnQ9+ zX6S;P4)e36iCaDZYFn?)(y(`QojT_{Ab2ok0i9yER?Nh#%+AhE6!r>pvkxU}Ap?Au z7Z(@PC)6p-f^g|!git_rXQhxUYS|G^TE1H=@=e1ZpjLWrdr2jQI+6P1Naz|2XIJ*d zbIu?dg!_|NtC0vQPr)YrfT!2GrLBlrZO$Fa1wPUtJ(w-OmEzaX zK%x#C?-!+uYAdsOjlIyqJARO9GuHBYztVMU;3>~H8fuQtH2PsL4{|O3Ld@L_F;fl* z<;eMt)GDYAL9Hb`fQ)9;j3`_*H}d;Oho+ir@7!^HHI$76478=Bu>7SA zz6peZ0P8#CZyEPk^0<6X-<`o({TQ~!t-fB{%~TW%>twP%mzwFxTecf`1z-V}f&!@R za^!CXW(DVU$KyHqJFdD_M{`CBg?3JAs#GQ?jmLGQ*?e@H*c+qO~hH*%Nz z7zVP-qcrpNP3>v39U$D^s!yio|7(T!547_p^4z8J7sZWNoo7^>92})lY5#81!n14; zcuYfWh0-Up-dbSuty()+t*k|rY%^KMUcND8u!k$T?WH{rRdVg>&PEvT*bkHQzgUQI zOt6pyGiW>%>nHK7{cg3`l|CI|X1&AKSeCgMJm)eUM6)pIm7>Z;{*L#2S@1-A7&ABmY5nqmbkoF@5&M7qE|(fm>M>soH^C}2f1|DYUZHM z&IP64h#eZ9KY8-Rsha_|u0}DI6D`jt<(D&oI@x`y7OX5t&gUZOR|Sd~eWoGzkqXd~ zzGeQA3XJDu?I_9%IM&wk(VHc_g8%UjKg2*BkaS+SWZ&5Qi_(k zx9$}XuEqBZHk6G41MVYP@oEbaXSh zlo@#}T0=Emd{r>m8#j%@C?%^yYW`AphPRb5Rc5?)Ti=A5=!-6g5m7%}`G1sBX5~@x z+RtiE0mh+or8G2IZ&+S#Ffdt#NJoYj5%AL~5Sy^eM}7!XNe;?wx~wG5Dza-F5ppLj zRVvlSP+Fte#geO2A)W*U(%c!J7@3M=(X-~Je(|Eme#UJ%FTV&3Xn{Mc7kq6HLd#+7 zMucV9WUxTf8tfRcst)MDx@1mad8kPI}@HbwEzw#x@h%c}(Tfaq^F z-{1+5{fy0&L?w_ft;fd3ygm=RL5XZ0hg6W7coxpvAbHl80&pOX0uSwPIm5Q3`*s*f z-Q3;1D_2~C|D_Y| zZ-|9{RsBI|eq;L;!-1Mo0FwU6OVu%2waItmr_>30k<_I_xZ{@~kkZJiFIH1i>claR znv#>BXZ_>YN%6Jqu4kDuKMcxiak+^;moc6bpx4|X#@T#r!ioDtq?XW2oU-;fzF?FQA3JN6fywjy`%G5JrX556 z!qO8NC)@C3*U?LG?8~lq4V%q|s|IGGBiskW6B<$=os>nMj{e!qQZ|znCr{@Y((rmy z`XJh;aynZpk2-N$!TzIMP2*>4P=|)LuNog|)&`)(cW6o7y1HXuAXzd7S1PPVRvJ&{ z%lTId%KO2uOxh=rx%WZ_gir-~3qYrB<#aisdW*Q57=b`|y;J^3=j`l^%qnG$eXduV z^IJjvqk?6}zP>&$o-#nF>Zfi{Zna1?I6wb<&Br~#c6xhm!q|1~eslSE=5O#grnpaj zeg@5uW;gF!-28JGf^#GU6?%;_(baX0zJ3r~cW+}mi<079E8p#3xebpvjh1`6;&?vE#AojTsYV6EkVA4=XfD)ZA8ey6&x?4klRp$Iv3O zcI0j5xSdzb&TU>ttAo=TD3}Nz9}DS?;z3;8OK3PY>>r>m=+e-#H@~(<=jHxpW^J8! zMM6xRFFd1f_x&@jS7l>%Hmyzdy*GI@4QeVf_W2X&)P({@XX$J2A}Xrt9&Vp`EsuS& z&V<1_@};AjQfEd^gYnzFiSU$BYR?X8c%4@q{QMZ`5APi#1Dr;5AOHJ3bBi0T33h)j z*_OhMnV0WPKQx887zA%fE{A*lxT7N`s4AoIC91(TI;?;2wHm_^7?0eJ(EN1P`Lsl} zvQ8g7xJSXA0(o!xMkQ`^JSi)8s=hl`gZbI>P5rh?Qa)9Liw)NPzI>0Py9;NqmUoTK zl$1p6%p45V0SERDfiM*|qP<1lb-1;AjLmrk?zT42)rH%U2YwR!#E3lph>OYU6Wsg_ z^NbyqOjV-y%H^f&LDwzR$x@FKVnAFWmWe2uMTX8)`n5}$u1l};!5VfbcH9hC9m!WI zs@QKxT*!lDSHI#4pEIYfo}R-^4n__wW#y$YP0TZmZ+L0I#61py{T!u?qby%+_hDXB zbWCe2TLm>-HP=xH!8Io5SP~>Yp2u)kPp|RvgzTzLQ5o#+j01!S*XHEE7&-iz@8YjW zaQEz6W~;Z?*;}dLQ1JETN}5E^^tn89&Ll$;TyovsR6f}>>#bA+gK`--qjK%8R9Ns} zTTCUwe7~|L^PX5$)rlkw^08pzLzJGL;PB)uv+J}gYFJhCzz-6J==mD38sDC64yz?n zi?iJ+ct>P06NMM&P$*(Kvl}s?(GSwoS@LY|QOUBNaI?(=XPOu)GusjM_bnJnnYk|2 zKs6U8EUMKyn}X)^zyuwu{bV*zCQm}FvuaB9?4faVxuu?E9^Ht8_VH^A!p;4J!Ayzt zTZAH-P9mCjwln90XqfT$TpQp#skkB(J{Wlw4|^W(lIt36rl&8ZH9c=>@>O(54gJM& zUWoCc2uq+-@fBhLBBz`EtyCREN24tetc%8p0-?3mvzF_cTX1E$bb zGA<2ttGND82EtEd;NG_5cR z4GwlBic3!3<_WVyf3*JTy*9YMzUOMoQdk~FK0P=||EZD@v7_y!ooH%iD(NcsrQS$r zmpF$p%$hPoBI3YPXr4q-MPyPj7;F~?s-320PV}%dGset0-m~g0%ce4 zFFY?r3%fI}eb4wG`Acf}y<0M&g4f|obmrkpSlw!r)M#tXYyOe8X)G}kr5OPGno4C+MkC>usI|GIvW#cF0R?I<(Mjbs{zFtWnHYu4{9#l`arm8%w{%+dTqKqyO;rt+ql|S#oN89e7_@5j z#yg?I_HIJsPP(=(A@D5Zl%8c-$)@v^?s4)6-u8Ha=VGNuS}Ryz;j{lO+-JhR4LP4+ zkknL`IDM~Nn9(-5;jJfEkdo5U!{oPpwB*St{GTCiGfwC?Dks|JfjX>i zt&Z8uM=5amTJwa;u$-s%CJV_;SD00P(H8YheJifrG{i>ql{uvl6cLjW4L|v|BBE~8 z+r53+)Os3zK3|_vG6-+UW2>d{A^MM#@+a}CJB)@N9j!iswx_GdM4q;K3EM2>Bu_4B zA1FkULphWovVG6kM5THbVvBajdU|{XlhVTjx5DH{Rdmun(NK~2esaLG3tkIy_=2k|CQanbdl~1N0$(9>= z1BS!l2LSrq10eNTRaNSB*N4~3si|ZDg8!(eJh3_tEfFx<9)T&uC9qorwHCg-!;Pk- zq~tUPkK_IFEcc_S9tN$SN8bs2Jy(L46#pLS(5wC@-OPuHye4(jw6vOBZ&s)DYL04n zJG>r1k59xufG)54q04{6u-b!tOS>YG`JvHVoB0(fCp#cjdl z6cmU*k9^wZ{Q_AMV)4rw=y~Vu93U>^$WJz5yyN#s<0CEcj10U@P+>ZyDShMp92apD z)+5MKU+BC;@nk%2C=%o$HnjF!`x9o2G9-*>);hEdmM?pQ%NAhCNH>&W&Ay+?0{yfjr>>auX-g(d_|O z)!(L)2)4Jp*(KV4Jy(B0$X-4}zqn57rkHhgQ!ZpmI0z;Ywho9H--du(waO~fMXEHy z;%>WAWwwzJM{50OkFQiTE$n@!#ZWG;+7noy-6hoxiK)q;VYe#c`m}f}p~JBDvl2$y zY5arW(EiBI&(B_o(MijiI*4^qs}yNek43-II|hwyj!jU~Kj-ScCrN4oxEp#)ZHr+Dxb z_xUJb&@j@5Eze2M)wNRKd_BXdgVgq#{h>dnFMq)EOoHMKF~7yx>wJxiZ!!*A$LOsdCxa1J5wbho(3HTc@) zm|KdMkKr&{HoF5^s?rr;VSJr!`dy0)byUy__B*?vwA!_H=M$oHj8P#cO~tqiR5nC8 zxJV>&c;5cnLQCz+*_N4^d3bcxbfSm8^4Qd-pxtN^vcQp5MGpcUY-eAbhD+6 z?t&k*STi`NnJKG5kE*Owm(Qkf$o(fZqkDy~Jb)>HgL~Q5mAki5!(0w$?QkRZ3Yt|E zemu!5pBmXz9?^Tvb9NqIAnFUkF(zC|@CAcf9NGv{6~jjLl46IHyR3f)WSIDiK8;ru z?YjJQ_58+-x%i2^duQ(WITU(*u_jN;I9lg>=~aIP z^x@Wf7-w9|a3N@SD(`t_Wo5Aepi=Ep$cvQ(i_|C(>R3ugC#k~Ps3bfbXXC(_ceSR5 zM`^L^^wdM}z305=npWJ(JmB5Rq~E~9blJL*olbe@3VJJ-L83{We;QP_uX47?xo~2I zW%oo#_e5&=X+-m}w%m~-6xynPdf(bgcl)i=HZ`6v~!2cZW5qVX8) z((vJ)*G{gFez)~PbQhH`^;B0;n|pW%&bVFWh1;7q8FNQEIw^7G_Pf@j9~^$1*A&?^ zR}48*ALa0|H@3 zYAldMIl}G9$~iV+D0D80Sz+PW=+7u^RK^+iqoGo^=t;oXIM@v_&$Zfea{nAA z9}>GO-#gr~o#!=Ur#Za-HnkNTUAETU8x^=8wk?1ZyuLU*NZIv~sIs5iGWJ#Y7 zF`%DfQ-Y(-VTX7xC&PO`H~(jdIo2f!OWHX!ClY% zT0QMv(&3@GG1NQFAU5_ErdPOdJo0F2scco|!PrdZ;<=N^%ptiP3QG<5XcECqw~RTX zp{K>na~qS^Tgh>X;a`9rxOsJ9YYeGgpK*wE#n!`daWk>3kt}>rPRxqS9>x0SFVazF z?9hE1%d$F8s87X-ycW-fz2IHXH7Sg;9gzT^EVU$oQR{Ivw&e^l<|z=kPkGkC7Ui$X z5$jdBDyMnSy*!WS8d1@7pC^d+HZEivWy?Dp`~Kdy+*L*nD=e8jc#4`KnClc>^@&s^ zb+xs1usu>SmTIirOv?~iP!$>yQoyYV16>vs7f-|;s2fQ=0cT>f_@AF+YF&;KwMnt+ zyJTl()?EAc?ui8S`!Ij!@mxY@xNxg((T`%iZtQ}6TY*7A_8w$op7XpGGP=42J(u%4 z@jy1(^YsTx#XQC|n5(ylb#kIQ=>aj&MEOSX zgx+d9aOmTGH*9i+VC%}sh(Zj z;9;sg?@;_qxv#-+Wmfp zog3!YBZ{+4_i%5K?9Au7M|r+P4MKkSf#9>;ctBJYP%Rwhbc0##>)wWJ zH5kaplw=nE{MK9*NXy!Iq+E;I0SsP_eqN`Lp4Q{+JfWnbqG9YljB~AwDOl#|_!bVA zXZkADQw7&jqgRckQPTtykfCihx*&a5S5^W$QL2R6fohK*e-)4bIttm|)W%;~290;3TBivv+uRr_w1(GF zcX*xf)3bC?LyBfHyPuG@yPh7#Vc#XhI%9f02%$v9e%}V%gp2=W34#fIzh){HxohRu zm+zY*s;3jZoyV^KVKC`_?t8P!D)d}0S?QjbiW+JMoI`6_t+{$5;`rXKE-nt9cWJUZ zbAX~35AQo*hmo23-g zwge_Ilb?H}k{GLXJjHGTluPjK}+s+ z6cLnhyv+=*p7+#%FbfX6Yqnc^QQZ7IuQfwSrN>c$-z#s31&T5@k#kx+TeI=+s(%mx zT8Z!j_ps=*;J4T7+v}2gobDObp7`Iv9{9?qMl%q0eOg4VPeGrm?7ITZjIhyXY>S7sBwK&5X)4Emvv7e)w2A+zb9boS5NwXaD^U$Z+2RN z-TaP5O?WCxbIJg8O*uNx`l8jr`Th_5TsSFdzBEK5h983#-=r+dZBn0E=9gG!U$1cVT{ z2WOn$9cS)`yZ#^kUoIcAl9jbMIq&sdTg!NFxSVTEpOm4~P9?QS7uLZ0aEHkA|@ILvK& z4^-E9Og*>1W4L8o-bB{zX?^8AY^0XA?h~H(Vxmq+8%b!V(dM|`-90tYp>2m!J@33} zFI)`q;eLT80nH3|7krI(D|UW~o-;>2+R6JRT<(L*UI0yK!-y0oPrYvZ^&3WvE%0{L zqxRx5@Wfk}u-~cK+WSORdA@IIB(wEZHL?s0lwNwY)rjTQ zYg%GRa@F_$Ou)nGeHnYq!`^c)=f#YVKg*3uJginwNnOjJ`p)08?$y`jAn54<(X>hu zNX1y{lytCLk^lhNNTs!M1J@{{!2c8l2EJt_zqUHGaZqkiTejDyqKHrjcU~{z22YOV zM?;q%FYj9I9X1`iI-CmW0FZuSXNpXyEVuo}xK<+AlN-d=I9>Rd^w*c~_j4f5}4>QvfE#b@{li{UjS=7ktdbsiJPa4d;eQ2WQ=4elEGY?{- zK!DHIHKJp}E$Xq}UyL9P2b1l9J>1+n=FWC1yUKG>T;7L{{&~TKcXEN^LSM}0rUU!R z_d22aC9IC{zJUnJ7G|;I4at=?pqwo%DqpCK;C(omcgV`d(h=O%>sfzRPi34yP{4Z= zO0zp6IGd1U;w$5Syk}r}&`40(^8TomcUAUATNGliS9oesc!YmSaAxZSJ<3|rsIde1!_dCmS!5uhxb@_5E4=3OS1eZ zKU30UYu4N|!e~ZZf6n2h$cR6UT+OtHtwNNWhiK}1SvIAo?_@E1_&(+Ur6(k*n@;>2 z9)jrI^%Ot%J*D&H*4lj7MlXEIdQS528j{}HtXCqL0Lg2@Q&Lj$q?#T*4>xijf%4mq za@nFqqA8p4H1m}QI3dWSq^^9G)OUyStzUaV`e@^3-vL%t&)lF8@;ay^0=fQxq zT;_-AJD%`{mOiP@<0YP=(g(H@hu3WERkwv|0#DYd6!T?P_SzQJ;yU<640caeE(KLew*R1N!fP9 zGo0gZI2Wa}^xV2E)j{Pj9O{bAOLdDE;3wG{)e4oe#1R9Ss_L`o3gZ6sDG|=R8AJ1- z8_7vP0MRh!`dN|2jXg?)o?=9Q@CU-I;?!MGVx|Ui7RFk8+Pm2$!w&n<{ zCk!GgQahlp%RkWL5*t0=YCkpBZ(-$$nbDXI{05ZB6zxkNQsWa{y=sX&-go&D#;#w0 z0h(TMHJJWfB1mtB#GFs0&(8ZBYUB1**FbpeX-+|DuD!y?Bqe%PY<>=0-CMcMS#P&V zp}HEuZ0%8WoCeJkFrl`w-d@sqB7;sacz1X{rjy1hW9=ZpbMEX}VJO;uVvyBkB)rRz zbgls&+69NTYjZ!=1K1A>bXp@&NSK6EpOMQRuOTl%DY4`CmA+}?R_A4$Cr)*#8`M@Y zWg|L1=9xmy0K|Wi(VvwVKZA$2Z-kd3NF#OTls}F7R9ceiT)`tV= z48cMe0v0{iL+v0=^(W{-{Th#h%X>ab@MF5T??Qg6LwqQs&+q*Urtk+Z1^*uOKZ9Ic zt_d|HCFzak;a056S<3w8UJs*)kBsOv%`c(^&3Mw{D{Q&?jyFPaBSG3(eII-d3dAZdB(+*MC^A`1Y`k&$y z7zbM8SJ|Lmz!@1KQvZj4dIx4+xP&0W$XzWck~A~W3Dr4he!*g|Ha_dEND48PiC9e^ zZYuJnC*o#TxLTGk#9LvE!d)=JU1+Odg_(`XYDUk#qRrsl8CZ#y!D}!wFkm;R^_zF= zNlT;e?Adr#Fw}c%^s|a}WqnoW{MI<;Qo#*Rg5M^D45U8VZ9u`}*#*JjW5ILF5h4`zSZ3F2x=ck?-a zV}4(ycxA?nyM%G<|OzP@q4HE2JIdaFKJ87uwq6uGyw9E031ABe4Yij%Ts0xio*tf) z`@#-s509+)1-w8D}a_Dsqt`MXP6IcRJdv zb97X@eytP(=w4a$&v4%G;Jts2%q=1f00%HDvJDvHQI3cECA;zaEREEIcseHT!HgP> zUw1jN3r_Pf0e8GYr*vHLY6Jyz6z2n~q6 zye@i|4F_s|{w7P^e1HW4BoVdpI=qMC{Y32D-rtAYY=mjfzZYmae4do&&M>*k8k$%A z_O!KbqG$m0YRbAi#k_oS6+IVcTV}F&uv?Js7oX<$1y6W>Skq!vy;P@N_pDR?-bpPw zeB31C3}d)Gljl$@jKLIc9L8?8Rs7&bF<0YXuOZ7X;y`c+)q8Fk!(EX5EM2alqrM;P zesMI%JfGlUh-Q-<6NUWu`I8J~cp)Y_iAs8!C6ti@V83oBuu3vZSjEwkaMd+UT@9nm zlAMp`A4D->-<)L#SVyKu#Dzjw8MbO-lCB)JY9)3?MiLizj|vKWd`bmj50Td0jo@ub zm=sxNoq}e*SdCY8EYOuk)ONZ0R^2>YNb?Rc19wp%>2Y<1e9Z#y;+w7cC@+pB0%pMB z^yEnU_PcoP@N(ZQR6Zy`S9U^}jM+^B4#G|r zLYU~%`zkb{WqzO1G2gK3wz`8Zy+B&ZPX?6GF95_Ptubp(*PCeX#zw~Y$f)?B1YMd` zT6WgyXIvBHf-R?7;=i(YPgqJMd(GC11uWoC(oyjNjlx0chBYk@d&}Q44pbH zHGJNjK954)h@{ap^}d%QPkdMej60Py{v*!wxd^e2S3*2LEm^qy%O)9K!QT`tJlO;p(h|AU?UcFO~U(D=9u5C>7BdAej6{eyr)Ysh*?prlnjaIDD z4(ozy9*Ss9uA4vYoFoG!0MRnW00iW?8u19r^ZXI_c6K}mp5n3GD_vkCtDw*obi^*S zKQzE;N~ogGq2i+-F8YW=8`vfG7{3U%xjVs$1zz+8m&uWCPXWBH#I-;w=6KJ36on0W z0_hLB8{IR7brFlUH@}#pgg~&VRFblB+2mcpPyw=3Ne_C3T34Ef$CgC58iyv&-u}ka zFi$K|% z05#+0Y3C{41!TrF%kg0d#se&8nP`z)0C`nw2#-8)*X;3r_kD*ypLuS1&o>3~ADYx< z4O2(w2!KVin0$}$x}!)X>i2st$?xS9lu-9R^3dA|B&D~8=9SK17mK2L&8EgC2e?x` zYOPH!O_ybw`gTjU_^TF&rxk%RQ8Ts)2kt<76&Q53JLj@>iA7X^n@;GgN@oe<< zXbYphr#0`>zLa|=ug?_EJWbzT@Z+v(qWlBpkT!U8JtcS0!n#GR`%e+*pLtxS<9X7Y zrsLF9d$L(P*l)b$7AhX*;lQq#&EO?{;5Yg06i4Lc*G%q9+N(JX>Xz_ZR!;H3tYCKOH**Jg*Q{b%@a90J6E31Q+a5Moa!oOtsi@> zcPI6cy^Cn{t1Di2$Z2Sb2#DKP$Q;`aEhCAnc*GAy;ljh))D*L69^bTZWJd4ct@pswwKRGg^;btkhGr z7zX`Ehemv*AGVvKV+7$6~`g>~iOYMTXo<@~lI3~XDOwK;b ztI@gq&9<_~((8vV&;2X-S5!!Y1jFwAGBE5L_*2KEEL_Cz6Pbot@nY4fjQ@DJp_V<;X_~G+F}w4-#-0Q-2kr`jTI7 zx0*v*pbzhOZhj(QtXRB(PMmGNL!)K0tq5MhxA{Er+04?CZ+|0AdK$(+CD!uXW&!a;=m!VD`|o`}*SVHt78V{g}Gpxn7q823waO&}+&Wmjwv5y5^0dmYcJPJ(pD#A`Zbx$Qh#5L1`w`GL?1AXnu=Y0)*H8fiwrjXj zZ~6)6%QV+?raloNwTA(xgvaq?02DiT>9=p0qr}|0FVoX0W9jT19FSx+Os8X`6QTCp zRB8|iVn|i|LuF?b8D6?H0v5IrT`FIa{TjO(2a7CTtRsZ@_{+>r`80galp7iq*)L}L zofIjt)jXXv6gBu+9eC(W0&woaZeL^DD~N&00|dzx2b77|q6!z$Ch&de+M~aM^gu}> zu_nLlZt9oJho{A|`cu9V?_s_;HtvP-;b{(Rmw`QIf6S(cPZciD;J!Z_$}zIDQxUh@ z9>Ml8KIcKCDpe&MfJSjZ6X{R@TpNhso-b02zF7#YhXDXj0wX(Au?(W4Cwt=cc8epUn^YM%leIMl(W{oHHdgv* zdy~fIV{SfA_s)HZy3yLyF<^r(;9VqV7NEIc!Sf3YOnyHw)+ByPU7CQ{QN$Z@aB0QF z*Kl@hXZ-QFwi(YuPj|8xtiE$`$;s5}S)KT)rXd@?c|i##emnJcbImd$qHruh$cA^L zcavq8;O?qz8HNPHV_f}sIL!ur12_^Ra|AgD4xa;P+^6=NDmH%em_m}gi>D+^zeY`c z5hyjz)55G6fXQ7(?wvs2H93;FMlkH?M|{S7AD=*rqJ0D1lbDevtWU=21IY}EofT^o z&mdAl2^ZEA*OuotC_o3C-=55uplz{c1BD%TGK!-kHjLnMB~y|l>gj~%hT z{#aY@)tz>Wk(kIcxI@#k)(C*)wt5q3=(a?2Tu5tg`8IW?r0}H++Y9~vz zOt64C3D-#l-NCRI=MZ(K8eUh@;c0w>ib4F&IUC~nZ)686V)TD$t9>_Me#oP-sheCT zF*~h&r?{paGi6I$ta`jR$-z?Z1q(?lfFkH4Z-EseDkl4&TqT8ty6>L~+d*13Tx+x~ z{b$(ezLlOw`04Ota9GsCm8mXdI=e*uXP=1zTz8wMd#7Wq1Hv^4-siJwmEkYVWdLXJ#rv&?{3t|mj#d4tm4W{$M0{23@UTUjF(B-575 z8+%fHgAnXfR3?omfI*BLXDj7^F3tyHN(Af?HB3tZJ0Ftx{ilUGyXd%4*R@UbZET7X z5(*WvP|DJOP7Nl}awjJUu-j>gsVu8MHZVgU4){vk}qJpZv&N-x0ER(-z=x=$r{1FV#%h)yv;aDLg6!pw5Gu5n<7Boj2GO zKcg}G&vIC~Y=n6pK9q}oDcoAQ@{OM1MhX0iM@w4cHrE;m`f7K&D#osuA(WKi$n#^^ ziiRZ&-K#$(vzOs`1mgHcez3$3@OZIMCK((A#dB2P_ZnXclvot7wt8 zpU*O|`5bl0XABsQ1~B!zM&8la*VhB%?J~uE0=Ah-aFQnW#ZIv>4n=_Ke49f{OI@$% z(EC^o5Lm3$8u1fPUa{fA!l{5g)_U6!KzTYl4+eY&%dXEGUjsEX9R}bpV*tT057C;a z$8=jlElyJ)fZVd-umVs(lV&iUQ~Scv>Y@_3Z<=~7{!KG=nrh*H(3Vo7jg`yS1&R_Ds5} z+m~7MVs0_~g1cby|tR@iZMR{Pk>5OJJG_((!lQDC#8F`B^`tvS3#jlbKtvCK7Ttrf&_` zpC{swEUT#W4u7M5W?NuJd}Gk8bVNG7XVA5-OGLhDR`aNlagsj6wVpDqv7^DUym4Hw zuB)JE$wq>y{<|;L$MX`J0J^$E57L`7q$aNC->`aFTnJD_{k-c35GxiEjDHD%Q1{cSnuY~QVH6v}XE zX^D8jQV1O-2{0dCu-adM`_WKbTOQ)2fs4TvNn)aUuM{2Kr@?Q$_Ip%RB4=5n2I%#WJ;;7hP7#9B06H~5wj5U7tYVr<-Yi2XTI=6n?!YDMpESqT0=l8iO%zFq{)Fq5nTFpk12We z6?I+SBp79k19`iYq8gCIvEMqx4&5lIXCjyPMa;Ja56n1m%7B4@bEI-MxfbX@>Aj^A-sY)W&F_U9gdO?s35u>gA$xxTp)AC456(1%Nc zM0Hu_w351_Q#jV<*FK8xI`4=aEpI-oEd6d$Sp|D8P`iPMF7?5L$EUNE1*M^m7fo&U z_eos(aAaSHpl0oa^Nme}3r==`w^W_4tgNID1#4*~4Aot`BQF${ljDd7AVZaID;hSAj$=tH zJX~DE8FaL?#~#ufclXna`Yp`Oa}H{%rB~P1UU8@%ySPv^r-9%N-LFJ-068kSa6-k; z8+)b@h{`8nY^Nr<>rfcCTC1I7qzdPr45#EK*&iI7xHmuOXJViI`m{-^O5ku_4aCZ^ zP&lc?{XIEl^=OW~)>Jbl<#tO8R`uvZpFc<6$-ZzsR^oG4D3h<@IZHtpU|!X>?z7f1 z!M88guck149m8$R9NI_(@cjt!9nt{0jJ5Y*(9yAZ-z_afLtz|3dImb2H8nMp zyEEK_MYy1x($ZcBN)F;&4k#Pj0cd$?K|^j(^{(3^EpnHm*Ho6S6Rx{@I|z*lKgoTr%{zaWfSGg zz+pdGZDTwGladNNZ(zxSrV4LV4~dZ=zJ9eXYx5Snc4?ZZFdP9eK}VTjnM99K<>t=L z75g=-I&cOChSfYxh??3MAjMmj!!cgi%!9JpH{Lq;qSTsj@~oN~D6HBfyExRG?jZ_I zA$WdLdIYddhKe+0iQy zO;_Ume3S&}V3~cf`OI4}1BK%8UR+E%@Sc1*xg&A5qQY;8ZFU;zL4RE?dR`P~R;377*5-}=R$#^PU5zD$_jb*#oLC>Xk(b0#FSq|8AL7IOJCOG?3# zmKcCmqtXRPo|%kWLkl#KlD}UqypV_ftmEil35-z8{tq#Qc^DryMaTMpXJXlgRkpp$ z`A#&lv^8$9e}H+3v1+(>1Y&gsetgVut-)iM^irw!w z)WT3Fx|#-e0MQAT%=JvMLp0TEh?Bum-Em^lw+q>pQ$wyc6BmUy-)k=BuLZDlA$j5k za^yeW=eE|bTQdMseduUwRV9B(S(GtXKXUMN>VaCPC1=^F=iK+I3|oqRb3jrHxiST4 zP{-QV>=m)Ls7dTwbbkDJoubwd`&q#Sr{*x)UTA8q6uxy)Kj*0b2Q>HT)de%~RvPu+ zh0>YtdjY3}H2pCAst>mo;&!PdlI}gC=z>~8 zay)>_!UEaZo^QQWu~*R~nL`~oJ11xHgmrlZfP?4y9GZ;8X=)W1y(D#`r(#1?0efUB ziGKw`dWDnyuaNAIFycz(g}_ecmWzh}rr7vK_f0Mox!#Wwq8tU9)eWnFa_JCoF94EpbPTOmz51xOp6<&&2&j}+7pWS2!5sRXSB=yekpWH5O^yfy+U@Mzj>7J$Mh>C5-q8w6t0FWkR9PSN3k+e&`;I57LWiKdtOznScJ8kvpR?~1WsuvTTs z)aOb4ca=9&XA;5*oMf zG-A1&WY*Bvq)z0zVvC@ArQ%T9$+Z$+l>VBmxNI#rrB>O~ z;R!M~nV*I4kxVuTUc$zb3@DUU6w@;Z+l-}jEf}sv!}^}C?c1B=zRwR&nSX2z5MHtw zFU<@NYRHLO|F8pZuK_F@de74E|85PgFp~>i#6tvDEh+t*u>f6pFQ3ogcSAz5JsjadxH+@BY%s-1%IQ>hc^PMT4Aqo)-IJRD40?Sy(qPtz@pZGwjc2 ziXc#d(OVW6N@o5_Nm@Ec>}0!@-|QW}Ez@5>=TCn~y^e>^_8V5TW1I)q;4p|Q_9 z{|LyQOEdHFsRPg|z~ohNsQY}G140_^83q2u`hDk+G#%98Yx}oGVSFRzM;vl&%V`A? zT!DxZBl^#vA(1B{`WRD7RCZw-o034qxpfaZu>z~aS*{zapCWJh12wnaA z5&8Q;{_%wU@fw`nPmwI@6%*E5)b`v z1yarkf&3za^?xg@5=c(L{C^kxdyVy{HTl0K{l&We{P_QJXifrZO7XJ^d+BSlKhzN>`fP|z-cb9Z20@5ik^w8ZRBHi8HLo+le(hM*l3^1fL!+^BZ z@QvrZ=e&=Pp0&>R|I1p;Vt#S&z3;vE9oKzrLRDYN5!@!bje&tdpdc@;hJkTw3IhYP z>=q9C%B7Ly4-AYukF2DmR28J8s8yZp0amu=7#Q-QiOIMc@dJjdtg}H^k#p*|{;EP1gi}R@S%|z#<8H#?_VnFgvE7=IREK1eQw1RLs4t5_MeOPM=rh|!JT*30btgSgb|y~)V>9luLgeN1VJVUqjrSeS zF#B7dwmOeb>-W#cFq)e~0xKkfZR0KtvcCEcrHW+5Ltau?%xD(`?+lIJ1JrI@XHV>R zDrpvZR1k`4ms;g@$q%F~x4khR#*5|n8kKRME+kk=^Mg<5XyUoj55qJ84!~FcfcO=x zjXNASByJ=l$uUVs=m#HIeDR2^CD5ab3`SW#7UzHFl@KrEOe1%g@7eaGvxM{I3U+YR zx;}mX9rBff2Oa)IW=-Q`D`!?vN3KjuB}#F=J6se_axY~y`b)0!FL|=7IjLd=)beI9 z4&V=B{R@V1)rSU2$w>eMCQ7^|k|)C|;dc{y-tM<${21f3)6c5PR>taG!+R^sYwF{X4EAwZ(QHminK(DSuvjX|?R;K2F~?~IYVQ88P63wX}7dFHbYPu^ov zE#YfR+_B+G!5Y8O>6_z+;TPZV1B;I+P@@a$QGQa*M**vF46%F(u^;&N30EWfJeBl3 zsR?I0BlOH);m6R}LE>f20*Yhm90=wp+GH55wUy@}$an!8oj*w^mJUqWTwm)e9=-Gy9|Z*w3N;PbY;GR*bR?*TVo)`*98 z?DYv)7pFs!a&PFO5vQc5=bYiA?#^F=v!9B4y)Cac)n<0P+ZvJidHV*wa5%5A-Lw^6 zbk%#t@kEX(y#ftAoZ)V&!!;b}>{QYZ?p+wtT*@BPrNkJxFgQ8)=uYSW-&;?#Z`@(P$OzBjJWh|SB9oY`#Nj*gA(OUi5s^aEK0EKe(afG_L*Tl31I$y(~tV``yk6048SLyS6Di# z$NJSoELg!gk1KHXy40>PSO2D#ByJPlZg&F|*Dyfx``tUVw_d!k zyoL2z&V@+o%aa<(3?lb0gm^MEu{Y`P6l89Ge5~`4MJ_Bhvfs^&P%ZK@EJJ$aX>#n# zRkrbMZm0$iIYdq?#|Elak16_bDtBY7d{d>K z+&A#92}XQhN(vhwP|!q7TOjFUp)rjur{?=aU;Q@8vP2yK480N*d60$3Kyj~sk) zzHtiRj`otQ*nCHNJTwdeFTwUHeTc3VbMEort=}YhLG&~$MlnU{8C?R=3GquJwl0cE zIS)Cy`>E2Vd9-uscwbz;VSXd~_VSy_TjHAdX{9GLvGUt=&T-^S8DALI;%+Oz<#81( z6buT)#&K&!bV6*UP8b>Euvami@Xj#K?lgyAMu@N!KeKqYK|{jUmzd5DehJLh&!6LM z7Hc*MyWf-YO*XWsKt1WTB2z;GegbX+|G~k5*TKla#Om3B(wfp*biYyDUhK8}o1(PW zz9rlxZ?|===^H}5lFvWL=95B2tU~McXLWUXks`=@NUTgrZ~-o~`H23A%Zs8t9Hl1t z@{{T(C6lBV9WO#Za|YYo#tL%^lMNFKv+d~#GY?~YXwQ6?i8G-h@pEEr!qhVg)s~7Q z{nP^6f}P^wH-@=wT4!xe>{zCo+&+(=^g8v5^%ZHYIK-{koHES>@JLb-~@p~gz-!%_;( z*3uJ&%);H`tlSRCcEhV&9FR#7r-~^^wz(HOGBETxu>qqK!y^?Dq5Uj|GOHre(q;+g zDnR;rOj4s}K$5CW`jlto4ZEVoVz-tP0Frz5O6U%SJ4MF`AhS-$zg9!XutHgrsXUms zq`Z{8gn4Q{9}W_(u&5x(*UE9%-pdt}SyT|0@vrl%L*)cUebNXD#^J>|y|Z>F^UlN_ zFj*s62R|2I7`LvKhW*i;HbkIbV6mz9M<5>LOE(?7;PdJSCg|4zo^F?7s}NFafPE4` z6W|7U!t2hlk-o>Xmm!_9Dx$zq`gYt7zbrUeCQBw#CYpYN>uYUS?ZUyDSr$iI7FW_yBxQ(z(*f8+r8n;q;9Jja56tNDsF)H}@UV6LqB4 zEI-`e(ZPjC@T<^~Fqr^@;I2a(vf$f;<@(;OIPOm~aL>>~rj2N}yKK#Dat0{31_y|P z=+e1Q*#3is1YdQp`J=gMp!ZzMyw0w|ZtHxjsEg<{&s48MZ;B(Y zExR?=1F_|+g}xq(*jMrF>*Py%tMJ|89g-FB{9bHlmVcRltR0{iM#X;!6a0%y6rm5O-N}IsG%0 z>|;4Ixl6uC0oJ#=Gxf!>Q?dB8dijrE*X7@pZVx|+G9>X8@1>J{GV!FGNSL-!=)^a} zey+D^_s76~__rzsOS; z0u_<34&|8@$d@j@gAa`gaf|j8{j=|7y-wwfBTe=c2+v4Na8=7;=_jfmhGucwzbqcp z*M7D$;x@1lC;II6J>;mQ6JVWZwX7@uW%{)AWqcFksAv_-UiaK|bKg1>gm~B{-JZ|? z_|oDGb=Jw!MdI*?hyANTldZ`pO_hxIBiitI5`K25QSDoW#qof`H$%^cxRS06jo(z) zEFlk?)*_kfHCYUx7wTQFc!Q5#yk15of|%VaKWpu4HB>bkwA&rSXn@efx8>jBzKz-l z*nlo=ubj6=X>HV}8mpYOwK}qz469L7IMD=e$P@Y2?RVyRT-E0RQ|oyUd+_jrQ}Y*) z8BB9fbAM`gd~E!K9S(fT{-RCP?gGNKSKBSj<6g0_@5ktFq19~RiDauZ=xG&0uJ3i! zF&e)z2!1UyVEApJt^L($&#ui?&sOsG71>4jsekDM4L2l(U8=T@aO>AZ?yiXv?D}i{!_X1XhDi{QJ{xUA6{>0o=^eMZ{FBf z*VkR@h1ABtQamIQ6v^mUcUgImuv=O?QC1Ag%+1ho1gzSkW^x%!Cc2uxI=4gW()Y5X z#r^Zmb(JoHWAKyN&W%JCw4Ik|T`NP*eR7L(zcHK6`=2zeoCj#61SB5Y5!Wji$iJew@D0=H2C~xQ-JEw0H zpI==FqcTtyi}=go%YmOe6Hv4JG6CF9Okq*%r1l? zh9%zj9gIE42Q51&de)CSBhTo+zhY_4R|v<#NX)|c!h%ixAnWy@3GaL5;Ow{+_j*PN zJG(xF<$yv>L+o1KXT3Yi-TnRKtQhi<7(VwRBkt@yAw8=l3~R@iP;cB>U}Tc^=v}O2 z%WZ^*E%hC+*M!*!=G-?#p%Vo>2YDT542(zgKYwp1sL_4Lz_^iRrJ?Pjt)eVsYH!D8 zVrKu=oXx||0sS-vhKPp{`cFG^7ZYj^J6oW$kcTMEKb{am|NZkaI}P8PPx0^^dD)eTm%`VgI-8#cn%r ze`UhJkibxomelaLu``dI@$k(>*M5k0%x)5pNK)~Im88&3Wz{dcUX!q0ALNq#+wdHD zrg2P~$M4^}C@3j{uMeLHbPvyayYICRVGg10X0N@>NEJNHY;t$cy2!X=1FO8ydUlIC z00Z-v4+)|BDWcvd3iI%wkazx3R*Q`g1v^4=IgA@Oi6nmgxWyjBd1+Qe^LG({llbqi zF&)^qDijv`vfKY8?Qg>W@%1CMgt5xa#|*UpWfKMVH!y9+PxmeM?)^#JAFk2dBGM+l z@nPT>9sIk;zc;(37tob<!>?OQ3Yyb!8(dZE9h3 zUnXxodhzRm`{VHc@yL<}@yF-Y>x=%^iToGsra{)bO>45vC);9yY}tcJOsp!SHa=xY za-`%R1Pb6`?)zcw(D5Xy{I-<4tk`14@3fNU@6WW_XJ4LNxRe@{7aeWQGZSeLLk_ z%IIcUHR{d#Ml!hoJ0604W-ZX&Jeow(I#kRtf?qxzU)L*8xFxfO*e^j}&{;9){Mf8_ zSSN4G6O|$?$7MeJOeLKscGo~iY58;Tj`iu@BD-nd^)uQIDkgvXSxZDca8l9BZ4Urj zUUaht!R_SW+}^t)sX|DSRBrn$+nJU(wRC2&l=Cf$A#Nm!FJ8PWw>EO$ouxPJB`r_m zEp#c3b6f0-%BI$XIH{2FC)Jt{4HiMt3+xd1bV^Aqf#z4VKvDCdgjih**!R)5kN?}n zjuZIPbSd$vt#<`tImu*qFi4nn`0Ve8yvDU<(W`kO=uIUbwKKDp2g)@6{6(SG`j|}5{>M_F zT8V@tTnti{e?!6!-WVIpaLb|&PZ7E=Y2?Qs6aL_&F*^-070II8CVg(`A3xs_#gAUf ziiyvjVs)ToISM_1 zS)6UviWhftno#}SO3UwIGF^GgXc$OZxh0l+oz_kz8+bM-XI!dl?51*4Zt-nLROrN4 zWYbziNgr~jn)9kh;T&43LfYLInI;$_lP~s~m1GI1Xhy}(QViD1I$%Qt;00i7nb&%# zocXtDs@1^jIaXp>e|Exo|0)9D*6FTypt5jjGtlm9+u0$~jS98r%Vqb?!}A)+zZ#3X zmu$rFs(Qv+vqGOf2#2r+>3%I(uC=&h5oDdk5y;tzI?5+7JHN~)EYK^CYTPb?n$FRL z8WK{8u^9RB_TvyY*e>uueHec8TmQkJO0yHaF^&YiY^5HTc*x4X;8xuBInVQ|kSI%aQW}HzxV~>THt3ay?6zttX6bys*>xwO-TU+` zeU)I*x6f{T-Yk6}=4nu760;T?beNa7Oe^tex2&{_(LT)R0I@e=*PC_8piYSW-|hsz zz!EGQ7vf}tIjIHj3zgOeRJI=*L0V&seFw$!kh>Ik0im6w%gMtjg7L_^TL(&PclDOv zC9&?f5NKG<*P7=Ek)@0`zERTYG|8{fYh~jQ=Y<)7lu1jqJA912fznuZBQ{@E-S%c# zFHZN|_}fSLB3`q+t}--W(l0TdPV-b|AYn~5 zoKqhWp!IQAPpzYy7P=s$tgk{{qo)9c{1L*NQiOJND22dfK0CG;AJ0RaqUP8S1S1VW zw0@6SXOZ!pJJZb*W_6@&4K|YrgAbX{EjT0o)U`icBMOmN7f8B?1ZNS2moI~%Z+NMt_hU(7qvoWp+{{HMkl76Fd zt)X|p_~t*{Y1>b%0BH_|VR&JV1`@#|?79Wj$X)BO`#_Zu2q7d$lLoC~=>dVNk|Ec!-v8fjyFp@8hNuwK9N0O9u-m)Yz)(hFoA(_sd#m z80x%6F{8KbJ%TAK2cW3E5Y}(5{`Z*aACK(ge@U$A?QCXY&>Qweo0f7Ii2D<*c-ju{ z&}xPCo2xhDlhtkmE>?SDeBR27%-#xMw#-70nzwPhh?)waVEhLOa@jsYY{_Z7qe-{d z1_wj3eP}X;8r2`+b5D4q9iP-;^YM0SXZ*v&%=JABojO2+Kg>zE$*&t{rrtArbud**F`;VV9FW@&a7|!qtqmrc4gbJ%gWk1cj{rRUQ*bd}-!` zCs+zs8_53VP(r&L!#x~3Z?sdIA8o|~ikr9alUZsExOnYn z>1^SIX`rn2Q6nNZ!+K)9dP@M7O)pB|^m3zA=1liY z%3X~+ZFMMFs}?ZuJRNMynQC(~!}2WcA$?^My;AZ_k&WA?8h!LtBV$y1i=$Llmn%!%JF#mniyreGcO6%kYCe*Aj$QMT;=`Et30Co1>w9E=efNQ6|h2rz`WR(dj_>!A3X{QkEdv$}yX zZnH19wtQy_0~xHd$N3k$MOjVLkKcfBJsB~@7 zRJ$VhprBxVD`!dOQdc(uerqF=l-&W|AHC+PcZZc}Y0F_14Xlt%Veo2ymS|7qROc3} zQO##iv1ROMCPO10W^J=tK`IW?^adV#rw$U0{1q||m*d2C7Y<5_N3lu%vQGn_0djCe=j4yQl#6n&Vi;{08*Fq$FXsGpbW2($9k!BApg9Odu<@^E78+; zm(9k3`s4Ynmba%B#8qOGjr=Fv(hFwv?(T>m;Dd#qhg^%Ygb-53p<_`GCWrYpZNuYq zj$C?P*nF*yy63m8jn!rnqohvF$|N=l;pvlTQhvjQz3Untt2z0!H1X$cc9^khYGl0D z#z>xz#d;efal-DPgo-Hh-_{pKpt|PLDJgebC!wn?Otb7wWn4++o99~huN2BePq^8mxY>sfv9o6aIq{Zj#9dT)lO+*Bw2$^t5{? zy8LUU5@YioNO-kea*Sz##KlQ$w*T219;sI!B1q?0 z1`^KX73W0O$rYdpZJr16RudcbI8*gj^Uu>{N`n4iZWIC&{VQvcBi5)#8qI1wDJLdZ z9|*YCHmqvhuDr-IoR_+8K!J^|F55)?Mc*`q(AM-|9b{ z;lY)6L}x_$_k843iPvOV+~OsH&C&G!!KnDP{QCQ0r!#sIZyk%1-Faqpl~Z{#m)gEN zHUqXTa?kY|BkF-OpBuXuDdKQGS)ODr`en1VDtART(i$zaje}HdnDm=s*s{z>PgkU8 zY&t3$f95N%lCwFiYG+=`qJyOv9ucsg@tL6W#=uUqbGxr5?R++0rS1%{A1jeIB7%!F z*hLVcTDg`ppnKT8$$8S?7=+U}KT`hU%*p9Q$705788hsy-L=LcxY5&p1Z*@mv69%6 z!C0BbujB%{G*M1wGh#bGZN)i844jHbBsCzWX593Rqkmp^Eg|+q8P!UxvIsNoRUn)?ovH3e6qBc;Ls{Qc24t8Pp-FgJj3+2i8j3!N#Oz4|1lr8Ub;!nryx{j}k zC)XKK77Ba$mvEa2KiuMi;dE4kXCQ;A6Z2<@4^5{?_ zmCIE(PYC$gRqHg?=j>qcW32e}5>Y0|hz4G_A&(JNUR;&txqhMtyidRprV(eI%$6@n z4-zi=>3)}TyCIDy(z=-hpc1`ew=ZWxrYl7%2g`lgvK9G~%x{z>5)R9>bKebg%|WM( zsx4#hP@pm?cE9FkCa~#@my-a4bCFa>5HMdqo&NlovkZ7|B!BGOIuCJID~{`!3Ss1T zVc^GeLwPxjvUP}k%j#Wy7<`7TD-S@%LJX?6a}Ff&DLCxBFi9BBJhf;lb4&Bnsj|;z zZa=9yPc*S@4Jp@%L~LBQTyVhj3z)=hLn8E~6pocmnCp;jg8>tshgFd8XGg z3B?{gh3Js>U@bRhc2pTt+F_X{|uNxwh8- z+V5=UW{;(BCfKBVQSD%ucAn>qdw4o{*xy_+IjQ~PWEN?u8Ciu(SVO8d=Y#yLSQli= zJLBM&F4k>kJF;|@32_Z6aOEwLtxHGuB+9NB$97Z9Dkc^Hfcl1N+*c;q`H4rM5u<7L zJ}Xg3N*tp*WxVf3PKH7L2LqS=@xs92aT%2)bvQt2IBJXA zVqkioc&GNZfVWKgxLOW-ytaxT1P%pP1M=bw2E1`=S7v+$>>$cFpfbE+R8`-=KZE9r&evyn|7 ztL-)0c9b+hv8e8PG@ZAIidw)b3^vS>e#Ahhe`slqZCNDOfg9eX=@ogEx=JS+jligCDS}$y;YTzZ}%;9sfg!!^Ae$@&+H? zFw&7PNj^J2rc~8#(lTVl;5t&8SaN)>!h?=kK0P9PzY>OH-v+y;CEv{X#0Xj)j+GiI z(|p5b>nllZEEgmzo5mJdZ+l^pPNKa+C^423Q|@H|Y}Ii>OkhwW-Q<-5FVE~?s;J#z za$W(gM%x+d)=6kUG=*@~%^Ox%hh)47y##2Lj(51E(Liew(d8vik8TMWq*4Df!+|DO7=3f|^!xSJD(p_Y&LNeW6x0 z8L;k7a?%OcAK`fKoj!@Bwad3kJIhqzitd8QpYvyG{ZbuRlD_q1i|AC^Hq`D3e;}2z zc%Sn+Bw5M(C}ytNnF4%VOY_U)|AS~h=m&5?=6t$c8S)2G4G(#iq_~rO#Fm)%Oxi}i zhU~GmM&i)?2(otR0K9bz#B236pw86EdtYzwoy-3UVeLq&?J}L6IZYKXhNxA-l;ll| zm8~1Lgy!5u0{W>mOf6Ebd2UICi*HJ`UY+1hZeG3!j&gmyipl2UrDl$LM@#Bg4=)+p znIQ96#eB>|-AkphGBuOqC(3X6E=|*`I~M22qeA;EIkR%c?NX9g2cq9n0O@-rQ{SRM7s^?wB&X1-4I2R#w; z=tmqVVA<;n8n<|z&%2Bk%t-SbhTz~dQDax;r@rQSCLJ!0A=$dWk2|+{S=x!R#(L(` zWF8I}0L*;H_2seg>R@~HtX#9QaYe2+`T_nhK7XDhH#y&vf!=&cLADrqgf(2NQmnS) zGr+L9*4)J@P9`WSjyVlm&cFUW&cKiM%R}@Oq1@;u{Rk4E&Jy7`r4dhfdnrdFQlotR z9pH`rJ3a(=9VPkLVx*&2nmcly>T!l%U)mA6S0uCP0b3E{Z+18Xb&Y&@H~T%~m!}nZ zC1jOi(ba<*0m~6dEr!(Hg=AKvr>tqb3NDn*ODvV}G8t#E{1+|vimSfQR1xcszWUC( z)svTTD?KgusMX3{Ds3d;6D6>9L47NqeDF5)X6fP+nb z*&a*Mw{Q9j3&rXI^j_m{vd2e@oh59=d!~VhZP?qFe7$?p`+u>-{{+q)((pA{j0|_% zjsa(0--)Wq=?RpfAh&vWk>??a2PWD38kA)~C_j`x$AHHw70{9c#lXEHS1wS?k?>>3 zM^8(xTV-0H49_#O{W#h{s#%#hK#l^aDTfduqE;;tC_Tyh{Y5x{B$UCX5A9>ZaBf>M z=@muzx?V#vPm7Z)WrG-L64#hDr*+7NiP_*UH=X=bm#C7li}jnA#4g$|Z}70?$b)kY zT$Xga zAcVPsx<``o2IBIH&vll))*PWJ?0uZZ%NHY!RnOMm6k?aHYdseANHm%UgFzqa3-{#7 zVS4&Byb_(o&YJe+*``W|S9039NSdbY_ddMdAKUG^q)$53Mf5sT@CkO-5TrTTP1uT_ ztFKgS|I9)Bogd5oQnh+nf)U8em>}E{xkW_+Y&~O`5O#vUOu#XQdyaeeNwsiM;4O4)b5c9;ez#Jr4Q5N}Kb*DVx|Z)+ zuUCM^{$@a#C%bS)qq|ScNLba&62Q0pFV3iC$w{Mq_Q{%rc<(0o zXvnkD)wKO?!>3uh$$9YN^A(26XWW3RW$YG6s_>|rmaE^2tXt>bz%2nNx(=OTxi0{A zPg3wL6Myi_p8Dr(2GU}J!f6SJ#+D+avBsHN${LU zyXC1QDB_7|FM*;bvF%EjIL1@ClO15K?=h~|>R=)>2m9Pd@y+gRNYCV?G6!3bT=2ms zWe(8GO~k=NW+dHw^5@{&*Z_;cjDaW%P6HcrzE4ccgW33xygpIBQOSzOQ(rpffVz5KDrGBmXzD$xh zFme>sVKr_2J*30H+|o22%@XDE`&RJrqVw&Vks*g%?mO)J*v?J32f54+lFx;F50hB= zawI|!uu5X>zFw7d=~k8TJV}0;um_FZ1K8A0xB~G(EV@o~h;VYk(=`3DkWQr{%Xcq$ z9Nuoo;4_D(zKC*>oi? z(#f2=l<(^X^xco`9rx1Ry1q+Gw&rmIz|yL442~ zow9?QZGPV~`*KR_8sA8lcu$78;?gFuvUo>x0z+ zB!U0_Bz4^)qRkQMw*k5K*5cWeRVu!VY`Z#n9!xq`Aq1ovN(F{r(#L5P1mvyG?qN#u zD2*^?`;$)dBVUwV7iSNk6aNkKv(V=Py^F?+4h4-DWtNLtZZ2R!eq2B9X*kGjk7vT8 zcJ0qrVKe8@Z<@EG!bm8)~pljpKEHf#S; z{N#Fg70%$^y2zwjiLs>BOj{~N<241r$=OD>zu7|eA(GDEy34+U*MJ3buzl8w7w#gW zzotEE1J>t(Eq|5?Ukgq)BB)n^3-{N z_E&8un&NuyBW<1_!M{N*j(9}dR3zm1e~q~QRc@q^>0HF*&QlP6hM&W7)aSzdsfvx z@JOx3$CE#86)|2owBs`mwA9R$H!Rnp5|o{V#C8f-uFm?ugw&aj%+UtkC-d3g4Y?w2 z=(LQbFil5MIW=fXSwfC{>z}uG6S$`e@1%x%=F)N6b%pqSK zZ(V=iqHe&Hr5>M-)vE$=K9Vm^!a{VlpDm~R>hw5FiG514D#N73-{}Sett^UqF`5jC zUDBlJRiSt>f_D8Y3tV|a)JahZs5BsyyJ4~mZotVK>NU#0vug*{`Z`$q{tvT zl0Vhk#Zxq!S6;5})m95nlfuxP=b;_U!R`I^FBPCbft&r>#JFVPe=0~8fFy!%ugPHD zq)9~ASO$KgO}Y$YpN-f$3yLkL2(@@tg7GcUIeqa@2p+G4$=YHAUGd;irLA9u#LJQK z+b&_3B(Q6Zl;;s1HEhKky^fOc_mc!TI#w$f}D(B05&oaLBmEXhmLSDk6q1@ z@hTh-nG@L4E&ZDCW@^pjx8IcG0L*yU@7Vj%>~eQL~`Lb8;G@gZU9~jGIp16XYftsA*;&3D_?5#ap?H(4 z!T`K0FW1GSgFo~KdukmvWgV?AXp z+4D3(X9g%+>7KZ%TuW|0x6{q5l@x*r6808A{vm^ z=sCGP8TZMIN&!Rwtzb_QYPp7k_o@NG_z!DmUcX3&Meto;)*0}0_jg`XCdnVaNEW`g z0Mh`? zScwvxDDL`9DYFcz;1ugKJO(UwT=7vejJI6Do!|r1q|#WgX)>=-=6R%1==Fah^wn3t z71)kQOs8 zDS-^?dNoVci(fjuNsaz%2maYghH9WI0+v07tl|8_SObsfC3@42T-#>!{&4q~*8WG2 zfzQw!)zJH4)_)wtUnb>WYS~iyNeKP_Yk^BnC;HC~NYnr1P`;kbzyAw5{g1{R%J5@q z)-}Xm)c>t){U7zYRB#LZMnQGm>)%JebVO{4=JsxZ)pzdw)>eVd4X&vIMEB^(f6Kg; zzK>?D#@(6ty#)CuE#J5~-hhtyw$8uT9sak9j=hPV7`kqk--q(Y@dvuFqPfE@VwXE2 zzYXsX(}?bc1RZ+Q&Q2_gmbT9M~c{%`5e@-XzC z`M+uSFn4gZbV_&=lc$7tf$Wra3MsT0Qw|H*JW4C1rsw`rrP zq4YYnW{LBy?n)Df7u{+mwqZU7|6hBsp}uP=mU059#uIxKDz}LTDi#B zotZlC!xk4?_EawOgWmZrbV4|^&1*81ic{=eDiFR;Q&1skIOzjL`BXCCT zU~S0e1L5ozE}HLihm^}>XjAmL%~XY2^IMrx%?3r|EUm50uCPRA^Mi!agX9@-WIEqW z=~-lIW1UX?A-&c}#{F`gO}-a>XaJr~{AC&ox^fiX9YUzo8$l`q)~WFkEVWQ(PSIlR zGrdM58&bUyLx~YMs@`s1_h21DY?;;pyL0VV;4411{1epEnJmZN7QnZ2 zM)USvb{$qld;KFW@i%Mwv)QwKN1v%RRr^2cF8&xGTy!q@#puX6FpKuw(5ORyrW*Eo z(*p1Mz-y;G#rz7^wm|NZisp%&g1{MqPKuRvHuC7Kc_@`W>_W>VMBOQp!Ik|eyUuG5 zF$St!9qcK1Ae3PP9nL`LKJn|JaiZb^ENW`s(UZvq@EQucN_Yl+rm{ z@ReegCm>JeNQ~2KP9POclrw|G^(@GhYn1~)&2DPwilp@MRUc zFIlqG`6a8>TuJVg$nthpSQR?J4U-Gz`xC}N9T32Xrhn)+Z=JNZ?f+!Ye7DC@Tp#X3 zwKc;j_P)V^B1P9HS+af468+=a zj<=P5p2WeLa9OQm$L(jfZ+n=6`f3{OfgqRh(Tu%bBoL@HbU#rwZ_#7YeJ9SsOzb|KF z?>zaSKbF^gww&Azx~sqNGF8BsR!b#cMeX-4!qNd(*Im% zZ(;MzcY+7cRV6;$Av4CZ^@*3+D}N<^n%8!<>x~)+Gy!L74`VXlB8BF>>&x&zm!k25|Qj<%pG+!qP;}S0}QH7dE7@Y%U*J!}F}v z$$jp5Ma&6ZRq-3TM~XP?iNrM^-;pK7 zR=tiU+pLC_SM879y(50M+3hq$0P~!P+Tbl?CTJ%)AJv)fMAM~0Q<_#SL9Me5){6cs zug64q{I{Do+HHDmeBR$^FJ2vp7j{@A<9Cv#t_JKa_#S*KubR0q-?YXdpnSXcw1wS$ z-c4z#?(L?d^1#Nx7?LYW!U+@Zz7tapYJa-p9mQ4-o30X9Nf2~iAAq>eWzKEy`1p#q z<(P+eZQLLjY&}`m!y00wGfPtPav@YE7je;!+iO4#dS#bs)V!G6^C#0j-3ezO2(M~e zH?lLH_RYGbEYc&(mGu^xEBGJ6X$c8xr74y`N66gwvw*-rt5hyP+!Mhl^IRy)jodZ# zQJMo!`J9L;(reRiA!S1I*^{z;4L*Rz^2M9S$p-7`IcVE_@~XDmBE^;n^nN!eeFV*K zLW4a#uq?5ieO#zaT|}d9ouK|~>#Hw0WR>b|me4N#0av})ch>bCNt`Q;^4$!q(pcj9 z1BuMV!X1t;i}rW30mY?ibuYi*W&m5;FAN#?POqmU6*o^VPd&Am;$${C zosO@nt`>ZavV2ZF)91UzGneC;iMCSC^$KCH`@+3ubME?n+)->Ay${UlXlX%LPh!o` zMQMmzZ_S-YrH+vw7Vv2^>vCa%jjZ*XD3@Kw&>f!Co2IO}h||SAo|F<_Somk0$sgeS z3-l2r8_evP7ty9|*^F0klgELUH;;rmk4L=Yd`Ck81_P64pUk@P(fkiiY6sT$Bhdhn zqn3!Zt12`bg`QL+AMT#bm}fOKP)2-N;99Hu$?ZR6P=SwcQhM#+!FdCUUPd>v7}jbW zNxri5?7Wt9a@{kGV};k?YUaASv?&&baZMHgjm}`ttHQA|#oQONYmK3ADI&@?!AOVQR-_iaNil$-^8-yqr zRFU2KR%^Bu*5a~b%uV-zV^L_)tVQ{Jp~5+CYrIEPAe+lIt?m0k`2wHoQe!$WMs}Ti zgPh;)u2}{&}B9kD^RhgRZ@YT$r32SqwV#DLpS0_7)ldNH6FvBhOG| z<7uEA6~6(L<(BQToAaVIw4(G0no|k5;?&FHxIt}AsvF0JUy11DmDn${0lDX&ys2vx zIsHo9i2noAWjpJ%fHd_IFH81Rh5nsAlg z0Szjpu)%Bl%O-7BGf%~NQs17;JZEZ`U1=schd&aU+dI~>1zR4jk0vARo9ELjPx}(r zH$vqo4~ne7JcQyW1tc*g7o`Se6sXf`^zq0pm*s?`jTZMvsZERKYtf5(Bn@Kp41dRW zz|QvTv|}TAS$K6utLr*)d21sMzW;Qax$nVM^OT>%4 zRHyDk+u|PUgpB$-x|E%abISdN5ULp&*JhGz@7W6qnxj)(NEo;A7!1h0VAHf{+LN1t`bdaUtn{wzW~}MtUXU?05=1F)TbS4O<)XMufRav^qaIUHQ`W*1qE)E@QDN z_e{i5d!1eT8KKyT$CuONu6K-{@4M3CeK4l~LuUSkEoU*HWABsPY8`41cl?sEp=i(V z@k6&pu^-S~eSNJvCd_9HC;=-c>gsjxIzwNKosL9&93L<+mv0`d4=_I*Os<0&PCidGKbiB)gHqoHVVJ$>i;lj+oa+)Ivm zN?zrZfpt#QsXxPY!srgtcQPpkEu_tXdybzbBis}%wu9QnKza3*{QBOJXCFMj^(iZ) zdXnRlKIXE0PqLa{S1(*~deP3*?7VSeZ7m@M9?3LAOxcBE=I9q%p4gwGk8P$t*N5&J zd7kleWUn*(5t!BGM}_rdfmcJ>NwM_)w{@|p?()0~ z*R_Yqo-5}us7Sx-4eTiwOK+3B-LLiK#SZ52&3p@f8>03}3+b|VFQ!`Mwj1<14d=T~ z8pzAs>~!VsWJPTp7QirYh(1c@NCaLkc>2%Ki^?p@89+}#StPE!d)PX5s)hJX6K5fW z*9hz>G!@1#u2X85$B6nn?q$m{!e(=ieS;sknr#aI57`1>JD}g71YH zx-PJgaeHkj4Oq%{u+TS@#AGLi-*D919#*_0(W_pq!h`o8vS@j_98%NE9$#Xe;w}En z_~&T^Cf{Rn4HI*Na8m5w8m>kXlJ95oKe6gEFFZSkKQ$COM#8~E)q5SM@2p*B3eX=N zsK7b%>M=+3;iL?K8}7(0tnFil!%${4&G(MC0fTEhU?>T~3N)(Xna8oxB=d)cnCTu# zCVLwfuDGW}kf3tNo+-I){_B4MWNPMlaC)xq%ejs**Tvl$KYZRJxU^?I*cm1n)Oj2| z*hkgIJXxlRr#x{Fa`2E$AZH?;YvL?dhN|BG$3EkNnXfjgaUfusuxuZY7Kmm7pUctS zm7DGSBo%_4?rfAiEaYK)f=o)eb1{klJ*=j{z}JgoDY|ZDFeUB`oBkji_Z13pd(8D)*Gi-=Mwd*!_W)p~ty` z=W)-*e97hF#U5_s2ILm^lD$^S45!K<`gnmEnslHC7#Lq`9Fii4bEQ`=GCiEHSKm+U zN>kr28Dsb}On_blfvmHU@7&0j1}RSGn9-GF;;VdQZcxbFs&v(P%n)|(rWCxz)jAy{ zO6Glx4g*=z#6wmel=d)QUpm=Krh)lGi(24T!o$e2x4ha%6Rq|+KX@zTU$*uwZ# zE%VN+IzFT=m}h{s&j-yZOAWyJY^4SCPm5r2pFdrcaQ}JMjqt*5s{jORaUH?qk*E4$ zUGyQzPI%h>Ln|&!cfcI%fR9di#|dx@$+Nsc?p07ycq4`P_Xj19{~vpA8CT`@wF@h0 z5Gn%F2ny0lBe6hA8tDe5yK?~xWD6oC-QC?C3#7Y2a?#zjU@aD$oAbW^bKdjpy?=YZ zAI`Vui$8@mm-oEqoMVo0jcZ(E^Sj9hpxC||heYT@$(eJrN`~8~L_qGV5j;$3yN@f! zqk2AoVvmW4(yTk*@^hK)3>ktRH&|w+)hk%u1=;Il<6L7$hmszk_d)=XpC5DvHM@(822&7_#RJrgWgi+|l@ zk0tNr%Q4i$=sNG|Sb^&`;#9t|h&(?pdVg-!C7`RwF>}>l_mCjlrTuhmXV+HRsU`P} zG-Ok6%T{}<%tbv@{LtO7OYXq{9&r?L-jnw4w<$Y9{ok~k{CeN4v9V^RCB{SyN7_&{ z(L4$Aaj_>t@c#;_U0_%*nEE-4jf2y4*j1qi(cQPPnAj>`%<|uyiuK3c0k4vdRE%7+ zI%fneQZ>46Kl@#TMHF4ACYl1-CIpIOMGY471tNGQVfph~v%qEYR}S{JmN1poqRVLr z`-H&rDQsFq+1hb#>eE5qrCV;JH)FN!{@}<4m+e8kR1Hia( zZ*wbIAu&x_#zHTBFDMzh=WE{Wm{kjSo+X}$W$cW29?r-xs7%6&c#w2ga5+ShKSHz4 z+7ixsdLuA}D}Qr+)od|K5d+m`Nq`E^~8b2L!)uYC3mv4o<{MA89#0FX-jr$*q zGYA0cX6uILQ3LEBds=7Lb;iUWxTe{*FBFI_$`dvwMj3%KA3IP4`jKz&@5Wf-sojZ(hq zD6Gx0*;VBjmQCiB2g6fz!oertH(CZs@FiZT$~R!#$4 zs|uq#e?V6-)!DEK=mq+?R7V&-5>M>9m+(%J6 zzqWrOR||VhKqr6Fg+d?qzLGneTP@K6kFzM{8EG;ouQQi|-z3A^^WJ5M@GkegjOY>A{Q8Ym3!FQEL zu~ALV{UWftX;(wNfaDWE*HjAJ@R;0FMYNi2RHbH38^>a(W$Ut;)rx<6M1&)oirh@~ zwdbj@x^g&7Tz}63zOZtM!TO^vf)+eRVttnGogZP^u;V*DC)ZWlqJEAi3*O5&wJJ-O zpSVX0nPvegB+|{*1{~6{l|6%fZL`2R)v6&`UWA6hLZn zy2b=w*~FRUJcL}G6pCcDz5Y+g6h04_L|rD*ksN$@nCY=;_*jtwa2Mk?B4DN%huh(3 zB!(yf5*I^RF={MdG&AJ;Jl(?VeheoB-VFe2f4hwmN`44q*be^CnR$B<{ zYAI8pX!M4LS;1-64$3m-1OH~;N094uwIQdl3r2nP(6JC zZ8A@9VQSRoi%vY}75z+wb0JxEDL|!r{WgVRwOp9|HaG~Z^Xe9SVV+3RE_Vx*U662I zYV%k$_Bqlbjv8R#L$EKajfYaHRQxw>d8leCmyDY26qw5U6_jdUt<+}UG0U*AX6!V> zCh#jx6Q(En=$?K#jd;`RvzM#2qJEoxLrGAB&uNbfBydT;V{w|hBzNJ48Pg-WjAX_S zDs@H;dB-r!8zNqQ;L#$zJ_~r5p;^DBKxTG4y>jKyyv;~kpTBr2TxWQ;fS+mf z+Z6^5DNxRJ`R!8xRP-kdKXY$_d*jwQ&Qw%c(m+NXAt%2_0c0<*(RO?fzof(QE^cv} zdklX+;qUxc>wCTnq1N#^N>z*VZNC&Qn zXRG8#0Q@r2{>|Rjuffz$0(@?pGt%7gN5D5x$K8u;PSFQR!OrL5EjmwZ0InfNN<;)4 zbc>RMY?`}%w$v1Yl$iZYg?2RF-Z*D%y!GYE&+l*eYlw$>5~Ip8nn&NAq4)f@+9KN1 zmeQ?019oFG(`3HXJvcs{p3|Q<60mO5a#LQrDXzPa2cHEBGRT%30p2`YrY{f2K&$-e zJ;)ucQ|7CQv>oVk0Xq=Zgl77ox0w0yrciax1_|wJZNUuw~a6ODCXqq%P zfI)7MKd+nZGZ#{OmAzxM4;#7@0T~&*UW z%0_?^-wa?y4*kh+02e8=e$sm&2nI;?*(bm`yc5c(vskoLGSPbt69$qK^Cs-umofkv zDBc(g$ljDD7tM5JJk$v`xxHRMZ1>qhH}wDvtUF@{?W`@=gWJa57s}_LTFN9=xnOpT z%_YlqU+%6@GJ_7Wq!mBA;e{qhis6gVjY+XI5TsGks z`*ZtT#~qc!GNpy3xMlOkXpnXaSKK9jyColZOX=aQ$AMY>CKSK#R?kcDC!fNh`i!Rt zrw#4@W1||Z1HgmELSfs^;lobl`S>v9Le4yW&=Iv>BUe((EVXXib>w?Q{_JcnJGzL}(t0KXb7mSwKP_DPH`a8zZN9i;m z&T`O&3FT<#+NJ93GMFVBw&jB zt>mB(i3>hhVLHDNXneUFGrqV$+)D=_+yFG(!-qRmiQkow1W7UDCV@;lHdHXv*@*?2 z^t+!A8qQdq2{{~G4emGD-3p?9)9P^t<;V>^o(FSoi9vovV;?q73j`~?e;gx3j)XZ5 ze+;k@++*a-TPx2^iFRG|lw(vcirZ>IbgH9^Lq5pBZFE1-ODUOzAJ|)KRaf8-m<}M? zwe?eXzqWBN2EW0In1zmIOZR5t&$ESrPLpbLZUv5hZYk6`e2N{aL5lE{O4gS6uIBj? zA_z)!CU;NlBI9HHF@Gh)ZWij{CHz?_y&4210!Cjq&${(FeQYkL_2X?|75(FP;sJMZ zI-D;QDy6Q1b|aXxr}IiUroib?3VKToKbI7@wU>u2+56v}Y{%RaigOeW_1?!>NgbRT zRWPNYp-Da1I?qYP)vDe#YXA+rB#y(0BOM@}B{X(8Tv+BVH#`1v40Ua}7<)Wc?3gR8 ziYm(RZPlux7&je!w(r6^_3RLtYO=q(0RMPVT$230&xSxH53U61HU9c_!K)X9QX!=? z9L#s(G<*ElzR)YCCkX4V+eOD(uO;$^G{A+8?QUt)O!u5AJFg<6S3g@mSz}P%Gpifm zLKJTRq6Kw37uDNWA^W?_kj&jjjAd^DNe4S649>y<8M?9#{gTG37$d0MeksJ@_P(tO zmCCm0(MTGpSC3w^ma4V_Rg^+9FKdBqF8-~F0d90yQxYHG>rD1H}uO9jYkjWwA^3eVAom`$v9K!H-?3jiY*Aq;t1^1GdWV+S3X4&Zhh=ZU)y27J$rHq<}fs-ldOhgNRuysOWb6Ow_#*?iLw$J}W|oO{ye`&$@cm`7THac3PpQuvSQ6I0jie(B zAn|DD!2LIT!tw`3Lr%=cE_ZbYUWuPLsQ(bMq@yM(tTZjp`H zrYk=IBA&;WrGmFy#oA-oVsMyaZ0#tZS<>Ip8=2XnN0y|m|GuhmM0*jW2*9-5iXBkz zyhBHhY>PkyG0^cUKDtj_se((hZtTXp%?aY|dI{X-U*aPryH>?3!9!I2*N5@Fn)WKylkWT&FSW~|`l~^2N^7b(c z;-2Hg(MyNb>S+vKNekS_IuW2 zb;#e1hv->Gc3o4mBv3pSkm=h0^_t^m-;HG$ zgBQ?}@Lu=tHXmhgriPO!=l-_21xoa~-^C0^-Z;Mv78XE5H2zA?397T}Os*8g@+P@J zbwPtooR5i7&)PI1L%IlY1(>wfdXN=~Ii**p>yc`7GNDWf43do*K`OscEo(bnh?`uJ zHGl&>+iHqi%jz{bEJ)BDD(%#a*iB+=Cz&eIjx{n>wG6w+*UXhqR?Z%*LjQAATZXnf zRT?Jq1z2`_7S|@C_ik@4H(#Ju-~LCdY%Hg>1wdJ+OBNy+lqF^$OFp<|kG2QaD#3Ij@`WBSPl5E#Hlo{9N*^ol2F!>`w*P4{{ygLV`87()0P}KU!g%3N@BBYJ-v9Cob2VT9CwR+@ z_uo$2;t{|GO=u`0`}6tv(@VYk2=(CI026!)+<#36mAm7YE5|zj>)oLV3>e!>&s_d5 zv-{hB<}(1KS&N+tn}54IIGKO}34%_XC+Sd(w<@`0F+vLyo(KikgD9z#^dHh#j`&U29!oD*Q?Vn7j{;eVXa;Hvh z!cO#;Chaeb???PQQyq{wAoOnwMLL)Pi!xxu{5OXA&u^I$C=8IomyGuk`-}houb%V! zU9n4Cug1UpxG=RKAQB!)8Oo0Q8xQ+W&-A1cxMkl(mjBBO&_~$g3GiA4$&D|b{#!F@ z0<7E@I>UeY@q4~!cT(yeynTDL|Mo%~09LL;w(DPh94K`b0bc8wUDS-^zdE=8-W_*W zYZD)g`RASd*V7vFyDJ)5ep4Ctr#JpLyXDrh8O08DeVPS1oJ>GIR3D(PA*CnslFv`Dz3KTgZ=Iwv*`=?6dxI`K%Iz1yk+xB(QEnNWyY zk)9~{;vmyk|ALl>M?Eq0)J7I3nVEY%%qACKjJlWPrqBiJAgr zAF*->%N>Zn&hwn9hyuM$ojK)olq2O%19JYa=VFh4$i$Y8wETS1@XS40r^EU9eqMuYu#7m0gJXk!827;VUo)4tq3>hkR|lmA) zq-ecK-Wy--%p8y0~AZ~VY#*lh}8Bt z2$f1*YYR(X)W3)o3GK!DP6!RA1oX6>-~L|v4vrbN-bX<4R<#$_=P}XHS+J(;%0@mu z^*KGQJI3n%Wt+nFX8#6-VKHA({eby>l$DL%aW|V`p6DDmU9I5oDtozHI zDW#2Di~7Bc@c4H^>7b zO}9n&TiTV~JW}l5Ek6sy`Ask#>X?j>Au4KcJr;JGWe-KAH}p@RlX2e-PUOmdmnktq z{nRs4tCS5f=0B)Cq3t&vHD8%DV|qU8{9Gl!fJmi1Qp>^n`tqGK@n*qS3*M3K+Vafx zdO+xQYAH_XWaAhb#(NeKkW|EJ;-ZLSW!>#|Q$0|R;!i&FtR8#Eq zo%W)|epTWTK7On+CMM?7+q7&UUpeiXv5-WbZ2(-&KU~vWB2mp(3BSZrJsx~S19QOTCtj#%IbIfiU z;vVzNLPzO`%r`DV5sw{G&OG&4EpA(BXELrx*fjZ*-t6+TeRrx@Z+#8_f7;uh?vYr^ z>Nw*u#&eoKW6`SmK9tN)58<}@EzG1|!Z|uuUigJlAcKlKV3a=ye=PKr$K3k2^G^At z4^D;sUW)8+*JjUV!B8UZ?+=)>ag^VxOEY`|0s;iAOpo6ZBP7+gpV|)S8eU;)ss%QrR;w7twZQLA!dB-^T3csNq(38h~1pw1UV88 zlQeJ!h9Zzn&of)jouT>CK@P~>X9H}E{uTjKj&SD;=b$xwNPYXw2zr&gQR$Lp8;j)> z^U16o9S)d-&(1u4aIR*2gJo`Or`pm15YTXt$(1JT>xU!sfwloe)1U8)izU&s=HH3+ z?9Ar-wO!dkoKx4%;JFs6jN>b}EV;>z5ksZ!m2^(1S?80BiwqB%BVh=I?jb8w>#(g9E^zJ>XIyFVj%U!`Fiv29Ej02 z?a)Dn5I#a^BgR%ja=bhBA|??+1?OPVXo})(jLJ6IjSGrpH78MTxhY7+aVqCz!%k(^ zZ290~K370!`~+r==<-zra=p|;Un^D4kRPHV0QXIn=tTxqX3Rn-MDon{jr$+*^)9qK zIrGnn$>=M8y@=I0y*P=w5AuZCt0kI!?t$IUmX66fSmEaY$}xL$CRuU*dn{nI#NVS_;eGFC{HVK*MhPlM1PKf)AAe!F!%T-Y;-=`RG# z^22jbJxGM!@PTNm3SQRNcmb9Rg~vkelsp+3M!k_xI=Rt}4a^~och}vi zTd9-%y_d^}4o}ZcOu}4o5vPfOGoTElV$BD7p3b&g;=S4eZE0(c{lW1z`1;B`Kh{B^ z&w4OUP|~De>vsuDXJ_YVMRXy~#>UudKfq;5g(H3&2%55(EtFS!wid%$yM>H?+i5jB zJym_)_Qn&Z*#jPp|6LX2{ibBdm#U_4DR7luUMZ-C0ta#Of)#nv-t(!-rqkhs82@{{ zeXBg|M!)|Vo5Qz*>0jb9c_!5sy_9{s4X?D_C`6B;r1qp zE>+I0ZJ=-Dar^CH4^bsfHC^?2h>F@txxSebnQcyo2^k|~&3op6CPggpcEa$@Z;QyqLFvUUR);EwzEQ)3E5fpc4Wim^K}@* zWiS1<{8A2IV0^Z3{cgWOxLTgGSUJZd+7b(Y9DC1VvFah}Vj4qPx7zt4czFqAlO%Q5 zFUKMN(A*}c0&{^lJ4B_X0^pGugI4vkrK5fp@@~C8{+ywM_q;81eke&$vhiXsx=rai zCCvH98}!aWWsG*ClherlDR1MUsEM#JU%$oRIni?c7JTFxm04LJ6us;Ego%X!Mocc2 zYny~A0h@padMA6wqhr0KrO(^#Q_)eI_Df6YRin}pBpk~0+RX;X&)gMG-c{a@ z?e&N7lrg}v{YY7D+NM~PobWeYYGQw;zmy%VcX}$98^1L#g}-xN0tQ4 z=IA*ZDLg7sKD?^7SeK@`m;Fs=vPce`AYhHPPjsK#7VfFfdg>2ELN8YbI2?RN*@RM# zp|=dvL@Y|bsq@5~*RA-j`8E$LUZ38?On-;2s;suM-^k0Duihgadf#50@IY*}$mE-J z)YM+VR6bKh63a_fJ?Z@b^vF8y~OTV_$iBp^abVH8RQdikSXBI=_A0e?aDe6I!qQKzbDC5++fpC@(borg{CxW47 zY z%wf^Al6a1~6cs|r%I{aOi;_fMuUupD(PKjajfaVsr-f22+b{);anB;m4II*=Xt!1> z;pUbtrb;%uGR)Z9W$Xlfd=kb0d(A9Rci1HR_!0VQFbVs}_f&5pW2u}#rB}LgLc-k9 z;vy8-P?CRd}oPJ|(#pciF(#1N`1}*nA0gCk| zkMTxAS*0o9o_@%fmseVn_WC4bemP=W9RTb6K@=VjK6|ZSl^myOFegaEgv*2XY{iPY z!2Ssi$Z6x`{d`>$F~1|nknHJjAK^rWm!vs|<&ci1ixkz*cEh^sso-7$;~G4?ouy#X zB$n^!HoUt}Kpj)26&ftkIQFZ1oH_;lI;+@w=uo)^&}BN}NA}}6S0Vf%$__{V z6}>S!Zml>Wr0xDGyK9$90b7M`Ue|PvA+m=3w{)@NL}4*p6kgl#4BKCh81_0TIS)ph zN@CRMu0~b^tFozn@X@X2kUm8+wfqMNo4?j7EvI<4Z+K+Oel_3!Qtu-h+GnL%UeTyW zOC-qgkH>tc3JsED{PD?v?Aeaq4WhR>KQ+#;mv_Xl3+8Axo}kJe^b}jEE3m?To^t2w zqw`f+mdbYg6|hgghCRp7t9DpA0z5iF-V_RwL}7W-hFp2YhEiO18jV9@>e2OShjNs2 zKNEa%VUv%6a}1psJJ4`2C8y|Mdl}^J^ubw8^=BC?7DFh`GcS_E+oof?0xf&jFQWv* zG}C((N{xDW+g*tar)VjLBxG3^#%Ntcj(;{?v+&vgN+xy^_k2C>ihn?OXg})g^yIRe zUG^tLOq@s5Ua;8Z#{kEiq-cG0wUy9oRrrZ2&DsLxf>Av^%7s-oyW+rVp+!(r0`s8X z7Z=f`DbI_JQM(Moo&0K{lKP&@vWJ=N`erF|jNM{xbhR6ZLUwnGJ*(;Sx(w3X+Kpo_ zMJijiH|NUSgXTN9tqN>)W^>@VsXeMm`F>O-WVJ8-ut=j?ms=BEinaS}fUqd%10?Xwmonm=eX?MAjKs(mBL)bj4XRkYuI?p>u8wCP@$vCuOZ-Us$FR-V7lO zS6r>(puO6nOT0pQc7#a5&3-K;E$H>5wA9^XF?n9hcK$j~jn&TRDwEZ(Mt_ z8l*}(>3SlRN=@PEH(ZZD;n|KGYdeWDvtnUkJ-hwG-(Q+zNYOCAoCR*oVY!~gJZNY^ z22xbHZAh(k%!&O$7;#e#&A(yLoi1@^ii|hr70#5-mS)eC7>HzNU~Kh=bFJjQQ=x{W zwb>lbyOXXNku$eakOfAFcFicC5!mGut?m&gWxobg6Gv;^p1$d7!=ArM;ZMC5-$(-l za9#{F1I=&iQ4$k!@!{evUByLl5n>t!^-J8n$}I;=|;yZvvbIY z@Xm_Ti^VBS)xMBJmX<^B>l=O++DLCa*2mde(p`DwJI*s1S6X&7sjJia7q4#?S1RO` zbBCkiGwPa1V24S^eLAc6Xl?MHQI4(Bizu~2NQ=F?)NgIeT`2rLIeb*MYg*7-Vs=#- zK&WdSiDJ2K)>&^;`S_0jct7I$PGe)YNIHPT>WM95(4G>3m{bdYM$t0}NWgN{vg)Hz z640M?Tg#EVJfGk;i$~0aoOQb6zG!uU`gqAp)8Df!>~<7B^gFJ>Ta(;@SLQU?nhd}OHgpy(f0@OnB8tk&E4lkcrWn(!48i_ zw2sp|=U*1p?~NB}R(3!$YRSoeVI<*ZN=GxEbU!7rpfP+VCOpVD`%;>_`Mb;3j_%G| zS5P&>vVtx4=1W`RT+>+=Y$8G?wP2U;&xpx*Y^r!;`>;B^8lAR33}*_cAi0b4wW9lo z!f3O}ygEdU97Cw=9Of!*p`O3D_g0FWRY?e|2qhkOk$iS@1c<#M9waT!1n_j05Du+8 zCF-Q`^|?dHTmE1w=DD#kenFI0o##5E7msJw%xCi7?ZtrjM#b|;#w&J%ktZvutQ2zu zvEzLae3dhN6Ig^z?T0Yp_0%E#rjO$$LoxW%fO3iNUYBuBo#zwm;Uhm|e0+Q^9ig)6 z#ouK|9=%E{r#GArByo?AFJjg!>N+OK!_#vN8@bt6JFdlLjACuR-0q||kQyFTf4O?J zmd`Jti~@G(c5(3L+6f<`t4+}TWNoU{EJ+tqs0EIVOl2UEw8|hfc?ySyrSictz+7g^W*HInTnp_G@-I?gS62^ zAX(HSOr(cG)}>abk$MleebqnTmP-=(;U`BY8=t`Z(P(tc_-qK9%HEY^qSC2NXQje8 zh7|iA33kE@xVq*yE7TronED~e`?lFA6><{{Iax-YjhgC@Kvzz4(cJ1(h-2BRp2uZv zOhR`!qyU&I2@n~OkC{gTcsb|kVf~p6+{TFfr_r$eHvF6MKjw&c(G*hCv=5Qe7fZ~H zK}0MS+rNQ78T+Y?2jWI^Zeredet#zSI7}zqJe`=?8Ei90MA`hIP(eRafe}-w{exzz zIf&dKs{(Gv(r@b-5a`9GgHl%;sX&Zh2(Qdni@S7B0;h#=&~2?O*5r`~YeL11XbMMU*la!&Ss^`0N*1#Z*$Xb-Dn2eC5nRD8P^zb~|4CqabycMRxTKQG?kCU zX9%MJNe#|cWF+kp8U8<`^w6X>@mWYE!IA~x(7n5i&{er?2i+Igl48IRS+kHC)svhk9K zPGA}Nbjpl5cKz@V-^9$5(kI}j3g&rl{C>@l^8Q}0dsD5lajrD`Jif!vf_2)^bFdoE zh4ne3hOm}{T8J+ALMewnUV$;Nf*sI|u5z!TXmknMqy5Bf%3i*y$IePo|S02&>$F@kriUUI@~V!_`Y<_JbssB0@yYzq@HiW1AHJdH2a)_!uo{6d+ql- zF5@41$zy!xB)L|}t^Mue2k#isrCA}6`b0sbsL_*zW5KN9jg^fZi6p+D+s2;Pp%(`* z1t6Ox;}Uo6zNXe_B6o6rp1!4BTP1XSEJad$mq9$}>gsuom+&dx^941H;Q@UlBFRN%zgj)m2$`25Z)gYh9C}hS%i0j*87ZJFgNM6-u&-6y<4{ z@KXt}XUoWH_sOO{9e)w8es>MaQiLBa&TUV&G$CYHTz4N83e!wk=yE!&O*! z9hu!_oT^o8BbVxV66on>mS4&;2UKo}Hpftfw=v&3D~8;-4NJf>ht(*v@9)Y#i_P(v z>cZEW3EuxbqEzXE%N(LQxAJAxXgkZD!?b6Nx~b)J&{P%Z%x8y2zh3N7Z8Z%#hAGJ? z4_+ttXGib$)ZY=AN&ZLh4~8RP(L)mHl%SX zKxPWdQ_7E+?~FTM6|b-4r*rL&e>cEodOV^5yB2?|a{NUqTiqM!_;o-w6IK$#GS~~p zG)-DkQk+l<%LH^^jqKxyWnvgjl*|0qlo=KOxjzgM*mLconT@itf z$6JV1ix1kD+iz@Pi3M%Vh{jZg+cIA>qSl0#aj28*yOqFt@Q9oDcvM`oR&=y7-Cc7k zB&AZyxggGpIE0zswa|h$0Z#7+S8n;6UjE7qF=qaUYvgsZ7zZNhuzx&U(tX_ ziZPmFik^_lVY@&+JQd6Fih3P5eE!Pm<`-st5umKM{#zdsYfCm+N)Or$3`_CeEPgVR z9ZY8GKyr&rb*S#!>PQ_vhFrg%_CkzeyI@WpQMcf`9!Nbp3Xc@HBJ^hc(C>0Cv9G0N zLhePS9dm{Bk@;nhbo^!X;~5Nz=$i4miQ|A@eNWGMY&}#~XzRrw+qY(| zOE0nTBWO$YB4-R|opuVMzmu|C@d6q01p_M6_TkZs;1=EyF3x=Hce9-R|}jkhR!1R6Y9-D8W{7`I*B;}e*=447`@Z8V!PuX~kh!9db( z81$Sq%eZ>yTFvzlpPiz7@6X>k2sd5b5}I^V=NqL~jMb!gD6&n66-jzMJ;Y>vsGZB;KW#7E@z|YC%8t*0o}z zNOMDPXxscF7wIS29lSC)i6`D18$HE>uQnajJAb?~o>(5^f}+?ZSZ-jzKZAT zMQ%h1ruj5cUK=EGNXJ=4=4rHh0EpmqzuLsXK09II7@)(q{b?oBNOaQu$p3_< zOv3mP5YW8ni{XI^c(=4Lj!1#-hgENS+Y!TFe(Tswm}_kl?HvY%HHG0(30~+}pLJXH zpZJJ~uGQCWPkeh6%}mQ-cwFb*49WyD_;c*yKM-*ZLQ{0?JpLRb*W4GTd`Tc;TTTn< z`p3`Hnd?uVLIUgynb;fi_L#3zD#ZsABBDaR`4#@aj;7^aI>dyG?@r$WziPoRP*L?}JHf&eSY_s!zx4hDgx%POv~><#k)X|%%kU?zb7Z%J;sz^Fg<%IAL`eBAUP|<5$L^lw>-QpdSUr+*M zzT$2p8Z2=>=K6u>igXApQoZ6IHB++1)kY6DMqjyjQ5Bd9jTk0<@ac`G_}TIy9C%%@T7gCtBfm7 zr;+Jd7rfa|bN~x5%|6pRYKHE2v&cfOFNa5C%wWQpKNpi20~^Ge((*C6*=UtLZE<2B zMjI0Xj`~V;EvRfV`H6z}i2>5zS?dTJ`?sCM3!7_dk6)!wvv_~E1W_wVvxQQooo^Zd46bU+!swiGxSo=u26)}^(!Aqs z!aMh`Q>qYvF=WF)wQ(xpxVikYDTXypX3%N+4==vo!TkhYJeOpAKDK((wmZl za2)woJUABD>UsZpg=1ojsy~RW0N~*f4ko-04DN5|ve8Hd0NWhn041zz-2vZFAkLh4 zexj;diN7eG7>bj>M)ik;1wkY0*&zB} z;~<8gz3sHy$nS?hdq?eFW;w)-L)m2~%nMv&O;^KZb3q<^tkD$k4+OO*WvoZD(LFs7 z7UxEXtBQGYa&oKuIhk7PrB>hGPzGvhACHT@c&lbXre8K)qnF9cXY8?_6`P(aFa&1h z7=1K)?_6g~K#N6_M>4NHjkuUtUhV8|+2{7Eb>i~Y^$!PK^MoXNl#yX!JjN%dmF~5! zhF`We2F;E~c#poXbmqQ@sB8W%3G&$d$yjkA1r+b|qZFC?S&*RROUR(lm zzMkF$m`xSr&mbigCWBv&5jkt#OYDY8_3i!RqU5mgdykw2Q({9BV6(fOGO<;|A{(;t z)oHIRSM{d$uV$(@vM}J)&D$3s;~aP^M=SI0 zm~Xu&W$??9jx@Z`b!k}X!b+3nK+=otc+=kxCj>nb!ZD3V@?{n`-+dmuyPfAeqtKYY0+PqYU`<;Mvf--|fO z6;BzXJu8kUs%%nd@^Y*LlK|>xZOzc)x7gQZU5l#{kpCK}xp84W(Kxlx<00qzE62i3 z6=Mv_h>g&vG&Pb1dH#6nqiV@)r&X&`A?;Zbqi| z`K#IcijJ2=z7CXWRERz7+fHr2X9i#Na*{V1bhfwW(ipaVMnLr=qNLi`L{0g$;JyIF zPLYIBCCz7`s_x4<=?{Wz0Y3ipga8g2#Ac8D>mS6ls=qWtc+N=)$YcNrgka`*a@C%H z6BQd9TVEs-@f{`1L~A0f`dnusPKKuaY-j-tfccs$%z^U`2xNanX*6S$`a;z-z=IhF zk@1Z8D(8y%cWA^nR{+heCi1)m-SxD(=^rP(i(=s|G($Bw%bJ`nG@G&|^Fvaa#B1ie zaCiD0<$CLP;e*J9a!a0M0k4D-oxm)~3@2vOAr`%=HhySuyl+nJgFy_pO5 z&HbxRQK?hxeb!!kt?sXT_4oDAAJ%|}qKMXUGs4~_zh*`E!>%Bn)N`|DXaSktfN9qO z3%$V;SjFQswWi4CcPQ|?A8v|*l z<8{fwtKM*O)BEb^}6B6#D=+D zpky!u_t-siiNrZ-x}xxKI)ZejT9=f;c${-qt?@?*-z9}S8Q=RHEzh7n^p=ZA!>Uo%tlEmO)QR)JHi!KYOKzI-xWBcuIseK1%2sO2c@{W@< z%TPf8po304Sto!(Zyv6|2Vs5bRokT{4WkGbS9K8nswF=RYGer~=aN;En}$Z(T^@Hh zHjo5!lOSvl%*pXl+tPe-xOW0P^gu8#4un{Su3}V~_OuW7Ccx29)OPyaQmtbI5Q_1h zo?cH+LCAZ?}hEemfzf{!&kxr;_A^ z@`?5`H=7I6z`&qtZbkm~#mmGwUaZ$vP;C!A3Orm`m#1QK4%O7#j17Hqy(3aoE!qAV zfd2l6(ai$a@#UBI59KsbuyAXOe=r{=NS`0v?-<_;HzdtPUF3NGtQehmME^Eg_9+i0 z-3pg$4*)h+4y2MPiTM&Jq;Gzk$M3D8G^Hk^E)?fZ zR=@i-&DVS=q_h9AukbLOo$CLV@J;_gUIeH&+sg|alf#TX2$N1iq5&vS@-(5_y6W6_ z$K(ujYJAK-Kq3Y+;yk!yDO#=-*6&=k65PX{#GV?`Tjau$Q=}bAZhy^~BjIB>Ys3qO zof*azGI=Kn)Ls}(Hs+y$x8EP%=rcJ|CT1Dj6}IeVTss*(rr5SkSsR4l35JZ?F*$X> zPn4;vTG`u2>~{s5KftkS#kh(X8_O*rN-WqD>@4U96bY)yn|F+%434GiJHJ zuHx_9Du^owgddx+2qj}Gn!ai@#IMOJDodKgtt`7gM=jP~$Zf+NnqcUZN$MlMn&1a% zTYg=CmFSP!hb7k8t(*^nt_u!%+}3oPtR9YK_fV<%mJOs_ya|88jQV%NRt0`u?|K$s z%E+kt60G(a$fUR#_mtvQs#C?&CDgY}%ERVMV=?!Kx(8I|t z3Oy%xqtPfts;MRG3$NLJ``x_Df=NE(W#<(s87O?GYX~$~32!b@^YD6o69X#DMZk4hp0`(wkn^l1&}!IcShwWQu!_D~+kMJy(!`6uu7-BoP_ zFRR_N@qtc?6#=HAS^o9b5Q|TGnT1IKz`2B<72M~$!r>Sc9M}GhW?dcK-5Wn-D^-9J zlbhDls++%gG0el^Y!i{-Fmz&#m|dUsEs1K|ZTCzsjAbh`F-4SXGGBVI*mc&4qrvW& zC+F9%gLtf@-;+rqud-4jzrtu1K!6CJ;*hL7(6F0$uW{K$R>f${l=j!2CW=gO*ACeJ zFh5Y-D|*NykYZ{LZb@jADunQ1bXB0?_`wwm8qGS9b+^YPppILNVuu(gRGO%i=JRxW z(BIf8ldEuIa5`D>Sm@$m#U5#!)wno3i~5A}>4)rBoA)>zc8T?uE}HXdq9CraDs{iW z%=>F(G7XTva)lem`&(@>*Xwt0vUQB$83>(UhtZ4|EQ#iWhd%)Niv& zi!~ZZMA@ z{!A@I%I`>NSESU$XuCU;>~wwSbq29f_4yOy@4)08fGTu%2$nlJT*USX)5)0=m^M$p zJhc1!9a+g=udq*4gCy?s448{x8_bI5-RqM@72oG7_Y{Xqnpo1ZN~k>KK!zm!p$a)v z9~?La;s>Z>sihUG7lWb4mFH%Y%Bs7B@XWL~ecpAAxKlm{xO9Uy}1LkUNZeiB& zCYhyj#QV{D!Hn&W7X=+*(E-n|NS*h>F}qrt1H+3sEqlpQEX0k6N3qFRV_Z+Ch_3#C zFg%}=m#c95IH~@2-=cM>kUS#Svi;7=)hQ>({Y+F$Y~n6nr6+1!Qx(T)1wYEMDe~$` z8O?;{xDlBf2=pr-7|VsXTPf)-3|yv4!W*8V|9ry@a@#8hEau2Tu;s=bcJ_ zwFyE^z{b+F+XG5lhYx-&f~#1uiaf~;Zi*%a=zWwl*q5(helyS-50R%X?2e&jeX|Gf zJ098JTIA(RQfx-V*&f6_w^k|n*E(y$oeHHS`|DfP7%<=Q{s}ptK#L{P2HglQzc3Lr z-6w}Z3K46a{!&*al613?lo|^lE;yq+spdjPD#+AK`|87CUD2&aDnP@|Q?|C$yc^9^ zmm#@puC7rdpGX~wjYl?nIMcl4nFnhr>z?hReWdMzXV|{dwsGa)z~p4bk2H;6?JY8!#d#BO-^#@*HwnZ#A01?Rc^yyKd z-bHT4=PMTJ&?B)>$GS8&6&*PPg%ON;pj8?1bA9m~D%Bd<7LVl~N3P>*R8y6T zzSNEIDx9l>C&s4f47NuGM}IUj`h#w1db^1bl8P(er6&Bfri}|6bI&J-7k-)3%79QEQcqF#5fzLg(-`=M)^BcFm#lVF z;26<00n{c}>RhTgZF`1nWCHXm?t@B`sysPXEWX-NuZmZFPPO^Zc z)_8CjDTm9&2OuTM^8(NAW9e;KffF7>D|a;#|9&%|P?5$BgRV!<)sKW4UT*=H%T3HD z1bb2;fwpXOApniMaPV|<+Hh;qiyd-NzS8%9eLeWEJm`s5*7n4x zi>Vot$`TR^#2XP4-1?)W*3FXPL6u&Cx^JJKcQVJr+!4$Z~I?@ueHH z*r)j+^kU^>E?Wwd`g_N7c1JS=?+C2wzC(e@9JYCaubsP8h?3S(Fj7nC8`e2bmx5TH z2lW=r-A9g^?m;b6R0*=l3w4|2IX*e@!CirPlGDYS(@W>SfIzC!a!DhZ#4{N%b?kN4 z(tyX^Sir8m0F(^Lj+Vy9_a(+?;Vt9do|b%a<7DtLoy? zXqU7J^YHu1iA4a&?9eF21rm#mf|@4mq7@;Uq;Mi-S(_(zQEk*OV2YayUe$YMk~AUa zldE!5DkV>6R<4ODWO3(Mz3;a*69yX90DuSKKArx5o?%g)4A^akr+CEmV$tbH!#aE`bf zFA<8N#(AXIiLKrPVjnURMg?c{ecl%%roB^Beh;uI{X}^!x6oZH?0|mIAz4o1@d1HM zpLR@cSn3^i!_|&PHmOYG34cbEx7wJ@E5PEfuEYT(lyMPhnB9@pkCl4!c1Ba#9IjkC znT$sjAzTw+pa*MEPVnJepQ(%3q|tPSZMqFoND{3p34`gP1lF}gO^sg=B?BM`mX*`| zY!}KHS#cXlt{JyQqat?C2j7FI5kqC}#%gsCJ0(e_RG-Xdf0!Mv_h}>&gKl@`6xoLO zjN%YsKfcn854)qiNX`#QAw>NUw&bsvEz}NTEN4;H{fbW0nL55&qfwj+RxkVQ?Sn~t zXCw-H$$mtXGCNp3#xx zo->Lk3Ap#&0?sDG4oR;5)IiPWn*boc$;%Za-anYYnB6;W&|^Y_{TXPSCz~%@;mw1F zDZ0J3yUUXX2`^n^&-J+u*dXz;y=$EtjMT_g--b+#0J;#nKHS#s*kclCy%u~T{MPy_ zf`o=C)-zT1utC$ep$7;noDkFHOHmxts<1;H3(-Qx6*s`3bv+lgP6RR@cTTKbVwGw2yhy*HRqMz;(I7U*oA z;9H}{E8RFBc_=oMvy)ub@g7O+SUzy@G z;||oDs7w{_GPn^VT|7N(oUiNA>T-s6$sBM%jzJ3wRR_>+rk=U9?$Z8fl0OOs*|G$x zvZ`2=)mjiWwPe4HqqB3~>e=M%Y#dL!%Ci|C^%H_-qxr);pF4!nlwvViR z@x%eWhf2`Dg}o!NjdsMeV>*4|pJHhGpW52m?ks5@&w!NbvlapZ0yof_q|)gC8=ubQ z+OgnK%oeI|OFSvSAdB*7D4Q`s4ILwbyXD|rP7-=Jn6Q}LSkZ=zOcMnJl0i#Zj%kAp zX(w@t|Ba)}sMwK$J(K0ySASn$p(*p3Qh=nVtb%BFL|C*?%lCx1pTRWm%LT(?xJaW` zClH`$PN;b5lW)&fg-=R4eyYu6zL<7+4=2lggdNF}L1VgvDsqjCl&i2=juP9gIb{Dd zCO?N^^>ymlji~$@G#u`?H=WCECQvnN?}M9l0;@>&^yGRAnIWdrd^hXOt$Xm^}V_NnnnuE@oZfnm|lFC$3jD51tIz}@4T#?jG1>Jlc4Trs#1 zK=GxU?C;;My#Jqw%;Q-J|7>p(1*Z+*Aj#4XNqZvUVLY*91F$?e9`ii&wFkfeMIkLO zv$#Tgy7w(9xokn?a5(v%ZoWup&%|_l{azDK6A1b%g!cgri_WgD-WJ=FWo>2z-{+%K zcFdG{peyL+vgR0D7AgEG(>qnLq5&MyA2+HaP0ptmpHB%`0$SoMN+URLdKQ=qe^0)X zdE`8M@fWr2(?NS_1Q0x}o=IJTJ@kyv+Kl+Pk+L+Z8#+9u+W?(fFq?@3fpX{_CgXm! ztKA5HkB(Wh1HjR9llxuO9$VjJI;fWo_Cq8ijP4l{7Sx##zD{BviY5tSG zx`3EnnGJ^1?uf64iRtO){jKp-&Tu0h899}gjjfN*@l9U!)kZ>Y7%m`$zQCUaJ6DSz zJl*VdbjSrBqy-?ROlGOJSoN9F;h|Wp!h?PIM-qy#{JGTX`dES!p)zW3?&Zj9GocC{ zSxp;n_=bBc5IeTjGJXhU99&>3v-x;-ON?(Vrb&{9iJsc*IAF`eQ4^c~qEXA%+pod6 zs3W~4@gWeq7*O zTI%4UNe7x^QsTrE6cpUti;pdXC@45xSpY~D8{yb>DJmg28h`R_Plg>!9v~oT zzCS%;elz$GtY`QX_KBY10&LOwq_UVPCeTQgHfNAH#i2R(#;0<>Z!xBR0~s$TFZ!dg zOrIWHsb4J$Ic@32MExNg2gx)4)JH@)Ye`V(sV$>eK_P3ly-1%`I}ZbPqHNZ|J}m;N zT(fk)$(IHPCc*DtT^@%J!S617rMl?CuDm6ojM6Qql!iwV& zXe-1xy;@5<98|do{>(VH3?r7)lDvhl7NQ>xxm zwQO`rOhk)Me#oE^-EPIOl9LL`@nHiph&&GgWq~MePqa83whBXtG$KZpTX<&8YnmX2 zLV4u}QAPt5s-fe%!EbYwpS=9hpi=3!X_Pr6S)kp1583~Khydq07WxXzIC;G@Skgrd z8J>S^&blVoy3B+zN@lIyP;o2;6KzO9_F6MF7SeBmgBjjZ0ZUbNp}o73^o)8@*dacv zbE=F+6yS=SBJBFEe^rP@#j2L=q$MUxAzSWvO{Kj}{mtigXH?g8c8s?@J_@8vGHGxX zUS;*geMxQNA}HT#w!1%Kj=|MapGt#Dl*Cd26Lsd7VYsIVS~PJ|t&1#oF}4u}@RC%h z4TfSpSOc`MC-eQ0q%_ix^${D9963bZ7K2WNZ(ELNIel3Ar~1_`rNpnV#PzbVG^Eol zQXf_~InobMuq;z*<`}0$WNg1_#5~1Uc_Dqp+!_Bh{?pU(YlTg6`I~=lx-?oln=P(6 z-!Ho+=lc&Zs1Z^GILjb-W~n;|luI^IY*$QlZd5N4@`-~M-bBo6WJM*`Wmz6lRBCO$ zjZ4y3+(BH!bG1e`bYXebt+Jkq2$w2-SeDB*bXi}wSdYwyW$!Jeqa$O7KcvteWE{zb zvd_VzQRC_5^9P)-+i|VFHeIw1#bp;_<)Ti>8oG4*#fKr){y30CYR>2R zdyw~se8Ov}Oa@?2Hnx6hejLMrsl()Z5B8X=@g2{RH380BsFxtA&Ne0ZYiBlSN0hCL zOI6>g!4!F}`5Iq6q*)xEU&=QGDl<>z$yTM&DWa$2tWqvIE23v-|05VES!EgdHMtt0 zpX$XS+gbO*4R;uEj#3*pD=wOZz3%$A!7cSl?QYI|^}0gJv<~YM)+-8b5$$PlI4?GofRnKmxp6G#79fCq#w88<+n<#!$9_LI2p8C z`==Q6H}La9-aMfIq^GvH>P48=kqy;)^e7U0J?s5nC9rcA+u;ZU+aJY=3OHk$VK_lO z9>|J;!xryrlu5U6OBmW(?)K)P!!;}3*gc}A8?lJSfQv7iV*Vsn@Rot>NP~S)rCcFe zjMa%k4OG#aGiZBqgORUX7T6{Sz?rc7)u>`Z>-S95>mA}zdg10BB?Z$Npw>{Q5_bk$ zxT7`p8wasN#h}4>@{EC=_Bd-1w6Y_;UG~Yu-wxUS_*8&T%0%_ZxwIVX!)O6*JML|9 z+&Rs NSsGb?pP+pVZj76tf9T=FnjULOUdMml2(>#Ti@uQ|Z0PYK1Ron)3K#{%Q8 zY!iT;r6tu1nQcDCSFg1i)Y^|;gxu+fgQ`243;M=taZp*kINr`d-X5gX9%o*=IgrfX zY?VjM5UjX>z8N1~v`q5G(1qU)Cn|{~Li6n`mmE0MDU0R$nB23;GHDD8RtOapfRM@) zPTd@bJiFUBsuNklgAad26;$50e(^L6@kz=UTvMx?wMu^LdHVLZfZ@+FaiMR)L(8^^ z>w5l`MyqpR%unv0-jG%g7EXO6%=NCQ&iq;JXixStsev0iGMv-ZsortF+HNk$NS?%C zJ94?1fdXQ57B)uDJGQfcNm@V?&kF6n7SUDo?Jqe1A6%olZd02gc9+RUdh|tpdDGd^ zC8PG>T1WLcq{XF3y^b=8!#xg{-Gxl_E8u%YaF5IYPdt*V&?3OUR`_MX9~COqT4(u1 zng*`|O?pbq&E~R8oGKy+W=2|fu&G%(D{E_E>UXbuTT&glFK~&p@N6e-FYthhuS-Vgbh?j|~FF*AQ zF`VyY(+?rLaGHb8*9NDNv^Q+yA)v_hrt7LSQVKZR9yFX1Hnp%4sc+I0jX@bnpE@sy ziQOKY3hL?Zmo0842K!dL95_|pztNwBLf`(Hb^(`!#D67*j4C(VBu@uLF1>W2>oq3_ z8v}ZraX4+y$!UHnCLGM(Lb(T&RxjoKS;>!EE98*vE5Luw#`N=@vf2(=V0`CB+e=9 zKV2){;2I4`7=~XSd!zbehy^VyPCj+gTCB8!y0QK<`Vp&Ma_IC+IHd;yp!G?b4OeY0 zcuXbokX~0RF6Rg&Jk>@ul5Q3qJwz@^ig+1_r_kNERZIVRwsWuS_ zGSH$L9Ua|(3ZW~ytoq8Y-qr_~Q!H}PwTYt&ANlbncL$&XZH2w-IlVd?F{f3MpwL7m zEnjBtwUWnhZF*n5zf9z79ng&Yk#>m4--NlD-P4s>z^$4euBJNuiHRg@s>iPR23@8{>{|B5*NTOG!K`;%D; zf3wO4+W{dK25bwQ`IVP@vOz!P50%2I0XK|7+pu{Kjs;(L6T{-QMk~-DNK~=F)nvAW z%GHEJvH;Qx?qA;Jzuoaqe|pH_f0vQUTOnLS`7?I=^S9VEKz%`Xf{ws%c>3>M{L4?Z z#>-hCTEhIp!TpDY4F*(Vg4V^qeEgqt`ghj%KOT~s0!RUhQ`Gu0L;M>9eBBL;U)pt= z9sBR-S>mI0oK7-~X^*Z**rz1Zp2 zQ=qiRvXNZ>e-qjJ?=M9N0=P&R0v$2u&!+y*->x_SNQQX{h3-$sM1S|7nP9+0nLh%2 zWnWOipKtv8w-${+NP%tckMa9q>wkZa|9MLp58xs(wXc!}r5`F`)_HX59lmzUDC>-Wg>1p}o( zgF`~*d|MV8)bTF*Mq-bt!10|GwO{0Dcbr5PP7>Wn`7<4A&yKzTbiqG=Q0_fc?k>zv z)73njT=~(T-cYf)dQR~#l#j95nq1jhro%ind!0$Kf4cc6d7JoEsM){WAVI&3}IBG*W;V zE_o~5(2@8<#f=S05eK?B;B#d^_xFDxihx1`(8={C^9O8*f4=Y>{J_VWzILB2z!MV^ z{xDmt-zL_!B7u8fd}<>hc-)li*<2DG0(0N=kQF(W;~dl%V8V9!h8790Ap;X~vh=@-i34o^ zJOzLHc0~_Ss46SnoTp_O*%GJhaSKVCUs!1Q-s8QyFH)QTK`jJX3eNl+ z9wph6J0Gr4n}+&45)ikEXD~*K`vjY%#-ior4oLg+0W>EPCZ=xiY?Q$biS~TR5rwci z{c5OE$K=hlv%6a9&>orfo~}68TAL{VaGAtM_jB3qj`7#e)4xjk-LU*=A-?Q{R#CFh zy*I`)iEoVWt`0@n><&WP2%w>%(P$tbL%qDbdR}3{4Oq$*B=;*u>Yrs-ZKoR=Dn({w zN1cO^W-T4esQET~&@eG61`8pGPdU}q)w7hNDCDsnp<@3j76ldskViBG2ot?ltpE}& zeTTC8juPN#hg(3C!%^k|TBz+Jn3gM|1-x;2DrTC}xO=QPwP?D#p9{^bZAAn(tsP|b z5tY_^&~R}j08)M?aDp~VPi1hkD#jJuccwcoF$(?99X7k52R*7%docFRXsxBLGNDnY zKPn0$qIOu!8&ML;WJ*y!7Fr9U04T59MiU8EOS)td?0PXEhNi;x$qOQ;bC&i93?^61 z+S)FcOf2hGSqa<20|2$@TxD7y23@}VKMrF7AeG09KL|0EThO(c29$UUzbNhjYa+Z# zMv!8}%hL*b7N`oz`BDWtf+>w_)VoX8x4&*==QMn=yEEh|7}-Allj80^_VAh#i+N_J z)#HsqPERO-=Q}A1g~Hg$=AGZ2`v3Dne_1RV{2ugJN*UB>klrWo28Od`x{$;~M7iR< z8Z5P4qaF-Kr0>se5ucTes?Ir|3qMc&Fj7-j_Y*a;yuzjb695dIg3!^`C8wr7$^xBS zToBRFl*F9PSV;ZlXJ2+JKmH)(R4#0%2O;)n9dcb*$f(S#uI+EswYg$(v=f=a$jTC* zs@PT@{g!N9=6lbkFpEXr;3On>HCgJ2o8u^4&(>=p50 zxUi0--jcRNMGmcR&<*xt*f8gM&jZst%3_&U_%yPI-QOr8T>IJJn0=*y zte(ux<5e0s?=eCqI>gsqoUH4mEZ?RRf^^^XR4|?6T&=Wg>Lz=HP(t4^FqkoLFznnB z=znPefFnVj48}1hxCS-GcuiP8ZXO;TOgtYAaVDN0P3j#j)KL)-#B5F#slwT+iDzo( zW3%?YLBfCi*N;#KI9Xv`f2T((5wX7rKE4PvVS0m_Q!?Ri|MNetO@S&5d$5u~8W}gI zm|Se_p*Co6kc%Y?{a=6k_tE^1Z#-g=Q%gy< z4wS-wyXn7vV=a(-mGWt<$i%ES%tIo3{T;=pKMdSM32CKeOcy$|^AF?u&s*U$g45n) zMIUXR2_^kdwq>Y-ecM;Ai+-_u={sMR7q9on3w4CQ|B6=v16ls1 z|v04+wb0TLE*872Yd8_R{)D|2qVRb!w%jGR>1(>ew(iv>5Wr^O+4u^3#n-u8Yq6n?bUG9gsEk7qOW}JFVG{Sxf=7oUm z5{wW|4>~!qsIwOASmtsK-zjN|IA!pen-4sGTv_kl>>5mv$>rwh4Q*TA--tp4 zh&_Pz;`i#QUf1lKTJb|dLp-u;M3`Bjxmi0dzq}DUy~d)P{NW@rNjRMU*kjRU21`=W zL55e+Yodh>_t%O1zf()Z2sZuEtRGk`8xNOIDfM=1R<$NtLS!kio%UN<{R%>pbC;LP zKx$fd@}b1}st;YaC2F`C^An!yRUM^zGp|`bL`uVKmM8&$t?qYYH21BRU7s_sS)2~c z_#J}5Wxzc$+S+8Y>^KZZGV8p&)S3-+-ArdJ@}!Ru<5+d4IE+0}Nj1Uf^oPU1uA?F$ z3#P*h($a+OQn%D^HqPH{00uzV4*M#2UA^Amn3Khcawhq}@);=UWqnTZf!}9`bmJm( z^z;{PPVbD^aAs-Vk_zEIK81#wo3lI0ZfQB3Z&}`-3cmy9FLfZc5W1CbFlRr%cdmUM zFk}m_zrTXilR~r2M9JumkF?5Sk@%aP-~mo5MfutDfYqA+xr!=I788At8Y2oFOVUmp z+H&j3Q6s=IlvFai(u(Bb2n<%z_RHfEl28n1(&Q_*JUnDrSlAeX_N7QXQVBb9T)E6r zN>%3JBGSa7dH1mFqWQW=o?k%kO&X2{TTAC)KcY}1sGBT5wYPq|*1J?0fVSIS;dMQZ z`F*>Kuum(_W*=zxEULaeO_7gyE!%u;zJp%ooO&RI$vph3Q8#v}*;VyzhP z?ozXMQKtAlOCaglwd)ziY?X6}T#14_+F&w4!}SrvWN!;PwNTkTpkyMfP1?LQ;-wSD zDsR*qNuFW$WHvoj=PvwM&l=*>O&-$P=qlNlEc;1^!2-%8`xqA=6_zr3YO}j5zc^EB z=DcMtg7; z1q?wHIdl-Cc7y-VzDq2o-jy_Sp=y_(8#RxRNY#9!mBCW5kI8ORMY(VJJwsALyQt=& zewoZ1nx$iIIIm{K=v_5No{P$`VI4)hf?jY2v)-Z!4d49K=hZ8F?5f*a3E@S$Kiv>R zU#O`V&t$wNOBUbZPjoR?)iKAAau>yFYvj0h>Q?`5sonj-ai@3_9*-lRpP}dC*SI81 z-*le5sL^CDbr7B*8N}Iki!q>*aT57v^#FO8lLp~%1PR__Ms2!-4(5s|3&|H&Iw)!J zD578Q$y{#R0Lbd{>DCe^#kjRsX*ac>Lc^U|+j(RyfLqqgG>_nI{D-J2Vt?KvHHP7po5U-_Sb zz}r4kog(-S+KRJhXi3TtdSpRDcF)NMv6&%ErygyXpiB{M7xb6CjO9-sA{DSrEB)|h z_>Bmo+lm)wL2K1-Nmbf*wY-mr6gjDxkJdk+eRO2oD@v`5Ji;K%psie5^cCKKm&agrswsF1{4x63q9v*w*Ua8}LuOfsP z;2eijsiwNzt$r{jIN8V>XDu1(fqz-+zIKC;>MB(x#q)9W zw()8$xLeiYzUris3B|*YuvC%3yx-0_sPTVXavCbA71N8ZPDCVlo$N_QP zDZ~4#M-o5;1NA}1>Crn#0id!63JpEGNr!X*rK7NDSDg1og+mn*n?=$^`B5osz$6j6 z<8o3qxGhpab;{C{3FWiPDF@@iMw_-gq$j7bkELqhpo_)6VKiUN-tt{gx!Fo200Jad zXo4C2q2!NBA6oKxYZ*+(gjlQ0N#mZ7)0t!L?>ETf(!uRoj%GjE%k{(*8c8=Bcf-ll z*ikKVMJx|k#_;lHO1FDkFT%LQ|uqY8FrPy_oci()IC@IwfA4bHs(GJ6GrCvbsR*rB) zRqk;-%qeSpNaD4Hr(9$RN)HqN0Q3Vdla5c?$W$-Z(3*!Bve_g)~F6Nr==QL z#aj`D%VvNS5>0PDHnVNKt{34)s5-AerS}kmY@^iWdVjrtKU$}2S7r=rTY}l(vg!YV zAWlys0MUKbYZsgAku1>|P-p&ReLV4=^Y8$RwJlDa_2$HNVw1-9F$0;`wpnlaCiP*w zbpoS#SkPWvhqZ?Rt!8uM82=!PJf53S4MqaIwYx4Hg-mU!3)>UqM}ftLL|7I7YYpK=O6wPTbg3RaElypp{i=hIk zk3gp%ON4&>`Fw``jrHM{$YDUDn#PR~d?Hlae7BRvnE?v=Czper2l|JPg>7q+<5PzR z%0-XL72ADRLHmW8Ni;G6@f`P8HA4wWv*%k0iyut+Cf6#<&NllfJjCp*b8G6XHp9n^ z2=-P|d?pB;aua3O@Su#JIBom-u1i&H?5cr2QA)xX~l8Z$?=o-$f1A8;9{*OUVa zMe56#hu%^B7f%wzdk$Nj9y03CqX4^P_iVuASue-7IT@*G=BIt`tKsbe^G5RJ!26|q zEVfSyC1KLXuK1r~C?f%hdzM7i+^;lEcO0vs-kum0Te%QBL#*rw>`HA1)(a~hZ$JZr zDLXbU>3Q(xxjy4f7pTw2ha7IRAL_DG&DmQxn&WeAJ^if6R-J}7 z4RLzrb9`Qx#K~`G+uAqp?uE=)igFWa{Wh>b3ZL&-E!P_!&os1(Bb%%Bn#$Wt>MTZl zpU6C!Jv(+O{YgK92gwOrZZS#-VRO8_#>UYv{=gcm3G1#oAgKcpY23hmE zuIfkcQB-q}N&xNLI~&t9b3cP@ z$N4L>V=iBPe6qxcb%!s%1Z0=r5u4F3h^cJYC11hZEXW3*Qzu`aay@OF;UKAz1U@SS z+>3FHsw*x)9!5HxWJq!`@n4{=dkPu-x;e&fB)?;YWRdH8gLLwvb!vr%h>~z2AaT?H zx=%sCA5=oH9~@}k8^}1K(6q*n%5-mDJ1 z1PKD0X~rE1CH>vUAyWYlWSaQy8n<`v$TlpWmI?TM_PK{_b*3O`-Btg^3IpSRfS%=^5DDgoamTh~SV0we;82VF5v*L3D-#$HL-(AzKI zjaV%6DL!z@k4}YxOs;bi+b+w8@)~`(hEromlP=6onI`HjbK2P1Zkor$vefld;3DEG zRaHkp=*f;E6@i0Qe#L_wcDTveb7Un9rGV8lG$+2|{N>zR85g!Hk9$0>>R5JOBhlWF z#6~y0aEtrHz91)MrzC~OVS~Jk5_t|Yd_(Ju{zul zA~8I#$sF2$1Yw>kY&_QJXSGHkywgE-C@;g>lK7b4rbOz>B{6Jxt}lk_;%;qV{?1)B zz-VN7ah_4x8ubj$Q8)Gq4AkeiW?XE1a*C`X=V{+|hbpSKct$+s^5dykscB9wtEPE~ z2kxgMH<$*(jFU?^dR_W35|BY*q{e?j}zk z;>K+pJXQB%#+6XKKW|1&FOO`Vc<{$SFT0aY=Cc=$mxeOCPMMsF?&r9ha##&O!Z~i| z-StJ27jaMm#6)ooZ2B42<9&&aBB%nPTovYDCDDi8othOwdXg=umi?@adAvl-2`xw) zANZQ+k%V@^WeQH5W3g6vAOey<`)c+@Q6cAiTlzq&1&#&^e^%hj-R^k0NQj}OR){I8QR9ic%0S$ zkouZzvM{ZgA1WHQx`{w*zWd8jrcS^#35PdO=NfhL9_ZXOx+H0##Xhcux4o(diA!Dj zp;_Rk++OOhN_^0}cfYs?hCLzSBF&Q6cInSw55s@p?=vFgqk{d2R-J4E9grY>a6Py3D(#)`-nX) zuvqWj=K>1BaJUfzx3MN~D)gfyxjtmHH_RUQ1N2T&paqCclwhP_Nh%?~j!cs%#yvI! zjj99Zz`6Ia&3=?G6}O+ec7XnH_?>vXVf4LQ08Cw!#Lt=ij4f`j20Ad_jc$8R_7((E zg1}@%H9q#+hgP1R^ps&sP4~3+oYfE3n7jw8vzClduVMyLbfKy4FAmbSS2-owi%RZS zKMH1rpJ{9q@!+#q-6Tw@RhX>07y|tc(WVGCuz7Q}as3amH%#4QX*Q9V9rQiCy2EPX zhv1*IemcSoeAqyvXq-wN9CO5OpRXTG^g{aB!a$S;S5fevTjh`clKZ?ugGHomow;6i zG4(SFovKl!*;ky}XEKQdn#S#QPJbVG9jyqt0Sg5+va5e;4s;ca?tYb+!sT2~oZn`t zrKNzA{w9D@iL$+$0)wTdWB5V+6^7g!t+nx6ArFFjJG;er!2Q-(XeL5A&=ygoMfGZKpf zxMnI#Fi-3@N~H4~F^x}q{n5Eyk-M`+1xuaSC@yQY!qwG4s1c^ZkgwW3#MT*rDxV&# z57)bc=k>|1otMeW>+^sf)HR67tC&{9e#(3yx6}LTe8#66tAQtx*?g5SiGJ@85xD0D zj}RvmpB4i7%wf%&d->ReiYua&uMBVyldpM?R@8Nv8iWj@obXy(--;b>9j9o#ZN6!g zm@74`fa^Bk3VB>@_h$97X>(4Ky{~4)V$UET3i;At5Rr3#ZC$rTf>-Smf?LJA<5C0; zZYLeoYp`Tk))XV=I;83gpH1$8@Gc#y0T=><>*wxXTh)3w;r-+!I(HA^AD!o(2x_0% zRrz7i&oDgBIY1P(7>KuO>UEe#j&`)$I`xA^>T0qSy|^;WqEa{6Y>*i6tg+hCp|pOzMQO&d|;ac1UO*QUq^xSIPw;(Q)Q2hP2FC7PIg z9X7~1xgKyN3qk}J%M4kO0XWqdJOalzgq?cYh%tJ1#hke9qMh;yU-oyK$T#iH^TlUW zXf)~z*+PMi1HbINih$(V9}_R3--B8;6@O((eJ^M*QH^dmdO~(uFW!z=?^UhIXe`%q zF)u)XKs9Ya<8<7MtP(ovzcF73)bT5o(G!U}%V%bvt5x+aQ7wpW)eWw|kq?mVV)Hs@ z@v?Df9M*;Fb)KZDGzV%g%2zf+dv{-H5Dg`9m9TSf*t53t0jU+t}fTJ9IUzuqjCN`_c9ZO^gyii@eaT9Jul~1#1lrac8;^v zoRs}jAn+ZMBL|4>_-CX>%v4BIIt zM_4RVYm|#ENfFH83)EShrc)~2R0xdc@v+4iP_ybM9}#R@**i}qoeS8%3lUe163lVE zhllz~&t`u-^$SIox_Hj1Qu|HJG2In{2oF#3umle(60*J*t=(&Y9qg>vJ*0U_SLxaf zx4CH)vs<1iW1X;jJ*7$5B+p>_kn8zjzVARg#{=nsMHNuj!||FM+UCHSF4PdW+O|UF zSWhlfHQB~@R$m}}EeS56xpcf6IlYStOCRnJ;iPoCee5hl{ZqX%ILUr3U3{Ar`Hoo` z#+aInm_G1VyjOG64Cmji*`(G&t|4I_;zC0?`UH^pHb8@F_<%;xMlelGv>*-ADPgNS zVuLl9DpV~&BcJYesy#8$J!nqnA1t0fY<`q}rmO$1a`I)B?;x(k5vmFVe-0WBdHh^e z3eleKU-oKKzMb-29KF|@TOgeTM94MA3wBB?;stJlhb9Q~GlNUP97*>?p<_@sMQp`*N~(0#D@@m`~wed0?f47x9>6XLo~4%)lPgq zOF`vq1{qL)T;hR{%sY|ne!dfROJr8|DdS~E|Ii4!a4pQ?X7{{h%s3;|HUVPhSoM-> z)FXFp$8kTT)mUET$QXLBe%_vhJc>kZps7n`t5(-R9jhqbBxj?wgYIO$++;HKQ8W|D zb$C*g^`gV^%=@+EUtdl-bV@$59JG%kz56kxX?HM@=2LBU&yUAP33LkBJaph#^M-={*aF4}83sN94XYfcov}8f!0gqz7anX|k&Z&{ldqaq+MWaeYE&jlq6-b^%Ss z4?(gsN>5?6D6wU@u7IuDI<$c`P5^8OoLc?4o27TPR(LlCbltmab=S8Hx4VUJ&dp<} z?pDYWX)7qu*H$rKsB6!*iWo+yW4|446u;k69lj?tWB&Jt6=2{`3L3`E%g!qKo5O@r zXCSm^`s9o%!CcL2ym|-mA+IGdu#XK)>I1O^Ms3JcT09H01)hc&0TphBP4}9~X-22a zoP|;zKgxmL05O^-AKyhPqtM8*_Nl_Tx#HluwYRN9pw+`aJT*+Jd!hHN9MizdyN#R? zSsdJ0#+*O^k_1(KDAaNzIi17>`1V5h7)alJvz%ij>`|xjL4slfNAEl98kG-huhzap z+?Hv&WTV+G4r|8JEc|?3pEtHXmn@qm70+b4hBVh(iHs0BtH(*V&2HLqckz*jncSf4 z?HQj52)<&h#Gb}*w9pTK0`4nADIg-+_jAW>Z2=>Hz$Dw?MJ^uAD$HyX7M#Uv9t50R>aB(G#5SNPSSPdA6>!_CpM3J2v^<5x1k=)a=#Y}#D zqJ!{xxcmF8m~Px;62}U;P?$cfLCJa5dSBzv9P2DUh1(TaEYRVqoub_#v!Bi#Hqcw-s!s>s5WvLB`QGbMngN|sS_USDmGa#XMl;H(K za{^+PB0e{*wv$69&Fem69vhRhtsodGT5+m!`~8Jc-5c-w{-}!l`Fhs`?j105a62}u z0b5I?Z933NOg=mpXn3z2FP5Rt_%-kUVec)Y;##)0(FAuI55e8tT>^nXu;A_x+@;YF zECd1scY?dSyIX?0OK^9)E9bm>zi00x`y1!pG48lO?il@J_3G}`wW?~)sx{~HJku}f zW{Zf%SvLxYz|TyW7YXsJc+}Jr`XlTL@azmg*q!ch)FUwm_TDO*=ey$KVqW!H3m!56^ZWGA*OBReF6gh17rPjua|TLHgaAm zu18M=nvt|d7!MR3fnR2>=b^Z}ZAVaSG`YO&9e8wCco~8ZJiWahGl+$ReYE|qigF&> z=CSWFwC{9Xu3Iil<_Ms4>YZBb#b4)@~0x zujgyJp8pcD@o#X7B~*K~xe544Jl=6RB&h+rPVM&aJhA-T=mWyNm;$o=^>x^x8{O#-d{p>t!ZqKau6RcZkOiL9|gA6aLnIuVykS8^e;wrGTvo z!T8)y15<*UTFp`%5o8_;z9gX8CpXVitjI3*-af%9H(j!ETe=2ts(6fta9jMtJ)oj9 z_rh3NFCa!eT4!q0^yv8LrNeNhdUq%YAbJR04ooh0bjo!l8iVKk$s06VBG!2P=sVo8 zmS8n1cXP#cK?lnD@+&FGQ`&KoYu`{$VLLU4In}{#_M8~$$oEW{{4+EAKt6kZ(r_da zbbBH1L?O+MFuLqx+JA=2xR9?&cXEqXTews^v*BSNU90LKZ-7U28)*wwegj)?#ZOPF z1#iYn$HejZF@SmXxu4hj3A%?`DB}{V=;Y>tz%Lo;ZQPCi=@AIv6;mx$F$3srJ_ z?ur{xpS{Q>zl9k5qN*GDLkq>7$g5CbcwC+ka<8S)`?_i>%X5m5cf1v-aIkUhm;cO38sE^^ezuL&Wi6&?eWW9>hz(?U_Wib2 zFrWr~tqD5#7>*7S@92b%RsTe(&P(7m(TnlRTOx1C2F8V|BRQ(Y4phGxUlIDR%@!`e zlfZ|G*^PnN^Hry=zyiJx*2FIxFLbHN2fN@r-#@&7gD8_tO%ZS+h^x_ccc@KLwG6p; zxCyx+981%bqZ1oHa*^ocrqHTHbPvTBpgih@cEA=&sGqkYdEY*dG@>0qb0XsCdNlH) z{zKjf97XsCuwzH|kc#HY%8I$ZS7elT>Bqh51*&=oCPDM5{FQLT_W`pU_+$92(&yVf_(M~YFS_|_OD;P!xWVud!$9Jw_~wEz^g*pjFmbV&_Jc#7 z+LzDc3>OK?)&TON&M&B3wtnVV4sV%~!;FeTT3?1X=#I%u_xZ)|AYlNU?gIUeha>?{SNP#nOcI|09>9Y<4PJU9y!?6)^vy~wr$Ew~lPx2HUM3dD>Sg29nEBf?l z_XA|h?%Lh;i8&Juw_24+a+KS$h}l9}FeZcI;tIGEOg7jm=!eqHETLSat!vKVp(GVk zlG_RAd7d{I&)T;|)NBK$Ynx}azhYK=4TMwGPL@u84ESo}b6w!pxWRq%IW~*JQMzi4U`o!1i zaC8R!v8_M_zAIgS3_Ib~j1+2LPpX95<5P({5m(61WNLWMs1t=5IKw28W~1K~v`e^% zmNAP(d-Y_Y6e|(iV6bQO;arrf9Wy18TU!fHHcW|j9S1YuFjQ*AaLvZktJaZei%Ver z;8Gf^rVk;tgZ3c_`$D*3`WB)u2`XK<*v@?p=Q$_LQ}rw7t>0f0eK2~kQ=WR9$Qj&~fh!eNP8 z)62lP_NON!No;aCWLi@z84~AS2DeXk8438f9Sh9XUZV6g6UJE_Xcdbc8}P#4(JJMo z9j*`p1vyRe+t;>I!BVL`_d%vuBQnLJ;^z+QS~#JI*wlIpa;}pfqv#6;(&%?S&^d7R zbY@!H_C>K|u)AfZF`^u@XO9@u3TAeFy>LU8h`Qbk9w}7xO!au_u>G|t5VN)*D}m9PF4{N}Cu2 zDJ=|&;W8l@Ltfr_dhYi@B)3%3E>G8W7+;@ z71($e;c>n#!8pU*Ts43#?duk5MMmbwd2r+Jphli5BJK2r<=jtW*fRWq%EuIAkc({b8Epx2D0*g_A^aX2#m66rs6`i)A@p#b3fael0;csG zyQS~<_pm4$!4p;*)#3YiQ?CG6+>XO0J{Q#p zK*B9mps(0%-i72Ms!b(kW}O7WJQcg8=SoD_^QsSxy(LYyRJtE;IEBZb@mRUFcP`A#0v$U3Y1oARAcFE@x|WeF1``dfG7HgP+|FMjc>-^7T@lzK39CApT7CXIf(Dp zbe=6!LMKg*tC)PVmCEO`JCGMib-vvnO}E6Lna=A%e#NwqY9Qi|uG}(>`>U;$Pc6mK z$o3dZzU|>+6ALYlsy}H``yIQ@b6gnG;vG|g;}?3zs}%N{_YsrUswFyDexD@iV_pRb z@>aUEe27)M`EDU}MEBMYR97Sl*~)6#Pd`&(+F-$f!=w|j+wbrcI~}6Jqze1VzJKW# zuZN}68=Ob~uli-ZikjZ3 z{8>E#U+LARhx5Co0QB|;o~M4~^&T7LCn!MW6eD<$-@D^UQ1SYbHxu=@7v}f$9S*M? zO=e#J;p!H#DcGbQe)o%c@J8B3K#F@~yxg+YW&lFfMyg=b9M6nkj{)Owv08h9Uq#wJ zpqRH)hle)8@*I4@?0VaQrpnHTe?_cI|2;t?`*3gjUIw5^BdP4hr9z_G^6-cNUb(=}i(9n** zmb=L4`DCgLCA_I+_V(B$VA=e;tMyrz(A!^eF<$t5tb<%=;Pa9fb6jpNQTj-H37XX@ z_&n0BYmHK?Sd}0&=e6Cf;z!pV_C#QN@E7jEpKpEqC~bAWrS})S`f{PQYN1=4t4mm- zSu;$>M4sCqo6L)Tr27`xX0E?bYtZz8i9M*sI4eFEf@PN$x=YDkFJEHL5?wY z*_-ZmFAt`3xd_IJLIQx<^XMpt2L1HI{~;&nz=`3!?^UEa*&HHM%#l5&wN!G$Qppet zT209ZR?MH14X)(Nhq21DQQmR@)OeXC?B1_rCH1v>rB8K4MwV=-?`quNX&QepDkO=^ zFnWRN?yA~noT;kOEEqpsUHBuJJg*#GocUsWsxfPSABaCXQF0sz zG}cGu-u4Xtj7cRYf{>94`;2f+^y&0zn(TOT(x>)>bq^;V&fkrQ*ekuMV(rzU(#^B& zG5h1yE-@Yy=Z`=29q~5kt-~Xi-A-M$b(z1J*KTd*{pseR>NouSY zBG^oaC0$)>tqC>pAFsDk?JxG!k55kzyoZ2V9lcY!-VB#Z-Yx6H$(j(5kWQZ4V>z+> z;1kINb~AEdDLWPrtCsjF)gKN8-`emR@R+QJHLB$Nq$f)S%_w9|x^8BQ4^2h{4}HU( z4c<+2(zd^c)<`ZFLs81bljbSr*d7hQnaO3EHryc-<%!nCk-0@qT6hx zzc{9-uo6pX&pf~L|1k|Me2}3yCO)2pn~RJD0U?zdC#oJX1dE6@<&ED@jX&qee;%{~ zoM^)xETa5JloWO1HXN@0?SWg0y-h40hjSZkTDi^ltErsACnhvGP4mLxk?6qaM!8P# znEaxdKP=G4U5YqYGTcuKr7p)RuD`a4tJ{)-S{EPv(^Y_5AudCgjA>6$il8k!F=_d&Vf^P!|Hp9zoR1MrVI7%E z1e}+1V$uL> zNzC1Bn&rR!r60MlzKrOo>D+Hk=#LKn+ZTdjo&YZYVzkuoZy)?0-@^Z(Sovj+RR2Rb z@9&-Zul`1702oy0`&s%uzx?UG?v`6TIRP_^XtJ0e+z#_F`Lqr zZkR`|OfOYI{nG;R@9q(P4YxO6$41$u7VvAMIN!HR|2O%M9rpiVBwLwy zP}rg~r9wOYVK4TZm1Fg@Fc4~(|IBy%AzbFa_B9d^NYK&vCA2+a|E1-FEFk(u4P^@R zN+Etb{{R#*P?MU1oqaqw={S`_G5d7{kHhAbO&r57;P}F=r5SCP|dc3lx{@=M2TOD-J75z6oS z`;OE>gF{5Uq)n}fw@yA>wo-}pa526OOy| zr+)4F-a$pc_;5t%4hMO+J8?#v^D>uTTXL23`oCxL0a z-wxrQe(Em=K4PLjwhi_q)5yR1rB9U17h7!aZ57U%^H=$hcyd zThZT`OE@W9RR3p%l-zJRdt=F6yGHKI%zi})aA~{;kX@|B-(+Eu`^(ntkM$8ApT9yl zRCk^{hv|`0A5C@rEV{)>84QW=u|@aY`p_F40Dw=CXZEr35y{`=rn(35sSWY^sAsJ_o_yVhifd{w?iO($Ax)+0hXv4-7O6t){X%GUrF zVd1UbWMKrKYVp-T2Tq+M44wLrih*#*| zjG-pMK#nj3P`4l!>EYpWkMI*}=BD-sJD{pNvtYt&bSuBWz=32w(uarbNHOpIw+#;UW_x8vb#MyQ8>F8Y*=zrI7}-QTZm*BL1pbMU z4edn15nRHnXTb+X!l>;B$q>ET|-g)C23wFI_5q%WcMAQEF^%xU5WY=TgnjUpM-r7&qRez>|l+f&X7lcFq4+IN77VzR@`e(?LEYrSZ+~@094u zUpwd4r(=4xL}nh(=$&ig3eHbA?|u9zk^WV8@+Ohl`SEm zb$PZN8J4}N3P~nwmrY=#t%X{yR*PLE65&k%zzCJ}n)4=B2!lz(z7e=D)Koy`CG@!S zW4E4p2{P$;)_t})cPJHfg2kYKJiJgK&y}tHul;Q+C=S5TMkzUb1^C!9=rw}qtw{?% zKu7?AhTUeeGe@3XkQ2*h=0%Bia831r@e3eM5R*fAn3LG*eibH!x=>ZuArWS-fXv!- zbQbyk#L0Xj0)QF+fWb@o++81PEMAlIZ?FS}FH&4Dz&>vSV_e}nH|r@=6iTURqJI$B zyET*yO#_eQPrcpyQ=;fEBY`Pq1kU27{;dUye6baF+g9KV+Y=(9-F>JhU)sNx2r^}q z3bO}iI$j{zAGJGOn_RxSR`m~-ij>M!x(JD2a){!JGI~lv2=jF6feGb#AvDd~gKYF- zaudyF`zm^!`oW#mvmhZUUpFV?WOP`k@3Sv*3>9n+?)*m!+*RAsjYquhi;mTy>;4rG zIF{5Ksz0}v1rME2YH9O3)AeyE1C_wqh!~F1a#hat`=ZGLn@3{vx%^X|oj@HsQq7u2Qa}L);&0^Zr>^-k4(8%XsGgU78xe~(rR+2U zl*7BS^jN@N$)FB>5B3-Pk{|1V@JCX4MpMe|TVcVx7@=TbrJy9M!H)$v>$?nM93txX zSsFftm=m2x#lrt0U@KqU=7j0XTsA+$9-x#9({Oa(D$*a7yf0rE8IgNVYd4fw(q!&r zFk3hSameXhpjeQtb5@aK_pfl$s;_W&2(A-bv!8rWm{%Dx`Ug6QAK7RXhQ!?+N||KJ zsgl6DqUS64e^RZ3^vnN&YHhcZ*Ino37sCrc_Z{rZd9s0d;6TFz`rSOpeAy}_W1d&+ z$6@SX66GKGI02D}k9(IXRvof>*t68hqbmm|uad9p%cNZ`D$1xEBTW*!?sKw{1z;ZD zq`R^t6M$oi)M!jcl4E})nUwFC^&`fM)n5SdIvNJ$+)s|%>5WhHKU-esE9cMC@_0Wq z8udkp+iwk1I4M0y;Bkhtn~kcS;|tk|0%gu9_?-9ATiCsTov8`#-RKjndNSYWo~h)D ztzq>=b0A?rzOPYZpPO#A8^h|c{x-SVX356>W>6hVmNc~yNKa(~Ji|A~KDQjPvJ37! zQER})vvmRf4t!O*cjHuplB)7odNnE7eoH|oW2aW>9gp7Wq?LJSZ;`*vFm6bz(M2OP ztHT9;TlDByh5-jITSKuH&fB)^~Dftwo zdY5f-AO$qOzzHr6(1`@lUf(NIDP>|TXCO8bPO{JchhaSlLTk64oClYiovI|m5Ef~$ zM_yQI0Aa`C^d1126ur^U23HJ?bjngJGhiY^uxaSYnt%$2Hf23cZ82pf@34iN++e#R znxJ@||CvyHPkC>#K~+029v$C9%X+DffkHYeJY}JtI|TN6$n*VILD!l=AX~?26NIn3 ztHQ8en2-Yr!D{h2v*F0&Nc6ph-w8+};U78Hm8c?(O|ke0VDLLoFd{ZX%rZs~1+&E$ zBjv+^dMEQ&r<9*On>lqjq)G9}(&bB7mDx5+!?ac>%4vXF-xSpX1t+Or&6oK}mZcoS?vTM#2g z%^u*a-~@+!!Mkv4Hcq0=hi-hOOk4eH=R4H=qM@4<8s&1ov+uLwCmTZe($*+A2%?yww(TK<3>U4Shv@F>lkt6&ix?S-WACN_q~qOrmS!BXcu=_vo)b$2<4f z+lqY&u)P3mCVOnUh`6J`CM4;ebgZb+UhVPZCBH2|BMggTAmGR$X-RHr*fn1yxmx5s zxFst3PqH8X~!iKWwi^%=^~9M5}Zzsw{-h|0Pb;w z&>+lvOKY@5$vtzhIgSF4kd7b>{W#R_%x3G8^M>{LEH1QWn(dO$3r@w&6)H@Z9#Fux z%N#V@Wmo~(gqd=A)TyfUi-IRRK8b2I^^VVYx9QIOu#!DrYNW=h3?19y-3teZ8tzDXL!P>5Y2uB{xH{FRR zL$!xR^<@=6SG^YZ{}QjdDWfxZQxIHg0L@?vW%F#2#UBCttAQjO zh4)OQEI`y)lc(ZOM0$Rba4-d+nkU+yD-s>>ZQUXmya$STH86{14X+(-=-7W(Vuv*y zPKmY-J9nz%lDAB&Z`m0y+#ah6%B~Z0c@BYgN*K@zFUn-fMjH2p)IZB(rhL*2jxWXI zKz#Q$5H0fm3%u$S#Z>oxyTz_k!H1qyt>zc+2mFqg%faPmAm;+;PPu<(yP+4E>6iSx$6*BICK=~W}larKD7C2Z){ZT{>{=fB2yFnoXcJmd*0ZG7Cclq z%2dyWS701l>lUKB4s+BNEf<|!3AF-1Za@QE z3v81>e19iTOWLR$b*>DLNjh#V;R?JAHV1?=ND5*f=;t^KKR*gQ78c(op~IzXyK~o6 z?Q*HT$D}W1N?=or^;w31v0-1z6@P0OxAr=Yk1XFu5~e+DZ>D0~@+bS+Bp!ap>fi^8M$%$OO5{55VDwFt~ zG+nviCQ`+!$bHS< zG-Z_D(7`I*f~_n$Fei_*-vZh4q7gi+8PpVZq{C{pNuPY?n!4B@oZRB{d~tt1zHW2) z64aEBE^!WOn}B7dl?ArUL6qHIiXw5kXMYbT~|ou8YJEzF!8PHA>(< zJKVVOP9^y25xptPsY16ILcFE;((S1}?l?!vf&}0?K zp-OTX&J|$BB%GZDXkpdE5DBG;bGYIZ>Xs=@GUyr%QGGxBI8h*@?6$j$zb+pKOTG;4 zQ`AER{!Dj6@AEK|dFrcJX`AiPB{z;LI@*9ai!EVQrwK)GnviD`GO+Pf$FkzUU@{Hn$w@RBlnliw_C_^UBS;E1zTb79J(U^!eTzf8$ff%*J(?4GDbN*D^GxDy(9 z>I5A4A@ne_=?FWWw+^`#pUZ?L@Q{(+!8ilWLk($z+kFd#{f#B?1?XuTaw7`KdI&D! z36p}pkKU22ue^2&Qi@h=1(Nbc27DW{M-Xrw(29ZDzxhHN6WPmynS|ReJ*60CW`t3}PDXIYKC3w}$ za{-{w(?&;KlG-3c^nLDFs@zO4M%&K$WU}2!Gn${J3c$ zt>jw?%ro_ta-A0aAHsRcOwBMxD5Z_O#Ja-5?_>jWVXEEsc?S%i07jHz9b|5c|13_q zl=!_kHhs*B>Qp!7<5?5-#PT!5!lrtcXsVlYmK^PB&_L~Ng?kaRKOwd5u>RA@Ob6+I zEjT~(q{krXF@+XdS}5{ajDhX01(@#Y^s9cd<)zliO#zc;`g6r>)0$#890&QMpf$>w z*^9kNaX?bent<;RlSxG>h&O?UJi{AQJdKRF077qPjwP9oTmaSgyDq4=*kxej&5jrn z5!wK>iPc8`V8_wi8VR-Z=aH}^*ThIZBAI$MODKD)`qsmeK?{4N z$;vyPPayG_s}fth-Egl~PkGG%OgS%p>OKEOAS&JtXcYR;AE3YNSRRE0g!6arrO2cl zERAd=BzjB}3c8IWq@7lwgQmqfC{w{XT^Bm6=R7tff^iqRadaO@_kbo$oweapO<8Tf zp(t{91}a*{z+sP|irTgvSz^&>^_oHrUxw!`n~1GDIBl5cZp`#01#ffKATR|TGB_(B z@ARjM%E#BO#Gy}i`lmHNml8IqsV*XG8YD)B;Qfgw9hjP$nvw|oX(rj3qC3TzFA(1x zF{spEGf56Ov?a=ucTj-XTM|&M>v4e#%#o8LkMYYg z9Y*CYK#?gg9G-kxjQDExWlmHaK{cb0=n0J2$ANZI#(^_!PyT?|j|H5DlVk3R{fCQ6 z0~$Z)1OCizB*EV~QD`AR*VYd>4{vQ>rGCXrk)@bB)2tzT;TQL`xkwaKsq$XqYCTVJ zlC-XGZRnzVh&l$2PB~kN#^$5h@uvp=tNJQ)c>Yc9IfW{2jbFA5cIP7L20(i=Bh zLt0^O0l^A2AQq0=5aaLXr*=Es4oZ3li)?yGqw=(Btie5vL{kT89*pau$z zg;#s~oukP!Q^fOnJ-DRO6i$oI&qg#iwh?^t{d5zOp3rQuT?F53xUHfGph``M#>NaK z>~Ma){3M0RW-`v__HD5_9903T@l&g9n8(%jmYc`+Xcn7te~RbrnHO~@GFs>%`G?r| z2smXY3CXYkt~2;J7emJ@M9(x9!N!-}^-G?1M@0_FxM4d~`9WBCf4RR(F|dw|^&Z(E3Vot>DX>GQ_tO>UabV)rNC2f11;Ne}gzDmO{C;78kOctpIN9`I4IJ#D|I0MK*lc{~@rH9-{Ty0^7tGFYQ zi@_;CVZ_A*^>p1s@HK;FTWPKVy)bx!8Sw=r@`~_-Ah;jj{)dN@hDheCY_Yh?oK`v< zW_zE9n$9y_t?T^usrIa+*$~ZuVMz3H<=P$^Ob(jtw)JM}A|HwAj#3`QC*9}T6BA$M z!Mn+y2@8c=eC;WH_{F zhHN1kUpZn9@ME7>1Re8e20gYX&-k+*y*ux$7#a9DVUbkPAi!ymq#@O~dBB%ACrXR9 znpaysNZS~FddcJB)C2e{RjM(`*7(+}-A8UJ9(*pEdjQ4Hqb;j@Jx8*Dzm7~zT{IBJ z5mpnLer$#0MAHvwIMi%JUN4FEis4h0w{PE0>b zfmwsSpO1W-B^xifMb&PkG!?a>Oh@aqQDrsxpm8KNpayce*wJ(I>r!v2T)bx*k*{*a zCsF}qi`DD(iU*jg(O~-NKgQA!Y%svKG^3!ltSlcxATGdqJud7pwj+K8T&IET6a6qC ze&?uahb-#c*}1nUpEQuzrDMv3q83hc+huC5Fm-?Df8DPA>`Nl8K=D2g7D5(yjFK@e z`8D6ur}5gGY!1U?7X@-c=zfv**cQY>oi8t#>F(VwBd~`O;6(R@l^_$@o$Bc|o8L^* z>yiS>tz(OCf$jVbvD7&31T1#mkSK2>lxJakD{+g{?~K3&amS~l#M$7_(wmqu?`~_=BfHC8w^=>IINzj& znhd67(6C#~s=1dQWA!Z@km&Ay1XiQZ=k7bW3{awrs1jjO2^{&as#}Ho@;1`|$=Asd zO~>=jF7Ui!jSUY%t$axZG4ARb*ULsgJ_d&WGNjUaMhooQSJdguW7K?tJ+2#My=Nj8 zqB>p?DUThw`#h3|I<33MITG6^yj0qnZx6sY6S})50GV46T5211AuF40(qfU6;b=;Y z4PPe9@T$Nb^_~=G{vb#G4LOAEgO)4`|CEZb|BaRX4Luj`2X86hr0yl)Aijf*5M|G! z?T_9@qJJ{A!CZ&6F-Q&{#<{88BPv%{p5@ewO8>0+esfm`%BG&<(0Uuv)?lZbTw;sJ_=jP3edXE_<_4Hbkpm09TYO5MCoQVSE=rmdkRZSK|?5Fofs zTjVUhumO$7F`70I-uS%a7rK;7%?_G?z&J{>F)Gb_ zaTY%WJDt652n?_Dr0z{+I1-ue$D_!OuEh$M)C;NQ@b4WW2U>NV2TjX>T+8@=I)bb0 zv-5{Q6{{brsK?}b$?JeX`a1~-KvcUbHg_9?>TL;O?{uY%`w#KeK-QPvt1UNZ_l-Nf z&{yN+n(sza*2{%V4?K9l{T%D<`5YEi!XRi`e%lttOX2Gix8OP}Aera3v=B&zN_%k9 zO^%$RZLU&M9PD*>z4gA7?qCm)gg=OIN^pR~@^kf}M!(pYwkhI~p_&#vP%(AG>feE{ zq7IdpFP;8~O+1c&dcgN)_SN{C91|Js$I%TsqmkyNv*yztK&V%15p5Wp6h@-4eW}Kj zd^Z>jndLCD==Qk%aNnr$z2s`i6M}_`|6qRTV4}&WCDawC4)K+9jTc3a1DrZc8dEcB z<=ZKR;AZ0a0;RNe0leY{=Fi<3M4PA|YLcwVPtMjYDaG(^baUlJ0>@hRg_f%c17E}2 z>Y*yDmiuK8BNMu2zfN5lEdX|{+w8W$GfKt4b!Uui$>x_%PT32p6*!}FRL412HL+Us zQAZUW^NXF+ms-AG*=wQT;Ni(To556rCWrR1TA~oK18jE(&MqDg6R2xzq2N(-Cy>!%2Ba&~M=<+|qWA+ugP2#j% z6kWQ%s;J~vlvYFfDg+iN}1=J$_!CXU*3Uq^jzA6PEQI#Q*ibA%yteOVs)b3zPfS&j$q3c<& z?Mc1e81>iaqhy!^1+OVlD>T;fX0>$$j3qDYfrktt(>f&Hu0CUk{047h&tCF@eRMQNRnIrbK<*<;MFl1Eu6Vyj=)4-p6Lo zBn&bbn%8+(WNTRWs|KKAADK7>aD~}H3#HGFzbUFpHey%oVjKt|il`Ni0di&PuqAV; z-aH=<5IAY)8=W*Y!nVhoVmC?6$7>AD%0Y}f{sK6RI_a$on+*54Hz8s4?^mn9zG^~P zio+F}a5N)H0#p@rELrGMwnl*1>f5d2g@g~3w6s!|gNNxS%K2kx3!bEOrOQRu$r>2Yo2;QWp9}C@+ipNL^_g}&`pxn95yY?|<98je6_#Cz{xp$HJTbEpN z0K{i_3lfjRe6Q_#COPl}E$n#qiE;rh+%O6Oj}*@db|#~M+rX`O^xC0r=;QZD5=!w( z+NEIr&9mb)Ky(Dp(MP<*GL5mxw>-RS(ymyifwG{*TS$!X-s4n0S_hae18X+pm?a*?Aj@|M1;?k8Pge5-7oi@Z4NM&|q3GxX&T?WrlEIqeAxhzi6-)!IN zwCE7X2>0yHjAGGM-3E1e1jiPA)pFe)Xv#ee(el+9kNaBegm&aSWKsQsJ}TZjw*)lk z*T+v^Y^M3(k{{JVGr@FGr(%5_R^hRLkv_@L_0P0VTfSHooTavMcN;92TDI z?Ir=V8wv#RlfS>ZzJJQFRY4jYcOWpmfA@p(P6(IWvqeigEN6=nYHIPZW3iH+82aL1Icmk3egDfYQ*5gmg@ z{cDXjy_CCE=VG0vY!>}AG>3H@L>sU8BdW5mpNkg0&)CfkC2}gr()X^=e|t%l_J^ z$?>RBV+xZ+CGSCUi*F~{geg24ZVhJGIN`c*!tG9*6#=a86)g$m7-sJiF(~(#hR=9$Uh@ zOzmBjN+w%AAY~?25G$uf?{d(IHpB|wlXr1-H?Y!?D>23BK?~U+u8`^?!ItVYfkQ<_ zr98OY%lMi5S&sKjUk|&>O^b%kLCb8T2}{qoHzg%NYd#$Hzd74Ui(ZM`OM#cmtEh^M z4#xTV{WDpmBX&(`6%vZ&#@f_j3&z349>wLR47xv?oAdr$W%kgn3cRY$b*0-IUi|{& zB27vSjIm&I*CK6h)9lLpj2*Ml+%!y88ZHG(r$B~w+hq>di0Mq#m;mnKiHT^`D7u`m zy@p2SsceSni%KPBT8Ofh6!SVRBGa|V0BcpU%z&g>p5*-8S?U6 zzaR7f?<=;+%+~@lU6UUq0r@mFuT@m=MjmkjX zwk?{Xyv@<`wXfband~LB$t^F=NUDG<(hrLeQ$RfM>|{oXYh>u#eJa<=KqyVj-JnAE zdrLbUkwIal@g|I8qtAJ5bLeWF*KzH}DPF6}d}6&^U3u33OF_AitHyACHgq!JlYtfC zFE1ZQD%;b^BK8UJp4xlVV|FarKv9;L)?OOblD3eaQIs=2ZULCJgepv`l+1}hpvI9w z4ca97y#MzMMTxOQ*U8bI@eAM7_a-=`cI_NbU{PIAPmcROTXK+)pnfka)oR64Sk%#( zh56D9vdLX)a#0mzIsE?Jh?6K*{}NIzg`Z@&2aji)!APGA`m(dTB6#|l7ya-LL4{KF z%tNkWkta~Bp-&pf5!|0q(zkXhTwJ!OgUwA|9rrrEKILYg(3v9##4w~ ztk`q#U0q_osn+m3N6jrUyHcqC)c9V?48Tdu?uTA#qMO@dXEf}akI$!ST029k(-q{g zkGp^9%XNR{ZKK93beG)iBTjJBTHLX>zZW?eSm)|FQ|LUr`^weT53?>V!KIn&{UMAr zy`}L-2AeF*anIphyx_@ES_Ij=7KRqqpJ$zDbSMlV zUv?!-5?ko`3T7s^)(#m{OVxTx(OiMCztT^Y_HG_(BWH;xM)hxxB@-lVSEvqZ_I}$M zdc6gjG|HY4)dl)a_@@^VoUoeVJ4l?7_*S5-%=hs;KcQ#ch_M*@`lvLNl$$)4?H&$| zB5!h>t!S0tif0EEMG@fMJ^9OPn$yQ>t0ik6CtHoZSL!-ZN>zUBvMTe7k(Ok9L7`XK z!}ymgTZg`QPC`x*w*B$6wcj~urU>D0q~dsVcKq}zi*HJr$t9vaGC4xd$p+U?mWy6=6SH|KG|bib4W!|TNl%I`u_E{fAqpT zbqGcjo$=y37xu?q;R^5>JSypnvsmm@2fXTMr@~VqaN7G z0k41V7WGhJvn5WY4BH$eJg%uBt7-FhrQIr~*lQ4fGul7imYPGL67rYsJfu1Ne6{Kq zU%=bPN-VmOjzplTKBqZ*;A%0ZIEIja{QNJD;3=q73L+4NfK=L_17IDehlf|juU7ZB zWhnl9X(m761_bY%f{lcmt{aRgv)#6~N!Sm^K0o)^zt6OuQXZ}MVSN1bDQm9AMo~#A z$}%O)!xJDf*E?*X@NlbLN_9m3y5zm{^fVj}zl49W!n5v(b;k*$YD3@oE<>E}rm7zZlOy z+Dk62cag+nWNK=|8Ww2kysB#6aUTxb$+QN-!I1{C7A&FN9DlKaf15-cx%_MmGV-8$ z>IIa{7lBw)b^20$5gFl?6wKwvr*+(}@r85PWF&=UUFuzNKilFzooPjSirvjlEvVHz zJg*}nLgM2{w?{7iQYdq7Wy**~Hw;IzDYz?~i=3~eU$;i_O7_&ZXxg?QFhBjxxZeq5leNB&FQiQvEc53`F1V6Q7llY0g%w`S^M~mhj-e-Fziz>*^-u^Ql1vPy}jf3YKEb~+qF>7 z*{TP>vHU0|ap=?Qh^*^ckL8C9O!S-Zy?ykQl9lS@Uy3Gb722GP!U-kZUWUip1Vaf zYt?#uawg(`>6EXW9;-{sFqV-bHdgng0F#I)m0U>TYGatjpCe{-jWuTkR-rSa$HN>X zo7^DDcR`T0NT3;B5L^*cy>;|z*5P}tbCGPjIKd^6-g~xF4A&0*sIQDtO8=D}^9o zz|Cg9xgf}VenBhiLqHe5{tBAo-Wk~J`sEabI*iSqz4Z43y#grW!m^3@uG*jHV`1pK zuo@g_C7P1+|BJJ?4vKSI)`xcpPLLo&a0#x#9fAdS2=4Cg7J>vPL4&)yy99TF4({%Q zJHI#k+_UdJcW2-F>Z_VRrY4!1m$iEJ>VEp^r^Dzwq_r!e4FZ3fJdZ0)HQ5u;j|_~5 zShPN%&mnx1ariOer6pFHK>PIz+K^p=QYoqRVq>~&S}UDZBp3|Ac1;!fTevRKWE}W-lkz!`7pC^^nxjiuYN!DlzgWLHS9p+eoW?`6i zk+%|$3Z>@}Ngk#Au)8x!O4ar!(ImEFX%V9WV9Unb%kPP~px{smr5SL{f4?B7o$$(~ z8f-Gw!fG)TR#d+WwhAfHK!k!j4BENhXVsd#jzFo6Xk@hdVJy?M@k|Bp*x4hWc-)4G zBN-o%ZWI_&;rjqfaXAh}_Id};zpOKrXRl2kc|Xx?h@@X?LJ6bYEU5K7>MfSjpYQJf z$2g$p$te4G!~CyLI%W`ni1&ac{5R2w8nWL#s*w3*yf*BkJ_!<%=AxGNtM%K@OU!#q zymLrl9LsZjlPO~j8UFsQnB#By9FvcdrnB+tPbTs@9=jhS!$Y%-59*bU5@;3K-oE~7 z@2+L44Q1|qMtgwX)&F;^0G_BM6*&7d{KC6Le?R*pXm(Cc8CqN|xma&pT9v8Vi2zR* zulCLmUrSr7KxKm))+Rmt{IoXrmh;5YI!V!ni1F^^Cjz(KA!|=}_rx86XQ6s4Zb}N- zCI&;+tjCDDzOm_2-7^&fL!=7Tsm2$p@C`oikzA)wJ&ppS40--{KZc<#wOrvj~ zV<}Bhk{XR7Fk!UYe2_YE9V^gK|KY;YQ-Y4>M>kdK>eBnoBX)SeSM*?8A~+YTl3nK? z=g-)#2;0-GOHjC(UK68oa3pq(1_Y)Wg_0ut<3VDk2d+%!-=`#X(!}iS@#}#qI4pYv5!)CngEoGtB0BP3J8$<-;Y|&y449z@yXZyVV0;)Zz(BjjxiwtJ+ z(C-Dv3co+9fCtm_gx0Ix`ya!g_a@|D zkAQK=1KbMj_K!{Yn$txpEF*6ip|#_@>9=*?O19M`|1^A29%(Eb1W#nrEYeUX{}n74JXyoN_b%?}O^HZ6Lajo94W9P{Oi z*awv;kKg!SVkxvw6%QUf(l)+Gxk6 zmy=rsY$fhCe6;G8#Fb~n{7^|8%ZM5 z_42|G3<^@PvMLeOXozbnWZorX_{~mrg#NlAdt&^{{>d7FBt?^&2qtDI?7)hByv9}N zoGXh+F|NY2+UtBB_H+DyK5?7I@$SF10RFU5=~m zJflP2bNuGH|6J25c0Zvx?E=p^-q=a34|&yBsh`IGZZK*XFCG||l1yHD{{{j5^9c7l zKx+{k7Km}_7O8efMYh_!u+{M0YxClZ3>k9ZeW&-EGgUzWMW9sbd&k!2IKB zdj$wR?0v9R8J23)CO}@l#7?=Y>sOLft4Q?TXV*puo1)yn|IL>t0y`2HXm=g@8Je(M zK9d>}PLzHD8@2kR!Swh1h}oc0aE-`3bu@lgE2hU=SP2N z06@+=31SM0AO;xicynN~RIb$=^Y)KLO#mP2_lG;HPM_@SGtxyvfEsx1c5%bh*wkP& z%a^3JuosuthUAV9gM=wwZo%Tsr=XyK$ymprt(C&Eq?QK8y(9ert=%Rqmz7vrs z<0!@=PBNXD;kOWW6KgBIHzhKFo$=TeYi3WGun7esbG+eDCLTn? z_R@Xx$AO{L=I3=sPA5;^j-o)gq#o4KlR;dhQ~!d^VmVq!xQp3pF+B=jv=)~&4`{PA zR>LcpbwQw0YY8~Rrk7B$n8`d14wmMTztq0D`tp*Rot=F$Qg{UdaAL>D4g2=ibBVoc z=FWl9;{6Y%W9bR*vZ?&SK2JT=w%^vfosH{GTV{S@_XNUNA2quqw68>_^P1apFy8}9 zC~s6_4kcDLmZMt__p|OiW+c=?`i0&Ll!Ub^t1XIR=;Ru;7!?ZCjei0b`n8}#-J2&e z7f`o~y$7_WN`g@v5op=BJKvIYt9x9PVQ$zF>bi6a09oASP(G^H$k?V~6_ zPr}R`8Wiymoi~z_n$zIBCRF3I#r#r=6S5AuCLdCrz&mM6CupwO&g>GF4r#*Ir{{q;f+_*&>v^vA569 zho<6PF((@uIB@|!1>)i(5#;)`Ep?%Pe7pruZgl13=z90(w`^sW4A@eQmQTQZ)x4sZ z&tL=5Ff(xC+NOJHCSz!zHam}lt82^%B}aYlGbmxsLx_)0K~Gf!XUGQ2NM+>r(qu7v4xZ#G+wC zFri$&dgds2$*REaxHHg5lr1Gnl;a+iP*K$G*XH>-kyjYqBGRb0p^tp$t~nyQ<>bg7K+uqHnx6$;rDgE&d8Z}4nfsqU(m1b~1Jm7hUS~SL}e#VqY z>disw)76!;P5X{BT-)D%1>PCPM}P>55XL^%F`PovJQjOl`pvTqx(y@Qqx? zTu(&XS07D~ylH` z175X+%WAeJ@Ye__XZxpN^Qi(s?|Fu9!PKV9SV&7@y|P-t-cojQ%SX9yo(;{Dzlz6q z&Iez!{j=?moIf?SF3S}koD4iGP7lUy!lr{l{zR(8;h;3@Pcl|LucMt+6HrEGy|8L6 zVbR*rN}}GskFbd4F_m>sFJGxi{3Wqn7n59X6Jwqtkm2F%t^*A4(V(US=a8rH`1)NP zF32q}FL!^|hdv-Vr8~Fa%YH9cMf##n+3}*c*NNy3D1!9Q=~J;W^6@Vn)Wsv}SN3X{ zKt28r9{JOID?$%$Ipq5=ZsmURn%k39Ba65_VUC!^A&a6bf?PXfetOVBo6doh>ABJk z)(EJst*@u_CNa0Yv5g-|OK;e_8c}^)Sm;)@^y7!0&g=CgMuBJPgYFj5u#nOPJ3G6I z1i6lM-kPW;r^EMc?q^@4*MD{wz|DdVJQ`X6z60` zsN(lN2%~>*L)coQKK5uhi6;v1kgRhQ&5kL2wr$b}Gqu%dU2ciP2}$CYw`Ui2UpU#> zR=;9HzwaRPdkZ$rE6&B;_%K^L1zdFD+1A^*AWJI~8YZ+~f3KT8v_XIxKPd>{$8fwf z!-1{>y`XHi+C+4Bn@MsC2mRNLY4!b6SS!IaW@l1W6N*ktkiaNPsS^%_`8ro&l) zR>F7;<@l6F!@Qk?WDQhzvJoD;Eoh5&II!+-k78aB1nT6H3fkSgk<>*DmKHS2CFR%jNOAf zD^{6yyP#u0$MNa7Ats|%n_Gy?Eim|0LQ45=tXyM*Fd#^AQdI}IkL;4zT=})zJmR=( zZN+48*q^?kOM?&vw$PMPU&u))MW7(q+VTId?l55d?>7&MMM~TolvftU-vP+@jkRY|6{qf7+$?i?$>*g zGtbbzaUpo>VwKXYqBt?B6LNnckWNKd4_5Jv{Li?d&7&qB) z`SxWtxI0NHdw!^D#ME8snxkAW5D6QfJ2tZF$^ zme79C*=^fAN-(d~cV!&|A97ReC0_!z!V)hQcblA~dP&gPu1WdK zBXiHN3UM|A_geYVYx}?AjzmJM`1IaLnyOTQrT25nSiJFVh}?jHsW-%T&J-J)UsG

zQAS5N?X?0T%-Z18*}S~G(U6|_?cHrn@c5|UZ)tW<8kdPMMOS^O{YQ1p3yupw$Uen^bx;McOwV| zSA4_wPLx))RPu9&0WdsJ=#K{ZP?WdbNtJ;11U+i{X%d^mZ2kpAjOb1Gd5}Y&4d1U2 z2^O+=t*{cA3k-Tt`h=EkN5qfID$>-efYTU`+Z8+(WFZu*ls_ilJX(&kxy5{_XgYjz zV%}907b|C_<+$n$C~v%G1xRr2rM?@N4T4Ke^ByH~EUu#)=F^o*(I?2GW0uc@qUW`@ z8+Cm?&u_h-&&y$_A+E!^F%*-(_+3D(Vrjn5U#M6}8b_n9c(yI_6iKZ{+>R++CGYTD zcC@*3P#m{`QD?>MHoH@$Yui39hiIwn?X`llqDn`xJ5wx&9;B53;Z$^Fw0D>4I^uCH zXtrZA^Rl(Ojaz>zQf+oA+U}ijDJ3UD5}CSwhm@kWYm6TY-`j3SLZe$(5t?dKm=%(oXqM z_s4Nx-eoZfR@mKGu9P<{`+4 zfdvr6T<2GjlRO{17K9@qeAol8sJwRHgj9-K^v3$WDxuDEL1r$%#3t5z;m0S4LB&il z_&J5z6f&j|gm^!d1yDf928ONeG?7D5<)Y)~-k#1%nWPI|5d9|a{8s{RmGXz}dfoBQ zIXy?Gj{6hI1Tl+UB5&q^D*{gOE0?QHgHEW=gZTo-=rb_kqHHa%?*Dn&E&B20DUb$YjA&ASrFkLQys%wMUJ8r|3Ojm*<{g;y2u>dgk`N>pLBJ+C`sgd(^kTw z1`pk+y)_!~w*F|g5JAz+-+MYbu<8{O17`(WQhN_Y4Pr|#HHWLDau+EM$ftsq6UB-; z@MV~#n)3PFs$h-n4!g!X&!9RJfDTTe-QXs%y-~lrYqo#op=-U7q&-0}TiccK3d!_% zsa?*dQwY4vDE4z~B`PNQL5ts)U*K*dfyn%!UUx{wCem<-x)zV^+h;T#&3xIrFqGqE z34sWrp#i7IUV2>C3l@M*5eK%46ArOhJ_LWME7O%}4*2w`FFyX=(~fSA< zy7JBEQaqe5fC!cOqerW$YhuYhOWR2#0tA zO>Rk_DOD@-j(4|)Z}L)CiOI{>@Sp8`9cH0M)|LLKFUw&4+wf@fKLKWe9Wk#kuK7g}AEs%b0_hor1u%U*jmnTMzK!eV^gq!Q+ z!qc9D^4x-;drzYi2J6!Gmaeup)TMtEI&9w*xg$4uiH2I-H0$;CI@fr2X;|~EJ=rW) ziK>uC6#};s;sz8n9dX6Z86A>CZc5JrIh=DTvlyaj)5kkeUbOX;oS(~17PJyQjGUbp z7Ehmf0=NGYL;KGI^#1kg2ugI2ZRAsve)dZDAIVxW znzhqu+&XP`X->9iv}q~ZGWtGux0A1R`yC#7lNnf^9=|{psm9p1eB<;TH*m0X`YNXx zh4bt$xNMx&R%I+Hg@nYiGn@@1LKb_4d?6t+HBfjY?2+N6L#Ny2^Er}*HXxE#$ml&T zoPi%)9}?E6w9m;f{t1cz)8Ukxb#)&~=T&bmp6@f_0 zuU2TZXq?e)G-i!o!GU1U?s%Pk67Mh9hJ`EHTHX4+46|V`*QQ^z-1-Iv=)6e9nzw~g zQOgs|J&j1%-FZF|^S-AU(zY`?S_Qza6H^l)P`^<}AB*F_-nY|3)PADAnYbnrZ+T6GXpwZJYRz1*4D zZEk)VzT9jGU(VUiK%C~X7|^@RQt>@!V$$K_>MTpw_YLDx^WMpjsH3UUZPB!G9Cm;x z<8x==q@s5;^Br4gsTE{L*n9bgV+n=C;2hJ2jjKeXB^a08SEY*Ahje@^9zeq{u`G$3 zo0Xu1M#tK3Z_bC-$y~C*S`8mII@SkJ;gI8ZhF#8dF>>x%BUjl<+bY<5(+M^@+7o9O zbh8lX@2~c$!E0@{t+YEpKWLb;dT<;)GTm2vmVGJfQuTHRE;h@hkBA4eTlmfL8_v7x zU}C9ze=qffU(h8LO=`)sQz^5GdctP`Uf32HT5VQdpT`8Y&tDz||pVu1(4qZMzUbbSCl(ET4rQYg-pssl9 z1-7skUaejbFB#=7@ba=wHy&xrKxeY?!&EI|b^bH0D4W*^UP-H`Q+EB`waS1*Bwaky z<%DLbe4q}E?x^0&k3E_Wn-MvArStui^(sEg((A}p&}jYp(2IPFTX#RR<$Pt_dZD7H ztfDnKzjB1Gc%RG2C}$4>W2SYgKiUBkdT>hXwV2ndNdRU-+}?C+GVc}})$X7%Rw;p} zvv0)yR8gTeUOJ#VArj23!xp^#RB0zl1dI|348V7zH*}S|lP}N{9N8a@?08SjK9zsY zrP(qL2cl%qY?S;E@#s-QQKaBL3q&%)oE74NM6xN|)QgLY<6^mz%7*gtS`|YCPYmO5 zt>UKDH~gy|R^JQx0eoyS;|0-RL29#$l&jaB6F(7~LxZ0b_LI);L}lx6Z~XWyc@(0@ z5XDK`oWMXzv6mOGFC=SQXor!6_-B}fGXG`jRmpX9(b!G@y1%;+akro7YY&Bp!Q#7& zGV4pVCS{4EH0>&{K#I>>W2num>mBK(oq>pXxPE|D(*#FK+-UK=iuy^%Q&>|&cn*IZ z{m?ARShUvUfQYSZVckFm1pKcX+BAgT=b;`gP^cxYan|u?ivYXS-l}6h`$=w3)~D@H|YPr%Ll#CW&Gh;pVK5pjPZ6@T)kP=LmJ7F zBcdXt>|STV-qhMDbd*IXHvo+wbrNOkbX@!)vPJ_oxj+hREWt$G##H-Sw_TRNAdIVb zEo(MKafT#(ayGXM&s&!xn4co;r%63kFP;u;qO{g&kfOgy5ZUDYMZAV2IlSpGk?1yhg$XO4+dpm3=|_Y7lauPJc74wW&BxKr2DPA6&;<_1M`}k zInL*u&?Sz_Vr&6j-Ndrx@1lSv&8zNjG!gWk(hrZS)K2D)7D#ij*L?E92E9>_A8h6i zIL_2Df6RQ~JmovvC~qHvaB*=J((LU*HqLlI_aHL`tw_-6oG~h^4He54DVLFPY&6Q& zon=GwdGU9YrAw3-6ez>2;)G3JBNsVRO+N(yqo zeDB_NnI-sD1~8(TTw>ev15uhY@&q{05$&DW>c?3LM+s1$>flN&&DKfbmafl(wFeqb z7T{EJ#FBfR+jcGCEp;wlWqAJr(SGytqZ8H}fBszf32lazKH9$}h3V<(f zVuI4mflzLlrA<#+b9l&H*t_JuNAlk+~*IemQU0qR_Ef;y6klNl^R`mwqjSh1%Wj= z^hJdNfu_bRS$gh|C8yC9c`;O-3V~HfwC0BlVcN^XSjVrLo%hIKV39zKaq4%WS99E7 z$VoChkj?i<8(RQVyC?}i*ghff*0Yz(WK}a52kRs4Seb_aEj|mrs~JvwHKr#%K({D$ zD?s$>vpgoOs`0WoPv!Rh(A2fT)Y9K^jTv?mE*z47JbEF7Q}^j|=AH;wZIgu|zx|^@ z3b#;;$v#IifB92NkJ26%Z-6K5#)@O!zRwI>zjA8u%NK?K&wPb7lDWY~=MID0!JB`{ z!)=6EM;qux$f(<*ERve{(SMcNSgqR3?u?EVLrlsZ7q7lS_q^gsfve9x7$4#hR`yS1 z3?p(VaKLnuZ`4v206`a4mBTg8CST7Gz6A!8VxI-uh>9;a2>3g&873c?cRo*!^50oXE@WwQ@9%>FTF36fiUM{ly03)f)y0xUeW2Cez-22 z%&$GJ@_d1HGvMA@5X4b5L#HWp*aQQxJUUokxOh%&)B+N!mb1oU8lRVOL+#yb=Pa#y z{5Uo#Wp8BE?3r49ARhXI$nrJ8awn&Lc7YRBqUU5~smeTQX@n9pEO92sH#_A518f6o zB|mP}t#VweC)(v~EiNq_4ODsPiq_s)9(!rD>tk3iRm7j|4AGX3Tdh=#zK^A13FTPM z`G~h?MZRmg1{<_=CzHw~RZYWgwW(So)NriMZCmFTR%oG8{Ih^DD2AHDTT1{uvH^y3 zIX7jf2*d`>Jk*<(qlxJxFd*#kI~PyoZ53~al82z8qH=J}kl~1mSRCh)c4~;9PD@D? zt+`KV9nco0PGbiWd!Swbw-K$V#1-0zNwsL25d*q!x4fni{{JT%G^DaJBF4o80DdK%v zPs3=ocd8mDyY9^1;rZQ^ywL+eWWV!Ie>yEUedw!2`0TEFBE`qg%gPL@S@J^8R8*|d zWkI5fR-k7kY}<=iT1}0nhgIaR@^*avZ_`jc4K{&e#>Y_+j5a&m_yP{fas)LVwQzP;4;|(!FPMv zbgESRqQ(6D=~Gng9gvJ=-?HQ@IDlAchB;sO(S7(Nz;oWcq{O$(>E18pNCn_MJv+K4$j1xD#+J7A8@_3ydu4KK-(xO%C5bZ3Q{?s!1h=d)_ za57QdI?*|uMvd*UJ%2h9^JN)p#sr9SMJG*1GUdd=V}(8eN||QI=dt1gS_F4D6Xa48 zt}EerBt)ngH+9RU}sSjVWu=G|p6iM}6DXLX_ zjuCQ|)1|C;*sO9sy2G^oA?jN;&w=H7;F4uo-Z6sLeNxO!)2wwes@qVYtvQ4cmWRsg ze9H>C*3IeASgDsvU_4;lYSbY5i11=*;qgA{(K{h$6)95ugl!iF6>h{71SJQi$A)9{ zXuTUGTTd#Bqx@EHsn3-J_f6I8X|0}lsDGk0eVgcu#C4uL$v;+HKYdDjA1gm%1&^4i zo^PXcnjJ7Q?-`YCK6WX;c88FKYqCYW7~|$a7OduGXgiCon^;3}+U~d`{%qu+<%QqV z``tA)*Oj_6+2D|-+pRj8jV&L=BhyX_bY2{4x}bu%pd_R z$6u@xiuHyN4BMX-ic3|m!K_kHcpSEwET&@vtRUp!bT)!4+z3qB_Z?r~i?{{UptJdI zzcQcpSJJFG5C`f+>;Ot)bHHI8|M9~`2wmjuR+PYng2ZS7owh94mdv@a!u^1qdUp*9 zOSg!4s8zYGh4*Z}&goXt-DZCz1qMsWeGaDUQmqbeOJ7DbdC8gJjr zpgh}y6h_MRz+@j?mp1^vr0L+yjima~HblnW1*T_BT@;CK3jg_tLwR0&O0nFsy6S8!^{t>!UNkLJTp|jj4EFAto(?h{Wx5)mgIm@NOuRh`>{^H z@lI3CgBfK|6z{rS?*|m@0HtgivwDo0waOyUUo)8WK+Vu|v7a3N3_8j9># zl9(u^C(Q;L?C>b>&e!4H8r_nuc$q0A;mw;6Y1#UWn$W=&2b3ttq3wcC{LWik?IQwH zF%9A5Kfqmf5tTXNwL5+lz4NB?u}qW<;h# zGTB#9wI4eIl)q&Bdn4vN(-?X)n2;#a&b{8;bEoSMy=8rj76p~-sB0Vy+Fuzr1g7$* z@~I$V#Z&PTg|a#Slg^|@^a3=k<@U8gf1oUjw7Mw~cL@{Hy9s1s7EECY^!bu(7U-G` zdQ2mA1Uw-ebT9YWvL-w4J|P0U`ka+dI1h6>HG=R8ZTApUbNjsbiZ>a)XFmNqZwn0T z({wJy88&K%8z(IN|6zAK)@Q4oBdbh03_NSi4_i~3@{t6V9f zi)UwX$3CBZP1uB&Wj}|IyU; zj9L%~M8Q!`t5R%E+_dJrJ3iSi2GJPy?b>Yjt40gx;Ra?}M?0T3J>Di{@0RIhcaCV* z=U#pXMD-=4aPS587b;oR;ju3}(|{tV!m7=AypOVXuNX)W!rdTPl781dbOI8RBo|lq zwN(&8D9e`VW2kWi+Z@?40sJHbLm%w8a>dk0_}9i3!b{w>uR<#_GHvL)IQ?HWA-VA6 zh=~3wu!PdZeTqFnbs@O9Y=A`Tepr&?je5D_3*3XEh)X&rmc*PJt*C9TD(y~73HiLf z4+P3>7Hltn;50K0f2${U-W%6kW-P+@eRg;dOMk^gouzWCv&obnh010*KbwI>=V6TG zyhjilNLLq`eN}n9g8FUb=5{-iCJw!u*FVTBuhfvPdt+?e)>l?~g21>Z2wVsg7H^i$ z2ZDD+Z}%%<>hA5a5Hcsk4m0PhxJ>0(cGs=m%|G#c^l)Z`(R+Ya)h3DE zgv=VWf@r49S6gs65NNuA^c>)*Kln2Ybi- z6?W+8=FwqKhY{E^4M|_*`+ze{IuS!q8HK9r^=8#uWKr1R)prrZ1m8_wkA^ z-yALH`&MljS4tXJuGIi_w!|n7NYj;PA=g4n^|&4+x!;ydSs#*BMVTjNa7-PAUwPvQ6@&`+Og@VmTvuEgFNogv-U4+AWKTv4e63EDTqF}jPR)5Ty`iidjl?S4kk@-J}U_FBHq z1t1PtbJ)&{u%)hl;}S){W*(G$RX?<$=%>9CN1v*v(6_J<_H=V(Dzo{+rqitq7z;$+ zLt7NiWl4W`|9(qFtWLal{mrHKxNwT2=Kzcf(fOmtCbp1~yE0x0@p+=B_N93~T_@t|8CwjBU3TIpI>~GBVWK9}Tu;F8idbK#wJs zUq8ME0*_ZO+7Gt?`lvZep$O3Y9I%!2u@h^G#=*W{)@P0u(OxEt^Q8Y$-D&djqg1RVQ-0x^m1#R&ot1JA)Fd$zFg=3iHQMLZ5Fc zb$5nw*BRhhid09@`Ou40@jOHWp(neN!Blro1c(C8-w6-rqW7siF5ZRnpDc!caI%&f zqL2}CtL3%G;isU_7^d^$)Dz~zv%h4Sog+6( zOzpv_j)#4U0%uwyTr0)8P0-51SNx*L{PikHcyHV!hP<2SH64nWMWb)3Gh5u9O*?}` z6T!D3Q$p11BLx&uC$t)Ni`QjZiQ4gmfw?`?VnZVkpH>VyiZ^7ut*7Ugx!OXz&(py< zc%M^p^N$fOvP2*DZv0vugwM_G-B(Az?ksueVLHm<2P>a~kZ%K?9xf?WB3w5Ats;`& z0|@~%Kz`IVB2k)(IZ6b>y-23)INszu-RY3snTZGlN$re{_l|*#XR8p(IkMZ|$flzb zl;l!>8?qI`tTsEQ!?8U~67?p0zIB9>Nq?vxc08NHk$FE+=1e<}-H;lJMV~c2L`fIV zpI71_xl>{$)_V!jZ!_O3<5Ta;*~`_3nJ&{qBt%G-nw>KFTRqH-Z^)WWJC*jWj*Pa}Vb1gg85C{V(qpsD=YH?8mGLYmo!)HD?7vk8B)0ml>DjtQlRkb8*c0P_^Z{IPpB)Lo30Faz%QGV1G+c< zUb6n*Z^kg^Yn+Q&k&+jQUZyL#O0xqcG+qLDDWB4ih30Xix$w~8ZLdUpFKmV3QbNq< zZbsoG1nlF@S^N@vJ4VgKMMd*Qle^h+v#u1JPJ;-d2<;kn^)QNNRmOY){(ChI0i0$x zwk>M;;F*ymNikRJ>>}i3#SMla-{E)1>5xm`gO3x#mDz>oV(Ic-k>xm)0tpALcr!n3 z)4kru;k5|)`#kap&ur{4qp?IRHsOn;*I0me*VKbmB=4;10Zf*OR3t9Pul2#A#hm+h8t9#E^-Fg@8V%yR2@#1 zy-7SOV$zN4w4xQ|kL=sRHFOpCU*?~4ds5z%&1$;+OKK%o&pV-Xg!gq>omTe>gLLV@ z9a}uufaphbspK0tn|mMeV6FS_FC01I#u`!@Ep4s^%?j|5$_wZCs`210q~nm8(CE3Jo@%<9NN7cHs9Sp#sCT7({hEA&kaw+%P{T>KkYAb3v-l-sE&}kD)plj zaLnl`JhcN8+liMg^a^sk+Uy{v=CUMp!F>vt15}!;f|;VovzJ(QY9dS#uAs89h){GdT`SlQx;K!q{K{4#NHigkisIX!E}BM(wST7MO6;uVPXT_xG(xL_)@6 z%@7K#s{1;KpNx(5OvarQ&!9_^92FE7Xqpt{x_l`2AS6!UceBfjd7pvX(?@2j!RA~` zvAOL`O?Q~NoiN=H`Q39}fT<932Ab8DK9CI%$@!VfLRsh)q0u`%Xj!LGV+`SS*U9tv zV+->$63U3@RUD)Hx50Xh=9knLPkf=3uSra3zSvIB4Yg_c-vs`hi)kH^Nt}5Kfy8v&VwlB5e1mgx_dR4yBD-%;ASv##cpGNs z)9vhJw8>xbVv8D-6+IbwJ>RxRzX7IkV~-Z$#*L}@SVNg<s}U)mEU&ajgM&}YfeH~^E5m`TT> z(G~;}b^7TnT$@k-)_~ccWJ*Mz7U@|~P-CZTiW!MJ>lVm6gvj-CX{JmoR){Efr3yIT z0W`sn>|s_xQ%{A7D(tr*e?av@6Mkh8MVhR|0j>97prNMoUnc9}uxKZ(Q<4(#c}UwE z5ai~^*R*C6;Z6}yrfo}DpE7F4BVy7Df*De>TRUs48~52{_#@tU9nqvNx2t|!DKJzW znXx?O1*pn{;k+=s6n2HXof6mQfM!`d?AYUvHQN{Qh`GH5=Pf2dS5GIe5Q>St?GV zP(ao!UaPZW(t{fTnNAOXN9no$d26+dP}nI6k?@ffvtm!kkf*^TGKhmp4h|L@&?sVJ znQ{tQzFZ+R|M-1Gd!|rDiNCVObj7EMY|&Ds=mtHGT7^b}2LPb*9CyZ)ZmWy~8GkxR zOsHFRnxN(bsKJ8kajdVG;QlHE{bcC)>44n|6YmJ6v))8%@1+Ycma8)y!iReX`GZEIJAKA>kxWLH-EvXwdvRp8 z0EKLpA*C$ZeJLGK(!V;Ij*-M3EA(3|7o}mp;5*YB~K1jo+ZzOzt%= zrv1T;ZO-@EH%*Q_KQ30MaHbAPlJTNdkE@2{nZDtM27 zHKy3u3)mAlA529bh9adGPZxbu5UqK;qfRXyA_l*bx6iM1tsUsFCEYY-a6Snn(K$yv zP`SRwS4Zk~(l{0iMdVlz#*%4kYsxRwlrVkGYMS+m$EaaWi^$cj4z}(3BDiHKfepE` z#V)KT;FG=8_=u^k>>rznZwuYmHaww>j}8?Jl()Jm<;L*2-@BHxl-1ZN`i(=B&qw6Rcu)aoVhYxN zlZw@5*6MgWAys=&WKp}3YN@&#PIVGTi>gwhEf=;E^L2H>iOvpAo7X;;wEGSda{A&n zfk6y;-j#esXw1cyAJJF*OPw`(+c-hNhe_4F#qq8hk2?WOTIotpM3#mZ^z-t$+?QLp z?k6)c^Q{&*+Wej$u1I{ptxwfx+75JNbgi!|h;XLPwTp!&2z@@0&uO@NEtfT8v!rm! zegZl_dzPJiim=@49LU~0-lGo;Brk4}W(y=I<%oiAUtf&(kI8o98ovzNF`J(9rBeQG z7Lm_MqrPWsF;$4?zQyWADh1)#E=~t~J@uF^RKYmuoqISqpJPfN7Ahnho6s+vayz=+ zo6IvVUWkU&ru3<4sPz=Clqp4DHIDK2!NDA4C{a?eQ^eosY~7d46kGRq-S3?sjt2h^ zx2qoeUPES}TJxaMap$`eqho0ERjsLd=l;Ms5=DbVxBR5{$JS_~QjLA6&(kAn>EeRzMNC$j{@eDf zj3HICZc|}%U_#@W))1NOQxa=pJY$L&&;n|}iqFEVhannLKro_U&3{S{x1uc`vFC0JJPOs4ti#t`C zOjBLLoA!}_hddFfEFqAN7JCF7z#Si{eYux`_T0juho(}f{7o{Bj`{>ac8L4|_W5Ly zYrfT#5sUF-z|%sVXflt=)!=mT#T}mQ&`{&#bKG^}QyZ-=gTlKXi6A;1(jBchIbMbs zXWvuV2~SEU)X|cN_dOoSxfMZ6%&9yc!9}cQRzG{*tQlC}PrxuUWQfv|e3p2yuks%7 zny>U?x_raD_+Bl0J=y6 zBwnFWp854?JOmv5zN~i5Z~EMDxvbk#EaToZSQPfE_Y`LP&Yi&;Dnb53Ktb(Ku{2CF z!c_@sJN{o}!~gvfr}dj?vo83s_I}>eT|uK*yiO~kGc|ajV*0BeKc^Lz`ZgXIa)S@> zhMf`J#y=&T#}o^9(swYZk0Sa-)CORa6zQ+Q!huwFMcEc+%EzJcfJ!cNRG6FMu(CMy zV=5|~BuO83SI`8|{AYGPuQFBP^EnU>1b$#9QGoBdv|XrF!kDfQHw4(hHL6x0tHp!5 zN*d4iPNgn`GiB=INyf(0<>X9y8F$1 zqP~bs$O?rGZoTD_WN?sA)=8gNwz|B;(d-N&EvKaNxk)>Jjq{_$Jb8)7!@DcZ()2`u40!x zxLtP`wa{mx7>Y^f?SZD$vlJNZ+Q3{gln2|j-6D=;NiyZw_DK*9dm#?mTq zY^wh)kJtHrQ)&Nti(>)?D`8}BN6gmyk)W0TkhX}bq}5LEfChh&w;E5aKlU)#gK)BJ7MGcy^n>URy`59Hru2fA}K4kSxh`9P} zr5$;D31643oG#BmL8k8-w%-Nr`L=w9;re=JOG*R#`!y<2Yvz(LUFZ7MrLhme1tH(7 zM#iCv|Hs%j#>cs?d#|=}8mqBwPuwJpZ6}SbiQU*}Y}-1RZsV!bpuN%Z(*?f`RWT4Pb& zPIl}?&a{P0!f?W%lqoF8jbuA=xVib>D6Ji+(p&&=rCQ=Gk*Tk%%QGC1lMipiH&Vdl zu+pq!S>vM1{@gTqqra=#%G06Dvd(@Ouh762KTz$+So zL;o~gqob92|HPQ;6lbp&or~A~(hoM3%N zbH~Em8sU;8GnShQysPeF{o)VmOr?XXY4x4{}V z8EWt;U)wf~2R1eMG<}Q}?=G&9FH0>sQ8A>Jlc$O}2{8G&KfGhWy1q)nCH} zEV%Gm%N;K{jn3P&iV>w8R=GN5t@ndhcVnwNnr$8Y_|y>m%=PB$R^08@tb7F5@=`NN ztS*&=giRxxnR1%!u}jh6PvROsxkw-~JZs)mJfxsYYyJ_F6pV~!G;x}8JTf+?;>4vB)#9)dKQH`S{rYGmYeKG-ZkSs8F5h$? zOc>Oc$gdPkpxejhrs~SV*Gg@1J8F~`pw)(=PEsJ{$IT73PzLD=xpw(N;s_e#EdU~3 zfdRh7{eTxQ5Q#YWpEzww22;WO)sqLmtr1+cRUZ3)G`Dd|#3@hDDq$VU=M>P>E9N(k zynffouLkQO&{h8=fe)vnS1neMjBFKLdDd!F8Ls8eR36;CpOy z8PD%HYbOl%2CR83;Ipj8y?X9V%DW#kA`O*;hoBa+@W#d}x%3^`!SEa=HeervoZft+ z7vw{*FHrLAQOVL^vB-1BkcP4ZnVjnCmV_85j) zzsihqnA>%^p<`YW)N*&+vMDu z7kg6WJn!o|NjfSeCcti=A_4B|%KV5?Y6sMdYeNi;#+*T;Hj~(gr=~5?R5-)(qdxzj zS8VO^ma?N*)aiKF9ND9mN2<`S#UiX1loDSYv~qk_E_*mBbU3 zAeYkr`50Z5`t~~{?S_rd zExAm7x5jY{yUi`07fSeD%b7kJ!iG*Ms-7jgZoJD*U%id~pC)sQT+GofgdA$nl(wfqLlh3Q~I zZ}E{t`nb3GCJZ0e`5PJxVsU}TeNxRD1IUx*2C2rrlfM2iLYYwhX2!q6Kvf6)(Ka#~ z>YapVMbF8=WSw*b#Kjj>?s4FJu3w24!WC#FDdXVx-^K2Xj;nAi10t(o??3yT#>#RHjjgIUir zn%@`RE)boLmPL4WGs?^9P8O9vbsL0(goDlY#!jR^aW-l;=H=yK(nw~|QPIT zUPJ0N+negvXx0jTVA@z3EQnMIbtwgS*JM%ubm28d?_kuzoN8Dhu>~}mk%{yac z;LpqrR^ek?$a-2>u|)|_!^6indz_^$2nihMbXswCziLq1zr5Ir&^Ex~xwFwBrD}Ib z_J#pwJ()BSBSJfEZc`u5to-7wy=ayP(9zyG5hh^hi(~stA zUn>{aOGVYE3v;NcD_kP+aV&;@@nlJ8%&2;NuIEta_Z4I_+C;}*H*G_n{+Pz50>`&0 zix*eP!nMtM%dg6`0;0XkBU{v*ng};s zr+^QCO~NC8c8i1u+_w(HD)10HYl{@Cc+YVbm>Qw}kXCYY!(Ow0Iw@QNK>e@8{f~Eb z5V`M7CiD0W%}tM?>si5&I+}_wPlHAwV+weSpy06r5C|zQufl#iefhBA#^FR!T}jYM zVA1vntCDzYkBRD7xyKJ@-G=?@s~euN{LF|14$HEX+FnM}dhy&r0W)bCeSNe=k_e@t zsE(-ftuu|3L&Ow|v@;+ehTqM#`MV3g4UaP>KSX0=EhdsR!W&9*T9O!Jd+q0qgeh-T z=f){}8EAx*6=Tw%83A37gjbF;jiqDOD?KuA`%lFW6TC9sot-Q{8kr1sc2pR+@50aJ z?Dxi}lHRnaz+nqRCyQqiCakdpUliIu-r=+1-7Pbq+gRoke!MONm*pI0r))W2mDHWe z3lhD&nl`RoTyt4f9b*>O%eqU@>Mj0GTGnEeoOnVt5Eqynq+_oBMM>$>p*HWS7Y9Jm z8;40C!*aB$qO_JcY^pF=TxKGnkH9mZuOm(L7BgP&(u2blK;R!F|Jlr`OI2q}3H0rd zW-! zU~Zu}qZQH0D)n@Nk;h|Xc3aheUTw>`Df?{QEw5jHckk0YP)@*y-VqB+w{G9^;c&W$ zaqVe34Sl&oEYkWH#J`5sfjQW}Y1l^;Kf6CUr-K$Q@^{eFY7$WEqUH4^5XpBkll+nF z5KwaRR;eaCI0HQ*Nieq^duJWxoViIlIG9X*Xoz@d7P zoPBix{YJvWb494u=pS`FKUOSjuK=5HB*cuJVb$B!L*hAGPh0dUka3!GZ+Ev8mjC*J z{ba$##%0Z$RtH>HzO-AlpwHR0ZFoNMRp{15ag=M2Ln@$v^y7gHg_=oprTR4ylE<1? zQ7}1<8*47pSb9FfS>CUKyzI8G@b%9ND)rlKfu+T(97d;L#!%AY=2Mi`9xA-$BJ~02 z=`7Db7;(lPq}!uE7=%b*RGF%vtD%v?J3chVK71Ae&F7h3@HIw+HL)<0UzUVd8DNe1 zz9&#Dwm7?9($Ux)cTA(Q$j;cn6wMh?{|?>7R&Tj>6xn${jLV^nD_)%?u|LQSh)(>T zUIx}w&O8?{mQ{%zlV}=>I=Ke^NaBz zml0JlTCd9;6S7PgrBI zNg+7J-&6CWNVbRhUm{|Y5D@B2GYa4*@r(5>e?2ypYQ_Y{v1~BcP*r!?HKBPo1tr70 zE6PKVj^hdjlPU;KHBZ-}vSh3=(H6!QOPVg$+zbb8Q_%nYs+p5CH$7j%@}x;>duDhr zG(sASOsoI#O1&>$hED!3e-Ro!Xe8^)R|`w|iitqC7Uix=Ig-&B{)7~O$wf=Ep_nns z+vNE5Vf2rfIw_UpywUh=OtiWE0gVN36UkVPO2}|EMfK=RO$^Lkoe-Wf{4)HVKOD@S zOu`}vifgrA<{8N%z!IkBKs#VQD6VK|!Ph$NVC=~@NyX>s(ZOB-apnsku`w9+CH-+NWC6tnJp%FwqTdnuE%$i?BG*wJKRPbdx= zNKc;uK&Q>tJK}s=%S!b8AxX?GgqY?K2u9P=m-S}VJx za^AV!e(}=x&gWm?{+44rx{cZ|+`}LcBQe08h4;=S6TkA1^VTL_acW)q;bhowSwY;hyi7D`2*w-Qg-peO zQ;+{3vL>30N{gwAv{AZ6xrpnHHrQ|aq9C^VBMKS$U&Jvbnq#Q&t)^$nAjEot zK6!&CNK$=Xk3Ps~JM3D0TytE(XJ@b2se{@4{)0~h8#{$1T3EB=W&P>8%EyN;`s~LY z!{x7Oel6iO(xS=TMOU#SKvxmoH?`N`M$LjSUuoWXxD}?rAtmPJG ziG;Ofw?FM*_JCCr=@?MI|3paTJ_tiPCDYQ}Z=9g7$YHxeQNw7g!z z(!;*#T5Yn~ARbW6@+grHdDjoCM&cZ*Al>r)q`M@jhuL27gx%=0)|Y$zUjKTGQ`=VA zVmLoEHd4U^0orgN6cRDYIj>RYmT?3yVvZJ#D)-z$!n1a|pSW?mY&JXVo={<> zdEqY1)U35BbDU_lg}t)AnV&SXpTsBOu66^S=NmDkLVutE`tbO^*sj@ndl9nERC53` z9ymwyXMz#Ul!nJf^ZN*&<@=U!pt_u-W9%Xp?c1bia1*X#{jvT^J5b z2Fau~(DVc&q9D?_SPam$tDkRrKHfCVv7CY9kopUk+;p-+5^Qj+wPp+K*2gGVO;LKD zLPKVH%^5f6E4N46=$WIpd&-kFpKn1?1Y#W?BBAHP&W^u+5ifmgJK6uOLMr0SS?zxN zkQAbqK40}H()wY})aLn@fC}KQx@-h(;#uc5BR!r(__KZ5DrdMNoeb|pZnsdX!^lZ3 z+(h(V0jgfOu7bjH%j39CLys2uo z4QKjk`a!F008FC`Kt9xcGQ1<$^qAKsfCs9UKda0?+z#|P&ZHlW zMu}mXLE7SVnqRd@r;@Ll6n^;xVSa;;3Ga}YE}f8*eW=ycGQtyP$$MB@cF=aW9;;)o zUQk`E%kHeDt7~$rE%Q*yRK4x?XFuRs8A-(MP~n9;UqF9JVit)PBq1#dcN&w3*molL|V4 zL$TaA`0!->;GNg6QnoPpkuRxr7wi|xX`fN$c8>CRuyHoE)DyfPijB6DZf#}N;8trG zE!hY8Q15nN@UUrT^yp@vLfy1JSGoYhj%4*WL%zQN4u79?*~}2j4b_F8n-!Y@JnTVo zX_al{Yh!*FD_Zh}2VwC^YVty&3>Zn8EF2?GHy4gg?bVg}adDv6^P39}pl|a|Aubgq zr&ySvy7tvGE&P54ryixLg7-o6##Gz{uhTPo-mUgxIn zWo3wQPLu%oY8o28&z;~O4=xwB5+~rmW3eDi^tv@<_#9S6E4+1j?f0*I+{_{sE7PV? zC%aw{dldqYTUH~apQ~Tzu(FEcie$|hm^`~XS-wbn?e<&CqyQ8Qv(G%{BMz=N9VX<( z?I?u@Fx%_)O&{w^47AUNrrj0B+9_Wpk=9+1>_1T@9P-?yp3=@`F4qEf8(TPM+8-Fj zi&AsIjdCSXElxExxAGrVfV`|`f`Qw!LbVN7DMK(FoQ?yBjYxCeVRlUotTWHPyQID{ z=#c>Lc!VlAKRqiGQ4dcWjW0ekFxhX{+Bl&k2luG33#~~(1}){gIp$hTJ_|1iQJFE7cK81 z!gY@{ymY+CAeO^Y4fNFlT(9TRjs52orCQyDViUFpDD3&d*8Vbqs(v<&6NW9h)#**;&KqAq-Kn`7Dq4SWLH~PM=7932>LX0xeRcYlaQ4th>bOP zKweuLs~Eq~la`K^#jIo)-)7jgOr^`fz01h_PTb9jAr1we@7-+LEHeiC4x{VKxH3cu zS#6!}+K?49({IGIq%}@y4}=ki6KMz31-KM^6TL|y6{<=|jE_x9DjG)JtT}Y^)Z5+J z2|wCat$LzuY4&qA#T7a*!%serKhv~~uk+;&C35U1fy{f)j>pRZ_>w6x%!nDquHndE zH0);i^;;VH;yw4=^AdnzK1c4BQeIPV&h>-#F;#a@C|+POMP7A0BH7;jWZT2>$jmDn zxBlLVTxJjDr=5mCe=Fi_Dtc;S9uH{X6-!9<_0}%a=ZBUhWrle^(~Bh+G?L_HR3DSt zX~hz0&wjuIWbnLd`&{}KGZq%+pxYyieuQ-aQFZ0JQg@CkR40>7*8?W77 z8bD4xLn`G(>=8*lni#u#a9xGgWhrXKdF(e%>>(0bsrZlo*~vHaf?x<^3Pz9s_dTt| z8z{<@G)NBqAq!#N0@Xi{c5DaU;7%NL+2&Kv)YBK@zF6^pv?1+mmfL057!Ek~ZTFwO}^fhsz zK-Q9qbnbyHY}>cT3arx8f>rl>HmeMCvkocdg-2~%H95IWEY$z2pYjKc{jps-M;B#-$Wvsj|r7g!m6t`Cp#<|7z~ZLo63m_iF(> z>?Fmd3%k2XBxPkNeKwYRRH%q#I*b?aEG;cBQ044-%p`{y{E7?xbv>kUAvD9jcxIT32_fQ3jpX@F10N@R!!HX6#hQajA=|iObf9&UZg{Kzm4U=xU^c(AL3vhR zXX-5+t zHset+R`(Yw>Unij0X2%Q;@7$dZHj^rc5!k-O07c%Z3{dnP|hsZzj2cP=fVCH@13PX z$_e?z`g)Y7SNpc(Vgm&wXVp?szgK#j-IO>Od|0~})T5Zu79+m1gE7V*H9z?-+ya#~ zOtVLx2@3qi5Jj`=?DE0lH=om-LI9^ndvFSoq7Xd)l=A+okBP`;;C5rgsMRJGC8rwJ z<;`vU6I~@p%>h;`UP;FK1Pd!EggJlcqJFRG*iSLUV)+WPfAw>ABucf&ViAXPACva~ z?}h(a;hEw8e)T~a`u7E~!ELyZk591;2?>rBp*&fiHI}$!7^*?%at)ytv#x+I@%+;9 z!?uhoez8EwQ93KenJ(TxYy5v_!AJFW)H9>>e1)`|joCWqG@7 z0SuVm{Z^{IR%Kp{M-$s2ITd zd>*&je!5fSe}5ITGG8aN1)Z>1lyZgPEYYDYEorf%N=k%S`ZC%+7Z@9tK4>=KxgRR# ze|GUmU0zAM%@`^0+H;5uVj}8IfC^}xt`eK3W^PmGG1c6A^!468{3`sm_MK{^x|o82 zJnQ(R`~U=-VK$Otwd}8s!6=mSmWskXInymWPrkQZoSZID#U~y0& zJArItt+uK@_KS;D!Z*=`Em`lyj4y7R?UFv&YoYzlSNSgUnMxXq^Fl=Ad~u%bydh`o zWXNW=5U(ERBnW5Qf*(GlI^)yR(HA9`zn2`QHJ=#_t7RElU-K_Nf3TfdK=J<{TM^$z z$?TjT&lY7@eShyOu`B?#*GN6b@$hh$*Y)=ONUNe%w=Q)4)zVT)>$?eG)1GG(`eZZA zLP|S{ziZ%~hH{VjS4uTfeFVZi%mhnB&a^-?@Ey@LFS*_F))WWLM6C1o8l+%*d2ZLZ zfW-1r_*24B{5wu;RATIsJr3*qKq=d{R^LXjgZbj;ybt5jxX*>G8y4ByWP z5Wuhzvx`vlM}_v{_){{~1(xrj0D_@z(^RpVvg}%wChW~ldI7-fcj${6>zxCE&uM4(|o4Urv z+|NFG50{sYlwxAg)b*g3$zR!045gq08-8o#`G~1dy~PBRnG`yMsmL_Ds)OAC_ZsOid3pXTPhE0K4O(V{rP zwVFtV>Q^NtuEk!ywm@#tQ9&5y4^W7O)ip_RaZUPsV`1S1o9W9v2+la%eqeYxW!7Nv za^Xg?L#T&~(q)%de3If0&3rMG!oM=!{Kx8EliAl98!k+QE{VGZz%#e6?NBn%-<_;P z9mo)?W9(YmJhNDf>YrxoCzO5;!s-8PW5ERTpNqRwCV6Th!zjw?y9yIOeF+ zm>omQNzccXDPW@bIpfRi!8Ivmx!GKrm@jUE7<#UBIz1%XGHr#Cn>Fgk(&|(#;DiLs zQNp^)9~5nqttc!sot|b-qvmAHGMLcIjx*h&u9Y&)W2w0KDHedU z1Jny-P-1!@lDT81)nX(jjT;6)0%4PY{zXTIsX2@`tzv#&qY1l zd+-!^>tv}N2}7$d!E&2Ol|U*_Yyd(jyN%DO%CTU{W&D?9&p7+B$yLufddtqF99=&s z{=1$~N(*`Yr94gtUtah}+`jHqdy?`Q4=q$9Z0C#zD_OFdViRTK5NgcPeKdGGMBTwW z><%yU*UL}DqZf$-5-B3_T4pc@ESj?&F$z?|qAyMl8eTUP8;mGOe8yfFC^Gmn?Xwe9_{ zjN10@VaQ5a)T}&70A(ekFQz!Gbef48HQu!3MJCk>kPmPJ=_P2Q!`zy}2BsUJILBvc zyq%rBkyqYTZS&*vccL#D5nN&evVD`ELG5VE)Sp%N>RS;uPjXX?lpOys7gx8R5_KKZldmggUL(yo*+Z_=~pMz&52+KX`9)} z6?mc(k@MaENm0lE?u6e?ncJzk1u)Z$@?obvDl@DA-vbF2EgCrFE&n4EeXXo*K4=-7 z&ue`l}LuoKZBdB)M%MuqCc#9N6S07aU@A)7l{LZJL)S7JG zAAkOBj#-DkZ^DRgg<2PG+~)<`a*0Ry@uPi#3nwlFD_yC?C{?Vn`X8i$%pL9KfyhhM zv38{RHXcNI zBZ>u@1qX`KT&Ta1_PcM4sl|B}#6d>u@0_hDqx7g=H#mmchinq`?kqQ zCJBlt{b~5(-Nzkvh$A~7J5X!|-W#+b14T4((_17$GH>zu^_3ZRwcmTy+QF`|JV{>K zKr*O``u7Odp^2j$&26GlYYN~olr~V(T3Xh+0CT!yr6t#Y1b6q##Tq0;%utrJj}ieK zFRFAPl9FPGw5?Hxx>m%{=8eLT6^#QS(d)b;S1s_qtUp+%QM>k10a3b9WkWq)^N+7C zG*Q;6>8WD$vyKCPQc!}@oufq9q4W{Ht0mcN{{l(aJBzX zqBP>Ho=7EODa-~ZXuRE&pVTq;b`_6<8iMS!N@Erid%;>;XWp?*47hFos)YQ9??2Cf zon(fs4%szuhDCtEjG`2J?ndOGDXEroLF9y?zgK50RoF>{HBEiZeWe$Ej_hR}jtmlE zXB7#dVlZW(t{D|J_|Xr@~Loh#ze(CCJ^sSi4oC@xfgJ&0GNBY3UN4w{)L>;14Q zsW4VdJmt86z-l&r9l8xVrI>i5PFF)!n%?P*v=f%Mf!z^GW_3G;(dbnA)?Nr$UY`5~q zcLyA-0C0T-(dGhz9b*}U>nNh*Zki+YIFDnT&Y|90`+hD$AuVY3*U^xDsSS{=(q>pw zaXr>uBOU5YWRlko(lOkgZ#}%4ID(?YTxf=XP)Hh5Dw&x?A;bJ5CChy~X0=vc1lDww zCs-*dR84Vlab$?S7;Om_8b9eL(E-JlJhsI!Js|!)G(yfdUw^Q;HEu~U6{QCj=aP34 zwc2-ELSiQL_kEX&AZLm%Z0Y5$Rte)^@w$uCb^lhGG(mno_u(rcFRFC=()s%OxPbjZM9mvp9)~+rQDHLy?SgGWxD&vBc;O{Qm_@!DOX02o+wIO zCE44)FVq47XfyENnB##XuMpy++?=$-%Dug)3C9I|N!Yg^M-+$n*DN{&ZhSJQTw0y{ zYg7IlnFOB&j&Ws+V!=~}75G{|)U{Rm0Cu|0Pzl=Ebc<3=vIFIw0UvC9Z5iI4-_WBA zyZWi&gQH9SaAS409#FP)AFHIJ!^p4Cn$Cc^dW&!Z2N+Usm{Af0#JgTlYWz=={@y9J zW<7NK{ahj+LgLqC$#K~zpeLU95L+ZJbBMb$eB4e|2DdKS54-!?k}WZD=0Q8qE-I># zUG%SWahgb+>1cx16Yj%}I^32P?vZmD!yts1B8RI>l^V^a3?9hoQHi{vzNJugCN>kZ zdb%unJcnyp?gn-iX&9fy$Y4lD-udw^!CKc;81@3ir137tGa0oJCbeVCtsM|W0B>IY z*C0qqy51>Df{BJ1ib4CEsEF)$9Uf*yT%H&_XM-FNwz7fUkm6%*!7$c+C6?+iI(%*) z!Nsz?x;T-JzzbYTR^s;(9mW*jCRIVAF^dme8WVYyjY?%5Le@5`YKf}`VeGSum|7`vJ5X;45jG>)>G?duO;ZpgGuO@Zgv@g&%H zvcxRBaawjTT<+LkfKmLN+XT}oyh1(o#6h|oLETl!WPN}}66H9~;Cwiy5H=~GLp{)9 zKr6)D)8pp*DI32+hmkl1zZ#v8nmr98H96+I-6nHz6lN|L@iC~z{u3>ttqMgqzj5Ed zFv}~+HhNRhgP>QQ(LR;4{uE^;Ap-;BP0!o@2Tf$sk%))X z?DYn0wHZYiI7p6B+qwWSVu_B#bVCv0IT1>ffyljqyrdBe@KTg#s7CF&EigG@b0Gie zokAhc*9yQjYFi`BcbVhIxo!NVxb{{Ni*eP`tT15DUP<>CqJh071u5L9`8Ot7;F9|r z*YBdn&?Xn3nQ{6JKkR%-v8v>$nJna7%4MobEUTb_QfzWL&-^)}q2KWYOKhlTC=t9% zdGcQ53CF9**JTIedKt>JqmSdY#b{L^&E1~XLFFhnyr+-1=U@p=gg}5z00dRLvY9Onb$?K6vYe&rxi&1i^K;|yrpmU{C1YtgSboK;{ z(J{fm6h-Sx=esV$`kRRlk92unm_!G02h9OEqL~~Rlm|z4xDSwlBxFf~p1pqDEw|@|uYv%=2&A(npK#2!qR~bW56iGOsC|ab77kFnPKN4ZhvSt%~FCkx^RdH!nk{ z`vQZCR(WAO<|*R*)MN!dUWUWGfyTZYQ%!YnmkMaXf9xi5}pvSPvf$<0hQ6pm0m zJYeXW{-NYfH&;-gV4sk*Awx-w>tTANx{`H(VFbU%k&wE*w|*<~P{_?s(ef<3&LQpL zD!QJ%OH_n$%fcP?`re@`+xm~#Dr9)}motjg-dATNjtTIP2-uZ@bu1O(hW|#7*f&b% zkM2}w_ZNY64$%;caZWSmW1E?|JCVnm!Lj%_ftGm=X-M|R?nD@aOSqBZLSREf#aR*8 z-GlFGrf?7w*>R!)>8fHnKE6>BMgk%%`_0+GDMe;KBgIMJ5ItVA^%mW8Fx!F=V^zm}X4$pwX`jPl{h^?OAH!pm8aUV->f zJ?;*RVXEE&bK8QtL~tZr7$zu>H}G5{6nO2#6@floK>9N`6^+tFq0>poA4CdD`;KsNX|p}=I&C0r-Qe)%BB!$(W?M3G9CzDX`6Nnv?_&QE|u2NQqm7^ zxy%IV49Wy}N%FZbBI`<&`=&6P2K*|Dcn|%NrPN?~y^qhwEEfj}RJuij2LxCtUv{p= zJLKpu=rTStA8NaNCGDObBKsor>h*Xqu6&{i&q+`=%p|YBRh69{;1KV<3BcGf3TNI^ zSS{S3*50n$Li{(TVc@R8KG@bauV_m4)`#bnjC_YfS~*XQso_p&m<}d;d$ctJ?)qkV z=Jm2c%P5&Va|R1We@0GURe z(l^4fOcqs3@*mR`1stYW6?X6^+UPm8>M=%)1kMu~?0rNGs9r^3G4gn=CDdr)>DuY( z+w4Fzo6l1nt(?YJW@Vu;>5*>Y&G78f>N$i$tt;-ejIic6s~kwfH5jalEoz(om)&&}KCwE9n&!%`BMpbXSvp#THLO>~=5vJJqfo<fuSI10oQU5t!&vnH6oS>avB&~h{jtj>mF61)lLCn z;z>Raqv;o+I@`qgwd0|54?}mSrp6HeYZsqC#}3?d@AQj&XER~&Uf>S?7V2H>p~=j+m*cTxId|_ZDzdobE2pus#%ZbY3i3#W6!nsWzO@L$ z0T(SOZ1WSUU}jH$Ttdb}wMYZPBsr0ICd2qxPQ0*6&TJS9E7eYM7vyka4{?o@5-S>)Dmem9hMqg zhQrwS4|Uc*jWhrIqjlW3nmN&x^bevHq}A8wO09X1C!)}Dxmyxx#ntuVW&2;%B)xdv zzIYhgfRPJZTuuXksBQkEQ- zTM+c{F&)|*dwFRKPP*ozepl=)7vP(0U$2s=DhIeirgm#?l?Q6J+RtgGmNpPFL%sMr zZizaHf$;}}8@~v;y7T0)=o74B6=(9pBQ0b?{b%hfwAR|U0ki`-%b$1*h%!RuVjS+> z=Absum7E(J<6|?4pYXVf50~ebkz_fz-XXrj@Hy>(YU1HN<_70et7bBr)$%+3Gt@ud z1S{5*%90c>r(TxryZjrQ)Lp#d$2GW+xMY;9sQYH_)| z8QP@K35^z*Jhtyv85t#1JmIwlhExJv8WA&^0UD*K-Gf0i8_jxBsKIG)p8(0@wrgbR zo|4qgFE~KtN*3+3fnBQp0|p_rhwDRO32-vnw%ZG41zdLYrpi-{*a`g3WnCbLs7dG& zkhcKb-#gSt;A?ApdjqQ#ueWfFkU56@{tX1}ZxF2{xF=tqr{%k55$2ei{3uO7?DJ{t z_=;I3YB*P}Q6_t|n}*VlS!bb13p}!%NS2C1L_|kf4i!Z>5M$T`m6_x4XE(tJZi}Zm zpA;yfG?FuutI(pZ(Z=?})&%ow%>820r-dL&2jhU&=#Q5Ygvc;VN^PSn9bXMtG5}~| zA|zyzwXRExi^zLt0yG4ED=Xg*{jaz*!lC;;~`EnA^Ju-i{2shu2MT|aSfKqY3L z+ORn<{?TQUh2BWTG1cKQITdFbx@LK7g<#0WscNINbF@c()pxULuMUg<&B8xWwn>*Y zL0vg6BaO08%tD*Mrt*@z)X+*R@v}*P7?jIkZt9SN?PPT|^g)?`32udigoGY8tR=5d zHx7BZJrb<#IUudoVDCZ=nWt_$ton-(c5djpIt(fm1O*;WNuyE0s+wb#i={4_wj*t;KiXF5hrKT zfu`)?B8;*kc!*qj%=+)cO4D%{w# z70`SPJI{7Py0tDjjd+xhlt_A?oV$q%cYeizTK@^d%Fn<3S%{i|8Uqm?FIAE;)7)=2 ztsd67TtapPy*p3w^5T-nlo%{SAD{YNgq*yf78i*#3G<+?Wp7q>S&pGHdu<8o)?zd` zS~lD7Jvb#Ft}`03oc1E+9LcRY(AqB(umx+;xl9laF17p^o#4e17Q^&WsfZ}RPU5@u zD-h8t*A9ef>W!j1o;KRsr&{}}S$c&EVo_367Mgc%Wci2&FE$m-MSf zD3GgUMdNpLs5r-2EujPlvOWig`?s~B_a$>^Clh~RKkii$PN@aA?oo&f7TE@5VXmwK z&0tGTP+*+u3p*>JzMHJz@`--@4;sqkECd6EY9QE}a0MDE)rG!74mXloOS9jnM!CRT zO}3Kzr*0at9R~#%&dWFNxYdC9{`|84Ei#o++X)^HZg71(sy~`g&e!*y45w)Q-?c;V zBfdQp8RLHx@<=(oFzWH&e;gf{nimAjwKIya2No<{zpV3=f-Rl-1e#bYG}V=|xHz3O zFlXwOf%eYmh}TmoAdI`VU@)0U9@fJa~}{BJD)q=Y>&_GTUD zN&P0U7>SU2r}YX)>u%~2f(;VJ-vDH@^U#M@?rBB8Cza)AQk$0!J zi%qE~*M2=#O9R&Tg+CvR1iKMV5gPnQ_JSk*RlBJzFnOZO>V@kAe}a$z|HB-iS_;Nv ziYgr~4cl1l{U;l8%se5%e@gdRA>e2s=}ctVsmkbXmZ8EeXlRD1Sy{n~AI0ys8>g96 zEIb$g#?RujCFLXozGXY#*jrdh$r;YgHAJf&(~DrlLzc0R9n(p zuXXp6n^pPEh4YB^sDA@u`Rk7NU+ZjP)Nj>=8G6pn#Ts7E5?oR@L@P5>;kzHT$*x%7 zw+^1X?&c+Os(V|;S*ZRaKXO9(+V!z*%1+S|75>HK_C0Sha=r}sqp|6D=Aiy; zuDCaj56rf%kGQrHps!9veeTrC`H*^RZG zce5T~-jj~dNPxvTnodbQRc7NX!xBBLKyzm}!U5aMl6#Kk@{OfXsq7Op)H^Vajq}|M z`$1z4tuc8|s$;N-Wo&SR0HjNFd0X9M;-Gl0!G$9A&3TrEnvHc&YnWMpC2t105ldTt7xPB_UC+!fx#ziQ0?IeBIC``m^;pKod+L544* zj)q|ec@m~&b?ZDSFsKT-I243$O(%ioAzc`%kdugReZgYb<~qG-6ZGb4aWOsxHdgo? z3E}CI?-FD`6Ev`75sa7YdP`I~Qz zek#M@tkOT-E}*p?jd+utC097zcop<^WKl?*t?|#V=Ra;#6Q*8DUxxn5dZ8#Nm`^#c zI*4){sTSWlD;FHXAuqPuHRPWcVfUtLl<26#Sbo2;Y?Sk>mKsrg1T0Nw*G{^T%~Tmv z%*l&w9nH06XS{H)p~lswMiKz@Kl2VNGCv~`nzlCiAU|*|%>h*TU9zZHMFER+ys2L< zmIB!m`(Xd(3eBi|wky5hVw|#1xd&7Q8M=_o)Z!$3+q-EDfRvnv@HlJC3uFa-$2dBg?_FtV7!ps! z0s_Bh=!|U^ncza;fa%_5Ebj{n3eeGTDObQ&?eH2J8tfV?k3pz$u~ek2anCQ$g99sC zK5$P&Ur~IY{oaF{iB^psv$=w7wK0#KyKVtN0c^Dmw@Mww#UV5_Az(iL@@l@O1wu#s zSA(t1;^zDSA%Ee)p`oeGocf(3iwiP^>NPYfx-ry#e8TDR#Wz@HneR&vr7(aRA%CI< zs7ATz^K&h;WTqFp`V)YHF;O|Qhe!R|C@vI3t_vqZ5qMbPnW^CgCIifd!X-~R`+nU9 z2Srl+=ex?coGr>dMU51Y0NEHqA%89oA|nR>KDEOb5z;@$>oSBd7_O>`A1CWQ{%-ro z=)q^~|MB+KQBk&QzlumoC?Wz(loMzLTk(`ek>o#jkPQyUv%M8sp> zxZryf+BUK1W?wmWLI70{4}tiE1m*Gq<|c0he`v6EZgA{DPzPj2n}XL8e?3y8&GpC%L@bZQ;%dL86Zlk5#zyJBw$z&AglN>1ae<|1b()KI6 zEHx+`4Qg(L^YK?5(uXJPB+DP(%6c&HkUG@EE(tGZ=LPR#@$Qww4D^fiRZ|8a5-AEI zfCudQIW`V0I*3mj>b1Jg4ylqyEwCoyxyL9s4*a0aAz*qNV(GiJ>(vUInD_@b0(7R| z2&S#wJrF)%)N*)z%L2z>aURLN^t33>fbnn<0EFy{dUb;ey@}rt6i$=7VmxQ*G)Wn0 zUCgFl1~WRaGd_Qut%I?$Xc8#6FIBz8I%KLcH085&qq$yZkk%S%n=UB`7J_Zg9qpXtZ_2)< zm||(3o4@FgG?(H*pL=>RzH3kBx5fS|_QxI9F*1;#W(u;r_FSnau*>QKo7~?rs9$=X z`lDyOrciB{^mAVAcN>nSsp;uy7u15A>>#4m<9kGd29Q7rB!ceOnF<9G&A-(L4i>0z zTd(6Jdv|XA!k0&H<4nGOzmo~4 zU@IDP>-@r!K-Fdhnqr62l~^Sv#xo0EJxV4)vJ1>iiy6{~0GoVf@bFw5M0o2D&N+>B zX-AE50)yI=?i-KbrW_U-J=PWUAVguRMCR5g|E2*m*oe3HH^rU3?vCa-ay%z%S4E*y z;m@ILl`g`q;)J03XryoQBPzwb)hegml>>!481p{|#%3aO*ak^WY$-4tTF=rSrT35Y zhSVY364-lE^I&I1-x*L2V{V-Dfx91vnwHSbzBP*_uWx`xs{M_RbrA=Ay3}IN^s8)x z01;Hbc&UKH4~>7S_L&$JALk;>S9@JmREqcoim@uSBm;eg9da!OE-bZ6wRz&V(iKb$ zggWWA+WVA7mM&GOq;H*~%OK<7be(CIL5^iGC2t~ZH@u?SwjDIg*U0Fw*v-SIGr}J% z=yRqeGhTsfF9tE_cS12|3O74~Y86Ei)0pQrViX$0nec2!l>|oaii_e)wPw8?{FjRVpV%2% zvfD+8I~b8QRT~kbQ*o8hdb;NQ+ti0M$GoK(aomy~VR5#KO|2_e0A( z-71$xz)kUpSgxT+_Rp~~KWdMw*RU7vu4oY3r44p5Z@nud(eo5T4`Wfq2kmiN$|{M` zl=35DXElJs=5De3&2zNBDxAb6arlKOzi&-31~JL z@bHERgSt4_5r4{#&}kUhh?syk5J%YsAvnbU=@*muB0Qw9=r!o64QJTHPps{lgWJ&)-|5yE3J- z{m~ojxA}B=nV2z%GflFZna_*MY{NbqfymZ%BP66-U!4yT7RkGxD20Xv|GQYdRO%S( zNtVVjR^%|U(ETW=h-d4aYFpTxSbeoZ;!9%DcOgbeA`e7^od5ur611uk^dUqfV!Owg zMp~teFYfzyqN^bCl+vH+tJ~FVp5o(eCmLym3G1C4z4K~v8h?|0Rzw@Fg_dqRNFY!F zjW$IphN#Hx=(yE%v6*7|zQ&{8;!$l0NxL@6?n1Y}e>iWjL}3@4Pqg5Ube(L~)0(R3 zo}=%LlI6oG8!ffL{8gn}JV3`t-LPdp+vF26sCV8)bY6iY@+JLCX5&-?T2<~Ran%U6 zaM^6Scz*2M<2)M8?27vqr+^r+c}Bc#iK&z>s^|qhU?S`$xlgTxR%cHQ)c{Bs)7>lV z(ZG);MRZ}|(fJ2LZegQaH>w5Zy5hJBz7PBxXn@yASDo%PtgG{U1MiR9#TMldU#d*V4lKTRbB}Q;KD-Zu5ePGj!ehss|iKji2%G z@i%7Pey-wMauk8VuKS-CDcBo|+RYhj1KY06={!6!30ZDT4j;C{Eh8PVR%|+dRm>Tt?5LG(tPY#%BuH4X5J1#CLG$UNpID(zKx>lr&sGv+O!@ z+I~iye20Af@K8yZ=;me|$l)lKuqdBrQnl`WHf>jfNHk*M6;(pelredPevF{v`kbej zq<>^%A`2`Bxn?3{75CmenZiF)z{n!Pg-`e3l^0Z5-**SB)h)1mB7U3aJWbUxp2}c}hpF)w&Q^A9ug*CX~;p;0{MyW~2LOMu008 zJSh1byQ1)~Vy=OSR*1vrx|!QTGspP2zbs#Np4)nqM5pJ;>_&;6tlR%MDbl@jo5)LV zcX#Iv3yk66>L!j#WDr@96bE?Tz4{R&OM@D%oo=(Pu)0Eq7xi_xZBW;%2x@`x?Zh?j z8?;S2HXKdy>ic%fZaR(3$4~~sq?~s~KGmUyJ|Ej2)^5{$%lquetYriYxO}fTrGsv% z*?M*pa$a7)^p(g`qm5xMZc@E;2F=vDdl3nAfGp29)*(7ckT@o4moxcX(N?c7<#N`$S;yqwy`(#$3zC@1=3dK?B4Tu(2q7RgD z*xw!~5DK7T?^9ZHqYU-{B;5ka=zbiTe8J)VN{*4jLqi}Ax+Speg= z=Q;qdRPe4(e^_|K`i*KiTh1oN%{b%cO;FGZ6;UzeO&-^yn>*4l;Y%_jpGZwMWLPl% zE4=6x6g5zS1o_dpEPL}9nh%-`WPTe>m0w)m+*!byxD_Lazvvx4ji~Y$48sPeUeUox z&Tf=Iz>8Yp>2|goE8Iv*k=cFSQjYwkEttORQ0>&TDSH>ujTY;TVYBZ%)W)Gz@rma< zkUR2bdtzjpro2@Sje=ARkXvA4t=hj&&f;+>`va?VF|#&5lOmw zL*WcDyJ+G~xSZ4NuM~gd<51NRCgq+d8}|Ntm!KNRu(f7_b$_{C;A-(bn4f`B4LpBN zeM(9wVDVviJdbUzhWDyj7rF3#ZRWXzL~@N+22e9uJg9B>Fm|#Ba}u}VbIAgC}nvw!UKgEC@(@T^y;@git=MURO^dt z-*Mf5zpo=Ex;blwYLGT=z$#^S_eN0k3)oYA*JZDZsOxCov-qV|(kL5SeaY>%VIw=7 ziv8a5c07*@r1hfL$I-|ZF}C>C)hmT~q*sr*5%&Meo*Na#J?2PsXy5WZSiu&nxOUwc z`9ViHqmx&s4))N1Zh#l#4$iv9PD~=xUZnfnFsvFK7XKhh&L3$T-oAZEPb4C)7MSu$ z4h01>1vU>;yIPI`ddtLWoYMULYkX?g_V(y$E(=W-sfBzcgiQG`C$LdUQBmBqg1RpP zsD3F;?Pnbr58~^}j3ikl)=W9{OZY2ELJawtxVrTWwv0TGiY!Hqp4S@ZaEBLG-~@v6 z86)biQ)+=%QShk{qqzo;a7LLG?EQAMIa1Q)kFWF#Ud!hxwM4P0iJc@nI~JIdp(si0 zh=m1le0lk`dxj;5B-}<@{p@^+I$x~LHizbsFB{F_S!1H1SHN&;^a>{t+9zI1{TIzQ07E0-;<)W$XrlR7c%WWx-&&WqdbbV7ABCt_~OOi_) z2p&U2&V*jtE=i!g&v+mf--F(GBKqqs~PzTf`HJQu=^Sb2YuH7CQ=S@4s|sdm?J? z|8T0}mf1r2iwIE%)*F-8Npkzt-S*n4hF&{&yO8z9RF$#BOpl5yVk1RQW((i&2!kDN z;7R%u2{*@fwe36Vty_lPIyVcwYYXi*DRr7BFprU;L?y8zTSf0FS2GoKUGr7*`?J|4 z%ZX%-St_(NV!wyFIT!mO@kHqfq4DUa zZR-zY9^>ngz}6D#XD2MkE_aPd!@!QJ`^E(4g*7GWLW3kkSq)S^t08^6nTet_aN5yD zTD)l%L(r_bB=q@Bj4QRg@E1_^!!8rd7H8}BfU53B1;qW}^F-zThCTxK5 z6+Aq+*01ZS58|dd`Nh;8N4tz+diwdb*o`d6=Y(OwV~; z>L)`$tVl>U+^$=dg4?Nvbyy;z%;4$z&Flqb4jh+;*@9wm>ukTOi;xWQ(mMdB(4`b- z;yaxQe`QQGxQ&Shm};Nw+&ZY{u#Z4XYrZ|L(uXUxh>eelp^htGNfp3L-o-9?{H~i3 z?gccmz{6KKL`+5>8@=7j-uSh8O3Q9hZ{W~T7Oq7?4j+_pr)od@VSJ|k;l9EbVzT3= z;jk{RR~AZn!`yqCHxkvG^UM(MvjaEI{jY{GU9K~1l8x_rHtoYTn6vNU)(|tM}ffX;86LZ5^s`U6u`9}hz(&hnb^YXe~j6z0i`Z+#^ zZSZUSWZ@IMQcR;1$}N4SZcSZtp@o%-uil^vTHAIUNDs(3{u0+OURNz|`>No~)eg-* z8jDNdcZ+YqLv6D^U&*F9{G6WX3Rr~qrkpxZB7GXK=7J_IMwKD!WldW-J{+>bSiI z%qS+d{47SN;v}wPe73>ZeCGz8f_>dCpSpS(!Qgg^K_&9PT+v_NDEV!n7f;>vS~_k) zZyow2G-9WgbZ7kyqG{9^7t;;zDS$_r$m}uZ+!=W5bx7{<%+zv1iv1{c=y4a62z3#q z=~I5i<7#i8?w!$ROrU;!#6*KeB^+)(o7Sr}@^@IQig$8yGE?!b82C;$k?1+oMdWZn zG}zU(hl(jS0xe1txlBE-yo;{a?&zM9^1ZZgL$WJk_F{a^GZeadeR2mnpB-lXaBC0U z+GQROEm_&BFNPU_z-wGZ_3Yhwr-?|XM4Fl2p58)RyMet4Gz@2r$wV3&FE+5iq)3G~ zIy&gZ^$((^b|XaWU=y@V$h3h8>G6o|IXDds*497Detp(562*7@gPloU3-Pqt&?EsBx z&U1U`t%P_6*;IkkKJ|~nO6XVX5to6bw@bKwXaOsQ?r>04LJ=TnU#>^kT5t#fC9;9v z6eD0O#QLdM)uhu9{>c;uVFff5=jTiwH}>BL+Av!%xt3+>0q+x@PNz7OT-M(fx+$!s zlSbDXKmF)MAM{B9WIn{*Fz86#Ji@F(K;!k<@>yauO>c8t>er|Bh#m}c!<2LM?rn{} z1LI`US0yw1JvXbwtb9vz}(f5AGGcLZHjF>x=< z+pRXHw@cSuePs!kCr^SnsiKeG4ji1m-Tzf!SR;X9D51mEKT$>+bx-miL5*ptWqqal zK}{O<19dKOWM`k**k;)W(4c*Z#&<+fr#5!JPaYYgQH5*Q^5&E1^sy8sD(C`oWuzM? zj$u_!l8;F=F3s*s)9FIPHv{p>YOrBN_Z$Rja6+EHRNPlM?wwXVy&Ws+qHb$@fxVaK zsu)f5*~t5>iyv7&t~jv#7*i1A_M?1eKCE<(X6Ab|=8hJY{V*fokZtuaC+lc~?GKzC z^%#16XMPqxf}{4EXtx4AFnddJE*e$YZV8R5%rx`5Yf?n2m=<8)zL8-4odEC_hs#4o zUs;3kxicXVW8yfn zS_kvvZ&q;Z9~elSdl7gx&`g8S6O=rzT|HKOvdi$2RyG(uV%{7A8-5`=xF9;!dDv-BpL#`Y%*Q=kU0tfmN!v1*+a-ODrE6ErtIQd-$|+5V~W;r>uM5}x}~YRaaljnPmv zb9Ra5npkcVvy1L&AOjOa+!zX3g<5`%?ivF^+(TA+)jKxM76&V6ey~$pTZC6?-7&`iI-*Uc(yR{4#fKX>j-*~V_I2?sbBWKfROz5ROUx&KrD zj2U8;ehoQgaZg+xx@EUT5_8UGh$1f?ZpsEQoe9EXVLps72k<&B`a}bl2mOP>72fVX zJu<(YpEkVy>BSw^NhJ}K)AI6dNE_RM-a?b1kX7mflPVW}D#c+=DnrwWO}1gya-38E zh9nljc^_7M?5)bm&i3Oy)6}a=IE`(GUZ;fBkrk7PLPgz`Mc|mHV5+KguFT3Ph5&x5 zN(YtdVMk|x6RMpCw`tBNtkB4oPbR(tXDE6k=d#IX|5wVR@H>Mfm5*L0lwqypAK{I;0;|Nij z@Fdm;O5~_Xu3=M|@}cB(tE!!xyDR*Z-90~MR;sw0XP7GjCXazlkaZR+hOi8w*1bM} z0t^FkTe>8JJli@CGnMN{tXt90b2BT)=TDT(#=PVLt`PDIBwcA9cg(o&Ovj^BsX;!K z9qpbS9!!t(18@zUgT3*!#~h3^+N%*ofx>#TIspjsJ`?=Hz7T7p<5JB;2Rt+XS^ zV1rOg$7ul#DTSa<;7XFKA%Gh=x8QFRAIl!1X^`K9>Vq0>}$a8jnS=f(aPdrPJ*{#UOU z#?3Mur|)_pN2=e25i)Jilw@A;%={D@?4MCd?3W_DB&M={d&j26(!9L!Of>QC*=8sq zb^!$VXc#`p6gsNO-F^<+amlf1%^!OCQp-S8deM7J#N*;ejL+I(tC4w9rdM9OSf@p3 zp|fr}1JS&5Vu4#m7JT{)`iQEZLwoEV2Zi?8(71!*%Qf?Ay9forS0$<-Lo%#6)`inM z*o2tEU>DLM|B`umo}puZp_};_dp^&!7ILo|38!(Dlx}8&jR{-7#a^<@ZFZ2iAb2r* zVNm(4TAorh9@*u-J=ctB{IhH?=3;n%NgJUQ@8zz|d^=^j_x^pWrLss_bz&y7A?NL2 zJ$w9bvK-Y&bBoqRwccnLmg9~u0u?;*e#ML0`zJxsn6V)I^3bfRGmftlU}l=v_sAs( zx9Q{&Q|QNbkE7J0uW5V9X%?e}f?`oA?U9sVw{fv#k~mQj-)}uGq-UgCoy; z{IW4YN!^w`dr$@Z1n47=dJi`8 z?cll2wft84ygu(Gzqiq!TCCm|NJ#L0Mgy`N<~9hhMn`Q~*@lQI`IbKBFBAe=thf3* ze0}Bvwkzm{iJu%wjQsdQ0=X|7j-h0Y9S4MU-z&|zEwY%ErV>fXQ_=O+GJjJNx({DcDG~cg&b3 z)mb^8!j#T2GAUI5b}M)Z2xXfqY;l^R*x|Aa9ZY(~v*4(#)WbwzK6>j8lT6naf#lSW z8EZv6HmOCT<$~U0Ume;i2U1PkU!*Qn1z9GOvdn*4)=|ja~BvH>ADB^4%lvy z_9xcgjx}MYVsU8aQ?YM{8&cxDv^W%Q^gcHOI5WwxRQv2)qZ`Nft)YCC?U7)D(`EYT zzGjl8`cC%ZX~amrf!W}hUI_fG9SuKCubk%Tx~DBq<+PRJ(C!?-K3iwScA=PISzy-3 zCvVm}oVFAE1Fz0U^N<16G5j7rxzCuq^Gt|b$Nzv!j2*mO)OiO!*O6SF$X*N9xRYPA z{nD{XwEQ#Qt!|-%Ct{;jrE}xKm%75hbl6;OrrLt&(R7(SO~;-lzZ3~Y45BNH4rJ(i zLr&SUZ`U6jxf9aol1@aEbgQYjCu;cgSbq_@wc(;97I0d1@Z<#zeyY1YX&5_8Vr_C7 zdxN=5xE4d1C4rZ}S2Thy7TCl|1KRK75xD{zE7`Z(M*fq8evwrY&aG8`_~7U}%qh%OA#2W_2nqpx7fa%N{hMeTyR8JSa;l(VV&++Le$+tF z@bkHk=kvgE)uiSZ7z)DY+iO`6gVZcP-ufkjr9vc@Ze~ zp!;$A5-_pE*Q@DcS1|7#KWg;=W6^I3f)Sy^4s&e=)Rd?krCBFKF#Bb#ccT;UPe#|m zpIjU*mems5E#@EG&%<4Kiu(W**CUsR5!y zdzEz)e!h1HG9DDz0}`yv6EE%NW);yO_a0-$S{U(?Aw<}^wuvyJ%q+LGOI0Wn_KJ$oHa#-Hua0 zKw!P()v)HZ4)8Pp+RKo{b87kz^yLqN-fgEx-&gYG;93JJ_z5q;$ zudLYssZ~L$Dun<`*U;*4EPdO6Hg3mqscQ2^K$Bmvt4r0!&Y5IDJz@YecBikMU$Vvu zUaV2PTYU|VFUC0R%^zp^c0#D3RbF=FrG;Wo;rEbh(sVr>?POO=lnQTGsu!Jqv_8$n zJU<+JnJVb_RcaN38X+V16*q_cL)BzS#a-c%5p&u z+D5)9*Wp41F{cCJq**?{3#?z%cAq2THP7B<9zc6nS>>&a8p(O`5ntMxE;aCqPN3LB zmuY%=B{A7J%eQ)uyC6@qR2TgKtK}j2@>X^uHkd9J0VRvzJq2bdA=6>&g+)TKmm@A! zZfzMMbFa$gqIn??xvTvE>5DF17l-Wm!{1oYo-FB5Sw<(f5&N}Vjasc@zOz|vUrbE= z12Qeup7fui8FM=?2^?B3qF8w#MAru1VM3{rX|p`Jc6*ut@GMODdi?&OvCCsps_XT9 zkk(Jd`e+h@$Bw@QXqqgV?%Zz=@n%cn4yE7td6ki!@6wBvUv;OI>*YrY`3y8Po5G{0 z&~}faeKT6VTYS`tXAJrG&H$bO{o z?O6yBP34(jT;DDV`3_5;Q-9IZ&EFs)rQHQbh>e2vrQ^0E%;!K5>KGOlR(I9}6R`8~ zx92_^&Lokf+i_M35gog!z1sD@0jxKI?s+s8z?*Uk%&A;>P}Ycjulk<1T~#>0B%WYWK&m*d!IH)Dd$`U@ ziM*T~C)JsJPM=PxY2%jYSW{+P6xA$DeFBZ~eBhl3Q$HTuu8>qx9=pmTD}d5ddv=JE|-veG%t|B5c~37MkDshPAo_XI3VzjO~^Nsi}#kZniB ze5jeK+f90-`zqs10A!wqO1!U!+MHoi;3o2`mfr38!T?I~{E_ONYV&4jEY_J~+N%Mo z?*q*Xg~`K1zjQoP6r~}?N2wQg?P9R{6%2W2F$bT`3R37#)c2i@x5)AB=);xVnv>cM z)9k-7yP16odwSOdgLP;r9H*pj2^>95{|EI>OMHT%gq`o4C1_M)sp0{@&`Oi4GbtPS z)X5tjj@7L1Y-Y_=r}jD|Vm#BRW`bQ?;0F4!{;a1kJMG=(UBPBBJD(#+o>%;Z$H$l->IYzR+O-8#&jGRMu1*aoO>wbxsGF= zm`7}n7iQaKJEwwg;0dX7*@;vb-8y-5lLdwgNgJeo6Ve%NeV#9Y!*35^*0*~4HHr_s z&A1TB=CWg)z)p!m;HJ(v7_)N9cIL+xGJCIegpt6-@pBtW&u#xX)o`=;E{~PH|NWjB z4TjHTiCZA=??akduN|X>9m}he2vUpni_1g|Aw?(SWdpFwB-bC9Zu|_R&iy)DEuM3$ ztY>Xly5)YK-R7NQOY>e6l?nnX542J!E+_|T`4;yVg3_ih>-q057f^vUY`|o8?Ibwd zh_7^q)q7KXi*Zdot1andI%QLhUDaQ58Y zompaAKS72hI@5DVsonURHEjr>%4Te(4BaAds37}x1cxZJ#-Qvq^|g*ltG(n7K*gx= zu~Dxf5t0=rp|snJW+u(u*9z+u6TdVW5g%mw+?|}%0=NqwZG|=@0l6Eb=W;tWJ%N^R zmr#~cP?{G@Hm^IFV1Efb)RKJ^mS<7_@#x@@o#0O<=gmC${^UWe!GN!>JsKd0iPr(L zdU!eHwpcsy%TXeHwK0i$KYOoPKV(n0*|$|sER}Kc`fE5gjJwbRYA<@GllHN!5d}bZ zZLSNSEY~RpTvAiNy2MMlEf?Th3b1+J!^_plV?{2S=-~S?ZJF zaKZuQ%fBPymd5qUHndOr7^Xkw0JUK;%xZX(l$l!dkULHN5$ls)!WE@ z!J~35LwC)d1<&e(pDqbDZ|6`V*A*>iJ;jGFxrPOOrjR1AEBf)AkMu{YF?l?pme=dD zjN03uT`u4kZ8DEIt`yL^3OL4lvjxdVkj>S33qVN(>gDrY_Ow5V=iqKD+v(zwvNPY! z!fVLS_j@+M^v-3ACp*HNcMN(O0G(%WTLgqRD{&=QdJJQB^N*0CGIc)4#Z|Z(!bk8K zw~t7LTG4iPeYNgV@e-RMbFIx(&0eYz#r!3_e89(_BX!Lx4Sq<$)HUQhz#_;h_iDnb zL<*$i_jw{gA_(uUE}P)9ua8g{^-Bnjr1MMQf?W+#i5FCsCe)Ww-kQqJY&x^t32+y6 zqvyI$8GFs+ZmA#KFX}jKc{(K{HawFsr-Uh1O_9;91Seg$-iLBXI4}_D- zx3;@7YNHROXxlkGu{@w;md+LpMb;X{4Zx$w=8H!#@I_%#tPABm)?Ag8vrrm@i)Y63$irPskF&XK*b{m0B%wq!pkv)erT1Pjbhx&2aw3)l)yB7pJ4nFO~~zbtg`Noc>h7Rs)(g|tA*>>*WV(o^59 z7n%aa?7Xad^HIH~+B|VR|8PG$WN{I-t~PabMwK6=>gomxBUKT>u$?I`*TyVh95mWp@g?dtjAX5 z00*;n{?vFg&~$V5z7qc43D3LukE*D;ljEP3hl_UA9nDyA*5ruVa4YAT_C-{eSk@(( za!n=>c9U&;RSWie6lpywMt z1V;+rZ7ieWJ*%05@8;T(O|E-^ReHO>v(GZU z^0TI#bDPr!1w-HLk<<5FI#f4(kZ5YjXwtA;@n`7|w*vpmTO2Xl{2Gj%3d*phxMSPy`hs5?-g?lb%yc({=>g!KwEP6@^FE2`XKw`?<+w+ zn%(Jcr3v$YB1X56e<<`-{tedjJ|u#tZxtTm%+xz*DYh2#tS^6?M6La4x{&RTbkBPO^->&%U?RR}z0Rf#TDj~+X zI=k4MoM&^oK2xwIU$|nO!xH=0SSAvzFDLi8<$PRzyv9n6#i*_22fEh_l9XLv`?-1n zExOOKYJqa*OR`Ll-=?`jn*lLfm3NIHZ(n4WWhq1%4p}$jy(LTVRiuvIUIDc*W+L|% zn(t2hcHO_;#$<=R*sVsS{dADcm&ng%nlt2G74g8ZXFz=6c zd}DV#tP-=S8~Pe35^iR*DktFN(rznM(Pyub`9_09^`$i0sH)Sk=ce6qVa1$IjnYbU zmi_}J|J3liqByDIc;(t~sxJ})@#veG*wXWFwClUM|L;uaH=!ba$6N`Vk)&M4=f{)D ztb+Xq8oTAkisN!H%Ya{7`1v2>UU{xet4}H2{HI<2<7fQw822f))e4k5)pq(T|2CXI zJ^Npuoi>W2sn=3jG5#~@DJ(Y=_UG;VrvsL+O8fMV4LS%R?#HE+`=a+x%k}R|@;_tv zxrKq26_Uz|qU|rNME?=B{aqIP^;(tf}r(gfy&wkSX8fG8SYaVot zut`Iaa8sYay}vKJ_#yseRCxj%dj;o@!(K;cV-ntt?+t!J_}?x+26~z%k%sx}>)FO4 zPto{I`$3jj1F}`;=>%Ste8B?z^5KyFal}6>|)_)0x@HOZ7j{ z)~Uj;>;J`1_rBbr`!A{KO}h9S^O8c{LjTl{J>*~9YWeB^G2{QcssH|;pD;=2&j=pO zsdWgl%kMv|>2Ley7fSkTi9=g;Qy>4G7XBk4i>KqFIm%-43C?f#`cH3Z#c$9}_o6Qbkglp`<)*sp=Jkdmd)!%dj}NT+|09r>VN z%PN3mr?-gsk5l{m7cmnUnA7Vu%y7y7lEXrA(30cnDyP$f|8`UYY~t?~mBOpU{@X1M zC8n)le9BJG@m(a;N`z zt&LWpcI9{3qgblnDZsG_4^4xLXz`Q3cd_2`8#kZIygz}84W#?PbLHo%pXIq%etNr5 zYXM@t@eNWhRX5b-Ep^y?qA2@ibcxeprQYcoi_U7X#@Efr-TvJrl67dH;sdG;p$9e7Y`QrW zE_R7cMEPlVv$N-sR`4vmhcVXiFJuB{d2-%&h9WpHq25X2v_cqr;L?#{^VjuZ&yke~ zpMtO_Vw1F%X@i=USZQc$Pmc|@t)f$98g}mqKW+7pcJx2U<2B}$Q6=q5*5B1LExq5A z4axd)X4iO~nHq^UNyFx)ftP6)D20JV078%6q%AE*X^WQslVeQ zq}>Y0ww*sud?J#(iZ#tYXWbEwbuOc>`+f*sEgFk1i<(1n7imqjm7$!&OHd|iO+I@V z1pPbXjIK0FLU%L}c3m`_z&_}BgQ1;3c^5>qQ`m2}`X2gRe)(tEt%Ov;EfXPZGcPS5 z%18h5Kt9f-Hww1DCjO03ZDT^l{CDYwV}fSA?^mm%+<)gJzhlzSD7m4-)gg+tCEfg} zv!XrxZyDdX6qLi!#!gc8vQ6Xus^JcXW-2R}Umcreu-liKZxk^1n+JRad3yQNs^#W9 z%?=hcQ!ljQ`WZhlF));NwaTpcKX82-8|fS|^PoG|cp(|x;I-2HY?`XdY>u$GJifg& zHc(N|bZ~j`5CFK_PAuMm#~RaLCHXm3kiduWM=o{S~xgcdCqX)B3z)bH7p~(#!j58*?ph*OjL5B}g;A>}j72 zD}Qd0{#dCWnC4~}qG|7?Npkd5sAe*iqrDR1%q=;x#ptEzM$+L?A;LS8FHlf%^h0_wq8YEa>Wp7)6oD}7&z-W;ukYdIZISLSk$=DU@?iY>ifTY zVt?tjj%4A9HSymChpC!)fPp8#ihgWN1)yCJy#=H?O?OG5YQF4mky@IyTP@Zcei^Rt zS`B3?pU=y-&+dX#yq?X%)GSnoR@>3yW7`-`9@TQEM^Pu^+2&Sfy7JdkY%iKp|7ptQ zYkn$kPt^rRMg5(-90l=HKL+E5TG7)0E8o-|&9aG=8@?Elcw8kLV(JN;7Ji{s=EAZA zZdD8ZY(v7E^!{7+SEoVKrdLv26O#q1Dn;t7i7SA`_}n4Kf$s1}Ujjm+e}Yo#Wg)5z zt;I>wxBP7J&daqlo4OMdR_{*uTe^6D(pjw3l});wQ_`sl8ytkJn{oY}?$P#(?x&9A zSVmLqf3DZE!8)EaVm3Dsc!{^#B*QpHM?VA<$cH1s`^&Z?H5nZRxf!^{7fuvfrz&XID&EKl zJ2_#S+5A2r44e`OuRQOe&Qm=SU_3nw+-&bgu}-u5TM;^_^2_b|LXj&Z6L8vk$Ce6) zKJW=c*bI{YW`hS7caRqn>_KWvTW)R?1k5@6z0Y9}$VaQ?f3n>i$8!AQxd){22?yVS zYgM_c&&o_AsGQ`$J0Ev{XkC;ith5l`j{o{q5HpTYO6v73zkS^8V}eBiADCW&kw~M#cyVlDQLB`+;I!_3qO>lE%u1r#N@1-HlvbxtYtb` zF@-jDvu9pm;F#)(qkJJT6=U{B`2aS7E=>F_X-Jb@%08r7t3UAt6Z#Mi-4VQE1c!{@ z<*MQ#o9Z+0;aJPEvuOE+aFNE)Y&+j+mQVifV>Fc6=F*3!QlB4+YAF7^{CKuYo_v6{ z*%6FO$v1nie5y!2K8sP_rhq}r2&_Ev#q$e?<1;gmck_vqPV#XXZk{Zj`*)>Jir>?x zs$ABv8Gml_T9JsU>Vg}l6+ohphyYZ%o;dHL-_{lFk0_ymUs0X2g&O$HdT6fRO0auC zMT%&CiH?oM8*bIrU$|-)$a1NL1mR7WaSa`-lBIzSJwZ#IH`}8sio0MuO_AkOA2`v^ zO!`7p-`9A$9E`(=Ae_`5j1aY`fq8;vv#pg$@mgh;8ySVK|P@|4A~UyouwXO>9>)x z6mLOR_k{!8M$KKoNc;(Fd7HPX)Vxu^K<*foD`bGl|L%A0_%5EIligHhZRc-0S1B)Q z(4hW2k%O{EgN3Cxr>>8GVzVT#$_2tva&DJ~64(LMMKAKP;G1-6 z)HfkhQ2qC;Zuxa|_E&6RBv7W2(`@~4&f%=goWd`Z%+WudCqUXh!D&Mk1sFJ3Ti+C@ zI8vj}NTL%b>6{d*sz@TcX+2*e1~QV)-rrBvfJ@?1eV(yO_NCJ&}#4qh>ZLJ zE?{5sxiAY(+ON6!R$TVQYyg;0XQw;xRxSVMDd~&(;Dgy#J!^2$&hS=9Sc_+H`txuM zi-*Kp4(%nTEQ3ej3w00Y`Q!UnE<<*VYD0Z@@7R1ATHoN4OQDd@@e1he+FExiWavaq zrORWR*8eUgX^FMPtNS0m^h2L$Y(fLY?r3q!<3D6Z!@r~SW@{{2UDt{sp13J>KM@RK zmQ_a|6tp;l*&8i8GCsZL@$@}XOlIX< z5LK#?d^fPz3SaNC;>wXqxg3YC%G)YO8gz1?$%!`PZr)HT!$mT8q8p<^|B47mw0VMd zxH6kP{;Ua*U`TfPb6lBwrRX6GXzKc?teAtwCW%M<0(jeBuND0M;QE5MKsph5MxzA* z*1PVGz80*pd9g4e_O3|1Y`-*pr^dW(2jccg-{auo(84>9QibjvrqX89rtBR791L=t z!K;m;SVDBa0K<@wWZ2%+qSSo>#h&EQmXg$me>djE4RN2y%JEtaN6*=^55F2hMarwI z$8k}f+C=ny9i27Jgl+cLIPhRC%si2l=OBsT8oPJ5)@REeW;Ucd=2K(6$n3fiwlo~W zlDyNSmzC`^cU7-bxb$txc^tL8)ZkI<4WE#M*a=$J#znBu9Sn<3D4n6Li7F0dk-Uls zOZC^9hr-PGsQDM=NJJuTI)t8{LMsLWk0|sEcInKk z{bDO+g`#%b!Zk&+bl+v_dAwO&pMGrGDSXzo>b&`gft`JLYbgZ+A)8w->FCo3r`q9q zNz&S2Bo}UOv4PC&vWcxZ&;fb8w@Zv76cI$3fSZyBU;KD-S3jI>O=V2|M&dAO@jJ>j z3NU6KyXN{8LClT~Nw_;1ObIkI?Pk2IZ$t91+T6~6ACmakvR1k+N6%Llgui|v%e67O zLVsF|+s{I-C$S4II-H&`yIwPrzPHU{CLixYhH5k`7KShN9k#eVZL>DpnJCR3Dp)fZ z=0>YXql}M`Rn=y76`0lBZJj0t6>6Aywt6(%Q{Xe|N})&&oi|0_XjA>~D!myuLn+%P zMc?Iy51x}(&vUuMBeil>y08E@!Fy$2I27{h2vstr?pSkI^aurNphR2Eu1g>Q5wxv+ z%P;j2vnH$SRZGde%&!x6?}0e$dE!aqxw-F-3{QLXj=tUdcr?JHWqAK(@#q(NSnD8K$c#Jy)!6x-JKs~`xHRFZ%sm7J6uB#Gpt@+s7Quxn$+YBO>S}n4b5Ag=bSV4+1ve$GwyxIy<_m90##kB)~u?v z=KRm!Y^wAX$WVF{Mo1g~MJ&lIURrVKM@X(!1D@Z6NDqfvZsiW}a!tR63>+T zZU{RI&{34Lz-ylm%qfKxp7oF>v;^@H7brz<4-OM6r|`$a&`0mwH^;u;((mpEhE~pD z`OX5C7&mXNHq_Z!OsNhyJk=XI^Rn>(DMGFK8x{h&Nc**;+*;ff3UUzz6$t@sYXb=h zN6qdk4fD89lWZ}T#S(>;Yt1f!Sn5cPtN_Jx=eH!{_dYClECJvI^W{~R!%+y^U{pp= zUhXFRfzJWm=4@54YGtaJ*?PcflXv}2j3Yda3E%)#c7AubJW{0?>&P&0cGON;dL#AX z9j_B8f2_<S8dQ<(^rFM-CVDJzkMdHP^bdkm$#j>9fx zcTC86KZ^aFk*^Z5i)555QgdE>j6no!w00Ph>h| zhi1CPvw|RT{A%!7pt|2vhvqrib61O9QTUvb6VH2{tQYN51SkFiR(q}PJ>yrK%?ymp zo>kteTc{TcF>$P#v5JE{1t&sQc5yMR;Hxr7Cgpg^K#5bUP2@>ko7EPqgza&t(WAJ* z1@#Md=nd1W6ysxYxXj7 zZllNsVi!6H?$jufsoixQ?Dhs?gNttz-^?nT< zsly@_#uFdi8h_tgBFTjrM(7zPU#!-Y&3V$?JPEOemd8y}4lw~W?)=;|a+|?%y zgv2;>QLLHNHDw|o525x8zw$IR^p=N#Tc`5K#H~$_y-6`cINWpLdZQfi=AF@HaM_8d zZ;vRlkFDYwHrJryciM&FeSB~o1A!05Z;cn9m!>$pGvcK7&4X~KB^@sDj@}gg$0!#y z4?`X|`XU-2c{7g9ue-%hKDW#XS><8RxAB;MRZ2b#BG?e|+Rq%kI3sR|R8dNMroKn* z*>bs^0Xt`h5nA}?bLyjOAg&H5Od@esH%p~Be#QsVGy9MfM~`51ZMEY{YUiBi>^gRK zsa~7RFHNngVOfRL)^lz&ZW0n|Ut}*_UT4jODqGo$7nl#|0s98}3wkuWZ%#g2teMt_ zh?K$Ipx-1n)BE&fMbK7(f>Uh)K0C4*UTW?eqE1jaQn8|)^BTF)$qgFI+hYavr*s1s zCtJEshD8}d|F;MMI2hnoBci$l)9W2Ak(h> z^Szk|a{5M#ZCGO5Z+WvwMe&IUS$x_v1mD5vu-><1O*0i&q7bJe02l zm&yc`qC6xK<>sGo9o=XBw0iMTN^N_#3-I#xg$1weUH3p_(SQh}Std48h@ob?82SAM z@$<8>8i+{Bq_(Iy!B-!61necIck0)1tEd|43Y_<>mAp$>LSMh~Tr+;)8h>RQ>&S!$ zYm467_rVv{N)YzU(@$6+C+S5nNud5TO8BQMbMcsX*opH?^RjKjk(5ZOSkg0P_g?HF z_L$dw_H8x0QePq)P%tnQP?iaW?`|6+MVT*#{0ppQ-4Hj)QSOWL&b#8dVSS8?v4Qh` zC4J>bIXqM&+X4##@QD(GqOT&mO0gXJ-JnyUBXk88c(LQ{m2#r2MDQ)%w?A3J;gFin z!c9N=m@b8IOW#9m@KngUw&nKq)ub1d#%Kjn`mn2jcA&wSBP!4^ux!pR47YuBW$S2w z1yGCk6UadcPru~*n>0Y*;&J?%sZ=DYSQoq`{qS|UOFhik^_?xRoD8P8LIS5niA_EU z2cbeX3Vg1d^``h8xFk#M36z)Bte*>Dj?;i#}+oV*KWxe)VOjt(5~_l&5y$@KkndyJ?aEvIJN(~O=w z-ok@Sp*BZ#N9T~$VpR9}9o<1OW!i9x+(0IqR}t8K8@_?FWdbu-n>Cey?B4;{l<9}= zv(G@LU|-uvB&qZI##(lc9Bu?73+4my#K?!9$aIT=n zN^Sr|z1xcYW~^LuR3(r8&E zY5`EbKj{oTvs4`$B+}#EumsG1XkTw_*RL%3K&?)Jl;ZiNT1wI~(qmhxAVBmS-81&B zbIYIGFliw`&T)6!w)65SQ9Xj}QZECHfq6kyqBn0o|xxZsw7{IbSeT!*&Q}3C*#@XRg~}=J?n{_e1NKYnZxNQ%BlK3OZqN(2!Ac1| zUXcjGane%j{4Xtgs%_%DPZx72XcgLoJ!ZFjXeh^uP~eZgeREX{KWB&;n-K}f1#k6c zW9N2#sfwXtdh!_)Hc!*{DjStweKM>iCS7^VQ`*DQ4r6dDUDH`apNoMn292%|^aTOu z)oVNc?gwuJ#3*7?Po}&h*mTv>uR0EZx}^yJ^QBzekz5P5mH`jO9Bn^>1=Fw9ZtQd2 zsLvzp`WI;Dd8Z5H$RpyPWa^Lj9_;57(JH`b$n^${1C*&;OQQN-@=QO+^k@`edix4l zcJnFNIYIbyI`LrX_ZZlMd$?8=0s=Gk`A(RTe{`WVN`HFXwqneC!x=niC#OmRua79sIlbe$u&vrz2>hls9yu4hPBn=ZSF!p6n)eYITv>6;j~TFG z0#d(KFuD{;8W3$uIo-{Y&Xf{gMWUCgv;#(s~CRTZijQb4#n-F$>5_OONVN>Y>AEfLhi<}&L06sUz8=H!ZZ@*D#tc;EB zNb0Ga8o8druZuHe5h*w5IVee%2#Q^{gdLpMAD?K38M*IG+3;9R-MA;J?SH*-*Ff*M zO*5w%@yZD#&De1XnDPZQb__WlaMTbQGu5Y?Fb6wa1FHCThF#q9-E8Mw$vCo~Gy%j- z*&FETq#N8$n+pPb1D`oZZwLe5Irz%5Lch0R%SNvKLRDw`78f;OY1_$2&!`pQJ6XVn3a@PI1MV)uEOOy zbZnRJ2%0#+soYQkm}lM$J>K1YV!6qhNhkSJOBBENE7tB@>;!6g`PjYzncLJxtOb!t zZSm`1Eof7X{^?)UaQ|>(p)msYRKMCj+Z?q(!SML6Vc%CxN>swv2ml&ZCwA+>gvj3c zRwYgw*ACztUVTX$WAUw{Rt#=W^<>4o0D96BSwLvEJm%kvpEEpr6tO;}U*AZ5u0riU zo+a&Gh;f~rgxjv)It+U14NQaN9^#EvUtxZ~T8vQ=ml)kXn z;@h`L7Q7OGC$gSj{d+(RpKLg>NzUk(tA$ZDAQY75KG5!OV@!8Sgb!6nmh2Sw{nS#G z^nlORy!ji!P~@x5ikP$g=*Rp|r5e)C&?LkUbmYIr#Q2|z`cK%mYy(Q>rkhwG$tdF) z&pl@zuZ_E`9TkRl7_R90I*)~E`f{m7Yay@wD1Xrf^8oMlkn738yFO*^XN=Tad2d4Q zfZC1}Ilu^yXpz*fH3r6fH9Z3maXU=I;~L2?Sq{eb@7{EaUpUR!Aa;9UnK(oI+0ux6 zL!tQtcSu>y6E-U{fHY?n+Ofq@k_C7hHdmLnD($gXe4kQ&+Cj7G(BaCh9czhv&QZ8u z59m7&!RAdqswlFdv(c@cc#!a9#m=l^GDD8{c5Nx!yuV#Nzr)c)*~~1YV)ml+ghn8> z;3S>eF%);ycPmE7ZH`|oGo+?;nyN>i`&?G0@CJim?h;7Ngf zo6lp+8RcTr{)i2|Z1ig)P;vo8^=5|7^G%x=UaeBhSa%+j>orw7gc38a3>DY-b=^5% z>dDyg-Dsf=c&b|-FQgpLGgvcZgB(G0Gz|EHI=(RtPnA71Up64#hZ_UU-XZLOcW~x- z4_WK98%()t9;Y9~1D5NJ?Bd1veyg6b9KW7*b#17`J!V}~rt!oI?HacuTHTX|%;^1S zc7Zt3fDr4r6<6Ho`Hd#*uAsv$vC9R*B3lf*=5clg2D}iov72vXuH29I&T6i{1}Q{s zkcdn6ya}0MZd!ao#DjP{d=+>D@MUi4Rqq+V!waD6-XWd2H z*IOC)WMJFQ3KVgVLZt9k*_~x>dddk6_5K^A@lg`yt?eZO@z_WWqoGC^?(&rVzvgIw zev|+S@;b=zf9c-W>GJgVa*vj z;1iK$&QmU#;2)Ki@u+d*@-DkXmUX`J4#!4nKx7!n5Mqx^^>{dJpr+9F>m^x{}8Z6sCcRs}zj#ihoix3>%#19#>nU8ut7$Kjy}c(Jf1CA8uCM$4NZ}Xw5YPC|0L6QrAr)eu z5$%x#c!xA@61<@Z=v%}OwsY@|+#zw|C%N8D0~=kl6He1#AL2oh*g4xF7*?p**x0w7 zH>mjr+?oxnLSJl-*T^p^B2CvEbL;nC_>dj<^4I3W(LCu6O(EG`Eee{ssdojJ`Wg8~xTtj+C!^W$C@1HEapx=_6;se-H z_?`G?x_fhpJ6TUQJxnWyMmWTs7bU*ADQiR7d;8loM)A2CS0DtNpd46VN|h|z6DI09 z-OnSMVnbvb{(h!k_73|B+;&B$hwwdkEw*?|oJ}En{K3jv^4!f~)y)-yTidV9%_`cv zuUeM+dT63gccm()(oq;hh3_W+rK1Q)SRHI+|!W2Y4#tu&r1nk+=O-J~*j z(p+f(0;ANP)hF@tOj*yP%RQSHDa&|ryIS^6aa%gR0)gl~@a+^FvRvZQfB+quvx?fw zVb|#ozcE1|VnwC{L}mh}>y3rA!(+NF!V5%V-uuh0LViAW-9fmQsLWtdYVg?in%LNc zPBxxLij)Qai?p{*`*S?|J3gh!;w>9N zU*Z2BxEO=46z4&4&md0JdywnoFxSr#9$VvOW*i>9X#m+BOwepSlV3L`5R{!2&#=HA z2Yk@;sqV8)p6WIwTw;m@@2c0NSm(#=n49C)LoOQ)f=jT8cAPNn+KrmWjI;?-N3uJ= zZCNfSu1F_^FgH7_R9 za~Q=nX7laf?uj0TDWNy}{rsw#V8@HbVM0w;)qMXM$NiV_m_Ld#&$e7=*oj7JImA$h zsfpNmQj4)F3Lto-#P4Yke?S!WJ>aojb%th1rn;Vsm)E7~gIhr)!cv*mR*S$0TDZi% z2kLe$uV}GXj`Q?jIOj_^VfZo$L2c93o^Pt|=15b{5IZq7HBhBcP2}f^*UDa#xJh^L z^%c6s{A6Y{f{MSE0_Qk0ISU?aQ`Grk9o<`em?yZhvVUW=L3 z!ZwF3h(<(F`W1FR(Llgq5v4Y_hgW)22Bbk(rj?CPa6O6K_?S~cK-A$vX{wdsDhlt2 z+|MQ$;T~*h#a}m*HkJF)e;nR@oK&;xo@xA@yYN0G$hm0(<#WV7>mq2lvt5k+G;Z`v~W2yGrr#*5>6*?G+$#NRH- zkv84XPUZ$}j4kdhq`feL;9!W4&XMFg<1G*eDm=&a9U2v`!Y1k%!zVsTF)WbetFs-i9=%Y+bTabU^*FcfgK=9= z%0W#{Ua(BlyJ>Bog3f}x^JChMutaAgUFHI6`|>lB2x^ax^Qp=`J%v2Fm2Bpl%dA0I z1o`K#Q0?rrVh7Uxs4Osf5{ht(1A17xe`UBbF6smmY2bkxd7H z0NGz&6#mVIDRauwojD8eKRZLN-WmC?!bv+CkAU!}OMw%GXTq;J71*w_&%twU_Xyva z&4;lzro|T_b~rO#x2Hxh`QX{Qt4PI^LMl7UG(|;czjf2W#LQY6Zp`Zb(qoWO7`N_K z$93OZ#n1tLgi7Ur>rn!sX@PVw7B(R@Comy^({Mg}1_c=jh!>Qp4o6td3%S2xe&P?_ z9A=shAh-oJNrOI?o%Y}0IRK+*qSCs%SppsAENgl;c%~>GZ3TtV#sPrV8TfV@R3)j zB#s?9%cLg|J5nVjl3`0ZJY1EA;Lf;{PC*Uo#bu=gxM|rz9RDC(ETpj05Q*~7U#v~E z<-!iS?JDZZMj$`45+Y7<1r?u8y*Qrtm|nAKPaE5YWh?vIj2u49cw6&J{i7CF{4oIJ zi>X7-ZeX5peYCERiCuVsxYigB4>%rTY?-T>i1JX7}nn1RpuMD3Z!AeF6h)LZGETyC0J)a$R;sNfb+#kx#Kz%SClrXfLvOfPyzobGoNZ zlF?G3eYq?))aPKa7yfPN%EpsbOuU zl-@pq`>m#@W1Ey3)J=o6`8z9Y;z>Au#q=($(i!}f@9GbQD(~EV0qXi_JZ}|)Ei5R# za1Dg(;t1h}bbvrf;5&}lPVxP&@PQ*$u_a43C_c&minEAC);4f}LGv()ZN66rk@}9+ z>l1gpa;AP(VK%^d6^3J>152VL;=`T@RPDRH)9m;>`1=N233%J$@TRtA>r7i=2r z!T+II#BphZ2_m6goyzrmqDC@ZQyCXx?g&xGby|XQD9ENVZk~2pjQWkjwiVo{zmQlsqS0#mtUwj5z%on*WxW!-5x}Vx&JE#fMNs#Q6k&DwivHx}wnN|c( z0aEU3PWB`*lmvHiEBmdWePY3Wpl*CX-~kAJ2`hOWp!1J?mDZEPXBU${RShXQE9-?q z0R3dlS_(YR;qDI&%N~4Fa#QV)Z^@M{Pk4WqazxjGTYGmji#~8F10;|84_W=GI&zry zJc4WVluRHEs=}gO|9R+s&XHz`M!XPDfl!Hk!EomnaZ{0_2WR%^E*83!Jyi! zg&d**5vSHILY|d586*;@>L3@>9nl&tl{`V0y&1!lWRk@;GLC?u9_h9&@<0c%gFX>v zy&80XYQv(@Xp+gwE=8A(xvjIJCHUKAOYNx1FzO+=n&v_vO;h>*XEZ?+Uk67~4>+zTH^mBoM5bQ~7nFkyfmjUDMBO*zm?z*p!3?|g-m25H~7%js`iU=lxr>^~rl9;LT z888#nC?OIej+Wc&5aF4!zK90NLJ9 z%B;us#Xi@^n$`-7813L_%`5I}&ePI6ZaVB9u<0D#^nki{CB8ll&@x6?b^PDrSFrzo z&9B%aUI~l`KiLu}rBpWib5e~2-2etKOh{gHa1SPB(=xYfNu6fya!SlF5>*ci>Mgpe z$!NWIwi+YENc8~`SVk@A4D`hZXBNsRZflc8l~!jPGslLfEGi%mY&w+I(l^(zr zLPkzCfJBI4Ecdg5pI09lMSi+`jEJ~LjlnpU-5IwtT{m+}l;r8nhte;363n##XiM8W zEWD}6H$w{1FzF1_8P6SF3O%(9K1ycwYV&SgE#4WWY6@G$uw}gC*3rzov=&hFl%@ie z;t=bS@$qB}a_5<(N?2J?^X+1Ihhe3+=-#|PYNu(##AQP@p&qrFQKmf?iA zzGgjO>Uaj>=1g3z;zX8cw~Xy0Wz0BC3xHO^l?iK!A` z93a7yCvu0u7h_w%K1!1*l<<58Unn}U(O6AQt-7JcU{XOuPPo>IYrNz(*!(MAn0dmV z#HFT;`)ku-7E8?nFKjiBSm$beKDc(Od7nR6&+pQYO0~^v)vx#f=qh7%;bEWiu zD~iB*^a>E#eq^JtYR}4em@Bj2^-o;IMohJsmqYZwh!xz$a6|1MxrtmZZ>;YlT=V~Q zG8Nh&{sUOwNCYAzw$Ac=-TP~0iA6lmcwxR}3Divb4KNS+JB&aS6EKKq!CCtT*ngCK z3}Yy-y@n}Ismxrn$BQWrk3T;#`}dgd8>(IKc^fctbwI7WE0anIuUB_uzhw1%`l&{D zU)2^e{}M_IWYGL6rR&!!kmz5emKT*wX4@78l41DI41u6gl}yPHv61HPOal?8xdxiY zYX6{3%(tliP1db9VhIIkHLK2fK1l#lFF&s0bvOOR z7=T&+YG9DXK)ifm5TAa7W1Oh(>FRaNI{u%Uu2S?DY(;Jc9UPFW{#n;$abE1k0;p-Wvj=s~~83tkD+UsORdHLuBBOm!>eh1cH63@m)!Iq96A$W=* zcSxVGvMKM2xjQP52@Xv$v zyRUxrjH_7^xEjy^{ez5xY0sOPuN-l21VE**+&AQ2Y=7)RAH)~!r76VppZ)rKwF2Pq z`tTOJ+r7vw;Yzp0A^ypZF1tRlc7JpZ%3>x+8B}tIp;!T!I{+@fsv*~$n?eO<^p)%G zty`%)zq{Y%cYeY?B=~DpNd_&Odej->x2p{bF0hMzSS|AKNhewpG8e(#bndNi-&nC@DjKXT-nR z_W!6g00iQHc_;k!vH<-z=?Cy$=u+z(0EMwXQt0Xmb>p$2`fpqH0Pm%Fck1i$IQKjzZsaJjYriv{p6TcpeQ_4QHZBpG`7 z$AA6T?%!n3(I*@!Nf+YZKBd16RY?Fwaf6xtFT{<%>+)Za znA06)lB=x$`ZuBsgEn>?AAo0e=UX8B6&eQif&wx1|7|b72VfM;+ z@WU{Xf3o~bdgR~Sv(>U2L44lZL(so{_55ka;YZ+r^VJtnrT@jC{{!mLN(vAkoZ5sa z|7r!l>lYw?a}PKm!+<&Y2$6gpY~&hg1Kt`mLPEt?bSho8DeJ)0mexysF|F#C{J(89P*+&#;kvZw5boB?H z=lC9LpZ%0brHsIb%J)z1j00tV{`@D=%oIg$C~4v863rBf#Sh8okV7)zV*as@|C?nw zZwv}Gos~rsRTY(~+`@HJIk|py>F~erfyY69jw)kqxkTQ=R&tL=`9~x`zqxyIRJXWy z0ymqU&u*^on)r|$CO)5??FC2fE&;EizqI9lwn$7rTHG;_6;(J_n|r=jZRT<4H5@;H zTw53|gxi$VY!LkBICE|c3N4)#cJ>K#PnUcqQ&pBTAl7$upm3m$+R=R?{oI%Fr6?$N z2pT>4RmF!$8v}Dw*Zj#EL9Y}TTousy_|c<{kp1Sa_;*J9vxIlDZxhje{n8-dz21LP zJVyMIJ>fVqj@n zX&s8F3UP%(%G}_;9(4of32_iUTdAp$m{B^3*RIUx#`ShV6^iK4`$x|MIb#`{zrCT| zQ@6#n2MW8&GpSxF646r7bdMEj#<0e+m28_{wwS7BsI_p;Z7M8kPFDvIXqFkslL`8- zvyc1KMbBRQUemA|6q;O;GDKbUCA!r5%=skmPZb=4-!|OuO*`&eTDmt@@75r=qI41e z>hW(IX36ksa5Q9|H6f)ntw!(VHyfw$=N=(gDaIItzOvC|QpuKoZ%8K6pFStuZ8=0a6G*mG=!`&LC6G;c`BIhQ35j&+{d|2=Fg7tO zs9x+)i}|}(O_U36Z=n#h8fIf{#BXuGXQ8mvFL zOM3O;UGTMRLvTFKGv)WXI0`05g2(JwSQYmlrKt8o8br>|@SoiF4Hhx0!Q#;|FO8VO z=YPugkgW2|%lB(qqpoFxQXhqm;1TnxORI7vX$sv^GHc$CBRIrnG0HT#a6MG~5|zzMDBQQ){ct=x`FJWTm-~nfVEs9)$cnYU^`4nV4>N-TPc8 zt^S0T%aMAaA!P!+Pwk+y-*zbyxUAFau+ZiagPyO7L!UXYI2iC|oR(fiU_jEz9Ooj+ z9D4L|?@Q8A6XP_4r2Pu0paq6AYC3Xq)e+_gu^*3JS}bd==8DbjFiEWpFi`xZ`Djf= zD2jt}c$6uWylZsDdK_`GqZ-OI)$8+b6Jxta!vy_}!Z9w(&ros`>9~+xgn2P?a?NQC z6wSH!cvO_QLZ5JlRk3dqg=1kXdo@i>}0 z`sfN#(c}40vFbI-+qZpl?l-(c46l{I{_(-vfBJJd<2AjD2@4mVWhp`Qi?Nv5Ag6Av za$UBR&Ea~2Iy>rZ#GvG5jOg0Y0rxJr&DVX^`qHWXiKp?X-W8O^IbdWu5lZ`;FYAq< zRi@$Q4@@4+>&o+-x_Ks+lab+M98i0*c!1&0G23WWQ{XBl^d7Hhr*EN;cmBoMXeIA_ zXD-61_sW;IDo~&%o6^w%wq?B8gPZe_{8&ThaLqg%sBh?o-nf@6V)-((iaE18f&=HR zME`xkMsHDqV(k!6xj}q2fmP;&&d+l_Sh_|%h`M;TGTQxi+wuE;kgI&ri@wo& ze!Hx5PaivuXOzqYCFB-{uIQcm$29sC+13@ljI-6qa>QJ+Wo{7jeTQP7e*h~W9zvgq z<}94u!h0lDP3)C)l)RHBg-I86BS=vjyREiRX5m&#STl*B4s9Gg(#+VjH>$JdIWws5 zXHdh=kB`^vA*nQuGV(}TF>Ya%K}pw^yk)VumcWc()fro0Wr|GanB@q&`RCrbcm@8q z2}im)^o!(kVE0eRRC-r>YQ4AlmsE#>^!V*w0Q~Eip^cT9dRs|2*fN3}wj#|FCNsJN($k`MYur^6|pz5VwwI3F>h|5=_4`Dca zG<#!Z>axY!1@%)d(zxRSum<^KQMECOL&5h(cEfL*KXG$5`*48d5}Y>=NiVkdO*ik9 zsFWqw+V1)YJMXI|naw7?j(yy+ltuob`PmcLPMjHm6fGYBjd3Jt*g-umkiRb z=y!9wTxEGv^(DNrT_azEWoxqB;i2QbAF^=poUipvWSaZ#g@<>$zh7&SX88J8Wk8!C z{2C$^ws{!GrqOPo%lf)B(UCWFt|Me}>ql3(Mzgs*t9o;6d^uNwxUrbt@zH%@U-WZQ zR-LGM>a+TLcJ+z1j-4{iu6$9?XGMGGh9Ur6m@-E)|2>#u>F{pV;{MDQU+wkVAPP5| zx$36M$}yRi^jg9X)cTDZ1E#;5IgDTg`IS!5xReZ(&BUzwB~tdbRhkicEjx$AjUpScXcUJ@#cRQNq2Z=bJ0u;eA}j zlGCkTVjLMlhTRCgx_6YG+sfzR39&up&mgmt$;vBx{=Ea@Z(q=g#hzbJAGQp-*~18% z1C~;?WMq~xe|@Fw>GmN({>O43uCpJFR>YA~g{Ii+Dr%L>T!uxR;*gZ+=%P;#Jp$|z zV6Q+P)t!aMx4(6acd=?jql}ua^45}ne%_f_Q&huAX=}f2AjpVq!X57oSoP<*7vpqM zbT{iY+z|7Tw~nTgm*(eo&7F|X)*z^mGU-uev=UosRn5Q)@2ji#5|5J~g?s}>K0-QF zN+JBk5B007_|3gi2Fmy}$8;w^FU%d$jxKk7N-~gnV6z(T+*- z!pOmHCY=u|Eo+rS$*}sZ6t11d^9EXyhc9!)cyxMSpX^LFrC37F(?O1NPj0c`mbiB$ zqDhsnwy1P3htU3cjW5UR0#+Eet}gVqUd@!BIgp<0OoX(jUxZZZkoY#;#&c0cmCtQ1 zj9S&Tws!hc3R#xEPUX98e_%B{j4XO{?y3RQEzxUU*4F);2S(zuCt8}yDR4MYn)uSJEmz=!u@DHcrI2s zSvaEJQAZWsbXEIAztK9R@^^znn9-J9*+xp~JbsL9vjbkL95c($z_w zJ+p7n|L9{)H={Q&xVhmlrFE;?YJ=_=Un-_j3Qn1Q1p?(qm zwKGoaZ146#=w%5vSD?A4TR{VpQeKKSI>!!<59!Lzj#;R#pSZaLOgzj5F(ScWS0zGS zvy2X_M#(o4Ny%^Rzy=z5F6z_mJLJ_7Ro&xI}AK%Y8Sle~fgk;x0@erf!>EG;dj z1W#0Cs2)8`BiLgx{3%RTu?cvdaNd3!xZCK9gg>d%FqzO|VLCRurWq@!MLJyY-PidP8i7t>J5}=0R%ensV9;8~XuKPun4s=r8XY1{`|wBCkaENP74PdI+0HQe z0cLwXi|&S+5Wb{{{2?ZBEQzLdn%zm(Q#7(zlv# zKZ)u2!cd<~%t7;s{T>GGy5CvvYuk}x4(iFK;8ZimGXq1n-ix$1?D&0{b76Vzq~g~F z(%b@g30vdk%2w~kDceJJB*tnzM3h%~UOI2gX0<7aoWbamAKg-8bzZP*o0g-gzF{{3 z8!fWm9I5qP5c3KADc9_BR6iM@)WM$0g(YHN)UC%^Okgkh?-K6+UZCS3cCK#7p+q}s zj0}WK7`HM>^QD6cj}=tNU0uIneBy)effh-dotJT@tUO4_0v{K>%qw0^9*v2-tcv@I z`NZ`u5)JM3LE;V)0n=2R~5O290gdYT>j!{1lEc=%f2W0t} zYsUw9KGe->(IXa`{5c%@>|*Us0@Mq2Y3VqM5LFuSTp;i5b=m}VZ-Zg{H9Y>fI*a^H)uJ z9xJ(QL485WKZ?&o`F`T9EUCUI%Jw4EYmwG>tv2Df+AB+`wc2%Z-&|0)w>9SMhdGX? zD`;0(9PgyV6U|yYhhw5-HQK=?Bs65K^)QafS-Mx!DvCPum;Xn1{iHJQOPBun@Y0!%6Yr-YGwhDaGfi=nAV*X33 zF2eNbaSLSe!$MwO-mjxwNsIdJl!w6M+%X|vtPkFt6p158J8mPP!6M(e6FenoSeXP# zE37M-v$=dWkL9OZKnz$Pt)N^RLRcj1FHWXC`6-Fu+Aw)e@jzD1I&A9M)*$ee!vo{E zZVu*E$EQMTz4ToX>k~#}Ld%DFCF5gTHSUJe&k4vo?DRK&qUV-9H*YpIHsAY_^X}}5 zRgd%3GYDn5Tldr3f#CYm<1Ko={^L7GgS?$`nq^3w!Y8}h!;%OGF@gH}wB+*=J{y)0 zK6_El{aG6!?Zi{~R+rnflU-h@a@}g>aF4sjEb+dmEa`W7!y{ZnDb*J=BYkZx=AyDc zr@`n2Sg-JzZ!awMbsIrSFN&h8yV}vC?>l;} zD})OclgpL18Nw(3F&0apAsE4^lNa3R;z25)(MLU*Mi^#wFZ%eo@I*&-`&{8h>@$cC zU7*->okh;w^9SuO+0iE2N=M|J+2eK-&|acYJ2Iu?s}=wHSJ|b#l^=o!SS>ii&1Jsu zd~ls~7*5q)u#UIU@rxPl44xbrBEln6yPj{$Eqvd_*>5|TeZHX1wxp&I5^}UYJoz!k zdVNQTwSV0qN1JLm`~0X^{zKh#y)Dat(`;+pWXS#7Z5GKtLhg)!4v4gxiuv*yE#Z4@ zKklni341PO4-UM^jZ+MSPLlYpkxm)6S!8*Ob4GdVCRUq{SNxo?*I?GquO(Tpd=OGL zwKLz6kj&4IqpOjgFr{*~qwZt%Op%N^e!wuVhj6N0q<%E}Qpu+zp}sQzFk`kM zVdCm(*!%;5B+6Puc6Qlx=xn(EyiS{q;=%odgU55vLyVzYxOli(I90>DcaQK@6o+^B zsZLsZb1=9x=-*0MKKT|tO z&JNTXAgydkls5jH!_n~|-M<)HbxAKW5q(dHn3loqGapnThh^7Q?$+5Fm4 zTJUm`djdV}t8IaZnN_ScF6`rc#cLdwFPzQ`34uIu-RuUOP0q9dXZE>_7b~R(G7(v$ zQA^2p*S5}Uj=NIYJ|DWG&3r*4{fPGbD)EZ@cozW=8OWysFZ}Qw^wHtZCjuL<+avom zDjY!N6Yx>Qkr!j@JO?;+&>KvRN|6~d&Q23IT7;uZ(@|yZcb3n6N0+h2Jjc9j$Lb2= z^UGsiCmsZaaWU5yWre9Cev=<#6$~>y)BzKXdI(aVaO@ggh!8c@y!Ng}qj1CLuVha7BbG-?r@!N)NDd1-*bN zJzQ(i;sRL_tVg}H>|460-$)yy<(MmYawn@&>^XkBL;akHKsnS`d3&?Q79|p3XbEy0 z=GJM-SfJH1Nvw zS!MBEWYOKQz|V58(zM$NZ9kyu>y9i-9=Q&z%v_`Nd=T40tA#ulCfg6qHCPA%L^Ouv z|7q{5qT=ehEfWF(LXhAZ2m~)6xI=J<;10pv-Gc=wB)Ge~yA9n-VboOvS}#<6(VjXZSo+y$#}GBSz~=(bkvrs6x?g#ccd~%Npah^^BQ8j6REO z{J6+vXfp02O21sH(u92q8cxm#$6rC4fnTs{XiNsT->uI5aZ35HfbB=sow922Aq<~m z%ZJJn&+|$%aKxm*rDfUM*9k=#K#__!8iWiiJ}aP>2^i~=XB$Kd800#hRx~diz|bQ4 z7!hl0X|K`rMooKbiYucOL-|BO(jtGYSI(@Mai2{XROr!|tb_D5_IA;i{f1Rmc5@U) z;FRTup47akfJvXUyFAPpC5xrhJ_b#xsadPMS)2F2WUBUzhkmqoHLH|n9>-SZX2Vjq zcJP^ZDyaX2!y$A=1T$M63&3%6dkkS4T!})r_@BGGA_+Np4cREq(JA1u!Ig#i-I-b0 zV^)`)N5tD3dr>M~?t#cR34eP{; zFXI&E5L6_B)#NXM_hE#zI899o^{GtNLJrgj>u#6J`!&L8KHor$7)B}3oMb+6e`NG5 zm~&%b>^QkF-|j|-Mehzj82}5*Q{NLX<6vSA(H@T!#mLyTlLCJ$0k6i-?2n%wa5A$( zBbg*M(_S|SHZ47b9@CHb>9MT*4K^mD37-oOUpj=A#Z@L=j}caroe7zpUibI?Os0Wq zQt1J6+X;QfT@c^liY&&=B>}H*e)+OK3yLzR3>;09@H-w(a`V0?6kp@oL$TU3$sy)j ziWyxRos6=@q?R)<(9E(-nE2N9^nQk^SRSk+TAmG9b|`ePc1Kpm1j|jWR1BZu05_G^ zP6bxw`s5RC_+k$Y;}4YY=<>w)m;t2_-VTyaI_rmKBiXujr%dC>onRPc){uo_&b?YR z_^LwVwJnBi7f|=wjiDD0PK4={aHzT34<_qD^PE!x=J?qjeGRCJE+;RBN(#s2{hp%R zlUJ2_3LS3mT}ryJYmD*v3yexO!`dQerue^J8P!!E}3>@tx@Q zx|Oq?|LNu-oe15%tHm`ClU^K7TDspZ1@LO4(s2IW#dw-#<9iR|OS$<2r$eLrw3eGK zx8D%+ivmlgqc4wpHIP&EZI?MaNW(p^?hxj4If4ZXv~$gEBf>Yn?~3I5c{N zxzLf7tCFphqa_Lkbg$;`NfZI|jjnuEXhGd7RbO=)r8#pF`VIY(P`&jIlhBR|(TK3h zoa@T`{mG0zSRB-OW>e{{_79qhm~LN5gwO^^mrl=NZVmMWMAScjKbLye zubL%~*3V1}LMfQ7K%Go~U1PzP(R!B`m!PRiFLfhv^c+<7-*R9!3 z6DfxXrt-c+wt(%wImw2IMGm+cCH+L@NGm(43`Ej-&rcojwJsn9+u5dn{XP(4e`3M@ zJvf!t$Z(|pdKUdF?-S{#+)!E|9o9p#UtWTdrMuboeOQ#lhg^6{Wb z%gK+e0h>q4(**+VzIG>4X zyy&TF$HTNV-5DjXH~0s>&cUI_qK5;T&btu;4z?2PVm34;Y1roP47Qn$ADA8&-IS_y zO25aBBS*&ds^IZfE{eCys-gAKFWz#OcIElVnupQMGJArQl36vUEX3pN#<%Gzax~~P z2-Kw&_Cw~I8=I#H3@GKb?QC*D0IB&a=73)g?Y$Iw*NC$^|n7Uwdsn z2pAJFBATE0A zD?kG9nXfMYcqBns^3Q z$Ad23xv*1{7wd`NLAGN`32Th7_%KH^4r1-$wn;q2+NBdYoTUjZShRFi(!@i`x;*)e zk|$Oh9NNLj;h3QwEdb{YVhj&F)mrf*CeOvfsRRp9t7(rUC{PSt+L4(*;Jv;jk&~ zD&v7PK~Rk6Pg=s)KC%v^TCqUoH+2X@WQLH(dVr&vRA3o?xZFBIlAk!4Xcpi8Ra^K z${eD(#u}GpNj>VENEI3vU%zSZwJ*oG+)%&|(GWvLD?RjdMOA2JQrH$iB5}~$=PpEGrliv)vRpy`98 z9?QfczRHq#=mscWz5w-wTH9hDs`*-Wv!~sBwxnGnLXdPkvKkbueNmX%U^!W90^-=! z+TJ`q?vP6UacT9bc@k)@#7A!GHg6#@W7536n&Wl&-U92$U7Dd--c6Z!+D>$Nhgty& zsJ|?<3V5ief%t=5EaSU(PF3`U+w;M{^l^!>s9m~y+C&{4H)hL}w9OCKw`GvI99hw4 zY?DjG=&h^~u)C6T5k_)c^NK~4m2J!`nYyFeM8jrI{3ue)L|O{3`(ps32e1BlQnzplyec_UHRi!@O4rax*84+*Zzf2w^n z<$o8+q}It)MqRYPQpV02sVjT@E16er(~2A6{HMQvO{I6VJI(SyBC!@W9V{GNOiGCb zq4`j+tTSU$N^$9?p=@vP4Ii!maA%y^zAE<=MYA^vaxAU4-SbFJL@sTS{LYNjX@~8~ z>D;@~wJ<92*DsMom$$7Vbjhsb*msFY<>j2UDM<&)CBH|daG(JBG0O>LaIzUm)3%6w z!J7Z>K0bLah=&gzqHMx-{dG6iR< zBOWooY>^%(kv^59n4A`gKqCN)`^esS9;|4(nSG~Wt;6#y-O8FaIxhk2MnN!ign4|D zpT%`8wG_#MrUxYWjx+?n>7BInb^+1#eeV{UY6RCHYV{?sY@U@DKFlG3U+&Sc(Ji8$ z)P8jIr>p5*P$P&r^$=5~q@q^wZI-c- zFmk&ZO~QW7BA_g*N(6a(EO2w42qOsLleMefg#vvBbH*Y<>{lb^!e)4&K4Qjv-V6D@r3x}jhAw=g{4Ag3Q zt~yP%A`;b9CeU$Jk+-jvsP1LoqEvnnK@ud4$IQ}7d%KXFP%L*U7y=^8?;Hl}ic)8V ztrU;tO;PTHFgCb9moGyoBYyW{yhX*T{*kzdnd8upJX;J+*_(cLWV0H+Y?K~t&X*T# zjgfHx;ZQQB2cyT8M7I>ErV^HatipETI5*nOA0 zZ>qEwEbz~dK$=+Q!h=gU(u^dWwmryaXVBN@$DS@U3;!C|#)*1msk;UPu=T;*=oct9 zz#VBmQ&_(I`Hb`V<`VBeko01?XM@I1`sx*z|Z24UU@&)?K2WQFaZp&;sQV;VU1la2W#l{|>5b=ea?%2|^B0&a- zBhjr0zypXCJn3nlDYFT}$uL17{;XYAcx$d7<=)Y=FFK2*gkMkcOC4d_dWK%-MuMTc zGt~%IIRkw?jo({XL*=_&$h(JG0zhA(!IV{PQUdFInu6!2k{l<&F+kU3i#;{Y$7|ux zbHEJ2_1t%-WrgNYFhhFHVJa4LyOM-m{Wxitk(R`|Mx-`l)!wh}aYc$D(ETx&{B9O; zvUYAfo)hu7K@T_KjBuk*vjYVG7>%L0nk0C+$#(B*qG0-)TKK>LmDWDuYu}u)@Cj&Y z&+wxKKNO&lQI{#5b5KtpELRfKGO^UQs;InGP;DHm#-L9@d2Clvc{1NUQQ$F?;TEA) z`b4>VtD7t{QkNSbyK{fm)kE_E=phZKzB6QW$x*M<(2ruFD@q z0B8%bsTvyjLMc;|I9)^^BR{de(NzR&Fe5hw4s+o-3gXrOxLWQ%oe1%2k*P`Ht*>Er zEvNbfaHlTuH)c*2J^+bPNU#xeA>OD+?qTSzCqVO#B?M+9nFu@{*cO~Jz55L^K-7Xw z_V}see(=@ALVJeAM{`B@2tiycMmrnjb+)cnX8pW3q<)YXf5?(iS(Tba6ao?^j!WKl0 zHtV*>*Qv~h1TtER^^RuqHrV#1IxXq^# z4={&*s6}ZM2O5(B_=yw_O)Ph$7@MkrK8`+E zW4CeMY7a$qpZTX!c4W}RGl*FZ?g007s(enCl!^`QIA;f^+H>(|iu?8>i-j|8xYw&K zP8yhN+lzQwW!~d>x&1Ao{Hj4_tF2accfMs+d~zy^<>~M%rp*m!W$Bcv>Z|Lz04^M_ zL_3b}B!0&2eK)qn4Y@-U%q`Ju+>{THt0lMpC z4ZAfsxB6;*8&RHqr>gCuS9NoxB|J1CTHSlax!7G;lD(=a!EB>1Cmg#2*4Lcn?I=@E z4V1Fv4C}H(N~N85=|INY1Hc~3!9q+ii={MtgXJ$Mld3zuE#mmup8}vuS=z7_-_~RC#IZ~je5Xj4TN9W0Y(OEu`O(X)Ka{+dwa;jEgBoM+_w^`?{R!!(&=4$QENa#C z<~DwX3$|kBogcfhl;@T@#9bLb_ff;IX_1f^0HvHRTVIx2ocvP*=Zwb};+W*H2mob) z{D?C;iLB-wBffOtXq)!O+P%3uj=D-CH*BJPp;*^XNp#3Y*B#dBH0=w)5$}MkKJQ$< zZ6CHnGsC)MRZ8gRmYsdGXsfJ-7TSp0CaQ+3;kd=i?Ej>zB$bLJ=a+c~WJZJ_{Shn{ z5)4`H7%^kuY2e9rMN6Wt10Rty2!#GHy$~5@}yS z*N~EVU{5NzXGEZgm9I9X{Xf>}Yq?bi${@?>f+4002U@Z10M_ITl)6x|@^v0<8o+F* zb`vPUS^H6dyS^6V`toO9t|I}eo=h{Z)2vgg;)An-n!`D0nB{R(&U9!OBiD5kD(o{| z4ipHOESI5$@=qJeyOai4kCt7aD%@zvoE|7;S~c-=8iVXp`2#5~&L5^*%`g@k-H_UD z*2NT_1`T$2ETgs`dx0zmHRsb>YFlnX!D6?44O0ErwT`_NJ@nQ0Al_fb-kfQV4i6uI zHt~QLWqZj3J?H&7-}Vg9*ZTP^P1Iy&i=V~v$^z2Y&!9p$3ynr4OQ=}wKkkhEL|BC0qUN^Spk(r+66JsN(k;N#mCaf5emj+D z*_&_j!fuFHuQS~&QhK*xu1quRiap`U3ej};8Q@mXf~@8ZPuHv-GL6onVt;63cdf*H zvGr-b+NT^>PXF;Eu^whW#l~bR04h_bdX6d%(rMfCkILC{ySf|^Ax0sP1R!kM9y+6q zKG?l}a=W!zsI(7!G#SvKuZHpbTZo8HdA2)>#)W;Ec(8qysi0$rqhG=EuE65cI%ZmB ze>e-@WbWZdpt&n!tL?sh?e~p>YW;fCwUd1r)|9$Q{0lT|p;#moI)#RuQnJ15k&~Yx zz0y;*+ec>meL}>i@l!Du(Cq4R^jWs?%{p0Gb?I6Hh~!+?v$Gp4C&gFmg;Yn(F)}dv zUbFq%KfC7IT7LrY#JW|AGJ4z1=u3~j(~k3IR%eH7{^t&dF8I~49Cdy9q-91K_cr)& z^+uiuZYuASA%Rf5IrE^(yxUg*Hb4|Mc~|-*ggL(EENyE7K7DARMLnAqjK% zQ=YpbSCQ_T&D;a2uTlC+jY@bWC6Kf0DAEov*HtFJx27nt9hWljm6(flf#|aPpu1(2 zMtXs*`~kB)pw8n#TZ7L4|5&3=FjTu-hsS1`L6tE9hfY@lV@GXS4+-zhJFKj1EZT{? z9I?HliSFb*KkZ*t-=-IAcTR;c?O&`36V&2|7VYVhn%`}5A=mSTS(qGBsP@)rH*3gj z21q;iSV-3ewy7(OM*4l9Z*%E@%W!9B-DGCfv1C8~-4aCgwUs@Yvt!{qIc=n9WM zmw-Vqin%N~43yKA{mK9B!0bGXL=_WOp}|eM5-3FAd#65dTr|A)p#S*}xGPvhly*cW zPamoz^)u;N>ato9(S-0NcMk+b8a zwxG+Ch=bX3k!3EIXs2T+w@p&HRPeavn&h+<&d4q444wFZn86FnQh8?+btOUGQaj%~ z?Ov%xkIe1k1rDu<|0+TGIQ{Y$I`wwHA%v*}Hy~y~AKl_N0X>E2vTIx1%j=W{&DVf< zyvKSybb|zSa$2R?gL1mqCqU|YrQrk&nG~mTU}e6meD~->ECYyQ^)b+hJI-Pz4%^G{ z6EkuCZa<4ukh9g^74)G_ED$=yrsgBLiOKCEC?%uTZVLOD3rgq&?%)Fh#VUe%kW=bD zj}33$y2qcH(E8~QofMUBlOp{mH}U`E&O_f%a`+--CC|HWzkc%M3O)(ID}A%%fiK~+ z;`&*O9|~BXT#AVC<*0HykvSu0!+^X-ftoaPi`>CD!S7WNTp7=Le0gak=n0?NZPT3z zSI0t=ro>P*@l`IBlty`eiv|`5mU>+*OO1}cBOy-Gko`yqNFi0N zwA+{Nl5oz{l{r0?G+-M> z4)p5&Z1HZv#oTk1-tm)hr;6U-iE$;Hx8=C3nUQcWB)*sN{xqIX=J=(_?9FnEmlTot zV$6e!lmM#O7K2%3k4~m5bL?mAo#A{?DqshHA!~jU>B^m)FGpEMdY~P(L zCvvEhWbQwzsKt1dhBz5cpRR^DI(9|S zzJGOmKcv6Oz~?Y#>)Bdwe~^U=$7;#v^aqdVpzp4%)Q3cQLwt_kEybHx{9bDhOh#~$ z#Ja^AbZ!IL^*%3Lg>sTH4}+}md4rwVibaAQ6O84QSSRAHN&#q-jvrLaWrw_}?T}l% zH@<-e2$V=viJHcVha<0JjcS8kom110MR7I;qfeqqN+n#NPw7ITl^;^lEBYx^c)RP{ zi$XX@KGB}GIKZ6Xl)rxzkfDr&}1@x3Ef zzh=E*m%wR#Xn&`Q`9d9As~gK{e_*Zg(UHiZi%3%K+YA84K}z}4x1aqy^RmQ3+c6Uaz1>Ak^LP&4J$H+scS z_>s`nOQ$LgT-4#mL-^&=NJ`6b(?2+DJ*|=G@fsJW#>^|c4KiAl&a#riA*k!5Ka+iV zN|44G!tS08mBSV|PwjVT&>!lZ8w$3kE(~Cjr0U#{xpzqbVbRbrk@`K~9lk=gQUcPa zJqOjyVM?l$>BVNiA?Fq2_Tw4-CaPTgL{6&BYl8iBy$nv~P}Df$w+mAl0SC2xfAtFc zorJJ}QYt-M&Y%n zI_G6Jn>`iTjhv*@Onb}}?%yACn_+K;q3c|H zRUgFH2n}IeGFz^{0TuaRh9D--b zcMs&BsIGW2`AWzxuaTWZCV-d0eRiShKpg!rwqE zZX;skbbVq(D<+aK#B!0yodbJkwMS;k7&Z?#h4`PoBv`}4O)zIQMq)n$pv4y=n)FIJ z8p`e_KRVGP+Qaf7Ipf_AWy$Q!__P_Q?Ch%Q4SWn487}bcGB%gTIocT`2q!z^!8b+$)$_QYc`-HJTwqFG-OHE;!B<(l*%!@K_1P~Lh|^1u zM-0U2(y!5Im3MPHH@nY#hI0Dr3C`%TFtA;esdQV?(K;?O|4Bp3w{kqqpmpo#4#mt_ z0o!dRp!`xZn`nkd&oFuA)^86JsexN0OFtdH+2oc;A6@@^83{b2)Z5Aa01tzg{Pjnr z`xond{QFW(P0q0i?S+9R|K;p0^b;_?%c+cJ0w6o);d*lI?M$Iz9lqm2*vy-!r5+%N z=IrLBdp10;H~ts53(M=&7}vK?vyBWa7UYkFwcwzf+NRJzhewkIo%v)Z<(Z8;?M+y?r?WJFEEA=*d4K0 z{tcAXe&>3Vq!^3VOGV4LL?0;y=R6TB*I2mG0n^7$DI4R^_DJ`^y6aYJ`@{G?L;9D- z%ym!6t&WHLOc2WDdF$!PHeD~{NU+edGm(+UMMqaqapavd@iXERr7$W_P)*~{7fEob z%nRWhr4+5VbC*#Pln)ZPvndQVT}d880#Yr;zmS43gz&+PT>PHa&FwexsrEb(FS2RB z15hmoLjtV`oy)&Gs-(|R0yq(I6h($rW5KUl7`Hl3nv<_i7QL(FmNQ&v{ByiEr_^JjF<$g`);Qq+~WRm$}KSWU?(_i0AW zV+FTckNTsOqAk_T%xfamI~`{W>j(+yw2@wkQjE9?P2G1J*QIyiw-rAscXD^gz1l*_ z67asxO=V@Mv{m%ig|7MqtFfP|9e$~NaQ@l> z^BN~18WZ1rOt84p5AXS_TDcjumVgx+eb&;zcv&hMcx2*&7PijPv+{fqk)#k zKM}O323HM?#G7a>EgSMQKn5Rm3ssQ1v%|u|?r^EFEx1rV8XGnx;w;>UCw~)d+QySjqE*eDVR!1?m3|8)6bBd?_4NyFFeHvoV&qKbPTjTg@lQ8 zzO|Z?Zdfu7nIwm>iH8E;L~pkX`w^7xYyRxLnHupH$7HD$p5iRCro=E-IlT zn3`MObgA9qZ}_Y8i`!xEZXTwBHd7-52cbloT~o3{ z?)ZBKW{ulm8Glg!Q#e)=xrMV;0=DMw_S2_f@}M|>6jcLd4Fc(nO!G( z-u@y#3jSyrAbzW3lTN8QbxF=twl21uIOw^7JPT4hdB-kHY?dSs`T?UaggLQI%3y_ks(&SJv>YOKtW+E)!LSnXnV0W*n=rm%_L7@?XAHA)V`Id7FEc~4tF6_%$k|DU^@8iT#aEf zc_3tJN+lA^zBMIT=`bdnj;xUvcakf~PZ}7vBIe?sH}{h}6DLz`F{`D)dJ;)5+z-c6 z%fTIwjw7kWU)zxf&04ncJv?OsVRmY#LUq$)eGjja zoL<(aOXxy%{=i^Xjf89QriE4y2>@^$P96>63D}Mf@H3Bu%p)PKwcZZ9eis`J(1Jj``dk#Uld8{iRUY$ppfi+})0r_~0$Z)0*6)xn#$GJ!~IDO>JC7 zX@R4k7uGDMlOf&ZE*zDGLd0`UiD_wGsSrJC9bLAXV~8jE^HxZr+|g*dOFNt3$!e6^ z5mB|de%>ud(P8Q?yWA%w6_wKs+L#5igXSH+-Lo@sTOEZb`n1gibnT%;o zC+o%)=*%R);*i&c)&;w_hMj4VJ_m`D+&1k@0Kk<4#wX8jC$nW>dc&fRkD&!bcZ#BR zX8V~<32y6lf?ffY6rTje{{qLoMiZ}rg+`*91r#-i7U`?+J~zATq{Fgd5TjotW@l$l zjz|oWVykEktK?XESJ?mylE$*g{=D!~3$FEz4mv_+1xprah<~d!``zz=CCSbmSP%uUeGgw5T@$tax`v`j&q>_&;0BqQCwI^;3~< zWhr|hwGareN1~gAE*8K2^`}iFifB|y-<_j1%FoA_6B@_DJ`ytBzhdP3!>Io{_u^(S z45S$oz}<;U;b8sjbl#XzejjWBxzpt=cvUDHvhBOQZRN#;mLq1G#`POF96FJ)^p&kW z^E36+wLS6qHcx6`8n4mdLE@y4u*aVU?EiYDnP4|A52T0l7Mz&)`J!q?^s}vv3~Pv= zTByZmlDX;v;OA$o_|K$-V*?bPU+v4bxBCxtuAEJZ8Gl94 zlQHHP#{H`v%zq8!PfVZ(?Yo}zj~DT~o3l=Lcg*IDt}a=mC>bhVFL$9GduOQf%LC!o zhJu1dlb(RA@q4sc!@imb#=nwOp+Eka_O%$u^YSR9@=FX%C!+^x>1ys*&~Mm3?iye3 zNjm(JMre|&cHRr986cByz5XwE{;?Pd5N?%<41}x=|0=#EUIKeGY2N>v;g8eyFMsfV z9w{yZgEpH>;Z=+Lmkr^c^WcBC{4z%Tsup7`hs^c%-|d-dcYOcv_GJBMu*sJbY=1c6U(bqv=E>J&@>hB?$-Jz4xc_cX^M3}*x}Rh9 zZ~DZSMe0>oGK+`#Z^nPO=k#ajV9h7R7XP=K{-$vB=eK6@uL4-juBS5%{`~I0Zz+<1 z4t6>>vi>gxzW=Mz_it||0k07(CXb2)`v30izxDagBNbwxgDsLEw)$5K@XrPQpDnpi zaXPbllYi;Tug#=u1g=clS2$^ZU1bBpu&p%Y=9QIdF;tdR|BcYwUr#!eBif-aBg)^6 zOZ@k#l#Avo8Haweqx#MXb@cBx{1}D(Ue#x8NcGo$_-`72;UPd50Nxl=AHu)6TE8ZYW1fWhC@^8TA?#fI^t^8Xw8FHZRX6Hj)$ybju8u)jHcdH)Lf Ok`R#\n\tPort <%= port %>\n")(host); - })).join('\n')); - console.log(clr.yellow('azure_wrapper/info:'), clr.green('Saved SSH config, you can use it like so: `ssh -F ', file_name, '`')); - console.log(clr.yellow('azure_wrapper/info:'), clr.green('The hosts in this deployment are:\n'), _.map(hosts.collection, function (host) { return host.name; })); -}; - -var get_location = function () { - if (process.env['AZ_AFFINITY']) { - return '--affinity-group=' + process.env['AZ_AFFINITY']; - } else if (process.env['AZ_LOCATION']) { - return '--location=' + process.env['AZ_LOCATION']; - } else { - return '--location=West Europe'; - } -} -var get_vm_size = function () { - if (process.env['AZ_VM_SIZE']) { - return '--vm-size=' + process.env['AZ_VM_SIZE']; - } else { - return '--vm-size=Small'; - } -} - -exports.queue_default_network = function () { - task_queue.push([ - 'network', 'vnet', 'create', - get_location(), - '--address-space=172.16.0.0', - conf.resources['vnet'], - ]); -} - -exports.queue_storage_if_needed = function() { - if (!process.env['AZURE_STORAGE_ACCOUNT']) { - conf.resources['storage_account'] = util.rand_suffix; - task_queue.push([ - 'storage', 'account', 'create', - '--type=LRS', - get_location(), - conf.resources['storage_account'], - ]); - process.env['AZURE_STORAGE_ACCOUNT'] = conf.resources['storage_account']; - } else { - // Preserve it for resizing, so we don't create a new one by accedent, - // when the environment variable is unset - conf.resources['storage_account'] = process.env['AZURE_STORAGE_ACCOUNT']; - } -}; - -exports.queue_machines = function (name_prefix, coreos_update_channel, cloud_config_creator) { - var x = conf.nodes[name_prefix]; - var vm_create_base_args = [ - 'vm', 'create', - get_location(), - get_vm_size(), - '--connect=' + conf.resources['service'], - '--virtual-network-name=' + conf.resources['vnet'], - '--no-ssh-password', - '--ssh-cert=' + conf.resources['ssh_key']['pem'], - ]; - - var cloud_config = cloud_config_creator(x, conf); - - var next_host = function (n) { - hosts.ssh_port_counter += 1; - var host = { name: util.hostname(n, name_prefix), port: hosts.ssh_port_counter }; - if (cloud_config instanceof Array) { - host.cloud_config_file = cloud_config[n]; - } else { - host.cloud_config_file = cloud_config; - } - hosts.collection.push(host); - return _.map([ - "--vm-name=<%= name %>", - "--ssh=<%= port %>", - "--custom-data=<%= cloud_config_file %>", - ], function (arg) { return _.template(arg)(host); }); - }; - - task_queue = task_queue.concat(_(x).times(function (n) { - if (conf.resizing && n < conf.old_size) { - return []; - } else { - return vm_create_base_args.concat(next_host(n), [ - coreos_image_ids[coreos_update_channel], 'core', - ]); - } - })); -}; - -exports.create_config = function (name, nodes) { - conf = { - name: name, - nodes: nodes, - weave_salt: util.rand_string(), - resources: { - vnet: [name, 'internal-vnet', util.rand_suffix].join('-'), - service: [name, util.rand_suffix].join('-'), - ssh_key: create_ssh_key(name), - } - }; - -}; - -exports.destroy_cluster = function (state_file) { - load_state(state_file); - if (conf.hosts === undefined) { - console.log(clr.red('azure_wrapper/fail: Nothing to delete.')); - process.abort(); - } - - conf.destroying = true; - task_queue = _.map(conf.hosts, function (host) { - return ['vm', 'delete', '--quiet', '--blob-delete', host.name]; - }); - - task_queue.push(['network', 'vnet', 'delete', '--quiet', conf.resources['vnet']]); - task_queue.push(['storage', 'account', 'delete', '--quiet', conf.resources['storage_account']]); - - exports.run_task_queue(); -}; - -exports.load_state_for_resizing = function (state_file, node_type, new_nodes) { - load_state(state_file); - if (conf.hosts === undefined) { - console.log(clr.red('azure_wrapper/fail: Nothing to look at.')); - process.abort(); - } - conf.resizing = true; - conf.old_size = conf.nodes[node_type]; - conf.old_state_file = state_file; - conf.nodes[node_type] += new_nodes; - hosts.collection = conf.hosts; - hosts.ssh_port_counter += conf.hosts.length; - process.env['AZURE_STORAGE_ACCOUNT'] = conf.resources['storage_account']; -} diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/lib/cloud_config.js b/release-0.19.0/docs/getting-started-guides/coreos/azure/lib/cloud_config.js deleted file mode 100644 index 75cff6cf2db..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/lib/cloud_config.js +++ /dev/null @@ -1,43 +0,0 @@ -var _ = require('underscore'); -var fs = require('fs'); -var yaml = require('js-yaml'); -var colors = require('colors/safe'); - - -var write_cloud_config_from_object = function (data, output_file) { - try { - fs.writeFileSync(output_file, [ - '#cloud-config', - yaml.safeDump(data), - ].join("\n")); - return output_file; - } catch (e) { - console.log(colors.red(e)); - } -}; - -exports.generate_environment_file_entry_from_object = function (hostname, environ) { - var data = { - hostname: hostname, - environ_array: _.map(environ, function (value, key) { - return [key.toUpperCase(), JSON.stringify(value.toString())].join('='); - }), - }; - - return { - permissions: '0600', - owner: 'root', - content: _.template("<%= environ_array.join('\\n') %>\n")(data), - path: _.template("/etc/weave.<%= hostname %>.env")(data), - }; -}; - -exports.process_template = function (input_file, output_file, processor) { - var data = {}; - try { - data = yaml.safeLoad(fs.readFileSync(input_file, 'utf8')); - } catch (e) { - console.log(colors.red(e)); - } - return write_cloud_config_from_object(processor(_.clone(data)), output_file); -}; diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/lib/deployment_logic/kubernetes.js b/release-0.19.0/docs/getting-started-guides/coreos/azure/lib/deployment_logic/kubernetes.js deleted file mode 100644 index e497a55708d..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/lib/deployment_logic/kubernetes.js +++ /dev/null @@ -1,76 +0,0 @@ -var _ = require('underscore'); -_.mixin(require('underscore.string').exports()); - -var util = require('../util.js'); -var cloud_config = require('../cloud_config.js'); - - -etcd_initial_cluster_conf_self = function (conf) { - var port = '2380'; - - var data = { - nodes: _(conf.nodes.etcd).times(function (n) { - var host = util.hostname(n, 'etcd'); - return [host, [host, port].join(':')].join('=http://'); - }), - }; - - return { - 'name': 'etcd2.service', - 'drop-ins': [{ - 'name': '50-etcd-initial-cluster.conf', - 'content': _.template("[Service]\nEnvironment=ETCD_INITIAL_CLUSTER=<%= nodes.join(',') %>\n")(data), - }], - }; -}; - -etcd_initial_cluster_conf_kube = function (conf) { - var port = '4001'; - - var data = { - nodes: _(conf.nodes.etcd).times(function (n) { - var host = util.hostname(n, 'etcd'); - return 'http://' + [host, port].join(':'); - }), - }; - - return { - 'name': 'apiserver.service', - 'drop-ins': [{ - 'name': '50-etcd-initial-cluster.conf', - 'content': _.template("[Service]\nEnvironment=ETCD_SERVERS=--etcd_servers=<%= nodes.join(',') %>\n")(data), - }], - }; -}; - -exports.create_etcd_cloud_config = function (node_count, conf) { - var input_file = './cloud_config_templates/kubernetes-cluster-etcd-node-template.yml'; - var output_file = util.join_output_file_path('kubernetes-cluster-etcd-nodes', 'generated.yml'); - - return cloud_config.process_template(input_file, output_file, function(data) { - data.coreos.units.push(etcd_initial_cluster_conf_self(conf)); - return data; - }); -}; - -exports.create_node_cloud_config = function (node_count, conf) { - var elected_node = 0; - - var input_file = './cloud_config_templates/kubernetes-cluster-main-nodes-template.yml'; - var output_file = util.join_output_file_path('kubernetes-cluster-main-nodes', 'generated.yml'); - - var make_node_config = function (n) { - return cloud_config.generate_environment_file_entry_from_object(util.hostname(n, 'kube'), { - weave_password: conf.weave_salt, - weave_peers: n === elected_node ? "" : util.hostname(elected_node, 'kube'), - breakout_route: util.ipv4([10, 2, 0, 0], 16), - bridge_address_cidr: util.ipv4([10, 2, n, 1], 24), - }); - }; - - return cloud_config.process_template(input_file, output_file, function(data) { - data.write_files = data.write_files.concat(_(node_count).times(make_node_config)); - data.coreos.units.push(etcd_initial_cluster_conf_kube(conf)); - return data; - }); -}; diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/lib/util.js b/release-0.19.0/docs/getting-started-guides/coreos/azure/lib/util.js deleted file mode 100644 index 2c88b8cff35..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/lib/util.js +++ /dev/null @@ -1,33 +0,0 @@ -var _ = require('underscore'); -_.mixin(require('underscore.string').exports()); - -exports.ipv4 = function (ocets, prefix) { - return { - ocets: ocets, - prefix: prefix, - toString: function () { - return [ocets.join('.'), prefix].join('/'); - } - } -}; - -exports.hostname = function hostname (n, prefix) { - return _.template("<%= pre %>-<%= seq %>")({ - pre: prefix || 'core', - seq: _.pad(n, 2, '0'), - }); -}; - -exports.rand_string = function () { - var crypto = require('crypto'); - var shasum = crypto.createHash('sha256'); - shasum.update(crypto.randomBytes(256)); - return shasum.digest('hex'); -}; - - -exports.rand_suffix = exports.rand_string().substring(50); - -exports.join_output_file_path = function(prefix, suffix) { - return './output/' + [prefix, exports.rand_suffix, suffix].join('_'); -}; diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/package.json b/release-0.19.0/docs/getting-started-guides/coreos/azure/package.json deleted file mode 100644 index 2eb45fd03ff..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/package.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "name": "coreos-azure-weave", - "version": "1.0.0", - "description": "Small utility to bring up a woven CoreOS cluster", - "main": "index.js", - "scripts": { - "test": "echo \"Error: no test specified\" && exit 1" - }, - "author": "Ilya Dmitrichenko ", - "license": "Apache 2.0", - "dependencies": { - "azure-cli": "^0.9.2", - "colors": "^1.0.3", - "js-yaml": "^3.2.5", - "openssl-wrapper": "^0.2.1", - "underscore": "^1.7.0", - "underscore.string": "^3.0.2" - } -} diff --git a/release-0.19.0/docs/getting-started-guides/coreos/azure/scale-kubernetes-cluster.js b/release-0.19.0/docs/getting-started-guides/coreos/azure/scale-kubernetes-cluster.js deleted file mode 100755 index f606898874c..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/azure/scale-kubernetes-cluster.js +++ /dev/null @@ -1,10 +0,0 @@ -#!/usr/bin/env node - -var azure = require('./lib/azure_wrapper.js'); -var kube = require('./lib/deployment_logic/kubernetes.js'); - -azure.load_state_for_resizing(process.argv[2], 'kube', parseInt(process.argv[3] || 1)); - -azure.run_task_queue([ - azure.queue_machines('kube', 'stable', kube.create_node_cloud_config), -]); diff --git a/release-0.19.0/docs/getting-started-guides/coreos/bare_metal_offline.md b/release-0.19.0/docs/getting-started-guides/coreos/bare_metal_offline.md deleted file mode 100644 index 0745215cee6..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/bare_metal_offline.md +++ /dev/null @@ -1,645 +0,0 @@ -# Bare Metal CoreOS with Kubernetes (OFFLINE) -Deploy a CoreOS running Kubernetes environment. This particular guild is made to help those in an OFFLINE system, wither for testing a POC before the real deal, or you are restricted to be totally offline for your applications. - - -## High Level Design -1. Manage the tftp directory - * /tftpboot/(coreos)(centos)(RHEL) - * /tftpboot/pxelinux.0/(MAC) -> linked to Linux image config file -2. Update per install the link for pxelinux -3. Update the DHCP config to reflect the host needing deployment -4. Setup nodes to deploy CoreOS creating a etcd cluster. -5. Have no access to the public [etcd discovery tool](https://discovery.etcd.io/). -6. Installing the CoreOS slaves to become Kubernetes minions. - -## Pre-requisites -1. Installed *CentOS 6* for PXE server -2. At least two bare metal nodes to work with - -## This Guides variables -| Node Description | MAC | IP | -| :---------------------------- | :---------------: | :---------: | -| CoreOS/etcd/Kubernetes Master | d0:00:67:13:0d:00 | 10.20.30.40 | -| CoreOS Slave 1 | d0:00:67:13:0d:01 | 10.20.30.41 | -| CoreOS Slave 2 | d0:00:67:13:0d:02 | 10.20.30.42 | - - -## Setup PXELINUX CentOS -To setup CentOS PXELINUX environment there is a complete [guide here](http://docs.fedoraproject.org/en-US/Fedora/7/html/Installation_Guide/ap-pxe-server.html). This section is the abbreviated version. - -1. Install packages needed on CentOS - - sudo yum install tftp-server dhcp syslinux - -2. ```vi /etc/xinetd.d/tftp``` to enable tftp service and change disable to 'no' - disable = no - -3. Copy over the syslinux images we will need. - - su - - mkdir -p /tftpboot - cd /tftpboot - cp /usr/share/syslinux/pxelinux.0 /tftpboot - cp /usr/share/syslinux/menu.c32 /tftpboot - cp /usr/share/syslinux/memdisk /tftpboot - cp /usr/share/syslinux/mboot.c32 /tftpboot - cp /usr/share/syslinux/chain.c32 /tftpboot - - /sbin/service dhcpd start - /sbin/service xinetd start - /sbin/chkconfig tftp on - -4. Setup default boot menu - - mkdir /tftpboot/pxelinux.cfg - touch /tftpboot/pxelinux.cfg/default - -5. Edit the menu ```vi /tftpboot/pxelinux.cfg/default``` - - default menu.c32 - prompt 0 - timeout 15 - ONTIMEOUT local - display boot.msg - - MENU TITLE Main Menu - - LABEL local - MENU LABEL Boot local hard drive - LOCALBOOT 0 - -Now you should have a working PXELINUX setup to image CoreOS nodes. You can verify the services by using VirtualBox locally or with bare metal servers. - -## Adding CoreOS to PXE -This section describes how to setup the CoreOS images to live alongside a pre-existing PXELINUX environment. - -1. Find or create the TFTP root directory that everything will be based off of. - * For this document we will assume ```/tftpboot/``` is our root directory. -2. Once we know and have our tftp root directory we will create a new directory structure for our CoreOS images. -3. Download the CoreOS PXE files provided by the CoreOS team. - - MY_TFTPROOT_DIR=/tftpboot - mkdir -p $MY_TFTPROOT_DIR/images/coreos/ - cd $MY_TFTPROOT_DIR/images/coreos/ - wget http://stable.release.core-os.net/amd64-usr/current/coreos_production_pxe.vmlinuz - wget http://stable.release.core-os.net/amd64-usr/current/coreos_production_pxe.vmlinuz.sig - wget http://stable.release.core-os.net/amd64-usr/current/coreos_production_pxe_image.cpio.gz - wget http://stable.release.core-os.net/amd64-usr/current/coreos_production_pxe_image.cpio.gz.sig - gpg --verify coreos_production_pxe.vmlinuz.sig - gpg --verify coreos_production_pxe_image.cpio.gz.sig - -4. Edit the menu ```vi /tftpboot/pxelinux.cfg/default``` again - - default menu.c32 - prompt 0 - timeout 300 - ONTIMEOUT local - display boot.msg - - MENU TITLE Main Menu - - LABEL local - MENU LABEL Boot local hard drive - LOCALBOOT 0 - - MENU BEGIN CoreOS Menu - - LABEL coreos-master - MENU LABEL CoreOS Master - KERNEL images/coreos/coreos_production_pxe.vmlinuz - APPEND initrd=images/coreos/coreos_production_pxe_image.cpio.gz cloud-config-url=http:///pxe-cloud-config-single-master.yml - - LABEL coreos-slave - MENU LABEL CoreOS Slave - KERNEL images/coreos/coreos_production_pxe.vmlinuz - APPEND initrd=images/coreos/coreos_production_pxe_image.cpio.gz cloud-config-url=http:///pxe-cloud-config-slave.yml - MENU END - -This configuration file will now boot from local drive but have the option to PXE image CoreOS. - -## DHCP configuration -This section covers configuring the DHCP server to hand out our new images. In this case we are assuming that there are other servers that will boot alongside other images. - -1. Add the ```filename``` to the _host_ or _subnet_ sections. - - filename "/tftpboot/pxelinux.0"; - -2. At this point we want to make pxelinux configuration files that will be the templates for the different CoreOS deployments. - - subnet 10.20.30.0 netmask 255.255.255.0 { - next-server 10.20.30.242; - option broadcast-address 10.20.30.255; - filename ""; - - ... - # http://www.syslinux.org/wiki/index.php/PXELINUX - host core_os_master { - hardware ethernet d0:00:67:13:0d:00; - option routers 10.20.30.1; - fixed-address 10.20.30.40; - option domain-name-servers 10.20.30.242; - filename "/pxelinux.0"; - } - host core_os_slave { - hardware ethernet d0:00:67:13:0d:01; - option routers 10.20.30.1; - fixed-address 10.20.30.41; - option domain-name-servers 10.20.30.242; - filename "/pxelinux.0"; - } - host core_os_slave2 { - hardware ethernet d0:00:67:13:0d:02; - option routers 10.20.30.1; - fixed-address 10.20.30.42; - option domain-name-servers 10.20.30.242; - filename "/pxelinux.0"; - } - ... - } - -We will be specifying the node configuration later in the guide. - -# Kubernetes -To deploy our configuration we need to create an ```etcd``` master. To do so we want to pxe CoreOS with a specific cloud-config.yml. There are two options we have here. -1. Is to template the cloud config file and programmatically create new static configs for different cluster setups. -2. Have a service discovery protocol running in our stack to do auto discovery. - -This demo we just make a static single ```etcd``` server to host our Kubernetes and ```etcd``` master servers. - -Since we are OFFLINE here most of the helping processes in CoreOS and Kubernetes are then limited. To do our setup we will then have to download and serve up our binaries for Kubernetes in our local environment. - -An easy solution is to host a small web server on the DHCP/TFTP host for all our binaries to make them available to the local CoreOS PXE machines. - -To get this up and running we are going to setup a simple ```apache``` server to serve our binaries needed to bootstrap Kubernetes. - -This is on the PXE server from the previous section: - - rm /etc/httpd/conf.d/welcome.conf - cd /var/www/html/ - wget -O kube-register https://github.com/kelseyhightower/kube-register/releases/download/v0.0.2/kube-register-0.0.2-linux-amd64 - wget -O setup-network-environment https://github.com/kelseyhightower/setup-network-environment/releases/download/v1.0.0/setup-network-environment - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kubernetes --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-apiserver --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-controller-manager --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-scheduler --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kubectl --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kubecfg --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kubelet --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-proxy --no-check-certificate - wget -O flanneld https://storage.googleapis.com/k8s/flanneld --no-check-certificate - -This sets up our binaries we need to run Kubernetes. This would need to be enhanced to download from the Internet for updates in the future. - -Now for the good stuff! - -## Cloud Configs -The following config files are tailored for the OFFLINE version of a Kubernetes deployment. - -These are based on the work found here: [master.yml](http://docs.k8s.io/getting-started-guides/coreos/cloud-configs/master.yaml), [node.yml](http://docs.k8s.io/getting-started-guides/coreos/cloud-configs/node.yaml) - -To make the setup work, you need to replace a few placeholders: - - - Replace `` with your PXE server ip address (e.g. 10.20.30.242) - - Replace `` with the kubernetes master ip address (e.g. 10.20.30.40) - - If you run a private docker registry, replace `rdocker.example.com` with your docker registry dns name. - - If you use a proxy, replace `rproxy.example.com` with your proxy server (and port) - - Add your own SSH public key(s) to the cloud config at the end - -### master.yml -On the PXE server make and fill in the variables ```vi /var/www/html/coreos/pxe-cloud-config-master.yml```. - - - #cloud-config - --- - write_files: - - path: /opt/bin/waiter.sh - owner: root - content: | - #! /usr/bin/bash - until curl http://127.0.0.1:4001/v2/machines; do sleep 2; done - - path: /opt/bin/kubernetes-download.sh - owner: root - permissions: 0755 - content: | - #! /usr/bin/bash - /usr/bin/wget -N -P "/opt/bin" "http:///kubectl" - /usr/bin/wget -N -P "/opt/bin" "http:///kubernetes" - /usr/bin/wget -N -P "/opt/bin" "http:///kubecfg" - chmod +x /opt/bin/* - - path: /etc/profile.d/opt-path.sh - owner: root - permissions: 0755 - content: | - #! /usr/bin/bash - PATH=$PATH/opt/bin - coreos: - units: - - name: 10-eno1.network - runtime: true - content: | - [Match] - Name=eno1 - [Network] - DHCP=yes - - name: 20-nodhcp.network - runtime: true - content: | - [Match] - Name=en* - [Network] - DHCP=none - - name: get-kube-tools.service - runtime: true - command: start - content: | - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStart=/opt/bin/kubernetes-download.sh - RemainAfterExit=yes - Type=oneshot - - name: setup-network-environment.service - command: start - content: | - [Unit] - Description=Setup Network Environment - Documentation=https://github.com/kelseyhightower/setup-network-environment - Requires=network-online.target - After=network-online.target - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///setup-network-environment - ExecStartPre=/usr/bin/chmod +x /opt/bin/setup-network-environment - ExecStart=/opt/bin/setup-network-environment - RemainAfterExit=yes - Type=oneshot - - name: etcd.service - command: start - content: | - [Unit] - Description=etcd - Requires=setup-network-environment.service - After=setup-network-environment.service - [Service] - EnvironmentFile=/etc/network-environment - User=etcd - PermissionsStartOnly=true - ExecStart=/usr/bin/etcd \ - --name ${DEFAULT_IPV4} \ - --addr ${DEFAULT_IPV4}:4001 \ - --bind-addr 0.0.0.0 \ - --cluster-active-size 1 \ - --data-dir /var/lib/etcd \ - --http-read-timeout 86400 \ - --peer-addr ${DEFAULT_IPV4}:7001 \ - --snapshot true - Restart=always - RestartSec=10s - - name: fleet.socket - command: start - content: | - [Socket] - ListenStream=/var/run/fleet.sock - - name: fleet.service - command: start - content: | - [Unit] - Description=fleet daemon - Wants=etcd.service - After=etcd.service - Wants=fleet.socket - After=fleet.socket - [Service] - Environment="FLEET_ETCD_SERVERS=http://127.0.0.1:4001" - Environment="FLEET_METADATA=role=master" - ExecStart=/usr/bin/fleetd - Restart=always - RestartSec=10s - - name: etcd-waiter.service - command: start - content: | - [Unit] - Description=etcd waiter - Wants=network-online.target - Wants=etcd.service - After=etcd.service - After=network-online.target - Before=flannel.service - Before=setup-network-environment.service - [Service] - ExecStartPre=/usr/bin/chmod +x /opt/bin/waiter.sh - ExecStart=/usr/bin/bash /opt/bin/waiter.sh - RemainAfterExit=true - Type=oneshot - - name: flannel.service - command: start - content: | - [Unit] - Wants=etcd-waiter.service - After=etcd-waiter.service - Requires=etcd.service - After=etcd.service - After=network-online.target - Wants=network-online.target - Description=flannel is an etcd backed overlay network for containers - [Service] - Type=notify - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///flanneld - ExecStartPre=/usr/bin/chmod +x /opt/bin/flanneld - ExecStartPre=-/usr/bin/etcdctl mk /coreos.com/network/config '{"Network":"10.100.0.0/16", "Backend": {"Type": "vxlan"}}' - ExecStart=/opt/bin/flanneld - - name: kube-apiserver.service - command: start - content: | - [Unit] - Description=Kubernetes API Server - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd.service - After=etcd.service - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kube-apiserver - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver - ExecStart=/opt/bin/kube-apiserver \ - --address=0.0.0.0 \ - --port=8080 \ - --service-cluster-ip-range=10.100.0.0/16 \ - --etcd_servers=http://127.0.0.1:4001 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-controller-manager.service - command: start - content: | - [Unit] - Description=Kubernetes Controller Manager - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kube-controller-manager - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager - ExecStart=/opt/bin/kube-controller-manager \ - --master=127.0.0.1:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-scheduler.service - command: start - content: | - [Unit] - Description=Kubernetes Scheduler - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kube-scheduler - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler - ExecStart=/opt/bin/kube-scheduler --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - - name: kube-register.service - command: start - content: | - [Unit] - Description=Kubernetes Registration Service - Documentation=https://github.com/kelseyhightower/kube-register - Requires=kube-apiserver.service - After=kube-apiserver.service - Requires=fleet.service - After=fleet.service - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kube-register - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-register - ExecStart=/opt/bin/kube-register \ - --metadata=role=node \ - --fleet-endpoint=unix:///var/run/fleet.sock \ - --healthz-port=10248 \ - --api-endpoint=http://127.0.0.1:8080 - Restart=always - RestartSec=10 - update: - group: stable - reboot-strategy: off - ssh_authorized_keys: - - ssh-rsa AAAAB3NzaC1yc2EAAAAD... - - -### node.yml -On the PXE server make and fill in the variables ```vi /var/www/html/coreos/pxe-cloud-config-slave.yml```. - - #cloud-config - --- - write_files: - - path: /etc/default/docker - content: | - DOCKER_EXTRA_OPTS='--insecure-registry="rdocker.example.com:5000"' - coreos: - units: - - name: 10-eno1.network - runtime: true - content: | - [Match] - Name=eno1 - [Network] - DHCP=yes - - name: 20-nodhcp.network - runtime: true - content: | - [Match] - Name=en* - [Network] - DHCP=none - - name: etcd.service - mask: true - - name: docker.service - drop-ins: - - name: 50-insecure-registry.conf - content: | - [Service] - Environment="HTTP_PROXY=http://rproxy.example.com:3128/" "NO_PROXY=localhost,127.0.0.0/8,rdocker.example.com" - - name: fleet.service - command: start - content: | - [Unit] - Description=fleet daemon - Wants=fleet.socket - After=fleet.socket - [Service] - Environment="FLEET_ETCD_SERVERS=http://:4001" - Environment="FLEET_METADATA=role=node" - ExecStart=/usr/bin/fleetd - Restart=always - RestartSec=10s - - name: flannel.service - command: start - content: | - [Unit] - After=network-online.target - Wants=network-online.target - Description=flannel is an etcd backed overlay network for containers - [Service] - Type=notify - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///flanneld - ExecStartPre=/usr/bin/chmod +x /opt/bin/flanneld - ExecStart=/opt/bin/flanneld -etcd-endpoints http://:4001 - - name: docker.service - command: start - content: | - [Unit] - After=flannel.service - Wants=flannel.service - Description=Docker Application Container Engine - Documentation=http://docs.docker.io - [Service] - EnvironmentFile=-/etc/default/docker - EnvironmentFile=/run/flannel/subnet.env - ExecStartPre=/bin/mount --make-rprivate / - ExecStart=/usr/bin/docker -d --bip=${FLANNEL_SUBNET} --mtu=${FLANNEL_MTU} -s=overlay -H fd:// ${DOCKER_EXTRA_OPTS} - [Install] - WantedBy=multi-user.target - - name: setup-network-environment.service - command: start - content: | - [Unit] - Description=Setup Network Environment - Documentation=https://github.com/kelseyhightower/setup-network-environment - Requires=network-online.target - After=network-online.target - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///setup-network-environment - ExecStartPre=/usr/bin/chmod +x /opt/bin/setup-network-environment - ExecStart=/opt/bin/setup-network-environment - RemainAfterExit=yes - Type=oneshot - - name: kube-proxy.service - command: start - content: | - [Unit] - Description=Kubernetes Proxy - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=setup-network-environment.service - After=setup-network-environment.service - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kube-proxy - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy - ExecStart=/opt/bin/kube-proxy \ - --etcd_servers=http://:4001 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-kubelet.service - command: start - content: | - [Unit] - Description=Kubernetes Kubelet - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=setup-network-environment.service - After=setup-network-environment.service - [Service] - EnvironmentFile=/etc/network-environment - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kubelet - ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet - ExecStart=/opt/bin/kubelet \ - --address=0.0.0.0 \ - --port=10250 \ - --hostname_override=${DEFAULT_IPV4} \ - --api_servers=:8080 \ - --healthz_bind_address=0.0.0.0 \ - --healthz_port=10248 \ - --logtostderr=true - Restart=always - RestartSec=10 - update: - group: stable - reboot-strategy: off - ssh_authorized_keys: - - ssh-rsa AAAAB3NzaC1yc2EAAAAD... - - -## New pxelinux.cfg file -Create a pxelinux target file for a _slave_ node: ```vi /tftpboot/pxelinux.cfg/coreos-node-slave``` - - default coreos - prompt 1 - timeout 15 - - display boot.msg - - label coreos - menu default - kernel images/coreos/coreos_production_pxe.vmlinuz - append initrd=images/coreos/coreos_production_pxe_image.cpio.gz cloud-config-url=http:///coreos/pxe-cloud-config-slave.yml console=tty0 console=ttyS0 coreos.autologin=tty1 coreos.autologin=ttyS0 - -And one for the _master_ node: ```vi /tftpboot/pxelinux.cfg/coreos-node-master``` - - default coreos - prompt 1 - timeout 15 - - display boot.msg - - label coreos - menu default - kernel images/coreos/coreos_production_pxe.vmlinuz - append initrd=images/coreos/coreos_production_pxe_image.cpio.gz cloud-config-url=http:///coreos/pxe-cloud-config-master.yml console=tty0 console=ttyS0 coreos.autologin=tty1 coreos.autologin=ttyS0 - -## Specify the pxelinux targets -Now that we have our new targets setup for master and slave we want to configure the specific hosts to those targets. We will do this by using the pxelinux mechanism of setting a specific MAC addresses to a specific pxelinux.cfg file. - -Refer to the MAC address table in the beginning of this guide. Documentation for more details can be found [here](http://www.syslinux.org/wiki/index.php/PXELINUX). - - cd /tftpboot/pxelinux.cfg - ln -s coreos-node-master 01-d0-00-67-13-0d-00 - ln -s coreos-node-slave 01-d0-00-67-13-0d-01 - ln -s coreos-node-slave 01-d0-00-67-13-0d-02 - - -Reboot these servers to get the images PXEd and ready for running containers! - -## Creating test pod -Now that the CoreOS with Kubernetes installed is up and running lets spin up some Kubernetes pods to demonstrate the system. - -See [a simple nginx example](../../../examples/simple-nginx.md) to try out your new cluster. - -For more complete applications, please look in the [examples directory](../../../examples). - -## Helping commands for debugging - -List all keys in etcd: - - etcdctl ls --recursive - -List fleet machines - - fleetctl list-machines - -Check system status of services on master node: - - systemctl status kube-apiserver - systemctl status kube-controller-manager - systemctl status kube-scheduler - systemctl status kube-register - -Check system status of services on a minion node: - - systemctl status kube-kubelet - systemctl status docker.service - -List Kubernetes - - kubectl get pods - kubectl get minions - - -Kill all pods: - - for i in `kubectl get pods | awk '{print $1}'`; do kubectl stop pod $i; done - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/coreos/bare_metal_offline.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/coreos/bare_metal_offline.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/master.yaml b/release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/master.yaml deleted file mode 100644 index af7247414b3..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/master.yaml +++ /dev/null @@ -1,180 +0,0 @@ -#cloud-config - ---- -hostname: master -coreos: - etcd2: - name: master - listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001 - advertise-client-urls: http://$private_ipv4:2379,http://$private_ipv4:4001 - initial-cluster-token: k8s_etcd - listen-peer-urls: http://$private_ipv4:2380,http://$private_ipv4:7001 - initial-advertise-peer-urls: http://$private_ipv4:2380 - initial-cluster: master=http://$private_ipv4:2380 - initial-cluster-state: new - fleet: - metadata: "role=master" - units: - - name: setup-network-environment.service - command: start - content: | - [Unit] - Description=Setup Network Environment - Documentation=https://github.com/kelseyhightower/setup-network-environment - Requires=network-online.target - After=network-online.target - - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/curl -L -o /opt/bin/setup-network-environment -z /opt/bin/setup-network-environment https://github.com/kelseyhightower/setup-network-environment/releases/download/v1.0.0/setup-network-environment - ExecStartPre=/usr/bin/chmod +x /opt/bin/setup-network-environment - ExecStart=/opt/bin/setup-network-environment - RemainAfterExit=yes - Type=oneshot - - name: fleet.service - command: start - - name: flanneld.service - command: start - drop-ins: - - name: 50-network-config.conf - content: | - [Unit] - Requires=etcd2.service - [Service] - ExecStartPre=/usr/bin/etcdctl set /coreos.com/network/config '{"Network":"10.244.0.0/16", "Backend": {"Type": "vxlan"}}' - - name: docker-cache.service - command: start - content: | - [Unit] - Description=Docker cache proxy - Requires=early-docker.service - After=early-docker.service - Before=early-docker.target - - [Service] - Restart=always - TimeoutStartSec=0 - RestartSec=5 - Environment="TMPDIR=/var/tmp/" - Environment="DOCKER_HOST=unix:///var/run/early-docker.sock" - ExecStartPre=-/usr/bin/docker kill docker-registry - ExecStartPre=-/usr/bin/docker rm docker-registry - ExecStartPre=/usr/bin/docker pull quay.io/devops/docker-registry:latest - # GUNICORN_OPTS is an workaround for - # https://github.com/docker/docker-registry/issues/892 - ExecStart=/usr/bin/docker run --rm --net host --name docker-registry \ - -e STANDALONE=false \ - -e GUNICORN_OPTS=[--preload] \ - -e MIRROR_SOURCE=https://registry-1.docker.io \ - -e MIRROR_SOURCE_INDEX=https://index.docker.io \ - -e MIRROR_TAGS_CACHE_TTL=1800 \ - quay.io/devops/docker-registry:latest - - name: docker.service - content: | - [Unit] - Description=Docker Application Container Engine - Documentation=http://docs.docker.com - After=docker.socket early-docker.target network.target - Requires=docker.socket early-docker.target - - [Service] - Environment=TMPDIR=/var/tmp - EnvironmentFile=-/run/flannel_docker_opts.env - EnvironmentFile=/etc/network-environment - MountFlags=slave - LimitNOFILE=1048576 - LimitNPROC=1048576 - ExecStart=/usr/lib/coreos/dockerd --daemon --host=fd:// --registry-mirror=http://${DEFAULT_IPV4}:5000 $DOCKER_OPT_BIP $DOCKER_OPT_MTU $DOCKER_OPT_IPMASQ - - [Install] - WantedBy=multi-user.target - drop-ins: - - name: 51-docker-mirror.conf - content: | - [Unit] - # making sure that docker-cache is up and that flanneld finished - # startup, otherwise containers won't land in flannel's network... - Requires=docker-cache.service flanneld.service - After=docker-cache.service flanneld.service - - name: kube-apiserver.service - command: start - content: | - [Unit] - Description=Kubernetes API Server - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd2.service setup-network-environment.service - After=etcd2.service setup-network-environment.service - - [Service] - EnvironmentFile=/etc/network-environment - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-apiserver -z /opt/bin/kube-apiserver https://storage.googleapis.com/kubernetes-release/release/v0.18.0/bin/linux/amd64/kube-apiserver - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver - ExecStart=/opt/bin/kube-apiserver \ - --allow_privileged=true \ - --insecure_bind_address=0.0.0.0 \ - --insecure_port=8080 \ - --kubelet_https=true \ - --secure_port=6443 \ - --service-cluster-ip-range=10.100.0.0/16 \ - --etcd_servers=http://127.0.0.1:4001 \ - --public_address_override=${DEFAULT_IPV4} \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-controller-manager.service - command: start - content: | - [Unit] - Description=Kubernetes Controller Manager - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-controller-manager -z /opt/bin/kube-controller-manager https://storage.googleapis.com/kubernetes-release/release/v0.18.0/bin/linux/amd64/kube-controller-manager - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager - ExecStart=/opt/bin/kube-controller-manager \ - --master=127.0.0.1:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-scheduler.service - command: start - content: | - [Unit] - Description=Kubernetes Scheduler - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-scheduler -z /opt/bin/kube-scheduler https://storage.googleapis.com/kubernetes-release/release/v0.18.0/bin/linux/amd64/kube-scheduler - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler - ExecStart=/opt/bin/kube-scheduler --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - - name: kube-register.service - command: start - content: | - [Unit] - Description=Kubernetes Registration Service - Documentation=https://github.com/kelseyhightower/kube-register - Requires=kube-apiserver.service - After=kube-apiserver.service - Requires=fleet.service - After=fleet.service - - [Service] - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-register -z /opt/bin/kube-register https://github.com/kelseyhightower/kube-register/releases/download/v0.0.3/kube-register-0.0.3-linux-amd64 - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-register - ExecStart=/opt/bin/kube-register \ - --metadata=role=node \ - --fleet-endpoint=unix:///var/run/fleet.sock \ - --api-endpoint=http://127.0.0.1:8080 \ - --healthz-port=10248 - Restart=always - RestartSec=10 - update: - group: alpha - reboot-strategy: off diff --git a/release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/node.yaml b/release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/node.yaml deleted file mode 100644 index 0668a7e8bdd..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/node.yaml +++ /dev/null @@ -1,105 +0,0 @@ -#cloud-config -write-files: - - path: /opt/bin/wupiao - permissions: '0755' - content: | - #!/bin/bash - # [w]ait [u]ntil [p]ort [i]s [a]ctually [o]pen - [ -n "$1" ] && [ -n "$2" ] && while ! curl --output /dev/null \ - --silent --head --fail \ - http://${1}:${2}; do sleep 1 && echo -n .; done; - exit $? -coreos: - etcd2: - listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001 - advertise-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001 - initial-cluster: master=http://:2380 - proxy: on - fleet: - metadata: "role=node" - units: - - name: fleet.service - command: start - - name: flanneld.service - command: start - drop-ins: - - name: 50-network-config.conf - content: | - [Unit] - Requires=etcd2.service - [Service] - ExecStartPre=/usr/bin/etcdctl set /coreos.com/network/config '{"Network":"10.244.0.0/16", "Backend": {"Type": "vxlan"}}' - - name: docker.service - command: start - drop-ins: - - name: 51-docker-mirror.conf - content: | - [Unit] - Requires=flanneld.service - After=flanneld.service - [Service] - Environment=DOCKER_OPTS='--registry-mirror=http://:5000' - - name: setup-network-environment.service - command: start - content: | - [Unit] - Description=Setup Network Environment - Documentation=https://github.com/kelseyhightower/setup-network-environment - Requires=network-online.target - After=network-online.target - - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/curl -L -o /opt/bin/setup-network-environment -z /opt/bin/setup-network-environment https://github.com/kelseyhightower/setup-network-environment/releases/download/v1.0.0/setup-network-environment - ExecStartPre=/usr/bin/chmod +x /opt/bin/setup-network-environment - ExecStart=/opt/bin/setup-network-environment - RemainAfterExit=yes - Type=oneshot - - name: kube-proxy.service - command: start - content: | - [Unit] - Description=Kubernetes Proxy - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=setup-network-environment.service - After=setup-network-environment.service - - [Service] - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-proxy -z /opt/bin/kube-proxy https://storage.googleapis.com/kubernetes-release/release/v0.18.0/bin/linux/amd64/kube-proxy - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy - # wait for kubernetes master to be up and ready - ExecStartPre=/opt/bin/wupiao 8080 - ExecStart=/opt/bin/kube-proxy \ - --master=:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-kubelet.service - command: start - content: | - [Unit] - Description=Kubernetes Kubelet - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=setup-network-environment.service - After=setup-network-environment.service - - [Service] - EnvironmentFile=/etc/network-environment - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kubelet -z /opt/bin/kubelet https://storage.googleapis.com/kubernetes-release/release/v0.18.0/bin/linux/amd64/kubelet - ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet - # wait for kubernetes master to be up and ready - ExecStartPre=/opt/bin/wupiao 8080 - ExecStart=/opt/bin/kubelet \ - --address=0.0.0.0 \ - --port=10250 \ - --hostname_override=${DEFAULT_IPV4} \ - --api_servers=:8080 \ - --allow_privileged=true \ - --logtostderr=true \ - --healthz_bind_address=0.0.0.0 \ - --healthz_port=10248 - Restart=always - RestartSec=10 - update: - group: alpha - reboot-strategy: off diff --git a/release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/standalone.yaml b/release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/standalone.yaml deleted file mode 100644 index a37b05e37d3..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/cloud-configs/standalone.yaml +++ /dev/null @@ -1,168 +0,0 @@ -#cloud-config - ---- -hostname: master -coreos: - etcd2: - name: master - listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001 - advertise-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001 - initial-cluster-token: k8s_etcd - listen-peer-urls: http://0.0.0.0:2380,http://0.0.0.0:7001 - initial-advertise-peer-urls: http://0.0.0.0:2380 - initial-cluster: master=http://0.0.0.0:2380 - initial-cluster-state: new - units: - - name: etcd2.service - command: start - - name: fleet.service - command: start - - name: flanneld.service - command: start - drop-ins: - - name: 50-network-config.conf - content: | - [Unit] - Requires=etcd2.service - [Service] - ExecStartPre=/usr/bin/etcdctl set /coreos.com/network/config '{"Network":"10.244.0.0/16", "Backend": {"Type": "vxlan"}}' - - name: docker-cache.service - command: start - content: | - [Unit] - Description=Docker cache proxy - Requires=early-docker.service - After=early-docker.service - Before=early-docker.target - - [Service] - Restart=always - TimeoutStartSec=0 - RestartSec=5 - Environment="TMPDIR=/var/tmp/" - Environment="DOCKER_HOST=unix:///var/run/early-docker.sock" - ExecStartPre=-/usr/bin/docker kill docker-registry - ExecStartPre=-/usr/bin/docker rm docker-registry - ExecStartPre=/usr/bin/docker pull quay.io/devops/docker-registry:latest - # GUNICORN_OPTS is an workaround for - # https://github.com/docker/docker-registry/issues/892 - ExecStart=/usr/bin/docker run --rm --net host --name docker-registry \ - -e STANDALONE=false \ - -e GUNICORN_OPTS=[--preload] \ - -e MIRROR_SOURCE=https://registry-1.docker.io \ - -e MIRROR_SOURCE_INDEX=https://index.docker.io \ - -e MIRROR_TAGS_CACHE_TTL=1800 \ - quay.io/devops/docker-registry:latest - - name: docker.service - command: start - drop-ins: - - name: 51-docker-mirror.conf - content: | - [Unit] - # making sure that docker-cache is up and that flanneld finished - # startup, otherwise containers won't land in flannel's network... - Requires=docker-cache.service flanneld.service - After=docker-cache.service flanneld.service - [Service] - Environment=DOCKER_OPTS='--registry-mirror=http://$private_ipv4:5000' - - name: kube-apiserver.service - command: start - content: | - [Unit] - Description=Kubernetes API Server - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd2.service - After=etcd2.service - - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-apiserver - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver - ExecStart=/opt/bin/kube-apiserver \ - --allow_privileged=true \ - --insecure_bind_address=0.0.0.0 \ - --insecure_port=8080 \ - --kubelet_https=true \ - --secure_port=6443 \ - --service-cluster-ip-range=10.100.0.0/16 \ - --etcd_servers=http://127.0.0.1:4001 \ - --public_address_override=127.0.0.1 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-controller-manager.service - command: start - content: | - [Unit] - Description=Kubernetes Controller Manager - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-controller-manager - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager - ExecStart=/opt/bin/kube-controller-manager \ - --machines=127.0.0.1 \ - --master=127.0.0.1:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-scheduler.service - command: start - content: | - [Unit] - Description=Kubernetes Scheduler - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-scheduler - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler - ExecStart=/opt/bin/kube-scheduler --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - - name: kube-proxy.service - command: start - content: | - [Unit] - Description=Kubernetes Proxy - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd2.service - After=etcd2.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-proxy - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy - ExecStart=/opt/bin/kube-proxy \ - --master=127.0.0.1:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-kubelet.service - command: start - content: | - [Unit] - Description=Kubernetes Kubelet - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd2.service - After=etcd2.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kubelet - ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet - ExecStart=/opt/bin/kubelet \ - --address=0.0.0.0 \ - --port=10250 \ - --hostname_override=127.0.0.1 \ - --api_servers=127.0.0.1:8080 \ - --allow_privileged=true \ - --logtostderr=true \ - --healthz_bind_address=0.0.0.0 \ - --healthz_port=10248 - Restart=always - RestartSec=10 - update: - group: alpha - reboot-strategy: off diff --git a/release-0.19.0/docs/getting-started-guides/coreos/coreos_multinode_cluster.md b/release-0.19.0/docs/getting-started-guides/coreos/coreos_multinode_cluster.md deleted file mode 100644 index 5ac05ebb7b9..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/coreos_multinode_cluster.md +++ /dev/null @@ -1,142 +0,0 @@ -# CoreOS Multinode Cluster - -Use the [master.yaml](cloud-configs/master.yaml) and [node.yaml](cloud-configs/node.yaml) cloud-configs to provision a multi-node Kubernetes cluster. - -> **Attention**: This requires at least CoreOS version **[653.0.0][coreos653]**, as this was the first release to include etcd2. - -[coreos653]: https://coreos.com/releases/#653.0.0 - -## Overview - -* Provision the master node -* Capture the master node private IP address -* Edit node.yaml -* Provision one or more worker nodes - -### AWS - -*Attention:* Replace `````` below for a [suitable version of CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/). - -#### Provision the Master - -``` -aws ec2 create-security-group --group-name kubernetes --description "Kubernetes Security Group" -aws ec2 authorize-security-group-ingress --group-name kubernetes --protocol tcp --port 22 --cidr 0.0.0.0/0 -aws ec2 authorize-security-group-ingress --group-name kubernetes --protocol tcp --port 80 --cidr 0.0.0.0/0 -aws ec2 authorize-security-group-ingress --group-name kubernetes --source-security-group-name kubernetes -``` - -``` -aws ec2 run-instances \ ---image-id \ ---key-name \ ---region us-west-2 \ ---security-groups kubernetes \ ---instance-type m3.medium \ ---user-data file://master.yaml -``` - -#### Capture the private IP address - -``` -aws ec2 describe-instances --instance-id -``` - -#### Edit node.yaml - -Edit `node.yaml` and replace all instances of `` with the private IP address of the master node. - -#### Provision worker nodes - -``` -aws ec2 run-instances \ ---count 1 \ ---image-id \ ---key-name \ ---region us-west-2 \ ---security-groups kubernetes \ ---instance-type m3.medium \ ---user-data file://node.yaml -``` - -### GCE - -*Attention:* Replace `````` below for a [suitable version of CoreOS image for GCE](https://coreos.com/docs/running-coreos/cloud-providers/google-compute-engine/). - -#### Provision the Master - -``` -gcloud compute instances create master \ ---image-project coreos-cloud \ ---image \ ---boot-disk-size 200GB \ ---machine-type n1-standard-1 \ ---zone us-central1-a \ ---metadata-from-file user-data=master.yaml -``` - -#### Capture the private IP address - -``` -gcloud compute instances list -``` - -#### Edit node.yaml - -Edit `node.yaml` and replace all instances of `` with the private IP address of the master node. - -#### Provision worker nodes - -``` -gcloud compute instances create node1 \ ---image-project coreos-cloud \ ---image \ ---boot-disk-size 200GB \ ---machine-type n1-standard-1 \ ---zone us-central1-a \ ---metadata-from-file user-data=node.yaml -``` - -#### Establish network connectivity - -Next, setup an ssh tunnel to the master so you can run kubectl from your local host. -In one terminal, run `gcloud compute ssh master --ssh-flag="-L 8080:127.0.0.1:8080"` and in a second -run `gcloud compute ssh master --ssh-flag="-R 8080:127.0.0.1:8080"`. - -### VMware Fusion - -#### Create the master config-drive - -``` -mkdir -p /tmp/new-drive/openstack/latest/ -cp master.yaml /tmp/new-drive/openstack/latest/user_data -hdiutil makehybrid -iso -joliet -joliet-volume-name "config-2" -joliet -o master.iso /tmp/new-drive -``` - -#### Provision the Master - -Boot the [vmware image](https://coreos.com/docs/running-coreos/platforms/vmware) using `master.iso` as a config drive. - -#### Capture the master private IP address - -#### Edit node.yaml - -Edit `node.yaml` and replace all instances of `` with the private IP address of the master node. - -#### Create the node config-drive - -``` -mkdir -p /tmp/new-drive/openstack/latest/ -cp node.yaml /tmp/new-drive/openstack/latest/user_data -hdiutil makehybrid -iso -joliet -joliet-volume-name "config-2" -joliet -o node.iso /tmp/new-drive -``` - -#### Provision worker nodes - -Boot one or more the [vmware image](https://coreos.com/docs/running-coreos/platforms/vmware) using `node.iso` as a config drive. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/coreos/coreos_multinode_cluster.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/coreos/coreos_multinode_cluster.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/coreos/coreos_single_node_cluster.md b/release-0.19.0/docs/getting-started-guides/coreos/coreos_single_node_cluster.md deleted file mode 100644 index 5bb0b555080..00000000000 --- a/release-0.19.0/docs/getting-started-guides/coreos/coreos_single_node_cluster.md +++ /dev/null @@ -1,66 +0,0 @@ -# CoreOS - Single Node Kubernetes Cluster - -Use the [standalone.yaml](cloud-configs/standalone.yaml) cloud-config to provision a single node Kubernetes cluster. - -> **Attention**: This requires at least CoreOS version **[653.0.0][coreos653]**, as this was the first release to include etcd2. - -[coreos653]: https://coreos.com/releases/#653.0.0 - -### CoreOS image versions - -### AWS - -``` -aws ec2 create-security-group --group-name kubernetes --description "Kubernetes Security Group" -aws ec2 authorize-security-group-ingress --group-name kubernetes --protocol tcp --port 22 --cidr 0.0.0.0/0 -aws ec2 authorize-security-group-ingress --group-name kubernetes --source-security-group-name kubernetes -``` - -*Attention:* Replace `````` bellow for a [suitable version of CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/). - -``` -aws ec2 run-instances \ ---image-id \ ---key-name \ ---region us-west-2 \ ---security-groups kubernetes \ ---instance-type m3.medium \ ---user-data file://standalone.yaml -``` - -### GCE - -*Attention:* Replace `````` bellow for a [suitable version of CoreOS image for GCE](https://coreos.com/docs/running-coreos/cloud-providers/google-compute-engine/). - -``` -gcloud compute instances create standalone \ ---image-project coreos-cloud \ ---image \ ---boot-disk-size 200GB \ ---machine-type n1-standard-1 \ ---zone us-central1-a \ ---metadata-from-file user-data=standalone.yaml -``` - -Next, setup an ssh tunnel to the instance so you can run kubectl from your local host. -In one terminal, run `gcloud compute ssh standalone --ssh-flag="-L 8080:127.0.0.1:8080"` and in a second -run `gcloud compute ssh standalone --ssh-flag="-R 8080:127.0.0.1:8080"`. - - -### VMware Fusion - -Create a [config-drive](https://coreos.com/docs/cluster-management/setup/cloudinit-config-drive) ISO. - -``` -mkdir -p /tmp/new-drive/openstack/latest/ -cp standalone.yaml /tmp/new-drive/openstack/latest/user_data -hdiutil makehybrid -iso -joliet -joliet-volume-name "config-2" -joliet -o standalone.iso /tmp/new-drive -``` - -Boot the [vmware image](https://coreos.com/docs/running-coreos/platforms/vmware) using the `standalone.iso` as a config drive. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/coreos/coreos_single_node_cluster.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/coreos/coreos_single_node_cluster.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/docker-multinode.md b/release-0.19.0/docs/getting-started-guides/docker-multinode.md deleted file mode 100644 index deb7b281821..00000000000 --- a/release-0.19.0/docs/getting-started-guides/docker-multinode.md +++ /dev/null @@ -1,51 +0,0 @@ -### Running Multi-Node Kubernetes Using Docker - -_Note_: -These instructions are somewhat significantly more advanced than the [single node](docker.md) instructions. If you are -interested in just starting to explore Kubernetes, we recommend that you start there. - -## Table of Contents - * [Overview](#overview) - * [Installing the master node](#master-node) - * [Installing a worker node](#adding-a-worker-node) - * [Testing your cluster](#testing-your-cluster) - -## Overview -This guide will set up a 2-node kubernetes cluster, consisting of a _master_ node which hosts the API server and orchestrates work -and a _worker_ node which receives work from the master. You can repeat the process of adding worker nodes an arbitrary number of -times to create larger clusters. - -Here's a diagram of what the final result will look like: -![Kubernetes Single Node on Docker](k8s-docker.png) - -### Bootstrap Docker -This guide also uses a pattern of running two instances of the Docker daemon - 1) A _bootstrap_ Docker instance which is used to start system daemons like ```flanneld``` and ```etcd``` - 2) A _main_ Docker instance which is used for the Kubernetes infrastructure and user's scheduled containers - -This pattern is necessary because the ```flannel``` daemon is responsible for setting up and managing the network that interconnects -all of the Docker containers created by Kubernetes. To achieve this, it must run outside of the _main_ Docker daemon. However, -it is still useful to use containers for deployment and management, so we create a simpler _bootstrap_ daemon to achieve this. - -## Master Node -The first step in the process is to initialize the master node. - -See [here](docker-multinode/master.md) for detailed instructions. - -## Adding a worker node - -Once your master is up and running you can add one or more workers on different machines. - -See [here](docker-multinode/worker.md) for detailed instructions. - -## Testing your cluster - -Once your cluster has been created you can [test it out](docker-multinode/testing.md) - -For more complete applications, please look in the [examples directory](../../examples) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/docker-multinode.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/docker-multinode.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/docker-multinode/master.md b/release-0.19.0/docs/getting-started-guides/docker-multinode/master.md deleted file mode 100644 index 64c93124803..00000000000 --- a/release-0.19.0/docs/getting-started-guides/docker-multinode/master.md +++ /dev/null @@ -1,149 +0,0 @@ -## Installing a Kubernetes Master Node via Docker -We'll begin by setting up the master node. For the purposes of illustration, we'll assume that the IP of this machine is ```${MASTER_IP}``` - -There are two main phases to installing the master: - * [Setting up ```flanneld``` and ```etcd```](#setting-up-flanneld-and-etcd) - * [Starting the Kubernetes master components](#starting-the-kubernetes-master) - - -## Setting up flanneld and etcd - -### Setup Docker-Bootstrap -We're going to use ```flannel``` to set up networking between Docker daemons. Flannel itself (and etcd on which it relies) will run inside of -Docker containers themselves. To achieve this, we need a separate "bootstrap" instance of the Docker daemon. This daemon will be started with -```--iptables=false``` so that it can only run containers with ```--net=host```. That's sufficient to bootstrap our system. - -Run: -```sh -sudo sh -c 'docker -d -H unix:///var/run/docker-bootstrap.sock -p /var/run/docker-bootstrap.pid --iptables=false --ip-masq=false --bridge=none --graph=/var/lib/docker-bootstrap 2> /var/log/docker-bootstrap.log 1> /dev/null &' -``` - -_Important Note_: -If you are running this on a long running system, rather than experimenting, you should run the bootstrap Docker instance under something like SysV init, upstart or systemd so that it is restarted -across reboots and failures. - - -### Startup etcd for flannel and the API server to use -Run: -``` -sudo docker -H unix:///var/run/docker-bootstrap.sock run --net=host -d gcr.io/google_containers/etcd:2.0.9 /usr/local/bin/etcd --addr=127.0.0.1:4001 --bind-addr=0.0.0.0:4001 --data-dir=/var/etcd/data -``` - -Next, you need to set a CIDR range for flannel. This CIDR should be chosen to be non-overlapping with any existing network you are using: - -```sh -sudo docker -H unix:///var/run/docker-bootstrap.sock run --net=host gcr.io/google_containers/etcd:2.0.9 etcdctl set /coreos.com/network/config '{ "Network": "10.1.0.0/16" }' -``` - - -### Set up Flannel on the master node -Flannel is a network abstraction layer build by CoreOS, we will use it to provide simplfied networking between our Pods of containers. - -Flannel re-configures the bridge that Docker uses for networking. As a result we need to stop Docker, reconfigure its networking, and then restart Docker. - -#### Bring down Docker -To re-configure Docker to use flannel, we need to take docker down, run flannel and then restart Docker. - -Turning down Docker is system dependent, it may be: - -```sh -sudo /etc/init.d/docker stop -``` - -or - -```sh -sudo systemctl stop docker -``` - -or it may be something else. - -#### Run flannel - -Now run flanneld itself: -```sh -sudo docker -H unix:///var/run/docker-bootstrap.sock run -d --net=host --privileged -v /dev/net:/dev/net quay.io/coreos/flannel:0.3.0 -``` - -The previous command should have printed a really long hash, copy this hash. - -Now get the subnet settings from flannel: -``` -sudo docker -H unix:///var/run/docker-bootstrap.sock exec cat /run/flannel/subnet.env -``` - -#### Edit the docker configuration -You now need to edit the docker configuration to activate new flags. Again, this is system specific. - -This may be in ```/etc/default/docker``` or ```/etc/systemd/service/docker.service``` or it may be elsewhere. - -Regardless, you need to add the following to the docker comamnd line: -```sh ---bip=${FLANNEL_SUBNET} --mtu=${FLANNEL_MTU} -``` - -#### Remove the existing Docker bridge -Docker creates a bridge named ```docker0``` by default. You need to remove this: - -```sh -sudo /sbin/ifconfig docker0 down -sudo brctl delbr docker0 -``` - -You may need to install the ```bridge-utils``` package for the ```brctl``` binary. - -#### Restart Docker -Again this is system dependent, it may be: - -```sh -sudo /etc/init.d/docker start -``` - -it may be: -```sh -systemctl start docker -``` - -## Starting the Kubernetes Master -Ok, now that your networking is set up, you can startup Kubernetes, this is the same as the single-node case, we will use the "main" instance of the Docker daemon for the Kubernetes components. - -```sh -sudo docker run --net=host -d -v /var/run/docker.sock:/var/run/docker.sock gcr.io/google_containers/hyperkube:v0.17.0 /hyperkube kubelet --api_servers=http://localhost:8080 --v=2 --address=0.0.0.0 --enable_server --hostname_override=127.0.0.1 --config=/etc/kubernetes/manifests-multi -``` - -### Also run the service proxy -```sh -sudo docker run -d --net=host --privileged gcr.io/google_containers/hyperkube:v0.17.0 /hyperkube proxy --master=http://127.0.0.1:8080 --v=2 -``` - -### Test it out -At this point, you should have a functioning 1-node cluster. Let's test it out! - -Download the kubectl binary -([OS X](http://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/darwin/amd64/kubectl)) -([linux](http://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kubectl)) - -List the nodes - -```sh -kubectl get nodes -``` - -This should print: -``` -NAME LABELS STATUS -127.0.0.1 Ready -``` - -If the status of the node is ```NotReady``` or ```Unknown``` please check that all of the containers you created are successfully running. -If all else fails, ask questions on IRC at #google-containers. - - -### Next steps -Move on to [adding one or more workers](worker.md) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/docker-multinode/master.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/docker-multinode/master.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/docker-multinode/testing.md b/release-0.19.0/docs/getting-started-guides/docker-multinode/testing.md deleted file mode 100644 index 9781e125852..00000000000 --- a/release-0.19.0/docs/getting-started-guides/docker-multinode/testing.md +++ /dev/null @@ -1,63 +0,0 @@ -## Testing your Kubernetes cluster. - -To validate that your node(s) have been added, run: - -```sh -kubectl get nodes -``` - -That should show something like: -``` -NAME LABELS STATUS -10.240.99.26 Ready -127.0.0.1 Ready -``` - -If the status of any node is ```Unknown``` or ```NotReady``` your cluster is broken, double check that all containers are running properly, and if all else fails, contact us on IRC at -```#google-containers``` for advice. - -### Run an application -```sh -kubectl -s http://localhost:8080 run nginx --image=nginx --port=80 -``` - -now run ```docker ps``` you should see nginx running. You may need to wait a few minutes for the image to get pulled. - -### Expose it as a service: -```sh -kubectl expose rc nginx --port=80 -``` - -This should print: -``` -NAME LABELS SELECTOR IP PORT(S) -nginx run=nginx 80/TCP -``` - -Hit the webserver: -```sh -curl -``` - -Note that you will need run this curl command on your boot2docker VM if you are running on OS X. - -### Scaling - -Now try to scale up the nginx you created before: - -```sh -kubectl scale rc nginx --replicas=3 -``` - -And list the pods - -```sh -kubectl get pods -``` - -You should see pods landing on the newly added machine. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/docker-multinode/testing.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/docker-multinode/testing.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/docker-multinode/worker.md b/release-0.19.0/docs/getting-started-guides/docker-multinode/worker.md deleted file mode 100644 index d171f3d00e2..00000000000 --- a/release-0.19.0/docs/getting-started-guides/docker-multinode/worker.md +++ /dev/null @@ -1,139 +0,0 @@ -## Adding a Kubernetes worker node via Docker. - -These instructions are very similar to the master set-up above, but they are duplicated for clarity. -You need to repeat these instructions for each node you want to join the cluster. -We will assume that the IP address of this node is ```${NODE_IP}``` and you have the IP address of the master in ```${MASTER_IP}``` that you created in the [master instructions](master.md). - -For each worker node, there are three steps: - * [Set up ```flanneld``` on the worker node](#set-up-flanneld-on-the-worker-node) - * [Start kubernetes on the worker node](#start-kubernetes-on-the-worker-node) - * [Add the worker to the cluster](#add-the-node-to-the-cluster) - -### Set up Flanneld on the worker node -As before, the Flannel daemon is going to provide network connectivity. - -#### Set up a bootstrap docker: -As previously, we need a second instance of the Docker daemon running to bootstrap the flannel networking. - -Run: -```sh -sudo sh -c 'docker -d -H unix:///var/run/docker-bootstrap.sock -p /var/run/docker-bootstrap.pid --iptables=false --ip-masq=false --bridge=none --graph=/var/lib/docker-bootstrap 2> /var/log/docker-bootstrap.log 1> /dev/null &' -``` - -_Important Note_: -If you are running this on a long running system, rather than experimenting, you should run the bootstrap Docker instance under something like SysV init, upstart or systemd so that it is restarted -across reboots and failures. - -#### Bring down Docker -To re-configure Docker to use flannel, we need to take docker down, run flannel and then restart Docker. - -Turning down Docker is system dependent, it may be: - -```sh -sudo /etc/init.d/docker stop -``` - -or - -```sh -sudo systemctl stop docker -``` - -or it may be something else. - -#### Run flannel - -Now run flanneld itself, this call is slightly different from the above, since we point it at the etcd instance on the master. -```sh -sudo docker -H unix:///var/run/docker-bootstrap.sock run -d --net=host --privileged -v /dev/net:/dev/net quay.io/coreos/flannel:0.3.0 /opt/bin/flanneld --etcd-endpoints=http://${MASTER_IP}:4001 -``` - -The previous command should have printed a really long hash, copy this hash. - -Now get the subnet settings from flannel: -``` -sudo docker -H unix:///var/run/docker-bootstrap.sock exec cat /run/flannel/subnet.env -``` - - -#### Edit the docker configuration -You now need to edit the docker configuration to activate new flags. Again, this is system specific. - -This may be in ```/etc/default/docker``` or ```/etc/systemd/service/docker.service``` or it may be elsewhere. - -Regardless, you need to add the following to the docker comamnd line: -```sh ---bip=${FLANNEL_SUBNET} --mtu=${FLANNEL_MTU} -``` - -#### Remove the existing Docker bridge -Docker creates a bridge named ```docker0``` by default. You need to remove this: - -```sh -sudo /sbin/ifconfig docker0 down -sudo brctl delbr docker0 -``` - -You may need to install the ```bridge-utils``` package for the ```brctl``` binary. - -#### Restart Docker -Again this is system dependent, it may be: - -```sh -sudo /etc/init.d/docker start -``` - -it may be: -```sh -systemctl start docker -``` - -### Start Kubernetes on the worker node -#### Run the kubelet -Again this is similar to the above, but the ```--api_servers``` now points to the master we set up in the beginning. - -```sh -sudo docker run --net=host -d -v /var/run/docker.sock:/var/run/docker.sock gcr.io/google_containers/hyperkube:v0.17.0 /hyperkube kubelet --api_servers=http://${MASTER_IP}:8080 --v=2 --address=0.0.0.0 --enable_server --hostname_override=$(hostname -i) -``` - -#### Run the service proxy -The service proxy provides load-balancing between groups of containers defined by Kubernetes ```Services``` - -```sh -sudo docker run -d --net=host --privileged gcr.io/google_containers/hyperkube:v0.17.0 /hyperkube proxy --master=http://${MASTER_IP}:8080 --v=2 -``` - - -### Add the node to the cluster - -On the master you created above, create a file named ```node.yaml``` make it's contents: - -```yaml -apiVersion: v1 -kind: Node -metadata: - name: ${NODE_IP} -spec: - externalID: ${NODE_IP} -status: - # Fill in appropriate values below - capacity: - cpu: "1" - memory: 3Gi -``` - -Make the API call to add the node, you should do this on the master node that you created above. Otherwise you need to add ```-s=http://${MASTER_IP}:8080``` to point ```kubectl``` at the master. - -```sh -./kubectl create -f node.yaml -``` - -### Next steps - -Move on to [testing your cluster](testing.md) or [add another node](#adding-a-kubernetes-worker-node-via-docker) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/docker-multinode/worker.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/docker-multinode/worker.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/docker.md b/release-0.19.0/docs/getting-started-guides/docker.md deleted file mode 100644 index dd4c3aef558..00000000000 --- a/release-0.19.0/docs/getting-started-guides/docker.md +++ /dev/null @@ -1,87 +0,0 @@ -## Running kubernetes locally via Docker - -The following instructions show you how to set up a simple, single node kubernetes cluster using Docker. - -Here's a diagram of what the final result will look like: -![Kubernetes Single Node on Docker](k8s-singlenode-docker.png) - -### Step One: Run etcd -```sh -docker run --net=host -d gcr.io/google_containers/etcd:2.0.9 /usr/local/bin/etcd --addr=127.0.0.1:4001 --bind-addr=0.0.0.0:4001 --data-dir=/var/etcd/data -``` - -### Step Two: Run the master -```sh -docker run --net=host -d -v /var/run/docker.sock:/var/run/docker.sock gcr.io/google_containers/hyperkube:v0.17.0 /hyperkube kubelet --api_servers=http://localhost:8080 --v=2 --address=0.0.0.0 --enable_server --hostname_override=127.0.0.1 --config=/etc/kubernetes/manifests -``` - -This actually runs the kubelet, which in turn runs a [pod](http://docs.k8s.io/pods.md) that contains the other master components. - -### Step Three: Run the service proxy -*Note, this could be combined with master above, but it requires --privileged for iptables manipulation* -```sh -docker run -d --net=host --privileged gcr.io/google_containers/hyperkube:v0.17.0 /hyperkube proxy --master=http://127.0.0.1:8080 --v=2 -``` - -### Test it out -At this point you should have a running kubernetes cluster. You can test this by downloading the kubectl -binary -([OS X](https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/darwin/amd64/kubectl)) -([linux](https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kubectl)) - -*Note:* -On OS/X you will need to set up port forwarding via ssh: -```sh -boot2docker ssh -L8080:localhost:8080 -``` - -List the nodes in your cluster by running:: - -```sh -kubectl get nodes -``` - -This should print: -``` -NAME LABELS STATUS -127.0.0.1 Ready -``` - -If you are running different kubernetes clusters, you may need to specify ```-s http://localhost:8080``` to select the local cluster. - -### Run an application -```sh -kubectl -s http://localhost:8080 run nginx --image=nginx --port=80 -``` - -now run ```docker ps``` you should see nginx running. You may need to wait a few minutes for the image to get pulled. - -### Expose it as a service: -```sh -kubectl expose rc nginx --port=80 -``` - -This should print: -``` -NAME LABELS SELECTOR IP PORT(S) -nginx run=nginx 80/TCP -``` - -Hit the webserver: -```sh -curl -``` - -Note that you will need run this curl command on your boot2docker VM if you are running on OS X. - -### A note on turning down your cluster -Many of these containers run under the management of the ```kubelet``` binary, which attempts to keep containers running, even if they fail. So, in order to turn down -the cluster, you need to first kill the kubelet container, and then any other containers. - -You may use ```docker ps -a | awk '{print $1}' | xargs docker kill```, note this removes _all_ containers running under Docker, so use with caution. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/docker.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/docker.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/fedora/fedora_ansible_config.md b/release-0.19.0/docs/getting-started-guides/fedora/fedora_ansible_config.md deleted file mode 100644 index 6fbf513ee26..00000000000 --- a/release-0.19.0/docs/getting-started-guides/fedora/fedora_ansible_config.md +++ /dev/null @@ -1,239 +0,0 @@ -#Configuring kubernetes on [Fedora](http://fedoraproject.org) via [Ansible](http://www.ansible.com/home). - -Configuring kubernetes on Fedora via Ansible offers a simple way to quickly create a clustered environment with little effort. - -Requirements: - -1. Host able to run ansible and able to clone the following repo: [kubernetes-ansible](https://github.com/eparis/kubernetes-ansible) -2. A Fedora 20+ or RHEL7 host to act as cluster master -3. As many Fedora 20+ or RHEL7 hosts as you would like, that act as cluster minions - -The hosts can be virtual or bare metal. The only requirement to make the ansible network setup work is that all of the machines are connected via the same layer 2 network. - -Ansible will take care of the rest of the configuration for you - configuring networking, installing packages, handling the firewall, etc... This example will use one master and two minions. - -## Architecture of the cluster - -A Kubernetes cluster reqiures etcd, a master, and n minions, so we will create a cluster with three hosts, for example: - -``` - fed1 (master,etcd) = 192.168.121.205 - fed2 (minion) = 192.168.121.84 - fed3 (minion) = 192.168.121.116 -``` - -**Make sure your local machine** - - - has ansible - - has git - -**then we just clone down the kubernetes-ansible repository** - -``` - yum install -y ansible git - git clone https://github.com/eparis/kubernetes-ansible.git - cd kubernetes-ansible -``` - -**Tell ansible about each machine and its role in your cluster.** - -Get the IP addresses from the master and minions. Add those to the `inventory` file (at the root of the repo) on the host running Ansible. - -We will set the kube_ip_addr to '10.254.0.[1-3]', for now. The reason we do this is explained later... It might work for you as a default. - -``` -[masters] -192.168.121.205 - -[etcd] -192.168.121.205 - -[minions] -192.168.121.84 kube_ip_addr=[10.254.0.1] -192.168.121.116 kube_ip_addr=[10.254.0.2] -``` - -**Setup ansible access to your nodes** - -If you already are running on a machine which has passwordless ssh access to the fed[1-3] nodes, and 'sudo' privileges, simply set the value of `ansible_ssh_user` in `group_vars/all.yaml` to the username which you use to ssh to the nodes (i.e. `fedora`), and proceed to the next step... - -*Otherwise* setup ssh on the machines like so (you will need to know the root password to all machines in the cluster). - -edit: group_vars/all.yml - -``` -ansible_ssh_user: root -``` - -## Configuring ssh access to the cluster - -If you already have ssh access to every machine using ssh public keys you may skip to [configuring the network](#configuring-the-network) - -**Create a password file.** - -The password file should contain the root password for every machine in the cluster. It will be used in order to lay down your ssh public key. Make sure your machines sshd-config allows password logins from root. - -``` -echo "password" > ~/rootpassword -``` - -**Agree to accept each machine's ssh public key** - -After this is completed, ansible is now enabled to ssh into any of the machines you're configuring. - -``` -ansible-playbook -i inventory ping.yml # This will look like it fails, that's ok -``` - -**Push your ssh public key to every machine** - -Again, you can skip this step if your ansible machine has ssh access to the nodes you are going to use in the kubernetes cluster. -``` -ansible-playbook -i inventory keys.yml -``` - -## Configuring the internal kubernetes network - -If you already have configured your network and docker will use it correctly, skip to [setting up the cluster](#setting-up-the-cluster) - -The ansible scripts are quite hacky configuring the network, you can see the [README](https://github.com/eparis/kubernetes-ansible) for details, or you can simply enter in variants of the 'kube_service_addresses' (in the all.yaml file) as `kube_ip_addr` entries in the minions field, as shown in the next section. - -**Configure the ip addresses which should be used to run pods on each machine** - -The IP address pool used to assign addresses to pods for each minion is the `kube_ip_addr`= option. Choose a /24 to use for each minion and add that to you inventory file. - -For this example, as shown earlier, we can do something like this... - -``` -[minions] -192.168.121.84 kube_ip_addr=10.254.0.1 -192.168.121.116 kube_ip_addr=10.254.0.2 -``` - -**Run the network setup playbook** - -There are two ways to do this: via flannel, or using NetworkManager. - -Flannel is a cleaner mechanism to use, and is the recommended choice. - -- If you are using flannel, you should check the kubernetes-ansible repository above. - -Currently, you essentially have to (1) update group_vars/all.yml, and then (2) run -``` -ansible-playbook -i inventory flannel.yml -``` - -- On the other hand, if using the NetworkManager based setup (i.e. you do not want to use flannel). - -On EACH node, make sure NetworkManager is installed, and the service "NetworkManager" is running, then you can run -the network manager playbook... - -``` -ansible-playbook -i inventory ./old-network-config/hack-network.yml -``` - -## Setting up the cluster - -**Configure the IP addresses used for services** - -Each kubernetes service gets its own IP address. These are not real IPs. You need only select a range of IPs which are not in use elsewhere in your environment. This must be done even if you do not use the network setup provided by the ansible scripts. - -edit: group_vars/all.yml - -``` -kube_service_addresses: 10.254.0.0/16 -``` - -**Tell ansible to get to work!** - -This will finally setup your whole kubernetes cluster for you. - -``` -ansible-playbook -i inventory setup.yml -``` - -## Testing and using your new cluster - -That's all there is to it. It's really that easy. At this point you should have a functioning kubernetes cluster. - - -**Show services running on masters and minions.** - -``` -systemctl | grep -i kube -``` - -**Show firewall rules on the masters and minions.** - -``` -iptables -nvL -``` - -**Create the following apache.json file and deploy pod to minion.** - -``` -cat << EOF > apache.json -{ - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "fedoraapache", - "labels": { - "name": "fedoraapache" - } - }, - "spec": { - "containers": [ - { - "name": "fedoraapache", - "image": "fedora/apache", - "ports": [ - { - "hostPort": 80, - "containerPort": 80 - } - ] - } - ] - } -} -EOF - -/usr/bin/kubectl create -f apache.json - -**Testing your new kube cluster** - -``` - -**Check where the pod was created** - -``` -kubectl get pods -``` - -Important : Note that the IP of the pods IP fields are on the network which you created in the kube_ip_addr file. - -In this example, that was the 10.254 network. - -If you see 172 in the IP fields, networking was not setup correctly, and you may want to re run or dive deeper into the way networking is being setup by looking at the details of the networking scripts used above. - -**Check Docker status on minion.** - -``` -docker ps -docker images -``` - -**After the pod is 'Running' Check web server access on the minion** - -``` -curl http://localhost -``` - -That's it ! - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/fedora/fedora_ansible_config.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/fedora/fedora_ansible_config.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/fedora/fedora_manual_config.md b/release-0.19.0/docs/getting-started-guides/fedora/fedora_manual_config.md deleted file mode 100644 index 3140cd63a8b..00000000000 --- a/release-0.19.0/docs/getting-started-guides/fedora/fedora_manual_config.md +++ /dev/null @@ -1,188 +0,0 @@ -##Getting started on [Fedora](http://fedoraproject.org) - -This is a getting started guide for Fedora. It is a manual configuration so you understand all the underlying packages / services / ports, etc... - -This guide will only get ONE node (previously minion) working. Multiple nodes require a functional [networking configuration](http://docs.k8s.io/networking.md) done outside of kubernetes. Although the additional kubernetes configuration requirements should be obvious. - -The kubernetes package provides a few services: kube-apiserver, kube-scheduler, kube-controller-manager, kubelet, kube-proxy. These services are managed by systemd and the configuration resides in a central location: /etc/kubernetes. We will break the services up between the hosts. The first host, fed-master, will be the kubernetes master. This host will run the kube-apiserver, kube-controller-manager, and kube-scheduler. In addition, the master will also run _etcd_ (not needed if _etcd_ runs on a different host but this guide assumes that _etcd_ and kubernetes master run on the same host). The remaining host, fed-node will be the node and run kubelet, proxy and docker. - -**System Information:** - -Hosts: -``` -fed-master = 192.168.121.9 -fed-node = 192.168.121.65 -``` - -**Prepare the hosts:** - -* Install kubernetes on all hosts - fed-{master,node}. This will also pull in docker. Also install etcd on fed-master. This guide has been tested with kubernetes-0.15.0 but should work with other versions too. -* The [--enablerepo=update-testing](https://fedoraproject.org/wiki/QA:Updates_Testing) directive in the yum command below will ensure that the most recent Kubernetes version that is scheduled for pre-release will be installed. This should be a more recent version than the Fedora "stable" release for Kubernetes that you would get without adding the directive. -* If you want the very latest Kubernetes release [you can download and yum install the RPM directly from Fedora Koji](http://koji.fedoraproject.org/koji/packageinfo?packageID=19202) instead of using the yum install command below. - -``` -yum -y install --enablerepo=updates-testing kubernetes -``` -* Install etcd and iptables - -``` -yum -y install etcd iptables -``` - -* Add master and node to /etc/hosts on all machines (not needed if hostnames already in DNS). Make sure that communication works between fed-master and fed-node by using a utility such as ping. - -``` -echo "192.168.121.9 fed-master -192.168.121.65 fed-node" >> /etc/hosts -``` - -* Edit /etc/kubernetes/config which will be the same on all hosts (master and node) to contain: - -``` -# Comma separated list of nodes in the etcd cluster -KUBE_MASTER="--master=http://fed-master:8080" - -# logging to stderr means we get it in the systemd journal -KUBE_LOGTOSTDERR="--logtostderr=true" - -# journal message level, 0 is debug -KUBE_LOG_LEVEL="--v=0" - -# Should this cluster be allowed to run privileged docker containers -KUBE_ALLOW_PRIV="--allow_privileged=false" -``` - -* Disable the firewall on both the master and node, as docker does not play well with other firewall rule managers. Please note that iptables-services does not exist on default fedora server install. - -``` -systemctl disable iptables-services firewalld -systemctl stop iptables-services firewalld -``` - -**Configure the kubernetes services on the master.** - -* Edit /etc/kubernetes/apiserver to appear as such. The service_cluster_ip_range IP addresses must be an unused block of addresses, not used anywhere else. They do not need to be routed or assigned to anything. - -``` -# The address on the local server to listen to. -KUBE_API_ADDRESS="--address=0.0.0.0" - -# Comma separated list of nodes in the etcd cluster -KUBE_ETCD_SERVERS="--etcd_servers=http://127.0.0.1:4001" - -# Address range to use for services -KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16" - -# Add your own! -KUBE_API_ARGS="" -``` - -* Edit /etc/etcd/etcd.conf,let the etcd to listen all the ip instead of 127.0.0.1, if not, you will get the error like "connection refused" -``` -ETCD_LISTEN_CLIENT_URLS="http://0.0.0.0:4001" -``` - -* Start the appropriate services on master: - -``` -for SERVICES in etcd kube-apiserver kube-controller-manager kube-scheduler; do - systemctl restart $SERVICES - systemctl enable $SERVICES - systemctl status $SERVICES -done -``` - -* Addition of nodes: - -* Create following node.json file on kubernetes master node: - -```json -{ - "apiVersion": "v1", - "kind": "Node", - "metadata": { - "name": "fed-node", - "labels":{ "name": "fed-node-label"} - }, - "spec": { - "externalID": "fed-node" - } -} -``` - -Now create a node object internally in your kubernetes cluster by running: - -``` -$ kubectl create -f node.json - -$ kubectl get nodes -NAME LABELS STATUS -fed-node name=fed-node-label Unknown - -``` - -Please note that in the above, it only creates a representation for the node -_fed-node_ internally. It does not provision the actual _fed-node_. Also, it -is assumed that _fed-node_ (as specified in `name`) can be resolved and is -reachable from kubernetes master node. This guide will discuss how to provision -a kubernetes node (fed-node) below. - -**Configure the kubernetes services on the node.** - -***We need to configure the kubelet on the node.*** - -* Edit /etc/kubernetes/kubelet to appear as such: - -``` -### -# kubernetes kubelet (node) config - -# The address for the info server to serve on (set to 0.0.0.0 or "" for all interfaces) -KUBELET_ADDRESS="--address=0.0.0.0" - -# You may leave this blank to use the actual hostname -KUBELET_HOSTNAME="--hostname_override=fed-node" - -# location of the api-server -KUBELET_API_SERVER="--api_servers=http://fed-master:8080" - -# Add your own! -#KUBELET_ARGS="" -``` - -* Start the appropriate services on the node (fed-node). - -``` -for SERVICES in kube-proxy kubelet docker; do - systemctl restart $SERVICES - systemctl enable $SERVICES - systemctl status $SERVICES -done -``` - -* Check to make sure now the cluster can see the fed-node on fed-master, and its status changes to _Ready_. - -``` -kubectl get nodes -NAME LABELS STATUS -fed-node name=fed-node-label Ready -``` -* Deletion of nodes: - -To delete _fed-node_ from your kubernetes cluster, one should run the following on fed-master (Please do not do it, it is just for information): - -``` -$ kubectl delete -f node.json -``` - -*You should be finished!* - -**The cluster should be running! Launch a test pod.** - -You should have a functional cluster, check out [101](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/walkthrough/README.md)! - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/fedora/fedora_manual_config.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/fedora/fedora_manual_config.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md b/release-0.19.0/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md deleted file mode 100644 index b5f5816939f..00000000000 --- a/release-0.19.0/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md +++ /dev/null @@ -1,165 +0,0 @@ -#**Kubernetes multiple nodes cluster with flannel on Fedora** - -This document describes how to deploy kubernetes on multiple hosts to set up a multi-node cluster and networking with flannel. Follow fedora [getting started guide](fedora_manual_config.md) to setup 1 master (fed-master) and 2 or more nodes (minions). Make sure that all nodes (minions) have different names (fed-node1, fed-node2 and so on) and labels (fed-node1-label, fed-node2-label, and so on) to avoid any conflict. Also make sure that the kubernetes master host is running etcd, kube-controller-manager, kube-scheduler, and kube-apiserver services, and the nodes (minions) are running docker, kube-proxy and kubelet services. Now install flannel on kubernetes nodes (minions). flannel on each node configures an overlay network that docker uses. flannel runs on each node to setup a unique class-C container network. - -##**Perform following commands on the kubernetes master** - -* Configure flannel by creating a `flannel-config.json` in your current directory on fed-master. flannel provides udp and vxlan among other overlay networking backend options. In this guide, we choose kernel based vxlan backend. The contents of the json are: - -``` -{ - "Network": "18.16.0.0/16", - "SubnetLen": 24, - "Backend": { - "Type": "vxlan", - "VNI": 1 - } -} -``` -**NOTE:** Choose an IP range that is *NOT* part of the public IP address range. - -* Add the configuration to the etcd server on fed-master. - -``` -# etcdctl set /coreos.com/network/config < flannel-config.json -``` - -* Verify the key exists in the etcd server on fed-master. - -``` -# etcdctl get /coreos.com/network/config -``` - -##**Perform following commands on all kubernetes nodes** - -* Edit the flannel configuration file /etc/sysconfig/flanneld as follows: - -``` -# Flanneld configuration options - -# etcd url location. Point this to the server where etcd runs -FLANNEL_ETCD="http://fed-master:4001" - -# etcd config key. This is the configuration key that flannel queries -# For address range assignment -FLANNEL_ETCD_KEY="/coreos.com/network" - -# Any additional options that you want to pass -FLANNEL_OPTIONS="" -``` - -**Note:** By default, flannel uses the interface for the default route. If you have multiple interfaces and would like to use an interface other than the default route one, you could add "-iface=" to FLANNEL_OPTIONS. For additional options, run `flanneld --help` on command line. - -* Enable the flannel service. - -``` -# systemctl enable flanneld -``` - -* If docker is not running, then starting flannel service is enough and skip the next step. - -``` -# systemctl start flanneld -``` - -* If docker is already running, then stop docker, delete docker bridge (docker0), start flanneld and restart docker as follows. Another alternative is to just reboot the system (`systemctl reboot`). - -``` -# systemctl stop docker -# ip link delete docker0 -# systemctl start flanneld -# systemctl start docker -``` - -*** - -##**Test the cluster and flannel configuration** - -* Now check the interfaces on the nodes. Notice there is now a flannel.1 interface, and the ip addresses of docker0 and flannel.1 interfaces are in the same network. You will notice that docker0 is assigned a subnet (18.16.29.0/24 as shown below) on each kubernetes node out of the IP range configured above. A working output should look like this: - -``` -# ip -4 a|grep inet - inet 127.0.0.1/8 scope host lo - inet 192.168.122.77/24 brd 192.168.122.255 scope global dynamic eth0 - inet 18.16.29.0/16 scope global flannel.1 - inet 18.16.29.1/24 scope global docker0 -``` - -* From any node in the cluster, check the cluster members by issuing a query to etcd server via curl (only partial output is shown using `grep -E "\{|\}|key|value"`). If you set up a 1 master and 3 nodes cluster, you should see one block for each node showing the subnets they have been assigned. You can associate those subnets to each node by the MAC address (VtepMAC) and IP address (Public IP) that is listed in the output. - -``` -# curl -s http://fed-master:4001/v2/keys/coreos.com/network/subnets | python -mjson.tool -{ - "node": { - "key": "/coreos.com/network/subnets", - { - "key": "/coreos.com/network/subnets/18.16.29.0-24", - "value": "{\"PublicIP\":\"192.168.122.77\",\"BackendType\":\"vxlan\",\"BackendData\":{\"VtepMAC\":\"46:f1:d0:18:d0:65\"}}" - }, - { - "key": "/coreos.com/network/subnets/18.16.83.0-24", - "value": "{\"PublicIP\":\"192.168.122.36\",\"BackendType\":\"vxlan\",\"BackendData\":{\"VtepMAC\":\"ca:38:78:fc:72:29\"}}" - }, - { - "key": "/coreos.com/network/subnets/18.16.90.0-24", - "value": "{\"PublicIP\":\"192.168.122.127\",\"BackendType\":\"vxlan\",\"BackendData\":{\"VtepMAC\":\"92:e2:80:ba:2d:4d\"}}" - } - } -} -``` - -* From all nodes, review the `/run/flannel/subnet.env` file. This file was generated automatically by flannel. - -``` -# cat /run/flannel/subnet.env -FLANNEL_SUBNET=18.16.29.1/24 -FLANNEL_MTU=1450 -FLANNEL_IPMASQ=false -``` - -* At this point, we have etcd running on the kubernetes master, and flannel / docker running on kubernetes nodes. Next steps are for testing cross-host container communication which will confirm that docker and flannel are configured properly. - -* Issue the following commands on any 2 nodes: - -``` -#docker run -it fedora:latest bash -bash-4.3# -``` - -* This will place you inside the container. Install iproute and iputils packages to install ip and ping utilities. Due to a [bug](https://bugzilla.redhat.com/show_bug.cgi?id=1142311), it is required to modify capabilities of ping binary to work around "Operation not permitted" error. - -``` -bash-4.3# yum -y install iproute iputils -bash-4.3# setcap cap_net_raw-ep /usr/bin/ping -``` - -* Now note the IP address on the first node: - -``` -bash-4.3# ip -4 a l eth0 | grep inet - inet 18.16.29.4/24 scope global eth0 -``` - -* And also note the IP address on the other node: - -``` -bash-4.3# ip a l eth0 | grep inet - inet 18.16.90.4/24 scope global eth0 -``` - -* Now ping from the first node to the other node: - -``` -bash-4.3# ping 18.16.90.4 -PING 18.16.90.4 (18.16.90.4) 56(84) bytes of data. -64 bytes from 18.16.90.4: icmp_seq=1 ttl=62 time=0.275 ms -64 bytes from 18.16.90.4: icmp_seq=2 ttl=62 time=0.372 ms -``` - -* Now kubernetes multi-node cluster is set up with overlay networking set up by flannel. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/gce.md b/release-0.19.0/docs/getting-started-guides/gce.md deleted file mode 100644 index acc1e06fb7b..00000000000 --- a/release-0.19.0/docs/getting-started-guides/gce.md +++ /dev/null @@ -1,124 +0,0 @@ -## Getting started on Google Compute Engine - -The example below creates a Kubernetes cluster with 4 worker node Virtual Machines and a master Virtual Machine (i.e. 5 VMs in your cluster). This cluster is set up and controlled from your workstation (or wherever you find convenient). - -### Before you start - -If you want a simplified getting started experience and GUI for managing clusters, please consider trying [Google Container Engine](https://cloud.google.com/container-engine/) for hosted cluster installation and management. - -If you want to use custom binaries or pure open source Kubernetes, please continue with the instructions below. - -### Prerequisites - -1. You need a Google Cloud Platform account with billing enabled. Visit the [Google Developers Console](http://cloud.google.com/console) for more details. -1. Make sure you have the `gcloud preview` command line component installed. Simply run `gcloud preview` at the command line - if it asks to install any components, go ahead and install them. If it simply shows help text, you're good to go. This is required as the cluster setup script uses GCE [Instance Groups](https://cloud.google.com/compute/docs/instance-groups/), which are in the gcloud preview namespace. You will also need to enable `Compute Engine Instance Group Manager API` in the developers console. `gcloud` can be installed as a part of the [Google Cloud SDK](https://cloud.google.com/sdk/) -1. Make sure that gcloud is set to use the Google Cloud Platform project you want. You can check the current project using `gcloud config list project` and change it via `gcloud config set project `. -1. Make sure you have credentials for GCloud by running ` gcloud auth login`. -1. Make sure you can start up a GCE VM from the command line. At least make sure you can do the [Create an instance](https://cloud.google.com/compute/docs/quickstart#create_an_instance) part of the GCE Quickstart. -1. Make sure you can ssh into the VM without interactive prompts. See the [Log in to the instance](https://cloud.google.com/compute/docs/quickstart#ssh) part of the GCE Quickstart. - -### Starting a Cluster - -You can install a client and start a cluster with this command: - -```bash -curl -sS https://get.k8s.io | bash -``` - -Once this command completes, you will have a master VM and four worker VMs, running as a Kubernetes cluster. By default, some containers will already be running on your cluster. Containers like `kibana` and `elasticsearch` provide [logging](../logging.md), while `heapster` provides [monitoring](../../cluster/addons/cluster-monitoring/README.md) services. - -If you run into trouble please see the section on [troubleshooting](gce.md#troubleshooting), or come ask questions on IRC at #google-containers on freenode. - -The next few steps will show you: - -1. how to set up the command line client on your workstation to manage the cluster -1. examples of how to use the cluster -1. how to delete the cluster -1. how to start clusters with non-default options (like larger clusters) - -### Installing the kubernetes command line tools on your workstation - -The cluster startup script will leave you with a running cluster and a ```kubernetes``` directory on your workstation. - -Add the appropriate binary folder to your ```PATH``` to access kubectl: - -```bash -# OS X -export PATH=path/to/kubernetes/platforms/darwin/amd64:$PATH - -# Linux -export PATH=path/to/kubernetes/platforms/linux/amd64:$PATH -``` - -Note: gcloud also ships with ```kubectl```, which by default is added to your path. -However the gcloud bundled kubectl version may be older than the one downloaded by the -get.k8s.io install script. We recommend you use the downloaded binary to avoid -potential issues with client/server version skew. - -### Getting started with your cluster -See [a simple nginx example](../../examples/simple-nginx.md) to try out your new cluster. - -For more complete applications, please look in the [examples directory](../../examples). - -### Tearing down the cluster -To remove/delete/teardown the cluster, use the `kube-down.sh` script. - -```bash -cd kubernetes -cluster/kube-down.sh -``` - -Likewise, the `kube-up.sh` in the same directory will bring it back up. You do not need to rerun the `curl` or `wget` command: everything needed to setup the Kubernetes cluster is now on your workstation. - -### Customizing - -The script above relies on Google Storage to stage the Kubernetes release. It -then will start (by default) a single master VM along with 4 worker VMs. You -can tweak some of these parameters by editing `kubernetes/cluster/gce/config-default.sh` -You can view a transcript of a successful cluster creation -[here](https://gist.github.com/satnam6502/fc689d1b46db9772adea). - -### Troubleshooting - -#### Project settings - -You need to have the Google Cloud Storage API, and the Google Cloud Storage -JSON API enabled. It is activated by default for new projects. Otherwise, it -can be done in the Google Cloud Console. See the [Google Cloud Storage JSON -API Overview](https://cloud.google.com/storage/docs/json_api/) for more -details. - -#### Cluster initialization hang - -If the Kubernetes startup script hangs waiting for the API to be reachable, you can troubleshoot by SSHing into the master and minion VMs and looking at logs such as `/var/log/startupscript.log`. - -Once you fix the issue, you should run `kube-down.sh` to cleanup after the partial cluster creation, before running `kube-up.sh` to try again. - -#### SSH - -If you're having trouble SSHing into your instances, ensure the GCE firewall -isn't blocking port 22 to your VMs. By default, this should work but if you -have edited firewall rules or created a new non-default network, you'll need to -expose it: `gcloud compute firewall-rules create --network= ---description "SSH allowed from anywhere" --allow tcp:22 default-ssh` - -Additionally, your GCE SSH key must either have no passcode or you need to be -using `ssh-agent`. - -#### Networking - -The instances must be able to connect to each other using their private IP. The -script uses the "default" network which should have a firewall rule called -"default-allow-internal" which allows traffic on any port on the private IPs. -If this rule is missing from the default network or if you change the network -being used in `cluster/config-default.sh` create a new rule with the following -field values: - -* Source Ranges: `10.0.0.0/8` -* Allowed Protocols and Port: `tcp:1-65535;udp:1-65535;icmp` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/gce.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/gce.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/juju.md b/release-0.19.0/docs/getting-started-guides/juju.md deleted file mode 100644 index fdbd77500a2..00000000000 --- a/release-0.19.0/docs/getting-started-guides/juju.md +++ /dev/null @@ -1,228 +0,0 @@ -## Getting started with Juju - -Juju handles provisioning machines and deploying complex systems to a -wide number of clouds, supporting service orchestration once the bundle of -services has been deployed. - - -### Prerequisites - -> Note: If you're running kube-up, on ubuntu - all of the dependencies -> will be handled for you. You may safely skip to the section: -> [Launch Kubernetes Cluster](#launch-kubernetes-cluster) - -#### On Ubuntu - -[Install the Juju client](https://juju.ubuntu.com/install) on your -local ubuntu system: - - sudo add-apt-repository ppa:juju/stable - sudo apt-get update - sudo apt-get install juju-core juju-quickstart - - -#### With Docker - -If you are not using ubuntu or prefer the isolation of docker, you may -run the following: - - mkdir ~/.juju - sudo docker run -v ~/.juju:/home/ubuntu/.juju -ti whitmo/jujubox:latest - -At this point from either path you will have access to the `juju -quickstart` command. - -To set up the credentials for your chosen cloud run: - - juju quickstart --constraints="mem=3.75G" -i - -Follow the dialogue and choose `save` and `use`. Quickstart will now -bootstrap the juju root node and setup the juju web based user -interface. - - -## Launch Kubernetes cluster - -You will need to have the Kubernetes tools compiled before launching the cluster - - make all WHAT=cmd/kubectl - export KUBERNETES_PROVIDER=juju - cluster/kube-up.sh - -If this is your first time running the `kube-up.sh` script, it will install -the required predependencies to get started with Juju, additionally it will -launch a curses based configuration utility allowing you to select your cloud -provider and enter the proper access credentials. - -Next it will deploy the kubernetes master, etcd, 2 minions with flannel based -Software Defined Networking. - - -## Exploring the cluster - -Juju status provides information about each unit in the cluster: - - juju status --format=oneline - - docker/0: 52.4.92.78 (started) - - flannel-docker/0: 52.4.92.78 (started) - - kubernetes/0: 52.4.92.78 (started) - - docker/1: 52.6.104.142 (started) - - flannel-docker/1: 52.6.104.142 (started) - - kubernetes/1: 52.6.104.142 (started) - - etcd/0: 52.5.216.210 (started) 4001/tcp - - juju-gui/0: 52.5.205.174 (started) 80/tcp, 443/tcp - - kubernetes-master/0: 52.6.19.238 (started) 8080/tcp - -You can use `juju ssh` to access any of the units: - - juju ssh kubernetes-master/0 - - -## Run some containers! - -`kubectl` is available on the kubernetes master node. We'll ssh in to -launch some containers, but one could use kubectl locally setting -KUBERNETES_MASTER to point at the ip of `kubernetes-master/0`. - -No pods will be available before starting a container: - - kubectl get pods - POD CONTAINER(S) IMAGE(S) HOST LABELS STATUS - - kubectl get replicationcontrollers - CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS - -We'll follow the aws-coreos example. Create a pod manifest: `pod.json` - -``` -{ - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "name": "hello", - "labels": { - "name": "hello", - "environment": "testing" - } - }, - "spec": { - "containers": [{ - "name": "hello", - "image": "quay.io/kelseyhightower/hello", - "ports": [{ - "containerPort": 80, - "hostPort": 80 - }] - }] - } -} -``` - -Create the pod with kubectl: - - kubectl create -f pod.json - - -Get info on the pod: - - kubectl get pods - - -To test the hello app, we'll need to locate which minion is hosting -the container. Better tooling for using juju to introspect container -is in the works but for let'suse `juju run` and `juju status` to find -our hello app. - -Exit out of our ssh session and run: - - juju run --unit kubernetes/0 "docker ps -n=1" - ... - juju run --unit kubernetes/1 "docker ps -n=1" - CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES - 02beb61339d8 quay.io/kelseyhightower/hello:latest /hello About an hour ago Up About an hour k8s_hello.... - - -We see `kubernetes/1` has our container, we can open port 80: - - juju run --unit kubernetes/1 "open-port 80" - juju expose kubernetes - sudo apt-get install curl - curl $(juju status --format=oneline kubernetes/1 | cut -d' ' -f3) - -Finally delete the pod: - - juju ssh kubernetes-master/0 - kubectl delete pods hello - - -## Scale out cluster - -We can add minion units like so: - - juju add-unit docker # creates unit docker/2, kubernetes/2, docker-flannel/2 - - -## Launch the "petstore" example app - -The petstore example is available as a -[juju action](https://jujucharms.com/docs/devel/actions). - - juju action do kubernetes-master/0 - - -Note: this example includes curl statements to exercise the app. - - -## Tear down cluster - - ./kube-down.sh - -or - - juju destroy-environment --force `juju env` - - -## More Info - -Kubernetes Bundle on Github - - - [Bundle Repository](https://github.com/whitmo/bundle-kubernetes) - * [Kubernetes master charm](https://github.com/whitmo/charm-kubernetes-master) - * [Kubernetes mininion charm](https://github.com/whitmo/charm-kubernetes) - - [Bundle Documentation](http://whitmo.github.io/bundle-kubernetes) - - [More about Juju](https://juju.ubuntu.com) - - -### Cloud compatibility - -Juju runs natively against a variety of cloud providers and can be -made to work against many more using a generic manual provider. - -Provider | v0.15.0 --------------- | ------- -AWS | TBD -HPCloud | TBD -OpenStack | TBD -Joyent | TBD -Azure | TBD -Digital Ocean | TBD -MAAS (bare metal) | TBD -GCE | TBD - - -Provider | v0.8.1 --------------- | ------- -AWS | [Pass](http://reports.vapour.ws/charm-test-details/charm-bundle-test-parent-136) -HPCloud | [Pass](http://reports.vapour.ws/charm-test-details/charm-bundle-test-parent-136) -OpenStack | [Pass](http://reports.vapour.ws/charm-test-details/charm-bundle-test-parent-136) -Joyent | [Pass](http://reports.vapour.ws/charm-test-details/charm-bundle-test-parent-136) -Azure | TBD -Digital Ocean | TBD -MAAS (bare metal) | TBD -GCE | TBD - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/juju.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/juju.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/k8s-docker.png b/release-0.19.0/docs/getting-started-guides/k8s-docker.png deleted file mode 100644 index 6795e35e83d5bf1350903e1a0a0a0028b99ad6ac..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 52545 zcmdqIby!qk*Eb5o07J>p4MTS+okK}Vh#(;yN(myJGc-u3bb}JoEsd0dptKT7OV`jX zXOH^4@AG~Co&U~tu4~}Z&7QsYecx-{>lbTB>uReK;nU({U|j;_V}(EHL&XT0cD4 zn6w%NST9-~p$m!#9J$S!HE5)(LN~ zLiBJh22EVG%ciHlQ~OkRvMYeFZT-RbL6_tC_nY8XEaFORI2iaU-^65sIH*=YN&0mk zX>Q+u2ab}tZ$}8woej=rrzPO}?*0K$MI^-8w6-+FN_ z`6LI!r|9vo7;v<@brH#An#0O^zx~C2o&LGCFmF=Ny~QXWt>L43!gwJnM3rlb3MRX; zOZt;nI~DXhJI3EvpPYY~o@Wfwzn1OyyENG6*dESNh|Mvccit`+Y^TIHVKd2OsOv~J zz^He@fv+r<>+HcW4zMxm=dunNBb?1&_bw4~61>>nc7BeT>m|y zaQD(sx`;|1$*N9q$4+IXsJKW|`O6o=TdBjg*Qd~%1!fn6bYZpuek7AxKYALYjubvPl*t)a7;iGvwALiTzB7KSLk%upW z6c7UOSrXAB?zmyi!7#!QYEY~cECDr;0~}ndAU6espzsu?SE!>K#st!D1gsq*=7#eK z{IHYAjeroL3dfJ=(iFm+Lpnf0P*93D3Z*Y83y9MdzeDLvAihcpx)S7AAC;nCLSMtr zM>yV5^Msb>E9uG}v3k(9K+Hlf@^D9BA~@HWfng+Rpm8grDUA1s>1t_uh-&xXg0c@q z7A{rik423pO1WE&-BgQoC=9-Ei|#}SydQ!!de;a-x38@D(ufU{gxTp8O97}vCFA9- z0=ninwO7x6Vc|sPTcuG`exg~9G>%=gHnjR~ts(R+%_hxIi)vNO9(o6P9#Uxit)|F` zvs~T_PmClpj=$H?GQrZcI<*FC%4%Dh{#IWn%@Vy^P!si|+fPL+!HvX|v8{-$9->8# zeV;a-Ir6;_;;!c?>j35s{9yWE#`y%MPaim6;+cS*LWr4DU~JB851_P=HOO@sNwsy*b|SfY1RK?THtzI#wRYdW^l0nO1SU(08n<{$9P*jNOb7gQ|GJ z<#^)8$0Mfo_9Hwyc01D*t`+(f+LgM2`#9Y~mS=bF(-g)g#L9Ez+q4=)e@5UX-9 zziH!6KIeJL6Ohc3Y@dvooKUJ|;QEdHTXv~Ssm_FuBZs4v zk(*yvk(<>m(SA)Aj>kQlvYUyt8MGa=G_(e^sUn|5X)>N>e9l1PX^1z*tq=e_dLlS znf`#czM1E|1hOxTUSw0wQd;os@agk!@i7^58)F-})NfW_^vv{TIGNc5_C+`@+tdve z&8{|7lQvYP)i>oy(@Egh2`eM`2 ze(W+Xr$1-SxO(w?w($`65Yf7AXDoxX0m@NFR3_jjdqy8JSw&7;j4#LjjvCw_Z;_%<)q}I z<>KVXI=ni{0tL^ku0hvc7qf?xsI`m9OC7KTxEyaCzW{s}Y=|pIa2t;l+Y{W=h1t~_ z!X!9m!S-l^5~O&g0s+Q0{*01^^ zj#87-`|fAek1F3(@2U8!q^fA98u1y|{kj`#5(_JmrDUR`@MrUKFF75X)r?%;Ucz7A z6}a;#rEYu1yVwOTIdU)t}Xm zE3#X~RP&nMk>zX`>=Ah@q|`Ft@NL(C>tRDT!`1N#<;q&3=%OFvEQE$)39bUg9uDV2boo-cxf3JM>qgmVAtgB`5 zxMM591?HkQjT*c=7-vT}|1@T9LN8CRy2J8G-QMaa#b!ml#diK7(_79Tohh7mX6@@L z9Dk&;n2#P?4=%+l>9GHNy)|zf`0#x8%SqTyd*MmprT2mt#QW#$M$4g5y0x+S^ho7` zS;fkigEt3_tq-?546RI`SrR)W*e2B9eplPBQRS%mt$4Fw6G@wpvD&`r-?)=K)AwWY z!@NuIIA$EyM_f5Za{9L5{!?A23I&&sRzDZZdxp2(Y_@!O9BdJ+yrZ`NYFIT~wXm-{ z!SkE+#H9E;@g%YCxYwU*mY?;xUN0Og`ID7x=-zqTd z;JnT~c|T$jW0L><=lAIM1!4~VTK@AJi1BQOAqIZ=%$tCt*pu{(x`D@@)YvN9!e zy@L)EKZWnVh^C5^dgvk7QvYi#yRy1+ZV;JTWxn6+Uh<>;^2#8!>~W=}nRH-wVEazQ zb=-Hx)|?cJ?I4GZhCP?|4Y#`Ml;w)}4(!0S3$shXxs#T_mH3-%I;TyCulak;~ z@_Cg`5B6}$Fz?;^yPK*Ns>8A8v9o?PM;}pxv8m(B;UBnvzdubLEz1q^zHEPN{ka$A zG`f{8uQB(oL-OMLiOZVp`mb?shrOcWn7OhJ`4i-I{-w=P->Z#noim-}+&Fpf0KBUM z9}XA$)%nw~!^_)J#z6q4#B)604$HV??f^SIb4o8xteQXkEiasX|hI79A0z63N09!eXnW zq^@_L6%w=m_|uoYHo4{J*^d>0!T<+-_t0F5V zDeV6zA62N^`S?KoUf}G#N0qd{e_5HJhZe;Jl9Vi_x;hH?B>Bc676Dd6pg-2Jh+!5m zsF%Hx*gBTDRTIPp4F|ik6-$S!9sM+tgT2V{|D5v@{)IHE3)gmEZr<4k?yg+Q&Z+h- z37lIe%#8OE15X(r`TXJS6=%Pqk+*c*-UX-~H+k5d-}0mATXZ&qA6WQ|X@C@5uF)!2Dq2UZ`ShZYjCEKKUy_86!K=^7SB)YHXAH7Y-oYkZ{O?zx;h{$VJ`OgOrPTkL{~vcuSuQ8yv*800AkGFdKh5T@8Nf zw*bL-VjF2;FHuzC%=Kry@C7goo@Fg>aS0cg?f24nKCO)&G3o_eS6MBSX6XF&Wc|#r zyLqPPk8^Dh`hvPb$g;-lwd37Zw%f(A6k3_wf7VADnHL3J3;g=RR_5SV%tK&NfWuk$ z7WxRXH;y}ehof%{vaegazb9hgfpgIpM`eDc{m=A?LAK=+Dd-sN1ksBb15CZv>{GA5 zEB5C?z=_>Duy>kAew%Z>!Tikk$|5Tr`6zw{c}2*4DbV~eF1zUaCpFa3lsmbybG6dcFK6~hC&I}~mEl?%Bx~N~sLyXneKqm5Q zld>?AF$+F~#QC@8wVu4ai$~6kt+3?z=ZQ%`>`Tv27vH61!3^|CtqUf%Iq+V>MMxyP z+4YmeKdzK676gTBh1FMl74+u3wyv%~KLb<~SpS*tpR?c7X(8A0c`6x@)o~cO%9JntU!sMm{wGUN zJY343`OTwKEj+mNqDa${(PxC{AXwPWVvUu;phgXj$!wgQnp@v1SPN8~asK3x@)bH1YT^ExDNfb)z2dN=c_kE=xWMJddmetA(NW8F z?_%w2a9~~C&X2~j-%IUW6~Q;ZZwFo+z2SRp_X-2Aml~-?1zY{Gf7n3$YmDfVN=7;= z4Xg%phvMkn3EVF^5)~Wu~00tl2Tup2(kNB?mop#SIotezWT|&;Cl%uKeBQ=L2BKS*oz| z@fxpdme0PuF-;%)5|~ooswQY$UmUw=nz#AX^nU!P?&al{Yrix9!NRc0oS%$SJIQ@z zVETRGJDs6Sah(>=t<{=66*H#6KU2{SJ=^bI5ahK;JMkUxKQxb*N&R);k-mmreHb6O zn@6#GY#CBouMmpk{;Qt^N!6_#mL(Tx;tTeWYAwo@c%~?KxqZj8#HuIa{@c4mt+wv# zBg~S|S7Uqo`ZSk6#T5eg=3!_fdZ+5oaEnQf57ksqRJ6*C>)=*l`}s9b@W&X6*-6*g z7WOB&1HH#)tzMrs1>4!;Xhq$NYZwa(3i`j5JzS}1oV!mrB49!2BJH+-u(h-M%v;rF zJxH{YckfBxY^!&n*UrrSVr_G+arzT)Y3^SfOU}RHv`b#@z%){_&!FWW8oELq*f!9NBNoIOjryOSr_0d`^>< z2D$rKIqB(l9uJ@vd%j6RUZ(JyYLppPfEkl7PxlCB7Vm{Us4y{T@!qSvkoDYru!4N{ z(DFIrB$i(CJ|(|N(i+c_=0cZ3XR}y+e&FSa``QpgpoZVk`l6f|6Q6Od^4(Z!=JfRR z-SPexznA7l{yPa{a^OZPYNOtL#_UTD*Lez|V60&9yVH&FzFAC}WQ%6^!cKw^&fkVT zd9X(IO!DR*%Mc`S=-dxrhd%z|L;JI~Y2wW5NjLw8=1kUc zarxJm30YKSOT79;KzK))19jV~tr5x$g{};yQuPLn{6i*Af`rN#DJhbklQ*@5Hxf^477o#V8ZRKVoW zt1mdWT<%GGuE$_}K)AbW3!ZHd%%wW>TT78Ms}N4iF9|{Sel%7cXl2Rx-uLCy#lh(s zmOag)Rb$QRainhR5rV7A>EO7knwVs0<;WOE(?bX$uYgSRA6SyBO6_+UD~P7uZWW}) zP1Ck>Nu3V0*52Bo)_)J<5c-O*h{Z@*#%zv-JcpVYhW6pI*#3C$q7l}ah&2vU4ipM9 z3f<}22J%S5QXw{-h>-?`gkZ`48K@5n2Il>eZPw}Y=3?@E$s5Jp=WIU)e!tFP4_>qm zeeVnaus6{NUe)_?zZWPF&9>|Q7Mfh)5EV6y#*%k+me6>lNX}eOBBD#M4U~qD{mOlR z>0^Ka3!F|r5ucPSinuF@UCXMQfRRuuHRLgtVs~bjDM;xu!~rE?Y4W{5J@FtKcj84y z_jXa?2KS>VGvuPIu&~}h3V)fL{{`kgPUsp$PGKP&;;{c4|t2D<m4ZT)-2#iueZI+ZNTDk2{{q-Nk74rOi6eXryTPvf-nJF0N?2th~y?)h3ND zunTd205jAzI>arGg$<&M#qHjSz;x7C>=l8*81{)TxIZ+=^!jGW`Ws?9vEJ%Vv_e#- z4uy|&S<(si%3301Z9WmQ>&mQ53X?-6zO(zwuHYTX3`D{Z4;8Dv6b_CtLXUpXLlU+i zEs^=bLO$LLDj}!Jx%yOm@<*Z*6x$ufrK_sw^7i)=*U#Nz%7^VgND71%S!ybNk+T^B{N`` zKKz^*a@0Yc!W~h(y3iHs`N2!{u# z2-s7sGCKtfpW9mbe&;Kx$&(nG=iN3TuxErhRwh}Uyoil^)Uh_xGh!|??+ODJ9gyka zw+6zfK>Mr^%D$lu>h0ld>4zT^CMrxHHW1fPLO_x4x@wy{wASt?pQEtsY)aD__AEm; zY}R|6s@jWYh!ny$oTfOjcSiR4QG^@qO0ez`ITYNajG3B|k+ZE6q_B>9pC|CE$3tT4 zNX&`m>d(@n7aYCj^2iZB`=|9=Z{O~&^jx{xk*~rLO+jy}S|b$%hir_^8J3Yw)Nadd zx88s1r1p2WtW#_s#%TjZ?RSm`K8K6q%+x&|HuSf%e6GN!`NDmHMo7n{TZG?7OIIK) zQVd+k%0DAz)eUA>6MENIFAU+Jo^gDdJG8YiTe&C2uM7?&8%vWFe6q##8->f>1nrFP z$Qz#8QfgF6MP6$|>xuOuoQ&`Yc*Br!>5^?s0GxTaMA(gW)kQYPRZxsEs{D_B{27ai zX6K62vrjEOWO0QbI2tNUOFI{&b)@r$*Y)miKIC3?N>)%`D{*-jJKhr#k`?|M-V0Te ze#Pw2cZaQyJ(2Q=S6(vEGq4!ni-hHE_P_;O&s%K7{+{B1F`M&(_uOuY_ex5!gOCUG4SkX`7;0ERT0c9 z!I%e_A!55y$%Vfy7^QEF#MAfC%b@!UtVl`r#l&pJ0GAVqGYRw2~KRq_3n; z<4VpU-Z&gEx=gkVR)^W+p)%R+U1g>J@-L_c00`H@YFk)J%JyFOXWcer%eFy3n-x2p zgw*h=JnPRRzziW*K2{N|t$v3&hrNlc3U#AwP#b`zT5m_xwW1#c9TLQ7Omw9_RR8CH zWSB9~Tp?kSKg{rdm@Hh61mbJyrze`V@{b_{q$27LB6(%* zp@%c736KE4J%0bYe+Kt=h;R^zI&hf9m4NR5BpJZj$c<5d*XcWdHz8covvnhTHIvyI zb49gHD|YmZSgImedgJkj0i^%unbII%=6`dsiRy=if$#7F3=IWGjMvB@79IX~FGD{Y zasiqL!MpV^MdN>;L|A3v;&@B$^z?g$sa&yL_c|M}T-m3|?EroJJ01uE?&sICJzb}2 z?eH=HK+j!eLhql>N;!<=A%|7aco4V%r?IiI+?rMQIt%c1v(vbv{1ximKiXBEnvLmggL zhoVL!>WkAo!Pyqi!)6*$$BCEN1eE<*lFyUYKCi`UQHz3`qzos1YIueHjb>WN_JzuQ z5s#idIT7b6-IXr=phL@(u29@vg-rmS7Cs)%*{xj^mhjw65^?&jwY2>9v0B}eQI>DR zcjIWAFKJ6~p;1l500lZ~jcyu7ikp#c`{;WLx%$ATXFQN z3YY4MOYx3^bb#1~PGu(Ky|=Fmdba(4+u!|vnanvPGvfr?*Q*jA)*uGLWUf2b8|aZ|Ex5V&eqBhcNMri z+0hrq^T{91q0&!y!;-!wg7*=f&miFJ_d2<9Ai+58R;NjU=I3ki z9@|rTg~B)R@>??n(+jjS_0}Kpxy@SYr5z$~F+8AyPQ_p9ykGz+?1z<88x1@IU$zZp z+c0>KPg$aK2Neq6AY~CqWui$F`2{|L9RWmbw`K7fQT+D#+R$c}qyU&#N+ECEL6cfb zi4TrIvkzZRw^*bsPUmV{3!r)uGRZxHl2?W&bVPXjfOI)v=g@AsIavl){Dz~Hh;cakmz2i5Y1aI7~wRJ3I+M@Rr zX03+4++UWkT|#|AjJid5qp*@B9VfWhVG%@ht54+y5E~^P7oeG+4NebB9yQlm$6xg~ zK3l%a?(8Ae_I6hA!&R+g)lx0Py;^97f3-v!w_Z$ zW%%dU?B5;}rY*XpNqLq^6SZ-0HJUUyI&Kb6*F82cxdyl&Ln-0)^wlj)P(ri;0c6aE|1(1z6y&qiOw<{F!YzEBaVQSrY*Layd9S3?zm+agpV`0q7mC zAkk*`k)Re+Xk@=L>Pu(c(QfM={y-$Nd~aO#yO2hR;@2To8-dimQ56_h4m1v;_{&>f z=XGu2qx&p!wdV6dLxo|a*ijv(0i5W~d@(Eip!nB$YGH{&eU2u2TP^Ec$sSMsbg3xE>s|7@i z)LM5G)9tMQ-rOb$C0g~lHDRS)Jh*=nFM}Gflp>em^1{J^8UTBlI{m`hUANDfaFK7YWMje0KMo9olV-Vk`Tu?p;9pU+1VJK)IxZ_kYYg?#|#ewrS+m4Unk>^OhY&V?Y4M-77=c6!n z1g;Ws1oPdZdznSn3P%V7okhje{eq5w^Mm(T%YXpD!;=FlsOX0Z1s<;6YrxDMDjR>) z=A*~ZJ&s7tp5F1cP96Fo$=64KgW^h)<&{dP?BRQPBpMZ}k<8P){76Jl>(zlhl+p-- zVNRygt$wFhw)T#Xxf?ObO^x5Nqi6#m2&Y?ZUb8hohRPHiBA{qZ!0G>Yn*(+_U1|`N zBFzNsij^~$X~PA*L@v1YMt3S9I~`@i2|TSwwjCC>9Xhv5Dp0nt2+%XKs2aps4J~MB zvAyPw%Vm_XqN>lK*g0<0jTu*);~N1co&4248Pid{A~`t=}3E6-@QPo zGr_Da1n;w)lIj1XAEX5|cld3IFf+WcY)mRQTdToj$@$sy13^&=i$AItG85~?1ihCv zwo-u%grgK;l7@wf(DrE$i*o%hFL4Nk?6h!qoQNSZ3>Q<6QsnNYL%r8+6#Rqp=%ZB1 z(%S{n?nh9~gr3p%j#+A?op&hcc6$Vuuk1hfAkBkB4_ywJ{{=7-Nu5=foKp2GD&x+C z88u53OL$Nw>-cjx5tJECIS-;NxlQY=KH!5T1RpgC4P($Mf@(<8X6(d0KR=3)1H!oF zpwv=I4=CCOSGZymN^Mvv;0RS5e_P9F(?f&_0ceX{!0ah(57ljHLU~~?c7(04#}t4< zZdUn1iL0;(wJf2!X>;M7?hqaqOB+fTs5gW|RpwS$=JYsL4I`AhYco*r1bvhYs zi@@XL87yq`Ti{fs2YI?z&vL7`WXHy> zU%;J%$3K2=w|D(VMmtHs^`}_o#AOQP3mfuZ+SHllY~13y% z>`^ZXEVz!2&Jeq!VHG{^oy zlIPj|l&T#JD%5^qyA=OL;m62kegKR-nBzR0;63!5<$zGPlUJQfg3)JMe-6CTb7E|gkGxpuw_x-qhvh%j)cYQ(a3|*%t|=n# z>pLvZaDBwt_^l{Biyvj`5+RR-{>mo|JzND<0 zXSvgwe*ioZ!r`{GWV8Q^J9@#s&Ven@uwD@%R}^D4lOd|zN5<0o7DjBo>O-ot;VX9m z@F3-RS-XV)ReNE!VCX5P9LV;U@ieYq3=HH&{{uX7Fo{?tScExE=yY5@23(SJ4ffB1ezTO$gX8apz^kvj6_Q z{tw`=z8a=6SuY1vTo?}?s!W8(l~?*NNrUo%J}_mnY2vbJ(6_U6DSmMWLf;wz+=TF_ zt=Hcb$$Nqquoo^dZRMkKA;NE7k6riIFd+emr?C6m>3e^9(ZAnOXg>PNopb8e|9SZT z?b%k-!q?-6#4DRSeZnDWvw(}t#fPNI<>#m}6c%&H`^OZ4ihzxL`2q@gne4x-j4k5@ zD1xwhFqg98U}nRA*km;%>`~YgVzq`};F65j(DI-fz->lyF}v+*6lL8TE;tp@*yU_h z_(w}%PU(#qoIz_6MNXV|}EO@~7ho1s06~T%pBsBY~F)j{m4FB(E z4X6aqcH3>xZu$SLuv+IUKoFq!{W10A-?^PNVeafR=SfIUcw*3G+yH2!|g zIyNK@0j{nrh8gp+zeC=c;V(r_f^xYydoH_A`2>vzyJ4ntogdqX ztHGAg5&M(hD)jHo-z0YqJyXB`h4}_ZYF%z_voWhuZj<0=Q-Y*XilAHPJh6%gfP?>s zbZe2GT~DzYOTqM(SUdve7yLikP71y*=x$`GM+%>t_Gl-|C=qO5n4wn^OpN^Jy-9Lh_>jobLALT zQ>y*`YeJE_WKm~nF9G5Im(BfJTXhFO2ag53566jjulA&L$hGnu#*5s~4_0LGcn!LER)f9AQ*Pq~Hv*QX)a_?Wy)xd8Uo%8Exi7lI3G9ZlBz-F>j&aNSI&%+% zt0P}_Bjm>jmxcyBfoeYnuzQCe?cJ63RRP50XnR`USEqb~QN{-by#p|^`>C{|js;_zC2FYmj{rNAAI71R z!^cIeA63u%-U=9^`{}Nk=hsJ6V@~@ukB1qP3jvcx;{h|%Ogy(8^nO$vA}vG+k$+DO zD*-&@x%<=jo`ODA9Mco3naBf}#|ZI6_=ZE8cH!XYMquFH_liu%!6a^da0vKXn6BxK z;JV-@=*6#Jw$DjDW4+!6u0PxuD=Y-unXyW<)_{#KoFl|OvASXxd4u1sdji7?i;D1P zO0Y>U;sSul(qHQY&E2jp{GT)jB2*%+6J6(S`R|zw?ZwXza>p`%kY6F^HRS6{i%G5; z0D%13!VCfv>*wU{J9nPPZkTMg2_wD=FWq&I#dOnFR8$-qNamg0a6^5hviL)US-AIwU*OTGDi6^Z-7`v_ zIA;6@zmK;j%beE9Hp?tNbolk{pC7J$YiOJgGR;;px9QB*uY4qV>^oMVz9|*7{`+l0 z%d8Z`0nHqhw@E8jJ&~YvtNTg}&v@FKm5u;l5wZZIvSmv#xCTJ{&EKV?ZB9-I(<5p2`j7q$>gloPxBS>D{I zHlA}95T;%NI@93U{_^ZiJW3>BXQtsc+NZ>JobL#-lC}^;V28>(mt?TD7gXL(Fe2z zs&tlUqHEXn)=ErC;$0J^%#JwDR!H$RDk?9q-<5F8zyewUs4{CU z8l%SY{@D2_LB0Y<$EgI?a}|fDVKQ zr4Q8Yhq5+uN<$S60Ii8#TKb3Vli3ERR8m49yA1UGJ$?grGgl3ULWszm7H+Q%eyW(3 zjtS67K*|i&?x0pC>Wvhu_Xf7K+b%OA-b_NWgqY{+p`PldJ!A!G>sQpBlYol>=#`~7 z%NK1Q_R==NR^ah+3;&%48U3u0T|lRaS!CC9xoe^|+5Pw@LHYYaq8d)Sfg}>(`#R0@ z%xcZW<4WRtU`h~(`#})NX;=f4d?{5-? zP7+~eK%*Nt^tdXk>Ua%EiE4mo^=;g>c;@p>b4YWw`tV`h(cy4_^ ze+n8>=!Fp}M{_D=qkSYexYGtv|H*?{6#CvzS|%BJ_c$Q8zuh=&yVWs192 zwo$Kw{ZDrdn3yA84mqPFx_GU{qKN-Eo&P8#{1+K|^^RaR@xhE4P)r}%Tdp|q$M}X) zX_7kD%UEq(X+zlK=7e>)ie^GV>(A3lSH8l?g}ymiyn93dU}sFr*|ojrbZSieiNuHLUH(l*cqN@VZCSoRz5Zn3_{B^x1WK(;d63c0 zd683TRHKM`^WS@$GA^d7R$r}B9Oq(MM)(;np?Sku=LEBKC~CwUOSb7f8SQVvH;Y!& zZN7B@hhN1VFUYJ}g(@IA$5^7ht(F(my+jug5`=A^;u*G{zw)C^-mMy@$z=

W5r- z`Rmo6RcBg9v@9UUJU1>aQ@>X-q%DOTG%c_z@Wnrs9&=<4EwPhuJ+0+U{6Bh&STYed zDv)YLWuV2Sq>D#}Axg5-z1c7nqYJ_K1~bAzUr2UVHPGiksV`(*WYuZaMvGYSr5Ird zWc)R%o)L2;jiaDlU{$7re(NMN74xp#jsvQYP+yo&qKK%87hr5i>A?QV%l8LZYozdSJL^`E6oXd7W<$ z<>vq;z2wTWNQJJAPJ+0KcwiEzicCgiT@ci5HTAI9h~r_lxWCfEPUnDuVSEc;wQ?p& zLa4!j<)_!J_bW_9DQ;{iSr%eXtQv&=J17x{5D69zFfUI!ZaxZO*`f>N*a7$sD<#$v z2CuT!3Y$!_YNv=7Ums~riO!M+%%qx!!V9}k5(xn)cNl*> zponcMW(rC4eTt5mkwOGU@UL(MAxjN%Fc_TUyJ7Pv5`j?b z;y?l=-C%rvh(efu%zK*|+CTjz|KKuU=(CuIS^6b@6O#B?s)I62`v~gAK8fsnP{MEe zo~sIs(?xx>JnP&~T!rVwJ2{>jdk>V{sN5&Ie&qMrg0Q>68`D835W;I@rAtT*83^OV zMjqJrz-jdxVWb{Gz~bMDq9p8G{Mxl?sFvVmCUeXY1wrG3;V$FP9Ck7Gwxe@yr;{ZWf3XEJirATzeRWjC={Qn47*FzX?cMi7t6cHUHn-fF%?$IB9Q5 zrSdRd%h9wk37{PVlg{U3h1vZt>z8TnPq`mZ(A#jrz}4h})?5q8`LE#hq+A1ggl2~S zq4o8*UlayWoCGKS&W0QX-?uvK8*8^lw-~Y{B7QRx9N&Cu>hJ9`{O|n+*bS9=0YdSl zy>6T8zcLCq%!Q0fz>C&>YUN64Ehj`V*mB2ritZE6-~AJ;yzq~dVXoM5pfy`I)KcBY zU*CAx>48RjsOsGNpV_lC1WO~CefDS)fC$F`_YcT=^F2QQ!zKe*7nGS5NtS-J+wuH| z3(;ckV3z#trVKG8CIE1H6eDP@(sp3_NUP6Jms|18n)fT&zy6z>1SaHVcR73mwOe-% zl%*i(A8K~hPpYR*lg6mm7#jBaFM*(1B2CmNEIHbb^uE#5e2lcaFHzKanzNtL7#!|#?zzS&HnMq zvojx2pPljIgo$$FJHw(usJPBjgECvdbn+!l<$b6*WjJo@O3{;lS0*{*VniL72Nc$cX5YkKN0ypOXSkG87T7K761H~VOk=G7? z`D^FHL3#?7r@OPh7f8(Kp*Tdgy-_4+CL%K#a}ml|E$@SZ<-K9`h08x4qF29n&+`;$ zDKr}cSm7T&CLi>O=V9e`$0sZx<~sq74gM6@tOj$$t3Mm|FLj;wXVy-+r4~CARBOWq zjROl2l?7d2xT6*ny2h_+?FL&~@oK6AFTIeuUF2^8U)rBu%c3K|xG+5REnu5!jI5Wa zNqAozIUpfO2DtzuhD_X@cXXc2W+v0Z1?#X^FK+(Qw_bRN{>T$;F-L13# zTA=s#ZfRwCIUf>+;DqcrOjYM!W@uPmA)2~GtKmTf_q4SQ$1_Lv;DkHDfNw!j2O#D_ zz)n0Mx7ig0<4?WOmX`KAdPgte1|Ok1qOqg01^5WrPqJ!&2A4`pQg>~Idnbka3G?gF zUECUKdJj-dgHLI~Hb-_HiEtx4nd^H*PIrtX(H#SL@F!^JxPvFS;V}R5r$xsQrOw9B zXdkpJ@C*zz-wNR2;i3Bqy?>nS%~uu4nKiqsEG;duNlTly+rVR}!F5(I(S4cTv<3In z)n7F@O=7s+$>p?8aI;nYgY3&ZIp7yzQMTn2cFBxK_;(84(e7`eLOInPu~+zMl$V=Rep<67J3R@|sV1Xq{nFC~*G z{9i8f9qm$)o!$Wv5{O0ac1oB}Bv&VbHq_!*-|M-I9oKQGCc=5QiW>>IH5Bdl-^Mp>;ubz|+>I2oKp`nS9wf4s$W-L!!@l}-t zX869$_}JLbB@iLB7=#%q7s4#VVi}j`RfkOOi1$}#MXI6g2X60>9T*Zu_C#LVJ0rO{ zBV3wMqcxqzw>SD+DxNqvy;bD>v5Y*hQHAAVToyU7NbLvja^C9^y|IyTctj zJAC%78>ukHUoT7}B9~{q=RJ$FMI2ry30jz&jq9fhQQ-65T~xmTT0&+Wc5VsTK|;+5 zzaQ5#Yw2Xj2Y1lYXJU2i9Be&@0_hfae+4Fwvjd0?sdj@Y!22QG4=+mOa8~SoW>{5v_Xq(P^O^) zV{stqeDJPL)ViL=tJArMYJ10PlBR0fUNhaX8y!+DT~somNDX%Bl=biSr!w~EBkLp! za)}z9YJOhKXV&sSR(Mho-D=_3=}7dT58ec5VH&UnZaF!N77z6Wv(B1nA;d>=uB5%M zLKs!|3u6KR0YszP1JHno287R!A7cpNC3U(v{N>lG=w@AU+rDwEA#o& zNFyYopU$?VC*lSWzBdvbY+<`C!)o-MYP=lA0u{$1#vd{!I(1t8lKymIBq3WRtnY z@fT0~-e>$=JDYycn)`e{2hnw#6^}dwkyBdmq7%*#`cSK+JC82ZhH#=m6<$2P=jT?6 zdnn;bfg!~ohB(1kf9|#Cvl+jk;mpYcr#@Um2Ec*dy2}lM%Vz4EZG>vHYyhk)|YB|Q4sRG2p^~Jp7PG{xJGwhv@kCOVvzQFK$E~A zT{O4v@pIhLEVpk0#z0*$jBVKZjuYkMM?6euttBK%(276{02M>zYRze-VL-FQBb#Gh z!r#NW^0}^6t{Cc zl;~%*hCFe_#`z$`HymRG>2)$9!tx{Z*%x8La-#pSGmlgdDss%{bB)+gfHJBPC*T_n zDQ@G1jFRxy+JB{Wot8CM${fMn4i3rNgKNFG%@4cc$3o6SeENczP5NOA=7OP4{KPJw z$i>{=0Y+$xbGBS~A_|2_r&O1S+^~+aQsBGQ#60!r1+A8^k_?2pxTt8Rqka4%(iM(gTX;2Zf(M{;tOrZu~*~oKzuV|KT;YcDF!JCbzZ}%A@C=BM%D1>XuzZ^ zqqH0$94|92A^t=x^G&t$j*iok(4bmW zhRJ?B)QdmXjmR?tcW(9QyG{16RFrsMZ`xtrJwI&TtUe4z&DHMm8sSY_OnK-Rw4h2M zC5CN$G}Z>u6{nlQ)`_zxeigYASTh+lU4}V)%i3)YFhd)w6(n0eFi3gm^5!h&q;0`X zh4{bnY>qrG?=HlC(R@#a1F6Q^nf6kxmDQOTi1SX@1Y1fL@jBprABi{&L!Ge*Bxg=3 zD+aB;FRGV5LO~p-1$Ec*8ynvieoY9bu;Huj0fU)pK7pKt59h0yju>&pXHZ_FyOf%v z*1F~Q{K=uk$lD}0$gQby5b}Fke7Fb{?DHm}I&R9C`Y0Ita_&l#| zBvLMK$7hUK;Z3{r%;np0)_BkkLJiTRm?zUl9c3_D=Cx7pwKrv<)aQ`LgaTQqTlG4o z+1OWW?E;$T1HxNVJ(^g|h&W7=>Zfy|*kztp_!LEj4zBno^vyo|Z+Ipv863$bNirkfw~B|}uxS6)a0myU3WIjM~X z2lZ~=Iqd-aD*U%&LVQQOUk!-zfi2`{U7DsnHV8z9B z?1YR|eut$$17oWxCKy}FS+9jDc0xU^4i%rbbIlLjZ_M6fgFXcbSkMW1d~ArWq)(rC z|CHOoloPc<^|uEl0(@WF>fmB#_>BfG6>mg3dmQhGCUz7IChmefT`K&EEkk$*dl5a67+ zp`#%qEtuDq`PRju96n9Xt#;3*Mo%lxY}UtkM7*YxvHSUA8HR!twy)G}##KlPis2>` zx7P2&&0HFY?hE)I?*Y)g3askpc4^D1|6}Mj_N2gS#+X{?2G|^U5&AKKbnHFcud81N zttgo!PEx)Gbz^B}E`SUquo8L#vZPF~JulHHe zteOinh0Q1kNIh^{GDsOGTfWgV-;zf}=PQ*K{dd?0HD)#BU;52Eu&ihnlXHuLV**d6 zAM?B<(4^di3u~n-Zbz82KzS`;7+=~BuxUdKxB>I%t>HlD0J+qM=2u)>ok%Q4<2Im6 zEkkfW4XmiKpkra@Up~A&EkqFe%H_pimdK^U1GVBqgDb-)Ii|MMWph7oTbFhSgG_V3 z#w7Cgh-(~MTV1yt^e6p4WPJr#lW*8Bi~$1#Mk6SU7C}syFpyQ7Z)Pi*xv1ZpXa`Rb)zgS^pR+gX&dl{#;GDUkVD2k z?{Z#Ri_0x(*u^mVyKZ<{|q*+4d|)C5^|{63)&LURBvk181KIV>)r; zqE6^7(r;_P*#0Q^eyBAgkXENcv?vLK$*HWKn2lU{ z$b?yV4hw+|oJBDLtwFEn>%v?@K!1EYaf$#1^1&9e>ZPHENAy2JwJ94q@BeAbnE9;# zD7_<6V`;Z~sZW5IaV2pj$qD!N`bLyWr{cFBo$rN7MhVYXB$C7Q2p9K0?yq60n~^ip z_mOM*WUQka3DAmm0ZuN-I^ca1@iW~_>aP%0c(%Hi*2L5hBYw%mu1s|fPrbt`rm<$wnfMs_l({N%w=_T-4LxPu zt-d2>ge>+&%3q|Q$qBL>zwl~Nxj6mv+j#SfzN`Ji$rMgc(RbW;UzRLcOO+okV(+<} z(o)Ou@9P$weg!S*P;rSag+Yl!w0qT|*Cg=GJ$wzDOE)@xx(;X3)k(hxiIbkK?K>C$HEbpw znbgzKa5%qx?7EmHtMMZu%)axncwFwCiltX!>w<3_?D?M_@0d0-#871B*6uG(tq7Q# zb6Z-zpq}7m!L`uboaFr=G{gG(mG`&IY1oZBuSeUo_;+)w@6Odd_1hNtP@VaaUeTE4 zTTsrOT?pf@87GUB^$$uzS6vhvW zXl<3PDvJ?+d>s8o!E`kJn|(M%Gv6Hp=Zi_#z6f#zC@*24>WgS%^Hqy+3dDc!xP`V9|fW=^_`lOLRQ}1@lS9 z!NZYS)yOv+%8D{N>;eZba<5wU+pR)MNX;s~_FOyNE4glVXGOamKP{fWXDU%phx;_Y zt2ejzxb_uf$d{JXbd9VCP&ZpVz1Vts(>minzvdNj!^&SxkCCp#5zr7(;Rr@ZzS$;E zAfXVe6{y6PJzi~loav>0b&|K@lWFuVdBl!%U`(_jf5e*ocUi=`KR&TFKHK z^A%GEy=q5Ack`9y&6RnJ*JaJCjiTbrB|h#7#z$v<9iwfh(Q(x;%l4hGx5%9C3~PB> z)KzA&y05I`Svnfl%~r+Us{iG6@Y&_T@q=)K(w#&&j-e;I>f;O4ZXd1N!0x+B?-L|3n6-?|b*(_igF*KkXwdJo&MC zjtmtweD!Sd3-*~?!*OS0Z++-VTyRiTxQPD;VfRHQ^R-01m!hDnYM>H$kc+&Q#8Kg= zp?KW{sn%>5yDAw0mkG$Fd}2Ia%Ek_jDr4K|(w*YI)HRrteNw|*#C0)P&SgRwr@lK!015#LN6VBi7uB2{HNiqX>ai-q88dtlcK+j6V?N{upXsr%PLDO+Ee&JyF zuGZ(&?s;w;QnJ9-d5)^YVir2nkNLUWg?my~TVsR-R$c}<$B*(1hl?=%?jdTU*;u*C zSOc|Q`qW#;F%J4^8UlWmfv1hsM+U?FItUb&_t=(b^#2&Z?9jCw_+x14|S?k&pDHG8s=vOI| z2POGNcy^aof#vRQ@pGO%_n#~!bFa@l_dVHG%{RVswzAHkwBz0@FOye|5PQTpHz!8; zap8Z=BP_(QT9(DM_&&vyFECto{pV`GfEPm_zYsu-wt7Y$x5dwXF;qFh%*4(PR^Q$Z z5irl>_V)qY@xuY#{t5s{DOtO1j%xuTm2)&4&Sog}xd-^mx>7i|r?D-*#nP1nyrH?j zp5>+IW;n%|d5=7@Y1AU>9%K%&6Em}WWk2_3Ml|-Bzve?ehmOyTffv>`_6pW~wX9l% zyke1Lu736DC8q|64miWJnGCwLbPf`j`0`&^J20FH{*;JVg$Kx8)HKShdS5ZY@k;gE zUx)xBes{&%5Fqb|Ug*GY4883AiI6tY{Z27Zj^G(CHe>?;T-Sc!rQAXB8k{%v6Q9S9 z36TGP@B%=CWW*cbH~(NbtYvy31)-yN-p_cJ?YuK-K6d4=*MCOqioBS+wrjbTI2QR( zP3Iy4oAo`r5lXcE`zu@=qJBr(xfUT_iMH!@4&M(HlPbdM!{O&`?S4%sF|S(m?wL__ z#>!)27=rbNhbrxA@q+j+;Ebbq#=} zJA`p(^)$@o@Y9OcIT6*i|4)wR? zgn*=gBb8ah#v+>+d;5JOUek4@x7JPdQ2W*Iub(mi@9^4U@|K1;LiEFbkqq~p`KZ^g zco@ePzArEp`tOeF(%_Ctj*LLUhDii8T)9E-(eM#O3b1x8DT$GpwGBJ^BXXu^#N8FyqWkrVVZoo}qchOf;daE- zC^m6JciL<(c|yzq`6r4m$Re}cYTdA6!*)t6_RZTfm=Rnd4r zte5EP+pbJUqUP?>MocwMX4YZ9c+MXeolem_O2Ao$CQ%U!aBf{BOAfc-@yC9S)8*nz z8KK-7U(~ZTbltdw_I#9+Ivyv`{CY_r_ZeBnh41+4vZ)|j8<`Iq@W=lL`2B9bSKRi-; z2pMHrXpOig^h8t!H$h_Rn<{WiI@1JJ$tWwvUljp zV*+^~b4z{We=FACV#y!{NxW!+#vTdZ+mu5tx09VTZ?a0mWmB26Pv!RT88pC!b)tmk z-}qa83jQ<<6TQ_scwGEsG0qJswX3GH{`u?%lXQk+&l|DOA(h_>3&E6tEAOX{grhEh z=s*RQAGWWM1I2#(+j)zg=4nPEc47=N7c<5cdE4t(oOD|sHmrrVZxKO$-S{lqT|#sIN3jYg zfB=9h0r2)p($YbRfOo?pxN!^ER^nMT-hBg}y_*cu2uYL&5acRwss$r@f!Hw*mH9030q?yu8chr^W+(&X z-U2Xb4?o%K8JBb8)1~N0WKLh( znMlg7sKXhwqs%|rQ7afK)ugL6Sx>4~ABeORL znklAdm3%Bnta_SrDk?_z)92Zkz~7z6LmFj_bU9qpI$Q-!jLY0tOg=swjqm60*b&wbCvwAuC9lcUN2;Xp3Daq z)S9)uxc#Q4E@=Ga)4GFx<^K2T3{Hxkcd%fU2jwi^j>;4rA;X9x!3FjD?6Ljp!QmzI z48~R&&Llwk`*s%nFP$#S83=4WU3tnWn%FC#Q1Ce1ntG&Nq-#211H(0t@VoeY?v>7c z8)aL#cAclymq2O`MTvaHctSD$@ZrP3M9!Oc#k~%!$x_Ok=cKQ5n+01~Ef>2)j3yq> z_#0zJt=FaU4+ADk$YUo!L}ZTM!5LD&$kTc)UIIWf)hz5B23Dn<|_K3N-NT^%Y+xkhzY zLD=mVVt03UZ?+kO$#&LMY6`|2Ch!h$R|WThW%W=n>6+9r9AUlkUj416Crl~KIj4;r zU1V-Hs_8?Cy#b9XPt!X0uln=$Be?27-ToX#wLq@=kO8-u&Q%N*vs%DtAoq9mU=Oqw zR87JN?}onguUb_lf1wxxkI*Dfl9-|oN-_1v%Zf`4S3g&5a9$j_Pf&UDTgt`qt%b+U z^iYjgMn1c8T1=3B?mJxxrfa0{xU1~P`Zu#B&wzee(bl$LW4wwj2KE6EarV=7V`7)K z^Q{r(E=x+sJWb192;#ND4{sl2tAwKnNgPp5U<6G>nL#OxeX_Odzs7&z8U%=`8B?h9 z)JB9l&P&=sI_&h|LZ$}D=muSAfmY*&+-%$9$j(A7CBcH;vf)vzu`%W7*0zW_jEGRsoKLnR-(7iQc^tzb}+zs?6$37|UH%~cs zpg5v*@a?g*IjhQ34WvNV(c>}WXL8&wK&t>jFL&vCLs`QILbzll&~f9wHFUt~;{Oqb5`-77Cix9OsM-p>cD4H9%HorD;|V>~2Z8?_&;5H)E$ z7Ofxh@B6-v{zwJ#Qx$ERu+^ifHgIaFte+=oq4kVO|HZ3c;#?)sd=^W-$DZrWDLNHNpI65|f4-=^-cf8N z4ip|==0MH}hR1x~{yuPeH1VRZ576vWd|WYTFjhoa6@2=d6Tz99%^Z*#1B47X+U2%D zUan9mzk#d0D9u$TG4Q@Xr=)lshmar&D%rHuHPx{ok9>2BL_QX2aK?wh)+UG~-kKy#vr_T{ur9H83`C=wR4wI$&# ze)kcLn3tyiqW3l8lio(}jDpiGdBQ1KTmSr2O^@$t9GI!6bCWs(`$*0^2oX;35h$p_ zwrPOI2nj8MybUXR`sFn8fSOP>;(?JLJ0IH_ylllkA@w<^9Hntg^bAxYypE@y4fWUU zC~SbJuA{A~LVbHO7P+w~z*Kgk9Hl0rM|jO!TX4jv@*?2IQSn-jwyz~0qvA|}OxD=Q zdy}tfgL52Qx;!9pOGTYO&Qk6=y1musfz$@f^UUU&ptds!k`eNw`-xOD-_I|uSR#EQ zJI|UWc96FyUq#Wksyy#Nr9*5qSbT(qBKroaejM_>>0>uL;6q7mWI51VJxqiQ*?-#c z`?P!3eczFn$V*eV_lV`A@kE>?kn!!SVM+*KJYr>%2QS()G<50E2pqA?R}IE^VWz;@?$$1>IzZ2f!ei*I2OA+zmv0@Y%Oz85& zJBN6D&7-_F6O=Q{g*iQq)8CT)l()Ps%r1$K868E*oACa=n{YD-3kQ|mCYH4#lfho& z+YF9o5yvTv(}k3n=Ub*Yr8PupQUB6G0!en{!gVpjwPbU4s^&nK~^tVB(sm7DmXq~JaqYW%?drpb>PbrUg_TUk!S6}CrU3? z6`JUvj?)#$uY^2X5>a2^2*>{SV$q>H$kO=T*k1cH ze~ZFbyL%Hvd3&OoGHeatfu{=RDiJXHJaX!{M9O-k9M%0N|C!3XwBMH|hLUnlpMHyn=1?H_m2O#>-ciJZ)&}VzPehI9NTLa+? zdY|mma7{WC!*LQt0Q4s0dsewIT|e>WllDjbHC`xg5vT-}g55woo>gDQow2d8HPJ5F zm$Nx+%1rm+Xa2i;+`ez!o7i*sfL4dUd+Y4i=D`Gx}^JHwHsh=LYDIgI)) zZ&qehpVxKkzS@yMj#N~)au9wOlR=-y!S71|uvdC*Jgd#Tr}~R5?e9QT1I3jCO?8>I zI-4};7W1{+sCcbj7U@;oqvE%JFG}}R;5rRSYgCg)P}4SuV|hPRiBR%7Tw~e^Pu0oQ zue6Rk`1Mo9^Zx8+z&G78vydK;c!}AtE{w1S%5-L0|BEusB3<=T+o4j^77Ku&qC}BN z*Q9emX@A?AW&{)`cYtFf36)YJ98D`x9NB#weIyltat(o=wWPHJM1*NwC^xiEC}>>g;ZB6s@Pe?eyEl0c^(A82Lpd7wKs{ z{>=D(-n{5t%r^%e(9Hg~;Uf1$DWjlffla&-H5CPYRQ@a;sO;l(Wl5x%NHz9Vm8h+p z0yw9pau$G7jMV4IBDG+s%v_#H@S%o=7LUj6X}@!a>pT|W#F(I{a(x_@f>CH^^BO3{ zi0O9TrQQJ%cAjFD0jLN?@Abf5Dl}ao>&f9H ze*cx<%=t_n$$2|}f+Rap0NPLgzOsI&*Vzh1ZkIL^ME>ZiSl5h*RAQuGVzuIIG(WEs zvDL@KPrd@0%+3^o46-|tno{kAm)B|FH(E6I0N3@w+>o|^ZPfx!{gfU$O-%XDJMDf) zwpwuNhaFv#CK~$nu$3(`5PpzayBYT&etYV5>bI294wBU&e^h*K?kmC!xad?!;rPhG z7aTZZ34czNA<&uyZikU#-I%#Si_?k=bm}b6s4`$G348pPofDiPjonCF)8_#$t&!G0 zO+U)yS7eMlp`E$hdiF8pM5rAnwJn4!#9hGM$tG^(wxrK)Ibw#os!p{+spO~b){p}e zt9yoHM!3(@r}MI*>4F(_fJiw_oG!kW@i!z4U{&k@zG}aeyifo{C`uk3R4+GsJ@A?N zP=VI%VfxW(ppUiX0aDBfTR6jf?`&CiTz~`=!Pqk|Ook$UrCbXrv(Q?a3T(ypppy)$C+s@9_Q$WDVwX5&2;fZ7RNgaFBP7JY zLV{-`4kxa+CF^IP-Ft+eBU$1TV(0ZGk?&2FW91XzbL0WxdZ?6_A>!Kiv}|UkHHLR2 zOL20lI5pm>sMnUFk_00ti^@YRL+FeUIo4(JCR3#kL&(Xl9@<^TOh5l|c_(HStg3(P zEIFCrRlzr^15<_&cXxQGWkD^>yPZW~YIcN7iTVBEcdO0P4*?IGA#7lO05dj@LNVB*NtLiS) z1dQxcv%hmJcOuZ_!c|jK!$E%btVmz&Vu`>W$BZ2r#dyn{vJ6w|E`6n&=bl5 zRIHpNDX}hhY2u!VCeOT#$#eb1nVFW`O0ip~{q5;&{|XdPijmTxdr7~5Ge^>+v%qzQ zxPGo!HR$K1_H4vaW6!%XGyji=BoG2j0HkQ)DT;_;*r=zBSrq#Df5|y;1F(EFFLn3- zJq?;zAekBdw?MvhLqM=<5*G;mlhh>g*c~(5vrQt7-XM_+XK-$;$_y?=NtpAkuLB1tqK@Vb@x zPqp8Qg`%U}mD=t-MulJmN)!ENqj0qpD0y8Yrn$a89{TS+L;V1cMCBLm7FYa@Pyc%( z{2nAaJvv0l*;(rMekuRIuz27ELRm-lRLqJOu%rb4uMO267zBVQ0i{dGf&ze^N~dqC z<`kR}7@M5?0MwU7`wgz&K<_mr`E%8v4qFA~b+H$8#@Tg(75=v}qZoxidgi941A45k z`Ty?y=Z89g!0vtz`x}b?-;FO)fjp21!}7`hb&!&fX`mMMSZOKze|{~e5H<;?zL3IPHxvaK3(-n_Z*DV_*bUpeg-Lm^G^X@YC_t_1J19D-+2`Rw-!R5`%N-2 zgKHXoIVD93j!6{2Nl2Z`LDF=Pj=DZbSg-_GrsoT=qSsbB%@_&0uQAF; z--tUoi6vCss|=$BA5@Skg57^fKOEZVUG#fe1NdD|f+PS0a}8=-x}FEHY77U8yu0BG z9Lh?v03j8k4F-<#_cq!)vQ4)^@B{F|_bq4vb|PkDs#XWZ+JArB18Ph~pxDm^jtDq0!RkH>(6ok zm|$QKhzO}Sxu^1nr$Gf|nluHVyKIj0jaAxcG#r`Eg1mB8;6>_shTps#PIjH&J{84@ z;6wm+=7TF}KHc-f&;q%d5;-ZcrcXpcy^%zYv7Nx8S`dg_FKOgJF;J_J(`@YRTN>1B zb|AizYV@t4b(kYd9gEd-kJGE;MozG;tF8V>1~sQL@N*E~N{HgPyT1~!4F)FzyTs~2*O&JBdw8@|6<=ihw;H46ckP|>8#QNr&P2(bo3 z=!$|m7i{IpB~FnPoXH?@45#jzcFXM9d|Tw+ZU=2Q@J3^nF{NT1?##)g0py;~v!M^= zw|A$Xy?F}1QIa3Jq`a|!<6)NJy(PqC>y`{2(7lrBUo1-JA_~>k>o_Sm2GRwJ9#ub}SoIr$Ku6|qq)h7gVI+yCoh+HR#8Jt% zMnt93`V~@?QfS$t{us#KB``F=EDCifQ%{b52kL-C9GFQGt7uKf>?7>=>(Q$LZXQxx zf}g0~-MpM5^j8}QJK!sN7{Y3_V^3<~vFDV*Gn6BT$7U?H#0;hcS?t$mv+-#t!lSZf z!f+w`Rm~dDhw6JWs0^M96lAd)f4PRj0!5kN$*HmVL;HWCRzN)g5|p{_TZ0e{PspIV zq_CL~S86qtnE==549Fuj`4RO&&cm?L&(QOF(dx&{!%C)o&(;v@zTi`ztd1~3T5Y`v zkg`$&yUAXXAHDjl^>He`Lr`_Q?T%HG_wx_>uFE~0uBSjyy0#CjElHobjb%k)b&^)R zku>|BG~o4k03YT28^V&msvb#MlJ^?<(Jx*%5m$$gG|gT|U-b~qOiwSGXDGTUc>^YT z4HdyPSg4~~p#AX`XX(@{meI_)GAVDaJls&fCQ%$3gXhjXjWTX0W?oK7K-_aX4r}`b zzu|I@TqMBP!4pCQfnfp@{dVL(I7p4Ssgmtx*47<_VKojlg<0w4YJO(H2YFb*Jy8tp z3EULGfGM{nfoTT?%+|Zv`H#~kEXi(tnR;r|dwRf~47taJ1k)w7Oul$_y&~s<`E+>J zrf`IzvVsG_zJZf|)Ahe&gG>5g@uSNI2t)dbumc70RYN81Jk;RW#5kdWSHEG@yUhnY zx-FsjLn6t`Rj-V$D|6x$ooDA;rVTKBzS)iY8ei&HYJW&7QLDd7Dp#|wUPs{Q(E5W` zlzmVdJR9p>Y4U%Hj5(%&{9|Fso7`|%@{yHph!SUSq#GQa*Q!U2P1&=X;-wud2Lv6| zNK#6Xn%Gia)5x7IlXMo=&g>8UOu|m|Qmgr(ydm6IQ9&UV$X37PKcN#dlYn!+JwEzj z`RmzW*q6uO(^>UL5yen?M{sW1IuXAiHzIG1RRM5u<~#^ElB9!iG3UZ}{*3qlD=&Qr zTE-SbH2U)=*ShMjYsX1@UHi1VNE-x|W@KWLYqOjk9cY?*RMTJ}Gl{L87BokxeEu~O zquInL4|n7zZ6$sN&BjC^tNzZ@EML@ohZmkw!uBRG!XLnumDd&e7&_2fTErRr@~HR% zxmk~wsyURlg>)Cdze~{uW1x(JOL1GHVYW#KeOgw*jC50q^*qjA?OcQM&yML!_JNu}F5F0`R_lrP6kYn$KmANpgqEVoN zgiI*qI@?7+%PqP#CMHzwzX~m*dqVPl(<$Lfwe@^Ld*WhzS2pSG(k_7aW3QmZhxOS@ zgU3z`zS8|j|HS{tNu3Lv)bX1CpYQqrtQYZD|DW#~+`Ho-_sdQDYp8-ylf`*E9$kh> ziV}CWnm%D?~y{ZynpJ)!Dz5_Z=P@i?;9GNqMVM6t(5KwX1=_l9+}vF#qICkw?{d2gsY-ji1!>=#*%1mjpF@&I4cC7URr$I zSNh2JQQX6mIi|01R^{>O z2}c1k+>RNlb_HjZD&&v@C^E<$1s`VmS{QsM}vXY7UK+oP_c`LEZit zX_)#aMJ@muABMU;!@C(s^@@JqF8r?J%=qiU-^=UYdRPTcsE2GmJ;3<-?^mcF;HbO; z-3V^6|8*FW`oy~RQRfebMxydm6@25Y#Qyg~@E^?17>m#$pSmX4ZhqdHiAnoBb1`S} zYy8aLjz)Mz(G1l8jL9s@sOBOtm;T?WDD;6Usp0LT~KwTXeu+|R2WzyRN$BY{GU!5jAy ztusE4_}dFH*B6VwPg~wHkB-1uwqh%hai-}DJxc*)emMn$(X{mHVM9HoY+K>`g*UZ0QTl_Av{j$cv6!X-l!gJp$lQj*b z3nCnFnjrHq_)5OJjJCFkjPMa}Va{Ve?Y6N~-HcBf6N2n?ZI(fYrwhHt2fc)Ozh1jB zc8kYJo{>1?k(AId^v-*~R;<--4ih?$fm)2R%hw17YE;#QpT;PA5#<=Bi9B=EB!bMT zzvco^_$h$3Q9k!7R%Ui55NWoQ{K%2}$*uDt9pfaCtK^fw>bo?_t!`MYg4FkOL=*DbcN4FegcfVXBG*-`=p>CNE)|!=q|E!fNm>0 zj0RV(e*e3O%lT$CswURG;N#qztDZaXxQVi((ME76b5S&#p`y{Qd z9%u7>>U&EV;Um_d{H3L(AaT3bKOR(8zsvHKHr_-NzlCx5H3emuKeE&VV~J`A>8?lH|c-h{N0pjKYgS70szt$EIG$g-ulk3+ zA#(z_qeqVQhuTrg{}x!V3{#~yNr+vaTzT6}{T1tkK9-msDpoTWN}UUi0fOx=(nNQY zP1W;bdI&Iv?okdd7+_=^Fr1`m9}a4$Mi7k0q1^t0sW$q6gY`!g0cwd}RdiQY*AR{k z&;!1&=o(eD(|FnzFLzo9Wp)LnXz3(p1u)0~I_f}y#-?CtnJ4Ld zixyUcL&BWOWAdi#`LJon?w^?%f3}OjrU*fP5zb%Z--=v9l8QHUcsp>WR6n2EaH!0M zCFs0LETc1Ze!1k34^V|0gJm~LgmY!GnqJHjQ0kh$BF5TLmAG{K)hWJrir@R%dpj}0 zMm+*|&6)7$9D(i{1)EL%@wB%UA&IW#EZ+R5GXy6)>C+}RUX|?eM*qfLyTG?~H!G*f z*tB6rRFzJ*eeR00u*j=={^>Oo)FB>%Av5rE^hb4u&D+LXA0wdiij!#N>9>)9`BHgu7V?o`?QFVOxs5D1@GSJi@E+y-!hos- zUt4of&b)NDyyt9<^W4``3T-OXFw`ig7w?w-eC!A@SW}6*K;=h=m>n*>*BA5E{Oag< zS-IWq%@Jl_T`q`rYMrqARDgtAZxIAv*$i5B1tt*%QDvy&B}6YO}5FMi7UucFaOL4eRHSu3XEGrAtGyq4d28?CYK)WM2I`F!`iXBgy&#!B|G+86*85+$8!>^dFJ{UU) zXulF(c*$!4ATqi}GK1&3dO+&9i>^L!SC%3eLpBwcNLOu##w-V{zWVmRU~yR8eW2~- z0O^UaO;yNaKd#obM@O3ci34Dm!xknn{kOkModk5}QREmFALhl?c%ukkUUkV^pUeBz z3!V=kd_*S_$C#I*vEPplPZTMfGDnuSlR6c(IiB zT=K+8#_7&eGc%pAc69s6&%@n*{b(*C$TK$bYq+(!XC@X#A_he>vSxV~+I$v}=f0^` zz=erNkG}Z@aPGY>wG@VKae7!3-eD%UlR^R1^tz^Qv;=w?c!-g6t^4w8wM@Rfjh9%C z--%a~s%*+dJ=iIF-R?LC{A%K9EKO}%rS)U^{Qb}80@{(;u)rD8!_6k5ZFh7MrhwH4 z;UhMxRD|k*_nlNlHt#O<1YL|p&zw&mzg!UNuMzm+zS8V1>Lw$c+aV(~ z_&h{sQ0L)9j9Af*G&RZ6@%#`?I}=M_67AV*j>9p5xq%WInjeEjFPDZ2gN)@f#+Q<= z-fcAxeX1+w=17<9KMyu(5r6Y3_kM?!H)ZMi!&<5maq=&O*zT|cIoGf(9EXU)u8y+zpAC(6tMpPby0*FuiCj3z;Y%J*7`PRJ1PF0i|%`Dw-c*8B4Nw<$#ftJz`oc0WAl!@rj2uR&zj` zTIr++P5J6eOkMGvQatp5;N90jVdkR%X-EkZa5C`cdT!brgn94Rq}#y#4>^9~(-qJZdw2%fx-P)dxRW|dym8=BzNh5J4_9DD*M5ToYMC4w)GSzX1gysOm1+Bn4rb1KG^C#JWy607_SWnBhWhT_`zd1 z@0Waea{qbe-B-inImSO5f;TI5<45cijqkseU_3L5aU=*2ql_44;Vjmti2;YbdVhAB z2_sbLX_oEtY{qrREHlRj&Gb7W1j|aZ1K+wG?%5uFe{M zsVc!4`S37M4pXlOJGdVkHhl;N^1neH+E;VcSmeIp=wx(o5r8zKMAs4r=eWCQk>XHH zzv>-C&&^q79CQd>j>BLY{A9CT=I&r%nCE-K=F8WP^rtLuanil5K9yWmJ0v+2(SIt{ z`&6S6di3J*yiF%WJIBGlCn2iQfxgkvRPLV8<@rzMz2mnvz zfFgg80Z;o+RJREc7lctcSqU+jHlWl$n;*DwhuFEDT!a8>{Dkk@^+$KD{T$rxjK{rk zt|<+uV3X2xl;~$xy0#ZYt%D=g-5!L(YXN|yBqOaSYq-s zGQ<_V$T-y_d%W_@K85Ygc>7hZ%i||$q?>mVLc2;->;?!Hr>d}%;mBsATugG0N0KL; zOkPTdzO92CDs5l8l66m@S5!}bd;mqwCeQG-bE@wWAitFalNMf*JV;nWd4Z!|!gs z(&^rFoveLU0_1BLK7xrYC12~o6m^%Jyj^1c9mCdn7Nfa~{l4QD1RtTR8IB(#v^IWu z)9}VfB9&b&hva|0>8E2Ke7sOjAhb8P<-FpiMlDpWd2~_F;~4NBW1z<9OLZ5LG5PBk zLt`)ltvomDb>nvVR|ggpghT4~tO4n>_{2(FSi3`4U$feVReCL%Q~9qoFEE!OAj)s9 zB~Yt)Ru!Et{?~mUQwOOgdam2fv!VpZXk7^Zuv`FdZAM3Yrp-WR(`RaGJR_JRTd2;q zzgV43m0R4Np{u&RjHTeGiJ*=`zjjQVll^|WJO5SFm2?4^iU@*P4RrJ%u@7#ZMs5#v zVuBfJZW7#ZPInT8T!?Q3kd+(xom$$AmFMkZ2f~_(cS;(sys9pxVu#<%aNtoBFf@g= z-HatX<@3-pKA?(W+%Zy5I+XcHp9MaP+3^xA{^sUj>(#sX(Z`2}jb+(yI0wG7O7m<+ zS2X_ZxlD+fUTBOa;CeeWJ;p#+{=y)-_l+TF=tC(5ne2;VaZ3(;e}oyr3W2MJbp&aC z*Z{_T;(YYLRK6!C7ovx62jZr!^gI&rJ3N5Up@B}jY?)LVXR~EZA62365;fl~2lmu1 z(8tg)KR^_#Z3FvE3qR65rSo`Ic{ajyNJn>I`f6gkMXbkxF30BJf7<1ZiSbgA^Fr z_#5gWy)IMe-798Ew>Ql5(5V;3yBpu$P&xeq+QK|groZYDERbn^f5_xEH;7Y29TE~^ zMN5*HZ@Ij@{A#G)4abBr?3Z4nU;UT>l=^fF2+a&{%;XCN(q>X$o__Hz(7a1$_I7RI z#G8vT8K7!rp5^~+RSLEcU4juY2OM(fwNVGV)=Ha!p7PH-o047|Z$cQ754C2l38pOw zPq*Yi*kD}&7{Xm{*x`h_w@tXEgkivVQuv`k>t7atS1{A_HrbF+qb6~E`0Y_m3QlOH zyzhOL;C<|+?a{K9+@Jhwd^7`@lAWCa2mS@Q?a^OC6e_Rz@pB%qS>y~QM2y^$=J_8Y z`Z}27-OOh4V~gf9!$%P@{>33QwilPvcW&K%;~N|sk^H^z<||tFu|u0W--Cqq2Yveo zbhGjS)=oo>4DkU?2W)z$FsOru@Id=oMTbx9`n6STPcjIC-WeaxTe!ldo0% z*5FjAE$}V(bz4KcoYp~8+vYZGKoDp~e zf{(;_KqsAx3G4`!pQHXL1sU-J1(@%qP(QwrP+RQ4-csC?P&o9aEV}AXeEfOpF6}Gsn zFxvmc)o)m{L0FAd0tmZs3R^hd(_i5aZ<_J!iRQ_MPt(ER5)%VU7TH)&oVx~SMFu!Iq1iU^yED?iY!ulwNX@5x@we-CmN9k z&a<9xssBNfsFgMe_VP;6Jnc9?!Sw!>oD@m3^7D}{eb1=F+c6Q$YR?iDiKiYW|EKZ! z{WMSDCpIMp=FLBnit64y?5$-e(eLz(Dl9?_aq#45L#=T>kcnF{2OcoY`VlW4%DwTc zxB5H3gC|fjdjCYMe_Ow!q9CJJ_2!^v@s}TZwvpN2ftq9Rx<0uIq*GB+4l4s|u6vZg zt2cV#pLD?jH&6k>q;Y1PdFh5PwN_y}40dI;OeliOJ}wYH`6AfRe}Vp&pCGWq{e@Bj z{2`UWCy(0_8DpP9?bV4txFXM_ZTJSNmKR9gDhyKo8-oY(BEkD|SGW#LQ#65%=E(Ft zL0=)IzhI#YTtuipe7xtVAE{@WJO-%0$Ez{8sdVi%dJsNX>7pc^&sLD5Ae7 zsP8MSSC*wmYvp_B3E}{hK@o$(SQ1Eb6cDR8&hACIjdJz~oYs4im@t>2Dzu1?mMG=X zzrIQeV#6lg0KAZCV4Ru#Xek}tG1XF*XyWVl0ejlT25Il-bqR2S?=(}hMW<}_@;+ED zwRgJ=M3#g$3|!thq_*=;1zzAkrzXM|CwJ40Jv;=68PY^jGBb_WMS$}6p2jrahyep2 z`%2tBZ=r40Zho4u0L(iMYfK0VdZxdhch(zTr>4$#nxKg#t>_5`aQu694X_jc$<;zZ z<^n=UTU(pUX4Oa+pd{Dc3J=FggE$Y|5{{Gmk!~2?%U)zeFP^KF8G|$Xeix_lQ}`L^8qx>sx+%(57*KL-^DCOLLVpdSDQi$IE0S9dq&Km|v`$$V+u znH8x2%0UZlGhX=tB}Wl{wpEmpLj$tw*inPXL0)F6sKBK2bAU0|Y3cT8q)6C#aqsbjh2)-5kZJ7 zMiPV$#x#iE`-9=gcmg**AYbT#6-@FC{2M7~>}=UPU9zNBzfZ&LJTj_RAD^Wjny zqU-@P>2R~>FUVZ+=u)T>z0M$QkG_Wzj6{;(ng60w>e!_8WXgR6r-;d!9lU@qo+a8O z;rOsv;1<>f2uzj77|F|Fn zC3$jJK!fCFJ*p5c3X}u9`XE`LG%GiKZgH1ty9@7E?we-lEw6R>)V^KC#Eqa9E!NvW|!ZkPMk=_d>iLgTRT$=}$sI;KfMp{@HUTZ&w$WmjQu8 z7}=mG;j!wWT)+tWU~!FcRt}+^ztbx>?fU8eRQHxqQHI<5FbsnX>5w8ymo(Dd-O?Z_ zT}nvjASvAf5(@3GD~zi;oy*X44}k{Ra7``P>2SD3BXP74WK z^uAmAEL=QvbZ#E&&$RA0BF@JbOke7v&oljB=rbvz>IQXvBGEaQnd0k>-TK0u03T8b zeL7BKC4c1^mS7Z0LKuPn3vvZ)Wu<(SE4<@0GoiGfAMSkx5{yFygPZD*yZBzmM{VSz zO?3a1tya!-<C~vV2{jNv5E5c_T1>+F7 z5KrB^_u0Hivh|V@a7oH+3|opFysfP*y9ke0&0ama#@GwlRae(Fx-S=~(-> zU{S>%(pY}0b%9Ld=;L?AQ9kNGrn?e&9NlC0ozeB@(d<5+) zRJ(NfzCfpkc8+`8_F7tKi=!93oT6`lA4->uMs3)RrXbm@J|9k!hhy$Cm0iT#V1!oB^6d^xZ_FRT} zxR|2LiXCxAlG^K*7p#ThloOX8I#58357fbb?gR-TxYzR4?X_vFqKtsfl>sv`3Q;NL)d!#P993XZ zn1^RUu-3#{IJBn}l|_5@0_4X!0jP9Ub_x~k+B1RVx2P_UnhsKnFoL1F_z{s{3>WHT zAF=BwemxmAhxoYEjQA~hykd6r0O@r5YS2{=7yy}_KJhTa@VrK#0r}Dl6~A&g*2=cE zyO(`dZ;IV5IIaA(l%(_1pDGm#Un5GE4s~ucg>X@FE!=Qq48g{LHQ#HiwpwORVI*l_VXhkAu>Si6*zKk}#ee|ChN%96$epD7dgNVh07?Vd30 zz4F~#h`C};n|nlUNBXDs$Ti2rIaZClEt>soI^VV>VR><4?N(ojxLo$sw=%lKN{@kb zg@Lnn-2@3E=y?P>8>wAk6G8I?!erQ@j@xNWJ^k4A;aBGSWfrF$m#RF%NDPZEeji$P z+y^M3wCoB=`{ZV5qL};cB}b72RG_vY)D0isnqw1v!?#9$X|$k2_W`SSo4+c=@>m?D zA;$#jnx#|H%X}_=Fu83I>Uhj5(2wQow-44@qK#r6juy*+eSfjO?LHut1ARaoiVVz; z6aSn&A@0@5>{8_73Ak#q{IYttNmLD7q?j+Rh{hBgP6ua99(qU-)0mJXw)o%L476LC z_a;V-rFf&i9SzmYZoM@YKvC{-ts%=oh*(B})qG6hG_a#R$_^ZB%_J0(XKk8ipp+mw z&H~1Tl~bDMMU$2L4hLUNlM77?hsxxMsO`M8CSQGG*zS(hQC`KXqtP?ubN7D6NE#=G ztK?kH`b(dd__S5}x+vX*8&0tu@MX$V9OdIHcp7xZugFI1Q=+tTwJtuUeRLpD>h2+9 z+N;~YdgwVG*q0pR?BBkRkzVqCZ|_TwVrRHoc1{VNo&h{O<1Ye((eoR#w1e!#e&4Na(6m$~Wn- zZm5l2-0bV?vjR$?U&Ytp3u#`(3H&qX7i{`=1P8Pnhn=hAr8(&k;?xQ6CtP4!Xnxbz z^TNYtpU{d%W;H6yNR%>8oW8)o8z{19ki3go~^w)$Mw-y7=ce>3FfL?NX+ zTFT8XnKm{jzbA$}xH*oQA~o8M;e$=uGYk)Ak$uB_3M%6&9<(g-k(&=_fmKZT&I5Y_ z1p~6MqJmv}Q~zz)&7SVdqrHu_a*aauq8e>B3wf zGET#j%7jWHJK)qV>Dmei$zf4WWyN&DDT$;uDWl#7lm3O1rJQlw&$J;}P`na6IA7V! zbMK$&uAfDZLiko>MW8TNMvkU^O?}~Vy&F>n<^VF13o-%(00zH8*)5TLS<6dA)L%}vnKAQm5jvD9o!@Wx6}>6_ zs9w**Wm<9NY)I1LIM2`+VFe$yZTjTu>Cgq6%|7zDxtNYBe;d#(-BE1 ztxG%-=OOhR>3uvX7Xmo8nY43N4^=pPSBnZ&M6UArP-`SwpHwQC&)Y~kOoPYHPfu2o z*&v_waW#j#X;Z9tghg)?=CTYzcYjin3Fd?=FeQp-50@uiQIv<$Y1lx&nKo{6?AQ{2 zc;1g((3+u~{#aV?Iq4lhiPH5Mf_4sOgrP!Bp!J}|q9QUYDnmOL|KYnOD$L9is!VHM z6ciVB&DdRO`m0tEoF52@+!WD=z|8;C8CdYs^DZ#NZkIK->Mei_GG5&{W%fEcItd=9 zy`MT!-c*}_Mlq`VQvgVbkn|V*+tYO7h`@9$nk#R0Zp6XmP70&SlLP)OP$qL#Zs)U3 zkovW8X&N?sgdFT@;8CU!v&f{f6L%jeEqs|It~lZN7|20W9Zy3?aI-5(A_ISrWBOLM z0K?)yQc|G6+fxggd>8BlNA}$W>nqH4Jj`QS&VX|-Zd|M}jAQAApFhbQpis=)9r&EM zSg3uYb2{UwG%ykpm0_u%X)FjdP8d0WOptUC4xZ5_=1lnjL;X z!67`+;`W5&b4uFu^#P*6X~m{y=f~O68RKQQu1~dF9BrC$2)VnKP(6C;$ma2UmPu;; zexDm?Nh}%4x(wUL)rIv$NiUNJ)hP-{w~(~4EP;l_XBl6#MHN)XJq-6hBm1ls-nx^7 zda@D-&H9|ye4hazS#J;HRb{(H{oAu-cqp0G@-pCEBjt1IqK_hRvA#N*q0V;Cv{fxEzzs|m9CWex6@E~u2KJ(!KB!ILc|{(& zJ{h<>82|&Oxjev((WTLhd}Z*(6J+xd0k3AI5`8!B9<+!qMs0sGczSn3xzOJ37S(fj zy~l=qEXabqtJN~-31bcWM3t)>vou|@=vVC1T7AV4WBDn%U{`0*YsnzbV$iK5)(2A= zzN9qht2}QnW{BN2`n(oTYg*0o&oV9x5*i|=%L5jq- zq=j+oP>sEngop{*ySkrbpjwJ?Aq_W`16djei3T@|0l}U+d}lC}RITh~N)r#e?z&Vh zW?XO7tlVEuqkD?=vSm6_FP6-%G5BJ{p5 zMa_v?;Uz|`lVGv4@Y#iox}K??mSzZw*9&LSpQopc=Av}*3XtP-Bx1>P8&$y20v>yD zm-AWo>b+8-yevY-;DLrIuH)cV>IN`Iw??_XhB^e&56086=02gjK%kffwl8k8`U|(; zB$xDRRV4R~HDj7q@I}~)eu;HvZvj-U=tVTOWn}J~U5(I7ixl>%z2>t`>}tYPyprBf z+C!#$#UN|y#an$r?2RXcA|>>z+yrmQ8&k!gjU^YEQOpao(-;@gRfQfxqI$(o3yPvF zEaZ)da9U|_CZ5Q5e3_Mt7brH%Jeu~S1<8bSto1Xnr!+Pqjny*0d9S=t@Twa$bOusN zk@3U36}bFZP6;w27m5cHf#RWP#?6+Je=u~U{1|7`bF(jyw0m>eYZ+(M#x#K0N@ z&08PW46|JCO>he8!1wJd2_dM;llF&8tIuKu)`eo5q-SpIp01VB_U3-z6`m)Er%5<>uoUERk5WFf#qXG6<>e zSv#}wa^`gIMI?RPbVd5RhnP4n=Q62RjrQ){iG&Dy2$U^oMq}q*4ck*Aq3BpR?L$cj zc4Q@_T7;9<^@nzCq9#rLQK%&0w&yFR#yhUe=XyM5w>)p3Q%<_f@Ydyir>dLzw23=G zplh54)Mfj7Mrj9Sj$n%O2vQa@p_Leq_3{Jx%+hT4I9l_~dg1y8oW}6M$nM!&XI^H* zZ5hGS9_>o=)rt>FoT6&Pc@Lh9uVuGRXAxJf4_>YGa65oupY8o7=tm)&oOlTg)dZhz zfP}a9A(U4yk~)XxS_|u9VffrN<+;kENl*2A%?$s|k3P|CpOyD76jst;W4-!P;*y%p zupZ$rzsmiZ%FfTEj+?w#%t6i3xa~wWk}c_f(m>-Sn(zfGUx~YvueKdiI?H8bA4nkP zd)naKh~&zUj&IV|e;8k2^<#q6ztmCU&4^JIhBz>~N@z!zIDTkW53+ z8N%Jfta}_G39Q6?#K+#>8glKwe^v0#5Qtl;WShs@on6FB*lifz@plLCuC`4(>EC@p zlFNwb2Alk29WN?q?E9{k9?fFkmQ;BD_;8E$_~5SHdUP~)pdz+{b`WO0g0e!eM8*Gn zHjI9IA1 zp@nE2c+#eNr~Iasxk113#w)3uiLO=XfRLy>`^I4YDSFr6Mic^*pz}I$w*7K+&c1vj znCE@2z$T7#Mz*2L(WaJN*M-f(_mOH53Jb<~O=L9HY#43%QKFz`xWwUgdf_GO$?B!> ziZu=*>LR!KIR~at1;204evcM%ts%Ua_-wP{W6zU|*?SVgQ=y%5RetZyzMPA6$y0&R z#b3Z})zjkH@iv#;CEjk`7(=cx6e@-EbiF_l!B83^gL`>aswpiyf=R zdg4MK)XX!l+WLZbhfQLv_SFRrwdEoO3X)-8@T7x?9!CXM-ee00qEf^uqsAS2xsZ{- z{y!PyRD_u4%V&bty`$K-dM!WZsCR|rS`D*$AKbX@)&=dinM)?37CY;*{0G7yUzowZ zrRT7CQ8yl|rL+3=-H$gq%ahyfVcWmYle@ZoT~>j--RjGKf8wM3%== zTd|@J|E%bLF%_ff0E0fECM)ZI|2vFU0)NPP-2fp?UV-$lER7D16n7B`G|E6$R9YRl85&x|T~hD( zO&Gr9H1uhbyZeA}0ZjinP#u9my%)0o)r>oqdDXh_NHoXsYU1O$0aud+H)=& zjJBT=g&p>$SY>`_;h~nhBSV94A%Z!Aix}Pw<}UUmNpqncte5%Z5ZnHDT+%0`#XY*)RBsetKxptv7dSx53EZ*B5`3L0ZatSn6ZpgfaF_( zK%fd>jRs=9oZj|XpwelWLLa};c3NvFk*-B4@5|)NFH!+5@Q+KHip37K&&ZmpgP

    Vol)QC&uPdtGJ_9S&93e7-4XwO-tis)!8@F*YK-|G zeYcsrUu{p1b`1w!b%ez90jH^lt>)WY6B)1LeIM;?GxZGN(`dvD-v%@5|~&$k{mn)}6G!zIgCOq}zo?eINeDKWId z4$~()J28EtwzMfC-bAA(XL{qYT6gtJ|Hskp+;hJFj`%8+YqgyI+5+jqni;u3w)fAQ zd#-uj2cvpcz}92a7HJrQBqmr7Mz=9vD+g#bZ?FuZMXv8h`m~F4ZZQHl^o3rCqReC&iFOj96H*Ah?l@(5=l>Z zcFsxCFFwo@7cp&ey<_rooPIstL4|-p8}y zs+8^;agR4qP=mz)G@t1!=!*7`yDi?QmsO@Fwsr?cZeF%P$!TS zTp(UMZ7U6iIQVi?VU~h;J`8?2C=u6<`NqY@5ABUSqNlI**kHri;(lrUe_zV4BPF6g z#AZBI{;@{d7)L4o11I7JcuIRpmvfDcn+CEyYCb7I`smkW!0@Eq#X{v(`yVXS_w`t+LB{$ zSm#Q52$baoxNtRFv=VVLD%Zh>i$RyUrnVf%YCt*oyf_rL(~Eu}acA~N{ay=TMncp) zf~?SKFpfSsF;x!pcAN+czhNag8L)oBET$&lvr!uU=01}%xd)-X!kC&PJ6ndOtm9$C zbZXc;ySf*!CCiaU=AC)>?`p_y5!5WmvgH#)JU$Kdi6IQGPr|v~LB;hWNK(82pE~zB zxR*3t-P~f(AugoPAAsXqiRXnMSGWoSieRs#Z?}WnoCy$Wv75^;kxo>OK~bn&1=Nzq zwq8g);k)gVLrkq`2DRsRkb-Xjt2tMU%6l(By>*RHb1E#Q|+IolCy4;E9gR2cVpdjwleE#xC>bm_W#!r1LO|6cIb zixvI%3d{2_IIg_9m-=G+K~p%(qRmxlhri!^=tmRpC zFiZ6N%zXYGv;`XYm90qKDSkQcGwUaX2TR$$@6yHco@_+iw6C2xM6~)It1q{D4;QEw zK=rB3F3QkWFXy5-*6+-x!AV?JWALUn9LnxYplXFtscq*^<2~~U3F2!jrPGuEq5+)t zjocHL5Q%mZmNH$lH$(%o-H;r3_3H_53qkp>8@c{tOb%w))5Q8wBQ@x{*k$hFNc7IE zx>cJAMq7n1CLS>Ldbom<{*(Xb0fBiOtrlZbr>pSwiq&1CP`UK(iKYe16f+5-1LBV^ z6w2D#{Lex%PDT;E8dD5)G>q;1D*P)|KQsyi)DCa|V7uQEpeJ_T_f^w}OSyu%3mC|B z+#{$&))x{V@Pl%w3zX-NaJg}iI)&FUZB;8bxvfdBlttEqiKj2_udt(B$8lffvlj6> zDXQPw7R97PLr(afc_eM9cytpn`)TCi_Rcp^d!5EIuE18^IDuN#D{3#Rw5n=kA6sq8 zr0p<$yWT`s*P4|jVRy}p63rV%bzEd-uL~3gX3ik``8c?wPg1Z0qrf!Feat}axK=jz za1G#j{9}7w3l zvP5df2A6+W@v9#W_egYp^D7d#?{WK6N^9W&?V!Mi-(1zG;@b-;>y$#go=3*Q&tvXp zVNhy{basbNX6r6AcLdeRs^^R=!7eT?#bN7AIy2B8u}{JNHTLusHolbb@RtST&^a zU-EdVSVLmy;(0sO(a*V&@oT@I~F^^28 zym&${mDU+Lx)gTnA*Vku{K_&TF0Ut`Mv8&Wy@yr#LpN{Gj7V9q3k7m6;x$v2E$3!& z8h^kj1nmBw0l6_>HbdFvab^=8`!?(;=LG}ytwPg6MM;MRYBFs>Jm#1TfZm^^; z&GXtyX8t^aK>yx3o<55ke_vZ7M^@UH{)PTM1NLyGU=n;Hqd8lmMtkzXo*?eB8+&iu zUEED1M)zwE@#YVAMwS-(Je$|{Ec$QN=O9Yv^!K<#F)f8q{qNYhm0gf*cs=)h6-N^1 zAe7ox7iQ~jOGcqcbrZ(pN|B(tGaUcFHaoY*!B6lDA8Q{Q=gA5NrQe`Fw%Nfw1VqvtLmre{WSb=o@_Jb5KVcN#x~RC-MHf{ zdYH3P_dXZw#&IH5u1Lw_uw!i!MrJCK=}g8$EWKq~C@lDC%uK_KX{o?j{h41VH@V~X z;$`!#iawu@D~0?C1u@Et%aM<=#_@}Av}4}i^T=B_5@ah)x$Swbro`b`zx;ICvl@Z=tnQM`)EJS6V4Wl|HDOGnl?V`aTx_h}9x+!1!)sm0x!&`-{-TjFS#`4EI$ z3;F4kwm2?%rCD>H9^F+icc!9b+RQ$l_{ldrtUe{naZ@F5dU#43R9dz`bgPzI2?Kf? zLXx*&tM%>~K(P3g+a5SSwKCkXLe0VUY;C=zwpk`+MipyiKZ_G1$pyLA`;0k6AUW=W zcUv3sQ(M4jtyg2yb>2Hp$Q-kctHG8KiaLei#-7@yW5b6tG^-t3_fp`2EW5zF**@$O zKp7$Kz5W8S$5A3DR7vkuf z+qXie+iX!6XZb0IE4I(#FkU1SJd|Y#A6LkwhULGt5Mo6s^O`{`LPb*+x!XN3P1-v5 zA*L>U;xpQ?Hzy_G6UX)Oa$twfEiv9`i04PdSxETgfk;vKGnY~sL?Ow<5rl=!e33rl zdbQ!>^@%S;k!^1q{0(npH~ONlKifRCLBN74n>L@t?(Psl)i=MG;=&0g@}TNRIz}^O zP@G-qh!cx{FEZZXLyXa`CyCg3tCeK%F9K9=|~5K;TWmVdd&b>uaGjW8OnYdVa)i(mjL0W4R=)Igy1dIscB|nFpCCLGNNtbwrf(g#M5}oCT_r6_{+W&^u7Ss0ftxRxjnb(3 zzNsy}N0Gc#fOKRH0NX$$0gVl~k%iuh9dV*(1?J@d2C{q#a(Ier0-1DWAP3TBm&V?s z(9njT2DHV(<>Pb=x|c800oS6I-m=x|9LuG0(U;)$BZxif$_Sqxm~gz^S~Z{qR}ch- z6p(<)$4#p*3oshgD*@JEXktuIn$?Gg^AobKG?SJG_pJtS;*4zEjcQQZ4sxdB1+6U> z+kljl1#D9A!*3(p23yy^%0j-th?FAnslN>6f8~7||F|J<{W|7z8jU1)d7-H+0i6dK z|Ad0~x0U06Ow=GisG8GP?ly)Z_mGYSp&ts7k>{CxaS>f@)ZhJ^3iIn61fj4|pNj+H z0V7JAMpBuxsb`CxOv~B0h+rvij`5xAe+834&^Z9~5m55~q(LOp>`sI=LyqS=wEuH)N>`+(YgouVD zo=lBN${wYo@4r7$q)bJ!ga0-y0UBm}xjji=VTp6J7TI;L)TN>(5$R#_o8Sxn1zMa5 z$O}I5C^`v^0{@Li)9ChEs&b33U>{$9?f+w_4R&(^3e02Kkq*tb#r!5>e|nR_6_Qb0 z^1NpIlQv&-Qdca&Llt->DDasC$%}0trJMQsA_<%$v_YRa0J|ETGi*eECciRZX(BcK zNRlO^a^*y-+ieDZj;FwCavPrl;Um7PKD8nC^b0$-_jIhL1v?O0K(p8Fte}mx}4V_FU z`2S-X0+u9f)Z@qEE1K#=+Xj#->mOit;uOs(|;SffGRUj{57 z4RMKX+|W}N2M!f=%P*s(4ggFw8q8Ps0cmjn5HZ|W(znDwmF>y(`REQ|bgRr7U@a$6 zONaFU)u`wmXGH+!gf2V+N{lsq`wb6d-j}Tcnu?EGo1MnO<@&IQ=(0koWZC_Uw9K!+ z+UTs_*i+f&DT#DHwB-Ihw+Fxk{!jC+-~=%Zyr^E1pm^eIG>n4E36j>i%>p;;mKG*$ za#D78UF#0U?tcjB0aBkuP#xVU;d-^AL2~UZ$8R^13GYPXkWgL3yrT^;eiplKJsNrQ zh8%cFQ&IYDBXDl`SPjmc&-kU=hX0QJwT#l3dAC z;ays(6_r0e-zzd6a>Bps-HAE5ca%|ha+DsR(%XK-faBgvLiK&1c*;sNIfyYEs`*eT z)rN!gcSsYGm!Sax0(8E`x4>!`IN4eaP*V(u9vJ~wj(0P+=jM>)X`nJvM*`e-UtWeP zBAFN~BSlHAyXBT26Ezw*m&0oZAHTrHSL1B`{P{D#-d62A9ugU|1ai?`0K#JaxIs+( z5kOo}U92iX5<+N1A+W~Ic)tNm3o`he?1wf$0)rVZlBe)^5Qo68 zr1Qmj8ATJ|G;#qpdPc>b4>`d^g|HE|h@i-_yrbTUlilER^Qf>Z-rAy1273MCNl{4x@N9!+Lufq?ZKj)@%+W76dF5un5Py-|c6lMu^H z?!@*gCjZ$ca_u17Zy&CUJE~P1so)lulq5$IGKN861XWI7$Eq-$o-Crx0zzyW_kaK` zorFsM-V#vIf6;OqdB2SB8(}MPrV~Vk_Y#A~8i2AHA>G$#IA@a=rHd&AOSRRdyWhVJ z9?l;jfZQEwR(;Rf%>P+mNea_J0Fl>lKZwUwZp82*?&N%PbX>T_u^Y5mKnqQ_-uNE% zB$G&DAwAt@AiDM6$-zE-kSI4NJX{A&3_hWZru7;L)(i$wijlxL8n=UQE_~&2-snl7 z1?B*5DxtyXvS_SiNL;n~t%u`ub5rYeG_7K|8K&eiXmkaq0;x#hob>C+9(N9NahzyS zUD){wo+-EboP#XOh78+$ThC^%wes`p-QhAe>Z`f+l^2q-A^ygtqmPX&1Y5_G`BK;5 z6fC+Ctj5f9qz5WNu(obX2N#J2j`HMGBcNbRTni}U{d;>I2p12gni@S;anu zw+2x*-|%X?LL1I`*mB`9KY<$+iWP%TD@PiBpx>}a!p^%GuHFUkODU~-ZK~GQA%GH< zt=F#-cMwT|&@K`3-49%XkE+x+y_(fkfhw&4$DUbB_x90x2%7{C0*lB|PCv)|@{^JG z!K)tLfU~zfpVECq#|1y8u$_)AeK}}swRzXUmcEMIFz4`(I(im7 znkOF@Zy|V2S;jSH5hu#9%7_~H)X_%s6nN?vN5Vm4m|%7m)Pc1KY%Zw_y%t6n5$%*N2Td{yWvqta3K38*WLt47KWd#mpO3;j3>OHuzwRX6FNQT-^kk4CG%Il?va(>3A_-eb z@KAmRn`sCJ&m$@q=*)T(Fz&2$C6+-yXDMqZDloANnrW3FUzv%(Rff$`K|pAfm2Qrd zp+0Vz$R;4ZM~7OTAMaRC-WRBhyUE>^j3~Ol6NVI*u$%P<5uO8eP_#O1>In)0Vdd#w zXWSuOn=7v0i6zG9Tp%y;bueK40FlxHmQaLSa~fOJCf;e(1bOqx z3W1+eSI|LFbA_vDAMXQ$f$qAw`4(ebum2` z;hWIzG@$Q;6zo1?K>vOo8UH4c?6TyCY>%C{B!9qb{$J&TLhE(Zi_Pt%R69`r&=9t| zR!u0tW0$dXmqI@8hFgg2!LGem^F@@#ZQWARoQbMc=*e;rxD5&|m z*OP}Utd!?7AE?g<_aMqzdkyM+NLZY>X{pB9T#(Xj>%$B!h&8bROK5xpQ%L|9E{kLeZjKr_!=#NMgB?DtWv ztzVRr!pbcrhaaQ`oAv#PNZM~C3N#|XGhee|QkOtM4pPP};n-@3VA4Xev4-DqlJ|Mc zb@4De;=$xMfI#b34m`g)?X~Qc8FicXYhV@A0~~~GJ+61#>v#yUPDZ&t$jU(flDpV0 zj-Gnm^QMRJJ@F~GPGUXMsOU`bLyWe9@Onp%f+X`^(h|W{)474Xt@5WgdOa{|+?vjW zrWtRbx(kf!)}cpq&DUOV5Dy(-=#V6w5>a^we|rF(`Y{PCP*Sp(4+e?@Gge<*zpXNY zW~uvkERGLb4*JpTc>l(_R|JXs=KJ~YOK>tTZ*-g=cimaCXKDgkRyakmGjC3{seh$8 zU?bpf@XH<-MNkavGaZG6R=+*C5fv9+@L=?PiOd2xcrRsX^sXz)6yfU0VLfsgavs$G z?*YEVF8tYSxpckW+BdC|#vz%fQOW$8e)+EUx31p}zM0_NZ+~C&!_PvPo&IGB=$Zag z9b;mi%ft?j;#e`q{pHTkc|zDpRSC6bB>AX0tUak)Y(M*fhia%`$iTaoejmum}q zyObxRtqkQn33hCNLQH~_{m1F4pZ5lDgl{!qjlSP55Wk_H`CUc524+S1u77IJ(Ge&8)`2Jr0r8cLC!;*|yb9n&DkTOkCsCly8p ze0=q?9mdo$@^rH=>>gcp8v(Gwf<3cR0RY(a z^7Y3@GQ&H|aiD#>6u3+Lx1B~V`d9=(US2~>)?p^!&sK=*@CzNiU)ektN6J6{Z=<9% zGlVBdO^yF?Xm)dol94a%w%9vQ3&jcFr|}^#EG7T@png;f8h(>FkJrg6_4F`R@kKJ7 z{MsZIa=#)FD9tUTLrD^iEvmv%C*ld&SNQ8-i-2?2Hk(uhL^FC|20PPq>SMtDNineh zw$S}ERzorqWn734$H~`ZvZJWCzbXUznfoE1P7N}>EdpyyAqGRb+Mbuz2_z0o@aulpYjKSMve=M>QB z&J7xJekddx@kkpPSp_O!2_W>PO1j4W(Hmoe85|>h%)z^&x(`(Tsd9h4 zhfae9+#J>I-JkyZ%z)SB$ObxvbQo+aazFq69eE0vG;g=>{`akoJPajJ;HOUCwf}#9 z%l`+bL*#FHi*#}{oVBq2bwm)4f2o79UeW!0XO^}r6Xx|bp@*-G73|CiRnS(HHXa~d z`5jGo{C>9~eh-$yU96yI3RSrgugoWy1aD5^D`%#sg6FItZ23suwW=$S<&M;O-3KL_&H#Ulko*>q4^Bsli3bptQJ+i5yDmk{w5>+S!w}NcSnjKI3e`kss8=qm>#$y z|DUxD{Ddw9TnAE|74ZMra4OUm@LSFk{{z|m-Z4Z791we8a)3MZKN~rdCPCYR`7fkN zp*2(D%MUK5WP+`zXry}qf{r0*t27KoM2#z%<^G2RhmI%-BFdu$R-vC**n~ROz}5h6 z*o9be>443so@@z-dj7Sh4kffsOm9$<_awewnczQ+1eXCfa6S389Hf7_fB4rG^gqv< je-EAizrA=svwelq?WJ@g9$1Ni0{$q!^QG7J8H)}Q5r diff --git a/release-0.19.0/docs/getting-started-guides/k8s-singlenode-docker.png b/release-0.19.0/docs/getting-started-guides/k8s-singlenode-docker.png deleted file mode 100644 index 5ebf812682d27e325cabf532f6a67f7bd69cf86d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 31801 zcmeFZRZv`A*RBnOBxs-s8r&_o2MrP+1WoYZ?!h5w6M}1ScXxN!;O;c;?$XF!Jn#E_ z$>Cpr?OnAGcGcp5S*sVb=bUTEb&r9+oQyas(iV$Ve#9-+V_T8RM0} zf|vJ~^pu11@uqSRef|LxM60C#r4?4(mrPF#6Zwai?lj^lx?Fdgyr|g5Vvrf)Q4z-( zB>uifb!m31W_s4>$ZfhFM()lFzTHj*){{L=1@myP?JLIX{?02nTy)r1DzL39hKBIs z*P?I}cTN0pak&!R6_nt(9%-N)G_#GQVwVw7ybqKGKJvpdB4iZnfk`V--_BEDr z*(k&Hr9smd$#|HJE1L1~>%>nm%$RXn16x#S=Kic=n0SZ&r*JR`k)1q^Hm?G2c#M-_ zoU)D91K|B7b+bX!u_hbay@t0Z6`yZ(S?D7>q*wf$J`JB&qJ%Kxc$Qd2i@{Q=TErQL z9~2QB9H>rh8sD_cE)ltZzUS}#4pls%+8<7SAC#=RWWHa>)PxOlNuicNSkWA%2vceC zLTF>9Q1*xf=JYvCB_#2T$j4msSLZ4UHFDtozPT-IiWwvQHWxI-%c`%%hvzD;{}8Ig zn~fs~CYQuwGZ5Rz&dHV%9T-4)6*H`Ve}(?I*2-ft_`Bn6VoEE{$_mw4_;W|+qIS}<-udE{y(U-nw@!-$YSqp%eG4(GO~j?RMA z+uUee6kcK*%KH6b>y{Y#Yk=j-r}t!^H!o2_^=&BA-{NH~d7HPvVT8T3OGRP_Gcv=y z)kY=oWc&6ELIUIMDS`eh`Wd4HoQV*8`FnvG;0UtJz&iXe{RT4u{yqXP+%&-u!34+%#I#&Ao{4nfHv^e1@bbK`gXOZ`E+?db0MEt|he+k`; zQ03y%{m4%fk>funw|i5Mpz-52_2mc&`-^*6H*ZiZ+_(Y$-1Rf_QuXvZxbQ z;!B*?`IV2g*aEL=+HqF!k73^a)M}4F5b8yEHu^yY0sll)I822C7DQ?mPL>ImCl(*} zDigmhSR&kd{n-oOG@V#n>~6d@U)7)$T_v3<-H*(Zv3jvepKvxg4bj=aH(pt~lV#Z| z)P;f$h@7B=V1`a5?NDv?(wMSmGdlac1h0Bp@m2}Gx!2-;WwqoehOa@J4r=h+>p)$h zI&o^GgJ2$cp|#l_>$;LQBY6;b5G{ogcehZ7A*#Wfd7+U;lTesbd_jMMu!V5%4QgkX z2j|M#k@=uIcYf8SEen}>-zZ5yB@=-u=|h2|KtUT<3H~B!N~S@@Pt`;k@%x>=xDBqV zkfv-gMGA=)CE71Rxkwr+OxceFV#2dBJRj?XoQ0f4vJ_BrEhkj+W9yUDWSd0YKDsf9 zN3g}5#jO1 zr=(bXdX%o8ZoIC)?vGWDE_uqvU*KOg7_xanJEdckS)^}-$FrQrYAdBH-_04!F%yb& zWkSazcDl}qx0}up4JZxNH)u8pHr{Mh^eMb(XV$)EQ^3m#iU?{53O!@rtQ%e%p64tv z(R^&Ajk=+;q;riTi!zLYjS9{Gq-ZsXIhmAikuN*JY)WOSV>)XJon$Ns9?ltdOdd|s zVt-t}^W812_y1mdYkJYK%fB1(CjL$H8@xA)Z(`WHIq>2wuD=I$7VHg$2TrA)((#x$-G0Kps7<#Soi&35Hea+XJ&yK>f zQcNmLS|##FX#(;oMJbsr;w|bPeXS!TbJ~IL6WVgq0@7M^l65jx^vLtW3r6WO)G~Ox zx%H~815O0i)Tv7SlO%sh2LG1+JTn3LqFp~+IgDbqX-vglz|qi?Ub>*FTKHiqm8XNR z*EPdA;f5ZWKTstw340M+>+QkY&kTESiB)M;pQ~6@?v~zm%yq__Y3RB2_?WKgRSab> zZdMiLF)TT>9JukuYm_cxH^?*$U%t8|gHl0RUh?}o`8K_}nz3`BY4CQN1nq6F)DE2l zt-Yjnp)MPj%vnlO9ikmV9m+sP!8yj6V8FE*wO*+uunA|>XAIJE`j$4KI3Km9ws$)q zJsrH|&}q@RIKw}CUkjy2lR^s@5A2D|iP(BGjI8MwQ=%NMTvGGvO83b0C`aI(fWJVn z!0Tp*<^ngSYn^+zdxzV_v+3il+i9pQJU4tH;x~?5!yS}D;^k( zErsp);kS5~*rd3$n2T79m{g3)Th)s74?$`{B-#Af#Q0b)6b?3dS7VD(zH9rdNNb0T zY+s`*_UCM>HuCz1i^H_qRITZV@QDeR&>#I@x94qqDn8e$bKHQRj%e_O{@UuM-wHm_ zxHh;8hmY|t_Z}6E>D2JolPs3Rl3at6eP6X~U#@iuUeAjRi_D;9%NxxbH1V#yt{fMp z)Cnl1*I?tPZer?S&tMj*?=zV^RD7K-G#dVi##Ys^AvWaU(}hG3MFQmyRpbiOa)^<* zK}w(e0BG}kJ$~J?pYZqDZ>T$mA%~;AQM1E?&s`hGq1mgVpHszO=j&t~HQMS|E}Hj3 zEl4aRW{>+n^amT@FIfgaCgfA)OPjTgD~>k1h3kanSDF}x)L)r*nPZtBEE-l6na;8fhZjubCz6m1Ng zrk~a{DDO8b>8M+4qnU*2hgP!YmN$JYF%_T8+0EPqzX^@sY}$3HIY^r8nV)W1vhWy( z4Sv@3Qh*4PpwXlEO3tk4y+xPK!b)Ms@Lu|EeT$KYmWSwp#7X$D_)qbyp7v1tN#2QR zu3WB2&i3G6-DPXmJy!S27a}gN3wGq#GU~43xk-6WR(r0AkCIXNW}O4v@^`53Q!cAV z)B@DfrWU6Bt1~%GTt2xh?RbtS5e^YD2qrwbo(EmV#aHwhNezb&VI?N;q&T{t3U~iJ z3G~PDeWz?EP+z$|mQ-9?4Cx2QlxUvR+2qYPLGKh}3XF<*G6 z_T5c(s*Wt0cD_~IN3RuyG(UISy48R(K`!gvHbNeg@Sg>~xIJWSc6roX;NNkB+>gG@ zL(>!-_|AQAe6P2^mQIZ%OP8E4Sad&mJ#CoRbiSWDtvy`fXB6sFE5h^`byFhS@q9RM znEpfMhh6a^@!_DGpvCWH=UvDBK{4ZNKU-)Ys;{C(3sT%2p-o1*zdMi3M)%?bKSFYw zd2XjJEw=Qx*T)@Ajdq8?_u5o52H_fYnfK~FBzL;IqJh?QlcxZrMML!1Ai%Nvh1k_W!`WSC)yeh^1 zrI+7@8k#UX<2+4dR$Rvjt-h?k>p7~qOf(y?cH2}tdKh;68f}Y2MgsSL`z2QmZ;E7b zGu!e2Whu@!^c5bbPeSnX{Pz+HM_}h{c03Dh;j7~}qnDr{LpS?6`0PNntPcYgg#Pbk zEC?4|d@^&18Bq0{0~Jj-!}bSsvhMx;9#UVr=-*2~D60)g|IX!T-DGwIT51%y4U}HQ5t+W!d1z{ zlcD-w*nSI1EgqxWukLP;YFzCz4YB@APzZhup|U~3TxDxvm{=o8Ns_jOXJ1e`+U9J6 z^UtbnW5OLUVxTo=+xf;;fQXzmZmM|HwJ@3f9GZjosf%K|Jg*>tjU=K`^!ayNJQ2RU z0z2UNNB#J~5Bhg*=-^#Sl5mx#D@}f!KVyaP@63@C%{eq5m=+h^=W$BZs#o!x??2XL zHxs;UuaN)J_~)T^Z^7w#RddBd(hc7-LJp*bcQnirU2Hy$yZf0tXZ(Gb!%~DseG+&@ zNV*$5ZXFxCGR`&s-5g*?NWen!qN^e5SXuGjhgstH-%9Gw5t{yI5rJbPK_Q2E!MTc$ zVdQ^~Mf>LqQ+`aPAuAJw790Bi&l&VY&?l9v{7HXu>tUzf^GKk%6x>j|7kUILQ9Jsx z*+THA=-ce!*Q0{(+@<2}_olXXni&KCdI$w*3)Y>MzHfpc)tc9>srd}*UU2Kq3R%->*oTNo1X&qFIiJVkZ)YO83cVP6s~J4q+= z@fh(GD3>^pe+W7@p?}}IU_Y&4x!xPzJSt$a^vISv{gk+8N!%^~JVX^|wKe>1*}_+HHZG_18;Fz^B>Os{;PrQduFgveyC# z!-9{EYxaxw(;J0J9_zz=XF;;iwwJ`~pXQ?j{kXhw;L^#Td71AO)m$pFv$NOw61&eZ zXf|>eeVqGtwdmL&89`<6HG#`2IpLkXsoJfLTZP?@f``_QS@lcLD~QW*4r!6sf6oPG zf>2J8W%5bI>SKs)*~(^t)l{MCVb!#zZNpKsi|*LGWy7HT&RAEG)>2tPrIypmbH}5m ztNMPXmIaHlE^L1b6SMV!IJU*Ro3lkp>ZJ9+H}C9nUG~d*7U)YFS6}h&mwq`xc~o0o z7<+xS8pw1j1wCviq0IAJtJ_N6d&PI$8tGZ=CzJR3Ki0uOHg#N7cQ(RI@8#u;9@^Dz zLCL#DCrPr=Mu}*~y!x6Y_xYxW+r5XeWS7GohZ!B;O#Q=+7%d0e%>nDGsw&GAw@d4J zi<%@^U!2hI0|~y`9eVzr$j?k_r!vIRQkELQnQi@D-)IbM+`5DCESFosmL*M>NP)+Y zaze)i7Oa-X2PkyUuSbqT0N6FlacM651oLwLH9k!L^B+RQ?X7&gyIBnPw->gN((3I( z{9iK;{A5+UFMLc+Y{(K35fsMMgeF?fhIoq|k08y-a$oR=Nkx3FtNE@LY%OaR9c+1z z8Y>Kjxi62FmKfA3dxMGi=UkN7F!cRPU1aBLuYSBh{rE{T!T6;cnZ`_v(~H9<#FMWE z-Df*Z|Lm5K0fzCzk@ETj;q@67p{8Do0LS4&#dmur{-QjX_r77y%ixy_s9XzSq^9Vh z-mhi2+X8==zIr$zw(bPsoeZostcCC@2$QJSv*>l#7L+v41!jE{fSmLY9~HcpLr2## zN_NgBzP$jA67wZYYq}KiZYA2fV!~O^l`NqWM(*X< z=Jnh%!J_&%9mdM_@(;B7y^$fMA_Iycjy7+ znd_`U%m$`^C9(iYlWZI-rDF6XNbpy*L#OYe$yreiB>s}89@xIcT=|TzZf;FXJ}yRA z+;3x`gGQ^->XwpcYV%tZp9*aMvCrUL(o`P*B)gK6?@89(c$y2HIHjf9&riTO);UQI zea56@u+|?0#uTv0z@%%XZyP^5y#XO-c6{z^2Z<6{`{8fika8nB%{y7GG@cEe>6*2B zBWm`BJ%)+AvffJZXvT?+4k5Rt2ALsbAu}~HH?Hrg)mUo8D~G}RanFg*BRK5{K=;`k zx6^#Tr}gq!!{1&{sas`<;#)gGRqni&sR(s@8ol3MBSMA0&-qPb>mU|n3Z;PjO4&$1 zy~CCFW$B6V^+g8}m%Ic!{ickm-5JlJ4k&kO;-fHcJn4Qo3$xP9MHKC%{v_dX(uD(k z7%@by40X+@yC~#DamE=*}p_tM(mi5<=)ILKDpAE(0t**LEmXWG^n~ ztpsbntq7-tmiNjozdJ%iAjVcC5g2~A_x31l^_{iT$YJA|Ov=y$i3CkTo&AZ96+Dw0 zs;}X1F7`K5hRs=sIPgR|*T*XlKezfGfpCj*F`-XR(!(WEojfGu_5m;LeQMc<%*s zLAH;0APwfQG6?)Cp9QXhb#Ca3Yuih_a`>rKK$oSIAr7rXoKEo_p1u0-K`Dp=BEZUU zFNX&&Z84V&{l^p0B>-N58lvTsaMH}e1sV>0E=qoOYK}X;deAHA?v4MreDZLji_1ZD zY&V$1J58E>42OYEF)RQz_o*4yLU|wwLhz$KokO+`JZ8}`Ql;Ud9bvi^7hG%Gq>P8r z&&4D4m3V*0%rqogGHG-MIuT%Z*Tpze_v&ukE zbdFa9bskPIgY!GD#XMFI%C5hPZ)&pYhx(4s^o%EH%e-MVREg6zIW9lNL-M_^BeKG` zMF-V?LxFaSz~38KNBzeS2-#zVN$jsf-EVhtpx85|M7p5|*650UVQ7MP%o#uL*u>>Z z(SPt*Tn12gnt5-xjeD2kGi!Txs2f7EooLz?u^mAw10spm+qri-Y7VbyF7D_6T?$oCphUv#t8NBX`3@fYVYVCWHjz;=& zC=S`gmfH>1;<_VIxUuq+Nb2xOs~dG}&2-D`agJHg9gReCO}uhT>C_?=jk-I3i zPzuHz`1JgAkR>-}IYK4|zuBk3mQWIX;&XPIY*(CA!m-eI;w3u%UM;>{(K^CpOB!c{ zi{_Am49d!^s!Kkx`2}HPNBfZ(ChbR^rI`4iS#O|+NxTKS`1|R~KiA|E#X9RKcLw9m z=_BBQ+7{}~VL>M9<0Jy;{EaGKytqQN&V+;vk*QG7@%^%=;1ksGkcypnB7?Wi(|n0e ziF)K}ZH5x1;n{6bIvkkILRf3JNIg?oCbSq_KF*B>rzq7))dKSKvo(v z0{!#J;@O~9xDqmvO&w+?x^o>EW{GK7S`h^ZRe)x0^5uX!HR(Cdp!bAI#Yt*%{}M zinwSA;Xq}59YVPK$;%e&ux)b#BjmYX<7 zCEkoF_(tJvj@SKnPhQgmNZjo$@m}JH^xbokzB{HOi@x?HL`rsALN_%3I9N)fNyZm~ zGCj9BOhp7@DD*N2N1lg}yg`4Bz$Hv0N*i$+8`Hxh(&+cx`&lvrJn}&WYBA`e6RWMi z=v>>exhqFe3E#B{9tv`W6Io)Yv1DvaZ?f;eB%5r!Mn=+GIvsoh_*VvHe!k~^pXVTB zLU`u)?VN(gLZzS{9%MC|=}u}QL2umTxl2s{h0mSNuJmcg$s?~05!;h@o)Np9hqw4r z5$y0@#k()NWxEYH1_z2Z2CW+%(p|+3KS#s(CYo5ms!3Lsl|q*F6n%o}$i7`JN-+}O z?@pr=mq1uoYA`VRN;WrQMkrukg1CtdJZ(UJ`j!+HO*;$<3SxYzB)c3d}Q-{ z&XtRV(Y-aU_&#P*?7t~zE)AU6Yk#?fbA=`kMa=j1AO56lbYVg6n|1NvXKvP z82%RUx%+?eayfq>JEA`+&X@f&_Wy4C|GgkU_Wx*d7SG9%(s@$-I&uKkpVXd?a^#Q<6vF0SEw8$~|K_6k>zo?4(4@q_gaI5t zDmO3B|K7F8+*d{Qk@7`ZgYNlm6_M96Q_@_GCj{;2y8rdKGZvHrW%UGqAG9{Ga0o z3z`wq&R5?N(=~cF+8#C3{48JV&r$jq1_Z*05KIoqKV$Enf@7m4*vY?e3#9~*Ou$nL>b2lEIa0%7XgwuE%5zc7yx zfO+=!c~fuydbi*aB`BhorR5|3K)cimU~IGY+4NW2VBU?$&o-GOlz$dB_Y)i?1I9}f z+~w7haB}hbC#XZ?xR#fbYy$ujEBRdo%D>j{BfP0p9?MDfTb0t*gYtgH!{ZLLs~Bu1 z&3$xBaU$nT-rMbrCeMN*h8@PvhRmzKK8X$gQBwyMkF`_7{bqwU78MoMav+xFFgwB0 zM%}#Zr(ibYuIQg76;0JZh-{Pyy22P<0rL7~!{Ouu%a(fw$A_D(hJ)&P#whcf(~ZLi z=#eA9G2%n#%}SaUp7Qzc=iA{Q^{69RoKN+Aeap34+z(^*LahD9zJe@Asf_vhD9^F{(#}%PW`c0E)!3c`2QOCDOQ)8XSBnzP|?HpsPzrTldTr=0{dZqHbFYHXY4k7vsgPBj->wQM-p z#9OT+XGR(16XW~tv|~6JzXAEa$G~MV$9@I4`dc#ropU1q18J6)AsCLPiyh7yrPvR6 z07&XtQ)vY&1HU-@svn4aA(6*+AyYD9p&5F($Hb&jKLMa3YlzGBVZ%{9knKYTQv{ci zoL2oIYyO@n&xE5dMPYoTx$3Ix0=yt8o07n$CYU0L<*Z9j`&apbwLYy(g47 z<;`WbMWmQEH!q4_Pl$BY@GZLL^naq(f9Pc-9Jo9oA{KQHAanOw9j|!blK=iE{i3*o-rJ2fu0%qp`WgV*MEpS-36z%&7*P!e$EiY^Xu+*;^CR4+4& zNN3thbZd#)<91}*$ke|ahMXpRpArRY<0tJ4*0xSk+m~x#9)I}Pj)nR%A903_j>JQW z4!X7{m9-9<{0SJ$%YRcnM4qlwveUi$51$1zj7VN^d18bg^>H`8m7N>(QhE?gKQ|UV zMOGpa6;VB&&|#(x?OD%HGR^nyK1To_AW^3)-FW4~LG-N^_HfRuM7p4(dcgUxZcAau zp6t)@*^o)y7bPPS?VS5XDYcN~2#Gs|u;7$=JU)axrzj+;ZvD8CVAVYP*hn0xf{^hc z*yiHm!bE)neRzr!h2d&v+_%OAmWg5-J)1i5n^%R7;iYzALBSca;oFcP6yJ*P?<6a; zu?o5VG6`OQNuUro9}&r0vVu6R1uq`2bP&!Dm9p5^f;dE)&;+hiwVcXMs=Olc!Y%b z3NR5+))^n)X@DdULfI|rHlj~-|EBsMlZ7OQCG|_%n9Z9mrXFzQ(S0S)9%EB_A$~Or zHd3Y;yU2{StybV4t;o-S6+Kx8za%V=I=CIM`Pf4rY5#H!rcdJ1 zV3CseUt`~ZAm?X=!pA=!&3yw5DcTlH%KsUoNdz3+N@3(*T2;OeFf_SfYX9Yr(MF;M zd>J==)*oLA&L;(iIBL`g{|fK^&reOrqVD`W_{MCZC#8fwW;6dO0zibX-XEWIvlY7X zrVr>77vf|lCe^?Jk5S2mT$a2QCF{0c9WcmpyPA9l1QK3|5;WLBebkYt=6Fn5*kA=J zIhm)s(w)&?UKQB>xSftVZBm{GEJ8VYY)vj?P~&R}2>jO7My&tEW_pGhncOXW-{eEo zPl?L;P$2@A%$TN0Ad5;3Lil7)-z4!igDU3hXM<-_htaw3$>e~*rOHFCR$=5ok?hZ+ z=Q08tF=^j2ss3k-#!pBUl?!KroDv8Zj5)y1Jeu3L?ssDvYI#3gnA`L8{o@TbL|e_5 zrV<>i9q%)93J%m{ijHcl`yytn%@xZLA}L_md``OWZEoYgOlUneLky&1K4!jt`WrOl zaI@xfca(ddn^dl6zjNKiXZvn^(Z@;w&dtf7@^pc3YoElU4#}Xz918{WhAirex<@l7 z8y$Ht**~`N3u2+wfEDz^Vi{e=O}~;j9#*1H!UZXiV3RPP-VRW&sVA$hB_}ow6%`L# zqG&mLB+Xm71UGzX6BpIM1P4%j8<~u&KGL%My7MM|X;Y<)s^OsF(7(!ZA$;yyE4ee^ zPA&H{Sy)Qzk)}m2Ejq2ve&i$sI#b&gEpVQ58!3M3STeO$B1-$uTsje4o6A{pgfi=x z2275ti*-6A&I{3|vdot_LOEmyY0HYMTx{1R%^fr8@@Jwyz_0XdFg2HkvM;wa!x29F#h`HTpiW&b{_RGE|6b$OvQ{C^Rs+$$?sglU&y~$?>$n#%ORBAiug@qhdV{c>hk*+WuWV zMUb|9Up*>zkTaKL;FmdMiD65Q1I5U`C;1c132L31d@0irQt76V-+69QTPIB{X@CtL zBh&tH;VI5YaGO>vY zr!Ogf3OR*b(7AW22i#trMe$zb;MZBIV#<+LAN3mJCz+PIol9Br5PpH1$$Y+(5aQ)IEaQv1xHxZb55$SOP z8`2}<=)C(v$9$DJT=*?=m0R^*$KKhra^XRQg!v#ft8DVgT2I4gS$+;#It^^_CFQr? z;;O^Vh%HrszhkH(*D!3H;nYBfgBykm=etUKwXoZi%Q@( zQw=Qg?pieyW^i5n)x@I`By=%X&*fV^7E1j@@yXnmHD?a0BupW=3+`c=T~ge{$fMT zT9@mdfZJ{DQvfvI^-q>CB~zL;Bfn3}i3^qDsjAv}w1l`rEv_~btm>sXXFCr7-Lu)1 zo}6zr*mWz(aiJCbY*EwYAWB{)HrjSKr|2m&>5p>U8OsX6x&Mh(o$TO!p8}}MF83GH zZXVjWni*Os8R}Xc4kIt%EIgUq*0ElkD!ef0p7q|b)5Hb8)Er_Q8Ss%;Fotp-X{-ro zBsYHKsdW2UmCE`#%fl>iqNggsb@l?Et=kQRSeq3pu&eaA!E{)$bU$RjX!m)V4MXiR ze+SYu$)JmS-u;$k9G=eO@o?7O&f#y_zb!7XO<^kRkKx<9 zXb#+4tihSgi5lmPN3J!!G@m}6HL}z=S0lp1(;Veu-7wgf=i;V2lTz&u){12{2zX>Y z>uS8+Ex3QZz)-WWI_zxPaCh3@G)e{ld={tmaPjQs^=U1SCfWX?RLU&KGWghY)o zWOz0(nb29h-+oy^mQ{_Qk`CaKJQ7RoKv;k6a1vmf)uY{AQo(cZ8GrNaQv=OeeUw%A z6eMQe`jFbHVOWWQ_P60}Z#>E4;RYi06TQ=tbfUQF zQcdecHBy2PuJC|%i-hlB=Vzz8lb)R2??4JpczF(N)5YaCAR)cdMZ|v-Aj%i)&1{t) zwhgbtq1%aI_&j=@nWg>!fKB@Fu;*mcy1at@! z$zPN$AsE0D+LM}s`qI8p9EhOtuR~jG+0!qAtz3W504ZWmUEb%McZtu_ENV_^0w16I z9RgW#Rwr|^Wa8_4=+)K53jb4S$|B$&Hh$*t;2MfQo}v4e#^8*STTQ0a7WFCjT5}ma zhJz{Qd%XB6%tG&6N>JvFFI3;SXi4_WN#KMIPN$WKoguiXY%h$t`rCdz!q-^aK%%8S zU0%^yznG-yPgB3Eu+fxua| zRqm-!z%s`88b8BSOWT`Lw%Xj{2YC56u88+&TdrEGu{I2|E)tm>9enj7pA9TF?!a;! z>?@B=I%SYnp{bqLu4)9mWMxt(WE(-z`63)At!cPhGk-ROB*GIkO!d0Nj|B?->jN0qH!{u z<`HJJ8h;?r@3WDG``Up}HrkLrOJivo-fJhgeWYj00)>lSJ{e2$hN4TrzZqBRlc+e$!-{ z9`rSWIOoHISf-PWckMxcIQzkv%cE7(Jn3+HTP2FYxlb^2_okT@dnmf>>IhI=m#!FC zbVV@~%;$ebCac?+crgkWjpcEdp^k%B%se3~>xnOBEB8?IsCjtuJfR-6cxH73CXE&J zX!Z!`r11e$YbKN3q#Lp64n*kq-HwQ$Nh6BVKg$Rt72=*FAVLwstu$>3i|Hej7^?u?H42WL40AG=I zeo5?cXWfH-4wMR{ObKjKVxZg9iR%7B1*)MU+*)E?a05C4H_BPWfFS4PKXbf_XOy^d zoZmiNeC7eZB%>3&I~I9td5M|MUzVrB|m_yGMowU zlt`HU)!)PS`L~8yG}O-$7x&NUpOL6}F+kZ}NFUGLFI}x%OCfGXzNgjE2%T0Iwx0G) z`XMRq^^LFQoVL*7Tr1Hv_LSW}uBUHLdSVd|y7s3_goPpFud0etoZ2NfMvycDKW1%%|IKCyI8oh|j z1GU;)Y-RY-*>#}gJEb(AmbFE@0Iz%hB2??jxcww1o#``EwUl3wv^rcztJAXx;a}i@ z96iP$FNDZvus#w>MHY6xn#!?$wGY=s{kmW()Dj+v4h=hE3i*4(G}EB3kxl=IQI7G>6@z z$4%*d2DiWKu!WxnY#h#qtf9e-*Z`VSe`%3&(?OA2RrV61P`Zv0oz}g+a|-WD7LF3# zSeY#ba?b-ji=Fpt%9xQS6KRVWVq~^xs+kyQvf{R-3;sdX=HKk^gsvdtzcQALGhDt-?|CL0+UT^(AxqwYj6^mv z3;+EC{%>983dANS=y%bI4@y=}sqV{Jw}tA<=GYdX(Xm!xoP_!DvBr-}4sd?L`^2kg z_`QLo@|)dT6YOTR z8-Lw&>Q`5Ht<7c!X=l7Y*}F_$`3{F{uxc{<$`}3J8)Gi|EY>~9i6lHlEWk1 zB9nghd~t`NZ1OhnfM6?fEEy{oDXZwFc+ z<@u}TTJsC`q@&o0)5U6=0yh^W8b?+h^A?2n-iw=~bd{Ire(bO(J}iw-1s0+krK$tU z`Yv8y!Ay?;V!Dsvu_RGt@b&%Gdi)+J0!djW{7#5Rl}7X&w2cDCl{m705jahZ)JxrM zzCM7!s1|>W&_sIn<8g|wX&pLk=4g`pU|7uvV?W(oYk0NPwJ*E_hipS94s-uv?Cu5}5DygU%wiJGEK?wnJk zUxXNoohBa~P!^G=B^`*`$;iUqC&$doIK#(nj$4iN-am;K zx?gec#jEsC{__=4qpNNJ(F%jeUFiW%a^;9i^n_lcuOFQfk)CZFMrQ{%XAIAe>iF23 z2&cu;l9@vwm*FY#=nJL&ryMd9Cd-1-fsjUvQ7Km0iuG0b5#KDIa041at&JAnuFZ$54V zTBh!Anif7Rj*H7d?$j^qW}-vatcJ|pb6>6X-!y&}UELkLwT~5AH`L}+0eAZpn`8I; z%<$a@zu};>_{HfJ?v@|B94xP!3-b)D;tIsT_e82d4P!`4i+LWi^XYmemOU;z3i^u> zyMZ*F(6`A0EPX)aVGfs4)XT808DBFb9q9hf^jeV1?SkcJU2<#Dy=3=9aaU-3C@!_a z!qp5JJaRJg{u^)?{fsbnl}c+t58dWd&DrX#&kO6$Ku@c@zf>m@;v3o? zI5;HUKna5`4k8IrlKBaASrUGWjKSB`GUo+VCx@i3K(Tf3WH%tcNFL5z{4;n}+F&8W znMF8}(@NAf0<>?!pIG^m>>$6WORtn(Uu)oEv&XxHTS+ zTD{nH+e2KR&)-`co^E(_wF!n^9XZM>jzOxe3Z%<&qp*;6N`1H9b%#Xl$zTkPMl_&c^wia*X0%R|!(u1m){548Bnv9~_76qV<^3v=he9G3foIp>7R z5(!9><9ANV5~f)I1ENudV*vTtwKx8dd~tRMRo+^lqV|^a6G9o^`wE{Q4)Zw*0Y!wq zk_jA*AZj{f04;Vl4|cgNYIoqG{X$Z0WfiC%FRE+pT)+w1W`^_QXLD!B%j9q_yrTe{ zOxppV_M1Dog_3Q>a~V=wvaZ4nczvkaP~ix{O^+WEgX9i?((*%E_s)inG0vEC)Oc5GdolGApTyR~>^K$2{~>70Rho399! zfAIMe_9#&X3gw_91XG~;wOAc}puAUj?=qcs`ULn$h{3f*fi1%^Em_m}=~^y%=KyHl zaa6f~4fYedK2s=q&PuaVBgxXv@%$isWKJzg_K8!g$!dSEBnG5|O~e+yi{2Kib<+Z& z_W)KaN+H_70ke`YH?}TuO7Hf`FXh`Cy)uKS5BQYu-qP~tF$6r7`Gcd;uQl<_my(|~ z)Ta=SH->Kd83&eCjka%@mb+p2Gu%|t79m8^f-@Pa> zgC(vCehWqK94J))IFS?GuUhUC%1oJ-pz;w>iek#-Zs;KaznDE86)yi;6j5}=E9O$*ke-KGDOt;$Klm%3@_eeBs^3B4*gt3E0oFMr&0 zqbxI))&lS*D#r#0%u1o{6K-MVfIq^K@iHS_>s9P|&$*WJtRr;54i68D^hpAu{M5Rs z|9EknIn{yFE%L*+JU~aFTGNyLGl-WVuM%{O0TlpM-?e zuZR?gqI>5AQ=k_dMi+Dde*pxG*ts4G7S(0N>G~fj z%TGx0saIilzGUbxv6~fK9v{JNCEt{=t3-7rTJ|(QY0sk);dzAK7uCTjHh}QaFIv3v-D`|JA3W@T7LoISL>ARb2vf_=l_fZ@o{BQ+>IS#UmJc zeP&PTE%P)1V_Gl+)Xsj1V5BK)Hd26$1V1+vj1b8MwyE?mAjMz_d2PfE2-9pUC)^hY z&^E=>jg{ZBA_SQ8mHsG2AL9V^h<1sv>fd58;N5)Z4~$WRm8*bl{O={#2Nc{$-5lmx z{23dOgzqz5`AE&8@aIOXPs^<-CC5$kr&1h;hiu>L4i&_cefj*c?$VT}pRC0{S3E*2 zdeGVR-qLhVy1+yFC}8TPy;!hRyQs(d6kX3I?Lo$f;40K$%T6XGL;bjuieT1N%zs{v zETL4=+qCMHY4$(?Z`}pMB!{j1pzH@d=ZyJ6N9hl)RbqfbGEb=NQIOmkz!7}-a@r`M zi92>A%+LjnI#dIByr+N6<>>$cAz+$N<*mP&d7<^*6qnkU?vr}zDZrFuq@YJh3|t%2 z2*cAwc>31~yTmZuw=y|eXZSkWzD`!#+hj5!$|h~{)=jgEk^$bj3WQ}1JH`f~^W~r)Wf_K%k^Edtn<6X7hDc~Zy4*EUfA0!-_(!?>PPXJzGaHVXUUj=# zVa<203Wn?+Uf!rx{H{H#Om1$h!7jAjf;7yfNYPXymaziwV!2Qr#Ln^5TYzKK%0}eYHF6?i%^iYbm9&H&~fs!9#aHD6M_}-8$b-< zBMz^9!vGKe1E>fWqDE&Pk1lu8M; z@qg;hS?mobzpon25N`l#6tbh*@HeHNu&Th|Q>BJC;%kDAHTXFp)ylY59(x}!D}$i@ zqD?i$06YMt6Gkupxg5$HXsd&00eKm*U2!uYf0kLpjI3|a!>5Z|jLficH5)Eq#l zZ_TL@TwiG(Oyn7_@D!o-0bu^&Vg+Zlf!Br0Ba`!JKak>T3P|YRM4*$t5^yE7HPFAfSA9{r=FgWv}Z^IvnU~ z(8_&0(1%&@#Vt@wbG}mz`EI7QRnvS?#I7Tz%C+QL0Wi?}g(u_~3{(~MyCqFX;{kmi z)#R^W?EsPg`-vW0*lnzB9neKo|I`-t)c>Wq@Ptb>X+{N3Ph`DV5fXicBkmgZ%L9j( zO0)!14ijyMBsZ?&(gmLis(A0u$K9OIjh;%1N;_WJu5|}jQ22}AvN-Ik__m6ik7d(- z&c41{U(^fbR|o=WF5q~_KcAC=(qsVbR3Y`m&g-C;{U+nts;nN55{^K3+>KqS=kMZ% z!`&m)3k7W5@Ye9FZVUkgxmy{6n>wy_G-9~z;itxr=BuWo8=IZav_7L(nfOv{?v)&T zHPz}1sSN6dNWD41hQa9}U1Y6}j)wY7rB+B}+VBt1!t5mMeYfJZ#hk12>Qb|q{WHA* z#!Wh3vzHdJ9`}Iac_^4-K1W2Ym2A@hDSt%Sm}&k(~k>J_>R0i*{b9bvscHS6 z%CIp>>YKZl#IB`GG38X!@$17N5xCHB=eMh>> z)#2fo6jPOc^Khn!IRNH5lArG&I7xz9C#*-saBjFm8i`r;{XAs(nL8p7MRv&qgLWKo zqX9O0SiAPhW4QOT>B^ANbauR*P2~u@i1_t!#KqxOsNoyt;)v*B4GT@x$2`g{#dWejHx=vqC_RG-In7meVJmE0 z@{_B)Tch3TGxs%$U1zdA=J-BePLxOyy&E#>A8^+^n|X89xqmKS`}Ke($1JY0FYm&6 z&UAj7QNNRY_)CgW63aWRgWj*z z3Fxr;e3H2Etpl}KJahn+r=;=pKB0w1nq;?h~QfeOR~wA5_AL zK?W;@6+<@oR*hv>Gaw@fSECvB_VA+P(m|I(^K+I;UVV2!Ca7itKSgaogkXYm`B7@9q*%MbiO^O0 zOc$pjBAUB020P|}TL2>v5Q*rEM5c)0VMLPr*cwICW=h!^c&HH5n=a@6S950-6-T>9 zY0^M|;E>?%L4pLQkpvGA0t9!5;O-VYxRc-n4GxWK(BKwaI=H(u)-XlRf6keitGSt3 zvlbUn-Bf>4{Z-Yw_p@sdy#Nr?`VIheZW*z5n0LXQU0Z`!oG!?|Aq6IDiWgJQis8@Tz;CowV&PFj}9sL&xH`2UY78&KvOFZhVWH)IC=Kv z0s;bO{9_hCi*%3^_6gb8ds1F$s&cIh{hIXGompE<afyRNE+5v{+L32lR$b9*5*WmR&(TuouuSXkr%!h%*wavoh z=HbY(P_K#x*Wn6qVBXvY{xqV{ugQ?q)l$9f3tbS z8Eqd2$|8{-US9cZwQGl6=XU#h%;KXufa490G!(k>J!wVjp*t(~7hG z9f@P3GP-Uv_Nru?{U~Kt$%Fc)VE+T(8Lmf+LUz=FsY*?)+{uQx!9dAesF(P{^DnK# zUNa4fDSV>bp{+c(M7^qO9tWYK*ZmvUf+Ab&*cfogR*Ejv#pUoUcsOlybC9ro8Av<0 zz0AEKND*(dQR66WQfc{BderQ^vl{h6v5<%yEIAZxHEKW;$f!kH*OSn**bt4udpAfX z3QlFiWJu?jU$M7W7Wj=Us^`w+k=u7=JVtza$V58~mTw7lXOo9ah}>HqBj7wG;xLcv zfcM`1GNSC}j;uz;|0R!NaWpDbCn&^x|5KC)n@6ROmvnPU9!%@>*3E*h%jtEVp-#?0 zZHvdG+t;=G(;a=?E^VH}8lJ2MQ!7!YsH!ZBo$36vw9|IC4YnV`_@$pLzBviNj_jHh z+pZdfBWzQuH+@N#ps)0!2IgxeH>h#0M~*ekU)f&ieo}g)v}*r~UF8!|@ygGWPIUHj z>`3{*H&k3HgkEn9JfFI(I+#Si*1OO1Z-9g<*C_UpIYp9!-7D*tW2H;<_*HIYKnT3m6fl2KlT>E;xF; zk{J{wZ;5s{Nsut2W_?-syz8^#jMq^%aYr7nh|`HwG_o(0w7oN!v@4!5QjRP0N@KxmkpoB7}|&RXx>Bl<A+#Lv`Bj8N1koG28s%Knpz=0uA`~38bcVf{G(72Ro-6tirinV5nrY_yOVnS zG0}=ZlUT(~nI&w?dPWl~k&UzPd{cdURvi>hnE z*XC!s$8=cazuQMJ4`)0TR~LWL^0S}P)j`Nk*}}l#KBqj~D}tSoh1zx8hN(eGC1GC< z>Y>YpW>9c9-44f(M`toqj|Vmhx(H4N5)z3X55eoylOBs|_n<-}0=Lu;-8DSEckXsY z!)vJ;vH@|BfSeBm4OC(BR};P=9vU1*A@e~mjYcEEaMST;K1+ZqsQfl2hj#O(a`zjX zA&#v3c50tVgaeLcqNGKHI*qDT4J5x>?(VI;RmMd36xp zaw~`(a~>r9!~36L6VaT6as*Fc5uuy*)m^7Rd^bwMBgNvF*$(+7s9KDixoIaiyq;3ISMEXUiUYfsLs!r3pqcB1z0w4K&^8`KuN zc4H_uvYK_+b0PJ2TZb6BcS^}0Bi#aykb-XGS=$j@l~Q+lay_23#9=Z@^wQa$B2M*C z0U;tY2{cR2bcTT|r}X4P-%F!Y~wRSTb<$&K-Kbyja%O8Ub;(@Hqq! z>9Ooy-yAH>@It4eW(}k@@=ojX&lX!0mmU1zea*guX)b$vx}%4rjg;PSi89+|d#8fw z3g@GTG7r++w}-@+kw;jxAdDr~pbr=eKi%TXN-ObC#K_JF}>=`OztYky53VgWRFM#dk+0XYmG?0 z*SFK$5xEC{%Z|snB$?%*=JoqH^QzXi!%XN(U5DfTeiZhOX;V6t2N^pQOvd@86BY40 zQx4{@Z&e-WvwWXDuC9D>`U0KgD9S5ak)${}%c{Kd?!&}{@c6HVTx?eAhRvrGIHt z*LsN)ExU@lMq2lCAkSvsCY62c$Q|0RV&RLVO|3l;bRhGIeWqq9jgBD<@}Ve>Qpq;+ z{W5+-%$-v|4Et$7+HhKYMa~M%?~0a>b>dY&2=uF zPitMv#*E_)(reZgU>9s|gMxllW7Q>`BG5y+K+<8j|94!)Z=pPj9fR zmxv>(4^SI{MDSLtq*#fp+3AY=lzah1mo}7_7OC5(^k^fAx1a`G%>&rQ!Zr z!vyOUOL788MgCZdYgbGQd^&_{b`vTrc8c)J?0V>|rzWOILMQ%kPyfMlUNIrWh2w2k zpdbjJTJGBYRuglWo46oDgF|r}h?OpzkE_t+7Sx%CQB>+uyU~!khYV}WNV1)^#CtCatWC)Ez@mph` zac|_w+n7TR6hh9BUtNQJOi#u8O0Qy2LQ2shV`B-F>Nk?LJy$Hn2iI$DT#1Oq#&G*S zVoHHmX%P&`Au$=xa8eRSw-I(usJM=1L7!)Qr@lDL-ll13k(WgHd%Q^SB)_-bo~8BT z*B*)=yyX|3hyUypXt#tD2&qXmQm{BSH0s!e%(H>W6{u3Eht>H!5?aEOz?MRk3Cb-a zZNXs>`!?>}h#p(k(zSGdeiK}xcKgo5C#)mJj8D?O+xQr}p`LPFAS%+da|9zubZcrR zPj9|c>AgK_KdR`fuco1N%9FKvk`qppcVO)&>7^k|o>eEFl`0pN64%rvqNOSLMGPQqV>?ZkdvSySfQ~sMTWIrsNnL8 z7y(Fl_tWC;&3Z7sW_81%QYH`E5I*}}IOnk9;)#`~zBeeW;)A~?I?hK2rJmcXyPpjl z=+LciGgcQ=SE*SRPA}M&qh${&tuTc97K~^1W$yC?rd@UWcIjg6UYv=laW_4kd-NT7M9_CEw{7E<=V&!{nXINYL`aB2KtJWNtE#Lk|2<8fA>Z4kmBYq ze3G#TnC9f>VsWJ4Uw=0qb)|?WV2xt`cA!;fCJeI`U$u}?zA5|;H5_5YktQD-WDs+ty0|mg{hD7;sZeO%WtP$|JGcJDvQwwFj%8~u@ND&5L(c6DG z{-Z4;8P;wMI*x~yU(S?!u)_OL;s=CnkA|+BWp@SyUOo6FIv!@szXGXB`R61eelOh6 zp_ZMc?+G@w7qB$VrrSulA9d;Y7m)b$O+Z3M_FN<*W#2WE5D4}Oo;?k9&F)h=7DBO#e*))?6=^<@E?g{^GK0&h{rZgPA zD5SYm4t1NfW|1el<5~I zMv6U(cs*1dF!dZ8BooAiUd2X9K*UHafwQ2;UFBygV2uJ)E;&0g(2Y}i1L)T2!J89p zTR?G&7;V$w8S!l@OcQNRBjqqDBRv&n%Vi>f8O<0&H;iT$=5GKc>afOV^3xEz8uDO* z)`IZ{Al7bkgNS5qMclM#2P%z>8Avrk_$oRWL}7!6w&RQCwl&MTi(%-m3Duu#M8+p^ z{G*gLZkf@^UEP=b?eLf(&{81`8`oy+4<9B=4i(|McsobHwY@EXtP;LQrSeHE`#RMa&~>zC)efLB0^f8LS_-8ZcC?g z;}Z*<+TLw@$)nN9%h7YIXS(&?u8?!rA%d)$Z3M3 z|BrW>;f>E|yY($7H{VvIE??(ef3m1{%T)S7Q_sTxVe9+*6zx3~bLkKBj1{OafZLk* zK`WA_S={E!Pm}MDRm>}#Rm{trZP*H9d0C?VX0-q`D0%=QmOY@E0W_89R;Ev#j#ing z>+^u*U3xjF##-;P_dBS=!PF}@9ZU9jX6gTmu)u;NVT8OS?;`o%ZSxUgNsDi>^yBwGHl_mz;*-nSqxs+splLnkT;RDuKS_6yB66VIA0+dl?rAqVjtK6zrc@VG02Nb{f6q>L)8c|a`rdCp6K0G zel*IWb`P>wn1ObifmN^;&%mVyFjnF{Vbgh;->hV6V`))TjaAb8*p4v}s5*|#KR=KB zEx^-@SN<4#i@NBN;xw4D_5SOT=iy=#^W$kCUzRG%M!RKJVDl48n3(xv%#-|$s-9cB z??@C;oG#P*ud9G=rivxI1e|e-WI!ppy>`zS-7o`wZO#iFBzo&s(R^Ti>?ci`Cl@LP z<>BJ~oWfg&gZa(DEbrCDacLp9PPCB>&reP*BY%6ZjGFEo@6;6{z~||F6Uap&g+wDh zEFSXlo!wN7BYk!-%ZBF`bM}(3C%@a($_SuPEZ$u!kl&nTWsvfZHNIf^7Rk6Q1+0HS zYq&wE9dWc7%@=B0L_8}wUpu(d+1u<7S0mDv_bLG2@)Hj{p@g+H`%7_r#0+zXb@Z}E=#3!VVyi}(&BxsMu5atZAcs?cZ;UwRg!9qX0@C~O5 z=DK|O**fa2d5f1xn>1?sWomuEz~P|=ElXhXFd`^_EPUJ*_xX=m)FAN@^UUJLuwF@N z;DoSCh2x3O^IL};)}rJ2GEU=_+mFtL{@5B|Cszt;FkmOucpP@QA>V3fCW7Bnec-*N zYx~C_k>M|+N)RmOw-wD_H8QNFbF>(8VE;wAg83!$e=HM4E^6;gs{@i88Ear`$7_3w zH0nnLlA>JMA3Tr-#vdupZvOY_jisj|oV!XS0c@A9w!5Verq<#QAiOVZ%~jO_Y-_6J z#qC@lc`J2}bmiuC|5sR4x|x*)n3F{E0FQ{>rNv(=*3hl$Juyb!S-_*>x~lMDiU#0^ z{&7_Jy!qc96?$~ZN(pl1#nl1yZgRh=aG8Lsgn3cmi?Myl9QV&6@Hpj!zzJx#3A$VM z-)+w&fNuzu{JZ}tgknk(*wl1b@5%CSmjx9F8JDRfm<9PlCj9Y0{?|`-1}Yg4wn$8m z3HK~(-aj6Io~hDsu1&MN1T=&1E`9+YIe z^QAW(Gaax{D9?oI*L3ojTw}(3^|Q5a={zrveBn$Jr}2hQMHe^VEt<~F!qj2D$MEzK zBlKW1dX7c&swXS=0cN+i*u6D#^TXHWlOmtJ+_2Wm#O4WrM0}pofg(5Eta7BGYM<}m zMQC=nlIa56rO!0aQSvUlpMX-#{e1J{6AC?Em!kiOWcFJ$dG}9Iw{TKSO)prr4Zx*=ae8XSQk_eI`T3hltO`1>5sbb8&K^-?+apChx z;FfJwS1C;b7?-;}0QuJE*MzQ4j9d@zLcj?lhZ}8o`QIS?uVW=BxP61YHgh)(zd?ck zTOshhlBBbr3$$9K+}iZ*V1o!Wc2mv_VL1*Z)s5Y}W6S6be|He=Eavqn_QQaz0%x&) z=ITT=1Beza&YDl>aSt+$<=eo9whcjUy{P2~u~1x%2K$^xjxjW;;Rf@=jW(kk_g z*(<%AnOa@B!Xxr=yzuVmY%L?xXyVtsm?Ydql4ai>Gf_E>r6Nw594v7(S|FSk&I{87 z!EZT=OOKm`l^F9?(jS2cz?3lh81s-Zhcu;&1Pay7VqKpv`DDEa%T-F?kZ-Q6mi|D8 z*VU}Mu{D^&?gnVlDP7r*n)V?e)Rj2WY|Oy(SxA>o+I8lrG5f^cp}L}Ky#Ur@AWi8J zY8jk?RKy>V6e{v9)>f5 z*?8wXHty%lL-RrzwK0yPKvo9~2tQ~9YS`1cF08bm9`B|Dyi&t!i(&@4*_5Eg^|oh2Ft4S$&J9w+mlOe15C`dI-`n-PUqI?Y4o6Z=Ihy6@(t>?AgK{ zMj_XeknQ@1>A@vuWo*LKs?Q`}_#@G~-ItJGe3S}jR;J_98DODEP2e)<@P}*zGJd13 z+tQQ`5ba@gSc2PBGbQTmkDR7gS^#E*=pW_jzmAvCsPF~Znr0wlA!5OK zQbD)f7hd`;axL+tinlgkMcLmw0+3F{EEDzqp)QsU?WTM9t=BDay$yu)HsavB=&V!0 z*mJx{QkS1WO;=fBX?pG}!Ee8O_=ZR2?=$cGonhfpf0D~)QoVh#$7Z>?H>%CNHjN^m z91qSfR);e`#n}7taHOh+NZ0{Q21Z-f}->~P@3P2+MHArJ@^Y?D)FA6ju=M^^gc?wA|m%F zT~hOpF`kb|^b!zovCIVZJ{x{i(N7L4n>?D9ff0h^A0QLz{2|PK^aEi9##H%TOsThW ze#eUBwdpI0A{Uxgm-E^j`nooHQ7DK?)~+~NF#B-vy};1G>y#(3{^;_Nj~^CgG(EZA z))2U!Na}P6dV(!NP~LX)iJc_%eH>dla1`C&cDuA?Nt3%IrU|*(s#SHta10xKyCx1F zSz^B!O7G*J)~e6xDbn8Du7RFa5S_UHLTwTKgITS>7On1 zMC|apMegoo!ks3~X7i|*Cm1emPBu&^%Z7u=N^bCD2oVrt;tX@1K5^)qWHcHN zB2g>=;!PU8cJfnN5FpNhDA<=2Umjy_wl=VzS_9e8nh#ZZcv6f2<(Eb|&(q}u(2!mM ze1MSSHmzyiNFnTbbxH`puM|G#N^ZZXL-VR9_3l>;J2;Ywbc3ifLG%4894mPV?@ym* z`nf(!lBKf!WJ*=sz5AynF>?KU zXVOwxOAKKHFC1(iYzU+gANCOHI|HL{0)*500XVV>Xq=|_yAFt!S}vLO1iP&l*(*Tf zt%ZXG|7sjPxseS(TEmuT$&H?Ay8sDDdHa}zSst6j^#H>{5VW#iGx{F?Y@JlZyTQ-D z05j;32DO2VOJNB`xWxkDvo}Dlwnxrm%JNO9?*vevcFaDZ&Z4ck!U=IQ zY{}4Wy=;q*{%ZUo>31{Ohm-mOfV=aR@n8Tn*9ZvfGkwFE!V6viExHnvD7FqVvVRO^ zPEyyC75<9v2l#*p>2PEt#$E^f@(M983cV>#0b-1>-B*a7Nvs0L?MKnlAs5iX)Ul$? z?;<73r)l@UDm^4rPx>NNEq;r{sDVRQ?6S(;(j>dsg39;??LbUc-Ru*L!4HR1H{1d4 zzw6`uCfG~sQ@3QrGZ;9kYXhkV+&jFI*bER?srAWE&NHr;=VPv3AJH7VSzqCipu(%< zbjMSmy7{$@ovCJx)m20A=fyLLmcZBMBl2FsEhz>VdaSs#_ZhjnZHfGx7YXs#~&utzzZR3H+S8weDRL`0IO9Pq1;eTE*Gj>^ z#8Dj~IhK2&bLl|#?pQ8YG{E=AQ08K>b0lW47<3Uu<-D(HmvzdYyM3{#mRXC^oXWzn zHE~G1LnQD`)X%q^wMi`mX?2wi;*?W(60kj!cO%u#P+QOj7=7o@Lsz)=U7PtDe@Frk za5C=x@QNmuQ4WK_NrR~TPx$QS#qmdS!q1n>;P?X%x1yO{tk$Tx-O56p5Yy*BLObB> zPrb$^mfCE3wb=1EW6ho)36-Rvocd9I`W8_q;>bGB^J>xY9d^C=L%F4ci1-t~)sO~% zR!P}Tw}h7jmj-=ZDZ*E#RtVzdsG<@mP?$HijyL-pnm>>nOV{cFt)5bPcLJdl>J#Te zm#y@}Ab$<}>M_BKq>xtSV0KiB-6AdVT3tvx8yphSHHK$bGS^`Zd)3eTEtI?THMnrp zj6GbDnO45yY=XX$isVH&iuHm^AI!e_DY`Prw*so0yd|2c*N>4Mzc89YzvJQ}(d2mP zM&178+gmI`+$E#v8KOxV_z=^b7BHF){C2%DlyDJxF4kh2MN-f8uG-qAMtE7~_G%L&TO&(?Nk07ZL>I zKlK4m5}@Z1Wn|^cmnod!rQdiI-l;Ql@?;WA3sZ5R)kwl(h#nm21CJF zhy6n-dNV?q{^9uztr6|!<|q{LUG5?FUmyCoN%o(DVy?sF2RTp7ggf*&%`4fcOVb>S zfVygngoKD|EQ;YKdC0QpMD=m30WXfWYzGU;)7`Kce7zZu4ZN$XvtEEjQKXC_D0z-| zC@Lq4hfoM;jI0!fuP94SIh^I?&FIPSv%5NIuv>zMlvZ}|W0nAi!=dEY;r5?@s^_De ziBv<9W%?*S4M`gvRZfRIK8B%U^?TIsQCE`R_^(6^2g8Br@|&g;M`b>I$XB`Uw(vSQ zl42jm9>+|GBgeA**k=0F$g?TQ4v8G{u4P4c=Ib3Hd6n(!(*l&sw+Sq|xTvY>u|5x# zh%K`TNj7br{u$I9FfNGI{(c7yMHV>*Mf&-@vGl<5KcIde=0 zZgZg*$mxRP{)4sU0kxnlOZ)GdUQvlq?1|*UZ_zIV7Kii#tOI^-jUhSs@y$wQ~!!K~dlg!4ue?Rukk%diB@{7b~QRNn~VutnM zz@114+boQQY_+GT^5KQ{%a-fSv}GKdcKBtnFn(8B)CUthUhQQAdl|wkSZ6{B@id2B zol}Ub^{UW;Jaa+|M!*@Jf}e)$FEBZ2G}d5&EpJDUQ^%sjo|{~#c51@ZL|f3on8yxY zDp=5`i2nXuez1#iOFwghdp$le8iL~8N~3_P%d*$8ieXJq5;&Lq)a&Olhr>!bn4pmA z7m-WHQ$uZ>WQGnjhK^bVHBI*z#RQ6LHFj~9edc!sJBZ2dGO-th1`r>3<57J#Ks}Of=y(zU9BL0 z(Ck*muSY3Z*j{^X!@X1kJ?7+DR&=94m~`4Y*)nU}T`&=X1kqZYw4OZ9$LpCauYoygH_GV>B`%IPXqm{bW`MdKqWh38}}@GuSNhaLM|S z5A|(Jmr5wF;`u9xUOo#}Km&R9bY7^&s&$y4`d}(;7`)#saCMbgU2}zJw@>>k`+7}# zGSoW1bxR}6XY}$Rz|-R;Km@Vz+GCYG0qP4!zgvc~|s2dEm(KM~NVAzyR%W z4W%=?23>iCR8+HVYA~49^T!B*S}%dT;+;4vjkZ+JBc~-6heicIEqj9{9L8<8BI>w> zYD4dl!fNH*C#B-@gY)BhXVRyZxZN7mb(-VadtGHvoO7dsiKi?yViV5vsD6mO#7m_J zZ%7V7Y+HsLsMmR4a@fq+rDa}c-z_nJ{Y1NGm-U&3f_NaxZd9dvS5@@|UV}^5V&}9o zyfbcTY0}OV%krU5Nvn2(By(UALPX!zU)K;OCXHKJ%;OMar0kO>(e6U|bda>y!MA@U zNt80qcOU^38K`p^gMx|LRI3yW(fbpy`$hBz;oO<*?d5+v<%PraJG06z7x}cCa5+l2 zIyBAE_H4Dy$v2^;Z)OKYZB)nF1MdJI$lL$O5g=Y+^-U3VrD$v_)R~MO~!60a{mn9AB(@9S1;_PWXm( zOu+3&J7MM!@P=n1W0lTPI-t5g3HUIJJT3s-+UG_8%bs!$vk z;IT>BMMzrA>sU=q{S4(Alid0aTV)AbTJ?~{T-PQf%=N zy|qIBPHyv)$tUd^L;Zc8i(&i*+|P*h`>Q|^@TQ_9^14> zPuRqw{AkV!Qyy5ZFiiaPlc<8gC)`Tq;H<1{HaZ(v7M02mB|YEk}PB&^xU$DALCsT z!wiR80EOHR(_6!rQpViKU%*d>Mh@3}SQ;yzj%FQ|NsDUoI$azUhNM7~yG{t9VrXhw zlk{T#9TuRss}>MJ1`fr5ngncdj|Nm6DlvaCxsJZ4Y~(gbfB!-V$OFAKn&{N#eFFNs zC7Yg#uFe^P3%nBn*cAUP=*DPb_`pm9^Wg!_YeGwlH$W3T5mvFs@x<$op|75T0dqjn zt$tYSmF4wSz}AK5>%`Cqgn$On1)R(c8E&pOydMBRh?4okhP>-_&2~#xQ-MQ$a=zD> z@pB0d@G>+`b!UsxS8VrzI+AzZbcuu5`tXgw+PFzpErIH2iDW#gGC7(k~Wy z=#q1PXA|X!ZOZ)9m0!$2*ECt|mi|3GA^x$m9pe)Jd6|mNtgOWa|DT?c0F#F(jsMTw zQI+_|rq-TLEBy0r3slr_OfrRk@2V7d^Ynl=-@j*?nu?Csp8MZ3UHuF-{D1l2j)?a< zFHzoCgos8R{^wn&=g*n0tt0m|sU51wr%jLdF3ey=#xyr{{~8HY9QRhSVXKOxl^qsB zAim7c^<)or?aE1Z@PN+tPdlD~R8SNBuhwq2vQ#2%*4LJF{8Ft4`p--v|h@lJ6zT-x_@WAArgsDgXcg diff --git a/release-0.19.0/docs/getting-started-guides/libvirt-coreos.md b/release-0.19.0/docs/getting-started-guides/libvirt-coreos.md deleted file mode 100644 index 4bf14bd1e76..00000000000 --- a/release-0.19.0/docs/getting-started-guides/libvirt-coreos.md +++ /dev/null @@ -1,260 +0,0 @@ -## Getting started with libvirt CoreOS - -### Highlights - -* Super-fast cluster boot-up (few seconds instead of several minutes for vagrant) -* Reduced disk usage thanks to [COW](https://en.wikibooks.org/wiki/QEMU/Images#Copy_on_write) -* Reduced memory footprint thanks to [KSM](https://www.kernel.org/doc/Documentation/vm/ksm.txt) - -### Prerequisites - -1. Install [dnsmasq](http://www.thekelleys.org.uk/dnsmasq/doc.html) -2. Install [ebtables](http://ebtables.netfilter.org/) -3. Install [qemu](http://wiki.qemu.org/Main_Page) -4. Install [libvirt](http://libvirt.org/) -5. Enable and start the libvirt daemon, e.g: - * ``systemctl enable libvirtd`` - * ``systemctl start libvirtd`` -6. [Grant libvirt access to your user¹](https://libvirt.org/aclpolkit.html) -7. Check that your $HOME is accessible to the qemu user² - -#### ¹ Depending on your distribution, libvirt access may be denied by default or may require a password at each access. - -You can test it with the following command: -``` -virsh -c qemu:///system pool-list -``` - -If you have access error messages, please read https://libvirt.org/acl.html and https://libvirt.org/aclpolkit.html . - -In short, if your libvirt has been compiled with Polkit support (ex: Arch, Fedora 21), you can create `/etc/polkit-1/rules.d/50-org.libvirt.unix.manage.rules` as follows to grant full access to libvirt to `$USER` - -``` -sudo /bin/sh -c "cat - > /etc/polkit-1/rules.d/50-org.libvirt.unix.manage.rules" << EOF -polkit.addRule(function(action, subject) { - if (action.id == "org.libvirt.unix.manage" && - subject.user == "$USER") { - return polkit.Result.YES; - polkit.log("action=" + action); - polkit.log("subject=" + subject); - } -}); -EOF -``` - -If your libvirt has not been compiled with Polkit (ex: Ubuntu 14.04.1 LTS), check the permissions on the libvirt unix socket: - -``` -ls -l /var/run/libvirt/libvirt-sock -srwxrwx--- 1 root libvirtd 0 févr. 12 16:03 /var/run/libvirt/libvirt-sock - -usermod -a -G libvirtd $USER -# $USER needs to logout/login to have the new group be taken into account -``` - -(Replace `$USER` with your login name) - -#### ² Qemu will run with a specific user. It must have access to the VMs drives - -All the disk drive resources needed by the VM (CoreOS disk image, kubernetes binaries, cloud-init files, etc.) are put inside `./cluster/libvirt-coreos/libvirt_storage_pool`. - -As we’re using the `qemu:///system` instance of libvirt, qemu will run with a specific `user:group` distinct from your user. It is configured in `/etc/libvirt/qemu.conf`. That qemu user must have access to that libvirt storage pool. - -If your `$HOME` is world readable, everything is fine. If your $HOME is private, `cluster/kube-up.sh` will fail with an error message like: - -``` -error: Cannot access storage file '$HOME/.../kubernetes/cluster/libvirt-coreos/libvirt_storage_pool/kubernetes_master.img' (as uid:99, gid:78): Permission denied -``` - -In order to fix that issue, you have several possibilities: -* set `POOL_PATH` inside `cluster/libvirt-coreos/config-default.sh` to a directory: - * backed by a filesystem with a lot of free disk space - * writable by your user; - * accessible by the qemu user. -* Grant the qemu user access to the storage pool. - -On Arch: - -``` -setfacl -m g:kvm:--x ~ -``` - -### Setup - -By default, the libvirt-coreos setup will create a single kubernetes master and 3 kubernetes minions. Because the VM drives use Copy-on-Write and because of memory ballooning and KSM, there is a lot of resource over-allocation. - -To start your local cluster, open a shell and run: - -```shell -cd kubernetes - -export KUBERNETES_PROVIDER=libvirt-coreos -cluster/kube-up.sh -``` - -The `KUBERNETES_PROVIDER` environment variable tells all of the various cluster management scripts which variant to use. If you forget to set this, the assumption is you are running on Google Compute Engine. - -The `NUM_MINIONS` environment variable may be set to specify the number of minions to start. If it is not set, the number of minions defaults to 3. - -The `KUBE_PUSH` environment variable may be set to specify which kubernetes binaries must be deployed on the cluster. Its possible values are: - -* `release` (default if `KUBE_PUSH` is not set) will deploy the binaries of `_output/release-tars/kubernetes-server-….tar.gz`. This is built with `make release` or `make release-skip-tests`. -* `local` will deploy the binaries of `_output/local/go/bin`. These are built with `make`. - -You can check that your machines are there and running with: - -``` -virsh -c qemu:///system list - Id Name State ----------------------------------------------------- - 15 kubernetes_master running - 16 kubernetes_minion-01 running - 17 kubernetes_minion-02 running - 18 kubernetes_minion-03 running - ``` - -You can check that the kubernetes cluster is working with: - -``` -$ kubectl get nodes -NAME LABELS STATUS -192.168.10.2 Ready -192.168.10.3 Ready -192.168.10.4 Ready -``` - -The VMs are running [CoreOS](https://coreos.com/). -Your ssh keys have already been pushed to the VM. (It looks for ~/.ssh/id_*.pub) -The user to use to connect to the VM is `core`. -The IP to connect to the master is 192.168.10.1. -The IPs to connect to the minions are 192.168.10.2 and onwards. - -Connect to `kubernetes_master`: -``` -ssh core@192.168.10.1 -``` - -Connect to `kubernetes_minion-01`: -``` -ssh core@192.168.10.2 -``` - -### Interacting with your Kubernetes cluster with the `kube-*` scripts. - -All of the following commands assume you have set `KUBERNETES_PROVIDER` appropriately: - -``` -export KUBERNETES_PROVIDER=libvirt-coreos -``` - -Bring up a libvirt-CoreOS cluster of 5 minions - -``` -NUM_MINIONS=5 cluster/kube-up.sh -``` - -Destroy the libvirt-CoreOS cluster - -``` -cluster/kube-down.sh -``` - -Update the libvirt-CoreOS cluster with a new Kubernetes release produced by `make release` or `make release-skip-tests`: - -``` -cluster/kube-push.sh -``` - -Update the libvirt-CoreOS cluster with the locally built Kubernetes binaries produced by `make`: -``` -KUBE_PUSH=local cluster/kube-push.sh -``` - -Interact with the cluster - -``` -kubectl ... -``` - -### Troubleshooting - -#### !!! Cannot find kubernetes-server-linux-amd64.tar.gz - -Build the release tarballs: - -``` -make release -``` - -#### Can't find virsh in PATH, please fix and retry. - -Install libvirt - -On Arch: - -``` -pacman -S qemu libvirt -``` - -On Ubuntu 14.04.1: - -``` -aptitude install qemu-system-x86 libvirt-bin -``` - -On Fedora 21: - -``` -yum install qemu libvirt -``` - -#### error: Failed to connect socket to '/var/run/libvirt/libvirt-sock': No such file or directory - -Start the libvirt daemon - -On Arch: - -``` -systemctl start libvirtd -``` - -On Ubuntu 14.04.1: - -``` -service libvirt-bin start -``` - -#### error: Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied - -Fix libvirt access permission (Remember to adapt `$USER`) - -On Arch and Fedora 21: - -``` -cat > /etc/polkit-1/rules.d/50-org.libvirt.unix.manage.rules <apiserver.log 2>&1 & - -$ ./bin/km controller-manager \ - --master=$servicehost:8888 \ - --mesos_master=${mesos_master} \ - --v=1 >controller.log 2>&1 & - -$ ./bin/km scheduler \ - --address=${servicehost} \ - --mesos_master=${mesos_master} \ - --etcd_servers=http://${servicehost}:4001 \ - --mesos_user=root \ - --api_servers=$servicehost:8888 \ - --v=2 >scheduler.log 2>&1 & -``` - -Also on the master node, we'll start up a proxy instance to act as a -public-facing service router, for testing the web interface a little -later on. - -```bash -$ sudo ./bin/km proxy \ - --bind_address=${servicehost} \ - --etcd_servers=http://${servicehost}:4001 \ - --logtostderr=true >proxy.log 2>&1 & -``` - -Disown your background jobs so that they'll stay running if you log out. - -```bash -$ disown -a -``` -#### Validate KM Services -Interact with the kubernetes-mesos framework via `kubectl`: - -```bash -$ bin/kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -``` - -```bash -$ bin/kubectl get services # your service IPs will likely differ -NAME LABELS SELECTOR IP PORT -kubernetes component=apiserver,provider=kubernetes 10.10.10.2 443 -``` -Lastly, use the Mesos CLI tool to validate the Kubernetes scheduler framework has been registered and running: -```bash -$ mesos state | grep "Kubernetes" - "name": "Kubernetes", -``` -Or, look for Kubernetes in the Mesos web GUI by pointing your browser to -`http://${mesos_master}`. Make sure you have an active VPN connection. -Go to the Frameworks tab, and look for an active framework named "Kubernetes". - -## Spin up a pod - -Write a JSON pod description to a local file: - -```bash -$ cat <nginx.json -{ "kind": "Pod", -"apiVersion": "v1beta1", -"id": "nginx-id-01", -"desiredState": { - "manifest": { - "version": "v1beta1", - "containers": [{ - "name": "nginx-01", - "image": "nginx", - "ports": [{ - "containerPort": 80, - "hostPort": 31000 - }], - "livenessProbe": { - "enabled": true, - "type": "http", - "initialDelaySeconds": 30, - "httpGet": { - "path": "/index.html", - "port": "8081" - } - } - }] - } -}, -"labels": { - "name": "foo" -} } -EOPOD -``` - -Send the pod description to Kubernetes using the `kubectl` CLI: - -```bash -$ bin/kubectl create -f nginx.json -nginx-id-01 -``` - -Wait a minute or two while `dockerd` downloads the image layers from the internet. -We can use the `kubectl` interface to monitor the status of our pod: - -```bash -$ bin/kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -nginx-id-01 172.17.5.27 nginx-01 nginx 10.72.72.178/10.72.72.178 cluster=gce,name=foo Running -``` - -Verify that the pod task is running in the Mesos web GUI. Click on the -Kubernetes framework. The next screen should show the running Mesos task that -started the Kubernetes pod. - -## Run the Example Guestbook App - -Following the instructions from the kubernetes-mesos [examples/guestbook][6]: - -```bash -$ export ex=k8sm/examples/guestbook -$ bin/kubectl create -f $ex/redis-master.json -$ bin/kubectl create -f $ex/redis-master-service.json -$ bin/kubectl create -f $ex/redis-slave-controller.json -$ bin/kubectl create -f $ex/redis-slave-service.json -$ bin/kubectl create -f $ex/frontend-controller.json - -$ cat </tmp/frontend-service -{ - "id": "frontend", - "kind": "Service", - "apiVersion": "v1beta1", - "port": 9998, - "selector": { - "name": "frontend" - }, - "publicIPs": [ - "${servicehost}" - ] -} -EOS -$ bin/kubectl create -f /tmp/frontend-service -``` - -Watch your pods transition from `Pending` to `Running`: - -```bash -$ watch 'bin/kubectl get pods' -``` - -Review your Mesos cluster's tasks: - -```bash -$ mesos ps - TIME STATE RSS CPU %MEM COMMAND USER ID - 0:00:05 R 41.25 MB 0.5 64.45 none root 0597e78b-d826-11e4-9162-42010acb46e2 - 0:00:08 R 41.58 MB 0.5 64.97 none root 0595b321-d826-11e4-9162-42010acb46e2 - 0:00:10 R 41.93 MB 0.75 65.51 none root ff8fff87-d825-11e4-9162-42010acb46e2 - 0:00:10 R 41.93 MB 0.75 65.51 none root 0597fa32-d826-11e4-9162-42010acb46e2 - 0:00:05 R 41.25 MB 0.5 64.45 none root ff8e01f9-d825-11e4-9162-42010acb46e2 - 0:00:10 R 41.93 MB 0.75 65.51 none root fa1da063-d825-11e4-9162-42010acb46e2 - 0:00:08 R 41.58 MB 0.5 64.97 none root b9b2e0b2-d825-11e4-9162-42010acb46e2 -``` -The number of Kubernetes pods listed earlier (from `bin/kubectl get pods`) should equal to the number active Mesos tasks listed the previous listing (`mesos ps`). - -Next, determine the internal IP address of the front end [service][7]: - -```bash -$ bin/kubectl get services -NAME LABELS SELECTOR IP PORT -kubernetes component=apiserver,provider=kubernetes 10.10.10.2 443 -redismaster name=redis-master 10.10.10.49 10000 -redisslave name=redisslave name=redisslave 10.10.10.109 10001 -frontend name=frontend 10.10.10.149 9998 -``` - -Interact with the frontend application via curl using the front-end service IP address from above: - -```bash -$ curl http://${frontend_service_ip_address}:9998/index.php?cmd=get\&key=messages -{"data": ""} -``` - -Or via the Redis CLI: - -```bash -$ sudo apt-get install redis-tools -$ redis-cli -h ${redis_master_service_ip_address} -p 10000 -10.233.254.108:10000> dump messages -"\x00\x06,world\x06\x00\xc9\x82\x8eHj\xe5\xd1\x12" -``` -#### Test Guestbook App -Or interact with the frontend application via your browser, in 2 steps: - -First, open the firewall on the master machine. - -```bash -# determine the internal port for the frontend service -$ sudo iptables-save|grep -e frontend # -- port 36336 in this case --A KUBE-PORTALS-CONTAINER -d 10.10.10.149/32 -p tcp -m comment --comment frontend -m tcp --dport 9998 -j DNAT --to-destination 10.22.183.23:36336 --A KUBE-PORTALS-CONTAINER -d 10.22.183.23/32 -p tcp -m comment --comment frontend -m tcp --dport 9998 -j DNAT --to-destination 10.22.183.23:36336 --A KUBE-PORTALS-HOST -d 10.10.10.149/32 -p tcp -m comment --comment frontend -m tcp --dport 9998 -j DNAT --to-destination 10.22.183.23:36336 --A KUBE-PORTALS-HOST -d 10.22.183.23/32 -p tcp -m comment --comment frontend -m tcp --dport 9998 -j DNAT --to-destination 10.22.183.23:36336 - -# open up access to the internal port for the frontend service -$ sudo iptables -A INPUT -i eth0 -p tcp -m state --state NEW,ESTABLISHED -m tcp \ - --dport ${internal_frontend_service_port} -j ACCEPT -``` - -Next, add a firewall rule in the Google Cloud Platform Console. Choose Compute > -Compute Engine > Networks, click on the name of your mesosphere-* network, then -click "New firewall rule" and allow access to TCP port 9998. - -![Google Cloud Platform firewall configuration][8] - -Now, you can visit the guestbook in your browser! - -![Kubernetes Guestbook app running on Mesos][9] - -[1]: http://mesosphere.com/docs/tutorials/run-hadoop-on-mesos-using-installer -[2]: http://mesosphere.com/docs/tutorials/run-spark-on-mesos -[3]: http://mesosphere.com/docs/tutorials/run-chronos-on-mesos -[4]: http://cloud.google.com -[5]: https://cloud.google.com/compute/ -[6]: https://github.com/mesosphere/kubernetes-mesos/tree/v0.4.0/examples/guestbook -[7]: https://github.com/GoogleCloudPlatform/kubernetes/blob/v0.11.0/docs/services.md#ips-and-vips -[8]: mesos/k8s-firewall.png -[9]: mesos/k8s-guestbook.png -[10]: http://mesos.apache.org/ - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/mesos.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/mesos.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/mesos/k8s-firewall.png b/release-0.19.0/docs/getting-started-guides/mesos/k8s-firewall.png deleted file mode 100755 index ed1c57ca7d0980056b9d088b4d3822c4dc0fd223..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 88722 zcmXtA2Ou16v|V*|t9Mo}(WBQ5qD2rywCF)d^oVW|L4+lUXh9G?T101cBBDj~PW0aU z`~2^{Yj<{L?97_k@4NThbI%p2tF1;%Ku-XHK!`QeRrDYb%tG+Yz{3Q4cy$BVArLr3 zL*<@3fkUQ;EjhdStR#i|>&G>GVNH&>Rl$8E`vQcz2a_)EqHDZGVagf*6G}HiVXlSUb zs{>15H8q)AMMXsi2ObkmH8oO-ip}6xO-+HG0l=y+*7&bMuBIHheZEG!%z z9-f|_zArhbtgMWRB1}8j+$0jZeS;c`S>Eq>GaIFFe!7TKygpr|5iH9vqg-5Qrsk<+d9_Vz~o zXJJaL8T~W_VP*=7vXa1(dY4@@dY8-Wot>TS?CgBO)6UM(*Vo@_OQ`0CXw!IoukTy@vt!P)M&wNr#JEm4>&VHo(MkY49l!3g1q>P^quG(nng z18eRh;1Ck%1-2YBYBUOK>N0d6irJ!zw}KzmmZi%BBU-Sr_iLSZh&rP0`qSAC3R{bLc@`^JkMB`!8d~$z*VhMw z&BKH6`nBGFTOJ-BPEL2WP0yNj{rvpY)S%ait6g4~em|;hvMVboWMyS!WMpOQ>*~M@ zm~CJk*yO~xqK%rGnjbXC8tUh4>Sqcj!;>fWuV25`(fMjob~`lQzQx7Gy?qG}A3vT0 z1}CAVMUSdkSXj6O1+jP??~e=*huZ9_FpdHPt7_%GetuAJ3~u-vCre99Z*TASrIC@5 zn?@3;ecD>L_8yG9_wVOEfOA5jP&X^@R}Gq6@oV6IJ?R#-v9;w$Woq;3?CRp?>g49) z`U)oIf96p;wYkaPWSEzCM#DS%IXSsS(p4d&tJ*C~*9e%2iHWhXv4zF#*x1<2#Ke*l zxDntuKPRVfq0JWM$;nAs@H07?nwko(9f{9aSzTS-T>aYB75*j*%-P{eeI;}dKEdRR zAKd=Htq?H)@8WxTx(B|wws6ut&%x23CYZtK@$vDNmKHG6w*RyF`T4;?GSW1_j-KIlQ#A1pL_LQYkYh> z@Q7g9mYt1N+|~xx78e(5jj^e}?hTe&yd+dpkSeAOHPBp4Xb)`Yqs2{H?7$ zJw06=^1;E?r9$y*Ypbi9tE=rn-nVz#&kqbmVEX?pA2{7_fa<`@bh5)3;93pgz{ z4AXA&)hm*4EZRj^nU@m4t&|pdjJ=SE8gcwqAd>P6H+#@Qbd4A{yT`z$+@#nryT?{I zAz_8$tW3*wBUJ;dMu3oMlPoiG37F*)GT)lD?w)oy$(PSgG0&ous zi;6m|<@geNazvAr3KDvjH4`+ZW8gY|nT<)`H;Ako;D)7wB&E@3e1WRCGbD7FJ{>9@b zQJm!X+PsP2;tR|KpYZJ&7ZT%!_SlN1_KAy&bHx{Y{n}|=Zd77;*Mcivqjc1%$^^U< z1OxhL&5{qj%c99zS-M~goIsby)$T?2vU{RtG+5sS9*)=?Tz+8!U$jZ+iuJr@y0*O- zeV<+Bh$9$%+rwdRLba%m6e)abY@$=7J_y-0y>4K1q!)VAu8M`RJ z&(AL;Q2OoLx8maBZ{OHXOwG;BfoBB%5jaP4^UiDF0FI6pIy*ao2TKZR^=-VKZwqgx z2)nO%IZvvit?l*tb=1cFHxj^MbR4~cvsr%x&J4Jf_;?C4$N-biE}7pd?U{)1>FVyS zXWN~Fs4eih)ovoQZ>=r6?dmF^;f|H_!?Nfi4ymr9VLt^aU@C{6?p|I$g%*JeWSqxY z4d>SREa!K8IGFA9?k!ANuEE#a$H&Ll*Vohkdv$gAnB{91)E5kFw+`#LK%J-u4<7XP z0_RjzRCMP~5n)u+!G8vJpO&ob`>4d!`Ue8&1W*-#RKWhjQ+8g?g5X;x4D-)IHW&63 z6aW{!2O?2qWWn0=DLW%Enb0{)TTf3**UY>;?)V;0dr|quMgXs-leIup1Oe91Pd2ux zwpMz4Y%Eq?OiZkOVecHECDBMzIc7Ds8L*Fo97G37j5q9Yt{jZf_p`x3W=5&74;m5S ze^G?(o;NU;LZ274t$Eg@30C(md+oWlSXEAzR8?_R(#;n9OQ8pTN@DbrlcOX5NBXD^ zOEJ-$Cp=38IN>}6W?67C&QIKU33E{vS&*_h^DKkHKaN$Z*?%3xOiJ`}Tk$){@#h(l zFsUvjf=KL7P^lbY%&xgyjBtn~qq4V9eD5Bmj5JARcVTQ7tBM6#-LQ6mjNGv8CAIM*gzn$ z`gHEYF7?l!KlzFZVfnh2@+4?-BI(pLImo>}zk9d8 zzh6;N0haswx9i~0pFcGxz}Woujha0IbG_HrJy)r~>JjR zA-htnrEtXPyAEq_>36umdvcItd>a1 zAKCiW)z{xmCb}q35}|7hXv};V{`PHz784y^%keF|;D{pU;s$Vu>+9FAXhBMXFn_^} z)LWm|5!L|$!ARl=cqA?-CO%VTe&PIrI;z9E94}4a8%; z0KD91zPUUb&eJJiM7~3}ZG@v(6a!B|q83hi@0o5sChq5-7)ePdNo`tDt6>Eu4UE|A-VhpVZo;^IOt&VgNAoL_(w)z{VU zLEjlLS8Gqbe)Y=h)ho~2`<=OMYGP_?^sT?<+*5`aS0Pb5Pp{yu3g(SFnBap({4ry4 zahYWhQb`W-y>nj`tYFK5tvxA55SBm^^Hi|9ZSDKtzW{es)^^%Tq-xn^588^Q&@QDq zY4Ja-Fe)~T8u=;OG+}a1=8x1a&Esc0gy?xi8;0^T(&E0y7{l_7>t<6peOU%=ZA`FQ zRJSr%tA2z~U2 zY|iCv$a70+2ckDpcn+|XIb$i5c4^mh-q5`KumPqFh@Ow_fj7+m}8K#sA(hV7i z03ojdUx^_h2ku|dP07_Nne;)2KWmsSrFuQ9Yx?8~^lQtS=il*-2tPyuax=~S905maLSv=Kquaq8hj_RWz>61u5CK( zgQSR7lJLc09mT739{##l8-GFO;YjuV%G}iS>C>ksCYZdztw-m+ZUK!Ey3YUrcLGVF zlhbQ^n(lY`*tG9sm*(b>wC)YczAkwF`K}>tfW6QamzvwzJw5%jAGn#LBrAbv9hUGW zmHCG(O;Y%In?dyTfs4Krb=8m*Pc0FUtE;U7$wOnuPf6JhYcl>m;L;a{hAvx`nsh&< zr>3T*S(D8zEwzJe=TD!t;zJ#shv4US8LjgkpbKp+Z99R#Bm6r-m^9=y1fN-Bo{al7oaA z#A72lW&ra*GEJ@KzH@XY2bhSRJaX&G6fErW)dO>l zj1GRUl+w1E@-dzb4jXr@mHr1}80TA-aI$oS7%mfT`+cd9sFp;EIHZn7uHhX6P0g!B zzC@GkN6-I^am_FzG5bOt)JX7!Yih z78g@Sb?`tVI;s80F`~KEv!|du%mx$)$)-M>meR;_3DAXu(V3W*7@EE;0oM;^-t~}OC7so~7E5gWEW>iVw;8h$ z>R*2R_-kDbhG%NuTL;JrRN1m}yx2e4$r1LJ_PuK3y;8}!lvk?pgJw2AjQCaKBQ+VM zuuic^SMc8~5EbIUxm=Zq*=umICG&YtuL9Xa;W!B}D-G zBxM0l7cK?y6cWAY=l~&;bFOuNXb6n&{h|H!b$U@{y#TVIN?pswh;$Bk=H1h*~r!}rq#|MHWq_)r}*0(ryEKca0_w7J1=(N(yHV{R9ILOR{@rHW7FIn&_8xl zV(S;xmbPhVXh>NU03oV!j8eH-SO{VA@_I)L^--jvL7cKLD=H{_kwm?N%n0jdut7Ms zRdV22dFu)!nf*8{eVv_LGeUuY@OWx!Y60f{zuW)=Y~4*LMOi~dMOlqhb6M<4NYi+2 z?Rc#;p2pWa`>!p#IuC(GqfqQp08uc}(=*f2-QUFTA<91Y^OdQuGkTh#Z#11ubPT@; zH_9(5Am#&0CXekFZg@$IJkxY=Zz z`EdQDM<#iH^B+5YT-0OC99aYD_l%{klUS>#h1%>CSA5J({>a*!TG3WK$Op3)q`uKJ znu`LzbmTxYgb8j$FkfAB+YH}2>1Tr@kP(Ne4aTg%*U!1HW)d{)@Tggn2oQ3 zb0E3Ye#0Ik6Q2G15eSV-b|z0Eh+cRZM&?(Im^i(xl1Tdrrd5`l>n(+egB=K*<4OGX zhxSk3=TD%BYqji0Y|J74!5`uL&@8;C9OS+*NaluVN~)=eNy^aL$B!R>{E&D%c{_3* zzQkk|IYv-G{$-Yz$9ZDydCLtBAQ4%B$xOGyRwnGgP9s{~-d6qAFCKXXLc|^3Pe zF^Y&3FElBQ}vuU}gA)xbJu8?L97g;kP1wqEu6P6w=EMR`e<%#J+ zv1HrszUjTFP1qx|jsP`@2p$c5^-cNT{;sZN)y+CWjU9iFW!OZoA1Ec1)z^o|6330M zuk+zcBKBdESb7d1<+QdAiNm0vuo>qciM}OD0ptV(EHwNait7u2XXeqyTF>EO=Eqq; z-i^*G3QI*O{sI`G>H7LQ7(9YMfBrnv)bx1Gu7s@ za?%>{CLy3Eu5Oo82~z|r6}qoUZ9n(Yn)^csDiE)^EK2t|M#X}k`a!#OtKSgSPg~JH3h75;9YkgdI+c6>_VrGVxV)Vc4?s~2JG=}065~*en=8tYXQV`y=Q8&mRUZYL2 z6rN(V6E$|^hvP@YBaAG|O<>fJPZ|WeEBPKW=@O~LJTYdB_psbf;pIXF#k8ePB z1mNlHY(|!l4$qC6+8{q<{?EX!@H1n;(KztX-nw=s1|~YNeD>-p?h!)4iLN_F|4|TN zMVy^umai^TS(q@+l$h^hP~ye@>-+sXs~IAKv5q4JQ4+DeL0$|_y118*HiD@*5bgHw8)62lX_oHRJBXK3I_JvsUOJc$H} znqi|L5tAvQZf{C<+6fEs4{gaD1~hfLc^(#;UAN{rg>Lx)QaFFU47hU#E7;#1x|hH8 z9e@7bV+qxgf#JbZyF`EwrVRuH`yyda-Lzfx_zSO8rhHONNOI%w8g}r`TLu|OHlrnTFIbUU~&wfE0q6AH3l60%Md|z?!AidDSPXo#3S7kvi$W|6dC*5=r|bFE6jO6m=g0?i@Qi z3`#^oOiV;_OiEkC-ux370!dwPA*{-~Wt5s7`B6};NOE5jV!$u`Kt(~y+%$GAx5 zd^-5bsKJjxe%T?twEPcZhV-EYm?dI#77JS%`9iih-qB{7LvjeI76~h=p0%~I!a_$r zOMMaMf%_(}`Ji~OLOj{o8oyMK7b7&D^CsS`iSi`Um{T>1&5Jl5ApKca_4tHd5NB2^ z=is=zt#`41Z8U*9d#};2GVg?h%Z{89MWW}JpwCpkWKKa0vBHCw5IvdS8{QYPTHi}% zDeb^cq@qepOoVT-UPE!SQObZi_)fpDMMfB#g0jY}GI^*@D%DkPQbO%1pCzhsrvAc3 zH2E;Wks(?uK7Y{Rl}Y10l>8rGHAhJ7fkCSMGUV&J4L57>=N^Zljl-Nv?iTpZEt96$ zOL&%o>c6wc*tvRg;{gAp%3u@`B05fGcVPv-BbSgJn?b^4yusIkpnd zBo)+lCnjB{NG2vHt-KM6A+%@|$O}MX6A;j-iy0FW&ALXry1{FyI(M2sg3 z3G{Bxh<8lFfp;Pr0<_vfHeF@Yq zHm|~fi4jtb3IdC%gNPnYPd`-=0b&g>1z-eaN%gn7l7;GCzyyNw2pXlK>2{^G%1ND=_5fH=K7VC<#Qh&P(HJA zV@InK6&y4EY9nU{Fw=uPeakVh2?rfc;;*(2^9->cZ^^R17&pKm`1OOhNp7F{*9l z$h*-QHMw$fb`>a9g1AAMAR=Ucy)nu~CXcz^rL!}$DJ`n}J5gL!r5aDyiU62Smxszs zt#dBtOGR;U8m-@#_D8;5#KLb?5BA>yT=e#@(noWiflxSvhi7v``7!ea{^`9z3Qj@) zgx^{O_xLy=o(0mn>J$1c%$xGlgwYspP9M@MFL1y4pwZ1fz=mP)XzxAaLyG(y-5r)N zCXNS`Kk0dXvL2xyBn3a=b`1XA^ZS=UpmoA}Si8ak^~VIPqY+2Gy6gcGGZj9R;luS( zEHAxfbKrfKMRWBcy|kJ72Yav}wvcVIu(@1TZjQK2Ey0zNI6eY?yiNQZUP^c*!~u(d z9%c*ija$|y{!D+czP`SBEK@(NO@^zyJz-KIX}J|_S2^xKOwk<~0BtGkU%~P~1?gu% z-dibC;o&-0Y$1>&h!0G7*sb#n9vszO(HjlV`IlsxT%{P1ksn7N>?vwO0D}+1`;vmv zV!9vj9T)FmECL_!`IqXilna^W)cGhNYx@460$TN>DsG%iBC~^il>Ibax0-p|*vaCx zWaO7vQQ(AIj`NzESw37n(!L-iCLtjqIzBl$IX*lDXzW#>#^T6JY``Eq*`5V8M-S1Xb-o<>xL-L!308bzbg8b_Ok|R*N zoL>RF-rO9_@e&Iwv@B)g~O|^g}t{b%3^N?Z{Qxqi#*yKii``NNkH2;$B~>O)PN1|r{>%G$=)LSgq$#IOhGTh6VPPGJM~|ObVa?Fk z9V-z8|K8P$W01_kW65JPVaWAGGuLis8lWaFLqCvf_K^|eQMg$#G`f<~lVsgMi*)QW zwS7O(%gt5bHV8f^dd@&69YVgq`bOzK-%1oGSnDQ7I^dJr>Gk8x*Ofg(s7seAL4pX# z7IW6o5-9zB23L4i1?D*p-ew<{$HRxj5&S<(%3nyx796Y7qTpyycOT#S zF=4W_r!>w)2A9I4LUffCiaoH-<%3ol5DIRn$c|7p%S9?C^O4Y|JcO zVNmH}Cv!N;stu*m0dgsKr~9j?n8C=5E04;VR!jKY;zP`VlX7m=?8vvcq9Q5_pS8I3 zqoaTIgrA(=`-N&?p+Oop0$T0-?QONiJAg4Qh%a5~8_JV~VJS^L9j6Q%tuY6G(~8lE z?FrG?J_xOhOj4_GaML34hfRG+vEul)m|Z3QZzc4Fmp#q;DT9vmw|^HEx?`5Ya=wSFoRoo! z(UO6CQ5OE^Yk7({XZ?y-hqvsx!EIm)y$blM%}-q|A^Fxa}D@lgx-G zsvAMOSL&_~dV3#uFS8xOd1ueg&cIv%${l9TM92t-da;`Pn~M-Zg_?6FW)RR=Hn%rF zP++>@|KeI(T8i+y+}g_8$~dCTivVYdl*?N+x z2&?7)O*Ed^+HDn zOujosg`dVyk{~1y&}p+#KgrV6dxXKw^8G*~hn!;;Fu31hdzXm1gIhRA;F8P{7~}VQ zazF`(FJ3c;eCVc^%Dq5~FHU`lpjIl(>-N)@DF_(KT4j5#@hSJ&$M(MZyaLw z!sVYWfPyB!?y0^OVqEbZPKZJvr~`jD;z!%nPyYkqKpT1hUFw~8{o}U9jD740QT83U zmiv(JA+;MDc0)RUIc7!lza(oe>pm;zEDXS#jA@)H_ zV{x&z%YVU+JjDx{pASBkirZqEi@+0wNt;b_jM0+iwSH_G7F4b zZW}&XUnlU#p{GJv#6pp-B71Nl_qi%pIU!;*OVS1Wgfrt}SHK3ix5{E3dwIRimnJ70 zKmIMzqBwCyM^W}2yH_#)hK8EPqgIamN@M0q5e$2f*8tF}pzyiRZvObLg2M0jRe(!V zQw6*l@(@HS-ESb~ei_X8DUUw#@|IaI#7ia4--~ziPC+ilQH?gnIM*jz?9rv)BtXsfsInq zM9{itv9oB%j0NT_CLG46lZ0wjj(0QphfVmw<*TmaBT)N(htMV!TA*|gn2lu59qKnG zT#TH$HYy$6&~=6#4x1v!K_D*UxC^PkhK!U-(&}b$Q!#t&6%|-5Km-Ke)e;sx<||Rn z9$x!SFK~hQLoaA%N%nTovONlD=jzi7PB41@1nqeFF$xcONz=1ZM97~`(TeP)BJ?wosrp+)vTl;+j>>7!J?v}O@)E-SG@?xtR& z#m?N;582xk_Lp;oc-)t}(p;mm z>}7jgWAQ12`*+Z*#Hl&MzurT5^VjDS^mH?ux5CU#a)#*hD@Cj@P<`yj_LAivTp4Nx zgwb&2a1^iyhIfJv`Xpz)7o)-SXxRJ5;L>!)6&h60bWdBW%8M&$(NVdui%{qpn4LiY zcDX!pxDycqrhXv;Q4_Io+R7^{cB%$bPW!ya(nB13pL~k;(*oS^&x$b0?;qaxHqWpc zwE@@e@RL|)YX&ZSQ`4occ1MZ)!=S*v{{EGHAQO{TzvRkuesd+}daI|jv@B~50y-pU zq5S0o-5chOsg2vKcpK^>D|y|fyv4M&d+Ox;Ty>;bBr&8-N0}`+W(;`uNLBXJAd>Lp z{ft@og?)4b<9=wCB?mnSxGII={DV`hmLPZ2(^b|}y>g@`u7OZyPR4f}12x$3#XN-VEN*qt_l>xp zm2@a&Nc#cd15yKe?}EFr3M?`L-&itOnaRx+6A}{}=&~3)WiLnD`{Iq5QTMSG=1-z& zW5qBC!c^FTZ7DRG0nR9R>=>Q$$HSHZF&zqM3qhMayy3^BW7n5G>n4KHOFKn7H+?f*r$0Bm=3aH>RH>G=k7DM8NPhnxE6E5>iXN zFwt#E>yELC5qy|`uCJ7_w!OWvrCdA!X2AU0rW{rWN8f_bxz1IZ0E_`*1SEo9QTjB* zhiP6SC}$^oo|f2Eg%vQjV5(D4LKLCK>yd#mm19;OO^@+>qj^M``PJHXtKItyIwouV)#CA-oaT zl-?I(-_`ZpcLY$^27$MNJA3Y&I}YbNxvYjE*MWAp1EbtTOgtgCvLh#u^gM4ViK7{c zU2VH$A%J|kR<#k)J77KHo(#&zaQIFt%4#=fp^rsxLHJ6{e(|wml~T))ZrK3L43r?5 z>|Z=LBVH%O%^v)v`AwXw(%41J@kl07HPlzp`1j*T7y7B@pKCXq((=za!hElj>{te# z!MjG?M_4x?OV4FYu5%f4pSepv7~&)!JH^}B27`|^X;>FxurN3-MCFa2DHk-1gT}{= z*oiHOHzGBV>p4lb?Qd_m98ky{UL(SlU-kWYgfT-jmwc$p>&ebFqy$952?SIp%y!o| zGJlQK+5BrZq!>w(Chvc{mS7m(1?BhD%qr9;d^sit%hTZP;x{{_u~O*8z0*sD(j7Y) z6qJ~3ZA9a+mpo2Bi~U0Gskmd>S>1a; z*r#MGhH$!*>fPEt_yWcjuWetafsLLhIKQwel93XN=xi>3L49;hHr2~Ei#2v-`z<xmzS1M2J6Depl3qA{BZZs?Foxn+!tRAn(W-4$$2X8#{)fEJ zf~Gu;K`A063cD*zEsU(_R%$MP`lQt34N5 zWrhe;O!@3woy_{}H2R%vH(ni2x-=gBO;tP}1W&S5ysLkyE)8e@Hb4XlT=|_YIa71c z$xu35djME8@ZxcC3|^bB&(meAErPC&H%bA?wl%slb=G6*GTnTGSWVLxpnekNlJYZ_ zr#Yea-5Hv}a|~AMt=qD83B4DjYifLAu&;&(kG%hIszWp$9#h8Xb}6#5 zNwV2~0u)e)DXSIS08>v-aMKLtxD!03)PYsNR3Kaay_o17b_6+`JLfO{2llzw?`#}W zRdDAX@UXG!!_TqwWA}t9R_^dVv{x^%Y;(_dvgn5CYJ7eZtQD)Xgt4<3z8X(}(+yvCE#HMZBkaCGYV z60UJmQ_=ss8QYt^>EY>1U8ka|$??~ioEx^xmerG4l$nD;Vy9g@2Q9v-4Sv(kk}mBY zAHMJY3v+ZTP}K#c@HjC2JnNhpG1Ig=Im@)0`$-+Rih};~!dLmxRXzc~9PnNSFA@0P zHRqv^zHbw!j@_0tu7dQW*k!)^Aod$vbamT~KG5Jc8JqMbM{z+ir7D69Fn~yq%-xb( zETFMb>(A^ou_{s^;U;o^XJ?0Hl?Aa*n$ZNbU$GT%NX2+LP#PCo2G@rX!CKKkh%uf# zZYC&6nsL+WuaKk`8FcH!12MJ(ElZFmUVHjZhz!Uc)==vbzW`U*|-m}1+ z;lIDv#nSA(w*Y!iz(&vQ9`I|%3&pdgc+gunH;6hrUtL6vb>8;Y4XV*VBYq~9~ttG_Fg8kCm3~x*%REM${U)U*|BmbK0dTe{oeg}`I!a0D^_Q}OJ;_Pi;G`1 zu2AaOV!QINNZe2N8>>Lc(RhiZ-@(jGh9wlP|f`F?&0GWzFNeQR|C;z4t}QKv_NQbpGn1 zMolt%;5@dBMaJ(}E0&WWnfLWOPV#aiElV8%p9TXVs*jKy&`ZIUN3H0J^&S3m__oi) zByac;w0Y3hmUPe0e9it`A>F(y<$7F-#hD83fY2=<6D;Ef^qZ?t0Ab$h!zpIu-ocAj z*d1(#nrJwosCP5g0+AgLhc0|b7-0bA`3xh$t}vR*>@y-xAbBII?065mzrQbNU7c;t z{q9u|k`!C%t2Rl!ZAshV>oqP)Xx#AKmrVTw3wu(RmzI;Sho@tBxSLTS zBz%yCdf+Y0cU8=f>27}8`tzv4o;e6KY_dWFi?G=*ys=%g_v1Bl`KWTP()gES%WS;do*Ts5Ocs-$I307DxK(K7;i8Fa+RVOZiw7QcywPf@wX-aDF&$e5 zkkl0?J+`7)S6EZ%ARbwXx1x7i&c;@G+|LIGAH6_jZMk@g$x29k?u)VMAERYX0hN%? zpMQfw`L3&#qdU1crU{sNXJ*d-0X&O2#%uqqGC(5#ez*XnrQItmMp$`L6>(3^%v73b zzd&j6u9X2O4LNslNxC;VI8Ww__xiP09NzZUwumuv1|G6iaislGQZwiU-ap01g;Yca zp&txja=_&jZBpt(udcuYDC`XQUIhe1TP_vFDOyBdp0&m)lH_^VdLE99nqTZ*2e5X+ zX7nGVYLWOS?!If%TFq5{_QI-}MfXe<_1m5>PJ{%Vx=y0R4j+QyJv_zda^o18d(8OL z0Ud0X70bH>)S%xC1~3df^OWAI2%G9$`|Pm0^JeC&AG^r^pgm&8+jmL1yT^)%Z7I5z z`hO>mE@!ge1Qw!R4&qEsCaf*BRrX*H?l0$jHe1oXrCIO$ zoou^timHH}lAw!L-CXfF`y{9XBq-jI(aqo9g+Sg(6E&!1cD9cBg?L%T2kDuaCAZ^sq7h;A~)_ zs`_puBysoA45yAoh(9{e=>eh4p@SC-8)Ox<$Ppcp35Qv7VeMJ!d<6xOAX{(jSkl9A zc0$fWP&IS*^7@E6>0ADnA9?dtySWT~e&N%YL1_c3b3mJV=gu9FbsrECnlZ+5|3<#W zK|g?mARjXmXUZS~E`_poJI-*h_d$)2yQ?eqIvtOCbe<`8B0bF`YbTV3q;4HjS~eVT zx|_B7x5SiYW#zs9%rpAat&*+u^ru!|&H1SZ348(ruSdEwN>#5f7ukdA>guaxwx;V} z8$bBG)Olqt6`+=n6^rin`ohIh_Mh!Hz7|I?O(EPC-B0K zaO?OQWY1yUkWbPa87IpZu_x@Ju7uQDxJ*<21M`5eTsITs zeuVi*wNuUNh6e9cV;$Ah1UiwUy2>6xbfO_Vj0n82HpF7~4ohv|`%jRz-2c}CR4-O~ zvx0=-lQ=AjgYErso+$Q`@xzBe-d*yt1kh(MnN}^9n9mnW@X6=urUTlw=oHVuEMCD^&`cQJ+ux#c~fYx*j z2@NPBQh|O|eKwpjg?_Fd*zf+VbQ-``KH!l@w*ksrs`m`XsYX#s%E8G=dDHcfl!#$$ zMs`}dVQNBga!Pi3Ox}1}&S+A`Wb)E+sXwSDPSL!yw6bUe0O=8Hk>wV^`|-yCy=eGO z!^O7jPSeHj`km><*E?I)vrT?GGk!bGK_@ef^#H6NY}dQYHeMW0*Sj)v+(zcq40+ zhAj&9W6Sn9?_-Le;uFW@$G|t;bJCT5BiAW8?zcz(f#kSkDq-P4+NqbWqY9g2BZ2Ho zN`Qi8)pK=CGS%r5T|!Sg$BCrP-XXpAr#oj#>!hs+sZ!J-M)w~Jz7@jgD|{jR4?ycL zV0h>Gl^DH%8^lDw!KVszuxjRJCcOzG5@XbSCM+7;!uP22aWuR<;k0u8D8PK-iIbQK zlOHcrhlqoGW?*wlN{Y#yyVnQ1Q|aP6dwYszH7onR@|PJssK5Zx9l~9!fbQCsM#AWG zUU(*k5_5Ie%F&}k&@{z1?+X4;fX8zW<$!=MS**-apgkV%$qL4AY5&R?Spy1CMH=1M zJ98GqXH^oW#pXtMHAmWpXkC5iu~q((m6e5IzNqU6TJXH(J#gNBMx0927D@RXAr-;D zAb9@MRb|%%PKCaM*5Cnm1>hMQ_OB4gDC?e0|Ve3Fx2eg=N2pk65()jCA0y*SMAF z$Nybl&$wjof(CCO!CW5U{9rm|v5SKj1h9s(!+9x-xqO3?_51KlnYO941CM`&U3J)` zqyT~_jGmBA_=EnbZ>1Dj(YCMc?6?v&f%xJ|xeb>*dqpw&a+)+P$fNhTcV{fwG=Jf`{T`O?mZY?|93hLYH~_qJV{k=+5BXV!BQwzxo`fM#cB2X3?X&K=hWms>b` zIFqr)X!Ga6JHM6>fWGhX$jIxR>7xANV)7?gx?$71LVLt2sCaSaxLwI4?$xX8KN*&f z5s$hlGpeWZax#4J@SE{lBmKAo*tUDVefr6mkgorobyEeNXfZ<5r$zqbY#uVkobbfp zgK98kNDlOk!S40d#S3a>A0K05x>6;B>{1jyWER73COjp$LZD={|6rtlK+B7jsKwD65P#--owl9yz^xKdzwycgG! zt(gDUgs_|y6VDL`y9F%}x+&(2-trRBoZZ;-1#$}Lx? z$~nYKh03V=v;_n1)P-xSq_TLoS#jn+G|G5M3neRvGTfFL1oXVBdv zDe(q<&rYFxQ3Jm_LvM6L z_r9*r)!=h?xI{_tNS})yK7Fp%x#)C1hfFU|gP-8-PIe8%M z9aqSCt(|yr&t#V2&y<{~=EdQoTcElEqSXKbCPS-UZx{@h6E8uY)>eQma(aO_enC6$H| zvQX8gu1~^*H0Nz#T)W{JnH>NZSK>QG;srNv*~AJ;CDh~v;GAg0L8k=U?t{D$1q&y z6q#x|K}s`YI!HOhK3188=GhFF}{NzCJSSe0&!nJV)YHz@Q6HMU%&o*@IgWV@W`( zQQh4?5Mhq~`Ga1SJvBwq#PRFD|LR|Uv_*LuXVVUibHOm0mwxi(1q(FtYGZ?v|B5x6 z&lx`b`#1XQbMz}saej+)@or`(g(a%R7lLlrF2SAR2q00?jOYN(;dk%8Cui3{Xak1V zUfWpVTIM%gsRgvjK^Kq4Dl7EjRFKO05r?a6{WD3S%8`t~2)0j}+_i|(zh?rpKy)otL#?fbpq*t4F%^~@Ex&8lYmkz~B-U4i|Q8tv7@ z8_sLB>DvSPE1{yBUz=__hI8|LE~}c0S(|)hkCE2Q@ci-!h1Lt-){C1~jg1L}ODLiaq`im;!jJe;){J{sNJ&Wn z?ShoFnq5LlNE zi@YAs5}F{DD8ET{=!jHN`s(6V<3v+Rv|id~|0Ry-%QsE`|C?^e3j+&@y8Sa z0m6#a;-Db9yXQ$K2GMGuI$LmX94OK`RwrW-M6xqPMHGWKvdPeTiJy*w7~g(LUdOY9 zSXZT42D99-XA_>@8J1C4|0b-3qyx~7L_H6Y9GcoE^kGCkLl;U6?q0a}z`YvXt%hAo zA*_v4AD|LM{?W&#aA5_sN>kwlzK-o#>9e%JN&H}Fus9i&A2g^pzU3}BizS7at)1*q zQE%f2)E6cr_}7a&iUJ!YH-9SgjJ~{Qkl_cu!Vk@%fX&n30lu{B_R;Tod8Ci;IW|s? zZ#jxC!Q`Q(rG?&cKS~nlcmEHg6dV*v46jqFggZDmJR4}ZVPj_-`z=N8Gz!jg)5}+HoQtX5X%^Oz!Q>TQ_ra z*Ff{p-;X0z7f#3!uv8J)-tnjQJ@O#i5PtV>&O~EX!$Shv@{c>ORC;9m zf&Bu-(Njl@XojAfSiqTRjlxS6%*PdMDo{|^;hf3mkwUPJj0;RI@syZuXfz4v)_f<^ zTZksK{^V^?rp1smy;Ju%Hto`{YBu`w)7$tjL)L09KK<^e^4QMW(D0>z3I6m>!n5O{ z$Ul>Lmok9P!=5N*mLt;=$nj`&5_Jm4hJUf9DE>=ZDw}oOY|O#|>H35va1MI?Bz?Z27n|EGCZ_ft=lp5#d@=SO68Rg5pC=)4CQOvFQT`vHsMj7%8!ag}&G7q4K@-HmxtA~kc3lqTn z**PCPsIY}@V9dF14{Q$%goY68rUtfy$6voP(%dPLwD$F>uJN$WLV19EL!>c0g8V3z=M^x1#^0RQMMc;I2c*Ln{3KbA(WUUp_@ zW&(>*rm@k_{m!08fearNeg?7wEnw&x!KyDm+cW8dA5ALVrHvya_4qP|zlZKW60GOB zySn~d^a(w=vOD=;K+{maxU0wY;6fsu!7D)Z4rPL05 z+}x^)by!G}zy10JME7$B%l`MLPLIMqe@>xXIfznN5W%Y=@sMJuXD9iGKdAoTDZ4p1 z4o0SP2?629{#Dv0-|G9>-L8;}vh*lqG3e<4&69J*K5%2i?w&K8V9r-qg6WXK13Bmv zKI9p2CtCz)D`i8@hNou<5l0?id(iOS#(rXphTbv?;Fq+^0V_R8d~%MPX4;T&fMKIaUZJ=_yVoexzxfe?V>}zd7u4 zko%20ml>E65Qi8@+kMNyCy{}DG2=l$;DenoB;CfRB+`|SQm3SCJO5@lf29dSFvvj# zm&!{@MJIclx{panWsGGGvD=noSVV;(b7%nB zGbm#577n|Tc-lK$t{JzM`0K$H!JgP|Z2|<_(t_Vw?ps>G72Pu50xI_ZCMFi9rAMXt zg@w^3vonY`%d2MlutiQ%wotpB!tUC5BK(Z3-=)>1bE0~wBf4U-+XSAN`p^hK-xO(! zA_2stQvdHVvtL^|swYV^7##ZN zvAkkpx8KXlh%tVYmxIrJo7e*L6k7OLMW7P*=T_=_>G>xGErut3$NksVE@z7bL zRt~@00gFS~dq=S3(%xT|^WE96@NMor& zuHN4Pz%-;xNg3GJ19zsZ2Xqd7rSd820*xJ#I}2Qif9QaSzUSlz_;SC7&J&HN+|P6S zhe1IVqdIm$TOa((HNGepKl=G2-)K+ueFj?CKV+7_BV`g~l6<0OfjE+0m|}W55v(K( z!ZJI0$Ux;&**hTJk68LI*J9_dZ^({l(N5kh^?${3T~2-mC`te(rhSGVzd7_p{ab0{IzG6XeJ1|S&d!gG*|so~ z+}XbQUMgWx&rI@904O#+YHA)iMJd#N+8cU&t@oTMezRQnf8xjLbzSh73?IMJ>)E>3 z#?8fUybakb9B_I1;4qTA6weH;n;s@&UV@Jb9mIFR<^Fq*3q;AV!#m8v*V_%9IQIa3 z?46J*3j!|M!e_)AK7q~pL5w86-x7XZ2*1{YpXo_oE)hOFIlu)x>mULl;ot4%QsSbc zrD*`uTj~2gO=Y9=ecywvv+Kx6>``wE$Z@3r;;F?w;Ms8!5JkAxHKep7H)r&vvcm&j zh|Q;5V+T$pj1bbZ=zQDvTkiht_w2{$tB8Hu&xHTlsDTt+8HjTcKG4foToGPGBFnf? zdU-Du#lwWQIK23xP@oa}s1ZUfy@m58r!5)(`)|lEOut~O^S^(>Aqm}(+=J}zcQTV; zf}WC;1jIJU-~rf>J$#&^r=z2zt1J6lAJn4S+S+g0IsDTAWux8Tlj4Q9i80ac(-z1! z%aFXEDL+-T-zkCjO>lL2aWQm+4~xKE43!qcW$qFF*V$+T$O|Oux1b;FsHQ*nPzxZx z5M$UG9*{)1(3`q2a$=rrhOMZSw!S0gceok!v6M0a%;c;29iOmaq7;SeGV@TX2SnmC zD^P!~e(%}+GhsVZ1pNI9g6*ZD08z;zlX-fc%0Q){*D>^6?%OjN4!KCFX;hzPBSPh8 zXz3hO1Yge}M^L{&z}P}~+uVbuQb{E-2{h>_%^jhHDvXO@BLIw-U$wP0o~HLE614YU zv%(r>l$0b4pf_l15KB4>3yWJ{E5C#ko4|dvGhlc#H>WLt+MpZ<2}sMh;GN3{r=3ht&}vtS7_KVm;L3lUrRF8>_6YK0Um?#tp~!6S;@qTklAhRo`!P z2M%SHErV5K0eQE83@ZnQwB&!yLorhmPRPEIf&I+;)j#RhT~Sf$HOi;{BhNf9NWZV3 zPjlz$8L0td3^*t$Q&LJ>7$O1|O-xSiWKQLg80AMMCX`^U@L#BMjW1SY3G_Ux&_n51 z{9dYhn)1WXFm%(`qaM{ddh`t^iEcG>YDZ6Vy|`^X>vfC=PCsNHGp>b?*IGcRn#7;iU9YI$d~@Haokuwbj?h zx$riA^9Q^GYzfnU=Io~DN|TBb;GLeI0pyXSB);wfk$+xEWo`L+54hRycs1L>bno8f zI_W$)pSo8*{Zw+g2s59XV~A96G7zF3NY6zY&>!qS7)G{nQvBY6+rP7~#5Lpyo~6w8 zKf|=*$PJu{q`5?uE&c*DBZ-{KT_R0x=3>|OAI4>v@?TAR^Gdx+`xl)X?1b0WKvQ2> zYX60GReMCcbc6mg-o$~{t0AX=lk|n8KFcv1GRK-|@+V(Rb#ak%I#2iRku$zkIlq1i zzja>-kMU__U(N~-ct$9?oK-mC(vaH-yvp3AKQn`m@Gydv2A|E%%wSlwrFv(*6QT+J z{VZ5UPDpN02n(Aiv0X!=ic5&wzV}D}s+6Do-5jD#qfm(ZhK!p`ACLfi_nNKlCNAJ6 zucyS{y&D~3q6cP_WY;f`C+~@;2G;z^HuGGRh8eV8b&;w|;kR6CYo>UfzP! zJW<{PF-~3qkzL@tl$1@ol6JN`%93V;FJ{~lVQd7^#b{n&++{>uKq0+c(v`|WBG^)XBv3cyv}Jwju~4$&WdAVt!Opv=Upy}`!DKEgh#bg9IS#OA-nj^qiC zC83HxXJ=v2r^A}Zp`xa~T9g&OqBXbslb@g8)x|Qo`^F|K89RkZTR}Q5DG9BQ@aI0- za;J;gO0f$sA0MIZhs8tBC-}K$BPAXQ=_x?xoRXs1d~ZH)5_HF$t@*Td${0SDxD0qz zhdqb4cy&G1dNvPBByEJHkqu_*?Z=NF`}>u;PQ!1J0Nu&ePpt>T@FNp2AVMju9sr-Q zt3x5;#6=Z`7(<28KE9B;zR>b2_#hRBbR&@AbU|{8Uos>cO&t#fdo>#qW{Ku@$~MI) zNFJ>U1}vn#v71ujc|nI@p^k>GsJ+(bK?W;7s&Np=Vi*&9vPYUj7$^|p99YBt1vcZ@ zQD4<94MTqV`_!C}ANvtrSWplO|J^Lvqs!a_xMS?yPIlwHnG4LqdGMK#Q1kSy=A_h{ z>%)y!{9~hrRhgK+>uaBr_p)M{k{E{_UOyy9Ov9@s-#0U3)uw-?j&Oax@m3bg)*gK9 zY2X~z#yd4n6atHsy32QF((T#AdRNF`LKUrAHp1KM5zIlpSpXxs>V084| z%tp_1?nj&_q*BouXB24JBt=-;?ss-IPeNwDYDo{fqq+RkyW=pChGm6_5TgB04(q z)7kO4Q~+>Jt@Hp9vxT|E8wi~brMo2KS5MA7dSdF?xv3AQo7!OPK&YviYB*i0=XP=o z3slxcIL4fWV!o^ncwIpJs**F`uj|PsO1e%vsCtGdFRuV+yzs@cLi|%(XoN4i#U;d(Nc#xj z)VhQ7Qo>izXnL*dKZJCMb9hh!;3x$J@eaZLvAd6~cBOJ0-unx2K%EgsM@Kis&Cz<4 z15Mb5{)yGS<`WWnoJ`K?)gm39`el?j>?y>UIj>*d+y_a@&v)-fcfNL zr37?jx^{>tVLQfew6UETO#Ro^z9;7Z22w&`*K&^nl8d{T7$T7v%E!n2bqU7{6^|7b zKM5tB8HGgZe7rRL&mb_R1F>|ly`P|3koorQcou!aRr^R3;J(@mw_WBLXnyx=xDTi} z?7)_xl!3!r70cH7A!oc#TN#HTxYCfym0dhCgLReh&mS+k-fPlcK{}%3{RCu(e{5ze z`>DX%XhfsF9CP493{{L8WCj>T+j8Ns`>x6Zpp&_rq4Fyj8Y;Yr#OK+uXo<%~&OUBR zx`#7&1~Xf{Qoe`ZolQ@zwwA8+mm|G*r0=b2zPSbmUu8Q!qZ<+j7vLiWBN=PAw{b9| z^0d-=UMyJ>FJ6R{Y7p9z^;`K0*k3!#42;rJp!3>e405iu_;vW*`IpW1tWX=4v3n?X z$G`KkvQJYI9cf0k=eA2a-{u`eczLLvqo`K7xfR7n#||v-h2*(3uaHKMI$K&=8c{g0 zV+HCa`eT0p7cxVk3#_4Yta83CPflj-Qo#ygngV;oz(DsXu{(gp?=t6Y`LtaPj`7o% z>kYU_VhVp+g5-UQi(#R$RZnle-jMpw%e2+8oP! zpg?|f#$4JkrnV{o-HiWXYM=l9%}FmEOn4}CVd;FivAVuaNk$fyK@yT(&q}_&wvpGO zr(=Ytiol#l-a6e^UZJDUWPxRyY=4_H`Ac%<>Ecw`_ubuHhbdO9ENvYHH&?gJw?;9v z;z0|u%t|q0PoIAKR`8p(tB0KhwjUc2jfdN+$msm$;jM;|EpSDG_6r& zJ^<$CSG|^ksV7n~NG0>u(#A$0T}YG$+{FSND3L5$wZVHGclX5_d$P<|2iamr1UJ{` zj3}P+vi6rIC```w?1l(kc1|&>%xhUuN2AsNNuoj3XNmBW^`V{Va+B78I}H6`$Axdl z;(UYQ;lU*-)4Sr?rZdfl&RiUSt;Ul)M;9r5L;+^>6b!39scn$-O_(L=A9s9(oCQYF{l5Sf2C&Th>C>IF9sek*sMy3u(fm-zq^rUE7l0B$=F1nX|5uGdajUe~w;{n{-tU{;bM5cdrb4 zLeYxj2{VwO#Fc!>$x7tw;{#6Ozo;j%a(U5DqkVi;KE35i?)R~BO#^UcU`#e>Fx@@7 z4q!q49twQzQ5^^!McuhM1C8YzOez{0lsA3+44ZTn=W&F1uz3FNR|gdxIxoQgmj5VU z;;awsy9bAd<$5s6kZcnj%S=MIT{!A2z6zf;&4kEX(iZtD58?wsO^}_I1%$|9XaDpZ zOzn0p?URs~z1odr8(I+U#ax3QNj8v-gB^~KV@8S1B| zXA7mNNh$@w}AO6 zT<#g-*)*=IR(x*qlIDXVQNVgU4igM^|M6oKE)FhkZqvLAfkuDd(zaCO1q$Ea2z6Dp z*eEO<6d!33Uf!o{82tB}V6fQLrIx~nd>9q|tKdJS3<(RnKTc_F^1E_Xu*|PJjP(=5 zvsARUwz4W{4o0=HH}mH+ZqP9_jFP&iH$F}|`j}xvc8rS1ds+GikgSK&#C5pPF*j^# z<~~ooMj{~j99U|6-)8bQGtfLDaGg>x2(@>KH%5>GO(?Rt8SMlii=Q5eii?v>%hUnC zfGv`!k`PZ?{YmI0);BW~70g%~e2!BkXE-|=&E)suxSY`F$FOZFi{04Bm`_!%moRlq z3r+QhX_SMJk%OEcK&P8Odv_4|>C^N2Y|qW#U&mrtg7)41w&-UPR!da6xLmTNd2b&D z3p21@tt>B(2DRx!z20V%1yWmm^-viLxlz+l1z64j<&ob0L4~1=2?wiEB9@uR=F|rC8}7~eB6ZB4Bo~2 zMGm4eiGY9y5?Y?suFPvCS;8RL$D-m^6WZl;b+(lzmwXRe*k0nWZ&~K z?OsfBgemQV@EP%SYy|Z6>(@No-0D)MR_MJxtCON4B4|LHT{Zjc$rJoMQ7I_`o|`t{ zhSk(mQRyqp4)Cd%X*&*CjU9(ys>L39Pa`D-CdHpQ($J*Qf-^mh;Z-kX46%vQzi<@VdvQy&!$K!dA=Vy zfk&91O{Vc}Ck0&7peLU4nI;HbRxE8Q7DKMjLzd`=-U@{VCkZOawPH`VA~^CZ8E}GN zepJkK>n&!1jWDcz@yoEjoz5TgWyw}wkN9p%U`>=SQAcuiyUWp*9dpmkPJ?Y^S&(jfK9dhs2m!jo^uI_gQzO%mHKu;)H zlE<6Mnh)#Tv;A5RNSnYP9Q>o-hhcS$`2XZ)(EXhBnSuiFMkS>jOsEI zG7~ew={IuG@jEW{^tAf)@yC{9Yh5nrN%jcd z2cu{96S2#J?M5#kci|UQ;!x7`nCNJh!&WMN*aye1eYp&dOqn@<4#`8=<{+a@4ldO} zia0 zWa2!w+ALbU<1rV zjvyRdyq8F=tDbVTY$E~zlX@e964U1<+23pR#-<;kl>m+~CT4A|fIpB{IB?W%M%q`{msBT=#YN z_4U)@!KhD9w>Bcjx1-&|r-FZD0p~EV(koQ5f2)6QW3zd1P^-^VPWH&_hsW#`7JQpT zYVRuBuzzCYI>xa#md00uCRp>${N1ctqsf=tjt`OeM0R82UiM1f68Zk%7XpIm*{T@+ zohgaOJ3EUqBI!E{_<`*tStMr7*Fi9>o>wn}&={3}R+uKCeI0RfsWd(;s!Yo{oGvr{rzgHV5SQ~A-D(n4`$uwvf;Nq z@LLAt%H>e>a_;hSM=li-j=Uh0x?Ef>PK=4EU3PO76ciGwBFS@{x3sfZr0VNcexarY zPIXmPbyXkzmkFs!c*Ds2)zyTAgv+k3%MgWpoZf`cf4F%l-YT}XFI|70T%APN$nVeN zH$Pfm+EV%B&w}(7pJaIBKNG+?Ar-d__a^j)HW|YXb|!3u-^|V$&(D)NGvmX$hrV9o zcj8SvBEN&NiBSB(;ckXsO6Ci6;oUY~-*EP`=bG%QUlA%SP4dW~Vku{ z)t;d*VR9TWk<}%$4lddB(b6(CU98!e#`5bfq8TzbFbL&ea z+Z;hRI{tz=l9Vz>`V#YE{~zwg-aQMZGk8Sw84rg%{4(BVqmdF6y3G-X5x!;@`i7>K ztHDK>NtLlNfOQlZ%D9o=B*2pu^NG0>uNqo|)MhpT_48>krofnhz}VO-6YRw4(+yze ztpE`T)zuFwl|u+u5FvezWFQThc(SRxy89s5Tjw%VsF4j#V0<@Ze98vKEdq@3Gg!;u zo6IfZMJhgGcC>4#YN)6TDKCsI$M&O;AHVUXKlsI74;$XISX(Pl4`8Dt58>7V%`A7g ziva4KfY3-g&TsQB6BmJ+-8{XBKuTp4ufhl!;E&UGA*O+TrAKRnkq~~@uJ}%thWf1T z1H>L#`lA@5i9sErUS3{6eJEM1Gxr}i>XFnA)LLG{!=DLDjtyc9`J9CQNA=yiTAh!r zNoJOU(yrp_EeV9*(2BI(3K+^X3hAh*sOV{!+N8U#yS#n5_V`@4B#3Y3GpPE*?*ZCE zJZ3kYom<_#_V5v)u)ScLNKmc@baeC@F;xIkh3CL^HaAMd-P_8ytl=A{5^M_ zbF+j2^O=8kc3O7tLkT&zS!nCZkto3FJAt9j?#g)^+!Amr?#pu}B z*ytFPx1K*SDu&AV17=1)x%(R%$CZe%h)8X< zFgU@o_JlQqGUNpN#SH25vM@#N3x=WqL=tB?2W9+ih2y>8`~u>WF`W4TJ ziGG}kKIDTmB2=*ICu|87%hmklOLOq%`tU&RB~yrB-0cRB%u&&PPgl2rO5pM`y@FCt z_wV0b-L5n6!Qf3Bs;VMPLVbh>G5~ysuToDqgTMRQ$I_Hq(I8tw&5?)*<Ld_f42X%uNwyyZ8U-AUv;LgrZ^O!Q!oXZ;BKMQz*ffaK6((Hs zR_I1UMSDufKuLN-WJfp@5K@oIOyq-9P9l7S?V;&_fT8^@XyC@+CVDO7u!Vi7>Dpa! zx4IAkg)SSTqCg`S?_jgoxXr$lTmGL5u?bqdg)Y~J(!2KLJAklG=`djV^mz`R5FgVO z<6c{Y?=!#JmzXDk8E~-i+WeWw103M$YGm@x%w0o)EcgiaYUTBo zh*iu3B}I}JC(2g7Hh;h`GM$w_qYJQ#{syq%mRBffEZDwU9$no7i=X)0fb5@L}< zf{`qw{~QquCMd#+e+QIBDiIC@oTjG`adB^>Om1f8;ObDB?cWOM^`@piJ{Z?nalXI_ zvjl}c&Y^(^$VxrAeibEMcgta@1!iFSXusf}898`(ER!RG{I&%-)^!lQ)G+QgF57aAG>dI|Vczd(<4db+%Wn!3ud7^#ggXGz<5gyN$)& zZ#59V8k;E9Snsh~K4Fw$)|H6+mSganhT%{s$G;lsxhV4ii+0Y zF8gqTAQ&GX1CRovs`~P!AWhup7FuIgQU)z0gQmAb*HEvHl2Q+XHO_T8?I_ zSA>ZN>3uXWCnpammMGx0z9(TL z>esRxs?@OK1kt*vlx3hOkbTv$36qcO2hM>^*JQUCV)`7sup7BGjAv$XSj5MRA~5u> zjgeW51HtlT`iQ$okMRC0j-{vjRUn{)^3Wn z`z8Dc@%ye-q^+%OYPV{CdY0^KYF43cnxr@xaqO(v2u*McMZkzWiNC)ONlP;~lbP`y z#Gnkp=%XeT4*Uz|%VfvwT9@y1k+;vb(IL2Ayoq}j*cct;t}!rfmbgNSB3d)LYC4gu z6i7+?T`a>>feFAar~8PqybU=*BQnbQoPw=j$+?nMhv@AJDSd0g6uPU)*9<7@AvPAPOr^TPgd4vWhZtQmv0X{P9tpH{Q|sf%=`wyMK-=n zvg{=$2Aqne_V%f1m!a#QUT2{hU^Iu6S65d9OyQtuh_K_6_$UNg@7&W@sB%cuB}Q${^*3 zrJ$u^i>-ARfd^{Hs(94FKIlI_{kx?-`J3=AKcT9h_<8}B zeBF$M*ux1T_rR*3Avr)#K=5vNZ)E1bY!7#!EPJ}KyX(H60rKi5>fMHUc{lis>YR_3 z3kFj79*oQ51*MLTwT=sHp(cW>7fc<+!Nl~~t|a*{Bk1Bpl#UsOp=%?3A+KK0rJKD6pc50izhTq~0VJmZV??*xrjlw~Z6|qmzZ7`0>yKIrDM1%;w2x!>m3LzF2-lA5R z{dD_HkC*SIT#!>#@72NI77KEey3Wh{?=F5ERlhAAm$-?7iJVc@OTwq;ilYdN&u%Ub zl;&eu#-#VDLk?2epJjZ+0u}1mn1iNb&p^TLvR5fR5BC`6b0sAu$%v1@=ccZ@3JD6) zAB%{Jjfz?rBgGQVPW{Ai4~;+Wcm#VgpRr5(4I?RDr5E{qP`y-2%bLv=CB7WOB<)3F zuBK_@H#3(Dj%D+t6LDughOfZcX6)$5OV;EHRC!fZz5fwSQ0As1P6HJtCEozpO8WWR z;H?wazmR&AO*sTEwAe%k4F-vz@94+DAP>1JFaA*sOkPD!kYv69E^oAjsj>M$)6BbE zRo}Srcf{~_>`OPwLYd0&N;)&im)A)fl%4lrm6oR{)nPfpWQSz<1J$mUuhMtIO3`2& zn3jU2*dX;Cm^*M-aJyU+j zhI}bExA~mhu@(34<|@#R0^YgV`#83iu}t+&fEfUYqs?bk29TrX*1VIU2Z0y;u~ zkg`G-fcObKk$g@aU?~xS>SF1RMntGC*hS9ZGJqc(48o=O#fo+g^s0_qfws-Anx^0- z=Rx8Hs9gIkfpUS4E)$ls3GPo|uCTJ;;e`Q+gvt)U6ZB_tQrXVlKI>T}j+uaD%y!S8 zKf19Dz?G&a8DMm>s`6rp^fSBHF`6Tk_&yI!OG`gOs%PK(m^)`-wN6vE30a>D^jo)d>bd-4XcK_qFzeIG{L2VqW-#jc!J!{2IFQ`nI;6} zv-rjN5tu}tgY)$G_^8JGFTw|vk$pMaHVhxC*LkP*1nsK+IR zs3TfD$6=;~`c^nL(pe1UfNxP9o|`Xeaiykg8gfgEr~DXFw9wg*mrfx6eFbyOIN|P7 zRMZP)Wk?1;n@CtuNWvw|T83$LWc__5H8t#91ym*)Bn3pKh>7v>mkEi~d_)`M8V~D< zs$7+fD$ai~ytLccEPRZTlAkUv-sM>_e4~+w&<_#fY#s^0sQRgYn3b;fQxa@Nl4I$0 zb#!vCdCeE!Q7c{Fc)e?t8WeeQ5yco%amT^Le^ik{D+ZmchnPS+pjH_=h&jy7wTF;R zJ?YQNEWI~*jf7j8OqVOFwq=V~?NSdxp*ZhyoAa9U@-j2R03W3(-;ueFk}fmTnG9r* z)E$nb-{2YB z1^`g-vWGxIbfqF1+iZk~M})9CgkyVEkceYOQolGwe)41RG6GWh!xWsy06u?Rac#LS z+wx36JTMyH>RtebB1@2?*m>yh{OHL;W(7!OtT@Vin>kL;X{S6h{x~_eg9Z3yB*z_# z$y}sa;B#~TfvQHE*v7^oNts2Hg+%#Q5@_y-%D$IcJVDGEoVUTFudlhP=_ws)|rq1x)eb{9Yz`y7zPW~r|$Zmhsh{7;W7-dAmV|Fg8Vls zD}+QQ34588q~cLOGNd9ZBD#)}SmQGW)Dt`_K-AF_L)W;xy}iD_zqf+QjpeK2A~KjN z))Uh$?n0A+$0%g+tWwj%W%ayoSo>2p$#KPXQXu7j+S@t7P>j#>b5crQkID=u^E8`e z6hsv^H24E@&*h^vVuGm1l^roNf2L+_4rzbFqirjOV~_M=?o48Jx7IoyeMfywMoa6r zasEE_!!jBk0YMA7pBf$|?1fY#K3Tggq?b>9gIAryQT|!NdwZML8%}cqaS*DqG8!)SJMEt%nRkyM_>3>{qTarmX^%e(4XLto5wigW~T+iB3V6#DE8KEx=u0XJh=Pl828keu^$Db!gpc zK(Js#8zm=1^ax$MVh9bcvR@8>Y!ww1AjfF7>Rp%Usec6i=m1z}laqD5BqMGr3AZlW ztq-vF3k#22K~mnl4NK@UNVMsNj2{n1t)nMmC*!J{3)5_T0>1LW_%u<2X>n0$QP2ta zO@jF<2ZF+m+65{iLVUu`EdYa|DSMqa2Eoi3v-xA^ku5hi@S6qX-sDVAkIrDRntZdI zo$0MB+1cKHMDyiKdfEa=(;lD0*;KVRGz6!cni}Xk%3ClO{a~%Bi3Of^@#O=MY=>Cs zs2?5}7+K>9NJHSe2`ubpI6NB}?C&3*m0eFnd7L;nsE!r+t?*SAOn{RUU`-hXh*idB z^c6R8Czt~0y^;5z%@nuyj?N$hdSUFP&~Y}{bLm*?2nCgqNsH@R zNqYLupVEDLdT`$}Ha3PW{5D}QG2wG^YFYx95IC2%w)U4?{tV%dNM0&+F`OQscVlje z`>e_sp&HT4!R?Ap&Q3a&oVD%`gNr$KV$jk4 zH8E<)!KfiDXdaKu1(X98PiJj?yuEKOiQ{|51Xl4^ARPIks396YZO}giS(9S|0$tWg=k>itUI96BHsQF~yzW zwB{w!3}kUjK>g;Bp>T*IU>A7aBO8w%xboap^);`Yu?vjee4DL}LYSG~!Sp#gDNj)e zQ-Z8&EQ%&#W7QZU19GegeN4SbZ1~X9iHu2FaDsb-{~P?dh5Ut^ZbedkhmDzCsD0!{XIMr$tx2_FR+r@g(sMCDpUn#4ue z!8BF;1WS7!e75p z<`npUT7XXdH)by-o2W-@EN`EkDCSYIsPwmP4l5Nv!ez`Acy@7%n4XbTzk{(04S%|x zxtw{(Y#SX#1pdCL*l9a%A9z(f^8(y#>bTYa=;dh_Ps(6$h&|O|O9Xs`C+`YnB_KcC z`C9P(ahTHN*m8iT0_2gGH8%s5%9y^0D3Ci$0ZJ#X!P{5zzf72l%Sy}POz}E;)6aZ# zbk8mYHbwp~HW@U@86-=%K>8sZj|f6WL9ymits!g181c;2)$Qc?M0UHU4GQ8l)6&x3 zq-{}Ca~2n?D8FE1XRY`yqwZkD1Az)uR@!JcKBA!b5S!dg9Q^X0meIkPpE>v4_i9<$ zNEMZ`_wRwR4D3Y2Jg%#O%&WQiZcFH$M#eMm<*rBzkXuqyRVDFZcc#)pX|@&Iwxk38 z_xYGvI*AWp`!nZyJXs8qFaHC3o(xHVtb?C}H7zCvFugt8U30_1M(3S)!s7QlW)brN zu-NU<(H?RZx@`=LOJuu!kn-H8^&cJUi`=tzavIUbf^cL=xvigq0zo6Y8->cby?yC4 zO~@-qWjIq}V|O{|$zomV2KbDFNQ=W@q|j6EZL$wy;N5$1@9oJ*Qg&yBr@|j3Jg$ZP zr{?FgzOq(0`1;<_TlK(cqxJsf!e6N&bZ$7_n$v!#{~nad*cOadOwWn{jPq3 zWi$)aMc^=Q@w*Zv@IGS7s&6m`b|*Jaw??0{?LVb@V8r#d+{g@RR1Ywr{UQww$D(DO zL!ag?ah)wX|8;hvY9xczhmRou99nHCwaYd3(?8yJy4{AxDjD|X9ba7Z0GI{}edUiz4M<0y0h-nmnZRrtJn(Hj-KjBx z3COk+5YF{*#70wjiNE_lz_h6;#4!m3CUKAf{7LB_!FZ)ijnY4X*KfcEDVZzuCAJWu zh%NsF^byBO4SZM^+^PTl1NICc$oxAVR1Np{mzTG&@JF>jmrq0Xk*auj;1}J24#WVM zb*T-E9zRT#jf^rhCF@vOK?a*L#;RNK@NE!^-z&5ADrJw1LbR7)gCHab7AkLB=`^l8 za2Xfd+JbTkJOI}yc4TCw%TY9xAET)4GId4_GQ36XEzPxSEQaO0>7?&fCzi-SM|x6J zQUW-yINxyb*Boxmn3yts%}+C^%#@PE+9fz02wC9-|G%>(b9Dq*S7v5X0Vvq6hO7?0 zV2-Mv`@Gu7jummj=y+;kZ2XG{^&Im$kd7M5B`*iPIp~%Li>fb@lBx#fiW-+KkxG~! z*zXxp?3NEMyTqKX8R+?`wC)*SU`>(1QqE4#QNnP3`fO@cd%EjC()jAcot*nBCy(@w z^E+-%RaK(CBSg;@@QWQBzLz`2O-@P0D}xaF(h_<-o!75rSn?jI{JEfsgoQ?jjt-u1 zXL3d~Ev93NrQNSe?1Zh9P0~bk2vBtv+v1U6^|yj)`{gBC^;yqvcF0I^uZElE!p^2mzSBW zQI(0{OJ-kBNLpq9KCGXmXc_f0b{DDupE>g$KbRX2N1+4bg~iHB(OvLuk10PM6&@-E z>PI0woSZS3JYu!gXny*?|J0gDcd_G;@85$>IOO{jNJpET1d423on@rPa}Z+&u+-13 ztZZ#LIfTJn6)+-Vrnl{$fvpPoBYs`KsB3s2{YwP@6&2-+wLQ1A%;``0JdEO>v`*zi z^K=cO!p_FR#`?Rb$3mjcUuz702zv^o=mei$y10Nl26(}_xEvLs=iF+_ayc~wZ{aHu zQGPfuj!^Do6Xw}ZCADpn<&YZC$DmNFQRxYOTBg62@5`3&V_1f;p~xP6 z{@(`=AD6CE)f{0K35oc7qhzYcYD zK^w;YQSg0@XLW5&ZEbZmks2(Iz`>T0tsR8gH8g;oAcipRWTd4CLRcYP#^c3{C+rho zPyIwQ3+CT*>weC`$H~db{Z1|jXgjsAY9br6?E{i!${P2;(UK9&lebPS-5F3a#dK;j*Rg5;JvfP5jU9*FL_fweVuZq_$Rns z?BK#lb^{6%ppX%~PE7#va=gRmR%)<5wHacy{(*ij5UQ;3hIjN&)fbyLw&>axj4MO+ zN5yRYn;TwF%2Eq^w*EbYOX?cFW?Qb{E|^L2-6dB>OoX}aB+!5KR7CD4exY%m9Yywo zNZc^VJmOr@PwH0~Qv}Gyok!cUA=5KxTw~upzdj!r{X4FHv$Bz!86PF2_{_ob)f3^# zX;FkzcVw_tC2`ffhaN8dN>N84zA_b46(Yg#{= z2^ik*iSt~sSh*B4*TCV4EXtPqU}wYb+h8txkWG$P3-0s38Wbgc7muDd(psR*%mqQ8 z4>YG9GK>fi8eosUICOU-ef8eaQ3`%fn_CCAJbw4L^`>B~{p%MnOyc0;L@TZkvWXyC zbtZeRz>8PfzajF>|M)@gb-e`&5~=&k-w({nt-@CSqh(eatT8(1v{^i*T!aC&P!uk^ zTa{bV2>UGSwhc@U!};!*0OfOKT3Tl2moJLEfmHCDGaqm%>2Dx@>~8M|9XUFh@dvo) zfx)or%|8f}ef2My!-vryC|V?$S3oHyy9q^=k&IiiLmA^EuoQ!c1ws*qsH_Aa{LOUn z2}nxpJw* zsZ)dUXa;I(3LDAImO1DyhoqVZrFP>D4YTn4h-$qH(SGJ}r{zTICLQ4qMiF zxO?7m<3N{y^jtUW1VXk*i!5lq%^%R9Fd7W?L_FA`rIvM2rrzha{9ad+IoOz(!kjQV zlUI*!bDrE}lsdp3QZn7s!5z?@HDV>DPEkNn97+;7oQsDBVd+DwKVLW8U+XUQEaaMm z#DS)r(AI;@gsJf=8i9ecr!?33Ny1` zg@sO_TGhIOtqMGuxqiXe;gYZLbpe6zQU)iiIh`mMPJL+f=Q($q66`kBJ=SZSpDbtw zJIIN3_o#0?t2uy8!U4;0sg#VI!tIRdOFOfBIUJqK)E`adEq|(~sq;RqJoc!+K^Xj! zF<`FOV3JZ%;L;XlJxtL|HT_|0ZH=EtLhX?Mdu~4u#D#=_2UJ;Fdf*pu@jqVE$u^7>KLF6H@wGja*;rX<>IEH2uA~xhqpdzL$)WSjS4or|5&tBqG6MEn@cx$aDpn2Nb(lRnSiUaF}r@HCX z*{PlpQg%`wd3d@UH|y|P%~nmzl@vSyTH>Dkx*at=C&gH?at!Tnt33557_J3`O%BlTG)Xpl-&9wv5k(z*#?LRe1!uP4RNktv zjfD34cSim!XwU738X6i_R@W5>$$LbYa|Re$6OHnojmug26zhE9f6FmCd`G43su9I6 z4*yxo<`TaZhD|LN1wnnJP9$VFx`v&Q4E1wXoo}GI#@2bpd68EQCdK z%?TPhIuP+t(1bb|PG%pR{c413TuNycFi`7FK2;+Psv8Xdt9bNBNMbN&okNHzw30}G ziN8>rpBo$QqLOm&z;!cfb(O8Ht&O)x^46_GR}^;4d*9sNJ}*6;7wAq9JA)c%>FIy1 z#E2gaKK<(uaDhbb5b*IfHZ}l$q=nV!d`rG&20srEXS*luPSnitV*G1a^jri3!AELlmb8uKgb)1a;LBSnq1FoLl-!4#^JAf^?%>b#w~fIVDu8 zM?Sx1b@W6F69$+O?T*A7o>~UC%)%9wd&7`Lwy$terGh!aggx%=fq{LgpOm{0Tq=FpuoK{cIg=K2EYQ`SAwu`` zM{>B4>S=}9*{ZysFD1(*$g^;qBA>-|^&kKdZ>kJ@cQn%6-F+CqB#@+cwYM*G+x(uI zI={O-02zq_`jrb)Q(GWt0`>zAS{#CA5JvjN`atzzh=ZyLCwbZo;wG&ZXPu9cTxw66 zs6}1kMPa_>F;}z<+?a~>>X`WOBn~E;un%^wt^;PGkaRcb@pEi|gbj2L_R@Th2ODMQ z+F9`9p%tUsVx9mw2iUCn`SL$zLFN#Ygs)t=f<+Hewi2^Tsu4=HJOP0bOmyR0bzutI z#22ij_G7QkfVN|0S;S{b@o#Z%6V;c za7UhCfj0t6Hn2E=6=V@{uD!XsT~5{2<;y1*Sb7l$6O`iOB`Q$@kjePFaNQRp_>Hl_ zy|Lcn@)vP^1A`J?YKK$FeMLnfAt4X|0hx+E3kXX?mJ+b8+U6RLMk=?`@m!_iB)q(e zF%^R#9-!7204M~E3zEK|!tho1?=XykwVt7sqhD%AjtsvCOt!DF-(tVU$`znD{s={o zGnEs(PpiP}{aHI@U>WdCwAa2KFq|Np0jw8Sw3j#^pCwE&7cVB2lrVnw?j-9Q7*MgW zjP^~qLxHh;Cm$Xgi#wc87^zeS`W%$E>FVk#RB&?InVK^8^u!Td_mm6?$k={jCyuz# z7`8Qv3R_>&5hwQFU9+SMrq63bA1cx1mU)8YCV^H zGfpvV7^y)9SrkVu>gwrrX?=0b$>dHtc$B@^VFk90I)JQ;Oz~TDhqO!6w z#K$j_XMOv|Qu*pGf$`jV0Vc*@WeN9o9`%-77vy@warW#^Ej5SF_x!}fiJ|`Ul9>L} z{W;lL*_oI8Q8~R6l}|TZVV;Ce434$EeE=`vU~`? zOLxMoQ2U*H7Ze|xWsiQ4{fKvVOEyJ)2#q#)`gAu2jhh2l`{Un6h!=sMNNQA=szg{G zk_w?JDZye6wNO*Y$tcWhY)s}5GI+9W=s28Wdmbe#%tA}=%Xufc4}Ys=QjLF%=qScr zHaJkOMi;ROGEkR^Z#-CS71Ipx{u&a{AD1-}t~&3N=B{Y-KxSqhaQO5>=dQ{zpoalc!;##r7l+ zc982A5cowk==u#0y%wecy%uL-ekFKuug$~}?m@G$ZyFPQFB}Wfx4gW(?x*AfR{ft0 zb{-;w4w)TQg-BReDOBTJ{s$qKmlobBr!*3z7gd~^&U}}4NHb{@scl^rA$bhm8 z_bec&n%JDwWd@STNFo-!Ue0HL+#V=ho5%oRFOPa>Y9zkRz-;FTz|->a*&U+Qbw&>dC91kORU>T&aXPH+Q@?3<38 zh!2M0*mZdGomUoXHM-t3tY0|$mWAGR@KRTHvFV^p)b6gV(x~fGu^hj)NQB{B)%f3W zK9`AWb?UIX08n&w`bVvYh#yIVtyf&ctZ;ZI zI9L#ca~RM&>@grrXd8(W85`=6#p_~V$d$>aTTkgl-R1ggt(HmQpbvmU3&q8$~k{#NY2$j~5Yt>)RWgir))Sdx`at@~%nUt3c&Qhuadb49zCY+`n8QoI~oN zU@YFakyl*27KX%4XO}>VVg=C3-n@AObiR;~lQf59AL(-AkLnRsRQS%TxVuAgxs0I>bzY~}GmwabWmLO#xN0#Oh~EdoJNUQvr8RT1Fa!3F?zq4sKT?+#d^ zVr2{Hp0>84-QA*H=SLJT99rQPTsV7nW_5LSW<~@IKahrWpe))73kiAC!Euh92E$B6 z4b=`=RQSj%$_cY)CN77O+Y+|q5u7q4HJK`0_8AqS?Hf`aXp z(b&qI9H8fxr2sX&2oQvnq7=xW_!a}vQz+tF$5jUvfsqGwHVTAUtpo!B>^*!_{+eLV zo@_7jdWG&@SCqlfkrUN2+iJIoD$OZ+MLu3lmJNgoWdFX+=)lZMXtnj#L<5<=wXsZ1 zj5A{~@kE97H*2nY>lbp<{T}2v&ksaD-wD@}AVW`mLT&5V&W2v7oU=70xO#c)Gx>L#f`MBLC*!B!@P)&@K= z*map#F^o%z%S5(TVzn#I`N3{`M&ACN@rj5v!UyNyQRTXt#krr`4!2qa6Qsj`fZkws zc3_FlQRH!2TCq}HL4tY*dk_8iGvwyfT}{m|U{FK+5f*B8SVSGQaks&!2~KuqDMz868a=NF1s9j-b9LZnLQ)0l~q} zu9@~k!O!o0ii4+T?1DeYjDT3gJO4M7{MWBDF`l2BOPnMrKPQBT+wU$t1#UZFI%(JR zu^g;1Ut?n_9vParlhAi>n?Ui?p=u9mMwsSwQD85u-DhqC~7gh?ZBa{(Qume$t=5ONN0^Bf5q11Rl`MiLGNYvsm#bTFiGo%=H|**Bf)_K z+8zu)P#~S1eMP_B5HXnO~M=VbVrn!_?8bQrrpxV#T9IqGrie-9BE8T6-kk5vA}pjH?mJQEQ8KHHq)4KZbMF3%+8Ev_P!j4$>Fs(%5klPDLBC}Pt z5$f(5rqsHmmP*x>C||>>MD*}qkjp83RD8a8`4e(sfv9tpNLR{|bKqOmer0SPTa$$- zAr`MMz>vDY$Vl8BFz7i?f(VU_ZVN<_itYleb3OM|dBfd;=EB^<`fms1q_k9(78RWi z(oKYX+Og5maU>B>O~+ni!jL6sg!jR5?;-}h?Y9!h$sS(ybb$!y>j1Ax;5t=T>!+xz zq^MWvhiOuP4lX-6llN8HRwFO7Bb>v?Wc!P^Zb4arU1(FNob}koW)0w-jSZpFJrFA) zdEF>*NFcg9ahRIaZ}t&KU6i1h@igrT6d_4_vUlw)?Yr+NR6;8XlrHY4EG@3We-&;9 zSAogD4lHF$Tg&wYx!%BSLy^YnC*;o_Kxn%iB<^+(_9#@VcQfx!UI z^~msWy-sE(@&h3tb$zk15e!Wd*<=$um3WyEPmB}LXQ#sugag_5+r@KKTRE+4)?()SV+Q^PYWaW+ltvNWEZYW%Y#TY&Uxvl$N#j@-jDX z&NsdxDBx>2Xr`OkdgSW|6NyLm4i*;fCho=##(>(|wiZ~Kf;VQS= zrAQi(a5^57zuzS$CN?)W=WXTz9+fniRGU;w?suEc0SzKU_!CT25J7$a-d|Bs$sYF#34$AtSOgp7fWiOuS`_K$Fs2@Pd6U^NIClqdI_F)|z$*e!(%BifxysgA-iDk~ zQu7^9uq_+AgUyk3{CntJXQ4i1yfLm+XAz;%o`b47M6+8BJ^qb8?EZL3bp`cFcZ$RF zr^{6jR1f#yI~>xv1--|5vBa97kBF3r+@&AM7ndVIiA_Z0<>5PLS00FQDe#ACS+^R- zH7FK)uM@C27J|NB^T$w2x>igL_?$u6)XMEU<0lSL#J9E%O5^?erX4L+=)SnCPGQbP z=km6!b3$-{V|u4Wevp@a{JTc6cwq06>t$w_nJ(8oa=Xhl?T(T(heUVHo;~JO*F?NP zuPk=t;N)w{8RBvb(QEA>esFY82df{VHC{1*ix_N|TD=x(wayIH4?(p1FK8LS^d^q> zOztwHr>7?gKqPnZL^T751Y9yBY(P+yC7xeEfIqs;Wcv5-%B~NYpz*Ek?OmOkY6?V> zAuB3;X!FZUdK~?dW_g^=9Xt5z=X)1#z^vYxMi(N>LlGPj($?B;A@U9U+am3gKc34)G9uJh((WnMnH<%w+${3Wac#{X=&W`~_xo~j{Na<&sv;|~ zFNo?G0Uehb0(F+f{#2ZG^=`TFx@*Ju!6&+BbzopeZ=78JGjd2+aW|i?u=sT6?(7_U z=lyDIj5VvdttAnkzFu6c!S>8})HYm-(WJn)l26LoBU-AlM2J|dRZV zt~pT(SZbi>A8JGGzkBNuM=1_FV8(6T8ys8!etLarOUe33O815(9Ro1$- zjUMbf&1f;s62CB1hZrqaU|4Rg+TOs{_H7Qt&#kW@dg(m=+OCJLGb6V>QXlceeESA~ z_ctI8Yigc~yG2?F|B0eTeMi0}01Cj$ss_f3Tm)T@YJNWH zwvN@;)Hr`<7$2rE-N|QNsKrHh> zC>z4KAXRq!Y7ePTA4o`2z+4A}6e=oUt@wExCIY`)J>#iG(ft&PDUK69|B7xgpLqXN zw&q(WsK@kKEMg$Y2(}d5{iH{Kuoy5}z$Rgfivy1%B;;YpLsGNBUO_?O`OuKZwP?al z6vE0Yul%4ncyYFOylIMCSjQl9t!JOuI4$*!sIW||3gzg;6}-iaNUiB4Y^>77p!-Tp zPPjx-RM&|hO^Hd~6B-0UD-lf?_rffuf=H*x+0xz8ZQYJ#Z#7IiqM+tCT?%qyRb^WK(hc6tN*M3TMG*dF!lfK-^@Tkh|5Jq_izX> zC_Q(6eb3L&tgJ+#5Rf9Bb4bL*pa_eC$b+qn4kWS9)Puvod-pJbu;uUdj5zM*skBXG z$wk#|&P`K`5`E1o-}zPV9zzpy5B0o`HyXNr-;)YK)e#>dHm)I&b3`Tgb&{()`zlC3 zM^HdOae+>!0vu5@F~3#nU5~GJmni@bcC9@CMhM~3X@k=zdAmF8UOf0qF{Aup|1H0g z9VFG{dIzb1joVym2#sKB0)I^B0rUuIgxR(1unY>QlJ=w*&*>S-+;NkC z#AzlXtgrshDdchn7BLVHQ%_l1*5G-{3rHp()Y{9}kIn=eO@|kF3(rFWAezda*`i%JR^U*I7NkU+S9nuq33_{$Ucm$DX)7CO=cnyokE}dO(Bjn zH$NBBit90uIDK}Ri%938wox@14iVDu@UAmwcd4nVnSUegPG=Id<1}*y7^>+;k}#Ct z4dPU((>WlLrJeyvJnAX(nkcQS%ZrPvi>suho~o)bb#qg#D3DmXpP~nrtGc<8k}2dZ z=y-ToTJqf^u*Q4?hwUSYH3NC)*Lipjps?$Mp|Af7_4!XzGm#t|z!$*5dHwnj(4~@M za9T#+y00%SrN8_0`b*TK-%YvCzFcFq)fTFqVaTIP$1+W6%H3c;J;$M;eTPzz`D@Kf z?X$;DQ%Zj*0jf^xN-KGs9UsPCH98 z?dwm-6IU3et3wDGLbN>*moWg+Zg@P#yGXH)hU^KibhzJ{dsmmg-1n$Cewh^2Cf(JN z65x~mfH{8Ron;8P%*{Oyy8W2t|3#4h%M@rg&I1)N$g=$W z`P`t^<;gaaZC~>@?uVQyb(!nFXI@i0n*#9b?*_wfNZXuC8YL5)7rYpr+iw0|t1JP+ zyP8^>pm|02LHW%C6X7jl<58}FGZ#k_Vq@QOfT|w(0}d8)u=i@WVYG?L2veGng5+t7 z=9iBFdIPLH*dCo_0)7b8OL{=IeQXB<kF2n`NDO>MQSsz+xz*LxX=Sh7+)A^v1;hmfVUB{Zs06hLnU81(G0ojF6=kv?(;p1&q~ySW{Vy1wdz`U*Z874u7&&|#*&N}zCwE?NT1?cCHP7|1s0qHacDr(uK<-kv$?VfFk5-_N? z+q|?o=f0Z`=L?URiVAr6r*g-?koloExj6f7+W6#3=lHlADSM`AfRQeiv40(Y6V76C zF~E6BZl}AY<+zf)qpR!w#>VBi6C516r-whx7pl529z;~$;boPDdsba-MgL%Kd3kzS zCE@}TaKqwpM>hM39pe=;qT#DZ;-O$^EU&G}TIGoT>Xu1*X0M~s>g#lG4KzkC7&V{9 zFTD2nNvJsu1uxIvL#9)=A9G%!4xopO9XX04G?zGEaE3>AadIbLXpNt7-CPuTc#7%D z;EhUyyKR@fo{cH5cxUZCPbm6EmE#arjoa=(EC#Rxq7WDyT*+j=2@$oz4ZtjrghTGC zD`r?kdt7p~fF8#sY1nZ48zi@DAK^{JhoL*-q?B~jZ;`(H;RA`g2GCX60O{p_HaMWu zCOumaKXD&Hz^@|{@Z#9p@XdWRk~lreG5@-#_drET!1O)|zh6VEh3y#HXM^ z1&J%qpAW%Tp_&`Yep=DOVhO_XaQ;w-&V6;b2x7-SbzgP7X_w~b50UZ*E5hnaY-?*K z{F>=#JLy2+e!|w#BKSw}PshIvoX8HrKhQ@(@(+S^*RS(JY981!FiG<9C6ly!VMxFp zM3pKa5rtHte!R*9eHYB_SFdIv4GrvDP*mm_!~in^mIZ*3ph%KfulQ*|w81N-W0(Gw z^@`g#wKePgd(wYF8UQZ<74o+QfqR`M=kCd8t*fL_Dn?@UbZRWeOM8$0+cMSDz{?pP z8HQr&Qo|#V;|!ab%@7H=_^0j+5=1t?hrnuqM3nC1f5jn!4>KPmBo<_V>_LzR=EO-^ zSd-j`4-4TOQ&au-Qs(DQ7glIzt-%=lJ2^8;|2*v8_4BMDjRMYEs;Z}Cn8R@Q&p3Na z;td212)kQ?;6KJD1>gqHBlgY6+#l9@ie(_Z<6{s$d@iF605-sU_-i}<%g3)Lsp@{! z%3b1M9;0M-he(N2uTbmU+R4cEwAgEmPtHs>a&2&*n24YT;eYOUHEEB%;7}VOrX36{ z=Uqt`Wt>kwGE7uTCRt~;wpt`OCx5dm`F&%fKeXTS(!zWyBOPRv1Dde}^Vu>7(EopB zJ(YHoBL{=#{m*|JG(CJ;l=g0j{Nsl9Bf3z%MEJ)*Sa5K+e@aIR2m4$jS3Vc3lH$VA zS$=hluYL}P(?b;@IXdnih%8NUp+w+e6%Bi5efiB<<>j?AD!+z4b4A<{6IdaK|0 zv}?*YFhyQlTW7HojPZE?#5#xC&tO2M#>K5>GyFshKW>nE%KJs8j$7?h7>A>VfS9a1 zc(n(AKt1K<{7a|X^SF9Zn}V{kXxbliHC~9qx9^>Er==65C$o`jNB3ttJ%)|S~l?L)_}TUn5^%76AAl;S;7tT=}V_x z5p+MktOWUY9$kx0VA||_%a)ZC(DPieU#xfAe`TTFxziR=w%L zrH^)jCfOMO0h=|-%$n<~z{y^ymmUV=ORXDiJZO%B>pD)J47*JtfFW%Mq z-k`DQ2_j}WCn|gH(nBLt6OL!Z!1ZgiwgvdEpq-7<6u>W_nxK0XNGV}N(U=%Z5f*a{+n$yP z6ToOc8Qn$C_cpW-J1rf3MO8{gE0D{zZ(@2aSZytpo2ZU{0~J@w6Zfh>T>dKg z4;x<)kzNzsy_)-~eJzwCF`BA0{OBm)UU&bzIvW}m#(E;zy~?{r)LacQ^3oK$o>0E9 zV!Zr($!2f(X9bxIO=3#QI~%zt&tI^msoSgZfa9btt0`-2AZ?@08}sQe2IjT*@0A`t ze3CJv4@2{ZDS?+=`VkL%?$iDyi}cfv+9qoKsP{9{flmUh(j0o0N05{SaT%EWw8yt0 zKtxOH05ln4VOt=``7sKE)`M!L!z{=WO?~DI(8|7ig_|25SFd*Km>XZ>Px?cSzmocc z^zK#tq>{7uK0;Ll?#uPcmm#JIawDV-p5@t}Rs9ee5CD&WkQCIy*M%1F9Uea>*)A8D zl`WHvjlaJz7En^uuXGBapp1eANI+j2Ir%$bzC)vMLjF#DN=wvY80rOv_zb7wRJ3TnjAZ9#0Wfmh5aG6(9@~W7a>ZO3lduG#L0VVm$ zBzeU3lS-6e&u`c%-Bs#29;kmu@$Td12cFWOnYqI+-%Fu?A1-vli+|_RZQc}H(c8SQ zKs}FvzLa>MfniY;-(?#P3#eB~Ay?LS*MT5@$9d z0`d$aK7G0)2>;55Oz!~&_De^40#q1O(+Bd3p_l5RsQVRKQHqkE(qidNUnoDz-!(4 z-42jF_4+VQ>KxP!NV?)sh9g;A(3!y$fG0B!uR*Z83dmDGW`Rfo6|l2@{YrcaPr+(% zD61?i%)FziuK#b-)>iaSehMFf>EU%retvrT5*QP@8Wnq!3KnX7X9Jg(SSAPfvUMc?@GuSJ&KMtfh_3PaAJq zYMIOo4QaQH#Ny)W>i9;2%&)90h#aP;XIGN$f(Oh>uz~${Z*NB{`O#k%LyNzkXMVtF>*fpS1_^sU zt*I3CEsfw7nIDSuEwe3|i_@1QN+pzI@BFr|WBzpZ?iU!_mlzB}gJ-U@a)%3TZqBG+ zxE^-f-)hsyd-CR>BLPVuKp-z3(XlIaN4L`L*3Is$a=BOP2{c3d_tojEt~5BzYQ(*F znIAA*uu8M3^*Swi#4GUEg4yubKD(DQ?>>CkW)z6Ub|BmF^N6!*sYC}sf;5rr6eGmoMomacRBnsi4JuKW1oVPS-NKhH?HFsVc6B}Rn`{RO(5rtNX8+ua!s*r5 z-?@ADE_lj{isgX;mt-8@xGu2;I$sRG_Xh)ZI85#3pAzn2)RdLW+(q9ND%qCRNLb6g zG1P`Z=&-s}^yyPZrB{ynncsH2srx?%gmNNhWS ziohJAXp<>j^uxRpAs!eOv*aI?VHe-^dn%+r~f4>bR25W|jitDoq?{?Vh4P)8#sDk{N1 zZk6Es`?qm)@TkEPU0`LaUynR@_Pn|bryv5sEzZp?E-uCGUyoegTa8&6g_Y7eX8 zzbICxDk93htUc2L#pqn}B7<9^4%MkwuN6HsCzZ*Fy(2%e9rNeq&ey?bH)R4=aqo`z zHsfHd=_c$G_mPASR7X4>ABHHcc2NyHdpVKurBe2IO$wu3Re!8T2Mp3!%UdTMC#i4B z#IZ&()fN?)U-Wt=d3tdVK$^2ci8Rz~amTgounrdkp-RBl(r0TG-;12ira!gYJ+{X8 zz5GlG`TjTT*5b&VYCur(BMuzLd^_I%CO>pJwc5|e8Gm(PhKkx%280p_9 zy(@$i1Tk6JczM=BFDR@6WbK9%5Tg7=^$||*Bj@a;lge5V5qeJpp-`2jRt`v0a9_Ei zr(7w|wyH&+^XQeYlgbo;3)&VIpyMZ6Y^xqA2_p*P3gB2uNyTXI^`^vu8BrIps{K)U z)i(X~D5PAFYyg|wxFKHdJNy9nPBRnqhq0$cq9sm%o zT?=o139drQzrroL+~p6h!m*M|p7bRSJh{sQ;DUg_Pa(etn({3{fq}=5A5Xi_8QEOA zb~t6s%;p<R=jtjq^CTrwAz zl>!u4a4?P#QFH8+VNJeQvpqlEks#x-XJxf=c(5HX-vM^@uY#Bij^GfP8L*@kWNm8lw`0a zg#y5!rm6}S$^6WW91-5Cc`SGNd=Sv~7vH#bBH#_Xv!??ZreH-}-gO7Dbv)^dO61|s zu6qMl3_u`nZ`mC>c<;i|L1iT9Oq|A1!>dr5OL@=0xB?pp6ac9H-?!r9;!>0d|NSW+ zYdlCUqRSkqG5@|qQ4vkjYW_dJ3sgJ^7Ueta{O1T1@VoKR(Ti(q0@ts(eB!K^`7ePR5v~H zaH?C~BNb!xq9>UhU+Sst{-xL=&&3pFN zVFTnL+DsT`I?3xz3gAG@A&sEuh0)B?Tn5Ti=lpDFn~5+>hbP+EBT1D1`tAJt~UHSLg@LyDDw0t;;3*!wm6*~p49o14)f zrwFm^Kl?xk089v4?)E`hB9cswr}h-CXL*<09G@Xt1=k1{OMa`&hv78dL+@4IGtl-x z*~jd93=nsAc1B}`&ei6S!Totl58X)`sx(3&8mEbVBD8Q_<4dOG`~D_MP#BGSfgV&mg!KW`t=54zdWX0J@xQBwY(ziaC*I)D%w z90&RQRpH>UbzvSuBz|Od58AOrfGnutCKw73oe&c~E0+qYmJRad1H% zsHyd=#RquDV^UX1wa8#=YMP&$8>OJXEF{S{-1_q7YZslt)jgP@;Fyv-qoc87HuD_s ze(x$KhtuY1XPxqY;po`&@@7aG&>}~oL{erMP#AA-VT`)P}Q z+eiw@*TZrBUfeQ{~&pSaI`7P}&wJ3AssR!Ih% ztOnzxE4XA}{AdWumb}ee*$v7cvI3`6U#sjkN1)W{{iFl#2Pq)exaDk<_v~Q)fin$3 zE3dk`{Tw)qH)Unp5jq`LY%u82(HRbVxOR7U7Eze7q_NlHOKeQDb>dlELHDTCs$pW8 zZD2`<&2Q|c`OHv({ZRTMT}#KgA$!w~##el$v%;St{c>Z zh~RxS?EVj=;m38WlG!%v)l>e{FjeK|nHw*?8xbqS8NFcGJ=-}Wk2^W)*@3Kp@d$G% zd|dN!RBdFjOI?9|N94uodqgk<;;Se5-VS%-iZnAmtGv_E)!hk>9a(iD9NUO96=A6o zlQCz^j+PP=n|rNUcyc}qLbPg(TXpAb_OARAT}j1BBPz6b9!-{wW+gOeU5CV@t|eOB z2A{sovnxzp{9j~q&1M>ZvmO`RM@wdWGuq8@tFE4gR*(XjV&!F|i;Ebi8ZNn-=pXXX zKqQrYb*gN1$0Ag7NY*n^u`HFqc8a=a-TbrZ<0puTZwH=u$EUO-{&bNVJ$OpL1h&wF zyBOf?Y+s;}vvzlX*yTXbCM?`GxHQSwGC-6y_kk9Pt@E^QyoU7f7+E$g9I}e#@+ul5 z%_LLA>fC472{Skk>rV{0rO=!jKbU-q^F~(TOZp6Kqvckk_a}U>*gO^Q;0&yre5R{= z2gl*V^|u{R3t)S1R1#K(F!MXZdhaT{i9$WMf%LeIL1cVOBCfwF9)B&99+BD@7ozex zLlMPu0C`bDLPB;M{fLHfuh-wMj%irBr>Vr3@0HC}nEJ&85m80j*Rm&yo@w8mbhq)a z$y%+W_GU=PA;Rb=T*~TO5^d{@>{v>uz-o95Gmh?gHo=m$HIk@%>KnKI=k=oETDEtN z5rTNu5Jhd(1bd?Jyk*}u-}fWsFhP2~zg_Mueqfv+c@ibM9tKV7KW0;+odq+2jlGA# z8-}KF_6y>8EG7`volr3weq7m_PT>4<#qy=6j?kay_uKO~-H|#()2G6xnsk-!|M;6c zTVHhG+MmFuekmZmrX#hW@w(k&G+L&^KZE&^lFvXU zh4x)hO82%D3K$w-SSp3Z+^X;>CZKpUH=pCTDG69xWkAU6LMC8hyoDtQYwEn4}9!&R!@6iYL@MY*^Bo0v%m z0Mo+Dm>wG|)Ff*_fjUY|!El4L(lwuT(Kg?a_c{%Tz=29tGO~@|{?VtxDsgeMx6AmD z#Mh`5tJ;bDIu87{ippo#R?m&H719j=BLAQJ_bG19BL+;-<7s;=ly*G`R2aJ8LLjZ( zEu76JsqUVV+7p|{Z~BUyZF&<%_Tr<7xYpW^{4heAWi;9o%{>s@0a{KclU8B&=JwKlQMBam-lU(A=P18YhvN}q zd%LQmjueuXbY30JWK{l2p6{4Tg~*UeF$7l^m(n|Lo72oQoQEduDvPweX2~$!h>$<7 z+v3Wz1>|HAALlO%yHwx{K%gBTnK4?NDu3`f0>u5md97ZO<`X#EI5^*0WznY11Cw?u zD=T&di{Sk=1TZJzip<>J-rO23PP#}I#x7psntpP68fGU3 z4M9)m8y^?PEY68!Bx?6SXSr8PWrN{dyL__4Qx&I#DJh*mq_$hKMrn_qrQ)o-8Vwo1 z9&B!k$t}P5+gH~tM^Sa3rT-(Pmkna#G@a) ze6`lHX?m6{g{E`hcbph;ByrJcRQA)zF>Eq1FYgB7@vrrS42Ho~7fB-4gmHd6)fI^QP^E(Y?_ZI|q+;e36>f zr`phs7DZd)Be04Nza&``s?M)oHFVq}8?C;Sllsu{Vo$W&Nny9u%2fSxIZB(m3M&O~ z#%%U=OUufXi+%}W{`@;hE+iE-HJ$8++OzXfU)W_Hm!+I`(4!*E@4pkn&UC}DmyleM z-CVEeN6eDBdku27aZG$UV)yb5$@!5eeS?&Y%Z8vAwhs|mhMbY(ldBW-d;?h5t=mM@EsqE8;KYla?gK+=;E%w{oOH^s$kNzER zmz%_7STt(QoZ%QGH?Fi$LP%&skD3@zqREH+W#p0iEq;M(=QW%GS#87G57h0O8zdKy z%s&MB7r?IB$yWsueiD3xx#+N+lLna3kyPz?lOV4xlf!!OET*nduZTfItYSfW6L3S1 z-f2uZT+8VuuhIYCfs5CH?}U1$c>?dpdHcVIb{R#wx{6~6w>LOoz0{XI-p^C=?Qsf$I*kp*iR>kXf2q7kr)*HB*O|T+OYPm~Pr0 zRBiA5Y%4CqzoPauz2H{-68pR0NNtA^P6tF82_TPZ^y&Iph$L(4>z~J5CnG~&vDz@m z8GyrM(}*NJq>vD6TaR>i=k$;PpOWV%*mfV*^^GwcKlyyc1^d(a z{`QY>iX(L@G3=1}5@Rxe=wi}yLF=-tnHe*xJ{LbsqAI4%wfIrB#5z)ad4<)xORUnS@qB%uAfN96q~LWueywMfBgHD z_dwtlw7O=-Q#&1M+<$)4kmE49XAu{@r<5}Qazp54uU&k_cQSArZO~trCho3SH@0I! z(@tWu38ZJ-RK+cZ9-10xv7)8wp2|1nIGG)URh~6C@2hQss$68X^>9bH@%~KzuE=m6 z2W8%0A0{Mh6I-;2{~ujn9uL+2|F2S%ij*aak~N{ozD$W^4AJzv}NpmE)zTqK+ zHF;*L93 z?uWp0SV?#WS&c!4NTkbA){ScHpKM@YHf$Y?W0;U8_lv9&4Yo^1vSUO z75o<3oVrC%hS(2|%SdyRLGY7*Yy4~&Sj)SS%P8GxGbEBIvat&an#@YAI&d(ccH;?X z(n07t zfup?s+MSTWHO|i`8Q$~nOaxX-ZC2jXu&|fomAS(<-8%peuG~Kp({8!Hnqb0nzhw*X zt$+@X@^+;4BPcX6K15+Y^uV#5k1ZO3XeC39yF}&Wd=c0$FKZEt!P$53h)GOD{qqoU zUd^P7{^a{;`q9%n?)=1T)14{kk~~~ceEzNL6G`jB622b}f`xdm3!H&y)Xlf7$BxO( zU;1Pr5l25>zLUzA#ZzMMr$>Sq{|f}FT*eFHRPFXk7qaDIxrY)$o1do~Sdd+K z;88wE1~|T(>?1*TkYF!`tgLoZoW2a+{6|8-^D}pVLMTTkr%>?mEJK&d*c8zPdNg9% zNx_dGNzlvd=UnmsvekL(=ORp0FA&=i51kDBXsP2y;N4B8UcH1zmC9Ea_3^fpzFv#k@nZJ$J z6zPK$EsBf*F10n*H$VWrGobyUY1?9PeRUl&`ZtTo$lRQF5>$k?w6$Tp33i|#KQod@B=+qkk&s^H3Dqg=T2mwmd%tf1f*RE3kfAr0M-dS*eXiq zGg!4=vIzLNbwMd;q`*r@HbQ`X3X(Rq*Zbt&83-g_gu}q|0IKOITczqfIb1X04LGFx4k_Oh1C-tqZ2PLPm z4mAjfcK|H-d+nD&QW;!<0T|`Zc{afH4HBY~pkEXGVTS05m;+wqTQ)YAkYBr6TMnZu zJlmHGcjf&0)Ri$a1Y}SFclxJKtfa>j!1<74gn*Ki?9J8W*#Or zLIAGaB4dXO#z>a8bnRKS&XLq6@6yN@jfAE|5sFtG1QDKkkmH(vf=ccCg>dBzHd*M_ zYu8lgro^4w`+K4qtbffINXLwBntc2g5sDCvun>*n#Y}8(57mx(m7f@AkU+tAA_j3J zp^p=SNj@aMHpaDQ4ShV?QKI`JUK(Yb>t8!oE0O2KuVG=Edavu_R}q!lrf(=@+>_IC zyG)nV{Sp1*xB<_mcg?rnl@<*MqzE%}$%ErerK)uC znzLHonMhGxBEM5_WTQ?=*(2^#r})w{Z6+q08j@6qdl?%57aENLVlQIXnS8SYS2+8K zW^(|SW=85oV6%U(kwPFsM+c7R4lVL36JcEi*;3ju=vfqLVd@r4%yqpyaQ17?aBQa4 zYuC)kX1&&_6S1>b~Cb)q)=c~f?#6F&vjJZ?E!DJ$j?_t`KTsPh7#XN+cfyv#c z8aG3rN?&4Offz8Nu97@nWQuy-`GH4oLBn7M(GXt?RI zf%_(G!=cLUY_-dYVtmB=b3b{~X#bsUKd2-I=8ds~PxI03qx$}b%P6IdMgAEo7dQeI z6u+FJgI(&*K`IZTd!j#tt{Dis6J^Ml_C}COX>Xe8XWe1!=Z7}ppE=(*DtFb`Z z0@+5jPHywC66L5RV@$yTBXW?-+fI*`--7UH*??vU%qQttTNkC;tCn>glO3%-tVp$L zHiLc-MW{8Njl`;m`0c0LDjS7f{A8jamJ{##*I%G^?|v+?n8>p8!!tv%r;#OJKbkMT zAhu~Qik?1C7NpHu-{8bno` z20j^KlyOv?Egj$ZG7^t>4G(~H9sPccEbY+e(^V_G4C;`auMJ*(`LZ>ae3M+T3*m~1 zPh0!}D$dvHCvA{K#PHuu2R9Xz$%0JXhzOVKE^zr{s#hxP`#ksvF;k>9Ba3v8qe7%% zp|Ynw56Hz{y=uHX1@DZq zs@1;}o|t%x`}MWJjrmQ8gcs07-Xgez>gu2i!XY8%q&6T@1KAUIAs}a6OjPtO^0pmQ z%Ck^%7!?e7@2P(Et>M5=w{{RxV+T%&vC*UF-V`=(umpRk!RYul%vArTcJ z-Nx#lt{h1kSs{Co+cCnL+#wFPrOmomAC3mU9u1v56q6aua=9i2mX#BUl^5oCWYPEczZ3x4Fc zp6}gqUvd3P=T3YjbF-wYQl(F~{?QXH=E_kFK?+t#B`QdoWq+H564P&glUcM|V*eQS zxVKB`Q)FJ~a8Y4fUVUv{dHoWxw8yx{EWN0Q(O)hrZH(I_u=MA7lcUQ-FLF1s7(f|H z9>6gN!?ekuHa!W4l(!?fOlQQ?m6Or-&Gy2^H!E>1B5t@tuD7|`!*AQ=K4f9?v6@7r z{V%(WXzN9T{E&g4w}Se0T}VExOa{0KOR`ENs`%3-Uwp@R0vd?G+l$c7Clk{lu zLbZUCGkq&4hHY$5dZ(%LOTRg?$p#mBbHfxInPl*q&gX7&6;>^!sbP03haH?YH!2=y zL7W(FV6h!ZEPw&Wlnu>T0OsPi^)#d{9WI?i^{DIlBIR1 za0-MM+NP%DO~If-zrUi`9>-J#5fwD&?zf z5@PFu4lLN%Rj*jQm-eGntJI)U8Is#=i$luF>3;iN@g~ToUoK_(z1i7lGx7c4WJM?| z=bJh`z_o4albp8PwAmhsyuw6_0Vv-+1~yY%WOz+=j}2f_wvK};xY+Z!>`>)^&dW%@w7KfGd*Hqewk1@ zb|fwjQ*149-Z}wpscf%6-*zc!-Bx+Z8}?{f^YQ9ll7zg5wPO2S=F8%H`04 z+Cig?lBLHLb6|OEI<61qWOQngPcV`{*qiolc(OU?uH6yE>9N)Olh(ZeOZDc}E%_9j z{Kif)ZoPD^Rccha;eH-v9X(`vJtIyQPTTpDhdx2!+n3^D+ieKg!$G!WrmyZxJFMtp;40CtjL(?w==rJES>9~EK1PFJ5B5&- zsg8}kT(MJmrQlzfb2Kw0|a< z2@4C7WsJNfHVxJ$9M4sTIlb+RjM2p`(UB8%6BoB3|A9pMEk6=IgDM8$t5NS2k+3uCP&ss7|i*4 zI4if^7)CVD93e>p=PH29dC~}9;(1AsG0dct1GP>tI|$Ehfo17`z(V#}{5k_!y*E|- z0_^;{x|eXTjclh&S6y#e$k<{`(C62PkN#hXLP239TX&eWMq2M*cLMwMZb`=>*Pd?B zQ+)gd>vS#@Ub$8XH$B37y@NGTTBUiN`cs7%)9Yualwe`J6No}lQL_S(vG?#6Hjap~ zIyww~W(#Sks`f{fJ5(6Qs`?>oIacFcTd%;-=D!li7|0;%ZX5~t<}h#A;`-kLXX!z110|;G>mWIUX7Ce2+4f^a3&MRLrv+BgvBrIGOFX+Vo8}eG zNK5L)#;tHntYKDyB?0NVi#naraA6m+IKuevig}PhesYCTYU8(Wv<*hc*~M*Z#s=d| z>CpTgwGI97Oa1HE9twIp@W*Zg0dSwKi6<9aU{0A|ASVpR2fMjVPEGw~XFa=Y34GG{ zZF_`P6L0#oANT~w^6#p1sSH@1QLf)j?HhchOQQ+>$Cmv+Lp${Nk z$}j7cR@L|57SJ45$Pcy+K5hk3gpW@@^OeRw<|?hSZyHQ#EdWv=lTsmIz(uBsbRajH zF)+{X9ri;&CuvYziKU=y=>l~%YpZBy@w=%`{dY{zeIyLDp8GGVte8WHt4{z!G3^Ud zNoKT|TEtv}gSlX|wcVKj`8|P@+Yu(EV1j^Z1KMs97I=iC=L{Es%hbB#n_lYvQ<_os zKTAvn10hp@SP7BS5_S?Foc@Nd~B0rl*592gNun?(m z)p5hW=Gnp3wV#_AG#YlpUsgcwv7n~WHQk6E+qgLy;O5cq-)qatKmjU^CKmBEl<7QM zq|9zqSo*Z1knj8lL62Nk$7iYySM+)5$-SroNB@ETe&VP6WsA6Oj3Q>q(a+Cna$!r( zn6he$%;@l~m?P5xn8nW!3xM~aS_qXhN`s)o&kwg;dBr_kwQAePw3W!7Em$7I5cT}D zp6jU%ic#YVkRRZ|1O4H5U&3NSfhe;3Tn=<03G0jauYz7{!1M1bYv6I}qQ!OWkT2%r zM~i~~o?dKB;d(^!#IW`DnYA4gBj7+1d5sOc`Wn|5*+_UL1pM43E!r^#3pC#`MVJe^ zBZxP6T*9*$zW$e+j|eTju|s`~MP7g!%5TPK_?bG-_7%FC3c3p1ym=Fp=7K00xChn+ zM!*dV@=JS$vKyP5_j7=BwyZi~ugu8ALwE0wB8^R26068sLOLV_5TK)DRm>erF+|Tw zvzC_{p?EP)D_E1oSR)(j6{!)-?(Hz#XfQCw@^mvmWd-G;O3?zUdtiCUeYY#B8A(`+ z!?VzD1;L+p%uG)+kdA;5V(_RW4UUA&nxg*eH+}2Oo_B^28HThqitKa0ZNAP|2&O?)(%|0-Po= zNRR?79dYvC=LjGnqfL<-Q?rBW^ONlD3~&x1-#~u?#VTNw{$vJCn6DnF z{@>4X9zA;77tgo`)e7l=od z!+91^6^QRp(fSANq6$3x+36rKP^F}<1LGc$Cj!%vh0%UE#uCvuI{Xu(eRR?(zug_~ zLxu7ZLoe%v9p4l%FKIzr=g7Lu_r=J}EwU@*GRXmxkT`~bpw4aS-N;@@ApmW-@hWM$ zm$OzW8O<&PM|uTMcPJ&FA6_?-p~A9U%tQc9lw{U5(Bk|NaN?cJ?@5qeYlGfo#Qvzn zrXbJie=G|KVCI(*+s1sr_BACBqu$5_vNs;r1YObnF2G<+C0+BMtvA;R=R?Q^#+&sP>slQlz(&LP8oiK07b z%>u6>ha(~!92_o+FJj-_VohyuEXkXld}@j*o9bRPhVH`{cGKh$4ozu2@p0kBpiDGu z*!{F~X2@2yZEl{g-D%F0vPWp~ao0{1C#U`n$5GB1?2o&?w>z=K$sEWm_6o(`)X=$i zsprWDV08hgdmC7x^GdG*hUMmaLs;y=6modD&O9CV(4NDZI)^M=z22FcKpU#>L>zDe zM$EiYtYgcJYc9aPp0kODktgSlmne(@fqZ*9K-2G4qzLIlZS=}JC-zSFZp)fdl zfH(uxwFw&L(k4T>N1fty)70(j9XL!pXA$+KWJI#kE1zc|HN1H8$$)(?hqfZ}c?Y^n zOdmOn=E3@*jPPxh#LcOG>K$766ajD%#Pp}KnB&nYP#|gs2PhdWG)QxLNZI)+Z8L9z z3Q|!;m8(*{>F*=9r?1wfymQUIEO|)}^(ct!dAcHaCm~S?+du@{)xor9RAFd@zD~CI z-+|`aSZdbb$+&jRu%oVM(16ui6zVeoDh>KG;w#q#YOm;J5tt=-KZt8L>F#4MOz_~* zEbt*<`r?>OWQ&*EizRe?a;}i~k?0Su1$+CPpPWkczgNkrNt}t!-0j!|ghYJ}r_*<~ z=xG(bWL@2FFggd>#br8&I@2=h#VP`f#;9jgKF8izNt!_|S6z)=lc$3?CuI|~7$M8A z4SKoURGc|T5z8!#{YVq_3D>>4WWXpudwwC@XAY&8i+0zi2Dde$|7?+3oye`;!Md!} zm~9hd@M+`zCy(KhXd3m`u3lCb?`f@mVF%tBI>+P@a2sYJ6BeX%q@6TawvqS^k!#mx zCU+9N{V2de>c`pLNlOA*W_nG}H!eKiYo#Ri_nm7I$Fn#z_IXgxTL{3!DECE5kg>p%w z-j?in)@prr4~HG?R=SYK%4UQdK zhz-Cy1_;P*-^Tj4B9)(^IGvaVcbHQN@u4GhA+ml(TRD$1qIhyN?iIL?4L1%ZHL7<% z0DArG9~If=i~t5RMJsq!Who}|>9wNzIdlr5BYld~ZIae|8W~f}`stb3yHd;QH!*08F0Y;8br>nD}#~mb!_-a=0L!5k8$JNTL z4S|8#|B5fRfa}y@PS)@1^gI7jl42X^%_R#pwGa@-?&zx7W4H(h;GIhHv;^q3E!cKf z`K9?y^c%-$tQz1)eDWeKN+OGsMae9yr|l9l`u2}5Rlw)MVJWQ{QS_?J{l@&zCi4;3b1JHpvV;+tO{XvgJhNs z>p#O9A>{SW0fvp-z0Zlre*x0DIqcF>tqjF$Or!h!ucnp;EU4}wq z2N3r0eA{goR4GfOh3VRAqJ3}86_nOASzn;m*LKs7=wUnYSk-O?r%Q< zRAk%ipsIdABzjrkv_=S^wpUn0gg*5)v~d9$jRRd~1n~mE&3tGZmE?8XG0}6FR(ex# z*5`{1zo+UezvNMvl=Q>fwv|Xve&F=@58N?BKpvk6=H zp>aINWLislH9Rql(yDptE^)ffQHL&k93s|h*N2hu;pnkB>tcEOyYuPL79+N}TK2rj z&o`Ff4`Rx$Y+Gh#@1A}fOn-W>eo`wKGEJwTC@Ageq8Fz8a5!MKtJ(m(MNY zJl#JBsDB-F%!qpZnwHF|PcE+jq~}tzQ;B9Zc#Ecn=haUY#YPxj&P<|LcUwQe2B8`SJIc~6?;bJwFlVS(_$3}@ZE{M7#E-NFFPD;1?jLy*^rkoN)2( zzd&Ds1_m|rmu5NfI9D06EgAQ*@@+XWG%IEiJ%=s5S`>F=RCWW``WgJ$@fZH_V0c{n zxn+Hdd9A(>MRkAIFF^~ML;~X&^q2;*XJl#6W}&gH ziNuVy`53&1tu1W?ypw8YAh2^1T>y&TU;sCo+_;6cm4&u6y19$6lCA=%@`*Y0PpF!J zdqG4xMRKnpm3w!m2%r#rrwtyu@JE7j#vqlIfU^noX$$DUs0vuIULLqHG$vxX@$Qzv zX%!)p3VpQ*%-1}&@`()HM=#PE#aB%d2M6fMnAr&I6-}WzZ|7Ttwr87&bj7rK9T|5V zi)s4=`FmbuX-g&SRzh0+>dC8X1GcghztF=A+eX~Ft@q+ECYtp_0CWp_WWknJ>`4bI zWA|n0Q&@p?4W`tNUOvrfRs?0h(M3V~Yr#OGx=VF0llq6Z+98{f)ZpOwSEn)|hO>X> z0sLgGOhx1^RV!S-R*eN46-P())RzC~a9XRW)hVZT(H*L7H)`J#w3!`i~W-BbxEb>XxXr4JRWgKiQ0cE%09g? zNV>`j!-3M9@p^dWYk>r!dgzoo<~XEUxZERch+9vW_+U5K}~*8tMW%=*<>v z5AMQ%&ziGi%AWTV5Cx*2*h!8 zI#x2L^cMtrlN)ZaUe1j{7lGVJeIU3MW;1k*JSwJV3 z%ufAQ<{OKfd6`-o`@0HJpLg?;4;+1}EjYUegr7sne=W(uEkOaHXCYz0$ACC}@kuGm z)ddtEx2*JAA~yNSaU_Qa_^wm!LJZ#(v3CIp`iKC0sLFTwiq3b@bo?ATOx@krxEQa9(EF%SdXV zwy}Y?Q?qp|zf=x$IC1l63tBzP(avh5aEr`lET^~_>G7O0oilQS;(N~<=+2L3ELQ?e zC~Tj3I#yge%akrdX4(3_M1;P?!3yW&?3CEHJp~%ZuVTu|WCWy-0$GaL!EwO57raKp zAl2xjYyyriis@tB@y|#*UJG~(Pf&D_nz}mRWCDZ^fa674R@Po34pfJ402#9q67ujNaB7o~Jpe3d zwW!bTGb(5=hu8Uibp^6!(SrpE(Fb=q9s+=nfr_GwO%R8L1*=Ibz)%PrX~=;kb);1_ zRYQ6~AMsg7>lzwlMgz}t%cqxRj9@|bgW1tO+IENa&bk7|x3?S{>~}687wZ9%kB`OL zp7xsoy$O-c9YNV@m4z)P)RZN^xGkbVus=lB17zxxA;BRr#Om2NX99;G;`V603qsqx zRZ>9vA+c8Jl4O_i0jze3K{7~IV>tK=FZB0=^fwMpPI}62(dLcA=}{j;E~h4Ifb()X zYP=9X?&=bxVUXdq+TRR?k0L6kBpGjv-j33co}mXB`LHW$gYhkk%j# z_V5Y{02VC(LIK48^CIkLs5Jf}fC~TPG93@V?Aisk<>uWzh#}$LBZ~=Acb?D<5Q2Si zCDs}|Vfv4l1Mq&NUB}q?^xo=16fX~jZpz`TqZezu1#9X|Q)ppKAyA$6ANxTJK{X;S zE-s6hd^5WZfZw=8qyK%9LOmI~xA_!wos1(OAB&$8y~#cTNK?qgB~D*4Fyzk^(ojEf zw*@kSU-W_l%@@zzD=4+}t=~B4W99c|+3G3m-RGuGU+m-2TgaS2b3us7=t@*!NOEAZ zqNRA@mHQVMHFmZiIS|Ykd4vBtf1@fRgY<626MM6(NoLvH+!jI;45orV$ZSWCT3hEv z9UY6$BgCZdrb7LwaK15!FDYK?MPJHa(9VlJ5e#S!1FyP!l2LZw*545;9B|^16QQ($ z-=w1Q&L5N}H#^?Z`x#2hH6HnHWS(0U(+Z(Ecm9xMJv)%}D!%aqtzx9!JKRTMX2oR5 z_p73`Zh6oY)Yd{_nTew}IW2r#Ta!m=EY`+yn^<22E;I4u6&INKZljuBN)Ebkz1Hgh z4b{@&R(6^mb{GbXclBY%>7KznYE~o3h{^#XwN7#`nlJ->d#=s!a5_^rOQ@~wMDYG6 z4YPAn*EM)Q609Mztcp+hEEw{MklAu?l?3jY`K#6pN|()_7-tDLo}}ec8Jshn4`i5} zh$=CPo<%KuX=Ac;Q{{N!J@Kt!wzXmTN6*W{k6%XUwV8`3yyTu(W7%nOU`qTLRkgO1 z)3Mitymnh*bSYzqJaU`NUcMg;sl%F2_1?GVDh!QbVPDNR&E4w8rtc45n>bX-N5UoN z9erw8dD6eS3v<5}A|?3N@~gh&zTIPU82`8E9 zPb;`ifB#XV;>WD6+92)-on+{_YhJs9YU|-@U4RkdT?v;dy?pbA<22bsr4r^8oj7!~ zQFto3nP z0lDG#=K)5Pq}$fEHq_Rz$H^{?%KRIm&ki+n$62f(UVEKs;z-7U$~8j`vPmgi|JWo% z_aF~n=!$=B7wUtsRNfCND*qa<@#;(joolA9DbJ=xj#w*ZOe8;utZ1&mOcJzZdptZu!iCrXMBZ_ILX8ci0Xi2qrYrsIfz zFZtd=bXUq;I86MehDUlAOxq`G#>TKO-J!+>5$YPYR(mO``-yi)q|VNvedY`1tNdjmMU~u0_<>G6NZ*}B!%&?5gF80cWA@_&Zv)`{}71Fsh^E&87kIlCK=kF_j*kNE*CdSGBxXu3>eBIR*p_30wQ9?B*@;- zPZiGCA9#XRN9#pZ6Wh)Qd0BF8i>i6?a-gBP`}{=ISXsIyxFKh~KP_T+{Sso#&UMtv=si&HQS>-P_;Kwyv5m*3@iDP4SB^VpUg+LxPJ#B8U>Ioa|LpL` zh49NR=WsXg(Wb$KOfjG<48>fDKo0EE(!W5v~k)sg{1! z@SO#MD_Pev@hg`!LFhjN$wt680E;E(zOTioR&xjQNA-isc9wbC^_8>x1HWB$msaf< z6nvf|iBUr)k86=SPKKWd=88z*R_(Am-O$vOh2vRp;Gw=a!LJFtY-YS}92Xe^b{$YB z;NnPHSe&7g5d7T&olmbyBWFzsGYTl6&|@316ZO@BcU9doQ`K?BICCn zR1n)=9RH4_S>LWl_qBeNk2E$8(XlAD6LE#0wh8x1?zV%T zwNHG-Ns{4V^_?))tC_9G@I?l| zK*nf9cFH1g(1s))qw2M_ac;o}s2p|Bus1c2%D|KHk92uTHZ+`KIpPaVd@BQP@)U3_ zL|4?hK+$$q#c8f>16xu zJem5EC2gKc&*qY)aI0Bt5vPaCCfyD#RzMyRwCS3SL&5>iFH_jg-;%+i)C^G+C5YS@ zOnjMCTD8xW} z^X6f0UiMCQ=b05pvYYixw}_~p zTtKO=u^^y_NrILK+R!@~IfJCaxS9P6yYt%>ZVwWTLYg0cd{w>anA~d3_?1M2l!T82pD&9%vL`>TRSAPD7kM*V1x%Ip4ZhlX`e%I_TY*z<}3iYd7c zzYf^YCa1_EfE$*qrzkG+ytebu z?OeB~KH7H|H7ebeH zfSeK4wN#h={(bi4pN8NNT}mBHDULpPuFAM!v&ni|(6@ebOrNrqN8Ze$Qw<(F{zTzu zfm`~n5nJ0A<$6`2BTUKD(A=KONM7^t>pMg2MEYhE@KdOd`JN9oqhBT$2puNpWn13o z9Stvi7!knNVhLeWY9;=f}ChF!hCBY{5u*UH;RODSt#sD7xQf;%P)wai&&4Z+=AQ-F=D{g4*{xW_v25EP$ zQoSo-cGJ}~;I?z1&-~46EnL{|ZCjAlV)ZGFVFn}G&mgJ1ld9vN1)y|frJ2()QLR=|$kp_S`~ zf=u54L-#fC39Tw4C*+J)%OGULqt0s6|EM`ZLGRI%Mzg`d-QjKsRfU3QCKROmA|md= zHU7GgyxXJk&qi%?%e9E!8>p88Q zvZid%@*bOpv1waG-KC;<6uf^+?@MF-jKEkSK43v*sL;q;BBDk;Go70srYJ9^`TbI0 z2I^*sm{z=g7zF*#Yi{&l6f@*}7KZ}9DE(*n%_LA%P29a(;L{}ie;$T5HT7NT%3x^O z@;DgNr7R8177EN9I6tvJpvF+u$&W(N>?fl7@;l1&+3S{{fX(E3VE>(;#cnsv*F_>4 zT5s7vn+qj#y~y()c6%<~nuvN|WbCGDzULx?wD&40s7l7WoBASy9VMTR>g}suh}Ie& z98?2P&A`Kp%ikti6sTZ1j^cGTwH0ORi?`w%4cX)?cUIa3p5XRQF~4{E!3iZ|W3i5X zG@KcHLR3q2wnghDw`!J-BEwNNKeGOz9}VN`yxf=V@2|{Uqi0NsiU&>*_S=SLD6cb= zX5^*lxiY@(dc(NAuQVa6kDVutHdq+ke4c_3>48f3m&ZgW4pW~j%j~jiS{0+^x^(j+ z>0rY*K^^-jL&|t=1v8^3y6A~=IFBaWTK*Vs7Wn~-p27dd#_OkV0>iU_c znZ(5{?T8}Tx6p^rf1Y53FfpwZOtl8x>cr}#d?{IKll2QxfGj8$k2l zzKN{!`e-Y82ydI_?zk>Yp{3!iZa`GKVn20SHl4EGe?RnI5ZC4%erCAckm~q|10aQ8}mp8zF^XR6+( z{l|bVc0*FrKYpwlE@uG}Ly`~hl~&zN3?q;c9W%4a8Xc-X_*RpgCFQYb`o0b(?g7U6 zUds|tGG^GfqM$fL`W(dF?R}Nny|45MHUb8hukxo?Xa{|4p2BCwZcS0U6HDeWi$C+ zwRQ3-sbq%H^5Kdj3;1G=&XIEc!Y@mw*pg0M6jOwv#MJXR`9qA8A>?>BO)axr*8>6B!*r`oGpNWDuI<aE|Ip;{k?xo5hoc6j$*=3W-oGAVF75&vJk;<61-5cD0xtzSCdf^FPVI4-P(&`7w5i9<#_*eMLB*xEHmQ~l5 zgtk%$fGF?7!1qLBKRoBLhV&j8fy{G)r)P7rjh&Jur98AWG^7OV-rq}4gezHgUsLai zgOl4rLK^LEsi!_V?NOzwf?PxYaCZV3*EhyTGvHJn9;0+^%b&>4PE>@}gE~01#+E|` z@$Va$6v%HkZ}4#zPg9{wWsX)BetM`;C^AbpVe$-sr&VM)u#9}Ed?7p$z8&R5vy+#N zj*gvg>x`z3>$|Fg4k-J^d$5XAFF*GimaS@%_P5q$vpPv4N)A0Hc!Ae?0wJ;QHHQIl z5ECeU_Sk0}e}wAB1Aqh7)zk{K5`W@yp}Aco8*3}l)OsJLg*&QC$ffcJO1j#L@oQaL zD5GUy9>dNhEWRWokUNd-@9h(v*xvyVWn!PWcy=l{DR2?n5alT6A`y%=EC#5HsV_8o{7PL~CN(y#CPbK5m zIX9848|6qJM&#UVP9TQAQ4$1rL*e@GITNfTR&7zgj{E&v`!oE4a7siKWX|LXfI2(m zx-r=mTlg5Uz0+IRYZP^>X7>r4^i8b!xmDEZlO;E%u-IF%L~WfebkHCITLT+14#LJ1 zeX^xkXgyd^(47pgX(?JXefgMi_*rSWT!Yg>qZwA1n(97NwH^SC?@%zlbJ3}a60iEe zp{QHCs~*I~UQlTh0KWRDl?b~10@vWqe_VrtP9t&{R&T+5X1&G+S-DV{VWmBfVv->LK>^UdlXzWCn9@FlHSSyQfxvBY0B73Ora09rVf9*7BS!Gdzd|Z5jB`SJ~zdU|UUN0~9IcrY9?ddI= zyaT_L&e=KSva@sA6}+aeoFqwdu0VZY9$z4tW2kur`2HwJNvG>W3?soY_!yIBResSV`Ifx7mly^xhRar!echeh?Im<`Bqd+4N`^`)K z^Vh8?(T=AmVKv!PPJR^1;6Bq8Jy8IO|0m3H^>o`C*%BudOF7&RplUe5r~9Zv;(F#@ z#o@UY%hO!kyn-f~oS!Wb05^LOLYi~gDm33-M8SQ>56+DzcL~y;dDDu#Vg$Zk&cD_P z$fBjkrhjTND(zIT>19^WE zWt&!2kL*bHaOZ!LRi{&Y4P}sms2J*feJ1i265iYA*$1`x8=85$-jVT>2|MWf)uA)YC{9P&^e#_wG z>enS-4}y=2954*OF`sA>Xu9Ad&Be0k`Y_kC(6tFVnOhAGdjbh43XTZ%nZE97Gr``s zS%B#a@t|>h#lR|3G>x^MDR`=>6-K|Vz%S$cX-S6@kHlJ(&n%rzMso5( zU>0YJ$ALIp$x1~faiB?)yg8edClLeFaGJ_OT;h}ExL_AUr;^wCb6ESwE!`)NZI(>8 z+76h_6M+&E0|1}W&W}T$gcGS64Tmq$N{}Z-vXi`*nvrR#+mhoa^SUsa(LnSScb-D_ z3+|@c{t~p@odtS6kjGF65Hm<`qo_QgDQ9zC_6yfDI=pnPfS*ms2;*IFH~Rp=6@uBi zccdNIo#3h}T9~avTVM8?w`|e>;ylo7y*CKc63-Jv9&YorNJux6qK`1A9r_ZD_NNre z085XH-kOZY2&luq zD^%X@?Xo}K$5!)b-Pg;t^c4etzX%je%K48`%lzVyIizZ2bW{ii4ZZ>MaQQF?VX+(s zI8SXtl(1jwDN!Fl?(pq_5h5CMW)45|EBk`NKjd|G4p<||>|EYIY%&v{vk?&PIz;`s zT?m@5eDu;6gf|`n7cAE50Fmay9JG};5J#W*Yi`GSrjhHH_wdERu>|R(j1T&OMS5G3 zo%^WtfVqt=D$ooO;S3IsMD_xaO%;6iH31oPQU>i8$}wIGb1-o9E4{I>J@+}gtrZwY z+^R2uzjxvqu$_VJTl|dji%L5#ZTswKN>p2?s;o(7+eQ5FTXd~mEpUEUG%s%EIp*F>y%0u=o8^<*drq>^>CqdNfE$C`D2P(}sXhBT30EU=D z!@+sY1AKjMa~MNSa9<4LUgU2)D$%Y+m3Q->*p`mT%0-QecsFcTJHM}7l65-sw(I9at@Ov^w;)_^P!AC?a<@6$}9+G zCHU?qMwaLiqh0Q6<+pd2On_&&)kwf1{?g#TX@~4{HqEN2_@mQNl zw39{^wg#=k`gzG0D8NJ`#mS^xiv{;Zkvwu^Dw4oNZ1P$x(L-vj@qMP>F2gDC=Qi^C zex~Nl!0b^eS(-Ja;&GQpi@e*TteLr|P{U3ytIChi5WDY1B04|`t!-=5ycmwoj;0u* zlH!kRtaWvRJ+3mbk{>1JkOD~=8JlDL&?66ipn%Tz@82^xM*h<6Y7BFQHPq?f)HRD4 z>-OJ{MUQ=^aQkM~L5aa|^FrX*8(%M|aCY>kV^2 zL|Mze0afIH}1;UveHrB*%z4B3m3D@GfJ`EuleUL9bmrOG-q1Se*I!N2N>VEZ!XhK=heg1o6wU zv74p|tM7~+^0StFuIbrfE#iv`tAlnoIIi+(RfbICDRCxP z=w)N4mr{+Z@XzV|!ci_AAFoIWU5r?H3)nywg)*_FjfzY!i0jxg=q`6ZgT|juol=5Wq!ix#iB9Rsqa2hRkbRJQIPIEHkFacgYUibR(z4kXl{hCKtgnzfsb!tD|Ae^hOQqZoX`88fQ0?8@4~2C?VU zk#UAknVyi;QR90}$1W9VHoxM1i>2X@+gS0G8IX*hQ`tp7*>-pkqKb-Ap!LcihZY6d zi^cBU`vZs4V4|m!NmW)hC%0~!(zZDVp^5-6qu1p@r7E&dyRaFp+P=LRGou^kLp692{yClu9x3yi*NFhA79Ju|!yz_7_ zQk_X5p4RSg$*pRqOcTFU-uKQLiZg&otS?$b9c@B``Hgo}(Qt2=H$q%TrFd4z_**sV zun}@6rFp;B50!@-{rs_Ft(Hdy3Pu1C%*lniRJR<_F|BZKDcbDd(wB`b~JI|t) z71@lgB4zYIJ5o}qm{LY0-SFPxPbRs2&T20JxvQXS+FQ)HredI`nJRJt(qzMqngzy8 z$9ET*SXUT_kK?o1PPbzFqXwy-A$orQ@W7f!;8vIJ+#!VsE>0FS!|t4jd~%fWdHc}k zp?yDASv$wU)9d2nOLc9u9Sl38CwEq~jR?AJ~=CR`ge z?*EMDX`9YI%ttSb;_M1b(~a#)PU~*YLR2!FCP-ffRrtMT26UtS0%H=cX7{HATcDn6 zUGl9=LOa{-kzDt1Cpq)NF43q2q<{nP_N zS&E4yKIe9k?lISa(gi41AMEGvC~<4H@}Y1J=i^S}^MS-ah3y^hs%14$cyfopj~-$7`8ll&DF%HBgXGV+w z_ro;>$is?>9L3(FXPHYCLf@_O z4(tV0`}A+2Q)ccwWgG`oC!n|7;TF{LkSm2!wwIUBBl`GS8&*O&?!{;i2B=-iKp!Iwx| zr(v!wzYDn|GdjTMfdV7cUqkAU<$P1QOD!9@SvRH3_6L~0jSg1s%XYw>9n+01>OABh zhs5-jo98$;4`@PP4s2PabKW1*sR1L^2le%EVZtp&3+QdyMCl37uSrs7gr3ppiRRB9 zsTrr>8m7bxW%#lVZBe(QrvN2haXtOuK|S}TyemT45f3|Kpn9NG_fXCo zUllKngS?ND-OH|~wR)vTexO&X^h*xYKJ6+aebwxSt)}BzMPXhUGq@w>98U9%&pGR@ z+w>KD#u$^EIsk9YY`w}DF@OCe@;P~|DRwXc)xWKQEPi-)Yapg29j;69-=nNil)0fM z%s%IBgSl(DY-jiS&M94PWsWZOnzjIKSxoF%jiQfZK3g~G+_b9aR(|SVq?2E0apw-O zVli96A5(kuXywMhdx#wyZA74cjF>uH)uVXRbz1@RAMSx1UUh+eD}PFC3Ai);UzK+$3xIN(b_F*1rgH)%_c2$d{Cqz%5Wd8dfLUb@NCH zGWPRFHPM&)WduN93p#NrDj&f|sE7UxlSCt2n9VMW1}jg#+0B#L zyC1M}p3Ht|q*sH5oLE2vCB2{=6EQMBfgWHbjvl@p4YYwJAaB3mHgOXXg}p_wH96AEkHv3?$;&9hRXJ z(DnVhduh$}>S~(I@9kQDz%lgu3*FB&DULW>kg>w0}_q_l!~N=GYCP zqli5X<48D!v@BO6`kZuR0xKc{g1s-)Am$Wd?Wp>krZKKz>+dOQdzQGqR|b$RyQV@_ zpCYuI*rp{r>&y5QX)Uj01WU`QzJE%L1Z{TwZ17n#bFY7KA3%cX=AZzHPFF5pps| z46X2mE>GK$j9k%dTVK@)oKBM8!lb9Fszmp%0;`u{&VgH%q@$z2=^urjra2z*ZmST# z=u26z?;Ftxw>;+bSt!R!4#khD>o@X-Ff&bB7CE~f{9f)?9ZW@F?F|nH)a4+#ZCF*= zv$6uVdSMUM^fk_m-1onjfR05VUAEsL(uSWxZa9dN{wGwQJB(9PQ==_}YP~Z@<8I;i zs74fJnkT1CykZ|iW-P4kbsf8|LgqaFM{-ch~l1qKvO5&5qJDeaN zCj2jWT!#sp`)_#MvxxVZX-SQwl>lO}QaZe`rIH;YY_mNN=cvdjP18itmopEx&HdyMmL-o_%fT*#NJwb|-oMOP!aR3wZDgsv6%P3a-X_TH zrYL<8c!`9H7QggWI!vZwz1N-nu6R4G72PCrhMnzSTiqw<(#J1+9HLCUfWa{902ZJC z*j%Yf&X=dW zXs2seuL(QvjaKg4@ialywu~+uE2=xbv7$XrQGay0U$^cGe_~iV8~jm&|Hzh0ZeO3K za#!9duRSlN)|@(41mV9sg#WN?gipGx-GIJC#CdJ{=xq)Ur**0GGwhsowW?+EUl_C% zZ;am@Df)wZuaXa||56vNWuYSO7<4^VzX|UH`=~1aJs1)Q@4y@sk5;`s& zD;Ang*0OhyE&p&0a3TvbdLEmUXODgT@vU$2c~|68xKnT3c$hGbD!$LHL+_(YHix4z zO=v)?twVeFbBCqCzH`r6!28kc& zjak`JEF=U&0eK>rUdTchW}z?nkzo`Ym?av%rd$P3G^c`EkCb6=E zlV%jZ)id-|z`y%R)OKURec3=T6!S|R4I8Zac9TWlz`MKyUCtrQEojEFN=`hCGs4_b zd0ijONL>he;~2@bkG}i%*$cU$Aeu~0}`V*l8XmI6y}c$*fT5T@Sz%CZyt;}^gcn)n59uis)a z%6Ey1y^Oe1wCZ1^?9R99pyB7W1_F!_O7XmDH!maiJPOo8)VLp^dP)_9<6esb&1M}K zHe+p_t8GdpRawrQl@3xJlTs6)BB)Li%b+Ha0j>zjQZqhr2?pOjq z*F5rlvX_8?fD3sje326lZ3%hV)0U>s+II!b>84xznC;+t|9-EUZ|Fo+7lYoEr^W)n zt+yk#z#{q9wd&yB8B;2zV(($ICfNnddIRZs?DYJ_`5#%=-h5I!{K(K6`8{!h?rLnnM#xt0NIQu7zTi6xk=s@cUIP!yEpM!v{_N8=sMy2KZ)6a(4oy0k5&;r@ox>nW> z_%v3__+h`1M|E|e1QnYSR2@494u=UU_(b;N*4~x+1LGbs#ld*_HSq`^owI|Ws86(X zewt*LW~?q!P8;XR2vCqyExR7;&XbW6zqb|rIF#{|*jqap95tItd)SuI6;a6Ct2`dq z92fDNds#LQ_zirsVo}w)I*a4;jt&<@`5WR~NE-}s74QvKu21)>Ctj9FA z*-z$F{40f`gdy`Jk}n_@RZm1@zlx}~Sxsda?jJ9kJWa#+7#YV)ZR*_&Nlkyiu$7fn z;X-X~Ep!H-a`WyeCslgW8lvRatwR@Ps`I*0qelkuc0$fiLD9ly>GV;?Q0lyDsv+tw zCnCf__dw>d*NWCu_=qW~*yf^bx+)DQQGtii#k~oah^=MGt^drOyrLSCeS&ZwUHNM=H*!tvWTTP9y*1-Nz^@b zI75hB;ZmgErZ%nj=zt^fsrlANHJ8U?bGF+Snv12(R+6--k4r0G-Jh0w-7cjJoVJPh zp{yLjZpyy4h^^w7wlD9M!#HtXSnq#WjXjp`7R{kC3k#eI3oP3&?jQA)UXF_JAmLq{ z&$y*Ja}IMG7MHG+^zNJ**TWsqE78*CmN63NQ5QHn=HtRI)wwHmPUG0Qny^F5Kv@ld z@;X?hY}YjbHh}REdJNxyhzv;k%KR5hUt8gZoA5` z#>>;E1}X;gMo^PmOwZb*mZ*XhAxr#nJF1q5rUzPGwwZca|LaTOzVQC(NDFGW_x~RX zcR|_bc@k%!8QQgy+^oXa&2Z1CxfeG6$_~hsi%AZNy4JG59DGZlMdZF%BqYrtDfJ~= zz77hd8}(~K5#n2o>*i7j;Lswep8Fh}k3f;Smsdg3=7T|kOd~MfhF}+0!4sDPLBw_| z2ohQib1teXcpMS@74_w@s+cZ+PAiRzi9bqDtYYV(TnC@7UxRVMC;=_7 zrtaBux4MIHi4i)y=3YY8WG76##sNW z^}ZwZb#ZS{O3J zPM#FpT&k6ilaG(jwU$1|<@Sq8`|6vQLhg^^_t^V3x)+75S5BUHD8P*nE*_3B6y3;6 z{EU7-m04*5g=E49-cZ)YqAW`SZ#`8;(N^?_fSDb0jLz{iyeH@F+H5=HU}mSmV;rJh1mj?wFHjOV~)%bQxVo4-`Qg6 z{uJQ;O@RAegV=d&zrLZiG11=rL_oBjRdmX2Fel7b%@gbWbeH`SySQN~#VS;Y?A&>g zmno4$r%o)nKX!qg(QZQStl;SlXbPTa7*2E$a%*_3P(g}X#AUphQ{j|l)qPbGt?!>D zC59+`t6+AoJk9`r2kZT!S|VD072Z^KjL*Lvcy@7yk78MqZCApt8L0#_k_D6hqfGoZ zM~pZ-Z3%rx4@T<2=nSjndtNXDp-{R>_p0JhyXCsR%U_XP9})U26wCa+^*2Rxc!|aQ zOwKj`W`2sNnxk^vNoQGE3(Eu6h1Thc3=IvHpmX@&K9F`aJ-3ocGh<~+0Eu+&t})6o z!GRWs@U8J?{`P6pK zwe;sLa-o-j$(+$&wIm*m${$~;PK&#Jz3bZfZpG0$a z>D*tKZ9ufM8|lv&KK-oFZIs)!QHY`s>{G(4jQHkh`Ad1F!znt4BMwMWdjhS8ufomX ziQ?VIkN1}wn;RI2>5iKmDrC}oZPoU6b6^x2z_JtD{$a$jsz5kE;2HyrT3 z8XFz8eX65A=@Z>|X!jW;4WgQq>1WR_=ODY`n|8d14ai5csggmj-a!*lWgX=0{%BYa zEqJGFLkT=k8HZNxska;2dKa++ex}Tq#7vYXtTlqBsUE8MawVREvsuXGgOq!rj-qBJ zb(_EAq~QI?S_F|W>Q*T4A^fBI3@H=w(Zj*S@`8NC!0dlm;R?ZI-ml5OB^4hnnn*8oCJRiIdBzd>^YLcgFM1cJ^7 zkX7NmWkf>*Lg%L00rpO2E8*vWdN@+)E)N8*_q-V*`4wO`$_uE0=DlXG=QXz5z9sMa_0+yC2|jD!u60 zyU;)`e?tqA2w{@=g$>xD$DK`=#W2=L1m4I3=IIpT_u^rawGw)td3x1buWF*1;-EK) zfLTMs$yZG*n6XxyVxvmCM=$USkw}=141u1NZO5KDdgHu zM5*|km$@?;V*xk|?h-3Mk5*xsD}eO6B<~@MdVZbcQaFPi1HfwcD+YlDPuOO#0X5)& zoh)~gBN?L|QZ$D6`T1E`?0gmnEMHgNSroinj^V65M_^4hY9F=rDf!LtD4w&4V^EUJ z`Hp{iHN!#csB%$oIi-vBlHkua&z~ZPjAE47AU2=%o@Wu?Mj|cPO;9Cy@S)iqGoI@E z%&L8NT!)c&B}5hpzC0?Q!)^M*W%A2LHnfY?zp=LTb&5yp$W5JbJHL9;!fSldCa)&0 z8Mpx??EJ~YnthvhbFr){-aj{q8zKQbbFX|NE*UP0VPW62*aRWLixabWaYEn03D~Cc zEIcTLjM^(TEh~TQ(U-RGJt`t8pek3?LOfbTn_Cc;JfxXHuxbos$C`&Q@!xCDlEnOu zN?_qT{-fKyweGUlJ*&`NjXXTZk1EUEbTl@IGV`d&e)5NYf6tMc#qeU!(NJe=$U;T?1NZrUsqV-tC!ynkyz!{=-7 zzDBw?k3Ja9j@r}(9V176lqa}zW8KSrThWXh?Uyi@;Q*6n9m$vbR4_mrLm>-ThM(Oo zU+;Y|tADcO_5M%3j|ThURauc@Qgn}&5AS!0AF1Nq3CnceR(3C{9DS zTJ~z5C>OOI6&HwAu{E9gel%*2{H?`sQ%gCi9KVrwmwVFM-TPaJiulGa7>`KlW-+yo8f2_x z?2QH}lV4llR7S#IHC%imLTmP!to!m}Ki8Gx<^AII?uX2`df)>;xvyLKSzqBU2-$#1 zSc)6e>Od!mD66n}p75Ji)K)kyAFX-*aHmNdlZL6Ej81*wJn~O)tk;#)v~`9CRiBHu zT1L=@)3sA^WUY~#F4~ny?rc7+O&%jhA+9&>Lt~fUg&r_X)RHdm*UGuhGg&t4@`2TO zp)tzEgCtogt^ec;^x{o`Nj>G(eA3auPhqHdKz7IHWPT_1Z$V5$ATd}Q44k`8RB7U+ zZqUH8wwj=h7>rqCL6Oh3+fGgWS%nUA7V@nptW$a8q=FsgB7O1?^L(h3QwjI|?3j&DD4L#9qHdbX1n7#|=drrdIeJ>M*TSkYXD z3b8vJGaVz(vWxh%&s&Kktd82WNA)}J34+3g{QMFS& zzQCH$UoI`k3ZG~AbD6uxZ;xVHvG>`Gs7vTR1ttdL$EQh?mKMzrEYtq-&2gY z=PwLRs>nT^{JPf)DnWrk!l$McBmjQR{KiO#Z_A^h(k4N!JupeN+{@q*Qz1wDzP<8$p41auvPW%%H z=HrU6PwFw`rpBhGCQZV1rrF`px=&(u(-V$r@{%aKoN$XI3e}Oinh;-!1*8(w7cIdp z5rWP!zQPBudkAN6I3k%$zPL(4UcSG(yJQ7w#pa=rH!w>A=IDkImB70+aigUSaU8*R zG5lLDbSuztxQ&(h&O0s(qm-IUX7ov0lw*(TJd}}E;(`VwdsH3XqubfcIS=+SuUG>q zvNkXsv9oxwQ%`4R{nEl| z92?wN(2#2kfC1z}5%1Q%BNXMGAHn_tpxeP-u=wHyn9jAZ3~u08SU^>{zHtd1O$_jbS1BkcI7uRrrlu-x4z2l1RiE#ZA(kOIRzhCCp&iR`h2H*$ z9EV=4mnAQw^5ZfGW6{#mf1#xg#Mon!*59a;i?x9mR&e-lCIK^s>2zqKWx4C^=kG8a z?`j?aw~dFIq<>{TR66}=8LY;m6S&`yw+os7QUL50Iyw~c8!cy{kUY&`=Xmc+-i%Tl z-weI!_!>D=A?((d=EN8Hg_Fq}<&<6w3DCTIO7fwQ%Dt7l);+|2pp zX)tsmGs?zG2D*gQI_?W$PGqEr#d(m$#gTM-42-2?&X~rzL&Lv1N-1uHXx7TgcPj?N z8^h!$op7X_IEz2wPN?Yp??8g{g-8*khe<1N&>Oak~r?JQq9HL(6Onk^hyJ$R%`)T>A>fyhVD*Lk|r?nCimIL%oZO6&ASKLRfIOz5^S= z6bc?t2{uKbLuv^vT#ySA>;r>8%}0$BQ`u8eK7jZrtkG90({=3DGC#NnKwIEPG0_qIBvzx?UB|q5R?Kq62 zR!Pob30$;6sCCB&WZvO!F*`bxPMZS?Rajbf| zt?X0w0wxrm@Yo@76VB14Zd7(Qn~9>mr4fCFx7i*KmBw|4U7NR0ezi08+VP}8uKtA+ z_A3OIqGua!1z}!U)mT~{H$MMzjmqVx3CD-&LRIEVBiT7jYvb@es@%$A=-o@R7&bPq zv{*Dj)chyb&tr5pkzn7ylxoATtj)FRg|piJpYTQ*i4$IY0XGG$jSaY!jl-p*Q=s2{ zYkz-jZ?9bwfotU=5V+<#i(1c;LebW1NBGDJsLm%h=G;lG_Cm(A_{;= zyjWlUdV%T|xU^0A=Fds2@KqRF1;9?B7<+XF8BgP!z-v0 zpS51IZDnI?GM+pH6%k(9_udq2o)b-eoZo4iEWD)JPR^Uf>32#E6TE5S!InjAJMPZ- z;)2)&Yx57<UKc=Z5wxTUB=U3k4df_a^ zapBDE!z;JFg$@RSe&^T5XAsPD{dcUbKJsvv6bW01(_lbgEm@1%p}6sL&kLZI*i@A@ Km2wm>-T8lGZ)9Kq diff --git a/release-0.19.0/docs/getting-started-guides/mesos/k8s-guestbook.png b/release-0.19.0/docs/getting-started-guides/mesos/k8s-guestbook.png deleted file mode 100755 index 07d2458b3b54fd0975f35f0a6f78fb0e48e287ef..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 44000 zcmagFXEa>j8}~gk2Ez^yQ}J}0sxKa&*B zCj31D=T3e&Jk7RO!xzsjF~-ukjB zz^|f>6#w?X;dASv-K?E^N#N3I6{=d{eq=g$mpD=VoCShM z2t`3_YwJVCcb@EYtUx|=s{$TH{r7KMy0Wyhh9@h*+umNH?a!ky=vZk3#SO8owCX!Z zjFu#{fv2Bh-pnd;9IUOT$W@c7GNi;f@9xYg(@b--BZhimk&azd!--+ zG!A^;_J{p?FR0Z%Ry$&pnlg&TxuO!l*qqokD{HhjevES)RO)rl%Qz?mUub5gkSv#5 zUHym=65653-{lb$LQ~mqey^0=bG>m}yb8wU$G7IoVxy73LvVqK7!!d*vV$~Uh*HgX z^LMurOWDcZ@7`O~I%2e-xRwg!c_W?$pw|I6kFp!no^IvGNOL-1xN7g31=6|SoXttv z_|+GSvZinwsg`9hmT6Va*9=L z8QqF`nv0tSEZc%n`_r5;1e$B~pon7gM|5u+B7cc>2Yu&86`;N$!*16fJ(I6D zz1gFMjE_#X?7Lx<^A zxMjkAHTowZnFQ6OsH6SdpCG0vw<+eE2+o8C#5>Fez+pK=k|-?59w}L&Ye59)B&Tc* zIvxEuy(2KA=~cxILLPx{Z5l&WoCm(Jfo*jkDda`P=`3ozxPz<;Kod5EZHU(K)!ynK z-AMG~(t00d99ZO|H{?E~f&8_>gUB3m_N|W^x>7)^SJl-uHKHC`&>|0YYgM%y0~$*9 z2nr~TGI>*jG;qfm0)(8|X%p(5)tNZdRxEWj63d9Z@hvZ6jNa381~>w9^5yWR$XrHZ zpw=I;WDx72$3klJ^uiq9Ki{~n?y2V#bVF8y2&X)n4@f55?A#kJ*Qs~H)DUEzg#((9 zln-q1(mKf3(O8WzEBQU{K6(4{qQ1WVTm5}{?*9^=Qly!#^@u@I?n%iK1*2(n((aqr z9ai)+nZZ2yCn{Q1Y0h%W7k>QAwuz(diQk_VLB;^i60eJTof?R1-yy~!b!VUJH^=r$ z`AnH*Cd|joN zrq*zj-1;eKPN^gem5wlT?P<7ruag4nbKOV%pu!Z+dr6aqjyAF*Z$+XyU_cr)Photz zzLeHAtpI6H3v=%p#Przk z3UB;^U2mFt_hES?y+RW-6NKejuzrpb_c7lQX|s1rr^r&}ny?luJDIW};#!LdKVzxx zvCnK>tJ0n11{yj?LD@47IySg6xD7@bpFMF31S7;e6@%_1+XrVhD%~BpZ_=QTvv68E z74uDicIPrm3(wVgu?_c1GtLV=sU-yrR7mUdm$$@GQWoNP&HnP7lgI)|Ekb4YSs`-V zny~g{Dhm#m!}`A_JyNPZT=F&tx>A`z&=AQbV=#)nLqN?u^7^|0bpUF0Q{@Jc-&U+Q z-C?d3iCGZ|+F`Q|n65UfDfKaMBTHk7WUCUIWNR`)QW3V0#%ys0;qR28pFV`o-WxB*a%u-z=k5|6n^ZjG{N zJzALmDic4wv-9GOZgCrIRacarlUrRSW*EDRP8X?^VhK;yyyr@*`4O0>N-!pvuVq%S zmasM&dHM{2VzIvb0#l$^O5NpH>oZ?uG?unfk7&uL#^L+SA+N&U4^hz5Qd%bTT#qiVU4iFDp2pQ9B8 zdn+L+gNfo^mNhvsPrjrYyTkYfZwKpgpIyPr=5H1GRy@;=Te!uQrd3}B|Y_kIef z_j2hengtGj*K;UDG|DxyFgR(BWfUy8Qc?eGGBL9|4$dB*Bs<-mmFPKhx~Cujch%#4 zlcDa&E0-T|A>rN?l3puH8t?!nA){2dK7Sh}Jkm@t|td7Q)IuQ zabUtUFNG>JiCy&xf!z4}nS-Oohj)+#wYY^Ft|w{XvNCoc-zDXbB9e~r#@%3V>{+eF zyz-{J?2^V}WNta6f59@d$!Jio`6E|=v&S^vI)ygqS?rSx^Vl ztPY>D$~cu@l~6y*_EqYk06iwgyh?_w(#8)!>@XoQ$G)6tz@d&Q*`1$&r(BhUr=vE6 zto`OYMujE3quxG%>+SUe4qwZcY(e+Z%yl1h(Ij8=zV2expGB0n$dRK3*Aand z0FWj##>4n6|I@@j5}!J_o3(Bhj2K5h5tP==N>rt-^*eQBU!mdS zCe-vH=ytfHYD{r`HTk!OM*+}r)-?l;-7^+Us!uJ|Wm6G$03Q>!^1VII(=1l7hm46x z%ElwgYz{U3U)^krP{HU0RhAizF};Ia@ovU2 zW$RC6W#%s-*Z)BsJ!Xc?hHkVfk$Y8pGhydk&-Is?CPbT_E~8`#JLo3JF6UWz~bniF=Sj!)6}1V0oxO|plJ;C@x1(=eSIuhz2&e_ zL_#h@=-fhScL-9gsR4E%j(Nu}!%PMawcC7bXC)CAU~?AtcoZ1a&Yde44b)(6StXL zKiY9xO5Rh=hH}rFn^SuPJW_`WIxO?pjuH`A%<(1@HlQZ=YQA*07ElQmTg z-TGf$KgdBi069Lg*jn@15NX)b`Vsblc5O;q|NX}u`$dzJIFXoeHx`R=IDNq^Tb@=J z`fgAil0&1Q0W+^3HhQl?+RUNh zyOtR+N8Wxn`RM6fK;_AXGuWyAYU&yuR`o59%HviG#d9ar>>f^D`|ml^pTdIs(Tj5n zUr($F&;o#F+0T2gy-v`pd*c(gCFupT9OpP^TT<3^=+&t(g9Z5-4r{QvAEK|?o0@B8 zZS~-SO!xJB1)Zw++|ZUwEi{}t(46NIY4)6gy&0~w_IF73$GNI^YbpB@uHP~wI=Q;Y zvV$De$U&o$L|)0I++?gMv2$2IPVd$@Z%P6^=y(Xub2u)r26U}s=~u3`a=VJsNd}40u43D|z_k0~qR6qII&Ym?aET!^X+na=L?PP8iW9CaoBm5`8(j zt<+$SW4*9TjzE9_+ySq_k)^DX_1+{+CC37jJD>j;zt46w9Qnz?D94f6VN`v6@HRC; zTp~dp%iD-t@s`em?=q=~ZGS`av&RxBqF|0JX&HkUX;}>H#+iZ%;STPlh;n64Ju5q9 zU|`@Br-Nmz>Kk!{k5JYO+yZYpE7AR9#;nGC&<@7>;W%8cRQR=|j`Y#)u!^2+Sn?e< zA9tOw(+hEeTdZR0t8my)sEK4Ucv?69_8R-=>CqfLv<3}yVscm}viu5rOI zn`nP14z<~;{36v-i`#WQE4*t@11bqa^nJ`sWjp3>vL9rA!l-lF&^(ptFpejv!QzGG z&3qduo;ODA1MTJY+^1Sydo+6Wjrk*hEpMoZCs>y`&&%o)(- z6E6ixn;)qxx!$qOKhR2C>84(@77ZVj*_F%9RI(88An_@JY9L0PB?;&`eGz$El0X*+DI2cm_ zFt@!UvfpiK%=1|5HCM6}NNG2WzKY+hbga9-of?8)`@S&20&TaQ(p$=$_h?g9!K)1e zFD%W)_>YoR&@|b671^Tpf-S060s#5siM$+GyosUlC$%I>n@G*&Eu+i-bNF8%H1NdxYV;UPs6C5@<6 zZ?l?g1Un~sARs|?cH~v5foIBwZ5wND$079vN@=PqdZG5@(ind4oeTX9A7?9 z%bcAt>0Q@w!g)n>-E!wgH~(ngx02c%pvO#UQygsjq!r1D zcL;{ZQpz1>hU5Nfz30iw*F*U@^$lV3@}uMr0UD<&l7 zQb^*@zTrVYvDs03@GE)kTYJ@Pnp3-X$KB~tdBf%4h&URcH$t)|Y>watA;LBk2HN)D z+}NCls9xiqlal%RrI$ZS1&dHN4p7dy4oe!%dwrwqO@H5u6VTHqPFg8Rb-i*{WtP7q z|7fnPtZ2TZ8ywzHd0R3VC4AGbl{EH(K6-DtXm7rJO)nHU$rmo*yenZsE?D$47zzg?tS7w6&t*cSM-%cy;tfsa4-FK+{ad z<#qvClIFrhTxLaU9wnCAv8pAgl=}~FJ+i%Bd>zJ^X)`cL z;SSl&i}-Zvx810f#L90VuY%r30>J7Cj&y$biKe#_qxE^ol(lMODISBk*Oq$<>-g{# za$mUsYfI`db7E>R|3!9u?I)<7y>N;;#j38wNSbDDckGlklYjin13X6CM6=H+7{J$j&->kU(qMAEaP?EtY5)wF82lj3hF60|l@^W->RhBep`m z665`Ls^yTq67D^g$@H4fHeR)*>8xn3o;$+0)jI&j&X!qKN;cx zQPv>QmtJRg$l;@jZzWvEQ#s4L?6A6?R0LzfP!E0S2{d-*6@bT$%&gC>|C&u;#OOhu zs8M?oNl~Au^pm-slzCx1uFV~11Lvh(G$_d;I+Ixdlo61aB<0rVv?0Zc1G8T+)`SlM ze|o^sZ{FE@;a^ctvKw3lU~(-0gD3|PYTCi?F90%s$s^f{=5=Z` zJvo-4n+lv`0eYq4Ne?Qsb){UEZ#d4)_GU_Oq%E0%9G@hkzjTmsl9lE2CQFXwDRa}C zvde#TN*o?G)aaGocjo@@GOya=XP{r9O7` zf2(s-iV~HH0IdWff}P4V`Q*brp|@>(e2*J>pYkx>e|wRR&2-d1+7uKa%C2h1^S@$R zP_y7z)6iY|Pyu)7Pf3Y!jBF}ASU20Aii6nYIZ71!UW*K^Q4L2)k<~CcnLqqS2E}Sb7F%*c+E8`CmIyAj^oTl+M8|vAX>j2}MLi~UF%e|vv z87+_`lk_((x;c?r1MYFXb~{e>$iT9J#R_Rr26U|o=VJi5g{C)Pqn;o~-}^<-Z`59; zJn7b0ik(v>jI!{=xevge8mLX@NBKI1hR36+^y74s`ZfG-sRm)|pvB;add__J{=~8c z1q3WL9=P48q7W?*NM6_unRa|{Xe$@6h54lJ=MYf5u6j#_DN%-{dDVM#*Ta#P9a3QT zhdZlPZqG$Q3yQsCy#(AwnG4}H|KrOI;Mc##Ty{qdcRhvr#>4Zwi+n9fiRd!Y1nb6& zSxqW?jT%8k(`^R@4jLSo{u&04G~Tj$t?;{54z*=v0VQ(rmoN7w+|{P#-{!4r`dy|Y z&>t-;1~5rNO9=-fVIW7bSY;A7ndI@7oMeD<7a)aOV z=K*3KA_(km<|Vc*!|EvE?@`e-HqmQXk@DYU0)gjF83rKO$d)-QW;%I`6H4sWT(%XD1=BJ7Cmpc|>G=Vh4iLW)#M zLPczUK~O$y%pA4Jo1a7jR~TYlI{g`c0N5d3N;tW-$l*( z+JT*IKD61(O*v_XupfA+6U_SNIAv@ha^O;-W(Uvam;|U628LE&gVI0zCh`EC5)NxF{~kBo}lHWdhj%tqv9QgtjDnpiBzz8TD_Z9N@He zBxR6V5eNrfLpGCPtV?ga=l@{Q&9Mw}P>kKga^BXX?>1HE!aU_o3H?j7NAdh_tvFoI zGoGbXO~%@F(X{gV_}H3mhAhC-%8xx5`OE*XWkMTIKQUGRhI~{D)sFQNV}zPjwY5z; zAvN9}Zsjbq)Ulj=j7#u*HRR>_la5Ak^fZ&?6)3uEza$3s2&{0vb+*u0z^??W=7^)* z77gvjWx}La!2!2MM9ePcYtlQn91&?Qm{-S^y@HLpsfRYRot>RuQI7J`>Zu#hClp;; zn%Vfs*!YD`sqZ~}l-x3;%Ab^!Q##~lXr>wO)R#qitfVT^Jyr!HLv3!UfN9Yuz; z%2wIuhpKF9dn{w2EvGE9()!HUM&>(>=Rr3=dD5a$KYi0vy36ldwCU}s!|!Iz_syX5 z701Aqy`!zglsh||!@AeNm;N?1(qk%C#u+x+MGiv8sFF;f!sm3#g(C~%9qXI%41p!t z0l*b9N@}~@$qU}%JDh@>@Johuw82WbT;4oF7*% zlybH*gOr>H97>ux{Hlh6Q7?q;Nk(rntw z4-3?chxmIc<9i*6@s?q~(G-*E^2pgVx!W$h$M0FVm@q1qA6~7oWVagq`ew~-3*-c- z)5A&)*m!we7SJ!-7E&X3J zLy`@-ypXu0!l`=8#`Udy`}+?b#JjQV^){+4fw0V_x;K^FlAj@#+T{h{F+$^U?35;x zuelu9y?a%tI2w_e+OkO>rZD@5Wj$6JxzvgDheB!Ov{IHhb^3x6`lzzj9ktm|-!vX)p`%f}#%ukn!=J7%F$+>PiALD5bq&Obksf~xn5h&;!F~Ksg;1pBaCLEX@59nxiN*V#E1H2G1?}fnS z-w+t7El%nf1d(o;tqw?S+&ZlZ(c!V~h-Cz+>46-nq3!f^BL#;UEfi9T^=w%f4~6mA z5V)4ah1;{j%+`U*?*;5Xb0pVWdP$20chI)ECAs zcknDH#2>3Wwy9uKAMlC#BXPtj++PO>}V(lwus^MqUWGtuEqXZ_Xtd<`^v z0($2ncrCgix4_rFdil&Pa;>~nq(*gUi8u+5GytAIZ{^!0G2R%e>b?cKvg1CZ0)^}V z$eCIY-rM-*0T0Y9VjS;MZfFXuTQDWaIwOUR0r*Xf-XQYt4XFIcZHj<5Cz_V_~O|)P1yEYYEey7c^i|cZc=-Rhx1h z)(h4r8iJcl#0EBb{n=u$w`eomA!#NW*Yx&>QPR!j77!Ez5LFA+FrIyTzViKUtrb?N zKa(Ec`r#gZFykY$pJYvF;e5~ew~zlV{5QWsiMvm3@!rC*MC+ly)>AaeERXxiN#W>^ zt=+br8;qnKoS4Z$SB!%4#H;=GB*4I!hP*<7QeSW7-9soJryWEKqh7P8`iK4%vKh&l zzS~WDraNO?ne3#l-akcB|NMGP{Oy}x|5?~s$$Bp#lxgo9=l^Zsi~Ypqlb0$sT$>Tf zOQ;Wwk_V(wIw**Ek>OJPdK zVA@AAqolU{9Mrb6+#1eJX2bd@C*{RIsPa|1CqZS4kMpf6+g685P2Ej5RRO$1I{xJK zN~?>)ipTw9s5S^5A3@(5*%-X9bE90&5pOA5z$f*lH6t}W8IY&0D~XD!sG>?*g>t#i zhIizt0`lIA)lgUyzMD`<0;+~(_3jEjdDAtY2vms&Vgx%Xp}@J3tY^0ye?bzBjizGR zSkM*Eb;YP{EqKos21`>rp`X9)JW9)x_IVQI=vZ15c{Ir8?^fpKx~XTP`y>74zTex{ z&Z;ldIG(>tL(1Eo;#X&dstN}^%EkKzv4a^Lb>qC*uM<}wE(KX);S?Qp-p{o}U&Q?X z)&?incdZX~I}KKh(0VCk#h~(Wo1T~Cxh5dZ;m;is2lZ77uu!h zI!2*MUsAl~FjtgDhlLKkhu6t-tE~uWMRoR`M#bw{8;i?5bIH$K5=Rqo`1CudXzG;c z=&!x2&J$2pG6IDRTvqjPpM4$sQ1kIIu&d$!*p))ZfGC8JnB|Q4z~=P@LG`mX8G2o} zeCHfPIE`GBUd9`*I3qH@1fxWq4fc+%Qmj{Slyl4mmXP8f9?>(P8GT>FF;EBpAA(RG zvq2h%%nrY9@#U3UVcO&gFW6=#xN0L93)mxF3+t1a^ipOgx(4b_GsYh}1Nr^wJI?qG z{FFpAN2Kc6h(~E`M^@g9U0qbTKVoxBAFYtLqNAr?Bm*S;v`~cWys?KumHX1)x-WKc zwks4}bz5uDtB6@P0GxiU1l#w7%M(pvX!LbIK9Y}nP|4+BvH&{WMF&{C z$AD=yA+^&*hs%M;03T`r3_^^Z8gyk=)QVHMz=Z^9t-||Y!jD%AZ#~kE(YBnFLN&@g zVLbVtSy4~6+@2%S(A|Dm7-}Nrq-lh-Rly+C71T4b_b#Hv#w@c79!Xt`#CTS<0H9M# zl{?EEYrJ~x%Q6~E>t3xRc~uwYkK-3#+`>&1{XB!7*drCZ3&8O7I{8XYEqVRw6RQ)E zv??TLUwLW!BDE2<9`$#)FE8ix3zgnXuYA(ZBl$v_9ngoQmV)&9I@KvMn&#h9-eXOU zOx49aU`>gm7waw@hIYPU9vUEpFLq1_tVhIrFH}=slCxWV;@nHRGM9MRJ3QEZYaw(c z;$X6G=>Z7jf>)3Vt=`C1ki&;;gT)dpNh2=~8el@QjlR!WBLi}2 zA$-I5iVqn5b~^ARk4kv3=hUzG6L`B88;Gb8r1w%2R-VB2lKL|!Pt4Q>;dQsD7lxBm+ZYg#8_bFd zbG`-eM5Qr@{N zT12iy>!I)3s80{Y#1P9LKE&#wwH6K5rpP}sa6m99Ar^RjB8waJZKgBF2{JyxiO z&>sXiIqqGvTN_pbaNJ_pn7a}R=|>C>2Fu$#3wdQbwow4z5l)SP`e;TEux}bLwzp}J zM@sUl3g*jE!(8itbMW)KS_1v?mU>BN`p|9R>WqeG9RN_Ep{gzNC_dgspvG zXha2@UfbM!^7~5(&&~Uv)(4ZJpDn5Fq)o#^Et#pgLr^3XLn?ux`U!;IPI~3K zzBzClj{+IJ+mgE7=@iGWof*RZK{=cNs1{+*WSe0Cz8W?d-Vl$7x5&E*(d6wrOw1g< zVO1LM87I4=*!3=rD{Qas_1&N-`C^wkpSqG~SjV%&HKF)eIrRl_T0>T05)JR2nH>>7 zKL+2mXv)VShpPWc+;98fCU)Gh+@Y3b>aZ^bbZkg z*Q(n=cijKV1PIq6Vfr%);eg7{f+kftH?_{e9AgiwC5^mqHveV8Si#{em+k}>$6_ckB+9Gbpf|=*2nRr4vvz{q!HjFv;ck$X}YX5LSW>6S$l>nC_Hu2k{_=NtH zsnxt#uTf}S-#DLXj_3&9vixN>NUfDg`RGyDwz6Vy)zhHmpeH`&f%QpKTSy>3U-b;n zzr%Rv^jqepX*Km7)h}OuEsdc+&f(R-*t2;-N|75b1d7t9lpYXh>GSrD9PDj#6#>`~ z^m;hxIUzUQQK9e4+uL@h|K8JolKwJw?!s`RPeOd7y@7AKIs)%AUR1A3aqJ?xyIgyD z8FgvY@$g+@n6NfW#kB_zR6t)qpvtWzF7S=`3fE_Mip&e#h&Nr$Ll=Us0Vf6D{U{DY zMqL>QYlT)m zM-%UY(yEv8(saKy#!nN=q>H%RKyJx)7S`t_mp|?Iv2ieVHKG(UwEX8M<0K_$dtT-$ zKns(|s|P87E1)D@La#~sR1WUb^BQ4CX>RB(s0mO_&7wf>vu0?Ag zXBpUH^Zu&MlHKPVdxi00XDMy8P7e{^kkKfl6{&v!j-<3{p!VL^1*+#-$%tF^Kw*rznn= zjF?6(FfEXC8N^Kk*0q6JUpo{&NI2b(Dwm-%b^k!rR z4}iOVM+H26yS$7~L6kxdjF|xf>PwAYaxJ}3zVnoT`D(L4tj%l-l}xnH+1b&?2X-_; zzKTF1f1+TxSUV}XUEkb1CX$*;H}_*B{gNyZd6fM2_mgzqRc5Lcva+=5kGJ7No; zEX*n5?WO;&^J#hS2Zvz(Y%QL4o=?S#|JgL^prA;%kv(4e_xSO}T- zu(L9T+yVp!kjzrw#Wk^vEzw99v(Gj5XBc{V#Ch{LUWpO1BZB4dfQi?X%e*BB0AwkR zCcQ(;lFM@3_>C7%ZPY4O{v&AoTsKzB_LF2zhlbJ4ULw)#K_|uG^6e z)a;swNG>MHHL6fKbFuI~9HnxvWHo$yHC8UBJi!G`3(^zgWp?6d!cwg{a26gGUPl!0 z@k#z354)=J)m1CkUaAD<`Fvh6n&W&EH>#Xu%#0-#>k&-`EHhkE77G$UH;got_8|yJ zWLpYGj}40-pvVSPFefQ0`yz(-51_O*adns_`IWuivy}$QuZL(j9fXd99 zbgKF#az`hx>c3819`RfrO{a4cT{fc$1#MX)Q)90$HdRMYlaqHJC>gt$R^e({16aR!UBzeJ;Nm~imwyHxNStlvxx6<0xn!s;-MIU%s>Lw9 zAOcDjPufqQU~Gv&^JOKD_i`dbE{gtMTKtrGtmJ685|Q@Y3)TE5^cpWoGZr|%9^S^0 zbdD`h)B2~Ka9Mw~pOsDuPSz8K#b7j1GGdll7BoZu=F6vvn-pxh2;(<5*UwSV8es}-7dE_zw$8x`Mh@0W| z#bGohv~9^L`Olw60UIHwT!C|$eh=<^^I-KUE;+8z8wo?G!_V4W72q1Yc&}Q&cPZ== zU1#g1R~1}l_&l%(A!IegrXg{NQnB~h;(Y$Y`dyKJRg8L zlq>U0EWci!V0=z1`ERVO38{zk;%jN&;=B$6MUnjN>sboEbECYW1%vhKQp~@Fp6Lnt zyEG3M5fZsP{Q^fyd~o>-INuSo;Lrju8F+IAuTN( zxz5a!Uc6h&$9&whd76EC%QO8WTX9oK<-tz(j;_S#pqa?vi10s}%x!5YN{@bv;~1_& zly2A!*~4L0o{NiE$J2(9x1AwmS$MjwwTIf1A0;(?1W=Bm7LqJ4_#4>_+_i!Vn{pYw+gJ z8gr0^XUN6pci}Gswo;f+tGO*7zJJU4PvSCg#*q80B&`&8gvStAz#jDa&cy zd;le4IT?Zxn$uqr*!86?BxlliKWf=QfLcmd!xHl9aa@Goc~K2eaDfz9YGDBW3QRFe zc=^&#=$J&#jAFdX@G4tn28@D{&$x&iFY9WY0rc^x+0;N4d8ZmVL$`lB5koouoc~)? zw)r`n9{f*lUgB9v%gyP@;y?dGtK^YypN8>=^z zLss@LZ{1s+uF?AY_lj|DUj7-u6nP`kL4T(Ze4~i zz1@Gbl_C+Y{eYt&XZE@L=9emR+Q#$=_my7d*dNy@SrU2qch0LL**@|&fr7r&SHi9d zYss%q4Le72w9E8mSc4NjON#`MRzO6k7eEJp z)-s&)I$^CS(OP+tm-|gKQiwrHY3bE~H#q(7*aV2j2NLH|2XPG4E6nf!guZ9=J$0gF zO=j%SPflwY6W~^lXf@})hPO2FgSa)C?t@r8An~+79-tseCwSrb{JZOF!45Mn!_o}q9(z5VO%b@DqFjMFAj-RvZa zA$*m&eiXt}cA)L|wbFxIw@RPlFsxeCy)UX*_=U_iJb5pZ)X8HIq)dX;`&= zQRq?X{7^|`Z^G?=L+*+K2EUKvi?$--m;XQwL;XHozWDcE)Jv-z!|Mq9AUwMgz-Rf*e_W`$mzgfJ`wHlYsJlki#7alJ}27SM6SZMn9`B={n z(!1f+(qG>{O8u&NyZ>*z=kc41iXsWazq@un84dfz!w#gs&nbqbDQ!mhr2qTTHdDnA zzTbY?ys7v);xAw7v)Z@y+AN}$G>Oc7Y0SE>dV12@wLv(x?;J^#eFMWJHX%hFp)9NP zM{}T#Ve+e2vn2;Y)2&V8@N-w)h51EYi&sBAtk~Mr$hMYM$$Zi3St$9<2G+RV>QMtz z-cu4V=K*sEA6xn!fQLu?5QD+!PfWbO*pje)`t(YvSZfdu+hPUvGQN2A<=(UDz}D6n zD!S!|W0;b#Z*S1*aY8p_WKvU8p$M_FDef>KU1iU;CY4s+=J(tK?+x)3Ksf`p<}o)S zO0>Q0bdb%im(gUQ_Gxz)H{%<(zO1`fbxy(^Z%cG_-Q5MpxXZe`SBUPTF9NrOUYW?! z7a(kJ>*y>FtoFsw5agxqEGDqH;E2Yv^zUypLC--!xV_L$FIGdFPfba+8=0Sv2<(Ds zz2U&-lK>|gXu=1G$g>;_&S@S?=wJgT@w=G03s#nT#$c3tS=|aUZ}jeeqUToPU+&W@ zu`rKTN#fv8@-j?P>Fn%Ch$>feXk$D&GAn^vyf`)mGB1KazO|JGm?2Ud@XBy@|fyBIcik6 z-6}{G+||$^um{n6vA*ZKGaLvz=jZzIW}*lUbuOGX&glsHSY+k2HRAQ>$oSsO&tEz|&33&<$FCgyr1$#Oir{77e#f@UDO*>hGbLZ!;Ki&T|^NOwK$FXj3?y2{O#OrcG z#dE1kq3JU#x_KCUNbuK~tKIGCv}R$(@cESD`6a%c5E%D#?B5zsj zp=OFcb?Bm1Szvjqvdgf8Y}UlYgnB&vNAKnd+0Wk1YyI&LIwxeUAGFS2-I@mx*51ki zLLUTviv02$9^pI66qVBIDmJY1@i{oCc-zglYk(UP`2#QZia3h30ga@0E3sz9FvXXc zZSIdVV1&JVbbcj|wqC{}AGBaYHipM&f|w{r9CB0to0 z`LjAbCBl*|+2csQfW{r}!o5zFnyPkVv{k9ro1? z4C3efL#YNLK&tccVGQJkiNK3-oYk)^s*3!JS$cN85iU@PDaxd0Szh|;j~o1W1`WR? zgfv&z<3W@8@M-G6`%kwd1RxWS0OOEeQlKnqm|ulz>iUBh&hZG=E#AqXS+BzA243I$ zXa|Mg^zW)FoZS!u-#w)i-!m%rHUGEssA#IlvpX-|y-J3eja%1gn4Pai*nvVXtcN_4$YWW1WUO?p7JhFDiD0Z}b_@W^^Z*jJ1{=QANi$V8c`RDD=IF zsaQ9l`q|#MwSZ~XVaZ+}4T%zth0MMVUa0S=Z&m{>BjQnxN)`}p{b5-ZDPsX%yDzv>@2bSYs;FwB{J6J;qu*jaY@<*9%Rt-XE*!t$z^BwBer>`8}yUgPiho~RM&^+ zZk{=Ka5?9=)Nk_6c4Q^Cw6$iv&%eTk=lOQ{24CPoS*(qvon6~LYc;or?VBcBR-5Uo z<(PHDB7a6GNI6(u!^lASdQ08Y$39Kz<~YTn^wC0B@4<)iIWjcEAzq?=MkFVwXQA7LLp))ye;Ji%nwzxdHWXr{<)P+jyg+j}hGl zdE*bMKffezinE;S>Z>_ZPuR48H&#T83nHnuzp*Ckl)R7yF`An}w4tG;g8~k7?wRUp zVtMzx`6-UKela!L&w51$l_m&F1gb0!4!>h}YT}L+;vpx*@?|rLz6NA$UVPDR{LhrF zY*gsG-$N3pfx-x__Vkibp8YU4x1xc+1!Zk*q0+cJoGvlwcZDRiN}7`!(Q7u2bme*o zHX>0mO@NW9=op^(P~fHbPEZp=LhI-nKh?to#&MCTKa|(~N_Ct#rT=oVH~Xsb=Fg7? znM%)p24s5N?O9{*1o=^oIome@5p>UWZn4Nd7g->2G_$e;HGP2EH z?Aof8gMHsX_G}W)$jiiZ+2c7RXDN-osgBwIjY-c82vvXm7AL*OfJbAx{*&jaHP6y| zBG!s7{6~FN*LJcSE!jjSv#Rc)H(mSI*6uOts*U0A1qON#TpiKBTHD$@1&(YOk0Wc; z@c>&J)m_&+D){HE;eq6Rk|BjVdQgqc=wO|{QP%5VxVtdtr9LsAHDVe zF&-Rn%lqwGe3L(!ddYCLV#DQS9`!|2?%Saedv6C>jM5742`SD_n$_PC14|83J~1_s ze!ZMj^k&|?W5>I7%U5>41MA(mm1nc{lgHxRQGJ5|OZ&Q)p;hCZQ6U$Wdy^i_x$bg* zbCg;q*-lmBtPDANMNX;))^=Mswr$(CZFFoq>DacNj&0kv)3H0YZTLpUTe{7dZID%b{vVs zR#3U^oHVBYE1LCro(j868IQeA00*TIHk z$vvJVKqMN}(YTUeqN%olzG`Bd<={Bc6#EhQUba}S(tEZc9Wxx82@1NuWSPQQphwtL z%oL+oS)?tw`j-IrH8Be$i9>3GO3PE(Y_H4UOZ>)}r2mqcwq(%HK@vaHXMmzY`va%H z?!+SwPHy}A+612Ov1;3o@D7#y_ot$HqCJA?)_qsq=W^1ByYBatIFB~j?`voGREgg$ z=oVW-XMazQX>M}RFt^-37oB12m{GV7vRn_Pz*L`SBiY{&=24OI{19SyBDLf#8G}*rj#P@jm@y!21&T z`)Wxqju}L09wuUNQn;}4bvzLS1Lp*t*b2G1MfrG5(8hjydwzN1*QvQIZdC|r!B6wg zX(?UhX#%tMFUc^j7A@Xp7VM``Q>PfM`|SK_RY{(|v@MP+z$+5jRO_L!_;Ogq*(1m? zGR30k;K;#v#(>4XG8cHa(uZ2x@E`W&-`nwt2dEf#|f z9DWwKHLX*|(y`)gvPgeSvCcZc&;+I9hmV%wxe{3`hm8kr%O>L8WTgP#q=-hR++73H zLT#pKfF!8*+iVKKsTG!pQyiG{szy2zG`G5Xd0J`|C{@q1}W%w#6cRv-5R57t|!%? z0K+EF>e?dkG`CnCc}{S)jbpJcpE!~(VMLZn>k>8Q*v)UqlBR8MEumlWWTTu;DE@I$ZI4>u^ZF-S{Q)?I0rWeZUtJuN9q{{_V-i-}}98gy(9s48g;)?I4%$ z^OpCfn>FO`>)T@T^Re1P4!7$|Bqn5=D$i5r`cHlQv1H)uf#S>i$EVh4-Phv)szhYE z>y_lU`!YN0&q=t{=+w*S1G2@>%UG%WM;~!f+umU~OLQlRGM%F_ zkYE)3Zz63Vl2n=2uCfv#M!ilrjn?iX44v+7Q|K}FznnSeK;qs_)3sgKoi1m;zU0q1 zHp^XUQ#68Qi2BGlb(@h+CYUnB{NiHz28=*TBzI7K zRQ%WGg9;jCx?-P!>@3r=4G=C!!68;gXz+_kkzSB<_ojP5r4aCtenxY^b0sZ>(Fi^g zdz)xf!^L>3R@$b!SmleZHrN3qrPT=chjqvhJ|HvE0YW@Tx9c{r3wIsZsLGY18yLn+ zaqXDu0l$d@m}r!c#Zw)itpcGvA~gcZjI~>S2@(>++QM65FLZr>>hwk?D9=#!jR>dt zOOcFb1h}U|0bTOKS-v7QgH6&x#ugWm!z!!s(_}F-$9S=t>Ult+axWHCErp6Cf@u%$ zB|@t=vY=SNurS$y0rI60WhjAk4!g#o-Z|yb!k77AX;TEWG;&7z;Y2|xRRP=zECG)( z0pxeMq<4B|llkmz5!Lk~Rc4&|7RTJ1zk7}Zd*7Gq zydIa^FB_)>-X`ueN1iz$au0 zC|eL=#Oa7ey&^kIJ=;2mKiy(V2n74!B^^gGWgV55i4of^2a?Vrz;-cj92=HPxVfS- zV405bnHFyYRj{-XVYcI3(t|-00v*bklV%hYq_wh3l!MT#@j`{4oMDmkxssL^qx2_X zh@Rm=w5M~lgf{)kjp<9VXT8xy!Lau({2%aJ^}3>g!0>=(o}ek%#PFhMo^8AV{smz6 z?gT{r8o5mt1A(&YkT>JF4o$-Ak(gph9Fa0aBE5hm<>>m6-PyB!EI^E=be*qSHh*{3 zm;epOV?u^~6$Sw*24dgE1(H@ld1UM@AJFGA(-?V@R> zuN18`c9UD#ErQ`S+pcq*W#)s2GS$n2wARny;4qvSkJ2Qnh?%r_pdi3;aXcKTMcJ$u zjP!!m7u{nekA#)#Vvw<#6MCg;31CNK751I;0TW>Neb)Ci1f zf?{KaXvEN)0(FTNh0tSy z#W73>out6mLWsE}se#qcK};Tm&p(<}U?x#`i!HQAzgc8F!iTZPKsw?ho9ZUiY_>!W z{RYULnkexE-eLFCcq9eIB(`VIJj=I#c}*0%{qX!=%WNt4RiyxgS&+2NNAn0DU?042 z5rZ?OnZh)V@e;^Ka$dE`#1KeAiDsNy?tm{0c|#eT9JR&Ev{jZN0ue92Fu7fi%>+!$b5J39oRN;saqR z@N%qx+Vs>ZAYqvLjz`2s_y#cY_I+L1V>0UhTUt77+q9$yB($Q9hMw0g0JcyJ603QR z89P`$z4TOqRgaL3CbZ-9e}=+xj{EPvAq1v7SO*xwn~;!nSJ*+8QeYMYf*NCqZexNC zJPFu05eNilF--A@xdkMj0C!kWcV-b-ctX!t2U~1CM6IwHQ6A1kBSZK#E_w^1 zo9l$b>Om|yk`P2loDg@PNc+4{%;6p{qe+cynenEVdAR#=jj0n!><<_IsC3J1_~BXu zCt|H;BGb8LnO44#Sgt%NbGJ!8mf|Ls?Y|^MHfzyl(M&A2iO|d$p+Z&ZyhVRmWTs`# zjR-XX&bf_BF(zyVzV&;&-y`WwO*)e+9`y5Zlf}&U?I|KB8=H_fE5c4Ga~#x{0Q6QH`P)kqANHiuEn9`5tUP1zTpqpO}R0fj#lU7ok8(92fuY$x$rPI zsnO&7AZj2rLEawEZKvSSo)DHml6F3`U9AM2HrMcAd2n$spPm9zH?agWg}w{3lvGR- za42Dw?ujOz{ud}f z%woq)(D~h?)@E?8Q{G(7;J+VFcD%bQ;o=gRp)o^>W}5ILvU=Y98aza9G)3QL8*>vN zMnG@DxIeitbYQ7gN0zRl`xzcn*uVTrK61E#qPxCP+5HY9Ogw-rDB*5PjhWwi8-ivjLGv{y_ z(VQTczVCpvuTW%GEfvlGUXV$i!Nih5HDJCFg=!9rw`3LSk!4wGG*xv4HW=LL(NxJT zR$?ca&&S%l@@F9MyHlG#a|GIq985&CAEYKNq-DJOYOzH=(rmkldoX;Cou=EvzdGpP zqd`tR(AvaAXp!(00z@09ToDtayv(yhpknedw zvC1KB)RG&@G|$G;f#0^gz=^G{-r6o5J7$hxyvQ|}nlvlp*3kD0W1(9z@Ns}I#)bTA zjDvrRwUz>Mgz|+Y&#jK)6?v6tE(<5AvUNx~9bBrue=3fqvmlCkQ!q#pH-n20$@d(2 zCt^8bDy0f`93usBN>-zS0xHAXpUh-ojMgS|yoz}$iyUqPm2h#2PLHJu*j;?0l0$Vs zik7ydxuqu!!X824JIxQS?LDs~zH4xPUClVaE(n3-nzNP1A;oXVdQ`%riqWu zZTkT;JeX^S>wu+`1_V&*M728w_LHV&Ic+zJbWmFjfeG<#=0n|Jkr=82_Z{X)RJKXN zE(%RCwR7u6{)M_F>=8fM2(S^HVVDOZf&nseYT@3UrzD_|%C^!%`;PU^yQFVYV8a?M z3oe6pekPb9UKFBCcw_%amG`!i9Jr{cMCxy^VhO-H#e~UD*I7`Ql;acB6p=;O7MmGS zNvKapR)|wULqw)mb6ad_R2v_)e^F*~kic-oI4o%*X7iHC{Oo$e6jTOFVGh>JSPyD% zA^)!iz>+aBvGHXL{$X~b4_84>sLUGv*>YDI+ zgg{BR8Khg-_<(wcd?FG=oRME{;s7{@dVb3po$)4a~i2gnYiR8#fJW~YH51N>dA1rAMbT!kZ zrS!3dh{t4MNigfHgDE8fGs_A)sw<^>?GWc*zRDC;jhoJkT3C$k*N>eqzgKmg0i%j` z7*SFQ*lGnE@iqrKm3|IK9BC!8P$s!BD2No?;%J~Gs5x@gO&1&b_yrQ%AYw~(?+%8L zz@x#SS$$SJLW&Tb7$z_y1UE}~R%}Q0S6a5r7f)dXuh%d`awB!;W(ru&Vd1-aCl^JOlJ6d|3uN~(2Rcw&Z|Yv>$o-& zkysRZH$8N4gv9nkCAcs9Iq(6#WXj=1u2{Kz=Xln1NpO&^Ubon{)qCD<&HWE0Lzzw3t(bUK{K;I ztJu0OGLzP5gVEjmo&!tCkrF%JrL!Uu)j+sMkCeB(tE!?7#Rzx~Y<6&n5awAsl!`{B z&3(ME^n4n=0-qS82|@iZ;1{p5m6gCyY6h_Xs&dH!^9P*Aipl&57M|zkk6>D4f^Q@k zkfB_BFkJD3w56mWT&_cLL1RK_u=Zi>=PZ?4)~x94s%gy36QIhWq*^PL6A0YjcQIyq zK>I@Z3P?~HqI@{9QT<5F2M~ljv25}=h%q$d*`tk$pqEAD{@j6#sqiQOOO0^beJ9Jl z!)#)IL>>@W9D9#b3q;l?CocqZ*jIyYE8=rH8pE@66dB0?17u^cp%%j$_e8OoMNOKJ zXs1D(xuE2xAdIZ^z~t2;2cTG>swWg;Xt3C|X!|^omHqA)AwApR*6U)ks7^^lOLm|RbYvBt|4~&5)z?4>O( zEe|BZu#WyJ03RTsfJAaLIsn2ELc=pmz1aZvS_`OKWS2o@OO;BuK{MaOR0f9P;-NUL zqO(L3=pcu+V}S=&R`#`OX&4&dI~yBZEn3fSv#VnOCVi-AhI#+g&3WLSP2-a{F0=2dC1uVMAomF*bgka{M>B< zyn=G8fP`fjV;s*^LssyU@LFdq^7Mcn&S{L2{Rlj2LvbRaNbsp4F}+b|0k9R*KFPjA zX!w-m?{C1Yx#s(_Wx@abnwRU7)$_-c4vObG)Zg%Qk*`^<#}bgV#aJT6hm#NL4n+Nj6443%1x;q+7a z44Zc?p_7zOiL*d{R*}i6%FTx$3@I2f7;d^|Dcf|L&B$(eR#4R1prFj{JSYZw)4L;g z!%$)zk`%eD=uMj>1cu^mlt*s1NjfW$c27Hfm zqTc(6%-zKa4@SHAA@Ex8L4(#^9FQ=;f9)h1fb3jfV=@nZJAMyILUd7?e z`Uk^R*DxpG?(~z2w3EGf9oPjO!g*Q|>;{l^QT~dLHPMRNR#(3qg*k&ELx7d^!4o=Rt=4RUtz{I1FWsWVPVT_IvE=0(%N4}6!5iqTa z)GmZ26rS3zB-}4Kf1esMi#^MS9RzJV3@k*%nBgD~o4`Cn)uEQ;49v9=a=g=}cWVV3 z2O8iI%>)+p{JS*tYW!2AcQ;=X?7%kvs5}9Tz^pu7{4GJ!4qhb$egG*c^hgL#)j)SB zliqOLvA=;m9fslgk0vU*P*^HKtzj77n5wh{2q{wkdAmhT7{LgzR$yF+FNE5e@GDaU z2dsWLO0Ns)E0hd?)Kx}C48|Ic%ivNi_&ZEac#?P=0(3&hVkE*I#VWIkO_&y;bq~yi z5&@Uyxk@7>V43r$5xaS6~Ce*|wx2^3W71=dLxzK`{@6 zu&;x33PzIIh2*%bWRxfa71O>GdKmCRwd!H^)k4}?q0mHgEY%T01q#}`n8x6X z61#x%KT92^>LU!`FeD-%E~Hktgko7h!4Cux5<@eRLo|CjRT7bUCcO}?7ti<@?Hn+? zEB31KgLfkx<%ad}?@=U_Oza0`UGxwR&ysPWl=dQf25`uS&K0`OcgWh+!`L;XDE>SuxBQ1tfzWsxDVjV~H0nTpAs9cR%8QJhw}s-2 z^zRSJ{sOoCpzACJh-4R3Bu_?QI%1+JNZJgkB3$X2d@Pw(emv;(gK%0v2xp*3;wf;E zrAJ(bs~VxVhqaeV5tZwojfeZST7FJR(e;$UE>?l~dubR4x77L+G3jQlbUMGoe}j4U(PS(Zg434%xq4v@-l z=;%(-Xb_3b-MV)VI-klS;Lk_>kbIz%Zi|hRPs0_n3scR1A@GuY|nO(2^pI z#)_I902rpwg&|N;+>WS2b!a!b5eZP<*|>0fz1A!&krGo4fENrL9_ICRGAWg`g9P4$ zByf@{wE`9`l^-`RAEE{n5%hy`@N2uk0&6SX@{7r8oIB<KcqC=C@GhRefRu;CE}QS1GzF;7<)w-lEJvZ3`X1-A zim`-(y@0kjj3bmlCTo1&e1TK0BMU~nEQv6Tes=}({FIvQGbR}}AXgy4ymRZ1)M9e6 z_`z@oRVKS(8o;2B96&#(JynxbuA(RzK_hAHWnyuz3@Ha@Is==S-caI&R_|+&ARQqB zv$}o-A_DEo1w*7Aq`EDlcdtz1Dh{m>FL1Z?Ko3V{Q3C8A7)&o#o(U42+mJ9n0xC|< zpqL1EgweQ2N}&(M1*Bl89bRUJ+)p`$3EYy-!b#A(1RpgX=!9Ys5vYt}%$TXS7PG9l zyn-r_jm~s88!{nnuFQN6j?gJ^%_14qC|WcHedkdE{5JWPDUwYPvmeBvV-$i6Ng_rD zH%mN`^F@Nbja;vC0W(c)$7P^Z>o0M=zC3@SUsuYQW?qvhi+WHwKRt8K9$2_#nkCK@k zU)d*PvW7^NgOg(LJ>_KVI*KOK&w-B%!^372zV7vl0DRj@OI*(kw}K9IQUOYo6-Qxs zjwUhy=u;#e7UX-dX0j+97z-+cAt0L%yq*-FP-Z4Av{wb#S9}o?; zn9XFrP7v)p!1Y8j9*V;&02%`;t{8Wvot!rmnGQfKYeba};ZSyZ&Q7wK0HhTZ5*?3Mp@gpyJ{eRL zT?0L?V!av>0-rai&VD~qkSHnC2fSYrC9RnSHC|tuNWy5({dRZ2-|xIa92PUlbA~uC zVzrwjKr(MNA)ZxnjNR5cmge;~=}%IEc!b7qK_pJuILS-@t--pSw6|QLRSKZAd|@TCJ%d;((vEJQPCqgyI>e zF%wFhtv%ad9F8HNM<^CzLKaMcqLQpYcR-gsV5B?{l3G`|A;E;i^#`1cl*Sp!*@-Nb zu-zD{pUsFOVMYo>ZbJk}2s4h(#3;-(BVj&jMf7$k$|JRbhu*~zr!!P5|8#>3&Rhah zud_LHvHWUX_mCaa0qa*o1($SAgOl{8BP<_{h;o(9gh+n@4io=5gS2ux_pUb%K`fRF z79UKwdfKx?#SlhTt8oN|LD(a{&NS>emy&$n<^9Qt;7=JqcS!>2p*M=V55f zAVQQ&!8J+|9q1^W815vAOb1^}!_Q_xidqX9tvb9Px9T8Eu#O?7gk_e0g#PRFms%Su zkopCgh7FI=Xol<=q#Gmz7YFxbCa24EA_)-5X<+CzBLTdEz{msuc8{QI0Dxe_m1?ae zm&xq*w;d=YuRa&wx|XjZETQ*AUbKB zmE-g#=_{i0G_0dLTy5tfxXnY1ydoInc3+97>2y_6^!z&@&T~ckeefP1pYNXo^P?$u zwm{^B7fmPwNYI>9GCX?qU))k4|IvW13A5^={$Y?!il5;v-L>z1JNExPn2yZLz{CH*D&9sMvzPHj6)_Q@te5kZbbFkf>5N+(@o+Cls=b-sf|?KSNBtY9A@bRDI28 zW@U{a%7B%sWvzaG52;_6G$>4b``kc?06zIfI%U*7ZqspPezcq~|H>YzoFn2#il6V3 zj4s$y=%<_*CZIi%V|pkO4{Er>aBtA}Wj*{6#Z*K@WKcrn|C~E}dwYXMQ)ss3aBb1e zBEj|vznUUeKP-){0RP_XuS4$ft*uIN7Wc7yy_c420#cjYk>}F z7)I$xQAB=c5=Sh4nj!u9)YBn{4D()S2rcOJkQ2*LHX$SA;R#rcjQL7cPpFwt0QEv- z>feNr&u7Js#}FOEC$D`-0pW<1{mZNxH`x|-`a3pigrk7(yiupai`|-e@cxVb>Fq4#M zuBk?wt}H9iM)@62%fHuW(>r8DL|;*euq$;xu?Wo9&5MF2EY&`IjG!dh;XWX<54jj{ z2jVvw;n>-h#_B!+RXHf=_?Oc;yf0~epGP%q+g>L*?h1JVUjR}h-T(ntqC@-(a7es` z3-aMGd!O{R!%cwSjs!GD%Uga45ETqlCGItJbYKVbUUfSc`K3GFx&s)UaErfq?zaQF zFicWdhf*DJ8K>Hk30|~|t8;4+`+gr+W5q~PfX|v#xtmI0OT*Q*KDJ>0cO-x7M z*nDK&xobL=6V*s7&#k;{X_31c1Gv6`kXcU#tA%m)xm*aM!0WDi??X<73L|A$*6+?U zjlOp^jWoYo&RQWa#{OJg$5H!PP!MtjZM)3_6P;R#FVHXB30z3{_ZfRX=Yd05zpp9- zM_=QgZ8lRWXBE^^7f}iz_)i2;&aFQ1`S7|6$s&f?mNC|`d-wDiwapB@(>1u zh(3Ll=MRE9DNox@bnojYt4=T0e{F>KVC+rCq3c3dH3jV-7ADh1UkJyspzYx*&+dkr zu*?5$XdLJ9|7s71!v>N6T_Y4(oUQCw-Vx7tKOTWhdfoTqcg45vJ&N!4#bNF1tD>@a zoMqp;Zk`2?%V7&3tIbs|^HxSSc7b}4R$AMX`!MXpsGkY(o~AR|ZQ8cnydUQ!{ofb! zNMgw7F(44<QQw8uu?=hLqH63&MczbLvWD2|4$Al#gf@pMI^46u80e9Y+hf)QZ0n> z&$Io{^XATXs;$p$FrjJOf5_N30LA%={qyu>RO9TFoL%^EyrsEOX0};P*_|o+$Kb_t zqCcH=HmhLi^YY;c$KTZ>YwBo}6y`dsy47CkrQhDlXqxM0n%SO=bwlP*bLx2%v1dJ_ zmsLr=tli^g8bY1zW4o2ZzI>gRQKz-~&)>;EOzZM0q2-eQy*(jWQJ`Z{fmgW&Km|I; z@Xg8N@RL$?E%^$bpJWRurR%oq4O>+dq?k+0K&mQ6ioXe*mlu8dD#r6aW7$I$hMmVR z63vNVVRx$>AqTq^jDd{clj<6tU!2!=p3@YTq&Vxn4Py2Rf&Z+u^@@9c-i;v=3iyQM zyX_7(9mMfEO%&)lkz>t)-hf&*Wgaq93?Uf?<>b6SPrkbPe=Qm4*=QOWZh~+ zfhuBTN9ijcF<8ZtwNDZm!D_C-8m>kPR^f*wZ+{RLT^d!vDZ2XFvb^4-<1Ffa zneQb2Mhb~vxudMauZj6z%;?2&O1SH3J~pXPZhLIU{M!%Q$#m2|8;xAGtmx?|&>R`t zaxf++tfehsEmND^n6c(r&e#{Gr~T~)YRPfD(dq7@WWkNJ)bTJYm^V3ykjCorcseiX z_r5r;gj7-C@EFbx3b2R2mo|NLg5%(Of9JHdoC|zR1%kt3ocaps=CKiG5d-K3`DN0dS%{>j>#dZ8!hgtH+~tk}od&^&QRkHqnsC zUjZyOtHgfrO2NkbSTBJWz&HME^Z(#1B)3IlKB}arCCV*0#F6OC_JnbhNC|WoUwW)g zHp#MU4a{@ZhkS_QjC)%NKIb`}MyYZWt5@W)ie+d~Kf>Hww&#wPk2ZYXuva|c?^KsI z2qsO7->!Es+=Cw*fydA%%+WA^SayIztoB>2!dgL9CQ!+zt8b4nrBb0n)nEMUb+{VL zNnq5WcZ-9(U~r)cb&;9VgE?kdGt_{wg2I5vfII1B;~wg&PyuICl_LJ(m+aHSS;vd}u8V3`e5=eBb~XnjSv3YG!p%U-_cReTvv>r!+-En0 zr>C0Y#K%da;6=RKp{KcW7L-kfFx{NPgHnQ+GL~KI2kuNFSRef zOtgJ{&aSlEeOEToC=vK9b+}3nTk#tkPwdt8p1^SSi86i*tb1xP*z#(fX~uur9KcI( zF>u1F_jwzHkF_Ag#*K7Z05CI&Hv;FcwR+G@6Va9xDaO0rzkj^#x?8*Kbe`9D-!~SV z{=K_w&ncz6EWhXww43k8nr%M2^Qtbc$F{b#GzMQ^+!Q_5XI(~x|7z~LJ~c$0QRuFb z_kIRkFWZl+wlWayjQth>U<+Vr2tSpu-FAFmQd3iRzMtDJJ$oi%jjvCLDvn!vM+m&t z^B11yh7kJz1iGYqd_d%u+h#0}LZle1XC+N709236p^9M9G%%=>m3M8qzCUe}=XWU| zH-=(1$T)vMR0U4{y0j4dNY48_`~c9weV;o&A6NGNfUb+Ty#F4YGW{*fgdOT?1>
    NdlsC{ZEfuA7bbgvz`f(d;eP*7 zVil}bL{zQ3m;86j`_b+eH2W8TQEWk@XG<&RfBClvQU_lt>egxF*n7P-zAVIC*SYEU zz4Rbsp`X2qa?Y$=tt?g;khXg1>Y#sM>a+V{@|W*AEZX2{{WNo6aYo$53G;(0&wO3! zpL1;6jEz18!e=Ud4e_)p!{3or(jOiV6J!Dp!;G3`?|#lhNB$<*6#Syqv3JB%8zaz` z6*)#{uY)^q{jr?mJ`9_g<@N@2AN*aGsV%fK`ZEN43xci0^|}ZtE7G zW!Qb0crEYO*j_xLU@mp%Xvdne^!f(r{tB4*Rr^64ZEH`c&uHYAYxlX49bJ=nnOl+N z?h@FjqlT(l1Zg~9lGA#1yhN6Av6yj6K;dNC`+n6jFecn2@%?^2b^zSXQQJQ!*cw6nkr420gzn=)e^Bx*cVcc@7r~y-Y*U@Fl(N{( zh%!Bw__E8hOsZ0m;p`q(>iSd%3IcSuock<<+=~1x+Ca{IN8hGRsqVkPdWiZO7iwo) zRMkT{G_NBiDiiyiJ508`*HrY)%fX%F>0ZvFb0ZeTG*@1fcVXAiJ-i9NTov$5y%b#E zrh>gyAt(@ee7~e!A41QyG(G@i>dzWrA64xzcJAEq`_MybKP`;5q*Tn6`vCk?b`1a( zErNHEitT8X>Jl?i#+!=Lu7BX-&)sUZ+4mwy|MK4OHLvk5<`M=3OvEjJ7|5KYGn>S5 z?L)bsH~iLB8uqUE(^)gWwKYG#UD5aOXy9FW#1G~}M(D8%OvBFBdFkz{92M@cwyL5Y z&IVsFd~STODIXiFtLidD{##<+LRE!``>vl?MZ3|1d0+_4cH2|q?(<| z_$@7N4INdrN(kZ+RLpV4yPq+;^TQ3rsE_1ef8q!4OKDY9A29RWWf;N25vF&#Dm)MPE?V3`k^wOmAnvxBO69Ss4PJ9Ds#v z4={sCf{z{p3KOTgz+N3mspe|?OhnS`T5=s9-FhVyZ%)4@T%Uj;38cu$12*mZe9s!q zhLtKSjosdZzyJOPrKyoS+Z7alp`6L*3BRzz@2XPeolbRCxx`vvNh)VFii?C zAOM!WI^QcBi(F3%`bSE^H|gV`f&Z4jE1Ct&t3Mw&i^H+c|2o`%}C%eouKucl4Q>YspK41E>a!mVP> z#hl*@HGTqS{Nu?uTn$I_jfzejKBsC~0qw4>d-jgo#O0+bo)<|sLQwIY6cxE{~BYtih%~l%vp5$4-m#CXk_?H{0g3xqPH&RD^5udXT z5#l@Hk##(vNQ0pL6xC_#I?pR134M?-(H0Q>Ux)I(AIt8ffNXuJgILfxPhAPiB>Jc; z6+xKRHf70{)SFweTERDcLXZ#W0fXC1SKue^O99|(geWM3voqem0l@0P{Scn-$GE?n zSet@BLlrLh#?Zq#BSA!LFDS&?ODtNg#x;okY2)(AISX0tawH_LE3B;f!MA{sCf3^0 z#r`;HyjWuQmd8QtEZ>9NsIN^vFZG4L?ANHQSD?n0h!V3$vSLI{uXm$>>Brt$OdWl9 zZ5O!Ny*=v6&E1p5i}~#aq>HbIZ;d?8Rn^v+q21aa%Np;1BaZ{oIspdzYo}KPp_a%f z4wq9UYix8@j<`zRU>r!h*7f7g4*a%OUs$Y+<5Kh1fu9TiuR1`nOZY-7fQ|a-;K%f} zACj-)8hs#3A)ZXtNfXqTEj+boh7NXzt~|O!Ccl&<^hG6Pe4hNg#{awm1cHYc*1zpnt()oh z01mNdRo@#QaL{x@7j->6weR|ZVzMxpiV|7jvFfqmCmd>oj0)2C7@bta)%n=Tha!28q}K+ef&Xh z`0M)9P`z57;^CElfXRV0bNMNrYOWK2SToL1XbT z=`anT+!mo&Ljne#^~Di}75eC}4*?vh5yk;vl-dD2+FDI7|6rz-jG!R^&^(xS#h$`5l^8Y-?AuG zi>ieT2d~TXvI3Nx&mQDXH|VM5D(VXteK#sE9*7DSaJ<_XYua#3I@!T&CL2g;`Q=eZ>^o4Pj})+Udgnt*RfgtpHF}UFZ@&tqhh|M`pc6_RBDc;#&`$1 z#%oyC^=Y@xW)4H-ItzXNu236wB6g3lqs zZzKvgrjMsO|D5LW-C3-WAaWt5| z>}7Cp`iu8XuGy$gTA9ki7P8_-pa`eD;j4&^B&Bz?LDuhxez%}eTL2;Ftz*{r?@N0H zud3VDP=ubTvZvl941y~Rvo@wm7~eU~M1oE=@oo}4B+j5VOOOnoJ!l#XeBNNV@2FTf zsW!(>h@pyy(YQoCqTvQk0AoY@vcjskL7Nv2E`1<U+e4wlZ)1ZVOAoOV@XO$u7FR)6WdkL5|jUZI%HE&7eu=o1}+)m%>R83X{qqWsq z4iI>!J$3_=d*9UqAiUqw~t3heXrma!FKNJhZ} zFkorQ@BSR2{mzdEgG4MH1)i+>*N!0xUW`BGcfGaM7ol) zp~1-Bdf^4wv~Bl580R!d6q9tVO>3}7zb>W@VMQ-7H}{BEoldL!_2{*AJ8gdtBP?Pk z4V5C_22sVZuNuhu-1=he@1{UgJ**yIO7kztu}W@5!LO6DTrcZ5plT;T-9v zHAKit^@Y&7!7`kh&P!kJq*BWo@GA@=+ulG&ZD-Y>9`M$>HFp&rersu^i1|*~ns_15 z+ja&^O#DwMF2sC)p|%Ox&LNX5CUVsLXsnQ{4~}RvmyC(wHT4&-v{=dFj$0xzyah3N z#p(l0eyb!rZ1}~w2uqB;6q__F+yOEeIKWZ$chO?{bwiqx`K~@G0pJ`c&rx)?a(u90 z2#G%cu{}kq6JCt?qMXM~=3Of&L04$6FVa!0jgss#uo;HSPGRW8ryLr@R-H&>K7B&f za6ACJ4FhF3RC-@{6g;(A3csj;>GAZST6Aj=hWx_#0;UN5EStpgm&Z{|atHi3{JWD+ zuP&B3y+_1?vUX5TUh+oSC>)~ppj!~q9h1|eahZ^siMUagb==S0CZEA|0)O$>%50bhWU z@AW$bMzSGtaOh`AX5Lny=vFJ%j+t*tNy4VlSpR@WyrGCiJBdO2R*!ja4GK?9!#DVk z+YT`;AoJ>~t8n1vbFG^F4skAd}3S@5# z!vG5Q{U7^&L$}*e!^cV$8o$|LkbKJi@So8prRF`^B8C-Vm3`&;Ws)o?Vl_a2mU=Ws zPqXRWK0pcG!+#0^d}0A1D**CQ^xvopP-7PVt4Or{RaY*&gdc^59*t7+Raa7USfP*b zsBwX+%1>PM+eh6B8w$O#U2&fniY^^{L}@iV6KCCY9K$CZ5(IdXggySAGAm^_mtYtO zLsv9$Pn?h=OnmF$_N23=Mb%|Eze9H%UL%o-s%hCvAK3pVGX-eC9>uAlG8%N$EQ`MN468Vvgore)0Dy+Sj&xJ?F&0&s|;mhOb z|Ht1!L=MBGaZlC!Q47C8n#8Yo;9>CxPW4Ef+ENHEQ{NRn%p=jyw4WI$vQcdrl|(E1 zSd^-I98?c#Kb%8Yhiu>kL9hL9IvKVQk7A2X5cC@zWuhnhr#*HUA51KRACl?2W|2-U zED_-KeI18MZ-9OO>9x9OU(uUxU|l3SP8>a4-xZR3ftGZS*ZVq@S=*8~3^AOcX<-LJixI*>>o`dr%#w4-~^`B_+`lQH-tn;haGr_X^g4Q2MxRq z?{r!_1CEAghdcV=kpxs3jI>BN1rz~<0S#+jdxk&LL?lxnPIyRcDpi;wfzrUP8sjy$ zH`b6~fQcJmdFI|{{Mfa zTT)3vsE*N6anFImb%n$ZeQ&OU@bQ7-KVj zulGKmK7D`hzgo7}`}KOhp0CIAd_A8N=f0jl!$&Hz-hhJ<9il!Izpzoa**$8XX%xY7SSPWlJot&D_ag0R~0 zEsu9^PCDr0Ua~>3?yi8J@`(=r@1P5exZu-QpSP<_O-GdO-m6&aGW3RAHcAb%);s02 zviPZPUyA*4QqZF>DJlm)XQ;&Y-iX~JzoT|@UaDV%p;lpg*JgVqom=wR)n~149M)2m zu|IL}PSCS!SEp6I9{>4tv(S$%WnpM%y4ArOgRgB5mLN0_P1HOoJ`=v7#%MrXYJ1$L zO)-U!1hCJyjNGnyTzlqeqLoA(LbgD4`?8~U*=7D)Z}Mf^V(6O)`hCS)+(VCm2I?9k z*ET%faOd`)g_a#UDHG=oqj9H==CsmY$US;y^i)32Am{}5^tnI7PIIq3g{SMKHtf%iNv-*Zmj5vVz}hFP+^}Euy%0`G&!Uy&8X{4nI*G)mjcus~;(D8=lE` zkbf3j<8o2)QtXv0j}HI+;fC&}2m6OQYKK0=sAO)~-r49?f8xB+_T>xdk9|AE!+JFb zTXFC>`OnE$tcv_ozC_HTRB?wxCk zxT0!cg?e9b!TWJUo2umotBsfc&dc{EJ%4lY%Zh(T^!&b{Lq{Cg3XcK~*?;@f=F-j` zk!M5xVC{UX9d?qSp`oF=>Bg;-QLP+5vZhG}y5-S8PcD_DRIn00VY)@p}rhCpB`=9&);*57pFT2@D z{H)gOeiSTWbbFiFm1IH5VA1^jCBua$g^Egk9I>(v3c0oYvby#c1taN(JqM<~o!A$- zA+6+=pU}P+(KUtn-zNI94D-^qNEUC%6XqBGF}%r4?A8Ik4ama2hT|D`k8M@hlrp#d z@WJA(F^$<{Y0=pJ_F{`N zX`qUc3WwQ?cfw5BOVOvMns$vEQZ-Yi`IHE4!5f~2>(10%YdZJw$Jw^aaO!9dM)KP; zYtE^siTvVq`$)kdIwGQ9?qm#sevm=x_6D~%T-oKKq<8DyJ-DIF&cEjmI&QrwDr&0U zlG5Yv7Qe*>*ApJUHCeyNGw!f=hOnCV=6G2h@8Q2wK3pyndvPRk%geeL-1|rN=fCb3 zmO0_~#`SC3u}!C=(awjTD^aewRF{aJ?7-@5;2hu=+(bx992nK{?KCRS{8}pJ`|NtR z*Wn*&*X5@hyWX6An38AS)Ut7ZO}+f)jZ&L5pUTGBw;elb7QL!&~{ts5_u zAHB0D=3@0D!=ORSoo6h0v!|VI%ICI5NDwlQ+{)+@{=h(vAF+INq5CZcx5Y2-gm-11 zaP~q-;*C$aM&X}I9ZC=0U!C0N8Yo=E-+APR^7KT_#U%X~mOAoB9=Lx~e(vm@m=bch zIeggrnQ2ha!P0NnzG~XQpT=AQK0Ke017}}{q&=8eic~yn_SxjY}ouzwA3Lz`sg>RPYCSsHHV|b*Pk2q;|~j`hE|Tgel@F| zu(y+$Ws3U<$AFvkP(>*&YyH_GNDJGy@6_&Wnifc75IJ*Wb_7_HoGJWxGA8f>q_)2_ zacRr1mRb8M75A3+G1bJF8nDoukg%Be!x2)3kD8q@BjpU^!wAT=oQ=EzFYE+)AJdOd ztEs9s89)g&nI@STu!&eS6K(zLHy^RK78X*1TE}@q$eWS4=nreBA3;j$)9=9`Ro8wP zlocd-$?X8o+udEv>}7tl^#}w=pwiYJ)mBP$-OaQ)1O0Kw+g)AW+*~UsC!_^it%El} zh^xQH>L*A4nPVVRFSR2TJA*)7X|3YDOVy0D=uov04=sJ)sr}isplyPZ=kDt3=mc5v z#uMJz#Vjc)0iNViWKqI@%O-~fPMjP>U4ho)epd;7>sE?PV2d(%!I9JluLj|uJYF*v zi~Y6YTna7$TDyMc&CCoW=!@*_?fuXv{=ea*_B$K3o`aTerfdfFQR~g-`#mRsmRv5^ z+}!*Zy#S4Ka=5~ijvjZsWql`StdA!v(U$FNr(qGqOmn;*?EP(V~)kQD$yK z5^2OzblB!G(#Z@g3ZY^~qJ9jujcKYJi=GP&VDnQo86hag7QcL1``Esu1TSjdIGV$s ztU0pm<%!8w8m^{)_C6k=Hu6Hn5(ZW{WD}a3frmSldUj`Aq&Ja{LTrH0<^|T`!$CCrH?Hh9YWs+^x?<&s3U2(F} zLR0(;L~QsSDGz37z%X~4D;$nW_U?}Ecgh>;nyK~;LcszQj*^E1#*}dVN-pU+cV4(@?{TJ#yZ>~Q8h2)ks2tdWs-WBqa(DN24=h#_F(w-*f45ag za8ULcS@+9?oE>Jth6N{bqRDyd1!4KP{N(d9Z|qiE1X#j?y+s>)cT#{&0dsScGm+_}hB_59l%!+w4fU=zL zJRi$!uM77JQnL3oY@9WoE#7Q{KQ6T%%uimpWx#qTUajepH|~~17>hfq*BVEZmV~5JsT9h58x1qNCbdV7@LO*=SH=%+&-cMVm zmd)CP_EG32#)zHnSZcntvQx(MSF#91m+xeVm*=d_YDT+^T}_J?>g!lOy+yM|uty#F z<$VLmLZsRfdGp8$J58<}HECHFE+uhLZ7ABSfVkGAaZH{QBf7w}67wOPvC&XaO@D3? zIur_*8Vw9l^QnLt_}z|4bGaGJkF1QBaB z7khI&7VTU)B<5!SxyUPEqu~|}u%7~5%%!Cz&>6kZ8s;|KHeEGRA2a5QPH0n|?lVlA zh)`y~PQWE8m-MW_c2PZQRLInTrGsx5XRHxrGQ=x|cPW)V41dG)82kL^SU;|UtmwGF z?eXWP1)5GZp7G-$)4CE`D@%qyzdY%vIqi9JrzgFLju2>F3=J$$?+h7|wTHj+UpS^0 zWm3TDrsGCg4X~T`#zigf0=|nPUncR$xnN>kkd>8{lar?8_9mrV^F?pYOH5_??p)47 z8|-PmC5f@)=Z`mV(Td1%_mYHr^Ra2O&1FuGV|RVSkc`37q`7bSi~&t<))qHz`})>9 ziOJhxQ5tj1o&_XTL4&hE%C}Tx@c;aQZ#}d=X%ZTxF**_yL||0MpKTYWl`U~q^0tQQ*Mx3* z8V-8RlrO2-t=HfLRh*}mg-$XQVG|c$9~#!pTM!zW)`cI;B7+)u0SXN|5*nVJ1RW1a zjkA)BGtJm>&Wd<`p%|%EWi71NCShzk1R;6}-~#GkHjR&u&%FcIj1QOAB~(U_IVeqe zT%@Zro;U@Jzv<0bH?Nnve3Nj#phvdOsGMCi^{}YD%KO47y2DAZ7cuaB+_OidJ>1aL@iv>|EBYuSPcn34o1|XAApzSo-zrZ2b8To?ypHYpl(;tm>s&I7bk(9ZRw?;^Ty3> zg}l0vUmR&2XL_cv?F0K*cMQA^bD@A zbKAEuvrs5f%WYnkG{d%acQ@pBYVk`$zI1G{92a)~Jmqqq5A${6fSsXk_`QdYR}+e7 za{i>}x&$67axkP8_uh->a&AaEA)&d}q-bgm*Iz#U$kpEtk&Gb56&Lo*JR`xM6^wQ0 zkn92yweC+@$uA`NtiIwti)o)DM5-zC&y){!ho1qWY=)dHmdeamd_EBs;k2c~Dz+)Xj}wi*dI;HulNtO`r@DH@He_tdai@=a#|W*L zal}V99)|w@Jek|lWP$jZP$$8V`CJ}u6zAQ{^fP?mWRu75IQXDNgbPz!3{CRQgyjpQ z)k+@OqVe6gMHYX3o6`#ZY{cMV(y(sTPf@?KZy@*-#OR&}`xr@5E~!YU8eR#)&& ztx1YbEg-==Il}!YVQlb0_w(^@R0>fOtDCI8f|7~B1lg0DyaeM%h((tCi}uw>$Hr1( zTHTG~wl+)TcWlo`tL0TbX@O0>FnGL)y81arjF1*8sX&IV%WaPxKy~-5#xGc!)&|b? z{gINQE8{D^FcJb zQ|O~q^NG3^A)KvzU?PUnD?iE1iZ!|!`l8)?HlA$vLD#`UW$Xz#T8lH*wM8PFS*xkj z-z4hQUDiOlH_i(Aryk~;{gEbQ)Zj51U{-TBX-g`&dixwty;1wfd6$L8y zOMSN798)#qPZHE*H)WL$qPR3V+q4IkT6lHp!rUQD-`qgDlg*oKe*m-s1lEI<(O4o# zGQvAHvm5Q!J~qtoRQIEm)AdWVkbkxG7gK@$cAs*27Q;?pF~H$)B$9P}U95ojU!|hi zw5c{2_a6&l2LfcdiHnJC6_ixJTfgVGqMf33OO>a>Yo}sut*xzv>{2|h^NfsOZJ&Vz zW_1x94k_{XGBY?sOk*aO1}U~X7zfQr{e69X{rweqyH)5L`k7|H$T@%h1Dt9`eEteD zmS(SBRI2hPaqF)^1J+XlXuw69|Oza=$tWq`PwulPHyiT>~-3m)JFMWy*z8 z=_hVVIynKNf+L_MCk$9?%pw%@e${p|x%9#4cZbFp^n{L7--v^a68d}eNq&*D?=({~%4R60+7Pd?v=MF;$Pk ze~6S#yDx{fM`S>^gN{}X16?IAFE6UV@%-t3cJ$RWY1q25gN1{>V0OWbq^72Z+VtC^ z3Kf*9?z(R60WM29RxSGe{B9prHUB(!VXH|!BJ&PJGCL98Hmj@qWeM1J`2 zVFz|`>DG!4IdLIf?htB9z|9*AxXyLn0#iA7e-UYSB~m6Q_65tS$qMd_7D~X>E&Yy zB3d`hI7&wvk_A=f^z?1HRfX{NAL168uQZ3CVNHw~;Gxq|3F~9dQ{$1YqBZm-j?_TM z9J4a^$oT3cdo)?CVXC8hTOu=^i(4O0qo0}7Z|Pq*l$lc8PYC3EfwOONF>60l7o*pq zT_H+>MKYP*4F9j$+WNz_H4- z$Db2J@WWtPTPd=;dR;l6M_dq_0ePjohv)Rrek(o+~qCg(26L#|JUU&b2IvH&(l(XR6H11$Hrs z{4u^F@$RA~X@LCIh?QvqxJoip#iA55m>TaOq9L{XQ79<+tUXQ7iEF%hnq-k@ zm9A$;P;LIt3u0km9>nhRW6T#RiU@fIipoASfX){5*7mG#&wfv#>y7 zFvQ<}iDnqJvb>z;v9|jklrsjNk?!tpU`DjGFb50)&uTm9C{^X>M;fzh*K56fd=~px zk4-_#5Z;-6Oi7XMu3CS`!h(E!B{6MmYz$z5Ln1W!r;GOBaCbK4;%O;ZP3N{0&_XJL zierF)K4_)Y@%QDh4o~P{-$tisL;0VeerKwqW3KTwH0%=;NnBYN*IMeaht7L#0Bpl8 zd{h>g7jwTcbc|H5+1NDiPJGhhsA}(_nwepzx%dE0ZOrX$1`NX z7=SRp&gjQ+TVH+?yX0yH&yfQNM(OF%H-=-pAbc>P0c#K81_084WeefMDT!>Fc~_S? zJ1Y(OSx$oIo^sy|(omF?l%jopgZ@+-X?O&p31cHq1@0!}TJ?FD0{AxPx=#tH=3QL; z+gAf@p!^rqqe}ncN~$Vl5C~&~f895#m2h&@tBmBM&{53v&djg?^aW3MH}*eo4}&({ zj-gR_8x$`_1M;E!>#5S{xwqybT>q9PzsCLw_POinxAk>E zFW}VmaZ~A1sS79UAtIS=|A^JZtnq_=6j~T-?vKM>y|`ZEAh`6_)zyuDij}aH&EcR> zC|5)D`dU}i`;Xu%poyi)XkJc%n{#IWGF7^2mh9!f&2^G4eu|xA|5NURnEzJSxU01g z<7e*4Twd~K0Wk3a4zR_HxjMf_uxB5y1_wQtPt1i5xyca#-U9BcGViBt(85(Za@&Nm z2BJ2DEnRcn%V8!ZQ79CqsUEatZzD5lX3Xkp-ksKec6`+$y+Ys@%b3-HvBf6EFRYcv z@)#R=z!Dg-dB)Tq&~BK}>Ss#LEX=zys4Be40l^L--IgYQIs2Tv$R25Fh!H3#9;O!L z=LcG2qP+2WYb%(Ug+|4tbp#j2jIAK%xj>?F{f58WR9%#& zCv{!ZuQUyBo8>~+s4QMzjD4t<^-X<*mFPd>Nlp~AUMrYc5=1f77e`XygY-)9Peek$ zk)|IGEoP`TUA`_C)qi}McOaB9GX!U;pFZ`M!5KHYE&CqE4iZ;}#&XN@&y;i&1k09W z`cEv?X$DSLZZkBl3veAt6|HzkmM~;d=6mW8wgl&TN1=7k8~s6et-x=JtP)tjUFKDk z)43n%Bsuh2drQXxUP^VoHujt?1PmyCNNFuzTwE+JM)V_$h~8_An6ud~V(W#1wwT%p zyFj1TlX^4vCa(APxcyksYF(Kz9Zdfg)|x~ixYxg&^ZRUj9x($SL&lD2aC$oaa-qFg zkh*DZRX+7S*d{#$%X0byS`|hZ?50&$*Is$L$0x%m4bC@1DfWEx0s=$uxP}-E)s+94 zT>W7jhVMT~*I|5&tx%kQo>cPJ^a1IQwn#*a+}l1?)yf^1EEu}$BBT{a+)1`Akb@(f zoxy-#6c-NItTy6~+pN^r71%IiJ5qFNXI=_GXZdL5Ngf>3MRAze#hBqYs5O=-DiFVV zG8R z7#eW9)RgtCRUhW2$rP%PDso_?;m4h%k|TYoWz7Z*DvGRAa<+h$Zlkpvs8L(pRq{r# zCl`<x>-Y`d{Qf(PD`?U(>@=y9|2bo!(iVA4rye)0*cl@1!LrGkiVJAz?-rUSkv z5?4R3FMP&^t}V3U)?XFIwj@{I=^e9PYm8+Pe6VPD!>u!eQOtx|eauckeZ7^NxHI8f}LA8Jh`lN|5>bRH025GP5ga9{x1 zEOGN7y^{R{sTt$LL-UP&IH0ck0^rjL*`@Fce6bV~iPYQMJ4mws7aae{p$!fWR`G;A z&zrt&lexK@mO&gi?+{KI%LzoEnE3b4!2M4bXX?F2472_n4GjKb~Q(`CK1Lw z6(#c$*f(;gnT3VmF88SdBfcjCNCR%ryu88XD1A7mv%c>y1dt4u8QnXob8_${ops*lcnb*rlPVzZH$MV` zE^9#N2L*fEAra~eA@>?U?(za}Z;MHCESQ61=+%qVz@C(F9+UylgsdcpnwEG+j{swy z9pbw!6(t7*p3nb;IM8VHA0+A_9@c|s1IphY=(GME3pD6-2m>9Wwzd}ZirOWq-t(V1 zqIxT5w-HaZh9W%u{r!tv+Aj$PRE+BC>I3h`{}H=~vT3I#ii^8w|3L1}P**~=N+Ra> zhFIj@D1304o^77_JY(BCQ#&{BZbqt0#S zSyAcW)upASL?UJwGY)A@M}`uET~!w=@i}4ZzXmVMV40`Oi1H-5)IVnN;v%q&|C13U z5b{w6N)Bj)`CBUh^?+|y-?@xJRai2%#|#9155x^rAEj4asjLf!*w-D9q2i*21>3e3 zI-Lf34;c=#FOMYrWaw9n4F=9U9|o-}h=s#&b=Hz!Z_xSA5?TkAu&W)fYL=lZVd}>%*x0PS%LJwbQ+(M;8LQS=&^RVxzf)1!}07$ObQ z_ew7{owzMAPd~rb4HC*o(6RGPNcoFG?kD&5mY)oa@~)VBgB!&3ci|#V8&}MRB}-yj zin{;Ga_f$^uZ0utI9fDL?7-bTw-T)oKZU))^5 zN2Q;laW0&4qjA~V^=nT(jR#?g;PQ#7iu3Fb(1I9GIZtp*Qd^2^P^?<8k$0=D)ToOT zqqGf}Xt{O2yH(Oc7<<>?Wnfs*KM{_-$BwbM>ECE7W_gcuclq&RLjehld-shI1SUh% zPhI_;EG+a;C?_YJB|=Of4Nhb)r<)%CY8q%)>BNlYkL-=SgPiY@kyA%hO0KGnhK!ML z?5>9KUxekg8ki%kX323CexC-7-YaVMO{XAAZDyH*~frx@PD}(`5D*B2H~w#!ch>2BRl-j`Ui|ba5_r4WiX9ml1cK`C1HvZ68ZVr&2OAHZ89Ta| zfCSv*x@_}sh=;+UXFm#jUX)G9sQnK^{9~(~OLJt#v0gwC@abq|ErFHOp4xy-e{%w0$UO8>rTTh|;&B<5Rt&m4SY`G(bxn9t2MJJ10Ku4s;r&>S;1!hAogi{!(7e zrj;?=Pva-aO--;t_a+%?Ad5Czm!zm+vE#knG8BO9*#ik~a|?5Gpq#`nI<{AWJ6SBF zq@{&0zEqfoJS|(!2_G(SQ660il?q&@WQDer!t7LXI(S&wOnEOvg8ahed?{1hgO`3a?C_tvjOH*T_#AVjRh`XZ$ zhZF%b-R4WhN)q*~_?r9|oO>7AIyCSnC%qg86g&sMUXxWEJCpLhwG7QHdzIcD>~$bg zve@fdv9)gG+2WD|tXVpqyon~F2|?!t5F1Bxxj=R#{49?h)Qw7jc^v5S9V=^>E)`eG z_o;o??T2TGYIwFrtogMt`I8}GQos-R0*meI!%`xulFx=8^7p3LM4Gqhct$od3e%v~TgNti8OrBh+C;a;5mlUeB21sB|0;Q)w zfsxiQ5xJ{GJuHtm+cc|Sfl=qVE&s`)jEoE{h6YpMNiZM>6B84;Xwbv*Ay4=Kd-O|) zfH){-13Y8D?6j{{u|UmXhk#2B5XGS6hPS7$=iVs)yVxV5;1VzVov94i&)nSNqWNO-drh!7a= zU$GBXhps~Nak&X2$Vi9)`zRMPGw7x1rW(8n1_09v%$S8Yg;R?YAOiM6KDr$H1WoxA zE);I(rE*jOEvcd+p^ETZ=3^%(vnMAX|7+s`vZe!==F!>}q z>ouz=zd_6ng8|Ov^*{YJArA=TwvnW=I;iA+x8F1dYbY)*R^--tL#qnrX(@v58M8ba z6ZiyR7cT5_adkB!DkMUL7 -$ export KUBE_GCE_MINION_PROJECT=coreos-cloud -$ export KUBE_CONTAINER_RUNTIME=rkt -``` - -You can optionally choose the version of rkt used by setting `KUBE_RKT_VERSION`: -```shell -$ export KUBE_RKT_VERSION=0.5.6 -``` - -Then you can launch the cluster by: -````shell -$ kube-up.sh -``` - -Note that we are still working on making all containerized the master components run smoothly in rkt. Before that we are not able to run the master node with rkt yet. - -### CoreOS cluster on AWS - -To use rkt as the container runtime for your CoreOS cluster on AWS, you need to specify the provider and OS distribution: -```shell -$ export KUBERNETES_PROVIDER=aws -$ export KUBE_OS_DISTRIBUTION=coreos -$ export KUBE_CONTAINER_RUNTIME=rkt -``` - -You can optionally choose the version of rkt used by setting `KUBE_RKT_VERSION`: -```shell -$ export KUBE_RKT_VERSION=0.5.6 -``` - -You can optionally choose the CoreOS channel by setting `COREOS_CHANNEL`: -```shell -$ export COREOS_CHANNEL=stable -``` - -Then you can launch the cluster by: -````shell -$ kube-up.sh -``` - -Note: CoreOS is not supported as the master using the automated launch -scripts. The master node is always Ubuntu. - -### Getting started with your cluster -See [a simple nginx example](../../examples/simple-nginx.md) to try out your new cluster. - -For more complete applications, please look in the [examples directory](../../examples). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/rkt/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/rkt/README.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/ubuntu.md b/release-0.19.0/docs/getting-started-guides/ubuntu.md deleted file mode 100644 index d210db0954c..00000000000 --- a/release-0.19.0/docs/getting-started-guides/ubuntu.md +++ /dev/null @@ -1,180 +0,0 @@ -# Kubernetes Deployment On Bare-metal Ubuntu Nodes - -This document describes how to deploy kubernetes on ubuntu nodes, including 1 master node and 3 minion nodes, and people uses this approach can scale to **any number of minion nodes** by changing some settings with ease. The original idea was heavily inspired by @jainvipin 's ubuntu single node work, which has been merge into this document. - -[Cloud team from Zhejiang University](https://github.com/ZJU-SEL) will maintain this work. - -### **Prerequisites：** -*1 The minion nodes have installed docker version 1.2+ and bridge-utils to manipulate linux bridge* - -*2 All machines can communicate with each other, no need to connect Internet (should use private docker registry in this case)* - -*3 These guide is tested OK on Ubuntu 14.04 LTS 64bit server, but it should also work on most Ubuntu versions* - -*4 Dependences of this guide: etcd-2.0.9, flannel-0.4.0, k8s-0.18.0, but it may work with higher versions* - -*5 All the remote servers can be ssh logged in without a password by using key authentication* - - -### **Main Steps** -#### I. Make *kubernetes* , *etcd* and *flanneld* binaries - -First clone the kubernetes github repo, `$ git clone https://github.com/GoogleCloudPlatform/kubernetes.git` -then `$ cd kubernetes/cluster/ubuntu`. - -Then run `$ ./build.sh`, this will download all the needed binaries into `./binaries`. - -You can customize your etcd version, flannel version, k8s version by changing variable `ETCD_VERSION` , `FLANNEL_VERSION` and `K8S_VERSION` in build.sh, default etcd version is 2.0.9, flannel version is 0.4.0 and K8s version is 0.18.0. - -Please make sure that there are `kube-apiserver`, `kube-controller-manager`, `kube-scheduler`, `kubelet`, `kube-proxy`, `etcd`, `etcdctl` and `flannel` in the binaries/master or binaries/minion directory. - -> We used flannel here because we want to use overlay network, but please remember it is not the only choice, and it is also not a k8s' necessary dependence. Actually you can just build up k8s cluster natively, or use flannel, Open vSwitch or any other SDN tool you like, we just choose flannel here as a example. - -#### II. Configure and start the kubernetes cluster -An example cluster is listed as below: - -| IP Address|Role | -|---------|------| -|10.10.103.223| minion | -|10.10.103.162| minion | -|10.10.103.250| both master and minion| - -First configure the cluster information in cluster/ubuntu/config-default.sh, below is a simple sample. - -``` -export nodes="vcap@10.10.103.250 vcap@10.10.103.162 vcap@10.10.103.223" - -export roles=("ai" "i" "i") - -export NUM_MINIONS=${NUM_MINIONS:-3} - -export SERVICE_CLUSTER_IP_RANGE=11.1.1.0/24 - -export FLANNEL_NET=172.16.0.0/16 - - -``` - -The first variable `nodes` defines all your cluster nodes, MASTER node comes first and separated with blank space like ` ` - -Then the `roles ` variable defines the role of above machine in the same order, "ai" stands for machine acts as both master and minion, "a" stands for master, "i" stands for minion. So they are just defined the k8s cluster as the table above described. - -The `NUM_MINIONS` variable defines the total number of minions. - -The `SERVICE_CLUSTER_IP_RANGE` variable defines the kubernetes service IP range. Please make sure that you do have a valid private ip range defined here, because some IaaS provider may reserve private ips. You can use below three private network range accordin to rfc1918. Besides you'd better not choose the one that conflicts with your own private network range. - - 10.0.0.0 - 10.255.255.255 (10/8 prefix) - - 172.16.0.0 - 172.31.255.255 (172.16/12 prefix) - - 192.168.0.0 - 192.168.255.255 (192.168/16 prefix) - -The `FLANNEL_NET` variable defines the IP range used for flannel overlay network, should not conflict with above `SERVICE_CLUSTER_IP_RANGE`. - -After all the above variable being set correctly. We can use below command in cluster/ directory to bring up the whole cluster. - -`$ KUBERNETES_PROVIDER=ubuntu ./kube-up.sh` - -The scripts is automatically scp binaries and config files to all the machines and start the k8s service on them. The only thing you need to do is to type the sudo password when promoted. The current machine name is shown below like. So you will not type in the wrong password. - -``` - -Deploying minion on machine 10.10.103.223 - -... - -[sudo] password to copy files and start minion: - -``` - -If all things goes right, you will see the below message from console -`Cluster validation succeeded` indicating the k8s is up. - -**All done !** - -You can also use `kubectl` command to see if the newly created k8s is working correctly. The `kubectl` binary is under the `cluster/ubuntu/binaries` directory. You can move it into your PATH. Then you can use the below command smoothly. - -For example, use `$ kubectl get nodes` to see if all your minion nodes are in ready status. It may take some time for the minions ready to use like below. - -``` - -NAME LABELS STATUS - -10.10.103.162 kubernetes.io/hostname=10.10.103.162 Ready - -10.10.103.223 kubernetes.io/hostname=10.10.103.223 Ready - -10.10.103.250 kubernetes.io/hostname=10.10.103.250 Ready - - -``` - -Also you can run kubernetes [guest-example](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/examples/guestbook) to build a redis backend cluster on the k8s． - - -#### IV. Deploy addons - -After the previous parts, you will have a working k8s cluster, this part will teach you how to deploy addones like dns onto the existing cluster. - -The configuration of dns is configured in cluster/ubuntu/config-default.sh. - -``` - -ENABLE_CLUSTER_DNS=true - -DNS_SERVER_IP="192.168.3.10" - -DNS_DOMAIN="kubernetes.local" - -DNS_REPLICAS=1 - -``` -The `DNS_SERVER_IP` is defining the ip of dns server which must be in the service_cluster_ip_range. - -The `DNS_REPLICAS` describes how many dns pod running in the cluster. - -After all the above variable have been set. Just type the below command - -``` - -$ cd cluster/ubuntu - -$ KUBERNETES_PROVIDER=ubuntu ./deployAddons.sh - -``` - -After some time, you can use `$ kubectl get pods` to see the dns pod is running in the cluster. Done! - - -#### IV. Trouble Shooting - -Generally, what this approach did is quite simple: - -1. Download and copy binaries and configuration files to proper dirctories on every node - -2. Configure `etcd` using IPs based on input from user - -3. Create and start flannel network - -So, if you see a problem, **check etcd configuration first** - -Please try: - -1. Check `/var/log/upstart/etcd.log` for suspicious etcd log - -2. Check `/etc/default/etcd`, as we do not have much input validation, a right config should be like: - ``` - ETCD_OPTS="-name infra1 -initial-advertise-peer-urls -listen-peer-urls -initial-cluster-token etcd-cluster-1 -initial-cluster infra1=,infra2=,infra3= -initial-cluster-state new" - ``` - -3. You can use below command - `$ KUBERNETES_PROVIDER=ubuntu ./kube-down.sh` to bring down the cluster and run - `$ KUBERNETES_PROVIDER=ubuntu ./kube-up.sh` again to start again. - -4. You can also customize your own settings in `/etc/default/{component_name}` after configured success. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/ubuntu.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/ubuntu.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/vagrant.md b/release-0.19.0/docs/getting-started-guides/vagrant.md deleted file mode 100644 index c8884ab83a6..00000000000 --- a/release-0.19.0/docs/getting-started-guides/vagrant.md +++ /dev/null @@ -1,308 +0,0 @@ -## Getting started with Vagrant - -Running kubernetes with Vagrant (and VirtualBox) is an easy way to run/test/develop on your local machine (Linux, Mac OS X). - -### Prerequisites -1. Install latest version >= 1.6.2 of vagrant from http://www.vagrantup.com/downloads.html -2. Install one of: - 1. The latest version of Virtual Box from https://www.virtualbox.org/wiki/Downloads - 2. [VMWare Fusion](https://www.vmware.com/products/fusion/) version 5 or greater as well as the appropriate [Vagrant VMWare Fusion provider](https://www.vagrantup.com/vmware) - 3. [VMWare Workstation](https://www.vmware.com/products/workstation/) version 9 or greater as well as the [Vagrant VMWare Workstation provider](https://www.vagrantup.com/vmware) - 4. [Parallels Desktop](https://www.parallels.com/products/desktop/) version 9 or greater as well as the [Vagrant Parallels provider](https://parallels.github.io/vagrant-parallels/) - 5. libvirt with KVM and enable support of hardware virtualisation. [Vagrant-libvirt](https://github.com/pradels/vagrant-libvirt). For fedora provided official rpm, and possible to use ```yum install vagrant-libvirt``` - -### Setup - -Setting up a cluster is as simple as running: - -```sh -export KUBERNETES_PROVIDER=vagrant -curl -sS https://get.k8s.io | bash -``` - -The `KUBERNETES_PROVIDER` environment variable tells all of the various cluster management scripts which variant to use. If you forget to set this, the assumption is you are running on Google Compute Engine. - -By default, the Vagrant setup will create a single kubernetes-master and 1 kubernetes-minion. Each VM will take 1 GB, so make sure you have at least 2GB to 4GB of free memory (plus appropriate free disk space). To start your local cluster, open a shell and run: - -```sh -cd kubernetes - -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -Vagrant will provision each machine in the cluster with all the necessary components to run Kubernetes. The initial setup can take a few minutes to complete on each machine. - -If you installed more than one Vagrant provider, Kubernetes will usually pick the appropriate one. However, you can override which one Kubernetes will use by setting the [`VAGRANT_DEFAULT_PROVIDER`](https://docs.vagrantup.com/v2/providers/default.html) environment variable: - -```sh -export VAGRANT_DEFAULT_PROVIDER=parallels -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -By default, each VM in the cluster is running Fedora, and all of the Kubernetes services are installed into systemd. - -To access the master or any minion: - -```sh -vagrant ssh master -vagrant ssh minion-1 -``` - -If you are running more than one minion, you can access the others by: - -```sh -vagrant ssh minion-2 -vagrant ssh minion-3 -``` - -To view the service status and/or logs on the kubernetes-master: -```sh -vagrant ssh master -[vagrant@kubernetes-master ~] $ sudo systemctl status kube-apiserver -[vagrant@kubernetes-master ~] $ sudo journalctl -r -u kube-apiserver - -[vagrant@kubernetes-master ~] $ sudo systemctl status kube-controller-manager -[vagrant@kubernetes-master ~] $ sudo journalctl -r -u kube-controller-manager - -[vagrant@kubernetes-master ~] $ sudo systemctl status etcd -[vagrant@kubernetes-master ~] $ sudo systemctl status nginx -``` - -To view the services on any of the kubernetes-minion(s): -```sh -vagrant ssh minion-1 -[vagrant@kubernetes-minion-1] $ sudo systemctl status docker -[vagrant@kubernetes-minion-1] $ sudo journalctl -r -u docker -[vagrant@kubernetes-minion-1] $ sudo systemctl status kubelet -[vagrant@kubernetes-minion-1] $ sudo journalctl -r -u kubelet -``` - -### Interacting with your Kubernetes cluster with Vagrant. - -With your Kubernetes cluster up, you can manage the nodes in your cluster with the regular Vagrant commands. - -To push updates to new Kubernetes code after making source changes: -```sh -./cluster/kube-push.sh -``` - -To stop and then restart the cluster: -```sh -vagrant halt -./cluster/kube-up.sh -``` - -To destroy the cluster: -```sh -vagrant destroy -``` - -Once your Vagrant machines are up and provisioned, the first thing to do is to check that you can use the `kubectl.sh` script. - -You may need to build the binaries first, you can do this with ```make``` - -```sh -$ ./cluster/kubectl.sh get nodes - -NAME LABELS -10.245.1.4 -10.245.1.5 -10.245.1.3 -``` - -### Authenticating with your master - -When using the vagrant provider in Kubernetes, the `cluster/kubectl.sh` script will cache your credentials in a `~/.kubernetes_vagrant_auth` file so you will not be prompted for them in the future. - -```sh -cat ~/.kubernetes_vagrant_auth -{ "User": "vagrant", - "Password": "vagrant", - "CAFile": "/home/k8s_user/.kubernetes.vagrant.ca.crt", - "CertFile": "/home/k8s_user/.kubecfg.vagrant.crt", - "KeyFile": "/home/k8s_user/.kubecfg.vagrant.key" -} -``` - -You should now be set to use the `cluster/kubectl.sh` script. For example try to list the nodes that you have started with: - -```sh -./cluster/kubectl.sh get nodes -``` - -### Running containers - -Your cluster is running, you can list the nodes in your cluster: - -```sh -$ ./cluster/kubectl.sh get nodes - -NAME LABELS -10.245.2.4 -10.245.2.3 -10.245.2.2 -``` - -Now start running some containers! - -You can now use any of the `cluster/kube-*.sh` commands to interact with your VM machines. -Before starting a container there will be no pods, services and replication controllers. - -```sh -$ ./cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS - -$ ./cluster/kubectl.sh get services -NAME LABELS SELECTOR IP PORT - -$ ./cluster/kubectl.sh get replicationcontrollers -NAME IMAGE(S SELECTOR REPLICAS -``` - -Start a container running nginx with a replication controller and three replicas - -```sh -$ ./cluster/kubectl.sh run my-nginx --image=nginx --replicas=3 --port=80 -``` - -When listing the pods, you will see that three containers have been started and are in Waiting state: - -```sh -$ ./cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -781191ff-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.4/10.245.2.4 name=myNginx Waiting -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Waiting -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Waiting -``` - -You need to wait for the provisioning to complete, you can monitor the nodes by doing: - -```sh -$ sudo salt '*minion-1' cmd.run 'docker images' -kubernetes-minion-1: - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE - 96864a7d2df3 26 hours ago 204.4 MB - google/cadvisor latest e0575e677c50 13 days ago 12.64 MB - kubernetes/pause latest 6c4579af347b 8 weeks ago 239.8 kB -``` - -Once the docker image for nginx has been downloaded, the container will start and you can list it: - -```sh -$ sudo salt '*minion-1' cmd.run 'docker ps' -kubernetes-minion-1: - CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES - dbe79bf6e25b nginx:latest "nginx" 21 seconds ago Up 19 seconds k8s--mynginx.8c5b8a3a--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1.etcd--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1--fcfa837f - fa0e29c94501 kubernetes/pause:latest "/pause" 8 minutes ago Up 8 minutes 0.0.0.0:8080->80/tcp k8s--net.a90e7ce4--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1.etcd--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1--baf5b21b - aa2ee3ed844a google/cadvisor:latest "/usr/bin/cadvisor - 38 minutes ago Up 38 minutes k8s--cadvisor.9e90d182--cadvisor_-_agent.file--4626b3a2 - 65a3a926f357 kubernetes/pause:latest "/pause" 39 minutes ago Up 39 minutes 0.0.0.0:4194->8080/tcp k8s--net.c5ba7f0e--cadvisor_-_agent.file--342fd561 -``` - -Going back to listing the pods, services and replicationcontrollers, you now have: - -```sh -$ ./cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -781191ff-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.4/10.245.2.4 name=myNginx Running -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Running -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Running - -$ ./cluster/kubectl.sh get services -NAME LABELS SELECTOR IP PORT - -$ ./cluster/kubectl.sh get replicationcontrollers -NAME IMAGE(S SELECTOR REPLICAS -myNginx nginx name=my-nginx 3 -``` - -We did not start any services, hence there are none listed. But we see three replicas displayed properly. -Check the [guestbook](../../examples/guestbook/README.md) application to learn how to create a service. -You can already play with scaling the replicas with: - -```sh -$ ./cluster/kubectl.sh scale rc my-nginx --replicas=2 -$ ./cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Running -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Running -``` - -Congratulations! - -### Troubleshooting - -#### I keep downloading the same (large) box all the time! - -By default the Vagrantfile will download the box from S3. You can change this (and cache the box locally) by providing a name and an alternate URL when calling `kube-up.sh` - -```sh -export KUBERNETES_BOX_NAME=choose_your_own_name_for_your_kuber_box -export KUBERNETES_BOX_URL=path_of_your_kuber_box -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -#### I just created the cluster, but I am getting authorization errors! - -You probably have an incorrect ~/.kubernetes_vagrant_auth file for the cluster you are attempting to contact. - -```sh -rm ~/.kubernetes_vagrant_auth -``` - -After using kubectl.sh make sure that the correct credentials are set: - -```sh -cat ~/.kubernetes_vagrant_auth -{ - "User": "vagrant", - "Password": "vagrant" -} -``` - -#### I just created the cluster, but I do not see my container running! - -If this is your first time creating the cluster, the kubelet on each minion schedules a number of docker pull requests to fetch prerequisite images. This can take some time and as a result may delay your initial pod getting provisioned. - -#### I want to make changes to Kubernetes code! - -To set up a vagrant cluster for hacking, follow the [vagrant developer guide](../devel/developer-guides/vagrant.md). - -#### I have brought Vagrant up but the nodes won't validate! - -Log on to one of the nodes (`vagrant ssh minion-1`) and inspect the salt minion log (`sudo cat /var/log/salt/minion`). - -#### I want to change the number of nodes! - -You can control the number of nodes that are instantiated via the environment variable `NUM_MINIONS` on your host machine. If you plan to work with replicas, we strongly encourage you to work with enough nodes to satisfy your largest intended replica size. If you do not plan to work with replicas, you can save some system resources by running with a single minion. You do this, by setting `NUM_MINIONS` to 1 like so: - -```sh -export NUM_MINIONS=1 -``` - -#### I want my VMs to have more memory! - -You can control the memory allotted to virtual machines with the `KUBERNETES_MEMORY` environment variable. -Just set it to the number of megabytes you would like the machines to have. For example: - -```sh -export KUBERNETES_MEMORY=2048 -``` - -If you need more granular control, you can set the amount of memory for the master and nodes independently. For example: - -```sh -export KUBERNETES_MASTER_MEMORY=1536 -export KUBERNETES_MINION_MEMORY=2048 -``` - -#### I ran vagrant suspend and nothing works! -```vagrant suspend``` seems to mess up the network. It's not supported at this time. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/vagrant.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/vagrant.md?pixel)]() diff --git a/release-0.19.0/docs/getting-started-guides/vsphere.md b/release-0.19.0/docs/getting-started-guides/vsphere.md deleted file mode 100644 index 5180912a2da..00000000000 --- a/release-0.19.0/docs/getting-started-guides/vsphere.md +++ /dev/null @@ -1,86 +0,0 @@ -## Getting started with vSphere - -The example below creates a Kubernetes cluster with 4 worker node Virtual -Machines and a master Virtual Machine (i.e. 5 VMs in your cluster). This -cluster is set up and controlled from your workstation (or wherever you find -convenient). - -### Prerequisites - -1. You need administrator credentials to an ESXi machine or vCenter instance. -2. You must have Go (version 1.2 or later) installed: [www.golang.org](http://www.golang.org). -3. You must have your `GOPATH` set up and include `$GOPATH/bin` in your `PATH`. - - ```sh - export GOPATH=$HOME/src/go - mkdir -p $GOPATH - export PATH=$PATH:$GOPATH/bin - ``` - -4. Install the govc tool to interact with ESXi/vCenter: - - ```sh - go get github.com/vmware/govmomi/govc - ``` - -5. Get or build a [binary release](binary_release.md) - -### Setup - -Download a prebuilt Debian 7.7 VMDK that we'll use as a base image: - -```sh -curl --remote-name-all https://storage.googleapis.com/govmomi/vmdk/2014-11-11/kube.vmdk.gz{,.md5} -md5sum -c kube.vmdk.gz.md5 -gzip -d kube.vmdk.gz -``` - -Import this VMDK into your vSphere datastore: - -```sh -export GOVC_URL='user:pass@hostname' -export GOVC_INSECURE=1 # If the host above uses a self-signed cert -export GOVC_DATASTORE='target datastore' -export GOVC_RESOURCE_POOL='resource pool or cluster with access to datastore' - -govc import.vmdk kube.vmdk ./kube/ -``` - -Verify that the VMDK was correctly uploaded and expanded to ~3GiB: - -```sh -govc datastore.ls ./kube/ -``` - -Take a look at the file `cluster/vsphere/config-common.sh` fill in the required -parameters. The guest login for the image that you imported is `kube:kube`. - -### Starting a cluster - -Now, let's continue with deploying Kubernetes. -This process takes about ~10 minutes. - -```sh -cd kubernetes # Extracted binary release OR repository root -export KUBERNETES_PROVIDER=vsphere -cluster/kube-up.sh -``` - -Refer to the top level README and the getting started guide for Google Compute -Engine. Once you have successfully reached this point, your vSphere Kubernetes -deployment works just as any other one! - -**Enjoy!** - -### Extra: debugging deployment failure - -The output of `kube-up.sh` displays the IP addresses of the VMs it deploys. You -can log into any VM as the `kube` user to poke around and figure out what is -going on (find yourself authorized with your SSH key, or use the password -`kube` otherwise). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/vsphere.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/getting-started-guides/vsphere.md?pixel)]() diff --git a/release-0.19.0/docs/glossary.md b/release-0.19.0/docs/glossary.md deleted file mode 100644 index 086e580f6f4..00000000000 --- a/release-0.19.0/docs/glossary.md +++ /dev/null @@ -1,61 +0,0 @@ - -# Glossary and Concept Index - -**Authorization** -:Kubernetes does not currently have an authorization system. Anyone with the cluster password can do anything. We plan -to add sophisticated authorization, and to make it pluggable. See the [access control design doc](./design/access.md) and -[this issue](https://github.com/GoogleCloudPlatform/kubernetes/issues/1430). - -**Annotation** -: A key/value pair that can hold large (compared to a Label), and possibly not human-readable data. Intended to store -non-identifying metadata associated with an object, such as provenance information. Not indexed. - -**Image** -: A [Docker Image](https://docs.docker.com/userguide/dockerimages/). See [images](./images.md). - -**Label** -: A key/value pair conveying user-defined identifying attributes of an object, and used to form sets of related objects, such as -pods which are replicas in a load-balanced service. Not intended to hold large or non-human-readable data. See [labels](./labels.md). - -**Name** -: A user-provided name for an object. See [identifiers](identifiers.md). - -**Namespace** -: A namespace is like a prefix to the name of an object. You can configure your client to use a particular namespace, -so you do not have to type it all the time. Namespaces allow multiple projects to prevent naming collisions between unrelated teams. - -**Pod** -: A collection of containers which will be scheduled onto the same node, which share and an IP and port space, and which -can be created/destroyed together. See [pods](./pods.md). - -**Replication Controller** -: A _replication controller_ ensures that a specified number of pod "replicas" are running at any one time. Both allows -for easy scaling of replicated systems, and handles restarting of a Pod when the machine it is on reboots or otherwise fails. - -**Resource** -: CPU, memory, and other things that a pod can request. See [resources](resources.md). - -**Secret** -: An object containing sensitive information, such as authentication tokens, which can be made available to containers upon request. See [secrets](secrets.md). - -**Selector** -: An expression that matches Labels. Can identify related objects, such as pods which are replicas in a load-balanced -service. See [labels](labels.md). - -**Service** -: A load-balanced set of `pods` which can be accessed via a single stable IP address. See [services](./services.md). - -**UID** -: An identifier on all Kubernetes objects that is set by the Kubernetes API server. Can be used to distinguish between historical -occurrences of same-Name objects. See [identifiers](identifiers.md). - -**Volume** -: A directory, possibly with some data in it, which is accessible to a Container as part of its filesystem. Kubernetes -Volumes build upon [Docker Volumes](https://docs.docker.com/userguide/dockervolumes/), adding provisioning of the Volume -directory and/or device. See [volumes](volumes.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/glossary.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/glossary.md?pixel)]() diff --git a/release-0.19.0/docs/high-availability/default-kubelet b/release-0.19.0/docs/high-availability/default-kubelet deleted file mode 100644 index ad38c8d7215..00000000000 --- a/release-0.19.0/docs/high-availability/default-kubelet +++ /dev/null @@ -1 +0,0 @@ -DAEMON_ARGS="$DAEMON_ARGS --cloud_provider=gce --config=/etc/kubernetes/manifests --allow_privileged=False --v=2 --cluster_dns=10.0.0.10 --cluster_domain=cluster.local --configure-cbr0=true --cgroup_root=/ --system-container=/system" \ No newline at end of file diff --git a/release-0.19.0/docs/high-availability/init-kubelet b/release-0.19.0/docs/high-availability/init-kubelet deleted file mode 100644 index 8acf7a15dbf..00000000000 --- a/release-0.19.0/docs/high-availability/init-kubelet +++ /dev/null @@ -1,126 +0,0 @@ -#!/bin/bash -# -### BEGIN INIT INFO -# Provides: kubelet -# Required-Start: $local_fs $network $syslog -# Required-Stop: -# Default-Start: 2 3 4 5 -# Default-Stop: 0 1 6 -# Short-Description: The Kubernetes node container manager -# Description: -# The Kubernetes container manager maintains docker state against a state file. -### END INIT INFO - - -# PATH should only include /usr/* if it runs after the mountnfs.sh script -PATH=/sbin:/usr/sbin:/bin:/usr/bin -DESC="The Kubernetes container manager" -NAME=kubelet -DAEMON=/usr/local/bin/kubelet -DAEMON_ARGS="" -DAEMON_LOG_FILE=/var/log/$NAME.log -PIDFILE=/var/run/$NAME.pid -SCRIPTNAME=/etc/init.d/$NAME -DAEMON_USER=root - -# Exit if the package is not installed -[ -x "$DAEMON" ] || exit 0 - -# Read configuration variable file if it is present -[ -r /etc/default/$NAME ] && . /etc/default/$NAME - -# Define LSB log_* functions. -# Depend on lsb-base (>= 3.2-14) to ensure that this file is present -# and status_of_proc is working. -. /lib/lsb/init-functions - -# -# Function that starts the daemon/service -# -do_start() -{ - # Avoid a potential race at boot time when both monit and init.d start - # the same service - PIDS=$(pidof $DAEMON) - for PID in ${PIDS}; do - kill -9 $PID - done - - # Return - # 0 if daemon has been started - # 1 if daemon was already running - # 2 if daemon could not be started - start-stop-daemon --start --quiet --background --no-close \ - --make-pidfile --pidfile $PIDFILE \ - --exec $DAEMON -c $DAEMON_USER --test > /dev/null \ - || return 1 - start-stop-daemon --start --quiet --background --no-close \ - --make-pidfile --pidfile $PIDFILE \ - --exec $DAEMON -c $DAEMON_USER -- \ - $DAEMON_ARGS >> $DAEMON_LOG_FILE 2>&1 \ - || return 2 -} - -# -# Function that stops the daemon/service -# -do_stop() -{ - # Return - # 0 if daemon has been stopped - # 1 if daemon was already stopped - # 2 if daemon could not be stopped - # other if a failure occurred - start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME - RETVAL="$?" - [ "$RETVAL" = 2 ] && return 2 - # Many daemons don't delete their pidfiles when they exit. - rm -f $PIDFILE - return "$RETVAL" -} - - -case "$1" in - start) - log_daemon_msg "Starting $DESC" "$NAME" - do_start - case "$?" in - 0|1) log_end_msg 0 || exit 0 ;; - 2) log_end_msg 1 || exit 1 ;; - esac - ;; - stop) - log_daemon_msg "Stopping $DESC" "$NAME" - do_stop - case "$?" in - 0|1) log_end_msg 0 ;; - 2) exit 1 ;; - esac - ;; - status) - status_of_proc -p $PIDFILE "$DAEMON" "$NAME" && exit 0 || exit $? - ;; - - restart|force-reload) - log_daemon_msg "Restarting $DESC" "$NAME" - do_stop - case "$?" in - 0|1) - do_start - case "$?" in - 0) log_end_msg 0 ;; - 1) log_end_msg 1 ;; # Old process is still running - *) log_end_msg 1 ;; # Failed to start - esac - ;; - *) - # Failed to stop - log_end_msg 1 - ;; - esac - ;; - *) - echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2 - exit 3 - ;; -esac \ No newline at end of file diff --git a/release-0.19.0/docs/high-availability/monit-docker b/release-0.19.0/docs/high-availability/monit-docker deleted file mode 100644 index 8c2753a430a..00000000000 --- a/release-0.19.0/docs/high-availability/monit-docker +++ /dev/null @@ -1,9 +0,0 @@ -check process docker with pidfile /var/run/docker.pid -group docker -start program = "/etc/init.d/docker start" -stop program = "/etc/init.d/docker stop" -if does not exist then restart -if failed - unixsocket /var/run/docker.sock - protocol HTTP request "/version" -then restart \ No newline at end of file diff --git a/release-0.19.0/docs/high-availability/monit-kubelet b/release-0.19.0/docs/high-availability/monit-kubelet deleted file mode 100644 index d7878916702..00000000000 --- a/release-0.19.0/docs/high-availability/monit-kubelet +++ /dev/null @@ -1,11 +0,0 @@ -check process kubelet with pidfile /var/run/kubelet.pid -group kubelet -start program = "/etc/init.d/kubelet start" -stop program = "/etc/init.d/kubelet stop" -if does not exist then restart -if failed - host 127.0.0.1 - port 10248 - protocol HTTP - request "/healthz" -then restart \ No newline at end of file diff --git a/release-0.19.0/docs/high-availability/podmaster.json b/release-0.19.0/docs/high-availability/podmaster.json deleted file mode 100644 index 8fb13b5911a..00000000000 --- a/release-0.19.0/docs/high-availability/podmaster.json +++ /dev/null @@ -1,57 +0,0 @@ -{ -"apiVersion": "v1beta3", -"kind": "Pod", -"metadata": {"name":"scheduler-master"}, -"spec":{ -"hostNetwork": true, -"containers":[ - { - "name": "scheduler-elector", - "image": "gcr.io/google_containers/podmaster:1.1", - "command": [ - "/podmaster", - "--etcd-servers=http://127.0.0.1:4001", - "--key=scheduler", - "--source-file=/kubernetes/kube-scheduler.manifest", - "--dest-file=/manifests/kube-scheduler.manifest" - ], - "volumeMounts": [ - { "name": "k8s", - "mountPath": "/kubernetes", - "readOnly": true}, - { "name": "manifests", - "mountPath": "/manifests", - "readOnly": false} - ] - }, - { - "name": "controller-manager-elector", - "image": "gcr.io/google_containers/podmaster:1.1", - "command": [ - "/podmaster", - "--etcd-servers=http://127.0.0.1:4001", - "--key=controller", - "--source-file=/kubernetes/kube-controller-manager.manifest", - "--dest-file=/manifests/kube-controller-manager.manifest" - ], - "volumeMounts": [ - { "name": "k8s", - "mountPath": "/kubernetes", - "readOnly": true}, - { "name": "manifests", - "mountPath": "/manifests", - "readOnly": false} - ] - } -], -"volumes":[ - { "name": "k8s", - "hostPath": { - "path": "/srv/kubernetes"} - }, -{ "name": "manifests", - "hostPath": { - "path": "/etc/kubernetes/manifests"} - } -] -}} diff --git a/release-0.19.0/docs/identifiers.md b/release-0.19.0/docs/identifiers.md deleted file mode 100644 index a9332e32626..00000000000 --- a/release-0.19.0/docs/identifiers.md +++ /dev/null @@ -1,16 +0,0 @@ -# Identifiers -All objects in the Kubernetes REST API are unambiguously identified by a Name and a UID. - -For non-unique user-provided attributes, Kubernetes provides [labels](labels.md) and [annotations](annotations.md). - -## Names -Names are generally client-provided. Only one object of a given kind can have a given name at a time (i.e., they are spatially unique). But if you delete an object, you can make a new object with the same name. Names are the used to refer to an object in a resource URL, such as `/api/v1/pods/some-name`. By convention, the names of Kubernetes resources should be up to maximum length of 253 characters and consist of lower case alphanumeric characters, `-`, and `.`, but certain resources have more specific restructions. See the [identifiers design doc](design/identifiers.md) for the precise syntax rules for names. - -## UIDs -UID are generated by Kubernetes. Every object created over the whole lifetime of a Kubernetes cluster has a distinct UID (i.e., they are spatially and temporally unique). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/identifiers.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/identifiers.md?pixel)]() diff --git a/release-0.19.0/docs/images.md b/release-0.19.0/docs/images.md deleted file mode 100644 index e06548b750c..00000000000 --- a/release-0.19.0/docs/images.md +++ /dev/null @@ -1,38 +0,0 @@ -# Images -Each container in a pod has its own image. Currently, the only type of image supported is a [Docker Image](https://docs.docker.com/userguide/dockerimages/). - -You create your Docker image and push it to a registry before referring to it in a kubernetes pod. - -The `image` property of a container supports the same syntax as the `docker` command does, including private registries and tags. - -## Using a Private Registry - -### Google Container Registry -Kubernetes has native support for the [Google Container Registry](https://cloud.google.com/tools/container-registry/), when running on Google Compute Engine. If you are running your cluster on Google Compute Engine or Google Container Engine, simply use the full image name (e.g. gcr.io/my_project/image:tag) and the kubelet will automatically authenticate and pull down your private image. - -### Other Private Registries -Docker stores keys for private registries in a `.dockercfg` file. Create a config file by running `docker login .` and then copying the resulting `.dockercfg` file to the kubelet working dir. -The kubelet working dir varies by cloud provider. It is `/` on GCE and `/home/core` on CoreOS. You can determine the working dir by running this command: -`sudo ls -ld /proc/$(pidof kubelet)/cwd` on a kNode. - -All users of the cluster will have access to any private registry in the `.dockercfg`. - -## Preloading Images - -Be default, the kubelet will try to pull each image from the specified registry. -However, if the `imagePullPolicy` property of the container is set to `IfNotPresent` or `Never`, -then a local image is used (preferentially or exclusively, respectively). - -This can be used to preload certain images for speed or as an alternative to authenticating to a private registry. - -Pull Policy is per-container, but any user of the cluster will have access to all local images. - -## Updating Images - -The default pull policy is `PullIfNotPresent` which causes the Kubelet to not pull an image if it already exists. If you would like to always force a pull you must set a pull image policy of `PullAlways` or specify a `:latest` tag on your image. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/images.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/images.md?pixel)]() diff --git a/release-0.19.0/docs/kibana.png b/release-0.19.0/docs/kibana.png deleted file mode 100644 index 91375ece2a5eaf5507c19565a5c5e0433cd5b0b5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 82617 zcmb@u2UL`4(=FYA`R?&2D*R@bx{&TC$dqlt)8`eGbeWfZ}fdX4m| z_Md-{v%WigM{@c5^C_j9N~(Lr|BmJU_tig*qm<0F#y!?E%y}lnZ6-7;p4|KM$WuHz zTEpIc()2F7ytm-u7&k2~?H_PB@Zx3P@)-a9{>$`rk6&-UT%q4PKZ^?&{vvs@`sY9I z-Y~rz!vE*p1$p8^@?Y=b?!4ms^^W&Zz5cIvW`D0$49TV|CkngRG<~GTl~Q3x%hpGb zmcFX<>+3#iV&LVyP4+C3~U+&*YNRGvQ-Isb4Q&=>wX=J znH)}U)k%D5yaLx6$yQZax%QIw5VwBTrzjpmC7|&2xh~3{k%6IZa?+uxLh=9OADv#X(9os)IU#{8dm0hnnI~84}`Dc?Md8UXYI>W}8*w`y{t!-^C zR+HW{p(MCcSwu%7W@SOUSVVx?bbFy=ut49kB+1py&0isDZfz|oJiPej_@STQzh@si zJ3IH8$eo>5kPadYY)ejWxw*Pl9-ge!14KcY8hl8*xj4>o2)1Flii`)TeUnBt3{<#FlIQs1CA z)|bHJ;VJH+qYD{!&(|H-U2OMmamAsd4cvC;HT;M%1Nq6vOR3f)CFUhbehNvBOH)4u ziw(4k%zqb)QTkCN54Po~w#$(Q|low9DJvdC*30w8WZ$@s{;y zDRv|ulNW6=Ix@_sE$}3@W6$C>Y&KTR%RQPy@BaP!%F4>#C%c1umIG$Il(T=F-*+xU zsnJqvC!z7_x*h~%6B85K`TR^wCc7)>rchdP ziTj%0Uev$4F7eI{E_1wq?eYF5ykyetYyGakrLmo;M9HMLc6NSz_fE6aO6%pzul>5` zC+e|=;CN42%INJ&Z07r}6mabaO$Zz>%78MbWl)vH%YUVB=xa;2UJTTYmPD|Cl@SSm8I zfl_N7-=DAHBuUxS6NH>r6apZKyPM(CE%+KijFVXdSQ9OXrq-7iybz)!ND`DM75Gu5Nb9_A(ATKKdNZFSc&dp&z&1Yl%3` zEGpX4$E7>l$Hs8Amg!I(S+X!D+kEd}xjR7iA-!0r<77|S-R8hLq562fQ?{%@s)2M| zA4Aa4+dhYh7SdpMn@Q!tUFey21FkPa zQK!a6Z?^rw-o+(Uglc(eYNIxf9Ba`QDJL(_ET6P<>Jd`ncz^YMQ~bfc+}H6G?liqnBU#Lgj8p%<-$VBuGX({O!2&(g&V=Dy4TNcuo75p2--{n_ z{PD@7qN4)?12MaYKYcH|Ecd2c5I8KfyR8;B0gx1%_c6)Jw!N$i@H&`}=B(bIDKu)d1#kXQ*+jzt>RCd zl$6vK%^BS`f0^+1JyzDM*RBD|VY`asxbDke{q*&4us(t7PEadIMt zi%kcGe#FGYw70iUO-%u0LLALEhEO#IIN=sAowwUKbK|%OHXR%4g z)vH(I_$;G-z95#6i{o7uKRZx#cRzf4@iH%^{9k|l_4@T|+}ikK2?_XIn#|vS|1A}K z%WkIrinO#e3!w*`xxV+oJp9`CGEokC1y&`ePN~)2>hSgJ*UPwW1J-!d4mU`q_8f1V z;9QhjkhvQ2^0td{5_JJY8gZ=aWkYPMn@vQtLj7+FH3n_Qt@83UJaKx?>dueRZi-KB zlhV&7lRd}TJuVAzjM7Ah={b)^F73M8nbuX(Cegb{7jIo1_bD6OKYF~b0T{`XGy7>4zG{Gs6~dRLn$z9gt&*uAda~1}+>!yX zW;=14lG1&3sE~wN;o-xF!8D?W5GysuTS3Grj{^yR{`@&TJ*0s2If&-ufd>Zb{RFq|e z^>76rpGv@HY#?7pjTPNK_FSc+H)yjVFh4~BuB zmTWGM-jPWIyw6EV)wsc`D_1tt8PnaXynDhLC_@%1<|i8)8~HoM@9696cXoF6VwaYd zI^w-=NXT7F9LliPq4P^kO^vV6k#d(}*m=ThwQ6j^nqXy_-QBOs`(hQHsYuJroC%c* z1qoxKLfPx-T3ECnsfG6{)~hkY#hJy$+o9s8_aL9YgKLV;)zC-`x*OgyHa?!1kdSth zg`eMfXQ@ZIUPZ;mX6-Vq=j*jGLBsb7nZhn>2{kn}zP^v88atv{@7(!u%cCP%{46z8 zthK94Ajy7nMv~?34T*@zNJxo_Ng~62eZ>U{08|!Z-|Y;WJ`zCmT)XDE@e?+>@dyqL zQeBt$nXb0jaJC9FQ5|1APwv^h8=RChBcDg@XSt(+;!07kT>u?9+ z4U5HwFhWlB*jweAfX(vr@tsTu(grI&)z%(KkqpYq%Y#LPCAfUy!k0}{ISMWQXSQMH z$BUN<%5ONN+tyS|ysHZ&G)^=13#K+SG<4XkZIGuDSlM--rEl6K5>0!44^rjv=)Pqu z-w_muC;N7E^;EW1ZZFPG`!W@RSn=mC{YkVko*7D9+tsyRcYtqYZQUf!J5eJaUsP1o z+}vE{;SEU~($j2XD5kqGH9OnfQ+KRO$Gc$f&rISJ*}($eO9b}Lc2K}Xr=*lxO{DZK z`w>45B*6BSAtb&+ksz*JYUMWfdLI@>gv`7z1I=nbs@UJZ0ckl{dRmG6(mJX{SKq#v z>|$pZ3uPC(cF9nQU3hZxWY(u18X6iX?E(pD!U9wx-@k9!xEy%dY5A3*p^C2RO&S{S zoo0jTl;oYIIh*nFD|BS+TF0jq>lD`l;_5u-(He@0LM(~X)@UOd_$5G~*I7DygXO@b*4MRN!{4 z``~ynUe=o?D%`iKO0T^bpSMEM=yp&mc67q7@ty%){fa<2`y|EWNSh1?Nrx``7`Zk>4QsRZZMXUeMcg3uaj<*kVGut| zR3S7Rr!UKK>a6j%<7+m~T#JyabVl4<8KKgzKNah8jFNp;pLKbPM|YE{C@x=IU_cQe z;8{GoP+7}T=att^3iZ#34qIISFaAz3iyB7Z$)dGroOU+Pj+v!+TCSz@+l<_rlaG^q zH10pPPt>^VmW?Iw98?aXi-p)V9T>%Cy98}$0IuASp7nW_mALq%DtC8RS0htXPOXxm z?@DrVj&e8}QH$~0ClgQ`c=E0m$|@;IHZ&MEg+yMBl$js0GYs_$TwIv1dVpzwoF%0f zY|*YSnI!75-#xvv<7ob`Sy5a|6YZe(#6BHTCOs!BOLK2`kg>rh;DQ?pg&EAZEoqm< z<64Z24k_~)*-=q?`IY!pU!(l?gog$mm(X1!$EVHKR>H46PQ8L|r;84CCLFXSbU`V+ zzrX+H%>_2LT=+@n$8|G2LELA;RVTFva*!dQ11w}gpVMRLj%co5SK77>RkE;Hfka`< z9gFzqRR$4J1@OfUimPyD#nThqq|ez2PW*H~HEW6UtXVzR;IKl| z=cb;ra*;C@+QmU_ZEYyHP^Mi;3{a-w7u_wFETuD5y=Y;9}e0_cGM&h32tIG;6 zMn*-+1ksO=jU68!S5{R))iRtaO=Q@`2$82&_P}hs97!zUKKbIVyk|xDdFtWiCMPFX zQRx#zRIW}K(WIX-?;*i`q*wmwPFAwy$bpJ->j#_l9wY;26nu*ucKLl&!WEpcfcTjks_ zQdHF2llnMAKDl&%TT)G&#JkvPI2UoUxbd|vQ!#OCW5aa;WlBUX@*O%+6EU$+IoGtj zl9Ck<6T130Z!i8`?x7HwL3_I%Tg6CdBhw-DlyjbGFkjws0~wo)0QE zMc-bCWa9$(5^2n3&~W~)L)xU!S2LM32TQc@K6z^=CYWgWlu*wVtmteU^ zC=KL{<5}FKKe4FC?o|qsBIE6-h&cexiZ0i~>`?K;@7nY%et3lTr_QF8KkwY{kke1< zw#U5>HXbzuB+3*U(#`Lo4sB&ovP`DL3S-*vwezbZGmR%dc47$c&Xa50HH{PUO)GcX9NDXCOcYX658roXmKz zQZ3d@yP0W3+qyI?-ZZ138fkAYiKv9WEjCE-{e4J?T_x83m6Kw zmA?$)ZLC+*huE@^dJ11NEFcxXc6pvHCqI!q(%CY=%b)KE=-KWWQYOnj%Z|uOdSAIY z5U;>zGC8*}$J@!x`z%u-(VrNQTi?lH?#q`i(Co>U$;!%7<@5NowX`h%IK9{re{^ki z1Ud5fi()H?96Y1SR)zM8fIi{ zP&+Rgj)@k^*1NxQ@q9nBI9;#d+$$<6xrsb^{3$V!-S2^bKr~sAx`(0)cJ1#!@e2%U z#GF@$ApJo>Y(0>trGd~-6!$qzmyNctb_6`)F=_u4rEkd_2W?YH39rs*Jev^7jT?Yu z8PHxK3~DxKp$8Y&&sVpFp1dWDu@OhnNWGMsv$*(|yTF}s4t91?*a6hSQS3SZp$0BX z-7lwpysbIei$@}n#3?T86Uvt~ED2zR6q|NMo&JHw>;m)f?AbHmDAeK$N=d6qBE8X9 zUh$pu{R1*$8XAK|y+zccF1M~7eys}-Jz3?!7e6Q&8NF4de}+jiKx$*>WuuL_hkF>L zgZ_Dihlh=g>2jVr85TrDM5r(;UZGP+77{)E8dw?6SE1WfA?^F~%OGaQ9i@Tpq6{({|FghC2Aehp-kS$n##N6C!keNTk!^moLT!Ueq450mQGcaeR;}%AjrO z>FM!N&q80N+i_3SN35eOG+w=$L3ntRN*Ea%qfjV+5(ePYFTCjK~&+qc2fcpX?%P{G7wtZKn=1WLDoNB5ev2I&PB9MhJ~_mW6{e1~oixo? z2H8no@_nf*9_kldlvrbmM^|)}b?i2GfU|?3NB&=#0(f++$V+ra67Tx0c7HZo`Tl&7 z^NDDAWotMCGpH=%N6hBTd_NK0Qxl7fRW2B$D#CAt5@<9uQ|}pTuf;A?hCN+<kvr&-+>PIY(X|RLvT5j_l5s|SM5AL6?hiTIi;NfX* zVqHRpN1Ka3GoS7oLPE9F|5xWdPEO9_?rAAZ81W1e|@R>)j8XB-d=?RXQ5CxzFr6rFe8Su^aDpmI@Lp3hKueF8!-)+W8ei znmi;=>z0p@WW8>-*2Gk6YpWk|qj8EF$b;XAdo1{nmV21;AE~&zZ&G-}l+s^`MZh z^~Z-o)HvkDI=V2#q+=Iw!Sh=?%CW@c<)R3@CCTZNW1 zEG#U|9;uxe89D#YvJayPo9ID(|9+S0E@fbN%%|>5+ugEvO5~|fs?pr$s%=0wwDtA% z_p5S5YfvR_I_uR12L_knH~yX~01} zyJj{p(q?hcCV)`A7kvep5#_Z6tG0Jj!I@Phy`_yrhk{mvW!`2l$508ijG9jt>7(OH zT^$SgJC)p?)#;LXTUfhiM@KR(Qr*~s-Y+XxiHLbS|GK&I#-{oVUw_U8=q*o4$786;Nx9?p)hBLu5RUX->43_a{!bu#T1DP60BBKVLk!Ydo>Pj!!*$G@|>CJx_2V&Q4B3qSmFY zCUJ8|MR^O|Ohxl7t#rkF^R%V%uG&$t?fQh52abSB%xY+3nvb?>^u~=Fz-b?@I&`7K z-6Er-ea^-|K+rd?#^lCZc0A8sQDdTd8xchl^pK33DQ)Dja{EY3VoPf)_rjY$-u?l9 z)Mz`p+GOSBtxL$4oL_PJ7e$G06g8GRE<>yVTP*A{QR7on*j-zj0(qvTr3FH_H+hec zTIhJQiMH`#@V2BsF)%BTz(awta$eO`S04a+l`1&dxHNo(Xuu=T1*glRdZItLKWkKwIIkNJs;9a9se@HKRdQGqbblLF@%O z8Ye>dy}>-@O4GZTL4RVXHF7CEVq;=N&W^W%BZBoxA>#TiHg?!F*-IUnlp~6WbeujX zWA|C3_hUsp_Vzbtfd#QOdS6V&MAPmsZLsFkq~ z+^lU2=j`3Q^(TrD(G;>q+*;n=)e4zMQzy95Qp-_}J1_Qq>pXT=HzylpgHNtYlvtoG z8v7Jsa}7<6Cva(e|Moqrp>mIv(?{~t`6=Y)4p78?YLPz;Q&v;UMpHhC{G-)~Po?r@ zT_C}&ha2t7eOx^~HER<*9tvJOf38q0gkS`Ywf7H@X4k!zi^iVN+`Or(sd)=P$0?bB z&QCq}WPOGa>U=z_$!gg_4zHu#lUFT1nCw!EvvlUKNsrK;*qo}FMixD!^J8r-`a&c! zQFJjKh(Ixl{7Hiv8zuUCwS9MD0WrSyoQBh-8r5`cv{TSN>qi^2h5wHy=XcE2Ed{$AC= z+KpJby&o4(FzzL1Z%)+&6l+FTjvu>D3PG&v>rZ^Qn@tmiecPjsBQ^93zkU0(XB_(O zU2|6#5dncUC|-_lf`ZzBL=NEtYMVtRqdh_J98_7k07)Gj`j#DgnbvwIMa-{!b*$V! z8#W4i&**_ii&hkKrz6E096|Ti||}iz{fx5-J^(ZKYZO7 zOaXZXlni2t1TilmQBkk`jcGMX?^C_*Ez?LB}FC0#ci#vd1rZ} z`(jY3#l}y1)-B8(FJ2O8j4LWGvcj&GXj|KyzY0+P4ZaN0P;vmPQo3jB1)Sh{M7wO> z0PZ&@6Q9l zSLq;aC+H>c@Z=g4wLJWh*M5KYrvx4?ZE_wZ2x)`1gPnRhJ`?UMb1X=0YZDXou3Z)k zWriG6h5N2du6n+wm)Gq1YX;P*5_~fkWTVVyNaQ=T52ir78TC1spCu9phQi#OGc$kk2A z)ek*%aF{90ZP!`ZSiLVj%R3)SS(o=~m95QQ^Oy>&#ha+tRa7+GB}0hE9FJ_t#$DC> z%OT!kkrItIv-mjDbz<_Dp=I_rBzL~^E4_StI*umtmEC}sXE#A5MDLk{e|Z6W?0nCU~zKx1gEFev^6P$ea{s((l)W6aF&7+@y&6g3@9b^SD zWS&S|-#kLi4EL1)GjN%RqSCBorr}Jl$gJhntWPrgq38408;y;6Eo^?86(;hK@(z)h z(z7Bx)?uW>;0T}P4H6QKd|h;mDC(rD%KpZ-0||b|sv1pxVq}guCcA${QA#6iUhU8$ zSEzKqO+0A+041pOSxDYrCGd`{2F{%oc-(XCCx?`bjI4UAm5nmQWTMh7+2{0tNc@MAQM>xAdFe0H)>;u?t7`jDwXxp4!Hp}xKzI6mA8nvI2J z8FWxG3BSNV@uSsZP`I4z?PX+SEC%w1yT3jLs%)&v1DB(v$p@JeMEwR?&Z-jgz6=KG zk4ui_ka}a|P32c9 zD3sgl$n{5TY;17{yxW%3EpnprD{P=ZE3->rgFrHaE9-bWreFlqhHO z;`wUli@D9rJq{H)2Dxp8dpD~m760nh94rN=UluIk;T$y!nU%tK?*{dgg{}5Ccrq0Q zz(b0V!uux2TcwOY7>(aNcrV7dC z=<-M(sxt%JYIa`U@#rIpZ1hU8X=kv9*>NKQ)jaobvl0VlSqe?k)`ngnTd4N-j-{Y@ z`}VC~xpU-10Kk?9KE#{gQlrO$ypJls&lm*bYEmzPoI zvyJ8MAmTW3c(}ThH3b~5iYG3wnen@QbJ2@_9-(SR5J+FlM7YDMWLdn$2h`T|qRr>e zxqEgp2a>(zw(tpu0D zb467%di0*%C#0U+okhIYPNZ}EWNIHJBvhCcnTgI1)xi54mT-S<*IvTb7C}fYT>qpA z(uI1yPRMP(*5P46IO^!PT*$EiI{4vd({DD#&t(-BoFTMhGnZf-71Ti!<#_dB~(33F< zL6Q{RvNB?*kt?I{pf>P1ZKQqHYt1IT{YPKw+!L?1lbODpVb1^E<2+I0{IWzuC76!eRX zS`K$HA$@5+N7yoQ15dldon;X6IXF2d;YPQFGmD=cJIpd|%0}IPCMS1W-1~T`CzbT7 zq^_ITZT0ZY|BvJ8ew;g!Xn8O3dU3FD2l_jEv?0YqWs80dRsgmqy6( z9-KcM1@LZ5=km4p36u&r>?jTZBja?JXimHcq+uZAK>l7Euc#<5kBf_2n47yTl`9Wp+Uijj`|o(+oh&%a<=fDfpE1$+r3+gUgf-ENo+R;Ijd;8w^lj zEm2{O)IjKJK}|DmwlpYO6QFQ4@t}4as3c*RRo9g>&O)!f_TevII27e#xj_J^HYj{` zTt@`Li=_Gbv9(Uw6*@v{5hH7B>OI$(^mJqBK0nyjjAp+c@bAC4i^rh;BpZqsmuv5xLj~ z4!`}A{moBYhN>AEx#|Un;D-TFx=M39Avzk@R%)P-lvRxy$_Sxq65r_-Uhf3#IKcj} z9g)co3|#czCVxV0L7hQN4}wir);+;xlU8C{^2K>Wa&p@o@0%uhNvY_2 z1BVMjtE!?vaHnL__U>*XzgHY6l|aA_Q&z$ zVGun75$7C`1>GY+gOst~5@@T=J~MpnZ8yItu7^)OcQPIPBc-=hl$mEQIoqK#?#al> zNi4BJx&%$Udim>FR5XtA5#{oKD%Wp~3jtt!ixi`CLh2882TKoZi*zN99U3`K zOm7Q1p;a*N&vrCUla@yEb>@bP?NOB)U~DS?H}Ff)Xn`-K8GMhl!ur@7S1+t}W83%2 zy;I!p8ieUYIns?wA}WY=PVm!{LnEB5E#vICQ?x|?K-{t=n6s|Zv-X^n7 zcYeO{C8btkRt?V_j>s)b2i#pBbrxC@t_k>-n;hQ=BAYvDex$?$sW{WjT=7 z+0kN6PTUO~c4o5op>$$4a_i9N!%DeM{;@h?0Y7%+FxTMm5sZ}q6WCB z`g)|)t-fX7zI@4bIvog(Plo6=l9}1E(@H*J;rP&2obPo8X~*ReG!z{?Jllh!9x0sC+vQ^c z*>&+wmWDO3`e=Jx=KJX1oUxRVc#NNcVS~nN=iF#eUQuC*9Kj4CY{$MUl^@c@V@-P*YO_%@!70J%_p#VoWC{@Qvd%Q#_y_reYyMJ|CcPwMht`| zV;C{s$~MKl?}K{3w*I54-s-=wH~(MS`G<0vPi^&26@#idO!#HAP@S(?rHk27dAg>= z67B0oHSF0tR{H*qMmjq4D*1T^Lg9lAKONO|Mz2==)O=R1joUjo<{-@IDl25q>Bk3| zq1kxG)4QRSszEeCHS|!cBLs+!N;jF9`Uhm z1~tGxAagJiQ+o~BDa8^$XSploQGw%}8>AIwjI@{(N;W7KL9TY$v-z)L3HLxA{b&;9 z;`m(N(!A0|9r)C>6V=)5bHRt?iVf1uly>EZ`^-G`AWGeUo} z)3P;Su-LqtMZ)X94?C`M#MA>>qRtd$k*kp3i*J|xB_%S1o<6sFB~FVq3g^f@F&?j8 z%APHUH*K7)IWn$97tJzHkCZE8OJ7wjkiz>qKoOJ=1ZK?n#P7AK0K?@8>DZFP{!&kZqG{uTbf*-%MyxGv+-QA zP@1P5ru3njC-;dqCDm9dyBjs(9tb!CuMP3sJ;{#(AK1L^llFd)h}1R7jfijds|nfC zR!S#MQOzw=J9SH`lF?Uolhv_V_TLxG&ik%>W+aQrnb(>x*9}oH7&Mo_qx-o_!5bngRakA5@4^=n9eJnDV8jF>?89+uGABJmWr3i?sQ@dvuK1)BvX z2|Nv+@Ru}Xi`%?q6LYOpjC#~+)T{EgClS|>AKQQX`pXJBB|lE;vQaLZZ`up%Sf=ad zqno14bTnDY1#=YU%=R*}^KWjU-Z~G+Xgy1x#;tB8vKaSjb=)Uqa~D+0H(h8+u;4R| z!0cs2imsXR32?8IaklTT3~O_&6W}Aoh0zJwKZGJy`IghVp+ucksVon0L1~H&KILzYgRA<*nlX+Zggcch9osd=Wf= zA3uJCLgA`^Ex1%|1b*S&n921Ge)3aYY{c(2R_vf7x1E%odp`n=gc!P3BXgx7DCFqSp4KUe*x(c*J ziFUp&hd_qje+D_uX48gb%fAj{NU!>*rWyh(7|EtVS;tFS!fAHXexVXWJnQuP`V(@yy)b)Le3lzl%51xO0&a2u%K%#W8zYjwP`RZ+Ve{b!W zL3uSDZNWz=e^KA7@Z}Z{FnqvzxDW8R&eirzj#NjcqY|@;Q!2l4uWLVBL%;H^el+s? zVvf(x&GFjLHG}*xGBN_p4>-YJf~{ImP|(L?CXm*9X?Zy|F7B|A%C_Grxa99|Sy|0Z zP0alKrH_QhE)+(C%nxGRt!qx~wyK)VCjsT!Lb<_=Q5>wY`a6gYT3W zLM5NvBqbYn!~G6`z<*u52;`ERgM-6zL2Bykmq)(tyDLb?gYOdP)D_){d*o;Zvgh8!uUak4N}vs_>-bW|5S)X`vX>1YG0#=+6i5x4PFPOfr$?N^9QDFojZ>;=0P z^o<5SCr;Yhaq79y?Hz$XIc?4oY}EuqQ9$Ap7Mg#`p?vW4h|7F> z`RwFqwWiWleiiof#nWfcvQ2ML z{5lv)X;|^ZwP-X_8wK~Cm>xva1s3R6cU3jdQVG&uE(D`fE5G!%qSKNt_Ww!hQbF|l zEUXv1l4*I(x`F(!K3vJonFkJ=RN{%GBw8eWg;HvEq>(wvb;icIxcpKKHXSaY+{(4m zE!*RcQ{96>+4ai*Y)2MG2J+Q&p&k}K1f^6`R_}780U4~ePkn=h{ScHv&;El5g z72EAsIoH=ph_^cVUaT6wGBtGxRMXVa(b3cd7;7~u(x%~mmturWkB`kZ-hG$Pt3y&I zu43@=dmZ7g%}y17NH1hJscJJWVu-uQDr*?Lm%*meIFl|!4S92&mXODXS z{+X|le##>gk1KRwyq{iMn|N;d@ON!c)A-`S(8x$eW@ZzZ$6+D8W|XFT^6FKJOnO)w zRR;gBV>?EGh@+IP`u_cU0=1WQ|5gK4k(IS|Vxqd*>Eo}D{ACT0UsdG=7r^&^R0QwP zF{~D__VHf692k)E`?j4iz@!uKpp+IGoX;L}$X2@VTIlO1!PhPh{Kn3Vj)@5|PR{ie zbS{BT{`6ZkO<)glVCvQmQ%?$|0m_uHZ^6!#dfc%&dZa_MT46=QNcxE zp!GBbx0d5KH(V;eYxBPR*e=9zz-qWv@6HAW3+5cu-MMr7N3TTYG7Y{{EU* z?)UHC!P5;i2pH5~x*!l}z0lw3{!QcHCk=aOmCs*mB>zcvW`FTwi0oy6zypd5mBG z_4_d~No=}(@!;RHtWFlb51uk^qNK}oUG3$jdJ}r7nr5Se2{o0!D13Z(H0CN3YN9CK zy`@IyCsEK#<>>CKj#qea+^^pGxZG9rD~~E=s7P}8=?}C^22SKfzWv||pTsS>xs3F< z)r*4@^36fS5|!QStEE|{DpwUm$B)d^pS70;Datatk2qhsa%?}mIU#}PKURsDTrDj~ zy&v&W+v@J^CaQ7vH4vP>Y8Y5Hm{w$HeNI!q=+$qhH*B>8vW=~_!Z;XDMyWTHi?6Si) zScH=)t8i7MCjDk+{-n&Jsl=IPq=#WgVx%$0pZg^@i3>7 zee4u)mCmo6+vhB@?C`K7sx9J>wXgMVV|#8Ap-A`4JY4@A(nF!0U8f~Bzjs~2rKhV; zHqS^Vf8Y4CT+TiBa@anwgz}@Wzir!a^J%0o_1t><^ zJLG?*=UCi`!tb+4idS}BQ0@J|g^ex{6CKbTYA=xX)c1>Ud*&GMfuS&YVC1mbIT@Yo zc7@KndcS|4uuVspDF5KO?pjaBV&*5eU+8sQ(NFHde&#im&uO10ZPdD=O)j`rdEAR! zts*4z{+c+*I7i*Z7L>cYV`wLPeESHu9q+)f_(hdI`~*c(Q`7cN2}^c`PHwK1;BzPw zc|w-+;pZWLedqD}a?~r!UlkAs2erY{LMPq5EZ;5MBqlat*Wc=XLCTMs&Z?R)Lw&8W z&Nfa0%iG2huSt}h^y2GPWx9_#Maw8(?c5jI32%!4wMENAjL3G|%{9JuOBIzD zHEk661R*T^HIE)~YO_QTDabfzxfk-g4Vs!P!zUHd+0<0E?{R?WF*b(-gRjmrK0Dxu2qfYpX}U!&I!_&OblaG+iMv!snIY zoZ+snEm!f}R?)223hn1`HB8Zm%1M%_Bw4M&iP>q`r;rXZ`|Rd#d`LDzU@HgpzS}x( zCQ(L~q9k0l{|>u~(vlACZjRu)^tB?gPe5$lLBQj8>*6!DXX?QxY8vj7=dO{HEFmsR3{|pnZN!*2BGqba83rckkbQ0gP#Oa7AKEhV|`G33s|J=DZ8MX`Uv7n-=vPMe0OG`@wO?4bYGtLTb zV{k%Qjg&0wyUfut{LVT1;hCAHnwpxx2EweEy}dm>J-s?ur<0PrnVqVE9IOi<=riMe z9B}Qr#OioO*;}C_a<~OpP*=b&913;%b0-i8&*j|l@hUJef|f0C>l%TY1H<>ep|;M> zwT=HY&f@a9JYBx&t)~#FLO*-PBYPE))PuKdR6=Go^4a6gUo3W+! z^)r}WOcrvI!Q*;W{|E z^k|*$ND!=FFvAF=l)AZSDQRhhX5q}vavwNMVEC)6v(p3JdI<{>0~!JM7lt zqwGo-jH0FANL0{JRds|t9c(X>laf+|9xue(0`aPZ-GMWJ%E|Fu$cH&dFq^}krmt=~Y^-@DW^K(oaPt)(0ng~U zfngy_%}r0A0`cv0cFGzlliGtvm-f)1D@nAM3yQIF`}q%>Fd1PqiyhSWVCUs6 zfe8{#a77dww~^7+Lw^Ysqxb27=|6+%YA{lYs5yoCg!`~fsIOp~LFAlCyynX18seJ2 zzkf$8k959zvZ#l8wyHCXRD-7+QMET>TXW(Ju>lrV$JL=t(Cj4M(TKW3Z(s|9Ip@lw z9fd8ep#5E8;nDi~G#F)uU}RxsjT85&-t0-04rO9yj*p26rV`*_W@Z)<(Z#bnIdp;! z#zHYMHdYI!6ciGLz}S$coSh@8-BtXnx}%JOemDYh*oUB?zTRH==}!zbC_Xty0z7cS z+K(Gt54X9EnpG4}w za2Q3)WXQ#CbqcS;0iC;=z!vYKsiOv}6%J(XNe_A&Ac(hT%j|2SbYQL18*v z`Zcz|;b%5jkm&1M2bxdX`QTx7bu~C*p}{#4-&+&m$Z*D{4iLv+@ktLONfm3QdDat+f@6(@V6V1$9T17-uT8)BnKOPARY z0sWD>5ChI+S||luHWu&=xgMrl{BjEZlXwRf#6(65*P{ z{0kklo=i*&fbb^8sKcuoLNfnc@*ndsm>T&LknMOTi1R~p43}Z!N9x@B$4%m=(|=*r zl$BF-jZ*Ol329&s``vYhguL=qI2VULd4c!M0NVkC)G+bk3~HiTt4K_~bOT)AwO%oWFS z3LcYt_`oy)VrywQ>CfbhuswXJnZ0xqmPcE2^AKDO_@GS%mLG^dm>_zF6uvE)2Ht)6 zgY=2{^y!Q44>f)LQ+R?y&FLWqtV}243vCw2kFeqXEG3w6_JXG)(7+=SAnnQ}Jlup- zv*#2+pWUeTt~Dgpr1${56r*Lf>+qPG{IZFa<>lq|^%~gG$YeD4+8`pCyScqRLD;3B zuBH>_kxyVN*TA>gmjTm%ZNN_HpP<>Oe@C-D_;gy~2^D_;*9rHkYBjerM%>36+G>bJ zy{d}W0Vi(rlU}$)bRe_D)-M~4r68!{ik5~W@ zL_q+VjjY>0$Up4tp_iLzP$_;JIu20N|kVP)d>l-U~%bMSX>Nx z3XT3bGqke=408Gi^+#kS=XIFZkOs#GV7XbLCOkS|dP7nZ#AJv=N^$Q>eT1T{Y_5_A zYVV`^KT-BP2p}5nasO6M_>nE#2cRLoy{t5Mt{$wNUh03iUd05QAib+nhSRor;60gkiM&|P=05Ra*Z zOc(5$#dFp)h~@JoIb76WQmi*0fKPTGCd*;S%@UityEc9Vqw~r(r^g42$pThGcj)=V z9-Tvumew#l!~=Y?#$c{#XD=JG-&@t1e`)W5TRUH;)GlK^;FEw{HiB5p(Nj}HpQrvY zhb}h{kFHpr%tN=F@b&5=7|ck4Z@>d;E)&r>S~34xY;HiZsb7MdrcxlOUE!R+)og!# zxX>^#{0O)4x?^4%T?G#*YE?6b=RFue?EsIHX~p4j2{aTGEN32psk&SJIRHT#XRCt1EW$Jx`1>r9aob(u=cN&3!+uy{UZVkJ>o}8SF z7^9C$PKF0g30`NpcMl%N;eYYyJ}c`;k#P|B0A?3xXC(ebHgGhjUISvTCq)w9cy)bU z9O_O8c)`*xxM=rkP7nbzGq2{eO%=e^7~AUx6eBDozK0K80e-;L3_oeT_rI3Ym>bMe zXr8aiDw;!h5&-a)`{41U7IiNv7RK$k^c=>1 z&Ym2P!!-id97d%N3M$sL!G#66SwnV&?Epa2wsKQy9w#xdQSqNkB;)M7m-g)cVed_# zvEKW&al1inm7+9Isk=yKnKDF!R3ge8A@iIe$y`b1M43V~ka-?5SE9_3Au>cEQ!>x| zuOHg`Ip=-;XFcbf_x-Q;to6UwUi*1!bKk%FJAB6Lx;_t~65_9xZ`*27&Q|so0yF3+ zoqNc5cr!&(9DL}P_pm|IBGWI7QWZw4ofa$s#0vj(8f8W8i@5 zwD&_`x$sdX^>gHJ<9x%y<`GQa2YU*x7IkjYv&Mc@hGDJO>=3C{Yn)A!4P>tjZaK3n zNHPjYiBkE8%b8oWDy%zP4b&Z0uU?JMNW)!#IeJ+#RA%XQ$xgm7MKT2mNMGS#%~c|< zY+qcM#46?ddKL^@%W&}E&W-nohy$jg>_FX>;xAuv)6>T!=o=EDtN{vkM$)Ol<%IRu z8BSX7p}f(m$jzprU{?__HivJbIF|3;W_s{Um3rv=hECS4^d3J(#Kq*d%!ce@J`67b4~y6Mo)>LsAXGj%maAUqsF;@87UB70 z%MGd7kK%6@NPgk6Q{M{Wzu9q{G%)kOUyh@vp3i3+ai|^(zo&LZ{JqlUpuzKZ-mb7uCJu}~a z92>J1t`*^ouZiSPz8sY6b-yW9pTE(5d12YiCz{lv4yld)6ilC?ZZGiRxyjkK<%Y@g z9tDByQSt-oTSOl|6pE>(lk_<_CCXXJotKc1Cl+g5!dDY@rh96WW4A=e)EF&Q@(=FW z@DlgjdGcdj+Fs?g{3czZx~8vLR91CI@z~qO=*bzgvCNLqeQTQ8{+`jW_3%JySm4{* zx4Uch57c&{V*s1In@9fvg!8-ug^wL0Is;Bli_q?2S5DOiD+rd4lUab-@BH@I@0X^=&!y)No<8`R0Lq_MQ{gfHi@Z_Y^U`8X}c8^`ieS?~3 z#o!wL7-=pWtyE7XA-dk~OJc<;8hHsaR3_u2){Vk&~lmrr7+4MO2}+ZD{A!iF^Je1dDF z+J&u4`)1W;JSd;jzk29`b(3g(ZEwEd7<+5Vo5%B?rVr}Hk%m-q`R(mfs*;{^3k~-k z`OshTh1qF-xTX9+l~nJ;NlBm4B&qZ#qWzz2ZVg|%!k&Asw0p7KE;VlCrjlRFy7$i$rw&BduD51sn~ybqJZP+eAA?=&pdB1u|n%krw=NQr<|} z>)Wee!hP9I7(XoK(R{bwv)BUJ1;U{hFdxVfcKD)C`wESR&BDK4W1mEC{`v}|3@Zq2 zo4Kd1do2b`1Q`z=d|@-%E+As1$+;7eH3HKYjY8w&I-(zdGyTzCxY$|jNg&^S51c_G zt*Eil`puoSC@Ue{9{|A&0q@pr+v?CALk4#Zwy>+rA34Af3J|BY;lfZCng8+J2e4ZN z63Mg-jgfG!B93!6W5$!~$_t>VtGREuS|@vRDW!U zIuvSHkhkb)EiW(sruJ|{yjGc?2Yo?Kvf+KVx>~No8?QFb_}D+yu*n;&t0r~Q*jYc{ zHN@-T)aW#K^2#?|(laCNVW%;F@!_Sv%q=hOw_UZ}zK{Pa*QdLuy`QLmtAA?k?8_}x z&B}XhLV9>E+$hT4&YSg1R;2NJ+bgHD-Q*Sy4ZiKODX2ZP(x|)3BXSi}V zMC0ZFO^^V70MH(qcm_PQP~@}w_4Nc*>4y(!8ynX}*KFc%Nyc^qlOI=~1KFxb`(A|V zA=e5Z4+X#k0?=`|YxfU`YQbwn1<-J_Fk*0!0HGTo!o^i%%=abmAg&D~BZvuZAN&~3 z=UmVJY+Nu}C4>aa$HU_?_!b1gLA%rs_CU>UFau_UxcR(|s-q|c$h9vbiiQ$_2)ct= zZMNkF5Ao+j!U^YC!MP&WQH(l!_Uva=oWRL2YA1|Ih=_x&p`qdU9u!k_=4Zy?4+%3jg&$uV2NBzx|@4#>?TE z2~wwxgPqD72T9&RbECOYj7j!nCSL(cHs)OcL<$M_#o#y!1;kt38X;N(-Kof%Gi~w%YgIrbLfEA9?RQ z&CwQEs1ZMDVr`e1D<$@>DD6m3;GK7e&dWB=6d!ZEIyiS{TI;&_wQu8lVu#uf%-!=C zyB5cBSTt3-J;HZC=l5F9NTCK5X&u$Gju|8GS5wk^Uq;#hNw! zM8Hoxogarg#pMX}le5ci{XcLSCKF?THwFQN+A*g|&-wHFR z56CG3R0M~!bJL?q=_bhP0@$yBE%+I(#|)B~$RSYbBFY6ub!xWx3y7;g7YOGusD%Zk z+qv^5To7pO&V;8zp)Y_#-8B4JeEb0FT66f@fiHUnEMDNWqC65;P=q`fCfD|3#0g|6 zreb1ZkP;kRS2%Nm9i8Y8AA(?x5%d@0d?K;H^&#vWf^^+98~h5&4G`X_E-Rzf*zwa{`=MlR7U=efzWD&D!BU_>R`k62Q#YmR zu0D2~3(E33HshPE$Typh@s%`(RcCM6wpXT{Vp_l@kR3V8rNq~#j=%Aa*Hp(zQ`>GeSOrdRj%bn<{3hLfbpRlQ=_!Jf|J4<};bW{lXQQg3x9H zPy!b&{KTWyMxFBh~ZD&73+ zJq>Ry*CvUWCPaqM9Me&c`f*)w@r)YZT`{Kf!p&l{qMTA<9$5v})7CFOg@{+CKAFq@ zQN-_L$C9%spde4Ob$0!6U4Eop{Z{lR&yGS~O`YQ6`gnhfwGCdUO8T1>)jMql6Efdg zHgFgAiCv#qC@)%DuU)dRH6!U4BKWv=6?u98V`{MW&{;nH9ej5zZ0^sTezAA&-|HdS zCCD=9AjLAFAO`o4kDHEr1=yUZc_&0KrqLHc`$F#GMS@0z*t6ZNs8~g3+%~^bH;&;r zjEj7IanaBIemZJui(c7uVPWCe9v)invWRD$g)gI;<1)Buz4<~aH8_dF2|699=zakSAXDB;BS`@C{3t610t7ot$hJU2HZ^ML(w_y z$M!*A^E^Vy#(3qeyLabl7E{bVpLCk!S;{<9-&lN(G=-r^N;QUYq&*Jvg3aC~4^` zmR46^LwHBTK1A~mDl1(_>k7_|I};KP_@~WjajBZRVZ$sQ0bDzx-NGpK7=jPa(Ly6C zL~vDj02oR>oD;}u;{Oo>s-zK^PXu$qb8ychQxTBKy!7D8rrE36iwm>JH&Wru(3IRQ zVDZk;rE%zQSCe><+INJ$V1#b$(cqYSY+4hqT269b7sR)Yyf0)CbWm>297#7JT{6F3 zSl}C}{l$ag?| zT`!MKK^bk2t;-y>%P4=2&Y(@N6_nJab7jShrx@}sY%8S z<=bxsX2DIPkcy6QU_gKf5-+qqAn=KR23@`hqG^_*b*8Ih7;#Y93`)a4ARPJ;iaiLW z={DZO1qWH_ycn8bzu-6!P(w=w*1#UUA`(P6J|X%=?p;Uy710Awe-PXVc7wW9KCU_X zi%0`h@i)*lg=a(Kj)4R>7|v^?kY(D61lV8fbNbJWW;b5bD_VA2jMfG3TxkVd43; z%!B>R7h;0y;xt^m0}nQUp3Av&?)mC=qm}$<9>L&2AXFhyH5+<{ zaTUg*tY{8?1kV~N1(dl0e0`s$8z@>nUUEIr>N&CRbOYJF9dl!ja0W{TI^;Z*ILOEt zg|&I{;%IV0Ro$zOca7S5QC+{W0K$*c^OAKPd#l=e_sQXl7(%GI%<5d>`Jt!RS`V`d z=VXs~?y2rk{qWhT^Yar)6`ina@^&aVqOLZI7J8$=@X#)lIGT(>?v5#+R6T_AJ_y}u zZ@uYUX~epy)Owp%Ijn24VHQ~OkGBfr6%sBVmZpz&F-n}6;f`fKYUfz9rqHfLUU%VT zLE792WB<(OLQWz%qk28o8Bl|R$TnoFBa?p}seWr6R9NVQ#LV9)<7<@jfbeqZ;j45< zl3hk1UtRC-VwcIQ$8q@!Ex#*X3wIKuCM+ti{f6wxx%^cD`_7eddZH_UfBw1i(i)PH zB^K5HF4+Bdif6*1?Zt3ZM5Iea;1B?V0D>A(t!`E5E=XM}D+>UVfWzf+7JU8p-gIb; zj2G`vN8y15dJ>h0Q0Op&BSj-qL_`FwO;#qRExxFM5U2o> z1?(LVpRmg?wWuNiqb?^e&v59_wM{E!OBS;?Y55phUo%%Z_3 zB*&5G4F~ogIdVx1BEZo0P^B)-kfW273-#8ZlriBmS(iIz_vpO-Y()0zH@hR6jo0Mb zLbghS(~UXp@cM4Ddffv`S7P{rqNiT&tKZ90Prj8#??BLMxezIrHxN%*yrqmX$lIc# z`T2Q&*9OSP;R2}1^fo_PI>S5m3^ZTu*+y9!YgFfL?Jsiwhv)4 zWVNY$ajhYHfeJd6yN?eCQcPxMiL+;w@@}TMy1oaeP9a{YC_P4V_iZ}yer&hHZVf2&SyV{F$EFjKYs z<;Y&`RQ#)Q{&yK1b!##*8Gb?Ms`AEYuX2yFIAi(okR>QuojYv6g7&IYbmNXQd^&SA zd3$V>d;0m8U|P{z`308YqQ{;8ez*U0QGFzOh>UEZPmnUdrZ6SRE%a!p<@eF>KB1~> zB*D8G9+XtRshu8s$|oDGp^J|}DXlVge?;ruW}{tumuH*rTkg~2VO>r<>&Hx*OGqS! zwUOgtON|E^y_WAQWT=1W9GE{mK=xW^;YMS|leWF2k$&G6b)WAI%kS)DKszeI(FF(=jWys@!72FbOqTWDZ_Cxk&8nKcQxVcT?C7m%=bn2s@{f zq7;SyF>QH;GRR}eC?K(NNh>f*Gn=XgH8^`%DM(cue8DA|iF_4Gj=o;n5_)e9MK#EJ>?G^xYQH#O*)57`0{ohU(*pAF8sJhc9| zOSLZ*(5M~@T$9#h%v*5gaD{H#5l*m*HZlGb)?bjaANU4{NJ(3yRdY*%-X{%CCTB$Z zwgMrFnn$k8h4RyS$5M13gx&pIk3hU^$9;-_V~Af(zuc!6JrP0J!eX@wVmK=2YMP8n&{F~61@G<|9 z&6hRd%(BRA<`1bvFoy<7hP4`rnvPCL|KmOab^=k_BFNpsdv4vcrxl1Hs$HBKuMx(E zhOV^YqFvzJm))>F>Z4_@&?$yO)>j005P*V*WgtNqLnd+Xf3fP{^OglO1o?m3j{URt45F^peS3qa~j`)4D6h%jq+!AjBqpJ^8nV{J&=zJ`_z~ zX+aSRHjre2iWTlPv}k9hrz=ARP%H$l(gG+uz(2P6;<(+Xz}I6YXGY`I$ zS5pCL3$;ZBNl8iAYyiVxBV%J@Q4&N7)@y%#`DwmNgyxrW0fEKBa$XDy?5J8pGn7Qy z?ui)mjB*F?Qcz9);|~JV^gFgZ^gFgR?6{+6=kA6~1UL*N=s+j4k!r0}hrS0<*W`FrRo|{eGMK=dc;CN;3@FTKeeAfLZP;)AKt$pNhJ4ND?^LMVy z9Fw@p7vg{WjYhN)r+Lqb(QBPr^sX*0yc6sRpSn$tg+PmN*P1nJ>dKq)s2}!r_T<&* z%gJ+EJ|v$ohcegc6o94TCg^D2BtEG(lrJ!o3z9m)xh|TI?oFRW#+!GQqH6_CWvr9> zZPe;@Wv?cK5hbdzeMg;I!sU$1ugp5o_eG8n#|lkL#M#7%7dIu=00h@qL!`INN#twS zHYKf1OZ)%YLcX;RQ9HE5X$^X0Ooy4``uEDsZdwl3mjh!3#n?@Z%vIvcUzmv5V>fjx zR4L5rrU@KAYyb((2_Oy8Z+JRq`X0?9h>XF(AyqmgD3}98I_U`dX8_I#2&|wOWH#Wy z(xR{r=YXDt|7OUx3YdL;{jUVV#%3$Wtn436CWq=PPRI`a|0eT)o#;TD#8Fl_1zK0I{Y*G>z7&SitBu>lN~WZv3avoe?k_J zsDtNGzQN1~>RENzC}gkzaPC<~S4%N|LfjY@zT&lCQR8X?CV3fM0<>QTh+jml1M1Jo zfKlM{JkI_TD>wK1WBp%!)h$BR(Zg+?@(dNU*IH0ajFpeWy8x#Pus!Sc^N^n#F+?HS z%q)3ybU70tQ|t`TGiFmtKEBHy{XW3??t6RJ_b>LO9to*b(0cgc!&$07H*K;yv$yAW z!1cAjxP-jWAqDJ*ikB5~FDqMZKYEEjCu&1wS$E=k{4|J&agxcU$yk9LsNTdk@50tq z7P|X5?8Yp)&$;OrLUPBAX*ZJVY}v9!hC^>uLNdxTd{q4TMfo=sQna7nqa#F9+#qO@ z*nCZYDI1rcetYpM-`eFIIF1E5IRE0d?;HPlI^J^0?ic{yz+V-Dnt56*sWC7xaL2Z7 z>Bdc$Yi^#9vkxe4hP66Ytx%WG9AEI4$v^SJ!e`PTUoxmZ?=_b#K{zXRT!8 zo_|%i{#A_E|D-VPC@I>%>C1OE5<|~gXIIRz$*5d6O}lKWS&c&f5?z2h@zC7^zMYWgD@8pszw{y-PaSYjkXiSGJ5s7m z3mxAjvtwOzF67H)W+z%c1DSRMVu{bZikP5F6_kozf3#w)rtbLO@akcVI?-88J`<4irEHuvLmU1b?{pXC~h*tt_yCBEBu3=h} zp|Pe@mQ%%-8@CLd-96H>Ig~s*$%IKnNQVEHP_N~Yl-|eUvhlK`sLLFi56t=5!7*k1a8xd2 zB?7GXUwZhzO=pOqbGE;V<3p_r7w#8pUMxXek6%Um1}ZDc)Z4ac7j9pvJDRP_s#Ak7 zyBksc`48g4f3&6{y8%-~_XoNorw@vV6rk(_*vJ0;SBE=`A@>5U$IF0k3w1AJcgeP~ z$K^k1u7ZlFUF*t1W3xzFg7k~r4VY^5%9aZb!+DIzlfCmpJGM-ik<#dSg=i< zHE!%J!5@N|4j-&eko>HE)b*4XBrcg=84lw8e(62?=japjLQimBFqA;6S@wNFA*0LgR}_hi~Wf4eg>_?crvddiNrVu)pB$q z2F^1|24SAidOKXajU+{(p^?~2#HpRY<&K(Yep9f2dNJ)Z#NBh<)A z=<+Q93?=p*l|M*ZfDFa{JCaPcoUd2IHDF^i!P6mG4gqfjX)bW5x+zLXk{{6kOS1=p z`dV?n<2#$Zf&bk8ReT*+nTD+#pz7_n7k14aium`rZ4&{mKyE8w!?#B(t!Zqgd`^@s zttoyZL~O1&y9;f8?6j4B_9!cBe2TRJkqkFMsId%&I6|$e+doKhhiDIaOtE)@LwJ&X zii(O@JQ7eDbZCmbE&X7Axt(!Ybwjjib!s4Fc z=Er}Vg{Ze0U^zLxW(C6&EgE{e0WKYaM4NayLqg2Zo;#z-IM7sHD}rw+jqEPaVDngA z(aAxAlq_Y%C5Nrgll1Hio_kqZSRAQ!vXVdh{#9?pbg;v-u1--($VN%O=&2)uy^zKL z{;k7QzIX1dI#eBHG@Ze9*Zs6uyh5B-+N;AMk#Bc1u=$(o>guXBOy~T3IbQqub4=t>vtXPh&B0<&Z;Wy|a5h}atExBr7{v0Nuf41H8v@*&p z7M7M*L{>6hjh>li%r>!ve=e&$0h;wJ054+NsErWCA8HUNG1u|y>pudkSIWhovlkfO zBa6-h{cv%nv2Y`K5x`R2)!`f@R4LJDM-_oYO;4{bC-;41MTUV)sIgIvv@$bKLEQp0 zYsmk<(qdme+g~pw7XH4=(boURF6qB$la{(FWMosGhBvM}sCj=%j6!-xSf!wPyZP5g zA8$x)+-pl!Dykghl$u-sVV->_3Cn$J#-hBnajC7Mr9L;;_1JlQ&$ZqFK zd{8imYZs=>&9uDvC6S7B>1LFEQAKs%Qh-B7_6h;s_;Yim=W1IQ6TL+3ZDzBL6Ca+O zA02@V>c}=KqsR=Lqm{P~C7yLh@kTF0npRaY3#YO#dHU8wH!XrOOigcWT&|?6m_|M` zcBXPQ*{w37YtnLh=xJlG7}yK)d@PH6tI71%-sA0?A2TVNdTt{$f@J5~UNSPd`^W~q zvL8ECa`|%5>F@88Qg0;9WfC9C_9n>bHx>X(YE;umSb5_0di>RL3UO<(roXf>EoT%O8p2m0c zC4bD7?z?)BRhc6C*4KAeS|aYKY@;c@!r#DV74b^ZJd+YLOg!m4JUdn$I%{5cR3(m- z_>5^)st~4{pOsHI&H-sjo1y8rK`SexH(Yr?0EES$4AE8NCV#6r;e{(KfXrN`10Gnajv*b z*IP~w2EStKv&1tL@cM$((zMZ<_&+r)g9<9)WkSMKwx+0j0AEI3^+kA?*-dt`2 zW#B0>>BPc0Xfu@2H5wURNh>%^rSr0D!Ms!2MNg`4=Mn49ea~J+2+40@UHJ?-Att*M zygHxC{K~&k*W~sX=mg{&*72pAn4A_fNID`Bkbm9#dXS#`kC__7>w2nW(SqJN&9p(D z?mt>R(_Oi$KT{IfYiw>3Iq%hO|)X{9Ys35^trbb4)T8D$|^!?UBn^k+M z@@;?d^$rVV7R4}o3x44W^wrHPS1@Th-zf9tsn!+U>8ll=2GUh&Zcvh`uW?{$?H;Gw za`B>LO>3IZ@{^G*JjZj$)P1hMKkf9S^A2efyPf==E2{@}kL?cX3ba;#KCt!|{R{Q; zFK>Ji6nhjB?7Fn#w{(quXcp}lac4TbaK$P&U_Bmb={5Dj*2Ku@PaCmEbHalrCz-!= z9FOENODvbP8krf+t#hhvqFl#(zr3emNXAv!(MI&}0fCTWjmHz$KW_ii{YOLTIvlBF zuS4G(j1)ug-zTliQy#V6lsj!4tEZMko;G*%r+~o+(?9HO40(C#dF%E+8%Pg*SJ;-i z2l>`<9o`{X^=cVcx1Zu7C!6}u_wao14etAH_~FW<`~v+|d)N+1pV1YVbzslcN$T6E z!!cD|!?%Tp?sB-YNcQ0whf9pP!_gkuVdkzKmBC$i={P(oJes`MeHD#+>gg@7wSi=7 zv&f4L!0WM?%E4&m_D955h}oC*p!H^iTkWMrXX@*$EsT#fmhiadbkpTy1vC#7dj>E*So0C`6!2<*;_pb@i#^F`wQ>67 zUaGFVYL=mxtE;ZCX|XuyPMe%GWT<|9gmXvl&h_rm`(FNP^_=wYjrAMzvUc#t^^wX<~E^BtjypT};U?O*3ovD`eY;NGrqrfhqp~r{51~>3(2gs_u=;?Vhd?NO$ zNknAP%W6AIt1%by?Ihjl@#ofE`Cf7XBFcvac9k}jD3GtZB0|-r`~78p*@OIS7n{?i z)wSEy;@Gy+Hq0gWzIg9(prXsXV!$i7EB&2UOU2yCX$2Gg-jN`VO(ffK&frtKr}erD z87`?s_2}*RKwBtXR$&vam}uheWp$cS5RdG~Sp4!sVfHy6*%vxjW{pkNos0I9%5H{) z`9GFTlwx_mV??sgerjW(-EhIaGsBCUD+j#r?&%U-6aBCt_-x~^hrQ2tyOwh$O)iev_y>phHum-hR9uld*x}SF z;9NRY9%Z)v!S)W?+0?_kSAC{DBlY-IeVT#6Ik9uYLl+j!B2|;vY}U&-*wdcLa9T_D zh{E+2#niREt3JD=2Hvy$A(Q2p~p=-x7IxD=XgHZ zCfD{kH6?rCNbS5xM;DvsjhURtSNHZ(wF*s6`FwNA-1{*)%K0$Wv0VR~=9Atfi8m$& z`?l2N1{!o2aj@iNMmf6=EIy*F6pj29e|%DFMzzIZz9~Vmiz0r8GnLArYo=pwgq@zt z;W>+1?z(_M-S0l;?wi{_>@8W_IxW;~ke#VB>#yTku*sc?Lum2W+^6l7j8*E3PIr64 znA0@+;F}7z`?#6z&UIR}x6kHF2rYI_iHZeiod~ zMs>`?Zm-?ffRQRAp$6mr`bWx?p;VXKYE7~!|LChrPLp!Jz$f--g8AFK#~ZqA69V|u z`Mw6OUOfA1*r)H?r|a0)JdVtf#0wOzWSK?NtC;q#TCgoL6;@wUzd%DK!wf%4=1Mkx zYRQBjAD=q;FLw{ zy$ODP&T8;bE?FMeUiA#LA?&vrBuP5zAJd z&W?4kEM)3qvCGcM!6>ZLOxx5TS_#aui%ZZ{f`q>38vFg>gz=M`%UDZBdpoIUYyC%t zXK&}8wRj2NPTW2ksAhiAJh)KxkFTS_jd4%kZgr&LF-tLMNQ1d~(L+8P#x_(w%khJh z>)q&l{!iwOlDB0P;}+ktSBylen+oR#N9W}~)O$z~{!8Ut!VG^Z;lZyxc@aAEq*6AP zC1yx?N7P>PZ&UNLJ#sdJu~Dgp#_UdSlWx02XGtIGzWTZO{6O((?1l2oBU?ekd9{Fq z%E8{z3sdq5lm}Fl>f%m_{mH+WJy%X&MyDe1*qXN9Pg#WX&@;}YOEmOdeHjU@&Cj{0 zXu5aonc{oa$0w(zx%Em@u8nTLKZPXkz9eEjP21CTBrKfN+zK7X92x8$Dz=@vb*IF1 zoYp$!z_YO|<@XAqvR5@|B|El!)bV?GQObd2yCuwwcZ&T>O^Udb4hJ9+>gw&tg$is& z0j1*w#00V{GSyLwM$H=yE@z!azj&N!dLTf_MK9Yv@%U^}$U@fzvNdG>7poJZ9(u2) znjdWpiKhSdcrvm5V{w36TVbhi!HDpenm^ zTI0&^6|OqIiD!I^Or+U*nbo}h`OR6^79o>zkb!~fB7jGbh>@9?IY`NMh(vwy;t8sA z?uVuti^`I(spKBnnhWo1-*j|QBsL)O{n!M}leUYuAHA^uWAR%Q@7NaAqUMO|-FmtL znngMRNmR0XLK+lCJ_$W;-Z>f6_QXbM`pZp$O@`03ZQpb3koG*ko096Br-!G!Pz|qZ zUO|5;tAd8@`$fh%8ZyI(7}s0Ok@%P4X$L*Ke4Ej$KT84YgfcV>PjXh)A(D}i(fB)A zwZ4s#jbb0|U+qb=KXi1z5JS@7ck+rNSG|RE3o64UHz-ov#pr+5MnW9=+O=!iV;zb7 z!h5Sh�@DX-EaJk%C`>WvkC*hxA&oZ@SrJPpU5#?b(>EYFb*-d0B8ISLV^;aA7Zm z6=K2;1RUex;!4TtIh?1eI9X(T*w)r|Vq$`voV?=H?c*{QDkZ$46S`Vj2Ns7>(}{gL zIlPz)KGF0rJn+qAA#dr-0}U%w7eoMQ(iWfMoRX( zuR_Gu#DQ&k2koDd{?_bU?58%X=-wS46WK^Rx{F;=L$G8OP|lH&BD+|evNI=KgBit0 zzMyR@&0Rfn_vF>Xy;>9IcLxUsUg*r{$8VtvU%dJtc&w&o`oXFSJ*5DSiYS_#*sBXk zR1Lh;WqTVi+`jt9H>arjcxBlK443u>87Em;S#^DSSyydlQ(C|fGHgH2gUa@pWE8h zI<~w{`If$0-pA(V(2q}Jf%J(sAhKzeWU7ktZEI8Q@|L$-FB37h!zX`%bZG>Hpl0|1Wp@9KZxv6|L{e);*!m$=a_zk-u&$IkAtuI$ESPl?h`Gcz;9Fxxp@Fjx*! zyF+?gObnW35OwJTGQTT#r2tNLYjK~7%9pY0#g@+7m;xr^&R)9Y=U(c%n99e^t(ACV zMc$T-EShA3S6%f#BNcg?&8HI*X78Hs8 z?a#>0KtV~_ zmTmbG4XZQ@Fgm~#T)%lUWU?QeoV}c32&KVe2M-bgF_5XLkbop2h)Muzb0{U>s_sdn z#@wbZwE2M%N0+t^xKWF>3iT;mVx)_ZNJQ(uj7G(uT-U^89!6VrS`^J~D{^r$adB}l zlE4>NTRM%~JMlKfmkP2uLIM~~7Yfi&l#noELQ_d5z z#D9ttl_-IOa`vERKwN2rfS}+L5r>?j#eB#4%O; z%Cx=>-^9v7&nztatld!~pLfQ8j~aQcR8a}hK1lInTqL3U0OkrF zIAEyoZMJg#ZTX{I^;_tceut*KGM3Wo;_Y{Gr;G=>8L9B|_i1?zAsI)p?)nW&*>f84 zJ=pHgl~{LdlEf;lWQ&h-dzDZs#vJ;TQpV;PByd%>E#|aSqnge+EQVI`rrXvF`3}l<+UbjB&4)J!LEgp$s?B zVha}+LTr?z$SXl=sI47=uo)1|*z&%OUcHd#{NpCX2q#nY=*q7Xr;(Dx zQP4E~30qg}K_jNEum7QE6#hQime^8a3y6Dyv(CluzfOE$4-c$y$2+-m#$t6iak$px z>(-SE#!zO*2y@XClTsM`TB;ox9phuQL5Gh4RA zSIOCXG{e2PpS@AChbs8-V@3uBu5zf1={UaLM9ag(z~JHr3V(lH455yRCIV=tTYZ5> zj(50piFz~>Ts2lv(Qr3lfr4J5qaZ0I#Xwz(>(QQPQxtDM+U=d4Ex>Xcd{pWhLPj(C z;sGZor>Mp1KP5M%;Lw95RuA=40LxPsa1GEW8Eh|XhX6gAIGFQ+n^1!*x-G|ltwJh4 zxRx3DSmYJ?{l3N|j&>)jojgkye}K3KxBy4i;S}aUZS~VDz~q1a{0RYoL-OCT)WoWt zGA6DIPHTw#9^y0~b1vyLPXh=C1YvMCcW|hI!Nnl&L!4t+4Pm|;KE&xKmcHcY3E62k zc~&lY>JTN?iP6!JV|F({t9Dl6w(7w+U=krfMVDsvSd!6*1AG%R{33xvq@k3|NO3Rj1ZRd_EiY*L znOtq*g_!SGP(Yl(@dDr;FAmth zs=#RSE!hIOO%`cai|zr)ibFpOLmh2sA)9gAL3fe0WXYyWGGxcReJvLf6zlCBd&1Nd z!j2ehh$$fu1$x@|C?uR>fO}StYuQ4xcI(F6mUngTekm^L;;wxAGgKG~p!fiWV0mGz zAaUqL(ws6^$)3|xxM&Q!=C^bS4&W4{^%<{}f>{#$0s_-GWSBQ2cZ|4j;Z2J>UY3=s zpDeA5kPPGph095j1ZH+v_S|=NKIO7n*2EamS6X`d#*G^>p3NA#MF6*gJFG56Zh~FZ zObJr%w#WwO!f-=;9$_8k=AP)xE4rRovIN&~D*Y0PJDd;m0DA)BKG;sfxa;Ku36Iw( z7%ukB1sz^;cGN)>ma;ClWB9n_>F81(hX6~Pnx1~}8EzE>XUi5v&0_N9AHJ3tR5uyY z4Ngh%U$F^mmJenOCs#S03RDFFWC3drtO^JreZwqM?NaKl{20BDWgFw`7UIrn#7ao| zzb}D{-HgM@YWWU^0*j-lsMut^Hq8n@I=Df~Mk8`Uz2iijNNnDKRc|dr_jX5&n@med zxmwkhm7Kg~{Thf?fOlqTX0{JwYXZT-!_`sExn2sN$F$8u>={&=)C=r`-MqZLgLjP} zva5sM2I89XwyMvcKZA$DopuDnwK)X^AN#+CDimC>+lSiPR2*Jv_ZM%m44G+q)q+Ao z(C~yJgDJK9J7~i~MF{2=lzL9>4_iox+%fB7u-J1){dT38un((PnnDEIVK4pVq{x@! z2g36chj=;yHk4pV6Ik5~p-jGKCCH=Rw#b=iFvN^%MF}q-P38(I8uF;-cXIggkPt8# zzM37yxEtUaA;l13_z8 z3I+?lAxP(2YJjv07T5=M>LWHI-(dwogtUf;rSM)ztZG4d31ngPuph)SmH2@X1>wc-|DJ3@(q0U|k|XncKr z`%+9DluAWJp13h@4=U4QX6<-fI=*2>r967ajXSs-9dSb&;abA4a6LMNUMY zxuSCMLvE=l;TqpJHU|DV0M2N|hPYEi6sf(~XV35djtD~O2?v0WGF**aP}rAwNodI# zCi_XtyM`Z+m6EJ4A%1Lg{CC;KkW@>l0Xe6De zv>f5$>KMLh{64Y*WILR4z;p4+wwpA~EIPanS{=|G$$TEY{;$XXS{{L!INydrIzbwY z>x((?u0^|`rsv~RjjT{kegX~wZfz4(z&$-TY~GB_)DcktOVdk8e*%k)-+?9oA`M;W zH2KNU5R%*^UkIT`CrcX{^{YEh6T()ww!10MxEzbST~?+BhxFj=K^OzS1S$#_SP5c+ zm=2Uj5XO1!;ufj*fBN+4i#4L6qVNzdQqT=Rna8*_r@pc>;rn@LOPmmcgm=K%gGi1l z&O?W^QkWMaI({5Y=>}V=2;ChZKOkV>e*gXg03ALNf0E6s0bDe z<_b=F@*O8w)_WhZd@HkSe5@ z%m%C;ivW#TMUlKqpx$7nS8Y+zb6}ms2wge=KrzPo!|T@(BVkFZ*|ilFUT$EYe}U#% znKe^2#;+}0?JD=AkmJr$^rqzv4GVMs07-N_0k+S7h#P{En2t2@3o=ef7Vvk3I{i~l z4h|nTth~4wC~?}&EqHz~GgAZM>`!J2J1xusV0}b!?g)gIlO8X#{E>i3XuP)MdS*s7c0*g#Kkz)P*3<4g?XHU55x= zSshCG5S|BGR#*8TH8HE}CJP3Yp_oMDiS7W9s1U_|bo8C(FtTTaKFDt6+eC0&F@`n^ zS?e+TDH+Fkg!Ve}Pr!ADB45GVs|3~uAsp10b@swDged<2To;)Ya|@dmgt!P9HLwGb zeL)VRT4I8+8W>-o$&tE2C~PN{6!sOu5(pY0E|?a}_w;e9B7Qw1JslGK-#a^NvED%a z$Q4wBu!Vg4@>LxvoR$^^AfyqO7n%rB zjBE=RH)O5a#>R6{IO0lc$3QlWU)T-lFd~zx!>YFZv?S6tT|+e+8ylc8@v1mQqV_CCfOR>`^oq?a zq1J^nfBZNZRcoHjLpNk2*am$AgC>aTMoD2F?b>Jl(@4kU3YGZe8Xm z1ITk$ig?Y}rGapV8)9K@-h?HCt^#kz(#XWb6JeVpX|+vF*{gJt zpj^3GN{spXGAGktu#%j_t&_^JX9Fj$5$ zvE8Sc58Gux-WrwxB^=4~=OK4;60~QPbp8FlXPKK4kf+K{Xh9|xin=(r-yq!r{hr#I z8gom_1KBLQ-J@|)K+y3$Ha0n_cj0SUb@k%U+#$!g;WH@m9AQz1Q$QO4(kRweR$&mh zK$bz=3{V~O9cDBA?0(lLX&ASxM@lU^K7g>EnCk%nPF#_PG30W$+};07<3zadv>hMG` z$BPh-Gb!KO>2B#|>0YHa0fUNav^Z*g&-BI&h!}KVg#wX?HLwxpq7vwih)bF}c(H z+gHldx2m5eB|%kL=Gd`(Y2M__%mu8%caB5xx1a;AyPuiaLtqCax!r=*Lfv2i<$|l+ z-KrHUwPi;TZWf37gK>{(9suhKqCi3-a4=4W$; zr!qHYwBQEj=H_xwp2O{VBzoW{ikw>8vAl;uw%>P?sB($o%xXmOJJ_afFI3G@hQrjk znMs=aa+;<|_(s#x+7=cgAc7IZetREOPdQPHfSKVns72qexU|&WjnMAi<-BqX$mBbb z$RQ3YEi3D^$VQWk;m|aQ8^2)k+X@^YkFV6Rp$m@Y3p9UIltN*y0s_Rvpp;*cS^Mb| zMBP+wi=Zq9d~qeKWp)e5BZ{ni4A`q+7bG%RB3I?@u+L|F0{o52`r*)_g~pyOf-&F0 z+fy0xzQYV>1~swESEABk?rzC3>r}ng+%4*8kNb}ks$Hgr z_~k+PGZsF+fIst3fI&yg^B|!e0<3S@4_6ElVr@->t5MoTz&HNA^dSt(heENdrb&=Y zaXC2vX{d&*YwGal40ewK0wy5pj$AJRW`yL+#KmO}t}=7*3;LBPlUbbEzrbm+4W{z6 z=XPXiQ1OB=w;%>Dj!v(-9RY3tbp4W(W%g|mMset^3Z&yOT;V4?I(YXG5oFPg%+9tE z7cW7UguBN4@ujP)t8vr2ciMnz(@+k{5?WCReik4>1;jTm7ncC!$$;6$9SbUx>=M%Z zd6XF7fb&+Jt@5=8qe}_7F&sl|vDw0$4GG(ZoP1((QnBOFL}*)&TA*qOPtxYJh@_-N zR8r(keuwoDnrKtPoAmws`6MJH7grWEMwAJN*3OwT@JH<2+-WHJAYVm=)W78c`V+WL zi10KtHT~cwFsl>Fw!w#sw1ZLu=Za0dFw#Rp?MW$gVvP_Dp!6j_-Or_i(g=XC1Dk?(!{FAbq{V|7kDPE^i5o-d?DFkouUzOkGtKI~>{J z!|vr>jtf_YKKq4-iyD9C%zVz2^^thV{JXrs45$jkWwbkYf;YUShNwV+358upS-DSr zbkzzdg*ZtCJ1YjpD@Je)i0$U+6z0%a8#wqolObcKktskUmU$Zm%hF7>kv=GdYL#q6V3WD}_9D~rlYZ9I z(n>@72gi~q0gu-c6QVoKj#8LFa;O#rF$*h*Jq4l&>QHqLWHm{}9I|#r)LpLWkcf*=H5<}au4OAF0u!mXwHO0yk_x$*ARt(u5 z=^0ub&Tde2BelQ&^5x5?PibHeBWV-UzIrtULW2n4uV7d+d@n=NIUa6qIxfw-VkFdD z41?*QY+#6(9i2YRCdH5hbc?{{H#RXT-}t4Wfe)q)I&$z&ss34;ar5h&SRWnY_b{_UO;D|<#I+{HHb9mH54 z#O37!d3Ey%f~gLFkWHOL&T`=~523kv7b~}BW#!P1puTwdGA&iU)8Z31*px0hLU|Du zz|+lbC%T_9Of8t5b9~=UxG4BUA*((f@MK&l;U_R<3CZfgDCsV`BYb?_!#68VHQ7c* zS|F&)!SjTKs9@x*u@1HmR;dopi`M8-A)&3lo}T9sVi13XJ~~lhLq*Sx7#Zi~wGoLo z$S&yk)uHKae`?}S7KQj%m?tKY!yH3=8TlN*X8U{}Jm7?&s9eD2{9}l9z)8&r3B%` zjR}*^5YvFpb0z0`Fl;bYJ~UY10#TMebAPw5RcCiMA40A@d-nLAO@~YmbZmHy8i-65 zL?baC!#XBpU(nf=MvnpEcTP@@7#jG@?qV1t<%jzS4;4l4d-i)z4*{h>Qr1_`g3uTN z9;vT3vK$6FBO?PXJiImA7xut%oo<AsgaZbBn zem^%gDJv zX^Wkl27C;>^Hy9jbe(Tszs8JNtF~6_8D|c{rdUtx&X1DHor85?EPZu=EF#Iuk<`AN z3yY1e*H3@NTrzVDOG_lA{ohfl#X&@<_56>owUc>KPKzjU^UNKyH!#*g_KD@!U-oPC zqDQjiBmA)bVjlij(`$TP3EyGd+THZbr5it~&7 z^pz8HOppxWiTcIm%qvN(p%~5Hz^Z-`kLdgR`%_ot=lS>j>znwr_*~0fSl{0or@KZ{ z=sq}d#*)ta6Tj@AXLW64L`=*)2ZxgJsw!}~DjSd)n`O`t`}FEnbZ}@l1qIq85ce%o zTA5?RaBJ|Y%2=Kfc$SD%H1~;fbY(Z|o8m}?@!ly6m1l1^j_o+A|3*|Wpy zA3xv#QK1>7?fBxfO%fGGVllI-LgXj0p&iej>4oP*LS}Owm#hMsGdb-)+Vt_6ee8ZA zKXS{{!LSyoibEC~Q~AmAXnx5tYg=3O3iR!m!~qL(d@lpI628nQsF98yIDA-(FS=|; z5%!nf@)Nwj8mlTSU%8SXRENC-)rFt|!_@p>nuKuvC1Y!59Nrxg!gzBVd!1UPzh-{n zS4(sKY!x7HH+gd2a8d3%eb>bL!-l4BiMx02KC|W3yLYy8=ZZo=M>obr!|%VK&-J56 z);2b2M0pqy2#c@Unsx~m=~Gp&+_>SwpsbW_2o3bSCdEqGUqCe8zc-7$>a2mz@4U=U zJ}fS-O2oVb9@d7BaOYd=y%&tCVT2|>Tnn>|ht0bnEi0?1r>Gz0D= z93+nB$i|rCyPBW)_mw+w^5iscA3^B8yYHBkpo1KN;jQnDjHx3V^!8BOlVkr9!RKpu zS2A|+YzrNB4<0-yCbr>AlA!+>9}Z`8{pwZn7-Wv}M~^NMGT1wY8=Ee;8a3@$rH-}} z>__)jnnglW^zMDiJ#q>C5h?v%`};X`3|oAdL;*Y-0glAXEzB%vKE4P&?p387*> zcJ$~##g3d?9}!w-5FZf8{zzb~Oi71Dy9i`mOT|{ckYR7iwT_o4_U=ufv{`ywM`cAt z&Tk$Ao1cwN6JaaLaS%gE2nlHrO%ZOeHb%x^BX%%tHzF%;fhctL2Hk=(#y^xG_iEW5 zsiS1~2$)x@WP9pV!mlMTCPBj{!}Iga2;KIwJc z*|IcZ9n9O^)|Csmtl+|12Snc!iTh0(vHp;*zd*?1cf_lTuN$T5EFLsofUHfVM;M&N z-b4Qjjf@m$+M#jHSgk&KbQw6GBGnr=-T^K^yw+Y-97i#iTlrW^Zd*O}4jM6A{JL}N z)*-?pIqNtEOOOUYM-YD;vb;)PyznE8`x+S1m_%1MJlL=4{a^}b;as(%I8*Z)caEi* zr#D;y6QJlwL7JHBRafxzX%mr)067!UthjjbtgfT|n$zjtiVFu$%EQBhd}fAqj%Upa zw0YO{>wgkv;ccJayt%{9&BY}hd&K6R}g0%OXw`LNpW zjf)Olq|#PBJD!xJ9X5>#R(4#`Yih)nFI;c%)3{#5WAC)+Vz}S$?>5|^Tw&0OqNjld z1LEGc4mOTwK!Q%%YU5inw)tVJPg|{7_0e&Kt_<;*NjA?=Hzg&dT>AbY@zpgpBX81+@Z{iG z!lpG$>|<(4d}ih^qSl;x3F}JN|I`>!$XDQd`^kd8TjukF*Om=ALQ z5^A*3aQ}B+^8aJm*#8U3$Da@P|4^Cs|JhrZTkX@dOCjOB<5p8u1!W0$T;HgjoSOOz zjv2}5rqcX&X|~?rKWGS4_wS_XtL}U~nhen2ZftQbs@UYp)2H)P!WiXt@xju*a&Iwm z9Hxm&_*sp?6_TmLxF^>H-Tc%qq)_9#U8DTIDc7pkz&fGLTAl0km&EZc#m9J30TxuG z{&|e2Jv10eW4^ZZ)K@&;6^K-vWOnAsOUtZwo2*#z;Vh)CH?y&E5aMf>_`g!*3{3*}=5@{z_^B%XHSFX$?T(E!WbhFY4 zLh^QF6&3JS_%u~=4`WPtL&Bzsu?Le8pp<(If|b!#fx%GwJ>=!V^Yy6toipanR5JYJU>ziWH;>cwQ^6ObbbUy8ArMTgwvqZnLV zSABGTO8Y*24j?BE8auX$Rb6JV58DkX^Nu}x4B+D6!c2FkK9~@$RK=}bJayfhl3q}| z(5L>VM*TTLLZ_o!Qjl8?zOKNjvi-)hXZ9*#Uf$kAyg&0+$e)J}9V%!75}T@qcXW`v z_O>2_2t3wWT$$_$CE7x>8l)iApWEknz`G+w@D1VBaY?cp0GklIBnu93Xon~GAn;|9 zt5hG-b1id+EQ2*>%@4ria&s^(0!pyQuz9N8cZ#7qB0`VHPaIFOOErnRP)c%$14SN8 z_*oqG0khBlLa|E%d(hV)mwzI}kdfBb)iKKE#f9a2eOH})u*~$ja@aJMIoO2}*F@#8 z>?~(fl_miB)LlL0`}WP^WU`E0ZX>EAb#ac0*H>X-VSc_7e*wVBdaWlF1#sWcV-E6j z%#O646F&}nS0Rk)ikvWTIxt}6!&6IEts3@m7*ypL$<>H~+=~NLOihbLDTOZ#)y8*t z$dj(G&m?0-QU*^Nj*wCrx=xR9L1R-}2Zt;sQmTlfM~ER=kh%CkNby$iah81XE86(v zypyCn+2e9Vve>5?UrV)~OeP8APTbf~TScz?^Zos8!E}GOUXmcZmIRNKr$_hh8R_X=N`d<5;kT>TH2UVCwYg>{ z7(AnSc2Ljg+uPp(WPsKwQBhA*NP^jFtj}Qi_wU|m&d<0&xJZyYRG@t9`0>MI*X^+L zhLB{zKE8i1A4aBizmi`DL*Kr2>w8_@a7LWR^QYs+jS~mT11qO`c{PA$owKRQz(gDq z3~djrEs=fBspX+h-Q7Fk?AdHq5nKi;ynXFj0(5{`yAvfnqYsf|wZb_bu^k)Yzv0cjw;d)DiaYK+U6@H&2yhOZ^E8cV&la z`0VaALT%u{$$q!k<*e9=Q!T~E5)uYE){CNu?vfd-3nY{s+!vU-lafI*(b=-x{^h@3 zfE7F2mx&{@*~1>_0$?7d*}5=BkTGE@6`QV9vCZtx?z{80YgoaBsb7_P9&es&ZoY8& z@}jr($kV|t>@Rc`q;v9}VZ&zTtW{aGv@esKdXM#R;a$;xpL06@QbrNpz^XZ9ZX@*d zZ{4^Ns@=u^gB?#>L*3LWCBb#}lGl%QiWB4*qLp)I(t-v3<-7IhQ9SBKQBl}gXHQ=m zO7bXHb6F5U$dPhs(gG}<9Taou(6HPNLBpF%dKv_6KTA$CQjKhaWmgstHR4v}lgULJ zMFxL=l7+$3L4fl6t?PFbSAX>yFSl(iFO2t-e_y+{9(%KeqwVGi7XANDjNPP`Sa3O8 zQEN?K#-PD%(nXco*>?^qAI-aYa|L-Qhlf2Z&d4q7a=DzAGrCDwPL>_-J2a7G;H!QT z&l$!-d+gY;6DAz`SE24!Ghpsw(X5xe=o){Aex`?*_JB0NkwDbzj2|70yWr2f8vgrE zNr~^zFa6|Uv5Sj}rdL_$+HF=QCoX(Nj*`pz1OH#7|8vw>1>ndh^`aZ1$jy=sHJUbZ zWxdGtcU!SyhB3H8Mox|@A5i^TW8=0Vh4=5@C&YD>pNR(_{T4l$tmtcxG5eZai+TqC z5y%|o&#!hp{^ctTfk!=0vr|Vd6q-L(!>ZcxwM+a!Dsa-EAam6M<>N*;i4A;EId2M<; zi|X~!+6ij8T%*4e`#a<2WvhPX8GQOQo?oPS)a?1MZQt}CvTHjryZQV1zxQR#%q2^b zL|ftOR@#{zsda^Sc|-r50|$JXzAe|#IL%!LT2jAYm+P0kcdvNRaOg3zLGwuyJC&K< zYLGQLIy#1i{v3*u@=+b5rw6@j)lY(Iv()U)hj@PXZm3<&moMi|9SZuO{l|dq#BP9^ zLYHa*7od&M=*N@w#Lql4T4w;=&ADle75nwu$h{2UVp2j44$FieECylc6315?!fwo% zC&X%+29bIa00|&CMK%)=0BElrDZseTqf^P?xYG!i{F8NLrZwm2V@ zFTxgKduH;>OH2$jG*+^q7A22XSHJQ2vDoB1*89<00w`J@^Nuepz14f!vbXF6yh0}( z4rr~@drjO~37ldF6G5T77vKYF_d{$6Mgt-)C2ATPA3TZ-`Eg=H=qT7Guo^?&c9AC& z9ugK*HH`65RTAw~7cZ_eGu!p`-Hngrp=5xwpyovT$%1 z4}Rw3k#t{w{P;089lG-XD}X=}n>q0xFw|J29|;%bTFve|>%V>lE)PEKjqAiVXC@E( zpF;yrPUV)P1OtVwm9v}LPX;}Lkqtz2(9jhJ^}qI{+9@b*OU~6=8ZBAtGiKblD9tIu z(;ZerxsUEExAxUY6PB?0nNF%^MfyJhW8PM?pv2n6hj;AS)t7{VoL?M)M!XO^QW56;+@rSZGE|cFmXwJh=$RG1^|vtat7qET&zRA1*7tkj$}-Bf-Lp9nt8pB;ZWC%Z z&mGG0JCFO1U+dz_;&aQ+jD=}p58$5$A99%dU?1i?IPB>^fz`9L>$CJpX=#}E4YM6r zp>X|4KQ3_`*@#@ptxWnL0Uvrfl3v67Px4q^_9gie8iwEZ3EH;JrfSx|%I3s%@q1FU zga3>h>#m9Vr-aV{$J_cia|{5h8>JwQql{I=*}LNW!>`q*jj0Nn!-lbA4(Kgc=-2Po zgKNa08RE?GuAt+^y>AS4BxymaH;#yoPA4Bb^?dr@a72~e$hn?_r&ezX2=M2vh=e>Z z2(G4v2Bwsm$L&r^a&vXXfVk?=!Gp|2826+JpxeG}Tc`_i0#^PP?WB0fK1DMX6%~Ck zn*oWI^xtvqB}^oo(b~}m*=Zn@em0~3{f5o!-RE7j@CM~K*`}1?k8l8NQPu`RNpZ%!abVmJ|b}wQ~1K%=2EU^@Qz@OoEI8ARL{ynHQ znmn0{Qatip?&5BP4}-TKC;|r()SkV2<28Zm`2s>W^MSO2Nff6nlZzW4J9}27x7xRF z58H-Mj^c?fVF3YGIOtGd*e4*Yyooa5bskjiV2dQ~mrRB_;G=Z!(F0WA#-Fk~Q}+3` zw3dylpQxVJvN`ri&k>%Bx2vz5GG)k|clS=&UpO)M=}v3KFnyH-#f0Z)!PG;myQ|m@ zEk8LoKH^a5DxKn*koufE<7&o-6m4`{|NGD#Mbs>tOwawK??@-kQUqE&Wp~ z#cVxN4~(;rBiav8de6p)&`@bP zx!WZr6ke|N^jxaD9}tEZmU!-*_1w80Yu7GLw)Hh=B_QI@mweBN#oLb_br)(`IgaC{ zOCyaE1CLlFf>uPUBDdm1-8+ZIJ-&TgPPqH*i>$Vj{ zoee~Fda*JrX+D<;&z+D3&(V^0PZ02D!y)b2zJ0S&P?K0;h8Co(re@7hMAVOS=d^q~ zkldY0O2UFHDVQhDB~PN#U6^QP^$;Oy+}N>F1Em7;Yq_tf8>^}5VYV#UmcLAP(9XmSiTLlf^I?{(bm`0HZ%-k`nTwQVIi4~YPZ|dskNJ~qL zvzQhZ$x1B-RzuzTe*e&onzAJ~5p_nw>Q}i_L@eUYg9mq2qb1~IWi_*{ik!a^)M3bD z_U}(j5{AZW(fkh6zks8W#m(k;?bp}S69-Ct`h^|{k!QRr70X1yxizcqQG5J-G0E{BJltG`SZaEr_Y{UqPt(TIa6el znmVH7JVG1pRp}QmKYo(?_u z2JgCs%OAFn3xG8>oi>fJjj!2xL^-cS?l10kvAVr_O+Y{Z_CK^q>CfSz^8Eh|+?AF3 zKUS`)tm*XU>0k zXNkSC>yE%5T`P7$H!ydNc8#60XL(84?NJV#=>ZlJ%Y*9c*^FcHzLR)|hl)RfP{s{0 zb7rSEA!=dM;7~{wgN`I944vCY&*j31wM>Cz8ErcQ2h@;^(K z40`jZu(MO(-}ADiCL=z+ps46QN|S$5Rfj)kq(W|u&w!Q=9CX&bn^22hMC1fm&z?N#$LP&#*V>(Ki5Oyu zrYs0pt+`JDY?JZmaLV@n zM=Sff5j(m05)%{0_YWy@=GyS^^pp^|IK%*Zc!Fu1IfPFnLrZLjWXgiRbz zramrQC>VB(kBdv@6tLs8qE@b00h4M!`bsmSkgKlVsi;sIYXCWe1<&8Vbz;W6T)zni zZXLHsBm`lhm3%*=7DzVx#Qpbth1yq`GU{|6KYYl4pb{@i5B6#Y@7 zWV(;Tw2MD|Xygo)Fh1M5)|QRB`#;gYVbLNZl`sSJDBvkK1ka9mX+{_W*j6yEgw-9opHWB*&0!7rg8wsP$f1H*e0EJb5x1CX*LP;L)8!@4QXB zbcxSkWn;rWZ|1CFt9r# zQJlU0)%8xk%S9i^g9mMeyDoY&XWjyeUATC0()G044CX8P#^TTLBmHJ03Cg@C z3_LHsD-oz`c!)CRbYzLQHw@$$L0M1l8vseiVGz1I9@6ymo^DZKWU(?h zG*r2#@(+OC!4rxfJpw9ThB6_izOHhK+nRk67qT3+7iYeFj~;i5 ziZ+*Od7a)F3EP*t@s}r~$T|k`$9oCw9d5SXx+x);pe93cQF_F)pF^(w8n=P&~V=bl`k0T%1RmAjXp?#WoIb>-kyj)b@f7{=~ZPloV%V?CCp3MO)jE zTpZ>8Q%$Ec13Mq@J4yP0%lh?cIDhw>b?@30+$HG^6yPdAmOvYGgqhkGtTbr&-m=G! zx23HM{9a%(-Kc}81a$8%CA|Cap{Y8`5x3!%%h?n}_wU+O^7(?m$vvGm$182KaWyh3 z5Df@^&C-jXJbm`;y+_l;c}B|A;l7ORD2BWrpb%t?(R@R$!%=QDx9-t@zu9URm(j#u zjA7vOH}BpxR2TQ)ppq9Xb#`VFV?$FDHlaBtCivdtPo0`U&0}#ju9Z27b2)=_*>`o- zj3{u{?IbIUO5OD97hv-8n(CYQJMbnNZukbEvztHvHxG?i<}tRPV@{|S$1-ql$A)qG z%pO0#K(qVlgoJhnR7dISPYQ{K1`d@{?AGl-OiblEuJRI3L>;tw5)J}&Uf#qw`^tie z#8S-!bguaLmrw*eCoVN;su2PYq`iBcT-oCA_#*{YG z%8D>>Au(}?wsz;!iVIG~#PpU5a9Xh<28%7X8Tag@ZSvOv%&<;z&s^wu0m24aBP9W6 z_UzapA>@5UP(ccejfi;g;)Ma0IHUQ=Pd?$>hSAzRBO&ARF zDJVx==JTFACnro)2^+b(TzXwQq}kJG{0uBT^&otZDG`xymT>IY1$rL9+!N}PZO@Q~ zQS64bltl+z1{=kp3JulNG=sJoInsK;f)=(Y`#a0OH3t_{&XhI+c^DV!85Ewn8O0m#RVsKb%>E&8p&iQ3NekB7?6NC1c4agpx;O zLQ1gkRo}fy5BOuABrFs6relUj2bqPh-A4o3m>kR0qfLho_s`KAZ8<1x+KU%2IIR54 z9op@FH;!hz?s-8qmgGrWcF*M6qtC(J!J=#^h<|C{*QW0)y#`R^?B=G_uiwm*?WtHF zkolmzoB@E`Av4X)`WyHLSC2r=;%iF^|g7uCP%l+#b{g%tG+?$D%o=2Z51^Qj1BUC+&EX{cN5 z=V#!gw3&gYr_Z0)p`K$#0+dI|;R)mP^}Fp=vUc=X0)Irn6no(?Xm-@7w5FyFVuB13 z`0<0IInUmnB9ep?CoI(?8XCOvAB%!mb#+2~JX;dd?myhUSW%&>+E&|Y`t%~sFF-cG zdJUHwkH2m8)sKxJH5HQ#9=n9Vgfx`4frAE#G&F&om{o9mnu}rGEn6d_ctVn{uELKa z7->*u=9wo4Xin`?pcWGm;qgaM9?ctEy=v^LB#c)w^pow>iBw14>}p83k=mRakK`Z8 z^cmD)kT3g*I}utzU0d4_bF1dGE{@}xyO`J>c~@A~t@u?PM*KDcoT4DSGwp|;kmEct z<3Ay){hts8c#N8L;!5uHx{2+LX>P|2<}mkRc{wokEST@ek;?b)JEYE0SLDAzX&`${ zrQ9y?sBhjZ^__t_XKPyq6Ty(_MGF_wA0&UF4q7#tE8#9_jUYHRg0d7MX1at$b#YFq z-QLwb?Wo(Ez~Oe#_DBHG?+EtP#^<3@^y%H(c>HR555es4VCV#eMUU%@#0Z?fB~ubY@d-O zd3nm}>e7Dnz~Q!GaGW({q1rgQ>(>z&%->)k zFGze!PB~S8cc#0^Q)(I<9ApJH&oON@y8DbaN_dxTg%{ z8oaki=X~&$s>+q8jvrTxw|DZJuxoS1`7U_0zt`8B&YXGeptVuuX9csQ)2A(MYzp7T z;`GKS$inher4tlpD9Y=Ppa@YO*4iHHEx3~n)=O5(X`JGsBO`V2g(JLg+9Z_PA9#Lw zZF|psB_(DcjO*7;e3dpo#&HS8WVVL8sR3G8>5nd*_nTQ;STG+3E`HXG8L%Ji1p;-) zk(80l>N(0-dRPCTmS8rmFcHCx3DMFCO(5itA3q+Aj~7oJj?dTX`5${7@2qz(->pi{ zg%hB?`X! zTV?m|)2CfPoULZ}AKF?5qBeXmLw)E_jHfGIT)zGIQLz24sAc5(8{#)Fy+2-3GJriw z#w#fh+yey4t8Bd#sVci+mp zBkWI`KD{cT;7e~qzbsNC*?K44{dkzeqM~x$t0dw|kba&ZjX<`vOY4R3?(62JU6uQe zXGosK$>0YT@I}TtjUc1#B=z;P#~zYfe1x#oEw72U^g{>WFLPEjyUSF>6XVY}_jJ&* zaW`q(=h)r87@hL_1uF+;Y?0a4j<@crX11woF?tNZm{Zv`gJE)hNc(C-BX3r@A2#$i z@Na>?Vpw zr5DrEVzHD_yzKfp&_aLY$VFixBnL*O9__EdgpTPu3pN8TXzNxfhkv%ZZ3{S-oXi*o7vjyJv=7*^h6T{ z)jw8Fwbg9yqLyK!;5V-4HE>_Mwr!PTdq_ZFv^Wm0tofcR0V@jb^}nPToIBQan-c>2j~+62F5}n?%^Qt$MWbu$^;gT8-go+RfJOkU;lw!eBR|{UVb8$w$q3k+ z5p^hhc=+%k%MK^Cb@t;256+xC+2w2~w-|L5c|!;*gT`OnQRG~p^oZYhL70e~kzlS) z1D#DR@?=vauMz_6JW#QnWXJO}suEt-H`Z2;7xHK^fo1i`Tyd>e4z5x_WhYcD%^dpB~wLzx#W+>Khm z;pp&O!f|szfaE2!_Xmb`T=A7qMiR+c6$HR1JJBGvwYhOE3(YSJn=W3|KX3~K0rzpf zi_!e5m2C#Uru$VJF|*^|SfmjbNEeB-NlBEavw-BQI2R#x0#2P;AyT(3`9f5T+_zy1 zVu?^Zf4~;e11uY;C6%8ctJvI5IG>!HoRaeO`}b?{wL0@VKw}N`N)PNJ^5ps}A~;e4 z4*u>PXWPncWmBF$eVSwV#)ZikOPJ)y#^A~kgcn-*2Z>hl9fz!Qci$AZpiDE${8Uy} z7BtO>p0d4ni|u9`Jmep?7u+v9aQSr%(xsipyLazcDqKjbR;^OlZd@i8v|8zgl(m%= zQ+y53i$Kr9Cgc#%kna8xXI*lmWLNhqLxx5&6mkKVUwlZdR~A@~Oh-a^=doehv|!M= zNIgD#_>eSU%8C0Vw{ScXLiCum$Af~VKt=FFiwrpYytJp0T>>rMfB3*%+5{$H=gpix zeRG?YD&NLOx5pg1$-l-esA5)F?XWH*r^x@Xq{uxI@qWkl?Qm;kB~&Dl7nU@PVjTiB zmjU}~_tBH4K&^?)q9KEtfA~@<-Kl|H_Jo(69(-Y4!-h7S=Y*RVfSL^1akF^}Sak z;!dqtSJ8AQ?1$=c*|nS3zK!fM{HRj2spr?6OAitV;cD%MbM&GWQHm&fLpz zx>5M>is`Pq#!TP!qV?P{jjEnW312ejRvCtbS}NQh@nzVwUo{=Ij;fzpcTK5V?4rW+ zc9Y{rZ0PUs*}Lc9w>=(r&xx$~x?A5MxZ(iMZ1iHK@$h<-;86TRS6l)r(1-(#>5=?F zyelw~;vV!EC7m!0Z<~+LRAXa^LY{01A;-a?8A+a02vejODw2|xr9KI)mMJ>F?xS^j zSnWh3nEO1msuwSE($adI+p1jR3BQco>zMAo*(eT0j+cDVHu7CrA>z@Osb9u4K7qWl*-tag~6f-&Ig z!#@l@1Q?C(v?n+in~i$&(zv4(o&*ed*$G|_a>)f*k2+Eq8t`P0)R7s&cXJen1 z^1_d&5R%l?-tg^&O<=$Dncd>%#^)Djp)^dHat%@!oxaZ-y9|#ZOe_Ux&K@#=Gl-ZK z!xbA+NMHIE;3~N;Hz^vJ_xKkC8nE_`T#aGFZsq5<**aSOlKQ(&`FVQ1m~-{!jfvV` z($!yNgz)vIrrf2#@ad}eph9V#eAz+klK+UfbG7H6xMKSUncaWyG4cT8wDinvyF?X# z|N3r|z>pOa z6GI^4hoXn`&5&)Vg*33iC8s!ahnX4~WGYlXT;g5JeFqPcB(OTE(=^>JCE+DP1uYNq z#gK~@r>&8Z#CUsAp5n7`l3;Tvq+-vL{BbYZ8b`ZGCy>4c@7VDHshGapQ@wZGtzURJ z{_NR)-MURlu;|=xY+y}lpxfs2L*(xHy`U4uoH=#$2$?(dA`SIgTdP|aZtHO19bPRi z^g7m~&MS-UnIF|KlQ2_zRCTFBhgJQYvd@cAiSNhdmv_mdwsKN_KtOVp25>!%}8i@I(ll`KY*f5D5=~OU%2@B+>o~{oX2bbh%$V2apd{b)tfdyUrL0>-}ag z^Lf`a$;Q)s+L(S)<5w5<+Pt=K(6QG)3)A}jqjG=0uFvgDQ$HzhpMLk-^>u?|7nO|( zOL#q2`*UlKuCnpK3!TOY3t|1Z9XId&VHm_leoO7Pjm?PtB`{r>z~j2L4K|dK3ZRF~ zO`bsN6W4zI4)Nf8e127Y-!As5iiimGS@=753!)*-en5{6S1ek+@S8vl=-$<8$n6L3 z!g-K2XjQ6^%N-aPnQ;F-5r}o5u&r$C2E~p`AiR(fYUl1XoOgFpXn1%E=)^HIvj0n^ z4m+<=_mYn7A$FMbpXi<|QToe`-ahi@EahL1GxnKt;deQvcYNJ`VGQZd_6HX-kw95$mo^m_3xm`{4=zmmX$7~LDwtcy^ zd%xlBn;fepg&dPFFMlSt5p?^P9_*~0c}___HY515`?IJ+)+I|;Uy$!QZPB-uuSS0U zN}kUnJ*Tg@ILc~q+n@KJ?TMDmx}^4~&g{qi*u*O);Vv%^*%(ce9a1;kQV^Q0UK|?U z`ZQ`@xmWL`j~YoW0qM8q`MGtz?>WNGI$5Jpv2sn*3?)-Hnf8z6HXDqb*zC=0;bHJz z1igm5-G*BM7B$b(LJD8aQI8-w8W`K-4Nk9z)`71PNp>-Oo^y2E$%rmkICAt_8VTdsSkPQPk&P=Xql z{`YkQ*a*5aca1fRt>5Fdr0dI&xa{nHt5aH*h3(y2zw&LM^wk=%3=q}0xp4eP@^=4{ zfR>o%DNTOs*N^htQdKi)>eTk-`mHu~Q!ibq34V98WB<25(|~tB?sRWc7gb4QL_}#! zO#peI0nDyU%gCOl5WZ;fiO?n8uAL|gKlb{aWslCUf2a&kxa??OsXuODfA?S0g>O;L zr6;r`gwUp6!u#AGkJD086rO$vdiGRWIC7)&=4Efqr_NF>-S3{DT0UT_am$@vPUXjY zFPI;BSAWXP_My{KGG~QeRc*-f|NNx1wXU16=~u#G&C}Cf)=&4v0wG!6+V}3{MKkI% zb1-aW_7U#3CLetK$n5xb%ZRN%Z1%MgZj`iHKWM7>k^h{kzmIfCvvpcjbdjcK%lz~{ z6JpK6I-99#$POqes&N@O{8$^oS7Ew=PTa7vu!<)p4|^9k*7klO)6}{$)t-VJFh;9Q zhqJr0m(1>&+RuB{ZeIh(6%P$&eg4%FuIcC4*=l;fVAH!EvaNgf-w(-sGt&2UeR{uT z+3ze}8?#$q%!>Z$xXiS!(O2Qnr10=p>o2r?{I$nA<(Q^$q;+1`5Y?(28>3Ct&NLS~I%te|bNUA@7zNYl_VV&i~)=ZV6hX(ihY#D8} zcU4AWJKg zUb=l*?Kj>wUx#cx)OGRgj6Kl{{cOf930BJuxz+g1L|GDPMUHo+_-l`T(DsZUE zzdikp!kFzni_15}ma8>?n7vJPz>xLImxnobN}ArF?s7eArmEewbJ3FiI~KOO<;T7b z{9W#5r{swZG9737 z7JNILnfrKo-G6_S;MVQZ<=l7GCbi-|(&+eYXjqL0$Cntv$zS`Jha~FSoYy&ANungWg|Mlw4yBp4~*2W11 znj}w(Gtb#MF*sM5YX{tgedm9^^h>v^yfo^3Sj(;T^3ruS0e9X?3U^hk|K}QX@z>6| zv+u`^x8FNUWjp-$pG>_w{eSzm!T!qs+nY#iZfL)ye8GP&%HLmW7<}Z^sSVtn_%f_c zTZ?rFXoqA5{+G<#%Bn7)?s(BjUWJDoDNZZ(0MqVW^HBq+4=V5JcwM|yIV z)($*0tFxRO4ar204Xp0M_?(;;VjQjLustnBy;l#}z55mx-}52l$+$6~`7k0Rl)7vg zvs^C*7Y3O-BOOkk*4S?*C7icCgD0-se*}Kte0%8xvHu;(7#ax34`D6_nAs5qbl znD$uVTH8rYRn>uu4@4B*|{^UfiFN$EWs^LuoY&ZP+g+eU|J!MV!lNSFG zu4U(`*vtRO7lA_c>g1MB*%(qAUj1|uq*m*hFesuNm&ZLp$u#|BA3tu5HI)>aYp-;! zUANQanINFHz~#cbqU8Aa_(Z2uPtM;dGeBT&BS?4Xkl))L2a|=xJ>_dm6UStj7ds*T z*fGUkz4r6`BO)k2vW|9Hz4|c!6%(_eq1K5G6w&GUWGEZMru(d@sKasTr-RN+95C?B zr%$dcR*ZF7)#;`blW%Y0pFc1KGJg?{)T7fuNBT7tEbEuXpf;ShPZti)#jI zg9cF;-S(36nJOpQoW7H4XDU{lr8!NznT2TMu@iixlF+5)>XG}!<^#5y;pDQ;{#u${ ztH3aX*O;35N-zf);nke7l>@I#$eCCgaz(@1(J?nY-HSZuFXQ4%n;vNGDZyf1FMZW8 zykbN6zyXG~_S72njrD7Nk)820qvn_981FGdBOg5|8y#Jus!&v3u&AuoiKGD8Rkp+S zsdgd9qi45KwOD<7v5tQ*JAm#psDGwvoD5TRHYEp|x!Kthc3zv8 z?ml3@8PNDJbRiECMG##u3oWzY=F5Z+@7_tv$gEwz9$}ll^kYa?;-~B+opow~?}xF= z`^Zru`4Ssw(Vo=6puZZl9#j$1`xIkiy2Bt0Z@;z((uXcMWM*hY^kre=E|h>}pJIZj znMu;+3*pCi;mHqr5E&|VyA~@kq+yzQIieO#&$@X&#-&F<;^d-rPts$r|LM3pX=xT3460 zAd3&JcXZQOxD_&)I((TIDYPW;`iFJ^h`Z#ZRn=nO(dEmBj9>6$ zRQ&PdTeGWM#ZEq)eW=3``_1H6^%2C{MYK%370Z{u=PUE~N?k4hfN5+0QcQK0-7%mJ z7*>~-=*i*8tzI}3Ce66_@L{{b7ts0?&3=CUDmq1|5V*ZihfXqRioZ~6sJkXQl0~^a zyL9W?wLv;McgxFtNrllic?`O`_pV=88#ZkBU9Aqik_p25A|hlLEY5u-)$(HD*UraN zgiUNG>U{^RsJvuL=`5iP12Ku{jzB3X&{ox4T~WxxxX@vKx7<0mYYG;=*aBw}6Y~`I zVNBoKIXHMemB}kA8oL<6Ezz%U9Ho=+?fGjkU_t&uuBSU_#R-4q=N&cHbRu$BWRp)^ zx9&UqMCE66H_C}fHF{i_tAabmesIQuKn1C`Z83~sy_jiX@%2Qk-zhXEWW+`|#tOWX z_wGp;zTD;`l5%oMW&PXWqQ=pIj^06k*WdFSU2*O6chi504t!k$Wf8*+ilhAvyoCGq zG4?sXQjfRPPPSYAUimpr6;u1EzvetTdg+n1)ZR%)e?L}wMQ(5X$ht$_sGQ8u;EFzD z4-t&y1TS2oP$b^oW16j~)H@U%jR)*>T%1UDz_*`1dD2`x0)2_CxvTG(d$(@!(Zlb& zr4yhb{SJ$q;X)j(tQabY!?<_v9kbgAqsNUC+sHXM^lj0l!qdvq65j^RF;=Z!&3FNn z9y&VZM`^3RsJgO^HYC`8MeYEn+ITv_!*{`-pSNK5!;R*0QUqn%5zk1#>YZ`sObI3y ztT;No3;3<#Vi^HhJ@mkVahNi2TCH2Z{>o@MsQ}{i;A6uPcG1AmaG#cyQeu(vt z0@b(?7Jj&#GS^8y+}`-Kz+TpXdN_u$^W zc`44*F>$k^$nLA1oa$&OHF_M~R7ZN$%74IGC=PiE$fv7)vUDQNTDEoS^XB#IV~L4& znAHj5pgIog25)bqBnn#b0mC(WWugq?%ZZ#ZXm1fWFt?k^-Xd@do;Ov6L$m1YN zuBDpF%Dh)~gy%J!WVFLot3GovBfWDI4P!pjt)-TUbH|Li43lZQ$9yr8F=axV{n~T~ zcYUbyj|-DL!sbsiqHYM`EsIu=U$-+5pFUSwytA1oMEd@b!te%Zv5(k#Fk zd_UXnufd8>A|Z$+3>q3T8_f`0u5hPfpW~n)%?kql!|7Us2aChMxG#10AEY4-wHK2b zbM5SeJY4UHOPA@(%mc%$!=D3{X!XLj#6E!5Pk05Sp*Qm{e>+0m{nI!vo^eq`sF^c| z4ICI?6o-HUY1z=&nC;uBAX*TKtvp%U6zT!`!pD)>?B5To$?cKxJJ*}}=1 zR|nK{?B!o@QG7yfeoVq5CyXDjiV6?)^y`C{Dd@uMeqJpv_<> zgAp@#J$n4u#>%e4kz+y1>Q7#oymh5L#w+o2PdC%$f2B4+0yd z0VTW%RT1#ufqJZZ`Q5w9(Vc`Y{rjV(7jdR;78PBlJ>&E6n3#@2-abD;0C|uTtZi-C zD7OuA7mxocA&&=041vWk$R)!e!D63aMRQlV^=HTvCzH#PDmNyDwbEqwjD=SsRvW+( zIb&*SDtMAV4?5n|h4!i7XT6RMDepbT%9?I|p=H}bWE?y*hDxl9Xm6wMWYONp)AJHt zVCe-wjzc`8l*bc$2F(vJHebo>Wi;OjK~f7P25X@0-A-|HL2dYpMAtR(4M<40KwM_{ z|EpxTnH&ZA+rO*vz>5U{!(_1WM(6;LWHvb-@+wOdr*xBY23~>XSL|5L(Sv6782g*e ziSv`q&1pd1Gc%K|;IzU0+tMwNgQD~HctpfpY)-r-mlB02fAnS@U0tx&E6%9>ym=go zuKoMxfKKsx;I$k*a7pSDRCG##knP!@wr7LB-)ZgNF`*Zt!-7Xm`3j7xjk!jn;4cEZ6IOTw@n4 z7V^)hyIuNBJvN}7_OYhZr!$Wb4BSS*Ra9w-1GJq_->Z3f3)xF$5(~z2uk=VU`Ut=@tXM39*vS2651|1ixx$fyzS)kIlPoF-$WVZrTk-^^_Tj}Z=_V{)! z0&cMwUOqm9Y20<<#C?|w+{u(G@Sv)mRaLG!0;i4SjvZdRAQRu=MQUe8ut zDmM8a@;3l-I9NVaRZT*)0AS!BCi0p2*={V2e12iMCDJWHJ1Xk2c*U()f#p8exAET7 zr&vW+;-RXkiH(Vw5ob>AscO2dg^9^hLLI+H?FADI-%_&+TIUDNxz^%uGu+jv0S;R0 zDFwzWtq{>Q=`H$<{J?&nT%e*&&CCJ^%;7);c*}r?Hx+OwNh3!h7s@U)L~QFQkSXVV zkm;ezjGWME$3QoLMan3Q|Ft^KC_5{ic;*c5qJ4`-dP-NC}$)dVfoxgZRe6%1M7%n3kqyt<_1J7wYsh-8U?I?}k3-R>hUN{Lt7} zk-c&1R2!RvT3VB$Lc=1Ff`)0TpE-TDod7nf>$;0uY?`VCLiwZxIpz~vTzQ(kdaad_ zS+bhUl`2y;1Ac$4 z7B*cojdC`;dCs?Wfz52OvQR6mVw=M z?AVOtWck>8K%lp8M=iVEmz)mWQw@WOF1;%&H|%4>pd!FH6w~%0;E1cy&aA+^Opo?W z8hyT87!)l+cn&Ce6+It@>*xgU+J#pc9CJ3fa8-HwoJo_MIP`ci$@~a7R2002HTm@E z>Q{V|V#_$3+T^_a6C9-T8{o@#pjdq4w|DZQ8xt&!PE8LN$PjvL3>i9f%i3X+V5&%B zgPOVCJZma)>FLo;Y;AplZkvCzXUwR{-;Ie3Bo?s_yd)`pwHmaKOLqV^TuyaH#@IJ33JFiD_JlwF6t&A>=O-TFjYj5BepMY_&`12NgsdSZFqB-n^J? z+u93xB_*H80(4R;i4n}VtE0hC?_7<+_GNVq#zw|eR6>%*K>?z(`B{dO6r>`1X}(rj=ueLa`lR3z;1 zY8``Aw6tc~>gMR(0M$)bRq%D>X*I;GaB<07{r%RZjeuO97cH^K2Y4_@!t5wXA=+#y zjr9EebB{RYG2Kr~>s)50kFwPt6K7)LW}mVSFdS9bpuc=sU~jMS0I$#Z{@?U>`?%%t|6vB@mKGbe(yI}7$RX`e9 zcYePk07e&|;B97V(Q}RPU(i|@Hj)gDFkJfH z1KMY_o=(rd_M~!p=;og{{^TiUxvO<{Q0R(Bf%JPLQA2s%A6ofp#UaB7pC3XVnL8Rf ztR3CFJ0UKv6c~T+Ui{J1)L?v9*EoGDMV#?@|M=|8$cS>D!|LYIe8pYcdTq?kUfij0 zR_vHpo->G zdGcw2jOosX^p8BQ%?Zk?FLr;dBO=b6k%b@YF*oBZz2V;Bzh0Y~?#$SF{mhfpa0R!5 z={MAW&v_EkAL-?Febdg$ni^QB;ke32|I+;o`+^&+O+-pPoqJc5ZIP z?b~8w0wCz!+2dpgBkSZ~?8evdS4bP+Z+{q?Ff8+m@tLHXAo)FU$+(lKf*d zjgMFPWXKPSms4oq6+M8Are-RhZ82*O>|2gWCf~C`LJ&&=;C|o* zVATc>W=M$Ps8Q{~^$q530mHQBm7{~WD8eva|;4@hcT}eWe zYI}w__bTDupFq8B#Po)ALLf;j+l4Sm7D3NoK!VKWZ168zpC8ITUshIvry+=94<3{i zV0H73CzXA;LH{ZYx&$uPg4&p}z`vDpLDrTMLb}7bBX<->PK$frWxMf~aa|^H!yi9( ztgTHx(UQhwQ{iK^`gS*luq`Q(oux@nVoNJ4DjBA}`>~?u|l3kl*f;IHaFCX5Gi3*7qz{-OoxGv=T9tr?0&xq z>H5{MZiDlq_(rkPR{Ez!DDd{!5B5Nvo zViXl!05{WXKf8xA!ILSnOxI-af~;0z_j`izf9$Cr3H$XdQ>ry zG#zILG0DK`C5W~%eesedLH(v|nObYNMLXDhs8$qzdGykfXzGe+tW4Et$NuBDJRV`D zEmc!C-8j|t#b{=CfOLCmo2Z0Aa8QMab4N1wcU_@U zdppYf)>j&K1cC?7j5u%KDaG@zFO?MeuP;?~Z;{BZ4`ZHQ8txs!*WLcOU%pU8tK-30 z>tI;E^Gjr4g`7z;7b#b;iNPODt~vK*h(S^EsZ$-FefCS=xAb9d;q&WTx1PE=RLBD& z^y$;v!($y);OZNHH)l2TC+yF{F(I6oNUN5WQxuxNUw>QQ;G2V$W%QxLhrXX=Y2fkb zgY9-zI{*GV7^c`lNkMwd5S{e#T0hR_N0%lo$Z0mW5?O?(B};(D8wQ%>xz=dBcLq2WQ2;h*ZD|Y-=S&8u! zVyc5Mk-C|3v2;BXA+gALPoGh82J?~apUrkwhPNFK6EZZiqd=LllfW@b>6&FM~(<@v$u$-f>%L{ z(Db@z#L|_oXKvI=(rH1+n!jZXt1(p3A_H;=bO*QVDshk^!=)uXz2=rfSH;bsr@c5H zN^S2DHMNmIm6BVVC)sWkgl$(aKb|mGXHkh|(@afiMbK~fqPF|Z)Lge2rFC|eL@|pE z3#%g=p(j=wfxAYRatPi1nnQ*xcXHaiB%seMe61v!6a1QOjg{y=5442OZ6n-${|#@x zm#RjDzfR=mckgiB@c3}jy8j#wX~kcGKNX8EdGp#pbGdB+hO^fyODE8!YOaHW*zBJx zgC4$}B_A2T^VaDsIvoWHGFOsZ=#*P@DM%AX8-Q1+2hYE*T;SIct>e<#x3kzUy?0-t z6$1S^pbh_NJ$~tuXJ~bE!>f>5#0JFzH7NgpQmH`qh^q@G#GSqJSVnqRc%TB!?>ar2 zYj5v^6w`20OS;N^wpdfP(J~o1fYy5d%V67b*F~E)BTFKSj!oB`axLleXRfh39b*eT z($8ui%g&z97z>LT;WH9$M~{*G6=#-UvBcT=!^gmo`2ja>+`N>QwzxHs&Jy88&dYo4 z-{*LFkCY1TqhrUMYikCc9-=ry`!K&m4T93)9_|f&#@vfq zx7ph$0OMowPqzBhsoP+)+}+Qko7&j)_@*I0a}MJkOq*SWg={FF&< z(o)B#;}*l~tGnO9+WOJ6XT?iXckbB1X7#849e|21?MRebQ6iI-?!T7cjHU!FBqN~B ztX;Qm(1XddXW!w1bjrk`Sw~^Mx@K^3wb*+R0)QKzn^c79Lx$9S`=+U`zUiM;kk;60 z#WFFc-jG>oX*O5G(-^WiU?Y@xR73={HKndLlmx-tm{pF z1r)<&5V$%B8Iu|4FVimgqf2nCouWhDT@qEQ>gq_EbXKoH0k*WTK-D`((Q{2r=b!SD zf?2FVHsFfv^rXx|&Y`;cI|>)!L;^A!Y5!9>ERsD2vzeAQ%5&h}BBoXijJ;E+(iP|J z28KprAqJ9S;1KisW-_H19Xki)^XUJNuFgEJ#hTQ6_gwz<7=%u1dnhYEa)RbSVu zTnNe&9{TNk+MM%2@R-R#Sh=9EFwmomCEejSZ!jq9(lMg9k`nFIo!942XjeB?6eobK zfSZux4&UB>I5$*a)*39#4&k;ks!q7_jn($;0x-#u#Hh|z4OrH2s?8=f_37L9G?TT; z%GSs434>YXSsi3uTLbzHTz;&<(@U17sYSI#TX3M%d$o)V^xoFHf*(*qLZ7#- z6Z_4L#*O^K2pPxB9(5OCwdw(NR%;eiua@`zY!0dwzolM`fQ@c=BH7;K*5xTzZ|>3v9<=|P@w(T&Dx<6J{H*&HMIn;%wQ79+CMWIM z{hd*bUAC;r??6RFb8}TrQCfV2e)uFU8fn^|M@%i)nS!L}s#P^7hioBg5gcjcppXP| zfumd6A1=yUdhEzq2*UpPMcS3KXIHRoIAH+KHAY$Ec0ti?(&rknur9~Cgk%QC^y%(o4*FR3xzdT(yNH%}zHs2ulZz;@lix{(Ol&py#{`PA1cvSF(|p^M!KEGjR+krVvFJ&K-z9g(jv{r|;$b)yMtDmq$P44}O_=;SBW z>s`QjM$&?f{;_C5)jHhr{Bf&lL67&#JvNxc0Oq1L1C=K3`0)T8{hpzgbR@cU=@PLq zsl8n6VLUW)a&rYjM{KGlH{@FGcloS&bTJm)+{K2gPipaR>rM9{aeFsi-J$)4uR6MK zpF`f)Dyi&z{Q0}yC$z(Jmw7H#U9dowkT)>6wtZW3jiE#B`kg#=@f2xkdfnrc9^RFe zudTx`3>i9fbE0dRSNa(`uyKM!jcHQL%^yr+%!r&pn=2r=D~#F2Uk0}8*j?N?aO_P< z<5S;;8t!1;R`;?1P^eYj-ai66KqT2vx=AW$dW5!-&?l>?1Q-A2W$?pf^S~8oT+kHW z{MR>BC~D3$etx|uCU|`Ohv-P(=u)$`F`-?zfEJKk+s_qL9Lst(v|pevn>K64?7W48 zZ8El;Nj+tobmfinjSS|1GyUpR{XAX;H1!ZmOP}~!9KVOI&pFq$VRfg*22Pv4pq!_w z;Hc{`9^^XdnoLp>vaCFJ(2WS7B;@5aF{jFKz zfxasiYwPQ;)BW^llXhFvLq-0c|JW?ZHJ|qJ@Jy`l;{0>-=H%qU?cIy#BbKMfRsQEy zQ||jQSPkHD<@_akHt1Wt58C4KT=Z>)!P{P*pKi<|k` z|4JtE^#+mV$6uoUe}7ZP1dS$%wOorS1y@4YKR>snN7#+>=G#gw)l2l5sT<=c*D6|d z^q*f-Q}kusjd^4fEZ{xQJA)kI$$ zc=g|JzNRet-$zi^h4u08yEPrQomc+%pABvAnXO?Auni7sp&=oI{?;|SeDNZKiT7}P zVP@TIP0ESeIMKS-qR68H@X)IlKxpxkC+m?kBTow4Ls^%ZnF(COEGuH-R#qM6xlW(X z;H&{aDxFh_7PdSeKF|xABAeD--DG`z_1wTcj4EBZa)k-&*dl>}2T?J_gvnth5Cki# z8h;e^>7`os7cAK!AGUAX=E6WEi@txy{^^fddUx{kjnM2MXy3idkD#l3;{(n0*GRBr z4>Xv(7=CDV^&K|@(qTN3m}UyCBbX66r#3r-HVn0w z814lTS4&Y6NNMo?!-vq~K}z{F&1mJ)H>6f*34Vdi9F5%WOM{*}>WT)20fQv6*&KsoEKM*($E!h+KcW?V>?X{n7 znJVq3G8|oSRf%Ps1O3(NW+(&c;Dwg&|4Lo5MI_rflfo}60L#Ezx z_UIT;{_fp4@bDX{`X*$E1GFdtA z3N};UzpqXAn?1Xam-A>s4^#o_k;6F)0SZ$DhE8HcxB?AsVr&e)sIUGO8I|=|bZ!k6)Okw)d{Lt&Yi~&ob z{%C1VDLmBJmGqnTA=>0;paQ@~WuDBs9ow;EfC7|4B_)LShl7E_Uc_nwh+z?|Ps`y7 z#~l(Vr|Ah(0rJ~;HY_?iL;&CGgSfxxo9gYnBN)^!?;+?0Kp$oK-Fl7g4;IUB_oj{I zK>+Y(Mv36FCNH@M+e|DKl_(IzHRWt9&7J065xCVP2Z)8w`o)Q&XrX?E2{ju{!l>fMfM%N=(F~-8svx!8ZJ__uK)-&jn@-X~?V@s?g_@DiBpB4` z>A$@hCLDXM>f-NhUEBVmv<2Sf1|lDWCdF?54U8HKKB%5yJ4~Cl zM|F097*!CHg9ShFVd8Y%au8XZ5$H$;NP36Stjv)3fRiL8xuBc&Yfu4q8#KJPZIeQ` zlimUwnL2d^Me-=sPv~s{7wmsN*gFAr0LWBG9w|tLT1UO;;X|cX=Y7mn{2~VjNo7PR zCZOpJDM+bx1sKGm5s3RcYR-H{fNMYve35~1CnFfEeu=$y6jqwsbvFaPpQ71bJz8kG z(W!;d-|R|P+dGQ9d#c?AJYngHh$O=fHi5IkL$ld_6{V%Wu_L1(X$mJAK{vtaJ=hlZ zkyf&4066|X-kpR*$w7i_VA1{iUr?{*AR3zt6HDmtQKUf@NEo@4n+%mnDb$k1PK?do zdinf$8um1u=ob)0;P0GHNI=qK$MNIGXX!C;9v&W^2-|D;a6!BY?^B$En5Mp2QA@WlEG$b<5&0&zz^LA{}pDaisMD|kl!{_4D zkL}HV2AYwDYH4ZBa&cj##TfyW_S*sj17RR-ov@0kh1CL$N3n!4d_5hVPCf3!pjKn4 z?JFL)YU~k8lq2srWSA>X=Fo#uMVsyZJD#yWq(>^~oZ4lKd-&1X; zu^yqxg{ztJo3thXk;7*QCkd9m_-f=SxNxikU`R!P@>bT?e72xB|rUBKnkxi?aZvk}oN(q`& zSa`VWMK{8NI;@*01=`!LELOEFn`jexq{w*&z=#i=mCLH z^LUA+4fei6BIh_duI6EqLs1eS{`HnPhbkDJ1XDpzrcJv`bA?Sv*2|d#dxHTFyrn@7 z-ua|LcRqZZO}1xF*1`*X0F)vdeOu^tk-@@6*ARig1Sp+txZnQ}s@vkDa?wt}Z`?t2RlVR1cfk`uFEbZAW z4n`a0f)+3^@aJi3~Yj^y13MwF?2LSgpP4#ofRI+5IrD(iBO(`RGK$#O zD%Odm1_hXVPPR({@20m!|BOisjd9*u=lW;ir65d9A%ssw0z<6{4SLw_Bq@`sj+N=t^(OQ9 zUkuhLxo%`--NKm{3nOH3rfc~=gmWO43ez$&j-bv#+cHtZ&>E7yjFz97Z^LtZC+j%8bNg+O1QCX!xMKZzFCDv$ZBKDa zr;pcLAEW8cff$Vl%JU7Y9}gvaUd<89M2nMygAq^8Z{qLdry>aq!gKY{ZrnhOZ5Nro zKw4((t=7T?f(BHeeG3vPXq(Ayil07hwg~h7d#EwaCbQMFxOm!WdeF%Hg@QU5P}g`)%=eI%mq8+b`!=M&{`ftvjztT31=nIaeEq);n$*wBI~ZNh&{D0jYP*S$ zQYbMd{rgh}M?P^S!=v@X;lj?=`&(EtP~~3envwl%NP!2&9y3Us7A;x#n?YYquS;32 z=#;L(@0UjfqJWas-%%|;-AK7tFBFpCm39e|ay?PbV|G3tvUuPhB+FK74RmL|Um41g zOU`o4Lr4T$E&>0v)Y7uhVH(9>qs9zBC5oej-(BLW$s4vE(f2@T}~vf`ZMbKR<5y}EzeS)Udr0wkRbvTxo*&cGz0 zGkr?In(++v3)_qjNY0R3aQf6Ko>lJ7J`sEOntxPEaiT7vf@6`;A|tdwL3tf~dT9W81BA!78h+ zBR*l}W)6X$F0Oo!9tV9@lW+3)4&4r{~YWK4H`k>o9}~ zX<9lObciBDVXdx;qNBHaCDNYHQ%zg*81jWF6wuC|dk;U^t28%^3jxh-A zGOodyq`K>-o5A8gr`UBv7QREIZO)=qfKnUm*Q{CNmGq;ax3Y=~Yi$EEG!P1CHnB6R zi(2SAzzC0l%@Yw}VOb4Ho%Cz!$p_k1Wppmyz3b4alPm6-bpD7HTE}+n>ykEGk#0b` z@#dpS33n{-a~cr2gZnNQC>H^pBse=RCi)-|0!GAwT|aRMK|JqS^%<`-K@n-wy8h0{tnZV+8|IIe1owp`4(YrV0MC=`fndO6VTZ`f;Jx11rnbS zaWD0-9TkGI+So26G0j6`YP;EIfo9PK=^y2;Y;AtZBEraCEBK8K`GlqsLXKcDI(dKC z)j!y)^;IcyL(q?c6C#7YN1c?3eJAK~_3AZ)se@0?45J<^J(s_gZWL>@CZ9;k0^#(d znMuFRLiFk7)ieTO*N*KZ_#5e|z0$d28zrx}d3WK;G{*}pc>76{_!ucZ?;Nh2l4lz? zNdL}DICROYkjJa&>pVDnyzHSy5YjalE_k8z(U1vmT_!Wv6w_|tTLjuTeKoQoV`G=4 z@&^mLb?!`%Urtw#yQkiQuyMeq4k zTAHzR2|NctzU=6Lho8ozIKe5D$rhmfwLS<0YEOlTQxqIW($*gCP|j;>(OjN9ZoP^oOv9S!=ix$a4|Zx2JPfQ!M;G?$$x zi(35q@1YfjBq1;&v69LxJP#DRm0Qt0pM$aR$he*oh`def1`bt)Bu(tE@#x<$Y1DY{ z%|IV?i#V05$S}EQ@V6>U-raGq5RvnIV~-=Y6n4@ew5d3AxfgP_G?E+S9}r)n4j(S) zy2+;Z7Q5E3Z8w))+X}VHW!5ZTUO& zK&yU+!S~;pE~OZi z8^fS@wJ*iMezibd^fN^=MsZ(_?5S}VAVo8;^B0>}f#5)ZM&)o#G3Mo(pDdZ1Wmv8kpCm0Bmtnu+aGo=_n zp^euZcnEdJT@!EI)3``04alvVB-=d+H_^zbC@w^H^yqwd_wB34j2Z0PRn$-M7% zk6kN_A)760*2G0K%YWA4s3#rJ5ZoEGCqI}65QMrCYK<~!nq%mRA}HR5cOWVA~FjVuI!|z zJP;?8G3d9Dfyeks-*ZdJK(F;oBr_)+{q2-VgSe2PYwD`_O&&_;@<8V)TzS4?$u};W zTmc6&rdYXn-{Yp(psI&EPoHjn@_|=>J}`wkqrDa)!b(DN@_x0iQW0n#)M9#mN|I5` zLW5e~QICb|;!h#MsEte}36f%lc;&(c^5yI87PO3MnEv2ShW6u=$aF{Aj^}4KZWNpf zypCFWyBhUv4iXC%!;t;PtaxVGRjL1bTZc7k3}Z&8CH1yGQo@jB!xKPKYza>#ZDfI~ z;JOoOOB)yXU~DO960+n3TGTAcBw8W~XH-HYy3JLW!Bn|NY2kC9v;@Fe;I^tE9}lZ<|26H6xLlk zR+OyFj5JBmf{ht$Y=%{(rvh$LPw`Jy-qc`jh^so zsUc@PXr{V^!`Fb0ib*%^#zRt{wg!oJI16rEAKN<&GUl0K6ZQAG#1*zryK~OC*Rq8R z_d)E-xG|2Be~Z3-(a!G%w8-k}K0$MMC=Otpw%Nrsyt3^C4}qA{Z&N)n#FLVfQx^Od zQrPIxmyaFWcB32}5nQm(<75RAH}<*aB}*Hd!60P3kBlGdmVH5?DJX$DCt@f(gq#F* zd&ah-GMxI5{?z!UM)xw%(<_9-^zuCj z%b!P&UaR^_eOH?`?1;&R`!{Y37%^gRQB~&p+HDPaszv^S-~h>Ud9W)jslb!no-t(u z_;9D5x_|v>-GwLJ4h%6dd0tdxZ)ZnS6YyQ7$A=K0%Fxj30~Vi{XUy*Ci68}fE2Lb_ z=?gp>U;V7BsiE#c!-S3IwR-gfc=Pr3IxlO2N+*;O48EBBn5%hEa8Nw*g{GPS=P|B= z=OH}D1i#N5vQ%^sPQV+5k!uMI>SV;3Q7k2qDtV-#?^k}HYaFw#w=JAk5RWu7^+6ZJdFd4{PRZ0HRUMFeUm z*FW|V&LoZOs(mMuQ9RzwdZ5J%yT7ovwc1{E3C=(fsfzXQ9csxfUGF{qA|3&MQz1`0 zdp5_!-puc<-q^8!6jg=gEHqJ7khsC=?KNjE&R|S6#dOz@P_w_Ps?tg7Q~l(^0F=e^ z+<-&S_1qJ7f%J$-KglqHKkxZ6ohVSwQ74q$_qB|AMj6ioM__>wg(1C@3b4h{?x9~A zvBbK;&{rg5@1=+HOh}RFMWF`sH`aJxYT8GuK)?8rTlGh3bS!tF%{6~W%mlt_Wdo4i za(lRkM16iSyE}VuvRj^Fl(BZuZ$qLw9ULUMfFr6wqlL4XjnT22>ci;Y#8OUSz1|;) zYYpbkHoqdo$dL~?NQMpDeSN+_h$VM7_$qjEFvN-t@^BT(`pQQSX;305yT^WdlyiJ_ z1Ra&r_{Q$1bBl+qSen_|V%%M_H*v6KFiX=s!-(X)hw7+7>=(O})FU<*Ee71&u)x4Y zdz?7{~d)DwwBAga?+O-SX?-N{_U$}$k@{P&7AU@4FvpA`Pi8@wUAp8SQ=dx zw=c`w>whK&e>MRmncAd-Dco~9oltywhY5aXw1D>n{3hqC#vNhhGh6h!c73~!T}9ox zty#Oa<>S-qJnP(iqpi)t%KqVK&~+ zRX{pxii)51_=L;h-oh#;t-8V``V<%5gI%}E}x^k?bdx>-!g65`b=wwcCkI0FV?WQ z_WCbv8A~3I70V#SQ1qQhBwGg8Zz>CW`0QDJMJ;@XK&fnkrl$SN(j?ft_{cI0@I&BD zK^EsAp)YN{bX0CIra6M3Xb&ZhYM%R5=fW;OBbu(=Sqt*RkjuBG&za;Z=wPh>a*<{) z2{CDw&Fzv7*Qy4R4^iujzqaL?r`hlNo(i>r>039yI?kQ)+3U6PHjkX__t34nv3<+e z;D&@rOEos<^eM2cGd!DFJyA6H&MIrAIUj=BpNO9#8<{h8W!e>EfAckUFCXa!Hx?O1 z_v_d^z-P3%KvDbk%20_dSdv&T{cJYHGjQ&royv=D-I~`oy#J70>*|laN{*|$ZZ=5& z$*tjib>EE6-xafCkka&JJrzT1mgq;m-kY_~(CPB%U1v-79^4*3>dM_y@R8rv@ZU1dYbZ*)OK&L*3C)m=h0PV;*8H0vipY=ABDIa zE?)O%je)*nPmK^f*k4ss0==<5z zrAD!yZUdM4>3IIWWa{`FHBa3^o1Vq2Ng1yjweII%mD`mL*nW*Ep1P@7Nk_l(V5Q;b z*|#TWazWjtA%=JTr#c=5sF&0U{P!#mCHA1K~6Y-3aEhH%$qUlih=p8l)q`>0Rf z6fcb$9&CTDgLr1<5}U3|choz3e>-+D&h_2@@SsdJG&Ut4{6iXds$L;uqwM45$aPMNWSmVK0A)*DD61%RAuAm zj4!2yQqlB3zIJrNt^JU%Dr6GT=xRtg^UEi&%%1wRWE#igUlX|DGfB5?x#gVsm1no=8bI1<4pS&_U z#BrDS*m#qSvyK4%4Jv$CV#G z*fnCr!obQif96M(h)zxZv!UE%lV_HP7H0FRPrgQ>x(ub$%SbX77WjEQeAZG?V~Q6 zNx{95vE^RB@UJ&OaHpZqS896HeE#@#c=<>qw~P?BG-n#T80_vUeW(Rw}cpjFrK z!mQ^^#;d96UGnB)J3IFFD$3Pu{cGx?+{nu=9>zP=wH|6hrFzc!8_i?yE}z8$RtaYs{bh zO!xM0cExvlhXpEiw$f9S&+l@`-coVv@PB?9z}O>pVePF!gl+Ke+pb4j+pVs)TV)-+vs(D7jg_6{IqCdu{|DQp5tsk~ diff --git a/release-0.19.0/docs/kubeconfig-file.md b/release-0.19.0/docs/kubeconfig-file.md deleted file mode 100644 index 739eac51d7c..00000000000 --- a/release-0.19.0/docs/kubeconfig-file.md +++ /dev/null @@ -1,155 +0,0 @@ -# kubeconfig files -In order to easily switch between multiple clusters, a kubeconfig file was defined. This file contains a series of authentication mechanisms and cluster connection information associated with nicknames. It also introduces the concept of a tuple of authentication information (user) and cluster connection information called a context that is also associated with a nickname. - -Multiple kubeconfig files are allowed. At runtime they are loaded and merged together along with override options specified from the command line (see rules below). - -## Related discussion -https://github.com/GoogleCloudPlatform/kubernetes/issues/1755 - -## Example kubeconfig file -``` -apiVersion: v1 -clusters: -- cluster: - api-version: v1 - server: http://cow.org:8080 - name: cow-cluster -- cluster: - certificate-authority: path/to/my/cafile - server: https://horse.org:4443 - name: horse-cluster -- cluster: - insecure-skip-tls-verify: true - server: https://pig.org:443 - name: pig-cluster -contexts: -- context: - cluster: horse-cluster - namespace: chisel-ns - user: green-user - name: federal-context -- context: - cluster: pig-cluster - namespace: saw-ns - user: black-user - name: queen-anne-context -current-context: federal-context -kind: Config -preferences: - colors: true -users: -- name: blue-user - user: - token: blue-token -- name: green-user - user: - client-certificate: path/to/my/client/cert - client-key: path/to/my/client/key -``` - -## Loading and merging rules -The rules for loading and merging the kubeconfig files are straightforward, but there are a lot of them. The final config is built in this order: - 1. Get the kubeconfig from disk. This is done with the following hierarchy and merge rules: - - - If the CommandLineLocation (the value of the `kubeconfig` command line option) is set, use this file only. No merging. Only one instance of this flag is allowed. - - - Else, if EnvVarLocation (the value of $KUBECONFIG) is available, use it as a list of files that should be merged. - Merge files together based on the following rules. - Empty filenames are ignored. Files with non-deserializable content produced errors. - The first file to set a particular value or map key wins and the value or map key is never changed. - This means that the first file to set CurrentContext will have its context preserved. It also means that if two files specify a "red-user", only values from the first file's red-user are used. Even non-conflicting entries from the second file's "red-user" are discarded. - - - Otherwise, use HomeDirectoryLocation (~/.kube/config) with no merging. - 1. Determine the context to use based on the first hit in this chain - 1. command line argument - the value of the `context` command line option - 1. current-context from the merged kubeconfig file - 1. Empty is allowed at this stage - 1. Determine the cluster info and user to use. At this point, we may or may not have a context. They are built based on the first hit in this chain. (run it twice, once for user, once for cluster) - 1. command line argument - `user` for user name and `cluster` for cluster name - 1. If context is present, then use the context's value - 1. Empty is allowed - 1. Determine the actual cluster info to use. At this point, we may or may not have a cluster info. Build each piece of the cluster info based on the chain (first hit wins): - 1. command line arguments - `server`, `api-version`, `certificate-authority`, and `insecure-skip-tls-verify` - 1. If cluster info is present and a value for the attribute is present, use it. - 1. If you don't have a server location, error. - 1. Determine the actual user info to use. User is built using the same rules as cluster info, EXCEPT that you can only have one authentication technique per user. - 1. Load precedence is 1) command line flag, 2) user fields from kubeconfig - 1. The command line flags are: `client-certificate`, `client-key`, `username`, `password`, and `token`. - 1. If there are two conflicting techniques, fail. - 1. For any information still missing, use default values and potentially prompt for authentication information - -## Manipulation of kubeconfig via `kubectl config ` -In order to more easily manipulate kubeconfig files, there are a series of subcommands to `kubectl config` to help. -See [docs/kubectl_config.md](kubectl_config.md) for help. - -### Example -``` -$kubectl config set-credentials myself --username=admin --password=secret -$kubectl config set-cluster local-server --server=http://localhost:8080 -$kubectl config set-context default-context --cluster=local-server --user=myself -$kubectl config use-context default-context -$kubectl config set contexts.default-context.namespace the-right-prefix -$kubectl config view -``` -produces this output -``` -clusters: - local-server: - server: http://localhost:8080 -contexts: - default-context: - cluster: local-server - namespace: the-right-prefix - user: myself -current-context: default-context -preferences: {} -users: - myself: - username: admin - password: secret - -``` -and a kubeconfig file that looks like this -``` -apiVersion: v1 -clusters: -- cluster: - server: http://localhost:8080 - name: local-server -contexts: -- context: - cluster: local-server - namespace: the-right-prefix - user: myself - name: default-context -current-context: default-context -kind: Config -preferences: {} -users: -- name: myself - user: - username: admin - password: secret -``` - -#### Commands for the example file -``` -$kubectl config set preferences.colors true -$kubectl config set-cluster cow-cluster --server=http://cow.org:8080 --api-version=v1 -$kubectl config set-cluster horse-cluster --server=https://horse.org:4443 --certificate-authority=path/to/my/cafile -$kubectl config set-cluster pig-cluster --server=https://pig.org:443 --insecure-skip-tls-verify=true -$kubectl config set-credentials blue-user --token=blue-token -$kubectl config set-credentials green-user --client-certificate=path/to/my/client/cert --client-key=path/to/my/client/key -$kubectl config set-context queen-anne-context --cluster=pig-cluster --user=black-user --namespace=saw-ns -$kubectl config set-context federal-context --cluster=horse-cluster --user=green-user --namespace=chisel-ns -$kubectl config use-context federal-context -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubeconfig-file.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubeconfig-file.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl.md b/release-0.19.0/docs/kubectl.md deleted file mode 100644 index 6fb9360414f..00000000000 --- a/release-0.19.0/docs/kubectl.md +++ /dev/null @@ -1,73 +0,0 @@ -## kubectl - -kubectl controls the Kubernetes cluster manager - -### Synopsis - - -kubectl controls the Kubernetes cluster manager. - -Find more information at https://github.com/GoogleCloudPlatform/kubernetes. - -``` -kubectl -``` - -### Options - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - -h, --help=false: help for kubectl - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl api-versions](kubectl_api-versions.md) - Print available API versions. -* [kubectl cluster-info](kubectl_cluster-info.md) - Display cluster info -* [kubectl config](kubectl_config.md) - config modifies kubeconfig files -* [kubectl create](kubectl_create.md) - Create a resource by filename or stdin -* [kubectl delete](kubectl_delete.md) - Delete a resource by filename, stdin, resource and ID, or by resources and label selector. -* [kubectl describe](kubectl_describe.md) - Show details of a specific resource -* [kubectl exec](kubectl_exec.md) - Execute a command in a container. -* [kubectl expose](kubectl_expose.md) - Take a replicated application and expose it as Kubernetes Service -* [kubectl get](kubectl_get.md) - Display one or many resources -* [kubectl label](kubectl_label.md) - Update the labels on a resource -* [kubectl logs](kubectl_logs.md) - Print the logs for a container in a pod. -* [kubectl namespace](kubectl_namespace.md) - SUPERCEDED: Set and view the current Kubernetes namespace -* [kubectl port-forward](kubectl_port-forward.md) - Forward one or more local ports to a pod. -* [kubectl proxy](kubectl_proxy.md) - Run a proxy to the Kubernetes API server -* [kubectl rolling-update](kubectl_rolling-update.md) - Perform a rolling update of the given ReplicationController. -* [kubectl run](kubectl_run.md) - Run a particular image on the cluster. -* [kubectl scale](kubectl_scale.md) - Set a new size for a Replication Controller. -* [kubectl stop](kubectl_stop.md) - Gracefully shut down a resource by id or filename. -* [kubectl update](kubectl_update.md) - Update a resource by filename or stdin. -* [kubectl version](kubectl_version.md) - Print the client and server version information. - -###### Auto generated by spf13/cobra at 2015-05-22 14:24:30.1784975 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_api-versions.md b/release-0.19.0/docs/kubectl_api-versions.md deleted file mode 100644 index f5cd8f49b7d..00000000000 --- a/release-0.19.0/docs/kubectl_api-versions.md +++ /dev/null @@ -1,57 +0,0 @@ -## kubectl api-versions - -Print available API versions. - -### Synopsis - - -Print available API versions. - -``` -kubectl api-versions -``` - -### Options - -``` - -h, --help=false: help for api-versions -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.231770799 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_api-versions.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_api-versions.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_cluster-info.md b/release-0.19.0/docs/kubectl_cluster-info.md deleted file mode 100644 index 531dc89794a..00000000000 --- a/release-0.19.0/docs/kubectl_cluster-info.md +++ /dev/null @@ -1,57 +0,0 @@ -## kubectl cluster-info - -Display cluster info - -### Synopsis - - -Display addresses of the master and services with label kubernetes.io/cluster-service=true - -``` -kubectl cluster-info -``` - -### Options - -``` - -h, --help=false: help for cluster-info -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.230831561 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_cluster-info.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_cluster-info.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_config.md b/release-0.19.0/docs/kubectl_config.md deleted file mode 100644 index 6f909c6b207..00000000000 --- a/release-0.19.0/docs/kubectl_config.md +++ /dev/null @@ -1,70 +0,0 @@ -## kubectl config - -config modifies kubeconfig files - -### Synopsis - - -config modifies kubeconfig files using subcommands like "kubectl config set current-context my-context" - -The loading order follows these rules: - 1. If the --kubeconfig flag is set, then only that file is loaded. The flag may only be set once and no merging takes place. - 2. If $KUBECONFIG environment variable is set, then it is used a list of paths (normal path delimitting rules for your system). These paths are merged together. When a value is modified, it is modified in the file that defines the stanza. When a value is created, it is created in the first file that exists. If no files in the chain exist, then it creates the last file in the list. - 3. Otherwise, ${HOME}/.kube/config is used and no merging takes place. - - -``` -kubectl config SUBCOMMAND -``` - -### Options - -``` - -h, --help=false: help for config - --kubeconfig="": use a particular kubeconfig file -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager -* [kubectl config set](kubectl_config_set.md) - Sets an individual value in a kubeconfig file -* [kubectl config set-cluster](kubectl_config_set-cluster.md) - Sets a cluster entry in kubeconfig -* [kubectl config set-context](kubectl_config_set-context.md) - Sets a context entry in kubeconfig -* [kubectl config set-credentials](kubectl_config_set-credentials.md) - Sets a user entry in kubeconfig -* [kubectl config unset](kubectl_config_unset.md) - Unsets an individual value in a kubeconfig file -* [kubectl config use-context](kubectl_config_use-context.md) - Sets the current-context in a kubeconfig file -* [kubectl config view](kubectl_config_view.md) - displays Merged kubeconfig settings or a specified kubeconfig file. - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.229842268 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_config.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_config.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_config_set-cluster.md b/release-0.19.0/docs/kubectl_config_set-cluster.md deleted file mode 100644 index 1ca4e740cbc..00000000000 --- a/release-0.19.0/docs/kubectl_config_set-cluster.md +++ /dev/null @@ -1,72 +0,0 @@ -## kubectl config set-cluster - -Sets a cluster entry in kubeconfig - -### Synopsis - - -Sets a cluster entry in kubeconfig. -Specifying a name that already exists will merge new fields on top of existing values for those fields. - -``` -kubectl config set-cluster NAME [--server=server] [--certificate-authority=path/to/certficate/authority] [--api-version=apiversion] [--insecure-skip-tls-verify=true] -``` - -### Examples - -``` -// Set only the server field on the e2e cluster entry without touching other values. -$ kubectl config set-cluster e2e --server=https://1.2.3.4 - -// Embed certificate authority data for the e2e cluster entry -$ kubectl config set-cluster e2e --certificate-authority=~/.kube/e2e/kubernetes.ca.crt - -// Disable cert checking for the dev cluster entry -$ kubectl config set-cluster e2e --insecure-skip-tls-verify=true -``` - -### Options - -``` - --api-version=: api-version for the cluster entry in kubeconfig - --certificate-authority=: path to certificate-authority for the cluster entry in kubeconfig - --embed-certs=false: embed-certs for the cluster entry in kubeconfig - -h, --help=false: help for set-cluster - --insecure-skip-tls-verify=false: insecure-skip-tls-verify for the cluster entry in kubeconfig - --server=: server for the cluster entry in kubeconfig -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --kubeconfig="": use a particular kubeconfig file - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl config](kubectl_config.md) - config modifies kubeconfig files - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.222182293 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_config_set-cluster.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_config_set-cluster.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_config_set-context.md b/release-0.19.0/docs/kubectl_config_set-context.md deleted file mode 100644 index ea8a19164e4..00000000000 --- a/release-0.19.0/docs/kubectl_config_set-context.md +++ /dev/null @@ -1,65 +0,0 @@ -## kubectl config set-context - -Sets a context entry in kubeconfig - -### Synopsis - - -Sets a context entry in kubeconfig -Specifying a name that already exists will merge new fields on top of existing values for those fields. - -``` -kubectl config set-context NAME [--cluster=cluster_nickname] [--user=user_nickname] [--namespace=namespace] -``` - -### Examples - -``` -// Set the user field on the gce context entry without touching other values -$ kubectl config set-context gce --user=cluster-admin -``` - -### Options - -``` - --cluster=: cluster for the context entry in kubeconfig - -h, --help=false: help for set-context - --namespace=: namespace for the context entry in kubeconfig - --user=: user for the context entry in kubeconfig -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": use a particular kubeconfig file - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl config](kubectl_config.md) - config modifies kubeconfig files - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.225463229 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_config_set-context.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_config_set-context.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_config_set-credentials.md b/release-0.19.0/docs/kubectl_config_set-credentials.md deleted file mode 100644 index 9093c8396f1..00000000000 --- a/release-0.19.0/docs/kubectl_config_set-credentials.md +++ /dev/null @@ -1,85 +0,0 @@ -## kubectl config set-credentials - -Sets a user entry in kubeconfig - -### Synopsis - - -Sets a user entry in kubeconfig -Specifying a name that already exists will merge new fields on top of existing values. - - Client-certificate flags: - --client-certificate=certfile --client-key=keyfile - - Bearer token flags: - --token=bearer_token - - Basic auth flags: - --username=basic_user --password=basic_password - - Bearer token and basic auth are mutually exclusive. - - -``` -kubectl config set-credentials NAME [--client-certificate=path/to/certfile] [--client-key=path/to/keyfile] [--token=bearer_token] [--username=basic_user] [--password=basic_password] -``` - -### Examples - -``` -// Set only the "client-key" field on the "cluster-admin" -// entry, without touching other values: -$ kubectl set-credentials cluster-admin --client-key=~/.kube/admin.key - -// Set basic auth for the "cluster-admin" entry -$ kubectl set-credentials cluster-admin --username=admin --password=uXFGweU9l35qcif - -// Embed client certificate data in the "cluster-admin" entry -$ kubectl set-credentials cluster-admin --client-certificate=~/.kube/admin.crt --embed-certs=true -``` - -### Options - -``` - --client-certificate=: path to client-certificate for the user entry in kubeconfig - --client-key=: path to client-key for the user entry in kubeconfig - --embed-certs=false: embed client cert/key for the user entry in kubeconfig - -h, --help=false: help for set-credentials - --password=: password for the user entry in kubeconfig - --token=: token for the user entry in kubeconfig - --username=: username for the user entry in kubeconfig -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": use a particular kubeconfig file - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --user="": The name of the kubeconfig user to use - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl config](kubectl_config.md) - config modifies kubeconfig files - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.22419139 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_config_set-credentials.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_config_set-credentials.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_config_set.md b/release-0.19.0/docs/kubectl_config_set.md deleted file mode 100644 index 024b576c307..00000000000 --- a/release-0.19.0/docs/kubectl_config_set.md +++ /dev/null @@ -1,59 +0,0 @@ -## kubectl config set - -Sets an individual value in a kubeconfig file - -### Synopsis - - -Sets an individual value in a kubeconfig file -PROPERTY_NAME is a dot delimited name where each token represents either a attribute name or a map key. Map keys may not contain dots. -PROPERTY_VALUE is the new value you wish to set. - -``` -kubectl config set PROPERTY_NAME PROPERTY_VALUE -``` - -### Options - -``` - -h, --help=false: help for set -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": use a particular kubeconfig file - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl config](kubectl_config.md) - config modifies kubeconfig files - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.226564217 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_config_set.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_config_set.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_config_unset.md b/release-0.19.0/docs/kubectl_config_unset.md deleted file mode 100644 index 0cceec32ae2..00000000000 --- a/release-0.19.0/docs/kubectl_config_unset.md +++ /dev/null @@ -1,58 +0,0 @@ -## kubectl config unset - -Unsets an individual value in a kubeconfig file - -### Synopsis - - -Unsets an individual value in a kubeconfig file -PROPERTY_NAME is a dot delimited name where each token represents either a attribute name or a map key. Map keys may not contain dots. - -``` -kubectl config unset PROPERTY_NAME -``` - -### Options - -``` - -h, --help=false: help for unset -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": use a particular kubeconfig file - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl config](kubectl_config.md) - config modifies kubeconfig files - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.228039789 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_config_unset.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_config_unset.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_config_use-context.md b/release-0.19.0/docs/kubectl_config_use-context.md deleted file mode 100644 index 1222f008a25..00000000000 --- a/release-0.19.0/docs/kubectl_config_use-context.md +++ /dev/null @@ -1,57 +0,0 @@ -## kubectl config use-context - -Sets the current-context in a kubeconfig file - -### Synopsis - - -Sets the current-context in a kubeconfig file - -``` -kubectl config use-context CONTEXT_NAME -``` - -### Options - -``` - -h, --help=false: help for use-context -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": use a particular kubeconfig file - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl config](kubectl_config.md) - config modifies kubeconfig files - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.228948447 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_config_use-context.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_config_use-context.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_config_view.md b/release-0.19.0/docs/kubectl_config_view.md deleted file mode 100644 index 15e4f7f1776..00000000000 --- a/release-0.19.0/docs/kubectl_config_view.md +++ /dev/null @@ -1,77 +0,0 @@ -## kubectl config view - -displays Merged kubeconfig settings or a specified kubeconfig file. - -### Synopsis - - -displays Merged kubeconfig settings or a specified kubeconfig file. - -You can use --output=template --template=TEMPLATE to extract specific values. - -``` -kubectl config view -``` - -### Examples - -``` -// Show Merged kubeconfig settings. -$ kubectl config view - -// Get the password for the e2e user -$ kubectl config view -o template --template='{{range .users}}{{ if eq .name "e2e" }}{{ index .user.password }}{{end}}{{end}}' -``` - -### Options - -``` - --flatten=false: flatten the resulting kubeconfig file into self contained output (useful for creating portable kubeconfig files) - -h, --help=false: help for view - --merge=true: merge together the full hierarchy of kubeconfig files - --minify=false: remove all information not used by current-context from the output - --no-headers=false: When using the default output, don't print headers. - -o, --output="": Output format. One of: json|yaml|template|templatefile. - --output-version="": Output the formatted object with the given version (default api-version). - --raw=false: display raw byte data - -t, --template="": Template string or path to template file to use when -o=template or -o=templatefile. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview] -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": use a particular kubeconfig file - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl config](kubectl_config.md) - config modifies kubeconfig files - -###### Auto generated by spf13/cobra at 2015-06-09 19:55:35.92095292 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_config_view.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_config_view.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_create.md b/release-0.19.0/docs/kubectl_create.md deleted file mode 100644 index 106102df054..00000000000 --- a/release-0.19.0/docs/kubectl_create.md +++ /dev/null @@ -1,70 +0,0 @@ -## kubectl create - -Create a resource by filename or stdin - -### Synopsis - - -Create a resource by filename or stdin. - -JSON and YAML formats are accepted. - -``` -kubectl create -f FILENAME -``` - -### Examples - -``` -// Create a pod using the data in pod.json. -$ kubectl create -f pod.json - -// Create a pod based on the JSON passed into stdin. -$ cat pod.json | kubectl create -f - -``` - -### Options - -``` - -f, --filename=[]: Filename, directory, or URL to file to use to create the resource - -h, --help=false: help for create -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.178299587 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_create.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_create.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_delete.md b/release-0.19.0/docs/kubectl_delete.md deleted file mode 100644 index f4a93b62ef6..00000000000 --- a/release-0.19.0/docs/kubectl_delete.md +++ /dev/null @@ -1,92 +0,0 @@ -## kubectl delete - -Delete a resource by filename, stdin, resource and ID, or by resources and label selector. - -### Synopsis - - -Delete a resource by filename, stdin, resource and ID, or by resources and label selector. - -JSON and YAML formats are accepted. - -If both a filename and command line arguments are passed, the command line -arguments are used and the filename is ignored. - -Note that the delete command does NOT do resource version checks, so if someone -submits an update to a resource right when you submit a delete, their update -will be lost along with the rest of the resource. - -``` -kubectl delete ([-f FILENAME] | (RESOURCE [(ID | -l label | --all)] -``` - -### Examples - -``` -// Delete a pod using the type and ID specified in pod.json. -$ kubectl delete -f pod.json - -// Delete a pod based on the type and ID in the JSON passed into stdin. -$ cat pod.json | kubectl delete -f - - -// Delete pods and services with label name=myLabel. -$ kubectl delete pods,services -l name=myLabel - -// Delete a pod with ID 1234-56-7890-234234-456456. -$ kubectl delete pod 1234-56-7890-234234-456456 - -// Delete all pods -$ kubectl delete pods --all -``` - -### Options - -``` - --all=false: [-all] to select all the specified resources. - --cascade=true: If true, cascade the delete resources managed by this resource (e.g. Pods created by a ReplicationController). Default true. - -f, --filename=[]: Filename, directory, or URL to a file containing the resource to delete. - --grace-period=-1: Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. - -h, --help=false: help for delete - --ignore-not-found=false: Treat "resource not found" as a successful delete. - -l, --selector="": Selector (label query) to filter on. - --timeout=0: The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-06-03 18:21:01.053120485 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_delete.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_delete.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_describe.md b/release-0.19.0/docs/kubectl_describe.md deleted file mode 100644 index 51aa400da61..00000000000 --- a/release-0.19.0/docs/kubectl_describe.md +++ /dev/null @@ -1,70 +0,0 @@ -## kubectl describe - -Show details of a specific resource - -### Synopsis - - -Show details of a specific resource. - -This command joins many API calls together to form a detailed description of a -given resource. - -``` -kubectl describe (RESOURCE NAME | RESOURCE/NAME) -``` - -### Examples - -``` -// Describe a node -$ kubectl describe nodes kubernetes-minion-emt8.c.myproject.internal - -// Describe a pod -$ kubectl describe pods/nginx -``` - -### Options - -``` - -h, --help=false: help for describe -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.177122438 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_describe.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_describe.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_exec.md b/release-0.19.0/docs/kubectl_exec.md deleted file mode 100644 index a31c8c0e1e2..00000000000 --- a/release-0.19.0/docs/kubectl_exec.md +++ /dev/null @@ -1,74 +0,0 @@ -## kubectl exec - -Execute a command in a container. - -### Synopsis - - -Execute a command in a container. - -``` -kubectl exec POD -c CONTAINER -- COMMAND [args...] -``` - -### Examples - -``` -// get output from running 'date' from pod 123456-7890, using the first container by default -$ kubectl exec 123456-7890 date - -// get output from running 'date' in ruby-container from pod 123456-7890 -$ kubectl exec 123456-7890 -c ruby-container date - -//switch to raw terminal mode, sends stdin to 'bash' in ruby-container from pod 123456-780 and sends stdout/stderr from 'bash' back to the client -$ kubectl exec 123456-7890 -c ruby-container -i -t -- bash -il -``` - -### Options - -``` - -c, --container="": Container name - -h, --help=false: help for exec - -p, --pod="": Pod name - -i, --stdin=false: Pass stdin to the container - -t, --tty=false: Stdin is a TTY -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-27 22:47:02.898315735 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_exec.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_exec.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_expose.md b/release-0.19.0/docs/kubectl_expose.md deleted file mode 100644 index ef564e15bc1..00000000000 --- a/release-0.19.0/docs/kubectl_expose.md +++ /dev/null @@ -1,91 +0,0 @@ -## kubectl expose - -Take a replicated application and expose it as Kubernetes Service - -### Synopsis - - -Take a replicated application and expose it as Kubernetes Service. - -Looks up a replication controller or service by name and uses the selector for that resource as the -selector for a new Service on the specified port. If no labels are specified, the new service will -re-use the labels from the resource it exposes. - -``` -kubectl expose RESOURCE NAME --port=port [--protocol=TCP|UDP] [--target-port=number-or-name] [--name=name] [--public-ip=ip] [--type=type] -``` - -### Examples - -``` -// Creates a service for a replicated nginx, which serves on port 80 and connects to the containers on port 8000. -$ kubectl expose rc nginx --port=80 --target-port=8000 - -// Creates a second service based on the above service, exposing the container port 8443 as port 443 with the name "nginx-https" -$ kubectl expose service nginx --port=443 --target-port=8443 --name=nginx-https - -// Create a service for a replicated streaming application on port 4100 balancing UDP traffic and named 'video-stream'. -$ kubectl expose rc streamer --port=4100 --protocol=udp --name=video-stream -``` - -### Options - -``` - --container-port="": Synonym for --target-port - --create-external-load-balancer=false: If true, create an external load balancer for this service (trumped by --type). Implementation is cloud provider dependent. Default is 'false'. - --dry-run=false: If true, only print the object that would be sent, without creating it. - --generator="service/v1": The name of the API generator to use. Default is 'service/v1'. - -h, --help=false: help for expose - -l, --labels="": Labels to apply to the service created by this call. - --name="": The name for the newly created object. - --no-headers=false: When using the default output, don't print headers. - -o, --output="": Output format. One of: json|yaml|template|templatefile. - --output-version="": Output the formatted object with the given version (default api-version). - --overrides="": An inline JSON override for the generated object. If this is non-empty, it is used to override the generated object. Requires that the object supply a valid apiVersion field. - --port=-1: The port that the service should serve on. Required. - --protocol="TCP": The network protocol for the service to be created. Default is 'tcp'. - --public-ip="": Name of a public IP address to set for the service. The service will be assigned this IP in addition to its generated service IP. - --selector="": A label selector to use for this service. If empty (the default) infer the selector from the replication controller. - --target-port="": Name or number for the port on the container that the service should direct traffic to. Optional. - -t, --template="": Template string or path to template file to use when -o=template or -o=templatefile. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview] - --type="": Type for this service: ClusterIP, NodePort, or LoadBalancer. Default is 'ClusterIP' unless --create-external-load-balancer is specified. -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-06-02 11:05:52.857144556 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_expose.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_expose.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_get.md b/release-0.19.0/docs/kubectl_get.md deleted file mode 100644 index a3a2c35c43e..00000000000 --- a/release-0.19.0/docs/kubectl_get.md +++ /dev/null @@ -1,95 +0,0 @@ -## kubectl get - -Display one or many resources - -### Synopsis - - -Display one or many resources. - -Possible resources include pods (po), replication controllers (rc), services -(svc), nodes, events (ev), component statuses (cs), limit ranges (limits), -nodes (no), persistent volumes (pv), persistent volume claims (pvc) -or resource quotas (quota). - -By specifying the output as 'template' and providing a Go template as the value -of the --template flag, you can filter the attributes of the fetched resource(s). - -``` -kubectl get [(-o|--output=)json|yaml|template|...] (RESOURCE [NAME] | RESOURCE/NAME ...) -``` - -### Examples - -``` -// List all pods in ps output format. -$ kubectl get pods - -// List a single replication controller with specified NAME in ps output format. -$ kubectl get replicationcontroller web - -// List a single pod in JSON output format. -$ kubectl get -o json pod web-pod-13je7 - -// Return only the phase value of the specified pod. -$ kubectl get -o template web-pod-13je7 --template={{.status.phase}} --api-version=v1 - -// List all replication controllers and services together in ps output format. -$ kubectl get rc,services - -// List one or more resources by their type and names -$ kubectl get rc/web service/frontend pods/web-pod-13je7 -``` - -### Options - -``` - --all-namespaces=false: If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace. - -h, --help=false: help for get - --no-headers=false: When using the default output, don't print headers. - -o, --output="": Output format. One of: json|yaml|template|templatefile. - --output-version="": Output the formatted object with the given version (default api-version). - -l, --selector="": Selector (label query) to filter on - -t, --template="": Template string or path to template file to use when -o=template or -o=templatefile. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview] - -w, --watch=false: After listing/getting the requested object, watch for changes. - --watch-only=false: Watch for changes to the requested object(s), without listing/getting first. -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-06-05 21:08:36.511279339 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_get.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_get.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_label.md b/release-0.19.0/docs/kubectl_label.md deleted file mode 100644 index 6f39e6d4e1d..00000000000 --- a/release-0.19.0/docs/kubectl_label.md +++ /dev/null @@ -1,89 +0,0 @@ -## kubectl label - -Update the labels on a resource - -### Synopsis - - -Update the labels on a resource. - -A label must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to 63 characters. -If --overwrite is true, then existing labels can be overwritten, otherwise attempting to overwrite a label will result in an error. -If --resource-version is specified, then updates will use this resource version, otherwise the existing resource-version will be used. - -``` -kubectl label [--overwrite] RESOURCE NAME KEY_1=VAL_1 ... KEY_N=VAL_N [--resource-version=version] -``` - -### Examples - -``` -// Update pod 'foo' with the label 'unhealthy' and the value 'true'. -$ kubectl label pods foo unhealthy=true - -// Update pod 'foo' with the label 'status' and the value 'unhealthy', overwriting any existing value. -$ kubectl label --overwrite pods foo status=unhealthy - -// Update all pods in the namespace -$ kubectl label pods --all status=unhealthy - -// Update pod 'foo' only if the resource is unchanged from version 1. -$ kubectl label pods foo status=unhealthy --resource-version=1 - -// Update pod 'foo' by removing a label named 'bar' if it exists. -// Does not require the --overwrite flag. -$ kubectl label pods foo bar- -``` - -### Options - -``` - --all=false: select all resources in the namespace of the specified resource types - -h, --help=false: help for label - --no-headers=false: When using the default output, don't print headers. - -o, --output="": Output format. One of: json|yaml|template|templatefile. - --output-version="": Output the formatted object with the given version (default api-version). - --overwrite=false: If true, allow labels to be overwritten, otherwise reject label updates that overwrite existing labels. - --resource-version="": If non-empty, the labels update will only succeed if this is the current resource-version for the object. Only valid when specifying a single resource. - -l, --selector="": Selector (label query) to filter on - -t, --template="": Template string or path to template file to use when -o=template or -o=templatefile. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview] -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-28 08:44:48.996047458 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_label.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_label.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_logs.md b/release-0.19.0/docs/kubectl_logs.md deleted file mode 100644 index 6168af61819..00000000000 --- a/release-0.19.0/docs/kubectl_logs.md +++ /dev/null @@ -1,73 +0,0 @@ -## kubectl logs - -Print the logs for a container in a pod. - -### Synopsis - - -Print the logs for a container in a pod. If the pod has only one container, the container name is optional. - -``` -kubectl logs [-f] [-p] POD [CONTAINER] -``` - -### Examples - -``` -// Returns snapshot of ruby-container logs from pod 123456-7890. -$ kubectl logs 123456-7890 ruby-container - -// Returns snapshot of previous terminated ruby-container logs from pod 123456-7890. -$ kubectl logs -p 123456-7890 ruby-container - -// Starts streaming of ruby-container logs from pod 123456-7890. -$ kubectl logs -f 123456-7890 ruby-container -``` - -### Options - -``` - -f, --follow=false: Specify if the logs should be streamed. - -h, --help=false: help for logs - --interactive=true: If true, prompt the user for input when required. Default true. - -p, --previous=false: If true, print the logs for the previous instance of the container in a pod if it exists. -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-21 20:24:03.06578685 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_logs.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_logs.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_namespace.md b/release-0.19.0/docs/kubectl_namespace.md deleted file mode 100644 index 8b79872f7c5..00000000000 --- a/release-0.19.0/docs/kubectl_namespace.md +++ /dev/null @@ -1,60 +0,0 @@ -## kubectl namespace - -SUPERCEDED: Set and view the current Kubernetes namespace - -### Synopsis - - -SUPERCEDED: Set and view the current Kubernetes namespace scope for command line requests. - -namespace has been superceded by the context.namespace field of .kubeconfig files. See 'kubectl config set-context --help' for more details. - - -``` -kubectl namespace [namespace] -``` - -### Options - -``` - -h, --help=false: help for namespace -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.181662849 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_namespace.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_namespace.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_port-forward.md b/release-0.19.0/docs/kubectl_port-forward.md deleted file mode 100644 index b9a4abfa7fc..00000000000 --- a/release-0.19.0/docs/kubectl_port-forward.md +++ /dev/null @@ -1,75 +0,0 @@ -## kubectl port-forward - -Forward one or more local ports to a pod. - -### Synopsis - - -Forward one or more local ports to a pod. - -``` -kubectl port-forward -p POD [LOCAL_PORT:]REMOTE_PORT [...[LOCAL_PORT_N:]REMOTE_PORT_N] -``` - -### Examples - -``` - -// listens on ports 5000 and 6000 locally, forwarding data to/from ports 5000 and 6000 in the pod -$ kubectl port-forward -p mypod 5000 6000 - -// listens on port 8888 locally, forwarding to 5000 in the pod -$ kubectl port-forward -p mypod 8888:5000 - -// listens on a random port locally, forwarding to 5000 in the pod -$ kubectl port-forward -p mypod :5000 - -// listens on a random port locally, forwarding to 5000 in the pod -$ kubectl port-forward -p mypod 0:5000 -``` - -### Options - -``` - -h, --help=false: help for port-forward - -p, --pod="": Pod name -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.187520496 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_port-forward.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_port-forward.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_proxy.md b/release-0.19.0/docs/kubectl_proxy.md deleted file mode 100644 index 572a851a4e3..00000000000 --- a/release-0.19.0/docs/kubectl_proxy.md +++ /dev/null @@ -1,87 +0,0 @@ -## kubectl proxy - -Run a proxy to the Kubernetes API server - -### Synopsis - - -To proxy all of the kubernetes api and nothing else, use: - -kubectl proxy --api-prefix=/ - -To proxy only part of the kubernetes api and also some static files: - -kubectl proxy --www=/my/files --www-prefix=/static/ --api-prefix=/api/ - -The above lets you 'curl localhost:8001/api/v1/pods'. - -To proxy the entire kubernetes api at a different root, use: - -kubectl proxy --api-prefix=/custom/ - -The above lets you 'curl localhost:8001/custom/api/v1/pods' - - -``` -kubectl proxy [--port=PORT] [--www=static-dir] [--www-prefix=prefix] [--api-prefix=prefix] -``` - -### Examples - -``` -// Run a proxy to kubernetes apiserver on port 8011, serving static content from ./local/www/ -$ kubectl proxy --port=8011 --www=./local/www/ - -// Run a proxy to kubernetes apiserver, changing the api prefix to k8s-api -// This makes e.g. the pods api available at localhost:8011/k8s-api/v1/pods/ -$ kubectl proxy --api-prefix=/k8s-api -``` - -### Options - -``` - --api-prefix="/api/": Prefix to serve the proxied API under. - -h, --help=false: help for proxy - -p, --port=8001: The port on which to run the proxy. - -w, --www="": Also serve static files from the given directory under the specified prefix. - -P, --www-prefix="/static/": Prefix to serve static files under, if static file directory is specified. -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-06-05 21:08:36.513099878 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_proxy.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_proxy.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_rolling-update.md b/release-0.19.0/docs/kubectl_rolling-update.md deleted file mode 100644 index 06a8fa38dcd..00000000000 --- a/release-0.19.0/docs/kubectl_rolling-update.md +++ /dev/null @@ -1,91 +0,0 @@ -## kubectl rolling-update - -Perform a rolling update of the given ReplicationController. - -### Synopsis - - -Perform a rolling update of the given ReplicationController. - -Replaces the specified controller with new controller, updating one pod at a time to use the -new PodTemplate. The new-controller.json must specify the same namespace as the -existing controller and overwrite at least one (common) label in its replicaSelector. - -``` -kubectl rolling-update OLD_CONTROLLER_NAME ([NEW_CONTROLLER_NAME] --image=NEW_CONTAINER_IMAGE | -f NEW_CONTROLLER_SPEC) -``` - -### Examples - -``` -// Update pods of frontend-v1 using new controller data in frontend-v2.json. -$ kubectl rolling-update frontend-v1 -f frontend-v2.json - -// Update pods of frontend-v1 using JSON data passed into stdin. -$ cat frontend-v2.json | kubectl rolling-update frontend-v1 -f - - -// Update the pods of frontend-v1 to frontend-v2 by just changing the image, and switching the -// name of the replication controller. -$ kubectl rolling-update frontend-v1 frontend-v2 --image=image:v2 - -// Update the pods of frontend by just changing the image, and keeping the old name -$ kubectl rolling-update frontend --image=image:v2 - -``` - -### Options - -``` - --deployment-label-key="deployment": The key to use to differentiate between two different controllers, default 'deployment'. Only relevant when --image is specified, ignored otherwise - --dry-run=false: If true, print out the changes that would be made, but don't actually make them. - -f, --filename="": Filename or URL to file to use to create the new controller. - -h, --help=false: help for rolling-update - --image="": Image to upgrade the controller to. Can not be used with --filename/-f - --no-headers=false: When using the default output, don't print headers. - -o, --output="": Output format. One of: json|yaml|template|templatefile. - --output-version="": Output the formatted object with the given version (default api-version). - --poll-interval="3s": Time delay between polling controller status after update. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". - --rollback=false: If true, this is a request to abort an existing rollout that is partially rolled out. It effectively reverses current and next and runs a rollout - -t, --template="": Template string or path to template file to use when -o=template or -o=templatefile. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview] - --timeout="5m0s": Max time to wait for a controller to update before giving up. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". - --update-period="1m0s": Time to wait between updating pods. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.184123104 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_rolling-update.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_rolling-update.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_run.md b/release-0.19.0/docs/kubectl_run.md deleted file mode 100644 index 349cba853b3..00000000000 --- a/release-0.19.0/docs/kubectl_run.md +++ /dev/null @@ -1,86 +0,0 @@ -## kubectl run - -Run a particular image on the cluster. - -### Synopsis - - -Create and run a particular image, possibly replicated. -Creates a replication controller to manage the created container(s). - -``` -kubectl run NAME --image=image [--port=port] [--replicas=replicas] [--dry-run=bool] [--overrides=inline-json] -``` - -### Examples - -``` -// Starts a single instance of nginx. -$ kubectl run nginx --image=nginx - -// Starts a replicated instance of nginx. -$ kubectl run nginx --image=nginx --replicas=5 - -// Dry run. Print the corresponding API objects without creating them. -$ kubectl run nginx --image=nginx --dry-run - -// Start a single instance of nginx, but overload the spec of the replication controller with a partial set of values parsed from JSON. -$ kubectl run nginx --image=nginx --overrides='{ "apiVersion": "v1", "spec": { ... } }' -``` - -### Options - -``` - --dry-run=false: If true, only print the object that would be sent, without sending it. - --generator="run/v1": The name of the API generator to use. Default is 'run-controller/v1'. - -h, --help=false: help for run - --hostport=-1: The host port mapping for the container port. To demonstrate a single-machine container. - --image="": The image for the container to run. - -l, --labels="": Labels to apply to the pod(s). - --no-headers=false: When using the default output, don't print headers. - -o, --output="": Output format. One of: json|yaml|template|templatefile. - --output-version="": Output the formatted object with the given version (default api-version). - --overrides="": An inline JSON override for the generated object. If this is non-empty, it is used to override the generated object. Requires that the object supply a valid apiVersion field. - --port=-1: The port that this container exposes. - -r, --replicas=1: Number of replicas to create for this container. Default is 1. - -t, --template="": Template string or path to template file to use when -o=template or -o=templatefile. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview] -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-06-05 21:08:36.513272503 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_run.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_run.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_scale.md b/release-0.19.0/docs/kubectl_scale.md deleted file mode 100644 index 546951adaf1..00000000000 --- a/release-0.19.0/docs/kubectl_scale.md +++ /dev/null @@ -1,75 +0,0 @@ -## kubectl scale - -Set a new size for a Replication Controller. - -### Synopsis - - -Set a new size for a Replication Controller. - -Scale also allows users to specify one or more preconditions for the scale action. -If --current-replicas or --resource-version is specified, it is validated before the -scale is attempted, and it is guaranteed that the precondition holds true when the -scale is sent to the server. - -``` -kubectl scale [--resource-version=version] [--current-replicas=count] --replicas=COUNT RESOURCE ID -``` - -### Examples - -``` -// Scale replication controller named 'foo' to 3. -$ kubectl scale --replicas=3 replicationcontrollers foo - -// If the replication controller named foo's current size is 2, scale foo to 3. -$ kubectl scale --current-replicas=2 --replicas=3 replicationcontrollers foo -``` - -### Options - -``` - --current-replicas=-1: Precondition for current size. Requires that the current size of the replication controller match this value in order to scale. - -h, --help=false: help for scale - --replicas=-1: The new desired number of replicas. Required. - --resource-version="": Precondition for resource version. Requires that the current resource version match this value in order to scale. -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.185268791 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_scale.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_scale.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_stop.md b/release-0.19.0/docs/kubectl_stop.md deleted file mode 100644 index ba56a33f478..00000000000 --- a/release-0.19.0/docs/kubectl_stop.md +++ /dev/null @@ -1,82 +0,0 @@ -## kubectl stop - -Gracefully shut down a resource by id or filename. - -### Synopsis - - -Gracefully shut down a resource by id or filename. - -Attempts to shut down and delete a resource that supports graceful termination. -If the resource is scalable it will be scaled to 0 before deletion. - -``` -kubectl stop (-f FILENAME | RESOURCE (ID | -l label | --all)) -``` - -### Examples - -``` -// Shut down foo. -$ kubectl stop replicationcontroller foo - -// Stop pods and services with label name=myLabel. -$ kubectl stop pods,services -l name=myLabel - -// Shut down the service defined in service.json -$ kubectl stop -f service.json - -// Shut down all resources in the path/to/resources directory -$ kubectl stop -f path/to/resources -``` - -### Options - -``` - --all=false: [-all] to select all the specified resources. - -f, --filename=[]: Filename, directory, or URL to file of resource(s) to be stopped. - --grace-period=-1: Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. - -h, --help=false: help for stop - --ignore-not-found=false: Treat "resource not found" as a successful stop. - -l, --selector="": Selector (label query) to filter on. - --timeout=0: The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-29 23:14:50.709764383 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_stop.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_stop.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_update.md b/release-0.19.0/docs/kubectl_update.md deleted file mode 100644 index 9471efb1a6b..00000000000 --- a/release-0.19.0/docs/kubectl_update.md +++ /dev/null @@ -1,70 +0,0 @@ -## kubectl update - -Update a resource by filename or stdin. - -### Synopsis - - -Update a resource by filename or stdin. - -JSON and YAML formats are accepted. - -``` -kubectl update -f FILENAME -``` - -### Examples - -``` -// Update a pod using the data in pod.json. -$ kubectl update -f pod.json - -// Update a pod based on the JSON passed into stdin. -$ cat pod.json | kubectl update -f - -``` - -### Options - -``` - -f, --filename=[]: Filename, directory, or URL to file to use to update the resource. - -h, --help=false: help for update -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-29 01:11:24.431126385 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_update.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_update.md?pixel)]() diff --git a/release-0.19.0/docs/kubectl_version.md b/release-0.19.0/docs/kubectl_version.md deleted file mode 100644 index 1c1dfe0fc38..00000000000 --- a/release-0.19.0/docs/kubectl_version.md +++ /dev/null @@ -1,58 +0,0 @@ -## kubectl version - -Print the client and server version information. - -### Synopsis - - -Print the client and server version information. - -``` -kubectl version -``` - -### Options - -``` - -c, --client=false: Client version only (no server required). - -h, --help=false: help for version -``` - -### Options inherited from parent commands - -``` - --alsologtostderr=false: log to standard error as well as files - --api-version="": The API version to use when talking to the server - --certificate-authority="": Path to a cert. file for the certificate authority. - --client-certificate="": Path to a client key file for TLS. - --client-key="": Path to a client key file for TLS. - --cluster="": The name of the kubeconfig cluster to use - --context="": The name of the kubeconfig context to use - --insecure-skip-tls-verify=false: If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - --kubeconfig="": Path to the kubeconfig file to use for CLI requests. - --log-backtrace-at=:0: when logging hits line file:N, emit a stack trace - --log-dir=: If non-empty, write log files in this directory - --log-flush-frequency=5s: Maximum number of seconds between log flushes - --logtostderr=true: log to standard error instead of files - --match-server-version=false: Require server version to match client version - --namespace="": If present, the namespace scope for this CLI request. - --password="": Password for basic authentication to the API server. - -s, --server="": The address and port of the Kubernetes API server - --stderrthreshold=2: logs at or above this threshold go to stderr - --token="": Bearer token for authentication to the API server. - --user="": The name of the kubeconfig user to use - --username="": Username for basic authentication to the API server. - --v=0: log level for V logs - --validate=false: If true, use a schema to validate the input before sending it - --vmodule=: comma-separated list of pattern=N settings for file-filtered logging -``` - -### SEE ALSO -* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager - -###### Auto generated by spf13/cobra at 2015-05-21 10:33:11.232741611 +0000 UTC - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/kubectl_version.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/kubectl_version.md?pixel)]() diff --git a/release-0.19.0/docs/labels.md b/release-0.19.0/docs/labels.md deleted file mode 100644 index 50c7d3ff266..00000000000 --- a/release-0.19.0/docs/labels.md +++ /dev/null @@ -1,110 +0,0 @@ -# Labels - -_Labels_ are key/value pairs that are attached to objects, such as pods. -Labels are intended to be used to specify identifying attributes of objects that are meaningful and relevant to users, but which do not directly imply semantics to the core system. -Labels can be used to organize and to select subsets of objects. Labels can be attached to objects at creation time and subsequently added and modified at any time. -Each object can have a set of key/value labels defined. Each Key must be unique for a given object. -``` -"labels": { - "key1" : "value1", - "key2" : "value2" -} -``` - -We'll eventually index and reverse-index labels for efficient queries and watches, use them to sort and group in UIs and CLIs, etc. We don't want to pollute labels with non-identifying, especially large and/or structured, data. Non-identifying information should be recorded using [annotations](annotations.md). - - -## Motivation - -Labels enable users to map their own organizational structures onto system objects in a loosely coupled fashion, without requiring clients to store these mappings. - -Service deployments and batch processing pipelines are often multi-dimensional entities (e.g., multiple partitions or deployments, multiple release tracks, multiple tiers, multiple micro-services per tier). Management often requires cross-cutting operations, which breaks encapsulation of strictly hierarchical representations, especially rigid hierarchies determined by the infrastructure rather than by users. - -Example labels: - - * `"release" : "stable"`, `"release" : "canary"`, ... - * `"environment" : "dev"`, `"environment" : "qa"`, `"environment" : "production"` - * `"tier" : "frontend"`, `"tier" : "backend"`, `"tier" : "middleware"` - * `"partition" : "customerA"`, `"partition" : "customerB"`, ... - * `"track" : "daily"`, `"track" : "weekly"` - -These are just examples; you are free to develop your own conventions. - - -## Syntax and character set - -_Labels_ are key value pairs. Valid label keys have two segments: an optional prefix and name, separated by a slash (`/`). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character (`[a-z0-9A-Z]`) with dashes (`-`), underscores (`_`), dots (`.`), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (`.`), not longer than 253 characters in total, followed by a slash (`/`). -If the prefix is omitted, the label key is presumed to be private to the user. System components which use labels must specify a prefix. The `kubernetes.io/` prefix is reserved for kubernetes core components. - -Valid label values must be 63 characters or less and must be empty or begin and end with an alphanumeric character (`[a-z0-9A-Z]`) with dashes (`-`), underscores (`_`), dots (`.`), and alphanumerics between. - -## Label selectors - -Unlike [names and UIDs](identifiers.md), labels do not provide uniqueness. In general, we expect many objects to carry the same label(s). - -Via a _label selector_, the client/user can identify a set of objects. The label selector is the core grouping primitive in Kubernetes. - -The API currently supports two types of selectors: _equality-based_ and _set-based_. -A label selector can be made of multiple _requirements_ which are comma-separated. In the case of multiple requirements, all must be satisfied so comma separator acts as an AND logical operator. - -### _Equality-based_ requirement - -_Equality-_ or _inequality-based_ requirements allow filtering by label keys and values. Matching objects must have all of the specified labels (both keys and values), though they may have additional labels as well. -Three kinds of operators are admitted `=`,`==`,`!=`. The first two represent _equality_ and are simply synonyms. While the latter represents _inequality_. For example: -``` -environment = production -tier != frontend -``` - -The former selects all resources with key equal to `environment` and value equal to `production`. -The latter selects all resources with key equal to `tier` and value distinct from `frontend`. -One could filter for resources in `production` but not `frontend` using the comma operator: `environment=production,tier!=frontend` - - -### _Set-based_ requirement - -_Set-based_ label requirements allow filtering keys according to a set of values. Matching objects must have all of the specified labels (i.e. all keys and at least one of the values specified for each key). Three kind of operators are supported: `in`,`notin` and exists (only the key identifier). For example: -``` -environment in (production, qa) -tier notin (frontend, backend) -partition -``` -The first example selects all resources with key equal to `environment` and value equal to `production` or `qa`. -The second example selects all resources with key equal to `tier` and value other than `frontend` and `backend`. -The third example selects all resources including a label with key `partition`; no values are checked. -Similarly the comma separator acts as an _AND_ operator for example filtering resource with a `partition` key (not matter the value) and with `environment` different than `qa`. For example: `partition,environment notin (qa)`. -The _set-based_ label selector is a general form of equality since `environment=production` is equivalent to `environment in (production)`; similarly for `!=` and `notin`. - -_Set-based_ requirements can be mixed with _equality-based_ requirements. For example: `partition in (customerA, customerB),environment!=qa`. - - -## API - -LIST and WATCH operations may specify label selectors to filter the sets of objects returned using a query parameter. Both requirements are permitted: - - * _equality-based_ requirements: `?label-selector=key1%3Dvalue1,key2%3Dvalue2` - * _set-based_ requirements: `?label-selector=key+in+%28value1%2Cvalue2%29%2Ckey2+notin+%28value3` - -Kubernetes also currently supports two objects that use label selectors to keep track of their members, `service`s and `replicationcontroller`s: - -* `service`: A [service](services.md) is a configuration unit for the proxies that run on every worker node. It is named and points to one or more pods. -* `replicationcontroller`: A [replication controller](replication-controller.md) ensures that a specified number of pod "replicas" are running at any one time. - -The set of pods that a `service` targets is defined with a label selector. Similarly, the population of pods that a `replicationcontroller` is monitoring is also defined with a label selector. For management convenience and consistency, `services` and `replicationcontrollers` may themselves have labels and would generally carry the labels their corresponding pods have in common. - -Sets identified by labels could be overlapping (think Venn diagrams). For instance, a service might target all pods with `"tier": "frontend"` and `"environment" : "prod"`. Now say you have 10 replicated pods that make up this tier. But you want to be able to 'canary' a new version of this component. You could set up a `replicationcontroller` (with `replicas` set to 9) for the bulk of the replicas with labels `"tier" : "frontend"` and `"environment" : "prod"` and `"track" : "stable"` and another `replicationcontroller` (with `replicas` set to 1) for the canary with labels `"tier" : "frontend"` and `"environment" : "prod"` and `"track" : "canary"`. Now the service is covering both the canary and non-canary pods. But you can mess with the `replicationcontrollers` separately to test things out, monitor the results, etc. - -Note that the superset described in the previous example is also heterogeneous. In long-lived, highly available, horizontally scaled, distributed, continuously evolving service applications, heterogeneity is inevitable, due to canaries, incremental rollouts, live reconfiguration, simultaneous updates and auto-scaling, hardware upgrades, and so on. - -Pods (and other objects) may belong to multiple sets simultaneously, which enables representation of service substructure and/or superstructure. In particular, labels are intended to facilitate the creation of non-hierarchical, multi-dimensional deployment structures. They are useful for a variety of management purposes (e.g., configuration, deployment) and for application introspection and analysis (e.g., logging, monitoring, alerting, analytics). Without the ability to form sets by intersecting labels, many implicitly related, overlapping flat sets would need to be created, for each subset and/or superset desired, which would lose semantic information and be difficult to keep consistent. Purely hierarchically nested sets wouldn't readily support slicing sets across different dimensions. - - -## Future developments - -Concerning API: we may extend such filtering to DELETE operations in the future. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/labels.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/labels.md?pixel)]() diff --git a/release-0.19.0/docs/logging.md b/release-0.19.0/docs/logging.md deleted file mode 100644 index 2c667f64a73..00000000000 --- a/release-0.19.0/docs/logging.md +++ /dev/null @@ -1,52 +0,0 @@ -# Logging - -## Logging by Kubernetes Components -Kubernetes components, such as kubelet and apiserver, use the [glog](https://godoc.org/github.com/golang/glog) logging library. Developer conventions for logging severity are described in [devel/logging.md](devel/logging.md). - -## Logging in Containers -There are no Kubernetes-specific requirements for logging from within containers. [search](https://www.google.com/?q=docker+container+logging) will turn up any number of articles about logging and -Docker containers. However, we do provide an example of how to collect, index, and view pod logs [using Fluentd, Elasticsearch, and Kibana](./getting-started-guides/logging.md) - - -## Logging to Elasticsearch on the GCE platform -Currently the collection of container logs using the [Fluentd](http://www.fluentd.org/) log collector is -enabled by default for clusters created for the GCE platform. Each node uses Fluentd to collect -the container logs which are submitted in [Logstash](http://logstash.net/docs/1.4.2/tutorials/getting-started-with-logstash) -format (in JSON) to an [Elasticsearch](http://www.elasticsearch.org/) cluster which runs as a Kubernetes service. -As of Kubernetes 0.11, when you create a cluster the console output reports the URL of both the Elasticsearch cluster as well as -a URL for a [Kibana](http://www.elasticsearch.org/overview/kibana/) dashboard viewer for the logs that have been ingested -into Elasticsearch. -``` -Elasticsearch is running at https://104.197.10.10/api/v1/proxy/namespaces/default/services/elasticsearch-logging -Kibana is running at https://104.197.10.10/api/v1/proxy/namespaces/default/services/kibana-logging -``` -Visiting the Kibana dashboard URL in a browser should give a display like this: -![Kibana](kibana.png) - -To learn how to query, filter etc. using Kibana you might like to look at this [tutorial](http://www.elasticsearch.org/guide/en/kibana/current/working-with-queries-and-filters.html). - -You can check to see if any logs are being ingested into Elasticsearch by curling against its URL. You will need to provide the username and password that was generated when your cluster was created. This can be found in the `kubernetes_auth` file for your cluster. -``` -$ curl -k -u admin:Drt3KdRGnoQL6TQM https://130.211.152.93/api/v1/proxy/namespaces/default/services/elasticsearch-logging/_search?size=10 -``` -A [demonstration](../examples/logging-demo/README.md) of two synthetic logging sources can be used -to check that logging is working correctly. - -Cluster logging can be turned on or off using the environment variable `ENABLE_NODE_LOGGING` which is defined in the -`config-default.sh` file for each provider. For the GCE provider this is set by default to `true`. Set this -to `false` to disable cluster logging. - -The type of logging is used is specified by the environment variable `LOGGING_DESTINATION` which for the -GCE provider has the default value `elasticsearch`. If this is set to `gcp` for the GCE provider then -logs will be sent to the Google Cloud Logging system instead. - -When using Elasticsearch the number of Elasticsearch instances can be controlled by setting the -variable `ELASTICSEARCH_LOGGING_REPLICAS` which has the default value of `1`. For large clusters -or clusters that are generating log information at a high rate you may wish to use more -Elasticsearch instances. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/logging.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/logging.md?pixel)]() diff --git a/release-0.19.0/docs/making-release-notes.md b/release-0.19.0/docs/making-release-notes.md deleted file mode 100644 index 9002b90afd1..00000000000 --- a/release-0.19.0/docs/making-release-notes.md +++ /dev/null @@ -1,36 +0,0 @@ -## Making release notes -This documents the process for making release notes for a release. - -### 1) Note the PR number of the previous release -Find the PR that was merged with the previous release. Remember this number -_TODO_: Figure out a way to record this somewhere to save the next release engineer time. - -### 2) Build the release-notes tool -```bash -${KUBERNETES_ROOT}/build/make-release-notes.sh -``` - -### 3) Trim the release notes -This generates a list of the entire set of PRs merged since the last release. It is likely long -and many PRs aren't worth mentioning. - -Open up ```candidate-notes.md``` in your favorite editor. - -Remove, regroup, organize to your hearts content. - - -### 4) Update CHANGELOG.md -With the final markdown all set, cut and paste it to the top of ```CHANGELOG.md``` - -### 5) Update the Release page - * Switch to the [releases](https://github.com/GoogleCloudPlatform/kubernetes/releases) page. - * Open up the release you are working on. - * Cut and paste the final markdown from above into the release notes - * Press Save. - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/making-release-notes.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/making-release-notes.md?pixel)]() diff --git a/release-0.19.0/docs/man/Dockerfile b/release-0.19.0/docs/man/Dockerfile deleted file mode 100644 index 9910bd48f90..00000000000 --- a/release-0.19.0/docs/man/Dockerfile +++ /dev/null @@ -1,7 +0,0 @@ -FROM golang:1.3 -RUN mkdir -p /go/src/github.com/cpuguy83 -RUN mkdir -p /go/src/github.com/cpuguy83 \ - && git clone -b v1 https://github.com/cpuguy83/go-md2man.git /go/src/github.com/cpuguy83/go-md2man \ - && cd /go/src/github.com/cpuguy83/go-md2man \ - && go get -v ./... -CMD ["/go/bin/go-md2man", "--help"] diff --git a/release-0.19.0/docs/man/README.md b/release-0.19.0/docs/man/README.md deleted file mode 100644 index 3c24f7b2798..00000000000 --- a/release-0.19.0/docs/man/README.md +++ /dev/null @@ -1,49 +0,0 @@ -Kubernetes Documentation -==================== - -This directory contains the Kubernetes user manual in the Markdown format. -Do *not* edit the man pages in the man1 directory. Instead, amend the -Markdown (*.md) files. - -# File List - - kube-apiserver.1.md - kube-controller-manager.1.md - kubelet.1.md - kube-proxy.1.md - kube-scheduler.1.md - Dockerfile - md2man-all.sh - -# Generating man pages from the Markdown files - -The recommended approach for generating the man pages is via a Docker -container using the supplied `Dockerfile` to create an image with the correct -environment. This uses `go-md2man`, a pure Go Markdown to man page generator. - -## Building the md2man image - -There is a `Dockerfile` provided in the `kubernetes/docs/man` directory. - -Using this `Dockerfile`, create a Docker image tagged `docker/md2man`: - - docker build -t docker/md2man . - -## Utilizing the image - -Once the image is built, run a container using the image with *volumes*: - - docker run -v //kubernetes/docs/man:/docs:rw \ - -w /docs -i docker/md2man /docs/md2man-all.sh - -The `md2man` Docker container will process the Markdown files and generate -the man pages inside the `docker/docs/man/man1` directory using -Docker volumes. For more information on Docker volumes see the man page for -`docker run` and also look at the article [Sharing Directories via Volumes] -(http://docs.docker.com/use/working_with_volumes/). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/man/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/man/README.md?pixel)]() diff --git a/release-0.19.0/docs/man/kube-apiserver.1.md b/release-0.19.0/docs/man/kube-apiserver.1.md deleted file mode 100644 index 89221a6b522..00000000000 --- a/release-0.19.0/docs/man/kube-apiserver.1.md +++ /dev/null @@ -1,198 +0,0 @@ -% KUBERNETES(1) kubernetes User Manuals -% Scott Collier -% October 2014 -# NAME -kube-apiserver \- Provides the API for kubernetes orchestration. - -# SYNOPSIS -**kube-apiserver** [OPTIONS] - -# DESCRIPTION - -The **kubernetes** API server validates and configures data for 3 types of objects: pods, services, and replicationcontrollers. Beyond just servicing REST operations, the API Server does two other things as well: 1. Schedules pods to worker nodes. Right now the scheduler is very simple. 2. Synchronize pod information (where they are, what ports they are exposing) with the service configuration. - -The the kube-apiserver several options. - -# OPTIONS -**--address**=127.0.0.1 - DEPRECATED: see --insecure-bind-address instead - -**--admission-control**="AlwaysAdmit" - Ordered list of plug-ins to do admission control of resources into cluster. Comma-delimited list of: AlwaysDeny, AlwaysAdmit, ServiceAccount, NamespaceExists, NamespaceLifecycle, NamespaceAutoProvision, LimitRanger, SecurityContextDeny, ResourceQuota - -**--admission-control-config-file**="" - File with admission control configuration. - -**--allow-privileged**=false - If true, allow privileged containers. - -**--alsologtostderr**=false - log to standard error as well as files - -**--api-burst**=200 - API burst amount for the read only port - -**--api-prefix**="/api" - The prefix for API requests on the server. Default '/api'. - -**--api-rate**=10 - API rate limit as QPS for the read only port - -**--authorization-mode**="AlwaysAllow" - Selects how to do authorization on the secure port. One of: AlwaysAllow,AlwaysDeny,ABAC - -**--authorization-policy-file**="" - File with authorization policy in csv format, used with --authorization-mode=ABAC, on the secure port. - -**--basic-auth-file**="" - If set, the file that will be used to admit requests to the secure port of the API server via http basic authentication. - -**--bind-address**=0.0.0.0 - The IP address on which to serve the --read-only-port and --secure-port ports. This address must be reachable by the rest of the cluster. If blank, all interfaces will be used. - -**--cert-dir**="/var/run/kubernetes" - The directory where the TLS certs are located (by default /var/run/kubernetes). If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored. - -**--client-ca-file**="" - If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate. - -**--cloud-config**="" - The path to the cloud provider configuration file. Empty string for no configuration file. - -**--cloud-provider**="" - The provider for cloud services. Empty string for no provider. - -**--cluster-name**="kubernetes" - The instance prefix for the cluster - -**--cors-allowed-origins**=[] - List of allowed origins for CORS, comma separated. An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled. - -**--etcd-config**="" - The config file for the etcd client. Mutually exclusive with -etcd-servers. - -**--etcd-prefix**="/registry" - The prefix for all resource paths in etcd. - -**--etcd-servers**=[] - List of etcd servers to watch (http://ip:port), comma separated. Mutually exclusive with -etcd-config - -**--event-ttl**=1h0m0s - Amount of time to retain events. Default 1 hour. - -**--external-hostname**="" - The hostname to use when generating externalized URLs for this master (e.g. Swagger API Docs.) - -**--insecure-bind-address**=127.0.0.1 - The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all interfaces). Defaults to localhost. - -**--insecure-port**=8080 - The port on which to serve unsecured, unauthenticated access. Default 8080. It is assumed that firewall rules are set up such that this port is not reachable from outside of the cluster and that port 443 on the cluster's public address is proxied to this port. This is performed by nginx in the default setup. - -**--kubelet_certificate_authority**="" - Path to a cert. file for the certificate authority. - -**--kubelet_client_certificate**="" - Path to a client key file for TLS. - -**--kubelet_client_key**="" - Path to a client key file for TLS. - -**--kubelet_https**=true - Use https for kubelet connections - -**--kubelet_port**=10250 - Kubelet port - -**--kubelet_timeout**=5s - Timeout for kubelet operations - -**--log_backtrace_at**=:0 - when logging hits line file:N, emit a stack trace - -**--log_dir**= - If non-empty, write log files in this directory - -**--log_flush_frequency**=5s - Maximum number of seconds between log flushes - -**--logtostderr**=true - log to standard error instead of files - -**--long-running-request-regexp**="[.*\\/watch$][^\\/proxy.*]" - A regular expression matching long running requests which should be excluded from maximum inflight request handling. - -**--master-service-namespace**="default" - The namespace from which the kubernetes master services should be injected into pods - -**--max-requests-inflight**=400 - The maximum number of requests in flight at a given time. When the server exceeds this, it rejects requests. Zero for no limit. - -**--old-etcd-prefix**="/registry" - The previous prefix for all resource paths in etcd, if any. - -**--port**=8080 - DEPRECATED: see --insecure-port instead - -**--service-cluster-ip-range**= - A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes for pods. - -**--profiling**=true - Enable profiling via web interface host:port/debug/pprof/ - -**--public-address-override**=0.0.0.0 - DEPRECATED: see --bind-address instead - -**--read-only-port**=7080 - The port on which to serve read-only resources. If 0, don't serve read-only at all. It is assumed that firewall rules are set up such that this port is not reachable from outside of the cluster. - -**--runtime-config**= - A set of key=value pairs that describe runtime configuration that may be passed to the apiserver. api/ key can be used to turn on/off specific api versions. api/all and api/legacy are special keys to control all and legacy api versions respectively. - -**--secure-port**=6443 - The port on which to serve HTTPS with authentication and authorization. If 0, don't serve HTTPS at all. - -**--service-account-key-file**="" - File containing PEM-encoded x509 RSA private or public key, used to verify ServiceAccount tokens. If unspecified, --tls-private-key-file is used. - -**--service-account-lookup**=false - If true, validate ServiceAccount tokens exist in etcd as part of authentication. - -**--stderrthreshold**=2 - logs at or above this threshold go to stderr - -**--storage-version**="" - The version to store resources with. Defaults to server preferred - -**--tls-cert-file**="" - File containing x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes. - -**--tls-private-key-file**="" - File containing x509 private key matching --tls-cert-file. - -**--token-auth-file**="" - If set, the file that will be used to secure the secure port of the API server via token authentication. - -**--v**=0 - log level for V logs - -**--version**=false - Print version information and quit - -**--vmodule**= - comma-separated list of pattern=N settings for file-filtered logging - -# EXAMPLES -``` -/usr/bin/kube-apiserver --logtostderr=true --v=0 --etcd_servers=http://127.0.0.1:4001 --insecure_bind_address=127.0.0.1 --insecure_port=8080 --kubelet_port=10250 --service-cluster-ip-range=10.1.1.0/24 --allow_privileged=false -``` - -# HISTORY -October 2014, Originally compiled by Scott Collier (scollier at redhat dot com) based - on the kubernetes source material and internal work. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/man/kube-apiserver.1.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/man/kube-apiserver.1.md?pixel)]() diff --git a/release-0.19.0/docs/man/kube-controller-manager.1.md b/release-0.19.0/docs/man/kube-controller-manager.1.md deleted file mode 100644 index a9081b47fc5..00000000000 --- a/release-0.19.0/docs/man/kube-controller-manager.1.md +++ /dev/null @@ -1,141 +0,0 @@ -% KUBERNETES(1) kubernetes User Manuals -% Scott Collier -% October 2014 -# NAME -kube-controller-manager \- Enforces kubernetes services. - -# SYNOPSIS -**kube-controller-manager** [OPTIONS] - -# DESCRIPTION - -The **kubernetes** controller manager is really a service that is layered on top of the simple pod API. To enforce this layering, the logic for the replicationcontroller is actually broken out into another server. This server watches etcd for changes to replicationcontroller objects and then uses the public Kubernetes API to implement the replication algorithm. - -The kube-controller-manager has several options. - -# OPTIONS -**--address**=127.0.0.1 - The IP address to serve on (set to 0.0.0.0 for all interfaces) - -**--allocate-node-cidrs**=false - Should CIDRs for Pods be allocated and set on the cloud provider. - -**--alsologtostderr**=false - log to standard error as well as files - -**--cloud-config**="" - The path to the cloud provider configuration file. Empty string for no configuration file. - -**--cloud-provider**="" - The provider for cloud services. Empty string for no provider. - -**--cluster-cidr**= - CIDR Range for Pods in cluster. - -**--concurrent-endpoint-syncs**=5 - The number of endpoint syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load - -**--concurrent_rc_syncs**=5 - The number of replication controllers that are allowed to sync concurrently. Larger number = more reponsive replica management, but more CPU (and network) load - -**--deleting-pods-burst**=10 - Number of nodes on which pods are bursty deleted in case of node failure. For more details look into RateLimiter. - -**--deleting-pods-qps**=0.1 - Number of nodes per second on which pods are deleted in case of node failure. - -**--kubeconfig**="" - Path to kubeconfig file with authorization and master location information. - -**--log_backtrace_at**=:0 - when logging hits line file:N, emit a stack trace - -**--log_dir**= - If non-empty, write log files in this directory - -**--log_flush_frequency**=5s - Maximum number of seconds between log flushes - -**--logtostderr**=true - log to standard error instead of files - -**--machines**=[] - List of machines to schedule onto, comma separated. - -**--master**="" - The address of the Kubernetes API server (overrides any value in kubeconfig) - -**--minion-regexp**="" - If non empty, and --cloud-provider is specified, a regular expression for matching minion VMs. - -**--namespace-sync-period**=5m0s - The period for syncing namespace life-cycle updates - -**--node-memory**=3Gi - The amount of memory (in bytes) provisioned on each node - -**--node-milli-cpu**=1000 - The amount of MilliCPU provisioned on each node - -**--node-monitor-grace-period**=40s - Amount of time which we allow running Node to be unresponsive before marking it unhealty. Must be N times more than kubelet's nodeStatusUpdateFrequency, where N means number of retries allowed for kubelet to post node status. - -**--node-monitor-period**=5s - The period for syncing NodeStatus in NodeController. - -**--node-startup-grace-period**=1m0s - Amount of time which we allow starting Node to be unresponsive before marking it unhealty. - -**--node-sync-period**=10s - The period for syncing nodes from cloudprovider. Longer periods will result in fewer calls to cloud provider, but may delay addition of new nodes to cluster. - -**--pod-eviction-timeout**=5m0s - The grace peroid for deleting pods on failed nodes. - -**--port**=10252 - The port that the controller-manager's http service runs on - -**--profiling**=true - Enable profiling via web interface host:port/debug/pprof/ - -**--pvclaimbinder-sync-period**=10s - The period for syncing persistent volumes and persistent volume claims - -**--register-retry-count**=10 - The number of retries for initial node registration. Retry interval equals node-sync-period. - -**--resource-quota-sync-period**=10s - The period for syncing quota usage status in the system - -**--service-account-private-key-file**="" - Filename containing a PEM-encoded private RSA key used to sign service account tokens. - -**--stderrthreshold**=2 - logs at or above this threshold go to stderr - -**--sync-nodes**=true - If true, and --cloud-provider is specified, sync nodes from the cloud provider. Default true. - -**--v**=0 - log level for V logs - -**--version**=false - Print version information and quit - -**--vmodule**= - comma-separated list of pattern=N settings for file-filtered logging - -# EXAMPLES -``` -/usr/bin/kube-controller-manager --logtostderr=true --v=0 --master=127.0.0.1:8080 --machines=127.0.0.1 -``` - -# HISTORY -October 2014, Originally compiled by Scott Collier (scollier at redhat dot com) based - on the kubernetes source material and internal work. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/man/kube-controller-manager.1.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/man/kube-controller-manager.1.md?pixel)]() diff --git a/release-0.19.0/docs/man/kube-proxy.1.md b/release-0.19.0/docs/man/kube-proxy.1.md deleted file mode 100644 index a49b2af07ed..00000000000 --- a/release-0.19.0/docs/man/kube-proxy.1.md +++ /dev/null @@ -1,78 +0,0 @@ -% KUBERNETES(1) kubernetes User Manuals -% Scott Collier -% October 2014 -# NAME -kube-proxy \- Provides network proxy services. - -# SYNOPSIS -**kube-proxy** [OPTIONS] - -# DESCRIPTION - -The **kubernetes** network proxy runs on each node. This reflects services as defined in the Kubernetes API on each node and can do simple TCP stream forwarding or round robin TCP forwarding across a set of backends. Service endpoints are currently found through Docker-links-compatible environment variables specifying ports opened by the service proxy. Currently the user must select a port to expose the service on on the proxy, as well as the container's port to target. - -The kube-proxy takes several options. - -# OPTIONS -**--alsologtostderr**=false - log to standard error as well as files - -**--bind-address**=0.0.0.0 - The IP address for the proxy server to serve on (set to 0.0.0.0 for all interfaces) - -**--healthz-bind-address**=127.0.0.1 - The IP address for the health check server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces) - -**--healthz-port**=10249 - The port to bind the health check server. Use 0 to disable. - -**--kubeconfig**="" - Path to kubeconfig file with authorization information (the master location is set by the master flag). - -**--log_backtrace_at**=:0 - when logging hits line file:N, emit a stack trace - -**--log_dir**= - If non-empty, write log files in this directory - -**--log_flush_frequency**=5s - Maximum number of seconds between log flushes - -**--logtostderr**=true - log to standard error instead of files - -**--master**="" - The address of the Kubernetes API server (overrides any value in kubeconfig) - -**--oom-score-adj**=-899 - The oom_score_adj value for kube-proxy process. Values must be within the range [-1000, 1000] - -**--resource-container**="/kube-proxy" - Absolute name of the resource-only container to create and run the Kube-proxy in (Default: /kube-proxy). - -**--stderrthreshold**=2 - logs at or above this threshold go to stderr - -**--v**=0 - log level for V logs - -**--version**=false - Print version information and quit - -**--vmodule**= - comma-separated list of pattern=N settings for file-filtered logging - -# EXAMPLES -``` -/usr/bin/kube-proxy --logtostderr=true --v=0 --master=http://127.0.0.1:8080 -``` - -# HISTORY -October 2014, Originally compiled by Scott Collier (scollier at redhat dot com) based - on the kubernetes source material and internal work. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/man/kube-proxy.1.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/man/kube-proxy.1.md?pixel)]() diff --git a/release-0.19.0/docs/man/kube-scheduler.1.md b/release-0.19.0/docs/man/kube-scheduler.1.md deleted file mode 100644 index c470bd2472a..00000000000 --- a/release-0.19.0/docs/man/kube-scheduler.1.md +++ /dev/null @@ -1,78 +0,0 @@ -% KUBERNETES(1) kubernetes User Manuals -% Scott Collier -% October 2014 -# NAME -kube-scheduler \- Schedules containers on hosts. - -# SYNOPSIS -**kube-scheduler** [OPTIONS] - -# DESCRIPTION - -The **kubernetes** scheduler is a policy-rich, topology-aware, workload-specific function that significantly impacts availability, performance, and capacity. The scheduler needs to take into account individual and collective resource requirements, quality of service requirements, hardware/software/policy constraints, affinity and anti-affinity specifications, data locality, inter-workload interference, deadlines, and so on. Workload-specific requirements will be exposed through the API as necessary. - -The kube-scheduler can take several options. - -# OPTIONS -**--address**=127.0.0.1 - The IP address to serve on (set to 0.0.0.0 for all interfaces) - -**--algorithm-provider**="DefaultProvider" - The scheduling algorithm provider to use, one of: DefaultProvider - -**--alsologtostderr**=false - log to standard error as well as files - -**--kubeconfig**="" - Path to kubeconfig file with authorization and master location information. - -**--log_backtrace_at**=:0 - when logging hits line file:N, emit a stack trace - -**--log_dir**= - If non-empty, write log files in this directory - -**--log_flush_frequency**=5s - Maximum number of seconds between log flushes - -**--logtostderr**=true - log to standard error instead of files - -**--master**="" - The address of the Kubernetes API server (overrides any value in kubeconfig) - -**--policy-config-file**="" - File with scheduler policy configuration - -**--port**=10251 - The port that the scheduler's http service runs on - -**--profiling**=true - Enable profiling via web interface host:port/debug/pprof/ - -**--stderrthreshold**=2 - logs at or above this threshold go to stderr - -**--v**=0 - log level for V logs - -**--version**=false - Print version information and quit - -**--vmodule**= - comma-separated list of pattern=N settings for file-filtered logging - -# EXAMPLES -``` -/usr/bin/kube-scheduler --logtostderr=true --v=0 --master=127.0.0.1:8080 -``` - -# HISTORY -October 2014, Originally compiled by Scott Collier (scollier@redhat.com) based - on the kubernetes source material and internal work. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/man/kube-scheduler.1.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/man/kube-scheduler.1.md?pixel)]() diff --git a/release-0.19.0/docs/man/kubelet.1.md b/release-0.19.0/docs/man/kubelet.1.md deleted file mode 100644 index 62b09c675ff..00000000000 --- a/release-0.19.0/docs/man/kubelet.1.md +++ /dev/null @@ -1,259 +0,0 @@ -% KUBERNETES(1) kubernetes User Manuals -% Scott Collier -% October 2014 -# NAME -kubelet \- Processes a container manifest so the containers are launched according to how they are described. - -# SYNOPSIS -**kubelet** [OPTIONS] - -# DESCRIPTION - -The **kubernetes** kubelet runs on each node. - -The Kubelet ensures that pods defined by "container manifests" are running. -Container manifests simply refer to the YAML or JSON files which we use to represent pods, but viewed from the perspective of the kubelet. -Thus, the Kubelet watches for these manifests (which can be provided by different mechanisms) and ensures that the containers described in those manifests are started. - -By "watch", we specifically mean, that the Kubelet monitors either an HTTP endpoint, or a directory, a file, or a server. - -There are 3 ways that a container manifest can be provided to the Kubelet: - - File: Path to a file OR directory passed as a flag on the command line. This file is rechecked every 20 seconds (configurable with a flag). See the --config option. - HTTP endpoint: HTTP endpoint passed as a parameter on the command line. This endpoint is checked every 20 seconds (also configurable with a flag). - HTTP server: The kubelet can also listen for HTTP and respond to a simple API submissions of new manifests (currently, this is underspecified). - -# OPTIONS -**--address**=0.0.0.0 - The IP address for the info server to serve on (set to 0.0.0.0 for all interfaces) - -**--allow_dynamic_housekeeping**=true - Whether to allow the housekeeping interval to be dynamic - -**--allow-privileged**=false - If true, allow containers to request privileged mode. [default=false] - -**--alsologtostderr**=false - log to standard error as well as files - -**--api-servers**=[] - List of Kubernetes API servers for publishing events, and reading pods and services. (ip:port), comma separated. Although this is a critical argument for common kube deployments, note that kubelets can still run pods from manifests without an api-server. - -**--boot_id_file**=/proc/sys/kernel/random/boot_id - Comma-separated list of files to check for boot-id. Use the first one that exists. - -**--cadvisor-port**=4194 - The port of the localhost cAdvisor endpoint - -**--cert-dir**="/var/run/kubernetes" - The directory where the TLS certs are located (by default /var/run/kubernetes). If --tls_cert_file and --tls_private_key_file are provided, this flag will be ignored. - -**--cgroup_root**="" - Optional root cgroup to use for pods. This is handled by the container runtime on a best effort basis. Default: '', which means use the container runtime default. - -**--cloud-config**="" - The path to the cloud provider configuration file. Empty string for no configuration file. - -**--cloud-provider**="" - The provider for cloud services. Empty string for no provider. - -**--cluster-dns**= - IP address for a cluster DNS server. If set, kubelet will configure all containers to use this for DNS resolution in addition to the host's DNS servers - -**--cluster-domain**="" - Domain for this cluster. If set, kubelet will configure all containers to search this domain in addition to the host's search domains - -**--config**="" - Path to the config file or directory of manifest files. For example, --config=/foo/ would run .manifest files under /foo on startup of the kubelet (even if no api-server was yet running). - -**--configure-cbr0**=false - If true, kubelet will configure cbr0 based on Node.Spec.PodCIDR. - -**--container_hints**=/etc/cadvisor/container_hints.json - location of the container hints file - -**--container_runtime**="docker" - The container runtime to use. Possible values: 'docker', 'rkt'. Default: 'docker'. - -**--docker**=unix:///var/run/docker.sock - docker endpoint - -**--docker-daemon-container**="/docker-daemon" - Optional resource-only container in which to place the Docker Daemon. Empty for no container (Default: /docker-daemon). - -**--docker-endpoint**="" - If non-empty, use this for the docker endpoint to communicate with - -**--docker_only**=false - Only report docker containers in addition to root stats - -**--docker_root**=/var/lib/docker - Absolute path to the Docker state root directory (default: /var/lib/docker) - -**--docker_run**=/var/run/docker - Absolute path to the Docker run directory (default: /var/run/docker) - -**--enable-debugging-handlers**=true - Enables server endpoints for log collection and local running of containers and commands - -**--enable_load_reader**=false - Whether to enable cpu load reader - -**--enable-server**=true - Enable the info server - -**--event_storage_age_limit**=default=24h - Max length of time for which to store events (per type). Value is a comma separated list of key values, where the keys are event types (e.g.: creation, oom) or "default" and the value is a duration. Default is applied to all non-specified event types - -**--event_storage_event_limit**=default=100000 - Max number of events to store (per type). Value is a comma separated list of key values, where the keys are event types (e.g.: creation, oom) or "default" and the value is an integer. Default is applied to all non-specified event types - -**--file-check-frequency**=20s - Duration between checking config files for new data - -**--global_housekeeping_interval**=1m0s - Interval between global housekeepings - -**--google-json-key**="" - The Google Cloud Platform Service Account JSON Key to use for authentication. - -**--healthz-bind-address**=127.0.0.1 - The IP address for the healthz server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces) - -**--healthz-port**=10248 - The port of the localhost healthz endpoint - -**--host-network-sources**="file" - Comma-separated list of sources from which the Kubelet allows pods to use of host network. For all sources use "*" [default="file"] - -**--hostname-override**="" - If non-empty, will use this string as identification instead of the actual hostname. - -**--housekeeping_interval**=1s - Interval between container housekeepings - -**--http-check-frequency**=20s - Duration between checking http for new data - -**--image-gc-high-threshold**=90 - The percent of disk usage after which image garbage collection is always run. Default: 90%% - -**--image-gc-low-threshold**=80 - The percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. Default: 80%% - -**--kubeconfig**=/var/lib/kubelet/kubeconfig - Path to a kubeconfig file, specifying how to authenticate to API server (the master location is set by the api-servers flag). - -**--log_backtrace_at**=:0 - when logging hits line file:N, emit a stack trace - -**--log_cadvisor_usage**=false - Whether to log the usage of the cAdvisor container - -**--log_dir**= - If non-empty, write log files in this directory - -**--log_flush_frequency**=5s - Maximum number of seconds between log flushes - -**--logtostderr**=true - log to standard error instead of files - -**--low-diskspace-threshold-mb**=256 - The absolute free disk space, in MB, to maintain. When disk space falls below this threshold, new pods would be rejected. Default: 256 - -**--machine_id_file**=/etc/machine-id,/var/lib/dbus/machine-id - Comma-separated list of files to check for machine-id. Use the first one that exists. - -**--manifest-url**="" - URL for accessing the container manifest - -**--master-service-namespace**="default" - The namespace from which the kubernetes master services should be injected into pods - -**--max_housekeeping_interval**=1m0s - Largest interval to allow between container housekeepings - -**--max_pods**=100 - Number of Pods that can run on this Kubelet. - -**--maximum-dead-containers**=100 - Maximum number of old instances of a containers to retain globally. Each container takes up some disk space. Default: 100. - -**--maximum-dead-containers-per-container**=5 - Maximum number of old instances of a container to retain per container. Each container takes up some disk space. Default: 5. - -**--minimum-container-ttl-duration**=1m0s - Minimum age for a finished container before it is garbage collected. Examples: '300ms', '10s' or '2h45m' - -**--network-plugin**="" - The name of the network plugin to be invoked for various events in kubelet/pod lifecycle - -**--node-status-update-frequency**=10s - Specifies how often kubelet posts node status to master. Note: be cautious when changing the constant, it must work with nodeMonitorGracePeriod in nodecontroller. Default: 10s - -**--oom-score-adj**=-900 - The oom_score_adj value for kubelet process. Values must be within the range [-1000, 1000] - -**--pod-infra-container-image**="gcr.io/google_containers/pause:0.8.0" - The image whose network/ipc namespaces containers in each pod will use. - -**--port**=10250 - The port for the info server to serve on - -**--read-only-port**=10255 - The read-only port for the info server to serve on (set to 0 to disable) - -**--registry-burst**=10 - Maximum size of a bursty pulls, temporarily allows pulls to burst to this number, while still not exceeding registry_qps. Only used if --registry_qps > 0 - -**--registry-qps**=0 - If > 0, limit registry pull QPS to this value. If 0, unlimited. [default=0.0] - -**--resource-container**="/kubelet" - Absolute name of the resource-only container to create and run the Kubelet in (Default: /kubelet). - -**--root-dir**="/var/lib/kubelet" - Directory path for managing kubelet files (volume mounts,etc). - -**--runonce**=false - If true, exit after spawning pods from local manifests or remote urls. Exclusive with --api_servers, and --enable-server - -**--stderrthreshold**=2 - logs at or above this threshold go to stderr - -**--streaming-connection-idle-timeout**=0 - Maximum time a streaming connection can be idle before the connection is automatically closed. Example: '5m' - -**--sync-frequency**=10s - Max period between synchronizing running containers and config - -**--tls-cert-file**="" - File /gmrvcontaining x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If --tls_cert_file and --tls_private_key_file are not provided, a self-signed certificate and key are generated for the public address and saved to the directory passed to --cert_dir. - -**--tls-private-key-file**="" - File containing x509 private key matching --tls_cert_file. - -**--v**=0 - log level for V logs - -**--version**=false - Print version information and quit - -**--vmodule**= - comma-separated list of pattern=N settings for file-filtered logging - -# EXAMPLES -``` -/usr/bin/kubelet --logtostderr=true --v=0 --api_servers=http://127.0.0.1:8080 --address=127.0.0.1 --port=10250 --hostname_override=127.0.0.1 --allow-privileged=false -``` - -# HISTORY -October 2014, Originally compiled by Scott Collier (scollier at redhat dot com) based - on the kubernetes source material and internal work. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/man/kubelet.1.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/man/kubelet.1.md?pixel)]() diff --git a/release-0.19.0/docs/man/man1/.files_generated b/release-0.19.0/docs/man/man1/.files_generated deleted file mode 100644 index 241e191b410..00000000000 --- a/release-0.19.0/docs/man/man1/.files_generated +++ /dev/null @@ -1,28 +0,0 @@ -kubectl-api-versions.1 -kubectl-cluster-info.1 -kubectl-config-set-cluster.1 -kubectl-config-set-context.1 -kubectl-config-set-credentials.1 -kubectl-config-set.1 -kubectl-config-unset.1 -kubectl-config-use-context.1 -kubectl-config-view.1 -kubectl-config.1 -kubectl-create.1 -kubectl-delete.1 -kubectl-describe.1 -kubectl-exec.1 -kubectl-expose.1 -kubectl-get.1 -kubectl-label.1 -kubectl-logs.1 -kubectl-namespace.1 -kubectl-port-forward.1 -kubectl-proxy.1 -kubectl-rolling-update.1 -kubectl-run.1 -kubectl-scale.1 -kubectl-stop.1 -kubectl-update.1 -kubectl-version.1 -kubectl.1 diff --git a/release-0.19.0/docs/man/man1/kube-apiserver.1 b/release-0.19.0/docs/man/man1/kube-apiserver.1 deleted file mode 100644 index 2fa1600b7ea..00000000000 --- a/release-0.19.0/docs/man/man1/kube-apiserver.1 +++ /dev/null @@ -1,259 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Scott Collier" "October 2014" "" - -.SH NAME -.PP -kube\-apiserver \- Provides the API for kubernetes orchestration. - -.SH SYNOPSIS -.PP -\fBkube\-apiserver\fP [OPTIONS] - -.SH DESCRIPTION -.PP -The \fBkubernetes\fP API server validates and configures data for 3 types of objects: pods, services, and replicationcontrollers. Beyond just servicing REST operations, the API Server does two other things as well: 1. Schedules pods to worker nodes. Right now the scheduler is very simple. 2. Synchronize pod information (where they are, what ports they are exposing) with the service configuration. - -.PP -The the kube\-apiserver several options. - -.SH OPTIONS -.PP -\fB\-\-address\fP=127.0.0.1 - DEPRECATED: see \-\-insecure\-bind\-address instead - -.PP -\fB\-\-admission\-control\fP="AlwaysAdmit" - Ordered list of plug\-ins to do admission control of resources into cluster. Comma\-delimited list of: AlwaysDeny, AlwaysAdmit, ServiceAccount, NamespaceExists, NamespaceLifecycle, NamespaceAutoProvision, LimitRanger, SecurityContextDeny, ResourceQuota - -.PP -\fB\-\-admission\-control\-config\-file\fP="" - File with admission control configuration. - -.PP -\fB\-\-allow\-privileged\fP=false - If true, allow privileged containers. - -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-burst\fP=200 - API burst amount for the read only port - -.PP -\fB\-\-api\-prefix\fP="/api" - The prefix for API requests on the server. Default '/api'. - -.PP -\fB\-\-api\-rate\fP=10 - API rate limit as QPS for the read only port - -.PP -\fB\-\-authorization\-mode\fP="AlwaysAllow" - Selects how to do authorization on the secure port. One of: AlwaysAllow,AlwaysDeny,ABAC - -.PP -\fB\-\-authorization\-policy\-file\fP="" - File with authorization policy in csv format, used with \-\-authorization\-mode=ABAC, on the secure port. - -.PP -\fB\-\-basic\-auth\-file\fP="" - If set, the file that will be used to admit requests to the secure port of the API server via http basic authentication. - -.PP -\fB\-\-bind\-address\fP=0.0.0.0 - The IP address on which to serve the \-\-read\-only\-port and \-\-secure\-port ports. This address must be reachable by the rest of the cluster. If blank, all interfaces will be used. - -.PP -\fB\-\-cert\-dir\fP="/var/run/kubernetes" - The directory where the TLS certs are located (by default /var/run/kubernetes). If \-\-tls\-cert\-file and \-\-tls\-private\-key\-file are provided, this flag will be ignored. - -.PP -\fB\-\-client\-ca\-file\fP="" - If set, any request presenting a client certificate signed by one of the authorities in the client\-ca\-file is authenticated with an identity corresponding to the CommonName of the client certificate. - -.PP -\fB\-\-cloud\-config\fP="" - The path to the cloud provider configuration file. Empty string for no configuration file. - -.PP -\fB\-\-cloud\-provider\fP="" - The provider for cloud services. Empty string for no provider. - -.PP -\fB\-\-cluster\-name\fP="kubernetes" - The instance prefix for the cluster - -.PP -\fB\-\-cors\-allowed\-origins\fP=[] - List of allowed origins for CORS, comma separated. An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled. - -.PP -\fB\-\-etcd\-config\fP="" - The config file for the etcd client. Mutually exclusive with \-etcd\-servers. - -.PP -\fB\-\-etcd\-prefix\fP="/registry" - The prefix for all resource paths in etcd. - -.PP -\fB\-\-etcd\-servers\fP=[] - List of etcd servers to watch ( -\[la]http://ip:port\[ra]), comma separated. Mutually exclusive with \-etcd\-config - -.PP -\fB\-\-event\-ttl\fP=1h0m0s - Amount of time to retain events. Default 1 hour. - -.PP -\fB\-\-external\-hostname\fP="" - The hostname to use when generating externalized URLs for this master (e.g. Swagger API Docs.) - -.PP -\fB\-\-insecure\-bind\-address\fP=127.0.0.1 - The IP address on which to serve the \-\-insecure\-port (set to 0.0.0.0 for all interfaces). Defaults to localhost. - -.PP -\fB\-\-insecure\-port\fP=8080 - The port on which to serve unsecured, unauthenticated access. Default 8080. It is assumed that firewall rules are set up such that this port is not reachable from outside of the cluster and that port 443 on the cluster's public address is proxied to this port. This is performed by nginx in the default setup. - -.PP -\fB\-\-kubelet\_certificate\_authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-kubelet\_client\_certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-kubelet\_client\_key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-kubelet\_https\fP=true - Use https for kubelet connections - -.PP -\fB\-\-kubelet\_port\fP=10250 - Kubelet port - -.PP -\fB\-\-kubelet\_timeout\fP=5s - Timeout for kubelet operations - -.PP -\fB\-\-log\_backtrace\_at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\_dir\fP= - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\_flush\_frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-long\-running\-request\-regexp\fP="[.\fI\\/watch\$][^\\/proxy.\fP]" - A regular expression matching long running requests which should be excluded from maximum inflight request handling. - -.PP -\fB\-\-master\-service\-namespace\fP="default" - The namespace from which the kubernetes master services should be injected into pods - -.PP -\fB\-\-max\-requests\-inflight\fP=400 - The maximum number of requests in flight at a given time. When the server exceeds this, it rejects requests. Zero for no limit. - -.PP -\fB\-\-old\-etcd\-prefix\fP="/registry" - The previous prefix for all resource paths in etcd, if any. - -.PP -\fB\-\-port\fP=8080 - DEPRECATED: see \-\-insecure\-port instead - -.PP -\fB\-\-service\-cluster\-ip\-range\fP= - A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes for pods. - -.PP -\fB\-\-profiling\fP=true - Enable profiling via web interface host:port/debug/pprof/ - -.PP -\fB\-\-public\-address\-override\fP=0.0.0.0 - DEPRECATED: see \-\-bind\-address instead - -.PP -\fB\-\-read\-only\-port\fP=7080 - The port on which to serve read\-only resources. If 0, don't serve read\-only at all. It is assumed that firewall rules are set up such that this port is not reachable from outside of the cluster. - -.PP -\fB\-\-runtime\-config\fP= - A set of key=value pairs that describe runtime configuration that may be passed to the apiserver. api/ key can be used to turn on/off specific api versions. api/all and api/legacy are special keys to control all and legacy api versions respectively. - -.PP -\fB\-\-secure\-port\fP=6443 - The port on which to serve HTTPS with authentication and authorization. If 0, don't serve HTTPS at all. - -.PP -\fB\-\-service\-account\-key\-file\fP="" - File containing PEM\-encoded x509 RSA private or public key, used to verify ServiceAccount tokens. If unspecified, \-\-tls\-private\-key\-file is used. - -.PP -\fB\-\-service\-account\-lookup\fP=false - If true, validate ServiceAccount tokens exist in etcd as part of authentication. - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-storage\-version\fP="" - The version to store resources with. Defaults to server preferred - -.PP -\fB\-\-tls\-cert\-file\fP="" - File containing x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and \-\-tls\-cert\-file and \-\-tls\-private\-key\-file are not provided, a self\-signed certificate and key are generated for the public address and saved to /var/run/kubernetes. - -.PP -\fB\-\-tls\-private\-key\-file\fP="" - File containing x509 private key matching \-\-tls\-cert\-file. - -.PP -\fB\-\-token\-auth\-file\fP="" - If set, the file that will be used to secure the secure port of the API server via token authentication. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-version\fP=false - Print version information and quit - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - -.SH EXAMPLES -.PP -.RS - -.nf -/usr/bin/kube\-apiserver \-\-logtostderr=true \-\-v=0 \-\-etcd\_servers=http://127.0.0.1:4001 \-\-insecure\_bind\_address=127.0.0.1 \-\-insecure\_port=8080 \-\-kubelet\_port=10250 \-\-service\-cluster\-ip\-range=10.1.1.0/24 \-\-allow\_privileged=false - -.fi - -.SH HISTORY -.PP -October 2014, Originally compiled by Scott Collier (scollier at redhat dot com) based - on the kubernetes source material and internal work. - -.PP -[]() diff --git a/release-0.19.0/docs/man/man1/kube-controller-manager.1 b/release-0.19.0/docs/man/man1/kube-controller-manager.1 deleted file mode 100644 index df0d45603f3..00000000000 --- a/release-0.19.0/docs/man/man1/kube-controller-manager.1 +++ /dev/null @@ -1,182 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Scott Collier" "October 2014" "" - -.SH NAME -.PP -kube\-controller\-manager \- Enforces kubernetes services. - -.SH SYNOPSIS -.PP -\fBkube\-controller\-manager\fP [OPTIONS] - -.SH DESCRIPTION -.PP -The \fBkubernetes\fP controller manager is really a service that is layered on top of the simple pod API. To enforce this layering, the logic for the replicationcontroller is actually broken out into another server. This server watches etcd for changes to replicationcontroller objects and then uses the public Kubernetes API to implement the replication algorithm. - -.PP -The kube\-controller\-manager has several options. - -.SH OPTIONS -.PP -\fB\-\-address\fP=127.0.0.1 - The IP address to serve on (set to 0.0.0.0 for all interfaces) - -.PP -\fB\-\-allocate\-node\-cidrs\fP=false - Should CIDRs for Pods be allocated and set on the cloud provider. - -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-cloud\-config\fP="" - The path to the cloud provider configuration file. Empty string for no configuration file. - -.PP -\fB\-\-cloud\-provider\fP="" - The provider for cloud services. Empty string for no provider. - -.PP -\fB\-\-cluster\-cidr\fP= - CIDR Range for Pods in cluster. - -.PP -\fB\-\-concurrent\-endpoint\-syncs\fP=5 - The number of endpoint syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load - -.PP -\fB\-\-concurrent\_rc\_syncs\fP=5 - The number of replication controllers that are allowed to sync concurrently. Larger number = more reponsive replica management, but more CPU (and network) load - -.PP -\fB\-\-deleting\-pods\-burst\fP=10 - Number of nodes on which pods are bursty deleted in case of node failure. For more details look into RateLimiter. - -.PP -\fB\-\-deleting\-pods\-qps\fP=0.1 - Number of nodes per second on which pods are deleted in case of node failure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to kubeconfig file with authorization and master location information. - -.PP -\fB\-\-log\_backtrace\_at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\_dir\fP= - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\_flush\_frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-machines\fP=[] - List of machines to schedule onto, comma separated. - -.PP -\fB\-\-master\fP="" - The address of the Kubernetes API server (overrides any value in kubeconfig) - -.PP -\fB\-\-minion\-regexp\fP="" - If non empty, and \-\-cloud\-provider is specified, a regular expression for matching minion VMs. - -.PP -\fB\-\-namespace\-sync\-period\fP=5m0s - The period for syncing namespace life\-cycle updates - -.PP -\fB\-\-node\-memory\fP=3Gi - The amount of memory (in bytes) provisioned on each node - -.PP -\fB\-\-node\-milli\-cpu\fP=1000 - The amount of MilliCPU provisioned on each node - -.PP -\fB\-\-node\-monitor\-grace\-period\fP=40s - Amount of time which we allow running Node to be unresponsive before marking it unhealty. Must be N times more than kubelet's nodeStatusUpdateFrequency, where N means number of retries allowed for kubelet to post node status. - -.PP -\fB\-\-node\-monitor\-period\fP=5s - The period for syncing NodeStatus in NodeController. - -.PP -\fB\-\-node\-startup\-grace\-period\fP=1m0s - Amount of time which we allow starting Node to be unresponsive before marking it unhealty. - -.PP -\fB\-\-node\-sync\-period\fP=10s - The period for syncing nodes from cloudprovider. Longer periods will result in fewer calls to cloud provider, but may delay addition of new nodes to cluster. - -.PP -\fB\-\-pod\-eviction\-timeout\fP=5m0s - The grace peroid for deleting pods on failed nodes. - -.PP -\fB\-\-port\fP=10252 - The port that the controller\-manager's http service runs on - -.PP -\fB\-\-profiling\fP=true - Enable profiling via web interface host:port/debug/pprof/ - -.PP -\fB\-\-pvclaimbinder\-sync\-period\fP=10s - The period for syncing persistent volumes and persistent volume claims - -.PP -\fB\-\-register\-retry\-count\fP=10 - The number of retries for initial node registration. Retry interval equals node\-sync\-period. - -.PP -\fB\-\-resource\-quota\-sync\-period\fP=10s - The period for syncing quota usage status in the system - -.PP -\fB\-\-service\-account\-private\-key\-file\fP="" - Filename containing a PEM\-encoded private RSA key used to sign service account tokens. - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-sync\-nodes\fP=true - If true, and \-\-cloud\-provider is specified, sync nodes from the cloud provider. Default true. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-version\fP=false - Print version information and quit - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - -.SH EXAMPLES -.PP -.RS - -.nf -/usr/bin/kube\-controller\-manager \-\-logtostderr=true \-\-v=0 \-\-master=127.0.0.1:8080 \-\-machines=127.0.0.1 - -.fi - -.SH HISTORY -.PP -October 2014, Originally compiled by Scott Collier (scollier at redhat dot com) based - on the kubernetes source material and internal work. - -.PP -[]() diff --git a/release-0.19.0/docs/man/man1/kube-proxy.1 b/release-0.19.0/docs/man/man1/kube-proxy.1 deleted file mode 100644 index ffb10f811fa..00000000000 --- a/release-0.19.0/docs/man/man1/kube-proxy.1 +++ /dev/null @@ -1,98 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Scott Collier" "October 2014" "" - -.SH NAME -.PP -kube\-proxy \- Provides network proxy services. - -.SH SYNOPSIS -.PP -\fBkube\-proxy\fP [OPTIONS] - -.SH DESCRIPTION -.PP -The \fBkubernetes\fP network proxy runs on each node. This reflects services as defined in the Kubernetes API on each node and can do simple TCP stream forwarding or round robin TCP forwarding across a set of backends. Service endpoints are currently found through Docker\-links\-compatible environment variables specifying ports opened by the service proxy. Currently the user must select a port to expose the service on on the proxy, as well as the container's port to target. - -.PP -The kube\-proxy takes several options. - -.SH OPTIONS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-bind\-address\fP=0.0.0.0 - The IP address for the proxy server to serve on (set to 0.0.0.0 for all interfaces) - -.PP -\fB\-\-healthz\-bind\-address\fP=127.0.0.1 - The IP address for the health check server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces) - -.PP -\fB\-\-healthz\-port\fP=10249 - The port to bind the health check server. Use 0 to disable. - -.PP -\fB\-\-kubeconfig\fP="" - Path to kubeconfig file with authorization information (the master location is set by the master flag). - -.PP -\fB\-\-log\_backtrace\_at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\_dir\fP= - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\_flush\_frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-master\fP="" - The address of the Kubernetes API server (overrides any value in kubeconfig) - -.PP -\fB\-\-oom\-score\-adj\fP=\-899 - The oom\_score\_adj value for kube\-proxy process. Values must be within the range [\-1000, 1000] - -.PP -\fB\-\-resource\-container\fP="/kube\-proxy" - Absolute name of the resource\-only container to create and run the Kube\-proxy in (Default: /kube\-proxy). - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-version\fP=false - Print version information and quit - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - -.SH EXAMPLES -.PP -.RS - -.nf -/usr/bin/kube\-proxy \-\-logtostderr=true \-\-v=0 \-\-master=http://127.0.0.1:8080 - -.fi - -.SH HISTORY -.PP -October 2014, Originally compiled by Scott Collier (scollier at redhat dot com) based - on the kubernetes source material and internal work. - -.PP -[]() diff --git a/release-0.19.0/docs/man/man1/kube-scheduler.1 b/release-0.19.0/docs/man/man1/kube-scheduler.1 deleted file mode 100644 index 85e749eed79..00000000000 --- a/release-0.19.0/docs/man/man1/kube-scheduler.1 +++ /dev/null @@ -1,98 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Scott Collier" "October 2014" "" - -.SH NAME -.PP -kube\-scheduler \- Schedules containers on hosts. - -.SH SYNOPSIS -.PP -\fBkube\-scheduler\fP [OPTIONS] - -.SH DESCRIPTION -.PP -The \fBkubernetes\fP scheduler is a policy\-rich, topology\-aware, workload\-specific function that significantly impacts availability, performance, and capacity. The scheduler needs to take into account individual and collective resource requirements, quality of service requirements, hardware/software/policy constraints, affinity and anti\-affinity specifications, data locality, inter\-workload interference, deadlines, and so on. Workload\-specific requirements will be exposed through the API as necessary. - -.PP -The kube\-scheduler can take several options. - -.SH OPTIONS -.PP -\fB\-\-address\fP=127.0.0.1 - The IP address to serve on (set to 0.0.0.0 for all interfaces) - -.PP -\fB\-\-algorithm\-provider\fP="DefaultProvider" - The scheduling algorithm provider to use, one of: DefaultProvider - -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-kubeconfig\fP="" - Path to kubeconfig file with authorization and master location information. - -.PP -\fB\-\-log\_backtrace\_at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\_dir\fP= - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\_flush\_frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-master\fP="" - The address of the Kubernetes API server (overrides any value in kubeconfig) - -.PP -\fB\-\-policy\-config\-file\fP="" - File with scheduler policy configuration - -.PP -\fB\-\-port\fP=10251 - The port that the scheduler's http service runs on - -.PP -\fB\-\-profiling\fP=true - Enable profiling via web interface host:port/debug/pprof/ - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-version\fP=false - Print version information and quit - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - -.SH EXAMPLES -.PP -.RS - -.nf -/usr/bin/kube\-scheduler \-\-logtostderr=true \-\-v=0 \-\-master=127.0.0.1:8080 - -.fi - -.SH HISTORY -.PP -October 2014, Originally compiled by Scott Collier (scollier@redhat.com) based - on the kubernetes source material and internal work. - -.PP -[]() diff --git a/release-0.19.0/docs/man/man1/kubectl-api-versions.1 b/release-0.19.0/docs/man/man1/kubectl-api-versions.1 deleted file mode 100644 index c4212fd1d46..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-api-versions.1 +++ /dev/null @@ -1,130 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl api\-versions \- Print available API versions. - - -.SH SYNOPSIS -.PP -\fBkubectl api\-versions\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Print available API versions. - - -.SH OPTIONS -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for api\-versions - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-cluster-info.1 b/release-0.19.0/docs/man/man1/kubectl-cluster-info.1 deleted file mode 100644 index 3f64ae37ab1..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-cluster-info.1 +++ /dev/null @@ -1,130 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl cluster\-info \- Display cluster info - - -.SH SYNOPSIS -.PP -\fBkubectl cluster\-info\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Display addresses of the master and services with label kubernetes.io/cluster\-service=true - - -.SH OPTIONS -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for cluster\-info - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-config-set-cluster.1 b/release-0.19.0/docs/man/man1/kubectl-config-set-cluster.1 deleted file mode 100644 index 374e37bbad7..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-config-set-cluster.1 +++ /dev/null @@ -1,153 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl config set\-cluster \- Sets a cluster entry in kubeconfig - - -.SH SYNOPSIS -.PP -\fBkubectl config set\-cluster\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Sets a cluster entry in kubeconfig. -Specifying a name that already exists will merge new fields on top of existing values for those fields. - - -.SH OPTIONS -.PP -\fB\-\-api\-version\fP="" - api\-version for the cluster entry in kubeconfig - -.PP -\fB\-\-certificate\-authority\fP="" - path to certificate\-authority for the cluster entry in kubeconfig - -.PP -\fB\-\-embed\-certs\fP=false - embed\-certs for the cluster entry in kubeconfig - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for set\-cluster - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - insecure\-skip\-tls\-verify for the cluster entry in kubeconfig - -.PP -\fB\-\-server\fP="" - server for the cluster entry in kubeconfig - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-kubeconfig\fP="" - use a particular kubeconfig file - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Set only the server field on the e2e cluster entry without touching other values. -$ kubectl config set\-cluster e2e \-\-server=https://1.2.3.4 - -// Embed certificate authority data for the e2e cluster entry -$ kubectl config set\-cluster e2e \-\-certificate\-authority=\~/.kube/e2e/kubernetes.ca.crt - -// Disable cert checking for the dev cluster entry -$ kubectl config set\-cluster e2e \-\-insecure\-skip\-tls\-verify=true - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl\-config(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-config-set-context.1 b/release-0.19.0/docs/man/man1/kubectl-config-set-context.1 deleted file mode 100644 index 4e7928418ed..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-config-set-context.1 +++ /dev/null @@ -1,143 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl config set\-context \- Sets a context entry in kubeconfig - - -.SH SYNOPSIS -.PP -\fBkubectl config set\-context\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Sets a context entry in kubeconfig -Specifying a name that already exists will merge new fields on top of existing values for those fields. - - -.SH OPTIONS -.PP -\fB\-\-cluster\fP="" - cluster for the context entry in kubeconfig - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for set\-context - -.PP -\fB\-\-namespace\fP="" - namespace for the context entry in kubeconfig - -.PP -\fB\-\-user\fP="" - user for the context entry in kubeconfig - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - use a particular kubeconfig file - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Set the user field on the gce context entry without touching other values -$ kubectl config set\-context gce \-\-user=cluster\-admin - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl\-config(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-config-set-credentials.1 b/release-0.19.0/docs/man/man1/kubectl-config-set-credentials.1 deleted file mode 100644 index 1638f4bed7c..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-config-set-credentials.1 +++ /dev/null @@ -1,169 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl config set\-credentials \- Sets a user entry in kubeconfig - - -.SH SYNOPSIS -.PP -\fBkubectl config set\-credentials\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Sets a user entry in kubeconfig -Specifying a name that already exists will merge new fields on top of existing values. - -.PP -Client\-certificate flags: - \-\-client\-certificate=certfile \-\-client\-key=keyfile - -.PP -Bearer token flags: - \-\-token=bearer\_token - -.PP -Basic auth flags: - \-\-username=basic\_user \-\-password=basic\_password - -.PP -Bearer token and basic auth are mutually exclusive. - - -.SH OPTIONS -.PP -\fB\-\-client\-certificate\fP="" - path to client\-certificate for the user entry in kubeconfig - -.PP -\fB\-\-client\-key\fP="" - path to client\-key for the user entry in kubeconfig - -.PP -\fB\-\-embed\-certs\fP=false - embed client cert/key for the user entry in kubeconfig - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for set\-credentials - -.PP -\fB\-\-password\fP="" - password for the user entry in kubeconfig - -.PP -\fB\-\-token\fP="" - token for the user entry in kubeconfig - -.PP -\fB\-\-username\fP="" - username for the user entry in kubeconfig - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - use a particular kubeconfig file - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Set only the "client\-key" field on the "cluster\-admin" -// entry, without touching other values: -$ kubectl set\-credentials cluster\-admin \-\-client\-key=\~/.kube/admin.key - -// Set basic auth for the "cluster\-admin" entry -$ kubectl set\-credentials cluster\-admin \-\-username=admin \-\-password=uXFGweU9l35qcif - -// Embed client certificate data in the "cluster\-admin" entry -$ kubectl set\-credentials cluster\-admin \-\-client\-certificate=\~/.kube/admin.crt \-\-embed\-certs=true - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl\-config(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-config-set.1 b/release-0.19.0/docs/man/man1/kubectl-config-set.1 deleted file mode 100644 index f83ea2edaa2..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-config-set.1 +++ /dev/null @@ -1,132 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl config set \- Sets an individual value in a kubeconfig file - - -.SH SYNOPSIS -.PP -\fBkubectl config set\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Sets an individual value in a kubeconfig file -PROPERTY\_NAME is a dot delimited name where each token represents either a attribute name or a map key. Map keys may not contain dots. -PROPERTY\_VALUE is the new value you wish to set. - - -.SH OPTIONS -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for set - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - use a particular kubeconfig file - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH SEE ALSO -.PP -\fBkubectl\-config(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-config-unset.1 b/release-0.19.0/docs/man/man1/kubectl-config-unset.1 deleted file mode 100644 index cea12d2e81a..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-config-unset.1 +++ /dev/null @@ -1,131 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl config unset \- Unsets an individual value in a kubeconfig file - - -.SH SYNOPSIS -.PP -\fBkubectl config unset\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Unsets an individual value in a kubeconfig file -PROPERTY\_NAME is a dot delimited name where each token represents either a attribute name or a map key. Map keys may not contain dots. - - -.SH OPTIONS -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for unset - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - use a particular kubeconfig file - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH SEE ALSO -.PP -\fBkubectl\-config(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-config-use-context.1 b/release-0.19.0/docs/man/man1/kubectl-config-use-context.1 deleted file mode 100644 index 4ae194bd2a6..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-config-use-context.1 +++ /dev/null @@ -1,130 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl config use\-context \- Sets the current\-context in a kubeconfig file - - -.SH SYNOPSIS -.PP -\fBkubectl config use\-context\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Sets the current\-context in a kubeconfig file - - -.SH OPTIONS -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for use\-context - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - use a particular kubeconfig file - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH SEE ALSO -.PP -\fBkubectl\-config(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-config-view.1 b/release-0.19.0/docs/man/man1/kubectl-config-view.1 deleted file mode 100644 index c4e237d5818..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-config-view.1 +++ /dev/null @@ -1,181 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl config view \- displays Merged kubeconfig settings or a specified kubeconfig file. - - -.SH SYNOPSIS -.PP -\fBkubectl config view\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -displays Merged kubeconfig settings or a specified kubeconfig file. - -.PP -You can use \-\-output=template \-\-template=TEMPLATE to extract specific values. - - -.SH OPTIONS -.PP -\fB\-\-flatten\fP=false - flatten the resulting kubeconfig file into self contained output (useful for creating portable kubeconfig files) - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for view - -.PP -\fB\-\-merge\fP=true - merge together the full hierarchy of kubeconfig files - -.PP -\fB\-\-minify\fP=false - remove all information not used by current\-context from the output - -.PP -\fB\-\-no\-headers\fP=false - When using the default output, don't print headers. - -.PP -\fB\-o\fP, \fB\-\-output\fP="" - Output format. One of: json|yaml|template|templatefile. - -.PP -\fB\-\-output\-version\fP="" - Output the formatted object with the given version (default api\-version). - -.PP -\fB\-\-raw\fP=false - display raw byte data - -.PP -\fB\-t\fP, \fB\-\-template\fP="" - Template string or path to template file to use when \-o=template or \-o=templatefile. The template format is golang templates [ -\[la]http://golang.org/pkg/text/template/#pkg-overview\[ra]] - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - use a particular kubeconfig file - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Show Merged kubeconfig settings. -$ kubectl config view - -// Get the password for the e2e user -$ kubectl config view \-o template \-\-template='\{\{range .users\}\}\{\{ if eq .name "e2e" \}\}\{\{ index .user.password \}\}\{\{end\}\}\{\{end\}\}' - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl\-config(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-config.1 b/release-0.19.0/docs/man/man1/kubectl-config.1 deleted file mode 100644 index 66eb5e8a1a2..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-config.1 +++ /dev/null @@ -1,136 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl config \- config modifies kubeconfig files - - -.SH SYNOPSIS -.PP -\fBkubectl config\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -config modifies kubeconfig files using subcommands like "kubectl config set current\-context my\-context" - -.PP -The loading order follows these rules: - 1. If the \-\-kubeconfig flag is set, then only that file is loaded. The flag may only be set once and no merging takes place. - 2. If $KUBECONFIG environment variable is set, then it is used a list of paths (normal path delimitting rules for your system). These paths are merged together. When a value is modified, it is modified in the file that defines the stanza. When a value is created, it is created in the first file that exists. If no files in the chain exist, then it creates the last file in the list. - 3. Otherwise, $\{HOME\}/.kube/config is used and no merging takes place. - - -.SH OPTIONS -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for config - -.PP -\fB\-\-kubeconfig\fP="" - use a particular kubeconfig file - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, \fBkubectl\-config\-view(1)\fP, \fBkubectl\-config\-set\-cluster(1)\fP, \fBkubectl\-config\-set\-credentials(1)\fP, \fBkubectl\-config\-set\-context(1)\fP, \fBkubectl\-config\-set(1)\fP, \fBkubectl\-config\-unset(1)\fP, \fBkubectl\-config\-use\-context(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-create.1 b/release-0.19.0/docs/man/man1/kubectl-create.1 deleted file mode 100644 index b0c511d36d1..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-create.1 +++ /dev/null @@ -1,152 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl create \- Create a resource by filename or stdin - - -.SH SYNOPSIS -.PP -\fBkubectl create\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Create a resource by filename or stdin. - -.PP -JSON and YAML formats are accepted. - - -.SH OPTIONS -.PP -\fB\-f\fP, \fB\-\-filename\fP=[] - Filename, directory, or URL to file to use to create the resource - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for create - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Create a pod using the data in pod.json. -$ kubectl create \-f pod.json - -// Create a pod based on the JSON passed into stdin. -$ cat pod.json | kubectl create \-f \- - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-delete.1 b/release-0.19.0/docs/man/man1/kubectl-delete.1 deleted file mode 100644 index c1c74f614fd..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-delete.1 +++ /dev/null @@ -1,194 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl delete \- Delete a resource by filename, stdin, resource and ID, or by resources and label selector. - - -.SH SYNOPSIS -.PP -\fBkubectl delete\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Delete a resource by filename, stdin, resource and ID, or by resources and label selector. - -.PP -JSON and YAML formats are accepted. - -.PP -If both a filename and command line arguments are passed, the command line -arguments are used and the filename is ignored. - -.PP -Note that the delete command does NOT do resource version checks, so if someone -submits an update to a resource right when you submit a delete, their update -will be lost along with the rest of the resource. - - -.SH OPTIONS -.PP -\fB\-\-all\fP=false - [\-all] to select all the specified resources. - -.PP -\fB\-\-cascade\fP=true - If true, cascade the delete resources managed by this resource (e.g. Pods created by a ReplicationController). Default true. - -.PP -\fB\-f\fP, \fB\-\-filename\fP=[] - Filename, directory, or URL to a file containing the resource to delete. - -.PP -\fB\-\-grace\-period\fP=\-1 - Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for delete - -.PP -\fB\-\-ignore\-not\-found\fP=false - Treat "resource not found" as a successful delete. - -.PP -\fB\-l\fP, \fB\-\-selector\fP="" - Selector (label query) to filter on. - -.PP -\fB\-\-timeout\fP=0 - The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Delete a pod using the type and ID specified in pod.json. -$ kubectl delete \-f pod.json - -// Delete a pod based on the type and ID in the JSON passed into stdin. -$ cat pod.json | kubectl delete \-f \- - -// Delete pods and services with label name=myLabel. -$ kubectl delete pods,services \-l name=myLabel - -// Delete a pod with ID 1234\-56\-7890\-234234\-456456. -$ kubectl delete pod 1234\-56\-7890\-234234\-456456 - -// Delete all pods -$ kubectl delete pods \-\-all - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-describe.1 b/release-0.19.0/docs/man/man1/kubectl-describe.1 deleted file mode 100644 index f8856055a3f..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-describe.1 +++ /dev/null @@ -1,149 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl describe \- Show details of a specific resource - - -.SH SYNOPSIS -.PP -\fBkubectl describe\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Show details of a specific resource. - -.PP -This command joins many API calls together to form a detailed description of a -given resource. - - -.SH OPTIONS -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for describe - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Describe a node -$ kubectl describe nodes kubernetes\-minion\-emt8.c.myproject.internal - -// Describe a pod -$ kubectl describe pods/nginx - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-exec.1 b/release-0.19.0/docs/man/man1/kubectl-exec.1 deleted file mode 100644 index c06547c8181..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-exec.1 +++ /dev/null @@ -1,164 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl exec \- Execute a command in a container. - - -.SH SYNOPSIS -.PP -\fBkubectl exec\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Execute a command in a container. - - -.SH OPTIONS -.PP -\fB\-c\fP, \fB\-\-container\fP="" - Container name - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for exec - -.PP -\fB\-p\fP, \fB\-\-pod\fP="" - Pod name - -.PP -\fB\-i\fP, \fB\-\-stdin\fP=false - Pass stdin to the container - -.PP -\fB\-t\fP, \fB\-\-tty\fP=false - Stdin is a TTY - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// get output from running 'date' from pod 123456\-7890, using the first container by default -$ kubectl exec 123456\-7890 date - -// get output from running 'date' in ruby\-container from pod 123456\-7890 -$ kubectl exec 123456\-7890 \-c ruby\-container date - -//switch to raw terminal mode, sends stdin to 'bash' in ruby\-container from pod 123456\-780 and sends stdout/stderr from 'bash' back to the client -$ kubectl exec 123456\-7890 \-c ruby\-container \-i \-t \-\- bash \-il - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-expose.1 b/release-0.19.0/docs/man/man1/kubectl-expose.1 deleted file mode 100644 index 55aaec9d511..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-expose.1 +++ /dev/null @@ -1,222 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl expose \- Take a replicated application and expose it as Kubernetes Service - - -.SH SYNOPSIS -.PP -\fBkubectl expose\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Take a replicated application and expose it as Kubernetes Service. - -.PP -Looks up a replication controller or service by name and uses the selector for that resource as the -selector for a new Service on the specified port. If no labels are specified, the new service will -re\-use the labels from the resource it exposes. - - -.SH OPTIONS -.PP -\fB\-\-container\-port\fP="" - Synonym for \-\-target\-port - -.PP -\fB\-\-create\-external\-load\-balancer\fP=false - If true, create an external load balancer for this service (trumped by \-\-type). Implementation is cloud provider dependent. Default is 'false'. - -.PP -\fB\-\-dry\-run\fP=false - If true, only print the object that would be sent, without creating it. - -.PP -\fB\-\-generator\fP="service/v1" - The name of the API generator to use. Default is 'service/v1'. - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for expose - -.PP -\fB\-l\fP, \fB\-\-labels\fP="" - Labels to apply to the service created by this call. - -.PP -\fB\-\-name\fP="" - The name for the newly created object. - -.PP -\fB\-\-no\-headers\fP=false - When using the default output, don't print headers. - -.PP -\fB\-o\fP, \fB\-\-output\fP="" - Output format. One of: json|yaml|template|templatefile. - -.PP -\fB\-\-output\-version\fP="" - Output the formatted object with the given version (default api\-version). - -.PP -\fB\-\-overrides\fP="" - An inline JSON override for the generated object. If this is non\-empty, it is used to override the generated object. Requires that the object supply a valid apiVersion field. - -.PP -\fB\-\-port\fP=\-1 - The port that the service should serve on. Required. - -.PP -\fB\-\-protocol\fP="TCP" - The network protocol for the service to be created. Default is 'tcp'. - -.PP -\fB\-\-public\-ip\fP="" - Name of a public IP address to set for the service. The service will be assigned this IP in addition to its generated service IP. - -.PP -\fB\-\-selector\fP="" - A label selector to use for this service. If empty (the default) infer the selector from the replication controller. - -.PP -\fB\-\-target\-port\fP="" - Name or number for the port on the container that the service should direct traffic to. Optional. - -.PP -\fB\-t\fP, \fB\-\-template\fP="" - Template string or path to template file to use when \-o=template or \-o=templatefile. The template format is golang templates [ -\[la]http://golang.org/pkg/text/template/#pkg-overview\[ra]] - -.PP -\fB\-\-type\fP="" - Type for this service: ClusterIP, NodePort, or LoadBalancer. Default is 'ClusterIP' unless \-\-create\-external\-load\-balancer is specified. - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Creates a service for a replicated nginx, which serves on port 80 and connects to the containers on port 8000. -$ kubectl expose rc nginx \-\-port=80 \-\-target\-port=8000 - -// Creates a second service based on the above service, exposing the container port 8443 as port 443 with the name "nginx\-https" -$ kubectl expose service nginx \-\-port=443 \-\-target\-port=8443 \-\-name=nginx\-https - -// Create a service for a replicated streaming application on port 4100 balancing UDP traffic and named 'video\-stream'. -$ kubectl expose rc streamer \-\-port=4100 \-\-protocol=udp \-\-name=video\-stream - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-get.1 b/release-0.19.0/docs/man/man1/kubectl-get.1 deleted file mode 100644 index e71f884a218..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-get.1 +++ /dev/null @@ -1,200 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl get \- Display one or many resources - - -.SH SYNOPSIS -.PP -\fBkubectl get\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Display one or many resources. - -.PP -Possible resources include pods (po), replication controllers (rc), services -(svc), nodes, events (ev), component statuses (cs), limit ranges (limits), -nodes (no), persistent volumes (pv), persistent volume claims (pvc) -or resource quotas (quota). - -.PP -By specifying the output as 'template' and providing a Go template as the value -of the \-\-template flag, you can filter the attributes of the fetched resource(s). - - -.SH OPTIONS -.PP -\fB\-\-all\-namespaces\fP=false - If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with \-\-namespace. - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for get - -.PP -\fB\-\-no\-headers\fP=false - When using the default output, don't print headers. - -.PP -\fB\-o\fP, \fB\-\-output\fP="" - Output format. One of: json|yaml|template|templatefile. - -.PP -\fB\-\-output\-version\fP="" - Output the formatted object with the given version (default api\-version). - -.PP -\fB\-l\fP, \fB\-\-selector\fP="" - Selector (label query) to filter on - -.PP -\fB\-t\fP, \fB\-\-template\fP="" - Template string or path to template file to use when \-o=template or \-o=templatefile. The template format is golang templates [ -\[la]http://golang.org/pkg/text/template/#pkg-overview\[ra]] - -.PP -\fB\-w\fP, \fB\-\-watch\fP=false - After listing/getting the requested object, watch for changes. - -.PP -\fB\-\-watch\-only\fP=false - Watch for changes to the requested object(s), without listing/getting first. - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// List all pods in ps output format. -$ kubectl get pods - -// List a single replication controller with specified NAME in ps output format. -$ kubectl get replicationcontroller web - -// List a single pod in JSON output format. -$ kubectl get \-o json pod web\-pod\-13je7 - -// Return only the phase value of the specified pod. -$ kubectl get \-o template web\-pod\-13je7 \-\-template=\{\{.status.phase\}\} \-\-api\-version=v1 - -// List all replication controllers and services together in ps output format. -$ kubectl get rc,services - -// List one or more resources by their type and names -$ kubectl get rc/web service/frontend pods/web\-pod\-13je7 - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-label.1 b/release-0.19.0/docs/man/man1/kubectl-label.1 deleted file mode 100644 index 9fddbcd4a07..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-label.1 +++ /dev/null @@ -1,193 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl label \- Update the labels on a resource - - -.SH SYNOPSIS -.PP -\fBkubectl label\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Update the labels on a resource. - -.PP -A label must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to 63 characters. -If \-\-overwrite is true, then existing labels can be overwritten, otherwise attempting to overwrite a label will result in an error. -If \-\-resource\-version is specified, then updates will use this resource version, otherwise the existing resource\-version will be used. - - -.SH OPTIONS -.PP -\fB\-\-all\fP=false - select all resources in the namespace of the specified resource types - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for label - -.PP -\fB\-\-no\-headers\fP=false - When using the default output, don't print headers. - -.PP -\fB\-o\fP, \fB\-\-output\fP="" - Output format. One of: json|yaml|template|templatefile. - -.PP -\fB\-\-output\-version\fP="" - Output the formatted object with the given version (default api\-version). - -.PP -\fB\-\-overwrite\fP=false - If true, allow labels to be overwritten, otherwise reject label updates that overwrite existing labels. - -.PP -\fB\-\-resource\-version\fP="" - If non\-empty, the labels update will only succeed if this is the current resource\-version for the object. Only valid when specifying a single resource. - -.PP -\fB\-l\fP, \fB\-\-selector\fP="" - Selector (label query) to filter on - -.PP -\fB\-t\fP, \fB\-\-template\fP="" - Template string or path to template file to use when \-o=template or \-o=templatefile. The template format is golang templates [ -\[la]http://golang.org/pkg/text/template/#pkg-overview\[ra]] - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Update pod 'foo' with the label 'unhealthy' and the value 'true'. -$ kubectl label pods foo unhealthy=true - -// Update pod 'foo' with the label 'status' and the value 'unhealthy', overwriting any existing value. -$ kubectl label \-\-overwrite pods foo status=unhealthy - -// Update all pods in the namespace -$ kubectl label pods \-\-all status=unhealthy - -// Update pod 'foo' only if the resource is unchanged from version 1. -$ kubectl label pods foo status=unhealthy \-\-resource\-version=1 - -// Update pod 'foo' by removing a label named 'bar' if it exists. -// Does not require the \-\-overwrite flag. -$ kubectl label pods foo bar\- - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-logs.1 b/release-0.19.0/docs/man/man1/kubectl-logs.1 deleted file mode 100644 index 148efd87678..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-logs.1 +++ /dev/null @@ -1,160 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl logs \- Print the logs for a container in a pod. - - -.SH SYNOPSIS -.PP -\fBkubectl logs\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Print the logs for a container in a pod. If the pod has only one container, the container name is optional. - - -.SH OPTIONS -.PP -\fB\-f\fP, \fB\-\-follow\fP=false - Specify if the logs should be streamed. - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for logs - -.PP -\fB\-\-interactive\fP=true - If true, prompt the user for input when required. Default true. - -.PP -\fB\-p\fP, \fB\-\-previous\fP=false - If true, print the logs for the previous instance of the container in a pod if it exists. - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Returns snapshot of ruby\-container logs from pod 123456\-7890. -$ kubectl logs 123456\-7890 ruby\-container - -// Returns snapshot of previous terminated ruby\-container logs from pod 123456\-7890. -$ kubectl logs \-p 123456\-7890 ruby\-container - -// Starts streaming of ruby\-container logs from pod 123456\-7890. -$ kubectl logs \-f 123456\-7890 ruby\-container - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-namespace.1 b/release-0.19.0/docs/man/man1/kubectl-namespace.1 deleted file mode 100644 index 94b04c52a9e..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-namespace.1 +++ /dev/null @@ -1,133 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl namespace \- SUPERCEDED: Set and view the current Kubernetes namespace - - -.SH SYNOPSIS -.PP -\fBkubectl namespace\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -SUPERCEDED: Set and view the current Kubernetes namespace scope for command line requests. - -.PP -namespace has been superceded by the context.namespace field of .kubeconfig files. See 'kubectl config set\-context \-\-help' for more details. - - -.SH OPTIONS -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for namespace - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-port-forward.1 b/release-0.19.0/docs/man/man1/kubectl-port-forward.1 deleted file mode 100644 index 6d52308dd3e..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-port-forward.1 +++ /dev/null @@ -1,156 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl port\-forward \- Forward one or more local ports to a pod. - - -.SH SYNOPSIS -.PP -\fBkubectl port\-forward\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Forward one or more local ports to a pod. - - -.SH OPTIONS -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for port\-forward - -.PP -\fB\-p\fP, \fB\-\-pod\fP="" - Pod name - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf - -// listens on ports 5000 and 6000 locally, forwarding data to/from ports 5000 and 6000 in the pod -$ kubectl port\-forward \-p mypod 5000 6000 - -// listens on port 8888 locally, forwarding to 5000 in the pod -$ kubectl port\-forward \-p mypod 8888:5000 - -// listens on a random port locally, forwarding to 5000 in the pod -$ kubectl port\-forward \-p mypod :5000 - -// listens on a random port locally, forwarding to 5000 in the pod -$ kubectl port\-forward \-p mypod 0:5000 - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-proxy.1 b/release-0.19.0/docs/man/man1/kubectl-proxy.1 deleted file mode 100644 index 49256350367..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-proxy.1 +++ /dev/null @@ -1,183 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl proxy \- Run a proxy to the Kubernetes API server - - -.SH SYNOPSIS -.PP -\fBkubectl proxy\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -To proxy all of the kubernetes api and nothing else, use: - -.PP -kubectl proxy \-\-api\-prefix=/ - -.PP -To proxy only part of the kubernetes api and also some static files: - -.PP -kubectl proxy \-\-www=/my/files \-\-www\-prefix=/static/ \-\-api\-prefix=/api/ - -.PP -The above lets you 'curl localhost:8001/api/v1/pods'. - -.PP -To proxy the entire kubernetes api at a different root, use: - -.PP -kubectl proxy \-\-api\-prefix=/custom/ - -.PP -The above lets you 'curl localhost:8001/custom/api/v1/pods' - - -.SH OPTIONS -.PP -\fB\-\-api\-prefix\fP="/api/" - Prefix to serve the proxied API under. - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for proxy - -.PP -\fB\-p\fP, \fB\-\-port\fP=8001 - The port on which to run the proxy. - -.PP -\fB\-w\fP, \fB\-\-www\fP="" - Also serve static files from the given directory under the specified prefix. - -.PP -\fB\-P\fP, \fB\-\-www\-prefix\fP="/static/" - Prefix to serve static files under, if static file directory is specified. - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Run a proxy to kubernetes apiserver on port 8011, serving static content from ./local/www/ -$ kubectl proxy \-\-port=8011 \-\-www=./local/www/ - -// Run a proxy to kubernetes apiserver, changing the api prefix to k8s\-api -// This makes e.g. the pods api available at localhost:8011/k8s\-api/v1/pods/ -$ kubectl proxy \-\-api\-prefix=/k8s\-api - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-rolling-update.1 b/release-0.19.0/docs/man/man1/kubectl-rolling-update.1 deleted file mode 100644 index 6483932c16e..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-rolling-update.1 +++ /dev/null @@ -1,207 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl rolling\-update \- Perform a rolling update of the given ReplicationController. - - -.SH SYNOPSIS -.PP -\fBkubectl rolling\-update\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Perform a rolling update of the given ReplicationController. - -.PP -Replaces the specified controller with new controller, updating one pod at a time to use the -new PodTemplate. The new\-controller.json must specify the same namespace as the -existing controller and overwrite at least one (common) label in its replicaSelector. - - -.SH OPTIONS -.PP -\fB\-\-deployment\-label\-key\fP="deployment" - The key to use to differentiate between two different controllers, default 'deployment'. Only relevant when \-\-image is specified, ignored otherwise - -.PP -\fB\-\-dry\-run\fP=false - If true, print out the changes that would be made, but don't actually make them. - -.PP -\fB\-f\fP, \fB\-\-filename\fP="" - Filename or URL to file to use to create the new controller. - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for rolling\-update - -.PP -\fB\-\-image\fP="" - Image to upgrade the controller to. Can not be used with \-\-filename/\-f - -.PP -\fB\-\-no\-headers\fP=false - When using the default output, don't print headers. - -.PP -\fB\-o\fP, \fB\-\-output\fP="" - Output format. One of: json|yaml|template|templatefile. - -.PP -\fB\-\-output\-version\fP="" - Output the formatted object with the given version (default api\-version). - -.PP -\fB\-\-poll\-interval\fP="3s" - Time delay between polling controller status after update. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". - -.PP -\fB\-\-rollback\fP=false - If true, this is a request to abort an existing rollout that is partially rolled out. It effectively reverses current and next and runs a rollout - -.PP -\fB\-t\fP, \fB\-\-template\fP="" - Template string or path to template file to use when \-o=template or \-o=templatefile. The template format is golang templates [ -\[la]http://golang.org/pkg/text/template/#pkg-overview\[ra]] - -.PP -\fB\-\-timeout\fP="5m0s" - Max time to wait for a controller to update before giving up. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". - -.PP -\fB\-\-update\-period\fP="1m0s" - Time to wait between updating pods. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Update pods of frontend\-v1 using new controller data in frontend\-v2.json. -$ kubectl rolling\-update frontend\-v1 \-f frontend\-v2.json - -// Update pods of frontend\-v1 using JSON data passed into stdin. -$ cat frontend\-v2.json | kubectl rolling\-update frontend\-v1 \-f \- - -// Update the pods of frontend\-v1 to frontend\-v2 by just changing the image, and switching the -// name of the replication controller. -$ kubectl rolling\-update frontend\-v1 frontend\-v2 \-\-image=image:v2 - -// Update the pods of frontend by just changing the image, and keeping the old name -$ kubectl rolling\-update frontend \-\-image=image:v2 - - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-run.1 b/release-0.19.0/docs/man/man1/kubectl-run.1 deleted file mode 100644 index 10244c69d65..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-run.1 +++ /dev/null @@ -1,201 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl run \- Run a particular image on the cluster. - - -.SH SYNOPSIS -.PP -\fBkubectl run\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Create and run a particular image, possibly replicated. -Creates a replication controller to manage the created container(s). - - -.SH OPTIONS -.PP -\fB\-\-dry\-run\fP=false - If true, only print the object that would be sent, without sending it. - -.PP -\fB\-\-generator\fP="run/v1" - The name of the API generator to use. Default is 'run\-controller/v1'. - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for run - -.PP -\fB\-\-hostport\fP=\-1 - The host port mapping for the container port. To demonstrate a single\-machine container. - -.PP -\fB\-\-image\fP="" - The image for the container to run. - -.PP -\fB\-l\fP, \fB\-\-labels\fP="" - Labels to apply to the pod(s). - -.PP -\fB\-\-no\-headers\fP=false - When using the default output, don't print headers. - -.PP -\fB\-o\fP, \fB\-\-output\fP="" - Output format. One of: json|yaml|template|templatefile. - -.PP -\fB\-\-output\-version\fP="" - Output the formatted object with the given version (default api\-version). - -.PP -\fB\-\-overrides\fP="" - An inline JSON override for the generated object. If this is non\-empty, it is used to override the generated object. Requires that the object supply a valid apiVersion field. - -.PP -\fB\-\-port\fP=\-1 - The port that this container exposes. - -.PP -\fB\-r\fP, \fB\-\-replicas\fP=1 - Number of replicas to create for this container. Default is 1. - -.PP -\fB\-t\fP, \fB\-\-template\fP="" - Template string or path to template file to use when \-o=template or \-o=templatefile. The template format is golang templates [ -\[la]http://golang.org/pkg/text/template/#pkg-overview\[ra]] - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Starts a single instance of nginx. -$ kubectl run nginx \-\-image=nginx - -// Starts a replicated instance of nginx. -$ kubectl run nginx \-\-image=nginx \-\-replicas=5 - -// Dry run. Print the corresponding API objects without creating them. -$ kubectl run nginx \-\-image=nginx \-\-dry\-run - -// Start a single instance of nginx, but overload the spec of the replication controller with a partial set of values parsed from JSON. -$ kubectl run nginx \-\-image=nginx \-\-overrides='\{ "apiVersion": "v1", "spec": \{ ... \} \}' - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-scale.1 b/release-0.19.0/docs/man/man1/kubectl-scale.1 deleted file mode 100644 index aa3cef1b1a0..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-scale.1 +++ /dev/null @@ -1,163 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl scale \- Set a new size for a Replication Controller. - - -.SH SYNOPSIS -.PP -\fBkubectl scale\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Set a new size for a Replication Controller. - -.PP -Scale also allows users to specify one or more preconditions for the scale action. -If \-\-current\-replicas or \-\-resource\-version is specified, it is validated before the -scale is attempted, and it is guaranteed that the precondition holds true when the -scale is sent to the server. - - -.SH OPTIONS -.PP -\fB\-\-current\-replicas\fP=\-1 - Precondition for current size. Requires that the current size of the replication controller match this value in order to scale. - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for scale - -.PP -\fB\-\-replicas\fP=\-1 - The new desired number of replicas. Required. - -.PP -\fB\-\-resource\-version\fP="" - Precondition for resource version. Requires that the current resource version match this value in order to scale. - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Scale replication controller named 'foo' to 3. -$ kubectl scale \-\-replicas=3 replicationcontrollers foo - -// If the replication controller named foo's current size is 2, scale foo to 3. -$ kubectl scale \-\-current\-replicas=2 \-\-replicas=3 replicationcontrollers foo - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-stop.1 b/release-0.19.0/docs/man/man1/kubectl-stop.1 deleted file mode 100644 index a00bcce9382..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-stop.1 +++ /dev/null @@ -1,179 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl stop \- Gracefully shut down a resource by id or filename. - - -.SH SYNOPSIS -.PP -\fBkubectl stop\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Gracefully shut down a resource by id or filename. - -.PP -Attempts to shut down and delete a resource that supports graceful termination. -If the resource is scalable it will be scaled to 0 before deletion. - - -.SH OPTIONS -.PP -\fB\-\-all\fP=false - [\-all] to select all the specified resources. - -.PP -\fB\-f\fP, \fB\-\-filename\fP=[] - Filename, directory, or URL to file of resource(s) to be stopped. - -.PP -\fB\-\-grace\-period\fP=\-1 - Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for stop - -.PP -\fB\-\-ignore\-not\-found\fP=false - Treat "resource not found" as a successful stop. - -.PP -\fB\-l\fP, \fB\-\-selector\fP="" - Selector (label query) to filter on. - -.PP -\fB\-\-timeout\fP=0 - The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Shut down foo. -$ kubectl stop replicationcontroller foo - -// Stop pods and services with label name=myLabel. -$ kubectl stop pods,services \-l name=myLabel - -// Shut down the service defined in service.json -$ kubectl stop \-f service.json - -// Shut down all resources in the path/to/resources directory -$ kubectl stop \-f path/to/resources - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-update.1 b/release-0.19.0/docs/man/man1/kubectl-update.1 deleted file mode 100644 index 3441a6e09e8..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-update.1 +++ /dev/null @@ -1,152 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl update \- Update a resource by filename or stdin. - - -.SH SYNOPSIS -.PP -\fBkubectl update\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Update a resource by filename or stdin. - -.PP -JSON and YAML formats are accepted. - - -.SH OPTIONS -.PP -\fB\-f\fP, \fB\-\-filename\fP=[] - Filename, directory, or URL to file to use to update the resource. - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for update - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH EXAMPLE -.PP -.RS - -.nf -// Update a pod using the data in pod.json. -$ kubectl update \-f pod.json - -// Update a pod based on the JSON passed into stdin. -$ cat pod.json | kubectl update \-f \- - -.fi -.RE - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl-version.1 b/release-0.19.0/docs/man/man1/kubectl-version.1 deleted file mode 100644 index d91fca6c10f..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl-version.1 +++ /dev/null @@ -1,134 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl version \- Print the client and server version information. - - -.SH SYNOPSIS -.PP -\fBkubectl version\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -Print the client and server version information. - - -.SH OPTIONS -.PP -\fB\-c\fP, \fB\-\-client\fP=false - Client version only (no server required). - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for version - - -.SH OPTIONS INHERITED FROM PARENT COMMANDS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH SEE ALSO -.PP -\fBkubectl(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubectl.1 b/release-0.19.0/docs/man/man1/kubectl.1 deleted file mode 100644 index 5b92e11e358..00000000000 --- a/release-0.19.0/docs/man/man1/kubectl.1 +++ /dev/null @@ -1,132 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Eric Paris" "Jan 2015" "" - - -.SH NAME -.PP -kubectl \- kubectl controls the Kubernetes cluster manager - - -.SH SYNOPSIS -.PP -\fBkubectl\fP [OPTIONS] - - -.SH DESCRIPTION -.PP -kubectl controls the Kubernetes cluster manager. - -.PP -Find more information at -\[la]https://github.com/GoogleCloudPlatform/kubernetes\[ra]. - - -.SH OPTIONS -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-version\fP="" - The API version to use when talking to the server - -.PP -\fB\-\-certificate\-authority\fP="" - Path to a cert. file for the certificate authority. - -.PP -\fB\-\-client\-certificate\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-client\-key\fP="" - Path to a client key file for TLS. - -.PP -\fB\-\-cluster\fP="" - The name of the kubeconfig cluster to use - -.PP -\fB\-\-context\fP="" - The name of the kubeconfig context to use - -.PP -\fB\-h\fP, \fB\-\-help\fP=false - help for kubectl - -.PP -\fB\-\-insecure\-skip\-tls\-verify\fP=false - If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure. - -.PP -\fB\-\-kubeconfig\fP="" - Path to the kubeconfig file to use for CLI requests. - -.PP -\fB\-\-log\-backtrace\-at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\-dir\fP="" - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\-flush\-frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-match\-server\-version\fP=false - Require server version to match client version - -.PP -\fB\-\-namespace\fP="" - If present, the namespace scope for this CLI request. - -.PP -\fB\-\-password\fP="" - Password for basic authentication to the API server. - -.PP -\fB\-s\fP, \fB\-\-server\fP="" - The address and port of the Kubernetes API server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-token\fP="" - Bearer token for authentication to the API server. - -.PP -\fB\-\-user\fP="" - The name of the kubeconfig user to use - -.PP -\fB\-\-username\fP="" - Username for basic authentication to the API server. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-validate\fP=false - If true, use a schema to validate the input before sending it - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - - -.SH SEE ALSO -.PP -\fBkubectl\-get(1)\fP, \fBkubectl\-describe(1)\fP, \fBkubectl\-create(1)\fP, \fBkubectl\-update(1)\fP, \fBkubectl\-delete(1)\fP, \fBkubectl\-namespace(1)\fP, \fBkubectl\-logs(1)\fP, \fBkubectl\-rolling\-update(1)\fP, \fBkubectl\-scale(1)\fP, \fBkubectl\-exec(1)\fP, \fBkubectl\-port\-forward(1)\fP, \fBkubectl\-proxy(1)\fP, \fBkubectl\-run(1)\fP, \fBkubectl\-stop(1)\fP, \fBkubectl\-expose(1)\fP, \fBkubectl\-label(1)\fP, \fBkubectl\-config(1)\fP, \fBkubectl\-cluster\-info(1)\fP, \fBkubectl\-api\-versions(1)\fP, \fBkubectl\-version(1)\fP, - - -.SH HISTORY -.PP -January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! diff --git a/release-0.19.0/docs/man/man1/kubelet.1 b/release-0.19.0/docs/man/man1/kubelet.1 deleted file mode 100644 index 3215e20ace5..00000000000 --- a/release-0.19.0/docs/man/man1/kubelet.1 +++ /dev/null @@ -1,339 +0,0 @@ -.TH "KUBERNETES" "1" " kubernetes User Manuals" "Scott Collier" "October 2014" "" - -.SH NAME -.PP -kubelet \- Processes a container manifest so the containers are launched according to how they are described. - -.SH SYNOPSIS -.PP -\fBkubelet\fP [OPTIONS] - -.SH DESCRIPTION -.PP -The \fBkubernetes\fP kubelet runs on each node. The Kubelet works in terms of a container manifest. A container manifest is a YAML or JSON file that describes a pod. The Kubelet takes a set of manifests that are provided in various mechanisms and ensures that the containers described in those manifests are started and continue running. - -.PP -There are 3 ways that a container manifest can be provided to the Kubelet: - -.PP -.RS - -.nf -File: Path passed as a flag on the command line. This file is rechecked every 20 seconds (configurable with a flag). -HTTP endpoint: HTTP endpoint passed as a parameter on the command line. This endpoint is checked every 20 seconds (also configurable with a flag). -HTTP server: The kubelet can also listen for HTTP and respond to a simple API (underspec'd currently) to submit a new manifest. - -.fi - -.SH OPTIONS -.PP -\fB\-\-address\fP=0.0.0.0 - The IP address for the info server to serve on (set to 0.0.0.0 for all interfaces) - -.PP -\fB\-\-allow\_dynamic\_housekeeping\fP=true - Whether to allow the housekeeping interval to be dynamic - -.PP -\fB\-\-allow\-privileged\fP=false - If true, allow containers to request privileged mode. [default=false] - -.PP -\fB\-\-alsologtostderr\fP=false - log to standard error as well as files - -.PP -\fB\-\-api\-servers\fP=[] - List of Kubernetes API servers for publishing events, and reading pods and services. (ip:port), comma separated. - -.PP -\fB\-\-boot\_id\_file\fP=/proc/sys/kernel/random/boot\_id - Comma\-separated list of files to check for boot\-id. Use the first one that exists. - -.PP -\fB\-\-cadvisor\-port\fP=4194 - The port of the localhost cAdvisor endpoint - -.PP -\fB\-\-cert\-dir\fP="/var/run/kubernetes" - The directory where the TLS certs are located (by default /var/run/kubernetes). If \-\-tls\_cert\_file and \-\-tls\_private\_key\_file are provided, this flag will be ignored. - -.PP -\fB\-\-cgroup\_root\fP="" - Optional root cgroup to use for pods. This is handled by the container runtime on a best effort basis. Default: '', which means use the container runtime default. - -.PP -\fB\-\-cloud\-config\fP="" - The path to the cloud provider configuration file. Empty string for no configuration file. - -.PP -\fB\-\-cloud\-provider\fP="" - The provider for cloud services. Empty string for no provider. - -.PP -\fB\-\-cluster\-dns\fP= - IP address for a cluster DNS server. If set, kubelet will configure all containers to use this for DNS resolution in addition to the host's DNS servers - -.PP -\fB\-\-cluster\-domain\fP="" - Domain for this cluster. If set, kubelet will configure all containers to search this domain in addition to the host's search domains - -.PP -\fB\-\-config\fP="" - Path to the config file or directory of files - -.PP -\fB\-\-configure\-cbr0\fP=false - If true, kubelet will configure cbr0 based on Node.Spec.PodCIDR. - -.PP -\fB\-\-container\_hints\fP=/etc/cadvisor/container\_hints.json - location of the container hints file - -.PP -\fB\-\-container\_runtime\fP="docker" - The container runtime to use. Possible values: 'docker', 'rkt'. Default: 'docker'. - -.PP -\fB\-\-docker\fP=unix:///var/run/docker.sock - docker endpoint - -.PP -\fB\-\-docker\-daemon\-container\fP="/docker\-daemon" - Optional resource\-only container in which to place the Docker Daemon. Empty for no container (Default: /docker\-daemon). - -.PP -\fB\-\-docker\-endpoint\fP="" - If non\-empty, use this for the docker endpoint to communicate with - -.PP -\fB\-\-docker\_only\fP=false - Only report docker containers in addition to root stats - -.PP -\fB\-\-docker\_root\fP=/var/lib/docker - Absolute path to the Docker state root directory (default: /var/lib/docker) - -.PP -\fB\-\-docker\_run\fP=/var/run/docker - Absolute path to the Docker run directory (default: /var/run/docker) - -.PP -\fB\-\-enable\-debugging\-handlers\fP=true - Enables server endpoints for log collection and local running of containers and commands - -.PP -\fB\-\-enable\_load\_reader\fP=false - Whether to enable cpu load reader - -.PP -\fB\-\-enable\-server\fP=true - Enable the info server - -.PP -\fB\-\-event\_storage\_age\_limit\fP=default=24h - Max length of time for which to store events (per type). Value is a comma separated list of key values, where the keys are event types (e.g.: creation, oom) or "default" and the value is a duration. Default is applied to all non\-specified event types - -.PP -\fB\-\-event\_storage\_event\_limit\fP=default=100000 - Max number of events to store (per type). Value is a comma separated list of key values, where the keys are event types (e.g.: creation, oom) or "default" and the value is an integer. Default is applied to all non\-specified event types - -.PP -\fB\-\-file\-check\-frequency\fP=20s - Duration between checking config files for new data - -.PP -\fB\-\-global\_housekeeping\_interval\fP=1m0s - Interval between global housekeepings - -.PP -\fB\-\-google\-json\-key\fP="" - The Google Cloud Platform Service Account JSON Key to use for authentication. - -.PP -\fB\-\-healthz\-bind\-address\fP=127.0.0.1 - The IP address for the healthz server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces) - -.PP -\fB\-\-healthz\-port\fP=10248 - The port of the localhost healthz endpoint - -.PP -\fB\-\-host\-network\-sources\fP="file" - Comma\-separated list of sources from which the Kubelet allows pods to use of host network. For all sources use "*" [default="file"] - -.PP -\fB\-\-hostname\-override\fP="" - If non\-empty, will use this string as identification instead of the actual hostname. - -.PP -\fB\-\-housekeeping\_interval\fP=1s - Interval between container housekeepings - -.PP -\fB\-\-http\-check\-frequency\fP=20s - Duration between checking http for new data - -.PP -\fB\-\-image\-gc\-high\-threshold\fP=90 - The percent of disk usage after which image garbage collection is always run. Default: 90%% - -.PP -\fB\-\-image\-gc\-low\-threshold\fP=80 - The percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. Default: 80%% - -.PP -\fB\-\-kubeconfig\fP=/var/lib/kubelet/kubeconfig - Path to a kubeconfig file, specifying how to authenticate to API server (the master location is set by the api\-servers flag). - -.PP -\fB\-\-log\_backtrace\_at\fP=:0 - when logging hits line file:N, emit a stack trace - -.PP -\fB\-\-log\_cadvisor\_usage\fP=false - Whether to log the usage of the cAdvisor container - -.PP -\fB\-\-log\_dir\fP= - If non\-empty, write log files in this directory - -.PP -\fB\-\-log\_flush\_frequency\fP=5s - Maximum number of seconds between log flushes - -.PP -\fB\-\-logtostderr\fP=true - log to standard error instead of files - -.PP -\fB\-\-low\-diskspace\-threshold\-mb\fP=256 - The absolute free disk space, in MB, to maintain. When disk space falls below this threshold, new pods would be rejected. Default: 256 - -.PP -\fB\-\-machine\_id\_file\fP=/etc/machine\-id,/var/lib/dbus/machine\-id - Comma\-separated list of files to check for machine\-id. Use the first one that exists. - -.PP -\fB\-\-manifest\-url\fP="" - URL for accessing the container manifest - -.PP -\fB\-\-master\-service\-namespace\fP="default" - The namespace from which the kubernetes master services should be injected into pods - -.PP -\fB\-\-max\_housekeeping\_interval\fP=1m0s - Largest interval to allow between container housekeepings - -.PP -\fB\-\-max\_pods\fP=100 - Number of Pods that can run on this Kubelet. - -.PP -\fB\-\-maximum\-dead\-containers\fP=100 - Maximum number of old instances of a containers to retain globally. Each container takes up some disk space. Default: 100. - -.PP -\fB\-\-maximum\-dead\-containers\-per\-container\fP=5 - Maximum number of old instances of a container to retain per container. Each container takes up some disk space. Default: 5. - -.PP -\fB\-\-minimum\-container\-ttl\-duration\fP=1m0s - Minimum age for a finished container before it is garbage collected. Examples: '300ms', '10s' or '2h45m' - -.PP -\fB\-\-network\-plugin\fP="" - The name of the network plugin to be invoked for various events in kubelet/pod lifecycle - -.PP -\fB\-\-node\-status\-update\-frequency\fP=10s - Specifies how often kubelet posts node status to master. Note: be cautious when changing the constant, it must work with nodeMonitorGracePeriod in nodecontroller. Default: 10s - -.PP -\fB\-\-oom\-score\-adj\fP=\-900 - The oom\_score\_adj value for kubelet process. Values must be within the range [\-1000, 1000] - -.PP -\fB\-\-pod\-infra\-container\-image\fP="gcr.io/google\_containers/pause:0.8.0" - The image whose network/ipc namespaces containers in each pod will use. - -.PP -\fB\-\-port\fP=10250 - The port for the info server to serve on - -.PP -\fB\-\-read\-only\-port\fP=10255 - The read\-only port for the info server to serve on (set to 0 to disable) - -.PP -\fB\-\-registry\-burst\fP=10 - Maximum size of a bursty pulls, temporarily allows pulls to burst to this number, while still not exceeding registry\_qps. Only used if \-\-registry\_qps > 0 - -.PP -\fB\-\-registry\-qps\fP=0 - If > 0, limit registry pull QPS to this value. If 0, unlimited. [default=0.0] - -.PP -\fB\-\-resource\-container\fP="/kubelet" - Absolute name of the resource\-only container to create and run the Kubelet in (Default: /kubelet). - -.PP -\fB\-\-root\-dir\fP="/var/lib/kubelet" - Directory path for managing kubelet files (volume mounts,etc). - -.PP -\fB\-\-runonce\fP=false - If true, exit after spawning pods from local manifests or remote urls. Exclusive with \-\-api\_servers, and \-\-enable\-server - -.PP -\fB\-\-stderrthreshold\fP=2 - logs at or above this threshold go to stderr - -.PP -\fB\-\-streaming\-connection\-idle\-timeout\fP=0 - Maximum time a streaming connection can be idle before the connection is automatically closed. Example: '5m' - -.PP -\fB\-\-sync\-frequency\fP=10s - Max period between synchronizing running containers and config - -.PP -\fB\-\-tls\-cert\-file\fP="" - File /gmrvcontaining x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If \-\-tls\_cert\_file and \-\-tls\_private\_key\_file are not provided, a self\-signed certificate and key are generated for the public address and saved to the directory passed to \-\-cert\_dir. - -.PP -\fB\-\-tls\-private\-key\-file\fP="" - File containing x509 private key matching \-\-tls\_cert\_file. - -.PP -\fB\-\-v\fP=0 - log level for V logs - -.PP -\fB\-\-version\fP=false - Print version information and quit - -.PP -\fB\-\-vmodule\fP= - comma\-separated list of pattern=N settings for file\-filtered logging - -.SH EXAMPLES -.PP -.RS - -.nf -/usr/bin/kubelet \-\-logtostderr=true \-\-v=0 \-\-api\_servers=http://127.0.0.1:8080 \-\-address=127.0.0.1 \-\-port=10250 \-\-hostname\_override=127.0.0.1 \-\-allow\-privileged=false - -.fi - -.SH HISTORY -.PP -October 2014, Originally compiled by Scott Collier (scollier at redhat dot com) based - on the kubernetes source material and internal work. - -.PP -May 2015, Revised by Victor HU(huruifeng at huawei dot com) by kubernetes version 0.17 - -.PP -[]() diff --git a/release-0.19.0/docs/man/md2man-all.sh b/release-0.19.0/docs/man/md2man-all.sh deleted file mode 100755 index 5665b49d8f0..00000000000 --- a/release-0.19.0/docs/man/md2man-all.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/bash - -# Copyright 2014 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -set -e - -if [[ -z ${GO_MD2MAN} ]]; then - GO_MD2MAN="go-md2man" -fi - -# get into this script's directory -cd "$(dirname "$(readlink -f "$BASH_SOURCE")")" - -[ "$1" = '-q' ] || { - set -x - pwd -} - -for FILE in *.md; do - base="$(basename "$FILE")" - name="${base%.md}" - num="${name##*.}" - if [ -z "$num" -o "$name" = "$num" ]; then - # skip files that aren't of the format xxxx.N.md (like README.md) - continue - fi - mkdir -p "./man${num}" - ${GO_MD2MAN} -in "$FILE" -out "./man${num}/${name}" -done diff --git a/release-0.19.0/docs/namespaces.md b/release-0.19.0/docs/namespaces.md deleted file mode 100644 index 1807156c5af..00000000000 --- a/release-0.19.0/docs/namespaces.md +++ /dev/null @@ -1,13 +0,0 @@ -# Namespaces - -Namespaces help different projects, teams, or customers to share a kubernetes cluster. First, they provide a scope for [Names](identifiers.md). Second, as our access control code develops, it is expected that it will be convenient to attach authorization and other policy to namespaces. - -Use of multiple namespaces is optional. For small teams, they may not be needed. - -Namespaces are still under development. For now, the best documentation is the [Namespaces Design Document](design/namespaces.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/namespaces.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/namespaces.md?pixel)]() diff --git a/release-0.19.0/docs/networking.md b/release-0.19.0/docs/networking.md deleted file mode 100644 index 43dbab9f06c..00000000000 --- a/release-0.19.0/docs/networking.md +++ /dev/null @@ -1,183 +0,0 @@ -# Networking in Kubernetes - -## Summary - -Kubernetes approaches networking somewhat differently that Docker's defaults. -We give every pod its own IP address allocated from an internal network, so you -do not need to explicitly create links between communicating pods. To do this, -you must set up your cluster networking correctly. - -Since pods can fail and be replaced with new pods with different IP addresses -on different nodes, we do not recommend having a pod directly talk to the IP -address of another Pod. Instead, if a pod, or collection of pods, provide some -service, then you should create a `service` object spanning those pods, and -clients should connect to the IP of the service object. See -[services](services.md). - -## Docker model - -Before discussing the Kubernetes approach to networking, it is worthwhile to -review the "normal" way that networking works with Docker. By default, Docker -uses host-private networking. It creates a virtual bridge, called `docker0` by -default, and allocates a subnet from one of the private address blocks defined -in [RFC1918](https://tools.ietf.org/html/rfc1918) for that bridge. For each -container that Docker creates, it allocates a virtual ethernet device (called -`veth`) which is attached to the bridge. The veth is mapped to appear as eth0 -in the container, using Linux namespaces. The in-container eth0 interface is -given an IP address from the bridge's address range. - -The result is that Docker containers can talk to other containers only if they -are on the same machine (and thus the same virtual bridge). Containers on -different machines can not reach each other - in fact they may end up with the -exact same network ranges and IP addresses. - -In order for Docker containers to communicate across nodes, they must be -allocated ports on the machine's own IP address, which are then forwarded or -proxied to the containers. This obviously means that containers must either -coordinate which ports they use very carefully or else be allocated ports -dynamically. - -## Kubernetes model - -Coordinating ports across multiple developers is very difficult to do at -scale and exposes users to cluster-level issues outside of their control. -Dynamic port allocation brings a lot of complications to the system - every -application has to take ports as flags, the API servers have to know how to -insert dynamic port numbers into configuration blocks, services have to know -how to find each other, etc. Rather than deal with this, Kubernetes takes a -different approach. - -Kubernetes imposes the following fundamental requirements on any networking -implementation (barring any intentional network segmentation policies): - * all containers can communicate with all other containers without NAT - * all nodes can communicate with all containers (and vice-versa) without NAT - * the IP that a container sees itself as is the same IP that others see it as - -What this means in practice is that you can not just take two computers -running Docker and expect Kubernetes to work. You must ensure that the -fundamental requirements are met. - -This model is not only less complex overall, but it is principally compatible -with the desire for Kubernetes to enable low-friction porting of apps from VMs -to containers. If your job previously ran in a VM, your VM had an IP and could -talk to other VMs in your project. This is the same basic model. - -Until now this document has talked about containers. In reality, Kubernetes -applies IP addresses at the `Pod` scope - containers within a `Pod` share their -network namespaces - including their IP address. This means that containers -within a `Pod` can all reach each other’s ports on `localhost`. This does imply -that containers within a `Pod` must coordinate port usage, but this is no -different that processes in a VM. We call this the "IP-per-pod" model. This -is implemented in Docker as a "pod container" which holds the network namespace -open while "app containers" (the things the user specified) join that namespace -with Docker's `--net=container:` function. - -As with Docker, it is possible to request host ports, but this is reduced to a -very niche operation. In this case a port will be allocated on the host `Node` -and traffic will be forwarded to the `Pod`. The `Pod` itself is blind to the -existence or non-existence of host ports. - -## How to achieve this - -There are a number of ways that this network model can be implemented. This -document is not an exhaustive study of the various methods, but hopefully serves -as an introduction to various technologies and serves as a jumping-off point. -If some techniques become vastly preferable to others, we might detail them more -here. - -### Google Compute Engine - -For the Google Compute Engine cluster configuration scripts, we use [advanced -routing](https://developers.google.com/compute/docs/networking#routing) to -assign each VM a subnet (default is /24 - 254 IPs). Any traffic bound for that -subnet will be routed directly to the VM by the GCE network fabric. This is in -addition to the "main" IP address assigned to the VM, which is NAT'ed for -outbound internet access. A linux bridge (called `cbr0`) is configured to exist -on that subnet, and is passed to docker's `--bridge` flag. - -We start Docker with: - -``` - DOCKER_OPTS="--bridge cbr0 --iptables=false --ip-masq=false" -``` - -We set up this bridge on each node with SaltStack, in -[container_bridge.py](../cluster/saltbase/salt/_states/container_bridge.py). - -``` -cbr0: - container_bridge.ensure: - - cidr: {{ grains['cbr-cidr'] }} - - mtu: 1460 -``` - -Docker will now allocate `Pod` IPs from the `cbr-cidr` block. Containers -can reach each other and `Nodes` over the `cbr0` bridge. Those IPs are all -routable within the GCE project network. - -GCE itself does not know anything about these IPs, though, so it will not NAT -them for outbound internet traffic. To achieve that we use an iptables rule to -masquerade (aka SNAT - to make it seem as if packets came from the `Node` -itself) traffic that is bound for IPs outside the GCE project network -(10.0.0.0/8). - -``` -iptables -t nat -A POSTROUTING ! -d 10.0.0.0/8 -o eth0 -j MASQUERADE -``` - -Lastly we enable IP forwarding in the kernel (so the kernel will process -packets for bridged containers): - -``` -sysctl net.ipv4.ip_forward=1 -``` - -The result of all this is that all `Pods` can reach each other and can egress -traffic to the internet. - -### L2 networks and linux bridging - -If you have a "dumb" L2 network, such as a simple switch in a "bare-metal" -environment, you should be able to do something similar to the above GCE setup. -Note that these instructions have only been tried very casually - it seems to -work, but has not been thoroughly tested. If you use this technique and -perfect the process, please let us know. - -Follow the "With Linux Bridge devices" section of [this very nice -tutorial](http://blog.oddbit.com/2014/08/11/four-ways-to-connect-a-docker/) from -Lars Kellogg-Stedman. - -### Flannel - -[Flannel](https://github.com/coreos/flannel#flannel) is a very simple overlay -network that satisfies the Kubernetes requirements. It installs in minutes and -should get you up and running if the above techniques are not working. Many -people have reported success with Flannel and Kubernetes. - -### OpenVSwitch - -[OpenVSwitch](./ovs-networking.md) is a somewhat more mature but also -complicated way to build an overlay network. This is endorsed by several of the -"Big Shops" for networking. - -### Weave - -[Weave](https://github.com/zettio/weave) is yet another way to build an overlay -network, primarily aiming at Docker integration. - -### Calico - -[Calico](https://github.com/Metaswitch/calico) uses BGP to enable real container -IPs. - -## Other reading - -The early design of the networking model and its rationale, and some future -plans are described in more detail in the [networking design -document](design/networking.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/networking.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/networking.md?pixel)]() diff --git a/release-0.19.0/docs/node.md b/release-0.19.0/docs/node.md deleted file mode 100644 index a5c0a6086ae..00000000000 --- a/release-0.19.0/docs/node.md +++ /dev/null @@ -1,142 +0,0 @@ -# Node - -## What is a node? - -`Node` is a worker node in Kubernetes, previously known as `Minion`. Node -may be a VM or physical machine, depending on the cluster. Each node has -the services necessary to run [Pods](pods.md) and be managed from the master -systems. The services include docker, kubelet and network proxy. See -[The Kubernetes Node](design/architecture.md#the-kubernetes-node) section in design -doc for more details. - -## Node Status - -Node status describes current status of a node. For now, there are three -pieces of information: - -### HostIP - -Host IP address is queried from cloudprovider and stored as part of node -status. If kubernetes runs without cloudprovider, node's ID will be used. -IP address can change, and there are different kind of IPs, e.g. public -IP, private IP, dynamic IP, ipv6, etc. It makes more sense to save it as -a status rather than spec. - -### Node Phase - -Node Phase is the current lifecycle phase of node, one of `Pending`, -`Running` and `Terminated`. Node Phase management is under development, -here is a brief overview: In kubernetes, node will be created in `Pending` -phase, until it is discovered and checked in by kubernetes, at which time, -kubernetes will mark it as `Running`. The end of a node's lifecycle is -`Terminated`. A terminated node will not receive any scheduling request, -and any running pods will be removed from the node. - -Node with `Running` phase is necessary but not sufficient requirement for -scheduling Pods. For a node to be considered a scheduling candidate, it -must have appropriate conditions, see below. - -### Node Condition -Node Condition describes the conditions of `Running` nodes. Current valid -condition is `NodeReady`. In the future, we plan to add more. -`NodeReady` means kubelet is healthy and ready to accept pods. Different -condition provides different level of understanding for node health. -Node condition is represented as a json object. For example, -the following conditions mean the node is in sane state: -```json -"conditions": [ - { - "kind": "Ready", - "status": "True", - }, -] -``` - -## Node Management - -Unlike [Pod](pods.md) and [Service](services.md), `Node` is not inherently -created by Kubernetes: it is either created from cloud providers like GCE, -or from your physical or virtual machines. What this means is that when -Kubernetes creates a node, it only creates a representation for the node. -After creation, Kubernetes will check whether the node is valid or not. -For example, if you try to create a node from the following content: -```json -{ - "kind": "Node", - "apiVersion": "v1", - "metadata": { - "name": "10.240.79.157", - "labels": { - "name": "my-first-k8s-node" - } - } -} -``` - -Kubernetes will create a `Node` object internally (the representation), and -validate the node by health checking based on the `metadata.name` field: we -assume `metadata.name` can be resolved. If the node is valid, i.e. all necessary -services are running, it is eligible to run a `Pod`; otherwise, it will be -ignored for any cluster activity, until it becomes valid. Note that Kubernetes -will keep invalid node unless explicitly deleted by client, and it will keep -checking to see if it becomes valid. - -Currently, there are two agents that interacts with Kubernetes node interface: -Node Controller and Kube Admin. - -### Node Controller - -Node controller is a component in Kubernetes master which manages `Node` -objects. It performs two major functions: cluster-wide node synchronization -and single node life-cycle management. - -Node controller has a sync loop that creates/deletes `Node`s from Kubernetes -based on all matching VM instances listed from cloud provider. The sync period -can be controlled via flag "--node_sync_period". If a new instance -gets created, Node Controller creates a representation for it. If an existing -instance gets deleted, Node Controller deletes the representation. Note however, -Node Controller is unable to provision the node for you, i.e. it won't install -any binary; therefore, to -join Kubernetes cluster, you as an admin need to make sure proper services are -running in the node. In the future, we plan to automatically provision some node -services. - -### Self-Registration of nodes - -When kubelet flag `--register-node` is true (the default), then the kubelet will attempt to -register itself with the API server. This is the preferred pattern, used by most distros. - -For self-registration, the kubelet is started with the following options: - - `--apiservers=` tells the kubelet the location of the apiserver. - - `--kubeconfig` tells kubelet where to find credentials to authenticate itself to the apiserver. - - `--cloud_provider=` tells the kubelet how to talk to a cloud provider to read metadata about itself. - - `--register-node` tells the kubelet to create its own node resource. - -Currently, any kubelet is authorized to create/modify any node resource, but in practice it only creates/modifies -its own. (In the future, we plan to limit authorization to only allow a kubelet to modify its own Node resource.) - -#### Manual Node Administration - -A cluster administrator can create and modify Node objects. - -If the administrator wishes to create node objects manually, set kubelet flag -`--register-node=false`. - -The administrator can modify Node resources (regardless of the setting of `--register-node`). -Modifications include setting labels on the Node, and marking it unschedulable. - -Labels on nodes can be used in conjunction with node selectors on pods to control scheduling. - -Making a node unscheduleable will prevent new pods from being scheduled to that -node, but will not affect any existing pods on the node. This is useful as a -preparatory step before a node reboot, etc. For example, to mark a node -unschedulable, run this command: -``` -kubectl update nodes 10.1.2.3 --patch='{"apiVersion": "v1", "unschedulable": true}' -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/node.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/node.md?pixel)]() diff --git a/release-0.19.0/docs/overview.md b/release-0.19.0/docs/overview.md deleted file mode 100644 index 01d0674467e..00000000000 --- a/release-0.19.0/docs/overview.md +++ /dev/null @@ -1,35 +0,0 @@ -# Kubernetes User Documentation - -Kubernetes is an open-source system for managing containerized applications across multiple hosts in a cluster. It provides mechanisms for application deployment, scheduling, updating, maintenance, and scaling. A key feature of Kubernetes is that it actively manages the containers to ensure that the state of the cluster continually matches the user's intentions. - -Today, Kubernetes supports just [Docker](http://www.docker.io) containers, but other container image formats and container runtimes will be supported in the future (e.g., [Rocket](https://coreos.com/blog/rocket/) support is in progress). Similarly, while Kubernetes currently focuses on continuously-running stateless (e.g. web server or in-memory object cache) and "cloud native" stateful applications (e.g. NoSQL datastores), in the near future it will support all the other workload types commonly found in production cluster environments, such as batch, stream processing, and traditional databases. - -In Kubernetes, all containers run inside [pods](pods.md). A pod can host a single container, or multiple cooperating containers; in the latter case, the containers in the pod are guaranteed to be co-located on the same machine and can share resources. A pod can also contain zero or more [volumes](volumes.md), which are directories that are private to a container or shared across containers in a pod. For each pod the user creates, the system finds a machine that is healthy and that has sufficient available capacity, and starts up the corresponding container(s) there. If a container fails it can be automatically restarted by Kubernetes' node agent, called the Kubelet. But if the pod or its machine fails, it is not automatically moved or restarted unless the user also defines a [replication controller](replication-controller.md), which we discuss next. - -Users can create and manage pods themselves, but Kubernetes drastically simplifies system management by allowing users to delegate two common pod-related activities: deploying multiple pod replicas based on the same pod configuration, and creating replacement pods when a pod or its machine fails. The Kubernetes API object that manages these behaviors is called a [replication controller](replication-controller.md). It defines a pod in terms of a template, that the system then instantiates as some number of pods (specified by the user). The replicated set of pods might constitute an entire application, a micro-service, or one layer in a multi-tier application. Once the pods are created, the system continually monitors their health and that of the machines they are running on; if a pod fails due to a software problem or machine failure, the replication controller automatically creates a new pod on a healthy machine, to maintain the set of pods at the desired replication level. Multiple pods from the same or different applications can share the same machine. Note that a replication controller is needed even in the case of a single non-replicated pod if the user wants it to be re-created when it or its machine fails. - -Frequently it is useful to refer to a set of pods, for example to limit the set of pods on which a mutating operation should be performed, or that should be queried for status. As a general mechanism, users can attach to most Kubernetes API objects arbitrary key-value pairs called [labels](labels.md), and then use a set of label selectors (key-value queries over labels) to constrain the target of API operations. Each resource also has a map of string keys and values that can be used by external tooling to store and retrieve arbitrary metadata about this object, called [annotations](annotations.md). - -Kubernetes supports a unique [networking model](networking.md). Kubernetes encourages a flat address space and does not dynamically allocate ports, instead allowing users to select whichever ports are convenient for them. To achieve this, it allocates an IP address for each pod. - -Modern Internet applications are commonly built by layering micro-services, for example a set of web front-ends talking to a distributed in-memory key-value store talking to a replicated storage service. To facilitate this architecture, Kubernetes offers the [service](services.md) abstraction, which provides a stable IP address and [DNS name](dns.md) that corresponds to a dynamic set of pods such as the set of pods constituting a micro-service. The set is defined using a label selector and thus can refer to any set of pods. When a container running in a Kubernetes pod connects to this address, the connection is forwarded by a local agent (called the kube proxy) running on the source machine, to one of the corresponding back-end containers. The exact back-end is chosen using a round-robin policy to balance load. The kube proxy takes care of tracking the dynamic set of back-ends as pods are replaced by new pods on new hosts, so that the service IP address (and DNS name) never changes. - -Every resource in Kubernetes, such as a pod, is identified by a URI and has a UID. Important components of the URI are the kind of object (e.g. pod), the object’s name, and the object’s [namespace](namespaces.md). Every name is unique within its namespace, and in contexts where an object name is provided without a namespace, it is assumed to be in the default namespace. UID is unique across time and space. - -Other details: - -* [API](api.md) -* [Client libraries](client-libraries.md) -* [Command-line interface](kubectl.md) -* [UI](ui.md) -* [Images and registries](images.md) -* [Container environment](container-environment.md) -* [Logging](logging.md) -* Monitoring using [CAdvisor](https://github.com/google/cadvisor) and [Heapster](https://github.com/GoogleCloudPlatform/heapster) - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/overview.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/overview.md?pixel)]() diff --git a/release-0.19.0/docs/ovs-networking.md b/release-0.19.0/docs/ovs-networking.md deleted file mode 100644 index 34f2bd8f54c..00000000000 --- a/release-0.19.0/docs/ovs-networking.md +++ /dev/null @@ -1,20 +0,0 @@ -# Kubernetes OpenVSwitch GRE/VxLAN networking - -This document describes how OpenVSwitch is used to setup networking between pods across nodes. -The tunnel type could be GRE or VxLAN. VxLAN is preferable when large scale isolation needs to be performed within the network. - -![ovs-networking](./ovs-networking.png "OVS Networking") - -The vagrant setup in Kubernetes does the following: - -The docker bridge is replaced with a brctl generated linux bridge (kbr0) with a 256 address space subnet. Basically, a node gets 10.244.x.0/24 subnet and docker is configured to use that bridge instead of the default docker0 bridge. - -Also, an OVS bridge is created(obr0) and added as a port to the kbr0 bridge. All OVS bridges across all nodes are linked with GRE tunnels. So, each node has an outgoing GRE tunnel to all other nodes. It does not need to be a complete mesh really, just meshier the better. STP (spanning tree) mode is enabled in the bridges to prevent loops. - -Routing rules enable any 10.244.0.0/16 target to become reachable via the OVS bridge connected with the tunnels. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/ovs-networking.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/ovs-networking.md?pixel)]() diff --git a/release-0.19.0/docs/ovs-networking.png b/release-0.19.0/docs/ovs-networking.png deleted file mode 100644 index ca75ab305b8f62eed7df748bf267701694d478db..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 71412 zcmeFZX*iUB{69Jvj4jF+dAs3??uA0_Kpvu|Td%36tJZIi5Ho3R_CP}zyW z#EcYKXR{$?j*zR#-wAw- z$>J({e$5XBIP3Yj-!hz5IPn-$dix$nEGCJrlZNXP4gI^5db%$qKA!D;CAM%dJB8oD z){&R)V&_dK%}11iTJUQT#=&_dYJnwoM4gwUh5ckm!R|Df`LQu&tG4wv*?(5U zJ}OHed^Z{MC1k2Obc)mX()481!Cq~zgyfl_Cuj4f*YYBC=NxHR=FhUk~N@|`5~E%i&jgf>3XsnC0z#4gwTY5TyP z!YRW8xQ6WQMIwIrK}8i&56vP=LV1q2|IhEL{yN`D__0C2#PuHBk7HnK4u^*~ZB54p zw`3&EIeAjHuds)u@GG6iKP5(?T?eno|KHz1^0sk-<|IWJTWs2uqv);JmT+b7>vPxU z+1~6CW(eSkM_-r#^HXheW}&7}t(zju-n_!E%`U-)F-V|#ifTK$wnqvKyeXClhvgzo z;aQp74Yel;r5panM)G*xNS{QcJkS3+bg-m&Y?}vXd)_-6k`?m`>yBHPry5+ za{>WCwY|Z1RMxs{Zi!c*+XmDBKB)Jg(q;-2sKQ;U_pDWY3m>HgJpJ&ZpsRonL7hnK zZXeg8YBb=yBOd_H1GNFyr23>d?624EnA}~Ts9!Hb?>VJuxQxLvhG+#4HPod_zC7kH z2wobi66-+ryH7nEui@kHy^KEp>m?sJ{TSQ-I>0QQGko<{wlpazy-EyoJjzg>(-_1D zgfj@R2oR^Q-(=-}_-#JZnbP~kX{dgX6|6EJ;MOFbg#;`CggHo_A)1;)dJ3wce>!-3 zAHTg(WW-9Vaz@%o8!w2wes`7Wf1O84Prvi=;Y-dgq@@E!B-*sP>!K)C+>yTaE{gwIL$V18WfT> z?MM|{ZIyUSvdv~zNtj@cexcL-z0Phq(BbVpjg9K>CJ!TR{+n-l+dB9^r_ki4>hNB_ zfHc-|9n%b)*8H(vjGkU7J+U%V)~b~lzVyc{ZEdzi;q8fLVcdIU15}>>d)KRjZM_Vl zVf6Q!uHYGmYxYXu#ye@eB28(%bNFMRs}PztKI|$DCy);yd63;0=$v+-D0XrVCU;W- z2hOc=h#V(xKAvn=3tY&;e-x_@TPoK2?JU+5w8S4WspOZ|^yZ-dE`l3O;N2(d*Bq2g z$2(=U4Lh zspK=-(==CC*QGI=3Eex-bJBb{0j;^MZTHP|TszFWG*gDn%;tLS@j<6lO(}-wTAFLD z{^3if+0Q6-Le!$drs*@<*4Tp&Mm?LzDEy~DaSmOEt9emL=; z^!Za@$3g|^XQeY0%+biGmeipSfwsh|67;nK)9`RM{!=cg*AP(iM#UM`!vqI80%0wF z90KZ8I@K@pjmb0P2TaFO+hy9aj{6SxcLrkJOxqU?v}@Zq?YsC-MH0yuI7+b%Gnog9 zTTHR(s>^zVYuvLI;_>02YHdv9^EQOj~B zdI>3~a}*!nh#GZ$x78ie2P6h9kRViK2l2Tck6sS5!eo0(FL;O=q6WVV9&GUXqqVIN z!)5NnW4pGKt-oW}dY3Em)L-K6BZzriam}asl@c|St)YSAg&CXf*opk9IYob4tq>{*2+bRg36b+bRH6X^ z$OFJ1$PuLC4$6#!h0yE9-rd`8A;PJz<^AXq^T5ZwYi2XG?nnT>jY{IwLc2c%FYtrRY zcRHAyngtNe-`_p4rLqMzL8z}l8||kYGFt zO@zv8iR1_o226tyl|=yX{+~bx`5J)A@GpAuolAI|=7I|wXwfPsrB9stg9TG%fB|hZ z6h13Sl#8OoNj`s?#{95ezU1n}!V{mC4IWMtDzFj6XdUa~jo&_G>)lLPX%VRZs9$si zr-W&+W1)g)dU`HxC4;`{$yGP0D?h$^k5?CNkv_6tP@s=K4oYU>ieA=(1?PlOJhYZ^ zLX2b6&&!f&B7?t)J*J}dBFL(DLLKEJ94Dys)Y6|^DvN&p+l|RK>cBK=pc^(-X1&zp zx6&}jql@@UCcYc3UL-^>e77J<_Ey4QG`uNKWsY)Mf~!R87Qe9HgV1~ts}V74&ZM|j zAR|M7)Z&RFtghY{FFv$p3|*!DL22eiZ9$_BkEid5shL+40AqNtflAN+yj^Z%&ZYL- zKU*@JW@)-)^r7(hyT?1N-vhDsH%(|9!2r|nVNDj*(--}j4%4(+({UoE3ddw01I>ND z99DgWUE`Z=y{{;zIf(DC2Z8_hfkZQA_R#a&=Sy&a6{u9bpioRSJlNlR`GK|#$nk%~ z5YOJG{0v)YdhOM*qMz1?)};|ZP3Xp4^qTl|j~jILFsP1b%M*mk5Jj}CG6Vl}DPLkk z9$z47`d;4p(DF0@cu+meED*i?%4!(H{o?(InB=pWg(raAqK&3Gv?oiUiYK0W?r}h_{SPQrARSPiFL#73>K<;*^-{Ss8PH#} zRP#^~-FG<<;n31^P?cyw3xx4iK-$p!gOmEv-IuQU3I|<)V`f`Ocw-(V&;d?TBD~zD z_Vf6nM$m!$TG$nzlU#LsnAgE!lZ^q&TYL3B!afV>GXUdE*&Ym&H!n72cP-3a*_z5* z4R7-K?9&r@;J1;%1f8qETnx2W50Xz?9GOv{9V-owN*5BG7aU#?a5z}&2aIzWpqoP? z0L0`$@5J=}9+}MXy{!qL(IlQ|`X_3scFm*pj0plNii2y=DL&l(Qr5MWj|;95%~7XpOSz6Yl@K+`n#zM1x{-HRzA*F)_uw&la5muGe)u7;)vD3z?P@ro?M zF$l7n+UPya{+eA1$07CY&=Ou0gnlJ=3m*_B{ko&FBY#XR=WDdWTD4ljx0Lbf)-q3p z!j}|$7QPivWy;uQH6KQaQb1^E0~P^A^W75!h&C9L)^D_9m&XiZS>=+9^lRty+0Lsw z`6zdr6qg}%aW{tC6Pf6^P_+_?FwA!&7;V9#WI-&qkWo#>dUpbC2P8?uL|M0oUN?SX zF4`>u7{)Op0)j?$oN>VkqWRstrBB!u8RZ#t$wK|-`+JJXaM&H!btT-1LXoCXC%H@HWUG6l^cLYgw7!!l zL{1M}u7wn_W<@>;A<++brK(Q6lVhZ@LX>*(_@?hsmczM836olPe$vgZ)kd8L@ri;# za~#po@H>gvs=Yr|G)8nUM=^F0E90~89^dHS#lhrPzO~vfEi^^!{CdH897qjNGVHgY zdQes%=1Rh`6z3^3SLgY6EN!v3^sdpDsTHwoE@hifA{6fy?kvD*Du?2sksh&+`EhfL zsOaHTCJdxh#6$~?-LtJCuV136-YmyuL(dkfa);D_7HBI|F5|9Or=S?HOpG$xqkn$$ zt;4^cEt?9LZwX)hkkC6Pn#KKDoV>HBQfq7KpIK+jP1q8hB+??H$W1uESHy!i&&r(9%enUZVgWpQ>iS4-l55J)#HJ3+3FiU*~IS^**W?RB0VIPG6cbP8u4)mq?wxTNd;Evi$tOVKDg7 zR>oh_yC}0{Bf|QA#bP6ZH+oq)<@gG}lb$uwP{dtS$&>AV3Fs6!n5=oi+}?uwxBOWo zQLbk*@MA8-LWUwWlm~%3>jaL$Ys~Eh4)ZK#PO_JKyW@-1Q^F&(covf+m5^tCfE;Z_ ztp}|O*QHDrc^*{Dgan`ohPQ9`vVa2`p)l{sg>G38&JT0Ba+b?`0ugO<>jT#8oyv%x z1Z(tiqa*jnA(&*LZI|{$Z9OV{UAj$MKqqO%}>JzP+wj`12KM+M0 zx;UYnp-)~q@-4>JxJfLNP`aj1Fn+>E*;bUM?XX~QvwyM~`EkV3nLgTl-Cz%LTAwGS zZS4IO+y=Ca{!qc#odTT$aXF6DTF~m)BCWd%#Nat18b%;jn*Iv&lcPbf9^*Tb13VNj_URIb zE{*rEPQTMW{U9rMNvT7jmI$ag;3g86Hm@%kh&v{jR#mJ3H3yIWO@l)*$g2sGzFXo} zY?2VSc#pn<)^xH+@s}fimB@Hx#hdq=d}g{g(6~9s%|P4uDo;fV9+kx(?p8T(7S4Sh z)m#pMHN1VfL)YjMjHNTB=t3OVt)p^mZ){=7<>~(=oh$ zfiwUlQuALPOX*H1GdT%|o}B?j;0VyJLXA7QWlpeiq3~q=Be#ly2$gQGvgfR7xwF0a zmHS#~93R{oylM1J`WD$|s_bR)Xs$j8)vu4_Ki!FX@?~!e-~aA8l@1j^xdSp3StKHNTy@F^H(ZL`^0`eRS64gXeu0MB3k5OmYXjH?u=@R`Dgs1gCd zkHd15O0h_f`_-P~=Y0U$omDCa8Zc~BO8r}lQ;!+h|MFPl3s8aouU|Xjw7-?;1#c?# zgB%$cSpo40v=ivsvix!Y#Rc#>^(TjN!{z&t#>|T0IxN9}*PCuU*qO^F_Ep~b$OqJ@ zAbC1T20$tRbtVfQfHkGL*c)<}3aTJQKfUeMa)^CEw}#qwp^aW+Yr{hQ9&auC1a0IC zuDNw??vySvgaCX_5>E?L@g~cl>!%jKwdVaH2vn2@3G>TOpxl@9qORfxX2Jp1LPX+b znxoWz{TzsNdv+q|)E%2diHKpi*l$K=t!K4!DnB(_B3cafo>(F zBWIa6j;Vf%2%hcD>H2pW*NvUms;T;EsXd?fAL2u8mvo6M{=a47dX#C(%kaeQk+ui7 zyd_TJ7x!h>nqH}H*9&hhxUX=wF%rXlf9Gv}g8mBUq)bTH?4CQJv4R3LfVwz&dm;Md zk;yAGrmCD0u=RdU{+a_;jNhltI+s!f)q$ep0f=BmV|DvhOddQn+_yfa`Z2qf)x2L~ z2(v7GUcZ(?$e2VlL0q9wPX2q2UIpExoRs2g3%7w>N~C3jL=lRYKC}k4?smjE(zhxp8yF3=%MB_4X`86Pl2;y2mVg~2H)9u%2jg$cfSS4rlUTwi z@va3lM`8KmNq2X53w&?4qth}av{9aUY1%PpoSPTQmy^bJO6AF6#A3nG^yRUQgY4g3 zwQr4r%5cZE?5)sR0mMlLHKps)9_QLpw%tE(qO=F&buqQxw!gnkSn*yhwViu*w%n$U zzC{)UvkfHIa;&twBZTk@{a6qum_U9=>Gb4Ww|p_>B_Y$OWesYb9V+Ok*te`h{mrY2 zJdW?^sDrVNdnuTr2taX&;>V;dqs#JbLxsG* zuBO~!Q@3H`%^%VTTDlss{KuMu@#sP~hPyLm);g0q2)9#(tB1fcEZ%03r5TA*QG zW%m6G6*NJnkGz;`SB#auo@8i4J;_M@NLz#&N1pfoBO_4E^QmO)g^=9h9%Kp`1!HNp z!IdR}Rw6fBB*n_eON-#s?LdmGyKQAXw~!sMSg23EQjnJac82cg%6`S6+y23yFo=k+ zPlBetRlDv)P|>bXUbQMi)K<}Fwgu??mC;s;<;1EB&>%aqz%HnX>J`hM7f!fgomj3g zGILKP?%Q3aMbul_BU-sEG&QDD6VrQ7DWir5GU+cCN-xY8jx^v zeSK5kfBF15Nv%%}oT>Kn9C#HI4A5UVu|Fq|8#Fp$CBQV2ZB?iD6mBUhJt^VavNd{8 zX4WwlS@G&t*Q?(jN< ziLcha;Kuo`J5Y%%R2g}B(GuA!gw|AVaXDZ98ssQ`oZ6K>Nzj`P{?j-)6{`dd7xttK zwaFLUh_54lUzk+epD-YWk80p);Z$cAs;Dvnm;LtPDYmZPogpZ0WqhXTq-1RTjed~) zp$1zDnXBk;?tpFaZ6o)6hv7c`LYe{?Vjw&878AUGCod-ZpR24Er!#4~{ z3`D4<+tFnhD6%$d#W7RW87wX1H{dJ1P~_xyhd+MqS4a3A1v|peL(=ev#zIvZ1()&Kv`^^M9K(GbJrvbFNeEN(JU^#KiN&<@lnjlOJznhBeJ>A$oj11H7D@$)VE4 zNB?rANlwO(QxBkpm!;2S6WNd2>i_5Zj}IDV*3MGkD<6rqfaO53h{tgRlWot;GAWjL ze9T)o1BJ>cS-DiIKkVZBR$+*M;rTyA2Jd{jMKT0qV9HUqOSJ^d11xOcicm^uYbQkh z?AGUF>+7^V$P%=+|(TybG*Q9Xb&zu9GC9Q zLZxF6Wy=x4RPP-%4Gza1^&beqc$)1LTF*w300TwocI=J-J$Yi>A z2^cLEz0vv1{V3*c8l7Ks%@6I&%>oM2V;?^1laXIITf!1f-ECE0o9%V_`!HJK)LQWt zrZcg2Zl|=nh8C>=fghw*wcB)nFtJdiB6A!Rsr`fe5uk{>_n-L@$ErTUzSmc&s8w5hYqMX0hb=ipF>Q{_Buq|9+D@!j0d;8^hc+wf#t}itg%{C`=J=P zGA`JAqau7e7KoZYVpDiGR_@oo12kZ4MX6}_bn&SNPuW2s^#+TV_4CvMdxBknk=fr< zjwN|toerK4(^_rv@c&8*x51xI*$8jsX!c#kPH6>m34whk8b!I_a*YREgckq@fBN|! zSyoPNYjY=Aa>bD_ENolQXP??h7fC1^7QA10?nG=6K;QWxHB zQNB549dY$5sT3VLSHaf&!UeA067ZWgp1@{18mc7-_c*gXqCDBPm2h;BE0uMl!k?}3 z3r)4D{|eW*St2d##S%uXjc0#6+JmzSUCN5dI~*B`PBkoE@cFWvc-PEX+VUM6S|Z5j zw_y}nUCD;?(pFp-GjlBWr1|rU5Og8~9r|d97%H7OvPj0K#TXTnA33pa*c9B??P;|C zTF~{J0=;2I+;6D>`k=yos@dKvm56v;&Y5CXgvBJyo_L>R|m>jL0O9)cw zM#~-GpSFJ?v%28iof+!XnXEu8ejYi$td%P8A+U){i?Mvez9md4PBk3@h-uCcTwi~) z9&GP3F|qpjwB`nR^QYw zIvZ|oaOn#lK1#`!9I5*-Bx7lghPPQ_)uW?A(Rg=B41&@`PQ7@5vmwLo)cd73W(Y}a zYm{Ly;+HRZn_%BW|GyvtFswMl8!iEgY;ya%S0=tMy%SeSPX%w%oHLIY#oHA3W5_a; zDRs&=|GO(&ipLl1v`MBuDNOPB+lWhT!AAiArfd5Wx|MI-`vBHIWxPX{r%p>%(x&RY z3h2-?7fdQWJ`bQ~5A1H=X)RO(+<25)*94Gkr{8f6G7Y8lr!26r}pHf7o$+|37;>yrmdx2Qr|6T#Ag*~DWra~kDlECDehVav_ zl?z4@VAz0r-`$oUD-IPXMq?!nVwK> zt!3o~7mkP$OVs_RbeQ6itg%-A(yi_;xpFXij?&sxchCGJl_&wC09FG)DuLT0KR>l2 zkTHbcx@EMnTYt9h9^x=+I=I)tf5nhqo*TLR9T~H8;5D(tQS;Ce7FrOonWL{$neYD# zd95RizErNVM31E;ykPWGt?}3Yz|u3D{_e4WJW(H0fCluH)!I6erfA%l{iU31;knh#$i>$F1X)#Bp z#V-Z&>MqyVX0vzCC2hm z>WA-yefQ>%196Xy2Y%6&6>i=vWxmZ;aRx;SzfbH`_}nr-tNh+K)8swS)E)bduh+My zYcFo?R8Q(BeYGgphhPl6EE4@W;2F&2&)r(Jjs{kIAR~S_@6J;w^8Ixlc+8Q^a;@(t zj?$H<0w^AIm0(F&xay2l4jCx#$|loSptgL>QF@iJi|`Do<*V@-C(5tam{e@2Da8<+ z1zHsceIsQ{exG6hkc*9S_g_4?l3;r)tAAXClSbk0n_uux4g-AtoZgNiitEgzf3>6K z?Fsp9bDFZCW%dhO~UK=c#!;e9Xq9HvnxiGEz7W*^Xg8SbEBP@@0K2*kO z+P;K$OE40)CVv@Y`QYVqk&5MSie?%SJ^!Vm&m1DX=~n70f&QzIBroFr^j3qrL?>aZ z=mj#_>tHJ57xq`)R4N983@%_vfz(;Fv@=w7G!WPkeD1lHrT)@4-ts?zH`U7h5aR$$F1!vzQ-n~!cv@XP&P~^r* zpN=jv6=NN!+ZOequO*7$YCZI#5?H-*kP3QF3G}6!3I#MA)ZL@I_uGNFt`QS_4lb|UO;5aoGJq;+j7NJ+C_dZKirqk+$q6^z*7f^;5c z+8tnAWjSnlKWAC`<0Z#Cu~5e4jJ#liDbYCpS2u8^}YnGp?wb8BS$qeO*xY0C~oUJtu@FkfVkEV z-&>&~R7=dqmAd0UZov21)(#4O`)SMnUFxByX^RJ={WzK%FJ(4%;$I%7)=rG0Eo8Cv z_;P8)_YAC%^ZvoLOW&(rfwn>5CUj0B|Z_s4_F^cU|~SGurs@*Kg;z@NEY zjATJtL0GHpxnI^#9m?4=H=0J7a8nqM;Ps&%AKp`-?$`r*SnIu;f6=j!xh)&?O;Jf! zf}?rYKdQYt4Sn&@>%;3Y{`(I8-i8|yWutn>i_`)J@|u)MLIU_gk*;U*5C=5(U)NyH z(6x1d(0@2H_hv&fzINer|Go)<%J-DC(uJDQea*e0$DQ%~8|BAhPnsTOr7si6R{`V0 z2llzw-hNm!)Rs3g1Dc#zQY%`&6~`mps_sCyPRFX>W9{ap!W3- zGT;At`lgi!PT$BWUf?+NHqFZx?KoYxn)PN$tP|KvIP#ATP20;@s9}H*|Hzk|{mtN2 zwL77~J0WWhJQaKGIMmvOR=T5zPDJ|9zr)Fleb|l6#^l(!B%l`y?>Mfr_H7DnR1)f5whdp?6a+}&bG}OO)z$F z6a3yy*WqLObAk5XPpNzeT)OM}y4}a~aqlYH@*Z#b-r<%auy;~FK(oDNtmP;b=0Xe4 zXn(J$WN6{ZoKr!-UH45eV(ZzPUy1tuuEM2Y*InY;yj~nVM!M(0ua>~@n`**%Hu2*h z?mBjH2qoGYf%aXt@&+24BSkhYpFHqS?6h)?D=?$HC+zcyQKEE`Yz9MqC zmkM&s<%lM}j40ab`?2P6X}h%Utr*(C+%&sJ#HzBC_|ybv_DPphfV->28%jH?Qzrxy z`+SjIRhePn!W_J7>5ATM#oN`O+`j+x<85n$3^_Bmu*A*Hr9-ovS}@vMHddSe&j)B( zn!}AX$6LF@mv_t=_8neQUf12--J8ljdF93sLaXVOh^Unk_c?IsXl!QAJM~OAw#rrk zHLTV~MBSSO4d~{e^kJ9)bCmem1ZXNFp-E!2*%%=%NsI3^TnMY13bgYi-?)JGGRc?u z!2G0ik>%Xy5&p_Yrj$?dvs6{1UH;{1o8{KLf>dk9f?vPG{bKy;{Niu$F>0sh{s+{? z!U(P$9R;jVlmJZ*+hf|KX5NCWeI<0$oXnER{i%yv>wMt;yoRZF30QFms@wMY$Xowr z*#{OQCw$s}ax$~VhF=v8abb-OeojY4Wl>RKqkDh_5R&~a;zOs-n zA>ITkTeFgHk{m|LmthjxiK|p#bwOuC#^-Eb1-)(EN^vV#RcJcySbpa;Ted#N0mbq*B zUdnchKpaO|*BOC5bIdutAS8R;uXvWWApE>;Rtyx_;e#;5`p?M}M7V^_SZI^BpZ8<= z85KLtMrie&5_tfAog9xa(XdX$40J#Sv7y_n(iB zy|v+R%^g;>;Je}U1pZ>9sRd+fB{?t+R5|A|zf)VIAV)he2_^&CFy8eue?gBih_BF3 zgIYUAUatFiWtgy}TlAjPbZYy^N-A?4m-c&4PT?I60>94rIG-3_i%QDeXkO9a?lt5a(3y;;ESGSMPHx) zzMKFk#3@FAE~q2RzN>$pb}Y75+?Kl<^C8Dbob)XtC>(dWQvCD_b~oqIl?4q|A}h7)2&9##RsP?Y8^D8 z3-Xk~u!yr35V-4LTJuh+GU#u5xxQU>X(W{{bZ0x}j&6PC1H;NQ#87uQN=G@S8sm0u(TxEnwmzdDoLZ3m!UdcVIAUq0c|Xku z-!Rfd!Cd%3uoT)^4e{w4vNh2}z;Xw(oM5-iMl`<&S~9ywRyN98K^zR&!~Vu73z|op zzHpap3$dVgEAM4965}clwB+nWj_oWUx04kJoai?$y?}> zrF`MdAN?#{FkUr!nN%_PYYNe2cN^&ZYG{1R&EYK@FW>=7pD3%k?sRo*>}@Iyzt%lm zNq@^LTQ`oIx3B&^AA)`?GPdvi+8h=z(u93~qo^^;JjFuSn)8`1M;V#eTxb84oL>{* zyY4>*(@Yx4L4)9cbQe)Ukknm!{2Z>JAEk?ISHN;YU*v~AXqYVDdp*@!r#@l;X(hhI zNnwalsRE8|A%^SU?PxFs*({m!$)^0LPuNF~DC<35?synrJLfDA%Ud=DK3s7G7{v&o z$ATuxMm2U)o6gl0?_h$JiDuS(`SLptYB$TD&jRc&nVIb(I(E4#a_`&p77wTSfa_}} z9y~iWb^9d1#K@Yr*k*mfH4Whi>*0Fxe%Rv0o=s7@?2*QR-xBy!=1gz|e<(`-F)FQC z5?m_#pfk0y>hky%)U_6`e#GT+)PMl|*8NQ(=^&z8AGx`uZWECMoa8o_5)uKp&_$fJ+l_8XaMcQ9*HNABkji3WnHN z-X;gkiom?bz|cqsr!_&#jX6SO`ijQHcWlu$I)B@Y*BjxeQLw8(?8gZ~$rBWydvC5O zXUgG;`|nIFRPSMUzFpPkE+DQL`;PnJ zMwq|wbY}nY6{smoyIjho??!pAkk2c9p^*BRGH@9Jp0p{z)5lTkhfT< z+Mjx9z*G|nSDNMkmr6L16byfE|j}a&v6R&O<()vjp}8o zS4j=ZhBkVFrC;H+aH`S=$yex+N~Q4&U8QczC+Ey`g@)n>Um;r!d|{_C*`DC7axSGp zb1gtOP(20+z|qTev%V;0xPtGm)oKKD&K5wTox5u2))B<(P1t_E9TZBO^vhVj(RjL|h_?$~tq;OED{a`pw9VB80zH^$$La` z7ECcpy+jiHqTKHJd9W=9ATC%M7jC}luhr`g6UTk2ptHzchYBq}=iD|&!U()aH;ftS z-vm*no;{7RdX@8`2r;@8v@#(wA34ACc=w$6>MPqcLzc26dN^8kF{AFRiDvoM-sYN5 zC&9AdMl~s%gkeOa?t8XN@@9yEaZ-bm6T%)g;^TqsI;6;%L1pnsHCy^><>vjIccLnj zLD%LllkTDyb<{Y{fkvx^SQ-sdg36OHcl7vUpuh?dumC8Q01YlLU!E6u;HdY|oa4Wj zd+uJ9DYxD+W7_0M0?~MjT<_b(mr3&)>}jPRIe7kIkk#YQrXO(Y7*Z67{LRyL+8CFcTSR6C}L)%B32sF^hg_`y4Ss5W^=#N zaUEix5tLuJEn+Y$k`+Xuh z$#EE!8bSk>M)@jcMzZ?8{|lBzwPrO2bog7k--z=kbj$}OSxRNWT8bs6td2@F*8|Zd zmBr89mu)#2xH&^TBVJfdpUVk)?=dvrh7ecfCXqAh*tY56$4d%1>@;hf+!p_{Wxdgb zZzA8Rf@7o-M_wDYlnJJ>V7&FVZUUC-D$o@Txy>MA#pw#GmSysw912_lsIZ^+h*^HXnoy)YH2(80Tt7K&DNHKD9LvCz=4_&V=jn`O1Y zJ^0zrfnlLH)#6328JAhDQDvgFV}{Db0z|gX5aVcw-S!zkdKX`pO7q#EH0{8a^*-&oMez zc2=I01cVGA#C1v114wuKr`kk&`yC4w2n*&**$(%>!k=uBdXBP4_a*|?LC+FwHSaXf z&917%jK0w8`Woqg>%PGV7jE1U@Qe3_``zZeFbH@_N&|vwQ@^KOGlp6Vv(yzIxiD5M zn>{Kj(REieWZ~zpDK95Rm%_>0YE!#kfb|C?)D;}N%qMa1E~fR9WnmCO(tJug$JZ$wqb&eLsv8>v1%u~!Vn?7tEd0op)9&ot@9fK!^aN^4)`vQx6qEhyO`{;|Xgs?I1YOPGxtH?Y;tH*a7tqhh zsqh4#YNH_~=bO^ty{4!_bsRP*oRtneZysF^aP|d^xgxM#RJEtW2py%y6wZXrA(N)Ao)x%(!m;t_-~a; zO<$HQmqocY0_y^agP+xBa^F|skx}IvY&@L?9mI1BoPaVKeIZVg=WpESaRj+ffaU-ms8U*XA&l)8p<_jY<2P9`y3)nr&8u=ZJ?e9K9Z-rJ!-rJCim=G)I#R(S|+Y08X!+2Wa(cgK1mxoN%dtdvaQ<>=9K?r6f0gLWHZk_U= znW|>vCP|aRUH^oh6iB9TxzoZz-)X}hfq%3)vU0_}XL&-{#UziuwLG=tdQ;8fYlg|N zR|fALuB2g&gUkKQ_dl9SWG%ebqAXWUeLC3^1J&vs=RpnbLMJUYTqjX_Rs6~-W9xK4 z>e0r2>=Om*sk0Ta5d}hQH*X;AbV%#2mLbAE+wUCvrWaB0r{<7Gmt1t zdT*{4zq-;#DTz>PNMGO?Hv%sWCY~KwLeYx|>`_bjed+bhr>JX!cl(4JR32WAcibQ- zJ!zb+Ne-|C{e?bL!|n->;p)w6({<3VaTPW^k{RReZs$45e)~uv?$C@yvQ26N12aEZ zoM}8>9+YWJ_TnYxvAblPqu78(UCWeOyCv%0jvT+N?faF4YjmEh=cfsh)T@xq<<p8k#5z%j^Y2-{YUlePawa6$) zk0FF72p8PvM<&`a-Cy?NjSgg;w|Jtw7*m2sqaWs3Z?Xzn88v9IL8+IZ!c}e`u)7<~SQ5L5m z7X9`c+avh@JSWRR=6aQ88LD|_y{yi-2^Izu!TkUx2+yt&wK#i9+%RDz;|2U8j=+^PGEfkxC<eqSg7;+50lxsNddombAot2)t4$<=e;W}5@O0d$!E0j)j}4iP&;9>GJj10 zEOc4xlo2d%6BdLJKdfSZ_1Oz#-L*jVBbZ(0TOIY>VyYZY%WT`j{l;K?Y59LI2oJ1(bK?voB%Ykvs>GhrOF;v?)PEYE~%lGff0&0+o)0u z-tMw*#dPq*=h3P7BBfO$VrczE%6lI1jd7lip}F#nHrnaxKV39v2o1)1`6Mv^A3yuR z{2WKKG&6=+z9ky+tNJW>D+xmkU)=f|XbjOw+_7;oNest4yo|0{0LC&i zDCtIl2ZV0M+Vi+?yJz#T*){8#W8k~Mgm!43wVDRg@DN&FKD^sh+7I&-&q=Hv`<*0) z2}>5wdZ%$340gqR)ve+sJZC6ZY7dfph;l#qu+LIW*tv!~N5qQQ!XX;+r4bRay?0`} z<50B7xocjC-BrQ0etb z@f@@8t3XTY3|K1?Kga;zXnNE3RC`)OW~7pL9^944;d+K&FtR@$f>95ST<{ue?8hN< zR3X$4OF+If+NAbc(J|V}2|lLS5i&L&_>if@l1Si#q~(t(5lK1vkUmRH=}GoFg@XA) zSE1uC9)1XLD-@%pI&$ZF0uT5arL}D(h{hK+T{j@g2Yig;;RABCl63KWpFJ zDIsJG<+F&cQlI6Dbj4JRZreaCnBNS&4z%?Jgaja_=wbuCnO)v|u&GV8FHip_tpa?) z3_g0+jHh-bvqN5_!-cgblUJNNzBVxUi#`ZPM1j<7Zua&bJGL8?@wF8V$31k_U%u-An?Us86)`xhaazk0D< zT3>!`&=V&I%l?z8>s?NZ)UGC#zOhnUp|WwJOR-q(n~x>@Y{1`UIV?@zJS0q?Ru2K@ zSw(Jyizg2sKlI^^g|f+;H|HBtR{?K~9E0rt+6WF0T=@1lsnrJ7>y64Z9@G4}U|ey% zGTO@P`_f(ss|+76D;@REiBO~bgQ$vm{~p0_t&s%_U*7ZYYHf~Wcq|e^c{c~tr`hM2 z;pW$`ij)Ng>}rKZT$d*BiatL9WcYAq~a@Tp;2UN8fAtNwi}_I;v7`V zQ>QPCn0N-Xxen>{OylgmXYZwochLj<8ioeu=H|E!GEl5D!jE6p*CGAs5-v~#b=O=K z%o+4g$n+Y6AVjQgsCs_G#zXVgxCBR4jpx*3E>NF)h^|;Qh^*N*k{QpAj{WFPa5mBPT{a-flKRKC^FN=irz6u=_>>GnzZM7HwJN9Fgz8(~;wpz~h z{*xDhJ|ttIB{siz$s6oBC1D73*F^V)l;3$HE;bC-L_+NubK(^+ryy8W{H}-|lvqr= z2iTO1`kxHMEC>nOzc3P>_jIb6ZhW>TAwtMBJTO;Kh#r0HG+6Jbo3D=7;r<@o@J75S zu;|yzG{z^9L{&;>Yq~{y90O8nl8fs{9Z6z?UA~k=S5tN%dbt*Av83N^ZUirV^xEs@ zG((tXWX*iO&V#Zza6E{8Kh06^;T4ZDPnGtb@Zwj}g2Pb7z00%42n!H4)pcAsnXLOs z{jziWi>X7c;067Mr$|vm7p=a&8k|^5vY)L%t(WYyI638h&*W&G&F3AC^e6JaVu+ao zwMlDCeOG}@}N>6Fz=%M#Nd#+q(}b9V+Uii z*3IrSZ$}-BdPl1`qhqd?@cg0&~kXPd}Wcv z#cY`O><22BHm%^aI24zVLbUAT+$G9i(N#ACq^Cd8e|b~|C9&C0`=f{k`vI8t|2?*9 z5MvN%XK8>j{N15FhmCQN0Z~0QRar3Yt;O-nN4R~(F(g=yuu&akA)+3QthF06$Xt2| z)+Fi$esKhr+)9^Dc>GC?$V|kl(D#y!e|Eqp_MhAODcGW8hhu4KcUj5kbMRKQDl!>q zFOjp5EQm+Qze?drnl@*2rk^Z&D*K|umHkk^ zb=H4);S|LGafB=2fQO8^eogYjDYl|8XyfqeNel-Orer#|4AzIY#Z4d8_N!hg8(eL9 zng|g%zY#SJSjmz8AQ^pI_y46^yMF&N+4+ zf(TEL&2+SQe1kKs3bxq>Yx;FhtC5bE2NX^lzAGZq|A-(!+V8`uO#0B9^@q=!Im>iw zMof^4`f;SnqT_o?ab&09M&B!?rogsQHB=O`A75Q26rOH3BN4Lrq+Y7+M@6%on`dHo8Cn1PGLzZ3b(!{xoaQIpwCER)2?%`szFeq|`|&t!<1BWQ$}Mw2 zKl1}>UMXfKVDRDghhFzHL*Kx2EiKy1pgiYq0iGp3W+Qn@n=HKSlPJW3(Q9YjhX$KL z_}`lv?mNA70R9atxQIru>1j0nSLyd;(`acIbKUu`CWx-0Velf$vw`u<(ZfU8*0rAr3P&I*QnRp7`1U7U ziJscvMz7}t;QBSTSY3@8MtDqZc6PSfer|Ju+&HD)n7Z+;7OwGxM#1=OWO4Fh-dL^NN-OT+A@d|(YO5RkrR z1W*{`I)Vje+WETcE1?UBsiVT}?8|(;@OD~+Fb-o)eE`qfhzcS;=Xk~U2A_gX#Vlh<#7tisbSn(#|+4*!K}Z#em}km%+*IuZP6E*%x&C~ufC(uDu~C*`C}J*j~F1Av#Fs>XAVeCO95ca zDipbjHq5Xy9Y{N^;zDTa4&PdNmv_*5*AH&+d5y}R;ZQg<$@3bMM^bU^9bz3Ur zF3yEsQo)R^iC~1vzeqpL1V|9VYKr-A&- znZ5Hi-dFB`czW{A{fO0zO*xwB1>~D(L5c&X!(hpeOLebKED(|%4#Z6Gv#cA3ZH~Mi zO@PT%Ec?#B`C4F5kQn~bTejPa+dE1lXH{{yJX?V4YMo4nH-BoTyXJ$+AKijjUXfmv z!1<^I9CIgaF}weBg*>&tDg%N*@;=u)0CDG4Wz$;3YP-we#PFNiCd1jFbDY4Pndk0Y z#Tj;WF*@7x@9zm&D{T?A?}V|mIFFPQPo{vkkyqJRnBmqYN8U3M(Z6Y{FhQX9LHy5N zCZfqBgK*tfGIMtvD)Kl4p|X&AnV%UH3$;g+9M?Jc(n}6Q&2&B0&YgTLFjMeOFdiK-g2K9g1_gpY(hEek4gqLY$R| z$IJ7KLNxt<*Msy&f0E-5=^-S-xIzDWrAOlKrtY$uV zLi8L`7#QMY-#<|gi>aAZbajF(#Y*`95=d(u@j2f>;n!58`1JQmw;nNGhV5|Kzs%1!^uZ?-_p8G8xG~xb+gN!@ z0Gyoz8um6xeQbsd)&`;0PIKbQZ~n0Z$kHwBueX!0K2&L1z`+E+GN={9yZ|z?qH&fT z)%9yHXv8tuf;_mcQ49jG#c`OvT^{)f_w$TAx;5n=mwR4pZ=;m!NJ0#8O?(2+CU7g8 zEeB(U3(+6FB|ym-Fx|#&FFJ^Ne_zwWceGWtw%f*fbzrK!%x7Ju9k!y_HkuH7|_wru0d_Uenh5yz{;}U_U?o zE|4MZF8eogybG|bD$^pN;6;r>-a$u)Jq+&eVYAW7n9#VV|4E1x0jMpxjBi5#Q8=rq03{6$rkZXO21vDiK$3m4i&jxL0RAFKX?;l;eDb=a(1NGUzR> zhgjv*S|5pxn?1L+7Bw3HP!H8^o{d% zn+oI8;lr^Di(05Q2IZS`&R|!y561nXl>GHkcx&6zR6xLyq=ye z09Jz5cb86mG6ZJQ*F(QvH5j(vH-JbjqK%6tmPY&+QKCLxU`vb$3su(rc!iPv`N%eF$#lw2E2bg3zW*W6|eHQ z%bxx2Qq#48f2_$th@a0u(bj6D*8`nOIOX?J3w_i%sM^Z$EJH8a3ZLilzb}gGi!(p- z+c7#Yi=qi3#fRaiTLS#k&t3&M-ve0uV~e()t`BV+Emj^a=PM#b|14c!(wP+?#@5Nr zgfDJr<^AIoo|3={$mH+TuTIs?Uc={;;@j|B|E!u^hz9!`>1D8|WidJ^$!WPf-=)iE z?EW_6ew-i=uk|QYPwIYm`SY7kE@OjY!zz{$tqg68IiX96giGv>tKbw_EhqqE%+ep@ zqTAYA3>d_j)1O90VV!4m9oA$(-~dYS^5CLp*J35m$iqUVXJR(S5F=0zD|4?@=Z_+< zPXY(F-p#_LnN7B-Ch`(~N7Gv<&b^;LE>diWh`#uO1*1=aom~Cp2!edT70NT*ad!a! zB|JbA)B-8jC`VmYRzbv^#sFOY%DM9jU5R!m`%})*-n26mYQ!LoHNw2p(TNwZ)?6Z` zAM>6VoSSAUN^6ARtr1_%ydJHTcTem%Q}biED2yFIL6l}BAIVE6vGXv~68(QUipQW} z;}o-3X4&x^SU9SK1d0gIf8Tf>w)ROiM=oiMmlr4cJs6&4iykg`Ybpo>Y1p;{2{$DB z`gDB$R=(V(w|Cl8dKmuLyHhg4GxmQ7%Op`CbE-M}n#_Vvt=gaSrV6E0XuC^Gyn3sU zR$NNa<LR0&im zL*Rd&zi?vp(PD+5(`GnB%V>bS{2I}cgxM#~1mqohH~YHD6Y<|Vk&zFdxG!vCgIb^G zWGX#S0$rDZT}z09vpL+&54%Pikk&e+hO1sX9}sOZ>sovkNnbeII%Qn*A{G97 zUTvXshPk!dUE(uR{I=B05z`?^Cl|L^4pRKXQH>H<)Jav_4M!gE(v&*6_psPxH8`h- zwt#&^5X7!lTxs>Am5thld^YE zRbD6_64SE&P~+@$$n&Pbr!(U{j|Fy|_aug`9P~Utw(-B5`tx_={@>bgmQ0%ueOwSt z;+A5nK*MC7tT)lK9ZU4=yxmVDLxEjpFv~H*21?)Se-JO5+~GF-iu!X%^Mw`=1omqgt%_CO)0yBFeFbOHNz0=c6P?F zXEa;mZ>w53oEIfF#<{z>9Q5-Np}F2jbn~x%tzw}qU?6PYp$^cz_v*tLyo$56rpnoP z#S>*nPdMS&yZL~|=wBs9xQ^L^ace`fOoScVe*O*{DPa{A#KENPv-wjD@r`Ey>}m0Y zX8t5DR|y{nU8!Q7`6tfZr)17(#ze4`q&>TDq-<9gJJLleADK}mt7ya#` zgH7iP3M=QgRct;%EPQw8)T+i;9(L!^pq^^lGa4lc%{a0)zf$(sF+|d~s-B$|Z*8@; zow4KvH!BbTNgkPtOVA}p3`Vwp@v^6INbTpe!DdwCV@{k)jq79gTIT?wA9w$?3;Npt zIF}>0Etf}zJi|+NK7H+(m1^5;(HlUHl1K;`%&favZ@T`Yqt;HsX+|YDRMYuL^2xG# z{;ViqQjK<4Q6HwK-cI~^&NnYLExsOJh>Vb#H07GP-C;$=tAlyR@~znC*2kF;cWw9kRO?p@i27M_Oj$Gs)J>$}(2#)@2WV8Qkg)1B!gx8ir^(#PHFZuQFvjkI~1 zSW*byC@D9KTzz&}=g~sKoqKAQP*jlTb|^B&@+4CNjFG$`jZt2gzCYVE9pGG5_)4&Qs;855Xc zct^q#CQveJvo1(YTC=TxCpAEQ+KNU%?Gt_Oqx#9G(|&dP885TtNA_x7_PBwLPNx!J zVd1U@2eEN%b5PrlCAQ8RdP@U<_Hf*GWio``JoY=dCK(3ZNLFT;1(MnG`MCKR{Bla3 zBF{=b5ANq>i3q!RkB0L+00e8?LZw1 z5ls&rWT-1M!L;s#^kV{8-FSbv87?8ruBTuE%NHpW3JP~z7A)tO9jx1d6vF>u+MgX43 zB3|lY04YTY^B2*}N-Cb?x>$WtU6|cbCbya)&$kXM@+d0gSz=4`_W^wqeMZYf%mqcu zRIC+Jq8v$0*gb(#?N$!$zz=vOh}Rtc@NZa3djNP5-Y-ihrkI;3gAl-i7dbvE7;7$S za3+l92(9Y8jWj4dE3>9ba{(wAP^I=QUSo;#+q5AAl}%jlCOb(k=*V@QK0eg6g*Uvi z6|IY;vsHeD3V1T3zUHneio6gAg>4YfeKcGvJ^H2SLG}I<m1gQ|W9$S~QIw zP>+}TZ4~+>M-J?TLmPk9`pHiJt0^-!r&1Jp@JCQHQ~K3F@`I5~rGQ16)&S)Ln;liQ z08twUV~o)km1uiu=eY)o(`&8iv6o*0bxm?#`vEoE@I(dIHc&6tp*MM>XY-+5ukIlI zXt1L4o6zM9Q;E{vKUKPr%H~`?+dP4(Ty%Wu^)g9a-l2)jjRq%6f%9htIsX85ZJ!v~ zZ3_r7`FJFjfbTj^dm|xO+Hue_@(7TNz}k0)5n}=x(pfMIg{{Rb0b7?Ut->3YAuG>r z^iEe<8LJ*iSZqy?e982Au~mH6O65``Wa<*JtMT5LIbc8}#G~UigFI{A8sAe(KOB%N z(ccU*JTi`AZ}?EGpf6@dDmDK?{WG3LwEK3;Ehc3zk?8}Y4qrW!xY9o|D!prZMta3{ z%&mG;Q6976JSkfYJ5T6y=j*=LHxpi=d1d_eZs&9l{Hp7@W7ml6oA)8@wwlFAci zJSo@l`_4j#rPp_sTlLKYXH$<3qZWR7n~MwjttszBUmJp6`Z#}-@Y+hg&wfL~c>vqX z7Sv*{wj|v&WN2B*JP$uw{B*IZ7P#TEy0)0f!bY+}-!Aj&xkr#%HGuGIzWsh{(QB>XZo6A}ZiQ4?^&UPsWXc&jSxLV8<*1?Z zY?g1xr~gau?)M(=7Eqjp`v6lHu$J%LLccSJUVu71nY;V&0TiKCF9LLiawHgg$9>o2 zpfceH(xT~X1H?NL6*{Uk*d4Ns*E>U$XVly$ogh%p3P!zdsR_9@-nNwx&!)-iHWD=d zlzvRK0Fz&Fi$y=a2I*wP=2f`!k8#$OS|lQR>S7T+UIui}xE=;wHV2-vQnvaBkVoBrE0V5xtYa$+UQyEVK(ZJjKRSvO(Eq(_u!%u^KmaK6Pr z-h@qY=RH)@bJGd;LVw&Ho1?>HPDJH1>#=5YM?+L|&Z9$uOflh()7Y0xCJDWrGGF11 zP25(S*au4~MOGiY17vzrGO)owRm2EaVEy#||%%HRPNjwx{HjKf0H zipZdb?>g2F)ScCS7BAXxC{9valXKRRTWni`i(othP_1(3GqqpJCVbCM;e$r=k)DlK z;>B(?Z0pYSvJu^fvV8W~piIHOzPsN}$++IL*~l*oJT?&?KKj$x?(N8cHcp{3c?Oi$ z)g1=b@sreZ(cEfUP6l+&;^sZe>vL)Z?&NXkt35*sKrNhFc`^${AOR z52I@RYXja-OnzhiB2a04p=aE`9BH?n9NNp>tl)6890K=CbJqCPtzL3R>u)kINDL4J zF6X|xd_qW&xOR=8=}h4le(9tLBjX<7dcl36x+STLcdsus9Q5gf)oOo;jm#or^;-?? zP$=+zOzG%`^%1(@B5+WS4+=0B8htH1LvnUg80VM}m!m&BB_76Lr&s)@4z@eyUQPXs zd1edWsbrc?w{oIIey~M@Gw?z4odP;?{fLnqa7e4}PTfi|l~81U#^?25sxxOH=pOa_ zhFolMu|i2-4fD0h*VBqd50*SQt7dJctMpekq^ue;iv+3uh`47PWERMQig($UnXPb0 zMNZ59MM27ouUUrK*Xczk;#Jrj$5c07R5T3Mc$5fihsGW!nc7Lz*VYNtH{>zEr^6GC z9PLQ?y1(9{TDYa~e1UuifJ916+G@e1ob~*MA@R|?plrETPJzo){f-JLIiE7!STV&6NUy0Ffh5H> z8q?=!?3rN3lHqKfs8Xmow(Wa$_yN%o1(BJ4wY()@05t%|dW=asQm+%kCWL?c0F^Rr z&}LOTX^9);q;M}B3x(P-xgMPMQFn^t3Hc}oSOAPCk^>ln$^f*1vI!*}51fG>Joalg zCS;*{z4biYglayr%wb2noV7F?WatTU%dcl$kZ49x*0ue7e_VqxnsZlBKh3s&6wnOBB8g+F0Mkbr7S?WGtl~N z6&bacgK5|<&OxykYmK{g`YaF5_V3f*mr|Z7Nxn|zAq^&zcP|g;x}WqDiS^v4t}csU zFFE<bo4#|!8m*7Et@&~W_%7D_mP1fpeb6S0fpp^bu*Jf>RopI4@sH-_KWWaPPVKXB8&h~NEAQR@ z;bk#CMo{SN<+s<}lSw!b#OMbJ0mW=)Dh}44@#W8#;E#RY6`A35h+c;z=M;wFf$Tz# zekkU=B9o~9?18nSe8B!eWzqZ!#`5-QmAXPI+x@RLD{JGEc%vT*Li*l06Zjm7sQ+## zbRyisp<|9sA@BY1aDu-LdW5v>B|D1_KugDL<5_gN3@FMksq{y1&9;y5{@KsG#7bQ3 zvR&@le2b$G@S(nA!hO0io0yp?&oB{kWA7nn#}1L9-L>%YCfdCZ4*ZZ~f2FB6tX~)_ z3W0eiUqrE(M0~0mCRORAo#-i}+0r}K0-c@kK}NYSi|f&#DdpDvLiD-}d^Z7FyuTGlc$xQo+z4y}W~lG4ctja~-*_uji{S-flvH?%j~3 z9{{-MHwjd_u8@|T^Wof(kPr+vg_!Ly`Dy!o*6>=Mp_!8_{K~ zWM+}X+V}0Yi&$rgqV|6;;0j>^@)MW6aV_|{`j@`!O7r65K=T+G$Hqso&Ji>hZqhJk z9f60tWD`moI_uA4Ajo%kHEz!Ulz~ip;X>hIL)WqJor4AKGs4qd_Wl*f2bg!MD!zw~ z4;cq|<^9?oA~Wq6=F&7R593r>N04_uo41^)yRTHQJ=3vGjIjUCotV2eVnlWB?J!H> z^LAw65x&#RGNW=~2-T{walqXH@BLHjU=sOl`-&Y-s|&F$e(y zZ=~pE68~#dOE|)c;htF@xE2#5ZbGQorW;#6`(BQQuGq|T0_>rr4Bjp73dRM`C6;iJnjzPD?CeL*5z5%b zS$wfvK!ok`qU)8LTc#H~wr<2+Y;(b2q}-E&L=tjms@%wt(cOL%Zj3Gn3BhLKhEc0T z+1(ZzI4hLq6=?Q_RV{joG5g)dKB=gH#t&?5Db>sl{?5UH!9?sV^t+YR(1LSoRB$m;)rI~X>G zjWxPQZf*2CC%l0)p~>#tHoZ>p=$LuTlPd9W%DrM%;a!dv2~m&*1Z|E!d)H;`R|XgR zW@gURnQ2W?X+&*wpa#-9X`|8giY}E^EnP(a9z;8?a7)#5gf|&J%Po$@X7V4#`FB1``$@Piw=B5?u zvO%hat=|~kt_)A(7TXLk)I>FPEJszY(JWa1XZMOgzG^?9D3fE+s%m6Z?BVHK3LQLKBr=S@S~(bbU6LHKM)1pC@Y{Z` z-wF#G>O=84Q9AK2>9o36eRe;(fnsmSKD0K^?&(h)pbQp{RL9R-b8@+x#^vL4?i1jN ztZvg8+z;%kCgwmeOCoq$(*Ltz5amw1z_-9I#JQRQwMO*UZ;nEdw+(#_>)G~jEDWEK zZa!oZIV6>zNPHT|dw&yMQg5cXP@WlLu8uB&=27dhhKWB4TNGq$v9*oUu`|?a5f4c- zUdMzp9=2*XOX27CP06z1So*-eobbE7&y%2T?Bvb|L*`WScJ~`bCdu|dIX{of{HV3k zECm6t!(fbi&(=(h@8!`8B33Dn!gCYFFP;U~Ha4_iTnFYn0W$7{vHmILHHb<~=>fL$ z178XJ*~g_~sBAW_7E}u+y^78NhFD4Bb4qo?&aqU*b4Oqv)!y)3VSkqcgo_+<1ia zZ68S!NfR;%K)u>unRu!b3l8`aHP=4QfkME$1F2T^bidEWCrV}FyCrO2Q zGK^myy+%2s?Pd2P-5-^UiNC)~bPn^2qCfv>a~Kts%&St-l-y4)BzGa_*U}m2JF-e0 z7|3=ivwyg)`vmUz(MK+OqzOrcpi>66O#nS(s_)NVwvyB?X4KpNs93OnB-Sclm9(DS zW6%1!`Gsj}%qfYV9-LA^#2po#F5qg+)DGI+D| zM1OFgW8JIU@;BAyzWjaD$HHnHS(7dS4U``C z=$-*3x=EOgLFa|%Vr%-Q`l=A7##WkA4A!VF_U_^Bl;ZJ1_8U%ow~0sWk-6m|i;sY3 z$K+wp?-!~BFG2gYq^mo#I)ofGN5(7BqQA3yHiC1zSM7G*Cou&o=E9u~Soa7xFVo=n z!3Qd95|g)cF{gAY2LJ4qg%*yK&pI*|89~{}a-aK0R_>?Ag!6B&h^jXtzDXo*Diqd3$;L5R3GrVm}1!7zK@KnC1for7YwhIw5jy}_G=DeO3unnD_ zm!Mu4o`?i(IGmjOnNzHIeNkX=c^#R<9hpPJ0JGGM)Yp-?VKkAWU2RR(f(UGBjB|sw zMp|S?)=o8H%-ZdJs?!cP4x#4D@kl*B%aW6B`||44ZY@b^J&ld?IxfW_yeQazJI%YiqPX?vy4 zWpJ$xBA{d}1OTC$flIGJ&630=kiVYiFz1+as z+NdSz6-1jAo5=b7U&mgPUKuARl!}{bPnyO{=d@UKoB6tF2h#poMhIcM=1P4=^YjH# z#A4_y(+w(;%Gf+N_ncG`@QLlDmP6JmKANS^XLs7MO0y7;;=d}XW3w?%<58j$#$ z9AwAdiFgi_{IKoEk1?PkeQpU+aj>-PP_=#h>8)}qRdp2a$n;Kc+dkEUsg>}KPx8>O z)c(|pZMnz#=}odNVIS7;B82}KxJM;)8cb}_f(Rb`dPp*ZH=u{SPaTL`ar2kl5kASu z$w@aXYA?E;dQZ{tvl~(`2_p9LK-yo z#r+L6PC6K1#1DGirMVUIp{Z;wK|Td#euI78G$CBO+j*e1a7O~qHa(>M4qJRHS8x4< z6OuH>GdvQ7aMRp9lF(C%gw3#f2iSWHbEtPgD2(9PP z&pC&#{T%3$3-T-Myw@&EwBT^Qf}@x%?Z@0;rtGp5*Am5ZwL&l}Btpcqb(}R*vF}1x zX3b35pLDuT+7L)9R%TL}wcFVEMKRl(*F*N;8uHFc#~+Z+yJ46g<-b@;1b9>I^;2T> z#kK?dCLaTWt4{wNsmgI)OT6QZVm}GB3dskbopC|ECwhA?H7nQS?q1sGFZ#3wIDx<@ zV4D(g{;rkZEo$T`qvf~(Av=|uTQug43p$z=(5;NpC_IKsQ@f-6a{E|`NYux0? z@evzXpb3-d(vJ4!eihELwBTdLAehW|^ZqBe*uTeq{b!P!c2yY9=G}DEw_M|fB zb|g=DW&ZyEf5QyuuXkMard~7F*&pV%nyUvUMJlMuZHX=496DLtw*Bj!a&VWnwj7y5 z>_p{Nj!}lZ+}zwjTUEUSxle`2AGm%vogWQxAzDAw9!$APpOrOryf-yDBVP!Jri|!` zzC$CGUUn#v1HbgO1DQNu-?=Ujw5p+`TQm|j7W_T`_k;1~L>bS%C|h!i zi@@OOL(d;P=y(l$1@GAa=H#HoF&(Phkzb1(PYKEQKJ$gS4{QHrNMM_d4)u(t>SRi5l~FW9a)CXMi;Dr;59p zKVP}-t3QowA1VN+JB-LnRDN>qxpTfLQXUTx8?ct`e64qJvFu*d8pC5s;jw%F{(q#K zzNO_)1yYuJ9QHm5L9V$G|IaCWa_9&LNA~TQ*J-7h+C2;|%xzeb;V8{njCYVOIQYftHJPW^9f#>&dd*YNRA z_Cb_gLejdwHh9;Z-_(a1rcVR2TZrJWQKCJNNVE0ON4seReD1(8Yfmi%kDbjlbv zuq83i820={@Xi|!opF<9`>J_qjK+@6EY-+tEi&RQm|*yas(S03<>42s3Gqud#u_4m zJmJyG#6fbh)_w7}7En5Pc}5XWemYt|it16>pUeg~p%5<)pRkePI1qTm&C4rnK2tx6 zUGm7|e8z7kIu!A)rk9T+L>0BL;?KsO@!K|?T*rjw0<&Z^6pW9vPszvzTZy;9a~yaJPv zsnY4^4~4&YzH9ZiPr5NGq;#m+g5toFN4#Ieq5GMn0$llsLNktQhwu9u;uJHa?V~-J zw=ODZLZ}&{(Y83(1s3Xk&+jq&>}p3SJ!Kc<=Kl6e0-}7JM-Afo9PZ*t2@@UwfB}ym zKG1p74@I*Hb!Ny%#`hu(^H*_cL+nf~F@)l&)rG0hbc9jW6KF7e9|=Q0{ol_Mf}a_x z-NFHuzz}Cja!VJapgJXjccQB(Z~xE`PE9thK z8-jC{b8{k>41R_zQwH^z{>%XR(uQlW2IJWIX5I1(^9l9Igr|U9hYL|>h4b2vbdlH_ z(kcyK{y9xv>I9JQVxc_iPZGd#7iN5goBPi3XWC7By*Sb^Nh&dnvl4Q@SaQGXvT1_i zuldy&cvs211$7Q*m_GBd7}U2q#b#=h3d3dniW&p-*!G2@g{0p=G8Zhip>2rP^z)L4 z-nlhNOmW~%AOnO+*)3C1jDuEBZ*{szOS`YWH#9SIPE1Jn?CI%=Cv!#qfxASbHmP($ zCi7=!zD}xA7>5Y=J!(Lst~Hab^{jZ=t%A9dZ?e564=nZdyi4ZLb%$iBmD0J621YOc4RGOb30aLvqIKg;> zgHvgGeo`hOLCBy&6+z0bG%Xk?j=D5$wq6?iDienCdT9(e`aEh?ENdRSmBq;~GwHd6 z4>7y*XH)a%5$0oQa_ob7X1;;nzvXTMW`=vsVg2TEwJxD#p=KQ}#GMrs2t14b-i#4e zvYQpOI(?`RLbUh#_B4(gqySdqbra4&C+#ctv*V#UdO;aJv%j*25w`QuD@j_g6beOK zU@3$gmN&Jxz+k{<&&V6S?oxi?)?8&V+cqi`2Kg;Lp^ZYln4cz4pxyM|tK>ky1JAs- zT&=O?5gg0+|G+3*m5(KQmJi(8?+$qmX`nD|hn=XyMYfDZ%UF$0p^F$yn(Vz*b0u^t zh#iRy+c(d9Ole@LCjt+S6VT08%l__{lLbWWqBz1=j{UYUAhG;_4P_oe#KEnShqJ_H z-h#xQNRWw~v55>O_J}|7b3jgeWp}`y!npJG1y~$~a6?tEQ57*Xb*|k4tY&6CFYT2C z0j9BoP9rzN-+fZiaObfuCsxf(?`NUj*O02}A_|kl)0ZCpMY1<6`wS#Ho2vMG2)PrM z$6D*B*($KM^RAA+nSjCj?TX4-o=p?yhkMlKii4#v@#U%KYa1E%KI%L-x}>Jm1v{t}tIFFguN!zek*qIx)O7 zsa=9X%tyY0a8#N3m|%EEH$>OtWDUH63^WB5z8q}zxmv#0#9X|P>IwHZF6cBFZ7%Js z3-c<#(WS|Ue7DsGXPd&jZ?Q4;sxmMsee+cPp*wMipS>Sq_5)48bq{bcfa@@HUhj4x z=@eQ@0-pVQRVX1#SqH$R8iRwDyH?OeW>*)xk82P4Y7~Nqk~}fP3g)n%y@tG|n0A*9 zQKFj*saKc$2E49|refE3#;p{97-24+w97VOsCxst>hH2y#f|0aGr=||SJw}i5hT8u zRnZ2qWq3a8_}hg?j3;e-Y3!8u<9<%H9oDyfeKHJ+?i}9+GXt>d0kRdxfJwv~>?v+X z2@ZMXxVu@Njc4CS<0zSYliwBCa$q@HKZDQxIpEAsbn8XkPXVwY?5+f=GgcR-bhi|Qxx^39 zV&~cev#tGIihht{z)s@R&k?Ej8&1gpJsHS?_#(FJ;HKQvL0SLbS{OIOww`W`9+;Yz5T9gi7#h zUeenscuNnhj!JKtm=VX^Thmh%QTzyrZ6ciDDKJP0QwQowo8F&)-Lw7tdsRRWDfoS5 zUa|DXPaU5!2*Tchi+Eq16}@1;!kqLJ_^~2^|MUNu%?FIDd{$Q0Qddq+NV{%GVu0Oz z%SUu2&a?fDhQ1c;Jx;O^oAWKw7*rIMoPghY@n*t;QNf%sU2dn0Lfver!73W(y627% znJ#Ep6M6HIuHPenYW9Mlf!U?lWgT%VLvU!(#6T&Ivm&e z{k4pRGmI~mtF!kU@YH}$@G%5&M_SBxfx*Bf2Nyk}6urt;a^2ByZG5J^w1m@Z>5<^Cco$I%3hc+_K@{VrN;`!Ddu8Z$+>9uDPVv;^8T|Q``bk>(&l)!E?aeP+z*bFOxz`%+`k;l6+5o za!{D9|8ep|jU_ObA~&Wi7JfQZo@7Hy6=m%y#5ai&W$?+rdoC2ckm1fxNY%r%6yQ0_ z)hGx*$IQm?|5+hPEs!|AUeHu=!|5H}ce64B>mQjCy)x)i=>E=*9zI1NNNMtPWu_jJ zKLAgfkQC-%=0Fs>5Y0ys9*q8p3r4KJ>5ngIg7a>>`Cey>0uFJR%}j*n)7us)c~2RW zqgCPf_Wr$;&T+D^{u7kKF^U-Q-}q|CtY@ia^8^2tX_ZfqM2pWbfhjiLatLNd+>SIW z|Hl*3t(5U-=if4<#1iffo45K2+>B=M_S+mBJS1f_aSsp2f29U<8-}|CYT}&U3Y4Y_ zY$ki*lCOW4bw5o@*NE~& z1)YaknK|78dVCh7uz^5e&!RtG%$%WnTP+J z1#k5gwfK~YI7Kyv;aOLx>1p&-s*-c_?fjvjX%p)=N>5$TljQw_i1eL>Ig5u1bVCBC zsZ82;5Z8zh^Z4!b%rRjwisx@#&BeyOdrvvVSzHVQ3QYw|SqZin>iOXiX)UB}qCklg zT#&AHj~Ry?oxo}oAX|ZwVhHhCM4Cgh<`2_LFTP1<4{ZrnaQ(Gsx)qH{+)GiJV z2;lGV-c0FYm}|9G$|gxXW*&YsY%Upaz86~0C4L>~X#$WH&J~pXCHTX|OB?lq;5?U< zoPJxmAen8Ivjm_AuTT^X^p;lffxuR7-?uW$%c6frnaT2 z2@+@&Aw|Y|Hz?HPXNKwMfn{&vK_Vx;n>yi7;GRX5XFVBkrQ!Fl3pd@67eAs^m5{33 zwHxGKq}e@QEi#M$fRh{!5+`$hpb%w8H3wa#7g^hu?rcdk%)I6Z*WeiFdFAsitL^!p zKc_$knEKU04#4t8QwuxNufXdj{t~CdS(#(d!((z9pkKyf-7aAalD=W{fq4@zB@i&6 z6eIX>YRc&5yCUjSj0w=pHpSqSAXSfRGtc$Ovwt$hk}Ou}v;KQp^t5>Tz{Ay{)P3sW zUx)Eje_U1;*a$j`^f4k}RWe3_ITXyCu1Upw{~j=~ksc*Y9|GpcTchVZiw!0b@3AX>nwn$%@K6f5rcW*32T^=s|qC+19IlZw4TlzIBR$vn^N8ger?3T&*&J zB}>D32C|Bb+{u6179V(VZ;hVL?wQ&D*#8_qOMyZ|91l2)C65Rp9_ zCdu`jgXQ(jIOZ&CsmFmU|9V7Qj(Li|wpPKKRvrUYxv1Ai{WK3~>(OzCwP#2uf`+7Ei-hA8*c{rzFDq<9tq(86Ikkh5wZ`f+q1Y$jPek2TTZ(5J}t%qx`8Uuc*h%~KNa_w=((wtx*T`5m=h>Jhr@o?7;DOh{pt-4h<Y-ry7*&bocL{qnmhXpat|HZg8T zLe?cHFz54|9axgwU&*EL$xvtNk+;m$T@+r^j33X&?e$gK`gy?f^Xj2g-cTgnb>uY8 zpXqI3p#|D=p>|NtpyYQFo-(^xCHIZXZ&W{QC%2W^eI6f24j9fo3If;|0iOfg`4mP&lB?guM7xTQqdH`UpNbyeP zt!wvs00XtyfL%R9VSDCq-r-~u@$TykY{jA5>-WK&eQW=@H1ZAfoELyTdS8xBNu+-b&i*W(@wCV{-qMS_JrZ-Iu6DAyUFY`KaG_f3jCm(wGs!y^j< zStH|}rtuQ)qLV@(Cs78u^3i$J~ zXUc<{^!=%2fvgU$dwH1=6L#Cgso%_{XpE8ZzhOLUFJ2%NgC5ZBdc{es$Z29-N5Qcr4=iHVQ9_n6|lX+rOO^znQRcyWMfv z5uF}dL)FxwlxMQUYi|=)ugn!ynrDj0ZlIB?&dBznAs0~~{>YS`tXiFO-hFHBU&Sc? zH#9*Fa+;R`?H5OkSYv3k?Rztl;EcKje#e=r*5$C3NA5X*TAEuH4D?;wg@k!92+Q?- z9@Ns?&wtUQdwK1M18Ut{Z>n^EIa`yrAQ5oW0*CWrH~MvlvBd0n>NPYG1$_4JOp2{AoP|K<7uBImr0q>l&NU_Ir*k0I6+bI& zVkLGoBP}%HK=~`dy>fv2x4`hG0%TARK@cNv3Bsdv5c20CztC>4g;2Q&`56s_r=XMD zM9&yz*BsLbKKrn$>jp$SnV_qQWlu4}_DeBPD;weJxlT)iuP0;VR?6Ri-t*A8R|Gs< zU%Fj(abAqOlUpuEjV?a)xo;wcw`ScuRqS z>kyuYz$*}nYKe+_D$!T{ z1PjdW<#}#|^yg~`*pz=cvGl$scPT%l7<~_`eMEm(<3({Eh>)9IBG1v}nVSzaO`AMB=7UC{mr(Erp0_!G*u>GOPN3$R0 zpOESCm%%xGr(4NO)UMX_p<_|nzWkxdlfazpq@2*J+;&QQ8|Km`ANWehT!kD;=;eWv zHaVLBAH?WVS6}o4idEzGw=;F%dkkbKTL;KyUxe zuC+{MI%qr0=B3j&IUX7+rHF0C7kf7+~ze!-rH}JssUWzL>{( zCpW64%w#R+?3xw(wXV-m*&3uJ7wNvKQNmS{P1SQ;ayH&A_Mw8~*U~slcxIukDzFJ3 zLe1@(V=kH*$B~rT`8T{OquU;5qszavn&`le_Z9Em3p=A5^5Z`#cEj04vM}KaFc$*# z(Ziq<}}_e*Bnb_P|_Xg*#}!Cf|D%iRg1mEVIDx-CUX zMC-OCw!XU;FYLb8XZ|7Q=s-eS@)Vo|t7`44|3u0|t@H)93Bv~q zVva!Vvwnbsp0^_$(l8~Jmifw-M&Ko_`Kmd9fEP(^I>8W7R3kJO2UOsGLQ%V8$4CH%f87Ww43J)w61>6b;K zWbh+u#|Kx~5ZJ-TF4VN?;JUYPYNDGH-{|GjX*jp|j_WbhxOs;7Blv2uLK$!d+=k-> zEtA1Ypu+UC4Z7v=#Bp!s?!p$1FX0oM^eDh#F+YH+fSyP+ZtH09XdQn*%k|+l(w3Knr@*?G`B|20%DIAAO%|+H`ee;FGulx{kEP-qyvzr{zFhV=h9}=b_E$|!VVf9! z#vZRX_1eyXsc9Bu41vq7n#cZ{azW1|qo#pM1gR!K3PmkrAY19!+_#8NR{-d)MUu04 z@Bf+nMQm4E!ZI@~(R%RJKL7SB`Ve<9k(OqTy?jpR`4s@g*i8Ae>;0CU`lHftr;^+!n zeqr+w6UMqkm=A|-k4Num$(0b#$`CAl=v|hdeb^{fU}F^aP&e+u{d^xccNLz_98yOj zCoVSaJ|3G^hc5=n=@rVyeD1Tz(sagW+SJQq;Pd!@tntG~O-8|p+)%fHN%qN9tC))& z8b2T>%TO`U(J|RyMDdyO%V-6d)aaUL#Gfng;VXT#qQa^HqfS;gKAw|!hMI-ER5ZA~ z8Q=J_Vmxg+R%T`7VvrALLAEX=ZLZ&baOR+d;xLa{uZ9?GykO5wbVihH+`h&=quZd@ z0Odc<{F@QRc~$$$XRKNeue0*vc*8HG{#77#JEzZ&*RwTliQCgPXw*w@5rjs4IY6r5 z!-d1jWqjVka1#|ViW{zQy7h7g%Eu;90O)VL50cwVfNopi1JYM#Pc4VtAbeTg8#L_) z;YsuHK#{-~3#G6cXv;)(QIZ82Slp6|O`74d)w{2tzo2b;(QmD-WEUTnGWqo$fJy$H zg~);tl1b}DMyA~CY;2XYY|NOcLp1bu4l@prgurfgforJrRa1rY_8YFoHKz#}?P@Mm zKrOV>kSscKFTUlhVHk)z6!5K|TwT_#!{$tg8`t^7(`hOr7st&buZ(JC&@uC7`11$S z{22ZL-&u>@Gyn;H9Pok8pwHta4OD}bmUYZQ5Up&M3)sl0^^xPOj)uT^ z%WWGyzngQD;mbZ8LX{JjX`(v&1Pk4y@7O03pDDhNKh$fg`|AOmqTklVGAvOtE}|7B zr&3@EPjkkG5jD$?&-do8wR0xXR!j0Zf=+yfk+sO)%U2q0O zILtCyK+y+o23qxcLZ7WQew!`7&v(*(@6BXXYS_gmqr+s5B2(~^xac5m6J}w`XIR3d6jKFL1%$fHF zCxco*-xo@fs#tv0Zn2T*auVH4jx#hA9*J;g@u&~~)%HEYii1lloUeDLk{|oDs*J@H z_P>=D688jW7zDxq?9y^|*a36MQK+43FjTLQFw-Ouk+o2?Tf3KiP0>yzU;iR4Pg++9 z+?(($!w`vgQP0Osy$s{WM9xaFU|XfI8bw>oZZ3KY>dj0ZNa6!zv@GV4@Rr~ zeIZ|GwRSp@;KxT8Y+87AwS)kBNG~bxaQ=JRBS?b@9$O1$O})Cer||J9Biw8-Jy_D) z+glV!;S$*hD-7$V008|mWsuBA4&c{k4BG62@TaI$$p>b%d;+ZKYA~*eCR@ z40iDh%nbU~es%FmH2x-Fd@`|q_Rb_#Cw5Y28}kHC9ar+Y>*IA_tpBcgK)03j&0%bs z=c0eZ#cmBORY^%HDAZWPQ|p|@yN$hogpj~@KdS9tx~x!{v;}+@N;82)BYVu>VNPsRd?v_2$&@?lZ;NLyP$HdfEt$iiye6K4< zWzvZx$hgI4)uVu!g9fFoqcdb1WD^07;TZ^?sG8t=3`R-VX~i-QZ&E}*w3a-1$GGGs z%K!S9U>vl>->E_E$iw9m6lYwPrGLfH6K}uZvs1>b;;iZlhJ1iiY_!{b>C9KUI0N~% zj1bUsv;0GK%DcZrubh~|N{PVlZ%U00I{m!A8%^(Gs4gTgUdV=_>ZjAfEOH)=c3uGkWNZeYnO+W)+Vn zH4)napFVHCDx~FjFfi9-+BpBNfSvgekW^T%pCx*rap0{{V%`!-pC9;(ngY@N+-vRy zU$5>{E~I?cB6~&4h%hK%zvk;aI;3!gu)W}@kwM(!9{3+HY~?Ar+Wp23sz-rs z8cn}T%Z!}rh4y078mK~l0AA%qg=Nb`a5qPv!YfwA(9IVgjdz(k`?{r+Ry8M3f9lCL zgxd~@7C~3Dw=GrrvgyM!zwa#%Si6q_nUNb@`FO6;Ekx{Z!Ac>L04V;kOUls9A#b%L z?Inn{EcI>#$@($wbX1?s!xp-m`ZQm&;qXqP9l)9ih0sVqSuHh92NWG$dI*kZPRr`r z5psR?xrwp*7ViUB=NjdktFA`AT+C_g6*@VF_wk%sv{MvGSze{7WZHo`ah_4bO2A6&8!n@Y{w*Bx#Wpkk-b0!8R5D1 zT|{MyS`TI4LmIhjN*_boT>K3P-gr+pDCEzqf)M#9tv?4b6q;GyvcsC=5O4lw9OXOM zBULT>6uNxvf)+GL+vqJPT6(M-FsHC^JsuHK-!lMI<;5XOfcg;~2ZBqay>zZJ0kb#a z3^5*8ohoWZU7@=MT-BBAEwaNG$a`<)6X67jSwc*==OqJcQcRI{)B^u#16d;?(1Rl* z@OM>rvfB>;ZYk8~`aT#yq(hCTT0IT>6|py0oN9%>+#~EdxKPO_{olzf+^2MnCm_fQ zFbdO5b~0deQ!5{=zQjlyKU2b?IRnZ>9$ul_TEwyAwcHPmJ4a2)-I|2UcFDc{M;Zte zwcV9C@&X3smS*UamfW3CQWTl%d3fi&bB(@(k5iv@I%(75+oSo!9kbsKzC9qr?l9Cv zY$s|PG5;eClvf+Z&D0_YHdfacbeD&ic%_#BB2HjI()VW_>y|tvV7LIGh=`Oh@^Txe zU+|8vs96S;#jMq)eo+bQ%v>evV7uC%u7Ls=phQmeUz!|XPqbJ|Lp_uz12dBzv{2#+OJ8G6ban>Es(!x!QuG0!z(r`sRw(sO^L$4GQKTQD4nOMe_KpDK zbyET7D+nKacGZmC%1LPg&%q*(6<8MjEeb&#Sy~x7VxTQi-isRARNQZ7E1fy+-NG1{ z$jGXHj%?daFv5Vq2O)NuqNsB3whO~fmcMWt)?zE%Y}@BM0y|dUPmhDKYrth_-DUSI zqw&Wiih*tGI@p;0xN8eTob)0r@j6nB&sPS7kPmT?4XYJZk{!?dxvOsXi4eXM!Hbiz zH`9Kn2;+W#C&Lg^^hf{PKoJj-3TUj&I}k4jEUlP5C(&nJcdVi<+>!IC4Zo_*`ttRK zX7r>o6k`x}k94vYgC-w+m2*<6muy3#zCxvjiGz7bF4|M19-NLSJNPHCBG{wvQi?mu z3i$1GLT~4G^&iI{RHBo%kZT7%3DSD{8$d+5qFs$IP%PUA@g=*`Vw8Bl?{%$zrh?aD zh4;617r6f66*d{z;;jhuu1M9^ffgptda9==f?dG zzWbE{uW`Y9o2U?zzd#;n5l5_)A%yBgWl=A7gg$zePr4ga5mO#V~Gr02!)dI#Zj&zi8W*s1=N` zs)J_|LH@H%7#NU|qpY_;{%JaN=l*+yd~vSopCj0v9PyqzuhRVIfnBPA(8n}q0N3+Z z3h7FV>t%O~@yX>L8?M%}=VF^bTF4@a7%BMsyv=jxudNHkP10!vxc~pPdX(o>QnYJn zeHd)at1vvIX@pcmxh2}!Fr{4=HC^anbMm+EDLF2fP$FX!6KD64k1_vZ4DJpUg3fbv zmKM!<_(1y%849Hu9m2;OUAm6e9*19D81sc+zyExpa(nvBZM=TO2>ZW_Y$gv@J8X2f zqFbVrOte%{IpF*&6T8$J8WC-f}(%h}O{Q5gHu9Qpae~z-j18U~Mk-o@# zHgb3$W5O9`4+}*bm!PH~dUD)-AEZN#q2Te}-hPpt;363A-}w~y#G>B!Dd;Cz={8n| zCPh;m-m$dh7~Ryzvp3f_z6rPJfKTva_S!7#*-&5Hbs}zg(vumM zq<9ESQpT9N<+#<%e(*zlIr-0ZKV`Kgr^<>K)DhwclDP@yJJX1@C}8VTA{%{&d9RTn z(y~wCm(4CkuSYdK$lUCyM4=Y@>}FK>MG$EWm3_2Gc~h7?GQC!dO4a`4!h00!XF;U5 zdbiM8wGFAvJ1$|CU*W%`Q5Hf#;fb8rDN2i zVFB6ciu*To-*6#^RY?vX_t15wsK~p5;SKCd+LSG93&?O88RvUTe?4^3;Y=6rQk9YK z=EpkfeWRZ2A_bZTx*rA4hDJ*zrYLPu9Iao8W_Tl@Rn}^ODyN0(I$G=-LIumh zN*O#0Z*g$T$e^WKX>C2wIx4*2Q2~Td9uGsidbhU|1)`vh`UiA1)yCzAWv=G;>M|Xp z{JGW20B^>=*x@A3SdbjJ1DxP$Ot_V^7`q)Al*(A|6z|t2lf&9s@utpdYhFGrFF!gf z0=I)lkV#|#!CuzPEb_KA1LH)pua5<*L zlCY;5dt2fZ>>1w__0aB8paO#=EWUnX5P=mpc*_uGRcIRF|K6z^S>@-a57foc5~MYI zn}8Y~`3PYd-?29(nH4@oairZ6KkKXrhz~8r{$^wwE)Zb%zL;Buha(fw4EF!(jaYgP zH6J&;NB;tus8w|^dG^D^DZ`dI>V9C6QTBTxt~rU9a&^?1|4N+IqbapY!O8n}4x@YJl4i@5sDvB)*M*2QOYOl&`>Gq+y>8i59pkDW zNu!eG<7z8lcFNVBqbaGFRm`eZGZ)y8`AH=O{TFYlb(FyYDw|7vLJ`|lh{!Yf!d(gb z-|Ip{xj!gcn(l~@^rJmA5B}<1{Mwhe+7%X0ovOEs9QZoBZsHkC3a6nWwg%;WYQ)fO#w;VK?u`G!QYBat z<`s74`g4o_GO|eEFk?yJ#x;CL)zG6b)_kM5 zJzqJyrf0e1L+*0s!PlLmz?M!6LKcHF&G{@si$(p~(=m3&?E4Ps-7`o!f!{@LUhNsB z85M$3OIyWxs6w-xn5SzFvi- zMr03E4D5)w;QIcg+H4bohN26Xkq;%Wzst9Tq~x@!(pjpKFHhEo)zO^66nkQL>-+Bbe5%Vh#!t+Qs<{{=Ae@5|{V9jk z`l!n#vGESMZ|JAEIGdmIA#YXDIDld7jcASdQ?{mgVgtS!+e<-o+0j;Ek>{f-nVvb} z=YmjYC;4wa5l?A`DXQL8R4}XgDaV4m#xUl_?Sux_FJUf-ULp3$msMxz4+mC5l?AW{ z#_rj>XKBP%tN*btGGMoPg8nizXG;p2w-1#`rowY4MlE6IQ`IK3y&_iCE%CRiwH<<= z&N`%vR^Wg~-X}4%SGZF4| zhH<+4{y}GsB#>6RPm+2Q2B+%i^rM!mOE=tQ#G;rGQI`vDy;kp=S z_*ue-qz#%kT1#+QauN@g=(ENjmtB=U^dl5b6YuwOn#L?pt9}w9+BQat6rk(1Eu|w7 zlcHHnWW1zZt9L9$xPcW)D>to+B@u$D>>cH zFED#Pk2?mn1P%*;dv823;nO+Fzpg< zl9s!D((dFYG+JbCFtA+I9*^wI0qRMNQN4*9@r~De#Y4CO6CEOdAZDlU&5`{TW%<-s zOGtd z0_?6v5v@ehMyrZt7p11XRcazaCc&$^)?VIDIj=W{NogiOlf(`8j@xX;q>@*T(9Hr# z7di{O*N?+uuT$1sGPcewzIVOhs@PfF5zii4ML})+hy8B9iFmzY(fp-+1X2|KtaX4P z_^4$HE;1=H=VV6+&-F4lXuCaau^snq>&XUk*xvxzKQ%}Y#WrO9@zDWY2+-XZ|AWL* zL(K!g)i!&)(Tcivg<%(vy5}#3Jj?1ohT|1uny?Ljhl3VZSD!a%9-j$%c`1fb?@9K{ zNwz!yOGNu*y5=p<(|HzdVA*IfDrdN6a#Jtl6d5ruuJ?MZxg=(4P-x7zzy!nGtdWFW zqHoo(-bh+`rieJP)Lz>ki5LxV@oeWybWNK(czLa8I4%9g1yv}JygdU&TVFnm6?h02 zv9f{x7`8TEp5Eg3kvDF@{rHZ>wZgQ3ihp?Rb-|?kX={u@;)DFgaa6haI+17RCj*q9hG$p zEu#1L+MNfZm51A9d>|u|G0FNVb;IdVur&B- zWnoBj=g7=9a5-HsC*Y}u^<+dE&g`D}19?%E0jYxm^7Zalb!XT71{XIp8_pRQ&j{hz zG1~-m4By64GG!piU#nQ78i%=NsUjZJE1@r&@2m zw4WmBu7RhNeA`os&83jub+4Gn5f(8$w6oVtD9u#_Usq3GdcL7?w}O7;<3^Y+BX@L5 z>DY49QPbdfvL@i~>!ziEb`r~LRJATj9|CnRV(m+Z+q#Ddvw)z*Q>K0ysHmuu60~o6 zdvT*C*}6q+^iG;_RhG)RpKmUYVGJeHs`Vu?`7ssd$%ZXA&^UL}H1f<Yv-y zm;G|#I0#$*ln+Qz)Q?^r$Dzvk;<>I<{H3!i$5(H`b-Ivk%I04F{K-}?Hv=eQICHjN z+VR>uxx)$IJy?O(QrBF6q7cOy;n@qT&s(OQxgrEKF^Va>8uh9fg;GnsgHIfyKTQAf zip2p}&8s7ERI#iJ+EN;4z>k`}TrwUgoQ`aDx4fpW=T6M=CRZ9TPh2@# zc`j{av;aI~kCMU~+aP$Vi? z19TIXTAD1R?yXO2WhZo?&oVZd}3>cm4XeqA^9!G{>y~``>-IV1W*bCAL zoigpT<9p**|5hU8iLbp|tru&2pNgwjJCjB2Y3zVAvL!uvzba$7*OiPY;G%5HY?^`? z$}+vm?<&rcN5AvZqD_4^-KJOMggZ>bWw-a|)%~j0M>yOSv(&CcaH&?XplmuysaNDX zRqwM&v2ol3qTPJ78CMK)*xVW`hn%PoI3dr^<4d2QTWo!lk-YXixO$~7%Cdi3L;>}~ za=rTg#Fqpc$BSRvjVbpAx=LLk$#&eD?=Uxee0_7LVto2X{ETi{4BIfqw&ZeuWUaZ- zZ@XcyO1CoA?u=Fzxg{+(C)d_j-y@&H1ex{O}10j z;0`tp+`pqXG}F6RExmSuT*kr2p{4{oftmQoD9_DS;4Q%7W@-IBWHfBlpPdpYt&%BWG2S#}Hg`1^5 zzPE^%Os89h1jGoMqreqXo^AvIsfC>Z6iS1zvf~p7W?aWJ0}vQ z09V&0?;>|D-rHL##HW~WImitsU7)EGsxY&;j-zhCpC zB8%#uQmb+#AKHPyfznIobu0&bgh2n3(}&SQEvT(`e-^GGiTnmDO1Gn4!!9Mfe0aId zRkMr;AR`<0DSMy};nZWJo3{@@$jGkSj@?oCeYX*ADI2iURr@`J*+Nq9twR@AzNzR{ zwDYEw<@*cw=NxxZ^;0%xXr<1SGb8bzaQ1y7uqi;|Op`1G8Wvo1g&CZ%<+6Ry zZa>&iq63Je>ZNffBcC<~OleX0Xb{Mxof{Yu99qGnbaNeP1G`0a5A&zwi{v!tL2QI|Dp#gnvVu`*o~1FgK=U*xufr@DVWYLtBNLkv4b{ zFZ5$Gg%1@6%6MZE;+=6VE}L5MTB-Wj?@$=uV7aBo!W`#MS^QrwAlC8fc2Z5jl_qEdY;r3Y$axk6M#LPGBcbJ zbOLfy#|2J%vx8mi1V(7!iv3#`aU1|$zSGA4)Ad9TsVSGEera^S_#ww$k<;1JE9@Vz z1HgyPHnv&&e^XX$;~q4&YIo8!jGX=ub5}9(7qNf~kpzLi3ziO422owK$4Z`%Sgy~d z;X=@YjWrwzIZ+8MjVh!d` zTAP|0sFq=@!J!wfw64K-#mavX7yt)xA56x#dlBbk%!IEr$xMw^&cm?8ULYxbt94g? z@b^C76$3)_8}5P41w#b$#)sD*YU_uaXn@0>>eS0d4DJgUi&n<}`}{yq2|P~ykHi4^?5=aolBk5|Gf?Aab%d3-_h$nx6G zSN&Z>hDnt?r||D_B42JOS@wkf@(x)PNu|Ri`}cZ^66||-)MS`RnB@QP^x_%;UP@%> z-r{9~Zi9ng1%IcLy;l96+XnKfV{M6~qI!q-UQ#J>`vH!nIoaJe0k9)?zf_?(?@(xh zBXS%d-A*Sb;ZCOy*nh}lS)o1mAX&_nZ}?@Zzl`wRCj5Vw@PZJHZt#9!AaaVJpkV9F z*}^^-KA4Rl$3BtWGYmSZ~2+CjbAvwAcP*_rh{IpbEeJNCZKk=QZ)S zbT(LhpE5at8Mn35nu$NQiD`!N7b!jSF_6#>U$;+QmWCez<OXSpiT+ib@0vD zZv^{($m2eq_g<#vc+y&X->YF$ls1h|pBAJw5H&umb-21KLiyW3-1SM`5{0k|g&uRs z#Y4ddJ}9TP4Jlz^{tX_hTCrgH;H7|z-tqeL3$n=*Uf@_f`Oi9Pk>oA1Nd7^Txil?# zYS*CJ`;A~pmrw0c2&zh%UzfDV)8C+%MBds2@7-tk8V_tJ4k0OXgSr9v1{2^(e} zn?O7D1G>H@v>~89+UXnI8wiPC=MCL4RN5u4wH2^Bvj15x<)RcMtF5jgBLLMIDQ6E9 z&CcGQ4+(CZ|01cqRfsi`=1fSBuv|Gj-~|0gru@gKXCUFi*Q*E}S@22C*E@ z6oV3~iheLZdS?fM3(*W)S_S&P80HroemHq)p_fD!cr2cc!#Mjsc{O5di|d>g=q>I0 z6;3stp|(x~r<1Qd>C{L$Xh0VLX?K?4cj%C`^nr}}F)+K9C=`CX*P544o$rL4U#*Dj z&NfuMLGyxTO6E8K)|Jgg!%4RadiBADW&Ojkh+DVFNZwUCeLy*sPn5S@T#u;MKKkf0 z{npf^=MsT^hy{@uM31v?lyR^x)IB_+*=2T^b-el&@uZ3BzS1O)z3Hf!4gIC3%omGT z1<>wt(m+Jz!V&cuY%?Dv@@h`5%#4m`g>keY!(0{U@u}Ta0gQjd-07~!6$}w!U)(Xh z$Ki|WZ86pXJTe(A_^C>!ecRcLT@GZ?8_od8GF( z(-ZV#e0~iAx*_r0u1eo@8C4jBJL6->@1+?&{#o7fOw_(pQGu-NQ;9&5`)#B)aX$zo zg|Pc5Olq5v!1pbIF6fo#UAF$gXwEejkI@&@S1{Yb`^hiQ4RX;CA6!U?sCJ;OA3Ca; zdwJP_l2Xj21uTfIdD!f+l4U%lOLW5XXH0h90K1Q(B;A7WM| zNrj*1gfsF5AU-mM++ZgxfKhvA2cU(L@}}M}U=-2K`Nn|oB0c)R#W8#qij9civ7WQi zHgE|gs)b3RN<}|xs=EFBgEVH=Z@&?~duk?C?*fxNPZ1Rr&AFJm!61<^;SS%sYYr#0 zxy?L;yavQJ4arz{v?rSj+7yY22M(w}K}Sk3qRLlNgk6~9(x{{>wF zp)qcA%tWD@o=XpVB?Zk`;p4n-^0+Y_ha1F5y(%_-5jUu)M-J~J0OmA{I1Y#X%x8s9 z?_DCqu#JX^ZAi;=2CDm;a4golKLeccTs2L-d0>PL{}R=ihdEDY=CTsj zi(W`L36rC*=i@)n{nlHQ(uAfzv$xiTQKC!QPgM?8vul^vGEWi(-jVS&MMcln-1iqD z5TZtC3`0$j!Qe-rQEqsyuyM=mQnjx*A>c^UEH%fFX*8p7hjH`78` zW#|n){@JQm%Bh~eYuxHVyk7UNd^gg^VGET0B*x~eYbJl9%Wrd$xn=S9#nrLre=LSu zn}21N;*K45z7fyEZEwW@#|5Cemv2o1Vu8u3xrInVnd|G_4(6BsD@AFt_xuk0ulHc` zN331yQJuPW4evwq^UMVFo-BKoLY;BL_i?Y<+>0Np!f|=u7dN{kn^5!q@L6ZeGh>oo3)PlSgL zfKfjNpWFF0qn;VI55C8#NPTwJ6WiPE@{BYq4%#9gXq{hq-^Cu=7G5VCWf2Ifw9Feg zE=G5*7Adem=NZBJ*}%sA@=JGQ5Uoq=duj*f!mnnFwm%P24L$ zpvUkot?5R(ChR;`6pgK0;omZwQ!;zIEts&g)WPYABz{RTS^R7;-q^{mwL0Ld8EX6H zdxZJ7{Y4E6@%z?kSnb6-Hk42;tR;b}MT&?5ZO1$VKPfqxQrg~h_Ce#aAN$Z}aKrNr z6}~2+N0~rFQS^l45?P*>=0J@)*%}U23Z-@H5V1b^a~XloVqPa8RI4uNAdAWhH0g(W znA^CMzegtC3-{Ca0&B*yoiQx;Bkq@MY@qGqf>_?uj-o*Vo!4$2LaBDp=A5YbQz zU$HyTzg7#R)rF&I?YxN-82_`&v2NvS-yewT_OTX@SLjg@brxY_QN~hB+ISE61yst# zZk~iwk;W%ld@)F(*G8glD9L);3*N2r*#Qn(f z6Ypaic=q!kO>h6g%p(mK@KcfYahW_$ZQaCe2Kut+`E!n+L^kq%`dwc>Q;S*rz0_ExRPwB(%i~wt3mL22ogf{>ZZ@d*36)k{(qpP7^!p zGqHfgz4cgnwyt{2-<7tij+_IOg~Zbc)FVw4qakykR*YQ=I;1!}AXg;cXVdMwh|_lC z?=$3ngg{0v@V#X(QGj$pO}qlflN797FmcbC+r$r=Mu-!`&Z(A1?|S%;uYT2UaZ8#zE;jHw!?ytsR4exxEyp&8{pxy^=~jdTla_IL z5VT}h-uOi05y5PDG8KZoD{nklM+ZpN)v9a~2(D7YZs+><(M=>9xSwK!l6D-2TO{H@ zB0bB`TZKA>#&G;bt(oe-evgtiJf;`h%OiYh#2gb|yQQ!eF?v~*y!?%V>-dzrlCbLP zB}t)RG{Q_jF25PAa(|$l66#ZJd5ZpX?Nn{GvJD?=EWwk13dOey3;OpI|hABi3HqzMP$p|hNrW&Jgh4ct84YKOb$rFzm;O9 z%BATBJ7UKoSVu*j3IieFlCi_4e&&?pCHmbieM&3BD@Sdsib0giTV-o`bcC#esmnHx z(@IKv+UU^`gCZy&w;c~10#6lhg>gq1Ze=dbh8dVPaH6N6gL&s+m-qIgV7GnR<-|%K zIpt}o(xYL!Sr$)35ul|{h9bbEjU|nB zQ}=HwAR&nsT`-!+qy-H{;Hh6*PA}i|isuEWLf?ZN+SYAN5Won>2pp{o_buRVRA7;S z==t=fXSWjsMl$?ThgZYM5_j_EEc`8qofF^JhN33$Uw&oHe&Hw$!@4(am)&h);1jc@ zk;f^0E*s)I;6!14np&*=Yu_WPrQEc^?Lk)+%U&MXzt0be?UG*b=~MxI>5DR^NyBkL zOl$voQyf%6spb8%bF}s&i#PFS)wy%4)XL`~(7XiR%}GW6+e9_YrKQ;({)11S7fCpf z3^alwoh&6AiPCKtwu7 zFQG~a5NbjXr=7j_&di>2&wX9@H8UV{cm?%i@t?0eyTI}D zqv^~;NRSAXE#ys>M^BCo;|mF_ALKR2$}b`GZ%rFzTAW?EnwG*989}-t6#~l&6Y6*c z`(QJbkrHN&?6YNp_k*;t5`!)q+h+E6Riq)nu>rWkmC5=Sh8A7Q)PNr4GWq7-mB{we zVKYXs_UHeTN=2?$D`7U?S3LT|q@6AbZM}PjUuoKlWH+GPVQ6lMV zY6%30SkcD9D-2^qTi;FR2(l{5fFyL*j6z9*4JY0$-h`pbnsgGVL8%3AN68lFrl>(! z3I&Zp1#=ce?#(E3F2il6P8dz7iA_bHP&ntMG2O_AwPKdH9dh4%(7}VO#_{*`iRSR@ zqd{~a4ITHYi3~{^!N?q8p<}h>2Hka&^%E$~`Ut)saS<4F%RZdQ$ zBs;PfZBKswzB<^|+Zg`gTEL=I$jdFvafHU9s|nd1FhDr-vMJ#8sT`6AKIG8;w7ey^FS4@LW|(_p1w< zRC)E@%{;xiLPll&z&V^9#2uU>NrZOO6zmg}b)fGhIH;HqU76pL!lzMy|FS9t5ZpDRioQ>Ee4JtP0TuIHid zLmzkB?@#Blyg9u8Nc!TgbwL@6Ugk}Ws*5t(^l31soXNJQ9Ccy>+MwjSP`wJud(mFG z!<0&$drz+A-3WDfR=4y~f38aT)@H7XS&nliZ7Q9VVS#PX821{6YjINJlc2s#kd{hP zo7t3hYX69E2j2|TJ3GI%cKbq8$DcRVAN-J`c0qGfbZ^Sa5Utj0-pm<{)@BZ|evS`* zaHtHGwqJkeJ@+^cf>;nu$v{<%0Ve3GGtlZ36<5v>KG@sl9j_P;viLt(ciFzBSCt4Q ze1LJhqf&36_`|M{+|C0tq)`f5#6SJ6p+xiW{gvuZWMVw8J|ycsY3(!#axYERmrR
    )P!<`iKCt(uoasVvw@yWIF1= zszYye_irLrj}{c>kF?j?U_6!c)`0a_Fsht;=R41;%*CT<*bbh+ZRE z(^+sa96kzwOPse8leVXMB?)25vFxv~p^NAAgWacimTWEBTEQF4s_dY3Km)F!B)eE` zp*}u8zQL(++CyYH9h9B@OP0UV8`D!5}pO zv#&?!v{VC47XU??^k4Arg3VuY<$XGfm zRGd9hO542l#z{*!F(IRC2>`6%7w=wy{9gVr!kf8Q@ z{%QA(>FK#0!pre`Z-t?y;I=DE-V5KPf0l~>Udr_mwx|t@Ok7GdsXmiWbnN`N0o}Jb z;dlTZSg@|0mDyd`{k3h}BoRF)=9}Rpy4+FD^>Of<>PtyUPooCqS86NQeE%YrlJNna z4@!Cc{ExgEO^&##mBr&db(Es!+g}vn%92++8%2oQkr9{4UU(aG5G4O3AMRap8d6#Y z4?5GP-iT61p4oLuNX^#0XV=ddNys!EAm-kg%5F^R%qG1Ce{(mD@+$=R1wuzJD90O4 zXLcUO7%NKn+}3@cY2v%4TfHM@_NUloeKl}@^3mjer{Td)PqL!i-jLF&W>HGB zzP$6|aeCXe(XYC36|Jh*Xk89}K6L&y+2^hBrd=U#57i_u`Wh)}P`Lx^55W({W5VLqDKfg8={278MczoWSW zqVqd->6T{*(Y9Q18uh=yQ*i$i0s#c}|Nmos5iDgyd*NxlOk8PdNi;~cbR)noJLPGZ zC^0x&u2&jn5-53k`uGArzk^I$u4oNmK0X*Y_k1CnK#(hsRpYZb4!LP}ukp+IpnVGP O=b@SotmK|m`2PZgR~3Z- diff --git a/release-0.19.0/docs/services_detail.svg b/release-0.19.0/docs/services_detail.svg deleted file mode 100644 index cafaf29eb8f..00000000000 --- a/release-0.19.0/docs/services_detail.svg +++ /dev/null @@ -1,570 +0,0 @@ - - - - - - - - - - image/svg+xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Backend Pod 1 - labels: app=MyAppport: 9376 - - - - - - Backend Pod 2 - labels: app=MyAppport: 9376 - - - - - - Backend Pod 3 - labels: app=MyAppport: 9376 - - - - - - - - - - - - - - - Client - - - - - iptables - - - - - kube-proxy - - - - - - - apiserver - - - - 3) connect to 10.0.0.1:1234 - 4) redirect to (random)proxy port - 1) watch Services and Endpoints - 2) open proxy port and set portal rules - 5) proxy to a backend - - diff --git a/release-0.19.0/docs/services_overview.png b/release-0.19.0/docs/services_overview.png deleted file mode 100644 index 564bd857e87e3ffdf72e363e45a8d11a7a6cb1f3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 43306 zcmbrlbyU>r7dJXspn{}yNh4AsARwRu(jeWSbO=aGgGx$Bi*!mO-61I;-QC?eH1Fn~ z_xJx@_s&{poh9OYXP(&mQ`_&Yj3~xE;(G`L0z+I(SRR46;ekM)XrbMKpM-f$$in|_ z*}N84M1z+Ln!Ydm`R+$CH5&xt{=oHrD8B#pxx)4rl__lM=AnbEMr68raANqDK0UVC?5fN9;#lNcdV2qq#d_z z#XnxCe^Q}Ydnk7g+fO)%s^GX#lg?~Z%>FLg3nky?(6~N&d(H}%^dL|6Qu8YQ0?B)5 z&rtpM3&s4)4NwAZkc%U3^drRA^S)q7#%mrv#4>&$d>W69!r>u`<55ppAvM%jS;BXk zt{nI-+M~W-NWO^~{;{@GGPBrydI!Uc@+)y|`Im`pemlGR9dnF<>PrFnrAfJ#0~rSJ zAO``8zVhw!dLoJ*E93bgX%x?;t|eJI+*Rj0Rth9kl>hg&qmO+n(c`~YJ%=|X;`Xio zUh(X=P#FIAO97A2UZVW>@-#w!g&6v>7fPjjvl{LBzK%jn-@C#vJ+unjuf;#Ur*oyr zg(xY7;<<&z{IZwVR-YJHLVJOT&hcOPi#X>;zKuHNUb)P^`h zIzftxo;Ij0A*Z=7$y_0ZdIxcNaZcN(`}(|sCBta{HZ^~a38QePilE|>d|P zaJ&U9`@>s~tKxWzhVt6-U(@ph?xZV^6t8|(i1PFmPEO}im=U;V)8}`sns?M8nXqHx5Fy}oYu4HKSb0w9wYaoGIAIcoTa))VzG;^M1u?R`QK*~CyXFi zFE4cO(B9@jcirqaJbP48z3kw^Uz)*hZ@Y;TTZK8BW}xv^BsGR8KBks>q0nbcPuDMe z3U^xnm?R-3&1~l@v-7j8$4t*_FKzP3Mm#iG6w>KMPjRhR(S{#p*S@ax&&ymsNKIu!M{<~X)&et~bX_eMza zS7v9fr+4IoFo8?5%yh0rT9MS|uOH`|?BVv06dvE6I+=e#H}pW-JiXp^g-C;KE!RLS z^{1jzWLOxEPj^V?^#_|romcz4x~9OLWjvfm@{_mH)_LpU#yGNRq&;XQCaT=giGavz zmh@y3SKV$yBVR7wkRCxc;XE(!DS6K!q0NS8r~k%zki{S5&YM>VE(J~J!1}aSw#98X zh3WZ)gpTrZGtSl_=0C1I$G`F#yd23|ZTibng>O^g`1SM+{>mx;o!Oa%OUF#Q!lqxi z=YV9-?{%B`WPff+SAe3e-{fa(?946^Dc{R zSO1RO7M$xz!i0m()Nej!`zKwR;PR8ha~?*krrX+$6=&b+iWT{BFr;}gVzNSqoabVo z?tFzC|CyC6{p#C(%wJy5v7TP;|yA)y)(r-A7d8z0vw7tA#L>=&9`~PIE&ee%mYhoP|-VcDAe6dBxBohCjUe-`xbHzI?smHc)NUM2b$qeU( zM)Xck<$5Bqqr^RHar7z~rw5VtNor-uEzV(ER4w9G5+Fn_;cTULz{#z6(22rrZ?RwUF1mdrh5KyxPKweQ`}?( z+p{ud4OGc{)?(;&;!aWwr*!zmA5DV?`ESg-!95W3yO#`CHuSURvtnEJBC7`2_F~&Z z3S-$rzMsTo0iKx;?KdljPqc||!sdP4;`%C9SJZUuocYir;-NvR@SX33_BZ*dIW{Jo z2HH3x!f-@krB2isf0WubW$t^tDXSa)%46EUIpOrq*ihO{`5tUlr#vF7aiksEL-+i8 zf!9|oof5~w&}8v@b>ddq_-W0z34fN<|10GLbnz&}^u+=3XdAmejc{lLmWYzUZC-D> z;*Zv?V--SiUHNp(bhp%$9;#QK!UJ=xs!wag{qEgL6j?t~<#WgxB+<}Tms;DTv{smB zWc(+htmI|VpXDbwIP1Hb*v2?Stzo8AIVBwE^W-6u6S1iFkT_N^oW}cgRr*AU8We&5m zwUnBxG~~z8aC0VUFY-UU@s_5R$@bZ^5;M~2nsW^Jo174q!5-b6f5C*$_Jx{s#RKOb z8qjJ^UGNb&$m+Pp4u%N zi`a>zP!@d2>o@VPtyEp4WnyJEY{pY*_rE`&-QAUo8YZZgGW1PBTfXU%Vw!g693{dQ zgPCl>`b20ut>C+5I6$319rJu| zUDUMOhT@s$?l!6`SlM9K&rK$DS@ueiIaKfW;*k`l^j~r+oqZ`O7?D?-#+IkMjX)dKUU;_ z@iXERNrh(moN$|@tnTn|kuT*h$<#hZoHmYXv@ zNe(q#W=A*PvP8`vPCLECuFu>`8mmIWhr&`I5e59m*xp77-F89D{ROw{x7tjlK*Hj^ zKHZ^i5(y|&h^5jlC>Z_)5zG(MXj5Cg;KmJ!pQlYc(4F_0XYA@ohWpFeq@!l_$ZVQe z%tHM}rFVKc=1&h3NzqU$3vAm<#B%ASn3XoyJV9=y^Yqhb`SVezzEGW?6(9cX7Nc6& zlY_Q9dNgW_Z*io&`>b7G>4WO?pMaZbx3Wg13PD@m68ddzOU=&}0Ei)W{FGXJmfO+XYt8AKN$;QY-K~%9lHYncN)zqM zUab&ChY&i&eSKT^rp&eeVC;)u!kgDDWRJM{v6;1QmPkga@{~40XU&P@OElB>&M6FS z`n~>D^N4b#;gSARB3Abc%fS5y`Im@op(}*HwtaSx>vbd0q@!l#5BZ8U&Fh%Z;eUU$ z@Y6l3SHs4ueIeKTo>F^-ywC&^K#AjLMez(JhD)ohTWV>kEl&7T!czY26t&_}(KHSv z^&hAn;`g0N`3^-}d&2t~UQoHnD147-&&xO5-O?c_u-{6w&RxU0gCH618mU4iKWB|u z(TFmArXL)WT>T``kbe&dLCtinmnKVNdoM<7*9B}36>KfqcK^A+FN*C;J2``a)U3kK zg3G})%)Eq|-uNby>Xps^|DzS)#jI*Q9)mPlc9=bP2%M4I)4qq{s5mRv2BY^j;b zMt|Wq(H|Jb2XH_nD@i0~DrL>iq6pU`v-gki@h5pTZ3(ypp36tL6dPXvJP;!ziw7rWJZr%qmV~L5!aNIsz>fZxwfAEvd z$LhX&R><;zH*1@;WPPC$pZ3+NNBeKvnfl$0Q&W65(K5DoV>e0~xw`Al$c{FhCv7@O z&Ud@m;G6957e)(&O)HaEIa>dcKkqy@M9r&t!w|ffPRpRD5`W9@J$HCuep=(Cno60a zW;yj`lhoPtn}}fJziHIh$OC)o*Ii!sx3uI32W0ud6}cQmD$W@%T0M%+MrzIj=|8H- zqCyjg?@JY>B=;js2G;L03+d}8A$twK)(4NO$@mUi3lyZ2mevcRfurI8w}|$W`!UYT z6nr~=JRi^fBE7cbx0)pJGldf9lgtS+w2zviB3a@-=?y-zMGsKg`|6y~Fl~b=kHKu1 zJCUzzR+qV5u(kP0pLS}g#c$KpsL_s`J#g02CFxvCJ-oZJ;!B%Eb!TQ>o&4&@g>>4F zi*1Cw-@YxaMP| zyRuVfQE2k$!LG2i{M_@BS*G+S+P_|GpYFOx%xy<(+h?QKETuLT9BsY=YWQNvIg5em z&wQCIV&!N;N=ki1aA=+Ly46@0Y=?d(4Q;Tr+8^lRi@O*#tr^oT_*ynR;KF?>t5N@x z=K`9}!s)L0LEKYW$0yv(o)?0(-{963D7e$P9*`K8=B}IPYqBgKpLSQk2^@3su0Cq4 zC63Qdo{)Osrh{G&D@VAurfV?H{b@<`!^H>UviyYQf9cyllF}QE-Y+*uc5LN6gFDFc zdyhYl;wox?T)EHeoHVUGqGK`k*oILl;vsP0nZpQF#ac{&6-z)O)?5=XX#0=>bL6Co zMko|oRbS`MKR_X5TW`H+4^kFUyIU32O?S{P_rmS$R@9bIg!c4CxN6?k6|ToCjwz#s z7@fx**AU~ZkEq1Sn!*e2VKt^j;&Z_mppi{?J|!7_=mMo?(0R1PunhNanpRz*!7g4Y zt7~+MnE)sqsM6+IbnbiGORtMAHpfdUBigs(s{F-Iu5wNaSVao6RjV0{hRfeXs^AscoTWv zc)#3dOHW%VZ!i*@BFTDVWUL!u-0zInUAM3GrAf!$8r{8`BNl+IrW3ke*P5Q`?X}U) z>6>gjX(F6ov!Dr_O1lzxfRZ%4S_!+~ZYeBZZpyzmRu&JS^cvwD4n;j~1w^hWyfaV3 z%^$)){qMSok=@ke#i-+ZG`n^w2xm-qxF?)_JNNC~Xtp9N-2)Asn;-WV9>C!aZ_TR1 zj`OZlrQYgl8bdL^XsxpUC8gXPZ@Ki{nh%ZoTV#OCe%oD-Q;mXE!->25+>l9gSrRg}N+v9IC#JpB;9nJ! zV)e#7)ZTn!HiMw*kGR z%UnbJg9kz4$a(!l-sN@u9zq*4L_~-#r>W+DK^%+0^ZD#}`*y$P)h& z*o8d~c?M>d`jNgn)Jz&Ld+#&;YpWlT-{qr~*nMqky548juyJS9(O_FWDF5n4fpEip z$xB85$TRU8vH-a0fBWvt;~(Ma{~G+OXR-WRvxgHX$Ut}^IcQ$5^C!s8P(`{Ec|T2Q zb@nvPFEmj|R{Xv&dfe{c)-Co(km>eYsn&$^Hr~Z)DVC@(Cq6WfAY^A=cKZ4Xk*44! zYxFMmwGfq*Cgc>Lo1vYRr1VR*(1?tKgx=tvfr%B$s5m=~x7IQ!b)Z}|0^EK*{8wtT z!nz`$VZ-*G&C?zZuEzSD+puPgUES%F`&&Imau(@(+b`aoe!eqGM6uA>hM^-D8zq8V z)-h;6t;@hDk8H~l3snA~Gg3MJuH-PI@{8)U(=GoX^~0(=4Ab0YDD&jRh^Zg9w4Mt~ zC{jZ6zE>#UCM_$htmLOkWzcX|mtpH7Z^3i}Ietiz!ljsYk+^HTwj!r355JB8aRt5( zgI+B!x?|xq+S_W4D_11fqbUBKp1$`j!{h6my<6hcA*OwsJk2>9?f$SeVSX6p?Vt@F zpG4&SJ2(8L9-<^I{)**3Q~<({a_W z9ii19nY*T`toPkX_KA-eO$%sMUDWC9P@^8#)PByvGZ0baX2Pf+k?8%-WT-Fl9#$@v zFR(HsO}fVL4}bPZ>1NAUOy%rUgC?&cyS8tzxF6pQHW2T+0CLbgc6fMcbR;kTJzFYD zj59pUXA1*S=OAdZK7_GfPp(;lRiPQA5QQRjdW=-xH=q?}oLAv~;_?xdQjkN0@h5pp zO@S4Fq;|_UM{&qa@!^#7fBJhI+bq8MMjwI{mQezJ)D(NGFmTAtny{D1=>!W?vA>Bd z)o=0&Bd72r`R*+1vn#&MLKW39devBUoG|)LIIArn|H?HvIq{LP@%li9XquPfhRzB3 z9|FuG*VT^dy3NY=o){>R5&UL5e3cQ<5ezEDXkJ^>YoARy(L{BK1uJb-ec0?{3m!?E ztb=#%9pX?VYETrlLp_I^#$(f(txZy4;%A4CcbXmvI+L7r_vO^6!;5Y@*<-D22Bt?X zS6luVKgTM86t;a=AsF^`?~*822sSkdep!%%|I%q<68pPp{%P3d8?jX4#~kb5K&4#% zvI}bD&NR{{8rgcn8*I$Qhw@1fND=Z6uDE}B+cj$!D1Ie^P-gw0p{DJh9z_0N>q`&k z)0D#M@PK161Iz_&iLIuz)fJNA=gI`d2k7jDzaN2U(j7RRZ1h2UUBJ8fDV3+WZjrL+Vclb5>Tl zoGKNyydTV}8WlG%TN{!v!U*yg;evo|B5WX@2GsUa``)r)2kMwy)8(k$R12h0}-B|c32*3YuGQ9 zDw0|FSCP5>zcbN))M6C~e=dlayy-K*w1wWCsX>(Vb4_p1k%@^Zyp`ss>=B8TZRf9v z=M^^#gxe1cV&cd6!%GeWK_{Y~mbOi1qmP^U=CcaW?&YJUBNq;zdcN5gK!#O$Djp3E zq|*p$6jc9p#oc|}(GhNf5eFJpIuoOuXE^@iH7qc6E4oiDNmAmN&F7#TWPv&9Evp{v zARI@Kv)1)w`!u|tkWgckeLp6S66gIp)03C4G_})>!=4qJ=8Fy)oewJ?8_&5RmGt0kZCZqt1#UDJn5u5`+JBn=N!&@|9f2ZF0{`Z=dBLIh` z9D%XK^}&bGCeqdgm>4UyKkv!0n~!G6SbYNN80Z`ToHiLhg(}mN8jTyumZJ*%icxVm z09*;|3ydj|7Fr;gxl2%ie1c1~NwMSID#0L#PfY3$=wX2c?c@ z2Z zy2$)?>!f5Pa-Q-to=3``OJ8iTM)W@M=)Zchd|sD@dz-V^md#}LCCI)e?2j;TTEM+} zdU=sBT5Ef!Ed=G9$Ng53`_bE~%k&C!Gf*{pH!Gss%ST(iL=Fp?#CwAed6CqEJz38D zmGf$K+%iXQdwojl*bHN-aJ~x@c4{&kTS|(ohr@DGS9tH&8*<-G<;v1pKvrrnbx4A$ zdAGivXnT0{zFf__586(ld*`RgNokD>vO`Y~N@P()&?n#)n=NEpWB_tg^u9@sij$cx zf8eFXzpI)*_?AWC+6%qpSx}+;v@jCkB^QrgI z<$U*30RE9)>`zIQQ|!H$8$%I7|jc>=RjzmAbbtDKQkz3@g(Oj$;I z{4!b7WoQ(#5x+y1gzc7Bj}G@uhmlf22frA&aS`b#sPlXUp|Wcva^W$5dO7{K z7k;ZH434PHo1|5;WM+%Pt>J8%{*s|>LAwwt`eoR(#A@^3L`l3VPYFG%7WU0wGM|*{ z#${8Cc)Xnxl&iSr!cwb? zRaeb(yVKERy%7I^AR|`{U(T-Oy~)bV{eZW(y-UoGj*8T7m$Ece zPpenj>i7J+qR?=3+SJI`l<7$CoD@mG*xvA#3y(_s@O}L?ygNeV#o38D6Umbs7@Zn> zOKW@^8fQg9iLJb z@Yj4n+Oe)chfXo{=_m@BL(9s47X;+Wpr1)n+wAuER3SgW(Pi0I+fVIOPIBTQE>M-v z|FmJqeJhsGUdZ6H5I6y4GTZ5Jj-Xa}*IhGGd%^Yphny)>Q~gw{OJ#VY7_FWA($)2^KtLd zf9?uI23hDgd0V}2WxXai##5o5teGqfyh}9?b6m|RK_1F+G())l`j_Gr#s}UAjn|~H zEnok9gYO|y{xUBfB?iw8H=&UPrMZv@x#c;b`ByxUz7L5G1uRYE1S|$CfP-Ma<83bh zA8&g4rKqr%PEi5`{jKVC?A`Q)tS$$+SDEH~tXb zvH??Bm#M@PvavpJ13ztQbk{!I7xR<@=v988CS1B$ z(p>zi{pRX31uh=LUx~Ehw-?iuNdReYdxUr~!_7189De_If!Iuti&N?0;#Ws9Q3cUp z|2=u&V`w!Sugc5j;++(bOQwQU^ZO*M&6e;5QB0{;FBp(HsbaZ4ckwzH z?7)Q0qnP$yPPe>U`SCkTigp9IO1!5n;rL4-I1hbGYahANb-N~Z^4@8wzU+T>87t@y zQ02pg?PJSJ``4pEqs6PQyLT;TTvseX6#o9bgB+CaubCw`pQ=5)J!;Z~>ez2{PGUzc zk%Qr<_+@$OB+@)Vn!0_P^tzYF&l~B@&PX_#u!jf)Pv2J~AZe{G``noz)dI3t+U*Kk za&`<1b288!RCw)9Wn=PjR7?P3TXffb2JS!UC59jS2r1E^%X69?vj`?+y^&-@YLVw^up_7G=oKSclKc7Pppf8%&@ zmR{gh6AojMGWomZsQgf@xsC$6gly6>`>lG(j?w|FDLBoa4$t^WRe2I(!=Eqy?whCL zntANw=2-W}>9{1UJ-2!6kfi^~?RPG}xnl&QHK`|y)2M}X&caJw-(;sckh8~?*P9(X zeNev4zE7;qTV1E zHc=1yNW_%QTQpC`Z^MJC>B3n_&Fk3@3Lr}W0QPyE>)=H*7x7|Rv;JgsF6o+Gz}tMi zk|n#1f&9_C^*|>}UA1i@P?@z{oq`fNeMfaNQb~TQacq8b2hkNH*;1S8bSaHj$84e@ zg7Al$m1Fl$K8*%fIqG2ZaSP0c9*I8)+4f_|auWEy0!}2=x$PbpI|=APw(0@#7rS zHP5FL>)I_{S16h3_*1CdSRd^vP>hiL_-Fb`5nr_hBt+Ew#^#~cZ*|u-T+^0p&EBvv z66GiO%Oz_g-M>ryu;kp9#VW|e+zjslsS@LS#?DsO(vx$WS*xmN52b&eiK!i}&fcFb ze}2J$Mou|AI5PfG0nAh7c`Jj^q`fagsl*R|3o zy)7pp5{GB?4c=g7g`^khA{Fo9eJU7I}+^60bql#aHy&T+DXALtpt@W=3cL>s`8|v{7*OATp(cN`eC&3Q18`avzl(4C zS!QV=|DE+r<1OhYTIwd@+sr$A;=j@k@qUyT(0Tu zbNjVms49;aq3+I<$o9@|T+N*mkK3Tod_Bds+Qb8jgtugvXr%8AqRLR$)^i7vWORB* zyc^w{^!zNOknY0xdFwh123{VG=+x`s9z5{NR-bQpp~~!i?=ZL(Cn)CP%gQK+^4Gw6 zu`(EX7r4MpLPmZ90flp~S++A>9TS{aIaYIh+`o>XNd}Sd)MLv?wcV>Ogi&q zM(HK~vH`aJCJkg)@C<*+smTQedESLG%2xRMPulVh>Q*J_haPpy+92Y;{T}z=FQn97 zb^k@@;4>oSJ5ut#lgY=u((vl(9Ce$NuP_Zxiji)RQnvkd<_H|Y2*(=C3!(Qiyx=Wm zZQv_Or%tN@*MY3$f$MA>G1o5$rL8(d7XNq)g%VVPruu)x9<*R zqhN6z#2+ZvbazAWY~}nFd;@to?avTZDPHBjhl)hqE+C=U5c=9}BAxCZLjkhoVd(99DVR`)Tow^A> zBk-{Pdwpub`u~vK{QvWa;!KPTI#^6FlEdqANhg1s^e=|A2ki0rfRvlo`dgF}(*wi; zMkbcGm!%&D@d39Ir+q;2Y@rkwiTU@HVbK!!HMFaJF@tmw)G)kNS&$vc2VWq-_=bSs z+sh$11?KhTZx}URCbIvPmZdpuxgGHg`6ui;v-vUlwpu0_DDStYNI;nnHl>0{;zX^L zHf^VCkMJ|Q1M-Rwo|;MDM^{-or*k*e|=(QFIj6vAM=R>fP$I z;bsWNDlc8xM5Kw%sqF--D8%e3+CX+LGO&1IDKoD98EEsILOTqwKF*3PU1Y zxZ9$$+V?~`4>R>P&M8!#XyW0YvzJ&54lHFXRya;SHh)%TXJKj+uMRr08dqN^*dKD@ z)BByI@V==G+$nzy;F1-6NTuy~qmDE0ej+FBx@J6XRJ=#F$!@OtR6G9BQmm{s9bh+OPGBe1)B6K zImr`F+q8|PUiA3@Wr!)mv|MKT|MOi6gtLm}l6zm6yQu$_@K2)T3k1ily?ExEDBd9h zN7|o7aP=SY@!XLn<3E?(e#H{S?OhT0X8*&ZTbDXv2_XS~B{${Vj4~ORP$(hx2XZ^! zqCS|1#EKTCAdB?=32-`Ng3MP!o44f5=p$fxphzt|B`Vu)%ATyX!VXdWTw03_XB6YH z3ZzWj4KX)Q1OGsZ0vzGwtioh=X#y-`E|Bow%76a?&jRH>+yoxTUSMzhk^hE>s6_Y3 zXCUX_W8%eJdP-WJR>>K2v3ndof=E)=hs*fS|L`EK3i^!4*^D2$)5*;0nNm@<%VgO-2|018_mzL%AdU>gPsQGw;Eo93vDMV2o4gejn4Me z(o-9b0MUj(U;njFd< zLuJ5Jh6fY*?9WsJf#$FonKy(*A zplj-nTnMMc9`C!~lhsgTY+>Fo8QymE?o?0SlW{z+{c)UV1|FG$w)$7l8qA%7b!Q~M zeFwYX1j4YhOPQ1K0EQ`kNsW!|YGCRzG}~~b1Sv!L*eI{aJQScO*JkhIf^k^YPw-I(R^Gv33F$CU<*B^Z2Z6rj zP9Y~WM+-I{;(T@mC+&@7H$u{<6y1H^<~rp|y}ejtHgYvz1$gM)WaUj)x;kk{%$Y4z z**S3!Kd_+W=fb>cMGvsnbppRk3bDrzPj)`DF4{*e-A|b=83Loh|Xql;Wa|E z8L%1Q>6-474J{H|X^)0jTl*)@5fIChxWC`aT~c3a&JB`49!|RT{K5kZ(&_7cqdnmv zR3CY_J@jR^sII<#Kq8v;(LgYy1t425BBzZHxk=Tst@;@i0n@iqZg%{ua9Yb`Hg%yY z`&GIvQT>k8PR$C%hXVAYJnTq zdKCZFJqU<`m?Ne+!#Q=bUoHOxQU&|VRgJwpLuv4=@C74WxRmal6m8>XGTg>b+lOfT z#qQPloh9A{jS^hx5ONZ4F&g=ptAlAB+$~psX!c-ym%hSy%_%Q!K6d2#z*T|iv4sD% zc6C*oaNl?3sWornPQ&eZ!I$@c9Ra5Ig82k0*Y4loC84|8u{Ua8NvTZ*&W}R^KJ}vB z3RowEd9C;I4TO(l4Uf7-vHY3<_TiH3%#4UFTL|?G^rk>A3yx3m`q_)5D1NpQ3z1jK z#1=POtgMzz?-lm-a2KR{DLB7)eSuczB%h|+dRvPcA~ju&I*N>f5MP6&fsmw1!UG{X zoBaV6_$V1@V{pQKF?N#IGl*6Qe}=~41?IQnzhFM`30e==e#EmEzhq>M%I zDbW5RUKAKokC#x6yAh$~g}pqZFEBpUt1h;ux{WK(&PB!!h?;X1s-8o}-G8r;=-K>* z)A%R*4$Roe!W*!+#p`^;WH)gEyD%{RQ;4~WTqXyqjqos!VX>{;CdFHi0(a(Ta3k8h_d zlC)ci%691IKIh5(h;yT_BO%(wK6c)c!}fsO_5^PY>axX`h&fEWLorDeie+*k$PWV@ z!?GR~5<#R-J)qiHyBk}Ho(TLkd|~-|(!{-*FP5P0IOf3@dK4HK3cQN0f%x}~z$Yqe zwTET-I`6g}EJLu?TFY-Uk(?t%$OENbFuHi*O9eJHg9$UANkpNN{7VmK+(J|8!9nw1DP5b$+N?v-$0Q zWy_H4FI{~D$<{|<>=y53tt{}Z{!GD>hW;i%r|9KOxB*1Uad#i%u-1_CC+{glDrZLu zSk;}puSaS27i6H=IbKbZw9BZc2Gg@&My$f1GUx`V% zq7wQDNb^!1tleG8J zBv>~*C&N!&9#~$-M?jA_%KhP^DCu+JuJZ>n7KoeL>VNZ#oU9D{9jYsn-GuzEWBuM* zzxsCw)-|o9%wrKf?9W6rrZcpMs}jyg#sn0W_WC8sc6rW&{kA3z+2hohx3!7$bcSUhbHYpKYPz3z_{aIfWh4FAQbM3XC zLCk`IF@{OnT1zqY=Wl~Itk7d7#aGIYp~V>wX0pP>0A%sxu~Q2!?3wzv#VHr^RhhVm_R?@B*W_PJCr9kU^&eVE~gsmteS? zKEs^&f7v9W)K(3miXyuazAfFOX#5U+vB2TT6yV+V7qN`%L2D8ESbxa z05!oa)R~D$3J`D%m&*7|hLMhlH~%g_>lhu*%>^Z_@>|K&=(&7hC4V#B6gpb>DFdx< zjLm!%%|nc)VF8=|&vgw0WXI%=>2xB*^~5E}gX4wXyw z$Ez7+kAvtJDrpm-kR_eFmm?WV-FPGB*9Ddr7spXX4hNqY7=PuBcVE_koL2B0-(dz^ z;tdUUOt@N%%>NoomOnxaJFU+KEb;3@dJWD%4}g_KK$VwMQp=MMhBzx^3qbrSFZ?o* zrKi(S9YlTg&Mxr5Mt#(jN-aHbyz4CIb=Yn=o?7vZ+QezFoYOiuh9@u>wj)sP38lTM zD_1lZd0Nc2+c>T0RtB0L%F%_!F#r1mxMR?hc^sn zf_$$zd4>94R6PNO@aWX&S_Xw{FfYFRIN z-=tr1cWcRjhH0vXGhuGbnFexgniD7YVG)K+Rn{%OIL`kP!kfnS05uBEis(+W&{r+~ zKjE^&)4S!9WH;<7Uii&Oiu&&G;y!Bc5VyRO=lB7+I5-|K z3=^TR# znK|g*%pV%3yUD=>aeBXlU7D4KB;MxYK*w!o!>f%yXBro413iNeD>S_!a18T>ijlwN zd?1Md#6$>MpTn7EZ}~r)8G0trJ}$2FH}gbB`eK0p%C1Q^o7dd=c^9i%rC2*W=D-a`)M2J_Hfz+6!<1?~sRz$cX^9KZIDrjk)I(ctt}cDzJHAmzwlrLT$a6~`4nn@)^2wbdq1Y!8!YM7LG1avkbW%G&G! zWKN-^dzIy#VRd~teE`}1USP|~NtrpK^<>+h1A3SoYD5Rk{wi@NClZb^|CLZWA*nnf zm3d`P?3d(*Sxo?dm+^hpXWwSCnGb%b@NC%?oDrU96U>kz;mMSR90%R~Az+tBnAKEHAmRb#{*(nc5{XvT_nrDN)I8hVhQm z<4gXi{lEc9Uqi5Eu1AZnhXu{%NK3Zt-};h4wO?}yM8yWM66J6uBi|(bSVEGGtt2^> ztxU%12I#qn)K+hPwgfochFmi3E?}50?yP?K-mw_|kN`vrN{G%}cmZ@^3 z&8T=UL?1#T@B&q--k+%QMYs&&qCs9BQcT&}TtRNmJlFEU=s7<~QEyrwDXg3|yfFBZ z9)wDkjR{t0?Bw1}x#8|fznh$IT#SaSmB?y2@aS_nl?;u;&K9^#sz8r1rl{lfZ2 zTU_yr-DZ`Cbcp3qL+gIhR3(1yLpyqYu5-_IS@jarZ>m(Z%v{AX$XL5?YyZmvj7?P7 z&#(e1enc&R0|z|Gi<2_HUtV!=*G^5m382}khv63fkjT*z~oRQsPa!N)#g~&mhkUV`qTDKZ9@bSMqws`{l4$?}MR5ST=`ip$G=Q zKr3*2Sz9%|1R5jbM*bJqG_Mnn*Pkj5DLNpE-;z5`2ve2*PKwqJU+w`}gxT`z!Cn|` z0SV0)2;|#MG1{-Ea*zV-3wc^**8-DFXbJs~snyrmitJ$a)~DFVMX*WtE<~t=PvX-G zlXF@~eSLNZ?$+m|8go4%3>40KHO*+lZoVo8`Sju7E6LZsmT~Rhm6WI|Ii#LsXWhVS zY%eWoI`yMHME(W!(l^-Q_S|-b4@9eHD^@jFHZLPguEtaMlAmz_oFBPt?)Wjzb3MP- z0|P^;lu?pZ%Ah`+{g&q(M4l!RrdBzowJ)oDkI0(SdMgTa7R#?0FkM>I{?zR6HFE7y z{u{rQe$@hbT3*W3f(+Vsv1yLKi%%o`m0(B$%pdT{45*nSRtIZ3;cvjS3+1aR_L+1j znY42h=!^@bkiI5e5FMAhR|F#7#PfoSM@Ek`-0tZ5;Z;c4)7MXH85H)`D1KW$eW%|W zS~eU@w|2^tM=|LSWZ{@>ynQB0Q2%%%t%OTESORLIJ2Rm)=xHopbTR8L16}p8%BwC5{-ozUonNuVp%_ghaD?w2S>!*qP3j?> zc0H686nDk}W-G*cVGOrn6+>ru^?c1p=>j9PLmxadab}SvIt7qi=tXUE!s#7}tuHNg;P<<^wf?<%e)mUEVHt=)1wv?%F z`w0&wR);q}vkB8A9m zuEzE^-U?}8t0>8Jyw&_MYz0kFaV`K+h+{b{j);uH3yF#pThH@PV!7`u@-DO1Z}FY-yW(jFVwIflH92E4Wy$)qpCqpIs0I} zzPEapF_qqVTF}18a8z1M*5k~PoT8|RqsR!?5c!XJxzD0$y@KpiC!n%Gr^1fFaC5lu zN>%-cLb9i%|H;|3*pLgqC+6_!T8vkbq_hNsEt#m&? z$sNrphIwZOhN;-NPN)QvBh48z8Xtbdol#y9OY^-;TMy+fD}L%EV5V`z$HKv3!~256 zPg+o#c4p5ik9_p?iG;SIWuJCk@OEa67~|@5)6hT8cb*?3HC<%4(#P*_FB8XHx;igi z*6vs8sJ$~WH`}TD$MX1ZR26quuT#&bixC-*y@>1u9u#zBoqvTFEsOTlk7$h<#ojLg z#l(+D$%e{vG1^;5%wuq>xde;8h)}?x~W$f!%fY6`@LbhB^eXi zw1Tr(K%nmN*}lota$P~LxK*#C1cLLYRI(j&3g-SyU1q1CwDSt#%d(#sb_oPqbV&BH z-%n4+9Y}ei`!yo1P4{s$Uzky)d8gN0#`wh$l8E?j-(D+O&)#0^vff(_XcDhUaV2mI)o^*iOd~Rh(D###cSKnEoN2aJPT7W`*fNUTk9sr(nO{geV=7 zb;Chk_X7>M04Y{cNdd<@+!yu^+bxbVh?INBqb{cXb3Q>RIm4xxjDA-o2muB&4bwhX z*Bh$&T7sI{14|1nA_HdQJ~Qh^s~2m_cUn*4$G&_sl1{lX+3R3w<8na(Vg+V`MWams zv%ur8#S2X@XwO1Cxfz$|E-`~WcE}Kkzj|<~i!jI(P>XyiS#LUw>(~v1&M>|MdGP^e0*(B;k ztTjT<_2gYgHD*R%;=}xZlacwzh`6)}40(y<&n|(Xj}+u_uQbM0!=nFO8jPtqV(=2n z#EMDF2uoyITJcma5rpFEn)JNlBl=Y->zuy*w`M1&BCX_7m&>j|?S~iwMg71zp5NWA z(X-BN;i%$EvHK~;mq>~_jwlf0U35zA3+RoMZ8$&3`4P8FR0qF}R^>|D+C;_kXeiMxIrbZgbfsY6)k)*m6D_Vv zZJ`U6qLnyLIOJ^ar@C&GM0ykGxTo4-|ZxBmYy_Losne_z}%Jb;u)3DO}b zF{E^dC?G@0(B0i#Qa`#ChLmolr8`8B7U}Mi?uPsDzpne;z1H)rguEe8Iz?>XX^Xgk^mwegVal$9-M3_}R3(cU zch?^psC&Nfv>BLM+rROoXP#hz!_M!&Q64TF;%gxP8BzUeB7LdPrOEcIvoECH!FD@t zH$U%~7DUR=V!!T@U%FzNS)Q33X$wCP*kTHXr>CZ#Or|PBlH|sh={r(YF-Sh{rbNzI z%rnnC6W;j^)9p@}=H7vw=$kSX945p^a=f4@6_0+>H`n=;=84kVRs~sM%Jr6yHyf5aKQ$*_C=qWP=)#6w5W z8{`bPma~-~K zz5O$;+!Eu?GFQsJhIGFwukQXatLYcS?Dl_^hn>il_6lm+2z@)(JD!l%h%(LinC!#>wNXre;Q{7+lU+L3n7! zkhk9G3vOG*yPBK??H2M{ZCvPwMWbUTaLt+#Wu2)L-1|-3?Vi_`Nt>2AnL$pgQ*HyS zEZba$AtOi3qTT_5rQQbm*|dC$yN}Tn5Z}grDz_K+C+jEVlj5FX2f|n7!ctl#i=Fkl zO?;K@-M1yR1SV{)WxxA3kqhKe>hoqATC@0WvzPslmjF}MEVhK#_z2LV*nx91dSJG= zi+)ad4m4e6%={b@6Wu(%uko0$jRB?Qq7(U>N-3KUJ=ufrj{DZ|nenXVn|v{zRJWIc zQ?Ugi(*OGFZn?{_hcb8^%Ew8xLyxYSC!YjH04Ra<7j53F6wZ1UlFUE(yxGASB~ZSyE;m)y-V-y+vv7bgkSIn%A{Faf*LZiROL??nxJbazbpRK;h!#Yhks zG+X~HB|fn~265nDPE*yETAyjogLe~yURZ5a=pUjYyBB&T^_>O^XC2O2?o-7U{z-#J zc5rcJ;NhU@Ve9wlZ`-`C-0PBDSlgs$B zS8dGDTr4I7uW&NviCbz|CGJ=4!1;D;I zDw&M}Spy%`iv`w3lF~0!l)F8<#9B-9%~%)4oehqk7-HD=um2HWsct+M_oq1+{B_H~ zjLe?-n(GyI?2P3!8gZiDkOqdObLTUhwJ;D~CGw{%0p)_*mCsa;`IiOkQv)`KQqqn4u+=UjDasT&Jp_ z3Pwxs(bs!;?$j~74_#ham;b2{D3?)gRuwa5@i!pIrr!vYrf9KM%-8(L>*fXggo!7yx2L|d~W&cFq`HH*s zber6bsmsc>W>AViZR5n??pX<$3)y=wt*5@`HLj(7>SYo;Z&$ZD_Fn}O;mTTT(+|x4 z`r_vcE?}6~5&H20V4E~1@8!6kscnNdQ8aAA$+9<-j^HiQM63*on>M&pNUO;%Y58If z){X#clHhvk{Ym)zLf4cs{(=vxRx|^*ai19)9x}E)ZE4iH@24ae`01J6d}8)> zV=4~i-CNtT0u{IDLkD`%E%8{a*DYCotpKqbAFP4u!Q22S0;%PL zpT&C401V3lFeqV{(bK(ve?X+Wbv)QJ)vwkD)h zzBW%l^>}TXw12wpRLCc4@W(vkq}_P*Wf2}oZn93DA|-nij^{-Rn;Zwp6jj>av_$s0 zzE~Gp@>qPz_VvpxWH)^{rmpw$z$)Zre~S?SwgOM8OZ#9~{Za@ey3@_v+rOjmqUjQ@ z`EFl-Fk!iO|LP8;RsOJoirqQbMAO3X>5Fxpl>*q1T$e(o>a9*Mthl!gs!j46f?wE% z%A0IbXOiD$ycP1Tmx{+xv9|H*gpKOu9tu@08kFvT$Ik2=m`ek}q1+nBpsSxOHMvPo4_<%2^3<_#W%8 zA1n9*LBY-rWMi#LF9AGot`cQIoXh%>l-j3r;ao9&t3SwJ^!r80enlG#T{<1K=v)Xj znu%)r-hWQowBaZMjaGb$`y0a-p(xF)`DrH=ch0YZF3Cx*dJEd6b6y>-43s$zG*hWF5-OuoI=zwPs9y@ZRwC|51ahX8)soEgP@UNB!P9JHHvKE;_ z-iO|6&3Mn{uYM7(5~g-}V-;KT9bG|}Cqu_os8se8aa2F3WyqP2qh8=vto{R#uL`n;cw9>nT!Fth3P_GFY6?#cf)=K+e((Nah{ z8i&olW+UdCY{uB)Dj_wet%C-CH_`^;Htk4dx?y+>Oo@us-9F8HeRHPFPe|H4MB%PY z;!G+5^*h!jX2O>Yn1l1PDO~rZ$3hC!pR}1CF$(ywx$m;60C#gj*}PB8j!et>nnaE98AzXKGm3Dx_nG zBO#6k>7A~X!d$0I7o;eD)pJe_r`jy;R5<_wjEwd7vm@mJ)$+#+PJQ)R5{$8Y+~|b< zc~eV8a&Ttotv($%L&6hYQ_HMwB2#$m(ZAD2>8YENRg{vVoy?*SCz)`=L9@QwIG>?Q zKV*uf7h*^fP8g~DQPa~`%U$+5qIrF8U_f|yvM12gA!6+;@-`|WhY|dNrGUAYR3emA zLNG+ZATR#+W5ydMBo**agp!_}MNd9H{x9J=X72yj3%}zSkbcfcm21ym4Z6|qsIj8_ z&SMoA-I6=v>-dG{iN27$T$otQ3z4FcycQ+ftStjEfGnIov6{#JYnbSijf$oPl#X~f z71i%u1pH|pB4|!naVa5wN~qx@z@+rn8U^(842S<@Xm866Z8!a;)6JwJ2N}Ah@CjBj zSFNW7)qdC1>UmjlDs}kQf7RI4Q|fE7T!DI)9=xGz(F0ArcTRA2E4OxvQQRiNyGzglWJF_H-}+ zpu-CKYDVRxqz-|m)Uot}Q@Ef8frU$B@_J*|{Zx2|cl5x0Ei-faeuu$=JLTFoaiaE_ zuQ|@3SM*=|*@i6mg;L(`w9l*>}H_7sa98FXBj7j04? zH?aG*#mulay;yEi5vTJ<1F5~hDcXzf+zSp<^E>0bFs3EB86;~42Xql>uD;W3|Npo!3Tpt=OJXG4Z$m*RBxsx0tM4m=%6k7dj%< z;Th~c5>5E!&JTJ|9(+&8cFbFXK_JvmT0IkAC&ND6=1rp)d3<2BpoPZY8<_=;X0x1R zE?bH%Zazpw^WVvh+wLZ}T+1k?+P6z(foPK7asIpgYsvjFUFU7tpR7^w#R?mMqn#9ELB&Mi-*v(SUta9lYl_qsG>mx4LDImYNG^7NY<+uR*SR=RM& z=$8Sk2E<9~fzNDZW!?4e1m~RfC-XL_R~~`m21VuLghB`$2Yunt5R0OEZAKl8nNtZ*-Xvtkd3y&WxBPB^%xrDLMz&_ zu(D%E2b{RQ={iGM16Azf39&sTHaaB=laSDBUV zsF?w!({U4Ro!MK&MWpZMqI%NY%jzjex zSC0We{Ug+Y@HeTOcZIec{oLxN(7W>!zH3`VvMs*Kf>xdOj01pMHmqp8ep(4Id%hxs zQdcBO)Ng+=(%>wKUAa_=TresvZ?SB|r{g`*+f)RX`C7v^UHMHRV-)zADp9ECVwVPUNlSS3Uj9UdoUkGH}Z6vyzmOVtANtVrQvp zQ`!fVwf7iYA@VnxZFVl1nEK#)Tep~!6vdtq`)x7VMo}?UzqEJ3uv70lYe0e&fx7VU z%gRtPeWIJy|B+Wmx4e2KdOL1#(<;{XNU5GBpRxjQ#1d0iWTI^LynS`&!QiGm6C~-9 z#SOrGee`eQ0B0uKC8vJTnVLe-;Isb{4jW)Cv6z1Fe8is}sAQxb@uepZJ?U7|A7o`X z`FlRQZ~kivX{B0`w}K->?km51nz(609WCay84U7ldKNP{@WHsZdbw+^WsobAWsE`p z>IK-0kV&Q*>{{=-t!Ls}rLxyg{t#MwO9$ccdyoBg%mn#_cgU9*&^H&~ecixK-Un`M zS#s@!TM?;FJAK2Era+mf=rQ}M>e~GAcE?lSb*{kIEFfW1w)u4frLCIpt+;EZTh!%} zI#WG)tzK!0K!CRSc|0DaSw+j+P^74oqa@$VNbiTH*-Vahhue9EugGVtl_Ynj; z#DCTs+$|qYzoL2#V{$CNX6S<71hA(*wNrI;D_00R_@xs&9MSu$Uug2KcIY7tapU;R z=YSzF=z1+A7-WL3Df@|{wF3^$g9IG#*E~O#AX1*M?nYB%o>IoL?E7~~k3u_?jSNy4 zLG=uz{kv$NL}P2e)v*maP$hY$>@02j&1WU>I-^dS)GEz3{CbBMNA{PNT^mXOz^#tbuBi`XE)*ZCG9I(l z`f4ggG*j|B@9nyS5utD_T)1@&(Qk(JN z+w$*!o?!Qbt0~xl0mypi~?*_ke!p0R_CW;s^cK zKWNPD3D*gO+wxw%`6=HZ5X4Q#qmF>w+L2Y~`|_1YG|+2Jw?h@V_HWM67I}bB_nLDF zO}D!_vdSErg4ruBBkjZSorX`bUX7G3$^HGO|H?C$yF!AiDS11xHVa^ZYEqRM(?1ZG zTOU_qZD=?T(GtGDuwjgUcNGD`{Jl#>W(T&C0P(y#d`&kV)8LZ}rE_= zmuMs+?ylclY3P^yLwd&g<+T_vS_*;G3{tA3lopfSLbS^2dk!WpOoK!K^5NgSd?2Z( z9w80J+Lg{7#N2xV&zZHoA5))=2j0)cOhus2LmstNGI@FiJ~mn~``>x&tR04=(nHDQ zKmBGaPO!bP&r}-9|8d_ea8xpx2INr!Vtlzf9F(WGdc}Npk$`bd;@B7XHu;X(EMNlE zMvGFz8kjiYCe?E*awiG&x-hADnFKU&LDzH~#V~+>P9EcmKm!@g3pJEA3fkuxI?(!c zbmq5JCj`pJT4AJ9dP+XRN0q#`09ZnhOBd=6G5xka;2#|V(f(i~9rLKA9guL#Ia9`; z1$QN4L(^4g{bFQ;*$K{DSI32Dn=ZxU8jJkrc8ULQFTgJ=m}}-akWOPCf?qw+5tORZ zd*!@${-QGqWN9a_9nM^}`&&?YbJU9M=7cLF@zXmFJFX z-xCgACIV|k9Kb(>@3@n?TcZ(7>@dl%Pd?#c+|Qe+`jRX-|o$Fq)h zwGL5fT8WGHM`LC;af~c&Wk+pT%^;;{QLBJFU#1ILARt82I`*uh3Q}6I>~5ZEetr&% zK9&g|vG8BYp$5hWAIzj0Tgh)b?D+j3@gF?;8mRAxS##Wq+uRZ1lOyDKQ)AGQ|5k2` z(n~SfjvI}I^N>Evw#IVG6GM&H?NJ*1S-e?!`twV3-3qc=?K!HiJ#6~#a*7OSSrS_q z6j}wMI2@)W@;PhFelpf+DB(!R+do4ft(XxT5Qn>kWX&zy3*T}dNg$__`=)gQQ^df~ zRKD+yAM%~|Q=f%j`8De{?>P#v-x{j@C?gAT49Cp<$PxmP_V_CR)Q7jo2<2kJLD~c$ zUMrW^g@Pye*iN{+f3VmvfHkf6nUUfI4&a$P8imaCn zHK*T>7lQzH4Q!`@6x)6og)r80H5Onyep_tS&o0kZL(yN`=+#Y|u1({bO*GbDNXV-v zxr>gjl6DQev+YkPoSnk`5Qek)x3$J5?T$Bf;F;E`&(PXc?A;CX29X-LDYRt78ORs> zs>gZ5UF?o0b{}*+-T*YTbUKkgB_J?*Grk?{Wgk(=nGQj|_HqFt*`vQOFh7d`nH6Ty zx09M*_55qxN5a6FuP%P6R?#y{e#;ma5(fsGYn^w=4(F^l3tL7gkCNrt>;?J~D840` zXGBRC8w>g|EhH>;l$zo@j8bfk$AC!+4muz@c~J8%qNRpG zi-P0b7Vq~ldrK!NEdlktAHvoaG13?%q{?88`feIv$+R5C=Oit5s z?QB$FIm@mpEi&FLrMBUi4a$dnc?cQJpJ))D{*2xo#vP&F?UANLE8d+CfccG{U42t2 zQ40mE4Ywtx#AeTu$AASIesq~GU~qan{`2dI1?SPW)!a*(p!SXi&TrvIXtS&=rQfDY z2xN{puESGdBhV8}g9(JwB-70In-|67ub^xZpc4b_231E8Evv1V9RpOgxYYxZPtw(x ze?f_l5H=L9G(-Zcm$zEfizr`9*l9ibk`0vVFNsFC`L3HQ9PsC>&dnCOu3R+|c6x87 zGScv{{EdIj$sRJsCZd<;!p3U?yQ<2*vS5xFb_LCKl;SaKnD_|L(+S^d!2lxx2AMp) zUNFAb&hwijpGU7B6xV;*H`1u{w4mqW+X#uxB=E9;voUAQGod)sSN5N`>!UYu1RQD3 zziQE87?&?rp27HM^mePs2A+J0lg_tRoG#IuvP1 zx-9yP+@huclD8%(vp@kkP2pdCd`ru=BzfK8$=E$emKqLfx^A%tf#YUlEA87v0IM}- z6O@?)2m^s}i>4>=?cr)-+b3jU;{Rea#S z3fvA0gE*3(u!B=kX4kQ8iv_LHzMHzgG1t)08kOTaFEH#00A;N2e!U7~^iCUyn`U>h z$^iM~-i?+MU)EH`WfY_HZP(E;bdi-9#hZ2@S|6Ky?yp~8gsXdI_YS#>{X?i|JM z&L2S*UmDVv`-<(D%@KbF6EB6-(kAtW$`UGbOGsJzs6#_0ha5kIu`-vWN%M}aS zODy<48I|$yJIA|H>Wcl4_uI4Jvv@5hJ-#%AUQp^xjV^lP5rwwK0I}G<6?$W zEPvIf8uqj?IH6P|S5#N0C>+Zct*sN#(#y7_nN@f`(ROb*z~C(jNzcwBW1o%ae+FJL z)~y%B&-V?u+M(JNjkVNv`>fC0#bZN$U;z7pyI+(_Uc!ZhErX}By7m?5X9D^aP>5_l z*3!$WMZc{h!Q(6kHG~%I+t&^p|JLkkX-vOa`KhmYe?$UwdnDlDuh9MnHdHo9V&C>hTieU$ zOEwwL*>3^>M_k{U(dXc+dksQ>?}6Xsql6?3yRwmevQtkQ7}UX~Vh@U98Z9!h=35Wl zlTtf+)S4o(fX}y2w+P}4C4@&}tmtXHJYUx(0W8BmUp9(VoGR1h2 z34G!#J~8gSkq*N5w~DXi6CLw~e#+i~KSYifMSDNHuDlPwPtF;%fu;owPFs?gGAckI z83bq&LGs0*A-SBum69AARgP~UCMu$4u!gOc{j9IJp?;+7kv9`7A3GBKWf>R`)Drer z@71#|a@WcR=={M#$#$jhyr!GW9rt(S-Vu2!P3#`%BN&}3F^*Q+;Ojzu(TM^$^?v|O zuk7m08;GeZ+BZhuwOd?OrE&k`3_4Qy3M?uvNBoYdBzF!0oZ(_UtZTW;|F)Xywhsqh z6PWiknYBobR`+lLUZ7lQl}_=s0loDM#kcSRf8Xy#G<|%xZm3d~Cc|R^`eCOJR0-f} zZ)(leDs6Uv54d?-HV#OCwqBDcD6~%iN5DGEK>VEqO>{Q96yZ1x@^|NV7E_j=l`J#= ziS7YRVK`)~|2FyI1?Vr4Z>eqhHa$=wsfqEnu9EuWcEGi}0BH2;UX$$MZ?MD%4PiT4 zRMI=v;dkzOTp9O=e83fy-w9wR`gf;h`6r^|V4&ky6@8hiHK~u8i6zgW$Pry zxaa#yxiaW8*!FV$_r~%I!imm~xd5>NMX#Jfe|9<-t^A=ebCsOP0o(&TUuWQ`Yl)j+eZl&utPaF&%#3b(X(JnkBQ!^rm2Cs|2ECb zR!$T1fdL=^lVH)!@J`}=r|OZ9|GMp6*cadICdqy1BUltV; zwBtZcGdt6yF^*^}Jk}T@PhIb+P9^;mfg!L78jeyv=_ygE$`)8A#j!dY|6gkbv7&1B zT$~)8VZQTN4R=vfi7=jpr4*{)0EEo$(!hwEwRGitrUtgEZ;Y{xoLp!XtG|1{_rsK) z_Ey<(72NwYRR8>lkY3P^j1~LDAn6&DkV5o->>I*-lm8!9&Hvw?&i~g7m2+e}02Unt zLP5kTEt6Hy^RMwh5sL zA~<9@#xoMZ%Q&s1hJdFb)C<4U|g%!FO)*=)5`dXzm}NJijPs;}tNDFb{+G4VgYl z(k;hQ(FCFXp|&Nq*Kfb22|Z1K+p(Xw6Xrit#sr@ZLes^TB`u1BiIxb7%tPG&dOk*= zkiG+YUBa{BQkXQmL3qZ&c%lB}?cB#1;83@6Z)VP8;J{$M z1nn%yTWBSan61Y6gq)*-a9h3h&v7{Kd&z0Kadp-beVaGY>BX;cC9RLQCzW? z`2&n06@=?wj13L#Dp_A~y%MV;c#%JaLBko0rzi`ZOmJiQ^|H-4))!JB!=u_()DmQ< zWT4!QL9^f&WiLf#3Gefuc`sINj3m9e`f>cOm{AbMRSRRXE1Jj&R~?l;94U3_zJg4F&^%#KR^Qw&iYE|N>G&A z^Nvgw%1&(jA>#OV1;pZG6~35XeO9%xQiel-A(AHM(y9$^WAK*q=YZO<(iat)7$bUo z`!Z0nyI$>M^utCxqeQ0Py1d(oUfL21@of$Xx6nSnvDbK#P|XHclpd58|8I>wW$idL zLE4qlXKTN0k9z{Yqo71WaqHf+Z@$U;DIFoQ3j)3$ z41w}`G z|96xpGSEQCB08@=`iu;e-E8)p>acEqv!GqD=J|*0mH@XoXWvsii81yV1H^y$62e#} z(SyyQyjM+FFZ1V6T+rka`r->bLt2~pP^xyY72enW97{!s3JD}NL|jq= z#O{gLnu^tXSPI&+^|qY4X>C!&ttS$r1>ZH61V&-bGpSxNn)k}pH4h~a?86eoam6>E ze1yCIdAs90{rGhuBksq?joR$fZr}a}YU*Ss1cR=Q#8@}x&YqUxt?Z@6esubntR{^9 zbiu2L5Q*kJwgLGA-BCQ18nX(FG`e>E6W3#Uef9V_&*}4{65$GCthh-@ckcp3Z|l(h zvCwoC>EI~+z?V3E^6$klw|&w6#b25r2h>^=&8p?LIQY{Mb_7&d($nM{ z*t}Fo@ILZ($V<$<%R;eWym=Vkcj<0zNr#vj@dH|ZkWwWugsNFRTwT5Ka=rsx$BQh}0Y{Wa}Dwk5XHWUHXM*AlNf9`Iv zKhO3tcSw??9^*-1I2-UBBJ4(a$F2t=;3kjhAQlh0PEXVIehIf7-!{74t?}(aABs!W zH@=P2W;|Nn*`EaPzO!G{331YG*}4s=ON58j2+mx>RV74E#6M&;gme_b3F$CpKU=6m z7h@S7K?8+-0Y{#Yn)AFpu(sIqNez=GWW&|1G6%sU5k}KK+!%Th;0y1YeH>G`ma2(Je6js& zo_QXM14CEl8X^xK^Fb*hlx>7O*o_C@KcJmGpZH4-VH#eJNCom6^uGbi@V=^i@`N1W zR;s2a6{U*a*VQ|*Eu|>-Vtg;O$(#P-$S6fbmo@(quin8#X{HUjY(AxhBW_1a>zeT^ zP+uR$A)L&&rSchL>w3ztG%z~!xgI2QM-0r)r`GEtjNZdYUj=Oi*3$h!xs=1er_H~; zqX`AInLxrLi}iH3WcD-w;iL%-$zxOudM*Qrhd;-R#aY$+^h_;rV(j#|d#L+9yNB*| zH^B>HNu$3$%`H~z#XRLNd-bifp3*4MyzhR$WU%RPeHEeNRCfDkH4ia|Iqt?cS*ArS zi`6gOqE|p4?|pO;79L3prNbv@))r>+T(QtU?T>*$F)>=+!C^)LM$N?3@* z)6eMp>sV-BjaGb84or={bnBy-;n_B*5D}mYPipfBP)>@)rz9?2v@RS6Fc921zYCPg8jOCrjuiXM+ zzGy|gD`fw0{TSn(ky7sR#W+9n6um)^~J@8E&=ICh}G_Dk3c*LJi`G4|%m zoBfq<_$XVYtWGggYH@6aa*T3GIP>{Bmfz02u7cVAQz@3#(qaM=dDONOnhQF89Kp|| zZ@vi`DrIYEYmNSRYi(0vE8xAyEfi~;yIM~Kt`B|5(_%$R;eI)XEyeP=9-CHuWz zHPk6Z7w+8P$JVnFnJz%n!R-z1dYa;o-3z(<3S9wgUA5mtFjVHCtAnZ&5=~ z|2z!Z1-)PRHS;%>2wTh0+<17}x^UXriGi}G#$|j$8t&O*MfA89vBVjpTgpDQkAiEexME0VyiW+BgWzhLkl?7Ux-*sW{Wa&S(Xl!Tq z70q5OXK=vhTuz=oCFMc&Xlv9LvSGGiV#PV_^9gDAL_CUvBj!h%s859A#UJB29?TUbPj`i7iRu@M7#u^`J~%W+W8{Q@d&7uw=O%4JCOj|$yPc>|Jd8`VIsXuphVAYG8!-}UC6Mp$rQZD&Sf7Cv5@`ql{5z|JftAwS{1 zvMQI$)^&c3{QSY%CBv9F7LV-3e<>-XD1tZ>_KUtQST_oL-5q5VenT4hiuVwvruw7N zn>OT%?RLR^sbsyCv6;RQtNn5LZVOvW+hY=N(KdVtsdZAMB*d+kf3?6y5^5+BW+^@~ z@BQ+RI*e2uRHHtEZ({|$6Xhd#e`S3BlUDWxY9=aKlG z&j^+M(&RK$w%)}GILZj+S$#~(re_Gh9J36Gf9J_fhFy1X{X($&OG^)=;$V&Kj=z<~ z`l19mOS?Ej#m#ZlUhG?>qj+IQeUleSdez%Osrp2BNm%dRl6G*65;T4R{r>OWE=mcp zgvR=hwj4rcnl9&dK2WJ1;aJoEDph4f3)Usb^TlqrzY^b(V?4upNyC9O4AZMuD=J#- z8G9X=#xH>AX~{tcyZRDsAxnEFBRHbmHXf&$+l3Zu@~$rjyR8aze0$aI^`G4Jj8w@} z2jNNe=(PBd`rAtLI`6LF$8X9jj1y(y;NU))A!h1+n;yz(J46_#95?0V5id$3C#z`u zQ`EM2DcRRpzPtYB(k;Vlp=Zr=)wS2e!Q*50igF)4G@no+3WW(tB%rJvPSa&^Rnbuy z0q+XJYw?%#hrs;<;C#h!ktq zdgA-OZ56&4!SGEzC(peREnlpQ&;~xx_0jUBqNn}t!_!l$W9!?`;g1iEVt)So1$nTw zr+T8jCUW};N;i2F`I91e0}~%g*~!Ax!{aZ>zLv_jiG$N`Sv{dbv4SWE;koA{#1Kvv zeFWkdN(56+O|UWi-oYAL0bC*sHljdD{*sb?K$U)fEjPorXYw&^dL-N6S4{3|&RIN> zl`4;JM4nFV4_0@HyA#*@kcH^0wQO^H zk({^8oSa-5t)?9J?srq}R(wPoL?GgFM(#D+z7izGkckuud*&gQ#qD1f3tS4(bS1-| z$#^1T&@dqj`ImJ3)rUd-SOE%@9D&w8d2=(>kdwx7z1c1H`}aWmuioH9Y^|?zJvGh6 z_nXeBX^ilpg)em(;ETCF|8APYY$)}!`@m;=_FoHw`?fVvV$fu!CzgNkj_>-Ws`F>~ z-?mi)VP;R#J)yiEj37J;!KTbX^zp%3WH?MeOYC!y8^weX&HLED(J)UPz@h_K#nm{* zB;kFEFpk%fN=t2^0^}4o;8DwM?R~sKxbAxP0 zLKd%9>S7yK+{4FQY)QX^(iL1*(23?mcz{o+DY)}?qkngE*$+Xdkf zS*V}?X8PUuBKe~iJ~ZMu%ZL(%-)Cj=nP(F_D1aOQfB@Tmd1FOE$_#A;HzgS|JjW?~^?0NgIlsQxEF@^n%XaVRHUjO_&~-JM zu3`&wlSGu-e@`Vh?VE#g)^>5T%J({Mkqz;`5K&_~!PGMe9LG2wdmD z%@hQJO(R+RV@EIPFif>byELOWe*&WCZN?coOtoaTgdK#(T{;?dpN@7iGa4_SXx?i# zx1?TC`(vYy=j0H({;ijpV9ocj>`4?ZFNP=&g303-0$$5_%N)z^e@PkITFQfDVyV_f zw~E#xQAng4J#?`4G2_>$`r$!_YRTdS`=p&d&C4-rPM4}nUUbB>2H%9o18yJIgNJgqh5^|AQ`gt%wNJlIYR_;&iit7__5AVzS z8~H(rQ2EKrrked;u|<2PbK-b7Xuyvujn<91nTw3go)EWPUYT#BEYNHLgmmOX^hgAu zXTrB$K+9KWI;QjU=#7nSwX-Hc`2YOdd7RyAY01>j0lcL@HYU3Mi+PA{E^P!YLr^kq zbAh+V^R4UGKAKoGjgT7`+|cjS--2HSc~D+zUc8~ODAr1Rk#EB^k{}+0*Ff*rK&k!* zoTkz(^pv^xM`rMYs3oeIa#r^3D}^aRmF$ssT*T_o)ONbOiLhodMw{Sk7 zuE0oDtzIulEV2-ZapJyM?Lu8@D33e(##+9P;k2nsB zhZjHs{fisrSA+4mK&Dv7rwy{euz}b>Fr(t(`%LpipvOL$b8>vuKs{!B(f&!6+KbWP zj2A#!g7zJ@_z5k0%2-Ugir!gwZYj#O%zx z4zl>zs01|)#_N2x7Zj_|D1Q^MX?o6d8IgnVd=xl-g&~}A5_5FRzM{T3BkPU#u(BkYQR zi$4xXCk^kz4ajc{jSj$WJkswYkiy^~y41ROgSPc5{~7eLC_tY)j(Pls9Yx4R%pEOp zr#k?uh%vu=h}sz1+b#}WuL0FW2_XTeUICv821~(-f(&i(Mng6bdhcN}&n2p#Ok}Z= zCt?Csh6>y}4n}18--sXKeK+D_?TU4l;ENCLz#vd0i7>5pwRXL_ZEWaz$p40=&3QZ@ zaSS*)(kT+H%U83fG#Tu_J|m2PLK#&1$60c|fD{g^QK-%lrU!BfLXtP1(%&c*aZL1w z`ooha6(2E1np|?>5vh2cNVff%b#|i?(DlMcIL9a{N9PaIJgvqvagQ$p2I9hQKA1J%NOv6>>8 zCBIo6Mgwj5lYpw3<4uB89S^@=|MY$uC<(~Bqaqa7dF9?LL3r(%;%bxkm|0&DoZn7! z;Dq`78W47?yp8E<7uDaoP}hgWh4fHU)jeB^2R3p17x<3v)6Dy`(@LucjxDS*{z@tG zYNwp>YFkcN3TDuMWvNo0Hc2$q!oe<3v&t918bVnK`p-Wi>$v11_D=kHR?$+o`C{hI zzs4zR#Wr*TyU7J>R+KRa*|IPi6^08}_ncj6`i7NhTxgA3GY37Hxn2Et{^DSl+KGL) z25te*;S=>sZLCwZO9D(eseV3~jB%7@&}h}zRnZ2n|HJ5a6uMZB4c8^RhYi{#3F|#1 zVp%5cGsyif5-vjX6h8lSev!tnIxI5pBfcykA)fbWHR04lJTQJA@-1SNoGN}`rt5EM zPr5IkU1=sDSuqlE`Y(zD<N*TKEIUi+A}0QC(j1}cj~Zq2#0d-3xxqi>Nu z!i24D6KmWEhpGu9ZwG4vsG~USuQpi-k~FQA{WIFt{6=%TlWEuzU-uY9eM239(B8`9 zYFdlAR=&m;h$e)rM;VstqPif5piKXqIB4I-ZvI`<`8u?Q7m4ACnd1COD#r$lST^nx zi7~CC+EvlEz1J_To4822@ZXl;lbaJ-@8MhTRq+R6|5#N1jy1s9-E0^IRbT3L(z*=v z(oaJYe%sE_oy@kcMmHVBVd`)1zj0qM?2kTI{Nepv78u~Q_1@Dgk;B(RkvnK4$SlfJ z4w*IQ>S+NqqG=cX1ti8pPIXKi-A|AR92SaEFEL3>c&L-ZHW?v(r2UKJmxKyo(+&Yd+=`IYP=+BN=3S5SV!7#64zOWL1GB(a^&xE<`qpgHmB5_5Pw@ZEP-tYaN5XxcO7g!Opf} zRKqipokd}c)1%>XC@ob1b^CLNlA6$xn%LzMI*LtuyQc$O-M2j?1YZ9oQGByBQ;4oP z$9MzL*s^a#_Ly&pXzm~xrMjfR=(s{3;hC601=CMU7l54ggvEM~n!hE0eJM%`8;uHy zh}?LFXoIXfd7?eHUG`t4Ab2rKyJ@?i->7bPa*qxRG>g=j3~AK=$9+LlNsY2Dm$dsK6D}y;|z{&1lyL5u^cqbeG;}@B6C}A#KyOzY3;sR@}jwa z@w9|vL+XO*sa$vRzjk+VQ@>H=i5d6Dd4-XniXT0BFfN~HX9mwk)4tkHYdj!;n#PN4 z;W~ECm8!KdrfJQG+~R+CU*OoCoWYhz_%VuOx!olzqitK)dM|!o^))Ts7vwCDkec(X znseVQ=8A>IIpoWqBqxZr9$bj=Km&iQZ!8hYoS#+%w!_5CFa850s&33xeG=oD2JP{b z;fIGqb$*eFrIJfW=??R-Fm)&-V)Ih{n?*1eM#svN&kPR#88AN>FCX2Xw|RGwDDPFj zAa5_J5rgop-jX6v3cxHif^qsujQuYH_U{W89ngGC8q^cQ5GqgoS7at;T&(v*+9liR z{hY1Sl)j5W%!wVW_zzW%)VHuFW?};j?+2OM-Jeb|?6vXtA0U+=d1+gZ>Xt~qhrI!l z!)?8%lh)I2?BJCHL+a6%y;L)nJ6S0kWG<ct1$V zPawk3pb-~_Z~*V`308GthK3)70Ec)5VUYICG;eDzmP?}o^b1nCEp66$|?)$o9n^w$b)#<^WW*|EAqR3n^3VE`owdqzhx?2u7 zZJ^E+BPD~*PiWqo%Flk54?kf%3R|S*zHCNK7Ue&d@2q5OJaKQnz7bHd=Sg@Aprt!a z_3fKf#38adijI8xZUBBor`8c2*qU#7HrF@42du8xCU#mbYe^ONF>Ly- zvxhqld2ozeOS7w%IBGx|vr8)u zJ|5XU29x??*7xkcH9E*2S!u}C#qJp!cpgZbnhtI@gc*AB8u$(HWtGy&IZC3TXKJnE z(3qAO+QwBz+U}nFA-xDOh#H%?`3>b(<6+Z`pv~tjS9RJnp27UkVCt5BMYinPj|4S) z&@P0S^;fp;3xj@l@q_$+H24`6jSY`)c=2B1dU_6|!`?#QlS!*@`LkR~sI|<}oBgWA z1gGTA3rj#E02Mc5288G(ixsDOCWAIH052FHcAYk6)5F(vHY>I2dDX-=n)w4vy`L+d z`DAXusn2~1#t(=e~caTw9U?%@6`T!?A9PA>f)c%Roz|br; zb4IN2ZiI6~CK`?5+y1|H=jmBA8dRp}tN9JT!(f8l<2{_ULAUtQ{&o3l>CGGllB z=0bO_HLUC&C;r_J~zn z`4`*wHzW=&HaK@b)%{s?g;k;&{>i*dmBo3MAdFc6C10dx%m{G#mZ6bhy@eNM$&E* ziP0z>IutPr zKT4*$n=-xD1+pml@fT%Z8!=!T9?1R}Lm)@oo3nvEgh29~OO}v|vg0EPAR-sGid_t>GuwfGI>mf;H`H+-EP_5ex+-ZY zp?mk>QZ;t$esrHd;!}n9`t3LNf5f8LBtDk%-JOUQFuhbLO$Z(9PO5>vaa7I-cBJSM zZ+jy8YD0X)E&FDAh>oQTD=1_uykZ?vZ0`no-m$*8eV7aKAubaT+h?Csbst#vO!WM9 zyfsJo3qFTA^vrZ=@?gw*K2XTAWA;|>(F4%AjWS?*0;%6OvajR~942v|4k~}zCel15 zyPZQU5%Q~kkkB8r^>=r)%$Ze0<4}}nc;RD(_u?y=kj=GqW){|s!SI)r>pw5M&V&VD zd$gemb2FXqf_GaO}IgDD?8)q*HpzsE8Cn_UsnGt~Qhcj}&+=AxMUU!UjDZeJ;wpjxJS>JXPAGUJC2V=siZ=;RAWJT}@(z z%J8=;)R?RQ!_xr$`8z|`ATM=aYeCiAX}EH=QL+PoM1F;ORc*($XgQtTP>1RhGVTlG zv1m!cEGd|w>`!D>d#O>+*zULd%(CJB-D=L-RuL_L*!D=26)2SI;TAs_|b8A7#^J-&&5i!r*~&OHd=d zMJwjBnzX+bi%TVrcI9yk3bwbw4iOtSNtoe7TwRt1*wjV;{yo>Ww?cznw&%k*2sox6 zxptyE2dvqGGKap4*u94RhXJdqP36IM?io7-)_^a5TTvx<{ha7Y^&8FRJ9$saLiZhk zvGkVX%QOsp^v?2bsj3obKg!IWHGE-lY-$MGrmeU9T>WJ6>5}Z$uSI;5^W-1?y^y4= z*^6%)f-PRIulqMG2~H!O#hQ#9I%Y{P7As2u;oL%|h9^q(j-kl>=fLYG01Q*qCk6r! zf4YGt_ZF_?sZ(8w%qk!S`YRp|q!@_NbZy+=W!JK9bdiSIQtis&jj_zM+xzGnwc}0n z$8zK(F9ISY8I^%-W%$9Ty{(dH-4vp_0XHgPz3znM0$I4t3P<0@(IxohD3o zZ<`w~6}d4RIEBRKvF1xZ7u zfk4+PVJq1Vzvowv zXwbOIjz`+&^5#?BrUwC#*49r9yucWYSE(NSE0Lg+GIoEO6Z>5-B3-O!7Eq-}1^mS} znD-Ux>*>}fIPpp|rr$xPHzk3o)8?U-C5ebje`5=a4z)kEyitlC0bH>_L+gE$hnYy; zQqAj$>zcHL2bfzr%`# zr^DD`Hb(@I>(a4>^>dQso*A}%&wKVMjpGYwwCYMuGwivzQXCe36Z^q6vnq)`O=D5L zbp`R9R0k*qcautd@;Xg&#_i$P?S=-?Qz&Z!F~Q1*luu9!xf)#)VaLYK`DN3k*LX!9 z@RRNzQ!f8m>RI8yO?KM$atG*`+8QE9h{mqFmWW)fv2x|w?zJZ1iZY3)L*VZFYAn)17gr+F^~^iX|FGhhJ1g~DcBv3>HNH@_);^bN;F-fy!tXiNH8 z`{Dr0=O+xxY*0%E#%sL)Fao>c9hXp26>`J<*05`VDb5Tl;cNtW357rB>gzxuThwB; z1YNq46B{|%vx}Mk8om~ZMHYolwCWOxknCsI+cfKw-dcP&#k&n*UJA{>Azr& z?;B+k=w#Y0rZvhPU~V5j5fodCqXt*R?o7lC?R~}UvMORHzkMt}<(CwPCr3=zCOs!3 z3|JfKqx{{zsJMXTP>OP;N|Ue!++tytX1McP54M8gP`j~K2oY-j)5F2NjDWNDty)Ji z6|kmm4zbhr`fN((>mp?#N(+PZk`O@kPOtnGi*_v~#W&LDMHDNqKnew;NyQ{Gju-R; z_9)$cU`en~tyM}}9EMC1h;+O&P>qUMJnp{i1Iw?E`%X;Ppd^W*{;1i`hX#pVy>bN|-{V~3p8KGlWa!R{b^8o(C;O~ylX$+V15RGcK;}$y{)C1rARNW^WmiUM z4;8ED`%D`URY(8^b|Y)KHizR|A}>NS;M1ygBDiXi-Y+)fy`aDBb<_%-4A`BvdvdeW z*XlR-o;9aV=h{cy2#Vzfdz%8%h`w6_zu{wzV?^z1?pdN5L*W|3wzsh3`T{5r^YUO3 zzjseVbf$ReBf$00R~r)=<%;iH6InroBbF;zTfJ{khvso-R$ zzTrQT3QtX6N1v#a{3BHP7wi)Fc+$dNrHrGzsjC8DAfDR{Acfko^3=hRg+sB@{p-C) z-u5j?H={hF{`Eq0J>7pc>T;(AbfeM|U$|Ph0xA-&n=!gP_dHqQNl$5j{9&|9u|xek zWbm2(WlS0-*pzAf8KHsmPkftAc#=#9K(pl+Is|+5oH4*F0?Zfd*(R}gKmdbwT*>|q zRHx~?y8trolnP9IGU{Qd*Qq!WB#F2L4&YQRf< zahH1UE1PWJuh)5~EdS(#n1dxA96_QIAS~>!-6lht4crRv5T|$1^h_37FHG6*YV`a5 zmfyz8-Syti`^)<_DHq#%jdy(T3Sfy#Ku`r`?EV}hYCrWy8B&zw+O^c6%;d8sIFt^= z1NK;8`%`unEpR;OL(R>Itcz^`wm!0Rd^RON#UlUQQQ3B1dhP}>dvzQui6>s;ZdJr* zFlL!Qoh^RQ(D;t51|Xzm0ZVx)_)yo9Y<+~ zv)I>{=Uy!~dCmPpa;w3x)w|I=_}SoO0_pPv#qOmmwOROg+pmC4k~;Er3p@ z4>DbaWIT#lVKt=LZC=WXuevoI@c|08|3_F0%of#P&C%2kc|fX!7x|8HjxH zpuPIADcvx!;qiBQK(Z5TRlsTjWlWP3LsNt4Un4-qm|Q<7^d2)XO>ECb7<*$8Jz6ls z`2o`yw4Od-&>;*2KJL>o((RvHniD$g-l6rreFnaL`TInc>7}@aaXy5lFOMk1%KQ0k6F$6XW{m8ez{KmF3M_Nf^j#acF5V^%jkeo5X$^p_9d-W)LYW9U%EBP{ABr_%NXqYC%E(B`$7mq~DF(OuxQRxB0dX z3XYctvFs0ySIpVhV*1YP&U!P5M!sYdJ>Bl3QM~Gh5u-IQMv21u<}Yc<7}$)sKEfArVCi{ zs6vQ1HA0~H{RhX{)+J+==^3~t;DS_@p)alcTf}M%%1iy#>sQuXxOW?lve^~`%MiRH z@UX9GK3|q~)HW+`fV;VKFumGi#^9hu+bj7JL^uZ^eusNITwd>PUeB|2#c=s+*(DA+m)uH4xOHm3=A80>ryhK!?6Q|Yk)jxvLlvW|V&UzC7Z&Vlp`;9C zu|4i}d-hTGZ^FfT`>We<9bd1CwD3fUMABY^8>{|kDx=moEd~>ewZ@B%_+GlyqEO^m zWpXnbjX4ddo5ZbBBvlH;>;F`bAf~gMqNr)yxG$8@XqS<9G=cN_^{RS1E@jqR2ioW5ZQ;OjJ|dI46=2ddp+l&VGai2ZWY%Pq|orxg%ST@$5b|#t5?9B zU}5|?;;Z-(@+?^5-&4X9_3aQLj2JF_SU$QQu)9t2-Q7m@?pqyE#g$WnsGz<59+wbJ zZ;oG!clMV`?376PwI^5|hoVlgzH@S$yw#X0WH969x~NQFl2To$^9I26sTBF{Q}E8l z?@^JU-IXH09e+2g%xe_PbT?dNFJ(ou>t~UH{5wXT_yHq>mMFb)07=Asl{)wE=tRK@ z1PsMITi!B-h|mlZ+b;AWB=%v#Gw(Z^<&$+RqzOV+0gR8_CaWRE=FseAAhw6Tji`zU zrmp55t)zNPSM!EpJ;@bPZjKqSudG;)u?(|i@~uMhX~D5NQ5Lu-R<{c<48Zaa`dsus zR=Ck>sVZn+7ta0YT5%QVS>xI^Oc?J^n!e+Rvo%)&@khqKj}N*$18#vpyv#u7;+;)p zBr*LtuauuDMSDgScqJ#4HWc*1RILM-rQqM2yMyN~pFdI!xm?r?yKoSE1*t(eBsyvj-CHy+>`aK? ztPK(0sf9w{z5OJ;=H~HUe9&HpcPie8 z=>f{N+`JFu~8 z#lO?9Acn+Y9C^K+$0wCKjqKmMZpVK4F<&nRDxUt>JsY2pvO#bUwW*Acl276x96_P6 zxdDLcSUU_?@jsZZNww1r>5H9miwT*>t93!clP_)l0N*hn9mNk8x+x&9dGskFocUFK z8DQeqy2nPcEYFpsEj6`I%2-vqwpL#8FgA4Q3Ez)Ny{_px!yVv|HlS^d^>BNF^kEH9 z-@a0TawOVi_7V{?u+y>{{gGuqfNQKK_Azz#KI-|NX`xJc(1R&YfAvZs^x)M#&}zYD`1WU+7qjPbGOe zZB{=ngeK)VMB8rt?yqb{xLZcgju@{!=?M=iw#6j?+uW>nn9sHDaG+1hCXh#$CC{f& z58fHlgKiqkRfBO(yvIVIE{RE5J-;$s?$n2WHRgpc6vZd(4m7%ysO@4+a~Rva$S1V) z^jgl?Y9M_ta=S{qOwaXtjMhcIpS`%+0sWcdiIlXGwweusK=Qr|lBWc~5*nQ;;xFSh z8v|G=whJ6!$jf3+x|Ov^=DGFF{nZ+WXf*GNkQNv?;(%Zcc-sKhIsac5*?jRJaH+ul zfuW@3Nd*3M{DAx6ngY(??1loY#2 - - - - - - - - - image/svg+xml - - - - - - - - - - - - - - - - - - - - - - - Backend Pod 1 - labels: app=MyAppport: 9376 - - - - - - Backend Pod 2 - labels: app=MyAppport: 9376 - - - - - - Backend Pod 3 - labels: app=MyAppport: 9376 - - - - - - - - - - - - - - - Client - - - - - - kube-proxy - - - - - - - apiserver - - - - - diff --git a/release-0.19.0/docs/sharing-clusters.md b/release-0.19.0/docs/sharing-clusters.md deleted file mode 100644 index 269a3594d1a..00000000000 --- a/release-0.19.0/docs/sharing-clusters.md +++ /dev/null @@ -1,112 +0,0 @@ -# Sharing Cluster Access - -Client access to a running kubernetes cluster can be shared by copying -the `kubectl` client config bundle ([.kubeconfig](kubeconfig-file.md)). -This config bundle lives in `$HOME/.kube/config`, and is generated -by `cluster/kube-up.sh`. Sample steps for sharing `kubeconfig` below. - -**1. Create a cluster** -```bash -cluster/kube-up.sh -``` -**2. Copy `kubeconfig` to new host** -```bash -scp $HOME/.kube/config user@remotehost:/path/to/.kube/config -``` - -**3. On new host, make copied `config` available to `kubectl`** - -* Option A: copy to default location -```bash -mv /path/to/.kube/config $HOME/.kube/config -``` -* Option B: copy to working directory (from which kubectl is run) -```bash -mv /path/to/.kube/config $PWD -``` -* Option C: manually pass `kubeconfig` location to `.kubectl` -```bash -# via environment variable -export KUBECONFIG=/path/to/.kube/config - -# via commandline flag -kubectl ... --kubeconfig=/path/to/.kube/config -``` - -## Manually Generating `kubeconfig` - -`kubeconfig` is generated by `kube-up` but you can generate your own -using (any desired subset of) the following commands. - -```bash -# create kubeconfig entry -kubectl config set-cluster $CLUSTER_NICK - --server=https://1.1.1.1 \ - --certificate-authority=/path/to/apiserver/ca_file \ - --embed-certs=true \ - # Or if tls not needed, replace --certificate-authority and --embed-certs with - --insecure-skip-tls-verify=true - --kubeconfig=/path/to/standalone/.kube/config - -# create user entry -kubectl config set-credentials $USER_NICK - # bearer token credentials, generated on kube master - --token=$token \ - # use either username|password or token, not both - --username=$username \ - --password=$password \ - --client-certificate=/path/to/crt_file \ - --client-key=/path/to/key_file \ - --embed-certs=true - --kubeconfig=/path/to/standalone/.kubeconfig - -# create context entry -kubectl config set-context $CONTEXT_NAME --cluster=$CLUSTER_NICKNAME --user=$USER_NICK -``` -Notes: -* The `--embed-certs` flag is needed to generate a standalone -`kubeconfig`, that will work as-is on another host. -* `--kubeconfig` is both the preferred file to load config from and the file to -save config too. In the above commands the `--kubeconfig` file could be -omitted if you first run -```bash -export KUBECONFIG=/path/to/standalone/.kube/config -``` -* The ca_file, key_file, and cert_file referenced above are generated on the -kube master at cluster turnup. They can be found on the master under -`/srv/kubernetes`. Bearer token/basic auth are also generated on the kube master. - -For more details on `kubeconfig` see [kubeconfig-file.md](kubeconfig-file.md), -and/or run `kubectl config -h`. - -## Merging `kubeconfig` Example - -`kubectl` loads and merges config from the following locations (in order) - -1. `--kubeconfig=path/to/.kube/config` commandline flag -2. `KUBECONFIG=path/to/.kube/config` env variable -3. `$PWD/.kubeconfig` -4. `$HOME/.kube/config` - -If you create clusters A, B on host1, and clusters C, D on host2, you can -make all four clusters available on both hosts by running - -```bash -# on host2, copy host1's default kubeconfig, and merge it from env -scp host1:/path/to/home1/.kube/config path/to/other/.kube/config - -export $KUBECONFIG=path/to/other/.kube/config - -# on host1, copy host2's default kubeconfig and merge it from env -scp host2:/path/to/home2/.kube/config path/to/other/.kube/config - -export $KUBECONFIG=path/to/other/.kube/config -``` -Detailed examples and explanation of `kubeconfig` loading/merging rules can be found in [kubeconfig-file.md](http://docs.k8s.io/kubeconfig-file.md). - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/sharing-clusters.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/sharing-clusters.md?pixel)]() diff --git a/release-0.19.0/docs/ui.md b/release-0.19.0/docs/ui.md deleted file mode 100644 index 04111536b82..00000000000 --- a/release-0.19.0/docs/ui.md +++ /dev/null @@ -1,23 +0,0 @@ -# Kubernetes UI Instructions - -## Kubernetes User Interface -Kubernetes has an extensible user interface with default functionality that describes the current cluster. See the [README](../www/README.md) in the www directory for more information. - -### Running locally -Assuming that you have a cluster running locally at `localhost:8080`, as described [here](getting-started-guides/locally.md), you can run the UI against it with kubectl: - -```sh -kubectl proxy --www=www/app --www-prefix=/ -``` - -You should now be able to access it by visiting [localhost:8001](http://localhost:8001/). - -You can also use other web servers to serve the contents of the www/app directory, as described [here](../www/README.md#serving-the-app-during-development). - -### Running remotely -When Kubernetes is deployed remotely, the api server deploys the UI. To access it, visit `/static/app/` or `/ui`, which redirects to `/static/app/`, on your master server. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/ui.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/ui.md?pixel)]() diff --git a/release-0.19.0/docs/user-guide.md b/release-0.19.0/docs/user-guide.md deleted file mode 100644 index 8c257b22a57..00000000000 --- a/release-0.19.0/docs/user-guide.md +++ /dev/null @@ -1,99 +0,0 @@ -# Kubernetes User Guide - -The user guide is intended for anyone who wants to run programs and services -on an existing Kubernetes cluster. Setup and administration of a -Kubernetes cluster is described in the [Cluster Admin Guide](cluster-admin-guide.md). -The developer guide is for anyone wanting to either write code which directly accesses the -kubernetes API, or to contribute directly to the kubernetes project. - -## Primary concepts - -* **Overview** ([overview.md](overview.md)): A brief overview - of Kubernetes concepts. - -* **Nodes** ([node.md](node.md)): A node is a worker machine in Kubernetes. - -* **Pods** ([pods.md](pods.md)): A pod is a tightly-coupled group of containers - with shared volumes. - -* **The Life of a Pod** ([pod-states.md](pod-states.md)): - Covers the intersection of pod states, the PodStatus type, the life-cycle - of a pod, events, restart policies, and replication controllers. - -* **Replication Controllers** ([replication-controller.md](replication-controller.md)): - A replication controller ensures that a specified number of pod "replicas" are - running at any one time. - -* **Services** ([services.md](services.md)): A Kubernetes service is an abstraction - which defines a logical set of pods and a policy by which to access them. - -* **Volumes** ([volumes.md](volumes.md)): A Volume is a directory, possibly with some - data in it, which is accessible to a Container. - -* **Labels** ([labels.md](labels.md)): Labels are key/value pairs that are - attached to objects, such as pods. Labels can be used to organize and to - select subsets of objects. - -* **Secrets** ([secrets.md](secrets.md)): A Secret stores sensitive data - (e.g. ssh keys, passwords) separately from the Pods that use them, protecting - the sensitive data from proliferation by tools that process pods. - -* **Accessing the API and other cluster services via a Proxy** [accessing-the-cluster.md](../docs/accessing-the-cluster.md) - -* **API Overview** ([api.md](api.md)): Pointers to API documentation on various topics - and explanation of Kubernetes's approaches to API changes and API versioning. - -* **Kubernetes Web Interface** ([ui.md](ui.md)): Accessing the Kubernetes - web user interface. - -* **Kubectl Command Line Interface** ([kubectl.md](kubectl.md)): - The `kubectl` command line reference. - -* **Sharing Cluster Access** ([sharing-clusters.md](sharing-clusters.md)): - How to share client credentials for a kubernetes cluster. - -* **Roadmap** ([roadmap.md](roadmap.md)): The set of supported use cases, features, - docs, and patterns that are required before Kubernetes 1.0. - -* **Glossary** ([glossary.md](glossary.md)): Terms and concepts. - -## Further reading - - -* **Annotations** ([annotations.md](annotations.md)): Attaching - arbitrary non-identifying metadata. - -* **Kubernetes Container Environment** ([container-environment.md](container-environment.md)): - Describes the environment for Kubelet managed containers on a Kubernetes - node. - -* **DNS Integration with SkyDNS** ([dns.md](dns.md)): - Resolving a DNS name directly to a Kubernetes service. - -* **Identifiers** ([identifiers.md](identifiers.md)): Names and UIDs - explained. - -* **Images** ([images.md](images.md)): Information about container images - and private registries. - -* **Logging** ([logging.md](logging.md)): Pointers to logging info. - -* **Namespaces** ([namespaces.md](namespaces.md)): Namespaces help different - projects, teams, or customers to share a kubernetes cluster. - -* **Networking** ([networking.md](networking.md)): Pod networking overview. - -* **The Kubernetes Resource Model** ([resources.md](resources.md)): - Provides resource information such as size, type, and quantity to assist in - assigning Kubernetes resources appropriately. - -* The [API object documentation](http://kubernetes.io/third_party/swagger-ui/). - -* Frequently asked questions are answered on this project's [wiki](https://github.com/GoogleCloudPlatform/kubernetes/wiki). - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/user-guide.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/user-guide.md?pixel)]() diff --git a/release-0.19.0/docs/versioning.md b/release-0.19.0/docs/versioning.md deleted file mode 100644 index de882759d30..00000000000 --- a/release-0.19.0/docs/versioning.md +++ /dev/null @@ -1,51 +0,0 @@ -# Kubernetes API and Release Versioning - -Legend: - -* **Kube <major>.<minor>.<patch>** refers to the version of Kubernetes that is released. This versions all components: apiserver, kubelet, kubectl, etc. -* **API vX[betaY]** refers to the version of the HTTP API. - -## Release Timeline - -### Minor version timeline - -* Kube 1.0.0 -* Kube 1.0.x: We create a 1.0-patch branch and backport critical bugs and security issues to it. Patch releases occur as needed. -* Kube 1.1-alpha1: Cut from HEAD, smoke tested and released two weeks after Kube 1.0's release. Roughly every two weeks a new alpha is released from HEAD. The timeline is flexible; for example, if there is a critical bugfix, a new alpha can be released ahead of schedule. (This applies to the beta and rc releases as well.) -* Kube 1.1-beta1: When HEAD is feature complete, we create a 1.1-snapshot branch and release it as a beta. (The 1.1-snapshot branch may be created earlier if something that definitely won't be in 1.1 needs to be merged to HEAD.) This should occur 6-8 weeks after Kube 1.0. Development continues at HEAD and only fixes are backported to 1.1-snapshot. -* Kube 1.1-rc1: Released from 1.1-snapshot when it is considered stable and ready for testing. Most users should be able to upgrade to this version in production. -* Kube 1.1: Final release. Should occur between 3 and 4 months after 1.0. - -### Major version timeline - -There is no mandated timeline for major versions. They only occur when we need to start the clock on deprecating features. A given major version should be the latest major version for at least one year from its original release date. - -## Release versions as related to API versions - -Here is an example major release cycle: - -* **Kube 1.0 should have API v1 without v1beta\* API versions** - * The last version of Kube before 1.0 (e.g. 0.14 or whatever it is) will have the stable v1 API. This enables you to migrate all your objects off of the beta API versions of the API and allows us to remove those beta API versions in Kube 1.0 with no effect. There will be tooling to help you detect and migrate any v1beta\* data versions or calls to v1 before you do the upgrade. -* **Kube 1.x may have API v2beta*** - * The first incarnation of a new (backwards-incompatible) API in HEAD is v2beta1. By default this will be unregistered in apiserver, so it can change freely. Once it is available by default in apiserver (which may not happen for several minor releases), it cannot change ever again because we serialize objects in versioned form, and we always need to be able to deserialize any objects that are saved in etcd, even between alpha versions. If further changes to v2beta1 need to be made, v2beta2 is created, and so on, in subsequent 1.x versions. -* **Kube 1.y (where y is the last version of the 1.x series) must have final API v2** - * Before Kube 2.0 is cut, API v2 must be released in 1.x. This enables two things: (1) users can upgrade to API v2 when running Kube 1.x and then switch over to Kube 2.x transparently, and (2) in the Kube 2.0 release itself we can cleanup and remove all API v2beta\* versions because no one should have v2beta\* objects left in their database. As mentioned above, tooling will exist to make sure there are no calls or references to a given API version anywhere inside someone's kube installation before someone upgrades. - * Kube 2.0 must include the v1 API, but Kube 3.0 must include the v2 API only. It *may* include the v1 API as well if the burden is not high - this will be determined on a per-major-version basis. - -## Rationale for API v2 being complete before v2.0's release - -It may seem a bit strange to complete the v2 API before v2.0 is released, but *adding* a v2 API is not a breaking change. *Removing* the v2beta\* APIs *is* a breaking change, which is what necessitates the major version bump. There are other ways to do this, but having the major release be the fresh start of that release's API without the baggage of its beta versions seems most intuitive out of the available options. - -# Upgrades - -* Users can upgrade from any Kube 1.x release to any other Kube 1.x release as a rolling upgrade across their cluster. (Rolling upgrade means being able to upgrade the master first, then one node at a time. See #4855 for details.) -* No hard breaking changes over version boundaries. - * For example, if a user is at Kube 1.x, we may require them to upgrade to Kube 1.x+y before upgrading to Kube 2.x. In others words, an upgrade across major versions (e.g. Kube 1.x to Kube 2.x) should effectively be a no-op and as graceful as an upgrade from Kube 1.x to Kube 1.x+1. But you can require someone to go from 1.x to 1.x+y before they go to 2.x. - -There is a separate question of how to track the capabilities of a kubelet to facilitate rolling upgrades. That is not addressed here. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/versioning.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/versioning.md?pixel)]() diff --git a/release-0.19.0/docs/volumes.md b/release-0.19.0/docs/volumes.md deleted file mode 100644 index 7059de0d613..00000000000 --- a/release-0.19.0/docs/volumes.md +++ /dev/null @@ -1,96 +0,0 @@ -# Volumes -This document describes the current state of Volumes in kubernetes. Familiarity with [pods](./pods.md) is suggested. - -A Volume is a directory, possibly with some data in it, which is accessible to a Container. Kubernetes Volumes are similar to but not the same as [Docker Volumes](https://docs.docker.com/userguide/dockervolumes/). - -A Pod specifies which Volumes its containers need in its [spec.volumes](http://kubernetes.io/third_party/swagger-ui/#!/v1/createPod) property. - -A process in a Container sees a filesystem view composed from two sources: a single Docker image and zero or more Volumes. A [Docker image](https://docs.docker.com/userguide/dockerimages/) is at the root of the file hierarchy. Any Volumes are mounted at points on the Docker image; Volumes do not mount on other Volumes and do not have hard links to other Volumes. Each container in the Pod independently specifies where on its image to mount each Volume. This is specified in each container's VolumeMounts property. - -## Resources - -The storage media (Disk, SSD, or memory) of a volume is determined by the media of the filesystem holding the kubelet root dir (typically `/var/lib/kubelet`). -There is no limit on how much space an EmptyDir or HostPath volume can consume, and no isolation between containers or between pods. - -In the future, we expect that EmptyDir and HostPath volumes will be able to request a certain amount of space using a [resource](./resources.md) specification, and to select the type of media to use, for clusters that have several media types. -## Types of Volumes - -Kubernetes currently supports multiple types of Volumes. The community welcomes additional contributions. - -### EmptyDir - -An EmptyDir volume is created when a Pod is bound to a Node. It is initially empty, when the first Container command starts. Containers in the same pod can all read and write the same files in the EmptyDir. When a Pod is unbound, the data in the EmptyDir is deleted forever. - -Some uses for an EmptyDir are: - - scratch space, such as for a disk-based mergesort or checkpointing a long computation. - - a directory that a content-manager container fills with data while a webserver container serves the data. - -Currently, the user cannot control what kind of media is used for an EmptyDir. If the Kubelet is configured to use a disk drive, then all EmptyDirectories will be created on that disk drive. In the future, it is expected that Pods can control whether the EmptyDir is on a disk drive, SSD, or tmpfs. - -### HostPath -A Volume with a HostPath property allows access to files on the current node. - -Some uses for a HostPath are: - - running a container that needs access to Docker internals; use a HostPath of /var/lib/docker. - - running cAdvisor in a container; use a HostPath of /dev/cgroups. - -Watch out when using this type of volume, because: - - pods with identical configuration (such as created from a podTemplate) may behave differently on different nodes due to different files on different nodes. - - When Kubernetes adds resource-aware scheduling, as is planned, it will not be able to account for resources used by a HostPath. - -### GCEPersistentDisk -__Important: You must create a PD using ```gcloud``` or the GCE API before you can use it__ - -A Volume with a GCEPersistentDisk property allows access to files on a Google Compute Engine (GCE) -[Persistent Disk](http://cloud.google.com/compute/docs/disks). - -There are some restrictions when using a GCEPersistentDisk: - - the nodes (what the kubelet runs on) need to be GCE VMs - - those VMs need to be in the same GCE project and zone as the PD - - avoid creating multiple pods that use the same Volume if any mount it read/write. - - if a pod P already mounts a volume read/write, and a second pod Q attempts to use the volume, regardless of if it tries to use it read-only or read/write, Q will fail. - - if a pod P already mounts a volume read-only, and a second pod Q attempts to use the volume read/write, Q will fail. - - replication controllers with replicas > 1 can only be created for pods that use read-only mounts. - -#### Creating a PD -Before you can use a GCE PD with a pod, you need to create it. - -```sh -gcloud compute disks create --size=500GB --zone=us-central1-a my-data-disk -``` - -#### GCE PD Example configuration: -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: testpd -spec: - containers: - - image: kubernetes/pause - name: testcontainer - volumeMounts: - - mountPath: /testpd - name: testvolume - volumes: - - name: testvolume - # This GCE PD must already exist. - gcePersistentDisk: - pdName: test - fsType: ext4 -``` -### NFS - -Kubernetes NFS volumes allow an existing NFS share to be made available to containers within a pod. - -See the [NFS Pod examples](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/nfs/) section for more details. -For example, [nfs-web-pod.yaml](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/nfs/nfs-web-pod.yaml) demonstrates how to specify the usage of an NFS volume within a pod. -In this example one can see that a `volumeMount` called "nfs" is being mounted onto `/var/www/html` in the container "web". -The volume "nfs" is defined as type `nfs`, with the NFS server serving from `nfs-server.default.kube.local` and exporting directory `/` as the share. -The mount being created in this example is not read only. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/volumes.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/volumes.md?pixel)]() diff --git a/release-0.19.0/examples/README.md b/release-0.19.0/examples/README.md deleted file mode 100644 index 850c4b624f7..00000000000 --- a/release-0.19.0/examples/README.md +++ /dev/null @@ -1,16 +0,0 @@ -# Examples - -This directory contains a number of different examples of how to run applications with Kubernetes. - -**Note** -This documentation is current for 0.19.0. - -Examples for previous releases is available in their respective branches: - * [v0.18.1](https://github.com/GoogleCloudPlatform/kubernetes/tree/release-0.18/examples) - * [v0.17.1](https://github.com/GoogleCloudPlatform/kubernetes/tree/release-0.17/examples) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/README.md?pixel)]() diff --git a/release-0.19.0/examples/cassandra/README.md b/release-0.19.0/examples/cassandra/README.md deleted file mode 100644 index a61aa5a8193..00000000000 --- a/release-0.19.0/examples/cassandra/README.md +++ /dev/null @@ -1,271 +0,0 @@ -## Cloud Native Deployments of Cassandra using Kubernetes - -The following document describes the development of a _cloud native_ [Cassandra](http://cassandra.apache.org/) deployment on Kubernetes. When we say _cloud native_ we mean an application which understands that it is running within a cluster manager, and uses this cluster management infrastructure to help implement the application. In particular, in this instance, a custom Cassandra ```SeedProvider``` is used to enable Cassandra to dynamically discover new Cassandra nodes as they join the cluster. - -This document also attempts to describe the core components of Kubernetes: _Pods_, _Services_, and _Replication Controllers_. - -### Prerequisites -This example assumes that you have a Kubernetes cluster installed and running, and that you have installed the ```kubectl``` command line tool somewhere in your path. Please see the [getting started](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/docs/getting-started-guides) for installation instructions for your platform. - -### A note for the impatient -This is a somewhat long tutorial. If you want to jump straight to the "do it now" commands, please see the [tl; dr](#tl-dr) at the end. - -### Simple Single Pod Cassandra Node -In Kubernetes, the atomic unit of an application is a [_Pod_](../../docs/pods.md). A Pod is one or more containers that _must_ be scheduled onto the same host. All containers in a pod share a network namespace, and may optionally share mounted volumes. In this simple case, we define a single container running Cassandra for our pod: - -```yaml -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - name: cassandra - name: cassandra -spec: - containers: - - args: - - /run.sh - resources: - limits: - cpu: "1" - image: kubernetes/cassandra:v2 - name: cassandra - ports: - - name: cql - containerPort: 9042 - - name: thrift - containerPort: 9160 - volumeMounts: - - name: data - mountPath: /cassandra_data - env: - - name: MAX_HEAP_SIZE - value: 512M - - name: HEAP_NEWSIZE - value: 100M - - name: KUBERNETES_API_PROTOCOL - value: http - volumes: - - name: data - emptyDir: {} -``` - -There are a few things to note in this description. First is that we are running the ```kubernetes/cassandra``` image. This is a standard Cassandra installation on top of Debian. However it also adds a custom [```SeedProvider```](https://svn.apache.org/repos/asf/cassandra/trunk/src/java/org/apache/cassandra/locator/SeedProvider.java) to Cassandra. In Cassandra, a ```SeedProvider``` bootstraps the gossip protocol that Cassandra uses to find other nodes. The ```KubernetesSeedProvider``` discovers the Kubernetes API Server using the built in Kubernetes discovery service, and then uses the Kubernetes API to find new nodes (more on this later) - -You may also note that we are setting some Cassandra parameters (```MAX_HEAP_SIZE``` and ```HEAP_NEWSIZE```). We also tell Kubernetes that the container exposes both the ```CQL``` and ```Thrift``` API ports. Finally, we tell the cluster manager that we need 1 cpu (1 core). - -Given this configuration, we can create the pod as follows - -```sh -$ kubectl create -f cassandra.yaml -``` - -After a few moments, you should be able to see the pod running: - -```sh -$ kubectl get pods cassandra -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -cassandra 10.244.3.3 kubernetes-minion-sft2/104.197.42.181 name=cassandra Running 21 seconds - cassandra kubernetes/cassandra:v2 Running 3 seconds -``` - - -### Adding a Cassandra Service -In Kubernetes a _[Service](../../docs/services.md)_ describes a set of Pods that perform the same task. For example, the set of nodes in a Cassandra cluster, or even the single node we created above. An important use for a Service is to create a load balancer which distributes traffic across members of the set. But a _Service_ can also be used as a standing query which makes a dynamically changing set of Pods (or the single Pod we've already created) available via the Kubernetes API. This is the way that we use initially use Services with Cassandra. - -Here is the service description: -```yaml -apiVersion: v1beta3 -kind: Service -metadata: - labels: - name: cassandra - name: cassandra -spec: - ports: - - port: 9042 - targetPort: 9042 - selector: - name: cassandra -``` - -The important thing to note here is the ```selector```. It is a query over labels, that identifies the set of _Pods_ contained by the _Service_. In this case the selector is ```name=cassandra```. If you look back at the Pod specification above, you'll see that the pod has the corresponding label, so it will be selected for membership in this Service. - -Create this service as follows: -```sh -$ kubectl create -f cassandra-service.yaml -``` - -Once the service is created, you can query it's endpoints: -```sh -$ kubectl get endpoints cassandra -o yaml -apiVersion: v1beta3 -kind: Endpoints -metadata: - creationTimestamp: 2015-04-23T17:21:27Z - name: cassandra - namespace: default - resourceVersion: "857" - selfLink: /api/v1beta3/namespaces/default/endpoints/cassandra - uid: 2c7d36bf-e9dd-11e4-a7ed-42010af011dd -subsets: -- addresses: - - IP: 10.244.3.3 - targetRef: - kind: Pod - name: cassandra - namespace: default - resourceVersion: "769" - uid: d185872c-e9dc-11e4-a7ed-42010af011dd - ports: - - port: 9042 - protocol: TCP - -``` - -You can see that the _Service_ has found the pod we created in step one. - -### Adding replicated nodes -Of course, a single node cluster isn't particularly interesting. The real power of Kubernetes and Cassandra lies in easily building a replicated, scalable Cassandra cluster. - -In Kubernetes a _[Replication Controller](../../docs/replication-controller.md)_ is responsible for replicating sets of identical pods. Like a _Service_ it has a selector query which identifies the members of it's set. Unlike a _Service_ it also has a desired number of replicas, and it will create or delete _Pods_ to ensure that the number of _Pods_ matches up with it's desired state. - -Replication Controllers will "adopt" existing pods that match their selector query, so let's create a Replication Controller with a single replica to adopt our existing Cassandra Pod. - -```yaml -apiVersion: v1beta3 -kind: ReplicationController -metadata: - labels: - name: cassandra - name: cassandra -spec: - replicas: 1 - selector: - name: cassandra - template: - metadata: - labels: - name: cassandra - spec: - containers: - - command: - - /run.sh - resources: - limits: - cpu: 1 - env: - - name: MAX_HEAP_SIZE - key: MAX_HEAP_SIZE - value: 512M - - name: HEAP_NEWSIZE - key: HEAP_NEWSIZE - value: 100M - image: "kubernetes/cassandra:v2" - name: cassandra - ports: - - containerPort: 9042 - name: cql - - containerPort: 9160 - name: thrift - volumeMounts: - - mountPath: /cassandra_data - name: data - volumes: - - name: data - emptyDir: {} -``` - -The bulk of the replication controller config is actually identical to the Cassandra pod declaration above, it simply gives the controller a recipe to use when creating new pods. The other parts are the ```replicaSelector``` which contains the controller's selector query, and the ```replicas``` parameter which specifies the desired number of replicas, in this case 1. - -Create this controller: - -```sh -$ kubectl create -f cassandra-controller.yaml -``` - -Now this is actually not that interesting, since we haven't actually done anything new. Now it will get interesting. - -Let's scale our cluster to 2: -```sh -$ kubectl scale rc cassandra --replicas=2 -``` - -Now if you list the pods in your cluster, you should see two cassandra pods: - -```sh -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -cassandra 10.244.3.3 kubernetes-minion-sft2/104.197.42.181 name=cassandra Running 7 minutes - cassandra kubernetes/cassandra:v2 Running 7 minutes -cassandra-gnhk8 10.244.0.5 kubernetes-minion-dqz3/104.197.2.71 name=cassandra Running About a minute - cassandra kubernetes/cassandra:v2 Running 51 seconds - -``` - -Notice that one of the pods has the human readable name ```cassandra``` that you specified in your config before, and one has a random string, since it was named by the replication controller. - -To prove that this all works, you can use the ```nodetool``` command to examine the status of the cluster, for example: - -```sh -$ ssh 104.197.42.181 -$ docker exec nodetool status -Datacenter: datacenter1 -======================= -Status=Up/Down -|/ State=Normal/Leaving/Joining/Moving --- Address Load Tokens Owns (effective) Host ID Rack -UN 10.244.0.5 74.09 KB 256 100.0% 86feda0f-f070-4a5b-bda1-2eeb0ad08b77 rack1 -UN 10.244.3.3 51.28 KB 256 100.0% dafe3154-1d67-42e1-ac1d-78e7e80dce2b rack1 -``` - -Now let's scale our cluster to 4 nodes: -```sh -$ kubectl scale rc cassandra --replicas=4 -``` - -Examining the status again: -```sh -$ docker exec nodetool status -Datacenter: datacenter1 -======================= -Status=Up/Down -|/ State=Normal/Leaving/Joining/Moving --- Address Load Tokens Owns (effective) Host ID Rack -UN 10.244.2.3 57.61 KB 256 49.1% 9d560d8e-dafb-4a88-8e2f-f554379c21c3 rack1 -UN 10.244.1.7 41.1 KB 256 50.2% 68b8cc9c-2b76-44a4-b033-31402a77b839 rack1 -UN 10.244.0.5 74.09 KB 256 49.7% 86feda0f-f070-4a5b-bda1-2eeb0ad08b77 rack1 -UN 10.244.3.3 51.28 KB 256 51.0% dafe3154-1d67-42e1-ac1d-78e7e80dce2b rack1 -``` - -### tl; dr; -For those of you who are impatient, here is the summary of the commands we ran in this tutorial. - -```sh -# create a single cassandra node -kubectl create -f cassandra.yaml - -# create a service to track all cassandra nodes -kubectl create -f cassandra-service.yaml - -# create a replication controller to replicate cassandra nodes -kubectl create -f cassandra-controller.yaml - -# scale up to 2 nodes -kubectl scale rc cassandra --replicas=2 - -# validate the cluster -docker exec nodetool status - -# scale up to 4 nodes -kubectl scale rc cassandra --replicas=4 -``` - -### Seed Provider Source - -See -[here](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/cassandra/java/src/io/k8s/cassandra/KubernetesSeedProvider.java). - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/cassandra/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/cassandra/README.md?pixel)]() diff --git a/release-0.19.0/examples/cassandra/cassandra-controller.yaml b/release-0.19.0/examples/cassandra/cassandra-controller.yaml deleted file mode 100644 index 1e10c503222..00000000000 --- a/release-0.19.0/examples/cassandra/cassandra-controller.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - labels: - name: cassandra - name: cassandra -spec: - replicas: 1 - selector: - name: cassandra - template: - metadata: - labels: - name: cassandra - spec: - containers: - - command: - - /run.sh - resources: - limits: - cpu: 1 - env: - - name: MAX_HEAP_SIZE - value: 512M - - name: HEAP_NEWSIZE - value: 100M - image: gcr.io/google_containers/cassandra:v3 - name: cassandra - ports: - - containerPort: 9042 - name: cql - - containerPort: 9160 - name: thrift - volumeMounts: - - mountPath: /cassandra_data - name: data - volumes: - - name: data - emptyDir: {} diff --git a/release-0.19.0/examples/cassandra/cassandra-service.yaml b/release-0.19.0/examples/cassandra/cassandra-service.yaml deleted file mode 100644 index 580c0a85551..00000000000 --- a/release-0.19.0/examples/cassandra/cassandra-service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1beta3 -kind: Service -metadata: - labels: - name: cassandra - name: cassandra -spec: - ports: - - port: 9042 - targetPort: 9042 - selector: - name: cassandra diff --git a/release-0.19.0/examples/cassandra/cassandra.yaml b/release-0.19.0/examples/cassandra/cassandra.yaml deleted file mode 100644 index 5240899cf47..00000000000 --- a/release-0.19.0/examples/cassandra/cassandra.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - name: cassandra - name: cassandra -spec: - containers: - - args: - - /run.sh - resources: - limits: - cpu: "1" - image: gcr.io/google_containers/cassandra:v3 - name: cassandra - ports: - - name: cql - containerPort: 9042 - - name: thrift - containerPort: 9160 - volumeMounts: - - name: data - mountPath: /cassandra_data - env: - - name: MAX_HEAP_SIZE - value: 512M - - name: HEAP_NEWSIZE - value: 100M - volumes: - - name: data - emptyDir: {} diff --git a/release-0.19.0/examples/cassandra/image/Dockerfile b/release-0.19.0/examples/cassandra/image/Dockerfile deleted file mode 100644 index 5e8c92c213e..00000000000 --- a/release-0.19.0/examples/cassandra/image/Dockerfile +++ /dev/null @@ -1,22 +0,0 @@ -FROM google/debian:wheezy - -COPY cassandra.list /etc/apt/sources.list.d/cassandra.list - -RUN gpg --keyserver pgp.mit.edu --recv-keys F758CE318D77295D -RUN gpg --export --armor F758CE318D77295D | apt-key add - - -RUN gpg --keyserver pgp.mit.edu --recv-keys 2B5C1B00 -RUN gpg --export --armor 2B5C1B00 | apt-key add - - -RUN gpg --keyserver pgp.mit.edu --recv-keys 0353B12C -RUN gpg --export --armor 0353B12C | apt-key add - - -RUN apt-get update -RUN apt-get -qq -y install cassandra - -COPY cassandra.yaml /etc/cassandra/cassandra.yaml -COPY run.sh /run.sh -COPY kubernetes-cassandra.jar /kubernetes-cassandra.jar -RUN chmod a+x /run.sh - -CMD /run.sh diff --git a/release-0.19.0/examples/cassandra/image/cassandra.list b/release-0.19.0/examples/cassandra/image/cassandra.list deleted file mode 100644 index 02e06f2d1ea..00000000000 --- a/release-0.19.0/examples/cassandra/image/cassandra.list +++ /dev/null @@ -1,3 +0,0 @@ -deb http://www.apache.org/dist/cassandra/debian 21x main -deb-src http://www.apache.org/dist/cassandra/debian 21x main - diff --git a/release-0.19.0/examples/cassandra/image/cassandra.yaml b/release-0.19.0/examples/cassandra/image/cassandra.yaml deleted file mode 100644 index b1543f2405b..00000000000 --- a/release-0.19.0/examples/cassandra/image/cassandra.yaml +++ /dev/null @@ -1,764 +0,0 @@ -# Cassandra storage config YAML - -# NOTE: -# See http://wiki.apache.org/cassandra/StorageConfiguration for -# full explanations of configuration directives -# /NOTE - -# The name of the cluster. This is mainly used to prevent machines in -# one logical cluster from joining another. -cluster_name: 'Test Cluster' - -# This defines the number of tokens randomly assigned to this node on the ring -# The more tokens, relative to other nodes, the larger the proportion of data -# that this node will store. You probably want all nodes to have the same number -# of tokens assuming they have equal hardware capability. -# -# If you leave this unspecified, Cassandra will use the default of 1 token for legacy compatibility, -# and will use the initial_token as described below. -# -# Specifying initial_token will override this setting on the node's initial start, -# on subsequent starts, this setting will apply even if initial token is set. -# -# If you already have a cluster with 1 token per node, and wish to migrate to -# multiple tokens per node, see http://wiki.apache.org/cassandra/Operations -num_tokens: 256 - -# initial_token allows you to specify tokens manually. While you can use # it with -# vnodes (num_tokens > 1, above) -- in which case you should provide a -# comma-separated list -- it's primarily used when adding nodes # to legacy clusters -# that do not have vnodes enabled. -# initial_token: - -# See http://wiki.apache.org/cassandra/HintedHandoff -# May either be "true" or "false" to enable globally, or contain a list -# of data centers to enable per-datacenter. -# hinted_handoff_enabled: DC1,DC2 -hinted_handoff_enabled: true -# this defines the maximum amount of time a dead host will have hints -# generated. After it has been dead this long, new hints for it will not be -# created until it has been seen alive and gone down again. -max_hint_window_in_ms: 10800000 # 3 hours -# Maximum throttle in KBs per second, per delivery thread. This will be -# reduced proportionally to the number of nodes in the cluster. (If there -# are two nodes in the cluster, each delivery thread will use the maximum -# rate; if there are three, each will throttle to half of the maximum, -# since we expect two nodes to be delivering hints simultaneously.) -hinted_handoff_throttle_in_kb: 1024 -# Number of threads with which to deliver hints; -# Consider increasing this number when you have multi-dc deployments, since -# cross-dc handoff tends to be slower -max_hints_delivery_threads: 2 - -# Maximum throttle in KBs per second, total. This will be -# reduced proportionally to the number of nodes in the cluster. -batchlog_replay_throttle_in_kb: 1024 - -# Authentication backend, implementing IAuthenticator; used to identify users -# Out of the box, Cassandra provides org.apache.cassandra.auth.{AllowAllAuthenticator, -# PasswordAuthenticator}. -# -# - AllowAllAuthenticator performs no checks - set it to disable authentication. -# - PasswordAuthenticator relies on username/password pairs to authenticate -# users. It keeps usernames and hashed passwords in system_auth.credentials table. -# Please increase system_auth keyspace replication factor if you use this authenticator. -authenticator: AllowAllAuthenticator - -# Authorization backend, implementing IAuthorizer; used to limit access/provide permissions -# Out of the box, Cassandra provides org.apache.cassandra.auth.{AllowAllAuthorizer, -# CassandraAuthorizer}. -# -# - AllowAllAuthorizer allows any action to any user - set it to disable authorization. -# - CassandraAuthorizer stores permissions in system_auth.permissions table. Please -# increase system_auth keyspace replication factor if you use this authorizer. -authorizer: AllowAllAuthorizer - -# Validity period for permissions cache (fetching permissions can be an -# expensive operation depending on the authorizer, CassandraAuthorizer is -# one example). Defaults to 2000, set to 0 to disable. -# Will be disabled automatically for AllowAllAuthorizer. -permissions_validity_in_ms: 2000 - -# The partitioner is responsible for distributing groups of rows (by -# partition key) across nodes in the cluster. You should leave this -# alone for new clusters. The partitioner can NOT be changed without -# reloading all data, so when upgrading you should set this to the -# same partitioner you were already using. -# -# Besides Murmur3Partitioner, partitioners included for backwards -# compatibility include RandomPartitioner, ByteOrderedPartitioner, and -# OrderPreservingPartitioner. -# -partitioner: org.apache.cassandra.dht.Murmur3Partitioner - -# Directories where Cassandra should store data on disk. Cassandra -# will spread data evenly across them, subject to the granularity of -# the configured compaction strategy. -# If not set, the default directory is $CASSANDRA_HOME/data/data. -data_file_directories: - - /cassandra_data/data - -# commit log. when running on magnetic HDD, this should be a -# separate spindle than the data directories. -# If not set, the default directory is $CASSANDRA_HOME/data/commitlog. -commitlog_directory: /cassandra_data/commitlog - -# policy for data disk failures: -# die: shut down gossip and Thrift and kill the JVM for any fs errors or -# single-sstable errors, so the node can be replaced. -# stop_paranoid: shut down gossip and Thrift even for single-sstable errors. -# stop: shut down gossip and Thrift, leaving the node effectively dead, but -# can still be inspected via JMX. -# best_effort: stop using the failed disk and respond to requests based on -# remaining available sstables. This means you WILL see obsolete -# data at CL.ONE! -# ignore: ignore fatal errors and let requests fail, as in pre-1.2 Cassandra -disk_failure_policy: stop - -# policy for commit disk failures: -# die: shut down gossip and Thrift and kill the JVM, so the node can be replaced. -# stop: shut down gossip and Thrift, leaving the node effectively dead, but -# can still be inspected via JMX. -# stop_commit: shutdown the commit log, letting writes collect but -# continuing to service reads, as in pre-2.0.5 Cassandra -# ignore: ignore fatal errors and let the batches fail -commit_failure_policy: stop - -# Maximum size of the key cache in memory. -# -# Each key cache hit saves 1 seek and each row cache hit saves 2 seeks at the -# minimum, sometimes more. The key cache is fairly tiny for the amount of -# time it saves, so it's worthwhile to use it at large numbers. -# The row cache saves even more time, but must contain the entire row, -# so it is extremely space-intensive. It's best to only use the -# row cache if you have hot rows or static rows. -# -# NOTE: if you reduce the size, you may not get you hottest keys loaded on startup. -# -# Default value is empty to make it "auto" (min(5% of Heap (in MB), 100MB)). Set to 0 to disable key cache. -key_cache_size_in_mb: - -# Duration in seconds after which Cassandra should -# save the key cache. Caches are saved to saved_caches_directory as -# specified in this configuration file. -# -# Saved caches greatly improve cold-start speeds, and is relatively cheap in -# terms of I/O for the key cache. Row cache saving is much more expensive and -# has limited use. -# -# Default is 14400 or 4 hours. -key_cache_save_period: 14400 - -# Number of keys from the key cache to save -# Disabled by default, meaning all keys are going to be saved -# key_cache_keys_to_save: 100 - -# Maximum size of the row cache in memory. -# NOTE: if you reduce the size, you may not get you hottest keys loaded on startup. -# -# Default value is 0, to disable row caching. -row_cache_size_in_mb: 0 - -# Duration in seconds after which Cassandra should -# save the row cache. Caches are saved to saved_caches_directory as specified -# in this configuration file. -# -# Saved caches greatly improve cold-start speeds, and is relatively cheap in -# terms of I/O for the key cache. Row cache saving is much more expensive and -# has limited use. -# -# Default is 0 to disable saving the row cache. -row_cache_save_period: 0 - -# Number of keys from the row cache to save -# Disabled by default, meaning all keys are going to be saved -# row_cache_keys_to_save: 100 - -# Maximum size of the counter cache in memory. -# -# Counter cache helps to reduce counter locks' contention for hot counter cells. -# In case of RF = 1 a counter cache hit will cause Cassandra to skip the read before -# write entirely. With RF > 1 a counter cache hit will still help to reduce the duration -# of the lock hold, helping with hot counter cell updates, but will not allow skipping -# the read entirely. Only the local (clock, count) tuple of a counter cell is kept -# in memory, not the whole counter, so it's relatively cheap. -# -# NOTE: if you reduce the size, you may not get you hottest keys loaded on startup. -# -# Default value is empty to make it "auto" (min(2.5% of Heap (in MB), 50MB)). Set to 0 to disable counter cache. -# NOTE: if you perform counter deletes and rely on low gcgs, you should disable the counter cache. -counter_cache_size_in_mb: - -# Duration in seconds after which Cassandra should -# save the counter cache (keys only). Caches are saved to saved_caches_directory as -# specified in this configuration file. -# -# Default is 7200 or 2 hours. -counter_cache_save_period: 7200 - -# Number of keys from the counter cache to save -# Disabled by default, meaning all keys are going to be saved -# counter_cache_keys_to_save: 100 - -# The off-heap memory allocator. Affects storage engine metadata as -# well as caches. Experiments show that JEMAlloc saves some memory -# than the native GCC allocator (i.e., JEMalloc is more -# fragmentation-resistant). -# -# Supported values are: NativeAllocator, JEMallocAllocator -# -# If you intend to use JEMallocAllocator you have to install JEMalloc as library and -# modify cassandra-env.sh as directed in the file. -# -# Defaults to NativeAllocator -# memory_allocator: NativeAllocator - -# saved caches -# If not set, the default directory is $CASSANDRA_HOME/data/saved_caches. -saved_caches_directory: /var/lib/cassandra/saved_caches - -# commitlog_sync may be either "periodic" or "batch." -# When in batch mode, Cassandra won't ack writes until the commit log -# has been fsynced to disk. It will wait up to -# commitlog_sync_batch_window_in_ms milliseconds for other writes, before -# performing the sync. -# -# commitlog_sync: batch -# commitlog_sync_batch_window_in_ms: 50 -# -# the other option is "periodic" where writes may be acked immediately -# and the CommitLog is simply synced every commitlog_sync_period_in_ms -# milliseconds. commitlog_periodic_queue_size allows 1024*(CPU cores) pending -# entries on the commitlog queue by default. If you are writing very large -# blobs, you should reduce that; 16*cores works reasonably well for 1MB blobs. -# It should be at least as large as the concurrent_writes setting. -commitlog_sync: periodic -commitlog_sync_period_in_ms: 10000 -# commitlog_periodic_queue_size: - -# The size of the individual commitlog file segments. A commitlog -# segment may be archived, deleted, or recycled once all the data -# in it (potentially from each columnfamily in the system) has been -# flushed to sstables. -# -# The default size is 32, which is almost always fine, but if you are -# archiving commitlog segments (see commitlog_archiving.properties), -# then you probably want a finer granularity of archiving; 8 or 16 MB -# is reasonable. -commitlog_segment_size_in_mb: 32 - -# any class that implements the SeedProvider interface and has a -# constructor that takes a Map of parameters will do. -seed_provider: - # Addresses of hosts that are deemed contact points. - # Cassandra nodes use this list of hosts to find each other and learn - # the topology of the ring. You must change this if you are running - # multiple nodes! - - class_name: io.k8s.cassandra.KubernetesSeedProvider - parameters: - # seeds is actually a comma-delimited list of addresses. - # Ex: ",," - - seeds: "%%ip%%" - -# For workloads with more data than can fit in memory, Cassandra's -# bottleneck will be reads that need to fetch data from -# disk. "concurrent_reads" should be set to (16 * number_of_drives) in -# order to allow the operations to enqueue low enough in the stack -# that the OS and drives can reorder them. Same applies to -# "concurrent_counter_writes", since counter writes read the current -# values before incrementing and writing them back. -# -# On the other hand, since writes are almost never IO bound, the ideal -# number of "concurrent_writes" is dependent on the number of cores in -# your system; (8 * number_of_cores) is a good rule of thumb. -concurrent_reads: 32 -concurrent_writes: 32 -concurrent_counter_writes: 32 - -# Total memory to use for sstable-reading buffers. Defaults to -# the smaller of 1/4 of heap or 512MB. -# file_cache_size_in_mb: 512 - -# Total permitted memory to use for memtables. Cassandra will stop -# accepting writes when the limit is exceeded until a flush completes, -# and will trigger a flush based on memtable_cleanup_threshold -# If omitted, Cassandra will set both to 1/4 the size of the heap. -# memtable_heap_space_in_mb: 2048 -# memtable_offheap_space_in_mb: 2048 - -# Ratio of occupied non-flushing memtable size to total permitted size -# that will trigger a flush of the largest memtable. Lager mct will -# mean larger flushes and hence less compaction, but also less concurrent -# flush activity which can make it difficult to keep your disks fed -# under heavy write load. -# -# memtable_cleanup_threshold defaults to 1 / (memtable_flush_writers + 1) -# memtable_cleanup_threshold: 0.11 - -# Specify the way Cassandra allocates and manages memtable memory. -# Options are: -# heap_buffers: on heap nio buffers -# offheap_buffers: off heap (direct) nio buffers -# offheap_objects: native memory, eliminating nio buffer heap overhead -memtable_allocation_type: heap_buffers - -# Total space to use for commitlogs. Since commitlog segments are -# mmapped, and hence use up address space, the default size is 32 -# on 32-bit JVMs, and 8192 on 64-bit JVMs. -# -# If space gets above this value (it will round up to the next nearest -# segment multiple), Cassandra will flush every dirty CF in the oldest -# segment and remove it. So a small total commitlog space will tend -# to cause more flush activity on less-active columnfamilies. -# commitlog_total_space_in_mb: 8192 - -# This sets the amount of memtable flush writer threads. These will -# be blocked by disk io, and each one will hold a memtable in memory -# while blocked. -# -# memtable_flush_writers defaults to the smaller of (number of disks, -# number of cores), with a minimum of 2 and a maximum of 8. -# -# If your data directories are backed by SSD, you should increase this -# to the number of cores. -#memtable_flush_writers: 8 - -# A fixed memory pool size in MB for for SSTable index summaries. If left -# empty, this will default to 5% of the heap size. If the memory usage of -# all index summaries exceeds this limit, SSTables with low read rates will -# shrink their index summaries in order to meet this limit. However, this -# is a best-effort process. In extreme conditions Cassandra may need to use -# more than this amount of memory. -index_summary_capacity_in_mb: - -# How frequently index summaries should be resampled. This is done -# periodically to redistribute memory from the fixed-size pool to sstables -# proportional their recent read rates. Setting to -1 will disable this -# process, leaving existing index summaries at their current sampling level. -index_summary_resize_interval_in_minutes: 60 - -# Whether to, when doing sequential writing, fsync() at intervals in -# order to force the operating system to flush the dirty -# buffers. Enable this to avoid sudden dirty buffer flushing from -# impacting read latencies. Almost always a good idea on SSDs; not -# necessarily on platters. -trickle_fsync: false -trickle_fsync_interval_in_kb: 10240 - -# TCP port, for commands and data -storage_port: 7000 - -# SSL port, for encrypted communication. Unused unless enabled in -# encryption_options -ssl_storage_port: 7001 - -# Address or interface to bind to and tell other Cassandra nodes to connect to. -# You _must_ change this if you want multiple nodes to be able to communicate! -# -# Set listen_address OR listen_interface, not both. Interfaces must correspond -# to a single address, IP aliasing is not supported. -# -# Leaving it blank leaves it up to InetAddress.getLocalHost(). This -# will always do the Right Thing _if_ the node is properly configured -# (hostname, name resolution, etc), and the Right Thing is to use the -# address associated with the hostname (it might not be). -# -# Setting listen_address to 0.0.0.0 is always wrong. -listen_address: %%ip%% -# listen_interface: eth0 - -# Address to broadcast to other Cassandra nodes -# Leaving this blank will set it to the same value as listen_address -# broadcast_address: 1.2.3.4 - -# Internode authentication backend, implementing IInternodeAuthenticator; -# used to allow/disallow connections from peer nodes. -# internode_authenticator: org.apache.cassandra.auth.AllowAllInternodeAuthenticator - -# Whether to start the native transport server. -# Please note that the address on which the native transport is bound is the -# same as the rpc_address. The port however is different and specified below. -start_native_transport: true -# port for the CQL native transport to listen for clients on -native_transport_port: 9042 -# The maximum threads for handling requests when the native transport is used. -# This is similar to rpc_max_threads though the default differs slightly (and -# there is no native_transport_min_threads, idle threads will always be stopped -# after 30 seconds). -# native_transport_max_threads: 128 -# -# The maximum size of allowed frame. Frame (requests) larger than this will -# be rejected as invalid. The default is 256MB. -# native_transport_max_frame_size_in_mb: 256 - -# Whether to start the thrift rpc server. -start_rpc: true - -# The address or interface to bind the Thrift RPC service and native transport -# server to. -# -# Set rpc_address OR rpc_interface, not both. Interfaces must correspond -# to a single address, IP aliasing is not supported. -# -# Leaving rpc_address blank has the same effect as on listen_address -# (i.e. it will be based on the configured hostname of the node). -# -# Note that unlike listen_address, you can specify 0.0.0.0, but you must also -# set broadcast_rpc_address to a value other than 0.0.0.0. -rpc_address: %%ip%% -# rpc_interface: eth1 - -# port for Thrift to listen for clients on -rpc_port: 9160 - -# RPC address to broadcast to drivers and other Cassandra nodes. This cannot -# be set to 0.0.0.0. If left blank, this will be set to the value of -# rpc_address. If rpc_address is set to 0.0.0.0, broadcast_rpc_address must -# be set. -# broadcast_rpc_address: 1.2.3.4 - -# enable or disable keepalive on rpc/native connections -rpc_keepalive: true - -# Cassandra provides two out-of-the-box options for the RPC Server: -# -# sync -> One thread per thrift connection. For a very large number of clients, memory -# will be your limiting factor. On a 64 bit JVM, 180KB is the minimum stack size -# per thread, and that will correspond to your use of virtual memory (but physical memory -# may be limited depending on use of stack space). -# -# hsha -> Stands for "half synchronous, half asynchronous." All thrift clients are handled -# asynchronously using a small number of threads that does not vary with the amount -# of thrift clients (and thus scales well to many clients). The rpc requests are still -# synchronous (one thread per active request). If hsha is selected then it is essential -# that rpc_max_threads is changed from the default value of unlimited. -# -# The default is sync because on Windows hsha is about 30% slower. On Linux, -# sync/hsha performance is about the same, with hsha of course using less memory. -# -# Alternatively, can provide your own RPC server by providing the fully-qualified class name -# of an o.a.c.t.TServerFactory that can create an instance of it. -rpc_server_type: sync - -# Uncomment rpc_min|max_thread to set request pool size limits. -# -# Regardless of your choice of RPC server (see above), the number of maximum requests in the -# RPC thread pool dictates how many concurrent requests are possible (but if you are using the sync -# RPC server, it also dictates the number of clients that can be connected at all). -# -# The default is unlimited and thus provides no protection against clients overwhelming the server. You are -# encouraged to set a maximum that makes sense for you in production, but do keep in mind that -# rpc_max_threads represents the maximum number of client requests this server may execute concurrently. -# -# rpc_min_threads: 16 -# rpc_max_threads: 2048 - -# uncomment to set socket buffer sizes on rpc connections -# rpc_send_buff_size_in_bytes: -# rpc_recv_buff_size_in_bytes: - -# Uncomment to set socket buffer size for internode communication -# Note that when setting this, the buffer size is limited by net.core.wmem_max -# and when not setting it it is defined by net.ipv4.tcp_wmem -# See: -# /proc/sys/net/core/wmem_max -# /proc/sys/net/core/rmem_max -# /proc/sys/net/ipv4/tcp_wmem -# /proc/sys/net/ipv4/tcp_wmem -# and: man tcp -# internode_send_buff_size_in_bytes: -# internode_recv_buff_size_in_bytes: - -# Frame size for thrift (maximum message length). -thrift_framed_transport_size_in_mb: 15 - -# Set to true to have Cassandra create a hard link to each sstable -# flushed or streamed locally in a backups/ subdirectory of the -# keyspace data. Removing these links is the operator's -# responsibility. -incremental_backups: false - -# Whether or not to take a snapshot before each compaction. Be -# careful using this option, since Cassandra won't clean up the -# snapshots for you. Mostly useful if you're paranoid when there -# is a data format change. -snapshot_before_compaction: false - -# Whether or not a snapshot is taken of the data before keyspace truncation -# or dropping of column families. The STRONGLY advised default of true -# should be used to provide data safety. If you set this flag to false, you will -# lose data on truncation or drop. -auto_snapshot: true - -# When executing a scan, within or across a partition, we need to keep the -# tombstones seen in memory so we can return them to the coordinator, which -# will use them to make sure other replicas also know about the deleted rows. -# With workloads that generate a lot of tombstones, this can cause performance -# problems and even exaust the server heap. -# (http://www.datastax.com/dev/blog/cassandra-anti-patterns-queues-and-queue-like-datasets) -# Adjust the thresholds here if you understand the dangers and want to -# scan more tombstones anyway. These thresholds may also be adjusted at runtime -# using the StorageService mbean. -tombstone_warn_threshold: 1000 -tombstone_failure_threshold: 100000 - -# Granularity of the collation index of rows within a partition. -# Increase if your rows are large, or if you have a very large -# number of rows per partition. The competing goals are these: -# 1) a smaller granularity means more index entries are generated -# and looking up rows withing the partition by collation column -# is faster -# 2) but, Cassandra will keep the collation index in memory for hot -# rows (as part of the key cache), so a larger granularity means -# you can cache more hot rows -column_index_size_in_kb: 64 - - -# Log WARN on any batch size exceeding this value. 5kb per batch by default. -# Caution should be taken on increasing the size of this threshold as it can lead to node instability. -batch_size_warn_threshold_in_kb: 5 - -# Number of simultaneous compactions to allow, NOT including -# validation "compactions" for anti-entropy repair. Simultaneous -# compactions can help preserve read performance in a mixed read/write -# workload, by mitigating the tendency of small sstables to accumulate -# during a single long running compactions. The default is usually -# fine and if you experience problems with compaction running too -# slowly or too fast, you should look at -# compaction_throughput_mb_per_sec first. -# -# concurrent_compactors defaults to the smaller of (number of disks, -# number of cores), with a minimum of 2 and a maximum of 8. -# -# If your data directories are backed by SSD, you should increase this -# to the number of cores. -#concurrent_compactors: 1 - -# Throttles compaction to the given total throughput across the entire -# system. The faster you insert data, the faster you need to compact in -# order to keep the sstable count down, but in general, setting this to -# 16 to 32 times the rate you are inserting data is more than sufficient. -# Setting this to 0 disables throttling. Note that this account for all types -# of compaction, including validation compaction. -compaction_throughput_mb_per_sec: 16 - -# When compacting, the replacement sstable(s) can be opened before they -# are completely written, and used in place of the prior sstables for -# any range that has been written. This helps to smoothly transfer reads -# between the sstables, reducing page cache churn and keeping hot rows hot -sstable_preemptive_open_interval_in_mb: 50 - -# Throttles all outbound streaming file transfers on this node to the -# given total throughput in Mbps. This is necessary because Cassandra does -# mostly sequential IO when streaming data during bootstrap or repair, which -# can lead to saturating the network connection and degrading rpc performance. -# When unset, the default is 200 Mbps or 25 MB/s. -# stream_throughput_outbound_megabits_per_sec: 200 - -# Throttles all streaming file transfer between the datacenters, -# this setting allows users to throttle inter dc stream throughput in addition -# to throttling all network stream traffic as configured with -# stream_throughput_outbound_megabits_per_sec -# inter_dc_stream_throughput_outbound_megabits_per_sec: - -# How long the coordinator should wait for read operations to complete -read_request_timeout_in_ms: 5000 -# How long the coordinator should wait for seq or index scans to complete -range_request_timeout_in_ms: 10000 -# How long the coordinator should wait for writes to complete -write_request_timeout_in_ms: 2000 -# How long the coordinator should wait for counter writes to complete -counter_write_request_timeout_in_ms: 5000 -# How long a coordinator should continue to retry a CAS operation -# that contends with other proposals for the same row -cas_contention_timeout_in_ms: 1000 -# How long the coordinator should wait for truncates to complete -# (This can be much longer, because unless auto_snapshot is disabled -# we need to flush first so we can snapshot before removing the data.) -truncate_request_timeout_in_ms: 60000 -# The default timeout for other, miscellaneous operations -request_timeout_in_ms: 10000 - -# Enable operation timeout information exchange between nodes to accurately -# measure request timeouts. If disabled, replicas will assume that requests -# were forwarded to them instantly by the coordinator, which means that -# under overload conditions we will waste that much extra time processing -# already-timed-out requests. -# -# Warning: before enabling this property make sure to ntp is installed -# and the times are synchronized between the nodes. -cross_node_timeout: false - -# Enable socket timeout for streaming operation. -# When a timeout occurs during streaming, streaming is retried from the start -# of the current file. This _can_ involve re-streaming an important amount of -# data, so you should avoid setting the value too low. -# Default value is 0, which never timeout streams. -# streaming_socket_timeout_in_ms: 0 - -# phi value that must be reached for a host to be marked down. -# most users should never need to adjust this. -# phi_convict_threshold: 8 - -# endpoint_snitch -- Set this to a class that implements -# IEndpointSnitch. The snitch has two functions: -# - it teaches Cassandra enough about your network topology to route -# requests efficiently -# - it allows Cassandra to spread replicas around your cluster to avoid -# correlated failures. It does this by grouping machines into -# "datacenters" and "racks." Cassandra will do its best not to have -# more than one replica on the same "rack" (which may not actually -# be a physical location) -# -# IF YOU CHANGE THE SNITCH AFTER DATA IS INSERTED INTO THE CLUSTER, -# YOU MUST RUN A FULL REPAIR, SINCE THE SNITCH AFFECTS WHERE REPLICAS -# ARE PLACED. -# -# Out of the box, Cassandra provides -# - SimpleSnitch: -# Treats Strategy order as proximity. This can improve cache -# locality when disabling read repair. Only appropriate for -# single-datacenter deployments. -# - GossipingPropertyFileSnitch -# This should be your go-to snitch for production use. The rack -# and datacenter for the local node are defined in -# cassandra-rackdc.properties and propagated to other nodes via -# gossip. If cassandra-topology.properties exists, it is used as a -# fallback, allowing migration from the PropertyFileSnitch. -# - PropertyFileSnitch: -# Proximity is determined by rack and data center, which are -# explicitly configured in cassandra-topology.properties. -# - Ec2Snitch: -# Appropriate for EC2 deployments in a single Region. Loads Region -# and Availability Zone information from the EC2 API. The Region is -# treated as the datacenter, and the Availability Zone as the rack. -# Only private IPs are used, so this will not work across multiple -# Regions. -# - Ec2MultiRegionSnitch: -# Uses public IPs as broadcast_address to allow cross-region -# connectivity. (Thus, you should set seed addresses to the public -# IP as well.) You will need to open the storage_port or -# ssl_storage_port on the public IP firewall. (For intra-Region -# traffic, Cassandra will switch to the private IP after -# establishing a connection.) -# - RackInferringSnitch: -# Proximity is determined by rack and data center, which are -# assumed to correspond to the 3rd and 2nd octet of each node's IP -# address, respectively. Unless this happens to match your -# deployment conventions, this is best used as an example of -# writing a custom Snitch class and is provided in that spirit. -# -# You can use a custom Snitch by setting this to the full class name -# of the snitch, which will be assumed to be on your classpath. -endpoint_snitch: SimpleSnitch - -# controls how often to perform the more expensive part of host score -# calculation -dynamic_snitch_update_interval_in_ms: 100 -# controls how often to reset all host scores, allowing a bad host to -# possibly recover -dynamic_snitch_reset_interval_in_ms: 600000 -# if set greater than zero and read_repair_chance is < 1.0, this will allow -# 'pinning' of replicas to hosts in order to increase cache capacity. -# The badness threshold will control how much worse the pinned host has to be -# before the dynamic snitch will prefer other replicas over it. This is -# expressed as a double which represents a percentage. Thus, a value of -# 0.2 means Cassandra would continue to prefer the static snitch values -# until the pinned host was 20% worse than the fastest. -dynamic_snitch_badness_threshold: 0.1 - -# request_scheduler -- Set this to a class that implements -# RequestScheduler, which will schedule incoming client requests -# according to the specific policy. This is useful for multi-tenancy -# with a single Cassandra cluster. -# NOTE: This is specifically for requests from the client and does -# not affect inter node communication. -# org.apache.cassandra.scheduler.NoScheduler - No scheduling takes place -# org.apache.cassandra.scheduler.RoundRobinScheduler - Round robin of -# client requests to a node with a separate queue for each -# request_scheduler_id. The scheduler is further customized by -# request_scheduler_options as described below. -request_scheduler: org.apache.cassandra.scheduler.NoScheduler - -# Scheduler Options vary based on the type of scheduler -# NoScheduler - Has no options -# RoundRobin -# - throttle_limit -- The throttle_limit is the number of in-flight -# requests per client. Requests beyond -# that limit are queued up until -# running requests can complete. -# The value of 80 here is twice the number of -# concurrent_reads + concurrent_writes. -# - default_weight -- default_weight is optional and allows for -# overriding the default which is 1. -# - weights -- Weights are optional and will default to 1 or the -# overridden default_weight. The weight translates into how -# many requests are handled during each turn of the -# RoundRobin, based on the scheduler id. -# -# request_scheduler_options: -# throttle_limit: 80 -# default_weight: 5 -# weights: -# Keyspace1: 1 -# Keyspace2: 5 - -# request_scheduler_id -- An identifier based on which to perform -# the request scheduling. Currently the only valid option is keyspace. -# request_scheduler_id: keyspace - -# Enable or disable inter-node encryption -# Default settings are TLS v1, RSA 1024-bit keys (it is imperative that -# users generate their own keys) TLS_RSA_WITH_AES_128_CBC_SHA as the cipher -# suite for authentication, key exchange and encryption of the actual data transfers. -# Use the DHE/ECDHE ciphers if running in FIPS 140 compliant mode. -# NOTE: No custom encryption options are enabled at the moment -# The available internode options are : all, none, dc, rack -# -# If set to dc cassandra will encrypt the traffic between the DCs -# If set to rack cassandra will encrypt the traffic between the racks -# -# The passwords used in these options must match the passwords used when generating -# the keystore and truststore. For instructions on generating these files, see: -# http://download.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore -# -server_encryption_options: - internode_encryption: none - keystore: conf/.keystore - keystore_password: cassandra - truststore: conf/.truststore - truststore_password: cassandra - # More advanced defaults below: - # protocol: TLS - # algorithm: SunX509 - # store_type: JKS - # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA] - # require_client_auth: false - -# enable or disable client/server encryption. -client_encryption_options: - enabled: false - keystore: conf/.keystore - keystore_password: cassandra - # require_client_auth: false - # Set trustore and truststore_password if require_client_auth is true - # truststore: conf/.truststore - # truststore_password: cassandra - # More advanced defaults below: - # protocol: TLS - # algorithm: SunX509 - # store_type: JKS - # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA] - -# internode_compression controls whether traffic between nodes is -# compressed. -# can be: all - all traffic is compressed -# dc - traffic between different datacenters is compressed -# none - nothing is compressed. -internode_compression: all - -# Enable or disable tcp_nodelay for inter-dc communication. -# Disabling it will result in larger (but fewer) network packets being sent, -# reducing overhead from the TCP protocol itself, at the cost of increasing -# latency if you block for cross-datacenter responses. -inter_dc_tcp_nodelay: false diff --git a/release-0.19.0/examples/cassandra/image/kubernetes-cassandra.jar b/release-0.19.0/examples/cassandra/image/kubernetes-cassandra.jar deleted file mode 100644 index 93f492965b76845d9e5da5f66b37b3d0c9f940e5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8219 zcmbtZ1yq#lx*kAM=@#i4x*J4Nx?>3Gp}P@~ZUJeKZbZ6~?gkN%?oMeWggYK;j9~uC7at{Dt`a5!ICj+p(HP{jCpbQ2Z zDcIXMn;C)aDOeZ{Eg>SqqirlOh0wawWeuXcO$~2ss>NkF%)->sg^E=ufLNH=O2XBp zoGykH`);_-7rtNAu7vODeulbHSec_zEAVycVPtElY;iMo_PV(_Cv5ec(|JNPfQ@C_ z`dflqu$_g)q6Cyc#8I9b*X;T>vx)xfCXHj} zCW9K=Jt61Y0aCMdr=QN}WF2KStiZI6s`NPkz3#-TIcuu9Jl7FU6J0TwM#0Dw3olK-2yV*MUhO0qVXENGrF^waG3 z9`?K3r;L@NU}#5Rln}yJf`u-J%@O0Ved6RSyIN5l)fBQMXt(VBiu(}evtsZO74#7$ zxR`L{rO84g{`KqylP=U;TQ%i)`A1=YX%@yFP^4YJdtlFu%>vmerd3yRgO1S$cQbqH zu9!Xvo@}Xg<=o@VVL7LgIq#SQv+M!F_V9&vjW496Gu8EE^wcv2`7z`X?xas)-PJIX z`wW1oDCcwdu;%{fhK8}T40YZH4(_9&$+a+JZ|twm+_JO@fBBH1F zRb{zK9dLF1B}zDZlNFN8pgg9op~Rb9{E-5B=Ql~=FKfY#0D_|#xPY8waGI}c@ng2j zg+c!(7(~cLV`F0(%1{qX7Pd}=*^|fuNEMxz=jV*qE^v@o6&$vZ(m$AJaZY(Az5p?1 zy}wkmt>R*@XzS;HW{fLa6_I<^*Lta)Uolioh{?^=4T^4A@p{+CTe_S`T}q>tnf2IcFJ-v#PySz1HFpv;{OfWx;YBR`CtY zkJj|fgSw=f2I&wF?n6At^cVj~5^ObZgtgY8X~JB&n$`aE_{A>75Ewyk;($aaH2BWUxOM!I&rL~guhUza?*L_f zL7r9RY5L?H0s-{nF;7^4MeA%1){cZ$xef#?CBimF`IZLzG##D+2S9ynxSqkaNLoy2 z#FInf4IS&$v=)SSXx_^o2)^W{y)p^K5*J-}|1@kRd3%(#bkKadbD&XUros$=iALCmSrBkujoes{rbqu>oFxqV-9WVj=(z{Wqd0i@j`B(Es;sJZsyY>x=uJ%IE zM418Xl_@Ckoz9fznM_RVtevI3($x3LsxFatEPS=GXJsYBRm=Tg0Ty_nHmlEt=UazV zB$ngnX4CE91tcG=({((fA217P30z9|e^2=q(mdX0<|{P;^1PEJ=A~-wVH% zjkb<27YtJ{q57(H69uBQc_jZ|P-9*iq7D@q`;;}JQAroQd6!&bw1oC5ZHM zjGsLgkhZbG<$ksBjtgALDZXb_r3Zma<%O{yZILG(&y2&v8NJ*amdY?H&7KeK*W;Jv z!#S61%5VZK)9l?)_Ct^tzAO+^LeQ2PN$WyoiQ!=ZZ~Rz$%2bUgvg2C7G}=nSS}q+NbFDk#S$-Bj z#%xLJGy1UokN1i)sGCEmv3F_GR70@R20V{2--6IGsC5xPvM}Y7-m+|zLjAk9@tXRy zF7E>XU3dTh!$0@-cQ=C&^{^)JZ*@5PEIDHU1QH-dKW|GEJZpU+N<<+86d-{R(gaE} zX@e14!{8vC@I(z!v4DW)thtT5f(5EduRc<4(2S=0%xv0uv&~yI*%qz_9%l{qS4Ini z$#>81?!NRKPKBYS!j)-OT^`bS%!G{qKNq3)*tMXdE(sCyb1#eFQ8(cMyGQ~X@#2$F zY4DDOx;CZWhbr4|R-vZ%Bq@17>8c!3)_(!RqFysAA3r9We7e3)m;0HPNcoThHu9Po zS2rPcQQ=UQ7$=9gnQ}dPb5_TrCyd%-?y3ZLF=qFo>9Y^2U}q%O%~X(PN-U~8?dK5G zfkS1t%Ov0Qfg#<`Wza3L3Hgnm<8WKzYg-f#wTKzxE$I&VU|SMUy?{apUa`)1k~+8A zp)E_L$H!c-UQ9wTx0y@nl&0-1ST|a2UReD5U0&-nX;G&mw61b(cOIrO23kiRh+jSn z)9@Z;p=LurCKdG|;|~R50nIoYqC*n5r=ZQl%pR&KYu8%&MRqNZznHbX7aLf@I8e5( z#y>i51%ke<@t-K3K7z48F}FHc5I=Uohd))BLnIK#4au)19KUvCSnpiX)Eab_SavFk z-DmGyg+94>R~l)Ww`^KNILW*I)_Hz>ti8WmqL$LqOxp>ievb1@$1p*^3#C&#-fTW_ z%<|l-wkBsE4MZ$6i#9oA&9DbzsdQhR=HoE2LB!&ueD|Q=GAv2_X`xGtzSGY2YM}dR zFwtVJ7RzPI^y%q#iTW|Z@q0Q(DAZ>-&ZiRc4QY*15?gL3A_7X zr@k_;t#&Zhqjfl3>WA6AuWLZUyBanY=vhKs4fM|}WJeLP^rl!_`HDn!iw4fz?UZUy zb+mZtv>Ki$vJ*CiHeC)YCGGd$t|jtK8sDE`j|1wwQ(V!(qT%khq^{^Fw^nvhif8fh zJHY}rZ91*4LeB`|MD@K=J1t)W@u(&+46nsFrl$6lV=EiWndF`p$H0YBuQ0bd*dLQW zvbK;)jIa}pey)Tws{R-ehHuuWmmDz$nsHE;p+|Bihor?!l=TpJFcBk}bR|7M9?8s? z^}PQh3dVcq_VLe}v(0xT+q2JvD`N35tHEcnBV0PKfchVE3XJqQh+;qt)ng%JZM>~R zIR~P!zC0{5>~=diI^7=fb-@N=K>7*#_w*g~&7p@C?X+2<8RtcybY&EdiyfA$a@Iun zbqtY!cN4P2t}#h$NaOW#<1x=E%w_B)Q!bY%=ozTn8k5P6WCGoNl`@!8Bs9Wowq2Zb(U$H-h1 zH?5jTL*1pUJ#R;f_BRq$qzkgOJfjPe{$Z7fTH&|s@$SfDN%S`Pc0e#Qd5Y-Sy^X?< zhZ;CrH!!@?vI#O#aH{N~R5d;{X+dbIy|-5H2*KV)P24%53|Sgo;dPSeTB>&SQ+dHS zs@kNQmHl$Og)&(*xH7`Px6_qJV0C++>CK%u%VW$chCwzOPkN+jD_{fnIU7w9S62$o zgUU#vAvU*-)XfiBvd@)KoM%wZnQM^bYabzTZlFh(c2%V^tXlR}X!MdUvYs+VOoV@l z@JJyX?9r~Qjauigt5xJoF3Qg7h;oV@j4!(DbA4$Hf08(_6ypL-|DdK0IeO%DVbFsx z{_N$j>7G2-<&48MM=je}SjrH$=vrlZQ#MEqDdyfl9@bkK6T21zjBN&Ck_)zA6P_Y1 z!n*P zblrR(rxa}LVYj_5VqvogPGJn%7R~9gt=U00Ruc>w(My9d8kGQ6Mr>GDcERgLC~E@U z90YMr4%5yAXxzTsQ^;dyrQM@LnP5zvd7A4OLC|Q_znqqdxuj}190lvS5|9!H);##I zN+ZsLH7Lz48FU?2TgFSbjaxZb7#GQvQnn80A>*b1vBk z=a5W)zN_`?a7r#!m368OZgV3J{DBF|HhwvQT`$fuv|wJM&thGQ$_~l88=xPpmEf+p#nNtNO37Kx#nIL(xNzFelX{9oM*E#X#U7lL2qZ8F<>UH*$$RS<^EzwK`I@_oFB(c0LE_jr%+%S=g z>df9B&S%gI+;`+rv-T+ZclqK|b=0>s)Y;#fsx1qcYID9dRV}DHzt<1b1(V3>zul3j z=sn+4#+<|N9g03U#}=${+YhB88CnQ6NF<&C;KB|u%+5EzFRwpLG=i{kka_I39Fr*T zbbqY_mRiwMaDT3q*{SYv+@@9+CY09YxUZD9kC;b;&nGSXZj`+x`9vLyfPneBB+|xI zYIfGqDId4FTDKWw5ONR^O?|uosVVU36lO^seTs8)MKlBij|n zvq5c6NG0lrnzu+8;TTF%=XnpvnM&PJPSP`BOI=nSVb*P*NV&HxAs)yZVhMj3@&iq6 zw3N-a^tQMnNb}y{2H-8{W|Dc?B5-7`JSoq3yBV1gAL|5DK-^X#fR8&Vjf#6*LBGE) zM2|`X1qRIE7a_R8=xpD{!GN$2mBh~gYVeJ>9EL|4boF5$QeZ$_zG3xEk5w>$h_3Ku zZNv{-yV(!|JfIfIxv>sYTl1cxIZWznli6~egNeAMgQQ?`JL+VX7%k&ml3|y}(Uf3z z5ZUu+`k}%2p#jIkxu!^Qld%2rdIR@D#nbsYd2JuC35#_`due5u;xQ17Bd;R8Q6kE@ zahstYQ zdR;^?R-}lNzB}$R@Aic?>?hU3$FQH&520X*?=k2WEQvIF;z&PzlMf6+HdQ%XuBdqM z{!``=aobZi)f3u>q+w%?=v5e1R`)>HB)l_3taG#tf zbK}fjc)VN&EXIy<^sGf4BF-g`R=k&0&*)s_^-o335)Q>G={2~RFh;t}dAsp=Z$(qu zCJ@9@l9LEm(ooN7*A%)7opU!N%XA0-;~U~n6do1w4e=9&x6*e8TmJ+I|0E{)li19L z5rS@-@AOU00960Riv$r6{D+_ zWmD{ky&nl$_b1QLMsGaXnT=N0om{5(d~M-vB+NH`G7HV3ZNR)$8Pxjn0r=}xKUg{j zt&E!IvzE5h7E6K|$T3+n*$gu)9`Oxf4;fOgO6aIY*Y(gSyU`Rad{4L?)X}Y`Llky9 z!uWh~^xBLtk3?-JbwyxxG52j>q+;>&cDqLr6Kt~wFy#qUjMw&?hMutVNMO4lV;To{ za|b$fMraEesW^w)y`LtL#qX#HR?8x!HOUcrlFMD*ZDwF{8P!bt-o!smRx693tiusc z(0M4`I_zY-++dve;byj79UN>HoDlv!5u!JF4{t_QTT_tc=N?TCsE&+g49MAs%_v71$)Q*}+x& z>%7FG3l>@@P7i#E*DQ4zb=o6M!x#Lu?EG_A@v>C7Y4l1G)TES2n77G}aE| zqG?r&{zYQTk3d8KsKu0u>+@;(+CW_B2DwE3Kd!X3x3LA=JDPzV#QMsS{Fu=I?*(-2 zmgdmL)Iyg&1AxJ8aXP*X?I*QBDX;C)#s+~ZGC0ffV@H&zKyJYG5y`p>KD^}NJf5V`fK9;VE_9e)_0|lZSwvd z`~N=D`gH=|g#SLt_$53Vav*=$_8)|QpKJUs{C8;lm+&-58TzNf{|zYrUB&O%?JpI2 z5dZvB6~7_5zbpA2Ec~TJ1u~EQr%L_`9saK2cYx}b24M(n^$#_CgR6dt{ - 4.0.0 - io.k8s.cassandra - kubernetes-cassandra - 0.0.3 - - src - - - maven-compiler-plugin - 2.3.2 - - 1.7 - 1.7 - - - - - - - junit - junit - 3.8.1 - test - - - org.slf4j - slf4j-log4j12 - 1.7.5 - - - org.codehaus.jackson - jackson-core-asl - 1.6.3 - - - org.codehaus.jackson - jackson-mapper-asl - 1.6.3 - - - org.apache.cassandra - cassandra-all - 2.0.11 - - - diff --git a/release-0.19.0/examples/cassandra/java/src/io/k8s/cassandra/KubernetesSeedProvider.java b/release-0.19.0/examples/cassandra/java/src/io/k8s/cassandra/KubernetesSeedProvider.java deleted file mode 100644 index 338c7f7e082..00000000000 --- a/release-0.19.0/examples/cassandra/java/src/io/k8s/cassandra/KubernetesSeedProvider.java +++ /dev/null @@ -1,149 +0,0 @@ -package io.k8s.cassandra; - -import java.io.IOException; -import java.nio.file.Files; -import java.nio.file.Path; -import java.nio.file.Paths; -import java.net.InetAddress; -import java.net.UnknownHostException; -import java.net.URL; -import java.net.URLConnection; -import java.security.cert.X509Certificate; -import java.security.KeyManagementException; -import java.security.NoSuchAlgorithmException; -import java.security.SecureRandom; -import java.util.ArrayList; -import java.util.HashMap; -import java.util.List; -import java.util.Map; - -import javax.net.ssl.HostnameVerifier; -import javax.net.ssl.HttpsURLConnection; -import javax.net.ssl.SSLContext; -import javax.net.ssl.SSLSession; -import javax.net.ssl.TrustManager; -import javax.net.ssl.X509TrustManager; - -import org.codehaus.jackson.JsonNode; -import org.codehaus.jackson.annotate.JsonIgnoreProperties; -import org.codehaus.jackson.map.ObjectMapper; -import org.apache.cassandra.locator.SeedProvider; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; - -public class KubernetesSeedProvider implements SeedProvider { - - @JsonIgnoreProperties(ignoreUnknown = true) - static class Address { - public String IP; - } - - @JsonIgnoreProperties(ignoreUnknown = true) - static class Subset { - public List
    addresses; - } - - @JsonIgnoreProperties(ignoreUnknown = true) - static class Endpoints { - public List subsets; - } - - private static String getEnvOrDefault(String var, String def) { - String val = System.getenv(var); - if (val == null) { - val = def; - } - return val; - } - - private static String getServiceAccountToken() throws IOException { - String file = "/var/run/secrets/kubernetes.io/serviceaccount/token"; - return new String(Files.readAllBytes(Paths.get(file))); - } - - private static final Logger logger = LoggerFactory.getLogger(KubernetesSeedProvider.class); - - private List defaultSeeds; - private TrustManager[] trustAll; - private HostnameVerifier trustAllHosts; - - public KubernetesSeedProvider(Map params) { - // Taken from SimpleSeedProvider.java - // These are used as a fallback, if we get nothing from k8s. - String[] hosts = params.get("seeds").split(",", -1); - defaultSeeds = new ArrayList(hosts.length); - for (String host : hosts) - { - try { - defaultSeeds.add(InetAddress.getByName(host.trim())); - } - catch (UnknownHostException ex) - { - // not fatal... DD will bark if there end up being zero seeds. - logger.warn("Seed provider couldn't lookup host " + host); - } - } - // TODO: Load the CA cert when it is available on all platforms. - trustAll = new TrustManager[] { - new X509TrustManager() { - public void checkServerTrusted(X509Certificate[] certs, String authType) {} - public void checkClientTrusted(X509Certificate[] certs, String authType) {} - public X509Certificate[] getAcceptedIssuers() { return null; } - } - }; - trustAllHosts = new HostnameVerifier() { - public boolean verify(String hostname, SSLSession session) { - return true; - } - }; - } - - public List getSeeds() { - List list = new ArrayList(); - String host = "https://kubernetes.default.cluster.local"; - String serviceName = getEnvOrDefault("CASSANDRA_SERVICE", "cassandra"); - String path = "/api/v1beta3/namespaces/default/endpoints/"; - try { - String token = getServiceAccountToken(); - - SSLContext ctx = SSLContext.getInstance("SSL"); - ctx.init(null, trustAll, new SecureRandom()); - - URL url = new URL(host + path + serviceName); - HttpsURLConnection conn = (HttpsURLConnection)url.openConnection(); - - // TODO: Remove this once the CA cert is propogated everywhere, and replace - // with loading the CA cert. - conn.setSSLSocketFactory(ctx.getSocketFactory()); - conn.setHostnameVerifier(trustAllHosts); - - conn.addRequestProperty("Authorization", "Bearer " + token); - ObjectMapper mapper = new ObjectMapper(); - Endpoints endpoints = mapper.readValue(conn.getInputStream(), Endpoints.class); - if (endpoints != null) { - // Here is a problem point, endpoints.subsets can be null in first node cases. - if (endpoints.subsets != null && !endpoints.subsets.isEmpty()){ - for (Subset subset : endpoints.subsets) { - for (Address address : subset.addresses) { - list.add(InetAddress.getByName(address.IP)); - } - } - } - } - } catch (IOException | NoSuchAlgorithmException | KeyManagementException ex) { - logger.warn("Request to kubernetes apiserver failed", ex); - } - if (list.size() == 0) { - // If we got nothing, we might be the first instance, in that case - // fall back on the seeds that were passed in cassandra.yaml. - return defaultSeeds; - } - return list; - } - - // Simple main to test the implementation - public static void main(String[] args) { - SeedProvider provider = new KubernetesSeedProvider(new HashMap()); - System.out.println(provider.getSeeds()); - } -} diff --git a/release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$1.class b/release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$1.class deleted file mode 100644 index 411292e8647eb34b089118a7c570fc3c2cacedd1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1088 zcma)4ZEF)j5Pmj^O&X((@!e{znrhM(uSEnkQjwrgny8Qxs{ORt8O8ygPPxc6Roe=h>MbKfiqk@Bnw`k;hUQ1>7uRxrkdu+!mO#BOTW_ z1ezTkd54c;Psuozp>L$OlMKj&WGU_u`EN`#(LR|LUwW!TZMOv08<}r4`vQe_+L<7yYE5GT84kUkH98!&oQ6{_mU*mX z!VoCQ#Ey24#;M9Q>q*4l4BLUG&>l0a4aq)NipI=$JB|}Fobg_xnK5U%7bQl~OYPov z@!w^<@3?R+UW6)$Vpi8BJBs`w?o?1hy@ELuowdTPk+C!Cn*!B85?>DvNLhg;=lbYz zBYANgq|clR?aELN$*{1D`21LnX;BiZ1FtK`X+`plW*^Jk+y!uXAgWczoqN8(ql9_( zmf6}uj(?!My7mQP^(%6pd6&a!p656Q*h7WqOVcQv!2<6%K1CB8QN_6#)-(3!d5FIu z-lhG*6ygDs8@yX36)a|EemFek>S{_%^ VsB2i{wSeomfwOFtIm$`k?-#E__=*4k diff --git a/release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$2.class b/release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$2.class deleted file mode 100644 index 58bd50d032854c283ab2343bba119c04bc66c6cb..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 838 zcma)4O>Yx15PjY(*>njs6v{^nrG-dMT2!NQK?{eao~B7Eol`~+`fnIoW8+FK&MJFsO-_ znUxG{9-5W>tS)iryQHLL*ql?JW>$A}QmTR($>ZT)-k_#IMvCF*>+ZYdxlagZ6^( ulV35@II1+f8;}3d2(X09)g1w@V3~FrbdP6T!*%+HxPcX1q$sYHDf|WFILwCt diff --git a/release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$Address.class b/release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$Address.class deleted file mode 100644 index 6efe8f5efdf3146a52214d2f416f8b1fc36feeb0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 582 zcmb7BO>Yx15PjZ!Y}lr>1WF0LZ~(RCfQ8_I1gca;LQ1=WiqIUmIlH6ONjgThH~g-i zD)rDGz>h*qwv~F}KxKJ6@6CATjs5%2)ir>3c%GqwtrXiSo+%{56NO$rGfSfvhNpTI zz2)ggh4v@QHXbN6_V&jL&4DXPVI#LpU#jy7`R``35T=*A!Yszd+ZDbgoAJyBh4ip2 zJq7W)LuT@Wg$aQKzRj)E^AAB6LKrT+(Z`k4WQr6^xTnw_%()7^BM}=8XC_9=$d~^_?&r?y>GP-y5{#6==(p9#2C>P; zfwkp_;LlxY!=sA__YRn=z3;@O1BK?+_E4d9=u4}xmOHWUs#8XPGNT!he(no18=By1 z{}0$oCys@5UP*c8oz(5@E?mTA5Uc18d=(1&+SREx|6lb^Jtu{YkCh~MYKJa5R`No` zCzG5PCV!UuFxCZII5Ab!6H`p17i}&$R==TlG!`E$M{#CDayByiD#uOivrNT*ktWxr zdRRd(!+nLPiw^a&AMSL%(wUL5em|PnA}Q=F`pn;DKVC2Z57FSC#hQ6qSfXsxYoJRD zbsN;Hv@~^%EIs)K^>t3ULfM{!8f&y`DhXIepSp=_lnq?R4eAx%-Q;)c7`M?O(C1Z# MJ6PsvP+!IJZ|Bj?KmY&$ diff --git a/release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$Subset.class b/release-0.19.0/examples/cassandra/java/target/classes/io/k8s/cassandra/KubernetesSeedProvider$Subset.class deleted file mode 100644 index bdbca660c9b2d9e650bfa6f6d3c0c8d969af6c02..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 745 zcma)4O>Yx15PeS4Y@4PugwIl-9FTw>Y9u%ywW?G_LMp5P5y*j?vpY(iq&Bj><#%yH z;=m8!MfoQ$quhEudl7X(fN^Co`gJvy;3P>L zij?nyzp$l*hnFuN9pX&L@+s zcckz<_hF(7l0P$5)KgQ;qIcRXF`{45I-NKlgj4t|Az6v6zQs|~_tDLq|Kgflmg-^? z-3<2?4pyD#pZ0r;UCxc0=(ppk6r6}&^^LzLw_+ zsAY>gxh>g?D@5+{ZTc8cG0q=u32Y#7xeS65lE82a8$6N_Bqju!<&Z+P!)8d9Y-X3)*+8iF z@M!I2Pups5dr*6#LJm_XJ=E6P)86*9_kCNnYWlsI+3aSCZ5naj%$xVW|9{{A{m1OX z&)t6(z*^B6#K-XoKR&78Q$d`>Jwe=y`-1S{R1i^|_G7pVBN+8#OitdfU_1yFpAMh{ zXXMP;AU=b0W%w*Ur{ME)`U?sk2x5+ueNc`M$;%hZ@FhH~;L8dg31U9JB3FJ@!PkOV zz`8aw1R&J(J8m>z%v2j_-q+=;kh6t1cE|{ zB1QNVQ7jN>Gka3WxM`;a)OOP}tk#5{P8)nIjb;v}4O>8I?&-0Nw46#LdwUH_Ak>+( zdbM=o(7MA~r!&_?`5xnto=MnI!|37SS)GUVL0!w(@r2eHPupDKx2;UtZcZcw7VdXm zAJa_3*3#*OwoAU+uA4d)aA|pV>9%BA8dqDeTuz(%fU(E0;)mjnNM)~Kx0!=GtSzn` z0vqdG8xp$Nt3_=qZuT~vKePP&DS_hFWRD?G*%>#DuFSwe!`h`EOmK!rkLig$x)qnt z-lT6(cTjOooUcv5M^tzn)OqOgsIABPx9cfKjJy`8rqNNu8jQz`=2$G5G3{N+e!~=) zQ#ZX`hvL$TVB4{nk+S1SQ@Uky+>G0o(>CwC4(3$Tw0w_1k#S7mLidak?A>O+nLKJr z04Fyg;KhBM;9&Q~x#jZCcv9=%nAT!sgKqX%y4H~)2;9I(O9$_?l7sOc2lvvHZs`LQ zs&ti1Y8NPxoAOPS>uqf+G}Tj~97<*3Tt9WA&F4Gl{F%#}B=1Fug5!*KGCLaYHFY~< z5v?o_vX;$oLy4Z>@sC63P}U>)lvea?aIBswWJ|qxBIu=QFUD5QSlEq9%9hwJQG79* z4xZ;Ak_)G3w6is7+Qu;%cfO28_Eor`IUMNjlrE1YO)~AG0?}=@ol5WSmhz?%lN^(l z4(O?r4E<$J=*JixeR?LX9VVgENmJu%ZO6gGTud4F1M_m@%bhb5_g!J=jJI~ zO)#Gbl%?Ik>0%z>X;Qk~Cy*ZkGVOT2mZxs#C5t`jB1#pZFjX@_GYvEOD#FhUtB8O= z{dvBA-hHTfK#vp0>bhxIE;&@JTfGbdf69v)fd&UeJ*CI`jJyy_Ftyl8ODhO4|K?c2 zi*R3^+%OnTW~`X8)ky{Orw`1PG8ZW#sERV73ar(bqBJXGYH1^88FpIhpN!{~jCBu6 z-OWLo$E{g~2~82@s;Cf^ikPK}*&?JOC8~JA-6UjMCVqyXTro#LG^%2*sAlx%3PH1F z=|j>jQm{tFejHH61sG67SQYccd^$xH3&cVe2uH{v>of^V#Xh`Hpr+8imP|astR%2R zVpy9+yq1|Y(PJ*NYZJ+2eehP3FAoamG}~!=$)$ zwLIQZ6)(cI|A*8X71!a#q;Q{%z=)RbBCoctj3rnm4Qr*O3S)Y9YjZT(+_j~<`MPLZ z_n!9FHpbm#&Q_u0Ajz!hskk<{`k-O!Yc*Ll(`25J*1S!%$w1XqBrw2)!Suo4P{qaK z5)Tu}n~W8=hsaLe7~QN2$pKX?6Ll>8IcIfu%Cj#~#d1;4vON{f^HYl|8YE9vh?T0) z#46Uv=8WB!wBpBgnR(cKv>3W&SajBEu}0ux*?9cV?4ydcVx7S1nfhxo>8N78*r19_ zB`r6KO{$0pCJMhQHp_?01dFVUmYGz>rEaEH#T7Uppv_duOHit~61~~bp=|q($pk2H zi39hfL%NdDOsuat(M#CuzJa`jOQ$aEFoxU?Yrrsb#h?3i8%Ht*Bf?JB=F&nfStHW| z!9S!k)%3^^X;wvxXk{6g;dw|=#|EcnZqw6!EDthY98tv<(Wc@i+^mSLs<=vQQ$)Ke zt`;3^9UT#;S#WC#gGl;)MhTM?%4wuF7QWoGOg#b@$cbE#=V~QesNC9i#+gjVSuZ&D zAY@#i!3%%j^etbDgP+ml+6FBM4V>V zO=EWZ@@WibWvpv=3M5-|qBqCEzMxVwpAn3fA-BlaPqVjYOo1E`@Ub^z6Ok{HwV$=4 zRQ4$*7p%x%;C&_JAJCohDhs#u+evqdL@oRb;*pN(7Sq-gt=Ub9W@FtpV!jq$V^j$G{f50&k1?`_*nE2HbNU&LQ`Sf-^ENioPtEgnh2y+b#^#)%li)R3aAZO^CtvV{ z0U4Hi^hAbUj(7?R7Uk)1zR{--LdE@}U}!7xblX5mTFj=AeD}vE^I3J)4ks&T^Bm1k z`t)=czZu9J(;23Ig-(WgfWXL~1Y`;+YTqgQMW>* zl1*65Us0kE`~{^L^JL@6-=~UX>*|c`@tl#Z8^=-vWz)sgF+Ld_eH_c{M5?1Cizb8 z)5iZ2|)%q>|HDXl++ig4*LDn~JE46}={_XHM4lzUM%jyd~AFgH{^j2gM3W*8TY zAzXx;OT>wZGxf!1FmIo49P{^4`GV+aETpVd-629HU_Z@U&7k2W$C{gQxg}u0iE_@Twlh{jd?8E}jr+L~PbF5RMa_mvB}h=)Sw2chW-}Q9OZ0lq$GE!AljqjQ<1|O^{Oj^30!52|bSSIMFkWyE-@A#dg2sbDR1$>wgh2*zwJVPg(H-EMazb;0 zyZiAG-0f*u%u)UYLLH;%z7JJ$OX0Af)OmF!H~A>%is;on9P5c@gc)Nuw`u0Mmt!l( PYd9|Ad-*5X!@vIkGx^Tl diff --git a/release-0.19.0/examples/cassandra/java/target/kubernetes-cassandra-0.0.2.jar b/release-0.19.0/examples/cassandra/java/target/kubernetes-cassandra-0.0.2.jar deleted file mode 100644 index 8fac473fe856dc1a982610e0d12492c6888f2931..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6448 zcmbtZ1z42Z)*eb=06`g~Q;DHLIwh4DY6wN8Wau1V014?12|>C+QV9j=?go)=Pz0n) zk@<(~QO`Yi?sM*c*F0Z5&#blHwZC`oy}o%zO$h@N2spRf#INN4b@Rsw7j=cmX-aV@ zsK|4v{o#fKkVm;Kg#*7@p}zJ-9iTtEL8Md^@~K=8!m5?6>mByI;OA|gQBAqLw7@5-zJA@5G!dw z8;v5cg1gA`f%U<#d{$p{9w zfjPn)pfH%R8r&9PZVZFpkTN!g!yFtqA6cOiKU0%Zx-Ug^CJ-z^`RLvFm^|2prQ)&O z6>%I6e zuuc0iSD%YKtW>Gb%D9$e32Qv)y#ULN8TLI;tK~sL*O3VmX7sk1K}u@sr4*on(4Kr6 zX=WD)j2~Qvx3wy89f`=G!{84r*#>*Of%(n^t_7|z08?zSZoA1`r!49nfgy%u*YE14 z;U^C`u}(cmV)z)Wkk?cya6~n1diB5okt(|%=U$RYu=S%{YdVU-O%#KI{{@3` zHpX_g<~EK$I8=w&67vvws0>>XYfJ_VXw+Z6lS5^Z0l#ITh0FRB$aV`8{;_X@I!EQr zQukrpTpMmMhNKs*|8plI?ADBDE93*mbqTJCX$|#Az^hPfkBZVL!<#J+{n&=et z<#zVZZ*QMsI*Zw8C1&&8*RywBWfz1axWroZqm_qf-%gV5PYP%WB2~xDM_H}hi-aek z6jKJUAktpWL^EooJ=3>)(1$^O#87PUn{8r3V49Cz%*j=c2mq_5we^-e*NzJ?;5@4p}&>SW{qbNpk~szX#M&l#7#HmpXMLmTT! zrgQR5zfvPcvMEhg3d33NHm7guN?1U&>#)A3L8T4S!Hh zQq4RTy+xWEcZiIl$=%rB_ZUnd3hS#IO6$Jjsub1i#e)1agY{u~ZrVglDB5CE<_%RO zDDnQ3jKB8WO7^SRvYdgHgwBQ}b^1G8P6^HkX-F2KtvjxoLc6Yf|buEs6PWK-? z>)^UmX;Gie(j-jGC`{T+`VBJVt5pk6X80LZhZ{uaUQNm_1^a7U&Py`q?K43nBtR%@ zNwzTBh}AU3LYQ-6sbpF8(p~275!RB(smrPhV=f+<2zKO#HtZiwr6e4s9i1VM>bJfk z=aRmr*6opbF_nsitZ&nhY-w%Rv&=>k%I-)#pp_#Ml-*&Nez7RS<4z`+e;mZ;soB(# zIcVpA*>_x3;m#1Ex(MZ=YUTh+aP+0AZ%?qq^^~T?91ZmJkQ!By1g@wh+CuGR+cwn^ z5(SHwU1_1*G;J2jojuthqFTywJ95)G^LIg(_E}c$3QaR*J1aP!c1Xzg3U_y3lhsGK zEwAWd%>@}?)aTFF<0Ni#V9jaoP*1GY06*(&*RcpF==U9a`r#p^@QaTPL6XgpSwazM zEXVmiX}Gc?8)sJSW#T%w)+?+>%vC8%EX(eV#ZRp#rg{xe&TTy};mf&+fsuQiXscTY zqdIBU`LkzTPo?$hv8O{?l#-iA?!-X9Qq3Xd^?=m9qKaAATN*cZa_+jzZpJm`jC0U* z;i#==0vl*`0}kwN27AGA)x;3=j6>xHg|vrp)`!ahM~VF^k8CIRnd5nfYw$awH+^`7 zjE?s>7g#!7zfupQuXv>aDRS~VZxz~O@Dx3?oWyG&Uh?QMeP z4iS^Rn%+BQhS!sxoxB+vs03k2nk_%@kmUblVwLjpVAJiW{7L0plnle_18G5y$KB;x zUNqXvA6ha}rb3tF-(;T}*+`H+4l~@n)=e>+e#;1LgTuk{(=zOmO1>BNT_ot#=UoK9 zN)y+;&bu|3pH$~R3#V{zyfVB}T_B75P7&gVZ|VhjG0}{UMd6MaUKB;a_hBI_x4tec zi|Y>AYsP1s##Y?))bd|>g_&VC2T(VdIp}>)KFjg50R1IFS$)&4p_Js}8k24waUI%3 z>Nlw$ui5eK^2>3V!Pc4&SdNPW<`#~CXXy)4r|K;>rwV!{IgJnU-Ew0$cAk2fjc%Ks z`cH@j8W%2+WnEPfUNs~j&4jk-mnt>Q@rn5~#9SeWT%<+M`!-rKCyP7;$mj)R@q(mF@+A3wZBf$bhZg9# z!dTw0@cZj!(M-96Wrt(+^<$|VqPj0P*2hZ=%j z3Dw3kjt4$a4*?lR0#ff~i#=ks=KZPw=ItBKzGKOP&+Ur}34#Gi3Q6Wd4=4``7r>`F z27Q^k8Z9F(0S6zlN7P%&pO0a7CJ-^C2dCrknDSkT3+K(iDUy6!mW@l2g8oH8TN)xe zD4JEcI80|Zc6qNLS>bV=@+MXA>uf2DWS7mG&jr6F28EDWPB6&Cd=@6rH>>h()rfY; zXW~;Yp$|8d(=;;*zFQCkOAHF_&fM=JZVZPH1*_iCDzLDZb1UBZ#b_{=uFKLgKaOjI z&|pxHe6)q+P05Q-h%u^L*v+I0#HF>S3f!X#jf)PfGXrDA6zNP3vOjIJ>< zI4Bjf8=5Q^S>=#w2wo@4yjS;hqgXzqoTiV>F#yRQd{roATfFUMi-~7E(6bWDu3*~z zgq-r}l;9RDsJk!1wq~5ym2g*2PZDit#)YeyU?x1!949mBy^wUR07IBlkb$_75T$s< z=qk3M=wmeGT8_I>oOIh|39P}}g}@y?BOrqJhO?3`tdnEE%Nkc}r|}IK)A>F2mb4vu z2CiR+I$}JnAdGs2S|~nB;0q7`lY(beS?1taDWdOKKF0pKdUq zO@|wZQIN?L)p!CYKescJmpL#FU#h|!TpDo_6$iumXU;s4{nLa z11erQp%rv?kS{+Xj&BG*K6?60Z#OEpZ(-E!G$+9PzQ1@CKG02I0sf|E8E%JFvhR)9 z;Ux>xY;$&tS}gmDH@G~fAi=obhXaYJniHJ?a460!tZnycJ+NAX&oT;^e|Cq995mIQfz@U(BC z1;gzj7eaQVM6eUO;Cz|%BXK;X3MLWUhx3oEo~fGR@ix$t7Y0+e37^pDhHHN;)s;9A zPmEq6;9t3I|CwrGgpewcM%0h7i`zUh?L*8ocQ9$ER{^MVA)uu-kAiRyR9o73NMhxS zn-N`3Hj)t?tOhaDQ9tGYS&K5dVdaS2Dy6y6@$!c6`yqI2FAcK;Vf6dJ&b5|}9UND8 z&{r1~Dv%WZ&NTl9+cE{yq&>TLIDVRtsj)ptR&nz;O?9pb%ckN{@7wPxmaZ*xOEVJK zO{2AIo;dS_6ee^>Y9zUB!z1Vlv7GW5ymZuJPSvthIFClEu0}fK)+yIohz02EfcXlm z+>tt@ph}ExKAY$@75ln?%)}$NVxRY5mpUIyP%WCvr9zV0s7O_#O+H^g(lE41P%T(n zZ*Vb5c&>83*gwPx*OU&gr2xzawM}~Qd|61qnOX`@_;E%fS$~7|n;^|&|89B{PVK9t z!A4r1Vzce1Xmhbkn=XM52xo&W@zk}yl4Hp(_7PXjBQzD`o1O2iHdy4wIG-5KLS8iS zQW`f4W`)}bY}flAG0lpmpAr6e?Yth6tF=PbJ}^Gu=gJb6ZZ7SiyNw zhqxGhu0#9<>O!>TPg#QFVoDsq!xt~*)4p;q*`aF4k6Uu>){l zI->S1kC0j~GRWj=qsylpu0heJ@FqI$(=O%Ndf6tH+$Ckg&G3g3sM@D)LvV6zo-X8h)TAdn943bKn9N;U>GpU$HDoD$O3C?&a#cB5iX(&cdK=J4 z?W7}*{(8Vmjrxokq&h+tJV*DWLjjawdb|*S4<1n+w$0x<{Dfcbi#)VlVfrY-w)EK0 z6XVA`!~t}ol(DL#A`=@FgRZDU=6_+*4sL4)gFBkT9OSx6fxg^CfI)G6`+2J>Om;cD zH4Q3}HNxaoT^~DeJal_&eQdMIGL^l^IN3mWK@L0AlBq0|*^iR$kmoSNw}Vfnb?~k4 z>s1Df$NNJb6&rIr1aFTw^}Z>-j=sTo+u{UL_^@&luke+ije8Pip3`3>PKDbB*!4oddU_ZvUk?{;Kq^qU5>e z_}$I}R#CU8fbRXm66tp__`=@)pGrCJ4d3lNTk}82_BWm4N5Q}E z6+b|-y-BWK8103Ee+%(P=lC_4-|uC=kmiX02c%y+o0<|9ihBUyGU{W6nr9{F|8xNU E4}4UB8~^|S diff --git a/release-0.19.0/examples/cassandra/java/target/kubernetes-cassandra-0.0.3.jar b/release-0.19.0/examples/cassandra/java/target/kubernetes-cassandra-0.0.3.jar deleted file mode 100644 index 93f492965b76845d9e5da5f66b37b3d0c9f940e5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8219 zcmbtZ1yq#lx*kAM=@#i4x*J4Nx?>3Gp}P@~ZUJeKZbZ6~?gkN%?oMeWggYK;j9~uC7at{Dt`a5!ICj+p(HP{jCpbQ2Z zDcIXMn;C)aDOeZ{Eg>SqqirlOh0wawWeuXcO$~2ss>NkF%)->sg^E=ufLNH=O2XBp zoGykH`);_-7rtNAu7vODeulbHSec_zEAVycVPtElY;iMo_PV(_Cv5ec(|JNPfQ@C_ z`dflqu$_g)q6Cyc#8I9b*X;T>vx)xfCXHj} zCW9K=Jt61Y0aCMdr=QN}WF2KStiZI6s`NPkz3#-TIcuu9Jl7FU6J0TwM#0Dw3olK-2yV*MUhO0qVXENGrF^waG3 z9`?K3r;L@NU}#5Rln}yJf`u-J%@O0Ved6RSyIN5l)fBQMXt(VBiu(}evtsZO74#7$ zxR`L{rO84g{`KqylP=U;TQ%i)`A1=YX%@yFP^4YJdtlFu%>vmerd3yRgO1S$cQbqH zu9!Xvo@}Xg<=o@VVL7LgIq#SQv+M!F_V9&vjW496Gu8EE^wcv2`7z`X?xas)-PJIX z`wW1oDCcwdu;%{fhK8}T40YZH4(_9&$+a+JZ|twm+_JO@fBBH1F zRb{zK9dLF1B}zDZlNFN8pgg9op~Rb9{E-5B=Ql~=FKfY#0D_|#xPY8waGI}c@ng2j zg+c!(7(~cLV`F0(%1{qX7Pd}=*^|fuNEMxz=jV*qE^v@o6&$vZ(m$AJaZY(Az5p?1 zy}wkmt>R*@XzS;HW{fLa6_I<^*Lta)Uolioh{?^=4T^4A@p{+CTe_S`T}q>tnf2IcFJ-v#PySz1HFpv;{OfWx;YBR`CtY zkJj|fgSw=f2I&wF?n6At^cVj~5^ObZgtgY8X~JB&n$`aE_{A>75Ewyk;($aaH2BWUxOM!I&rL~guhUza?*L_f zL7r9RY5L?H0s-{nF;7^4MeA%1){cZ$xef#?CBimF`IZLzG##D+2S9ynxSqkaNLoy2 z#FInf4IS&$v=)SSXx_^o2)^W{y)p^K5*J-}|1@kRd3%(#bkKadbD&XUros$=iALCmSrBkujoes{rbqu>oFxqV-9WVj=(z{Wqd0i@j`B(Es;sJZsyY>x=uJ%IE zM418Xl_@Ckoz9fznM_RVtevI3($x3LsxFatEPS=GXJsYBRm=Tg0Ty_nHmlEt=UazV zB$ngnX4CE91tcG=({((fA217P30z9|e^2=q(mdX0<|{P;^1PEJ=A~-wVH% zjkb<27YtJ{q57(H69uBQc_jZ|P-9*iq7D@q`;;}JQAroQd6!&bw1oC5ZHM zjGsLgkhZbG<$ksBjtgALDZXb_r3Zma<%O{yZILG(&y2&v8NJ*amdY?H&7KeK*W;Jv z!#S61%5VZK)9l?)_Ct^tzAO+^LeQ2PN$WyoiQ!=ZZ~Rz$%2bUgvg2C7G}=nSS}q+NbFDk#S$-Bj z#%xLJGy1UokN1i)sGCEmv3F_GR70@R20V{2--6IGsC5xPvM}Y7-m+|zLjAk9@tXRy zF7E>XU3dTh!$0@-cQ=C&^{^)JZ*@5PEIDHU1QH-dKW|GEJZpU+N<<+86d-{R(gaE} zX@e14!{8vC@I(z!v4DW)thtT5f(5EduRc<4(2S=0%xv0uv&~yI*%qz_9%l{qS4Ini z$#>81?!NRKPKBYS!j)-OT^`bS%!G{qKNq3)*tMXdE(sCyb1#eFQ8(cMyGQ~X@#2$F zY4DDOx;CZWhbr4|R-vZ%Bq@17>8c!3)_(!RqFysAA3r9We7e3)m;0HPNcoThHu9Po zS2rPcQQ=UQ7$=9gnQ}dPb5_TrCyd%-?y3ZLF=qFo>9Y^2U}q%O%~X(PN-U~8?dK5G zfkS1t%Ov0Qfg#<`Wza3L3Hgnm<8WKzYg-f#wTKzxE$I&VU|SMUy?{apUa`)1k~+8A zp)E_L$H!c-UQ9wTx0y@nl&0-1ST|a2UReD5U0&-nX;G&mw61b(cOIrO23kiRh+jSn z)9@Z;p=LurCKdG|;|~R50nIoYqC*n5r=ZQl%pR&KYu8%&MRqNZznHbX7aLf@I8e5( z#y>i51%ke<@t-K3K7z48F}FHc5I=Uohd))BLnIK#4au)19KUvCSnpiX)Eab_SavFk z-DmGyg+94>R~l)Ww`^KNILW*I)_Hz>ti8WmqL$LqOxp>ievb1@$1p*^3#C&#-fTW_ z%<|l-wkBsE4MZ$6i#9oA&9DbzsdQhR=HoE2LB!&ueD|Q=GAv2_X`xGtzSGY2YM}dR zFwtVJ7RzPI^y%q#iTW|Z@q0Q(DAZ>-&ZiRc4QY*15?gL3A_7X zr@k_;t#&Zhqjfl3>WA6AuWLZUyBanY=vhKs4fM|}WJeLP^rl!_`HDn!iw4fz?UZUy zb+mZtv>Ki$vJ*CiHeC)YCGGd$t|jtK8sDE`j|1wwQ(V!(qT%khq^{^Fw^nvhif8fh zJHY}rZ91*4LeB`|MD@K=J1t)W@u(&+46nsFrl$6lV=EiWndF`p$H0YBuQ0bd*dLQW zvbK;)jIa}pey)Tws{R-ehHuuWmmDz$nsHE;p+|Bihor?!l=TpJFcBk}bR|7M9?8s? z^}PQh3dVcq_VLe}v(0xT+q2JvD`N35tHEcnBV0PKfchVE3XJqQh+;qt)ng%JZM>~R zIR~P!zC0{5>~=diI^7=fb-@N=K>7*#_w*g~&7p@C?X+2<8RtcybY&EdiyfA$a@Iun zbqtY!cN4P2t}#h$NaOW#<1x=E%w_B)Q!bY%=ozTn8k5P6WCGoNl`@!8Bs9Wowq2Zb(U$H-h1 zH?5jTL*1pUJ#R;f_BRq$qzkgOJfjPe{$Z7fTH&|s@$SfDN%S`Pc0e#Qd5Y-Sy^X?< zhZ;CrH!!@?vI#O#aH{N~R5d;{X+dbIy|-5H2*KV)P24%53|Sgo;dPSeTB>&SQ+dHS zs@kNQmHl$Og)&(*xH7`Px6_qJV0C++>CK%u%VW$chCwzOPkN+jD_{fnIU7w9S62$o zgUU#vAvU*-)XfiBvd@)KoM%wZnQM^bYabzTZlFh(c2%V^tXlR}X!MdUvYs+VOoV@l z@JJyX?9r~Qjauigt5xJoF3Qg7h;oV@j4!(DbA4$Hf08(_6ypL-|DdK0IeO%DVbFsx z{_N$j>7G2-<&48MM=je}SjrH$=vrlZQ#MEqDdyfl9@bkK6T21zjBN&Ck_)zA6P_Y1 z!n*P zblrR(rxa}LVYj_5VqvogPGJn%7R~9gt=U00Ruc>w(My9d8kGQ6Mr>GDcERgLC~E@U z90YMr4%5yAXxzTsQ^;dyrQM@LnP5zvd7A4OLC|Q_znqqdxuj}190lvS5|9!H);##I zN+ZsLH7Lz48FU?2TgFSbjaxZb7#GQvQnn80A>*b1vBk z=a5W)zN_`?a7r#!m368OZgV3J{DBF|HhwvQT`$fuv|wJM&thGQ$_~l88=xPpmEf+p#nNtNO37Kx#nIL(xNzFelX{9oM*E#X#U7lL2qZ8F<>UH*$$RS<^EzwK`I@_oFB(c0LE_jr%+%S=g z>df9B&S%gI+;`+rv-T+ZclqK|b=0>s)Y;#fsx1qcYID9dRV}DHzt<1b1(V3>zul3j z=sn+4#+<|N9g03U#}=${+YhB88CnQ6NF<&C;KB|u%+5EzFRwpLG=i{kka_I39Fr*T zbbqY_mRiwMaDT3q*{SYv+@@9+CY09YxUZD9kC;b;&nGSXZj`+x`9vLyfPneBB+|xI zYIfGqDId4FTDKWw5ONR^O?|uosVVU36lO^seTs8)MKlBij|n zvq5c6NG0lrnzu+8;TTF%=XnpvnM&PJPSP`BOI=nSVb*P*NV&HxAs)yZVhMj3@&iq6 zw3N-a^tQMnNb}y{2H-8{W|Dc?B5-7`JSoq3yBV1gAL|5DK-^X#fR8&Vjf#6*LBGE) zM2|`X1qRIE7a_R8=xpD{!GN$2mBh~gYVeJ>9EL|4boF5$QeZ$_zG3xEk5w>$h_3Ku zZNv{-yV(!|JfIfIxv>sYTl1cxIZWznli6~egNeAMgQQ?`JL+VX7%k&ml3|y}(Uf3z z5ZUu+`k}%2p#jIkxu!^Qld%2rdIR@D#nbsYd2JuC35#_`due5u;xQ17Bd;R8Q6kE@ zahstYQ zdR;^?R-}lNzB}$R@Aic?>?hU3$FQH&520X*?=k2WEQvIF;z&PzlMf6+HdQ%XuBdqM z{!``=aobZi)f3u>q+w%?=v5e1R`)>HB)l_3taG#tf zbK}fjc)VN&EXIy<^sGf4BF-g`R=k&0&*)s_^-o335)Q>G={2~RFh;t}dAsp=Z$(qu zCJ@9@l9LEm(ooN7*A%)7opU!N%XA0-;~U~n6do1w4e=9&x6*e8TmJ+I|0E{)li19L z5rS@-@AOU00960Riv$r6{D+_ zWmD{ky&nl$_b1QLMsGaXnT=N0om{5(d~M-vB+NH`G7HV3ZNR)$8Pxjn0r=}xKUg{j zt&E!IvzE5h7E6K|$T3+n*$gu)9`Oxf4;fOgO6aIY*Y(gSyU`Rad{4L?)X}Y`Llky9 z!uWh~^xBLtk3?-JbwyxxG52j>q+;>&cDqLr6Kt~wFy#qUjMw&?hMutVNMO4lV;To{ za|b$fMraEesW^w)y`LtL#qX#HR?8x!HOUcrlFMD*ZDwF{8P!bt-o!smRx693tiusc z(0M4`I_zY-++dve;byj79UN>HoDlv!5u!JF4{t_QTT_tc=N?TCsE&+g49MAs%_v71$)Q*}+x& z>%7FG3l>@@P7i#E*DQ4zb=o6M!x#Lu?EG_A@v>C7Y4l1G)TES2n77G}aE| zqG?r&{zYQTk3d8KsKu0u>+@;(+CW_B2DwE3Kd!X3x3LA=JDPzV#QMsS{Fu=I?*(-2 zmgdmL)Iyg&1AxJ8aXP*X?I*QBDX;C)#s+~ZGC0ffV@H&zKyJYG5y`p>KD^}NJf5V`fK9;VE_9e)_0|lZSwvd z`~N=D`gH=|g#SLt_$53Vav*=$_8)|QpKJUs{C8;lm+&-58TzNf{|zYrUB&O%?JpI2 z5dZvB6~7_5zbpA2Ec~TJ1u~EQr%L_`9saK2cYx}b24M(n^$#_CgR6dt{ Active -development name=development Active -production name=production Active -``` - -For kubectl client to work with each namespace, we define two contexts: - -```shell -$ kubectl config set-context dev --namespace=development --cluster=${CLUSTER_NAME} --user=${USER_NAME} -$ kubectl config set-context prod --namespace=production --cluster=${CLUSTER_NAME} --user=${USER_NAME} -``` - -### Step Two: Create backend replication controller in each namespace - -Use the file [`examples/cluster-dns/dns-backend-rc.yaml`](dns-backend-rc.yaml) to create a backend server [replication controller](../../docs/replication-controller.md) in each namespace. - -```shell -$ kubectl config use-context dev -$ kubectl create -f examples/cluster-dns/dns-backend-rc.yaml -``` - -Once that's up you can list the pod in the cluster: - -```shell -$ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -dns-backend dns-backend ddysher/dns-backend name=dns-backend 1 -``` - -Now repeat the above commands to create a replication controller in prod namespace: - -```shell -$ kubectl config use-context prod -$ kubectl create -f examples/cluster-dns/dns-backend-rc.yaml -$ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -dns-backend dns-backend ddysher/dns-backend name=dns-backend 1 -``` - -### Step Three: Create backend service - -Use the file [`examples/cluster-dns/dns-backend-service.yaml`](dns-backend-service.yaml) to create -a [service](../../docs/services.md) for the backend server. - -```shell -$ kubectl config use-context dev -$ kubectl create -f examples/cluster-dns/dns-backend-service.yaml -``` - -Once that's up you can list the service in the cluster: - -```shell -$ kubectl get service dns-backend -NAME LABELS SELECTOR IP(S) PORT(S) -dns-backend name=dns-backend 10.0.236.129 8000/TCP -``` - -Again, repeat the same process for prod namespace: - -```shell -$ kubectl config use-context prod -$ kubectl create -f examples/cluster-dns/dns-backend-service.yaml -$ kubectl get service dns-backend -NAME LABELS SELECTOR IP(S) PORT(S) -dns-backend name=dns-backend 10.0.35.246 8000/TCP -``` - -### Step Four: Create client pod in one namespace - -Use the file [`examples/cluster-dns/dns-frontend-pod.yaml`](dns-frontend-pod.yaml) to create a client [pod](../../docs/pods.md) in dev namespace. The client pod will make a connection to backend and exit. Specifically, it tries to connect to address `http://dns-backend.development.kubernetes.local:8000`. - -```shell -$ kubectl config use-context dev -$ kubectl create -f examples/cluster-dns/dns-frontend-pod.yaml -``` - -Once that's up you can list the pod in the cluster: - -```shell -$ kubectl get pods dns-frontend -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -dns-frontend 10.244.2.9 kubernetes-minion-sswf/104.154.55.211 name=dns-frontend Running 3 seconds - dns-frontend ddysher/dns-frontend Running 2 seconds -``` - -Wait until the pod succeeds, then we can see the output from the client pod: - -```shell -$ kubectl log dns-frontend -2015-05-07T20:13:54.147664936Z 10.0.236.129 -2015-05-07T20:13:54.147721290Z Send request to: http://dns-backend.development.kubernetes.local:8000 -2015-05-07T20:13:54.147733438Z -2015-05-07T20:13:54.147738295Z Hello World! -``` - -Please refer to the [source code](./images/frontend/client.py) about the logs. First line prints out the ip address associated with the service in dev namespace; remaining lines print out our request and server response. If we switch to prod namespace with the same pod config, we'll see the same result, i.e. dns will resolve across namespace. - -```shell -$ kubectl config use-context prod -$ kubectl create -f examples/cluster-dns/dns-frontend-pod.yaml -$ kubectl log dns-frontend -2015-05-07T20:13:54.147664936Z 10.0.236.129 -2015-05-07T20:13:54.147721290Z Send request to: http://dns-backend.development.kubernetes.local:8000 -2015-05-07T20:13:54.147733438Z -2015-05-07T20:13:54.147738295Z Hello World! -``` - - -#### Note about default namespace - -If you prefer not using namespace, then all your services can be addressed using `default` namespace, e.g. `http://dns-backend.default.kubernetes.local:8000`, or shorthand version `http://dns-backend:8000` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/cluster-dns/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/cluster-dns/README.md?pixel)]() diff --git a/release-0.19.0/examples/cluster-dns/dns-backend-rc.yaml b/release-0.19.0/examples/cluster-dns/dns-backend-rc.yaml deleted file mode 100644 index 34530a5865a..00000000000 --- a/release-0.19.0/examples/cluster-dns/dns-backend-rc.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - name: dns-backend - labels: - name: dns-backend -spec: - replicas: 1 - selector: - name: dns-backend - template: - metadata: - labels: - name: dns-backend - spec: - containers: - - name: dns-backend - image: ddysher/dns-backend - ports: - - name: backend-port - containerPort: 8000 - protocol: tcp diff --git a/release-0.19.0/examples/cluster-dns/dns-backend-service.yaml b/release-0.19.0/examples/cluster-dns/dns-backend-service.yaml deleted file mode 100644 index 09077855e18..00000000000 --- a/release-0.19.0/examples/cluster-dns/dns-backend-service.yaml +++ /dev/null @@ -1,9 +0,0 @@ -kind: Service -apiVersion: v1beta3 -metadata: - name: dns-backend -spec: - ports: - - port: 8000 - selector: - name: dns-backend diff --git a/release-0.19.0/examples/cluster-dns/dns-frontend-pod.yaml b/release-0.19.0/examples/cluster-dns/dns-frontend-pod.yaml deleted file mode 100644 index fee1c81a374..00000000000 --- a/release-0.19.0/examples/cluster-dns/dns-frontend-pod.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - name: dns-frontend - labels: - name: dns-frontend -spec: - containers: - - name: dns-frontend - image: ddysher/dns-frontend - command: - - python - - client.py - - http://dns-backend.development.kubernetes.local:8000 - imagePullPolicy: Always - restartPolicy: Never diff --git a/release-0.19.0/examples/cluster-dns/images/backend/Dockerfile b/release-0.19.0/examples/cluster-dns/images/backend/Dockerfile deleted file mode 100644 index 915a2d19020..00000000000 --- a/release-0.19.0/examples/cluster-dns/images/backend/Dockerfile +++ /dev/null @@ -1,6 +0,0 @@ -FROM python:2.7 - -COPY . /dns-backend -WORKDIR /dns-backend - -CMD ["python", "server.py"] diff --git a/release-0.19.0/examples/cluster-dns/images/backend/server.py b/release-0.19.0/examples/cluster-dns/images/backend/server.py deleted file mode 100644 index fdb8edfac67..00000000000 --- a/release-0.19.0/examples/cluster-dns/images/backend/server.py +++ /dev/null @@ -1,37 +0,0 @@ -#!/usr/bin/env python - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer - -PORT_NUMBER = 8000 - -# This class will handles any incoming request. -class HTTPHandler(BaseHTTPRequestHandler): - # Handler for the GET requests - def do_GET(self): - self.send_response(200) - self.send_header('Content-type','text/html') - self.end_headers() - self.wfile.write("Hello World!") - -try: - # Create a web server and define the handler to manage the incoming request. - server = HTTPServer(('', PORT_NUMBER), HTTPHandler) - print 'Started httpserver on port ' , PORT_NUMBER - server.serve_forever() -except KeyboardInterrupt: - print '^C received, shutting down the web server' - server.socket.close() diff --git a/release-0.19.0/examples/cluster-dns/images/frontend/Dockerfile b/release-0.19.0/examples/cluster-dns/images/frontend/Dockerfile deleted file mode 100644 index 6046b7e1afb..00000000000 --- a/release-0.19.0/examples/cluster-dns/images/frontend/Dockerfile +++ /dev/null @@ -1,8 +0,0 @@ -FROM python:2.7 - -RUN pip install requests - -COPY . /dns-frontend -WORKDIR /dns-frontend - -CMD ["python", "client.py"] diff --git a/release-0.19.0/examples/cluster-dns/images/frontend/client.py b/release-0.19.0/examples/cluster-dns/images/frontend/client.py deleted file mode 100644 index cbb27644936..00000000000 --- a/release-0.19.0/examples/cluster-dns/images/frontend/client.py +++ /dev/null @@ -1,46 +0,0 @@ -#!/usr/bin/env python - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -import argparse -import requests -import socket - -from urlparse import urlparse - - -def CheckServiceAddress(address): - hostname = urlparse(address).hostname - service_address = socket.gethostbyname(hostname) - print service_address - - -def GetServerResponse(address): - print 'Send request to:', address - response = requests.get(address) - print response - print response.content - - -def Main(): - parser = argparse.ArgumentParser() - parser.add_argument('address') - args = parser.parse_args() - CheckServiceAddress(args.address) - GetServerResponse(args.address) - - -if __name__ == "__main__": - Main() diff --git a/release-0.19.0/examples/cluster-dns/namespace-dev.yaml b/release-0.19.0/examples/cluster-dns/namespace-dev.yaml deleted file mode 100644 index 492eddb9f4a..00000000000 --- a/release-0.19.0/examples/cluster-dns/namespace-dev.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1beta3 -kind: Namespace -metadata: - name: "development" - labels: - name: "development" diff --git a/release-0.19.0/examples/cluster-dns/namespace-prod.yaml b/release-0.19.0/examples/cluster-dns/namespace-prod.yaml deleted file mode 100644 index 7cd820ca9ad..00000000000 --- a/release-0.19.0/examples/cluster-dns/namespace-prod.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1beta3 -kind: Namespace -metadata: - name: "production" - labels: - name: "production" diff --git a/release-0.19.0/examples/doc.go b/release-0.19.0/examples/doc.go deleted file mode 100644 index d976f88e65a..00000000000 --- a/release-0.19.0/examples/doc.go +++ /dev/null @@ -1,18 +0,0 @@ -/* -Copyright 2014 The Kubernetes Authors All rights reserved. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Examples contains sample applications for trying out the concepts in Kubernetes. -package examples diff --git a/release-0.19.0/examples/downward-api/README.md b/release-0.19.0/examples/downward-api/README.md deleted file mode 100644 index 84956f4ef7c..00000000000 --- a/release-0.19.0/examples/downward-api/README.md +++ /dev/null @@ -1,39 +0,0 @@ -# Downward API example - -Following this example, you will create a pod with a containers that consumes the pod's name and -namespace using the downward API. - -## Step Zero: Prerequisites - -This example assumes you have a Kubernetes cluster installed and running, and that you have -installed the ```kubectl``` command line tool somewhere in your path. Please see the [getting -started](../../docs/getting-started-guides) for installation instructions for your platform. - -## Step One: Create the pod - -Containers consume the downward API using environment variables. The downward API allows -containers to be injected with the name and namespace of the pod the container is in. - -Use the [`examples/downward-api/dapi-pod.yaml`](dapi-pod.yaml) file to create a Pod with a container that consumes the -downward API. - -```shell -$ kubectl create -f examples/downward-api/dapi-pod.yaml -``` - -### Examine the logs - -This pod runs the `env` command in a container that consumes the downward API. You can grep -through the pod logs to see that the pod was injected with the correct values: - -```shell -$ kubectl log dapi-test-pod | grep POD_ -2015-04-30T20:22:18.568024817Z POD_NAME=dapi-test-pod -2015-04-30T20:22:18.568087688Z POD_NAMESPACE=default -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/downward-api/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/downward-api/README.md?pixel)]() diff --git a/release-0.19.0/examples/downward-api/dapi-pod.yaml b/release-0.19.0/examples/downward-api/dapi-pod.yaml deleted file mode 100644 index 09e8bbe8c17..00000000000 --- a/release-0.19.0/examples/downward-api/dapi-pod.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - name: dapi-test-pod -spec: - containers: - - name: test-container - image: gcr.io/google_containers/busybox - command: [ "/bin/sh", "-c", "env" ] - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - restartPolicy: Never diff --git a/release-0.19.0/examples/elasticsearch/Dockerfile b/release-0.19.0/examples/elasticsearch/Dockerfile deleted file mode 100644 index fd47488abcc..00000000000 --- a/release-0.19.0/examples/elasticsearch/Dockerfile +++ /dev/null @@ -1,18 +0,0 @@ -FROM java:7-jre - -RUN apt-get update && \ - apt-get install -y curl && \ - apt-get clean - -RUN cd / && \ - curl -O https://download.elastic.co/elasticsearch/elasticsearch/elasticsearch-1.5.2.tar.gz && \ - tar xf elasticsearch-1.5.2.tar.gz && \ - rm elasticsearch-1.5.2.tar.gz - -COPY elasticsearch.yml /elasticsearch-1.5.2/config/elasticsearch.yml -COPY run.sh / -COPY elasticsearch_discovery / - -EXPOSE 9200 9300 - -CMD ["/run.sh"] \ No newline at end of file diff --git a/release-0.19.0/examples/elasticsearch/Makefile b/release-0.19.0/examples/elasticsearch/Makefile deleted file mode 100644 index ae1794e6b70..00000000000 --- a/release-0.19.0/examples/elasticsearch/Makefile +++ /dev/null @@ -1,14 +0,0 @@ -.PHONY: elasticsearch_discovery build push all - -TAG = 1.0 - -build: - docker build -t kubernetes/elasticsearch:$(TAG) . - -push: - docker push kubernetes/elasticsearch:$(TAG) - -elasticsearch_discovery: - go build elasticsearch_discovery.go - -all: elasticsearch_discovery build push diff --git a/release-0.19.0/examples/elasticsearch/README.md b/release-0.19.0/examples/elasticsearch/README.md deleted file mode 100644 index 5743be293e7..00000000000 --- a/release-0.19.0/examples/elasticsearch/README.md +++ /dev/null @@ -1,324 +0,0 @@ -# Elasticsearch for Kubernetes - -This directory contains the source for a Docker image that creates an instance -of [Elasticsearch](https://www.elastic.co/products/elasticsearch) 1.5.2 which can -be used to automatically form clusters when used -with [replication controllers](../../docs/replication-controller.md). This will not work with the library Elasticsearch image -because multicast discovery will not find the other pod IPs needed to form a cluster. This -image detects other Elasticsearch [pods](../../docs/pods.md) running in a specified [namespace](../../docs/namespaces.md) with a given -label selector. The detected instances are used to form a list of peer hosts which -are used as part of the unicast discovery mechansim for Elasticsearch. The detection -of the peer nodes is done by a program which communicates with the Kubernetes API -server to get a list of matching Elasticsearch pods. To enable authenticated -communication this image needs a [secret](../../docs/secrets.md) to be mounted at `/etc/apiserver-secret` -with the basic authentication username and password. - -Here is an example replication controller specification that creates 4 instances of Elasticsearch which is in the file -[music-rc.yaml](music-rc.yaml). -``` -apiVersion: v1beta3 -kind: ReplicationController -metadata: - labels: - name: music-db - namespace: mytunes - name: music-db -spec: - replicas: 4 - selector: - name: music-db - template: - metadata: - labels: - name: music-db - spec: - containers: - - name: es - image: kubernetes/elasticsearch:1.0 - env: - - name: "CLUSTER_NAME" - value: "mytunes-db" - - name: "SELECTOR" - value: "name=music-db" - - name: "NAMESPACE" - value: "mytunes" - ports: - - name: es - containerPort: 9200 - - name: es-transport - containerPort: 9300 - volumeMounts: - - name: apiserver-secret - mountPath: /etc/apiserver-secret - readOnly: true - volumes: - - name: apiserver-secret - secret: - secretName: apiserver-secret -``` -The `CLUSTER_NAME` variable gives a name to the cluster and allows multiple separate clusters to -exist in the same namespace. -The `SELECTOR` variable should be set to a label query that identifies the Elasticsearch -nodes that should participate in this cluster. For our example we specify `name=music-db` to -match all pods that have the label `name` set to the value `music-db`. -The `NAMESPACE` variable identifies the namespace -to be used to search for Elasticsearch pods and this should be the same as the namespace specified -for the replication controller (in this case `mytunes`). - -Before creating pods with the replication controller a secret containing the bearer authentication token -should be set up. A template is provided in the file [apiserver-secret.yaml](apiserver-secret.yaml): -``` -apiVersion: v1beta3 -kind: Secret -metadata: - name: apiserver-secret - namespace: NAMESPACE -data: - token: "TOKEN" - -``` -Replace `NAMESPACE` with the actual namespace to be used and `TOKEN` with the basic64 encoded -versions of the bearer token reported by `kubectl config view` e.g. -``` -$ kubectl config view -... -- name: kubernetes-logging_kubernetes-basic-auth -... - token: yGlDcMvSZPX4PyP0Q5bHgAYgi1iyEHv2 - ... -$ echo yGlDcMvSZPX4PyP0Q5bHgAYgi1iyEHv2 | base64 -eUdsRGNNdlNaUFg0UHlQMFE1YkhnQVlnaTFpeUVIdjIK= - -``` -resulting in the file: -``` -apiVersion: v1beta3 -kind: Secret -metadata: - name: apiserver-secret - namespace: mytunes -data: - token: "eUdsRGNNdlNaUFg0UHlQMFE1YkhnQVlnaTFpeUVIdjIK=" - -``` -which can be used to create the secret in your namespace: -``` -kubectl create -f apiserver-secret.yaml --namespace=mytunes -secrets/apiserver-secret - -``` -Now you are ready to create the replication controller which will then create the pods: -``` -$ kubectl create -f music-rc.yaml --namespace=mytunes -replicationcontrollers/music-db - -``` -It's also useful to have a [service](../../docs/services.md) with an external load balancer for accessing the Elasticsearch -cluster which can be found in the file [music-service.yaml](music-service.yaml). -``` -apiVersion: v1beta3 -kind: Service -metadata: - name: music-server - namespace: mytunes - labels: - name: music-db -spec: - selector: - name: music-db - ports: - - name: db - port: 9200 - targetPort: es - createExternalLoadBalancer: true -``` -Let's create the service with an external load balancer: -``` -$ kubectl create -f music-service.yaml --namespace=mytunes -services/music-server - -``` -Let's see what we've got: -``` -$ kubectl get pods,rc,services,secrets --namespace=mytunes - -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -music-db-0fwsu 10.244.2.48 kubernetes-minion-m49b/104.197.35.221 name=music-db Running 6 minutes - es kubernetes/elasticsearch:1.0 Running 29 seconds -music-db-5pc2e 10.244.0.24 kubernetes-minion-3c8c/146.148.41.184 name=music-db Running 6 minutes - es kubernetes/elasticsearch:1.0 Running 6 minutes -music-db-bjqmv 10.244.3.31 kubernetes-minion-zey5/104.154.59.10 name=music-db Running 6 minutes - es kubernetes/elasticsearch:1.0 Running 19 seconds -music-db-swtrs 10.244.1.37 kubernetes-minion-f9dw/130.211.159.230 name=music-db Running 6 minutes - es kubernetes/elasticsearch:1.0 Running 6 minutes -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -music-db es kubernetes/elasticsearch:1.0 name=music-db 4 -NAME LABELS SELECTOR IP(S) PORT(S) -music-server name=music-db name=music-db 10.0.138.61 9200/TCP - 104.197.12.157 -NAME TYPE DATA -apiserver-secret Opaque 2 -``` -This shows 4 instances of Elasticsearch running. After making sure that port 9200 is accessible for this cluster (e.g. using a firewall rule for GCE) we can make queries via the service which will be fielded by the matching Elasticsearch pods. -``` -$ curl 104.197.12.157:9200 -{ - "status" : 200, - "name" : "Warpath", - "cluster_name" : "mytunes-db", - "version" : { - "number" : "1.5.2", - "build_hash" : "62ff9868b4c8a0c45860bebb259e21980778ab1c", - "build_timestamp" : "2015-04-27T09:21:06Z", - "build_snapshot" : false, - "lucene_version" : "4.10.4" - }, - "tagline" : "You Know, for Search" -} -$ curl 104.197.12.157:9200 -{ - "status" : 200, - "name" : "Callisto", - "cluster_name" : "mytunes-db", - "version" : { - "number" : "1.5.2", - "build_hash" : "62ff9868b4c8a0c45860bebb259e21980778ab1c", - "build_timestamp" : "2015-04-27T09:21:06Z", - "build_snapshot" : false, - "lucene_version" : "4.10.4" - }, - "tagline" : "You Know, for Search" -} -``` -We can query the nodes to confirm that an Elasticsearch cluster has been formed. -``` -$ curl 104.197.12.157:9200/_nodes?pretty=true -{ - "cluster_name" : "mytunes-db", - "nodes" : { - "u-KrvywFQmyaH5BulSclsA" : { - "name" : "Jonas Harrow", -... - "discovery" : { - "zen" : { - "ping" : { - "unicast" : { - "hosts" : [ "10.244.2.48", "10.244.0.24", "10.244.3.31", "10.244.1.37" ] - }, -... - "name" : "Warpath", -... - "discovery" : { - "zen" : { - "ping" : { - "unicast" : { - "hosts" : [ "10.244.2.48", "10.244.0.24", "10.244.3.31", "10.244.1.37" ] - }, -... - "name" : "Callisto", -... - "discovery" : { - "zen" : { - "ping" : { - "unicast" : { - "hosts" : [ "10.244.2.48", "10.244.0.24", "10.244.3.31", "10.244.1.37" ] - }, -... - "name" : "Vapor", -... - "discovery" : { - "zen" : { - "ping" : { - "unicast" : { - "hosts" : [ "10.244.2.48", "10.244.0.24", "10.244.3.31", "10.244.1.37" ] -... -``` -Let's ramp up the number of Elasticsearch nodes from 4 to 10: -``` -$ kubectl scale --replicas=10 replicationcontrollers music-db --namespace=mytunes -scaled -$ kubectl get pods --namespace=mytunes -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -music-db-0fwsu 10.244.2.48 kubernetes-minion-m49b/104.197.35.221 name=music-db Running 33 minutes - es kubernetes/elasticsearch:1.0 Running 26 minutes -music-db-2erje 10.244.2.50 kubernetes-minion-m49b/104.197.35.221 name=music-db Running 48 seconds - es kubernetes/elasticsearch:1.0 Running 46 seconds -music-db-5pc2e 10.244.0.24 kubernetes-minion-3c8c/146.148.41.184 name=music-db Running 33 minutes - es kubernetes/elasticsearch:1.0 Running 32 minutes -music-db-8rkvp 10.244.3.33 kubernetes-minion-zey5/104.154.59.10 name=music-db Running 48 seconds - es kubernetes/elasticsearch:1.0 Running 46 seconds -music-db-bjqmv 10.244.3.31 kubernetes-minion-zey5/104.154.59.10 name=music-db Running 33 minutes - es kubernetes/elasticsearch:1.0 Running 26 minutes -music-db-efc46 10.244.2.49 kubernetes-minion-m49b/104.197.35.221 name=music-db Running 48 seconds - es kubernetes/elasticsearch:1.0 Running 46 seconds -music-db-fhqyg 10.244.0.25 kubernetes-minion-3c8c/146.148.41.184 name=music-db Running 48 seconds - es kubernetes/elasticsearch:1.0 Running 47 seconds -music-db-guxe4 10.244.3.32 kubernetes-minion-zey5/104.154.59.10 name=music-db Running 48 seconds - es kubernetes/elasticsearch:1.0 Running 46 seconds -music-db-pbiq1 10.244.1.38 kubernetes-minion-f9dw/130.211.159.230 name=music-db Running 48 seconds - es kubernetes/elasticsearch:1.0 Running 47 seconds -music-db-swtrs 10.244.1.37 kubernetes-minion-f9dw/130.211.159.230 name=music-db Running 33 minutes - es kubernetes/elasticsearch:1.0 Running 32 minutes - -``` -Let's check to make sure that these 10 nodes are part of the same Elasticsearch cluster: -``` -$ curl 104.197.12.157:9200/_nodes?pretty=true | grep name -"cluster_name" : "mytunes-db", - "name" : "Killraven", - "name" : "Killraven", - "name" : "mytunes-db" - "vm_name" : "OpenJDK 64-Bit Server VM", - "name" : "eth0", - "name" : "Tefral the Surveyor", - "name" : "Tefral the Surveyor", - "name" : "mytunes-db" - "vm_name" : "OpenJDK 64-Bit Server VM", - "name" : "eth0", - "name" : "Jonas Harrow", - "name" : "Jonas Harrow", - "name" : "mytunes-db" - "vm_name" : "OpenJDK 64-Bit Server VM", - "name" : "eth0", - "name" : "Warpath", - "name" : "Warpath", - "name" : "mytunes-db" - "vm_name" : "OpenJDK 64-Bit Server VM", - "name" : "eth0", - "name" : "Brute I", - "name" : "Brute I", - "name" : "mytunes-db" - "vm_name" : "OpenJDK 64-Bit Server VM", - "name" : "eth0", - "name" : "Callisto", - "name" : "Callisto", - "name" : "mytunes-db" - "vm_name" : "OpenJDK 64-Bit Server VM", - "name" : "eth0", - "name" : "Vapor", - "name" : "Vapor", - "name" : "mytunes-db" - "vm_name" : "OpenJDK 64-Bit Server VM", - "name" : "eth0", - "name" : "Timeslip", - "name" : "Timeslip", - "name" : "mytunes-db" - "vm_name" : "OpenJDK 64-Bit Server VM", - "name" : "eth0", - "name" : "Magik", - "name" : "Magik", - "name" : "mytunes-db" - "vm_name" : "OpenJDK 64-Bit Server VM", - "name" : "eth0", - "name" : "Brother Voodoo", - "name" : "Brother Voodoo", - "name" : "mytunes-db" - "vm_name" : "OpenJDK 64-Bit Server VM", - "name" : "eth0", - -``` - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/elasticsearch/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/elasticsearch/README.md?pixel)]() diff --git a/release-0.19.0/examples/elasticsearch/apiserver-secret.yaml b/release-0.19.0/examples/elasticsearch/apiserver-secret.yaml deleted file mode 100644 index 1d0c8522005..00000000000 --- a/release-0.19.0/examples/elasticsearch/apiserver-secret.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1beta3 -kind: Secret -metadata: - name: apiserver-secret - namespace: NAMESPACE -data: - token: "TOKEN" - diff --git a/release-0.19.0/examples/elasticsearch/elasticsearch.yml b/release-0.19.0/examples/elasticsearch/elasticsearch.yml deleted file mode 100644 index ff0237a2eb2..00000000000 --- a/release-0.19.0/examples/elasticsearch/elasticsearch.yml +++ /dev/null @@ -1,385 +0,0 @@ -##################### Elasticsearch Configuration Example ##################### - -# This file contains an overview of various configuration settings, -# targeted at operations staff. Application developers should -# consult the guide at . -# -# The installation procedure is covered at -# . -# -# Elasticsearch comes with reasonable defaults for most settings, -# so you can try it out without bothering with configuration. -# -# Most of the time, these defaults are just fine for running a production -# cluster. If you're fine-tuning your cluster, or wondering about the -# effect of certain configuration option, please _do ask_ on the -# mailing list or IRC channel [http://elasticsearch.org/community]. - -# Any element in the configuration can be replaced with environment variables -# by placing them in ${...} notation. For example: -# -#node.rack: ${RACK_ENV_VAR} - -# For information on supported formats and syntax for the config file, see -# - - -################################### Cluster ################################### - -# Cluster name identifies your cluster for auto-discovery. If you're running -# multiple clusters on the same network, make sure you're using unique names. -# -cluster.name: ${CLUSTER_NAME} - - -#################################### Node ##################################### - -# Node names are generated dynamically on startup, so you're relieved -# from configuring them manually. You can tie this node to a specific name: -# -#node.name: "Franz Kafka" - -# Every node can be configured to allow or deny being eligible as the master, -# and to allow or deny to store the data. -# -# Allow this node to be eligible as a master node (enabled by default): -# -node.master: ${NODE_MASTER} -# -# Allow this node to store data (enabled by default): -# -node.data: ${NODE_DATA} - -# You can exploit these settings to design advanced cluster topologies. -# -# 1. You want this node to never become a master node, only to hold data. -# This will be the "workhorse" of your cluster. -# -#node.master: false -#node.data: true -# -# 2. You want this node to only serve as a master: to not store any data and -# to have free resources. This will be the "coordinator" of your cluster. -# -#node.master: true -#node.data: false -# -# 3. You want this node to be neither master nor data node, but -# to act as a "search load balancer" (fetching data from nodes, -# aggregating results, etc.) -# -#node.master: false -#node.data: false - -# Use the Cluster Health API [http://localhost:9200/_cluster/health], the -# Node Info API [http://localhost:9200/_nodes] or GUI tools -# such as , -# , -# and -# to inspect the cluster state. - -# A node can have generic attributes associated with it, which can later be used -# for customized shard allocation filtering, or allocation awareness. An attribute -# is a simple key value pair, similar to node.key: value, here is an example: -# -#node.rack: rack314 - -# By default, multiple nodes are allowed to start from the same installation location -# to disable it, set the following: -#node.max_local_storage_nodes: 1 - - -#################################### Index #################################### - -# You can set a number of options (such as shard/replica options, mapping -# or analyzer definitions, translog settings, ...) for indices globally, -# in this file. -# -# Note, that it makes more sense to configure index settings specifically for -# a certain index, either when creating it or by using the index templates API. -# -# See and -# -# for more information. - -# Set the number of shards (splits) of an index (5 by default): -# -#index.number_of_shards: 5 - -# Set the number of replicas (additional copies) of an index (1 by default): -# -#index.number_of_replicas: 1 - -# Note, that for development on a local machine, with small indices, it usually -# makes sense to "disable" the distributed features: -# -#index.number_of_shards: 1 -#index.number_of_replicas: 0 - -# These settings directly affect the performance of index and search operations -# in your cluster. Assuming you have enough machines to hold shards and -# replicas, the rule of thumb is: -# -# 1. Having more *shards* enhances the _indexing_ performance and allows to -# _distribute_ a big index across machines. -# 2. Having more *replicas* enhances the _search_ performance and improves the -# cluster _availability_. -# -# The "number_of_shards" is a one-time setting for an index. -# -# The "number_of_replicas" can be increased or decreased anytime, -# by using the Index Update Settings API. -# -# Elasticsearch takes care about load balancing, relocating, gathering the -# results from nodes, etc. Experiment with different settings to fine-tune -# your setup. - -# Use the Index Status API () to inspect -# the index status. - - -#################################### Paths #################################### - -# Path to directory containing configuration (this file and logging.yml): -# -#path.conf: /path/to/conf - -# Path to directory where to store index data allocated for this node. -# -#path.data: /path/to/data -# -# Can optionally include more than one location, causing data to be striped across -# the locations (a la RAID 0) on a file level, favouring locations with most free -# space on creation. For example: -# -#path.data: /path/to/data1,/path/to/data2 - -# Path to temporary files: -# -#path.work: /path/to/work - -# Path to log files: -# -#path.logs: /path/to/logs - -# Path to where plugins are installed: -# -#path.plugins: /path/to/plugins - - -#################################### Plugin ################################### - -# If a plugin listed here is not installed for current node, the node will not start. -# -#plugin.mandatory: mapper-attachments,lang-groovy - - -################################### Memory #################################### - -# Elasticsearch performs poorly when JVM starts swapping: you should ensure that -# it _never_ swaps. -# -# Set this property to true to lock the memory: -# -#bootstrap.mlockall: true - -# Make sure that the ES_MIN_MEM and ES_MAX_MEM environment variables are set -# to the same value, and that the machine has enough memory to allocate -# for Elasticsearch, leaving enough memory for the operating system itself. -# -# You should also make sure that the Elasticsearch process is allowed to lock -# the memory, eg. by using `ulimit -l unlimited`. - - -############################## Network And HTTP ############################### - -# Elasticsearch, by default, binds itself to the 0.0.0.0 address, and listens -# on port [9200-9300] for HTTP traffic and on port [9300-9400] for node-to-node -# communication. (the range means that if the port is busy, it will automatically -# try the next port). - -# Set the bind address specifically (IPv4 or IPv6): -# -#network.bind_host: 192.168.0.1 - -# Set the address other nodes will use to communicate with this node. If not -# set, it is automatically derived. It must point to an actual IP address. -# -#network.publish_host: 192.168.0.1 - -# Set both 'bind_host' and 'publish_host': -# -#network.host: 192.168.0.1 - -# Set a custom port for the node to node communication (9300 by default): -# -transport.tcp.port: ${TRANSPORT_PORT} - -# Enable compression for all communication between nodes (disabled by default): -# -#transport.tcp.compress: true - -# Set a custom port to listen for HTTP traffic: -# -http.port: ${HTTP_PORT} - -# Set a custom allowed content length: -# -#http.max_content_length: 100mb - -# Disable HTTP completely: -# -#http.enabled: false - - -################################### Gateway ################################### - -# The gateway allows for persisting the cluster state between full cluster -# restarts. Every change to the state (such as adding an index) will be stored -# in the gateway, and when the cluster starts up for the first time, -# it will read its state from the gateway. - -# There are several types of gateway implementations. For more information, see -# . - -# The default gateway type is the "local" gateway (recommended): -# -#gateway.type: local - -# Settings below control how and when to start the initial recovery process on -# a full cluster restart (to reuse as much local data as possible when using shared -# gateway). - -# Allow recovery process after N nodes in a cluster are up: -# -#gateway.recover_after_nodes: 1 - -# Set the timeout to initiate the recovery process, once the N nodes -# from previous setting are up (accepts time value): -# -#gateway.recover_after_time: 5m - -# Set how many nodes are expected in this cluster. Once these N nodes -# are up (and recover_after_nodes is met), begin recovery process immediately -# (without waiting for recover_after_time to expire): -# -#gateway.expected_nodes: 2 - - -############################# Recovery Throttling ############################# - -# These settings allow to control the process of shards allocation between -# nodes during initial recovery, replica allocation, rebalancing, -# or when adding and removing nodes. - -# Set the number of concurrent recoveries happening on a node: -# -# 1. During the initial recovery -# -#cluster.routing.allocation.node_initial_primaries_recoveries: 4 -# -# 2. During adding/removing nodes, rebalancing, etc -# -#cluster.routing.allocation.node_concurrent_recoveries: 2 - -# Set to throttle throughput when recovering (eg. 100mb, by default 20mb): -# -#indices.recovery.max_bytes_per_sec: 20mb - -# Set to limit the number of open concurrent streams when -# recovering a shard from a peer: -# -#indices.recovery.concurrent_streams: 5 - - -################################## Discovery ################################## - -# Discovery infrastructure ensures nodes can be found within a cluster -# and master node is elected. Multicast discovery is the default. - -# Set to ensure a node sees N other master eligible nodes to be considered -# operational within the cluster. This should be set to a quorum/majority of -# the master-eligible nodes in the cluster. -# -#discovery.zen.minimum_master_nodes: 1 - -# Set the time to wait for ping responses from other nodes when discovering. -# Set this option to a higher value on a slow or congested network -# to minimize discovery failures: -# -#discovery.zen.ping.timeout: 3s - -# For more information, see -# - -# Unicast discovery allows to explicitly control which nodes will be used -# to discover the cluster. It can be used when multicast is not present, -# or to restrict the cluster communication-wise. -# -# 1. Disable multicast discovery (enabled by default): -# -discovery.zen.ping.multicast.enabled: ${MULTICAST} -# -# 2. Configure an initial list of master nodes in the cluster -# to perform discovery when new nodes (master or data) are started: -# -#discovery.zen.ping.unicast.hosts: ${UNICAST_HOSTS} - -# EC2 discovery allows to use AWS EC2 API in order to perform discovery. -# -# You have to install the cloud-aws plugin for enabling the EC2 discovery. -# -# For more information, see -# -# -# See -# for a step-by-step tutorial. - -# GCE discovery allows to use Google Compute Engine API in order to perform discovery. -# -# You have to install the cloud-gce plugin for enabling the GCE discovery. -# -# For more information, see . - -# Azure discovery allows to use Azure API in order to perform discovery. -# -# You have to install the cloud-azure plugin for enabling the Azure discovery. -# -# For more information, see . - -################################## Slow Log ################################## - -# Shard level query and fetch threshold logging. - -#index.search.slowlog.threshold.query.warn: 10s -#index.search.slowlog.threshold.query.info: 5s -#index.search.slowlog.threshold.query.debug: 2s -#index.search.slowlog.threshold.query.trace: 500ms - -#index.search.slowlog.threshold.fetch.warn: 1s -#index.search.slowlog.threshold.fetch.info: 800ms -#index.search.slowlog.threshold.fetch.debug: 500ms -#index.search.slowlog.threshold.fetch.trace: 200ms - -#index.indexing.slowlog.threshold.index.warn: 10s -#index.indexing.slowlog.threshold.index.info: 5s -#index.indexing.slowlog.threshold.index.debug: 2s -#index.indexing.slowlog.threshold.index.trace: 500ms - -################################## GC Logging ################################ - -#monitor.jvm.gc.young.warn: 1000ms -#monitor.jvm.gc.young.info: 700ms -#monitor.jvm.gc.young.debug: 400ms - -#monitor.jvm.gc.old.warn: 10s -#monitor.jvm.gc.old.info: 5s -#monitor.jvm.gc.old.debug: 2s - -################################## Security ################################ - -# Uncomment if you want to enable JSONP as a valid return transport on the -# http server. With this enabled, it may pose a security risk, so disabling -# it unless you need it is recommended (it is disabled by default). -# -#http.jsonp.enable: true diff --git a/release-0.19.0/examples/elasticsearch/elasticsearch_discovery.go b/release-0.19.0/examples/elasticsearch/elasticsearch_discovery.go deleted file mode 100644 index 100ba01260c..00000000000 --- a/release-0.19.0/examples/elasticsearch/elasticsearch_discovery.go +++ /dev/null @@ -1,97 +0,0 @@ -/* -Copyright 2015 The Kubernetes Authors All rights reserved. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package main - -import ( - "flag" - "fmt" - "os" - "strings" - "time" - - "github.com/GoogleCloudPlatform/kubernetes/pkg/api" - "github.com/GoogleCloudPlatform/kubernetes/pkg/client" - "github.com/GoogleCloudPlatform/kubernetes/pkg/fields" - "github.com/GoogleCloudPlatform/kubernetes/pkg/labels" - "github.com/golang/glog" -) - -var ( - token = flag.String("token", "", "Bearer token for authentication to the API server.") - server = flag.String("server", "", "The address and port of the Kubernetes API server") - namespace = flag.String("namespace", api.NamespaceDefault, "The namespace containing Elasticsearch pods") - selector = flag.String("selector", "", "Selector (label query) for selecting Elasticsearch pods") -) - -func main() { - flag.Parse() - glog.Info("Elasticsearch discovery") - apiServer := *server - if apiServer == "" { - kubernetesService := os.Getenv("KUBERNETES_SERVICE_HOST") - if kubernetesService == "" { - glog.Fatalf("Please specify the Kubernetes server with --server") - } - apiServer = fmt.Sprintf("https://%s:%s", kubernetesService, os.Getenv("KUBERNETES_SERVICE_PORT")) - } - - glog.Infof("Server: %s", apiServer) - glog.Infof("Namespace: %q", *namespace) - glog.Infof("selector: %q", *selector) - - config := client.Config{ - Host: apiServer, - BearerToken: *token, - Insecure: true, - } - - c, err := client.New(&config) - if err != nil { - glog.Fatalf("Failed to make client: %v", err) - } - - l, err := labels.Parse(*selector) - if err != nil { - glog.Fatalf("Failed to parse selector %q: %v", *selector, err) - } - pods, err := c.Pods(*namespace).List(l, fields.Everything()) - if err != nil { - glog.Fatalf("Failed to list pods: %v", err) - } - - glog.Infof("Elasticsearch pods in namespace %s with selector %q", *namespace, *selector) - podIPs := []string{} - for i := range pods.Items { - p := &pods.Items[i] - for attempt := 0; attempt < 10; attempt++ { - glog.Infof("%d: %s PodIP: %s", i, p.Name, p.Status.PodIP) - if p.Status.PodIP != "" { - podIPs = append(podIPs, fmt.Sprintf(`"%s"`, p.Status.PodIP)) - break - } - time.Sleep(1 * time.Second) - p, err = c.Pods(*namespace).Get(p.Name) - if err != nil { - glog.Warningf("Failed to get pod %s: %v", p.Name, err) - } - } - if p.Status.PodIP == "" { - glog.Warningf("Failed to obtain PodIP for %s", p.Name) - } - } - fmt.Printf("discovery.zen.ping.unicast.hosts: [%s]\n", strings.Join(podIPs, ", ")) -} diff --git a/release-0.19.0/examples/elasticsearch/music-rc.yaml b/release-0.19.0/examples/elasticsearch/music-rc.yaml deleted file mode 100644 index eec1e9accce..00000000000 --- a/release-0.19.0/examples/elasticsearch/music-rc.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - labels: - name: music-db - namespace: mytunes - name: music-db -spec: - replicas: 4 - selector: - name: music-db - template: - metadata: - labels: - name: music-db - spec: - containers: - - name: es - image: kubernetes/elasticsearch:1.0 - env: - - name: "CLUSTER_NAME" - value: "mytunes-db" - - name: "SELECTOR" - value: "name=music-db" - - name: "NAMESPACE" - value: "mytunes" - ports: - - name: es - containerPort: 9200 - - name: es-transport - containerPort: 9300 - volumeMounts: - - name: apiserver-secret - mountPath: /etc/apiserver-secret - readOnly: true - volumes: - - name: apiserver-secret - secret: - secretName: apiserver-secret diff --git a/release-0.19.0/examples/elasticsearch/music-service.yaml b/release-0.19.0/examples/elasticsearch/music-service.yaml deleted file mode 100644 index 3dc45fae440..00000000000 --- a/release-0.19.0/examples/elasticsearch/music-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1beta3 -kind: Service -metadata: - name: music-server - namespace: mytunes - labels: - name: music-db -spec: - selector: - name: music-db - ports: - - name: db - port: 9200 - targetPort: es - createExternalLoadBalancer: true diff --git a/release-0.19.0/examples/elasticsearch/run.sh b/release-0.19.0/examples/elasticsearch/run.sh deleted file mode 100755 index 2b0447e3bcc..00000000000 --- a/release-0.19.0/examples/elasticsearch/run.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -export CLUSTER_NAME=${CLUSTER_NAME:-elasticsearch-default} -export NODE_MASTER=${NODE_MASTER:-true} -export NODE_DATA=${NODE_DATA:-true} -export MULTICAST=${MULTICAST:-false} -readonly TOKEN=$(cat /etc/apiserver-secret/token) -/elasticsearch_discovery --namespace="${NAMESPACE}" --token="${TOKEN}" --selector="${SELECTOR}" >> /elasticsearch-1.5.2/config/elasticsearch.yml -export HTTP_PORT=${HTTP_PORT:-9200} -export TRANSPORT_PORT=${TRANSPORT_PORT:-9300} -/elasticsearch-1.5.2/bin/elasticsearch diff --git a/release-0.19.0/examples/environment-guide/README.md b/release-0.19.0/examples/environment-guide/README.md deleted file mode 100644 index 6d985709119..00000000000 --- a/release-0.19.0/examples/environment-guide/README.md +++ /dev/null @@ -1,95 +0,0 @@ -Environment Guide Example -========================= -This example demonstrates running pods, replication controllers, and -services. It shows two types of pods: frontend and backend, with -services on top of both. Accessing the frontend pod will return -environment information about itself, and a backend pod that it has -accessed through the service. The goal is to illuminate the -environment metadata available to running containers inside the -Kubernetes cluster. The documentation for the kubernetes environment -is [here](/docs/container-environment.md). - -![Diagram](diagram.png) - -Prerequisites -------------- -This example assumes that you have a Kubernetes cluster installed and -running, and that you have installed the `kubectl` command line tool -somewhere in your path. Please see the [getting -started](/docs/getting-started-guides) for installation instructions -for your platform. - -Optional: Build your own containers ------------------------------------ -The code for the containers is under -[containers/](containers) - -Get everything running ----------------------- - - kubectl create -f ./backend-rc.yaml - kubectl create -f ./backend-srv.yaml - kubectl create -f ./show-rc.yaml - kubectl create -f ./show-srv.yaml - -Query the service ------------------ -Use `kubectl describe service show-srv` to determine the public IP of -your service. - -> Note: If your platform does not support external load balancers, - you'll need to open the proper port and direct traffic to the - internal IP shown for the frontend service with the above command - -Run `curl :80` to query the service. You should get -something like this back: - -``` -Pod Name: show-rc-xxu6i -Pod Namespace: default -USER_VAR: important information - -Kubenertes environment variables -BACKEND_SRV_SERVICE_HOST = 10.147.252.185 -BACKEND_SRV_SERVICE_PORT = 5000 -KUBERNETES_RO_SERVICE_HOST = 10.147.240.1 -KUBERNETES_RO_SERVICE_PORT = 80 -KUBERNETES_SERVICE_HOST = 10.147.240.2 -KUBERNETES_SERVICE_PORT = 443 -KUBE_DNS_SERVICE_HOST = 10.147.240.10 -KUBE_DNS_SERVICE_PORT = 53 - -Found backend ip: 10.147.252.185 port: 5000 -Response from backend -Backend Container -Backend Pod Name: backend-rc-6qiya -Backend Namespace: default -``` - -First the frontend pod's information is printed. The pod name and -[namespace](/docs/design/namespaces.md) are retreived from the -[Downward API](/docs/downward_api.md). Next, `USER_VAR` is the name of -an environment variable set in the [pod -definition](show-rc.yaml). Then, the dynamic kubernetes environment -variables are scanned and printed. These are used to find the backend -service, named `backend-srv`. Finally, the frontend pod queries the -backend service and prints the information returned. Again the backend -pod returns its own pod name and namespace. - -Try running the `curl` command a few times, and notice what -changes. Ex: `watch -n 1 curl -s ` Firstly, the frontend service -is directing your request to different frontend pods each time. The -frontend pods are always contacting the backend through the backend -service. This results in a different backend pod servicing each -request as well. - -Cleanup -------- - kubectl delete rc,service -l type=show-type - kubectl delete rc,service -l type=backend-type - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/environment-guide/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/environment-guide/README.md?pixel)]() diff --git a/release-0.19.0/examples/environment-guide/backend-rc.yaml b/release-0.19.0/examples/environment-guide/backend-rc.yaml deleted file mode 100644 index 6c57b95dac9..00000000000 --- a/release-0.19.0/examples/environment-guide/backend-rc.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -apiVersion: v1 -kind: ReplicationController -metadata: - name: backend-rc - labels: - type: backend-type -spec: - replicas: 3 - template: - metadata: - labels: - type: backend-type - spec: - containers: - - name: backend-container - image: gcr.io/google-samples/env-backend:1.1 - imagePullPolicy: Always - ports: - - containerPort: 5000 - protocol: TCP - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace diff --git a/release-0.19.0/examples/environment-guide/backend-srv.yaml b/release-0.19.0/examples/environment-guide/backend-srv.yaml deleted file mode 100644 index 7083b37bf88..00000000000 --- a/release-0.19.0/examples/environment-guide/backend-srv.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-srv - labels: - type: backend-type -spec: - ports: - - port: 5000 - protocol: TCP - selector: - type: backend-type diff --git a/release-0.19.0/examples/environment-guide/containers/README.md b/release-0.19.0/examples/environment-guide/containers/README.md deleted file mode 100644 index 8ab18ef83eb..00000000000 --- a/release-0.19.0/examples/environment-guide/containers/README.md +++ /dev/null @@ -1,26 +0,0 @@ -Building --------- -For each container, the build steps are the same. The examples below -are for the `show` container. Replace `show` with `backend` for the -backend container. - -GCR ---- - docker build -t gcr.io//show . - gcloud preview docker push gcr.io//show - -Docker Hub ----------- - docker build -t /show . - docker push /show - -Change Pod Definitions ----------------------- -Edit both `show-rc.yaml` and `backend-rc.yaml` and replace the -specified `image:` with the one that you built. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/environment-guide/containers/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/environment-guide/containers/README.md?pixel)]() diff --git a/release-0.19.0/examples/environment-guide/containers/backend/Dockerfile b/release-0.19.0/examples/environment-guide/containers/backend/Dockerfile deleted file mode 100644 index 3fa58ff7abe..00000000000 --- a/release-0.19.0/examples/environment-guide/containers/backend/Dockerfile +++ /dev/null @@ -1,2 +0,0 @@ -FROM golang:onbuild -EXPOSE 8080 diff --git a/release-0.19.0/examples/environment-guide/containers/backend/backend.go b/release-0.19.0/examples/environment-guide/containers/backend/backend.go deleted file mode 100644 index b4edf75ff5d..00000000000 --- a/release-0.19.0/examples/environment-guide/containers/backend/backend.go +++ /dev/null @@ -1,37 +0,0 @@ -/* -Copyright 2015 The Kubernetes Authors All rights reserved. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package main - -import ( - "fmt" - "log" - "net/http" - "os" -) - -func printInfo(resp http.ResponseWriter, req *http.Request) { - name := os.Getenv("POD_NAME") - namespace := os.Getenv("POD_NAMESPACE") - fmt.Fprintf(resp, "Backend Container\n") - fmt.Fprintf(resp, "Backend Pod Name: %v\n", name) - fmt.Fprintf(resp, "Backend Namespace: %v\n", namespace) -} - -func main() { - http.HandleFunc("/", printInfo) - log.Fatal(http.ListenAndServe(":5000", nil)) -} diff --git a/release-0.19.0/examples/environment-guide/containers/show/Dockerfile b/release-0.19.0/examples/environment-guide/containers/show/Dockerfile deleted file mode 100644 index 3fa58ff7abe..00000000000 --- a/release-0.19.0/examples/environment-guide/containers/show/Dockerfile +++ /dev/null @@ -1,2 +0,0 @@ -FROM golang:onbuild -EXPOSE 8080 diff --git a/release-0.19.0/examples/environment-guide/containers/show/show.go b/release-0.19.0/examples/environment-guide/containers/show/show.go deleted file mode 100644 index 56bd988b400..00000000000 --- a/release-0.19.0/examples/environment-guide/containers/show/show.go +++ /dev/null @@ -1,95 +0,0 @@ -/* -Copyright 2015 The Kubernetes Authors All rights reserved. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package main - -import ( - "fmt" - "io" - "log" - "net/http" - "os" - "sort" - "strings" -) - -func getKubeEnv() (map[string]string, error) { - environS := os.Environ() - environ := make(map[string]string) - for _, val := range environS { - split := strings.Split(val, "=") - if len(split) != 2 { - return environ, fmt.Errorf("Some weird env vars") - } - environ[split[0]] = split[1] - } - for key := range environ { - if !(strings.HasSuffix(key, "_SERVICE_HOST") || - strings.HasSuffix(key, "_SERVICE_PORT")) { - delete(environ, key) - } - } - return environ, nil -} - -func printInfo(resp http.ResponseWriter, req *http.Request) { - kubeVars, err := getKubeEnv() - if err != nil { - http.Error(resp, err.Error(), http.StatusInternalServerError) - return - } - - backendHost := os.Getenv("BACKEND_SRV_SERVICE_HOST") - backendPort := os.Getenv("BACKEND_SRV_SERVICE_PORT") - backendRsp, backendErr := http.Get(fmt.Sprintf( - "http://%v:%v/", - backendHost, - backendPort)) - if backendErr == nil { - defer backendRsp.Body.Close() - } - - name := os.Getenv("POD_NAME") - namespace := os.Getenv("POD_NAMESPACE") - fmt.Fprintf(resp, "Pod Name: %v \n", name) - fmt.Fprintf(resp, "Pod Namespace: %v \n", namespace) - - envvar := os.Getenv("USER_VAR") - fmt.Fprintf(resp, "USER_VAR: %v \n", envvar) - - fmt.Fprintf(resp, "\nKubenertes environment variables\n") - var keys []string - for key := range kubeVars { - keys = append(keys, key) - } - sort.Strings(keys) - for _, key := range keys { - fmt.Fprintf(resp, "%v = %v \n", key, kubeVars[key]) - } - - fmt.Fprintf(resp, "\nFound backend ip: %v port: %v\n", backendHost, backendPort) - if backendErr == nil { - fmt.Fprintf(resp, "Response from backend\n") - io.Copy(resp, backendRsp.Body) - } else { - fmt.Fprintf(resp, "Error from backend: %v", backendErr.Error()) - } -} - -func main() { - http.HandleFunc("/", printInfo) - log.Fatal(http.ListenAndServe(":8080", nil)) -} diff --git a/release-0.19.0/examples/environment-guide/diagram.png b/release-0.19.0/examples/environment-guide/diagram.png deleted file mode 100644 index dd5d1551631f2adce68bfa4555050a2fa1250af0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 18765 zcmbWf1z45Qx-R;YQi>=7k`e+U4bmkdEg&G>E!~|eB_$#PA|(PMQX<__A}zucY3Y`3 zINw}r?ftBM?>^_AyLt4P#6SNWV|;IYGg3`O?jivt0fHbG735{q;k5}tFxv5O;X8({ zXGQRW?Ix|Di3eZ)coq@xGrqIDt{Z|7UPb@MK;FEiK#&`Vg3Mh_@3*VtKHi#hf zzTRsIJ?!!u&)TrrvGEz6F}+Az?OZ+XUO2vB@dnXVaAi(8_Ap#fBkTCqdBgi#|er#v7HGlLG+{q)-LtkL|90~^XEsd(_cfwTEdCrygM2bi6st#e+&+C zn3|d<<)|;+GvJb($&Qe}OhPhHXWd7;pS*KI^;XR1<$B|JpoW3Lm=|x#Ds7Q5aeKIh zl~ucZj{3q#nRWHzalK8s-uKQ<9_4hg!);T}SUTila3}JLai5Lns=B)RkJ-%38wCS4 zvo#z0pFLKzu0+c8!kHDXXYU9jw8VILzdowxH^f9m9mn=9)XFf#w@gk>irEc+qRiK{ zo!j(wgqMiuXtBZpn=`7W{U(71zs9{K|)FS@q2goj*_aXoSq&fDFMziY13k#s&PkmPtSK*Sr`|H zX~W>zxT2wK?OhudGgcwrSIyM4RpoUWUKfRNDdG|g**Cr0X= zdjFHw?Lz&^UJ?oln`DWAqrR%MN$zabTZxK=23}%L8rs@&x3!DhZTR2dM#_9nUJ1Iw zr-+G(IT5&&lVoq;CFJBW-+f(CL4hY=!*6oM4$EIUC4#D11LHjb_LDD7O--UFCnv9b z>m}N!oxd4yCQZJ&r9otAX-RKDzO?t zUXNwXB=vlvZ{6LR@AL8quUx%4y|8d0C@83}m8kb+j2Y9Zy552n5c8R-0+f;5^|)UIOyQsX!Fwx)$5E` zCuZU#C-Sul=;n^jB`Dj++0^XqSF7i`l2{r}_eRx=>^5)uOJqdIN8k(CFi+J4H^1Sv z{BBmLrC%CwyjQZjf+D;Sh|Bj98#82Pb)<}5t6-O~$nLtr%%7__SXlD<%}VQn{#)z)P-o1#R$r!}8UOk7Cuu1D&aI|}n&6OU;o-&1?+SBraz1Ul$=|qqgNdn?xXA#$ z6C)ag;ZOOOFaF-Ezj&^r%DJ09J}MwJD;3IE5s`hVec{HPJG+Y)==__m;sd=ZwX;LCVt3bTZgNCtFAM3?sDyo9H&Gt4Uy^M#NnlebN zvtft))-dvS%~Le*so`MmgO*qt(W3w&64UMZ9%mtHbM--;N|c6%##IYmU7XF^9Z!uBSeWKPiPxF?rizOrN^Y-E9<3_5D2W?zL+QmkvgUNzo-|OxmX;x*r`#pk_ z&W0Cy(?r9==>jQI1stRe45)ee_#SF$;UYSvW;lq+*~uYyYLAfDI<>2t8wm|f3_Nb> zViXqgy{oI#ch}Z_qVBqnkI!juS#6Jg&qDiNyW)cf7xy+Moytb+_1ixU@cb#n2p(KI z8C)N)ePDnxA;LWpzbiYf;-{Z-1TBO8bR6vOO61zdwWtiR_ zn=>8sWKo+_Pl+*+ZY#dM_3@}U$uo+^qoLxXv^=BY4L1q#(e3SRsxs8nF3Q-ce8m3h zQ526+XJ4Nx>gUhaPWq;$r6riYbPp92@bfj zWwViU>U~*^+Fs}@sA8AS9?10L*UM6CGAkY1N&fhe&Hs35WUnGG?;XApbS8hj z@4|1Ee9e#NsR;>JPv?@1zjwGcR&mwtPx#%>Q%QTnoT!Ks6B8p>UDSczjBdhbA??o1 zn>P&_>5o3u)rk$xb|!2r)NmcVy`_;W_Qhu4-K8Q?7@)o)81U8B);74~dwOhu;x(9A3O>G(qC9NDo5Ey3{`Ev(M&?<4e*UfN zQWsI>L>*O!*ii0HOhzjl24B8>*{)&3B37!yUgf=MmaJ89D*BIYmX!S^CN0ZG4g`%Z zL`@q(nRS3=o*}sOJh#_@lAN&_A%L=dW;J|RpU`7Pi20)1gQkVY2=j)mz5OdULu@xY zn5AUMLs+?}XKo_vi;Ih?ad)lizAg>sS$p-}{KTIT>kN;mwm$(g<=b&e0|Ns?#sRz6P~pu7b%GP# zEs3vQxj$JsbFOV4WK$D7Pfku=9?VlMfSX)h)W$OIw^6^>-rnBV_f~kD&H&~5&&{4{ z6+Cz&=JVO-cyG-B^@k6p+u!xt4RvX0>4ml^a=KK!w4gC11%*S~p^uL$_s8$$s?yNV z>`eG=4Al8-Q@d7=y&JHR_$oy6ce%^k0B8B8gv43o@bIwUWYBp)=jndghBeWBJG?_ZFWm8G?Da0t*YM$ygI809);0lqq)+Vox@D$uSC^W9v9 z0^iRSxJjr4r{j0;-c!F<6KeH}u&)GVX1-@(VFK-~t#4Ho6-6lN=o-bLfSg|_A(Nub zJ0IZTU6;ggY>JDC33w7gJ7`<(qAGdH&rccSzBSt^udMuR+;RV{ZuOThq%10LONNJr zJOX!zv>B4RU?mi2?3vkgSIJ8dOinP3(N@g)@d>qZm0Ly5N$!UXp_D46L`LJ+$;qH} zc_u|IwnQ5{yC_T(Vj`kX11q}@dWCze!Gnlc?Y0cVLp>cG9TxySh;?GzyZ7&z9PZs~ zF^g(*eZHbc!IhYrnhNkIbHVqH<@>hQ)^z)-hf%%0LA%j-E&)YY7dAV`Fp*wwro3oh@0{FfwwYjC z?wi)w81yq>e>_j;vjx5r)IRg!z<>bpOSEDU^?v($4ae)Eh0P`hH90wRdB~fNPk3P% z+)9O7jbt=5hPUG74V02NJsMzjai9C1ND>fUsaN>LYr{ydF;M(Ly4XmrCfhF5fa3%I zGd5(k;g2Ey2-nx*E?#l$olQdCql_U)TI0Woos%>Da^_hn@8hHURRzU8O9SW{CY zmUPe7&Tji;Vr)zq)-0vAUm*l|f@aer(|fyB3jqGMHdc7)Bzwh?*V$ z8=;_}b0LWgy2s^uPdUhxGCM5@E=RR-77VfNZEy2^v*0b1VHf}?NfyPFy}6! zkML)9*xYGRW-@ZAW--3w5_e#heAfiS#GjH7nHkhUC^FhHn-2KNkoLS%gj*s8CwTKQ zI})vG{(rLxh3NgNy|rShJVxr_R&MjKfZYMYQq}){S51r6SA)r#7zM}9zU_{Z$NAjv ze()=wL@o&@_-gPqDZF4$L>+mzB6;0P+K)0AAJvY$MFmk}oUkO_=jqnr&EEf396IVs zVP(I2LTa*c7OlE`_Rm*eN|bcd#Od`6Cd?9?;N%tQ;pNfVO{ImF0iZvdh$A_grzWxsj!| z2Pv+P%K{CtJGn)C>t3g ziwZ3|SMjV(V<#hofA#`Yx`kSwN9^HmCZ#$im7_i|i#MEw4pj0qU?DB{tfjdU`Cf^g ztP;zH{#^lCRL+DAzd+UaIvG+Z&U`_xxD1sVfpHm29;(2?_SHm1%a3ZT(SJ6*O)rJt zvn?G?B!ll$2XB(b1%1zw#3mZ=%ZMZWU_zX{ar) ztQZ1|;4!ZACb@X=qAT!_LIcj?x$Q&p9p8X_l|0c4nV3@IsNJ~S&C9_{$PX+`%v>C7 zYztV1-^0w|20|;ZpfLR)Rp7zPSFfJU&RQ_BurLY;yk7C`$XQ;t)zs9S`jMkl<-T+U z0I&6JE-scd6&6jlMD0-N>6=fRo!c#V0|=+Yf_aPVXz?e=kWi@`$>fxjzU09tfZX#5 z$=Gc);2G}hxa)ecsH&*Q?u*>vt6?XLVj;bD?V6C^-lzPsGL8KqZR1eT3$`zX&!|~j zFWg0LRtfYA7CF-dqvxVnjI3L6vq{yxyunZlYwKD90s!^E z00I&6KPZ`7DQ+aYmH1r%-d9{~RDVQVHsVhzbqD2f$>I|hw-Q_8e1Yc29KAwMD=Deq z8(dtfbtcW2fv_te`5jf%R!nK4UY7uf2nC*0t^A#C@qF4m1s9wHrSEvn^Oyw5t1jA< zH75xco}QkT99VL{4H*9cK;vat2~1%>{FFTu{C&gkWKU!`SaWTIu=x`hUQ{faQG z^)v;LlM7EHNw4rs?!ki|QI))HV}l`nGmOgwp=H1Zc4Xw_I-XZm2`w!T6|{whhJuPg zna`Yz|GuGtR@7^~RgNyeqPU=-?AzSd`0nm*5T=^QYmYHUWcKdeyN#~3<8gBL?|0Jr zF48x`(UsruKbCoJ?tc$BiRaqyP+;P3;Hw*m+c+Rw)O4F%-}65+Gm}a3OtD@QJ{>M| z->;b^$E!VhbU)~zg>IE0{u{})YrC{{Ykn(yR^10utfV!@ertD%jBi^#@dJ)NCPv#Q z?(q8yhrzzz`<$H9_>P%@_86+_Ktl?;?XQGfm!WL2Ff*S`@@yQ~mLD}flg`=(0Ccl* zv}f0@`G7TVP@zw3J6eh9iZGyqv&PcJV}eA*N2lF&)4iyW*$6${puB-b$7B$tpj&=glNDK|9o%S%Fgz-{zufxx$xNG z7-?|rdd=<1oE*!^6h3RxN^ORg=!VCGxl51OhQ#G!sc+HtZu_m7DJm)+Nn(bW6bpI< zM#^B)#-Z%~Y|A;SUjG;8lwCijFE1~Th>dNS3kWBsYyTQb7@wRR@#4kh?o>hIjG(i_ zi1GlS;>sz!maX#(4lvEgn-;eBKMpNlaI}+cZf=eOgg@H0D>5O~YQ~c$>}K_Ie&e4U zEQ}=88lKVp`}fB`7lM5ByVi?~gakkgnwxc6@KWZlLD5o#2hPaL<@7o+aVSeYpCF6| z36YxmGGcGQ)e#K43;;bwa6EAH&;6rm;vjkS6J!+>Op1s&JM0Tmx3y)11*0FzyIfCC z5AZ-OEm=EMQ4Y$;FNRq)U763i_dTd_S4ajvTXx|gmKGK-IxXIP{>-aaVuAr@HgJzv zTt+0#vB~E$Nx;!k-m8=p1zla;ond{aab9F?Z4En9J9FGo@U-vzgcu60s%WL{dHbAU znbpO$iTY8#jPY8pLDirmjibF$r=^e!w13AMKnGA%QOW)AffWrBQhMeCN3U}!GhdCA zVK^=k39_)5^((I1dLFeBNo@#CEz{9JH&Pn3$-kr>95|`ebW+dkNT8c1?{4 z0TI!AtP7Xa^!2G=q{pr|96K^Fu-&>vpQR>GC19Tk@MPfmwc9pJKXPPb0Ha*PlmZg* ze#rI~6VtN^|Lq4Ki;8k#g1vgpWh^lz1}IuSORb;EsqQWeldS0IXnow^2=pCgU|?8G zYCO3au-QfqtVV2q$-PEmw9&;!&~Z%uw$`V=VgQ0Ra=a!3l3-Y|3Ja%16a`%AoO4A# zSHmjjkk4ghOXVn|mCCfu*~YV##!oOhoGz80-v(MH;uvcQAcf!IH~$+x>sad}kOovh zy#XaQzrH>#BEl%}&{8#=g~8U*kr{bExb)%u`)8VL*M!ql;A%NJb6ZlzaA3L;`OSuZPc#l5f<|Cq!-5a2L@Rs9K zvO9Vf)1_}@qyje>6ucB==B@qxJYWPy7~U}JeLYq+@>B*u(l~aou7mOZ-4b~^5q1qz z9u|_B<)#yd(F%ItwI~OuX?N}I+2Qnp?IvB);B*!OV`QZJ&c0hSsi>&vle$RA$uA&Jf4jZc zWGnUF{9|OT@u8q#dv##Rj@HG+>2_>*pWqb2Y4;X?iJPoLPK z^b-9#iwXSul+I+bA>d#(LG^DFmf!}df`YCWvz~Rjo}LvHD3$lztp3Q2 zclcf^$vH|%f2NwBekd%&K~~3W$)m_PFym0?Bva$Hk9w^5VC;il_6&wT(gXt8i=-sM zDY4fa`eFCNFHLXFbvcWq{i=3b;GpyBpz)fj-Dp@TAKeBS<-?~>tvgGD;bVcOrt}i0 zI~x9nb4eh0wQ(3Hz+1B_D#$pK2vsExnSiB*)xVvH=$MHN+w!Ilb~6q-Ex*Xf{b}{V zl`B_DYz7#ZZr(JV?@qCCbZlqI@aLV{KJb?S5&B7VG!d*YW~WEHK-6UX{l#EfSHOIq z5(APCXBz(M6)9B5sdT^f>bV)T5O#jHao!GPkA#|r0S8L0PdXSOQrw^Bc4T3m2oO!b;t)f=zk2oR2O&9U zYn+kp*kfDUCt3yf)zx2G2Lx~ft-{2@!a%QCHum;1ii+P~^j^`{(7=+EY{Y0hwlCFD z)76b^YLaSgZ5?wzcOKnPvbJWy#%zATf=9LFS@q)08@&L~z1oReMHDol*2$3rpLiU;GkJ*M0NM1nXcT;9@z0|ubHlx zB!`3Qr#o7`AH8nZCwX3X42oC~4+T-ir9I*FL@@x>+!RF8p0u=9V!V_wYWbR;wd0)E z4+hTXee?m%C_%X!<=M*N>0V5g3~J!Kabv1COQP>;aBOUB3lOCha!!L^!k^K9XJcjU zr;2Is7#$srySQ6juNAGYuYdl1X7ja5sz497>l|#8BH-}mE-NW#(Z`R!dEPEey2=$R zGwa(|j_xNxo%Or)lRLUn$Y+ZQ*yaMTW+gCz8mZU)9jonH?FHyyyqzh%X3zIu&d=*+ z9?aZh<>~&wM?vHbKeNM<=oH#D_i{pIfsQm$aW`6ry+ZPIXOOdYymz-$B|7f2Ug6Hp zplSj@{P3_a3BHeMXIe1GCNAS)uPpLx0+pMdZdvRPz`b+# z(-Wyx>Ra6(j@F!ll*DM`a#b_VXi=wUvUT6See*)Yj>5``&yO@Uolo_6uFClM2-oip z>kB~rd>#{XI`hG6cGSOtiJSZHbwrZz;>ASClfNxn0HIntRKK-6PkyNW=us%l?P;!{ z!zdVJ_lc)y3bktS&7J4I$BRweVPs>oO=~kdybIcvf6tpcf8ed210wUUKNb{}x-F>K zPd1DLb+sn|`v;_iQ@QBPwtd;TV5cm#P&Z<;s?L_JEK+TjFyN z8=irVOFln48=MyA;xFnpPxL%0Y7@|W^(8uq)shkWJ(zhKP)UwgJ&zwEAe_&{RGsze zM{BYff`e8%X2ILDw7N=^3QIhCZUl}eDbRFp?sWfx=bzs7o>s*DoA2_^TMxn1OK5C7 zkIc=@t!GYHVr_4JG+%wGDds)m`bu$*0bC&Yf+3YuK5La)uxG$CsxkZi>Q*|TWtmCz zMc^rep`XhEJ%cpa44%wFn#w{J)TN+5ze7J48lXfqC&+^J6|i0~Cv^>ik;F@Lse`oM zh%QTwmG#!GNEj8I4-^%*u%S+bpqbJ4?~1TIdyDw#>ZX)`{`}IKH^o~q=d%JU>1!&Y zFm*WIr6wO_(#3FFo`M)-QAsFx7Vg6i@L=V(R#T8~XVjHv*3J zL9QWhaNnGJ3#4Q9lS>3MA)Wpbk`J@g-bb|ku|Z5>iD|Ve1F~3PY+{lr&d>i7{J{h8 zW553W>)af3_hG>h9wFh=j0~?d?iPE2?CR>nT$SmQg{)_Sh#b*M(A208%p8tv^Q4!2E)Ttn-0N!S$RmT#6 zk00L(YJP%KqE`rLzSFk+>$LNW5qoA3LM!wN-2#o(X+Zqt!YNc-2cnDEnv?{CaHR0y}55}LdI`(wB0E6NZev!j_CCANUsURhc zx=T|&h=9SU&X@5&`^^&_+%uQ_$oHftJV?yKuABc~>oxx`)hBqsjRoNdmUFB+jbEwc zqTPO;oLa)w8qGgcyGN*8VT?n#d5dB0^K&?V9mS zkk%y$iHRHa3x;xUgEbF6qIq>u^3{h7s<&7 zQVtGl6)*}IMMd=iw?}q&D;IT{9jWQ*JqI5bDy7ib5vp;^%-mdCTT^rOPfbzQ)^p@N zsQPzcVQXs$IA${A(O05y0vihOg_WJ74V})TNG;C2$ zGEVUIYxnSxq<`(f7V)L*A~CPH*yNp7O3jn5hVeq436%DFW{IF#viOJ+pKU84>R8~C z4h|geva_9hGGrJ+l$oDOX9a7rwSCepE3xc)P2$j!>M&8K`(eOFiRP*WRt{!*ROK zLwk{NQ+6;4E>qh$AQ3&>eRE;;XXD_w87h4joWUK?B_4t`h=Ys!BLwRLVD1!QlR-Z97y&gi09Y&h6yd2PdVO$E*4ziFvXGV8R1P{np8R*q zcA$%^adnAZMh1vJcCfn$4f^yIa~MEvk&yu@>s4~HyiC1zNQM1~G*JG%?rgYN83vN; zG3|j1rGER4-~0OZ#hid5p5h|noJI5ro#5&lQ#)TjvYYA8y7wNu`{s|u#ULRHzD=q% zMh}B|7vQc8F|rz>lxb>0lzekPDjY^%#K#Y;RKU2pAs|4;mPml885+hwipFmpWyAlX zYYtqO?UV6<*CL_P7*TWcgGbtr9!-xrHHLx#GdAy83-;K+hS>Ax&tD`Y%=oBydU`f? zX#nE^74omQ7&b1hufX!Le%RS>R#w&~hy+F85R%>C=O-l=-?@w?7J+tCdixPBeUIwm zd8aEda2fwkw9f2HMTKuJkg2|j*A4SP`NEHmeETLrYB;U9NIAm| z6im~Z_87Q;7SWBmr^J#cm(LG6BykOliVPe4eYR}6Q7l*`Fh;1wyf2rRqa+^fgMAMX znsHaGn!NS#kN>S5P3276^_rsvvN_I&Tb4p;Dyw7FZmmgKjRKw<6EQ65-k1#Wc<2!c zI%NOIi0~&$<|p`-1pE{L0d>CEkN~yfcAHn`7ZjXHP?fm;*9UxW0OWUNWpRO?mIj{s z!qUqiAwdhlEwE2ucmfB78G27qkpM&u=RWcM=mXvzRQvbD+ndV;#SEOBmw;q}9HCQg zJ5*wujOTx(76Fg~B2Z}J$7-Dm_y>=O2pjoQS(#m0N^J|HDHmLs~mJ zP|iaFd`C5^QuAvs z7sK{UXR=_hS5HBLX7qYv*>3k%B7hP^E`uZwBX(k3=Q3U)oEeyx;gqry;0oa zqRpav&0X<{yhc(wC~3YUpDhJA?M!5cPxmL|#QlWo4~}0rQwGBrHiX$IiYhkVnEiao z%0g`Sr$*IGtf=!snwP8L_e>XwOU~$u3UK?R^2rm-)De3~^jJ~s_==Np84-aYfOh)~ zlK7b3I%4g-dhxY`BDdM7#5|Ww7wp7{Zj{69Da}w{Fh|Q{BxQmf76meXP!e&Iq z)Oag|R6KiujN)cQWWf!k@CFWg`YbE{iP`oZfhH+s=7bj)lOHHUo-3@=g7U<}KHTIh zwp6}my7|AJBH;3}Y@QALtHD4o`c&QuHOoe`WWIcPMGo%O*+BCCvk_eMY0JDvtz-?@ ztZEfJ;-%cq;Lbo0xZK9D7z$N(n1E&X<>ZPf3lHPIhv8`d9vy8==$ca?=Q2{R2StKe zvnpVqFK~~q1FUsPHZHD7emw`}505e((Y0SKd*IU;7?aNmFU3gu)}yC$nTNak>H+xi zVUph5cvpE5!b)PFL_F5n`umwe~OE$XR0M;o5g-COFV5BrO^&dZf-kKS3^!kdM zIl4yfIR9sL)Fk;lRrK z|I?ZLPo!I?N>W6#B;4=*Ec=MUO0%@(ZO7$f?En1pf3ZKEH&hTkL@@n){$F6&|JyT3 zj_*RI7*p6LIF~UqX@W_E7mrlKQu@`%APc)0vdDR-U(U(l{2tKZ5 zSzzT{dDev4FUf;=?6)p#-+>?`k9t18?2XGZRR)~pJysgJg~L*%I;+D=?suiL`hob2 zF~moJTn;t=E<-$c>G#+Yx6n)lm<#H(7Ls&IIqL3{%!x*$Yfj~QrsaA|N7%LF>lI*E zmh0so=lzqbr1s!OwPF5~u84)VG<%7pVdkjkmyfPNsnv^=`O&rhzyN??njF=$`$jd|jz<28T%0Q$ZiqUd)Pdk5LCsTs37%9XfYh| zHg$`hwYM=0Y9t7W-Dz7C1jh?tnUnhBTu zni@)Q5z+1>r(w-AumndSV5g8bi2wA-lQ(TrBo3Su_e^1wpQ^ zzrVj0nXRm>R5dIyxtpq(qn?|W*Ht6x19ZFwm7g*Iey>>8hYug5fZ$gb6exL}9BitA z`b0x=4bp8v)2`LeT^us|ZbQze_3-$3;W7Ukzl*pnG$Lu7OroNrkJQv|q=1s_>guW^ zx35kXg#+*jl!WH#mT(8O77D9R1-vf^?BUNS6K-k@wVp=-6O_TaFb0it)H#N1%lW{o z#fJFN9{?wRL9cm{p5E&b(CvUu75=-(0y>{cj=E27S(#hLkSzzMv+pO{&0M4#pP2YO zQYBA6J~h=&QCV4YVSb(fb_2z=swn3AeW)s|oSf|g*>Y(hp%+4~E#VlFA5Ly=+vkXo z@EZp=N(AmbxNueh@Vg%e2i^k!l~_600U*j?Ct31P+u7T<78%z51y7^R7krU$+3bQY9}Y1-$TR8bPYMal;(*6W0TigzK=#oE#N&7G-nG||T2VtHr~?eIO~@LK ztSm3HgBwYQ8Xj&~aTk%ZxbyfE<_%&3f}_OIwLmd8HpM;Qg@@P3$jm@2G5;yXM*>ow z3988OSA|3B9Pm2k5UIb8V1zPzZw{2bJ2*JlhgmxVnPL}%YS&N-D<;iHj|S+@{$8k+ zXL4OU#Fo8{Lq|*icbbofMm=F)q|PPf}xbmpEQ6oAs=%4&@a4ZSQPOZ_t17!QtD~|n9S-}EE9G;0IXJS zh(vFkqN9Wp+k2*KBL8Mjo&hXHqu&b`?&YZ8i$pcv80>J$y z9v_Z=^7JWrUz%uT)QU%4$j_l65(M%XkQjBXM)QF8Q&T3cLewp97UCJ@Y$ob_7&}zH4vDdJb7ZXF;NfBZP|zoR6wSLPMh}?wcsQTp-^$(>gq-y#5e$pB|**c z_6tc2cad>xU_2p}i42$i9{SJD&hFH#ZTCsa85z-nt6pN&LkaNGZ+)~eNHSMB;mi=Rg#=1J{0`1~1d?9cMk^x3}61!R}aKkYX?xusDN^*P_Y67QXazW!IQ!r87Q0exrWt`)$r5 z4Ka%G3`D=eJ_}6AAE{0a3iinW?x^xX}R%#wO3)%`~dG%tgjxZ=+d~?WDcMz@NU<=4v+1u#YU=J zvTrjm{2{)#cK#ibw6Uq?*K4rUbadnkvKi!dTZrb4w3EZbvQWaK zWf}iFUMo}UwUK*r;@`Io1a#OM0pH1Cye4tIZd>JLrv*58OK2)vatgxN6@t*86B8;j zGLZELlK#!M9JXKpsBH^+*|p$?*Nu&y?Wu4%T3D!Fb3UD=E0GpsG|A^+Jo@$yn+T-B zQw{;$!5oxLA&4H(Leg&0T?Cd@Gzo1ge_Dig9k;)I|1J%RMJ%oOa}XuoL7YTApA-x> zAZM^*AAlVWkznyYm)dcNr6Pz8KP4VECK4>2_4kts%&A>Hj;`L`bvI!PuoR07qacF* z)m~txg;=uHJWf0estVDsz<-*o$PFl~zy%@Y{A9$w9mpf}f;@*XcAwj^-kI_F5h|d9 zF{$gq?)hIb=`6L2L=IFp#QFFJYkQA*WWZd7cpmHR+bs}0FMT}7ygJ!P_u#<;@2yUj z<{87$+izdKd;;9BZyUIz%gI4`y)`TsLP2L@ARPpP1c8OTQoIRdWo*Ts0NP2?#YOzj z3XSI>&GHjP zsoY~Y<*bUC9#DF2;?}L<)jTxeO@W&ZA@JvrbDBQboT&mlt_E5YEUb*cYE|;CLPiFA zpj>GOU<7ISB^qf^!eGdy`)?^g3k!k(j)J>55qRuiKUPHo9Rc?P10{f)scCCpKz@~) zUjQ;B7P8z05eVnSetLrj{}GLr!ZDW)8Z?0SUE8bk-eiEw=LtC4p|3R7(TRXWDyebc z;Y~0hT?S7BIL@7u+}?dl;V}<;+?05mYoPvOzc?u7Xl z16qxOvkHKl471>ud0f0ETMqOK4T68$x#T|ag~}bRHrWobF);Y1WKOA#pS_D1KYntr;OcT zxk`Hd8Un&!A8e=Iu_J>C9gyDW2h6hk*@rpV``e zPVpSwzj>%a&6m^7A@2cwWWu)v1--ud&*NOU;5R&Q^9ug6uR$B+f1$tO$C4I2wXa{l zic!@)y#`WDsM*wAk9c|P7}-JV8{wmY#z%T*@s8G?#LrK**P*VRw3%?9xP7D1WhE6M z!hQN8Ej;{s9IO{$n2tMEDg~R`W8Y5veiKZy-|<{Arm~YKhuaI*t^ zE9hGJ;97RC$;>!ES?~fu$tW=JOui@G^yt2f_u1h>DJWE4+S(|6nCII) zR&G4jI1v0fAqJR~WaJyUB8X%4-Qo?->%|!jhB_)?PH#h$Q`~b*# zWC#Fw{_*a@-&n1J@n@q|t~bd$b}U-k+QhR4mm26uNa&5rtYWH4N?sU#iLFM589^1h z3i4GYr0r6{0?H`SjP&AM0K3FU@=VTCGB}PM@VZF^!0Y zxX1D*F2oT}kD<-te5ceB~^wTbjYC6#+e0*UDqY;-^RGeLv!bfhSc0H+zF{%>z zk;i9eXG{NLa=OJRxo>l>Uh3*s9%M)uzIpX(7GG9c8WXh}s{~U5h}K{CJ&?ogV9xhh z@NT|Rv`kQAWf!C%%E5g)O&z?AG@$95@_S_GCbg8Sl$4aOnwlCJNe*R9`!C3`P64#r zh9*860P}%>UorpZR%)Z*Rw%L)N_+!fiZ`QAl?V?nnJr%a-MFJy^57B?qhD2BxoXdn;=kxfRl}RLEQFPF+}*#H4{!Y=+WzzOpRYUo zMWO#NRu!;K2oWAs=)rTBS}J~s$ykH1?FG5@$I$-bbGS99Q)Fl68x?ZIZ+Z|%dtEilrDl2y%!)7m>4GH;p zAxUkIZg51qMxJiE9aVV2kguU4!X@!r$Pj|z0j00Uw%pbCQv#|O6M~>8_PfhNV#9|l z=ztPhheR8woGX8i5NH^kgyO_8TXV^3wkJ(gn-uaLuevDfBoK&yQjYcr^FVC!ZZS%A z;WKVAG4#23eMXd(K_&-Bhm+Hef|#mVrnTrg&qE;JDsteRQmDXpmr1Pu;dAEIVD%5` z#8UX33LrCn?O<~TU~<2$8Df!A%@#+StIoEWNc3I=k3NoB-EW&XiZX=T$cg_S`zaQD zgWg9pimC^EP?B!g6z!E##gLejAz>Q#@SAL+(c8bJM0=%?|L{tq^%;50R^2c_qPP&( zanISA8`6lguEGG#|1RZaT=Gkoi=%A=03cWLeFAz+pvyC$>zL^ZK0pp=oqn%=3vD%` zS%?kQgd^dxG*v(A)XjIxHMby$rPNBkO7-# zL$+-YWRLBj3!;WPZ;*5+7d;B{3kzws@?=FVa}fj&h5lTC;6B_;s*FB46&01@QHk>t zx7oQldS+%^z;t*0{Aw2(pxMeC=sE`5>!>)k3}U=a3v$fwJ|*bxskG7i5DMVL|wZ z4zdVpQ|3*j*Oy5Kl(_0=mzrc`z%YG>4n?C?l-{?(n!uJpECGH7y-)umvg?HO&wQoi zO^G)0-@FfW0iJ|7O?t$K>gp8ag-YH^WelV{&rEcn!oA$Z?{F2K0Y40n6H4%#M@J8>DAoz=Q-E68z>3CEN(_ z`S`@dP>8xxi~EuSnveli8s-fUF9?Hv{P^+jTIHlP^tq(Z{KL}4K>BU?A=QTpyE0lhkaJie5d?~cmey^BHX z|MxCC6hAl(@5QX}zhiEF7pI5j+MQ*i0|Kd#s){oTDyk@eBIvV+-tMnwr^f?7e?9|x zc|~lZd>XoBNcr#F@k!U#)m_p>sVFPA9&RttLuds?J}m-`Mv(OVcT0FZ);IefR2H>w znUvvsO zrUE6&(-T(DD?M+86J91HEI~@}X1U&j4F4^B5)$#fU*=4SijSc~^9#feq2)Y1X37y# z9hr{`wBVyQAgiwg^AX<9%FNte767RRX^4iTFF+(`SFaDC{zZT|(71BtbSF=e=BMo6 zLb0uHj7(%vw?su#A)&McAA^8Zkp-!JPR>}!4aU~? z5mUxk>2&oM=I7(<6_Np0Pj`q7`3>S5+D8C-@uDHV#@AM5$@H8n3I9;|I~j zSTSdd8d6K{fEmtFy)?BSF1EQK=L2@)+yo<-(o>4>pU~7W;i)hz-ss77zPB{><9_pb zbAFKYLUs;E2&a);hfwk~?#(BPs(5(sBI0KI6(6%KUGuehQk}dXm?6w{^4h6;TZxwS z`ISW?7P{ai_oMp3CHtr8STq@?6gRqDGx?rPXM0D;FpSQ*9zstpt~i0n6=}SPcX-gJ znz@p4#%lEPz2L`>j!)n%s?`R#4+fvmGE!r3KiKZF7dX}{Mz#0^OCHH(4+JYSV}(l7 zFFyQAf*`?0#rqZGjzPT(+o`p+wV54vX)jAdi=ng_Z8*%A9U`2hN>z^Hv~Wue^7r%i3?^jEB}|{)CX1?v_M&2Z`eLEjW^fEo z{fT{aK0YGQzOz-vlWRqc!0%$}_}iQQ&>{$xIpyIvg~m0+K6+`3B8KM?2GZ1?j2kyX zp;3OJikND~S=h>)h@H%oxVimcho+VXm#C?wgeO;@H>HjyuA`5*KD|b~N#Ym9U>7%$ zGxdV~d14R`IeKqHYn~wshg5=g$%N=*|L_Q~(;Y5Pz0^ndE=0A-TW#V@*Vx3Re$0ASF6nxReL|b=eY={qg!CyW{X+@I;7$Xrk7zYxZ`( zibz_+73?f<`Fb}!SpD(nGe0g{mFoB}?;ods$I8Wm3w8OmN@;G0s(h1sN_Kw}r2oKe zU&(o_lBY47O9@O%!!B?6(ifcAyJ{*Nj_>vJ(LcK^jThQaca9&i5Q#LJ!RH|%3inlH Jilj}R{4WuILE8WT diff --git a/release-0.19.0/examples/environment-guide/show-rc.yaml b/release-0.19.0/examples/environment-guide/show-rc.yaml deleted file mode 100644 index 4de94c06ca3..00000000000 --- a/release-0.19.0/examples/environment-guide/show-rc.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: v1 -kind: ReplicationController -metadata: - name: show-rc - labels: - type: show-type -spec: - replicas: 3 - template: - metadata: - labels: - type: show-type - spec: - containers: - - name: show-container - image: gcr.io/google-samples/env-show:1.1 - imagePullPolicy: Always - ports: - - containerPort: 8080 - protocol: TCP - env: - - name: USER_VAR - value: important information - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace diff --git a/release-0.19.0/examples/environment-guide/show-srv.yaml b/release-0.19.0/examples/environment-guide/show-srv.yaml deleted file mode 100644 index 25a2d7473e0..00000000000 --- a/release-0.19.0/examples/environment-guide/show-srv.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: show-srv - labels: - type: show-type -spec: - type: LoadBalancer - ports: - - port: 80 - protocol: TCP - targetPort: 8080 - selector: - type: show-type diff --git a/release-0.19.0/examples/examples_test.go b/release-0.19.0/examples/examples_test.go deleted file mode 100644 index 103d28a6c18..00000000000 --- a/release-0.19.0/examples/examples_test.go +++ /dev/null @@ -1,438 +0,0 @@ -/* -Copyright 2014 The Kubernetes Authors All rights reserved. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package examples_test - -import ( - "fmt" - "io/ioutil" - "os" - "path/filepath" - "regexp" - "strings" - "testing" - - "github.com/GoogleCloudPlatform/kubernetes/pkg/api" - "github.com/GoogleCloudPlatform/kubernetes/pkg/api/latest" - "github.com/GoogleCloudPlatform/kubernetes/pkg/api/validation" - "github.com/GoogleCloudPlatform/kubernetes/pkg/capabilities" - "github.com/GoogleCloudPlatform/kubernetes/pkg/runtime" - "github.com/GoogleCloudPlatform/kubernetes/pkg/util/yaml" - "github.com/golang/glog" -) - -func validateObject(obj runtime.Object) (errors []error) { - switch t := obj.(type) { - case *api.ReplicationController: - if t.Namespace == "" { - t.Namespace = api.NamespaceDefault - } - errors = validation.ValidateReplicationController(t) - case *api.ReplicationControllerList: - for i := range t.Items { - errors = append(errors, validateObject(&t.Items[i])...) - } - case *api.Service: - if t.Namespace == "" { - t.Namespace = api.NamespaceDefault - } - errors = validation.ValidateService(t) - case *api.ServiceList: - for i := range t.Items { - errors = append(errors, validateObject(&t.Items[i])...) - } - case *api.Pod: - if t.Namespace == "" { - t.Namespace = api.NamespaceDefault - } - errors = validation.ValidatePod(t) - case *api.PodList: - for i := range t.Items { - errors = append(errors, validateObject(&t.Items[i])...) - } - case *api.PersistentVolume: - errors = validation.ValidatePersistentVolume(t) - case *api.PersistentVolumeClaim: - if t.Namespace == "" { - t.Namespace = api.NamespaceDefault - } - errors = validation.ValidatePersistentVolumeClaim(t) - case *api.PodTemplate: - if t.Namespace == "" { - t.Namespace = api.NamespaceDefault - } - errors = validation.ValidatePodTemplate(t) - case *api.Endpoints: - if t.Namespace == "" { - t.Namespace = api.NamespaceDefault - } - errors = validation.ValidateEndpoints(t) - case *api.Namespace: - errors = validation.ValidateNamespace(t) - case *api.Secret: - if t.Namespace == "" { - t.Namespace = api.NamespaceDefault - } - errors = validation.ValidateSecret(t) - case *api.LimitRange: - if t.Namespace == "" { - t.Namespace = api.NamespaceDefault - } - errors = validation.ValidateLimitRange(t) - case *api.ResourceQuota: - if t.Namespace == "" { - t.Namespace = api.NamespaceDefault - } - errors = validation.ValidateResourceQuota(t) - default: - return []error{fmt.Errorf("no validation defined for %#v", obj)} - } - return errors -} - -func walkJSONFiles(inDir string, fn func(name, path string, data []byte)) error { - return filepath.Walk(inDir, func(path string, info os.FileInfo, err error) error { - if err != nil { - return err - } - - if info.IsDir() && path != inDir { - return filepath.SkipDir - } - - file := filepath.Base(path) - if ext := filepath.Ext(file); ext == ".json" || ext == ".yaml" { - glog.Infof("Testing %s", path) - data, err := ioutil.ReadFile(path) - if err != nil { - return err - } - name := strings.TrimSuffix(file, ext) - - if ext == ".yaml" { - out, err := yaml.ToJSON(data) - if err != nil { - return fmt.Errorf("%s: %v", path, err) - } - data = out - } - - fn(name, path, data) - } - return nil - }) -} - -func TestExampleObjectSchemas(t *testing.T) { - cases := map[string]map[string]runtime.Object{ - "../cmd/integration": { - "v1beta3-controller": &api.ReplicationController{}, - "v1-controller": &api.ReplicationController{}, - }, - "../examples/guestbook": { - "frontend-controller": &api.ReplicationController{}, - "redis-slave-controller": &api.ReplicationController{}, - "redis-master-controller": &api.ReplicationController{}, - "frontend-service": &api.Service{}, - "redis-master-service": &api.Service{}, - "redis-slave-service": &api.Service{}, - }, - "../examples/guestbook-go": { - "guestbook-controller": &api.ReplicationController{}, - "redis-slave-controller": &api.ReplicationController{}, - "redis-master-controller": &api.ReplicationController{}, - "guestbook-service": &api.Service{}, - "redis-master-service": &api.Service{}, - "redis-slave-service": &api.Service{}, - }, - "../examples/walkthrough": { - "pod1": &api.Pod{}, - "pod2": &api.Pod{}, - "pod-with-http-healthcheck": &api.Pod{}, - "service": &api.Service{}, - "replication-controller": &api.ReplicationController{}, - "podtemplate": &api.PodTemplate{}, - }, - "../examples/update-demo": { - "kitten-rc": &api.ReplicationController{}, - "nautilus-rc": &api.ReplicationController{}, - }, - "../examples/persistent-volumes/volumes": { - "local-01": &api.PersistentVolume{}, - "local-02": &api.PersistentVolume{}, - "gce": &api.PersistentVolume{}, - "nfs": &api.PersistentVolume{}, - }, - "../examples/persistent-volumes/claims": { - "claim-01": &api.PersistentVolumeClaim{}, - "claim-02": &api.PersistentVolumeClaim{}, - "claim-03": &api.PersistentVolumeClaim{}, - }, - "../examples/persistent-volumes/simpletest": { - "namespace": &api.Namespace{}, - "pod": &api.Pod{}, - "service": &api.Service{}, - }, - "../examples/iscsi": { - "iscsi": &api.Pod{}, - }, - "../examples/glusterfs": { - "glusterfs-pod": &api.Pod{}, - "glusterfs-endpoints": &api.Endpoints{}, - }, - "../examples/liveness": { - "exec-liveness": &api.Pod{}, - "http-liveness": &api.Pod{}, - }, - "../examples": { - "pod": &api.Pod{}, - "replication": &api.ReplicationController{}, - }, - "../examples/rbd/secret": { - "ceph-secret": &api.Secret{}, - }, - "../examples/rbd/v1beta3": { - "rbd": &api.Pod{}, - "rbd-with-secret": &api.Pod{}, - }, - "../examples/cassandra": { - "cassandra-controller": &api.ReplicationController{}, - "cassandra-service": &api.Service{}, - "cassandra": &api.Pod{}, - }, - "../examples/celery-rabbitmq": { - "celery-controller": &api.ReplicationController{}, - "flower-controller": &api.ReplicationController{}, - "rabbitmq-controller": &api.ReplicationController{}, - "rabbitmq-service": &api.Service{}, - }, - "../examples/cluster-dns": { - "dns-backend-rc": &api.ReplicationController{}, - "dns-backend-service": &api.Service{}, - "dns-frontend-pod": &api.Pod{}, - "namespace-dev": &api.Namespace{}, - "namespace-prod": &api.Namespace{}, - }, - "../examples/downward-api": { - "dapi-pod": &api.Pod{}, - }, - "../examples/elasticsearch": { - "apiserver-secret": nil, - "music-rc": &api.ReplicationController{}, - "music-service": &api.Service{}, - }, - "../examples/explorer": { - "pod": &api.Pod{}, - }, - "../examples/hazelcast": { - "hazelcast-controller": &api.ReplicationController{}, - "hazelcast-service": &api.Service{}, - }, - "../examples/kubernetes-namespaces": { - "namespace-dev": &api.Namespace{}, - "namespace-prod": &api.Namespace{}, - }, - "../examples/limitrange": { - "invalid-pod": &api.Pod{}, - "limit-range": &api.LimitRange{}, - "valid-pod": &api.Pod{}, - }, - "../examples/logging-demo": { - "synthetic_0_25lps": &api.Pod{}, - "synthetic_10lps": &api.Pod{}, - }, - "../examples/meteor": { - "meteor-controller": &api.ReplicationController{}, - "meteor-service": &api.Service{}, - "mongo-pod": &api.Pod{}, - "mongo-service": &api.Service{}, - }, - "../examples/mysql-wordpress-pd": { - "mysql-service": &api.Service{}, - "mysql": &api.Pod{}, - "wordpress-service": &api.Service{}, - "wordpress": &api.Pod{}, - }, - "../examples/nfs": { - "nfs-server-pod": &api.Pod{}, - "nfs-server-service": &api.Service{}, - "nfs-web-pod": &api.Pod{}, - }, - "../examples/node-selection": { - "pod": &api.Pod{}, - }, - "../examples/openshift-origin": { - "openshift-controller": &api.ReplicationController{}, - "openshift-service": &api.Service{}, - }, - "../examples/phabricator": { - "authenticator-controller": &api.ReplicationController{}, - "phabricator-controller": &api.ReplicationController{}, - "phabricator-service": &api.Service{}, - }, - "../examples/redis": { - "redis-controller": &api.ReplicationController{}, - "redis-master": &api.Pod{}, - "redis-proxy": &api.Pod{}, - "redis-sentinel-controller": &api.ReplicationController{}, - "redis-sentinel-service": &api.Service{}, - }, - "../examples/resourcequota": { - "namespace": &api.Namespace{}, - "limits": &api.LimitRange{}, - "quota": &api.ResourceQuota{}, - }, - "../examples/rethinkdb": { - "admin-pod": &api.Pod{}, - "admin-service": &api.Service{}, - "driver-service": &api.Service{}, - "rc": &api.ReplicationController{}, - }, - "../examples/secrets": { - "secret-pod": &api.Pod{}, - "secret": &api.Secret{}, - }, - "../examples/spark": { - "spark-master-service": &api.Service{}, - "spark-master": &api.Pod{}, - "spark-worker-controller": &api.ReplicationController{}, - }, - "../examples/storm": { - "storm-nimbus-service": &api.Service{}, - "storm-nimbus": &api.Pod{}, - "storm-worker-controller": &api.ReplicationController{}, - "zookeeper-service": &api.Service{}, - "zookeeper": &api.Pod{}, - }, - } - - capabilities.SetForTests(capabilities.Capabilities{ - AllowPrivileged: true, - }) - - for path, expected := range cases { - tested := 0 - err := walkJSONFiles(path, func(name, path string, data []byte) { - expectedType, found := expected[name] - if !found { - t.Errorf("%s: %s does not have a test case defined", path, name) - return - } - tested++ - if expectedType == nil { - t.Logf("skipping : %s/%s\n", path, name) - return - } - if err := latest.Codec.DecodeInto(data, expectedType); err != nil { - t.Errorf("%s did not decode correctly: %v\n%s", path, err, string(data)) - return - } - if errors := validateObject(expectedType); len(errors) > 0 { - t.Errorf("%s did not validate correctly: %v", path, errors) - } - }) - if err != nil { - t.Errorf("Expected no error, Got %v", err) - } - if tested != len(expected) { - t.Errorf("Expected %d examples, Got %d", len(expected), tested) - } - } -} - -// This regex is tricky, but it works. For future me, here is the decode: -// -// Flags: (?ms) = multiline match, allow . to match \n -// 1) Look for a line that starts with ``` (a markdown code block) -// 2) (?: ... ) = non-capturing group -// 3) (P) = capture group as "name" -// 4) Look for #1 followed by either: -// 4a) "yaml" followed by any word-characters followed by a newline (e.g. ```yamlfoo\n) -// 4b) "any word-characters followed by a newline (e.g. ```json\n) -// 5) Look for either: -// 5a) #4a followed by one or more characters (non-greedy) -// 5b) #4b followed by { followed by one or more characters (non-greedy) followed by } -// 6) Look for #5 followed by a newline followed by ``` (end of the code block) -// -// This could probably be simplified, but is already too delicate. Before any -// real changes, we should have a testscase that just tests this regex. -var sampleRegexp = regexp.MustCompile("(?ms)^```(?:(?Pyaml)\\w*\\n(?P.+?)|\\w*\\n(?P\\{.+?\\}))\\n^```") -var subsetRegexp = regexp.MustCompile("(?ms)\\.{3}") - -func TestReadme(t *testing.T) { - paths := []struct { - file string - expectedType []runtime.Object - }{ - {"../README.md", []runtime.Object{&api.Pod{}}}, - {"../examples/walkthrough/README.md", []runtime.Object{&api.Pod{}}}, - {"../examples/iscsi/README.md", []runtime.Object{&api.Pod{}}}, - {"../examples/simple-yaml.md", []runtime.Object{&api.Pod{}, &api.ReplicationController{}}}, - } - - for _, path := range paths { - data, err := ioutil.ReadFile(path.file) - if err != nil { - t.Errorf("Unable to read file %s: %v", path, err) - continue - } - - matches := sampleRegexp.FindAllStringSubmatch(string(data), -1) - if matches == nil { - continue - } - ix := 0 - for _, match := range matches { - var content, subtype string - for i, name := range sampleRegexp.SubexpNames() { - if name == "type" { - subtype = match[i] - } - if name == "content" && match[i] != "" { - content = match[i] - } - } - if subtype == "yaml" && subsetRegexp.FindString(content) != "" { - t.Logf("skipping (%s): \n%s", subtype, content) - continue - } - - var expectedType runtime.Object - if len(path.expectedType) == 1 { - expectedType = path.expectedType[0] - } else { - expectedType = path.expectedType[ix] - ix++ - } - json, err := yaml.ToJSON([]byte(content)) - if err != nil { - t.Errorf("%s could not be converted to JSON: %v\n%s", path, err, string(content)) - } - if err := latest.Codec.DecodeInto(json, expectedType); err != nil { - t.Errorf("%s did not decode correctly: %v\n%s", path, err, string(content)) - continue - } - if errors := validateObject(expectedType); len(errors) > 0 { - t.Errorf("%s did not validate correctly: %v", path, errors) - } - _, err = latest.Codec.Encode(expectedType) - if err != nil { - t.Errorf("Could not encode object: %v", err) - continue - } - } - } -} diff --git a/release-0.19.0/examples/explorer/Dockerfile b/release-0.19.0/examples/explorer/Dockerfile deleted file mode 100644 index e6545402f20..00000000000 --- a/release-0.19.0/examples/explorer/Dockerfile +++ /dev/null @@ -1,20 +0,0 @@ -# Copyright 2015 The Kubernetes Authors. All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -FROM scratch -MAINTAINER Daniel Smith -ADD explorer explorer -ADD README.md README.md -EXPOSE 8080 -ENTRYPOINT ["/explorer"] diff --git a/release-0.19.0/examples/explorer/Makefile b/release-0.19.0/examples/explorer/Makefile deleted file mode 100644 index bbccac4e36b..00000000000 --- a/release-0.19.0/examples/explorer/Makefile +++ /dev/null @@ -1,16 +0,0 @@ -all: push - -# Keep this one version ahead, so no one accidentally blows away the latest published version. -TAG = 1.1 - -explorer: explorer.go - CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -ldflags '-w' ./explorer.go - -container: explorer - docker build -t gcr.io/google_containers/explorer:$(TAG) . - -push: container - gcloud preview docker push gcr.io/google_containers/explorer:$(TAG) - -clean: - rm -f explorer diff --git a/release-0.19.0/examples/explorer/README.md b/release-0.19.0/examples/explorer/README.md deleted file mode 100644 index dac1f3b73dc..00000000000 --- a/release-0.19.0/examples/explorer/README.md +++ /dev/null @@ -1,133 +0,0 @@ -### explorer - -Explorer is a little container for examining the runtime environment kubernetes produces for your pods. - -The intended use is to substitute gcr.io/google_containers/explorer for your intended container, and then visit it via the proxy. - -Currently, you can look at: - * The environment variables to make sure kubernetes is doing what you expect. - * The filesystem to make sure the mounted volumes and files are also what you expect. - * Perform DNS lookups, to see how DNS works. - -`pod.json` is supplied as an example. You can control the port it serves on with the -port flag. - -Example from command line (the DNS lookup looks better from a web browser): -``` -$ kubectl create -f pod.json -$ kubectl proxy & -Starting to serve on localhost:8001 - -$ curl localhost:8001/api/v1beta3/proxy/namespaces/default/pods/explorer:8080/vars/ -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin -HOSTNAME=explorer -KIBANA_LOGGING_PORT_5601_TCP_PORT=5601 -KUBERNETES_SERVICE_HOST=10.0.0.2 -MONITORING_GRAFANA_PORT_80_TCP_PROTO=tcp -MONITORING_INFLUXDB_UI_PORT_80_TCP_PROTO=tcp -KIBANA_LOGGING_SERVICE_PORT=5601 -MONITORING_HEAPSTER_PORT_80_TCP_PORT=80 -MONITORING_INFLUXDB_UI_PORT_80_TCP_PORT=80 -KIBANA_LOGGING_SERVICE_HOST=10.0.204.206 -KIBANA_LOGGING_PORT_5601_TCP=tcp://10.0.204.206:5601 -KUBERNETES_PORT=tcp://10.0.0.2:443 -MONITORING_INFLUXDB_PORT=tcp://10.0.2.30:80 -MONITORING_INFLUXDB_PORT_80_TCP_PROTO=tcp -MONITORING_INFLUXDB_UI_PORT=tcp://10.0.36.78:80 -KUBE_DNS_PORT_53_UDP=udp://10.0.0.10:53 -MONITORING_INFLUXDB_SERVICE_HOST=10.0.2.30 -ELASTICSEARCH_LOGGING_PORT=tcp://10.0.48.200:9200 -ELASTICSEARCH_LOGGING_PORT_9200_TCP_PORT=9200 -KUBERNETES_PORT_443_TCP=tcp://10.0.0.2:443 -ELASTICSEARCH_LOGGING_PORT_9200_TCP_PROTO=tcp -KIBANA_LOGGING_PORT_5601_TCP_ADDR=10.0.204.206 -KUBE_DNS_PORT_53_UDP_ADDR=10.0.0.10 -MONITORING_HEAPSTER_PORT_80_TCP_PROTO=tcp -MONITORING_INFLUXDB_PORT_80_TCP_ADDR=10.0.2.30 -KIBANA_LOGGING_PORT=tcp://10.0.204.206:5601 -MONITORING_GRAFANA_SERVICE_PORT=80 -MONITORING_HEAPSTER_SERVICE_PORT=80 -MONITORING_HEAPSTER_PORT_80_TCP=tcp://10.0.150.238:80 -ELASTICSEARCH_LOGGING_PORT_9200_TCP=tcp://10.0.48.200:9200 -ELASTICSEARCH_LOGGING_PORT_9200_TCP_ADDR=10.0.48.200 -MONITORING_GRAFANA_PORT_80_TCP_PORT=80 -MONITORING_HEAPSTER_PORT=tcp://10.0.150.238:80 -MONITORING_INFLUXDB_PORT_80_TCP=tcp://10.0.2.30:80 -KUBE_DNS_SERVICE_PORT=53 -KUBE_DNS_PORT_53_UDP_PORT=53 -MONITORING_GRAFANA_PORT_80_TCP_ADDR=10.0.100.174 -MONITORING_INFLUXDB_UI_SERVICE_HOST=10.0.36.78 -KIBANA_LOGGING_PORT_5601_TCP_PROTO=tcp -MONITORING_GRAFANA_PORT=tcp://10.0.100.174:80 -MONITORING_INFLUXDB_UI_PORT_80_TCP_ADDR=10.0.36.78 -KUBE_DNS_SERVICE_HOST=10.0.0.10 -KUBERNETES_PORT_443_TCP_PORT=443 -MONITORING_HEAPSTER_PORT_80_TCP_ADDR=10.0.150.238 -MONITORING_INFLUXDB_UI_SERVICE_PORT=80 -KUBE_DNS_PORT=udp://10.0.0.10:53 -ELASTICSEARCH_LOGGING_SERVICE_HOST=10.0.48.200 -KUBERNETES_SERVICE_PORT=443 -MONITORING_HEAPSTER_SERVICE_HOST=10.0.150.238 -MONITORING_INFLUXDB_SERVICE_PORT=80 -MONITORING_INFLUXDB_PORT_80_TCP_PORT=80 -KUBE_DNS_PORT_53_UDP_PROTO=udp -MONITORING_GRAFANA_PORT_80_TCP=tcp://10.0.100.174:80 -ELASTICSEARCH_LOGGING_SERVICE_PORT=9200 -MONITORING_GRAFANA_SERVICE_HOST=10.0.100.174 -MONITORING_INFLUXDB_UI_PORT_80_TCP=tcp://10.0.36.78:80 -KUBERNETES_PORT_443_TCP_PROTO=tcp -KUBERNETES_PORT_443_TCP_ADDR=10.0.0.2 -HOME=/ - -$ curl localhost:8001/api/v1beta3/proxy/namespaces/default/pods/explorer:8080/fs/ -mount/ -var/ -.dockerenv -etc/ -dev/ -proc/ -.dockerinit -sys/ -README.md -explorer - -$ curl localhost:8001/api/v1beta3/proxy/namespaces/default/pods/explorer:8080/dns?q=elasticsearch-logging - -
    - - -
    -

    LookupNS(elasticsearch-logging):
-Result: ([]*net.NS)
-Error: <*>lookup elasticsearch-logging: no such host
-
-LookupTXT(elasticsearch-logging):
-Result: ([]string)
-Error: <*>lookup elasticsearch-logging: no such host
-
-LookupSRV("", "", elasticsearch-logging):
-cname: elasticsearch-logging.default.cluster.local.
-Result: ([]*net.SRV)[<*>{Target:(string)elasticsearch-logging.default.cluster.local. Port:(uint16)9200 Priority:(uint16)10 Weight:(uint16)100}]
-Error: 
-
-LookupHost(elasticsearch-logging):
-Result: ([]string)[10.0.60.245]
-Error: 
-
-LookupIP(elasticsearch-logging):
-Result: ([]net.IP)[10.0.60.245]
-Error: 
-
-LookupMX(elasticsearch-logging):
-Result: ([]*net.MX)
-Error: <*>lookup elasticsearch-logging: no such host
-
-
    - - -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/explorer/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/explorer/README.md?pixel)]() diff --git a/release-0.19.0/examples/explorer/explorer.go b/release-0.19.0/examples/explorer/explorer.go deleted file mode 100644 index e10dfc925c9..00000000000 --- a/release-0.19.0/examples/explorer/explorer.go +++ /dev/null @@ -1,122 +0,0 @@ -/* -Copyright 2015 The Kubernetes Authors All rights reserved. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// A tiny web server for viewing the environment kubernetes creates for your -// containers. It exposes the filesystem and environment variables via http -// server. -package main - -import ( - "flag" - "fmt" - "log" - "net" - "net/http" - "os" - - "github.com/davecgh/go-spew/spew" -) - -var ( - port = flag.Int("port", 8080, "Port number to serve at.") -) - -func main() { - flag.Parse() - hostname, err := os.Hostname() - if err != nil { - log.Fatalf("Error getting hostname: %v", err) - } - - links := []struct { - link, desc string - }{ - {"/fs/", "Complete file system as seen by this container."}, - {"/vars/", "Environment variables as seen by this container."}, - {"/hostname/", "Hostname as seen by this container."}, - {"/dns?q=google.com", "Explore DNS records seen by this container."}, - {"/quit", "Cause this container to exit."}, - } - - http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { - fmt.Fprintf(w, " Kubernetes environment explorer

    ") - for _, v := range links { - fmt.Fprintf(w, `    %v: %v
    `, v.link, v.link, v.desc) - } - }) - - http.Handle("/fs/", http.StripPrefix("/fs/", http.FileServer(http.Dir("/")))) - http.HandleFunc("/vars/", func(w http.ResponseWriter, r *http.Request) { - for _, v := range os.Environ() { - fmt.Fprintf(w, "%v\n", v) - } - }) - http.HandleFunc("/hostname/", func(w http.ResponseWriter, r *http.Request) { - fmt.Fprintf(w, hostname) - }) - http.HandleFunc("/quit", func(w http.ResponseWriter, r *http.Request) { - os.Exit(0) - }) - http.HandleFunc("/dns", dns) - - go log.Fatal(http.ListenAndServe(fmt.Sprintf("0.0.0.0:%d", *port), nil)) - - select {} -} - -func dns(w http.ResponseWriter, r *http.Request) { - q := r.URL.Query().Get("q") - // Note that the below is NOT safe from input attacks, but that's OK - // because this is just for debugging. - fmt.Fprintf(w, ` -
    - - -
    -

    `, q)
-	{
-		res, err := net.LookupNS(q)
-		spew.Fprintf(w, "LookupNS(%v):\nResult: %#v\nError: %v\n\n", q, res, err)
-	}
-	{
-		res, err := net.LookupTXT(q)
-		spew.Fprintf(w, "LookupTXT(%v):\nResult: %#v\nError: %v\n\n", q, res, err)
-	}
-	{
-		cname, res, err := net.LookupSRV("", "", q)
-		spew.Fprintf(w, `LookupSRV("", "", %v):
-cname: %v
-Result: %#v
-Error: %v
-
-`, q, cname, res, err)
-	}
-	{
-		res, err := net.LookupHost(q)
-		spew.Fprintf(w, "LookupHost(%v):\nResult: %#v\nError: %v\n\n", q, res, err)
-	}
-	{
-		res, err := net.LookupIP(q)
-		spew.Fprintf(w, "LookupIP(%v):\nResult: %#v\nError: %v\n\n", q, res, err)
-	}
-	{
-		res, err := net.LookupMX(q)
-		spew.Fprintf(w, "LookupMX(%v):\nResult: %#v\nError: %v\n\n", q, res, err)
-	}
-	fmt.Fprintf(w, `
    - -`) -} diff --git a/release-0.19.0/examples/explorer/pod.json b/release-0.19.0/examples/explorer/pod.json deleted file mode 100644 index 99e68332255..00000000000 --- a/release-0.19.0/examples/explorer/pod.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "kind": "Pod", - "apiVersion": "v1beta3", - "metadata": { - "name": "explorer" - }, - "spec": { - "containers": [ - { - "name": "explorer", - "image": "gcr.io/google_containers/explorer:1.0", - "args": [ - "-port=8080" - ], - "ports": [ - { - "containerPort": 8080, - "protocol": "TCP" - } - ], - "volumeMounts": [ - { - "name": "test-volume", - "mountPath": "/mount/test-volume" - } - ] - } - ], - "volumes": [ - { - "name": "test-volume", - "emptyDir": {} - } - ] - } -} diff --git a/release-0.19.0/examples/glusterfs/README.md b/release-0.19.0/examples/glusterfs/README.md deleted file mode 100644 index 47d758f46c1..00000000000 --- a/release-0.19.0/examples/glusterfs/README.md +++ /dev/null @@ -1,89 +0,0 @@ -## Glusterfs - -[Glusterfs](http://www.gluster.org) is an open source scale-out filesystem. These examples provide information about how to allow containers use Glusterfs volumes. - -The example assumes that you have already set up a Glusterfs server cluster and the Glusterfs client package is installed on all Kubernetes nodes. - -### Prerequisites - -Set up Glusterfs server cluster; install Glusterfs client package on the Kubernetes nodes. ([Guide](https://www.howtoforge.com/high-availability-storage-with-glusterfs-3.2.x-on-debian-wheezy-automatic-file-replication-mirror-across-two-storage-servers)) - -### Create endpoints -Here is a snippet of [glusterfs-endpoints.json](glusterfs-endpoints.json), - -``` - "addresses": [ - { - "IP": "10.240.106.152" - } - ], - "ports": [ - { - "port": 1, - "protocol": "TCP" - } - ] - -``` -The "IP" field should be filled with the address of a node in the Glusterfs server cluster. In this example, it is fine to give any valid value (from 1 to 65535) to the "port" field. - -Create the endpoints, -```shell -$ kubectl create -f examples/glusterfs/glusterfs-endpoints.json -``` - -You can verify that the endpoints are successfully created by running -```shell -$ kubect get endpoints -NAME ENDPOINTS -glusterfs-cluster 10.240.106.152:1,10.240.79.157:1 -``` - -### Create a POD - -The following *volume* spec in [glusterfs-pod.json](glusterfs-pod.json) illustrates a sample configuration. - -```js -{ - "name": "glusterfsvol", - "glusterfs": { - "endpoints": "glusterfs-cluster", - "path": "kube_vol", - "readOnly": true - } -} -``` - -The parameters are explained as the followings. - -- **endpoints** is endpoints name that represents a Gluster cluster configuration. *kubelet* is optimized to avoid mount storm, it will randomly pick one from the endpoints to mount. If this host is unresponsive, the next Gluster host in the endpoints is automatically selected. -- **path** is the Glusterfs volume name. -- **readOnly** is the boolean that sets the mountpoint readOnly or readWrite. - -Create a pod that has a container using Glusterfs volume, -```shell -$ kubectl create -f examples/glusterfs/glusterfs-pod.json -``` -You can verify that the pod is running: - -```shell -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -glusterfs 10.244.2.13 kubernetes-minion-151f/23.236.54.97 Running About a minute - glusterfs kubernetes/pause Running About a minute - -``` - -You may ssh to the host and run 'mount' to see if the Glusterfs volume is mounted, -```shell -$ mount | grep kube_vol -10.240.106.152:kube_vol on /var/lib/kubelet/pods/f164a571-fa68-11e4-ad5c-42010af019b7/volumes/kubernetes.io~glusterfs/glusterfsvol type fuse.glusterfs (rw,relatime,user_id=0,group_id=0,default_permissions,allow_other,max_read=131072) -``` - -You may also run `docker ps` on the host to see the actual container. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/glusterfs/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/glusterfs/README.md?pixel)]() diff --git a/release-0.19.0/examples/glusterfs/glusterfs-endpoints.json b/release-0.19.0/examples/glusterfs/glusterfs-endpoints.json deleted file mode 100644 index 4c5d649e14a..00000000000 --- a/release-0.19.0/examples/glusterfs/glusterfs-endpoints.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "kind": "Endpoints", - "apiVersion": "v1beta3", - "metadata": { - "name": "glusterfs-cluster" - }, - "subsets": [ - { - "addresses": [ - { - "IP": "10.240.106.152" - } - ], - "ports": [ - { - "port": 1, - "protocol": "TCP" - } - ] - }, - { - "addresses": [ - { - "IP": "10.240.79.157" - } - ], - "ports": [ - { - "port": 1, - "protocol": "TCP" - } - ] - } - ] -} diff --git a/release-0.19.0/examples/glusterfs/glusterfs-pod.json b/release-0.19.0/examples/glusterfs/glusterfs-pod.json deleted file mode 100644 index 664a35dc0fa..00000000000 --- a/release-0.19.0/examples/glusterfs/glusterfs-pod.json +++ /dev/null @@ -1,32 +0,0 @@ -{ - "apiVersion": "v1beta3", - "id": "glusterfs", - "kind": "Pod", - "metadata": { - "name": "glusterfs" - }, - "spec": { - "containers": [ - { - "name": "glusterfs", - "image": "kubernetes/pause", - "volumeMounts": [ - { - "mountPath": "/mnt/glusterfs", - "name": "glusterfsvol" - } - ] - } - ], - "volumes": [ - { - "name": "glusterfsvol", - "glusterfs": { - "endpoints": "glusterfs-cluster", - "path": "kube_vol", - "readOnly": true - } - } - ] - } -} \ No newline at end of file diff --git a/release-0.19.0/examples/guestbook-go/README.md b/release-0.19.0/examples/guestbook-go/README.md deleted file mode 100644 index 1c1b5e1af9e..00000000000 --- a/release-0.19.0/examples/guestbook-go/README.md +++ /dev/null @@ -1,212 +0,0 @@ -## GuestBook example - -This example shows how to build a simple multi-tier web application using Kubernetes and Docker. It consists of a web frontend, a redis master for storage and a replicated set of redis slaves. - -### Step Zero: Prerequisites - -This example assumes that you have forked the repository and [turned up a Kubernetes cluster](../../docs/getting-started-guides): - -```shell -$ cd kubernetes -$ hack/dev-build-and-up.sh -``` - -### Step One: Turn up the redis master. - -Use the file `examples/guestbook-go/redis-master-controller.json` to create a [replication controller](../../docs/replication-controller.md) which manages a single [pod](../../docs/pods.md). The pod runs a redis key-value server in a container. Using a replication controller is the preferred way to launch long-running pods, even for 1 replica, so the pod will benefit from self-healing mechanism in kubernetes. - -Create the redis master replication controller in your Kubernetes cluster using the `kubectl` CLI: - -```shell -$ kubectl create -f examples/guestbook-go/redis-master-controller.json -``` - -Once that's up you can list the replication controllers in the cluster: -```shell -$ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -redis-master-controller redis-master gurpartap/redis name=redis,role=master 1 -``` - -List pods in cluster to verify the master is running. You'll see a single redis master pod. It will also display the machine that the pod is running on once it gets placed (may take up to thirty seconds). - -```shell -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -redis-master-y06lj 10.244.3.4 kubernetes-minion-bz1p/104.154.61.231 name=redis,role=master Running 8 seconds - redis-master gurpartap/redis Running 3 seconds -``` - -If you ssh to that machine, you can run `docker ps` to see the actual pod: - -```shell -me@workstation$ gcloud compute ssh --zone us-central1-b kubernetes-minion-bz1p - -me@kubernetes-minion-3:~$ sudo docker ps -CONTAINER ID IMAGE COMMAND CREATED STATUS -d5c458dabe50 gurpartap/redis:latest "/usr/local/bin/redi 5 minutes ago Up 5 minutes -``` - -(Note that initial `docker pull` may take a few minutes, depending on network conditions.) - -### Step Two: Turn up the master service. -A Kubernetes '[service](../../docs/services.md)' is a named load balancer that proxies traffic to one or more containers. The services in a Kubernetes cluster are discoverable inside other containers via environment variables or DNS. Services find the containers to load balance based on pod labels. - -The pod that you created in Step One has the label `name=redis` and `role=master`. The selector field of the service determines which pods will receive the traffic sent to the service. Use the file `examples/guestbook-go/redis-master-service.json` to create the service in the `kubectl` cli: - -```shell -$ kubectl create -f examples/guestbook-go/redis-master-service.json - -$ kubectl get services -NAME LABELS SELECTOR IP(S) PORT(S) -redis-master name=redis,role=master name=redis,role=master 10.0.11.173 6379/TCP -``` - -This will cause all new pods to see the redis master apparently running on $REDIS_MASTER_SERVICE_HOST at port 6379, or running on 'redis-master:6379'. Once created, the service proxy on each node is configured to set up a proxy on the specified port (in this case port 6379). - -### Step Three: Turn up the replicated slave pods. -Although the redis master is a single pod, the redis read slaves are a 'replicated' pod. In Kubernetes, a replication controller is responsible for managing multiple instances of a replicated pod. - -Use the file `examples/guestbook-go/redis-slave-controller.json` to create the replication controller: - -```shell -$ kubectl create -f examples/guestbook-go/redis-slave-controller.json - -$ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -redis-master redis-master gurpartap/redis name=redis,role=master 1 -redis-slave redis-slave gurpartap/redis name=redis,role=slave 2 -``` - -The redis slave configures itself by looking for the redis-master service name:port pair. In particular, the redis slave is started with the following command: - -```shell -redis-server --slaveof redis-master 6379 -``` - -Once that's up you can list the pods in the cluster, to verify that the master and slaves are running: - -```shell -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -redis-master-y06lj 10.244.3.4 kubernetes-minion-bz1p/104.154.61.231 name=redis,role=master Running 5 minutes - redis-master gurpartap/redis Running 5 minutes -redis-slave-3psic 10.244.0.4 kubernetes-minion-mluf/104.197.10.10 name=redis,role=slave Running 38 seconds - redis-slave gurpartap/redis Running 33 seconds -redis-slave-qtigf 10.244.2.4 kubernetes-minion-rcgd/130.211.122.180 name=redis,role=slave Running 38 seconds - redis-slave gurpartap/redis Running 36 seconds -``` - -You will see a single redis master pod and two redis slave pods. - -### Step Four: Create the redis slave service. - -Just like the master, we want to have a service to proxy connections to the read slaves. In this case, in addition to discovery, the slave service provides transparent load balancing to clients. The service specification for the slaves is in `examples/guestbook-go/redis-slave-service.json` - -This time the selector for the service is `name=redis,role=slave`, because that identifies the pods running redis slaves. It may also be helpful to set labels on your service itself--as we've done here--to make it easy to locate them later. - -Now that you have created the service specification, create it in your cluster with the `kubectl` CLI: - -```shell -$ kubectl create -f examples/guestbook-go/redis-slave-service.json - -$ kubectl get services -NAME LABELS SELECTOR IP(S) PORT(S) -redis-master name=redis,role=master name=redis,role=master 10.0.11.173 6379/TCP -redis-slave name=redis,role=slave name=redis,role=slave 10.0.234.24 6379/TCP -``` - -### Step Five: Create the guestbook pod. - -This is a simple Go net/http ([negroni](https://github.com/codegangsta/negroni) based) server that is configured to talk to either the slave or master services depending on whether the request is a read or a write. It exposes a simple JSON interface, and serves a jQuery-Ajax based UX. Like the redis read slaves it is a replicated service instantiated by a replication controller. - -The pod is described in the file `examples/guestbook-go/guestbook-controller.json`. Using this file, you can turn up your guestbook with: - -```shell -$ kubectl create -f examples/guestbook-go/guestbook-controller.json - -$ kubectl get replicationControllers -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -guestbook guestbook kubernetes/guestbook:v2 name=guestbook 3 -redis-master redis-master gurpartap/redis name=redis,role=master 1 -redis-slave redis-slave gurpartap/redis name=redis,role=slave 2 -``` - -Once that's up (it may take ten to thirty seconds to create the pods) you can list the pods in the cluster, to verify that the master, slaves and guestbook frontends are running: - -```shell -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -guestbook-1xzms 10.244.1.6 kubernetes-minion-q6w5/23.236.54.97 name=guestbook Running 40 seconds - guestbook kubernetes/guestbook:v2 Running 35 seconds -guestbook-9ksu4 10.244.0.5 kubernetes-minion-mluf/104.197.10.10 name=guestbook Running 40 seconds - guestbook kubernetes/guestbook:v2 Running 34 seconds -guestbook-lycwm 10.244.1.7 kubernetes-minion-q6w5/23.236.54.97 name=guestbook Running 40 seconds - guestbook kubernetes/guestbook:v2 Running 35 seconds -redis-master-y06lj 10.244.3.4 kubernetes-minion-bz1p/104.154.61.231 name=redis,role=master Running 8 minutes - redis-master gurpartap/redis Running 8 minutes -redis-slave-3psic 10.244.0.4 kubernetes-minion-mluf/104.197.10.10 name=redis,role=slave Running 3 minutes - redis-slave gurpartap/redis Running 3 minutes -redis-slave-qtigf 10.244.2.4 kubernetes-minion-rcgd/130.211.122.180 name=redis,role=slave Running 3 minutes - redis-slave gurpartap/redis Running 3 minutes -``` - -You will see a single redis master pod, two redis slaves, and three guestbook pods. - -### Step Six: Create the guestbook service. - -Just like the others, you want a service to group your guestbook pods. The service specification for the guestbook is in `examples/guestbook-go/guestbook-service.json`. There's a twist this time - because we want it to be externally visible, we set the `createExternalLoadBalancer` flag on the service. - -```shell -$ kubectl create -f examples/guestbook-go/guestbook-service.json - -$ kubectl get services -NAME LABELS SELECTOR IP(S) PORT(S) -guestbook name=guestbook name=guestbook 10.0.114.109 3000/TCP -redis-master name=redis,role=master name=redis,role=master 10.0.11.173 6379/TCP -redis-slave name=redis,role=slave name=redis,role=slave 10.0.234.24 6379/TCP -``` - -To play with the service itself, find the external IP of the load balancer: - -```shell -$ kubectl get services guestbook -o template --template='{{(index .status.loadBalancer.ingress 0).ip}}' -104.154.63.66$ -``` -and then visit port 3000 of that IP address e.g. `http://104.154.63.66:3000`. - -**NOTE:** You may need to open the firewall for port 3000 using the [console][cloud-console] or the `gcloud` tool. The following command will allow traffic from any source to instances tagged `kubernetes-minion`: - -```shell -$ gcloud compute firewall-rules create --allow=tcp:3000 --target-tags=kubernetes-minion kubernetes-minion-3000 -``` - -If you are running Kubernetes locally, you can just visit http://localhost:3000 -For details about limiting traffic to specific sources, see the [GCE firewall documentation][gce-firewall-docs]. - -[cloud-console]: https://console.developer.google.com -[gce-firewall-docs]: https://cloud.google.com/compute/docs/networking#firewalls - -### Step Seven: Cleanup - -You should delete the service which will remove any associated resources that were created e.g. load balancers, forwarding rules and target pools. All the resources (replication controllers and service) can be deleted with a single command: -```shell -$ kubectl delete -f examples/guestbook-go -guestbook-controller -guestbook -redis-master-controller -redis-master -redis-slave-controller -redis-slave -``` - -To turn down a Kubernetes cluster: - -```shell -$ cluster/kube-down.sh -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/guestbook-go/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/guestbook-go/README.md?pixel)]() diff --git a/release-0.19.0/examples/guestbook-go/guestbook-controller.json b/release-0.19.0/examples/guestbook-go/guestbook-controller.json deleted file mode 100644 index bcea604bd54..00000000000 --- a/release-0.19.0/examples/guestbook-go/guestbook-controller.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "kind":"ReplicationController", - "apiVersion":"v1beta3", - "metadata":{ - "name":"guestbook", - "labels":{ - "name":"guestbook" - } - }, - "spec":{ - "replicas":3, - "selector":{ - "name":"guestbook" - }, - "template":{ - "metadata":{ - "labels":{ - "name":"guestbook" - } - }, - "spec":{ - "containers":[ - { - "image":"kubernetes/guestbook:v2", - "name":"guestbook", - "ports":[ - { - "name":"http-server", - "containerPort":3000, - "protocol":"TCP" - } - ] - } - ] - } - } - } -} diff --git a/release-0.19.0/examples/guestbook-go/guestbook-service.json b/release-0.19.0/examples/guestbook-go/guestbook-service.json deleted file mode 100644 index 3359efee25a..00000000000 --- a/release-0.19.0/examples/guestbook-go/guestbook-service.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "kind":"Service", - "apiVersion":"v1beta3", - "metadata":{ - "name":"guestbook", - "labels":{ - "name":"guestbook" - } - }, - "spec":{ - "createExternalLoadBalancer": true, - "ports": [ - { - "port":3000, - "targetPort":"http-server", - "protocol":"TCP" - } - ], - "selector":{ - "name":"guestbook" - } - } -} diff --git a/release-0.19.0/examples/guestbook-go/redis-master-controller.json b/release-0.19.0/examples/guestbook-go/redis-master-controller.json deleted file mode 100644 index 2ca918e7398..00000000000 --- a/release-0.19.0/examples/guestbook-go/redis-master-controller.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "kind":"ReplicationController", - "apiVersion":"v1beta3", - "id":"redis-master", - "metadata":{ - "name":"redis-master", - "labels":{ - "name":"redis", - "role":"master" - } - }, - "spec":{ - "replicas":1, - "selector":{ - "name":"redis", - "role":"master" - }, - "template":{ - "metadata":{ - "labels":{ - "name":"redis", - "role":"master" - } - }, - "spec":{ - "containers":[ - { - "name":"redis-master", - "image":"gurpartap/redis", - "ports":[ - { - "name":"redis-server", - "containerPort":6379, - "protocol":"TCP" - } - ] - } - ] - } - } - } -} diff --git a/release-0.19.0/examples/guestbook-go/redis-master-service.json b/release-0.19.0/examples/guestbook-go/redis-master-service.json deleted file mode 100644 index 5aed7d9ff84..00000000000 --- a/release-0.19.0/examples/guestbook-go/redis-master-service.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "kind":"Service", - "apiVersion":"v1beta3", - "metadata":{ - "name":"redis-master", - "labels":{ - "name":"redis", - "role":"master" - } - }, - "spec":{ - "ports": [ - { - "port":6379, - "targetPort":"redis-server", - "protocol":"TCP" - } - ], - "selector":{ - "name":"redis", - "role":"master" - } - } -} diff --git a/release-0.19.0/examples/guestbook-go/redis-slave-controller.json b/release-0.19.0/examples/guestbook-go/redis-slave-controller.json deleted file mode 100644 index 6fabb700889..00000000000 --- a/release-0.19.0/examples/guestbook-go/redis-slave-controller.json +++ /dev/null @@ -1,47 +0,0 @@ -{ - "kind":"ReplicationController", - "apiVersion":"v1beta3", - "id":"redis-slave", - "metadata":{ - "name":"redis-slave", - "labels":{ - "name":"redis", - "role":"slave" - } - }, - "spec":{ - "replicas":2, - "selector":{ - "name":"redis", - "role":"slave" - }, - "template":{ - "metadata":{ - "labels":{ - "name":"redis", - "role":"slave" - } - }, - "spec":{ - "containers":[ - { - "name":"redis-slave", - "image":"gurpartap/redis", - "command":[ - "sh", - "-c", - "redis-server /etc/redis/redis.conf --slaveof redis-master 6379" - ], - "ports":[ - { - "name":"redis-server", - "containerPort":6379, - "protocol":"TCP" - } - ] - } - ] - } - } - } -} diff --git a/release-0.19.0/examples/guestbook-go/redis-slave-service.json b/release-0.19.0/examples/guestbook-go/redis-slave-service.json deleted file mode 100644 index 2eb1fb4ad04..00000000000 --- a/release-0.19.0/examples/guestbook-go/redis-slave-service.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "kind":"Service", - "apiVersion":"v1beta3", - "metadata":{ - "name":"redis-slave", - "labels":{ - "name":"redis", - "role":"slave" - } - }, - "spec":{ - "ports": [ - { - "port":6379, - "targetPort":"redis-server", - "protocol":"TCP" - } - ], - "selector":{ - "name":"redis", - "role":"slave" - } - } -} diff --git a/release-0.19.0/examples/guestbook/README.md b/release-0.19.0/examples/guestbook/README.md deleted file mode 100644 index 644465add99..00000000000 --- a/release-0.19.0/examples/guestbook/README.md +++ /dev/null @@ -1,549 +0,0 @@ -## GuestBook example - -This example shows how to build a simple, multi-tier web application using Kubernetes and Docker. - -The example consists of: -- A web frontend -- A redis master (for storage and a replicated set of redis slaves) - -The web front end interacts with the redis master via javascript redis API calls. - -### Step Zero: Prerequisites - -This example requires a kubernetes cluster. See the [Getting Started guides](../../docs/getting-started-guides) for how to get started. - -### Step One: Fire up the redis master - -Note: This redis-master is *not* highly available. Making it highly available would be a very interesting, but intricate exercise - redis doesn't actually support multi-master deployments at the time of this writing, so high availability would be a somewhat tricky thing to implement, and might involve periodic serialization to disk, and so on. - -Use (or just create) the file `examples/guestbook/redis-master-controller.json` which describes a single [pod](../../docs/pods.md) running a redis key-value server in a container: - -Note that, although the redis server runs just with a single replica, we use [replication controller](../../docs/replication-controller.md) to enforce that exactly one pod keeps running (e.g. in a event of node going down, the replication controller will ensure that the redis master gets restarted on a healthy node). This could result in data loss. - - -```js -{ - "kind":"ReplicationController", - "apiVersion":"v1beta3", - "metadata":{ - "name":"redis-master", - "labels":{ - "name":"redis-master" - } - }, - "spec":{ - "replicas":1, - "selector":{ - "name":"redis-master" - }, - "template":{ - "metadata":{ - "labels":{ - "name":"redis-master" - } - }, - "spec":{ - "containers":[ - { - "name":"master", - "image":"redis", - "ports":[ - { - "containerPort":6379, - "protocol":"TCP" - } - ] - } - ] - } - } - } -} -``` - -Now, create the redis pod in your Kubernetes cluster by running: - -```shell -$ kubectl create -f examples/guestbook/redis-master-controller.json - -$ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -redis-master master redis name=redis-master 1 -``` - -Once that's up you can list the pods in the cluster, to verify that the master is running: - -```shell -$ kubectl get pods -``` - -You'll see all kubernetes components, most importantly the redis master pod. It will also display the machine that the pod is running on once it gets placed (may take up to thirty seconds): - -```shell -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -redis-master-controller-gb50a 10.244.3.7 master redis kubernetes-minion-7agi.c.hazel-mote-834.internal/104.154.54.203 name=redis-master Running -``` - -If you ssh to that machine, you can run `docker ps` to see the actual pod: - -```shell -me@workstation$ gcloud compute ssh kubernetes-minion-7agi - -me@kubernetes-minion-7agi:~$ sudo docker ps -CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES -0ffef9649265 redis:latest "redis-server /etc/r About a minute ago Up About a minute k8s_redis-master.767aef46_redis-master-controller-gb50a.default.api_4530d7b3-ae5d-11e4-bf77-42010af0d719_579ee964 -``` - -(Note that initial `docker pull` may take a few minutes, depending on network conditions. The pods will be reported as pending while the image is being downloaded.) - -### Step Two: Fire up the master service -A Kubernetes '[service](../../docs/services.md)' is a named load balancer that proxies traffic to *one or more* containers. This is done using the *labels* metadata which we defined in the redis-master pod above. As mentioned, in redis there is only one master, but we nevertheless still want to create a service for it. Why? Because it gives us a deterministic way to route to the single master using an elastic IP. - -The services in a Kubernetes cluster are discoverable inside other containers via environment variables. - -Services find the containers to load balance based on pod labels. - -The pod that you created in Step One has the label `name=redis-master`. The selector field of the service determines *which pods will receive the traffic* sent to the service, and the port and targetPort information defines what port the service proxy will run at. - -Use the file `examples/guestbook/redis-master-service.json`: - -```js -{ - "kind":"Service", - "apiVersion":"v1beta3", - "metadata":{ - "name":"redis-master", - "labels":{ - "name":"redis-master" - } - }, - "spec":{ - "ports": [ - { - "port":6379, - "targetPort":6379, - "protocol":"TCP" - } - ], - "selector":{ - "name":"redis-master" - } - } -} -``` - -to create the service by running: - -```shell -$ kubectl create -f examples/guestbook/redis-master-service.json -redis-master - -$ kubectl get services -NAME LABELS SELECTOR IP PORT -redis-master name=redis-master name=redis-master 10.0.246.242 6379 -``` - -This will cause all pods to see the redis master apparently running on :6379. The traffic flow from slaves to masters can be described in two steps, like so. - -- A *redis slave* will connect to "port" on the *redis master service* -- Traffic will be forwarded from the service "port" (on the service node) to the *targetPort* on the pod which (a node the service listens to). - -Thus, once created, the service proxy on each minion is configured to set up a proxy on the specified port (in this case port 6379). - -### Step Three: Fire up the replicated slave pods -Although the redis master is a single pod, the redis read slaves are a 'replicated' pod. In Kubernetes, a replication controller is responsible for managing multiple instances of a replicated pod. The replication controller will automatically launch new pods if the number of replicas falls (this is quite easy - and fun - to test, just kill the docker processes for your pods at will and watch them come back online on a new node shortly thereafter). - -Use the file `examples/guestbook/redis-slave-controller.json`, which looks like this: - -```js -{ - "kind":"ReplicationController", - "apiVersion":"v1beta3", - "metadata":{ - "name":"redis-slave", - "labels":{ - "name":"redis-slave" - } - }, - "spec":{ - "replicas":2, - "selector":{ - "name":"redis-slave" - }, - "template":{ - "metadata":{ - "labels":{ - "name":"redis-slave" - } - }, - "spec":{ - "containers":[ - { - "name":"slave", - "image":"kubernetes/redis-slave:v2", - "ports":[ - { - "containerPort":6379, - "protocol":"TCP" - } - ] - } - ] - } - } - } -} -``` - -to create the replication controller by running: - -```shell -$ kubectl create -f examples/guestbook/redis-slave-controller.json -redis-slave-controller - -$ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -redis-master master redis name=redis-master 1 -redis-slave slave kubernetes/redis-slave:v2 name=redis-slave 2 -``` - -Once that's up you can list the pods in the cluster, to verify that the master and slaves are running: - -```shell -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -redis-master-controller-gb50a 10.244.3.7 master redis kubernetes-minion-7agi.c.hazel-mote-834.internal/104.154.54.203 name=redis-master Running -redis-slave-controller-182tv 10.244.3.6 slave kubernetes/redis-slave:v2 kubernetes-minion-7agi.c.hazel-mote-834.internal/104.154.54.203 name=redis-slave Running -redis-slave-controller-zwk1b 10.244.2.8 slave kubernetes/redis-slave:v2 kubernetes-minion-3vxa.c.hazel-mote-834.internal/104.154.54.6 name=redis-slave Running -``` - -You will see a single redis master pod and two redis slave pods. - -### Step Four: Create the redis slave service - -Just like the master, we want to have a service to proxy connections to the read slaves. In this case, in addition to discovery, the slave service provides transparent load balancing to web app clients. - -The service specification for the slaves is in `examples/guestbook/redis-slave-service.json`: - -```js -{ - "kind":"Service", - "apiVersion":"v1beta3", - "metadata":{ - "name":"redis-slave", - "labels":{ - "name":"redis-slave" - } - }, - "spec":{ - "ports": [ - { - "port":6379, - "targetPort":6379, - "protocol":"TCP" - } - ], - "selector":{ - "name":"redis-slave" - } - } -} -``` - -This time the selector for the service is `name=redis-slave`, because that identifies the pods running redis slaves. It may also be helpful to set labels on your service itself as we've done here to make it easy to locate them with the `kubectl get services -l "label=value"` command. - -Now that you have created the service specification, create it in your cluster by running: - -```shell -$ kubectl create -f examples/guestbook/redis-slave-service.json -redis-slave - -$ kubectl get services -NAME LABELS SELECTOR IP PORT -redis-master name=redis-master name=redis-master 10.0.246.242 6379 -redis-slave name=redis-slave name=redis-slave 10.0.72.62 6379 -``` - -### Step Five: Create the frontend pod - -This is a simple PHP server that is configured to talk to either the slave or master services depending on whether the request is a read or a write. It exposes a simple AJAX interface, and serves an angular-based UX. Like the redis read slaves it is a replicated service instantiated by a replication controller. - -It can now leverage writes to the load balancing redis-slaves, which can be highly replicated. - -The pod is described in the file `examples/guestbook/frontend-controller.json`: - -```js -{ - "kind":"ReplicationController", - "apiVersion":"v1beta3", - "metadata":{ - "name":"frontend", - "labels":{ - "name":"frontend" - } - }, - "spec":{ - "replicas":3, - "selector":{ - "name":"frontend" - }, - "template":{ - "metadata":{ - "labels":{ - "name":"frontend" - } - }, - "spec":{ - "containers":[ - { - "name":"php-redis", - "image":"kubernetes/example-guestbook-php-redis:v2", - "ports":[ - { - "containerPort":80, - "protocol":"TCP" - } - ] - } - ] - } - } - } -} -``` - -Using this file, you can turn up your frontend with: - -```shell -$ kubectl create -f examples/guestbook/frontend-controller.json -frontend-controller - -$ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -frontend php-redis kubernetes/example-guestbook-php-redis:v2 name=frontend 3 -redis-master master redis name=redis-master 1 -redis-slave slave kubernetes/redis-slave:v2 name=redis-slave 2 -``` - -Once that's up (it may take ten to thirty seconds to create the pods) you can list the pods in the cluster, to verify that the master, slaves and frontends are running: - -```shell -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -frontend-5m1zc 10.244.1.131 php-redis kubernetes/example-guestbook-php-redis:v2 kubernetes-minion-3vxa.c.hazel-mote-834.internal/146.148.71.71 app=frontend,name=frontend,uses=redis-slave,redis-master Running -frontend-ckn42 10.244.2.134 php-redis kubernetes/example-guestbook-php-redis:v2 kubernetes-minion-by92.c.hazel-mote-834.internal/104.154.54.6 app=frontend,name=frontend,uses=redis-slave,redis-master Running -frontend-v5drx 10.244.0.128 php-redis kubernetes/example-guestbook-php-redis:v2 kubernetes-minion-wilb.c.hazel-mote-834.internal/23.236.61.63 app=frontend,name=frontend,uses=redis-slave,redis-master Running -redis-master-gb50a 10.244.3.7 master redis kubernetes-minion-7agi.c.hazel-mote-834.internal/104.154.54.203 name=redis-master Running -redis-slave-182tv 10.244.3.6 slave kubernetes/redis-slave:v2 kubernetes-minion-7agi.c.hazel-mote-834.internal/104.154.54.203 name=redis-slave Running -redis-slave-zwk1b 10.244.2.8 slave kubernetes/redis-slave:v2 kubernetes-minion-3vxa.c.hazel-mote-834.internal/104.154.54.6 name=redis-slave Running -``` - -You will see a single redis master pod, two redis slaves, and three frontend pods. - -The code for the PHP service looks like this: - -```php - 'tcp', - 'host' => 'redis-master', - 'port' => 6379, - ]); - - $client->set($_GET['key'], $_GET['value']); - print('{"message": "Updated"}'); - } else { - $client = new Predis\Client([ - 'scheme' => 'tcp', - 'host' => 'redis-slave', - 'port' => 6379, - ]); - - $value = $client->get($_GET['key']); - print('{"data": "' . $value . '"}'); - } -} else { - phpinfo(); -} ?> -``` - -### Step Six: Create the guestbook service. - -Just like the others, you want a service to group your frontend pods. -The service is described in the file `examples/guestbook/frontend-service.json`: - -```js -{ - "kind":"Service", - "apiVersion":"v1beta3", - "metadata":{ - "name":"frontend", - "labels":{ - "name":"frontend" - } - }, - "spec":{ - "ports": [ - { - "port":80, - "targetPort":80, - "protocol":"TCP" - } - ], - "selector":{ - "name":"frontend" - } - } -} -``` - -When `createExternalLoadBalancer` is specified `"createExternalLoadBalancer":true`, it takes some time for an external IP to show up in `kubectl get services` output. -There should eventually be an internal (10.x.x.x) and an external address assigned to the frontend service. -If running a single node local setup, or single VM, you don't need `createExternalLoadBalancer`, nor do you need `publicIPs`. -Read the *Accessing the guestbook site externally* section below for details and set 10.11.22.33 accordingly (for now, you can -delete these parameters or run this - either way it won't hurt anything to have both parameters the way they are). - -```shell -$ kubectl create -f examples/guestbook/frontend-service.json -frontend - -$ kubectl get services -NAME LABELS SELECTOR IP PORT -frontend name=frontend name=frontend 10.0.93.211 8000 -redis-master name=redis-master name=redis-master 10.0.246.242 6379 -redis-slave name=redis-slave name=redis-slave 10.0.72.62 6379 -``` - -### A few Google Container Engine specifics for playing around with the services. - -In GCE, `kubectl` automatically creates forwarding rule for services with `createExternalLoadBalancer`. - -```shell -$ gcloud compute forwarding-rules list -NAME REGION IP_ADDRESS IP_PROTOCOL TARGET -frontend us-central1 130.211.188.51 TCP us-central1/targetPools/frontend -``` - -You can grab the external IP of the load balancer associated with that rule and visit `http://130.211.188.51:80`. - -In GCE, you also may need to open the firewall for port 80 using the [console][cloud-console] or the `gcloud` tool. The following command will allow traffic from any source to instances tagged `kubernetes-minion`: - -```shell -$ gcloud compute firewall-rules create --allow=tcp:80 --target-tags=kubernetes-minion kubernetes-minion-80 -``` - -For GCE details about limiting traffic to specific sources, see the [GCE firewall documentation][gce-firewall-docs]. - -[cloud-console]: https://console.developer.google.com -[gce-firewall-docs]: https://cloud.google.com/compute/docs/networking#firewalls - -### Accessing the guestbook site externally - -The pods that we have set up are reachable through the frontend service, but you'll notice that 10.0.93.211 (the IP of the frontend service) is unavailable from outside of kubernetes. -Of course, if you are running kubernetes minions locally, this isn't such a big problem - the port binding will allow you to reach the guestbook website at localhost:80... but the beloved **localhost** solution obviously doesn't work in any real world scenario. - -Unless you have access to the `createExternalLoadBalancer` feature (cloud provider specific), you will want to set up a **publicIP on a node**, so that the service can be accessed from outside of the internal kubernetes network. This is quite easy. You simply look at your list of kubelet IP addresses, and update the service file to include a `publicIPs` string, which is mapped to an IP address of any number of your existing kubelets. This will allow all your kubelets to act as external entry points to the service (translation: this will allow you to browse the guestbook site at your kubelet IP address from your browser). - -If you are more advanced in the ops arena, note you can manually get the service IP from looking at the output of `kubectl get pods,services`, and modify your firewall using standard tools and services (firewalld, iptables, selinux) which you are already familar with. - -And of course, finally, if you are running Kubernetes locally, you can just visit http://localhost:80. - -### Step Seven: Cleanup - -If you are in a live kubernetes cluster, you can just kill the pods, using a script such as this (obviously, read through it and make sure you understand it before running it blindly, as it will kill several pods automatically for you). - -```shell -### First, kill services and controllers. -kubectl stop -f examples/guestbook/redis-master-controller.json -kubectl stop -f examples/guestbook/redis-slave-controller.json -kubectl stop -f examples/guestbook/frontend-controller.json -kubectl delete -f examples/guestbook/redis-master-service.json -kubectl delete -f examples/guestbook/redis-slave-service.json -kubectl delete -f examples/guestbook/frontend-service.json -``` - -To completely tear down a Kubernetes cluster, if you ran this from source, you can use - -```shell -$ cluster/kube-down.sh -``` - -### Troubleshooting - -the Guestbook example can fail for a variety of reasons, which makes it an effective test. Lets test the web app simply using *curl*, so we can see whats going on. - -Before we proceed, what are some setup idiosyncracies that might cause the app to fail (or, appear to fail, when merely you have a *cold start* issue. - -- running kubernetes from HEAD, in which case, there may be subtle bugs in the kubernetes core component interactions. -- running kubernetes with security turned on, in such a way that containers are restricted from doing their job. -- starting the kubernetes and not allowing enough time for all services and pods to come online, before doing testing. - - - -To post a message (Note that this call *overwrites* the messages field), so it will be reset to just one entry. - -``` -curl "localhost:8000/index.php?cmd=set&key=messages&value=jay_sais_hi" -``` - -And, to get messages afterwards... - -``` -curl "localhost:8000/index.php?cmd=get&key=messages" -``` - -1) When the *Web page hasn't come up yet*: - -When you go to localhost:8000, you might not see the page at all. Testing it with curl... -```shell - ==> default: curl: (56) Recv failure: Connection reset by peer -``` -This means the web frontend isn't up yet. Specifically, the "reset by peer" message is occurring because you are trying to access the *right port*, but *nothing is bound* to that port yet. Wait a while, possibly about 2 minutes or more, depending on your set up. Also, run a *watch* on docker ps, to see if containers are cycling on and off or not starting. - -```watch -$> watch -n 1 docker ps -``` - -If you run this on a node to which the frontend is assigned, you will eventually see the frontend container turns on. At that point, this basic error will likely go away. - -2) *Temporarily, while waiting for the app to come up* , you might see a few of these: - -```shell -==> default:
    -==> default: Fatal error: Uncaught exception 'Predis\Connection\ConnectionException' with message 'Error while reading line from the server [tcp://10.254.168.69:6379]' in /vendor/predis/predis/lib/Predis/Connection/AbstractConnection.php:141 -``` - -The fix, just go get some coffee. When you come back, there is a good chance the service endpoint will eventually be up. If not, make sure its running and that the redis master / slave docker logs show something like this. - -```shell -$> docker logs 26af6bd5ac12 -... -[9] 20 Feb 23:47:51.015 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128. -[9] 20 Feb 23:47:51.015 * The server is now ready to accept connections on port 6379 -[9] 20 Feb 23:47:52.005 * Connecting to MASTER 10.254.168.69:6379 -[9] 20 Feb 23:47:52.005 * MASTER <-> SLAVE sync started -``` - -3) *When security issues cause redis writes to fail* you may have to run *docker logs* on the redis containers: - -```shell -==> default: Fatal error: Uncaught exception 'Predis\ServerException' with message 'MISCONF Redis is configured to save RDB snapshots, but is currently not able to persist on disk. Commands that may modify the data set are disabled. Please check Redis logs for details about the error.' in /vendor/predis/predis/lib/Predis/Client.php:282" -``` -The fix is to setup SE Linux properly (don't just turn it off). Remember that you can also rebuild this entire app from scratch, using the dockerfiles, and modify while redeploying. Reach out on the mailing list if you need help doing so! - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/guestbook/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/guestbook/README.md?pixel)]() diff --git a/release-0.19.0/examples/guestbook/frontend-controller.json b/release-0.19.0/examples/guestbook/frontend-controller.json deleted file mode 100644 index 8b8119b94cb..00000000000 --- a/release-0.19.0/examples/guestbook/frontend-controller.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "kind":"ReplicationController", - "apiVersion":"v1beta3", - "metadata":{ - "name":"frontend", - "labels":{ - "name":"frontend" - } - }, - "spec":{ - "replicas":3, - "selector":{ - "name":"frontend" - }, - "template":{ - "metadata":{ - "labels":{ - "name":"frontend" - } - }, - "spec":{ - "containers":[ - { - "name":"php-redis", - "image":"kubernetes/example-guestbook-php-redis:v2", - "ports":[ - { - "containerPort":80, - "protocol":"TCP" - } - ] - } - ] - } - } - } -} diff --git a/release-0.19.0/examples/guestbook/frontend-service.json b/release-0.19.0/examples/guestbook/frontend-service.json deleted file mode 100644 index 07e81f9942b..00000000000 --- a/release-0.19.0/examples/guestbook/frontend-service.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "kind":"Service", - "apiVersion":"v1beta3", - "metadata":{ - "name":"frontend", - "labels":{ - "name":"frontend" - } - }, - "spec":{ - "ports": [ - { - "port":80, - "targetPort":80, - "protocol":"TCP" - } - ], - "selector":{ - "name":"frontend" - } - } -} diff --git a/release-0.19.0/examples/guestbook/php-redis/Dockerfile b/release-0.19.0/examples/guestbook/php-redis/Dockerfile deleted file mode 100644 index 3cf7c2cfa20..00000000000 --- a/release-0.19.0/examples/guestbook/php-redis/Dockerfile +++ /dev/null @@ -1,7 +0,0 @@ -FROM brendanburns/php - -ADD index.php /var/www/index.php -ADD controllers.js /var/www/controllers.js -ADD index.html /var/www/index.html - -CMD /run.sh diff --git a/release-0.19.0/examples/guestbook/php-redis/controllers.js b/release-0.19.0/examples/guestbook/php-redis/controllers.js deleted file mode 100644 index 1ea5bdce18f..00000000000 --- a/release-0.19.0/examples/guestbook/php-redis/controllers.js +++ /dev/null @@ -1,29 +0,0 @@ -var redisApp = angular.module('redis', ['ui.bootstrap']); - -/** - * Constructor - */ -function RedisController() {} - -RedisController.prototype.onRedis = function() { - this.scope_.messages.push(this.scope_.msg); - this.scope_.msg = ""; - var value = this.scope_.messages.join(); - this.http_.get("/index.php?cmd=set&key=messages&value=" + value) - .success(angular.bind(this, function(data) { - this.scope_.redisResponse = "Updated."; - })); -}; - -redisApp.controller('RedisCtrl', function ($scope, $http, $location) { - $scope.controller = new RedisController(); - $scope.controller.scope_ = $scope; - $scope.controller.location_ = $location; - $scope.controller.http_ = $http; - - $scope.controller.http_.get("/index.php?cmd=get&key=messages") - .success(function(data) { - console.log(data); - $scope.messages = data.data.split(","); - }); -}); diff --git a/release-0.19.0/examples/guestbook/php-redis/index.html b/release-0.19.0/examples/guestbook/php-redis/index.html deleted file mode 100644 index 81328b4fcd8..00000000000 --- a/release-0.19.0/examples/guestbook/php-redis/index.html +++ /dev/null @@ -1,25 +0,0 @@ - - - Guestbook - - - - - - -
    -

    Guestbook

    -
    -
    -
    - -
    -
    -
    -
    - {{msg}} -
    -
    -
    - - diff --git a/release-0.19.0/examples/guestbook/php-redis/index.php b/release-0.19.0/examples/guestbook/php-redis/index.php deleted file mode 100644 index 18bff077579..00000000000 --- a/release-0.19.0/examples/guestbook/php-redis/index.php +++ /dev/null @@ -1,33 +0,0 @@ - 'tcp', - 'host' => 'redis-master', - 'port' => 6379, - ]); - - $client->set($_GET['key'], $_GET['value']); - print('{"message": "Updated"}'); - } else { - $client = new Predis\Client([ - 'scheme' => 'tcp', - 'host' => 'redis-slave', - 'port' => 6379, - ]); - - $value = $client->get($_GET['key']); - print('{"data": "' . $value . '"}'); - } -} else { - phpinfo(); -} ?> diff --git a/release-0.19.0/examples/guestbook/redis-master-controller.json b/release-0.19.0/examples/guestbook/redis-master-controller.json deleted file mode 100644 index add8ba79904..00000000000 --- a/release-0.19.0/examples/guestbook/redis-master-controller.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "kind":"ReplicationController", - "apiVersion":"v1beta3", - "metadata":{ - "name":"redis-master", - "labels":{ - "name":"redis-master" - } - }, - "spec":{ - "replicas":1, - "selector":{ - "name":"redis-master" - }, - "template":{ - "metadata":{ - "labels":{ - "name":"redis-master" - } - }, - "spec":{ - "containers":[ - { - "name":"master", - "image":"redis", - "ports":[ - { - "containerPort":6379, - "protocol":"TCP" - } - ] - } - ] - } - } - } -} diff --git a/release-0.19.0/examples/guestbook/redis-master-service.json b/release-0.19.0/examples/guestbook/redis-master-service.json deleted file mode 100644 index 101d9ea965c..00000000000 --- a/release-0.19.0/examples/guestbook/redis-master-service.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "kind":"Service", - "apiVersion":"v1beta3", - "metadata":{ - "name":"redis-master", - "labels":{ - "name":"redis-master" - } - }, - "spec":{ - "ports": [ - { - "port":6379, - "targetPort":6379, - "protocol":"TCP" - } - ], - "selector":{ - "name":"redis-master" - } - } -} diff --git a/release-0.19.0/examples/guestbook/redis-slave-controller.json b/release-0.19.0/examples/guestbook/redis-slave-controller.json deleted file mode 100644 index 4a668fe091b..00000000000 --- a/release-0.19.0/examples/guestbook/redis-slave-controller.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "kind":"ReplicationController", - "apiVersion":"v1beta3", - "metadata":{ - "name":"redis-slave", - "labels":{ - "name":"redis-slave" - } - }, - "spec":{ - "replicas":2, - "selector":{ - "name":"redis-slave" - }, - "template":{ - "metadata":{ - "labels":{ - "name":"redis-slave" - } - }, - "spec":{ - "containers":[ - { - "name":"slave", - "image":"kubernetes/redis-slave:v2", - "ports":[ - { - "containerPort":6379, - "protocol":"TCP" - } - ] - } - ] - } - } - } -} diff --git a/release-0.19.0/examples/guestbook/redis-slave-service.json b/release-0.19.0/examples/guestbook/redis-slave-service.json deleted file mode 100644 index 2b866b6f94a..00000000000 --- a/release-0.19.0/examples/guestbook/redis-slave-service.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "kind":"Service", - "apiVersion":"v1beta3", - "metadata":{ - "name":"redis-slave", - "labels":{ - "name":"redis-slave" - } - }, - "spec":{ - "ports": [ - { - "port":6379, - "targetPort":6379, - "protocol":"TCP" - } - ], - "selector":{ - "name":"redis-slave" - } - } -} diff --git a/release-0.19.0/examples/guestbook/redis-slave/Dockerfile b/release-0.19.0/examples/guestbook/redis-slave/Dockerfile deleted file mode 100644 index 8167438bbea..00000000000 --- a/release-0.19.0/examples/guestbook/redis-slave/Dockerfile +++ /dev/null @@ -1,7 +0,0 @@ -FROM redis - -ADD run.sh /run.sh - -RUN chmod a+x /run.sh - -CMD /run.sh diff --git a/release-0.19.0/examples/guestbook/redis-slave/run.sh b/release-0.19.0/examples/guestbook/redis-slave/run.sh deleted file mode 100755 index bf48f27c015..00000000000 --- a/release-0.19.0/examples/guestbook/redis-slave/run.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/bin/bash - -# Copyright 2014 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -redis-server --slaveof redis-master 6379 diff --git a/release-0.19.0/examples/hazelcast/Dockerfile b/release-0.19.0/examples/hazelcast/Dockerfile deleted file mode 100644 index 55963290c1a..00000000000 --- a/release-0.19.0/examples/hazelcast/Dockerfile +++ /dev/null @@ -1,11 +0,0 @@ -FROM quay.io/pires/docker-jre:8u45-2 - -MAINTAINER Paulo Pires - -EXPOSE 5701 - -RUN \ - curl -Lskj https://github.com/pires/hazelcast-kubernetes-bootstrapper/releases/download/0.3.1/hazelcast-kubernetes-bootstrapper-0.3.1.jar \ - -o /bootstrapper.jar - -CMD java -jar /bootstrapper.jar diff --git a/release-0.19.0/examples/hazelcast/README.md b/release-0.19.0/examples/hazelcast/README.md deleted file mode 100644 index b8836d0b80a..00000000000 --- a/release-0.19.0/examples/hazelcast/README.md +++ /dev/null @@ -1,214 +0,0 @@ -## Cloud Native Deployments of Hazelcast using Kubernetes - -The following document describes the development of a _cloud native_ [Hazelcast](http://hazelcast.org/) deployment on Kubernetes. When we say _cloud native_ we mean an application which understands that it is running within a cluster manager, and uses this cluster management infrastructure to help implement the application. In particular, in this instance, a custom Hazelcast ```bootstrapper``` is used to enable Hazelcast to dynamically discover Hazelcast nodes that have already joined the cluster. - -Any topology changes are communicated and handled by Hazelcast nodes themselves. - -This document also attempts to describe the core components of Kubernetes: _Pods_, _Services_, and _Replication Controllers_. - -### Prerequisites -This example assumes that you have a Kubernetes cluster installed and running, and that you have installed the `kubectl` command line tool somewhere in your path. Please see the [getting started](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/docs/getting-started-guides) for installation instructions for your platform. - -### A note for the impatient -This is a somewhat long tutorial. If you want to jump straight to the "do it now" commands, please see the [tl; dr](#tl-dr) at the end. - -### Sources - -Source is freely available at: -* Hazelcast Discovery - https://github.com/pires/hazelcast-kubernetes-bootstrapper -* Dockerfile - https://github.com/pires/hazelcast-kubernetes -* Docker Trusted Build - https://registry.hub.docker.com/u/pires/hazelcast-k8s - -### Simple Single Pod Hazelcast Node -In Kubernetes, the atomic unit of an application is a [_Pod_](../../docs/pods.md). A Pod is one or more containers that _must_ be scheduled onto the same host. All containers in a pod share a network namespace, and may optionally share mounted volumes. - -In this case, we shall not run a single Hazelcast pod, because the discovery mechanism now relies on a service definition. - - -### Adding a Hazelcast Service -In Kubernetes a _[Service](../../docs/services.md)_ describes a set of Pods that perform the same task. For example, the set of nodes in a Hazelcast cluster. An important use for a Service is to create a load balancer which distributes traffic across members of the set. But a _Service_ can also be used as a standing query which makes a dynamically changing set of Pods available via the Kubernetes API. This is actually how our discovery mechanism works, by relying on the service to discover other Hazelcast pods. - -Here is the service description: -```yaml -apiVersion: v1beta3 -kind: Service -metadata: - labels: - name: hazelcast - name: hazelcast -spec: - ports: - - port: 5701 - targetPort: 5701 - selector: - name: hazelcast -``` - -The important thing to note here is the `selector`. It is a query over labels, that identifies the set of _Pods_ contained by the _Service_. In this case the selector is `name: hazelcast`. If you look at the Replication Controller specification below, you'll see that the pod has the corresponding label, so it will be selected for membership in this Service. - -Create this service as follows: -```sh -$ kubectl create -f hazelcast-service.yaml -``` - -### Adding replicated nodes -The real power of Kubernetes and Hazelcast lies in easily building a replicated, resizable Hazelcast cluster. - -In Kubernetes a _[Replication Controller](../../docs/replication-controller.md)_ is responsible for replicating sets of identical pods. Like a _Service_ it has a selector query which identifies the members of it's set. Unlike a _Service_ it also has a desired number of replicas, and it will create or delete _Pods_ to ensure that the number of _Pods_ matches up with it's desired state. - -Replication Controllers will "adopt" existing pods that match their selector query, so let's create a Replication Controller with a single replica to adopt our existing Hazelcast Pod. - -```yaml -apiVersion: v1beta3 -kind: ReplicationController -metadata: - labels: - name: hazelcast - name: hazelcast -spec: - replicas: 1 - selector: - name: hazelcast - template: - metadata: - labels: - name: hazelcast - spec: - containers: - - resources: - limits: - cpu: 1 - image: quay.io/pires/hazelcast-kubernetes:0.3.1 - name: hazelcast - env: - - name: "DNS_DOMAIN" - value: "cluster.local" - ports: - - containerPort: 5701 - name: hazelcast -``` - -There are a few things to note in this description. First is that we are running the `quay.io/pires/hazelcast-kubernetes` image, tag `0.3.1`. This is a `busybox` installation with JRE 8. However it also adds a custom [`application`](https://github.com/pires/hazelcast-kubernetes-bootstrapper) that finds any Hazelcast nodes in the cluster and bootstraps an Hazelcast instance accordingle. The `HazelcastDiscoveryController` discovers the Kubernetes API Server using the built in Kubernetes discovery service, and then uses the Kubernetes API to find new nodes (more on this later). - -You may also note that we tell Kubernetes that the container exposes the `hazelcast` port. Finally, we tell the cluster manager that we need 1 cpu core. - -The bulk of the replication controller config is actually identical to the Hazelcast pod declaration above, it simply gives the controller a recipe to use when creating new pods. The other parts are the `selector` which contains the controller's selector query, and the `replicas` parameter which specifies the desired number of replicas, in this case 1. - -Last but not least, we set `DNS_DOMAIN` environment variable according to your Kubernetes clusters DNS configuration. - -Create this controller: - -```sh -$ kubectl create -f hazelcast-controller.yaml -``` - -After the controller provisions successfully the pod, you can query the service endpoints: -```sh -$ kubectl get endpoints hazelcast -o yaml -apiVersion: v1beta3 -kind: Endpoints -metadata: - creationTimestamp: 2015-05-04T17:43:40Z - labels: - name: hazelcast - name: hazelcast - namespace: default - resourceVersion: "120480" - selfLink: /api/v1beta3/namespaces/default/endpoints/hazelcast - uid: 19a22aa9-f285-11e4-b38f-42010af0bbf9 -subsets: -- addresses: - - IP: 10.245.2.68 - targetRef: - kind: Pod - name: hazelcast - namespace: default - resourceVersion: "120479" - uid: d7238173-f283-11e4-b38f-42010af0bbf9 - ports: - - port: 5701 - protocol: TCP -``` - -You can see that the _Service_ has found the pod created by the replication controller. - -Now it gets even more interesting. - -Let's scale our cluster to 2 pods: -```sh -$ kubectl scale rc hazelcast --replicas=2 -``` - -Now if you list the pods in your cluster, you should see two hazelcast pods: - -```sh -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -hazelcast-pkyzd 10.244.90.3 e2e-test-minion-vj7k/104.197.8.214 name=hazelcast Running 14 seconds - hazelcast quay.io/pires/hazelcast-kubernetes:0.3.1 Running 2 seconds -hazelcast-ulkws 10.244.66.2 e2e-test-minion-2x1f/146.148.62.37 name=hazelcast Running 7 seconds - hazelcast quay.io/pires/hazelcast-kubernetes:0.3.1 Running 6 seconds -``` - -To prove that this all works, you can use the `log` command to examine the logs of one pod, for example: - -```sh -$ kubectl log hazelcast-ulkws hazelcast -2015-05-09 22:06:20.016 INFO 5 --- [ main] com.github.pires.hazelcast.Application : Starting Application v0.2-SNAPSHOT on hazelcast-enyli with PID 5 (/bootstrapper.jar started by root in /) -2015-05-09 22:06:20.071 INFO 5 --- [ main] s.c.a.AnnotationConfigApplicationContext : Refreshing org.springframework.context.annotation.AnnotationConfigApplicationContext@5424f110: startup date [Sat May 09 22:06:20 GMT 2015]; root of context hierarchy -2015-05-09 22:06:21.511 INFO 5 --- [ main] o.s.j.e.a.AnnotationMBeanExporter : Registering beans for JMX exposure on startup -2015-05-09 22:06:21.549 INFO 5 --- [ main] c.g.p.h.HazelcastDiscoveryController : Asking k8s registry at https://kubernetes.default.cluster.local.. -2015-05-09 22:06:22.031 INFO 5 --- [ main] c.g.p.h.HazelcastDiscoveryController : Found 2 pods running Hazelcast. -2015-05-09 22:06:22.176 INFO 5 --- [ main] c.h.instance.DefaultAddressPicker : [LOCAL] [someGroup] [3.4.2] Interfaces is disabled, trying to pick one address from TCP-IP config addresses: [10.244.90.3, 10.244.66.2] -2015-05-09 22:06:22.177 INFO 5 --- [ main] c.h.instance.DefaultAddressPicker : [LOCAL] [someGroup] [3.4.2] Prefer IPv4 stack is true. -2015-05-09 22:06:22.189 INFO 5 --- [ main] c.h.instance.DefaultAddressPicker : [LOCAL] [someGroup] [3.4.2] Picked Address[10.244.66.2]:5701, using socket ServerSocket[addr=/0:0:0:0:0:0:0:0,localport=5701], bind any local is true -2015-05-09 22:06:22.642 INFO 5 --- [ main] com.hazelcast.spi.OperationService : [10.244.66.2]:5701 [someGroup] [3.4.2] Backpressure is disabled -2015-05-09 22:06:22.647 INFO 5 --- [ main] c.h.spi.impl.BasicOperationScheduler : [10.244.66.2]:5701 [someGroup] [3.4.2] Starting with 2 generic operation threads and 2 partition operation threads. -2015-05-09 22:06:22.796 INFO 5 --- [ main] com.hazelcast.system : [10.244.66.2]:5701 [someGroup] [3.4.2] Hazelcast 3.4.2 (20150326 - f6349a4) starting at Address[10.244.66.2]:5701 -2015-05-09 22:06:22.798 INFO 5 --- [ main] com.hazelcast.system : [10.244.66.2]:5701 [someGroup] [3.4.2] Copyright (C) 2008-2014 Hazelcast.com -2015-05-09 22:06:22.800 INFO 5 --- [ main] com.hazelcast.instance.Node : [10.244.66.2]:5701 [someGroup] [3.4.2] Creating TcpIpJoiner -2015-05-09 22:06:22.801 INFO 5 --- [ main] com.hazelcast.core.LifecycleService : [10.244.66.2]:5701 [someGroup] [3.4.2] Address[10.244.66.2]:5701 is STARTING -2015-05-09 22:06:23.108 INFO 5 --- [cached.thread-2] com.hazelcast.nio.tcp.SocketConnector : [10.244.66.2]:5701 [someGroup] [3.4.2] Connecting to /10.244.90.3:5701, timeout: 0, bind-any: true -2015-05-09 22:06:23.182 INFO 5 --- [cached.thread-2] c.h.nio.tcp.TcpIpConnectionManager : [10.244.66.2]:5701 [someGroup] [3.4.2] Established socket connection between /10.244.66.2:48051 and 10.244.90.3/10.244.90.3:5701 -2015-05-09 22:06:29.158 INFO 5 --- [ration.thread-1] com.hazelcast.cluster.ClusterService : [10.244.66.2]:5701 [someGroup] [3.4.2] - -Members [2] { - Member [10.244.90.3]:5701 - Member [10.244.66.2]:5701 this -} - -2015-05-09 22:06:31.177 INFO 5 --- [ main] com.hazelcast.core.LifecycleService : [10.244.66.2]:5701 [someGroup] [3.4.2] Address[10.244.66.2]:5701 is STARTED -``` - -Now let's scale our cluster to 4 nodes: -```sh -$ kubectl scale rc hazelcast --replicas=4 -``` - -Examine the status again by checking a node’s log and you should see the 4 members connected. - -### tl; dr; -For those of you who are impatient, here is the summary of the commands we ran in this tutorial. - -```sh -# create a service to track all hazelcast nodes -kubectl create -f hazelcast-service.yaml - -# create a replication controller to replicate hazelcast nodes -kubectl create -f hazelcast-controller.yaml - -# scale up to 2 nodes -kubectl scale rc hazelcast --replicas=2 - -# scale up to 4 nodes -kubectl scale rc hazelcast --replicas=4 -``` - -### Hazelcast Discovery Source - -See [here](https://github.com/pires/hazelcast-kubernetes-bootstrapper/blob/master/src/main/java/com/github/pires/hazelcast/HazelcastDiscoveryController.java) - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/hazelcast/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/hazelcast/README.md?pixel)]() diff --git a/release-0.19.0/examples/hazelcast/hazelcast-controller.yaml b/release-0.19.0/examples/hazelcast/hazelcast-controller.yaml deleted file mode 100644 index 86496ef665f..00000000000 --- a/release-0.19.0/examples/hazelcast/hazelcast-controller.yaml +++ /dev/null @@ -1,27 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - labels: - name: hazelcast - name: hazelcast -spec: - replicas: 1 - selector: - name: hazelcast - template: - metadata: - labels: - name: hazelcast - spec: - containers: - - resources: - limits: - cpu: 1 - image: quay.io/pires/hazelcast-kubernetes:0.3.1 - name: hazelcast - env: - - name: "DNS_DOMAIN" - value: "cluster.local" - ports: - - containerPort: 5701 - name: hazelcast diff --git a/release-0.19.0/examples/hazelcast/hazelcast-service.yaml b/release-0.19.0/examples/hazelcast/hazelcast-service.yaml deleted file mode 100644 index 1ea5a121209..00000000000 --- a/release-0.19.0/examples/hazelcast/hazelcast-service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1beta3 -kind: Service -metadata: - labels: - name: hazelcast - name: hazelcast -spec: - ports: - - port: 5701 - targetPort: 5701 - selector: - name: hazelcast diff --git a/release-0.19.0/examples/iscsi/README.md b/release-0.19.0/examples/iscsi/README.md deleted file mode 100644 index 97731de8849..00000000000 --- a/release-0.19.0/examples/iscsi/README.md +++ /dev/null @@ -1,65 +0,0 @@ -## Step 1. Setting up iSCSI target and iSCSI initiator -**Setup A.** On Fedora 21 nodes - -If you use Fedora 21 on Kubernetes node, then first install iSCSI initiator on the node: - - # yum -y install iscsi-initiator-utils - - -then edit */etc/iscsi/initiatorname.iscsi* and */etc/iscsi/iscsid.conf* to match your iSCSI target configuration. - -I mostly followed these [instructions](http://www.server-world.info/en/note?os=Fedora_21&p=iscsi&f=2) to setup iSCSI initiator and these [instructions](http://www.server-world.info/en/note?os=Fedora_21&p=iscsi) to setup iSCSI target. - -**Setup B.** On Unbuntu 12.04 and Debian 7 nodes on GCE - -GCE does not provide preconfigured Fedora 21 image, so I set up the iSCSI target on a preconfigured Ubuntu 12.04 image, mostly following these [instructions](http://www.server-world.info/en/note?os=Ubuntu_12.04&p=iscsi). My Kubernetes cluster on GCE was running Debian 7 images, so I followed these [instructions](http://www.server-world.info/en/note?os=Debian_7.0&p=iscsi&f=2) to set up the iSCSI initiator. - -##Step 2. Creating the pod with iSCSI persistent storage -Once you have installed iSCSI initiator and new Kubernetes, you can create a pod based on my example *iscsi.json*. In the pod JSON, you need to provide *targetPortal* (the iSCSI target's **IP** address and *port* if not the default port 3260), target's *iqn*, *lun*, and the type of the filesystem that has been created on the lun, and *readOnly* boolean. - -Once your pod is created, run it on the Kubernetes master: - -```console -kubectl create -f your_new_pod.json -``` - -Here is my command and output: - -```console -# kubectl create -f examples/iscsi/iscsi.json -# kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -iscsipd 10.244.3.14 kubernetes-minion-bz1p/104.154.61.231 Running About an hour - iscsipd-rw kubernetes/pause Running About an hour - iscsipd-ro kubernetes/pause Running About an hour -``` - -On the Kubernetes node, I got these in mount output - -```console -# mount |grep kub -/dev/sdb on /var/lib/kubelet/plugins/kubernetes.io/iscsi/iscsi/10.240.205.13:3260-iqn-iqn.2014-12.world.server:storage.target1-lun-0 type ext4 (ro,relatime,data=ordered) -/dev/sdb on /var/lib/kubelet/pods/e36158ce-f8d8-11e4-9ae7-42010af01964/volumes/kubernetes.io~iscsi/iscsipd-ro type ext4 (ro,relatime,data=ordered) -/dev/sdc on /var/lib/kubelet/plugins/kubernetes.io/iscsi/iscsi/10.240.205.13:3260-iqn-iqn.2014-12.world.server:storage.target1-lun-1 type xfs (rw,relatime,attr2,inode64,noquota) -/dev/sdc on /var/lib/kubelet/pods/e36158ce-f8d8-11e4-9ae7-42010af01964/volumes/kubernetes.io~iscsi/iscsipd-rw type xfs (rw,relatime,attr2,inode64,noquota) -``` - -If you ssh to that machine, you can run `docker ps` to see the actual pod. -```console -# docker ps -CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES -cc051196e7af kubernetes/pause:latest "/pause" About an hour ago Up About an hour k8s_iscsipd-rw.ff2d2e9f_iscsipd_default_e36158ce-f8d8-11e4-9ae7-42010af01964_26f3a457 -8aa981443cf4 kubernetes/pause:latest "/pause" About an hour ago Up About an hour k8s_iscsipd-ro.d7752e8f_iscsipd_default_e36158ce-f8d8-11e4-9ae7-42010af01964_4939633d -``` - -Run *docker inspect* and I found the Containers mounted the host directory into the their */mnt/iscsipd* directory. -```console -# docker inspect --format '{{index .Volumes "/mnt/iscsipd"}}' cc051196e7af -/var/lib/kubelet/pods/75e0af2b-f8e8-11e4-9ae7-42010af01964/volumes/kubernetes.io~iscsi/iscsipd-rw -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/iscsi/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/iscsi/README.md?pixel)]() diff --git a/release-0.19.0/examples/iscsi/iscsi.json b/release-0.19.0/examples/iscsi/iscsi.json deleted file mode 100644 index 439832b8049..00000000000 --- a/release-0.19.0/examples/iscsi/iscsi.json +++ /dev/null @@ -1,53 +0,0 @@ -{ - "apiVersion": "v1beta3", - "kind": "Pod", - "metadata": { - "name": "iscsipd" - }, - "spec": { - "containers": [ - { - "name": "iscsipd-ro", - "image": "kubernetes/pause", - "volumeMounts": [ - { - "mountPath": "/mnt/iscsipd", - "name": "iscsipd-ro" - } - ] - }, - { - "name": "iscsipd-rw", - "image": "kubernetes/pause", - "volumeMounts": [ - { - "mountPath": "/mnt/iscsipd", - "name": "iscsipd-rw" - } - ] - } - ], - "volumes": [ - { - "name": "iscsipd-ro", - "iscsi": { - "targetPortal": "10.16.154.81:3260", - "iqn": "iqn.2014-12.world.server:storage.target01", - "lun": 0, - "fsType": "ext4", - "readOnly": true - } - }, - { - "name": "iscsipd-rw", - "iscsi": { - "targetPortal": "10.16.154.81:3260", - "iqn": "iqn.2014-12.world.server:storage.target01", - "lun": 1, - "fsType": "xfs", - "readOnly": false - } - } - ] - } -} diff --git a/release-0.19.0/examples/k8petstore/README.md b/release-0.19.0/examples/k8petstore/README.md deleted file mode 100644 index 541cdc41b61..00000000000 --- a/release-0.19.0/examples/k8petstore/README.md +++ /dev/null @@ -1,117 +0,0 @@ -## Welcome to k8PetStore - -This is a follow up to the [Guestbook Example](../guestbook/README.md)'s [Go implementation](../guestbook-go/). - -- It leverages the same components (redis, Go REST API) as the guestbook application -- It comes with visualizations for graphing whats happening in Redis transactions, along with commandline printouts of transaction throughput -- It is hackable : you can build all images from the files is in this repository (With the exception of the data generator, which is apache bigtop). -- It generates massive load using a semantically rich, realistic transaction simulator for petstores - -This application will run a web server which returns REDIS records for a petstore application. -It is meant to simulate and test high load on kubernetes or any other docker based system. - -If you are new to kubernetes, and you haven't run guestbook yet, - -you might want to stop here and go back and run guestbook app first. - -The guestbook tutorial will teach you a lot about the basics of kubernetes, and we've tried not to be redundant here. - -## Architecture of this SOA - -A diagram of the overall architecture of this application can be seen in [arch.dot](arch.dot) (you can paste the contents in any graphviz viewer, including online ones such as http://sandbox.kidstrythisathome.com/erdos/. - -## Docker image dependencies - -Reading this section is optional, only if you want to rebuild everything from scratch. - -This project depends on three docker images which you can build for yourself and save -in your dockerhub "dockerhub-name". - -Since these images are already published under other parties like redis, jayunit100, and so on, -so you don't need to build the images to run the app. - -If you do want to build the images, you will need to build and push the images in this repository. - -For a list of those images, see the `build-and-push` shell script - it builds and pushes all the images for you, just - -modify the dockerhub user name in it accordingly. - -## Get started with the WEBAPP - -The web app is written in Go, and borrowed from the original Guestbook example by brendan burns. - -We have extended it to do some error reporting, persisting of JSON petstore transactions (not much different then guestbook entries), - -and supporting of additional REST calls, like LLEN, which returns the total # of transactions in the database. - -To work on the app, just cd to the `dev` directory, and follow the instructions. You can easily edit it in your local machine, by installing - -redis and go. Then you can use the `Vagrantfile` in this top level directory to launch a minimal version of the app in pure docker containers. - -If that is all working, you can finally run `k8petstore.sh` in any kubernetes cluster, and run the app at scale. - -## Set up the data generator (optional) - -The web front end provides users an interface for watching pet store transactions in real time as they occur. - -To generate those transactions, you can use the bigpetstore data generator. Alternatively, you could just write a - -shell script which calls "curl localhost:3000/k8petstore/rpush/blahblahblah" over and over again :). But thats not nearly - -as fun, and its not a good test of a real world scenario where payloads scale and have lots of information content. - -Similarly, you can locally run and test the data generator code, which is Java based, you can pull it down directly from - -apache bigtop. - -Directions for that are here : https://github.com/apache/bigtop/tree/master/bigtop-bigpetstore/bigpetstore-transaction-queue - -You will likely want to checkout the branch 2b2392bf135e9f1256bd0b930f05ae5aef8bbdcb, which is the exact commit which the current k8petstore was tested on. - -## Now what? - -Once you have done the above 3 steps, you have a working, from source, locally runnable version of the k8petstore app, now, we can try to run it in kubernetes. - -## Hacking, testing, benchmarking - -Once the app is running, you can go to the location of publicIP:3000 (the first parameter in the script). In your browser, you should see a chart - -and the k8petstore title page, as well as an indicator of transaction throughput, and so on. You should be able to modify - -You can modify the HTML pages, add new REST paths to the Go app, and so on. - -## Running in kubernetes - -Now that you are done hacking around on the app, you can run it in kubernetes. To do this, you will want to rebuild the docker images (most likely, for the Go web-server app), but less likely for the other images which you are less likely to need to change. Then you will push those images to dockerhub. - -Now, how to run the entire application in kubernetes? - -To simplify running this application, we have a single file, k8petstore.sh, which writes out json files on to disk. This allows us to have dynamic parameters, without needing to worry about managing multiplejson files. - -You might want to change it to point to your customized Go image, if you chose to modify things. - -like the number of data generators (more generators will create more load on the redis master). - -So, to run this app in kubernetes, simply run [The all in one k8petstore.sh shell script](k8petstore.sh). - -Note that there are a few , self explanatory parameters to set at the top of it. - -Most importantly, the Public IPs parameter, so that you can checkout the web ui (at $PUBLIC_IP:3000), which will show a plot and read outs of transaction throughput. - -## Future - -In the future, we plan to add cassandra support. Redis is a fabulous in memory data store, but it is not meant for truly available and resilient storage. - -Thus we plan to add another tier of queueing, which empties the REDIS transactions into a cassandra store which persists. - -## Questions - -For questions on running this app, you can ask on the google containers group (freenode ~ google-containers@googlegroups.com or #google-containers on IRC) - -For questions about bigpetstore, and how the data is generated, ask on the apache bigtop mailing list. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/k8petstore/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/k8petstore/README.md?pixel)]() diff --git a/release-0.19.0/examples/k8petstore/Vagrantfile b/release-0.19.0/examples/k8petstore/Vagrantfile deleted file mode 100644 index a96af767b65..00000000000 --- a/release-0.19.0/examples/k8petstore/Vagrantfile +++ /dev/null @@ -1,37 +0,0 @@ -# -*- mode: ruby -*- -# vi: set ft=ruby : - -require 'fileutils' - -#$fes = 1 -#$rslavess = 1 - -Vagrant.configure("2") do |config| - - config.vm.define "rmaster" do |rm| - rm.vm.provider "docker" do |d| - d.vagrant_vagrantfile = "./dev/hosts/Vagrantfile" - d.build_dir = "redis-master" - d.name = "rmaster" - d.create_args = ["--privileged=true", "-m", "1g"] - #d.ports = [ "6379:6379" ] - d.remains_running = true - end - end - - config.vm.define "frontend" do |fe| - fe.vm.provider "docker" do |d| - d.vagrant_vagrantfile = "./dev/hosts/Vagrantfile" - d.build_dir = "web-server" - d.name = "web-server" - d.create_args = ["--privileged=true"] - d.remains_running = true - d.create_args = d.create_args << "--link" << "rmaster:rmaster" - d.ports = ["3000:3000"] - d.env = {"REDISMASTER_SERVICE_HOST"=>"rmaster","REDISMASTER_SERVICE_PORT"=>"6379"} - end - end - - ### Todo , add data generator. - -end diff --git a/release-0.19.0/examples/k8petstore/bps-data-generator/README.md b/release-0.19.0/examples/k8petstore/bps-data-generator/README.md deleted file mode 100644 index 09b18fc9748..00000000000 --- a/release-0.19.0/examples/k8petstore/bps-data-generator/README.md +++ /dev/null @@ -1,21 +0,0 @@ -# How to generate the bps-data-generator container # - -This container is maintained as part of the apache bigtop project. - -To create it, simply - -`git clone https://github.com/apache/bigtop` - -and checkout the last exact version (will be updated periodically). - -`git checkout -b aNewBranch 2b2392bf135e9f1256bd0b930f05ae5aef8bbdcb` - -then, cd to bigtop-bigpetstore/bigpetstore-transaction-queue, and run the docker file, i.e. - -`Docker build -t -i jayunit100/bps-transaction-queue`. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/k8petstore/bps-data-generator/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/k8petstore/bps-data-generator/README.md?pixel)]() diff --git a/release-0.19.0/examples/k8petstore/build-push-containers.sh b/release-0.19.0/examples/k8petstore/build-push-containers.sh deleted file mode 100755 index 7733b6fdd48..00000000000 --- a/release-0.19.0/examples/k8petstore/build-push-containers.sh +++ /dev/null @@ -1,29 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -#K8PetStore version is tied to the redis version. We will add more info to version tag later. -#Change the 'jayunit100' string below to you're own dockerhub name and run this script. -#It will build all the containers for this application and publish them to your dockerhub account -version="r.2.8.19" -docker build -t jayunit100/k8-petstore-redis:$version ./redis/ -docker build -t jayunit100/k8-petstore-redis-master:$version ./redis-master -docker build -t jayunit100/k8-petstore-redis-slave:$version ./redis-slave -docker build -t jayunit100/k8-petstore-web-server:$version ./web-server - -docker push jayunit100/k8-petstore-redis:$version -docker push jayunit100/k8-petstore-redis-master:$version -docker push jayunit100/k8-petstore-redis-slave:$version -docker push jayunit100/k8-petstore-web-server:$version diff --git a/release-0.19.0/examples/k8petstore/dev/README b/release-0.19.0/examples/k8petstore/dev/README deleted file mode 100644 index 3b495ea7034..00000000000 --- a/release-0.19.0/examples/k8petstore/dev/README +++ /dev/null @@ -1,35 +0,0 @@ -### Local development - -1) Install Go - -2) Install Redis - -Now start a local redis instance - -``` -redis-server -``` - -And run the app - -``` -export GOPATH=~/Development/k8hacking/k8petstore/web-server/ -cd $GOPATH/src/main/ -## Now, you're in the local dir to run the app. Go get its depenedencies. -go get -go run PetStoreBook.go -``` - -Once the app works the way you want it to, test it in the vagrant recipe below. This will gaurantee that you're local environment isn't doing something that breaks the containers at the versioning level. - -### Testing - -This folder can be used by anyone interested in building and developing the k8petstore application. - -This is for dev and test. - -`vagrant up` gets you a cluster with the app's core components running. - -You can rename Vagrantfile_atomic to Vagrantfile if you want to try to test in atomic instead. - -** Now you can run the code on the kubernetes cluster with reasonable assurance that any problems you run into are not bugs in the code itself :) * diff --git a/release-0.19.0/examples/k8petstore/dev/Vagrantfile b/release-0.19.0/examples/k8petstore/dev/Vagrantfile deleted file mode 100755 index c4f19b2aa4d..00000000000 --- a/release-0.19.0/examples/k8petstore/dev/Vagrantfile +++ /dev/null @@ -1,44 +0,0 @@ -# -*- mode: ruby -*- -# vi: set ft=ruby : - -require 'fileutils' - -#$fes = 1 -#$rslavess = 1 - -Vagrant.configure("2") do |config| - - config.vm.define "rmaster" do |rm| - rm.vm.provider "docker" do |d| - d.vagrant_vagrantfile = "./hosts/Vagrantfile" - d.build_dir = "../redis-master" - d.name = "rmaster" - d.create_args = ["--privileged=true"] - #d.ports = [ "6379:6379" ] - d.remains_running = true - end - end - - puts "sleep 20 to make sure container is up..." - sleep(20) - puts "resume" - - config.vm.define "frontend" do |fe| - fe.vm.provider "docker" do |d| - d.vagrant_vagrantfile = "./hosts/Vagrantfile" - d.build_dir = "../web-server" - d.name = "web-server" - d.create_args = ["--privileged=true"] - d.remains_running = true - d.create_args = d.create_args << "--link" << "rmaster:rmaster" - d.ports = ["3000:3000"] - d.env = {"REDISMASTER_SERVICE_HOST"=>"rmaster","REDISMASTER_SERVICE_PORT"=>"6379"} - end - end - - - - ### Todo , add data generator. - - -end diff --git a/release-0.19.0/examples/k8petstore/dev/hosts/Vagrantfile b/release-0.19.0/examples/k8petstore/dev/hosts/Vagrantfile deleted file mode 100644 index 72e86d72621..00000000000 --- a/release-0.19.0/examples/k8petstore/dev/hosts/Vagrantfile +++ /dev/null @@ -1,11 +0,0 @@ -VAGRANTFILE_API_VERSION = "2" - -Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| - config.vm.box = "jayunit100/centos7" - config.vm.provision "docker" - config.vm.provision "shell", inline: "ps aux | grep 'sshd:' | awk '{print $2}' | xargs kill" - config.vm.provision "shell", inline: "yum install -y git && service firewalld stop && service docker restart" - config.vm.provision "shell", inline: "docker ps -a | awk '{print $1}' | xargs --no-run-if-empty docker rm -f || ls" - config.vm.network :forwarded_port, guest: 3000, host: 3000 - -end diff --git a/release-0.19.0/examples/k8petstore/dev/test.sh b/release-0.19.0/examples/k8petstore/dev/test.sh deleted file mode 100755 index 53d42a8c5b7..00000000000 --- a/release-0.19.0/examples/k8petstore/dev/test.sh +++ /dev/null @@ -1,47 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -## First set up the host VM. That ensures -## we avoid vagrant race conditions. -set -x - -cd hosts/ -echo "note: the VM must be running before you try this" -echo "if not already running, cd to hosts and run vagrant up" -vagrant provision -#echo "removing containers" -#vagrant ssh -c "sudo docker rm -f $(docker ps -a -q)" -cd .. - -## Now spin up the docker containers -## these will run in the ^ host vm above. - -vagrant up - -## Finally, curl the length, it should be 3 . - -x=`curl localhost:3000/llen` - -for i in `seq 1 100` do - if [ x$x == "x3" ]; then - echo " passed $3 " - exit 0 - else - echo " FAIL" - fi -done - -exit 1 # if we get here the test obviously failed. diff --git a/release-0.19.0/examples/k8petstore/k8petstore.dot b/release-0.19.0/examples/k8petstore/k8petstore.dot deleted file mode 100644 index 539132fb3aa..00000000000 --- a/release-0.19.0/examples/k8petstore/k8petstore.dot +++ /dev/null @@ -1,9 +0,0 @@ - digraph k8petstore { - - USERS -> publicIP_proxy -> web_server; - bps_data_generator -> web_server [arrowhead = crow, label = "http://$FRONTEND_SERVICE_HOST:3000/rpush/k8petstore/{name..address..,product=..."]; - external -> web_server [arrowhead = crow, label=" http://$FRONTEND_SERVICE_HOST/k8petstore/llen:3000"]; - web_server -> redis_master [label=" RESP : k8petstore, llen"]; - redis_master -> redis_slave [arrowhead = crow] [label="replication (one-way)"]; -} - diff --git a/release-0.19.0/examples/k8petstore/k8petstore.sh b/release-0.19.0/examples/k8petstore/k8petstore.sh deleted file mode 100755 index 5a5393435cf..00000000000 --- a/release-0.19.0/examples/k8petstore/k8petstore.sh +++ /dev/null @@ -1,287 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -echo "WRITING KUBE FILES , will overwrite the jsons, then testing pods. is kube clean ready to go?" - - -#Args below can be overriden when calling from cmd line. -#Just send all the args in order. -#for dev/test you can use: -#kubectl=$GOPATH/src/github.com/GoogleCloudPlatform/kubernetes/cluster/kubectl.sh" -kubectl="kubectl" -VERSION="r.2.8.19" -PUBLIC_IP="10.1.4.89" # ip which we use to access the Web server. -_SECONDS=1000 # number of seconds to measure throughput. -FE="1" # amount of Web server -LG="1" # amount of load generators -SLAVE="1" # amount of redis slaves -TEST="1" # 0 = Dont run tests, 1 = Do run tests. -NS="k8petstore" # namespace - -kubectl="${1:-$kubectl}" -VERSION="${2:-$VERSION}" -PUBLIC_IP="${3:-$PUBLIC_IP}" # ip which we use to access the Web server. -_SECONDS="${4:-$_SECONDS}" # number of seconds to measure throughput. -FE="${5:-$FE}" # amount of Web server -LG="${6:-$LG}" # amount of load generators -SLAVE="${7:-$SLAVE}" # amount of redis slaves -TEST="${8:-$TEST}" # 0 = Dont run tests, 1 = Do run tests. -NS="${9:-$NS}" # namespace - -echo "Running w/ args: kubectl $kubectl version $VERSION ip $PUBLIC_IP sec $_SECONDS fe $FE lg $LG slave $SLAVE test $TEST NAMESPACE $NS" -function create { - -cat << EOF > fe-rc.json -{ - "kind": "ReplicationController", - "apiVersion": "v1beta3", - "metadata": { - "name": "fectrl", - "labels": {"name": "frontend"} - }, - "spec": { - "replicas": $FE, - "selector": {"name": "frontend"}, - "template": { - "metadata": { - "labels": { - "name": "frontend", - "uses": "redis-master" - } - }, - "spec": { - "containers": [{ - "name": "frontend-go-restapi", - "image": "jayunit100/k8-petstore-web-server:$VERSION" - }] - } - } - } -} -EOF - -cat << EOF > bps-load-gen-rc.json -{ - "kind": "ReplicationController", - "apiVersion": "v1beta3", - "metadata": { - "name": "bpsloadgenrc", - "labels": {"name": "bpsLoadGenController"} - }, - "spec": { - "replicas": $LG, - "selector": {"name": "bps"}, - "template": { - "metadata": { - "labels": { - "name": "bps", - "uses": "frontend" - } - }, - "spec": { - "containers": [{ - "name": "bps", - "image": "jayunit100/bigpetstore-load-generator", - "command": ["sh","-c","/opt/PetStoreLoadGenerator-1.0/bin/PetStoreLoadGenerator http://\$FRONTEND_SERVICE_HOST:3000/rpush/k8petstore/ 4 4 1000 123"] - }] - } - } - } -} -EOF - -cat << EOF > fe-s.json -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "frontend", - "labels": { - "name": "frontend" - } - }, - "spec": { - "ports": [{ - "port": 3000 - }], - "publicIPs":["$PUBLIC_IP","10.1.4.89"], - "selector": { - "name": "frontend" - } - } -} -EOF - -cat << EOF > rm.json -{ - "kind": "Pod", - "apiVersion": "v1beta3", - "metadata": { - "name": "redismaster", - "labels": { - "name": "redis-master" - } - }, - "spec": { - "containers": [{ - "name": "master", - "image": "jayunit100/k8-petstore-redis-master:$VERSION", - "ports": [{ - "containerPort": 6379 - }] - }] - } -} -EOF - -cat << EOF > rm-s.json -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "redismaster", - "labels": { - "name": "redis-master" - } - }, - "spec": { - "ports": [{ - "port": 6379 - }], - "selector": { - "name": "redis-master" - } - } -} -EOF - -cat << EOF > rs-s.json -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "redisslave", - "labels": { - "name": "redisslave" - } - }, - "spec": { - "ports": [{ - "port": 6379 - }], - "selector": { - "name": "redisslave" - } - } -} -EOF - -cat << EOF > slave-rc.json -{ - "kind": "ReplicationController", - "apiVersion": "v1beta3", - "metadata": { - "name": "redissc", - "labels": {"name": "redisslave"} - }, - "spec": { - "replicas": $SLAVE, - "selector": {"name": "redisslave"}, - "template": { - "metadata": { - "labels": { - "name": "redisslave", - "uses": "redis-master" - } - }, - "spec": { - "containers": [{ - "name": "slave", - "image": "jayunit100/k8-petstore-redis-slave:$VERSION", - "ports": [{"containerPort": 6379}] - }] - } - } - } -} -EOF -$kubectl create -f rm.json --namespace=$NS -$kubectl create -f rm-s.json --namespace=$NS -sleep 3 # precaution to prevent fe from spinning up too soon. -$kubectl create -f slave-rc.json --namespace=$NS -$kubectl create -f rs-s.json --namespace=$NS -sleep 3 # see above comment. -$kubectl create -f fe-rc.json --namespace=$NS -$kubectl create -f fe-s.json --namespace=$NS -$kubectl create -f bps-load-gen-rc.json --namespace=$NS -} - -function pollfor { - pass_http=0 - - ### Test HTTP Server comes up. - for i in `seq 1 150`; - do - ### Just testing that the front end comes up. Not sure how to test total entries etc... (yet) - echo "Trying curl ... $PUBLIC_IP:3000 , attempt $i . expect a few failures while pulling images... " - curl "$PUBLIC_IP:3000" > result - cat result - cat result | grep -q "k8-bps" - if [ $? -eq 0 ]; then - echo "TEST PASSED after $i tries !" - i=1000 - break - else - echo "the above RESULT didn't contain target string for trial $i" - fi - sleep 3 - done - - if [ $i -eq 1000 ]; then - pass_http=1 - fi - -} - -function tests { - pass_load=0 - - ### Print statistics of db size, every second, until $SECONDS are up. - for i in `seq 1 $_SECONDS`; - do - echo "curl : $PUBLIC_IP:3000 , $i of $_SECONDS" - curr_cnt="`curl "$PUBLIC_IP:3000/llen"`" - ### Write CSV File of # of trials / total transcations. - echo "$i $curr_cnt" >> result - echo "total transactions so far : $curr_cnt" - sleep 1 - done -} - -create - -pollfor - -if [[ $pass_http -eq 1 ]]; then - echo "Passed..." -else - exit 1 -fi - -if [[ $TEST -eq 1 ]]; then - echo "running polling tests now" - tests -fi diff --git a/release-0.19.0/examples/k8petstore/redis-master/Dockerfile b/release-0.19.0/examples/k8petstore/redis-master/Dockerfile deleted file mode 100644 index bd3a67ced04..00000000000 --- a/release-0.19.0/examples/k8petstore/redis-master/Dockerfile +++ /dev/null @@ -1,17 +0,0 @@ -# -# Redis Dockerfile -# -# https://github.com/dockerfile/redis -# - -# Pull base image. -# -# Just a stub. - -FROM jayunit100/redis:2.8.19 - -ADD etc_redis_redis.conf /etc/redis/redis.conf - -CMD ["redis-server", "/etc/redis/redis.conf"] -# Expose ports. -EXPOSE 6379 diff --git a/release-0.19.0/examples/k8petstore/redis-master/etc_redis_redis.conf b/release-0.19.0/examples/k8petstore/redis-master/etc_redis_redis.conf deleted file mode 100644 index 38b8c701e7a..00000000000 --- a/release-0.19.0/examples/k8petstore/redis-master/etc_redis_redis.conf +++ /dev/null @@ -1,46 +0,0 @@ -pidfile /var/run/redis.pid -port 6379 -tcp-backlog 511 -timeout 0 -tcp-keepalive 0 -loglevel verbose -syslog-enabled yes -databases 1 -save 1 1 -save 900 1 -save 300 10 -save 60 10000 -stop-writes-on-bgsave-error yes -rdbcompression no -rdbchecksum yes -dbfilename dump.rdb -dir /data -slave-serve-stale-data no -slave-read-only yes -repl-disable-tcp-nodelay no -slave-priority 100 -maxmemory -appendonly yes -appendfilename "appendonly.aof" -appendfsync everysec -no-appendfsync-on-rewrite no -auto-aof-rewrite-percentage 100 -auto-aof-rewrite-min-size 1 -aof-load-truncated yes -lua-time-limit 5000 -slowlog-log-slower-than 10000 -slowlog-max-len 128 -latency-monitor-threshold 0 -notify-keyspace-events "KEg$lshzxeA" -list-max-ziplist-entries 512 -list-max-ziplist-value 64 -set-max-intset-entries 512 -zset-max-ziplist-entries 128 -zset-max-ziplist-value 64 -hll-sparse-max-bytes 3000 -activerehashing yes -client-output-buffer-limit normal 0 0 0 -client-output-buffer-limit slave 256mb 64mb 60 -client-output-buffer-limit pubsub 32mb 8mb 60 -hz 10 -aof-rewrite-incremental-fsync yes diff --git a/release-0.19.0/examples/k8petstore/redis-slave/Dockerfile b/release-0.19.0/examples/k8petstore/redis-slave/Dockerfile deleted file mode 100644 index 67952daf116..00000000000 --- a/release-0.19.0/examples/k8petstore/redis-slave/Dockerfile +++ /dev/null @@ -1,15 +0,0 @@ -# -# Redis Dockerfile -# -# https://github.com/dockerfile/redis -# - -# Pull base image. -# -# Just a stub. - -FROM jayunit100/redis:2.8.19 - -ADD run.sh /run.sh - -CMD /run.sh diff --git a/release-0.19.0/examples/k8petstore/redis-slave/etc_redis_redis.conf b/release-0.19.0/examples/k8petstore/redis-slave/etc_redis_redis.conf deleted file mode 100644 index 38b8c701e7a..00000000000 --- a/release-0.19.0/examples/k8petstore/redis-slave/etc_redis_redis.conf +++ /dev/null @@ -1,46 +0,0 @@ -pidfile /var/run/redis.pid -port 6379 -tcp-backlog 511 -timeout 0 -tcp-keepalive 0 -loglevel verbose -syslog-enabled yes -databases 1 -save 1 1 -save 900 1 -save 300 10 -save 60 10000 -stop-writes-on-bgsave-error yes -rdbcompression no -rdbchecksum yes -dbfilename dump.rdb -dir /data -slave-serve-stale-data no -slave-read-only yes -repl-disable-tcp-nodelay no -slave-priority 100 -maxmemory -appendonly yes -appendfilename "appendonly.aof" -appendfsync everysec -no-appendfsync-on-rewrite no -auto-aof-rewrite-percentage 100 -auto-aof-rewrite-min-size 1 -aof-load-truncated yes -lua-time-limit 5000 -slowlog-log-slower-than 10000 -slowlog-max-len 128 -latency-monitor-threshold 0 -notify-keyspace-events "KEg$lshzxeA" -list-max-ziplist-entries 512 -list-max-ziplist-value 64 -set-max-intset-entries 512 -zset-max-ziplist-entries 128 -zset-max-ziplist-value 64 -hll-sparse-max-bytes 3000 -activerehashing yes -client-output-buffer-limit normal 0 0 0 -client-output-buffer-limit slave 256mb 64mb 60 -client-output-buffer-limit pubsub 32mb 8mb 60 -hz 10 -aof-rewrite-incremental-fsync yes diff --git a/release-0.19.0/examples/k8petstore/redis-slave/run.sh b/release-0.19.0/examples/k8petstore/redis-slave/run.sh deleted file mode 100755 index d42c8f261fa..00000000000 --- a/release-0.19.0/examples/k8petstore/redis-slave/run.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash - -# Copyright 2014 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -echo "Note, if you get errors below indicate kubernetes env injection could be faliing..." -echo "env vars =" -env -echo "CHECKING ENVS BEFORE STARTUP........" -if [ ! "$REDISMASTER_SERVICE_HOST" ]; then - echo "Need to set REDIS_MASTER_SERVICE_HOST" && exit 1; -fi -if [ ! "$REDISMASTER_PORT" ]; then - echo "Need to set REDIS_MASTER_PORT" && exit 1; -fi - -echo "ENV Vars look good, starting !" - -redis-server --slaveof ${REDISMASTER_SERVICE_HOST:-$SERVICE_HOST} $REDISMASTER_SERVICE_PORT diff --git a/release-0.19.0/examples/k8petstore/redis/Dockerfile b/release-0.19.0/examples/k8petstore/redis/Dockerfile deleted file mode 100644 index 41ac9dcdd44..00000000000 --- a/release-0.19.0/examples/k8petstore/redis/Dockerfile +++ /dev/null @@ -1,45 +0,0 @@ -# -# Redis Dockerfile -# -# https://github.com/dockerfile/redis -# - -# Pull base image. -FROM ubuntu - -# Install Redis. -RUN \ - cd /tmp && \ - # Modify to stay at this version rather then always update. - - ################################################################# - ###################### REDIS INSTALL ############################ - wget http://download.redis.io/releases/redis-2.8.19.tar.gz && \ - tar xvzf redis-2.8.19.tar.gz && \ - cd redis-2.8.19 && \ - ################################################################ - ################################################################ - make && \ - make install && \ - cp -f src/redis-sentinel /usr/local/bin && \ - mkdir -p /etc/redis && \ - cp -f *.conf /etc/redis && \ - rm -rf /tmp/redis-stable* && \ - sed -i 's/^\(bind .*\)$/# \1/' /etc/redis/redis.conf && \ - sed -i 's/^\(daemonize .*\)$/# \1/' /etc/redis/redis.conf && \ - sed -i 's/^\(dir .*\)$/# \1\ndir \/data/' /etc/redis/redis.conf && \ - sed -i 's/^\(logfile .*\)$/# \1/' /etc/redis/redis.conf - -# Define mountable directories. -VOLUME ["/data"] - -# Define working directory. -WORKDIR /data - -ADD etc_redis_redis.conf /etc/redis/redis.conf - -# Print redis configs and start. -# CMD "redis-server /etc/redis/redis.conf" - -# Expose ports. -EXPOSE 6379 diff --git a/release-0.19.0/examples/k8petstore/redis/etc_redis_redis.conf b/release-0.19.0/examples/k8petstore/redis/etc_redis_redis.conf deleted file mode 100644 index 38b8c701e7a..00000000000 --- a/release-0.19.0/examples/k8petstore/redis/etc_redis_redis.conf +++ /dev/null @@ -1,46 +0,0 @@ -pidfile /var/run/redis.pid -port 6379 -tcp-backlog 511 -timeout 0 -tcp-keepalive 0 -loglevel verbose -syslog-enabled yes -databases 1 -save 1 1 -save 900 1 -save 300 10 -save 60 10000 -stop-writes-on-bgsave-error yes -rdbcompression no -rdbchecksum yes -dbfilename dump.rdb -dir /data -slave-serve-stale-data no -slave-read-only yes -repl-disable-tcp-nodelay no -slave-priority 100 -maxmemory -appendonly yes -appendfilename "appendonly.aof" -appendfsync everysec -no-appendfsync-on-rewrite no -auto-aof-rewrite-percentage 100 -auto-aof-rewrite-min-size 1 -aof-load-truncated yes -lua-time-limit 5000 -slowlog-log-slower-than 10000 -slowlog-max-len 128 -latency-monitor-threshold 0 -notify-keyspace-events "KEg$lshzxeA" -list-max-ziplist-entries 512 -list-max-ziplist-value 64 -set-max-intset-entries 512 -zset-max-ziplist-entries 128 -zset-max-ziplist-value 64 -hll-sparse-max-bytes 3000 -activerehashing yes -client-output-buffer-limit normal 0 0 0 -client-output-buffer-limit slave 256mb 64mb 60 -client-output-buffer-limit pubsub 32mb 8mb 60 -hz 10 -aof-rewrite-incremental-fsync yes diff --git a/release-0.19.0/examples/k8petstore/web-server/Dockerfile b/release-0.19.0/examples/k8petstore/web-server/Dockerfile deleted file mode 100644 index fe98d81ce26..00000000000 --- a/release-0.19.0/examples/k8petstore/web-server/Dockerfile +++ /dev/null @@ -1,21 +0,0 @@ -FROM google/golang:latest - -# Add source to gopath. This is defacto required for go apps. -ADD ./src /gopath/src/ -ADD ./static /tmp/static -ADD ./test.sh /opt/test.sh -RUN chmod 777 /opt/test.sh -# $GOPATH/[src/a/b/c] -# go build a/b/c -# go run main - -# So that we can easily run and install -WORKDIR /gopath/src/ - -# Install the code (the executables are in the main dir) This will get the deps also. -RUN go get main -#RUN go build main - -# Expected that you will override this in production kubernetes. -ENV STATIC_FILES /tmp/static -CMD /gopath/bin/main diff --git a/release-0.19.0/examples/k8petstore/web-server/PetStoreBook.go b/release-0.19.0/examples/k8petstore/web-server/PetStoreBook.go deleted file mode 100644 index 1c81cef9537..00000000000 --- a/release-0.19.0/examples/k8petstore/web-server/PetStoreBook.go +++ /dev/null @@ -1,204 +0,0 @@ -/* -Copyright 2014 The Kubernetes Authors All rights reserved. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package main - -import ( - "encoding/json" - "fmt" - "net/http" - "os" - "strings" - - "github.com/codegangsta/negroni" - "github.com/gorilla/mux" - "github.com/xyproto/simpleredis" -) - -//return the path to static assets (i.e. index.html) -func pathToStaticContents() string { - var static_content = os.Getenv("STATIC_FILES") - // Take a wild guess. This will work in dev environment. - if static_content == "" { - println("*********** WARNING: DIDNT FIND ENV VAR 'STATIC_FILES', guessing your running in dev.") - static_content = "../../static/" - } else { - println("=========== Read ENV 'STATIC_FILES', path to assets : " + static_content) - } - - //Die if no the static files are missing. - _, err := os.Stat(static_content) - if err != nil { - println("*********** os.Stat failed on " + static_content + " This means no static files are available. Dying...") - os.Exit(2) - } - return static_content -} - -func main() { - - var connection = os.Getenv("REDISMASTER_SERVICE_HOST") + ":" + os.Getenv("REDISMASTER_SERVICE_PORT") - - if connection == ":" { - print("WARNING ::: If in kube, this is a failure: Missing env variable REDISMASTER_SERVICE_HOST") - print("WARNING ::: Attempting to connect redis localhost.") - connection = "127.0.0.1:6379" - } else { - print("Found redis master host " + os.Getenv("REDISMASTER_SERVICE_PORT")) - connection = os.Getenv("REDISMASTER_SERVICE_HOST") + ":" + os.Getenv("REDISMASTER_SERVICE_PORT") - } - - println("Now connecting to : " + connection) - /** - * Create a connection pool. ?The pool pointer will otherwise - * not be of any use.?https://gist.github.com/jayunit100/1d00e6d343056401ef00 - */ - pool = simpleredis.NewConnectionPoolHost(connection) - - println("Connection pool established : " + connection) - - defer pool.Close() - - r := mux.NewRouter() - - println("Router created ") - - /** - * Define a REST path. - * - The parameters (key) can be accessed via mux.Vars. - * - The Methods (GET) will be bound to a handler function. - */ - r.Path("/info").Methods("GET").HandlerFunc(InfoHandler) - r.Path("/lrange/{key}").Methods("GET").HandlerFunc(ListRangeHandler) - r.Path("/rpush/{key}/{value}").Methods("GET").HandlerFunc(ListPushHandler) - r.Path("/llen").Methods("GET").HandlerFunc(LLENHandler) - - //for dev environment, the site is one level up... - - r.PathPrefix("/").Handler(http.FileServer(http.Dir(pathToStaticContents()))) - - r.Path("/env").Methods("GET").HandlerFunc(EnvHandler) - - list := simpleredis.NewList(pool, "k8petstore") - HandleError(nil, list.Add("jayunit100")) - HandleError(nil, list.Add("tstclaire")) - HandleError(nil, list.Add("rsquared")) - - // Verify that this is 3 on startup. - infoL := HandleError(pool.Get(0).Do("LLEN", "k8petstore")).(int64) - fmt.Printf("\n=========== Starting DB has %d elements \n", infoL) - if infoL < 3 { - print("Not enough entries in DB. something is wrong w/ redis querying") - print(infoL) - panic("Failed ... ") - } - - println("=========== Now launching negroni...this might take a second...") - n := negroni.Classic() - n.UseHandler(r) - n.Run(":3000") - println("Done ! Web app is now running.") - -} - -/** -* the Pool will be populated on startup, -* it will be an instance of a connection pool. -* Hence, we reference its address rather than copying. - */ -var pool *simpleredis.ConnectionPool - -/** -* REST -* input: key -* -* Writes all members to JSON. - */ -func ListRangeHandler(rw http.ResponseWriter, req *http.Request) { - println("ListRangeHandler") - - key := mux.Vars(req)["key"] - - list := simpleredis.NewList(pool, key) - - //members := HandleError(list.GetAll()).([]string) - members := HandleError(list.GetLastN(4)).([]string) - - print(members) - membersJSON := HandleError(json.MarshalIndent(members, "", " ")).([]byte) - - print("RETURN MEMBERS = " + string(membersJSON)) - rw.Write(membersJSON) -} - -func LLENHandler(rw http.ResponseWriter, req *http.Request) { - println("=========== LLEN HANDLER") - - infoL := HandleError(pool.Get(0).Do("LLEN", "k8petstore")).(int64) - fmt.Printf("=========== LLEN is %d ", infoL) - lengthJSON := HandleError(json.MarshalIndent(infoL, "", " ")).([]byte) - fmt.Printf("================ LLEN json is %s", infoL) - - print("RETURN LEN = " + string(lengthJSON)) - rw.Write(lengthJSON) - -} - -func ListPushHandler(rw http.ResponseWriter, req *http.Request) { - println("ListPushHandler") - - /** - * Expect a key and value as input. - * - */ - key := mux.Vars(req)["key"] - value := mux.Vars(req)["value"] - - println("New list " + key + " " + value) - list := simpleredis.NewList(pool, key) - HandleError(nil, list.Add(value)) - ListRangeHandler(rw, req) -} - -func InfoHandler(rw http.ResponseWriter, req *http.Request) { - println("InfoHandler") - - info := HandleError(pool.Get(0).Do("INFO")).([]byte) - rw.Write(info) -} - -func EnvHandler(rw http.ResponseWriter, req *http.Request) { - println("EnvHandler") - - environment := make(map[string]string) - for _, item := range os.Environ() { - splits := strings.Split(item, "=") - key := splits[0] - val := strings.Join(splits[1:], "=") - environment[key] = val - } - - envJSON := HandleError(json.MarshalIndent(environment, "", " ")).([]byte) - rw.Write(envJSON) -} - -func HandleError(result interface{}, err error) (r interface{}) { - if err != nil { - print("ERROR : " + err.Error()) - //panic(err) - } - return result -} diff --git a/release-0.19.0/examples/k8petstore/web-server/dump.rdb b/release-0.19.0/examples/k8petstore/web-server/dump.rdb deleted file mode 100644 index d1028f16798018ff444a1f08941f303959c9a2e1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 88 zcmWG?b@2=~FfcIt$H2vvZBdX~Qe2W>lzQ02;UddL1_p*>3e56C3=CXZiIt^!nI(n> r20WZVCCNF7nMJAG97V;2rHRZ%sVQ6!W+^bH{QrNWD*9-6)CNZY%u^nB diff --git a/release-0.19.0/examples/k8petstore/web-server/static/histogram.js b/release-0.19.0/examples/k8petstore/web-server/static/histogram.js deleted file mode 100644 index c9f20203e35..00000000000 --- a/release-0.19.0/examples/k8petstore/web-server/static/histogram.js +++ /dev/null @@ -1,39 +0,0 @@ -//var data = [4, 8, 15, 16, 23, 42]; - -function defaults(){ - - Chart.defaults.global.animation = false; - -} - -function f(data2) { - - defaults(); - - // Get context with jQuery - using jQuery's .get() method. - var ctx = $("#myChart").get(0).getContext("2d"); - ctx.width = $(window).width()*1.5; - ctx.width = $(window).height *.5; - - // This will get the first returned node in the jQuery collection. - var myNewChart = new Chart(ctx); - - var data = { - labels: Array.apply(null, Array(data2.length)).map(function (_, i) {return i;}), - datasets: [ - { - label: "My First dataset", - fillColor: "rgba(220,220,220,0.2)", - strokeColor: "rgba(220,220,220,1)", - pointColor: "rgba(220,220,220,1)", - pointStrokeColor: "#fff", - pointHighlightFill: "#fff", - pointHighlightStroke: "rgba(220,220,220,1)", - data: data2 - } - ] - }; - - var myLineChart = new Chart(ctx).Line(data); -} - diff --git a/release-0.19.0/examples/k8petstore/web-server/static/index.html b/release-0.19.0/examples/k8petstore/web-server/static/index.html deleted file mode 100644 index b184ab0e782..00000000000 --- a/release-0.19.0/examples/k8petstore/web-server/static/index.html +++ /dev/null @@ -1,47 +0,0 @@ - - - - - - - - - - - - - - ((( - PRODUCTION -))) Guestbook - - - - - - - - - - - - -
    -
    -

    Waiting for database connection...This will get overwritten...

    -
    -     		-
    -
    -

    -

    /env - /info

    -
    -
    - -
    - - - diff --git a/release-0.19.0/examples/k8petstore/web-server/static/script.js b/release-0.19.0/examples/k8petstore/web-server/static/script.js deleted file mode 100644 index 095d161fdfe..00000000000 --- a/release-0.19.0/examples/k8petstore/web-server/static/script.js +++ /dev/null @@ -1,72 +0,0 @@ -$(document).ready(function() { - - var max_trials=1000 - - var headerTitleElement = $("#header h1"); - var entriesElement = $("#k8petstore-entries"); - var hostAddressElement = $("#k8petstore-host-address"); - var currentEntries = [] - - var updateEntryCount = function(data, trial) { - if(currentEntries.length > 1000) - currentEntries.splice(0,100); - //console.info("entry count " + data) ; - currentEntries[trial]=data ; - } - - var updateEntries = function(data) { - entriesElement.empty(); - //console.info("data - > " + Math.random()) - //uncommend for debugging... - //entriesElement.append("

    CURRENT TIME : "+ $.now() +"

    TOTAL entries : "+ JSON.stringify(currentEntries)+"

    ") - var c1 = currentEntries[currentEntries.length-1] - var c2 = currentEntries[currentEntries.length-2] - entriesElement.append("

    CURRENT TIME : "+ $.now() +"

    TOTAL entries : "+ c1 +"
    transaction delta " + (c1-c2) +"

    ") - f(currentEntries); - $.each(data, function(key, val) { - //console.info(key + " -> " +val); - entriesElement.append("

    " + key + " " + val.substr(0,50) + val.substr(100,150) + "

    "); - }); - - } - - // colors = purple, blue, red, green, yellow - var colors = ["#549", "#18d", "#d31", "#2a4", "#db1"]; - var randomColor = colors[Math.floor(5 * Math.random())]; - ( - function setElementsColor(color) { - headerTitleElement.css("color", color); - }) - - (randomColor); - - hostAddressElement.append(document.URL); - - // Poll every second. - (function fetchGuestbook() { - - // Get JSON by running the query, and append - $.getJSON("lrange/k8petstore").done(updateEntries).always( - function() { - setTimeout(fetchGuestbook, 2000); - }); - })(); - - (function fetchLength(trial) { - $.getJSON("llen").done( - function a(llen1){ - updateEntryCount(llen1, trial) - }).always( - function() { - // This function is run every 2 seconds. - setTimeout( - function(){ - trial+=1 ; - fetchLength(trial); - f(); - }, 5000); - } - ) - })(0); -}); - diff --git a/release-0.19.0/examples/k8petstore/web-server/static/style.css b/release-0.19.0/examples/k8petstore/web-server/static/style.css deleted file mode 100644 index 36852934520..00000000000 --- a/release-0.19.0/examples/k8petstore/web-server/static/style.css +++ /dev/null @@ -1,69 +0,0 @@ -body, input { - color: #123; - font-family: "Gill Sans", sans-serif; -} - -div { - overflow: hidden; - padding: 1em 0; - position: relative; - text-align: center; -} - -h1, h2, p, input, a { - font-weight: 300; - margin: 0; -} - -h1 { - color: #BDB76B; - font-size: 3.5em; -} - -h2 { - color: #999; -} - -form { - margin: 0 auto; - max-width: 50em; - text-align: center; -} - -input { - border: 0; - border-radius: 1000px; - box-shadow: inset 0 0 0 2px #BDB76B; - display: inline; - font-size: 1.5em; - margin-bottom: 1em; - outline: none; - padding: .5em 5%; - width: 55%; -} - -form a { - background: #BDB76B; - border: 0; - border-radius: 1000px; - color: #FFF; - font-size: 1.25em; - font-weight: 400; - padding: .75em 2em; - text-decoration: none; - text-transform: uppercase; - white-space: normal; -} - -p { - font-size: 1.5em; - line-height: 1.5; -} -.chart div { - font: 10px sans-serif; - background-color: steelblue; - text-align: right; - padding: 3px; - margin: 1px; - color: white; -} diff --git a/release-0.19.0/examples/k8petstore/web-server/test.sh b/release-0.19.0/examples/k8petstore/web-server/test.sh deleted file mode 100644 index 7b8b0eacd10..00000000000 --- a/release-0.19.0/examples/k8petstore/web-server/test.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -echo "start test of frontend" -curl localhost:3000/llen -curl localhost:3000/llen -curl localhost:3000/llen -curl localhost:3000/llen -curl localhost:3000/llen -curl localhost:3000/llen -x=`curl localhost:3000/llen` -echo "done testing frontend result = $x" diff --git a/release-0.19.0/examples/kubectl-container/.gitignore b/release-0.19.0/examples/kubectl-container/.gitignore deleted file mode 100644 index 50a4a06fd1d..00000000000 --- a/release-0.19.0/examples/kubectl-container/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -kubectl -.tag diff --git a/release-0.19.0/examples/kubectl-container/Dockerfile b/release-0.19.0/examples/kubectl-container/Dockerfile deleted file mode 100644 index d27d3573644..00000000000 --- a/release-0.19.0/examples/kubectl-container/Dockerfile +++ /dev/null @@ -1,18 +0,0 @@ -# Copyright 2014 Google Inc. All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -FROM scratch -MAINTAINER Daniel Smith -ADD kubectl kubectl -ENTRYPOINT ["/kubectl"] diff --git a/release-0.19.0/examples/kubectl-container/Makefile b/release-0.19.0/examples/kubectl-container/Makefile deleted file mode 100644 index b13b09d2ec4..00000000000 --- a/release-0.19.0/examples/kubectl-container/Makefile +++ /dev/null @@ -1,30 +0,0 @@ -# Use: -# -# `make kubectl` will build kubectl. -# `make tag` will suggest a tag. -# `make container` will build a container-- you must supply a tag. -# `make push` will push the container-- you must supply a tag. - -kubectl: - KUBE_STATIC_OVERRIDES="kubectl" ../../hack/build-go.sh cmd/kubectl; cp ../../_output/local/bin/linux/amd64/kubectl . - -.tag: kubectl - ./kubectl version -c | grep -o 'GitVersion:"[^"]*"' | cut -f 2 -d '"' > .tag - -tag: .tag - @echo "Suggest using TAG=$(shell cat .tag)" - @echo "$$ make container TAG=$(shell cat .tag)" - @echo "or" - @echo "$$ make push TAG=$(shell cat .tag)" - -container: - $(if $(TAG),,$(error TAG is not defined. Use 'make tag' to see a suggestion)) - docker build -t gcr.io/google_containers/kubectl:$(TAG) . - -push: container - $(if $(TAG),,$(error TAG is not defined. Use 'make tag' to see a suggestion)) - gcloud preview docker push gcr.io/google_containers/kubectl:$(TAG) - -clean: - rm -f kubectl - rm -f .tag diff --git a/release-0.19.0/examples/kubectl-container/README.md b/release-0.19.0/examples/kubectl-container/README.md deleted file mode 100644 index 697d1a9699f..00000000000 --- a/release-0.19.0/examples/kubectl-container/README.md +++ /dev/null @@ -1,24 +0,0 @@ -This directory contains a Dockerfile and Makefile for packaging up kubectl into -a container. - -It's not currently automated as part of a release process, so for the moment -this is an example of what to do if you want to package kubectl into a -container/your pod. - -In the future, we may release consistently versioned groups of containers when -we cut a release, in which case the source of gcr.io/google_containers/kubectl -would become that automated process. - -```pod.json``` is provided as an example of packaging kubectl as a sidecar -container, and to help you verify that kubectl works correctly in -this configuration. - -A possible reason why you would want to do this is to use ```kubectl proxy``` as -a drop-in replacement for the old no-auth KUBERNETES_RO service. The other -containers in your pod will find the proxy apparently serving on localhost. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/kubectl-container/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/kubectl-container/README.md?pixel)]() diff --git a/release-0.19.0/examples/kubectl-container/pod.json b/release-0.19.0/examples/kubectl-container/pod.json deleted file mode 100644 index 756090862f2..00000000000 --- a/release-0.19.0/examples/kubectl-container/pod.json +++ /dev/null @@ -1,54 +0,0 @@ -{ - "kind": "Pod", - "apiVersion": "v1beta3", - "metadata": { - "name": "kubectl-tester" - }, - "spec": { - "containers": [ - { - "name": "bb", - "image": "gcr.io/google_containers/busybox", - "command": [ - "sh", "-c", "sleep 5; wget -O - ${KUBERNETES_RO_SERVICE_HOST}:${KUBERNETES_RO_SERVICE_PORT}/api/v1beta3/pods/; sleep 10000" - ], - "ports": [ - { - "containerPort": 8080, - "protocol": "TCP" - } - ], - "env": [ - { - "name": "KUBERNETES_RO_SERVICE_HOST", - "value": "127.0.0.1" - }, - { - "name": "KUBERNETES_RO_SERVICE_PORT", - "value": "8001" - } - ], - "volumeMounts": [ - { - "name": "test-volume", - "mountPath": "/mount/test-volume" - } - ] - }, - { - "name": "kubectl", - "image": "gcr.io/google_containers/kubectl:v0.18.0-120-gaeb4ac55ad12b1-dirty", - "imagePullPolicy": "Always", - "args": [ - "proxy", "-p", "8001" - ] - } - ], - "volumes": [ - { - "name": "test-volume", - "emptyDir": {} - } - ] - } -} diff --git a/release-0.19.0/examples/kubernetes-namespaces/README.md b/release-0.19.0/examples/kubernetes-namespaces/README.md deleted file mode 100644 index 8d2bae92696..00000000000 --- a/release-0.19.0/examples/kubernetes-namespaces/README.md +++ /dev/null @@ -1,255 +0,0 @@ -## Kubernetes Namespaces - -Kubernetes _[namespaces](../../docs/namespaces.md)_ help different projects, teams, or customers to share a Kubernetes cluster. - -It does this by providing the following: - -1. A scope for [Names](../../docs/identifiers.md). -2. A mechanism to attach authorization and policy to a subsection of the cluster. - -Use of multiple namespaces is optional. - -This example demonstrates how to use Kubernetes namespaces to subdivide your cluster. - -### Step Zero: Prerequisites - -This example assumes the following: - -1. You have an [existing Kubernetes cluster](../../docs/getting-started-guides). -2. You have a basic understanding of Kubernetes _[pods](../../docs/pods.md)_, _[services](../../docs/services.md)_, and _[replication controllers](../../docs/replication-controller.md)_. - -### Step One: Understand the default namespace - -By default, a Kubernetes cluster will instantiate a default namespace when provisioning the cluster to hold the default set of pods, -services, and replication controllers used by the cluster. - -Assuming you have a fresh cluster, you can introspect the available namespace's by doing the following: - -```shell -$ kubectl get namespaces -NAME LABELS -default -``` - -### Step Two: Create new namespaces - -For this exercise, we will create two additional Kubernetes namespaces to hold our content. - -Let's imagine a scenario where an organization is using a shared Kubernetes cluster for development and production use cases. - -The development team would like to maintain a space in the cluster where they can get a view on the list of pods, services, and replication-controllers -they use to build and run their application. In this space, Kubernetes resources come and go, and the restrictions on who can or cannot modify resources -are relaxed to enable agile development. - -The operations team would like to maintain a space in the cluster where they can enforce strict procedures on who can or cannot manipulate the set of -pods, services, and replication controllers that run the production site. - -One pattern this organization could follow is to partition the Kubernetes cluster into two namespaces: development and production. - -Let's create two new namespaces to hold our work. - -Use the file [`examples/kubernetes-namespaces/namespace-dev.json`](namespace-dev.json) which describes a development namespace: - -```js -{ - "kind": "Namespace", - "apiVersion": "v1beta3", - "metadata": { - "name": "development", - "labels": { - "name": "development" - } - } -} -``` - -Create the development namespace using kubectl. - -```shell -$ kubectl create -f examples/kubernetes-namespaces/namespace-dev.json -``` - -And then lets create the production namespace using kubectl. - -```shell -$ kubectl create -f examples/kubernetes-namespaces/namespace-prod.json -``` - -To be sure things are right, let's list all of the namespaces in our cluster. - -```shell -$ kubectl get namespaces -NAME LABELS STATUS -default Active -development name=development Active -production name=production Active -``` - - -### Step Three: Create pods in each namespace - -A Kubernetes namespace provides the scope for pods, services, and replication controllers in the cluster. - -Users interacting with one namespace do not see the content in another namespace. - -To demonstrate this, let's spin up a simple replication controller and pod in the development namespace. - -We first check what is the current context: - -```shell -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: REDACTED - server: https://130.211.122.180 - name: lithe-cocoa-92103_kubernetes -contexts: -- context: - cluster: lithe-cocoa-92103_kubernetes - user: lithe-cocoa-92103_kubernetes - name: lithe-cocoa-92103_kubernetes -current-context: lithe-cocoa-92103_kubernetes -kind: Config -preferences: {} -users: -- name: lithe-cocoa-92103_kubernetes - user: - client-certificate-data: REDACTED - client-key-data: REDACTED - token: 65rZW78y8HbwXXtSXuUw9DbP4FLjHi4b -- name: lithe-cocoa-92103_kubernetes-basic-auth - user: - password: h5M0FtUUIflBSdI7 - username: admin -``` - -The next step is to define a context for the kubectl client to work in each namespace. The value of "cluster" and "user" fields are copied from the current context. - -```shell -$ kubectl config set-context dev --namespace=development --cluster=lithe-cocoa-92103_kubernetes --user=lithe-cocoa-92103_kubernetes -$ kubectl config set-context prod --namespace=production --cluster=lithe-cocoa-92103_kubernetes --user=lithe-cocoa-92103_kubernetes -``` - -The above commands provided two request contexts you can alternate against depending on what namespace you -wish to work against. - -Let's switch to operate in the development namespace. - -```shell -$ kubectl config use-context dev -``` - -You can verify your current context by doing the following: - -```shell -$ kubectl config view -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: REDACTED - server: https://130.211.122.180 - name: lithe-cocoa-92103_kubernetes -contexts: -- context: - cluster: lithe-cocoa-92103_kubernetes - namespace: development - user: lithe-cocoa-92103_kubernetes - name: dev -- context: - cluster: lithe-cocoa-92103_kubernetes - user: lithe-cocoa-92103_kubernetes - name: lithe-cocoa-92103_kubernetes -- context: - cluster: lithe-cocoa-92103_kubernetes - namespace: production - user: lithe-cocoa-92103_kubernetes - name: prod -current-context: dev -kind: Config -preferences: {} -users: -- name: lithe-cocoa-92103_kubernetes - user: - client-certificate-data: REDACTED - client-key-data: REDACTED - token: 65rZW78y8HbwXXtSXuUw9DbP4FLjHi4b -- name: lithe-cocoa-92103_kubernetes-basic-auth - user: - password: h5M0FtUUIflBSdI7 - username: admin -``` - -At this point, all requests we make to the Kubernetes cluster from the command line are scoped to the development namespace. - -Let's create some content. - -```shell -$ kubectl run snowflake --image=kubernetes/serve_hostname --replicas=2 -``` - -We have just created a replication controller whose replica size is 2 that is running the pod called snowflake with a basic container that just serves the hostname. - -```shell -kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -snowflake snowflake kubernetes/serve_hostname run=snowflake 2 - -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -snowflake-mbrfi 10.244.2.4 kubernetes-minion-ilqx/104.197.8.214 run=snowflake Running About an hour - snowflake kubernetes/serve_hostname Running About an hour -snowflake-p78ev 10.244.2.5 kubernetes-minion-ilqx/104.197.8.214 run=snowflake Running About an hour - snowflake kubernetes/serve_hostname Running About an hour -``` - -And this is great, developers are able to do what they want, and they do not have to worry about affecting content in the production namespace. - -Let's switch to the production namespace and show how resources in one namespace are hidden from the other. - -```shell -$ kubectl config use-context prod -``` - -The production namespace should be empty. - -```shell -$ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS - -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -``` - -Production likes to run cattle, so let's create some cattle pods. - -```shell -$ kubectl run cattle --image=kubernetes/serve_hostname --replicas=5 - -$ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -cattle cattle kubernetes/serve_hostname run=cattle 5 - -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -cattle-1kyvj 10.244.0.4 kubernetes-minion-7s1y/23.236.54.97 run=cattle Running About an hour - cattle kubernetes/serve_hostname Running About an hour -cattle-kobrk 10.244.1.4 kubernetes-minion-cfs6/104.154.61.231 run=cattle Running About an hour - cattle kubernetes/serve_hostname Running About an hour -cattle-l1v9t 10.244.0.5 kubernetes-minion-7s1y/23.236.54.97 run=cattle Running About an hour - cattle kubernetes/serve_hostname Running About an hour -cattle-ne2sj 10.244.3.7 kubernetes-minion-x8gx/104.154.47.83 run=cattle Running About an hour - cattle kubernetes/serve_hostname Running About an hour -cattle-qrk4x 10.244.0.6 kubernetes-minion-7s1y/23.236.54.97 run=cattle Running About an hour - cattle kubernetes/serve_hostname -``` - -At this point, it should be clear that the resources users create in one namespace are hidden from the other namespace. - -As the policy support in Kubernetes evolves, we will extend this scenario to show how you can provide different -authorization rules for each namespace. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/kubernetes-namespaces/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/kubernetes-namespaces/README.md?pixel)]() diff --git a/release-0.19.0/examples/kubernetes-namespaces/namespace-dev.json b/release-0.19.0/examples/kubernetes-namespaces/namespace-dev.json deleted file mode 100644 index 2561e92a38f..00000000000 --- a/release-0.19.0/examples/kubernetes-namespaces/namespace-dev.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "kind": "Namespace", - "apiVersion": "v1beta3", - "metadata": { - "name": "development", - "labels": { - "name": "development" - } - } -} diff --git a/release-0.19.0/examples/kubernetes-namespaces/namespace-prod.json b/release-0.19.0/examples/kubernetes-namespaces/namespace-prod.json deleted file mode 100644 index 149183c94ab..00000000000 --- a/release-0.19.0/examples/kubernetes-namespaces/namespace-prod.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "kind": "Namespace", - "apiVersion": "v1beta3", - "metadata": { - "name": "production", - "labels": { - "name": "production" - } - } -} diff --git a/release-0.19.0/examples/limitrange/README.md b/release-0.19.0/examples/limitrange/README.md deleted file mode 100644 index ea330d924ad..00000000000 --- a/release-0.19.0/examples/limitrange/README.md +++ /dev/null @@ -1,7 +0,0 @@ -Please refer to this [doc](https://github.com/GoogleCloudPlatform/kubernetes/blob/620af168920b773ade28e27211ad684903a1db21/docs/design/admission_control_limit_range.md#kubectl). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/limitrange/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/limitrange/README.md?pixel)]() diff --git a/release-0.19.0/examples/limitrange/invalid-pod.json b/release-0.19.0/examples/limitrange/invalid-pod.json deleted file mode 100644 index 3c622859f81..00000000000 --- a/release-0.19.0/examples/limitrange/invalid-pod.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "apiVersion":"v1beta3", - "kind": "Pod", - "metadata": { - "name": "invalid-pod", - "labels": { - "name": "invalid-pod" - } - }, - "spec": { - "containers": [{ - "name": "kubernetes-serve-hostname", - "image": "gcr.io/google_containers/serve_hostname", - "resources": { - "limits": { - "cpu": "10m", - "memory": "5Mi" - } - } - }] - } -} diff --git a/release-0.19.0/examples/limitrange/limit-range.json b/release-0.19.0/examples/limitrange/limit-range.json deleted file mode 100644 index c27e9f14fe1..00000000000 --- a/release-0.19.0/examples/limitrange/limit-range.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "apiVersion": "v1beta3", - "kind": "LimitRange", - "metadata": { - "name": "limits" - }, - "spec": { - "limits": [ - { - "type": "Pod", - "max": { - "memory": "1Gi", - "cpu": "2" - }, - "min": { - "memory": "6Mi", - "cpu": "250m" - } - }, - { - "type": "Container", - "max": { - "memory": "1Gi", - "cpu": "2" - }, - "min": { - "memory": "6Mi", - "cpu": "250m" - }, - "default": { - "memory": "6Mi", - "cpu": "250m" - } - } - ] - } -} diff --git a/release-0.19.0/examples/limitrange/valid-pod.json b/release-0.19.0/examples/limitrange/valid-pod.json deleted file mode 100644 index 350a844d2ca..00000000000 --- a/release-0.19.0/examples/limitrange/valid-pod.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "apiVersion":"v1beta3", - "kind": "Pod", - "metadata": { - "name": "valid-pod", - "labels": { - "name": "valid-pod" - } - }, - "spec": { - "containers": [{ - "name": "kubernetes-serve-hostname", - "image": "gcr.io/google_containers/serve_hostname", - "resources": { - "limits": { - "cpu": "1", - "memory": "6Mi" - } - } - }] - } -} diff --git a/release-0.19.0/examples/liveness/README.md b/release-0.19.0/examples/liveness/README.md deleted file mode 100644 index 16689ac0365..00000000000 --- a/release-0.19.0/examples/liveness/README.md +++ /dev/null @@ -1,82 +0,0 @@ -## Overview -This example shows two types of pod health checks: HTTP checks and container execution checks. - -The [exec-liveness.yaml](./exec-liveness.yaml) demonstrates the container execution check. -``` - livenessProbe: - exec: - command: - - cat - - /tmp/health - initialDelaySeconds: 15 - timeoutSeconds: 1 -``` -Kubelet executes the command cat /tmp/health in the container and reports failure if the command returns a non-zero exit code. - -Note that the container removes the /tmp/health file after 10 seconds, -``` -echo ok > /tmp/health; sleep 10; rm -rf /tmp/health; sleep 600 -``` -so when Kubelet executes the health check 15 seconds (defined by initialDelaySeconds) after the container started, the check would fail. - - -The [http-liveness.yaml](http-liveness.yaml) demonstrates the HTTP check. -``` - livenessProbe: - httpGet: - path: /healthz - port: 8080 - initialDelaySeconds: 15 - timeoutSeconds: 1 -``` -The Kubelet sends a HTTP request to the specified path and port to perform the health check. If you take a look at image/server.go, you will see the server starts to respond with an error code 500 after 10 seconds, so the check fails. - -This [guide](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/walkthrough/k8s201.md#health-checking) has more information on health checks. - -## Get your hands dirty -To show the health check is actually working, first create the pods: -``` -# kubectl create -f exec-liveness.yaml -# cluster/kbuectl.sh create -f http-liveness.yaml -``` - -Check the status of the pods once they are created: -``` -# kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -liveness-exec 10.244.3.7 kubernetes-minion-f08h/130.211.122.180 test=liveness Running 3 seconds - liveness gcr.io/google_containers/busybox Running 2 seconds -liveness-http 10.244.0.8 kubernetes-minion-0bks/104.197.10.10 test=liveness Running 3 seconds - liveness gcr.io/google_containers/liveness Running 2 seconds -``` - -Check the status half a minute later, you will see the termination messages: -``` -# kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -liveness-exec 10.244.3.7 kubernetes-minion-f08h/130.211.122.180 test=liveness Running 34 seconds - liveness gcr.io/google_containers/busybox Running 3 seconds last termination: exit code 137 -liveness-http 10.244.0.8 kubernetes-minion-0bks/104.197.10.10 test=liveness Running 34 seconds - liveness gcr.io/google_containers/liveness Running 13 seconds last termination: exit code 2 -``` -The termination messages indicate that the liveness probes have failed, and the containers have been killed and recreated. - -You can also see the container restart count being incremented by running `kubectl describe`. -``` -# kubectl describe pods liveness-exec | grep "Restart Count" -Restart Count: 8 -``` - -You would also see the killing and creating events at the bottom of the *kubectl describe* output: -``` - Thu, 14 May 2015 15:23:25 -0700 Thu, 14 May 2015 15:23:25 -0700 1 {kubelet kubernetes-minion-0uzf} spec.containers{liveness} killing Killing 88c8b717d8b0940d52743c086b43c3fad0d725a36300b9b5f0ad3a1c8cef2d3e - Thu, 14 May 2015 15:23:25 -0700 Thu, 14 May 2015 15:23:25 -0700 1 {kubelet kubernetes-minion-0uzf} spec.containers{liveness} created Created with docker id b254a9810073f9ee9075bb38ac29a4b063647176ad9eabd9184078ca98a60062 - Thu, 14 May 2015 15:23:25 -0700 Thu, 14 May 2015 15:23:25 -0700 1 {kubelet kubernetes-minion-0uzf} spec.containers{liveness} started Started with docker id b254a9810073f9ee9075bb38ac29a4b063647176ad9eabd9184078ca98a60062 - ... -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/liveness/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/liveness/README.md?pixel)]() diff --git a/release-0.19.0/examples/liveness/exec-liveness.yaml b/release-0.19.0/examples/liveness/exec-liveness.yaml deleted file mode 100644 index b72dac0f595..00000000000 --- a/release-0.19.0/examples/liveness/exec-liveness.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - test: liveness - name: liveness-exec -spec: - containers: - - args: - - /bin/sh - - -c - - echo ok > /tmp/health; sleep 10; rm -rf /tmp/health; sleep 600 - image: gcr.io/google_containers/busybox - livenessProbe: - exec: - command: - - cat - - /tmp/health - initialDelaySeconds: 15 - timeoutSeconds: 1 - name: liveness diff --git a/release-0.19.0/examples/liveness/http-liveness.yaml b/release-0.19.0/examples/liveness/http-liveness.yaml deleted file mode 100644 index 36d3d70caf0..00000000000 --- a/release-0.19.0/examples/liveness/http-liveness.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - test: liveness - name: liveness-http -spec: - containers: - - args: - - /server - image: gcr.io/google_containers/liveness - livenessProbe: - httpGet: - path: /healthz - port: 8080 - initialDelaySeconds: 15 - timeoutSeconds: 1 - name: liveness diff --git a/release-0.19.0/examples/liveness/image/Dockerfile b/release-0.19.0/examples/liveness/image/Dockerfile deleted file mode 100644 index d057ecd309e..00000000000 --- a/release-0.19.0/examples/liveness/image/Dockerfile +++ /dev/null @@ -1,4 +0,0 @@ -FROM scratch - -ADD server /server - diff --git a/release-0.19.0/examples/liveness/image/Makefile b/release-0.19.0/examples/liveness/image/Makefile deleted file mode 100644 index c123ac6df9d..00000000000 --- a/release-0.19.0/examples/liveness/image/Makefile +++ /dev/null @@ -1,13 +0,0 @@ -all: push - -server: server.go - CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -ldflags '-w' ./server.go - -container: server - docker build -t gcr.io/google_containers/liveness . - -push: container - gcloud preview docker push gcr.io/google_containers/liveness - -clean: - rm -f server diff --git a/release-0.19.0/examples/liveness/image/server.go b/release-0.19.0/examples/liveness/image/server.go deleted file mode 100644 index 26c337e767b..00000000000 --- a/release-0.19.0/examples/liveness/image/server.go +++ /dev/null @@ -1,46 +0,0 @@ -/* -Copyright 2014 The Kubernetes Authors All rights reserved. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// A simple server that is alive for 10 seconds, then reports unhealthy for -// the rest of its (hopefully) short existence. -package main - -import ( - "fmt" - "log" - "net/http" - "time" -) - -func main() { - started := time.Now() - http.HandleFunc("/started", func(w http.ResponseWriter, r *http.Request) { - w.WriteHeader(200) - data := (time.Now().Sub(started)).String() - w.Write([]byte(data)) - }) - http.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) { - duration := time.Now().Sub(started) - if duration.Seconds() > 10 { - w.WriteHeader(500) - w.Write([]byte(fmt.Sprintf("error: %v", duration.Seconds()))) - } else { - w.WriteHeader(200) - w.Write([]byte("ok")) - } - }) - log.Fatal(http.ListenAndServe(":8080", nil)) -} diff --git a/release-0.19.0/examples/logging-demo/Makefile b/release-0.19.0/examples/logging-demo/Makefile deleted file mode 100644 index c847f9d6b35..00000000000 --- a/release-0.19.0/examples/logging-demo/Makefile +++ /dev/null @@ -1,34 +0,0 @@ -# Makefile for launching syntheitc logging sources (any platform) -# and for reporting the forwarding rules for the -# Elasticsearch and Kibana pods for the GCE platform. - - -.PHONY: up down logger-up logger-down logger10-up logger10-downget net - -KUBECTL=../../cluster/kubectl.sh - -up: logger-up logger10-up - -down: logger-down logger10-down - - -logger-up: - -${KUBECTL} create -f synthetic_0_25lps.yaml - -logger-down: - -${KUBECTL} delete pods synthetic-logger-0.25lps-pod - -logger10-up: - -${KUBECTL} create -f synthetic_10lps.yaml - -logger10-down: - -${KUBECTL} delete pods synthetic-logger-10lps-pod - -get: - ${KUBECTL} get pods - ${KUBECTL} get replicationControllers - ${KUBECTL} get services - -net: - ${KUBECTL} get services elasticsearch-logging -o json - ${KUBECTL} get services kibana-logging -o json diff --git a/release-0.19.0/examples/logging-demo/README.md b/release-0.19.0/examples/logging-demo/README.md deleted file mode 100644 index 159eb353589..00000000000 --- a/release-0.19.0/examples/logging-demo/README.md +++ /dev/null @@ -1,248 +0,0 @@ -# Elasticsearch/Kibana Logging Demonstration -This directory contains two [pod](../../docs/pods.md) specifications which can be used as synthetic -logging sources. The pod specification in [synthetic_0_25lps.yaml](synthetic_0_25lps.yaml) -describes a pod that just emits a log message once every 4 seconds: -``` -# This pod specification creates an instance of a synthetic logger. The logger -# is simply a program that writes out the hostname of the pod, a count which increments -# by one on each iteration (to help notice missing log enteries) and the date using -# a long format (RFC-3339) to nano-second precision. This program logs at a frequency -# of 0.25 lines per second. The shellscript program is given directly to bash as -c argument -# and could have been written out as: -# i="0" -# while true -# do -# echo -n "`hostname`: $i: " -# date --rfc-3339 ns -# sleep 4 -# i=$[$i+1] -# done -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - name: synth-logging-source - name: synthetic-logger-0.25lps-pod -spec: - containers: - - args: - - bash - - -c - - 'i="0"; while true; do echo -n "`hostname`: $i: "; date --rfc-3339 ns; sleep - 4; i=$[$i+1]; done' - image: ubuntu:14.04 - name: synth-lgr -``` - -The other YAML file [synthetic_10lps.yaml](synthetic_10lps.yaml) specifies a similar synthetic logger that emits 10 log messages every second. To run both synthetic loggers: -``` -$ make up -../../../kubectl.sh create -f synthetic_0_25lps.yaml -Running: ../../../cluster/../cluster/gce/../../_output/dockerized/bin/linux/amd64/kubectl create -f synthetic_0_25lps.yaml -synthetic-logger-0.25lps-pod -../../../kubectl.sh create -f synthetic_10lps.yaml -Running: ../../../cluster/../cluster/gce/../../_output/dockerized/bin/linux/amd64/kubectl create -f synthetic_10lps.yaml -synthetic-logger-10lps-pod - -``` - -Visiting the Kibana dashboard should make it clear that logs are being collected from the two synthetic loggers: -![Synthetic loggers](synth-logger.png) - -You can report the running pods, [replication controllers](../../docs/replication-controller.md), and [services](../../docs/services.md) with another Makefile rule: -``` -$ make get -../../../kubectl.sh get pods -Running: ../../../../cluster/gce/../../_output/dockerized/bin/linux/amd64/kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -elasticsearch-logging-f0smz 10.244.2.3 kubernetes-minion-ilqx/104.197.8.214 kubernetes.io/cluster-service=true,name=elasticsearch-logging Running 5 hours - elasticsearch-logging gcr.io/google_containers/elasticsearch:1.0 Running 5 hours -etcd-server-kubernetes-master kubernetes-master/ Running 5 hours - etcd-container gcr.io/google_containers/etcd:2.0.9 Running 5 hours -fluentd-elasticsearch-kubernetes-minion-7s1y 10.244.0.2 kubernetes-minion-7s1y/23.236.54.97 Running 5 hours - fluentd-elasticsearch gcr.io/google_containers/fluentd-elasticsearch:1.5 Running 5 hours -fluentd-elasticsearch-kubernetes-minion-cfs6 10.244.1.2 kubernetes-minion-cfs6/104.154.61.231 Running 5 hours - fluentd-elasticsearch gcr.io/google_containers/fluentd-elasticsearch:1.5 Running 5 hours -fluentd-elasticsearch-kubernetes-minion-ilqx 10.244.2.2 kubernetes-minion-ilqx/104.197.8.214 Running 5 hours - fluentd-elasticsearch gcr.io/google_containers/fluentd-elasticsearch:1.5 Running 5 hours -fluentd-elasticsearch-kubernetes-minion-x8gx 10.244.3.2 kubernetes-minion-x8gx/104.154.47.83 Running 5 hours - fluentd-elasticsearch gcr.io/google_containers/fluentd-elasticsearch:1.5 Running 5 hours -kibana-logging-cwe0b 10.244.1.3 kubernetes-minion-cfs6/104.154.61.231 kubernetes.io/cluster-service=true,name=kibana-logging Running 5 hours - kibana-logging gcr.io/google_containers/kibana:1.2 Running 5 hours -kube-apiserver-kubernetes-master kubernetes-master/ Running 5 hours - kube-apiserver gcr.io/google_containers/kube-apiserver:f0c332fc2582927ec27d24965572d4b0 Running 5 hours -kube-controller-manager-kubernetes-master kubernetes-master/ Running 5 hours - kube-controller-manager gcr.io/google_containers/kube-controller-manager:6729154dfd4e2a19752bdf9ceff8464c Running 5 hours -kube-dns-swd4n 10.244.3.5 kubernetes-minion-x8gx/104.154.47.83 k8s-app=kube-dns,kubernetes.io/cluster-service=true,name=kube-dns Running 5 hours - kube2sky gcr.io/google_containers/kube2sky:1.2 Running 5 hours - etcd quay.io/coreos/etcd:v2.0.3 Running 5 hours - skydns gcr.io/google_containers/skydns:2015-03-11-001 Running 5 hours -kube-scheduler-kubernetes-master kubernetes-master/ Running 5 hours - kube-scheduler gcr.io/google_containers/kube-scheduler:ec9d2092f754211cc5ab3a5162c05fc1 Running 5 hours -monitoring-heapster-controller-zpjj1 10.244.3.3 kubernetes-minion-x8gx/104.154.47.83 kubernetes.io/cluster-service=true,name=heapster Running 5 hours - heapster gcr.io/google_containers/heapster:v0.10.0 Running 5 hours -monitoring-influx-grafana-controller-dqan4 10.244.3.4 kubernetes-minion-x8gx/104.154.47.83 kubernetes.io/cluster-service=true,name=influxGrafana Running 5 hours - grafana gcr.io/google_containers/heapster_grafana:v0.6 Running 5 hours - influxdb gcr.io/google_containers/heapster_influxdb:v0.3 Running 5 hours -synthetic-logger-0.25lps-pod 10.244.0.7 kubernetes-minion-7s1y/23.236.54.97 name=synth-logging-source Running 19 minutes - synth-lgr ubuntu:14.04 Running 19 minutes -synthetic-logger-10lps-pod 10.244.3.14 kubernetes-minion-x8gx/104.154.47.83 name=synth-logging-source Running 19 minutes - synth-lgr ubuntu:14.04 Running 19 minutes -../../_output/local/bin/linux/amd64/kubectl get replicationControllers -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -elasticsearch-logging elasticsearch-logging gcr.io/google_containers/elasticsearch:1.0 name=elasticsearch-logging 1 -kibana-logging kibana-logging gcr.io/google_containers/kibana:1.2 name=kibana-logging 1 -kube-dns etcd quay.io/coreos/etcd:v2.0.3 k8s-app=kube-dns 1 - kube2sky gcr.io/google_containers/kube2sky:1.2 - skydns gcr.io/google_containers/skydns:2015-03-11-001 -monitoring-heapster-controller heapster gcr.io/google_containers/heapster:v0.10.0 name=heapster 1 -monitoring-influx-grafana-controller influxdb gcr.io/google_containers/heapster_influxdb:v0.3 name=influxGrafana 1 - grafana gcr.io/google_containers/heapster_grafana:v0.6 -../../_output/local/bin/linux/amd64/kubectl get services -NAME LABELS SELECTOR IP(S) PORT(S) -elasticsearch-logging kubernetes.io/cluster-service=true,name=elasticsearch-logging name=elasticsearch-logging 10.0.251.221 9200/TCP -kibana-logging kubernetes.io/cluster-service=true,name=kibana-logging name=kibana-logging 10.0.188.118 5601/TCP -kube-dns k8s-app=kube-dns,kubernetes.io/cluster-service=true,name=kube-dns k8s-app=kube-dns 10.0.0.10 53/UDP -kubernetes component=apiserver,provider=kubernetes 10.0.0.2 443/TCP -monitoring-grafana kubernetes.io/cluster-service=true,name=grafana name=influxGrafana 10.0.254.202 80/TCP -monitoring-heapster kubernetes.io/cluster-service=true,name=heapster name=heapster 10.0.19.214 80/TCP -monitoring-influxdb name=influxGrafana name=influxGrafana 10.0.198.71 80/TCP -monitoring-influxdb-ui name=influxGrafana name=influxGrafana 10.0.109.66 80/TCP -``` - -The `net` rule in the Makefile will report information about the Elasticsearch and Kibana services including the public IP addresses of each service. -``` -$ make net -../../../kubectl.sh get services elasticsearch-logging -o json -current-context: "lithe-cocoa-92103_kubernetes" -Running: ../../_output/local/bin/linux/amd64/kubectl get services elasticsearch-logging -o json -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "elasticsearch-logging", - "namespace": "default", - "selfLink": "/api/v1beta3/namespaces/default/services/elasticsearch-logging", - "uid": "9dc7290f-f358-11e4-a58e-42010af09a93", - "resourceVersion": "28", - "creationTimestamp": "2015-05-05T18:57:45Z", - "labels": { - "kubernetes.io/cluster-service": "true", - "name": "elasticsearch-logging" - } - }, - "spec": { - "ports": [ - { - "name": "", - "protocol": "TCP", - "port": 9200, - "targetPort": "es-port" - } - ], - "selector": { - "name": "elasticsearch-logging" - }, - "portalIP": "10.0.251.221", - "sessionAffinity": "None" - }, - "status": {} -} -current-context: "lithe-cocoa-92103_kubernetes" -Running: ../../_output/local/bin/linux/amd64/kubectl get services kibana-logging -o json -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "kibana-logging", - "namespace": "default", - "selfLink": "/api/v1beta3/namespaces/default/services/kibana-logging", - "uid": "9dc6f856-f358-11e4-a58e-42010af09a93", - "resourceVersion": "31", - "creationTimestamp": "2015-05-05T18:57:45Z", - "labels": { - "kubernetes.io/cluster-service": "true", - "name": "kibana-logging" - } - }, - "spec": { - "ports": [ - { - "name": "", - "protocol": "TCP", - "port": 5601, - "targetPort": "kibana-port" - } - ], - "selector": { - "name": "kibana-logging" - }, - "portalIP": "10.0.188.118", - "sessionAffinity": "None" - }, - "status": {} -} -``` -To find the URLs to access the Elasticsearch and Kibana viewer, -``` -$ kubectl cluster-info -Kubernetes master is running at https://130.211.122.180 -elasticsearch-logging is running at https://130.211.122.180/api/v1beta3/proxy/namespaces/default/services/elasticsearch-logging -kibana-logging is running at https://130.211.122.180/api/v1beta3/proxy/namespaces/default/services/kibana-logging -kube-dns is running at https://130.211.122.180/api/v1beta3/proxy/namespaces/default/services/kube-dns -grafana is running at https://130.211.122.180/api/v1beta3/proxy/namespaces/default/services/monitoring-grafana -heapster is running at https://130.211.122.180/api/v1beta3/proxy/namespaces/default/services/monitoring-heapster -``` - -To find the user name and password to access the URLs, -``` -$ kubectl config view -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: REDACTED - server: https://130.211.122.180 - name: lithe-cocoa-92103_kubernetes -contexts: -- context: - cluster: lithe-cocoa-92103_kubernetes - user: lithe-cocoa-92103_kubernetes - name: lithe-cocoa-92103_kubernetes -current-context: lithe-cocoa-92103_kubernetes -kind: Config -preferences: {} -users: -- name: lithe-cocoa-92103_kubernetes - user: - client-certificate-data: REDACTED - client-key-data: REDACTED - token: 65rZW78y8HxmXXtSXuUw9DbP4FLjHi4b -- name: lithe-cocoa-92103_kubernetes-basic-auth - user: - password: h5M0FtVXXflBSdI7 - username: admin -``` - -Access the Elasticsearch service at URL `https://130.211.122.180/api/v1beta3/proxy/namespaces/default/services/elasticsearch-logging`, use the user name 'admin' and password 'h5M0FtVXXflBSdI7', -``` -{ - "status" : 200, - "name" : "Major Mapleleaf", - "cluster_name" : "kubernetes_logging", - "version" : { - "number" : "1.4.4", - "build_hash" : "c88f77ffc81301dfa9dfd81ca2232f09588bd512", - "build_timestamp" : "2015-02-19T13:05:36Z", - "build_snapshot" : false, - "lucene_version" : "4.10.3" - }, - "tagline" : "You Know, for Search" -} -``` -Visiting the URL `https://130.211.122.180/api/v1beta3/proxy/namespaces/default/services/kibana-logging` should show the Kibana viewer for the logging information stored in the Elasticsearch service. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/logging-demo/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/logging-demo/README.md?pixel)]() diff --git a/release-0.19.0/examples/logging-demo/synth-logger.png b/release-0.19.0/examples/logging-demo/synth-logger.png deleted file mode 100644 index bd19ea3ee41dc5cd6730ce6a3f54431b09f32a85..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 89284 zcmce;bySvH*Ej0kZWV)&6c7-QE~OhqLQ13?q?=p11XNH;M7p~hq+7(BF6r*>?)WDA zdDzc;{&>$gXMFGXUBj`7&3)CHYpywevAkcu5=Fg3aOc{!Yp7x`g=DW?yUBm;+Vw{$ zf5LAbl6|3sFW0RF#pF>?P)4StC*enY8)0P|IfQ|Yy|$J9HA4%8xjuunu9d#Ng|!jF zX5)G-oZ!(lF`?)34$-S)_R4ZfB)2xLSx}s@_OWl=kijSWnmL(yCs*-pmr38SqMDM6 zX_%c+mTie`uZbFt{HQY%w!Bc?hws7F*FB_A@DI*rj#G_M)f$1 z`u=fkv^C@0;^IrVqkkQ&=vjr=uYS1p8a;#V>W8k^FE#%7_Ydzs3oc(i?cWD0wye_C z_wfneDlQ-T?*sKyFV5BXM%1X{8e0xkCkGpGypG?k>lcR#)AI5Vm8^5~^L7{KXZo$7 z)vMke9UZMYr{Ci#2qtR!xWi{rh9L%PNypBE~^w7?{;xsX}9*h zuyEzqgPZ8Y?=~mvZevlt<&5s_?VX<1;ovAm`r?U-h!8w@V59Tq-yhzTE;!A?(SQ%G zQV;*JpkUu+SeJ(OAt^F6?g7W4g8kT?hK2@uMZ?q`2j1~8EmxYL=1@ir0wSUuuVr7R z8k9SCREvy$b4Ecw65WNKG-)1s;v0m7 zQ4|sasnjNG=mOX{xWy?nZ57@078Vu;1_p+mu?n*}D5N1FAzJUYgw4&@(q)pUeU_^h z|MiTM6Gn$#QxiGouJFaFx?GMm=ADb-)XDQ{3*v^{%UCpwXRYPWW5OUQ2i z*u%)!xIL1kl6*lkB0QX4y{K!TbD+ACC#Y_5yt*60rfJcb?7>tmIzdf!b4a@WSIPY$=@=ONyuF7?%+(YWaC$UKEynl{C$HPv+w1D;et3pKL{zQY_%$+; zU@qMK<41$`$hqlhSp@~#rS234wGuC(MBD}=BcpWL?yjzUr#%x54GqSyk-@Ad*($=(dPfPetm40+4`Z=^3MrDI2{o$Xy*&X$*#A?^_)B@E=`?p#hg z^X(AiY01e|7w0F~!sZh-E*s<39^XD(zxCPE(|%(-CUvQ(s3?ZVzM-+PRG;&5Oo=3w zlRJ}TVgd3;uEY7RWImE_YMqfOb^dZxqC7>Pt)m}>$cAr8ye~tE4hFE z{CT4-R$o`wdTu-9?m}m&QXx_2c%Am|Y2i5fGk+nnrB&r#T^YR&WkUh`pxx79lKoOE zTF(!RhC3g}TU}k$<;S~xdPc*I$JAj}XJ^$NcT)Sx)YpG} zxPIc`yu)y0RbEwAb~rxfY(G7XLh4d=GFq8sNe+XNAor7(m)AnQ_WlEGJ!5^OK_L(4 zO(G(qkTgln&k478^0DK76&8MX9XT4w9xB{l8yk6QotK@HgN21DB_$=Gz8O$ZG5Reu zv_CjQuI8x1J@oCT+Otsiq#1cpQQ_vn$v5+LyPHdDuH&OV>=)V@S$|x=X*OCGfMGS$ z;P?GIvzFF`diX?sUIa{N$Bq4#6n_HDJ44sg@t+7$G{1YS#={Wwg z@oMK=Xb-!3dI-6!W;+EgPJfG%AR8KDxoyQMgKpfq6~|-0K2`6judna%ZKL*rpPHJQ zhGq%kRaI5>{QNv2ApvG7i($uOkHO(#i;0>Tq>e^~O-4n`Ul z=)}B^+q0GS8=7Tr>jnnwhl`Bu?CkF1G0OA&2o4So3=E8qkB7ua#Q*MasL;^o1})-Pt^IvsJ}1br(Gd~&LEVx3F2{is60~%5dFth4nBF3O1jXhf zC71>TRRTE*{o^i4%3X&BUQfc!e%rPx=kyZMG&!N@u0UN`Gfs%r$>~VWnfB*S%R^DUG zX6KFSu;5@J6z#$xEw{71@Ta;4ZQ%vFjcCOF2SbK&-a?7^ECzZ82AG0&kkCvA7=`ch z5;M`$)ARGY!Y?G7VOm4#$Hv9QB_t%o!!tB7A$a)kAqk1w>7k{dS6G({SsY<3fc zJ8M&Q3x}K!*4M@=OG82wEG@SnsQmo=4BI0^!o!>752rjyKBJS27aB@a3JQ9Kg!DC% zxV@We!4dSz&0SA;;i>7o#wI5xm+*Sf<_o5`9wabAb~6;z%Y%W2Mod!ji@(3WpP#<0 zv76=yqULvBpUcJB0VJQ+V0z6ePF~)3KRs@X`V-G>Igq^Dd=57-+Z<$SY8r8;HI(5l zDk>4@+sUP#vu;XhMvY?kK~58mxV1Mm zErz>2TU}j+Ar5bBZf^EOd-&MHDEkn&Yv2 z&cO?R$zbc7o10r$bm)C#W@i5A?jFG^B?q&9!u4eB?BoE4f;nRK{OknoIW;vEiR@%5 z_4M>4vn{roYk}NUlb9%I*#Zk>xDYyNa!n0CH@DMrZ$?Q;N&B1=BO*&4q)|Iaiy8u=rMn*>XS@E*o7%4Ho3&-u-Tu!^xp7ko#PQ|aO z(}MvWN)DnyhJIt+cUA0v1~fDgw@NRn4cR1ha#*M=k86aSCPM_ z-rCsOj*X7}LY?--V;Zk;48qtR!i&?YaM-dq)krK_q<=!4fARhg4-7oKunomrcw>>A z#)(mt&Mq!4Iy%!wg$v2DG*RubPb@zw?J$@W8096vG$k z9~6j2!c8C4j6zB-^7X-!w~svQ%Uw=Nva(k8On)D2Oe|QH=lQ!<+sE-&R8%Z2Es6R+ z%#nBE5l4yOaO02bjN>*}h1`oKMD*6u5}y#$OjlPnXvAb5yLT5k^cG)ZVFgW3PX{$hQ}3_8RzAyJh{2vR z)ttAAJnv-k*D%{ny*V_pV=GRFG@SO)4Qjcy&l<(jAA#|Gfu(jW?R&-0QX%#9n+#L) z%(JoaqL0kKqh74ubcp;;P0N)=xh-pt@8twWPNf;N0}-RNpaVIocddn(ZxDty$h7Y$QlbuDg@3e zr}q7*F`5YBJr4{bhW^gGPI*2r+iB0Ob0hr9UlqJ=7j2tw$TB{@v0GSBK*PW=R-~Pz z(-RUr8(edKZo+Z8t{xj3+w(I`;FWl0ZU(-9Hm_XMoK>Ur12;bI3U%sJD5jms$%BX~ zZ1v>5Z{Hrs)uf}P)uF_+t6isj}S&t zIo-lU&bZ$~Q&dv8F9>m_ytSv~@eQha_@_uebwS1OKyM!hY73?vs;tb+@87>e1-84l z$H&WyLhADicc#w$mQSNj!69ULEJ{gED5%|Up<9eq;9z0(>~44pK7U^KJ4uwr#|lak zJG+w7QhRIbm5EvbQV*3;=lQmX47oH$%_;}TCQwgT*sk=ijg)3(U2LPLh@Z4gl!VIt zEG{mFau^OLCnuNV-KBxN2?)7HKf;CO<>UPk1l0Oag=uCH{1y+`q8I_ARn}etzxjYt^ zXg)nT5?!09H9W9DkZg42=QoOpwW;wVc`1e4eeoCx@bRt7qSIYYZj&N9qh(Z7$}Q_} zn#b-F22IT7b2a)C-CdlR7#f-jGan&9`prDWEY2EOZ)k+Jqw1jUL@7^wsMbCX3gD=qiR`>AIoD1}6nthIuTp<$ zJs~})O!G9Wp&xaQ-c>%zYPo)rWMXQ6Xt%6fNF{{yZG61%EB*rFH&V{ej;r}}8wTiVpqezvi_OSbsm`a4Rt}J3D7Qc56SPCoL%M@xk5!2?6KsevX>QH`hP@Ae|9}G#nil zwlGk-5naBKd+u5+t{8xUIcvVPl0hFy3Ec=qkVfY(90X5*cIQCEQAN;8`pO7-MY_Nm z!quwD1y9+Gs;r#xADXz%Omm98tn;^*CmxusOzCa*1bk5qc&zuneVRj~b~r@GGyx0O zsPxE4Bp_e=Et9V!mO8G5>p7ZRS>9Z%Z@G@QS%>n1Sl-aN9s9`Zu%4nGkKL9Z{J7-r zj%s5&XtS`TNv7g+QVbAD-tK0R`>rRJLzSc&oMz&*NkjB4m07>x93J0}uqsfp2y4ef z5_6D|Pg}g}Q};DHl8lFuB6<0eMO$4xItfiZLtUL?9%34f_AHE9m~;!Uxb~;=#^Rnt zMew!x6*1pgA!C{gmG@dZGHDp;N{<{kT=ng2k81l!!$h|dPNDGydS?v5SHuDdRVw)~ zYdd54A{uRNZHaK(CYU)mYHhXxgMwyWYiWhNaQD0i{YNtZ08yIVO3U3y2}na&6XCPd z)7_)4YOq4`xopdeilmT23=|i$wLoRk)Phjj-`!qr;vJ@o^gNLk*MQaUzHMz=N=gc( zNg^Tx?X;E?%#gG!#T+M?^iaW`L3MX}ic7By9b5_2C5`?hS!*^>XX@`>eBB!C* z`T0|jJZT||ys)sazP=uC0zRXzcyDOuqd8?BV?qby(32|Vb8yE;qc5a*Q|A$w-B5R#@0TSHcS>ts1j8Z=RtnL9z-Gl^gk3T6*yF)7=QSzviqQ6%`dNEOM)> ztE~oTN3vK(>gl9=O_udN|1MIu=ouJRR+gn>ImLRm?~{vmxLi~ho4USsBqR@O?Tq20 z3K5Uvb(NIq^;_XE`TN+mvd+n-CpoiC%7jNel|}= zG(}Lex`swhPEM)C_|G;RZmY%3TRRIe+>YJ7z4G)H=@^R8#glyD?y|AR%n-6V>`L(P z_$x9M)`RcNg)l=4z5zvPu*b6u0(8_4T21 zNzBtA+&iY`kIRd$2yE7~Dvu8B!Sqgs62inYA~JB8>CtKPHt&+ zIq}|sm?qKk5%5FYRBhH9Jj8UGfFU~Nzf5ODMMv}n>w#3kz!SX>x+SD%f>`g z=#!Yfc#?8HCUu+i!#J)957B7r>CdsiTb-Fkk>ie(&SNKh3P0z+(-c>;=x)7beits& z*RHAM+v;?f-7@xkVqDO0Z=BWp3#G?u&9|K;*3#<(+qX&0aB*ze@-*qwjF0zcwkQ8! zzmj-<$9T+M$vkc%Uhlsn&S>~#7pDn)yYf8yxZ=Qy*d9Ny^h)$^V8z8b`0zZ_}VIW+`S}SfCm6>(^gA&L^pJEE5q! zJ}R$rN{%ZxoOc(WTKsenY>GnEI38|l!#6<_dS4*`xY<(Je7Ce1ZQ0E0!&5)0*zbsm zoAhkkDQRg*qsY)l$-i-Z3nfZ;c4$pa&9)5XRLY~E=KYO{TDJ>V{)eOPXKP(;KLbmx|w(a?*) zxuDtJnwpw|mC<>>YPa18dYMwh!OjjLuS0$d-yNt5$jHe0b2Z=_r=xBCdD(Z+3en0X zVnd@>Vm2h$v-=s95EBcFg_)UvfI#HSgQstPyvKDij8rJsX)AgmH5hy!ijm11Ia-yk zXhXzPWFu4W-o2yr?kohFk8Z8BP!52F+1X{Wk&=Q+qm3ezK?OsZh`>*Cf=H?&z?<>P zD{+No-bqL>FytVVa^!>Gaz2Ds@{q^=or_ED`F>Q}moLf5ja&BX>Cu3lGGTiE>HZOV z>YVHxb2Bp^UteYVP=E|vU5T;8%%vEDB$!K|q*2pyaD>s|c?&^T-nl@RmK*+}jfa~* zE-ol0>A|a4cKh!?WFqcE0a{*GR>kkcIuVF4G|fs$LFyF9i=;V>jy_>wVHq+jfkLj( z*V;gY(idrEX-UJx#KFwm;;1>Q$mAA%v38o#r++UYy1LKJZdtrK{4$MJ7QQLeQu_HEsn6`;5l29h@E)uFMK~h zxqW;&B}6B+ru?b2Z>uKeu!3cDqrOVSrcO|cZwq06)k27zy4!`yoS&yYCVsowg^Vnz z>-i3O;C9iV$G3Uz;->>#1aeI_@~SksxpLKKI@Z-xhDubaO2=jR0&VHr)+{v_MdD;h zIqfz@W!dd_oi8@}9zSGn{rS=tLzXJA-*-+@)V_zdUXOrMN3;em3Vp z%a%H)+xgFK@I+ zS^o7W_??5{gWoJkX+6W`jYV&gW1wJ{^P)?m!@s#C96@b>0qHd3!z45;%S_H+$`RSB zwe9ZO2)>NtcY$I)ow~QL&(_|)6BeZ`^j0{?)Wx&T!NMYfSQi$wc1!n2|K#kk=)B&g%Hq-u> zDct~sUry|n5IXqoV1M62V;OKq-}2j&0!BQ8!9TKuJ6GXe1&hPenPSE`O~N3f5Vl6k1=WZ$$W$o zp@T?`vkT8j@~W^Gm6}+D^*DrZrizck69KpM2Gh8)`mj^E)56rTF^7Yijn7 z%O9kNMkg~f^UIfeb9{6tq_P>iaMcQ%rD@>E{PQ}0JiqQXysLY+owl)4-2?Y#-)^y- zBN9h0tM_wV_U4-h`1lO!RWGTrQ&W>4Q&0?zj5s?uVG7O`MI(<3rEq-#J~4_66;BZ= zr}L3*zQ+73a6!&P8QYdAXZy8HYhf^Td!HcqGx1y>H9HNRMd3^YZb~3Bk+Kq?bE28StG8 zDaIss$sOLpy^BothP+1UEG#46cv<{T+bQ|BW#H0PpjJ2^OYMDndb;6eBg1(2S} zot}>%wB=F<2M1Y|o>K;`4OLgBr@!p!b|Z>UPfrI}%G=xf7WzYZVt!#6U?i|{Gbggv zaT2JPiwACU*xPJ=t80n!t}QdTNH&g#xK4P@sr~aW18F)z6kp`=;fz02&JooOx;i=# z9{^%SM@NU>dB^Vt4X_U`;K^U`S?1fL(jaFB=MS0D(a}XnHke6voQ~;)&OF^~zA&(T z`selQ5vVi~JX%f;4j!LA0SqQ71Gr2mhOE4NZ^cs)VPQ6Qc1Gp=N4&i1N=iyH{5FeS zT-NijUZ_{tcw<;W%LrhkOp*u<(}U=zxmeR6cO~Qu09K`HUD99i$#aFOTh&l* z_55}`|J*)0-HED&%@A_uFOh}@*^Hv9%R^mM>0s|^5{=I?URPd}TB#^HiSXLU#Y}?~ zKm#plSc1psi*dohMTP_GFc8^o^Z-H&$^addocwG2{D`j!fQN{X&(I=3X?cmYC1z!r z)|FDz$W)^S=)C`k`5}>+^w;m-GF{2rKc2h4isN?KZTb!6G+Dq)HMPo5CzR|Ql0J#u z-Lk;iF0Zae1MwLWF*mt5Sf3=S8iYd#{0cs=UQ?lA=c|VTHBgNJ)Lv<~(yv~a@=;ce zPz_nmV$kt!t$09F@AVxhe3>KK>gql?n&_I22tH_`a@t=NyKe&M03eApY!rP>Oy1 zuv_)4SjdUxYBOIE;Lg6$ZnL)UBIz5TrARZF2&s}T5y0hW;f=nh(4kSW+9HO*5}8JS!t%G<&myE3Ks@~{h8(=yP;Lt7y-hqhF50Nc~3y$Bd4&8lPV zI2u-CaVZQ_@+ z8jB;+*>OchwX};fu5+S5*Hc_uLE)0+pvU!90*cr5?0CZMf)8lBM;Nd^l$V$DIc!b> z#7uQbyT3aavllqsd?6$xWMfk#M263-htl)s4uhhxv9X?>o`b_7&~`AD^_W$jJ$nx! zC?xb3%UEQ@)+PB2oME;~;r!}Q;fD_&O#8FBET@HRZHv>=7UG|~L*?i4?p-*?9f&^y zcC*3dzAUJp0c`@3^7{4bFz?C9$<-{iZ{Brty{(O^%hX<%F zDD;3&jP{nJ401V|3yb1FoF6U3A%Ln33hK#GD}Dd|{pjc@d;=|6QW8ArSpPocvw16aqyrL;I)234EMA0Ji*@&HZ?AQxR;T%=ddkGK67IOaeW z0747Hx*0*CTWBqM-QT`l5*ukt(j(PLa3$yr%elCK#(pk7p)dZ}5A7=&U_#wJJ-)s^ zX|*`6t4%UK!k<2W3JnXBNRb65dx~7dO9=JnwiSuiL`4O+_L0{9Zbnv?{nE6Kw)XGA zK~B~uUESS*D%yC2SS;+EWo2c_RaIuIgKrqaB(PK;V~%-OvMjZ8pb>LE%Ea?SMa#|3 zmLIwmgV8-WxHw#F`rP%onPeMP93!lpz15ZWG11XC(Fhz)2cL$t?CtG!Fm?cF*9*j~ zfaOPZ#s#aWv&pW}C$~wV46P$2g};FMo>j^hse_L0pBly2Jp28rZewqMzX7lF{N!YO zUY?fn>u)hJIVD3pmX^=!KZ<;LXt}XoojX=hQC=CtTdXx2 z1$Qf9-AH(`W+E*6{F6hsDLZ3-1#*r|RHB;0b5LoMuKBfStv^gtT0)|AS@p;>F=4_5-Stvmflst5;DEn zzh6PAY%oEGgC48UPOxTX(lq8qAwBoHS~)aQ4luBT#`1?5U(oIrwPSe&T4z=cFV`MA z+$KG8bWAP`n}_nkac^5(>{SAFCLn*h4PT4%^P4(aWIGIvy*dTXBm?x4sh3a7cknv2 z9ud_rD4B>aPk-`NT`ZU>y-i2MsEvCwQ-ionyQd*=y7s6gxf&ZAJ6mJty79JL`|Ky4 zbJ6OGisLjX0ZhTe&{NBq#^0 z6S83;iru`WxjBN-@Xlcp*R-9uW@l&&z?Pl0##3M7P#fQ z(<2}#-)&SM%y-6-U}OK9v+C*TQOZ%Z1yVXoDG%+zlQ%#>w(r#d*7ot^$IZ=6fcshS zW1pdM?v@nfhM{8nnkE;RLdB5%I`PeN-C0%n; zt0q7-DzUl0@95m{1xJhV!hE5_8zFfN97mh$X5&|4au4-ttG*vU9-ZdA<>RXcv@E7} z{k6(7`>E3-8o9K0r*SE$iJuP-53LP5_cu2md5n5jLaHWUr}%=@L5_MA*ykJ8#PeC6 zIy9AiQzQ)Sh^Xhg=tE_i#L&H9(W|HwuJjGD%qx{v^*XLN?$#MfYLA(8Z zC`wvH!&b9blSIFMeZckeF?~^D;`C-hecOpb`c*V*#-}IP>r~_Rc6PCB&bU$SK)PD~iuEcTclB+Y zxh?+JeP^_$bLt*iY}QZa4qg z$;P~c;(%DkI8BX1-cY&jJp<951HtI>hl(QFW5emYA~cSwukkFO+MixCE&TmzPGNd% z!8#VFcgZ+Q>uryE+Ef3Q-J+o$&kt5r`+Lje9Pva+WevRfpoF8{n#sw z^_@ROIbDg@83S5Kc(X>G#n@Pokf^++>DulUw`372xW1zHIo`7|7<^s%2~lQZsVt_V zF!D<8zF-CsqIDn#i_dZUS5s3{N5^_j>4YLPtVNt-SFz~;P~@4Jv_6TT za%$O7G#{&?prR5@IrqJF`cdnBR!*vVx?Q-GY00QYk8h7vp_Hx>GCtC@@RRS5jSX<@ ztWtQmxXg1q^PLi6V%1J_ExxysMhRpHYKHH#xnw$w7Dcu^i*%-mvJ;Oy{VTKjQTyKb zXcsn{T3JVHs$FFeebs)vWU=>rW1nET$kyJDgyc)0SpGOWIXQGtQ&o|{RsaD{__wz# z`>8GFe_VSuHD{o~=O-uSHxN3oz)wHjs*lbhUpvTURXtu>skjyMAfyV1^zqEEgfP@y zVW`s|a@#CI%Mj;!Oe2?=lES9nf*m0l8lG;6#dOK6P4+nsF*!u_zuRIuQsXRLDhj~! z&om|<=O4$#JtY@Klc4DS5&vU3lNLF)rHZ%ND$=c6XE7~dc|0Wj&SZd2s3F`|n%W&fWfR?q%$+M$F zh0W4|TNOn=+hovO*D3GgStF=w1EqbhZKCg4Wze;QxK#kwll$Z%%4%v7Dcz8yq0@V6 zKlit~_At#9zE|i_m|Rv+pkmmk})g)|P^JX6e5b)h6fueb?}x zXD>)?Z(RLAaOZzcxBLI;61|Ib$QYs*&Q9B3-3&diZsXe8^}_$VH)t7&TR_d+plJU{ zYvh{*Thrnp^HxFC@lAXw6qTWoS!D~2kNE)^Lt|bi7E12I2Oj*Xs&^|0*;0%l#UF}`(TZhAC73c%;tukmjj^p-N&*!y;TbGhXxtH+JX(L1N zdM{LRI}>VlnU^{TYGk^*T7x-S``+k^vw^-tsI~LU!I6u0PtSFF2X^k&K7YD^>MLFK zVX2J9lf~@LCF8_BYZHZnmm(+`p;~0SnABEoC?Q(pU_gw8o*)fiLxmW%RPInRsHfNVFI!J-qaGONy3njG@SROsbc0+hHurAMd9&{J7d)AWPyf~S21VyQ%QUvmeu3Z8WA$L#=d9e>RpfM@LFfv zV??tnPo7M^(t(bXlFx}-r}oUexRz1tmVWMzUwLql_O8Kc@e+S}VZIsjXB zbJpQW%RPKola`kD@^NNvZmMx)BDEmOj@#u0FOS24MB~UK0bv=q7ihTsNd$0F{$hyh zi_M?|AvypE39qR`#8v1+$#nl?oA^=tFsMR@80b|rPhA58MQDQ}BZq&gfShc`ZfP6} z`q9yfJTP2`qay1HJ| zhOpcBj%sL`kNYGT*0ET#yk?}qyR)*g(%#mVZEgl+=`iMlt5;Yw1}L$Ojm`AT3<$YY zm6ah3LE~9!HuO_355VT0uP$OKvM*k|2>Hp*@L={WC(MZQB+A@lhB%91sapCJk*%VV z)P~+R)+HHPpy1iqip_7|yE^-DE%0 zSalW#sbkc=5*k~5BO_%XwMIphh8sphr3ct$bH2rdgoH&Y(PDTJ68zWOCSpO&OimU` zi5?2bTzX8iZO@~|W*=PM`KIUQNYR`8vAOx#Zq}H%xQU;7j8}KF_yES=0|N@W5G(#T zX%wI`5l-Sjirqymc~_Ld-dwBa;4^4#T>-oT=(9D@#O|}PveHvims!n;w^nztw$E&3W@RbtcP2tg zRU_h#>jYG!5>&!*6*~D|<&`zwS^U=Zb)Ut>kcGqFdsWF0wxw53)71=#ivMU9%h~w^ zcy}B+#i9bX$W(}0kSs+wL?}#+kXpA_nb10fDvQfj68(_zB|EmhUX*VL?VqOkwu&WRtt zehC4k2W^?s2Z)eSM!wsB{Rto<#BPD|7o_{u6}$e#_0|8^(hwazDp+hMp>bcZ1x9FP z1<+H@hhK%rp8t9G>aXSVmFb})zJA>uL|A|-m#9ZTPBxoZ=X&@R0PUclAa%yPygcw& zS(U3(1{EWiu0FXbU1w0JLXYcN53T|I0%bs-xVX4X4)m3NpJ&kB;EzM-=;#<3!BT~K z@1Ca2Kc9=A0-@AnOflfmz>i|h^F3?tj@&{eQV}HyxSLw-ZSZL+uQ2U0v^*$0OU6 zwpN4h?qULn%FPb6f8GHKsYlXrbjq37>r^4i#M|w`dLa{>r<*aBu~Dtdv14t+*sBE@ zvcY&k<(ig0we_O|>S36Iob<8Lq0PoLq_bV_5gH7iPX?fcQD?VF zABJ{33;Q(2(70^Xp1l2exBKoutn0+195V}#3iZPK>l4J%$MJJ_>k`YZM+=a7{KeTW z(dPfHg-~-B^Xf@|WF6BL-zW1xmeiGw~(BR2>@FATM8oEd4zcNA~ z#pE_)3`kS$AKPmE)GIDnvT9E~dN@mHgJ87P*PqnSooJUI7;4D(FZjwwDiqfkH)<&T zTwhSwMNws}=jZYXlfyp=KHeomTEq4ME|P6hgLj5Ocx&}kV_2`Cdd>pmQn(x*-EcrM#%6T+p7T>JKQG5X}=RN!}2fmqG#nt{x1-Wy8 z@60wO*;6^0Zx}pHTuNx$CiEn3dp3Sm=fxMMOKX_dvh5=A?v*@x>gGRu!#ypQUYv;! zk-37|Z-^+_OwH$)TU#oKh*EF6iEgEGn!S1ls9d*ox{U@BzLLh9f+$hQu{chKJmyz( zyDRvnYhTW6iY3*&UQ^3)MswKzl5r$@eamJYJjhD#bNc(05k*!O;&ahrvvftSA zU((0g&wpDxEE4F0X8V-H#C$LcgDfpY#=Gaw=y|E-;+~fyiey-Giob*@ULmIV-%}Jz zmyA8^+V*POtL)>rgV0CR#MPFjwG+aG`rc)aIKsYqOozU7=~uRPC{M!S3?b>;YD$C09g|y%}NsDyK_Ggb%jTr2ImIB^^ zX6Jtl-Pc%e{m&srEsc$7g}PU_eeL!CArJ^@y#5}banXjW5W5ziIMfRWC+Oztr~h;L zx`NZGFWWnT7hjgLU;p##VC}sBF>Cw(zXjrlz)fKpGxo~Dr1xLzmsbC|BhBE-%1ZF( zMMMmNb4ycB?gh%!TTbXx3uitm-S~TW!uxl;ue1P{pF1=JpW^=ZHW<dPb@o z3qc(W)V8oN68s$8JQW7*Kr^?6KUHT8!w8Iu;(^kr(>WoUXA&gozqvPW>@Vde30g`L;Rb+oZJNN|wM1>9vXjgz$ z!9qeqOKTz#73X$-)D%FD)Y;mcs=rOT&>4r&{bpi5Ugh}X{U1PSRRNFYTx^U$)ViG5 znVPPEe-{dHzh~HM<%WTY4(AjS76ziVJ%)#apFb9Z*=cuCAxjbL+im0Hu5e-6H1$e5^Q~zl zpVO{#{+kcbr>iq|HZ>iB;SDiX(Z|}cHPh$`tvMGLsFwi*03{>TxC6btyVFQt5U%9a zo^#9jwa#glTYbXVZXiUcm%U9`DhqcIeDNXzGeS~PL*vrL9YUuB)DWG?`F1N4c!6ot z^3+P9?zRAH`bvM!2>5Y;4UCw`f^Gsh!EJ{sAnw5umz|vr@-;L<_U!VkUK^W#$Hc`! zs#Mhc#ztIZWCi$fcNRK9MGCTqGq4G+udl<4hejDX%7&d9bI`JHfU;Jt%3%v0Z#YR5U9idP zKKb$f+RED6*|_tDf`USE!4?9%)}0GjfYfwl=0??@U)M@OH=xOdxP z%F5x;4+R6u`H=rzI0hy-@JvjcW}EIuruKAqgWV6B(#)J3A}lQOfR}K>D$AJ$8o5+3 z+|qjD5fj%qZ0Q8N4F2}*$D9=?G(apX0Bk()w-7g|51zz>hXI|0|FOs6$qAVI9`ZRA z6%@#Q`Wx=x6O^I$;r)O)4ZeOPs6Ht{CzW5F9gmb@E?R~+y907T>Z6Nfh6(^ zE(2R3GhX+o6vJ9SbEP%I8D&afDTBS3uib#Tfl0ytqrNTY17K6V7 zx_PJlAw&O%T+?q5`qlfxreO7Q+-c{4o9DUjxP`>Kq`UF(F1^wk)!&nT_kn>J2yf%U zw_whPPgejf7qSyh>^OTrsJRGy`X?K;T0$ijV@~a|Ldl@~29GSm$s$-}?N$d#$sn7d zqo9QIIhPEX;Rf79B{)1jzQlPT|B!X3NQ8lmhZQubW;Xh)1dU&bqJn~0z(_JXt9Rdc zq-5a{ikRcppj5#dQP| z=BE1;$PB<%jS~Q-wz=#u>xB*m)uPKjoen&*;^J0%bT2;Nld;Nzrtng(zB(j#BqLN+ zU46Mj0K6-o{UMOd0%cxS#(6Zs^;9Z~9qin<(a<1q7Ju&mW%@&!lOSn+#~D8kp;_34 z0&oO)T{hO%t9U*5hCV)H#jj-yLx9}MB?w< z+RIAfvMUorDP`87Asc*NJf5pj32tgNdfXHC`#3l$tcrP>XY)}ApC%xVMf{0#=-+MD z-CFa?-QL*=!P3WuXCwy`0J~YZyQM;gN}<7+%fT3#6+{Pkv4Ql3P~C#7@9gh?_4W1j z_b=6bk)v7+GJPO|n>#!4E(6!AsUBTmw93&M)W3_1i<6UY=9rJ{!eRmgF$oEI9JlrS zL|9-W9DQy0h-qH6UAqO5UoI#$g3~1nAPIu84&D+I8{6K8Tg0H=SOk4aa0CN287z9R zB!dsq0Y@|(fxi7dH2XaAY4*%9ZFU3SfMR|HQRzWbe zMPT9L_CqR!1-y3i=iQdm=bx;eGe`MK(iDmne*Z3{2h#)Ah)elUv1$$sh;qjYX23$6 z8$Sz+H54LHv+&!mM~_jx0MqH^%z*Xzw@ERG;Y+=9TZaA}o)|D0KvfT6T|V=b2c-GR z`#;C^0eZ?-EzV3&Z(0}V1}6&a2GHu*TVo*sE*KCdK(ZLDb8S(rdFKc-2ws~#r`vf@WaKie`P~vsXHdC-Fx|H5 zP_@`3qy!$KUA^dg(O1N3Wbgx{-gKF|x;iLjDvz-C#~l{{V~Q3fc1%9)1KZ6x1T=LJ zDX90Wb&z-N7dQq%gysQT4)qE;Dyl-Lkcdc$aStU6iyT+;ThKKF-2huhyiI!*1L(}Za{HP;w}5%M;S%n|Ik0l+vMA?bQxK-}8ef}JqbV5=bzAv~<= z5AiykA-Ql^FJBN6D*s+1k_7vXwDd>|xU`4R9jPk8?hq}uRbNR2VuORRiHRBA;uxrv zG?2zHJo*!V01E+I0Yx$Eiyw`QL2v;Mf4RHIcl}m)|B$tOn!wiBk{c8nx<7GoZa>=; z0KbRW%FD{i`aaCFQI#ZF!xGgF6(m?HYP|-dr){bS6qcc+r&G*c>`Ci{AkS7;%1(r& z1?#ibfQJ1UpwvqKPDfWO)FS}E!8{2MYf#7q(w3|~&7Ii?@anrI%tjXA^B|h21QV&E zVkol$kW?$%bFE~7F)?S5EQWulHS59rjp^<;DTZB3Y?FVQLShN-PS>gho$g);c*YN4 zA0#k-zR`+`zqViM%BFhZ9a4JzqaUb|K0p|nADBn=&1D`oHzJWHIzw6~X+msLqrNXXvLyG&n* zcuHWnAsyf`svp7zF1SpZW`(M-nHZG3u*Jqejf->P(CJEEtt%*RA*Io3Xv2hs)Xx#s zo`OjIU&Or!SXJ4!C5%<2B9wxP2^9ntC95P60Ywlci{xlTGLj`5KoJE*l4K?493+d0 zjAY~xRdSS^p~nI2y0828yLDgp|Nisc&wC0E`|Q2eTr-S0=a~Bo5@lDGX9{Vp``#Q2 zzIOu#2{xD|iZIxWGp}yh7SWni{dw!mj#UBVdQf`nl%E9rd>qu1eiD#lrU1jYxw%;e zEsdW(-9|jX;8{A7fKcH&+Fe)Xn+j=chEh;xc$^$eQ^>=Bf8%ccQ=S*0g4*zv0gRgTCY3Q(7Wd$4GDn1@avQepMW5cSk{76FR5XM;!F^tycY>dH za18~E4$??!>Ng{b2)l-vr6ujj8^TSA>Y8>_4dLNO?)W~A{iM8xPoEohadF|KmbAAo zs0Gu(804okLHD=NHQYdEt5SkO#Pt*03wbm_+{P_2}0j>ic5b*P)wp5zgxs zHvi&sWuKZie${~iBBn;tv|Q83js0QSq%6O@U!h@UwXJjzY7`*B;$}w`qebpQE8h^05`MH#_y# zV6)@J1~lr*T+}n$q~D72_nU~`jQgba(l-6tpiAf@)j;*8gfR0Ofkj)Jo6#K&6b*@^ z9sSuQ=A#C^t!s<>T54Kzux&rRtoxCv29OHtRizaGWr5Cr>yLK-gLw@*|-$n{P0`*Ld>LQf>p~_J5A%{=X$k` z27UYk!}lE$$nV*>jtUBzyE-%7x$RC9rWTN%Vst@rggjr%Fd`ZcH#~+>`+g=Rhrdd-}2_d=G)gH zs=h4BskU?DSm%K$>j+Op4XfLwFOM=SCLTC-%h~y!jg13Xoq!Nb=SwWqCuy!!@^r*c z8lub=O{>J#*8pW+Zf@9tOm1><%T$ddbn4B+Xh6e&P6}ZHc&xNYcq7R zo6&VY&oYXSGjU4cIf2n`RUdHa*86km;abyW%$Y_%;LQ-jnW2}s9JGpfcJ3#}53A8^ zbm@?LBANYi)l$JRF^6>Bbi)}7_OChbZNGJSpBDW=Gh?A{r#XM_=1=qRo$gY0Z6nsN zyB438r#(>*o}7(Pq|G1yR^G$xM?*2ym^ETn8P%1vG#WAHetgA5z@|;Ntg0jPy$5yT zWz}O9qan0=4z_smW)w$UM%8+c4L?Uw!iOJCs+t|?uJU0iMygv0jm!>C7l$t-YMh2w zjqvU){C#-tsaD#vKfehsOz-w-`myf=QO_rNH2{n%h0L^ZHl~Y zYA|oPRp&d$$fF^L!dqPGDM>;z3n8g03C$r=skhW*e5h#KJQo^RI!=zhHNThF*Hqbk zR&fuZVxgHQb&o_wc<}D+ST#Lda7jMQc~R*+K{5;T^M4LmQRZ+tl1u}5En zfquhiJbUZdqY<~qxQ_{k#oDQ=X}k+RA-LdqS$47MXvA4so6MiS=1!`<%*Jx1v^yWyCCP!JSel7XkkfNP3X zbHM#XIF~wtJqBN|4+ z+!JsRyb6?rtU&1HgBRZYP9YI=#vD&m#wKevP_HxeH3fb&!0VGb`UNb=|Y2% z9oi4XeOR`8KnjVWwL*f*!82w=E=_dkLdht=M?xwd?)m)OTqU#^96P`&b^T^#QUbVb zgb+jDzo#NjLK{Mh{&C>HI87NKrG=hRHOg;*pZx08D{$cXjQF760^P&Vave8PhJYWy z%PE{&6Y8D&%q^z?UyOwvWE4 z6PG$rW^H<|kuR)`_Fh>=!|(L;Y>7v8?xgm*vVTplsP2tuy=|J->sH&>HdQ&w+ER#< z`RQ_@kGiZ`*PaC5kgC15<|j9*`UYH;?*6>e;?`Pb$l$4i<%Tz;tgL+7*Rrpg?&Qgo z*RRhBd(}M@4hIAR|En1uD%KcC2{QDBx(%^FpK_#v&Y)=#?kmsUKLLKIVSTZ#fJM?( z4DQ~&i;x7O&;tAtZle5_^Y{fkL-$&p$4x|h23zY+!=Hn&3_G{~#IrtQ&ZP3LZoi!h*2ghz6FrkZK zDexqS6n4BOw_qX#R~9E~B|&s((O=t51h?!)ploRz7RQVV<|6fq%%_gbla-^D3&tLLX%^oN?`DTxH?A$xn>MP-4xIV$TW)!pnpE99 zbwakX^2w!@8Ke7b$K`~@*aF{<)U}?q)0kB(N|blXRbVDp8`W1dyXMKocU73oUZY<& zs-Ql0kT5&4SlQw1+|^Arq7i2_)~h)#QaDPreWIJwbU>%Hd^_HmRmwLFr}|KNFI@>U z-EI^0htH^(is2mdt%z>5{OVh$g3ekI(Gi9mGIDZ0l&Liz1>ENL^r;mVj2)f+b^XX0 z8Bg}rAj+ZV=C*)pycl)`ez%ASlwu-e1#L|1c|RWlzPcEu)B1J{mNM98Bs(hDIu_Mj zVn)d7P>_=|M-f1fX$dC@drIX2lZlwF4L<@pjJ6L-4|qtxy7sz$))U}4dbArrD80%2 zq>h8bie6%vQlWjmvl_A!0Lf=sO{L}J)euZq_D3DGqLZX!?V$u z8OO|f@8>l^1ULoV0uiH4v6Q?@%R z3r9_P_tm*lji`jxXy=85B#;}%vl#0Ti2m;O(w3i78JZp!2RZ0J2bvHjmlg{(TzZUb zN|{0%vYjv9^j>LuB^|b_Z6#8}hiWC;KU+BQgYAIjQqXWYo3TM-)l1XnKx2)=p^TNu zYE0jj-J_<1;AZVC49uTvk5`C`l=#RE^#JUXABP&TJG}{VXTa+KU%8ZkX_Ux&j0HqY zif9w*KcK{kDj7`l^r6wweJ~w3x=d_rz!SeCW>rnseq$Ehpv$^joOdI*o|F@UcrolIF|Qg{ z!>QLe1aOc(Ri`cz&Y(Vm%tMC`p`R8ymY?4a+LYKt46hQ3Mh|0{YsP7804k*IaiebcD9$6l%T3DebJAicKXn< zNsDJgDvQMh0qhm&0~}c;qHTOrI~952E)H7X30GX%V%6cm)U!i;WS4KXmV)cWvw182 zTG}bvYE#q0jvs?c_mwI)*-U=-D=)S@)?sUe{KFN7_@_i59PtH@S)WX|9K&{AaC%r< z=a}&R#OcF6{wQ`gg8lFir5XGAlhOnJ!t(OM=;{(f!w3n3e31U|VW3cCdV2HTfG*XN%ExVpN9gEfWP0=Fy&+S4G#9a?EsK^@!-UyWp~tuop*W*%gap zL{AK!9-qy$zKRL~?mm(bflzfXUi`!*h`$Ae6dYh!%(iUPJ8g-=Sv?ccU@)x>yzs+q8MaT_@~ zY4^!wERbvBVdaHv&C2P48JCsxPoXutM>>?!9m1TcXj`JD;(`i|pWm{DWmtoxFp zWdPR)3lmTNilfc6l0Wagj#7PcOl{z?GFhs34+aga%?KDLvu~4qyR@<|wAkuwy{fQ@ zZzb#gE6Q9d?rt@W-`^wLWmQ+QHIuGdWSkRZ9ka6v*3R%5stA-mrYCH&r=Y)KG-PDP zVo#9XH}*l7>BPdh9F{#_Zdcm1SKss!&7z}Ds0#GaSD7}v@?K#(BcbpL?e<-iX|1-5 z8D?LoXy%(2n)hXk_fUEJy|hYeVM@{0NRFyA_4q6!81UrO%QSBGuQyL>a(v9qgb9)g zKHJ>ZrXE%2y7%P!8!7r-ybj z_~((4ep&+Da{_=hhk!skAU1$^Wf9e2fq^un0%|fLJ8jZc@(_U*i_#%_8S?W$E9 zei?Fz7ttGnW22X%1iB0a1%~$SeiD%mD+?Vfv&Di1NQ|JVp6KkD)pksIjdVd_LRY$6 zx^$@|E~$Wt9#|sL@4@>saHHT?p_-uEl?NnB2a0nnL`YEY;CMWBL^-Jz_F;+mJT`tkB})l`K-kGrQfK$jSuU5vUeRk{Bwbh*~SbQTMl-wF&N}kzvNK__a4G&`K-Q4z~QKY4- zpn8+RAS2I#yq7*Ux*ge24L&c)q!+BeIqkvbh>gZ5J|&h4jE=6rZ&a}UvMUuRFjA7u zYF%*yAHj7{T-?&7C!ghcFzV%cAWP|emn%ZI*gwdsJ3r;I#>(-_%O9FETIqdul&2U( zxf}2e-%})3j}S|k4cpFiPe1hjgmd=h35{%(pU|%1Tg4|Oh==OFYCJ=*xw%br^*UBZ z(s0GxbsY)2+hRJoZM{JD+%CHRiJ4_fBszQ>6(2YgMY(z~NjgVQuY-al|2H6;*R#XY z!H8`RyPv(m9UyWGX?&ynDW9Ti0Q4^+$&GzPT?ABy+-37MB<=NQwH836?a8WuIsMH+MPx}9SS+oH#%y>Ne%Qi59wFH2jw8G7d~S# z^p==x0lD{CC^h6vBjneB!~4{qm;1`JInir=h=CyzDixv(y4JGyz*28JO-@e2|1M)( zQ&J>c?n^s2dA@v!B9FLq_;y53eS3}WijNa|QpWkVP*7y$l88W%fm9zH3TKjebx=-q zzf<%1jEpOP>#gcm78XXv7@@%yTJ;R=noxu)$SiK(o}i$rrp7{#oZrQ;np>xyUP31Y zh?(btU($-t|ymKz{B^u5IK{MyA||NC(5U+8c5_n}pxIVbXvx`|Ae>Ja@= zk)Fc=(r0oHkVN;dp}(E%<^g+0t>a^ysr+5=qj&wUPLQsBxA%XJ8ME#0(Ec$*z4qDr zdY$oW`0IZKh*k?!U%QMveW>2OIMD#-OK)P1+s|*hdHIbLO$xEefWn%+_GX?O5 zUA-2H3vC+Cmq4x##ei~;gRJXc&EKq#Jwpx|H{Dk?d93MA~^ zAkARR*fuRAa=c<&Y=Z0iq1Ob$KY1%-o?$h+!nKwD^y#lH1DbE5;w+-%b*^vNutDrX zR9*AfX7S2a9k*+o!{@GB$QT%KB`2exj4Z*(!Hf%lFd!3sRLTIPiXhJ*6b5}p|3cYl zcxbnR`Z4(j|EKRenCNHE^!qy*;g2ze7Q{ zQ_7SwOlLD$+9O@Pu;lS(TJ@>Enh)BXprEQmKz!}QN9byBNJT~MhYM1AgdR8_NQt}^ znbwYs?(T&o^9JzBJ)yOK3pWPtv^1tQxVi22fXP4Ziu#V^OVhM*{5??ALE^Cw)I=b^!TuJ_5-;}FRu2rT9b4(9$K~b_jTWO4vxKhVdFLJ zPCFuTH0L)Nj=#>tf5YMbb(19b_iN9e`x->SMd=Z`_>yaMacIco?jYrQ_AX=Mr^Uq9 z@!cLmS3T17idaAWvKap&5BUAmFxFspKLu@;f;;yWf@oH7g%l5O7ENm+ea>T>`J88$ z2u~~OHnW|Ek$AhcjV2_0RsYWJ=aIHc+r0nyFvk`~VZ~_rt%OYrO;a$!QmS?nLFTXF@)97{6)g*ISf}s6d4z80QvZq?@ z|1yszeerS7dq{#_5GGPgB0c)>;ct(MPN4eZv+I70egR|+ri|#918bF@=Ui{DCo6k3&aW-O~GWXcp7>DIkcWDEM&1%+(_|Snf&?l?q+h*EnAF}pD+on z>PafC%?*tg|HIqp9KzYfm7Janckd==H53X-D-KJ=)xQ7jx8J-TOGTyqU^c8gP+1%I z42YYYS=34Y=RK0L!`f$}wRT4mYP!D0NB>g14X@Atj@Sb{)^QCvhzd~4AS(=NG1rS> zrMGr?ynFW!h+P?L*1(w-~{{G1`oibIai-!1NeQ;Y>CFL#_jG@k3lA7CcdIk8u`>*=xJuZ0eU z|HK`PTW=7k=Y%_$0hbwB8&z9v;B-C;{H?Ct#OjGQXa$zqa{F zqIm}JE)>+lB*F*sJ{(%xCK>a;nX&)R)!@Hf0Pz3&<=Cp&)>a@| zq;B*3*8EBOmsZnd*&TI(>f6q(mpCj(_5Xf-+1yU}h;i}0Q0C|jzbw_isBUm6PyZbw zWeCx`z7Kxyp{JiyBui!Y4^(<8{krHwvAVDexeI$xxy6m6B(aD0abhtw9BEsGi3 zKQ$eUal^e7nCE$0%$JHQJZs3FdOfhJpkEW5sata<3lwvG7*40WbWZ%{+Ja#IvtM~! z@AA+`F%mgZjSazVpG6plX$4#T{9k=*wT=zz>^VO}VVIC!82t9}>?rr=zp2vya?_2U zoUbRv{a8zkM5i|u4~vPHnd$O^L}8#{gC&nk{4sjJJ4x|YPi$&o#9Q~)?9%T*lr$|H&SnJGM-Ym8iR8 zcZQt%aL{s-3%vT0<_zLi%Deqd@BPzl!Ui?fYai~vd%S`E1{*hRn{^p9KZ%T~Q@eaq zROWeDiV3L|>mvN{oa6=o{uji#{uB<+T&QV!{9<0})309%?%_UTEC~uKViHD38<Dj#B* zNJPS6Gf=HZ=>aQ)KfHMHqJqMk^*_-;%>N1%iGhJE^h82pQFo18iv;I2Kl)byzZ#lb za=q=_%7#Z(nm9$qta1^6laqKMFLltpMiWKCoG&@+r$#dV`~k9^+bJCK8|9hlKUp0W z$v(Qv+R&S*w*>)d{@EPuSI8qSJuovi7SksXUt1Gjd$aD^iQ`*=@Vi)4X%o(8 zgrq-@Jh)eqPtLc7bJM(+05S`QP2WTe=yFi6P`{3wDNQ&aIhsQgF$^$Sg=S-SQc_io zgqT=t^}JjA^=gzMqn29y(xq9jYKjQQEw$*V?JnQieg+94OG_i`rkh)Z!>i@e&Bo90 z=|=bI6m=z{J9I_3#X@-++z+d4bD4X`tHV&>qC>!R~MIfg3DcN z-MW0yZvXSbTW(?9XU?EJH)57o40xn_?Ygc2_gr|wakomJss}fdximC8X|mmIEP;oq*X4~ZNu}&mTRjl zUhuz^JYEgt&t<}B(ZSWCsb@!P@|*f>jbm9RoWECY*uEn&9l2ljpj_GI`PhS%WX65l z9wFzsi24#FIe9Ec)NWq}@Lr=WM_7v?+;*=;`uF|I0QYos2(qz_3}7dA!{uC4=lr@R`LLMUb%#&&yzx0TxXu8a(skaSMZbS868sr>QulGyi8mE_YzR3q6_ zAQ6r>(?~bXIhOlS8~0lv+5f8vi9DAdnZ$=ok6WQBPf{5dB!~G z%)s}^tGcGf4ZOL#Nusx_O|C3-HcS+ezdlp9IJHZ$_x)z-a2yyO^vDIKL}GxB3-p}Lyj2^@U0hJ+dpvWc81K*E-pp=*dwiOVaP8} z48e&nD7;7aUpSwk|Ni}R0)@P2R1=h)qE1MwgGSf%^TfYg(7#mwKQroUUUrt7^y{XB zmAb?rKZ;c=&UCQI;Br_4XTG3>P85UIt%#n}8G!>2Zq{wXVp=tfQ*E#7UQ8>Dz zwulsKqIGrlK%TDE@!`PdXT_g>%ASISsg^I~2~yn_OTKDvQmPfqM`>GCbR77NB~S7= z=47OwG5FF%qd>^@IdWv=>_ngVjMcoAbBWRZm)mR|>SG$@DKdm?Y4gI+{MI3sl)=7!!RyVN_c|Rk+sej^V=SGE)a>qW-Xkf0P~EC&iZriITKH6znu4iW#LQjRwusBQo=$zSo8sEuXX;d8({xi(1a?o@EJA45nrmiqg3_ad z`^a|nwm(D8B}G3-@SdhHGOGN-XlBUY?c7J5*!pRx{=tN>BF}}^4RK31b-Fx_Q19i_0 zhRPehKTdC@m^gOvH>Qon42GLlOPud6M7Pw>mPAjB+03mNq+7`ihPnpVi0F)}ynOL? zqJovR%8F*C_xFgIXJ>ydUAg0Xb?e>>OEko@tuVJleU-n92tZ|V8v4oTIfdQP(f zv-+wL`Buxp@%4daNlCi(?qvGSf^x#CY`2V-^+yw0&EiBq?9ZUs1?8JJMLUw?9gtX% zlYgN5+YdJSr+iYh%l(dNpzdiZ+8(qQb(D2l+O z$l^%p&!hI{ z3^@vK8~w%?JO*2>{I=C-i&=WKw~53Kr^J{q4LWIOR4sOQ_hp)&X+uVC0X<|)f+%A} z&XnlN3J4US?{Ay$nt8nMU;d^q7X6yYo;0HyPBG^eiViWV8zqo|NOuPEnoiCSP#s^3 zh|kF%a7heClNZt_BZR4@p+=MpBr2r{34>}KWz+lj?d#Wmu;yMw$KbQ=Xfs2*Qp(T{ z^dBHI;K#8@iMM{t}(_b}6ZP8qudtm@G0oz8n>U%iLO=eU{S zJ00K3&Yl#iGU?FF>)rNZ3tf$zaoIPTauafD^4{=`Z29@K?%5?nmGgve zECHf=J=$lSYvPYzobYGj^#6P=r1lBAV{WnK6&bbrwC(3&iat!guh=y4NWg)ZG!yxL z?Z@dn190MB+6kw3PjtVrr{ z_;a(@C5>qMN^c`4ugh7SYA4;cZMtTY*K%~84jw8pd0aGY(O20^QFcCTJd)Lc)8GvI z%I!1v^cA!@4aiI<%oCa-eQE`Ak9|GbD$GUiO8$t-Yp}lUrq+W@M#QTy=_aN)4dA^nH>6-uRN+qhH?SNd!!l(@F;T z>P)omx2@HfI#n)+R-2^itV2NonL@={b4DtgMX&PX4efbuzE*8cpG>4B$@F;5$g5I8 zJVW&q=`XW`LfN1NMqa8(V1_f?7&X)92LSxN4qmVD-L zY3CLN8e)I-R>6maCZmBL1MKv@QW#2eFe|qtR>mo8&MetMopyV+$x%L}f)|rETW;d{ zQ&(A27;S&<6Ashl9Gph`V$Y^8wJc@(j+Z6Io7Y&p5Ogq#jEXvTG$=dwhy;5g{Y%WV z@bbFF;s0QG>x1vd=uxGr=s?c2vd85~k`3S7gt)D)?tou7`EY`y2q*nZKR>G}?Z;*= zf9m$L)5EdF;?0Tl4T{}&rrNUy|B?L%kN$CoWgX*HNw1UENS(93JM-d1x76i+#(j!~ z6`!rl^My6%PZ^xavZ|Z!om+I69^otayfFG>cIKAo<0JH2wjU-Hs*lYVi}qtUVo@LI zMG&fIJE5$8x0hg}mI%!|Nv~l|>=@G$1%`bNTA3eI&L>H_DMv9l-R`GUB z%d75)IfZtdj>6u|dut3(yt;Yh2G?7<&|`Q7Fa-`A4svSQGKK+oiB1&biT zfu@qBh?7>bGGLDTg^8MqQ`tS0EZPP=-P&4Pw0iZg=BjMenS1|6vx6bBK2G7X zwbjJ?{3n()g}vHZ36&0u+G+J#j5imk8v^A6{Ca5(G96w=8%epkcn`&S?-mL_5<#O$ z`zD)v!kUv@DIi2)p(7_TIM2_HBkh2PzG&Lx^d~=P8CsitvIrFge##aq!MYq@MAJwz z@DN)20+&Ps>^K_oN41x4a-`YLEIH^*$Ob4ge5qR@JH@K|GK)|@8^+pKQy+vk$Br-5 zq+eawEap>~PLL~+=0R<;S5{UQW$2AhE&y&_U0j%2=hlL}pB-09?x?eB7A&Gb9z}dR zge3eDCm=}y&pyW6`qoK@WI&R<`Bj`E6s%Waz=@pK!;lFQGeAZT+Ld{1m6V4J4lVlhU;p zh&|0+Pz)|uIImY%@j3lo^9sM%(Diyxp+M#Giebqz6)!5{Ch^ZLEjh@W`FI9ADtHr2 z`Th3Lpkr~8Kwpl2S%5en>$fk8>_1WkdZYt5o3wUYE!FtMToHN`ML9>15a%-ukgYxZ zlZqm7(JyMWz}H|O^TZ7i;Su|EtEJw^k?J7A;%m{gL)w4@?ysben+K^0GP670n_|)V z;=0p+bAYlR_n@k%ia^d}Mcu*|LA4XOVnfch3jQVTlOhwdXEYLPJzpA%o;@2-+$euC zDm2!7*q{34OtQaMg7Ua$rne&{tZhpmlgzeYQIFqOtk`I^N>U3E6I;?PTvyQNw1 zijsc5EaXcl`<*#XX;F@(*v$At=94rX*4Ag;6XGaT0=Dha-@nl4<&)(msOHR}=Xb$; za6rCn3*C2Gh6D4jR28Rk-(Gfa&$U>TdcRE3k`w!tkdpewlk)p`L5IfY(z#n2l^K2_ z8V>2Mc6yh;gqIgabQKf4{G@!}Ba9~?oOeF=5!$b1* zyzA>Q;^Gir=R|9M)hD@y{vyde_{o5lwO^ULgCf5Qo6fj2u4gFBs1nwTJNk~RtmlcVubjP3 zdH>G=YsIuA8BEAr>HO3@e8r@A_2yPTcI%qq)sLT3qABTlPl}AN5bv3!?bF6bt8YlE zucZHKKm4bU^qqT{nQYRePNj~uConfCcplhFmYT2B|do>s2wkG>I+ z5GcrclvT5NB_PJ>viFz32wxtlR=Wv$9Y$9Oj5e{>&zs7e#REm}r` zppz7QG{4aNwpKXdgL~qqTH>Cad(-*w{Ms`7*;jL@BK@?5Ox(+F6`ZS+}GFX zgLk@}C~-H#e#Sy0r;k&*X}yW7ZOse8Yp&-Np`erH}S9V!|b~NM=ZnbMy0<+cWCdP)ZS&`{^=8M+{cla2Ha`|Y`yt0{}qh;@Y7Mbfm zvr=DLd7gA^wz2L<`Ipjzy%!iiR@QS=4`wIlr`uYn)(>+~kkfT^xcFu)UvfzAR`t=A ziEt@t`#`wWD#2{?jD1nileiQUlgp+F3G;&Q)1xo@DknsAUmaxUe{Rci^Oe+9mE9?) zb_uER+4q($2b^Mci!Gb_$)fd2!dc$vpc<=S}&6x*NOr z4>%H~`EaJ1H{UjVh1o`I@VN(6864~yjVh!bK7kCDyKO&8#6QOaVYWS$i73wGeYS6Z zSLBwELK#tNsH)0_HtaSpGdea}ez5n4OlAJVH!*K0>8GU@JypMSxp}JkSoCxc@?I|I z5gO4oZP03rWOFSSE6)-N>nM>;dp-#Y6*Dj%kP)Tsb=VyrUC*mC71-?pDgx389^ zN=S<8@D7xWjz1>e9`{m~isDh`U6xDnd6eH9(vGMoX3Iq=XVWW03XwVq*~%p_rwt@9 ziz6k!I)t^t z>!0hgzmDFrYL-q@#n+0GNUw=X7bw+Z9w=CG#@JA)D=mur`w92efQM^$GGrjf_WR?EpMg?@LYh$Cg0+3nW+ zvnz6^i9Pfy)ai-Knqwx7tecxWeJmxndhkf>9=R|eE`2gLZ!~L=&a&HWVkI`mH%TTb zosxd}`ujHT2{33L?@UVqJ{~3p{j_Px^HdgOfW@6HU^bpcQDw9%+h}K10;)QiA4FZNw2n-IO3KNxIXj?qV$(e^bQq*bu!`)Gh=datO`|o8-_WZd9IFL9w z{pW`8FX8#iHunn;ifL*(fC>pk$=Q>&6&3nL4>zL986IRT8r0l0!8*k6u$+hXfXP%8 zf})~olq*NYebiEJh{(uPqbC_%;}JYIjFhjHyEPRLBj>WN-8<=&@v)%3(ZJq{kxtBHjAK*`Sp%uNdbrvzwJ zuw-1|M_@U8J6^J~=!i)}WRL!-#>k#)ry8{k-6GX8Vt50dXXxna5(y!|jj?&tCRCm>eI^xi=P??(_Qfq5ewL)Qq%bjiNvXRsU6| zH1sn3ny&2_uGi8?(@Ef-pq9W73d3T82o-wVR(e-SuNxTHb-vr6s@lTxqdP%zYtfOp z#L8CBLi6sSA?&e=JnI&^g5~)^ls}{KL<;5p;4(nERJj0?=T4&50u1H-x3PT0In>(K zhfsP#wu>ox+tZIoiE(nGTf+vlcxdjx1ml#nvXD}4Rp7y{o@hG&2`5!g&UR6$|(Iu;V@e8KD4#v zqd;ch(du?|B}i5_-y&|z>Oa4BM+^Dpii!$i-vG`Rs(et`c+M{QIri#R-r9z(ZV3Jn zUfpoLjQ*Y;Zj^*K2o^a}*3yz;MbNrFiQ{F`T{iF|Lm|LwYh)#H{Sz9rG#;((O6cl_ zV4q2AKofz)qu22(^b3ot(y=k7@~j6oR(gO6Y7qZn;`iRYsB0o^i^jJ6FB{|-zqb1Qm>dqk6J_=F z_4QaBF})@yLj3`W_Vv?uKmtebfJBK(fIsmBfKLM4IbgFYLQ95Rw9I+Z8WeIulY$Vi z0QLPK-l}y;*ZgODq@BV&;g17NB?P^28$6hxd61V3CC7azo!8}%ChKiYc=(FXGLcfq z&IUY#pp0N*6||eLZ*SKit-+F_y#HCDLpQhvW5=*GV2f)`*YV8Am;&_@Dur1bUvV3# z=<3E&en%HdZ8ExWcd=_MqM;JvwR)_1?u2q9@P3INc|LN0&7)gw|!~niQv_ccrnY;TJlysrO5057I z2<`U$TB^yw!bL z_FrBZMz5^`De5K~LDzBq(WV%R>ZYa@G?NlbOyrpMuqajM+sr`kUtYN<)BiQ)2l$gf z@8^Sp>>rCJ8wb%s4fYTepqcen9aJaP($VQ39Tl{m)b3{wdOVjAB1xKpE+?IDcwCfM zrLPF;-DJQQS_Hv8tULH*Lc7!Pi1gWV~)o z#HCbX>-9a^@+7g+cJo3t(M}NJEAzB=rZ)BvsYmU0s1uK!39my@sYB5<3)Je!w=Ie1 z-#q51jcF2TX{Km_zjVpDpkNuA1bSvaEv*Ai1uANAW>Gbx03z6OM{o}jM~p(cps7mkJP_$Zzh7T{9S~+gZsc$(Nywak;Q6F&bbajfjkl zO)A0hx3hI4O2CjnbxnmPH*39?z(ec`tZ_hwpL-CLUXMAnqmTM|x5!O7Uvpq>yvziX zU3M{p^i1K*R2woTB_+oX9eRyMZ!pl}1rjsVCV_hHGz=x0qcLp)jI{f?bj^Nz-b&|) z|1@jL0+Sco4v6f(u@_9>N?;#+j{{GV0W}5V!mg8qEj^%E>+ffDylZ9_uaQ5G-feR_ zsK8>_d3x7E7_6>R&za#C-_dJM1$D@y)T5`LP8eDoTFG*}>oSxHoiLUabRPj;Ug7@2 zyI2O-{1|l0$Y6j71g0u&vF1ezH`iw3a{lE#UA=IkS?}tE z6f8D46Zp{cO6LeS4qSk^wKbK~tn(jC{QA)##8eV3;#7koZk1AqI98O7?i<7tIv4yJ zC%Cz}d3cN(V&y@9TWw7|0v5D=+Gy*sfKn-fQdu+2#l&wm4HVv^d(|{~h|GkOtNK%8 z1DgK8$${QNun}@#XkWjkC*&f+eknW$b~#AU!5;enC(jyI6g5Lmlz6_0v9XgJ9D|@7 zMCGzn;AuMkjube8I7?eeNtGa4M1nxEZU}k?tpw>93W$hPMNXW!3*Q&M5Gr9CJgzl& z^C`W#6Chw`jTSc~-_V^X2!8~YdUg5X0%1sM*s>dw()2Isr%o+Zg&1#9hC7-(WY(ok zrmSa*eM0FLEPp#ZUUV>kfXHc8f3GfP34_tPb`iDabc)Z|M@1E$l!Otc>40_NRf+rV z?_1R|I4hBl^@%#4D7p6GqF1%!xI6N!IJ7EW;ShtI75qk4Xt)%MICbPm7hGi+Alzg* zdWO-A?9`}-wN70)2ZXRWT_IrZs}8o!p{|B1wNcB>bL~4;Pl5~NwRiSGL_~Kkwf<@# zLUMn1-}hgwhxcFq0`7wTHthD#qK$us1pXH;_$Q}r&(KhO#(}jvJ-2&QUmXlZVgbDC zx6bnR+Io-9zXAvUy36)C$MaBf20d%nAW6MPqeX^5qRJEuw&+6G|ak<{Nl>FcQWj$|ed) z?F^%ic1%_x-Hw*wLI;QJo!vh9`F5ah1eYn@%}wig>bWLwHuW=WHKeVrYB6%~9PvW> z3QPr`N=rdzXSKXI2LkhrYR}L(fEEDQ7EE=4_Cw|m)OEAaa}O(E)K|bo0S4)G-3Bqz z?Vz7}_kvdiK||O@*Nbiktk7=o-oLK2R0k^LsF>GXV`C8RDrjkGU9Sv0=5#kH4h_&C z+pO~E5}$HQNioJuV7L*f&-KC5hxZ`)Zs$T8P5u@)$P0-KFsUxEZs43mL{i_@#=oE_ zu(D`M_Yvd`=;?wwVYZ8ax~LTeHAcy@H#(8G(18sWZ4kTgFklDNt$f3;mdTarb0=925zc0YQ%R+sFvWSk?NO>V5+^ zFFL8O=I3FK5lSV|u#5hQ=dP|-Wn~>HW#h)t>R=fcFp_GpS2KC0ulh%t&Io0i2dT2=+2#9mMzo5NHtf7}PJ85hS8eV5d&WYHF@P5y9XhBRr=8`S}6R zhLwfIkrEy}2Fm%U8~{OT%!iV1ziI){SwD(D5va49Y6eU`@dNd0 z*(MQ(nkd}%aeOW+x{k27wj4+1GC3?dame*d`b)6QAyM|JygUv;21tffH{7|3QB@s? zBCyI}z7{1t3HEdlBOtd1(*BI*&3n?#8^C^tsoC&WdGs19K764nZbsmAmv ztSwp+YlmC0M2c8!1bQgdzCc=o2n5kB0;vbrP_pFkc zL$f_%$|D&mz@)Ce$e0{yQyox^2oDFYfR`A%6D5`r;}3AU%LfCAWWI=sy>tOL0|vv=8ILMYf_YTpCr!HzIG?giC7f|YO{2#&vdV*|b@;@RgT zn6L`~X%v#Mp+%kvVR7P>u*a0&5d!w%t1&SED@8me7)l8KPnhiPn<8-jAWL)T-iCj` z?08%;F_4mYu+hpjlR4c$h+i9klL3XsE2a9nQ6B1| z%!f4>U7v_)1J7EeBCLY{4$2yql0YF+8ylOLB?eI2JjIro^~>t(>mwSKkdy>O=R|0D zDC7){2sA-*>J*CM&v-C#aS^*=5xa%~Rkg`g#6d*3J_45t(oN*k!a3-$UogPh;?y#C z?p|HR`?eT?h&zX2yK@~7!39Fm|5Wo_XF3&87&*Ddx#Mg z=VN3epb-_6>>lI)#K6tSRiB$JdEsNskjh8P~Zj10C(IzptuX6!YhA&|Iw(x^?z=SR@Lgl^xL5#i5Ye?AP%{^uBhsF|y-P=HI=`^Mjx;_TJd{5PIm1FVMPIoI zk|zXj5D$cTryZ6T@ndqD0`SDczHEuXC&Q2ySfOHw-K9}mup$x9Buwk% zq5!&*r_#zTMp_wJ!GC$qJdT4-czVI+c6O6I8j#J5l8J75wrLbh=Jyaqau@xX95M2CZ*TI(&Qd=ureVGymBh_T5LW zy8&KeVfDf&5ZI^MR3|49gnshF{(0c+#j9+28Dnq4bMNnxfmV$ukjId{kdTo4{3YN} zK#lM(au=GfvUFy~$IB`zys8{u4z=ZGfw~%9?=Mvp;Wu6_yxjmJ7v2E1k4UpDb_Qgw zFOMqt*nkJ$8q+`*fET+S;2lR?hcODWD`NN!KzVxc3xH>W5a-=BHLXh)!6Ol=s0#op zL8bTw1OTzT2fgQH^22IXfL;hJ7P2&eg)$Ktpi#8@q*D-CdU;~y>J+w};YB+M2S**I1ffjy zk_SCeGs?==!cLOgi!zCd7DN5>=+(S9%WArG zpFV#c7#v)fomEm%AwCZ3s=$BA$;HKbuS1M<3=}|U(~9bxxHU7-zVfV7CcXD(jHiF> z^Ff?t92(IP?b+mC6f=D}7<}U-GzJ5!V+E}P7ZOlkVr%x#qF=EO?E~O%I_G2LVuOEo zcHrmFUQ5=Ikno26iZBn}zT2n8I@M$@yd^ty?Quy4etiYW-;d}1%5nYr^85c#fAa4| zowpicouN@e_$&<(OTjufZ-ze4&du#LCjg`sy?C)PPH{A!8Q%L(qV}Sp5dc^O3$bW` zeB}VFG~bPnqyXBpA9aR_5-V5ENr7H901!4vzTv$Q-3~Yaj8rZxH;GMm;MzJXNt_&F zKHARD!%Q4$0ygDUodHCLC@x=7X>+Keva%^&xeiDST#CAUp$)6g`oa@53=bX@ftz>q z#}Cu7?;?Bl_yR_{v(Gc%FXBN;${2trAhF<~c@eM+Y!~Eoo3`N`ea4)CRZ+u=mqHe-b;6Dc{4* zMgWKdCSWz*1tpZG*#Wt0g7Bd68)mrBQUn8{;oC|{NaR88pu`XcVZbLs`o;FIRaI3m zQ)FAVFe;~p4^+a+Y3AKKiIfXooSbsjrpR%@S>*#!A%MTWB8%YFYK|f6cqkw4)NBcD1 zyjzu-k{GCGA!oQ$q;whuwv3L+Sy_s-$p{s{-8 zt@R9-p?;m`_q+G8kK@>Ti+%DaHjI9PCsms;fsvkVjLCw;n?NR4?yWFt)STnm-VbA@ zKRR~A+G*J`D&X-s^K-`Ud6JA4z#tvZO`H5%n$l|So9Q$=!9C&06Xy`ZVC|3*SyO(C zP|KpHBV^btk7aTf_|3(t8UL5;Yszg`p=O6yp`VEU&`&!fHa%u7S3U`Kb5M>C&z({`le)>>sE@Tic zZ1`dmGMgWH)-Kg(%1WhiDsc#W%-}G1aMoaVR^w^(Pmc<>%o=y#*=nkRcz7BlW$!np~oN;Q=Pg-Q?VpcOJo4 zkr@*eJT`5rW6L$_0>K8Jj*}>ETqEbQzifd-84F)OebQ$65{O)cfy7+>Af{bX)X!xr z1w&w{xgKe=G>jjONS&UR#t{sTj&|_z!K{%{q(ex(8XQ~zS^F$yQG)GRuF`rlH4*@a zka>@qW5yW&Jk4vWd3Ds;y#;=PSn9*|q3Yw*=d61_w|Wr-WD1~}><$@WVp52Rh>&70p0(;=;} zKE=$)=!1yVa>X5VXWaogoR_nHv>l|{vlp1HE439BU%_8JN6b8}V^Lc2Y0Hd3%<+0e z?ZS;b?E<6z4Y3>Pj)H2Z)WH1}Pm5C)J)@!*XB=j4D)MW8BrNQ2auExS%HE5=66PtA z$J`-`%F5JWaICGL4cVt5+^MqnRWjx?i=W_vYSXhnyr=BwYLl)|gT-yu-#4d=`;G41 zo1YW0rc~wo(Jz^C%zuct7?aaSzt1?^`4SCmQu{vsDRb_LeUHY>W_|^MKI6iL`#M)G z5?PnFmc9cSFlBF2HBfT@6z8!PP0H>`vk{I7@hFQNCYF;ciw&b1w+lf$Rsj$P>2S@aGOgDSt_NtTqu zR5LE{^nx>yGUaeKHn&f|T)@#4tKXz<6|DLT3xj+Nuj`ALQ^FD$MyPSP4R`lR#6ZF? z=Gp)3pRwskx_0)wrR?P6coom)#3LO(f4;CdDg&W4K0Jj*I`iFO#}Xf0>!nYY{>-TZ zmGYey(p=t@J&kOc3vtH}=fPpq4+}+$6&wUSOLyx?k~t zV&l~&@fMf$Ec$v;HuEImCKmApfO63lYkZ!SgsSZJ=|5t`38LhX%(-Bk^u)$d3!W5R zw^ZyyNpK{;L%?6?-U}?}fSu#p*2)KFZK_-R1Vp=nJ9h?<5V$RT`CrKX zF7EbhKFZF@dcr^}pd?NVxKSPqrOq)`M}4N4)F^yxUSv+~B(s!AMbSu=LAWjQyj2e2 z@%qi1c-I$1@IHeFpDA&(@Fso6OyAC!mhpisvdINY6PqxXyt?4(!cIe0aTB3fZel3m zLA2nLbdwu0bm+$?i6f#;kK$eImnr9S=|XF*-+SQ6*q5-yh~X!vx=6}F!jU|0Ag=hpn;%j{obZr+c!q-&%^5tf-7!}%sFSo?0TXd829lP!*XNvit zX`9#Y{W^N|XmJ-2u$pi>XYSl#yiVc?6U7!Vbe^ADT+>K_M10T>0tZp;q#*<+wXLUqD)wH{8vT;J3taK2c~1{3~JUJ2YIN3>P+v`NDgT z9=@9+NBQJ%(d{s{A>t!f;(&?skCbfQD+(Hk`_TUVo`fi6%|Um?>BT?3e&yg;Gae0q zz*2dQeO&|_3=(H;FPLmTDeJ4$Cscl&jWK}UZ>-!n$`q1;!(Jnz!nIjvxrsnWN}eOT zE?vIt_oZMoDr9ecsR63jNHM?PHNNo0dqHK0)=$O-(M^LWKn-_%*E!(&k~M2``Q#Mt ze`o6FdHkV8Wm!&t2(lJoOl#sq(Lupz<0sm!6k}uu5tQIVgXLPs_{qXKntL&6}~EQP7NUbQl8>MMaB%^Yyq&w5#&u(W4VMWDEmU zKqFu4VpTf0)VI-|p`6EaQ(q3|pi(YU?B4Y_q#xS^zL@pbfLO=RM-q!LVe&T+w5pa+!Bd1gMDDgALV4kZ#QIuT#Le);kevZ#xF2n)|52b*h#A?)i&*d_=f|e|^A#wmq*%XyI~lTwosi>#xU4IAOx0`}gNa zlzsj@bl^ZFs_p;=${7SSabG0FtUk&4Cw#~U%x4USN3QCrpLOXHfvFmN4F~{p+qB1; z_LWM7yWCG-YLNN|R%b$Y>aKkoK*9D0GjTulfXJkzlaj?%O)Dd%Xg0NhZQUV5o;mpC zjFXwGn;Uz=p0kCJTn%#vKWXL50-h>#EJFJqI@yk!%Q*W$84-n&>)t(x!sB(BEdN{{U7y22QgJ~MK{~CBAp|Q>1Q51;ZzlXV> zy3vjI3r{32tpf<}*tP2*92KJ!;l){E`5J@(?2JFV;z7(2t^6FUiZOgv_y&-Nt%T!> z6_Y6v_#K|_gX7b(3F=y{Udbsbh-t4VdxvC-Baa`MIg4VuZT7pIDBqn>Q~VrebQhHR zx8;1xP=;@!B4?TC-XU5OFnSJI_b$t@W()bWq$ZI;%B!56ivgvZ?*HNDrkv4BIYZTE z*!mb!b%zWU>)yZqVn4^3opq@;8SGgU7Z}-;oQ3A)Bir<2^C&r5eQCfOCcF+e@+fx%HA248B24D`rV)}v7vfh(zaSFKpVVBg_A zd#dr`(K@RpY?qPG&v9I~Y$C4KcngL>8_3EOoKJ?2jn9GK@g?#7r|2w7!uIQ0%cG}I16_? z|BeLB_96KVi=j_AGRwavCa)VMr!`GZ_dXmL@};F9qpEsmYX3WIxh?ij6FhJ}1S_O|?K zF)F_d>%33VfIWs!IaUCleD_0@PWv zee#Dd(3Uy~+;nu>;veHIN^kK0-c2_n6pDV@e;tY=v`K!iemq)D&HQ&1KOYf1@$JO- z`(gGsmyU&ph8^L#lK@3p=^#2KECwKP)i~+O3#?n<{%EXx1R0{kuE(W3S0(_A{@$+Z z4taKh7Q1Vxs>NkjcX9;DQY=TNt}!2&)8;WXfOKoohxcFEKkKUT9(_s*89@!sw(jqmOcZfKkdg024eQK`>v zlo`__>c$QZr6nb;1Y9jYwc(3SYW-P+_~Dea=h-vL{iVd6eB^5?p;zG0^>HTsU~CAV z#pE6F1n^&N(g_KTtf(?7o#s^^v%cH$PwYDA_C2>46*d*(4pTm_T$^obiZ|g3$~E;WL5WHVD@ILiZ7ZzJ6_Pjj9diSZm-^U7 z<*vo=*?w5puv}7?U={farNgCAoiO1GxPh;E8WSID@V1oSl>C0TT-0arTw zXIC;yHMSQ*y5TtnhKSW0*qI;WgMELg+)W|rpL%!c(&fAB>_1>?nYl#D8CplQKDZN7 z9(-8|en-DK$OJenJ=`m_(Fi4LmAi+)N|0{cxop-Y<@4$n)QL-V_ze8sEB0K{(+_-o1-CE2IF)(jSY8V(ZQ( zkm$Bg&A58`@{rf$z#BzH?%=;m+P}Vl9$@|ni!6uV2w^M=#vEAflqvZ+v1>q0ge!4t zIi?xBR$T9c`&JvzovQ<;Bzch>zx+v`bw{SZVMhanz2>spQXEbW^n0%hOV(U8nucZS zKzO(%9M!v&KiFyL$wO=34nI5NRB>cKTC7TcMSm!Yn(E@_mfSj*LReff55tRxyJN?W zeA*GJs^_ph6E(fr5yxi~R|#RA5=BowAT)Brj~}#B@xpIF$nlxt=8xr#mGU11QdY1v z|N4b-;ViIBRrMi41l$iq_&raLI2iBZGCM4SqkD&#dm#6lLwPg*zU%HoqE2KC@=2bz1do7hrZmK(GqPvH*VZm zb5*H;G z(`KEO;o{^3f%gy&Epa~c7w;DoB=X^@%WIYm)Ao`LMB_yn(3ITo!vb2&6%Z7k=(*$V z?-0?=i)T~<(^uwQzb-BlUbAKm+PCPGsJY~x^pDL(XbSRqo{<_TL-G+9SBV?3xirvc zC}L+9WzO}z1}#GQ0#0tmMkg*Sta0fwdCHW{Teet}{FRkWYgTjBRDO-+6}&Gilj|OO z*_uZqawVXn9WsPS_8tVZWk5R zQJ8V^`Tn)g0rTtdn20|B>?UVX>|4Tseg$sf(-~YVkh1nVlb|LY*29U zKs@f&-TsuWg3n)lD3W}_maI9hdfHN|dv`d654iJE?X;+Kc|9XAT_`FV{Vw?S&xdRZ zYT5FyKJ})9&2RtR$=5vN-_7kc+jSjf6b%5Qp0ob>SHrE4Ggck`_mbWJYg_vNN9@DE zJ3|FUnJrs>k(IG3QC_~{k?q^Po5=nMN*>1o-ix1PzSpMUQ?ZO9N<*(azHwv5_gqF* z{5;k?TXbKOL%N9lGvd-$jwWTVYpV%w5K1S9r0nkQPQDbkSAA{bd$9vuQC(f#U-D}L zDh~kJfk*)e3Y39)#vw|Jo4H~iv8hm6y1#y9wPK%n#7Jx|*2xQF9ZiYSu%1kWADIIa z=Y-`5ci|tFYbX>QF*g6Nfy-Q7j~+hE_j*9BBq_&!Nmi5BR#xJ~z6u0@HL9F^32u~3 z_4)H>@GBuz#BzT?5R5`fax%IPLAHPI-X{j>f`$n6$Qj+_XePkBa1nP}^$7q7a*DC< z7rO^1RPsmgjJ}YkjvhI3Dn3311OdHv=|!gaVr56zS~q1CBOJiD(D_--75h^9Wr}h7 zk=IwEN0Z1&rS~3-Eo4}McgUb^XsD~-YfRET25f?Hy$56VeJ=_M`&Ry;D8<#dTsaz} z=HCvq=`+USB-xgy*h*rZ?|%96<-LP6YIvndo5aOF+$B27`YBnlNniu_3L3DnvGFR5 zH5WyEO?)-LKQUI}*I1Mk4;V(OV}2IWP(6G*M1*6CWDJpGmc}y#J~B zcUnoE-}|VX+4&7qN*XhD{O^CtNiDK1$~d0$!`8Jl%VPwaj41z0OZ~|zf}nEnV|DdP zH@6}E`_GDCgIe~!>c9O?jp*SV0zq5N10_BTW3}m$B{4wQgC>2p>dDGTbZpQ6$?dtK zrfWkf8`ey5sR=PBPZ}5-C!RdnQ6*095F|E7+-M}V!|uQSNG=f+zRuIL@b29*`95T>MT-`VA3r`=oe(;W;%lp3J*6vu=P0{)U%hgFoz+tSo&*3> z#uH=M?S`zlmoR$y@@9|#aS(T2@slS$zPY|pTC(B+<*9EG zEjF#(2v!!}?5m`72F*#(g80(up%0iu18t*wq zSbjwmwG>Q6{cf)5#fv|PH(k09nr~~n8GOY#4hRs!j5-R~$F6x?Nl4grqwK@SkJ!ID z2=mO%%c`o1A3yFOG;#6xAr*5cQN}d@&4mC|lt+&&7A#oMW7mn4l&E9Jqy#3^58R$N z0D1#WnD&$KW5?_kEErX?7AGfhi)Hfv2xu3*%6>)fog6Xl(Tf*jl$5#&OVSqd<|2Cb z{O4G4y2`WL&#{+l4RKT*0MWMggdNr}bMu~po{w|{9t?z9eqgQ-4U7y*M(xZdYQX06 zjaRw4M*rDwIWWJ0A5P$fVmrryX^O$u$a2OEhAa=HAnDh22chEcXV3f*x;bHc_s%sm zyhUw|4Y5=Ec6(-?Nlj%Z=0Hvy00ps%sdE(UCX?Me2`k*)9axjjKS4hw<>932(qmUe zS=rVKkz7N<^rzNkq1VIeZ$#RjAxqzu%j)XtdV4n$F`Zpp!k?)Z6c+v?U$7k!Q!cVH zPBsrT5mSYA6x*f>6V=rzyZQ)vkwSO@oIoSxHdm!@-@e?)9y9niY#N>`D`QkyRaZCO z!*I@=l-%55t!q}Sc)NCT`KAl!&tt-G_GtxhgJwk19zQ&gl|xKriOyoNw5F?|m+%-9 zh^mxmHo#B@Yw_#!(4+U!F9#gEEPupoNY?kFmoJZG#U&;E#GP>Z^l6SLtOXe> zGX@#ne5S#_f{{#6U03xDJDSEXr?fLw=$$$TCq)muyN|t&IvETE1SK&c@4!+pC%);#O{3+n-b%^>sv)GU?#Nu2MJHzOE-5 zdRlpJg_GpN73U)(`$19vIjx$SIFftqnqm(sv9}*8tfk8&Yn$=5%a^AR2ff4<>o6BJkp@_J_mZz%!vGR!Lqvlz0apLLIGMlu9^hlF3 zX^(aCe6$kuRRBQkEuUC7oP=CoiZ>zPC&E3@Ga9S&E6NskJ0yiX8-x>J%xcU0d7B znc09)JbfzKj)iP)L9jt5`(kq%ICyXefuo3r z4Y?~lBLgDcnBkwMr&3Z;8;kywtPW(**j5&3xv#>C0EwYQFrR8JnX0$^}i&=I6 z@-?6wPmHVR7jTQoTEAffO90=xD};|Z{+7`PZ}%%LeVG~?TSh1)7IhKmI3ka50L=T{ zrf)efubmK+lr)7rM)j}jRWFz>2%&sI~C3fO|hBLefx-5?VlUg zlG9SWz}obv;iutNzAryZG-(R~uOCI(Un)41EWiECGmnoB4vG0reVyOqcJ3NE>9BnE z+7Tr$I|?7NHd!^LMQGhhtH_iHc0v<;yEEB8{@VU!MT^Ey^ORS(|7nc(gJ0hVlr%Mr z@3*+UsdvEnSa0j6zx~g~^tPXq@%!MiFL!<8XPNc8;JfOVmO*{)yccaIU(Kb>M|>~u zc2o02cJ?B$V`es&my3#gKVavDix-KLk~^*g0bzfdS$~CT{B&ZXod2}7B+ANlxjZ-y zGRnmX`z+X%(=VsD=;w7=c0PpG|Y(gxQK}WYLC8LP;1?=E*8yLNLC$33Kot@b>z}4@287-`sEgVoOT%oy|Xm)twH$J>@(5 zaCm_ea58i!l2xq2?M@tcgp@Gq;5VAMqK6dUz^n^iKsfm3nj^y$z82LN%R z7wcy2#n$bPhhU9Xul@|jd{uczn>u{`yRXeQHZ}uxLan{8tb`qWuVfOV3%x>Fvvb$3 zM%_Y6d%E=%bB{{@`9N&WeY z!>#jdY{*R^6_capiZyTlqL=4he9Fqof_#*5ar58BE&SQklx%xpcis}ne$fc`_M@@z zAI~eOP2GQG&2DGsBD1R@{z-Yd#U|33pS%P(e0XIo8;CV&{R9CZ26qDrFq@fDrJA>-HU`q0x7Z z-mehy>$P=Zxi0MHLhK!>;x|t6Tet%wY>H+!P~)3Lbo`GWylsO|^OL@}_lFO2Hng+| zPdgG)pfqvx)E|>J>?jy3v1o9ayWb-X*-v@G2k+KHTHcU?AFDe*zZ%ugec3XMobrB# z&*yg$V$MhfM$0Ud8oXW2xh!=?lkeoeX0}jFi%cpd%sgA1aeMo(FVB6Pa ztEW|+6@=?%8tS7oOh;ZfkPnmC6_OORKg26V5T2fFUayf7InO$=XGN8D?aD9fu1$T_ zPEfbmFI46h+lFnCAx42}FAiNvKb=w? z-T3Or3QrS3Fr8~W@_NJGjiwLxs5!Tbn!b#59yCVl4_oo?ICax{*NQmT^vchA1JmEz>&&=|eJR-BvqzVzXB`Vtrs`Q2e=yDMEQAhHPtG2>PvTzL zTHw>mmoG>5S~+$2bIbionLe4=Y#(LaaO2~8*a4}kC*z<`^BwS&54>j=J%fFmT=#`dea#9-=CK#YgPT$ zJi6Vw{QLgsP?sW)yoe`WX}{VcxBd3-*4%CTzl&?}HMZu<=i<{vZAa^P!}4rkMYMwBijoU%@q`;^*^az5v49N9j;JWvCgD&c0C=c zFJHatAW-cX7~I63IzZ|+4qcod<9Y>y8z5V^S2SVvxssCuA=u>8O5~@fTM%IIq3C)` zbfl1=q5xAyIG_4U^u5AllRK{Z{+gt${8xU3xycN3b8!POTZx4LN|4t`vYL4o3QdpA zbnhQh+dlJz=q#W|tC#tmP3!~Tw{Kr;tlUmVmWTfqdyO##B2Pp|n;lLB@<9q_y1k%- zPo2*5@}J}uPz0Yh>hR&_k7uv$A3>^l{_I&M(@8RGeAFUr8m;DT17+ZYH(I|>EQ=Kt z4Gayx>uy?j7C_KAOWEH_!vEqb@D$wr+}X1~nw8@p#XXLX<%5f3E}UhuqO$V6f`Zs9 zTPTZp03mh9+HNb`q#M}SG-F*jH*!c17t}^kU~n^_F9*I9nDc$&iL3Fa>{K?v`$Ke` zyz=qGhtnx3zNiFekDmpH@DVBaC`d3x5DIzp*yuqlf`D|7(*XRedT#ID2Pku}M>j2H zGT;BseBROEBjzGkUTVGk_B^nj4e}4QgYxLnUB>g^!6>2&sH9|AjkU9L6{Z=en|1;m zKL8Bc031WDQ1!Jr!h`Px;d?SZp1*-W()Oh6WMvk#RZUF|-#*81>uv{o`*Fi|-dZ}8 zCD>Y8hqE3H|Mj$SUboY?hj!kchH;Ahw5o^i(Y;I0%8#q*9Su70H|bLE0_^U0l@-uN zkZ=m&l0p_O!t^tsg&@pysarbWw$lXag6j2~hx-a~XU@FJjF3?L7*BVG^WA>T^%=Hr z6Z{agL7}aYu`#_+(CHgCY~aDrlvX}jWf1KU#arGiIGwBx51V+gn?)>Qab0Y(}DFM`sIN~l|oD?;8AJwy&SwcjDmz~FRw;!Sg zDld=gr^D$h5_(lD%#(&W|KxJP*IP|bdigIefT^)Dy~hKjm>2Ma5+0eSw9Z9&E3+tH+`?u)gX(+GKcQn_h9IQ9OrlEUbz=hXgI0=kRJK3UM;e>kD8m1 zaOzYq6_pr^X_8uJ5)<*u9llWpErCnAibokxXg4o%x7`WMA7OpvG&Byl*%s`6c(j-K z<~zRwha7y=C#b`L74Vn7o8GiG8RkqIFB3Xd(kA$)gH8Lmt)d~2<_oC#;L^_ty}r9- zRbSm^`84E<$9B6AzrEK3YF@nOaiN<(45EDJ#}j$PfTW}v>fvS|ohxF?0L)1G(!IlVkK4^k z|GRdJQ^dK)3baAnvVQF>aa5+1bXRN1q z{(Q2EN{_{9lp*wvZ`jaRq9fPu7xLY$gynGL5eE*S|8_~~6?lL7Svq|lJgDVvRub9v ze;q|xz3_@x8Wq91br~=>xLHs``1=WQap`RK9JB|mZ4w(hrzHQUMx=g0{@ zh})!B%#EPQBR19%Y7ptWtAs?1@W6@JVScAddA0H$!6A`PW07P#q`Nv zpseNEa7N7zsm5j|D&-C+e@6LMb}Kbi#Z!4oRF9Nq|MrE+Ta-p`B~nJsZ40sK{k>-2 z!dyKG2dfKpL+EqBH1uO5oiI6xiPeiD6Ev3?x8~>S5OngYJhx;Y4GonYHR^luL`aA? zIP9sq;U{2rfn)rl)q!9i^ZgZx1D6IEcBkWWt}Zqz)2z(_g~uBoFJ-f9XgB)h+QrQm zYi#c?BZVbsU-fZx2+-hf{H3ZS`J|SUY=5%~Fg~*#6o_8BX&zF*wt_k8dBp>zd>$WWTOh$t+(dK5~ z^!~A@PaADKuee~}ejGR6US3qFc~>#=ie2c^F$BUjZ>9|T9KFR-Q4A-O)YU^j8ddiX ztGIsk(W6HQZ*>Xp^;W7}xpD<*`t$qu`AgF%-z==GB99$2P2B9Hg&3r!so6-XfOw=G zh=($C=+NKl8WE3Vm9B#a3Qirc=y}J3B6iM?&|f1Ig=-GMui8>)8xJq))-fU~Fxf!- z`#i^aIw_$CPDkIk@1WKLM}bp@*}%-`6KhM&w)rlD4X&uLw6im{t4?r?{Wjz0z=Mw_ z%I)hEv3QRAZG-ldiiis;3(pA;t`aLa`{*y%{U=SBQ25{h=KkK&GptOP{xrU_*XhKY z{5y({?!VsMO-Q9xBPlg?F(h)s@h%Oz9rnz$w6^Xd_!MPWGiL+Wi9(CCpy%R}fS|!I zqmhL4ZSOYV_2KUFv!aM-5355;;tf-raveX{)Et@YA-^wwD*H9SLBZ?AekZ)TI$M7H z^+iR?VH<#k2}Mn(3mP$$Re>7N##u{_$fY?0YPJ-5Ko!zB(EYLVUuY@9#C~sJQ!>C>mz; zjo+tk$J^9XkQp=x^B&-|!!d1tZ?E4RyhSf4neD2M~luG^wcQ=#=0ViI4BpQuK}AeI5k@Zr6TPV%_)8t>bkf&xy)n6YE8 z`yc`mUXUjAWV6B zkIHE6Gk~BmOq=q3VN05c`~|QNp5`n;H(pWi$1lLD}x;u z@^%?6u;gpcH`RP80ooroNuL1&B%%hRToKebN1lr-v&ygS7X-*&rZz-ITA?&~d3o8` z9QIPh2|>VNepK&g)$1=arV&DJZv_Vk`H&0G4+HT`h-tr77VG-Cb26Q+EG#hSJ)}jQ zm=a6NacmE~6_CojSD-x_`OVGKJXclr(^OZF2zBI;gKVii$hq(s1-mC<1k0+~o!m5e zZ{r(Hc*75j>sq1;aSZ#euisuSjv)no`}e=`qWbVPxEV;+%w9p=-0|Lh|N1GGZ;`678Ny4r$Bz(IJE8uJbchQzc3fpH~VznPMDR* z@nJ49@F}m9{*m&too`hTgEvA#M39fs|6uJEw`9k~#jz*n;NAGgqS+La)Wb)Q|!aYF?`x)b??_~ zx84l%_=i>|;RKGaEUadFr0-VM29Ew8dYkM@%^R9A_PD0H|ou(%OA zajqd9$;E}{1Tm)}{e)rS=E_vD1F>I76#=Gi-v#sLsjhyht`L4WDr$}aVgM-&tIx|z z>qcMEuihEfH#~iBgrB*)2XoNq-#ACT5I54PNZnRFVRj~`lg%N;wFgP&?bXH6;03UFdJ zg43utH!G8`Mi2VW+cUm$jaltTevSwegC8MxcE)F}$yj=;D}s6F?L85jjvO&*KCiE* z*t2SF_|c=YRU~ahGQHP{UT#B!HzTU;b^AdZ+noy^-Yc3mf12^)b*~F=zc%xhagh#J zUonsQvRu}ntwKw-queIJL^p7PirpYBER#d>MLf}1YoG3-uhnnfW{rrX(SP^F*MEUK zfy!QAUym}eY2!wdLxWDcQn^vk03YgibAstkrk<%@{}bR!hMALiC}P9N!JiS8&2Nu- z^-9M_y59O!YL*>X73YS(uT8u1?D({_u)9@$MV8h~yb=VGSh)$?s(1-Z1Cp}tG+IHS zy};ZN$puljmiFz_hhcL|2E2R!J`+T`wCW^r+N%(2T0rNhKgklrr{68a@i`vZCG9ZV z0KgE@!Hwj~n3YN@Dy_iuwuXKFsNqOE3Ml*I#~0xtf>cgV_XJX}pJGp-NWWK^<)d>I zRX!4Ix)s|-L4mmmT*hDy6kdYe$Bw;bCW=DZ@U7Td+EsQ$#cLS(^x?xl@{w0ly`0^c zIo{UD(%M6N>>42>F;+>5Bv-a-JSqv_l-D?P=;~Fgj)aGIDBam}ypn8vl;rD9Vnm9a zmqmj`=j~+#qq4O)ab4~oxj@HLZS9&VQLThx(7>U0|LG`LY-?+B;%~9dyP|^hwG8=? zt{i+D+uA06qnPCt(F7tPAu)iiAtE1B32$X6{Or89qPz+T3rsjpNog>70ANzKbjy?| zKN@N=_fkPqxMaNe1Ww4SO#}4;7nv``@4%5$Mm?X>E9lwBjHQGJx%QY>-%-`^|4VhQ zz&xd(pfGta;vE?^1LsS<)i28n91L+l29I&=V|hUjHJK^yXcp(r&6_oAw6d}rPna@= z0QR-Mo_SR3admlmZsu_c*RbTkWl+a}#EYLjV?ajQzJ1dB^3gz>P>;*5C7w9ZA<8gr zF*zXI=rf1_`xa6MGp*7uT%i9^1OaZ7IS~}jIF5=APkayBq?KY%NXXs$_oHY7gd^ek zIF9qfjCttL0QqiM7{OxXLsQ@dCTTDgL4^{TMTGec*p*WpuC@Zc3^vKnToGmz5gLkk zi(3uS!)5vM&Mq4Yyu&Ii$i5q44S0H{^hSUN%Ree3e~R$0wieYV7YO9_cR@iga{Wb6cizVmlGN)Bk2}UMfRLUVLcE)v(uBi{eoLAOY_qr5<^8vrsu*qw=tTXNHe?#$+ zrG}uTJ9proW9I3(rZ+w_CYGqF9aR;lGF_asv_q%lm)yFyuC|`TWe;{tIvyBtrv^!V zMr!|0!rGr~y?1aZDqE|VZDVd8wr3Bt;*oiZOoIcygi+1HKH`sjt0zRQgF^y*bMW#s zQ&vQO?MV|jQ_7B$MGVJ{%UUa{rSz<+FJac^eKG(_HCp^{f{5H z81S0xM#m4HX=PeC#p0)7ga?6UhvPyYAMFNh<3ziT5%1*DMM{QZ`~?eBR!kr7r)=|J ztwfKmUFi+W_NbUSdv=JPtnASc9TUUI&P|&PWsh17+B4ItV__ClnUnMjMpIue#uGov z`{aqgx*45%OMdv1=hD4T4sq1=Y0?|!aOchO*T#wmg4|T=-ek`j=CZ{#hEY)1;?e15 z8W><2_-+}jxNESd@sh^y&|cp23kwS5ovz)fP+Ev%CwNUNz+MLci9o28PDW3Cf`#32OFf4j0_(kb(@nXM0QJm4daSfa| z7+&x#l^gXB6-V8;C@|{P^hLYxFaP!HSBQc9niCN9vsR zTi^0x@U2QpNojAY9kMUK;%jsJtpQ^G8nDwiqFug+$;zhYW^UOOEv<1j>EiNMiYz=w zEyTbw<<2c?1e(H*qg1YU@f^0V%W9b_`-s zG$uw6Xc5HmFA+bVI~g7A4sam_A2`sd^a`D)eS5s3I2Id+?%l)iGEP{+Gy^JbGQJjb zB-YEu40l+#@Hx)M*5${K9l3PLd)2D3uRk{OF-hvAdf^)Is!Zv^moJ{dKTM2_MBhD8 z6E_*PTMy}UIXn;n((?@rD86V`VuH_cx)AZjf!S3@ewrI7-A)MFw@>syZqGZHmPYGB zWrJ5vmEqpmrvSFOqs>fA28lM>b{&EiK@(C9)EA2;#-I>#%Ju?Spmn@nW}4xQ7I|#ON%Th1w@SH{RbP;3esOZVl;mbh_4bmt+T2Qw%*-5UsDdM7hC|T% znGzU68H?lQ_6frQ;giASL0D96!9#=+x#J&x7P*X@ON`cHgZiR)c`k>WN-@0ur z8D8gj;(!)N@y=bk+}N~rt*c2G=>(338dp>*eM4j=J2??`C_F_Qaw~HD3AB6}xlWohBo^7&*T?U{l*{zyx zcZ@bHYwLqIkDe^Cn`IIod3r>=gTY?cB}-IMe0YLET@>zG9V@xlNm#637sNLI`(v@ zGK$u~lx7swat=vCLXvv@yxpGm~` zIG@)s$%eYK91C5Bd#($2B^Rbq3@0Uxjh!b^WH;j7kz3CCFWUXApE0tf9rt$O6Ebbq z(W4}U{Ps=TKNTCDUR-J)_UH*1qM4$x*X)5fI*0b}zpKIvQi)XM*r<5GHg0duz}5c> zzRhRy&xdarT<+gl>c&sM*FSXzsx1|VZoS=E4~rChc1LG{MolEUt?Eqjv9r#b|jMqxSv7*OhQu!VTr5j?78Q#DIc23 z^E+^8V%(KQ*47D0NnML}&bPGO9;v3J^pWpb|K>>3;qu?=V_=C0x10-Xsnd|J2&*>_ zzdl!}J}8BcQ2&1Nkh$yDedRpTsP~(>LzGGgCXrr-vLyp^W0paZ|4&Qf+arBEbCwjY zUA(YG*Acvh6#^B#)EqGYVV$S=FE*}6DoTTxsz!8t-JmT-*3@yUvrO6`i!(j z34b$nVEZqQ-Pcc<23FP48MfRcaCHB(fbo+jolp(wH46AOW6Rw$y1OictlO=r4?8`^ zBP9KZROb%)9u1R*GO>;@DhT2Tv2#oEFl(o>cqp+4V4}o%&;ib`;hlR)uUvZ~G*IuR zs|%#+kt1VU&zoIzuk;yHWoq>mPinA70v{QIQKwo%Lj!FQ;r0_mQ!o4T{3LWB0f||U z%!C*Qc&IuTc9t(3(JOe#;lrlyz?kT!EVHX0PYhIPDwuISWmjk6au$K2}h6G zg&@_^>)msawyM;KIHNlqL#JG$$Yesz+l*N_bO|u@=r|4>S-$&yw{A1NW#r=fPv3Z6 zF#i6tb~mZkPNjdXF80z3>FE~c=B%yY!qYZ51Pf-y3xewg508NwtNO%$RE#|o@um8{ z>;9mrFf&}OEF%+R<1r&gjzqXuUgWWPVt<5H!aU>3UEE!3w%oXVTY)-TWqk#WpLueG7F1d9_Mxc?&>r=fY5$o&fcl(-kC~nQOXsp z^sU;GhZ=Unsdk@@S*w_DR-ab*^5vihzp1XSUC4t%q)rZxj9jid0Di{TXQe)@%F;bE zOVOR07Mt7HXwhWGz9OHI0SQL@-V{bn{aoLamCn4dKgL>B8VW#GXlG7f4ScX`*L|Vn z1edKHk|1i07>dQ215?6)d)E)fM?CWS{Zm7`F5uQu8U*(5d%Ja>!lAG*HD2DNqvJ-6 zg7Q>eF@<(?ErwZ0)Q2f1npSmp%y5qY&Z^_MDw;Ts- zM2>~u0VKB*0`=wW&L4`3q6=VF!sElH3U+DuG{d8#rKOdfGF~7kZ&$*_Z2NZU8-VNe zb_dcI=LGMNkaD^#h6MM!cGCOMQo`Pkk?~^3iES(7;Q&a{`aE zv+$3-Ij@wj2HOt)qA4{KX2Zgwy>RcSrgUzXH7i$oLk8kWroOOIe#*aP*BpI8-GxKi z-kx;c-#jJ}JFD^uqzAKMVxu*2VCzJe9(7RZ)3r>kAAm;Wl4%%hg%@Z&|D7+ukehCO zAO2&!K2`ge_GMYY*kJnnUhO~%v7>O4LgUjdiYQTUu)XNrsA1Oa!CMPm0io0rR3SY* z?-Uk_B9z_CxmQ9S6cikuwq??jkGxyDLL(0xP&<4Nz|&q3{WqpU4pJpAp9{#vkEoF~ z@5Q;sm_IiqE9=nf@*K(G8-MAZSrPqtFhHMj2F%J}X~<}hbYKLZLW~i1+*a5~{C7yg z%$s0Z-PfWAi?;eLaw~k=PLM+R&(8!EZ{EZic`%uzZsBV$Wjt1p5bo%3+; zWmgg?QXG$sD&K7o2UT-@s3L)(jztn6_)A^NCm%m}FmuJ<@&cVWQayTHOiPRXtDAsu zB=zJ7`iYZ^i{)4yXU97~_Dpav(Xvd^@_sEY5@0@9XUmLp=fs13DTL?rXvKNV7T0Du zGop2bEzx=?c#;qmu&GbzoYV=aA*_i|v9aaUN#gY@Ql&v*2*PWFs@%UWgU@uc003e6^ zD4&%XG~6#;|oNyK7MWk|%S1IZE*9tFcD>~wUp-sO4n#JALT1%2j??Rm*&%>8BlGZ#u+dKErZ zGQL+>cZGPz>XfYtriWlv7AzP#!O4hWQiS1j>3Ki5R6Z~pc0lo?;mRLl#0Y%o%Zpv2 zTtLSMY4Vy&IG}^#=z76=$;0zDirn^){-Rf0Z2K1iu3Yh1u|iSX+O~aRT8!q|nfjI_ zCnwABLx<=LlRk?BYnt!RK0Q=mFYCko;q-weA8yo!eKczRFl+DZix4Jr1qd=&_Rcwst~&@BHqJP{YS%=0yD;kDldBv`Qp89sG~ei^2l*avX& z8uIen{`hg*&s|~}d3ZuCWsaz@#m8g*i0LqA%pS&M5`dzhLh>6#;U#mpjK_QGr^CmV zFmo6q6m}xmKSpqrc}x_8VE%c_5@wu>N|Scud#YB_zN$DRX!714_eG|hw&JwSDspm; zkh3sLJ4*9fem9o3699I&{>yv+sIQoeKu25{uyZK8AhDIm$>kLlNvlloXRY9#J>9>( z{Uv?LU83VQZ2JEG{#osZ{OT;As!3HqlRJS*8XYyzm5C*ra zL*EtOmh$>f-z0QWu;$pnVR_3g-LiCDvxXT~-6SRRRFf}UC@v~Go7v$c#2BrTu>D(@ z1VP&xF$Q_)U1cSMHqO^Y59l9Srr-`-A1+>GIe9}i4)r=Z>;BUlI25o@1{Kpt_@q9kB+Xa>=N2< zh_Ted*j;XZ`NRR{hSxGs^u#XC(>vZs?TVteuG4=RBWF+3q z*O+QrBjR${uu_-Xvw#2hpFdAyW7v><24JyEXT$pSF%fjr(A_8Q78o(2!_?7&$Q~2j zZzg#)9r&ozRd%lKxQ$3Wmo^BZKw4E*)oUgHBxLxD#S0fAQFpt#oHo2JMN#-Atjx`~ zDtv>rGmwr5>Ly6^=uyJTO1hG1EPP!%{Y3}*&$YF+vDeU@Bc4`;PM#EGEuWMHtSFLQ z_arw(T*$@`@P`iAX>q@xg2vAC%#$@WmD--?^`%nswV?F3A)+i(tp^SrYR~vG611%? z(bhOoM-cjjumeh`Ux>(dhlM$EgaJGZn*(nRSb~EF1*5|A5`Bg~)g7zu%ud|g%OY;b zCdH2zSo1S{_;4obQNgepcS!yiS6mVtwRr;?sgUYNG*DEE-IYco$Ev98oVr4sGEEu6 z)hwG_!q6+1qG1E<<1Q6+4lH^P(U(oszI^$5ct6K&P6Vz19ttxFuWz5vxa+rC8kJd` zEBY|Ece7?RZrNm`ou3RbM(zBxqM_L*z28nxoT8qNNuRjBjFNKF5_#me1&X#cA zZVNZN#=vgPIXuB|?pzg&kCaJmCI+<~oF2~^Gpf)$_|fEfI#)yg6}rqv~2G4%<*IvEk5@?p6+?jIN6_%$o1`@DZU8M1hc-=NykyKT>{D|`N)ZfpCJ zNrx@#mPphaE>%-i9iZhovL)a$UGPljJvM6kzZ>j=>bf^PUilFBbo&PT6KBqBL9n`- z-KTV@gDe8@*d|HGFr)c!?eHya^IrV7x4K;E%YlT{Q>GUNYI~_RZ`Su|$*MI|vAaw3N%D&}yR#b{@~w|w-W=9=<-`5Kf?#dAj`?K!THUifm(8enc3%Q) zQ5bQ3+cv+s_8yau$^D#RF)Tq{QzOm!1#@4^H(@@xKmVx1+23D^y9NKN@$8?Uy=iIg zmnV?wy;m^y1M3oYonmX-;1LZQ>T|>PM>0}M#kXzPJYR3?j=A+y8~%r5T_&h)Na=@U zCA>ZlSN@$dbyJzvA_&C?A^tyq*G}{8&|%;ysgMGT`4*pO*nd#iy3oG65cBtn<^A4) zHwNtVMTSut0n)P6&O4m39J9>aW9r8C_R~J^Q@@y;T($5nC3SnDvZ+D+l`yKS!l`@znBjwM&|;XU$6B9;K!A z6k=#*v9nwMxv= zdS&(cDZWpW55tPIHvZZdzMtmr+Y9&hly0g0oV_bpn%20b@X188(+4{xN%Rq`Fhcm`LL#vP1LeDUV#-3pHw7o%M- z@$)bhk!(z#H7h(Ug50*?OJdIgE2%$G@h5*++|4B?V9FFQ8fu%`)to*^^K56ixw$s& z@EEM6C2*XgsmC1N{E`&71UYzkfEHIk~jtks(C^%y5p(o0q-l zqt|YW0db4ya^ETHxK$(OdS+$AgAz59SYz)IYVYPXoseEDx5qrb!Z7z#OYQdSCRPDm zL_2h+_WZB53-P*6-Z#4K6x;T6L(P?Sm#=tTE=p^Dxqaqolmk)m_ZiF1Aqh@1XU=(4 z4Ogxl$SRABjLLoRz%s%7?1L42a@$!0)=O}1m5gaSF~?$2u~UNsj|olJx%R9li|&p5 zQ@Z8SD6@aXs^1HsW!>$nXR`q<12X}d2Wt-*IF#QIq&R+_qhsN-hgR0sUsqZB+iL1; zZn*EfH`93NT#EY@rKY1sS!*vJJVjOJ_GfQBS^e?jA=mMi2&=ZG{(4nchNE#2 zsAT(&^mVhDzwVs;I?3_&Q~hD`W8F>y{^Rv7@h8i{BR(ip;JuwsSp6rKNG znG#dD!UMLNXIpAxlVh>Hkd-?#So`^(Ctv5qWIZn*G{_K?go0;}4RMMeEcUzW9OX^Y0mc7p$MThIKXvJR;lZ0e^Xm_KqjJH*)Ujm>>oBLR zm;XYO*kRfuw6#Z^*{?GtU@HGBt^tPw3v8CaqGO%G*JVx3%jb-43Hd%*QC5|ZSh_kt zO5bdCp+&-)vTL79eN{3vY};-(?U(fF)uC?PruMd5=--M$M>*}iodkLI_Km=5k2W$= zam;`50z~&4HhDX5U9W>_pERD1Zthtep_a{!~o-VA{@R}Dx9_bZUA+*0PrO7^dAuO7-Go;V zBOn!n63?7DlbF~?QE}d^SqUdk0--*r@Ss0r^X6YvnlxtsxdINF_0Na>!{IIkUR=x= zd>%pKo_mbnY4{Suh)55;MuHU zR%T`cQ8^|gl=rlH2chrwd*fisJ{57*FqYbCgR!Q@e;uL9vfq8%Mf3&&{di zkv47AX@Ac#k+g+3XlQZk=l>k}yYNBma) za4USkzQn|ovM?H<$BJ_{BOa+KHVRchU-V>m7SmafDvWWY{LRf>NwUm+#q?u`(Zb7rMxW4a&46*b8$N?&LH&w}p-90&k%dnQjqnETsx^+9 zjM;NaD@5h@XsPFzBQ$!8-J#Kea|l%z`8iVLEBKXhON@W=Y!={9%q36~0enby?JCR= zq8bHh5;LYW1TWXr{D|zw_hstn|2*37Tyt1=;ON1FM-L8KJ6wB2LsW0EIwLEdF-Q=T zStBDNHZap#Y}>9~nN;Y-vddA7Fne#i8p-${V#GI-*x*cOOSc~##IS*AaJp?X*L)P z=QMy0Sp}UbuiVyyVZuk_fb2(%Epu z-Xj^O1FQAd?J{nu#2ZdqM`t8@Y<+!!G~TnP^X^5Zf5`9kUB9krl%=1kd`_VJ?))mR z?Z(CqWDTu4*r^E9Yk)}ZVrX(-V5h}+!!a6W{u>R}D#__~4>FgOkl5yF2?x&^&NcrJ zzRT6xT3XhHCywR;aTnDR$?t{!w~pKN5#O1;=t>bE{eLRM4 zs4Z;X+IITZk2hP+U3q!=rSd*oO#l|DKNsU{K#5B?q5JC9Dm2bjh@$0*a)3wuMck1E zu(PvgXD-pBZXI%PaZ`n<)?#+$UoY>@hf>AcyD`|0S`DcZI`fUxKEk>~h!+=Eia8v= z9FE7g*?$H|Hbib+4dQh`On_TqmOGvsIPFY`@x}52WZBQpk3~&GF5j6P{SXh4`Y2nZ zPe=j)gJ4ClVyj`8!^DZ{gbNN78h|jb4UieEsX2_Z7tyU=G6t1MQpTVuqdbrjoHV=T~C68Pmy= z?*MIT_GKISk1u2T2BToNAeS*}z7Ep1a@8ur^6`9EIysR(Kx@SHMWcry6t%LIj_RI! zb>F_V)>ll0+-|$t%fv5zp}-F@aF0$%Ev>4&eJwRYJ0iA(n18mum;L9mYK=Z|yD@oa zKX(R&lYr_zduGwlCfj5)pjTHu7TikPhRLGCWM+87@m$(=EC%#J7X;-3$PYY*8IS)e zlsO@X4p~TJ%uQK0fhU0q6kxGyM{&iVK{68b_4HFzoMN@~pLZsu{b96jmy9Bld;sAB zGk^8$|7Y7))-~7vhNXmeGe(+M*}O9DPr3>h{myi;2}1b-X>R z)4#voI%C*B6Y_+={Qvsp!?bbYVlC3-4Q)5#|MiyJ(xeUl|GlNrFUg%GFPz5UW8@Nc zn!UOLMIoi3L&kSa`@h~+tl0O(e(MGBAO$a9{y>@KoXg`t7bsE{1X+NtH zom%RVQoe~h2uLLKg(-;gH=L|)%-rkPL8iykk5XHGrp;eJqq)H9=D|@bx?YMf&kY)J zB=W^W$JV}iUs}`U+eRGqY|n4Iy6wlOe3gs(|Gtb`xu*P6+W9{^9=Fdtdetv}#0{+~ zyR5h3HxHkG6ESXeKhN4jADV1MGH2R{nJ!ip&GS6}^pKvB{CM%Ho^Dw;miay_{P*v= z<5WEP#QCj7>3^=cl=Zk}^TP2fUv(UqH^T3+>!aIuqc5etco`QMq_Hw%z@mb=SI=w3 z<#&Aa%|i8#%>u149qU$}{+M%1K4--jo3H)H?#$mJHp%iz$yuZJm;Ddlj5~5%a;Dh= zi}-bhx$dc(Lw5&P-@H;C5+)m?+w?1?ydj4J5=;pwW7R1)a{B#pQz<}N~t^a zYF^&`W#M#qThWjv^OfuMCasd0dEBPqk^BqQRh#u^D@ITEb&I-?5m_0dv5ZV;XTwH!j)Zqk__57vUo%DU4!>y5l(ho*MV8FQ} zn!VGG-t|%Bh&_3g>LT)c9Ha+R;i5+(P)Y2%%OS+!C<-Pl5NGMSU#kgU#V@aa{8!V@ zmT#XRF-YFmVdF2dB`Fl9B_icU0nY3#nz)>|aGr4w$g$N$uoqbVSXQrR?P3%r_dX@O zS=MZmIZ`7gDWd+T5z4|M8#%-A?0J8$mZov7$7jxUnAw~d*sQRkL&dpkKHco|+FO!y zPcPW9TXE6i1r1*U-J)MlTh{v4BS}p${#%6nW2=?@Ri|0UmiS37NZFvD)|8ZWb(Ds3 z$-@ibqb|4^-kS9I&6P42>oTp?84K6jf62>_DyaKDeDZ4Rpi1$>+wz8Ab@|@!&Ed#9 zM~9s;7!vSftPS5kYFx^AqkhBf0vwmQ?A}|WnPVoESUlCt^Xc@fM^dZs_JEOsytC5ySa&;00k zBrnEAbc`{2DpPvkw(-sNqTmb1L+*!!^}5!?{%r( zb2ARMR;oF+G|1fiq_?P5P859XYtIGNB{3@-R;!6@Jts|Gt~S-vp|90~){$eB9#g!? zn$TS~Wy%!nyzh3;mk}lr(Cxh4m|C`{ygUMh(}{^!8GlII3sio?&lZk-49`c=sYYRj z;7vje6pxgHq&nFLvHK#Fi|BaS)s*}ch~y8{>JqV>#dyly#}1#&mQiL{i;{qFD(nji zqI5vF-%UaS!|6#9O!S?B=@Tb4kDG$bYwUZPQ)sX>k3SF|PHort`Q>Va+#?mgaCnMu z7c*LSoa76$&l5H(7*Sy@t)gNR*%vGPLa~3%2nh0kf)YrK8t@Aad%DOWe8I#ayzn^X zOzAmX}zO+*H)880&tCkjB16|#jYFK)Mc80@;dW2&M|BhR8{X}WOURGiHN9qnG^#&zk9bi z?4z-+_LbG1k{>96X7A z!tB{4X(YUKzMH-L&W2-9EI<*k1z!7?Kv2TM3gFRj@8?o3)8`U^@1+R$$xD|;U@W}8 z`Vj6N9KIT-&>2I~-kmu&qpIgFr&fGn2OLBc4hW)4*ArR<4pmk@3!QBv5ld$mow)Q1 zgC~_3Wbg+h!}LM#;n_IeypCBi{2`A}c6`UJ>fO~wA~B^B-m_;97rXUWqrYpHwO0j~ zE&xc0SUf{|E+XbOU@6SA>-9ds{IqI^9wdrWa^a#ExGJ9|6&hW z6O#!l$q7D_0tWT+y7@S4)Vx8a63MR?=qoSTukU=a`*g4Ur9PVODa!9dH$@&FEul7` zyunpRK`lC6G4bsYrNZwY6EDOEojPwBKlMO|BbJ^rCVP*z+AFHR2`paL)wd5d46Jpg zO}s5kFj-I5OevP@%vrOTPb^Fo>)ErXtO+(UdGu85!J)C2_AQB6U_x381nw0;h!tXB zV8Femb(0bl>IF?MyW;+QzUnU`NpJF=5Ru#at&N9=p2*Y9TguV0&ifO0m}@y#T1vutg*{SZJlP{X7oV21%R65PPr*oyMZ60sl=$SPw?+Gp*uyDCFZ z2Sjv7@pMMU91ag3iMTKSiV*sK?#<54-Lrc)=N-Kk0Lsn3exZDCj%xmUHEm0KxqrgC zbqFE-{3Hf76n$6k)fHnO8WA!_yX#(8U+MNX-0O1g;qmV~6wK2bdM)ko%rz1#e19Hm zJET3y(b9JQ^SVzVcT;`5uIeP!&t2aCiF{Ah)m3N9`|WgX{C*A*PBAXkwG%C;V5&6ZAw#y&iHD94y z{tc0nk!6H_vCTEqb>v8Z_7=b1Tz>U@T#$KuzH3}whk)^YUv-%fgYALf8w7er0!8OE z{bEgsiqXPAP;v;NvuXDZn&lO@$FNHEd&i!HEk8dTJ4__-iw-@J>KEVB7Z;u6*KW>< zNEWT0CIi9l&r&~FmQnxH+d~>Z1n?(z=uKNQv*TBI?T!5 z{uH|Cv$IhJDDUjSK0sn>?wuBsRYpKv&8CouWuq~I*78ye9VdYw)PC+|q~)>Sl3YnO z!QDYPS(FSyHLv}BJl1;t%0DGE1_5(w>AT-njJ+^=+xb`VYB@Hx(|5?Mm}p_KEL%$X z+=a~>R&L!q-`ud~{iVaJ2F1mG+P~_a?~{%#dHcd@i~4oiFt+PgHiVOr{*hYM(f8*j z57E+?H^bWRYeL0~T?gmO)fSygJJK`IE~vn&rE|@?!k0eZn`$UE{JS0QvA?+c!tF8a zmt53?Z1;iF7O++6j{pGr1)@(K#XTcY1o0zC(0)&PSn&LLX7^`)p%D=zFwQn#r5Hqj zjXYpJi6UCSJ4U9=;Qfhm5eJJqcZ@AV${T*Vjh_GX4edopG0K_y2I0qSoj|aF8#l)7 z&k94v_`aH;O_*ZpE2tLBhg0<)$ydhu*>-juOk?pQqogDUw3$4)l2Q~P-X1MHR}M2m zM`>MwW4Y4Ch7a8WGxdfK$K(Nf60D@`Q#_7;eC*#v&k~>Il_1DQxeT4QdH8K1>NY$+ zOldgpck<;g|&4_|8JyvbsMI?Ov@F94R7rY4djI^Uo08^-1h{3kto+j=~0nBUkpx0TmB z@7E7?DmJbuoT^z|;5sta_)hbclO-lHM<0q8ZyHO|1Rj||x;2GC5l$%{nU5Zw3+sYgRnf)Q z)l_JFL+DHFfxSMz_(Ili5?hO-1>#wWSZX&Otp^$9>wzfd*wKi&o>n!|gwHPv+3@_y zlM7_z%+VVfp)Di9bB>$;Vc8zHHz zi6DGTU3ccvCC~ZuqxkQnNgYf+qCSj^SsoDH+n8i!bTGpP-io_DnA5`1kWRQhS4Ql;&Kl z_QJ#OIP_?G&HQ4?((&8z|O0$S?)KFCoKgEK^y8*q}=9q zY3U=_c!GLdzH54VI!L%5qbxgk8Y{vs0n2{-@grh_1=i05?&013d2awdr{-t9#e6Tb z7G)g@Phy+7^C~@ckcH8?)qgk@(90(*BL>K?~QliTQruhIZuy~j3&Z3Bx zbz0Uw$>Z^tk@2JN;NHAV_pFvLin*%1G{YMrW9w^@ygkJw$BxKlzc!#Ovpc1B~+m(*_^&$QR3>CY)P+J_5L zbacPEBvu*XBNLMyxCaDg_INvnxfm3FX!Uq7g&-mR6~uf5s0Y0ya;`XMeOWRjFcWZ# z9C?bB6|@7>FeKClg{8n*vmFx?63#BT(T4#7%OkN5==dzjpMc3`bw=| z6T}7M8C&Kp0>_h96FvBzL^T#m@W-QIEc_b=|x=dJMa*sudC+Z@|Hw%?WqX7DC z;Y9|XW4is(fPfq)1(o51(Dk04>dtyh{}G8gE*FPr8B0IOuMVw4w7wLa*q@e`mT-l= z00`oHe=P_WRQH{gTY>{%mS{QNMoS2()R zyVi$>A!wH*x5sdT2GS2TIocj}P}>mI);o#=j36Vo^yd&G2Qt$SOZ54C^NiW7R%sWf zpIc-#K5`|1Wqsz8^uOW{rP94(-r>WI&l5^7$n{fre-i9>#Cl1Qlp>~61%3RCelrgIZ4a4sl%b+g>Bu1 ziuL%zp82Y#e|!Y^wY7Z$InUGwWYAugKeei!6zLbop4}WycPU)j+Sw)&$#!QcrRlTv zcOStqhj&h?Q~i?=hv5T{hZqixJNt~nejXj_!$smHXdma@X+z9c8ya_d zv-8ihr%!LLel^@-9(-t^-1@?2GRgf<_+9L8VIY5Smj8gD;Nuger@rpxclW@@D6_eT z*G{i|Dd~4QI9NM>gR1ot4k!@c%okJa{S&I(6OxL zxcIeTZcxwa_K&tXJktN7^Nhrhcdi=>M+98CR(^9}%g1Zy+cX^(&sUs(^+n#{$046n zzl~}4{8`jby*6edwKOhxgm-eLjHy_1$I@AauN78DefnIblOjLxmY_taDfFS>@tzQ4 zr>UWFjs6xgVA7RvZ}xwA*?MJia&5YoDD%cfD=R1%&|M26M5WVRail8}Ah*%Y7zC05 zk!YhP!Ihi^l3`9Vk{#QCjLBix4`ztGYE58iDee%}&FN$rr?=L6)=AF4n z0Dp!jp&Xa1koGSQU-@7ifP=HFKDd0Th6Q3^#7gON<1zF|QM8s?t zo}fZI1HXDOzhiY_yUaK*jRix@U)KaT=YSGc?QfpOfFGbHfLp$`>g}}}t{M<&J&$f` zMB7iZKu&)cRiKzEf@YCUho_Z2TvC}H&0&t)S>lNkT!WjtyS2g#n$7uq^r>)xx?&GSeYNB0NuH3V0SM>NT2klHEHNqEhRy7lXI9d@7(b{{T zp4ML%ipKwr4z%N6r<;T%tfhu1k~!}j3Ay|0i@P@Zh&(=8oIgZ*S3YvazQF87b!l#+ zSsm|Z>{HT=lKemO0^zgwAIXEW64IP~`#`j@Z-X6_3J~FiL7wgUD$=|Pf8s$Fgz4DNC!#7vVSlpJoZSe{l zl+?5#OQK~NCnZKpzsOw8bpUUdCfn)snX1|AqMgpWn~X+k1@I*cMrQ;_$xu}sEFb6O zF!pmHndj3iLfJO!B7f%5C(GbLSrA zML9xFK>8lRnoWL%P`*56}<>(m~#{94N3o5N6OT<~$s47>&g9 zgRGB`jQVA*=bFf1m@c7TAx#7TTtL*K^)fVmGYvEVy`}NE5cq(&|5ga4T)zA)H}^BM z+JrMtOKTI8VO`&mS=7^w*(Z>*OB*Z=GeUMqlj!z>_@-&C4tHZQxtSKCishOb0e(eTp1t2YyvuM92O;ShX zqorlp_{8)z+3G#>jsoRp!A_2&sxF znQ4y6haOQ3ItY4AN4Ln<(eWsHPE^8eTNo+Eejc*`E8Sm9ulg*oQqOHLU=zRgA4Ej&HWx!_pfmg3V z8w+I$2Mr7gLrWMo%cHq}e`$uFESLgrW#;j#sJe+d=x~AHIfl4}jrH|32}RIt#LORb zg0z7VhJl+Pazf1bNa*d?oCHjccU7MrHzD@(Nhn!C`L% z8c-@#5?AbGXt~0}k_}8Eh2h+RM@u(&d3Eg63EP6=AnX_WC@UWg5BFkS!W;z5-b3-X zdE-Wm69HoK>ohm5E+29J`0;@U_iz(|DLIL_r(~Ap0i#h@v19RA^T?Ew=olRlM56T* z1!|-fr#H(C8`>rL%;b1<1h3s8e^@Ac!yT_6I&k1w#ad;lJR)Dn{ko(ElP~s$D>?!&w zj9tD>l$eH30}f_N(maAzPLJ!}r9Z!NOzhtMC$oifa;Ds@W7HKa&8{S4&D?DXr!@{w z^*ddpc48`Uq;Gp$(-c(=jXe*R?2{kP2a_wGC3NZ1Rd@X^i$w5}=Kuq=DZJ<+xjzf$ zTcJ>DgJshurO{FE3k&x}gxTmD^k!31>k)ZRo;f4gty}L~ZwDOKC>KWytH(evcC<*a zCS=qjyI%7ip%|(ahNEHQO+*nKu5~|KYLshj=ZyE5j;2&KA{X9N*f%Xr$&rx?5xJQQ z-}w?Eex(inBjLQSX*xU#S|I~vC^I-F^b7> za&l!FPMT+w4Pp={cNG8Q@yPAQPYMgIUptU}&zf;o({s{gAtO$d8poB^OW0$OZum^? zhgbL_*;87^5+T~M70ZviDL=@fijYis6((u9b?XF|f&KRfW_Jrra4st@K88p9!eN5( z_|c>EA?i*W7+3A?;pzEcxLRc>jH_J|UPswghZ)V4@)}Eo@>v$IC1*NznQ_!Tc@`lR z*iUdOoHQw(szOzD+ee8fY5F?l;>HHju~KLLcNSPV()N3&@OZ_X(;9Pn#lUqjUx6om z@}y?x&U+Z^mz?&V@XtSUUSd54sGKE5B`Az&Acq}ZDj2t38_Vw zB65dlYTBi3y>;NgY(f=z-ZmLL9Skr$cr{*xBpW{}yQlN&*N$`2?$s4|=f(L2>{JKN zT1eFs;H}T8$dy4sjvT?~>K)p28ca#>Il0RamUXNxvh&d!{3Y1$WHfmJw_9L1V zRM{kzf*mseYuPTMpCHl=3VMX!AAOL&X;Jup$+efn1A~HmAoXz&fM{Zjqo#}m{remm zYAoQmxE)b9@jxJ>A0fY&Z~@_VhDWHW>B_-Q=7&oI2s##h?eNvL(|W@=qb`!|_5)x5 z$m`(H1*c;3jOcCyGDDdGU3%?W#Bcgj zuv+z>V}IRROssE_;0rMS2I(fYrEJ0rSFYfG^nwIZGfzB(S*)q6mj=2H0=Y&-{rbg= z^@LxbL-rysc-o6}@?E`(kf6Mn8Nij5e|a;@Dk{DK8x#fKyxBsIMqgosjy)=r6nHZ- zPr`*W%L=ez{>3H265&v&Q)4g&b%{IOli=Tk`14HjrQemCL9Nr3mfE+)k^|o5Eh@hi zgoc_M#?N13W}KxZz(M+tK#aIknFqj(X7IE5c6N*#K6U;2Mou!YIvVv`8mq#v9fLU| zEz|w(<)4_yxWxnp9}(*7{I6cVOkTC%s$1lN1J7BrYflXdC;-e^V;pPCP>;PTsb8NS z&n1WFjMLn2COy@1_UutZhmru&%4uDlcm(%!g5Y0#x<_dn1{2ZTK7JWqSwxT9#fEsP zqJrJE%goqVtghiU2sLR45VnDDo8g{&YI8d~)Wd*Li<#-(&-iY>>HdRFuP99A<(tr+ zBCEFS9i%#^F3o;4C^{Nea8f<)7KNDK*VCK~kT`twG(sJBul6phs>ITm!;wO$3R$h#W2fCKO5h6ZYeJwUt8 zsed=n+l9DxJK$3VC{Q32b4N0izu3TBi zc-q2?v9Tq9KCEy^sv~GZ$vD=mNiLXX-RX7>b7e=MX(LbqaLcS#39RUnBGw4g41*8v zKyu8_0U>H6KFqjVD*ck7@F+)ko2Dt%H#!?qLOJwe+Qn0velgG?5u=!T#o&PIe#_{2 zAQa@!mk6IU+3M_!umTH%p>a|-a9bc<4G%YUGqz8W2!CWoC&F*VlDhd`!760)=CPr} z_6@A`)SiJqbjzJ>h7JhF-e%#9@0UWYStbW)*sczcrx40IV7r_&+y{uXZQ*8`db zW}8wbMt0TOvM5J;Vtv)16LI9Y&|(0SNS+ubIb^u>#Dv|u9K+sRlD}2|+jL)~SSf<)1 zYW$00=3fObBzlnN3Xmd=ICR2o^(*6Yuj`Vmrba}}MZZNYN5P@7dOsNP%-e^)t8+*b z#R-H}WdBR_WKBq{=MiFV-D-uQsboMh{UGGq^hQD8u(ps(8m3qe`o2ig`OSQ^c?2Ty z?F;#DwA-MiTsl0vK((v2WbyM4iXPJ$96pX2k{REkJ%&`6v^-XI+|g{Uy#GhZz0UbH z`Ck2vjC{+pLkJn*s3=;>Ukn;IE-I_68}{zpbkZw-92L5EKT%Lcga%heO-?r5^m7w= ztaA)uMIx3BQ1bQzr(k$ptWIB+wIQeNwQKr--dptSZESQ$jhe05i{D>5UsI>gO1c9! zUgCGq41#HaMcA6EFRw2F+NM)!P~DM-GMLiIsh!n?pyWiFuPI9pC(Y&7srCo8#COS)^O1Lbp=RC~7v&xUW{=!qm)XAb z^>xfwIg2?<^4&;$@K_V8W zwIoZQP{^~=)Sj?g_n=?j3+3N~>aT|zSe^e+zO{4F%U++gADD$_l^Ki~Lv`Q{MgSPM zaG1P6eRshTlhXv(dU)xctwRebWA?*+y1%*H#c6|@2G}|{2lsf zW{H*S4?>gUG8hhlfC{#?h7*X0&)5spcmOQqfg)SvI_L8#^cGxMaexLKgl&jb5dGDu zWmr>pn8ZF|_UitwP|YwbW)J0lM{pDuw2cXKg;*nGMS%UV#3!VncB5FRR4r3)Bgv{1R#ujkslWLQ{lI}4;CNsC!KBGKQ-&Ngw+xY!6lw!{4Y3Ky4|=dk zd&&&Y?J|e;T&6H@<;H+{13k0o!~$hgm5c^blDo zf3p4V6>9#{dDE2-my6H!M3IBjS_0TiVFhMi6)Uk}frahpu+ z#l|Y^@eAtA=tG!>y)vhhl1M(}d@ckUzm_XD%8pk|KK*jj^aQsR-abC`jIg!MTao}dxP!}pL5LK{TCYzb?`JvTuY1sA&)-6sNj5~lckh@-wrlrp z5ZJP7BWjmsL_a01v^Z?bT!uRvWTcGs&6yi5h!G&9$;DXD+z4`S1p1S`Iyi{QOPPbVAms=NK+MAeMQ=#z!}b!8 zh77skX3M$^d?dfV6p1#OESf2@PPC25SFWJsNsx3J_>_+wUOIJ-DA-mrBUeG{&lKJE z1*~MiQ2{8ynGx+-d_KCacB6NLzs*eEIJLj(V}<(VP-}6KyJHHo(n%Cldi3xhGa)je zR3%aD=@bH&rhj|Lq_!O$Hm!D6Fj;cgbx5DUSJc|I+P#T?AL=$b&zxJnBWod(`uf*K zYohXX-r~^+^iJqc#L0*Q#LzX&OK156Yqi528Jj+*#n05=vBB@WOR^n3s*Oja<%boM z21&$Hs+T;K@7>$Xz8{(TlznOdHmj40x2A>VXrGFc&A7Yuk{ge%lG>h#cLWIv6#`wI z=9i5?DNs2M+&W{>@ZtFYplL^uG_mIdoDk({kXcs_vWTRF``=Hc-M&O zCkn=tUl^gYI@+0J9CjmP%vn-pK0#CTJG4-UnP}OfOhVRDqCe)mLyC!^vsRyj=J8lH z0q}{pv+e6K&kUKW>b{J4S$n1rpB*7x_#(c;Z*FRBpa~ev2#6Oh_v0=5obS`BuZRC6 z{PphL+qu)ePegphcY8C4n?d~xcu_)$9esc|7M=Hvi>e$Gf67$BNnO0Au<#gpW zQ4JFEisceB?jkxXy*|b{T%~`w$DN%PLVyF6q1AbJmKy0Xy}-7pSKzIv9e^ZursJX2 zUJ>C0|D?CR+Ab$H-YzrYp^9bvpyUgPU3ui05o?-;)PRVFHp~f6_;44+B0{(P{OQ#u zjZyyxtr=E$9-eAib3#4-!dCA8RP94XaM1AYgf-`a-)Sw?x&8aAWeCuU*8ZuHdH>E> zOKpyZHQVR(95C;5UD1p={XG=!7&WOX_RQ&O{X186|BeVwYo?luu1?hy+iI_{hD)%i zXu)ZiQhmDbnrv>*9C6jc^6X>#du_rU6Et{v$oLRPJ%u|(!2TOYV==}gJ zyR5qU;SxOssryv*wYMHMHhOt``rj*|P#f>tc9VDjm2vmlG~ksjG^CdnCLI#8Y&$zu z5g0bse57Xl#a7xiy?;1*@zn?tN(F^TD!Z2RpRX}55`v*e`{_&y-P-qabNV5cDYK67 z7-Dc*A{JDJIKO;??X+r#aFnx1i`K9I&RIi%rLn2j*0@^o358U8UZ$!DjWdHN0Corf zO-w5!V4+huOoZ7KltoRZpfrzZT2f((4%|hH5-uI1 zwjQT>_$x;+Iv{Qv&PqLdk=cE*QeN6Zhk zvbv2;Bl=L;lHyIpEWG(U?$TfNmvx}7OoN1U_=A$sr0wWhVugR_8zf$oNr1j>aq0T| z2P)2a$PrS<@YG+w$h4YTevSy~PRM3*L(}s=OC1}D!%Vpo`HozMdY!A%96A*7G+?%l ziG)$G-!)9rQYe2Z(x4Pv*2x4~lB@FTHwlAR2E?q*xeVHVdo> z6D63l_leu+d~HVN){8TtuK9S^MFiz`RyWaFh^*VU|8exk5t>fw#_qSXBj-k*z?*x& zBjplU;i<=rRW~veWb1*Q_ezw;Z+=D_f*zmCcSt9-k<>=WNpk{hOg{ieWu*O;q6#rO zyj40SX@Fcla2`M$3^1(oGODbmu5+GtxvQH<4=kPooc0B-mzj14LWI2E(yMR^K?$I* z@wUW27=wMk>?#Jqwbhn%5Q+oNOqyb+MFy~9X!cbXl~+`N4IMpv_!o^+BzvXWcbIKe zQZt`T=uP_7)Wa3-pS9mK&xFV{Gyl~qoCK!;2#I9c3Y8vr_Ba|WY5ZGLtWsx5iQ0Fh ztIXEDyOe0ldin67lmo6);{%__VOJyC0HuO;w8HH|>iE|rD zPa*YGFB;5>#;x8Zb2nnOL@f1~VC&3A34hed1#G-S$lx8}I~V0#D3{d>GFSgExFO_s z{yMFDU`XKjlwex|^-jyz7c9n3Y>IdTIX8Ssb})(Y)V~wh{SHkJZb6!BM)~CYjemy< z%mGq;iqNJv882R3#R|bDkqqADk7G)Eg75VgDNpeBOB;h(k&LXY+Su+E$Eqa<1g*$8 z?O16R^6nWeTeF>sY(O7+HW5(b?E{a;Zt=Wqnd|8Fc zErHPe(kJm&uA=V%b?vJcN)kG+Xx~}%K)k&S_wg^))q7RC`p|s`?;&e~WH2jcIU-wd z!_;>alK`R&|1e%%XLmBO&zelz;V|9F4Rl~gkx#p?bpHgu8i6eSJy+4kp@T` zAQf}6vq`TeH{QD+Zu(Z}$p$#5C>b5KV9uP~F}shwi-j&hFehN#b#1hSB>YS%qPwB5 zqGCYn$y#(3ltj$!s9?h}Zm^s0pby~qxK3xBqm^#vO!`{FAPUgaq4&M9VKqbwKT~@x zkF*)t8*N}iehpc&JUEvcb=;a_VTuh6|JPT;c{l?#ytntL0FcShNUL(2ZZz{Prz zAQTyS2A%)>v$XFN!~v!%#tD)}lM5`b`niKxmVmXOFDD^^zWny(?GLCY@@6!)z)PGd zvEC{NFTUb5sNtBVo+JH-R5O!cV5r;s)aMU`;W}MA?f}IvdHD=xofk?*a6$|Z{p5;j zPaGqa`czqoCkZc+%42~{*y4ZSC!qYsygWG#(VL>1kX3mYux}rTKm)Zh+|QgGD4q5X3Ti#dSUY zm>xc4J9~#T@0ltGwnTF=E0Y~6>A@8o-s%%imlep3~*&~5${V7WcG?Zd(6RsG0fKX zJ~Ac_L-j#eax2)w`UuX0K1)ysfc@beYf{$2RL3>ej4E4lx77A0> zI*OyO5N7rMhL_!q@!+g$y!DR)dPJd`fsLl*9h%DVUayPT0M|~6rG>@$eGsnF4V5Z} z8)f9=Cfi#lDAj^k1)n(@ZkFsBx_e)FfTeYO!XkMC9R-)d!-ozPJ6R0Smt#?)SCj3! zE5qyqJKVqf5uY%0X~?jZgK*1+7418Hlw5dnXn6nR0M*uohm-_z#7*?DvO#Ol*z%*& zmhuY%M|JW$-9znk!4!98t=xdN0jKbn=&%hY-hM3b*Wcn} zmj8z^x!6YhzqQ$&{$IY#Y)P*L-u=I`k7)lRUA=np*e+{j1XZ-9nYHP8lZ89}7nb(H A8~^|S diff --git a/release-0.19.0/examples/logging-demo/synthetic_0_25lps.yaml b/release-0.19.0/examples/logging-demo/synthetic_0_25lps.yaml deleted file mode 100644 index 5ff01e52874..00000000000 --- a/release-0.19.0/examples/logging-demo/synthetic_0_25lps.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# This pod specification creates an instance of a synthetic logger. The logger -# is simply a program that writes out the hostname of the pod, a count which increments -# by one on each iteration (to help notice missing log enteries) and the date using -# a long format (RFC-3339) to nano-second precision. This program logs at a frequency -# of 0.25 lines per second. The shellscript program is given directly to bash as -c argument -# and could have been written out as: -# i="0" -# while true -# do -# echo -n "`hostname`: $i: " -# date --rfc-3339 ns -# sleep 4 -# i=$[$i+1] -# done -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - name: synth-logging-source - name: synthetic-logger-0.25lps-pod -spec: - containers: - - args: - - bash - - -c - - 'i="0"; while true; do echo -n "`hostname`: $i: "; date --rfc-3339 ns; sleep - 4; i=$[$i+1]; done' - image: ubuntu:14.04 - name: synth-lgr diff --git a/release-0.19.0/examples/logging-demo/synthetic_10lps.yaml b/release-0.19.0/examples/logging-demo/synthetic_10lps.yaml deleted file mode 100644 index 35f305d260f..00000000000 --- a/release-0.19.0/examples/logging-demo/synthetic_10lps.yaml +++ /dev/null @@ -1,30 +0,0 @@ -# This pod specification creates an instance of a synthetic logger. The logger -# is simply a program that writes out the hostname of the pod, a count which increments -# by one on each iteration (to help notice missing log enteries) and the date using -# a long format (RFC-3339) to nano-second precision. This program logs at a frequency -# of 0.25 lines per second. The shellscript program is given directly to bash as -c argument -# and could have been written out as: -# i="0" -# while true -# do -# echo -n "`hostname`: $i: " -# date --rfc-3339 ns -# sleep 4 -# i=$[$i+1] -# done -apiVersion: v1beta3 -kind: Pod -metadata: - creationTimestamp: null - labels: - name: synth-logging-source - name: synthetic-logger-10lps-pod -spec: - containers: - - args: - - bash - - -c - - 'i="0"; while true; do echo -n "`hostname`: $i: "; date --rfc-3339 ns; sleep - 0.1; i=$[$i+1]; done' - image: ubuntu:14.04 - name: synth-lgr diff --git a/release-0.19.0/examples/meteor/README.md b/release-0.19.0/examples/meteor/README.md deleted file mode 100644 index 6641943bdfe..00000000000 --- a/release-0.19.0/examples/meteor/README.md +++ /dev/null @@ -1,171 +0,0 @@ -Meteor on Kuberenetes -===================== - -This example shows you how to package and run a -[Meteor](https://www.meteor.com/) app on Kubernetes. - -Build a container for your Meteor app -------------------------------------- - -To be able to run your Meteor app on Kubernetes you need to build a -Docker container for it first. To do that you need to install -[Docker](https://www.docker.com) Once you have that you need to add 2 -files to your existing Meteor project `Dockerfile` and -`.dockerignore`. - -`Dockerfile` should contain the below lines. You should replace the -`ROOT_URL` with the actual hostname of your app. -``` -FROM chees/meteor-kubernetes -ENV ROOT_URL http://myawesomeapp.com -``` - -The `.dockerignore` file should contain the below lines. This tells -Docker to ignore the files on those directories when it's building -your container. -``` -.meteor/local -packages/*/.build* -``` - -You can see an example meteor project already set up at: -[meteor-gke-example](https://github.com/Q42/meteor-gke-example). Feel -free to use this app for this example. - -> Note: The next step will not work if you have added mobile platforms -> to your meteor project. Check with `meteor list-platforms` - -Now you can build your container by running this in -your Meteor project directory: -``` -docker build -t my-meteor . -``` - -Pushing to a registry ---------------------- - -For the [Docker Hub](https://hub.docker.com/), tag your app image with -your username and push to the Hub with the below commands. Replace -`` with your Hub username. -``` -docker tag my-meteor /my-meteor -docker push /my-meteor -``` - -For [Google Container -Registry](https://cloud.google.com/tools/container-registry/), tag -your app image with your project ID, and push to GCR. Replace -`` with your project ID. -``` -docker tag my-meteor gcr.io//my-meteor -gcloud preview docker push gcr.io//my-meteor -``` - -Running -------- - -Now that you have containerized your Meteor app it's time to set up -your cluster. Edit [`meteor-controller.json`](meteor-controller.json) and make sure the `image` -points to the container you just pushed to the Docker Hub or GCR. - -As you may know, Meteor uses MongoDB, and we'll need to provide it a -persistent Kuberetes volume to store its data. See the [volumes -documentation](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/volumes.md) -for options. We're going to use Google Compute Engine persistent -disks. Create the MongoDB disk by running: -``` -gcloud compute disks create --size=200GB mongo-disk -``` - -You also need to format the disk before you can use it: -``` -gcloud compute instances attach-disk --disk=mongo-disk --device-name temp-data kubernetes-master -gcloud compute ssh kubernetes-master --command "sudo mkdir /mnt/tmp && sudo /usr/share/google/safe_format_and_mount /dev/disk/by-id/google-temp-data /mnt/tmp" -gcloud compute instances detach-disk --disk mongo-disk kubernetes-master -``` - -Now you can start Mongo using that disk: -``` -kubectl create -f mongo-pod.json -kubectl create -f mongo-service.json -``` - -Wait until Mongo is started completely and then start up your Meteor app: -``` -kubectl create -f meteor-controller.json -kubectl create -f meteor-service.json -``` - -Note that [`meteor-service.json`](meteor-service.json) creates an external load balancer, so -your app should be available through the IP of that load balancer once -the Meteor pods are started. You can find the IP of your load balancer -by running: -``` -kubectl get services/meteor -o template -t "{{.spec.publicIPs}}" -``` - -You will have to open up port 80 if it's not open yet in your -environment. On GCE, you may run the below command. -``` -gcloud compute firewall-rules create meteor-80 --allow=tcp:80 --target-tags kubernetes-minion -``` - -What is going on? ------------------ - -Firstly, the `FROM chees/meteor-kubernetes` line in your `Dockerfile` -specifies the base image for your Meteor app. The code for that image -is located in the `dockerbase/` subdirectory. Open up the `Dockerfile` -to get an insight of what happens during the `docker build` step. The -image is based on the Node.js official image. It then installs Meteor -and copies in your apps' code. The last line specifies what happens -when your app container is run. -``` -ENTRYPOINT MONGO_URL=mongodb://$MONGO_SERVICE_HOST:$MONGO_SERVICE_PORT /usr/local/bin/node main.js -``` - -Here we can see the MongoDB host and port information being passed -into the Meteor app. The `MONGO_SERVICE...` environment variables are -set by Kubernetes, and point to the service named `mongo` specified in -[`mongo-service.json`](mongo-service.json). See the [environment -documentation](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/container-environment.md) -for more details. - -As you may know, Meteor uses long lasting connections, and requires -_sticky sessions_. With Kubernetes you can scale out your app easily -with session affinity. The [`meteor-service.json`](meteor-service.json) file contains -`"sessionAffinity": "ClientIP"`, which provides this for us. See the -[service -documentation](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/services.md#virtual-ips-and-service-proxies) -for more information. - -As mentioned above, the mongo container uses a volume which is mapped -to a persistent disk by Kubernetes. In [`mongo-pod.json`](mongo-pod.json) the container -section specifies the volume: -``` - "volumeMounts": [ - { - "name": "mongo-disk", - "mountPath": "/data/db" - } -``` - -The name `mongo-disk` refers to the volume specified outside the -container section: -``` - "volumes": [ - { - "name": "mongo-disk", - "gcePersistentDisk": { - "pdName": "mongo-disk", - "fsType": "ext4" - } - } - ], -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/meteor/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/meteor/README.md?pixel)]() diff --git a/release-0.19.0/examples/meteor/dockerbase/Dockerfile b/release-0.19.0/examples/meteor/dockerbase/Dockerfile deleted file mode 100644 index 8ce633c634b..00000000000 --- a/release-0.19.0/examples/meteor/dockerbase/Dockerfile +++ /dev/null @@ -1,18 +0,0 @@ -FROM node:0.10 -MAINTAINER Christiaan Hees - -ONBUILD WORKDIR /appsrc -ONBUILD COPY . /appsrc - -ONBUILD RUN curl https://install.meteor.com/ | sh && \ - meteor build ../app --directory --architecture os.linux.x86_64 && \ - rm -rf /appsrc -# TODO rm meteor so it doesn't take space in the image? - -ONBUILD WORKDIR /app/bundle - -ONBUILD RUN (cd programs/server && npm install) -EXPOSE 8080 -CMD [] -ENV PORT 8080 -ENTRYPOINT MONGO_URL=mongodb://$MONGO_SERVICE_HOST:$MONGO_SERVICE_PORT /usr/local/bin/node main.js diff --git a/release-0.19.0/examples/meteor/dockerbase/README.md b/release-0.19.0/examples/meteor/dockerbase/README.md deleted file mode 100644 index a17b773e6ad..00000000000 --- a/release-0.19.0/examples/meteor/dockerbase/README.md +++ /dev/null @@ -1,15 +0,0 @@ -Building the meteor-kubernetes base image ------------------------------------------ - -As a normal user you don't need to do this since the image is already built and pushed to Docker Hub. You can just use it as a base image. See [this example](https://github.com/Q42/meteor-gke-example/blob/master/Dockerfile). - -To build and push the base meteor-kubernetes image: - - docker build -t chees/meteor-kubernetes . - docker push chees/meteor-kubernetes - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/meteor/dockerbase/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/meteor/dockerbase/README.md?pixel)]() diff --git a/release-0.19.0/examples/meteor/meteor-controller.json b/release-0.19.0/examples/meteor/meteor-controller.json deleted file mode 100644 index 2935126e03f..00000000000 --- a/release-0.19.0/examples/meteor/meteor-controller.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "kind": "ReplicationController", - "apiVersion": "v1beta3", - "metadata": { - "name": "meteor-controller", - "labels": { - "name": "meteor" - } - }, - "spec": { - "replicas": 2, - "selector": { - "name": "meteor" - }, - "template": { - "metadata": { - "labels": { - "name": "meteor" - } - }, - "spec": { - "containers": [ - { - "name": "meteor", - "image": "chees/meteor-gke-example:latest", - "ports": [ - { - "name": "http-server", - "hostPort": 80, - "containerPort": 8080, - "protocol": "TCP" - } - ], - "resources": {} - } - ] - } - } - } -} diff --git a/release-0.19.0/examples/meteor/meteor-service.json b/release-0.19.0/examples/meteor/meteor-service.json deleted file mode 100644 index e04be7c13f8..00000000000 --- a/release-0.19.0/examples/meteor/meteor-service.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "meteor" - }, - "spec": { - "ports": [ - { - "protocol": "TCP", - "port": 80, - "targetPort": "http-server" - } - ], - "selector": { - "name": "meteor" - }, - "createExternalLoadBalancer": true, - "sessionAffinity": "ClientIP" - } -} diff --git a/release-0.19.0/examples/meteor/mongo-pod.json b/release-0.19.0/examples/meteor/mongo-pod.json deleted file mode 100644 index cd7deba68e8..00000000000 --- a/release-0.19.0/examples/meteor/mongo-pod.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "kind": "Pod", - "apiVersion": "v1beta3", - "metadata": { - "name": "mongo", - "labels": { - "name": "mongo", - "role": "mongo" - } - }, - "spec": { - "volumes": [ - { - "name": "mongo-disk", - "gcePersistentDisk": { - "pdName": "mongo-disk", - "fsType": "ext4" - } - } - ], - "containers": [ - { - "name": "mongo", - "image": "mongo:latest", - "ports": [ - { - "name": "mongo", - "containerPort": 27017, - "protocol": "TCP" - } - ], - "resources": {}, - "volumeMounts": [ - { - "name": "mongo-disk", - "mountPath": "/data/db" - } - ] - } - ] - } -} diff --git a/release-0.19.0/examples/meteor/mongo-service.json b/release-0.19.0/examples/meteor/mongo-service.json deleted file mode 100644 index 72e9ed46503..00000000000 --- a/release-0.19.0/examples/meteor/mongo-service.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "mongo", - "labels": { - "name": "mongo" - } - }, - "spec": { - "ports": [ - { - "protocol": "TCP", - "port": 27017, - "targetPort": "mongo" - } - ], - "selector": { - "name": "mongo", - "role": "mongo" - } - } -} diff --git a/release-0.19.0/examples/mysql-wordpress-pd/README.md b/release-0.19.0/examples/mysql-wordpress-pd/README.md deleted file mode 100644 index 5362451f6a1..00000000000 --- a/release-0.19.0/examples/mysql-wordpress-pd/README.md +++ /dev/null @@ -1,314 +0,0 @@ - -# Persistent Installation of MySQL and WordPress on Kubernetes - -This example describes how to run a persistent installation of [Wordpress](https://wordpress.org/) using the [volumes](/docs/volumes.md) feature of Kubernetes, and [Google Compute Engine](https://cloud.google.com/compute/docs/disks) [persistent disks](/docs/volumes.md#gcepersistentdisk). - -We'll use the [mysql](https://registry.hub.docker.com/_/mysql/) and [wordpress](https://registry.hub.docker.com/_/wordpress/) official [Docker](https://www.docker.com/) images for this installation. (The wordpress image includes an Apache server). - -We'll create two Kubernetes [pods](http://docs.k8s.io/pods.md) to run mysql and wordpress, both with associated persistent disks, then set up a Kubernetes [service](http://docs.k8s.io/services.md) to front each pod. - -This example demonstrates several useful things, including: how to set up and use persistent disks with Kubernetes pods; how to define Kubernetes services to leverage docker-links-compatible service environment variables; and use of an external load balancer to expose the wordpress service externally and make it transparent to the user if the wordpress pod moves to a different cluster node. - -## Install gcloud and start up a Kubernetes cluster - -First, if you have not already done so, [create](https://cloud.google.com/compute/docs/quickstart) a [Google Cloud Platform](https://cloud.google.com/) project, and install the [gcloud SDK](https://cloud.google.com/sdk/). - -Then, set the gcloud default project name to point to the project you want to use for your Kubernetes cluster: - -``` -gcloud config set project -``` - -Next, grab the Kubernetes [release binary](https://github.com/GoogleCloudPlatform/kubernetes/releases) and start up a Kubernetes cluster: -``` -$ cluster/kube-up.sh -``` -where `` is the path to your Kubernetes installation. - -Or, as [described here](http://docs.k8s.io/getting-started-guides/gce.md), you can do this via: -```shell -wget -q -O - https://get.k8s.io | bash -``` -or -```shell -curl -sS https://get.k8s.io | bash -``` - -## Create two persistent disks - -For this WordPress installation, we're going to configure our Kubernetes [pods](http://docs.k8s.io/pods.md) to use [persistent disks](https://cloud.google.com/compute/docs/disks). This means that we can preserve installation state across pod shutdown and re-startup. - -You will need to create the disks in the same [GCE zone](https://cloud.google.com/compute/docs/zones) as the Kubernetes cluster. The `cluster/kube-up.sh` script will create the cluster in the `us-central1-b` zone by default, as seen in the [config-default.sh](/cluster/gce/config-default.sh) file. Replace `$ZONE` below with the appropriate zone. - -Before doing anything else, we'll create the persistent disks that we'll use for the installation: one for the mysql pod, and one for the wordpress pod. -The general series of steps required is as described [here](http://docs.k8s.io/volumes.md), where $DISK_SIZE is specified as, e.g. '500GB'. In future, this process will be more streamlined. - -So for the two disks used in this example, do the following. -First create the mysql disk, setting the disk size to meet your needs: - -```shell -gcloud compute disks create --size=$DISK_SIZE --zone=$ZONE mysql-disk -``` - -Then create the wordpress disk. Note that you may not want as large a disk size for the wordpress code as for the mysql disk. - -```shell -gcloud compute disks create --size=$DISK_SIZE --zone=$ZONE wordpress-disk -``` - -## Start the Mysql Pod and Service - -Now that the persistent disks are defined, the Kubernetes pods can be launched. We'll start with the mysql pod. - -### Start the Mysql pod - -First, **edit [`mysql.yaml`](mysql.yaml)**, the mysql pod definition, to use a database password that you specify. -`mysql.yaml` looks like this: - -```yaml -apiVersion: v1beta3 -kind: Pod -metadata: - name: mysql - labels: - name: mysql -spec: - containers: - - resources: - limits : - cpu: 1 - image: mysql - name: mysql - env: - - name: MYSQL_ROOT_PASSWORD - # change this - value: yourpassword - ports: - - containerPort: 3306 - name: mysql - volumeMounts: - # name must match the volume name below - - name: mysql-persistent-storage - # mount path within the container - mountPath: /var/lib/mysql - volumes: - - name: mysql-persistent-storage - gcePersistentDisk: - # This GCE PD must already exist. - pdName: mysql-disk - fsType: ext4 - -``` - -Note that we've defined a volume mount for `/var/lib/mysql`, and specified a volume that uses the persistent disk (`mysql-disk`) that you created. -Once you've edited the file to set your database password, create the pod as follows, where `` is the path to your Kubernetes installation: - -```shell -$ kubectl create -f mysql.yaml -``` - -It may take a short period before the new pod reaches the `Running` state. -List all pods to see the status of this new pod and the cluster node that it is running on: - -```shell -$ kubectl get pods -``` - - -#### Check the running pod on the Compute instance - -You can take a look at the logs for a pod by using `kubectl.sh log`. For example: - -```shell -$ kubectl log mysql -``` - -If you want to do deeper troubleshooting, e.g. if it seems a container is not staying up, you can also ssh in to the node that a pod is running on. There, you can run `sudo -s`, then `docker ps -a` to see all the containers. You can then inspect the logs of containers that have exited, via `docker logs `. (You can also find some relevant logs under `/var/log`, e.g. `docker.log` and `kubelet.log`). - -### Start the Mysql service - -We'll define and start a [service](http://docs.k8s.io/services.md) that lets other pods access the mysql database on a known port and host. -We will specifically name the service `mysql`. This will let us leverage the support for [Docker-links-compatible](http://docs.k8s.io/services.md#how-do-they-work) service environment variables when we set up the wordpress pod. The wordpress Docker image expects to be linked to a mysql container named `mysql`, as you can see in the "How to use this image" section on the wordpress docker hub [page](https://registry.hub.docker.com/_/wordpress/). - -So if we label our Kubernetes mysql service `mysql`, the wordpress pod will be able to use the Docker-links-compatible environment variables, defined by Kubernetes, to connect to the database. - -The [`mysql-service.yaml`](mysql-service.yaml) file looks like this: - -```yaml -apiVersion: v1beta3 -kind: Service -metadata: - labels: - name: mysql - name: mysql -spec: - ports: - # the port that this service should serve on - - port: 3306 - # label keys and values that must match in order to receive traffic for this service - selector: - name: mysql -``` - -Start the service like this: - -```shell -$ kubectl create -f mysql-service.yaml -``` - -You can see what services are running via: - -```shell -$ kubectl get services -``` - - -## Start the WordPress Pod and Service - -Once the mysql service is up, start the wordpress pod, specified in -[`wordpress.yaml`](wordpress.yaml). Before you start it, **edit `wordpress.yaml`** and **set the database password to be the same as you used in `mysql.yaml`**. -Note that this config file also defines a volume, this one using the `wordpress-disk` persistent disk that you created. - -```yaml -apiVersion: v1beta3 -kind: Pod -metadata: - name: wordpress - labels: - name: wordpress -spec: - containers: - - image: wordpress - name: wordpress - env: - - name: WORDPRESS_DB_PASSWORD - # change this - must match mysql.yaml password - value: yourpassword - ports: - - containerPort: 80 - name: wordpress - volumeMounts: - # name must match the volume name below - - name: wordpress-persistent-storage - # mount path within the container - mountPath: /var/www/html - volumes: - - name: wordpress-persistent-storage - gcePersistentDisk: - # This GCE PD must already exist. - pdName: wordpress-disk - fsType: ext4 -``` - -Create the pod: - -```shell -$ kubectl create -f wordpress.yaml -``` - -And list the pods to check that the status of the new pod changes -to `Running`. As above, this might take a minute. - -```shell -$ kubectl get pods -``` - -### Start the WordPress service - -Once the wordpress pod is running, start its service, specified by [`wordpress-service.yaml`](wordpress-service.yaml). - -The service config file looks like this: - -```yaml -apiVersion: v1beta3 -kind: Service -metadata: - labels: - name: wpfrontend - name: wpfrontend -spec: - createExternalLoadBalancer: true - ports: - # the port that this service should serve on - - port: 80 - # label keys and values that must match in order to receive traffic for this service - selector: - name: wordpress -``` - -Note the `createExternalLoadBalancer` setting. This will set up the wordpress service behind an external IP. -Note also that we've set the service port to 80. We'll return to that shortly. - -Start the service: - -```shell -$ kubectl create -f wordpress-service.yaml -``` - -and see it in the list of services: - -```shell -$ kubectl get services -``` - -Then, find the external IP for your WordPress service by listing the forwarding rules for your project: - -```shell -$ gcloud compute forwarding-rules list -``` - -Look for the rule called `wpfrontend`, which is what we named the wordpress service, and note its IP address. - -## Visit your new WordPress blog - -To access your new installation, you first may need to open up port 80 (the port specified in the wordpress service config) in the firewall for your cluster. You can do this, e.g. via: - -```shell -$ gcloud compute firewall-rules create sample-http --allow tcp:80 -``` - -This will define a firewall rule called `sample-http` that opens port 80 in the default network for your project. - -Now, we can visit the running WordPress app. -Use the external IP that you obtained above, and visit it on port 80: - -``` -http:// -``` - -You should see the familiar WordPress init page. - -## Take down and restart your blog - -Set up your WordPress blog and play around with it a bit. Then, take down its pods and bring them back up again. Because you used persistent disks, your blog state will be preserved. - -If you are just experimenting, you can take down and bring up only the pods: - -```shell -$ kubectl delete -f wordpress.yaml -$ kubectl delete -f mysql.yaml -``` - -When you restart the pods again (using the `create` operation as described above), their services will pick up the new pods based on their labels. - -If you want to shut down the entire app installation, you can delete the services as well. - -If you are ready to turn down your Kubernetes cluster altogether, run: - -```shell -$ cluster/kube-down.sh -``` - - - - - - - - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/mysql-wordpress-pd/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/mysql-wordpress-pd/README.md?pixel)]() diff --git a/release-0.19.0/examples/mysql-wordpress-pd/mysql-service.yaml b/release-0.19.0/examples/mysql-wordpress-pd/mysql-service.yaml deleted file mode 100644 index c8e0c55a18f..00000000000 --- a/release-0.19.0/examples/mysql-wordpress-pd/mysql-service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1beta3 -kind: Service -metadata: - labels: - name: mysql - name: mysql -spec: - ports: - # the port that this service should serve on - - port: 3306 - # label keys and values that must match in order to receive traffic for this service - selector: - name: mysql diff --git a/release-0.19.0/examples/mysql-wordpress-pd/mysql.yaml b/release-0.19.0/examples/mysql-wordpress-pd/mysql.yaml deleted file mode 100644 index b94c5607942..00000000000 --- a/release-0.19.0/examples/mysql-wordpress-pd/mysql.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - name: mysql - labels: - name: mysql -spec: - containers: - - resources: - limits : - cpu: 0.5 - image: mysql - name: mysql - env: - - name: MYSQL_ROOT_PASSWORD - # change this - value: yourpassword - ports: - - containerPort: 3306 - name: mysql - volumeMounts: - # name must match the volume name below - - name: mysql-persistent-storage - # mount path within the container - mountPath: /var/lib/mysql - volumes: - - name: mysql-persistent-storage - gcePersistentDisk: - # This GCE PD must already exist. - pdName: mysql-disk - fsType: ext4 diff --git a/release-0.19.0/examples/mysql-wordpress-pd/wordpress-service.yaml b/release-0.19.0/examples/mysql-wordpress-pd/wordpress-service.yaml deleted file mode 100644 index 3a8573d1097..00000000000 --- a/release-0.19.0/examples/mysql-wordpress-pd/wordpress-service.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1beta3 -kind: Service -metadata: - labels: - name: wpfrontend - name: wpfrontend -spec: - createExternalLoadBalancer: true - ports: - # the port that this service should serve on - - port: 80 - # label keys and values that must match in order to receive traffic for this service - selector: - name: wordpress diff --git a/release-0.19.0/examples/mysql-wordpress-pd/wordpress.yaml b/release-0.19.0/examples/mysql-wordpress-pd/wordpress.yaml deleted file mode 100644 index 56230ab3710..00000000000 --- a/release-0.19.0/examples/mysql-wordpress-pd/wordpress.yaml +++ /dev/null @@ -1,28 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - name: wordpress - labels: - name: wordpress -spec: - containers: - - image: wordpress - name: wordpress - env: - - name: WORDPRESS_DB_PASSWORD - # change this - must match mysql.yaml password - value: yourpassword - ports: - - containerPort: 80 - name: wordpress - volumeMounts: - # name must match the volume name below - - name: wordpress-persistent-storage - # mount path within the container - mountPath: /var/www/html - volumes: - - name: wordpress-persistent-storage - gcePersistentDisk: - # This GCE PD must already exist. - pdName: wordpress-disk - fsType: ext4 diff --git a/release-0.19.0/examples/nfs/README.md b/release-0.19.0/examples/nfs/README.md deleted file mode 100644 index 3cecc3089be..00000000000 --- a/release-0.19.0/examples/nfs/README.md +++ /dev/null @@ -1,43 +0,0 @@ -# Example of NFS volume - -See [nfs-web-pod.yaml](nfs-web-pod.yaml) for a quick example, how to use NFS volume -in a pod. - -## Complete setup - -The example below shows how to export a NFS share from a pod and import it -into another one. - -### NFS server part - -Define [NFS server pod](nfs-server-pod.yaml) and -[NFS service](nfs-server-service.yaml): - - $ kubectl create -f nfs-server-pod.yaml - $ kubectl create -f nfs-server-service.yaml - -The server exports `/mnt/data` directory as `/` (fsid=0). The directory contains -dummy `index.html`. Wait until the pod is running! - -### NFS client - -[WEB server pod](nfs-web-pod.yaml) uses the NFS share exported above as a NFS -volume and runs simple web server on it. The pod assumes your DNS is configured -and the NFS service is reachable as `nfs-server.default.kube.local`. Edit the -yaml file to supply another name or directly its IP address (use -`kubectl get services` to get it). - -Define the pod: - - $ kubectl create -f nfs-web-pod.yaml - -Now the pod serves `index.html` from the NFS server: - - $ curl http:/// - Hello World! - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/nfs/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/nfs/README.md?pixel)]() diff --git a/release-0.19.0/examples/nfs/exporter/Dockerfile b/release-0.19.0/examples/nfs/exporter/Dockerfile deleted file mode 100644 index 68755ed44b1..00000000000 --- a/release-0.19.0/examples/nfs/exporter/Dockerfile +++ /dev/null @@ -1,11 +0,0 @@ -FROM fedora:21 -MAINTAINER Jan Safranek -EXPOSE 2049/tcp - -RUN yum -y install nfs-utils && yum clean all - -ADD run_nfs /usr/local/bin/ - -RUN chmod +x /usr/local/bin/run_nfs - -ENTRYPOINT ["/usr/local/bin/run_nfs"] diff --git a/release-0.19.0/examples/nfs/exporter/README.md b/release-0.19.0/examples/nfs/exporter/README.md deleted file mode 100644 index 8266fb81db0..00000000000 --- a/release-0.19.0/examples/nfs/exporter/README.md +++ /dev/null @@ -1,16 +0,0 @@ -# NFS-exporter container - -Inspired by https://github.com/cpuguy83/docker-nfs-server. Rewritten for -Fedora. - -Serves NFS4 exports, defined on command line. At least one export must be defined! - -Usage:: - - docker run -d --name nfs --privileged jsafrane/nfsexporter /path/to/share /path/to/share2 ... - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/nfs/exporter/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/nfs/exporter/README.md?pixel)]() diff --git a/release-0.19.0/examples/nfs/exporter/run_nfs b/release-0.19.0/examples/nfs/exporter/run_nfs deleted file mode 100755 index b6b888e9300..00000000000 --- a/release-0.19.0/examples/nfs/exporter/run_nfs +++ /dev/null @@ -1,72 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -function start() -{ - - # prepare /etc/exports - seq=0 - for i in "$@"; do - echo "$i *(rw,sync,no_root_squash,insecure,fsid=$seq)" >> /etc/exports - seq=$(($seq + 1)) - echo "Serving $i" - done - - # from /lib/systemd/system/proc-fs-nfsd.mount - mount -t nfsd nfds /proc/fs/nfsd - - # from /lib/systemd/system/nfs-config.service - /usr/lib/systemd/scripts/nfs-utils_env.sh - - # from /lib/systemd/system/nfs-mountd.service - . /run/sysconfig/nfs-utils - /usr/sbin/rpc.mountd $RPCMOUNTDARGS - - # from /lib/systemd/system/nfs-server.service - . /run/sysconfig/nfs-utils - /usr/sbin/exportfs -r - /usr/sbin/rpc.nfsd -N 2 -N 3 -V 4 -V 4.1 $RPCNFSDARGS - - echo "NFS started" -} - -function stop() -{ - echo "Stopping NFS" - - # from /lib/systemd/system/nfs-server.service - /usr/sbin/rpc.nfsd 0 - /usr/sbin/exportfs -au - /usr/sbin/exportfs -f - - # from /lib/systemd/system/nfs-mountd.service - kill $( pidof rpc.mountd ) - # from /lib/systemd/system/proc-fs-nfsd.mount - umount /proc/fs/nfsd - - echo > /etc/exports - exit 0 -} - - -trap stop TERM - -start "$@" - -# Ugly hack to do nothing and wait for SIGTERM -while true; do - read -done diff --git a/release-0.19.0/examples/nfs/nfs-data/Dockerfile b/release-0.19.0/examples/nfs/nfs-data/Dockerfile deleted file mode 100644 index 33fd131a5c7..00000000000 --- a/release-0.19.0/examples/nfs/nfs-data/Dockerfile +++ /dev/null @@ -1,5 +0,0 @@ -FROM jsafrane/nfsexporter -MAINTAINER Jan Safranek -ADD index.html /mnt/data/index.html - -ENTRYPOINT ["/usr/local/bin/run_nfs", "/mnt/data"] diff --git a/release-0.19.0/examples/nfs/nfs-data/README.md b/release-0.19.0/examples/nfs/nfs-data/README.md deleted file mode 100644 index df31bb168fe..00000000000 --- a/release-0.19.0/examples/nfs/nfs-data/README.md +++ /dev/null @@ -1,12 +0,0 @@ -# NFS-exporter container with a file - -This container exports /mnt/data with index.html in it via NFSv4. Based on -../exporter. - -Available in dockerhub as -[jsafrane/nfs-data](https://registry.hub.docker.com/u/jsafrane/nfs-data/). - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/nfs/nfs-data/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/nfs/nfs-data/README.md?pixel)]() diff --git a/release-0.19.0/examples/nfs/nfs-data/index.html b/release-0.19.0/examples/nfs/nfs-data/index.html deleted file mode 100644 index cd0875583aa..00000000000 --- a/release-0.19.0/examples/nfs/nfs-data/index.html +++ /dev/null @@ -1 +0,0 @@ -Hello world! diff --git a/release-0.19.0/examples/nfs/nfs-server-pod.yaml b/release-0.19.0/examples/nfs/nfs-server-pod.yaml deleted file mode 100644 index e0bb565e6eb..00000000000 --- a/release-0.19.0/examples/nfs/nfs-server-pod.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - name: nfs-server - labels: - role: nfs-server -spec: - containers: - - name: nfs-server - image: jsafrane/nfs-data - privileged: true - ports: - - name: nfs - containerPort: 2049 - protocol: tcp diff --git a/release-0.19.0/examples/nfs/nfs-server-service.yaml b/release-0.19.0/examples/nfs/nfs-server-service.yaml deleted file mode 100644 index 634087122ef..00000000000 --- a/release-0.19.0/examples/nfs/nfs-server-service.yaml +++ /dev/null @@ -1,9 +0,0 @@ -kind: Service -apiVersion: v1beta3 -metadata: - name: nfs-server -spec: - ports: - - port: 2049 - selector: - role: nfs-server diff --git a/release-0.19.0/examples/nfs/nfs-web-pod.yaml b/release-0.19.0/examples/nfs/nfs-web-pod.yaml deleted file mode 100644 index 0c897fd910e..00000000000 --- a/release-0.19.0/examples/nfs/nfs-web-pod.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# -# This pod imports nfs-server.default.kube.local:/ into /var/www/html -# - -apiVersion: v1beta3 -kind: Pod -metadata: - name: nfs-web -spec: - containers: - - name: web - image: nginx - ports: - - name: web - containerPort: 80 - protocol: tcp - volumeMounts: - # name must match the volume name below - - name: nfs - mountPath: "/usr/share/nginx/html" - volumes: - - name: nfs - nfs: - # FIXME: use the right hostname - server: nfs-server.default.kube.local - path: "/" - readOnly: false diff --git a/release-0.19.0/examples/node-selection/README.md b/release-0.19.0/examples/node-selection/README.md deleted file mode 100644 index c69ad487314..00000000000 --- a/release-0.19.0/examples/node-selection/README.md +++ /dev/null @@ -1,66 +0,0 @@ -## Node selection example - -This example shows how to assign a pod to a specific node or to one of a set of nodes using node labels and the nodeSelector field in a pod specification. Generally this is unnecessary, as the scheduler will take care of things for you, but you may want to do so in certain circumstances like to ensure that your pod ends up on a machine with an SSD attached to it. - -### Step Zero: Prerequisites - -This example assumes that you have a basic understanding of kubernetes pods and that you have [turned up a Kubernetes cluster](https://github.com/GoogleCloudPlatform/kubernetes#documentation). - -### Step One: Attach label to the node - -Run `kubectl get nodes` to get the names of your cluster's nodes. Pick out the one that you want to add a label to. - -Then, to add a label to the node you've chosen, run `kubectl label nodes =`. For example, if my node name is 'kubernetes-foo-node-1.c.a-robinson.internal' and my desired label is 'disktype=ssd', then I can run `kubectl label nodes kubernetes-foo-node-1.c.a-robinson.internal disktype=ssd`. - -If this fails with an "invalid command" error, you're likely using an older version of kubectl that doesn't have the `label` command. In that case, see the [previous version](https://github.com/GoogleCloudPlatform/kubernetes/blob/a053dbc313572ed60d89dae9821ecab8bfd676dc/examples/node-selection/README.md) of this guide for instructions on how to manually set labels on a node. - -Also, note that label keys must be in the form of DNS labels (as described in the [identifiers doc](/docs/design/identifiers.md)), meaning that they are not allowed to contain any upper-case letters. - -You can verify that it worked by re-running `kubectl get nodes` and checking that the node now has a label. - -### Step Two: Add a nodeSelector field to your pod configuration - -Take whatever pod config file you want to run, and add a nodeSelector section to it, like this. For example, if this is my pod config: - -
    -apiVersion: v1beta3
-kind: Pod
-metadata:
-  labels:
-    env: test
-  name: nginx
-spec:
-  containers:
-  - image: nginx
-    name: nginx
-
    - -Then add a nodeSelector like so: - -
    -apiVersion: v1beta3
-kind: Pod
-metadata:
-  labels:
-    env: test
-  name: nginx
-spec:
-  containers:
-  - image: nginx
-    imagePullPolicy: IfNotPresent
-    name: nginx
-  nodeSelector:
-    disktype: ssd
-
    - -When you then run `kubectl create -f pod.yaml`, the pod will get scheduled on the node that you attached the label to! You can verify that it worked by running `kubectl get pods` and looking at the "host" that the pod was assigned to. - -### Conclusion - -While this example only covered one node, you can attach labels to as many nodes as you want. Then when you schedule a pod with a nodeSelector, it can be scheduled on any of the nodes that satisfy that nodeSelector. Be careful that it will match at least one node, however, because if it doesn't the pod won't be scheduled at all. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/node-selection/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/node-selection/README.md?pixel)]() diff --git a/release-0.19.0/examples/node-selection/pod.yaml b/release-0.19.0/examples/node-selection/pod.yaml deleted file mode 100644 index 42a6b39e8a2..00000000000 --- a/release-0.19.0/examples/node-selection/pod.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - env: test - name: nginx -spec: - containers: - - image: nginx - imagePullPolicy: IfNotPresent - name: nginx - nodeSelector: - disktype: ssd diff --git a/release-0.19.0/examples/openshift-origin/.gitignore b/release-0.19.0/examples/openshift-origin/.gitignore deleted file mode 100644 index 8dd8c8ed38b..00000000000 --- a/release-0.19.0/examples/openshift-origin/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -config/ -secret.json diff --git a/release-0.19.0/examples/openshift-origin/README.md b/release-0.19.0/examples/openshift-origin/README.md deleted file mode 100644 index 8f98113ca81..00000000000 --- a/release-0.19.0/examples/openshift-origin/README.md +++ /dev/null @@ -1,161 +0,0 @@ -## OpenShift Origin example - -This example shows how to run OpenShift Origin as a pod on an existing Kubernetes cluster. - -OpenShift Origin runs with a rich set of role based policy rules out of the box that requires authentication from users -via certificates. When run as a pod on an existing Kubernetes cluster, it proxies access to the underlying Kubernetes services -to provide security. - -As a result, this example is a complex end-to-end configuration that shows how to configure certificates for a service that runs -on Kubernetes, and requires a number of configuration files to be injected dynamically via a secret volume to the pod. - -### Step 0: Prerequisites - -This example assumes that you have an understanding of Kubernetes and that you have forked the repository. - -OpenShift Origin creates privileged containers when running Docker builds during the source-to-image process. - -If you are using a Salt based KUBERNETES_PROVIDER (**gce**, **vagrant**, **aws**), you should enable the -ability to create privileged containers via the API. - -```shell -$ cd kubernetes -$ vi cluster/saltbase/pillar/privilege.sls - -# If true, allow privileged containers to be created by API -allow_privileged: true -``` - -Now spin up a cluster using your preferred KUBERNETES_PROVIDER - -```shell -$ export KUBERNETES_PROVIDER=gce -$ cluster/kube-up.sh -``` - -Next, let's setup some variables, and create a local folder that will hold generated configuration files. - -```shell -$ export OPENSHIFT_EXAMPLE=$(pwd)/examples/openshift-origin -$ export OPENSHIFT_CONFIG=${OPENSHIFT_EXAMPLE}/config -$ mkdir ${OPENSHIFT_CONFIG} -``` - -### Step 1: Export your Kubernetes configuration file for use by OpenShift pod - -OpenShift Origin uses a configuration file to know how to access your Kubernetes cluster with administrative authority. - -``` -$ cluster/kubectl.sh config view --output=yaml --flatten=true --minify=true > ${OPENSHIFT_CONFIG}/kubeconfig -``` - -The output from this command will contain a single file that has all the required information needed to connect to your -Kubernetes cluster that you previously provisioned. This file should be considered sensitive, so do not share this file with -untrusted parties. - -We will later use this file to tell OpenShift how to bootstap its own configuration. - -### Step 2: Create an External Load Balancer to Route Traffic to OpenShift - -An external load balancer is needed to route traffic to our OpenShift master service that will run as a pod on your -Kubernetes cluster. - - -```shell -$ cluster/kubectl.sh create -f $OPENSHIFT_EXAMPLE/openshift-service.yaml -``` - -### Step 3: Generate configuration file for your OpenShift master pod - -The OpenShift master requires a configuration file as input to know how to bootstrap the system. - -In order to build this configuration file, we need to know the public IP address of our external load balancer in order to -build default certificates. - -Grab the public IP address of the service we previously created. - -```shell -$ export PUBLIC_IP=$(cluster/kubectl.sh get services openshift --template="{{ index .status.loadBalancer.ingress 0 \"ip\" }}") -$ echo $PUBLIC_IP -``` - -Ensure you have a valid PUBLIC_IP address before continuing in the example. - -We now need to run a command on your host to generate a proper OpenShift configuration. To do this, we will volume mount the configuration directory that holds your Kubernetes kubeconfig file from the prior step. - -```shell -docker run --privileged -v ${OPENSHIFT_CONFIG}:/config openshift/origin start master --write-config=/config --kubeconfig='/config/kubeconfig' --master='https://localhost:8443' --public-master='https://${PUBLIC_IP}:8443' -``` - -You should now see a number of certificates minted in your configuration directory, as well as a master-config.yaml file that tells the OpenShift master how to execute. In the next step, we will bundle this into a Kubernetes Secret that our OpenShift master pod will consume. - -### Step 4: Bundle the configuration into a Secret - -We now need to bundle the contents of our configuration into a secret for use by our OpenShift master pod. - -OpenShift includes an experimental command to make this easier. - -First, update the ownership for the files previously generated: - -``` -$ sudo -E chown -R ${USER} ${OPENSHIFT_CONFIG} -``` - -Then run the following command to collapse them into a Kubernetes secret. - -```shell -docker run -i -t --privileged -e="OPENSHIFTCONFIG=/config/admin.kubeconfig" -v ${OPENSHIFT_CONFIG}:/config openshift/origin ex bundle-secret openshift-config -f /config &> ${OPENSHIFT_EXAMPLE}/secret.json -``` - -Now, lets create the secret in your Kubernetes cluster. - -```shell -$ cluster/kubectl.sh create -f ${OPENSHIFT_EXAMPLE}/secret.json -``` - -**NOTE: This secret is secret and should not be shared with untrusted parties.** - -### Step 5: Deploy OpenShift Master - -We are now ready to deploy OpenShift. - -We will deploy a pod that runs the OpenShift master. The OpenShift master will delegate to the underlying Kubernetes -system to manage Kubernetes specific resources. For the sake of simplicity, the OpenShift master will run with an embedded etcd to hold OpenShift specific content. This demonstration will evolve in the future to show how to run etcd in a pod so that content is not destroyed if the OpenShift master fails. - -```shell -$ cluster/kubectl.sh create -f ${OPENSHIFT_EXAMPLE}/openshift-controller.yaml -``` - -You should now get a pod provisioned whose name begins with openshift. - -```shell -$ cluster/kubectl.sh get pods | grep openshift -$ cluster/kubectl.sh log openshift-t7147 origin -Running: cluster/../cluster/gce/../../cluster/../_output/dockerized/bin/linux/amd64/kubectl log openshift-t7t47 origin -2015-04-30T15:26:00.454146869Z I0430 15:26:00.454005 1 start_master.go:296] Starting an OpenShift master, reachable at 0.0.0.0:8443 (etcd: [https://10.0.27.2:4001]) -2015-04-30T15:26:00.454231211Z I0430 15:26:00.454223 1 start_master.go:297] OpenShift master public address is https://104.197.73.241:8443 -``` - -Depending upon your cloud provider, you may need to open up an external firewall rule for tcp:8443. For GCE, you can run the following: - -```shell -gcloud compute --project "your-project" firewall-rules create "origin" --allow tcp:8443 --network "your-network" --source-ranges "0.0.0.0/0" -``` - -Consult your cloud provider's documentation for more information. - -Open a browser and visit the OpenShift master public address reported in your log. - -You can use the CLI commands by running the following: - -```shell -$ docker run --privileged --entrypoint="/usr/bin/bash" -it -e="OPENSHIFTCONFIG=/config/admin.kubeconfig" -v ${OPENSHIFT_CONFIG}:/config openshift/origin -$ osc config use-context public-default -$ osc --help -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/openshift-origin/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/openshift-origin/README.md?pixel)]() diff --git a/release-0.19.0/examples/openshift-origin/cleanup.sh b/release-0.19.0/examples/openshift-origin/cleanup.sh deleted file mode 100755 index abe9dbf7ae3..00000000000 --- a/release-0.19.0/examples/openshift-origin/cleanup.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash - -# Copyright 2014 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Cleans up resources from the example, assumed to be run from Kubernetes repo root - -export OPENSHIFT_EXAMPLE=$(pwd)/examples/openshift-origin -export OPENSHIFT_CONFIG=${OPENSHIFT_EXAMPLE}/config -rm -fr ${OPENSHIFT_CONFIG} -cluster/kubectl.sh delete secrets openshift-config -cluster/kubectl.sh stop rc openshift -cluster/kubectl.sh delete rc openshift -cluster/kubectl.sh delete services openshift diff --git a/release-0.19.0/examples/openshift-origin/create.sh b/release-0.19.0/examples/openshift-origin/create.sh deleted file mode 100755 index 8de6020c476..00000000000 --- a/release-0.19.0/examples/openshift-origin/create.sh +++ /dev/null @@ -1,31 +0,0 @@ -#!/bin/bash - -# Copyright 2014 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Creates resources from the example, assumed to be run from Kubernetes repo root -export OPENSHIFT_EXAMPLE=$(pwd)/examples/openshift-origin -export OPENSHIFT_CONFIG=${OPENSHIFT_EXAMPLE}/config -mkdir ${OPENSHIFT_CONFIG} -cluster/kubectl.sh config view --output=yaml --flatten=true --minify=true > ${OPENSHIFT_CONFIG}/kubeconfig -cluster/kubectl.sh create -f $OPENSHIFT_EXAMPLE/openshift-service.yaml -sleep 60 -export PUBLIC_IP=$(cluster/kubectl.sh get services openshift --template="{{ index .status.loadBalancer.ingress 0 \"ip\" }}") -echo "PUBLIC IP: ${PUBLIC_IP}" -docker run --privileged -v ${OPENSHIFT_CONFIG}:/config openshift/origin start master --write-config=/config --kubeconfig=/config/kubeconfig --master=https://localhost:8443 --public-master=https://${PUBLIC_IP}:8443 -sudo -E chown ${USER} -R ${OPENSHIFT_CONFIG} -docker run -i -t --privileged -e="OPENSHIFTCONFIG=/config/admin.kubeconfig" -v ${OPENSHIFT_CONFIG}:/config openshift/origin ex bundle-secret openshift-config -f /config &> ${OPENSHIFT_EXAMPLE}/secret.json -cluster/kubectl.sh create -f ${OPENSHIFT_EXAMPLE}/secret.json -cluster/kubectl.sh create -f ${OPENSHIFT_EXAMPLE}/openshift-controller.yaml -cluster/kubectl.sh get pods | grep openshift diff --git a/release-0.19.0/examples/openshift-origin/openshift-controller.yaml b/release-0.19.0/examples/openshift-origin/openshift-controller.yaml deleted file mode 100644 index 5922254e16d..00000000000 --- a/release-0.19.0/examples/openshift-origin/openshift-controller.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - labels: - name: openshift - name: openshift -spec: - replicas: 1 - selector: - name: openshift - template: - metadata: - labels: - name: openshift - spec: - containers: - - args: - - start - - master - - --config=/config/master-config.yaml - image: "openshift/origin" - name: origin - ports: - - containerPort: 8443 - name: openshift - volumeMounts: - - mountPath: /config - name: config - readOnly: true - volumes: - - name: config - secret: - secretName: openshift-config \ No newline at end of file diff --git a/release-0.19.0/examples/openshift-origin/openshift-service.yaml b/release-0.19.0/examples/openshift-origin/openshift-service.yaml deleted file mode 100644 index 01540d02bda..00000000000 --- a/release-0.19.0/examples/openshift-origin/openshift-service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1beta3 -kind: Service -metadata: - name: openshift -spec: - ports: - - port: 8443 - name: openshift - targetPort: 8443 - selector: - name: openshift - createExternalLoadBalancer: true diff --git a/release-0.19.0/examples/persistent-volumes/README.md b/release-0.19.0/examples/persistent-volumes/README.md deleted file mode 100644 index eb6ae2a589b..00000000000 --- a/release-0.19.0/examples/persistent-volumes/README.md +++ /dev/null @@ -1,117 +0,0 @@ -# How To Use Persistent Volumes - -The purpose of this guide is to help you become familiar with Kubernetes Persistent Volumes. By the end of the guide, we'll have -nginx serving content from your persistent volume. - -This guide assumes knowledge of Kubernetes fundamentals and that you have a cluster up and running. - -## Provisioning - -A PersistentVolume in Kubernetes represents a real piece of underlying storage capacity in the infrastructure. Cluster administrators -must first create storage (create their GCE disks, export their NFS shares, etc.) in order for Kubernetes to mount it. - -PVs are intended for "network volumes" like GCE Persistent Disks, NFS shares, and AWS ElasticBlockStore volumes. ```HostPath``` was included -for ease of development and testing. You'll create a local ```HostPath``` for this example. - -> IMPORTANT! For ```HostPath``` to work, you will need to run a single node cluster. Kubernetes does not -support local storage on the host at this time. There is no guarantee your pod ends up on the correct node where the ```HostPath``` resides. - - -``` - -// this will be nginx's webroot -mkdir /tmp/data01 -echo 'I love Kubernetes storage!' > /tmp/data01/index.html - -``` - -PVs are created by posting them to the API server. - -``` - -kubectl create -f examples/persistent-volumes/volumes/local-01.yaml -kubectl get pv - -NAME LABELS CAPACITY ACCESSMODES STATUS CLAIM -pv0001 map[] 10737418240 RWO Available - -``` - -## Requesting storage - -Users of Kubernetes request persistent storage for their pods. They don't know how the underlying cluster is provisioned. -They just know they can rely on their claim to storage and can manage its lifecycle independently from the many pods that may use it. - -Claims must be created in the same namespace as the pods that use them. - -``` - -kubectl create -f examples/persistent-volumes/claims/claim-01.yaml -kubectl get pvc - -NAME LABELS STATUS VOLUME -myclaim-1 map[] - - -# A background process will attempt to match this claim to a volume. -# The eventual state of your claim will look something like this: - -kubectl get pvc - -NAME LABELS STATUS VOLUME -myclaim-1 map[] Bound f5c3a89a-e50a-11e4-972f-80e6500a981e - - -kubectl get pv - -NAME LABELS CAPACITY ACCESSMODES STATUS CLAIM -pv0001 map[] 10737418240 RWO Bound myclaim-1 / 6bef4c40-e50b-11e4-972f-80e6500a981e - -``` - -## Using your claim as a volume - -Claims are used as volumes in pods. Kubernetes uses the claim to look up its bound PV. The PV is then exposed to the pod. - -``` - -kubectl create -f examples/persistent-volumes/simpletest/pod.yaml - -kubectl get pods - -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED -mypod 172.17.0.2 myfrontend nginx 127.0.0.1/127.0.0.1 Running 12 minutes - - -kubectl create -f examples/persistent-volumes/simpletest/service.json -kubectl get services - -NAME LABELS SELECTOR IP PORT(S) -frontendservice name=frontendhttp 10.0.0.241 3000/TCP -kubernetes component=apiserver,provider=kubernetes 10.0.0.2 443/TCP - - -``` - -## Next steps - -You should be able to query your service endpoint and see what content nginx is serving. A "forbidden" error might mean you -need to disable SELinux (setenforce 0). - -``` - -curl 10.0.0.241:3000 -I love Kubernetes storage! - -``` - -Hopefully this simple guide is enough to get you started with PersistentVolumes. If you have any questions, join -```#google-containers``` on IRC and ask! - -Enjoy! - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/persistent-volumes/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/persistent-volumes/README.md?pixel)]() diff --git a/release-0.19.0/examples/persistent-volumes/claims/claim-01.yaml b/release-0.19.0/examples/persistent-volumes/claims/claim-01.yaml deleted file mode 100644 index 3c69d2e1b56..00000000000 --- a/release-0.19.0/examples/persistent-volumes/claims/claim-01.yaml +++ /dev/null @@ -1,10 +0,0 @@ -kind: PersistentVolumeClaim -apiVersion: v1beta3 -metadata: - name: myclaim-1 -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 3Gi diff --git a/release-0.19.0/examples/persistent-volumes/claims/claim-02.yaml b/release-0.19.0/examples/persistent-volumes/claims/claim-02.yaml deleted file mode 100644 index 48d48070b22..00000000000 --- a/release-0.19.0/examples/persistent-volumes/claims/claim-02.yaml +++ /dev/null @@ -1,10 +0,0 @@ -kind: PersistentVolumeClaim -apiVersion: v1beta3 -metadata: - name: myclaim-2 -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 8Gi diff --git a/release-0.19.0/examples/persistent-volumes/claims/claim-03.json b/release-0.19.0/examples/persistent-volumes/claims/claim-03.json deleted file mode 100644 index b3b0717af09..00000000000 --- a/release-0.19.0/examples/persistent-volumes/claims/claim-03.json +++ /dev/null @@ -1,17 +0,0 @@ -{ - "kind": "PersistentVolumeClaim", - "apiVersion": "v1beta3", - "metadata": { - "name": "myclaim-3" - }, "spec": { - "accessModes": [ - "ReadWriteOnce", - "ReadOnlyMany" - ], - "resources": { - "requests": { - "storage": "10G" - } - } - } -} diff --git a/release-0.19.0/examples/persistent-volumes/simpletest/namespace.json b/release-0.19.0/examples/persistent-volumes/simpletest/namespace.json deleted file mode 100644 index c9e7ced5557..00000000000 --- a/release-0.19.0/examples/persistent-volumes/simpletest/namespace.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "kind": "Namespace", - "apiVersion":"v1beta3", - "metadata": { - "name": "myns", - "labels": { - "name": "development" - } - } -} diff --git a/release-0.19.0/examples/persistent-volumes/simpletest/pod.yaml b/release-0.19.0/examples/persistent-volumes/simpletest/pod.yaml deleted file mode 100644 index f7f686c0404..00000000000 --- a/release-0.19.0/examples/persistent-volumes/simpletest/pod.yaml +++ /dev/null @@ -1,20 +0,0 @@ -kind: Pod -apiVersion: v1beta3 -metadata: - name: mypod - labels: - name: frontendhttp -spec: - containers: - - name: myfrontend - image: dockerfile/nginx - ports: - - containerPort: 80 - name: "http-server" - volumeMounts: - - mountPath: "/var/www/html" - name: mypd - volumes: - - name: mypd - persistentVolumeClaim: - claimName: myclaim-1 diff --git a/release-0.19.0/examples/persistent-volumes/simpletest/service.json b/release-0.19.0/examples/persistent-volumes/simpletest/service.json deleted file mode 100644 index 1c80f9e5148..00000000000 --- a/release-0.19.0/examples/persistent-volumes/simpletest/service.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "frontendservice" - }, - "spec": { - "ports": [ - { - "protocol": "TCP", - "port": 3000, - "targetPort": "http-server" - } - ], - "selector": { - "name": "frontendhttp" - } - } -} diff --git a/release-0.19.0/examples/persistent-volumes/volumes/gce.yaml b/release-0.19.0/examples/persistent-volumes/volumes/gce.yaml deleted file mode 100644 index 8cc6520327f..00000000000 --- a/release-0.19.0/examples/persistent-volumes/volumes/gce.yaml +++ /dev/null @@ -1,13 +0,0 @@ -kind: PersistentVolume -apiVersion: v1beta3 -metadata: - name: pv0003 -spec: - capacity: - storage: 10Gi - accessModes: - - ReadWriteOnce - - ReadOnlyMany - gcePersistentDisk: - pdName: "abc123" - fsType: "ext4" diff --git a/release-0.19.0/examples/persistent-volumes/volumes/local-01.yaml b/release-0.19.0/examples/persistent-volumes/volumes/local-01.yaml deleted file mode 100644 index ce0fe9fbbe2..00000000000 --- a/release-0.19.0/examples/persistent-volumes/volumes/local-01.yaml +++ /dev/null @@ -1,13 +0,0 @@ -kind: PersistentVolume -apiVersion: v1beta3 -metadata: - name: pv0001 - labels: - type: local -spec: - capacity: - storage: 10Gi - accessModes: - - ReadWriteOnce - hostPath: - path: "/tmp/data01" diff --git a/release-0.19.0/examples/persistent-volumes/volumes/local-02.yaml b/release-0.19.0/examples/persistent-volumes/volumes/local-02.yaml deleted file mode 100644 index 4be4c3ce12e..00000000000 --- a/release-0.19.0/examples/persistent-volumes/volumes/local-02.yaml +++ /dev/null @@ -1,14 +0,0 @@ -kind: PersistentVolume -apiVersion: v1beta3 -metadata: - name: pv0002 - labels: - type: local -spec: - capacity: - storage: 8Gi - accessModes: - - ReadWriteOnce - hostPath: - path: "/tmp/data02" - persistentVolumeReclaimPolicy: Recycle diff --git a/release-0.19.0/examples/persistent-volumes/volumes/nfs.yaml b/release-0.19.0/examples/persistent-volumes/volumes/nfs.yaml deleted file mode 100644 index 6e0f911ecb8..00000000000 --- a/release-0.19.0/examples/persistent-volumes/volumes/nfs.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1beta3 -kind: PersistentVolume -metadata: - name: pv0003 -spec: - capacity: - storage: 5Gi - accessModes: - - ReadWriteOnce - nfs: - path: /tmp - server: 172.17.0.2 diff --git a/release-0.19.0/examples/phabricator/README.md b/release-0.19.0/examples/phabricator/README.md deleted file mode 100644 index d252b29fc75..00000000000 --- a/release-0.19.0/examples/phabricator/README.md +++ /dev/null @@ -1,224 +0,0 @@ -## Phabricator example - -This example shows how to build a simple multi-tier web application using Kubernetes and Docker. - -The example combines a web frontend and an external service that provides MySQL database. We use CloudSQL on Google Cloud Platform in this example, but in principle any approach to running MySQL should work. - -### Step Zero: Prerequisites - -This example assumes that you have a basic understanding of kubernetes [services](../../docs/services.md) and that you have forked the repository and [turned up a Kubernetes cluster](../../docs/getting-started-guides): - -```shell -$ cd kubernetes -$ hack/dev-build-and-up.sh -``` - -### Step One: Set up Cloud SQL instance - -Follow the [official instructions](https://cloud.google.com/sql/docs/getting-started) to set up Cloud SQL instance. - -In the remaining part of this example we will assume that your instance is named "phabricator-db", has IP 173.194.242.66 and the password is "1234". - -### Step Two: Turn up the phabricator - -To start Phabricator server use the file [`examples/phabricator/phabricator-controller.json`](phabricator-controller.json) which describes a [replication controller](../../docs/replication-controller.md) with a single [pod](../../docs/pods.md) running an Apache server with Phabricator PHP source: - -```js -{ - "kind": "ReplicationController", - "apiVersion": "v1beta3", - "metadata": { - "name": "phabricator-controller", - "labels": { - "name": "phabricator" - } - }, - "spec": { - "replicas": 1, - "selector": { - "name": "phabricator" - }, - "template": { - "metadata": { - "labels": { - "name": "phabricator" - } - }, - "spec": { - "containers": [ - { - "name": "phabricator", - "image": "fgrzadkowski/example-php-phabricator", - "ports": [ - { - "name": "http-server", - "containerPort": 80 - } - ] - } - ] - } - } - } -} -``` - -Create the phabricator pod in your Kubernetes cluster by running: - -```shell -$ kubectl create -f examples/phabricator/phabricator-controller.json -``` - -Once that's up you can list the pods in the cluster, to verify that it is running: - -```shell -kubectl get pods -``` - -You'll see a single phabricator pod. It will also display the machine that the pod is running on once it gets placed (may take up to thirty seconds): - -``` -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -phabricator-controller-02qp4 10.244.1.34 phabricator fgrzadkowski/phabricator kubernetes-minion-2.c.myproject.internal/130.211.141.151 name=phabricator -``` - -If you ssh to that machine, you can run `docker ps` to see the actual pod: - -```shell -me@workstation$ gcloud compute ssh --zone us-central1-b kubernetes-minion-2 - -$ sudo docker ps -CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES -54983bc33494 fgrzadkowski/phabricator:latest "/run.sh" 2 hours ago Up 2 hours k8s_phabricator.d6b45054_phabricator-controller-02qp4.default.api_eafb1e53-b6a9-11e4-b1ae-42010af05ea6_01c2c4ca -``` - -(Note that initial `docker pull` may take a few minutes, depending on network conditions. During this time, the `get pods` command will return `Pending` because the container has not yet started ) - -### Step Three: Authenticate phabricator in Cloud SQL - -If you read logs of the phabricator container you will notice the following error message: - -```bash -$ kubectl log phabricator-controller-02qp4 -[...] -Raw MySQL Error: Attempt to connect to root@173.194.252.142 failed with error -#2013: Lost connection to MySQL server at 'reading initial communication -packet', system error: 0. - -``` - -This is because the host on which this container is running is not authorized in Cloud SQL. To fix this run: - -```bash -gcloud sql instances patch phabricator-db --authorized-networks 130.211.141.151 -``` - -To automate this process and make sure that a proper host is authorized even if pod is rescheduled to a new machine we need a separate pod that periodically lists pods and authorizes hosts. Use the file [`examples/phabricator/authenticator-controller.json`](authenticator-controller.json): - -```js -{ - "kind": "ReplicationController", - "apiVersion": "v1beta3", - "metadata": { - "name": "authenticator-controller", - "labels": { - "name": "authenticator" - } - }, - "spec": { - "replicas": 1, - "selector": { - "name": "authenticator" - }, - "template": { - "metadata": { - "labels": { - "name": "authenticator" - } - }, - "spec": { - "containers": [ - { - "name": "authenticator", - "image": "gcr.io.google_containers/cloudsql-authenticator:v1" - } - ] - } - } - } -} -``` - -To create the pod run: - -```shell -$ kubectl create -f examples/phabricator/authenticator-controller.json -``` - - -### Step Four: Turn up the phabricator service - -A Kubernetes 'service' is a named load balancer that proxies traffic to one or more containers. The services in a Kubernetes cluster are discoverable inside other containers via *environment variables*. Services find the containers to load balance based on pod labels. These environment variables are typically referenced in application code, shell scripts, or other places where one node needs to talk to another in a distributed system. You should catch up on [kubernetes services](http://docs.k8s.io/services.md) before proceeding. - -The pod that you created in Step One has the label `name=phabricator`. The selector field of the service determines which pods will receive the traffic sent to the service. Since we are setting up a service for an external application we also need to request external static IP address (otherwise it will be assigned dynamically): - -```shell -$ gcloud compute addresses create phabricator --region us-central1 -Created [https://www.googleapis.com/compute/v1/projects/myproject/regions/us-central1/addresses/phabricator]. -NAME REGION ADDRESS STATUS -phabricator us-central1 107.178.210.6 RESERVED -``` - -Use the file [`examples/phabricator/phabricator-service.json`](phabricator-service.json): - -```js -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "phabricator" - }, - "spec": { - "ports": [ - { - "port": 80, - "targetPort": "http-server" - } - ], - "selector": { - "name": "phabricator" - }, - "createExternalLoadBalancer": true, - "publicIPs": [ - "107.178.210.6" - ] - } -} -``` - -To create the service run: - -```shell -$ kubectl create -f examples/phabricator/phabricator-service.json -phabricator -``` - -Note that it will also create an external load balancer so that we can access it from outside. You may need to open the firewall for port 80 using the [console][cloud-console] or the `gcloud` tool. The following command will allow traffic from any source to instances tagged `kubernetes-minion`: - -```shell -$ gcloud compute firewall-rules create phabricator-node-80 --allow=tcp:80 --target-tags kubernetes-minion -``` - -### Step Six: Cleanup - -To turn down a Kubernetes cluster: - -```shell -$ cluster/kube-down.sh -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/phabricator/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/phabricator/README.md?pixel)]() diff --git a/release-0.19.0/examples/phabricator/authenticator-controller.json b/release-0.19.0/examples/phabricator/authenticator-controller.json deleted file mode 100644 index 1da45113e90..00000000000 --- a/release-0.19.0/examples/phabricator/authenticator-controller.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "kind": "ReplicationController", - "apiVersion": "v1beta3", - "metadata": { - "name": "authenticator-controller", - "labels": { - "name": "authenticator" - } - }, - "spec": { - "replicas": 1, - "selector": { - "name": "authenticator" - }, - "template": { - "metadata": { - "labels": { - "name": "authenticator" - } - }, - "spec": { - "containers": [ - { - "name": "authenticator", - "image": "gcr.io/google_containers/cloudsql-authenticator:v1" - } - ] - } - } - } -} diff --git a/release-0.19.0/examples/phabricator/cloudsql-authenticator/Dockerfile b/release-0.19.0/examples/phabricator/cloudsql-authenticator/Dockerfile deleted file mode 100644 index 50456c0fd49..00000000000 --- a/release-0.19.0/examples/phabricator/cloudsql-authenticator/Dockerfile +++ /dev/null @@ -1,8 +0,0 @@ -FROM google/cloud-sdk - -RUN apt-get update && apt-get install -y curl - -ADD run.sh /run.sh -RUN chmod a+x /*.sh - -CMD ["/run.sh"] diff --git a/release-0.19.0/examples/phabricator/cloudsql-authenticator/run.sh b/release-0.19.0/examples/phabricator/cloudsql-authenticator/run.sh deleted file mode 100755 index e2898c8bf14..00000000000 --- a/release-0.19.0/examples/phabricator/cloudsql-authenticator/run.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# TODO: This loop updates authorized networks even if nothing has changed. It -# should only send updates if something changes. We should be able to do -# this by comparing pod creation time with the last scan time. -while true; do - hostport="https://kubernetes.default.cluster.local" - token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) - path="api/v1beta3/pods" - query="labels=$SELECTOR" - - # TODO: load in the CAS cert when we distributed it on all platforms. - ips_json=`curl ${hostport}/${path}?${query} --insecure --header "Authorization: Bearer ${token}" 2>/dev/null | grep hostIP` - ips=`echo $ips_json | cut -d'"' -f 4 | sed 's/,$//'` - echo "Adding IPs $ips" - gcloud sql instances patch $CLOUDSQL_DB --authorized-networks $ips - sleep 10 -done diff --git a/release-0.19.0/examples/phabricator/phabricator-controller.json b/release-0.19.0/examples/phabricator/phabricator-controller.json deleted file mode 100644 index 795f0b24f0d..00000000000 --- a/release-0.19.0/examples/phabricator/phabricator-controller.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "kind": "ReplicationController", - "apiVersion": "v1beta3", - "metadata": { - "name": "phabricator-controller", - "labels": { - "name": "phabricator" - } - }, - "spec": { - "replicas": 1, - "selector": { - "name": "phabricator" - }, - "template": { - "metadata": { - "labels": { - "name": "phabricator" - } - }, - "spec": { - "containers": [ - { - "name": "phabricator", - "image": "fgrzadkowski/example-php-phabricator", - "ports": [ - { - "name": "http-server", - "containerPort": 80 - } - ] - } - ] - } - } - } -} \ No newline at end of file diff --git a/release-0.19.0/examples/phabricator/phabricator-service.json b/release-0.19.0/examples/phabricator/phabricator-service.json deleted file mode 100644 index 8448d720552..00000000000 --- a/release-0.19.0/examples/phabricator/phabricator-service.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "phabricator" - }, - "spec": { - "ports": [ - { - "port": 80, - "targetPort": "http-server" - } - ], - "selector": { - "name": "phabricator" - }, - "createExternalLoadBalancer": true, - "publicIPs": [ - "107.178.210.6" - ] - } -} \ No newline at end of file diff --git a/release-0.19.0/examples/phabricator/php-phabricator/000-default.conf b/release-0.19.0/examples/phabricator/php-phabricator/000-default.conf deleted file mode 100644 index 2ec64d6879d..00000000000 --- a/release-0.19.0/examples/phabricator/php-phabricator/000-default.conf +++ /dev/null @@ -1,12 +0,0 @@ - - Require all granted - - - - DocumentRoot /home/www-data/phabricator/webroot - - RewriteEngine on - RewriteRule ^/rsrc/(.*) - [L,QSA] - RewriteRule ^/favicon.ico - [L,QSA] - RewriteRule ^(.*)$ /index.php?__path__=$1 [B,L,QSA] - diff --git a/release-0.19.0/examples/phabricator/php-phabricator/Dockerfile b/release-0.19.0/examples/phabricator/php-phabricator/Dockerfile deleted file mode 100644 index 9bf1e0d3620..00000000000 --- a/release-0.19.0/examples/phabricator/php-phabricator/Dockerfile +++ /dev/null @@ -1,26 +0,0 @@ -FROM ubuntu:14.04 - -# Install all the required packages. -RUN apt-get update -RUN apt-get -y install \ - git apache2 dpkg-dev python-pygments \ - php5 php5-mysql php5-gd php5-dev php5-curl php-apc php5-cli php5-json php5-xhprof -RUN a2enmod rewrite -RUN apt-get source php5 -RUN (cd `ls -1F | grep '^php5-.*/$'`/ext/pcntl && phpize && ./configure && make && sudo make install) - -# Load code source. -RUN mkdir /home/www-data -RUN cd /home/www-data && git clone https://github.com/phacility/libphutil.git -RUN cd /home/www-data && git clone https://github.com/phacility/arcanist.git -RUN cd /home/www-data && git clone https://github.com/phacility/phabricator.git -RUN chown -R www-data /home/www-data -RUN chgrp -R www-data /home/www-data - -ADD 000-default.conf /etc/apache2/sites-available/000-default.conf -ADD run.sh /run.sh -RUN chmod a+x /*.sh - -# Run Apache2. -EXPOSE 80 -CMD ["/run.sh"] diff --git a/release-0.19.0/examples/phabricator/php-phabricator/run.sh b/release-0.19.0/examples/phabricator/php-phabricator/run.sh deleted file mode 100755 index abbfff611ba..00000000000 --- a/release-0.19.0/examples/phabricator/php-phabricator/run.sh +++ /dev/null @@ -1,28 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -echo "MySQL host IP ${MYSQL_SERVICE_IP} port ${MYSQL_SERVICE_PORT}." -/home/www-data/phabricator/bin/config set mysql.host $MYSQL_SERVICE_IP -/home/www-data/phabricator/bin/config set mysql.port $MYSQL_SERVICE_PORT -/home/www-data/phabricator/bin/config set mysql.pass $MYSQL_PASSWORD - -echo "Running storage upgrade" -/home/www-data/phabricator/bin/storage --force upgrade || exit 1 - -source /etc/apache2/envvars -echo "Starting Apache2" -apache2 -D FOREGROUND - diff --git a/release-0.19.0/examples/phabricator/setup.sh b/release-0.19.0/examples/phabricator/setup.sh deleted file mode 100755 index 860c93f0896..00000000000 --- a/release-0.19.0/examples/phabricator/setup.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -echo "Create Phabricator replication controller" && kubectl create -f phabricator-controller.json -echo "Create Phabricator service" && kubectl create -f phabricator-service.json -echo "Create Authenticator replication controller" && kubectl create -f authenticator-controller.json -echo "Create firewall rule" && gcloud compute firewall-rules create phabricator-node-80 --allow=tcp:80 --target-tags kubernetes-minion - diff --git a/release-0.19.0/examples/phabricator/teardown.sh b/release-0.19.0/examples/phabricator/teardown.sh deleted file mode 100755 index 884c5f4bddf..00000000000 --- a/release-0.19.0/examples/phabricator/teardown.sh +++ /dev/null @@ -1,22 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -echo "Deleting Authenticator replication controller" && kubectl stop rc authenticator-controller -echo "Deleting Phabricator service" && kubectl delete -f phabricator-service.json -echo "Deleting Phabricator replication controller" && kubectl stop rc phabricator-controller - -echo "Delete firewall rule" && gcloud compute firewall-rules delete -q phabricator-node-80 - diff --git a/release-0.19.0/examples/pod.yaml b/release-0.19.0/examples/pod.yaml deleted file mode 100644 index c5eb91f988a..00000000000 --- a/release-0.19.0/examples/pod.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - name: nginx - name: nginx - namespace: default -spec: - containers: - - image: nginx - imagePullPolicy: IfNotPresent - name: nginx - ports: - - containerPort: 80 - protocol: TCP - restartPolicy: Always \ No newline at end of file diff --git a/release-0.19.0/examples/rbd/README.md b/release-0.19.0/examples/rbd/README.md deleted file mode 100644 index 2fa256a969a..00000000000 --- a/release-0.19.0/examples/rbd/README.md +++ /dev/null @@ -1,50 +0,0 @@ -# How to Use it? -Install Ceph on the Kubernetes host. For example, on Fedora 21 - - # yum -y install ceph - -If you don't have a Ceph cluster, you can set up a [containerized Ceph cluster](https://github.com/rootfs/docker-ceph) - -Then get the keyring from the Ceph cluster and copy it to */etc/ceph/keyring*. - -Once you have installed Ceph and new Kubernetes, you can create a pod based on my examples [rbd.json](v1beta3/rbd.json) [rbd-with-secret.json](v1beta3/rbd-with-secret.json). In the pod JSON, you need to provide the following information. - -- *monitors*: Ceph monitors. -- *pool*: The name of the RADOS pool, if not provided, default *rbd* pool is used. -- *image*: The image name that rbd has created. -- *user*: The RADOS user name. If not provided, default *admin* is used. -- *keyring*: The path to the keyring file. If not provided, default */etc/ceph/keyring* is used. -- *secretName*: The name of the authentication secrets. If provided, *secretName* overrides *keyring*. Note, see below about how to create a secret. -- *fsType*: The filesystem type (ext4, xfs, etc) that formatted on the device. -- *readOnly*: Whether the filesystem is used as readOnly. - -# Use Ceph Authentication Secret - -If Ceph authentication secret is provided, the secret should be first be base64 encoded, then encoded string is placed in a secret yaml. An example yaml is provided [here](secret/ceph-secret.yaml). Then post the secret through ```kubectl``` in the following command. - -```console - # kubectl create -f examples/rbd/secret/ceph-secret.yaml -``` - -# Get started - -Here are my commands: - -```console - # kubectl create -f examples/rbd/v1beta3/rbd.json - # kubectl get pods -``` - -On the Kubernetes host, I got these in mount output - -```console - #mount |grep kub - /dev/rbd0 on /var/lib/kubelet/plugins/kubernetes.io/rbd/rbd/kube-image-foo type ext4 (ro,relatime,stripe=4096,data=ordered) - /dev/rbd0 on /var/lib/kubelet/pods/ec2166b4-de07-11e4-aaf5-d4bed9b39058/volumes/kubernetes.io~rbd/rbdpd type ext4 (ro,relatime,stripe=4096,data=ordered) -``` - - If you ssh to that machine, you can run `docker ps` to see the actual pod and `docker inspect` to see the volumes used by the container. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/rbd/README.md?pixel)]() - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/rbd/README.md?pixel)]() diff --git a/release-0.19.0/examples/rbd/secret/ceph-secret.yaml b/release-0.19.0/examples/rbd/secret/ceph-secret.yaml deleted file mode 100644 index 1acd1a29ea1..00000000000 --- a/release-0.19.0/examples/rbd/secret/ceph-secret.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1beta3 -kind: Secret -metadata: - name: ceph-secret -data: - key: QVFCMTZWMVZvRjVtRXhBQTVrQ1FzN2JCajhWVUxSdzI2Qzg0SEE9PQ== diff --git a/release-0.19.0/examples/rbd/v1beta3/rbd-with-secret.json b/release-0.19.0/examples/rbd/v1beta3/rbd-with-secret.json deleted file mode 100644 index 295009d3f4a..00000000000 --- a/release-0.19.0/examples/rbd/v1beta3/rbd-with-secret.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "apiVersion": "v1beta3", - "id": "rbdpd2", - "kind": "Pod", - "metadata": { - "name": "rbd2" - }, - "spec": { - "containers": [ - { - "name": "rbd-rw", - "image": "kubernetes/pause", - "volumeMounts": [ - { - "mountPath": "/mnt/rbd", - "name": "rbdpd" - } - ] - } - ], - "volumes": [ - { - "name": "rbdpd", - "rbd": { - "monitors": [ - "10.16.154.78:6789", - "10.16.154.82:6789", - "10.16.154.83:6789" - ], - "pool": "kube", - "image": "foo", - "user": "admin", - "secretRef": { - "name": "ceph-secret" - }, - "fsType": "ext4", - "readOnly": true - } - } - ] - } -} diff --git a/release-0.19.0/examples/rbd/v1beta3/rbd.json b/release-0.19.0/examples/rbd/v1beta3/rbd.json deleted file mode 100644 index e704c8dab60..00000000000 --- a/release-0.19.0/examples/rbd/v1beta3/rbd.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "apiVersion": "v1beta3", - "id": "rbdpd", - "kind": "Pod", - "metadata": { - "name": "rbd" - }, - "spec": { - "containers": [ - { - "name": "rbd-rw", - "image": "kubernetes/pause", - "volumeMounts": [ - { - "mountPath": "/mnt/rbd", - "name": "rbdpd" - } - ] - } - ], - "volumes": [ - { - "name": "rbdpd", - "rbd": { - "monitors": [ - "10.16.154.78:6789", - "10.16.154.82:6789", - "10.16.154.83:6789" - ], - "pool": "kube", - "image": "foo", - "user": "admin", - "keyring": "/etc/ceph/keyring", - "fsType": "ext4", - "readOnly": true - } - } - ] - } -} diff --git a/release-0.19.0/examples/redis/README.md b/release-0.19.0/examples/redis/README.md deleted file mode 100644 index 82ab059805b..00000000000 --- a/release-0.19.0/examples/redis/README.md +++ /dev/null @@ -1,120 +0,0 @@ -## Reliable, Scalable Redis on Kubernetes - -The following document describes the deployment of a reliable, multi-node Redis on Kubernetes. It deploys a master with replicated slaves, as well as replicated redis sentinels which are use for health checking and failover. - -### Prerequisites -This example assumes that you have a Kubernetes cluster installed and running, and that you have installed the ```kubectl``` command line tool somewhere in your path. Please see the [getting started](../../docs/getting-started-guides) for installation instructions for your platform. - -### A note for the impatient -This is a somewhat long tutorial. If you want to jump straight to the "do it now" commands, please see the [tl; dr](#tl-dr) at the end. - -### Turning up an initial master/sentinel pod. -A [_Pod_](../../docs/pods.md) is one or more containers that _must_ be scheduled onto the same host. All containers in a pod share a network namespace, and may optionally share mounted volumes. - -We will used the shared network namespace to bootstrap our Redis cluster. In particular, the very first sentinel needs to know how to find the master (subsequent sentinels just ask the first sentinel). Because all containers in a Pod share a network namespace, the sentinel can simply look at ```$(hostname -i):6379```. - -Here is the config for the initial master and sentinel pod: [redis-master.yaml](redis-master.yaml) - - -Create this master as follows: -```sh -kubectl create -f examples/redis/redis-master.yaml -``` - -### Turning up a sentinel service -In Kubernetes a [_Service_](../../docs/services.md) describes a set of Pods that perform the same task. For example, the set of nodes in a Cassandra cluster, or even the single node we created above. An important use for a Service is to create a load balancer which distributes traffic across members of the set. But a _Service_ can also be used as a standing query which makes a dynamically changing set of Pods (or the single Pod we've already created) available via the Kubernetes API. - -In Redis, we will use a Kubernetes Service to provide a discoverable endpoints for the Redis sentinels in the cluster. From the sentinels Redis clients can find the master, and then the slaves and other relevant info for the cluster. This enables new members to join the cluster when failures occur. - -Here is the definition of the sentinel service: [redis-sentinel-service.yaml](redis-sentinel-service.yaml) - -Create this service: -```sh -kubectl create -f examples/redis/redis-sentinel-service.yaml -``` - -### Turning up replicated redis servers -So far, what we have done is pretty manual, and not very fault-tolerant. If the ```redis-master``` pod that we previously created is destroyed for some reason (e.g. a machine dying) our Redis service goes away with it. - -In Kubernetes a [_Replication Controller_](../../docs/replication-controller.md) is responsible for replicating sets of identical pods. Like a _Service_ it has a selector query which identifies the members of it's set. Unlike a _Service_ it also has a desired number of replicas, and it will create or delete _Pods_ to ensure that the number of _Pods_ matches up with it's desired state. - -Replication Controllers will "adopt" existing pods that match their selector query, so let's create a Replication Controller with a single replica to adopt our existing Redis server. Here is the replication controller config: [redis-controller.yaml](redis-controller.yaml) - -The bulk of this controller config is actually identical to the redis-master pod definition above. It forms the template or "cookie cutter" that defines what it means to be a member of this set. - -Create this controller: - -```sh -kubectl create -f examples/redis/redis-controller.yaml -``` - -We'll do the same thing for the sentinel. Here is the controller config: [redis-sentinel-controller.yaml](redis-sentinel-controller.yaml) - -We create it as follows: -```sh -kubectl create -f examples/redis/redis-sentinel-controller.yaml -``` - -### Scale our replicated pods -Initially creating those pods didn't actually do anything, since we only asked for one sentinel and one redis server, and they already existed, nothing changed. Now we will add more replicas: - -```sh -kubectl scale rc redis --replicas=3 -``` - -```sh -kubectl scale rc redis-sentinel --replicas=3 -``` - -This will create two additional replicas of the redis server and two additional replicas of the redis sentinel. - -Unlike our original redis-master pod, these pods exist independently, and they use the ```redis-sentinel-service``` that we defined above to discover and join the cluster. - -### Delete our manual pod -The final step in the cluster turn up is to delete the original redis-master pod that we created manually. While it was useful for bootstrapping discovery in the cluster, we really don't want the lifespan of our sentinel to be tied to the lifespan of one of our redis servers, and now that we have a successful, replicated redis sentinel service up and running, the binding is unnecessary. - -Delete the master as follows: -```sh -kubectl delete pods redis-master -``` - -Now let's take a close look at what happens after this pod is deleted. There are three things that happen: - - 1. The redis replication controller notices that its desired state is 3 replicas, but there are currently only 2 replicas, and so it creates a new redis server to bring the replica count back up to 3 - 2. The redis-sentinel replication controller likewise notices the missing sentinel, and also creates a new sentinel. - 3. The redis sentinels themselves, realize that the master has disappeared from the cluster, and begin the election procedure for selecting a new master. They perform this election and selection, and chose one of the existing redis server replicas to be the new master. - -### Conclusion -At this point we now have a reliable, scalable Redis installation. By scaling the replication controller for redis servers, we can increase or decrease the number of read-slaves in our cluster. Likewise, if failures occur, the redis-sentinels will perform master election and select a new master. - -### tl; dr -For those of you who are impatient, here is the summary of commands we ran in this tutorial: - -``` -# Create a bootstrap master -kubectl create -f examples/redis/redis-master.yaml - -# Create a service to track the sentinels -kubectl create -f examples/redis/redis-sentinel-service.yaml - -# Create a replication controller for redis servers -kubectl create -f examples/redis/redis-controller.yaml - -# Create a replication controller for redis sentinels -kubectl create -f examples/redis/redis-sentinel-controller.yaml - -# Scale both replication controllers -kubectl scale rc redis --replicas=3 -kubectl scale rc redis-sentinel --replicas=3 - -# Delete the original master pod -kubectl delete pods redis-master -``` - - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/redis/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/redis/README.md?pixel)]() diff --git a/release-0.19.0/examples/redis/image/Dockerfile b/release-0.19.0/examples/redis/image/Dockerfile deleted file mode 100644 index c770efd8a4b..00000000000 --- a/release-0.19.0/examples/redis/image/Dockerfile +++ /dev/null @@ -1,11 +0,0 @@ -FROM redis:2.8 -RUN apt-get update -RUN apt-get install -yy -q python - -COPY redis-master.conf /redis-master/redis.conf -COPY redis-slave.conf /redis-slave/redis.conf -COPY run.sh /run.sh -COPY sentinel.py /sentinel.py - -CMD [ "/run.sh" ] -ENTRYPOINT [ "sh", "-c" ] diff --git a/release-0.19.0/examples/redis/image/redis-master.conf b/release-0.19.0/examples/redis/image/redis-master.conf deleted file mode 100644 index a514219dcfd..00000000000 --- a/release-0.19.0/examples/redis/image/redis-master.conf +++ /dev/null @@ -1,827 +0,0 @@ -# Redis configuration file example - -# Note on units: when memory size is needed, it is possible to specify -# it in the usual form of 1k 5GB 4M and so forth: -# -# 1k => 1000 bytes -# 1kb => 1024 bytes -# 1m => 1000000 bytes -# 1mb => 1024*1024 bytes -# 1g => 1000000000 bytes -# 1gb => 1024*1024*1024 bytes -# -# units are case insensitive so 1GB 1Gb 1gB are all the same. - -################################## INCLUDES ################################### - -# Include one or more other config files here. This is useful if you -# have a standard template that goes to all Redis servers but also need -# to customize a few per-server settings. Include files can include -# other files, so use this wisely. -# -# Notice option "include" won't be rewritten by command "CONFIG REWRITE" -# from admin or Redis Sentinel. Since Redis always uses the last processed -# line as value of a configuration directive, you'd better put includes -# at the beginning of this file to avoid overwriting config change at runtime. -# -# If instead you are interested in using includes to override configuration -# options, it is better to use include as the last line. -# -# include /path/to/local.conf -# include /path/to/other.conf - -################################ GENERAL ##################################### - -# By default Redis does not run as a daemon. Use 'yes' if you need it. -# Note that Redis will write a pid file in /var/run/redis.pid when daemonized. -daemonize no - -# When running daemonized, Redis writes a pid file in /var/run/redis.pid by -# default. You can specify a custom pid file location here. -pidfile /var/run/redis.pid - -# Accept connections on the specified port, default is 6379. -# If port 0 is specified Redis will not listen on a TCP socket. -port 6379 - -# TCP listen() backlog. -# -# In high requests-per-second environments you need an high backlog in order -# to avoid slow clients connections issues. Note that the Linux kernel -# will silently truncate it to the value of /proc/sys/net/core/somaxconn so -# make sure to raise both the value of somaxconn and tcp_max_syn_backlog -# in order to get the desired effect. -tcp-backlog 511 - -# By default Redis listens for connections from all the network interfaces -# available on the server. It is possible to listen to just one or multiple -# interfaces using the "bind" configuration directive, followed by one or -# more IP addresses. -# -# Examples: -# -# bind 192.168.1.100 10.0.0.1 -# bind 127.0.0.1 - -# Specify the path for the Unix socket that will be used to listen for -# incoming connections. There is no default, so Redis will not listen -# on a unix socket when not specified. -# -# unixsocket /tmp/redis.sock -# unixsocketperm 700 - -# Close the connection after a client is idle for N seconds (0 to disable) -timeout 0 - -# TCP keepalive. -# -# If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence -# of communication. This is useful for two reasons: -# -# 1) Detect dead peers. -# 2) Take the connection alive from the point of view of network -# equipment in the middle. -# -# On Linux, the specified value (in seconds) is the period used to send ACKs. -# Note that to close the connection the double of the time is needed. -# On other kernels the period depends on the kernel configuration. -# -# A reasonable value for this option is 60 seconds. -tcp-keepalive 60 - -# Specify the server verbosity level. -# This can be one of: -# debug (a lot of information, useful for development/testing) -# verbose (many rarely useful info, but not a mess like the debug level) -# notice (moderately verbose, what you want in production probably) -# warning (only very important / critical messages are logged) -loglevel notice - -# Specify the log file name. Also the empty string can be used to force -# Redis to log on the standard output. Note that if you use standard -# output for logging but daemonize, logs will be sent to /dev/null -logfile "" - -# To enable logging to the system logger, just set 'syslog-enabled' to yes, -# and optionally update the other syslog parameters to suit your needs. -# syslog-enabled no - -# Specify the syslog identity. -# syslog-ident redis - -# Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7. -# syslog-facility local0 - -# Set the number of databases. The default database is DB 0, you can select -# a different one on a per-connection basis using SELECT where -# dbid is a number between 0 and 'databases'-1 -databases 16 - -################################ SNAPSHOTTING ################################ -# -# Save the DB on disk: -# -# save -# -# Will save the DB if both the given number of seconds and the given -# number of write operations against the DB occurred. -# -# In the example below the behaviour will be to save: -# after 900 sec (15 min) if at least 1 key changed -# after 300 sec (5 min) if at least 10 keys changed -# after 60 sec if at least 10000 keys changed -# -# Note: you can disable saving completely by commenting out all "save" lines. -# -# It is also possible to remove all the previously configured save -# points by adding a save directive with a single empty string argument -# like in the following example: -# -# save "" - -save 900 1 -save 300 10 -save 60 10000 - -# By default Redis will stop accepting writes if RDB snapshots are enabled -# (at least one save point) and the latest background save failed. -# This will make the user aware (in a hard way) that data is not persisting -# on disk properly, otherwise chances are that no one will notice and some -# disaster will happen. -# -# If the background saving process will start working again Redis will -# automatically allow writes again. -# -# However if you have setup your proper monitoring of the Redis server -# and persistence, you may want to disable this feature so that Redis will -# continue to work as usual even if there are problems with disk, -# permissions, and so forth. -stop-writes-on-bgsave-error yes - -# Compress string objects using LZF when dump .rdb databases? -# For default that's set to 'yes' as it's almost always a win. -# If you want to save some CPU in the saving child set it to 'no' but -# the dataset will likely be bigger if you have compressible values or keys. -rdbcompression yes - -# Since version 5 of RDB a CRC64 checksum is placed at the end of the file. -# This makes the format more resistant to corruption but there is a performance -# hit to pay (around 10%) when saving and loading RDB files, so you can disable it -# for maximum performances. -# -# RDB files created with checksum disabled have a checksum of zero that will -# tell the loading code to skip the check. -rdbchecksum yes - -# The filename where to dump the DB -dbfilename dump.rdb - -# The working directory. -# -# The DB will be written inside this directory, with the filename specified -# above using the 'dbfilename' configuration directive. -# -# The Append Only File will also be created inside this directory. -# -# Note that you must specify a directory here, not a file name. -dir /redis-master-data - -################################# REPLICATION ################################# - -# Master-Slave replication. Use slaveof to make a Redis instance a copy of -# another Redis server. A few things to understand ASAP about Redis replication. -# -# 1) Redis replication is asynchronous, but you can configure a master to -# stop accepting writes if it appears to be not connected with at least -# a given number of slaves. -# 2) Redis slaves are able to perform a partial resynchronization with the -# master if the replication link is lost for a relatively small amount of -# time. You may want to configure the replication backlog size (see the next -# sections of this file) with a sensible value depending on your needs. -# 3) Replication is automatic and does not need user intervention. After a -# network partition slaves automatically try to reconnect to masters -# and resynchronize with them. -# -# slaveof - -# If the master is password protected (using the "requirepass" configuration -# directive below) it is possible to tell the slave to authenticate before -# starting the replication synchronization process, otherwise the master will -# refuse the slave request. -# -# masterauth - -# When a slave loses its connection with the master, or when the replication -# is still in progress, the slave can act in two different ways: -# -# 1) if slave-serve-stale-data is set to 'yes' (the default) the slave will -# still reply to client requests, possibly with out of date data, or the -# data set may just be empty if this is the first synchronization. -# -# 2) if slave-serve-stale-data is set to 'no' the slave will reply with -# an error "SYNC with master in progress" to all the kind of commands -# but to INFO and SLAVEOF. -# -slave-serve-stale-data yes - -# You can configure a slave instance to accept writes or not. Writing against -# a slave instance may be useful to store some ephemeral data (because data -# written on a slave will be easily deleted after resync with the master) but -# may also cause problems if clients are writing to it because of a -# misconfiguration. -# -# Since Redis 2.6 by default slaves are read-only. -# -# Note: read only slaves are not designed to be exposed to untrusted clients -# on the internet. It's just a protection layer against misuse of the instance. -# Still a read only slave exports by default all the administrative commands -# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve -# security of read only slaves using 'rename-command' to shadow all the -# administrative / dangerous commands. -slave-read-only yes - -# Replication SYNC strategy: disk or socket. -# -# ------------------------------------------------------- -# WARNING: DISKLESS REPLICATION IS EXPERIMENTAL CURRENTLY -# ------------------------------------------------------- -# -# New slaves and reconnecting slaves that are not able to continue the replication -# process just receiving differences, need to do what is called a "full -# synchronization". An RDB file is transmitted from the master to the slaves. -# The transmission can happen in two different ways: -# -# 1) Disk-backed: The Redis master creates a new process that writes the RDB -# file on disk. Later the file is transferred by the parent -# process to the slaves incrementally. -# 2) Diskless: The Redis master creates a new process that directly writes the -# RDB file to slave sockets, without touching the disk at all. -# -# With disk-backed replication, while the RDB file is generated, more slaves -# can be queued and served with the RDB file as soon as the current child producing -# the RDB file finishes its work. With diskless replication instead once -# the transfer starts, new slaves arriving will be queued and a new transfer -# will start when the current one terminates. -# -# When diskless replication is used, the master waits a configurable amount of -# time (in seconds) before starting the transfer in the hope that multiple slaves -# will arrive and the transfer can be parallelized. -# -# With slow disks and fast (large bandwidth) networks, diskless replication -# works better. -repl-diskless-sync no - -# When diskless replication is enabled, it is possible to configure the delay -# the server waits in order to spawn the child that trnasfers the RDB via socket -# to the slaves. -# -# This is important since once the transfer starts, it is not possible to serve -# new slaves arriving, that will be queued for the next RDB transfer, so the server -# waits a delay in order to let more slaves arrive. -# -# The delay is specified in seconds, and by default is 5 seconds. To disable -# it entirely just set it to 0 seconds and the transfer will start ASAP. -repl-diskless-sync-delay 5 - -# Slaves send PINGs to server in a predefined interval. It's possible to change -# this interval with the repl_ping_slave_period option. The default value is 10 -# seconds. -# -# repl-ping-slave-period 10 - -# The following option sets the replication timeout for: -# -# 1) Bulk transfer I/O during SYNC, from the point of view of slave. -# 2) Master timeout from the point of view of slaves (data, pings). -# 3) Slave timeout from the point of view of masters (REPLCONF ACK pings). -# -# It is important to make sure that this value is greater than the value -# specified for repl-ping-slave-period otherwise a timeout will be detected -# every time there is low traffic between the master and the slave. -# -# repl-timeout 60 - -# Disable TCP_NODELAY on the slave socket after SYNC? -# -# If you select "yes" Redis will use a smaller number of TCP packets and -# less bandwidth to send data to slaves. But this can add a delay for -# the data to appear on the slave side, up to 40 milliseconds with -# Linux kernels using a default configuration. -# -# If you select "no" the delay for data to appear on the slave side will -# be reduced but more bandwidth will be used for replication. -# -# By default we optimize for low latency, but in very high traffic conditions -# or when the master and slaves are many hops away, turning this to "yes" may -# be a good idea. -repl-disable-tcp-nodelay no - -# Set the replication backlog size. The backlog is a buffer that accumulates -# slave data when slaves are disconnected for some time, so that when a slave -# wants to reconnect again, often a full resync is not needed, but a partial -# resync is enough, just passing the portion of data the slave missed while -# disconnected. -# -# The bigger the replication backlog, the longer the time the slave can be -# disconnected and later be able to perform a partial resynchronization. -# -# The backlog is only allocated once there is at least a slave connected. -# -# repl-backlog-size 1mb - -# After a master has no longer connected slaves for some time, the backlog -# will be freed. The following option configures the amount of seconds that -# need to elapse, starting from the time the last slave disconnected, for -# the backlog buffer to be freed. -# -# A value of 0 means to never release the backlog. -# -# repl-backlog-ttl 3600 - -# The slave priority is an integer number published by Redis in the INFO output. -# It is used by Redis Sentinel in order to select a slave to promote into a -# master if the master is no longer working correctly. -# -# A slave with a low priority number is considered better for promotion, so -# for instance if there are three slaves with priority 10, 100, 25 Sentinel will -# pick the one with priority 10, that is the lowest. -# -# However a special priority of 0 marks the slave as not able to perform the -# role of master, so a slave with priority of 0 will never be selected by -# Redis Sentinel for promotion. -# -# By default the priority is 100. -slave-priority 100 - -# It is possible for a master to stop accepting writes if there are less than -# N slaves connected, having a lag less or equal than M seconds. -# -# The N slaves need to be in "online" state. -# -# The lag in seconds, that must be <= the specified value, is calculated from -# the last ping received from the slave, that is usually sent every second. -# -# This option does not GUARANTEE that N replicas will accept the write, but -# will limit the window of exposure for lost writes in case not enough slaves -# are available, to the specified number of seconds. -# -# For example to require at least 3 slaves with a lag <= 10 seconds use: -# -# min-slaves-to-write 3 -# min-slaves-max-lag 10 -# -# Setting one or the other to 0 disables the feature. -# -# By default min-slaves-to-write is set to 0 (feature disabled) and -# min-slaves-max-lag is set to 10. - -################################## SECURITY ################################### - -# Require clients to issue AUTH before processing any other -# commands. This might be useful in environments in which you do not trust -# others with access to the host running redis-server. -# -# This should stay commented out for backward compatibility and because most -# people do not need auth (e.g. they run their own servers). -# -# Warning: since Redis is pretty fast an outside user can try up to -# 150k passwords per second against a good box. This means that you should -# use a very strong password otherwise it will be very easy to break. -# -# requirepass foobared - -# Command renaming. -# -# It is possible to change the name of dangerous commands in a shared -# environment. For instance the CONFIG command may be renamed into something -# hard to guess so that it will still be available for internal-use tools -# but not available for general clients. -# -# Example: -# -# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 -# -# It is also possible to completely kill a command by renaming it into -# an empty string: -# -# rename-command CONFIG "" -# -# Please note that changing the name of commands that are logged into the -# AOF file or transmitted to slaves may cause problems. - -################################### LIMITS #################################### - -# Set the max number of connected clients at the same time. By default -# this limit is set to 10000 clients, however if the Redis server is not -# able to configure the process file limit to allow for the specified limit -# the max number of allowed clients is set to the current file limit -# minus 32 (as Redis reserves a few file descriptors for internal uses). -# -# Once the limit is reached Redis will close all the new connections sending -# an error 'max number of clients reached'. -# -# maxclients 10000 - -# Don't use more memory than the specified amount of bytes. -# When the memory limit is reached Redis will try to remove keys -# according to the eviction policy selected (see maxmemory-policy). -# -# If Redis can't remove keys according to the policy, or if the policy is -# set to 'noeviction', Redis will start to reply with errors to commands -# that would use more memory, like SET, LPUSH, and so on, and will continue -# to reply to read-only commands like GET. -# -# This option is usually useful when using Redis as an LRU cache, or to set -# a hard memory limit for an instance (using the 'noeviction' policy). -# -# WARNING: If you have slaves attached to an instance with maxmemory on, -# the size of the output buffers needed to feed the slaves are subtracted -# from the used memory count, so that network problems / resyncs will -# not trigger a loop where keys are evicted, and in turn the output -# buffer of slaves is full with DELs of keys evicted triggering the deletion -# of more keys, and so forth until the database is completely emptied. -# -# In short... if you have slaves attached it is suggested that you set a lower -# limit for maxmemory so that there is some free RAM on the system for slave -# output buffers (but this is not needed if the policy is 'noeviction'). -# -# maxmemory - -# MAXMEMORY POLICY: how Redis will select what to remove when maxmemory -# is reached. You can select among five behaviors: -# -# volatile-lru -> remove the key with an expire set using an LRU algorithm -# allkeys-lru -> remove any key according to the LRU algorithm -# volatile-random -> remove a random key with an expire set -# allkeys-random -> remove a random key, any key -# volatile-ttl -> remove the key with the nearest expire time (minor TTL) -# noeviction -> don't expire at all, just return an error on write operations -# -# Note: with any of the above policies, Redis will return an error on write -# operations, when there are no suitable keys for eviction. -# -# At the date of writing these commands are: set setnx setex append -# incr decr rpush lpush rpushx lpushx linsert lset rpoplpush sadd -# sinter sinterstore sunion sunionstore sdiff sdiffstore zadd zincrby -# zunionstore zinterstore hset hsetnx hmset hincrby incrby decrby -# getset mset msetnx exec sort -# -# The default is: -# -# maxmemory-policy volatile-lru - -# LRU and minimal TTL algorithms are not precise algorithms but approximated -# algorithms (in order to save memory), so you can select as well the sample -# size to check. For instance for default Redis will check three keys and -# pick the one that was used less recently, you can change the sample size -# using the following configuration directive. -# -# maxmemory-samples 3 - -############################## APPEND ONLY MODE ############################### - -# By default Redis asynchronously dumps the dataset on disk. This mode is -# good enough in many applications, but an issue with the Redis process or -# a power outage may result into a few minutes of writes lost (depending on -# the configured save points). -# -# The Append Only File is an alternative persistence mode that provides -# much better durability. For instance using the default data fsync policy -# (see later in the config file) Redis can lose just one second of writes in a -# dramatic event like a server power outage, or a single write if something -# wrong with the Redis process itself happens, but the operating system is -# still running correctly. -# -# AOF and RDB persistence can be enabled at the same time without problems. -# If the AOF is enabled on startup Redis will load the AOF, that is the file -# with the better durability guarantees. -# -# Please check http://redis.io/topics/persistence for more information. - -appendonly yes - -# The name of the append only file (default: "appendonly.aof") - -appendfilename "appendonly.aof" - -# The fsync() call tells the Operating System to actually write data on disk -# instead of waiting for more data in the output buffer. Some OS will really flush -# data on disk, some other OS will just try to do it ASAP. -# -# Redis supports three different modes: -# -# no: don't fsync, just let the OS flush the data when it wants. Faster. -# always: fsync after every write to the append only log. Slow, Safest. -# everysec: fsync only one time every second. Compromise. -# -# The default is "everysec", as that's usually the right compromise between -# speed and data safety. It's up to you to understand if you can relax this to -# "no" that will let the operating system flush the output buffer when -# it wants, for better performances (but if you can live with the idea of -# some data loss consider the default persistence mode that's snapshotting), -# or on the contrary, use "always" that's very slow but a bit safer than -# everysec. -# -# More details please check the following article: -# http://antirez.com/post/redis-persistence-demystified.html -# -# If unsure, use "everysec". - -# appendfsync always -appendfsync everysec -# appendfsync no - -# When the AOF fsync policy is set to always or everysec, and a background -# saving process (a background save or AOF log background rewriting) is -# performing a lot of I/O against the disk, in some Linux configurations -# Redis may block too long on the fsync() call. Note that there is no fix for -# this currently, as even performing fsync in a different thread will block -# our synchronous write(2) call. -# -# In order to mitigate this problem it's possible to use the following option -# that will prevent fsync() from being called in the main process while a -# BGSAVE or BGREWRITEAOF is in progress. -# -# This means that while another child is saving, the durability of Redis is -# the same as "appendfsync none". In practical terms, this means that it is -# possible to lose up to 30 seconds of log in the worst scenario (with the -# default Linux settings). -# -# If you have latency problems turn this to "yes". Otherwise leave it as -# "no" that is the safest pick from the point of view of durability. - -no-appendfsync-on-rewrite no - -# Automatic rewrite of the append only file. -# Redis is able to automatically rewrite the log file implicitly calling -# BGREWRITEAOF when the AOF log size grows by the specified percentage. -# -# This is how it works: Redis remembers the size of the AOF file after the -# latest rewrite (if no rewrite has happened since the restart, the size of -# the AOF at startup is used). -# -# This base size is compared to the current size. If the current size is -# bigger than the specified percentage, the rewrite is triggered. Also -# you need to specify a minimal size for the AOF file to be rewritten, this -# is useful to avoid rewriting the AOF file even if the percentage increase -# is reached but it is still pretty small. -# -# Specify a percentage of zero in order to disable the automatic AOF -# rewrite feature. - -auto-aof-rewrite-percentage 100 -auto-aof-rewrite-min-size 64mb - -# An AOF file may be found to be truncated at the end during the Redis -# startup process, when the AOF data gets loaded back into memory. -# This may happen when the system where Redis is running -# crashes, especially when an ext4 filesystem is mounted without the -# data=ordered option (however this can't happen when Redis itself -# crashes or aborts but the operating system still works correctly). -# -# Redis can either exit with an error when this happens, or load as much -# data as possible (the default now) and start if the AOF file is found -# to be truncated at the end. The following option controls this behavior. -# -# If aof-load-truncated is set to yes, a truncated AOF file is loaded and -# the Redis server starts emitting a log to inform the user of the event. -# Otherwise if the option is set to no, the server aborts with an error -# and refuses to start. When the option is set to no, the user requires -# to fix the AOF file using the "redis-check-aof" utility before to restart -# the server. -# -# Note that if the AOF file will be found to be corrupted in the middle -# the server will still exit with an error. This option only applies when -# Redis will try to read more data from the AOF file but not enough bytes -# will be found. -aof-load-truncated yes - -################################ LUA SCRIPTING ############################### - -# Max execution time of a Lua script in milliseconds. -# -# If the maximum execution time is reached Redis will log that a script is -# still in execution after the maximum allowed time and will start to -# reply to queries with an error. -# -# When a long running script exceeds the maximum execution time only the -# SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be -# used to stop a script that did not yet called write commands. The second -# is the only way to shut down the server in the case a write command was -# already issued by the script but the user doesn't want to wait for the natural -# termination of the script. -# -# Set it to 0 or a negative value for unlimited execution without warnings. -lua-time-limit 5000 - -################################## SLOW LOG ################################### - -# The Redis Slow Log is a system to log queries that exceeded a specified -# execution time. The execution time does not include the I/O operations -# like talking with the client, sending the reply and so forth, -# but just the time needed to actually execute the command (this is the only -# stage of command execution where the thread is blocked and can not serve -# other requests in the meantime). -# -# You can configure the slow log with two parameters: one tells Redis -# what is the execution time, in microseconds, to exceed in order for the -# command to get logged, and the other parameter is the length of the -# slow log. When a new command is logged the oldest one is removed from the -# queue of logged commands. - -# The following time is expressed in microseconds, so 1000000 is equivalent -# to one second. Note that a negative number disables the slow log, while -# a value of zero forces the logging of every command. -slowlog-log-slower-than 10000 - -# There is no limit to this length. Just be aware that it will consume memory. -# You can reclaim memory used by the slow log with SLOWLOG RESET. -slowlog-max-len 128 - -################################ LATENCY MONITOR ############################## - -# The Redis latency monitoring subsystem samples different operations -# at runtime in order to collect data related to possible sources of -# latency of a Redis instance. -# -# Via the LATENCY command this information is available to the user that can -# print graphs and obtain reports. -# -# The system only logs operations that were performed in a time equal or -# greater than the amount of milliseconds specified via the -# latency-monitor-threshold configuration directive. When its value is set -# to zero, the latency monitor is turned off. -# -# By default latency monitoring is disabled since it is mostly not needed -# if you don't have latency issues, and collecting data has a performance -# impact, that while very small, can be measured under big load. Latency -# monitoring can easily be enalbed at runtime using the command -# "CONFIG SET latency-monitor-threshold " if needed. -latency-monitor-threshold 0 - -############################# Event notification ############################## - -# Redis can notify Pub/Sub clients about events happening in the key space. -# This feature is documented at http://redis.io/topics/notifications -# -# For instance if keyspace events notification is enabled, and a client -# performs a DEL operation on key "foo" stored in the Database 0, two -# messages will be published via Pub/Sub: -# -# PUBLISH __keyspace@0__:foo del -# PUBLISH __keyevent@0__:del foo -# -# It is possible to select the events that Redis will notify among a set -# of classes. Every class is identified by a single character: -# -# K Keyspace events, published with __keyspace@__ prefix. -# E Keyevent events, published with __keyevent@__ prefix. -# g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ... -# $ String commands -# l List commands -# s Set commands -# h Hash commands -# z Sorted set commands -# x Expired events (events generated every time a key expires) -# e Evicted events (events generated when a key is evicted for maxmemory) -# A Alias for g$lshzxe, so that the "AKE" string means all the events. -# -# The "notify-keyspace-events" takes as argument a string that is composed -# of zero or multiple characters. The empty string means that notifications -# are disabled. -# -# Example: to enable list and generic events, from the point of view of the -# event name, use: -# -# notify-keyspace-events Elg -# -# Example 2: to get the stream of the expired keys subscribing to channel -# name __keyevent@0__:expired use: -# -# notify-keyspace-events Ex -# -# By default all notifications are disabled because most users don't need -# this feature and the feature has some overhead. Note that if you don't -# specify at least one of K or E, no events will be delivered. -notify-keyspace-events "" - -############################### ADVANCED CONFIG ############################### - -# Hashes are encoded using a memory efficient data structure when they have a -# small number of entries, and the biggest entry does not exceed a given -# threshold. These thresholds can be configured using the following directives. -hash-max-ziplist-entries 512 -hash-max-ziplist-value 64 - -# Similarly to hashes, small lists are also encoded in a special way in order -# to save a lot of space. The special representation is only used when -# you are under the following limits: -list-max-ziplist-entries 512 -list-max-ziplist-value 64 - -# Sets have a special encoding in just one case: when a set is composed -# of just strings that happen to be integers in radix 10 in the range -# of 64 bit signed integers. -# The following configuration setting sets the limit in the size of the -# set in order to use this special memory saving encoding. -set-max-intset-entries 512 - -# Similarly to hashes and lists, sorted sets are also specially encoded in -# order to save a lot of space. This encoding is only used when the length and -# elements of a sorted set are below the following limits: -zset-max-ziplist-entries 128 -zset-max-ziplist-value 64 - -# HyperLogLog sparse representation bytes limit. The limit includes the -# 16 bytes header. When an HyperLogLog using the sparse representation crosses -# this limit, it is converted into the dense representation. -# -# A value greater than 16000 is totally useless, since at that point the -# dense representation is more memory efficient. -# -# The suggested value is ~ 3000 in order to have the benefits of -# the space efficient encoding without slowing down too much PFADD, -# which is O(N) with the sparse encoding. The value can be raised to -# ~ 10000 when CPU is not a concern, but space is, and the data set is -# composed of many HyperLogLogs with cardinality in the 0 - 15000 range. -hll-sparse-max-bytes 3000 - -# Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in -# order to help rehashing the main Redis hash table (the one mapping top-level -# keys to values). The hash table implementation Redis uses (see dict.c) -# performs a lazy rehashing: the more operation you run into a hash table -# that is rehashing, the more rehashing "steps" are performed, so if the -# server is idle the rehashing is never complete and some more memory is used -# by the hash table. -# -# The default is to use this millisecond 10 times every second in order to -# actively rehash the main dictionaries, freeing memory when possible. -# -# If unsure: -# use "activerehashing no" if you have hard latency requirements and it is -# not a good thing in your environment that Redis can reply from time to time -# to queries with 2 milliseconds delay. -# -# use "activerehashing yes" if you don't have such hard requirements but -# want to free memory asap when possible. -activerehashing yes - -# The client output buffer limits can be used to force disconnection of clients -# that are not reading data from the server fast enough for some reason (a -# common reason is that a Pub/Sub client can't consume messages as fast as the -# publisher can produce them). -# -# The limit can be set differently for the three different classes of clients: -# -# normal -> normal clients including MONITOR clients -# slave -> slave clients -# pubsub -> clients subscribed to at least one pubsub channel or pattern -# -# The syntax of every client-output-buffer-limit directive is the following: -# -# client-output-buffer-limit -# -# A client is immediately disconnected once the hard limit is reached, or if -# the soft limit is reached and remains reached for the specified number of -# seconds (continuously). -# So for instance if the hard limit is 32 megabytes and the soft limit is -# 16 megabytes / 10 seconds, the client will get disconnected immediately -# if the size of the output buffers reach 32 megabytes, but will also get -# disconnected if the client reaches 16 megabytes and continuously overcomes -# the limit for 10 seconds. -# -# By default normal clients are not limited because they don't receive data -# without asking (in a push way), but just after a request, so only -# asynchronous clients may create a scenario where data is requested faster -# than it can read. -# -# Instead there is a default limit for pubsub and slave clients, since -# subscribers and slaves receive data in a push fashion. -# -# Both the hard or the soft limit can be disabled by setting them to zero. -client-output-buffer-limit normal 0 0 0 -client-output-buffer-limit slave 256mb 64mb 60 -client-output-buffer-limit pubsub 32mb 8mb 60 - -# Redis calls an internal function to perform many background tasks, like -# closing connections of clients in timeout, purging expired keys that are -# never requested, and so forth. -# -# Not all tasks are performed with the same frequency, but Redis checks for -# tasks to perform according to the specified "hz" value. -# -# By default "hz" is set to 10. Raising the value will use more CPU when -# Redis is idle, but at the same time will make Redis more responsive when -# there are many keys expiring at the same time, and timeouts may be -# handled with more precision. -# -# The range is between 1 and 500, however a value over 100 is usually not -# a good idea. Most users should use the default of 10 and raise this up to -# 100 only in environments where very low latency is required. -hz 10 - -# When a child rewrites the AOF file, if the following option is enabled -# the file will be fsync-ed every 32 MB of data generated. This is useful -# in order to commit the file to the disk more incrementally and avoid -# big latency spikes. -aof-rewrite-incremental-fsync yes diff --git a/release-0.19.0/examples/redis/image/redis-slave.conf b/release-0.19.0/examples/redis/image/redis-slave.conf deleted file mode 100644 index cb01c10a0e8..00000000000 --- a/release-0.19.0/examples/redis/image/redis-slave.conf +++ /dev/null @@ -1,827 +0,0 @@ -# Redis configuration file example - -# Note on units: when memory size is needed, it is possible to specify -# it in the usual form of 1k 5GB 4M and so forth: -# -# 1k => 1000 bytes -# 1kb => 1024 bytes -# 1m => 1000000 bytes -# 1mb => 1024*1024 bytes -# 1g => 1000000000 bytes -# 1gb => 1024*1024*1024 bytes -# -# units are case insensitive so 1GB 1Gb 1gB are all the same. - -################################## INCLUDES ################################### - -# Include one or more other config files here. This is useful if you -# have a standard template that goes to all Redis servers but also need -# to customize a few per-server settings. Include files can include -# other files, so use this wisely. -# -# Notice option "include" won't be rewritten by command "CONFIG REWRITE" -# from admin or Redis Sentinel. Since Redis always uses the last processed -# line as value of a configuration directive, you'd better put includes -# at the beginning of this file to avoid overwriting config change at runtime. -# -# If instead you are interested in using includes to override configuration -# options, it is better to use include as the last line. -# -# include /path/to/local.conf -# include /path/to/other.conf - -################################ GENERAL ##################################### - -# By default Redis does not run as a daemon. Use 'yes' if you need it. -# Note that Redis will write a pid file in /var/run/redis.pid when daemonized. -daemonize no - -# When running daemonized, Redis writes a pid file in /var/run/redis.pid by -# default. You can specify a custom pid file location here. -pidfile /var/run/redis.pid - -# Accept connections on the specified port, default is 6379. -# If port 0 is specified Redis will not listen on a TCP socket. -port 6379 - -# TCP listen() backlog. -# -# In high requests-per-second environments you need an high backlog in order -# to avoid slow clients connections issues. Note that the Linux kernel -# will silently truncate it to the value of /proc/sys/net/core/somaxconn so -# make sure to raise both the value of somaxconn and tcp_max_syn_backlog -# in order to get the desired effect. -tcp-backlog 511 - -# By default Redis listens for connections from all the network interfaces -# available on the server. It is possible to listen to just one or multiple -# interfaces using the "bind" configuration directive, followed by one or -# more IP addresses. -# -# Examples: -# -# bind 192.168.1.100 10.0.0.1 -# bind 127.0.0.1 - -# Specify the path for the Unix socket that will be used to listen for -# incoming connections. There is no default, so Redis will not listen -# on a unix socket when not specified. -# -# unixsocket /tmp/redis.sock -# unixsocketperm 700 - -# Close the connection after a client is idle for N seconds (0 to disable) -timeout 0 - -# TCP keepalive. -# -# If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence -# of communication. This is useful for two reasons: -# -# 1) Detect dead peers. -# 2) Take the connection alive from the point of view of network -# equipment in the middle. -# -# On Linux, the specified value (in seconds) is the period used to send ACKs. -# Note that to close the connection the double of the time is needed. -# On other kernels the period depends on the kernel configuration. -# -# A reasonable value for this option is 60 seconds. -tcp-keepalive 60 - -# Specify the server verbosity level. -# This can be one of: -# debug (a lot of information, useful for development/testing) -# verbose (many rarely useful info, but not a mess like the debug level) -# notice (moderately verbose, what you want in production probably) -# warning (only very important / critical messages are logged) -loglevel notice - -# Specify the log file name. Also the empty string can be used to force -# Redis to log on the standard output. Note that if you use standard -# output for logging but daemonize, logs will be sent to /dev/null -logfile "" - -# To enable logging to the system logger, just set 'syslog-enabled' to yes, -# and optionally update the other syslog parameters to suit your needs. -# syslog-enabled no - -# Specify the syslog identity. -# syslog-ident redis - -# Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7. -# syslog-facility local0 - -# Set the number of databases. The default database is DB 0, you can select -# a different one on a per-connection basis using SELECT where -# dbid is a number between 0 and 'databases'-1 -databases 16 - -################################ SNAPSHOTTING ################################ -# -# Save the DB on disk: -# -# save -# -# Will save the DB if both the given number of seconds and the given -# number of write operations against the DB occurred. -# -# In the example below the behaviour will be to save: -# after 900 sec (15 min) if at least 1 key changed -# after 300 sec (5 min) if at least 10 keys changed -# after 60 sec if at least 10000 keys changed -# -# Note: you can disable saving completely by commenting out all "save" lines. -# -# It is also possible to remove all the previously configured save -# points by adding a save directive with a single empty string argument -# like in the following example: -# -# save "" - -save 900 1 -save 300 10 -save 60 10000 - -# By default Redis will stop accepting writes if RDB snapshots are enabled -# (at least one save point) and the latest background save failed. -# This will make the user aware (in a hard way) that data is not persisting -# on disk properly, otherwise chances are that no one will notice and some -# disaster will happen. -# -# If the background saving process will start working again Redis will -# automatically allow writes again. -# -# However if you have setup your proper monitoring of the Redis server -# and persistence, you may want to disable this feature so that Redis will -# continue to work as usual even if there are problems with disk, -# permissions, and so forth. -stop-writes-on-bgsave-error yes - -# Compress string objects using LZF when dump .rdb databases? -# For default that's set to 'yes' as it's almost always a win. -# If you want to save some CPU in the saving child set it to 'no' but -# the dataset will likely be bigger if you have compressible values or keys. -rdbcompression yes - -# Since version 5 of RDB a CRC64 checksum is placed at the end of the file. -# This makes the format more resistant to corruption but there is a performance -# hit to pay (around 10%) when saving and loading RDB files, so you can disable it -# for maximum performances. -# -# RDB files created with checksum disabled have a checksum of zero that will -# tell the loading code to skip the check. -rdbchecksum yes - -# The filename where to dump the DB -dbfilename dump.rdb - -# The working directory. -# -# The DB will be written inside this directory, with the filename specified -# above using the 'dbfilename' configuration directive. -# -# The Append Only File will also be created inside this directory. -# -# Note that you must specify a directory here, not a file name. -dir "./" - -################################# REPLICATION ################################# - -# Master-Slave replication. Use slaveof to make a Redis instance a copy of -# another Redis server. A few things to understand ASAP about Redis replication. -# -# 1) Redis replication is asynchronous, but you can configure a master to -# stop accepting writes if it appears to be not connected with at least -# a given number of slaves. -# 2) Redis slaves are able to perform a partial resynchronization with the -# master if the replication link is lost for a relatively small amount of -# time. You may want to configure the replication backlog size (see the next -# sections of this file) with a sensible value depending on your needs. -# 3) Replication is automatic and does not need user intervention. After a -# network partition slaves automatically try to reconnect to masters -# and resynchronize with them. -# -slaveof %master-ip% %master-port% - -# If the master is password protected (using the "requirepass" configuration -# directive below) it is possible to tell the slave to authenticate before -# starting the replication synchronization process, otherwise the master will -# refuse the slave request. -# -# masterauth - -# When a slave loses its connection with the master, or when the replication -# is still in progress, the slave can act in two different ways: -# -# 1) if slave-serve-stale-data is set to 'yes' (the default) the slave will -# still reply to client requests, possibly with out of date data, or the -# data set may just be empty if this is the first synchronization. -# -# 2) if slave-serve-stale-data is set to 'no' the slave will reply with -# an error "SYNC with master in progress" to all the kind of commands -# but to INFO and SLAVEOF. -# -slave-serve-stale-data yes - -# You can configure a slave instance to accept writes or not. Writing against -# a slave instance may be useful to store some ephemeral data (because data -# written on a slave will be easily deleted after resync with the master) but -# may also cause problems if clients are writing to it because of a -# misconfiguration. -# -# Since Redis 2.6 by default slaves are read-only. -# -# Note: read only slaves are not designed to be exposed to untrusted clients -# on the internet. It's just a protection layer against misuse of the instance. -# Still a read only slave exports by default all the administrative commands -# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve -# security of read only slaves using 'rename-command' to shadow all the -# administrative / dangerous commands. -slave-read-only yes - -# Replication SYNC strategy: disk or socket. -# -# ------------------------------------------------------- -# WARNING: DISKLESS REPLICATION IS EXPERIMENTAL CURRENTLY -# ------------------------------------------------------- -# -# New slaves and reconnecting slaves that are not able to continue the replication -# process just receiving differences, need to do what is called a "full -# synchronization". An RDB file is transmitted from the master to the slaves. -# The transmission can happen in two different ways: -# -# 1) Disk-backed: The Redis master creates a new process that writes the RDB -# file on disk. Later the file is transferred by the parent -# process to the slaves incrementally. -# 2) Diskless: The Redis master creates a new process that directly writes the -# RDB file to slave sockets, without touching the disk at all. -# -# With disk-backed replication, while the RDB file is generated, more slaves -# can be queued and served with the RDB file as soon as the current child producing -# the RDB file finishes its work. With diskless replication instead once -# the transfer starts, new slaves arriving will be queued and a new transfer -# will start when the current one terminates. -# -# When diskless replication is used, the master waits a configurable amount of -# time (in seconds) before starting the transfer in the hope that multiple slaves -# will arrive and the transfer can be parallelized. -# -# With slow disks and fast (large bandwidth) networks, diskless replication -# works better. -repl-diskless-sync no - -# When diskless replication is enabled, it is possible to configure the delay -# the server waits in order to spawn the child that trnasfers the RDB via socket -# to the slaves. -# -# This is important since once the transfer starts, it is not possible to serve -# new slaves arriving, that will be queued for the next RDB transfer, so the server -# waits a delay in order to let more slaves arrive. -# -# The delay is specified in seconds, and by default is 5 seconds. To disable -# it entirely just set it to 0 seconds and the transfer will start ASAP. -repl-diskless-sync-delay 5 - -# Slaves send PINGs to server in a predefined interval. It's possible to change -# this interval with the repl_ping_slave_period option. The default value is 10 -# seconds. -# -# repl-ping-slave-period 10 - -# The following option sets the replication timeout for: -# -# 1) Bulk transfer I/O during SYNC, from the point of view of slave. -# 2) Master timeout from the point of view of slaves (data, pings). -# 3) Slave timeout from the point of view of masters (REPLCONF ACK pings). -# -# It is important to make sure that this value is greater than the value -# specified for repl-ping-slave-period otherwise a timeout will be detected -# every time there is low traffic between the master and the slave. -# -# repl-timeout 60 - -# Disable TCP_NODELAY on the slave socket after SYNC? -# -# If you select "yes" Redis will use a smaller number of TCP packets and -# less bandwidth to send data to slaves. But this can add a delay for -# the data to appear on the slave side, up to 40 milliseconds with -# Linux kernels using a default configuration. -# -# If you select "no" the delay for data to appear on the slave side will -# be reduced but more bandwidth will be used for replication. -# -# By default we optimize for low latency, but in very high traffic conditions -# or when the master and slaves are many hops away, turning this to "yes" may -# be a good idea. -repl-disable-tcp-nodelay no - -# Set the replication backlog size. The backlog is a buffer that accumulates -# slave data when slaves are disconnected for some time, so that when a slave -# wants to reconnect again, often a full resync is not needed, but a partial -# resync is enough, just passing the portion of data the slave missed while -# disconnected. -# -# The bigger the replication backlog, the longer the time the slave can be -# disconnected and later be able to perform a partial resynchronization. -# -# The backlog is only allocated once there is at least a slave connected. -# -# repl-backlog-size 1mb - -# After a master has no longer connected slaves for some time, the backlog -# will be freed. The following option configures the amount of seconds that -# need to elapse, starting from the time the last slave disconnected, for -# the backlog buffer to be freed. -# -# A value of 0 means to never release the backlog. -# -# repl-backlog-ttl 3600 - -# The slave priority is an integer number published by Redis in the INFO output. -# It is used by Redis Sentinel in order to select a slave to promote into a -# master if the master is no longer working correctly. -# -# A slave with a low priority number is considered better for promotion, so -# for instance if there are three slaves with priority 10, 100, 25 Sentinel will -# pick the one with priority 10, that is the lowest. -# -# However a special priority of 0 marks the slave as not able to perform the -# role of master, so a slave with priority of 0 will never be selected by -# Redis Sentinel for promotion. -# -# By default the priority is 100. -slave-priority 100 - -# It is possible for a master to stop accepting writes if there are less than -# N slaves connected, having a lag less or equal than M seconds. -# -# The N slaves need to be in "online" state. -# -# The lag in seconds, that must be <= the specified value, is calculated from -# the last ping received from the slave, that is usually sent every second. -# -# This option does not GUARANTEE that N replicas will accept the write, but -# will limit the window of exposure for lost writes in case not enough slaves -# are available, to the specified number of seconds. -# -# For example to require at least 3 slaves with a lag <= 10 seconds use: -# -# min-slaves-to-write 3 -# min-slaves-max-lag 10 -# -# Setting one or the other to 0 disables the feature. -# -# By default min-slaves-to-write is set to 0 (feature disabled) and -# min-slaves-max-lag is set to 10. - -################################## SECURITY ################################### - -# Require clients to issue AUTH before processing any other -# commands. This might be useful in environments in which you do not trust -# others with access to the host running redis-server. -# -# This should stay commented out for backward compatibility and because most -# people do not need auth (e.g. they run their own servers). -# -# Warning: since Redis is pretty fast an outside user can try up to -# 150k passwords per second against a good box. This means that you should -# use a very strong password otherwise it will be very easy to break. -# -# requirepass foobared - -# Command renaming. -# -# It is possible to change the name of dangerous commands in a shared -# environment. For instance the CONFIG command may be renamed into something -# hard to guess so that it will still be available for internal-use tools -# but not available for general clients. -# -# Example: -# -# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 -# -# It is also possible to completely kill a command by renaming it into -# an empty string: -# -# rename-command CONFIG "" -# -# Please note that changing the name of commands that are logged into the -# AOF file or transmitted to slaves may cause problems. - -################################### LIMITS #################################### - -# Set the max number of connected clients at the same time. By default -# this limit is set to 10000 clients, however if the Redis server is not -# able to configure the process file limit to allow for the specified limit -# the max number of allowed clients is set to the current file limit -# minus 32 (as Redis reserves a few file descriptors for internal uses). -# -# Once the limit is reached Redis will close all the new connections sending -# an error 'max number of clients reached'. -# -# maxclients 10000 - -# Don't use more memory than the specified amount of bytes. -# When the memory limit is reached Redis will try to remove keys -# according to the eviction policy selected (see maxmemory-policy). -# -# If Redis can't remove keys according to the policy, or if the policy is -# set to 'noeviction', Redis will start to reply with errors to commands -# that would use more memory, like SET, LPUSH, and so on, and will continue -# to reply to read-only commands like GET. -# -# This option is usually useful when using Redis as an LRU cache, or to set -# a hard memory limit for an instance (using the 'noeviction' policy). -# -# WARNING: If you have slaves attached to an instance with maxmemory on, -# the size of the output buffers needed to feed the slaves are subtracted -# from the used memory count, so that network problems / resyncs will -# not trigger a loop where keys are evicted, and in turn the output -# buffer of slaves is full with DELs of keys evicted triggering the deletion -# of more keys, and so forth until the database is completely emptied. -# -# In short... if you have slaves attached it is suggested that you set a lower -# limit for maxmemory so that there is some free RAM on the system for slave -# output buffers (but this is not needed if the policy is 'noeviction'). -# -# maxmemory - -# MAXMEMORY POLICY: how Redis will select what to remove when maxmemory -# is reached. You can select among five behaviors: -# -# volatile-lru -> remove the key with an expire set using an LRU algorithm -# allkeys-lru -> remove any key according to the LRU algorithm -# volatile-random -> remove a random key with an expire set -# allkeys-random -> remove a random key, any key -# volatile-ttl -> remove the key with the nearest expire time (minor TTL) -# noeviction -> don't expire at all, just return an error on write operations -# -# Note: with any of the above policies, Redis will return an error on write -# operations, when there are no suitable keys for eviction. -# -# At the date of writing these commands are: set setnx setex append -# incr decr rpush lpush rpushx lpushx linsert lset rpoplpush sadd -# sinter sinterstore sunion sunionstore sdiff sdiffstore zadd zincrby -# zunionstore zinterstore hset hsetnx hmset hincrby incrby decrby -# getset mset msetnx exec sort -# -# The default is: -# -# maxmemory-policy volatile-lru - -# LRU and minimal TTL algorithms are not precise algorithms but approximated -# algorithms (in order to save memory), so you can select as well the sample -# size to check. For instance for default Redis will check three keys and -# pick the one that was used less recently, you can change the sample size -# using the following configuration directive. -# -# maxmemory-samples 3 - -############################## APPEND ONLY MODE ############################### - -# By default Redis asynchronously dumps the dataset on disk. This mode is -# good enough in many applications, but an issue with the Redis process or -# a power outage may result into a few minutes of writes lost (depending on -# the configured save points). -# -# The Append Only File is an alternative persistence mode that provides -# much better durability. For instance using the default data fsync policy -# (see later in the config file) Redis can lose just one second of writes in a -# dramatic event like a server power outage, or a single write if something -# wrong with the Redis process itself happens, but the operating system is -# still running correctly. -# -# AOF and RDB persistence can be enabled at the same time without problems. -# If the AOF is enabled on startup Redis will load the AOF, that is the file -# with the better durability guarantees. -# -# Please check http://redis.io/topics/persistence for more information. - -appendonly yes - -# The name of the append only file (default: "appendonly.aof") - -appendfilename "appendonly.aof" - -# The fsync() call tells the Operating System to actually write data on disk -# instead of waiting for more data in the output buffer. Some OS will really flush -# data on disk, some other OS will just try to do it ASAP. -# -# Redis supports three different modes: -# -# no: don't fsync, just let the OS flush the data when it wants. Faster. -# always: fsync after every write to the append only log. Slow, Safest. -# everysec: fsync only one time every second. Compromise. -# -# The default is "everysec", as that's usually the right compromise between -# speed and data safety. It's up to you to understand if you can relax this to -# "no" that will let the operating system flush the output buffer when -# it wants, for better performances (but if you can live with the idea of -# some data loss consider the default persistence mode that's snapshotting), -# or on the contrary, use "always" that's very slow but a bit safer than -# everysec. -# -# More details please check the following article: -# http://antirez.com/post/redis-persistence-demystified.html -# -# If unsure, use "everysec". - -# appendfsync always -appendfsync everysec -# appendfsync no - -# When the AOF fsync policy is set to always or everysec, and a background -# saving process (a background save or AOF log background rewriting) is -# performing a lot of I/O against the disk, in some Linux configurations -# Redis may block too long on the fsync() call. Note that there is no fix for -# this currently, as even performing fsync in a different thread will block -# our synchronous write(2) call. -# -# In order to mitigate this problem it's possible to use the following option -# that will prevent fsync() from being called in the main process while a -# BGSAVE or BGREWRITEAOF is in progress. -# -# This means that while another child is saving, the durability of Redis is -# the same as "appendfsync none". In practical terms, this means that it is -# possible to lose up to 30 seconds of log in the worst scenario (with the -# default Linux settings). -# -# If you have latency problems turn this to "yes". Otherwise leave it as -# "no" that is the safest pick from the point of view of durability. - -no-appendfsync-on-rewrite no - -# Automatic rewrite of the append only file. -# Redis is able to automatically rewrite the log file implicitly calling -# BGREWRITEAOF when the AOF log size grows by the specified percentage. -# -# This is how it works: Redis remembers the size of the AOF file after the -# latest rewrite (if no rewrite has happened since the restart, the size of -# the AOF at startup is used). -# -# This base size is compared to the current size. If the current size is -# bigger than the specified percentage, the rewrite is triggered. Also -# you need to specify a minimal size for the AOF file to be rewritten, this -# is useful to avoid rewriting the AOF file even if the percentage increase -# is reached but it is still pretty small. -# -# Specify a percentage of zero in order to disable the automatic AOF -# rewrite feature. - -auto-aof-rewrite-percentage 100 -auto-aof-rewrite-min-size 64mb - -# An AOF file may be found to be truncated at the end during the Redis -# startup process, when the AOF data gets loaded back into memory. -# This may happen when the system where Redis is running -# crashes, especially when an ext4 filesystem is mounted without the -# data=ordered option (however this can't happen when Redis itself -# crashes or aborts but the operating system still works correctly). -# -# Redis can either exit with an error when this happens, or load as much -# data as possible (the default now) and start if the AOF file is found -# to be truncated at the end. The following option controls this behavior. -# -# If aof-load-truncated is set to yes, a truncated AOF file is loaded and -# the Redis server starts emitting a log to inform the user of the event. -# Otherwise if the option is set to no, the server aborts with an error -# and refuses to start. When the option is set to no, the user requires -# to fix the AOF file using the "redis-check-aof" utility before to restart -# the server. -# -# Note that if the AOF file will be found to be corrupted in the middle -# the server will still exit with an error. This option only applies when -# Redis will try to read more data from the AOF file but not enough bytes -# will be found. -aof-load-truncated yes - -################################ LUA SCRIPTING ############################### - -# Max execution time of a Lua script in milliseconds. -# -# If the maximum execution time is reached Redis will log that a script is -# still in execution after the maximum allowed time and will start to -# reply to queries with an error. -# -# When a long running script exceeds the maximum execution time only the -# SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be -# used to stop a script that did not yet called write commands. The second -# is the only way to shut down the server in the case a write command was -# already issued by the script but the user doesn't want to wait for the natural -# termination of the script. -# -# Set it to 0 or a negative value for unlimited execution without warnings. -lua-time-limit 5000 - -################################## SLOW LOG ################################### - -# The Redis Slow Log is a system to log queries that exceeded a specified -# execution time. The execution time does not include the I/O operations -# like talking with the client, sending the reply and so forth, -# but just the time needed to actually execute the command (this is the only -# stage of command execution where the thread is blocked and can not serve -# other requests in the meantime). -# -# You can configure the slow log with two parameters: one tells Redis -# what is the execution time, in microseconds, to exceed in order for the -# command to get logged, and the other parameter is the length of the -# slow log. When a new command is logged the oldest one is removed from the -# queue of logged commands. - -# The following time is expressed in microseconds, so 1000000 is equivalent -# to one second. Note that a negative number disables the slow log, while -# a value of zero forces the logging of every command. -slowlog-log-slower-than 10000 - -# There is no limit to this length. Just be aware that it will consume memory. -# You can reclaim memory used by the slow log with SLOWLOG RESET. -slowlog-max-len 128 - -################################ LATENCY MONITOR ############################## - -# The Redis latency monitoring subsystem samples different operations -# at runtime in order to collect data related to possible sources of -# latency of a Redis instance. -# -# Via the LATENCY command this information is available to the user that can -# print graphs and obtain reports. -# -# The system only logs operations that were performed in a time equal or -# greater than the amount of milliseconds specified via the -# latency-monitor-threshold configuration directive. When its value is set -# to zero, the latency monitor is turned off. -# -# By default latency monitoring is disabled since it is mostly not needed -# if you don't have latency issues, and collecting data has a performance -# impact, that while very small, can be measured under big load. Latency -# monitoring can easily be enalbed at runtime using the command -# "CONFIG SET latency-monitor-threshold " if needed. -latency-monitor-threshold 0 - -############################# Event notification ############################## - -# Redis can notify Pub/Sub clients about events happening in the key space. -# This feature is documented at http://redis.io/topics/notifications -# -# For instance if keyspace events notification is enabled, and a client -# performs a DEL operation on key "foo" stored in the Database 0, two -# messages will be published via Pub/Sub: -# -# PUBLISH __keyspace@0__:foo del -# PUBLISH __keyevent@0__:del foo -# -# It is possible to select the events that Redis will notify among a set -# of classes. Every class is identified by a single character: -# -# K Keyspace events, published with __keyspace@__ prefix. -# E Keyevent events, published with __keyevent@__ prefix. -# g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ... -# $ String commands -# l List commands -# s Set commands -# h Hash commands -# z Sorted set commands -# x Expired events (events generated every time a key expires) -# e Evicted events (events generated when a key is evicted for maxmemory) -# A Alias for g$lshzxe, so that the "AKE" string means all the events. -# -# The "notify-keyspace-events" takes as argument a string that is composed -# of zero or multiple characters. The empty string means that notifications -# are disabled. -# -# Example: to enable list and generic events, from the point of view of the -# event name, use: -# -# notify-keyspace-events Elg -# -# Example 2: to get the stream of the expired keys subscribing to channel -# name __keyevent@0__:expired use: -# -# notify-keyspace-events Ex -# -# By default all notifications are disabled because most users don't need -# this feature and the feature has some overhead. Note that if you don't -# specify at least one of K or E, no events will be delivered. -notify-keyspace-events "" - -############################### ADVANCED CONFIG ############################### - -# Hashes are encoded using a memory efficient data structure when they have a -# small number of entries, and the biggest entry does not exceed a given -# threshold. These thresholds can be configured using the following directives. -hash-max-ziplist-entries 512 -hash-max-ziplist-value 64 - -# Similarly to hashes, small lists are also encoded in a special way in order -# to save a lot of space. The special representation is only used when -# you are under the following limits: -list-max-ziplist-entries 512 -list-max-ziplist-value 64 - -# Sets have a special encoding in just one case: when a set is composed -# of just strings that happen to be integers in radix 10 in the range -# of 64 bit signed integers. -# The following configuration setting sets the limit in the size of the -# set in order to use this special memory saving encoding. -set-max-intset-entries 512 - -# Similarly to hashes and lists, sorted sets are also specially encoded in -# order to save a lot of space. This encoding is only used when the length and -# elements of a sorted set are below the following limits: -zset-max-ziplist-entries 128 -zset-max-ziplist-value 64 - -# HyperLogLog sparse representation bytes limit. The limit includes the -# 16 bytes header. When an HyperLogLog using the sparse representation crosses -# this limit, it is converted into the dense representation. -# -# A value greater than 16000 is totally useless, since at that point the -# dense representation is more memory efficient. -# -# The suggested value is ~ 3000 in order to have the benefits of -# the space efficient encoding without slowing down too much PFADD, -# which is O(N) with the sparse encoding. The value can be raised to -# ~ 10000 when CPU is not a concern, but space is, and the data set is -# composed of many HyperLogLogs with cardinality in the 0 - 15000 range. -hll-sparse-max-bytes 3000 - -# Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in -# order to help rehashing the main Redis hash table (the one mapping top-level -# keys to values). The hash table implementation Redis uses (see dict.c) -# performs a lazy rehashing: the more operation you run into a hash table -# that is rehashing, the more rehashing "steps" are performed, so if the -# server is idle the rehashing is never complete and some more memory is used -# by the hash table. -# -# The default is to use this millisecond 10 times every second in order to -# actively rehash the main dictionaries, freeing memory when possible. -# -# If unsure: -# use "activerehashing no" if you have hard latency requirements and it is -# not a good thing in your environment that Redis can reply from time to time -# to queries with 2 milliseconds delay. -# -# use "activerehashing yes" if you don't have such hard requirements but -# want to free memory asap when possible. -activerehashing yes - -# The client output buffer limits can be used to force disconnection of clients -# that are not reading data from the server fast enough for some reason (a -# common reason is that a Pub/Sub client can't consume messages as fast as the -# publisher can produce them). -# -# The limit can be set differently for the three different classes of clients: -# -# normal -> normal clients including MONITOR clients -# slave -> slave clients -# pubsub -> clients subscribed to at least one pubsub channel or pattern -# -# The syntax of every client-output-buffer-limit directive is the following: -# -# client-output-buffer-limit -# -# A client is immediately disconnected once the hard limit is reached, or if -# the soft limit is reached and remains reached for the specified number of -# seconds (continuously). -# So for instance if the hard limit is 32 megabytes and the soft limit is -# 16 megabytes / 10 seconds, the client will get disconnected immediately -# if the size of the output buffers reach 32 megabytes, but will also get -# disconnected if the client reaches 16 megabytes and continuously overcomes -# the limit for 10 seconds. -# -# By default normal clients are not limited because they don't receive data -# without asking (in a push way), but just after a request, so only -# asynchronous clients may create a scenario where data is requested faster -# than it can read. -# -# Instead there is a default limit for pubsub and slave clients, since -# subscribers and slaves receive data in a push fashion. -# -# Both the hard or the soft limit can be disabled by setting them to zero. -client-output-buffer-limit normal 0 0 0 -client-output-buffer-limit slave 256mb 64mb 60 -client-output-buffer-limit pubsub 32mb 8mb 60 - -# Redis calls an internal function to perform many background tasks, like -# closing connections of clients in timeout, purging expired keys that are -# never requested, and so forth. -# -# Not all tasks are performed with the same frequency, but Redis checks for -# tasks to perform according to the specified "hz" value. -# -# By default "hz" is set to 10. Raising the value will use more CPU when -# Redis is idle, but at the same time will make Redis more responsive when -# there are many keys expiring at the same time, and timeouts may be -# handled with more precision. -# -# The range is between 1 and 500, however a value over 100 is usually not -# a good idea. Most users should use the default of 10 and raise this up to -# 100 only in environments where very low latency is required. -hz 10 - -# When a child rewrites the AOF file, if the following option is enabled -# the file will be fsync-ed every 32 MB of data generated. This is useful -# in order to commit the file to the disk more incrementally and avoid -# big latency spikes. -aof-rewrite-incremental-fsync yes diff --git a/release-0.19.0/examples/redis/image/run.sh b/release-0.19.0/examples/redis/image/run.sh deleted file mode 100755 index 90815a1b81f..00000000000 --- a/release-0.19.0/examples/redis/image/run.sh +++ /dev/null @@ -1,84 +0,0 @@ -#!/bin/bash - -# Copyright 2014 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -function launchmaster() { - if [[ ! -e /redis-master-data ]]; then - echo "Redis master data doesn't exist, data won't be persistent!" - mkdir /redis-master-data - fi - redis-server /redis-master/redis.conf -} - -function launchsentinel() { - while true; do - master=$(redis-cli -h ${REDIS_SENTINEL_SERVICE_HOST} -p ${REDIS_SENTINEL_SERVICE_PORT} --csv SENTINEL get-master-addr-by-name mymaster | tr ',' ' ' | cut -d' ' -f1) - if [[ -n ${master} ]]; then - master="${master//\"}" - else - master=$(hostname -i) - fi - - redis-cli -h ${master} INFO - if [[ "$?" == "0" ]]; then - break - fi - echo "Connecting to master failed. Waiting..." - sleep 10 - done - - sentinel_conf=sentinel.conf - - echo "sentinel monitor mymaster ${master} 6379 2" > ${sentinel_conf} - echo "sentinel down-after-milliseconds mymaster 60000" >> ${sentinel_conf} - echo "sentinel failover-timeout mymaster 180000" >> ${sentinel_conf} - echo "sentinel parallel-syncs mymaster 1" >> ${sentinel_conf} - - redis-sentinel ${sentinel_conf} -} - -function launchslave() { - while true; do - master=$(redis-cli -h ${REDIS_SENTINEL_SERVICE_HOST} -p ${REDIS_SENTINEL_SERVICE_PORT} --csv SENTINEL get-master-addr-by-name mymaster | tr ',' ' ' | cut -d' ' -f1) - if [[ -n ${master} ]]; then - master="${master//\"}" - else - echo "Failed to find master." - sleep 60 - exit 1 - fi - redis-cli -h ${master} INFO - if [[ "$?" == "0" ]]; then - break - fi - echo "Connecting to master failed. Waiting..." - sleep 10 - done - perl -pi -e "s/%master-ip%/${master}/" /redis-slave/redis.conf - perl -pi -e "s/%master-port%/6379/" /redis-slave/redis.conf - redis-server /redis-slave/redis.conf -} - -if [[ "${MASTER}" == "true" ]]; then - launchmaster - exit 0 -fi - -if [[ "${SENTINEL}" == "true" ]]; then - launchsentinel - exit 0 -fi - -launchslave diff --git a/release-0.19.0/examples/redis/redis-controller.yaml b/release-0.19.0/examples/redis/redis-controller.yaml deleted file mode 100644 index 03f667a9814..00000000000 --- a/release-0.19.0/examples/redis/redis-controller.yaml +++ /dev/null @@ -1,28 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - name: redis -spec: - replicas: 1 - selector: - name: redis - template: - metadata: - labels: - name: redis - spec: - containers: - - name: redis - image: kubernetes/redis:v1 - ports: - - containerPort: 6379 - resources: - limits: - cpu: "1" - volumeMounts: - - mountPath: /redis-master-data - name: data - volumes: - - name: data - emptyDir: {} - diff --git a/release-0.19.0/examples/redis/redis-master.yaml b/release-0.19.0/examples/redis/redis-master.yaml deleted file mode 100644 index 02abada976d..00000000000 --- a/release-0.19.0/examples/redis/redis-master.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - name: redis - redis-sentinel: "true" - role: master - name: redis-master -spec: - containers: - - name: master - image: kubernetes/redis:v1 - env: - - name: MASTER - value: "true" - ports: - - containerPort: 6379 - resources: - limits: - cpu: "1" - volumeMounts: - - mountPath: /redis-master-data - name: data - - name: sentinel - image: kubernetes/redis:v1 - env: - - name: SENTINEL - value: "true" - ports: - - containerPort: 26379 - volumes: - - name: data - emptyDir: {} diff --git a/release-0.19.0/examples/redis/redis-proxy.yaml b/release-0.19.0/examples/redis/redis-proxy.yaml deleted file mode 100644 index 2993a45bf10..00000000000 --- a/release-0.19.0/examples/redis/redis-proxy.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - name: redis-proxy - role: proxy - name: redis-proxy -spec: - containers: - - name: proxy - image: kubernetes/redis-proxy:v1 - ports: - - containerPort: 6379 - name: api diff --git a/release-0.19.0/examples/redis/redis-sentinel-controller.yaml b/release-0.19.0/examples/redis/redis-sentinel-controller.yaml deleted file mode 100644 index d75887736fa..00000000000 --- a/release-0.19.0/examples/redis/redis-sentinel-controller.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - name: redis-sentinel -spec: - replicas: 1 - selector: - redis-sentinel: "true" - template: - metadata: - labels: - name: redis-sentinel - redis-sentinel: "true" - role: sentinel - spec: - containers: - - name: sentinel - image: kubernetes/redis:v1 - env: - - name: SENTINEL - value: "true" - ports: - - containerPort: 26379 diff --git a/release-0.19.0/examples/redis/redis-sentinel-service.yaml b/release-0.19.0/examples/redis/redis-sentinel-service.yaml deleted file mode 100644 index 7078d182f3f..00000000000 --- a/release-0.19.0/examples/redis/redis-sentinel-service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1beta3 -kind: Service -metadata: - labels: - name: sentinel - role: service - name: redis-sentinel -spec: - ports: - - port: 26379 - targetPort: 26379 - selector: - redis-sentinel: "true" diff --git a/release-0.19.0/examples/replication.yaml b/release-0.19.0/examples/replication.yaml deleted file mode 100644 index 6692777adf3..00000000000 --- a/release-0.19.0/examples/replication.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - name: nginx - namespace: default -spec: - replicas: 3 - selector: - app: nginx - template: - metadata: - name: nginx - labels: - app: nginx - spec: - containers: - - image: nginx - imagePullPolicy: IfNotPresent - name: nginx - ports: - - containerPort: 80 - protocol: TCP - restartPolicy: Always diff --git a/release-0.19.0/examples/resourcequota/README.md b/release-0.19.0/examples/resourcequota/README.md deleted file mode 100644 index 79d4d078af8..00000000000 --- a/release-0.19.0/examples/resourcequota/README.md +++ /dev/null @@ -1,155 +0,0 @@ -Resource Quota -======================================== -This example demonstrates how resource quota and limits can be applied to a Kubernetes namespace. - -This example assumes you have a functional Kubernetes setup. - -Step 1: Create a namespace ------------------------------------------ -This example will work in a custom namespace to demonstrate the concepts involved. - -Let's create a new namespace called quota-example: - -```shell -$ kubectl create -f namespace.yaml -$ kubectl get namespaces -NAME LABELS STATUS -default Active -quota-example Active -``` - -Step 2: Apply a quota to the namespace ------------------------------------------ -By default, a pod will run with unbounded CPU and memory limits. This means that any pod in the -system will be able to consume as much CPU and memory on the node that executes the pod. - -Users may want to restrict how much of the cluster resources a given namespace may consume -across all of its pods in order to manage cluster usage. To do this, a user applies a quota to -a namespace. A quota lets the user set hard limits on the total amount of node resources (cpu, memory) -and API resources (pods, services, etc.) that a namespace may consume. - -Let's create a simple quota in our namespace: - -```shell -$ kubectl create -f quota.yaml --namespace=quota-example -``` - -Once your quota is applied to a namespace, the system will restrict any creation of content -in the namespace until the quota usage has been calculated. This should happen quickly. - -You can describe your current quota usage to see what resources are being consumed in your -namespace. - -``` -$ kubectl describe quota quota --namespace=quota-example -Name: quota -Resource Used Hard --------- ---- ---- -cpu 0m 20 -memory 0m 1Gi -persistentvolumeclaims 0m 10 -pods 0m 10 -replicationcontrollers 0m 20 -resourcequotas 1 1 -secrets 1 10 -services 0m 5 -``` - -Step 3: Applying default resource limits ------------------------------------------ -Pod authors rarely specify resource limits for their pods. - -Since we applied a quota to our project, let's see what happens when an end-user creates a pod that has unbounded -cpu and memory by creating an nginx container. - -To demonstrate, lets create a replication controller that runs nginx: - -```shell -$ kubectl run nginx --image=nginx --replicas=1 --namespace=quota-example -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -nginx nginx nginx run=nginx 1 -``` - -Now let's look at the pods that were created. - -```shell -$ kubectl get pods --namespace=quota-example -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -``` - -What happened? I have no pods! Let's describe the replication controller to get a view of what is happening. - -```shell -kubectl describe rc nginx --namespace=quota-example -Name: nginx -Image(s): nginx -Selector: run=nginx -Labels: run=nginx -Replicas: 0 current / 1 desired -Pods Status: 0 Running / 0 Waiting / 0 Succeeded / 0 Failed -Events: - FirstSeen LastSeen Count From SubobjectPath Reason Message - Mon, 01 Jun 2015 22:49:31 -0400 Mon, 01 Jun 2015 22:52:22 -0400 7 {replication-controller } failedCreate Error creating: Pod "nginx-" is forbidden: Limited to 1Gi memory, but pod has no specified memory limit -``` - -The Kubernetes API server is rejecting the replication controllers requests to create a pod because our pods -do not specify any memory usage. - -So let's set some default limits for the amount of cpu and memory a pod can consume: - -```shell -$ kubectl create -f limits.yaml --namespace=quota-example -limitranges/limits -$ kubectl describe limits limits --namespace=quota-example -Name: limits -Type Resource Min Max Default ----- -------- --- --- --- -Container cpu - - 100m -Container memory - - 512Mi -``` - -Now any time a pod is created in this namespace, if it has not specified any resource limits, the default -amount of cpu and memory per container will be applied as part of admission control. - -Now that we have applied default limits for our namespace, our replication controller should be able to -create its pods. - -```shell -$ kubectl get pods --namespace=quota-example -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -nginx-t40zm 10.0.0.2 10.245.1.3/10.245.1.3 run=nginx Running 2 minutes - nginx nginx Running 2 minutes -``` - -And if we print out our quota usage in the namespace: - -```shell -kubectl describe quota quota --namespace=quota-example -Name: quota -Resource Used Hard --------- ---- ---- -cpu 100m 20 -memory 536870912 1Gi -persistentvolumeclaims 0m 10 -pods 1 10 -replicationcontrollers 1 20 -resourcequotas 1 1 -secrets 1 10 -services 0m 5 -``` - -You can now see the pod that was created is consuming explicit amounts of resources, and the usage is being -tracked by the Kubernetes system properly. - -Summary ----------------------------- -Actions that consume node resources for cpu and memory can be subject to hard quota limits defined -by the namespace quota. - -Any action that consumes those resources can be tweaked, or can pick up namespace level defaults to -meet your end goal. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/resourcequota/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/resourcequota/README.md?pixel)]() diff --git a/release-0.19.0/examples/resourcequota/limits.yaml b/release-0.19.0/examples/resourcequota/limits.yaml deleted file mode 100644 index edba3d8318c..00000000000 --- a/release-0.19.0/examples/resourcequota/limits.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v1beta3 -kind: LimitRange -metadata: - name: limits -spec: - limits: - - default: - cpu: 100m - memory: 512Mi - type: Container diff --git a/release-0.19.0/examples/resourcequota/namespace.yaml b/release-0.19.0/examples/resourcequota/namespace.yaml deleted file mode 100644 index 93f3dfb8fc8..00000000000 --- a/release-0.19.0/examples/resourcequota/namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1beta3 -kind: Namespace -metadata: - name: quota-example diff --git a/release-0.19.0/examples/resourcequota/quota.yaml b/release-0.19.0/examples/resourcequota/quota.yaml deleted file mode 100644 index 61493a0167c..00000000000 --- a/release-0.19.0/examples/resourcequota/quota.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1beta3 -kind: ResourceQuota -metadata: - name: quota -spec: - hard: - cpu: "20" - memory: 1Gi - persistentvolumeclaims: "10" - pods: "10" - replicationcontrollers: "20" - resourcequotas: "1" - secrets: "10" - services: "5" diff --git a/release-0.19.0/examples/rethinkdb/README.md b/release-0.19.0/examples/rethinkdb/README.md deleted file mode 100644 index e760648d43e..00000000000 --- a/release-0.19.0/examples/rethinkdb/README.md +++ /dev/null @@ -1,138 +0,0 @@ -RethinkDB Cluster on Kubernetes -============================== - -Setting up a [rethinkdb](http://rethinkdb.com/) cluster on [kubernetes](http://kubernetes.io) - -**Features** - - * Auto configuration cluster by querying info from k8s - * Simple - -Quick start ------------ -**Step 0** - -change the namespace of the current context to "rethinkdb" -``` -$kubectl config view -o template --template='{{index . "current-context"}}' | xargs -I {} kubectl config set-context {} --namespace=rethinkdb -``` - -**Step 1** - -antmanler/rethinkdb will discover peer using endpoints provided by kubernetes_ro service, -so first create a service so the following pod can query its endpoint - -```shell -$kubectl create -f driver-service.yaml -``` - -check out: - -```shell -$kubectl get se -NAME LABELS SELECTOR IP(S) PORT(S) -rethinkdb-driver db=influxdb db=rethinkdb 10.0.27.114 28015/TCP -``` - -**Step 2** - -start fist server in cluster - -```shell -$kubectl create -f rc.yaml -``` - -Actually, you can start servers as many as you want at one time, just modify the `replicas` in `rc.ymal` - -check out again: - -```shell -$kubectl get po -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -rethinkdb-rc-1.16.0-6odi0 kubernetes-minion-s59e/ db=rethinkdb,role=replicas Pending 11 seconds - rethinkdb antmanler/rethinkdb:1.16.0 -``` - -**Done!** - - ---- - -Scale ------ - -You can scale up you cluster using `kubectl scale`, and new pod will join to exsits cluster automatically, for example - - -```shell -$kubectl scale rc rethinkdb-rc-1.16.0 --replicas=3 -scaled -$kubectl get po -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED MESSAGE -rethinkdb-rc-1.16.0-6odi0 10.244.3.3 kubernetes-minion-s59e/104.197.79.42 db=rethinkdb,role=replicas Running About a minute - rethinkdb antmanler/rethinkdb:1.16.0 Running About a minute -rethinkdb-rc-1.16.0-e3mxv kubernetes-minion-d7ub/ db=rethinkdb,role=replicas Pending 6 seconds - rethinkdb antmanler/rethinkdb:1.16.0 -rethinkdb-rc-1.16.0-manu6 kubernetes-minion-cybz/ db=rethinkdb,role=replicas Pending 6 seconds - rethinkdb antmanler/rethinkdb:1.16.0 -``` - -Admin ------ - -You need a separate pod (labeled as role:admin) to access Web Admin UI - -```shell -kubectl create -f admin-pod.yaml -kubectl create -f admin-service.yaml -``` - -find the service - -```shell -$kubectl get se -NAME LABELS SELECTOR IP(S) PORT(S) -rethinkdb-admin db=influxdb db=rethinkdb,role=admin 10.0.131.19 8080/TCP - 104.197.19.120 -rethinkdb-driver db=influxdb db=rethinkdb 10.0.27.114 28015/TCP -``` - -We request for an external load balancer in the [admin-service.yaml](admin-service.yaml) file: - -``` -createExternalLoadBalancer: true -``` - -The external load balancer allows us to access the service from outside via an external IP, which is 104.197.19.120 in this case. - -Note that you may need to create a firewall rule to allow the traffic, assuming you are using GCE: -``` -$ gcloud compute firewall-rules create rethinkdb --allow=tcp:8080 -``` - -Now you can open a web browser and access to *http://104.197.19.120:8080* to manage your cluster. - - - -**Why not just using pods in replicas?** - -This is because kube-proxy will act as a load balancer and send your traffic to different server, -since the ui is not stateless when playing with Web Admin UI will cause `Connection not open on server` error. - - -- - - - -**BTW** - - * All services and pods are placed under namespace `rethinkdb`. - - * `gen_pod.sh` is using to generate pod templates for my local cluster, -the generated pods which is using `nodeSelector` to force k8s to schedule containers to my designate nodes, for I need to access persistent data on my host dirs. Note that one needs to label the node before 'nodeSelector' can work, see this [tutorial](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/examples/node-selection) - - * see [antmanler/rethinkdb-k8s](https://github.com/antmanler/rethinkdb-k8s) for detail - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/rethinkdb/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/rethinkdb/README.md?pixel)]() diff --git a/release-0.19.0/examples/rethinkdb/admin-pod.yaml b/release-0.19.0/examples/rethinkdb/admin-pod.yaml deleted file mode 100644 index 87cf82c3ce5..00000000000 --- a/release-0.19.0/examples/rethinkdb/admin-pod.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - db: rethinkdb - role: admin - name: rethinkdb-admin-1.16.0 - namespace: rethinkdb -spec: - containers: - - image: antmanler/rethinkdb:1.16.0 - name: rethinkdb - ports: - - containerPort: 8080 - name: admin-port - - containerPort: 28015 - name: driver-port - - containerPort: 29015 - name: cluster-port - volumeMounts: - - mountPath: /data/rethinkdb_data - name: rethinkdb-storage - volumes: - - name: rethinkdb-storage - emptyDir: {} diff --git a/release-0.19.0/examples/rethinkdb/admin-service.yaml b/release-0.19.0/examples/rethinkdb/admin-service.yaml deleted file mode 100644 index 6820e74eab1..00000000000 --- a/release-0.19.0/examples/rethinkdb/admin-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1beta3 -kind: Service -metadata: - labels: - db: influxdb - name: rethinkdb-admin - namespace: rethinkdb -spec: - ports: - - port: 8080 - targetPort: 8080 - createExternalLoadBalancer: true - selector: - db: rethinkdb - role: admin diff --git a/release-0.19.0/examples/rethinkdb/driver-service.yaml b/release-0.19.0/examples/rethinkdb/driver-service.yaml deleted file mode 100644 index 824afac8790..00000000000 --- a/release-0.19.0/examples/rethinkdb/driver-service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1beta3 -kind: Service -metadata: - labels: - db: influxdb - name: rethinkdb-driver - namespace: rethinkdb -spec: - ports: - - port: 28015 - targetPort: 28015 - selector: - db: rethinkdb diff --git a/release-0.19.0/examples/rethinkdb/gen-pod.sh b/release-0.19.0/examples/rethinkdb/gen-pod.sh deleted file mode 100755 index 11681aaedd2..00000000000 --- a/release-0.19.0/examples/rethinkdb/gen-pod.sh +++ /dev/null @@ -1,73 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -set -o errexit -set -o nounset -set -o pipefail - -: ${VERSION:=1.16.0} - -readonly NAME=${1-} -if [[ -z "${NAME}" ]]; then - echo -e "\033[1;31mName must be specified\033[0m" - exit 1 -fi - -ADMIN="" -if [[ ${NAME} == "admin" ]]; then - ADMIN="role: admin" -fi - -NODE="" -# One needs to label a node with the same key/value pair, -# i.e., 'kubectl label nodes name=${2}' -if [[ ! -z "${2-}" ]]; then - NODE="nodeSelector: { name: ${2} }" -fi - -cat << EOF -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - ${ADMIN} - db: rethinkdb - name: rethinkdb-${NAME}-${VERSION} - namespace: rethinkdb -spec: - containers: - - image: antmanler/rethinkdb:${VERSION} - name: rethinkdb - ports: - - containerPort: 8080 - name: admin-port - protocol: TCP - - containerPort: 28015 - name: driver-port - protocol: TCP - - containerPort: 29015 - name: cluster-port - protocol: TCP - volumeMounts: - - mountPath: /data/rethinkdb_data - name: rethinkdb-storage - ${NODE} - restartPolicy: Always - volumes: - - hostPath: - path: /data/db/rethinkdb - name: rethinkdb-storage -EOF diff --git a/release-0.19.0/examples/rethinkdb/image/Dockerfile b/release-0.19.0/examples/rethinkdb/image/Dockerfile deleted file mode 100644 index e4a14508ac6..00000000000 --- a/release-0.19.0/examples/rethinkdb/image/Dockerfile +++ /dev/null @@ -1,14 +0,0 @@ -FROM rethinkdb:1.16.0 - -MAINTAINER BinZhao - -RUN apt-get update && \ - apt-get install -yq curl && \ - rm -rf /var/cache/apt/* && rm -rf /var/lib/apt/lists/* && \ - curl -L http://stedolan.github.io/jq/download/linux64/jq > /usr/bin/jq && \ - chmod u+x /usr/bin/jq - -COPY ./run.sh /usr/bin/run.sh -RUN chmod u+x /usr/bin/run.sh - -CMD ["/usr/bin/run.sh"] diff --git a/release-0.19.0/examples/rethinkdb/image/run.sh b/release-0.19.0/examples/rethinkdb/image/run.sh deleted file mode 100644 index 34574924481..00000000000 --- a/release-0.19.0/examples/rethinkdb/image/run.sh +++ /dev/null @@ -1,37 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -set -o pipefail - -IP="" -if [[ -n "${KUBERNETES_RO_SERVICE_HOST}" ]]; then - - : ${NAMESPACE:=rethinkdb} - # try to pick up first different ip from endpoints - MYHOST=$(ip addr | grep 'state UP' -A2 | tail -n1 | awk '{print $2}' | cut -f1 -d'/') - URL="${KUBERNETES_RO_SERVICE_HOST}/api/v1beta3/namespaces/${NAMESPACE}/endpoints/rethinkdb-driver" - IP=$(curl -s ${URL} | jq -s -r --arg h "${MYHOST}" '.[0].subsets | .[].addresses | [ .[].IP ] | map(select(. != $h)) | .[0]') || exit 1 - [[ "${IP}" == null ]] && IP="" -fi - -if [[ -n "${IP}" ]]; then - ENDPOINT="${IP}:29015" - echo "Join to ${ENDPOINT}" - exec rethinkdb --bind all --join ${ENDPOINT} -else - echo "Start single instance" - exec rethinkdb --bind all -fi diff --git a/release-0.19.0/examples/rethinkdb/rc.yaml b/release-0.19.0/examples/rethinkdb/rc.yaml deleted file mode 100644 index 558a7c86ad8..00000000000 --- a/release-0.19.0/examples/rethinkdb/rc.yaml +++ /dev/null @@ -1,34 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - labels: - db: rethinkdb - name: rethinkdb-rc-1.16.0 - namespace: rethinkdb -spec: - replicas: 1 - selector: - db: rethinkdb - role: replicas - template: - metadata: - labels: - db: rethinkdb - role: replicas - spec: - containers: - - image: antmanler/rethinkdb:1.16.0 - name: rethinkdb - ports: - - containerPort: 8080 - name: admin-port - - containerPort: 28015 - name: driver-port - - containerPort: 29015 - name: cluster-port - volumeMounts: - - mountPath: /data/rethinkdb_data - name: rethinkdb-storage - volumes: - - name: rethinkdb-storage - emptyDir: {} diff --git a/release-0.19.0/examples/secrets/README.md b/release-0.19.0/examples/secrets/README.md deleted file mode 100644 index 6ff0189821f..00000000000 --- a/release-0.19.0/examples/secrets/README.md +++ /dev/null @@ -1,52 +0,0 @@ -# Secrets example - -Following this example, you will create a secret and a pod that consumes that secret in a volume. - -## Step Zero: Prerequisites - -This example assumes you have a Kubernetes cluster installed and running, and that you have -installed the ```kubectl``` command line tool somewhere in your path. Please see the [getting -started](../../docs/getting-started-guides) for installation instructions for your platform. - -## Step One: Create the secret - -A secret contains a set of named byte arrays. - -Use the [`examples/secrets/secret.yaml`](secret.yaml) file to create a secret: - -```shell -$ kubectl create -f examples/secrets/secret.yaml -``` - -You can use `kubectl` to see information about the secret: - -```shell -$ kubectl get secrets -NAME TYPE DATA -test-secret Opaque 2 -``` - -## Step Two: Create a pod that consumes a secret - -Pods consume secrets in volumes. Now that you have created a secret, you can create a pod that -consumes it. - -Use the [`examples/secrets/secret-pod.yaml`](secret-pod.yaml) file to create a Pod that consumes the secret. - -```shell -$ kubectl create -f examples/secrets/secret-pod.yaml -``` - -This pod runs a binary that displays the content of one of the pieces of secret data in the secret -volume: - -```shell -$ kubectl log secret-test-pod -2015-04-29T21:17:24.712206409Z content of file "/etc/secret-volume/data-1": value-1 -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/secrets/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/secrets/README.md?pixel)]() diff --git a/release-0.19.0/examples/secrets/secret-pod.yaml b/release-0.19.0/examples/secrets/secret-pod.yaml deleted file mode 100644 index be401018990..00000000000 --- a/release-0.19.0/examples/secrets/secret-pod.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - name: secret-test-pod -spec: - containers: - - name: test-container - image: kubernetes/mounttest:0.1 - command: [ "/mt", "--file_content=/etc/secret-volume/data-1" ] - volumeMounts: - # name must match the volume name below - - name: secret-volume - mountPath: /etc/secret-volume - volumes: - - name: secret-volume - secret: - secretName: test-secret - restartPolicy: Never diff --git a/release-0.19.0/examples/secrets/secret.yaml b/release-0.19.0/examples/secrets/secret.yaml deleted file mode 100644 index 463094a6922..00000000000 --- a/release-0.19.0/examples/secrets/secret.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1beta3 -kind: Secret -metadata: - name: test-secret -data: - data-1: dmFsdWUtMQ0K - data-2: dmFsdWUtMg0KDQo= diff --git a/release-0.19.0/examples/simple-nginx.md b/release-0.19.0/examples/simple-nginx.md deleted file mode 100644 index 29f291bc930..00000000000 --- a/release-0.19.0/examples/simple-nginx.md +++ /dev/null @@ -1,50 +0,0 @@ -## Running your first containers in Kubernetes - -Ok, you've run one of the [getting started guides](../docs/getting-started-guides/) and you have -successfully turned up a Kubernetes cluster. Now what? This guide will help you get oriented -to Kubernetes and running your first containers on the cluster. - -### Running a container (simple version) - -From this point onwards, it is assumed that `kubectl` is on your path from one of the getting started guides. - -The [`kubectl run`](/docs/kubectl_run.md) line below will create two [nginx](https://registry.hub.docker.com/_/nginx/) [pods](/docs/pods.md) listening on port 80. It will also create a [replication controller](/docs/replication-controller.md) named `my-nginx` to ensure that there are always two pods running. - -```bash -kubectl run my-nginx --image=nginx --replicas=2 --port=80 -``` - -Once the pods are created, you can list them to see what is up and running: -```bash -kubectl get pods -``` - -You can also see the replication controller that was created: -```bash -kubectl get rc -``` - -To stop the two replicated containers, stop the replication controller: -```bash -kubectl stop rc my-nginx -``` - -### Exposing your pods to the internet. -On some platforms (for example Google Compute Engine) the kubectl command can integrate with your cloud provider to add a [public IP address](/docs/services.md#external-services) for the pods, -to do this run: - -```bash -kubectl expose rc my-nginx --port=80 --type=LoadBalancer -``` - -This should print the service that has been created, and map an external IP address to the service. - -### Next: Configuration files -Most people will eventually want to use declarative configuration files for creating/modifying their applications. A [simplified introduction](simple-yaml.md) -is given in a different document. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/simple-nginx.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/simple-nginx.md?pixel)]() diff --git a/release-0.19.0/examples/simple-yaml.md b/release-0.19.0/examples/simple-yaml.md deleted file mode 100644 index 5817d50d9c2..00000000000 --- a/release-0.19.0/examples/simple-yaml.md +++ /dev/null @@ -1,95 +0,0 @@ -## Getting started with config files. - -In addition to the imperative style commands described [elsewhere](simple-nginx.md), Kubernetes -supports declarative YAML or JSON configuration files. Often times config files are preferable -to imperative commands, since they can be checked into version control and changes to the files -can be code reviewed, producing a more robust, reliable and archival system. - -### Running a container from a pod configuration file - -```bash -cd kubernetes -kubectl create -f pod.yaml -``` - -Where pod.yaml contains something like: - -```yaml -apiVersion: v1beta3 -kind: Pod -metadata: - labels: - app: nginx - name: nginx - namespace: default -spec: - containers: - - image: nginx - imagePullPolicy: IfNotPresent - name: nginx - ports: - - containerPort: 80 - protocol: TCP - restartPolicy: Always -``` - -You can see your cluster's pods: - -```bash -kubectl get pods -``` - -and delete the pod you just created: - -```bash -kubectl delete pods nginx -``` - -### Running a replicated set of containers from a configuration file -To run replicated containers, you need a [Replication Controller](../docs/replication-controller.md). -A replication controller is responsible for ensuring that a specific number of pods exist in the -cluster. - -```bash -cd kubernetes -kubectl create -f replication.yaml -``` - -Where ```replication.yaml``` contains: - -```yaml -apiVersion: v1beta3 -kind: ReplicationController -metadata: - name: nginx - namespace: default -spec: - replicas: 3 - selector: - app: nginx - template: - metadata: - name: nginx - labels: - app: nginx - spec: - containers: - - image: nginx - imagePullPolicy: IfNotPresent - name: nginx - ports: - - containerPort: 80 - protocol: TCP - restartPolicy: Always -``` - -To delete the replication controller (and the pods it created): -```bash -kubectl delete rc nginx -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/simple-yaml.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/simple-yaml.md?pixel)]() diff --git a/release-0.19.0/examples/spark/README.md b/release-0.19.0/examples/spark/README.md deleted file mode 100644 index 7a28bdf4e93..00000000000 --- a/release-0.19.0/examples/spark/README.md +++ /dev/null @@ -1,177 +0,0 @@ -# Spark example - -Following this example, you will create a functional [Apache -Spark](http://spark.apache.org/) cluster using Kubernetes and -[Docker](http://docker.io). - -You will setup a Spark master service and a set of -Spark workers using Spark's [standalone mode](http://spark.apache.org/docs/latest/spark-standalone.html). - -For the impatient expert, jump straight to the [tl;dr](#tldr) -section. - -### Sources - -Source is freely available at: -* Docker image - https://github.com/mattf/docker-spark -* Docker Trusted Build - https://registry.hub.docker.com/search?q=mattf/spark - -## Step Zero: Prerequisites - -This example assumes you have a Kubernetes cluster installed and -running, and that you have installed the ```kubectl``` command line -tool somewhere in your path. Please see the [getting -started](../../docs/getting-started-guides) for installation -instructions for your platform. - -## Step One: Start your Master service - -The Master [service](../../docs/services.md) is the master (or head) service for a Spark -cluster. - -Use the [`examples/spark/spark-master.json`](spark-master.json) file to create a [pod](../../docs/pods.md) running -the Master service. - -```shell -$ kubectl create -f examples/spark/spark-master.json -``` - -Then, use the `examples/spark/spark-master-service.json` file to -create a logical service endpoint that Spark workers can use to access -the Master pod. - -```shell -$ kubectl create -f examples/spark/spark-master-service.json -``` - -Ensure that the Master service is running and functional. - -### Check to see if Master is running and accessible - -```shell -$ kubectl get pods,services -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -spark-master 192.168.90.14 spark-master mattf/spark-master 172.18.145.8/172.18.145.8 name=spark-master Running -NAME LABELS SELECTOR IP PORT -kubernetes component=apiserver,provider=kubernetes 10.254.0.2 443 -spark-master name=spark-master name=spark-master 10.254.125.166 7077 -``` - -Connect to http://192.168.90.14:8080 to see the status of the master. - -```shell -$ links -dump 192.168.90.14:8080 - [IMG] 1.2.1 Spark Master at spark://spark-master:7077 - - * URL: spark://spark-master:7077 - * Workers: 0 - * Cores: 0 Total, 0 Used - * Memory: 0.0 B Total, 0.0 B Used - * Applications: 0 Running, 0 Completed - * Drivers: 0 Running, 0 Completed - * Status: ALIVE -... -``` - -(Pull requests welcome for an alternative that uses the service IP and -port) - -## Step Two: Start your Spark workers - -The Spark workers do the heavy lifting in a Spark cluster. They -provide execution resources and data cache capabilities for your -program. - -The Spark workers need the Master service to be running. - -Use the [`examples/spark/spark-worker-controller.json`](spark-worker-controller.json) file to create a -[replication controller](../../docs/replication-controller.md) that manages the worker pods. - -```shell -$ kubectl create -f examples/spark/spark-worker-controller.json -``` - -### Check to see if the workers are running - -```shell -$ links -dump 192.168.90.14:8080 - [IMG] 1.2.1 Spark Master at spark://spark-master:7077 - - * URL: spark://spark-master:7077 - * Workers: 3 - * Cores: 12 Total, 0 Used - * Memory: 20.4 GB Total, 0.0 B Used - * Applications: 0 Running, 0 Completed - * Drivers: 0 Running, 0 Completed - * Status: ALIVE - - Workers - -Id Address State Cores Memory - 4 (0 6.8 GB -worker-20150318151745-192.168.75.14-46422 192.168.75.14:46422 ALIVE Used) (0.0 B - Used) - 4 (0 6.8 GB -worker-20150318151746-192.168.35.17-53654 192.168.35.17:53654 ALIVE Used) (0.0 B - Used) - 4 (0 6.8 GB -worker-20150318151746-192.168.90.17-50490 192.168.90.17:50490 ALIVE Used) (0.0 B - Used) -... -``` - -(Pull requests welcome for an alternative that uses the service IP and -port) - -## Step Three: Do something with the cluster - -```shell -$ kubectl get pods,services -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -spark-master 192.168.90.14 spark-master mattf/spark-master 172.18.145.8/172.18.145.8 name=spark-master Running -spark-worker-controller-51wgg 192.168.75.14 spark-worker mattf/spark-worker 172.18.145.9/172.18.145.9 name=spark-worker,uses=spark-master Running -spark-worker-controller-5v48c 192.168.90.17 spark-worker mattf/spark-worker 172.18.145.8/172.18.145.8 name=spark-worker,uses=spark-master Running -spark-worker-controller-ehq23 192.168.35.17 spark-worker mattf/spark-worker 172.18.145.12/172.18.145.12 name=spark-worker,uses=spark-master Running -NAME LABELS SELECTOR IP PORT -kubernetes component=apiserver,provider=kubernetes 10.254.0.2 443 -spark-master name=spark-master name=spark-master 10.254.125.166 7077 - -$ sudo docker run -it mattf/spark-base sh - -sh-4.2# echo "10.254.125.166 spark-master" >> /etc/hosts - -sh-4.2# export SPARK_LOCAL_HOSTNAME=$(hostname -i) - -sh-4.2# MASTER=spark://spark-master:7077 pyspark -Python 2.7.5 (default, Jun 17 2014, 18:11:42) -[GCC 4.8.2 20140120 (Red Hat 4.8.2-16)] on linux2 -Type "help", "copyright", "credits" or "license" for more information. -Welcome to - ____ __ - / __/__ ___ _____/ /__ - _\ \/ _ \/ _ `/ __/ '_/ - /__ / .__/\_,_/_/ /_/\_\ version 1.2.1 - /_/ - -Using Python version 2.7.5 (default, Jun 17 2014 18:11:42) -SparkContext available as sc. ->>> import socket, resource ->>> sc.parallelize(range(1000)).map(lambda x: (socket.gethostname(), resource.getrlimit(resource.RLIMIT_NOFILE))).distinct().collect() -[('spark-worker-controller-ehq23', (1048576, 1048576)), ('spark-worker-controller-5v48c', (1048576, 1048576)), ('spark-worker-controller-51wgg', (1048576, 1048576))] -``` - -## tl;dr - -```kubectl create -f spark-master.json``` - -```kubectl create -f spark-master-service.json``` - -Make sure the Master Pod is running (use: ```kubectl get pods```). - -```kubectl create -f spark-worker-controller.json``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/spark/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/spark/README.md?pixel)]() diff --git a/release-0.19.0/examples/spark/spark-master-service.json b/release-0.19.0/examples/spark/spark-master-service.json deleted file mode 100644 index 28e3e8b3881..00000000000 --- a/release-0.19.0/examples/spark/spark-master-service.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "spark-master", - "labels": { - "name": "spark-master" - } - }, - "spec": { - "ports": [ - { - "port": 7077, - "targetPort": 7077 - } - ], - "selector": { - "name": "spark-master" - } - } -} \ No newline at end of file diff --git a/release-0.19.0/examples/spark/spark-master.json b/release-0.19.0/examples/spark/spark-master.json deleted file mode 100644 index 34373f6c674..00000000000 --- a/release-0.19.0/examples/spark/spark-master.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "kind": "Pod", - "apiVersion": "v1beta3", - "metadata": { - "name": "spark-master", - "labels": { - "name": "spark-master" - } - }, - "spec": { - "containers": [ - { - "name": "spark-master", - "image": "mattf/spark-master", - "ports": [ - { - "containerPort": 7077 - } - ], - "resources": { - "limits": { - "cpu": "100m" - } - } - } - ] - } -} \ No newline at end of file diff --git a/release-0.19.0/examples/spark/spark-worker-controller.json b/release-0.19.0/examples/spark/spark-worker-controller.json deleted file mode 100644 index 44eb4882dcc..00000000000 --- a/release-0.19.0/examples/spark/spark-worker-controller.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "kind": "ReplicationController", - "apiVersion": "v1beta3", - "metadata": { - "name": "spark-worker-controller", - "labels": { - "name": "spark-worker" - } - }, - "spec": { - "replicas": 3, - "selector": { - "name": "spark-worker" - }, - "template": { - "metadata": { - "labels": { - "name": "spark-worker", - "uses": "spark-master" - } - }, - "spec": { - "containers": [ - { - "name": "spark-worker", - "image": "mattf/spark-worker", - "ports": [ - { - "hostPort": 8888, - "containerPort": 8888 - } - ], - "resources": { - "limits": { - "cpu": "100m" - } - } - } - ] - } - } - } -} \ No newline at end of file diff --git a/release-0.19.0/examples/storm/README.md b/release-0.19.0/examples/storm/README.md deleted file mode 100644 index 2972dba7668..00000000000 --- a/release-0.19.0/examples/storm/README.md +++ /dev/null @@ -1,174 +0,0 @@ -# Storm example - -Following this example, you will create a functional [Apache -Storm](http://storm.apache.org/) cluster using Kubernetes and -[Docker](http://docker.io). - -You will setup an [Apache ZooKeeper](http://zookeeper.apache.org/) -service, a Storm master service (a.k.a. Nimbus server), and a set of -Storm workers (a.k.a. supervisors). - -For the impatient expert, jump straight to the [tl;dr](#tldr) -section. - -### Sources - -Source is freely available at: -* Docker image - https://github.com/mattf/docker-storm -* Docker Trusted Build - https://registry.hub.docker.com/search?q=mattf/storm - -## Step Zero: Prerequisites - -This example assumes you have a Kubernetes cluster installed and -running, and that you have installed the ```kubectl``` command line -tool somewhere in your path. Please see the [getting -started](../../docs/getting-started-guides) for installation -instructions for your platform. - -## Step One: Start your ZooKeeper service - -ZooKeeper is a distributed coordination [service](../../docs/services.md) that Storm uses as a -bootstrap and for state storage. - -Use the [`examples/storm/zookeeper.json`](zookeeper.json) file to create a [pod](../../docs/pods.md) running -the ZooKeeper service. - -```shell -$ kubectl create -f examples/storm/zookeeper.json -``` - -Then, use the [`examples/storm/zookeeper-service.json`](zookeeper-service.json) file to create a -logical service endpoint that Storm can use to access the ZooKeeper -pod. - -```shell -$ kubectl create -f examples/storm/zookeeper-service.json -``` - -You should make sure the ZooKeeper pod is Running and accessible -before proceeding. - -### Check to see if ZooKeeper is running - -```shell -$ kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -zookeeper 192.168.86.4 zookeeper mattf/zookeeper 172.18.145.8/172.18.145.8 name=zookeeper Running -``` - -### Check to see if ZooKeeper is accessible - -```shell -$ kubectl get services -NAME LABELS SELECTOR IP PORT -kubernetes component=apiserver,provider=kubernetes 10.254.0.2 443 -zookeeper name=zookeeper name=zookeeper 10.254.139.141 2181 - -$ echo ruok | nc 10.254.139.141 2181; echo -imok -``` - -## Step Two: Start your Nimbus service - -The Nimbus service is the master (or head) service for a Storm -cluster. It depends on a functional ZooKeeper service. - -Use the [`examples/storm/storm-nimbus.json`](storm-nimbus.json) file to create a pod running -the Nimbus service. - -```shell -$ kubectl create -f examples/storm/storm-nimbus.json -``` - -Then, use the [`examples/storm/storm-nimbus-service.json`](storm-nimbus-service.json) file to -create a logical service endpoint that Storm workers can use to access -the Nimbus pod. - -```shell -$ kubectl create -f examples/storm/storm-nimbus-service.json -``` - -Ensure that the Nimbus service is running and functional. - -### Check to see if Nimbus is running and accessible - -```shell -$ kubectl get services -NAME LABELS SELECTOR IP PORT -kubernetes component=apiserver,provider=kubernetes 10.254.0.2 443 -zookeeper name=zookeeper name=zookeeper 10.254.139.141 2181 -nimbus name=nimbus name=nimbus 10.254.115.208 6627 - -$ sudo docker run -it -w /opt/apache-storm mattf/storm-base sh -c '/configure.sh 10.254.139.141 10.254.115.208; ./bin/storm list' -... -No topologies running. -``` - -## Step Three: Start your Storm workers - -The Storm workers (or supervisors) do the heavy lifting in a Storm -cluster. They run your stream processing topologies and are managed by -the Nimbus service. - -The Storm workers need both the ZooKeeper and Nimbus services to be -running. - -Use the [`examples/storm/storm-worker-controller.json`](storm-worker-controller.json) file to create a -[replication controller](../../docs/replication-controller.md) that manages the worker pods. - -```shell -$ kubectl create -f examples/storm/storm-worker-controller.json -``` - -### Check to see if the workers are running - -One way to check on the workers is to get information from the -ZooKeeper service about how many clients it has. - -```shell -$ echo stat | nc 10.254.139.141 2181; echo -Zookeeper version: 3.4.6--1, built on 10/23/2014 14:18 GMT -Clients: - /192.168.48.0:44187[0](queued=0,recved=1,sent=0) - /192.168.45.0:39568[1](queued=0,recved=14072,sent=14072) - /192.168.86.1:57591[1](queued=0,recved=34,sent=34) - /192.168.8.0:50375[1](queued=0,recved=34,sent=34) - /192.168.45.0:39576[1](queued=0,recved=34,sent=34) - -Latency min/avg/max: 0/2/2570 -Received: 23199 -Sent: 23198 -Connections: 5 -Outstanding: 0 -Zxid: 0xa39 -Mode: standalone -Node count: 13 -``` - -There should be one client from the Nimbus service and one per -worker. Ideally, you should get ```stat``` output from ZooKeeper -before and after creating the replication controller. - -(Pull requests welcome for alternative ways to validate the workers) - -## tl;dr - -```kubectl create -f zookeeper.json``` - -```kubectl create -f zookeeper-service.json``` - -Make sure the ZooKeeper Pod is running (use: ```kubectl get pods```). - -```kubectl create -f storm-nimbus.json``` - -```kubectl create -f storm-nimbus-service.json``` - -Make sure the Nimbus Pod is running. - -```kubectl create -f storm-worker-controller.json``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/storm/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/storm/README.md?pixel)]() diff --git a/release-0.19.0/examples/storm/storm-nimbus-service.json b/release-0.19.0/examples/storm/storm-nimbus-service.json deleted file mode 100644 index e593c10384a..00000000000 --- a/release-0.19.0/examples/storm/storm-nimbus-service.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "nimbus", - "labels": { - "name": "nimbus" - } - }, - "spec": { - "ports": [ - { - "port": 6627, - "targetPort": 6627 - } - ], - "selector": { - "name": "nimbus" - } - } -} \ No newline at end of file diff --git a/release-0.19.0/examples/storm/storm-nimbus.json b/release-0.19.0/examples/storm/storm-nimbus.json deleted file mode 100644 index dd303dc376b..00000000000 --- a/release-0.19.0/examples/storm/storm-nimbus.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "kind": "Pod", - "apiVersion": "v1beta3", - "metadata": { - "name": "nimbus", - "labels": { - "name": "nimbus" - } - }, - "spec": { - "containers": [ - { - "name": "nimbus", - "image": "mattf/storm-nimbus", - "ports": [ - { - "containerPort": 6627 - } - ], - "resources": { - "limits": { - "cpu": "100m" - } - } - } - ] - } -} \ No newline at end of file diff --git a/release-0.19.0/examples/storm/storm-worker-controller.json b/release-0.19.0/examples/storm/storm-worker-controller.json deleted file mode 100644 index 0ab315eccec..00000000000 --- a/release-0.19.0/examples/storm/storm-worker-controller.json +++ /dev/null @@ -1,55 +0,0 @@ -{ - "kind": "ReplicationController", - "apiVersion": "v1beta3", - "metadata": { - "name": "storm-worker-controller", - "labels": { - "name": "storm-worker" - } - }, - "spec": { - "replicas": 3, - "selector": { - "name": "storm-worker" - }, - "template": { - "metadata": { - "labels": { - "name": "storm-worker", - "uses": "nimbus" - } - }, - "spec": { - "containers": [ - { - "name": "storm-worker", - "image": "mattf/storm-worker", - "ports": [ - { - "hostPort": 6700, - "containerPort": 6700 - }, - { - "hostPort": 6701, - "containerPort": 6701 - }, - { - "hostPort": 6702, - "containerPort": 6702 - }, - { - "hostPort": 6703, - "containerPort": 6703 - } - ], - "resources": { - "limits": { - "cpu": "200m" - } - } - } - ] - } - } - } -} \ No newline at end of file diff --git a/release-0.19.0/examples/storm/zookeeper-service.json b/release-0.19.0/examples/storm/zookeeper-service.json deleted file mode 100644 index a4166b24a25..00000000000 --- a/release-0.19.0/examples/storm/zookeeper-service.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "kind": "Service", - "apiVersion": "v1beta3", - "metadata": { - "name": "zookeeper", - "labels": { - "name": "zookeeper" - } - }, - "spec": { - "ports": [ - { - "port": 2181, - "targetPort": 2181 - } - ], - "selector": { - "name": "zookeeper" - } - } -} \ No newline at end of file diff --git a/release-0.19.0/examples/storm/zookeeper.json b/release-0.19.0/examples/storm/zookeeper.json deleted file mode 100644 index c2b6dcb531b..00000000000 --- a/release-0.19.0/examples/storm/zookeeper.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "kind": "Pod", - "apiVersion": "v1beta3", - "metadata": { - "name": "zookeeper", - "labels": { - "name": "zookeeper" - } - }, - "spec": { - "containers": [ - { - "name": "zookeeper", - "image": "mattf/zookeeper", - "ports": [ - { - "containerPort": 2181 - } - ], - "resources": { - "limits": { - "cpu": "100m" - } - } - } - ] - } -} \ No newline at end of file diff --git a/release-0.19.0/examples/update-demo/README.md b/release-0.19.0/examples/update-demo/README.md deleted file mode 100644 index 65fbd16c9a2..00000000000 --- a/release-0.19.0/examples/update-demo/README.md +++ /dev/null @@ -1,121 +0,0 @@ - -# Live update example -This example demonstrates the usage of Kubernetes to perform a live update on a running group of [pods](../../docs/pods.md). - -### Step Zero: Prerequisites - -This example assumes that you have forked the repository and [turned up a Kubernetes cluster](../../docs/getting-started-guides): - -```bash -$ cd kubernetes -$ ./cluster/kube-up.sh -``` - -### Step One: Turn up the UX for the demo - -You can use bash job control to run this in the background (note that you must use the default port -- 8001 -- for the following demonstration to work properly). This can sometimes spew to the output so you could also run it in a different terminal. - -``` -$ ./kubectl proxy --www=examples/update-demo/local/ & -+ ./kubectl proxy --www=examples/update-demo/local/ -I0218 15:18:31.623279 67480 proxy.go:36] Starting to serve on localhost:8001 -``` - -Now visit the the [demo website](http://localhost:8001/static). You won't see anything much quite yet. - -### Step Two: Run the controller -Now we will turn up two replicas of an image. They all serve on internal port 80. - -```bash -$ ./kubectl create -f examples/update-demo/nautilus-rc.yaml -``` - -After pulling the image from the Docker Hub to your worker nodes (which may take a minute or so) you'll see a couple of squares in the UI detailing the pods that are running along with the image that they are serving up. A cute little nautilus. - -### Step Three: Try scaling the controller - -Now we will increase the number of replicas from two to four: - -```bash -$ ./kubectl scale rc update-demo-nautilus --replicas=4 -``` - -If you go back to the [demo website](http://localhost:8001/static/index.html) you should eventually see four boxes, one for each pod. - -### Step Four: Update the docker image -We will now update the docker image to serve a different image by doing a rolling update to a new Docker image. - -```bash -$ ./kubectl rolling-update update-demo-nautilus --update-period=10s -f examples/update-demo/kitten-rc.yaml -``` -The rolling-update command in kubectl will do 2 things: - -1. Create a new [replication controller](../../docs/replication-controller.md) with a pod template that uses the new image (`gcr.io/google_containers/update-demo:kitten`) -2. Scale the old and new replication controllers until the new controller replaces the old. This will kill the current pods one at a time, spinnning up new ones to replace them. - -Watch the [demo website](http://localhost:8001/static/index.html), it will update one pod every 10 seconds until all of the pods have the new image. - -### Step Five: Bring down the pods - -```bash -$ ./kubectl stop rc update-demo-kitten -``` - -This will first 'stop' the replication controller by turning the target number of replicas to 0. It'll then delete that controller. - -### Step Six: Cleanup - -To turn down a Kubernetes cluster: - -```bash -$ ./cluster/kube-down.sh -``` - -Kill the proxy running in the background: -After you are done running this demo make sure to kill it: - -```bash -$ jobs -[1]+ Running ./kubectl proxy --www=local/ & -$ kill %1 -[1]+ Terminated: 15 ./kubectl proxy --www=local/ -``` - -### Updating the Docker images - -If you want to build your own docker images, you can set `$DOCKER_HUB_USER` to your Docker user id and run the included shell script. It can take a few minutes to download/upload stuff. - -```bash -$ export DOCKER_HUB_USER=my-docker-id -$ ./examples/update-demo/build-images.sh -``` - -To use your custom docker image in the above examples, you will need to change the image name in `examples/update-demo/nautilus-rc.yaml` and `examples/update-demo/kitten-rc.yaml`. - -### Image Copyright - -Note that the images included here are public domain. - -* [kitten](http://commons.wikimedia.org/wiki/File:Kitten-stare.jpg) -* [nautilus](http://commons.wikimedia.org/wiki/File:Nautilus_pompilius.jpg) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/update-demo/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/update-demo/README.md?pixel)]() diff --git a/release-0.19.0/examples/update-demo/build-images.sh b/release-0.19.0/examples/update-demo/build-images.sh deleted file mode 100755 index 63c0fe92984..00000000000 --- a/release-0.19.0/examples/update-demo/build-images.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash - -# Copyright 2014 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# This script will build and push the images necessary for the demo. - -set -o errexit -set -o nounset -set -o pipefail - -DOCKER_HUB_USER=${DOCKER_HUB_USER:-kubernetes} - -set -x - -docker build -t "${DOCKER_HUB_USER}/update-demo:kitten" images/kitten -docker build -t "${DOCKER_HUB_USER}/update-demo:nautilus" images/nautilus - -docker push "${DOCKER_HUB_USER}/update-demo" diff --git a/release-0.19.0/examples/update-demo/images/kitten/Dockerfile b/release-0.19.0/examples/update-demo/images/kitten/Dockerfile deleted file mode 100644 index b053138b352..00000000000 --- a/release-0.19.0/examples/update-demo/images/kitten/Dockerfile +++ /dev/null @@ -1,17 +0,0 @@ -# Copyright 2014 Google Inc. All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -FROM kubernetes/test-webserver -COPY html/kitten.jpg kitten.jpg -COPY html/data.json data.json diff --git a/release-0.19.0/examples/update-demo/images/kitten/html/data.json b/release-0.19.0/examples/update-demo/images/kitten/html/data.json deleted file mode 100644 index 0be61a42b30..00000000000 --- a/release-0.19.0/examples/update-demo/images/kitten/html/data.json +++ /dev/null @@ -1,3 +0,0 @@ -{ - "image": "kitten.jpg" -} diff --git a/release-0.19.0/examples/update-demo/images/kitten/html/kitten.jpg b/release-0.19.0/examples/update-demo/images/kitten/html/kitten.jpg deleted file mode 100644 index a382bf16aceb05d0c084a32815dcea80aaf02d4b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 14769 zcmeHucU)6Tx9AQ5LJ3_g6paB?loon#p^6C7L{u<@0FjV{G(bfV1yn=?Y!pEOD^03m z0YL$kBPvabh+;vifCx&<-8&TZeCK}mz3=_rU)KqH_N+2%)>?aJvS($%Zezbgp0W%f z`T~HxJ+Kh~06qW-0{}SKf`NCa;2$=;GbX zhvH2@Ir>u=6uLi!io#-1>S`EG)CPMTo=Ap}iU5SrSJTy3S3{}k>1*ofYv}+0_bC8C zfU>#O)YUN;7i?s+0pKFn(zres;Xm6TFI0G8@CDs@f3*)r`)MC+->>#@!4_q}BDt1i z3xd5l#RjY)8##A&8+!;qa%}R#+5=qdVL+Gz0X`8BAG;Gc0wDSL`1tvd{QO8UK><54t zAK(M{z+q^BOAH1VgR#3nBN6OJFcVNq9vG*93PS}B&KhnWUIZV%fFSJeL>RyYUnGhG zFm4!}i<^rF!OO=3M{0mXF*x^HaSV^yHk<@H=#V<^vV=>8=5q3qPF3C-nzYE5ScF2N z^T@kVJY8#fX3^nw7D+BXmepAd?G=r#J%q91BM+OH@4s5DKb;*_a^_LK%;j!p<(9xaXvYcb;7pawx`2_E%B z3Ckc2s+?YqXvllNqeUiSoh9*f%~1tjNCCt;t?EWliL4bqmaf_iLeG*4|Gft5f2zRl z0FZFbm|}nlFhmi`xkhl?#rwYBY|in_W%}e>t%s+iwq_M6d=Dve58Q8hGtM(KB4=kp zQ$@qXd!wQ!5zoxe+t|fmFK-w$&W}Zwh`r{DNs!nz$q+eD;}v%HI$pOWI+Fi=l+1}i zYZKYL(#s9E0oWMLk6%2$HMYNg<0Kw;=TnJ^pYnQgMr({xN=3G9VF z#<4M zS{tSzb|3#Y8{3$ykis-qmo)RcXBN;~D&Sd}mI%>7w@Zh=1eQ}aQtzWL_3?S@FFCzBG1K%6I^yD=K25Sc}j&_=~POyPy z)pdT`Zo<~BkIHMjGv~JHa6o9smQ&2hHC;~DdeTu>WHX%V;_}14+&PHtXmOsh^10xF zoJqOPm@D;kTNx0Zw))|yhwhe+>aX>;zbj^%@nUa0%px;SpAME!>|NTK#3pf2Zj2|1t=VG5tz`TR%C4&Mo(25IYLr$Za!`nYvNWmRu@ zm(HE*Q#|SZ*`y;k-})NUZ`%PUt51D*AN){$p4YuA|54a^-L3xQwxYL$jyRU8ex>oj zLuw%-+X&C)F6Q)`f5u)9R@-->{lbnD_fOt#vy1g$CC7C>F-e|&9Jcj+Li!K+R{o~4 zjMQ@cTPE^&K*j7!qK?gJ=*NZt%>huX*RW%BERatwRGIj28#}J={ayeF;1BBzGiy zOz~Ag;tSdMoFC}e$qxn{2hW|JqkT~;4x$C{#>4=+>BgH5SJmKUTH9B@$9z|oXtGmp z8w~b}#kHJs#CFc!NWWZ{dRaM5c}QNq(D?bcn8Ctn%hwHTpy*c1(H@TQ#ix`d$G9b)(;ipRCq;B z3I1zoXUuTY)d?F9w1$3IRQ!qKY4G5q$+I8YQ?lBw=zo6k`S#>Hrpyg>52;bBi=t-D z%k}apjUHb38`IK`BureQHGR6W!+k`tf%k>S*z^59LWi&$c9A?5&EsBxJ~JtLR88Dd1pqOXGXIfk@W&sQA>oDn--k z7q;KIqB$!ijg!7mJlXUeZF=3~4VwRE_q1H@h=Z?z zY&W~{>+qRo<*L7O&_!nWLkXGRL~@g@b7psa>v-GK8XI#Y{>r^m9rAsM=dPc_B=TYy zDX;+hRJdnvz)VKgxCEgr=kVjUPj|LPhKxFa4H_N)#|4K)>d{FA_?GhIEnv}D~fu;4iJeNB3GEsAbbN!c`^Y%Bi(`{753Z(AN zwCpX~Exoh+9)D9h(=O(Y@@}V`?o+R$ElY0$_2*HhQ__{J+PvX}rh)pp0Hc6aNj_T7 z15l-TubO;E*?|4FK1Na9s`By2XN@Y_scY`e#ZNt*Qy8vk*k3%RT>9?N_*BwJ$KzS) z%A&Nj-uaQYr<#g`?fTl{@LtKjR#@xuJlOD>3#A|9+6u<+`9^=aKH=)s$duQlq))6M z7w+k9zVY<E#;`r)I>l+_4(&6{yYy@noF&%j_7GH|529QO* z$tScwyeWHn;A!XeFBj!T-Bjv|&L4~}eprX-$!W)u#KYo^Dvxb1{0b)u?0FLLMS^(n z<(1ioJ&8GeI}Nmtp7a~-NX+P}o34uK$QVAyZW^12oHX6N#x5vFM&qVvQQ>H*px^RS zwGoVMTel>{?e!>+SH1cC@eQid*$aHF2Ul;x>X(rx(ho>l@kR#AB6@@Qc$S@yW3nVX z<6jOL9|&*s2$?nNsrOj5CQ~&aBu3;}lxKR@u{hh+X9xHu60iF(|ElvEK%6q;ww4OY zL?yCbatja7&Z^HyZ=_3?=i&+~r63dt@`%&F^c>qsa$jo|*a> zoMPxJ^?FVkdj^YMw*PQ`I8)R|o!mdUS8rQkUPSGP@b#20{z3Xlh!2^)!~(uX(GJt} zuTOJFvrq4rHRRdxAyd@-FG-Va56$W#SB)wjYS9xa^XM{$yJGgp5hJ-Wy*_1k3bXPKt zw`O~%iIwy8bnc@>yUaPQA1IS2uC}PmGhw)Wi6X#fC3WMCcuTw1|e20S%zg|p{r3LKiKc7({+cp1bC z-&ZwV_)c6lr=LED_7SW_!3%oV1^_`S4LltCGgP7(_BhBuMAy zaAWOv*v)&x020Ba3|2oa7XQU!2P%U|A=5$n3WyU+Wsnz*0FCsfEdfq`bo(U$OCw`{ z0%XQdV2d}2zC_vT$6zf1mVqRTB>?o}PtoT10KWxC%zFuNvNp$p+Q1=|oP1Cy9}3gk zl=2n=ImMbr{ui7%>0kNGX+AElWQLWT6A5~@OU0bzgZd}D6P?81;2lFqrcO)j0xSZa zL7`dT7&yoRj*^akj`YP@0kt7!@D8aBY$5p0i}~BIF5s#3pN4hDljiY`G`#5!NCKyb z;%OA>c7Fo+aKRZ$B>OG8PZ%ONfjXH}7z|1vi9+^U=z?6NKq~x#7h1$S5&issB?vAO zK;4%3p|t`Zn%80eGz!kU`O_(kvyRqrXu=DFf;W>0V1B*{ad6Q3T+QKJ^*apz%7OVg zHCVwoy}&a(R0I|l35e!s@Qs7D0aSf`K?(`1=TFM81?nc@IEhE@( zSSmv%@?XGppO2M5X!!Z8^XYXX@-!!ZaP zZCpaBiyOSaJTrs=SpnNXKNNWT|7|~tM_UjSau2W?`EG7QlV38V%R z7&uf&Ac;)Z4>3Y>gzJNC2(5}naab4uMrh72^C)+FM--MqBcQZYw3P8`>KK%co(e`w zOGigtiIa<vMwI4p{#+|!f0vZbab?Q2#fva;|(~{|J~R=czs_AEf5E~ofwGoBdG4B z68zApCHwU`M`wGA55Wkn!5K;)OCx}R3@|ncqM-B^Wi?%8bu||-y#=G8uco1_rUTBj zc~-C=(Kqy;SUH(6zp;W7+y{(z{!h%%I^p=(hDZlPq@fEl*_jZu&>|60oOz^=!$Xl~ zBQzbyBKV*eki`Gk%kx5m!RYAU&Hl}nc{V!5ml2Gk5zPF+S+KZTfBvrU51B%X3gZ27 zWIqD9Rj8s>L5ozOMKy1n>fi0=(0*Bfi|pX4hMG&;iSgpH|8xK2fj=JjMu$bX;lD~Lo&N=Twtu0;Qb8Nby_8NXnP?0m-WBcK%gWrYhm zk1Z8$9uVe50DNFRHJAgugoliS5`Cc*UoK7ovs|G9M$zHiVmzYaYk4J>sbNrPGfl*D za0oC77tX`O!^_Lb27qyi0dP(huDZlF9NOF|$eSj|BYLPR63PcIs@52J`7W`M?kq1U z4myzwJS1|2L)BV9O-vMqGIhjpp}jHcwD}BMP#_%o8K`?I^}yS~y*Citr{hZ!cPY!} z7M{{4d2fE`IG*~kX2Ubuo7GX;Nw2+=Qg*M&(cWja*PTvQNsK4H{Gkb#-T1LB?L$d3ya^3Jt|M>LfNdC^}w^E9YVAq$weXv)jsN+j&SJCS;JnMNrwaBqhpKqvm ze7xN8@K|7eaQfWNlIQN9KCfFN-rE{ofZf8h&mMF+H;~>@d*6LX_TE)|xF(f3!I!@y z^=as`I(xS#a?@vbi*CPKV^nm%Aj5Et-L;y&MipO~^QoJ+Fp?CtnZ*VYSps*cZ_^z- zTcS$TM>0gtR|;AITUWqEl`!#{1+k;m#|0uas7F5z4gn4ob4P%G^+M0`5gv5$p`*F z0E`DfDEmKrx;Lm=nD5LOaO4t#E3MKDAtT(LP}!chAzq=)K6H~ILiGILRcg)HsR}DS zV?sMY^U}2GN6Z7!w;{-CUB%%#ZlC3$v&#=2t5#syD-b^CX1a;l2Rm;%oWgG^dE`YF znXAFM(*5HbzOmLqZMWP=+~GpTrt43Gd4O26Ef0jBC?8V;+($x2ZXSE96m&$bDCRW( z-jm)HthbpVf*VBLL=Cx8XtC70r+bwyRS^~Q>P80-zrv*vnC@>6B6F1v(!W=7%mH)N zc>v;$(FgAD`AV`H97k@7@`y*mHIL8$cIPH>=E)&%7TE=copy&I31F zYl<$sn`#yPw4;{n&h${5K6vpqNwM^<2({H}=ir_4RPMrtj<&wJXM;Zqtciv6j90Q4rAW`YD8GC`}D>%U8_0sAgkYCXT`~`jmZ9nr}btcEw2(c>Brr- z8ocEYSz8%k)YaO7_ahLyU*CTgY24}~bP_(mO7*Of9v`wim3lLgx#r2rNw3iK)IpM& z$IzMc=)9XEhYk;#6@Hmup80g=TC2#xifmF)%h}yiZ=QWa=f5zDp7H3~T0QXTK(U@P zm6)7=cRSXjMkwRu@keC?0%uAkdoOg`H}1%TqoTqaW`~tq!l&G7`DR%Gsw(~R%95vQ zx+vRtYwlVNv{PCp_wUr&SaCM~)k-#S-OKk)rJ>jA41#vWWJ#w%!S;l|f^v6^J~KQK z81U7iY@{vh!nz`Z(yPsT`)+M>y;Q8ts@N2^y;X>|S#z+=1tbXwOo$ zI=Q~KFr%orTI9Q!iD{JJE>@LXb`mtM3Y|cd?I@LvEmJa^kgD3+ zY$n2D&{`&^9q+P%P_LU&rEN;(p$Uzpw@*i;8~PzWQn#GBEgmVWf@EFj9!xWS*e$=D zUpaW3KBmBOe!b1~hiWw`>Od6h$O5@ z&@(7!H@DO1T(+7W*QFH-9uwK6MUvm0!*3wXznV{;HV9&o?i=V^&o2R}!`-SEWshZ! z_y|fwdK!gppypkOlbfG~Fp&DjLy0%5`EZO{a*CDA14Z2ve3#|WupH;)kTv^CwZ55A zJD>44#ncE%zI;>OHvIK7nfC(raN9lOt?x|w_w`F37puMb_UJ}Mw@yS|t(Bv&3)el& zBla&;c>|&>e_d;jc#T(;8*iM34)8bzJ*jLc*l{;h?5NL%M{tY-o*r`W=q}3a{)@Y?h-AsCJ`E8| zMp;MVlFi!98de)_TBxW;=O65qY$ ztW9UJxO)e{WplzUpHV@6qfz!ET&sB7o;bVc{A%^%WvQ{0uzc~FZ6(QZmQRe$KIJ4n z>fnC&P(?$=bofis58z!Kae%F5%y#^-3OqXwF)29MQalSI7_`|hY^gXY5BFVAStlPp7 zZ@-_7#_nR6GGKAL7El(xI)=p?i16^$stg+W3^L z_}SPk$KNFnZ+tNP&O+35ys_N*`+m&z7gM$SY#)v#Y~O51&b`UsET+*PudH}a;I-mc z@dIX^YiC{ebT~8*uiV^G9^w8~qaew3&2^!MZe}oT*6wVAX+7W;nB!fx{GC*)b-`cFcXOiBZmHZ84k>i*`5s_*6fT4v&D&R--aVdU z5bG0p5_wE=Dr!&7GB4T0dp)r>5(%rCHID5#`MjcVV~sUnHk_i&kQ5T=M~hqu(@Z@b z+v>i-?z84mnUt8bJ!3_U>pgqO!{)`AX0E&T5p(hJ>3LaS^2x!Q4L3&^h-jbNaCy`9 zy&pT>%2TQY?)1i0cjRw(vfZ^dS`ERqajSiV++^#0Y^UzFk*Y7XWltaH1z(Zus?C=Q z4ONWF8r#)x)|KqhLeZLAon&pQbYwXn>Fin{Ml~t7oD9(MuqSzIT0#)-}aT5OblEuC+hJIo}y+w-4&UcE@5mt}4Zu@bsC3N}g z14%(EHUy>Ab=A8iuW-tg&eglpDZ6F!bo$=c2lLy?$3JilcfHK++@H?9(!SoRxFsuo22Bu=9aS&!o*jOIare@Z^~8}lh@ULW&Q$= z)B^qn-wpk`B06Fgg8KPqMv`U%@?|3Va0u8coJX)wqV!(;N=+r{4Ed=32pgp1(?So& zdk-v?>z^%e?y;6K!|_JJk#{eJb!lGd2`IaIsBTRllMPrf`&*=r957C4{;m_YIZas1 z{qRW_F&d)A`b4kO!N;pujuXfL+ejWlOrZAxlQ^raOy6}^-tUzwD;a%fcI?r4xpu3q zk`eh+NnW+ZPw$^es}ndsd*)o&%AwkOhTU;0`8!O??(J|hVdAhuU#8WLvjGV$cKd$; D(=o1& diff --git a/release-0.19.0/examples/update-demo/images/nautilus/Dockerfile b/release-0.19.0/examples/update-demo/images/nautilus/Dockerfile deleted file mode 100644 index 2904a107916..00000000000 --- a/release-0.19.0/examples/update-demo/images/nautilus/Dockerfile +++ /dev/null @@ -1,17 +0,0 @@ -# Copyright 2014 Google Inc. All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -FROM kubernetes/test-webserver -COPY html/nautilus.jpg nautilus.jpg -COPY html/data.json data.json diff --git a/release-0.19.0/examples/update-demo/images/nautilus/html/data.json b/release-0.19.0/examples/update-demo/images/nautilus/html/data.json deleted file mode 100644 index 2debee09a91..00000000000 --- a/release-0.19.0/examples/update-demo/images/nautilus/html/data.json +++ /dev/null @@ -1,3 +0,0 @@ -{ - "image": "nautilus.jpg" -} diff --git a/release-0.19.0/examples/update-demo/images/nautilus/html/nautilus.jpg b/release-0.19.0/examples/update-demo/images/nautilus/html/nautilus.jpg deleted file mode 100644 index 544d2bd471abf859e029d412f24ac64c2c7aecb6..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 21231 zcmeHvcU)6Vv+zlw_bLcTKoAru2_5Mj>Aj1P1c*R_Nhped1rZx4Dxx4LVxb5MQba|? z0*H+wRf-}gAP7iD;M;_v&+|U_z4v>6zx&Vkxp2;zot>SXot@pBo!vc4txF$y3QQsi z{t#qs4Q+uSh#BI7K@b8!Fc=5zwhTir0Su?Zw6rQ1;|d-Q@LUkMLoDE`fpODeZUEQA zcvoluLzut{406NPLku7tV4;sNku`V#Ci@#tG@XwWpc#W<=rBKx%fVDS4D!P^A0a@< zWj-(^AhI2h9sHR(Z?`bDu(F0s2}HadArj@Ns;Z=fLO~Gg&;1Z2!@c@6z>)m$D7!!s zl|%_7g`$j%P#7h&3QE@67fT@0keeYILQ6?Q3!{Wm($rE>*FvKq6bPVLNb=ytRoUTh z4qjS=n-e5|)ipt88HSyLAn?xw@*$Nl7^PE))jGkuP9fLe@zbzn8WdyX?a(l614nFOG~-nDGV-JprzBqr#)T31vJZ@xg1}8LX4n- z%QTFDaLwis8NX~Eas79jhr?ENiYS1u>6&8(@TCQFaM8-6KbKmUh9P#k3HumXL$IY0 zh?5?JaQkU=OC3-g#Lmpj%)-ph!otqO#>&Pcz{SqaB_PDdC&0%i#KTSxE05*K-|sLE zHZ~4U4sK3PZhlTqPJY^rlYco2&;NwM(qo8+8Nxw01WXcw^S}^1u%%8=Nv5S|Fg+k8 z1B@Pkz_fq>BMg#(k%^gwl@0dyL>L4|tR`|pFeD5CN5UDH7?~Lm?8+dK2Z5B}MKc)K z`|?TdK7e85KYitn;YKL|hbMl@D&&LpMoiMlj-wyPuoP9ntfE7kjL$gXOscL@)z&pQ zf5ML!$31Nf>-}LWb2j_%-E+^HK2KaLdH%j{(#1bKKIMApi{}0*bu-t1h$H83lvTHU zndX7ua3C#`E)x?YgDPDF2{bPfNU&Ryj{$SwG(Sy(Cl2+a%2IwG$p@2-90jlxl`&~X zngC3jRI3_*5LegXOq|uI_)lvh{MQo5{1RcQ9b!k&%jALdpd{xQHQ6xLcV9*zk_;iE zzU)VkI}tv7?deWLqSX@AzkQM9@FGS&q_lZjqqEsChs<-*;3x-c{CE^VUrvA%qO?92?lj+Y*O%zt7FNFh>-(O;-cBKBYTH zZ_dl*-kv7BNr=iO6;3JSwv;W@L~N!G=Q$D^hPDj{jyqFyws*@ziBd`8;+=*A953J2 z6den0{npF1d)P>p406%*=PLVqTvlcY%@-J}HhHKR^Pp z{8|3?mixB3tDzp2FGSStS4T}2FLn@LD4frqENt`EY<7Xl4{i?pQQx8w(?>36oi?D< zMjch?R90xDlts(GU4ob=rR{$Ba1T(wJu;pPhx)YzQ!W{Ac;iF~oR@#{=CpO(+`7BA z3;y5x)E6(Nu^}uJ6E0<;Dzu%`=PS>=t(OW>Au~D0F>Dt+Gubzcm79sDdtF6; zEjQ+7Zfg{>33Cg3U}RkRSUaxNIbW-&m`t44`0xehOwv}pI^eMceUACGsSZ6BZ!{eC zYM-T>8zOsO{T+oEmoL;)b0iM-n$q63uFjLm0e8JK*2L`i+WoFQy{393JJuTw}b@Fh0?G<&|*Q@#5S z7@N9(G~e$$?jqjyjk_O=b+roP@{8M_hY6|psdU=jNFBa*uB4qX5|Oh6F&5zZdexcR zlG%uN=RKe3)pjg$UhJ4XI#Y9CQ^_sC&*$$|sphrV++@p*F)R3Z?`+AN+#-J#kqFJ| z0Zo7OWJS0A)v(|>>)ENFpPRqv%=D!pf?~2X-&O77$ZFBxc%6UH?6^hiXDO0HIV=B$ zq#N!o;sahfUXsk%i|U$1v1cZhAj-l9z!Qxu(6xAPn%B#jfw9H+*9m7n4SkTxVYKHjUYxCvF^Af>=57iRT(B zTxX4B)6?%1<}O&~>wV2znBMj^FIpR?-F6{);hr#~SL0JR-NW*36X|I`ghReh7O76e z8Oe#KPbn|{ENvBiQF3xx^&o1fI(A5IU!}rkF%4giBa@Hv?W-knv>o)WeVo6&m>b=F zK_=LE;Qr5vbFn35)M1`y`e)BQ+ND>)Gh%r!cB!!`!0Ac(>2sFC*Q?7e*)Cd8gcp=q z)6-&J`nYWClrPDcd$kyndC4(tKCiH*3SW4$wcW>!$M?3_vzUMz8@g{So|dscI)WX- z7f>&ioXpZo?*6feX-$y-OgtoB#8}o47;EA^GQnS|IonM$%QSr?>$>%4<8yV(w_{q zPV)CD4D1X*Mb=IYFSeB4)&7u&k>B>JJo&|ekFV2W^OqpMmNLfRN#PpgUB0?EX^)EX zTpNyii5e%!yfrF0x!AzMD^hZ2luW{hJz&IyWjv`iTDVr$aC>ZQtZP&+g9|E;`V?It zKPy}L@C4RVo_+oF{7Y$94b3+Z_cGHyN%KgASxQS9M&-A@V0;3FMq+X?)hegnuw+WJ zAAgJ-h39{`)L>aU+!Why@zcpfQc3#j9QMwgA<8gkSaXCDlIwNw64c;AcpYP7;LqXW zv0m+dyPCz9iR}5gNI@ zy=+rN{6>mG&eYslao<75`_Z0{$WdnX-FKw1@5ODRh`sZhWuk6OKVr^{3y)oD8gQG- z_@Z*>O+FX4TO{B|DyzXON}1BJ_G-cVp_j1n_YB^ba|iDZZD}9g_#_`2b4)!4Yd+B` z43&M5G8ex;pZiXiJ&!L*cRc#gz_ZNHBYKmvE+?Y$xGKeV-1mqsiaj@5yUuOwZtIZh zJNSBbFy@BmL|?phtD^tNX-V&bt3S*y4NOLzd_PIX>@^bKIj@R88IjSSG#oRSM>2ec zEV=I`xhLsm#ikFhPxW)_pAQe7iN)u*89hOA8i<&qlDZ_6+YYpz6*^Sk_ttz6dJ>R{ z`g*x5)v|6YWdb_m8J)Fn#}YI@6uvJ zYdFuI#A}Ue&BAV+9XWhCdM};OTBfG{LFk9?iwC@B=C+DkbhrF$R>++*66LVv`~Z`< zdc=&glQptLE#-Tenf6hc2hrS)whAn_&0Fx*rj2q}*QYoe83pZ(Z`MG}n*B)c;|a=; zd4vqlL_RB-yY~+2eOj|QCh@Uaf&zD^uO&)SrK6~7pZnf+yjJ-a1y>3x@OW%KaKE+4a5pLW|FU&A{;L|xZSnz63T8ohh2xXkDJt3xqK_lv?8 zk7sm0ESuN6cxBFqI^4OTZ3*(ut7@=0U-y1vL}yy@&hFyVgFoIbn$0B;I}|6bQq{jM zC`8|1f_hrwvoDKG&M7FCaJgdDo-L9RzYlNHBed(-UM-AM6tu7wd*|b)o1M9#OHW$n z`_#zEBHhf73)gxHGM1#=T59x7)3nMXu?!>;oO*Cbdw9s`rSK(4KGMO$(qFf*V)51> z7!B^%WiD(<9?d>0{)u>hICiORX?UISFPDX~f)b=*Xkm?{&2u4WyC}>9LWoG4tv$gU z77oEh;pz}GZMLg~L2HP@wIMdNs*19Tnw$~{qHx{c6R8lA=HQ@nm8Ns$)``@(Eb$}E z)UWqgOiQUAiJqoKPwNAB;60$vOCg9YlnfjvwqexJFe*TTNihW3QK*i7BvLSK<_cL5 zsdzjwEMyg?J&l6Nv^W<%uOlInMqx;x((=%fmwDpJHohTvClfa(fTFWn$zVq&k^CL; z)UZ%nzg<|6$PU>-WQYX*{2>(N2;m_r6b6OTSV63zYt$e{XJZ&lC9X)s?iWS~rV@yB zmLQ#lPHklEZn>=EZ8R2ed2stxW8U9tY#T}?kcbqJzK%v|6iOwoRsvMgkGvLf2%uQ6 zMU2QqqhAps^;g8oFPO5HViQ0OUyGQ81RJkKfKGq0HpB)6tSDkxOOS(^p%IVHTOEJ&kjvQ1H;(4=vjp2OUT2*&FDT%f6?z zIN}FAo#u6=2N*pUaBtEA>q;j9R!)~-l8!Zp6#e}{N-($spA-nN70i_j7uPTtI^F}^ zS7}t~7@Fm;VCX!T{ZgQ30pHj^1jJWB|G$t%*99|;_i8_c>w|s?t`)s)ph0v`+Oi(k z)1n9ya9ft17KMOQYWZS@h>$NBA*c`m3IK(Tsb|f%lKqiHS{sqNIA`=3DFMWC3W;b!9akr)801pn| zFe=FmPsEdbsd&0HPJ2RE2YJ?IVj2dJLKYzbDDe2-u0JA-9Q>D`3cB+Dim|2y{PpLA z(Kndt)tD53kuDtmw8q}N# zhxhjlqYt1g;dnCjAIM!+(SIdp^9wK{1(V3XDVJxNzoFS$0>}c{kcc#0vrtK);D?xk z|9ymF4F*HmzhK$@=tJMX;MqVE2mYO$-uq-}1%Y2$V9t7@ba=U^ffX7MXeLY_b&xa) zh?9n;bq<=ZJ-|s(?L=kX0lCG-OO4gx9_&|dBUNYWsuZrlz72MiGON2Nd#@Jw&Q+q&$(bag~EHo`NM4=)P+d zjU({OhEa7Sfuze-2nk(d`;WR>B@A8NNcqp?Ysqv4uV%tw*Qi5**M=@J4y%X{#)sgE zR0^O)({#2fiM90_`9I1M60$~3p_+t)YW%xarqG-ziVk=RDU6K8n}mZBH_{3V)iNUE zfj0{{sqs3Jv~?4CC5${;!)bNr;4+al2}khXvr2?kkyp}?$0#|i?h}<)QU~qz8$aN@ z0UqzwhX1vQW3p0N6h>i%+!~k)4tU7_Ti$C*)uNFuOAT!FA4UE}YlRQ+#qP1Nb22g} z1mGz^OX{X3sw#$HyC=p3tzx2%!Ki6q)D6`PO^gkVG0GaMlBi#~>E0$#cc2>O-|-ek zMquT{pAZZZC}7nAWnp5ZhSpS5lgB8aB~du6mOqIc;tNV6g!l&F6?cW=1L)eZw$?Hx zVZ&$*Zea|VYM@Op7-d6KbtPjXBeaUDiLr^Au_oHcRKr-qKn<`0Ed=sd5Ghn&A{I}} z1275%0!~ZKS5-|Fr=ltEr-Jd9S3#>{<$bYAO7eINPFdX-t*)W0>ARYL*@NjD{C`z8 z=yjkXbjKKFr3V@WQ&*s10?ksjf_;erKqUDUUmxgaAZRPn`c^OjkkX;$T#COlTdtNl zfdbY?_N=gU#P9yaoNm%uzF68a6VS15I36d7T1FE7V`VJoj{r*}G`smPt$3M?Lh`3Z z_>%Dk0idz|)sp{V2lc9e*g&8aJg`kgNySwiELTqP@AanZ=eJR5l^hIpG;nQ&mylYxK$ z7NWrc%P?3q1vJaBJ`Ki&5W#9HoF;Q9E(Aw|p8+@_JdCyskFWx8d^iCg0pKP8O9h98 z5CBZuwZR{P_XS%6=wKhHrIp-dz}eyaa54BMxFTEwZUDE0JHfr-0r1`Mz3@1A zB0LqI1-?1$lb^o;XOki!xSSUqadRUqdKEGqdVg+#wf-UjF%V-86Pv& zGxjo0GBGg;Gs!XOFxfKsGEtf0nJzHpGd*HzVCrL6 zKiJsVB-u3C?AZux``J?2ZnM>}ePo+u=Vjl*Zp7}z9>$)?euMondmH-?4i1h@9Qqs{ z98``(jvS7s99&JivaE@>_Ut{q%^xl*`_x!!Vp<7VOB z#BIdw%N@g=#(j^wg?o~Rj|a_T%M-$Lf+v@!mgg%k6YnNo6J8u|9Pd@$r@Xy<2)>Pc zMtoSlLwwnM&-wcJ8Tn=SE%yEA~Sl6&_T1Z4lUkERBOsG)kz0jO6O4vj=NcgmHnQ-TNPakz*o7BJHAZ(Ji75qEVt(MPG?difs@x6AKl)Aof)3+Xlf6 z`Wtp_IJ=>8!+`Hu>M3RVgS70MJw6r~hB6i+KwD=sRjDg`TLD|MiG(c94n z(G}=%%oYq5lZI(h=1?|Oj#VyK9#fH1!K-Abw5sx{TB{yWtx{c3Q&%Ia6{roUOR4Wv zPgifz;McIzIH6Ia$)IVd8LRm~b5=`Di>g(m^?jTCwxDgf+rDbcXydiBwR?3Wb$oTM z==A8Kba(1r*6q=g(DT*H()*;pQ6Hy&UH^;0W`kV@`356~N`_>^62oaDEu(0o$HoX_ zGvi~%Z%lYioJ}s8beT$;2AJlVj+&{OMVUP|XE3)kKW*M(A!dQK$gvpRuD(5b`!h>+ zOGnF#mY=M)SdpzNtl`$%t~`DTw`a7svrn_{cR)Mr zbEtOYbM$e{b)0fCbV_pSaF%rrbFOmXa`AG>ahY~Cc1?EeaZ_}QcB^w=?@n+p_h9mH z@wo0W>1pD5&a=-;)hphs*;~dt(z|xY`W?YL9{O)?~|U;K6all{L2=meYz7zor0ObPr(Fd|$ejO{YtmAPv= z$TsLk&{D8#aA62@$j*>^L|$SL@fm3YDUwtlDi<0b+Ou10_qpApWJ~gO3XI}SDW~#- zm#J4_vSEkAK8EXtr-jc%xI`33@^rdUW3)l^ zl^9rzUrbf(#@M*nzWrwVZysPh5Om=6L8XJq2PY1>9;%2Fi`yU9d)Vx7UOZtxEX z{rL5T8^jwuHyv(1%TdqC$ra5_%7f>HgLih` zX)dxXsw&nfF1RawH@$?fZK?M>-h^|$5kG~ZR!Yu8sc=rufPG;Vy+WYJXj-sXLM zvvYH6i&sleE3WlxTX5T0dwBbN$NmotAC7f$ccyfSc4c*M?k?<6>v{Om_~WZjj-NVu zvAsi|DW8A##r1Rar+g9rlJgbw^}&GYz`H@u!M>r;q4{s|!#u<3BeElRzw3X0HR?9n zH%1;?8b9$v_{WV2m5HiJyUDJpkg56UV>7}tH)l0wtLI$jzRXAbWcr!9uz8_k(Q@&_ zQV7`KJOW9qoUo_83xLD@+z2@0_btT`{m?xt_}OA+Vr6D#Up{pI47_nbaIpII+iMR3oS$a|pI-o9 zU7(%9r&Ve>(7rtZj@pASd8`C*(3}=%-~Zr2@-j&9aijSe4Fph?<<_|ezf*|c zzZKzbaV)r|;i|iliT?cOhpC*y0a7XN}>a_`ye5~@`wch%GLQw4PH zf6Z_k)480hm^{dD{y@KK|Dd;|UXTyWYu@`QT6dC@rPIUk-tA8wb~{JT6_*f&$Zttc zc4prM$<{YXitNo&8^#Z z-D^HG77~w$mten~H<1xd>RYeOw&B8wOH2hBs93#@Q~KJc@iznnH_2Vuqt<9#^5wD! zdG5lVXkA~^<90Vsz3jztmn#}(HIMgV-)Xhm#cF1t+A}0nO{%I+Jjn6Znb^>m=%9dk zH@v^!m^zYPo(3XkB5>Cc+)h} z9QpW^Qg2#Op1Ek8czl&L!`YvL-Xd%|4;Rh%nc8};MK1r1xTw{x+7odZj4}c)no7Rr zWLso`qo?qIkTV>K#RTwZF#G7C&K-LdkYBuIzsBSJFT8k;PAWtDt=M6R)3SvLA%~ed zG(PWrd@QbtbGP=3O`A1k9xH8A@q)dP<%T4L(={2hj}8%r(19tNcW_wV%}WM01tS$H!ierE3a&kb(h1U8utLCZxvg^J8Am zn0}p8$sai?v-u0hPHydfe}mKuGoJ%K*dI;J_0X(^!ww`coeQqgd+g73dq&Ukt9r}$ zKH1PSud1t?xTD?fCA6gnwDrSw@;jurqA5v-pg2S6jP<28C=uil)?YOq~Wd6&Z3l|bB;x0_> z{%9((b0hlgxG7dYE|EJ@`bq&$kMJ9~1dpq7BFdiA_C-MIrT}i=0@fbe^q&WHm6g%V znLbjlUcFU%lCX0LLX5}UxInKm?YkS$h`6g2=GK_jmt8aRA+AGnY41B4R3nxk_dDCi zodtHZ-XNqF^yapZ8K(zByNAQJHVx%H3UqHEjqk__3PBgTmE0;-+h5{YI6xo`?L8mR zP@L5B!LunrnN;kN8)9126MlT8jd)0)ySs5v20t%;D}3JbQv5=xw+}WzC#JdHn&ZNQ zt+{Vs-S6~|ycUz{cBni2^?QO3p>0Us|KVZ3y2&8M_qMZln;u~su7AN6`s9mIx13Hg?xGSpx;u)oo;i&n)**x$jsq1R$Hne< z&Cewk6zsFhx^>Ro{|NS)|Ft3iT9Wt0_KJwMGWp`k@68=o2D=Mdrs@YoY>(x%r!7JG z;q&vZyMpRH)s0Kt+RqNGyEb)tD5|1vR|8i&>04=`ZR5m`d=Z5`!foHeng&J)^$+nZ zt=VOTLo=n1d`wfC`?J1!x3>A0c|Q*cXdV1CH7^kuk~e({qu4JaH9R-}7TfgIv1CW( zL-Ub9BmB9M@53F%;blH0w=e0Yl$MrEjc)&j*Rk9+*V2)TGR?op_d(L#v8YIy?^fD*kHOLkk8h>l zTgna)&lfT5O%5L3o1sderfusO@LqqG&As~mQ)*Sk#g4FLO+snhVXOnMTGI;#wam)##16W!E`g)*(G zZfU1*>WbR&pReAzBE?=>WS@R)Z^Cf?dIzV(jXW+Yha7BETCzDTidY^kcW#i+}Jse*}M$B4gfVBX&s9 z>_l*^YhuO4i>EH&blkP}9hzPD^;t(!?_*rAyHx_O={I4GW()f}*5$F+&NP|SeYX#q zKReI0+`(X=*kGZlk!eUPu05bg{!{sYB^x~7j8AXgIahv%g#WHL43Rm_XXJ<%yplO( z*V|Q}6dN8tr5AseqKwp6MIMY1Y>JmQ6WjKcmwA-5oPqbNUbR2dJ*dstJ9*dBm&CMm=yDzNR<{SpApKN=5-p>?}^!T zMd{k1qe;ED)U2SmWa{aOMzOAsyFcRw8IGcVUan7XQ${!a*fJO;d-(NfW?s@kg{ek% z)>{dCE>Za$s+y8yhgEg2X(8;jVtYT@AL7M6z9?kJ`uO{#eROFE0?}A%b<*!if93g2 z&d-zNZ|}}NDO(xp%FMTu7u$F2#qBn6sr1PGhi=Hfjy>Pu!XAxjeOy!Nmv5$)b$$M_ z;qBp3-FAZymrwV)7b#m9T+WZIzZ-4-U8kwML~~g2Oli{wfi0I44x0DsEVdUljy1J0(5@w0V{Q0q5v6Ix8{KB8_wW5$k1BV#lX1=X)NrpThF~;~`=Ad>6lO1{TE3ukFP&W@eb(75 zP3~vLOP}^7DCDKO$g8T?U7w8)kDsvI;5-|&?prG+OuZvaGvdNJdoG@YXpd6bhcRYz zlAC4qHxDsLBXwC*rMxG_chC6#jMc+~9IkgBj z0=+0AM!b#~NvnNbE^4EV>wH>LSa9h`-okvf!@ic#sX6%qe`IZP#Rl~2h?GQ|6q#35 zjN13?h35AN&x*9!R=mmGot12Qcc__ud3O! zJUmr;UUODAHM=fT#wV=M*ckgv$L8o_uJI1M0e9H?@P%C!^`ergimLSs8GnmUI_snc;#Rt#4toxQXmrCqy z%%~af#`|izB6{JNQfGC64F)F?9k~`>QfrT5iY>~7?i%lP?VD~k?Z7#mG!-pw+E_Vx z*K_!~)mMYEvtvx&AtYzf91Ls=%cn1vl{J^2;|xf`j7|2FIRetA=$u~g(GsigZxc1Q zJ*(G-vMk%zIg35ol{z98UoHOW^RU18xugYZ`RIWpVx|6NHrKBO*;C$6zcp?)4b~^) zB1@yqIlSWhocwNqPemLoo89G=VK8%Arf+L(%Apa7+e3aCb~crP{nr*0Fvq&oWrx!q z-gOSy&G$n0X4yw8uZ*42PZ1T2G;8ya*#Ak$!vGnM z=I4`u5V;pnDN`9Q8ER!MSOt-0FoQc9L67~oLj!wSj9VNP57GDzu`zc;I>(G0}Yq$_w-f zNDV6=0}b7je@V9D{rGHo8fghiywkC6Z`8=V_g$?@@2IN-SG(J~CmcEjYkvGxnRin7 dsoOPZ8B*GauWW1X&Uh#$@&K61WZ_cV{{f0CZ2tfN diff --git a/release-0.19.0/examples/update-demo/kitten-rc.yaml b/release-0.19.0/examples/update-demo/kitten-rc.yaml deleted file mode 100644 index 516d5b88d78..00000000000 --- a/release-0.19.0/examples/update-demo/kitten-rc.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - name: update-demo-kitten -spec: - selector: - name: update-demo - version: kitten - template: - metadata: - labels: - name: update-demo - version: kitten - spec: - containers: - - image: gcr.io/google_containers/update-demo:kitten - name: update-demo - ports: - - containerPort: 80 - protocol: TCP diff --git a/release-0.19.0/examples/update-demo/local/LICENSE.angular b/release-0.19.0/examples/update-demo/local/LICENSE.angular deleted file mode 100644 index 020f87acd2e..00000000000 --- a/release-0.19.0/examples/update-demo/local/LICENSE.angular +++ /dev/null @@ -1,21 +0,0 @@ -The MIT License - -Copyright (c) 2010-2014 Google, Inc. http://angularjs.org - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. diff --git a/release-0.19.0/examples/update-demo/local/angular.min.js b/release-0.19.0/examples/update-demo/local/angular.min.js deleted file mode 100644 index 43f31f67089..00000000000 --- a/release-0.19.0/examples/update-demo/local/angular.min.js +++ /dev/null @@ -1,210 +0,0 @@ -/* - AngularJS v1.2.16 - (c) 2010-2014 Google, Inc. http://angularjs.org - License: MIT -*/ -(function(O,U,s){'use strict';function t(b){return function(){var a=arguments[0],c,a="["+(b?b+":":"")+a+"] http://errors.angularjs.org/1.2.16/"+(b?b+"/":"")+a;for(c=1;c").append(b).html();try{return 3===b[0].nodeType?K(c):c.match(/^(<[^>]+>)/)[1].replace(/^<([\w\-]+)/, -function(a,b){return"<"+K(b)})}catch(d){return K(c)}}function Xb(b){try{return decodeURIComponent(b)}catch(a){}}function Yb(b){var a={},c,d;q((b||"").split("&"),function(b){b&&(c=b.split("="),d=Xb(c[0]),B(d)&&(b=B(c[1])?Xb(c[1]):!0,a[d]?M(a[d])?a[d].push(b):a[d]=[a[d],b]:a[d]=b))});return a}function Zb(b){var a=[];q(b,function(b,d){M(b)?q(b,function(b){a.push(za(d,!0)+(!0===b?"":"="+za(b,!0)))}):a.push(za(d,!0)+(!0===b?"":"="+za(b,!0)))});return a.length?a.join("&"):""}function wb(b){return za(b, -!0).replace(/%26/gi,"&").replace(/%3D/gi,"=").replace(/%2B/gi,"+")}function za(b,a){return encodeURIComponent(b).replace(/%40/gi,"@").replace(/%3A/gi,":").replace(/%24/g,"$").replace(/%2C/gi,",").replace(/%20/g,a?"%20":"+")}function Wc(b,a){function c(a){a&&d.push(a)}var d=[b],e,g,f=["ng:app","ng-app","x-ng-app","data-ng-app"],h=/\sng[:\-]app(:\s*([\w\d_]+);?)?\s/;q(f,function(a){f[a]=!0;c(U.getElementById(a));a=a.replace(":","\\:");b.querySelectorAll&&(q(b.querySelectorAll("."+a),c),q(b.querySelectorAll("."+ -a+"\\:"),c),q(b.querySelectorAll("["+a+"]"),c))});q(d,function(a){if(!e){var b=h.exec(" "+a.className+" ");b?(e=a,g=(b[2]||"").replace(/\s+/g,",")):q(a.attributes,function(b){!e&&f[b.name]&&(e=a,g=b.value)})}});e&&a(e,g?[g]:[])}function $b(b,a){var c=function(){b=y(b);if(b.injector()){var c=b[0]===U?"document":ha(b);throw Pa("btstrpd",c);}a=a||[];a.unshift(["$provide",function(a){a.value("$rootElement",b)}]);a.unshift("ng");c=ac(a);c.invoke(["$rootScope","$rootElement","$compile","$injector","$animate", -function(a,b,c,d,e){a.$apply(function(){b.data("$injector",d);c(b)(a)})}]);return c},d=/^NG_DEFER_BOOTSTRAP!/;if(O&&!d.test(O.name))return c();O.name=O.name.replace(d,"");Ea.resumeBootstrap=function(b){q(b,function(b){a.push(b)});c()}}function fb(b,a){a=a||"_";return b.replace(Xc,function(b,d){return(d?a:"")+b.toLowerCase()})}function xb(b,a,c){if(!b)throw Pa("areq",a||"?",c||"required");return b}function Ra(b,a,c){c&&M(b)&&(b=b[b.length-1]);xb(P(b),a,"not a function, got "+(b&&"object"==typeof b? -b.constructor.name||"Object":typeof b));return b}function Aa(b,a){if("hasOwnProperty"===b)throw Pa("badname",a);}function bc(b,a,c){if(!a)return b;a=a.split(".");for(var d,e=b,g=a.length,f=0;f "+e[1]+a.replace(le,"<$1>")+e[2]; -d.removeChild(d.firstChild);for(a=e[0];a--;)d=d.lastChild;a=0;for(e=d.childNodes.length;a=S?(c.preventDefault=null,c.stopPropagation=null,c.isDefaultPrevented=null):(delete c.preventDefault,delete c.stopPropagation,delete c.isDefaultPrevented)};c.elem=b;return c}function Ia(b){var a=typeof b,c;"object"==a&&null!==b?"function"==typeof(c=b.$$hashKey)?c=b.$$hashKey():c===s&&(c=b.$$hashKey=bb()):c=b;return a+":"+c}function Va(b){q(b,this.put,this)}function oc(b){var a,c;"function"==typeof b?(a=b.$inject)||(a=[],b.length&&(c=b.toString().replace(oe, -""),c=c.match(pe),q(c[1].split(qe),function(b){b.replace(re,function(b,c,d){a.push(d)})})),b.$inject=a):M(b)?(c=b.length-1,Ra(b[c],"fn"),a=b.slice(0,c)):Ra(b,"fn",!0);return a}function ac(b){function a(a){return function(b,c){if(X(b))q(b,Rb(a));else return a(b,c)}}function c(a,b){Aa(a,"service");if(P(b)||M(b))b=n.instantiate(b);if(!b.$get)throw Wa("pget",a);return m[a+h]=b}function d(a,b){return c(a,{$get:b})}function e(a){var b=[],c,d,g,h;q(a,function(a){if(!k.get(a)){k.put(a,!0);try{if(w(a))for(c= -Sa(a),b=b.concat(e(c.requires)).concat(c._runBlocks),d=c._invokeQueue,g=0,h=d.length;g 4096 bytes)!"));else{if(l.cookie!==da)for(da=l.cookie,d=da.split("; "),Q={},g=0;gk&&this.remove(p.key),b},get:function(a){if(k").parent()[0])});var g=L(a,b,a,c,d,e);ma(a,"ng-scope");return function(b,c,d){xb(b,"scope");var e=c?Ja.clone.call(a):a;q(d,function(a,b){e.data("$"+b+"Controller",a)});d=0;for(var f=e.length;darguments.length&& -(b=a,a=s);D&&(c=lb);return p(a,b,c)}var I,x,v,A,R,H,lb={},da;I=c===g?d:Ub(d,new Hb(y(g),d.$attr));x=I.$$element;if(Q){var T=/^\s*([@=&])(\??)\s*(\w*)\s*$/;f=y(g);H=e.$new(!0);ia&&ia===Q.$$originalDirective?f.data("$isolateScope",H):f.data("$isolateScopeNoTemplate",H);ma(f,"ng-isolate-scope");q(Q.scope,function(a,c){var d=a.match(T)||[],g=d[3]||c,f="?"==d[2],d=d[1],l,m,n,p;H.$$isolateBindings[c]=d+g;switch(d){case "@":I.$observe(g,function(a){H[c]=a});I.$$observers[g].$$scope=e;I[g]&&(H[c]=b(I[g])(e)); -break;case "=":if(f&&!I[g])break;m=r(I[g]);p=m.literal?xa:function(a,b){return a===b};n=m.assign||function(){l=H[c]=m(e);throw ja("nonassign",I[g],Q.name);};l=H[c]=m(e);H.$watch(function(){var a=m(e);p(a,H[c])||(p(a,l)?n(e,a=H[c]):H[c]=a);return l=a},null,m.literal);break;case "&":m=r(I[g]);H[c]=function(a){return m(e,a)};break;default:throw ja("iscp",Q.name,c,a);}})}da=p&&u;L&&q(L,function(a){var b={$scope:a===Q||a.$$isolateScope?H:e,$element:x,$attrs:I,$transclude:da},c;R=a.controller;"@"==R&&(R= -I[a.name]);c=z(R,b);lb[a.name]=c;D||x.data("$"+a.name+"Controller",c);a.controllerAs&&(b.$scope[a.controllerAs]=c)});f=0;for(v=l.length;fG.priority)break;if(V=G.scope)A=A||G,G.templateUrl||(K("new/isolated scope",Q,G,Z),X(V)&&(Q=G));t=G.name;!G.templateUrl&&G.controller&&(V=G.controller,L=L||{},K("'"+t+"' controller",L[t],G,Z),L[t]=G);if(V=G.transclude)E=!0,G.$$tlb||(K("transclusion",T,G,Z),T=G),"element"==V?(D=!0,v=G.priority, -V=H(c,ra,W),Z=d.$$element=y(U.createComment(" "+t+": "+d[t]+" ")),c=Z[0],mb(g,y(ya.call(V,0)),c),Xa=x(V,e,v,f&&f.name,{nonTlbTranscludeDirective:T})):(V=y(Eb(c)).contents(),Z.empty(),Xa=x(V,e));if(G.template)if(K("template",ia,G,Z),ia=G,V=P(G.template)?G.template(Z,d):G.template,V=Y(V),G.replace){f=G;V=Cb.test(V)?y(V):[];c=V[0];if(1!=V.length||1!==c.nodeType)throw ja("tplrt",t,"");mb(g,Z,c);S={$attr:{}};V=da(c,[],S);var $=a.splice(N+1,a.length-(N+1));Q&&pc(V);a=a.concat(V).concat($);B(d,S);S=a.length}else Z.html(V); -if(G.templateUrl)K("template",ia,G,Z),ia=G,G.replace&&(f=G),J=C(a.splice(N,a.length-N),Z,d,g,Xa,l,n,{controllerDirectives:L,newIsolateScopeDirective:Q,templateDirective:ia,nonTlbTranscludeDirective:T}),S=a.length;else if(G.compile)try{O=G.compile(Z,d,Xa),P(O)?u(null,O,ra,W):O&&u(O.pre,O.post,ra,W)}catch(aa){m(aa,ha(Z))}G.terminal&&(J.terminal=!0,v=Math.max(v,G.priority))}J.scope=A&&!0===A.scope;J.transclude=E&&Xa;p.hasElementTranscludeDirective=D;return J}function pc(a){for(var b=0,c=a.length;bp.priority)&&-1!=p.restrict.indexOf(g)&&(n&&(p=Tb(p,{$$start:n,$$end:r})),b.push(p),k=p)}catch(F){m(F)}}return k}function B(a,b){var c=b.$attr,d=a.$attr,e=a.$$element;q(a,function(d,e){"$"!=e.charAt(0)&&(b[e]&&(d+=("style"===e?";":" ")+b[e]),a.$set(e,d,!0,c[e]))});q(b,function(b,g){"class"==g?(ma(e,b),a["class"]=(a["class"]? -a["class"]+" ":"")+b):"style"==g?(e.attr("style",e.attr("style")+";"+b),a.style=(a.style?a.style+";":"")+b):"$"==g.charAt(0)||a.hasOwnProperty(g)||(a[g]=b,d[g]=c[g])})}function C(a,b,c,d,e,g,f,l){var k=[],m,r,z=b[0],u=a.shift(),F=D({},u,{templateUrl:null,transclude:null,replace:null,$$originalDirective:u}),x=P(u.templateUrl)?u.templateUrl(b,c):u.templateUrl;b.empty();n.get(v.getTrustedResourceUrl(x),{cache:p}).success(function(n){var p,J;n=Y(n);if(u.replace){n=Cb.test(n)?y(n):[];p=n[0];if(1!=n.length|| -1!==p.nodeType)throw ja("tplrt",u.name,x);n={$attr:{}};mb(d,b,p);var v=da(p,[],n);X(u.scope)&&pc(v);a=v.concat(a);B(c,n)}else p=z,b.html(n);a.unshift(F);m=ia(a,p,c,e,b,u,g,f,l);q(d,function(a,c){a==p&&(d[c]=b[0])});for(r=L(b[0].childNodes,e);k.length;){n=k.shift();J=k.shift();var A=k.shift(),R=k.shift(),v=b[0];if(J!==z){var H=J.className;l.hasElementTranscludeDirective&&u.replace||(v=Eb(p));mb(A,y(J),v);ma(y(v),H)}J=m.transclude?Q(n,m.transclude):R;m(r,n,v,d,J)}k=null}).error(function(a,b,c,d){throw ja("tpload", -d.url);});return function(a,b,c,d,e){k?(k.push(b),k.push(c),k.push(d),k.push(e)):m(r,b,c,d,e)}}function E(a,b){var c=b.priority-a.priority;return 0!==c?c:a.name!==b.name?a.namea.status? -b:n.reject(b)}var d={method:"get",transformRequest:e.transformRequest,transformResponse:e.transformResponse},g=function(a){function b(a){var c;q(a,function(b,d){P(b)&&(c=b(),null!=c?a[d]=c:delete a[d])})}var c=e.headers,d=D({},a.headers),g,f,c=D({},c.common,c[K(a.method)]);b(c);b(d);a:for(g in c){a=K(g);for(f in d)if(K(f)===a)continue a;d[g]=c[g]}return d}(a);D(d,a);d.headers=g;d.method=Fa(d.method);(a=Ib(d.url)?b.cookies()[d.xsrfCookieName||e.xsrfCookieName]:s)&&(g[d.xsrfHeaderName||e.xsrfHeaderName]= -a);var f=[function(a){g=a.headers;var b=uc(a.data,tc(g),a.transformRequest);E(a.data)&&q(g,function(a,b){"content-type"===K(b)&&delete g[b]});E(a.withCredentials)&&!E(e.withCredentials)&&(a.withCredentials=e.withCredentials);return z(a,b,g).then(c,c)},s],h=n.when(d);for(q(v,function(a){(a.request||a.requestError)&&f.unshift(a.request,a.requestError);(a.response||a.responseError)&&f.push(a.response,a.responseError)});f.length;){a=f.shift();var k=f.shift(),h=h.then(a,k)}h.success=function(a){h.then(function(b){a(b.data, -b.status,b.headers,d)});return h};h.error=function(a){h.then(null,function(b){a(b.data,b.status,b.headers,d)});return h};return h}function z(b,c,g){function f(a,b,c,e){v&&(200<=a&&300>a?v.put(s,[a,b,sc(c),e]):v.remove(s));l(b,a,c,e);d.$$phase||d.$apply()}function l(a,c,d,e){c=Math.max(c,0);(200<=c&&300>c?p.resolve:p.reject)({data:a,status:c,headers:tc(d),config:b,statusText:e})}function k(){var a=db(r.pendingRequests,b);-1!==a&&r.pendingRequests.splice(a,1)}var p=n.defer(),z=p.promise,v,q,s=u(b.url, -b.params);r.pendingRequests.push(b);z.then(k,k);(b.cache||e.cache)&&(!1!==b.cache&&"GET"==b.method)&&(v=X(b.cache)?b.cache:X(e.cache)?e.cache:F);if(v)if(q=v.get(s),B(q)){if(q.then)return q.then(k,k),q;M(q)?l(q[1],q[0],ba(q[2]),q[3]):l(q,200,{},"OK")}else v.put(s,z);E(q)&&a(b.method,s,c,f,g,b.timeout,b.withCredentials,b.responseType);return z}function u(a,b){if(!b)return a;var c=[];Sc(b,function(a,b){null===a||E(a)||(M(a)||(a=[a]),q(a,function(a){X(a)&&(a=qa(a));c.push(za(b)+"="+za(a))}))});0=S&&(!b.match(/^(get|post|head|put|delete|options)$/i)||!O.XMLHttpRequest))return new O.ActiveXObject("Microsoft.XMLHTTP");if(O.XMLHttpRequest)return new O.XMLHttpRequest;throw t("$httpBackend")("noxhr");}function Ud(){this.$get=["$browser","$window","$document",function(b,a,c){return ve(b,ue,b.defer,a.angular.callbacks,c[0])}]}function ve(b,a,c,d,e){function g(a,b){var c=e.createElement("script"),d=function(){c.onreadystatechange= -c.onload=c.onerror=null;e.body.removeChild(c);b&&b()};c.type="text/javascript";c.src=a;S&&8>=S?c.onreadystatechange=function(){/loaded|complete/.test(c.readyState)&&d()}:c.onload=c.onerror=function(){d()};e.body.appendChild(c);return d}var f=-1;return function(e,l,k,m,n,p,r,z){function u(){v=f;A&&A();x&&x.abort()}function F(a,d,e,g,f){L&&c.cancel(L);A=x=null;0===d&&(d=e?200:"file"==sa(l).protocol?404:0);a(1223===d?204:d,e,g,f||"");b.$$completeOutstandingRequest(C)}var v;b.$$incOutstandingRequestCount(); -l=l||b.url();if("jsonp"==K(e)){var J="_"+(d.counter++).toString(36);d[J]=function(a){d[J].data=a};var A=g(l.replace("JSON_CALLBACK","angular.callbacks."+J),function(){d[J].data?F(m,200,d[J].data):F(m,v||-2);d[J]=Ea.noop})}else{var x=a(e);x.open(e,l,!0);q(n,function(a,b){B(a)&&x.setRequestHeader(b,a)});x.onreadystatechange=function(){if(x&&4==x.readyState){var a=null,b=null;v!==f&&(a=x.getAllResponseHeaders(),b="response"in x?x.response:x.responseText);F(m,v||x.status,b,a,x.statusText||"")}};r&&(x.withCredentials= -!0);if(z)try{x.responseType=z}catch(s){if("json"!==z)throw s;}x.send(k||null)}if(0=h&&(n.resolve(r),m(p.$$intervalId),delete e[p.$$intervalId]);z||b.$apply()},f);e[p.$$intervalId]=n;return p}var e={};d.cancel=function(a){return a&&a.$$intervalId in e?(e[a.$$intervalId].reject("canceled"),clearInterval(a.$$intervalId),delete e[a.$$intervalId], -!0):!1};return d}]}function ad(){this.$get=function(){return{id:"en-us",NUMBER_FORMATS:{DECIMAL_SEP:".",GROUP_SEP:",",PATTERNS:[{minInt:1,minFrac:0,maxFrac:3,posPre:"",posSuf:"",negPre:"-",negSuf:"",gSize:3,lgSize:3},{minInt:1,minFrac:2,maxFrac:2,posPre:"\u00a4",posSuf:"",negPre:"(\u00a4",negSuf:")",gSize:3,lgSize:3}],CURRENCY_SYM:"$"},DATETIME_FORMATS:{MONTH:"January February March April May June July August September October November December".split(" "),SHORTMONTH:"Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec".split(" "), -DAY:"Sunday Monday Tuesday Wednesday Thursday Friday Saturday".split(" "),SHORTDAY:"Sun Mon Tue Wed Thu Fri Sat".split(" "),AMPMS:["AM","PM"],medium:"MMM d, y h:mm:ss a","short":"M/d/yy h:mm a",fullDate:"EEEE, MMMM d, y",longDate:"MMMM d, y",mediumDate:"MMM d, y",shortDate:"M/d/yy",mediumTime:"h:mm:ss a",shortTime:"h:mm a"},pluralCat:function(b){return 1===b?"one":"other"}}}}function wc(b){b=b.split("/");for(var a=b.length;a--;)b[a]=wb(b[a]);return b.join("/")}function xc(b,a,c){b=sa(b,c);a.$$protocol= -b.protocol;a.$$host=b.hostname;a.$$port=Y(b.port)||we[b.protocol]||null}function yc(b,a,c){var d="/"!==b.charAt(0);d&&(b="/"+b);b=sa(b,c);a.$$path=decodeURIComponent(d&&"/"===b.pathname.charAt(0)?b.pathname.substring(1):b.pathname);a.$$search=Yb(b.search);a.$$hash=decodeURIComponent(b.hash);a.$$path&&"/"!=a.$$path.charAt(0)&&(a.$$path="/"+a.$$path)}function oa(b,a){if(0===a.indexOf(b))return a.substr(b.length)}function Ya(b){var a=b.indexOf("#");return-1==a?b:b.substr(0,a)}function Jb(b){return b.substr(0, -Ya(b).lastIndexOf("/")+1)}function zc(b,a){this.$$html5=!0;a=a||"";var c=Jb(b);xc(b,this,b);this.$$parse=function(a){var e=oa(c,a);if(!w(e))throw Kb("ipthprfx",a,c);yc(e,this,b);this.$$path||(this.$$path="/");this.$$compose()};this.$$compose=function(){var a=Zb(this.$$search),b=this.$$hash?"#"+wb(this.$$hash):"";this.$$url=wc(this.$$path)+(a?"?"+a:"")+b;this.$$absUrl=c+this.$$url.substr(1)};this.$$rewrite=function(d){var e;if((e=oa(b,d))!==s)return d=e,(e=oa(a,e))!==s?c+(oa("/",e)||e):b+d;if((e=oa(c, -d))!==s)return c+e;if(c==d+"/")return c}}function Lb(b,a){var c=Jb(b);xc(b,this,b);this.$$parse=function(d){var e=oa(b,d)||oa(c,d),e="#"==e.charAt(0)?oa(a,e):this.$$html5?e:"";if(!w(e))throw Kb("ihshprfx",d,a);yc(e,this,b);d=this.$$path;var g=/^\/?.*?:(\/.*)/;0===e.indexOf(b)&&(e=e.replace(b,""));g.exec(e)||(d=(e=g.exec(d))?e[1]:d);this.$$path=d;this.$$compose()};this.$$compose=function(){var c=Zb(this.$$search),e=this.$$hash?"#"+wb(this.$$hash):"";this.$$url=wc(this.$$path)+(c?"?"+c:"")+e;this.$$absUrl= -b+(this.$$url?a+this.$$url:"")};this.$$rewrite=function(a){if(Ya(b)==Ya(a))return a}}function Ac(b,a){this.$$html5=!0;Lb.apply(this,arguments);var c=Jb(b);this.$$rewrite=function(d){var e;if(b==Ya(d))return d;if(e=oa(c,d))return b+a+e;if(c===d+"/")return c}}function nb(b){return function(){return this[b]}}function Bc(b,a){return function(c){if(E(c))return this[b];this[b]=a(c);this.$$compose();return this}}function Vd(){var b="",a=!1;this.hashPrefix=function(a){return B(a)?(b=a,this):b};this.html5Mode= -function(b){return B(b)?(a=b,this):a};this.$get=["$rootScope","$browser","$sniffer","$rootElement",function(c,d,e,g){function f(a){c.$broadcast("$locationChangeSuccess",h.absUrl(),a)}var h,l=d.baseHref(),k=d.url();a?(l=k.substring(0,k.indexOf("/",k.indexOf("//")+2))+(l||"/"),e=e.history?zc:Ac):(l=Ya(k),e=Lb);h=new e(l,"#"+b);h.$$parse(h.$$rewrite(k));g.on("click",function(a){if(!a.ctrlKey&&!a.metaKey&&2!=a.which){for(var b=y(a.target);"a"!==K(b[0].nodeName);)if(b[0]===g[0]||!(b=b.parent())[0])return; -var e=b.prop("href");X(e)&&"[object SVGAnimatedString]"===e.toString()&&(e=sa(e.animVal).href);var f=h.$$rewrite(e);e&&(!b.attr("target")&&f&&!a.isDefaultPrevented())&&(a.preventDefault(),f!=d.url()&&(h.$$parse(f),c.$apply(),O.angular["ff-684208-preventDefault"]=!0))}});h.absUrl()!=k&&d.url(h.absUrl(),!0);d.onUrlChange(function(a){h.absUrl()!=a&&(c.$evalAsync(function(){var b=h.absUrl();h.$$parse(a);c.$broadcast("$locationChangeStart",a,b).defaultPrevented?(h.$$parse(b),d.url(b)):f(b)}),c.$$phase|| -c.$digest())});var m=0;c.$watch(function(){var a=d.url(),b=h.$$replace;m&&a==h.absUrl()||(m++,c.$evalAsync(function(){c.$broadcast("$locationChangeStart",h.absUrl(),a).defaultPrevented?h.$$parse(a):(d.url(h.absUrl(),b),f(a))}));h.$$replace=!1;return m});return h}]}function Wd(){var b=!0,a=this;this.debugEnabled=function(a){return B(a)?(b=a,this):b};this.$get=["$window",function(c){function d(a){a instanceof Error&&(a.stack?a=a.message&&-1===a.stack.indexOf(a.message)?"Error: "+a.message+"\n"+a.stack: -a.stack:a.sourceURL&&(a=a.message+"\n"+a.sourceURL+":"+a.line));return a}function e(a){var b=c.console||{},e=b[a]||b.log||C;a=!1;try{a=!!e.apply}catch(l){}return a?function(){var a=[];q(arguments,function(b){a.push(d(b))});return e.apply(b,a)}:function(a,b){e(a,null==b?"":b)}}return{log:e("log"),info:e("info"),warn:e("warn"),error:e("error"),debug:function(){var c=e("debug");return function(){b&&c.apply(a,arguments)}}()}}]}function fa(b,a){if("constructor"===b)throw Ba("isecfld",a);return b}function Za(b, -a){if(b){if(b.constructor===b)throw Ba("isecfn",a);if(b.document&&b.location&&b.alert&&b.setInterval)throw Ba("isecwindow",a);if(b.children&&(b.nodeName||b.prop&&b.attr&&b.find))throw Ba("isecdom",a);}return b}function ob(b,a,c,d,e){e=e||{};a=a.split(".");for(var g,f=0;1e?Cc(d[0],d[1],d[2],d[3],d[4],c,a):function(b,g){var f=0,h;do h=Cc(d[f++],d[f++],d[f++],d[f++],d[f++],c,a)(b,g),g=s,b=h;while(fa)for(b in l++,e)e.hasOwnProperty(b)&&!d.hasOwnProperty(b)&&(q--,delete e[b])}else e!==d&&(e=d,l++);return l},function(){p?(p=!1,b(d,d,c)):b(d,f,c);if(h)if(X(d))if(ab(d)){f=Array(d.length);for(var a=0;as&&(y=4-s,Q[y]||(Q[y]=[]),H=P(d.exp)?"fn: "+(d.exp.name||d.exp.toString()):d.exp,H+="; newVal: "+qa(g)+"; oldVal: "+qa(f),Q[y].push(H));else if(d===c){x=!1;break a}}catch(w){p.$$phase= -null,e(w)}if(!(h=L.$$childHead||L!==this&&L.$$nextSibling))for(;L!==this&&!(h=L.$$nextSibling);)L=L.$parent}while(L=h);if((x||k.length)&&!s--)throw p.$$phase=null,a("infdig",b,qa(Q));}while(x||k.length);for(p.$$phase=null;m.length;)try{m.shift()()}catch(T){e(T)}},$destroy:function(){if(!this.$$destroyed){var a=this.$parent;this.$broadcast("$destroy");this.$$destroyed=!0;this!==p&&(q(this.$$listenerCount,eb(null,m,this)),a.$$childHead==this&&(a.$$childHead=this.$$nextSibling),a.$$childTail==this&& -(a.$$childTail=this.$$prevSibling),this.$$prevSibling&&(this.$$prevSibling.$$nextSibling=this.$$nextSibling),this.$$nextSibling&&(this.$$nextSibling.$$prevSibling=this.$$prevSibling),this.$parent=this.$$nextSibling=this.$$prevSibling=this.$$childHead=this.$$childTail=this.$root=null,this.$$listeners={},this.$$watchers=this.$$asyncQueue=this.$$postDigestQueue=[],this.$destroy=this.$digest=this.$apply=C,this.$on=this.$watch=function(){return C})}},$eval:function(a,b){return g(a)(this,b)},$evalAsync:function(a){p.$$phase|| -p.$$asyncQueue.length||f.defer(function(){p.$$asyncQueue.length&&p.$digest()});this.$$asyncQueue.push({scope:this,expression:a})},$$postDigest:function(a){this.$$postDigestQueue.push(a)},$apply:function(a){try{return l("$apply"),this.$eval(a)}catch(b){e(b)}finally{p.$$phase=null;try{p.$digest()}catch(c){throw e(c),c;}}},$on:function(a,b){var c=this.$$listeners[a];c||(this.$$listeners[a]=c=[]);c.push(b);var d=this;do d.$$listenerCount[a]||(d.$$listenerCount[a]=0),d.$$listenerCount[a]++;while(d=d.$parent); -var e=this;return function(){c[db(c,b)]=null;m(e,1,a)}},$emit:function(a,b){var c=[],d,g=this,f=!1,h={name:a,targetScope:g,stopPropagation:function(){f=!0},preventDefault:function(){h.defaultPrevented=!0},defaultPrevented:!1},l=[h].concat(ya.call(arguments,1)),k,m;do{d=g.$$listeners[a]||c;h.currentScope=g;k=0;for(m=d.length;kc.msieDocumentMode)throw ua("iequirks");var e=ba(ga);e.isEnabled=function(){return b};e.trustAs=d.trustAs;e.getTrusted=d.getTrusted;e.valueOf=d.valueOf;b||(e.trustAs=e.getTrusted=function(a,b){return b},e.valueOf=Da);e.parseAs=function(b,c){var d=a(c);return d.literal&&d.constant?d:function(a,c){return e.getTrusted(b, -d(a,c))}};var g=e.parseAs,f=e.getTrusted,h=e.trustAs;q(ga,function(a,b){var c=K(b);e[Ta("parse_as_"+c)]=function(b){return g(a,b)};e[Ta("get_trusted_"+c)]=function(b){return f(a,b)};e[Ta("trust_as_"+c)]=function(b){return h(a,b)}});return e}]}function be(){this.$get=["$window","$document",function(b,a){var c={},d=Y((/android (\d+)/.exec(K((b.navigator||{}).userAgent))||[])[1]),e=/Boxee/i.test((b.navigator||{}).userAgent),g=a[0]||{},f=g.documentMode,h,l=/^(Moz|webkit|O|ms)(?=[A-Z])/,k=g.body&&g.body.style, -m=!1,n=!1;if(k){for(var p in k)if(m=l.exec(p)){h=m[0];h=h.substr(0,1).toUpperCase()+h.substr(1);break}h||(h="WebkitOpacity"in k&&"webkit");m=!!("transition"in k||h+"Transition"in k);n=!!("animation"in k||h+"Animation"in k);!d||m&&n||(m=w(g.body.style.webkitTransition),n=w(g.body.style.webkitAnimation))}return{history:!(!b.history||!b.history.pushState||4>d||e),hashchange:"onhashchange"in b&&(!f||7b;b=Math.abs(b);var f=b+"",h="",l=[],k=!1;if(-1!==f.indexOf("e")){var m=f.match(/([\d\.]+)e(-?)(\d+)/);m&&"-"==m[2]&&m[3]>e+1?f="0":(h=f,k=!0)}if(k)0b)&&(h=b.toFixed(e)); -else{f=(f.split(Nc)[1]||"").length;E(e)&&(e=Math.min(Math.max(a.minFrac,f),a.maxFrac));f=Math.pow(10,e);b=Math.round(b*f)/f;b=(""+b).split(Nc);f=b[0];b=b[1]||"";var m=0,n=a.lgSize,p=a.gSize;if(f.length>=n+p)for(m=f.length-n,k=0;kb&&(d="-",b=-b);for(b=""+b;b.length-c)e+=c;0===e&&-12==c&&(e=12);return Ob(e,a,d)}}function pb(b,a){return function(c,d){var e=c["get"+b](),g=Fa(a?"SHORT"+b:b);return d[g][e]}}function Jc(b){function a(a){var b;if(b=a.match(c)){a=new Date(0);var g=0,f=0,h=b[8]?a.setUTCFullYear:a.setFullYear,l=b[8]?a.setUTCHours:a.setHours;b[9]&&(g=Y(b[9]+b[10]),f=Y(b[9]+b[11])); -h.call(a,Y(b[1]),Y(b[2])-1,Y(b[3]));g=Y(b[4]||0)-g;f=Y(b[5]||0)-f;h=Y(b[6]||0);b=Math.round(1E3*parseFloat("0."+(b[7]||0)));l.call(a,g,f,h,b)}return a}var c=/^(\d{4})-?(\d\d)-?(\d\d)(?:T(\d\d)(?::?(\d\d)(?::?(\d\d)(?:\.(\d+))?)?)?(Z|([+-])(\d\d):?(\d\d))?)?$/;return function(c,e){var g="",f=[],h,l;e=e||"mediumDate";e=b.DATETIME_FORMATS[e]||e;w(c)&&(c=Ge.test(c)?Y(c):a(c));vb(c)&&(c=new Date(c));if(!Na(c))return c;for(;e;)(l=He.exec(e))?(f=f.concat(ya.call(l,1)),e=f.pop()):(f.push(e),e=null);q(f,function(a){h= -Ie[a];g+=h?h(c,b.DATETIME_FORMATS):a.replace(/(^'|'$)/g,"").replace(/''/g,"'")});return g}}function Ce(){return function(b){return qa(b,!0)}}function De(){return function(b,a){if(!M(b)&&!w(b))return b;a=Y(a);if(w(b))return a?0<=a?b.slice(0,a):b.slice(a,b.length):"";var c=[],d,e;a>b.length?a=b.length:a<-b.length&&(a=-b.length);0a||37<=a&&40>=a)||m()});if(e.hasEvent("paste"))a.on("paste cut",m)}a.on("change",l);d.$render=function(){a.val(d.$isEmpty(d.$viewValue)? -"":d.$viewValue)};var n=c.ngPattern;n&&((e=n.match(/^\/(.*)\/([gim]*)$/))?(n=RegExp(e[1],e[2]),e=function(a){return pa(d,"pattern",d.$isEmpty(a)||n.test(a),a)}):e=function(c){var e=b.$eval(n);if(!e||!e.test)throw t("ngPattern")("noregexp",n,e,ha(a));return pa(d,"pattern",d.$isEmpty(c)||e.test(c),c)},d.$formatters.push(e),d.$parsers.push(e));if(c.ngMinlength){var p=Y(c.ngMinlength);e=function(a){return pa(d,"minlength",d.$isEmpty(a)||a.length>=p,a)};d.$parsers.push(e);d.$formatters.push(e)}if(c.ngMaxlength){var r= -Y(c.ngMaxlength);e=function(a){return pa(d,"maxlength",d.$isEmpty(a)||a.length<=r,a)};d.$parsers.push(e);d.$formatters.push(e)}}function Pb(b,a){b="ngClass"+b;return["$animate",function(c){function d(a,b){var c=[],d=0;a:for(;dS?function(b){b=b.nodeName?b:b[0];return b.scopeName&&"HTML"!=b.scopeName?Fa(b.scopeName+":"+b.nodeName):b.nodeName}:function(b){return b.nodeName?b.nodeName:b[0].nodeName};var Xc=/[A-Z]/g,$c={full:"1.2.16",major:1,minor:2,dot:16,codeName:"badger-enumeration"},Ua=N.cache={},gb=N.expando="ng-"+(new Date).getTime(), -me=1,Pc=O.document.addEventListener?function(b,a,c){b.addEventListener(a,c,!1)}:function(b,a,c){b.attachEvent("on"+a,c)},Fb=O.document.removeEventListener?function(b,a,c){b.removeEventListener(a,c,!1)}:function(b,a,c){b.detachEvent("on"+a,c)};N._data=function(b){return this.cache[b[this.expando]]||{}};var he=/([\:\-\_]+(.))/g,ie=/^moz([A-Z])/,Bb=t("jqLite"),je=/^<(\w+)\s*\/?>(?:<\/\1>|)$/,Cb=/<|&#?\w+;/,ke=/<([\w:]+)/,le=/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/gi,ea= -{option:[1,'"],thead:[1,"","
    "],col:[2,"","
    "],tr:[2,"","
    "],td:[3,"","
    "],_default:[0,"",""]};ea.optgroup=ea.option;ea.tbody=ea.tfoot=ea.colgroup=ea.caption=ea.thead;ea.th=ea.td;var Ja=N.prototype={ready:function(b){function a(){c||(c=!0,b())}var c=!1;"complete"===U.readyState?setTimeout(a):(this.on("DOMContentLoaded",a),N(O).on("load",a))},toString:function(){var b= -[];q(this,function(a){b.push(""+a)});return"["+b.join(", ")+"]"},eq:function(b){return 0<=b?y(this[b]):y(this[this.length+b])},length:0,push:Ke,sort:[].sort,splice:[].splice},kb={};q("multiple selected checked disabled readOnly required open".split(" "),function(b){kb[K(b)]=b});var nc={};q("input select option textarea button form details".split(" "),function(b){nc[Fa(b)]=!0});q({data:jc,inheritedData:jb,scope:function(b){return y(b).data("$scope")||jb(b.parentNode||b,["$isolateScope","$scope"])}, -isolateScope:function(b){return y(b).data("$isolateScope")||y(b).data("$isolateScopeNoTemplate")},controller:kc,injector:function(b){return jb(b,"$injector")},removeAttr:function(b,a){b.removeAttribute(a)},hasClass:Gb,css:function(b,a,c){a=Ta(a);if(B(c))b.style[a]=c;else{var d;8>=S&&(d=b.currentStyle&&b.currentStyle[a],""===d&&(d="auto"));d=d||b.style[a];8>=S&&(d=""===d?s:d);return d}},attr:function(b,a,c){var d=K(a);if(kb[d])if(B(c))c?(b[a]=!0,b.setAttribute(a,d)):(b[a]=!1,b.removeAttribute(d)); -else return b[a]||(b.attributes.getNamedItem(a)||C).specified?d:s;else if(B(c))b.setAttribute(a,c);else if(b.getAttribute)return b=b.getAttribute(a,2),null===b?s:b},prop:function(b,a,c){if(B(c))b[a]=c;else return b[a]},text:function(){function b(b,d){var e=a[b.nodeType];if(E(d))return e?b[e]:"";b[e]=d}var a=[];9>S?(a[1]="innerText",a[3]="nodeValue"):a[1]=a[3]="textContent";b.$dv="";return b}(),val:function(b,a){if(E(a)){if("SELECT"===Ka(b)&&b.multiple){var c=[];q(b.options,function(a){a.selected&& -c.push(a.value||a.text)});return 0===c.length?null:c}return b.value}b.value=a},html:function(b,a){if(E(a))return b.innerHTML;for(var c=0,d=b.childNodes;c":function(a,c,d,e){return d(a,c)>e(a,c)},"<=":function(a,c,d,e){return d(a,c)<=e(a,c)},">=":function(a,c,d,e){return d(a,c)>=e(a,c)},"&&":function(a,c,d,e){return d(a,c)&&e(a,c)},"||":function(a,c,d,e){return d(a,c)||e(a,c)},"&":function(a,c,d,e){return d(a,c)&e(a,c)},"|":function(a,c,d,e){return e(a,c)(a,c,d(a,c))},"!":function(a,c,d){return!d(a,c)}},Ne={n:"\n",f:"\f",r:"\r",t:"\t",v:"\v","'":"'",'"':'"'}, -Nb=function(a){this.options=a};Nb.prototype={constructor:Nb,lex:function(a){this.text=a;this.index=0;this.ch=s;this.lastCh=":";this.tokens=[];var c;for(a=[];this.index=a},isWhitespace:function(a){return" "===a||"\r"===a||"\t"===a||"\n"===a||"\v"===a||"\u00a0"=== -a},isIdent:function(a){return"a"<=a&&"z">=a||"A"<=a&&"Z">=a||"_"===a||"$"===a},isExpOperator:function(a){return"-"===a||"+"===a||this.isNumber(a)},throwError:function(a,c,d){d=d||this.index;c=B(c)?"s "+c+"-"+this.index+" ["+this.text.substring(c,d)+"]":" "+d;throw Ba("lexerr",a,c,this.text);},readNumber:function(){for(var a="",c=this.index;this.index","<=",">="))a=this.binaryFn(a,c.fn,this.relational());return a},additive:function(){for(var a=this.multiplicative(),c;c=this.expect("+","-");)a=this.binaryFn(a,c.fn,this.multiplicative());return a},multiplicative:function(){for(var a=this.unary(),c;c=this.expect("*","/","%");)a=this.binaryFn(a,c.fn,this.unary());return a},unary:function(){var a;return this.expect("+")?this.primary():(a=this.expect("-"))?this.binaryFn($a.ZERO,a.fn, -this.unary()):(a=this.expect("!"))?this.unaryFn(a.fn,this.unary()):this.primary()},fieldAccess:function(a){var c=this,d=this.expect().text,e=Dc(d,this.options,this.text);return D(function(c,d,h){return e(h||a(c,d))},{assign:function(e,f,h){return ob(a(e,h),d,f,c.text,c.options)}})},objectIndex:function(a){var c=this,d=this.expression();this.consume("]");return D(function(e,g){var f=a(e,g),h=d(e,g),l;if(!f)return s;(f=Za(f[h],c.text))&&(f.then&&c.options.unwrapPromises)&&(l=f,"$$v"in f||(l.$$v=s,l.then(function(a){l.$$v= -a})),f=f.$$v);return f},{assign:function(e,g,f){var h=d(e,f);return Za(a(e,f),c.text)[h]=g}})},functionCall:function(a,c){var d=[];if(")"!==this.peekToken().text){do d.push(this.expression());while(this.expect(","))}this.consume(")");var e=this;return function(g,f){for(var h=[],l=c?c(g,f):g,k=0;ka.getHours()?c.AMPMS[0]:c.AMPMS[1]},Z:function(a){a=-1*a.getTimezoneOffset();return a=(0<=a?"+":"")+(Ob(Math[0=S&&(c.href||c.name||c.$set("href",""),a.append(U.createComment("IE fix")));if(!c.href&&!c.xlinkHref&&!c.name)return function(a,c){var g="[object SVGAnimatedString]"===wa.call(c.prop("href"))?"xlink:href":"href";c.on("click",function(a){c.attr(g)||a.preventDefault()})}}}),zb={};q(kb,function(a,c){if("multiple"!=a){var d=na("ng-"+c);zb[d]=function(){return{priority:100,link:function(a,g,f){a.$watch(f[d],function(a){f.$set(c,!!a)})}}}}});q(["src", -"srcset","href"],function(a){var c=na("ng-"+a);zb[c]=function(){return{priority:99,link:function(d,e,g){var f=a,h=a;"href"===a&&"[object SVGAnimatedString]"===wa.call(e.prop("href"))&&(h="xlinkHref",g.$attr[h]="xlink:href",f=null);g.$observe(c,function(a){a&&(g.$set(h,a),S&&f&&e.prop(f,g[h]))})}}}});var sb={$addControl:C,$removeControl:C,$setValidity:C,$setDirty:C,$setPristine:C};Oc.$inject=["$element","$attrs","$scope","$animate"];var Qc=function(a){return["$timeout",function(c){return{name:"form", -restrict:a?"EAC":"E",controller:Oc,compile:function(){return{pre:function(a,e,g,f){if(!g.action){var h=function(a){a.preventDefault?a.preventDefault():a.returnValue=!1};Pc(e[0],"submit",h);e.on("$destroy",function(){c(function(){Fb(e[0],"submit",h)},0,!1)})}var l=e.parent().controller("form"),k=g.name||g.ngForm;k&&ob(a,k,f,k);if(l)e.on("$destroy",function(){l.$removeControl(f);k&&ob(a,k,s,k);D(f,sb)})}}}}}]},dd=Qc(),qd=Qc(!0),Oe=/^(ftp|http|https):\/\/(\w+:{0,1}\w*@)?(\S+)(:[0-9]+)?(\/|\/([\w#!:.?+=&%@!\-\/]))?$/, -Pe=/^[a-z0-9!#$%&'*+/=?^_`{|}~.-]+@[a-z0-9-]+(\.[a-z0-9-]+)*$/i,Qe=/^\s*(\-|\+)?(\d+|(\d*(\.\d*)))\s*$/,Rc={text:ub,number:function(a,c,d,e,g,f){ub(a,c,d,e,g,f);e.$parsers.push(function(a){var c=e.$isEmpty(a);if(c||Qe.test(a))return e.$setValidity("number",!0),""===a?null:c?a:parseFloat(a);e.$setValidity("number",!1);return s});Je(e,"number",c);e.$formatters.push(function(a){return e.$isEmpty(a)?"":""+a});d.min&&(a=function(a){var c=parseFloat(d.min);return pa(e,"min",e.$isEmpty(a)||a>=c,a)},e.$parsers.push(a), -e.$formatters.push(a));d.max&&(a=function(a){var c=parseFloat(d.max);return pa(e,"max",e.$isEmpty(a)||a<=c,a)},e.$parsers.push(a),e.$formatters.push(a));e.$formatters.push(function(a){return pa(e,"number",e.$isEmpty(a)||vb(a),a)})},url:function(a,c,d,e,g,f){ub(a,c,d,e,g,f);a=function(a){return pa(e,"url",e.$isEmpty(a)||Oe.test(a),a)};e.$formatters.push(a);e.$parsers.push(a)},email:function(a,c,d,e,g,f){ub(a,c,d,e,g,f);a=function(a){return pa(e,"email",e.$isEmpty(a)||Pe.test(a),a)};e.$formatters.push(a); -e.$parsers.push(a)},radio:function(a,c,d,e){E(d.name)&&c.attr("name",bb());c.on("click",function(){c[0].checked&&a.$apply(function(){e.$setViewValue(d.value)})});e.$render=function(){c[0].checked=d.value==e.$viewValue};d.$observe("value",e.$render)},checkbox:function(a,c,d,e){var g=d.ngTrueValue,f=d.ngFalseValue;w(g)||(g=!0);w(f)||(f=!1);c.on("click",function(){a.$apply(function(){e.$setViewValue(c[0].checked)})});e.$render=function(){c[0].checked=e.$viewValue};e.$isEmpty=function(a){return a!==g}; -e.$formatters.push(function(a){return a===g});e.$parsers.push(function(a){return a?g:f})},hidden:C,button:C,submit:C,reset:C,file:C},dc=["$browser","$sniffer",function(a,c){return{restrict:"E",require:"?ngModel",link:function(d,e,g,f){f&&(Rc[K(g.type)]||Rc.text)(d,e,g,f,c,a)}}}],rb="ng-valid",qb="ng-invalid",La="ng-pristine",tb="ng-dirty",Re=["$scope","$exceptionHandler","$attrs","$element","$parse","$animate",function(a,c,d,e,g,f){function h(a,c){c=c?"-"+fb(c,"-"):"";f.removeClass(e,(a?qb:rb)+c); -f.addClass(e,(a?rb:qb)+c)}this.$modelValue=this.$viewValue=Number.NaN;this.$parsers=[];this.$formatters=[];this.$viewChangeListeners=[];this.$pristine=!0;this.$dirty=!1;this.$valid=!0;this.$invalid=!1;this.$name=d.name;var l=g(d.ngModel),k=l.assign;if(!k)throw t("ngModel")("nonassign",d.ngModel,ha(e));this.$render=C;this.$isEmpty=function(a){return E(a)||""===a||null===a||a!==a};var m=e.inheritedData("$formController")||sb,n=0,p=this.$error={};e.addClass(La);h(!0);this.$setValidity=function(a,c){p[a]!== -!c&&(c?(p[a]&&n--,n||(h(!0),this.$valid=!0,this.$invalid=!1)):(h(!1),this.$invalid=!0,this.$valid=!1,n++),p[a]=!c,h(c,a),m.$setValidity(a,c,this))};this.$setPristine=function(){this.$dirty=!1;this.$pristine=!0;f.removeClass(e,tb);f.addClass(e,La)};this.$setViewValue=function(d){this.$viewValue=d;this.$pristine&&(this.$dirty=!0,this.$pristine=!1,f.removeClass(e,La),f.addClass(e,tb),m.$setDirty());q(this.$parsers,function(a){d=a(d)});this.$modelValue!==d&&(this.$modelValue=d,k(a,d),q(this.$viewChangeListeners, -function(a){try{a()}catch(d){c(d)}}))};var r=this;a.$watch(function(){var c=l(a);if(r.$modelValue!==c){var d=r.$formatters,e=d.length;for(r.$modelValue=c;e--;)c=d[e](c);r.$viewValue!==c&&(r.$viewValue=c,r.$render())}return c})}],Fd=function(){return{require:["ngModel","^?form"],controller:Re,link:function(a,c,d,e){var g=e[0],f=e[1]||sb;f.$addControl(g);a.$on("$destroy",function(){f.$removeControl(g)})}}},Hd=aa({require:"ngModel",link:function(a,c,d,e){e.$viewChangeListeners.push(function(){a.$eval(d.ngChange)})}}), -ec=function(){return{require:"?ngModel",link:function(a,c,d,e){if(e){d.required=!0;var g=function(a){if(d.required&&e.$isEmpty(a))e.$setValidity("required",!1);else return e.$setValidity("required",!0),a};e.$formatters.push(g);e.$parsers.unshift(g);d.$observe("required",function(){g(e.$viewValue)})}}}},Gd=function(){return{require:"ngModel",link:function(a,c,d,e){var g=(a=/\/(.*)\//.exec(d.ngList))&&RegExp(a[1])||d.ngList||",";e.$parsers.push(function(a){if(!E(a)){var c=[];a&&q(a.split(g),function(a){a&& -c.push(ca(a))});return c}});e.$formatters.push(function(a){return M(a)?a.join(", "):s});e.$isEmpty=function(a){return!a||!a.length}}}},Se=/^(true|false|\d+)$/,Id=function(){return{priority:100,compile:function(a,c){return Se.test(c.ngValue)?function(a,c,g){g.$set("value",a.$eval(g.ngValue))}:function(a,c,g){a.$watch(g.ngValue,function(a){g.$set("value",a)})}}}},id=va(function(a,c,d){c.addClass("ng-binding").data("$binding",d.ngBind);a.$watch(d.ngBind,function(a){c.text(a==s?"":a)})}),kd=["$interpolate", -function(a){return function(c,d,e){c=a(d.attr(e.$attr.ngBindTemplate));d.addClass("ng-binding").data("$binding",c);e.$observe("ngBindTemplate",function(a){d.text(a)})}}],jd=["$sce","$parse",function(a,c){return function(d,e,g){e.addClass("ng-binding").data("$binding",g.ngBindHtml);var f=c(g.ngBindHtml);d.$watch(function(){return(f(d)||"").toString()},function(c){e.html(a.getTrustedHtml(f(d))||"")})}}],ld=Pb("",!0),nd=Pb("Odd",0),md=Pb("Even",1),od=va({compile:function(a,c){c.$set("ngCloak",s);a.removeClass("ng-cloak")}}), -pd=[function(){return{scope:!0,controller:"@",priority:500}}],fc={};q("click dblclick mousedown mouseup mouseover mouseout mousemove mouseenter mouseleave keydown keyup keypress submit focus blur copy cut paste".split(" "),function(a){var c=na("ng-"+a);fc[c]=["$parse",function(d){return{compile:function(e,g){var f=d(g[c]);return function(c,d,e){d.on(K(a),function(a){c.$apply(function(){f(c,{$event:a})})})}}}}]});var sd=["$animate",function(a){return{transclude:"element",priority:600,terminal:!0,restrict:"A", -$$tlb:!0,link:function(c,d,e,g,f){var h,l,k;c.$watch(e.ngIf,function(g){Qa(g)?l||(l=c.$new(),f(l,function(c){c[c.length++]=U.createComment(" end ngIf: "+e.ngIf+" ");h={clone:c};a.enter(c,d.parent(),d)})):(k&&(k.remove(),k=null),l&&(l.$destroy(),l=null),h&&(k=yb(h.clone),a.leave(k,function(){k=null}),h=null))})}}}],td=["$http","$templateCache","$anchorScroll","$animate","$sce",function(a,c,d,e,g){return{restrict:"ECA",priority:400,terminal:!0,transclude:"element",controller:Ea.noop,compile:function(f, -h){var l=h.ngInclude||h.src,k=h.onload||"",m=h.autoscroll;return function(f,h,q,s,u){var F=0,v,y,A,x=function(){y&&(y.remove(),y=null);v&&(v.$destroy(),v=null);A&&(e.leave(A,function(){y=null}),y=A,A=null)};f.$watch(g.parseAsResourceUrl(l),function(g){var l=function(){!B(m)||m&&!f.$eval(m)||d()},q=++F;g?(a.get(g,{cache:c}).success(function(a){if(q===F){var c=f.$new();s.template=a;a=u(c,function(a){x();e.enter(a,null,h,l)});v=c;A=a;v.$emit("$includeContentLoaded");f.$eval(k)}}).error(function(){q=== -F&&x()}),f.$emit("$includeContentRequested")):(x(),s.template=null)})}}}}],Jd=["$compile",function(a){return{restrict:"ECA",priority:-400,require:"ngInclude",link:function(c,d,e,g){d.html(g.template);a(d.contents())(c)}}}],ud=va({priority:450,compile:function(){return{pre:function(a,c,d){a.$eval(d.ngInit)}}}}),vd=va({terminal:!0,priority:1E3}),wd=["$locale","$interpolate",function(a,c){var d=/{}/g;return{restrict:"EA",link:function(e,g,f){var h=f.count,l=f.$attr.when&&g.attr(f.$attr.when),k=f.offset|| -0,m=e.$eval(l)||{},n={},p=c.startSymbol(),r=c.endSymbol(),s=/^when(Minus)?(.+)$/;q(f,function(a,c){s.test(c)&&(m[K(c.replace("when","").replace("Minus","-"))]=g.attr(f.$attr[c]))});q(m,function(a,e){n[e]=c(a.replace(d,p+h+"-"+k+r))});e.$watch(function(){var c=parseFloat(e.$eval(h));if(isNaN(c))return"";c in m||(c=a.pluralCat(c-k));return n[c](e,g,!0)},function(a){g.text(a)})}}}],xd=["$parse","$animate",function(a,c){var d=t("ngRepeat");return{transclude:"element",priority:1E3,terminal:!0,$$tlb:!0, -link:function(e,g,f,h,l){var k=f.ngRepeat,m=k.match(/^\s*([\s\S]+?)\s+in\s+([\s\S]+?)(?:\s+track\s+by\s+([\s\S]+?))?\s*$/),n,p,r,s,u,F,v={$id:Ia};if(!m)throw d("iexp",k);f=m[1];h=m[2];(m=m[3])?(n=a(m),p=function(a,c,d){F&&(v[F]=a);v[u]=c;v.$index=d;return n(e,v)}):(r=function(a,c){return Ia(c)},s=function(a){return a});m=f.match(/^(?:([\$\w]+)|\(([\$\w]+)\s*,\s*([\$\w]+)\))$/);if(!m)throw d("iidexp",f);u=m[3]||m[1];F=m[2];var B={};e.$watchCollection(h,function(a){var f,h,m=g[0],n,v={},H,R,w,C,T,t, -E=[];if(ab(a))T=a,n=p||r;else{n=p||s;T=[];for(w in a)a.hasOwnProperty(w)&&"$"!=w.charAt(0)&&T.push(w);T.sort()}H=T.length;h=E.length=T.length;for(f=0;fA;)z.pop().element.remove()}for(;x.length>I;)x.pop()[0].element.remove()}var k;if(!(k=t.match(d)))throw Te("iexp",t,ha(f));var l=c(k[2]||k[1]),m=k[4]||k[6],n=k[5],p=c(k[3]||""),q= -c(k[2]?k[1]:m),y=c(k[7]),w=k[8]?c(k[8]):null,x=[[{element:f,label:""}]];u&&(a(u)(e),u.removeClass("ng-scope"),u.remove());f.empty();f.on("change",function(){e.$apply(function(){var a,c=y(e)||[],d={},h,k,l,p,t,v,u;if(r)for(k=[],p=0,v=x.length;p@charset "UTF-8";[ng\\:cloak],[ng-cloak],[data-ng-cloak],[x-ng-cloak],.ng-cloak,.x-ng-cloak,.ng-hide{display:none !important;}ng\\:form{display:block;}.ng-animate-block-transitions{transition:0s all!important;-webkit-transition:0s all!important;}'); -//# sourceMappingURL=angular.min.js.map diff --git a/release-0.19.0/examples/update-demo/local/angular.min.js.map b/release-0.19.0/examples/update-demo/local/angular.min.js.map deleted file mode 100644 index 0dddf2aab5d..00000000000 --- a/release-0.19.0/examples/update-demo/local/angular.min.js.map +++ /dev/null @@ -1,8 +0,0 @@ -{ -"version":3, -"file":"angular.min.js", -"lineCount":209, -"mappings":"A;;;;;aAKC,SAAQ,CAACA,CAAD,CAASC,CAAT,CAAmBC,CAAnB,CAA8B,CA8BvCC,QAAAA,EAAAA,CAAAA,CAAAA,CAAAA,CAAAA,MAAAA,SAAAA,EAAAA,CAAAA,IAAAA,EAAAA,SAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA,EAAAA,GAAAA,EAAAA,CAAAA,CAAAA,CAAAA,CAAAA,GAAAA,CAAAA,EAAAA,EAAAA,CAAAA,CAAAA,uCAAAA,EAAAA,CAAAA,CAAAA,CAAAA,CAAAA,GAAAA,CAAAA,EAAAA,EAAAA,CAAAA,KAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA,SAAAA,OAAAA,CAAAA,CAAAA,EAAAA,CAAAA,CAAAA,CAAAA,CAAAA,EAAAA,CAAAA,EAAAA,CAAAA,CAAAA,GAAAA,CAAAA,GAAAA,EAAAA,GAAAA,EAAAA,CAAAA,CAAAA,CAAAA,EAAAA,GAAAA,CAAAA,kBAAAA,CAAAA,UAAAA,EAAAA,MAAAA,UAAAA,CAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,EAAAA,QAAAA,CAAAA,aAAAA,CAAAA,EAAAA,CAAAA,CAAAA,WAAAA,EAAAA,MAAAA,UAAAA,CAAAA,CAAAA,CAAAA,CAAAA,WAAAA,CAAAA,QAAAA,EAAAA,MAAAA,UAAAA,CAAAA,CAAAA,CAAAA,CAAAA,IAAAA,UAAAA,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,CAAAA,OAAAA,MAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAuOAC,QAASA,GAAW,CAACC,CAAD,CAAM,CACxB,GAAW,IAAX,EAAIA,CAAJ,EAAmBC,EAAA,CAASD,CAAT,CAAnB,CACE,MAAO,CAAA,CAGT;IAAIE,EAASF,CAAAE,OAEb,OAAqB,EAArB,GAAIF,CAAAG,SAAJ,EAA0BD,CAA1B,CACS,CAAA,CADT,CAIOE,CAAA,CAASJ,CAAT,CAJP,EAIwBK,CAAA,CAAQL,CAAR,CAJxB,EAImD,CAJnD,GAIwCE,CAJxC,EAKyB,QALzB,GAKO,MAAOA,EALd,EAK8C,CAL9C,CAKqCA,CALrC,EAKoDA,CALpD,CAK6D,CAL7D,GAKmEF,EAZ3C,CA4C1BM,QAASA,EAAO,CAACN,CAAD,CAAMO,CAAN,CAAgBC,CAAhB,CAAyB,CACvC,IAAIC,CACJ,IAAIT,CAAJ,CACE,GAAIU,CAAA,CAAWV,CAAX,CAAJ,CACE,IAAKS,CAAL,GAAYT,EAAZ,CAGa,WAAX,EAAIS,CAAJ,GAAiC,QAAjC,EAA0BA,CAA1B,EAAoD,MAApD,EAA6CA,CAA7C,EAAgET,CAAAW,eAAhE,EAAsF,CAAAX,CAAAW,eAAA,CAAmBF,CAAnB,CAAtF,GACEF,CAAAK,KAAA,CAAcJ,CAAd,CAAuBR,CAAA,CAAIS,CAAJ,CAAvB,CAAiCA,CAAjC,CALN,KAQO,IAAIT,CAAAM,QAAJ,EAAmBN,CAAAM,QAAnB,GAAmCA,CAAnC,CACLN,CAAAM,QAAA,CAAYC,CAAZ,CAAsBC,CAAtB,CADK,KAEA,IAAIT,EAAA,CAAYC,CAAZ,CAAJ,CACL,IAAKS,CAAL,CAAW,CAAX,CAAcA,CAAd,CAAoBT,CAAAE,OAApB,CAAgCO,CAAA,EAAhC,CACEF,CAAAK,KAAA,CAAcJ,CAAd,CAAuBR,CAAA,CAAIS,CAAJ,CAAvB,CAAiCA,CAAjC,CAFG,KAIL,KAAKA,CAAL,GAAYT,EAAZ,CACMA,CAAAW,eAAA,CAAmBF,CAAnB,CAAJ,EACEF,CAAAK,KAAA,CAAcJ,CAAd,CAAuBR,CAAA,CAAIS,CAAJ,CAAvB,CAAiCA,CAAjC,CAKR,OAAOT,EAxBgC,CA2BzCa,QAASA,GAAU,CAACb,CAAD,CAAM,CACvB,IAAIc,EAAO,EAAX,CACSL,CAAT,KAASA,CAAT,GAAgBT,EAAhB,CACMA,CAAAW,eAAA,CAAmBF,CAAnB,CAAJ,EACEK,CAAAC,KAAA,CAAUN,CAAV,CAGJ,OAAOK,EAAAE,KAAA,EAPgB,CAUzBC,QAASA,GAAa,CAACjB,CAAD;AAAMO,CAAN,CAAgBC,CAAhB,CAAyB,CAE7C,IADA,IAAIM,EAAOD,EAAA,CAAWb,CAAX,CAAX,CACUkB,EAAI,CAAd,CAAiBA,CAAjB,CAAqBJ,CAAAZ,OAArB,CAAkCgB,CAAA,EAAlC,CACEX,CAAAK,KAAA,CAAcJ,CAAd,CAAuBR,CAAA,CAAIc,CAAA,CAAKI,CAAL,CAAJ,CAAvB,CAAqCJ,CAAA,CAAKI,CAAL,CAArC,CAEF,OAAOJ,EALsC,CAc/CK,QAASA,GAAa,CAACC,CAAD,CAAa,CACjC,MAAO,SAAQ,CAACC,CAAD,CAAQZ,CAAR,CAAa,CAAEW,CAAA,CAAWX,CAAX,CAAgBY,CAAhB,CAAF,CADK,CAYnCC,QAASA,GAAO,EAAG,CAIjB,IAHA,IAAIC,EAAQC,EAAAtB,OAAZ,CACIuB,CAEJ,CAAMF,CAAN,CAAA,CAAa,CACXA,CAAA,EACAE,EAAA,CAAQD,EAAA,CAAID,CAAJ,CAAAG,WAAA,CAAsB,CAAtB,CACR,IAAa,EAAb,EAAID,CAAJ,CAEE,MADAD,GAAA,CAAID,CAAJ,CACO,CADM,GACN,CAAAC,EAAAG,KAAA,CAAS,EAAT,CAET,IAAa,EAAb,EAAIF,CAAJ,CACED,EAAA,CAAID,CAAJ,CAAA,CAAa,GADf,KAIE,OADAC,GAAA,CAAID,CAAJ,CACO,CADMK,MAAAC,aAAA,CAAoBJ,CAApB,CAA4B,CAA5B,CACN,CAAAD,EAAAG,KAAA,CAAS,EAAT,CAXE,CAcbH,EAAAM,QAAA,CAAY,GAAZ,CACA,OAAON,GAAAG,KAAA,CAAS,EAAT,CAnBU,CA4BnBI,QAASA,GAAU,CAAC/B,CAAD,CAAMgC,CAAN,CAAS,CACtBA,CAAJ,CACEhC,CAAAiC,UADF,CACkBD,CADlB,CAIE,OAAOhC,CAAAiC,UALiB,CAuB5BC,QAASA,EAAM,CAACC,CAAD,CAAM,CACnB,IAAIH,EAAIG,CAAAF,UACR3B,EAAA,CAAQ8B,SAAR,CAAmB,QAAQ,CAACpC,CAAD,CAAK,CAC1BA,CAAJ,GAAYmC,CAAZ,EACE7B,CAAA,CAAQN,CAAR,CAAa,QAAQ,CAACqB,CAAD,CAAQZ,CAAR,CAAY,CAC/B0B,CAAA,CAAI1B,CAAJ,CAAA,CAAWY,CADoB,CAAjC,CAF4B,CAAhC,CAQAU,GAAA,CAAWI,CAAX,CAAeH,CAAf,CACA,OAAOG,EAXY,CAcrBE,QAASA,EAAG,CAACC,CAAD,CAAM,CAChB,MAAOC,SAAA,CAASD,CAAT;AAAc,EAAd,CADS,CAKlBE,QAASA,GAAO,CAACC,CAAD,CAASC,CAAT,CAAgB,CAC9B,MAAOR,EAAA,CAAO,KAAKA,CAAA,CAAO,QAAQ,EAAG,EAAlB,CAAsB,WAAWO,CAAX,CAAtB,CAAL,CAAP,CAA0DC,CAA1D,CADuB,CAoBhCC,QAASA,EAAI,EAAG,EAoBhBC,QAASA,GAAQ,CAACC,CAAD,CAAI,CAAC,MAAOA,EAAR,CAIrBC,QAASA,GAAO,CAACzB,CAAD,CAAQ,CAAC,MAAO,SAAQ,EAAG,CAAC,MAAOA,EAAR,CAAnB,CAcxB0B,QAASA,EAAW,CAAC1B,CAAD,CAAO,CAAC,MAAwB,WAAxB,GAAO,MAAOA,EAAf,CAe3B2B,QAASA,EAAS,CAAC3B,CAAD,CAAO,CAAC,MAAwB,WAAxB,GAAO,MAAOA,EAAf,CAgBzB4B,QAASA,EAAQ,CAAC5B,CAAD,CAAO,CAAC,MAAgB,KAAhB,EAAOA,CAAP,EAAyC,QAAzC,GAAwB,MAAOA,EAAhC,CAexBjB,QAASA,EAAQ,CAACiB,CAAD,CAAO,CAAC,MAAwB,QAAxB,GAAO,MAAOA,EAAf,CAexB6B,QAASA,GAAQ,CAAC7B,CAAD,CAAO,CAAC,MAAwB,QAAxB,GAAO,MAAOA,EAAf,CAexB8B,QAASA,GAAM,CAAC9B,CAAD,CAAO,CACpB,MAAgC,eAAhC,GAAO+B,EAAAxC,KAAA,CAAcS,CAAd,CADa,CAiBtBhB,QAASA,EAAO,CAACgB,CAAD,CAAQ,CACtB,MAAgC,gBAAhC,GAAO+B,EAAAxC,KAAA,CAAcS,CAAd,CADe,CAiBxBX,QAASA,EAAU,CAACW,CAAD,CAAO,CAAC,MAAwB,UAAxB,GAAO,MAAOA,EAAf,CA9lBa;AAwmBvCgC,QAASA,GAAQ,CAAChC,CAAD,CAAQ,CACvB,MAAgC,iBAAhC,GAAO+B,EAAAxC,KAAA,CAAcS,CAAd,CADgB,CAYzBpB,QAASA,GAAQ,CAACD,CAAD,CAAM,CACrB,MAAOA,EAAP,EAAcA,CAAAJ,SAAd,EAA8BI,CAAAsD,SAA9B,EAA8CtD,CAAAuD,MAA9C,EAA2DvD,CAAAwD,YADtC,CAoDvBC,QAASA,GAAS,CAACC,CAAD,CAAO,CACvB,MAAO,EAAGA,CAAAA,CAAH,EACJ,EAAAA,CAAAC,SAAA,EACGD,CAAAE,KADH,EACgBF,CAAAG,KADhB,EAC6BH,CAAAI,KAD7B,CADI,CADgB,CA+BzBC,QAASA,GAAG,CAAC/D,CAAD,CAAMO,CAAN,CAAgBC,CAAhB,CAAyB,CACnC,IAAIwD,EAAU,EACd1D,EAAA,CAAQN,CAAR,CAAa,QAAQ,CAACqB,CAAD,CAAQE,CAAR,CAAe0C,CAAf,CAAqB,CACxCD,CAAAjD,KAAA,CAAaR,CAAAK,KAAA,CAAcJ,CAAd,CAAuBa,CAAvB,CAA8BE,CAA9B,CAAqC0C,CAArC,CAAb,CADwC,CAA1C,CAGA,OAAOD,EAL4B,CAwCrCE,QAASA,GAAO,CAACC,CAAD,CAAQnE,CAAR,CAAa,CAC3B,GAAImE,CAAAD,QAAJ,CAAmB,MAAOC,EAAAD,QAAA,CAAclE,CAAd,CAE1B,KAAK,IAAIkB,EAAI,CAAb,CAAgBA,CAAhB,CAAoBiD,CAAAjE,OAApB,CAAkCgB,CAAA,EAAlC,CACE,GAAIlB,CAAJ,GAAYmE,CAAA,CAAMjD,CAAN,CAAZ,CAAsB,MAAOA,EAE/B,OAAQ,EANmB,CAS7BkD,QAASA,GAAW,CAACD,CAAD,CAAQ9C,CAAR,CAAe,CACjC,IAAIE,EAAQ2C,EAAA,CAAQC,CAAR,CAAe9C,CAAf,CACA,EAAZ,EAAIE,CAAJ,EACE4C,CAAAE,OAAA,CAAa9C,CAAb,CAAoB,CAApB,CACF,OAAOF,EAJ0B,CA4EnCiD,QAASA,GAAI,CAACC,CAAD,CAASC,CAAT,CAAqB,CAChC,GAAIvE,EAAA,CAASsE,CAAT,CAAJ,EAAgCA,CAAhC,EAAgCA,CA3MlBE,WA2Md,EAAgCF,CA3MAG,OA2MhC,CACE,KAAMC,GAAA,CAAS,MAAT,CAAN;AAIF,GAAKH,CAAL,CAaO,CACL,GAAID,CAAJ,GAAeC,CAAf,CAA4B,KAAMG,GAAA,CAAS,KAAT,CAAN,CAE5B,GAAItE,CAAA,CAAQkE,CAAR,CAAJ,CAEE,IAAM,IAAIrD,EADVsD,CAAAtE,OACUgB,CADW,CACrB,CAAiBA,CAAjB,CAAqBqD,CAAArE,OAArB,CAAoCgB,CAAA,EAApC,CACEsD,CAAAzD,KAAA,CAAiBuD,EAAA,CAAKC,CAAA,CAAOrD,CAAP,CAAL,CAAjB,CAHJ,KAKO,CACDc,CAAAA,CAAIwC,CAAAvC,UACR3B,EAAA,CAAQkE,CAAR,CAAqB,QAAQ,CAACnD,CAAD,CAAQZ,CAAR,CAAY,CACvC,OAAO+D,CAAA,CAAY/D,CAAZ,CADgC,CAAzC,CAGA,KAAMA,IAAIA,CAAV,GAAiB8D,EAAjB,CACEC,CAAA,CAAY/D,CAAZ,CAAA,CAAmB6D,EAAA,CAAKC,CAAA,CAAO9D,CAAP,CAAL,CAErBsB,GAAA,CAAWyC,CAAX,CAAuBxC,CAAvB,CARK,CARF,CAbP,IAEE,CADAwC,CACA,CADcD,CACd,IACMlE,CAAA,CAAQkE,CAAR,CAAJ,CACEC,CADF,CACgBF,EAAA,CAAKC,CAAL,CAAa,EAAb,CADhB,CAEWpB,EAAA,CAAOoB,CAAP,CAAJ,CACLC,CADK,CACS,IAAII,IAAJ,CAASL,CAAAM,QAAA,EAAT,CADT,CAEIxB,EAAA,CAASkB,CAAT,CAAJ,CACLC,CADK,CACaM,MAAJ,CAAWP,CAAAA,OAAX,CADT,CAEItB,CAAA,CAASsB,CAAT,CAFJ,GAGLC,CAHK,CAGSF,EAAA,CAAKC,CAAL,CAAa,EAAb,CAHT,CALT,CA8BF,OAAOC,EAtCyB,CA4ClCO,QAASA,GAAW,CAACC,CAAD,CAAM7C,CAAN,CAAW,CAC7BA,CAAA,CAAMA,CAAN,EAAa,EAEb,KAAI1B,IAAIA,CAAR,GAAeuE,EAAf,CAGM,CAAAA,CAAArE,eAAA,CAAmBF,CAAnB,CAAJ,EAAmD,GAAnD,GAAiCA,CAAAwE,OAAA,CAAW,CAAX,CAAjC,EAA4E,GAA5E,GAA0DxE,CAAAwE,OAAA,CAAW,CAAX,CAA1D,GACE9C,CAAA,CAAI1B,CAAJ,CADF,CACauE,CAAA,CAAIvE,CAAJ,CADb,CAKF,OAAO0B,EAXsB,CA4C/B+C,QAASA,GAAM,CAACC,CAAD,CAAKC,CAAL,CAAS,CACtB,GAAID,CAAJ,GAAWC,CAAX,CAAe,MAAO,CAAA,CACtB,IAAW,IAAX,GAAID,CAAJ,EAA0B,IAA1B,GAAmBC,CAAnB,CAAgC,MAAO,CAAA,CACvC,IAAID,CAAJ,GAAWA,CAAX,EAAiBC,CAAjB,GAAwBA,CAAxB,CAA4B,MAAO,CAAA,CAHb;IAIlBC,EAAK,MAAOF,EAJM,CAIsB1E,CAC5C,IAAI4E,CAAJ,EADyBC,MAAOF,EAChC,EACY,QADZ,EACMC,CADN,CAEI,GAAIhF,CAAA,CAAQ8E,CAAR,CAAJ,CAAiB,CACf,GAAI,CAAC9E,CAAA,CAAQ+E,CAAR,CAAL,CAAkB,MAAO,CAAA,CACzB,KAAKlF,CAAL,CAAciF,CAAAjF,OAAd,GAA4BkF,CAAAlF,OAA5B,CAAuC,CACrC,IAAIO,CAAJ,CAAQ,CAAR,CAAWA,CAAX,CAAeP,CAAf,CAAuBO,CAAA,EAAvB,CACE,GAAI,CAACyE,EAAA,CAAOC,CAAA,CAAG1E,CAAH,CAAP,CAAgB2E,CAAA,CAAG3E,CAAH,CAAhB,CAAL,CAA+B,MAAO,CAAA,CAExC,OAAO,CAAA,CAJ8B,CAFxB,CAAjB,IAQO,CAAA,GAAI0C,EAAA,CAAOgC,CAAP,CAAJ,CACL,MAAOhC,GAAA,CAAOiC,CAAP,CAAP,EAAqBD,CAAAN,QAAA,EAArB,EAAqCO,CAAAP,QAAA,EAChC,IAAIxB,EAAA,CAAS8B,CAAT,CAAJ,EAAoB9B,EAAA,CAAS+B,CAAT,CAApB,CACL,MAAOD,EAAA/B,SAAA,EAAP,EAAwBgC,CAAAhC,SAAA,EAExB,IAAY+B,CAAZ,EAAYA,CAtTJV,WAsTR,EAAYU,CAtTcT,OAsT1B,EAA2BU,CAA3B,EAA2BA,CAtTnBX,WAsTR,EAA2BW,CAtTDV,OAsT1B,EAAkCzE,EAAA,CAASkF,CAAT,CAAlC,EAAkDlF,EAAA,CAASmF,CAAT,CAAlD,EAAkE/E,CAAA,CAAQ+E,CAAR,CAAlE,CAA+E,MAAO,CAAA,CACtFG,EAAA,CAAS,EACT,KAAI9E,CAAJ,GAAW0E,EAAX,CACE,GAAsB,GAAtB,GAAI1E,CAAAwE,OAAA,CAAW,CAAX,CAAJ,EAA6B,CAAAvE,CAAA,CAAWyE,CAAA,CAAG1E,CAAH,CAAX,CAA7B,CAAA,CACA,GAAI,CAACyE,EAAA,CAAOC,CAAA,CAAG1E,CAAH,CAAP,CAAgB2E,CAAA,CAAG3E,CAAH,CAAhB,CAAL,CAA+B,MAAO,CAAA,CACtC8E,EAAA,CAAO9E,CAAP,CAAA,CAAc,CAAA,CAFd,CAIF,IAAIA,CAAJ,GAAW2E,EAAX,CACE,GAAI,CAACG,CAAA5E,eAAA,CAAsBF,CAAtB,CAAL,EACsB,GADtB,GACIA,CAAAwE,OAAA,CAAW,CAAX,CADJ,EAEIG,CAAA,CAAG3E,CAAH,CAFJ,GAEgBZ,CAFhB,EAGI,CAACa,CAAA,CAAW0E,CAAA,CAAG3E,CAAH,CAAX,CAHL,CAG0B,MAAO,CAAA,CAEnC;MAAO,CAAA,CAlBF,CAsBX,MAAO,CAAA,CArCe,CAyCxB+E,QAASA,GAAG,EAAG,CACb,MAAQ5F,EAAA6F,eAAR,EAAmC7F,CAAA6F,eAAAC,SAAnC,EACK9F,CAAA+F,cADL,EAEI,EAAG,CAAA/F,CAAA+F,cAAA,CAAuB,UAAvB,CAAH,EAAyC,CAAA/F,CAAA+F,cAAA,CAAuB,eAAvB,CAAzC,CAHS,CAmCfC,QAASA,GAAI,CAACC,CAAD,CAAOC,CAAP,CAAW,CACtB,IAAIC,EAA+B,CAAnB,CAAA3D,SAAAlC,OAAA,CAxBT8F,EAAApF,KAAA,CAwB0CwB,SAxB1C,CAwBqD6D,CAxBrD,CAwBS,CAAiD,EACjE,OAAI,CAAAvF,CAAA,CAAWoF,CAAX,CAAJ,EAAwBA,CAAxB,WAAsChB,OAAtC,CAcSgB,CAdT,CACSC,CAAA7F,OACA,CAAH,QAAQ,EAAG,CACT,MAAOkC,UAAAlC,OACA,CAAH4F,CAAAI,MAAA,CAASL,CAAT,CAAeE,CAAAI,OAAA,CAAiBH,EAAApF,KAAA,CAAWwB,SAAX,CAAsB,CAAtB,CAAjB,CAAf,CAAG,CACH0D,CAAAI,MAAA,CAASL,CAAT,CAAeE,CAAf,CAHK,CAAR,CAKH,QAAQ,EAAG,CACT,MAAO3D,UAAAlC,OACA,CAAH4F,CAAAI,MAAA,CAASL,CAAT,CAAezD,SAAf,CAAG,CACH0D,CAAAlF,KAAA,CAAQiF,CAAR,CAHK,CATK,CAqBxBO,QAASA,GAAc,CAAC3F,CAAD,CAAMY,CAAN,CAAa,CAClC,IAAIgF,EAAMhF,CAES,SAAnB,GAAI,MAAOZ,EAAX,EAAiD,GAAjD,GAA+BA,CAAAwE,OAAA,CAAW,CAAX,CAA/B,CACEoB,CADF;AACQxG,CADR,CAEWI,EAAA,CAASoB,CAAT,CAAJ,CACLgF,CADK,CACC,SADD,CAEIhF,CAAJ,EAAczB,CAAd,GAA2ByB,CAA3B,CACLgF,CADK,CACC,WADD,CAEYhF,CAFZ,GAEYA,CA5YLoD,WA0YP,EAEYpD,CA5YaqD,OA0YzB,IAGL2B,CAHK,CAGC,QAHD,CAMP,OAAOA,EAb2B,CA+BpCC,QAASA,GAAM,CAACtG,CAAD,CAAMuG,CAAN,CAAc,CAC3B,MAAmB,WAAnB,GAAI,MAAOvG,EAAX,CAAuCH,CAAvC,CACO2G,IAAAC,UAAA,CAAezG,CAAf,CAAoBoG,EAApB,CAAoCG,CAAA,CAAS,IAAT,CAAgB,IAApD,CAFoB,CAkB7BG,QAASA,GAAQ,CAACC,CAAD,CAAO,CACtB,MAAOvG,EAAA,CAASuG,CAAT,CACA,CAADH,IAAAI,MAAA,CAAWD,CAAX,CAAC,CACDA,CAHgB,CAOxBE,QAASA,GAAS,CAACxF,CAAD,CAAQ,CACH,UAArB,GAAI,MAAOA,EAAX,CACEA,CADF,CACU,CAAA,CADV,CAEWA,CAAJ,EAA8B,CAA9B,GAAaA,CAAAnB,OAAb,EACD4G,CACJ,CADQC,CAAA,CAAU,EAAV,CAAe1F,CAAf,CACR,CAAAA,CAAA,CAAQ,EAAO,GAAP,EAAEyF,CAAF,EAAmB,GAAnB,EAAcA,CAAd,EAA+B,OAA/B,EAA0BA,CAA1B,EAA+C,IAA/C,EAA0CA,CAA1C,EAA4D,GAA5D,EAAuDA,CAAvD,EAAwE,IAAxE,EAAmEA,CAAnE,CAFH,EAILzF,CAJK,CAIG,CAAA,CAEV,OAAOA,EATiB,CAe1B2F,QAASA,GAAW,CAACC,CAAD,CAAU,CAC5BA,CAAA,CAAUC,CAAA,CAAOD,CAAP,CAAAE,MAAA,EACV,IAAI,CAGFF,CAAAG,MAAA,EAHE,CAIF,MAAMC,CAAN,CAAS,EAGX,IAAIC,EAAWJ,CAAA,CAAO,OAAP,CAAAK,OAAA,CAAuBN,CAAvB,CAAAO,KAAA,EACf,IAAI,CACF,MAHcC,EAGP,GAAAR,CAAA,CAAQ,CAAR,CAAA9G,SAAA,CAAoC4G,CAAA,CAAUO,CAAV,CAApC,CACHA,CAAAI,MAAA,CACQ,YADR,CACA,CAAsB,CAAtB,CAAAC,QAAA,CACU,aADV;AACyB,QAAQ,CAACD,CAAD,CAAQ/D,CAAR,CAAkB,CAAE,MAAO,GAAP,CAAaoD,CAAA,CAAUpD,CAAV,CAAf,CADnD,CAHF,CAKF,MAAM0D,CAAN,CAAS,CACT,MAAON,EAAA,CAAUO,CAAV,CADE,CAfiB,CAgC9BM,QAASA,GAAqB,CAACvG,CAAD,CAAQ,CACpC,GAAI,CACF,MAAOwG,mBAAA,CAAmBxG,CAAnB,CADL,CAEF,MAAMgG,CAAN,CAAS,EAHyB,CAatCS,QAASA,GAAa,CAAYC,CAAZ,CAAsB,CAAA,IACtC/H,EAAM,EADgC,CAC5BgI,CAD4B,CACjBvH,CACzBH,EAAA,CAAS2H,CAAAF,CAAAE,EAAY,EAAZA,OAAA,CAAsB,GAAtB,CAAT,CAAqC,QAAQ,CAACF,CAAD,CAAU,CAChDA,CAAL,GACEC,CAEA,CAFYD,CAAAE,MAAA,CAAe,GAAf,CAEZ,CADAxH,CACA,CADMmH,EAAA,CAAsBI,CAAA,CAAU,CAAV,CAAtB,CACN,CAAKhF,CAAA,CAAUvC,CAAV,CAAL,GACM4F,CACJ,CADUrD,CAAA,CAAUgF,CAAA,CAAU,CAAV,CAAV,CAAA,CAA0BJ,EAAA,CAAsBI,CAAA,CAAU,CAAV,CAAtB,CAA1B,CAAgE,CAAA,CAC1E,CAAKhI,CAAA,CAAIS,CAAJ,CAAL,CAEUJ,CAAA,CAAQL,CAAA,CAAIS,CAAJ,CAAR,CAAH,CACLT,CAAA,CAAIS,CAAJ,CAAAM,KAAA,CAAcsF,CAAd,CADK,CAGLrG,CAAA,CAAIS,CAAJ,CAHK,CAGM,CAACT,CAAA,CAAIS,CAAJ,CAAD,CAAU4F,CAAV,CALb,CACErG,CAAA,CAAIS,CAAJ,CADF,CACa4F,CAHf,CAHF,CADqD,CAAvD,CAgBA,OAAOrG,EAlBmC,CAqB5CkI,QAASA,GAAU,CAAClI,CAAD,CAAM,CACvB,IAAImI,EAAQ,EACZ7H,EAAA,CAAQN,CAAR,CAAa,QAAQ,CAACqB,CAAD,CAAQZ,CAAR,CAAa,CAC5BJ,CAAA,CAAQgB,CAAR,CAAJ,CACEf,CAAA,CAAQe,CAAR,CAAe,QAAQ,CAAC+G,CAAD,CAAa,CAClCD,CAAApH,KAAA,CAAWsH,EAAA,CAAe5H,CAAf,CAAoB,CAAA,CAApB,CAAX,EAC2B,CAAA,CAAf,GAAA2H,CAAA,CAAsB,EAAtB,CAA2B,GAA3B,CAAiCC,EAAA,CAAeD,CAAf,CAA2B,CAAA,CAA3B,CAD7C,EADkC,CAApC,CADF,CAMAD,CAAApH,KAAA,CAAWsH,EAAA,CAAe5H,CAAf,CAAoB,CAAA,CAApB,CAAX,EACsB,CAAA,CAAV,GAAAY,CAAA,CAAiB,EAAjB,CAAsB,GAAtB,CAA4BgH,EAAA,CAAehH,CAAf,CAAsB,CAAA,CAAtB,CADxC,EAPgC,CAAlC,CAWA,OAAO8G,EAAAjI,OAAA,CAAeiI,CAAAxG,KAAA,CAAW,GAAX,CAAf,CAAiC,EAbjB,CA4BzB2G,QAASA,GAAgB,CAACjC,CAAD,CAAM,CAC7B,MAAOgC,GAAA,CAAehC,CAAf;AAAoB,CAAA,CAApB,CAAAsB,QAAA,CACY,OADZ,CACqB,GADrB,CAAAA,QAAA,CAEY,OAFZ,CAEqB,GAFrB,CAAAA,QAAA,CAGY,OAHZ,CAGqB,GAHrB,CADsB,CAmB/BU,QAASA,GAAc,CAAChC,CAAD,CAAMkC,CAAN,CAAuB,CAC5C,MAAOC,mBAAA,CAAmBnC,CAAnB,CAAAsB,QAAA,CACY,OADZ,CACqB,GADrB,CAAAA,QAAA,CAEY,OAFZ,CAEqB,GAFrB,CAAAA,QAAA,CAGY,MAHZ,CAGoB,GAHpB,CAAAA,QAAA,CAIY,OAJZ,CAIqB,GAJrB,CAAAA,QAAA,CAKY,MALZ,CAKqBY,CAAA,CAAkB,KAAlB,CAA0B,GAL/C,CADqC,CAwD9CE,QAASA,GAAW,CAACxB,CAAD,CAAUyB,CAAV,CAAqB,CAOvCnB,QAASA,EAAM,CAACN,CAAD,CAAU,CACvBA,CAAA,EAAW0B,CAAA5H,KAAA,CAAckG,CAAd,CADY,CAPc,IACnC0B,EAAW,CAAC1B,CAAD,CADwB,CAEnC2B,CAFmC,CAGnCC,CAHmC,CAInCC,EAAQ,CAAC,QAAD,CAAW,QAAX,CAAqB,UAArB,CAAiC,aAAjC,CAJ2B,CAKnCC,EAAsB,mCAM1BzI,EAAA,CAAQwI,CAAR,CAAe,QAAQ,CAACE,CAAD,CAAO,CAC5BF,CAAA,CAAME,CAAN,CAAA,CAAc,CAAA,CACdzB,EAAA,CAAO3H,CAAAqJ,eAAA,CAAwBD,CAAxB,CAAP,CACAA,EAAA,CAAOA,CAAArB,QAAA,CAAa,GAAb,CAAkB,KAAlB,CACHV,EAAAiC,iBAAJ,GACE5I,CAAA,CAAQ2G,CAAAiC,iBAAA,CAAyB,GAAzB,CAA+BF,CAA/B,CAAR,CAA8CzB,CAA9C,CAEA,CADAjH,CAAA,CAAQ2G,CAAAiC,iBAAA,CAAyB,GAAzB;AAA+BF,CAA/B,CAAsC,KAAtC,CAAR,CAAsDzB,CAAtD,CACA,CAAAjH,CAAA,CAAQ2G,CAAAiC,iBAAA,CAAyB,GAAzB,CAA+BF,CAA/B,CAAsC,GAAtC,CAAR,CAAoDzB,CAApD,CAHF,CAJ4B,CAA9B,CAWAjH,EAAA,CAAQqI,CAAR,CAAkB,QAAQ,CAAC1B,CAAD,CAAU,CAClC,GAAI,CAAC2B,CAAL,CAAiB,CAEf,IAAIlB,EAAQqB,CAAAI,KAAA,CADI,GACJ,CADUlC,CAAAmC,UACV,CAD8B,GAC9B,CACR1B,EAAJ,EACEkB,CACA,CADa3B,CACb,CAAA4B,CAAA,CAAUlB,CAAAD,CAAA,CAAM,CAAN,CAAAC,EAAY,EAAZA,SAAA,CAAwB,MAAxB,CAAgC,GAAhC,CAFZ,EAIErH,CAAA,CAAQ2G,CAAAoC,WAAR,CAA4B,QAAQ,CAACxF,CAAD,CAAO,CACpC+E,CAAAA,CAAL,EAAmBE,CAAA,CAAMjF,CAAAmF,KAAN,CAAnB,GACEJ,CACA,CADa3B,CACb,CAAA4B,CAAA,CAAShF,CAAAxC,MAFX,CADyC,CAA3C,CAPa,CADiB,CAApC,CAiBIuH,EAAJ,EACEF,CAAA,CAAUE,CAAV,CAAsBC,CAAA,CAAS,CAACA,CAAD,CAAT,CAAoB,EAA1C,CAxCqC,CAkGzCH,QAASA,GAAS,CAACzB,CAAD,CAAUqC,CAAV,CAAmB,CACnC,IAAIC,EAAcA,QAAQ,EAAG,CAC3BtC,CAAA,CAAUC,CAAA,CAAOD,CAAP,CAEV,IAAIA,CAAAuC,SAAA,EAAJ,CAAwB,CACtB,IAAIC,EAAOxC,CAAA,CAAQ,CAAR,CAAD,GAAgBrH,CAAhB,CAA4B,UAA5B,CAAyCoH,EAAA,CAAYC,CAAZ,CACnD,MAAMtC,GAAA,CAAS,SAAT,CAAwE8E,CAAxE,CAAN,CAFsB,CAKxBH,CAAA,CAAUA,CAAV,EAAqB,EACrBA,EAAAxH,QAAA,CAAgB,CAAC,UAAD,CAAa,QAAQ,CAAC4H,CAAD,CAAW,CAC9CA,CAAArI,MAAA,CAAe,cAAf,CAA+B4F,CAA/B,CAD8C,CAAhC,CAAhB,CAGAqC,EAAAxH,QAAA,CAAgB,IAAhB,CACI0H,EAAAA,CAAWG,EAAA,CAAeL,CAAf,CACfE,EAAAI,OAAA,CAAgB,CAAC,YAAD,CAAe,cAAf,CAA+B,UAA/B,CAA2C,WAA3C,CAAwD,UAAxD;AACb,QAAQ,CAACC,CAAD,CAAQ5C,CAAR,CAAiB6C,CAAjB,CAA0BN,CAA1B,CAAoCO,CAApC,CAA6C,CACpDF,CAAAG,OAAA,CAAa,QAAQ,EAAG,CACtB/C,CAAAgD,KAAA,CAAa,WAAb,CAA0BT,CAA1B,CACAM,EAAA,CAAQ7C,CAAR,CAAA,CAAiB4C,CAAjB,CAFsB,CAAxB,CADoD,CADxC,CAAhB,CAQA,OAAOL,EAtBoB,CAA7B,CAyBIU,EAAqB,sBAEzB,IAAIvK,CAAJ,EAAc,CAACuK,CAAAC,KAAA,CAAwBxK,CAAAqJ,KAAxB,CAAf,CACE,MAAOO,EAAA,EAGT5J,EAAAqJ,KAAA,CAAcrJ,CAAAqJ,KAAArB,QAAA,CAAoBuC,CAApB,CAAwC,EAAxC,CACdE,GAAAC,gBAAA,CAA0BC,QAAQ,CAACC,CAAD,CAAe,CAC/CjK,CAAA,CAAQiK,CAAR,CAAsB,QAAQ,CAAC1B,CAAD,CAAS,CACrCS,CAAAvI,KAAA,CAAa8H,CAAb,CADqC,CAAvC,CAGAU,EAAA,EAJ+C,CAjCd,CA0CrCiB,QAASA,GAAU,CAACxB,CAAD,CAAOyB,CAAP,CAAiB,CAClCA,CAAA,CAAYA,CAAZ,EAAyB,GACzB,OAAOzB,EAAArB,QAAA,CAAa+C,EAAb,CAAgC,QAAQ,CAACC,CAAD,CAASC,CAAT,CAAc,CAC3D,OAAQA,CAAA,CAAMH,CAAN,CAAkB,EAA1B,EAAgCE,CAAAE,YAAA,EAD2B,CAAtD,CAF2B,CAkCpCC,QAASA,GAAS,CAACC,CAAD,CAAM/B,CAAN,CAAYgC,CAAZ,CAAoB,CACpC,GAAI,CAACD,CAAL,CACE,KAAMpG,GAAA,CAAS,MAAT,CAA2CqE,CAA3C,EAAmD,GAAnD,CAA0DgC,CAA1D,EAAoE,UAApE,CAAN,CAEF,MAAOD,EAJ6B,CAOtCE,QAASA,GAAW,CAACF,CAAD,CAAM/B,CAAN,CAAYkC,CAAZ,CAAmC,CACjDA,CAAJ,EAA6B7K,CAAA,CAAQ0K,CAAR,CAA7B,GACIA,CADJ,CACUA,CAAA,CAAIA,CAAA7K,OAAJ,CAAiB,CAAjB,CADV,CAIA4K,GAAA,CAAUpK,CAAA,CAAWqK,CAAX,CAAV,CAA2B/B,CAA3B,CAAiC,sBAAjC,EACK+B,CAAA,EAAqB,QAArB,EAAO,MAAOA,EAAd;AAAgCA,CAAAI,YAAAnC,KAAhC,EAAwD,QAAxD,CAAmE,MAAO+B,EAD/E,EAEA,OAAOA,EAP8C,CAevDK,QAASA,GAAuB,CAACpC,CAAD,CAAOxI,CAAP,CAAgB,CAC9C,GAAa,gBAAb,GAAIwI,CAAJ,CACE,KAAMrE,GAAA,CAAS,SAAT,CAA8DnE,CAA9D,CAAN,CAF4C,CAchD6K,QAASA,GAAM,CAACrL,CAAD,CAAMsL,CAAN,CAAYC,CAAZ,CAA2B,CACxC,GAAI,CAACD,CAAL,CAAW,MAAOtL,EACdc,EAAAA,CAAOwK,CAAArD,MAAA,CAAW,GAAX,CAKX,KAJA,IAAIxH,CAAJ,CACI+K,EAAexL,CADnB,CAEIyL,EAAM3K,CAAAZ,OAFV,CAISgB,EAAI,CAAb,CAAgBA,CAAhB,CAAoBuK,CAApB,CAAyBvK,CAAA,EAAzB,CACET,CACA,CADMK,CAAA,CAAKI,CAAL,CACN,CAAIlB,CAAJ,GACEA,CADF,CACQ,CAACwL,CAAD,CAAgBxL,CAAhB,EAAqBS,CAArB,CADR,CAIF,OAAI,CAAC8K,CAAL,EAAsB7K,CAAA,CAAWV,CAAX,CAAtB,CACS4F,EAAA,CAAK4F,CAAL,CAAmBxL,CAAnB,CADT,CAGOA,CAhBiC,CAwB1C0L,QAASA,GAAgB,CAACC,CAAD,CAAQ,CAAA,IAC3BC,EAAYD,CAAA,CAAM,CAAN,CACZE,EAAAA,CAAUF,CAAA,CAAMA,CAAAzL,OAAN,CAAqB,CAArB,CACd,IAAI0L,CAAJ,GAAkBC,CAAlB,CACE,MAAO3E,EAAA,CAAO0E,CAAP,CAIT,KAAIjD,EAAW,CAAC1B,CAAD,CAEf,GAAG,CACDA,CAAA,CAAUA,CAAA6E,YACV,IAAI,CAAC7E,CAAL,CAAc,KACd0B,EAAA5H,KAAA,CAAckG,CAAd,CAHC,CAAH,MAISA,CAJT,GAIqB4E,CAJrB,CAMA,OAAO3E,EAAA,CAAOyB,CAAP,CAhBwB,CA4BjCoD,QAASA,GAAiB,CAACpM,CAAD,CAAS,CAEjC,IAAIqM,EAAkBlM,CAAA,CAAO,WAAP,CAAtB,CACI6E,EAAW7E,CAAA,CAAO,IAAP,CAMXsK,EAAAA,CAAiBzK,CAHZ,QAGLyK,GAAiBzK,CAHE,QAGnByK,CAH+B,EAG/BA,CAGJA,EAAA6B,SAAA,CAAmB7B,CAAA6B,SAAnB,EAAuCnM,CAEvC,OAAcsK,EARL,OAQT;CAAcA,CARS,OAQvB,CAAiC8B,QAAQ,EAAG,CAE1C,IAAI5C,EAAU,EAqDd,OAAOT,SAAe,CAACG,CAAD,CAAOmD,CAAP,CAAiBC,CAAjB,CAA2B,CAE7C,GAAa,gBAAb,GAKsBpD,CALtB,CACE,KAAMrE,EAAA,CAAS,SAAT,CAIoBnE,QAJpB,CAAN,CAKA2L,CAAJ,EAAgB7C,CAAA3I,eAAA,CAAuBqI,CAAvB,CAAhB,GACEM,CAAA,CAAQN,CAAR,CADF,CACkB,IADlB,CAGA,OAAcM,EA1ET,CA0EkBN,CA1ElB,CA0EL,GAAcM,CA1EK,CA0EIN,CA1EJ,CA0EnB,CAA6BkD,QAAQ,EAAG,CAgNtCG,QAASA,EAAW,CAACC,CAAD,CAAWC,CAAX,CAAmBC,CAAnB,CAAiC,CACnD,MAAO,SAAQ,EAAG,CAChBC,CAAA,CAAYD,CAAZ,EAA4B,MAA5B,CAAA,CAAoC,CAACF,CAAD,CAAWC,CAAX,CAAmBnK,SAAnB,CAApC,CACA,OAAOsK,EAFS,CADiC,CA/MrD,GAAI,CAACP,CAAL,CACE,KAAMH,EAAA,CAAgB,OAAhB,CAEiDhD,CAFjD,CAAN,CAMF,IAAIyD,EAAc,EAAlB,CAGIE,EAAY,EAHhB,CAKIC,EAASP,CAAA,CAAY,WAAZ,CAAyB,QAAzB,CALb,CAQIK,EAAiB,cAELD,CAFK,YAGPE,CAHO,UAcTR,CAdS,MAuBbnD,CAvBa,UAoCTqD,CAAA,CAAY,UAAZ,CAAwB,UAAxB,CApCS,SA+CVA,CAAA,CAAY,UAAZ,CAAwB,SAAxB,CA/CU,SA0DVA,CAAA,CAAY,UAAZ,CAAwB,SAAxB,CA1DU,OAqEZA,CAAA,CAAY,UAAZ,CAAwB,OAAxB,CArEY,UAiFTA,CAAA,CAAY,UAAZ;AAAwB,UAAxB,CAAoC,SAApC,CAjFS,WAmHRA,CAAA,CAAY,kBAAZ,CAAgC,UAAhC,CAnHQ,QA8HXA,CAAA,CAAY,iBAAZ,CAA+B,UAA/B,CA9HW,YA0IPA,CAAA,CAAY,qBAAZ,CAAmC,UAAnC,CA1IO,WAuJRA,CAAA,CAAY,kBAAZ,CAAgC,WAAhC,CAvJQ,QAkKXO,CAlKW,KA8KdC,QAAQ,CAACC,CAAD,CAAQ,CACnBH,CAAA5L,KAAA,CAAe+L,CAAf,CACA,OAAO,KAFY,CA9KF,CAoLjBV,EAAJ,EACEQ,CAAA,CAAOR,CAAP,CAGF,OAAQM,EAxM8B,CA1ET,EA0E/B,CAX+C,CAvDP,CART,EAQnC,CAdiC,CAiZnCK,QAASA,GAAkB,CAAC3C,CAAD,CAAS,CAClClI,CAAA,CAAOkI,CAAP,CAAgB,WACD1B,EADC,MAENpE,EAFM,QAGJpC,CAHI,QAIJgD,EAJI,SAKHgC,CALG,SAMH5G,CANG,UAOFqJ,EAPE,MAQPhH,CARO,MASPiD,EATO,QAUJU,EAVI,UAWFI,EAXE,UAYH9D,EAZG,aAaCG,CAbD,WAcDC,CAdC,UAeF5C,CAfE,YAgBAM,CAhBA,UAiBFuC,CAjBE,UAkBFC,EAlBE,WAmBDO,EAnBC,SAoBHpD,CApBG;QAqBH2M,EArBG,QAsBJ7J,EAtBI,WAuBD4D,CAvBC,WAwBDkG,EAxBC,WAyBD,SAAU,CAAV,CAzBC,UA0BFnN,CA1BE,OA2BL0F,EA3BK,CAAhB,CA8BA0H,GAAA,CAAgBnB,EAAA,CAAkBpM,CAAlB,CAChB,IAAI,CACFuN,EAAA,CAAc,UAAd,CADE,CAEF,MAAO7F,CAAP,CAAU,CACV6F,EAAA,CAAc,UAAd,CAA0B,EAA1B,CAAAZ,SAAA,CAAuC,SAAvC,CAAkDa,EAAlD,CADU,CAIZD,EAAA,CAAc,IAAd,CAAoB,CAAC,UAAD,CAApB,CAAkC,CAAC,UAAD,CAChCE,QAAiB,CAAC1D,CAAD,CAAW,CAE1BA,CAAA4C,SAAA,CAAkB,eACDe,EADC,CAAlB,CAGA3D,EAAA4C,SAAA,CAAkB,UAAlB,CAA8BgB,EAA9B,CAAAC,UAAA,CACY,GACHC,EADG,OAECC,EAFD,UAGIA,EAHJ,MAIAC,EAJA,QAKEC,EALF,QAMEC,EANF,OAOCC,EAPD,QAQEC,EARF,QASEC,EATF,YAUMC,EAVN,gBAWUC,EAXV,SAYGC,EAZH,aAaOC,EAbP,YAcMC,EAdN,SAeGC,EAfH,cAgBQC,EAhBR,QAiBEC,EAjBF,QAkBEC,EAlBF,MAmBAC,EAnBA,WAoBKC,EApBL;OAqBEC,EArBF,eAsBSC,EAtBT,aAuBOC,EAvBP,UAwBIC,EAxBJ,QAyBEC,EAzBF,SA0BGC,EA1BH,UA2BIC,EA3BJ,cA4BQC,EA5BR,iBA6BWC,EA7BX,WA8BKC,EA9BL,cA+BQC,EA/BR,SAgCGC,EAhCH,QAiCEC,EAjCF,UAkCIC,EAlCJ,UAmCIC,EAnCJ,YAoCMA,EApCN,SAqCGC,EArCH,CADZ,CAAAnC,UAAA,CAwCY,WACGoC,EADH,CAxCZ,CAAApC,UAAA,CA2CYqC,EA3CZ,CAAArC,UAAA,CA4CYsC,EA5CZ,CA6CAnG,EAAA4C,SAAA,CAAkB,eACDwD,EADC,UAENC,EAFM,UAGNC,EAHM,eAIDC,EAJC,aAKHC,EALG,WAMLC,EANK,mBAOGC,EAPH,SAQPC,EARO,cASFC,EATE,WAULC,EAVK,OAWTC,EAXS,cAYFC,EAZE,WAaLC,EAbK,MAcVC,EAdU,QAeRC,EAfQ,YAgBJC,EAhBI;GAiBZC,EAjBY,MAkBVC,EAlBU,cAmBFC,EAnBE,UAoBNC,EApBM,gBAqBAC,EArBA,UAsBNC,EAtBM,SAuBPC,EAvBO,OAwBTC,EAxBS,iBAyBEC,EAzBF,CAAlB,CAlD0B,CADI,CAAlC,CAtCkC,CAwPpCC,QAASA,GAAS,CAACvI,CAAD,CAAO,CACvB,MAAOA,EAAArB,QAAA,CACG6J,EADH,CACyB,QAAQ,CAACC,CAAD,CAAIhH,CAAJ,CAAeE,CAAf,CAAuB+G,CAAvB,CAA+B,CACnE,MAAOA,EAAA,CAAS/G,CAAAgH,YAAA,EAAT,CAAgChH,CAD4B,CADhE,CAAAhD,QAAA,CAIGiK,EAJH,CAIoB,OAJpB,CADgB,CAgBzBC,QAASA,GAAuB,CAAC7I,CAAD,CAAO8I,CAAP,CAAqBC,CAArB,CAAkCC,CAAlC,CAAuD,CAMrFC,QAASA,EAAW,CAACC,CAAD,CAAQ,CAAA,IAEtBjO,EAAO8N,CAAA,EAAeG,CAAf,CAAuB,CAAC,IAAAC,OAAA,CAAYD,CAAZ,CAAD,CAAvB,CAA8C,CAAC,IAAD,CAF/B,CAGtBE,EAAYN,CAHU,CAItBO,CAJsB,CAIjBC,CAJiB,CAIPC,CAJO,CAKtBtL,CALsB,CAKbuL,CALa,CAKYC,CAEtC,IAAI,CAACT,CAAL,EAAqC,IAArC,EAA4BE,CAA5B,CACE,IAAA,CAAMjO,CAAA/D,OAAN,CAAA,CAEE,IADAmS,CACkB,CADZpO,CAAAyO,MAAA,EACY,CAAdJ,CAAc,CAAH,CAAG,CAAAC,CAAA,CAAYF,CAAAnS,OAA9B,CAA0CoS,CAA1C,CAAqDC,CAArD,CAAgED,CAAA,EAAhE,CAOE,IANArL,CAMoB,CANVC,CAAA,CAAOmL,CAAA,CAAIC,CAAJ,CAAP,CAMU,CALhBF,CAAJ,CACEnL,CAAA0L,eAAA,CAAuB,UAAvB,CADF,CAGEP,CAHF,CAGc,CAACA,CAEK,CAAhBI,CAAgB,CAAH,CAAG,CAAAI,CAAA,CAAe1S,CAAAuS,CAAAvS,CAAW+G,CAAAwL,SAAA,EAAXvS,QAAnC,CACIsS,CADJ,CACiBI,CADjB,CAEIJ,CAAA,EAFJ,CAGEvO,CAAAlD,KAAA,CAAU8R,EAAA,CAAOJ,CAAA,CAASD,CAAT,CAAP,CAAV,CAKR,OAAOM,EAAA5M,MAAA,CAAmB,IAAnB,CAAyB9D,SAAzB,CAzBmB,CANyD;AACrF,IAAI0Q,EAAeD,EAAA/M,GAAA,CAAUkD,CAAV,CAAnB,CACA8J,EAAeA,CAAAC,UAAfD,EAAyCA,CACzCb,EAAAc,UAAA,CAAwBD,CACxBD,GAAA/M,GAAA,CAAUkD,CAAV,CAAA,CAAkBiJ,CAJmE,CAyGvFe,QAASA,EAAM,CAAC/L,CAAD,CAAU,CACvB,GAAIA,CAAJ,WAAuB+L,EAAvB,CACE,MAAO/L,EAEL7G,EAAA,CAAS6G,CAAT,CAAJ,GACEA,CADF,CACYgM,EAAA,CAAKhM,CAAL,CADZ,CAGA,IAAI,EAAE,IAAF,WAAkB+L,EAAlB,CAAJ,CAA+B,CAC7B,GAAI5S,CAAA,CAAS6G,CAAT,CAAJ,EAA8C,GAA9C,EAAyBA,CAAAhC,OAAA,CAAe,CAAf,CAAzB,CACE,KAAMiO,GAAA,CAAa,OAAb,CAAN,CAEF,MAAO,KAAIF,CAAJ,CAAW/L,CAAX,CAJsB,CAO/B,GAAI7G,CAAA,CAAS6G,CAAT,CAAJ,CAAuB,CACgBA,IAAAA,EAAAA,CA1BvCzG,EAAA,CAAqBZ,CACrB,KAAIuT,CAEJ,IAAKA,CAAL,CAAcC,EAAAjK,KAAA,CAAuB3B,CAAvB,CAAd,CACS,CAAA,CAAA,CAAA,CAAA,cAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CADT,KAAA,CAIO,IAAA,EAAA,CAAA,CA1CQiC,CACX4J,EAAAA,CAAW7S,CAAA8S,uBAAA,EACX3H,EAAAA,CAAQ,EAEZ,IARQ4H,EAAApJ,KAAA,CA8CD3C,CA9CC,CAQR,CAGO,CACLgM,CAAA,CAAMH,CAAAI,YAAA,CAAqBjT,CAAAkT,cAAA,CAAsB,KAAtB,CAArB,CAENjK,EAAA,CAAM,CAACkK,EAAAxK,KAAA,CAgCF3B,CAhCE,CAAD,EAA+B,CAAC,EAAD,CAAK,EAAL,CAA/B,EAAyC,CAAzC,CAAAqD,YAAA,EACN+I,EAAA,CAAOC,EAAA,CAAQpK,CAAR,CAAP,EAAuBoK,EAAAC,SACvBN,EAAAO,UAAA,CAAgB,mBAAhB,CACEH,CAAA,CAAK,CAAL,CADF,CA8BKpM,CA7BOG,QAAA,CAAaqM,EAAb,CAA+B,WAA/B,CADZ,CAC0DJ,CAAA,CAAK,CAAL,CAC1DJ;CAAAS,YAAA,CAAgBT,CAAAU,WAAhB,CAIA,KADAhT,CACA,CADI0S,CAAA,CAAK,CAAL,CACJ,CAAO1S,CAAA,EAAP,CAAA,CACEsS,CAAA,CAAMA,CAAAW,UAGHC,EAAA,CAAE,CAAP,KAAUC,CAAV,CAAab,CAAAc,WAAApU,OAAb,CAAoCkU,CAApC,CAAsCC,CAAtC,CAA0C,EAAED,CAA5C,CAA+CzI,CAAA5K,KAAA,CAAWyS,CAAAc,WAAA,CAAeF,CAAf,CAAX,CAE/CZ,EAAA,CAAMH,CAAAa,WACNV,EAAAe,YAAA,CAAkB,EAlBb,CAHP,IAEE5I,EAAA5K,KAAA,CAAWP,CAAAgU,eAAA,CAoCNhN,CApCM,CAAX,CAuBF6L,EAAAkB,YAAA,CAAuB,EACvBlB,EAAAU,UAAA,CAAqB,EACrB,EAAA,CAAOpI,CAOP,CAuBE8I,EAAA,CAAe,IAAf,CAvBF,CAuBE,CACevN,EAAAmM,CAAOzT,CAAA0T,uBAAA,EAAPD,CACf9L,OAAA,CAAgB,IAAhB,CAHqB,CAAvB,IAKEkN,GAAA,CAAe,IAAf,CAAqBxN,CAArB,CAnBqB,CAuBzByN,QAASA,GAAW,CAACzN,CAAD,CAAU,CAC5B,MAAOA,EAAA0N,UAAA,CAAkB,CAAA,CAAlB,CADqB,CAI9BC,QAASA,GAAY,CAAC3N,CAAD,CAAS,CAC5B4N,EAAA,CAAiB5N,CAAjB,CAD4B,KAElB/F,EAAI,CAAd,KAAiBuR,CAAjB,CAA4BxL,CAAAqN,WAA5B,EAAkD,EAAlD,CAAsDpT,CAAtD,CAA0DuR,CAAAvS,OAA1D,CAA2EgB,CAAA,EAA3E,CACE0T,EAAA,CAAanC,CAAA,CAASvR,CAAT,CAAb,CAH0B,CAO9B4T,QAASA,GAAS,CAAC7N,CAAD,CAAU8N,CAAV,CAAgBjP,CAAhB,CAAoBkP,CAApB,CAAiC,CACjD,GAAIhS,CAAA,CAAUgS,CAAV,CAAJ,CAA4B,KAAM9B,GAAA,CAAa,SAAb,CAAN,CADqB,IAG7C+B,EAASC,EAAA,CAAmBjO,CAAnB,CAA4B,QAA5B,CACAiO,GAAAC,CAAmBlO,CAAnBkO,CAA4B,QAA5BA,CAEb,GAEIpS,CAAA,CAAYgS,CAAZ,CAAJ,CACEzU,CAAA,CAAQ2U,CAAR;AAAgB,QAAQ,CAACG,CAAD,CAAeL,CAAf,CAAqB,CAC3CM,EAAA,CAAsBpO,CAAtB,CAA+B8N,CAA/B,CAAqCK,CAArC,CACA,QAAOH,CAAA,CAAOF,CAAP,CAFoC,CAA7C,CADF,CAMEzU,CAAA,CAAQyU,CAAA9M,MAAA,CAAW,GAAX,CAAR,CAAyB,QAAQ,CAAC8M,CAAD,CAAO,CAClChS,CAAA,CAAY+C,CAAZ,CAAJ,EACEuP,EAAA,CAAsBpO,CAAtB,CAA+B8N,CAA/B,CAAqCE,CAAA,CAAOF,CAAP,CAArC,CACA,CAAA,OAAOE,CAAA,CAAOF,CAAP,CAFT,EAIE3Q,EAAA,CAAY6Q,CAAA,CAAOF,CAAP,CAAZ,EAA4B,EAA5B,CAAgCjP,CAAhC,CALoC,CAAxC,CARF,CANiD,CAyBnD+O,QAASA,GAAgB,CAAC5N,CAAD,CAAU+B,CAAV,CAAgB,CAAA,IACnCsM,EAAYrO,CAAA,CAAQsO,EAAR,CADuB,CAEnCC,EAAeC,EAAA,CAAQH,CAAR,CAEfE,EAAJ,GACMxM,CAAJ,CACE,OAAOyM,EAAA,CAAQH,CAAR,CAAArL,KAAA,CAAwBjB,CAAxB,CADT,EAKIwM,CAAAL,OAKJ,GAJEK,CAAAP,OAAAS,SACA,EADgCF,CAAAL,OAAA,CAAoB,EAApB,CAAwB,UAAxB,CAChC,CAAAL,EAAA,CAAU7N,CAAV,CAGF,EADA,OAAOwO,EAAA,CAAQH,CAAR,CACP,CAAArO,CAAA,CAAQsO,EAAR,CAAA,CAAkB1V,CAVlB,CADF,CAJuC,CAmBzCqV,QAASA,GAAkB,CAACjO,CAAD,CAAUxG,CAAV,CAAeY,CAAf,CAAsB,CAAA,IAC3CiU,EAAYrO,CAAA,CAAQsO,EAAR,CAD+B,CAE3CC,EAAeC,EAAA,CAAQH,CAAR,EAAsB,EAAtB,CAEnB,IAAItS,CAAA,CAAU3B,CAAV,CAAJ,CACOmU,CAIL,GAHEvO,CAAA,CAAQsO,EAAR,CACA,CADkBD,CAClB,CA1NuB,EAAEK,EA0NzB,CAAAH,CAAA,CAAeC,EAAA,CAAQH,CAAR,CAAf,CAAoC,EAEtC,EAAAE,CAAA,CAAa/U,CAAb,CAAA,CAAoBY,CALtB,KAOE,OAAOmU,EAAP,EAAuBA,CAAA,CAAa/U,CAAb,CAXsB,CAejDmV,QAASA,GAAU,CAAC3O,CAAD,CAAUxG,CAAV,CAAeY,CAAf,CAAsB,CAAA,IACnC4I,EAAOiL,EAAA,CAAmBjO,CAAnB,CAA4B,MAA5B,CAD4B,CAEnC4O,EAAW7S,CAAA,CAAU3B,CAAV,CAFwB,CAGnCyU,EAAa,CAACD,CAAdC,EAA0B9S,CAAA,CAAUvC,CAAV,CAHS,CAInCsV,EAAiBD,CAAjBC,EAA+B,CAAC9S,CAAA,CAASxC,CAAT,CAE/BwJ,EAAL,EAAc8L,CAAd,EACEb,EAAA,CAAmBjO,CAAnB,CAA4B,MAA5B,CAAoCgD,CAApC,CAA2C,EAA3C,CAGF,IAAI4L,CAAJ,CACE5L,CAAA,CAAKxJ,CAAL,CAAA,CAAYY,CADd,KAGE,IAAIyU,CAAJ,CAAgB,CACd,GAAIC,CAAJ,CAEE,MAAO9L,EAAP,EAAeA,CAAA,CAAKxJ,CAAL,CAEfyB;CAAA,CAAO+H,CAAP,CAAaxJ,CAAb,CALY,CAAhB,IAQE,OAAOwJ,EArB4B,CA0BzC+L,QAASA,GAAc,CAAC/O,CAAD,CAAUgP,CAAV,CAAoB,CACzC,MAAKhP,EAAAiP,aAAL,CAEuC,EAFvC,CACSvO,CAAA,GAAAA,EAAOV,CAAAiP,aAAA,CAAqB,OAArB,CAAPvO,EAAwC,EAAxCA,EAA8C,GAA9CA,SAAA,CAA2D,SAA3D,CAAsE,GAAtE,CAAAzD,QAAA,CACI,GADJ,CACU+R,CADV,CACqB,GADrB,CADT,CAAkC,CAAA,CADO,CAM3CE,QAASA,GAAiB,CAAClP,CAAD,CAAUmP,CAAV,CAAsB,CAC1CA,CAAJ,EAAkBnP,CAAAoP,aAAlB,EACE/V,CAAA,CAAQ8V,CAAAnO,MAAA,CAAiB,GAAjB,CAAR,CAA+B,QAAQ,CAACqO,CAAD,CAAW,CAChDrP,CAAAoP,aAAA,CAAqB,OAArB,CAA8BpD,EAAA,CACzBtL,CAAA,GAAAA,EAAOV,CAAAiP,aAAA,CAAqB,OAArB,CAAPvO,EAAwC,EAAxCA,EAA8C,GAA9CA,SAAA,CACQ,SADR,CACmB,GADnB,CAAAA,QAAA,CAEQ,GAFR,CAEcsL,EAAA,CAAKqD,CAAL,CAFd,CAE+B,GAF/B,CAEoC,GAFpC,CADyB,CAA9B,CADgD,CAAlD,CAF4C,CAYhDC,QAASA,GAAc,CAACtP,CAAD,CAAUmP,CAAV,CAAsB,CAC3C,GAAIA,CAAJ,EAAkBnP,CAAAoP,aAAlB,CAAwC,CACtC,IAAIG,EAAmB7O,CAAA,GAAAA,EAAOV,CAAAiP,aAAA,CAAqB,OAArB,CAAPvO,EAAwC,EAAxCA,EAA8C,GAA9CA,SAAA,CACU,SADV,CACqB,GADrB,CAGvBrH,EAAA,CAAQ8V,CAAAnO,MAAA,CAAiB,GAAjB,CAAR,CAA+B,QAAQ,CAACqO,CAAD,CAAW,CAChDA,CAAA,CAAWrD,EAAA,CAAKqD,CAAL,CAC4C,GAAvD,GAAIE,CAAAtS,QAAA,CAAwB,GAAxB,CAA8BoS,CAA9B,CAAyC,GAAzC,CAAJ;CACEE,CADF,EACqBF,CADrB,CACgC,GADhC,CAFgD,CAAlD,CAOArP,EAAAoP,aAAA,CAAqB,OAArB,CAA8BpD,EAAA,CAAKuD,CAAL,CAA9B,CAXsC,CADG,CAgB7C/B,QAASA,GAAc,CAACgC,CAAD,CAAO9N,CAAP,CAAiB,CACtC,GAAIA,CAAJ,CAAc,CACZA,CAAA,CAAaA,CAAAhF,SACF,EADuB,CAAAX,CAAA,CAAU2F,CAAAzI,OAAV,CACvB,EADsDD,EAAA,CAAS0I,CAAT,CACtD,CACP,CAAEA,CAAF,CADO,CAAPA,CAEJ,KAAI,IAAIzH,EAAE,CAAV,CAAaA,CAAb,CAAiByH,CAAAzI,OAAjB,CAAkCgB,CAAA,EAAlC,CACEuV,CAAA1V,KAAA,CAAU4H,CAAA,CAASzH,CAAT,CAAV,CALU,CADwB,CAWxCwV,QAASA,GAAgB,CAACzP,CAAD,CAAU+B,CAAV,CAAgB,CACvC,MAAO2N,GAAA,CAAoB1P,CAApB,CAA6B,GAA7B,EAAoC+B,CAApC,EAA4C,cAA5C,EAA+D,YAA/D,CADgC,CAIzC2N,QAASA,GAAmB,CAAC1P,CAAD,CAAU+B,CAAV,CAAgB3H,CAAhB,CAAuB,CACjD4F,CAAA,CAAUC,CAAA,CAAOD,CAAP,CAIgB,EAA1B,EAAGA,CAAA,CAAQ,CAAR,CAAA9G,SAAH,GACE8G,CADF,CACYA,CAAAnD,KAAA,CAAa,MAAb,CADZ,CAKA,KAFIgF,CAEJ,CAFYzI,CAAA,CAAQ2I,CAAR,CAAA,CAAgBA,CAAhB,CAAuB,CAACA,CAAD,CAEnC,CAAO/B,CAAA/G,OAAP,CAAA,CAAuB,CAErB,IADA,IAAIwD,EAAOuD,CAAA,CAAQ,CAAR,CAAX,CACS/F,EAAI,CADb,CACgB0V,EAAK9N,CAAA5I,OAArB,CAAmCgB,CAAnC,CAAuC0V,CAAvC,CAA2C1V,CAAA,EAA3C,CACE,IAAKG,CAAL,CAAa4F,CAAAgD,KAAA,CAAanB,CAAA,CAAM5H,CAAN,CAAb,CAAb,IAAyCrB,CAAzC,CAAoD,MAAOwB,EAM7D4F,EAAA,CAAUC,CAAA,CAAOxD,CAAAmT,WAAP,EAA6C,EAA7C,GAA2BnT,CAAAvD,SAA3B,EAAmDuD,CAAAoT,KAAnD,CATW,CAV0B,CAuBnDC,QAASA,GAAW,CAAC9P,CAAD,CAAU,CAC5B,IAD4B,IACnB/F,EAAI,CADe,CACZoT,EAAarN,CAAAqN,WAA7B,CAAiDpT,CAAjD,CAAqDoT,CAAApU,OAArD,CAAwEgB,CAAA,EAAxE,CACE0T,EAAA,CAAaN,CAAA,CAAWpT,CAAX,CAAb,CAEF,KAAA,CAAO+F,CAAAiN,WAAP,CAAA,CACEjN,CAAAgN,YAAA,CAAoBhN,CAAAiN,WAApB,CAL0B,CAp7ES;AAm/EvC8C,QAASA,GAAkB,CAAC/P,CAAD,CAAU+B,CAAV,CAAgB,CAEzC,IAAIiO,EAAcC,EAAA,CAAalO,CAAA6B,YAAA,EAAb,CAGlB,OAAOoM,EAAP,EAAsBE,EAAA,CAAiBlQ,CAAAtD,SAAjB,CAAtB,EAA4DsT,CALnB,CAgM3CG,QAASA,GAAkB,CAACnQ,CAAD,CAAUgO,CAAV,CAAkB,CAC3C,IAAIG,EAAeA,QAAS,CAACiC,CAAD,CAAQtC,CAAR,CAAc,CACnCsC,CAAAC,eAAL,GACED,CAAAC,eADF,CACyBC,QAAQ,EAAG,CAChCF,CAAAG,YAAA,CAAoB,CAAA,CADY,CADpC,CAMKH,EAAAI,gBAAL,GACEJ,CAAAI,gBADF,CAC0BC,QAAQ,EAAG,CACjCL,CAAAM,aAAA,CAAqB,CAAA,CADY,CADrC,CAMKN,EAAAO,OAAL,GACEP,CAAAO,OADF,CACiBP,CAAAQ,WADjB,EACqCjY,CADrC,CAIA,IAAImD,CAAA,CAAYsU,CAAAS,iBAAZ,CAAJ,CAAyC,CACvC,IAAIC,EAAUV,CAAAC,eACdD,EAAAC,eAAA,CAAuBC,QAAQ,EAAG,CAChCF,CAAAS,iBAAA,CAAyB,CAAA,CACzBC,EAAAnX,KAAA,CAAayW,CAAb,CAFgC,CAIlCA,EAAAS,iBAAA,CAAyB,CAAA,CANc,CASzCT,CAAAW,mBAAA,CAA2BC,QAAQ,EAAG,CACpC,MAAOZ,EAAAS,iBAAP,EAAuD,CAAA,CAAvD,GAAiCT,CAAAG,YADG,CAKtC,KAAIU,EAAoBnT,EAAA,CAAYkQ,CAAA,CAAOF,CAAP;AAAesC,CAAAtC,KAAf,CAAZ,EAA0C,EAA1C,CAExBzU,EAAA,CAAQ4X,CAAR,CAA2B,QAAQ,CAACpS,CAAD,CAAK,CACtCA,CAAAlF,KAAA,CAAQqG,CAAR,CAAiBoQ,CAAjB,CADsC,CAAxC,CAMY,EAAZ,EAAIc,CAAJ,EAEEd,CAAAC,eAEA,CAFuB,IAEvB,CADAD,CAAAI,gBACA,CADwB,IACxB,CAAAJ,CAAAW,mBAAA,CAA2B,IAJ7B,GAOE,OAAOX,CAAAC,eAEP,CADA,OAAOD,CAAAI,gBACP,CAAA,OAAOJ,CAAAW,mBATT,CAvCwC,CAmD1C5C,EAAAgD,KAAA,CAAoBnR,CACpB,OAAOmO,EArDoC,CA+S7CiD,QAASA,GAAO,CAACrY,CAAD,CAAM,CAAA,IAChBsY,EAAU,MAAOtY,EADD,CAEhBS,CAEW,SAAf,EAAI6X,CAAJ,EAAmC,IAAnC,GAA2BtY,CAA3B,CACsC,UAApC,EAAI,OAAQS,CAAR,CAAcT,CAAAiC,UAAd,CAAJ,CAEExB,CAFF,CAEQT,CAAAiC,UAAA,EAFR,CAGWxB,CAHX,GAGmBZ,CAHnB,GAIEY,CAJF,CAIQT,CAAAiC,UAJR,CAIwBX,EAAA,EAJxB,CADF,CAQEb,CARF,CAQQT,CAGR,OAAOsY,EAAP,CAAiB,GAAjB,CAAuB7X,CAfH,CAqBtB8X,QAASA,GAAO,CAACpU,CAAD,CAAO,CACrB7D,CAAA,CAAQ6D,CAAR,CAAe,IAAAqU,IAAf,CAAyB,IAAzB,CADqB,CAkGvBC,QAASA,GAAQ,CAAC3S,CAAD,CAAK,CAAA,IAChB4S,CADgB,CAEhBC,CAIa,WAAjB,EAAI,MAAO7S,EAAX,EACQ4S,CADR,CACkB5S,CAAA4S,QADlB,IAEIA,CAUA,CAVU,EAUV,CATI5S,CAAA5F,OASJ,GAREyY,CAEA,CAFS7S,CAAA1C,SAAA,EAAAuE,QAAA,CAAsBiR,EAAtB;AAAsC,EAAtC,CAET,CADAC,CACA,CADUF,CAAAjR,MAAA,CAAaoR,EAAb,CACV,CAAAxY,CAAA,CAAQuY,CAAA,CAAQ,CAAR,CAAA5Q,MAAA,CAAiB8Q,EAAjB,CAAR,CAAwC,QAAQ,CAAChO,CAAD,CAAK,CACnDA,CAAApD,QAAA,CAAYqR,EAAZ,CAAoB,QAAQ,CAACC,CAAD,CAAMC,CAAN,CAAkBlQ,CAAlB,CAAuB,CACjD0P,CAAA3X,KAAA,CAAaiI,CAAb,CADiD,CAAnD,CADmD,CAArD,CAMF,EAAAlD,CAAA4S,QAAA,CAAaA,CAZjB,EAcWrY,CAAA,CAAQyF,CAAR,CAAJ,EACLqT,CAEA,CAFOrT,CAAA5F,OAEP,CAFmB,CAEnB,CADA+K,EAAA,CAAYnF,CAAA,CAAGqT,CAAH,CAAZ,CAAsB,IAAtB,CACA,CAAAT,CAAA,CAAU5S,CAAAE,MAAA,CAAS,CAAT,CAAYmT,CAAZ,CAHL,EAKLlO,EAAA,CAAYnF,CAAZ,CAAgB,IAAhB,CAAsB,CAAA,CAAtB,CAEF,OAAO4S,EA3Ba,CAygBtB/O,QAASA,GAAc,CAACyP,CAAD,CAAgB,CAmCrCC,QAASA,EAAa,CAACC,CAAD,CAAW,CAC/B,MAAO,SAAQ,CAAC7Y,CAAD,CAAMY,CAAN,CAAa,CAC1B,GAAI4B,CAAA,CAASxC,CAAT,CAAJ,CACEH,CAAA,CAAQG,CAAR,CAAaU,EAAA,CAAcmY,CAAd,CAAb,CADF,KAGE,OAAOA,EAAA,CAAS7Y,CAAT,CAAcY,CAAd,CAJiB,CADG,CAUjCiL,QAASA,EAAQ,CAACtD,CAAD,CAAOuQ,CAAP,CAAkB,CACjCnO,EAAA,CAAwBpC,CAAxB,CAA8B,SAA9B,CACA,IAAItI,CAAA,CAAW6Y,CAAX,CAAJ,EAA6BlZ,CAAA,CAAQkZ,CAAR,CAA7B,CACEA,CAAA,CAAYC,CAAAC,YAAA,CAA6BF,CAA7B,CAEd,IAAI,CAACA,CAAAG,KAAL,CACE,KAAM1N,GAAA,CAAgB,MAAhB,CAA2EhD,CAA3E,CAAN,CAEF,MAAO2Q,EAAA,CAAc3Q,CAAd,CAAqB4Q,CAArB,CAAP,CAA8CL,CARb,CAWnCrN,QAASA,EAAO,CAAClD,CAAD,CAAO6Q,CAAP,CAAkB,CAAE,MAAOvN,EAAA,CAAStD,CAAT,CAAe,MAAQ6Q,CAAR,CAAf,CAAT,CA6BlCC,QAASA,EAAW,CAACV,CAAD,CAAe,CAAA,IAC7BzM,EAAY,EADiB,CACboN,CADa,CACHtN,CADG,CACUvL,CADV,CACa0V,CAC9CtW,EAAA,CAAQ8Y,CAAR,CAAuB,QAAQ,CAACvQ,CAAD,CAAS,CACtC,GAAI,CAAAmR,CAAAC,IAAA,CAAkBpR,CAAlB,CAAJ,CAAA,CACAmR,CAAAxB,IAAA,CAAkB3P,CAAlB,CAA0B,CAAA,CAA1B,CAEA,IAAI,CACF,GAAIzI,CAAA,CAASyI,CAAT,CAAJ,CAIE,IAHAkR,CAGgD;AAHrC7M,EAAA,CAAcrE,CAAd,CAGqC,CAFhD8D,CAEgD,CAFpCA,CAAAxG,OAAA,CAAiB2T,CAAA,CAAYC,CAAA5N,SAAZ,CAAjB,CAAAhG,OAAA,CAAwD4T,CAAAG,WAAxD,CAEoC,CAA5CzN,CAA4C,CAA9BsN,CAAAI,aAA8B,CAAPjZ,CAAO,CAAH,CAAG,CAAA0V,CAAA,CAAKnK,CAAAvM,OAArD,CAAyEgB,CAAzE,CAA6E0V,CAA7E,CAAiF1V,CAAA,EAAjF,CAAsF,CAAA,IAChFkZ,EAAa3N,CAAA,CAAYvL,CAAZ,CADmE,CAEhFoL,EAAWkN,CAAAS,IAAA,CAAqBG,CAAA,CAAW,CAAX,CAArB,CAEf9N,EAAA,CAAS8N,CAAA,CAAW,CAAX,CAAT,CAAAlU,MAAA,CAA8BoG,CAA9B,CAAwC8N,CAAA,CAAW,CAAX,CAAxC,CAJoF,CAJxF,IAUW1Z,EAAA,CAAWmI,CAAX,CAAJ,CACH8D,CAAA5L,KAAA,CAAeyY,CAAA5P,OAAA,CAAwBf,CAAxB,CAAf,CADG,CAEIxI,CAAA,CAAQwI,CAAR,CAAJ,CACH8D,CAAA5L,KAAA,CAAeyY,CAAA5P,OAAA,CAAwBf,CAAxB,CAAf,CADG,CAGLoC,EAAA,CAAYpC,CAAZ,CAAoB,QAApB,CAhBA,CAkBF,MAAOxB,CAAP,CAAU,CAYV,KAXIhH,EAAA,CAAQwI,CAAR,CAWE,GAVJA,CAUI,CAVKA,CAAA,CAAOA,CAAA3I,OAAP,CAAuB,CAAvB,CAUL,EARFmH,CAAAgT,QAQE,GARWhT,CAAAiT,MAQX,EARqD,EAQrD,EARsBjT,CAAAiT,MAAApW,QAAA,CAAgBmD,CAAAgT,QAAhB,CAQtB,IAFJhT,CAEI,CAFAA,CAAAgT,QAEA,CAFY,IAEZ,CAFmBhT,CAAAiT,MAEnB,EAAAtO,EAAA,CAAgB,UAAhB,CACInD,CADJ,CACYxB,CAAAiT,MADZ,EACuBjT,CAAAgT,QADvB,EACoChT,CADpC,CAAN,CAZU,CArBZ,CADsC,CAAxC,CAsCA,OAAOsF,EAxC0B,CA+CnC4N,QAASA,EAAsB,CAACC,CAAD,CAAQtO,CAAR,CAAiB,CAE9CuO,QAASA,EAAU,CAACC,CAAD,CAAc,CAC/B,GAAIF,CAAA7Z,eAAA,CAAqB+Z,CAArB,CAAJ,CAAuC,CACrC,GAAIF,CAAA,CAAME,CAAN,CAAJ,GAA2BC,CAA3B,CACE,KAAM3O,GAAA,CAAgB,MAAhB,CAA0DV,CAAA3J,KAAA,CAAU,MAAV,CAA1D,CAAN,CAEF,MAAO6Y,EAAA,CAAME,CAAN,CAJ8B,CAMrC,GAAI,CAGF,MAFApP,EAAAxJ,QAAA,CAAa4Y,CAAb,CAEO;AADPF,CAAA,CAAME,CAAN,CACO,CADcC,CACd,CAAAH,CAAA,CAAME,CAAN,CAAA,CAAqBxO,CAAA,CAAQwO,CAAR,CAH1B,CAIF,MAAOE,CAAP,CAAY,CAIZ,KAHIJ,EAAA,CAAME,CAAN,CAGEE,GAHqBD,CAGrBC,EAFJ,OAAOJ,CAAA,CAAME,CAAN,CAEHE,CAAAA,CAAN,CAJY,CAJd,OASU,CACRtP,CAAAoH,MAAA,EADQ,CAhBmB,CAsBjC9I,QAASA,EAAM,CAAC9D,CAAD,CAAKD,CAAL,CAAWgV,CAAX,CAAkB,CAAA,IAC3BC,EAAO,EADoB,CAE3BpC,EAAUD,EAAA,CAAS3S,CAAT,CAFiB,CAG3B5F,CAH2B,CAGnBgB,CAHmB,CAI3BT,CAEAS,EAAA,CAAI,CAAR,KAAWhB,CAAX,CAAoBwY,CAAAxY,OAApB,CAAoCgB,CAApC,CAAwChB,CAAxC,CAAgDgB,CAAA,EAAhD,CAAqD,CACnDT,CAAA,CAAMiY,CAAA,CAAQxX,CAAR,CACN,IAAmB,QAAnB,GAAI,MAAOT,EAAX,CACE,KAAMuL,GAAA,CAAgB,MAAhB,CACyEvL,CADzE,CAAN,CAGFqa,CAAA/Z,KAAA,CACE8Z,CACA,EADUA,CAAAla,eAAA,CAAsBF,CAAtB,CACV,CAAEoa,CAAA,CAAOpa,CAAP,CAAF,CACEga,CAAA,CAAWha,CAAX,CAHJ,CANmD,CAYhDqF,CAAA4S,QAAL,GAEE5S,CAFF,CAEOA,CAAA,CAAG5F,CAAH,CAFP,CAOA,OAAO4F,EAAAI,MAAA,CAASL,CAAT,CAAeiV,CAAf,CAzBwB,CAyCjC,MAAO,QACGlR,CADH,aAbP6P,QAAoB,CAACsB,CAAD,CAAOF,CAAP,CAAe,CAAA,IAC7BG,EAAcA,QAAQ,EAAG,EADI,CAEnBC,CAIdD,EAAAE,UAAA,CAAyBA,CAAA7a,CAAA,CAAQ0a,CAAR,CAAA,CAAgBA,CAAA,CAAKA,CAAA7a,OAAL,CAAmB,CAAnB,CAAhB,CAAwC6a,CAAxCG,WACzBC,EAAA,CAAW,IAAIH,CACfC,EAAA,CAAgBrR,CAAA,CAAOmR,CAAP,CAAaI,CAAb,CAAuBN,CAAvB,CAEhB,OAAO5X,EAAA,CAASgY,CAAT,CAAA,EAA2Bva,CAAA,CAAWua,CAAX,CAA3B,CAAuDA,CAAvD,CAAuEE,CAV7C,CAa5B,KAGAV,CAHA,UAIKhC,EAJL,KAKA2C,QAAQ,CAACpS,CAAD,CAAO,CAClB,MAAO2Q,EAAAhZ,eAAA,CAA6BqI,CAA7B,CAAoC4Q,CAApC,CAAP,EAA8DY,CAAA7Z,eAAA,CAAqBqI,CAArB,CAD5C,CALf,CAjEuC,CApIX;AAAA,IACjC2R,EAAgB,EADiB,CAEjCf,EAAiB,UAFgB,CAGjCtO,EAAO,EAH0B,CAIjC0O,EAAgB,IAAIzB,EAJa,CAKjCoB,EAAgB,UACJ,UACIN,CAAA,CAAc/M,CAAd,CADJ,SAEG+M,CAAA,CAAcnN,CAAd,CAFH,SAGGmN,CAAA,CAiDnBgC,QAAgB,CAACrS,CAAD,CAAOmC,CAAP,CAAoB,CAClC,MAAOe,EAAA,CAAQlD,CAAR,CAAc,CAAC,WAAD,CAAc,QAAQ,CAACsS,CAAD,CAAY,CACrD,MAAOA,EAAA7B,YAAA,CAAsBtO,CAAtB,CAD8C,CAAlC,CAAd,CAD2B,CAjDjB,CAHH,OAICkO,CAAA,CAsDjBhY,QAAc,CAAC2H,CAAD,CAAO3C,CAAP,CAAY,CAAE,MAAO6F,EAAA,CAAQlD,CAAR,CAAclG,EAAA,CAAQuD,CAAR,CAAd,CAAT,CAtDT,CAJD,UAKIgT,CAAA,CAuDpBkC,QAAiB,CAACvS,CAAD,CAAO3H,CAAP,CAAc,CAC7B+J,EAAA,CAAwBpC,CAAxB,CAA8B,UAA9B,CACA2Q,EAAA,CAAc3Q,CAAd,CAAA,CAAsB3H,CACtBma,EAAA,CAAcxS,CAAd,CAAA,CAAsB3H,CAHO,CAvDX,CALJ,WAkEhBoa,QAAkB,CAACf,CAAD,CAAcgB,CAAd,CAAuB,CAAA,IACnCC,EAAenC,CAAAS,IAAA,CAAqBS,CAArB,CAAmCd,CAAnC,CADoB,CAEnCgC,EAAWD,CAAAjC,KAEfiC,EAAAjC,KAAA,CAAoBmC,QAAQ,EAAG,CAC7B,IAAIC,EAAeC,CAAAnS,OAAA,CAAwBgS,CAAxB,CAAkCD,CAAlC,CACnB,OAAOI,EAAAnS,OAAA,CAAwB8R,CAAxB,CAAiC,IAAjC,CAAuC,WAAYI,CAAZ,CAAvC,CAFsB,CAJQ,CAlEzB,CADI,CALiB,CAejCtC,EAAoBG,CAAA2B,UAApB9B,CACIe,CAAA,CAAuBZ,CAAvB,CAAsC,QAAQ,EAAG,CAC/C,KAAM3N,GAAA,CAAgB,MAAhB,CAAiDV,CAAA3J,KAAA,CAAU,MAAV,CAAjD,CAAN,CAD+C,CAAjD,CAhB6B,CAmBjC6Z,EAAgB,EAnBiB,CAoBjCO,EAAoBP,CAAAF,UAApBS,CACIxB,CAAA,CAAuBiB,CAAvB,CAAsC,QAAQ,CAACQ,CAAD,CAAc,CACtD1P,CAAAA,CAAWkN,CAAAS,IAAA,CAAqB+B,CAArB;AAAmCpC,CAAnC,CACf,OAAOmC,EAAAnS,OAAA,CAAwB0C,CAAAoN,KAAxB,CAAuCpN,CAAvC,CAFmD,CAA5D,CAMRhM,EAAA,CAAQwZ,CAAA,CAAYV,CAAZ,CAAR,CAAoC,QAAQ,CAACtT,CAAD,CAAK,CAAEiW,CAAAnS,OAAA,CAAwB9D,CAAxB,EAA8BnD,CAA9B,CAAF,CAAjD,CAEA,OAAOoZ,EA7B8B,CAkQvCjM,QAASA,GAAqB,EAAG,CAE/B,IAAImM,EAAuB,CAAA,CAE3B,KAAAC,qBAAA,CAA4BC,QAAQ,EAAG,CACrCF,CAAA,CAAuB,CAAA,CADc,CAIvC,KAAAvC,KAAA,CAAY,CAAC,SAAD,CAAY,WAAZ,CAAyB,YAAzB,CAAuC,QAAQ,CAAC0C,CAAD,CAAUC,CAAV,CAAqBC,CAArB,CAAiC,CAO1FC,QAASA,EAAc,CAACtY,CAAD,CAAO,CAC5B,IAAIuY,EAAS,IACblc,EAAA,CAAQ2D,CAAR,CAAc,QAAQ,CAACgD,CAAD,CAAU,CACzBuV,CAAL,EAA+C,GAA/C,GAAezV,CAAA,CAAUE,CAAAtD,SAAV,CAAf,GAAoD6Y,CAApD,CAA6DvV,CAA7D,CAD8B,CAAhC,CAGA,OAAOuV,EALqB,CAQ9BC,QAASA,EAAM,EAAG,CAAA,IACZC,EAAOL,CAAAK,KAAA,EADK,CACaC,CAGxBD,EAAL,CAGK,CAAKC,CAAL,CAAW/c,CAAAqJ,eAAA,CAAwByT,CAAxB,CAAX,EAA2CC,CAAAC,eAAA,EAA3C,CAGA,CAAKD,CAAL,CAAWJ,CAAA,CAAe3c,CAAAid,kBAAA,CAA2BH,CAA3B,CAAf,CAAX,EAA8DC,CAAAC,eAAA,EAA9D,CAGa,KAHb,GAGIF,CAHJ,EAGoBN,CAAAU,SAAA,CAAiB,CAAjB,CAAoB,CAApB,CATzB,CAAWV,CAAAU,SAAA,CAAiB,CAAjB,CAAoB,CAApB,CAJK,CAdlB,IAAIld,EAAWwc,CAAAxc,SAgCXqc,EAAJ,EACEK,CAAA5X,OAAA,CAAkBqY,QAAwB,EAAG,CAAC,MAAOV,EAAAK,KAAA,EAAR,CAA7C;AACEM,QAA8B,EAAG,CAC/BV,CAAA7X,WAAA,CAAsBgY,CAAtB,CAD+B,CADnC,CAMF,OAAOA,EAxCmF,CAAhF,CARmB,CA0SjCnL,QAASA,GAAuB,EAAE,CAChC,IAAAoI,KAAA,CAAY,CAAC,OAAD,CAAU,UAAV,CAAsB,QAAQ,CAACuD,CAAD,CAAQC,CAAR,CAAkB,CAC1D,MAAOD,EAAAE,UACA,CAAH,QAAQ,CAACrX,CAAD,CAAK,CAAE,MAAOmX,EAAA,CAAMnX,CAAN,CAAT,CAAV,CACH,QAAQ,CAACA,CAAD,CAAK,CACb,MAAOoX,EAAA,CAASpX,CAAT,CAAa,CAAb,CAAgB,CAAA,CAAhB,CADM,CAHyC,CAAhD,CADoB,CAgClCsX,QAASA,GAAO,CAACzd,CAAD,CAASC,CAAT,CAAmByd,CAAnB,CAAyBC,CAAzB,CAAmC,CAsBjDC,QAASA,EAA0B,CAACzX,CAAD,CAAK,CACtC,GAAI,CACFA,CAAAI,MAAA,CAAS,IAAT,CArvGGF,EAAApF,KAAA,CAqvGsBwB,SArvGtB,CAqvGiC6D,CArvGjC,CAqvGH,CADE,CAAJ,OAEU,CAER,GADAuX,CAAA,EACI,CAA4B,CAA5B,GAAAA,CAAJ,CACE,IAAA,CAAMC,CAAAvd,OAAN,CAAA,CACE,GAAI,CACFud,CAAAC,IAAA,EAAA,EADE,CAEF,MAAOrW,CAAP,CAAU,CACVgW,CAAAM,MAAA,CAAWtW,CAAX,CADU,CANR,CAH4B,CAmExCuW,QAASA,EAAW,CAACC,CAAD,CAAWC,CAAX,CAAuB,CACxCC,SAASA,EAAK,EAAG,CAChBzd,CAAA,CAAQ0d,CAAR,CAAiB,QAAQ,CAACC,CAAD,CAAQ,CAAEA,CAAA,EAAF,CAAjC,CACAC,EAAA,CAAcJ,CAAA,CAAWC,CAAX,CAAkBF,CAAlB,CAFE,CAAjBE,CAAA,EADwC,CAuE3CI,QAASA,EAAa,EAAG,CACvBC,CAAA,CAAc,IACVC,EAAJ,EAAsBxY,CAAAyY,IAAA,EAAtB,GAEAD,CACA,CADiBxY,CAAAyY,IAAA,EACjB,CAAAhe,CAAA,CAAQie,EAAR,CAA4B,QAAQ,CAACC,CAAD,CAAW,CAC7CA,CAAA,CAAS3Y,CAAAyY,IAAA,EAAT,CAD6C,CAA/C,CAHA,CAFuB,CAhKwB,IAC7CzY,EAAO,IADsC,CAE7C4Y,EAAc7e,CAAA,CAAS,CAAT,CAF+B,CAG7C0D,EAAW3D,CAAA2D,SAHkC,CAI7Cob,EAAU/e,CAAA+e,QAJmC;AAK7CZ,EAAane,CAAAme,WALgC,CAM7Ca,EAAehf,CAAAgf,aAN8B,CAO7CC,EAAkB,EAEtB/Y,EAAAgZ,OAAA,CAAc,CAAA,CAEd,KAAIrB,EAA0B,CAA9B,CACIC,EAA8B,EAGlC5X,EAAAiZ,6BAAA,CAAoCvB,CACpC1X,EAAAkZ,6BAAA,CAAoCC,QAAQ,EAAG,CAAExB,CAAA,EAAF,CA6B/C3X,EAAAoZ,gCAAA,CAAuCC,QAAQ,CAACC,CAAD,CAAW,CAIxD7e,CAAA,CAAQ0d,CAAR,CAAiB,QAAQ,CAACC,CAAD,CAAQ,CAAEA,CAAA,EAAF,CAAjC,CAEgC,EAAhC,GAAIT,CAAJ,CACE2B,CAAA,EADF,CAGE1B,CAAA1c,KAAA,CAAiCoe,CAAjC,CATsD,CA7CT,KA6D7CnB,EAAU,EA7DmC,CA8D7CE,CAaJrY,EAAAuZ,UAAA,CAAiBC,QAAQ,CAACvZ,CAAD,CAAK,CACxB/C,CAAA,CAAYmb,CAAZ,CAAJ,EAA8BN,CAAA,CAAY,GAAZ,CAAiBE,CAAjB,CAC9BE,EAAAjd,KAAA,CAAa+E,CAAb,CACA,OAAOA,EAHqB,CA3EmB,KAoG7CuY,EAAiB/a,CAAAgc,KApG4B,CAqG7CC,EAAc3f,CAAAkE,KAAA,CAAc,MAAd,CArG+B,CAsG7Csa,EAAc,IAqBlBvY,EAAAyY,IAAA,CAAWkB,QAAQ,CAAClB,CAAD,CAAM3W,CAAN,CAAe,CAE5BrE,CAAJ,GAAiB3D,CAAA2D,SAAjB,GAAkCA,CAAlC,CAA6C3D,CAAA2D,SAA7C,CACIob,EAAJ,GAAgB/e,CAAA+e,QAAhB,GAAgCA,CAAhC,CAA0C/e,CAAA+e,QAA1C,CAGA,IAAIJ,CAAJ,CACE,IAAID,CAAJ,EAAsBC,CAAtB,CAiBA,MAhBAD,EAgBOxY,CAhBUyY,CAgBVzY,CAfHyX,CAAAoB,QAAJ,CACM/W,CAAJ,CAAa+W,CAAAe,aAAA,CAAqB,IAArB,CAA2B,EAA3B,CAA+BnB,CAA/B,CAAb,EAEEI,CAAAgB,UAAA,CAAkB,IAAlB,CAAwB,EAAxB;AAA4BpB,CAA5B,CAEA,CAAAiB,CAAA1b,KAAA,CAAiB,MAAjB,CAAyB0b,CAAA1b,KAAA,CAAiB,MAAjB,CAAzB,CAJF,CADF,EAQEua,CACA,CADcE,CACd,CAAI3W,CAAJ,CACErE,CAAAqE,QAAA,CAAiB2W,CAAjB,CADF,CAGEhb,CAAAgc,KAHF,CAGkBhB,CAZpB,CAeOzY,CAAAA,CAjBP,CADF,IAwBE,OAAOuY,EAAP,EAAsB9a,CAAAgc,KAAA3X,QAAA,CAAsB,MAAtB,CAA6B,GAA7B,CA9BQ,CA3He,KA6J7C4W,GAAqB,EA7JwB,CA8J7CoB,EAAgB,CAAA,CAiCpB9Z,EAAA+Z,YAAA,CAAmBC,QAAQ,CAACV,CAAD,CAAW,CAEpC,GAAI,CAACQ,CAAL,CAAoB,CAMlB,GAAIrC,CAAAoB,QAAJ,CAAsBxX,CAAA,CAAOvH,CAAP,CAAAmgB,GAAA,CAAkB,UAAlB,CAA8B3B,CAA9B,CAEtB,IAAIb,CAAAyC,WAAJ,CAAyB7Y,CAAA,CAAOvH,CAAP,CAAAmgB,GAAA,CAAkB,YAAlB,CAAgC3B,CAAhC,CAAzB,KAEKtY,EAAAuZ,UAAA,CAAejB,CAAf,CAELwB,EAAA,CAAgB,CAAA,CAZE,CAepBpB,EAAAxd,KAAA,CAAwBoe,CAAxB,CACA,OAAOA,EAlB6B,CAkCtCtZ,EAAAma,SAAA,CAAgBC,QAAQ,EAAG,CACzB,IAAIX,EAAOC,CAAA1b,KAAA,CAAiB,MAAjB,CACX,OAAOyb,EAAA,CAAOA,CAAA3X,QAAA,CAAa,wBAAb,CAAuC,EAAvC,CAAP,CAAoD,EAFlC,CAQ3B,KAAIuY,EAAc,EAAlB,CACIC,GAAmB,EADvB,CAEIC,EAAava,CAAAma,SAAA,EAsBjBna,EAAAwa,QAAA,CAAeC,QAAQ,CAACtX,CAAD,CAAO3H,CAAP,CAAc,CAAA,IAE/Bkf,CAF+B,CAEJC,CAFI,CAEItf,CAFJ,CAEOK,CAE1C,IAAIyH,CAAJ,CACM3H,CAAJ,GAAcxB,CAAd,CACE4e,CAAA+B,OADF,CACuBC,MAAA,CAAOzX,CAAP,CADvB,CACsC,SADtC,CACkDoX,CADlD,CAE0B,wCAF1B;AAIMhgB,CAAA,CAASiB,CAAT,CAJN,GAKIkf,CAOA,CAPgBrgB,CAAAue,CAAA+B,OAAAtgB,CAAqBugB,MAAA,CAAOzX,CAAP,CAArB9I,CAAoC,GAApCA,CAA0CugB,MAAA,CAAOpf,CAAP,CAA1CnB,CACM,QADNA,CACiBkgB,CADjBlgB,QAOhB,CANsD,CAMtD,CAAmB,IAAnB,CAAIqgB,CAAJ,EACElD,CAAAqD,KAAA,CAAU,UAAV,CAAsB1X,CAAtB,CACE,6DADF,CAEEuX,CAFF,CAEiB,iBAFjB,CAbN,CADF,KAoBO,CACL,GAAI9B,CAAA+B,OAAJ,GAA2BL,EAA3B,CAKE,IAJAA,EAIK,CAJc1B,CAAA+B,OAId,CAHLG,CAGK,CAHSR,EAAAlY,MAAA,CAAuB,IAAvB,CAGT,CAFLiY,CAEK,CAFS,EAET,CAAAhf,CAAA,CAAI,CAAT,CAAYA,CAAZ,CAAgByf,CAAAzgB,OAAhB,CAAoCgB,CAAA,EAApC,CACEsf,CAEA,CAFSG,CAAA,CAAYzf,CAAZ,CAET,CADAK,CACA,CADQif,CAAAtc,QAAA,CAAe,GAAf,CACR,CAAY,CAAZ,CAAI3C,CAAJ,GACEyH,CAIA,CAJO4X,QAAA,CAASJ,CAAAK,UAAA,CAAiB,CAAjB,CAAoBtf,CAApB,CAAT,CAIP,CAAI2e,CAAA,CAAYlX,CAAZ,CAAJ,GAA0BnJ,CAA1B,GACEqgB,CAAA,CAAYlX,CAAZ,CADF,CACsB4X,QAAA,CAASJ,CAAAK,UAAA,CAAiBtf,CAAjB,CAAyB,CAAzB,CAAT,CADtB,CALF,CAWJ,OAAO2e,EApBF,CAxB4B,CA+DrCra,EAAAib,MAAA,CAAaC,QAAQ,CAACjb,CAAD,CAAKkb,CAAL,CAAY,CAC/B,IAAIC,CACJzD,EAAA,EACAyD,EAAA,CAAYnD,CAAA,CAAW,QAAQ,EAAG,CAChC,OAAOc,CAAA,CAAgBqC,CAAhB,CACP1D,EAAA,CAA2BzX,CAA3B,CAFgC,CAAtB,CAGTkb,CAHS,EAGA,CAHA,CAIZpC,EAAA,CAAgBqC,CAAhB,CAAA,CAA6B,CAAA,CAC7B,OAAOA,EARwB,CAsBjCpb,EAAAib,MAAAI,OAAA,CAAoBC,QAAQ,CAACC,CAAD,CAAU,CACpC,MAAIxC,EAAA,CAAgBwC,CAAhB,CAAJ,EACE,OAAOxC,CAAA,CAAgBwC,CAAhB,CAGA;AAFPzC,CAAA,CAAayC,CAAb,CAEO,CADP7D,CAAA,CAA2B5a,CAA3B,CACO,CAAA,CAAA,CAJT,EAMO,CAAA,CAP6B,CAtVW,CAkWnDqN,QAASA,GAAgB,EAAE,CACzB,IAAA0J,KAAA,CAAY,CAAC,SAAD,CAAY,MAAZ,CAAoB,UAApB,CAAgC,WAAhC,CACR,QAAQ,CAAE0C,CAAF,CAAaiB,CAAb,CAAqBC,CAArB,CAAiC+D,CAAjC,CAA2C,CACjD,MAAO,KAAIjE,EAAJ,CAAYhB,CAAZ,CAAqBiF,CAArB,CAAgChE,CAAhC,CAAsCC,CAAtC,CAD0C,CAD3C,CADa,CAsF3BrN,QAASA,GAAqB,EAAG,CAE/B,IAAAyJ,KAAA,CAAY4H,QAAQ,EAAG,CAGrBC,QAASA,EAAY,CAACC,CAAD,CAAUC,CAAV,CAAmB,CAwMtCC,QAASA,EAAO,CAACC,CAAD,CAAQ,CAClBA,CAAJ,EAAaC,CAAb,GACOC,CAAL,CAEWA,CAFX,EAEuBF,CAFvB,GAGEE,CAHF,CAGaF,CAAAG,EAHb,EACED,CADF,CACaF,CAQb,CAHAI,CAAA,CAAKJ,CAAAG,EAAL,CAAcH,CAAAK,EAAd,CAGA,CAFAD,CAAA,CAAKJ,CAAL,CAAYC,CAAZ,CAEA,CADAA,CACA,CADWD,CACX,CAAAC,CAAAE,EAAA,CAAa,IAVf,CADsB,CAmBxBC,QAASA,EAAI,CAACE,CAAD,CAAYC,CAAZ,CAAuB,CAC9BD,CAAJ,EAAiBC,CAAjB,GACMD,CACJ,GADeA,CAAAD,EACf,CAD6BE,CAC7B,EAAIA,CAAJ,GAAeA,CAAAJ,EAAf,CAA6BG,CAA7B,CAFF,CADkC,CA1NpC,GAAIT,CAAJ,GAAeW,EAAf,CACE,KAAMriB,EAAA,CAAO,eAAP,CAAA,CAAwB,KAAxB,CAAkE0hB,CAAlE,CAAN,CAFoC,IAKlCY,EAAO,CAL2B,CAMlCC,EAAQngB,CAAA,CAAO,EAAP,CAAWuf,CAAX,CAAoB,IAAKD,CAAL,CAApB,CAN0B,CAOlCvX,EAAO,EAP2B,CAQlCqY,EAAYb,CAAZa,EAAuBb,CAAAa,SAAvBA,EAA4CC,MAAAC,UARV,CASlCC,EAAU,EATwB,CAUlCb,EAAW,IAVuB,CAWlCC,EAAW,IAyCf,OAAOM,EAAA,CAAOX,CAAP,CAAP,CAAyB,KAoBlBhJ,QAAQ,CAAC/X,CAAD,CAAMY,CAAN,CAAa,CACxB,GAAIihB,CAAJ,CAAeC,MAAAC,UAAf,CAAiC,CAC/B,IAAIE,EAAWD,CAAA,CAAQhiB,CAAR,CAAXiiB,GAA4BD,CAAA,CAAQhiB,CAAR,CAA5BiiB,CAA2C,KAAMjiB,CAAN,CAA3CiiB,CAEJhB;CAAA,CAAQgB,CAAR,CAH+B,CAMjC,GAAI,CAAA3f,CAAA,CAAY1B,CAAZ,CAAJ,CAQA,MAPMZ,EAOCY,GAPM4I,EAON5I,EAPa+gB,CAAA,EAOb/gB,CANP4I,CAAA,CAAKxJ,CAAL,CAMOY,CANKA,CAMLA,CAJH+gB,CAIG/gB,CAJIihB,CAIJjhB,EAHL,IAAAshB,OAAA,CAAYd,CAAAphB,IAAZ,CAGKY,CAAAA,CAfiB,CApBH,KAiDlB4Y,QAAQ,CAACxZ,CAAD,CAAM,CACjB,GAAI6hB,CAAJ,CAAeC,MAAAC,UAAf,CAAiC,CAC/B,IAAIE,EAAWD,CAAA,CAAQhiB,CAAR,CAEf,IAAI,CAACiiB,CAAL,CAAe,MAEfhB,EAAA,CAAQgB,CAAR,CAL+B,CAQjC,MAAOzY,EAAA,CAAKxJ,CAAL,CATU,CAjDI,QAwEfkiB,QAAQ,CAACliB,CAAD,CAAM,CACpB,GAAI6hB,CAAJ,CAAeC,MAAAC,UAAf,CAAiC,CAC/B,IAAIE,EAAWD,CAAA,CAAQhiB,CAAR,CAEf,IAAI,CAACiiB,CAAL,CAAe,MAEXA,EAAJ,EAAgBd,CAAhB,GAA0BA,CAA1B,CAAqCc,CAAAV,EAArC,CACIU,EAAJ,EAAgBb,CAAhB,GAA0BA,CAA1B,CAAqCa,CAAAZ,EAArC,CACAC,EAAA,CAAKW,CAAAZ,EAAL,CAAgBY,CAAAV,EAAhB,CAEA,QAAOS,CAAA,CAAQhiB,CAAR,CATwB,CAYjC,OAAOwJ,CAAA,CAAKxJ,CAAL,CACP2hB,EAAA,EAdoB,CAxEC,WAkGZQ,QAAQ,EAAG,CACpB3Y,CAAA,CAAO,EACPmY,EAAA,CAAO,CACPK,EAAA,CAAU,EACVb,EAAA,CAAWC,CAAX,CAAsB,IAJF,CAlGC,SAmHdgB,QAAQ,EAAG,CAGlBJ,CAAA,CADAJ,CACA,CAFApY,CAEA,CAFO,IAGP,QAAOkY,CAAA,CAAOX,CAAP,CAJW,CAnHG,MA2IjBsB,QAAQ,EAAG,CACf,MAAO5gB,EAAA,CAAO,EAAP,CAAWmgB,CAAX,CAAkB,MAAOD,CAAP,CAAlB,CADQ,CA3IM,CApDa,CAFxC,IAAID,EAAS,EA+ObZ,EAAAuB,KAAA,CAAoBC,QAAQ,EAAG,CAC7B,IAAID,EAAO,EACXxiB,EAAA,CAAQ6hB,CAAR,CAAgB,QAAQ,CAAC3H,CAAD,CAAQgH,CAAR,CAAiB,CACvCsB,CAAA,CAAKtB,CAAL,CAAA,CAAgBhH,CAAAsI,KAAA,EADuB,CAAzC,CAGA,OAAOA,EALsB,CAmB/BvB,EAAAtH,IAAA,CAAmB+I,QAAQ,CAACxB,CAAD,CAAU,CACnC,MAAOW,EAAA,CAAOX,CAAP,CAD4B,CAKrC;MAAOD,EAxQc,CAFQ,CAwTjCrQ,QAASA,GAAsB,EAAG,CAChC,IAAAwI,KAAA,CAAY,CAAC,eAAD,CAAkB,QAAQ,CAACuJ,CAAD,CAAgB,CACpD,MAAOA,EAAA,CAAc,WAAd,CAD6C,CAA1C,CADoB,CAmgBlC3V,QAASA,GAAgB,CAAC5D,CAAD,CAAWwZ,CAAX,CAAkC,CAAA,IACrDC,EAAgB,EADqC,CAErDC,EAAS,WAF4C,CAGrDC,EAA2B,wCAH0B,CAIrDC,EAAyB,gCAJ4B,CASrDC,EAA4B,yBAiB/B,KAAAhW,UAAA,CAAiBiW,QAASC,EAAiB,CAACza,CAAD,CAAO0a,CAAP,CAAyB,CACnEtY,EAAA,CAAwBpC,CAAxB,CAA8B,WAA9B,CACI5I,EAAA,CAAS4I,CAAT,CAAJ,EACE8B,EAAA,CAAU4Y,CAAV,CAA4B,kBAA5B,CA2BA,CA1BKP,CAAAxiB,eAAA,CAA6BqI,CAA7B,CA0BL,GAzBEma,CAAA,CAAcna,CAAd,CACA,CADsB,EACtB,CAAAU,CAAAwC,QAAA,CAAiBlD,CAAjB,CAAwBoa,CAAxB,CAAgC,CAAC,WAAD,CAAc,mBAAd,CAC9B,QAAQ,CAAC9H,CAAD,CAAYqI,CAAZ,CAA+B,CACrC,IAAIC,EAAa,EACjBtjB,EAAA,CAAQ6iB,CAAA,CAAcna,CAAd,CAAR,CAA6B,QAAQ,CAAC0a,CAAD,CAAmBniB,CAAnB,CAA0B,CAC7D,GAAI,CACF,IAAIgM,EAAY+N,CAAA1R,OAAA,CAAiB8Z,CAAjB,CACZhjB,EAAA,CAAW6M,CAAX,CAAJ,CACEA,CADF,CACc,SAAWzK,EAAA,CAAQyK,CAAR,CAAX,CADd,CAEYzD,CAAAyD,CAAAzD,QAFZ,EAEiCyD,CAAAwU,KAFjC,GAGExU,CAAAzD,QAHF;AAGsBhH,EAAA,CAAQyK,CAAAwU,KAAR,CAHtB,CAKAxU,EAAAsW,SAAA,CAAqBtW,CAAAsW,SAArB,EAA2C,CAC3CtW,EAAAhM,MAAA,CAAkBA,CAClBgM,EAAAvE,KAAA,CAAiBuE,CAAAvE,KAAjB,EAAmCA,CACnCuE,EAAAuW,QAAA,CAAoBvW,CAAAuW,QAApB,EAA0CvW,CAAAwW,WAA1C,EAAkExW,CAAAvE,KAClEuE,EAAAyW,SAAA,CAAqBzW,CAAAyW,SAArB,EAA2C,GAC3CJ,EAAA7iB,KAAA,CAAgBwM,CAAhB,CAZE,CAaF,MAAOlG,CAAP,CAAU,CACVsc,CAAA,CAAkBtc,CAAlB,CADU,CAdiD,CAA/D,CAkBA,OAAOuc,EApB8B,CADT,CAAhC,CAwBF,EAAAT,CAAA,CAAcna,CAAd,CAAAjI,KAAA,CAAyB2iB,CAAzB,CA5BF,EA8BEpjB,CAAA,CAAQ0I,CAAR,CAAc7H,EAAA,CAAcsiB,CAAd,CAAd,CAEF,OAAO,KAlC4D,CA0DrE,KAAAQ,2BAAA,CAAkCC,QAAQ,CAACC,CAAD,CAAS,CACjD,MAAInhB,EAAA,CAAUmhB,CAAV,CAAJ,EACEjB,CAAAe,2BAAA,CAAiDE,CAAjD,CACO,CAAA,IAFT,EAISjB,CAAAe,2BAAA,EALwC,CA8BnD,KAAAG,4BAAA,CAAmCC,QAAQ,CAACF,CAAD,CAAS,CAClD,MAAInhB,EAAA,CAAUmhB,CAAV,CAAJ,EACEjB,CAAAkB,4BAAA,CAAkDD,CAAlD,CACO,CAAA,IAFT,EAISjB,CAAAkB,4BAAA,EALyC,CASpD,KAAA1K,KAAA,CAAY,CACF,WADE,CACW,cADX;AAC2B,mBAD3B,CACgD,OADhD,CACyD,gBADzD,CAC2E,QAD3E,CAEF,aAFE,CAEa,YAFb,CAE2B,WAF3B,CAEwC,MAFxC,CAEgD,UAFhD,CAE4D,eAF5D,CAGV,QAAQ,CAAC4B,CAAD,CAAcgJ,CAAd,CAA8BX,CAA9B,CAAmDY,CAAnD,CAA4DC,CAA5D,CAA8EC,CAA9E,CACCC,CADD,CACgBpI,CADhB,CAC8B+E,CAD9B,CAC2CsD,CAD3C,CACmDC,CADnD,CAC+DC,CAD/D,CAC8E,CAqLtF/a,QAASA,EAAO,CAACgb,CAAD,CAAgBC,CAAhB,CAA8BC,CAA9B,CAA2CC,CAA3C,CACIC,CADJ,CAC4B,CACpCJ,CAAN,WAA+B5d,EAA/B,GAGE4d,CAHF,CAGkB5d,CAAA,CAAO4d,CAAP,CAHlB,CAOAxkB,EAAA,CAAQwkB,CAAR,CAAuB,QAAQ,CAACphB,CAAD,CAAOnC,CAAP,CAAa,CACrB,CAArB,EAAImC,CAAAvD,SAAJ,EAA0CuD,CAAAyhB,UAAAzd,MAAA,CAAqB,KAArB,CAA1C,GACEod,CAAA,CAAcvjB,CAAd,CADF,CACgC2F,CAAA,CAAOxD,CAAP,CAAAkQ,KAAA,CAAkB,eAAlB,CAAAnR,OAAA,EAAA,CAA4C,CAA5C,CADhC,CAD0C,CAA5C,CAKA,KAAI2iB,EACIC,CAAA,CAAaP,CAAb,CAA4BC,CAA5B,CAA0CD,CAA1C,CACaE,CADb,CAC0BC,CAD1B,CAC2CC,CAD3C,CAERI,GAAA,CAAaR,CAAb,CAA4B,UAA5B,CACA,OAAOS,SAAqB,CAAC1b,CAAD,CAAQ2b,CAAR,CAAwBC,CAAxB,CAA8C,CACxE3a,EAAA,CAAUjB,CAAV,CAAiB,OAAjB,CAGA,KAAI6b,EAAYF,CACA,CAAZG,EAAAxe,MAAAvG,KAAA,CAA2BkkB,CAA3B,CAAY,CACZA,CAEJxkB,EAAA,CAAQmlB,CAAR,CAA+B,QAAQ,CAACtK,CAAD,CAAWnS,CAAX,CAAiB,CACtD0c,CAAAzb,KAAA,CAAe,GAAf,CAAqBjB,CAArB,CAA4B,YAA5B,CAA0CmS,CAA1C,CADsD,CAAxD,CAKQja,EAAAA,CAAI,CAAZ,KAAI,IAAW0V,EAAK8O,CAAAxlB,OAApB,CAAsCgB,CAAtC,CAAwC0V,CAAxC,CAA4C1V,CAAA,EAA5C,CAAiD,CAC/C,IACIf;AADOulB,CAAAhiB,CAAUxC,CAAVwC,CACIvD,SACE,EAAjB,GAAIA,CAAJ,EAAiD,CAAjD,GAAoCA,CAApC,EACEulB,CAAAE,GAAA,CAAa1kB,CAAb,CAAA+I,KAAA,CAAqB,QAArB,CAA+BJ,CAA/B,CAJ6C,CAQ7C2b,CAAJ,EAAoBA,CAAA,CAAeE,CAAf,CAA0B7b,CAA1B,CAChBub,EAAJ,EAAqBA,CAAA,CAAgBvb,CAAhB,CAAuB6b,CAAvB,CAAkCA,CAAlC,CACrB,OAAOA,EAvBiE,CAjBhC,CA4C5CJ,QAASA,GAAY,CAACO,CAAD,CAAWzc,CAAX,CAAsB,CACzC,GAAI,CACFyc,CAAAC,SAAA,CAAkB1c,CAAlB,CADE,CAEF,MAAM/B,CAAN,CAAS,EAH8B,CAwB3Cge,QAASA,EAAY,CAACU,CAAD,CAAWhB,CAAX,CAAyBiB,CAAzB,CAAuChB,CAAvC,CAAoDC,CAApD,CACGC,CADH,CAC2B,CAoC9CE,QAASA,EAAe,CAACvb,CAAD,CAAQkc,CAAR,CAAkBC,CAAlB,CAAgCC,CAAhC,CAAmD,CAAA,IACzDC,CADyD,CAC5CxiB,CAD4C,CACtCyiB,CADsC,CAC/BC,CAD+B,CACAllB,CADA,CACG0V,CADH,CACOkL,CAG5EuE,EAAAA,CAAiBN,CAAA7lB,OAArB,KACIomB,EAAqBC,KAAJ,CAAUF,CAAV,CACrB,KAAKnlB,CAAL,CAAS,CAAT,CAAYA,CAAZ,CAAgBmlB,CAAhB,CAAgCnlB,CAAA,EAAhC,CACEolB,CAAA,CAAeplB,CAAf,CAAA,CAAoB6kB,CAAA,CAAS7kB,CAAT,CAGX4gB,EAAP,CAAA5gB,CAAA,CAAI,CAAR,KAAkB0V,CAAlB,CAAuB4P,CAAAtmB,OAAvB,CAAuCgB,CAAvC,CAA2C0V,CAA3C,CAA+CkL,CAAA,EAA/C,CACEpe,CAKA,CALO4iB,CAAA,CAAexE,CAAf,CAKP,CAJA2E,CAIA,CAJaD,CAAA,CAAQtlB,CAAA,EAAR,CAIb,CAHAglB,CAGA,CAHcM,CAAA,CAAQtlB,CAAA,EAAR,CAGd,CAFAilB,CAEA,CAFQjf,CAAA,CAAOxD,CAAP,CAER,CAAI+iB,CAAJ,EACMA,CAAA5c,MAAJ,EACEuc,CACA,CADavc,CAAA6c,KAAA,EACb,CAAAP,CAAAlc,KAAA,CAAW,QAAX,CAAqBmc,CAArB,CAFF,EAIEA,CAJF,CAIevc,CAGf,CAAA,CADA8c,CACA,CADoBF,CAAAG,WACpB,GAA2BX,CAAAA,CAA3B,EAAgDlB,CAAhD,CACE0B,CAAA,CAAWP,CAAX,CAAwBE,CAAxB,CAAoC1iB,CAApC,CAA0CsiB,CAA1C,CACEa,CAAA,CAAwBhd,CAAxB,CAA+B8c,CAA/B,EAAoD5B,CAApD,CADF,CADF,CAKE0B,CAAA,CAAWP,CAAX,CAAwBE,CAAxB,CAAoC1iB,CAApC,CAA0CsiB,CAA1C,CAAwDC,CAAxD,CAbJ,EAeWC,CAfX,EAgBEA,CAAA,CAAYrc,CAAZ,CAAmBnG,CAAA4Q,WAAnB,CAAoCzU,CAApC,CAA+ComB,CAA/C,CAhCqE,CAhC3E,IAJ8C,IAC1CO,EAAU,EADgC,CAE1CM,CAF0C,CAEnClD,CAFmC,CAEXtP,CAFW,CAEcyS,CAFd,CAIrC7lB,EAAI,CAAb,CAAgBA,CAAhB,CAAoB6kB,CAAA7lB,OAApB,CAAqCgB,CAAA,EAArC,CACE4lB,CAyBA,CAzBQ,IAAIE,EAyBZ,CAtBApD,CAsBA,CAtBaqD,EAAA,CAAkBlB,CAAA,CAAS7kB,CAAT,CAAlB,CAA+B,EAA/B,CAAmC4lB,CAAnC;AAAgD,CAAN,GAAA5lB,CAAA,CAAU8jB,CAAV,CAAwBnlB,CAAlE,CACmBolB,CADnB,CAsBb,EAnBAwB,CAmBA,CAnBc7C,CAAA1jB,OACD,CAAPgnB,EAAA,CAAsBtD,CAAtB,CAAkCmC,CAAA,CAAS7kB,CAAT,CAAlC,CAA+C4lB,CAA/C,CAAsD/B,CAAtD,CAAoEiB,CAApE,CACwB,IADxB,CAC8B,EAD9B,CACkC,EADlC,CACsCd,CADtC,CAAO,CAEP,IAgBN,GAdkBuB,CAAA5c,MAclB,EAbEyb,EAAA,CAAape,CAAA,CAAO6e,CAAA,CAAS7kB,CAAT,CAAP,CAAb,CAAkC,UAAlC,CAaF,CAVAglB,CAUA,CAVeO,CAGD,EAHeA,CAAAU,SAGf,EAFA,EAAE7S,CAAF,CAAeyR,CAAA,CAAS7kB,CAAT,CAAAoT,WAAf,CAEA,EADA,CAACA,CAAApU,OACD,CAAR,IAAQ,CACRmlB,CAAA,CAAa/Q,CAAb,CACGmS,CAAA,CAAaA,CAAAG,WAAb,CAAqC7B,CADxC,CAMN,CAHAyB,CAAAzlB,KAAA,CAAa0lB,CAAb,CAAyBP,CAAzB,CAGA,CAFAa,CAEA,CAFcA,CAEd,EAF6BN,CAE7B,EAF2CP,CAE3C,CAAAhB,CAAA,CAAyB,IAI3B,OAAO6B,EAAA,CAAc3B,CAAd,CAAgC,IAlCO,CA0EhDyB,QAASA,EAAuB,CAAChd,CAAD,CAAQkb,CAAR,CAAsB,CACpD,MAAOkB,SAA0B,CAACmB,CAAD,CAAmBC,CAAnB,CAA4BC,CAA5B,CAAyC,CACxE,IAAIC,EAAe,CAAA,CAEdH,EAAL,GACEA,CAEA,CAFmBvd,CAAA6c,KAAA,EAEnB,CAAAa,CAAA,CADAH,CAAAI,cACA,CADiC,CAAA,CAFnC,CAMIrgB,EAAAA,CAAQ4d,CAAA,CAAaqC,CAAb,CAA+BC,CAA/B,CAAwCC,CAAxC,CACZ,IAAIC,CAAJ,CACEpgB,CAAA2Y,GAAA,CAAS,UAAT,CAAqBla,EAAA,CAAKwhB,CAAL,CAAuBA,CAAA1R,SAAvB,CAArB,CAEF,OAAOvO,EAbiE,CADtB,CA4BtD8f,QAASA,GAAiB,CAACvjB,CAAD,CAAOkgB,CAAP,CAAmBkD,CAAnB,CAA0B9B,CAA1B,CAAuCC,CAAvC,CAAwD,CAAA,IAE5EwC,EAAWX,CAAAY,MAFiE,CAG5EhgB,CAGJ,QALehE,CAAAvD,SAKf,EACE,KAAK,CAAL,CAEEwnB,CAAA,CAAa/D,CAAb,CACIgE,EAAA,CAAmBC,EAAA,CAAUnkB,CAAV,CAAAmH,YAAA,EAAnB,CADJ,CACuD,GADvD,CAC4Dma,CAD5D,CACyEC,CADzE,CAFF,KAMWphB,CANX,CAMiBmF,CANjB,CAMuB8e,CAA0BC,EAAAA,CAASrkB,CAAA2F,WAAxD,KANF,IAOW+K,EAAI,CAPf,CAOkBC;AAAK0T,CAAL1T,EAAe0T,CAAA7nB,OAD/B,CAC8CkU,CAD9C,CACkDC,CADlD,CACsDD,CAAA,EADtD,CAC2D,CACzD,IAAI4T,EAAgB,CAAA,CAApB,CACIC,EAAc,CAAA,CAElBpkB,EAAA,CAAOkkB,CAAA,CAAO3T,CAAP,CACP,IAAI,CAAC+D,CAAL,EAAqB,CAArB,EAAaA,CAAb,EAA0BtU,CAAAqkB,UAA1B,CAA0C,CACxClf,CAAA,CAAOnF,CAAAmF,KAEPmf,EAAA,CAAaP,EAAA,CAAmB5e,CAAnB,CACTof,EAAAje,KAAA,CAAqBge,CAArB,CAAJ,GACEnf,CADF,CACSwB,EAAA,CAAW2d,CAAAE,OAAA,CAAkB,CAAlB,CAAX,CAAiC,GAAjC,CADT,CAIA,KAAIC,EAAiBH,CAAAxgB,QAAA,CAAmB,cAAnB,CAAmC,EAAnC,CACjBwgB,EAAJ,GAAmBG,CAAnB,CAAoC,OAApC,GACEN,CAEA,CAFgBhf,CAEhB,CADAif,CACA,CADcjf,CAAAqf,OAAA,CAAY,CAAZ,CAAerf,CAAA9I,OAAf,CAA6B,CAA7B,CACd,CADgD,KAChD,CAAA8I,CAAA,CAAOA,CAAAqf,OAAA,CAAY,CAAZ,CAAerf,CAAA9I,OAAf,CAA6B,CAA7B,CAHT,CAMA4nB,EAAA,CAAQF,EAAA,CAAmB5e,CAAA6B,YAAA,EAAnB,CACR4c,EAAA,CAASK,CAAT,CAAA,CAAkB9e,CAClB8d,EAAA,CAAMgB,CAAN,CAAA,CAAezmB,CAAf,CAAuB4R,EAAA,CAAKpP,CAAAxC,MAAL,CACnB2V,GAAA,CAAmBtT,CAAnB,CAAyBokB,CAAzB,CAAJ,GACEhB,CAAA,CAAMgB,CAAN,CADF,CACiB,CAAA,CADjB,CAGAS,EAAA,CAA4B7kB,CAA5B,CAAkCkgB,CAAlC,CAA8CviB,CAA9C,CAAqDymB,CAArD,CACAH,EAAA,CAAa/D,CAAb,CAAyBkE,CAAzB,CAAgC,GAAhC,CAAqC9C,CAArC,CAAkDC,CAAlD,CAAmE+C,CAAnE,CACcC,CADd,CAtBwC,CALe,CAiC3D7e,CAAA,CAAY1F,CAAA0F,UACZ,IAAIhJ,CAAA,CAASgJ,CAAT,CAAJ,EAAyC,EAAzC,GAA2BA,CAA3B,CACE,IAAA,CAAO1B,CAAP,CAAe4b,CAAAna,KAAA,CAA4BC,CAA5B,CAAf,CAAA,CACE0e,CAIA,CAJQF,EAAA,CAAmBlgB,CAAA,CAAM,CAAN,CAAnB,CAIR,CAHIigB,CAAA,CAAa/D,CAAb,CAAyBkE,CAAzB,CAAgC,GAAhC,CAAqC9C,CAArC,CAAkDC,CAAlD,CAGJ,GAFE6B,CAAA,CAAMgB,CAAN,CAEF,CAFiB7U,EAAA,CAAKvL,CAAA,CAAM,CAAN,CAAL,CAEjB,EAAA0B,CAAA,CAAYA,CAAAif,OAAA,CAAiB3gB,CAAAnG,MAAjB,CAA+BmG,CAAA,CAAM,CAAN,CAAAxH,OAA/B,CAGhB,MACF,MAAK,CAAL,CACEsoB,CAAA,CAA4B5E,CAA5B,CAAwClgB,CAAAyhB,UAAxC,CACA,MACF,MAAK,CAAL,CACE,GAAI,CAEF,GADAzd,CACA;AADQ2b,CAAAla,KAAA,CAA8BzF,CAAAyhB,UAA9B,CACR,CACE2C,CACA,CADQF,EAAA,CAAmBlgB,CAAA,CAAM,CAAN,CAAnB,CACR,CAAIigB,CAAA,CAAa/D,CAAb,CAAyBkE,CAAzB,CAAgC,GAAhC,CAAqC9C,CAArC,CAAkDC,CAAlD,CAAJ,GACE6B,CAAA,CAAMgB,CAAN,CADF,CACiB7U,EAAA,CAAKvL,CAAA,CAAM,CAAN,CAAL,CADjB,CAJA,CAQF,MAAOL,CAAP,CAAU,EAhEhB,CAwEAuc,CAAA5iB,KAAA,CAAgBynB,CAAhB,CACA,OAAO7E,EA/EyE,CA0FlF8E,QAASA,EAAS,CAAChlB,CAAD,CAAOilB,CAAP,CAAkBC,CAAlB,CAA2B,CAC3C,IAAIjd,EAAQ,EAAZ,CACIkd,EAAQ,CACZ,IAAIF,CAAJ,EAAiBjlB,CAAAolB,aAAjB,EAAsCplB,CAAAolB,aAAA,CAAkBH,CAAlB,CAAtC,EAEE,EAAG,CACD,GAAI,CAACjlB,CAAL,CACE,KAAMqlB,GAAA,CAAe,SAAf,CAEIJ,CAFJ,CAEeC,CAFf,CAAN,CAImB,CAArB,EAAIllB,CAAAvD,SAAJ,GACMuD,CAAAolB,aAAA,CAAkBH,CAAlB,CACJ,EADkCE,CAAA,EAClC,CAAInlB,CAAAolB,aAAA,CAAkBF,CAAlB,CAAJ,EAAgCC,CAAA,EAFlC,CAIAld,EAAA5K,KAAA,CAAW2C,CAAX,CACAA,EAAA,CAAOA,CAAAoI,YAXN,CAAH,MAYiB,CAZjB,CAYS+c,CAZT,CAFF,KAgBEld,EAAA5K,KAAA,CAAW2C,CAAX,CAGF,OAAOwD,EAAA,CAAOyE,CAAP,CAtBoC,CAiC7Cqd,QAASA,EAA0B,CAACC,CAAD,CAASN,CAAT,CAAoBC,CAApB,CAA6B,CAC9D,MAAO,SAAQ,CAAC/e,CAAD,CAAQ5C,CAAR,CAAiB6f,CAAjB,CAAwBQ,CAAxB,CAAqCvC,CAArC,CAAmD,CAChE9d,CAAA,CAAUyhB,CAAA,CAAUzhB,CAAA,CAAQ,CAAR,CAAV,CAAsB0hB,CAAtB,CAAiCC,CAAjC,CACV,OAAOK,EAAA,CAAOpf,CAAP,CAAc5C,CAAd,CAAuB6f,CAAvB,CAA8BQ,CAA9B,CAA2CvC,CAA3C,CAFyD,CADJ,CA8BhEmC,QAASA,GAAqB,CAACtD,CAAD,CAAasF,CAAb,CAA0BC,CAA1B,CAAyCpE,CAAzC,CACCqE,CADD,CACeC,CADf,CACyCC,CADzC,CACqDC,CADrD,CAECrE,CAFD,CAEyB,CAiMrDsE,QAASA,EAAU,CAACC,CAAD,CAAMC,CAAN,CAAYf,CAAZ,CAAuBC,CAAvB,CAAgC,CACjD,GAAIa,CAAJ,CAAS,CACHd,CAAJ,GAAec,CAAf,CAAqBT,CAAA,CAA2BS,CAA3B,CAAgCd,CAAhC,CAA2CC,CAA3C,CAArB,CACAa,EAAA3F,QAAA,CAAcvW,CAAAuW,QACd,IAAI6F,CAAJ;AAAiCpc,CAAjC,EAA8CA,CAAAqc,eAA9C,CACEH,CAAA,CAAMI,EAAA,CAAmBJ,CAAnB,CAAwB,cAAe,CAAA,CAAf,CAAxB,CAERH,EAAAvoB,KAAA,CAAgB0oB,CAAhB,CANO,CAQT,GAAIC,CAAJ,CAAU,CACJf,CAAJ,GAAee,CAAf,CAAsBV,CAAA,CAA2BU,CAA3B,CAAiCf,CAAjC,CAA4CC,CAA5C,CAAtB,CACAc,EAAA5F,QAAA,CAAevW,CAAAuW,QACf,IAAI6F,CAAJ,GAAiCpc,CAAjC,EAA8CA,CAAAqc,eAA9C,CACEF,CAAA,CAAOG,EAAA,CAAmBH,CAAnB,CAAyB,cAAe,CAAA,CAAf,CAAzB,CAETH,EAAAxoB,KAAA,CAAiB2oB,CAAjB,CANQ,CATuC,CAoBnDI,QAASA,EAAc,CAAChG,CAAD,CAAU+B,CAAV,CAAoBkE,CAApB,CAAwC,CAAA,IACzD1oB,CADyD,CAClD2oB,EAAkB,MADgC,CACxBC,EAAW,CAAA,CAChD,IAAI7pB,CAAA,CAAS0jB,CAAT,CAAJ,CAAuB,CACrB,IAAA,CAAqC,GAArC,GAAOziB,CAAP,CAAeyiB,CAAA7e,OAAA,CAAe,CAAf,CAAf,GAAqD,GAArD,EAA4C5D,CAA5C,CAAA,CACEyiB,CAIA,CAJUA,CAAAuE,OAAA,CAAe,CAAf,CAIV,CAHa,GAGb,EAHIhnB,CAGJ,GAFE2oB,CAEF,CAFoB,eAEpB,EAAAC,CAAA,CAAWA,CAAX,EAAgC,GAAhC,EAAuB5oB,CAEzBA,EAAA,CAAQ,IAEJ0oB,EAAJ,EAA8C,MAA9C,GAA0BC,CAA1B,GACE3oB,CADF,CACU0oB,CAAA,CAAmBjG,CAAnB,CADV,CAGAziB,EAAA,CAAQA,CAAR,EAAiBwkB,CAAA,CAASmE,CAAT,CAAA,CAA0B,GAA1B,CAAgClG,CAAhC,CAA0C,YAA1C,CAEjB,IAAI,CAACziB,CAAL,EAAc,CAAC4oB,CAAf,CACE,KAAMlB,GAAA,CAAe,OAAf,CAEFjF,CAFE,CAEOoG,CAFP,CAAN,CAhBmB,CAAvB,IAqBW7pB,EAAA,CAAQyjB,CAAR,CAAJ,GACLziB,CACA,CADQ,EACR,CAAAf,CAAA,CAAQwjB,CAAR,CAAiB,QAAQ,CAACA,CAAD,CAAU,CACjCziB,CAAAN,KAAA,CAAW+oB,CAAA,CAAehG,CAAf,CAAwB+B,CAAxB,CAAkCkE,CAAlC,CAAX,CADiC,CAAnC,CAFK,CAMP,OAAO1oB,EA7BsD,CAiC/DolB,QAASA,EAAU,CAACP,CAAD,CAAcrc,CAAd,CAAqBsgB,CAArB,CAA+BnE,CAA/B,CAA6CC,CAA7C,CAAgE,CAmKjFmE,QAASA,EAA0B,CAACvgB,CAAD,CAAQwgB,CAAR,CAAuB,CACxD,IAAI5E,CAGmB,EAAvB,CAAIrjB,SAAAlC,OAAJ;CACEmqB,CACA,CADgBxgB,CAChB,CAAAA,CAAA,CAAQhK,CAFV,CAKIyqB,EAAJ,GACE7E,CADF,CAC0BsE,EAD1B,CAIA,OAAO9D,EAAA,CAAkBpc,CAAlB,CAAyBwgB,CAAzB,CAAwC5E,CAAxC,CAbiD,CAnKuB,IAC7EqB,CAD6E,CACtEjB,CADsE,CACzDjP,CADyD,CACrDqS,CADqD,CAC7ClF,CAD6C,CACjCwG,CADiC,CACnBR,GAAqB,EADF,CACMhF,EAGrF+B,EAAA,CADEoC,CAAJ,GAAoBiB,CAApB,CACUhB,CADV,CAGUpkB,EAAA,CAAYokB,CAAZ,CAA2B,IAAInC,EAAJ,CAAe9f,CAAA,CAAOijB,CAAP,CAAf,CAAiChB,CAAAzB,MAAjC,CAA3B,CAEV7B,EAAA,CAAWiB,CAAA0D,UAEX,IAAIb,CAAJ,CAA8B,CAC5B,IAAIc,EAAe,8BACf/E,EAAAA,CAAYxe,CAAA,CAAOijB,CAAP,CAEhBI,EAAA,CAAe1gB,CAAA6c,KAAA,CAAW,CAAA,CAAX,CAEXgE,GAAJ,EAA0BA,EAA1B,GAAgDf,CAAAgB,oBAAhD,CACEjF,CAAAzb,KAAA,CAAe,eAAf,CAAgCsgB,CAAhC,CADF,CAGE7E,CAAAzb,KAAA,CAAe,yBAAf,CAA0CsgB,CAA1C,CAKFjF,GAAA,CAAaI,CAAb,CAAwB,kBAAxB,CAEAplB,EAAA,CAAQqpB,CAAA9f,MAAR,CAAwC,QAAQ,CAAC+gB,CAAD,CAAaC,CAAb,CAAwB,CAAA,IAClEnjB,EAAQkjB,CAAAljB,MAAA,CAAiB+iB,CAAjB,CAAR/iB,EAA0C,EADwB,CAElEojB,EAAWpjB,CAAA,CAAM,CAAN,CAAXojB,EAAuBD,CAF2C,CAGlEZ,EAAwB,GAAxBA,EAAYviB,CAAA,CAAM,CAAN,CAHsD,CAIlEqjB,EAAOrjB,CAAA,CAAM,CAAN,CAJ2D,CAKlEsjB,CALkE,CAMlEC,CANkE,CAMvDC,CANuD,CAM5CC,CAE1BZ,EAAAa,kBAAA,CAA+BP,CAA/B,CAAA,CAA4CE,CAA5C,CAAmDD,CAEnD,QAAQC,CAAR,EAEE,KAAK,GAAL,CACEjE,CAAAuE,SAAA,CAAeP,CAAf,CAAyB,QAAQ,CAACzpB,CAAD,CAAQ,CACvCkpB,CAAA,CAAaM,CAAb,CAAA,CAA0BxpB,CADa,CAAzC,CAGAylB,EAAAwE,YAAA,CAAkBR,CAAlB,CAAAS,QAAA,CAAsC1hB,CAClCid,EAAA,CAAMgE,CAAN,CAAJ,GAGEP,CAAA,CAAaM,CAAb,CAHF,CAG4BvG,CAAA,CAAawC,CAAA,CAAMgE,CAAN,CAAb,CAAA,CAA8BjhB,CAA9B,CAH5B,CAKA;KAEF,MAAK,GAAL,CACE,GAAIogB,CAAJ,EAAgB,CAACnD,CAAA,CAAMgE,CAAN,CAAjB,CACE,KAEFG,EAAA,CAAYxG,CAAA,CAAOqC,CAAA,CAAMgE,CAAN,CAAP,CAEVK,EAAA,CADEF,CAAAO,QAAJ,CACYtmB,EADZ,CAGYimB,QAAQ,CAACM,CAAD,CAAGC,CAAH,CAAM,CAAE,MAAOD,EAAP,GAAaC,CAAf,CAE1BR,EAAA,CAAYD,CAAAU,OAAZ,EAAgC,QAAQ,EAAG,CAEzCX,CAAA,CAAYT,CAAA,CAAaM,CAAb,CAAZ,CAAsCI,CAAA,CAAUphB,CAAV,CACtC,MAAMkf,GAAA,CAAe,WAAf,CAEFjC,CAAA,CAAMgE,CAAN,CAFE,CAEenB,CAAA3gB,KAFf,CAAN,CAHyC,CAO3CgiB,EAAA,CAAYT,CAAA,CAAaM,CAAb,CAAZ,CAAsCI,CAAA,CAAUphB,CAAV,CACtC0gB,EAAA7lB,OAAA,CAAoBknB,QAAyB,EAAG,CAC9C,IAAIC,EAAcZ,CAAA,CAAUphB,CAAV,CACbshB,EAAA,CAAQU,CAAR,CAAqBtB,CAAA,CAAaM,CAAb,CAArB,CAAL,GAEOM,CAAA,CAAQU,CAAR,CAAqBb,CAArB,CAAL,CAKEE,CAAA,CAAUrhB,CAAV,CAAiBgiB,CAAjB,CAA+BtB,CAAA,CAAaM,CAAb,CAA/B,CALF,CAEEN,CAAA,CAAaM,CAAb,CAFF,CAE4BgB,CAJ9B,CAUA,OAAOb,EAAP,CAAmBa,CAZ2B,CAAhD,CAaG,IAbH,CAaSZ,CAAAO,QAbT,CAcA,MAEF,MAAK,GAAL,CACEP,CAAA,CAAYxG,CAAA,CAAOqC,CAAA,CAAMgE,CAAN,CAAP,CACZP,EAAA,CAAaM,CAAb,CAAA,CAA0B,QAAQ,CAAChQ,CAAD,CAAS,CACzC,MAAOoQ,EAAA,CAAUphB,CAAV,CAAiBgR,CAAjB,CADkC,CAG3C,MAEF,SACE,KAAMkO,GAAA,CAAe,MAAf,CAGFY,CAAA3gB,KAHE,CAG6B6hB,CAH7B,CAGwCD,CAHxC,CAAN,CAxDJ,CAVsE,CAAxE,CAhB4B,CAyF9B7F,EAAA,CAAekB,CAAf,EAAoCmE,CAChC0B,EAAJ,EACExrB,CAAA,CAAQwrB,CAAR,CAA8B,QAAQ,CAACve,CAAD,CAAY,CAAA,IAC5CsN,EAAS,QACHtN,CAAA,GAAcoc,CAAd,EAA0Cpc,CAAAqc,eAA1C,CAAqEW,CAArE,CAAoF1gB,CADjF,UAEDgc,CAFC,QAGHiB,CAHG,aAIE/B,EAJF,CADmC,CAM7CgH,CAEHhI,EAAA,CAAaxW,CAAAwW,WACK,IAAlB,EAAIA,CAAJ,GACEA,CADF;AACe+C,CAAA,CAAMvZ,CAAAvE,KAAN,CADf,CAIA+iB,EAAA,CAAqBrH,CAAA,CAAYX,CAAZ,CAAwBlJ,CAAxB,CAMrBkP,GAAA,CAAmBxc,CAAAvE,KAAnB,CAAA,CAAqC+iB,CAChCzB,EAAL,EACEzE,CAAA5b,KAAA,CAAc,GAAd,CAAoBsD,CAAAvE,KAApB,CAAqC,YAArC,CAAmD+iB,CAAnD,CAGExe,EAAAye,aAAJ,GACEnR,CAAAoR,OAAA,CAAc1e,CAAAye,aAAd,CADF,CAC0CD,CAD1C,CAxBgD,CAAlD,CA+BE7qB,EAAA,CAAI,CAAR,KAAW0V,CAAX,CAAgB0S,CAAAppB,OAAhB,CAAmCgB,CAAnC,CAAuC0V,CAAvC,CAA2C1V,CAAA,EAA3C,CACE,GAAI,CACF+nB,CACA,CADSK,CAAA,CAAWpoB,CAAX,CACT,CAAA+nB,CAAA,CAAOA,CAAAsB,aAAA,CAAsBA,CAAtB,CAAqC1gB,CAA5C,CAAmDgc,CAAnD,CAA6DiB,CAA7D,CACImC,CAAAnF,QADJ,EACsBgG,CAAA,CAAeb,CAAAnF,QAAf,CAA+B+B,CAA/B,CAAyCkE,EAAzC,CADtB,CACoFhF,EADpF,CAFE,CAIF,MAAO1d,CAAP,CAAU,CACVsc,CAAA,CAAkBtc,CAAlB,CAAqBL,EAAA,CAAY6e,CAAZ,CAArB,CADU,CAQVqG,CAAAA,CAAeriB,CACf8f,EAAJ,GAAiCA,CAAAwC,SAAjC,EAA+G,IAA/G,GAAsExC,CAAAyC,YAAtE,IACEF,CADF,CACiB3B,CADjB,CAGArE,EAAA,EAAeA,CAAA,CAAYgG,CAAZ,CAA0B/B,CAAA7V,WAA1B,CAA+CzU,CAA/C,CAA0DomB,CAA1D,CAGf,KAAI/kB,CAAJ,CAAQqoB,CAAArpB,OAAR,CAA6B,CAA7B,CAAqC,CAArC,EAAgCgB,CAAhC,CAAwCA,CAAA,EAAxC,CACE,GAAI,CACF+nB,CACA,CADSM,CAAA,CAAYroB,CAAZ,CACT,CAAA+nB,CAAA,CAAOA,CAAAsB,aAAA,CAAsBA,CAAtB,CAAqC1gB,CAA5C,CAAmDgc,CAAnD,CAA6DiB,CAA7D,CACImC,CAAAnF,QADJ,EACsBgG,CAAA,CAAeb,CAAAnF,QAAf,CAA+B+B,CAA/B,CAAyCkE,EAAzC,CADtB,CACoFhF,EADpF,CAFE,CAIF,MAAO1d,CAAP,CAAU,CACVsc,CAAA,CAAkBtc,CAAlB,CAAqBL,EAAA,CAAY6e,CAAZ,CAArB,CADU,CA7JmE,CArPnFX,CAAA,CAAyBA,CAAzB,EAAmD,EAoBnD,KArBqD,IAGjDmH,EAAmB,CAAC9J,MAAAC,UAH6B,CAIjD8J,CAJiD,CAKjDR,EAAuB5G,CAAA4G,qBAL0B,CAMjDnC,EAA2BzE,CAAAyE,yBANsB;AAOjDe,GAAoBxF,CAAAwF,kBAP6B,CAQjD6B,EAA4BrH,CAAAqH,0BARqB,CASjDC,EAAyB,CAAA,CATwB,CAUjDlC,EAAgCpF,CAAAoF,8BAViB,CAWjDmC,EAAetD,CAAAqB,UAAfiC,CAAyCvlB,CAAA,CAAOgiB,CAAP,CAXQ,CAYjD3b,CAZiD,CAajD2c,CAbiD,CAcjDwC,CAdiD,CAgBjD/F,GAAoB5B,CAhB6B,CAiBjDkE,CAjBiD,CAqB7C/nB,EAAI,CArByC,CAqBtC0V,EAAKgN,CAAA1jB,OAApB,CAAuCgB,CAAvC,CAA2C0V,CAA3C,CAA+C1V,CAAA,EAA/C,CAAoD,CAClDqM,CAAA,CAAYqW,CAAA,CAAW1iB,CAAX,CACZ,KAAIynB,GAAYpb,CAAAof,QAAhB,CACI/D,EAAUrb,CAAAqf,MAGVjE,GAAJ,GACE8D,CADF,CACiB/D,CAAA,CAAUQ,CAAV,CAAuBP,EAAvB,CAAkCC,CAAlC,CADjB,CAGA8D,EAAA,CAAY7sB,CAEZ,IAAIwsB,CAAJ,CAAuB9e,CAAAsW,SAAvB,CACE,KAGF,IAAIgJ,CAAJ,CAAqBtf,CAAA1D,MAArB,CACEyiB,CAIA,CAJoBA,CAIpB,EAJyC/e,CAIzC,CAAKA,CAAA6e,YAAL,GACEU,CAAA,CAAkB,oBAAlB,CAAwCnD,CAAxC,CAAkEpc,CAAlE,CACkBkf,CADlB,CAEA,CAAIxpB,CAAA,CAAS4pB,CAAT,CAAJ,GACElD,CADF,CAC6Bpc,CAD7B,CAHF,CASF2c,EAAA,CAAgB3c,CAAAvE,KAEXojB,EAAA7e,CAAA6e,YAAL,EAA8B7e,CAAAwW,WAA9B,GACE8I,CAIA,CAJiBtf,CAAAwW,WAIjB,CAHA+H,CAGA,CAHuBA,CAGvB,EAH+C,EAG/C,CAFAgB,CAAA,CAAkB,GAAlB,CAAwB5C,CAAxB,CAAwC,cAAxC,CACI4B,CAAA,CAAqB5B,CAArB,CADJ,CACyC3c,CADzC,CACoDkf,CADpD,CAEA,CAAAX,CAAA,CAAqB5B,CAArB,CAAA,CAAsC3c,CALxC,CAQA,IAAIsf,CAAJ,CAAqBtf,CAAAqZ,WAArB,CACE4F,CAUA,CAVyB,CAAA,CAUzB,CALKjf,CAAAwf,MAKL,GAJED,CAAA,CAAkB,cAAlB,CAAkCP,CAAlC,CAA6Dhf,CAA7D,CAAwEkf,CAAxE,CACA,CAAAF,CAAA,CAA4Bhf,CAG9B,EAAsB,SAAtB,EAAIsf,CAAJ,EACEvC,CASA,CATgC,CAAA,CAShC,CARA+B,CAQA,CARmB9e,CAAAsW,SAQnB;AAPA6I,CAOA,CAPYhE,CAAA,CAAUQ,CAAV,CAAuBP,EAAvB,CAAkCC,CAAlC,CAOZ,CANA6D,CAMA,CANetD,CAAAqB,UAMf,CALItjB,CAAA,CAAOtH,CAAAotB,cAAA,CAAuB,GAAvB,CAA6B9C,CAA7B,CAA6C,IAA7C,CACuBf,CAAA,CAAce,CAAd,CADvB,CACsD,GADtD,CAAP,CAKJ,CAHAhB,CAGA,CAHcuD,CAAA,CAAa,CAAb,CAGd,CAFAQ,EAAA,CAAY7D,CAAZ,CAA0BliB,CAAA,CA1pK7BlB,EAAApF,KAAA,CA0pK8C8rB,CA1pK9C,CAA+B,CAA/B,CA0pK6B,CAA1B,CAAwDxD,CAAxD,CAEA,CAAAvC,EAAA,CAAoB7c,CAAA,CAAQ4iB,CAAR,CAAmB3H,CAAnB,CAAiCsH,CAAjC,CACQa,CADR,EAC4BA,CAAAlkB,KAD5B,CACmD,2BAQdujB,CARc,CADnD,CAVtB,GAsBEG,CAEA,CAFYxlB,CAAA,CAAOwN,EAAA,CAAYwU,CAAZ,CAAP,CAAAiE,SAAA,EAEZ,CADAV,CAAArlB,MAAA,EACA,CAAAuf,EAAA,CAAoB7c,CAAA,CAAQ4iB,CAAR,CAAmB3H,CAAnB,CAxBtB,CA4BF,IAAIxX,CAAA4e,SAAJ,CAUE,GATAW,CAAA,CAAkB,UAAlB,CAA8BpC,EAA9B,CAAiDnd,CAAjD,CAA4Dkf,CAA5D,CASI9kB,CARJ+iB,EAQI/iB,CARgB4F,CAQhB5F,CANJklB,CAMIllB,CANcjH,CAAA,CAAW6M,CAAA4e,SAAX,CACD,CAAX5e,CAAA4e,SAAA,CAAmBM,CAAnB,CAAiCtD,CAAjC,CAAW,CACX5b,CAAA4e,SAIFxkB,CAFJklB,CAEIllB,CAFaylB,CAAA,CAAoBP,CAApB,CAEbllB,CAAA4F,CAAA5F,QAAJ,CAAuB,CACrBulB,CAAA,CAAmB3f,CAEjBmf,EAAA,CAz8HJnZ,EAAApJ,KAAA,CAw8HuB0iB,CAx8HvB,CAw8HE,CAGc3lB,CAAA,CAAO2lB,CAAP,CAHd,CACc,EAId3D,EAAA,CAAcwD,CAAA,CAAU,CAAV,CAEd,IAAwB,CAAxB,EAAIA,CAAAxsB,OAAJ,EAAsD,CAAtD,GAA6BgpB,CAAA/oB,SAA7B,CACE,KAAM4oB,GAAA,CAAe,OAAf,CAEFmB,CAFE,CAEa,EAFb,CAAN,CAKF+C,EAAA,CAAY7D,CAAZ,CAA0BqD,CAA1B,CAAwCvD,CAAxC,CAEImE,EAAAA,CAAmB,OAAQ,EAAR,CAOnBC,EAAAA,CAAqBrG,EAAA,CAAkBiC,CAAlB,CAA+B,EAA/B,CAAmCmE,CAAnC,CACzB,KAAIE,EAAwB3J,CAAAvf,OAAA,CAAkBnD,CAAlB,CAAsB,CAAtB,CAAyB0iB,CAAA1jB,OAAzB,EAA8CgB,CAA9C,CAAkD,CAAlD,EAExByoB,EAAJ,EACE6D,EAAA,CAAwBF,CAAxB,CAEF1J,EAAA,CAAaA,CAAAzd,OAAA,CAAkBmnB,CAAlB,CAAAnnB,OAAA,CAA6ConB,CAA7C,CACbE,EAAA,CAAwBtE,CAAxB,CAAuCkE,CAAvC,CAEAzW,EAAA,CAAKgN,CAAA1jB,OAjCgB,CAAvB,IAmCEusB,EAAAjlB,KAAA,CAAkBqlB,CAAlB,CAIJ;GAAItf,CAAA6e,YAAJ,CACEU,CAAA,CAAkB,UAAlB,CAA8BpC,EAA9B,CAAiDnd,CAAjD,CAA4Dkf,CAA5D,CAcA,CAbA/B,EAaA,CAboBnd,CAapB,CAXIA,CAAA5F,QAWJ,GAVEulB,CAUF,CAVqB3f,CAUrB,EAPAkZ,CAOA,CAPaiH,CAAA,CAAmB9J,CAAAvf,OAAA,CAAkBnD,CAAlB,CAAqB0iB,CAAA1jB,OAArB,CAAyCgB,CAAzC,CAAnB,CAAgEurB,CAAhE,CACTtD,CADS,CACMC,CADN,CACoBzC,EADpB,CACuC2C,CADvC,CACmDC,CADnD,CACgE,sBACjDuC,CADiD,0BAE7CnC,CAF6C,mBAGpDe,EAHoD,2BAI5C6B,CAJ4C,CADhE,CAOb,CAAA3V,CAAA,CAAKgN,CAAA1jB,OAfP,KAgBO,IAAIqN,CAAAzD,QAAJ,CACL,GAAI,CACFmf,CACA,CADS1b,CAAAzD,QAAA,CAAkB2iB,CAAlB,CAAgCtD,CAAhC,CAA+CxC,EAA/C,CACT,CAAIjmB,CAAA,CAAWuoB,CAAX,CAAJ,CACEO,CAAA,CAAW,IAAX,CAAiBP,CAAjB,CAAyBN,EAAzB,CAAoCC,CAApC,CADF,CAEWK,CAFX,EAGEO,CAAA,CAAWP,CAAAQ,IAAX,CAAuBR,CAAAS,KAAvB,CAAoCf,EAApC,CAA+CC,CAA/C,CALA,CAOF,MAAOvhB,EAAP,CAAU,CACVsc,CAAA,CAAkBtc,EAAlB,CAAqBL,EAAA,CAAYylB,CAAZ,CAArB,CADU,CAKVlf,CAAA4Z,SAAJ,GACEV,CAAAU,SACA,CADsB,CAAA,CACtB,CAAAkF,CAAA,CAAmBsB,IAAAC,IAAA,CAASvB,CAAT,CAA2B9e,CAAAsW,SAA3B,CAFrB,CA5JkD,CAmKpD4C,CAAA5c,MAAA,CAAmByiB,CAAnB,EAAoE,CAAA,CAApE,GAAwCA,CAAAziB,MACxC4c,EAAAG,WAAA,CAAwB4F,CAAxB,EAAkD7F,EAClDzB,EAAAoF,8BAAA,CAAuDA,CAGvD,OAAO7D,EA7L8C,CA2avD+G,QAASA,GAAuB,CAAC5J,CAAD,CAAa,CAE3C,IAF2C,IAElCxP,EAAI,CAF8B,CAE3BC,EAAKuP,CAAA1jB,OAArB,CAAwCkU,CAAxC,CAA4CC,CAA5C,CAAgDD,CAAA,EAAhD,CACEwP,CAAA,CAAWxP,CAAX,CAAA;AAAgB5R,EAAA,CAAQohB,CAAA,CAAWxP,CAAX,CAAR,CAAuB,gBAAiB,CAAA,CAAjB,CAAvB,CAHyB,CAqB7CuT,QAASA,EAAY,CAACkG,CAAD,CAAc7kB,CAAd,CAAoB1F,CAApB,CAA8B0hB,CAA9B,CAA2CC,CAA3C,CAA4D6I,CAA5D,CACCC,CADD,CACc,CACjC,GAAI/kB,CAAJ,GAAaic,CAAb,CAA8B,MAAO,KACjCvd,EAAAA,CAAQ,IACZ,IAAIyb,CAAAxiB,eAAA,CAA6BqI,CAA7B,CAAJ,CAAwC,CAAA,IAC9BuE,CAAWqW,EAAAA,CAAatI,CAAArB,IAAA,CAAcjR,CAAd,CAAqBoa,CAArB,CAAhC,KADsC,IAElCliB,EAAI,CAF8B,CAE3B0V,EAAKgN,CAAA1jB,OADhB,CACmCgB,CADnC,CACqC0V,CADrC,CACyC1V,CAAA,EADzC,CAEE,GAAI,CACFqM,CACA,CADYqW,CAAA,CAAW1iB,CAAX,CACZ,EAAM8jB,CAAN,GAAsBnlB,CAAtB,EAAmCmlB,CAAnC,CAAiDzX,CAAAsW,SAAjD,GAC8C,EAD9C,EACKtW,CAAAyW,SAAA9f,QAAA,CAA2BZ,CAA3B,CADL,GAEMwqB,CAIJ,GAHEvgB,CAGF,CAHc/K,EAAA,CAAQ+K,CAAR,CAAmB,SAAUugB,CAAV,OAAgCC,CAAhC,CAAnB,CAGd,EADAF,CAAA9sB,KAAA,CAAiBwM,CAAjB,CACA,CAAA7F,CAAA,CAAQ6F,CANV,CAFE,CAUF,MAAMlG,CAAN,CAAS,CAAEsc,CAAA,CAAkBtc,CAAlB,CAAF,CAbyB,CAgBxC,MAAOK,EAnB0B,CA+BnC+lB,QAASA,EAAuB,CAACtrB,CAAD,CAAM6C,CAAN,CAAW,CAAA,IACrCgpB,EAAUhpB,CAAA0iB,MAD2B,CAErCuG,EAAU9rB,CAAAulB,MAF2B,CAGrC7B,EAAW1jB,CAAAqoB,UAGflqB,EAAA,CAAQ6B,CAAR,CAAa,QAAQ,CAACd,CAAD,CAAQZ,CAAR,CAAa,CACX,GAArB,EAAIA,CAAAwE,OAAA,CAAW,CAAX,CAAJ,GACMD,CAAA,CAAIvE,CAAJ,CAGJ,GAFEY,CAEF,GAFoB,OAAR,GAAAZ,CAAA,CAAkB,GAAlB,CAAwB,GAEpC,EAF2CuE,CAAA,CAAIvE,CAAJ,CAE3C,EAAA0B,CAAA+rB,KAAA,CAASztB,CAAT,CAAcY,CAAd,CAAqB,CAAA,CAArB,CAA2B2sB,CAAA,CAAQvtB,CAAR,CAA3B,CAJF,CADgC,CAAlC,CAUAH,EAAA,CAAQ0E,CAAR,CAAa,QAAQ,CAAC3D,CAAD,CAAQZ,CAAR,CAAa,CACrB,OAAX,EAAIA,CAAJ,EACE6kB,EAAA,CAAaO,CAAb,CAAuBxkB,CAAvB,CACA,CAAAc,CAAA,CAAI,OAAJ,CAAA,EAAgBA,CAAA,CAAI,OAAJ,CAAA;AAAeA,CAAA,CAAI,OAAJ,CAAf,CAA8B,GAA9B,CAAoC,EAApD,EAA0Dd,CAF5D,EAGkB,OAAX,EAAIZ,CAAJ,EACLolB,CAAAhiB,KAAA,CAAc,OAAd,CAAuBgiB,CAAAhiB,KAAA,CAAc,OAAd,CAAvB,CAAgD,GAAhD,CAAsDxC,CAAtD,CACA,CAAAc,CAAA,MAAA,EAAgBA,CAAA,MAAA,CAAeA,CAAA,MAAf,CAA8B,GAA9B,CAAoC,EAApD,EAA0Dd,CAFrD,EAMqB,GANrB,EAMIZ,CAAAwE,OAAA,CAAW,CAAX,CANJ,EAM6B9C,CAAAxB,eAAA,CAAmBF,CAAnB,CAN7B,GAOL0B,CAAA,CAAI1B,CAAJ,CACA,CADWY,CACX,CAAA4sB,CAAA,CAAQxtB,CAAR,CAAA,CAAeutB,CAAA,CAAQvtB,CAAR,CARV,CAJyB,CAAlC,CAhByC,CAkC3CitB,QAASA,EAAkB,CAAC9J,CAAD,CAAa6I,CAAb,CAA2B0B,CAA3B,CACvBnI,CADuB,CACTW,CADS,CACU2C,CADV,CACsBC,CADtB,CACmCrE,CADnC,CAC2D,CAAA,IAChFkJ,EAAY,EADoE,CAEhFC,CAFgF,CAGhFC,CAHgF,CAIhFC,EAA4B9B,CAAA,CAAa,CAAb,CAJoD,CAKhF+B,EAAqB5K,CAAAlR,MAAA,EAL2D,CAOhF+b,EAAuBvsB,CAAA,CAAO,EAAP,CAAWssB,CAAX,CAA+B,aACvC,IADuC,YACrB,IADqB,SACN,IADM,qBACqBA,CADrB,CAA/B,CAPyD,CAUhFpC,EAAe1rB,CAAA,CAAW8tB,CAAApC,YAAX,CACD,CAARoC,CAAApC,YAAA,CAA+BK,CAA/B,CAA6C0B,CAA7C,CAAQ,CACRK,CAAApC,YAEVK,EAAArlB,MAAA,EAEAmd,EAAAtK,IAAA,CAAU0K,CAAA+J,sBAAA,CAA2BtC,CAA3B,CAAV,CAAmD,OAAQ5H,CAAR,CAAnD,CAAAmK,QAAA,CACU,QAAQ,CAACC,CAAD,CAAU,CAAA,IACpB1F,CADoB,CACuB2F,CAE/CD,EAAA,CAAUxB,CAAA,CAAoBwB,CAApB,CAEV,IAAIJ,CAAA7mB,QAAJ,CAAgC,CAE5B+kB,CAAA,CAp3IJnZ,EAAApJ,KAAA,CAm3IuBykB,CAn3IvB,CAm3IE,CAGc1nB,CAAA,CAAO0nB,CAAP,CAHd,CACc,EAId1F,EAAA,CAAcwD,CAAA,CAAU,CAAV,CAEd,IAAwB,CAAxB,EAAIA,CAAAxsB,OAAJ;AAAsD,CAAtD,GAA6BgpB,CAAA/oB,SAA7B,CACE,KAAM4oB,GAAA,CAAe,OAAf,CAEFyF,CAAAxlB,KAFE,CAEuBojB,CAFvB,CAAN,CAKF0C,CAAA,CAAoB,OAAQ,EAAR,CACpB7B,GAAA,CAAYjH,CAAZ,CAA0ByG,CAA1B,CAAwCvD,CAAxC,CACA,KAAIoE,EAAqBrG,EAAA,CAAkBiC,CAAlB,CAA+B,EAA/B,CAAmC4F,CAAnC,CAErB7rB,EAAA,CAASurB,CAAA3kB,MAAT,CAAJ,EACE2jB,EAAA,CAAwBF,CAAxB,CAEF1J,EAAA,CAAa0J,CAAAnnB,OAAA,CAA0Byd,CAA1B,CACb6J,EAAA,CAAwBU,CAAxB,CAAgCW,CAAhC,CAtB8B,CAAhC,IAwBE5F,EACA,CADcqF,CACd,CAAA9B,CAAAjlB,KAAA,CAAkBonB,CAAlB,CAGFhL,EAAA9hB,QAAA,CAAmB2sB,CAAnB,CAEAJ,EAAA,CAA0BnH,EAAA,CAAsBtD,CAAtB,CAAkCsF,CAAlC,CAA+CiF,CAA/C,CACtBxH,CADsB,CACH8F,CADG,CACW+B,CADX,CAC+BlF,CAD/B,CAC2CC,CAD3C,CAEtBrE,CAFsB,CAG1B5kB,EAAA,CAAQ0lB,CAAR,CAAsB,QAAQ,CAACtiB,CAAD,CAAOxC,CAAP,CAAU,CAClCwC,CAAJ,EAAYwlB,CAAZ,GACElD,CAAA,CAAa9kB,CAAb,CADF,CACoBurB,CAAA,CAAa,CAAb,CADpB,CADsC,CAAxC,CAQA,KAHA6B,CAGA,CAH2BjJ,CAAA,CAAaoH,CAAA,CAAa,CAAb,CAAAnY,WAAb,CAAyCqS,CAAzC,CAG3B,CAAMyH,CAAAluB,OAAN,CAAA,CAAwB,CAClB2J,CAAAA,CAAQukB,CAAA1b,MAAA,EACRqc,EAAAA,CAAyBX,CAAA1b,MAAA,EAFP,KAGlBsc,EAAkBZ,CAAA1b,MAAA,EAHA,CAIlBuT,EAAoBmI,CAAA1b,MAAA,EAJF,CAKlByX,EAAWsC,CAAA,CAAa,CAAb,CAEf,IAAIsC,CAAJ,GAA+BR,CAA/B,CAA0D,CACxD,IAAIU,EAAaF,CAAA3lB,UAEX8b,EAAAoF,8BAAN,EACIkE,CAAA7mB,QADJ,GAGEwiB,CAHF,CAGazV,EAAA,CAAYwU,CAAZ,CAHb,CAMA+D,GAAA,CAAY+B,CAAZ,CAA6B9nB,CAAA,CAAO6nB,CAAP,CAA7B,CAA6D5E,CAA7D,CAGA7E,GAAA,CAAape,CAAA,CAAOijB,CAAP,CAAb,CAA+B8E,CAA/B,CAZwD,CAexDJ,CAAA,CADER,CAAAzH,WAAJ,CAC2BC,CAAA,CAAwBhd,CAAxB,CAA+BwkB,CAAAzH,WAA/B,CAD3B,CAG2BX,CAE3BoI,EAAA,CAAwBC,CAAxB,CAAkDzkB,CAAlD,CAAyDsgB,CAAzD,CAAmEnE,CAAnE,CACE6I,CADF,CA1BsB,CA6BxBT,CAAA,CAAY,IA3EY,CAD5B,CAAAzQ,MAAA,CA8EQ,QAAQ,CAACuR,CAAD,CAAWC,CAAX,CAAiBC,CAAjB,CAA0BxiB,CAA1B,CAAkC,CAC9C,KAAMmc,GAAA,CAAe,QAAf;AAAyDnc,CAAA0R,IAAzD,CAAN,CAD8C,CA9ElD,CAkFA,OAAO+Q,SAA0B,CAACC,CAAD,CAAoBzlB,CAApB,CAA2BnG,CAA3B,CAAiC6rB,CAAjC,CAA8CtJ,CAA9C,CAAiE,CAC5FmI,CAAJ,EACEA,CAAArtB,KAAA,CAAe8I,CAAf,CAGA,CAFAukB,CAAArtB,KAAA,CAAe2C,CAAf,CAEA,CADA0qB,CAAArtB,KAAA,CAAewuB,CAAf,CACA,CAAAnB,CAAArtB,KAAA,CAAeklB,CAAf,CAJF,EAMEoI,CAAA,CAAwBC,CAAxB,CAAkDzkB,CAAlD,CAAyDnG,CAAzD,CAA+D6rB,CAA/D,CAA4EtJ,CAA5E,CAP8F,CAlGd,CAkHtFwC,QAASA,EAAU,CAACgD,CAAD,CAAIC,CAAJ,CAAO,CACxB,IAAI8D,EAAO9D,CAAA7H,SAAP2L,CAAoB/D,CAAA5H,SACxB,OAAa,EAAb,GAAI2L,CAAJ,CAAuBA,CAAvB,CACI/D,CAAAziB,KAAJ,GAAe0iB,CAAA1iB,KAAf,CAA+ByiB,CAAAziB,KAAD,CAAU0iB,CAAA1iB,KAAV,CAAqB,EAArB,CAAyB,CAAvD,CACOyiB,CAAAlqB,MADP,CACiBmqB,CAAAnqB,MAJO,CAQ1BurB,QAASA,EAAiB,CAAC2C,CAAD,CAAOC,CAAP,CAA0BniB,CAA1B,CAAqCtG,CAArC,CAA8C,CACtE,GAAIyoB,CAAJ,CACE,KAAM3G,GAAA,CAAe,UAAf,CACF2G,CAAA1mB,KADE,CACsBuE,CAAAvE,KADtB,CACsCymB,CADtC,CAC4CzoB,EAAA,CAAYC,CAAZ,CAD5C,CAAN,CAFoE,CAQxEuhB,QAASA,EAA2B,CAAC5E,CAAD,CAAa+L,CAAb,CAAmB,CACrD,IAAIC,EAAgBtL,CAAA,CAAaqL,CAAb,CAAmB,CAAA,CAAnB,CAChBC,EAAJ,EACEhM,CAAA7iB,KAAA,CAAgB,UACJ,CADI,SAEL+B,EAAA,CAAQ+sB,QAA8B,CAAChmB,CAAD,CAAQnG,CAAR,CAAc,CAAA,IACvDjB,EAASiB,CAAAjB,OAAA,EAD8C,CAEvDqtB,EAAWrtB,CAAAwH,KAAA,CAAY,UAAZ,CAAX6lB,EAAsC,EAC1CA,EAAA/uB,KAAA,CAAc6uB,CAAd,CACAtK,GAAA,CAAa7iB,CAAAwH,KAAA,CAAY,UAAZ,CAAwB6lB,CAAxB,CAAb,CAAgD,YAAhD,CACAjmB,EAAAnF,OAAA,CAAakrB,CAAb,CAA4BG,QAAiC,CAAC1uB,CAAD,CAAQ,CACnEqC,CAAA,CAAK,CAAL,CAAAyhB,UAAA,CAAoB9jB,CAD+C,CAArE,CAL2D,CAApD,CAFK,CAAhB,CAHmD,CAmBvD2uB,QAASA,EAAiB,CAACtsB,CAAD,CAAOusB,CAAP,CAA2B,CACnD,GAA0B,QAA1B;AAAIA,CAAJ,CACE,MAAOtL,EAAAuL,KAET,KAAIzmB,EAAMoe,EAAA,CAAUnkB,CAAV,CAEV,IAA0B,WAA1B,EAAIusB,CAAJ,EACY,MADZ,EACKxmB,CADL,EAC4C,QAD5C,EACsBwmB,CADtB,EAEY,KAFZ,EAEKxmB,CAFL,GAE4C,KAF5C,EAEsBwmB,CAFtB,EAG4C,OAH5C,EAGsBA,CAHtB,EAIE,MAAOtL,EAAAwL,aAV0C,CAerD5H,QAASA,EAA2B,CAAC7kB,CAAD,CAAOkgB,CAAP,CAAmBviB,CAAnB,CAA0B2H,CAA1B,CAAgC,CAClE,IAAI4mB,EAAgBtL,CAAA,CAAajjB,CAAb,CAAoB,CAAA,CAApB,CAGpB,IAAKuuB,CAAL,CAAA,CAGA,GAAa,UAAb,GAAI5mB,CAAJ,EAA+C,QAA/C,GAA2B6e,EAAA,CAAUnkB,CAAV,CAA3B,CACE,KAAMqlB,GAAA,CAAe,UAAf,CAEF/hB,EAAA,CAAYtD,CAAZ,CAFE,CAAN,CAKFkgB,CAAA7iB,KAAA,CAAgB,UACJ,GADI,SAEL+I,QAAQ,EAAG,CAChB,MAAO,KACAsmB,QAAiC,CAACvmB,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CACvDynB,CAAAA,CAAeznB,CAAAynB,YAAfA,GAAoCznB,CAAAynB,YAApCA,CAAuD,EAAvDA,CAEJ,IAAI/H,CAAApZ,KAAA,CAA+BnB,CAA/B,CAAJ,CACE,KAAM+f,GAAA,CAAe,aAAf,CAAN,CAWF,GAJA6G,CAIA,CAJgBtL,CAAA,CAAazgB,CAAA,CAAKmF,CAAL,CAAb,CAAyB,CAAA,CAAzB,CAA+BgnB,CAAA,CAAkBtsB,CAAlB,CAAwBsF,CAAxB,CAA/B,CAIhB,CAIAnF,CAAA,CAAKmF,CAAL,CAEC,CAFY4mB,CAAA,CAAc/lB,CAAd,CAEZ,CADAwmB,CAAA/E,CAAA,CAAYtiB,CAAZ,CAAAqnB,GAAsB/E,CAAA,CAAYtiB,CAAZ,CAAtBqnB,CAA0C,EAA1CA,UACA,CADyD,CAAA,CACzD,CAAA3rB,CAAAb,CAAAynB,YAAA5mB,EAAoBb,CAAAynB,YAAA,CAAiBtiB,CAAjB,CAAAuiB,QAApB7mB,EAAsDmF,CAAtDnF,QAAA,CACQkrB,CADR,CACuBG,QAAiC,CAACO,CAAD,CAAWC,CAAX,CAAqB,CAO9D,OAAZ;AAAGvnB,CAAH,EAAuBsnB,CAAvB,EAAmCC,CAAnC,CACE1sB,CAAA2sB,aAAA,CAAkBF,CAAlB,CAA4BC,CAA5B,CADF,CAGE1sB,CAAAqqB,KAAA,CAAUllB,CAAV,CAAgBsnB,CAAhB,CAVwE,CAD7E,CArB0D,CADxD,CADS,CAFN,CAAhB,CATA,CAJkE,CAqEpErD,QAASA,GAAW,CAACjH,CAAD,CAAeyK,CAAf,CAAiCC,CAAjC,CAA0C,CAAA,IACxDC,EAAuBF,CAAA,CAAiB,CAAjB,CADiC,CAExDG,EAAcH,CAAAvwB,OAF0C,CAGxDuC,EAASkuB,CAAA9Z,WAH+C,CAIxD3V,CAJwD,CAIrD0V,CAEP,IAAIoP,CAAJ,CACE,IAAI9kB,CAAO,CAAH,CAAG,CAAA0V,CAAA,CAAKoP,CAAA9lB,OAAhB,CAAqCgB,CAArC,CAAyC0V,CAAzC,CAA6C1V,CAAA,EAA7C,CACE,GAAI8kB,CAAA,CAAa9kB,CAAb,CAAJ,EAAuByvB,CAAvB,CAA6C,CAC3C3K,CAAA,CAAa9kB,CAAA,EAAb,CAAA,CAAoBwvB,CACJG,EAAAA,CAAKzc,CAALyc,CAASD,CAATC,CAAuB,CAAvC,KAAK,IACIxc,EAAK2R,CAAA9lB,OADd,CAEKkU,CAFL,CAESC,CAFT,CAEaD,CAAA,EAAA,CAAKyc,CAAA,EAFlB,CAGMA,CAAJ,CAASxc,CAAT,CACE2R,CAAA,CAAa5R,CAAb,CADF,CACoB4R,CAAA,CAAa6K,CAAb,CADpB,CAGE,OAAO7K,CAAA,CAAa5R,CAAb,CAGX4R,EAAA9lB,OAAA,EAAuB0wB,CAAvB,CAAqC,CACrC,MAZ2C,CAiB7CnuB,CAAJ,EACEA,CAAAquB,aAAA,CAAoBJ,CAApB,CAA6BC,CAA7B,CAEEtd,EAAAA,CAAWzT,CAAA0T,uBAAA,EACfD,EAAAI,YAAA,CAAqBkd,CAArB,CACAD,EAAA,CAAQxpB,CAAA6pB,QAAR,CAAA,CAA0BJ,CAAA,CAAqBzpB,CAAA6pB,QAArB,CACjBC,EAAAA,CAAI,CAAb,KAAgBC,CAAhB,CAAqBR,CAAAvwB,OAArB,CAA8C8wB,CAA9C,CAAkDC,CAAlD,CAAsDD,CAAA,EAAtD,CACM/pB,CAGJ,CAHcwpB,CAAA,CAAiBO,CAAjB,CAGd,CAFA9pB,CAAA,CAAOD,CAAP,CAAA0b,OAAA,EAEA,CADAtP,CAAAI,YAAA,CAAqBxM,CAArB,CACA,CAAA,OAAOwpB,CAAA,CAAiBO,CAAjB,CAGTP,EAAA,CAAiB,CAAjB,CAAA,CAAsBC,CACtBD,EAAAvwB,OAAA,CAA0B,CAvCkC,CA2C9D2pB,QAASA,GAAkB,CAAC/jB,CAAD,CAAKorB,CAAL,CAAiB,CAC1C,MAAOhvB,EAAA,CAAO,QAAQ,EAAG,CAAE,MAAO4D,EAAAI,MAAA,CAAS,IAAT,CAAe9D,SAAf,CAAT,CAAlB;AAAyD0D,CAAzD,CAA6DorB,CAA7D,CADmC,CAjxC5C,IAAIlK,GAAaA,QAAQ,CAAC/f,CAAD,CAAUpD,CAAV,CAAgB,CACvC,IAAA2mB,UAAA,CAAiBvjB,CACjB,KAAAygB,MAAA,CAAa7jB,CAAb,EAAqB,EAFkB,CAKzCmjB,GAAA9L,UAAA,CAAuB,YACT0M,EADS,WAeTuJ,QAAQ,CAACC,CAAD,CAAW,CAC1BA,CAAH,EAAiC,CAAjC,CAAeA,CAAAlxB,OAAf,EACE0kB,CAAAkB,SAAA,CAAkB,IAAA0E,UAAlB,CAAkC4G,CAAlC,CAF2B,CAfV,cAgCNC,QAAQ,CAACD,CAAD,CAAW,CAC7BA,CAAH,EAAiC,CAAjC,CAAeA,CAAAlxB,OAAf,EACE0kB,CAAA0M,YAAA,CAAqB,IAAA9G,UAArB,CAAqC4G,CAArC,CAF8B,CAhCb,cAkDNZ,QAAQ,CAACe,CAAD,CAAatC,CAAb,CAAyB,CAC9C,IAAIuC,EAAQC,EAAA,CAAgBF,CAAhB,CAA4BtC,CAA5B,CAAZ,CACIyC,EAAWD,EAAA,CAAgBxC,CAAhB,CAA4BsC,CAA5B,CAEK,EAApB,GAAGC,CAAAtxB,OAAH,CACE0kB,CAAA0M,YAAA,CAAqB,IAAA9G,UAArB,CAAqCkH,CAArC,CADF,CAE8B,CAAvB,GAAGA,CAAAxxB,OAAH,CACL0kB,CAAAkB,SAAA,CAAkB,IAAA0E,UAAlB,CAAkCgH,CAAlC,CADK,CAGL5M,CAAA+M,SAAA,CAAkB,IAAAnH,UAAlB,CAAkCgH,CAAlC,CAAyCE,CAAzC,CAT4C,CAlD3B,MAwEfxD,QAAQ,CAACztB,CAAD,CAAMY,CAAN,CAAauwB,CAAb,CAAwB9G,CAAxB,CAAkC,CAAA,IAK1C+G,EAAa7a,EAAA,CAAmB,IAAAwT,UAAA,CAAe,CAAf,CAAnB,CAAsC/pB,CAAtC,CAIboxB,EAAJ,GACE,IAAArH,UAAA5mB,KAAA,CAAoBnD,CAApB,CAAyBY,CAAzB,CACA,CAAAypB,CAAA,CAAW+G,CAFb,CAKA,KAAA,CAAKpxB,CAAL,CAAA,CAAYY,CAGRypB,EAAJ,CACE,IAAApD,MAAA,CAAWjnB,CAAX,CADF;AACoBqqB,CADpB,EAGEA,CAHF,CAGa,IAAApD,MAAA,CAAWjnB,CAAX,CAHb,IAKI,IAAAinB,MAAA,CAAWjnB,CAAX,CALJ,CAKsBqqB,CALtB,CAKiCtgB,EAAA,CAAW/J,CAAX,CAAgB,GAAhB,CALjC,CASAkD,EAAA,CAAWkkB,EAAA,CAAU,IAAA2C,UAAV,CAGX,IAAkB,GAAlB,GAAK7mB,CAAL,EAAiC,MAAjC,GAAyBlD,CAAzB,EACkB,KADlB,GACKkD,CADL,EACmC,KADnC,GAC2BlD,CAD3B,CAEE,IAAA,CAAKA,CAAL,CAAA,CAAYY,CAAZ,CAAoBwjB,CAAA,CAAcxjB,CAAd,CAA6B,KAA7B,GAAqBZ,CAArB,CAGJ,EAAA,CAAlB,GAAImxB,CAAJ,GACgB,IAAd,GAAIvwB,CAAJ,EAAsBA,CAAtB,GAAgCxB,CAAhC,CACE,IAAA2qB,UAAAsH,WAAA,CAA0BhH,CAA1B,CADF,CAGE,IAAAN,UAAA3mB,KAAA,CAAoBinB,CAApB,CAA8BzpB,CAA9B,CAJJ,CAUA,EADIiqB,CACJ,CADkB,IAAAA,YAClB,GAAehrB,CAAA,CAAQgrB,CAAA,CAAY7qB,CAAZ,CAAR,CAA0B,QAAQ,CAACqF,CAAD,CAAK,CACpD,GAAI,CACFA,CAAA,CAAGzE,CAAH,CADE,CAEF,MAAOgG,CAAP,CAAU,CACVsc,CAAA,CAAkBtc,CAAlB,CADU,CAHwC,CAAvC,CA5C+B,CAxE3B,UAgJXgkB,QAAQ,CAAC5qB,CAAD,CAAMqF,CAAN,CAAU,CAAA,IACtBghB,EAAQ,IADc,CAEtBwE,EAAexE,CAAAwE,YAAfA,GAAqCxE,CAAAwE,YAArCA,CAAyD,EAAzDA,CAFsB,CAGtByG,EAAazG,CAAA,CAAY7qB,CAAZ,CAAbsxB,GAAkCzG,CAAA,CAAY7qB,CAAZ,CAAlCsxB,CAAqD,EAArDA,CAEJA,EAAAhxB,KAAA,CAAe+E,CAAf,CACAwW,EAAA7X,WAAA,CAAsB,QAAQ,EAAG,CAC1BstB,CAAA1B,QAAL,EAEEvqB,CAAA,CAAGghB,CAAA,CAAMrmB,CAAN,CAAH,CAH6B,CAAjC,CAMA,OAAOqF,EAZmB,CAhJP,CAP+D,KAuKlFksB,EAAc1N,CAAA0N,YAAA,EAvKoE,CAwKlFC,GAAY3N,CAAA2N,UAAA,EAxKsE,CAyKlF7E,EAAsC,IAChB,EADC4E,CACD,EADsC,IACtC,EADwBC,EACxB;AAAhBrvB,EAAgB,CAChBwqB,QAA4B,CAACjB,CAAD,CAAW,CACvC,MAAOA,EAAAxkB,QAAA,CAAiB,OAAjB,CAA0BqqB,CAA1B,CAAArqB,QAAA,CAA+C,KAA/C,CAAsDsqB,EAAtD,CADgC,CA3KqC,CA8KlF7J,EAAkB,cAGtB,OAAOte,EAjL+E,CAJ5E,CA3H6C,CAo6C3D8d,QAASA,GAAkB,CAAC5e,CAAD,CAAO,CAChC,MAAOuI,GAAA,CAAUvI,CAAArB,QAAA,CAAauqB,EAAb,CAA4B,EAA5B,CAAV,CADyB,CA4DlCT,QAASA,GAAe,CAACU,CAAD,CAAOC,CAAP,CAAa,CAAA,IAC/BC,EAAS,EADsB,CAE/BC,EAAUH,CAAAlqB,MAAA,CAAW,KAAX,CAFqB,CAG/BsqB,EAAUH,CAAAnqB,MAAA,CAAW,KAAX,CAHqB,CAM3B/G,EAAI,CADZ,EAAA,CACA,IAAA,CAAeA,CAAf,CAAmBoxB,CAAApyB,OAAnB,CAAmCgB,CAAA,EAAnC,CAAwC,CAEtC,IADA,IAAIsxB,EAAQF,CAAA,CAAQpxB,CAAR,CAAZ,CACQkT,EAAI,CAAZ,CAAeA,CAAf,CAAmBme,CAAAryB,OAAnB,CAAmCkU,CAAA,EAAnC,CACE,GAAGoe,CAAH,EAAYD,CAAA,CAAQne,CAAR,CAAZ,CAAwB,SAAS,CAEnCie,EAAA,GAA2B,CAAhB,CAAAA,CAAAnyB,OAAA,CAAoB,GAApB,CAA0B,EAArC,EAA2CsyB,CALL,CAOxC,MAAOH,EAb4B,CA0BrCniB,QAASA,GAAmB,EAAG,CAAA,IACzBoX,EAAc,EADW,CAEzBmL,EAAY,yBAWhB,KAAAC,SAAA,CAAgBC,QAAQ,CAAC3pB,CAAD,CAAOmC,CAAP,CAAoB,CAC1CC,EAAA,CAAwBpC,CAAxB,CAA8B,YAA9B,CACI/F,EAAA,CAAS+F,CAAT,CAAJ,CACE9G,CAAA,CAAOolB,CAAP,CAAoBte,CAApB,CADF,CAGEse,CAAA,CAAYte,CAAZ,CAHF,CAGsBmC,CALoB,CAU5C,KAAAuO,KAAA,CAAY,CAAC,WAAD,CAAc,SAAd,CAAyB,QAAQ,CAAC4B,CAAD,CAAYc,CAAZ,CAAqB,CAwBhE,MAAO,SAAQ,CAACwW,CAAD,CAAa/X,CAAb,CAAqB,CAAA,IAC9BM,CAD8B;AACbhQ,CADa,CACA0nB,CAE/BzyB,EAAA,CAASwyB,CAAT,CAAH,GACElrB,CAOA,CAPQkrB,CAAAlrB,MAAA,CAAiB+qB,CAAjB,CAOR,CANAtnB,CAMA,CANczD,CAAA,CAAM,CAAN,CAMd,CALAmrB,CAKA,CALanrB,CAAA,CAAM,CAAN,CAKb,CAJAkrB,CAIA,CAJatL,CAAA3mB,eAAA,CAA2BwK,CAA3B,CACA,CAAPmc,CAAA,CAAYnc,CAAZ,CAAO,CACPE,EAAA,CAAOwP,CAAAoR,OAAP,CAAsB9gB,CAAtB,CAAmC,CAAA,CAAnC,CADO,EACqCE,EAAA,CAAO+Q,CAAP,CAAgBjR,CAAhB,CAA6B,CAAA,CAA7B,CAElD,CAAAF,EAAA,CAAY2nB,CAAZ,CAAwBznB,CAAxB,CAAqC,CAAA,CAArC,CARF,CAWAgQ,EAAA,CAAWG,CAAA7B,YAAA,CAAsBmZ,CAAtB,CAAkC/X,CAAlC,CAEX,IAAIgY,CAAJ,CAAgB,CACd,GAAMhY,CAAAA,CAAN,EAAwC,QAAxC,EAAgB,MAAOA,EAAAoR,OAAvB,CACE,KAAMnsB,EAAA,CAAO,aAAP,CAAA,CAAsB,OAAtB,CAEFqL,CAFE,EAEaynB,CAAA5pB,KAFb,CAE8B6pB,CAF9B,CAAN,CAKFhY,CAAAoR,OAAA,CAAc4G,CAAd,CAAA,CAA4B1X,CAPd,CAUhB,MAAOA,EA1B2B,CAxB4B,CAAtD,CAvBiB,CAsG/BhL,QAASA,GAAiB,EAAE,CAC1B,IAAAuJ,KAAA,CAAY,CAAC,SAAD,CAAY,QAAQ,CAAC/Z,CAAD,CAAQ,CACtC,MAAOuH,EAAA,CAAOvH,CAAAC,SAAP,CAD+B,CAA5B,CADc,CAsC5BwQ,QAASA,GAAyB,EAAG,CACnC,IAAAsJ,KAAA,CAAY,CAAC,MAAD,CAAS,QAAQ,CAAC2D,CAAD,CAAO,CAClC,MAAO,SAAQ,CAACyV,CAAD,CAAYC,CAAZ,CAAmB,CAChC1V,CAAAM,MAAAzX,MAAA,CAAiBmX,CAAjB,CAAuBjb,SAAvB,CADgC,CADA,CAAxB,CADuB,CAcrC4wB,QAASA,GAAY,CAAC5D,CAAD,CAAU,CAAA,IACzBjc,EAAS,EADgB,CACZ1S,CADY,CACP4F,CADO,CACFnF,CAE3B,IAAI,CAACkuB,CAAL,CAAc,MAAOjc,EAErB7S,EAAA,CAAQ8uB,CAAAnnB,MAAA,CAAc,IAAd,CAAR,CAA6B,QAAQ,CAACgrB,CAAD,CAAO,CAC1C/xB,CAAA,CAAI+xB,CAAA/uB,QAAA,CAAa,GAAb,CACJzD,EAAA,CAAMsG,CAAA,CAAUkM,EAAA,CAAKggB,CAAA5K,OAAA,CAAY,CAAZ;AAAennB,CAAf,CAAL,CAAV,CACNmF,EAAA,CAAM4M,EAAA,CAAKggB,CAAA5K,OAAA,CAAYnnB,CAAZ,CAAgB,CAAhB,CAAL,CAEFT,EAAJ,GAEI0S,CAAA,CAAO1S,CAAP,CAFJ,CACM0S,CAAA,CAAO1S,CAAP,CAAJ,CACE0S,CAAA,CAAO1S,CAAP,CADF,EACiB,IADjB,CACwB4F,CADxB,EAGgBA,CAJlB,CAL0C,CAA5C,CAcA,OAAO8M,EAnBsB,CAmC/B+f,QAASA,GAAa,CAAC9D,CAAD,CAAU,CAC9B,IAAI+D,EAAalwB,CAAA,CAASmsB,CAAT,CAAA,CAAoBA,CAApB,CAA8BvvB,CAE/C,OAAO,SAAQ,CAACmJ,CAAD,CAAO,CACfmqB,CAAL,GAAiBA,CAAjB,CAA+BH,EAAA,CAAa5D,CAAb,CAA/B,CAEA,OAAIpmB,EAAJ,CACSmqB,CAAA,CAAWpsB,CAAA,CAAUiC,CAAV,CAAX,CADT,EACwC,IADxC,CAIOmqB,CAPa,CAHQ,CAyBhCC,QAASA,GAAa,CAACnpB,CAAD,CAAOmlB,CAAP,CAAgBiE,CAAhB,CAAqB,CACzC,GAAI3yB,CAAA,CAAW2yB,CAAX,CAAJ,CACE,MAAOA,EAAA,CAAIppB,CAAJ,CAAUmlB,CAAV,CAET9uB,EAAA,CAAQ+yB,CAAR,CAAa,QAAQ,CAACvtB,CAAD,CAAK,CACxBmE,CAAA,CAAOnE,CAAA,CAAGmE,CAAH,CAASmlB,CAAT,CADiB,CAA1B,CAIA,OAAOnlB,EARkC,CAiB3CuG,QAASA,GAAa,EAAG,CAAA,IACnB8iB,EAAa,kBADM,CAEnBC,EAAW,YAFQ,CAGnBC,EAAoB,cAHD,CAInBC,EAAgC,CAAC,cAAD,CAAiB,gCAAjB,CAJb,CAMnBC,EAAW,IAAAA,SAAXA,CAA2B,mBAEV,CAAC,QAAQ,CAACzpB,CAAD,CAAO,CAC7B7J,CAAA,CAAS6J,CAAT,CAAJ,GAEEA,CACA,CADOA,CAAAtC,QAAA,CAAa6rB,CAAb,CAAgC,EAAhC,CACP,CAAIF,CAAAnpB,KAAA,CAAgBF,CAAhB,CAAJ,EAA6BspB,CAAAppB,KAAA,CAAcF,CAAd,CAA7B,GACEA,CADF,CACSvD,EAAA,CAASuD,CAAT,CADT,CAHF,CAMA,OAAOA,EAP0B,CAAhB,CAFU,kBAaX,CAAC,QAAQ,CAAC0pB,CAAD,CAAI,CAC7B,MAAO1wB,EAAA,CAAS0wB,CAAT,CAAA;AAvhNmB,eAuhNnB,GAvhNJvwB,EAAAxC,KAAA,CAuhN2B+yB,CAvhN3B,CAuhNI,EAlhNmB,eAkhNnB,GAlhNJvwB,EAAAxC,KAAA,CAkhNyC+yB,CAlhNzC,CAkhNI,CAA0CrtB,EAAA,CAAOqtB,CAAP,CAA1C,CAAsDA,CADhC,CAAb,CAbW,SAkBpB,QACC,QACI,mCADJ,CADD,MAICrvB,EAAA,CAAKmvB,CAAL,CAJD,KAKCnvB,EAAA,CAAKmvB,CAAL,CALD,OAMCnvB,EAAA,CAAKmvB,CAAL,CAND,CAlBoB,gBA2Bb,YA3Ba,gBA4Bb,cA5Ba,CANR,CAyCnBG,EAAuB,IAAAC,aAAvBD,CAA2C,EAzCxB,CA+CnBE,EAA+B,IAAAC,qBAA/BD,CAA2D,EAE/D,KAAApa,KAAA,CAAY,CAAC,cAAD,CAAiB,UAAjB,CAA6B,eAA7B,CAA8C,YAA9C,CAA4D,IAA5D,CAAkE,WAAlE,CACR,QAAQ,CAACsa,CAAD,CAAeC,CAAf,CAAyBhR,CAAzB,CAAwC3G,CAAxC,CAAoD4X,CAApD,CAAwD5Y,CAAxD,CAAmE,CAihB7EiJ,QAASA,EAAK,CAAC4P,CAAD,CAAgB,CA6E5BC,QAASA,EAAiB,CAAClF,CAAD,CAAW,CAEnC,IAAImF,EAAOnyB,CAAA,CAAO,EAAP,CAAWgtB,CAAX,CAAqB,MACxBkE,EAAA,CAAclE,CAAAjlB,KAAd,CAA6BilB,CAAAE,QAA7B,CAA+CxiB,CAAAwnB,kBAA/C,CADwB,CAArB,CAGX,OAzpBC,IA0pBM,EADWlF,CAAAoF,OACX,EA1pBoB,GA0pBpB,CADWpF,CAAAoF,OACX;AAAHD,CAAG,CACHH,CAAAK,OAAA,CAAUF,CAAV,CAP+B,CA5ErC,IAAIznB,EAAS,QACH,KADG,kBAEO8mB,CAAAc,iBAFP,mBAGQd,CAAAU,kBAHR,CAAb,CAKIhF,EAiFJqF,QAAqB,CAAC7nB,CAAD,CAAS,CA2B5B8nB,QAASA,EAAW,CAACtF,CAAD,CAAU,CAC5B,IAAIuF,CAEJr0B,EAAA,CAAQ8uB,CAAR,CAAiB,QAAQ,CAACwF,CAAD,CAAWC,CAAX,CAAmB,CACtCn0B,CAAA,CAAWk0B,CAAX,CAAJ,GACED,CACA,CADgBC,CAAA,EAChB,CAAqB,IAArB,EAAID,CAAJ,CACEvF,CAAA,CAAQyF,CAAR,CADF,CACoBF,CADpB,CAGE,OAAOvF,CAAA,CAAQyF,CAAR,CALX,CAD0C,CAA5C,CAH4B,CA3BF,IACxBC,EAAapB,CAAAtE,QADW,CAExB2F,EAAa7yB,CAAA,CAAO,EAAP,CAAW0K,CAAAwiB,QAAX,CAFW,CAGxB4F,CAHwB,CAGeC,CAHf,CAK5BH,EAAa5yB,CAAA,CAAO,EAAP,CAAW4yB,CAAAI,OAAX,CAA8BJ,CAAA,CAAW/tB,CAAA,CAAU6F,CAAAL,OAAV,CAAX,CAA9B,CAGbmoB,EAAA,CAAYI,CAAZ,CACAJ,EAAA,CAAYK,CAAZ,CAGA,EAAA,CACA,IAAKC,CAAL,GAAsBF,EAAtB,CAAkC,CAChCK,CAAA,CAAyBpuB,CAAA,CAAUiuB,CAAV,CAEzB,KAAKC,CAAL,GAAsBF,EAAtB,CACE,GAAIhuB,CAAA,CAAUkuB,CAAV,CAAJ,GAAiCE,CAAjC,CACE,SAAS,CAIbJ,EAAA,CAAWC,CAAX,CAAA,CAA4BF,CAAA,CAAWE,CAAX,CATI,CAYlC,MAAOD,EAzBqB,CAjFhB,CAAaZ,CAAb,CAEdjyB,EAAA,CAAO0K,CAAP,CAAeunB,CAAf,CACAvnB,EAAAwiB,QAAA,CAAiBA,CACjBxiB,EAAAL,OAAA,CAAgBU,EAAA,CAAUL,CAAAL,OAAV,CAKhB,EAHI6oB,CAGJ,CAHgBC,EAAA,CAAgBzoB,CAAA0R,IAAhB,CACA,CAAV2V,CAAA5T,QAAA,EAAA,CAAmBzT,CAAA0oB,eAAnB,EAA4C5B,CAAA4B,eAA5C,CAAU,CACVz1B,CACN,IACEuvB,CAAA,CAASxiB,CAAA2oB,eAAT,EAAkC7B,CAAA6B,eAAlC,CADF;AACgEH,CADhE,CA0BA,KAAII,EAAQ,CArBQC,QAAQ,CAAC7oB,CAAD,CAAS,CACnCwiB,CAAA,CAAUxiB,CAAAwiB,QACV,KAAIsG,EAAUtC,EAAA,CAAcxmB,CAAA3C,KAAd,CAA2BipB,EAAA,CAAc9D,CAAd,CAA3B,CAAmDxiB,CAAA4nB,iBAAnD,CAGVzxB,EAAA,CAAY6J,CAAA3C,KAAZ,CAAJ,EACE3J,CAAA,CAAQ8uB,CAAR,CAAiB,QAAQ,CAAC/tB,CAAD,CAAQwzB,CAAR,CAAgB,CACb,cAA1B,GAAI9tB,CAAA,CAAU8tB,CAAV,CAAJ,EACI,OAAOzF,CAAA,CAAQyF,CAAR,CAF4B,CAAzC,CAOE9xB,EAAA,CAAY6J,CAAA+oB,gBAAZ,CAAJ,EAA4C,CAAA5yB,CAAA,CAAY2wB,CAAAiC,gBAAZ,CAA5C,GACE/oB,CAAA+oB,gBADF,CAC2BjC,CAAAiC,gBAD3B,CAKA,OAAOC,EAAA,CAAQhpB,CAAR,CAAgB8oB,CAAhB,CAAyBtG,CAAzB,CAAAyG,KAAA,CAAuCzB,CAAvC,CAA0DA,CAA1D,CAlB4B,CAqBzB,CAAgBv0B,CAAhB,CAAZ,CACIi2B,EAAU5B,CAAA6B,KAAA,CAAQnpB,CAAR,CAYd,KATAtM,CAAA,CAAQ01B,CAAR,CAA8B,QAAQ,CAACC,CAAD,CAAc,CAClD,CAAIA,CAAAC,QAAJ,EAA2BD,CAAAE,aAA3B,GACEX,CAAA1zB,QAAA,CAAcm0B,CAAAC,QAAd,CAAmCD,CAAAE,aAAnC,CAEF,EAAIF,CAAA/G,SAAJ,EAA4B+G,CAAAG,cAA5B,GACEZ,CAAAz0B,KAAA,CAAWk1B,CAAA/G,SAAX,CAAiC+G,CAAAG,cAAjC,CALgD,CAApD,CASA,CAAMZ,CAAAt1B,OAAN,CAAA,CAAoB,CACdm2B,CAAAA,CAASb,CAAA9iB,MAAA,EACb,KAAI4jB,EAAWd,CAAA9iB,MAAA,EAAf,CAEAojB,EAAUA,CAAAD,KAAA,CAAaQ,CAAb,CAAqBC,CAArB,CAJQ,CAOpBR,CAAAnH,QAAA,CAAkB4H,QAAQ,CAACzwB,CAAD,CAAK,CAC7BgwB,CAAAD,KAAA,CAAa,QAAQ,CAAC3G,CAAD,CAAW,CAC9BppB,CAAA,CAAGopB,CAAAjlB,KAAH;AAAkBilB,CAAAoF,OAAlB,CAAmCpF,CAAAE,QAAnC,CAAqDxiB,CAArD,CAD8B,CAAhC,CAGA,OAAOkpB,EAJsB,CAO/BA,EAAAnY,MAAA,CAAgB6Y,QAAQ,CAAC1wB,CAAD,CAAK,CAC3BgwB,CAAAD,KAAA,CAAa,IAAb,CAAmB,QAAQ,CAAC3G,CAAD,CAAW,CACpCppB,CAAA,CAAGopB,CAAAjlB,KAAH,CAAkBilB,CAAAoF,OAAlB,CAAmCpF,CAAAE,QAAnC,CAAqDxiB,CAArD,CADoC,CAAtC,CAGA,OAAOkpB,EAJoB,CAO7B,OAAOA,EA3EqB,CAiQ9BF,QAASA,EAAO,CAAChpB,CAAD,CAAS8oB,CAAT,CAAkBX,CAAlB,CAA8B,CAqD5C0B,QAASA,EAAI,CAACnC,CAAD,CAASpF,CAAT,CAAmBwH,CAAnB,CAAkCC,CAAlC,CAA8C,CACrDnc,CAAJ,GA93BC,GA+3BC,EAAc8Z,CAAd,EA/3ByB,GA+3BzB,CAAcA,CAAd,CACE9Z,CAAAhC,IAAA,CAAU8F,CAAV,CAAe,CAACgW,CAAD,CAASpF,CAAT,CAAmB8D,EAAA,CAAa0D,CAAb,CAAnB,CAAgDC,CAAhD,CAAf,CADF,CAIEnc,CAAAmI,OAAA,CAAarE,CAAb,CALJ,CASAsY,EAAA,CAAe1H,CAAf,CAAyBoF,CAAzB,CAAiCoC,CAAjC,CAAgDC,CAAhD,CACKra,EAAAua,QAAL,EAAyBva,CAAAtS,OAAA,EAXgC,CAkB3D4sB,QAASA,EAAc,CAAC1H,CAAD,CAAWoF,CAAX,CAAmBlF,CAAnB,CAA4BuH,CAA5B,CAAwC,CAE7DrC,CAAA,CAAS3G,IAAAC,IAAA,CAAS0G,CAAT,CAAiB,CAAjB,CAER,EAn5BA,GAm5BA,EAAUA,CAAV,EAn5B0B,GAm5B1B,CAAUA,CAAV,CAAoBwC,CAAAC,QAApB,CAAuCD,CAAAvC,OAAvC,EAAwD,MACjDrF,CADiD,QAE/CoF,CAF+C,SAG9CpB,EAAA,CAAc9D,CAAd,CAH8C,QAI/CxiB,CAJ+C,YAK1C+pB,CAL0C,CAAxD,CAJ4D,CAc/DK,QAASA,EAAgB,EAAG,CAC1B,IAAIC,EAAM/yB,EAAA,CAAQqgB,CAAA2S,gBAAR,CAA+BtqB,CAA/B,CACG,GAAb,GAAIqqB,CAAJ,EAAgB1S,CAAA2S,gBAAA7yB,OAAA,CAA6B4yB,CAA7B,CAAkC,CAAlC,CAFU,CArFgB,IACxCH,EAAW5C,CAAApT,MAAA,EAD6B,CAExCgV,EAAUgB,CAAAhB,QAF8B,CAGxCtb,CAHwC,CAIxC2c,CAJwC,CAKxC7Y,EAAM8Y,CAAA,CAASxqB,CAAA0R,IAAT;AAAqB1R,CAAAyqB,OAArB,CAEV9S,EAAA2S,gBAAAn2B,KAAA,CAA2B6L,CAA3B,CACAkpB,EAAAD,KAAA,CAAamB,CAAb,CAA+BA,CAA/B,CAGA,EAAKpqB,CAAA4N,MAAL,EAAqBkZ,CAAAlZ,MAArB,IAAyD,CAAA,CAAzD,GAAwC5N,CAAA4N,MAAxC,EAAmF,KAAnF,EAAkE5N,CAAAL,OAAlE,IACEiO,CADF,CACUvX,CAAA,CAAS2J,CAAA4N,MAAT,CAAA,CAAyB5N,CAAA4N,MAAzB,CACAvX,CAAA,CAASywB,CAAAlZ,MAAT,CAAA,CAA2BkZ,CAAAlZ,MAA3B,CACA8c,CAHV,CAMA,IAAI9c,CAAJ,CAEE,GADA2c,CACI,CADS3c,CAAAP,IAAA,CAAUqE,CAAV,CACT,CAAAtb,CAAA,CAAUm0B,CAAV,CAAJ,CAA2B,CACzB,GAAIA,CAAAtB,KAAJ,CAGE,MADAsB,EAAAtB,KAAA,CAAgBmB,CAAhB,CAAkCA,CAAlC,CACOG,CAAAA,CAGH92B,EAAA,CAAQ82B,CAAR,CAAJ,CACEP,CAAA,CAAeO,CAAA,CAAW,CAAX,CAAf,CAA8BA,CAAA,CAAW,CAAX,CAA9B,CAA6C7yB,EAAA,CAAK6yB,CAAA,CAAW,CAAX,CAAL,CAA7C,CAAkEA,CAAA,CAAW,CAAX,CAAlE,CADF,CAGEP,CAAA,CAAeO,CAAf,CAA2B,GAA3B,CAAgC,EAAhC,CAAoC,IAApC,CAVqB,CAA3B,IAeE3c,EAAAhC,IAAA,CAAU8F,CAAV,CAAewX,CAAf,CAKA/yB,EAAA,CAAYo0B,CAAZ,CAAJ,EACEnD,CAAA,CAAapnB,CAAAL,OAAb,CAA4B+R,CAA5B,CAAiCoX,CAAjC,CAA0Ce,CAA1C,CAAgD1B,CAAhD,CAA4DnoB,CAAA2qB,QAA5D,CACI3qB,CAAA+oB,gBADJ,CAC4B/oB,CAAA4qB,aAD5B,CAIF,OAAO1B,EA5CqC,CA4F9CsB,QAASA,EAAQ,CAAC9Y,CAAD,CAAM+Y,CAAN,CAAc,CACzB,GAAI,CAACA,CAAL,CAAa,MAAO/Y,EACpB,KAAInW,EAAQ,EACZlH,GAAA,CAAco2B,CAAd,CAAsB,QAAQ,CAACh2B,CAAD,CAAQZ,CAAR,CAAa,CAC3B,IAAd,GAAIY,CAAJ,EAAsB0B,CAAA,CAAY1B,CAAZ,CAAtB,GACKhB,CAAA,CAAQgB,CAAR,CAEL,GAFqBA,CAErB,CAF6B,CAACA,CAAD,CAE7B,EAAAf,CAAA,CAAQe,CAAR,CAAe,QAAQ,CAACyF,CAAD,CAAI,CACrB7D,CAAA,CAAS6D,CAAT,CAAJ,GACEA,CADF,CACMR,EAAA,CAAOQ,CAAP,CADN,CAGAqB,EAAApH,KAAA,CAAWsH,EAAA,CAAe5H,CAAf,CAAX,CAAiC,GAAjC,CACW4H,EAAA,CAAevB,CAAf,CADX,CAJyB,CAA3B,CAHA,CADyC,CAA3C,CAYkB,EAAlB,CAAGqB,CAAAjI,OAAH;CACEoe,CADF,GACgC,EAAtB,EAACA,CAAApa,QAAA,CAAY,GAAZ,CAAD,CAA2B,GAA3B,CAAiC,GAD3C,EACkDiE,CAAAxG,KAAA,CAAW,GAAX,CADlD,CAGA,OAAO2c,EAlBkB,CA52B/B,IAAIgZ,EAAerU,CAAA,CAAc,OAAd,CAAnB,CAOI+S,EAAuB,EAE3B11B,EAAA,CAAQszB,CAAR,CAA8B,QAAQ,CAAC6D,CAAD,CAAqB,CACzDzB,CAAAl0B,QAAA,CAA6B1B,CAAA,CAASq3B,CAAT,CACA,CAAvBnc,CAAArB,IAAA,CAAcwd,CAAd,CAAuB,CAAanc,CAAA1R,OAAA,CAAiB6tB,CAAjB,CAD1C,CADyD,CAA3D,CAKAn3B,EAAA,CAAQwzB,CAAR,CAAsC,QAAQ,CAAC2D,CAAD,CAAqBl2B,CAArB,CAA4B,CACxE,IAAIm2B,EAAat3B,CAAA,CAASq3B,CAAT,CACA,CAAXnc,CAAArB,IAAA,CAAcwd,CAAd,CAAW,CACXnc,CAAA1R,OAAA,CAAiB6tB,CAAjB,CAONzB,EAAA3xB,OAAA,CAA4B9C,CAA5B,CAAmC,CAAnC,CAAsC,UAC1B2tB,QAAQ,CAACA,CAAD,CAAW,CAC3B,MAAOwI,EAAA,CAAWxD,CAAA6B,KAAA,CAAQ7G,CAAR,CAAX,CADoB,CADO,eAIrBkH,QAAQ,CAAClH,CAAD,CAAW,CAChC,MAAOwI,EAAA,CAAWxD,CAAAK,OAAA,CAAUrF,CAAV,CAAX,CADyB,CAJE,CAAtC,CAVwE,CAA1E,CAooBA3K,EAAA2S,gBAAA,CAAwB,EA+FxBS,UAA2B,CAAC7uB,CAAD,CAAQ,CACjCxI,CAAA,CAAQ8B,SAAR,CAAmB,QAAQ,CAAC4G,CAAD,CAAO,CAChCub,CAAA,CAAMvb,CAAN,CAAA,CAAc,QAAQ,CAACsV,CAAD,CAAM1R,CAAN,CAAc,CAClC,MAAO2X,EAAA,CAAMriB,CAAA,CAAO0K,CAAP,EAAiB,EAAjB,CAAqB,QACxB5D,CADwB,KAE3BsV,CAF2B,CAArB,CAAN,CAD2B,CADJ,CAAlC,CADiC,CAAnCqZ,CA7CA,CAAmB,KAAnB,CAA0B,QAA1B,CAAoC,MAApC,CAA4C,OAA5C,CAyDAC,UAAmC,CAAC5uB,CAAD,CAAO,CACxC1I,CAAA,CAAQ8B,SAAR,CAAmB,QAAQ,CAAC4G,CAAD,CAAO,CAChCub,CAAA,CAAMvb,CAAN,CAAA,CAAc,QAAQ,CAACsV,CAAD,CAAMrU,CAAN,CAAY2C,CAAZ,CAAoB,CACxC,MAAO2X,EAAA,CAAMriB,CAAA,CAAO0K,CAAP;AAAiB,EAAjB,CAAqB,QACxB5D,CADwB,KAE3BsV,CAF2B,MAG1BrU,CAH0B,CAArB,CAAN,CADiC,CADV,CAAlC,CADwC,CAA1C2tB,CA9BA,CAA2B,MAA3B,CAAmC,KAAnC,CAYArT,EAAAmP,SAAA,CAAiBA,CAGjB,OAAOnP,EAhvBsE,CADnE,CAjDW,CAy7BzBsT,QAASA,GAAS,CAACtrB,CAAD,CAAS,CAIvB,GAAY,CAAZ,EAAI4L,CAAJ,GAAkB,CAAC5L,CAAA7E,MAAA,CAAa,uCAAb,CAAnB,EACE,CAAC/H,CAAAm4B,eADH,EAEE,MAAO,KAAIn4B,CAAAo4B,cAAJ,CAAyB,mBAAzB,CACF,IAAIp4B,CAAAm4B,eAAJ,CACL,MAAO,KAAIn4B,CAAAm4B,eAGb,MAAMh4B,EAAA,CAAO,cAAP,CAAA,CAAuB,OAAvB,CAAN,CAXuB,CA8B3B2Q,QAASA,GAAoB,EAAG,CAC9B,IAAAiJ,KAAA,CAAY,CAAC,UAAD,CAAa,SAAb,CAAwB,WAAxB,CAAqC,QAAQ,CAACua,CAAD,CAAW7X,CAAX,CAAoBiF,CAApB,CAA+B,CACtF,MAAO2W,GAAA,CAAkB/D,CAAlB,CAA4B4D,EAA5B,CAAuC5D,CAAAnT,MAAvC,CAAuD1E,CAAAhS,QAAA6tB,UAAvD,CAAkF5W,CAAA,CAAU,CAAV,CAAlF,CAD+E,CAA5E,CADkB,CAMhC2W,QAASA,GAAiB,CAAC/D,CAAD,CAAW4D,CAAX,CAAsBK,CAAtB,CAAqCD,CAArC,CAAgDxZ,CAAhD,CAA6D,CA4HrF0Z,QAASA,EAAQ,CAAC7Z,CAAD,CAAMmY,CAAN,CAAY,CAAA,IAIvB2B,EAAS3Z,CAAA/K,cAAA,CAA0B,QAA1B,CAJc,CAKvB2kB,EAAcA,QAAQ,EAAG,CACvBD,CAAAE,mBAAA;AAA4BF,CAAAG,OAA5B,CAA4CH,CAAAI,QAA5C,CAA6D,IAC7D/Z,EAAAga,KAAAxkB,YAAA,CAA6BmkB,CAA7B,CACI3B,EAAJ,EAAUA,CAAA,EAHa,CAM7B2B,EAAArjB,KAAA,CAAc,iBACdqjB,EAAApzB,IAAA,CAAasZ,CAETnG,EAAJ,EAAoB,CAApB,EAAYA,CAAZ,CACEigB,CAAAE,mBADF,CAC8BI,QAAQ,EAAG,CACjC,iBAAAvuB,KAAA,CAAuBiuB,CAAAO,WAAvB,CAAJ,EACEN,CAAA,EAFmC,CADzC,CAOED,CAAAG,OAPF,CAOkBH,CAAAI,QAPlB,CAOmCI,QAAQ,EAAG,CAC1CP,CAAA,EAD0C,CAK9C5Z,EAAAga,KAAAhlB,YAAA,CAA6B2kB,CAA7B,CACA,OAAOC,EA3BoB,CA3H7B,IAAIQ,EAAW,EAGf,OAAO,SAAQ,CAACtsB,CAAD,CAAS+R,CAAT,CAAcoL,CAAd,CAAoBvK,CAApB,CAA8BiQ,CAA9B,CAAuCmI,CAAvC,CAAgD5B,CAAhD,CAAiE6B,CAAjE,CAA+E,CA6F5FsB,QAASA,EAAc,EAAG,CACxBxE,CAAA,CAASuE,CACTE,EAAA,EAAaA,CAAA,EACbC,EAAA,EAAOA,CAAAC,MAAA,EAHiB,CAM1BC,QAASA,EAAe,CAAC/Z,CAAD,CAAWmV,CAAX,CAAmBpF,CAAnB,CAA6BwH,CAA7B,CAA4CC,CAA5C,CAAwD,CAE9E1V,CAAA,EAAaiX,CAAAhX,OAAA,CAAqBD,CAArB,CACb8X,EAAA,CAAYC,CAAZ,CAAkB,IAKH,EAAf,GAAI1E,CAAJ,GACEA,CADF,CACWpF,CAAA,CAAW,GAAX,CAA6C,MAA5B,EAAAiK,EAAA,CAAW7a,CAAX,CAAA8a,SAAA,CAAqC,GAArC,CAA2C,CADvE,CAQAja,EAAA,CAHoB,IAAXmV,GAAAA,CAAAA,CAAkB,GAAlBA,CAAwBA,CAGjC,CAAiBpF,CAAjB,CAA2BwH,CAA3B,CAFaC,CAEb,EAF2B,EAE3B,CACA1C,EAAAnV,6BAAA,CAAsCnc,CAAtC,CAjB8E,CAlGhF,IAAI2xB,CACJL,EAAAlV,6BAAA,EACAT;CAAA,CAAMA,CAAN,EAAa2V,CAAA3V,IAAA,EAEb,IAAyB,OAAzB,EAAIvX,CAAA,CAAUwF,CAAV,CAAJ,CAAkC,CAChC,IAAI8sB,EAAa,GAAbA,CAAoBj2B,CAAA60B,CAAAqB,QAAA,EAAAl2B,UAAA,CAA8B,EAA9B,CACxB60B,EAAA,CAAUoB,CAAV,CAAA,CAAwB,QAAQ,CAACpvB,CAAD,CAAO,CACrCguB,CAAA,CAAUoB,CAAV,CAAApvB,KAAA,CAA6BA,CADQ,CAIvC,KAAI8uB,EAAYZ,CAAA,CAAS7Z,CAAA3W,QAAA,CAAY,eAAZ,CAA6B,oBAA7B,CAAoD0xB,CAApD,CAAT,CACZ,QAAQ,EAAG,CACTpB,CAAA,CAAUoB,CAAV,CAAApvB,KAAJ,CACEivB,CAAA,CAAgB/Z,CAAhB,CAA0B,GAA1B,CAA+B8Y,CAAA,CAAUoB,CAAV,CAAApvB,KAA/B,CADF,CAGEivB,CAAA,CAAgB/Z,CAAhB,CAA0BmV,CAA1B,EAAqC,EAArC,CAEF2D,EAAA,CAAUoB,CAAV,CAAA,CAAwBjvB,EAAAzH,KANX,CADC,CANgB,CAAlC,IAeO,CAEL,IAAIq2B,EAAMnB,CAAA,CAAUtrB,CAAV,CAEVysB,EAAAO,KAAA,CAAShtB,CAAT,CAAiB+R,CAAjB,CAAsB,CAAA,CAAtB,CACAhe,EAAA,CAAQ8uB,CAAR,CAAiB,QAAQ,CAAC/tB,CAAD,CAAQZ,CAAR,CAAa,CAChCuC,CAAA,CAAU3B,CAAV,CAAJ,EACI23B,CAAAQ,iBAAA,CAAqB/4B,CAArB,CAA0BY,CAA1B,CAFgC,CAAtC,CASA23B,EAAAV,mBAAA,CAAyBmB,QAAQ,EAAG,CAQlC,GAAIT,CAAJ,EAA6B,CAA7B,EAAWA,CAAAL,WAAX,CAAgC,CAAA,IAC1Be,EAAkB,IADQ,CAE1BxK,EAAW,IAEZoF,EAAH,GAAcuE,CAAd,GACEa,CAIA,CAJkBV,CAAAW,sBAAA,EAIlB,CAAAzK,CAAA,CAAY,UAAD,EAAe8J,EAAf,CAAsBA,CAAA9J,SAAtB,CAAqC8J,CAAAY,aALlD,CAQAV,EAAA,CAAgB/Z,CAAhB,CACImV,CADJ,EACc0E,CAAA1E,OADd,CAEIpF,CAFJ,CAGIwK,CAHJ,CAIIV,CAAArC,WAJJ,EAIsB,EAJtB,CAZ8B,CARE,CA4BhChB,EAAJ,GACEqD,CAAArD,gBADF;AACwB,CAAA,CADxB,CAIA,IAAI6B,CAAJ,CACE,GAAI,CACFwB,CAAAxB,aAAA,CAAmBA,CADjB,CAEF,MAAOnwB,CAAP,CAAU,CAQV,GAAqB,MAArB,GAAImwB,CAAJ,CACE,KAAMnwB,EAAN,CATQ,CAcd2xB,CAAAa,KAAA,CAASnQ,CAAT,EAAiB,IAAjB,CA/DK,CAkEP,GAAc,CAAd,CAAI6N,CAAJ,CACE,IAAItW,EAAYiX,CAAA,CAAcY,CAAd,CAA8BvB,CAA9B,CADlB,KAEWA,EAAJ,EAAeA,CAAA1B,KAAf,EACL0B,CAAA1B,KAAA,CAAaiD,CAAb,CAzF0F,CAJT,CAiMvFxoB,QAASA,GAAoB,EAAG,CAC9B,IAAI0hB,EAAc,IAAlB,CACIC,EAAY,IAWhB,KAAAD,YAAA,CAAmB8H,QAAQ,CAACz4B,CAAD,CAAO,CAChC,MAAIA,EAAJ,EACE2wB,CACO,CADO3wB,CACP,CAAA,IAFT,EAIS2wB,CALuB,CAkBlC,KAAAC,UAAA,CAAiB8H,QAAQ,CAAC14B,CAAD,CAAO,CAC9B,MAAIA,EAAJ,EACE4wB,CACO,CADK5wB,CACL,CAAA,IAFT,EAIS4wB,CALqB,CAUhC,KAAAvY,KAAA,CAAY,CAAC,QAAD,CAAW,mBAAX,CAAgC,MAAhC,CAAwC,QAAQ,CAAC+K,CAAD,CAASd,CAAT,CAA4BgB,CAA5B,CAAkC,CA0C5FL,QAASA,EAAY,CAACqL,CAAD,CAAOqK,CAAP,CAA2BC,CAA3B,CAA2C,CAW9D,IAX8D,IAC1Dh0B,CAD0D,CAE1Di0B,CAF0D,CAG1D34B,EAAQ,CAHkD,CAI1D4G,EAAQ,EAJkD,CAK1DjI,EAASyvB,CAAAzvB,OALiD,CAM1Di6B,EAAmB,CAAA,CANuC,CAS1Dh0B,EAAS,EAEb,CAAM5E,CAAN,CAAcrB,CAAd,CAAA,CAC4D,EAA1D,GAAO+F,CAAP,CAAoB0pB,CAAAzrB,QAAA,CAAa8tB,CAAb,CAA0BzwB,CAA1B,CAApB,GAC+E,EAD/E,GACO24B,CADP,CACkBvK,CAAAzrB,QAAA,CAAa+tB,CAAb,CAAwBhsB,CAAxB,CAAqCm0B,CAArC,CADlB,GAEG74B,CAID,EAJU0E,CAIV,EAJyBkC,CAAApH,KAAA,CAAW4uB,CAAA9O,UAAA,CAAetf,CAAf,CAAsB0E,CAAtB,CAAX,CAIzB,CAHAkC,CAAApH,KAAA,CAAW+E,CAAX,CAAgB2e,CAAA,CAAO4V,CAAP,CAAa1K,CAAA9O,UAAA,CAAe5a,CAAf,CAA4Bm0B,CAA5B,CAA+CF,CAA/C,CAAb,CAAhB,CAGA;AAFAp0B,CAAAu0B,IAEA,CAFSA,CAET,CADA94B,CACA,CADQ24B,CACR,CADmBI,CACnB,CAAAH,CAAA,CAAmB,CAAA,CANrB,GASG54B,CACD,EADUrB,CACV,EADqBiI,CAAApH,KAAA,CAAW4uB,CAAA9O,UAAA,CAAetf,CAAf,CAAX,CACrB,CAAAA,CAAA,CAAQrB,CAVV,CAcF,EAAMA,CAAN,CAAeiI,CAAAjI,OAAf,IAEEiI,CAAApH,KAAA,CAAW,EAAX,CACA,CAAAb,CAAA,CAAS,CAHX,CAYA,IAAI+5B,CAAJ,EAAqC,CAArC,CAAsB9xB,CAAAjI,OAAtB,CACI,KAAMq6B,GAAA,CAAmB,UAAnB,CAGsD5K,CAHtD,CAAN,CAMJ,GAAI,CAACqK,CAAL,EAA4BG,CAA5B,CA8BE,MA7BAh0B,EAAAjG,OA6BO4F,CA7BS5F,CA6BT4F,CA5BPA,CA4BOA,CA5BFA,QAAQ,CAACtF,CAAD,CAAU,CACrB,GAAI,CACF,IADE,IACMU,EAAI,CADV,CACa0V,EAAK1W,CADlB,CAC0Bs6B,CAA5B,CAAkCt5B,CAAlC,CAAoC0V,CAApC,CAAwC1V,CAAA,EAAxC,CACkC,UAahC,EAbI,OAAQs5B,CAAR,CAAeryB,CAAA,CAAMjH,CAAN,CAAf,CAaJ,GAZEs5B,CAMA,CANOA,CAAA,CAAKh6B,CAAL,CAMP,CAJEg6B,CAIF,CALIP,CAAJ,CACStV,CAAA8V,WAAA,CAAgBR,CAAhB,CAAgCO,CAAhC,CADT,CAGS7V,CAAA+V,QAAA,CAAaF,CAAb,CAET,CAAa,IAAb,GAAIA,CAAJ,EAAqBz3B,CAAA,CAAYy3B,CAAZ,CAArB,CACEA,CADF,CACS,EADT,CAE0B,QAF1B,EAEW,MAAOA,EAFlB,GAGEA,CAHF,CAGSl0B,EAAA,CAAOk0B,CAAP,CAHT,CAMF,EAAAr0B,CAAA,CAAOjF,CAAP,CAAA,CAAYs5B,CAEd,OAAOr0B,EAAAxE,KAAA,CAAY,EAAZ,CAjBL,CAmBJ,MAAMiZ,CAAN,CAAW,CACL+f,CAEJ,CAFaJ,EAAA,CAAmB,QAAnB,CAA4D5K,CAA5D,CACT/U,CAAAxX,SAAA,EADS,CAEb,CAAAugB,CAAA,CAAkBgX,CAAlB,CAHS,CApBU,CA4BhB70B,CAFPA,CAAAu0B,IAEOv0B,CAFE6pB,CAEF7pB,CADPA,CAAAqC,MACOrC,CADIqC,CACJrC,CAAAA,CA3EqD,CA1C4B,IACxFs0B,EAAoBpI,CAAA9xB,OADoE,CAExFo6B,EAAkBrI,CAAA/xB,OAmItBokB,EAAA0N,YAAA,CAA2B4I,QAAQ,EAAG,CACpC,MAAO5I,EAD6B,CAgBtC1N,EAAA2N,UAAA,CAAyB4I,QAAQ,EAAG,CAClC,MAAO5I,EAD2B,CAIpC;MAAO3N,EAzJqF,CAAlF,CAzCkB,CAsMhC/T,QAASA,GAAiB,EAAG,CAC3B,IAAAmJ,KAAA,CAAY,CAAC,YAAD,CAAe,SAAf,CAA0B,IAA1B,CACP,QAAQ,CAAC4C,CAAD,CAAeF,CAAf,CAA0B8X,CAA1B,CAA8B,CA+HzCrW,QAASA,EAAQ,CAAC/X,CAAD,CAAKkb,CAAL,CAAY8Z,CAAZ,CAAmBC,CAAnB,CAAgC,CAAA,IAC3Cv3B,EAAc4Y,CAAA5Y,YAD6B,CAE3Cw3B,EAAgB5e,CAAA4e,cAF2B,CAG3ClE,EAAW5C,CAAApT,MAAA,EAHgC,CAI3CgV,EAAUgB,CAAAhB,QAJiC,CAK3CmF,EAAY,CAL+B,CAM3CC,EAAal4B,CAAA,CAAU+3B,CAAV,CAAbG,EAAuC,CAACH,CAE5CD,EAAA,CAAQ93B,CAAA,CAAU83B,CAAV,CAAA,CAAmBA,CAAnB,CAA2B,CAEnChF,EAAAD,KAAA,CAAa,IAAb,CAAmB,IAAnB,CAAyB/vB,CAAzB,CAEAgwB,EAAAqF,aAAA,CAAuB33B,CAAA,CAAY43B,QAAa,EAAG,CACjDtE,CAAAuE,OAAA,CAAgBJ,CAAA,EAAhB,CAEY,EAAZ,CAAIH,CAAJ,EAAiBG,CAAjB,EAA8BH,CAA9B,GACEhE,CAAAC,QAAA,CAAiBkE,CAAjB,CAEA,CADAD,CAAA,CAAclF,CAAAqF,aAAd,CACA,CAAA,OAAOG,CAAA,CAAUxF,CAAAqF,aAAV,CAHT,CAMKD,EAAL,EAAgB5e,CAAAtS,OAAA,EATiC,CAA5B,CAWpBgX,CAXoB,CAavBsa,EAAA,CAAUxF,CAAAqF,aAAV,CAAA,CAAkCrE,CAElC,OAAOhB,EA3BwC,CA9HjD,IAAIwF,EAAY,EAuKhBzd,EAAAqD,OAAA,CAAkBqa,QAAQ,CAACzF,CAAD,CAAU,CAClC,MAAIA,EAAJ,EAAeA,CAAAqF,aAAf,GAAuCG,EAAvC,EACEA,CAAA,CAAUxF,CAAAqF,aAAV,CAAA5G,OAAA,CAAuC,UAAvC,CAGO,CAFPyG,aAAA,CAAclF,CAAAqF,aAAd,CAEO,CADP,OAAOG,CAAA,CAAUxF,CAAAqF,aAAV,CACA;AAAA,CAAA,CAJT,EAMO,CAAA,CAP2B,CAUpC,OAAOtd,EAlLkC,CAD/B,CADe,CAkM7B1Q,QAASA,GAAe,EAAE,CACxB,IAAAuM,KAAA,CAAY4H,QAAQ,EAAG,CACrB,MAAO,IACD,OADC,gBAGW,aACD,GADC,WAEH,GAFG,UAGJ,CACR,QACU,CADV,SAEW,CAFX,SAGW,CAHX,QAIU,EAJV,QAKU,EALV,QAMU,GANV,QAOU,EAPV,OAQS,CART,QASU,CATV,CADQ,CAWN,QACQ,CADR,SAES,CAFT,SAGS,CAHT,QAIQ,QAJR,QAKQ,EALR,QAMQ,SANR,QAOQ,GAPR,OAQO,CARP,QASQ,CATR,CAXM,CAHI,cA0BA,GA1BA,CAHX,kBAgCa,OAEZ,uFAAA,MAAA,CAAA,GAAA,CAFY,YAIH,iDAAA,MAAA,CAAA,GAAA,CAJG;IAKX,0DAAA,MAAA,CAAA,GAAA,CALW,UAMN,6BAAA,MAAA,CAAA,GAAA,CANM,OAOT,CAAC,IAAD,CAAM,IAAN,CAPS,QAQR,oBARQ,CAShBka,OATgB,CAST,eATS,UAUN,iBAVM,UAWN,WAXM,YAYJ,UAZI,WAaL,QAbK,YAcJ,WAdI,WAeL,QAfK,CAhCb,WAkDMC,QAAQ,CAACC,CAAD,CAAM,CACvB,MAAY,EAAZ,GAAIA,CAAJ,CACS,KADT,CAGO,OAJgB,CAlDpB,CADc,CADC,CAyE1BC,QAASA,GAAU,CAACrwB,CAAD,CAAO,CACpBswB,CAAAA,CAAWtwB,CAAArD,MAAA,CAAW,GAAX,CAGf,KAHA,IACI/G,EAAI06B,CAAA17B,OAER,CAAOgB,CAAA,EAAP,CAAA,CACE06B,CAAA,CAAS16B,CAAT,CAAA,CAAcoH,EAAA,CAAiBszB,CAAA,CAAS16B,CAAT,CAAjB,CAGhB,OAAO06B,EAAAj6B,KAAA,CAAc,GAAd,CARiB,CAW1Bk6B,QAASA,GAAgB,CAACC,CAAD,CAAcC,CAAd,CAA2BC,CAA3B,CAAoC,CACvDC,CAAAA,CAAY9C,EAAA,CAAW2C,CAAX,CAAwBE,CAAxB,CAEhBD,EAAAG,WAAA;AAAyBD,CAAA7C,SACzB2C,EAAAI,OAAA,CAAqBF,CAAAG,SACrBL,EAAAM,OAAA,CAAqBh6B,CAAA,CAAI45B,CAAAK,KAAJ,CAArB,EAA4CC,EAAA,CAAcN,CAAA7C,SAAd,CAA5C,EAAiF,IALtB,CAS7DoD,QAASA,GAAW,CAACC,CAAD,CAAcV,CAAd,CAA2BC,CAA3B,CAAoC,CACtD,IAAIU,EAAsC,GAAtCA,GAAYD,CAAAx3B,OAAA,CAAmB,CAAnB,CACZy3B,EAAJ,GACED,CADF,CACgB,GADhB,CACsBA,CADtB,CAGI/0B,EAAAA,CAAQyxB,EAAA,CAAWsD,CAAX,CAAwBT,CAAxB,CACZD,EAAAY,OAAA,CAAqB90B,kBAAA,CAAmB60B,CAAA,EAAyC,GAAzC,GAAYh1B,CAAAk1B,SAAA33B,OAAA,CAAsB,CAAtB,CAAZ,CACpCyC,CAAAk1B,SAAA/b,UAAA,CAAyB,CAAzB,CADoC,CACNnZ,CAAAk1B,SADb,CAErBb,EAAAc,SAAA,CAAuB/0B,EAAA,CAAcJ,CAAAo1B,OAAd,CACvBf,EAAAgB,OAAA,CAAqBl1B,kBAAA,CAAmBH,CAAAgV,KAAnB,CAGjBqf,EAAAY,OAAJ,EAA0D,GAA1D,EAA0BZ,CAAAY,OAAA13B,OAAA,CAA0B,CAA1B,CAA1B,GACE82B,CAAAY,OADF,CACuB,GADvB,CAC6BZ,CAAAY,OAD7B,CAZsD,CAyBxDK,QAASA,GAAU,CAACC,CAAD,CAAQC,CAAR,CAAe,CAChC,GAA6B,CAA7B,GAAIA,CAAAh5B,QAAA,CAAc+4B,CAAd,CAAJ,CACE,MAAOC,EAAA7U,OAAA,CAAa4U,CAAA/8B,OAAb,CAFuB,CAOlCi9B,QAASA,GAAS,CAAC7e,CAAD,CAAM,CACtB,IAAI/c,EAAQ+c,CAAApa,QAAA,CAAY,GAAZ,CACZ,OAAiB,EAAV,EAAA3C,CAAA,CAAc+c,CAAd,CAAoBA,CAAA+J,OAAA,CAAW,CAAX,CAAc9mB,CAAd,CAFL,CAMxB67B,QAASA,GAAS,CAAC9e,CAAD,CAAM,CACtB,MAAOA,EAAA+J,OAAA,CAAW,CAAX;AAAc8U,EAAA,CAAU7e,CAAV,CAAA+e,YAAA,CAA2B,GAA3B,CAAd,CAAgD,CAAhD,CADe,CAkBxBC,QAASA,GAAgB,CAACtB,CAAD,CAAUuB,CAAV,CAAsB,CAC7C,IAAAC,QAAA,CAAe,CAAA,CACfD,EAAA,CAAaA,CAAb,EAA2B,EAC3B,KAAIE,EAAgBL,EAAA,CAAUpB,CAAV,CACpBH,GAAA,CAAiBG,CAAjB,CAA0B,IAA1B,CAAgCA,CAAhC,CAQA,KAAA0B,QAAA,CAAeC,QAAQ,CAACrf,CAAD,CAAM,CAC3B,IAAIsf,EAAUZ,EAAA,CAAWS,CAAX,CAA0Bnf,CAA1B,CACd,IAAI,CAACle,CAAA,CAASw9B,CAAT,CAAL,CACE,KAAMC,GAAA,CAAgB,UAAhB,CAA6Evf,CAA7E,CACFmf,CADE,CAAN,CAIFjB,EAAA,CAAYoB,CAAZ,CAAqB,IAArB,CAA2B5B,CAA3B,CAEK,KAAAW,OAAL,GACE,IAAAA,OADF,CACgB,GADhB,CAIA,KAAAmB,UAAA,EAb2B,CAoB7B,KAAAA,UAAA,CAAiBC,QAAQ,EAAG,CAAA,IACtBjB,EAAS50B,EAAA,CAAW,IAAA20B,SAAX,CADa,CAEtBngB,EAAO,IAAAqgB,OAAA,CAAc,GAAd,CAAoBz0B,EAAA,CAAiB,IAAAy0B,OAAjB,CAApB,CAAoD,EAE/D,KAAAiB,MAAA,CAAarC,EAAA,CAAW,IAAAgB,OAAX,CAAb,EAAwCG,CAAA,CAAS,GAAT,CAAeA,CAAf,CAAwB,EAAhE,EAAsEpgB,CACtE,KAAAuhB,SAAA,CAAgBR,CAAhB,CAAgC,IAAAO,MAAA3V,OAAA,CAAkB,CAAlB,CALN,CAQ5B,KAAA6V,UAAA,CAAiBC,QAAQ,CAAC7f,CAAD,CAAM,CAAA,IACzB8f,CAEJ,KAAMA,CAAN,CAAepB,EAAA,CAAWhB,CAAX,CAAoB1d,CAApB,CAAf,IAA6Cze,CAA7C,CAEE,MADAw+B,EACA,CADaD,CACb,CAAA,CAAMA,CAAN,CAAepB,EAAA,CAAWO,CAAX,CAAuBa,CAAvB,CAAf,IAAmDv+B,CAAnD,CACS49B,CADT,EAC0BT,EAAA,CAAW,GAAX,CAAgBoB,CAAhB,CAD1B,EACqDA,CADrD,EAGSpC,CAHT,CAGmBqC,CAEd,KAAMD,CAAN,CAAepB,EAAA,CAAWS,CAAX;AAA0Bnf,CAA1B,CAAf,IAAmDze,CAAnD,CACL,MAAO49B,EAAP,CAAuBW,CAClB,IAAIX,CAAJ,EAAqBnf,CAArB,CAA2B,GAA3B,CACL,MAAOmf,EAboB,CAxCc,CAoE/Ca,QAASA,GAAmB,CAACtC,CAAD,CAAUuC,CAAV,CAAsB,CAChD,IAAId,EAAgBL,EAAA,CAAUpB,CAAV,CAEpBH,GAAA,CAAiBG,CAAjB,CAA0B,IAA1B,CAAgCA,CAAhC,CAQA,KAAA0B,QAAA,CAAeC,QAAQ,CAACrf,CAAD,CAAM,CAC3B,IAAIkgB,EAAiBxB,EAAA,CAAWhB,CAAX,CAAoB1d,CAApB,CAAjBkgB,EAA6CxB,EAAA,CAAWS,CAAX,CAA0Bnf,CAA1B,CAAjD,CACImgB,EAA6C,GAC5B,EADAD,CAAAv5B,OAAA,CAAsB,CAAtB,CACA,CAAf+3B,EAAA,CAAWuB,CAAX,CAAuBC,CAAvB,CAAe,CACd,IAAAhB,QACD,CAAEgB,CAAF,CACE,EAER,IAAI,CAACp+B,CAAA,CAASq+B,CAAT,CAAL,CACE,KAAMZ,GAAA,CAAgB,UAAhB,CAA6Evf,CAA7E,CACFigB,CADE,CAAN,CAGF/B,EAAA,CAAYiC,CAAZ,CAA4B,IAA5B,CAAkCzC,CAAlC,CAEqCW,EAAAA,CAAAA,IAAAA,OAoBnC,KAAI+B,EAAqB,gBAKC,EAA1B,GAAIpgB,CAAApa,QAAA,CAzB4D83B,CAyB5D,CAAJ,GACE1d,CADF,CACQA,CAAA3W,QAAA,CA1BwDq0B,CA0BxD,CAAkB,EAAlB,CADR,CAQI0C,EAAAv1B,KAAA,CAAwBmV,CAAxB,CAAJ,GAKA,CALA,CAKO,CADPqgB,CACO,CADiBD,CAAAv1B,KAAA,CAAwBmC,CAAxB,CACjB,EAAwBqzB,CAAA,CAAsB,CAAtB,CAAxB,CAAmDrzB,CAL1D,CAjCF,KAAAqxB,OAAA,CAAc,CAEd,KAAAmB,UAAA,EAhB2B,CA4D7B,KAAAA,UAAA,CAAiBC,QAAQ,EAAG,CAAA,IACtBjB,EAAS50B,EAAA,CAAW,IAAA20B,SAAX,CADa,CAEtBngB,EAAO,IAAAqgB,OAAA,CAAc,GAAd,CAAoBz0B,EAAA,CAAiB,IAAAy0B,OAAjB,CAApB,CAAoD,EAE/D,KAAAiB,MAAA,CAAarC,EAAA,CAAW,IAAAgB,OAAX,CAAb,EAAwCG,CAAA,CAAS,GAAT,CAAeA,CAAf,CAAwB,EAAhE,EAAsEpgB,CACtE,KAAAuhB,SAAA;AAAgBjC,CAAhB,EAA2B,IAAAgC,MAAA,CAAaO,CAAb,CAA0B,IAAAP,MAA1B,CAAuC,EAAlE,CAL0B,CAQ5B,KAAAE,UAAA,CAAiBC,QAAQ,CAAC7f,CAAD,CAAM,CAC7B,GAAG6e,EAAA,CAAUnB,CAAV,CAAH,EAAyBmB,EAAA,CAAU7e,CAAV,CAAzB,CACE,MAAOA,EAFoB,CA/EiB,CAgGlDsgB,QAASA,GAA0B,CAAC5C,CAAD,CAAUuC,CAAV,CAAsB,CACvD,IAAAf,QAAA,CAAe,CAAA,CACfc,GAAAp4B,MAAA,CAA0B,IAA1B,CAAgC9D,SAAhC,CAEA,KAAIq7B,EAAgBL,EAAA,CAAUpB,CAAV,CAEpB,KAAAkC,UAAA,CAAiBC,QAAQ,CAAC7f,CAAD,CAAM,CAC7B,IAAI8f,CAEJ,IAAKpC,CAAL,EAAgBmB,EAAA,CAAU7e,CAAV,CAAhB,CACE,MAAOA,EACF,IAAM8f,CAAN,CAAepB,EAAA,CAAWS,CAAX,CAA0Bnf,CAA1B,CAAf,CACL,MAAO0d,EAAP,CAAiBuC,CAAjB,CAA8BH,CACzB,IAAKX,CAAL,GAAuBnf,CAAvB,CAA6B,GAA7B,CACL,MAAOmf,EARoB,CANwB,CAsNzDoB,QAASA,GAAc,CAACC,CAAD,CAAW,CAChC,MAAO,SAAQ,EAAG,CAChB,MAAO,KAAA,CAAKA,CAAL,CADS,CADc,CAOlCC,QAASA,GAAoB,CAACD,CAAD,CAAWE,CAAX,CAAuB,CAClD,MAAO,SAAQ,CAAC39B,CAAD,CAAQ,CACrB,GAAI0B,CAAA,CAAY1B,CAAZ,CAAJ,CACE,MAAO,KAAA,CAAKy9B,CAAL,CAET,KAAA,CAAKA,CAAL,CAAA,CAAiBE,CAAA,CAAW39B,CAAX,CACjB,KAAAy8B,UAAA,EAEA,OAAO,KAPc,CAD2B,CA6CpDptB,QAASA,GAAiB,EAAE,CAAA,IACtB6tB,EAAa,EADS,CAEtBU,EAAY,CAAA,CAShB,KAAAV,WAAA,CAAkBW,QAAQ,CAACC,CAAD,CAAS,CACjC,MAAIn8B,EAAA,CAAUm8B,CAAV,CAAJ,EACEZ,CACO,CADMY,CACN,CAAA,IAFT,EAISZ,CALwB,CAgBnC,KAAAU,UAAA;AAAiBG,QAAQ,CAACrU,CAAD,CAAO,CAC9B,MAAI/nB,EAAA,CAAU+nB,CAAV,CAAJ,EACEkU,CACO,CADKlU,CACL,CAAA,IAFT,EAISkU,CALqB,CAoChC,KAAAvlB,KAAA,CAAY,CAAC,YAAD,CAAe,UAAf,CAA2B,UAA3B,CAAuC,cAAvC,CACR,QAAQ,CAAE4C,CAAF,CAAgB2X,CAAhB,CAA4B3W,CAA5B,CAAwC0I,CAAxC,CAAsD,CAuGhEqZ,QAASA,EAAmB,CAACC,CAAD,CAAS,CACnChjB,CAAAijB,WAAA,CAAsB,wBAAtB,CAAgDljB,CAAAmjB,OAAA,EAAhD,CAAoEF,CAApE,CADmC,CAvG2B,IAC5DjjB,CAD4D,CAG5D2D,EAAWiU,CAAAjU,SAAA,EAHiD,CAI5Dyf,EAAaxL,CAAA3V,IAAA,EAGb2gB,EAAJ,EACEjD,CACA,CADqByD,CAlgBlB5e,UAAA,CAAc,CAAd,CAkgBkB4e,CAlgBDv7B,QAAA,CAAY,GAAZ,CAkgBCu7B,CAlgBgBv7B,QAAA,CAAY,IAAZ,CAAjB,CAAqC,CAArC,CAAjB,CAmgBH,EADoC8b,CACpC,EADgD,GAChD,EAAA0f,CAAA,CAAepiB,CAAAoB,QAAA,CAAmB4e,EAAnB,CAAsCsB,EAFvD,GAIE5C,CACA,CADUmB,EAAA,CAAUsC,CAAV,CACV,CAAAC,CAAA,CAAepB,EALjB,CAOAjiB,EAAA,CAAY,IAAIqjB,CAAJ,CAAiB1D,CAAjB,CAA0B,GAA1B,CAAgCuC,CAAhC,CACZliB,EAAAqhB,QAAA,CAAkBrhB,CAAA6hB,UAAA,CAAoBuB,CAApB,CAAlB,CAEAzZ,EAAAlG,GAAA,CAAgB,OAAhB,CAAyB,QAAQ,CAACzI,CAAD,CAAQ,CAIvC,GAAIsoB,CAAAtoB,CAAAsoB,QAAJ,EAAqBC,CAAAvoB,CAAAuoB,QAArB,EAAqD,CAArD,EAAsCvoB,CAAAwoB,MAAtC,CAAA,CAKA,IAHA,IAAIljB,EAAMzV,CAAA,CAAOmQ,CAAAO,OAAP,CAGV,CAAsC,GAAtC,GAAO7Q,CAAA,CAAU4V,CAAA,CAAI,CAAJ,CAAAhZ,SAAV,CAAP,CAAA,CAEE,GAAIgZ,CAAA,CAAI,CAAJ,CAAJ,GAAeqJ,CAAA,CAAa,CAAb,CAAf,EAAkC,CAAC,CAACrJ,CAAD,CAAOA,CAAAla,OAAA,EAAP,EAAqB,CAArB,CAAnC,CAA4D,MAG9D;IAAIq9B,EAAUnjB,CAAA/Y,KAAA,CAAS,MAAT,CAEVX,EAAA,CAAS68B,CAAT,CAAJ,EAAgD,4BAAhD,GAAyBA,CAAA18B,SAAA,EAAzB,GAGE08B,CAHF,CAGY3G,EAAA,CAAW2G,CAAAC,QAAX,CAAAzgB,KAHZ,CAMA,KAAI0gB,EAAe3jB,CAAA6hB,UAAA,CAAoB4B,CAApB,CAEfA,EAAJ,GAAgB,CAAAnjB,CAAA9Y,KAAA,CAAS,QAAT,CAAhB,EAAsCm8B,CAAtC,EAAuD,CAAA3oB,CAAAW,mBAAA,EAAvD,IACEX,CAAAC,eAAA,EACA,CAAI0oB,CAAJ,EAAoB/L,CAAA3V,IAAA,EAApB,GAEEjC,CAAAqhB,QAAA,CAAkBsC,CAAlB,CAGA,CAFA1jB,CAAAtS,OAAA,EAEA,CAAArK,CAAAyK,QAAA,CAAe,0BAAf,CAAA,CAA6C,CAAA,CAL/C,CAFF,CApBA,CAJuC,CAAzC,CAsCIiS,EAAAmjB,OAAA,EAAJ,EAA0BC,CAA1B,EACExL,CAAA3V,IAAA,CAAajC,CAAAmjB,OAAA,EAAb,CAAiC,CAAA,CAAjC,CAIFvL,EAAArU,YAAA,CAAqB,QAAQ,CAACqgB,CAAD,CAAS,CAChC5jB,CAAAmjB,OAAA,EAAJ,EAA0BS,CAA1B,GACE3jB,CAAA7X,WAAA,CAAsB,QAAQ,EAAG,CAC/B,IAAI66B,EAASjjB,CAAAmjB,OAAA,EAEbnjB,EAAAqhB,QAAA,CAAkBuC,CAAlB,CACI3jB,EAAAijB,WAAA,CAAsB,sBAAtB,CAA8CU,CAA9C,CACsBX,CADtB,CAAAxnB,iBAAJ,EAEEuE,CAAAqhB,QAAA,CAAkB4B,CAAlB,CACA,CAAArL,CAAA3V,IAAA,CAAaghB,CAAb,CAHF,EAKED,CAAA,CAAoBC,CAApB,CAT6B,CAAjC,CAYA,CAAKhjB,CAAAua,QAAL;AAAyBva,CAAA4jB,QAAA,EAb3B,CADoC,CAAtC,CAmBA,KAAIC,EAAgB,CACpB7jB,EAAA5X,OAAA,CAAkB07B,QAAuB,EAAG,CAC1C,IAAId,EAASrL,CAAA3V,IAAA,EAAb,CACI+hB,EAAiBhkB,CAAAikB,UAEhBH,EAAL,EAAsBb,CAAtB,EAAgCjjB,CAAAmjB,OAAA,EAAhC,GACEW,CAAA,EACA,CAAA7jB,CAAA7X,WAAA,CAAsB,QAAQ,EAAG,CAC3B6X,CAAAijB,WAAA,CAAsB,sBAAtB,CAA8CljB,CAAAmjB,OAAA,EAA9C,CAAkEF,CAAlE,CAAAxnB,iBAAJ,CAEEuE,CAAAqhB,QAAA,CAAkB4B,CAAlB,CAFF,EAIErL,CAAA3V,IAAA,CAAajC,CAAAmjB,OAAA,EAAb,CAAiCa,CAAjC,CACA,CAAAhB,CAAA,CAAoBC,CAApB,CALF,CAD+B,CAAjC,CAFF,CAYAjjB,EAAAikB,UAAA,CAAsB,CAAA,CAEtB,OAAOH,EAlBmC,CAA5C,CAqBA,OAAO9jB,EArGyD,CADtD,CA/Dc,CAuN5B1L,QAASA,GAAY,EAAE,CAAA,IACjB4vB,EAAQ,CAAA,CADS,CAEjB16B,EAAO,IASX,KAAA26B,aAAA,CAAoBC,QAAQ,CAACC,CAAD,CAAO,CACjC,MAAI19B,EAAA,CAAU09B,CAAV,CAAJ,EACEH,CACK,CADGG,CACH,CAAA,IAFP,EAISH,CALwB,CASnC,KAAA7mB,KAAA,CAAY,CAAC,SAAD,CAAY,QAAQ,CAAC0C,CAAD,CAAS,CAwDvCukB,QAASA,EAAW,CAAC51B,CAAD,CAAM,CACpBA,CAAJ,WAAmB61B,MAAnB,GACM71B,CAAAuP,MAAJ,CACEvP,CADF,CACSA,CAAAsP,QACD,EADoD,EACpD,GADgBtP,CAAAuP,MAAApW,QAAA,CAAkB6G,CAAAsP,QAAlB,CAChB,CAAA,SAAA,CAAYtP,CAAAsP,QAAZ,CAA0B,IAA1B,CAAiCtP,CAAAuP,MAAjC;AACAvP,CAAAuP,MAHR,CAIWvP,CAAA81B,UAJX,GAKE91B,CALF,CAKQA,CAAAsP,QALR,CAKsB,IALtB,CAK6BtP,CAAA81B,UAL7B,CAK6C,GAL7C,CAKmD91B,CAAAkoB,KALnD,CADF,CASA,OAAOloB,EAViB,CAa1B+1B,QAASA,EAAU,CAAC/rB,CAAD,CAAO,CAAA,IACpBgsB,EAAU3kB,CAAA2kB,QAAVA,EAA6B,EADT,CAEpBC,EAAQD,CAAA,CAAQhsB,CAAR,CAARisB,EAAyBD,CAAAE,IAAzBD,EAAwCr+B,CACxCu+B,EAAAA,CAAW,CAAA,CAIf,IAAI,CACFA,CAAA,CAAW,CAAC,CAACF,CAAA96B,MADX,CAEF,MAAOmB,CAAP,CAAU,EAEZ,MAAI65B,EAAJ,CACS,QAAQ,EAAG,CAChB,IAAIpmB,EAAO,EACXxa,EAAA,CAAQ8B,SAAR,CAAmB,QAAQ,CAAC2I,CAAD,CAAM,CAC/B+P,CAAA/Z,KAAA,CAAU4/B,CAAA,CAAY51B,CAAZ,CAAV,CAD+B,CAAjC,CAGA,OAAOi2B,EAAA96B,MAAA,CAAY66B,CAAZ,CAAqBjmB,CAArB,CALS,CADpB,CAYO,QAAQ,CAACqmB,CAAD,CAAOC,CAAP,CAAa,CAC1BJ,CAAA,CAAMG,CAAN,CAAoB,IAAR,EAAAC,CAAA,CAAe,EAAf,CAAoBA,CAAhC,CAD0B,CAvBJ,CApE1B,MAAO,KAQAN,CAAA,CAAW,KAAX,CARA,MAiBCA,CAAA,CAAW,MAAX,CAjBD,MA0BCA,CAAA,CAAW,MAAX,CA1BD,OAmCEA,CAAA,CAAW,OAAX,CAnCF,OA4CG,QAAS,EAAG,CAClB,IAAIh7B,EAAKg7B,CAAA,CAAW,OAAX,CAET,OAAO,SAAQ,EAAG,CACZP,CAAJ,EACEz6B,CAAAI,MAAA,CAASL,CAAT,CAAezD,SAAf,CAFc,CAHA,CAAZ,EA5CH,CADgC,CAA7B,CApBS,CAwJvBi/B,QAASA,GAAoB,CAACr4B,CAAD,CAAOs4B,CAAP,CAAuB,CAClD,GAAa,aAAb,GAAIt4B,CAAJ,CACE,KAAMu4B,GAAA,CAAa,SAAb,CAEFD,CAFE,CAAN,CAIF,MAAOt4B,EAN2C,CASpDw4B,QAASA,GAAgB,CAACxhC,CAAD;AAAMshC,CAAN,CAAsB,CAE7C,GAAIthC,CAAJ,CAAS,CACP,GAAIA,CAAAmL,YAAJ,GAAwBnL,CAAxB,CACE,KAAMuhC,GAAA,CAAa,QAAb,CAEFD,CAFE,CAAN,CAGK,GACHthC,CAAAJ,SADG,EACaI,CAAAsD,SADb,EAC6BtD,CAAAuD,MAD7B,EAC0CvD,CAAAwD,YAD1C,CAEL,KAAM+9B,GAAA,CAAa,YAAb,CAEFD,CAFE,CAAN,CAGK,GACHthC,CAAAyS,SADG,GACczS,CAAA2D,SADd,EAC+B3D,CAAA4D,KAD/B,EAC2C5D,CAAA6D,KAD3C,EACuD7D,CAAA8D,KADvD,EAEL,KAAMy9B,GAAA,CAAa,SAAb,CAEFD,CAFE,CAAN,CAZK,CAiBT,MAAOthC,EAnBsC,CA4yB/CyhC,QAASA,GAAM,CAACzhC,CAAD,CAAMsL,CAAN,CAAYo2B,CAAZ,CAAsBC,CAAtB,CAA+BlgB,CAA/B,CAAwC,CAErDA,CAAA,CAAUA,CAAV,EAAqB,EAEjBxa,EAAAA,CAAUqE,CAAArD,MAAA,CAAW,GAAX,CACd,KADA,IAA+BxH,CAA/B,CACSS,EAAI,CAAb,CAAiC,CAAjC,CAAgB+F,CAAA/G,OAAhB,CAAoCgB,CAAA,EAApC,CAAyC,CACvCT,CAAA,CAAM4gC,EAAA,CAAqBp6B,CAAAyL,MAAA,EAArB,CAAsCivB,CAAtC,CACN,KAAIC,EAAc5hC,CAAA,CAAIS,CAAJ,CACbmhC,EAAL,GACEA,CACA,CADc,EACd,CAAA5hC,CAAA,CAAIS,CAAJ,CAAA,CAAWmhC,CAFb,CAIA5hC,EAAA,CAAM4hC,CACF5hC,EAAA61B,KAAJ,EAAgBpU,CAAAogB,eAAhB,GACEC,EAAA,CAAeH,CAAf,CASA,CARM,KAQN,EARe3hC,EAQf,EAPG,QAAQ,CAAC81B,CAAD,CAAU,CACjBA,CAAAD,KAAA,CAAa,QAAQ,CAACxvB,CAAD,CAAM,CAAEyvB,CAAAiM,IAAA,CAAc17B,CAAhB,CAA3B,CADiB,CAAlB,CAECrG,CAFD,CAOH,CAHIA,CAAA+hC,IAGJ,GAHgBliC,CAGhB,GAFEG,CAAA+hC,IAEF,CAFY,EAEZ,EAAA/hC,CAAA,CAAMA,CAAA+hC,IAVR,CARuC,CAqBzCthC,CAAA,CAAM4gC,EAAA,CAAqBp6B,CAAAyL,MAAA,EAArB,CAAsCivB,CAAtC,CAEN,OADA3hC,EAAA,CAAIS,CAAJ,CACA,CADWihC,CA3B0C,CAsCvDM,QAASA,GAAe,CAACC,CAAD;AAAOC,CAAP,CAAaC,CAAb,CAAmBC,CAAnB,CAAyBC,CAAzB,CAA+BV,CAA/B,CAAwClgB,CAAxC,CAAiD,CACvE4f,EAAA,CAAqBY,CAArB,CAA2BN,CAA3B,CACAN,GAAA,CAAqBa,CAArB,CAA2BP,CAA3B,CACAN,GAAA,CAAqBc,CAArB,CAA2BR,CAA3B,CACAN,GAAA,CAAqBe,CAArB,CAA2BT,CAA3B,CACAN,GAAA,CAAqBgB,CAArB,CAA2BV,CAA3B,CAEA,OAAQlgB,EAAAogB,eACD,CAwBDS,QAAoC,CAACz4B,CAAD,CAAQgR,CAAR,CAAgB,CAAA,IAC9C0nB,EAAW1nB,CAAD,EAAWA,CAAAla,eAAA,CAAsBshC,CAAtB,CAAX,CAA0CpnB,CAA1C,CAAmDhR,CADf,CAE9CisB,CAEJ,IAAe,IAAf,EAAIyM,CAAJ,CAAqB,MAAOA,EAG5B,EADAA,CACA,CADUA,CAAA,CAAQN,CAAR,CACV,GAAeM,CAAA1M,KAAf,GACEiM,EAAA,CAAeH,CAAf,CAMA,CALM,KAKN,EALeY,EAKf,GAJEzM,CAEA,CAFUyM,CAEV,CADAzM,CAAAiM,IACA,CADcliC,CACd,CAAAi2B,CAAAD,KAAA,CAAa,QAAQ,CAACxvB,CAAD,CAAM,CAAEyvB,CAAAiM,IAAA,CAAc17B,CAAhB,CAA3B,CAEF,EAAAk8B,CAAA,CAAUA,CAAAR,IAPZ,CAUA,IAAI,CAACG,CAAL,CAAW,MAAOK,EAClB,IAAe,IAAf,EAAIA,CAAJ,CAAqB,MAAO1iC,EAE5B,EADA0iC,CACA,CADUA,CAAA,CAAQL,CAAR,CACV,GAAeK,CAAA1M,KAAf,GACEiM,EAAA,CAAeH,CAAf,CAMA,CALM,KAKN,EALeY,EAKf,GAJEzM,CAEA,CAFUyM,CAEV,CADAzM,CAAAiM,IACA,CADcliC,CACd,CAAAi2B,CAAAD,KAAA,CAAa,QAAQ,CAACxvB,CAAD,CAAM,CAAEyvB,CAAAiM,IAAA,CAAc17B,CAAhB,CAA3B,CAEF,EAAAk8B,CAAA,CAAUA,CAAAR,IAPZ,CAUA,IAAI,CAACI,CAAL,CAAW,MAAOI,EAClB,IAAe,IAAf,EAAIA,CAAJ,CAAqB,MAAO1iC,EAE5B,EADA0iC,CACA,CADUA,CAAA,CAAQJ,CAAR,CACV,GAAeI,CAAA1M,KAAf,GACEiM,EAAA,CAAeH,CAAf,CAMA,CALM,KAKN,EALeY,EAKf,GAJEzM,CAEA,CAFUyM,CAEV,CADAzM,CAAAiM,IACA,CADcliC,CACd,CAAAi2B,CAAAD,KAAA,CAAa,QAAQ,CAACxvB,CAAD,CAAM,CAAEyvB,CAAAiM,IAAA,CAAc17B,CAAhB,CAA3B,CAEF,EAAAk8B,CAAA,CAAUA,CAAAR,IAPZ,CAUA,IAAI,CAACK,CAAL,CAAW,MAAOG,EAClB,IAAe,IAAf;AAAIA,CAAJ,CAAqB,MAAO1iC,EAE5B,EADA0iC,CACA,CADUA,CAAA,CAAQH,CAAR,CACV,GAAeG,CAAA1M,KAAf,GACEiM,EAAA,CAAeH,CAAf,CAMA,CALM,KAKN,EALeY,EAKf,GAJEzM,CAEA,CAFUyM,CAEV,CADAzM,CAAAiM,IACA,CADcliC,CACd,CAAAi2B,CAAAD,KAAA,CAAa,QAAQ,CAACxvB,CAAD,CAAM,CAAEyvB,CAAAiM,IAAA,CAAc17B,CAAhB,CAA3B,CAEF,EAAAk8B,CAAA,CAAUA,CAAAR,IAPZ,CAUA,IAAI,CAACM,CAAL,CAAW,MAAOE,EAClB,IAAe,IAAf,EAAIA,CAAJ,CAAqB,MAAO1iC,EAE5B,EADA0iC,CACA,CADUA,CAAA,CAAQF,CAAR,CACV,GAAeE,CAAA1M,KAAf,GACEiM,EAAA,CAAeH,CAAf,CAMA,CALM,KAKN,EALeY,EAKf,GAJEzM,CAEA,CAFUyM,CAEV,CADAzM,CAAAiM,IACA,CADcliC,CACd,CAAAi2B,CAAAD,KAAA,CAAa,QAAQ,CAACxvB,CAAD,CAAM,CAAEyvB,CAAAiM,IAAA,CAAc17B,CAAhB,CAA3B,CAEF,EAAAk8B,CAAA,CAAUA,CAAAR,IAPZ,CASA,OAAOQ,EApE2C,CAxBnD,CAADC,QAAsB,CAAC34B,CAAD,CAAQgR,CAAR,CAAgB,CACpC,IAAI0nB,EAAW1nB,CAAD,EAAWA,CAAAla,eAAA,CAAsBshC,CAAtB,CAAX,CAA0CpnB,CAA1C,CAAmDhR,CAEjE,IAAe,IAAf,EAAI04B,CAAJ,CAAqB,MAAOA,EAC5BA,EAAA,CAAUA,CAAA,CAAQN,CAAR,CAEV,IAAI,CAACC,CAAL,CAAW,MAAOK,EAClB,IAAe,IAAf,EAAIA,CAAJ,CAAqB,MAAO1iC,EAC5B0iC,EAAA,CAAUA,CAAA,CAAQL,CAAR,CAEV,IAAI,CAACC,CAAL,CAAW,MAAOI,EAClB,IAAe,IAAf,EAAIA,CAAJ,CAAqB,MAAO1iC,EAC5B0iC,EAAA,CAAUA,CAAA,CAAQJ,CAAR,CAEV,IAAI,CAACC,CAAL,CAAW,MAAOG,EAClB,IAAe,IAAf,EAAIA,CAAJ,CAAqB,MAAO1iC,EAC5B0iC,EAAA,CAAUA,CAAA,CAAQH,CAAR,CAEV,OAAKC,EAAL,CACe,IAAf,EAAIE,CAAJ,CAA4B1iC,CAA5B,CACA0iC,CADA,CACUA,CAAA,CAAQF,CAAR,CAFV,CAAkBE,CAlBkB,CAR2B,CAwGzEE,QAASA,GAAe,CAACR,CAAD,CAAON,CAAP,CAAgB,CACtCN,EAAA,CAAqBY,CAArB,CAA2BN,CAA3B,CAEA,OAAOc,SAAwB,CAAC54B,CAAD;AAAQgR,CAAR,CAAgB,CAC7C,MAAa,KAAb,EAAIhR,CAAJ,CAA0BhK,CAA1B,CACO,CAAEgb,CAAD,EAAWA,CAAAla,eAAA,CAAsBshC,CAAtB,CAAX,CAA0CpnB,CAA1C,CAAmDhR,CAApD,EAA2Do4B,CAA3D,CAFsC,CAHT,CASxCS,QAASA,GAAe,CAACT,CAAD,CAAOC,CAAP,CAAaP,CAAb,CAAsB,CAC5CN,EAAA,CAAqBY,CAArB,CAA2BN,CAA3B,CACAN,GAAA,CAAqBa,CAArB,CAA2BP,CAA3B,CAEA,OAAOe,SAAwB,CAAC74B,CAAD,CAAQgR,CAAR,CAAgB,CAC7C,GAAa,IAAb,EAAIhR,CAAJ,CAAmB,MAAOhK,EAC1BgK,EAAA,CAAQ,CAAEgR,CAAD,EAAWA,CAAAla,eAAA,CAAsBshC,CAAtB,CAAX,CAA0CpnB,CAA1C,CAAmDhR,CAApD,EAA2Do4B,CAA3D,CACR,OAAgB,KAAT,EAAAp4B,CAAA,CAAgBhK,CAAhB,CAA4BgK,CAAA,CAAMq4B,CAAN,CAHU,CAJH,CAW9CS,QAASA,GAAQ,CAACr3B,CAAD,CAAOmW,CAAP,CAAgBkgB,CAAhB,CAAyB,CAIxC,GAAIiB,EAAAjiC,eAAA,CAA6B2K,CAA7B,CAAJ,CACE,MAAOs3B,GAAA,CAAct3B,CAAd,CAL+B,KAQpCu3B,EAAWv3B,CAAArD,MAAA,CAAW,GAAX,CARyB,CASpC66B,EAAiBD,CAAA3iC,OATmB,CAUpC4F,CAIJ,IAAK2b,CAAAogB,eAAL,EAAkD,CAAlD,GAA+BiB,CAA/B,CAEO,GAAKrhB,CAAAogB,eAAL,EAAkD,CAAlD,GAA+BiB,CAA/B,CAEA,GAAIrhB,CAAAjc,IAAJ,CAEHM,CAAA,CADmB,CAArB,CAAIg9B,CAAJ,CACOd,EAAA,CAAgBa,CAAA,CAAS,CAAT,CAAhB,CAA6BA,CAAA,CAAS,CAAT,CAA7B,CAA0CA,CAAA,CAAS,CAAT,CAA1C,CAAuDA,CAAA,CAAS,CAAT,CAAvD,CAAoEA,CAAA,CAAS,CAAT,CAApE,CAAiFlB,CAAjF,CACelgB,CADf,CADP,CAIO3b,QAAQ,CAAC+D,CAAD,CAAQgR,CAAR,CAAgB,CAAA,IACvB3Z,EAAI,CADmB,CAChBmF,CACX,GACEA,EAIA,CAJM27B,EAAA,CAAgBa,CAAA,CAAS3hC,CAAA,EAAT,CAAhB,CAA+B2hC,CAAA,CAAS3hC,CAAA,EAAT,CAA/B,CAA8C2hC,CAAA,CAAS3hC,CAAA,EAAT,CAA9C,CAA6D2hC,CAAA,CAAS3hC,CAAA,EAAT,CAA7D,CACgB2hC,CAAA,CAAS3hC,CAAA,EAAT,CADhB,CAC+BygC,CAD/B,CACwClgB,CADxC,CAAA,CACiD5X,CADjD,CACwDgR,CADxD,CAIN,CADAA,CACA,CADShb,CACT,CAAAgK,CAAA,CAAQxD,CALV,OAMSnF,CANT,CAMa4hC,CANb,CAOA,OAAOz8B,EAToB,CAL1B,KAiBA,CACL,IAAI8oB,EAAO,UACX7uB;CAAA,CAAQuiC,CAAR,CAAkB,QAAQ,CAACpiC,CAAD,CAAMc,CAAN,CAAa,CACrC8/B,EAAA,CAAqB5gC,CAArB,CAA0BkhC,CAA1B,CACAxS,EAAA,EAAQ,qCAAR,EACe5tB,CAEA,CAAG,GAAH,CAEG,yBAFH,CAE+Bd,CAF/B,CAEqC,UALpD,EAKkE,IALlE,CAKyEA,CALzE,CAKsF,OALtF,EAMSghB,CAAAogB,eACA,CAAG,2BAAH,CACaF,CAAAh6B,QAAA,CAAgB,YAAhB,CAA8B,MAA9B,CADb,CAQC,4GARD,CASG,EAhBZ,CAFqC,CAAvC,CAoBA,KAAAwnB,EAAAA,CAAAA,CAAQ,WAAR,CAGI4T,EAAiB,IAAIC,QAAJ,CAAa,GAAb,CAAkB,GAAlB,CAAuB,IAAvB,CAA6B7T,CAA7B,CAErB4T,EAAA3/B,SAAA,CAA0BN,EAAA,CAAQqsB,CAAR,CAC1BrpB,EAAA,CAAK2b,CAAAogB,eAAA,CAAyB,QAAQ,CAACh4B,CAAD,CAAQgR,CAAR,CAAgB,CACpD,MAAOkoB,EAAA,CAAel5B,CAAf,CAAsBgR,CAAtB,CAA8BinB,EAA9B,CAD6C,CAAjD,CAEDiB,CA9BC,CAnBA,IACLj9B,EAAA,CAAK48B,EAAA,CAAgBG,CAAA,CAAS,CAAT,CAAhB,CAA6BA,CAAA,CAAS,CAAT,CAA7B,CAA0ClB,CAA1C,CAHP,KACE77B,EAAA,CAAK28B,EAAA,CAAgBI,CAAA,CAAS,CAAT,CAAhB,CAA6BlB,CAA7B,CAuDM,iBAAb;AAAIr2B,CAAJ,GACEs3B,EAAA,CAAct3B,CAAd,CADF,CACwBxF,CADxB,CAGA,OAAOA,EAzEiC,CAgI1C8K,QAASA,GAAc,EAAG,CACxB,IAAI4J,EAAQ,EAAZ,CAEIyoB,EAAgB,KACb,CAAA,CADa,gBAEF,CAAA,CAFE,oBAGE,CAAA,CAHF,CAmDpB,KAAApB,eAAA,CAAsBqB,QAAQ,CAAC7hC,CAAD,CAAQ,CACpC,MAAI2B,EAAA,CAAU3B,CAAV,CAAJ,EACE4hC,CAAApB,eACO,CADwB,CAAC,CAACxgC,CAC1B,CAAA,IAFT,EAIS4hC,CAAApB,eAL2B,CA2BvC,KAAAsB,mBAAA,CAA0BC,QAAQ,CAAC/hC,CAAD,CAAQ,CACvC,MAAI2B,EAAA,CAAU3B,CAAV,CAAJ,EACE4hC,CAAAE,mBACO,CAD4B9hC,CAC5B,CAAA,IAFT,EAIS4hC,CAAAE,mBAL8B,CAUzC,KAAAzpB,KAAA,CAAY,CAAC,SAAD,CAAY,UAAZ,CAAwB,MAAxB,CAAgC,QAAQ,CAAC2pB,CAAD,CAAU/lB,CAAV,CAAoBD,CAApB,CAA0B,CAC5E4lB,CAAAz9B,IAAA,CAAoB8X,CAAA9X,IAEpBs8B,GAAA,CAAiBA,QAAyB,CAACH,CAAD,CAAU,CAC7CsB,CAAAE,mBAAL,EAAyC,CAAAG,EAAA3iC,eAAA,CAAmCghC,CAAnC,CAAzC,GACA2B,EAAA,CAAoB3B,CAApB,CACA,CAD+B,CAAA,CAC/B,CAAAtkB,CAAAqD,KAAA,CAAU,4CAAV,CAAyDihB,CAAzD,CACI,2EADJ,CAFA,CADkD,CAOpD;MAAO,SAAQ,CAACtH,CAAD,CAAM,CACnB,IAAIkJ,CAEJ,QAAQ,MAAOlJ,EAAf,EACE,KAAK,QAAL,CAEE,GAAI7f,CAAA7Z,eAAA,CAAqB05B,CAArB,CAAJ,CACE,MAAO7f,EAAA,CAAM6f,CAAN,CAGLmJ,EAAAA,CAAQ,IAAIC,EAAJ,CAAUR,CAAV,CAEZM,EAAA,CAAmB38B,CADN88B,IAAIC,EAAJD,CAAWF,CAAXE,CAAkBL,CAAlBK,CAA2BT,CAA3BS,CACM98B,OAAA,CAAayzB,CAAb,CAAkB,CAAA,CAAlB,CAEP,iBAAZ,GAAIA,CAAJ,GAGE7f,CAAA,CAAM6f,CAAN,CAHF,CAGekJ,CAHf,CAMA,OAAOA,EAET,MAAK,UAAL,CACE,MAAOlJ,EAET,SACE,MAAO13B,EAvBX,CAHmB,CAVuD,CAAlE,CA3FY,CA6S1BmO,QAASA,GAAU,EAAG,CAEpB,IAAA4I,KAAA,CAAY,CAAC,YAAD,CAAe,mBAAf,CAAoC,QAAQ,CAAC4C,CAAD,CAAaqH,CAAb,CAAgC,CACtF,MAAOigB,GAAA,CAAS,QAAQ,CAACzkB,CAAD,CAAW,CACjC7C,CAAA7X,WAAA,CAAsB0a,CAAtB,CADiC,CAA5B,CAEJwE,CAFI,CAD+E,CAA5E,CAFQ,CAkBtBigB,QAASA,GAAQ,CAACC,CAAD,CAAWC,CAAX,CAA6B,CAyR5CC,QAASA,EAAe,CAAC1iC,CAAD,CAAQ,CAC9B,MAAOA,EADuB,CAKhC2iC,QAASA,EAAc,CAACh5B,CAAD,CAAS,CAC9B,MAAOupB,EAAA,CAAOvpB,CAAP,CADuB,CAlRhC,IAAI8V,EAAQA,QAAQ,EAAG,CAAA,IACjBmjB,EAAU,EADO,CAEjB5iC,CAFiB,CAEVy1B,CA+HX,OA7HAA,EA6HA,CA7HW,SAEAC,QAAQ,CAAC1wB,CAAD,CAAM,CACrB,GAAI49B,CAAJ,CAAa,CACX,IAAIhM,EAAYgM,CAChBA,EAAA,CAAUpkC,CACVwB,EAAA,CAAQ6iC,CAAA,CAAI79B,CAAJ,CAEJ4xB,EAAA/3B,OAAJ,EACE2jC,CAAA,CAAS,QAAQ,EAAG,CAElB,IADA,IAAI1kB,CAAJ;AACSje,EAAI,CADb,CACgB0V,EAAKqhB,CAAA/3B,OAArB,CAAuCgB,CAAvC,CAA2C0V,CAA3C,CAA+C1V,CAAA,EAA/C,CACEie,CACA,CADW8Y,CAAA,CAAU/2B,CAAV,CACX,CAAAG,CAAAw0B,KAAA,CAAW1W,CAAA,CAAS,CAAT,CAAX,CAAwBA,CAAA,CAAS,CAAT,CAAxB,CAAqCA,CAAA,CAAS,CAAT,CAArC,CAJgB,CAApB,CANS,CADQ,CAFd,QAqBDoV,QAAQ,CAACvpB,CAAD,CAAS,CACvB8rB,CAAAC,QAAA,CAAiBoN,CAAA,CAA8Bn5B,CAA9B,CAAjB,CADuB,CArBhB,QA0BDqwB,QAAQ,CAAC+I,CAAD,CAAW,CACzB,GAAIH,CAAJ,CAAa,CACX,IAAIhM,EAAYgM,CAEZA,EAAA/jC,OAAJ,EACE2jC,CAAA,CAAS,QAAQ,EAAG,CAElB,IADA,IAAI1kB,CAAJ,CACSje,EAAI,CADb,CACgB0V,EAAKqhB,CAAA/3B,OAArB,CAAuCgB,CAAvC,CAA2C0V,CAA3C,CAA+C1V,CAAA,EAA/C,CACEie,CACA,CADW8Y,CAAA,CAAU/2B,CAAV,CACX,CAAAie,CAAA,CAAS,CAAT,CAAA,CAAYilB,CAAZ,CAJgB,CAApB,CAJS,CADY,CA1BlB,SA2CA,MACDvO,QAAQ,CAAC1W,CAAD,CAAWklB,CAAX,CAAoBC,CAApB,CAAkC,CAC9C,IAAI9nB,EAASsE,CAAA,EAAb,CAEIyjB,EAAkBA,QAAQ,CAACljC,CAAD,CAAQ,CACpC,GAAI,CACFmb,CAAAua,QAAA,CAAgB,CAAAr2B,CAAA,CAAWye,CAAX,CAAA,CAAuBA,CAAvB,CAAkC4kB,CAAlC,EAAmD1iC,CAAnD,CAAhB,CADE,CAEF,MAAMgG,CAAN,CAAS,CACTmV,CAAA+X,OAAA,CAAcltB,CAAd,CACA,CAAAy8B,CAAA,CAAiBz8B,CAAjB,CAFS,CAHyB,CAFtC,CAWIm9B,EAAiBA,QAAQ,CAACx5B,CAAD,CAAS,CACpC,GAAI,CACFwR,CAAAua,QAAA,CAAgB,CAAAr2B,CAAA,CAAW2jC,CAAX,CAAA,CAAsBA,CAAtB,CAAgCL,CAAhC,EAAgDh5B,CAAhD,CAAhB,CADE,CAEF,MAAM3D,CAAN,CAAS,CACTmV,CAAA+X,OAAA,CAAcltB,CAAd,CACA,CAAAy8B,CAAA,CAAiBz8B,CAAjB,CAFS,CAHyB,CAXtC,CAoBIo9B,EAAsBA,QAAQ,CAACL,CAAD,CAAW,CAC3C,GAAI,CACF5nB,CAAA6e,OAAA,CAAe,CAAA36B,CAAA,CAAW4jC,CAAX,CAAA,CAA2BA,CAA3B,CAA0CP,CAA1C,EAA2DK,CAA3D,CAAf,CADE,CAEF,MAAM/8B,CAAN,CAAS,CACTy8B,CAAA,CAAiBz8B,CAAjB,CADS,CAHgC,CAQzC48B,EAAJ,CACEA,CAAAljC,KAAA,CAAa,CAACwjC,CAAD,CAAkBC,CAAlB,CAAkCC,CAAlC,CAAb,CADF,CAGEpjC,CAAAw0B,KAAA,CAAW0O,CAAX,CAA4BC,CAA5B,CAA4CC,CAA5C,CAGF,OAAOjoB,EAAAsZ,QAnCuC,CADzC,CAuCP,OAvCO,CAuCE4O,QAAQ,CAACvlB,CAAD,CAAW,CAC1B,MAAO,KAAA0W,KAAA,CAAU,IAAV;AAAgB1W,CAAhB,CADmB,CAvCrB,CA2CP,SA3CO,CA2CIwlB,QAAQ,CAACxlB,CAAD,CAAW,CAE5BylB,QAASA,EAAW,CAACvjC,CAAD,CAAQwjC,CAAR,CAAkB,CACpC,IAAIroB,EAASsE,CAAA,EACT+jB,EAAJ,CACEroB,CAAAua,QAAA,CAAe11B,CAAf,CADF,CAGEmb,CAAA+X,OAAA,CAAclzB,CAAd,CAEF,OAAOmb,EAAAsZ,QAP6B,CAUtCgP,QAASA,EAAc,CAACzjC,CAAD,CAAQ0jC,CAAR,CAAoB,CACzC,IAAIC,EAAiB,IACrB,IAAI,CACFA,CAAA,CAAkB,CAAA7lB,CAAA,EAAW4kB,CAAX,GADhB,CAEF,MAAM18B,CAAN,CAAS,CACT,MAAOu9B,EAAA,CAAYv9B,CAAZ,CAAe,CAAA,CAAf,CADE,CAGX,MAAI29B,EAAJ,EAAsBtkC,CAAA,CAAWskC,CAAAnP,KAAX,CAAtB,CACSmP,CAAAnP,KAAA,CAAoB,QAAQ,EAAG,CACpC,MAAO+O,EAAA,CAAYvjC,CAAZ,CAAmB0jC,CAAnB,CAD6B,CAA/B,CAEJ,QAAQ,CAACpnB,CAAD,CAAQ,CACjB,MAAOinB,EAAA,CAAYjnB,CAAZ,CAAmB,CAAA,CAAnB,CADU,CAFZ,CADT,CAOSinB,CAAA,CAAYvjC,CAAZ,CAAmB0jC,CAAnB,CAdgC,CAkB3C,MAAO,KAAAlP,KAAA,CAAU,QAAQ,CAACx0B,CAAD,CAAQ,CAC/B,MAAOyjC,EAAA,CAAezjC,CAAf,CAAsB,CAAA,CAAtB,CADwB,CAA1B,CAEJ,QAAQ,CAACsc,CAAD,CAAQ,CACjB,MAAOmnB,EAAA,CAAennB,CAAf,CAAsB,CAAA,CAAtB,CADU,CAFZ,CA9BqB,CA3CvB,CA3CA,CAJU,CAAvB,CAqIIumB,EAAMA,QAAQ,CAAC7iC,CAAD,CAAQ,CACxB,MAAIA,EAAJ,EAAaX,CAAA,CAAWW,CAAAw0B,KAAX,CAAb,CAA4Cx0B,CAA5C,CACO,MACCw0B,QAAQ,CAAC1W,CAAD,CAAW,CACvB,IAAI3C,EAASsE,CAAA,EACb+iB,EAAA,CAAS,QAAQ,EAAG,CAClBrnB,CAAAua,QAAA,CAAe5X,CAAA,CAAS9d,CAAT,CAAf,CADkB,CAApB,CAGA,OAAOmb,EAAAsZ,QALgB,CADpB,CAFiB,CArI1B,CAuLIvB,EAASA,QAAQ,CAACvpB,CAAD,CAAS,CAC5B,IAAIwR,EAASsE,CAAA,EACbtE,EAAA+X,OAAA,CAAcvpB,CAAd,CACA,OAAOwR,EAAAsZ,QAHqB,CAvL9B,CA6LIqO,EAAgCA,QAAQ,CAACn5B,CAAD,CAAS,CACnD,MAAO,MACC6qB,QAAQ,CAAC1W,CAAD;AAAWklB,CAAX,CAAoB,CAChC,IAAI7nB,EAASsE,CAAA,EACb+iB,EAAA,CAAS,QAAQ,EAAG,CAClB,GAAI,CACFrnB,CAAAua,QAAA,CAAgB,CAAAr2B,CAAA,CAAW2jC,CAAX,CAAA,CAAsBA,CAAtB,CAAgCL,CAAhC,EAAgDh5B,CAAhD,CAAhB,CADE,CAEF,MAAM3D,CAAN,CAAS,CACTmV,CAAA+X,OAAA,CAAcltB,CAAd,CACA,CAAAy8B,CAAA,CAAiBz8B,CAAjB,CAFS,CAHO,CAApB,CAQA,OAAOmV,EAAAsZ,QAVyB,CAD7B,CAD4C,CAiIrD,OAAO,OACEhV,CADF,QAEGyT,CAFH,MAlGIwB,QAAQ,CAAC10B,CAAD,CAAQ8d,CAAR,CAAkBklB,CAAlB,CAA2BC,CAA3B,CAAyC,CAAA,IACtD9nB,EAASsE,CAAA,EAD6C,CAEtD2V,CAFsD,CAItD8N,EAAkBA,QAAQ,CAACljC,CAAD,CAAQ,CACpC,GAAI,CACF,MAAQ,CAAAX,CAAA,CAAWye,CAAX,CAAA,CAAuBA,CAAvB,CAAkC4kB,CAAlC,EAAmD1iC,CAAnD,CADN,CAEF,MAAOgG,CAAP,CAAU,CAEV,MADAy8B,EAAA,CAAiBz8B,CAAjB,CACO,CAAAktB,CAAA,CAAOltB,CAAP,CAFG,CAHwB,CAJoB,CAatDm9B,EAAiBA,QAAQ,CAACx5B,CAAD,CAAS,CACpC,GAAI,CACF,MAAQ,CAAAtK,CAAA,CAAW2jC,CAAX,CAAA,CAAsBA,CAAtB,CAAgCL,CAAhC,EAAgDh5B,CAAhD,CADN,CAEF,MAAO3D,CAAP,CAAU,CAEV,MADAy8B,EAAA,CAAiBz8B,CAAjB,CACO,CAAAktB,CAAA,CAAOltB,CAAP,CAFG,CAHwB,CAboB,CAsBtDo9B,EAAsBA,QAAQ,CAACL,CAAD,CAAW,CAC3C,GAAI,CACF,MAAQ,CAAA1jC,CAAA,CAAW4jC,CAAX,CAAA,CAA2BA,CAA3B,CAA0CP,CAA1C,EAA2DK,CAA3D,CADN,CAEF,MAAO/8B,CAAP,CAAU,CACVy8B,CAAA,CAAiBz8B,CAAjB,CADU,CAH+B,CAQ7Cw8B,EAAA,CAAS,QAAQ,EAAG,CAClBK,CAAA,CAAI7iC,CAAJ,CAAAw0B,KAAA,CAAgB,QAAQ,CAACx0B,CAAD,CAAQ,CAC1Bo1B,CAAJ,GACAA,CACA,CADO,CAAA,CACP,CAAAja,CAAAua,QAAA,CAAemN,CAAA,CAAI7iC,CAAJ,CAAAw0B,KAAA,CAAgB0O,CAAhB,CAAiCC,CAAjC,CAAiDC,CAAjD,CAAf,CAFA,CAD8B,CAAhC,CAIG,QAAQ,CAACz5B,CAAD,CAAS,CACdyrB,CAAJ,GACAA,CACA,CADO,CAAA,CACP,CAAAja,CAAAua,QAAA,CAAeyN,CAAA,CAAex5B,CAAf,CAAf,CAFA,CADkB,CAJpB,CAQG,QAAQ,CAACo5B,CAAD,CAAW,CAChB3N,CAAJ,EACAja,CAAA6e,OAAA,CAAcoJ,CAAA,CAAoBL,CAApB,CAAd,CAFoB,CARtB,CADkB,CAApB,CAeA,OAAO5nB,EAAAsZ,QA7CmD,CAkGrD;IAxBP7c,QAAY,CAACgsB,CAAD,CAAW,CAAA,IACjBnO,EAAWhW,CAAA,EADM,CAEjBwY,EAAU,CAFO,CAGjBt1B,EAAU3D,CAAA,CAAQ4kC,CAAR,CAAA,CAAoB,EAApB,CAAyB,EAEvC3kC,EAAA,CAAQ2kC,CAAR,CAAkB,QAAQ,CAACnP,CAAD,CAAUr1B,CAAV,CAAe,CACvC64B,CAAA,EACA4K,EAAA,CAAIpO,CAAJ,CAAAD,KAAA,CAAkB,QAAQ,CAACx0B,CAAD,CAAQ,CAC5B2C,CAAArD,eAAA,CAAuBF,CAAvB,CAAJ,GACAuD,CAAA,CAAQvD,CAAR,CACA,CADeY,CACf,CAAM,EAAEi4B,CAAR,EAAkBxC,CAAAC,QAAA,CAAiB/yB,CAAjB,CAFlB,CADgC,CAAlC,CAIG,QAAQ,CAACgH,CAAD,CAAS,CACdhH,CAAArD,eAAA,CAAuBF,CAAvB,CAAJ,EACAq2B,CAAAvC,OAAA,CAAgBvpB,CAAhB,CAFkB,CAJpB,CAFuC,CAAzC,CAYgB,EAAhB,GAAIsuB,CAAJ,EACExC,CAAAC,QAAA,CAAiB/yB,CAAjB,CAGF,OAAO8yB,EAAAhB,QArBc,CAwBhB,CA1UqC,CAkV9CzkB,QAASA,GAAa,EAAE,CACtB,IAAAqI,KAAA,CAAY,CAAC,SAAD,CAAY,UAAZ,CAAwB,QAAQ,CAAC0C,CAAD,CAAUc,CAAV,CAAoB,CAC9D,IAAIgoB,EAAwB9oB,CAAA8oB,sBAAxBA,EACwB9oB,CAAA+oB,4BADxBD,EAEwB9oB,CAAAgpB,yBAF5B,CAIIC,EAAuBjpB,CAAAipB,qBAAvBA,EACuBjpB,CAAAkpB,2BADvBD,EAEuBjpB,CAAAmpB,wBAFvBF,EAGuBjpB,CAAAopB,kCAP3B,CASIC,EAAe,CAAC,CAACP,CATrB,CAUIQ,EAAMD,CACA;AAAN,QAAQ,CAAC3/B,CAAD,CAAK,CACX,IAAI6/B,EAAKT,CAAA,CAAsBp/B,CAAtB,CACT,OAAO,SAAQ,EAAG,CAChBu/B,CAAA,CAAqBM,CAArB,CADgB,CAFP,CAAP,CAMN,QAAQ,CAAC7/B,CAAD,CAAK,CACX,IAAI8/B,EAAQ1oB,CAAA,CAASpX,CAAT,CAAa,KAAb,CAAoB,CAAA,CAApB,CACZ,OAAO,SAAQ,EAAG,CAChBoX,CAAAgE,OAAA,CAAgB0kB,CAAhB,CADgB,CAFP,CAOjBF,EAAAvoB,UAAA,CAAgBsoB,CAEhB,OAAOC,EA3BuD,CAApD,CADU,CAmGxB70B,QAASA,GAAkB,EAAE,CAC3B,IAAIg1B,EAAM,EAAV,CACIC,EAAmBhmC,CAAA,CAAO,YAAP,CADvB,CAEIimC,EAAiB,IAErB,KAAAC,UAAA,CAAiBC,QAAQ,CAAC5kC,CAAD,CAAQ,CAC3Be,SAAAlC,OAAJ,GACE2lC,CADF,CACQxkC,CADR,CAGA,OAAOwkC,EAJwB,CAOjC,KAAAnsB,KAAA,CAAY,CAAC,WAAD,CAAc,mBAAd,CAAmC,QAAnC,CAA6C,UAA7C,CACR,QAAQ,CAAE4B,CAAF,CAAeqI,CAAf,CAAoCc,CAApC,CAA8CwP,CAA9C,CAAwD,CA0ClEiS,QAASA,EAAK,EAAG,CACf,IAAAC,IAAA,CAAW7kC,EAAA,EACX,KAAAu1B,QAAA,CAAe,IAAAuP,QAAf,CAA8B,IAAAC,WAA9B,CACe,IAAAC,cADf,CACoC,IAAAC,cADpC,CAEe,IAAAC,YAFf,CAEkC,IAAAC,YAFlC,CAEqD,IACrD,KAAA,CAAK,MAAL,CAAA,CAAe,IAAAC,MAAf,CAA6B,IAC7B;IAAAC,YAAA,CAAmB,CAAA,CACnB,KAAAC,aAAA,CAAoB,EACpB,KAAAC,kBAAA,CAAyB,EACzB,KAAAC,YAAA,CAAmB,EACnB,KAAAC,gBAAA,CAAuB,EACvB,KAAA3b,kBAAA,CAAyB,EAXV,CA48BjB4b,QAASA,EAAU,CAACC,CAAD,CAAQ,CACzB,GAAI3qB,CAAAua,QAAJ,CACE,KAAMiP,EAAA,CAAiB,QAAjB,CAAsDxpB,CAAAua,QAAtD,CAAN,CAGFva,CAAAua,QAAA,CAAqBoQ,CALI,CAY3BC,QAASA,EAAW,CAAC7M,CAAD,CAAMrxB,CAAN,CAAY,CAC9B,IAAIlD,EAAK2e,CAAA,CAAO4V,CAAP,CACTpvB,GAAA,CAAYnF,CAAZ,CAAgBkD,CAAhB,CACA,OAAOlD,EAHuB,CAMhCqhC,QAASA,EAAsB,CAACC,CAAD,CAAUtM,CAAV,CAAiB9xB,CAAjB,CAAuB,CACpD,EACEo+B,EAAAL,gBAAA,CAAwB/9B,CAAxB,CAEA,EAFiC8xB,CAEjC,CAAsC,CAAtC,GAAIsM,CAAAL,gBAAA,CAAwB/9B,CAAxB,CAAJ,EACE,OAAOo+B,CAAAL,gBAAA,CAAwB/9B,CAAxB,CAJX,OAMUo+B,CANV,CAMoBA,CAAAhB,QANpB,CADoD,CActDiB,QAASA,EAAY,EAAG,EAt9BxBnB,CAAAhrB,UAAA,CAAkB,aACHgrB,CADG,MA0BVxf,QAAQ,CAAC4gB,CAAD,CAAU,CAIlBA,CAAJ,EACEC,CAIA,CAJQ,IAAIrB,CAIZ,CAHAqB,CAAAb,MAGA,CAHc,IAAAA,MAGd,CADAa,CAAAX,aACA,CADqB,IAAAA,aACrB,CAAAW,CAAAV,kBAAA;AAA0B,IAAAA,kBAL5B,GAOEW,CAKA,CALaA,QAAQ,EAAG,EAKxB,CAFAA,CAAAtsB,UAEA,CAFuB,IAEvB,CADAqsB,CACA,CADQ,IAAIC,CACZ,CAAAD,CAAApB,IAAA,CAAY7kC,EAAA,EAZd,CAcAimC,EAAA,CAAM,MAAN,CAAA,CAAgBA,CAChBA,EAAAT,YAAA,CAAoB,EACpBS,EAAAR,gBAAA,CAAwB,EACxBQ,EAAAnB,QAAA,CAAgB,IAChBmB,EAAAlB,WAAA,CAAmBkB,CAAAjB,cAAnB,CAAyCiB,CAAAf,YAAzC,CAA6De,CAAAd,YAA7D,CAAiF,IACjFc,EAAAhB,cAAA,CAAsB,IAAAE,YAClB,KAAAD,YAAJ,CAEE,IAAAC,YAFF,CACE,IAAAA,YAAAH,cADF,CACmCiB,CADnC,CAIE,IAAAf,YAJF,CAIqB,IAAAC,YAJrB,CAIwCc,CAExC,OAAOA,EA9Be,CA1BR,QAyKR7iC,QAAQ,CAAC+iC,CAAD,CAAWjpB,CAAX,CAAqBkpB,CAArB,CAAqC,CAAA,IAE/CztB,EAAMitB,CAAA,CAAYO,CAAZ,CAAsB,OAAtB,CAFyC,CAG/CtjC,EAFQ0F,IAEAw8B,WAHuC,CAI/CsB,EAAU,IACJnpB,CADI,MAEF6oB,CAFE,KAGHptB,CAHG,KAIHwtB,CAJG,IAKJ,CAAC,CAACC,CALE,CAQd3B,EAAA,CAAiB,IAGjB,IAAI,CAACrlC,CAAA,CAAW8d,CAAX,CAAL,CAA2B,CACzB,IAAIopB,EAAWV,CAAA,CAAY1oB,CAAZ,EAAwB7b,CAAxB,CAA8B,UAA9B,CACfglC,EAAA7hC,GAAA,CAAa+hC,QAAQ,CAACC,CAAD;AAASC,CAAT,CAAiBl+B,CAAjB,CAAwB,CAAC+9B,CAAA,CAAS/9B,CAAT,CAAD,CAFpB,CAK3B,GAAuB,QAAvB,EAAI,MAAO49B,EAAX,EAAmCxtB,CAAAsB,SAAnC,CAAiD,CAC/C,IAAIysB,EAAaL,CAAA7hC,GACjB6hC,EAAA7hC,GAAA,CAAa+hC,QAAQ,CAACC,CAAD,CAASC,CAAT,CAAiBl+B,CAAjB,CAAwB,CAC3Cm+B,CAAApnC,KAAA,CAAgB,IAAhB,CAAsBknC,CAAtB,CAA8BC,CAA9B,CAAsCl+B,CAAtC,CACAzF,GAAA,CAAYD,CAAZ,CAAmBwjC,CAAnB,CAF2C,CAFE,CAQ5CxjC,CAAL,GACEA,CADF,CA3BY0F,IA4BFw8B,WADV,CAC6B,EAD7B,CAKAliC,EAAArC,QAAA,CAAc6lC,CAAd,CAEA,OAAO,SAAQ,EAAG,CAChBvjC,EAAA,CAAYD,CAAZ,CAAmBwjC,CAAnB,CACA5B,EAAA,CAAiB,IAFD,CAnCiC,CAzKrC,kBA0QEkC,QAAQ,CAACjoC,CAAD,CAAMwe,CAAN,CAAgB,CACxC,IAAI3Y,EAAO,IAAX,CAEIyqB,CAFJ,CAKIC,CALJ,CAOI2X,CAPJ,CASIC,EAAuC,CAAvCA,CAAqB3pB,CAAAte,OATzB,CAUIkoC,EAAiB,CAVrB,CAWIC,EAAY5jB,CAAA,CAAOzkB,CAAP,CAXhB,CAYIsoC,EAAgB,EAZpB,CAaIC,EAAiB,EAbrB,CAcIC,EAAU,CAAA,CAdd,CAeIC,EAAY,CAsGhB,OAAO,KAAA/jC,OAAA,CApGPgkC,QAA8B,EAAG,CAC/BpY,CAAA,CAAW+X,CAAA,CAAUxiC,CAAV,CADoB,KAE3B8iC,CAF2B,CAEhBloC,CAEf,IAAKwC,CAAA,CAASqtB,CAAT,CAAL,CAKO,GAAIvwB,EAAA,CAAYuwB,CAAZ,CAAJ,CAgBL,IAfIC,CAeKrvB,GAfQonC,CAeRpnC,GAbPqvB,CAEA,CAFW+X,CAEX,CADAG,CACA,CADYlY,CAAArwB,OACZ,CAD8B,CAC9B,CAAAkoC,CAAA,EAWOlnC,EARTynC,CAQSznC,CARGovB,CAAApwB,OAQHgB,CANLunC,CAMKvnC,GANSynC,CAMTznC,GAJPknC,CAAA,EACA,CAAA7X,CAAArwB,OAAA,CAAkBuoC,CAAlB,CAA8BE,CAGvBznC,EAAAA,CAAAA,CAAI,CAAb,CAAgBA,CAAhB,CAAoBynC,CAApB,CAA+BznC,CAAA,EAA/B,CACiBqvB,CAAA,CAASrvB,CAAT,CAEf,GAF+BqvB,CAAA,CAASrvB,CAAT,CAE/B,EADKovB,CAAA,CAASpvB,CAAT,CACL,GADqBovB,CAAA,CAASpvB,CAAT,CACrB,EAAiBqvB,CAAA,CAASrvB,CAAT,CAAjB,GAAiCovB,CAAA,CAASpvB,CAAT,CAAjC,GACEknC,CAAA,EACA,CAAA7X,CAAA,CAASrvB,CAAT,CAAA,CAAcovB,CAAA,CAASpvB,CAAT,CAFhB,CAnBG,KAwBA,CACDqvB,CAAJ,GAAiBgY,CAAjB,GAEEhY,CAEA,CAFWgY,CAEX,CAF4B,EAE5B,CADAE,CACA,CADY,CACZ,CAAAL,CAAA,EAJF,CAOAO,EAAA;AAAY,CACZ,KAAKloC,CAAL,GAAY6vB,EAAZ,CACMA,CAAA3vB,eAAA,CAAwBF,CAAxB,CAAJ,GACEkoC,CAAA,EACA,CAAIpY,CAAA5vB,eAAA,CAAwBF,CAAxB,CAAJ,CACM8vB,CAAA,CAAS9vB,CAAT,CADN,GACwB6vB,CAAA,CAAS7vB,CAAT,CADxB,GAEI2nC,CAAA,EACA,CAAA7X,CAAA,CAAS9vB,CAAT,CAAA,CAAgB6vB,CAAA,CAAS7vB,CAAT,CAHpB,GAMEgoC,CAAA,EAEA,CADAlY,CAAA,CAAS9vB,CAAT,CACA,CADgB6vB,CAAA,CAAS7vB,CAAT,CAChB,CAAA2nC,CAAA,EARF,CAFF,CAcF,IAAIK,CAAJ,CAAgBE,CAAhB,CAGE,IAAIloC,CAAJ,GADA2nC,EAAA,EACW7X,CAAAA,CAAX,CACMA,CAAA5vB,eAAA,CAAwBF,CAAxB,CAAJ,EAAqC,CAAA6vB,CAAA3vB,eAAA,CAAwBF,CAAxB,CAArC,GACEgoC,CAAA,EACA,CAAA,OAAOlY,CAAA,CAAS9vB,CAAT,CAFT,CA5BC,CA7BP,IACM8vB,EAAJ,GAAiBD,CAAjB,GACEC,CACA,CADWD,CACX,CAAA8X,CAAA,EAFF,CA+DF,OAAOA,EApEwB,CAoG1B,CA7BPQ,QAA+B,EAAG,CAC5BJ,CAAJ,EACEA,CACA,CADU,CAAA,CACV,CAAAhqB,CAAA,CAAS8R,CAAT,CAAmBA,CAAnB,CAA6BzqB,CAA7B,CAFF,EAIE2Y,CAAA,CAAS8R,CAAT,CAAmB4X,CAAnB,CAAiCriC,CAAjC,CAIF,IAAIsiC,CAAJ,CACE,GAAKllC,CAAA,CAASqtB,CAAT,CAAL,CAGO,GAAIvwB,EAAA,CAAYuwB,CAAZ,CAAJ,CAA2B,CAChC4X,CAAA,CAAmB3hB,KAAJ,CAAU+J,CAAApwB,OAAV,CACf,KAAK,IAAIgB,EAAI,CAAb,CAAgBA,CAAhB,CAAoBovB,CAAApwB,OAApB,CAAqCgB,CAAA,EAArC,CACEgnC,CAAA,CAAahnC,CAAb,CAAA,CAAkBovB,CAAA,CAASpvB,CAAT,CAHY,CAA3B,IAOL,KAAST,CAAT,GADAynC,EACgB5X,CADD,EACCA,CAAAA,CAAhB,CACM3vB,EAAAC,KAAA,CAAoB0vB,CAApB,CAA8B7vB,CAA9B,CAAJ,GACEynC,CAAA,CAAaznC,CAAb,CADF,CACsB6vB,CAAA,CAAS7vB,CAAT,CADtB,CAXJ,KAEEynC,EAAA,CAAe5X,CAZa,CA6B3B,CAtHiC,CA1Q1B,SAkbP4P,QAAQ,EAAG,CAAA,IACd2I,CADc,CACPxnC,CADO,CACA8X,CADA,CAEd2vB,CAFc,CAGdC,EAAa,IAAAnC,aAHC,CAIdoC,EAAkB,IAAAnC,kBAJJ,CAKd3mC,CALc,CAMd+oC,CANc,CAMPC,EAAMrD,CANC,CAORuB,CAPQ,CAQd+B,EAAW,EARG,CASdC,CATc,CASNC,CATM,CASEC,CAEpBtC,EAAA,CAAW,SAAX,CAEAjB;CAAA,CAAiB,IAEjB,GAAG,CACDkD,CAAA,CAAQ,CAAA,CAGR,KAFA7B,CAEA,CAZ0BxvB,IAY1B,CAAMmxB,CAAA7oC,OAAN,CAAA,CAAyB,CACvB,GAAI,CACFopC,CACA,CADYP,CAAAr2B,MAAA,EACZ,CAAA42B,CAAAz/B,MAAA0/B,MAAA,CAAsBD,CAAA1W,WAAtB,CAFE,CAGF,MAAOvrB,CAAP,CAAU,CAsflBiV,CAAAua,QApfQ,CAofa,IApfb,CAAAlT,CAAA,CAAkBtc,CAAlB,CAFU,CAIZ0+B,CAAA,CAAiB,IARM,CAWzB,CAAA,CACA,EAAG,CACD,GAAK+C,CAAL,CAAgB1B,CAAAf,WAAhB,CAGE,IADAnmC,CACA,CADS4oC,CAAA5oC,OACT,CAAOA,CAAA,EAAP,CAAA,CACE,GAAI,CAIF,GAHA2oC,CAGA,CAHQC,CAAA,CAAS5oC,CAAT,CAGR,CACE,IAAKmB,CAAL,CAAawnC,CAAA5uB,IAAA,CAAUmtB,CAAV,CAAb,KAAsCjuB,CAAtC,CAA6C0vB,CAAA1vB,KAA7C,GACI,EAAE0vB,CAAAjjB,GACA,CAAI1gB,EAAA,CAAO7D,CAAP,CAAc8X,CAAd,CAAJ,CACqB,QADrB,EACK,MAAO9X,EADZ,EACgD,QADhD,EACiC,MAAO8X,EADxC,EAEQqwB,KAAA,CAAMnoC,CAAN,CAFR,EAEwBmoC,KAAA,CAAMrwB,CAAN,CAH1B,CADJ,CAKE8vB,CAIA,CAJQ,CAAA,CAIR,CAHAlD,CAGA,CAHiB8C,CAGjB,CAFAA,CAAA1vB,KAEA,CAFa0vB,CAAAjjB,GAAA,CAAWthB,EAAA,CAAKjD,CAAL,CAAX,CAAyBA,CAEtC,CADAwnC,CAAA/iC,GAAA,CAASzE,CAAT,CAAkB8X,CAAD,GAAUkuB,CAAV,CAA0BhmC,CAA1B,CAAkC8X,CAAnD,CAA0DiuB,CAA1D,CACA,CAAU,CAAV,CAAI8B,CAAJ,GACEE,CAMA,CANS,CAMT,CANaF,CAMb,CALKC,CAAA,CAASC,CAAT,CAKL,GALuBD,CAAA,CAASC,CAAT,CAKvB,CAL0C,EAK1C,EAJAC,CAIA,CAJU3oC,CAAA,CAAWmoC,CAAAxO,IAAX,CACD,CAAH,MAAG,EAAOwO,CAAAxO,IAAArxB,KAAP,EAAyB6/B,CAAAxO,IAAAj3B,SAAA,EAAzB,EACHylC,CAAAxO,IAEN,CADAgP,CACA,EADU,YACV,CADyB/iC,EAAA,CAAOjF,CAAP,CACzB,CADyC,YACzC,CADwDiF,EAAA,CAAO6S,CAAP,CACxD,CAAAgwB,CAAA,CAASC,CAAT,CAAAroC,KAAA,CAAsBsoC,CAAtB,CAPF,CATF,KAkBO,IAAIR,CAAJ,GAAc9C,CAAd,CAA8B,CAGnCkD,CAAA,CAAQ,CAAA,CACR,OAAM,CAJ6B,CAvBrC,CA8BF,MAAO5hC,CAAP,CAAU,CA2ctBiV,CAAAua,QAzcY;AAycS,IAzcT,CAAAlT,CAAA,CAAkBtc,CAAlB,CAFU,CAUhB,GAAI,EAAEoiC,CAAF,CAAUrC,CAAAZ,YAAV,EACCY,CADD,GArEoBxvB,IAqEpB,EACuBwvB,CAAAd,cADvB,CAAJ,CAEE,IAAA,CAAMc,CAAN,GAvEsBxvB,IAuEtB,EAA4B,EAAE6xB,CAAF,CAASrC,CAAAd,cAAT,CAA5B,CAAA,CACEc,CAAA,CAAUA,CAAAhB,QAhDb,CAAH,MAmDUgB,CAnDV,CAmDoBqC,CAnDpB,CAuDA,KAAIR,CAAJ,EAAaF,CAAA7oC,OAAb,GAAmC,CAAEgpC,CAAA,EAArC,CAEE,KAqbN5sB,EAAAua,QArbY,CAqbS,IArbT,CAAAiP,CAAA,CAAiB,QAAjB,CAGFD,CAHE,CAGGv/B,EAAA,CAAO6iC,CAAP,CAHH,CAAN,CAzED,CAAH,MA+ESF,CA/ET,EA+EkBF,CAAA7oC,OA/ElB,CAmFA,KA2aFoc,CAAAua,QA3aE,CA2amB,IA3anB,CAAMmS,CAAA9oC,OAAN,CAAA,CACE,GAAI,CACF8oC,CAAAt2B,MAAA,EAAA,EADE,CAEF,MAAOrL,CAAP,CAAU,CACVsc,CAAA,CAAkBtc,CAAlB,CADU,CArGI,CAlbJ,UAgkBNqO,QAAQ,EAAG,CAEnB,GAAIixB,CAAA,IAAAA,YAAJ,CAAA,CACA,IAAIlkC,EAAS,IAAA2jC,QAEb,KAAA7G,WAAA,CAAgB,UAAhB,CACA,KAAAoH,YAAA,CAAmB,CAAA,CACf,KAAJ,GAAarqB,CAAb,GAEAhc,CAAA,CAAQ,IAAAymC,gBAAR,CAA8BnhC,EAAA,CAAK,IAAL,CAAWuhC,CAAX,CAAmC,IAAnC,CAA9B,CA2BA,CAvBI1kC,CAAA+jC,YAuBJ,EAvB0B,IAuB1B,GAvBgC/jC,CAAA+jC,YAuBhC,CAvBqD,IAAAF,cAuBrD,EAtBI7jC,CAAAgkC,YAsBJ,EAtB0B,IAsB1B;CAtBgChkC,CAAAgkC,YAsBhC,CAtBqD,IAAAF,cAsBrD,EArBI,IAAAA,cAqBJ,GArBwB,IAAAA,cAAAD,cAqBxB,CArB2D,IAAAA,cAqB3D,EApBI,IAAAA,cAoBJ,GApBwB,IAAAA,cAAAC,cAoBxB,CApB2D,IAAAA,cAoB3D,EATA,IAAAH,QASA,CATe,IAAAE,cASf,CAToC,IAAAC,cASpC,CATyD,IAAAC,YASzD,CARI,IAAAC,YAQJ,CARuB,IAAAC,MAQvB,CARoC,IAQpC,CALA,IAAAI,YAKA,CALmB,EAKnB,CAJA,IAAAT,WAIA,CAJkB,IAAAO,aAIlB,CAJsC,IAAAC,kBAItC,CAJ+D,EAI/D,CADA,IAAAnxB,SACA,CADgB,IAAAwqB,QAChB,CAD+B,IAAAl2B,OAC/B,CAD6CrH,CAC7C,CAAA,IAAA+mC,IAAA,CAAW,IAAAhlC,OAAX,CAAyBilC,QAAQ,EAAG,CAAE,MAAOhnC,EAAT,CA7BpC,CALA,CAFmB,CAhkBL,OAmoBT4mC,QAAQ,CAACK,CAAD,CAAO/uB,CAAP,CAAe,CAC5B,MAAO4J,EAAA,CAAOmlB,CAAP,CAAA,CAAa,IAAb,CAAmB/uB,CAAnB,CADqB,CAnoBd,YAoqBJpW,QAAQ,CAACmlC,CAAD,CAAO,CAGpBttB,CAAAua,QAAL;AAA4Bva,CAAAsqB,aAAA1mC,OAA5B,EACE+zB,CAAAnT,MAAA,CAAe,QAAQ,EAAG,CACpBxE,CAAAsqB,aAAA1mC,OAAJ,EACEoc,CAAA4jB,QAAA,EAFsB,CAA1B,CAOF,KAAA0G,aAAA7lC,KAAA,CAAuB,OAAQ,IAAR,YAA0B6oC,CAA1B,CAAvB,CAXyB,CApqBX,cAkrBDC,QAAQ,CAAC/jC,CAAD,CAAK,CAC1B,IAAA+gC,kBAAA9lC,KAAA,CAA4B+E,CAA5B,CAD0B,CAlrBZ,QAmuBRkE,QAAQ,CAAC4/B,CAAD,CAAO,CACrB,GAAI,CAEF,MADA5C,EAAA,CAAW,QAAX,CACO,CAAA,IAAAuC,MAAA,CAAWK,CAAX,CAFL,CAGF,MAAOviC,CAAP,CAAU,CACVsc,CAAA,CAAkBtc,CAAlB,CADU,CAHZ,OAKU,CAsNZiV,CAAAua,QAAA,CAAqB,IApNjB,IAAI,CACFva,CAAA4jB,QAAA,EADE,CAEF,MAAO74B,CAAP,CAAU,CAEV,KADAsc,EAAA,CAAkBtc,CAAlB,CACMA,CAAAA,CAAN,CAFU,CAJJ,CANW,CAnuBP,KA8wBXqiC,QAAQ,CAAC1gC,CAAD,CAAOwV,CAAP,CAAiB,CAC5B,IAAIsrB,EAAiB,IAAAhD,YAAA,CAAiB99B,CAAjB,CAChB8gC,EAAL,GACE,IAAAhD,YAAA,CAAiB99B,CAAjB,CADF,CAC2B8gC,CAD3B,CAC4C,EAD5C,CAGAA,EAAA/oC,KAAA,CAAoByd,CAApB,CAEA,KAAI4oB,EAAU,IACd,GACOA,EAAAL,gBAAA,CAAwB/9B,CAAxB,CAGL,GAFEo+B,CAAAL,gBAAA,CAAwB/9B,CAAxB,CAEF,CAFkC,CAElC,EAAAo+B,CAAAL,gBAAA,CAAwB/9B,CAAxB,CAAA,EAJF,OAKUo+B,CALV,CAKoBA,CAAAhB,QALpB,CAOA;IAAIvgC,EAAO,IACX,OAAO,SAAQ,EAAG,CAChBikC,CAAA,CAAe5lC,EAAA,CAAQ4lC,CAAR,CAAwBtrB,CAAxB,CAAf,CAAA,CAAoD,IACpD2oB,EAAA,CAAuBthC,CAAvB,CAA6B,CAA7B,CAAgCmD,CAAhC,CAFgB,CAhBU,CA9wBd,OA2zBT+gC,QAAQ,CAAC/gC,CAAD,CAAO8R,CAAP,CAAa,CAAA,IACtB1T,EAAQ,EADc,CAEtB0iC,CAFsB,CAGtBjgC,EAAQ,IAHc,CAItB4N,EAAkB,CAAA,CAJI,CAKtBJ,EAAQ,MACArO,CADA,aAEOa,CAFP,iBAGW4N,QAAQ,EAAG,CAACA,CAAA,CAAkB,CAAA,CAAnB,CAHtB,gBAIUH,QAAQ,EAAG,CACzBD,CAAAS,iBAAA,CAAyB,CAAA,CADA,CAJrB,kBAOY,CAAA,CAPZ,CALc,CActBkyB,EAAsBC,CAAC5yB,CAAD4yB,CA92WzB9jC,OAAA,CAAcH,EAAApF,KAAA,CA82WoBwB,SA92WpB,CA82W+Bb,CA92W/B,CAAd,CAg2WyB,CAetBL,CAfsB,CAenBhB,CAEP,GAAG,CACD4pC,CAAA,CAAiBjgC,CAAAi9B,YAAA,CAAkB99B,CAAlB,CAAjB,EAA4C5B,CAC5CiQ,EAAA6yB,aAAA,CAAqBrgC,CAChB3I,EAAA,CAAE,CAAP,KAAUhB,CAAV,CAAiB4pC,CAAA5pC,OAAjB,CAAwCgB,CAAxC,CAA0ChB,CAA1C,CAAkDgB,CAAA,EAAlD,CAGE,GAAK4oC,CAAA,CAAe5oC,CAAf,CAAL,CAMA,GAAI,CAEF4oC,CAAA,CAAe5oC,CAAf,CAAAgF,MAAA,CAAwB,IAAxB,CAA8B8jC,CAA9B,CAFE,CAGF,MAAO3iC,CAAP,CAAU,CACVsc,CAAA,CAAkBtc,CAAlB,CADU,CATZ,IACEyiC,EAAAzlC,OAAA,CAAsBnD,CAAtB,CAAyB,CAAzB,CAEA,CADAA,CAAA,EACA,CAAAhB,CAAA,EAWJ,IAAIuX,CAAJ,CAAqB,KAErB5N,EAAA,CAAQA,CAAAu8B,QAtBP,CAAH,MAuBSv8B,CAvBT,CAyBA,OAAOwN,EA1CmB,CA3zBZ,YA83BJkoB,QAAQ,CAACv2B,CAAD,CAAO8R,CAAP,CAAa,CAgB/B,IAhB+B,IAE3BssB,EADSxvB,IADkB,CAG3B6xB,EAFS7xB,IADkB,CAI3BP,EAAQ,MACArO,CADA;YAHC4O,IAGD,gBAGUN,QAAQ,EAAG,CACzBD,CAAAS,iBAAA,CAAyB,CAAA,CADA,CAHrB,kBAMY,CAAA,CANZ,CAJmB,CAY3BkyB,EAAsBC,CAAC5yB,CAAD4yB,CA/6WzB9jC,OAAA,CAAcH,EAAApF,KAAA,CA+6WoBwB,SA/6WpB,CA+6W+Bb,CA/6W/B,CAAd,CAm6W8B,CAahBL,CAbgB,CAabhB,CAGlB,CAAQknC,CAAR,CAAkBqC,CAAlB,CAAA,CAAyB,CACvBpyB,CAAA6yB,aAAA,CAAqB9C,CACrBrV,EAAA,CAAYqV,CAAAN,YAAA,CAAoB99B,CAApB,CAAZ,EAAyC,EACpC9H,EAAA,CAAE,CAAP,KAAUhB,CAAV,CAAmB6xB,CAAA7xB,OAAnB,CAAqCgB,CAArC,CAAuChB,CAAvC,CAA+CgB,CAAA,EAA/C,CAEE,GAAK6wB,CAAA,CAAU7wB,CAAV,CAAL,CAOA,GAAI,CACF6wB,CAAA,CAAU7wB,CAAV,CAAAgF,MAAA,CAAmB,IAAnB,CAAyB8jC,CAAzB,CADE,CAEF,MAAM3iC,CAAN,CAAS,CACTsc,CAAA,CAAkBtc,CAAlB,CADS,CATX,IACE0qB,EAAA1tB,OAAA,CAAiBnD,CAAjB,CAAoB,CAApB,CAEA,CADAA,CAAA,EACA,CAAAhB,CAAA,EAeJ,IAAI,EAAEupC,CAAF,CAAWrC,CAAAL,gBAAA,CAAwB/9B,CAAxB,CAAX,EAA4Co+B,CAAAZ,YAA5C,EACCY,CADD,GAtCOxvB,IAsCP,EACuBwvB,CAAAd,cADvB,CAAJ,CAEE,IAAA,CAAMc,CAAN,GAxCSxvB,IAwCT,EAA4B,EAAE6xB,CAAF,CAASrC,CAAAd,cAAT,CAA5B,CAAA,CACEc,CAAA,CAAUA,CAAAhB,QA1BS,CA+BzB,MAAO/uB,EA/CwB,CA93BjB,CAi7BlB,KAAIiF,EAAa,IAAI4pB,CAErB,OAAO5pB,EAn/B2D,CADxD,CAZe,CA2iC7BjP,QAASA,GAAqB,EAAG,CAAA,IAC3B4W,EAA6B,mCADF,CAE7BG,EAA8B,qCAkBhC;IAAAH,2BAAA,CAAkCC,QAAQ,CAACC,CAAD,CAAS,CACjD,MAAInhB,EAAA,CAAUmhB,CAAV,CAAJ,EACEF,CACO,CADsBE,CACtB,CAAA,IAFT,EAIOF,CAL0C,CAyBnD,KAAAG,4BAAA,CAAmCC,QAAQ,CAACF,CAAD,CAAS,CAClD,MAAInhB,EAAA,CAAUmhB,CAAV,CAAJ,EACEC,CACO,CADuBD,CACvB,CAAA,IAFT,EAIOC,CAL2C,CAQpD,KAAA1K,KAAA,CAAY4H,QAAQ,EAAG,CACrB,MAAO6oB,SAAoB,CAACC,CAAD,CAAMC,CAAN,CAAe,CACxC,IAAIC,EAAQD,CAAA,CAAUjmB,CAAV,CAAwCH,CAApD,CACIsmB,CAEJ,IAAI,CAACpyB,CAAL,EAAqB,CAArB,EAAaA,CAAb,CAEE,GADAoyB,CACI,CADYpR,EAAA,CAAWiR,CAAX,CAAA9qB,KACZ,CAAkB,EAAlB,GAAAirB,CAAA,EAAwB,CAACA,CAAA7iC,MAAA,CAAoB4iC,CAApB,CAA7B,CACE,MAAO,SAAP,CAAiBC,CAGrB,OAAOH,EAViC,CADrB,CArDQ,CA4FjCI,QAASA,GAAa,CAACC,CAAD,CAAU,CAC9B,GAAgB,MAAhB,GAAIA,CAAJ,CACE,MAAOA,EACF,IAAIrqC,CAAA,CAASqqC,CAAT,CAAJ,CAAuB,CAK5B,GAA8B,EAA9B,CAAIA,CAAAvmC,QAAA,CAAgB,KAAhB,CAAJ,CACE,KAAMwmC,GAAA,CAAW,QAAX,CACsDD,CADtD,CAAN,CAGFA,CAAA,CAA0BA,CAjBrB9iC,QAAA,CAAU,+BAAV,CAA2C,MAA3C,CAAAA,QAAA,CACU,OADV,CACmB,OADnB,CAiBKA,QAAA,CACY,QADZ,CACsB,IADtB,CAAAA,QAAA,CAEY,KAFZ,CAEmB,YAFnB,CAGV,OAAW7C,OAAJ,CAAW,GAAX;AAAiB2lC,CAAjB,CAA2B,GAA3B,CAZqB,CAavB,GAAIpnC,EAAA,CAASonC,CAAT,CAAJ,CAIL,MAAW3lC,OAAJ,CAAW,GAAX,CAAiB2lC,CAAAlmC,OAAjB,CAAkC,GAAlC,CAEP,MAAMmmC,GAAA,CAAW,UAAX,CAAN,CAtB4B,CA4BhCC,QAASA,GAAc,CAACC,CAAD,CAAW,CAChC,IAAIC,EAAmB,EACnB7nC,EAAA,CAAU4nC,CAAV,CAAJ,EACEtqC,CAAA,CAAQsqC,CAAR,CAAkB,QAAQ,CAACH,CAAD,CAAU,CAClCI,CAAA9pC,KAAA,CAAsBypC,EAAA,CAAcC,CAAd,CAAtB,CADkC,CAApC,CAIF,OAAOI,EAPyB,CA4ElC75B,QAASA,GAAoB,EAAG,CAC9B,IAAA85B,aAAA,CAAoBA,EADU,KAI1BC,EAAuB,CAAC,MAAD,CAJG,CAK1BC,EAAuB,EAwB3B,KAAAD,qBAAA,CAA4BE,QAAS,CAAC5pC,CAAD,CAAQ,CACvCe,SAAAlC,OAAJ,GACE6qC,CADF,CACyBJ,EAAA,CAAetpC,CAAf,CADzB,CAGA,OAAO0pC,EAJoC,CAkC7C,KAAAC,qBAAA,CAA4BE,QAAS,CAAC7pC,CAAD,CAAQ,CACvCe,SAAAlC,OAAJ,GACE8qC,CADF,CACyBL,EAAA,CAAetpC,CAAf,CADzB,CAGA,OAAO2pC,EAJoC,CAO7C,KAAAtxB,KAAA,CAAY,CAAC,WAAD,CAAc,QAAQ,CAAC4B,CAAD,CAAY,CA0C5C6vB,QAASA,EAAkB,CAACC,CAAD,CAAO,CAChC,IAAIC,EAAaA,QAA+B,CAACC,CAAD,CAAe,CAC7D,IAAAC,qBAAA,CAA4BC,QAAQ,EAAG,CACrC,MAAOF,EAD8B,CADsB,CAK3DF,EAAJ,GACEC,CAAAnwB,UADF,CACyB,IAAIkwB,CAD7B,CAGAC,EAAAnwB,UAAAwf,QAAA;AAA+B+Q,QAAmB,EAAG,CACnD,MAAO,KAAAF,qBAAA,EAD4C,CAGrDF,EAAAnwB,UAAA9X,SAAA,CAAgCsoC,QAAoB,EAAG,CACrD,MAAO,KAAAH,qBAAA,EAAAnoC,SAAA,EAD8C,CAGvD,OAAOioC,EAfyB,CAxClC,IAAIM,EAAgBA,QAAsB,CAACnkC,CAAD,CAAO,CAC/C,KAAMkjC,GAAA,CAAW,QAAX,CAAN,CAD+C,CAI7CpvB,EAAAF,IAAA,CAAc,WAAd,CAAJ,GACEuwB,CADF,CACkBrwB,CAAArB,IAAA,CAAc,WAAd,CADlB,CAN4C,KA4DxC2xB,EAAyBT,CAAA,EA5De,CA6DxCU,EAAS,EAEbA,EAAA,CAAOf,EAAA5a,KAAP,CAAA,CAA4Bib,CAAA,CAAmBS,CAAnB,CAC5BC,EAAA,CAAOf,EAAAgB,IAAP,CAAA,CAA2BX,CAAA,CAAmBS,CAAnB,CAC3BC,EAAA,CAAOf,EAAAiB,IAAP,CAAA,CAA2BZ,CAAA,CAAmBS,CAAnB,CAC3BC,EAAA,CAAOf,EAAAkB,GAAP,CAAA,CAA0Bb,CAAA,CAAmBS,CAAnB,CAC1BC,EAAA,CAAOf,EAAA3a,aAAP,CAAA,CAAoCgb,CAAA,CAAmBU,CAAA,CAAOf,EAAAiB,IAAP,CAAnB,CAyGpC,OAAO,SAtFPE,QAAgB,CAACl3B,CAAD,CAAOu2B,CAAP,CAAqB,CACnC,IAAItwB,EAAe6wB,CAAAlrC,eAAA,CAAsBoU,CAAtB,CAAA,CAA8B82B,CAAA,CAAO92B,CAAP,CAA9B,CAA6C,IAChE,IAAI,CAACiG,CAAL,CACE,KAAM0vB,GAAA,CAAW,UAAX,CAEF31B,CAFE,CAEIu2B,CAFJ,CAAN,CAIF,GAAqB,IAArB,GAAIA,CAAJ,EAA6BA,CAA7B,GAA8CzrC,CAA9C,EAA4E,EAA5E,GAA2DyrC,CAA3D,CACE,MAAOA,EAIT,IAA4B,QAA5B,GAAI,MAAOA,EAAX,CACE,KAAMZ,GAAA,CAAW,OAAX,CAEF31B,CAFE,CAAN,CAIF,MAAO,KAAIiG,CAAJ,CAAgBswB,CAAhB,CAjB4B,CAsF9B;WAzBP7Q,QAAmB,CAAC1lB,CAAD,CAAOm3B,CAAP,CAAqB,CACtC,GAAqB,IAArB,GAAIA,CAAJ,EAA6BA,CAA7B,GAA8CrsC,CAA9C,EAA4E,EAA5E,GAA2DqsC,CAA3D,CACE,MAAOA,EAET,KAAI/gC,EAAe0gC,CAAAlrC,eAAA,CAAsBoU,CAAtB,CAAA,CAA8B82B,CAAA,CAAO92B,CAAP,CAA9B,CAA6C,IAChE,IAAI5J,CAAJ,EAAmB+gC,CAAnB,WAA2C/gC,EAA3C,CACE,MAAO+gC,EAAAX,qBAAA,EAKT,IAAIx2B,CAAJ,GAAa+1B,EAAA3a,aAAb,CAAwC,CAzIpC8L,IAAAA,EAAY9C,EAAA,CA0ImB+S,CA1IR9oC,SAAA,EAAX,CAAZ64B,CACA/6B,CADA+6B,CACGna,CADHma,CACMkQ,EAAU,CAAA,CAEfjrC,EAAA,CAAI,CAAT,KAAY4gB,CAAZ,CAAgBipB,CAAA7qC,OAAhB,CAA6CgB,CAA7C,CAAiD4gB,CAAjD,CAAoD5gB,CAAA,EAApD,CACE,GAbc,MAAhB,GAae6pC,CAAAN,CAAqBvpC,CAArBupC,CAbf,CACSpV,EAAA,CAY+B4G,CAZ/B,CADT,CAae8O,CAAAN,CAAqBvpC,CAArBupC,CATJthC,KAAA,CAS6B8yB,CAThB3c,KAAb,CAST,CAAkD,CAChD6sB,CAAA,CAAU,CAAA,CACV,MAFgD,CAKpD,GAAIA,CAAJ,CAEE,IAAKjrC,CAAO,CAAH,CAAG,CAAA4gB,CAAA,CAAIkpB,CAAA9qC,OAAhB,CAA6CgB,CAA7C,CAAiD4gB,CAAjD,CAAoD5gB,CAAA,EAApD,CACE,GArBY,MAAhB,GAqBiB8pC,CAAAP,CAAqBvpC,CAArBupC,CArBjB,CACSpV,EAAA,CAoBiC4G,CApBjC,CADT,CAqBiB+O,CAAAP,CAAqBvpC,CAArBupC,CAjBNthC,KAAA,CAiB+B8yB,CAjBlB3c,KAAb,CAiBP,CAAkD,CAChD6sB,CAAA,CAAU,CAAA,CACV,MAFgD,CA8HpD,GAxHKA,CAwHL,CACE,MAAOD,EAEP,MAAMxB,GAAA,CAAW,UAAX,CAEFwB,CAAA9oC,SAAA,EAFE,CAAN,CAJoC,CAQjC,GAAI2R,CAAJ,GAAa+1B,EAAA5a,KAAb,CACL,MAAOyb,EAAA,CAAcO,CAAd,CAET,MAAMxB,GAAA,CAAW,QAAX,CAAN,CAtBsC,CAyBjC,SAhDPhQ,QAAgB,CAACwR,CAAD,CAAe,CAC7B,MAAIA,EAAJ;AAA4BN,CAA5B,CACSM,CAAAX,qBAAA,EADT,CAGSW,CAJoB,CAgDxB,CA5KqC,CAAlC,CAtEkB,CAmhBhCn7B,QAASA,GAAY,EAAG,CACtB,IAAIq7B,EAAU,CAAA,CAad,KAAAA,QAAA,CAAeC,QAAS,CAAChrC,CAAD,CAAQ,CAC1Be,SAAAlC,OAAJ,GACEksC,CADF,CACY,CAAC,CAAC/qC,CADd,CAGA,OAAO+qC,EAJuB,CAsDhC,KAAA1yB,KAAA,CAAY,CAAC,QAAD,CAAW,UAAX,CAAuB,cAAvB,CAAuC,QAAQ,CAC7C+K,CAD6C,CACnCnH,CADmC,CACvBgvB,CADuB,CACT,CAGhD,GAAIF,CAAJ,EAAe9uB,CAAAnF,KAAf,EAA4D,CAA5D,CAAgCmF,CAAAivB,iBAAhC,CACE,KAAM7B,GAAA,CAAW,UAAX,CAAN,CAMF,IAAI8B,EAAMloC,EAAA,CAAKwmC,EAAL,CAaV0B,EAAAC,UAAA,CAAgBC,QAAS,EAAG,CAC1B,MAAON,EADmB,CAG5BI,EAAAP,QAAA,CAAcK,CAAAL,QACdO,EAAA/R,WAAA,CAAiB6R,CAAA7R,WACjB+R,EAAA9R,QAAA,CAAc4R,CAAA5R,QAET0R,EAAL,GACEI,CAAAP,QACA,CADcO,CAAA/R,WACd,CAD+BkS,QAAQ,CAAC53B,CAAD,CAAO1T,CAAP,CAAc,CAAE,MAAOA,EAAT,CACrD,CAAAmrC,CAAA9R,QAAA,CAAc93B,EAFhB,CAwBA4pC,EAAAI,QAAA,CAAcC,QAAmB,CAAC93B,CAAD,CAAO60B,CAAP,CAAa,CAC5C,IAAIz2B,EAASsR,CAAA,CAAOmlB,CAAP,CACb,OAAIz2B,EAAAqY,QAAJ,EAAsBrY,CAAAoI,SAAtB,CACSpI,CADT,CAGS25B,QAA0B,CAACjnC,CAAD,CAAOgV,CAAP,CAAe,CAC9C,MAAO2xB,EAAA/R,WAAA,CAAe1lB,CAAf;AAAqB5B,CAAA,CAAOtN,CAAP,CAAagV,CAAb,CAArB,CADuC,CALN,CAtDE,KAoT5CjU,EAAQ4lC,CAAAI,QApToC,CAqT5CnS,EAAa+R,CAAA/R,WArT+B,CAsT5CwR,EAAUO,CAAAP,QAEd3rC,EAAA,CAAQwqC,EAAR,CAAsB,QAAS,CAACiC,CAAD,CAAY/jC,CAAZ,CAAkB,CAC/C,IAAIgkC,EAAQjmC,CAAA,CAAUiC,CAAV,CACZwjC,EAAA,CAAIj7B,EAAA,CAAU,WAAV,CAAwBy7B,CAAxB,CAAJ,CAAA,CAAsC,QAAS,CAACpD,CAAD,CAAO,CACpD,MAAOhjC,EAAA,CAAMmmC,CAAN,CAAiBnD,CAAjB,CAD6C,CAGtD4C,EAAA,CAAIj7B,EAAA,CAAU,cAAV,CAA2By7B,CAA3B,CAAJ,CAAA,CAAyC,QAAS,CAAC3rC,CAAD,CAAQ,CACxD,MAAOo5B,EAAA,CAAWsS,CAAX,CAAsB1rC,CAAtB,CADiD,CAG1DmrC,EAAA,CAAIj7B,EAAA,CAAU,WAAV,CAAwBy7B,CAAxB,CAAJ,CAAA,CAAsC,QAAS,CAAC3rC,CAAD,CAAQ,CACrD,MAAO4qC,EAAA,CAAQc,CAAR,CAAmB1rC,CAAnB,CAD8C,CARR,CAAjD,CAaA,OAAOmrC,EArUyC,CADtC,CApEU,CA6ZxBv7B,QAASA,GAAgB,EAAG,CAC1B,IAAAyI,KAAA,CAAY,CAAC,SAAD,CAAY,WAAZ,CAAyB,QAAQ,CAAC0C,CAAD,CAAUiF,CAAV,CAAqB,CAAA,IAC5D4rB,EAAe,EAD6C,CAE5DC,EACE7qC,CAAA,CAAI,CAAC,eAAA8G,KAAA,CAAqBpC,CAAA,CAAWomC,CAAA/wB,CAAAgxB,UAAAD,EAAqB,EAArBA,WAAX,CAArB,CAAD,EAAyE,EAAzE,EAA6E,CAA7E,CAAJ,CAH0D,CAI5DE,EAAQ,QAAAljC,KAAA,CAAegjC,CAAA/wB,CAAAgxB,UAAAD,EAAqB,EAArBA,WAAf,CAJoD,CAK5DvtC,EAAWyhB,CAAA,CAAU,CAAV,CAAXzhB,EAA2B,EALiC,CAM5D0tC,EAAe1tC,CAAA0tC,aAN6C,CAO5DC,CAP4D,CAQ5DC,EAAc,6BAR8C,CAS5DC,EAAY7tC,CAAA64B,KAAZgV,EAA6B7tC,CAAA64B,KAAAiV,MAT+B;AAU5DC,EAAc,CAAA,CAV8C,CAW5DC,EAAa,CAAA,CAGjB,IAAIH,CAAJ,CAAe,CACb,IAAI7pC,IAAIA,CAAR,GAAgB6pC,EAAhB,CACE,GAAG/lC,CAAH,CAAW8lC,CAAArkC,KAAA,CAAiBvF,CAAjB,CAAX,CAAmC,CACjC2pC,CAAA,CAAe7lC,CAAA,CAAM,CAAN,CACf6lC,EAAA,CAAeA,CAAAllB,OAAA,CAAoB,CAApB,CAAuB,CAAvB,CAAA1W,YAAA,EAAf,CAAyD47B,CAAAllB,OAAA,CAAoB,CAApB,CACzD,MAHiC,CAOjCklB,CAAJ,GACEA,CADF,CACkB,eADlB,EACqCE,EADrC,EACmD,QADnD,CAIAE,EAAA,CAAc,CAAC,EAAG,YAAH,EAAmBF,EAAnB,EAAkCF,CAAlC,CAAiD,YAAjD,EAAiEE,EAAjE,CACfG,EAAA,CAAc,CAAC,EAAG,WAAH,EAAkBH,EAAlB,EAAiCF,CAAjC,CAAgD,WAAhD,EAA+DE,EAA/D,CAEXP,EAAAA,CAAJ,EAAiBS,CAAjB,EAA+BC,CAA/B,GACED,CACA,CADcvtC,CAAA,CAASR,CAAA64B,KAAAiV,MAAAG,iBAAT,CACd,CAAAD,CAAA,CAAaxtC,CAAA,CAASR,CAAA64B,KAAAiV,MAAAI,gBAAT,CAFf,CAhBa,CAuBf,MAAO,SAUI,EAAGpvB,CAAAtC,CAAAsC,QAAH,EAAsBgB,CAAAtD,CAAAsC,QAAAgB,UAAtB,EAA+D,CAA/D,CAAqDwtB,CAArD,EAAsEG,CAAtE,CAVJ,YAYO,cAZP,EAYyBjxB,EAZzB,GAcQ,CAACkxB,CAdT,EAcwC,CAdxC,CAcyBA,CAdzB,WAeKS,QAAQ,CAAC12B,CAAD,CAAQ,CAIxB,GAAa,OAAb,EAAIA,CAAJ,EAAgC,CAAhC,EAAwBc,CAAxB,CAAmC,MAAO,CAAA,CAE1C,IAAIpV,CAAA,CAAYkqC,CAAA,CAAa51B,CAAb,CAAZ,CAAJ,CAAsC,CACpC,IAAI22B,EAASpuC,CAAA8T,cAAA,CAAuB,KAAvB,CACbu5B,EAAA,CAAa51B,CAAb,CAAA,CAAsB,IAAtB;AAA6BA,CAA7B,GAAsC22B,EAFF,CAKtC,MAAOf,EAAA,CAAa51B,CAAb,CAXiB,CAfrB,KA4BA7R,EAAA,EA5BA,cA6BS+nC,CA7BT,aA8BSI,CA9BT,YA+BQC,CA/BR,SAgCIV,CAhCJ,MAiCE/0B,CAjCF,kBAkCam1B,CAlCb,CArCyD,CAAtD,CADc,CA6E5Bn8B,QAASA,GAAgB,EAAG,CAC1B,IAAAuI,KAAA,CAAY,CAAC,YAAD,CAAe,UAAf,CAA2B,IAA3B,CAAiC,mBAAjC,CACP,QAAQ,CAAC4C,CAAD,CAAe2X,CAAf,CAA2BC,CAA3B,CAAiCvQ,CAAjC,CAAoD,CA6B/D4T,QAASA,EAAO,CAACzxB,CAAD,CAAKkb,CAAL,CAAY+Z,CAAZ,CAAyB,CAAA,IACnCjE,EAAW5C,CAAApT,MAAA,EADwB,CAEnCgV,EAAUgB,CAAAhB,QAFyB,CAGnCoF,EAAal4B,CAAA,CAAU+3B,CAAV,CAAbG,EAAuC,CAACH,CAG5C9Z,EAAA,CAAYgT,CAAAnT,MAAA,CAAe,QAAQ,EAAG,CACpC,GAAI,CACFgW,CAAAC,QAAA,CAAiBjxB,CAAA,EAAjB,CADE,CAEF,MAAMuB,CAAN,CAAS,CACTyvB,CAAAvC,OAAA,CAAgBltB,CAAhB,CACA,CAAAsc,CAAA,CAAkBtc,CAAlB,CAFS,CAFX,OAMQ,CACN,OAAO4mC,CAAA,CAAUnY,CAAAoY,YAAV,CADD,CAIHhT,CAAL,EAAgB5e,CAAAtS,OAAA,EAXoB,CAA1B,CAYTgX,CAZS,CAcZ8U,EAAAoY,YAAA,CAAsBjtB,CACtBgtB,EAAA,CAAUhtB,CAAV,CAAA,CAAuB6V,CAEvB,OAAOhB,EAvBgC,CA5BzC,IAAImY,EAAY,EAmEhB1W,EAAArW,OAAA,CAAiBitB,QAAQ,CAACrY,CAAD,CAAU,CACjC,MAAIA,EAAJ,EAAeA,CAAAoY,YAAf,GAAsCD,EAAtC,EACEA,CAAA,CAAUnY,CAAAoY,YAAV,CAAA3Z,OAAA,CAAsC,UAAtC,CAEO;AADP,OAAO0Z,CAAA,CAAUnY,CAAAoY,YAAV,CACA,CAAAja,CAAAnT,MAAAI,OAAA,CAAsB4U,CAAAoY,YAAtB,CAHT,EAKO,CAAA,CAN0B,CASnC,OAAO3W,EA7EwD,CADrD,CADc,CAkJ5B4B,QAASA,GAAU,CAAC7a,CAAD,CAAM8vB,CAAN,CAAY,CAC7B,IAAI9uB,EAAOhB,CAEPnG,EAAJ,GAGEk2B,CAAAh4B,aAAA,CAA4B,MAA5B,CAAoCiJ,CAApC,CACA,CAAAA,CAAA,CAAO+uB,CAAA/uB,KAJT,CAOA+uB,EAAAh4B,aAAA,CAA4B,MAA5B,CAAoCiJ,CAApC,CAGA,OAAO,MACC+uB,CAAA/uB,KADD,UAEK+uB,CAAAjV,SAAA,CAA0BiV,CAAAjV,SAAAzxB,QAAA,CAAgC,IAAhC,CAAsC,EAAtC,CAA1B,CAAsE,EAF3E,MAGC0mC,CAAAv3B,KAHD,QAIGu3B,CAAAvR,OAAA,CAAwBuR,CAAAvR,OAAAn1B,QAAA,CAA8B,KAA9B,CAAqC,EAArC,CAAxB,CAAmE,EAJtE,MAKC0mC,CAAA3xB,KAAA,CAAsB2xB,CAAA3xB,KAAA/U,QAAA,CAA4B,IAA5B,CAAkC,EAAlC,CAAtB,CAA8D,EAL/D,UAMK0mC,CAAAjS,SANL,MAOCiS,CAAA/R,KAPD,UAQ4C,GACvC,GADC+R,CAAAzR,SAAA33B,OAAA,CAA+B,CAA/B,CACD,CAANopC,CAAAzR,SAAM,CACN,GADM,CACAyR,CAAAzR,SAVL,CAbsB,CAkC/BvH,QAASA,GAAe,CAACiZ,CAAD,CAAa,CAC/Bn7B,CAAAA,CAAU/S,CAAA,CAASkuC,CAAT,CAAD,CAAyBnV,EAAA,CAAWmV,CAAX,CAAzB,CAAkDA,CAC/D,OAAQn7B,EAAAimB,SAAR,GAA4BmV,EAAAnV,SAA5B,EACQjmB,CAAA2D,KADR,GACwBy3B,EAAAz3B,KAHW,CAr0bE;AAm3bvC1F,QAASA,GAAe,EAAE,CACxB,IAAAsI,KAAA,CAAY5W,EAAA,CAAQnD,CAAR,CADY,CA+E1B0Q,QAASA,GAAe,CAAC3G,CAAD,CAAW,CAWjCgpB,QAASA,EAAQ,CAAC1pB,CAAD,CAAOkD,CAAP,CAAgB,CAC/B,GAAGjJ,CAAA,CAAS+F,CAAT,CAAH,CAAmB,CACjB,IAAIwlC,EAAU,EACdluC,EAAA,CAAQ0I,CAAR,CAAc,QAAQ,CAACmJ,CAAD,CAAS1R,CAAT,CAAc,CAClC+tC,CAAA,CAAQ/tC,CAAR,CAAA,CAAeiyB,CAAA,CAASjyB,CAAT,CAAc0R,CAAd,CADmB,CAApC,CAGA,OAAOq8B,EALU,CAOjB,MAAO9kC,EAAAwC,QAAA,CAAiBlD,CAAjB,CAAwBylC,CAAxB,CAAgCviC,CAAhC,CARsB,CAVjC,IAAIuiC,EAAS,QAqBb,KAAA/b,SAAA,CAAgBA,CAEhB,KAAAhZ,KAAA,CAAY,CAAC,WAAD,CAAc,QAAQ,CAAC4B,CAAD,CAAY,CAC5C,MAAO,SAAQ,CAACtS,CAAD,CAAO,CACpB,MAAOsS,EAAArB,IAAA,CAAcjR,CAAd,CAAqBylC,CAArB,CADa,CADsB,CAAlC,CAoBZ/b,EAAA,CAAS,UAAT,CAAqBgc,EAArB,CACAhc,EAAA,CAAS,MAAT,CAAiBic,EAAjB,CACAjc,EAAA,CAAS,QAAT,CAAmBkc,EAAnB,CACAlc,EAAA,CAAS,MAAT,CAAiBmc,EAAjB,CACAnc,EAAA,CAAS,SAAT,CAAoBoc,EAApB,CACApc,EAAA,CAAS,WAAT,CAAsBqc,EAAtB,CACArc,EAAA,CAAS,QAAT,CAAmBsc,EAAnB,CACAtc,EAAA,CAAS,SAAT,CAAoBuc,EAApB,CACAvc,EAAA,CAAS,WAAT,CAAsBwc,EAAtB,CApDiC,CAwKnCN,QAASA,GAAY,EAAG,CACtB,MAAO,SAAQ,CAACzqC,CAAD,CAAQyuB,CAAR,CAAoBuc,CAApB,CAAgC,CAC7C,GAAI,CAAC9uC,CAAA,CAAQ8D,CAAR,CAAL,CAAqB,MAAOA,EADiB,KAGzCirC,EAAiB,MAAOD,EAHiB,CAIzCE,EAAa,EAEjBA,EAAAtxB,MAAA,CAAmBuxB,QAAQ,CAACjuC,CAAD,CAAQ,CACjC,IAAK,IAAI+S,EAAI,CAAb,CAAgBA,CAAhB,CAAoBi7B,CAAAnvC,OAApB,CAAuCkU,CAAA,EAAvC,CACE,GAAG,CAACi7B,CAAA,CAAWj7B,CAAX,CAAA,CAAc/S,CAAd,CAAJ,CACE,MAAO,CAAA,CAGX;MAAO,CAAA,CAN0B,CASZ,WAAvB,GAAI+tC,CAAJ,GAEID,CAFJ,CACyB,SAAvB,GAAIC,CAAJ,EAAoCD,CAApC,CACeA,QAAQ,CAACnvC,CAAD,CAAM2vB,CAAN,CAAY,CAC/B,MAAOvlB,GAAAlF,OAAA,CAAelF,CAAf,CAAoB2vB,CAApB,CADwB,CADnC,CAKewf,QAAQ,CAACnvC,CAAD,CAAM2vB,CAAN,CAAY,CAC/B,GAAI3vB,CAAJ,EAAW2vB,CAAX,EAAkC,QAAlC,GAAmB,MAAO3vB,EAA1B,EAA8D,QAA9D,GAA8C,MAAO2vB,EAArD,CAAwE,CACtE,IAAK4f,IAAIA,CAAT,GAAmBvvC,EAAnB,CACE,GAAyB,GAAzB,GAAIuvC,CAAAtqC,OAAA,CAAc,CAAd,CAAJ,EAAgCtE,EAAAC,KAAA,CAAoBZ,CAApB,CAAyBuvC,CAAzB,CAAhC,EACIJ,CAAA,CAAWnvC,CAAA,CAAIuvC,CAAJ,CAAX,CAAwB5f,CAAA,CAAK4f,CAAL,CAAxB,CADJ,CAEE,MAAO,CAAA,CAGX,OAAO,CAAA,CAP+D,CASxE5f,CAAA,CAAQ9kB,CAAA,EAAAA,CAAG8kB,CAAH9kB,aAAA,EACR,OAA+C,EAA/C,CAAQA,CAAA,EAAAA,CAAG7K,CAAH6K,aAAA,EAAA3G,QAAA,CAA8ByrB,CAA9B,CAXuB,CANrC,CAsBA,KAAImN,EAASA,QAAQ,CAAC98B,CAAD,CAAM2vB,CAAN,CAAW,CAC9B,GAAmB,QAAnB,EAAI,MAAOA,EAAX,EAAkD,GAAlD,GAA+BA,CAAA1qB,OAAA,CAAY,CAAZ,CAA/B,CACE,MAAO,CAAC63B,CAAA,CAAO98B,CAAP,CAAY2vB,CAAAtH,OAAA,CAAY,CAAZ,CAAZ,CAEV,QAAQ,MAAOroB,EAAf,EACE,KAAK,SAAL,CACA,KAAK,QAAL,CACA,KAAK,QAAL,CACE,MAAOmvC,EAAA,CAAWnvC,CAAX,CAAgB2vB,CAAhB,CACT,MAAK,QAAL,CACE,OAAQ,MAAOA,EAAf,EACE,KAAK,QAAL,CACE,MAAOwf,EAAA,CAAWnvC,CAAX;AAAgB2vB,CAAhB,CACT,SACE,IAAM4f,IAAIA,CAAV,GAAoBvvC,EAApB,CACE,GAAyB,GAAzB,GAAIuvC,CAAAtqC,OAAA,CAAc,CAAd,CAAJ,EAAgC63B,CAAA,CAAO98B,CAAA,CAAIuvC,CAAJ,CAAP,CAAoB5f,CAApB,CAAhC,CACE,MAAO,CAAA,CANf,CAWA,MAAO,CAAA,CACT,MAAK,OAAL,CACE,IAAUzuB,CAAV,CAAc,CAAd,CAAiBA,CAAjB,CAAqBlB,CAAAE,OAArB,CAAiCgB,CAAA,EAAjC,CACE,GAAI47B,CAAA,CAAO98B,CAAA,CAAIkB,CAAJ,CAAP,CAAeyuB,CAAf,CAAJ,CACE,MAAO,CAAA,CAGX,OAAO,CAAA,CACT,SACE,MAAO,CAAA,CA1BX,CAJ8B,CAiChC,QAAQ,MAAOiD,EAAf,EACE,KAAK,SAAL,CACA,KAAK,QAAL,CACA,KAAK,QAAL,CAEEA,CAAA,CAAa,GAAGA,CAAH,CAEf,MAAK,QAAL,CAEE,IAAKnyB,IAAIA,CAAT,GAAgBmyB,EAAhB,CACG,SAAQ,CAACtnB,CAAD,CAAO,CACiB,WAA/B,EAAI,MAAOsnB,EAAA,CAAWtnB,CAAX,CAAX,EACA+jC,CAAAtuC,KAAA,CAAgB,QAAQ,CAACM,CAAD,CAAQ,CAC9B,MAAOy7B,EAAA,CAAe,GAAR,EAAAxxB,CAAA,CAAcjK,CAAd,CAAuBA,CAAvB,EAAgCA,CAAA,CAAMiK,CAAN,CAAvC,CAAqDsnB,CAAA,CAAWtnB,CAAX,CAArD,CADuB,CAAhC,CAFc,CAAf,CAAA,CAKE7K,CALF,CAOH,MACF,MAAK,UAAL,CACE4uC,CAAAtuC,KAAA,CAAgB6xB,CAAhB,CACA,MACF,SACE,MAAOzuB,EAtBX,CAwBIqrC,CAAAA,CAAW,EACf,KAAUp7B,CAAV,CAAc,CAAd,CAAiBA,CAAjB,CAAqBjQ,CAAAjE,OAArB,CAAmCkU,CAAA,EAAnC,CAAwC,CACtC,IAAI/S,EAAQ8C,CAAA,CAAMiQ,CAAN,CACRi7B,EAAAtxB,MAAA,CAAiB1c,CAAjB,CAAJ,EACEmuC,CAAAzuC,KAAA,CAAcM,CAAd,CAHoC,CAMxC,MAAOmuC,EArGsC,CADzB,CA0JxBd,QAASA,GAAc,CAACe,CAAD,CAAU,CAC/B,IAAIC;AAAUD,CAAAE,eACd,OAAO,SAAQ,CAACC,CAAD,CAASC,CAAT,CAAwB,CACjC9sC,CAAA,CAAY8sC,CAAZ,CAAJ,GAAiCA,CAAjC,CAAkDH,CAAAI,aAAlD,CACA,OAAOC,GAAA,CAAaH,CAAb,CAAqBF,CAAAM,SAAA,CAAiB,CAAjB,CAArB,CAA0CN,CAAAO,UAA1C,CAA6DP,CAAAQ,YAA7D,CAAkF,CAAlF,CAAAvoC,QAAA,CACa,SADb,CACwBkoC,CADxB,CAF8B,CAFR,CA4DjCb,QAASA,GAAY,CAACS,CAAD,CAAU,CAC7B,IAAIC,EAAUD,CAAAE,eACd,OAAO,SAAQ,CAACQ,CAAD,CAASC,CAAT,CAAuB,CACpC,MAAOL,GAAA,CAAaI,CAAb,CAAqBT,CAAAM,SAAA,CAAiB,CAAjB,CAArB,CAA0CN,CAAAO,UAA1C,CAA6DP,CAAAQ,YAA7D,CACLE,CADK,CAD6B,CAFT,CAS/BL,QAASA,GAAY,CAACI,CAAD,CAASE,CAAT,CAAkBC,CAAlB,CAA4BC,CAA5B,CAAwCH,CAAxC,CAAsD,CACzE,GAAc,IAAd,EAAID,CAAJ,EAAsB,CAACK,QAAA,CAASL,CAAT,CAAvB,EAA2CltC,CAAA,CAASktC,CAAT,CAA3C,CAA6D,MAAO,EAEpE,KAAIM,EAAsB,CAAtBA,CAAaN,CACjBA,EAAA,CAASxiB,IAAA+iB,IAAA,CAASP,CAAT,CAJgE,KAKrEQ,EAASR,CAATQ,CAAkB,EALmD,CAMrEC,EAAe,EANsD,CAOrEzoC,EAAQ,EAP6D,CASrE0oC,EAAc,CAAA,CAClB,IAA6B,EAA7B,GAAIF,CAAAzsC,QAAA,CAAe,GAAf,CAAJ,CAAgC,CAC9B,IAAIwD,EAAQipC,CAAAjpC,MAAA,CAAa,qBAAb,CACRA,EAAJ,EAAyB,GAAzB,EAAaA,CAAA,CAAM,CAAN,CAAb,EAAgCA,CAAA,CAAM,CAAN,CAAhC,CAA2C0oC,CAA3C,CAA0D,CAA1D,CACEO,CADF,CACW,GADX,EAGEC,CACA,CADeD,CACf,CAAAE,CAAA,CAAc,CAAA,CAJhB,CAF8B,CAUhC,GAAKA,CAAL,CA2CqB,CAAnB,CAAIT,CAAJ,GAAkC,EAAlC,CAAwBD,CAAxB,EAAgD,CAAhD,CAAuCA,CAAvC,IACES,CADF,CACiBT,CAAAW,QAAA,CAAeV,CAAf,CADjB,CA3CF;IAAkB,CACZW,CAAAA,CAAe7wC,CAAAywC,CAAA1oC,MAAA,CAAaioC,EAAb,CAAA,CAA0B,CAA1B,CAAAhwC,EAAgC,EAAhCA,QAGf6C,EAAA,CAAYqtC,CAAZ,CAAJ,GACEA,CADF,CACiBziB,IAAAqjB,IAAA,CAASrjB,IAAAC,IAAA,CAASyiB,CAAAY,QAAT,CAA0BF,CAA1B,CAAT,CAAiDV,CAAAa,QAAjD,CADjB,CAIIC,EAAAA,CAAMxjB,IAAAwjB,IAAA,CAAS,EAAT,CAAaf,CAAb,CACVD,EAAA,CAASxiB,IAAAyjB,MAAA,CAAWjB,CAAX,CAAoBgB,CAApB,CAAT,CAAoCA,CAChCE,EAAAA,CAAYppC,CAAA,EAAAA,CAAKkoC,CAALloC,OAAA,CAAmBioC,EAAnB,CACZhT,EAAAA,CAAQmU,CAAA,CAAS,CAAT,CACZA,EAAA,CAAWA,CAAA,CAAS,CAAT,CAAX,EAA0B,EAEnBzmC,KAAAA,EAAM,CAANA,CACH0mC,EAASjB,CAAAkB,OADN3mC,CAEH4mC,EAAQnB,CAAAoB,MAEZ,IAAIvU,CAAAh9B,OAAJ,EAAqBoxC,CAArB,CAA8BE,CAA9B,CAEE,IADA5mC,CACK,CADCsyB,CAAAh9B,OACD,CADgBoxC,CAChB,CAAApwC,CAAA,CAAI,CAAT,CAAYA,CAAZ,CAAgB0J,CAAhB,CAAqB1J,CAAA,EAArB,CAC0B,CAGxB,IAHK0J,CAGL,CAHW1J,CAGX,EAHcswC,CAGd,EAHmC,CAGnC,GAH6BtwC,CAG7B,GAFE0vC,CAEF,EAFkBN,CAElB,EAAAM,CAAA,EAAgB1T,CAAAj4B,OAAA,CAAa/D,CAAb,CAIpB,KAAKA,CAAL,CAAS0J,CAAT,CAAc1J,CAAd,CAAkBg8B,CAAAh9B,OAAlB,CAAgCgB,CAAA,EAAhC,CACoC,CAGlC,IAHKg8B,CAAAh9B,OAGL,CAHoBgB,CAGpB,EAHuBowC,CAGvB,EAH6C,CAG7C,GAHuCpwC,CAGvC,GAFE0vC,CAEF,EAFkBN,CAElB,EAAAM,CAAA,EAAgB1T,CAAAj4B,OAAA,CAAa/D,CAAb,CAIlB,KAAA,CAAMmwC,CAAAnxC,OAAN,CAAwBkwC,CAAxB,CAAA,CACEiB,CAAA,EAAY,GAGVjB,EAAJ,EAAqC,GAArC,GAAoBA,CAApB,GAA0CQ,CAA1C,EAA0DL,CAA1D,CAAuEc,CAAAhpB,OAAA,CAAgB,CAAhB,CAAmB+nB,CAAnB,CAAvE,CAxCgB,CAgDlBjoC,CAAApH,KAAA,CAAW0vC,CAAA,CAAaJ,CAAAqB,OAAb,CAA8BrB,CAAAsB,OAAzC,CACAxpC,EAAApH,KAAA,CAAW6vC,CAAX,CACAzoC,EAAApH,KAAA,CAAW0vC,CAAA,CAAaJ,CAAAuB,OAAb,CAA8BvB,CAAAwB,OAAzC,CACA,OAAO1pC,EAAAxG,KAAA,CAAW,EAAX,CAvEkE,CA0E3EmwC,QAASA,GAAS,CAACpW,CAAD;AAAMqW,CAAN,CAAc9+B,CAAd,CAAoB,CACpC,IAAI++B,EAAM,EACA,EAAV,CAAItW,CAAJ,GACEsW,CACA,CADO,GACP,CAAAtW,CAAA,CAAM,CAACA,CAFT,CAKA,KADAA,CACA,CADM,EACN,CADWA,CACX,CAAMA,CAAAx7B,OAAN,CAAmB6xC,CAAnB,CAAA,CAA2BrW,CAAA,CAAM,GAAN,CAAYA,CACnCzoB,EAAJ,GACEyoB,CADF,CACQA,CAAArT,OAAA,CAAWqT,CAAAx7B,OAAX,CAAwB6xC,CAAxB,CADR,CAEA,OAAOC,EAAP,CAAatW,CAVuB,CActCuW,QAASA,EAAU,CAACjpC,CAAD,CAAOoZ,CAAP,CAAa1Q,CAAb,CAAqBuB,CAArB,CAA2B,CAC5CvB,CAAA,CAASA,CAAT,EAAmB,CACnB,OAAO,SAAQ,CAACwgC,CAAD,CAAO,CAChB7wC,CAAAA,CAAQ6wC,CAAA,CAAK,KAAL,CAAalpC,CAAb,CAAA,EACZ,IAAa,CAAb,CAAI0I,CAAJ,EAAkBrQ,CAAlB,CAA0B,CAACqQ,CAA3B,CACErQ,CAAA,EAASqQ,CACG,EAAd,GAAIrQ,CAAJ,EAA8B,GAA9B,EAAmBqQ,CAAnB,GAAmCrQ,CAAnC,CAA2C,EAA3C,CACA,OAAOywC,GAAA,CAAUzwC,CAAV,CAAiB+gB,CAAjB,CAAuBnP,CAAvB,CALa,CAFsB,CAW9Ck/B,QAASA,GAAa,CAACnpC,CAAD,CAAOopC,CAAP,CAAkB,CACtC,MAAO,SAAQ,CAACF,CAAD,CAAOxC,CAAP,CAAgB,CAC7B,IAAIruC,EAAQ6wC,CAAA,CAAK,KAAL,CAAalpC,CAAb,CAAA,EAAZ,CACIiR,EAAMhN,EAAA,CAAUmlC,CAAA,CAAa,OAAb,CAAuBppC,CAAvB,CAA+BA,CAAzC,CAEV,OAAO0mC,EAAA,CAAQz1B,CAAR,CAAA,CAAa5Y,CAAb,CAJsB,CADO,CAuIxCstC,QAASA,GAAU,CAACc,CAAD,CAAU,CAK3B4C,QAASA,EAAgB,CAACC,CAAD,CAAS,CAChC,IAAI5qC,CACJ,IAAIA,CAAJ,CAAY4qC,CAAA5qC,MAAA,CAAa6qC,CAAb,CAAZ,CAAyC,CACnCL,CAAAA,CAAO,IAAIttC,IAAJ,CAAS,CAAT,CAD4B,KAEnC4tC,EAAS,CAF0B,CAGnCC,EAAS,CAH0B,CAInCC,EAAahrC,CAAA,CAAM,CAAN,CAAA,CAAWwqC,CAAAS,eAAX,CAAiCT,CAAAU,YAJX,CAKnCC,EAAanrC,CAAA,CAAM,CAAN,CAAA,CAAWwqC,CAAAY,YAAX,CAA8BZ,CAAAa,SAE3CrrC,EAAA,CAAM,CAAN,CAAJ,GACE8qC,CACA,CADSnwC,CAAA,CAAIqF,CAAA,CAAM,CAAN,CAAJ,CAAeA,CAAA,CAAM,EAAN,CAAf,CACT,CAAA+qC,CAAA,CAAQpwC,CAAA,CAAIqF,CAAA,CAAM,CAAN,CAAJ,CAAeA,CAAA,CAAM,EAAN,CAAf,CAFV,CAIAgrC;CAAA9xC,KAAA,CAAgBsxC,CAAhB,CAAsB7vC,CAAA,CAAIqF,CAAA,CAAM,CAAN,CAAJ,CAAtB,CAAqCrF,CAAA,CAAIqF,CAAA,CAAM,CAAN,CAAJ,CAArC,CAAqD,CAArD,CAAwDrF,CAAA,CAAIqF,CAAA,CAAM,CAAN,CAAJ,CAAxD,CACI1F,EAAAA,CAAIK,CAAA,CAAIqF,CAAA,CAAM,CAAN,CAAJ,EAAc,CAAd,CAAJ1F,CAAuBwwC,CACvBQ,EAAAA,CAAI3wC,CAAA,CAAIqF,CAAA,CAAM,CAAN,CAAJ,EAAc,CAAd,CAAJsrC,CAAuBP,CACvBQ,EAAAA,CAAI5wC,CAAA,CAAIqF,CAAA,CAAM,CAAN,CAAJ,EAAc,CAAd,CACJwrC,EAAAA,CAAKvlB,IAAAyjB,MAAA,CAA8C,GAA9C,CAAW+B,UAAA,CAAW,IAAX,EAAmBzrC,CAAA,CAAM,CAAN,CAAnB,EAA6B,CAA7B,EAAX,CACTmrC,EAAAjyC,KAAA,CAAgBsxC,CAAhB,CAAsBlwC,CAAtB,CAAyBgxC,CAAzB,CAA4BC,CAA5B,CAA+BC,CAA/B,CAhBuC,CAmBzC,MAAOZ,EArByB,CAFlC,IAAIC,EAAgB,sGA2BpB,OAAO,SAAQ,CAACL,CAAD,CAAOkB,CAAP,CAAe,CAAA,IACxBzjB,EAAO,EADiB,CAExBxnB,EAAQ,EAFgB,CAGxBrC,CAHwB,CAGpB4B,CAER0rC,EAAA,CAASA,CAAT,EAAmB,YACnBA,EAAA,CAAS3D,CAAA4D,iBAAA,CAAyBD,CAAzB,CAAT,EAA6CA,CACzChzC,EAAA,CAAS8xC,CAAT,CAAJ,GAEIA,CAFJ,CACMoB,EAAAnpC,KAAA,CAAmB+nC,CAAnB,CAAJ,CACS7vC,CAAA,CAAI6vC,CAAJ,CADT,CAGSG,CAAA,CAAiBH,CAAjB,CAJX,CAQIhvC,GAAA,CAASgvC,CAAT,CAAJ,GACEA,CADF,CACS,IAAIttC,IAAJ,CAASstC,CAAT,CADT,CAIA,IAAI,CAAC/uC,EAAA,CAAO+uC,CAAP,CAAL,CACE,MAAOA,EAGT,KAAA,CAAMkB,CAAN,CAAA,CAEE,CADA1rC,CACA,CADQ6rC,EAAApqC,KAAA,CAAwBiqC,CAAxB,CACR,GACEjrC,CACA,CADeA,CA9pbdhC,OAAA,CAAcH,EAAApF,KAAA,CA8pbO8G,CA9pbP,CA8pbcnG,CA9pbd,CAAd,CA+pbD,CAAA6xC,CAAA,CAASjrC,CAAAuV,IAAA,EAFX,GAIEvV,CAAApH,KAAA,CAAWqyC,CAAX,CACA,CAAAA,CAAA,CAAS,IALX,CASF9yC,EAAA,CAAQ6H,CAAR,CAAe,QAAQ,CAAC9G,CAAD,CAAO,CAC5ByE,CAAA;AAAK0tC,EAAA,CAAanyC,CAAb,CACLsuB,EAAA,EAAQ7pB,CAAA,CAAKA,CAAA,CAAGosC,CAAH,CAASzC,CAAA4D,iBAAT,CAAL,CACKhyC,CAAAsG,QAAA,CAAc,UAAd,CAA0B,EAA1B,CAAAA,QAAA,CAAsC,KAAtC,CAA6C,GAA7C,CAHe,CAA9B,CAMA,OAAOgoB,EAxCqB,CA9BH,CAuG7Bkf,QAASA,GAAU,EAAG,CACpB,MAAO,SAAQ,CAAC4E,CAAD,CAAS,CACtB,MAAOntC,GAAA,CAAOmtC,CAAP,CAAe,CAAA,CAAf,CADe,CADJ,CAiGtB3E,QAASA,GAAa,EAAE,CACtB,MAAO,SAAQ,CAAC4E,CAAD,CAAQC,CAAR,CAAe,CAC5B,GAAI,CAACtzC,CAAA,CAAQqzC,CAAR,CAAL,EAAuB,CAACtzC,CAAA,CAASszC,CAAT,CAAxB,CAAyC,MAAOA,EAEhDC,EAAA,CAAQtxC,CAAA,CAAIsxC,CAAJ,CAER,IAAIvzC,CAAA,CAASszC,CAAT,CAAJ,CAEE,MAAIC,EAAJ,CACkB,CAAT,EAAAA,CAAA,CAAaD,CAAA1tC,MAAA,CAAY,CAAZ,CAAe2tC,CAAf,CAAb,CAAqCD,CAAA1tC,MAAA,CAAY2tC,CAAZ,CAAmBD,CAAAxzC,OAAnB,CAD9C,CAGS,EAViB,KAcxB0zC,EAAM,EAdkB,CAe1B1yC,CAf0B,CAevB4gB,CAGD6xB,EAAJ,CAAYD,CAAAxzC,OAAZ,CACEyzC,CADF,CACUD,CAAAxzC,OADV,CAESyzC,CAFT,CAEiB,CAACD,CAAAxzC,OAFlB,GAGEyzC,CAHF,CAGU,CAACD,CAAAxzC,OAHX,CAKY,EAAZ,CAAIyzC,CAAJ,EACEzyC,CACA,CADI,CACJ,CAAA4gB,CAAA,CAAI6xB,CAFN,GAIEzyC,CACA,CADIwyC,CAAAxzC,OACJ,CADmByzC,CACnB,CAAA7xB,CAAA,CAAI4xB,CAAAxzC,OALN,CAQA,KAAA,CAAOgB,CAAP,CAAS4gB,CAAT,CAAY5gB,CAAA,EAAZ,CACE0yC,CAAA7yC,KAAA,CAAS2yC,CAAA,CAAMxyC,CAAN,CAAT,CAGF,OAAO0yC,EAnCqB,CADR,CAqGxB3E,QAASA,GAAa,CAACxqB,CAAD,CAAQ,CAC5B,MAAO,SAAQ,CAACtgB,CAAD,CAAQ0vC,CAAR,CAAuBC,CAAvB,CAAqC,CAkClDC,QAASA,EAAiB,CAACC,CAAD,CAAOC,CAAP,CAAmB,CAC3C,MAAOptC,GAAA,CAAUotC,CAAV,CACA,CAAD,QAAQ,CAACxoB,CAAD,CAAGC,CAAH,CAAK,CAAC,MAAOsoB,EAAA,CAAKtoB,CAAL,CAAOD,CAAP,CAAR,CAAZ,CACDuoB,CAHqC,CAlCK;AAuClD7oB,QAASA,EAAO,CAAC+oB,CAAD,CAAKC,CAAL,CAAQ,CACtB,IAAI9uC,EAAK,MAAO6uC,EAAhB,CACI5uC,EAAK,MAAO6uC,EAChB,OAAI9uC,EAAJ,EAAUC,CAAV,EACY,QAIV,EAJID,CAIJ,GAHG6uC,CACA,CADKA,CAAArpC,YAAA,EACL,CAAAspC,CAAA,CAAKA,CAAAtpC,YAAA,EAER,EAAIqpC,CAAJ,GAAWC,CAAX,CAAsB,CAAtB,CACOD,CAAA,CAAKC,CAAL,CAAW,EAAX,CAAe,CANxB,EAQS9uC,CAAA,CAAKC,CAAL,CAAW,EAAX,CAAe,CAXF,CArCxB,GADI,CAACjF,CAAA,CAAQ8D,CAAR,CACL,EAAI,CAAC0vC,CAAL,CAAoB,MAAO1vC,EAC3B0vC,EAAA,CAAgBxzC,CAAA,CAAQwzC,CAAR,CAAA,CAAyBA,CAAzB,CAAwC,CAACA,CAAD,CACxDA,EAAA,CAAgB9vC,EAAA,CAAI8vC,CAAJ,CAAmB,QAAQ,CAACO,CAAD,CAAW,CAAA,IAChDH,EAAa,CAAA,CADmC,CAC5Bh6B,EAAMm6B,CAANn6B,EAAmBrX,EAC3C,IAAIxC,CAAA,CAASg0C,CAAT,CAAJ,CAAyB,CACvB,GAA4B,GAA5B,EAAKA,CAAAnvC,OAAA,CAAiB,CAAjB,CAAL,EAA0D,GAA1D,EAAmCmvC,CAAAnvC,OAAA,CAAiB,CAAjB,CAAnC,CACEgvC,CACA,CADoC,GACpC,EADaG,CAAAnvC,OAAA,CAAiB,CAAjB,CACb,CAAAmvC,CAAA,CAAYA,CAAAvzB,UAAA,CAAoB,CAApB,CAEd5G,EAAA,CAAMwK,CAAA,CAAO2vB,CAAP,CACN,IAAIn6B,CAAAsB,SAAJ,CAAkB,CAChB,IAAI9a,EAAMwZ,CAAA,EACV,OAAO85B,EAAA,CAAkB,QAAQ,CAACtoB,CAAD,CAAGC,CAAH,CAAM,CACrC,MAAOP,EAAA,CAAQM,CAAA,CAAEhrB,CAAF,CAAR,CAAgBirB,CAAA,CAAEjrB,CAAF,CAAhB,CAD8B,CAAhC,CAEJwzC,CAFI,CAFS,CANK,CAazB,MAAOF,EAAA,CAAkB,QAAQ,CAACtoB,CAAD,CAAGC,CAAH,CAAK,CACpC,MAAOP,EAAA,CAAQlR,CAAA,CAAIwR,CAAJ,CAAR,CAAexR,CAAA,CAAIyR,CAAJ,CAAf,CAD6B,CAA/B,CAEJuoB,CAFI,CAf6C,CAAtC,CAoBhB,KADA,IAAII,EAAY,EAAhB,CACUnzC,EAAI,CAAd,CAAiBA,CAAjB,CAAqBiD,CAAAjE,OAArB,CAAmCgB,CAAA,EAAnC,CAA0CmzC,CAAAtzC,KAAA,CAAeoD,CAAA,CAAMjD,CAAN,CAAf,CAC1C,OAAOmzC,EAAArzC,KAAA,CAAe+yC,CAAA,CAEtB5E,QAAmB,CAAChqC,CAAD,CAAKC,CAAL,CAAQ,CACzB,IAAM,IAAIlE;AAAI,CAAd,CAAiBA,CAAjB,CAAqB2yC,CAAA3zC,OAArB,CAA2CgB,CAAA,EAA3C,CAAgD,CAC9C,IAAI8yC,EAAOH,CAAA,CAAc3yC,CAAd,CAAA,CAAiBiE,CAAjB,CAAqBC,CAArB,CACX,IAAa,CAAb,GAAI4uC,CAAJ,CAAgB,MAAOA,EAFuB,CAIhD,MAAO,EALkB,CAFL,CAA8BF,CAA9B,CAAf,CAzB2C,CADxB,CAyD9BQ,QAASA,GAAW,CAAC/mC,CAAD,CAAY,CAC1B7M,CAAA,CAAW6M,CAAX,CAAJ,GACEA,CADF,CACc,MACJA,CADI,CADd,CAKAA,EAAAyW,SAAA,CAAqBzW,CAAAyW,SAArB,EAA2C,IAC3C,OAAOlhB,GAAA,CAAQyK,CAAR,CAPuB,CAqfhCgnC,QAASA,GAAc,CAACttC,CAAD,CAAU6f,CAAV,CAAiBmF,CAAjB,CAAyBrH,CAAzB,CAAmC,CAqBxD4vB,QAASA,EAAc,CAACC,CAAD,CAAUC,CAAV,CAA8B,CACnDA,CAAA,CAAqBA,CAAA,CAAqB,GAArB,CAA2BlqC,EAAA,CAAWkqC,CAAX,CAA+B,GAA/B,CAA3B,CAAiE,EACtF9vB,EAAA0M,YAAA,CAAqBrqB,CAArB,EAA+BwtC,CAAA,CAAUE,EAAV,CAA0BC,EAAzD,EAAwEF,CAAxE,CACA9vB,EAAAkB,SAAA,CAAkB7e,CAAlB,EAA4BwtC,CAAA,CAAUG,EAAV,CAAwBD,EAApD,EAAqED,CAArE,CAHmD,CArBG,IACpDG,EAAO,IAD6C,CAEpDC,EAAa7tC,CAAAxE,OAAA,EAAAshB,WAAA,CAA4B,MAA5B,CAAb+wB,EAAoDC,EAFA,CAGpDC,EAAe,CAHqC,CAIpDC,EAASJ,CAAAK,OAATD,CAAuB,EAJ6B,CAKpDE,EAAW,EAGfN,EAAAO,MAAA,CAAatuB,CAAA9d,KAAb,EAA2B8d,CAAAuuB,OAC3BR,EAAAS,OAAA,CAAc,CAAA,CACdT,EAAAU,UAAA,CAAiB,CAAA,CACjBV,EAAAW,OAAA,CAAc,CAAA,CACdX,EAAAY,SAAA,CAAgB,CAAA,CAEhBX,EAAAY,YAAA,CAAuBb,CAAvB,CAGA5tC,EAAA6e,SAAA,CAAiB6vB,EAAjB,CACAnB,EAAA,CAAe,CAAA,CAAf,CAkBAK,EAAAa,YAAA,CAAmBE,QAAQ,CAACC,CAAD,CAAU,CAGnCzqC,EAAA,CAAwByqC,CAAAT,MAAxB,CAAuC,OAAvC,CACAD,EAAAp0C,KAAA,CAAc80C,CAAd,CAEIA,EAAAT,MAAJ;CACEP,CAAA,CAAKgB,CAAAT,MAAL,CADF,CACwBS,CADxB,CANmC,CAoBrChB,EAAAiB,eAAA,CAAsBC,QAAQ,CAACF,CAAD,CAAU,CAClCA,CAAAT,MAAJ,EAAqBP,CAAA,CAAKgB,CAAAT,MAAL,CAArB,GAA6CS,CAA7C,EACE,OAAOhB,CAAA,CAAKgB,CAAAT,MAAL,CAET90C,EAAA,CAAQ20C,CAAR,CAAgB,QAAQ,CAACe,CAAD,CAAQC,CAAR,CAAyB,CAC/CpB,CAAAqB,aAAA,CAAkBD,CAAlB,CAAmC,CAAA,CAAnC,CAAyCJ,CAAzC,CAD+C,CAAjD,CAIAzxC,GAAA,CAAY+wC,CAAZ,CAAsBU,CAAtB,CARsC,CAoBxChB,EAAAqB,aAAA,CAAoBC,QAAQ,CAACF,CAAD,CAAkBxB,CAAlB,CAA2BoB,CAA3B,CAAoC,CAC9D,IAAIG,EAAQf,CAAA,CAAOgB,CAAP,CAEZ,IAAIxB,CAAJ,CACMuB,CAAJ,GACE5xC,EAAA,CAAY4xC,CAAZ,CAAmBH,CAAnB,CACA,CAAKG,CAAA91C,OAAL,GACE80C,CAAA,EAQA,CAPKA,CAOL,GANER,CAAA,CAAeC,CAAf,CAEA,CADAI,CAAAW,OACA,CADc,CAAA,CACd,CAAAX,CAAAY,SAAA,CAAgB,CAAA,CAIlB,EAFAR,CAAA,CAAOgB,CAAP,CAEA,CAF0B,CAAA,CAE1B,CADAzB,CAAA,CAAe,CAAA,CAAf,CAAqByB,CAArB,CACA,CAAAnB,CAAAoB,aAAA,CAAwBD,CAAxB,CAAyC,CAAA,CAAzC,CAA+CpB,CAA/C,CATF,CAFF,CADF,KAgBO,CACAG,CAAL,EACER,CAAA,CAAeC,CAAf,CAEF,IAAIuB,CAAJ,CACE,IAtwdyB,EAswdzB,EAtwdC9xC,EAAA,CAswdY8xC,CAtwdZ,CAswdmBH,CAtwdnB,CAswdD,CAA8B,MAA9B,CADF,IAGEZ,EAAA,CAAOgB,CAAP,CAGA,CAH0BD,CAG1B,CAHkC,EAGlC,CAFAhB,CAAA,EAEA,CADAR,CAAA,CAAe,CAAA,CAAf,CAAsByB,CAAtB,CACA,CAAAnB,CAAAoB,aAAA,CAAwBD,CAAxB,CAAyC,CAAA,CAAzC,CAAgDpB,CAAhD,CAEFmB,EAAAj1C,KAAA,CAAW80C,CAAX,CAEAhB,EAAAW,OAAA,CAAc,CAAA,CACdX,EAAAY,SAAA,CAAgB,CAAA,CAfX,CAnBuD,CAgDhEZ,EAAAuB,UAAA,CAAiBC,QAAQ,EAAG,CAC1BzxB,CAAA0M,YAAA,CAAqBrqB,CAArB,CAA8B0uC,EAA9B,CACA/wB,EAAAkB,SAAA,CAAkB7e,CAAlB,CAA2BqvC,EAA3B,CACAzB,EAAAS,OAAA,CAAc,CAAA,CACdT,EAAAU,UAAA;AAAiB,CAAA,CACjBT,EAAAsB,UAAA,EAL0B,CAsB5BvB,EAAA0B,aAAA,CAAoBC,QAAS,EAAG,CAC9B5xB,CAAA0M,YAAA,CAAqBrqB,CAArB,CAA8BqvC,EAA9B,CACA1xB,EAAAkB,SAAA,CAAkB7e,CAAlB,CAA2B0uC,EAA3B,CACAd,EAAAS,OAAA,CAAc,CAAA,CACdT,EAAAU,UAAA,CAAiB,CAAA,CACjBj1C,EAAA,CAAQ60C,CAAR,CAAkB,QAAQ,CAACU,CAAD,CAAU,CAClCA,CAAAU,aAAA,EADkC,CAApC,CAL8B,CAlJwB,CAwyB1DE,QAASA,GAAQ,CAACC,CAAD,CAAOC,CAAP,CAAsBC,CAAtB,CAAgCv1C,CAAhC,CAAsC,CACrDq1C,CAAAR,aAAA,CAAkBS,CAAlB,CAAiCC,CAAjC,CACA,OAAOA,EAAA,CAAWv1C,CAAX,CAAmBxB,CAF2B,CAMvDg3C,QAASA,GAAwB,CAACH,CAAD,CAAOC,CAAP,CAAsB1vC,CAAtB,CAA+B,CAC9D,IAAI2vC,EAAW3vC,CAAArD,KAAA,CAAa,UAAb,CACXX,EAAA,CAAS2zC,CAAT,CAAJ,EAWEF,CAAAI,SAAA/1C,KAAA,CAVgBg2C,QAAQ,CAAC11C,CAAD,CAAQ,CAG9B,GAAKq1C,CAAAxB,OAAA,CAAYyB,CAAZ,CAAL,EAAoC,EAAAC,CAAAI,SAAA,EAAqBJ,CAAAK,YAArB,EAChCL,CAAAM,aADgC,CAApC,EAC+BN,CAAAO,aAD/B,CAKA,MAAO91C,EAHLq1C,EAAAR,aAAA,CAAkBS,CAAlB,CAAiC,CAAA,CAAjC,CAL4B,CAUhC,CAb4D,CAiBhES,QAASA,GAAa,CAACvtC,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB6yC,CAAvB,CAA6Bp5B,CAA7B,CAAuC2W,CAAvC,CAAiD,CACrE,IAAI2iB,EAAW3vC,CAAArD,KAAA,CAAa,UAAb,CAIf,IAAI,CAAC0Z,CAAA4vB,QAAL,CAAuB,CACrB,IAAImK,EAAY,CAAA,CAEhBpwC,EAAA6Y,GAAA,CAAW,kBAAX,CAA+B,QAAQ,CAAC7V,CAAD,CAAO,CAC5CotC,CAAA,CAAY,CAAA,CADgC,CAA9C,CAIApwC;CAAA6Y,GAAA,CAAW,gBAAX,CAA6B,QAAQ,EAAG,CACtCu3B,CAAA,CAAY,CAAA,CACZ74B,EAAA,EAFsC,CAAxC,CAPqB,CAavB,IAAIA,EAAWA,QAAQ,EAAG,CACxB,GAAI64B,CAAAA,CAAJ,CAAA,CACA,IAAIh2C,EAAQ4F,CAAAZ,IAAA,EAKRQ,GAAA,CAAUhD,CAAAyzC,OAAV,EAAyB,GAAzB,CAAJ,GACEj2C,CADF,CACU4R,EAAA,CAAK5R,CAAL,CADV,CAIA,IAAIq1C,CAAAa,WAAJ,GAAwBl2C,CAAxB,EAIKu1C,CAJL,EAI2B,EAJ3B,GAIiBv1C,CAJjB,EAIiC,CAACu1C,CAAAO,aAJlC,CAKMttC,CAAAgtB,QAAJ,CACE6f,CAAAc,cAAA,CAAmBn2C,CAAnB,CADF,CAGEwI,CAAAG,OAAA,CAAa,QAAQ,EAAG,CACtB0sC,CAAAc,cAAA,CAAmBn2C,CAAnB,CADsB,CAAxB,CAlBJ,CADwB,CA4B1B,IAAIic,CAAAywB,SAAA,CAAkB,OAAlB,CAAJ,CACE9mC,CAAA6Y,GAAA,CAAW,OAAX,CAAoBtB,CAApB,CADF,KAEO,CACL,IAAI+Y,CAAJ,CAEIkgB,EAAgBA,QAAQ,EAAG,CACxBlgB,CAAL,GACEA,CADF,CACYtD,CAAAnT,MAAA,CAAe,QAAQ,EAAG,CAClCtC,CAAA,EACA+Y,EAAA,CAAU,IAFwB,CAA1B,CADZ,CAD6B,CAS/BtwB,EAAA6Y,GAAA,CAAW,SAAX,CAAsB,QAAQ,CAACzI,CAAD,CAAQ,CAChC5W,CAAAA,CAAM4W,CAAAqgC,QAIE,GAAZ,GAAIj3C,CAAJ,GAAmB,EAAnB,CAAwBA,CAAxB,EAAqC,EAArC,CAA+BA,CAA/B,EAA6C,EAA7C,EAAmDA,CAAnD,EAAiE,EAAjE,EAA0DA,CAA1D,GAEAg3C,CAAA,EAPoC,CAAtC,CAWA,IAAIn6B,CAAAywB,SAAA,CAAkB,OAAlB,CAAJ,CACE9mC,CAAA6Y,GAAA,CAAW,WAAX,CAAwB23B,CAAxB,CAxBG,CA8BPxwC,CAAA6Y,GAAA,CAAW,QAAX,CAAqBtB,CAArB,CAEAk4B,EAAAiB,QAAA,CAAeC,QAAQ,EAAG,CACxB3wC,CAAAZ,IAAA,CAAYqwC,CAAAmB,SAAA,CAAcnB,CAAAa,WAAd,CAAA;AAAiC,EAAjC,CAAsCb,CAAAa,WAAlD,CADwB,CAhF2C,KAqFjElH,EAAUxsC,CAAAi0C,UAIVzH,EAAJ,GAKE,CADA3oC,CACA,CADQ2oC,CAAA3oC,MAAA,CAAc,oBAAd,CACR,GACE2oC,CACA,CADcvrC,MAAJ,CAAW4C,CAAA,CAAM,CAAN,CAAX,CAAqBA,CAAA,CAAM,CAAN,CAArB,CACV,CAAAqwC,CAAA,CAAmBA,QAAQ,CAAC12C,CAAD,CAAQ,CACjC,MANKo1C,GAAA,CAASC,CAAT,CAAe,SAAf,CAA0BA,CAAAmB,SAAA,CAMDx2C,CANC,CAA1B,EAMgBgvC,CANkClmC,KAAA,CAMzB9I,CANyB,CAAlD,CAMyBA,CANzB,CAK4B,CAFrC,EAME02C,CANF,CAMqBA,QAAQ,CAAC12C,CAAD,CAAQ,CACjC,IAAI22C,EAAanuC,CAAA0/B,MAAA,CAAY8G,CAAZ,CAEjB,IAAI,CAAC2H,CAAL,EAAmB,CAACA,CAAA7tC,KAApB,CACE,KAAMrK,EAAA,CAAO,WAAP,CAAA,CAAoB,UAApB,CACqDuwC,CADrD,CAEJ2H,CAFI,CAEQhxC,EAAA,CAAYC,CAAZ,CAFR,CAAN,CAIF,MAjBKwvC,GAAA,CAASC,CAAT,CAAe,SAAf,CAA0BA,CAAAmB,SAAA,CAiBEx2C,CAjBF,CAA1B,EAiBgB22C,CAjBkC7tC,KAAA,CAiBtB9I,CAjBsB,CAAlD,CAiB4BA,CAjB5B,CAS4B,CAarC,CADAq1C,CAAAuB,YAAAl3C,KAAA,CAAsBg3C,CAAtB,CACA,CAAArB,CAAAI,SAAA/1C,KAAA,CAAmBg3C,CAAnB,CAxBF,CA4BA,IAAIl0C,CAAAq0C,YAAJ,CAAsB,CACpB,IAAIC,EAAY91C,CAAA,CAAIwB,CAAAq0C,YAAJ,CACZE,EAAAA,CAAqBA,QAAQ,CAAC/2C,CAAD,CAAQ,CACvC,MAAOo1C,GAAA,CAASC,CAAT,CAAe,WAAf,CAA4BA,CAAAmB,SAAA,CAAcx2C,CAAd,CAA5B,EAAoDA,CAAAnB,OAApD,EAAoEi4C,CAApE,CAA+E92C,CAA/E,CADgC,CAIzCq1C,EAAAI,SAAA/1C,KAAA,CAAmBq3C,CAAnB,CACA1B,EAAAuB,YAAAl3C,KAAA,CAAsBq3C,CAAtB,CAPoB,CAWtB,GAAIv0C,CAAAw0C,YAAJ,CAAsB,CACpB,IAAIC;AAAYj2C,CAAA,CAAIwB,CAAAw0C,YAAJ,CACZE,EAAAA,CAAqBA,QAAQ,CAACl3C,CAAD,CAAQ,CACvC,MAAOo1C,GAAA,CAASC,CAAT,CAAe,WAAf,CAA4BA,CAAAmB,SAAA,CAAcx2C,CAAd,CAA5B,EAAoDA,CAAAnB,OAApD,EAAoEo4C,CAApE,CAA+Ej3C,CAA/E,CADgC,CAIzCq1C,EAAAI,SAAA/1C,KAAA,CAAmBw3C,CAAnB,CACA7B,EAAAuB,YAAAl3C,KAAA,CAAsBw3C,CAAtB,CAPoB,CAhI+C,CAyyCvEC,QAASA,GAAc,CAACxvC,CAAD,CAAOiN,CAAP,CAAiB,CACtCjN,CAAA,CAAO,SAAP,CAAmBA,CACnB,OAAO,CAAC,UAAD,CAAa,QAAQ,CAAC4b,CAAD,CAAW,CAiFrC6zB,QAASA,EAAe,CAACnmB,CAAD,CAAUC,CAAV,CAAmB,CACzC,IAAIF,EAAS,EAAb,CAGQnxB,EAAI,CADZ,EAAA,CACA,IAAA,CAAeA,CAAf,CAAmBoxB,CAAApyB,OAAnB,CAAmCgB,CAAA,EAAnC,CAAwC,CAEtC,IADA,IAAIsxB,EAAQF,CAAA,CAAQpxB,CAAR,CAAZ,CACQkT,EAAI,CAAZ,CAAeA,CAAf,CAAmBme,CAAAryB,OAAnB,CAAmCkU,CAAA,EAAnC,CACE,GAAGoe,CAAH,EAAYD,CAAA,CAAQne,CAAR,CAAZ,CAAwB,SAAS,CAEnCie,EAAAtxB,KAAA,CAAYyxB,CAAZ,CALsC,CAOxC,MAAOH,EAXkC,CAc3CqmB,QAASA,EAAa,CAACtnB,CAAD,CAAW,CAC/B,GAAI,CAAA/wB,CAAA,CAAQ+wB,CAAR,CAAJ,CAEO,CAAA,GAAIhxB,CAAA,CAASgxB,CAAT,CAAJ,CACL,MAAOA,EAAAnpB,MAAA,CAAe,GAAf,CACF,IAAIhF,CAAA,CAASmuB,CAAT,CAAJ,CAAwB,CAAA,IACzBunB,EAAU,EACdr4C,EAAA,CAAQ8wB,CAAR,CAAkB,QAAQ,CAACtqB,CAAD,CAAIkqB,CAAJ,CAAO,CAC3BlqB,CAAJ,EACE6xC,CAAA53C,KAAA,CAAaiwB,CAAb,CAF6B,CAAjC,CAKA,OAAO2nB,EAPsB,CAFxB,CAWP,MAAOvnB,EAdwB,CA9FjC,MAAO,UACK,IADL,MAECrP,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CAiCnC+0C,QAASA,EAAkB,CAACD,CAAD,CAAU7d,CAAV,CAAiB,CAC1C,IAAI+d;AAAc5xC,CAAAgD,KAAA,CAAa,cAAb,CAAd4uC,EAA8C,EAAlD,CACIC,EAAkB,EACtBx4C,EAAA,CAAQq4C,CAAR,CAAiB,QAAS,CAACvvC,CAAD,CAAY,CACpC,GAAY,CAAZ,CAAI0xB,CAAJ,EAAiB+d,CAAA,CAAYzvC,CAAZ,CAAjB,CACEyvC,CAAA,CAAYzvC,CAAZ,CACA,EAD0ByvC,CAAA,CAAYzvC,CAAZ,CAC1B,EADoD,CACpD,EADyD0xB,CACzD,CAAI+d,CAAA,CAAYzvC,CAAZ,CAAJ,GAA+B,EAAU,CAAV,CAAE0xB,CAAF,CAA/B,EACEge,CAAA/3C,KAAA,CAAqBqI,CAArB,CAJgC,CAAtC,CAQAnC,EAAAgD,KAAA,CAAa,cAAb,CAA6B4uC,CAA7B,CACA,OAAOC,EAAAn3C,KAAA,CAAqB,GAArB,CAZmC,CA8B5Co3C,QAASA,EAAkB,CAACjR,CAAD,CAAS,CAClC,GAAiB,CAAA,CAAjB,GAAI7xB,CAAJ,EAAyBpM,CAAAmvC,OAAzB,CAAwC,CAAxC,GAA8C/iC,CAA9C,CAAwD,CACtD,IAAIsb,EAAamnB,CAAA,CAAa5Q,CAAb,EAAuB,EAAvB,CACjB,IAAI,CAACC,CAAL,CAAa,CA1Cf,IAAIxW,EAAaqnB,CAAA,CA2CFrnB,CA3CE,CAA2B,CAA3B,CACjB1tB,EAAAstB,UAAA,CAAeI,CAAf,CAyCe,CAAb,IAEO,IAAI,CAACrsB,EAAA,CAAO4iC,CAAP,CAAcC,CAAd,CAAL,CAA4B,CAEnB9Y,IAAAA,EADGypB,CAAAzpB,CAAa8Y,CAAb9Y,CACHA,CArBduC,EAAQinB,CAAA,CAqBkBlnB,CArBlB,CAA4BtC,CAA5B,CAqBMA,CApBdyC,EAAW+mB,CAAA,CAAgBxpB,CAAhB,CAoBesC,CApBf,CAoBGtC,CAnBlByC,EAAWknB,CAAA,CAAkBlnB,CAAlB,CAA6B,EAA7B,CAmBOzC,CAlBlBuC,EAAQonB,CAAA,CAAkBpnB,CAAlB,CAAyB,CAAzB,CAEa,EAArB,GAAIA,CAAAtxB,OAAJ,CACE0kB,CAAA0M,YAAA,CAAqBrqB,CAArB,CAA8ByqB,CAA9B,CADF,CAE+B,CAAxB,GAAIA,CAAAxxB,OAAJ,CACL0kB,CAAAkB,SAAA,CAAkB7e,CAAlB,CAA2BuqB,CAA3B,CADK,CAGL5M,CAAA+M,SAAA,CAAkB1qB,CAAlB,CAA2BuqB,CAA3B,CAAkCE,CAAlC,CASmC,CAJmB,CASxDqW,CAAA,CAASzjC,EAAA,CAAKwjC,CAAL,CAVyB,CA9DpC,IAAIC,CAEJl+B,EAAAnF,OAAA,CAAab,CAAA,CAAKmF,CAAL,CAAb,CAAyB+vC,CAAzB,CAA6C,CAAA,CAA7C,CAEAl1C,EAAAwnB,SAAA,CAAc,OAAd,CAAuB,QAAQ,CAAChqB,CAAD,CAAQ,CACrC03C,CAAA,CAAmBlvC,CAAA0/B,MAAA,CAAY1lC,CAAA,CAAKmF,CAAL,CAAZ,CAAnB,CADqC,CAAvC,CAKa,UAAb,GAAIA,CAAJ,EACEa,CAAAnF,OAAA,CAAa,QAAb;AAAuB,QAAQ,CAACs0C,CAAD,CAASC,CAAT,CAAoB,CAEjD,IAAIC,EAAMF,CAANE,CAAe,CACnB,IAAIA,CAAJ,GAAYD,CAAZ,CAAwB,CAAxB,CAA2B,CACzB,IAAIN,EAAUD,CAAA,CAAa7uC,CAAA0/B,MAAA,CAAY1lC,CAAA,CAAKmF,CAAL,CAAZ,CAAb,CACdkwC,EAAA,GAAQjjC,CAAR,EAQAsb,CACJ,CADiBqnB,CAAA,CAPAD,CAOA,CAA2B,CAA3B,CACjB,CAAA90C,CAAAstB,UAAA,CAAeI,CAAf,CATI,GAaAA,CACJ,CADiBqnB,CAAA,CAXGD,CAWH,CAA4B,EAA5B,CACjB,CAAA90C,CAAAwtB,aAAA,CAAkBE,CAAlB,CAdI,CAFyB,CAHsB,CAAnD,CAXiC,CAFhC,CAD8B,CAAhC,CAF+B,CAzziBxC,IAAIxqB,EAAYA,QAAQ,CAACurC,CAAD,CAAQ,CAAC,MAAOlyC,EAAA,CAASkyC,CAAT,CAAA,CAAmBA,CAAAznC,YAAA,EAAnB,CAA0CynC,CAAlD,CAAhC,CACI3xC,GAAiBw4C,MAAAj+B,UAAAva,eADrB,CAaIsM,GAAYA,QAAQ,CAACqlC,CAAD,CAAQ,CAAC,MAAOlyC,EAAA,CAASkyC,CAAT,CAAA,CAAmBA,CAAA3gC,YAAA,EAAnB,CAA0C2gC,CAAlD,CAbhC,CAwCIn6B,CAxCJ,CAyCIjR,CAzCJ,CA0CI2L,EA1CJ,CA2CI7M,GAAoB,EAAAA,MA3CxB,CA4CIjF,GAAoB,EAAAA,KA5CxB,CA6CIqC,GAAoB+1C,MAAAj+B,UAAA9X,SA7CxB,CA8CIuB,GAAoB7E,CAAA,CAAO,IAAP,CA9CxB,CAmDIsK,GAAoBzK,CAAAyK,QAApBA,GAAuCzK,CAAAyK,QAAvCA,CAAwD,EAAxDA,CAnDJ,CAoDI8C,EApDJ,CAqDI2a,EArDJ,CAsDIrmB,GAAoB,CAAC,GAAD,CAAM,GAAN,CAAW,GAAX,CAMxB2W,EAAA,CAAO9V,CAAA,CAAI,CAAC,YAAA8G,KAAA,CAAkBpC,CAAA,CAAUqmC,SAAAD,UAAV,CAAlB,CAAD,EAAsD,EAAtD,EAA0D,CAA1D,CAAJ,CACH3D,MAAA,CAAMrxB,CAAN,CAAJ,GACEA,CADF,CACS9V,CAAA,CAAI,CAAC,uBAAA8G,KAAA,CAA6BpC,CAAA,CAAUqmC,SAAAD,UAAV,CAA7B,CAAD;AAAiE,EAAjE,EAAqE,CAArE,CAAJ,CADT,CAiNAxqC,EAAA+V,QAAA,CAAe,EAoBf9V,GAAA8V,QAAA,CAAmB,EA8KnB,KAAIzF,GAAQ,QAAQ,EAAG,CAIrB,MAAKrR,OAAAsZ,UAAAjI,KAAL,CAKO,QAAQ,CAAC5R,CAAD,CAAQ,CACrB,MAAOjB,EAAA,CAASiB,CAAT,CAAA,CAAkBA,CAAA4R,KAAA,EAAlB,CAAiC5R,CADnB,CALvB,CACS,QAAQ,CAACA,CAAD,CAAQ,CACrB,MAAOjB,EAAA,CAASiB,CAAT,CAAA,CAAkBA,CAAAsG,QAAA,CAAc,QAAd,CAAwB,EAAxB,CAAAA,QAAA,CAAoC,QAApC,CAA8C,EAA9C,CAAlB,CAAsEtG,CADxD,CALJ,CAAX,EA8CVwmB,GAAA,CADS,CAAX,CAAI1P,CAAJ,CACc0P,QAAQ,CAAC5gB,CAAD,CAAU,CAC5BA,CAAA,CAAUA,CAAAtD,SAAA,CAAmBsD,CAAnB,CAA6BA,CAAA,CAAQ,CAAR,CACvC,OAAQA,EAAA4jB,UACD,EAD2C,MAC3C,EADsB5jB,CAAA4jB,UACtB,CAAH5d,EAAA,CAAUhG,CAAA4jB,UAAV,CAA8B,GAA9B,CAAoC5jB,CAAAtD,SAApC,CAAG,CAAqDsD,CAAAtD,SAHhC,CADhC,CAOckkB,QAAQ,CAAC5gB,CAAD,CAAU,CAC5B,MAAOA,EAAAtD,SAAA,CAAmBsD,CAAAtD,SAAnB,CAAsCsD,CAAA,CAAQ,CAAR,CAAAtD,SADjB,CAurBhC,KAAI+G,GAAoB,QAAxB,CAmgBIsC,GAAU,MACN,QADM,OAEL,CAFK,OAGL,CAHK,KAIP,EAJO,UAKF,oBALE,CAngBd,CAsuBIyI,GAAUzC,CAAAwH,MAAV/E,CAAyB,EAtuB7B,CAuuBIF,GAASvC,CAAA+d,QAATxb,CAA0B,KAA1BA,CAAkC1Q,CAAA,IAAID,IAAJC,SAAA,EAvuBtC;AAwuBI8Q,GAAO,CAxuBX,CAyuBIyjC,GAAsBz5C,CAAAC,SAAAy5C,iBACA,CAAlB,QAAQ,CAACpyC,CAAD,CAAU8N,CAAV,CAAgBjP,CAAhB,CAAoB,CAACmB,CAAAoyC,iBAAA,CAAyBtkC,CAAzB,CAA+BjP,CAA/B,CAAmC,CAAA,CAAnC,CAAD,CAAV,CAClB,QAAQ,CAACmB,CAAD,CAAU8N,CAAV,CAAgBjP,CAAhB,CAAoB,CAACmB,CAAAqyC,YAAA,CAAoB,IAApB,CAA2BvkC,CAA3B,CAAiCjP,CAAjC,CAAD,CA3uBpC,CA4uBIuP,GAAyB1V,CAAAC,SAAA25C,oBACA,CAArB,QAAQ,CAACtyC,CAAD,CAAU8N,CAAV,CAAgBjP,CAAhB,CAAoB,CAACmB,CAAAsyC,oBAAA,CAA4BxkC,CAA5B,CAAkCjP,CAAlC,CAAsC,CAAA,CAAtC,CAAD,CAAP,CACrB,QAAQ,CAACmB,CAAD,CAAU8N,CAAV,CAAgBjP,CAAhB,CAAoB,CAACmB,CAAAuyC,YAAA,CAAoB,IAApB,CAA2BzkC,CAA3B,CAAiCjP,CAAjC,CAAD,CAKvBkN,EAAAymC,MAAb,CAA4BC,QAAQ,CAACh2C,CAAD,CAAO,CAEzC,MAAO,KAAA8W,MAAA,CAAW9W,CAAA,CAAK,IAAAqtB,QAAL,CAAX,CAAP,EAAyC,EAFA,CAQ3C,KAAIvf,GAAuB,iBAA3B,CACII,GAAkB,aADtB,CAEIsB,GAAepT,CAAA,CAAO,QAAP,CAFnB,CA4DIsT,GAAoB,4BA5DxB,CA6DIG,GAAc,WA7DlB,CA8DII,GAAkB,WA9DtB,CA+DIK,GAAmB,yEA/DvB,CAiEIH;AAAU,QACF,CAAC,CAAD,CAAI,8BAAJ,CAAoC,WAApC,CADE,OAGH,CAAC,CAAD,CAAI,SAAJ,CAAe,UAAf,CAHG,KAIL,CAAC,CAAD,CAAI,mBAAJ,CAAyB,qBAAzB,CAJK,IAKN,CAAC,CAAD,CAAI,gBAAJ,CAAsB,kBAAtB,CALM,IAMN,CAAC,CAAD,CAAI,oBAAJ,CAA0B,uBAA1B,CANM,UAOA,CAAC,CAAD,CAAI,EAAJ,CAAQ,EAAR,CAPA,CAUdA,GAAA8lC,SAAA,CAAmB9lC,EAAA+lC,OACnB/lC,GAAAgmC,MAAA,CAAgBhmC,EAAAimC,MAAhB,CAAgCjmC,EAAAkmC,SAAhC,CAAmDlmC,EAAAmmC,QAAnD,CAAqEnmC,EAAAomC,MACrEpmC,GAAAqmC,GAAA,CAAarmC,EAAAsmC,GAgQb,KAAIx0B,GAAkB3S,CAAAkI,UAAlByK,CAAqC,OAChCy0B,QAAQ,CAACt0C,CAAD,CAAK,CAGlBu0C,QAASA,EAAO,EAAG,CACbC,CAAJ,GACAA,CACA,CADQ,CAAA,CACR,CAAAx0C,CAAA,EAFA,CADiB,CAFnB,IAAIw0C,EAAQ,CAAA,CASgB,WAA5B,GAAI16C,CAAA+4B,WAAJ,CACE7a,UAAA,CAAWu8B,CAAX,CADF,EAGE,IAAAv6B,GAAA,CAAQ,kBAAR,CAA4Bu6B,CAA5B,CAGA,CAAArnC,CAAA,CAAOrT,CAAP,CAAAmgB,GAAA,CAAkB,MAAlB,CAA0Bu6B,CAA1B,CANF,CAVkB,CADmB,UAqB7Bj3C,QAAQ,EAAG,CACnB,IAAI/B;AAAQ,EACZf,EAAA,CAAQ,IAAR,CAAc,QAAQ,CAAC+G,CAAD,CAAG,CAAEhG,CAAAN,KAAA,CAAW,EAAX,CAAgBsG,CAAhB,CAAF,CAAzB,CACA,OAAO,GAAP,CAAahG,CAAAM,KAAA,CAAW,IAAX,CAAb,CAAgC,GAHb,CArBkB,IA2BnCikB,QAAQ,CAACrkB,CAAD,CAAQ,CAChB,MAAiB,EAAV,EAACA,CAAD,CAAe2F,CAAA,CAAO,IAAA,CAAK3F,CAAL,CAAP,CAAf,CAAqC2F,CAAA,CAAO,IAAA,CAAK,IAAAhH,OAAL,CAAmBqB,CAAnB,CAAP,CAD5B,CA3BmB,QA+B/B,CA/B+B,MAgCjCR,EAhCiC,MAiCjC,EAAAC,KAjCiC,QAkC/B,EAAAqD,OAlC+B,CAAzC,CA0CI6S,GAAe,EACnB5W,EAAA,CAAQ,2DAAA,MAAA,CAAA,GAAA,CAAR,CAAgF,QAAQ,CAACe,CAAD,CAAQ,CAC9F6V,EAAA,CAAanQ,CAAA,CAAU1F,CAAV,CAAb,CAAA,CAAiCA,CAD6D,CAAhG,CAGA,KAAI8V,GAAmB,EACvB7W,EAAA,CAAQ,kDAAA,MAAA,CAAA,GAAA,CAAR,CAAuE,QAAQ,CAACe,CAAD,CAAQ,CACrF8V,EAAA,CAAiBlK,EAAA,CAAU5L,CAAV,CAAjB,CAAA,CAAqC,CAAA,CADgD,CAAvF,CAYAf,EAAA,CAAQ,MACAsV,EADA,eAESe,EAFT,OAIC9M,QAAQ,CAAC5C,CAAD,CAAU,CAEvB,MAAOC,EAAA,CAAOD,CAAP,CAAAgD,KAAA,CAAqB,QAArB,CAAP,EAAyC0M,EAAA,CAAoB1P,CAAA4P,WAApB,EAA0C5P,CAA1C,CAAmD,CAAC,eAAD,CAAkB,QAAlB,CAAnD,CAFlB,CAJnB;aASQsjB,QAAQ,CAACtjB,CAAD,CAAU,CAE9B,MAAOC,EAAA,CAAOD,CAAP,CAAAgD,KAAA,CAAqB,eAArB,CAAP,EAAgD/C,CAAA,CAAOD,CAAP,CAAAgD,KAAA,CAAqB,yBAArB,CAFlB,CAT1B,YAcMyM,EAdN,UAgBIlN,QAAQ,CAACvC,CAAD,CAAU,CAC1B,MAAO0P,GAAA,CAAoB1P,CAApB,CAA6B,WAA7B,CADmB,CAhBtB,YAoBM6qB,QAAQ,CAAC7qB,CAAD,CAAS+B,CAAT,CAAe,CACjC/B,CAAAszC,gBAAA,CAAwBvxC,CAAxB,CADiC,CApB7B,UAwBIgN,EAxBJ,KA0BDwkC,QAAQ,CAACvzC,CAAD,CAAU+B,CAAV,CAAgB3H,CAAhB,CAAuB,CAClC2H,CAAA,CAAOuI,EAAA,CAAUvI,CAAV,CAEP,IAAIhG,CAAA,CAAU3B,CAAV,CAAJ,CACE4F,CAAAymC,MAAA,CAAc1kC,CAAd,CAAA,CAAsB3H,CADxB,KAEO,CACL,IAAIgF,CAEQ,EAAZ,EAAI8R,CAAJ,GAEE9R,CACA,CADMY,CAAAwzC,aACN,EAD8BxzC,CAAAwzC,aAAA,CAAqBzxC,CAArB,CAC9B,CAAY,EAAZ,GAAI3C,CAAJ,GAAgBA,CAAhB,CAAsB,MAAtB,CAHF,CAMAA,EAAA,CAAMA,CAAN,EAAaY,CAAAymC,MAAA,CAAc1kC,CAAd,CAED,EAAZ,EAAImP,CAAJ,GAEE9R,CAFF,CAEiB,EAAT,GAACA,CAAD,CAAexG,CAAf,CAA2BwG,CAFnC,CAKA,OAAQA,EAhBH,CAL2B,CA1B9B,MAmDAxC,QAAQ,CAACoD,CAAD,CAAU+B,CAAV,CAAgB3H,CAAhB,CAAsB,CAClC,IAAIq5C,EAAiB3zC,CAAA,CAAUiC,CAAV,CACrB,IAAIkO,EAAA,CAAawjC,CAAb,CAAJ,CACE,GAAI13C,CAAA,CAAU3B,CAAV,CAAJ,CACQA,CAAN,EACE4F,CAAA,CAAQ+B,CAAR,CACA,CADgB,CAAA,CAChB,CAAA/B,CAAAoP,aAAA,CAAqBrN,CAArB,CAA2B0xC,CAA3B,CAFF,GAIEzzC,CAAA,CAAQ+B,CAAR,CACA,CADgB,CAAA,CAChB,CAAA/B,CAAAszC,gBAAA,CAAwBG,CAAxB,CALF,CADF;IASE,OAAQzzC,EAAA,CAAQ+B,CAAR,CAED,EADGkf,CAAAjhB,CAAAoC,WAAAsxC,aAAA,CAAgC3xC,CAAhC,CAAAkf,EAAwCvlB,CAAxCulB,WACH,CAAEwyB,CAAF,CACE76C,CAbb,KAeO,IAAImD,CAAA,CAAU3B,CAAV,CAAJ,CACL4F,CAAAoP,aAAA,CAAqBrN,CAArB,CAA2B3H,CAA3B,CADK,KAEA,IAAI4F,CAAAiP,aAAJ,CAKL,MAFI0kC,EAEG,CAFG3zC,CAAAiP,aAAA,CAAqBlN,CAArB,CAA2B,CAA3B,CAEH,CAAQ,IAAR,GAAA4xC,CAAA,CAAe/6C,CAAf,CAA2B+6C,CAxBF,CAnD9B,MA+EAh3C,QAAQ,CAACqD,CAAD,CAAU+B,CAAV,CAAgB3H,CAAhB,CAAuB,CACnC,GAAI2B,CAAA,CAAU3B,CAAV,CAAJ,CACE4F,CAAA,CAAQ+B,CAAR,CAAA,CAAgB3H,CADlB,KAGE,OAAO4F,EAAA,CAAQ+B,CAAR,CAJ0B,CA/E/B,MAuFC,QAAQ,EAAG,CAYhB6xC,QAASA,EAAO,CAAC5zC,CAAD,CAAU5F,CAAV,CAAiB,CAC/B,IAAIy5C,EAAWC,CAAA,CAAwB9zC,CAAA9G,SAAxB,CACf,IAAI4C,CAAA,CAAY1B,CAAZ,CAAJ,CACE,MAAOy5C,EAAA,CAAW7zC,CAAA,CAAQ6zC,CAAR,CAAX,CAA+B,EAExC7zC,EAAA,CAAQ6zC,CAAR,CAAA,CAAoBz5C,CALW,CAXjC,IAAI05C,EAA0B,EACnB,EAAX,CAAI5iC,CAAJ,EACE4iC,CAAA,CAAwB,CAAxB,CACA,CAD6B,WAC7B,CAAAA,CAAA,CAAwB,CAAxB,CAAA,CAA6B,WAF/B,EAIEA,CAAA,CAAwB,CAAxB,CAJF,CAKEA,CAAA,CAAwB,CAAxB,CALF,CAK+B,aAE/BF,EAAAG,IAAA,CAAc,EACd,OAAOH,EAVS,CAAX,EAvFD,KA4GDx0C,QAAQ,CAACY,CAAD,CAAU5F,CAAV,CAAiB,CAC5B,GAAI0B,CAAA,CAAY1B,CAAZ,CAAJ,CAAwB,CACtB,GAA2B,QAA3B,GAAIwmB,EAAA,CAAU5gB,CAAV,CAAJ,EAAuCA,CAAAg0C,SAAvC,CAAyD,CACvD,IAAIz+B,EAAS,EACblc,EAAA,CAAQ2G,CAAAwa,QAAR,CAAyB,QAAS,CAACm4B,CAAD,CAAS,CACrCA,CAAAsB,SAAJ;AACE1+B,CAAAzb,KAAA,CAAY64C,CAAAv4C,MAAZ,EAA4Bu4C,CAAAjqB,KAA5B,CAFuC,CAA3C,CAKA,OAAyB,EAAlB,GAAAnT,CAAAtc,OAAA,CAAsB,IAAtB,CAA6Bsc,CAPmB,CASzD,MAAOvV,EAAA5F,MAVe,CAYxB4F,CAAA5F,MAAA,CAAgBA,CAbY,CA5GxB,MA4HAmG,QAAQ,CAACP,CAAD,CAAU5F,CAAV,CAAiB,CAC7B,GAAI0B,CAAA,CAAY1B,CAAZ,CAAJ,CACE,MAAO4F,EAAA8M,UAET,KAJ6B,IAIpB7S,EAAI,CAJgB,CAIboT,EAAarN,CAAAqN,WAA7B,CAAiDpT,CAAjD,CAAqDoT,CAAApU,OAArD,CAAwEgB,CAAA,EAAxE,CACE0T,EAAA,CAAaN,CAAA,CAAWpT,CAAX,CAAb,CAEF+F,EAAA8M,UAAA,CAAoB1S,CAPS,CA5HzB,OAsIC0V,EAtID,CAAR,CAuIG,QAAQ,CAACjR,CAAD,CAAKkD,CAAL,CAAU,CAInBgK,CAAAkI,UAAA,CAAiBlS,CAAjB,CAAA,CAAyB,QAAQ,CAACm4B,CAAD,CAAOC,CAAP,CAAa,CAAA,IACxClgC,CADwC,CACrCT,CAKP,IAAIqF,CAAJ,GAAWiR,EAAX,GACoB,CAAd,EAACjR,CAAA5F,OAAD,EAAoB4F,CAApB,GAA2BkQ,EAA3B,EAA6ClQ,CAA7C,GAAoD4Q,EAApD,CAAyEyqB,CAAzE,CAAgFC,CADtF,IACgGvhC,CADhG,CAC4G,CAC1G,GAAIoD,CAAA,CAASk+B,CAAT,CAAJ,CAAoB,CAGlB,IAAKjgC,CAAL,CAAS,CAAT,CAAYA,CAAZ,CAAgB,IAAAhB,OAAhB,CAA6BgB,CAAA,EAA7B,CACE,GAAI4E,CAAJ,GAAW8P,EAAX,CAEE9P,CAAA,CAAG,IAAA,CAAK5E,CAAL,CAAH,CAAYigC,CAAZ,CAFF,KAIE,KAAK1gC,CAAL,GAAY0gC,EAAZ,CACEr7B,CAAA,CAAG,IAAA,CAAK5E,CAAL,CAAH,CAAYT,CAAZ,CAAiB0gC,CAAA,CAAK1gC,CAAL,CAAjB,CAKN,OAAO,KAdW,CAiBdY,CAAAA,CAAQyE,CAAAk1C,IAER3mC,EAAAA,CAAMhT,CAAD,GAAWxB,CAAX,CAAwB8tB,IAAAqjB,IAAA,CAAS,IAAA9wC,OAAT,CAAsB,CAAtB,CAAxB,CAAmD,IAAAA,OAC5D,KAAK,IAAIkU,EAAI,CAAb,CAAgBA,CAAhB,CAAoBC,CAApB,CAAwBD,CAAA,EAAxB,CAA6B,CAC3B,IAAI+Q,EAAYrf,CAAA,CAAG,IAAA,CAAKsO,CAAL,CAAH,CAAY+sB,CAAZ,CAAkBC,CAAlB,CAChB//B,EAAA;AAAQA,CAAA,CAAQA,CAAR,CAAgB8jB,CAAhB,CAA4BA,CAFT,CAI7B,MAAO9jB,EAzBiG,CA6B1G,IAAKH,CAAL,CAAS,CAAT,CAAYA,CAAZ,CAAgB,IAAAhB,OAAhB,CAA6BgB,CAAA,EAA7B,CACE4E,CAAA,CAAG,IAAA,CAAK5E,CAAL,CAAH,CAAYigC,CAAZ,CAAkBC,CAAlB,CAGF,OAAO,KAxCmC,CAJ3B,CAvIrB,CAqPA9gC,EAAA,CAAQ,YACMuU,EADN,QAGED,EAHF,IAKFumC,QAASA,EAAI,CAACl0C,CAAD,CAAU8N,CAAV,CAAgBjP,CAAhB,CAAoBkP,CAApB,CAAgC,CAC/C,GAAIhS,CAAA,CAAUgS,CAAV,CAAJ,CAA4B,KAAM9B,GAAA,CAAa,QAAb,CAAN,CADmB,IAG3C+B,EAASC,EAAA,CAAmBjO,CAAnB,CAA4B,QAA5B,CAHkC,CAI3CkO,EAASD,EAAA,CAAmBjO,CAAnB,CAA4B,QAA5B,CAERgO,EAAL,EAAaC,EAAA,CAAmBjO,CAAnB,CAA4B,QAA5B,CAAsCgO,CAAtC,CAA+C,EAA/C,CACRE,EAAL,EAAaD,EAAA,CAAmBjO,CAAnB,CAA4B,QAA5B,CAAsCkO,CAAtC,CAA+CiC,EAAA,CAAmBnQ,CAAnB,CAA4BgO,CAA5B,CAA/C,CAEb3U,EAAA,CAAQyU,CAAA9M,MAAA,CAAW,GAAX,CAAR,CAAyB,QAAQ,CAAC8M,CAAD,CAAM,CACrC,IAAIqmC,EAAWnmC,CAAA,CAAOF,CAAP,CAEf,IAAI,CAACqmC,CAAL,CAAe,CACb,GAAY,YAAZ,EAAIrmC,CAAJ,EAAoC,YAApC,EAA4BA,CAA5B,CAAkD,CAChD,IAAIsmC,EAAWz7C,CAAA64B,KAAA4iB,SAAA,EAA0Bz7C,CAAA64B,KAAA6iB,wBAA1B,CACf,QAAQ,CAAE7vB,CAAF,CAAKC,CAAL,CAAS,CAAA,IAEX6vB,EAAuB,CAAf,GAAA9vB,CAAAtrB,SAAA,CAAmBsrB,CAAA+vB,gBAAnB,CAAuC/vB,CAFpC,CAGfgwB,EAAM/vB,CAAN+vB,EAAW/vB,CAAA7U,WACX,OAAO4U,EAAP,GAAagwB,CAAb,EAAoB,CAAC,EAAGA,CAAH,EAA2B,CAA3B,GAAUA,CAAAt7C,SAAV,GACnBo7C,CAAAF,SAAA,CACAE,CAAAF,SAAA,CAAgBI,CAAhB,CADA;AAEAhwB,CAAA6vB,wBAFA,EAE6B7vB,CAAA6vB,wBAAA,CAA2BG,CAA3B,CAF7B,CAEgE,EAH7C,EAJN,CADF,CAWb,QAAQ,CAAEhwB,CAAF,CAAKC,CAAL,CAAS,CACf,GAAKA,CAAL,CACE,IAAA,CAASA,CAAT,CAAaA,CAAA7U,WAAb,CAAA,CACE,GAAK6U,CAAL,GAAWD,CAAX,CACE,MAAO,CAAA,CAIb,OAAO,CAAA,CARQ,CAWnBxW,EAAA,CAAOF,CAAP,CAAA,CAAe,EAOfomC,EAAA,CAAKl0C,CAAL,CAFey0C,YAAe,UAAfA,YAAwC,WAAxCA,CAED,CAAS3mC,CAAT,CAAd,CAA8B,QAAQ,CAACsC,CAAD,CAAQ,CAC5C,IAAmBskC,EAAUtkC,CAAAukC,cAGvBD,EAAN,GAAkBA,CAAlB,GAHa/jC,IAGb,EAAyCyjC,CAAA,CAH5BzjC,IAG4B,CAAiB+jC,CAAjB,CAAzC,GACExmC,CAAA,CAAOkC,CAAP,CAActC,CAAd,CAL0C,CAA9C,CA9BgD,CAAlD,IAwCEqkC,GAAA,CAAmBnyC,CAAnB,CAA4B8N,CAA5B,CAAkCI,CAAlC,CACA,CAAAF,CAAA,CAAOF,CAAP,CAAA,CAAe,EAEjBqmC,EAAA,CAAWnmC,CAAA,CAAOF,CAAP,CA5CE,CA8CfqmC,CAAAr6C,KAAA,CAAc+E,CAAd,CAjDqC,CAAvC,CAT+C,CAL3C,KAmEDgP,EAnEC,KAqED+mC,QAAQ,CAAC50C,CAAD,CAAU8N,CAAV,CAAgBjP,CAAhB,CAAoB,CAC/BmB,CAAA,CAAUC,CAAA,CAAOD,CAAP,CAKVA,EAAA6Y,GAAA,CAAW/K,CAAX,CAAiBomC,QAASA,EAAI,EAAG,CAC/Bl0C,CAAA60C,IAAA,CAAY/mC,CAAZ,CAAkBjP,CAAlB,CACAmB,EAAA60C,IAAA,CAAY/mC,CAAZ,CAAkBomC,CAAlB,CAF+B,CAAjC,CAIAl0C,EAAA6Y,GAAA,CAAW/K,CAAX,CAAiBjP,CAAjB,CAV+B,CArE3B,aAkFOmnB,QAAQ,CAAChmB,CAAD,CAAU80C,CAAV,CAAuB,CAAA,IACtCx6C,CADsC,CAC/BkB,EAASwE,CAAA4P,WACpBjC,GAAA,CAAa3N,CAAb,CACA3G,EAAA,CAAQ,IAAI0S,CAAJ,CAAW+oC,CAAX,CAAR,CAAiC,QAAQ,CAACr4C,CAAD,CAAM,CACzCnC,CAAJ,CACEkB,CAAAu5C,aAAA,CAAoBt4C,CAApB,CAA0BnC,CAAAuK,YAA1B,CADF;AAGErJ,CAAAquB,aAAA,CAAoBptB,CAApB,CAA0BuD,CAA1B,CAEF1F,EAAA,CAAQmC,CANqC,CAA/C,CAH0C,CAlFtC,UA+FI+O,QAAQ,CAACxL,CAAD,CAAU,CAC1B,IAAIwL,EAAW,EACfnS,EAAA,CAAQ2G,CAAAqN,WAAR,CAA4B,QAAQ,CAACrN,CAAD,CAAS,CAClB,CAAzB,GAAIA,CAAA9G,SAAJ,EACEsS,CAAA1R,KAAA,CAAckG,CAAd,CAFyC,CAA7C,CAIA,OAAOwL,EANmB,CA/FtB,UAwGI0a,QAAQ,CAAClmB,CAAD,CAAU,CAC1B,MAAOA,EAAAg1C,gBAAP,EAAkCh1C,CAAAqN,WAAlC,EAAwD,EAD9B,CAxGtB,QA4GE/M,QAAQ,CAACN,CAAD,CAAUvD,CAAV,CAAgB,CAC9BpD,CAAA,CAAQ,IAAI0S,CAAJ,CAAWtP,CAAX,CAAR,CAA0B,QAAQ,CAAC6jC,CAAD,CAAO,CACd,CAAzB,GAAItgC,CAAA9G,SAAJ,EAAmD,EAAnD,GAA8B8G,CAAA9G,SAA9B,EACE8G,CAAAwM,YAAA,CAAoB8zB,CAApB,CAFqC,CAAzC,CAD8B,CA5G1B,SAoHG2U,QAAQ,CAACj1C,CAAD,CAAUvD,CAAV,CAAgB,CAC/B,GAAyB,CAAzB,GAAIuD,CAAA9G,SAAJ,CAA4B,CAC1B,IAAIoB,EAAQ0F,CAAAiN,WACZ5T,EAAA,CAAQ,IAAI0S,CAAJ,CAAWtP,CAAX,CAAR,CAA0B,QAAQ,CAAC6jC,CAAD,CAAO,CACvCtgC,CAAA+0C,aAAA,CAAqBzU,CAArB,CAA4BhmC,CAA5B,CADuC,CAAzC,CAF0B,CADG,CApH3B,MA6HAqS,QAAQ,CAAC3M,CAAD,CAAUk1C,CAAV,CAAoB,CAChCA,CAAA,CAAWj1C,CAAA,CAAOi1C,CAAP,CAAA,CAAiB,CAAjB,CACX,KAAI15C,EAASwE,CAAA4P,WACTpU,EAAJ,EACEA,CAAAquB,aAAA,CAAoBqrB,CAApB,CAA8Bl1C,CAA9B,CAEFk1C,EAAA1oC,YAAA,CAAqBxM,CAArB,CANgC,CA7H5B,QAsIE0b,QAAQ,CAAC1b,CAAD,CAAU,CACxB2N,EAAA,CAAa3N,CAAb,CACA;IAAIxE,EAASwE,CAAA4P,WACTpU,EAAJ,EAAYA,CAAAwR,YAAA,CAAmBhN,CAAnB,CAHY,CAtIpB,OA4ICm1C,QAAQ,CAACn1C,CAAD,CAAUo1C,CAAV,CAAsB,CAAA,IAC/B96C,EAAQ0F,CADuB,CACdxE,EAASwE,CAAA4P,WAC9BvW,EAAA,CAAQ,IAAI0S,CAAJ,CAAWqpC,CAAX,CAAR,CAAgC,QAAQ,CAAC34C,CAAD,CAAM,CAC5CjB,CAAAu5C,aAAA,CAAoBt4C,CAApB,CAA0BnC,CAAAuK,YAA1B,CACAvK,EAAA,CAAQmC,CAFoC,CAA9C,CAFmC,CA5I/B,UAoJI6S,EApJJ,aAqJOJ,EArJP,aAuJOmmC,QAAQ,CAACr1C,CAAD,CAAUgP,CAAV,CAAoBsmC,CAApB,CAA+B,CAC9CtmC,CAAJ,EACE3V,CAAA,CAAQ2V,CAAAhO,MAAA,CAAe,GAAf,CAAR,CAA6B,QAAQ,CAACmB,CAAD,CAAW,CAC9C,IAAIozC,EAAiBD,CACjBx5C,EAAA,CAAYy5C,CAAZ,CAAJ,GACEA,CADF,CACmB,CAACxmC,EAAA,CAAe/O,CAAf,CAAwBmC,CAAxB,CADpB,CAGC,EAAAozC,CAAA,CAAiBjmC,EAAjB,CAAkCJ,EAAlC,EAAqDlP,CAArD,CAA8DmC,CAA9D,CAL6C,CAAhD,CAFgD,CAvJ9C,QAmKE3G,QAAQ,CAACwE,CAAD,CAAU,CAExB,MAAO,CADHxE,CACG,CADMwE,CAAA4P,WACN,GAA8B,EAA9B,GAAUpU,CAAAtC,SAAV,CAAmCsC,CAAnC,CAA4C,IAF3B,CAnKpB,MAwKAgnC,QAAQ,CAACxiC,CAAD,CAAU,CACtB,GAAIA,CAAAw1C,mBAAJ,CACE,MAAOx1C,EAAAw1C,mBAKT,KADI9/B,CACJ,CADU1V,CAAA6E,YACV,CAAc,IAAd,EAAO6Q,CAAP,EAAuC,CAAvC,GAAsBA,CAAAxc,SAAtB,CAAA,CACEwc,CAAA,CAAMA,CAAA7Q,YAER,OAAO6Q,EAVe,CAxKlB,MAqLA7Y,QAAQ,CAACmD,CAAD,CAAUgP,CAAV,CAAoB,CAChC,MAAIhP,EAAAy1C,qBAAJ;AACSz1C,CAAAy1C,qBAAA,CAA6BzmC,CAA7B,CADT,CAGS,EAJuB,CArL5B,OA6LCvB,EA7LD,gBA+LU/B,QAAQ,CAAC1L,CAAD,CAAU01C,CAAV,CAAqBC,CAArB,CAAgC,CAClDxB,CAAAA,CAAW,CAAClmC,EAAA,CAAmBjO,CAAnB,CAA4B,QAA5B,CAAD,EAA0C,EAA1C,EAA8C01C,CAA9C,CAEfC,EAAA,CAAYA,CAAZ,EAAyB,EAEzB,KAAIvlC,EAAQ,CAAC,gBACK1U,CADL,iBAEMA,CAFN,CAAD,CAKZrC,EAAA,CAAQ86C,CAAR,CAAkB,QAAQ,CAACt1C,CAAD,CAAK,CAC7BA,CAAAI,MAAA,CAASe,CAAT,CAAkBoQ,CAAAlR,OAAA,CAAay2C,CAAb,CAAlB,CAD6B,CAA/B,CAVsD,CA/LlD,CAAR,CA6MG,QAAQ,CAAC92C,CAAD,CAAKkD,CAAL,CAAU,CAInBgK,CAAAkI,UAAA,CAAiBlS,CAAjB,CAAA,CAAyB,QAAQ,CAACm4B,CAAD,CAAOC,CAAP,CAAayb,CAAb,CAAmB,CAElD,IADA,IAAIx7C,CAAJ,CACQH,EAAE,CAAV,CAAaA,CAAb,CAAiB,IAAAhB,OAAjB,CAA8BgB,CAAA,EAA9B,CACM6B,CAAA,CAAY1B,CAAZ,CAAJ,EACEA,CACA,CADQyE,CAAA,CAAG,IAAA,CAAK5E,CAAL,CAAH,CAAYigC,CAAZ,CAAkBC,CAAlB,CAAwByb,CAAxB,CACR,CAAI75C,CAAA,CAAU3B,CAAV,CAAJ,GAEEA,CAFF,CAEU6F,CAAA,CAAO7F,CAAP,CAFV,CAFF,EAOEoT,EAAA,CAAepT,CAAf,CAAsByE,CAAA,CAAG,IAAA,CAAK5E,CAAL,CAAH,CAAYigC,CAAZ,CAAkBC,CAAlB,CAAwByb,CAAxB,CAAtB,CAGJ,OAAO75C,EAAA,CAAU3B,CAAV,CAAA,CAAmBA,CAAnB,CAA2B,IAbgB,CAiBpD2R,EAAAkI,UAAAtV,KAAA,CAAwBoN,CAAAkI,UAAA4E,GACxB9M,EAAAkI,UAAA4hC,OAAA,CAA0B9pC,CAAAkI,UAAA4gC,IAtBP,CA7MrB,CA0QAvjC,GAAA2C,UAAA,CAAoB,KAMb1C,QAAQ,CAAC/X,CAAD,CAAMY,CAAN,CAAa,CACxB,IAAA,CAAKgX,EAAA,CAAQ5X,CAAR,CAAL,CAAA,CAAqBY,CADG,CANR,KAcb4Y,QAAQ,CAACxZ,CAAD,CAAM,CACjB,MAAO,KAAA,CAAK4X,EAAA,CAAQ5X,CAAR,CAAL,CADU,CAdD;OAsBVkiB,QAAQ,CAACliB,CAAD,CAAM,CACpB,IAAIY,EAAQ,IAAA,CAAKZ,CAAL,CAAW4X,EAAA,CAAQ5X,CAAR,CAAX,CACZ,QAAO,IAAA,CAAKA,CAAL,CACP,OAAOY,EAHa,CAtBJ,CA0FpB,KAAIyX,GAAU,oCAAd,CACIC,GAAe,GADnB,CAEIC,GAAS,sBAFb,CAGIJ,GAAiB,kCAHrB,CAII5M,GAAkBlM,CAAA,CAAO,WAAP,CAJtB,CAo0BIi9C,GAAiBj9C,CAAA,CAAO,UAAP,CAp0BrB,CAm1BIiQ,GAAmB,CAAC,UAAD,CAAa,QAAQ,CAACrG,CAAD,CAAW,CAGrD,IAAAszC,YAAA,CAAmB,EAkCnB,KAAAtqB,SAAA,CAAgBC,QAAQ,CAAC3pB,CAAD,CAAOkD,CAAP,CAAgB,CACtC,IAAIzL,EAAMuI,CAANvI,CAAa,YACjB,IAAIuI,CAAJ,EAA8B,GAA9B,EAAYA,CAAA/D,OAAA,CAAY,CAAZ,CAAZ,CAAmC,KAAM83C,GAAA,CAAe,SAAf,CACoB/zC,CADpB,CAAN,CAEnC,IAAAg0C,YAAA,CAAiBh0C,CAAAqf,OAAA,CAAY,CAAZ,CAAjB,CAAA,CAAmC5nB,CACnCiJ,EAAAwC,QAAA,CAAiBzL,CAAjB,CAAsByL,CAAtB,CALsC,CAsBxC,KAAA+wC,gBAAA,CAAuBC,QAAQ,CAACtqB,CAAD,CAAa,CAClB,CAAxB,GAAGxwB,SAAAlC,OAAH,GACE,IAAAi9C,kBADF,CAC4BvqB,CAAD,WAAuB9tB,OAAvB;AAAiC8tB,CAAjC,CAA8C,IADzE,CAGA,OAAO,KAAAuqB,kBAJmC,CAO5C,KAAAzjC,KAAA,CAAY,CAAC,UAAD,CAAa,iBAAb,CAAgC,QAAQ,CAACwD,CAAD,CAAWkgC,CAAX,CAA4B,CAuB9E,MAAO,OAiBGC,QAAQ,CAACp2C,CAAD,CAAUxE,CAAV,CAAkB25C,CAAlB,CAAyB3lB,CAAzB,CAA+B,CACzC2lB,CAAJ,CACEA,CAAAA,MAAA,CAAYn1C,CAAZ,CADF,EAGOxE,CAGL,EAHgBA,CAAA,CAAO,CAAP,CAGhB,GAFEA,CAEF,CAFW25C,CAAA35C,OAAA,EAEX,EAAAA,CAAA8E,OAAA,CAAcN,CAAd,CANF,CAQMwvB,EA9CR,EAAM2mB,CAAA,CA8CE3mB,CA9CF,CAqCyC,CAjB1C,OAwCG6mB,QAAQ,CAACr2C,CAAD,CAAUwvB,CAAV,CAAgB,CAC9BxvB,CAAA0b,OAAA,EACM8T,EA9DR,EAAM2mB,CAAA,CA8DE3mB,CA9DF,CA4D0B,CAxC3B,MA+DE8mB,QAAQ,CAACt2C,CAAD,CAAUxE,CAAV,CAAkB25C,CAAlB,CAAyB3lB,CAAzB,CAA+B,CAG5C,IAAA4mB,MAAA,CAAWp2C,CAAX,CAAoBxE,CAApB,CAA4B25C,CAA5B,CAAmC3lB,CAAnC,CAH4C,CA/DzC,UAkFM3Q,QAAQ,CAAC7e,CAAD,CAAUmC,CAAV,CAAqBqtB,CAArB,CAA2B,CAC5CrtB,CAAA,CAAYhJ,CAAA,CAASgJ,CAAT,CAAA,CACEA,CADF,CAEE/I,CAAA,CAAQ+I,CAAR,CAAA,CAAqBA,CAAAzH,KAAA,CAAe,GAAf,CAArB,CAA2C,EACzDrB,EAAA,CAAQ2G,CAAR,CAAiB,QAAS,CAACA,CAAD,CAAU,CAClCsP,EAAA,CAAetP,CAAf,CAAwBmC,CAAxB,CADkC,CAApC,CAGMqtB,EA7GR,EAAM2mB,CAAA,CA6GE3mB,CA7GF,CAsGwC,CAlFzC,aAyGSnF,QAAQ,CAACrqB,CAAD,CAAUmC,CAAV,CAAqBqtB,CAArB,CAA2B,CAC/CrtB,CAAA,CAAYhJ,CAAA,CAASgJ,CAAT,CAAA,CACEA,CADF,CAEE/I,CAAA,CAAQ+I,CAAR,CAAA,CAAqBA,CAAAzH,KAAA,CAAe,GAAf,CAArB,CAA2C,EACzDrB,EAAA,CAAQ2G,CAAR,CAAiB,QAAS,CAACA,CAAD,CAAU,CAClCkP,EAAA,CAAkBlP,CAAlB,CAA2BmC,CAA3B,CADkC,CAApC,CAGMqtB,EApIR,EAAM2mB,CAAA,CAoIE3mB,CApIF,CA6H2C,CAzG5C,UAiIM9E,QAAQ,CAAC1qB,CAAD,CAAUu2C,CAAV,CAAe76B,CAAf,CAAuB8T,CAAvB,CAA6B,CAC9Cn2B,CAAA,CAAQ2G,CAAR,CAAiB,QAAS,CAACA,CAAD,CAAU,CAClCsP,EAAA,CAAetP,CAAf,CAAwBu2C,CAAxB,CACArnC,GAAA,CAAkBlP,CAAlB;AAA2B0b,CAA3B,CAFkC,CAApC,CAIM8T,EA1JR,EAAM2mB,CAAA,CA0JE3mB,CA1JF,CAqJ0C,CAjI3C,SAyIK9zB,CAzIL,CAvBuE,CAApE,CAlEyC,CAAhC,CAn1BvB,CAm0EIomB,GAAiBjpB,CAAA,CAAO,UAAP,CASrBwN,GAAAoL,QAAA,CAA2B,CAAC,UAAD,CAAa,uBAAb,CAy5C3B,KAAIwZ,GAAgB,0BAApB,CAi8CIqI,GAAqBz6B,CAAA,CAAO,cAAP,CAj8CzB,CA66DI29C,GAAa,iCA76DjB,CA86DIlhB,GAAgB,MAAS,EAAT,OAAsB,GAAtB,KAAkC,EAAlC,CA96DpB,CA+6DIsB,GAAkB/9B,CAAA,CAAO,WAAP,CA6QtB8+B,GAAA1jB,UAAA,CACEojB,EAAApjB,UADF,CAEEoiB,EAAApiB,UAFF,CAE+B,SAMpB,CAAA,CANoB,WAYlB,CAAA,CAZkB,QA0BrB2jB,EAAA,CAAe,UAAf,CA1BqB,KA2CxBvgB,QAAQ,CAACA,CAAD,CAAM3W,CAAN,CAAe,CAC1B,GAAI5E,CAAA,CAAYub,CAAZ,CAAJ,CACE,MAAO,KAAA0f,MAET,KAAIt2B,EAAQ+1C,EAAAt0C,KAAA,CAAgBmV,CAAhB,CACR5W,EAAA,CAAM,CAAN,CAAJ,EAAc,IAAA4D,KAAA,CAAUzD,kBAAA,CAAmBH,CAAA,CAAM,CAAN,CAAnB,CAAV,CACd,EAAIA,CAAA,CAAM,CAAN,CAAJ,EAAgBA,CAAA,CAAM,CAAN,CAAhB,GAA0B,IAAAo1B,OAAA,CAAYp1B,CAAA,CAAM,CAAN,CAAZ,EAAwB,EAAxB,CAC1B,KAAAgV,KAAA,CAAUhV,CAAA,CAAM,CAAN,CAAV,EAAsB,EAAtB,CAA0BC,CAA1B,CAEA,OAAO,KATmB,CA3CC,UAkEnBk3B,EAAA,CAAe,YAAf,CAlEmB;KA+EvBA,EAAA,CAAe,QAAf,CA/EuB,MA4FvBA,EAAA,CAAe,QAAf,CA5FuB,MA+GvBE,EAAA,CAAqB,QAArB,CAA+B,QAAQ,CAACzzB,CAAD,CAAO,CAClD,MAAyB,GAAlB,EAAAA,CAAArG,OAAA,CAAY,CAAZ,CAAA,CAAwBqG,CAAxB,CAA+B,GAA/B,CAAqCA,CADM,CAA9C,CA/GuB,QAwIrBwxB,QAAQ,CAACA,CAAD,CAAS4gB,CAAT,CAAqB,CACnC,OAAQt7C,SAAAlC,OAAR,EACE,KAAK,CAAL,CACE,MAAO,KAAA28B,SACT,MAAK,CAAL,CACE,GAAIz8B,CAAA,CAAS08B,CAAT,CAAJ,CACE,IAAAD,SAAA,CAAgB/0B,EAAA,CAAcg1B,CAAd,CADlB,KAEO,IAAI75B,CAAA,CAAS65B,CAAT,CAAJ,CACL,IAAAD,SAAA,CAAgBC,CADX,KAGL,MAAMe,GAAA,CAAgB,UAAhB,CAAN,CAGF,KACF,SACM96B,CAAA,CAAY26C,CAAZ,CAAJ,EAA8C,IAA9C,GAA+BA,CAA/B,CACE,OAAO,IAAA7gB,SAAA,CAAcC,CAAd,CADT,CAGE,IAAAD,SAAA,CAAcC,CAAd,CAHF,CAG0B4gB,CAjB9B,CAqBA,IAAA5f,UAAA,EACA,OAAO,KAvB4B,CAxIR,MAgLvBiB,EAAA,CAAqB,QAArB,CAA+Bn8B,EAA/B,CAhLuB,SA0LpB+E,QAAQ,EAAG,CAClB,IAAA24B,UAAA,CAAiB,CAAA,CACjB,OAAO,KAFW,CA1LS,CAkkB/B,KAAIiB,GAAezhC,CAAA,CAAO,QAAP,CAAnB,CACIwjC,GAAsB,EAD1B,CAEIxB,EAFJ,CAgEI6b,GAAY,CAEZ,MAFY,CAELC,QAAQ,EAAE,CAAC,MAAO,KAAR,CAFL,CAGZ,MAHY,CAGLC,QAAQ,EAAE,CAAC,MAAO,CAAA,CAAR,CAHL;AAIZ,OAJY,CAIJC,QAAQ,EAAE,CAAC,MAAO,CAAA,CAAR,CAJN,WAKFn7C,CALE,CAMZ,GANY,CAMRo7C,QAAQ,CAACl4C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAC7BD,CAAA,CAAEA,CAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAiB6Q,EAAA,CAAEA,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CACrB,OAAI7X,EAAA,CAAUyoB,CAAV,CAAJ,CACMzoB,CAAA,CAAU0oB,CAAV,CAAJ,CACSD,CADT,CACaC,CADb,CAGOD,CAJT,CAMOzoB,CAAA,CAAU0oB,CAAV,CAAA,CAAaA,CAAb,CAAe7rB,CARO,CANnB,CAeZ,GAfY,CAeRm+C,QAAQ,CAACn4C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CACzBD,CAAA,CAAEA,CAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAiB6Q,EAAA,CAAEA,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CACrB,QAAQ7X,CAAA,CAAUyoB,CAAV,CAAA,CAAaA,CAAb,CAAe,CAAvB,GAA2BzoB,CAAA,CAAU0oB,CAAV,CAAA,CAAaA,CAAb,CAAe,CAA1C,CAFyB,CAfnB,CAmBZ,GAnBY,CAmBRuyB,QAAQ,CAACp4C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,CAAuB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAxB,CAnBnB,CAoBZ,GApBY,CAoBRqjC,QAAQ,CAACr4C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,CAAuB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAxB,CApBnB,CAqBZ,GArBY,CAqBRsjC,QAAQ,CAACt4C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,CAAuB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAxB,CArBnB,CAsBZ,GAtBY,CAsBRujC,QAAQ,CAACv4C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,CAAuB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAxB,CAtBnB,CAuBZ,GAvBY,CAuBRlY,CAvBQ,CAwBZ,KAxBY,CAwBN07C,QAAQ,CAACx4C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAkBC,CAAlB,CAAoB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,GAAyB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAA1B,CAxBtB,CAyBZ,KAzBY,CAyBNyjC,QAAQ,CAACz4C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAkBC,CAAlB,CAAoB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,GAAyB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAA1B,CAzBtB,CA0BZ,IA1BY,CA0BP0jC,QAAQ,CAAC14C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,EAAwB6Q,CAAA,CAAE7lB,CAAF;AAAQgV,CAAR,CAAzB,CA1BpB,CA2BZ,IA3BY,CA2BP2jC,QAAQ,CAAC34C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,EAAwB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAzB,CA3BpB,CA4BZ,GA5BY,CA4BR4jC,QAAQ,CAAC54C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,CAAuB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAxB,CA5BnB,CA6BZ,GA7BY,CA6BR6jC,QAAQ,CAAC74C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,CAAuB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAxB,CA7BnB,CA8BZ,IA9BY,CA8BP8jC,QAAQ,CAAC94C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,EAAwB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAzB,CA9BpB,CA+BZ,IA/BY,CA+BP+jC,QAAQ,CAAC/4C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,EAAwB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAzB,CA/BpB,CAgCZ,IAhCY,CAgCPgkC,QAAQ,CAACh5C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,EAAwB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAzB,CAhCpB,CAiCZ,IAjCY,CAiCPikC,QAAQ,CAACj5C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,EAAwB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAzB,CAjCpB,CAkCZ,GAlCY,CAkCRkkC,QAAQ,CAACl5C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOD,EAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAP,CAAuB6Q,CAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAxB,CAlCnB,CAoCZ,GApCY,CAoCRmkC,QAAQ,CAACn5C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiBC,CAAjB,CAAmB,CAAC,MAAOA,EAAA,CAAE7lB,CAAF,CAAQgV,CAAR,CAAA,CAAgBhV,CAAhB,CAAsBgV,CAAtB,CAA8B4Q,CAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAA9B,CAAR,CApCnB,CAqCZ,GArCY,CAqCRokC,QAAQ,CAACp5C,CAAD,CAAOgV,CAAP,CAAe4Q,CAAf,CAAiB,CAAC,MAAO,CAACA,CAAA,CAAE5lB,CAAF,CAAQgV,CAAR,CAAT,CArCjB,CAhEhB,CAwGIqkC,GAAS,GAAK,IAAL,GAAe,IAAf,GAAyB,IAAzB,GAAmC,IAAnC,GAA6C,IAA7C,CAAmD,GAAnD,CAAuD,GAAvD,CAA4D,GAA5D,CAAgE,GAAhE,CAxGb;AAiHIzb,GAAQA,QAAS,CAAChiB,CAAD,CAAU,CAC7B,IAAAA,QAAA,CAAeA,CADc,CAI/BgiB,GAAAvoB,UAAA,CAAkB,aACHuoB,EADG,KAGX0b,QAAS,CAACxvB,CAAD,CAAO,CACnB,IAAAA,KAAA,CAAYA,CAEZ,KAAApuB,MAAA,CAAa,CACb,KAAA69C,GAAA,CAAUv/C,CACV,KAAAw/C,OAAA,CAAc,GAEd,KAAAC,OAAA,CAAc,EAEd,KAAI9sB,CAGJ,KAFI7rB,CAEJ,CAFW,EAEX,CAAO,IAAApF,MAAP,CAAoB,IAAAouB,KAAAzvB,OAApB,CAAA,CAAsC,CACpC,IAAAk/C,GAAA,CAAU,IAAAzvB,KAAA1qB,OAAA,CAAiB,IAAA1D,MAAjB,CACV,IAAI,IAAAg+C,GAAA,CAAQ,KAAR,CAAJ,CACE,IAAAC,WAAA,CAAgB,IAAAJ,GAAhB,CADF,KAEO,IAAI,IAAAl8C,SAAA,CAAc,IAAAk8C,GAAd,CAAJ,EAA8B,IAAAG,GAAA,CAAQ,GAAR,CAA9B,EAA8C,IAAAr8C,SAAA,CAAc,IAAAu8C,KAAA,EAAd,CAA9C,CACL,IAAAC,WAAA,EADK,KAEA,IAAI,IAAAC,QAAA,CAAa,IAAAP,GAAb,CAAJ,CACL,IAAAQ,UAAA,EAEA,CAAI,IAAAC,IAAA,CAAS,IAAT,CAAJ,GAAkC,GAAlC,GAAsBl5C,CAAA,CAAK,CAAL,CAAtB,GACK6rB,CADL,CACa,IAAA8sB,OAAA,CAAY,IAAAA,OAAAp/C,OAAZ,CAAiC,CAAjC,CADb,KAEEsyB,CAAA7rB,KAFF,CAE4C,EAF5C,GAEe6rB,CAAA7C,KAAAzrB,QAAA,CAAmB,GAAnB,CAFf,CAHK;IAOA,IAAI,IAAAq7C,GAAA,CAAQ,aAAR,CAAJ,CACL,IAAAD,OAAAv+C,KAAA,CAAiB,OACR,IAAAQ,MADQ,MAET,IAAA69C,GAFS,MAGR,IAAAS,IAAA,CAAS,KAAT,CAHQ,EAGW,IAAAN,GAAA,CAAQ,IAAR,CAHX,EAG6B,IAAAA,GAAA,CAAQ,MAAR,CAH7B,CAAjB,CAOA,CAFI,IAAAA,GAAA,CAAQ,IAAR,CAEJ,EAFmB54C,CAAA7E,QAAA,CAAa,IAAAs9C,GAAb,CAEnB,CADI,IAAAG,GAAA,CAAQ,IAAR,CACJ,EADmB54C,CAAA+L,MAAA,EACnB,CAAA,IAAAnR,MAAA,EARK,KASA,IAAI,IAAAu+C,aAAA,CAAkB,IAAAV,GAAlB,CAAJ,CAAgC,CACrC,IAAA79C,MAAA,EACA,SAFqC,CAAhC,IAGA,CACL,IAAIw+C,EAAM,IAAAX,GAANW,CAAgB,IAAAN,KAAA,EAApB,CACIO,EAAMD,CAANC,CAAY,IAAAP,KAAA,CAAU,CAAV,CADhB,CAEI35C,EAAK63C,EAAA,CAAU,IAAAyB,GAAV,CAFT,CAGIa,EAAMtC,EAAA,CAAUoC,CAAV,CAHV,CAIIG,EAAMvC,EAAA,CAAUqC,CAAV,CACNE,EAAJ,EACE,IAAAZ,OAAAv+C,KAAA,CAAiB,OAAQ,IAAAQ,MAAR,MAA0By+C,CAA1B,IAAmCE,CAAnC,CAAjB,CACA,CAAA,IAAA3+C,MAAA,EAAc,CAFhB,EAGW0+C,CAAJ,EACL,IAAAX,OAAAv+C,KAAA,CAAiB,OAAQ,IAAAQ,MAAR,MAA0Bw+C,CAA1B,IAAmCE,CAAnC,CAAjB,CACA,CAAA,IAAA1+C,MAAA,EAAc,CAFT,EAGIuE,CAAJ,EACL,IAAAw5C,OAAAv+C,KAAA,CAAiB,OACR,IAAAQ,MADQ;KAET,IAAA69C,GAFS,IAGXt5C,CAHW,MAIR,IAAA+5C,IAAA,CAAS,KAAT,CAJQ,EAIW,IAAAN,GAAA,CAAQ,IAAR,CAJX,CAAjB,CAMA,CAAA,IAAAh+C,MAAA,EAAc,CAPT,EASL,IAAA4+C,WAAA,CAAgB,4BAAhB,CAA8C,IAAA5+C,MAA9C,CAA0D,IAAAA,MAA1D,CAAuE,CAAvE,CArBG,CAwBP,IAAA89C,OAAA,CAAc,IAAAD,GAjDsB,CAmDtC,MAAO,KAAAE,OA/DY,CAHL,IAqEZC,QAAQ,CAACa,CAAD,CAAQ,CAClB,MAAmC,EAAnC,GAAOA,CAAAl8C,QAAA,CAAc,IAAAk7C,GAAd,CADW,CArEJ,KAyEXS,QAAQ,CAACO,CAAD,CAAQ,CACnB,MAAuC,EAAvC,GAAOA,CAAAl8C,QAAA,CAAc,IAAAm7C,OAAd,CADY,CAzEL,MA6EVI,QAAQ,CAACv+C,CAAD,CAAI,CACZw6B,CAAAA,CAAMx6B,CAANw6B,EAAW,CACf,OAAQ,KAAAn6B,MAAD,CAAcm6B,CAAd,CAAoB,IAAA/L,KAAAzvB,OAApB,CAAwC,IAAAyvB,KAAA1qB,OAAA,CAAiB,IAAA1D,MAAjB,CAA8Bm6B,CAA9B,CAAxC,CAA6E,CAAA,CAFpE,CA7EF,UAkFNx4B,QAAQ,CAACk8C,CAAD,CAAK,CACrB,MAAQ,GAAR,EAAeA,CAAf,EAA2B,GAA3B,EAAqBA,CADA,CAlFP,cAsFFU,QAAQ,CAACV,CAAD,CAAK,CAEzB,MAAe,GAAf,GAAQA,CAAR,EAA6B,IAA7B,GAAsBA,CAAtB,EAA4C,IAA5C,GAAqCA,CAArC,EACe,IADf,GACQA,CADR,EAC8B,IAD9B,GACuBA,CADvB,EAC6C,QAD7C;AACsCA,CAHb,CAtFX,SA4FPO,QAAQ,CAACP,CAAD,CAAK,CACpB,MAAQ,GAAR,EAAeA,CAAf,EAA2B,GAA3B,EAAqBA,CAArB,EACQ,GADR,EACeA,CADf,EAC2B,GAD3B,EACqBA,CADrB,EAEQ,GAFR,GAEgBA,CAFhB,EAE6B,GAF7B,GAEsBA,CAHF,CA5FN,eAkGDiB,QAAQ,CAACjB,CAAD,CAAK,CAC1B,MAAe,GAAf,GAAQA,CAAR,EAA6B,GAA7B,GAAsBA,CAAtB,EAAoC,IAAAl8C,SAAA,CAAck8C,CAAd,CADV,CAlGZ,YAsGJe,QAAQ,CAACxiC,CAAD,CAAQ2iC,CAAR,CAAeC,CAAf,CAAoB,CACtCA,CAAA,CAAMA,CAAN,EAAa,IAAAh/C,MACTi/C,EAAAA,CAAUx9C,CAAA,CAAUs9C,CAAV,CACA,CAAJ,IAAI,CAAGA,CAAH,CAAY,GAAZ,CAAkB,IAAA/+C,MAAlB,CAA+B,IAA/B,CAAsC,IAAAouB,KAAA9O,UAAA,CAAoBy/B,CAApB,CAA2BC,CAA3B,CAAtC,CAAwE,GAAxE,CACJ,GADI,CACEA,CAChB,MAAMhf,GAAA,CAAa,QAAb,CACF5jB,CADE,CACK6iC,CADL,CACa,IAAA7wB,KADb,CAAN,CALsC,CAtGxB,YA+GJ+vB,QAAQ,EAAG,CAGrB,IAFA,IAAIvP,EAAS,EAAb,CACImQ,EAAQ,IAAA/+C,MACZ,CAAO,IAAAA,MAAP,CAAoB,IAAAouB,KAAAzvB,OAApB,CAAA,CAAsC,CACpC,IAAIk/C,EAAKr4C,CAAA,CAAU,IAAA4oB,KAAA1qB,OAAA,CAAiB,IAAA1D,MAAjB,CAAV,CACT,IAAU,GAAV,EAAI69C,CAAJ,EAAiB,IAAAl8C,SAAA,CAAck8C,CAAd,CAAjB,CACEjP,CAAA,EAAUiP,CADZ,KAEO,CACL,IAAIqB,EAAS,IAAAhB,KAAA,EACb,IAAU,GAAV,EAAIL,CAAJ,EAAiB,IAAAiB,cAAA,CAAmBI,CAAnB,CAAjB,CACEtQ,CAAA;AAAUiP,CADZ,KAEO,IAAI,IAAAiB,cAAA,CAAmBjB,CAAnB,CAAJ,EACHqB,CADG,EACO,IAAAv9C,SAAA,CAAcu9C,CAAd,CADP,EAEiC,GAFjC,EAEHtQ,CAAAlrC,OAAA,CAAckrC,CAAAjwC,OAAd,CAA8B,CAA9B,CAFG,CAGLiwC,CAAA,EAAUiP,CAHL,KAIA,IAAI,CAAA,IAAAiB,cAAA,CAAmBjB,CAAnB,CAAJ,EACDqB,CADC,EACU,IAAAv9C,SAAA,CAAcu9C,CAAd,CADV,EAEiC,GAFjC,EAEHtQ,CAAAlrC,OAAA,CAAckrC,CAAAjwC,OAAd,CAA8B,CAA9B,CAFG,CAKL,KALK,KAGL,KAAAigD,WAAA,CAAgB,kBAAhB,CAXG,CAgBP,IAAA5+C,MAAA,EApBoC,CAsBtC4uC,CAAA,EAAS,CACT,KAAAmP,OAAAv+C,KAAA,CAAiB,OACRu/C,CADQ,MAETnQ,CAFS,MAGT,CAAA,CAHS,IAIXrqC,QAAQ,EAAG,CAAE,MAAOqqC,EAAT,CAJA,CAAjB,CA1BqB,CA/GP,WAiJLyP,QAAQ,EAAG,CAQpB,IAPA,IAAIlc,EAAS,IAAb,CAEIgd,EAAQ,EAFZ,CAGIJ,EAAQ,IAAA/+C,MAHZ,CAKIo/C,CALJ,CAKaC,CALb,CAKwBC,CALxB,CAKoCzB,CAEpC,CAAO,IAAA79C,MAAP,CAAoB,IAAAouB,KAAAzvB,OAApB,CAAA,CAAsC,CACpCk/C,CAAA,CAAK,IAAAzvB,KAAA1qB,OAAA,CAAiB,IAAA1D,MAAjB,CACL,IAAW,GAAX,GAAI69C,CAAJ,EAAkB,IAAAO,QAAA,CAAaP,CAAb,CAAlB,EAAsC,IAAAl8C,SAAA,CAAck8C,CAAd,CAAtC,CACa,GACX,GADIA,CACJ,GADgBuB,CAChB,CAD0B,IAAAp/C,MAC1B,EAAAm/C,CAAA,EAAStB,CAFX,KAIE,MAEF;IAAA79C,MAAA,EARoC,CAYtC,GAAIo/C,CAAJ,CAEE,IADAC,CACA,CADY,IAAAr/C,MACZ,CAAOq/C,CAAP,CAAmB,IAAAjxB,KAAAzvB,OAAnB,CAAA,CAAqC,CACnCk/C,CAAA,CAAK,IAAAzvB,KAAA1qB,OAAA,CAAiB27C,CAAjB,CACL,IAAW,GAAX,GAAIxB,CAAJ,CAAgB,CACdyB,CAAA,CAAaH,CAAAr4B,OAAA,CAAas4B,CAAb,CAAuBL,CAAvB,CAA+B,CAA/B,CACbI,EAAA,CAAQA,CAAAr4B,OAAA,CAAa,CAAb,CAAgBs4B,CAAhB,CAA0BL,CAA1B,CACR,KAAA/+C,MAAA,CAAaq/C,CACb,MAJc,CAMhB,GAAI,IAAAd,aAAA,CAAkBV,CAAlB,CAAJ,CACEwB,CAAA,EADF,KAGE,MAXiC,CAiBnCpuB,CAAAA,CAAQ,OACH8tB,CADG,MAEJI,CAFI,CAMZ,IAAI/C,EAAAh9C,eAAA,CAAyB+/C,CAAzB,CAAJ,CACEluB,CAAA1sB,GACA,CADW63C,EAAA,CAAU+C,CAAV,CACX,CAAAluB,CAAA7rB,KAAA,CAAag3C,EAAA,CAAU+C,CAAV,CAFf,KAGO,CACL,IAAIr1C,EAASs3B,EAAA,CAAS+d,CAAT,CAAgB,IAAAj/B,QAAhB,CAA8B,IAAAkO,KAA9B,CACb6C,EAAA1sB,GAAA,CAAW5D,CAAA,CAAO,QAAQ,CAAC2D,CAAD,CAAOgV,CAAP,CAAe,CACvC,MAAQxP,EAAA,CAAOxF,CAAP,CAAagV,CAAb,CAD+B,CAA9B,CAER,QACO8Q,QAAQ,CAAC9lB,CAAD,CAAOxE,CAAP,CAAc,CAC5B,MAAOogC,GAAA,CAAO57B,CAAP,CAAa66C,CAAb,CAAoBr/C,CAApB,CAA2BqiC,CAAA/T,KAA3B,CAAwC+T,CAAAjiB,QAAxC,CADqB,CAD7B,CAFQ,CAFN,CAWP,IAAA69B,OAAAv+C,KAAA,CAAiByxB,CAAjB,CAEIquB,EAAJ,GACE,IAAAvB,OAAAv+C,KAAA,CAAiB,OACT4/C,CADS,MAET,GAFS,MAGT,CAAA,CAHS,CAAjB,CAKA,CAAA,IAAArB,OAAAv+C,KAAA,CAAiB,OACR4/C,CADQ,CACE,CADF,MAETE,CAFS,MAGT,CAAA,CAHS,CAAjB,CANF,CA7DoB,CAjJN;WA4NJrB,QAAQ,CAACsB,CAAD,CAAQ,CAC1B,IAAIR,EAAQ,IAAA/+C,MACZ,KAAAA,MAAA,EAIA,KAHA,IAAI+wC,EAAS,EAAb,CACIyO,EAAYD,CADhB,CAEIrgC,EAAS,CAAA,CACb,CAAO,IAAAlf,MAAP,CAAoB,IAAAouB,KAAAzvB,OAApB,CAAA,CAAsC,CACpC,IAAIk/C,EAAK,IAAAzvB,KAAA1qB,OAAA,CAAiB,IAAA1D,MAAjB,CAAT,CACAw/C,EAAAA,CAAAA,CAAa3B,CACb,IAAI3+B,CAAJ,CACa,GAAX,GAAI2+B,CAAJ,EACM4B,CAIJ,CAJU,IAAArxB,KAAA9O,UAAA,CAAoB,IAAAtf,MAApB,CAAiC,CAAjC,CAAoC,IAAAA,MAApC,CAAiD,CAAjD,CAIV,CAHKy/C,CAAAt5C,MAAA,CAAU,aAAV,CAGL,EAFE,IAAAy4C,WAAA,CAAgB,6BAAhB,CAAgDa,CAAhD,CAAsD,GAAtD,CAEF,CADA,IAAAz/C,MACA,EADc,CACd,CAAA+wC,CAAA,EAAU1wC,MAAAC,aAAA,CAAoBU,QAAA,CAASy+C,CAAT,CAAc,EAAd,CAApB,CALZ,EASI1O,CATJ,CAQE,CADI2O,CACJ,CADU/B,EAAA,CAAOE,CAAP,CACV,EACE9M,CADF,CACY2O,CADZ,CAGE3O,CAHF,CAGY8M,CAGd,CAAA3+B,CAAA,CAAS,CAAA,CAfX,KAgBO,IAAW,IAAX,GAAI2+B,CAAJ,CACL3+B,CAAA,CAAS,CAAA,CADJ,KAEA,CAAA,GAAI2+B,CAAJ,GAAW0B,CAAX,CAAkB,CACvB,IAAAv/C,MAAA,EACA,KAAA+9C,OAAAv+C,KAAA,CAAiB,OACRu/C,CADQ,MAETS,CAFS,QAGPzO,CAHO,MAIT,CAAA,CAJS,IAKXxsC,QAAQ,EAAG,CAAE,MAAOwsC,EAAT,CALA,CAAjB,CAOA,OATuB,CAWvBA,CAAA;AAAU8M,CAXL,CAaP,IAAA79C,MAAA,EAlCoC,CAoCtC,IAAA4+C,WAAA,CAAgB,oBAAhB,CAAsCG,CAAtC,CA1C0B,CA5NZ,CA8QlB,KAAI3c,GAASA,QAAS,CAACH,CAAD,CAAQH,CAAR,CAAiB5hB,CAAjB,CAA0B,CAC9C,IAAA+hB,MAAA,CAAaA,CACb,KAAAH,QAAA,CAAeA,CACf,KAAA5hB,QAAA,CAAeA,CAH+B,CAMhDkiB,GAAAud,KAAA,CAAch/C,CAAA,CAAO,QAAS,EAAG,CAC/B,MAAO,EADwB,CAAnB,CAEX,UACS,CAAA,CADT,CAFW,CAMdyhC,GAAAzoB,UAAA,CAAmB,aACJyoB,EADI,OAGV/8B,QAAS,CAAC+oB,CAAD,CAAOhpB,CAAP,CAAa,CAC3B,IAAAgpB,KAAA,CAAYA,CAGZ,KAAAhpB,KAAA,CAAYA,CAEZ,KAAA24C,OAAA,CAAc,IAAA9b,MAAA2b,IAAA,CAAexvB,CAAf,CAEVhpB,EAAJ,GAGE,IAAAw6C,WAEA,CAFkB,IAAAC,UAElB,CAAA,IAAAC,aAAA,CACA,IAAAC,YADA,CAEA,IAAAC,YAFA,CAGA,IAAAC,YAHA,CAGmBC,QAAQ,EAAG,CAC5B,IAAAtB,WAAA,CAAgB,mBAAhB,CAAqC,MAAOxwB,CAAP,OAAoB,CAApB,CAArC,CAD4B,CARhC,CAaA,KAAItuB,EAAQsF,CAAA,CAAO,IAAA+6C,QAAA,EAAP,CAAwB,IAAAC,WAAA,EAET,EAA3B,GAAI,IAAArC,OAAAp/C,OAAJ;AACE,IAAAigD,WAAA,CAAgB,wBAAhB,CAA0C,IAAAb,OAAA,CAAY,CAAZ,CAA1C,CAGFj+C,EAAAmqB,QAAA,CAAgB,CAAC,CAACnqB,CAAAmqB,QAClBnqB,EAAAka,SAAA,CAAiB,CAAC,CAACla,CAAAka,SAEnB,OAAOla,EA9BoB,CAHZ,SAoCRqgD,QAAS,EAAG,CACnB,IAAIA,CACJ,IAAI,IAAAE,OAAA,CAAY,GAAZ,CAAJ,CACEF,CACA,CADU,IAAAF,YAAA,EACV,CAAA,IAAAK,QAAA,CAAa,GAAb,CAFF,KAGO,IAAI,IAAAD,OAAA,CAAY,GAAZ,CAAJ,CACLF,CAAA,CAAU,IAAAI,iBAAA,EADL,KAEA,IAAI,IAAAF,OAAA,CAAY,GAAZ,CAAJ,CACLF,CAAA,CAAU,IAAAjO,OAAA,EADL,KAEA,CACL,IAAIjhB,EAAQ,IAAAovB,OAAA,EAEZ,EADAF,CACA,CADUlvB,CAAA1sB,GACV,GACE,IAAAq6C,WAAA,CAAgB,0BAAhB,CAA4C3tB,CAA5C,CAEEA,EAAA7rB,KAAJ,GACE+6C,CAAAnmC,SACA,CADmB,CAAA,CACnB,CAAAmmC,CAAAl2B,QAAA,CAAkB,CAAA,CAFpB,CANK,CAaP,IADA,IAAUhrB,CACV,CAAQipC,CAAR,CAAe,IAAAmY,OAAA,CAAY,GAAZ,CAAiB,GAAjB,CAAsB,GAAtB,CAAf,CAAA,CACoB,GAAlB,GAAInY,CAAA9Z,KAAJ,EACE+xB,CACA,CADU,IAAAL,aAAA,CAAkBK,CAAlB,CAA2BlhD,CAA3B,CACV,CAAAA,CAAA,CAAU,IAFZ,EAGyB,GAAlB,GAAIipC,CAAA9Z,KAAJ;CACLnvB,CACA,CADUkhD,CACV,CAAAA,CAAA,CAAU,IAAAH,YAAA,CAAiBG,CAAjB,CAFL,EAGkB,GAAlB,GAAIjY,CAAA9Z,KAAJ,EACLnvB,CACA,CADUkhD,CACV,CAAAA,CAAA,CAAU,IAAAJ,YAAA,CAAiBI,CAAjB,CAFL,EAIL,IAAAvB,WAAA,CAAgB,YAAhB,CAGJ,OAAOuB,EApCY,CApCJ,YA2ELvB,QAAQ,CAAC4B,CAAD,CAAMvvB,CAAN,CAAa,CAC/B,KAAM+O,GAAA,CAAa,QAAb,CAEA/O,CAAA7C,KAFA,CAEYoyB,CAFZ,CAEkBvvB,CAAAjxB,MAFlB,CAEgC,CAFhC,CAEoC,IAAAouB,KAFpC,CAE+C,IAAAA,KAAA9O,UAAA,CAAoB2R,CAAAjxB,MAApB,CAF/C,CAAN,CAD+B,CA3EhB,WAiFNygD,QAAQ,EAAG,CACpB,GAA2B,CAA3B,GAAI,IAAA1C,OAAAp/C,OAAJ,CACE,KAAMqhC,GAAA,CAAa,MAAb,CAA0D,IAAA5R,KAA1D,CAAN,CACF,MAAO,KAAA2vB,OAAA,CAAY,CAAZ,CAHa,CAjFL,MAuFXG,QAAQ,CAACwC,CAAD,CAAKC,CAAL,CAASC,CAAT,CAAaC,CAAb,CAAiB,CAC7B,GAAyB,CAAzB,CAAI,IAAA9C,OAAAp/C,OAAJ,CAA4B,CAC1B,IAAIsyB,EAAQ,IAAA8sB,OAAA,CAAY,CAAZ,CAAZ,CACI+C,EAAI7vB,CAAA7C,KACR,IAAI0yB,CAAJ,GAAUJ,CAAV,EAAgBI,CAAhB,GAAsBH,CAAtB,EAA4BG,CAA5B,GAAkCF,CAAlC,EAAwCE,CAAxC,GAA8CD,CAA9C,EACK,EAACH,CAAD,EAAQC,CAAR,EAAeC,CAAf,EAAsBC,CAAtB,CADL,CAEE,MAAO5vB,EALiB,CAQ5B,MAAO,CAAA,CATsB,CAvFd,QAmGTovB,QAAQ,CAACK,CAAD,CAAKC,CAAL,CAASC,CAAT,CAAaC,CAAb,CAAgB,CAE9B,MAAA,CADI5vB,CACJ,CADY,IAAAitB,KAAA,CAAUwC,CAAV,CAAcC,CAAd,CAAkBC,CAAlB;AAAsBC,CAAtB,CACZ,GACM,IAAAz7C,KAIG6rB,EAJW7rB,CAAA6rB,CAAA7rB,KAIX6rB,EAHL,IAAA2tB,WAAA,CAAgB,mBAAhB,CAAqC3tB,CAArC,CAGKA,CADP,IAAA8sB,OAAA5sC,MAAA,EACO8f,CAAAA,CALT,EAOO,CAAA,CATuB,CAnGf,SA+GRqvB,QAAQ,CAACI,CAAD,CAAI,CACd,IAAAL,OAAA,CAAYK,CAAZ,CAAL,EACE,IAAA9B,WAAA,CAAgB,4BAAhB,CAA+C8B,CAA/C,CAAoD,GAApD,CAAyD,IAAAxC,KAAA,EAAzD,CAFiB,CA/GJ,SAqHR6C,QAAQ,CAACx8C,CAAD,CAAKy8C,CAAL,CAAY,CAC3B,MAAOrgD,EAAA,CAAO,QAAQ,CAAC2D,CAAD,CAAOgV,CAAP,CAAe,CACnC,MAAO/U,EAAA,CAAGD,CAAH,CAASgV,CAAT,CAAiB0nC,CAAjB,CAD4B,CAA9B,CAEJ,UACQA,CAAAhnC,SADR,CAFI,CADoB,CArHZ,WA6HNinC,QAAQ,CAACC,CAAD,CAAOC,CAAP,CAAeH,CAAf,CAAqB,CACtC,MAAOrgD,EAAA,CAAO,QAAQ,CAAC2D,CAAD,CAAOgV,CAAP,CAAc,CAClC,MAAO4nC,EAAA,CAAK58C,CAAL,CAAWgV,CAAX,CAAA,CAAqB6nC,CAAA,CAAO78C,CAAP,CAAagV,CAAb,CAArB,CAA4C0nC,CAAA,CAAM18C,CAAN,CAAYgV,CAAZ,CADjB,CAA7B,CAEJ,UACS4nC,CAAAlnC,SADT,EAC0BmnC,CAAAnnC,SAD1B,EAC6CgnC,CAAAhnC,SAD7C,CAFI,CAD+B,CA7HvB,UAqIPonC,QAAQ,CAACF,CAAD,CAAO38C,CAAP,CAAWy8C,CAAX,CAAkB,CAClC,MAAOrgD,EAAA,CAAO,QAAQ,CAAC2D,CAAD,CAAOgV,CAAP,CAAe,CACnC,MAAO/U,EAAA,CAAGD,CAAH,CAASgV,CAAT,CAAiB4nC,CAAjB,CAAuBF,CAAvB,CAD4B,CAA9B,CAEJ,UACQE,CAAAlnC,SADR,EACyBgnC,CAAAhnC,SADzB,CAFI,CAD2B,CArInB;WA6ILomC,QAAQ,EAAG,CAErB,IADA,IAAIA,EAAa,EACjB,CAAA,CAAA,CAGE,GAFyB,CAErB,CAFA,IAAArC,OAAAp/C,OAEA,EAF2B,CAAA,IAAAu/C,KAAA,CAAU,GAAV,CAAe,GAAf,CAAoB,GAApB,CAAyB,GAAzB,CAE3B,EADFkC,CAAA5gD,KAAA,CAAgB,IAAAygD,YAAA,EAAhB,CACE,CAAA,CAAC,IAAAI,OAAA,CAAY,GAAZ,CAAL,CAGE,MAA8B,EACvB,GADCD,CAAAzhD,OACD,CAADyhD,CAAA,CAAW,CAAX,CAAC,CACD,QAAQ,CAAC97C,CAAD,CAAOgV,CAAP,CAAe,CAErB,IADA,IAAIxZ,CAAJ,CACSH,EAAI,CAAb,CAAgBA,CAAhB,CAAoBygD,CAAAzhD,OAApB,CAAuCgB,CAAA,EAAvC,CAA4C,CAC1C,IAAI0hD,EAAYjB,CAAA,CAAWzgD,CAAX,CACZ0hD,EAAJ,GACEvhD,CADF,CACUuhD,CAAA,CAAU/8C,CAAV,CAAgBgV,CAAhB,CADV,CAF0C,CAM5C,MAAOxZ,EARc,CAVZ,CA7IN,aAqKJmgD,QAAQ,EAAG,CAGtB,IAFA,IAAIiB,EAAO,IAAA7vB,WAAA,EAAX,CACIJ,CACJ,CAAA,CAAA,CACE,GAAKA,CAAL,CAAa,IAAAovB,OAAA,CAAY,GAAZ,CAAb,CACEa,CAAA,CAAO,IAAAE,SAAA,CAAcF,CAAd,CAAoBjwB,CAAA1sB,GAApB,CAA8B,IAAAqM,OAAA,EAA9B,CADT,KAGE,OAAOswC,EAPW,CArKP,QAiLTtwC,QAAQ,EAAG,CAIjB,IAHA,IAAIqgB,EAAQ,IAAAovB,OAAA,EAAZ,CACI97C,EAAK,IAAAu9B,QAAA,CAAa7Q,CAAA7C,KAAb,CADT,CAEIkzB,EAAS,EACb,CAAA,CAAA,CACE,GAAKrwB,CAAL,CAAa,IAAAovB,OAAA,CAAY,GAAZ,CAAb,CACEiB,CAAA9hD,KAAA,CAAY,IAAA6xB,WAAA,EAAZ,CADF,KAEO,CACL,IAAIkwB;AAAWA,QAAQ,CAACj9C,CAAD,CAAOgV,CAAP,CAAe64B,CAAf,CAAsB,CACvC54B,CAAAA,CAAO,CAAC44B,CAAD,CACX,KAAK,IAAIxyC,EAAI,CAAb,CAAgBA,CAAhB,CAAoB2hD,CAAA3iD,OAApB,CAAmCgB,CAAA,EAAnC,CACE4Z,CAAA/Z,KAAA,CAAU8hD,CAAA,CAAO3hD,CAAP,CAAA,CAAU2E,CAAV,CAAgBgV,CAAhB,CAAV,CAEF,OAAO/U,EAAAI,MAAA,CAASL,CAAT,CAAeiV,CAAf,CALoC,CAO7C,OAAO,SAAQ,EAAG,CAChB,MAAOgoC,EADS,CARb,CAPQ,CAjLF,YAuMLlwB,QAAQ,EAAG,CACrB,MAAO,KAAAuuB,WAAA,EADc,CAvMN,YA2MLA,QAAQ,EAAG,CACrB,IAAIsB,EAAO,IAAAM,QAAA,EAAX,CACIR,CADJ,CAEI/vB,CACJ,OAAA,CAAKA,CAAL,CAAa,IAAAovB,OAAA,CAAY,GAAZ,CAAb,GACOa,CAAA92B,OAKE,EAJL,IAAAw0B,WAAA,CAAgB,0BAAhB,CACI,IAAAxwB,KAAA9O,UAAA,CAAoB,CAApB,CAAuB2R,CAAAjxB,MAAvB,CADJ,CAC0C,0BAD1C,CACsEixB,CADtE,CAIK,CADP+vB,CACO,CADC,IAAAQ,QAAA,EACD,CAAA,QAAQ,CAACl5C,CAAD,CAAQgR,CAAR,CAAgB,CAC7B,MAAO4nC,EAAA92B,OAAA,CAAY9hB,CAAZ,CAAmB04C,CAAA,CAAM14C,CAAN,CAAagR,CAAb,CAAnB,CAAyCA,CAAzC,CADsB,CANjC,EAUO4nC,CAdc,CA3MN,SA4NRM,QAAQ,EAAG,CAClB,IAAIN,EAAO,IAAArB,UAAA,EAAX,CACIsB,CADJ,CAEIlwB,CACJ,IAAa,IAAAovB,OAAA,CAAY,GAAZ,CAAb,CAAgC,CAC9Bc,CAAA,CAAS,IAAAK,QAAA,EACT;GAAKvwB,CAAL,CAAa,IAAAovB,OAAA,CAAY,GAAZ,CAAb,CACE,MAAO,KAAAY,UAAA,CAAeC,CAAf,CAAqBC,CAArB,CAA6B,IAAAK,QAAA,EAA7B,CAEP,KAAA5C,WAAA,CAAgB,YAAhB,CAA8B3tB,CAA9B,CAL4B,CAAhC,IAQE,OAAOiwB,EAZS,CA5NH,WA4ONrB,QAAQ,EAAG,CAGpB,IAFA,IAAIqB,EAAO,IAAAO,WAAA,EAAX,CACIxwB,CACJ,CAAA,CAAA,CACE,GAAKA,CAAL,CAAa,IAAAovB,OAAA,CAAY,IAAZ,CAAb,CACEa,CAAA,CAAO,IAAAE,SAAA,CAAcF,CAAd,CAAoBjwB,CAAA1sB,GAApB,CAA8B,IAAAk9C,WAAA,EAA9B,CADT,KAGE,OAAOP,EAPS,CA5OL,YAwPLO,QAAQ,EAAG,CACrB,IAAIP,EAAO,IAAAQ,SAAA,EAAX,CACIzwB,CACJ,IAAKA,CAAL,CAAa,IAAAovB,OAAA,CAAY,IAAZ,CAAb,CACEa,CAAA,CAAO,IAAAE,SAAA,CAAcF,CAAd,CAAoBjwB,CAAA1sB,GAApB,CAA8B,IAAAk9C,WAAA,EAA9B,CAET,OAAOP,EANc,CAxPN,UAiQPQ,QAAQ,EAAG,CACnB,IAAIR,EAAO,IAAAS,WAAA,EAAX,CACI1wB,CACJ,IAAKA,CAAL,CAAa,IAAAovB,OAAA,CAAY,IAAZ,CAAiB,IAAjB,CAAsB,KAAtB,CAA4B,KAA5B,CAAb,CACEa,CAAA,CAAO,IAAAE,SAAA,CAAcF,CAAd,CAAoBjwB,CAAA1sB,GAApB,CAA8B,IAAAm9C,SAAA,EAA9B,CAET,OAAOR,EANY,CAjQJ;WA0QLS,QAAQ,EAAG,CACrB,IAAIT,EAAO,IAAAU,SAAA,EAAX,CACI3wB,CACJ,IAAKA,CAAL,CAAa,IAAAovB,OAAA,CAAY,GAAZ,CAAiB,GAAjB,CAAsB,IAAtB,CAA4B,IAA5B,CAAb,CACEa,CAAA,CAAO,IAAAE,SAAA,CAAcF,CAAd,CAAoBjwB,CAAA1sB,GAApB,CAA8B,IAAAo9C,WAAA,EAA9B,CAET,OAAOT,EANc,CA1QN,UAmRPU,QAAQ,EAAG,CAGnB,IAFA,IAAIV,EAAO,IAAAW,eAAA,EAAX,CACI5wB,CACJ,CAAQA,CAAR,CAAgB,IAAAovB,OAAA,CAAY,GAAZ,CAAgB,GAAhB,CAAhB,CAAA,CACEa,CAAA,CAAO,IAAAE,SAAA,CAAcF,CAAd,CAAoBjwB,CAAA1sB,GAApB,CAA8B,IAAAs9C,eAAA,EAA9B,CAET,OAAOX,EANY,CAnRJ,gBA4RDW,QAAQ,EAAG,CAGzB,IAFA,IAAIX,EAAO,IAAAY,MAAA,EAAX,CACI7wB,CACJ,CAAQA,CAAR,CAAgB,IAAAovB,OAAA,CAAY,GAAZ,CAAgB,GAAhB,CAAoB,GAApB,CAAhB,CAAA,CACEa,CAAA,CAAO,IAAAE,SAAA,CAAcF,CAAd,CAAoBjwB,CAAA1sB,GAApB,CAA8B,IAAAu9C,MAAA,EAA9B,CAET,OAAOZ,EANkB,CA5RV,OAqSVY,QAAQ,EAAG,CAChB,IAAI7wB,CACJ,OAAI,KAAAovB,OAAA,CAAY,GAAZ,CAAJ,CACS,IAAAF,QAAA,EADT,CAEO,CAAKlvB,CAAL,CAAa,IAAAovB,OAAA,CAAY,GAAZ,CAAb,EACE,IAAAe,SAAA,CAAchf,EAAAud,KAAd,CAA2B1uB,CAAA1sB,GAA3B;AAAqC,IAAAu9C,MAAA,EAArC,CADF,CAEA,CAAK7wB,CAAL,CAAa,IAAAovB,OAAA,CAAY,GAAZ,CAAb,EACE,IAAAU,QAAA,CAAa9vB,CAAA1sB,GAAb,CAAuB,IAAAu9C,MAAA,EAAvB,CADF,CAGE,IAAA3B,QAAA,EATO,CArSD,aAkTJJ,QAAQ,CAAC7N,CAAD,CAAS,CAC5B,IAAI/P,EAAS,IAAb,CACI4f,EAAQ,IAAA1B,OAAA,EAAAjyB,KADZ,CAEItkB,EAASs3B,EAAA,CAAS2gB,CAAT,CAAgB,IAAA7hC,QAAhB,CAA8B,IAAAkO,KAA9B,CAEb,OAAOztB,EAAA,CAAO,QAAQ,CAAC2H,CAAD,CAAQgR,CAAR,CAAgBhV,CAAhB,CAAsB,CAC1C,MAAOwF,EAAA,CAAOxF,CAAP,EAAe4tC,CAAA,CAAO5pC,CAAP,CAAcgR,CAAd,CAAf,CADmC,CAArC,CAEJ,QACO8Q,QAAQ,CAAC9hB,CAAD,CAAQxI,CAAR,CAAewZ,CAAf,CAAuB,CACrC,MAAO4mB,GAAA,CAAOgS,CAAA,CAAO5pC,CAAP,CAAcgR,CAAd,CAAP,CAA8ByoC,CAA9B,CAAqCjiD,CAArC,CAA4CqiC,CAAA/T,KAA5C,CAAyD+T,CAAAjiB,QAAzD,CAD8B,CADtC,CAFI,CALqB,CAlTb,aAgUJ8/B,QAAQ,CAACvhD,CAAD,CAAM,CACzB,IAAI0jC,EAAS,IAAb,CAEI6f,EAAU,IAAA3wB,WAAA,EACd,KAAAivB,QAAA,CAAa,GAAb,CAEA,OAAO3/C,EAAA,CAAO,QAAQ,CAAC2D,CAAD,CAAOgV,CAAP,CAAe,CAAA,IAC/B2oC,EAAIxjD,CAAA,CAAI6F,CAAJ,CAAUgV,CAAV,CAD2B,CAE/B3Z,EAAIqiD,CAAA,CAAQ19C,CAAR,CAAcgV,CAAd,CAF2B,CAG5BmH,CAEP,IAAI,CAACwhC,CAAL,CAAQ,MAAO3jD,EAEf,EADAiH,CACA,CADI06B,EAAA,CAAiBgiB,CAAA,CAAEtiD,CAAF,CAAjB,CAAuBwiC,CAAA/T,KAAvB,CACJ,IAAS7oB,CAAA+uB,KAAT,EAAmB6N,CAAAjiB,QAAAogB,eAAnB,IACE7f,CAKA,CALIlb,CAKJ,CAJM,KAIN,EAJeA,EAIf,GAHEkb,CAAA+f,IACA,CADQliC,CACR,CAAAmiB,CAAA6T,KAAA,CAAO,QAAQ,CAACxvB,CAAD,CAAM,CAAE2b,CAAA+f,IAAA;AAAQ17B,CAAV,CAArB,CAEF,EAAAS,CAAA,CAAIA,CAAAi7B,IANN,CAQA,OAAOj7B,EAf4B,CAA9B,CAgBJ,QACO6kB,QAAQ,CAAC9lB,CAAD,CAAOxE,CAAP,CAAcwZ,CAAd,CAAsB,CACpC,IAAIpa,EAAM8iD,CAAA,CAAQ19C,CAAR,CAAcgV,CAAd,CAGV,OADW2mB,GAAAiiB,CAAiBzjD,CAAA,CAAI6F,CAAJ,CAAUgV,CAAV,CAAjB4oC,CAAoC/f,CAAA/T,KAApC8zB,CACJ,CAAKhjD,CAAL,CAAP,CAAmBY,CAJiB,CADrC,CAhBI,CANkB,CAhUV,cAgWHggD,QAAQ,CAACv7C,CAAD,CAAK49C,CAAL,CAAoB,CACxC,IAAIb,EAAS,EACb,IAA8B,GAA9B,GAAI,IAAAb,UAAA,EAAAryB,KAAJ,EACE,EACEkzB,EAAA9hD,KAAA,CAAY,IAAA6xB,WAAA,EAAZ,CADF,OAES,IAAAgvB,OAAA,CAAY,GAAZ,CAFT,CADF,CAKA,IAAAC,QAAA,CAAa,GAAb,CAEA,KAAIne,EAAS,IAEb,OAAO,SAAQ,CAAC75B,CAAD,CAAQgR,CAAR,CAAgB,CAI7B,IAHA,IAAIC,EAAO,EAAX,CACIta,EAAUkjD,CAAA,CAAgBA,CAAA,CAAc75C,CAAd,CAAqBgR,CAArB,CAAhB,CAA+ChR,CAD7D,CAGS3I,EAAI,CAAb,CAAgBA,CAAhB,CAAoB2hD,CAAA3iD,OAApB,CAAmCgB,CAAA,EAAnC,CACE4Z,CAAA/Z,KAAA,CAAU8hD,CAAA,CAAO3hD,CAAP,CAAA,CAAU2I,CAAV,CAAiBgR,CAAjB,CAAV,CAEE8oC,EAAAA,CAAQ79C,CAAA,CAAG+D,CAAH,CAAUgR,CAAV,CAAkBra,CAAlB,CAARmjD,EAAsChhD,CAE1C6+B,GAAA,CAAiBhhC,CAAjB,CAA0BkjC,CAAA/T,KAA1B,CACA6R,GAAA,CAAiBmiB,CAAjB,CAAwBjgB,CAAA/T,KAAxB,CAGI7oB,EAAAA,CAAI68C,CAAAz9C,MACA,CAAAy9C,CAAAz9C,MAAA,CAAY1F,CAAZ,CAAqBsa,CAArB,CAAA,CACA6oC,CAAA,CAAM7oC,CAAA,CAAK,CAAL,CAAN,CAAeA,CAAA,CAAK,CAAL,CAAf,CAAwBA,CAAA,CAAK,CAAL,CAAxB,CAAiCA,CAAA,CAAK,CAAL,CAAjC,CAA0CA,CAAA,CAAK,CAAL,CAA1C,CAER,OAAO0mB,GAAA,CAAiB16B,CAAjB,CAAoB48B,CAAA/T,KAApB,CAjBsB,CAXS,CAhWzB,kBAiYCmyB,QAAS,EAAG,CAC5B,IAAI8B,EAAa,EAAjB,CACIC,EAAc,CAAA,CAClB,IAA8B,GAA9B,GAAI,IAAA7B,UAAA,EAAAryB,KAAJ,EACE,EAAG,CACD,GAAI,IAAA8vB,KAAA,CAAU,GAAV,CAAJ,CAEE,KAEF;IAAIqE,EAAY,IAAAlxB,WAAA,EAChBgxB,EAAA7iD,KAAA,CAAgB+iD,CAAhB,CACKA,EAAAvoC,SAAL,GACEsoC,CADF,CACgB,CAAA,CADhB,CAPC,CAAH,MAUS,IAAAjC,OAAA,CAAY,GAAZ,CAVT,CADF,CAaA,IAAAC,QAAA,CAAa,GAAb,CAEA,OAAO3/C,EAAA,CAAO,QAAQ,CAAC2D,CAAD,CAAOgV,CAAP,CAAe,CAEnC,IADA,IAAI1W,EAAQ,EAAZ,CACSjD,EAAI,CAAb,CAAgBA,CAAhB,CAAoB0iD,CAAA1jD,OAApB,CAAuCgB,CAAA,EAAvC,CACEiD,CAAApD,KAAA,CAAW6iD,CAAA,CAAW1iD,CAAX,CAAA,CAAc2E,CAAd,CAAoBgV,CAApB,CAAX,CAEF,OAAO1W,EAL4B,CAA9B,CAMJ,SACQ,CAAA,CADR,UAES0/C,CAFT,CANI,CAlBqB,CAjYb,QA+ZTpQ,QAAS,EAAG,CAClB,IAAIsQ,EAAY,EAAhB,CACIF,EAAc,CAAA,CAClB,IAA8B,GAA9B,GAAI,IAAA7B,UAAA,EAAAryB,KAAJ,EACE,EAAG,CACD,GAAI,IAAA8vB,KAAA,CAAU,GAAV,CAAJ,CAEE,KAHD,KAKGjtB,EAAQ,IAAAovB,OAAA,EALX,CAMDnhD,EAAM+xB,CAAA8f,OAAN7xC,EAAsB+xB,CAAA7C,KACtB,KAAAkyB,QAAA,CAAa,GAAb,CACA,KAAIxgD,EAAQ,IAAAuxB,WAAA,EACZmxB,EAAAhjD,KAAA,CAAe,KAAMN,CAAN,OAAkBY,CAAlB,CAAf,CACKA,EAAAka,SAAL,GACEsoC,CADF,CACgB,CAAA,CADhB,CAVC,CAAH,MAaS,IAAAjC,OAAA,CAAY,GAAZ,CAbT,CADF,CAgBA,IAAAC,QAAA,CAAa,GAAb,CAEA,OAAO3/C,EAAA,CAAO,QAAQ,CAAC2D,CAAD,CAAOgV,CAAP,CAAe,CAEnC,IADA,IAAI44B,EAAS,EAAb,CACSvyC,EAAI,CAAb,CAAgBA,CAAhB;AAAoB6iD,CAAA7jD,OAApB,CAAsCgB,CAAA,EAAtC,CAA2C,CACzC,IAAI6G,EAAWg8C,CAAA,CAAU7iD,CAAV,CACfuyC,EAAA,CAAO1rC,CAAAtH,IAAP,CAAA,CAAuBsH,CAAA1G,MAAA,CAAewE,CAAf,CAAqBgV,CAArB,CAFkB,CAI3C,MAAO44B,EAN4B,CAA9B,CAOJ,SACQ,CAAA,CADR,UAESoQ,CAFT,CAPI,CArBW,CA/ZH,CAsenB,KAAIjhB,GAAgB,EAApB,CAumEI8H,GAAa5qC,CAAA,CAAO,MAAP,CAvmEjB,CAymEIgrC,GAAe,MACX,MADW,KAEZ,KAFY,KAGZ,KAHY,cAMH,aANG,IAOb,IAPa,CAzmEnB,CA6zGIuD,EAAiBzuC,CAAA8T,cAAA,CAAuB,GAAvB,CA7zGrB,CA8zGI66B,GAAYpV,EAAA,CAAWx5B,CAAA2D,SAAAgc,KAAX,CAAiC,CAAA,CAAjC,CAqNhBjP,GAAAqI,QAAA,CAA0B,CAAC,UAAD,CAkU1Bg2B,GAAAh2B,QAAA,CAAyB,CAAC,SAAD,CA4DzBs2B,GAAAt2B,QAAA,CAAuB,CAAC,SAAD,CASvB,KAAIw3B,GAAc,GAAlB,CA2HIsD,GAAe,MACXvB,CAAA,CAAW,UAAX,CAAuB,CAAvB,CADW,IAEXA,CAAA,CAAW,UAAX,CAAuB,CAAvB,CAA0B,CAA1B,CAA6B,CAAA,CAA7B,CAFW,GAGXA,CAAA,CAAW,UAAX,CAAuB,CAAvB,CAHW,MAIXE,EAAA,CAAc,OAAd,CAJW,KAKXA,EAAA,CAAc,OAAd,CAAuB,CAAA,CAAvB,CALW,IAMXF,CAAA,CAAW,OAAX,CAAoB,CAApB,CAAuB,CAAvB,CANW,GAOXA,CAAA,CAAW,OAAX,CAAoB,CAApB,CAAuB,CAAvB,CAPW,IAQXA,CAAA,CAAW,MAAX,CAAmB,CAAnB,CARW,GASXA,CAAA,CAAW,MAAX,CAAmB,CAAnB,CATW,IAUXA,CAAA,CAAW,OAAX,CAAoB,CAApB,CAVW,GAWXA,CAAA,CAAW,OAAX;AAAoB,CAApB,CAXW,IAYXA,CAAA,CAAW,OAAX,CAAoB,CAApB,CAAwB,GAAxB,CAZW,GAaXA,CAAA,CAAW,OAAX,CAAoB,CAApB,CAAwB,GAAxB,CAbW,IAcXA,CAAA,CAAW,SAAX,CAAsB,CAAtB,CAdW,GAeXA,CAAA,CAAW,SAAX,CAAsB,CAAtB,CAfW,IAgBXA,CAAA,CAAW,SAAX,CAAsB,CAAtB,CAhBW,GAiBXA,CAAA,CAAW,SAAX,CAAsB,CAAtB,CAjBW,KAoBXA,CAAA,CAAW,cAAX,CAA2B,CAA3B,CApBW,MAqBXE,EAAA,CAAc,KAAd,CArBW,KAsBXA,EAAA,CAAc,KAAd,CAAqB,CAAA,CAArB,CAtBW,GAJnB6R,QAAmB,CAAC9R,CAAD,CAAOxC,CAAP,CAAgB,CACjC,MAAyB,GAAlB,CAAAwC,CAAA+R,SAAA,EAAA,CAAuBvU,CAAAwU,MAAA,CAAc,CAAd,CAAvB,CAA0CxU,CAAAwU,MAAA,CAAc,CAAd,CADhB,CAIhB,GAdnBC,QAAuB,CAACjS,CAAD,CAAO,CACxBkS,CAAAA,CAAQ,EAARA,CAAYlS,CAAAmS,kBAAA,EAMhB,OAHAC,EAGA,EAL0B,CAATA,EAACF,CAADE,CAAc,GAAdA,CAAoB,EAKrC,GAHcxS,EAAA,CAAUnkB,IAAA,CAAY,CAAP,CAAAy2B,CAAA,CAAW,OAAX,CAAqB,MAA1B,CAAA,CAAkCA,CAAlC,CAAyC,EAAzC,CAAV,CAAwD,CAAxD,CAGd,CAFctS,EAAA,CAAUnkB,IAAA+iB,IAAA,CAAS0T,CAAT,CAAgB,EAAhB,CAAV,CAA+B,CAA/B,CAEd,CAP4B,CAcX,CA3HnB,CAsJI7Q,GAAqB,8EAtJzB,CAuJID,GAAgB,UAmFpB3E,GAAAj2B,QAAA,CAAqB,CAAC,SAAD,CAuHrB,KAAIq2B,GAAkBjsC,EAAA,CAAQiE,CAAR,CAAtB,CAWImoC,GAAkBpsC,EAAA,CAAQmK,EAAR,CA2KtBgiC,GAAAv2B,QAAA;AAAwB,CAAC,QAAD,CAiFxB,KAAIlL,GAAsB1K,EAAA,CAAQ,UACtB,GADsB,SAEvBgH,QAAQ,CAAC7C,CAAD,CAAUpD,CAAV,CAAgB,CAEnB,CAAZ,EAAIsU,CAAJ,GAIOtU,CAAAyb,KAQL,EARmBzb,CAAAmF,KAQnB,EAPEnF,CAAAqqB,KAAA,CAAU,MAAV,CAAkB,EAAlB,CAOF,CAAAjnB,CAAAM,OAAA,CAAe3H,CAAAotB,cAAA,CAAuB,QAAvB,CAAf,CAZF,CAeA,IAAI,CAACnpB,CAAAyb,KAAL,EAAkB,CAACzb,CAAA0gD,UAAnB,EAAqC,CAAC1gD,CAAAmF,KAAtC,CACE,MAAO,SAAQ,CAACa,CAAD,CAAQ5C,CAAR,CAAiB,CAE9B,IAAIqY,EAA+C,4BAAxC,GAAAlc,EAAAxC,KAAA,CAAcqG,CAAArD,KAAA,CAAa,MAAb,CAAd,CAAA,CACA,YADA,CACe,MAC1BqD,EAAA6Y,GAAA,CAAW,OAAX,CAAoB,QAAQ,CAACzI,CAAD,CAAO,CAE5BpQ,CAAApD,KAAA,CAAayb,CAAb,CAAL,EACEjI,CAAAC,eAAA,EAH+B,CAAnC,CAJ8B,CAlBH,CAFD,CAAR,CAA1B,CAuXI1H,GAA6B,EAIjCtP,EAAA,CAAQ4W,EAAR,CAAsB,QAAQ,CAACstC,CAAD,CAAW15B,CAAX,CAAqB,CAEjD,GAAgB,UAAhB,EAAI05B,CAAJ,CAAA,CAEA,IAAIC,EAAa78B,EAAA,CAAmB,KAAnB,CAA2BkD,CAA3B,CACjBlb,GAAA,CAA2B60C,CAA3B,CAAA,CAAyC,QAAQ,EAAG,CAClD,MAAO,UACK,GADL,MAEC1iC,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CACnCgG,CAAAnF,OAAA,CAAab,CAAA,CAAK4gD,CAAL,CAAb,CAA+BC,QAAiC,CAACrjD,CAAD,CAAQ,CACtEwC,CAAAqqB,KAAA,CAAUpD,CAAV,CAAoB,CAAC,CAACzpB,CAAtB,CADsE,CAAxE,CADmC,CAFhC,CAD2C,CAHpD,CAFiD,CAAnD,CAmBAf,EAAA,CAAQ,CAAC,KAAD;AAAQ,QAAR,CAAkB,MAAlB,CAAR,CAAmC,QAAQ,CAACwqB,CAAD,CAAW,CACpD,IAAI25B,EAAa78B,EAAA,CAAmB,KAAnB,CAA2BkD,CAA3B,CACjBlb,GAAA,CAA2B60C,CAA3B,CAAA,CAAyC,QAAQ,EAAG,CAClD,MAAO,UACK,EADL,MAEC1iC,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CAAA,IAC/B2gD,EAAW15B,CADoB,CAE/B9hB,EAAO8hB,CAEM,OAAjB,GAAIA,CAAJ,EAC4C,4BAD5C,GACI1nB,EAAAxC,KAAA,CAAcqG,CAAArD,KAAA,CAAa,MAAb,CAAd,CADJ,GAEEoF,CAEA,CAFO,WAEP,CADAnF,CAAA6jB,MAAA,CAAW1e,CAAX,CACA,CADmB,YACnB,CAAAw7C,CAAA,CAAW,IAJb,CAOA3gD,EAAAwnB,SAAA,CAAco5B,CAAd,CAA0B,QAAQ,CAACpjD,CAAD,CAAQ,CACnCA,CAAL,GAGAwC,CAAAqqB,KAAA,CAAUllB,CAAV,CAAgB3H,CAAhB,CAMA,CAAI8W,CAAJ,EAAYqsC,CAAZ,EAAsBv9C,CAAArD,KAAA,CAAa4gD,CAAb,CAAuB3gD,CAAA,CAAKmF,CAAL,CAAvB,CATtB,CADwC,CAA1C,CAXmC,CAFhC,CAD2C,CAFA,CAAtD,CAkCA,KAAI+rC,GAAe,aACJpyC,CADI,gBAEDA,CAFC,cAGHA,CAHG,WAINA,CAJM,cAKHA,CALG,CA6CnB4xC,GAAA77B,QAAA,CAAyB,CAAC,UAAD,CAAa,QAAb,CAAuB,QAAvB,CAAiC,UAAjC,CA+TzB,KAAIisC,GAAuBA,QAAQ,CAACC,CAAD,CAAW,CAC5C,MAAO,CAAC,UAAD,CAAa,QAAQ,CAAC1nC,CAAD,CAAW,CAoDrC,MAnDoBxP,MACZ,MADYA;SAERk3C,CAAA,CAAW,KAAX,CAAmB,GAFXl3C,YAGN6mC,EAHM7mC,SAIT5D,QAAQ,EAAG,CAClB,MAAO,KACA2f,QAAQ,CAAC5f,CAAD,CAAQg7C,CAAR,CAAqBhhD,CAArB,CAA2BkgB,CAA3B,CAAuC,CAClD,GAAI,CAAClgB,CAAAihD,OAAL,CAAkB,CAOhB,IAAIC,EAAyBA,QAAQ,CAAC1tC,CAAD,CAAQ,CAC3CA,CAAAC,eACA,CAAID,CAAAC,eAAA,EAAJ,CACID,CAAAG,YADJ,CACwB,CAAA,CAHmB,CAM7C4hC,GAAA,CAAmByL,CAAA,CAAY,CAAZ,CAAnB,CAAmC,QAAnC,CAA6CE,CAA7C,CAIAF,EAAA/kC,GAAA,CAAe,UAAf,CAA2B,QAAQ,EAAG,CACpC5C,CAAA,CAAS,QAAQ,EAAG,CAClB7H,EAAA,CAAsBwvC,CAAA,CAAY,CAAZ,CAAtB,CAAsC,QAAtC,CAAgDE,CAAhD,CADkB,CAApB,CAEG,CAFH,CAEM,CAAA,CAFN,CADoC,CAAtC,CAjBgB,CADgC,IAyB9CC,EAAiBH,CAAApiD,OAAA,EAAAshB,WAAA,CAAgC,MAAhC,CAzB6B,CA0B9CkhC,EAAQphD,CAAAmF,KAARi8C,EAAqBphD,CAAAwxC,OAErB4P,EAAJ,EACExjB,EAAA,CAAO53B,CAAP,CAAco7C,CAAd,CAAqBlhC,CAArB,CAAiCkhC,CAAjC,CAEF,IAAID,CAAJ,CACEH,CAAA/kC,GAAA,CAAe,UAAf,CAA2B,QAAQ,EAAG,CACpCklC,CAAAlP,eAAA,CAA8B/xB,CAA9B,CACIkhC,EAAJ,EACExjB,EAAA,CAAO53B,CAAP,CAAco7C,CAAd,CAAqBplD,CAArB,CAAgColD,CAAhC,CAEF/iD,EAAA,CAAO6hB,CAAP,CAAmBgxB,EAAnB,CALoC,CAAtC,CAhCgD,CAD/C,CADW,CAJFrnC,CADiB,CAAhC,CADqC,CAA9C,CAyDIA,GAAgBi3C,EAAA,EAzDpB,CA0DIp2C,GAAkBo2C,EAAA,CAAqB,CAAA,CAArB,CA1DtB,CAoEIO,GAAa,qFApEjB;AAqEIC,GAAe,4DArEnB,CAsEIC,GAAgB,oCAtEpB,CAwEIC,GAAY,MA6ENjO,EA7EM,QAokBhBkO,QAAwB,CAACz7C,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB6yC,CAAvB,CAA6Bp5B,CAA7B,CAAuC2W,CAAvC,CAAiD,CACvEmjB,EAAA,CAAcvtC,CAAd,CAAqB5C,CAArB,CAA8BpD,CAA9B,CAAoC6yC,CAApC,CAA0Cp5B,CAA1C,CAAoD2W,CAApD,CAEAyiB,EAAAI,SAAA/1C,KAAA,CAAmB,QAAQ,CAACM,CAAD,CAAQ,CACjC,IAAI+F,EAAQsvC,CAAAmB,SAAA,CAAcx2C,CAAd,CACZ,IAAI+F,CAAJ,EAAag+C,EAAAj7C,KAAA,CAAmB9I,CAAnB,CAAb,CAEE,MADAq1C,EAAAR,aAAA,CAAkB,QAAlB,CAA4B,CAAA,CAA5B,CACO,CAAU,EAAV,GAAA70C,CAAA,CAAe,IAAf,CAAuB+F,CAAA,CAAQ/F,CAAR,CAAgB8xC,UAAA,CAAW9xC,CAAX,CAE9Cq1C,EAAAR,aAAA,CAAkB,QAAlB,CAA4B,CAAA,CAA5B,CACA,OAAOr2C,EAPwB,CAAnC,CAWAg3C,GAAA,CAAyBH,CAAzB,CAA+B,QAA/B,CAAyCzvC,CAAzC,CAEAyvC,EAAAuB,YAAAl3C,KAAA,CAAsB,QAAQ,CAACM,CAAD,CAAQ,CACpC,MAAOq1C,EAAAmB,SAAA,CAAcx2C,CAAd,CAAA,CAAuB,EAAvB,CAA4B,EAA5B,CAAiCA,CADJ,CAAtC,CAIIwC,EAAAmtC,IAAJ,GACMuU,CAMJ,CANmBA,QAAQ,CAAClkD,CAAD,CAAQ,CACjC,IAAI2vC,EAAMmC,UAAA,CAAWtvC,CAAAmtC,IAAX,CACV,OAAOyF,GAAA,CAASC,CAAT,CAAe,KAAf,CAAsBA,CAAAmB,SAAA,CAAcx2C,CAAd,CAAtB,EAA8CA,CAA9C,EAAuD2vC,CAAvD,CAA4D3vC,CAA5D,CAF0B,CAMnC,CADAq1C,CAAAI,SAAA/1C,KAAA,CAAmBwkD,CAAnB,CACA;AAAA7O,CAAAuB,YAAAl3C,KAAA,CAAsBwkD,CAAtB,CAPF,CAUI1hD,EAAA+pB,IAAJ,GACM43B,CAMJ,CANmBA,QAAQ,CAACnkD,CAAD,CAAQ,CACjC,IAAIusB,EAAMulB,UAAA,CAAWtvC,CAAA+pB,IAAX,CACV,OAAO6oB,GAAA,CAASC,CAAT,CAAe,KAAf,CAAsBA,CAAAmB,SAAA,CAAcx2C,CAAd,CAAtB,EAA8CA,CAA9C,EAAuDusB,CAAvD,CAA4DvsB,CAA5D,CAF0B,CAMnC,CADAq1C,CAAAI,SAAA/1C,KAAA,CAAmBykD,CAAnB,CACA,CAAA9O,CAAAuB,YAAAl3C,KAAA,CAAsBykD,CAAtB,CAPF,CAUA9O,EAAAuB,YAAAl3C,KAAA,CAAsB,QAAQ,CAACM,CAAD,CAAQ,CACpC,MAAOo1C,GAAA,CAASC,CAAT,CAAe,QAAf,CAAyBA,CAAAmB,SAAA,CAAcx2C,CAAd,CAAzB,EAAiD6B,EAAA,CAAS7B,CAAT,CAAjD,CAAkEA,CAAlE,CAD6B,CAAtC,CAxCuE,CApkBzD,KAinBhBokD,QAAqB,CAAC57C,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB6yC,CAAvB,CAA6Bp5B,CAA7B,CAAuC2W,CAAvC,CAAiD,CACpEmjB,EAAA,CAAcvtC,CAAd,CAAqB5C,CAArB,CAA8BpD,CAA9B,CAAoC6yC,CAApC,CAA0Cp5B,CAA1C,CAAoD2W,CAApD,CAEIyxB,EAAAA,CAAeA,QAAQ,CAACrkD,CAAD,CAAQ,CACjC,MAAOo1C,GAAA,CAASC,CAAT,CAAe,KAAf,CAAsBA,CAAAmB,SAAA,CAAcx2C,CAAd,CAAtB,EAA8C6jD,EAAA/6C,KAAA,CAAgB9I,CAAhB,CAA9C,CAAsEA,CAAtE,CAD0B,CAInCq1C,EAAAuB,YAAAl3C,KAAA,CAAsB2kD,CAAtB,CACAhP,EAAAI,SAAA/1C,KAAA,CAAmB2kD,CAAnB,CARoE,CAjnBtD,OA4nBhBC,QAAuB,CAAC97C,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB6yC,CAAvB,CAA6Bp5B,CAA7B,CAAuC2W,CAAvC,CAAiD,CACtEmjB,EAAA,CAAcvtC,CAAd,CAAqB5C,CAArB,CAA8BpD,CAA9B,CAAoC6yC,CAApC,CAA0Cp5B,CAA1C,CAAoD2W,CAApD,CAEI2xB,EAAAA,CAAiBA,QAAQ,CAACvkD,CAAD,CAAQ,CACnC,MAAOo1C,GAAA,CAASC,CAAT,CAAe,OAAf,CAAwBA,CAAAmB,SAAA,CAAcx2C,CAAd,CAAxB,EAAgD8jD,EAAAh7C,KAAA,CAAkB9I,CAAlB,CAAhD,CAA0EA,CAA1E,CAD4B,CAIrCq1C,EAAAuB,YAAAl3C,KAAA,CAAsB6kD,CAAtB,CACAlP;CAAAI,SAAA/1C,KAAA,CAAmB6kD,CAAnB,CARsE,CA5nBxD,OAuoBhBC,QAAuB,CAACh8C,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB6yC,CAAvB,CAA6B,CAE9C3zC,CAAA,CAAYc,CAAAmF,KAAZ,CAAJ,EACE/B,CAAApD,KAAA,CAAa,MAAb,CAAqBvC,EAAA,EAArB,CAGF2F,EAAA6Y,GAAA,CAAW,OAAX,CAAoB,QAAQ,EAAG,CACzB7Y,CAAA,CAAQ,CAAR,CAAA6+C,QAAJ,EACEj8C,CAAAG,OAAA,CAAa,QAAQ,EAAG,CACtB0sC,CAAAc,cAAA,CAAmB3zC,CAAAxC,MAAnB,CADsB,CAAxB,CAF2B,CAA/B,CAQAq1C,EAAAiB,QAAA,CAAeC,QAAQ,EAAG,CAExB3wC,CAAA,CAAQ,CAAR,CAAA6+C,QAAA,CADYjiD,CAAAxC,MACZ,EAA+Bq1C,CAAAa,WAFP,CAK1B1zC,EAAAwnB,SAAA,CAAc,OAAd,CAAuBqrB,CAAAiB,QAAvB,CAnBkD,CAvoBpC,UA6pBhBoO,QAA0B,CAACl8C,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB6yC,CAAvB,CAA6B,CAAA,IACjDsP,EAAYniD,CAAAoiD,YADqC,CAEjDC,EAAariD,CAAAsiD,aAEZ/lD,EAAA,CAAS4lD,CAAT,CAAL,GAA0BA,CAA1B,CAAsC,CAAA,CAAtC,CACK5lD,EAAA,CAAS8lD,CAAT,CAAL,GAA2BA,CAA3B,CAAwC,CAAA,CAAxC,CAEAj/C,EAAA6Y,GAAA,CAAW,OAAX,CAAoB,QAAQ,EAAG,CAC7BjW,CAAAG,OAAA,CAAa,QAAQ,EAAG,CACtB0sC,CAAAc,cAAA,CAAmBvwC,CAAA,CAAQ,CAAR,CAAA6+C,QAAnB,CADsB,CAAxB,CAD6B,CAA/B,CAMApP,EAAAiB,QAAA,CAAeC,QAAQ,EAAG,CACxB3wC,CAAA,CAAQ,CAAR,CAAA6+C,QAAA,CAAqBpP,CAAAa,WADG,CAK1Bb,EAAAmB,SAAA,CAAgBuO,QAAQ,CAAC/kD,CAAD,CAAQ,CAC9B,MAAOA,EAAP,GAAiB2kD,CADa,CAIhCtP;CAAAuB,YAAAl3C,KAAA,CAAsB,QAAQ,CAACM,CAAD,CAAQ,CACpC,MAAOA,EAAP,GAAiB2kD,CADmB,CAAtC,CAIAtP,EAAAI,SAAA/1C,KAAA,CAAmB,QAAQ,CAACM,CAAD,CAAQ,CACjC,MAAOA,EAAA,CAAQ2kD,CAAR,CAAoBE,CADM,CAAnC,CA1BqD,CA7pBvC,QAyZJvjD,CAzZI,QA0ZJA,CA1ZI,QA2ZJA,CA3ZI,OA4ZLA,CA5ZK,MA6ZNA,CA7ZM,CAxEhB,CA+4BI8K,GAAiB,CAAC,UAAD,CAAa,UAAb,CAAyB,QAAQ,CAACwmB,CAAD,CAAW3W,CAAX,CAAqB,CACzE,MAAO,UACK,GADL,SAEI,UAFJ,MAGCyE,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB6yC,CAAvB,CAA6B,CACrCA,CAAJ,EACG,CAAA2O,EAAA,CAAUt+C,CAAA,CAAUlD,CAAAkR,KAAV,CAAV,CAAA,EAAmCswC,EAAA11B,KAAnC,EAAmD9lB,CAAnD,CAA0D5C,CAA1D,CAAmEpD,CAAnE,CAAyE6yC,CAAzE,CAA+Ep5B,CAA/E,CACmD2W,CADnD,CAFsC,CAHtC,CADkE,CAAtD,CA/4BrB,CA45BI2gB,GAAc,UA55BlB,CA65BID,GAAgB,YA75BpB,CA85BIgB,GAAiB,aA95BrB,CA+5BIW,GAAc,UA/5BlB,CAuiCI+P,GAAoB,CAAC,QAAD,CAAW,mBAAX,CAAgC,QAAhC,CAA0C,UAA1C,CAAsD,QAAtD,CAAgE,UAAhE,CACpB,QAAQ,CAACp6B,CAAD,CAAStI,CAAT,CAA4B+D,CAA5B,CAAmC7B,CAAnC,CAA6CpB,CAA7C,CAAqDG,CAArD,CAA+D,CA6DzE4vB,QAASA,EAAc,CAACC,CAAD,CAAUC,CAAV,CAA8B,CACnDA,CAAA,CAAqBA,CAAA,CAAqB,GAArB,CAA2BlqC,EAAA,CAAWkqC,CAAX,CAA+B,GAA/B,CAA3B,CAAiE,EACtF9vB,EAAA0M,YAAA,CAAqBzL,CAArB,EAAgC4uB,CAAA,CAAUE,EAAV,CAA0BC,EAA1D,EAAyEF,CAAzE,CACA9vB;CAAAkB,SAAA,CAAkBD,CAAlB,EAA6B4uB,CAAA,CAAUG,EAAV,CAAwBD,EAArD,EAAsED,CAAtE,CAHmD,CA3DrD,IAAA4R,YAAA,CADA,IAAA/O,WACA,CADkBh1B,MAAAgkC,IAElB,KAAAzP,SAAA,CAAgB,EAChB,KAAAmB,YAAA,CAAmB,EACnB,KAAAuO,qBAAA,CAA4B,EAC5B,KAAAjR,UAAA,CAAiB,CAAA,CACjB,KAAAD,OAAA,CAAc,CAAA,CACd,KAAAE,OAAA,CAAc,CAAA,CACd,KAAAC,SAAA,CAAgB,CAAA,CAChB,KAAAL,MAAA,CAAa1tB,CAAA1e,KAV4D,KAYrEy9C,EAAahiC,CAAA,CAAOiD,CAAAg/B,QAAP,CAZwD,CAarEC,EAAaF,CAAA96B,OAEjB,IAAI,CAACg7B,CAAL,CACE,KAAM7mD,EAAA,CAAO,SAAP,CAAA,CAAkB,WAAlB,CACF4nB,CAAAg/B,QADE,CACa1/C,EAAA,CAAY6e,CAAZ,CADb,CAAN,CAYF,IAAA8xB,QAAA,CAAeh1C,CAmBf,KAAAk1C,SAAA,CAAgB+O,QAAQ,CAACvlD,CAAD,CAAQ,CAC9B,MAAO0B,EAAA,CAAY1B,CAAZ,CAAP,EAAuC,EAAvC,GAA6BA,CAA7B,EAAuD,IAAvD,GAA6CA,CAA7C,EAA+DA,CAA/D,GAAyEA,CAD3C,CA/CyC,KAmDrEyzC,EAAajvB,CAAAghC,cAAA,CAAuB,iBAAvB,CAAb/R,EAA0DC,EAnDW,CAoDrEC,EAAe,CApDsD,CAqDrEE,EAAS,IAAAA,OAATA,CAAuB,EAI3BrvB,EAAAC,SAAA,CAAkB6vB,EAAlB,CACAnB,EAAA,CAAe,CAAA,CAAf,CA0BA,KAAA0B,aAAA,CAAoB4Q,QAAQ,CAACpS,CAAD,CAAqBD,CAArB,CAA8B,CAGpDS,CAAA,CAAOR,CAAP,CAAJ;AAAmC,CAACD,CAApC,GAGIA,CAAJ,EACMS,CAAA,CAAOR,CAAP,CACJ,EADgCM,CAAA,EAChC,CAAKA,CAAL,GACER,CAAA,CAAe,CAAA,CAAf,CAEA,CADA,IAAAgB,OACA,CADc,CAAA,CACd,CAAA,IAAAC,SAAA,CAAgB,CAAA,CAHlB,CAFF,GAQEjB,CAAA,CAAe,CAAA,CAAf,CAGA,CAFA,IAAAiB,SAEA,CAFgB,CAAA,CAEhB,CADA,IAAAD,OACA,CADc,CAAA,CACd,CAAAR,CAAA,EAXF,CAiBA,CAHAE,CAAA,CAAOR,CAAP,CAGA,CAH6B,CAACD,CAG9B,CAFAD,CAAA,CAAeC,CAAf,CAAwBC,CAAxB,CAEA,CAAAI,CAAAoB,aAAA,CAAwBxB,CAAxB,CAA4CD,CAA5C,CAAqD,IAArD,CApBA,CAHwD,CAoC1D,KAAA8B,aAAA,CAAoBwQ,QAAS,EAAG,CAC9B,IAAAzR,OAAA,CAAc,CAAA,CACd,KAAAC,UAAA,CAAiB,CAAA,CACjB3wB,EAAA0M,YAAA,CAAqBzL,CAArB,CAA+BywB,EAA/B,CACA1xB,EAAAkB,SAAA,CAAkBD,CAAlB,CAA4B8vB,EAA5B,CAJ8B,CA4BhC,KAAA6B,cAAA,CAAqBwP,QAAQ,CAAC3lD,CAAD,CAAQ,CACnC,IAAAk2C,WAAA,CAAkBl2C,CAGd,KAAAk0C,UAAJ,GACE,IAAAD,OAIA,CAJc,CAAA,CAId,CAHA,IAAAC,UAGA,CAHiB,CAAA,CAGjB,CAFA3wB,CAAA0M,YAAA,CAAqBzL,CAArB,CAA+B8vB,EAA/B,CAEA,CADA/wB,CAAAkB,SAAA,CAAkBD,CAAlB,CAA4BywB,EAA5B,CACA,CAAAxB,CAAAsB,UAAA,EALF,CAQA91C,EAAA,CAAQ,IAAAw2C,SAAR,CAAuB,QAAQ,CAAChxC,CAAD,CAAK,CAClCzE,CAAA,CAAQyE,CAAA,CAAGzE,CAAH,CAD0B,CAApC,CAII,KAAAilD,YAAJ,GAAyBjlD,CAAzB,GACE,IAAAilD,YAEA,CAFmBjlD,CAEnB,CADAslD,CAAA,CAAW16B,CAAX,CAAmB5qB,CAAnB,CACA,CAAAf,CAAA,CAAQ,IAAAkmD,qBAAR;AAAmC,QAAQ,CAAChoC,CAAD,CAAW,CACpD,GAAI,CACFA,CAAA,EADE,CAEF,MAAMnX,CAAN,CAAS,CACTsc,CAAA,CAAkBtc,CAAlB,CADS,CAHyC,CAAtD,CAHF,CAhBmC,CA8BrC,KAAIqvC,EAAO,IAEXzqB,EAAAvnB,OAAA,CAAcuiD,QAAqB,EAAG,CACpC,IAAI5lD,EAAQolD,CAAA,CAAWx6B,CAAX,CAGZ,IAAIyqB,CAAA4P,YAAJ,GAAyBjlD,CAAzB,CAAgC,CAAA,IAE1B6lD,EAAaxQ,CAAAuB,YAFa,CAG1BhhB,EAAMiwB,CAAAhnD,OAGV,KADAw2C,CAAA4P,YACA,CADmBjlD,CACnB,CAAM41B,CAAA,EAAN,CAAA,CACE51B,CAAA,CAAQ6lD,CAAA,CAAWjwB,CAAX,CAAA,CAAgB51B,CAAhB,CAGNq1C,EAAAa,WAAJ,GAAwBl2C,CAAxB,GACEq1C,CAAAa,WACA,CADkBl2C,CAClB,CAAAq1C,CAAAiB,QAAA,EAFF,CAV8B,CAgBhC,MAAOt2C,EApB6B,CAAtC,CApLyE,CADnD,CAviCxB,CA21CIiO,GAAmBA,QAAQ,EAAG,CAChC,MAAO,SACI,CAAC,SAAD,CAAY,QAAZ,CADJ,YAEO+2C,EAFP,MAGCtkC,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuBsjD,CAAvB,CAA8B,CAAA,IAGtCC,EAAYD,CAAA,CAAM,CAAN,CAH0B,CAItCE,EAAWF,CAAA,CAAM,CAAN,CAAXE,EAAuBtS,EAE3BsS,EAAA3R,YAAA,CAAqB0R,CAArB,CAEAv9C,EAAA6/B,IAAA,CAAU,UAAV,CAAsB,QAAQ,EAAG,CAC/B2d,CAAAvR,eAAA,CAAwBsR,CAAxB,CAD+B,CAAjC,CAR0C,CAHvC,CADyB,CA31ClC,CAy6CI53C,GAAoB1M,EAAA,CAAQ,SACrB,SADqB,MAExBif,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB6yC,CAAvB,CAA6B,CACzCA,CAAA8P,qBAAAzlD,KAAA,CAA+B,QAAQ,EAAG,CACxC8I,CAAA0/B,MAAA,CAAY1lC,CAAAyjD,SAAZ,CADwC,CAA1C,CADyC,CAFb,CAAR,CAz6CxB;AAm7CI73C,GAAoBA,QAAQ,EAAG,CACjC,MAAO,SACI,UADJ,MAECsS,QAAQ,CAAClY,CAAD,CAAQ8S,CAAR,CAAa9Y,CAAb,CAAmB6yC,CAAnB,CAAyB,CACrC,GAAKA,CAAL,CAAA,CACA7yC,CAAA0jD,SAAA,CAAgB,CAAA,CAEhB,KAAIxQ,EAAYA,QAAQ,CAAC11C,CAAD,CAAQ,CAC9B,GAAIwC,CAAA0jD,SAAJ,EAAqB7Q,CAAAmB,SAAA,CAAcx2C,CAAd,CAArB,CACEq1C,CAAAR,aAAA,CAAkB,UAAlB,CAA8B,CAAA,CAA9B,CADF,KAKE,OADAQ,EAAAR,aAAA,CAAkB,UAAlB,CAA8B,CAAA,CAA9B,CACO70C,CAAAA,CANqB,CAUhCq1C,EAAAuB,YAAAl3C,KAAA,CAAsBg2C,CAAtB,CACAL,EAAAI,SAAAh1C,QAAA,CAAsBi1C,CAAtB,CAEAlzC,EAAAwnB,SAAA,CAAc,UAAd,CAA0B,QAAQ,EAAG,CACnC0rB,CAAA,CAAUL,CAAAa,WAAV,CADmC,CAArC,CAhBA,CADqC,CAFlC,CAD0B,CAn7CnC,CAqgDIhoC,GAAkBA,QAAQ,EAAG,CAC/B,MAAO,SACI,SADJ,MAECwS,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB6yC,CAAvB,CAA6B,CACzC,IACIjsC,GADA/C,CACA+C,CADQ,UAAAtB,KAAA,CAAgBtF,CAAA2jD,OAAhB,CACR/8C,GAAyB3F,MAAJ,CAAW4C,CAAA,CAAM,CAAN,CAAX,CAArB+C,EAA6C5G,CAAA2jD,OAA7C/8C,EAA4D,GAiBhEisC,EAAAI,SAAA/1C,KAAA,CAfY6F,QAAQ,CAAC6gD,CAAD,CAAY,CAE9B,GAAI,CAAA1kD,CAAA,CAAY0kD,CAAZ,CAAJ,CAAA,CAEA,IAAIxjD,EAAO,EAEPwjD,EAAJ,EACEnnD,CAAA,CAAQmnD,CAAAx/C,MAAA,CAAgBwC,CAAhB,CAAR,CAAoC,QAAQ,CAACpJ,CAAD,CAAQ,CAC9CA,CAAJ;AAAW4C,CAAAlD,KAAA,CAAUkS,EAAA,CAAK5R,CAAL,CAAV,CADuC,CAApD,CAKF,OAAO4C,EAVP,CAF8B,CAehC,CACAyyC,EAAAuB,YAAAl3C,KAAA,CAAsB,QAAQ,CAACM,CAAD,CAAQ,CACpC,MAAIhB,EAAA,CAAQgB,CAAR,CAAJ,CACSA,CAAAM,KAAA,CAAW,IAAX,CADT,CAIO9B,CAL6B,CAAtC,CASA62C,EAAAmB,SAAA,CAAgBuO,QAAQ,CAAC/kD,CAAD,CAAQ,CAC9B,MAAO,CAACA,CAAR,EAAiB,CAACA,CAAAnB,OADY,CA7BS,CAFtC,CADwB,CArgDjC,CA6iDIwnD,GAAwB,oBA7iD5B,CAimDIh4C,GAAmBA,QAAQ,EAAG,CAChC,MAAO,UACK,GADL,SAEI5F,QAAQ,CAAC69C,CAAD,CAAMC,CAAN,CAAe,CAC9B,MAAIF,GAAAv9C,KAAA,CAA2By9C,CAAAC,QAA3B,CAAJ,CACSC,QAA4B,CAACj+C,CAAD,CAAQ8S,CAAR,CAAa9Y,CAAb,CAAmB,CACpDA,CAAAqqB,KAAA,CAAU,OAAV,CAAmBrkB,CAAA0/B,MAAA,CAAY1lC,CAAAgkD,QAAZ,CAAnB,CADoD,CADxD,CAKSE,QAAoB,CAACl+C,CAAD,CAAQ8S,CAAR,CAAa9Y,CAAb,CAAmB,CAC5CgG,CAAAnF,OAAA,CAAab,CAAAgkD,QAAb,CAA2BG,QAAyB,CAAC3mD,CAAD,CAAQ,CAC1DwC,CAAAqqB,KAAA,CAAU,OAAV,CAAmB7sB,CAAnB,CAD0D,CAA5D,CAD4C,CANlB,CAF3B,CADyB,CAjmDlC,CAsqDI0M,GAAkBumC,EAAA,CAAY,QAAQ,CAACzqC,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CAC/DoD,CAAA6e,SAAA,CAAiB,YAAjB,CAAA7b,KAAA,CAAoC,UAApC,CAAgDpG,CAAAokD,OAAhD,CACAp+C,EAAAnF,OAAA,CAAab,CAAAokD,OAAb,CAA0BC,QAA0B,CAAC7mD,CAAD,CAAQ,CAI1D4F,CAAA0oB,KAAA,CAAatuB,CAAA,EAASxB,CAAT,CAAqB,EAArB,CAA0BwB,CAAvC,CAJ0D,CAA5D,CAF+D,CAA3C,CAtqDtB,CAmuDI4M,GAA0B,CAAC,cAAD;AAAiB,QAAQ,CAACqW,CAAD,CAAe,CACpE,MAAO,SAAQ,CAACza,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CAEhC+rB,CAAAA,CAAgBtL,CAAA,CAAard,CAAApD,KAAA,CAAaA,CAAA6jB,MAAAygC,eAAb,CAAb,CACpBlhD,EAAA6e,SAAA,CAAiB,YAAjB,CAAA7b,KAAA,CAAoC,UAApC,CAAgD2lB,CAAhD,CACA/rB,EAAAwnB,SAAA,CAAc,gBAAd,CAAgC,QAAQ,CAAChqB,CAAD,CAAQ,CAC9C4F,CAAA0oB,KAAA,CAAatuB,CAAb,CAD8C,CAAhD,CAJoC,CAD8B,CAAxC,CAnuD9B,CA6xDI2M,GAAsB,CAAC,MAAD,CAAS,QAAT,CAAmB,QAAQ,CAAC2W,CAAD,CAAOF,CAAP,CAAe,CAClE,MAAO,SAAQ,CAAC5a,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CACpCoD,CAAA6e,SAAA,CAAiB,YAAjB,CAAA7b,KAAA,CAAoC,UAApC,CAAgDpG,CAAAukD,WAAhD,CAEA,KAAIj1C,EAASsR,CAAA,CAAO5gB,CAAAukD,WAAP,CAGbv+C,EAAAnF,OAAA,CAFA2jD,QAAuB,EAAG,CAAE,MAAQjlD,CAAA+P,CAAA,CAAOtJ,CAAP,CAAAzG,EAAiB,EAAjBA,UAAA,EAAV,CAE1B,CAA6BklD,QAA8B,CAACjnD,CAAD,CAAQ,CACjE4F,CAAAO,KAAA,CAAamd,CAAA4jC,eAAA,CAAoBp1C,CAAA,CAAOtJ,CAAP,CAApB,CAAb,EAAmD,EAAnD,CADiE,CAAnE,CANoC,CAD4B,CAA1C,CA7xD1B,CA8iEIqE,GAAmBsqC,EAAA,CAAe,EAAf,CAAmB,CAAA,CAAnB,CA9iEvB,CA8lEIpqC,GAAsBoqC,EAAA,CAAe,KAAf,CAAsB,CAAtB,CA9lE1B,CA8oEIrqC,GAAuBqqC,EAAA,CAAe,MAAf,CAAuB,CAAvB,CA9oE3B,CAwsEInqC,GAAmBimC,EAAA,CAAY,SACxBxqC,QAAQ,CAAC7C,CAAD,CAAUpD,CAAV,CAAgB,CAC/BA,CAAAqqB,KAAA,CAAU,SAAV,CAAqBruB,CAArB,CACAoH,EAAAqqB,YAAA,CAAoB,UAApB,CAF+B,CADA,CAAZ,CAxsEvB;AA+4EIhjB,GAAwB,CAAC,QAAQ,EAAG,CACtC,MAAO,OACE,CAAA,CADF,YAEO,GAFP,UAGK,GAHL,CAD+B,CAAZ,CA/4E5B,CAq+EIuB,GAAoB,EACxBvP,EAAA,CACE,6IAAA,MAAA,CAAA,GAAA,CADF,CAEE,QAAQ,CAAC0I,CAAD,CAAO,CACb,IAAIkhB,EAAgBtC,EAAA,CAAmB,KAAnB,CAA2B5e,CAA3B,CACpB6G,GAAA,CAAkBqa,CAAlB,CAAA,CAAmC,CAAC,QAAD,CAAW,QAAQ,CAACzF,CAAD,CAAS,CAC7D,MAAO,SACI3a,QAAQ,CAAC+b,CAAD,CAAWhiB,CAAX,CAAiB,CAChC,IAAIiC,EAAK2e,CAAA,CAAO5gB,CAAA,CAAKqmB,CAAL,CAAP,CACT,OAAO,SAAQ,CAACrgB,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CACpCoD,CAAA6Y,GAAA,CAAW/Y,CAAA,CAAUiC,CAAV,CAAX,CAA4B,QAAQ,CAACqO,CAAD,CAAQ,CAC1CxN,CAAAG,OAAA,CAAa,QAAQ,EAAG,CACtBlE,CAAA,CAAG+D,CAAH,CAAU,QAAQwN,CAAR,CAAV,CADsB,CAAxB,CAD0C,CAA5C,CADoC,CAFN,CAD7B,CADsD,CAA5B,CAFtB,CAFjB,CAgeA,KAAI5I,GAAgB,CAAC,UAAD,CAAa,QAAQ,CAACmW,CAAD,CAAW,CAClD,MAAO,YACO,SADP,UAEK,GAFL,UAGK,CAAA,CAHL,UAIK,GAJL;MAKE,CAAA,CALF,MAMC7C,QAAS,CAACkK,CAAD,CAASpG,CAAT,CAAmB6B,CAAnB,CAA0BgvB,CAA1B,CAAgC8R,CAAhC,CAA6C,CAAA,IACpD17C,CADoD,CAC7CsZ,CAD6C,CACjCqiC,CACvBx8B,EAAAvnB,OAAA,CAAcgjB,CAAAghC,KAAd,CAA0BC,QAAwB,CAACtnD,CAAD,CAAQ,CAEpDwF,EAAA,CAAUxF,CAAV,CAAJ,CACO+kB,CADP,GAEIA,CACA,CADa6F,CAAAvF,KAAA,EACb,CAAA8hC,CAAA,CAAYpiC,CAAZ,CAAwB,QAAS,CAACjf,CAAD,CAAQ,CACvCA,CAAA,CAAMA,CAAAjH,OAAA,EAAN,CAAA,CAAwBN,CAAAotB,cAAA,CAAuB,aAAvB,CAAuCtF,CAAAghC,KAAvC,CAAoD,GAApD,CAIxB57C,EAAA,CAAQ,OACC3F,CADD,CAGRyd,EAAAy4B,MAAA,CAAel2C,CAAf,CAAsB0e,CAAApjB,OAAA,EAAtB,CAAyCojB,CAAzC,CARuC,CAAzC,CAHJ,GAeK4iC,CAQH,GAPEA,CAAA9lC,OAAA,EACA,CAAA8lC,CAAA,CAAmB,IAMrB,EAJGriC,CAIH,GAHEA,CAAA1Q,SAAA,EACA,CAAA0Q,CAAA,CAAa,IAEf,EAAGtZ,CAAH,GACE27C,CAIA,CAJmB/8C,EAAA,CAAiBoB,CAAA3F,MAAjB,CAInB,CAHAyd,CAAA04B,MAAA,CAAemL,CAAf,CAAiC,QAAQ,EAAG,CAC1CA,CAAA,CAAmB,IADuB,CAA5C,CAGA,CAAA37C,CAAA,CAAQ,IALV,CAvBF,CAFwD,CAA1D,CAFwD,CANvD,CAD2C,CAAhC,CAApB,CA8MI4B,GAAqB,CAAC,OAAD,CAAU,gBAAV,CAA4B,eAA5B,CAA6C,UAA7C,CAAyD,MAAzD,CACP,QAAQ,CAAC6V,CAAD,CAAUC,CAAV,CAA4BokC,CAA5B,CAA6ChkC,CAA7C,CAAyDD,CAAzD,CAA+D,CACvF,MAAO,UACK,KADL,UAEK,GAFL,UAGK,CAAA,CAHL,YAIO,SAJP,YAKOva,EAAAzH,KALP,SAMImH,QAAQ,CAAC7C,CAAD;AAAUpD,CAAV,CAAgB,CAAA,IAC3BglD,EAAShlD,CAAAilD,UAATD,EAA2BhlD,CAAAmB,IADA,CAE3B+jD,EAAYllD,CAAA00B,OAAZwwB,EAA2B,EAFA,CAG3BC,EAAgBnlD,CAAAolD,WAEpB,OAAO,SAAQ,CAACp/C,CAAD,CAAQgc,CAAR,CAAkB6B,CAAlB,CAAyBgvB,CAAzB,CAA+B8R,CAA/B,CAA4C,CAAA,IACrDroB,EAAgB,CADqC,CAErD+J,CAFqD,CAGrDgf,CAHqD,CAIrDC,CAJqD,CAMrDC,EAA4BA,QAAQ,EAAG,CACtCF,CAAH,GACEA,CAAAvmC,OAAA,EACA,CAAAumC,CAAA,CAAkB,IAFpB,CAIGhf,EAAH,GACEA,CAAAx0B,SAAA,EACA,CAAAw0B,CAAA,CAAe,IAFjB,CAIGif,EAAH,GACEvkC,CAAA04B,MAAA,CAAe6L,CAAf,CAA+B,QAAQ,EAAG,CACxCD,CAAA,CAAkB,IADsB,CAA1C,CAIA,CADAA,CACA,CADkBC,CAClB,CAAAA,CAAA,CAAiB,IALnB,CATyC,CAkB3Ct/C,EAAAnF,OAAA,CAAaigB,CAAA0kC,mBAAA,CAAwBR,CAAxB,CAAb,CAA8CS,QAA6B,CAACtkD,CAAD,CAAM,CAC/E,IAAIukD,EAAiBA,QAAQ,EAAG,CAC1B,CAAAvmD,CAAA,CAAUgmD,CAAV,CAAJ,EAAkCA,CAAlC,EAAmD,CAAAn/C,CAAA0/B,MAAA,CAAYyf,CAAZ,CAAnD,EACEJ,CAAA,EAF4B,CAAhC,CAKIY,EAAe,EAAErpB,CAEjBn7B,EAAJ,EACEuf,CAAAtK,IAAA,CAAUjV,CAAV,CAAe,OAAQwf,CAAR,CAAf,CAAAmK,QAAA,CAAgD,QAAQ,CAACO,CAAD,CAAW,CACjE,GAAIs6B,CAAJ,GAAqBrpB,CAArB,CAAA,CACA,IAAIspB,EAAW5/C,CAAA6c,KAAA,EACfgwB,EAAAvqB,SAAA,CAAgB+C,CAQZ/nB,EAAAA,CAAQqhD,CAAA,CAAYiB,CAAZ,CAAsB,QAAQ,CAACtiD,CAAD,CAAQ,CAChDiiD,CAAA,EACAxkC,EAAAy4B,MAAA,CAAel2C,CAAf,CAAsB,IAAtB,CAA4B0e,CAA5B,CAAsC0jC,CAAtC,CAFgD,CAAtC,CAKZrf,EAAA,CAAeuf,CACfN,EAAA,CAAiBhiD,CAEjB+iC,EAAAH,MAAA,CAAmB,uBAAnB,CACAlgC,EAAA0/B,MAAA,CAAYwf,CAAZ,CAnBA,CADiE,CAAnE,CAAAprC,MAAA,CAqBS,QAAQ,EAAG,CACd6rC,CAAJ;AAAqBrpB,CAArB,EAAoCipB,CAAA,EADlB,CArBpB,CAwBA,CAAAv/C,CAAAkgC,MAAA,CAAY,0BAAZ,CAzBF,GA2BEqf,CAAA,EACA,CAAA1S,CAAAvqB,SAAA,CAAgB,IA5BlB,CAR+E,CAAjF,CAxByD,CAL5B,CAN5B,CADgF,CADhE,CA9MzB,CAoSIxc,GAAgC,CAAC,UAAD,CAClC,QAAQ,CAAC+5C,CAAD,CAAW,CACjB,MAAO,UACK,KADL,UAEM,IAFN,SAGI,WAHJ,MAIC3nC,QAAQ,CAAClY,CAAD,CAAQgc,CAAR,CAAkB6B,CAAlB,CAAyBgvB,CAAzB,CAA+B,CAC3C7wB,CAAAre,KAAA,CAAckvC,CAAAvqB,SAAd,CACAu9B,EAAA,CAAS7jC,CAAAsH,SAAA,EAAT,CAAA,CAA8BtjB,CAA9B,CAF2C,CAJxC,CADU,CADe,CApSpC,CAwWI8E,GAAkB2lC,EAAA,CAAY,UACtB,GADsB,SAEvBxqC,QAAQ,EAAG,CAClB,MAAO,KACA2f,QAAQ,CAAC5f,CAAD,CAAQ5C,CAAR,CAAiB6f,CAAjB,CAAwB,CACnCjd,CAAA0/B,MAAA,CAAYziB,CAAA6iC,OAAZ,CADmC,CADhC,CADW,CAFY,CAAZ,CAxWtB,CAmZI/6C,GAAyB0lC,EAAA,CAAY,UAAY,CAAA,CAAZ,UAA4B,GAA5B,CAAZ,CAnZ7B,CAgkBIzlC,GAAuB,CAAC,SAAD,CAAY,cAAZ,CAA4B,QAAQ,CAAC4gC,CAAD,CAAUnrB,CAAV,CAAwB,CACrF,IAAIslC,EAAQ,KACZ,OAAO,UACK,IADL,MAEC7nC,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CAAA,IAC/BgmD,EAAYhmD,CAAAi3B,MADmB,CAE/BgvB,EAAUjmD,CAAA6jB,MAAAqO,KAAV+zB,EAA6B7iD,CAAApD,KAAA,CAAaA,CAAA6jB,MAAAqO,KAAb,CAFE,CAG/BrkB,EAAS7N,CAAA6N,OAATA;AAAwB,CAHO,CAI/Bq4C,EAAQlgD,CAAA0/B,MAAA,CAAYugB,CAAZ,CAARC,EAAgC,EAJD,CAK/BC,EAAc,EALiB,CAM/Bh4B,EAAc1N,CAAA0N,YAAA,EANiB,CAO/BC,EAAY3N,CAAA2N,UAAA,EAPmB,CAQ/Bg4B,EAAS,oBAEb3pD,EAAA,CAAQuD,CAAR,CAAc,QAAQ,CAAC+uB,CAAD,CAAas3B,CAAb,CAA4B,CAC5CD,CAAA9/C,KAAA,CAAY+/C,CAAZ,CAAJ,GACEH,CAAA,CAAMhjD,CAAA,CAAUmjD,CAAAviD,QAAA,CAAsB,MAAtB,CAA8B,EAA9B,CAAAA,QAAA,CAA0C,OAA1C,CAAmD,GAAnD,CAAV,CAAN,CADF,CAEIV,CAAApD,KAAA,CAAaA,CAAA6jB,MAAA,CAAWwiC,CAAX,CAAb,CAFJ,CADgD,CAAlD,CAMA5pD,EAAA,CAAQypD,CAAR,CAAe,QAAQ,CAACn3B,CAAD,CAAanyB,CAAb,CAAkB,CACvCupD,CAAA,CAAYvpD,CAAZ,CAAA,CACE6jB,CAAA,CAAasO,CAAAjrB,QAAA,CAAmBiiD,CAAnB,CAA0B53B,CAA1B,CAAwC63B,CAAxC,CAAoD,GAApD,CACXn4C,CADW,CACFugB,CADE,CAAb,CAFqC,CAAzC,CAMApoB,EAAAnF,OAAA,CAAaylD,QAAyB,EAAG,CACvC,IAAI9oD,EAAQ8xC,UAAA,CAAWtpC,CAAA0/B,MAAA,CAAYsgB,CAAZ,CAAX,CAEZ,IAAKrgB,KAAA,CAAMnoC,CAAN,CAAL,CAME,MAAO,EAHDA,EAAN,GAAe0oD,EAAf,GAAuB1oD,CAAvB,CAA+BouC,CAAAhU,UAAA,CAAkBp6B,CAAlB,CAA0BqQ,CAA1B,CAA/B,CACC,OAAOs4C,EAAA,CAAY3oD,CAAZ,CAAA,CAAmBwI,CAAnB,CAA0B5C,CAA1B,CAAmC,CAAA,CAAnC,CAP6B,CAAzC,CAWGmjD,QAA+B,CAACtiB,CAAD,CAAS,CACzC7gC,CAAA0oB,KAAA,CAAamY,CAAb,CADyC,CAX3C,CAtBmC,CAFhC,CAF8E,CAA5D,CAhkB3B,CAkzBIh5B,GAAoB,CAAC,QAAD,CAAW,UAAX,CAAuB,QAAQ,CAAC2V,CAAD,CAASG,CAAT,CAAmB,CAExE,IAAIylC,EAAiBvqD,CAAA,CAAO,UAAP,CACrB,OAAO,YACO,SADP,UAEK,GAFL,UAGK,CAAA,CAHL,OAIE,CAAA,CAJF;KAKCiiB,QAAQ,CAACkK,CAAD,CAASpG,CAAT,CAAmB6B,CAAnB,CAA0BgvB,CAA1B,CAAgC8R,CAAhC,CAA4C,CACtD,IAAI51B,EAAalL,CAAA4iC,SAAjB,CACI5iD,EAAQkrB,CAAAlrB,MAAA,CAAiB,qEAAjB,CADZ,CAEc6iD,CAFd,CAEgCC,CAFhC,CAEgDC,CAFhD,CAEkEC,CAFlE,CAGYC,CAHZ,CAG6BC,CAH7B,CAIEC,EAAe,KAAMxyC,EAAN,CAEjB,IAAI,CAAC3Q,CAAL,CACE,KAAM2iD,EAAA,CAAe,MAAf,CACJz3B,CADI,CAAN,CAIFk4B,CAAA,CAAMpjD,CAAA,CAAM,CAAN,CACNqjD,EAAA,CAAMrjD,CAAA,CAAM,CAAN,CAGN,EAFAsjD,CAEA,CAFatjD,CAAA,CAAM,CAAN,CAEb,GACE6iD,CACA,CADmB9lC,CAAA,CAAOumC,CAAP,CACnB,CAAAR,CAAA,CAAiBA,QAAQ,CAAC/pD,CAAD,CAAMY,CAAN,CAAaE,CAAb,CAAoB,CAEvCqpD,CAAJ,GAAmBC,CAAA,CAAaD,CAAb,CAAnB,CAAiDnqD,CAAjD,CACAoqD,EAAA,CAAaF,CAAb,CAAA,CAAgCtpD,CAChCwpD,EAAA7R,OAAA,CAAsBz3C,CACtB,OAAOgpD,EAAA,CAAiBt+B,CAAjB,CAAyB4+B,CAAzB,CALoC,CAF/C,GAUEJ,CAGA,CAHmBA,QAAQ,CAAChqD,CAAD,CAAMY,CAAN,CAAa,CACtC,MAAOgX,GAAA,CAAQhX,CAAR,CAD+B,CAGxC,CAAAqpD,CAAA,CAAiBA,QAAQ,CAACjqD,CAAD,CAAM,CAC7B,MAAOA,EADsB,CAbjC,CAkBAiH,EAAA,CAAQojD,CAAApjD,MAAA,CAAU,+CAAV,CACR,IAAI,CAACA,CAAL,CACE,KAAM2iD,EAAA,CAAe,QAAf,CACoDS,CADpD,CAAN,CAGFH,CAAA,CAAkBjjD,CAAA,CAAM,CAAN,CAAlB,EAA8BA,CAAA,CAAM,CAAN,CAC9BkjD,EAAA,CAAgBljD,CAAA,CAAM,CAAN,CAOhB,KAAIujD,EAAe,EAGnBh/B,EAAAgc,iBAAA,CAAwB8iB,CAAxB,CAA6BG,QAAuB,CAACC,CAAD,CAAY,CAAA,IAC1D5pD,CAD0D,CACnDrB,CADmD,CAE1DkrD,EAAevlC,CAAA,CAAS,CAAT,CAF2C,CAG1DwlC,CAH0D,CAM1DC,EAAe,EAN2C,CAO1DC,CAP0D,CAQ1DnlC,CAR0D,CAS1D3lB,CAT0D,CASrDY,CATqD,CAY1DmqD,CAZ0D,CAa1D1+C,CAb0D;AAc1D2+C,EAAiB,EAIrB,IAAI1rD,EAAA,CAAYorD,CAAZ,CAAJ,CACEK,CACA,CADiBL,CACjB,CAAAO,CAAA,CAAclB,CAAd,EAAgCC,CAFlC,KAGO,CACLiB,CAAA,CAAclB,CAAd,EAAgCE,CAEhCc,EAAA,CAAiB,EACjB,KAAK/qD,CAAL,GAAY0qD,EAAZ,CACMA,CAAAxqD,eAAA,CAA0BF,CAA1B,CAAJ,EAAuD,GAAvD,EAAsCA,CAAAwE,OAAA,CAAW,CAAX,CAAtC,EACEumD,CAAAzqD,KAAA,CAAoBN,CAApB,CAGJ+qD,EAAAxqD,KAAA,EATK,CAYPuqD,CAAA,CAAcC,CAAAtrD,OAGdA,EAAA,CAASurD,CAAAvrD,OAAT,CAAiCsrD,CAAAtrD,OACjC,KAAIqB,CAAJ,CAAY,CAAZ,CAAeA,CAAf,CAAuBrB,CAAvB,CAA+BqB,CAAA,EAA/B,CAKC,GAJAd,CAIG,CAJI0qD,CAAD,GAAgBK,CAAhB,CAAkCjqD,CAAlC,CAA0CiqD,CAAA,CAAejqD,CAAf,CAI7C,CAHHF,CAGG,CAHK8pD,CAAA,CAAW1qD,CAAX,CAGL,CAFHkrD,CAEG,CAFSD,CAAA,CAAYjrD,CAAZ,CAAiBY,CAAjB,CAAwBE,CAAxB,CAET,CADH6J,EAAA,CAAwBugD,CAAxB,CAAmC,eAAnC,CACG,CAAAV,CAAAtqD,eAAA,CAA4BgrD,CAA5B,CAAH,CACE7+C,CAGA,CAHQm+C,CAAA,CAAaU,CAAb,CAGR,CAFA,OAAOV,CAAA,CAAaU,CAAb,CAEP,CADAL,CAAA,CAAaK,CAAb,CACA,CAD0B7+C,CAC1B,CAAA2+C,CAAA,CAAelqD,CAAf,CAAA,CAAwBuL,CAJ1B,KAKO,CAAA,GAAIw+C,CAAA3qD,eAAA,CAA4BgrD,CAA5B,CAAJ,CAML,KAJArrD,EAAA,CAAQmrD,CAAR,CAAwB,QAAQ,CAAC3+C,CAAD,CAAQ,CAClCA,CAAJ,EAAaA,CAAAjD,MAAb,GAA0BohD,CAAA,CAAan+C,CAAA64B,GAAb,CAA1B,CAAmD74B,CAAnD,CADsC,CAAxC,CAIM,CAAAu9C,CAAA,CAAe,OAAf,CACiIz3B,CADjI,CACmJ+4B,CADnJ,CAAN,CAIAF,CAAA,CAAelqD,CAAf,CAAA,CAAwB,IAAMoqD,CAAN,CACxBL,EAAA,CAAaK,CAAb,CAAA,CAA0B,CAAA,CAXrB,CAgBR,IAAKlrD,CAAL,GAAYwqD,EAAZ,CAEMA,CAAAtqD,eAAA,CAA4BF,CAA5B,CAAJ,GACEqM,CAIA,CAJQm+C,CAAA,CAAaxqD,CAAb,CAIR,CAHAgwB,CAGA,CAHmB/kB,EAAA,CAAiBoB,CAAA3F,MAAjB,CAGnB,CAFAyd,CAAA04B,MAAA,CAAe7sB,CAAf,CAEA,CADAnwB,CAAA,CAAQmwB,CAAR,CAA0B,QAAQ,CAACxpB,CAAD,CAAU,CAAEA,CAAA,aAAA,CAAsB,CAAA,CAAxB,CAA5C,CACA,CAAA6F,CAAAjD,MAAA6L,SAAA,EALF,CAUGnU;CAAA,CAAQ,CAAb,KAAgBrB,CAAhB,CAAyBsrD,CAAAtrD,OAAzB,CAAgDqB,CAAhD,CAAwDrB,CAAxD,CAAgEqB,CAAA,EAAhE,CAAyE,CACvEd,CAAA,CAAO0qD,CAAD,GAAgBK,CAAhB,CAAkCjqD,CAAlC,CAA0CiqD,CAAA,CAAejqD,CAAf,CAChDF,EAAA,CAAQ8pD,CAAA,CAAW1qD,CAAX,CACRqM,EAAA,CAAQ2+C,CAAA,CAAelqD,CAAf,CACJkqD,EAAA,CAAelqD,CAAf,CAAuB,CAAvB,CAAJ,GAA+B6pD,CAA/B,CAA0DK,CAAA3+C,CAAevL,CAAfuL,CAAuB,CAAvBA,CAwD3D3F,MAAA,CAxD2DskD,CAAA3+C,CAAevL,CAAfuL,CAAuB,CAAvBA,CAwD/C3F,MAAAjH,OAAZ,CAAiC,CAAjC,CAxDC,CAEA,IAAI4M,CAAAjD,MAAJ,CAAiB,CAGfuc,CAAA,CAAatZ,CAAAjD,MAEbwhD,EAAA,CAAWD,CACX,GACEC,EAAA,CAAWA,CAAAv/C,YADb,OAEQu/C,CAFR,EAEoBA,CAAA,aAFpB,CAIkBv+C,EAwCrB3F,MAAA,CAAY,CAAZ,CAxCG,EAA4BkkD,CAA5B,EAEEzmC,CAAA24B,KAAA,CAAc7xC,EAAA,CAAiBoB,CAAA3F,MAAjB,CAAd,CAA6C,IAA7C,CAAmDD,CAAA,CAAOkkD,CAAP,CAAnD,CAEFA,EAAA,CAA2Bt+C,CAwC9B3F,MAAA,CAxC8B2F,CAwClB3F,MAAAjH,OAAZ,CAAiC,CAAjC,CAtDkB,CAAjB,IAiBEkmB,EAAA,CAAa6F,CAAAvF,KAAA,EAGfN,EAAA,CAAWukC,CAAX,CAAA,CAA8BtpD,CAC1BupD,EAAJ,GAAmBxkC,CAAA,CAAWwkC,CAAX,CAAnB,CAA+CnqD,CAA/C,CACA2lB,EAAA4yB,OAAA,CAAoBz3C,CACpB6kB,EAAAwlC,OAAA,CAA+B,CAA/B,GAAqBrqD,CACrB6kB,EAAAylC,MAAA,CAAoBtqD,CAApB,GAA+BgqD,CAA/B,CAA6C,CAC7CnlC,EAAA0lC,QAAA,CAAqB,EAAE1lC,CAAAwlC,OAAF,EAAuBxlC,CAAAylC,MAAvB,CAErBzlC,EAAA2lC,KAAA,CAAkB,EAAE3lC,CAAA4lC,MAAF,CAAmC,CAAnC,IAAsBzqD,CAAtB,CAA4B,CAA5B,EAGbuL,EAAAjD,MAAL,EACE2+C,CAAA,CAAYpiC,CAAZ,CAAwB,QAAQ,CAACjf,CAAD,CAAQ,CACtCA,CAAA,CAAMA,CAAAjH,OAAA,EAAN,CAAA,CAAwBN,CAAAotB,cAAA,CAAuB,iBAAvB,CAA2C4F,CAA3C,CAAwD,GAAxD,CACxBhO,EAAAy4B,MAAA,CAAel2C,CAAf,CAAsB,IAAtB,CAA4BD,CAAA,CAAOkkD,CAAP,CAA5B,CACAA,EAAA,CAAejkD,CACf2F,EAAAjD,MAAA,CAAcuc,CAIdtZ,EAAA3F,MAAA;AAAcA,CACdmkD,EAAA,CAAax+C,CAAA64B,GAAb,CAAA,CAAyB74B,CATa,CAAxC,CArCqE,CAkDzEm+C,CAAA,CAAeK,CA7H+C,CAAhE,CAlDsD,CALrD,CAHiE,CAAlD,CAlzBxB,CA8oCIv8C,GAAkB,CAAC,UAAD,CAAa,QAAQ,CAAC6V,CAAD,CAAW,CACpD,MAAO,SAAQ,CAAC/a,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CACpCgG,CAAAnF,OAAA,CAAab,CAAAooD,OAAb,CAA0BC,QAA0B,CAAC7qD,CAAD,CAAO,CACzDujB,CAAA,CAAS/d,EAAA,CAAUxF,CAAV,CAAA,CAAmB,aAAnB,CAAmC,UAA5C,CAAA,CAAwD4F,CAAxD,CAAiE,SAAjE,CADyD,CAA3D,CADoC,CADc,CAAhC,CA9oCtB,CA8yCIuH,GAAkB,CAAC,UAAD,CAAa,QAAQ,CAACoW,CAAD,CAAW,CACpD,MAAO,SAAQ,CAAC/a,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CACpCgG,CAAAnF,OAAA,CAAab,CAAAsoD,OAAb,CAA0BC,QAA0B,CAAC/qD,CAAD,CAAO,CACzDujB,CAAA,CAAS/d,EAAA,CAAUxF,CAAV,CAAA,CAAmB,UAAnB,CAAgC,aAAzC,CAAA,CAAwD4F,CAAxD,CAAiE,SAAjE,CADyD,CAA3D,CADoC,CADc,CAAhC,CA9yCtB,CA81CI+H,GAAmBslC,EAAA,CAAY,QAAQ,CAACzqC,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CAChEgG,CAAAnF,OAAA,CAAab,CAAAwoD,QAAb,CAA2BC,QAA2B,CAACC,CAAD,CAAYC,CAAZ,CAAuB,CACvEA,CAAJ,EAAkBD,CAAlB,GAAgCC,CAAhC,EACElsD,CAAA,CAAQksD,CAAR,CAAmB,QAAQ,CAACnmD,CAAD,CAAMqnC,CAAN,CAAa,CAAEzmC,CAAAuzC,IAAA,CAAY9M,CAAZ,CAAmB,EAAnB,CAAF,CAAxC,CAEE6e,EAAJ,EAAetlD,CAAAuzC,IAAA,CAAY+R,CAAZ,CAJ4D,CAA7E,CAKG,CAAA,CALH,CADgE,CAA3C,CA91CvB,CAm+CIt9C,GAAoB,CAAC,UAAD,CAAa,QAAQ,CAAC2V,CAAD,CAAW,CACtD,MAAO,UACK,IADL,SAEI,UAFJ,YAKO,CAAC,QAAD,CAAW6nC,QAA2B,EAAG,CACpD,IAAAC,MAAA;AAAa,EADuC,CAAzC,CALP,MAQC3qC,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB4oD,CAAvB,CAA2C,CAAA,IAEnDE,CAFmD,CAGnDC,CAHmD,CAInDnE,CAJmD,CAKnDoE,EAAiB,EAErBhjD,EAAAnF,OAAA,CANgBb,CAAAipD,SAMhB,EANiCjpD,CAAAic,GAMjC,CAAwBitC,QAA4B,CAAC1rD,CAAD,CAAQ,CAAA,IACtDH,CADsD,CACnD0V,EAAKi2C,CAAA3sD,OACZ,IAAQ,CAAR,CAAG0W,CAAH,CAAW,CACT,GAAG6xC,CAAH,CAAqB,CACnB,IAAKvnD,CAAL,CAAS,CAAT,CAAYA,CAAZ,CAAgB0V,CAAhB,CAAoB1V,CAAA,EAApB,CACEunD,CAAA,CAAiBvnD,CAAjB,CAAAyhB,OAAA,EAEF8lC,EAAA,CAAmB,IAJA,CAOrBA,CAAA,CAAmB,EACnB,KAAKvnD,CAAL,CAAQ,CAAR,CAAWA,CAAX,CAAa0V,CAAb,CAAiB1V,CAAA,EAAjB,CAAsB,CACpB,IAAIg6C,EAAW0R,CAAA,CAAiB1rD,CAAjB,CACf2rD,EAAA,CAAe3rD,CAAf,CAAAwU,SAAA,EACA+yC,EAAA,CAAiBvnD,CAAjB,CAAA,CAAsBg6C,CACtBt2B,EAAA04B,MAAA,CAAepC,CAAf,CAAyB,QAAQ,EAAG,CAClCuN,CAAApkD,OAAA,CAAwBnD,CAAxB,CAA2B,CAA3B,CAC+B,EAA/B,GAAGunD,CAAAvoD,OAAH,GACEuoD,CADF,CACqB,IADrB,CAFkC,CAApC,CAJoB,CATb,CAsBXmE,CAAA,CAAmB,EACnBC,EAAA,CAAiB,EAEjB,IAAKF,CAAL,CAA2BF,CAAAC,MAAA,CAAyB,GAAzB,CAA+BrrD,CAA/B,CAA3B,EAAoEorD,CAAAC,MAAA,CAAyB,GAAzB,CAApE,CACE7iD,CAAA0/B,MAAA,CAAY1lC,CAAAmpD,OAAZ,CACA,CAAA1sD,CAAA,CAAQqsD,CAAR,CAA6B,QAAQ,CAACM,CAAD,CAAqB,CACxD,IAAIC,EAAgBrjD,CAAA6c,KAAA,EACpBmmC,EAAA9rD,KAAA,CAAoBmsD,CAApB,CACAD,EAAArmC,WAAA,CAA8BsmC,CAA9B,CAA6C,QAAQ,CAACC,CAAD,CAAc,CACjE,IAAIC,EAASH,CAAAhmD,QAEb2lD,EAAA7rD,KAAA,CAAsBosD,CAAtB,CACAvoC,EAAAy4B,MAAA,CAAe8P,CAAf,CAA4BC,CAAA3qD,OAAA,EAA5B,CAA6C2qD,CAA7C,CAJiE,CAAnE,CAHwD,CAA1D,CA7BwD,CAA5D,CAPuD,CARpD,CAD+C,CAAhC,CAn+CxB,CAgiDIl+C,GAAwBolC,EAAA,CAAY,YAC1B,SAD0B,UAE5B,GAF4B,SAG7B,WAH6B;KAIhCvyB,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiB6f,CAAjB,CAAwB4vB,CAAxB,CAA8B8R,CAA9B,CAA2C,CACvD9R,CAAAgW,MAAA,CAAW,GAAX,CAAiB5lC,CAAAumC,aAAjB,CAAA,CAAwC3W,CAAAgW,MAAA,CAAW,GAAX,CAAiB5lC,CAAAumC,aAAjB,CAAxC,EAAgF,EAChF3W,EAAAgW,MAAA,CAAW,GAAX,CAAiB5lC,CAAAumC,aAAjB,CAAAtsD,KAAA,CAA0C,YAAcynD,CAAd,SAAoCvhD,CAApC,CAA1C,CAFuD,CAJnB,CAAZ,CAhiD5B,CA0iDIkI,GAA2BmlC,EAAA,CAAY,YAC7B,SAD6B,UAE/B,GAF+B,SAGhC,WAHgC,MAInCvyB,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB6yC,CAAvB,CAA6B8R,CAA7B,CAA0C,CACtD9R,CAAAgW,MAAA,CAAW,GAAX,CAAA,CAAmBhW,CAAAgW,MAAA,CAAW,GAAX,CAAnB,EAAsC,EACtChW,EAAAgW,MAAA,CAAW,GAAX,CAAA3rD,KAAA,CAAqB,YAAcynD,CAAd,SAAoCvhD,CAApC,CAArB,CAFsD,CAJf,CAAZ,CA1iD/B,CA2mDIoI,GAAwBilC,EAAA,CAAY,MAChCvyB,QAAQ,CAACkK,CAAD,CAASpG,CAAT,CAAmBynC,CAAnB,CAA2BvpC,CAA3B,CAAuCykC,CAAvC,CAAoD,CAChE,GAAI,CAACA,CAAL,CACE,KAAM1oD,EAAA,CAAO,cAAP,CAAA,CAAuB,QAAvB,CAILkH,EAAA,CAAY6e,CAAZ,CAJK,CAAN,CAOF2iC,CAAA,CAAY,QAAQ,CAACrhD,CAAD,CAAQ,CAC1B0e,CAAAze,MAAA,EACAye,EAAAte,OAAA,CAAgBJ,CAAhB,CAF0B,CAA5B,CATgE,CAD5B,CAAZ,CA3mD5B,CA6pDIwG,GAAkB,CAAC,gBAAD,CAAmB,QAAQ,CAAC6W,CAAD,CAAiB,CAChE,MAAO,UACK,GADL,UAEK,CAAA,CAFL,SAGI1a,QAAQ,CAAC7C,CAAD;AAAUpD,CAAV,CAAgB,CACd,kBAAjB,EAAIA,CAAAkR,KAAJ,EAKEyP,CAAAhM,IAAA,CAJkB3U,CAAA8hC,GAIlB,CAFW1+B,CAAA,CAAQ,CAAR,CAAA0oB,KAEX,CAN6B,CAH5B,CADyD,CAA5C,CA7pDtB,CA6qDI49B,GAAkBztD,CAAA,CAAO,WAAP,CA7qDtB,CAmzDIsP,GAAqBtM,EAAA,CAAQ,UAAY,CAAA,CAAZ,CAAR,CAnzDzB,CAqzDI8K,GAAkB,CAAC,UAAD,CAAa,QAAb,CAAuB,QAAQ,CAAC87C,CAAD,CAAajlC,CAAb,CAAqB,CAAA,IAEpE+oC,EAAoB,wMAFgD,CAGpEC,EAAgB,eAAgB9qD,CAAhB,CAGpB,OAAO,UACK,GADL,SAEI,CAAC,QAAD,CAAW,UAAX,CAFJ,YAGO,CAAC,UAAD,CAAa,QAAb,CAAuB,QAAvB,CAAiC,QAAQ,CAACkjB,CAAD,CAAWoG,CAAX,CAAmBqhC,CAAnB,CAA2B,CAAA,IAC1EznD,EAAO,IADmE,CAE1E6nD,EAAa,EAF6D,CAG1EC,EAAcF,CAH4D,CAK1EG,CAGJ/nD,EAAAgoD,UAAA;AAAiBP,CAAA5G,QAGjB7gD,EAAAioD,KAAA,CAAYC,QAAQ,CAACC,CAAD,CAAeC,CAAf,CAA4BC,CAA5B,CAA4C,CAC9DP,CAAA,CAAcK,CAEdJ,EAAA,CAAgBM,CAH8C,CAOhEroD,EAAAsoD,UAAA,CAAiBC,QAAQ,CAAC/sD,CAAD,CAAQ,CAC/B+J,EAAA,CAAwB/J,CAAxB,CAA+B,gBAA/B,CACAqsD,EAAA,CAAWrsD,CAAX,CAAA,CAAoB,CAAA,CAEhBssD,EAAApW,WAAJ,EAA8Bl2C,CAA9B,GACEwkB,CAAAxf,IAAA,CAAahF,CAAb,CACA,CAAIusD,CAAAnrD,OAAA,EAAJ,EAA4BmrD,CAAAjrC,OAAA,EAF9B,CAJ+B,CAWjC9c,EAAAwoD,aAAA,CAAoBC,QAAQ,CAACjtD,CAAD,CAAQ,CAC9B,IAAAktD,UAAA,CAAeltD,CAAf,CAAJ,GACE,OAAOqsD,CAAA,CAAWrsD,CAAX,CACP,CAAIssD,CAAApW,WAAJ,EAA8Bl2C,CAA9B,EACE,IAAAmtD,oBAAA,CAAyBntD,CAAzB,CAHJ,CADkC,CAUpCwE,EAAA2oD,oBAAA,CAA2BC,QAAQ,CAACpoD,CAAD,CAAM,CACnCqoD,CAAAA,CAAa,IAAbA,CAAoBr2C,EAAA,CAAQhS,CAAR,CAApBqoD,CAAmC,IACvCd,EAAAvnD,IAAA,CAAkBqoD,CAAlB,CACA7oC,EAAAq2B,QAAA,CAAiB0R,CAAjB,CACA/nC,EAAAxf,IAAA,CAAaqoD,CAAb,CACAd,EAAAhqD,KAAA,CAAmB,UAAnB,CAA+B,CAAA,CAA/B,CALuC,CASzCiC,EAAA0oD,UAAA,CAAiBI,QAAQ,CAACttD,CAAD,CAAQ,CAC/B,MAAOqsD,EAAA/sD,eAAA,CAA0BU,CAA1B,CADwB,CAIjC4qB,EAAAyd,IAAA,CAAW,UAAX,CAAuB,QAAQ,EAAG,CAEhC7jC,CAAA2oD,oBAAA,CAA2B7rD,CAFK,CAAlC,CApD8E,CAApE,CAHP,MA6DCof,QAAQ,CAAClY,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuBsjD,CAAvB,CAA8B,CA0C1CyH,QAASA,EAAa,CAAC/kD,CAAD;AAAQglD,CAAR,CAAuBlB,CAAvB,CAAoCmB,CAApC,CAAgD,CACpEnB,CAAAhW,QAAA,CAAsBoX,QAAQ,EAAG,CAC/B,IAAItH,EAAYkG,CAAApW,WAEZuX,EAAAP,UAAA,CAAqB9G,CAArB,CAAJ,EACMmG,CAAAnrD,OAAA,EAEJ,EAF4BmrD,CAAAjrC,OAAA,EAE5B,CADAksC,CAAAxoD,IAAA,CAAkBohD,CAAlB,CACA,CAAkB,EAAlB,GAAIA,CAAJ,EAAsBuH,CAAAprD,KAAA,CAAiB,UAAjB,CAA6B,CAAA,CAA7B,CAHxB,EAKMb,CAAA,CAAY0kD,CAAZ,CAAJ,EAA8BuH,CAA9B,CACEH,CAAAxoD,IAAA,CAAkB,EAAlB,CADF,CAGEyoD,CAAAN,oBAAA,CAA+B/G,CAA/B,CAX2B,CAgBjCoH,EAAA/uC,GAAA,CAAiB,QAAjB,CAA2B,QAAQ,EAAG,CACpCjW,CAAAG,OAAA,CAAa,QAAQ,EAAG,CAClB4jD,CAAAnrD,OAAA,EAAJ,EAA4BmrD,CAAAjrC,OAAA,EAC5BgrC,EAAAnW,cAAA,CAA0BqX,CAAAxoD,IAAA,EAA1B,CAFsB,CAAxB,CADoC,CAAtC,CAjBoE,CAyBtE4oD,QAASA,EAAe,CAACplD,CAAD,CAAQglD,CAAR,CAAuBnY,CAAvB,CAA6B,CACnD,IAAIwY,CACJxY,EAAAiB,QAAA,CAAeC,QAAQ,EAAG,CACxB,IAAIuX,EAAQ,IAAI52C,EAAJ,CAAYm+B,CAAAa,WAAZ,CACZj3C,EAAA,CAAQuuD,CAAA/qD,KAAA,CAAmB,QAAnB,CAAR,CAAsC,QAAQ,CAAC81C,CAAD,CAAS,CACrDA,CAAAsB,SAAA,CAAkBl4C,CAAA,CAAUmsD,CAAAl1C,IAAA,CAAU2/B,CAAAv4C,MAAV,CAAV,CADmC,CAAvD,CAFwB,CAS1BwI,EAAAnF,OAAA,CAAa0qD,QAA4B,EAAG,CACrClqD,EAAA,CAAOgqD,CAAP,CAAiBxY,CAAAa,WAAjB,CAAL,GACE2X,CACA,CADW5qD,EAAA,CAAKoyC,CAAAa,WAAL,CACX,CAAAb,CAAAiB,QAAA,EAFF,CAD0C,CAA5C,CAOAkX,EAAA/uC,GAAA,CAAiB,QAAjB,CAA2B,QAAQ,EAAG,CACpCjW,CAAAG,OAAA,CAAa,QAAQ,EAAG,CACtB,IAAI7F;AAAQ,EACZ7D,EAAA,CAAQuuD,CAAA/qD,KAAA,CAAmB,QAAnB,CAAR,CAAsC,QAAQ,CAAC81C,CAAD,CAAS,CACjDA,CAAAsB,SAAJ,EACE/2C,CAAApD,KAAA,CAAW64C,CAAAv4C,MAAX,CAFmD,CAAvD,CAKAq1C,EAAAc,cAAA,CAAmBrzC,CAAnB,CAPsB,CAAxB,CADoC,CAAtC,CAlBmD,CA+BrDkrD,QAASA,EAAc,CAACxlD,CAAD,CAAQglD,CAAR,CAAuBnY,CAAvB,CAA6B,CA6GlD4Y,QAASA,EAAM,EAAG,CAAA,IAEZC,EAAe,CAAC,EAAD,CAAI,EAAJ,CAFH,CAGZC,EAAmB,CAAC,EAAD,CAHP,CAIZC,CAJY,CAKZC,CALY,CAMZ9V,CANY,CAOZ+V,CAPY,CAOIC,CAChBC,EAAAA,CAAanZ,CAAA4P,YACbj0B,EAAAA,CAASy9B,CAAA,CAASjmD,CAAT,CAATwoB,EAA4B,EAThB,KAUZvxB,EAAOivD,CAAA,CAAUlvD,EAAA,CAAWwxB,CAAX,CAAV,CAA+BA,CAV1B,CAYCnyB,CAZD,CAaZ8vD,CAbY,CAaAzuD,CACZsZ,EAAAA,CAAS,EAETo1C,EAAAA,CAAc,CAAA,CAhBF,KAiBZC,CAjBY,CAkBZjpD,CAGJ,IAAIg0C,CAAJ,CACE,GAAIkV,CAAJ,EAAe9vD,CAAA,CAAQwvD,CAAR,CAAf,CAEE,IADAI,CACSG,CADK,IAAI73C,EAAJ,CAAY,EAAZ,CACL63C,CAAAA,CAAAA,CAAa,CAAtB,CAAyBA,CAAzB,CAAsCP,CAAA3vD,OAAtC,CAAyDkwD,CAAA,EAAzD,CACEv1C,CAAA,CAAOw1C,CAAP,CACA,CADoBR,CAAA,CAAWO,CAAX,CACpB,CAAAH,CAAAz3C,IAAA,CAAgB23C,CAAA,CAAQtmD,CAAR,CAAegR,CAAf,CAAhB,CAAwCg1C,CAAA,CAAWO,CAAX,CAAxC,CAJJ,KAOEH,EAAA,CAAc,IAAI13C,EAAJ,CAAYs3C,CAAZ,CAKlB,KAAKtuD,CAAL,CAAa,CAAb,CAAgBrB,CAAA,CAASY,CAAAZ,OAAT,CAAsBqB,CAAtB,CAA8BrB,CAA9C,CAAsDqB,CAAA,EAAtD,CAA+D,CAE7Dd,CAAA,CAAMc,CACN,IAAIwuD,CAAJ,CAAa,CACXtvD,CAAA,CAAMK,CAAA,CAAKS,CAAL,CACN,IAAuB,GAAvB,GAAKd,CAAAwE,OAAA,CAAW,CAAX,CAAL,CAA6B,QAC7B4V,EAAA,CAAOk1C,CAAP,CAAA,CAAkBtvD,CAHP,CAMboa,CAAA,CAAOw1C,CAAP,CAAA,CAAoBh+B,CAAA,CAAO5xB,CAAP,CAEpBgvD,EAAA,CAAkBa,CAAA,CAAUzmD,CAAV,CAAiBgR,CAAjB,CAAlB,EAA8C,EAC9C,EAAM60C,CAAN,CAAoBH,CAAA,CAAaE,CAAb,CAApB,IACEC,CACA,CADcH,CAAA,CAAaE,CAAb,CACd,CAD8C,EAC9C,CAAAD,CAAAzuD,KAAA,CAAsB0uD,CAAtB,CAFF,CAIIxU,EAAJ,CACEC,CADF,CACal4C,CAAA,CACTitD,CAAAttC,OAAA,CAAmBwtC,CAAA,CAAUA,CAAA,CAAQtmD,CAAR,CAAegR,CAAf,CAAV,CAAmC/X,CAAA,CAAQ+G,CAAR,CAAegR,CAAf,CAAtD,CADS,CADb,EAKMs1C,CAAJ,EACMI,CAEJ,CAFgB,EAEhB,CADAA,CAAA,CAAUF,CAAV,CACA,CADuBR,CACvB,CAAA3U,CAAA;AAAWiV,CAAA,CAAQtmD,CAAR,CAAe0mD,CAAf,CAAX,GAAyCJ,CAAA,CAAQtmD,CAAR,CAAegR,CAAf,CAH3C,EAKEqgC,CALF,CAKa2U,CALb,GAK4B/sD,CAAA,CAAQ+G,CAAR,CAAegR,CAAf,CAE5B,CAAAo1C,CAAA,CAAcA,CAAd,EAA6B/U,CAZ/B,CAcAsV,EAAA,CAAQC,CAAA,CAAU5mD,CAAV,CAAiBgR,CAAjB,CAGR21C,EAAA,CAAQxtD,CAAA,CAAUwtD,CAAV,CAAA,CAAmBA,CAAnB,CAA2B,EACnCd,EAAA3uD,KAAA,CAAiB,IAEXovD,CAAA,CAAUA,CAAA,CAAQtmD,CAAR,CAAegR,CAAf,CAAV,CAAoCk1C,CAAA,CAAUjvD,CAAA,CAAKS,CAAL,CAAV,CAAwBA,CAFjD,OAGRivD,CAHQ,UAILtV,CAJK,CAAjB,CAlC6D,CAyC1DD,CAAL,GACMyV,CAAJ,EAAiC,IAAjC,GAAkBb,CAAlB,CAEEN,CAAA,CAAa,EAAb,CAAAztD,QAAA,CAAyB,IAAI,EAAJ,OAAc,EAAd,UAA2B,CAACmuD,CAA5B,CAAzB,CAFF,CAGYA,CAHZ,EAKEV,CAAA,CAAa,EAAb,CAAAztD,QAAA,CAAyB,IAAI,GAAJ,OAAe,EAAf,UAA4B,CAAA,CAA5B,CAAzB,CANJ,CAWKkuD,EAAA,CAAa,CAAlB,KAAqBW,CAArB,CAAmCnB,CAAAtvD,OAAnC,CACK8vD,CADL,CACkBW,CADlB,CAEKX,CAAA,EAFL,CAEmB,CAEjBP,CAAA,CAAkBD,CAAA,CAAiBQ,CAAjB,CAGlBN,EAAA,CAAcH,CAAA,CAAaE,CAAb,CAEVmB,EAAA1wD,OAAJ,EAAgC8vD,CAAhC,EAEEL,CAMA,CANiB,SACNkB,CAAA1pD,MAAA,EAAAtD,KAAA,CAA8B,OAA9B,CAAuC4rD,CAAvC,CADM,OAERC,CAAAc,MAFQ,CAMjB,CAFAZ,CAEA,CAFkB,CAACD,CAAD,CAElB,CADAiB,CAAA7vD,KAAA,CAAuB6uD,CAAvB,CACA,CAAAf,CAAAtnD,OAAA,CAAqBooD,CAAA1oD,QAArB,CARF,GAUE2oD,CAIA,CAJkBgB,CAAA,CAAkBZ,CAAlB,CAIlB,CAHAL,CAGA,CAHiBC,CAAA,CAAgB,CAAhB,CAGjB,CAAID,CAAAa,MAAJ,EAA4Bf,CAA5B,EACEE,CAAA1oD,QAAApD,KAAA,CAA4B,OAA5B,CAAqC8rD,CAAAa,MAArC,CAA4Df,CAA5D,CAfJ,CAmBAS,EAAA,CAAc,IACV3uD,EAAA,CAAQ,CAAZ,KAAerB,CAAf,CAAwBwvD,CAAAxvD,OAAxB,CAA4CqB,CAA5C,CAAoDrB,CAApD,CAA4DqB,CAAA,EAA5D,CACEq4C,CACA,CADS8V,CAAA,CAAYnuD,CAAZ,CACT,CAAA,CAAKuvD,CAAL,CAAsBlB,CAAA,CAAgBruD,CAAhB,CAAsB,CAAtB,CAAtB,GAEE2uD,CAQA,CARcY,CAAA7pD,QAQd,CAPI6pD,CAAAN,MAOJ,GAP6B5W,CAAA4W,MAO7B;AANEN,CAAAvgC,KAAA,CAAiBmhC,CAAAN,MAAjB,CAAwC5W,CAAA4W,MAAxC,CAMF,CAJIM,CAAAnrB,GAIJ,GAJ0BiU,CAAAjU,GAI1B,EAHEuqB,CAAA7pD,IAAA,CAAgByqD,CAAAnrB,GAAhB,CAAoCiU,CAAAjU,GAApC,CAGF,CAAImrB,CAAA5V,SAAJ,GAAgCtB,CAAAsB,SAAhC,EACEgV,CAAAtsD,KAAA,CAAiB,UAAjB,CAA8BktD,CAAA5V,SAA9B,CAAwDtB,CAAAsB,SAAxD,CAXJ,GAiBoB,EAAlB,GAAItB,CAAAjU,GAAJ,EAAwB+qB,CAAxB,CAEEzpD,CAFF,CAEYypD,CAFZ,CAOGrqD,CAAAY,CAAAZ,CAAU0qD,CAAA5pD,MAAA,EAAVd,KAAA,CACQuzC,CAAAjU,GADR,CAAA9hC,KAAA,CAES,UAFT,CAEqB+1C,CAAAsB,SAFrB,CAAAvrB,KAAA,CAGSiqB,CAAA4W,MAHT,CAiBH,CAXAZ,CAAA7uD,KAAA,CAAsC,SACzBkG,CADyB,OAE3B2yC,CAAA4W,MAF2B,IAG9B5W,CAAAjU,GAH8B,UAIxBiU,CAAAsB,SAJwB,CAAtC,CAWA,CALIgV,CAAJ,CACEA,CAAA9T,MAAA,CAAkBn1C,CAAlB,CADF,CAGE0oD,CAAA1oD,QAAAM,OAAA,CAA8BN,CAA9B,CAEF,CAAAipD,CAAA,CAAcjpD,CAzChB,CA8CF,KADA1F,CAAA,EACA,CAAMquD,CAAA1vD,OAAN,CAA+BqB,CAA/B,CAAA,CACEquD,CAAAlyC,IAAA,EAAAzW,QAAA0b,OAAA,EA5Ee,CAgFnB,IAAA,CAAMiuC,CAAA1wD,OAAN,CAAiC8vD,CAAjC,CAAA,CACEY,CAAAlzC,IAAA,EAAA,CAAwB,CAAxB,CAAAzW,QAAA0b,OAAA,EAzKc,CA5GlB,IAAIjb,CAEJ,IAAI,EAAEA,CAAF,CAAUspD,CAAAtpD,MAAA,CAAiB8lD,CAAjB,CAAV,CAAJ,CACE,KAAMD,GAAA,CAAgB,MAAhB,CAIJyD,CAJI,CAIQhqD,EAAA,CAAY6nD,CAAZ,CAJR,CAAN,CAJgD,IAW9C4B,EAAYhsC,CAAA,CAAO/c,CAAA,CAAM,CAAN,CAAP,EAAmBA,CAAA,CAAM,CAAN,CAAnB,CAXkC,CAY9C2oD,EAAY3oD,CAAA,CAAM,CAAN,CAAZ2oD,EAAwB3oD,CAAA,CAAM,CAAN,CAZsB,CAa9CqoD,EAAUroD,CAAA,CAAM,CAAN,CAboC,CAc9C4oD,EAAY7rC,CAAA,CAAO/c,CAAA,CAAM,CAAN,CAAP,EAAmB,EAAnB,CAdkC,CAe9C5E;AAAU2hB,CAAA,CAAO/c,CAAA,CAAM,CAAN,CAAA,CAAWA,CAAA,CAAM,CAAN,CAAX,CAAsB2oD,CAA7B,CAfoC,CAgB9CP,EAAWrrC,CAAA,CAAO/c,CAAA,CAAM,CAAN,CAAP,CAhBmC,CAkB9CyoD,EADQzoD,CAAAupD,CAAM,CAANA,CACE,CAAQxsC,CAAA,CAAO/c,CAAA,CAAM,CAAN,CAAP,CAAR,CAA2B,IAlBS,CAuB9CkpD,EAAoB,CAAC,CAAC,SAAU/B,CAAV,OAA+B,EAA/B,CAAD,CAAD,CAEpB6B,EAAJ,GAEEhH,CAAA,CAASgH,CAAT,CAAA,CAAqB7mD,CAArB,CAQA,CAJA6mD,CAAAp/B,YAAA,CAAuB,UAAvB,CAIA,CAAAo/B,CAAA/tC,OAAA,EAVF,CAcAksC,EAAAznD,MAAA,EAEAynD,EAAA/uC,GAAA,CAAiB,QAAjB,CAA2B,QAAQ,EAAG,CACpCjW,CAAAG,OAAA,CAAa,QAAQ,EAAG,CAAA,IAClB0lD,CADkB,CAElBvE,EAAa2E,CAAA,CAASjmD,CAAT,CAAbshD,EAAgC,EAFd,CAGlBtwC,EAAS,EAHS,CAIlBpa,CAJkB,CAIbY,CAJa,CAISE,CAJT,CAIgByuD,CAJhB,CAI4B9vD,CAJ5B,CAIoCywD,CAJpC,CAIiDP,CAEvE,IAAInV,CAAJ,CAEE,IADA55C,CACqB,CADb,EACa,CAAhB2uD,CAAgB,CAAH,CAAG,CAAAW,CAAA,CAAcC,CAAA1wD,OAAnC,CACK8vD,CADL,CACkBW,CADlB,CAEKX,CAAA,EAFL,CAME,IAFAN,CAEe,CAFDkB,CAAA,CAAkBZ,CAAlB,CAEC,CAAXzuD,CAAW,CAAH,CAAG,CAAArB,CAAA,CAASwvD,CAAAxvD,OAAxB,CAA4CqB,CAA5C,CAAoDrB,CAApD,CAA4DqB,CAAA,EAA5D,CACE,IAAI,CAAC2vD,CAAD,CAAiBxB,CAAA,CAAYnuD,CAAZ,CAAA0F,QAAjB,EAA6C,CAA7C,CAAAi0C,SAAJ,CAA8D,CAC5Dz6C,CAAA,CAAMywD,CAAA7qD,IAAA,EACF0pD,EAAJ,GAAal1C,CAAA,CAAOk1C,CAAP,CAAb,CAA+BtvD,CAA/B,CACA,IAAI0vD,CAAJ,CACE,IAAKC,CAAL,CAAkB,CAAlB,CAAqBA,CAArB,CAAkCjF,CAAAjrD,OAAlC,GACE2a,CAAA,CAAOw1C,CAAP,CACI,CADgBlF,CAAA,CAAWiF,CAAX,CAChB,CAAAD,CAAA,CAAQtmD,CAAR,CAAegR,CAAf,CAAA,EAA0Bpa,CAFhC,EAAqD2vD,CAAA,EAArD,EADF,IAMEv1C,EAAA,CAAOw1C,CAAP,CAAA,CAAoBlF,CAAA,CAAW1qD,CAAX,CAEtBY,EAAAN,KAAA,CAAW+B,CAAA,CAAQ+G,CAAR,CAAegR,CAAf,CAAX,CAX4D,CAA9D,CATN,IAwBO,CACLpa,CAAA,CAAMouD,CAAAxoD,IAAA,EACN,IAAW,GAAX,EAAI5F,CAAJ,CACEY,CAAA,CAAQxB,CADV,KAEO,IAAY,EAAZ,GAAIY,CAAJ,CACLY,CAAA,CAAQ,IADH,KAGL,IAAI8uD,CAAJ,CACE,IAAKC,CAAL,CAAkB,CAAlB,CAAqBA,CAArB,CAAkCjF,CAAAjrD,OAAlC,CAAqDkwD,CAAA,EAArD,CAEE,IADAv1C,CAAA,CAAOw1C,CAAP,CACI;AADgBlF,CAAA,CAAWiF,CAAX,CAChB,CAAAD,CAAA,CAAQtmD,CAAR,CAAegR,CAAf,CAAA,EAA0Bpa,CAA9B,CAAmC,CACjCY,CAAA,CAAQyB,CAAA,CAAQ+G,CAAR,CAAegR,CAAf,CACR,MAFiC,CAAnC,CAHJ,IASEA,EAAA,CAAOw1C,CAAP,CAEA,CAFoBlF,CAAA,CAAW1qD,CAAX,CAEpB,CADIsvD,CACJ,GADal1C,CAAA,CAAOk1C,CAAP,CACb,CAD+BtvD,CAC/B,EAAAY,CAAA,CAAQyB,CAAA,CAAQ+G,CAAR,CAAegR,CAAf,CAIsB,EAAlC,CAAI+1C,CAAA,CAAkB,CAAlB,CAAA1wD,OAAJ,EACM0wD,CAAA,CAAkB,CAAlB,CAAA,CAAqB,CAArB,CAAAjrB,GADN,GACqCllC,CADrC,GAEImwD,CAAA,CAAkB,CAAlB,CAAA,CAAqB,CAArB,CAAA1V,SAFJ,CAEuC,CAAA,CAFvC,CAtBK,CA4BPxE,CAAAc,cAAA,CAAmBn2C,CAAnB,CA1DsB,CAAxB,CADoC,CAAtC,CA+DAq1C,EAAAiB,QAAA,CAAe2X,CAGfzlD,EAAAnF,OAAA,CAAa4qD,CAAb,CA3GkD,CAhGpD,GAAKnI,CAAA,CAAM,CAAN,CAAL,CAAA,CAF0C,IAItC2H,EAAa3H,CAAA,CAAM,CAAN,CACbwG,EAAAA,CAAcxG,CAAA,CAAM,CAAN,CALwB,KAMtClM,EAAWp3C,CAAAo3C,SAN2B,CAOtC+V,EAAantD,CAAAstD,UAPyB,CAQtCT,EAAa,CAAA,CARyB,CAStC1B,CATsC,CAYtC+B,EAAiB7pD,CAAA,CAAOtH,CAAA8T,cAAA,CAAuB,QAAvB,CAAP,CAZqB,CAatCm9C,EAAkB3pD,CAAA,CAAOtH,CAAA8T,cAAA,CAAuB,UAAvB,CAAP,CAboB,CActCk6C,EAAgBmD,CAAA5pD,MAAA,EAGZjG,EAAAA,CAAI,CAAZ,KAjB0C,IAiB3BuR,EAAWxL,CAAAwL,SAAA,EAjBgB,CAiBImE,EAAKnE,CAAAvS,OAAnD,CAAoEgB,CAApE,CAAwE0V,CAAxE,CAA4E1V,CAAA,EAA5E,CACE,GAA0B,EAA1B,GAAIuR,CAAA,CAASvR,CAAT,CAAAG,MAAJ,CAA8B,CAC5B2tD,CAAA,CAAc0B,CAAd,CAA2Bj+C,CAAAmT,GAAA,CAAY1kB,CAAZ,CAC3B,MAF4B,CAMhC4tD,CAAAhB,KAAA,CAAgBH,CAAhB,CAA6B+C,CAA7B,CAAyC9C,CAAzC,CAGI3S,EAAJ,GACE0S,CAAA9V,SADF,CACyBuZ,QAAQ,CAAC/vD,CAAD,CAAQ,CACrC,MAAO,CAACA,CAAR,EAAkC,CAAlC,GAAiBA,CAAAnB,OADoB,CADzC,CAMI8wD,EAAJ,CAAgB3B,CAAA,CAAexlD,CAAf,CAAsB5C,CAAtB,CAA+B0mD,CAA/B,CAAhB,CACS1S,CAAJ,CAAcgU,CAAA,CAAgBplD,CAAhB,CAAuB5C,CAAvB,CAAgC0mD,CAAhC,CAAd,CACAiB,CAAA,CAAc/kD,CAAd,CAAqB5C,CAArB,CAA8B0mD,CAA9B,CAA2CmB,CAA3C,CAjCL,CAF0C,CA7DvC,CANiE,CAApD,CArzDtB,CAwvEIhhD,GAAkB,CAAC,cAAD;AAAiB,QAAQ,CAACwW,CAAD,CAAe,CAC5D,IAAI+sC,EAAiB,WACR1uD,CADQ,cAELA,CAFK,CAKrB,OAAO,UACK,GADL,UAEK,GAFL,SAGImH,QAAQ,CAAC7C,CAAD,CAAUpD,CAAV,CAAgB,CAC/B,GAAId,CAAA,CAAYc,CAAAxC,MAAZ,CAAJ,CAA6B,CAC3B,IAAIuuB,EAAgBtL,CAAA,CAAard,CAAA0oB,KAAA,EAAb,CAA6B,CAAA,CAA7B,CACfC,EAAL,EACE/rB,CAAAqqB,KAAA,CAAU,OAAV,CAAmBjnB,CAAA0oB,KAAA,EAAnB,CAHyB,CAO7B,MAAO,SAAS,CAAC9lB,CAAD,CAAQ5C,CAAR,CAAiBpD,CAAjB,CAAuB,CAAA,IAEjCpB,EAASwE,CAAAxE,OAAA,EAFwB,CAGjCqsD,EAAarsD,CAAAwH,KAAA,CAFIqnD,mBAEJ,CAAbxC,EACErsD,CAAAA,OAAA,EAAAwH,KAAA,CAHeqnD,mBAGf,CAEFxC,EAAJ,EAAkBA,CAAAjB,UAAlB,CAGE5mD,CAAArD,KAAA,CAAa,UAAb,CAAyB,CAAA,CAAzB,CAHF,CAKEkrD,CALF,CAKeuC,CAGXzhC,EAAJ,CACE/lB,CAAAnF,OAAA,CAAakrB,CAAb,CAA4B2hC,QAA+B,CAACzpB,CAAD,CAASC,CAAT,CAAiB,CAC1ElkC,CAAAqqB,KAAA,CAAU,OAAV,CAAmB4Z,CAAnB,CACIA,EAAJ,GAAeC,CAAf,EAAuB+mB,CAAAT,aAAA,CAAwBtmB,CAAxB,CACvB+mB,EAAAX,UAAA,CAAqBrmB,CAArB,CAH0E,CAA5E,CADF,CAOEgnB,CAAAX,UAAA,CAAqBtqD,CAAAxC,MAArB,CAGF4F,EAAA6Y,GAAA,CAAW,UAAX,CAAuB,QAAQ,EAAG,CAChCgvC,CAAAT,aAAA,CAAwBxqD,CAAAxC,MAAxB,CADgC,CAAlC,CAxBqC,CARR,CAH5B,CANqD,CAAxC,CAxvEtB,CAyyEIwM,GAAiB/K,EAAA,CAAQ,UACjB,GADiB;SAEjB,CAAA,CAFiB,CAAR,CAKfnD,EAAAyK,QAAA1B,UAAJ,CAEEq4B,OAAAE,IAAA,CAAY,gDAAZ,CAFF,EA5jnBA,CAFApuB,EAEA,CAFSlT,CAAAkT,OAET,GACE3L,CAYA,CAZS2L,EAYT,CAXA3Q,CAAA,CAAO2Q,EAAA/M,GAAP,CAAkB,OACT6f,EAAA9b,MADS,cAEF8b,EAAA4E,aAFE,YAGJ5E,EAAA5B,WAHI,UAIN4B,EAAAnc,SAJM,eAKDmc,EAAAkhC,cALC,CAAlB,CAWA,CAFAh1C,EAAA,CAAwB,QAAxB,CAAkC,CAAA,CAAlC,CAAwC,CAAA,CAAxC,CAA8C,CAAA,CAA9C,CAEA,CADAA,EAAA,CAAwB,OAAxB,CAAiC,CAAA,CAAjC,CAAwC,CAAA,CAAxC,CAA+C,CAAA,CAA/C,CACA,CAAAA,EAAA,CAAwB,MAAxB,CAAgC,CAAA,CAAhC,CAAuC,CAAA,CAAvC,CAA8C,CAAA,CAA9C,CAbF,EAeE3K,CAfF,CAeW8L,CAyjnBX,CAvjnBA5I,EAAAnD,QAujnBA,CAvjnBkBC,CAujnBlB,CAFA6F,EAAA,CAAmB3C,EAAnB,CAEA,CAAAlD,CAAA,CAAOtH,CAAP,CAAAw6C,MAAA,CAAuB,QAAQ,EAAG,CAChC3xC,EAAA,CAAY7I,CAAZ,CAAsB8I,EAAtB,CADgC,CAAlC,CAZA,CAh8pBqC,CAAtC,CAAA,CAg9pBE/I,MAh9pBF,CAg9pBUC,QAh9pBV,CAk9pBD,EAACwK,OAAAonD,MAAA,EAAD,EAAoBpnD,OAAAnD,QAAA,CAAgBrH,QAAhB,CAAAkE,KAAA,CAA+B,MAA/B,CAAAo4C,QAAA,CAA+C,uRAA/C;", -"sources":["angular.js"], -"names":["window","document","undefined","minErr","isArrayLike","obj","isWindow","length","nodeType","isString","isArray","forEach","iterator","context","key","isFunction","hasOwnProperty","call","sortedKeys","keys","push","sort","forEachSorted","i","reverseParams","iteratorFn","value","nextUid","index","uid","digit","charCodeAt","join","String","fromCharCode","unshift","setHashKey","h","$$hashKey","extend","dst","arguments","int","str","parseInt","inherit","parent","extra","noop","identity","$","valueFn","isUndefined","isDefined","isObject","isNumber","isDate","toString","isRegExp","location","alert","setInterval","isElement","node","nodeName","prop","attr","find","map","results","list","indexOf","array","arrayRemove","splice","copy","source","destination","$evalAsync","$watch","ngMinErr","Date","getTime","RegExp","shallowCopy","src","charAt","equals","o1","o2","t1","t2","keySet","csp","securityPolicy","isActive","querySelector","bind","self","fn","curryArgs","slice","startIndex","apply","concat","toJsonReplacer","val","toJson","pretty","JSON","stringify","fromJson","json","parse","toBoolean","v","lowercase","startingTag","element","jqLite","clone","empty","e","elemHtml","append","html","TEXT_NODE","match","replace","tryDecodeURIComponent","decodeURIComponent","parseKeyValue","keyValue","key_value","split","toKeyValue","parts","arrayValue","encodeUriQuery","encodeUriSegment","pctEncodeSpaces","encodeURIComponent","angularInit","bootstrap","elements","appElement","module","names","NG_APP_CLASS_REGEXP","name","getElementById","querySelectorAll","exec","className","attributes","modules","doBootstrap","injector","tag","$provide","createInjector","invoke","scope","compile","animate","$apply","data","NG_DEFER_BOOTSTRAP","test","angular","resumeBootstrap","angular.resumeBootstrap","extraModules","snake_case","separator","SNAKE_CASE_REGEXP","letter","pos","toLowerCase","assertArg","arg","reason","assertArgFn","acceptArrayAnnotation","constructor","assertNotHasOwnProperty","getter","path","bindFnToScope","lastInstance","len","getBlockElements","nodes","startNode","endNode","nextSibling","setupModuleLoader","$injectorMinErr","$$minErr","factory","requires","configFn","invokeLater","provider","method","insertMethod","invokeQueue","moduleInstance","runBlocks","config","run","block","publishExternalAPI","version","uppercase","angularModule","$LocaleProvider","ngModule","$$SanitizeUriProvider","$CompileProvider","directive","htmlAnchorDirective","inputDirective","formDirective","scriptDirective","selectDirective","styleDirective","optionDirective","ngBindDirective","ngBindHtmlDirective","ngBindTemplateDirective","ngClassDirective","ngClassEvenDirective","ngClassOddDirective","ngCloakDirective","ngControllerDirective","ngFormDirective","ngHideDirective","ngIfDirective","ngIncludeDirective","ngInitDirective","ngNonBindableDirective","ngPluralizeDirective","ngRepeatDirective","ngShowDirective","ngStyleDirective","ngSwitchDirective","ngSwitchWhenDirective","ngSwitchDefaultDirective","ngOptionsDirective","ngTranscludeDirective","ngModelDirective","ngListDirective","ngChangeDirective","requiredDirective","ngValueDirective","ngIncludeFillContentDirective","ngAttributeAliasDirectives","ngEventDirectives","$AnchorScrollProvider","$AnimateProvider","$BrowserProvider","$CacheFactoryProvider","$ControllerProvider","$DocumentProvider","$ExceptionHandlerProvider","$FilterProvider","$InterpolateProvider","$IntervalProvider","$HttpProvider","$HttpBackendProvider","$LocationProvider","$LogProvider","$ParseProvider","$RootScopeProvider","$QProvider","$SceProvider","$SceDelegateProvider","$SnifferProvider","$TemplateCacheProvider","$TimeoutProvider","$WindowProvider","$$RAFProvider","$$AsyncCallbackProvider","camelCase","SPECIAL_CHARS_REGEXP","_","offset","toUpperCase","MOZ_HACK_REGEXP","jqLitePatchJQueryRemove","dispatchThis","filterElems","getterIfNoArguments","removePatch","param","filter","fireEvent","set","setIndex","setLength","childIndex","children","shift","triggerHandler","childLength","jQuery","originalJqFn","$original","JQLite","trim","jqLiteMinErr","parsed","SINGLE_TAG_REGEXP","fragment","createDocumentFragment","HTML_REGEXP","tmp","appendChild","createElement","TAG_NAME_REGEXP","wrap","wrapMap","_default","innerHTML","XHTML_TAG_REGEXP","removeChild","firstChild","lastChild","j","jj","childNodes","textContent","createTextNode","jqLiteAddNodes","jqLiteClone","cloneNode","jqLiteDealoc","jqLiteRemoveData","jqLiteOff","type","unsupported","events","jqLiteExpandoStore","handle","eventHandler","removeEventListenerFn","expandoId","jqName","expandoStore","jqCache","$destroy","jqId","jqLiteData","isSetter","keyDefined","isSimpleGetter","jqLiteHasClass","selector","getAttribute","jqLiteRemoveClass","cssClasses","setAttribute","cssClass","jqLiteAddClass","existingClasses","root","jqLiteController","jqLiteInheritedData","ii","parentNode","host","jqLiteEmpty","getBooleanAttrName","booleanAttr","BOOLEAN_ATTR","BOOLEAN_ELEMENTS","createEventHandler","event","preventDefault","event.preventDefault","returnValue","stopPropagation","event.stopPropagation","cancelBubble","target","srcElement","defaultPrevented","prevent","isDefaultPrevented","event.isDefaultPrevented","eventHandlersCopy","msie","elem","hashKey","objType","HashMap","put","annotate","$inject","fnText","STRIP_COMMENTS","argDecl","FN_ARGS","FN_ARG_SPLIT","FN_ARG","all","underscore","last","modulesToLoad","supportObject","delegate","provider_","providerInjector","instantiate","$get","providerCache","providerSuffix","factoryFn","loadModules","moduleFn","loadedModules","get","_runBlocks","_invokeQueue","invokeArgs","message","stack","createInternalInjector","cache","getService","serviceName","INSTANTIATING","err","locals","args","Type","Constructor","returnedValue","prototype","instance","has","service","$injector","constant","instanceCache","decorator","decorFn","origProvider","orig$get","origProvider.$get","origInstance","instanceInjector","servicename","autoScrollingEnabled","disableAutoScrolling","this.disableAutoScrolling","$window","$location","$rootScope","getFirstAnchor","result","scroll","hash","elm","scrollIntoView","getElementsByName","scrollTo","autoScrollWatch","autoScrollWatchAction","$$rAF","$timeout","supported","Browser","$log","$sniffer","completeOutstandingRequest","outstandingRequestCount","outstandingRequestCallbacks","pop","error","startPoller","interval","setTimeout","check","pollFns","pollFn","pollTimeout","fireUrlChange","newLocation","lastBrowserUrl","url","urlChangeListeners","listener","rawDocument","history","clearTimeout","pendingDeferIds","isMock","$$completeOutstandingRequest","$$incOutstandingRequestCount","self.$$incOutstandingRequestCount","notifyWhenNoOutstandingRequests","self.notifyWhenNoOutstandingRequests","callback","addPollFn","self.addPollFn","href","baseElement","self.url","replaceState","pushState","urlChangeInit","onUrlChange","self.onUrlChange","on","hashchange","baseHref","self.baseHref","lastCookies","lastCookieString","cookiePath","cookies","self.cookies","cookieLength","cookie","escape","warn","cookieArray","unescape","substring","defer","self.defer","delay","timeoutId","cancel","self.defer.cancel","deferId","$document","this.$get","cacheFactory","cacheId","options","refresh","entry","freshEnd","staleEnd","n","link","p","nextEntry","prevEntry","caches","size","stats","capacity","Number","MAX_VALUE","lruHash","lruEntry","remove","removeAll","destroy","info","cacheFactory.info","cacheFactory.get","$cacheFactory","$$sanitizeUriProvider","hasDirectives","Suffix","COMMENT_DIRECTIVE_REGEXP","CLASS_DIRECTIVE_REGEXP","EVENT_HANDLER_ATTR_REGEXP","this.directive","registerDirective","directiveFactory","$exceptionHandler","directives","priority","require","controller","restrict","aHrefSanitizationWhitelist","this.aHrefSanitizationWhitelist","regexp","imgSrcSanitizationWhitelist","this.imgSrcSanitizationWhitelist","$interpolate","$http","$templateCache","$parse","$controller","$sce","$animate","$$sanitizeUri","$compileNodes","transcludeFn","maxPriority","ignoreDirective","previousCompileContext","nodeValue","compositeLinkFn","compileNodes","safeAddClass","publicLinkFn","cloneConnectFn","transcludeControllers","$linkNode","JQLitePrototype","eq","$element","addClass","nodeList","$rootElement","boundTranscludeFn","childLinkFn","$node","childScope","nodeListLength","stableNodeList","Array","linkFns","nodeLinkFn","$new","childTranscludeFn","transclude","createBoundTranscludeFn","attrs","linkFnFound","Attributes","collectDirectives","applyDirectivesToNode","terminal","transcludedScope","cloneFn","controllers","scopeCreated","$$transcluded","attrsMap","$attr","addDirective","directiveNormalize","nodeName_","nName","nAttrs","attrStartName","attrEndName","specified","ngAttrName","NG_ATTR_BINDING","substr","directiveNName","addAttrInterpolateDirective","addTextInterpolateDirective","byPriority","groupScan","attrStart","attrEnd","depth","hasAttribute","$compileMinErr","groupElementsLinkFnWrapper","linkFn","compileNode","templateAttrs","jqCollection","originalReplaceDirective","preLinkFns","postLinkFns","addLinkFns","pre","post","newIsolateScopeDirective","$$isolateScope","cloneAndAnnotateFn","getControllers","elementControllers","retrievalMethod","optional","directiveName","linkNode","controllersBoundTransclude","cloneAttachFn","hasElementTranscludeDirective","isolateScope","$$element","LOCAL_REGEXP","templateDirective","$$originalDirective","definition","scopeName","attrName","mode","lastValue","parentGet","parentSet","compare","$$isolateBindings","$observe","$$observers","$$scope","literal","a","b","assign","parentValueWatch","parentValue","controllerDirectives","controllerInstance","controllerAs","$scope","scopeToChild","template","templateUrl","terminalPriority","newScopeDirective","nonTlbTranscludeDirective","hasTranscludeDirective","$compileNode","$template","$$start","$$end","directiveValue","assertNoDuplicate","$$tlb","createComment","replaceWith","replaceDirective","contents","denormalizeTemplate","newTemplateAttrs","templateDirectives","unprocessedDirectives","markDirectivesAsIsolate","mergeTemplateAttributes","compileTemplateUrl","Math","max","tDirectives","startAttrName","endAttrName","srcAttr","dstAttr","$set","tAttrs","linkQueue","afterTemplateNodeLinkFn","afterTemplateChildLinkFn","beforeTemplateCompileNode","origAsyncDirective","derivedSyncDirective","getTrustedResourceUrl","success","content","childBoundTranscludeFn","tempTemplateAttrs","beforeTemplateLinkNode","linkRootElement","oldClasses","response","code","headers","delayedNodeLinkFn","ignoreChildLinkFn","rootElement","diff","what","previousDirective","text","interpolateFn","textInterpolateLinkFn","bindings","interpolateFnWatchAction","getTrustedContext","attrNormalizedName","HTML","RESOURCE_URL","attrInterpolatePreLinkFn","$$inter","newValue","oldValue","$updateClass","elementsToRemove","newNode","firstElementToRemove","removeCount","j2","replaceChild","expando","k","kk","annotation","$addClass","classVal","$removeClass","removeClass","newClasses","toAdd","tokenDifference","toRemove","setClass","writeAttr","booleanKey","removeAttr","listeners","startSymbol","endSymbol","PREFIX_REGEXP","str1","str2","values","tokens1","tokens2","token","CNTRL_REG","register","this.register","expression","identifier","exception","cause","parseHeaders","line","headersGetter","headersObj","transformData","fns","JSON_START","JSON_END","PROTECTION_PREFIX","CONTENT_TYPE_APPLICATION_JSON","defaults","d","interceptorFactories","interceptors","responseInterceptorFactories","responseInterceptors","$httpBackend","$browser","$q","requestConfig","transformResponse","resp","status","reject","transformRequest","mergeHeaders","execHeaders","headerContent","headerFn","header","defHeaders","reqHeaders","defHeaderName","reqHeaderName","common","lowercaseDefHeaderName","xsrfValue","urlIsSameOrigin","xsrfCookieName","xsrfHeaderName","chain","serverRequest","reqData","withCredentials","sendReq","then","promise","when","reversedInterceptors","interceptor","request","requestError","responseError","thenFn","rejectFn","promise.success","promise.error","done","headersString","statusText","resolvePromise","$$phase","deferred","resolve","removePendingReq","idx","pendingRequests","cachedResp","buildUrl","params","defaultCache","timeout","responseType","interceptorFactory","responseFn","createShortMethods","createShortMethodsWithData","createXhr","XMLHttpRequest","ActiveXObject","createHttpBackend","callbacks","$browserDefer","jsonpReq","script","doneWrapper","onreadystatechange","onload","onerror","body","script.onreadystatechange","readyState","script.onerror","ABORTED","timeoutRequest","jsonpDone","xhr","abort","completeRequest","urlResolve","protocol","callbackId","counter","open","setRequestHeader","xhr.onreadystatechange","responseHeaders","getAllResponseHeaders","responseText","send","this.startSymbol","this.endSymbol","mustHaveExpression","trustedContext","endIndex","hasInterpolation","startSymbolLength","exp","endSymbolLength","$interpolateMinErr","part","getTrusted","valueOf","newErr","$interpolate.startSymbol","$interpolate.endSymbol","count","invokeApply","clearInterval","iteration","skipApply","$$intervalId","tick","notify","intervals","interval.cancel","short","pluralCat","num","encodePath","segments","parseAbsoluteUrl","absoluteUrl","locationObj","appBase","parsedUrl","$$protocol","$$host","hostname","$$port","port","DEFAULT_PORTS","parseAppUrl","relativeUrl","prefixed","$$path","pathname","$$search","search","$$hash","beginsWith","begin","whole","stripHash","stripFile","lastIndexOf","LocationHtml5Url","basePrefix","$$html5","appBaseNoFile","$$parse","this.$$parse","pathUrl","$locationMinErr","$$compose","this.$$compose","$$url","$$absUrl","$$rewrite","this.$$rewrite","appUrl","prevAppUrl","LocationHashbangUrl","hashPrefix","withoutBaseUrl","withoutHashUrl","windowsFilePathExp","firstPathSegmentMatch","LocationHashbangInHtml5Url","locationGetter","property","locationGetterSetter","preprocess","html5Mode","this.hashPrefix","prefix","this.html5Mode","afterLocationChange","oldUrl","$broadcast","absUrl","initialUrl","LocationMode","ctrlKey","metaKey","which","absHref","animVal","rewrittenUrl","newUrl","$digest","changeCounter","$locationWatch","currentReplace","$$replace","debug","debugEnabled","this.debugEnabled","flag","formatError","Error","sourceURL","consoleLog","console","logFn","log","hasApply","arg1","arg2","ensureSafeMemberName","fullExpression","$parseMinErr","ensureSafeObject","setter","setValue","fullExp","propertyObj","unwrapPromises","promiseWarning","$$v","cspSafeGetterFn","key0","key1","key2","key3","key4","cspSafePromiseEnabledGetter","pathVal","cspSafeGetter","simpleGetterFn1","simpleGetterFn2","getterFn","getterFnCache","pathKeys","pathKeysLength","evaledFnGetter","Function","$parseOptions","this.unwrapPromises","logPromiseWarnings","this.logPromiseWarnings","$filter","promiseWarningCache","parsedExpression","lexer","Lexer","parser","Parser","qFactory","nextTick","exceptionHandler","defaultCallback","defaultErrback","pending","ref","createInternalRejectedPromise","progress","errback","progressback","wrappedCallback","wrappedErrback","wrappedProgressback","catch","finally","makePromise","resolved","handleCallback","isResolved","callbackOutput","promises","requestAnimationFrame","webkitRequestAnimationFrame","mozRequestAnimationFrame","cancelAnimationFrame","webkitCancelAnimationFrame","mozCancelAnimationFrame","webkitCancelRequestAnimationFrame","rafSupported","raf","id","timer","TTL","$rootScopeMinErr","lastDirtyWatch","digestTtl","this.digestTtl","Scope","$id","$parent","$$watchers","$$nextSibling","$$prevSibling","$$childHead","$$childTail","$root","$$destroyed","$$asyncQueue","$$postDigestQueue","$$listeners","$$listenerCount","beginPhase","phase","compileToFn","decrementListenerCount","current","initWatchVal","isolate","child","ChildScope","watchExp","objectEquality","watcher","listenFn","watcher.fn","newVal","oldVal","originalFn","$watchCollection","veryOldValue","trackVeryOldValue","changeDetected","objGetter","internalArray","internalObject","initRun","oldLength","$watchCollectionWatch","newLength","$watchCollectionAction","watch","watchers","asyncQueue","postDigestQueue","dirty","ttl","watchLog","logIdx","logMsg","asyncTask","$eval","isNaN","next","$on","this.$watch","expr","$$postDigest","namedListeners","$emit","listenerArgs","array1","currentScope","sanitizeUri","uri","isImage","regex","normalizedVal","adjustMatcher","matcher","$sceMinErr","adjustMatchers","matchers","adjustedMatchers","SCE_CONTEXTS","resourceUrlWhitelist","resourceUrlBlacklist","this.resourceUrlWhitelist","this.resourceUrlBlacklist","generateHolderType","Base","holderType","trustedValue","$$unwrapTrustedValue","this.$$unwrapTrustedValue","holderType.prototype.valueOf","holderType.prototype.toString","htmlSanitizer","trustedValueHolderBase","byType","CSS","URL","JS","trustAs","maybeTrusted","allowed","enabled","this.enabled","$sceDelegate","msieDocumentMode","sce","isEnabled","sce.isEnabled","sce.getTrusted","parseAs","sce.parseAs","sceParseAsTrusted","enumValue","lName","eventSupport","android","userAgent","navigator","boxee","documentMode","vendorPrefix","vendorRegex","bodyStyle","style","transitions","animations","webkitTransition","webkitAnimation","hasEvent","divElm","deferreds","$$timeoutId","timeout.cancel","base","urlParsingNode","requestUrl","originUrl","filters","suffix","currencyFilter","dateFilter","filterFilter","jsonFilter","limitToFilter","lowercaseFilter","numberFilter","orderByFilter","uppercaseFilter","comparator","comparatorType","predicates","predicates.check","objKey","filtered","$locale","formats","NUMBER_FORMATS","amount","currencySymbol","CURRENCY_SYM","formatNumber","PATTERNS","GROUP_SEP","DECIMAL_SEP","number","fractionSize","pattern","groupSep","decimalSep","isFinite","isNegative","abs","numStr","formatedText","hasExponent","toFixed","fractionLen","min","minFrac","maxFrac","pow","round","fraction","lgroup","lgSize","group","gSize","negPre","posPre","negSuf","posSuf","padNumber","digits","neg","dateGetter","date","dateStrGetter","shortForm","jsonStringToDate","string","R_ISO8601_STR","tzHour","tzMin","dateSetter","setUTCFullYear","setFullYear","timeSetter","setUTCHours","setHours","m","s","ms","parseFloat","format","DATETIME_FORMATS","NUMBER_STRING","DATE_FORMATS_SPLIT","DATE_FORMATS","object","input","limit","out","sortPredicate","reverseOrder","reverseComparator","comp","descending","v1","v2","predicate","arrayCopy","ngDirective","FormController","toggleValidCss","isValid","validationErrorKey","INVALID_CLASS","VALID_CLASS","form","parentForm","nullFormCtrl","invalidCount","errors","$error","controls","$name","ngForm","$dirty","$pristine","$valid","$invalid","$addControl","PRISTINE_CLASS","form.$addControl","control","$removeControl","form.$removeControl","queue","validationToken","$setValidity","form.$setValidity","$setDirty","form.$setDirty","DIRTY_CLASS","$setPristine","form.$setPristine","validate","ctrl","validatorName","validity","addNativeHtml5Validators","$parsers","validator","badInput","customError","typeMismatch","valueMissing","textInputType","composing","ngTrim","$viewValue","$setViewValue","deferListener","keyCode","$render","ctrl.$render","$isEmpty","ngPattern","patternValidator","patternObj","$formatters","ngMinlength","minlength","minLengthValidator","ngMaxlength","maxlength","maxLengthValidator","classDirective","arrayDifference","arrayClasses","classes","digestClassCounts","classCounts","classesToUpdate","ngClassWatchAction","$index","old$index","mod","Object","addEventListenerFn","addEventListener","attachEvent","removeEventListener","detachEvent","_data","JQLite._data","optgroup","option","tbody","tfoot","colgroup","caption","thead","th","td","ready","trigger","fired","removeAttribute","css","currentStyle","lowercasedName","getNamedItem","ret","getText","textProp","NODE_TYPE_TEXT_PROPERTY","$dv","multiple","selected","onFn","eventFns","contains","compareDocumentPosition","adown","documentElement","bup","eventmap","related","relatedTarget","one","off","replaceNode","insertBefore","contentDocument","prepend","wrapNode","after","newElement","toggleClass","condition","classCondition","nextElementSibling","getElementsByTagName","eventName","eventData","arg3","unbind","$animateMinErr","$$selectors","classNameFilter","this.classNameFilter","$$classNameFilter","$$asyncCallback","enter","leave","move","add","PATH_MATCH","paramValue","OPERATORS","null","true","false","+","-","*","/","%","^","===","!==","==","!=","<",">","<=",">=","&&","||","&","|","!","ESCAPE","lex","ch","lastCh","tokens","is","readString","peek","readNumber","isIdent","readIdent","was","isWhitespace","ch2","ch3","fn2","fn3","throwError","chars","isExpOperator","start","end","colStr","peekCh","ident","lastDot","peekIndex","methodName","quote","rawString","hex","rep","ZERO","assignment","logicalOR","functionCall","fieldAccess","objectIndex","filterChain","this.filterChain","primary","statements","expect","consume","arrayDeclaration","msg","peekToken","e1","e2","e3","e4","t","unaryFn","right","ternaryFn","left","middle","binaryFn","statement","argsFn","fnInvoke","ternary","logicalAND","equality","relational","additive","multiplicative","unary","field","indexFn","o","safe","contextGetter","fnPtr","elementFns","allConstant","elementFn","keyValues","ampmGetter","getHours","AMPMS","timeZoneGetter","zone","getTimezoneOffset","paddedZone","xlinkHref","propName","normalized","ngBooleanAttrWatchAction","formDirectiveFactory","isNgForm","formElement","action","preventDefaultListener","parentFormCtrl","alias","URL_REGEXP","EMAIL_REGEXP","NUMBER_REGEXP","inputType","numberInputType","minValidator","maxValidator","urlInputType","urlValidator","emailInputType","emailValidator","radioInputType","checked","checkboxInputType","trueValue","ngTrueValue","falseValue","ngFalseValue","ctrl.$isEmpty","NgModelController","$modelValue","NaN","$viewChangeListeners","ngModelGet","ngModel","ngModelSet","this.$isEmpty","inheritedData","this.$setValidity","this.$setPristine","this.$setViewValue","ngModelWatch","formatters","ctrls","modelCtrl","formCtrl","ngChange","required","ngList","viewValue","CONSTANT_VALUE_REGEXP","tpl","tplAttr","ngValue","ngValueConstantLink","ngValueLink","valueWatchAction","ngBind","ngBindWatchAction","ngBindTemplate","ngBindHtml","getStringValue","ngBindHtmlWatchAction","getTrustedHtml","$transclude","previousElements","ngIf","ngIfWatchAction","$anchorScroll","srcExp","ngInclude","onloadExp","autoScrollExp","autoscroll","previousElement","currentElement","cleanupLastIncludeContent","parseAsResourceUrl","ngIncludeWatchAction","afterAnimation","thisChangeId","newScope","$compile","ngInit","BRACE","numberExp","whenExp","whens","whensExpFns","isWhen","attributeName","ngPluralizeWatch","ngPluralizeWatchAction","ngRepeatMinErr","ngRepeat","trackByExpGetter","trackByIdExpFn","trackByIdArrayFn","trackByIdObjFn","valueIdentifier","keyIdentifier","hashFnLocals","lhs","rhs","trackByExp","lastBlockMap","ngRepeatAction","collection","previousNode","nextNode","nextBlockMap","arrayLength","collectionKeys","nextBlockOrder","trackByIdFn","trackById","$first","$last","$middle","$odd","$even","ngShow","ngShowWatchAction","ngHide","ngHideWatchAction","ngStyle","ngStyleWatchAction","newStyles","oldStyles","ngSwitchController","cases","selectedTranscludes","selectedElements","selectedScopes","ngSwitch","ngSwitchWatchAction","change","selectedTransclude","selectedScope","caseElement","anchor","ngSwitchWhen","$attrs","ngOptionsMinErr","NG_OPTIONS_REGEXP","nullModelCtrl","optionsMap","ngModelCtrl","unknownOption","databound","init","self.init","ngModelCtrl_","nullOption_","unknownOption_","addOption","self.addOption","removeOption","self.removeOption","hasOption","renderUnknownOption","self.renderUnknownOption","unknownVal","self.hasOption","setupAsSingle","selectElement","selectCtrl","ngModelCtrl.$render","emptyOption","setupAsMultiple","lastView","items","selectMultipleWatch","setupAsOptions","render","optionGroups","optionGroupNames","optionGroupName","optionGroup","existingParent","existingOptions","modelValue","valuesFn","keyName","groupIndex","selectedSet","lastElement","trackFn","trackIndex","valueName","groupByFn","modelCast","label","displayFn","nullOption","groupLength","optionGroupsCache","optGroupTemplate","existingOption","optionTemplate","optionsExp","track","optionElement","ngOptions","ngModelCtrl.$isEmpty","nullSelectCtrl","selectCtrlName","interpolateWatchAction","$$csp"] -} diff --git a/release-0.19.0/examples/update-demo/local/index.html b/release-0.19.0/examples/update-demo/local/index.html deleted file mode 100644 index 22a4859126a..00000000000 --- a/release-0.19.0/examples/update-demo/local/index.html +++ /dev/null @@ -1,36 +0,0 @@ - - - - - - - - - -
    - - ID: {{server.podName}}
    - Host: {{server.host}}
    - Status: {{server.status}}
    - Image: {{server.dockerImage}}
    - Labels: -
      -
    • {{key}}={{value}}
      • -
    -
    - - diff --git a/release-0.19.0/examples/update-demo/local/script.js b/release-0.19.0/examples/update-demo/local/script.js deleted file mode 100644 index cf0fb3dd6b6..00000000000 --- a/release-0.19.0/examples/update-demo/local/script.js +++ /dev/null @@ -1,100 +0,0 @@ -/* -Copyright 2014 Google Inc. All rights reserved. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -var base = "http://localhost:8001/api/v1beta3/"; - -var updateImage = function($http, server) { - $http.get(base + "proxy/namespaces/default/pods/" + server.podName + "/data.json") - .success(function(data) { - console.log(data); - server.image = data.image; - }) - .error(function(data) { - console.log(data); - server.image = ""; - }); -}; - -var updateServer = function($http, server) { - $http.get(base + "namespaces/default/pods/" + server.podName) - .success(function(data) { - console.log(data); - server.labels = data.metadata.labels; - server.host = data.spec.host.split('.')[0]; - server.status = data.status.phase; - server.dockerImage = data.status.containerStatuses[0].image; - updateImage($http, server); - }) - .error(function(data) { - console.log(data); - }); -}; - -var updateData = function($scope, $http) { - var servers = $scope.servers; - for (var i = 0; i < servers.length; ++i) { - var server = servers[i]; - updateServer($http, server); - } -}; - -var ButtonsCtrl = function ($scope, $http, $interval) { - $scope.servers = []; - update($scope, $http); - $interval(angular.bind({}, update, $scope, $http), 2000); -}; - -var getServer = function($scope, name) { - var servers = $scope.servers; - for (var i = 0; i < servers.length; ++i) { - if (servers[i].podName == name) { - return servers[i]; - } - } - return null; -}; - -var isUpdateDemoPod = function(pod) { - return pod.metadata && pod.metadata.labels && pod.metadata.labels.name == "update-demo"; -}; - -var update = function($scope, $http) { - if (!$http) { - console.log("No HTTP!"); - return; - } - $http.get(base + "namespaces/default/pods") - .success(function(data) { - console.log(data); - var newServers = []; - for (var i = 0; i < data.items.length; ++i) { - var pod = data.items[i]; - if (!isUpdateDemoPod(pod)) { - continue; - } - var server = getServer($scope, pod.metadata.name); - if (server == null) { - server = { "podName": pod.metadata.name }; - } - newServers.push(server); - } - $scope.servers = newServers; - updateData($scope, $http); - }) - .error(function(data) { - console.log("ERROR: " + data); - }) -}; diff --git a/release-0.19.0/examples/update-demo/local/style.css b/release-0.19.0/examples/update-demo/local/style.css deleted file mode 100644 index ea8941c0ac3..00000000000 --- a/release-0.19.0/examples/update-demo/local/style.css +++ /dev/null @@ -1,40 +0,0 @@ -/* -Copyright 2014 Google Inc. All rights reserved. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -img { - height: 100px; - width: 100px; - float: right; - background-size: 100px 100px; - background-color: black; - margin-left: 10px; - border: none; -} - -ul { - margin-top: 0; - margin-bottom: 0; -} - -.pod { - font-family: Roboto, Open Sans, arial; - border: 1px solid black; - border-radius: 5px; - padding: 10px; - margin: 10px; - display: inline-block; - background-color: #D1D1D1; -} diff --git a/release-0.19.0/examples/update-demo/nautilus-rc.yaml b/release-0.19.0/examples/update-demo/nautilus-rc.yaml deleted file mode 100644 index 5e3b4566fce..00000000000 --- a/release-0.19.0/examples/update-demo/nautilus-rc.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - name: update-demo-nautilus -spec: - replicas: 2 - selector: - name: update-demo - version: nautilus - template: - metadata: - labels: - name: update-demo - version: nautilus - spec: - containers: - - image: gcr.io/google_containers/update-demo:nautilus - name: update-demo - ports: - - containerPort: 80 - protocol: TCP diff --git a/release-0.19.0/examples/walkthrough/README.md b/release-0.19.0/examples/walkthrough/README.md deleted file mode 100644 index 7e1982f71a8..00000000000 --- a/release-0.19.0/examples/walkthrough/README.md +++ /dev/null @@ -1,118 +0,0 @@ -# Kubernetes 101 - Walkthrough - -## Pods -The first atom of Kubernetes is a _pod_. A pod is a collection of containers that are symbiotically grouped. - -See [pods](../../docs/pods.md) for more details. - -### Intro - -Trivially, a single container might be a pod. For example, you can express a simple web server as a pod: - -```yaml -apiVersion: v1beta3 -kind: Pod -metadata: - name: www -spec: - containers: - - name: nginx - image: nginx -``` - -A pod definition is a declaration of a _desired state_. Desired state is a very important concept in the Kubernetes model. Many things present a desired state to the system, and it is Kubernetes' responsibility to make sure that the current state matches the desired state. For example, when you create a Pod, you declare that you want the containers in it to be running. If the containers happen to not be running (e.g. program failure, ...), Kubernetes will continue to (re-)create them for you in order to drive them to the desired state. This process continues until you delete the Pod. - -See the [design document](../../DESIGN.md) for more details. - -### Volumes - -Now that's great for a static web server, but what about persistent storage? We know that the container file system only lives as long as the container does, so we need more persistent storage. To do this, you also declare a ```volume``` as part of your pod, and mount it into a container: -```yaml -apiVersion: v1beta3 -kind: Pod -metadata: - name: storage -spec: - containers: - - name: redis - image: redis - volumeMounts: - # name must match the volume name below - - name: redis-persistent-storage - # mount path within the container - mountPath: /data/redis - volumes: - - name: redis-persistent-storage - emptyDir: {} -``` - -Ok, so what did we do? We added a volume to our pod: -``` - volumes: - - name: redis-persistent-storage - emptyDir: {} -``` - -And we added a reference to that volume to our container: -``` - volumeMounts: - # name must match the volume name below - - name: redis-persistent-storage - # mount path within the container - mountPath: /data/redis -``` - -In Kubernetes, ```emptyDir``` Volumes live for the lifespan of the Pod, which is longer than the lifespan of any one container, so if the container fails and is restarted, our persistent storage will live on. - -If you want to mount a directory that already exists in the file system (e.g. ```/var/logs```) you can use the ```hostDir``` directive. - -See [volumes](../../docs/volumes.md) for more details. - -### Multiple Containers - -_Note: -The examples below are syntactically correct, but some of the images (e.g. kubernetes/git-monitor) don't exist yet. We're working on turning these into working examples._ - - -However, often you want to have two different containers that work together. An example of this would be a web server, and a helper job that polls a git repository for new updates: - -```yaml -apiVersion: v1beta3 -kind: Pod -metadata: - name: www -spec: - containers: - - name: nginx - image: nginx - volumeMounts: - - mountPath: /srv/www - name: www-data - readOnly: true - - name: git-monitor - image: kubernetes/git-monitor - env: - - name: GIT_REPO - value: http://github.com/some/repo.git - volumeMounts: - - mountPath: /data - name: www-data - volumes: - - name: www-data - emptyDir: {} -``` - -Note that we have also added a volume here. In this case, the volume is mounted into both containers. It is marked ```readOnly``` in the web server's case, since it doesn't need to write to the directory. - -Finally, we have also introduced an environment variable to the ```git-monitor``` container, which allows us to parameterize that container with the particular git repository that we want to track. - - -### What's next? -Continue on to [Kubernetes 201](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/examples/walkthrough/k8s201.md) or -for a complete application see the [guestbook example](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/examples/guestbook/README.md) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/walkthrough/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/walkthrough/README.md?pixel)]() diff --git a/release-0.19.0/examples/walkthrough/k8s201.md b/release-0.19.0/examples/walkthrough/k8s201.md deleted file mode 100644 index f08f868e097..00000000000 --- a/release-0.19.0/examples/walkthrough/k8s201.md +++ /dev/null @@ -1,157 +0,0 @@ -# Kubernetes 201 - Labels, Replication Controllers, Services and Health Checking - -### Overview -When we had just left off in the [previous episode](README.md) we had learned about pods, multiple containers and volumes. -We'll now cover some slightly more advanced topics in Kubernetes, related to application productionization, deployment and -scaling. - -### Labels -Having already learned about Pods and how to create them, you may be struck by an urge to create many, many pods. Please do! But eventually you will need a system to organize these pods into groups. The system for achieving this in Kubernetes is Labels. Labels are key-value pairs that are attached to each object in Kubernetes. Label selectors can be passed along with a RESTful ```list``` request to the apiserver to retrieve a list of objects which match that label selector. For example: - -```sh -kubectl get pods -l name=nginx -``` - -Lists all pods who name label matches 'nginx'. Labels are discussed in detail [elsewhere](http://docs.k8s.io/labels.md), but they are a core concept for two additional building blocks for Kubernetes, Replication Controllers and Services - -### Replication Controllers - -OK, now you have an awesome, multi-container, labelled pod and you want to use it to build an application, you might be tempted to just start building a whole bunch of individual pods, but if you do that, a whole host of operational concerns pop up. For example: how will you scale the number of pods up or down and how will you ensure that all pods are homogenous? - -Replication controllers are the objects to answer these questions. A replication controller combines a template for pod creation (a "cookie-cutter" if you will) and a number of desired replicas, into a single Kubernetes object. The replication controller also contains a label selector that identifies the set of objects managed by the replication controller. The replication controller constantly measures the size of this set relative to the desired size, and takes action by creating or deleting pods. The design of replication controllers is discussed in detail [elsewhere](http://docs.k8s.io/replication-controller.md). - -An example replication controller that instantiates two pods running nginx looks like: -```yaml -apiVersion: v1beta3 -kind: ReplicationController -metadata: - name: nginx-controller -spec: - replicas: 2 - # selector identifies the set of Pods that this - # replication controller is responsible for managing - selector: - name: nginx - # podTemplate defines the 'cookie cutter' used for creating - # new pods when necessary - template: - metadata: - labels: - # Important: these labels need to match the selector above - # The api server enforces this constraint. - name: nginx - spec: - containers: - - name: nginx - image: nginx - ports: - - containerPort: 80 -``` - -### Services -Once you have a replicated set of pods, you need an abstraction that enables connectivity between the layers of your application. For example, if you have a replication controller managing your backend jobs, you don't want to have to reconfigure your front-ends whenever you re-scale your backends. Likewise, if the pods in your backends are scheduled (or rescheduled) onto different machines, you can't be required to re-configure your front-ends. In Kubernetes, the Service object achieves these goals. A Service basically combines an IP address and a label selector together to form a simple, static rallying point for connecting to a micro-service in your application. - -For example, here is a service that balances across the pods created in the previous nginx replication controller example: -```yaml -apiVersion: v1beta3 -kind: Service -metadata: - name: nginx-example -spec: - ports: - - port: 8000 # the port that this service should serve on - # the container on each pod to connect to, can be a name - # (e.g. 'www') or a number (e.g. 80) - targetPort: 80 - protocol: TCP - # just like the selector in the replication controller, - # but this time it identifies the set of pods to load balance - # traffic to. - selector: - name: nginx -``` - -When created, each service is assigned a unique IP address. This address is tied to the lifespan of the Service, and will not change while the Service is alive. Pods can be configured to talk to the service, and know that communication to the service will be automatically load-balanced out to some pod that is a member of the set identified by the label selector in the Service. Services are described in detail [elsewhere](http://docs.k8s.io/services.md). - -### Health Checking -When I write code it never crashes, right? Sadly the [kubernetes issues list](https://github.com/GoogleCloudPlatform/kubernetes/issues) indicates otherwise... - -Rather than trying to write bug-free code, a better approach is to use a management system to perform periodic health checking -and repair of your application. That way, a system, outside of your application itself, is responsible for monitoring the -application and taking action to fix it. It's important that the system be outside of the application, since of course, if -your application fails, and the health checking agent is part of your application, it may fail as well, and you'll never know. -In Kubernetes, the health check monitor is the Kubelet agent. - -#### Low level process health-checking - -The simplest form of health-checking is just process level health checking. The Kubelet constantly asks the Docker daemon -if the container process is still running, and if not, the container process is restarted. In all of the Kubernetes examples -you have run so far, this health checking was actually already enabled. It's on for every single container that runs in -Kubernetes. - -#### Application health-checking - -However, in many cases, this low-level health checking is insufficient. Consider for example, the following code: - -```go -lockOne := sync.Mutex{} -lockTwo := sync.Mutex{} - -go func() { - lockOne.Lock(); - lockTwo.Lock(); - ... -}() - -lockTwo.Lock(); -lockOne.Lock(); -``` - -This is a classic example of a problem in computer science known as "Deadlock". From Docker's perspective your application is -still operating, the process is still running, but from your application's perspective, your code is locked up, and will never respond correctly. - -To address this problem, Kubernetes supports user implemented application health-checks. These checks are performed by the -Kubelet to ensure that your application is operating correctly for a definition of "correctly" that _you_ provide. - -Currently, there are three types of application health checks that you can choose from: - - * HTTP Health Checks - The Kubelet will call a web hook. If it returns between 200 and 399, it is considered success, failure otherwise. - * Container Exec - The Kubelet will execute a command inside your container. If it exits with status 0 it will be considered a success. - * TCP Socket - The Kubelet will attempt to open a socket to your container. If it can establish a connection, the container is considered healthy, if it can't it is considered a failure. - -In all cases, if the Kubelet discovers a failure, the container is restarted. - -The container health checks are configured in the "LivenessProbe" section of your container config. There you can also specify an "initialDelaySeconds" that is a grace period from when the container is started to when health checks are performed, to enable your container to perform any necessary initialization. - -Here is an example config for a pod with an HTTP health check: -```yaml -apiVersion: v1beta3 -kind: Pod -metadata: - name: pod-with-healthcheck -spec: - containers: - - name: nginx - image: nginx - # defines the health checking - livenessProbe: - # an http probe - httpGet: - path: /_status/healthz - port: 80 - # length of time to wait for a pod to initialize - # after pod startup, before applying health checking - initialDelaySeconds: 30 - timeoutSeconds: 1 - ports: - - containerPort: 80 -``` - -### What's next? -For a complete application see the [guestbook example](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/examples/guestbook). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/walkthrough/k8s201.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/examples/walkthrough/k8s201.md?pixel)]() diff --git a/release-0.19.0/examples/walkthrough/pod-with-http-healthcheck.yaml b/release-0.19.0/examples/walkthrough/pod-with-http-healthcheck.yaml deleted file mode 100644 index af1ca32a1ca..00000000000 --- a/release-0.19.0/examples/walkthrough/pod-with-http-healthcheck.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - name: pod-with-healthcheck -spec: - containers: - - name: nginx - image: nginx - # defines the health checking - livenessProbe: - # an http probe - httpGet: - path: /_status/healthz - port: 80 - # length of time to wait for a pod to initialize - # after pod startup, before applying health checking - initialDelaySeconds: 30 - timeoutSeconds: 1 - ports: - - containerPort: 80 diff --git a/release-0.19.0/examples/walkthrough/pod1.yaml b/release-0.19.0/examples/walkthrough/pod1.yaml deleted file mode 100644 index 7eefc9ca8f5..00000000000 --- a/release-0.19.0/examples/walkthrough/pod1.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - name: www -spec: - containers: - - name: nginx - image: nginx diff --git a/release-0.19.0/examples/walkthrough/pod2.yaml b/release-0.19.0/examples/walkthrough/pod2.yaml deleted file mode 100644 index ed0cd1fe916..00000000000 --- a/release-0.19.0/examples/walkthrough/pod2.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1beta3 -kind: Pod -metadata: - name: storage -spec: - containers: - - name: redis - image: redis - volumeMounts: - # name must match the volume name below - - name: redis-persistent-storage - # mount path within the container - mountPath: /data/redis - volumes: - - name: redis-persistent-storage - emptyDir: {} diff --git a/release-0.19.0/examples/walkthrough/podtemplate.json b/release-0.19.0/examples/walkthrough/podtemplate.json deleted file mode 100644 index 5732a113584..00000000000 --- a/release-0.19.0/examples/walkthrough/podtemplate.json +++ /dev/null @@ -1,22 +0,0 @@ - { - "apiVersion": "v1beta3", - "kind": "PodTemplate", - "metadata": { - "name": "nginx" - }, - "template": { - "metadata": { - "labels": { - "name": "nginx" - }, - "generateName": "nginx-" - }, - "spec": { - "containers": [{ - "name": "nginx", - "image": "dockerfile/nginx", - "ports": [{"containerPort": 80}] - }] - } - } - } diff --git a/release-0.19.0/examples/walkthrough/replication-controller.yaml b/release-0.19.0/examples/walkthrough/replication-controller.yaml deleted file mode 100644 index 826b945ca05..00000000000 --- a/release-0.19.0/examples/walkthrough/replication-controller.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: v1beta3 -kind: ReplicationController -metadata: - name: nginx-controller -spec: - replicas: 2 - # selector identifies the set of Pods that this - # replicaController is responsible for managing - selector: - name: nginx - # podTemplate defines the 'cookie cutter' used for creating - # new pods when necessary - template: - metadata: - labels: - # Important: these labels need to match the selector above - # The api server enforces this constraint. - name: nginx - spec: - containers: - - name: nginx - image: nginx - ports: - - containerPort: 80 diff --git a/release-0.19.0/examples/walkthrough/service.yaml b/release-0.19.0/examples/walkthrough/service.yaml deleted file mode 100644 index 58a459e5116..00000000000 --- a/release-0.19.0/examples/walkthrough/service.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1beta3 -kind: Service -metadata: - name: nginx-example -spec: - ports: - - port: 8000 # the port that this service should serve on - # the container on each pod to connect to, can be a name - # (e.g. 'www') or a number (e.g. 80) - targetPort: 80 - protocol: TCP - # just like the selector in the replication controller, - # but this time it identifies the set of pods to load balance - # traffic to. - selector: - name: nginx diff --git a/release-0.20.0/docs/.files_generated b/release-0.20.0/docs/.files_generated deleted file mode 100644 index ea5ef406c64..00000000000 --- a/release-0.20.0/docs/.files_generated +++ /dev/null @@ -1,28 +0,0 @@ -kubectl.md -kubectl_api-versions.md -kubectl_cluster-info.md -kubectl_config.md -kubectl_config_set-cluster.md -kubectl_config_set-context.md -kubectl_config_set-credentials.md -kubectl_config_set.md -kubectl_config_unset.md -kubectl_config_use-context.md -kubectl_config_view.md -kubectl_create.md -kubectl_delete.md -kubectl_describe.md -kubectl_exec.md -kubectl_expose.md -kubectl_get.md -kubectl_label.md -kubectl_logs.md -kubectl_namespace.md -kubectl_port-forward.md -kubectl_proxy.md -kubectl_rolling-update.md -kubectl_run.md -kubectl_scale.md -kubectl_stop.md -kubectl_update.md -kubectl_version.md diff --git a/release-0.20.0/docs/README.md b/release-0.20.0/docs/README.md deleted file mode 100644 index 37d69f00789..00000000000 --- a/release-0.20.0/docs/README.md +++ /dev/null @@ -1,30 +0,0 @@ -# Kubernetes Documentation - -**Note** -This documentation is current for 0.20.0. - -Documentation for previous releases is available in their respective branches: - * [v0.19.0](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/release-0.19.0/docs) - * [v0.18.1](https://github.com/GoogleCloudPlatform/kubernetes/tree/release-0.18/docs) - * [v0.17.1](https://github.com/GoogleCloudPlatform/kubernetes/tree/release-0.17/docs) - -* The [User's guide](user-guide.md) is for anyone who wants to run programs and services on an existing Kubernetes cluster. - -* The [Cluster Admin's guide](cluster-admin-guide.md) is for anyone setting up a Kubernetes cluster or administering it. - -* The [Developer guide](developer-guide.md) is for anyone wanting to write programs that access the kubernetes API, - write plugins or extensions, or modify the core code of kubernetes. - -* The [Kubectl Command Line Interface](kubectl.md) is a detailed reference on the `kubectl` CLI. - -* The [API object documentation](http://kubernetes.io/third_party/swagger-ui/) is a detailed description of all fields found in core API objects. - -* An overview of the [Design of Kubernetes](design) - -* There are example files and walkthroughs in the [examples](../examples) folder. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/README.md?pixel)]() diff --git a/release-0.20.0/docs/accessing-the-cluster.md b/release-0.20.0/docs/accessing-the-cluster.md deleted file mode 100644 index 503ba6b5a09..00000000000 --- a/release-0.20.0/docs/accessing-the-cluster.md +++ /dev/null @@ -1,251 +0,0 @@ -# User Guide to Accessing the Cluster - * [Accessing the cluster API](#api) - * [Accessing services running on the cluster](#otherservices) - * [So many proxies](#somanyproxies) - -## Accessing the cluster API -### Accessing for the first time with kubectl -When accessing the Kubernetes API for the first time, we suggest using the -kubernetes CLI, `kubectl`. - -To access a cluster, you need to know the location of the cluster and have credentials -to access it. Typically, this is automatically set-up when you work through -though a [Getting started guide](../docs/getting-started-guide/README.md), -or someone else setup the cluster and provided you with credentials and a location. - -Check the location and credentials that kubectl knows about with this command: -``` -kubectl config view -``` - -Many of the [examples](../examples/) provide an introduction to using -kubectl and complete documentation is found in the [kubectl manual](../docs/kubectl.md). - -### Directly accessing the REST API -Kubectl handles locating and authenticating to the apiserver. -If you want to directly access the REST API with an http client like -curl or wget, or a browser, there are several ways to locate and authenticate: - - Run kubectl in proxy mode. - - Recommended approach. - - Uses stored apiserver location. - - Verifies identity of apiserver using self-signed cert. No MITM possible. - - Authenticates to apiserver. - - In future, may do intelligent client-side load-balancing and failover. - - Provide the location and credentials directly to the http client. - - Alternate approach. - - Works with some types of client code that are confused by using a proxy. - - Need to import a root cert into your browser to protect against MITM. - -#### Using kubectl proxy - -The following command runs kubectl in a mode where it acts as a reverse proxy. It handles -locating the apiserver and authenticating. -Run it like this: -``` -kubectl proxy --port=8080 & -``` -See [kubectl proxy](../docs/kubectl_proxy.md) for more details. - -Then you can explore the API with curl, wget, or a browser, like so: -``` -$ curl http://localhost:8080/api/ -{ - "versions": [ - "v1" - ] -} -``` -#### Without kubectl proxy -It is also possible to avoid using kubectl proxy by passing an authentication token -directly to the apiserver, like this: -``` -$ APISERVER=$(kubectl config view | grep server | cut -f 2- -d ":" | tr -d " ") -$ TOKEN=$(kubectl config view | grep token | cut -f 2 -d ":" | tr -d " ") -$ curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure -{ - "versions": [ - "v1" - ] -} -``` - -The above example uses the `--insecure` flag. This leaves it subject to MITM -attacks. When kubectl accesses the cluster it uses a stored root certificate -and client certificates to access the server. (These are installed in the -`~/.kube` directory). Since cluster certificates are typically self-signed, it -make take special configuration to get your http client to use root -certificate. - -On some clusters, the apiserver does not require authentication; it may serve -on localhost, or be protected by a firewall. There is not a standard -for this. [Configuring Access to the API](../docs/accessing_the_api.md) -describes how a cluster admin can configure this. Such approaches may conflict -with future high-availability support. - -### Programmatic access to the API - -There are [client libraries](../docs/client-libraries.md) for accessing the API -from several languages. The Kubernetes project-supported -[Go](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/pkg/client) -client library can use the same [kubeconfig file](../docs/kubeconfig-file.md) -as the kubectl CLI does to locate and authenticate to the apiserver. - -See documentation for other libraries for how they authenticate. - -### Accessing the API from a Pod - -When accessing the API from a pod, locating and authenticating -to the api server are somewhat different. - -The recommended way to locate the apiserver within the pod is with -the `kubernetes` DNS name, which resolves to a Service IP which in turn -will be routed to an apiserver. - -The recommended way to authenticate to the apiserver is with a -[service account](service_accounts.md) credential. By default, a pod -is associated with a service account, and a credential (token) for that -service account is placed into the filesystem tree of each container in that pod, -at `/var/run/secrets/kubernetes.io/serviceaccount/token`. - -From within a pod the recommended ways to connect to API are: - - run a kubectl proxy as one of the containers in the pod, or as a background - process within a container. This proxies the - kubernetes API to the localhost interface of the pod, so that other processes - in any container of the pod can access it. See this [example of using kubectl proxy - in a pod](../examples/kubectl-container/). - - use the Go client library, and create a client using the `client.NewInContainer()` factory. - This handles locating and authenticating to the apiserver. -In each case, the credentials of the pod are used to communicate securely with the apiserver. - - -## Accessing services running on the cluster -The previous section was about connecting the Kubernetes API server. This section is about -connecting to other services running on Kubernetes cluster. In kubernetes, the -[nodes](../docs/node.md), [pods](../docs/pods.md) and [services](services.md) all have -their own IPs. In many cases, the node IPs, pod IPs, and some service IPs on a cluster will not be -routable, so they will not be reachable from a machine outside the cluster, -such as your desktop machine. - -### Ways to connect -You have several options for connecting to nodes, pods and services from outside the cluster: - - Access services through public IPs. - - Use a service with type `NodePort` or `LoadBalancer` to make the service reachable outside - the cluster. See the [services](../docs/services.md) and - [kubectl expose](../docs/kubectl_expose.md) documentation. - - Depending on your cluster environment, this may just expose the service to your corporate network, - or it may expose it to the internet. Think about whether the service being exposed is secure. - Does it do its own authentication? - - Place pods behind services. To access one specific pod from a set of replicas, such as for debugging, - place a unique label on the pod it and create a new service which selects this label. - - In most cases, it should not be necessary for application developer to directly access - nodes via their nodeIPs. - - Access services, nodes, or pods using the Proxy Verb. - - Does apiserver authentication and authorization prior to accessing the remote service. - Use this if the services are not secure enough to expose to the internet, or to gain - access to ports on the node IP, or for debugging. - - Proxies may cause problems for some web applications. - - Only works for HTTP/HTTPS. - - Described [here](#apiserverproxy). - - Access from a node or pod in the cluster. - - Run a pod, and then connect to a shell in it using [kubectl exec](../docs/kubectl_exec.md). - Connect to other nodes, pods, and services from that shell. - - Some clusters may allow you to ssh to a node in the cluster. From there you may be able to - access cluster services. This is a non-standard method, and will work on some clusters but - not others. Browsers and other tools may or may not be installed. Cluster DNS may not work. - -### Discovering builtin services - -Typically, there are several services which are started on a cluster by default. Get a list of these -with the `kubectl cluster-info` command: -``` -$ kubectl cluster-info - - Kubernetes master is running at https://104.197.5.247 - elasticsearch-logging is running at https://104.197.5.247/api/v1/proxy/namespaces/default/services/elasticsearch-logging - kibana-logging is running at https://104.197.5.247/api/v1/proxy/namespaces/default/services/kibana-logging - kube-dns is running at https://104.197.5.247/api/v1/proxy/namespaces/default/services/kube-dns - grafana is running at https://104.197.5.247/api/v1/proxy/namespaces/default/services/monitoring-grafana - heapster is running at https://104.197.5.247/api/v1/proxy/namespaces/default/services/monitoring-heapster -``` -This shows the proxy-verb URL for accessing each service. -For example, this cluster has cluster-level logging enabled (using Elasticsearch), which can be reached -at `https://104.197.5.247/api/v1/proxy/namespaces/default/services/elasticsearch-logging/` if suitable credentials are passed, or through a kubectl proxy at, for example: -`http://localhost:8080/api/v1/proxy/namespaces/default/services/elasticsearch-logging/`. -(See [above](#api) for how to pass credentials or use kubectl proxy.) - -#### Manually constructing apiserver proxy URLs -As mentioned above, you use the `kubectl cluster-info` command to retrieve the service's proxy URL. To create proxy URLs that include service endpoints, suffixes, and parameters, you simply append to the service's proxy URL: -`http://`*`kubernetes_master_address`*`/`*`service_path`*`/`*`service_name`*`/`*`service_endpoint-suffix-parameter`* - - -##### Examples - * To access the Elasticsearch service endpoint `_search?q=user:kimchy`, you would use: `http://104.197.5.247/api/v1/proxy/namespaces/default/services/elasticsearch-logging/_search?q=user:kimchy` - * To access the Elasticsearch cluster health information `_cluster/health?pretty=true`, you would use: `https://104.197.5.247/api/v1/proxy/namespaces/default/services/elasticsearch-logging/_cluster/health?pretty=true` - ``` - { - "cluster_name" : "kubernetes_logging", - "status" : "yellow", - "timed_out" : false, - "number_of_nodes" : 1, - "number_of_data_nodes" : 1, - "active_primary_shards" : 5, - "active_shards" : 5, - "relocating_shards" : 0, - "initializing_shards" : 0, - "unassigned_shards" : 5 - } - ``` - -#### Using web browsers to access services running on the cluster -You may be able to put an apiserver proxy url into the address bar of a browser. However: - - Web browsers cannot usually pass tokens, so you may need to use basic (password) auth. Apiserver can be configured to accept basic auth, - but your cluster may not be configured to accept basic auth. - - Some web apps may not work, particularly those with client side javascript that construct urls in a - way that is unaware of the proxy path prefix. - -## Requesting redirects -The redirect capabilities have been deprecated and removed. Please use a proxy (see below) instead. - -##So Many Proxies -There are several different proxies you may encounter when using kubernetes: - 1. The [kubectl proxy](#kubectlproxy): - - runs on a user's desktop or in a pod - - proxies from a localhost address to the kubernetes apiserver - - client to proxy uses HTTP - - proxy to apiserver uses HTTPS - - locates apiserver - - adds authentication headers - 1. The [apiserver proxy](#apiserverproxy): - - is a bastion built into the apiserver - - connects a user outside of the cluster to cluster IPs which otherwise might not be reachable - - runs in the apiserver processes - - client to proxy uses HTTPS (or http if apiserver so configured) - - proxy to target may use HTTP or HTTPS as chosen by proxy using available information - - can be used to reach a Node, Pod, or Service - - does load balancing when used to reach a Service - 1. The [kube proxy](../docs/services.md#ips-and-vips): - - runs on each node - - proxies UDP and TCP - - does not understand HTTP - - provides load balancing - - is just used to reach services - 1. A Proxy/Load-balancer in front of apiserver(s): - - existence and implementation varies from cluster to cluster (e.g. nginx) - - sits between all clients and one or more apiservers - - acts as load balancer if there are several apiservers. - 1. Cloud Load Balancers on external services: - - are provided by some cloud providers (e.g. AWS ELB, Google Cloud Load Balancer) - - are created automatically when the kubernetes service has type `LoadBalancer` - - use UDP/TCP only - - implementation varies by cloud provider. - - - -Kubernetes users will typically not need to worry about anything other than the first two types. The cluster admin -will typically ensure that the latter types are setup correctly. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/accessing-the-cluster.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/accessing-the-cluster.md?pixel)]() diff --git a/release-0.20.0/docs/accessing_the_api.md b/release-0.20.0/docs/accessing_the_api.md deleted file mode 100644 index f2a2460927f..00000000000 --- a/release-0.20.0/docs/accessing_the_api.md +++ /dev/null @@ -1,81 +0,0 @@ -# Configuring APIserver ports - -This document describes what ports the kubernetes apiserver -may serve on and how to reach them. The audience is -cluster administrators who want to customize their cluster -or understand the details. - -Most questions about accessing the cluster are covered -in [Accessing the cluster](../docs/accessing-the-cluster.md). - - -## Ports and IPs Served On -The Kubernetes API is served by the Kubernetes APIServer process. Typically, -there is one of these running on a single kubernetes-master node. - -By default the Kubernetes APIserver serves HTTP on 2 ports: - 1. Localhost Port - - serves HTTP - - default is port 8080, change with `--insecure-port` flag. - - defaults IP is localhost, change with `--insecure-bind-address` flag. - - no authentication or authorization checks in HTTP - - protected by need to have host access - 2. Secure Port - - default is port 6443, change with `--secure-port` flag. - - default IP is first non-localhost network interface, change with `--bind-address` flag. - - serves HTTPS. Set cert with `--tls-cert-file` and key with `--tls-private-key-file` flag. - - uses token-file or client-certificate based [authentication](./authentication.md). - - uses policy-based [authorization](./authorization.md). - 3. Removed: ReadOnly Port - - For security reasons, this had to be removed. Use the service account feature instead. - -## Proxies and Firewall rules - -Additionally, in some configurations there is a proxy (nginx) running -on the same machine as the apiserver process. The proxy serves HTTPS protected -by Basic Auth on port 443, and proxies to the apiserver on localhost:8080. In -these configurations the secure port is typically set to 6443. - -A firewall rule is typically configured to allow external HTTPS access to port 443. - -The above are defaults and reflect how Kubernetes is deployed to GCE using -kube-up.sh. Other cloud providers may vary. - -## Use Cases vs IP:Ports - -There are three differently configured serving ports because there are a -variety of uses cases: - 1. Clients outside of a Kubernetes cluster, such as human running `kubectl` - on desktop machine. Currently, accesses the Localhost Port via a proxy (nginx) - running on the `kubernetes-master` machine. Proxy uses bearer token authentication. - 2. Processes running in Containers on Kubernetes that need to do read from - the apiserver. Currently, these can use a service account. - 3. Scheduler and Controller-manager processes, which need to do read-write - API operations. Currently, these have to run on the operations on the - apiserver. Currently, these have to run on the same host as the - apiserver and use the Localhost Port. In the future, these will be - switched to using service accounts to avoid the need to be co-located. - 4. Kubelets, which need to do read-write API operations and are necessarily - on different machines than the apiserver. Kubelet uses the Secure Port - to get their pods, to find the services that a pod can see, and to - write events. Credentials are distributed to kubelets at cluster - setup time. - -## Expected changes - - Policy will limit the actions kubelets can do via the authed port. - - Kubelets will change from token-based authentication to cert-based-auth. - - Scheduler and Controller-manager will use the Secure Port too. They - will then be able to run on different machines than the apiserver. - - A general mechanism will be provided for [giving credentials to - pods]( - https://github.com/GoogleCloudPlatform/kubernetes/issues/1907). - - Clients, like kubectl, will all support token-based auth, and the - Localhost will no longer be needed, and will not be the default. - However, the localhost port may continue to be an option for - installations that want to do their own auth proxy. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/accessing_the_api.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/accessing_the_api.md?pixel)]() diff --git a/release-0.20.0/docs/admission_controllers.md b/release-0.20.0/docs/admission_controllers.md deleted file mode 100644 index 345178d8fac..00000000000 --- a/release-0.20.0/docs/admission_controllers.md +++ /dev/null @@ -1,112 +0,0 @@ -# Admission Controllers - -## What are they? - -An admission control plug-in is a piece of code that intercepts requests to the Kubernetes -API server prior to persistence of the object, but after the request is authenticated -and authorized. The plug-in code is in the API server process -and must be compiled into the binary in order to be used at this time. - -Each admission control plug-in is run in sequence before a request is accepted into the cluster. If -any of the plug-ins in the sequence reject the request, the entire request is rejected immediately -and an error is returned to the end-user. - -Admission control plug-ins may mutate the incoming object in some cases to apply system configured -defaults. In addition, admission control plug-ins may mutate related resources as part of request -processing to do things like increment quota usage. - -## Why do I need them? - -Many advanced features in Kubernetes require an admission control plug-in to be enabled in order -to properly support the feature. As a result, a Kubernetes API server that is not properly -configured with the right set of admission control plug-ins is an incomplete server and will not -support all the features you expect. - -## How do I turn on an admission control plug-in? - -The Kubernetes API server supports a flag, ```admission_control``` that takes a comma-delimited, -ordered list of admission control choices to invoke prior to modifying objects in the cluster. - -## What does each plug-in do? - -### AlwaysAdmit - -Use this plugin by itself to pass-through all requests. - -### AlwaysDeny - -Rejects all requests. Used for testing. - -### DenyExecOnPrivileged - -This plug-in will intercept all requests to exec a command in a pod if that pod has a privileged container. - -If your cluster supports privileged containers, and you want to restrict the ability of end-users to exec -commands in those containers, we strongly encourage enabling this plug-in. - -### ServiceAccount - -This plug-in implements automation for [serviceAccounts]( service_accounts.md). -We strongly recommend using this plug-in if you intend to make use of Kubernetes ```ServiceAccount``` objects. - -### SecurityContextDeny - -This plug-in will deny any pod with a [SecurityContext](security_context.md) that defines options that were not available on the ```Container```. - -### ResourceQuota - -This plug-in will observe the incoming request and ensure that it does not violate any of the constraints -enumerated in the ```ResourceQuota``` object in a ```Namespace```. If you are using ```ResourceQuota``` -objects in your Kubernetes deployment, you MUST use this plug-in to enforce quota constraints. - -See the [resourceQuota design doc]( design/admission_control_resource_quota.md). - -It is strongly encouraged that this plug-in is configured last in the sequence of admission control plug-ins. This is -so that quota is not prematurely incremented only for the request to be rejected later in admission control. - -### LimitRanger - -This plug-in will observe the incoming request and ensure that it does not violate any of the constraints -enumerated in the ```LimitRange``` object in a ```Namespace```. If you are using ```LimitRange``` objects in -your Kubernetes deployment, you MUST use this plug-in to enforce those constraints. - -See the [limitRange design doc]( design/admission_control_limit_range.md). - -### NamespaceExists - -This plug-in will observe all incoming requests that attempt to create a resource in a Kubernetes ```Namespace``` -and reject the request if the ```Namespace``` was not previously created. We strongly recommend running -this plug-in to ensure integrity of your data. - -### NamespaceAutoProvision (deprecated) - -This plug-in will observe all incoming requests that attempt to create a resource in a Kubernetes ```Namespace``` -and create a new ```Namespace``` if one did not already exist previously. - -We strongly recommend ```NamespaceExists``` over ```NamespaceAutoProvision```. - -### NamespaceLifecycle - -This plug-in enforces that a ```Namespace``` that is undergoing termination cannot have new content created in it. - -A ```Namespace``` deletion kicks off a sequence of operations that remove all content (pods, services, etc.) in that -namespace. In order to enforce integrity of that process, we strongly recommend running this plug-in. - -Once ```NamespaceAutoProvision``` is deprecated, we anticipate ```NamespaceLifecycle``` and ```NamespaceExists``` will -be merged into a single plug-in that enforces the life-cycle of a ```Namespace``` in Kubernetes. - -## Is there a recommended set of plug-ins to use? - -Yes. - -For Kubernetes 1.0, we strongly recommend running the following set of admission control plug-ins (order matters): - -```shell ---admission_control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/admission_controllers.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/admission_controllers.md?pixel)]() diff --git a/release-0.20.0/docs/annotations.md b/release-0.20.0/docs/annotations.md deleted file mode 100644 index 011aa37e832..00000000000 --- a/release-0.20.0/docs/annotations.md +++ /dev/null @@ -1,31 +0,0 @@ -# Annotations - -We have [labels](labels.md) for identifying metadata. - -It is also useful to be able to attach arbitrary non-identifying metadata, for retrieval by API clients such as tools, libraries, etc. This information may be large, may be structured or unstructured, may include characters not permitted by labels, etc. Such information would not be used for object selection and therefore doesn't belong in labels. - -Like labels, annotations are key-value maps. -``` -"annotations": { - "key1" : "value1", - "key2" : "value2" -} -``` - -Possible information that could be recorded in annotations: - -* fields managed by a declarative configuration layer, to distinguish them from client- and/or server-set default values and other auto-generated fields, fields set by auto-sizing/auto-scaling systems, etc., in order to facilitate merging -* build/release/image information (timestamps, release ids, git branch, PR numbers, image hashes, registry address, etc.) -* pointers to logging/monitoring/analytics/audit repos -* client library/tool information (e.g. for debugging purposes -- name, version, build info) -* other user and/or tool/system provenance info, such as URLs of related objects from other ecosystem components -* lightweight rollout tool metadata (config and/or checkpoints) -* phone/pager number(s) of person(s) responsible, or directory entry where that info could be found, such as a team website - -Yes, this information could be stored in an external database or directory, but that would make it much harder to produce shared client libraries and tools for deployment, management, introspection, etc. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/annotations.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/annotations.md?pixel)]() diff --git a/release-0.20.0/docs/api-conventions.md b/release-0.20.0/docs/api-conventions.md deleted file mode 100644 index df6384fab6f..00000000000 --- a/release-0.20.0/docs/api-conventions.md +++ /dev/null @@ -1,598 +0,0 @@ -API Conventions -=============== - -Updated: 4/16/2015 - -*This document is oriented at users who want a deeper understanding of the kubernetes -API structure, and developers wanting to extend the kubernetes API. An introduction to -using resources with kubectl can be found in (working_with_resources.md).* - -The conventions of the [Kubernetes API](api.md) (and related APIs in the ecosystem) are intended to ease client development and ensure that configuration mechanisms can be implemented that work across a diverse set of use cases consistently. - -The general style of the Kubernetes API is RESTful - clients create, update, delete, or retrieve a description of an object via the standard HTTP verbs (POST, PUT, DELETE, and GET) - and those APIs preferentially accept and return JSON. Kubernetes also exposes additional endpoints for non-standard verbs and allows alternative content types. All of the JSON accepted and returned by the server has a schema, identified by the "kind" and "apiVersion" fields. Where relevant HTTP header fields exist, they should mirror the content of JSON fields, but the information should not be represented only in the HTTP header. - -The following terms are defined: - -* **Kind** the name of a particular object schema (e.g. the "Cat" and "Dog" kinds would have different attributes and properties) -* **Resource** a representation of a system entity, sent or retrieved as JSON via HTTP to the server. Resources are exposed via: - * Collections - a list of resources of the same type, which may be queryable - * Elements - an individual resource, addressable via a URL - -Each resource typically accepts and returns data of a single kind. A kind may be accepted or returned by multiple resources that reflect specific use cases. For instance, the kind "pod" is exposed as a "pods" resource that allows end users to create, update, and delete pods, while a separate "pod status" resource (that acts on "pod" kind) allows automated processes to update a subset of the fields in that resource. A "restart" resource might be exposed for a number of different resources to allow the same action to have different results for each object. - -Resource collections should be all lowercase and plural, whereas kinds are CamelCase and singular. - - -Types (Kinds) -------------- - -Kinds are grouped into three categories: - -1. **Objects** represent a persistent entity in the system. - - Creating an API object is a record of intent - once created, the system will work to ensure that resource exists. All API objects have common metadata. - - An object may have multiple resources that clients can use to perform specific actions that create, update, delete, or get. - - Examples: `Pods`, `ReplicationControllers`, `Services`, `Namespaces`, `Nodes` - -2. **Lists** are collections of **resources** of one (usually) or more (occasionally) kinds. - - Lists have a limited set of common metadata. All lists use the "items" field to contain the array of objects they return. - - Most objects defined in the system should have an endpoint that returns the full set of resources, as well as zero or more endpoints that return subsets of the full list. Some objects may be singletons (the current user, the system defaults) and may not have lists. - - In addition, all lists that return objects with labels should support label filtering (see [labels.md](labels.md), and most lists should support filtering by fields. - - Examples: PodLists, ServiceLists, NodeLists - - TODO: Describe field filtering below or in a separate doc. - -3. **Simple** kinds are used for specific actions on objects and for non-persistent entities. - - Given their limited scope, they have the same set of limited common metadata as lists. - - The "size" action may accept a simple resource that has only a single field as input (the number of things). The "status" kind is returned when errors occur and is not persisted in the system. - - Examples: Binding, Status - -The standard REST verbs (defined below) MUST return singular JSON objects. Some API endpoints may deviate from the strict REST pattern and return resources that are not singular JSON objects, such as streams of JSON objects or unstructured text log data. - -The term "kind" is reserved for these "top-level" API types. The term "type" should be used for distinguishing sub-categories within objects or subobjects. - -### Resources - -All JSON objects returned by an API MUST have the following fields: - -* kind: a string that identifies the schema this object should have -* apiVersion: a string that identifies the version of the schema the object should have - -These fields are required for proper decoding of the object. They may be populated by the server by default from the specified URL path, but the client likely needs to know the values in order to construct the URL path. - -### Objects - -#### Metadata - -Every object kind MUST have the following metadata in a nested object field called "metadata": - -* namespace: a namespace is a DNS compatible subdomain that objects are subdivided into. The default namespace is 'default'. See [namespaces.md](namespaces.md) for more. -* name: a string that uniquely identifies this object within the current namespace (see [identifiers.md](identifiers.md)). This value is used in the path when retrieving an individual object. -* uid: a unique in time and space value (typically an RFC 4122 generated identifier, see [identifiers.md](identifiers.md)) used to distinguish between objects with the same name that have been deleted and recreated - -Every object SHOULD have the following metadata in a nested object field called "metadata": - -* resourceVersion: a string that identifies the internal version of this object that can be used by clients to determine when objects have changed. This value MUST be treated as opaque by clients and passed unmodified back to the server. Clients should not assume that the resource version has meaning across namespaces, different kinds of resources, or different servers. (see [concurrency control](#concurrency-control-and-consistency), below, for more details) -* creationTimestamp: a string representing an RFC 3339 date of the date and time an object was created -* deletionTimestamp: a string representing an RFC 3339 date of the date and time after which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. -* labels: a map of string keys and values that can be used to organize and categorize objects (see [labels.md](labels.md)) -* annotations: a map of string keys and values that can be used by external tooling to store and retrieve arbitrary metadata about this object (see [annotations.md](annotations.md)) - -Labels are intended for organizational purposes by end users (select the pods that match this label query). Annotations enable third-party automation and tooling to decorate objects with additional metadata for their own use. - -#### Spec and Status - -By convention, the Kubernetes API makes a distinction between the specification of the desired state of an object (a nested object field called "spec") and the status of the object at the current time (a nested object field called "status"). The specification is a complete description of the desired state, including configuration settings provided by the user, [default values](#defaulting) expanded by the system, and properties initialized or otherwise changed after creation by other ecosystem components (e.g., schedulers, auto-scalers), and is persisted in stable storage with the API object. If the specification is deleted, the object will be purged from the system. The status summarizes the current state of the object in the system, and is usually persisted with the object by an automated processes but may be generated on the fly. At some cost and perhaps some temporary degradation in behavior, the status could be reconstructed by observation if it were lost. - -When a new version of an object is POSTed or PUT, the "spec" is updated and available immediately. Over time the system will work to bring the "status" into line with the "spec". The system will drive toward the most recent "spec" regardless of previous versions of that stanza. In other words, if a value is changed from 2 to 5 in one PUT and then back down to 3 in another PUT the system is not required to 'touch base' at 5 before changing the "status" to 3. In other words, the system's behavior is *level-based* rather than *edge-based*. This enables robust behavior in the presence of missed intermediate state changes. - -The Kubernetes API also serves as the foundation for the declarative configuration schema for the system. In order to facilitate level-based operation and expression of declarative configuration, fields in the specification should have declarative rather than imperative names and semantics -- they represent the desired state, not actions intended to yield the desired state. - -The PUT and POST verbs on objects will ignore the "status" values. A `/status` subresource is provided to enable system components to update statuses of resources they manage. - -Otherwise, PUT expects the whole object to be specified. Therefore, if a field is omitted it is assumed that the client wants to clear that field's value. The PUT verb does not accept partial updates. Modification of just part of an object may be achieved by GETting the resource, modifying part of the spec, labels, or annotations, and then PUTting it back. See [concurrency control](#concurrency-control-and-consistency), below, regarding read-modify-write consistency when using this pattern. Some objects may expose alternative resource representations that allow mutation of the status, or performing custom actions on the object. - -All objects that represent a physical resource whose state may vary from the user's desired intent SHOULD have a "spec" and a "status". Objects whose state cannot vary from the user's desired intent MAY have only "spec", and MAY rename "spec" to a more appropriate name. - -Objects that contain both spec and status should not contain additional top-level fields other than the standard metadata fields. - -##### Typical status properties - -* **phase**: The phase is a simple, high-level summary of the phase of the lifecycle of an object. The phase should progress monotonically. Typical phase values are `Pending` (not yet fully physically realized), `Running` or `Active` (fully realized and active, but not necessarily operating correctly), and `Terminated` (no longer active), but may vary slightly for different types of objects. New phase values should not be added to existing objects in the future. Like other status fields, it must be possible to ascertain the lifecycle phase by observation. Additional details regarding the current phase may be contained in other fields. -* **conditions**: Conditions represent orthogonal observations of an object's current state. Objects may report multiple conditions, and new types of conditions may be added in the future. Condition status values may be `True`, `False`, or `Unknown`. Unlike the phase, conditions are not expected to be monotonic -- their values may change back and forth. A typical condition type is `Ready`, which indicates the object was believed to be fully operational at the time it was last probed. Conditions may carry additional information, such as the last probe time or last transition time. - -TODO(@vishh): Reason and Message. - -Phases and conditions are observations and not, themselves, state machines, nor do we define comprehensive state machines for objects with behaviors associated with state transitions. The system is level-based and should assume an Open World. Additionally, new observations and details about these observations may be added over time. - -In order to preserve extensibility, in the future, we intend to explicitly convey properties that users and components care about rather than requiring those properties to be inferred from observations. - -Note that historical information status (e.g., last transition time, failure counts) is only provided at best effort, and is not guaranteed to not be lost. - -Status information that may be large (especially unbounded in size, such as lists of references to other objects -- see below) and/or rapidly changing, such as [resource usage](resources.md#usage-data), should be put into separate objects, with possibly a reference from the original object. This helps to ensure that GETs and watch remain reasonably efficient for the majority of clients, which may not need that data. - -#### References to related objects - -References to loosely coupled sets of objects, such as [pods](pods.md) overseen by a [replication controller](replication-controller.md), are usually best referred to using a [label selector](labels.md). In order to ensure that GETs of individual objects remain bounded in time and space, these sets may be queried via separate API queries, but will not be expanded in the referring object's status. - -References to specific objects, especially specific resource versions and/or specific fields of those objects, are specified using the `ObjectReference` type. Unlike partial URLs, the ObjectReference type facilitates flexible defaulting of fields from the referring object or other contextual information. - -References in the status of the referee to the referrer may be permitted, when the references are one-to-one and do not need to be frequently updated, particularly in an edge-based manner. - -#### Lists of named subobjects preferred over maps - -Discussed in [#2004](https://github.com/GoogleCloudPlatform/kubernetes/issues/2004) and elsewhere. There are no maps of subobjects in any API objects. Instead, the convention is to use a list of subobjects containing name fields. - -For example: -```yaml -ports: - - name: www - containerPort: 80 -``` -vs. -```yaml -ports: - www: - containerPort: 80 -``` - -This rule maintains the invariant that all JSON/YAML keys are fields in API objects. The only exceptions are pure maps in the API (currently, labels, selectors, and annotations), as opposed to sets of subobjects. - -#### Constants - -Some fields will have a list of allowed values (enumerations). These values will be strings, and they will be in CamelCase, with an initial uppercase letter. Examples: "ClusterFirst", "Pending", "ClientIP". - -### Lists and Simple kinds - -Every list or simple kind SHOULD have the following metadata in a nested object field called "metadata": - -* resourceVersion: a string that identifies the common version of the objects returned by in a list. This value MUST be treated as opaque by clients and passed unmodified back to the server. A resource version is only valid within a single namespace on a single kind of resource. - -Every simple kind returned by the server, and any simple kind sent to the server that must support idempotency or optimistic concurrency should return this value.Since simple resources are often used as input alternate actions that modify objects, the resource version of the simple resource should correspond to the resource version of the object. - - -Differing Representations -------------------------- - -An API may represent a single entity in different ways for different clients, or transform an object after certain transitions in the system occur. In these cases, one request object may have two representations available as different resources, or different kinds. - -An example is a Service, which represents the intent of the user to group a set of pods with common behavior on common ports. When Kubernetes detects a pod matches the service selector, the IP address and port of the pod are added to an Endpoints resource for that Service. The Endpoints resource exists only if the Service exists, but exposes only the IPs and ports of the selected pods. The full service is represented by two distinct resources - under the original Service resource the user created, as well as in the Endpoints resource. - -As another example, a "pod status" resource may accept a PUT with the "pod" kind, with different rules about what fields may be changed. - -Future versions of Kubernetes may allow alternative encodings of objects beyond JSON. - - -Verbs on Resources ------------------- - -API resources should use the traditional REST pattern: - -* GET /<resourceNamePlural> - Retrieve a list of type <resourceName>, e.g. GET /pods returns a list of Pods. -* POST /<resourceNamePlural> - Create a new resource from the JSON object provided by the client. -* GET /<resourceNamePlural>/<name> - Retrieves a single resource with the given name, e.g. GET /pods/first returns a Pod named 'first'. Should be constant time, and the resource should be bounded in size. -* DELETE /<resourceNamePlural>/<name> - Delete the single resource with the given name. DeleteOptions may specify gracePeriodSeconds, the optional duration in seconds before the object should be deleted. Individual kinds may declare fields which provide a default grace period, and different kinds may have differing kind-wide default grace periods. A user provided grace period overrides a default grace period, including the zero grace period ("now"). -* PUT /<resourceNamePlural>/<name> - Update or create the resource with the given name with the JSON object provided by the client. -* PATCH /<resourceNamePlural>/<name> - Selectively modify the specified fields of the resource. See more information [below](#patch). - -Kubernetes by convention exposes additional verbs as new root endpoints with singular names. Examples: - -* GET /watch/<resourceNamePlural> - Receive a stream of JSON objects corresponding to changes made to any resource of the given kind over time. -* GET /watch/<resourceNamePlural>/<name> - Receive a stream of JSON objects corresponding to changes made to the named resource of the given kind over time. - -These are verbs which change the fundamental type of data returned (watch returns a stream of JSON instead of a single JSON object). Support of additional verbs is not required for all object types. - -Two additional verbs `redirect` and `proxy` provide access to cluster resources as described in [accessing-the-cluster.md](accessing-the-cluster.md). - -When resources wish to expose alternative actions that are closely coupled to a single resource, they should do so using new sub-resources. An example is allowing automated processes to update the "status" field of a Pod. The `/pods` endpoint only allows updates to "metadata" and "spec", since those reflect end-user intent. An automated process should be able to modify status for users to see by sending an updated Pod kind to the server to the "/pods/<name>/status" endpoint - the alternate endpoint allows different rules to be applied to the update, and access to be appropriately restricted. Likewise, some actions like "stop" or "scale" are best represented as REST sub-resources that are POSTed to. The POST action may require a simple kind to be provided if the action requires parameters, or function without a request body. - -TODO: more documentation of Watch - -### PATCH operations - -The API supports three different PATCH operations, determined by their corresponding Content-Type header: - -* JSON Patch, `Content-Type: application/json-patch+json` - * As defined in [RFC6902](https://tools.ietf.org/html/rfc6902), a JSON Patch is a sequence of operations that are executed on the resource, e.g. `{"op": "add", "path": "/a/b/c", "value": [ "foo", "bar" ]}`. For more details on how to use JSON Patch, see the RFC. -* Merge Patch, `Content-Type: application/merge-json-patch+json` - * As defined in [RFC7386](https://tools.ietf.org/html/rfc7386), a Merge Patch is essentially a partial representation of the resource. The submitted JSON is "merged" with the current resource to create a new one, then the new one is saved. For more details on how to use Merge Patch, see the RFC. -* Strategic Merge Patch, `Content-Type: application/strategic-merge-patch+json` - * Strategic Merge Patch is a custom implementation of Merge Patch. For a detailed explanation of how it works and why it needed to be introduced, see below. - -#### Strategic Merge Patch - -In the standard JSON merge patch, JSON objects are always merged but lists are always replaced. Often that isn't what we want. Let's say we start with the following Pod: - -```yaml -spec: - containers: - - name: nginx - image: nginx-1.0 -``` - -...and we POST that to the server (as JSON). Then let's say we want to *add* a container to this Pod. - -```yaml -PATCH /api/v1/namespaces/default/pods/pod-name -spec: - containers: - - name: log-tailer - image: log-tailer-1.0 -``` - -If we were to use standard Merge Patch, the entire container list would be replaced with the single log-tailer container. However, our intent is for the container lists to merge together based on the `name` field. - -To solve this problem, Strategic Merge Patch uses metadata attached to the API objects to determine what lists should be merged and which ones should not. Currently the metadata is available as struct tags on the API objects themselves, but will become available to clients as Swagger annotations in the future. In the above example, the `patchStrategy` metadata for the `containers` field would be `merge` and the `patchMergeKey` would be `name`. - -Note: If the patch results in merging two lists of scalars, the scalars are first deduplicated and then merged. - -Strategic Merge Patch also supports special operations as listed below. - -### List Operations - -To override the container list to be strictly replaced, regardless of the default: - -```yaml -containers: - - name: nginx - image: nginx-1.0 - - $patch: replace # any further $patch operations nested in this list will be ignored -``` - -To delete an element of a list that should be merged: - -```yaml -containers: - - name: nginx - image: nginx-1.0 - - $patch: delete - name: log-tailer # merge key and value goes here -``` - -### Map Operations - -To indicate that a map should not be merged and instead should be taken literally: - -```yaml -$patch: replace # recursive and applies to all fields of the map it's in -containers: -- name: nginx - image: nginx-1.0 -``` - -To delete a field of a map: - -```yaml -name: nginx -image: nginx-1.0 -labels: - live: null # set the value of the map key to null -``` - - -Idempotency ------------ - -All compatible Kubernetes APIs MUST support "name idempotency" and respond with an HTTP status code 409 when a request is made to POST an object that has the same name as an existing object in the system. See [identifiers.md](identifiers.md) for details. - -Names generated by the system may be requested using `metadata.generateName`. GenerateName indicates that the name should be made unique by the server prior to persisting it. A non-empty value for the field indicates the name will be made unique (and the name returned to the client will be different than the name passed). The value of this field will be combined with a unique suffix on the server if the Name field has not been provided. The provided value must be valid within the rules for Name, and may be truncated by the length of the suffix required to make the value unique on the server. If this field is specified, and Name is not present, the server will NOT return a 409 if the generated name exists - instead, it will either return 201 Created or 504 with Reason `ServerTimeout` indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). - -Defaulting ----------- - -Default resource values are API version-specific, and they are applied during -the conversion from API-versioned declarative configuration to internal objects -representing the desired state (`Spec`) of the resource. Subsequent GETs of the -resource will include the default values explicitly. - -Incorporating the default values into the `Spec` ensures that `Spec` depicts the -full desired state so that it is easier for the system to determine how to -achieve the state, and for the user to know what to anticipate. - -API version-specific default values are set by the API server. - -Late Initialization -------------------- -Late initialization is when resource fields are set by a system controller -after an object is created/updated. - -For example, the scheduler sets the `pod.spec.nodeName` field after the pod is created. - -Late-initializers should only make the following types of modifications: - - Setting previously unset fields - - Adding keys to maps - - Adding values to arrays which have mergeable semantics (`patchStrategy:"merge"` attribute in - the type definition). - -These conventions: - 1. allow a user (with sufficient privilege) to override any system-default behaviors by setting - the fields that would otherwise have been defaulted. - 1. enables updates from users to be merged with changes made during late initialization, using - strategic merge patch, as opposed to clobbering the change. - 1. allow the component which does the late-initialization to use strategic merge patch, which - facilitates composition and concurrency of such components. - -Although the apiserver Admission Control stage acts prior to object creation, -Admission Control plugins should follow the Late Initialization conventions -too, to allow their implementation to be later moved to a 'controller', or to client libraries. - -Concurrency Control and Consistency ------------------------------------ - -Kubernetes leverages the concept of *resource versions* to achieve optimistic concurrency. All Kubernetes resources have a "resourceVersion" field as part of their metadata. This resourceVersion is a string that identifies the internal version of an object that can be used by clients to determine when objects have changed. When a record is about to be updated, it's version is checked against a pre-saved value, and if it doesn't match, the update fails with a StatusConflict (HTTP status code 409). - -The resourceVersion is changed by the server every time an object is modified. If resourceVersion is included with the PUT operation the system will verify that there have not been other successful mutations to the resource during a read/modify/write cycle, by verifying that the current value of resourceVersion matches the specified value. - -The resourceVersion is currently backed by [etcd's modifiedIndex](https://coreos.com/docs/distributed-configuration/etcd-api/). However, it's important to note that the application should *not* rely on the implementation details of the versioning system maintained by Kubernetes. We may change the implementation of resourceVersion in the future, such as to change it to a timestamp or per-object counter. - -The only way for a client to know the expected value of resourceVersion is to have received it from the server in response to a prior operation, typically a GET. This value MUST be treated as opaque by clients and passed unmodified back to the server. Clients should not assume that the resource version has meaning across namespaces, different kinds of resources, or different servers. Currently, the value of resourceVersion is set to match etcd's sequencer. You could think of it as a logical clock the API server can use to order requests. However, we expect the implementation of resourceVersion to change in the future, such as in the case we shard the state by kind and/or namespace, or port to another storage system. - -In the case of a conflict, the correct client action at this point is to GET the resource again, apply the changes afresh, and try submitting again. This mechanism can be used to prevent races like the following: - -``` -Client #1 Client #2 -GET Foo GET Foo -Set Foo.Bar = "one" Set Foo.Baz = "two" -PUT Foo PUT Foo -``` - -When these sequences occur in parallel, either the change to Foo.Bar or the change to Foo.Baz can be lost. - -On the other hand, when specifying the resourceVersion, one of the PUTs will fail, since whichever write succeeds changes the resourceVersion for Foo. - -resourceVersion may be used as a precondition for other operations (e.g., GET, DELETE) in the future, such as for read-after-write consistency in the presence of caching. - -"Watch" operations specify resourceVersion using a query parameter. It is used to specify the point at which to begin watching the specified resources. This may be used to ensure that no mutations are missed between a GET of a resource (or list of resources) and a subsequent Watch, even if the current version of the resource is more recent. This is currently the main reason that list operations (GET on a collection) return resourceVersion. - - -Serialization Format --------------------- - -APIs may return alternative representations of any resource in response to an Accept header or under alternative endpoints, but the default serialization for input and output of API responses MUST be JSON. - -All dates should be serialized as RFC3339 strings. - - -Units ------ - -Units must either be explicit in the field name (e.g., `timeoutSeconds`), or must be specified as part of the value (e.g., `resource.Quantity`). Which approach is preferred is TBD. - - -Selecting Fields ----------------- - -Some APIs may need to identify which field in a JSON object is invalid, or to reference a value to extract from a separate resource. The current recommendation is to use standard JavaScript syntax for accessing that field, assuming the JSON object was transformed into a JavaScript object. - -Examples: - -* Find the field "current" in the object "state" in the second item in the array "fields": `fields[0].state.current` - -TODO: Plugins, extensions, nested kinds, headers - - -HTTP Status codes ------------------ - -The server will respond with HTTP status codes that match the HTTP spec. See the section below for a breakdown of the types of status codes the server will send. - -The following HTTP status codes may be returned by the API. - -#### Success codes - -* `200 StatusOK` - * Indicates that the request completed successfully. -* `201 StatusCreated` - * Indicates that the request to create kind completed successfully. -* `204 StatusNoContent` - * Indicates that the request completed successfully, and the response contains no body. - * Returned in response to HTTP OPTIONS requests. - -#### Error codes -* `307 StatusTemporaryRedirect` - * Indicates that the address for the requested resource has changed. - * Suggested client recovery behavior - * Follow the redirect. -* `400 StatusBadRequest` - * Indicates the requested is invalid. - * Suggested client recovery behavior: - * Do not retry. Fix the request. -* `401 StatusUnauthorized` - * Indicates that the server can be reached and understood the request, but refuses to take any further action, because the client must provide authorization. If the client has provided authorization, the server is indicating the provided authorization is unsuitable or invalid. - * Suggested client recovery behavior - * If the user has not supplied authorization information, prompt them for the appropriate credentials - * If the user has supplied authorization information, inform them their credentials were rejected and optionally prompt them again. -* `403 StatusForbidden` - * Indicates that the server can be reached and understood the request, but refuses to take any further action, because it is configured to deny access for some reason to the requested resource by the client. - * Suggested client recovery behavior - * Do not retry. Fix the request. -* `404 StatusNotFound` - * Indicates that the requested resource does not exist. - * Suggested client recovery behavior - * Do not retry. Fix the request. -* `405 StatusMethodNotAllowed` - * Indicates that that the action the client attempted to perform on the resource was not supported by the code. - * Suggested client recovery behavior - * Do not retry. Fix the request. -* `409 StatusConflict` - * Indicates that either the resource the client attempted to create already exists or the requested update operation cannot be completed due to a conflict. - * Suggested client recovery behavior - * * If creating a new resource - * * Either change the identifier and try again, or GET and compare the fields in the pre-existing object and issue a PUT/update to modify the existing object. - * * If updating an existing resource: - * See `Conflict` from the `status` response section below on how to retrieve more information about the nature of the conflict. - * GET and compare the fields in the pre-existing object, merge changes (if still valid according to preconditions), and retry with the updated request (including `ResourceVersion`). -* `422 StatusUnprocessableEntity` - * Indicates that the requested create or update operation cannot be completed due to invalid data provided as part of the request. - * Suggested client recovery behavior - * Do not retry. Fix the request. -* `429 StatusTooManyRequests` - * Indicates that the either the client rate limit has been exceeded or the server has received more requests then it can process. - * Suggested client recovery behavior: - * Read the ```Retry-After``` HTTP header from the response, and wait at least that long before retrying. -* `500 StatusInternalServerError` - * Indicates that the server can be reached and understood the request, but either an unexpected internal error occurred and the outcome of the call is unknown, or the server cannot complete the action in a reasonable time (this maybe due to temporary server load or a transient communication issue with another server). - * Suggested client recovery behavior: - * Retry with exponential backoff. -* `503 StatusServiceUnavailable` - * Indicates that required service is unavailable. - * Suggested client recovery behavior: - * Retry with exponential backoff. -* `504 StatusServerTimeout` - * Indicates that the request could not be completed within the given time. Clients can get this response ONLY when they specified a timeout param in the request. - * Suggested client recovery behavior: - * Increase the value of the timeout param and retry with exponential backoff - -Response Status Kind --------------------- - -Kubernetes will always return the ```Status``` kind from any API endpoint when an error occurs. -Clients SHOULD handle these types of objects when appropriate. - -A ```Status``` kind will be returned by the API in two cases: - * When an operation is not successful (i.e. when the server would return a non 2xx HTTP status code). - * When a HTTP ```DELETE``` call is successful. - -The status object is encoded as JSON and provided as the body of the response. The status object contains fields for humans and machine consumers of the API to get more detailed information for the cause of the failure. The information in the status object supplements, but does not override, the HTTP status code's meaning. When fields in the status object have the same meaning as generally defined HTTP headers and that header is returned with the response, the header should be considered as having higher priority. - -**Example:** -``` -$ curl -v -k -H "Authorization: Bearer WhCDvq4VPpYhrcfmF6ei7V9qlbqTubUc" https://10.240.122.184:443/api/v1/namespaces/default/pods/grafana - -> GET /api/v1/namespaces/default/pods/grafana HTTP/1.1 -> User-Agent: curl/7.26.0 -> Host: 10.240.122.184 -> Accept: */* -> Authorization: Bearer WhCDvq4VPpYhrcfmF6ei7V9qlbqTubUc -> - -< HTTP/1.1 404 Not Found -< Content-Type: application/json -< Date: Wed, 20 May 2015 18:10:42 GMT -< Content-Length: 232 -< -{ - "kind": "Status", - "apiVersion": "v1", - "metadata": {}, - "status": "Failure", - "message": "pods \"grafana\" not found", - "reason": "NotFound", - "details": { - "name": "grafana", - "kind": "pods" - }, - "code": 404 -} -``` - -```status``` field contains one of two possible values: -* `Success` -* `Failure` - -`message` may contain human-readable description of the error - -```reason``` may contain a machine-readable description of why this operation is in the `Failure` status. If this value is empty there is no information available. The `reason` clarifies an HTTP status code but does not override it. - -```details``` may contain extended data associated with the reason. Each reason may define its own extended details. This field is optional and the data returned is not guaranteed to conform to any schema except that defined by the reason type. - -Possible values for the ```reason``` and ```details``` fields: -* `BadRequest` - * Indicates that the request itself was invalid, because the request doesn't make any sense, for example deleting a read-only object. - * This is different than `status reason` `Invalid` above which indicates that the API call could possibly succeed, but the data was invalid. - * API calls that return BadRequest can never succeed. - * Http status code: `400 StatusBadRequest` -* `Unauthorized` - * Indicates that the server can be reached and understood the request, but refuses to take any further action without the client providing appropriate authorization. If the client has provided authorization, this error indicates the provided credentials are insufficient or invalid. - * Details (optional): - * `kind string` - * The kind attribute of the unauthorized resource (on some operations may differ from the requested resource). - * `name string` - * The identifier of the unauthorized resource. - * HTTP status code: `401 StatusUnauthorized` -* `Forbidden` - * Indicates that the server can be reached and understood the request, but refuses to take any further action, because it is configured to deny access for some reason to the requested resource by the client. - * Details (optional): - * `kind string` - * The kind attribute of the forbidden resource (on some operations may differ from the requested resource). - * `name string` - * The identifier of the forbidden resource. - * HTTP status code: `403 StatusForbidden` -* `NotFound` - * Indicates that one or more resources required for this operation could not be found. - * Details (optional): - * `kind string` - * The kind attribute of the missing resource (on some operations may differ from the requested resource). - * `name string` - * The identifier of the missing resource. - * HTTP status code: `404 StatusNotFound` -* `AlreadyExists` - * Indicates that the resource you are creating already exists. - * Details (optional): - * `kind string` - * The kind attribute of the conflicting resource. - * `name string` - * The identifier of the conflicting resource. - * HTTP status code: `409 StatusConflict` -* `Conflict` - * Indicates that the requested update operation cannot be completed due to a conflict. The client may need to alter the request. Each resource may define custom details that indicate the nature of the conflict. - * HTTP status code: `409 StatusConflict` -* `Invalid` - * Indicates that the requested create or update operation cannot be completed due to invalid data provided as part of the request. - * Details (optional): - * `kind string` - * the kind attribute of the invalid resource - * `name string` - * the identifier of the invalid resource - * `causes` - * One or more `StatusCause` entries indicating the data in the provided resource that was invalid. The `reason`, `message`, and `field` attributes will be set. - * HTTP status code: `422 StatusUnprocessableEntity` -* `Timeout` - * Indicates that the request could not be completed within the given time. Clients may receive this response if the server has decided to rate limit the client, or if the server is overloaded and cannot process the request at this time. - * Http status code: `429 TooManyRequests` - * The server should set the `Retry-After` HTTP header and return `retryAfterSeconds` in the details field of the object. A value of `0` is the default. -* `ServerTimeout` - * Indicates that the server can be reached and understood the request, but cannot complete the action in a reasonable time. This maybe due to temporary server load or a transient communication issue with another server. - * Details (optional): - * `kind string` - * The kind attribute of the resource being acted on. - * `name string` - * The operation that is being attempted. - * The server should set the `Retry-After` HTTP header and return `retryAfterSeconds` in the details field of the object. A value of `0` is the default. - * Http status code: `504 StatusServerTimeout` -* `MethodNotAllowed` - * Indicates that that the action the client attempted to perform on the resource was not supported by the code. - * For instance, attempting to delete a resource that can only be created. - * API calls that return MethodNotAllowed can never succeed. - * Http status code: `405 StatusMethodNotAllowed` -* `InternalError` - * Indicates that an internal error occurred, it is unexpected and the outcome of the call is unknown. - * Details (optional): - * `causes` - * The original error. - * Http status code: `500 StatusInternalServerError` - -`code` may contain the suggested HTTP return code for this status. - - -Events ------- - -TODO: Document events (refer to another doc for details) - - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/api-conventions.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/api-conventions.md?pixel)]() diff --git a/release-0.20.0/docs/api.md b/release-0.20.0/docs/api.md deleted file mode 100644 index 267f4f45858..00000000000 --- a/release-0.20.0/docs/api.md +++ /dev/null @@ -1,78 +0,0 @@ -# The Kubernetes API - -Primary system and API concepts are documented in the [User guide](user-guide.md). - -Overall API conventions are described in the [API conventions doc](api-conventions.md). - -Complete API details are documented via [Swagger](http://swagger.io/). The Kubernetes apiserver (aka "master") exports an API that can be used to retrieve the [Swagger spec](https://github.com/swagger-api/swagger-spec/tree/master/schemas/v1.2) for the Kubernetes API, by default at `/swaggerapi`, and a UI you can use to browse the API documentation at `/swagger-ui`. We also periodically update a [statically generated UI](http://kubernetes.io/third_party/swagger-ui/). - -Remote access to the API is discussed in the [access doc](accessing_the_api.md). - -The Kubernetes API also serves as the foundation for the declarative configuration schema for the system. The [Kubectl](kubectl.md) command-line tool can be used to create, update, delete, and get API objects. - -Kubernetes also stores its serialized state (currently in [etcd](https://coreos.com/docs/distributed-configuration/getting-started-with-etcd/)) in terms of the API resources. - -Kubernetes itself is decomposed into multiple components, which interact through its API. - -## API changes - -In our experience, any system that is successful needs to grow and change as new use cases emerge or existing ones change. Therefore, we expect the Kubernetes API to continuously change and grow. However, we intend to not break compatibility with existing clients, for an extended period of time. In general, new API resources and new resource fields can be expected to be added frequently. Elimination of resources or fields will require following a deprecation process. The precise deprecation policy for eliminating features is TBD, but once we reach our 1.0 milestone, there will be a specific policy. - -What constitutes a compatible change and how to change the API are detailed by the [API change document](devel/api_changes.md). - -## API versioning - -Fine-grain resource evolution alone makes it difficult to eliminate fields or restructure resource representations. Therefore, Kubernetes supports multiple API versions, each at a different API path prefix, such as `/api/v1beta3`. These are simply different interfaces to read and/or modify the same underlying resources. In general, all API resources are accessible via all API versions, though there may be some cases in the future where that is not true. - -Distinct API versions present more clear, consistent views of system resources and behavior than intermingled, independently evolved resources. They also provide a more straightforward mechanism for controlling access to end-of-lifed and/or experimental APIs. - -The [API and release versioning proposal](versioning.md) describes the current thinking on the API version evolution process. - -## v1beta1, v1beta2, and v1beta3 are deprecated; please move to v1 ASAP - -As of June 4, 2015, the Kubernetes v1 API has been enabled by default. The v1beta1 and v1beta2 APIs were deleted on June 1, 2015. v1beta3 is planned to be deleted on July 6, 2015. - -### v1 conversion tips (from v1beta3) - -We're working to convert all documentation and examples to v1. A simple [API conversion tool](cluster_management.md#switching-your-config-files-to-a-new-api-version) has been written to simplify the translation process. Use `kubectl create --validate` in order to validate your json or yaml against our Swagger spec. - -Changes to services are the most significant difference between v1beta3 and v1. - -* The `service.spec.portalIP` property is renamed to `service.spec.clusterIP`. -* The `service.spec.createExternalLoadBalancer` property is removed. Specify `service.spec.type: "LoadBalancer"` to create an external load balancer instead. -* The `service.spec.publicIPs` property is deprecated and now called `service.spec.deprecatedPublicIPs`. This property will be removed entirely when v1beta3 is removed. The vast majority of users of this field were using it to expose services on ports on the node. Those users should specify `service.spec.type: "NodePort"` instead. Read [External Services](services.md#external-services) for more info. If this is not sufficient for your use case, please file an issue or contact @thockin. - -Some other difference between v1beta3 and v1: - -* The `pod.spec.containers[*].privileged` and `pod.spec.containers[*].capabilities` properties are now nested under the `pod.spec.containers[*].securityContext` property. See [Security Contexts](security_context.md). -* The `pod.spec.host` property is renamed to `pod.spec.nodeName`. -* The `endpoints.subsets[*].addresses.IP` property is renamed to `endpoints.subsets[*].addresses.ip`. -* The `pod.status.containerStatuses[*].state.termination` and `pod.status.containerStatuses[*].lastState.termination` properties are renamed to `pod.status.containerStatuses[*].state.terminated` and `pod.status.containerStatuses[*].lastState.terminated` respectively. -* The `pod.status.Condition` property is renamed to `pod.status.conditions`. -* The `status.details.id` property is renamed to `status.details.name`. - -### v1beta3 conversion tips (from v1beta1/2) - -Some important differences between v1beta1/2 and v1beta3: - -* The resource `id` is now called `name`. -* `name`, `labels`, `annotations`, and other metadata are now nested in a map called `metadata` -* `desiredState` is now called `spec`, and `currentState` is now called `status` -* `/minions` has been moved to `/nodes`, and the resource has kind `Node` -* The namespace is required (for all namespaced resources) and has moved from a URL parameter to the path: `/api/v1beta3/namespaces/{namespace}/{resource_collection}/{resource_name}`. If you were not using a namespace before, use `default` here. -* The names of all resource collections are now lower cased - instead of `replicationControllers`, use `replicationcontrollers`. -* To watch for changes to a resource, open an HTTP or Websocket connection to the collection query and provide the `?watch=true` query parameter along with the desired `resourceVersion` parameter to watch from. -* The `labels` query parameter has been renamed to `labelSelector`. -* The `fields` query parameter has been renamed to `fieldSelector`. -* The container `entrypoint` has been renamed to `command`, and `command` has been renamed to `args`. -* Container, volume, and node resources are expressed as nested maps (e.g., `resources{cpu:1}`) rather than as individual fields, and resource values support [scaling suffixes](resources.md#resource-quantities) rather than fixed scales (e.g., milli-cores). -* Restart policy is represented simply as a string (e.g., `"Always"`) rather than as a nested map (`always{}`). -* Pull policies changed from `PullAlways`, `PullNever`, and `PullIfNotPresent` to `Always`, `Never`, and `IfNotPresent`. -* The volume `source` is inlined into `volume` rather than nested. -* Host volumes have been changed from `hostDir` to `hostPath` to better reflect that they can be files or directories. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/api.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/api.md?pixel)]() diff --git a/release-0.20.0/docs/application-troubleshooting.md b/release-0.20.0/docs/application-troubleshooting.md deleted file mode 100644 index edc90c83f5e..00000000000 --- a/release-0.20.0/docs/application-troubleshooting.md +++ /dev/null @@ -1,149 +0,0 @@ -# Application Troubleshooting. - -This guide is to help users debug applications that are deployed into Kubernetes and not behaving correctly. -This is *not* a guide for people who want to debug their cluster. For that you should check out -[this guide](cluster-troubleshooting.md) - -## FAQ -Users are highly encouraged to check out our [FAQ](https://github.com/GoogleCloudPlatform/kubernetes/wiki/User-FAQ) - -## Diagnosing the problem -The first step in troubleshooting is triage. What is the problem? Is it your Pods, your Replication Controller or -your Service? - * [Debugging Pods](#debugging-pods) - * [Debugging Replication Controllers](#debugging-replication-controllers) - * [Debugging Services](#debugging-services) - -### Debugging Pods -The first step in debugging a Pod is taking a look at it. For the purposes of example, imagine we have a pod -```my-pod``` which holds two containers ```container-1``` and ```container-2``` - -First, describe the pod. This will show the current state of the Pod and recent events. - -```sh -export POD_NAME=my-pod -kubectl describe pods ${POD_NAME} -``` - -Look at the state of the containers in the pod. Are they all ```Running```? Have there been recent restarts? - -Depending on the state of the pod, you may want to: - * [Debug a pending pod](#debugging-pending-pods) - * [Debug a waiting pod](#debugging-waiting-pods) - * [Debug a crashing pod](#debugging-crashing-pods-or-otherwise-unhealthy-pods) - -#### Debuging Pending Pods -If a Pod is stuck in ```Pending``` it means that it can not be scheduled onto a node. Generally this is because -there are insufficient resources of one type or another that prevent scheduling. Look at the output of the -```kubectl describe ...``` command above. There should be messages from the scheduler about why it can not schedule -your pod. Reasons include: - -You don't have enough resources. You may have exhausted the supply of CPU or Memory in your cluster, in this case -you need to delete Pods, adjust resource requests, or add new nodes to your cluster. - -You are using ```hostPort```. When you bind a Pod to a ```hostPort``` there are a limited number of places that pod can be -scheduled. In most cases, ```hostPort``` is unnecesary, try using a Service object to expose your Pod. If you do require -```hostPort``` then you can only schedule as many Pods as there are nodes in your Kubernetes cluster. - - -#### Debugging Waiting Pods -If a Pod is stuck in the ```Waiting``` state, then it has been scheduled to a worker node, but it can't run on that machine. -Again, the information from ```kubectl describe ...``` should be informative. The most common cause of ```Waiting``` pods -is a failure to pull the image. Make sure that you have the name of the image correct. Have you pushed it to the repository? -Does it work if you run a manual ```docker pull ``` on your machine? - -#### Debugging Crashing or otherwise unhealthy pods - -Let's suppose that ```container-2``` has been crash looping and you don't know why, you can take a look at the logs of -the current container: - -```sh -kubectl logs ${POD_NAME} ${CONTAINER_NAME} -``` - -If your container has previously crashed, you can access the previous container's crash log with: -```sh -kubectl logs --previous ${POD_NAME} ${CONTAINER_NAME} -``` - -Alternately, you can run commands inside that container with ```exec```: - -```sh -kubectl exec ${POD_NAME} -c ${CONTAINER_NAME} -- ${CMD} ${ARG1} ${ARG2} ... ${ARGN} -``` - -Note that ```-c ${CONTAINER_NAME}``` is optional and can be omitted for Pods that only contain a single container. - -As an example, to look at the logs from a running Cassandra pod, you might run -```sh -kubectl exec cassandra -- cat /var/log/cassandra/system.log -``` - - -If none of these approaches work, you can find the host machine that the pod is running on and SSH into that host, -but this should generally not be necessary given tools in the Kubernetes API. Indeed if you find yourself needing to ssh into a machine, please file a -feature request on GitHub describing your use case and why these tools are insufficient. - -### Debugging Replication Controllers -Replication controllers are fairly straightforward. They can either create Pods or they can't. If they can't -create pods, then please refer to the [instructions above](#debugging-pods) - -You can also use ```kubectl describe rc ${CONTROLLER_NAME}``` to introspect events related to the replication -controller. - -### Debugging Services -Services provide load balancing across a set of pods. There are several common problems that can make Services -not work properly. The following instructions should help debug Service problems. - -#### Verify that there are endpoints for the service -For every Service object, the apiserver makes an ```endpoints`` resource available. - -You can view this resource with: - -``` -kubectl get endpoints ${SERVICE_NAME} -``` - -Make sure that the endpoints match up with the number of containers that you expect to be a member of your service. -For example, if your Service is for an nginx container with 3 replicas, you would expect to see three different -IP addresses in the Service's endpoints. - -#### Missing endpoints -If you are missing endpoints, try listing pods using the labels that Service uses. Imagine that you have -a Service where the labels are: -```yaml -... -spec: - - selector: - name: nginx - type: frontend -``` - -You can use: -``` -kubectl get pods --selector=name=nginx,type=frontend -``` - -to list pods that match this selector. Verify that the list matches the Pods that you expect to provide your Service. - -If the list of pods matches expectations, but your endpoints are still empty, it's possible that you don't -have the right ports exposed. If your service has a ```containerPort``` specified, but the Pods that are -selected don't have that port listed, then they won't be added to the endpoints list. - -Verify that the pod's ```containerPort``` matches up with the Service's ```containerPort``` - -#### Network traffic isn't forwarded -If you can connect to the service, but the connection is immediately dropped, and there are endpoints -in the endpoints list, it's likely that the proxy can't contact your pods. - -There are three things to -check: - * Are your pods working correctly? Look for restart count, and [debug pods](#debugging-pods) - * Can you connect to your pods directly? Get the IP address for the Pod, and try to connect directly to that IP - * Is your application serving on the port that you configured? Kubernetes doesn't do port remapping, so if your application serves on 8080, the ```containerPort``` field needs to be 8080. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/application-troubleshooting.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/application-troubleshooting.md?pixel)]() diff --git a/release-0.20.0/docs/architecture.dia b/release-0.20.0/docs/architecture.dia deleted file mode 100644 index 26e0eed22e6ffdc7781055de4dfcc1e8d2b968d4..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6522 zcmV-=8HMH_iwFP!000021MOW~Z{x<2e)q2sJTEzbrp>-oUyjb?AUV6iIY2fWY_ix# zgO)fR?Z}cL(Q|v)-@e_XWLpv`QS5G-@|1y@gdT~drmE_zs{Xp_Z-4)CHyeD)maFMv z{_c{JT-S5`FP4j#?y?My9!92ao z-d*0L}HvzAM0#wi^VKU=cUwq`H;1jvl^!}t6~S2)&B19r+L0O^7-GVvsIG?l)rwoxKpk7b~&9K zHr}mQ)ZFFsbdrC#{&MJX(e{t4y!+QkcmFh9O>bsd)u*4%^I*6C8s_%9-%jDdpWg1N z4dvZxA!4F4$l!E{xP6#Tvegka+kQ>Woj$Bzc6IEj@4l|-gDHQt1K5R#S^70wu5bVI z6I2h@U+~)F4AOBv{j|Ay_DmKx|C^2T^aaU+}(VV?hR4_P0w>FtNSUKlm@`6bVOL_1-t z4~x&&6~W_iRIIk(t0#4Bt-sV;e+3akD(w@BslkG9uu?{n6JhmN*}tPIu;-$hs4z1z zRhHTZc8*&5XZ9t3rlxeQrYwM(It`+P#aGjWfR=p3t^NqEoKUV!%Wpe(&*MmFvGba` z@3qLqwqCcBy8X78WHpJ~foP{LbY9H!Dq-&TgZJs(boSMLrgXl#9IW!M4wkJ;D&P9g zZ1yS3r{nZ_^lW* z4|nTF*-%PlfOncvd@4TDu30>N6du4Q{W4p89)C!ec`bBuZ=WOyl}-~>RP3};Xdz|9 zZA@l{lt+&Ke3#WI03<@k#7|;s-NFlkX>Db1GTHX+du|T;4?iCtZtQoHBLYQ7AVsVf zU_={uT@XYgKv0k@O9X(5#5!?JMBF?Jh>=bV2N((KW95(mp$SCB3(vJR0SucmZdn1BAQw9x_kg!DYmzW!(|CunQPtTxI#mkNPN5kA!R#e>mr+$ZzzUlvwXhbt zT?gwjCZZS<#g2)_HdaZe^V$tnjEaIqMIs?gI^U3BR1_pCI*ugL8%Zpx8|P&OjSC|} zI4N8@46$(T)P&2Z2;#dkgb#!dgpUrBYC{xr!KDo{0THAl1W^GJYomrNA%;dS!W!np zXle5h>(zCkDfTLIX6?B+L=i-hH{+ispQft?f=Cx2!jck15{VcRxHenEEzsT=Vxgb9 zSY7d$5VDa%IgB1Jv}R}ELC|w_5q|FJAkqptr4>9rsQKKQuJtjiJ@eZ9%ix3cN^AAZ z7sU?I;OSrAUFv;8?9NTY_&yV$0^`^PCbI9_NGW`uCQMn7w3p}M{eE9e&;fR^slBg= z=m7h`t8yvU{g&VpIm*eg(+2x~YF|MBh~RtM%%`3b*>hLb4$BJTdb5!(ZKALDHquX( zT%GdAT4!bAf6}IUD~T1(<%F&ElMj#876CjCs_h#=yV4e=LA2iOT~zEu$I^R6xOv)f zmsYB**l~}h`+-*5O#2TNz9MP=q4HNRw7+p7>~JaU#?3<*X9#rjM@M-+)C zVTC7k+i40p66j4Ed(#?aMQ?gmB#9G?8q9l4nDaDR2{*k)MC@nd#PCuKFDe<_FyRLC z@TmPD{a4p$u$^ajeQW{Q!xl!%#h0(x#3*_XdQA)!#c&=F*hILaCc?~nlAAlV2LMAs zBoi_F2-~p6l!8DB7*TN5Z#k63WlZP@vBD#?-n*fEPZcWOOxJH#+izw;`g%7=X=Q*)Xri@hpGMSF^sE`%pDK^0@D@Yj1ff+`bGN5Qg%yI>7i;9X-&4DxC79eLf(>We4(j>?Z zVj;|ViihRCTGacGQ$)O<&Sninyf1$G4D-daDv+u^7fJRa>t{htwCEy`GISYj{A-?P z)=%UZZA6bYY--P_7`~;1g3&mXuWiNa{cL)F{b8}3eskv=W(U2@`*gNy>1GNsHh6Ig z8BNIQ;bvuTpIx^0R)Okw-lGd`Fs+2)Lzi*`6*^{2rilPhRutGsjERvoEvgK)$+tEj zBNy`O7h0cTcvS_kp4ZoU9^0wO(NpSqOvWhaH86D(z|;$^1|nk@^fUpRWjRTl)56f1 z)Q)uslVjc7-nI$FmVdh zbyou_JFxMJMb@6F+HLuU7XB(MocUPz?ujhgm4#Dp3pYeEEu&kwAs~~&#u#VZb^B&a zm&T-oif!SQi>zxajRyW*7`Qmez>~-ZUcK?oy^kQhWkeM?%3^YAoRqaO!-#=R&4*kO z#Z^=mx%b){oj=kf*=n95V(zsY*I4sevliWpB77KK_C6Q!)~0+#zn<25)l8YKm_m-y zR-37Gs%^D^>d4ycy}BmqY|VvksdLN|5sL8b`Z_-wbv{mt;@(_rnvg_-8Ztu^1rt%F zog`XHk`l~_Iu4}0=Crtusn$Uj*+jD~-mopr##5uOixjoY?q}0+TEu6rt<`cdn;qzD zg`1Y4j{0z7cw(J}>y(!m+_UWF94Ysv(+i@65Ulv(45*mtJ&|T3$>Pe$hOr4X_L>#f zQ5j4j7TE+}gbijC_`7^0-S!k;{uqDACJzWH9YBh-wyLRe{vi>GLP+TdQvA5*AIk>rBu=z7k@E{f84wR}fBK6P!>zXf26CtY;khGm|LY;UHrr9<2cQ;$#7uxa&>P_a56~8 z%f)InxJ$<$rt@qyyhv9AcZkHjZgBH;FrGaW_gPK9WduD_Y|m7y;Mn1y&m9ix9G*8r zngQWL2!~VUJ z(GQ{@e9eCFcs*4l{;gg$2hH7NOu^!|dR2NYh^wO2t1vsn>Yd7p6eJ2|LfoX`19h2`^9869IUeCr|H<0HiR|FuHj5uLPAt%$fIaE3!E zgzzuXm*m3uoM+~ypeW%&TLDasWYH^w6_T|Sk(*@HuCoSQW&3mY*d?R4(<$m3(j9M- zArAD=iP{E7!1)-tB#EK4upcd?7?~ouRcj-c{V{S)jMlEqFNr}zM?-&Z=)2u;y6R{r zybmyK4l{SqbAejRrnEG4*K@(0ETW<#L$6)uf&Dx*^w((UBBY^rhUnf$OCI+WnEfxr z?X9AWfI<-CYE(3)b^D#10FU0hvTm6N%-n;BgJ#}WGZ)mSf90;7cZTQQ2PzzqO{|G* zQ8%HiAg+KHa1NkGZeV1h9c@&KwtcOdTY1eYD^l~s;=Wd1#Of$kzRJ^Oe$39f_r2p8 z`g0+nOdVZe3|F`tw7@B@aFtiDyJ{U$ky>000HA#0jUJ4%Z{G5H8X3H95ha_0s1F_Q^8~12d%-hhCvk`YC zL?;%Kw&jzX?AvwokOz(?HpU(0XANG-DKQ{nNO!2H6|XE-Nj)g5CB5j{>BZ`l8FiKa zhJh9aTKx~SbQ1^6tLLCYM`0HDPfQ?EJN{v8$7|&jJV!w^wSL!TenLrJc;5JBrJ6+^ zINs&)I55WQt%b7|7G76WQXQR62No)mvZkiuW>RZGj;Ls0^dwg?g@@CTiB_kGNJTrF z!|8izYFAA?4ZSCr7of$ zJVQz@cvEt@vFV8_=DA5uW44WSl32o=B#?rS+^k3;=z4Bl>@2Kyoj9EG`{MA_hY&rO zO<5OzK#1wH?ihxOy0O2JLW{YxJSk6psB;KD2zGFd9(YtLA;ukNlYi0L3RYb2=gm|G zPI&2yVtT)|6pLSm!3YGAqT~{ugZKO1+#e;Ew=-#hV3DNtVW7efYWL=`j zMIdg*1-*ngEr$AJ)y?nJKhxwC=qf?H8(~cvFM9#ZMa3tnK|1XD*{c5}~bI1K|GkYbu`X z=p7~weNG&z+XPB)sxs$8&SN?sMhpy#zeiFKfFUqKV|E7gSW%OXfSi)8hJc3091Uqm z0{v@c9!7V)$)0Xp+|b5@QCVPC2!le(NEY=LNLm;D8Y-~ovYKcyGcmQ6+UInRidqxm zNftm;oe~Km<7=wxWMM-+aEDRdl{$-X@3+My!;mj}$XB6<829xq?mONeT5|ualO%Fz z-2{z_o>mGiq>Nnc*bKRf9R2w&t5FO{+Omt<4FtylHqr6tpZgPa6=n$lcc7vUn z0qp)9xchSrR`^poZ7@lPf?92f3Kl@LbYc|1NZ4e{UTAleIVxayudNAUC?dAZ3{*t? zkVHZVVK0!3HHdt?nTyr~8Kz(;z!3^#>a!}SicS!78qJ6hHvAUKT}IXE04r=Z9YbtS z$1q(+MHHi=*in(2-Iq@1c!s6}Dr@4JS_nx5#zh?sS&}jUlyEZ?t_wh19O1%AQF0`l z8w95(N=Akdzm*|=AbuczbeLDW!*HyK`3xY0bOj+QKpj>q=V*ECLab&^43pqMgzExC zn1smHSkJ{Fj3A7>8UHl-G+p6jzD`htCMAjpi6GL=bUqn`A5PtuMtS7(_SAWE;4pd= z$u!bQ(RI}5Ad(Bt<}9uhFLM}IngCUp#A+Uo?EOk9tn_}`b*}~|^gR6E?~4h#zz+7d z_Z1OcU?2EZF3Y;#5`5Ywx=MCG(s4gkaWoYO=X;yYhaPAncU99pz{O^p?R3eA(tF$K zr%JBQ`eUuLGWS1eYrU1k3g>dd2K%WZ>+1l=D*^SEwPytF%3F#C(R#OkQL!BzOYaq7 z=4snqy59H|+wReHKhSEMY5$?xS0wE}Q~~RS_BXDD9j=C*djINB?Px%EN=SF|_R7JC zpm})b9pJV39F;-d>0w?Q(fgrZWt$1mRU7tg1Xcxn4MV;*;_AY_V@0#W0cLgZ7aycp z5Rj5Y)7=g4SP12I@7Ejp7M|QBft?NgXy6oLm55A;Oo&XqMy5p6PyrB}ItC{m2%MPN z+eeRwPE2g50@7*mK2;zhJ_T4P0u%xi0#uIyN)uq!ECa-+koa_b_f3f)_+%pvzQ6Yy z2cAkO~QHOh+K^sGn{Cl)od_pmVMX|xhQzI??dM$sG5Yoe(zZibe@Ui86xK>j+NXH~Gl z19U;tZoFFTktRwohZ4px*8`G6QZ)D#ZJVIEoZ~v1Pl}bCy1oMqOg(xITXh-V?|za; z32pn~&nMUEa=G|i-`a{X&s$&5via>HSZwX*pF|u1-o_Hz^(f@qIqXgrSo3bWdAHhr zHw)e2u+Fx<2XH<5WE-8u3<)*ihDs+!3d2Xj8WV+LI+p#lj%?u7i>$9wd5r8r3-7Ci z+w{r9!gp(2v?~ku9!h3S4VaeEE!+?xlfuR%XWX5iq)eB_q=brX;gyT5J*bBU{yiAD zILW}1$Oc|lzV;p!B@-Jf4~6|(#SG9(F*XWT+V%W|qGat@D(Va}{K;bc5oZO(Pw}gD z@iip)uWS%}gUCY#m>mIH$s)DpRL7kk0W2x22U2iHPS8Tob?^~8y{KI$W*Fah4MFxQ z!>9{Dbch;4LG54=w}hZe@{y|^u%zT3sdI=v2*Jpsi_L{SCB(qve1^o(ml+bHy@$jA zC!3?s5#8Tf3U}KhFaqlbg_8;D9Ngdc=Km;>hT9(|HI)EbM|XdfN{H_74D&9Ngvh%@ z{0&<}gfd0R)o3G&f-l$7u^JOfp@W=D9N)CXdhd6XZb7f=y>;eI&&IqNH)}$M;f|4E zWI6SzgB{z3=DnT_iRO*wz01fDFH=o1-XvYej&mGV5!1K}8Qhu8Xd@2*r|n`PrBeSe zkLYtA@pJZVnl0U-;gOP79~pk%()j5vzK2OZGlN<-eVDxFAoL`LPg( zd*3@=jPqPbs3-@czz9*GIM{u==FNN)1n#_<2MGd?pVTtmv|N@D!?hYRMIffnwQ{sx z%Na3a{gx>LLmBm?R)EztIjZGYzmz?-nh_C?ZAp@B^|Vn8k8Q=y1^#WiTEAs-@jq#9 zZSrQ8UHp+Rmg#MFaq+|S?%sZNHZsg6gHO|RkmcjaUoe4)oj}+Ci3`Dp)}2s=r@T%* gNw1-a^ddc!fQo}7C@59B1%k97NDUAa z0R;g8F+hNT5D-ESE!2A+XP7U~%=@o*{r~;SUF*MR&8#rzIc4vCc0Xl)*Hpi~YD!L)+z+ zhqr~BHR9KsE|%6uuQ^%RSZi5Z+{E1eWUYYMd{gJz#b0%Ny2g5%-MBj|Sf||6Z?QM+ zIzNO$s8T21>3-_E`NZ+Q^ru#z=&{dZPuu&fZyhgh6ctC?WQNT@~YEjdZNDASiZYv zgj#;8Hk*sCprxYSz7>J!yMf-dD|+)r4+KI}Hw}SVa2q5Svig6dyY7=p8G51>FS`r0 z@SmqyJ$L($rije%XD;@NJ^E&YRcUbDCz%o)8o}r`1Q7H^nn}P$&1<#{tC;e+Fjy>m zy0(Ptz$QRI1gf*JKvR}!yyX+M9lJR<&F}~Y&Ocw!&T79v=wWNT<$gB5+!Rm3uO`%3 z?z>gcIqH>6pC1_+2|?YLso}y!2{wsEZG6OR*0 zU2`sOLNjRmf}!%D%%`N!?j`;Te3RUgfxN*Dn?OgrgA=^tJuWMy?&qg5S?xw!KhbTA z$$oS>_bPuW?i`k(2I@?@GQH^rpK#iJ@9kh-e*Z=|?8E!5vO_|TVu)Oi$d8+Uoxu`` zJD(~QIS=w5V{LG+T8WvU%9^0A3O}l_0^Ju=X)dtYQ6XFdk|tZ~9b|Y(wo>oSB{Nhb z{1ZkzxPPm*IH#ysF_KsQOGtxFuOjH&J;H60!2|yIvjk}f*LFyxTa={z!f0t}5mD`R zE@n@cmjA7RcujauMI>m}!7%z;7lGQiw*Hrv9=Y;@-X|v)ma`-=6=fVM)xym!!?q6{1OGi|xUf2C8RBIlxf|$aK&V ze8c^E(0!x$oQm!FR99o`M3zv+5*YrKnazN&K!+WirVX5#Kt8Iz(cEEF;kyv_#!R&| z)XT};EJttGy?5qkN9W2c$IZ_?%YIKKd59@VT$V_a(iR4D^b#&}im+}>2E?MWhRZ!} zg;5lcq%IUzH}J(#`q1cO=MkgiwxN4btp;hJ>8a%lJN}~wqC^8(d%I)*spg(f#MODS zWRm*UdL_+V<6KHZtVHp66K}u9!zK2g$ekvQ$}vl_E5BvfoMk-6%feE8yZ!x7H;<`e z!`({CNwoV^w^FACT9lRO-17z zq5v6l>aLSa0QT{zzK=Q2D5hXfYpw;2&MjqHVb~^IZXdML@dwR3VE7N1Y>TB_Kbw-6 z7>p(2&!=3?ouiTP#pA7S0PpmD!S}#cXHgSb`ztblP%5suh8fJAs;jFbd+mq;GR8AA zM}TP#{$sTrV(G;RG!|+~tU07pCQYkhSh?yWYkiT84_i**l>*lk!Y&`*y7bw3dkj%U zc#jScpT4Tx0od#%SzH6J;*z6D$%=j)f|0*}SJ*GJr6F8f#p)2yaOYBKJ}|zR_yYoJ z;pLY=M;T_2Xgg;g><+1(YLuZklIJ{C?9wj)uvp#1Bw$*~^aIy$&DT@-ihyNl4}xh8 zCU|KT>$AEvH#C#a)fm-!;XdeDAz?xMH#{?Lpq6BKswrw zMzK&kZKd{~qHJdHs0kV$i6n+0i*y0SQoG=bt4A)2lHq=&8|yZIWo=&&rv%zjJS8n^ z3nZ^1syJrD;nlM1h-rOD_4CZJXYb7S$|W@oxt*^4aT5Tb6Q@oE7;ltrk=k<->9xMb zu`{dD&BnkUG*I))6J_Fo*4qgN)(M9{kK(EdW3***aR4-NX@%fHd) zw$z_Cm+I<@^UpW~+8rvdgj1aMfor+OLkqn;f=kge&Fu{Aah6F;PIeYox+W~91EeTb z4o*BleTaB_?#%2w%oak9Sr!3Yt|@i_Mv7O)y+7uBMYPf)$>YE2WfhhxXdVWb+3#bP zG4m`gEAqGh@2RE=uUP=5Zdt8{@M}QizsltA$j1*y7`_C(tot>V z&m|8qP0p&88-ANIPQv4SKjCG;QTsbqVEPjMOEr!@Yp zXxQhlT=N||reu4(#@5D7h#)`WV-ayF9VP`IblNhkRE)76MOve$tOwsJczy1WRFZmi z8%_hCofh@|xDWr(7awd}p~RKS9=V7%w|EV;y=TDsObjfkzzmuivi1g2(aZ&KxMWK6 zq4XCVp_hDS20snWkc87Zg?x!;t1p?CA3?eMl(&ue>+m)=HSvA76RW;d<^S}`Z8S%3 zAs~~f|LZMGWOHm0cL6eg=yjfNMWrW0fRC2Hyf~Dh_`#~(z7U8ezC48PV2W3q_4AWX z$hkX&86+D{>|Ec}Pd7=ii5+;A(Vt++2mGJj3NW@h$r7gi^Mq@Cs7eWc>RQP|o@%%m zoN(I6mCEq={$o01S*o(f*Fz?W>+cV|l&#*~`$QpKA>k!+ls=%wC( zzg@@Yp25_uHL}(jSs{jBoo&<5FO%06ll`(XJJQxj6%tOX;q8?vEx^d0PagIgIp1qv zs3$P(7PKND9~P)CYmi)b^Ne9qtbFiiGft~hCcs~FthjZ6nSoP9YtNlZcWH1~o5U1S z#b@zmL~#kRPG)Rbv;raelz!7OkUXjotZ0|x?H_AGSVSMcVSVEsr3no<3u z*suueXL`r;dyFjCed1;i9~_10jzh>=JEZ3~a&w9j`^%QA79yuYq6j?`ML{#Sk#1b2 zN5n4-CWT`X8xa_+Dym7&1ncYT+h)P|Ft4q0;Lv8Ep^4vMjsd_KtX2G9YZbZq6L2hI zACtVbvfA~YPkZ{91g%)8;o2m5*j#qS5_fR+yFq?XpC*0|X0!}KkhMl$Ccg~(HAjGIUuB8$H!BG7irfMfYaMjg# zyzQOvkh73W5>c%YwrKCr5hu*}a7y5}93GJqAr0Z-;l<-}>cWp8lPcod2=flkb6AaWwngjJ zt~JZ*H1ByggAZ+9QN0g<@U7Hj*5l%58;&HYU%8Ze7kCfnO|jz1d)-9%ubasqY0NuYnazXaJ!bY6Y}I!rK)#9GUYq z1?^^R6ud<#mf6r)aEq1QUVmiV%lK02_p%;mpS2anklXRvb2`8rXFQJ6(gIwwQGzye zT7BLzlTz=Xv^pDUF3S@HLcRFLTL$8>RBCyPDlnRWJo70qV}En5aqAtoa}n%;6?~Up zwhX!DaBXe}X2AXnv-i_?zJ@EI=4*NP*r5T2FYwuoJtelWU766sVzFqnQF_!UWNViv zVeFd`!)3*GXGnUWvEhjeN#cq_?DCg19=2xJbGv~TN=-AG4rtW?YX&UE{0e0!%$9eU zA!`%YdU*=ND=0S2$-wb`QRQl0NXX{)$px8MqZ)5DZEN6w6Gxbp(bNOe-(>x2esBzQDl7GZ zsG!T zqx&S2ET(7Vs*LcYT`s-l!V*cisQ8~$y3TA9`}Qq%9Q_%aerQm}-R@HcA&slQe|hOj zLsYAYCxBFG2XjE;FNmzYRkHmF`+MHIgM~(79)zCukNwjMo4aGdY9}jT@=I5arAa~V zT89RV*-{L`-W(CXJJ{^CnxKw5;9Jp4I4WDETu=GM#>R%4CL^4dTn|hjc1eplcH%>a zz2Ortd&*wTX8OrpX2$b@LNj35eRnhj11BAW>j{}agqE)}d!|9G9)|__O&)hS)qw~o z=Y1ju;V<4cBBc8HZ`CwLx~iorgnZIaSAXx1GP_^Dwf;_> zcu2iWtPT*p`A8Tius%e73q^`MSBhPBAS0&^ZD#siPhDjjTlVf5YHf>Z)%nS!KbV=+l@$cqLN$%+JB(SVVCl>K8Co`O zsrzTxZ#w?S-1!fT&1I0aUP$VBj1_qelA&oI9w^G*6b(XVC}4>`sS5;s^(C{-sA97W zyJxv1?6@OpSiRDPQn@Gc)5TPtj40<~Lg`nXLx8K4U|c2h;186s1gCZSaC5bzG?}A( zONXB^_SDOl0Mop{N*yL88#L~gS{|1UvIP@a?eQ7&Q4ZX!@#U6Set_#?=EyNW}8S=CMgBvy|xFBwlclsv5cHI=7NvB%ll{q<{zBxW#p#O0!j z>vyqG0au*Yg>gBnSnWAB@WK0rJ|JO-1T*2Q-aSOlKOC`jHw9y_J26m>uOSZLWTr~r zQAle`^_nQj%I-VGdg?XltROJ%0YWekGjAj9srO&LeEDT^K^IEVW*meK(g(@SS7Cf1 zkWRkvLqPu_GI(GuQh$cVT_&8TppTg_pZ}cHJLnJ@=*AsF8E`k zuz_rlp=yEV&gehm0@gn6Kh(u+y^)G=CM3)3%n@~v@(en5rp5LZASU8`8caX33e*}% zq+>BTZ6m=Tm^$~*79lVArOTq&LzHzlmDE_i(FDOnhdYe4&$*&xjB@mTcmd_+8rtbt zRO*rYk97;G4@DM*zP^DzvU}Uk%~KXbDqyPROU%0c+?Lgu%OJm1f!5GPc;y+09t4~- zpUA8-T({?*_~@Qmj>c#0tYQOs*`ZbwKpS%+j1i(atQBeuWfVZ}Zb|!H~-+Q^&mQan9Oa^*Ft4WT^E_+FK}+hI8q8YrugC4vn|8 zEku5V@MAv?FZV1?5GD_9op|RskJffG1#X}@J8T7Yzjd4ZBz@jXv7~z3Pu+ZlnXCv@ zYv3v=aO7!jZgeCeN+PzQk@~v+A0{O;+pssI-Cl$RjAL4_tYVi5qA<8F2oiCKk?9&Q zdWaaaJ@d>_Jn5$v6=G&?1R~c!l%s!kwqiHqB4FRYnPY@&O^i6T^QX3k8*0|$-o4bk z)#>oS-N@SZkHsYH%5>cniMTe`Q#pgA1g@{zJiCE8+R*#Pww&USUWA zJ004-#ICgBN}~xY4O3QzWG256mnR6P7YGgX1^AX3OyLv;<|1U0ss_=VLa5|J%% znM`@FZx&EU4_F5ci0<20P!3ZO_(vL6s1%pwN}kscBS|nzBI2BZY*2t{T$yOdTW?us z&eE5Qp3iA&r7yiF=935yCYO9CxK9zAxfKQ-2HJimWrY6e0-ZZmx>@38>GHf>P!hp) z9po5x3#WMxXap{`MGv^A%6WI88%&Exbuk2|SQ33apQohBVzjV3N8Wo~TxmjSZ904^ zL}{hJ2gyLX8xU4H$b-wK#N?Ik^*MZ?Qvi0s@Lq_I6Tg=JM6>0a?UA4S7}GMBdIB&k zh$=o<&@6H~O{&M_fQXGY+o|CxIvzWhb($6kJU=}vG1ioZ=OcvrK;wzoq)GXZZ1*^V zXviD7y9g_eZZ(Wp6rXYUv=Cq#u_9nU^%{MI-9?HUB#0Tk`4C@XVbf$zsK~iVC%oQ1 zIjG)EZR$*rURYhGtgrReiG<|3clZ|US}dv)SHdzTU3?W2ex1;`aZh8q%g2XtMaC_| zzj~yI{|C@C^P$XYMAK7WYw!X!s)qxM1^E=e9)i+EHp^Iff6Bq{;tfd^B)2P*{DCXe zwFBN2l;!MqIA14)@_yHnoa+oth^g1%5-6n8q-Pc|*DfL%kYM__v~htF7-&u4$*BA^ zbX&$#r5P_2u3`EIR6tReV^@9M4P)JaU3dUGn!9N%{E7VS*cz@$ zDwa=q4fMCo!D`zA&|M(Os z)E~IM5Lh9NB6K=(Y`d4!IgM4Zdwv1x1czi?V3HI_sdVDGyxfzo0xA_S}*5D zA4zHRN3ny9dYI*?K^6+O|ZGaLH6d3g?@eFQagbxdzIJ9pnV>glxKuCi!%cDINnNTo-s_mB*|=bEgHV<-IiF{@_lOZtms%36`WXUQbVE4FNA z9r&og$Yo6oHc;Kj0=OF6T~V76Rs9cYwg!m+@!lw`$3Yf1Dre5?Wy_Zwo{V4~K@ji& zYc!i)T?sY;b-|W0TPSltU-kTOv<%qi^E}NuueWw13~b+l6oAjt?1vyAqe{F zSIn~J>S`GlYMGf+4EpeaElQt-mxn6QlRb+DrN=RRk)KW^CMETFE#`9_w*WGJ&JpG- zz55->7CK^$86O-xF}oa4vuWZITflHrKiNYr>C3p6GT3aG^Ih#RDKZd!?r(Hrms&@dMxrG$BFq^A{+rqTQST@Lg*>X^B2iyTbr^4LzzN1bwJv2xP z_SDnn%2+n>J4tc{>*LXigUX4&h2{<(5CC2J1mSo-M6x{`AyRGsR zSU(Qe#8JWKex^9E!KYzpq=Jpg^98zSzvX!+u+|SZcZY%y>@k$9GU7PCUQ)9XuarbP z4-#kHtbgxFsF^J)*UM@LyvYv2?K?q!V59s3k-`qK%ftZK=ZprPbjZy8{Y<0?5lxd4 zOV_6s@+^Js*9cl}1v z&WRpQ6(-2`UQn?!Ql&WN4)+Z^N^2kO>-|cb1N*SmU|+ka2jmZLBS%HH0zz=YybBe} zut-Z^XsPV8%rOO>I!F7^bIYq!OLH_QLes+*HIUK*$%;h-=A}ZMjP1Dt1S*+L&UlhM6U| z(%m2sY=6VkhXRf)(AB^H$EKNkMR#>%+(^U$#3Y{Ne4lPJvnNJ72b( z0vV|0c^;w2Pa+p9O~mopAOWBK?at~`rDCw_&|5^KMYTfN)*w?@NCOfd$l??H950KU z0Ip5p6K{WIN33f?M2LI1MR^yKhO^UY`9&8#%+8wZInXaF*70RJE^D?(gtjjgG- zDmX`y>WwG)eHngAh#anyRZ=2Omw@a&_M7->$K|y>HWtL+ns}1_Cb~i_b?=Df8-vE;;E$x4 zUst1AU-_W)*Q!f2WygqrYM6ita?LO{7kDyN(y-NA7&~KvI(3=IRj4tWC#w@rNDJ3e z32hh#_Uw=p*Y5XO`grMBjnL*wb`Uz}MZ#p<|d5NJ1Hi_(5Vb!W(o1=#krmFhBS5~kl71jWn7n{*XM5^d|3&>pwip*%5T`?* zLe!Y4o*LgpeFXMu1UxI!oR1%7KVS2tk(4?Kh7Z$gm*qdLHNc9Q3=n+GMRBh|g?jO2UrgTw+bA}+p8B1W1x8ud;T_2vz`EYONGGZFjLz4%G=wU{^j6DO1#-I0YHnO-{7QlSQ!lNsegW$ ze+`#1XBgJv0=Y-Mj}=TF<@{&VKu8&dt;Fq`1=9!kA#KLHs{kT7^c;;+)d)cqfC;*arrD4pmhRytFQ}8S=@zI=bg)VNA!y)ZptT&;@Qj+VSwcWk3g{WKTUqX>f zRhtp#tA7VV|5rJ~X~m-(l2RnDPB>gGsHFo=B+_v5?Vjy9k5jTd38S8N#bXT(4KLb8 z9yCy{Et%lVxNj&qodH?e4Cn8vOamQt7YMfSTy$V`FHBN~-$|68sHq1I{9M~`sF^`T zE*|a4r9->fvvAeI_hG~GYUQ1YUmwo54a?T7TyMQMy9;q}6)csj7qe8@{${ayai_n< z0pTrXZ;Tlu1K{Z1fc@M<8!vGUd0U*M;{9e}Et}%j;ZlyMW~GI@fKiXWVUB~&D+lkr z+}`iVNbITa)Oi>qAt4bc$7!|OA-53id6i`B*RvpxLWzTun=Q1t-QL#+rb`xA81AdH z*}j4PB|yAoVT&$Rmx}%V{rh{Jj*s9xWTbnj&&uyLP1K~(@Zt9O9N(s%o*so@^&6On zFE9!DqQml^@O{;L5QvqdFr*%E4ZM{z5lbPImhPL)e*)y4hnH7TcJ=*P8KV!>Kz$mv z-5rQ^4b}K6k;_uruXUWF<4%+YJlOYynUhitx6K`J@RI#aNXr1-)-~t}PQQ8n(4pn; zjh*~#D&hY^AE@Xc%(dFUUTl7fSS~q(zgxM=8}>;^8w@0?JAr`IP4zr1FC=*h#LXnOQtiY~`{&&9 za{^Av`6O5`3l0L;0&N(C6QTKU-ytWxc-6C_bE_W>%+MSvJeI=J4ZA566467yk^Vk< zD*};y3`Vn5u7MIce^XTKvG#*8)pBhkZ?T!(?+Qz9o2-E|0~|@}IIc&RA0@8;@+%|T zNKyY3FxToC&gIPfnR@5K_MB14+;7t}jDmuK+RKFO*t;_tDX4ahK=jJpyQb*aq*2MM zvESXB<>ll=#KpyjK#*dswEpR4zW6B(A>a08$=lIDqtZH<_t8_ITZY-ij$o(vrmeYp zdg|^DQQrJrXkgl>{j5}PwP$Hd6ID33vbo*;`ymQL*vX!pu8! z$?#$Qy&%ly?#$}gC5(mawJzahu$4F07Ffp>GU@XuT}9zOb>yxiadrie z0%MZ=4Q~s~vXWn6#QKv|=%`SSVl?ym1)T_%%w)5fqnlOwKbwqEbMab%t)(n?MA~A@hTTo@qfAkFR+$%4&r3+~->bo*JdXe0OJBp@RbDqiZmm zT$S%>!T9v)+UtAe2u?%b5Tz0GNQl|tT3w>S?FDoY(&pKqs zIq$KOLGuMDTg|*p{{2%VG3yz-DKIcq2@?r0Z{Tart_JM~3GZhPet$|lXiVwu{;FYC z%f-s-KaQF}W8=j;)y%y8{S}D0+80wEgNV%~ud&z<0EB(S5kk_S5J$_ZTAMUduH}pBwVKrTFmIk&L`}`j=?n z$&8IvUS;+!s@yMZf6dL$>2RU@tpld3eMwCIoV!o*j{5bclOE_X^IqfZfz1qup7d$* zGr&t74FM6bRgV?*^5xT|h3lGW$jh*Ay9cD=$Ttbmia>pR{j5rlLsnxpzE0i`12@xW zcOC5gBEyEKu)60BnIAMS@*#@NTP#H-*j&h4#A|%=#);FWrx_mSwMZ zady@VkR_+CJfkU?R`t}30t2YE=v31Qci4dCwU#!+H>Oo>{oLHn zP)bcqu#2?=(+a0jKtxm7U6Q(T-(h|FuKF8{!@XEl{@A3CK)te8r0iq%4yHH+g0Y@l z91dP$8eQY_3gQ|qXF^Vnt0#L!6U)m@77jx4e_niHirKe9^oj&WcsW#Ne2X1U_V)0Q zVsDTD`~bX3SN^g4J%CBA!jvPyB7YoQGli{3(S_|mb!B|(yxy!REBlPK5r@NF%4$DT z?k)99b;x3Ue0;nN*R4;Jsy!zy2E3@S3GyXomv^k*;rq;BxYAl&9hHT?s)A&=o)ZP; zBiXM@t#Aoh+xh{x3ug#soXj}pIfRy!o8^Ss^E%DMAB z-!rBTVy_5B1#n3J@>vi;3wa$C3N=(*yFGEJF#HLon7n#>(9GJfNqOe2v$L}_=9+Ko zrLf!fzM#*Z5+T^kQ@t0qS9})`5A-x&`!P5;c*Q(fug&Y16ji|*ABE(Q!Q$fLgvzl@ zqnBI*9Z>4$OX{*Kv$KWZ7Y>dn;tkyWIh?W-@c8j#?3N(_!ow!_C&y;$A{27K_VUQ} z$t+LPoI6P%yNTfTofKoXW__B$dyU$k7r%X6yqXMT?ut1$4m$LXF)*!}X6rAPw6^_| z*_#85e1iR+EKgo5QBzY0i%JRyGx=RJ?4MvVt2DeAtNi!q)Q>AjIs7_Czdk=Pn0**hwQ`%6NNPr*P+0Ao$;W1ZzaFq!*eX3l zs;PcFsI3psM`%o>!MJ5*)c!dJ*D?Kgh*j{?pj{UIwh>?v5U?Ps3Kkk+9PM`S!jFUO zcQ7uuRZm|UzC!$>bbRYz+joIuDc~GquOaAy4hR=zrcJ8dh3&%PE{E8kFlLZB1KulH z-JI<2e9q+RmHH?=LaJA2gHB_ECWlQgCFJ+Apu);@acRlOjG0~<#z0l`w+ib_j{|Y*(}X#@=6-Em12Ip)Jg%o; z%Lh&UUjz&^^uNW*5udF%!38`6M92jgCCLe2`MkrnKwJX_#<22V#SmbUf6H0s3r3KP zR6XC0ybOuqMhOxN-s{`mpF(v<)|!LJ5W&L&^K7AZ|CSn{&ELce>h@o>K2`JSa|Z;1 zliz?TT(`rxA}@_=;Ojw9e@^E=L(srL|CX+x&A%6YuYt-9Wy1oKva#A%|M~+M^}mmz z5DtG^n!keXn-15;sMRwjPkXZQc}1E~4Wq16AzKn4$xKUEtT;%9Lb4t6!-U2|ZV zgdyV~Gr`};yfcf)JCe2!)Ve-^u@Kbtzld?6q5no^Q1dsvJ9gPnY2Sq(+|cD@ez6Z+ zYCtLeRlJS{Yp$ovLfTyr((YICVcH$E`=4c+wx3Lciib1JaM65;17vCarC`keKMgLJ z|L??a0^(@%FF+krw*x92!NdK36as`_aug@HAtUs!IOR(g+q!5P$Vr)c z0@EdV#(!v-tFT&#_WykvhE+WH%UQ@-?1gPIAa=<=EXEbq^*F7e+PU=u%cmwF`1N3B zbCGoEVM$gy`MaO0L%1=1bz6J$q>h8m>U3bHr&i9LVrX@WVTu1L;t;uipxqcY6JQo6oxVYPJtV}i~(7|ZU(8!J&WXqM@zvpnMzc6&?=OksWmhKIp^ zE78z)!aZD{{C$eBIKN(2L1VMw7#1a_S2q~Gtrs!_MJJiPwIH094$7Ebcra*PH)m2H zxW!>$W|UEJNj2F^$wi6&^_eM@lI_?EQwLu~y-xExPJJx^@hMUL&7!-8$%ny#(eU+y z%|EAs1l3DGN2V+t{P9;gE$Vg9h4}qsak~m$)>v+V(!NBrPb&Yu{K~Xmz8B1b@Nx@0 z4Fj(I!uHkCsqxL&SxngNL6BQUmz9mJ~-9H!K!`gZ;lFW764yxe#BegJQys z(r0+jdkv!ur85wOn=m2sc_%-i=L{X~LwGg8tmahyJNebbpLxb0(*l_JaXk7n&*-;? z1gSgiHozU`xP`YcuzU=+KiB51oSeR50(N!o z_yr1L|Iq|lo8K|s^nJ57kQ(!pF&OLN-*)8qYvs(xQ0&1qwzyNE|MK4`msaCUy~pdH zb;k}kPVt56CZcJ*1?k9u%PRC&EE8EjsxpZ`!Ws8 zxKW5d?zGjb34`dS@7gmMeTWlg>;`_q(8Ys3VfZHp&4V@6+5VK%qN{#}F_bYbFq+1^ zd=|`Cz?$AT=z?QkH_RV%H;f7F0tqif@~pQWOwO|Fc5X~R5@>daIU=p{J$PyQ*3y)d z?@CU;llD(yaNr#wDcUI6R}5p;lTiNlnB`VB@L`Ha6((F~?VsskwPUDvdcem%**F+} z4qwmYtaLYlv8GJm-L3%iibtyX+Xg7shHKT2|3#C!+iUA}8byFDf`)HuK~lF-6rR2~ zmD`Z7kaqyoD9|Qx%t8~?sC}@8G28z#DX6ey-#YO7Wc{om_mH{Fz|jQ*fGs zs`HgFtqyAb8;u;8>~EeN1Q9&p^M4`w|22&i%BriY)o&bhke!&A7$S{(5$N>E-im^j z@C?eNL^sWP63R9D|G#G9s>rU+&XFiMmf(0V5%xxl~qJ_Z9|w>o2rJplmGlUwM_FO zB=x(V^Q$Z<+W`J9*GH@MbEDtu5 zXw~1o=?%}$zAYdS;;#`*De4ZaueoER)xBQU9?>}`Zw4swD)=7-YuC+E()lIN0jfk@b(w9oDj6jkY4AV+cB^&64&o_kqq{$=ySKh_1>mWpFa7kZRy*03n$>Cxab^OPiC39L~HZQ z(on+JO#zgXz+SH30zXBl3AaGBzX-WfLwkYQ3AYanT<;C^_d3VJ7E;~6$Q!;Wv!R$Z zgaj=(FHQGZwFFOwJd7(N(N_09)&Fh-PMI=j21hnwxXnWzl(OD?HY&>JEZ>@ZFc=SdctFAq9)8}*Ge zs^IFyPP@1yY^5)8e+x$YRC4ll(v@J!Tj?Zw^g3$pykZ5Kyo!s*3W9MGt}|PkMd)4@E^X;s3`JKy1L3_PL|t=U;^?NGaUxXoDPtb%Zq=kj;?|3A7KY$f`ks; z0S22L)oQz}kDbr2@|EK5@v9hZ&cSDCEUV*wCkaL4BI~lQmOuQGAeex|Crn7Zn6;+} zMt*AbbBRv`+eGJ4Xfl*?+9-?H4|(f9d|}Yw*}6zT1t6B9qD;M!`*g30N0nfrZM!eB zsv&>n^-JNe&he;Zbv}IhGkqn3k(rvbhLS!JEplPTxtP3EVOfU3lM;Au;~UbGfU?Q! z{2Rgz;6bVt%!lsVI?osI4?lgsol|n_>}~&+!D%1UOM`F3kIi@lXqRBUy-7gG7n&|9 z@R968zW{0cm~f4{K{oIkarNa)#O3bLu*)xj!lSF+%SK#vo=chQgQPmc}8LRUsnD9h^Hy6q{9oR#vqfxQyta!nvGS>zs9(;&Z6EX92 zIw=^fe=NeqIM!%R9&&Wy=kPQSL{^;M=Z1Ud6X{&+=kncWiBSfw_cG`YN;%c|!b!Tp ze6-d@`R@yYBWI6EY8*DCQj6_u_1Vl6KATu6=Ox-S+IMw3>G(s9NuYpSyu`mx zFXn>n#Rb8{y5%>{ol)+9)YA80?ko32O};mCFM{L`wKX2UXm+XXto}2dN=GMaNv>=U z%D$93?=aU2VGn@iQFb^B-B1$^e`&{p2_C+UJ@f4Ig$dnDAClC!;fc8vr*TgzNL)?m|>8t=+zHaJVfbyqyLPZ#2!# z6+YU8z&fz9vL=B;aHbU5$*TQ>C#%N# zo*CTbN|L{S^2cs-@na>s_TG^>I(BH5I$rWR^2DmPn69VH>*3!&y6SriXN@*w%k6G5 z7XJGzUy#g~RiJr;9>b63f+`Q#>20V{sugtP*?4yFQ{+A18DW+O!j5Sd0$0>oki%1N~XBqR@DGLa2Zx zDfYXyz^1-SlJ`EiwIpU>V1V(Q7>IK7boQ2chKbpQVoj zx*Zb4+b}w4ck!hL)cmI=n5_Hddx-%GX8lp-fIlJ*T|h7NF7v7PKQ)MHnl($3)F(oQ~YT{xrQGP8ff>_hFH z`N4_=DMt5E`uqEJ{T8SCWln!yo37*6Cn{oQZfd4@1}1FTb-)++Vrw#iDONF(vw|uQ zYZb6~D69$c8Wa{Hm1aU6`$n*l#5kjL&>+(J0;G{#SJek zaiv+0X;%YR&oLmofbznjsr1|GH!C00gr?`ZZccNhX1JJ!T*ZLmfhZ$UZps+pM||r- zX8ia}M?#p|v+In2BlA_2B2R~5zal(6n}?qKxgZU7C5u@Nbfcj4^~>0@ zBeX7@pFc4r1;3j|L*V(BVCe%xj>@SgCF3a}+awO$5?w8{_!!JX4`9i*Q&z@xN<41_ zuU&}kcK-J6o7(0VWX%-!S`6nIj@K4L-7j2S?Gw3grL1`CTbbU>cF#@tt-BZ*(yCvY zd#Nzf;n{!__e7&7Zqh4JD|E)#6lZ;BF;V&Mr-bqk7MyiWsI1!b&uJ^ktI|mavW7f! ze_2h>iNw5dth6DR(7%+T<`pp>9v)L<7ousqBY(<$rnOXs4!xT<$L-#k$*}o@iUHGEx5NAGF zcBmW2MSETA`dL9GL?H8Yq0eX5@`HgU6GJ}hRb6%Kjdw3J_*9GTz^6&cO zTDM~v0Uvj<)K?TutfZF+HLS;cwc7e0pjC}S_x|&)%%9XmH>E)j485zVsd?upolu+| z-@7eUKZhqN=r*tAXU_@@eJGRo)?^r5jA}>iu+80B7%SenPZthWHpKg~4moRn=| zX#}TT+fjx!#TmrrVd3_(!dcs0j9*`QrT$vql=wDGm-lL8w*iMrl4Ul{H#*NvUWkU| z8BKS$H8m@(HF4x*nhP0Qz5Q-Y30l|Ys%-WvNdpkl+up9YT(aV=WM2$XX^-_ z01y>99m|fXjHa7>b;&J=>6?FntY0j=Gcl_l?l-Et)UZZl>9L|jh9)CR=RMtl$G1^} zDj~rd`#oT16z7gnLC0sBR=ize7A^i}#s`N)vp6{!2`2hSRGQ}mQ;k?l_3x{@XZzMr zW)s})t2=kN5BZ#2lsj>eAVy$|#&OKazQQ`iNvm8f;w!jxHqk!Y*m}ZL=qjq6$9`Fa zq|X}oa!Vu4)pO1HN8zvw*+Ii>yuzT;#SHPp;UlKKj=#))PC7h^Q|BwudN;=-wWa0- z&yqQz-qD#|dv@nyBXtlbWf2h4U2Nj;M?Ujq~ ziokGQ?r+**b1&R&l}Aa)Apm(jqn%VZ)|*LF9PB!v>U{6r9MZx1KFxX*`&&0V8Rd1v z2d&>czaZB~v=`4A^)^izZ$NZ0%72vUw_88-%jb>t)ny1kM+`SgDnBI6@;jr6y)rnfuM!h}lfZpLw|QQ8BNH9}wXV^=QzKd7@LPK?hs-y*dv&DVNSKxT+&;_kEZmO9lA--*PI@%3P1d8QQo7T-O>#AkZWmjJPW#;W z7U)McU$xM;5(l_w9acS&wAx$kyO>VQA$~v)o>e^--8Fksp@iLnh`bQ1y)~GIturcJ zDymnZgBPQ&Z*Btf>%(lg=>iX!dtOuBaN6~zt9kMds>s3Y#7 zXzbh8aSl&T@dg+REyMcz``kSFIp3C<7G3faVzmWwC{pUv8Whf`F zCfVFNlHQxa?=p^LnpZW$=(6WD-8NO@S52nmTf)@6G_KFeeuJeG=F=i z(otx4oFwMNN^G;|)QVsif@ZK>d^%HTv2={PZ8+l4{R6qpnS>fDl`6BTY0LEn#>rIK z6IF?;d?qiq+Ue5cLIBweOFximYHqwjf z*ON(PQTG>KUS35-(gcI&^20h4_ub602_fz&_?^+=7>(SlHWYF8PXP#`Ez|HswzUtk=ngd^a7YPthw(`M&~`EcbDnp|JOymp;zqA!ESlu@KBF5Ps#28RWrF5LEZI9Y2|n@n7`vxF^u$o;}S zPs!pf7T14BS~LpuQ;*eQfsa_;Tt?Y)*j?Q-=#0h3OYb_|#7=%Tcu!zdvT4Sgzr`Ez z85z5^>Of_4=^;iUcN%5CidfdKq+gr9dh2E=4CmzpxiqDHb-jAZYYZt-cxo919L-++ z$J(s9zo18obFEljce)(0QjA6pe*sS{RE{_pinZw*@tV8P+{tMio)y{+Uo!%>MRRhB z##0g$hMiyVE^O&`&$YAeZuq5Kq0N0#bXR?NfJRX>y{PF=JU#m9qO-ijz%IWQVd&A0smv6y+tbp1;MeNFArZkB4uP+eF%M*J_ z-EH(pGb<}AgjMiT*jghhs|!R9V?TcUuwMqRDiGGXRzv2Ku;3_l3|a%56|VRyO^@d2 z_So+A$P2nZctzp;DjAs>9!o2I9cC9$9=0rJ6^D?Z)spZ|2ltp}Fj$CJuz|N2I-SNgpjxB)5IPrGwf(RfYMn<)ZW zjkk!t(G-DvkqPj^e*42l+I)jZX~SSKP_FMz58R5T%$BO>3ZLG}UXh$w{es^8t$r}H z=`}jQ=c7FpLhFt5N>}N#RT{mw7D!IEtWNI9fEdAH(S;3x&|&HBi9p;E_s?s zwGys`^YNAku2-&&Hg`JCYgzv}a7pg`y2e8LGN`)>)pcw=4O}@8@0~}pDwq+mIj5>J z_KQd~AIXC5>ui*6^`CLC)ea0FFK?q#?37Ry*UXED;GKZaO2b<@em?EK(e}>>^6|+* z47i@Ko;ZbTufOvqic@#6<`67oca?|!vx*OTC#3w+g;Z;6iy&J4E)giWUibI)%{;m> zB={|k111Ex&%vkyd(4GYz0<7Dnb}&&hwAy2u-O|8^8x~8$O}=x+6S3JFFgh+J~@vu zRO_&(R;djhe#)r>uCX;LQ~w;cO5NYFC{PzV=;!tGm9hDcV4IK~yodG<7$Ak4Y_7aJ zo(>zj-M-xq{jV`LN)QAHb2;D4{KCu6FLLmk*r4uzD}lj08-f@1E(G-H$4}ZYH#%SU zKL}FLbbvGQoPvUXswjYI>@JL6VIal}Ku^s{K)151#NoHaLG%Bo91b&f|L2ncg7!aW zRXQG79DdIl`owXrM6#x#_UIGs6yO&qO53(RSmIDhQ0RAkqPy#6K ztJ3<4`_$U1-~EmHpT8YXQkdVhf$CDtAX$eM-etobh@dAG+AQW5*6oYdhaHx)MS}wW z7klp+*5tM=3dfG!2m&faK`DZOC?Xvd!9r6MkS?Hz)X+OwHjt{)rP%-r5CMTu0w^US zO+^Sul@^f_Na*z&Z*URad!O&#bMAS*v!Ca?^M{L-Z;?o^>_WO-|x`5ofgbOPeD@9(89fAVGf1oVJ|mCew7X<`t2P*7QeVF;sLd`PwWS zoml*N1jzpWFTVaMyI9wWo&~U!~DZP`kf>umlwV{HFi8e-cS{2!oPC82`} z2o+i$sq{-Uce-7orTD$e+;tBtRs>ExvI{z0{kt6*th}kC6i7ldAwr=GXL>y%; z`~GlZGRM?hON83zAjIo+o*TU1^Ys{dk=yyyZ2vkAacciTs ze|gN21))r&{tx`E^cnvC=f40)`~w!l>;BVFoC24-aZ0e0 zcjuH_ww$^x>Y+gi&vDlP_Vqt&SU;V3q{)?YQ{?%rpU>~`eL8`0_^Gs^|5hXcyAA)> zZNf^Q*{PHaqq>aj)FhRXJJ3*XRd)6TKWGwUIP>TD`+;=#*0k7 zw4<|=p}8)g^w+_g&m|n&-mws z$Um=m-umyD1FT;kgfJXM2&jxB2J-;u*-RT`!NN@7LdhXzL)3NwEI~C$FU^HI8A|S_ zNck=rW!YFDZ@}8#$kywoa3_A5oSQ@_Nox{BYFS^ovX@pM2>RFOh%8oy_m5b7^rQIrd7>vBI1t?-CAn7(wrn=XrDlLx4daz5jXah3EbiTK!Wgf&UV)o4^Uz zG5{sOV-Y<({*SUJCH^(l)o%$!`T3d1vA6F0XO#Q*+6^r7KXH`w^Z518e-D7MGA_=} zSD9f>{NX=nB6|jO0+^T?9IQ@;FYPV*99mrDST#G8MCmO)KWNw#I6s_NXoz-VNOCGNI78T|3Tyf|1cb#?X3z`($a z{FGa_Zdtpy94*Mtr*4JRIqaWFE}u%Pt5qi;g3j8;CT(YQM+y|rlcbQrXL0%2=MT`_ z$5#4I|<&d|+1CpTBW4jgG-78ocM zjy#*^-^%L(?o+Hd<5`X%dsh$r@<6Sz4zT7T{Wf-Pr8H93n|#cnZDK*iofYjbHK-BGz7s@H$if;gdO zaCqCXM5(A2<>W*{{M&OY)r7-IunFvO20anD>gbp?4t_vch=R|CgD$y6n;2@bzH#Ff z`OvMhUQ1OUFq=-!BqOdDduGOUJ9`;I1tO!O^l`igpr~5*A>`2uI8s({aPS42PpH}4p&!sIL5R#0#caPsfG0CH))K)0hmG*S- zsji)+<;&@&Z{L1SxfgPyT~`mGohKn{qBW?nyU;X<3)emG-(WU$yliqf$F^0cFwr;a zI0-mnMa!Q0kA9Wm4ghCcM$$!zBE)A#9261BF;bD03%V}-e$c!>#puGf|Tt+bz6BDT0R|5`MJsfXldq+p{s7JXa86C>D zihAF#&+-i?**Sk=c-U6IjC0`BTzqVlo&{RSObefek9lvP6ySOC}AJsAlX}e-R z!#DKu1QDxzYvi(gfZcs>eTSo?V;Tv4x5Iq9>!F+wMVa6VnR~i2H%AP1dH9)L=NcH- zJIph3;V!8`adD!TG7y2gfmp16nv zXLo;tYF%k0aA>c>?HrKv7<(~5M!zCHr>c`E`{RR*3N=8kqo$>$U4<&vy!svV8Sfrv z+^^vB=hP!jA&Rn_aaE^z2cjW;K!LJ9IQyhWn^TRhX#9&?fd4VPedNt=&t`*Ta1a`Oq>=RX^=%%wUcR-ulTf<@3%_%(Q@-fn9%v!d$X!3i78|Rd7NXYnwhc3OP?UxTwg; zOu*cnJu*sjataC^tnn(EMscd`mNgL(5xz?8hel=Ft9ZwcC{gyMM{qGuvJbHGPT}jO zw)7vNHHE1ocj;oCT1o^loJz+NlcpQM?OcF2M5h{?-^lI~72oK)XzOUYq=u;fu7<1{ zG9H))>a#ZBDQ|lSs_;6bfN_VFpIqHkzP@K(3C}e-{^Rqrki@N-*SvDwlmrrrL$U*T zltN8peIgrdKz(|gk1+8&ckcXE>kf^_(~{$0?}{Sxi_6Z(mWTi!!6H<80Lp5c&GHlNqSbUlV<@6P~v-9y- z20ENH;2aB-zU1`RbR2F7*tpo`;tyYMlpC9~E-bY5l`X~F!~@1xbSTItQKl*T;oR^- zR#sNc-@jj}Gc!FqU0!|%p?=sWFB@*y;MD$9qMF;=hdrwU*+f?(bTa6VDxN51^J~}m z^bHM%+*M;n5YfW+&teO_UxjvscFMkYgs<55|Dh8EY2qw#7yJ6maYO` zh{39n2{QbN5J}NCk+4LvcltDdM5tcvQN~e?mpz#eWLWa)W-o1-}SSZ);7Qfpo z6hAjKTmqJIjrXp#kB|H;^z~|J?Fb8F-Ysq(tX#?mPdNQi$hVW5N5EKD_YIoY)J~;) zX676HCnNt`nm2>y!nDXZF!<+Ub^@Ls{VN0G;PCLEuy7M1IBx$VTO4`lzsJ}C6a9xG zKk}Bp$Ny65MSl2yv?P=5hO9=C*2v-fJrpgF(}ypb{!lO+{y-Mw$2%snmQ5bm%1i>m zhPgAcv9U2TCT8buAQ*5vZZVDzyB_QsyJJzgU#}neHI*#8!XHWuJc0em5KEC6U|jso zID_JA5iOp3*f8L{dxf0W!dx?g0Kn5s7^iFUp5Q%u)CxqUl^)P605Pz@wCe`=f5$xJ zGfl%kupIf-e`IGve*X9Pe?JrKmiA)bLZMWGy_2QX9*Fz%t#0}UaKdx!)NBl-wq zV?XxBYbR`v0x}9iOptMgpH8M&_6q*Jif(nrD!iRQOkRE@{kKO{ihqAZneoW}@R;8o z5n(){`5pvetu90khA|w=fW_HePI~TVk+$nFO1v2ot>PKUUrR2rKX~xqRcKJ#Nd(O& z3rc+tj*Wfg1FY0^XY7!@#3nf+r3`>#Ukq`I4{U5~u7VoS{1GCoC1CE04E~E+D;D%? z2d%}B;M7;p^z%f`Y~Pf9);_zY8GRdv!?^~(>861k(?h#OmZiN{OjsXWI}=;%NQ!8bG~yavMuX8ckWz`U{CqI z-b3ZG5La8{Pc$Qp&6HD^6N%o*T?E^BoZnZKKC@`J6s zJfS8sTg!OAsq<2Oc&e#=z zpWN5?2#gXazR+bdfX#5mU_P@xTpTAEufiRYkcgBuHK3cQ<3FTsHfBmp){UR zb@>|yoV;33%6>syInlqh@fbF|-2>^oHTUPJRENioG=EuN=-u_8eLyTFJP-;Nclw-q z%=z6#RZx_-YX~ZsJ6hi6B)V)Ul@V+|dAmKnHdw-J!!$zCoRz*$)5d5%q=0T}W#6IT zLM^cbb-}tiz;_dI1{1`yNp7x$h3c=E1_@G`>p{w0i6jG6K+k86pf=%1bti{3j|y;) zHF<4!-{no_3HKfQasH(QwZCt=ht}oZzhtvf{Y@uw?MvS4uF7kyuWzN?1hpzAT^4iW zFNh$$kbedqlW~o$Y`2VSKcmW9XExFb7qx#%CitUSu&$7tBwu>UBwY}Qwr0?6<)2+$ zPj^00xo>!MA2da|p~h1@VA<2wdhKi;f__}d;>@LX9=3-BwjR1H`<^OJ3ay}I2aDM3+FtZS zTzdMo#d(Tv>|PJ0AKmQXTcwj^O_8n!5|bx20m56WfRyOh(M$@0{PPRav{;V2?|MQk z8#PeswcOTT1wq?-b!LP)uC5~59(kW)x@%8Wp21RbAwc(YT!q}>!(kwYn)~_rdDq3< zzAt;pWoaj;S5f@40+~M)2rBmit>X-B>FBTvtdNwH%!2;YIc7OIIcE(eZ;p;hPv`f~ zSh~?^5(DS$c_|&mb`_nFcvT5Cg2D`qj3#6kNXEW3?F3KKrrmsd_tizjz`=@ISXv4~ zKZY6=Rc#K*X+k;giFnM8Fn-#s*Ti6qZw9E{s)yEwDin`1YrU&ixK&|3!c-)~$@b1o zBsoUqBA0@zi%UKi>74W(*{v=0FX-9<_6AacV`*sWNk`1(cKB35pUcH@SsxD%>DfBp zg)r~giL{+haA18I_wasN(Y;oPeC1$mf2B@S6~y&`5}9g+Vz&UEyERa(+v|a z)!uH@GT`4(&qN4g`dIJ$Wj&d$SzTmQ`@n`!A4}gH0iCu;tCIJv&*ZQnt#HXe?b0>* z_}J2|3`f@!0{?PV`i{O&_C2E^%QK^Xl6FiqIh3uuXXKay+g>-!ygC`tb|=3YUm=h z_Z+cXM_c=FcAGXZ3l8?zgI(-Un{2#2+~j?t>7;%+#OSDb;i7X8a)7cu@O}_*Op(00BF*oX0O>Fu$6xupGpV% z?S|w&oF;`4qk(r-@Cf^`xCD^Om=Z`B5;>RGeidkv+)2e`fapt&fB*aZ`3$}K`J$R)AV3- zRt~NE(dfeCE*ao?-e1PK5YzG^h()~3bu9*xZ39mES7&@=*P%=@lYIFGCD%isFt*a{ zx20^q;#SrJfT>%6erO3q9I<6o>!MIU$zWvuCMDt zAD;judnp)#8HCb5#Ja9s(-x!NW;M}Uq&7`D0}bR;nd?2?Z(L}O7_$|}8I{jQP*4xW z9I-bbDhE^xNIyRP_3Oo){QO7sE0(bFW1dy__VC1ngrg}BTsM5w8ihg@^L&X!y|(wm zPr*447p;zKpka&ZeCuD_xy}RK~a&dJX95;hE@h+I@(MJ{quR7)Qd@bZ&Gwt{P_MFc`TXp2xhg+1l5EZYj_)jcvYGB$_CTU!kd*M>}L#q-@% z`AR4#Xz}1AmrWi}?jQB$tyb?IWGa|dQ>642r9*uVbKT3AD?y5;q3aw+$>mct5x5i$ z45#;t`(7WX0Kc*zCOvBaQm zPN{wofq6mA5FW-I%gZ2PEWN_+HjNe&E~aS z4{6my8wGadEGJ@01=CaCGb3Efv5E`1f=ytY!K{zQkX)L zITbSVuPH5bm2ccD#k~I}75p!aG$`BBM+@avIGRZGEET`LPyWMbe?}W$oPx)g!0f{O zY&>Pu+i=NN%`VC))DrZ>ztT*68c?SIB#W?O&&hPD7%v+eHO*QjaFJQB>Aiv|l!|2F z>35|Mf~U=EACV}RJQ?HTcSKB-OY$roYhbM=UJT){;`FXCNb_=$O=b@(-FHBJEQExP zB=g)3dE=#PIx{U0QkU|Y%o9nO;H*k__wtIP)4opvbI6$@BZ$$3p@e-~Sm~mMP-1MX z6(Ph#<^);&i~S7LAESILpDIYy%~B1DPv1S6&`tumwxx%fIr#>;N?Z>-@|Ab~tF;Y( z20aicp2sp`l=sLod3t)<;LP;gQ|>iej&LMSZb$)JTo!2Ye^HV;+%b0jWH_N2;-UVr zasRLN_602x^{3^R?o8)mQ-N!H&KDtrl8&Q%r|z#%A_*$(RZtYaZ)A>s9&WHN?S;pN z&x+Xar&ul31E0%Z9$fMA<}KZy+n;Z1Ub{kg9{ZQTbEf;(l=kG>CK4v1*Qz;IWu|Qu zty|@_NAMsmQz^7K?Rx?J6*B^q)*bWvGCbJ7y1s0M%vD;VXo4gYG#6E zZz-epF1K@1);u-aHHl|BrO{X(PBWhCVxz1iCrZ1^aLqz{?CEuryT1=WPiqpl>O=zT zflyqqhG^&>kGbYb!5^a>#6&B96W3M>+0CDr_J{{jn^34~E+mN2gljXOE$%wqWG5!d zvj<4r{Fy6My|iSEa0E0Uo*npd+p;=SeSb& zNFJT*!tlQJ)_Uw^end*P@$H#T4EHm#zQp*PW9xXgvPPG4N1w#6SMyfU4B&{d)6(}V zGnFxzqYK$xO?>q`kzJcS3g{4&|6rz~SlBX@484vnGhd;;cugAc(e?T`J40xJEdH0D zuV3FZ<+%#w`ieA=bS*1}tJ`fup$d@LqUs(>dGVL+bojv=3Y?vsF0L&H72<%^QAx?F zlIeE%LcvQLma;(QJ{R-=cR2o?tBX^)7D)1%1 zKb^+Z^z=wr*)QqZ?Xxwf>G|{BM7E|3NYcj zf|nt4n0yb+T}wli?Fuzo+GvM>@#V{BKsmZPVt_O{Lq_x^##U5efoGthtf8UdrN%)D zB}yV&Ppx$6ci0$4ddNuQ^tAg<7Ruyogaq)9mvG1)g!C&*KP)kDdkWGieUxN^=ps_u zQZAW~12lj0<8d5lASegOb}8JdtD`4#vVeQr7A zx8%alagSanDrj*Z9|0c`w}&R(N09s#7}5HS-+j6FvKs`jhz@9mrV6UbO91vSfQU^l z0~?#91yC_GJXqQjtb8(TX&UUEQKjXO!>hTOnGeA@S#Kh?4XO5v4AzikE?4sYV`i$6 z!CYeO4e-ibNU1*qUDN-D*&RmsxA1e}D(Ui51-e4@Ma4x$3Hfd5l|4(dmAq#JgR`EE zyc*oq^+NacB?&mFmun4C$Q)2zw0!~C;9Y=r^yJP>T;G}v2*{}_MGUb3~8FrH1h4J$sw0l0GGMU$T zgz_?R*J0+|L(51I-%}6jz)zQg_Xx-i4>Go$C0v!Mmmyu=P<4@0K;dBHT{?ocra>%0 zZCzc}%W)wgq57>KH8kqKebc)PCN0=(v>XGn)qn%%4dU3Wil6SQcrHPc?GR~HB*IHN zhe1$q&~sm1!E0c&KRMFQ+B!TN`1CG7B(al>1C61%NKc=^jHl|p-f?wZzh8fk94Al^ z?5yO5C=g4MK`eeLQTknslY`^A2SEgJ0sQg!!>gAI@a!yBub)0QPR*9BlPRZGLKFbX z%>>P^0Bs^md%=aSWu^R`8g0Op4PVHLEU`uJk-eXVtB$^<-`GC=xdfapq3h?B4DICb zO@Z05WcO#ftLQ5s?)XkM!bO4Y4<-W=W(lUlRA}S&`3Njig-&0q<7MmWQoQn#55o&k zV#S%l11xNI0oj+&I{=O(kX7=Lw`3)Kz78GNA*dz=h}KI9vYk`U|oqXsEnW=qhuwArKs1Ngy`81&tPr>B)^s zc#tO3Qg?{J8R30@o9knyH66$)e*>AmAKFXp*GcLrT5BupHbepQjrvY~VK{bX81@r- zW|=>`ZMz)V5a@itz}qm@G7;L(TS?Z@lrz>!!&OAl>{vuXD|>+_L^y-R6DZY2#K+Le zyqtg0*?#qMqlidtVD_c+4tfk=2J)}$Ms5(5Dh?9x;y85S7B20Dpogo-C3IC;em`FF za-#V>yeIgCV8h!y#DbJho-0VlHp6QwT#`Xn_t!z(w3YTi}&(ATlq$JoqGb&$srN7 zuJdzzT-ePFrFiBgb}5lXS66&>r>$Za`DvOkuZ3fL*6vE6(tpwP&unI`?N z8Ev&)y6`4z%bciPPqk7B0S~8oT>0y0!@TlDpT))SRv{-Q_-510+nyDsB(BNjqJLk2T(cS%E&LIN)^I*ly9Om-hUjRlTSY!3D6l zB4M3l-Q0`EZ0zh(faVGUQoexyg3;5--8}|4R&rz6K3Y?0Fao1!^<{jS+IJ|vP?x{F zfmE&+b76aZWg^+V$S~E4bCpT^9L0C>92m-9Hd{xA8JK!pSN*^uz7FNa@vOv6)dkpX zoF4OcYFnG(cSOP60LKl=G^)Deoob{SSM`y=?%0G{WZ5P29y0NB0%}{s{JKrEEd*7K zWXW_%QX(3K1%!0c0Q?!3kYz&G{3kDzl!xf6BlWVF}o zr#-K9(=N}+#cN89+~-jQ9W~H37c6{VprU9+bw%+yN?Qm@$6xV6YVpE2uD=+p*cNTB zak3^XVr;N!d1notvAJne9{1Hmx`axvnlYc_V=J91F#>DJ^4N@!KM1GrKKQiHf=);bP{*+ z@kt*=p^Wi9qtNco@NFO^UFnJ|o9Z);nwac?A_76ExPiNX_hja9}+rn~H zAeLa#cH{cGVkW**O+S)NzTgw*2QB(j6z2QWD84M>zN1~IJSGM&PrJbdKhcMJW8y*B zx-~`e=+Ps62}&li?|VVBv2=8t!AbKNaCyEtj~oWivfzTfD}%c(PCV znM9sXzFK%$bt;rJ*S|ZLa%T~4FY8~+^j0`SBU)YL-CFx|^~q`*R*FWB+E1%#iTX|! zbR^joO($;(Jaw!e9NQXDE`6cvzWXS}b!W&=C+QOq#F=|!LsYTH_yMq*si)mzJ|PiX zcEWA&THE4))4ns&1U{jyePB{Aqi$CNh;70vmkGVD_!1pMaEA~RcjBObW|MN5 zu-$HvP(kuuzG$dUT)goX+u}szBqnMv4Pjc|-a~$?QDRqE*h2|Am+*5_Q^&vsz8>M9 z8yN)yBFkF(dk|_?>EwX*l#ohm9sAKM#w7xhfBX`$YMXrD8%CdX`KDF66dVMgi}9&b znLTk#L6o7POO2=SvJ+b8twceTsTN`^e5F}^W$uBqs{HHlC(-O&u0F#GxT<|OzoS(> z#(!SAil2jPP+>nkzbX<$lRer|2P{w5iVZt|R-0*YoC^FkF#%!9%Yza&Y>f&i$?!kUluWxpsskTRB zd)KeGWftM~#i?zKA>OWewP*GS+ExKN(XSc?8!g~}$rlRQOar)x_D&J*cn*OHwZu$c zfV>;ML@u5Fy)glpxOrvk4c!`fqbc>wei|YquHp+jD8AZwFLM@g?mO?G-+h(Xtl^#N zg0}QYanze5%AT1`8kdHWOgqN*&q@Lb|4o74xDQkm4EhZ2Rez7D8qCceR{wDgWU$)drm~dog=OujphO!;dY10F-!4HK0148roIn%1uIW~^N`cuhB6tQu;Z4I(j4sQ zir#Yr2!jMD0d7wJ$X&hnAWAOw>X?hP`=w~vX)oyi&QVCy~3oVz=L4$w%J_Joua}jQ|{Tj54tNOw0SFo()A&{w~J?GucR7($I*BWlN==h7qAq4 zVv(!wt3DRp5?1f42(iP;-rYD{!qXetqA)FkSogrJ|$0Q7G)?Tmr#x_%bA3 zT-qrDRvtvq^OT!~FrUt%KpLoraSOC7fUP+4FKp(X6kOaQUTj*tU11g^kB`iQ zNPA&G+ z!URgi$-dEDB0y0{8ChA57JF%xpSV!fH;?6gBu)efC+np}O2@0`P38##gN|(?DGl`? z&eYCx^S&#Z3Vh?W^XErOvqE_Gmuswi6^?aSp%}GAfG25HzLR1E&l>wRB|A`84|Hz8 z3ZVj6UY6*fPTzC7U?ZG#8f`h>Co}6toQl7)TdY%|j`yHD&EvL1V~$0n>s-uoupD-8 z*o8+TDuc2<=Z{d-i=rLnkLsgJ(?nRd7l@ypujmDIZV(}tx@p~N=OnH}$A}(0cxki| zBI+?-UV~5^a?>4k11_sD-2pJr%BD7+?gA0pSs2wn)uY4fljz z+h}q`SX8ulO6uul_P73-yy_k{lT0f6Pt-E$I6B^Hozz z3o{V1lez8pvei=^A(UemNgN#ot{-h8Fl;YIT=m@&V;BC=cp@%vrma%HSNEe7cl1H* z=k4gzl81y6ld@=6Z#TiNp4o@p@=wn<8-d)SO~T@#QvOoA`#x}?*o`x4^9l=vA+}`E z{_v|1P%2D4J!f_NfwYYnExRhGt_dc+*lhPPqu&0*nOgS@jsr?qG|Q+;E|bUi!-V}J ziBO{3WexWoeBrFGv6gu|i&?|H53+rGTu{LuiVVW;Rjp{?%g`YIX7%gE?^s`86a zIKaU7TNA)3Wx=Fd)bHsW&MnsR5oQwPLaStyvJOSP_e%ImBV`?akWRRaLLHY*#uRY5w=@J96Q?R z4%c*kIijRQ^0Z)0M0fIBw@>L_a<6||rCl{^$@RddXHhTWa7QF1b>iaVcWm9d)w{g6 zprC-4Tho=;c`KmW;@Y)Wu}WogAlU}Mt~BcNnl)05larHokpv;Mjn~s`58(2^vR|t+ zFeyCeqhHh6SLruyM49oD3omU++FlaM^rDjM%DRAwaylY>fSif z8rBlGdy3HNex7jVyS{NKI!Z;i?X4pS=jkp#xN`A@ygamF_BqJAF?rxV$hwPWMbt!@ zY)ei_c|EQR*7Uc#5&7g6-JlFN$(B%8-#NaSOm^$2NsuaW|}} zZL_;qMZ81_>27;44QY}c#r!<9rh`rp4)N{Kkv=sL;x?TiS11BJgE8)t-wuYrjsLM6 zB#hM_=HIT0`>Eo{j-BWvbXh}&)rXC*oy2i$$ zp!J^uS*xJY7Ve<1aACg70D`^01)6!?4F6&~ZLbrOZ#PcIUN4hm6yHg^PaHg|y#q>x z=X`k*LP!?H827lta9;Bz5pRW)G)rd zWx0Q?K++MNkXUM{%4WZ~C|(!-;zRnVu&eIw)8%zH&)+pH#(-<4qHNt+bPS-Yg3lbg zt~r;Zr@j3i)GE}BUI8ay7r3^wiB4VA+6+*Q%$H+vO0dtv8>{>TR!3PS*e)Szh(*>K zF?Sy6A-)3^7oDCy1NP9d_N+_s+)G#D=oMg_`Gh!tywX( z|LK!-SC#j-T>c z>wZwg7nE6u%70BtsS^S_vC%U38d)otG)~=XI+}0So>P_a$g%yPpWX(n!jH{1TrC&=qNDc2dcl%Xcd}@YD}(Uv5C+XyJJL9Jt#toM@}NU}C24 z=9$K_2hjVppjuRS>Rk6Jsh>G_3l9(tYNso#SA5!cGsqT{R=ztKU+z`$y4il4&up`0 z11C%ub?eWNYTmV>j}_j(@t*-aAlg1xdywbIf(pvT_YtLe8n@BWy0yJs8{fh)oE%9SUS4rX5kFv66#wcDr2Uj)n;*IOlITt0-fW$@l*joNC&FHR{#2*8U4 z`L#P@RCHN=i4dk8Xyuv8)^+y?_#%P_{=y4triz+w2BZ#JyL>yxP79_*Z9PBLV3X1; zLcCGyPEuVl!bKRpHn^H8jHj#Ht%exV+(o4{0F_kXr7=}$>*$yrG;C8+1S0<|EsGVn zr4VFE?~|TLa)Br5h+#+;HI%J4`ju4AD-K5~^6soPC7$EM+9LVp+si|m zfg#2l)=nD`9=PZA9R#@~5Xer&{nW~#p)>?cKWOI+O3e&Ez2*B+BzS*74iX9&ksmCV zG`a2=1B<%+H=`0IW;L(ubG6RTOy958msF;#_I)VmDCZgu3<&p`ck0fjxTn7Ic<$jo7m2`H40*S4(JX` zicnUoc_pfwx8Hk586JLRNM5%i2I*ENvlhE|hgHTD2kl$_5b%=d#Kc_NRq&$a{Ad%N zB!uP@9fV1;Z6ZWv`eBP*hn#a|wx`rOws+#sXs!+SsvstISE!7F0-NCG7?6q;cEx}l zNXM6mX%8y4fZc4O&P9 zzy!iebM;nCT_l{(6WIRflpD*aeK98Qv?YE~q=3!?(3xpCoQ~vP`>-u2_7LY52oD-M z6pxpcXD&yWC25&iilHx@)$c7;lVZJ*U>jj3NcOT$Mon!XoSz0PJ@Z$`5B>`qTuM07 zitF<~cr6R}N^zi_UK$)4+5xNw=p_41tGSvQH6&vPZyOj}R<_x+s|o5$gn>)SSn+Ri zS)zLm$R%%4jE7#x%SR_`tAPB!RzppRqt(Z@%b!@JBzBxS8_y|L-urCQb@u~z{^7p;o_FbLWbYB%bIWI|{~D+Iez=oFCfuX6HeIOo;Ch@leux@C|#Zzc5mOtxWC0 z$c5I)fcg-O0T|dg$A?(Gty2aGUuya41SN%kIld$#y@IO~?O1d~3*{BnzUPa2?}&UG z#$D?=$NABTi5$FF*|>6FuSe00X9q-y7iK7iF_Dz|N_0GZTr_0(TEJ}QygAfr65>L; zB|Ln5ilns>f9$P@F7B^z>dM2V)peq)DX#M=EmT@fKnw`8s69Y<vAfXNP3!0@~>WDg`VOV-6_y$4M|YJ#Ip20bYvi8 z({-99o*&gXD|5~uEKXfFhq@@baz? zz(ukvKmraWay<|iSFbJfF3HbkzV|&|3Y*uwxTt+ZN8TXP?8*20gg9D8%%dNq4`+c2 z-PKfL25nAsA@0x2POh_?F$Y`7hAsY!Xi{ zn$rmiyoFstFsa`mF2Yy#;LlrBnnNn&YqPtck2?iMqo-scQu~q{3nd%jS>5UB=>ZUb zf54nt6eo=KC3eh0jOw`S;>d_5m@-*`311Ru$1!z+sU~m;8pmX_;0TbP^z+)93>j(E zNIp|}w;l)Sd$N`N;5Dd~q{lfh1Gc?l{=ZYMO`bmwXRY#!b+B%f6)24_i1ip#o;TqsJZ>e+R@Cnp*^Z0dK4t+f%eh@?+5?8g{I!c1`2e&e2gY`#75ec){_eylre&M;Q=69# z;vW&4nKy~010^R!)GOV~FGV&ye5!Q7A_)-h(kbv2VRW8%*O~6H+q-;Mba7l1DL^~P@`Z=t`K48O~%x(J2%Dx2z zHqc#9>~9~-zY$PvCfVR~%G}4n;exfbH47+J<&ZG-fdhNbI1BQEzH-sV#x9ok#+yNd zz3s~qI{N{^qzLNw3=ZdpS}iGU$J%w*HefO6^CxqOM3u0WC#U3tr+$D!5gi|&CYQ{7 z;9iw`-N0*R&<&wOsSdOgKujif0oD3x+Ggg%-&U49H_+*-bJb<_JU$NDXzuNK;&WZUn5WtJA?% zx@{(^ZH3#S`u@?u^h7mMt-3+G6mU_#zYrRa46I!g7#DvjY7-8%1HEowT?~r#pYvFM z{tAA4cT~%ou;VX4HOq$7g663iD-X4V#6%rQxot74#MXDs>?Gk4(t(#v55^b0Is}=Bbr|lTyZ)iW6pHcY2f7;!*YD$WYUz7A+q`MY<=ooj-uu7=_HDze2wc7V4|jFB|$6&rq`tc$Jpg^+zZ z!l<``zgSOa<5k@=B;;f&mUu35GNKU|^hBW&1Mc-syV?@Z9NOgm%CB!t_eaOJ%q zl9oem^SF^S)W|X6SRxbfx+!tNq;Bf>r(n%In!u)T%V7s6ikbiBU0d`pu(()u_ABx6 z2f3kmVn`K%GQGk1f%|G_APm9h4a2}P+yxxMd<(am!pe@t%fjjUAXb&rB{$F`@*ADO zc!oW{Y@O?@PYUn*h|ZW&uc;q$uqMalethzDg$Yl?&;`p}2llN1!tN#}2Y_IbzaGfB zRL5pTUK)fKby2Bb26kbeuu4urKz(W#l4MpfU|`TK4c3Q}7t6x#$jb|72YOFl#BBV< zSLvX;yxN=a{U+y#Ng>#h{GDS@w1F_bCa=q(2)GQ0aytB71>hbw1=%7xCg!E>Qy%ek zCeh9}NAbfFhP1A0iop1hd#N0jV<;!!L`g2X46aX#pI6dQA824m@ptXHyAf$ ziYlz+T)cx3B*0QwF-YXaD4dbCt?hyff&PL`GRru9!E=xS&5C} zIpK!+Y@MyTK^3cR;Df=Oudc0aq?1EP6c4Q0sRw2vNZQ-cDM3h&H5$kmuqtc^qvNJ} zi)=h=`FKqY7G#gB%i{W4z9c6Dd4uq0wpRIJagM8dL$7T>EePB!G;$I0tIUA=eku#y zHNhOEQn<0yOAVA23NTMFC~)x;9%xOT@S%S-0n%SirX2L_7$N-6Vk1;O~TB^jmR${sEBG z0+uYOdgfb7q6Sjm`Q#cw?U!sLxF;_d_vC)~7mw*}9ql-w6?%vj-sTw-%KOLWfz=MT zc8u-~3Q$L4$&6Li)EdB!=_#aby3bjq50i#uyn%{yesFNGP*5DmOYnm{=uT{$ZRB}S zgpx|?n(0Zt0xBWH4or#sgU z$kL_+x^cVPp++u)-EV+oHIR*$uc@nB-0&IXYZ+wuSj-^{kj5ZBPaT0(hV##*`_~ia zTEl`WtN|Jom{`76(Z6%zASO@u9>%SP1mK^6U{arYO28!0!zX}EqJ}sLDFp?b{A76s za2dWW2&HnUy$0e2J7Mc#!L;zLq_)MhIj^v4B*eOed=4?sSe%+4?n!esgb| z;yX8~#Jp-#5>qRW#{lbI!_^zS3~uj6v$`ln3mhELQpK>5xa^br=86NK)qS zEZ9%E;a@;SKmT=IFUVY{Kqx6RHk{fi^LC|E;Ex|mcGDN{NBPi)0A?+DaT#9;-EOz@ zAnca=TP31xAQSUVhxTkN@sn?HZnRP(B?AdDyw&xM86iLx%XwKN`hrP$4oaVM zv}jHR9J>)IZw-o@`TOxfZ4wkBDRim*0rHcs;7WrB!riYV#f!lL1vM4|!1$tIpl=Le z>;X`o=YbSzl|HUKThP|$3riG8`#XTrHe_H3aF%t;wwKOJbPMQ>oI8(F^bv&gZb75g z?(537ed^HZDvfbhdRyGG{xERN!-AyxVRkQ2Qwsec)9KY@Yj^jvdutzyVrXE$16N%D zRBQTXhTxAHVv%G&vP>a@FPtUzmV))O2;=+EG34>wXVn!Yony+qHzhg`l0!R&ZVQT7 zJnY~Gk^njBX01B>H;aK>-cV@PD9h*eLbIv(EuWZkPjU7-DGI z5IgKHtR5!Kf1nJ^o>1ffGy^ZzAggm6LJ*g0vTd1G6oPX|l)EdIg0Kg~HjNl|rZ~{g z#}$*?AWmv=`z4vF^2c>vLW6+K1VSqRN-NkBG5>ffMf@P+ONPN{fB}f7tr+cqsSq?S~Xa zX|kkf6emTN!Le^GmJ)?*Weu%D$i7V_d(=S)5fxdJgRxH-Q`RIQTZk#j7_x8g{Y-Iw zzxRFpbI#{;I*oar`+I-y`?{|Cy8jTxkAQE9wLM7jz5D`*L-qadA*9(1{s&N5T3IOu zAS-;MRADIqL?i%R9r#r~w8DMcx`G1rsJgkom)Ch1myxqPrzpob7WfVP!RY`TnxBYF zr-k=H7J+K+R7-fuvC^>ZNELYe&Tj*x*2o--$szEmzTimku$i1Hyv4O?hm=$ladKgy z+isIiNXz1pyhG5ap^TA>y$pgZZh(jJN6|*OHzuGr->b|b@@LYtv4XGJKBVfHlOgsg zoZpb0vNj#?ghDP4n|_%qqhF;}1qJ#|O-+X5fdt{ew|v$vd4~#C73n-}xf9dZ7j_8p z_eSBN6Cd+IdtuTPNVNibLys07^Qx8lUa!V`zig#_S-V9>HQV>efJ1P>0U-ehLE!7p z{9h@co>%eXZ`LIgKCtH2C#&jm%=-@?{wdmvAVnKt%<lXqMzhPi_Cf8PDFpfd9p7Y}AIkNeFb6-0*2jdph@%)w%|v0j#M zMTCk%M|2;SaeQ@TF0+g@I+ex5=@Boepf1seEVtI(NV$fXP zi|Gs=$n6-~A_zqx{@q4(%X4BKZu$MNEO*3$2ID1Ad5n0Lw@6hxAe+vvuI(P?;-+_6 z+j$e#=4t5!0^u-d;=)k>f`GFXS3nmG$HcbS*uIRru31BXEI~s>~^T;E}C3u>e)ho;?q308SCTT@s`JaJTm<^YYam=$rU&c(z_$`+JVBycoQR zP3*2MN1*FGhu{L-D=1D(ln!}%@AZ!0+NQj$@w=+<@gPUBwpWwg`CL2*}+%S@{2Mrb*2abSNtGGZg;4we@+JsI`Bq?6O%A z5a;~*Bc^Zm9<}rGDxHlFX`Gv#_1_1x_g7ClGee7uf4GE;h7@+QZ)KpNRqkCAnvbLD zP_+4@^oc}&=+{ua2IsPOYtEk{F5-jN4^k_faic&|4=FDjlUF80oD116<6ahFAz{U# zbXhaP(!+MUHKDHAacFU`;3`n9zw!p8L07Z+N3vujb{oXYua%aj1 zio4kCF-Wx^y7Wfdt+5a4LnX1Us? z$OnLfX$O|0JVDERLg*;C1_4?@{|p58)j+!)syTAhI?iCUBX%;o4#eUhQCueb$=HK9Kp6G?7~(-pWHmfUD7&tCH_oL8gHr&=03z03X2 zCh>Cb-W?9ss8+UJb!)nPl#-CYhm)9bB9w9YE2L)soObA|wX`KTSU27=+sl{_#tS#k zLCJ11V#*n_i8vpAG%IeO0y8;}j8hgML}dP2Pu4>2M^r)E=B^gGFYI>Pr}AOXUipl| zXs>p!)bG7J-?%674{ed6JztQ|P)GJqxDZwUsz}$F+S(HZrKJl!ZjTc$1M{)5_=5Q0 z)E~P4n!=0gJGvVc$U8>19Y*32+Q>>5EjLkq%#Udiw-*3;I6hfdK?vIP>6qEyJ7o47YsoQ?$>ATvg@BXqOC!84QYkzhmUYUr_Ka_a;|3mdClH zC}Q#OCj8cR-V-30ejMWwqPLxA-)~_89Y-Af{{3ZFe?Pa_oA?w~MS1}T`0aH+5U`*; zFsQrwX?tco*GfE}*BE*{;_XS%hy=yhQB>qv^&n&VuY5G3gs_!@?jiBGeokH{V zv?WlBSGU#&SbXGN7j=<TX@Dl^}LwcaBn>Q6d3*{E7JTuri>LnxwZgcp}K5oCd{8#zLrQmjR<4y${l)XACOMsR~oP244oE~%n z?I=bje<~nf?#=(>SJHK!1D~SUW)PU9+h!1gz$lHS`Hl)xTVO-M{D%aipZtzv(~nsM zp`Zz?tWiZBla5(spMUOL58VX`uRi)1% zN0aAW{NyD6BJ#Uwody8ky^hJdRj^NT9^62->`GYcsa{EZw^?X)d9R!n>U|T@2!1y!8f`#je%vu7-2$^=5MM$1+Sjsu<;BT{&Fv;5uap#g`>nu=eZhn&EP1z)EMZf7Dw(9uGLf9anlm0tb+D zhb}&enE|ovT%ryJNFDr>OYg>lp2>epj@z*X(EI9xLtF)!j%ZP-RNZYvCH06s4=M1R zxS~3}{)owvajh*aI(sLdx}I^;Ta{Rwk|4pXHUI}5bJYJ-Z}jfZzBWW;m~Uo&{%YFo zhr1to_I^C1I$odmRTqYGvSlvt@g7hFt!}|NG;fvhU;RP9#@V1qzY*?Yj0Uo;S!`d@ zbV9-%i2$cOPInRJdi5WlK+$F*pW*kdY;x!d9Pk5onnL~&_{+(L;_{{N(|*j^`upOF z!$o~wRveU<6L5A3OgxvIYa<9=^#LB#Uf5GleT=p*3?AY9;_G;0h7MN?sgCschFLya)qQv3mYDl|9AGN3Vf#oOE@GGhCNX zBE<{^4hP7dn{=SIp?rNrr`JzXE1C`9whomHAR-zMIF&4`ip^dT_~zg4{VFC`yvGnU zu?y~6qfqj%LWQx5LJX+u>7Ih2SP2 zfrcRze_)2Xwn`MFDkg(7LMDk!O$aZdHKdFeqeE6ZDn9cZFN{J4E+;1tG#w0 znN^Id6FeH--{%I*P`_V)NRf5UmDQ!{weqqB4dp7b)k=qz(VCq44Q$jJb!|m0K%aPW zemZ5%{N6}k%KhL6q+l9Jdb*x_Q0G6LW;QmBWo7u|GfmMf@>U8O(alHQd z^p#mvv_;zC`2BJpbp#eKL1YYc~jHO zRS&lySL|dmrD#59?(<#;usu_(r(8oOz3dG}M>p8+)br@wK@bLIMK)bofzRhIxAzF2 zXU0=8O4FMEa$1=Jf##u}w5R+ssQ@ER+VL1Vj631-YH$M@Q!=429QyVx6O=sJjuCD7 zU3=!getp&jqso^-w{L+T4%!P+vJPE&q-v_-)A@ALc8M`in9-5oQW0pXc{Wzg;Xw)u z4Bo$dZUadwO$zyOC$<6(UK+Bi9Kx~6%7gH$oSA$%sC{&TEbAZq(4J_6u5pM#*+R~i=GfY^VS<}dg-dz1Bdhe6p zI?w5RH$vX&CzUE!KjLf|=4y~c8PWvgZ1}h61|n;6xA5~m2qJh=e<`&pXz8t9eSzSq zzu^<&&9NW1y3d+pDRW&TeAXZT)))oEjzm|X9CCbg>wgO3zMO+94u)72tw_zd$LjF^ zl*psXu82+R&;Tm&X&;e4vgT=sQUN^*6fx))*}~@;eVyVDA7|omgaRMlzq3gbOizHh zka2mEQvRm&96G!SvoD;GIYAjMIC<*{(-vB{qGJ$7uI6eO^ryE___uQ?30jJV^_GID z4(OR|irh%%QhgT)6I@!Z0RGD(OS?Dg2$v4eb`&#F@Igyu@#@M-z1Bn!+Ig0VD z_mX;Un0y36K}*d_%N!Ldz!Z?&lYpTuyHWXr=EHSZCEgS$2cSDG=bAfuTtr8cs6Zg$ zA_Sg%=XM53?SY{Nmi~mJVuDDy}cR*L8;e2qN4nU=zzvY*Hu4_07pHd8(_pD84CJg(p11m`k`F_7Ku`aJ- z14h-*_hRk6m`U0KBj{Z&PA(|x$GQ8R>2 zPXBjy)klvGDB9d8l-rX4>Ve`!KxUV&j8?3E5EsIWup_+>5 z%-_)fM3d3Zy_AlS;~Jw!O8{NH-pob02RiWj;h|AAXaCo#n~Xg~L2Qd|#CDf93_uAMKgn6TY*G%>3lv*8N)cJ}cf94w9XCZ} z0K70(e*l^Tj4Go}Sx6H|2Uw1Rv=|0oP4r*R$mz^dX!6x{+eLHWJ?L+s+w}(8*Pi=^ zIJrS@4CtMCOLvJX1O6fR!;2;JHD&v*Gt@6t41_j9X#f&z`(uGoLkID3zxm_DmX~e< zQvZWJzTRo`P(de;aGOMRT;-tLZ&?(Dpq>}s2Pp3wG<8h4DZ~F zHZo&*oEuNu?d+9Ag)JSQ9ZHleVK>0Cz6UgGAOEBQw4F*6m?k7>owF0i-g|c;h2*2! zBAB1s3N=IkG*Ocs=(8fqC&+GwEQjkxQx8G(ztn@WkP+c5#xGu2_G`hc22MdBD5B3D zjw$~?%Pp1h( z_k@23a<2ehf-w0)bNktKor-nuFVM$}Fvlyyy+Cc&^!LLROA8SbKWdDkfdKp*N*=rz z;9~erXO)F+_;FJr<*)pm+d8y`6HavXC#YFcHkLL-fQa3jCVe=+N9tP^U%0{*H!cMC z$UEJ|N}W00JbC~3BF~qF(k}>nUmOIasF816TQ=Qq+BpBf4At@^%MB&9oll{2*U;B| zf>M2c!#dph+4Gnk4XD=J&ukTjt}J&9)G#9T#>2-iAbH%UME?;&EaZe$Gow%1Loe zHaQxW421oGiZ2X@H(gx*bOmj-A)<$!oeM)tOBI|IkjZNs(R)%G1(jYb+xE?30Y&{v z$D(l)L#&ia&_L<35d(crn`4!1-Q5+KzpQ|ioaOlcM=_F|eeqwlYUq}XoV|K|)6M`N zF*M~lKn69$-Hm;&nrA>6Jse?>HDP9wi{@tlY!Td60rT$%|7J){2Nrd^mSxYLX?hyN zSp!(YE+7@<>K6FYxhnF@M+IKZvlYR^qa5(6KpYJtYX!jF?Bk{E1TbQwO&2`){9hy0 z-Wc2B(eEHC{hGv&e#ohHFaq&*qeh_DD8`QI0m60$KyOIC$#K7h@tDN=1;sn(9x6oS z5l+E86kKxmDR|Fn^7ex$+Ugs)e%0{o`JGxomNfrk1e8L9yi|l(7aH;m*j0RI-X7oy z3IrYbc*~PONvx`+KH4YgnUwhZ)bEBqRh5^>5;A9>v}tH%;8#D~c_=fPP3UbFMDTMP z!<8o_&@qqsS=+vnzMc`&W(9uqt})Pv_@FD#NTfoV1$4)Tj+q0j3glB*BSY0>Z!c#8 zOxFQP`@fO^4B>%kN+or&6-L*Wew&uFL=AKPsUz=nXT&O;< zN}X7C3RzRZo!N*Mz0<-P2WC(rQMb53GS0P1@*G0^Yy5tLpa28jzs@lZ$|^rd-G4Do z%0R4yya@m_7W}C=p;iH1A)wcs31k_BN8DLD1=?oNTN{~A)T<#xvyJ=iX{^C#F&GBZ zpUZtYjm~WNnr%bkJ%Oy;8H`MFqj~f%G#D4#%cXyTMB>z-1!O%)5U8^EXU(3@+ac%t zBJqP>)np&3{&93dhwSFKEC^)#f1GO&Xiey&b5VPDbhjut0UwG_8Djlf={BrcG4^Ai-eeDBMb)FtOEncY)7hurTt;)kzXx=+{#<(IQvA-1)S59L`CiiaCb$j$0h(tdW5SZ}!_$Jc|+fV(RD z_VY@HV)thZm$?uRXA166rm;g7F>3)-?so<6B1qbH*= z_ta<1uyrBHsWkMT$I@cuQH`>RuEs7LNGb^IeiY>!i7;F5^xhs@{@d|k%k2YndK*K>=8?zbt~X=Cn_mX?cf5GS*On*`ZV)oca0>3V`; ziPeE=V0-fpOq)h9dCt#GIk2vMBwyx!vI)7f?rAXj3~r=LJrZm4d6(vlx&iRE_uhtl zx!kNhax8um{@CLuPbQc!!=URYnB%uv&r=1*xL~4PDqvyi(v`Ms(+74Q9-V$$l~X-a zW~5{x;FfNQ5-t2@I!s8rt$ZMOzh^2YFPXYcJ;fS_YO! za-KzLk-j7qCuKJEeJ@=nj zn~z$XOdFA2x8xv3pAy!X`kr|s|AKo;tXNhwbqs>KN8@JxJ3D6tdt7bMg+U14_Cd_9 zs-mK|Xs=5mIxz3#l#i0FQo&m98@ojNqiOyTbDkB|4BlJ}KUq|@PL}VPjLaWi!XQ++ zIzF=2VZ{qc=?($DYIi=UExbEh7F3iNkfB&5ri^{_Q{)D=bzD`TZlw^chT1#TmIv9x z2i8{SNU)w$RY?|mxQCn9#1_ujy|5j}`DHc`8(q9UWDCyP8h zSl1iHm6d&7?DYjTBSZ%Q&%V>C<=aB$_J%}Gx&~JJY1@AYbV+`O8+2W%Z zx%nyw!-V%u#pQXj+C*T6YfJKMv)lkDxMsDg?Hf3KQkikAId$=Dz+$^S<^F7=)#_`G zPkCxjSgw|A?(J#W6D1=O+}XMi4z|J<4$?gRD-Dn4j~~**UYznysVhLOm-1C!%$L)a z$6KHGOy3A|HMu=CuTn=%SEQz_bfruVG-QG97b`{!b-Rp)dx_$?_(18Cfo1K2>A zExP^+QGOv3^YJvn+)W1*{3X>`si?{Jr8#OixUQhGbd{7tjCsK0A0M4WYztAcJEznAs<0*e7)7(@fZ~bN^+$vf;65?=On0mVsqX zN>`L$c;=|hzhTdVJrcmcafwDzI$_z(;?@|gFG`EAR^x}dSjsy|3R$X|zm^C?rS%J& z-<59o(oP;W&@LPq{c{2w4p1ucGr&y6(cOJ^asT)aoec1%&C>hu?%lil3@@@2U))q6 z&R-3B!^|ahR@jZZEzG_iLM<{#wa({IzZ^!KI;&biAbbmivE|KF$^C!V_F#VG1(zoZ z@a%g!+Vgkq2h6Lg?-d7XKFz$krIOj_-r^~0H1kUq^LIXV4b1(0#-jZhN1DldTBl!- zKYk)NQ@VANO7<8A|MAX)8kIQ?D9)fv|G5xuyJB0XcEcDc|9KP&9F$v?3g!iYpGUuwq^y~x<%G9+V56-$H`#lQXqOqBFs%4F zyXW}G%yfT7jl0T8)lAp^S=X_u<*7#A>=4$w(m5M9>TPX+u@ci?7d3AiIMQ<*#)Ho? zAj%Oe+8@CU2bYsJbSZyuDyu;OiS~**$9|Vx#16~Q4YKK>gU%{Fr zUBI#cbof!>0VM6My%D8k7L7R$WB#uLmEkF?zcNTp0ZTph1NPb0J8Cz)702ESl~D7RM9g(k%jX#ywKm>y~p&evWQf9hRv=46Uk3t zWcXvRc+{Lug;kdAZJGhQ!yLydy79xQ*NQ!R!2N~=6QMkrl1KTW!Sqg0&vF6m3jK4P z&^Pw!y`OZ<8c*!N)7}65QqN)pif&mJ7oXR-a>?hRtL*R&C&akBBh(y zI^BN!>?u(J%QF!QuIX`pn`iPS_Kfq+%T))aGv6x1P2@!tM{go&{j7VwLna=@@XayK&qKeJR5c7F;4OBhOc%nz|YTnlVWlmg61q+yozt^0v;+V=X|bt z*Th=*sR>=i14wNKRy+V4B0Gl#e(dhByVtnqa&zZp*PJcNIhWrm*PMq{DO7VSfSbKl zTY*<{2Ja2K7WJ(93mEZghqe??E1tMF-?D>?Yrz6O+idNO1o`jQCAe<-7Ci)VEY;?~ z<8;`*qlUU&+3_*K>*r z3fg4Mu~gP!DIPz})jX3PN7gd{DOfTNHBZ+Ml;(!bwffH%+FPyt0u#m`Niz>T40lw& zwDDGsS_*8al?Yg9w6`L+-Z19MH~Bk?;%T;4H=Uz4u{aQX46{C`xQIf5X3zfleA&e+ z)P6u5VO z+V9C!T|GY(ZvS+eC8p#aG4TL(-Ul<3$6PsFP~RF#(GSHfS{xst&5aGt%6mxvja?dF z(O>y-IYjlzm0!nHzF}`ql`D%AbQ=`L0RyuB+v%!-qKMqg*`IQaK1n6sFsF@RfBE|s z_tvR+nJt8#6cLM=qg>v?P&@0?dAw91C!p0gG?AoEiC@lXwZ5gXQ$S>-1N?Gt3AwhH z%9<}NPEJl1j!htJB`lH}GmR`%H;xWzm`YU?t2sMqXp^KLkgKUD!{|=@7SgJn<=$RI zk;NE91#k@Yix%gdjc6o@=GkKesvXQn7n#!!-Dzpo9_&+RQM?eCk)02DY@mOsB9_I4 zyzoTD=Tn*5@xG4M35_HQEUsF)a%`T()8q}6B}i`5cq~g!0PJ0=<~EO-?#OufEgTZ|mXYCQnyYuNBDS?K#Xr!0!zHamTlnXr#ANYu6A(svZ$+#Lpg%TW zQWObhAQD0!SV4brKnU65w(=5MFr6j1^M_!ycyd@%r6TADfm6QMw1<_pSm|Ky4tg-4 z6#OsjXW`k7;aSUHTg*R$FWXa-S2I`{R9c=ax7y43hT63|mQZfQTKzp~CTuWv-e39C z(w2tt)@m#dT3#u|0?)RW{}}CR^G@#&avOCzuv}Zx6QYaf9q;3q$Ohe&X!6e~>=oTs zl(aiat5fvs})8;1(R2ts9tn7^p{_V@Sw&T@(=Z zr{|q3vgpm+%;LwNkGaC{k=({%Uum+viD=laPKh~BwsM#pG9zCq_@*uDcpi{gWl^*! zv5v7ALqE@x2c|_`Tn&m}KI#Jo=-%s6IjHb#nzcnSnjtul-`-*Aoq=oYi|uQk_v)nSoINxLbK6mXd^e2PkYKG; z#!%q{g<2uYM5lqOpB4Rr=KZ=APXx`eU9#9I?v@VkPjF%?u9>bU>w* ze&G1F=E)>I1|&LbTik%*f$8~qQvx6UP!j)^Sa>xYCfAMbBAG|)ais{E2Aj%-f_Q>k(L1(@`NM*k-tq>21?lt)6UF0(A?_=~ zPf0dgX{A6soawyjRiQaNvnSsx#Thvou<@;GKqS}De69QP1$V9Q4c$r8FP|_XJbsdI z%D(^lsK<_c1~>t>3XOT2GyNPg9fUf3#sAeFsQ_5eN7*X}TAOJvpfymX)|q=(54d6* zK^}hyhh-JKb>2o31EP__!LH86hMDn;R^TkECz} zBB|nx!V49%c~4(grj+D zZ!S|W{$i!c4{j+Z@iXqxEbt*7Zf->!KknP7Jy5v&w~9*N)(CRt60l#L!=m%xJ-+Vl zjF*fv@YZ*XZ1^PGKALtzKiSs=x`c>BkUIz|-UMGzq0hv##KH0OxTAwfyIaO$E^BoT zsr96q-UIY)b+9%VHDcr#`gsV|{-%BaR40XZT$Q! z-X{5kZVs?Xf;AF7^>!Tv2=4nv*fr6?l>hrM*@c9z=?aZ)BCbF>g$X83J4S0!s?7Ms zNstNd5Vga0Hp8mMGWQSBo|V0_LQ1NttA7hkC$J#VIvbDZBvV6Uvwrs@Gk2?)b#U*U zl$u(=&++&h+YvU+z(&EOe_<*JMm&qK=h&sTzGc8gKIS5iADA9h`K~K~ehQk)ilm?a zWp}34_Vs+laIxfhQA<6z7@{>dK1f~rT5)euTy8GYTj%b}t}P7`U^$qCPZJ0`;=eQs7^c*L5WD8<_ywa04^tlsypGn-});O&Pr($(L zr>FvoiU$jTBr3AL)R6ZK2(UUD-&$`6Ji0|xPk;Y}@8w-&@1MXXZM+JYv2br}KGT@@ zC#mfMlRkT65nx4kS#QEK8*WapIS`k4N5?2u2admxKD_Y0at{(LXe|?O`hYgx96JEK zE_$Gla{nFFRN?IWs<-w@tbw{kFm@$_Gw9nNb|W6RBZ7bm54dYJ$z+oq6TIYDNIO%Oyk2bIbAwZE?DL zD>A$h1e!X3`nOzBvU`hyNK7IuEFsEBUaOk;^>ME{GRfIFY?%dG07q!ikDgEg`+!N) zoJ(-%3$0J99hhd>?!lT+Zt{c;BOW#2R^eY(>24!=2L=ew!X^$L=8f-l{Qs#8@UoIy z%g)HiBA%beU5pMEb^={2e8`N*Tbjmrk_n3iT{Vc5%vJTa~woMM4(h(7^g8>sL)2PN$< z-zS7wEFT{yP;19WIbbe6clvR6SJyYFgzhn?z4oi9hiO~4y@=q(PLv>XZQ&1U6yPan zx6F&X!R$o`EPoFRb;@akY)3r3jo>zO>J!P<u-Q^Cq$qBYv6dM;gd1<#ozagDa=tD z156Gyo%M!WK2@ukUPwXH#|>aVEkGf8vrS+Vnc}vKbzc4Xk|W?b z+v})m^|mx`Mvxw?-)1L7K(puQe!<-$)&cxuU&MjOC>hod7Ukb-sDA#M2dRD0d2<0g z!_|xwfK_W}OMp2j6#BKb9WGp=^ngPKYeG~4ON16-8KfuU;|FR+^xsrL84v`^DSl^T zP@#Uf)qSQ>tvFVVuu-f1IwGXdsXO*{Hon(t_aF?|Xu`9raR5)kT(WwI7~>6yZCv~k zNrX-H?E}<=3)~=$VZWDI*NwV5s<IVI{E9Vwk}i2a$k+Z!?d3|A24emeu|i%09C?Z++FRSZRu2 zm?8W`Euep9?nVJW5|ps?vx=>wKd^9QpEco$(=Z0AZEzmL&#yGSwqJ;Yo$BAHuwgVc~_+ci#}) zX92rUK)A(kMX+m%7QeB`i=(I&g1vpVyvmH#sk37K{IqhyHD%Nd4lE?xEjc8yoA4PM zn9kY#=xIUg7~8876lF8nLLUez0!%a7Td~G&B6?=lpr*kjkQs*jx3ic{}J$!oW)kynxQY`zPBviz3QG>*>YQPWXAQOW`@Rq{vpFa8)uP#1o;X z8r>ijDQ-sUPZ|oMHi@9dhJ0?#G|?tVr>*>#O)CP{{H+g66I#dw{2*_X#>_&dGJifp zwIG5GM*|Ai@VN0>%Q(DSBnZH?vKv|>`~%Rtiu9Pbc%kLk33q(IT`AVh_&>wi0y$*DVLSGt83RQ^7(y6WJcl%`eGH$giEhchXjx_ zbPx4x{_y$o|*QbemI42+gVl85FvsuRad5zh^5b&`k-kwoFW}R@286v zIUHQ0Rshc{pegd$M)ArVWAIr-P6?9np4We%Jmq4Ru#T77Taf7VZHH%eiRWh}L9Wb( z8y^q~i@S{ue@gu!paM{~GO&sNq+v?bfJp>=jgQSRVSfl(&9MMvi^h7HggyHIeJPwa zHlE21CJ4?8*2=(PF5A+QcITR*1gzk~x9QUxXfUm%c&kA%1G4Z|%$C$`aRGp+!*DO4 z`i9X_BnI^AXIhUio>wsjf8B~~kR5ovlyjp{fpSh|GeSHUx^>h||Nh51J0xBQvm^WW zOPRlB%vbI7))%V$bH|kKv=p4Y|6pN7T}_i;liq30!~^wlhM?>p2SMB$yOFoRM)>8t zte$H7YoGiZtO^uY`bUIqZPd-k_@u&!KV@Xp@I%Jj5>57+XQkn?9|h9sOwkXBs5##! zrl}y9J^R-8Xxf?$?Fn21d4p5mroU0;W&Hz?_Zu__4>*+cxJ*~U>vsgRz9W~;tzr;7 ztnH3UyeRo}YAJNef!3kO>BMy(SZlVPsryo8kG8NW!DH1c0dEFUyd#k0y7 ziG-JVCD7ardwZskE(GbCkJtKv>^N5V{P?1n5v;xP&dyX3wpH3N`3%=jz-Vlj zQ$No(4?pB#Moq+i-=YNHq}_`Q);HG+1nT&xp1TLQ_+6lv+Gs13pg~vzx$bSKMNOpV5k8C+Kk~9N& z6z;Ly-@?D~xCWo3XICKgc|KeEP%?5k9T>L?^aeEMe;n=s(YE&N8rdRQIvo)AOZ}xD=PLH0i-z|l7=ccK> zx)-N*UYw0@+KxnfQ{SHk8?*FU0&?1%;3Yg4n@)TA>m>Ad~^QFrrm!MQc=`QhK|W~vk%v($0o+}WX3S9wp%kOle}2iu~Y zBjrs>URf9l?>@|IZAfNwj>2}9n|>6l-vNvMk{@{XRQky|-v{&Q^_nY(Lnl&iW_5M7 za$-%(D1vpUR4YK!Dzd>;6zj^=$KdI^e%RmNRWmNVfBvaMp{?!08cR$Hh!_yfQ-vZQ z58rFBmAa+FM;%oioD$K&M(35^dw0SJe8hw-xH5sd`@Xjdru}%zj-F#`w@G>*-V+(_ z3XQTG<2N}Y0jIHpI{o9eAk5vX1jr%5N=-pQxWCfJq{4e9EC0a)7*TdU@KWm>cK+6S z{b@>1y-i2KSz-Ux#l^*wemgef#5ax^xA60mp?r^W9k?4Ww|Kq05r>|Aed&g$Q#(0G zPKh@x?={-GEI1s<_l{QEf%j1rJ z+G?kL9_n4Woj5PO=X`kQPdW0cArHLFqlQ24>HJCKT}dLaGv`M@`eG;}JC1VcB~mP?j8#S;flT85tb zDXDJ;7iL*FV!~8s^DxeFltNMJoMw?#d9yN<;e0eO%dtFf;8L%ov~>Gcg3;=b#A@0+ zOhQ=!zxnNic}6;k@~CaGG*XtjV%wx&h);O~4EaR&+D0B9pjVmczIQo1yy-Eb{LzmR?!s}Kmhh-glJ#%Kkqqx`)_<+) zS{)8-K$j;)3)Y;{FU@xRDAcR5xiEg-x1H&G@GBto5^ilrdi`@FQ{Ow>enE!aR5(a> z6YZUt%&?sm&fuX@J+GX;Eq*`_s>TnneP-FqfNX=Ah@{oqirSoGk7XV_`=u(d!H1ei z{f3rv@Iw%P&MB=afa~WztaiBP4!WXsI5l^hkxmo#pk%j#NUG|KOzy=lH4a46$UIvx zmD4tYMT_kAuP#%#jdM1Xz*>8v)QMSe?NUGKm7>2x@Vv6^rAyCUe?~gj0zw}K_j8K? zJXTbmQ}Ye#dvwPCN4DM^Q64#c~m!!e)0AGMHIySE9{NWZ;ZrSFK*yB3p0TB%r2=2_|!6`?9t{K?B z)G{+$u)91|lH{N^T|nMPn~qQdG2P4qFW)>G+)P6Nt0j;108W(tj|bq^hU)w?1*X5w zGEJ6)m}CJZC>N)TN$y*O{T-KA5l_$cBR;7G<1sFU?XSnPZe%N5Id~iDR;A|aBk4RM z`NywEX%y)pgf+LN7e~*9Gz>=V6OV!eO?LEIj*{Vqvw=*g_Gg;VK|^qKUX>_7_rye8 z(v-2Y+*}U|X*IK}uU0Dnd7<)&M^(2wjnKYP$ZW4S>4>b~-a?jW$@ehnS|Z6?zxZC# zbRIy;)_lz^EtX5(oF_&OFq%O76EK;=F<5eWCqMGdipyXODB;dU|JqX?&T#+OKUgZr zip@6If!u9_Izn#-t)8vjQ8o* zob}2f1tLNlbsLA+bIz@gr$Ni{NM5|>M$3XBv<0|4XbUnmWwJOt`O_~f*cz)d<4@_a zqkHhO#+^YgpKLpPVfp>w)ckq5%^BGA3#B4}wA~!KV95^R9p=4KQTE`@znU%@;%Y_n z6lAI@ENpixs4~5E=!q4VdbO_aC(eLF#SY=S-Ob+PRHHAPKTl)a?0Izk9qHu!>4DA8 zKc!=O)gOU@i733BsT^@VQ&|YBW>@55)WGm%uuev{#su?ijC(XJRX?y83uI1*4oKKf zFh3bucnOavit^%tm+0(=Y!ttef%SgkDEqq5dx`V-sAO?y>s`pgoihvduHk_B{LuB= zllH-DS>cI~tB%LHwe#=UzYIPjyoKH-;_G%@ZPt;|SF4p%*hAmZIq~ zK}l?=wZ0t2Gt73vpsoC8Rfe!ghTI7~H%ulhapawMjnZ(@bbH8;@R;aZDAltYl?(Iu zMFWz2=Dp$trj}ruYY}7@XP($H`5T$j;Sjv=oQ_J&J-`SBv|pOL?xj|m9f#B}D!$TViJgP) zROqbEwkL^+<+GKUuV!L6V)=&#UYAR4#UMdvp@=Z$5sJK49yzCE95R;FmzAo;qAcRn zZxZ#X55vB;O$Dz}*D;LMK? z)AOSG(Q(O$sqJTaztfqjo9&ghP2yc*J=ye@>oD~oAl1Y!D|YT}Pp7I_Vr%PGeY}2- zJ7@l*5ORGa3(Qj{%V231NXQgnvBFsWxRX{kmRqMtk%wOM(ek zGyiFc@MX3;t(WmV@NN6$2HFnN?^7fqJ;p$^F~IO&<_25i`W*B^T@KJcmgUHoWmjJ} zdQqMkzFeBkCG%|C-q&!aZ#60k)wnEh6#Mi}CY!ejX5Nuk5O{|)5R7+Jl5H3PWIR6{ zZ<-^-O%A2K1MXIdwF^k%(ZbfNj=NaL`F^9r$+R2O74aU=74j{wQ9??#Cm3rm%f%6|6q~#e4XlD zpaAgiY?aNToi=J-ep=648Cg3aa(ujvUH|^R)Kkx)+^2*3JR`hGgmyYclIm4GU)*~G zgieC=g*ZUDEjm_Cm`ku8S+x5loRE}JGG1Kt%1j3`MFDYFwJG0q!i*QyN zc_DG4EdKtz8wlRgkYV~*V3S}HY`jdrzL;8f<&@-^&;9+_`RS-_6PSOQukI3|Ryv_I zFkZjvO{kIz{W8s3s*C@*^EM4Y`2xOG1Fr$kXBmjl)ZT(WL0mC+1ZKiZX?Ucju0)_fPzlB{qaZw`%qzO@ZR7`pzzOa-c==0 zP66kUBS$QG5Zo55z(-h(Jl(?hck_Fr>hSJNxS!axBXq}(O#`H&lzipEf$8d{^6De2 zBUY=IQd`fNa{m72Rq3E4!(-e(yR;8au!HoXW|?M*o51uijxb*`+j$sJwjL7GAPh#> z5Aeom_eoe*90pfHA63=k^e9xd5q$+VI!Q@MoTx5(i%SdO_@8LU13Q=6s5AuWgR#+d zi0lfD$g}ik?4jdI%0lng-{MiUm+Cu@$JHB1PK447ML)GiRWD{&@138HAn$5r$FI_l zuHX^M4~_%y%Wefx@{y`sZw>Wo6zE$iUDnweYa-fBw}noBSubR)pwVqOGSUHVf)u=ls`W3)%|&=OWvuJ4L7f zStE?qo1dzebR+0(6F2lFFE!8;tQO#^tq%bmTM=aL_GUBo5Hp|m7E2U z0{7i*32Wa|R4er~RtNRXOcsxo*dxcM9R^^`a{Ei0A$ zgmvdPXr-ro#dom|s1ujL6+HR+7pMM;@1kk#*3V4ITzK@KF z5u`$TnN5phkf-DC=;?VchtpSPJx(AzON$cTc*&~Qc=nn%e7Nsv-c2DIiNxJ>Stwgh zt7wC73(MPNhL?(S)3wZ|&r)6(jxyWr@!Wt>Xo1Wl*`-ifx7^wSNPl#WHKLQ+w{Fxw z(MF7Vk&VVBcNXNk<0Y36qu%#}g?6Kqq$FDzp7kx!tbn*^s1&>zqoDDqgnKw2O2$F~ zGwC|hr?KoIZ@+72>WAHjf&`!O$03~!ihbD3_(Sf?6|QRzAmBgN863hdk>muP4I}Hx zQia1nui4QBYNjCD^!{}5vn$PWmLp8Uw&{kDssBWWp0`FA95>Zf9q8zj4M>Fcu^ZsV zux|PEK2Eg{ieuU{%Q3E_3#^hTl}ob_FHp8{ze(+FuQ~||3Sc1ZG0V#f9G+Lrd4}jf zSq+#tp+6i)nn(j!P4@1~lkO4lUO0;}L&lJRFPe1V$tJHc;Om_W+37p==LOJN;D1Fr zFpS9pzxTDv)+%dJpR5euA3ZkAG{C8#RwByh`h?+CZG@?nRf7<80n$Zm_UoXEr1!Pg z^?WW)XY-?*E+L>qG&mohoQJIQ4K?3qNCIW1+7~o=Wr4bdEoQHs7EB<-t}VsZ65YIJ zs#&U$8Y$jsN4H6p>l9xIGc?^*3=GX8pOe5|G}^ZYIgFzDAtHRqP)=pdYi17TFzm5OZ z!dXRxnrb{eMKEh{}1HsR`tisNUkP`Dl0RLKi)gaVX2*xCuu7WLyiA?ZT=h1^nGTU+w9>;9u#jHfHfwa?DMz=uo< zb;Y1Tit+c6sE{W=?O!ffS&jTM2=9v=8S)%2f{**e%`+{25uK#n2tfnLTIVQz;A2_Q z5usc5@9VybyTj@ko!}wD3jL!1G5a=4jgCPP?9uyqT7_VJ0F$cjEP*Try36j_l?vEy zv6V8ivYmh(g2~3r1^aw*X%P@^tFSLHW~U?Ay^C3b)L9*PyCQPkTeA@GBy)hz?~m+) z4igO3^f;@Hi+Q5a2*FbL=aK82Kc{UVTI`*<&5b0=gNX@V54$iPN!*vW5h6S7x##K+ zD$rD@o%_sSwK?vbq-3f6cVXmBL*qnZE+o>Nfb=mLFIzLSUwZqAh0QN9th?3)WQRUN z*Fd=IkR{m)f+gJhBkeNOt{jIhC~%_hhdiGkD81&j?ca^Uk}})FkcJ7hK)!;w-?4?$ z@Eb8TF*|$vnN&hMaAxi|Wa(si3*gJg&%i7v+yauK1W=M@=b+G^3Y^WDi0e@AN|Mg_ zk(VM1{4ZR>3}~$7<2!-t-fD%L9suQvRY1)xZJpw!5W4=^3m~TgXZ{gCnH9bsNZA$0SCO{ut_XJs-Zp}urbrM<(;H&G`i5-%NDCdL z$pVcdKhT7fd@@VE2YZD^REFlaK=IN%xdr*9Z_D}_CWk{fJLmY;7J(7)C(4ac=z$=; zh?tYt&eVhi?t|##G2H9S7~jfwFXJ_Ts&)Um2}zbnpmg*CeCl3+p+NaT$QQX3p09tb z^tBTL`(Y!P>p2rfqRbnd5yqLZCsext&N?t@)Y0DyTdr%_-&d}VT9>#PA@SsKYCIV; zgs%={>8ylyzrgTEE@6}PpBF=gxYB#%5w0_O&X5owf-g@*o-YNEl=r-JJC$Q@oWFjM ze$%=-DqnJz5An{_V(i56o?v#vaA-#q_V;=WHBJlR<6Tm}4Krid&3wNJ3}#@;;l6&I z>v>3WC_-c##&H!Hhwnf0u&u3(px^E&kdl1qz%mGn{DfKtQ0?dCBx)JlzN>w5!RHk9 zK0Wk4UVAq;-HEBGezFu;y{x~70&4RM3PxBUHi4i>j@^S#CQ(XiMbp_TgvTqa`(}+d z0oc&U^_&?w!3VA&Sy3B$Md&Pc|0I&rI2*vs1b)yk`jmGJFT+80fD8=uf(uP<5PZR4 zhtb5wIVibi&U6cXl<{eFf>eJ&{!H{%MW$izG&?tGCC(6N2kSNfNg}YK=l>&*oS(6d zTS1^U>}^Z(T4<|A5!lCY3G-1uYwvym1m^bfp0I;CN722dCetJl(%lntux?4}B^Zwt!8kxDgtN`Cukgo!6am<%cto`PVQn21X!5{s99 zSadsS6}Cr_-WbACd_+wMuw#)?7&}rwCe1LjJZoDx)W~vqhz}26IQjGjV<;dPMVtv& zVFrb-poBI0FZUa!bRJtlsw9$1;(HbL6(sk;WFwEdM17PE@GZtG!OuZj3Tm8R5&TIs z{5X6bj2@smLuS&}Jr9VW1no(ukqq$N0B0=~bV{Sv-x9>6=uz$z4@7Q<1uv66BDOJL|TJC#8`;iEBvp zv%)p#2b(SI27MS2iwF||%IAOECXRd8wzTeBgM>=t+98Wbi}CSGDda-S5y(tkfhYqm z+sg--ws>JTdGuR)|D=BP2xzafUNFUAGJHkz*^vkNwxHya9YJM}$|A$+$@{hHd(xmz zI8?q)DBfhbw5r=}I2@HI2fvK@eBpx=O+yQ_p|bI|#kPQWp1P2`MFns@kn-_rQhfpL zuXqz3T`^xkQykAXqvK7HGW&899oxf9eAEp`_?U0mW+^L!gBM`6;KDMXV)F!0kCW(B zuqyg2e&VwE;iXkr9YuNt$1Y|n{s12%6z7pdl5D`xibCEY?8wPIk%>w|Fw!**Iy~5v zHUCLY#2Qp@_yE!W{-39n#eSyv{>|1+(5wa67*dsnF*PJo3hY1`Tj)n z!FDA2@9;t}Z)o2Hj-rXZeNJ&{sbya*G{EXX3q2`G# z7)+L*dqoVS&xAvZ1=Sv4yevZx4ERBUGuSNi5GxRLsS^ zlh?-wr89M%hzkVVLVmS$3lOh+@i4HxKYxDmHvnEEReRn?=R{-3g(eUWj=1#w!s#$7yhHWQJ2=}5N}6z%X$C)MSrDNPb>3+v=3#j6U*2Ev%E~k$NGGSFoFB@z%kDL_|i8 zyQvo32h0CCh`{p?e+F#+f;Qk#!H3Lh?F1lqOIx>F&b>PbyCoW8VCMVdl!Q5h79*8s z&SODZYca-OZ+(T+4gi6@mr*geYOY0_DMzN6J2 z+Nv~U+d6vL`1r`C8&}`mmyX!3V^A&s&!9F?XK^%ReNgwTtWHY1&mJ%6nT#oPA@nE0 zcIqR+gtNE+kdt3n_)7Uy6B)W2q-k;QVf@uq`t+JztIVa2EFh_S)`lP08U z@A~UGoal4X@4o91-R`9O&J?93$i9{vDQGKkH_ZjZ?)c@YqUXm*yvL z{^;#h0?9FG0FrbbB;_yo_lGR@`fXt>Eo8|aqFA&Mym>e?fT_q)1DmtPxW*Wxgj!a{ zV@`k>Wo3;)vn1pAw(+^y-z^E~jsq7y8oVuy68#P}P%4|Nw`sXd^`3R=i*Q{Tt_!`V zYh*;|;Uv_)8vq|{hbCnVW@mJMvZos#5c=gj}k3I9T# zBf5E`F%h*mG=$PZYi}Pzzxex<7NA4!{X$_^Euf>~Fr6;w71v91spYLaEVY+#5vTR_ z*G`LANOZ_rsoQ0UemOea^zN5Mq_IA2gR(#w{=Yts6?v+Pn5=9p1Z((TrRo5F`91Sy z(d^?pmar|evbEF0pjXLvNG($B0sodc>nWmMgk?n376BUL%^tGd2D)QPSBPhgnU@Y? zWv9F-%VGyXTKTzTJby2HnycGY)qQFyL}V<^;h+!{s?1z0HOM| z1o(KESa|pNH$56!EaH|4kHz*vIqhz-QHjEZ(bnWFYlXQCCKe!O%0fD)4BfhZj(Dm=fk00Mb(FxO;e4Mt>dK(b>f~+hz#Ve~T z!E+qyB*&Jof{XF3=lSGZdXiY(5lzkoSvMH@-w)Sa{RV^Gk*1w~Cv=#ORYfVvV{R-g z7>v;;P-Rz7N9Qtt(9+gSDNo0SVS7n}Ka-`S`JfbNxY|r(rhlW&O&!!xu&ZVOMPYM=aQ*@G6Y& ztPkBYhL_+9&E>;6%75KZFx&~8BK>~>eE!FV0J(6yvW${Bi{(y%dtYr4`&x>e2eML9 zj{j^}*N|pAHe>0RLIly7!mz5q3CUUBA#~j^y*(FOf<(5I!Vj1N?rYE)HkvK8f1 z+i9tHal~!O_bez{M9m@(X1rZFjSE65pgXdqIydtJ)#PY-?W?bU|>IrTK1tGEmHPSOqUBh$b+ zz{Zk6O{DhJsh;LE`#3F(lf43{fX7rK9A}{0s7IO~%|gZ=03DPU-~ooMv~_`=!1gOI zsq(5Z1zi`9?|WY$ zo<8xU{$fIl-7PwRE#Ux*fFo=#>VSbb4j3UejqwT;mQ9BKnRjkIy_y)G0Du1m*+t9K zKQDHAsGaBI+0*>>YZQNV-G`YH&^`}}x?e~2cK4$P&;_OIg4&gDm?=}?gCFz}Y?Str z8|x{&18W{o6T*FdLf5jWN7|auUvX{DT{?`qww?M)6G40$MK*nGt`v~T*b;B^NW9zX zirX^e!D~Y0dVj_;Log6ZQ~sW+^?ZQdyKsyP2nr^F88x3Db~SOf)5s?gYD*w`?#yK+ zB85z-%Hz|VaZpRXfTS{bq^a%9Z9L~P$l<&PzUi}jCd_OtBK#|^uQQew>%Jw z%?}M0gTfDLyL&np>slqZ)S9fS3a#fctok!DX?-^4jI-3YWg$|GTy{f{4V9=E!g=TC zlXy@u$x!rPld5>IFP5dF*3*`=V%Bdk&DYD!FD{NSgglp4ZP3B7KC7=GO(OwT6XUHR z6=wxyrN=8265g7kZx{%myal@)F5k#Qd_&NG_#Naz#uQo>ycwHw#|5~PkjgG zZfIwtnFh^0*}v}870<`>8PeB~H`T||EEQ}ubTo9S2=@1+o(VVBM_Jqf?#lNB#Sru; z@}Mj`{pjmc9=WdzTLuotnYRWM&S_XLxSp?XGdpW!Rc~Y){y9EHz&6ToY1R1=T)B`YUd}p8<4#B<8rYMhm2Kg08-nv<#agwi3ey$8%HXsO^ zO)>!|0%Kgh+!qLjCi>$WXh0MG7;%+0{B-9V`MJ6OY8@8}Z$M7Wfo-2DI;omt?m|uN|T8nXNH^YhzC-t^4il(j+!Ib;EfO{y(N5VwrFWLaO-6tCuL+d2K`;;DoGX_>RPR^}Bukqv74I}WEq1;nHi9|ZE zGT<^Ur`Z_3&u;u>&_GjL-GOp_!SUnp{H^Lc!u*SUs0&cDu6H8t0>EVfiNv-&V307Q zlS70aEequ?;P%qC!M63;+?(2Nd57*1>P#Yf1S~_?Pbmp71Rk9Ny-D{>8ceCb6R|gu zkqut@Vr*k02r-JeeECC%`FiA$AV+AXda7fE&1tsv`SGRgQDHUMS=w)r8r-O|eL%Wj zl7T!wNp9wW@yrV}G=MQ)`SZOwrKNAcQbuA!@V_2n?7Abtb+L|Hu0Y8>yl>gPeuFR`(nnL;*Xy-2kUhR(lSdZm}Fauqm?V z+{&-iZo^<3HL^SN#vK2g;B2%LT(~-baa*9jzkz0Ydp*rn7N(gH*f1z!pnUDxwbVYF zg?wvUTk{9V$|o6#XnMC?9hq5jl{o6*Qu)Ls<=#ka3@hx6}Sd*li zmtl(36z>q-ou#qigGewKxqn&{SxHgP)s?f*11T9IYgr>;qFKPoTFEvOiNrd5jFj7{ zZwtSw#$k%Riooy8t|Zhp`*GY@6^%X?JO?C$iwhc_Jj)5i6@X}%fi+KvEel$~lPLRY z*9JcL#SAqOd_0@oC=wI@5^!op?4M$4&j-()YO1p!?~R=-n$$6Wv8D`%oWmu#Ll-uJ zzH7G>1NUhgGDM{ZaMbY+dofj$tBQH0#=TEH9D-jQ<}{>YojXvCw)|AihW<6=JpS|8 zJP<7BSpMrAlR5o|==!cOkvXo(Wb`xDvOSoRC_I1ZkYtDKq-YB#!Dac>vUQhNP#p2- z9O0c2d$^a1Br=-fB*{()d4WI7k9m=Op;Ha4a$h-`YS%b4_0y)WH0*H+6kurD@hCP4 zjC*LpO7bS=&#xOHpAfU$_aOtF;vtuB!gl5q65mbLhYaLh>Q^K`ey40`tsV-tn~4i+ z9P%)woF`j+^K!C&z7Q4VV&GVK?hBl>`bJbubpkzHU_tp0A!{}3ir7ty)3=tPKAJlq z70XCj9nDnDTym8{g2*><6H5GwdBUD$h$f^igdS9lm2tX&tTJZc45HTL&gX0(fuq_A zO09KfW~Pn^F60CySjB0qVIJf@)T`J5uYy|`!h0XN+q>1Gw$cZZG4Aw@S!dVCJA(3k#*vT(h%A zzG+A+IyB`%OqF*)t--{nV(%xJ55cLL4aCT4hI&A17Yew55&vZavK5tLVZ|rYD!cJD z&=OzmQP*WgUkzEOn}38bWTX2KLzS5*69#dv^2y|`7{)o3c!mqHPD(Azd%aY~Lw4W# z>4`aep$$K$LH`fw!*pI+9DYH}Xoh_1(sfTj35T8N6S;+@tvhQZn(N#;n@>{+07SKn z(qrPU8mIy4c3}gP42;dVR6fq*&Yh9oxg&>G$J)~!!TbgZ`VM%q_NbJ16B!|5@IU2z zJA3}~#fE?$bZ#-5(THmDQ|zSM{#+8>goW_s%j9xXLGAph8|`JWo&$>+e7`9jRXdnm zy@|tDI_+bbkH^khnd;+*%O`6@SWbddV@Ju%%8FsbK&?ZWf&f&Bp5S|-SnP3q29pcP z42V}Yfh$K?9S6tCh8~!quf`IPu&-|vLnCx`F>e5iz1d)`eD~DR1E;4w3|S?8zA|NS zp1!oQI5U*hNr6cz@-VzhK5|5kGFTlrfeVH-p}FW#PwVI7Q9Jg$j4j+E0Gt^z;05BZ z*FZq19^2v!clsqb=CE^nwQ7g@ZF}R@VRhk}_CVFEa1{6ip|MbuJlU*DQR}=UpXXYW zIB)91IjF31WB0iYBMDtq>80W|_9}v+!@ymfwGfZ&zO>N^bwQ67dUv0(adUx@?$HWzn_bP5z#n7d~l<+Tg|Wfp;x=eo>^&Kf6R zz=MT^0Q`RAH=?D|TEy6b)*YvvTB(|VzpFx#>au*oQ?lwp4DvdRod~ip*eV&H)!w;f zIPNT9ZoYn-zN5KcXtNiua;5AMtkhkueL%kN9@mD6N0($y`=pM-wrW4F;)6{Fbk;*H7+uJplMwswI|o#}NV z{v0`by?g;9~NH~@roN(p)`fdoCkfqf2N?fZfA|MH1du95$~(O zG%xxC{>asKbZBd%aN9?t6C8e))(U8uMr zu;J@coF{!m^SHl6RyjZp!FP;6@XOMk+upl(`{yWpqRk-kiNpfEOlYwa4s=JDhFm$NT)*wN3!Ww(3ab?2t2~Emw&#RG z>^x&XSV!EVo;YlPxIe)Bso8D`dV~r_p3L0d;BC0zV#QUpuIR=(EAHibU@#%Kdg;XcMfyS#*}4B;#vr4P0+D)> z#3&w&(>j*WRRS&Uhr~iQ;Aw8JT@s}DgC}&tOXVZ%F=@yDkqv`u_TUMcWIr8G7t7TRYscA^J z*8Mep*rjs8C5sEbQ-QuF;m1t`?}m8gE%Bu)s(*;_hUvHh4zRSx{6tZah^%ZjH#+IY zm)2DdyBRgYlwup_dFRft?NQqiW7JM2-2u6P95`cg}+a85t1L%?R z$9888D{juvPQU0QD6_Y{34M!i%Q_K+ePDW87;%u{_=_n7BR@mZjUM@t@yq&=`)Qry z-JiZbVOn^P&JFfA%{9e}u{@Xo&FN@o_pNn)`sb&%d*XS{@SEZt_RR6o@2m7&`rgVMx{x4QvUM45 zcz&})Uj^peqpMr@|Go#x>z|4A^g+L9cC?lMy3Cm~$qC5#_Smbk?QduvJbxGd5BxD| zswb?4GGuG;zzXuCMl#5)`2$kQHe_r!0KXQ2L$MMfmhBZM(fjlt$~t}+jn{*IpUQx% zIBxLuP|13hqO%=4SLqYDbqT6Wj3V$ioX+V)a4oQxo>`7Gnu#9d;Bc(qS|~yvg8jWU zEcRzhf}$j{kPA`z+Y#y{-N2iGt&2>ovXYWx7J*|nOvhs*BU=%FQ|V=j0_Q@;jNDh} zGB0A~mfKWUb7YZ*{rir#z4pYRz`uGz3z8~;F*d1|w$kJ$L;!=EiwekvUqZsEa3y`C zqWoiNzdB}sJ-~0rsfB~TH~ts)xf!Fv_I0Oj1U)d}U$C=x|EE)!Ush(d2eAV+j-`d2 ziENzkhLaVpVh9smTm-tm(&vpBo0qKQ+3hDVcJ|2UJ-F6-_cVgmInrar+Fl#`I6AhW z=B}JuqIwH_Cib)F7XNtJ)kW^@;k6sw)EZ@&0q_JI8_T*wc=JZVbz)tT92~ab*L(F? z7U+qOR#G>kF`w&u5#i&v=-~#462cA7Km4~twz8<+LGrhIpyK~zY9l&U=;H#AAntiR%$5b3=XCh4e%;vhS7joCb{7CmRT04B5;PLMiWD8} zK@711P!syRu)!>#JFOz7+izA$a5JFF5JfN*hS_1I=E{J@wHuH!FprZ^MWCMg@^Re| zk;Lj1eAk?i4vEJ_QsZx!NliZzPrp&d%?oZBJ*!~hqshFu+q4pZ}&H)!x zW1MLMH1PY(jD6wC%2I3228`VZqIu<(kbry-;OTkTrQY5s2+7l~fueOyvmZd#|B!k} z&}{k>G^G9(YfDCKGq|veU=QT~1vY{D(natu>ZSjZhA#=5!L9;xdT!^-8|m#Cl4!h( z_M-%pM|KwCA}Uas%K}pEtV+Dd&Jf}L`lC6oyxfym!mApyW42<6u)H{9inE4#An641 z4Czp9*qW00GgAsc7uUUJn`PH-d(8m!Q0aC0%e+d@8ihi+$6if&?xZqK#*HR;A|RCy zx%4TCoqR6K>K;ce8$KI%_Gxns**>_&&6^IBm5?F_EaBMT;9&P3ARx@gLy#CT?Rs91 zLY%8Ym)XzbS~uh|y$hbV1L6S!9!=mZrokfA*jUCi9drlWVjwp}m1XJ_wKAH|wIG(O zOsNCD2}?c@D=iRr@H|-usKXH4Up`$}893lPi?isI*FO_m;-c~O=N1}tlC3gP0 z?_I)#5r_E%4g%Rp%PSi&`j6Y&+h-vVR*6JV8j$b-^)hZl4zYonz!$cfQJn8KICxV$ z6MtWE(vFjYl9RI6I7k)`i17?OipNOj$*1QXUIgIm`9EoIuKMC6G9ePx(HZI;Lhrl?={2~zy{seaaFMZi6bV1 z8xWeP^H|bIYx$JC*zYEp;dF02E+m%x%-4>0n1hUv7qU$Gw0UGter2zH!^oj{jQBfr zW!{90>r7lAxNeY6v#%rFzU5FYUcfK zNVi5AiWQ0%U@{HHY9@)V`j$x#C2^Qm$3qE99b@fM!>=M?EK9$=p zic!wL%llq-aU;Wi#=O|-$`C@smI2d9KkYVXz5J``#?N2^p~$wyzl9~**sW?Pde$n# zH6z+Vr`%BTJZWXM8lN-+tN0v1bnQ|Xf+4DwP+x%-l&6jon}{H-0}3af+#o&Z_70d_ z5}rC5fFbGD?z3LH+C%wRz9i>H9~&5!NVXPTi#FGi<1&-2Z6{P4yFN;9miz_yMo-{} zl`EAs0U+ZG<&;1>*UGEQ`Oz>%_6T4ICuIfXjVEWqvI5Ygncay*vuT$p%}$QHC&S;P zD&s4?Gobym>ba@bOT}ln0%U~jdjHA3@1?hCww&~Etc6g$tus7P$BkU>b&`{yTPtbN z*+t;6nvsksByGnC?^5%ETDUTk6BD!fz+O&LNcd+H)gVINW~`4`D#a~FCfsT0tCS0c z^f52=_P4kx-NV1Y-gK#G@=tD7*C%Auw=(5&9=$A`_1(>YBoQX~8z0x*In3du*bE9^#`LbF`2; z5ZeR2eA7`Va4o>t_R&2!F;YZVowQk3csNKY8(Tu1gM!9%n$s>ZV(j)JQM&)X&P1!V z*_1OZg3HI4KLsSL$4w=#I=eszWDVzm51j?3)`J<8fd+xPP4)O+za0Ntz8eT*&6nNU z%S$?))9VeCa!LmG#atHh#1g?>4w9NaC(w@NmRMQ9`IOyFnr37FEZklb*qH$V3OfyX zV^1Vj0$$2BsK=2?Go7g)n1wP-&uBlo8+Z!`5#U*XUqW9Hiswz$5s!Qr&#1Vx$jVXUvZBYSmI1tA6M)2#py)u+B&cB|RL=WHc?pZGCVc5UVK(>SNfhYL_<<~8G%rk&QH2h`QhpMj7_jdO(=G>EkDPCN`mf`bIaVj{-Jl z3isnWw{kPy94*0B>c3*xiTA5z%AI2I4mPdh(txtqhuTYoKFKftMl$oWxujfQM1NXY z3ifqP7Lq*jJVv&^p|nQ9EdzqUW8Jmh=a(h2TNsx}oSijVe{>E6DJs0kh3h&8QUVeY zQ=fW8+(l#UHfao>6fos`zf3-QWID?G5NA~7-FTrWIu3T!Cj<+5*qLMaD3$c{XI^1h zPR>7@oSU~ZDjJt)j7mPNKun}&rU`*3af&B=dZP&;GUtT8a8TH5#Z?l<61r3-JXWKk zopzn0XzsWRYbicv8Z<}R|7GZhboLRiM(sg zOYkry&qyC+diw0pP7L;t$;9rTeWV(GrX9f;>qqWGcu%n@ZYYef2Y--QDS=sd<8 zunCWku_zsIaXs;nU#&tU?Uce(^B2b8JQ03tJ_+`{NADJB%|r|mc9Ic>u5N%0nD)hY z*?49Z_ce*f6CLTpx9n%^Ju3hWlPd!fjUJD6WjEOyXbrfwdF{hb5vtajg41!If(I#! zmBk7w1%au-i8Z$Gc|#rBw-BRcrQ8agBmkMzq!MctH|kWFO@~5#Ky<<86fMtV`)a9>f)?$@p`3}NPHZFJr23?JjkB1Mabkdt{phSx8Zmv z6V41l)nVI*B0z}JFNHJhAT-zBvH8ZJY^iTBL(m%VYKEO2)pK|CF@@D9m@E}vdJkxD z=6FRbUn)2-!25tm@SXNLpmtDUq`zGZz1@8HOET~KQki42m0-)*`5o-=uqK9Et zHbAck*OEqEvV;h9ck7Ek>V80SHy^LYj^{2PhnKFqvAU$JbY$K%$R>rg2@Qg&Y~kj1 z7D?w6K>QvmDH?TRpNX* z<@tUEj%m|OX2X>%;QHv_^7pknF?zX-V*eMnk)X*D3E&h*c zLwz=;6Utk^_S{5-^Tg$GQDA#L`EicWwMShf!99E-*hPqiZ_c{Fxxazi6BSvdDv+U! zR<^QK!^eAOd-U4guy-lc9tQ+rJ-JS)?33` z_wNaL?3I=6=(N!H}b&p4Y8J!z^i!&qN;oCRo_1YQQU4-x7$2`oTSB={3ThLB5{mbX#%5hLGDv}uCj-22bh%$+=V)J+NLA~go(+q|zC;!DG{TGJu zaP%PdlEGLd_;R;z5h09W;Chp3PxF=r=!Kdmt6g1%yc;{GMkS=W4@kJBA@$_tg+mRnb6+1`xaEa_%1)04 z0e4r8xxSZy`dGBZNWSToE>;|7ltRin%*1tuN~Uw z!(Zw&-hqv6Ub8=;baB9)s`_q22LG>;aU{x+Y>5I8c60H|t^i+e*|G)6$PfcN4-Tlf z1Q_ce1j;&7dugF(P@BV+wq^GMh_oZg}WAni)y>YZgMrUO$c<|Jfo{9-;KOm%b9j`GqKS&wLXutU;7(qmZagYSmZ16kH|9Anfd_7+jZwOe<-$*%0!n~$C}f<~~oz!mu8N551= zE$}3HrENi1;+gWN&Xh>-ymjX3*(IvT%M&{v$+eGki|F8ELSC9{+DqQO_qJ(lfP)=` zrMULGH@}%!E^`PW?!9j+_zeys|FQ9|s^8-g{Jq&v6($@ed@}Z~?Yci@^3j%`($Q=y z)I<=ba14s(WPf_nOD9~&+TJyo>(d!M=W)jSMyP*ir;>CmH=7eJrmS6~a(Gs*?{9A~?vIo)()CfGG?FL8fX8^F*ohC9ip7SGi1~1UnEHVYQ11aalD}a>Fb<0Gabt0HWeON z-osb*z%OiNz@$s|z2m;M;?uu;nU$6zY>+GvrxXZuq7r|Noqnr#Z&l-BzjqZo3Aj=6)tKv5gy0!D@2HkkaW^#<>0g8P!?nllcbQa?dIBB7 zxNNHnH=jLIa|9*w1C?Lj2M#->nGm@u_E)QYyv#<4tWm>TZp}2vd>jIAhWA>zpo}h$ zcO80k4zaY?B0)qHoCN3)9Di;*#MWr#;feos@w-Tg#IKY~KOdDxTw>d+e$K(rWY3rz z$&pC%8+534lc`<^I6UjUtbA1P$$Qg>Rvd~G1h)XPqv3l>M*TSc8Kp^eIfx>t!ZtOb zG2!8jTb^^8>6JIy$Lr|d^qFAd>;275J14d!mS@*S;i;VJV((6;n!VLt&%HuM@^NrH z>%2U<{1)d@D{-j5nXC19y1e0R#8AbG6uzk|9e44OBwnDZ@zyU7_CS;u4)k+7X*i;U zmy9mWY)@L;ZhyVHIcCA}=at=Lj;j1ElxjA=0-ZG%G6SMw7o`CwPnW4gBHa`OJb^6aNk@_b1Bk61o##HeKKRJ(N#9(6U$W zp7XW3_N0WiJ0~0N@U>dMxn8in)rG)}7P$Y4u@$ zQLdfMTOIq)k~R!fdnr0t*)v?65e>AlY7;oaqv&UwQ&(h(tA5g}i`Sf}E4h}kl6CQP z{kT}R%kRPhK_3@;{-R9zrwW6E=C8IGewBPe-nE@h&U)s>kHHh!PDPVN<(aJSOGEC5 zkjfqO=J7(~QGr(MxJGN7gH~VR7ncOsQDPBnN;@~-JM)%ke$=}}z1(!VJa9(JrNVSt z^68NYU@3G9Wtm0$NOAR4d6C8Ewx34kYruZzX1{mc_jrI-67}O%k_8c<9$rZLWk$}V zAgvgc)7ea7`#f}Pwugn2{mjJTUw!&jG)H+^ByhjH#YbbmnGn~-slo@$_LXiIZQF^U=QiiLhpVr39*I2W3 z46Y6ep1C73TDJJ6b~nq9L3955OhKk0LjslAuAGbp?C7^mmG;>%ALrWTuh9ec?8N?T9ESoD}~@VQB2gMMj(Lk}Uf-4v^*zCURbbn&7N0-#oCAhZj2>?%`?Xua&IF9VM?+;Zy;r zdkhAf@zDOr%i(7!C+2V7bBsO{@wT^D(n`;*B*#rHP$`yAl<%GLMWCMws^#AVFD9<7}_$#vizrdsEy~$%Zv&!^dBi2ftoe z{OQkS)5rM!>>%#nw72ez2RAJ0ki90n{6LhFHg7EEqJ{spd17T&0sT(3ws^w>nMdaL zp>60}7=9O9HP81u;fanr#{XKCq_DsJ)G^gl>7 zV_mrT*0?koJXl|%k(u1aoFR7?DWl1;W}Cl;&-FD%s#Gsa$jTZO-&zsjv`>)tP0kRA z`BWg7MOs_I%O;uf5Z5CwRv`i8&QBuFn`~_s>U`Q* zk=x->LwX0dOSmuP6mC04^-fQgliJCV4~cG0try2ZjlxdbVQfGP8%__KEH8pR4-1%7 z2<<3uKOjQdIU;44?N6skr;^mdlB4}i7MBI-Nb(`cUBdb{f`(8EmE|YVhca$d2XX08 zh-D3j$gY05@N4A6FZ(PoJ!9OOTyzOU8Tha+`X0y3z}*^3HBrZG9QV%2NyW=NjqTLU zu;sveaemap#K9g({ospNrbdB%c||!xkd);pFww2AwVqyrtepGy_P5aW(yM+k@3TsZ zO`OQ%*t`bOu#d`_)kDuHy&W$+!)t!YH)p~Kqh4_mnq{-4T0CEy;FwN@ocJ}ugOi9c z`9`V48MqBDWtH9TPUG6~K;=rNctLSe&22*Y+q0|eAw*3=?p+SU{H>Dn`$Jada>Qp|k2sWOM?4MN z@+ra1%`kxoIMOObDtxAI1h2UdUu%ZYWAA%Y=$J00vzKSl+&e~_A zr7k(xDDh^uTcWBnlVxXq(c|LueaUyi+3gxys|jpaLH~MFpONcsORn6m6~AW$-FLV> zJ=f3vlTf}S!Dhn+rciT!wytvJNWoLt+MIr#4fEA=u3uBf`GI9;`2C)^0R8km%RuY$ zj_R5H;}7LOYP)3KiMddj<<`eiTYNc4b46yTxBc+=iH}PE4Rc4#$L-fZ7D4Hm9tf%J zb|j|BxxGoM1KTBc>j(;WOR=&lnmX3r@CvFRN^_AY}T*A zrYBS*`2r@ZYr5rEhPc)iSMhhh2QA%O8d3{Hz0dYdJw{4b zW1X@v?`;aI#SO;;=wecY0_c+YMAYv0pUu81lEPdok^L)xkhJJ>%kbMy%yp39He>8O zjUzIk277lRt1>)1T%!kK(V^Z|v5*XY6WPi!(ZqLzSfACiR+j}-I6};N?p_W~`k{aN zBuiv)1Kn@3`0jAO-y=Nzz&9AGX|`7y+1xGB?<#0(DJXuiS!36yTDNA&!ZJQM4y#tw zyMG^)ttHJE3=eYD#~K+1>XHK$X1Z=Hk#%pMV!>pj6?P3<^<_l%zYO7RO6H&sa0tYE zgVL<0?CZ1-Gw})((_Zy@WmU9jGbk1Kp@2a&_2T-WMT?NXcZ5bbb$k=uW#Rnw1kvvh-Lx857ad)yibNL@h|AxHcPQU4Pw!Anm^7#+2Lydua%k9%zhSdlq1?|e zWhG52IL<}jpIN?ddK!~qYMo=zSt@U9vX?GXp68OnBom%#JTF7?cK6`9KvR9k!8;i( zUY4TkbKOHDd-x`PNe(eGG*q$f>FZNo1+RQ~cDC&Ts2=Q^e8L2P7`dtPT6Di$W!^kX zXA3qxqONqmzR&5DYkSVi1)rXoS0TK%o`(7VlwMup;B;4!R$3c+3--a|`WoOp@s zE5*gkc}W?yg^OQ_??f;wS8?MyeAwqWi#g9JV&^O>R;|??e3w6; z-C!v!)>YVUoFyHY9du;`Q5Trr9#<(9C_8ArxqgUc6KL!I0{R&3--*Z29}UQC_5+X< zwXwdRZu~erwfG19#-y9mGN4>KCY|%Ju3B;BEq9NC$M)BgIv&wvYdbrtot(>}m3Tr^ zC!89Q zJXG$q@QtFL#tlPS4~P(bd#=F!;IH3k(9&?ep5_e68y%i>KKELQN2BLlw90qFLMY^J z<{*zkFJtA3d?>yGm*#;Tn|0&LEhRyVcFz(a2NpTLsF!ggViX9s0-z`!w!5QybaXW6 z1rh_!9e^AjMrb^cQjnGu+BrV=u5_?v%W+pp^q7T2Lu7iW*q1vA&dGk z1ih1sb2J~-L7Z5pgfcvQw2W^5`dyg!>lyW5Kw}OsE=n9g%w1TDr0^mj79(Z|^18{bK1o|MiT(n zm?Qjv>Z5C5*4m)Vi-Il4uY4P6%a0Y^_h7~>Pxrv_Y+(Eh=>N6)g|t*|tmvu#u>`6r zD!Fn?{rxf3e>g|J0yEzsdhmK1f}IyZ2#Q^InV$2V zQrnA()1$A6Y&5$QR}PeVr!XXOo_5_s8ku5@6O?&E*=3;(7^Zh!20YT7w?RKJ-8lXK zC;*tAaoXp0sr>)nElMRv8gDny*FOprue2R6&#(pY+X?;`nZh)$e=su~#=1HyfXsxg z3mlk@f6Z|7=WEn+`~5-U=n(WIKvq@Ry#h4^{tMwtiP8l9-UGlvhJjuh_Wuxd*Cd*S zEZ*fR)sz$p9$?{pkL1=X%M@>QC{jSputVlXN`q#qVa)>GyVBS5hSs$eo>mTp36%VA z`i!X?8_NT2y{|#&i*MryV5J9w6#j~z%hkL?rr5Olc2h3mcWuPnE0}SOQs!NQko3qr zL{5&;{7l-KETTo6y7(Zk^9TlWGaa@F&s)}0HffXlXPGfCE8bH#I#^>C>Pdfi4 z$(Ud6w}7Y&S4RU(-^XD{SAE>+s;q0|K4j!XZErw=1ikb!pfKBhhAq&RGg_lqMVcSh!+S13OU;!uBN$Ayd>TLYf$ z8E=)=ws;JNJsC$Ze?UYH4KL+%L%n05-%tm(ld(qF#Sy68$h-;DbsVbw!|8G! zc1X+J+jGHx?U3o~=<~0>-1rlNY0hM}6pyT1T5=nihoebZ7%_9vXc+ovS7CHF9Yg%> zcLDF)B$=F{6V=V^&TI1v3!y;SQbG@8pln1b3;$6N7#(VrnPbo~9oFszR8+tHlc?oi zGK5sS&D#PND=Tc0osLkn1U(bLc+yqgQ-B6c(f49cp;{Ts*JfG3uZbKB%A+eYwOpaF zG`BU*F3iuzOh}lhyL+0+oH)(nw*kX{(|cniZB;TjpZ!2EqZrcKxs8vC&vN^|*@!xo z7%|rOp6JKd55Fb$LKH8r78n;Qk(N<`W@Uqf){S)5PzD`fWB8};>h0fAw9w*#=n8<$OeO) z5Gf@ng()`ohM{OXB=a=vxiym_4V0kd!bFQVD-dPq-f2C^^B>m|6N37RI;jjdwUkdb z@BcI+a%V*_;1;nDMlL4{vKCXKRQm6p{udVK?{#zKLv_S^OW40iVSHOJ zW%`e%^{$WdP14Nib4)heRgx<#%)sIJ&Cl5GNN{M|5F90K zZX@!(=Hlg5@o#ewPT+InK*vuw>%}0AnX$gXSL4cclY%*+Bk>eF#pZkKq~60TOCevenr^r7MTX6 zt`-P{l@g{^;Qdv?av2WtoUzx4ghs;klZcQF=vRQvNV_t=qYhMtAGp-YTs~Jt5~UE~ zSZETZ3w=GZuCw z{s101?J}nB1?x-GmM$&}S7c7g@P0JLU|dAlf^tXy4_jXz57qzuKb30UQPP6SQdCN^ z6xqg-LaQia-z6ej_FYBFHocRm>?*Qm%}$C5St3i;GRDYmEQ7K9&K>nJ@89El|LDEM zy|4Sa=XKWSd7c5_6{VR8)?#ENv*LIQ}t2U$Hv;x9`#W+XUWx46(OjV{;M8 zJ|gd?xGgQH?!w21A*1slu zAY~HFT@4T48^nbAo?Te@0?W4wO$^LbVCIH)Ivqp9YnwK0qEkOZTF8sZ;~(?)vosf> z0hFWtMh)eA3!y}T&JUnISvBsPoU~(=C?5&{ZT9!dr5WQU`-Ena;^tf)jx8v=moPIm zO=>`tNDdsA;9HtDlICjI^+dMR52bh`yt6A-rxNb8@3l!ZX(R*uBZ}f4}By zLnD)LOmlu%k@WVhUj>kJA|M9~i(^m#{uST_Q`w;kh``R7=>&F2X>B_K?KJ&9b|D;{ zakbFex1XCkGfhPngNcGTA^Xh#o`UM34HzG?7(+i$7M9sKj6xNngK)vYuYpVhI}WW1 zb)5wP>p$*(5AoQWzVUn!lag{DYy?6vgxN9bJ>c2Lp%(}VU_O;W$O41Nf32(w($Mj> zWl3L4wz_po$zKh1FbCj8)z#I_P;KO=$a&5Sr>byS(>>`i?MYKS9Zt_JiE3--4#9oj zym=VdF|fU-mlj7dwO`%4w}H-anxWzL;!Z>z;oyp8VcO(7GWPT5!K+uUyasxdHvqNZ zp2I(|N|18PrCS@8wl>X2aqT~U8ja0;(|}zo=sg3)`{4oL`bh3B2QYu$zWw{N*TWI{ zYqV@dQ8f^VT(-s@-|9PZf=lqUtZWQeJ)aJ7*lBO-m^gFX`g1a9ZB%hqz*yU!qQPaI za1y#+fx7i(YYogB#ulyurVvlJ0~xfjk#VWt-yQ3`r09T(bNMV&5iRY4z-7EU*qEbX zCiMjvP(c?*6d)50QN9_w_I?2)e_$MOkAS}};{`~z=$SLmf#duC+UtzOSR_T)bal&? zE!mdD5Cv0^(Tdq!;dsKtDhyO(ruLr|g<*+6hE<6K)Tr$+5LX*U-O7Nz_7Fx5xzU8otJ|4lz!%=!*4s$SCfTF%_T~VSCS0nDSVjel+-Miz!rWc1-bRxUH{|XH#{HbA} z!px1yWG}G7f36BAKt#d67pbXpg&bS}m`_eSyqmmj5aQp0^q!zJ*4Gz8I~WS}a{s=4 z7olpX>AVC-ny{MB(tpSe_E&|;F?rthDQaBOw{E@xUYh+U7n9(c`pDyvU|roPSV>%A z=0r8U0>N6U_kn&W;tFyG%F4zK$%qclV`5@@ot2e!LfRW6kr`IK2~|J>91`;&7nAP@ zfe-QZ9aBqm3R7OgO^_4%-ZfDkVU5FeAuC(Enj)b|LcTpn_;+RHeScpoft2t~?Jdxo zvGsC=SV<#pcmO_8%plX>pGT?w;oNQ#Ng&SysWn0jKwN?39{`^Jdu&u&u05yy+7N?U z^b&w^z{3SXt{KP*z6I7*y13bwl{VG}I#=EyG9@AsPZt?fY(`X_djqIjLYJW?HjD*EtG{%ow~m77;FKUabTyoLFbppUH#LxC+I&s z@V~u5X`X|b!*KnqjMj+8B&)2u=yvvhf8h!!0MHpg4TPq1(CtM2{{4CQ`!%XmWx5Cc zy#Hs5a>MB#7_GSWz&LC5^*9+dgrOZB6pHkgZX@MM*Vp0~3AQyf;M%&SUahssRJ@>H zZxiRA_2~TP78KRBTO?m~qP-~X7QW+u__I~(mX=EBm#2T>&wi-0?16oRg8#ejO!_66 z|KW17IF=IDSLl#*O0~DI?>|4m_UDQ7XJKCuL+nJ3k3U4Gotu8GMWVi@fKP$HrP&yG zSeDPNTh%nTBdP_m-E$KYZYiJm&2tOmC2oGI#Z5@i&gO&wYXI7R7 z{RW@&&ZY&&P1J-_3xF;BQ_GZc3{*ey%uYi`+h=!B?{_g6~kcCFHr-j8A zI+s#!)0)7`<2t&!E}NQ~{)UdpHFc8C%zASB($R8O1Iz|2~ZYwmZCjpTbY#Es3 zNGu;WJNx@}bBt>LL%Hvml`JKD`ZVH*TrY%2FvLK z{1y;T19l4Nj?7zY=-=hbpS|Q9hrLV(34osNht>$k=i1vCt=}~24_OQ+BACdw($%p@ao0v6i{4bY``}hCzeI&yFd~;*OGX@+m^gN|?Ls#lcc=~@_8z5m+`phMPDkf)N1nZGjAH+ov+45|YtdC#3Yhp;gLkI~Be@-=Be z!VLk(bu)xAr%hD+J_m#xxuvCEJX!!%);Qt!;fDGFp)Iw%@0XD#-<<}m#^lIzesu(M zHHMZAKTpAMmjCS1m8)0H#t^Dox)&qSc-eCWQta9E&5{An{Cl2)4%GCoIZ%Iy|0Rhh za^-gmA0L}9qXPu3ATBv61Z1!7oQAyux}WCGPM!U5{4CbDD%YRpt!EWsF$vn%;6i9T~-$3U&F@A+D!8(5ut#94jTV2f)Zd|_gZ}Ok)}3Ok%r{g zl{%sF+?fT0H%eC!yd8OI;-M+Tkw=ch8JK2%+tyYHj)&G785(Ulg0z}KQ}*=3LZM6Q zg0`*D4z<655!EmZr;hP4SS~&!e8}I&$$1r=Jz(!Rxt)ngiw1~Udmq8CjfgX3(F#>D zl@jRDSP2hK)H1`sq_tZUdmr@I!-%zpe>TTK%cBOuA4oe$eSLkgc`ssO^67Mv-Zn&q z_&z@`Hi5Qflkr-dxm3MtZ*$PSIVkeK1z$7?hRy*2!x274-^(zW>V=Y$5)uyWUsKw^ z%SNw|3e;&w<|Io;Xq>ZOK7rB=tUT$pKc`-lm6e^gw*RUG%wRcoZr|XP=KS z8g*aPMZcO%Db<)DyLlv`mfjGVVCl|KkHC%))q*{<)mH4nK)Sc&qO% z#JmYFz?Oo{8JoR=DSM#tq1%B@V+;Y199;2w#rYzY_f(KyIfh(-KSyoOmR1AQzUA-& zhYI5hApMYKtlcCZ4u=#8q^j}wmX#H6vsW zy3E?t3%o{CE3kvvmVG^O?5BJv*y__U&&# zscPi^o|w3X_^5DFAPlCLb152sXjAsxom3DR%~PQuM+9q723Ne!6Ui!(jHqZ+I30{( zpv7N<8%#TKV1Vv}fA#lj`t6+$4u^cI_X05@bRQl-7ct8*tD|l3PP1+8?JbadfE0{v z$1O+483}sr)}w&4TF0K+CM?XzVbE&AT-3w)Y$nO120&;7N+wjzmDfxBs)H;3%A<=FgwcLki>? zv?_*MZ`ryPF-Hi)H!Frt$kq}rxoJ1}!=VHf!(ImrHJ3kS zrFu%-P9qrn?5n`S51n6il>^__YbdCq7i+3e<()bg0muqvrVJRW5J0AXU81|2w%-@i zzK{dr-sm_W`jIL`$&4bN74(W3li_=vxr5Be5^&|R-U_y8y-5(I4?LCbT7Ivg86|t{ zJb0&)lo(pr>C8(tdhLQXW_PX<*GH#TysHDVc%N6c|LFE9>S+{u*tw8wQ{U z2VbuINSfc*FubOw2D-0aE#GN{?$ew`B?(U7-WyC|h_ghmV6E1x1*pJ0vf-kzON)KgP2G>NN7Zwo#1op5Q1e7_&?*-AGa@S%!+lU5-8c11tvxHQosZc_*B5=~+=>42*rF&m|~# z_3H<g-BORhI{mPO}$_vU%ci28S=5DqOZh3FgsrAAo zDhiU!xo5MA<^cWk6uTe`yq8&uPD9BZ(Luv4Ecx)P+F!%T*TI$cN+_35;z+e*!jk!0 z-F(!>in|TJ-QF;W4r9Y}O$RRQr3S4aOvWY#EVnZDn=(Yz9io!iky_=pVK-_@-pCpI z?Ry$8E^v^hPsW6$%%&FIG8r?i-=A*C0r1qg8$cX$^OxO!#Ev=su0#@=%(|(8B||Xa z-Z`$Pp|OQ2Mz#$3LD<*4qnuvA7)Ci?ETJ?Lv9->W!|8q{)cWKYx~Er64DAiD*i6%m zstUK@Oibp^Wn~|tY-+XEj?0=MQ^S7!ElRln2^m<7Y) zt}Jq;?EU+L^k2dnxHd@YI}F$!lwhF+iELgMKZ3?;ZvO7Tq9B`Io?^dS zf^ra16vghNbV@jfg+IW7|Ka;{IhMaz7$7{U&4(7d8**I&?>PfoOJ4ccUSm8! zQemu8jw@srl{?AQV-ZZ;HdH0=*drP7X`(0Xho@-_aoeDxy=)-1cO)vThy*Eo2p%BM zYD@;Tk8ppVVG4sz>}~7V0aS$~%%+x9{P}_1F7#421U~ceJT9D7@116}nM`Aymy{08 zCfxcpU{b79yJ1p_kZP%!maiY>5S*#~hN3ap{M#hMsd6eQ@3`S>}HXarjaW~{?1y=bLNh;m{_=f4fMys4n$SkrsRp9S(TbbIrwsHm?S2i2;8XZaZ7p}QI~ zcz_=CS}M}&DPfnN*i$uC)zQTQ%sj)o{{(*U@ap8eUM^5IYh`v7`YZ>yRT>WSUmYJC z(}ui`3XGY?aI65u;Ehd02-a@{-81!yUn6}I;Aj6oAZQ3N6{OJ3y1=1rnS*ou8)CU| zYT$&je1VFEbSDvC4*J%=A&;G(+37)z+8Y^e(>qmeidag&-Y`QVFRFK3)$PN>v^r*< zWQY3CdRTrE#-_LAxZV!b+@=C^_PvrHMoPX% zUrstM7k6;uQhF4#1=i1}5^S7*-3DK)la&Kg<<%d>6p;Y!=kROl{+sTP9{;KNc3bPTW zCPZ+zHV~5s45H3WO)o?SS?!#bJju>U9q~&D`Z$|h>!o9Xsb+6&ELM{o>KlFeIB%pa zWz_K@dWYh%V|=hddg5?C{8BT+-~)`73B|77#?~OgC>TgM6S_LOx=2<^kk)auw!8ub z1)`k_%SNGxg}`W_x^Fb3eQE`iacEzVu#?~YAcT>*By^62A=JoGaAVWAcEoIk5)v>V zPv_AXZe_`2jzi;GK_-#F1&THGq>T4GZvSQ|8O-GnN-?Qx9~UJ$g*1kL8e%aJ3e8g6 zyrA--puly>LyvDk?8Y7vUz=D1Ta+fu^Se+G1)P3v;8Xmr4mrTLVlbCIU(D(ddUECY zw_*|nPBbfn)MuydVfa%0?$xSK{zx_`mwy5Ba0pdXzS08e?}oz(PvwKtyYuX%$wA3V zYnIXaPx4vV&0clJ!#jUXnp}`Lzf&{;TqyW__(QTkD~e(`~4 zr_o^%By5y}J?yG0PtRKz(6gl4fn#AP{IC1ctWO1OxH)eAKz zD)8>&x^fa%3w7N7wUdlE$tCr4_3G&0#9fqByAx9w9y2}MZ*TkI{rjd|ez$J!mANik zglxJP8Rz)-l7g|?;3cHhogHZz_&AEDXgn5n?0MoklT})(Pwg0cY0HsgV>W{p#(TcX zdv}_YEZ>`!sprQy5-idgzGs0+l%OW_7?>EU&z+39Y|(nVwKmAFuJ8h|C^hCUN$+%5 z?3RYil$q|5^;W@lC&n<+S%~QGAr0B1D`TQ+;SfuZV9^k?5|Ck4f3N5<@WIEz13HJd zyt}sh?8Bjnw6lddp82i(Z7dq0>H5ZHMGiJ*KvkEyEj&Vu(YjUgRurYB!7FE(B*Vv2 zoq4(;d01D^K_VzwqgTN3S&(y<;!YV^ws=Pg+&othKXJh&mY;}<()2^pJsFVEtNf{^ zjoF9*kMd-vp_~tOqksLs(DJafHPOlv6=J*3euZ=$cX?UhCCbdhB6wSM!6bcT-c*_Q z^2=qw(p9+WCDjhNVW*%^A1P6bZGQ$uza%1&h=eSJKw6LT+H1NHLlGBgY({ ziF}Y;@;n6iI3FA`6)f*bl=cbQBS@J3U+fSy;`>Y?Ac#`T)I7RcXSj0Rjk)dX&!0c- z70Lhp%fg1BHRS`eKs_KS`Hj9AuP2dAJtX?aKSH8k$sB4}LncIdS3d#75a#2yA(I*K znNUf&%_135qO+iVpLn()D(BHw%k%FsS5#Eact%#ks&T0=fPsT6pph^=63h1To+F(c7CL);7O{s4YX~)rErodm;-upZCN3 z)iYy4v9>D}{(3X}bbG9l^hesSwsW^%6AGw--iGYeiappWpfk7h$tW*hmAD{#=FA`u z^5ur)&6g+aVZ0%i$nlEr#yEdzomgl0+K2yLwNAv!qoX zndjGC9W|!<{9QI76P2*OSaj`Re<|h(70ln;WhFzFrITA)>ZsEb-SaA;sve1x9)e{_ ziH#UxL$NY6aq!omRR8I3=B-h6gy4$F+ssD`(PLbOB4`8F5gn$-c*)1A4k!8-k8k-h zU0zj1>8D6-_}!nkn_wZ9tWPRx!0p!kDw8o*z$Ik0EVaBySo{r!0MjF)FyQtCsaMRI zPakwETNg@H=@?WPn|gSBu}u6*KPMsTewUd!;TmLF3XLKRbuTw_#D|vXxJjRXzXUW0 z+TmZ(7td<@nNBx3c?LwYJ~LqPqsxXCravlUUXWV#n0|CCeM>*U`DV$H_W|E1kY#G;Q08*{<7boyMD;1N6Rk& zuE8A{k^_BWIeCxD=+lZn-Jxn1SEnfUJz2*?=SWjRGXMTo#YP>Ly(zhgprvbxqSu-3 zw!hmFed3`R!I(pBuVjSgF`RE6tbS+C22ex>4U5F z=ar?BJ(Njql4_ckf$Ftt(az*Way*ET&ns4!~bMrbd+PYyRT19(}$}Q@iLoal$4cEZbZq{ ztulWG^g;m%%K1=dBp`EAW_-~&MOBeXZIDAx#dHCq}BluPHSR znsi+XMlFE*-0)o!oZtNi4qRTHWL~xFkF`ZKW6|ZMVjd_kLUIWd7pfB}qc=&Dx4nT> zjNBcTUAvEwcoc`I32Rb)8)m!v*INnlV@NvN`=6hX&>RzbsLeZ|!{kBQ(An=|lLH_9 z5gT562ZeZcT8~S~_HZ>@A1OWUMsyy(rcL?RY1iJVz3rl_(ylMb``fqcDV2xt2jZQu zCHaBzQ~XuS=IPfBN^JUzB&>Ty@|CPySw`A_w{w@C05=l#FMvlJZ^mJmLx7abjB?f9 zaQCkX2$Du+%{@IajGypc*HZ71UEQaU%=w#m9ZQj1?t#3{2& zDCD@I3OQsmTFhrOGi(gR`V!cww~c4muVH)#vU9CG?XT`>)a(gJI**o?izPbT?JSBt znh}QC8I4O#>37bp$s}q8ghhvMQBu>!r0=3RX&V|{OtE+?o|J<{Pv3 zm#I6YoAnb>j~V*QBn#YMqCd9XHr%m+4X2&)v{%5dJGl`(H5hwxZr?=fKec#Fg0%>f z9xF9bp9_QA>CTa=tvFKGoG}%CZUK8}yoj`rJH3ze=11XiSe{XkL^6bdW2(EV;rqWJm%07hn{7x|%DNed#n4jR+%L%Ba6r?=al+L5&Jv~^T zrf|G;0uxUz+Aukk!_Fnhl{4?rv+^?UYuo;iSVMW&f``sL@Zt@-5WER&kIMnYK!dD8_fxS z;u%d)Hd+8@e)~B*&~={NSP8jFV~|_XbQZV5&7TU@RERmqwqcPetJ$g@$!X zzR)&je6HPRxm`y31Gr-ln>*@-V+_`#TvYBSC^7jOh+!}Sj~r@{kDdgxI#!D&3Fjj* zDNcZiHqRuuNL)Q}Z%pcAo5rH_SPmO!LP!%C8BJspD(|4)D5&Yl44Gw5-VVfgo(_oi zu=Y$3Jm?hFw^UMH5@>o-J>|0hiACRq=9g@|-V)K&K=#>>QD;&^y|D`P=de(QxHRadrR7!Hn3{No0Zv5WNn5 z_5h#jMI>2Fs zz{1Z8+#`>i*w~?HzCBRfN|WhM#HOExCOh+ABsX_ka8<1!A^zPZel<1ejb&=UVmCB& zzCyC?U}cl$yYcxzt9=uOjzmh4sZi)~xmEiHvO|=ns4ZTOkyOZ03~e zuHlN?vrOlKd`BoYa~1vGbY6{&O1PU`628+}vZLoh)>FqvwI2$hFv_*cb+)%?LpM1q z$cxnnCp*I6XWCoe`8UC!Yam7yh5Q2Fpv$*Tu`;sQw_3Lb9Jj9Yr|%*S{aVu^do$Bb zCYRFi7PC6R&I_JUr*Mg1)4=JwKM}Fy_imVHeB%!Nv5AI0%VIJ)h9VPU^`f#;YT9ICcs{VM6ivOUL zb;I?VMND{3<6XfnkutJ-Te_V-#>IX|rwql!0>gcSiyvniEw1j}J92b&NiluRsQ2s= zY=mO%Yd`@Ih6z9pRmcAVkfZN^n}dVe4AffLvi)TjXX%ppalpofva=aWxh{A`<#d&> zb!zLIM0fJ-voqusu#hWuqb6Es?&sA5L8&+So8%Yn=oVCI$)E8(=# z+sj|RrYA?(1AA8t6N+JTjzw);+jSj?HiZ-}%PT;kI9OP_|j7gEQ^a(*uCo`0Dabg07 z-1aK9B*~56urQLPw)KnYl|twAF#t0>ZU?W*vqM2oe8F8*hZ>|+u2Q~I5K|3IT$Tia z-rte@dLX_OUByZj2&g1DKpRuIY3lH4<~O8eMbs(g>FWL8-#K%7v65898d9EkNe*!J z&sQ}@YfP19IEM%=&I2#!VC1Mb6vc5cVEe1&GH=YTWKp}s5XkD)756~sU|<9k}#D*UeT z-G&s7+H~D?jO^}@KT_gcvBfR-%UOnO_DI=&_lB9o-{;(7>(8r7R%xJ$(4E z8H%OOa(Td4`S$JGm)?UARQxE7u%jzr=*cM%EBudXgnd1c`jUAjMkDnZV_3_MDkB?p z^^6mhDF|DZ6EWqzt-402k#)4HRW2lFJ=!!A1HWepg=%If7$h~`-6_r--M)RNW__WW z)3mGH96oF0VPMyrXhPk&nk+1~DOAjQHY!TfO~r}-Yb-G~V5#U`kuzbrz-IsETA{m$ zntRa1_=_wIWpJ5MzLW?6(7pk%=tFBbkS8F)_P?uLwQtp0xk@~t2)h*f??r9b@11%f zkdg!hk9U7*Vj?eNiz3gHDWH2ErJ%X=&p)d5oGkUq<0+Vd6snFj?-i~MGeO&)D)+%i zO?)P}r#aV%Gf!@P{awPfd z&3R~8gWIv?3z7~U^*+M&s3{Oq1!uqeH_h2T);GG^9;)Q;?#J~EW*}Gckm^^rZW7`?Ag;?vEA=;ekx_NKuz`?k$mvVGn`KF4 z8-arFZ%B6hn1FUMR)+S2?Mj*cbwCr>0)9*L_wVYT&aen_gOwSl0Ng;2E~VDQ>sK4U zwFE#82=_90(Yw2#Mx8yJo>i{zh0sYFD|Vn42gZ2jZ_IjgZQ(EHUT#z4xEzi8<<|DL zbwPb$=JyTfDDo8VlU)jPmq>e=vo4WI3Ge&QJUpR{($>eii zY>9%S`s1yz$g4vBbpa0_W>X8%5#lL&fWnLfoO);%UBapds^3Lg49|Jhkx@>yaV~x% zJgS`F!A7GT7{acNoDO{vklVORV`4Dxwqly8U#v+GL46EInHI_4?-$&7KCZNf@K7oc zTkBs_XbI*}yOlg|fK6XA0SZ5)Dk7q5Yq$Nb{;W;`hCc!(*}R5gM=fj?0_SUUc5rCf z{6C>aq4c3ZT%_*zcsej7Jy$OMrBm+hBSxGb2UVD!8-DK0bzjoLqx0KYtk}m!xXN#| zM~@uJM08=&BfHxSbr0Y>nFF8?%(gXs<|Tq8EWO#-e7j;jsRnDEUO@nS`OKA zBuCb>y8h)+Jy6CeQZHPb9T>RT+1slE2Lj&(EeF zKRX07DT-9pD+M(^hT7Tty@qN14*)%<3y+G_i`Zxbr6u%JC? zD;ksuqIzo2fQCRCL!cW*mktXyv`c~5eBcUVtagXffxUbi0JRF6(adto8|c+uQ0D=Oh4Yzs!{0Hc^(s{h zZz2J6$l}5P>4l7#iNv#>C1<0ffK(kBjSQ%&TXg8DxJ^qp|A~`UR4syNFg3SFKy(>& zjFm%;)ii(t^=i!FUv7om--pbkn0D|K_(8@U|H!f$l51wk90d>Ip?0{$Q090^+ou$&kKky}yWONa9Ez5MpNq~i+&5aqfIb(a|cf!;XR zQqS+nCU?MiNNVrLMBvym%m;UU;`*S$4nxCg_-FznT4I^#kMJ1ln}L zm6-B7q*{;T6KvWdF~U#}1XW%$kbgieYYEtst^yWQZWNb7bQ$li;eSpSWYXR z2ZYK`ifSPWe5ElTD(sk5I|p4)?+#5QqkBVD-RuR`TB*6d6hINbY?$R~d%HJlM^&7s zU+t?|?rDB^m}4G<$f0|E%5wmsCF{^R7!encCrDN-gGbEGZ=!q<(_3s$P+~<11)*Gi z(A-z3wbd;i%MW?t%+SCa933R=o}=p4%C4YJ6b$rraub~T5oyXLA(tLVQB1$uv)~6Q zy=CEtDNnq=^0gJPOX1`fv^Oon$&7vrHUk<_kuDxUMww)-pVpuE{|P@A@wmxeBsh9& zDRpr%^aJ_?-h<^y=uXIj&OH`(9>qCVUFv1oVW_8vu}>S~t!#HI2a_zz(i|#VcWBte zrx2||^4fF40Z)Qz!NMnzAcx}`yKz%ujNxEWzDHl{&EROliBS#b#z}lntxCD=@|?ug zG8hOxsL>i8Y4)n?&wX!RRy*U%F&BDk_m2}sF4o64KA+NO8s(AP_Wpy| z`^&F`w+G#sXu6(o6YtVn`(co^wbk+5YFsMS?RDGN@3&KmnUhjge#}bR=Jzc%5+4kj zEiU?iSGwy8OV2qXS(Y#&2k^B~MYb5|h)6~X_t<%)dczP@6UE=zd7*%*DGR74pn3!hn&EB(?eFXj<8DQbcBpqjTg_c} z_m^M4e$CB`j*U(FHBBIx(ve)CHqlxR!=7phq3) zkdm0E2vRbfwKdQxPiJv{G^erG7We))U#us&Y%Idi`*#5jomA~jZp7gOxVQQ0|1@vf{w`km12}5sXT_;*bZ0g7*cNAklS%nhQK_F>z#$KxZ<=Pmrd$oRJ4$X? zNS9}(;rh*MJ54?2+?ls;Fh>@O=Euttrkfkkgs>XVK&RE0+#4|B z%`c62rt`9@%>9h437f|H7){n(&bI;sT~=m8)J4%Q&CFl(9oI1B?UQ$tnmm4ZZ`EHe zZO;-Nl^w#ruXfE`4)Y)L=rLc~G2Kd#UYKdQHc?`0lnq$CP_ z&y_MDV5BtGDE#b6xq>gtshAY+^K>wem0O;n{uGbdI9`|{Ch;!9=hxtrpHzT?jIReTn4EkaC z0Ap=!4Qgp3^(CDR?4fP8J;xAL9H9fd+AtCzDF6&!BcAj9M6?Z422138O#+1QEM0Zxp(f+{vyQK7r*pR~uM(zs%k~-4E?TbD5Sz;lk{n z^ME?i?Sj6}Y-qUR;NqfjcmL5ILkh?okjJ~?TTSfpk8$URke+YWpXNbFF>fOItdvpI zn9j0wO@HiAQ`Z%I=ueoPppH(hOpgI$p99`YQErf$e1#!m`WL}~I#ssJ+OV$I50XY099%mD^La(fhX!e z`xw0@v_<~zyq+&JExX4SUU;G~m7gj82E3!4b>2aZ`<(NLCbJ})vxI(9gU=v-GC9X0M1@O|>O1TU*-}JYWKg%KDZjyqdhw!AS^p zVoc0Y0QOp2Bi>{y`PHif^m-EJE^I(Wva9`5s4F&*jE;$5ZthK*FQM}D;vItSb$U}I z(F;GVOUeyoJ(A*Vy$!#SO1BgTWx5$Yk)7+hEH_7vG7f&DHuKRm*d&BAu2J+GJtcSx(p^!b#xmU0(o24FtuS}eQ^Nnoya3Z@JfPm~o;PoSGXO}0-Mp58b( z<@(i%c#imKWgJB?gRTKdVDy1;CN$yLkAc>x?`nUo3JUdvHpokT--p2JL?#uIoJV=4 zbg~y#k_nUHC9Gn)1mhpCc>@DW=-EYdB%XKU7+^Vk94j~?WdR3q+s+ekd+F&wI00lq zfbFNh^W-Y>Misuq6USUm|FfYpz_a)4N}6o)!)tQOq6@$g+HAJ~hrLC_m-`poTN$GC zmz!pI?h_CW5=ffqc0oqvuZp27{k@GrRLqSNl_eiOe89PTLXQF`h597Ub)^uyolWj_ zvvZd1(Icudu>LfW6?PWE)#234rx4V>rmg}xYV#8}K*7y4vKe~Dn@Be0KDQ zvaphtl)TslunoF_N~jwM?}zWZreSNRhOSUea zmX>}6`r#;~6=CFu#tFBne#K5Y|GNeJZ+PKdt^ZDM_-@ns!NfpzfM719Lth38P7 zu7?nHRFlDf`d3#b45I6WRA@$-ka`UBc4cm7#%8>E1C?ASbV4Syx{z5(q}t(W0L3QYJxc5633>LEcG_{T>0&0DI2%Xh8LI49OVJDt1ubAVN3KoNe z$}AX5mEsn28fA-jr-i<^&QfrCfiCeT*YH^z_oCZb!5EpTZx}($PeXYQh5b;^l1Jm> z;oZhF{iGF;w(%utSxs$K8Ck0ml``r}-zt7{Ht^06)@%pH0qtmvjw})knki z3oyi2vwUIjRR$F&e5XW-A&*z!RiC*?$AQKmqq|GmZ|7siQ@wkG(2J~c=SuL*V2_ur zpz(4^gwm%0Zy!?C!-EV^8v0nEkeJ=to5mlic_3j2ywe|`6r+6Ihp&)2lwsTg5BLL!*Rx{2pPFK@!_45!Y4lBthkvR zg5?He_Iw(n)KpIPlcm(y5=Bo(GZZ6m2JDYuHLSQ(nL#x)hI+++i4J8 zSv?1uAQziBepDfA%3*4{YSK>q6mD7Zr_1+yN*V01S{&cI)QYW=xt0y22l)v7kzP+>sLqemK{vJaL8XF0ZWJ2439mIWfpC_1a@-}!NiDd??e|D4V7fJ=%iI>oZ&cQkxJLc7#x>P{Ac5~ihAo(x zP>aXhC!%nOrqj^X)zPuEl9rOX^ne7o@byuQ;Em7*4ay(6iLFHT-z~U^i zJ$w_>C#a~0LE7vlRIVH5(9biW*LyEr`Xw%9ZEaR8hs#TW0TujSIGk4kQ0Kz1M})T2 zor7t=0_z7NE*trABNWf*{`hv+2E?r%axwf{a|Mhd^kI=prO8znWIka;<-%-0FwM>1_sfwC7q=>IPDKisj7-|n0V1Aqv!>5v1tA}A>6xa)sEg);p^ zrtCfmS*~WI1@KIDvh?1s$M(MVv{q;oN+!@~0g4=9U>c;mbkm<3(VdgOci}REu~y*7 zjIjUzCp?%oF%gAwjicTt0=~EA*RObb0ll-N#HP9z!X-XrZKk~UiNL&g+ldT1O4=H{ zmgQ+^jiMJ!K0b97GstBPA*B?fGzfa$?ycKQSFK?;=SD{J!XrT?uVn{5k|8q?hWx*^ z%k}!&*Jw(DpMdOhTYgSXq7L1AT^klJ^0nV1ZW7Vsw_OpAMh$!gDd_0F)htKY@FNSJ zZS<`DAV>jf0m>H9`J;WH=jfOD?{0o`0c6;_xbeA6!jbz#7UA-;GL;Wi2@LRR6G$On zm|xrOzdJs4PY{)2;pZ(}2X1FoSe^41O9Y`dTKDH8R~`z=I5Rfs`vBp`%$~ zKN5d8j@*B13BHs^?C$WdK(&Ja?gtFI$9UhY#kileLRPz0>B!s9BCXwFCv%?nt>Ekeoqu4yZxPJH5N%;e>Pa>s5p9&7%!4E-0+jS^Z)kFh?QX#RzBY zb|g0-&&MKw@D{ntyx^nv9S(wHzS|rObowsYOGq2BQ(^L@GRP~JA^K^k3YY+38o*Kd zUui;K^R{|xEpLf8WSkz>Bo=j#j;1vr@A(n(SN}O5`{VB#@lM`{D4vi(vDFeWx3yHuI6-f0P#WBzyy)AHS6BzE2 z*W`<_Hsr3Ikk~Jb&D#PrLitr>7k_H=u6(guJ)cPu8R1^vhXZlxIVQ z3EI2|MmLY9M$hSb@!wY$Xi+ZoMAv}9a)Q)M@I5Gq+=SxHyH?BJyo0M#7H3|;KWC?W zQ{X^VjeHl-@^)}Yq|;tQz#3%4e?Ic{H;b8>Zp8CwEHIW!;i|4*un+S#V9-n$o1fPb zgSIPnUT`>ER=R)uI37J=9$ud#XS!l*(^vpEh9O)9Ir>#}hNTFk^=%~x7ZM8qC1yrr zy~2@0Hr2RSNCxqDp&LxVgZyNWVvI>vQot~)l%bZ^h0IOaPu!-ixmt>_ zf@pQJs_dqdji0h0dg_l34D+%hnb+CEDm%-iJL-pVs_s*yY4I_}=bu_0PsAH7+zg7d z;|Lx$q>K z&OSG#{&o1?scN)I=IJEZ8r?mAiRTP^bnwB(%9yD3o$co1f|gf(v7^O$(W?D&uHNu)q^U}PdEH`meDgW+5M zYj9Ru+E~TO;;*i9Zf^=eZ&lhUR9TKRJmb=%HxduUY+Z2h@{_F7Gc@Fb=&1&wU?9P% zK>`)2?MHulaQBhyceTbZD<4xjlA&gLFDD^VPJ0Hl_@B!c15%&j$QU)VYvmE?bIOw1 zRIY`&IbW&0T*}DCrdI+NxWaEG*3N*sEj>%d7$4_4eU#y=F?n#_%waldXV5i8q6PbG zVJ1kdqvOqtb*w{$2l6E!%g=k=3o|&eO=(i3(%h_7l~BFhfisenH#a+r*!!(xyrHD2 z=_iz?;n|IYs$OdQFb&5E$kcHBE_N|`ABZNZ4PLFa9^1nM(3$6l(hM>`9d99aHEHXYvk{p#tqquhVF-qcC_v#`N2Wq^J1P_r082!yr)-jb})3sX!vve401HP zxDO~u!enx2r0dF87Cxyk3@KG9&PW}WFCi)E54JsJ!;ys3vXFaDKWnWeEb?S98gVq- zqqh;ykdvgM&MuT{bKo8xA6Rj-yTFhs^@C3OO)oEf$kFq&l!Tyc80>kU6zAleet*#I zmW@qDCgDt&brW`U^Vj(O{UxfI?Xd%S1owlX%)&dy8K2`N>Aur%pys&p2JN*+5j*Am zIfM$e?+Qm*iysmd*E!h@jge3$eLXQJ7Z(xV^mh*fGO72+PXo)r`+7! z!^w3Wk4GA_6Ou@(iL!X2)>p*}j_OA6#V$0muo$s5ndwz^2*6Sk%&SlS@0Jxa$ZlxJ-r03%5*^2+ z;8&Yq;wF;I)zH}3VzkiO8g7VEy$E}JjrDLNcMf6pmuzCjEg_>FghUvU1lEt&<0R>D z^$U8%x(~jWr6N4)6%!;63>d!iY8g0BuRuUT1*aUl^DH@ekprI(t`FZoPe~yO8^v1L z4mE1|{ydJ3{M6Fb)pcOe>NC&v#I(R2xFd9CR33u%w>qpF_cjb8zHZ+ve%~ zwko>E&F;eD7ozHh>F*HRp`?HB3 zU-wVlc?L6k)x94Y1b^DdAaV=3+`^J$SQ+hf&EUb#b`L^xH9a!3s;_4Zc z()4LtBrc_2H0+2%Z&j0?979dKI}F)81s`*ASqbH0Wp%mrF2A(x$Q}WlWILpx=wg;g zVFe=U+ToP_N=kk^JY6d9}5utf!LMbvCWg5sy&2?=H})^AK8>>Wed#UcvWq~ z+19%${H*661rq7?Qy3t-em*u6pNjCm0nDi_sNe$&_fi6fBeE_il`p1?);k7m{-?Gf zhxw4+)>cZ#rG6HrMplo&LMn_|$cBE;MLlfYJF?hq?e`^p{@Uwe&dv=hH$7PVxIE3h zzozE#&I76!!7xF}gt<3DRdU&Vh<$O))+hD<(RI~fQFcv#B?JsWPy|K50z^_pQc}gB zq&q}JQM#m4F%a~jr9}{yRJvDCP?i#;Q`X%jBv(LK;+q>4y}s-F?mxWreV@J0xzCw1 zXXZCEzp*~4JQD9|VS$sEWp3~nPuh0@@2HK9eSfF@r5^7)>A#B3>=f9wA&&re_`$vI zQ8m=Xa=19-?E&pQAY+=z(xDDW0)HP%S5+%m;2t4CKGKEl6T@qR!!FrD^6 zoV(7HC`I)i^@$IPbr^MSg_LX8#1+0)g;r!+---9dNymQ*z<<8^jxrfYn`htB3!zb_N84tU>bIeGmb%UIhVNdplGwX_qBYT90dwa)A zTW@i8O3Q?*{Xw%<@EzUpf_$-t-*zP*kZhv1_So)sTPLeCYIx0I!l0~1g8J9=LZtLZ zWKR%Y$+jIw;ZC3r)jvJ3N9M$1xp)vD2j;_NCKULT?oZ1T6KISe<+&0Wg1i2Q`B4dp zEWJdAWXjIAoIb~(8ct1ZX`gAxd>Vhrd;!uL#BBjqSw1e@HR|DHVUcR%*|eZ_5^;5Y zJsHp?!%qZuo;E(>z6Nwyr0Vs1v*%qZ{2XnFTgM$*R*yZ~KEHLc7Q(6K zvvXhdvWt$2y3&8$Q?~Ox?%p2l7Kle&?S~HW9Ym;5S-v3Lbv>lsDEHDo9$WH@m$u6` zK7nti%UVuExO9tQG#^1ri?aa3^z|KK-!Jws}4A=IytWh?`JK3r z?)B9uYAmjDqVliE{ThO|*4k3+M=-R~5L=*B6wQ!xAKN?f6e>qd0?fzGOmmb!^EZ=F zexMgI4oyJD-8{7Npdqk!1T{8c30b6H4?1&k+97V3vC|HBQGLioH79E9pjrF}6|#fT z2t4yq&Ye4;61-NoVj!w<&gR}7$oTd1=<;cWG=|+#!L-5k%i^`k zEgvw7=e6fEB21)xZh(zCtgGRhA-)bU(Lk@Or)O5jc)vHX>XyZinlQa=ie%pP3iD6C zr=`133lC}ryLD4>(<>JlpY%-2{ciYx07%$5PSd zw93Rc>9D2`lWfi$a0@lQmY~fTZT^_cN{g~3tip#cdq)&y*gj&Vctc`Rv{mJ(I1{lk zxMlo)BU`#EvC4;dU)reG?GP$CkOTu`%l&U}G9V&@D#u+{U7<9lQ1^D|@X-?Ce|&Hi zcX0!fV-l!-SnB!Dt7q>zw84V0>}jkwmOb*FEhU%sHSvNaMtuJgvmOn1KV%_!toA^T zrqqKQ4M@SFboq6OU5fEbjRZdt(-8NgzrGCl69)-#W(wy&egiQTc*yi_9)QlyQ9q@F zH$mw9yr2MXt%kgNNkQnyd$vwr8i{EttiKQF?)1*2P4xlg*zGuFX_|WZcq!ZgSgNNi z@_*mXDtoPDbyHoR*)82>(q%jh=I7yXaUBHISKp>?=CKP12p)Nh!W|xR@*Xw=G|zEx z{wX=#5?Vg&xgOT$&JXm{Q$P2n47`=_?im`IKG63R*WB3Hm|z3?N;29XOK`ZbM_jka z>t|#2q(cY__0YW*;?q7I%N2J5EYH=Q$?CM8J0$Ls^ZVLVe)3llpi3cxD69U0<(HQk zUiZAb_}jKSi$Xg(*8$K)Vf;StKDI{J9dHZ4W4J=EIS2{{$xXAXjrQ#8#A0b9Pt%hw zzMKC_GNwUEKDwU)mg9U}P-CnI-0_m@!`oAm!o5x_aHADlTy~X4!kpcY@xnVq zWJBDqe+CNj^0wc1A~Kp9m@H-r7pT8vTrzRB@TF2e@|{5NNp8xZ#K+PeqKiCjUB`}m zM{=m9h@Gi{0iR7+V<2HMBrt}DrQvo~=ap9XdY)hNhCeYKV7tcHJ6LRN+5@F!vU~^W zPjl_iQhO~2ebMXN!uHSg&F;1Ei2-SlS1*c3KfK=z`SE?Z=MqR;Z$TwOs2j8QA!Y!& z&0V47eR@&xC)GXQY~Gy_4Yhj#B$K4&xSY?p;^<_753xP;n2ca7O9*fz?KAPe^g zVI6>q;$qsQ48~m@Q`K^1ILaUJpRz`nWFc{Y3I4?MR9K5u7fIqTosZ05_6%sj^h-KL z`Ff&)=VQ+F-S0D7p^c~;YpFw)!8yyo#ML&~L7W(C`ZpXT4Q%*+Cz!Qyql91Pl-N(J zcTQ%K@Vi^!5eI(Bv6hftkeK=TvlMRObIqs!j&~8+fE^d|p=e)tGh+lXs1!Tl@{5XKRc!CfmBKYLM(+77{w-(-S53rTS zI64F(EhDc6@;HRo*q=~lfnRgNw+r9U#sUS#mHy463rVse9!6c03+;DQE%t1^!VFoy zdz{uMcP6qQI&>V+!2lcKZB&isUajwt<8YyK9>R2?Qw|~5isG+5L4UJ+H!nW?FKVz0 zd^%Jn|CeGUe&Fipc%*0hJ|1;?oG(2KKg~szPREM^EK+qd~ofk z9@1w9K=TAD3)N(Hv=Yc$I?!YPVAVX^+8QbfuWEdw#~uv+6(M8mH7G@JtK^if9nbxK zaU;K|2!GR;73>RjV`S=tWeDAT0!#dM1uXi6m)pI2J;iIl@nrn%uSxIs4)$)u#39v} zN)X9BDBpUhFK928!FbC|OBVc-|ZFj(?yQCw5Ae!7YY9c>?*Cw4Y`SBiG|u5~$WzW25x#ud z*NKUVQ92@bA>D#n(aag7fEYd?bV3KW+EXLa-|HLH8u<^ped$=COtv@*& z4pH8`JRU^R(ybg*r@sMT{u-vAiX`se_`UVQ^;@H(I3RV#&;N1UI+nuL{LY<|HZ&YO z6h;(yITNp$R7d;gW)i~6Aoo|^i0fCG*!6SlWH&N08spk}fgcAly!{^gCvjxZFnxXC zj06pg>=~8XH!R@qn9SRf1+g%jerl}0xhAL$IIedqs_z1V#Oj>**MJ>+3YtR^3BW&4 zYNX(Xb-w*kfPz=fZ4YnQj53wgJXNEA6GR8#H9RTsIZULX>-p04(WJi%A!lbj!%?!l z8%*Hw=9tRKcmtKq+l~1v6su>D!_4gX9UUAUHTn>eb)ERd;e>nHs!s$uCl{RWs-)8P zH`MM^-`k;WlYbS3qAY+E9wbN(^0BMSNckhd~ASMs>j&QZ>~vQ*XNZ!F23cvK9PmBi@TVRnk&|3IBwSQlkC&?c1xI zbLgu|Kc)GUg@lAAg*{lD2#`tfZEP&Vrs+aHlIym$?Xx^ZZejha4`?+i9_{xte_|c9 zhk|!Isul<^4)E`xFzY+d%S|xP(V1*n%$PpGN-3>FC7SAZ=QE@ddfa_vU5iR(bXuj2 z-cOW_g;*Q(ewP%S;}Y>jIFT#TL&_G;grtc_L!e;Og1=*iLX8i20P0>dzB(vvuHP!$ zY+YpFMWfoB^lM%GZePploL(h^{fyCk7)L((t+=Xcu*=okJ7GKJC;7^ zK@hk07(l7YohaJ~bBHrG)Lj23n=O>G3mdh84BHkt& zQr$`IGoWfUZ>Ni(tOKkr@9R@lRc+5V)H)q>8QK?0?*p|z@cs=C;UZ9zr%j=w zNY9)GHY4HCa&C3&9Vkt(fc)Mtb?(63+}OmT%uBLgN@&H(Nz8r$&Err>|B$Z(9o3P? zdepKz94w05<6DC4mkGWPMh{ra`FB@bpcSjN{Yn_P_zmWJ1d8og>R51 z++PHmEMa(SWWU>xiGk^PoZk<2W_!MkNzgWkq(ggZ7pBPe6Y7xS@T?eiNX;P^ZqIrZ zA#Eg`i8`oEmtUHZ^nJAF5eeu|e?OQraQ&KPUr;}W7TX_)HwQV}T_?Y9U_Wn|2nb|e zxF649*yt>{1OfDDmxw^)BOZOA1IT{P;8crU?$N)WbQ?kin4TvS&2a16XcKCoC3~OX zY`yp-3vU=^Cq@%4gL-YS21RP%HX`R9x2QIDJ=6=c{)z9N93Nb{iWkI{FnZt9%@9lz0-W8 z9xf-L4!IVXQd5QugBFWcJIn6p2y+7&qZZJ^-ld<^DCF0pXD~B>O0E1oq@}7I1Yb!3BvA8Y}>c>t1PZ@}b9WM!UPt z?`gA&+`O)8!hW*FX6yHuGsq4476JPGY(@4m0`f|I=^hgtiB|ysqUAarIgSuUMRK|`#^{Tv$YY3Ly+l0cl#w_3Nxxa2MA*4Be^$ld;Ko6yn9Yd1(D;DA}|sP zty5+Xx>Mj$p^=yyP}Lpu2%Ed77Qxu#o%rK8=7yC3Mr~M+XPL3Gw8Xa*_xBst$f3B5 zrEmWq_twI115`Liri~h)pA7!}@8)T#_FfPzr)5CuQ+PEL{zFwg5+-aq2Q-4e1*Wu=Q~@uIaMxSv^dn{_ zm8!J*osQi*Iz(7rUSCFl9K;T~4b~HYwGz5B98%?QvPU-FxNTHld*#mI*Z+F=*+2)! zulcxdr*0N~^E-2C|DkMWMSHrd0fAC<+_h}abmLn4^FMmNo(vJ&|d2zSL3JA#S@yQu-RtXIcqCDLP__?i#8hy zz9_xpbV0BBjL-~S8V=feW(z)?RDdLq^j}QWfcATNsZ@HH+R-B9EadD=`wlHD8`?5( z%6#`;8gvUzRMQ4x1T~G&OqVflU*BO>N>rcie}&{p_gd=He^hMN7gQ*F#~tdQAk@W7kAAf=@g47U0b=R8OkE| zRvE9KW&z280FJ!jgj=}^SlfR<%4UbV6lilAlbVkgpQgoU@u(&KJRa9RU|R0{Dd^9+ z$wxfX#zlY4OWKLUxK}rUEbT z+e#)cFW~=7Ap+@e=*BWcp7;Z=X=5R1OPnX=iEd8~T`Bszzr1q=v@> znMZQ3mrDG3wciD#7BCVDmzU}&=$N~iSZ~!H;|~jx(|B6Vtxhjo)~XMtf0g=hNSVBeCO=dSMPO1QjI(4ncOVqf` zF>MJ-(>XoXfgoWmZZ|4C@-f~e-|NmD?E61&Lxmt6XfIweGqbXKy#!^?90pO=&U7E& zK-<7=s?#Lhe0Du@J}IY{KsE%BxfX>{m>ct=fyjM z=(w%QMlhp{yfos=t>&D?@>UZaiWnxk~@%|y<$ zft$Up=8aPk~avp&U;0Hz#-@A{OcN!0_(47RHN- zmnNpB6;hJT*fI^O4Tksh2jG{7z7nb^)S~8o=io~0;wEMhxR0C**C7RgQ^kuuJ|EY4ms&x-$&r%>dy@hc7U&*!i&1~{di6BD zs!5lSqhB+y1vBw8!^Vog3>wk!&d4{qQaju-n*@ZA2;X{qO7AkDP}&Z!7M3Q*At#QonXV$=JSQiU0~{%oJmP6mrp^C zM)#GGf(Y;M#@VMo%7z%8C%aROTk@VG7u#^ARn0FQ%geMo@NC(-_;=_Qg~B3DHbM{Y z8wV)gfbvKf$GHhOmKPYOgTNHwZy^?$N#r*TAJh^s_38Bm?JqNHWXt}{A|A)8eDM$; zr>=2=r&e;su6VV#Z{7NG0^1uR^PP=9RSn%NlioJ%pt#(jv%T@Otd0MM20Ai&9~RrK zgbt0CCwZ(H1Q1+)ZgG1@A??E0HJN{FQ1B+1f~4f(wtliyCIG7Qv^F-{wA$(mS*+pB zfc-AXTF(Nu4&lNDQEPnZSR z*ESU#R;SPZnS=vP`Bt;Y%N?JN0?GsFAFI$_)r-^LLee%vnnTvdYlNuPFx1yK0l4l0 zCtVCtguLn75)a)FMRZ>y~%P&!$N9t6w7xKq@wG&0^dU(dsd&Vc+||3ULxl6m&0SJS`n&6 z(;&eNUN#g2_hZ?WK*zwijbuqHuVxX7JzKGTCfZWwkGGPHfLqG)0rrq`6dZtm{y0#- z#hFkgpq{Ayl8YX5-6t1LZS{$H3R1iA6HTz|_ z#AqHoWWKJ3k^VaG(NDVZ9F2~H{NZ1ZI8sj`d_0pkrcKFE_}Duu`G8LcSa|o3(&&9} zb%V2|T`dcG-U~vc4Bk9LRBaFjg^RMot13-YmWo8rS~f?k6>IqxDFQ`eJ#YKv0V7Z54t;fsCB zAEmXMCjA^0KDlrbE_5?G*Q-Cs3Om@CbmM0^y`S2Ve3MYS`06Mzp+Dd5X9*xYN;ArA z89+i$xcQ_Dv+3&SqBs*^%n7d{WXzWkK|!wD9Y=%F_$NyV`2u>0Ga`$JojX{@1SyA& zkz{H}<6H>?%PPcZ1K3W2(NV3b@G@tEyu>;!>!c5^6&YFSZZ>47{7+iC&0)z}#cmof zYFs-?m$Vbg@P0k{*~mq4k%{Hj&bqX|ks03&^3dX9@#O=GwSjc);2UMr!)A02l)Gec z3L-bqwkdl``KNZ;!6n9vo)a?8$N}O7QUaQ(B4n zUWdMMxcPAFmz~od#g~1%1SxooMrlK1(b*aPH5lC?j<*P3pDwpw4Y_&fWty z9G_c3pP3FQ-{U@9`vTbx&Z_{aYC95|VtvN+U{k~&KwBwN8%a0U$iV`|Itq~ynt*D$ z-OvDI5pLmB;rwE`IM-#3DTc7!J_B-wmdn zAE;e$9!=@#HoD2eWTAJC4MIQTs9u2a)zc%sm%;~r@jNT|wWJ#xe~t6FhU{HqU3^Qc z`}#ncQ&Q4Zaf!~tU^W)L#A2$-j$z5Y32%-2MQq-U1u=F8c z;!08@NP@tpF0Me!XrO0|24yj5PyC*bidvH6C?e*`qUf#MSG^ms?e?`y+@)YCrVzpO=wW!D_IMD@ z%u8d&h$yM2XoJMocf%X&OA3und?_1V`?K*6P}P*RrpJxqM;s~Y>l6l+o)-grzB0wI zLz=kEzX7$&!Q0~t`2F#@hZk;NmVF`8`E{OKE1~Rrdux+hm)*{}*K2oQ-$`EOb^1cJ zOuCgNH?(T|iZc+M+kGnPJGL@+TIsZ`aRBkpKIebz^6~y2tybwxF82L;4kc_zxA)bk z8Q;z>9SLy(b$YpO+!*9)F`V-SIrJGjrER_~suTKIuMj^#iE<8>q#x7zi7GZ$h;EJN zl1ZZqh2!^$w>58vz+z*NE~%-pyS~k@m=rQ-+R7{#^9PdEGX{QWO#CIgll zqnUAzAOuy(DW%}&@-MK1(z4eI!28WG!)5paamavM*Zr1nmB&J(&z1v);=Tyh6hWPt zuhey_4}4sIekT`se@9g4)qHli-Y$g4ZTlu=*6(xWpAs!U9AeZ;M9s<>@=n8>*Cqn6 zEP~*gm}vm;4LabAgp8$W=Zk||Hw+5Jj&OT6l?9DLg4O2(6lK60)lMY`(i~GSqV;R2 ze%+gE||d+ z+S;9)9f0NlY>AFvD<5vyyq= z&G&)5;{j$k_up_KYaDz!KjdIAAK5%Xme9QNI}MJBG1je)0zbYHc~bZLT@*LqeIs1j zSfXL53f($G-#=ke93ZZK)RAa^n|Gzq<6%J%ywvW_$&1vD%tqV%ZUgKp4t~UP)GtfK zn}}5@WiR-1Fi?IDo1bu1cp8{c?(X(As`06+@frg85N2pld*|pEs3nkOihv^tK>dqx z+ML}#)llWgW>ZI-Db@D4eB?@$@s`xx_Z^T8fHpBk$k@s-w)4u5@gca!8K%M^6=o=D zW7UfJ@9sMzH~rOQx~LNEeO?O_okl@8jnBesdqHAM0Ldr>gK_=XY?7Hfkb#h7RsJ|n zP+o@^+5C^R@~(=L`-<*>UBVvCSbO=t%-g{r5;ReA9&ra*RfU9ZIVo5=wa}}*fAA zv<~r@0aEbOFZ)?soxT zc+u|@MIM2663m?B`uYcATQ{>af)t(n2FshXtt<$`ym)DLH3Jj^kSgO*gCS^xb?8O2 zzU1#EgwjEHG(MBTGX~C!pjt3&hR2I+4$mTXo{tTiTpoFA7xJx()ci^Zb`DxRea@SI0YECnz|AC}!^fQJmHips{v|oE7Y>$660>f+8CXJL0-0 zY=F4FE_6#abfCBsm7O1Sj%ioTFJ=8HLBc7$rt&GwBMXr*X>=6j)1X@Hm9KR7dDvx? z+1S;1tGw1S)IAPKx8A{;N&a~kh7S%k3ei(lK)AKuMxqPhITp?TZPAQM3XU#qN8ioKuFr*4fn+cGvcQ4v1f?3H*6Em> zeTDeXJ_r?h+F2a zpWKY=ANHI6FirC9?_yhADYg-tJZ6UIsxC$+g^zTaR_}Fy*Y?RFA7RAYvZxU9~Yckk+lRY+C`oZA$KdX;o z8MFgz+1SR;Zs{cU%_>s_ISe`p3?b)>{oZ=b`eY4#4tWVG5v!1lfbSbV`3IPyngYY4 zTW`#q6W7lyC4-Gm*?L@W9VyCK!;Rbdk`2SDoJN~sPp>T<=gG@7NL;(-``{uvipMLF z#7<1emu8|>ldGg#px=2v+I;jBW8#Jwwq2DkrkjaLFtARAw<-cp$LQ9Xy#ZM15KyGJ zd@sAzcTmTsDq>_2a3_NX!@Ta}4-=lb5Wc~|QY4E#UH(*_iY^f&i{RW>e>%)SS23l; z$sbujPse>}103^|&Z$2lV|EQ3%rDGv2?+MI`Q+W*h)j_p!7&qqi+`0-E-pXAXR)gGU z5`00(d~Y2zMn`lWUYYcfL{a=%rn{<)<9&_o-u(9rDM z0~$_0p$nwe(e1O{DcT*Gc9o7R`YWMW-J|zrv3AL|nw#nu=H#)HZ7bpv`Hm}RGYszC z$i~kXFY}2;)&xT=W8+%N`t4>lih(-5ux@Q&#ee(ObH8PBWoDs_H9KCfvHOos#k~Fb z^aN@o10iM`0`N-t{o|j*P)sXPUO+Qu~oV6lRK0 zat}cg0lk1)=X_8rct4)|1&xHw^Zi~tbJP4>F5qXRQ(?Q4gSenl>M@}1A#ix%t;S-q zjM^3BH4m+}GLE_ob$8?Yo^3HoMW>sWKi#`H6@3Zg>EuMh_)MLuCM=;>&#~?c5h8be zPfh=ioIm>)`+}l#R4D)c6{JD*dCY%T&47@(`#k@{goH!kC{#_OTO>GTu@9*`v;puZyFps zfZ-^~Ddw99B-{bo;BOwc^RA*iv}nEhNFA0<&r$Ade4MWpyxc7U9E$bxqHT8kMKF}t zTYhDzl3ryR_<+yRg$M8ix;9m$(DNrtmKy3r2yP?^+Zm!H&2fZfs*f~P)i#F4=kCpp zkZ_<*m=Aigg(N!bxkr5^;+oXD8wvV(+5gF?W>i+bk;~4>aoGgr{*vvmBwX3dpvDYb zD`Jn*WM;9WsK|6qNWK@5GHdQX%YQN}K`bxtq<`2B1D?GJ`SZ|X;pVBuQ?HD+rxQER z5Uf~mEZhGCVEkOck3yu<3Ch*Hh21ZV0~Lh|T|*d<9=;lJv}(PZQ!APj@K~ zmpWMB7hBH|l|~LCzd;`8__Zn3!rlMBR7>bSsMR#Cq>p&r_%q`Q9zUt6QgQpW&A~LP zG$@y&fySsrh?&jELPCSAuDt2Kj>IGf1$=nM_r&3}A0*x|?aGv2gTbHJDY5j;f9O%E zbk57JjjL4w-gd|!5sjxy0&2J=L8DT$S~Jy7|2gixGPm3X{O6=!bR*=+r1upLBD1-~H3Xyzjr;J^6JaR@l)3#ZsOil*2(Cv21bT--E$}Bz2q?KFO z9Dcy5yBO5JBvEoju{QhN}cVAn%ByAMKYkXjUNORG&@$<rU&=NcZf6aj@! z#}rrbTk3M=)y!e%=wq-J-t$Z6v;0qFWp% z=MvCKXCuaRG08QUNDLC_0!y`ivhKkj8$}Y(9+7==h*jn zB2%cU6fmSqwV6a&Rh759_C`}h$1Q4Xt1y{?jy*Jq*hQvxTa$t}ZydPv5~gH57w=Ax zZ@eIN+^SFPE-5nJ-pRZpPw}U5ni?b)$T0G&_0v6z?r&N@5lDy)^w{_{H>fjs3l1pq zkEr?#G#(-y6Nuf3xGu4ali+u+nMurwxrmOLcQ#a1`m{Nv1w~Y7rKrj>#i-I&UQMdc zOi#GdW2`vZ>$7t0LF((<1|-c;9`hObcaVUF3z5oG;jGX()GE_-cFSJaY_bFcUbO^c z9dUUP>fM$?Yj*`apf#r%3hJb@PCj+py#cASb)QoC62$gpGbiTOwdqIkb`&Z(L9Yg$-c(BzxauGZ#FRS}%zUO~9+xl=NL+bgv zM_XUZD&;)hazUS5pXzS#Sw1gVs4U8f%E148wsYhl@Kuiw!VU1=Z%Kyd21I$?=0-nI zwoc8=#Id4&YPaZu5w)~T1S@wbEFn8FsGdZg1!txU58(L(V)aoHI)EjvYeVet5>-gPU#lzhUbhV1 z`u|a zesmPWjz|DhRI?9kc^)VXQg#dv=1QDv=e&H%yn4=-lZ1+){`F0MLq9;hfLS^A7O>10 zUdRtNAG2TlS18o_@T;sShAfStkBgxi+y41Dq~#PmevPltQNVV|li@SjB@n)~pD5+u z29Vs7%US|6OnhNrWh^TGwarl-n{38V9r)e>-T=%D)|>O)93E2$?m6tLa{ zkpu#GMrg~yf3rIID%Of_KI)7)bjAXdM zgQ1d!&Pi?%fEcO);uN)4RS4z-@sdaPMXG!^s+WLMeF&t`6EK2c4oG!b!y}M^@)mz{ z{;6Nu9Tf_ho3A;!H>N9QJdpkpxB4@6)*;Cx=EfM;;W?^L(C*3u@e?5qT9Ug2&el2< zzAgA*qz^m)`9MEQBufGwdn#xvF@~H44=T<;oPjd%Ti`LX zM8*|}RX@m$c6o7y=)RTVhI#p0a##Ff<7lsco~?p$zSJJ4X^yK7v;Zod^3kQ%KLZ01#rj% zk`x!CU-xxpTUMyZYMi(ed&9))T(P4JEZXWkrIXzkqRz5@`S+wdS!Z;jCcP(CDWiY| zT~$^Y;j>#%94c7cJlB4UILD*%bH&2$aa#Op7f2V^b$$?<4>E81GRVU610femM^#~z z?mwP^0!YvBgnpot9+{4j2ou_xoT2_4{I`Cc&~PSr2+%JNsAT*Ool)k_lV2K0urC71 zEPLr;Gd8A~m$^EEzcy?0y~t73xgvN*2J|V0Ynh8Kh9_vc_Btvip4~9+N{d8Sz%ZRz zB6tWwYm7@XKsSmQ{e+ila0OINP1#7%?66Fht_FVdHzpgwva2Z@w<5&$HK}Zma|)Ml zC2rJxv%8%6YAAbH+HokHNGd^JYwU&`t8o%Z!nAR?tZzjRJ6!8XdSA|27JI#qbIHz9 zrKUaUZPlugPN)#sL`L?m@69SlBTLyeo2@etstT!kk)O4Ag@p1|7SJGMOJFZDNW)d) zfmn}_uB1!T_woK4W5GpgzuSCa#u7K#PC~*W663ULi64i6lil=6RI(?R|dR zS?!R9EP8eAgs)QLQS<3yyt~ZT@zp9IDkg~16^0$KQ|M_v+ov$tYrFCsub+oq6&15- znw)s%=3`qg%KvSMd+q8y>AXDh=N|>J9S;4#X7%fVBc^vab4bg?{>8ICaN#|`0unE@ z732mY3Rl_6DBr7PAK^s$;TI6S5V+|KLU)eWZjdQ61PIn9nm$(z8~J7ldgV#ct()pw zN;64wh}p;2Fo=qs@_^Xn8}gT++zOpe)yP=~g`VYpt?0(l@dk0ROLx0CyTWp9TyJNc z;q@9$r)#X3JNjp4AyCZf7kN#`;);5ufbtOcKCI^F%I8naD@^vn<%b!)967&pzu=Et zqq6qAU5SiKAha`x-5IQ^DY68ogNH>@jd}sB!k%lhSwhu6UoJHR#qYX=Z%J=Y&zSC< zZC2B{(1B<9baBz0O;{pnLqmphq7k=zP^)&L`Ob^(&NbD153LXLt14)^2r;qqcPA~r z9G+VBo`lVzS$Qt!z3i5ke&k-9yv0ef`cSfnMWYIbQs&7-Fe8(FnHPmNqM~J-W4AD; z5j!7?9Vk8OOd~Cm8wMu){TBou2%MC|D|FA-n!-2hGyvX5P9a^Ity~1%_JeY)x#qdL z2eeOCeZ>IK>V&Lc&4WtKvhvk_HRhYP6zyfV&A!b@xVVrmqfe&2wzCmC+vMbaY<1{I z5uLeM%6Ib#;d=tUJ5L7o-7bg?)ad(|`n@5UZ)~BbZ{?YpXK}c@>X>K5k2kwEh($Iy zHP7bitENZE6_Z|DnjZX!{38?S3z^qNLyhtcOze$J#W!k`NI+AGx+KgNp=cH zln&itR?Z|xcN3SX?$*cR-pab$820O1^^}I)(IDF~Ih`I~W?OQ*&NQ=jxw-C4i+&h6 z_S-5YL6KR~jxT}uT-}{RrE^eAvh`?W3+YlCNxIwvfIA{aGP|5AR@2|JXE(}8FjC1$ z`feyWTsruULd#RC+bXOWpgGN^>pQ3H(BtLcLClHpp-A_b0`S zp8aK4B}`K(MpamSDj)BQ@v;VMd86w^ zBVnP&GL0m=vE0hd^th(~+YEj4^5=|v2ls*2IT>FywtbZxY1N;NyLa^U+IB>L{0wCh6FyX-&_uqcaA;8iz$syWfDG? zYq@LK0q4ws7*`0=IDqu@IXP*NPEULKvXF$sh+HkQW)8>iCN?BrAp#++#SGFfS9!12 ziygi0NyuHkAv>|%OG38wsg>h^^z^df(ZkcZ^2C*!nsqI@CTf2?;d%!YOs!Mbh3`0vr}!pml&~Wj zoHnx89y^Y*XJy&zXEJKtj_zj?+uxgBMb$UCc%`mBJYU1z+>!8V7go%F`Ryq!W-m}u zno|W@OCtLP#Ujflc4(1qv^$-?D|=Jsl#ogVPDhF+bcrL5K(4C1eVO^jZ4L>JFWRq2 zY?3*s_pidPx{MU%Km6m-+{Fur+dk4$WH4OY)n|(?8|ATDgWLbw1Ks7I5%BR zVHx_tICOVGk8ej}+~uZL2OpmD>Ln`?2GTwHQLrKUfn{;f7Zr%V7j0q2me0X*N_Kj; zeWMfEfzK*QD{_iJ2yzeE@kPzz?m}4;@bJBESXo(VbN!?I{anEw%?=3)YHZU!Mit4W z=5)>4>F^ZfG97eTAQ>gc%c*U={TL91T9o0i*=7_aAG8KqU>i^GwEW9ti7(x=+p-h*zQBbQmOHS zYIv`sVw~u@UbZ`=n9iQG-IE>6~A)4QU6TW{mVS*%T0Wch@jc9oBS)2R%m zp38AR26pv_xm?;66E8UPM!#~ngOG3SrEkLV#4#k+Ip%tML)uE|sqds}o8?0Eo06xZ zWEZUsrY3lDVa2CT^ZdZ3)}j&<|jMW3F5l=k4SqvF_`8M3w0HbqX>6!8)WA!sH~) zw7atLvhM?Iit2#QaXuWc(8Fnu6#L$Wate<_g)^rJlB+Td=^|ov^$g0b8B0C+;15F-2_1-hBjvRzJ z_V>#)C~R(arT3SE@4gUeVCF62HebYIU%X#-UQdji_!juhPNi(wlq0iGCMT}VxyoOs zKHi5N|J7^LX+^#XVdXPBE~;JN^z}BMhUos!^x;p;oJ4FX2t}uw;IF~jigw5JI*nFe z$n0tt4HEqxfRjWGrTN-SM(#f!ZK1kxk$P7H8Wk$6LEbBIW9NY_m6c59T7Z0Xtl z^fY-ogUs+}tHvPN!!I&=r(WEXTX8$@1mACBMxlk81nQ*2=~dKTR;|1oc>B0JUkP2n zVEvl@*3;9&q#FmED4Sk`R8{!gy75?wuHGJ9}Ut7I~7XxqI+HBO1gm3IYCa*8zzae-)6Xt!#Z4M%O{&}ZqFosg>;;? z8qeKQHEf;TlETB5ciFo07bZv_bH(O9{cI#1B`W@zcN^lf7xF3+G6%Fwzm-F--AF*^ z{050N`$heSBFi|O(cN=1DUN3D&HZHW7fHb#(t^j&RF{>x^Nzi+upo(Nu6e}2QI+hG zWw0=)FVjzVw}-l|@N3)i`}v&Rt_A0Zc{s&N?ixxH8YclvEwiyYRWi&`;ppK$^dBin z5TXYRHWL!#Oe374>mJ#uD{Wo2^=C7$Y*kd{e+OIJEXZi2yrjf!Y_vDGGdwDiYcIwe z7sSRg<#c9S7#teD?+&>7r)5bSm#bZSeZ->OZJQ`j{7K*eR5~cP=r+(rS*@MoN_aL8 zptGfEd)PH!*~Z;*+}?u5i6zI(WF`pW2*TXkDv3&TzxrWbzC7fdqh`a!F3zHvQ>J)V z>{e(6RR_Vge5S@LXr)ZOeG3=RPYjAq??=6+AYbFa-*3iWXva|T#udyrKn~ZG2)wdMK@OoJ3)KdTnEbNXnawq8kP3wq`k!sflVwiC z6<lw;{rr<4yZFliOv}?3?G2~yCEz@w(W9wfY+f-e zh<7C2r0=WmSR71`kK?x^lt#=QdzC2S_FM$A&~NQ5v#LH7I=@|a*>La}VXLXG4wCqL zGG*7cL!v>_{Fk&$Rwc8qbX?A)90{kr-mRTi{sMSX#a_ugE!#%u0QF(q-{gTOcE74a zhf52lCE3WwA?Jg>h+8~duHmv4o%Dp>nSX>pouexEMqm(n{C zOOyQOfj`ARZa3j`P~zmlb5Q;3VHP<*zZ}nV#->xuw9&)m<2hmnomsSZ#z|YEi!sHN zF)_9Bvu4Zq=^;n*xY}tNHqVwB?96c$U+jzkonNjaPLMp8kDg9eHEkE~|_pS544x{kmB9Tn>s^G-hO&L>Xt_R;FdnE|7;YFk9fvnoT{>O0oNVh{+e&Y5RwSs#!VI72I+?Qj@^QBr#qW)n)4K(*{ z`a)wnoFm>8Pi48I?cqq2gg6x_*Bot;N1454dI^2er5Mwv`G_U%Q~9{H414D)TZL(3 zJC4YON%bX%<2^(8)#Ic{8)AGWb|7s~(0sZudWPP(^+|hhF3~VHFW2S|bdT~yN*b^5 z3SF_uD($;)2z`?B%EE;_s7_()H7RQ;tTQO%Ev*zTySni*{`HSHcX6c_95)86Um7=@ z!v5aA<$(#NT>|~eo^=#`4dx&f^!~T#O1+Bv^M9iXd;^9ghAtgU^?!wMfy#oGl@&>1ivJE<=TkHXwYc`U6NVAxl zshn8d71_*_l8H(zo}9AMFHYcclSnVmbFa2BdBNz@Un#opecUszW$)`f>|$%psRD&V z-wSRxZ)I<1Qy>6_g5W~|p_ReDz5^%q5*M)Q?t;&96!G|0eP2B;Nt@zk#3!NU_uiA6Yrc11(vCOy3wpf&x zcBsjrkFQ^qw^CZ^)39q_wc#!)x04NqGX=RRK7S;1MEKWd8{`PhtH@0PuC_L-YA7eT zEr;I_a%T6=-p-2ADj6;`Hj$2-x=}$lAnLen2G}6W9+uK~l~8XmU8!&$Z}+!15bU#= zv=BTa2zk5TBSeU0-0`9lqr>GMIwrcUzKbfo4LF^#`1%19={C#ElGn6ogP(blakJHE zVJ#Zm$WDtE)`>TGry7Zy#e-(A1_)erw#uijcuQa5><{RPB{wOS)tufS{gjXaS^wzd z6hHjv!tx;p(ER)b@fA@-LyE6|zQ`VFlc2{&H~7W>rBTm|*_QhHix6y_!W{KaD>k@eGoxbbT9SAUIR< zLgG!?t(#VLg&!KTbOjG1G{0K4$r#thNOQN}aNXTeZkVmLc?q@P*{f!~CfM4eHtk}eJ@8SQ z0g=NnJR#KI7}PB$`QU7`?N;-ALg@ejb=MqDKYY9U^Wp1UN6_`?TX8%@D3_u5cUnzQ z;=RYSNym;g%yg}0?CK9nI(di7_NY)a@~+pgf1GixQAp}Ohakh3@+dH3zNp>i}3=JI~x2v^h#hiqr?M87N(8z zOU5b6x4pzCU`sIlw;cbL=|cUz4I&!Fkgg zn9kb{Rc4w`rgt}}EP?|Y4Q_47;o5AwkMufu3j9`ebze9J9M)9G^rQEcp1bAOQ9}14 zYI%`s84qte9UXzbdHw4?O_e}Xyo%ZPVtZc*pofioa$^*|D_y>SdQvh@v&wp4Pt;HOfi($!!8`ejk9z$Z)N$CmlggwD3KIyK_CZNgpSQYfPQN6XvZN@#1pVJG2+J}aQ z3g%x%0dlx^TZ7{<#?s`|x3Eo3O_wtv{iJ1XWH*H{-0#t{67H^sDdmfo<~SHJ9le;n z^0%ig?aNYKsj-*lKbxq8f!MB6^X&(VZ=r&}Haq&n+@Cu??K=P z{wYsBtMsyhIR4~7m5Uz(o<3CcSkMA;hoE4(M(zzwaM;;z4E4LLfIi_;A#6VArt^_y zU;Jr=qP^lRy$;DU_qd0ssEeINwp}YFP1K*|4$zZXx}$5h0j#J3sB%@%%#jYwJ1>eh zVJJ)YO^g0M417+*5D+7apo2q0LtD_+x2iLgoFCPr4oT1bcF(@!Ok=m^r`A+GRn0o6 zoQs6It)b7AzvbH*S}sM-MMT+@mzQS%&kL3s(L51-n|imK8tL^;7}c1WDd_#~pCg%L z0kV|f*IVf+%RCVL-9hTt-KHcO(DMz9Xk2jk5nR|B;bc zzoe6W0E?fSHW8fb?ugfNJTBF|^dZ={N;Nee-56zSqgHWFjaXQ_J89(ZT$lQ6vieeJ z_oE;GdTsamYk%u&Y@58pSN6)xH5kyzw750NHODk`{Mj-^TqX9-)$I^7 z{k8h)urqzt0T05GQ?T2c?^hjUPRvwSS6c(`z_8fxz?@J)y#uXW%PoRuI^%DAm&$Rm z_@k?Fg|!2_XYYKitdEQSPOU6{zN$u0{8uly=)Ir}r*;7}QafPT56+eIckg2aPOzYz z1M0US(_!cq?yJq~n{gDpP2{P$2NQC6pSl|nt`Tzu#E3~0Ar2B!-^^d3J|Nh=Ra76+ zjNtmG03y=q2Eom%k1Ah(h)q1`*8J=1(>@+(v^&%frWrqBI%M)h;qtGjdsoYD zXg$60X8%yaul(1p7_{byzYL$f{D?{EmB)^qMBLQ)*j+!$!Z$@r%g6GSLVp{uHpfU) z;&KbFEzbyoDPk$a_!>BdqPZpP*fImty%rL=Rcd`g9csd!*GgCX7D-7-S=^92;u*voTdzZ^^klC$xU4rdSk>EX z33$Hfn0&IU@QxYtHrp3Fs2AF|tg`j@rAUHJ!79ppL}-p(Ndx=k{f-d`AO-g<%^((d zE_PbUqxbnUB`Op#rorbwTc}h4Dy{078~AAEnjzz2*d|c!Ud+=pDEjeOar8|}_x;Nf z^TB;-d3jk2AOAF|8Zs}=aIzF!FDp+Txo*Q|llt4SkVz`!@aWoWjJ@ie6vCBO;W7(M{5E{6#EIipA^+qbHIq<@{$f{%IYrQjA|6 zj%2x}VLr$@B6O*r?uf)Is+=CT8wt@+9%5@H*Gngh2hBMR@8oXQ%XDLtd)DL}d$Cuv zd0}!Sg+38xt)JtckeeN*?$$7z`IHiHu<}&UcV}Db0?#O*7vlC>@QM(vg8`FA9fNgs>y+u>AoMY}O6MOo z-TA`ba>nKm{&XzGR`wg?x&VZpTn)VG)uLY}O!QZj1X>GmF4&a)_lSQ($@jKmm{iv) zf7@)V&oC@|v)xw)C7CX$EJ%NWM0&O1m=phAR^fiq#~M=Tfa¬^&ndFqLoL?s9fg zuah;`W9H5Yw3J1?3-(NV`kD8Ir-z48sv|Ywb4g!}Zke^pA)ZGa#QD?@11WArxqmXZ zWu0s8%r<5z*G>VcQ6ko`Jokj6`K9J-h`^8q*|O<+Hr^X?ULQ|wO&5{ANEiaXIrt{< z@^C%;;k;v}Q#dX}qX!gWSeZH26~HcoRt!;MA!EqZvV*T8>VkWw?zNkj8M(Bbp15do zyKyn9?yH+3XP0F#(kR{LMiWx&;k0=Nh)zP*Ne_MJ!XQOWct>D_>x9snmtZfB9B^^# zdb{DV&oOl? zxLh(NQqybooSNd*+gBB9HJj<_UbXZ3rjk@+ta%21tjn^|5?EI_G|m%B^x9AvPJ&}i zqJeYyWp;~^k1Lz$6`*2XZQ1^v!tz4KmPL5f8KkWN(eySW!MKd(6-1ox9m=0~&74PP z?saQ^=k1bgxOKQwvIp6u4^&EpSUIa{llVR6uYozYxjcej*en|H@5~!}^qRRZu*ydG zA&DVKS?PRJC^riwM3nbgxBatXT|vuoR!JtBa@F}l>{4HgO%APcSgJw1CKu`1hbhs& zo59QVxRSKDB97sB5qn;F^V@-nj^waq)r09zi*O^HrXTPVHuAO4ZI0pJx3B1Sh{T1g zq&@9b`7VBQZsi@Z8z=l=(AoGYviUQLp8kXqe0qFzOKqpDvkybdtpzW>xGhN-)Qa1C z)Ben-h|JP^6vt;icSa5W*nOO)yU(Du^rU{bV4J}>-ZqZ-nKkoM%UDN`>bH4l>ZrKx zP%Vee@f*n#<{764SZszmj>=feKTB{dS0)!k#bNwsS8o{`kB#(b2MA=RdaPY|Qs(ET zc=MKOHr1uf=6r+usg(~t7d&rmo!6^=-^}?-=xF_F-u2!2g=NH>IxyK;Ks(g5x9gH~ z%gP8x0)rCnmDo2}dV8;-NgxEnf1fntWCURho+3y}qB)DL{KUAqY@T7ifBznYx@?wjm@~UE(r)!`wWwz!FN4`f)UKq+ah~rm9%m=MHna_i_p692 zHtnmtR)e;PdC*X7(vP-SyRh36CtVv!eAG1Mfwrg8`kCDl%GwJ8qLRoF#Acd-XE`@UP*s?mfXoI%)}q@aKz)_imz$?!SC-`&v(S^b>ZF3K5}(ey6&!N z7h`Ohfer@?{se~F=P^`j(LnIc^(%=u;C(sQf4@Hd5+Y3R1((I8mim*#JV zMl<$_w-0yM^jNr~<8{Z9yhz!(&aJ{Je9a{5G40Suz2j%?QRC*M^FvY<<$7CNm>L~e ziGEoNjyd#be$9_&P#!pe{gaC!i04kaj}t#p(k&+@S@@5X=ktRxBb zyGfPc46xsqbi?*mlVzM`yp1Ae7iYztS*U8|t2n!%qSUQIn5y45b0rfBr*po8H8A$* z>j@^s+RCAc%=w8cqa?uvwrNlF&?vjO8a4YtWw{Wu!Pv3CF!eIM?NOz_JhqIBtvvLt zGFzML$9Q4fbWcSucI@5vNspk^NS8%}5JxJzKr`t~X@%(l>sS|*VqvHYTlRxkf+w=t zm z@l!$_M;`tVz~4DU{gKlV`V^Hopj-LMTZWA}YST}QgIPO|Da`*6-B|A9I^2d4u60)9h3QQEtEG9IYia$F}2`UMn z8~no~YOh3cQqoeCP4YK*Kk^7(%zxzCu1^&iceQMU%Yq}`j0~oL4TG}8$lXv-16vBO z2zF-R?A!>&bGp!!!9kCzw#4<-K9XzwEp+2!GxJv|eh=qw+(}|LdIQP^cY5Ga8HRVs z=9#BCiy~}*hr^RiAY}1!(R6;Ovu|WQO{U4Ppx#B2nJWaz`^AJx6O~`H%_j2ooZoyb zB7a_Zqa!|3ZL0V3>@HY8wLdccnjtKi>gHRgV-+#o-rjB)FMRPw3%^|H3zz+`nEE`% zk8gc_++U-A{b!LR^gf4q!Ud_L*x2}ZeA-i#A&v(h>RdF@Z*nH&_$vl`70TqH3lmVN zF+$mMTp)zU%`NWc$#1I*Q{>uaFk|g@_v|J9?a?!V)h@Za_4wjz$y@WhGdQ&r)sk5n z*D1_sJO7)2rVT5(?G61kFr&SvD}22$UMn(R=dMJ`8k=@y$~EaUote1To6dTg>6MD> z3a|nI{G_!UPrJ4ad8svf6Kq^yoDC9}J-3G0r(v#ta<}gB)AMJVWfc{@DO5EXEWzXTR#*SAxK3tt*;9Iuhb}Y- z>}bp1<=B>}qa_jH;sYo9OYh08j>=!1UOkH6=(+czQW!Elt}I@BfWr6qo9G1LX&sLG z)RmMnU9j*8rG|#*X2uMRz*7HnaSb0`LpLXxv$Kfu#A#-7Ng!ghkMnc&7vs3jQ@4HWagBnJM zXyMFaSlT+p?ts`mM4guZ!&t|N^1x(>X5&Ry#BSfbkC5p3o9mY{-GZlI1>t)R^0w(G z+x0Ui1?AXg@PCS1mjt;NY_uz#=f}Pn>2f%Nk$hzN?4^+*XI@ZIy=wH{NNxnzIAjhqgAvow=VSzc%J0M9MDQG2oT2> zx>j7N0KTJW6V2P|r6_4kJuSDcLT5Z8O6pq{E4@qec37|RVZH{s^UEy<& zoa4t_K0%V;WA@GZvrOu4o3x4MW4SevEK_0gu|Zdpewl~~eo?$LXRV)G^N*kI?X<03 zVZQa-U8l9oPzIN{*jVw>14X~~C~FlSsOr7hr7q2tS<0(YC02;_nAWICwC3nI^0A9y zuyFrmZw zq}{*bvm@M3W12F1&s(?$;`y}{z{Dy29Pws4rJW~x%bTG@R9{&szAm{8iOw~jK0T^K zh;#tvy+2fbNZ6K@mj1~)*$sBu+M4W}lh34NWeE%R&l1SCkK(EP9aG@?tZioQ2ps=} z2sHyJ3BXmHT-EysFpE=ASm%U`z^o~nU%0(F>}C&!HWJ*G#;*9tF#_n~NEV%X?WVcND$9YS3SJ$Kw2$A(=uX z8vnAraXsFY=)-^PeBM$Zx6{8AP9&8dRNb8T03_%2qxC1j$LwagkI(bp9!`J2W!m*4 zz{!$KR#oCs@aWv!jNrbn+?$ecs%d)q0TPAMjfsz!1j_EfB!<7Rw7IUX*VL_QX&=Ld zD;qvvGmpzTTSrd>0{up3W0`He9HA5h2c_-b)_-XGFDLf@#W$_I-HlN52QI%WK2fsL z(%L^!Q=qS3V01-90dpm7>mCYyt|J3$hLBRi&Sab?s-}+u#JCKp;o;`b(Z*$PKR6&)8&Er!4 zM^x|sWT*en4d4HJ(*HqO{NEhR(M{t&#SbVXt{@QW3wcYvqBeD7+h;)7JNk3I7JoP0 zmch+?wM;iP_ttk22=V!V4ZRo`4?y&NfS~j11zXRx)e5kaRd9tsnYzXg1;|DK+2Gwf z_@l4yt(3fcqolX?@yL6px1S%{n4Go#%-XL&^nrA8dUvR;8hthrypwi@j7_uS^m0HLhyiv_Zl=)x69p{i+W3hvu(?<^qh zum8e&4G5?O%l^Wk=hCD=q48|p;^V(L$UZL%a&oi)vv8nx9@rxL`uZ+D+`0)Nuz65N zD0kEMSg83+vV~XHEG?D(eA$i78cjrCIix6CpwXpP1PBVU6Smrn7~IlatZo2s<6e(& zb2_8=uhtygYE5oVe*TSekHrsG1fUto{qW&W;LG9L){RQ+n^RNO*$E8vbj-v2vDw*t zz*@htttWgWwx9OE!9hz+Q&ZB`eQnj#a_hv5KuB)sXUl#n$y*pI#_a9`=`Mez_ga?H zcK3l4di`g!(X)brM*%|hK43+qwWko0rL4g>ATMvL4xTGSgf201Z; zV22&qeo^GT&7oEjY-nse3PloSxt>;5sl~;`T0C2CGqczl$b#I;N)rH8C|{pA-fhrj zgh=YvY#4MA2xq(iqBO}C(8l>CBqfh-dE^k0SGV4l+0f8%WbfX+l7$$65B!(Vn)PjU zuHd|+q+U7Xq}0v>2m8N-*5^4L;EaB?wE{rEhR{NMnh$t6j{JNd-`4wVfg1A&4u?}G ztU_731!TA&w|eLEd@Jdutpk`Fc=h8T?@t#m3IkuVv*+KeH3B$iFOjk?8^S9cv^KW~%}RhOf|(~O1?Itd*E@twd? zG#&y)l#=4&!A)Oe!q$1)=lO@cJRLdoY>E|OXviwj5)8t%qi?1`TKG5j={BED(^Uis zddnZe?@6{0!8!|T3Woa|x1#szSqTY=Bbz3J^_FUil-kw>0IFREgSAWsK)|5QDH7@3 z5}W5hF8@;{&=>LAQDR-9&8BTCQn`I&!T)S))$c&8GB?)@0lhN-+k5nvjcKdhvROr1 zpp_d zF{|hm8nAIZeGms{2g!>gV8f_~0NHe9^(e9j;!HT#DVnV;MCBIq`a7Ap^bjLTKqi0jI+3tmixRu&BSbf2p+A z*>Ph&eP~-d&}0aZHYsDLdw}w2OW4s1ljgbL(_3-hodIbTU#YHcMKcT`lpWJrdm3>$ z&K&sR9`N+3?-*wlenc9I?3b}rf>Ebl4X<&Jtc?M5Fx?bo#5wxl0bqPb{@73LefZ48C(e)4CjGHxWl!=| zt+ZsDRv=tDLZa8O&qRv$g7|eK;~COblBaJv4*otC9M^nwuX=!;03-2($Ojz>6F@|T!Z$<=KeNax^nq~1Wf9)x_gzj}}U=<#-?$y{`R~9SF zlumI>k-;-0ZyW-vJh#%7?wQ-!Ww}zviT_l7hxsq|TitVq&{i@T=Ywijax3zjNkHoo z=YxdEsc>DVLq$7rY_9n6tuwF^JBVTpPyYFWJnL5KA zzbC_epAV(g0WEWc06aa}-lWdX zd%wErwW}h^ak-yJ8zc2~i;-GsFMV%>gruM`Kv@xhgeTY=Bd@k($}u`a$^V?3vhamj zIjOif*)geJ)vEG{8SG+KR@M^w-42h9M->Zi>S}~BeFuf?)RKSfpk{rSzsNl5e-9$W zLI+Dg8?hk(s?DZm=1irn}J=vRC1f}VF3TCw2(7m%1*1YTb@}DRbzIBF;Z(<>{=qTM;#$>(; z-=O^QGdL-|%g=CEcJve}ji%BSfcM0FR{+DUWX>vHA7bV% zSFRf&2ZvxKH9I&(smPiB(ZJPOP$O5y$>OLU&GrtvC7$4qo@EyZ@jeh}Uy~I8YIwwM z*jh~-?n*{)nGZPpLhBQlq=srN!wH&EEIA#A9f^F(= zW*A;kV*fS_S_FS8`;Li)`zrU(TpG4IR1qs>T58&GzP9P{q$plrWoe>VJL2X)G*sL( zZ@GrGhadb2PEs2ZU)#KG4E!{z4_ko;bh?sR3E*lDeq-hl#{5T?%Z*Pin9$vwCU@uf zbzy9P@RZOc67zhMY+TXwNH*pec(m0&PA|k<1rn2zqzf~w7~&?8;x`3`FqSL0qT5tR zEe;v#k1pCAYSfltOk0?;%q=QPhL!R8d9&)}yW?pmzj6|5c=L@>K%Y$xrbSpf=arZD zF!<{oeK;-U(w;>Y4Kbof57hrqxc948Jgp-eCM8z8J@YQkSYmp%E;LoH(O{$; z=Lxav2NrVr1`spY5bHcUeo7%5>E+ccCA2cCoI0xJ`0Yp#kLxm-M0d;Wn1Ti|`e7^IFZlhPMoQR#4hh82%|S@Ptbxqv z?4nKe0cuX0*A>K72o|WFys~ead%LRNj6h!=yXc)FWcp}mKy&D4%dd_b8@-P?E_IpP z>X{s)zsn44yWy5Mj>fjYs`3Y&m4pS<5C5^Tu{haetOsP+*ab?0my&e?#8fauHH2R_ zn?fK{G)}(arbNca+n0n3pn_KF$iUGS-4PZX-IQxOX3b3ra+^Kb5#Cf`O-#>_uWib< zYCBm$ZS^$F(S0+Jidizy#GSeOksAj z7iqov#m5@RH~dvXxWsK`<>hUi&Ti^c1cLRKi~Tj;JKwe3E^iaaAY9+AO71*FdJr3| z-QUTOQRzDM_O_H{ZIFY595)TM-?Mfm*L1gvVWZ-s6j77W!)u)R`j>XwS&n*S^&6aw zZV0o}iBX)c&#W?VI2(2<=uXMA(IL&iiEKmInbY1I* zqcK>6a8io_b*M;5+L$|7Y$A?otKg@bq_pBc#td4@W4Wsyl4HW2cz>on#^1*sqAA$5iJ;Zgai+oy+}TajrdRDEwQ zucmlStUBi2ccGCZGlODwMfk7Az4b-0cXg?YmFvTMWZOqDw&^4I$1=E>A_tLjS=6r@ zyC}M4uP7%6y97sXJ?%+XAZ6A&`1)pNWwC_-GkoR9k%xG%M{`!0C!Kl(tGZRqFrno_ z#EaF7MmV?m^EWHQ1#BjqOlwe@*`A|>A(J6z?t*U2^|2YxR`vVpkx4@jKWUy!zd$u6c%9 z;-3<%e8glf#aG!mBljLPXsn(G+i2JEyZWtF6SliLSAyH?D=VH3?L`^8$J)e54j6R&p4rIP zF;of4*i-tV@Hlxxh21+wtOJ%)e{d*_*iOxW1EOAIV10Cnn3Hl`9|_Y&MXx8me>dkn+ntu@cKl?}nsTxD#dk%F zfA#9JdT6yS_DXz{P05u(6>=rNuxAs%jL0x9^`;PLoyM4Tc}FyYtIYl z1S;-0T{-vp3@HT#JKw8`yO3pv>~}kn%R$W4zq>9uMkB`g{9N2$8-{5)8;^($mv5}M z6+j!a=?e3>ef#~toJQX?7{ZDmjDGG*l*_4*rvCS74<~NymV{Gbw*vRWc?R!V^6+pP zMPpEux|#hHM25OicFX?nRDC?0uJ^RQm$p7i8K$&oGOAn?HqM_h2zj7i8bLcrEFwnL zzSlriL`-Z>$U-*5i?t~%w>sgiW65S#1k6X3@#2+z1_3^UKyFQ@F#M%bEc+lfWiHMyp2teO)Kk*T<1VtwNB#*)rwA=UvEu|F8)M)tJne%0KPk}lVE zxd@B`&OyGNyyOk1u`W2^d<+i>*z-Q>h4w&}1VcHV#}(}%B_}t^rZ#bGT)jGhS!?3h zZa7NY?)KQroS|{$Q1NxWxs(e|7lk0pgLKVDGE4XP&ENvPeFw2#V7210+}zw$`J1;A zm$}$=7md<;aYOWBB0CG~Ax$UNE4!7}U4gLwP65=lw>kk_CWa7=5#w5KWa96Ye20~X zyZ{M0^&Lx3aG#k_AdPn?ll$k`#gW3g`@)lLLgwC?=8FiS*oxds z{AuWo9Y_Xb=nTD%#gYbR`owAgH`}avGg?4pKbh%a*)~Mbbz2NDEp)iS6WkA z)-K->XJBm1xkytS=o#W_jBn1SNVQwVjQ6KeX`U4uYbq9SmstLF>fdb7fdDPHy)a>n zM#@ssjC^`wds|poSnPfEczcc$AgB225ewlJ@cIl&y%4)ybk>={z33d6p(tS7k32uk4<&w*)mcL`}KUCX;F9`>r09pN{M#kuXR> zLufJw<(kcJsIrj)DzCM62OsA2^vH4Qg>=M1ahp}oc)wkCv-zevD9S4;(pv_=Jas~) z$Ks!WSSPUURunmMv7hs@NS-dX*K1b<^R!xs;I0Px=`e)BrM8ekM&<4doCT5&Ql>mc zBb=WF=Qx#W`ufzbv?6C59Jm(L@y7mIw$jSIS7e&pAm8Ff;yH(yIN4y;>Jn`~$Sra& ziCc6_>|p*TOpyU&`9`w7Wx7m_zT4FbUE)k|N9KTtf1g570oF5;l<3x3nxTzm0*s>C zA(O17C5~Czy6Z(mYWqC?U%qNqsW;O?2ETl<$JIzaiqkD+!%72z@{U$JN&wG&u4iNK z4ty;fDeO%nJ0&|}<oGPeds^6z4YS!;u_W0Qd9VJlBT=A(3!h3b zs$c0Qs*-OcBTFLED;4&xY^>x19T2*if-)&~LPU7De?Y+gU)GyP7lS?5Q_2J6z7n(C z-E?m|od49n*g0k7Bp+;M)g2?&ctWo{u!`Em*3|vTEZQXcJIkCs?k;?(EO3wLZEkENd51*X{nYS7&kMm`%{! zD^riJs*Nfo8e|7y>hu!FkIk`i{a<)cwgk1UjTDmZRJ|E)O*xnJ?%SajRK#L=UB zsC=MTStFxLr&$B}d2Tae z=Zp8Zb4pGeQqIdM3YUx<9lf>N{WSZBNhLF}Lkv-kUko+Pei#d}<#2q_xHGD#be?Q1 zF{OWk<*!32*`#?vPZexCvHj1Y()JZOt$bZ$8C}%yjk0!Q40?Tppx;t-_C5OL!=F=9 zatqWYMKPeYX?u@J~ zFA;BWpnyv)_9w0NK{}}k{W9~XgMJo2=&yU|25u#O2yHlRuVn`aZ7AWPwn1B0*QFG8 z{SEg@WCGN`S(uxDuPO&>o}-XfCiC;4*q!aP(WxpYY3QY-z83%-?3zjRUj(h2TU?wH zia-opE??Ufd(8-A+KspFU%}@ePp*sQ1P*zVHU5`n>}x1=HXhAK#6rS}sP7+@#8%{A#$&I0rbI zoEx3ow>{WJ<>f{_74Ag~P;fm@fm8iax=SBy0_1QTf9!6A$mu@$Z{UFs_EG4Y_!5OeK1OU2ez6CRh3TLr_jkATb(+52YhkGTLU|O^QS-H z%T};1MhUi6$iDjY&<)lSKOJ87%1?pa%Mf;#&L`OyAY93pWr{I*b$jvSY}eg*R6M;h z{#0R5?kd_HP}RRB#A=C#50hERjDc1O_%&*xOmgc?n>$^sr50gI^zPrk?;*0ry*9;- z`YE42T8rEs5C*IPKTX-2Ou7%ax?jC=b!lXLh7QZQC-2npO+MfO0zG>P{K~s#yw+%> z5!Q|QhSLV(&2%sz$2unih0nn`cV>|go~0ZNcHwe+d+AOa4(|0EBT*pcH9!r8+Ro(p zitF*KOFZXxgI^OUq%vLMh^(#K{*dlHs1fxCJKsBpUXEKfL${)UIL6X@RT#6} z$_POM`la>>{E9^u+sRc*p(TuADyV6I&$L*hFa%DFj&d*rP!E5faq3FB5m&geP90)k znfn7A@X)r}__oUt+?xXZsSM9may(c;=@W+s#5V=O?60>5i%<5mC`6iuzdyHe2!WT2 zUE^jmQiJkM+9NCHEYf`l&?WSZa zP8_*2IkEg{kVQ|(5^6Dpf-UZrQBzbVLE@;FdNaYPD~Zf%%S0Kd%*R3^I&+Fln~@AJYVC)Q^IJ|azZ zW#l1l9fhJ}vgR~HwVa>b881oO5vV2(svjF4zX>Ex>C>xrQ5G~PUL`oj<_4p?=y>A9 zO6@F3+nLt)s+rwj8C#KH_6rS)j@FBFrpvmFA6O>p-_bIikABN!iP`&n1z?_?NQHfo zR}6=oRcKf%BXVwU$TCMjs`}cTY;$*TCAxvbFWzAUaIwi5K8DwSn^Sk#O?)i;CShC!5xHS<=;Ma^o1uB-}TggK&7X{Fz8)cJ0&xTf@2O#1vP~x0zh+25i`d zgq7fxz?Gn1Ggdy&hdfYBGB?VXAMn$r>JgB?=~~frld@}&);PNgBb_Hd5=Ylkuq3Ib z*7ymE-;@3 zeCu6=KmFeCc_JO+SfOs)TZ~MEyc6lK17LiVnXef57Dsj0KfbMQONa25RU|%Lrdn_h z_rn2!B&E0-n=Q+TQs(|#+KN&!y%PU^WV~In#okR{uuyhv0*-Gh(FZ?I+g^Hq+Dfig zq5UDY6W>WmvOFK?wEVf)e=3Z`$s253TETpsvkfDp=n5Rw=NmiiAyxOJa;)wLt|BVo6t zXPp3Jd|X_^cKU|pQUBCH zJB)_+YG()G&g*VK4@N-&d0c(%Of`p}2eIO^_knJT$AMWw$f2)MmFiG-0qpOiYylX3f4GpIt|)uWQTpv56`yQrEoh_ocl8m z+TP6bq}rqzv$kyaP&T@$;_%mJ7x_if0weB081Y@>#yWXDFb3-+{(rGfVw91d76HwQ zGz}!DwvnH&D6BP+GiQ>!4Ie zbkXrJ#hG81a3E5wu9g|m;y+@noX_UZd z^rd6A=l-kPZW@v>HVDMbsjR(0{*=dA`@jq5b8Duh+@(tDQomKs*#p07x3}`>dgzPZ zM_6-=$g4%$?({tI$?Wk?^F$d9W@pt)&X0Hcs?+|Ws(a*!-6#F{h#@9iMkba!}fZKMxAMId0nyi0=Cl5b@2T%1_gNs)M1dErEPs0nsqFr!i4QoK254$;&)EOiBf)wuBz34);!pkduslLBkq8i&H}N(_hAZn70%v z8>>4TV9DBa{{~R`^{h!>ED&wCd|T=GBPZ+wVO%f&I5uq@eMu?Et( zT(mO-)HWCOuG2?152G7@3&Odl$uCn>aTou_3}D`Xfr&uSpFBFWcza75%@xQv??gGpQ=VDsG7GZ%$@kfUMo{)_tM>F!q&HRX_ATX_Y5Nb!5;8L^ zvdwE55gP*>&a$9IPe=A~n{Fu|bJ!iws-&%R$V#7XwBGCu+Y5-&sSZ zJ)*)_V#Dyykn!{;)*`bSaV6D%uVLsr*1!c_UG`YN(_Nz}Mp=O74425v^vLA2g|K$Q zyGo&DID*h-$V(p}Wn@ATpRKQLl>DktM-$1Y(=g$(g3gaNiRQv3j1UvM(WM^u?^X(n z);zHNywpl^B*NmT8eO=@JWE@N~#iv_wPliYBCKn(@GTWozFrICU}^~m%!FT zD{vpZ%FA<1M^~2^uOc`v+^x{?YR`V0rGgqOwfKw|KvlL3^nhL9MXy(tKL{#(Ecj(o znQ|>7*Ai!ld2qY=85i!270qagW;5Z{=w6roSGMYTx47=&?!k6FBekw`K7$E6a=*9c z!&$u3`femrKRx1yHm1e;j|BG_`KPxkW7xz| z8ZsD*^q&!|y(;hA%7p3boKKhOneW6t7(&WlPx0U&+jCHG@33_H?Nzq<>HcNex<%2Z z!latB!Fg6CaM6&(ViEPyO zts&f;3zo24Od1g*FC~{hGsqqx@@mBuGGh!Ubc~pyObBr-IwM841zx{gfTv2i(d~V2 zj^sCgGq7+beX?7A7`G?1k7+Vr;Lg&7exdCPfi)5H&a$!~%L+fM^WkUeKgibjajA2Q z`GOHNzL(YQN=sYH#e0i;6{|fQbS6~QhUR~8cjxc>t=3g`yz2YATC(=%*rOu~_Kq`t zU@%pZ2XnAqH-2u(XbzfK9X`iOdVN2hF^ayKC)JeHB4t7yK(3qSQa5zx(p*h*<%(Js z%V;rN>;AMm>PDDXCN%k!UtP|cnnIO#1X$wZEP{XUxBC%>&4)hFT0DBq`&R#Nvrc-N}smT~v1xX~giacBZgT@KTYw^QU+tD4r#n$})${~jKs zr6V8^lXOsrS$?&%d99ec@Z271r>zzeEAM5i7mJQ1-vg@Q&&YM97|Mmi6>F+gy#6HBv~HWq;gj0`$0Q5s z>e@PS#r-FbMFyADyKafzxnd;DhW7-dhNJkW@z5^(U5*)bUr-+4vJOx7w?(4$Ym?Dy?M8g zkYIbI*Q0CUu`K4Wp~s;YUap6Bq+U4DA(s;8b?pAWjI&R~2=}|ex5<~O+_FHq&zE{EB^jR;G=G3tr4~`VV zjZ~L8tt|y%mKT>hHLKV6>LF42EKjy}o6h{0bxj7!Ht`n6UEFeI z&(3pOH#WsVRuNVCXX+n(JA(J5d>ku2nA(VXldFcYCNhsV?f-J1v{zy$Wl{Wz`rBA1 z;?SJlROH?+cVqUjqL%DKhUkhE0eS{l9wpJOcd^*U$Yg99a$kueIyi31l#0{t&)~3d z;2Ax#6yI~7{p@!*H;#ey zekHUpqKK0aPIb9|w?Wo%K+Q6;KwWpyJGdlrCit3s@JwzfH|?JNkvB`)AsA$= zW+(@a+?}jl@l?HjT^IIHy2YZ}krF}5E2WYl>$Xd6Dt#063v0@ckVh4rt-me5?$l_A zDt^i*@U%#Du)9SrqqopUyW7slv?JZ;+6`{afRxX3_mJ{1I)*yPd=GCNYEIw>GvNh` zF{}x*`5QyCV8dI-(TUnioyQEqsFw(-GuY`W6lAb75y!zdP)g|d0S94PeeAjsADvy+ zNavTfhP;Kx&TmOitt^2xh!&|BQAA89!l9Q#U&u>%$u83KIr3Z@nZx$IXIJ`|2Yd9= z1N~685Wl0e9;ea0Py@d-cQ-JsaIC}90aOK?aIVKE%_{WCXWX>@9+$fT!kROnkr^6D^21yQrP%2!>H2S2lTJjm~RyiobH? z?=_)uz9sbiBA;lDw2uT$mAWp3S6|eTjVl{i!&dpHyf9bzj|%@fNYbX^_>A|0+=e=iV<_yJ9Kp zmi|6Q@AE>sjHLHoViV7oiX9Dmtb_ytl3bANzY7@GPRyoh#rezr4ZAHNq~FEa`Du3? z*}%R>KD$xDFXeZ(F>zht;7S{vm*V3NEVh>oZO5JQg?~BS*U2Xo3f#|^9SrtGc^7ph z7rIDt_+1OaR{L8XU1=};)!9=68+lwz!LsB6O;=blrNW$Q^@?l{v}*5aXN%{pZe*L| z9;^=|zC@z&4k|`HQ5!SfNM2ui$n-Sp#F@$8qbt6?mY7@j&WU8Eov^!j4DVb}@iaA) z+j|+gMyfW77i;*iBJh$D)<7%J4!GX0oh!$3^lNlDC>t|pk9Yff114J`dQi3_&&1nE z#eqLAAfXey&m#!O6+cuyH>A<2ID3d3YQ9pI%b0jBcrM9S!ZSges*QPJ#5T}ebS5r9 zqK}#wTN>oSZQXv8DxN2EfQr_88LCs5MT%_vlsdOF>*=piL8 zdAs!1($BaYq3*FmD2WM+Tj4gP>xp0AE?G&@`0$V3f1f?2{!81*-$@e7u|g~aj*ruA zU{W#NUr$i2x-Sqwz1={i`;7Dr3|h~NTmc_x@5iHfZSBoJg z*97TGiOzdo3`8go-E?)sY`tLh*4%sRYWiMo&MKKvw|<8dv&>q2$-zgr*l|zbbot!z z2RJQhijd543^MfFL=j(ALYj{z+sTgDc+?gI0WbBHDR4cGV|ah(dLq0eU00Ag^ke4BcW!rlk$*PE}gC*(IK>cSNsy922?{tjVeQpWFsr8vi^? z1BbA9R`$V1MK5o1hnRVlGBO+38-N`7bV0yFM`)aZ6$kpmX%Av!QPyUqr3E!rhu(L- zA*8oa)W^fz{>cV)bW)<#dc;k(gyB{4j>%cJWI#E1IOzp!(s^qW_p*DRc8<#&;{NVT zcWe4|0W7V~S%rkuiL-;d*fxikBQfRXs!X&??%8^Ax?)2hCQaBTgB_er9+pSQ-S8Ug zE~xFN`V%|fYI@Sri#>>C z@BQ#s?EC-Lyj46?oNAN`OP4hJNm=z_+W`JYGB^PN%?^Uw_fNm<+K(`+`(Zxmx+Zb; z$j7Us$I2%H89XEfSsqRq+&CYi_))T)q+0Q-`H!Ptc&`HE z^%1=6d)?L<|AC5kJLd1n7D`?mI?=64fZf7uo*}II2!Tla|JeHSK&bcb{}H#`7Me<2 zYf(zdR@s*pOG%f}QmpoveE%RC)Y#ZV1y$aga0Sw0^!j!3KTvgifTqe}v4;GCP~~fw;#CMl>GLyb3KZ)&XywBg86Rk7#LO}0#Vb8Oi{}T5qOMjUCszy;Fueih348SDX9|6ioj)5yq7Bgebn}8nW}KoNDENOP^j;V z?#=D;g*UuI5uE0u3BBgOQdyZA*9zfOS-Am!3m?)!eWd1jF!*<^0xCzJ;TY&XA%qGPru+R#`~WpGoXWgwx9x~(+}#HIbRrqc?-2*yviwK+PWu| z^18XYdPF1mo{zKM%2=9#@X+$CRoHUGg!ZwI!;WXhmLu#dAn3A$&**>Qj-~SeeIVpd z<-RjDt*$z>bQT_Y1L?lGb_Ju`8qEJCY<}53-9#>6)zJu~1H9Vuu@!j9;h=Zc*z7Dp z?|Y>??Pw&@(>x`&) zTmXn+vZ{IE?Q*+m_=80-nZcd2=W{rbRoV12tN72aZ~|RmULg{~m9S-ql`Oohv^@Kz zw?7bKj*3F*;F-ym+?&YHFFsRL<(SZ8DRm%1+2Hfe#@Gv8x2)H`|7QpaOzF}Uy~CVH zkL!&=s?i8fB#bfTYV09IHK$hZ3S;n z3aBIq)&GV3y?W~ZZyO|tKKdW96MY}_^gi*c#nhd@|Mvce^}82teD&MxY%>n3=o5-` z!&}9SU=*qtT96}!N)~2U{-BYB)J^f+@GfILes8b0Am?jX?T%vYDO{>ZjwJ3N;DEm9V(p!03DR3~O=IVli%)8UPx6OPn_}0Tat47wc3nX6umwJ&%5j@9FY->jbYwkGJ0jW$9-|YKg zUKi==lW0e+qT@ZmCoGc1Wwaj|i?7}G_SA+LO6luYj3~Z#Pp=rwD!Xo!`)fZcaN&{R zbX1DaRkQGY?ksqXgV`z3)(hn?eD0Bb$E>@ganPy!1x*4 zva!*VaM1CAtTE=L?sgD1y`}M`XMzqdO4N=+GL=|~|?Y$7KF2=j~OQH0+@g8v_ zpPoNTV&?~rRQi4HD!bi(rl>;NOG`Ndn13>UOZ#6c?29iB$2fW2qUtVEf!R~)NXk95 z{P9?lz$$;eq{49NS-;aiT8T4@UELKvy!Fm{q{C7EUDigc+NFM7Zo-87({pSs&Z%6{ z!E!1uDx|+T-gJ|hs4mB9;p4RHPj{;1U$QF;UYNo@&dYZ+qf8YB$8R1Z%9^Pl?`vVK zuV3&Dy<@-iaTe4t?cAgKHUYS!QWNzqxl(dj;9Uq|E zIqRKaZdMmt61?o{ewpO*Sa@bpGD7y!Ao@C^3+cYMug^5Nr$w6N zOPziiT5R^BH>jGc!$)Y^Je=s@Ywe5NA7vrm1YBgLUzoUd=VrbUvhRJm)r!PeEvH55 z{ND#FQDNe>0~d0z!(%-9=knRS3VVp(>ryvkG?0(%bl@?_VV+nn^txQ1XK22oGs;`J zP=_0wpHK#H%W~ zu_4mYNLZ(#U_BEFHn9svK8}W;y5*M-ICW(jj3o2vAB#>k7YFdK*kFN(#w z?EcU_J&vmmdvJZ_pz$qdzy2$EZczTP8vgd`%Hfd{J*SR51`}`F%%Q4tvVY_pR?VKYyMf(?J$66Mz4qA4U z6Sp`z(6OEBl~E+#=trKd9np4wwPf8aVtY)n&L+l=kcLw&$&PbRr?#Q3%AU?TC;G2x z+C#vuCnN>ut(hTkdai(Sv8b%|N*kK1a8Wwlt)<9Gd^Ok+)H<-#IV~SF zpRM&F8Q+s8Vme}~t?jc}_#Iojx?T-0SVs6%%y@MLFC_oYMbT#D89;`?me~bB8ve03 zBwR{%gM>z<2|7eCh_g=J#re2fbO`E=8Jn9^OK#n|f_)9}s=cTQQVxoYsUVI^vopvP zQ!$>AzurSn;TzSj%d%D%$J{~+Hy=}pBFR7_hF{^oC}vgyn{!l@+V9qRcJ_iRrtZnl zdtEWTtM$Z6i$}rO>gjs#);s}Vo))-5hv0@9*d~4tfdWjDgAnzRnKhPoePNc7K&Y*U zKAuM;%6Hg1#`&6UXWWyq8`D5*D6qT!U3h_}D=8mic#GfNt9Lr;(*m`Sqw9e|Y?R|@k$?-O zFI{0LyXcX@^pQxvUToxj!L8XNkPio?=R{qDe+x%@tQq9 zv&J_j?)$H^jvNrUNJu>M)VzGEXU)9Y(@0*s|6e`Ny#LYm$ly)?8Rc`xMR zs)%+!{fyqBd8^x`u-Jy^hNOR$PS3OFT?NlU?ym-gb z_fLLrW?fAee2@_IA$r%5l%Pr3Y~_U3kzi$e@y<)mArnvmeurepwWc2zjmNcof0SQp zcw3&aW?Ycfv3Nfyt+xXG&!}4-l8DPNvnfMA0dgKhLCKbWsAuJw-CCmlOuC)tL%rhd zu6D)E9Q7`Z!q+>ah=+>~ox#~n$n5AJRMFVy6{oX&RDsaJ?(bgQk;0mtVLb;*WwRLa z3|`P?DxB22nWdP_Q_kG!yn}NsTfavAm=HwqjS1Y)ygT0FNe}uFB;EF*WhGk2c~JqA z>GyFakT1#9fMN{vpUOkVp^Ts`xxMwc+gdlv4 z7AVNEQ@&9#D;L#qINJx&1tTQssb#AEbwvS^N5QY}D?X-^Wg0tTE?Fr?rJ6@CAp-65 zPu*9IAxR{K?M@|+u#U3Bx{4#|=(kl9s>5&1{vf=6?!{OvixY!lddUXo*`T*WkA#(3 zzx2t&ELgROt;)bcXQT- zgtb<5%YnsAEZ=9*B#mc^RGiW9Iy8Ak2KK*c>E%(p?>c9RylRvaWMy>-j&_LdN#NEa z&q}oY`jxuVa@O4+eON&HHTK&gH}Yg* zgb_d}_Hq1w=_cMLNULhGFuNDiQsw$6^RmL>TM33X{O|qv`}op_9ZLz*bAp+1hSS=$ zG{+inCiGTEyqykEhJWXVMlrGr%w2;S9 z`abmRiwgknVi|+>RJ^4lnLU^;sFf6q7HZ|DS!H*?GOu|G%b_cpO9$I|mbklGU!^=f zF*7F{Wz^--A$Tfj*0jPI165pg&PNG35Hl#NRD~51=7(1lcL6c zz3V)j{aB#hyOG?*SAUS2$E7jE#ieKIlb9z^uasU-E;hHOCCJuL1rC1qXM9^uc6M-5 zFz1ia`-Jyd8&cdi(Lm5kJD#i(UDcNT__=_BB z`y$R}Jom1}V7?)b&u_Jhd~eh`5+*r)un(Y z)8eU2OT~;PvKka-(Yf2~MotYp(=4iHaXicCr>qI2gwBaP?;Z#9s9mQBY8G#se9n$q z=bge-us@Q$;n{q?YN`ws#+8`aoyay zSD=2R9ufnJc{?0N-#ni&8eKo;>-5bNo@C==c-Qm)YRU-+<(mcX5Xwy45=|;$y{kSi zekR)^P;xL0Uq@Hu;_0u=+{1&P-RfCK_f|e~vSw2*;34Cvq4gCj))~4W$u^b!1(f^KsIy8~8aBI#Bw;y9H@Ufc zHsz=HEupA@_igXRXC|F_4hzhT)SrkLa*1zs7|mRz%Kf>nNgo;L>+2m^E$`22QqhwF zW@h~g+Bwts%DoN{YA+w4s%=Goi z=euLy9+gpGPqBGt?mlb#`Qheg&8q^ineBD|Zf5ODGc=E>g$hcK?WpOmBsVp_yX(O7 zC-IPn$r!!qeNr?1oFNlwdU=jWT`e>8uv>ejUzTadD?SgJir`%@t^qCNr>A_+kgLAa zApyJ=25VQW(js|e+yTbIg>aF%v^U)o|B;x1{QNz14~=MouPIxlW?sf3?A97*QH8K& zZJ6SoiPnEvd*mOsLx^yS^PU(1I5Zy*c#@#0d97^-dvys=vF7=Gu!Yk-GV_V(z1reOul1lzCW zhF68CK12YVg=Z$bpcc!gE6}$`9BC~8ySB~@p`uXl zo+Vw$(B^|or)EoAnflV zqq^hvw__gZ6}Ng1T{r4&S%d1R;N5p7kp&4Bz#h&uDfw2cbq}usRY=R%;hAw}8_&GC zM%W#dQJlGM^yI>N2&HcVdRK%)(FwBTO4Vef;K+$s*|Q_I{w=(d7NgTFN*i==p#pm} zcXH=Z{M6(1u!ihY=*Zz@K~He56d@!lbsV81mQ8Z>!iz`Z>(u4HtZZ$(*L9;o;ZMxu<0A5iLq{or0Zd0t_t(z)C4ni__l z=|_?#AsNQX&hC6O`~lT?73HxCYXF5(KV#NQ%&1U1IprO&mubrE zMRo}f3!J_8OFZvM_TU&TG)B8~tUs6b475`CVD?Y*mFHm)J(9S)LQ`3FQ_d7<$`A{q8hw6PD&(L z7{(F3jNyU9F9gL|tGe_a;X2tvS8cd=FAL^~x|0x;0hZQ!Vy`^o46}6^6y- zm8W%%mX(xbwZN+eG1{(GnPg=TTT=Sf5O3S{4?zg~K3`qJt%_pj`-2B)%_`zpS^{xT zhIY~sXsdT0>NKa-o4WNyXiQymb;>S3A)f^nR_jrA zw$>H-oZMV~S%Yocwk=-QOfS!dx;3)-UJ$oi{=G<595n88*dD*_C=-e|g*5{7TXU@p z(XZvW$qIC98W?VSwS*{+FA0ojf*a_6NU2H-$}j*c&<J(nQ7C9pHG2)8jq;0^gZBBs7j(81=ESk*Oxp`z--zQ#F9~ZQQb7v;GSZ5T+ zUwOnD3*j(GoPsA#>}Q<$!OQykdGhQjGKvL^n5GIS7=gy{KB<;hxw0#lR;Mr3;$Zc> zs@02}dX8Y1N6guK4DLOF;>rUyY^d821Iz8tZZAMJWNH5th-l=!U%;?TKQa{MJfadW827%g(11SO za>@Vh`Rb4d7?ybD<>{6I03SX1g7DH3@@TGT9+q0);!Da4FJ0m*Dk{b!1BMafGsx(- zhH?Y<<(&I^u;|))un6Vz`79ai)H`jt58o^YgHMToEwKA`LZF~2*>qflxxS1Z3_=8q)sWj$a}W3Ffx0(dH#^^IR9bMBt6_()!z zF<;fEk9*-nS3s~}L=D{>eiZIpxsZNssN66v>pV+hvLfc&4!J+!$-HJPb)@Ah<%dRQ zut%LXdq9OQY!Hqa2zEXZp}bn?<8C_S4K9PlP^L zGsDd)tK~d?@*cyFAIPCjZG*DTkxKS!FeB+NvFL<_nn*vZA23XL2tu3|HyB{%)C)uz z&V88bj=gRqhER-`(cIcDo7l-gls)DKwGV(-S&(i!xC^ly3~^O%?z z|GeDaM;e1!gX<@qc8f*3eA_ci5RHl!v_Yz*U(mcR$k6%k9NzDSlEq%6{z+Q(7Z!~= z-Q7*eNWl)nr_Jd@W8mQ+JV^;ild7YP5dndl_4SoT6&3Laf9eQ9+*8N?F3Vy?A2(?N;3!qc*g)NC?7bym?OU+-%Ya>lpx3cM~Pp?-T5A|+6v$W*aKkKQ00cj zihuVyeuTt?_zcU5>}+*zDV!J847!yVLAPB(6%%SudpY@NuQ|-a&Uc9~wrhpDvND-J zCX^w_Av?qfZa)jo&K5MvUw4)aksvBW1W8*ZTgKyfZ7t+MHc-wyV$s<@FUDvs{dN5l z{Z(G&kqwpc3=t2B=z(SZ^5E6M1m`e-aMEHlh=D$LVuO?fiH)M@XVLH+w0qgV+&CuA z>-z(VcZb+x=cb?%e}ELN(wpas<-&ZTBiOf+K7}86bV+&WFMH=*r$u1PERx%(p9d;h zpCvH!k(a?BR=s3|ud7guXfP@JW8^x)9k{T!zw5CkxfSr`C6#5p?oy9e6jvysmUAsu zX+#sfdtE7~Q{G(S zJLg24bDpd`{DcFknoi$PsPA?3^-a*l-SM+;Gn7T}Q^}zD;>8YqLVsU{g>#8I0{(BjP+69$-cv zl)(*cezT4V0^>2Od#SMqWT>PP2P$+b0QgqD-#9J%!CU-+@ot@H^;{3kSNSzm7Xd<( zzkg>Sh(*$%GYB7@I(4023Mo<#qgF2E7Q@oGK!2z9u^LYm-&rlN(QzVRZJCL<+9prL zhw(QjQ^7u4Jl)vy2jI4U$9O+PGK0Fn>#|T*vp8_@1YQDee@J&hiv4c%5gRiIW8hM^ zmc8MC_zV%}PivA9=(flPjRcr!4ai8?ZD>nbeA3XxjXYC}6;+)B930905~R$FvRS!) zn8f}murg47CtSER%7b4;bxH(GoR<4VBaN*{3gW_I`*-#B}Sah9d{R zsNx9eox6S&GB@a*O4wYcec;&z^q;?WGhKgq*rfF3rk5|3VHA^p(;{Ieu!L(Oh4N6H zP+*LcjqgniZKdIef!<7+z) zv>!yr8mfr8&(x7!Ab?Y)vFkTWQl&snw7yUtNto2b*eRvGx4s9b@9e#O6{=*vdqp*5 zz{1yUl!otknA-3w_`;YbcDma*l^X6@W_rufF=lmK5OkcL@*xxGqzes+3S2O+t*v&n zC~-nDv{1>k=?H+HEt8Pr924 zHyCnK`c;uZL1X=oqGS+SWX%eY&s@qC4>-tR~ z2Mk%V+PHpBO?|8Kduy-9-#_twc}e4zzl)15&zssf=;|Kf4{O*vvL*sv%GEJtck8$? z;>;+4f~e2}brupjwj-2>Sfph_*Yut35YMkGE-Mq|j#MARJaV_*2lu6= z5gz)cgs|^xQz!ss0+$58;MGvR3qIt;M-Lacaew?g6q6xz!hDQg(ap6#kUicPx5Te{ z&mA4WHzInaM>05=kSGQI%ptwc!i{u{N%goR-C7b=WntF>2m zp+i%oK%TuV=lZxp{WoWYr_2)F7(+cazbu1S`XJi+9X~e@?hb7*2a0kn_Y_*h6;QOS zpPhL9Nzv&5+97&;ztomE?H8^=CF+0utUHDDFRH5xVq%7NJtuGKt=I;wGrK5dZ9>Tp zOmU8)5>d`r9aR2QjZ>|@=Mme-s<-wim?tMDK4!YCf=;Y&LSq-mu~KJJHlqVI-f;9A zbl>ZPQ5evf?I?8e4~G^vv|Pi z>D;%@W9|GsZeU1<89UrZ%JGcKXmA@5N%KDo34KPY6{duQ~%k z7x?%n6;#zeE2Y`a&SRd(&97baRffa-?8xkK+==aLn~8cPN-4MBQ)#9tvcfO6SpNRU zf`a_qB|-QYWiy!?;eK`IZZ=nCliBWsRC!c=U;J#HPm0wFL!c! zTF;jNjgc|Q4kLLo;UUBV*@4w4)T*uOp1q_WN`mrRETnQ@!Jr1B>DjS;O}2SGAYqu~ z8E_S}Dj#2-$tp;su?wg^T7A2oDTGqi(6q~--M)&Eube4*?6z{_9x6zxBdp<$IA__; zqOLKDN_dEJY$lyj8`X_I6pAN`c`}cw54vm@l8WZht6{2|N5>r3bSMHSGUes!>Dm4a z2&8-5CyuNhKMM~I;xA@Y+|ITnl#uj&mz~dbSu`dU${6RF z3Oxq5&yhB7#o|_{E2AfG78sM`x_f#!K(mqAo}6 zT!$)L7B1YmT+<9ndtgd=QEd=3CRzJA0!daAzk5v6>E++y4FKE~j6_{^tMRc0L*#kU z<@W6fKd=fCNgIy{btUNTKB-WDg`B3YX;;t6go?loYm-mYKg)&%mhc>g%#uIq#D z`kU&*w2jcM;n0KJARQAd$D2R%QiG{(um(GHk_VyOEGgYVs&AV{0IY%>mpo#`5{ znV>s_0rU%Rtt00k3`2Y3#+k^ zdV0ib$pRTNn*|JPlwqU@;SwZg)xvNz949JnQ`3!ibVXNh@2g+{T5~zU9;GycqzOM_ ztW;&YI;A*Iu_*4c{a@S=ztWFv5c(E)e)m_}GZ#$xA*)!oUYXvuPl^L?pgyAW)a&1X zq8P^2>;cbhPw0q03(4it)6#;ofL?&_Y;engcej|@&twgAs*KfMZs4H{Jj5nNkO3a6SvAC#nEZZ(1En~Hh?keF4ZLK%gD%pj-B4N7`aSY z?$vna?&>Niwz{c}uijUPR*H+p3a&pz#PdibPV}K1O6y4op45r;@-pO!RZ&vn0QEpN z?)&xY6LMBrHa4C0lU$KJ`rQr0ZJGO^QE}F3@=yR!4qFk z)KIma^xD<`{hA1k5GxcPkA79{~`xqaF ze(2`p$?qh3sa|HeIf4yUHJ?>?cHlz#MH#W^p0~C)ZY(CdLAM)#ETMRn(;oGcma2nz zJf5tb0W>_BEqzcfaK$S3o-U-ctC>_57hf&g95NE%N62>qJ2H8I@tCh~JLQs(H0Qj0 z9JPH1s>&N3Q=Mm3G#U~&H#=KH7J6xJgN3<3Fmt7&&Str0JPoi0+#HSwmvjE!@DZZ_+B{24o2O=$9kMMNAiGJ+7RG8f%W*iB+a~mxtT*fy1UybO?+nPa6Y9ei|j(K`}&kvX8_#*0KapSgDu7v!UE`yZVsLPrc z)`Utgb!uOxO()0{TC^kdFa}y(y_~KMF!Xr1(9qCOrE*A+7D9jlDGd{^X(a}Lh^=8% z4y7$&Qvqmhk1nuqr(r?R!i)t$KX!BS;O~sdAYJoiV7^7G4q`Uz@jK>s$ssY2bP%SV zs_Sd!{PKX<>LTu)lMTP5H^t2X26yPH-*66XtiJHDglh*%-Fb(^r;B&2diJK=88GQ^ zgV4jp4P0rekVGn+>h`1DTswd|JC3R4PgJl*8|SoFxs;rWfeV}BtZpx=|FXmyq8K)IOJ&kn(~-r{byIMVS$Y@$-mMP1il7Qzs)6}FH@rap%b zN3ejkFsp{>CMd>$7xUa3OU^7uNhO>un{xLfDSw<=1M^R_bul{?Klb^Mkj{IR6jhVn z9;PcM%2+oWXB$KtY_^M3PnFgjIdrC=^b>t>u)a+G>PwK~N+yZn9f@hx?NBH?H#zwg7_zD@yBWrf>$6;dD0T<_)$Ca&nHe(ea-hzb$RRt=L-MDNw0 zFFh$%BwUvY;Perq5o{?iit7cvB6HjK;Tmc<@GU{BKMv=nx%lUnNfU`gPDrF{rhvy$ zEyU0hlWn8CZH{8rqJ@aR%*EH1)NuFNjCE6UbHE%WOfe}iqj^2#%KtFhM`7-hDs2947--et@%{7X z^NuF`GM+Lh6G({H%E7u|(u zPTR5m{-(VA{A^&biKm%(wNjupBWK6oRdWNvDwCC=JQb~`0YYM4XZN8{-U1sss)XTB z=RE%Q52%lMpSA~?+}un8ODjAFfI5^VL{?ojQLX@VhIrGRoky69=X=6fwQbm1`e8;_ zZNa{YROtKa%D1=Ua|nLK-I>*<396u-4>308&j)V3RK-NYB~g?dMFNiE^46p;SrqAzNWl*Lqcgd`{eUBSj1E5OJ1*NJ3(*mJc(^cP0} z;5g@8cGN@$&!*af*@BbT{CdN{iwcb0xZ|0hiPj2FZv5xDHa}$b0bDa`a(E`ky!_od zGHi6S?ryy{wLv7l3la;~4ch_K37%L4Lk9uIOq)2EUwc>EWIUjL%w-(lAY$7#G+^95 zkfwCZyXFhNB56B>SWpul*<~>reyn~KPA2^OZ}(`oR6PHuI5Bo@e-WY~F*zCb7Y=~e zm0hTGpQgRw2RIZ$Ur-A2_SB8H{|Ij{`lLr$ykOld_c^G3|AHsHlQ0%!iAqq~&K=wJ z$D`AFUc3RIR$+n*=ng>Ib7T)Sph!+&bA23}JORv@iI*XV47XtpSQ_L6){L<&Vsa3b zJ+UBoX3WFa*FndEWyjiWQ*2at z{J=8|`o<4{t~|vo@o<295tuipB7Cu8Zg_4e;P>8P`JWu!7Tn+2Q6kK#14)BMQIk z`#jLek`eQI$J+a9{irVUjsAxP4lgN@gPq)syAkejHT7$zl6Y=7jy`n(lj{I6q?U6G zzHawX3O#53+U|Uu}!ai z0ljjQ1X_?QdZZIzCnjkW;RIo{mN(*#r-w3p1Yr}x!du##E=pSJ@1v@S7Ml(;y?JNy zD^D!${k9wH(7%T47cv}0qDD3r0hT9r6sy-#Uw`5aJU`#f(eW8vL`ZH*qspOU>rd*K z0FFJeq5t=M`n|iPgu&lXYeG(tW%OX@-N`*J7%$Go)1;}8fd16nV-*jfz#1Vma0%c# zfYS*8V#*8PT-8e$H*(DRCx;8B=cHtAfXmoOGN7VIT8wpSvCeSoHb@S4{+5Iwt!DJ| zGkL6B_tGUQOBJrM?E#XXr%VX3bZooY;JW)f&!-HQ9;|ct`Wd!{CQvTN6oH$8F$jyvyIn9Qlu|er zRR{iEI55vpo;ZuKQ%Gw)0T4hy^kb!c`M#Q^I2Y+Uzx#j~2d1Xp!teqvS+U@}IH9tK zn8s*uscT^tVtz%1()&+}y<1Qc*&x&n7VB^W&=fS*J%h)^1r-kRC) zuapf`Gb%>0GJb8DCM+LqAqwh$#f0BQ+%E=%pgN=x$s&4udBH3s;SiuQuG$fElhgs) znj}-_=jRu0oKiLfNI$;ufcvh59Drrb7h=~L)(Mwv-4fIHmaZP8DOPvzHt@!kr(LrOcNB87mz%#jNHyrhdDG%{>3nxG94YgilH5okzn1#{3~9*Jn)LqWGXQ=Eq>Zbm?&w4=DVvbMkxf*`ds z#^psh9pEt>VwmPQD^T7+v-XqLS9{NijB$aG^@pE(J`9+&s%j5da&&+DAI0ddIwt~r z4Y{*DvQcO=uCh{$4dxVr7Z1=LytIOcB|L9X6F)i%=M!hY!Ag~0uh@*LlHCxk$9Or7 z53S<+RJ25LxRGbPQvdUXYn(Q^KMWtQ`WvwxJ-TO2C0z+Jcy&-}OWzfD=goUu792(j z5Ryb9o3S#d?vZl{)h;Qqgv*+^wKop?o*N6DDmtL%K4HK$e;2gcdj-Iba*{i;v&Vc1 zVOl!JJfWI+?Y15r7UDS_1Kb=P8L~3DUT|ysja!RQc*|nU^})*5tF2r4APqe>J@5m; zI2KT5>NEw7>lWm{^V|hWeg_ya$TNaDu_o7;=D*Dtn>-pYaghV;tjZ9Q>CRugMKP4U z3L3~JZodTX>S4Bhs;~E)zNK1-{@#v`J$`>(?$x@H4b^0F+8w53wZJ`h#`d{j8bv%m+I+*V!eOmJ z_%GzJmWYl5d%(IlEa=u@iV7+)D}x<{cFOj7YCV8o|3C%iFW(3tq+UO0Z1|1{=?p_V`Hz7@Q@2>$@R8QN!-cFJr9^y2!P>Ft_2SMglS0Ij4~X zx^l{22!x|zfO}U*^rJ_Qph-^Ux*f6TuII5s|Y# zyE~p1pVvfO<9~x&a^;Fy8f4zTu1s-r(H=&_ZnAyl1q9DsZB#iKQ3Et2m`F{!+5 z^u^F$psNtJ3jxjzBSm1&P6N^|UTHN&LRCnP4FV_ngcxul&=^jq=k&T?hOlaIbW#i> z8?0?D(M%HtXo9EL$33ytcxnv77R-Z1Z~=M_npNRMq;M4#IgyQ~^-P&hlah|*sq}#3 z0H!rh#3eW332cGx#ukLHMY~@4Gbpt_3c`Mgy|IJ7p*%hFcG(5ZwmUtr3r`-~b{)mJGKKmDeCgbmuPwPV=A3#t5hB z%&B|&Bz+HtO+%Hd0({-=Td$<@#A@(fDT8?Xc=xT|JLWUM)C%uFue9}KK2Ise zoE??sk-5Dyp7{&)ou{hJ3Z1P52Qr_J+X`2HyFZcr7WIw8o~bNmQ3UiIR}O zb9ah~w6*2%z<1WG0O{;u-TVJ8=3NX&xT5HJ=c^AF>gv>C3i;1cb_sHdk=3#X5~u=v zaUfT~#i@H5Vr#vyz3Zg*_M?>Y7HES?> ze`!->S=RUB1sDUzV9Saen)N@=w=!_sT64A^L-3a_U2!!On+`wXsl9RJ@z%ZqzNnqf(7H|Hw(&pps`>WhT6Jl%R zkDi&5&wqzWw9VO!I%TMtwb*J*dH3u3%z1_1o;Aw(A2;l%A~-2Pv(G&K_7LG|OmM7K zVrf+xL*pj=3P&|$%`$qNIKe$7=QetZ1%Du#S13fOC@MZKBfz6^c86%7%P2{WLRwMc z_cgBaQ%%cSqPEb4C;0PM!bU#z_L^Z*A7Vi!Ubg}BA;K_IeNBKDGt|82Sp%7F&Va7E#**Erv!KY@^Evr)(I3x-*KqP0e|lAgIp`VZ)Bu?TWNgY zZ9sf|DQ-Zn@CpcoH!=xNydyctY$^q-2t0W*aQJ}`VOSS63obw%{)i9iVgn&uGoy1k zx!5@htMnh{Rff$MfJJg~$*0Om8hYFX-Ru{!9*OHMg4lo`6}vRsbc#7*(%6xqlgo)n zWc_aj`1dYKbkn=UlSImzx-69T-Wg8Ku$qLy^&(e`J*xNi(7t~D{5kx?KgGPt&P`v$ zrJPT27f`>J&N+hKB9?(r3AzPJn!TzmU;bu12Jxz^5bQJS0MOL4q04lBCX#sU6gI5Y zsQ~b9_cs$^T{%SHPMq{i7lg21H+}g~&kbxKrGK>%0lz86rM;W%q0Yu21jBoTng1?!W!+q9pv`B& zYfZiNrAMNcJW-JSaG|>Ttjjue&bf{l5NtrFo7k{PY_^JuDpnk%6la}F0yH=!kEVp- znNaD$jOCwaUE>cE-|(WIsr$v_3~S<0sjqpCRvZ-bs@^`oIOpiR7FbQwtE{)yzPuJ865)v zRkeo^8$k&S+<#O4aGjD2*wwEe^J^E^Apj{KTi4j~vYx%M)vUN^q4mQlb%ytb4ZkIP zed>qJ^M5xdN*2|ZLzv?G9OBwZiBZ9etNOXI<^sYL-Y$pnX^frty2lf6dD#k=)DU2X zOCqYFCoojp_x>qpfb^``50Y#wwhF!WS__FF^FmnauxW`6qUSs+os=W#FG$} z@V7f6JFXkYmOTdH|B<-fd+N1@t+!EH1TWo*Pcu{Os5@x!{f_B03gmUKPkKshZ!gwgO_5av~D+jdIR5ONsxL0L8b6U2(C#2 z**wu4>Y<|=0buC*r^E36vTz>BouY#sad{&(<)gx9^X6X<6c=OW5=jt_^+${JIhAUNl`^b0HRfktKyyxTeviO z5>RR;W-^DoI_xAnkRV2c^u~jR5RbOnDJ51LKErMsN-M|S-6q4;!WeikNMBRlqFwbf zYc0HUMU&i}kHf7F(KP4^OcC$mRIIhJc1fP=^tuu9{<0glJ?Ki%NDB5$i3O#DcvBYK zwN6Rvs7yk?)MWuoGDN#u<`Uz0)GkQynT0j3pJA(UAa@Q^qVpmendF%xvNfd3lEy>Br4GEs^B(SrUQ5y=`RgQ8vO?t7s_1qfU zCUH^l>M#&M^ZKe6atualZ;DLUkw0GACrIn%qC=qVCJ-*iCB;h~{vk02OxuFQ;CEmq zD=F|-NSa*ACB{LDxR*$~PO*Ho25S&bRx8|IPweuhc{3SR?gL`f@emQQEj}H_5YD92 z=|K1j(&B89pgE6Gjo( z)MOm26nmiE+qHx_$&~h{G)ZSjm_YL7s_HMu*`}_;5>&+F$KL>_RZLC$Q?541i2}(z z7)`BYMVATIa$aGoJFlt%Z+d@Ww5Nl`n)QmX)l1fTXcubVj0{>MeU*h!*$(cBY}O`g z><~Zt^h!irfYq^YO4%~IHpSVv2tB(RP`e{w7(6FVpy9t7!DBV&4)w)dcPv$ zv`E-r)|_lw!4vYYVnhmuOgNq}i#H0qaJ9HR_>Q{5TUK^5;UY6FO49ve;E?1wK*Trd zqTTSTR01y6MLWX7gcnrs<{hX$j=SpQfE$_XD;%f`IY{l8 zt7E)v$1ZS-98}{#Nqo&#cw6ffR~|WmLh7l!_9)BAiI66-g0e^ih0iUEF?yF?Dl62xCziRomFF%cF?d&eb5m1{LmiAMfN9fOHf#|& ztaaAdh?0CKv(aAEVM3%FJNV>`_#H~!Y>jjnr+qV8KM#-6xns8I%2nM~4gAZ^o+W9( zwNG>!9NQpHh=v!?F8{a65VmrPz(B6qdzh6@_0_H+OHzzdnNak^JpyMSJr23*PHPUO z)81UgELOT5B`5k{*&BixC=)+Z1Dz!=q)&4`{D2V5f#{jl72>Ms3MF8Lvd|1N)_pzp zgQ^b4^O#9yvniyasumVfCAJuyvV#$u>lLQn|I7locsj;7w{ydt+f6E zt>pqz*vkq9q2M8zB(nY_Nr}h+|8v8Jfg{Zm6fmb&8RC!lqrn_0(Zy@ zI`Q1AOF863@c`L>)l&H5%XIONv9-~b7{4oC`d8UP8i>N4?qPhg>tAP)I8S6+wfT}s zZ{Gg9{7*s*8(x>N<}#=bB8Xu9>eFDDc8k|P6P@MR*ZGTkzmv{TD2|QakJ9%(ah};= zwb%bYV2Tp-`&L{Upu>;@w_0L|8G1>h7ZFBc)&K0v7&N?#5_|G(l7!8OaGWF9unG6K}Ah|BtTs4y5}3{=i=% zyh}r7Wkf~UN+Gi{8i=xYgd&@`cBRaygeyV|5kgkhjm&FQl5}k@BI90r#P7V6Tc6+e z_w#Svdta~T^Nhzi=W)(40SO&@m^}mGc(Y~K04#h2^=Nd3CR1X?g?WU1_SknI7C_EH z8;S$$VhHw4i&5#5Cx7U)0Xe@zf@PEphJr?1k->;oWY6ra_v4 zyaBv8O=##qujR;9TwU;96D76XT13bwkbW24SkWA&t6`TcTc33!x(m+gBjdCs%@c9e zO+Lgu!u=#alq&tF4wn)~vGI1&!`8!3-<5q)>t^{R`VZ*M~a zu2FJ~eDBc&G*=Ht2{S;-0ijzTOm7I#u|L@HlsfQyjv)9E_Eb#fdLaes!Gewt-~LY2 zg*4vW(SH3n9=_HLt;kJ(A(P3|fI(U*3E1#5fRy{)f0t2yatMQA3C{@j_EJthR71ti z*~NbCJ_HjD!N;g-tT?}mu2;FY9a{z)D-3i-I1Kd%(o@$gR=tEp{?sz0`Qswt;VEDQ z(msnuq_GHM+Z!LbmtW9(l1c}V+>aSuOM`I27Ha=4rRSTzw>^nWX7KiL@= z+J64LF6~%tGqN7mG@d1O$TYLWQX^3s8$MkvJi(P&7ed=V%r|yPQuUne3ot$GCQwd( zX(A2|55V`gj0vgL?m8bJ!gPvDeXS6W4Q;%6*)Jclgt|<`>F(hrj~@?=!YREj18zgGB&_vr=(-7o z6v%1;*H{@Mu{i3}Y}02OwIJ114fF|=FcZ0`3e`C^0g3~4_S=dlP(o<)1nq&V;!Wnf zqcjVnm^4X|Y*#-&)4Ne!Ce2iQCy${#L@rmm&hP=?%r(UXB%wH=+fAq+<<)#I<{x^3 z0?w#Ylp}hP;F^ar-cJ++{T8Jcd!lQb3y|A_|_f9N_ zm;?@3gX2aM?zwdw3)dLKYfBkjwYr)_`lsi=fB%k()4<FW9JZa zA*FyzMEp-=KsrfPP5LSnyq8cC1~uOejc~L#0CHc<5TXO?)N*@%iI`aM#5P~Fb^^Er zB?fW1hR3h{&kwu?d0qC)ckR?O4RuU0-GW}mPMK#qi@RiS3#0e&?GT8!$N=r(D4&xB|%&XcBMX z_$Zpht2ue>Mb0H@+(MW+1S_whz;_6W0cer%MG*&91sI#dP+Vm6{@N7hZV`0(fwb62 zC)4!l4=8k*D-FhHw!nn+zshXdES;XwCNFyI;<NZFt|v(vIgKey%1H3 zd-+d@Rl*x#Yj6W+=zt1$zve#RN!jM3Jtg0ZI+qv__P-`x;I|1sTuDZ`{wfB6A}GB$ zDpgX%%-HxRILhN8DlNyRez@( z!=FKOgwI({^W0;=YBS}K5b-bx$ZmJk8}l2Jl6TzJRr33e9oc{pD=j&6^?|fn(n*I^ zCf6E}Pgh`Ii=Cq+z`m^K2Z5h75dR{!(giVRRxY~O=E$#x@Ue_f*JxN zl>WM6C^=j}uzw(}pA_wSrb}G_Qm+lO2J^=M7MfCY@_rY){ZWGIwjEF~1NkUl&J%q} zt=19r%{s62DWq<@Gf0rS>veBq_kmRp zZ*0u5Ff0qCS};NAjA~$|3mpkMY?xH-qXifcYqMU8`=`?MWl315XN2QIbZo!Tvvt9I zxIo5a)6-I6HGtYsB4Y{JvhMQLh{e4BQCqHx(o%_!VkgJ)u%i8UnL*}n$fLZ52!QPJ z@sxM41&$Nf)%*ombj|Gb>{Ce*e;*$SCuCCdUZZO>7)a$DlVTClZwF;l=M_;2-tEkT-figU|Rg zcF%;0(V0KaVq*mE$I&4`F}sD}8swWdD%<~u!xH|~I?upoc`h>?Ki0iQDn8avhEXnL zIH|uCr0jxgGeO%u_4z7(%~pg4NZBsEdMAYU4X*E6xW9T50HmM z?s)AV9qcYeb9xr|5P<3Duee@Ej*s}cVyt|`vJL?B396F7L*yk zr(A#DTAswUQI?yifySJc4bm0zWkFadk`tdKAPUWZ=Rtmb?u@cED(^#9UemMCh2Y^U zl02m8ddGmzMJbnw7bg8JhZh@xgH{=k;~L9E)5S%d_xvHkqa0G{zG04@XU4)yfyBcv zW57+w8~Hew#*R=2%#YR(QMlgNsMg~O1}-!||CqBhF4*@tkW5L%y}wDO!jSv#VUDZa zUg!RxSejej%%hBD(nfNX3b}iB17J*r_EeIg6=V-s*4{i}VPW5S8xZoUT*$Vi6m=e> zH-8I{&#eNe#qZp!g!zFJJf?SAm?nqyfGIs}fI;3@gM} z!YUTR$cyY@Cs((7t@(Pb8F=|m!1wtt-mx;LoRH*iJ{Mrdvxn^=K?yZKw)za2s1DAZ z0gZw)j1CnhwEw`ZrVPE;KGd?y=vVN476yC^WmK}*gb$8U@|Dg-ChxbZ$IJAi5u zR>a|%7yNd=PlRU49!zc0z+y12XV;P1Vn*d!#6q<@OHUxlaa zvvG&(Tx%MWjEwW#t5ZS43Tx|AP#o9h9Ep!plNN?w?X6ny2pcXLAbs5@yXrfTM6}uD zL;v@6z=emcqWBSQED4Cz?aEwP%k!8&=N#`(eK%hfY5s4DUm9urASV{}rML3h&6>kE z8z#h_m{7g!LNZN|{G-$}B!sS)CqeOggkrXTXmv*POA}!sZoFxGV+8f`z8fs{pS|41 z7$>QmT6xde?uo5+K8K?b!-fLcP0r89Cjqit{Ez~YTkp35>Q0O3#~#u@$tjfdfl^2U_Q?xm?2cZoVD7i%NA?P}Za zOzT)Y>HNAJkg(wmd$*Ja5mR3}*6KtDp{kOiJfa2NG8QipCqZ(+Vcx2D2H5F<`kz?j zcDC$*rvmRZiA4Iz4x8=ob6!#!aw6_aTKhWkYz!2i zq+FX@SXp!>!>|oJsp}LexE23k33}@ZF}ovywqc!fgOsn7V8T+UCw$b@rjf(ccxbFW zn_#^wa{lWT+L>pjx5>fvVPgksD*V^V$K9)2YEK+0PkJ|R$c%5gO*)qsSNbwWQF!)|ML|?W)Sfr+#QB?JH z*WuS9p>^-120VrGIPM3@N{H5cCAl)Xdl*@lCVD=pSY5Is6wzl}#$lj#o@tA5_uAI5 ze<{LU-^WB;{?`06eT{N1m$K3V&+MG*Jkoj_WJ09qnS}a)?ZOWw{q0C+F1>U^qwaQ` z$st;`u70wVpRy1=u4?J}#qjq~i(6tvb6y9*o)&cybF zjP-|Gj9UN`aHWvL2de9QEG(XpT>7z4;7Ec#rvs2ysD~0z9f#M><;y>B13{?1uI>yG z8;rMHYpC5+H3oC8?9Dv3K08hGX;G+Gr{Sohq=9vLr?Jvt_0AOmyijv!_W^;5bDCUQ zevR6uvs{nM3&`H%1rELG8=x9#f0S~~xLWFob`a6~>rTXpso~_^H=6>MlR<(}K%^Dk zIB@hl%_Rsz>OX(Jc;Ue!pfCF?T$0DA(qYC;x}7mFi=x6KBl#goT@QOSG9}ngRb!>C z=S7-XP5Ez;*$G$Ta!NHU!$P0BAFBCYZB;WV8kxDPLQ=i;Ckf`vMOflbVn$dW1-U%x z8FbgV7baDv@w$p{%`AEEhOJlRcB99qLZeT?F&bpX=)-R1Q=vC>@`{aAkwX3?Qtnyf z#1@zBxGKFw=TdHzHmLU5Ha~aZEX~`9!&3u(Y|AP?T>(bq4?w?8p1)miPQMGg2oWiL z1y6O;tu?un@GV0mFC@4fp2Tx{NWDGj-gMkEDbZ`>1sGR#LWItNQsz&-0NRgdxzMx~ zf>%F5)mFv{(pvvB3^HNL6$>*3+M6RVZf=h@-$c(&)=^Y-2&gI@uNy91x+Eto7{R~Z ztDVO9egUd9(AgRT=``JlkiEx0_&ti;eD}1tb;NF5{3vrYTP)_u?t(BLOhrt`_&jr& z&tmQXLqD;7^Zb(yLzEo(S)yxouGXUZ5@Sq7?p-9nFGTU#A#3krQS8Wk8<6Z+V^t3v z5}`}hP#UUcmsM{qR~d4a{Z1fEcZ57;eed~`F2}KLTn{R(&>@Pye5TWlx$AsdcS}-P zC`_2+=T`8$zHHjYFeH{nkrv;tJVIvn`G#9TR6g!-zU*Pp_>&Hq*9pAE_}}q+_-TV? zDt3n_ywmS2&vuclTwRZ1V8}FUnw;N?{*~sBlSVma)$+&0#kHjQ9L(9Ai{n>uRk{hY zC9$|t0z-FMM8?uD*pRKNxeAk=24T`BepO~3#&aHo@fCJ&!#&HK%Uz;XNgkEz6u8#YM~v4bwRbf6HbVp6cqQaG-ZW`Aq}L{ZWudNaUSv zZEgKt*XbN|nULDw!vr;=hY;2^h%c)9lXGxY7a0n@|HCQxE@>|ti)&9xWC?AWct4u6QaXoz}C06yF~Q&-Si7DIkW~ z6UL0S&)U4ZcUW|~33jx`?tbd!T#OEBix*ybmz}pV-KC^$%FtnHz<4V*+RP@ZUB{H4 z^gR?G5KoB#i!S$6ky}3(4xD>^8Uha|PGXv@H3N0PNu6+fYD$W2EetWXvaBW|62Cf` zA6)0UUF&QOi9pA7a+?cyVCCuL@Q4WOVZ)pjw~`-`(?{5S7$w+j2w7pNVJ#kEAMp5a zQkV7ADvYTkl*9bi#T|Gdm2PoY&(x0319Hav0y|(kgZ=UeKbyAj{%V7!0pA-&3MA98 z?6QSvrzpzR7FwQQgb2cymCYeGPJBl|kdu#$tgITO9f5ck7Pi${8qt$)X13v|aJW*Q zoBL2rL&KVJqO&uhE`jb~!PrWQg1a+@R4P>9Z!QMAlgr1)&;>I=Q_|qTCy68v@jZ^Y zjXnNrWk+Ztrxqq_BVzcCXs8@E)c~9yakMooD2QVv9~LeAbp4 zOEqWT!HNow&$Zt7W;MgR_8+Qfu)Cdc_2o5NNJ*^!b>4!Wq^0r5D#yr>&zIPGxYo|M zeqot%`t|Ge_^IGv&6L#COza-UQ6OHw^=-*NAa>t>KHs;jq$K_h!%C3@2OB~=UwW*P z^!)kr@8bLS?>G3s{9s>a^f!(D>G*1OMvLXmwC6k14$O6}0FlS*CGkVfVR`?-NUS*L z-M&&GhvuD@39;{cLp~PE8hJhmP99(+xvkCu(8|tlG!E>{d951Br6bR+<+17=A52_< zF}?~)Q;Z(NpFEWMh~{!^@0Va+*=N?QT5@P!N)UasWgN-olKWWZiu^#nKg{DDDb!l) zCiryu9F0o(v4i_e(?)FLbiQ15ptXl<_+=`2H(oXKAd;*{jGJi;ro)|PVhbKV8hb%a zO*j;kKit}_9Gzfej(Co^&=I_7e!Z%It+mB_<$=s_k zb-x7I_-$x!1=7vy7}w_L&}&zcsEgU}-(cmwi-e!Gz_} zJg+Gp1#IPdEDg1j!98tmUrCh1ey!ZvJsFRSkkyyfV}u+NvAXQP4CG-7}$kO6qmMsViA<|`muO}wKn!B6P=)o)J#r16hcUf^u0R_k=ny8~bcQ!}-*C$b&W zm0Y^e9hS2I8>MpNKHzy3BQ<5Yh&$yz*!`F-JEf5SSt5UZnlp%&gF!}HXh!Ics5R@u zq9=aMVOP15sLLje?AcCz2$y#L#M{l!GcZlizgoe$1b zy?voqWg~7gK5P%!EwO*o%)CM&PeC5NiYsG6&G9X=J|st>#pet2irKsuBP-7Lr!bRj zXvW134O^k80}#nL7TVB$7O_jNQ3Yg7O_nvaH%T77_LwWC;#$fd{$GI1{gi8JCdZz9 zY1DVvMun(H+u(jOf2G2m&IN4Vb>^UT9mnq7uQ)94sv!=iooh%%m(6H2+T-e1V9Zg6 zS}F-6da4V!+Jj?y^E|}Wq}b{kW*(*mzdekNrF{$HBuOz69)sTc@_M8%N*Qh6Q6tOO z0DZGfRAOq6mDCu2fbB05Cf2PiEJ(r5j0=#uv5VBv=^r`-sa#%H+RBlUs|8)Pm<|A3 z<3)h>3drnsGPD7NznJ$lyqn*$WlsMq4A{z#O2)w^H^2l|BVyX2jF-TO*KESsAFA#B z71}s3ZQf~Yg z9Tf7nf{S(Ue>TROgY)M-M1vDQvZ*Y^8AIbMZYhLx&XO{u1{Q#<0MwEzK(Sg5mynd? zKQgSLcHx4}d(Z25cY^cvJO~A1EvW)lDfykw{ot9Ngr@2mWq!Q{5LEkci#GH`UM|o< z4jrl?LcsYOTIPu3i_zzI;}BFCGAs8v3q49vU^%Y*#`SsqkesYbkYORXT(4z}jSLUh zj*vcaq5;_Y^03VVnW0cmdK1sKy79c)jxP)(B8t&2+FZtN+Yp7&LynG)qS8`QXF$mX zYL%Rze~eFruD4rY{i2OBb&sER<5+9l)ufIeAVWF#dy#BG3xuB#Vd7>f-hYAz6`3&l zEj2YY-^=+CB*2TYu{tOBnlaZWE~Im~B~S-gOYhuki%*E7-)9j6Y5BsO@tV2lTB192 zK;`ZoE$-Wa82|IUyTBus1@~qiIt4Q~^WelAd-v3ShY2}?+XB2rBO9kt{P|PAy`>JC zr!I7!H!JM;mIcI)hoH9KU2|9NDu}ZpBNS}g%Y_o~)T{6OQWnRvAs<(y_I&C>W6$Hq zb)|<^R%B5u5=$-iruLnm$`Ax%>M-u|Q4?1gnki2eB~QN&#>;d~@kipHL{TX^Qq*$3 zbNMde)J6DoLL_`y#s^@4CHwv?box!z-OULS)N=BR4^;raQW_0hUuMc6N zM)W>Ph$O|u6(-GIN;VutDHn+G1tlkESs22Sxos4BbUqLf*}4`iD5XiK(ZO3iKuNJ_TP-c_h}Jwjkbv?=jE13fAPO&>le5!ywb(FTm|<>XX{f&9^&dht+= z__+yp8W8gU))Ru1&E;qkHlz`%q#O!A(tm98w;+V(teVgul9%FJz61J1$Zs z`+GqXIzRs%HAMC*ad&O@-ni`7udmd$NOjk|{=)0}I5Da%WL%)1%)UH3rYE=^*+tP} z9Ez<#gI9UkdZ`uHh&-1#Z1yK)LV*Aq{oP_#%$156>?5ckcNZsd77VL^>dTdfNF9=!`hb-z__)9|7ea>b zg|FajuRsTzix9#Pzs3|$CUe(*KYo%;l5O-5((j0`4R2>P}jjNj57sV*spA~wP2{B6?dolf4;-*o)_W_q!;MQ7zM zC#7>Ql+GO;9Hy4lJRPAjxIYuKr($w>V;U;*MW09C&)Dk>yvmTK+GjI;{gINE7hd2N z%A9~e)c0}UrR;MlPSVJ#-!IEL*;R+8+}C?)(W%b*Jkw4Fb)CgGRzECrPx|^K#>B+X zPB8V60n9y_+=@(ZtYSryhnjB@$1pO&atGidT+@s*OIv@8Fe61oS7*^W30t_UGfS1d zQCs4AN<6Z?9sFQoe&Lb)`-?uliT#i3VBq3i7_FMOD=F$*VVA?01Y(`IF`E*{P?sxY zEt7fh77-Dfx8QaABpcL#r}A#AMT*8<$x?mfG?(qjOwxHg&om5?J^+*7)nEvZihMH+ zz#_u}BL^#6p6SKB;^L07Dpsob{if0_c>6 z*v<<7ie>4%UYOasv7i7kze^8-Pt?R*EhL(iyF zB)=M)1FSskgEKP{u(U(IhYhj5N%>xeUFi1~l$LfD+JBZov@eJnufj0aE0-@{?v)2$ zT@S0b1MyV7dm313`5BL(^%LC^Q-D0+MOMn>sFNP(2lkE=3hRM)g!AP!=9(-68T&iQ z)?DSk7;4-~Xh^g2sjD!J3${43iO>ZYEg2Pa9P$6PvKu{mbtRjBjKVRxdG6)Wxt4i-+V_VJ%Mu6+M5mtx|(BP@eS3i6hdX|>r?&9*y z5=rh4?L&)pPnUtcco6n#ppW}sQc%#HM(Dj&mDdPt-0xXhR@SwRJM|ij7d=`g{xytE zRK(;bKP#gc7j?46#$;V&D8L+Y<*{i6x+z|)$QRYX? zQ|h~X9P?KZd7av32kWCI*af?%FZYrAJsZ9MQ*5IsdgFiZT@aY+DIj{`2CD#FfLCIx z>b6*zIpZLuj{OfwNoA)^(ym*9c)n}elLiZGJ_n3V#dC@jONSXnDr{w0EhPuUk#x0< zNX0w?>`zARP5s#A6lZ*)057Gpv>6Hih!j>E9S>pp~zgJ50jVKRSU zqo6<~QBQd85=W%+9d9IU&&C|m0O|c;A*P>l2%!7pM@2WCV>ArIJqFRxzOa5rFu612 zP9xOSN}gJW)pY&x6zUGjsIf$M_R zmWoX?wzdG-n7}C9x)ysUE)bt8nBEctckC4HQcXG=i1OGULS^BKudf{VEob50m=DX} z_C^W|2{CjI_x2|56`360iWI6-Zn4?QfHg0%{o(ufesJdgAg8_8uF0f@&+ON=!6kMcCrjv_MF_> z3PXK2rtKn525)3bQETC4dpzEkz!yP{^BK7l2g9wMtzN2uwMxq}tt(}tU7PAVO@;x` zaJ?`F+kr!D^QVeWh2mUc^R`%YY(2;FmRM@1y%a4OLBF%(=;Tu}c`R~@18IbD`H98` zhcAH@9(``?ypqB*4XQXHwNJfuLSM1YhdilQs;A}bhZ;+7#>vy7K;mjWuyNWrX;eLg ziJG$jn~lp>v8CIP=`8)ju8*8BG;JUN$y~#W7Im`t+(9r~U9PKOxb$m7a{}%!x+$6a zcz8%k%gS;rl{3RS4^c$z_J-X-d{I+zUML)RqX{& ztGR>Npa+dKtSu#>OrHm&X9Y?(DRx!&ABAGU{viAShg8PR9QrEdqkNmpxn@ocm5D6? z7a6TeloTV?oWVy2DrD; zf)PCuSIXh!Oz!j5Y;*QwIZ|OLYRttl7&N=My6RVG=DoZL=l)kz4}uJ&Wn(!^wPQ6g zjt||m2SNkdO>}nLtDpQ7#P~u+PHvp`2h5UJo)T<^f?T<}uAUy<1k-S(0Rx&#zfsFo zb}re2MMPBO$~0_7a8SM&)`2*&wKInDOzV5{30!l$e*FM2W#JMa1JFSrFdgBxl-)HD zU|QsZ9clH9w03^VjiiV+<*NN&v<-dy5A%@4nt-4PazTt$+-|kbS(~?xyh?#QybL&V z#)rW;r3b|a#JJbKTAuRc+;mR-lPq7-{D;9=tORG&$JAfmB7QekUSnx`n5aqwv_&@u z5cZt@P%L)qYn9T$rnEG<(c(Rs@&mZ52AVvXIaDGC*Go-F@mQCqZoBS z`jevrrR{dr74fxH zu!_=%j+_mvV8pyYoPytq=Lq)lHz^B$e+9G-kqaY5bO;gkgI2Ae8c7UWqk=|G z>o_7Ic}JU*i+A1&GKOo#Orl_0vN+$oZ9~#FT6E zlk=EuakX}l?VP@t4*j2>o~sTocjp&rFePn9(l>SnApv&92lTn};tWxfz)9RfcpjLZ zKA5iPp(YV|c8HN??=fRjhA7q9Pxud4#_0p7kY9j3)8x+3JnrW(idMW7&Y~h08<~5* zv8a!%RW*1r8lbDX^p!*_gTm1{*a&b}gjZ5+<(K><&-4gBgLNsyZ}eXEgxBTw&!6w# zI!mP;OtBa3H&}(t>Iv6=JjLpW0D@rA%F^ay@){e=wIwPOofgsUP?wXOD+lHH6sU2^ zWs2@Jm3Qyp!)~UOZ1=8SuzB=mP6v+03&7(*1by?pJ$#c|FF67*nhduu9J$hc{dmdn zXGzEI@VC9jU9}eCUyE#ojyIo@YTY%d)x|1BgVni~;Q6PQp_i|@av*asRSeVd)nI|c zVIc3DBqJ~1{+Ntuva0yCqkP7!apyPX9p;?lI7V4yDPpgD5w{ z_j%G@or;Nf>1>F$NnpXVrK@lC2d%L5p^z>x)t?$-UDcIc17F$RwIwMw#MPhXO}Grw zJCQ}D6gIZo*}G$*{|KZ@HWM`RM3M70>QEJ~^2b>DvG6ttT|m zRE*zRqvPn7ET%Jv$^Tbn?*T42$oKVO7z@5CLqc70b{Eq5%WX0@OSWa(v$>=3HfdrJ4(e50sHmxSC_C9Guo4w2onQ`EjorJYo_+B!({0Q^VrTA-;~!A9|B)pugK=nJb{= zAVou!5;o)aVr2GAInm&g02dX>Xg$eDi-<~nKKj)@RKSo?mKsrM-6~Pte=K(MV-WWV zA=reVk)00wb(voKPRMG`u1A}W_V(_zyo_%mrYBzqHV({wunTd*%rw2p(G0{tzhK!z zV7A10?w~4?p+G-1wHPa{8y3R5IfVQnS(*i!SfZ7s3lv}5#XTZh)6^etF+`l?suf!y z%#s@JR>^NnOvC!MSsc^iaqqMxN2k5OSdgU5q*qQ$Umli%iJnJzDw}x3*1w7O2tx5_?+zeY|xj8rv?BJ3enUEQ^ z3j@$_Cen{fb>;QQX~eyXlbT<}YwcdEQzt}gerPWh#c zeTYbk06w>A#o7*cT5J0OftYx48l-UFrqALX#c3Kk`JpK$nZ}@Y*evV}H&s@KK&-0H zN7Lx(Yk(z6W)@nrbmg1cX%PlpSTogE6*LGYLNfgdSJ+3TWYL=Kj5QHC8ama}VaoQ2 za^5%k47HrYnYS)gAA3mOx8ov1VC^dDd(gPd8SN;#-WwE@DduhvGtPJWHc{N@Fr;z3 zAXdya{`D&BDS0PTaw-qsrJlFE0x-GLv}gqusda^R-3FEAhvw)@u!pC3E!VcMb&IUB zzKM<;QsjLbcAYG!2WHip81o6ZLRMQ({t8#NbfR8qH=cFE8(^si2kY|oE#Yj-{HETe z-Q7i_xg?$7Eu^gXNTGN-ASSK)RtG?u^zN)8|FFm*2W?eiidY|besc4n?@+^CW$-z@&I$5LJ#q1~! zy6BiejI#8X{6Px{ch0rCsftqJW&rhz=M*QN&BObRyNw1@ z*+jS{5<`9gTU}+fBd6#B%cePGnz8~Yz{s6d$Z>G|Dy}NB6*M89oQ#NV7XMKwB%s=+ zqrE*Wq&+GZTEO2xzYhVDCG5|YH0|`y2yQaaBDp>UlYx`|sUMZ4n+1mIi;*~>vJr^6 z2f>7Q+4c+sHd}FEa%T+XV6}=K8!vg+sYtCV)KAs))L>T4<96>d+vtS-(;*jbR?E$sNch?XAVlF zB`i-z1^66b$rRtdo-dH0y3;_Fd~0|K^4kt2KYh4aj#(zrTbRsxv{>=duu^5|m!=2_ zxTpk-rt}wUH4-Mh$KSOJTWG}>)pXev`gZZwC@>~Q?pqW?8v*4XI4yz& z4#eL)ADwN#?2qg7jq<*4)p18bR%e5r-m9TxF6(Hw80$^V6+vbjmr#%Q+Jf+97+a+` zM>kZxNRQ6AxE*PeYgfI0_*S=`&iecw+6N97+op5R#YLsBA7f*=MK#Iv;55B@?QD>9 z4HM%~H-RuFa@}=p_18px7<-h`x8>skaq~60T6cWENnPJ{lf3hnJ6l@^)et3-hj{$9 z3*NZX;u-1DDL)>A>#09XmumC$oVD5suH!iv?Mf3w(;ni>z?{1wA9ZN59CnGoJjzL3 zxuhCwA6Nr{A5=Jw(EAv1hE-T150Mzq@=GjZuZeJc+v;OhP}ibvQc$!5iTZ2jpTHV) zj9=cd-ly2Ond86JEQ&D-8)p4<(--xO^_QPLF{#QfcuW6zARd@}V|Kq1=p%P*u~z>0 zgYRVe<;(66ls*!SU^|VD+}_X45Bk5a8M1XzP>Gw+zh=lYt;M!j90H`@t!q?jTK`z` zD#5iGYEud_v@WsE2{hcNVJX%t58o9 zA^9T5GKSEY`%~$H_~7(@ZF$2@RuM=N$gsxB{#_cao4e?~%nYlF-Rm8>IGMv{Ue|~*6 zq(!y|Oyrj-7ZjbKZj^jV{RVOYlT4GAjb!Qg4X*|U)@hoZ@x>uGLU8}FIW@j)S1x;`?DgX3RU-w zqGV(K8;$x!DYB-anv0c{mD=daZav6(i!&rzbts)468{=<$Nkx5k#TCM)$om2jrnt00#(stO282v zW7VPIH+{%4m72>B)DcC3q(`UK#SJ`T!gsNvz{a`-I(Q^!03Jw?ENeYq$=0yHG{nd{ z@a#o;MVLL2o848&x353mfc(H~Wwx@riG z08x;ZESEc%PxeG1MDmv3srkq;QAnU)^6kzk0-|h$8ZKJu>52^|9!yg~!VG zD2HeCOK&qg#E9i4+I|0%QvmT6=y`QfdgHksSaqE3wy62o9S{^tW@W)k&N3s$!ke^| z^H_5u>H|ULsJTnhpB;i^6%-FHfV*@!HpQ$UnEq^DiDf-gZ@K*@9D@k&8_t0QC@D@< zO8rUHwsDR<%HH2q05rjJadxEruau2nL8T0m16O$*vjJ#+I*&LNyI7?fyzb;YnU{;D zvEOwB`9eUA3soE_ip=679B$W}HY>}Bw3KUb^~uc^qy&q)6||*ba%K@4O}24(P>G$O zKpWe`_}s3Qp_APjbh0Z_>aA&pSsd)J_h@@`?O?CL(KN&2`dUQO5mq$+piO{6B24;G zGA}JW)RJsVOn(GB<9M@nS09V&hRWCL$2j@cetLkigx#bu1E=JO`Qjhj0Wk{vsrf(1Fl?>}e1ibKMWO@XT#?Eayf_nOMz=}fMy9RbK47a(9Y++O zRDa{k+6$MWGbat*cODsO)MAMe_#(bzBk}9f-dMi&+vO0p zaf|7zZTFe#J=xBi{leU@t(jlXbBS#kv(S8xp#f}!gA@v}m zT~vYew_N7KgI?wJtgX)1SHPG8GpW=y*gzlcl_*}b5MQwvKanX;*O{d+)zGh{{a{S~ zi$Qq4h1#VVw2O)miZ+<+Uqm;a%W&TIh2?GaNxwRhFsAaiR6?1OJW&g3FJ-ZxOZo^|JyuJEdA!klw$)8IgQ(eI+RY!E)B@74v0$w*+$) zY&fYr6oZ4)UApKTY#8Ryi3le)g}-O7N*dX)2-fN`R{R({;JI*2IcbaeKS_C&3sarf z{~9+_psR`VedbaX_v(EgSi$Ez4->)<+*3I{j96aFH>^kBBaNzJ zm?|v~G&~Fepf5?JshN=`L&71eki`SQ}`P zq-<_X@;;qb$_2i4^J63}Q@>6nIpl;(SI|2dY3Uz+5&XLknVFhuJZ`d{FLK_y4Sw_8 z-{0J7bD7j6p>9-vp^tp$vk2pH$3z`r$1!naNLlThFzrd1ClMNGMyc1BrUF*5Ik<%b zt!Em+bOLp2R6oFokCF~CuFt&=oO=3ulSB5!GfvkF$+bzt%i|-$$k0i(e&M?f1be#- z^sJ|%U<^VIH4zffzB+XStN|q(TYq7bZpgX8Ymc)ID(DFH9FpT;X*5faE63>efg96( z{%M3zey!~=`W@C)Fbe_}rg;$k0MGeSk;$`sNcu@ia-!Icm9 zlNAzuOvNWlq%j@)(}=aLfv#%@d=bv)TUVEQqP(wH-zv-qou2X(Jp)6{(y9>Kzp+d) zc-aZ4AKe-N(b#`=^@RV5mEW>)8{`Qe{C364&h{g~l|obV6ci<=$2C%)Uqat)NIS6M`9(}%oemEj zmec>)hKTm^8^p-9IC2e+d*Z6jV`OBvCQ{?n4(nlU^9`Z02+Mpl>>V8VpwV&@5jncC zrWrxDH1=7;epTyTcBDS9*MCQRl`0fJ=I>HLsJ*A}KTS5Z#$xqSKQr2L=%faRo|nb<8M{Edeh88IH@f|Noe z?YVVcN1^Z^VaubWei0RkQ*GpzrDf`^Zv2j6UJL;z4hJ=C2rUw@n-WAImV2JsE)J9` zw~^J$HY=JyO#HhdyZ-)xl=nBTqSwKL?g^;3>UQseFHE>jpy|IfN zqIM_U{L%-7zj#Vs4~_diPHCAgNUKHC(t*;rb>961Cns!7hQFf}NkSYB;d7%(Gl$LO z>j7kW@V8yi|d+$1t^BC{wlxu>H>T-M2E3 zL8D6}xbj?rO81FtkL9y370LQ%*>ztI=+NFC4c&fY%BoDzJx}JhR5BDYM?^8ad zw;3MCtXl2gEo^N1^37cHLG;m*Qve>rG}4 zV7y(E8X8$0OMvY3`|{JoDXN_I<`j{v;({rXm2D)9<>BV0jb59|+vbyb`&Aa{QK0$qO3X`y7w%`?jRTVS5Ih_$(|zcV+c)zrALWh-P5Dl{)?s7KJ)xjk&{_Q z+vne=O7jv$WHm3Lpp%t{w2bkNGv*pKtpjm4WuqR#7$tmkEk66_@ek<0jpo_3k`)g zPJmK&K#q>Q_F9}SJw|SdE-h12*@{&SmPyCXpBgggHpCD@G(Eb%W-Y9q)fE&~5QVES z0v#+Q*#Ccgj|e{ZMt7p|e)I0U$Az_ES_%toPEI!)e3MOote{|Lw>Y5HwbI0F76Gp# zY=B;xY}$@1>jnJf@gt zjMex`ib<)cdTaGysuSkP+;uC6Y0+{b|O-xDG*LA3YXr88s z4-Qy0}P`rN>P}cb2sU{|Lv%;%V6TcX$(V>m{iyF%TejW`RjiAlmisvHk1LvB8IR4zuym z66lY%*%HOd0I>gZ^iJIm{c1c$8xY9@}I0kNfU&XA%A7xWyGcfpIa7yc^g z`8Clnx!4!P{m`*|k&m@;#7<#tv880b0+yEl9A@m9hclkx6fGE7eP?KBIEq@Wjqhz_ zX9!qYh!fcm<{GW^i(HqaOJ)UckIs9%N$?7gDY4 z91im5_QKXsXV+6Q?>{1fO4tsHgqa%)!^wnNJaf{%JsL84v0|ZGROBaHls`Tyz<&{M zb|d2qv4YTSq@5<<=kIuND!IO@Y*bHKihkYcmss>!_DUm zmDrFN1jJ&rM`@{(X(>{Q1jOxPx*Mc(N8rLKE(t2k{r)R`*yI(EsOfRIP`{s+H6&V{ z*7SD}4weH2Yn+-cKs;z&%dntl$NmCX2nW(Ou|$PdEKig?U1sLrtjdy(@*rMVsz$$h z#_hLoxmSF^vwBpw>cfYAE&m(Qk20b`V>dLxnt@hPZso7dM|7eg2^$GR6Ms#tj5+ho zn-(}?D#>Xz9fblA;-WEOIm8M7KFn+~C0&PzNuvFztF!8S^Q`=b*&=sGr>W?)YhpgZ z>W678ada6L(d%xg|Rkt#3ohak5-DgIGla(*8%*wf`bpc(PEYn>}UTlH~bcQ&l@o zM_x*R4+r)+`}sw$yB9d*+nfLYJ}VC`oYUEsE|Y02DGgC!{-iK7hLsZ$(hV>Auz|+y z_0`b$?Mrx~QA@WKtkQ<%m7?ecV(!4qzbOa|#8AUzNC*xr+4$m|O_J|dy_e}ejs4|S z;kg%dV2IYbo8uPx^Y*CF^#3C?#f(fh6_!RIn#CF$XQ}ASRkNAR*sqaeD@tdu;?4`p zlNH=vrJg>I&Nk_^{XzM@MgN@nmVXbk!K23)3>fsl^R4>=kiPO|%Ux6aNj{$?7p3@E zV+FOhofsNU^6!4~$XM1|yF7H+D=IpS>EYN5AjE=?`fc}7iER6eA(6&t5J0KLwrsyP z4>Rrip&=ixJx(kn5B4sUXIHFx4O-6e@y|!hPbaOFdYc9R*8nU-cc7eh76PjH9|`%N zr`1sVc~9UHc#pl9wVstB$=Hb=nIRqd<)3+j?G>x;nakP6nXvzGQIqQLQ?dN}R4=iE z%Vv;x?-I}^xf^7kYIF2oCTwj>Q;{B0<@WtDukT1E9b&qlk+qHu!HpjJ=N2me=CUA* zT@-ds!wgo4D@C&DWcFkAI6WTurrX-v3$Ih?|KK=a=qhttP@EKMDECD-{NWG5CZqFt z9i>i5w!f{hrU?ZFf%F^{cql3)G}F~?oBsz5YCoc&LGYD=dV(l;L9-GFB5-aaF9T3G z2l`@WQJ0MVi=sOPT7wBHPndOid>!iH`KM|2&G_HHkgG1b~*Q=(8Y-oBw$jCt(-{?^v?lAAA_H!KbZIbY45tDn##8RMSX}fqN0NZ5Owe|DpEuO zf;0!gMi3Q|8WAkC&?HC^h{Fsjh%hRM6amrDiHIP*j9^s6h?F2*A|OP-&^zBwLdc!( z&9|28t#7^e)?3^^C?_}f?z7K1`|R`E&EN+5Lql*vQ;EJghhKd6r?=JB)uE5tC|@>! zH^2|KW*&5@o%aX_)GUZ~LgS(jiEB~3ad^m8n^ zVAx}TQx|L;;=xWEpkc+$UpIRaK8P`b+(mvNW?2N(CQ*{hhXn`K3slrM7Hj zWILbpMZ`Dslz;l$!_-ZiP3qOQZ%%$B=@75rmh!f5KSA&B_DKe=428qFPDFj|j{L8S zw_Q8End#QZoYg41>4e#EOUuUpR(jFO%|9Od^d@@mb$2&s9~CG&zg&D@Kd4ByA}b)f zXO!OR(>l5v$;o0Nx5hC{dv1kct7GTo>!PL8b zXP9(KJCvpxgKSpH(JJEmh9F$GVtZ$;O$VgOs&E}}FG$#aoBIStHk&Ti58`n$Ez-YC zLZRp-1i%M?+o$fPGf-!E4073dbzq98M@)C!(-n!)kc>WHw2}Qa>)=CN)fqv|gsNXa zBH1vXR;tFV+0Rgw zwYL>wc3lsvuwVC%=LiK5&#-49r17>t*R>n0U#u&ScY;AmbayFFefo6v?_F~oCpz#> zkcb=&-0~r#B5mA*-|tE#n>ykO)D4f{Su5-S`^MhAKEM?-85q-N3QIH&mx{Z&?71bDp*ozALO=~r6f&w2h; z)J-{IFbI~8j{Q26Rogh|Kp$!tobd5g)++d^Jg9er|B*uh4_Sk~jxp?64)Hcwt+I2H zsTrkCwdwHt?Sq8aPlqOpz(dAn8)wpd4nyq~N{V7D0)2{$YrJ%~bKYNzlD4tJtU}08 z%8O2$+rUd~(HsuIk(C6)l%Pa|G1Q-LghIP;8S$Y+smbp3%LBmLp+n|Cy8!38>u;mjwpJ z+|T=UB{Wo2lD);*pBZgL(WSDR-EZHHT&N=~%Arka-sTIsK?1~z2S8k1H;t9;wyrJ= z%br3+VUz@kJyD2r6xq3w1mDru^KK2!7i&>pRLRKBKEGxxl1{gZ zENLB@oVHXIZxqn119R!&opf8~1#Q})AnKSE?tySc3*jNxb2t4JpZ=>!s>5@11y=u^BGn-!)^dJ7Q{~ap($XP5n!6qmPZZdl1TwhB z;;X*e6V5SXZd~ElIQqNn=6~a?8Et~YrV*%Q<{p>FzQzp>7P&Lq2QEX1n$%tzc;7X< zA{LLbZceb7>C}o^yiFH1riV_%cd>gwyowrIY4P31w)!BC2>UGm&Izth!w9>#Fs@Fvk&;INRf}Wu46dn-9Mfx(Q@fF{ZW6g*Zp)%bC>IYDw3L3ht4qQt<=tgU>aY9e-*9wRU zCNi)2HwtVxsr4~)|DcV+v#{5r+Ml--$wZ!`*E93ni>|w$R%j$qWXdsR5^p!2Nicpt zc$acxdr#oQ${e956M(aaH86}!Q@!hOl)`J?D`Za>?Zg%P6nVZnhR+C~=1Eqo&~qyEhNGToRMaf)U^GT7|1g4~G@SqKUUIv-+sR9dIP{$G zS=%S(N8JhypugBZ z;F1RUwyKx4b}+gynh9}V-FqK&HjH^R=r*}pdNo67XG#%iQY<)JCsa=(c$HT(rlvVR z=f10KyU^{#_w>-x5$#dgx5h2E>#6m$f$$35>_wV*=jMh73~Juk4QUNVPn}WSnnwbo z4=FbW>%0|7R0{26?boBtxhc1`st?^(a;~;Z&kuX5cYSh|-O=C;qf%)Q5N<1k==&v= z)>t5!s6E(qbA*0%h^xZ718aI9#5lb`CgNcHhAey4oBTD}x67+T+zZGeCF$y?1mkE) zc3ac^AIFzs(k1Hh4-&9}zw{1Dl4Vyj^hABEnrlfPU9cG=u6Tl%dEupub+!I|`iefM z77t;6dQMTX(!i`({J5vV@?;F*oZ2ySt5h}dO!W$~gl+WD`izx?uA3^G?;j;6RoeWH zH@m1BqgS<)LC(|IYS5BDl*1#PfRYg=hWM>P=d1HVE^ZgWRmaGFM@*pHd{O7R+R*cD zO@U6ct(A+y7ztZMpy-LZTrfY;@G@UF@$!f59ktUYHFx$pl2b-y>f{||e^wAm=+YGp z=}J5Efw4prU!{Z3cumdoprp<06f`nFfDwE8Iif+`HK?EPc5 zRh#Y^8&J#+h|iJl0{2iu(!~wy)PUiw0B5o%R%D4T6>I2XGZ| zSn~KugQai`;Sy%&?KjGu^h&^Ys*d|i2 zur}#X)t&q|3VrUr;BXt)<62mun_}yNw@FleyJla%LcREvktZ1{H)*b`4Vpb5)?5j% zmmcYPQc;?sL01)$A%7qKjL_eSCAB*!LvmqthYAb1cV^2|pJuxY#1M{cDxYXy+0fMG z6%?UW$rsC}Lf>y+r1*z<^`1ESk%Y}Xmzdu-p1!|+ub{&zYVn&-!`eTFuwoo+pbXAn zX2jF@QsqB7f;VZTHwV9$=bKb){T@lV)p)_Y=J2kQ^6FjdYOzXbds#}2tsHTZXYqwC z{My%xqScAX)o-;#ig1z^Ev{-d&z-Vzb1L;cw*S$=68Yed7x3!raqx$B6Os2F`1C52 zR-UEqHDce1k&u%3~@nGI43U(D1&?zO-_2iV1meRsA9a z6Ap~#*Uv)jRSm*hdY|kYgUHD=u}l$uR@OXGrPUNjh^FQoWqnYuHPWY0*Xm-mU7-I* zmN{pFpe(KSODl6`;BxKtPW%qhFbQk%2On~mKcjfIGX^fu3NO`O@5&@Syf|tPY9Ne1 zzzXBzx!9!+S=ld{nKJ1KshGn;W&xh@69>-qJuj5ejy|5&sDCjLLVfv>@=aL%lw#NKzWf;(rwF?tXQ`3X?b6w0A?vDVQfy4_~~cd&+_*D zhLiYM>BZE+hvcN9;wTxMi6YV5+dHd!l*BN16YTJ+AnecV#s1u3LwBr>olNC#?ZFxR z^#krzr3752qGOQ z`QG*YCc-Y<>?{$Q9t04^}25kJ}UiUbOhsmKOjcQ#z#*L5?Kx~1YS}m zD>~^z7ii7>uH@ts1@H(kX9xLzvQC!P z&U9&TH51f4{p?DP$bPaSv&egL8{?Vy*)k7bEXIPMg^x3K*>lRO?Y)y2FXclXjk{GtDJ~esvRyHHqg>^#xtA1 zj%(}{<+{ny^oz5}h0xKbCdK8`*X^*+?S#%B|7!_-#ai5FdSW=V>%j(0gf-*_Bn3k< zuG2QzL2ZPr(wqh-uV%z;*xQC~m)l|+@A{!ED*f5z(+aO;M4iY`t1)1LP~K3z%s7MG z-9SI4=#!8JY4RHk{+G`X~ZK)duTbNWFDRG%ZfkB~$&CBg0`=l3fX5DfN6dq5!S$5|^o@Bd9 zRjO!ER&95y&DdTaHx`|RRjH=YPk-3Llw<_?f3$vLZdf3T7n6yx(=t1q#k_R?$uajj zpD?du=KVXF6Sh{6tgO7Dy~w)`GcBPg^v+g(qr7c!&dvIm?4A&rGVefwVzm2)N!Ms7 zF2vbHN}i+ezjtxgccwvbB&-SSS@ec^Sz!$gBSukp82-t?#7*A4*(8|~^Q@)E^Yx1^ zQcw*cndVe&ces28XJ)2LQ)lEbFHfnaJ0J6N%3GI7N~KWSqiPRXK}HL^z{xS=bulz& zwZQa8Q+~TL-u7gbQQK84kG{7$N#1+E_=xXjQUS@m23ve%IGLl7gT|6xL6-CL$+Du*x8@hvAVi>D|P^T%?@onMO|F()ar{foyoCc^ap(AwA# zIs0t)J>3_zKVf+m4E9+G`8S?VIRq>KE&tWn4@w*7jQ777A*;{hrhrBe!!vB8sa^;1 zS%=uJu=qQ;F071%Jz{Zgij;WBXUCFZyN&g%o`WiRidpmTQ90v7r27bGYf+RJ7ZU|muJzFA%)S=8+o(rtHnQyC!+AxklUpe`nr<0P4~{atIB|VHC^>mB!dqbNL7YC#2I1` z$GwYNW9qiB&^ipbCGO&(Dx9gcfQA2s8RI`tM58S$u6B5Qr6htxt7vGPVx!oIh2)%R zcTPINuWysQD7c(B0@j*!pq-=yAtJMH!M)SZ&(BhBeLc%U#Fm=xP_7i3fnXl(v_#nQ ztr~2200&#QFNiLlq4r3eWA!iGh}hc*#61|gbts#G0|gMI3VyWg()I)PvavoKyOfgrxm z(o=+>QblLqV&ukWJoofD_e7%1!s_EP7x|XKSP+%->{^gb^Q=G?<_?M%e-tfxdWoX5 z{10T+lHac`+Vl&Q~tyersXR=W=3U&*yOh{#ua9Ja#N- z(>z}M=btqU*Kn!*ig_V7r+1Z&{R86iEk`X=EcaPXM< - - - - - - - - - - - - Node - - - - - - kubelet - - - - - - - - - - - container - - - - - - - container - - - - - - - cAdvisor - - - - - - - Pod - - - - - - - - - - - container - - - - - - - container - - - - - - - container - - - - - - - Pod - - - - - - - - - - - - container - - - - - - - container - - - - - - - container - - - - - - - Pod - - - - - - - Proxy - - - - - - - kubectl (user commands) - - - - - - - - - - - - - - - Firewall - - - - - - - Internet - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - replication controller - - - - - - - Scheduler - - - - - - - Scheduler - - - - Master components - Colocated, or spread across machines, - as dictated by cluster size. - - - - - - - - - - - - REST - (pods, services, - rep. controllers) - - - - - - - authorization - authentication - - - - - - - scheduling - actuator - - - - APIs - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - docker - - - - - - - - .. - - - ... - - - - - - - - - - - - - - - - - - - - - - - - Node - - - - - - kubelet - - - - - - - - - - - container - - - - - - - container - - - - - - - cAdvisor - - - - - - - Pod - - - - - - - - - - - container - - - - - - - container - - - - - - - container - - - - - - - Pod - - - - - - - - - - - - container - - - - - - - container - - - - - - - container - - - - - - - Pod - - - - - - - Proxy - - - - - - - - - - - - - - - - - - - docker - - - - - - - - .. - - - ... - - - - - - - - - - - - - - - - - - - - - - - - - - Distributed - Watchable - Storage - - (implemented via etcd) - - - diff --git a/release-0.20.0/docs/authentication.md b/release-0.20.0/docs/authentication.md deleted file mode 100644 index 351ab663462..00000000000 --- a/release-0.20.0/docs/authentication.md +++ /dev/null @@ -1,46 +0,0 @@ -# Authentication Plugins - -Kubernetes uses client certificates, tokens, or http basic auth to authenticate users for API calls. - -Client certificate authentication is enabled by passing the `--client_ca_file=SOMEFILE` -option to apiserver. The referenced file must contain one or more certificates authorities -to use to validate client certificates presented to the apiserver. If a client certificate -is presented and verified, the common name of the subject is used as the user name for the -request. - -Token authentication is enabled by passing the `--token_auth_file=SOMEFILE` option -to apiserver. Currently, tokens last indefinitely, and the token list cannot -be changed without restarting apiserver. We plan in the future for tokens to -be short-lived, and to be generated as needed rather than stored in a file. - -The token file format is implemented in `plugin/pkg/auth/authenticator/token/tokenfile/...` -and is a csv file with 3 columns: token, user name, user uid. - -When using token authentication from an http client the apiserver expects an `Authorization` -header with a value of `Bearer SOMETOKEN`. - -Basic authentication is enabled by passing the `--basic_auth_file=SOMEFILE` -option to apiserver. Currently, the basic auth credentials last indefinitely, -and the password cannot be changed without restarting apiserver. Note that basic -authentication is currently supported for convenience while we finish making the -more secure modes described above easier to use. - -The basic auth file format is implemented in `plugin/pkg/auth/authenticator/password/passwordfile/...` -and is a csv file with 3 columns: password, user name, user id. - -When using basic authentication from an http client the apiserver expects an `Authorization` header -with a value of `Basic BASE64ENCODEDUSER:PASSWORD`. - -## Plugin Development - -We plan for the Kubernetes API server to issue tokens -after the user has been (re)authenticated by a *bedrock* authentication -provider external to Kubernetes. We plan to make it easy to develop modules -that interface between kubernetes and a bedrock authentication provider (e.g. -github.com, google.com, enterprise directory, kerberos, etc.) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/authentication.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/authentication.md?pixel)]() diff --git a/release-0.20.0/docs/authorization.md b/release-0.20.0/docs/authorization.md deleted file mode 100644 index 39b2bdac5ec..00000000000 --- a/release-0.20.0/docs/authorization.md +++ /dev/null @@ -1,109 +0,0 @@ -# Authorization Plugins - - -In Kubernetes, authorization happens as a separate step from authentication. -See the [authentication documentation](./authentication.md) for an -overview of authentication. - -Authorization applies to all HTTP accesses on the main apiserver port. (The -readonly port is not currently subject to authorization, but is planned to be -removed soon.) - -The authorization check for any request compares attributes of the context of -the request, (such as user, resource, and namespace) with access -policies. An API call must be allowed by some policy in order to proceed. - -The following implementations are available, and are selected by flag: - - `--authorization_mode=AlwaysDeny` - - `--authorization_mode=AlwaysAllow` - - `--authorization_mode=ABAC` - -`AlwaysDeny` blocks all requests (used in tests). -`AlwaysAllow` allows all requests; use if you don't need authorization. -`ABAC` allows for user-configured authorization policy. ABAC stands for Attribute-Based Access Control. - -## ABAC Mode -### Request Attributes - -A request has 4 attributes that can be considered for authorization: - - user (the user-string which a user was authenticated as). - - whether the request is readonly (GETs are readonly) - - what resource is being accessed - - applies only to the API endpoints, such as - `/api/v1/namespaces/default/pods`. For miscellaneous endpoints, like `/version`, the - resource is the empty string. - - the namespace of the object being access, or the empty string if the - endpoint does not support namespaced objects. - -We anticipate adding more attributes to allow finer grained access control and -to assist in policy management. - -### Policy File Format - -For mode `ABAC`, also specify `--authorization_policy_file=SOME_FILENAME`. - -The file format is [one JSON object per line](http://jsonlines.org/). There should be no enclosing list or map, just -one map per line. - -Each line is a "policy object". A policy object is a map with the following properties: - - `user`, type string; the user-string from `--token_auth_file` - - `readonly`, type boolean, when true, means that the policy only applies to GET - operations. - - `resource`, type string; a resource from an URL, such as `pods`. - - `namespace`, type string; a namespace string. - -An unset property is the same as a property set to the zero value for its type (e.g. empty string, 0, false). -However, unset should be preferred for readability. - -In the future, policies may be expressed in a JSON format, and managed via a REST -interface. - -### Authorization Algorithm - -A request has attributes which correspond to the properties of a policy object. - -When a request is received, the attributes are determined. Unknown attributes -are set to the zero value of its type (e.g. empty string, 0, false). - -An unset property will match any value of the corresponding -attribute. An unset attribute will match any value of the corresponding property. - -The tuple of attributes is checked for a match against every policy in the policy file. -If at least one line matches the request attributes, then the request is authorized (but may fail later validation). - -To permit any user to do something, write a policy with the user property unset. -To permit an action Policy with an unset namespace applies regardless of namespace. - -### Examples - 1. Alice can do anything: `{"user":"alice"}` - 2. Kubelet can read any pods: `{"user":"kubelet", "resource": "pods", "readonly": true}` - 3. Kubelet can read and write events: `{"user":"kubelet", "resource": "events"}` - 4. Bob can just read pods in namespace "projectCaribou": `{"user":"bob", "resource": "pods", "readonly": true, "ns": "projectCaribou"}` - -[Complete file example](../pkg/auth/authorizer/abac/example_policy_file.jsonl) - -## Plugin Development - -Other implementations can be developed fairly easily. -The APIserver calls the Authorizer interface: -```go -type Authorizer interface { - Authorize(a Attributes) error -} -``` -to determine whether or not to allow each API action. - -An authorization plugin is a module that implements this interface. -Authorization plugin code goes in `pkg/auth/authorization/$MODULENAME`. - -An authorization module can be completely implemented in go, or can call out -to a remote authorization service. Authorization modules can implement -their own caching to reduce the cost of repeated authorization calls with the -same or similar arguments. Developers should then consider the interaction between -caching and revocation of permissions. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/authorization.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/authorization.md?pixel)]() diff --git a/release-0.20.0/docs/availability.md b/release-0.20.0/docs/availability.md deleted file mode 100644 index f8972106911..00000000000 --- a/release-0.20.0/docs/availability.md +++ /dev/null @@ -1,136 +0,0 @@ -# Availability - -This document collects advice on reasoning about and provisioning for high-availability when using Kubernetes clusters. - -## Failure modes - -This is an incomplete list of things that could go wrong, and how to deal with them. - -Root causes: - - VM(s) shutdown - - network partition within cluster, or between cluster and users. - - crashes in Kubernetes software - - data loss or unavailability of persistent storage (e.g. GCE PD or AWS EBS volume). - - operator error misconfigures kubernetes software or application software. - -Specific scenarios: - - Apiserver VM shutdown or apiserver crashing - - Results - - unable to stop, update, or start new pods, services, replication controller - - existing pods and services should continue to work normally, unless they depend on the Kubernetes API - - Apiserver backing storage lost - - Results - - apiserver should fail to come up. - - kubelets will not be able to reach it but will continue to run the same pods and provide the same service proxying. - - manual recovery or recreation of apiserver state necessary before apiserver is restarted. - - Supporting services (node controller, replication controller manager, scheduler, etc) VM shutdown or crashes - - currently those are colocated with the apiserver, and their unavailability has similar consequences as apiserver - - in future, these will be replicated as well and may not be co-located - - they do not have own persistent state - - Node (thing that runs kubelet and kube-proxy and pods) shutdown - - Results - - pods on that Node stop running - - Kubelet software fault - - Results - - crashing kubelet cannot start new pods on the node - - kubelet might delete the pods or not - - node marked unhealthy - - replication controllers start new pods elsewhere - - Cluster operator error - - Results: - - loss of pods, services, etc - - lost of apiserver backing store - - users unable to read API - - etc - -Mitigations: -- Action: Use IaaS providers automatic VM restarting feature for IaaS VMs. - - Mitigates: Apiserver VM shutdown or apiserver crashing - - Mitigates: Supporting services VM shutdown or crashes - -- Action use IaaS providers reliable storage (e.g GCE PD or AWS EBS volume) for VMs with apiserver+etcd. - - Mitigates: Apiserver backing storage lost - -- Action: Use Replicated APIserver feature (when complete: feature is planned but not implemented) - - Mitigates: Apiserver VM shutdown or apiserver crashing - - Will tolerate one or more simultaneous apiserver failures. - - Mitigates: Apiserver backing storage lost - - Each apiserver has independent storage. Etcd will recover from loss of one member. Risk of total data loss greatly reduced. - -- Action: Snapshot apiserver PDs/EBS-volumes periodically - - Mitigates: Apiserver backing storage lost - - Mitigates: Some cases of operator error - - Mitigates: Some cases of kubernetes software fault - -- Action: use replication controller and services in front of pods - - Mitigates: Node shutdown - - Mitigates: Kubelet software fault - -- Action: applications (containers) designed to tolerate unexpected restarts - - Mitigates: Node shutdown - - Mitigates: Kubelet software fault - -- Action: Multiple independent clusters (and avoid making risky changes to all clusters at once) - - Mitigates: Everything listed above. - -## Choosing Multiple Kubernetes Clusters - -You may want to set up multiple kubernetes clusters, both to -have clusters in different regions to be nearer to your users; and to tolerate failures and/or invasive maintenance. - -### Scope of a single cluster - -On IaaS providers such as Google Compute Engine or Amazon Web Services, a VM exists in a -[zone](https://cloud.google.com/compute/docs/zones) or [availability -zone](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html). -We suggest that all the VMs in a Kubernetes cluster should be in the same availability zone, because: - - compared to having a single global Kubernetes cluster, there are fewer single-points of failure - - compared to a cluster that spans availability zones, it is easier to reason about the availability properties of a - single-zone cluster. - - when the Kubernetes developers are designing the system (e.g. making assumptions about latency, bandwidth, or - correlated failures) they are assuming all the machines are in a single data center, or otherwise closely connected. - -It is okay to have multiple clusters per availability zone, though on balance we think fewer is better. -Reasons to prefer fewer clusters are: - - improved bin packing of Pods in some cases with more nodes in one cluster. - - reduced operational overhead (though the advantage is diminished as ops tooling and processes matures). - - reduced costs for per-cluster fixed resource costs, e.g. apiserver VMs (but small as a percentage - of overall cluster cost for medium to large clusters). - -Reasons to have multiple clusters include: - - strict security policies requiring isolation of one class of work from another (but, see Partitioning Clusters - below). - - test clusters to canary new Kubernetes releases or other cluster software. - -### Selecting the right number of clusters -The selection of the number of kubernetes clusters may be a relatively static choice, only revisited occasionally. -By contrast, the number of nodes in a cluster and the number of pods in a service may be change frequently according to -load and growth. - -To pick the number of clusters, first, decide which regions you need to be in to have adequate latency to all your end users, for services that will run -on Kubernetes (if you use a Content Distribution Network, the latency requirements for the CDN-hosted content need not -be considered). Legal issues might influence this as well. For example, a company with a global customer base might decide to have clusters in US, EU, AP, and SA regions. -Call the number of regions to be in `R`. - -Second, decide how many clusters should be able to be unavailable at the same time, while still being available. Call -the number that can be unavailable `U`. If you are not sure, then 1 is a fine choice. - -If it is allowable for load-balancing to direct traffic to any region in the event of a cluster failure, then -then you need `R + U` clusters. If it is not (e.g you want to ensure low latency for all users in the event of a -cluster failure), then you need to have `R * U` clusters (`U` in each of `R` regions). In any case, try to put each cluster in a different zone. - -Finally, if any of your clusters would need more than the maximum recommended number of nodes for a Kubernetes cluster, then -you may need even more clusters. Our [roadmap](http://docs.k8s.io/roadmap.md) -calls for maximum 100 node clusters at v1.0 and maximum 1000 node clusters in the middle of 2015. - -## Working with multiple clusters - -When you have multiple clusters, you would typically create services with the same config in each cluster and put each of those -service instances behind a load balancer (AWS Elastic Load Balancer, GCE Forwarding Rule or HTTP Load Balancer), so that -failures of a single cluster are not visible to end users. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/availability.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/availability.md?pixel)]() diff --git a/release-0.20.0/docs/cli-roadmap.md b/release-0.20.0/docs/cli-roadmap.md deleted file mode 100644 index bdb5d957c9d..00000000000 --- a/release-0.20.0/docs/cli-roadmap.md +++ /dev/null @@ -1,84 +0,0 @@ -# Kubernetes CLI/Configuration Roadmap - -See also issues with the following labels: -* [area/config-deployment](https://github.com/GoogleCloudPlatform/kubernetes/labels/area%2Fconfig-deployment) -* [component/CLI](https://github.com/GoogleCloudPlatform/kubernetes/labels/component%2FCLI) -* [component/client](https://github.com/GoogleCloudPlatform/kubernetes/labels/component%2Fclient) - -1. Create services before other objects, or at least before objects that depend upon them. Namespace-relative DNS mitigates this some, but most users are still using service environment variables. [#1768](https://github.com/GoogleCloudPlatform/kubernetes/issues/1768) -1. Finish rolling update [#1353](https://github.com/GoogleCloudPlatform/kubernetes/issues/1353) - 1. Friendly to auto-scaling [#2863](https://github.com/GoogleCloudPlatform/kubernetes/pull/2863#issuecomment-69701562) - 1. Rollback (make rolling-update reversible, and complete an in-progress rolling update by taking 2 replication controller names rather than always taking a file) - 1. Rollover (replace multiple replication controllers with one, such as to clean up an aborted partial rollout) - 1. Write a ReplicationController generator to derive the new ReplicationController from an old one (e.g., `--image-version=newversion`, which would apply a name suffix, update a label value, and apply an image tag) - 1. Use readiness [#620](https://github.com/GoogleCloudPlatform/kubernetes/issues/620) - 1. Perhaps factor this in a way that it can be shared with [Openshift’s deployment controller](https://github.com/GoogleCloudPlatform/kubernetes/issues/1743) - 1. Rolling update service as a plugin -1. Kind-based filtering on object streams -- only operate on the kinds of objects specified. This would make directory-based kubectl operations much more useful. Users should be able to instantiate the example applications using `kubectl create -f ...` -1. Improved pretty printing of endpoints, such as in the case that there are more than a few endpoints -1. Service address/port lookup command(s) -1. List supported resources -1. Swagger lookups [#3060](https://github.com/GoogleCloudPlatform/kubernetes/issues/3060) -1. --name, --name-suffix applied during creation and updates -1. --labels and opinionated label injection: --app=foo, --tier={fe,cache,be,db}, --uservice=redis, --env={dev,test,prod}, --stage={canary,final}, --track={hourly,daily,weekly}, --release=0.4.3c2. Exact ones TBD. We could allow arbitrary values -- the keys are important. The actual label keys would be (optionally?) namespaced with kubectl.kubernetes.io/, or perhaps the user’s namespace. -1. --annotations and opinionated annotation injection: --description, --revision -1. Imperative updates. We'll want to optionally make these safe(r) by supporting preconditions based on the current value and resourceVersion. - 1. annotation updates similar to label updates - 1. other custom commands for common imperative updates - 1. more user-friendly (but still generic) on-command-line json for patch -1. We also want to support the following flavors of more general updates: - 1. whichever we don’t support: - 1. safe update: update the full resource, guarded by resourceVersion precondition (and perhaps selected value-based preconditions) - 1. forced update: update the full resource, blowing away the previous Spec without preconditions; delete and re-create if necessary - 1. diff/dryrun: Compare new config with current Spec [#6284](https://github.com/GoogleCloudPlatform/kubernetes/issues/6284) - 1. submit/apply/reconcile/ensure/merge: Merge user-provided fields with current Spec. Keep track of user-provided fields using an annotation -- see [#1702](https://github.com/GoogleCloudPlatform/kubernetes/issues/1702). Delete all objects with deployment-specific labels. -1. --dry-run for all commands -1. Support full label selection syntax, including support for namespaces. -1. Wait on conditions [#1899](https://github.com/GoogleCloudPlatform/kubernetes/issues/1899) -1. Make kubectl scriptable: make output and exit code behavior consistent and useful for wrapping in workflows and piping back into kubectl and/or xargs (e.g., dump full URLs?, distinguish permanent and retry-able failure, identify objects that should be retried) - 1. Here's [an example](http://techoverflow.net/blog/2013/10/22/docker-remove-all-images-and-containers/) where multiple objects on the command line and an option to dump object names only (`-q`) would be useful in combination. [#5906](https://github.com/GoogleCloudPlatform/kubernetes/issues/5906) -1. Easy generation of clean configuration files from existing objects (including containers -- podex) -- remove readonly fields, status - 1. Export from one namespace, import into another is an important use case -1. Derive objects from other objects - 1. pod clone - 1. rc from pod - 1. --labels-from (services from pods or rcs) -1. Kind discovery (i.e., operate on objects of all kinds) [#5278](https://github.com/GoogleCloudPlatform/kubernetes/issues/5278) -1. A fairly general-purpose way to specify fields on the command line during creation and update, not just from a config file -1. Extensible API-based generator framework (i.e. invoke generators via an API/URL rather than building them into kubectl), so that complex client libraries don’t need to be rewritten in multiple languages, and so that the abstractions are available through all interfaces: API, CLI, UI, logs, ... [#5280](https://github.com/GoogleCloudPlatform/kubernetes/issues/5280) - 1. Need schema registry, and some way to invoke generator (e.g., using a container) - 1. Convert run command to API-based generator -1. Transformation framework - 1. More intelligent defaulting of fields (e.g., [#2643](https://github.com/GoogleCloudPlatform/kubernetes/issues/2643)) -1. Update preconditions based on the values of arbitrary object fields. -1. Deployment manager compatibility on GCP: [#3685](https://github.com/GoogleCloudPlatform/kubernetes/issues/3685) -1. Describe multiple objects, multiple kinds of objects [#5905](https://github.com/GoogleCloudPlatform/kubernetes/issues/5905) -1. Support yaml document separator [#5840](https://github.com/GoogleCloudPlatform/kubernetes/issues/5840) - -TODO: -* watch -* attach [#1521](https://github.com/GoogleCloudPlatform/kubernetes/issues/1521) -* image/registry commands -* do any other server paths make sense? validate? generic curl functionality? -* template parameterization -* dynamic/runtime configuration - -Server-side support: - -1. Default selectors from labels [#1698](https://github.com/GoogleCloudPlatform/kubernetes/issues/1698#issuecomment-71048278) -1. Stop [#1535](https://github.com/GoogleCloudPlatform/kubernetes/issues/1535) -1. Deleted objects [#2789](https://github.com/GoogleCloudPlatform/kubernetes/issues/2789) -1. Clone [#170](https://github.com/GoogleCloudPlatform/kubernetes/issues/170) -1. Resize [#1629](https://github.com/GoogleCloudPlatform/kubernetes/issues/1629) -1. Useful /operations API: wait for finalization/reification -1. List supported resources [#2057](https://github.com/GoogleCloudPlatform/kubernetes/issues/2057) -1. Reverse label lookup [#1348](https://github.com/GoogleCloudPlatform/kubernetes/issues/1348) -1. Field selection [#1362](https://github.com/GoogleCloudPlatform/kubernetes/issues/1362) -1. Field filtering [#1459](https://github.com/GoogleCloudPlatform/kubernetes/issues/1459) -1. Operate on uids - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/cli-roadmap.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/cli-roadmap.md?pixel)]() diff --git a/release-0.20.0/docs/client-libraries.md b/release-0.20.0/docs/client-libraries.md deleted file mode 100644 index 8e1f31cff97..00000000000 --- a/release-0.20.0/docs/client-libraries.md +++ /dev/null @@ -1,21 +0,0 @@ -## kubernetes API client libraries - -### Supported - * [Go](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/pkg/client) - -### User Contributed -*Note: Libraries provided by outside parties are supported by their authors, not the core Kubernetes team* - - * [Java](https://github.com/fabric8io/fabric8/tree/master/components/kubernetes-api) - * [Ruby1](https://github.com/Ch00k/kuber) - * [Ruby2](https://github.com/abonas/kubeclient) - * [PHP](https://github.com/devstub/kubernetes-api-php-client) - * [Node.js](https://github.com/tenxcloud/node-kubernetes-client) - * [Perl](https://metacpan.org/pod/Net::Kubernetes) - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/client-libraries.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/client-libraries.md?pixel)]() diff --git a/release-0.20.0/docs/cluster-admin-guide.md b/release-0.20.0/docs/cluster-admin-guide.md deleted file mode 100644 index e59239071c7..00000000000 --- a/release-0.20.0/docs/cluster-admin-guide.md +++ /dev/null @@ -1,80 +0,0 @@ -# Kubernetes Cluster Admin Guide - -The cluster admin guide is for anyone creating or administering a Kubernetes cluster. -It assumes some familiarity with concepts in the [User Guide](user-guide.md). - -## Planning a cluster - -There are many different examples of how to setup a kubernetes cluster. Many of them are listed in this -[matrix](getting-started-guides/README.md). We call each of the combinations in this matrix a *distro*. - -Before choosing a particular guide, here are some things to consider: - - Are you just looking to try out Kubernetes on your laptop, or build a high-availability many-node cluster? Both - models are supported, but some distros are better for one case or the other. - - Will you be using a hosted Kubernetes cluster, such as [GKE](https://cloud.google.com/container-engine), or setting - one up yourself? - - Will your cluster be on-premises, or in the cloud (IaaS)? Kubernetes does not directly support hybrid clusters. We - recommend setting up multiple clusters rather than spanning distant locations. - - Will you be running Kubernetes on "bare metal" or virtual machines? Kubernetes supports both, via different distros. - - Do you just want to run a cluster, or do you expect to do active development of kubernetes project code? If the - latter, it is better to pick a distro actively used by other developers. Some distros only use binary releases, but - offer is a greater variety of choices. - - Not all distros are maintained as actively. Prefer ones which are listed as tested on a more recent version of - Kubernetes. - - If you are configuring kubernetes on-premises, you will need to consider what [networking - model](networking.md) fits best. - - If you are designing for very [high-availability](availability.md), you may want multiple clusters in multiple zones. - -## Setting up a cluster - -Pick one of the Getting Started Guides from the [matrix](getting-started-guides/README.md) and follow it. -If none of the Getting Started Guides fits, you may want to pull ideas from several of the guides. - -One option for custom networking is *OpenVSwitch GRE/VxLAN networking* ([ovs-networking.md](ovs-networking.md)), which -uses OpenVSwitch to set up networking between pods across - Kubernetes nodes. - -If you are modifying an existing guide which uses Salt, this document explains [how Salt is used in the Kubernetes -project.](salt.md). - -## Upgrading a cluster -[Upgrading a cluster](cluster_management.md). - -## Managing nodes - -[Managing nodes](node.md). - -## Optional Cluster Services - -* **DNS Integration with SkyDNS** ([dns.md](dns.md)): - Resolving a DNS name directly to a Kubernetes service. - -* **Logging** with [Kibana](logging.md) - -## Multi-tenant support - -* **Namespaces** ([namespaces.md](namespaces.md)): Namespaces help different - projects, teams, or customers to share a kubernetes cluster. - -* **Resource Quota** ([resource_quota_admin.md](resource_quota_admin.md)) - -## Security - -* **Kubernetes Container Environment** ([container-environment.md](container-environment.md)): - Describes the environment for Kubelet managed containers on a Kubernetes - node. - -* **Securing access to the API Server** [accessing the api]( accessing_the_api.md) - -* **Authentication** [authentication]( authentication.md) - -* **Authorization** [authorization]( authorization.md) - -* **Admission Controllers** [admission_controllers]( admission_controllers.md) - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/cluster-admin-guide.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/cluster-admin-guide.md?pixel)]() diff --git a/release-0.20.0/docs/cluster-troubleshooting.md b/release-0.20.0/docs/cluster-troubleshooting.md deleted file mode 100644 index 2b56ec0282a..00000000000 --- a/release-0.20.0/docs/cluster-troubleshooting.md +++ /dev/null @@ -1,33 +0,0 @@ -# Cluster Troubleshooting -Most of the time, if you encounter problems, it is your application that is having problems. For application -problems please see the [application troubleshooting guide](application-troubleshooting.md). - -## Listing your cluster -The first thing to debug in your cluster is if your nodes are all registered correctly. - -Run -``` -kubectl get nodes -``` - -And verify that all of the nodes you expect to see are present and that they are all in the ```Ready``` state. - -## Looking at logs -For now, digging deeper into the cluster requires logging into the relevant machines. Here are the locations -of the relevant log files. (note that on systemd based systems, you may need to use ```journalctl``` instead) - -### Master - * /var/log/kube-apiserver.log - API Server, responsible for serving the API - * /var/log/kube-scheduler.log - Scheduler, responsible for making scheduling decisions - * /var/log/kube-controller-manager.log - Controller that manages replication controllers - -### Worker Nodes - * /var/log/kubelet.log - Kubelet, responsible for running containers on the node - * /var/log/kube-proxy.log - Kube Proxy, responsible for service load balancing - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/cluster-troubleshooting.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/cluster-troubleshooting.md?pixel)]() diff --git a/release-0.20.0/docs/cluster_management.md b/release-0.20.0/docs/cluster_management.md deleted file mode 100644 index edde83224e6..00000000000 --- a/release-0.20.0/docs/cluster_management.md +++ /dev/null @@ -1,65 +0,0 @@ -# Cluster Management - -This doc is in progress. - -## Upgrading a cluster - -The `cluster/kube-push.sh` script will do a rudimentary update; it is a 1.0 roadmap item to have a robust live cluster update system. - -## Updgrading to a different API version - -There is a sequence of steps to upgrade to a new API version. - -1. Turn on the new api version -2. Upgrade the cluster's storage to use the new version. -3. Upgrade all config files. Identify users of the old api version endpoints. -4. Update existing objects in the storage to new version by running cluster/update-storage-objects.sh -3. Turn off the old version. - -### Turn on or off an API version for your cluster - -Specific API versions can be turned on or off by passing --runtime-config=api/ flag while bringing up the server. For example: to turn off v1 API, pass --runtime-config=api/v1=false. -runtime-config also supports 2 special keys: api/all and api/legacy to control all and legacy APIs respectively. For example, for turning off all api versions except v1, pass --runtime-config=api/all=false,api/v1=true. - -### Switching your cluster's storage API version - -KUBE_API_VERSIONS env var controls the API versions that are supported in the cluster. The first version in the list is used as the cluster's storage version. Hence, to set a specific version as the storage version, bring it to the front of list of versions in the value of KUBE_API_VERSIONS. - -### Switching your config files to a new API version - -You can use the kube-version-change utility to convert config files between different API versions. - -``` -$ hack/build-go.sh cmd/kube-version-change -$ _output/local/go/bin/kube-version-change -i myPod.v1beta3.yaml -o myPod.v1.yaml -``` - -### Maintenance on a Node - -If you need to reboot a node (such as for a kernel upgrade, libc upgrade, hardware repair, etc.), and the downtime is -brief, then when the Kubelet restarts, it will attempt to restart the pods scheduled to it. If the reboot takes longer, -then the node controller will terminate the pods that are bound to the unavailable node. If there is a corresponding -replication controller, then a new copy of the pod will be started on a different node. So, in the case where all -pods are replicated, upgrades can be done without special coordination. - -If you want more control over the upgrading process, you may use the following workflow: - 1. Mark the node to be rebooted as unschedulable: - `kubectl update nodes $NODENAME --patch='{"apiVersion": "v1", "spec": {"unschedulable": true}}'`. - This keeps new pods from landing on the node while you are trying to get them off. - 1. Get the pods off the machine, via any of the following strategies: - 1. wait for finite-duration pods to complete - 1. delete pods with `kubectl delete pods $PODNAME` - 1. for pods with a replication controller, the pod will eventually be replaced by a new pod which will be scheduled to a new node. additionally, if the pod is part of a service, then clients will automatically be redirected to the new pod. - 1. for pods with no replication controller, you need to bring up a new copy of the pod, and assuming it is not part of a service, redirect clients to it. - 1. Work on the node - 1. Make the node schedulable again: - `kubectl update nodes $NODENAME --patch='{"apiVersion": "v1", "spec": {"unschedulable": false}}'`. - If you deleted the node's VM instance and created a new one, then a new schedulable node resource will - be created automatically when you create a new VM instance (if you're using a cloud provider that supports - node discovery; currently this is only GCE, not including CoreOS on GCE using kube-register). See [Node](node.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/cluster_management.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/cluster_management.md?pixel)]() diff --git a/release-0.20.0/docs/container-environment.md b/release-0.20.0/docs/container-environment.md deleted file mode 100644 index 37abbda6bd4..00000000000 --- a/release-0.20.0/docs/container-environment.md +++ /dev/null @@ -1,94 +0,0 @@ - -# Kubernetes Container Environment - -## Overview -This document describes the environment for Kubelet managed containers on a Kubernetes node (kNode).  In contrast to the Kubernetes cluster API, which provides an API for creating and managing containers, the Kubernetes container environment provides the container access to information about what else is going on in the cluster.  - -This cluster information makes it possible to build applications that are *cluster aware*.   -Additionally, the Kubernetes container environment defines a series of hooks that are surfaced to optional hook handlers defined as part of individual containers.  Container hooks are somewhat analogous to operating system signals in a traditional process model.   However these hooks are designed to make it easier to build reliable, scalable cloud applications in the Kubernetes cluster.  Containers that participate in this cluster lifecycle become *cluster native*.  - -Another important part of the container environment is the file system that is available to the container. In Kubernetes, the filesystem is a combination of an [image](./images.md) and one or more [volumes](./volumes.md). - - -The following sections describe both the cluster information provided to containers, as well as the hooks and life-cycle that allows containers to interact with the management system. - -## Cluster Information -There are two types of information that are available within the container environment.  There is information about the container itself, and there is information about other objects in the system. - -### Container Information -Currently, the only information about the container that is available to the container is the Pod name for the pod in which the container is running.  This ID is set as the hostname of the container, and is accessible through all calls to access the hostname within the container (e.g. the hostname command, or the [gethostname][1] function call in libc).  Additionally, user-defined environment variables from the pod definition, are also available to the container, as are any environment variables specified statically in the Docker image. - -In the future, we anticipate expanding this information with richer information about the container.  Examples include available memory, number of restarts, and in general any state that you could get from the call to GET /pods on the API server. - -### Cluster Information -Currently the list of all services that are running at the time when the container was created via the Kubernetes Cluster API are available to the container as environment variables.  The set of environment variables matches the syntax of Docker links. - -For a service named **foo** that maps to a container port named **bar**, the following variables are defined: - -```sh -FOO_SERVICE_HOST= -FOO_SERVICE_PORT= -``` - -Services have dedicated IP address, and are also surfaced to the container via DNS (If [DNS addon](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/cluster/addons/dns) is enabled).  Of course DNS is still not an enumerable protocol, so we will continue to provide environment variables so that containers can do discovery. - -## Container Hooks -*NB*: Container hooks are under active development, we anticipate adding additional hooks as the Kubernetes container management system evolves.* - -Container hooks provide information to the container about events in its management lifecycle.  For example, immediately after a container is started, it receives a *PostStart* hook.  These hooks are broadcast *into* the container with information about the life-cycle of the container.  They are different from the events provided by Docker and other systems which are *output* from the container.  Output events provide a log of what has already happened.  Input hooks provide real-time notification about things that are happening, but no historical log.   - -### Hook Details -There are currently two container hooks that are surfaced to containers, and two proposed hooks: - -*PreStart - ****Proposed*** - -This hook is sent immediately before a container is created.  It notifies that the container will be created immediately after the call completes.  No parameters are passed. *Note - *Some event handlers (namely ‘exec’ are incompatible with this event) - -*PostStart* - -This hook is sent immediately after a container is created.  It notifies the container that it has been created.  No parameters are passed to the handler. - -*PostRestart - ****Proposed*** - -This hook is called before the PostStart handler, when a container has been restarted, rather than started for the first time.  No parameters are passed to the handler. - -*PreStop* - -This hook is called immediately before a container is terminated.  This event handler is blocking, and must complete before the call to delete the container is sent to the Docker daemon. The SIGTERM notification sent by Docker is also still sent. - -A single parameter named reason is passed to the handler which contains the reason for termination.  Currently the valid values for reason are: - -* ```Delete``` - indicating an API call to delete the pod containing this container. -* ```Health``` - indicating that a health check of the container failed. -* ```Dependency``` - indicating that a dependency for the container or the pod is missing, and thus, the container needs to be restarted.  Examples include, the pod infra container crashing, or persistent disk failing for a container that mounts PD. - -Eventually, user specified reasons may be [added to the API](https://github.com/GoogleCloudPlatform/kubernetes/issues/137). - - -### Hook Handler Execution -When a management hook occurs, the management system calls into any registered hook handlers in the container for that hook.  These hook handler calls are synchronous in the context of the pod containing the container. Note:this means that hook handler execution blocks any further management of the pod.  If your hook handler blocks, no other management (including health checks) will occur until the hook handler completes.  Blocking hook handlers do *not* affect management of other Pods.  Typically we expect that users will make their hook handlers as lightweight as possible, but there are cases where long running commands make sense (e.g. saving state prior to container stop) - -For hooks which have parameters, these parameters are passed to the event handler as a set of key/value pairs.  The details of this parameter passing is handler implementation dependent (see below). - -### Hook delivery guarantees -Hook delivery is "at least one", which means that a hook may be called multiple times for any given event (e.g. "start" or "stop") and it is up to the hook implementer to be able to handle this -correctly. - -We expect double delivery to be rare, but in some cases if the ```kubelet``` restarts in the middle of sending a hook, the hook may be resent after the kubelet comes back up. - -Likewise, we only make a single delivery attempt. If (for example) an http hook receiver is down, and unable to take traffic, we do not make any attempts to resend. - -### Hook Handler Implementations -Hook handlers are the way that hooks are surfaced to containers.  Containers can select the type of hook handler they would like to implement.  Kubernetes currently supports two different hook handler types: - - * Exec - Executes a specific command (e.g. pre-stop.sh) inside the cgroup and namespaces of the container.  Resources consumed by the command are counted against the container.  Commands which print "ok" to standard out (stdout) are treated as healthy, any other output is treated as container failures (and will cause kubelet to forcibly restart the container).  Parameters are passed to the command as traditional linux command line flags (e.g. pre-stop.sh --reason=HEALTH) - - * HTTP - Executes an HTTP request against a specific endpoint on the container.  HTTP error codes (5xx) and non-response/failure to connect are treated as container failures. Parameters are passed to the http endpoint as query args (e.g. http://some.server.com/some/path?reason=HEALTH) - -[1]: http://man7.org/linux/man-pages/man2/gethostname.2.html - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/container-environment.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/container-environment.md?pixel)]() diff --git a/release-0.20.0/docs/containers.md b/release-0.20.0/docs/containers.md deleted file mode 100644 index 6cca8e7f0ce..00000000000 --- a/release-0.20.0/docs/containers.md +++ /dev/null @@ -1,95 +0,0 @@ -# Containers with Kubernetes - -## Containers and commands - -So far the Pods we've seen have all used the `image` field to indicate what process Kubernetes -should run in a container. In this case, Kubernetes runs the image's default command. If we want -to run a particular command or override the image's defaults, there are two additional fields that -we can use: - -1. `Command`: Controls the actual command run by the image -2. `Args`: Controls the arguments passed to the command - -### How docker handles command and arguments - -Docker images have metadata associated with them that is used to store information about the image. -The image author may use this to define defaults for the command and arguments to run a container -when the user does not supply values. Docker calls the fields for commands and arguments -`Entrypoint` and `Cmd` respectively. The full details for this feature are too complicated to -describe here, mostly due to the fact that the docker API allows users to specify both of these -fields as either a string array or a string and there are subtle differences in how those cases are -handled. We encourage the curious to check out [docker's documentation]() for this feature. - -Kubernetes allows you to override both the image's default command (docker `Entrypoint`) and args -(docker `Cmd`) with the `Command` and `Args` fields of `Container`. The rules are: - -1. If you do not supply a `Command` or `Args` for a container, the defaults defined by the image - will be used -2. If you supply a `Command` but no `Args` for a container, only the supplied `Command` will be - used; the image's default arguments are ignored -3. If you supply only `Args`, the image's default command will be used with the arguments you - supply -4. If you supply a `Command` **and** `Args`, the image's defaults will be ignored and the values - you supply will be used - -Here are examples for these rules in table format - -| Image `Entrypoint` | Image `Cmd` | Container `Command` | Container `Args` | Command Run | -|--------------------|------------------|---------------------|--------------------|------------------| -| `[/ep-1]` | `[foo bar]` | <not set> | <not set> | `[ep-1 foo bar]` | -| `[/ep-1]` | `[foo bar]` | `[/ep-2]` | <not set> | `[ep-2]` | -| `[/ep-1]` | `[foo bar]` | <not set> | `[zoo boo]` | `[ep-1 zoo boo]` | -| `[/ep-1]` | `[foo bar]` | `[/ep-2]` | `[zoo boo]` | `[ep-2 zoo boo]` | - - -## Capabilities - -By default, Docker containers are "unprivileged" and cannot, for example, run a Docker daemon inside a Docker container. We can have fine grain control over the capabilities using cap-add and cap-drop.More details [here](https://docs.docker.com/reference/run/#runtime-privilege-linux-capabilities-and-lxc-configuration). - -The relationship between Docker's capabilities and [Linux capabilities](http://man7.org/linux/man-pages/man7/capabilities.7.html) - -| Docker's capabilities | Linux capabilities | -| ---- | ---- | -| SETPCAP | CAP_SETPCAP | -| SYS_MODULE | CAP_SYS_MODULE | -| SYS_RAWIO | CAP_SYS_RAWIO | -| SYS_PACCT | CAP_SYS_PACCT | -| SYS_ADMIN | CAP_SYS_ADMIN | -| SYS_NICE | CAP_SYS_NICE | -| SYS_RESOURCE | CAP_SYS_RESOURCE | -| SYS_TIME | CAP_SYS_TIME | -| SYS_TTY_CONFIG | CAP_SYS_TTY_CONFIG | -| MKNOD | CAP_MKNOD | -| AUDIT_WRITE | CAP_AUDIT_WRITE | -| AUDIT_CONTROL | CAP_AUDIT_CONTROL | -| MAC_OVERRIDE | CAP_MAC_OVERRIDE | -| MAC_ADMIN | CAP_MAC_ADMIN | -| NET_ADMIN | CAP_NET_ADMIN | -| SYSLOG | CAP_SYSLOG | -| CHOWN | CAP_CHOWN | -| NET_RAW | CAP_NET_RAW | -| DAC_OVERRIDE | CAP_DAC_OVERRIDE | -| FOWNER | CAP_FOWNER | -| DAC_READ_SEARCH | CAP_DAC_READ_SEARCH | -| FSETID | CAP_FSETID | -| KILL | CAP_KILL | -| SETGID | CAP_SETGID | -| SETUID | CAP_SETUID | -| LINUX_IMMUTABLE | CAP_LINUX_IMMUTABLE | -| NET_BIND_SERVICE | CAP_NET_BIND_SERVICE | -| NET_BROADCAST | CAP_NET_BROADCAST | -| IPC_LOCK | CAP_IPC_LOCK | -| IPC_OWNER | CAP_IPC_OWNER | -| SYS_CHROOT | CAP_SYS_CHROOT | -| SYS_PTRACE | CAP_SYS_PTRACE | -| SYS_BOOT | CAP_SYS_BOOT | -| LEASE | CAP_LEASE | -| SETFCAP | CAP_SETFCAP | -| WAKE_ALARM | CAP_WAKE_ALARM | -| BLOCK_SUSPEND | CAP_BLOCK_SUSPEND | - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/containers.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/containers.md?pixel)]() diff --git a/release-0.20.0/docs/design/README.md b/release-0.20.0/docs/design/README.md deleted file mode 100644 index f1f1fe0d754..00000000000 --- a/release-0.20.0/docs/design/README.md +++ /dev/null @@ -1,23 +0,0 @@ -# Kubernetes Design Overview - -Kubernetes is a system for managing containerized applications across multiple hosts, providing basic mechanisms for deployment, maintenance, and scaling of applications. - -Kubernetes establishes robust declarative primitives for maintaining the desired state requested by the user. We see these primitives as the main value added by Kubernetes. Self-healing mechanisms, such as auto-restarting, re-scheduling, and replicating containers require active controllers, not just imperative orchestration. - -Kubernetes is primarily targeted at applications composed of multiple containers, such as elastic, distributed micro-services. It is also designed to facilitate migration of non-containerized application stacks to Kubernetes. It therefore includes abstractions for grouping containers in both loosely coupled and tightly coupled formations, and provides ways for containers to find and communicate with each other in relatively familiar ways. - -Kubernetes enables users to ask a cluster to run a set of containers. The system automatically chooses hosts to run those containers on. While Kubernetes's scheduler is currently very simple, we expect it to grow in sophistication over time. Scheduling is a policy-rich, topology-aware, workload-specific function that significantly impacts availability, performance, and capacity. The scheduler needs to take into account individual and collective resource requirements, quality of service requirements, hardware/software/policy constraints, affinity and anti-affinity specifications, data locality, inter-workload interference, deadlines, and so on. Workload-specific requirements will be exposed through the API as necessary. - -Kubernetes is intended to run on a number of cloud providers, as well as on physical hosts. - -A single Kubernetes cluster is not intended to span multiple availability zones. Instead, we recommend building a higher-level layer to replicate complete deployments of highly available applications across multiple zones (see [the availability doc](../availability.md) and [cluster federation proposal](../proposals/federation.md) for more details). - -Finally, Kubernetes aspires to be an extensible, pluggable, building-block OSS platform and toolkit. Therefore, architecturally, we want Kubernetes to be built as a collection of pluggable components and layers, with the ability to use alternative schedulers, controllers, storage systems, and distribution mechanisms, and we're evolving its current code in that direction. Furthermore, we want others to be able to extend Kubernetes functionality, such as with higher-level PaaS functionality or multi-cluster layers, without modification of core Kubernetes source. Therefore, its API isn't just (or even necessarily mainly) targeted at end users, but at tool and extension developers. Its APIs are intended to serve as the foundation for an open ecosystem of tools, automation systems, and higher-level API layers. Consequently, there are no "internal" inter-component APIs. All APIs are visible and available, including the APIs used by the scheduler, the node controller, the replication-controller manager, Kubelet's API, etc. There's no glass to break -- in order to handle more complex use cases, one can just access the lower-level APIs in a fully transparent, composable manner. - -For more about the Kubernetes architecture, see [architecture](architecture.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/README.md?pixel)]() diff --git a/release-0.20.0/docs/design/access.md b/release-0.20.0/docs/design/access.md deleted file mode 100644 index 147f2f131db..00000000000 --- a/release-0.20.0/docs/design/access.md +++ /dev/null @@ -1,254 +0,0 @@ -# K8s Identity and Access Management Sketch - -This document suggests a direction for identity and access management in the Kubernetes system. - - -## Background - -High level goals are: - - Have a plan for how identity, authentication, and authorization will fit in to the API. - - Have a plan for partitioning resources within a cluster between independent organizational units. - - Ease integration with existing enterprise and hosted scenarios. - -### Actors -Each of these can act as normal users or attackers. - - External Users: People who are accessing applications running on K8s (e.g. a web site served by webserver running in a container on K8s), but who do not have K8s API access. - - K8s Users : People who access the K8s API (e.g. create K8s API objects like Pods) - - K8s Project Admins: People who manage access for some K8s Users - - K8s Cluster Admins: People who control the machines, networks, or binaries that make up a K8s cluster. - - K8s Admin means K8s Cluster Admins and K8s Project Admins taken together. - -### Threats -Both intentional attacks and accidental use of privilege are concerns. - -For both cases it may be useful to think about these categories differently: - - Application Path - attack by sending network messages from the internet to the IP/port of any application running on K8s. May exploit weakness in application or misconfiguration of K8s. - - K8s API Path - attack by sending network messages to any K8s API endpoint. - - Insider Path - attack on K8s system components. Attacker may have privileged access to networks, machines or K8s software and data. Software errors in K8s system components and administrator error are some types of threat in this category. - -This document is primarily concerned with K8s API paths, and secondarily with Internal paths. The Application path also needs to be secure, but is not the focus of this document. - -### Assets to protect - -External User assets: - - Personal information like private messages, or images uploaded by External Users - - web server logs - -K8s User assets: - - External User assets of each K8s User - - things private to the K8s app, like: - - credentials for accessing other services (docker private repos, storage services, facebook, etc) - - SSL certificates for web servers - - proprietary data and code - -K8s Cluster assets: - - Assets of each K8s User - - Machine Certificates or secrets. - - The value of K8s cluster computing resources (cpu, memory, etc). - -This document is primarily about protecting K8s User assets and K8s cluster assets from other K8s Users and K8s Project and Cluster Admins. - -### Usage environments -Cluster in Small organization: - - K8s Admins may be the same people as K8s Users. - - few K8s Admins. - - prefer ease of use to fine-grained access control/precise accounting, etc. - - Product requirement that it be easy for potential K8s Cluster Admin to try out setting up a simple cluster. - -Cluster in Large organization: - - K8s Admins typically distinct people from K8s Users. May need to divide K8s Cluster Admin access by roles. - - K8s Users need to be protected from each other. - - Auditing of K8s User and K8s Admin actions important. - - flexible accurate usage accounting and resource controls important. - - Lots of automated access to APIs. - - Need to integrate with existing enterprise directory, authentication, accounting, auditing, and security policy infrastructure. - -Org-run cluster: - - organization that runs K8s master components is same as the org that runs apps on K8s. - - Nodes may be on-premises VMs or physical machines; Cloud VMs; or a mix. - -Hosted cluster: - - Offering K8s API as a service, or offering a Paas or Saas built on K8s - - May already offer web services, and need to integrate with existing customer account concept, and existing authentication, accounting, auditing, and security policy infrastructure. - - May want to leverage K8s User accounts and accounting to manage their User accounts (not a priority to support this use case.) - - Precise and accurate accounting of resources needed. Resource controls needed for hard limits (Users given limited slice of data) and soft limits (Users can grow up to some limit and then be expanded). - -K8s ecosystem services: - - There may be companies that want to offer their existing services (Build, CI, A/B-test, release automation, etc) for use with K8s. There should be some story for this case. - -Pods configs should be largely portable between Org-run and hosted configurations. - - -# Design -Related discussion: -- https://github.com/GoogleCloudPlatform/kubernetes/issues/442 -- https://github.com/GoogleCloudPlatform/kubernetes/issues/443 - -This doc describes two security profiles: - - Simple profile: like single-user mode. Make it easy to evaluate K8s without lots of configuring accounts and policies. Protects from unauthorized users, but does not partition authorized users. - - Enterprise profile: Provide mechanisms needed for large numbers of users. Defense in depth. Should integrate with existing enterprise security infrastructure. - -K8s distribution should include templates of config, and documentation, for simple and enterprise profiles. System should be flexible enough for knowledgeable users to create intermediate profiles, but K8s developers should only reason about those two Profiles, not a matrix. - -Features in this doc are divided into "Initial Feature", and "Improvements". Initial features would be candidates for version 1.00. - -## Identity -###userAccount -K8s will have a `userAccount` API object. -- `userAccount` has a UID which is immutable. This is used to associate users with objects and to record actions in audit logs. -- `userAccount` has a name which is a string and human readable and unique among userAccounts. It is used to refer to users in Policies, to ensure that the Policies are human readable. It can be changed only when there are no Policy objects or other objects which refer to that name. An email address is a suggested format for this field. -- `userAccount` is not related to the unix username of processes in Pods created by that userAccount. -- `userAccount` API objects can have labels - -The system may associate one or more Authentication Methods with a -`userAccount` (but they are not formally part of the userAccount object.) -In a simple deployment, the authentication method for a -user might be an authentication token which is verified by a K8s server. In a -more complex deployment, the authentication might be delegated to -another system which is trusted by the K8s API to authenticate users, but where -the authentication details are unknown to K8s. - -Initial Features: -- there is no superuser `userAccount` -- `userAccount` objects are statically populated in the K8s API store by reading a config file. Only a K8s Cluster Admin can do this. -- `userAccount` can have a default `namespace`. If API call does not specify a `namespace`, the default `namespace` for that caller is assumed. -- `userAccount` is global. A single human with access to multiple namespaces is recommended to only have one userAccount. - -Improvements: -- Make `userAccount` part of a separate API group from core K8s objects like `pod`. Facilitates plugging in alternate Access Management. - -Simple Profile: - - single `userAccount`, used by all K8s Users and Project Admins. One access token shared by all. - -Enterprise Profile: - - every human user has own `userAccount`. - - `userAccount`s have labels that indicate both membership in groups, and ability to act in certain roles. - - each service using the API has own `userAccount` too. (e.g. `scheduler`, `repcontroller`) - - automated jobs to denormalize the ldap group info into the local system list of users into the K8s userAccount file. - -###Unix accounts -A `userAccount` is not a Unix user account. The fact that a pod is started by a `userAccount` does not mean that the processes in that pod's containers run as a Unix user with a corresponding name or identity. - -Initially: -- The unix accounts available in a container, and used by the processes running in a container are those that are provided by the combination of the base operating system and the Docker manifest. -- Kubernetes doesn't enforce any relation between `userAccount` and unix accounts. - -Improvements: -- Kubelet allocates disjoint blocks of root-namespace uids for each container. This may provide some defense-in-depth against container escapes. (https://github.com/docker/docker/pull/4572) -- requires docker to integrate user namespace support, and deciding what getpwnam() does for these uids. -- any features that help users avoid use of privileged containers (https://github.com/GoogleCloudPlatform/kubernetes/issues/391) - -###Namespaces -K8s will have a have a `namespace` API object. It is similar to a Google Compute Engine `project`. It provides a namespace for objects created by a group of people co-operating together, preventing name collisions with non-cooperating groups. It also serves as a reference point for authorization policies. - -Namespaces are described in [namespace.md](namespaces.md). - -In the Enterprise Profile: - - a `userAccount` may have permission to access several `namespace`s. - -In the Simple Profile: - - There is a single `namespace` used by the single user. - -Namespaces versus userAccount vs Labels: -- `userAccount`s are intended for audit logging (both name and UID should be logged), and to define who has access to `namespace`s. -- `labels` (see [docs/labels.md](/docs/labels.md)) should be used to distinguish pods, users, and other objects that cooperate towards a common goal but are different in some way, such as version, or responsibilities. -- `namespace`s prevent name collisions between uncoordinated groups of people, and provide a place to attach common policies for co-operating groups of people. - - -## Authentication - -Goals for K8s authentication: -- Include a built-in authentication system with no configuration required to use in single-user mode, and little configuration required to add several user accounts, and no https proxy required. -- Allow for authentication to be handled by a system external to Kubernetes, to allow integration with existing to enterprise authorization systems. The kubernetes namespace itself should avoid taking contributions of multiple authorization schemes. Instead, a trusted proxy in front of the apiserver can be used to authenticate users. - - For organizations whose security requirements only allow FIPS compliant implementations (e.g. apache) for authentication. - - So the proxy can terminate SSL, and isolate the CA-signed certificate from less trusted, higher-touch APIserver. - - For organizations that already have existing SaaS web services (e.g. storage, VMs) and want a common authentication portal. -- Avoid mixing authentication and authorization, so that authorization policies be centrally managed, and to allow changes in authentication methods without affecting authorization code. - -Initially: -- Tokens used to authenticate a user. -- Long lived tokens identify a particular `userAccount`. -- Administrator utility generates tokens at cluster setup. -- OAuth2.0 Bearer tokens protocol, http://tools.ietf.org/html/rfc6750 -- No scopes for tokens. Authorization happens in the API server -- Tokens dynamically generated by apiserver to identify pods which are making API calls. -- Tokens checked in a module of the APIserver. -- Authentication in apiserver can be disabled by flag, to allow testing without authorization enabled, and to allow use of an authenticating proxy. In this mode, a query parameter or header added by the proxy will identify the caller. - -Improvements: -- Refresh of tokens. -- SSH keys to access inside containers. - -To be considered for subsequent versions: -- Fuller use of OAuth (http://tools.ietf.org/html/rfc6749) -- Scoped tokens. -- Tokens that are bound to the channel between the client and the api server - - http://www.ietf.org/proceedings/90/slides/slides-90-uta-0.pdf - - http://www.browserauth.net - - -## Authorization - -K8s authorization should: -- Allow for a range of maturity levels, from single-user for those test driving the system, to integration with existing to enterprise authorization systems. -- Allow for centralized management of users and policies. In some organizations, this will mean that the definition of users and access policies needs to reside on a system other than k8s and encompass other web services (such as a storage service). -- Allow processes running in K8s Pods to take on identity, and to allow narrow scoping of permissions for those identities in order to limit damage from software faults. -- Have Authorization Policies exposed as API objects so that a single config file can create or delete Pods, Replication Controllers, Services, and the identities and policies for those Pods and Replication Controllers. -- Be separate as much as practical from Authentication, to allow Authentication methods to change over time and space, without impacting Authorization policies. - -K8s will implement a relatively simple -[Attribute-Based Access Control](http://en.wikipedia.org/wiki/Attribute_Based_Access_Control) model. -The model will be described in more detail in a forthcoming document. The model will -- Be less complex than XACML -- Be easily recognizable to those familiar with Amazon IAM Policies. -- Have a subset/aliases/defaults which allow it to be used in a way comfortable to those users more familiar with Role-Based Access Control. - -Authorization policy is set by creating a set of Policy objects. - -The API Server will be the Enforcement Point for Policy. For each API call that it receives, it will construct the Attributes needed to evaluate the policy (what user is making the call, what resource they are accessing, what they are trying to do that resource, etc) and pass those attributes to a Decision Point. The Decision Point code evaluates the Attributes against all the Policies and allows or denies the API call. The system will be modular enough that the Decision Point code can either be linked into the APIserver binary, or be another service that the apiserver calls for each Decision (with appropriate time-limited caching as needed for performance). - -Policy objects may be applicable only to a single namespace or to all namespaces; K8s Project Admins would be able to create those as needed. Other Policy objects may be applicable to all namespaces; a K8s Cluster Admin might create those in order to authorize a new type of controller to be used by all namespaces, or to make a K8s User into a K8s Project Admin.) - - -## Accounting - -The API should have a `quota` concept (see https://github.com/GoogleCloudPlatform/kubernetes/issues/442). A quota object relates a namespace (and optionally a label selector) to a maximum quantity of resources that may be used (see [resources.md](/docs/resources.md)). - -Initially: -- a `quota` object is immutable. -- for hosted K8s systems that do billing, Project is recommended level for billing accounts. -- Every object that consumes resources should have a `namespace` so that Resource usage stats are roll-up-able to `namespace`. -- K8s Cluster Admin sets quota objects by writing a config file. - -Improvements: -- allow one namespace to charge the quota for one or more other namespaces. This would be controlled by a policy which allows changing a billing_namespace= label on an object. -- allow quota to be set by namespace owners for (namespace x label) combinations (e.g. let "webserver" namespace use 100 cores, but to prevent accidents, don't allow "webserver" namespace and "instance=test" use more than 10 cores. -- tools to help write consistent quota config files based on number of nodes, historical namespace usages, QoS needs, etc. -- way for K8s Cluster Admin to incrementally adjust Quota objects. - -Simple profile: - - a single `namespace` with infinite resource limits. - -Enterprise profile: - - multiple namespaces each with their own limits. - -Issues: -- need for locking or "eventual consistency" when multiple apiserver goroutines are accessing the object store and handling pod creations. - - -## Audit Logging - -API actions can be logged. - -Initial implementation: -- All API calls logged to nginx logs. - -Improvements: -- API server does logging instead. -- Policies to drop logging for high rate trusted API calls, or by users performing audit or other sensitive functions. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/access.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/access.md?pixel)]() diff --git a/release-0.20.0/docs/design/admission_control.md b/release-0.20.0/docs/design/admission_control.md deleted file mode 100644 index 0581a190873..00000000000 --- a/release-0.20.0/docs/design/admission_control.md +++ /dev/null @@ -1,85 +0,0 @@ -# Kubernetes Proposal - Admission Control - -**Related PR:** - -| Topic | Link | -| ----- | ---- | -| Separate validation from RESTStorage | https://github.com/GoogleCloudPlatform/kubernetes/issues/2977 | - -## Background - -High level goals: - -* Enable an easy-to-use mechanism to provide admission control to cluster -* Enable a provider to support multiple admission control strategies or author their own -* Ensure any rejected request can propagate errors back to the caller with why the request failed - -Authorization via policy is focused on answering if a user is authorized to perform an action. - -Admission Control is focused on if the system will accept an authorized action. - -Kubernetes may choose to dismiss an authorized action based on any number of admission control strategies. - -This proposal documents the basic design, and describes how any number of admission control plug-ins could be injected. - -Implementation of specific admission control strategies are handled in separate documents. - -## kube-apiserver - -The kube-apiserver takes the following OPTIONAL arguments to enable admission control - -| Option | Behavior | -| ------ | -------- | -| admission_control | Comma-delimited, ordered list of admission control choices to invoke prior to modifying or deleting an object. | -| admission_control_config_file | File with admission control configuration parameters to boot-strap plug-in. | - -An **AdmissionControl** plug-in is an implementation of the following interface: - -```go -package admission - -// Attributes is an interface used by a plug-in to make an admission decision on a individual request. -type Attributes interface { - GetNamespace() string - GetKind() string - GetOperation() string - GetObject() runtime.Object -} - -// Interface is an abstract, pluggable interface for Admission Control decisions. -type Interface interface { - // Admit makes an admission decision based on the request attributes - // An error is returned if it denies the request. - Admit(a Attributes) (err error) -} -``` - -A **plug-in** must be compiled with the binary, and is registered as an available option by providing a name, and implementation -of admission.Interface. - -```go -func init() { - admission.RegisterPlugin("AlwaysDeny", func(client client.Interface, config io.Reader) (admission.Interface, error) { return NewAlwaysDeny(), nil }) -} -``` - -Invocation of admission control is handled by the **APIServer** and not individual **RESTStorage** implementations. - -This design assumes that **Issue 297** is adopted, and as a consequence, the general framework of the APIServer request/response flow -will ensure the following: - -1. Incoming request -2. Authenticate user -3. Authorize user -4. If operation=create|update, then validate(object) -5. If operation=create|update|delete, then admission.Admit(requestAttributes) - a. invoke each admission.Interface object in sequence -6. Object is persisted - -If at any step, there is an error, the request is canceled. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/admission_control.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/admission_control.md?pixel)]() diff --git a/release-0.20.0/docs/design/admission_control_limit_range.md b/release-0.20.0/docs/design/admission_control_limit_range.md deleted file mode 100644 index 79b3669ccfc..00000000000 --- a/release-0.20.0/docs/design/admission_control_limit_range.md +++ /dev/null @@ -1,138 +0,0 @@ -# Admission control plugin: LimitRanger - -## Background - -This document proposes a system for enforcing min/max limits per resource as part of admission control. - -## Model Changes - -A new resource, **LimitRange**, is introduced to enumerate min/max limits for a resource type scoped to a -Kubernetes namespace. - -```go -const ( - // Limit that applies to all pods in a namespace - LimitTypePod string = "Pod" - // Limit that applies to all containers in a namespace - LimitTypeContainer string = "Container" -) - -// LimitRangeItem defines a min/max usage limit for any resource that matches on kind -type LimitRangeItem struct { - // Type of resource that this limit applies to - Type string `json:"type,omitempty"` - // Max usage constraints on this kind by resource name - Max ResourceList `json:"max,omitempty"` - // Min usage constraints on this kind by resource name - Min ResourceList `json:"min,omitempty"` - // Default usage constraints on this kind by resource name - Default ResourceList `json:"default,omitempty"` -} - -// LimitRangeSpec defines a min/max usage limit for resources that match on kind -type LimitRangeSpec struct { - // Limits is the list of LimitRangeItem objects that are enforced - Limits []LimitRangeItem `json:"limits"` -} - -// LimitRange sets resource usage limits for each kind of resource in a Namespace -type LimitRange struct { - TypeMeta `json:",inline"` - ObjectMeta `json:"metadata,omitempty"` - - // Spec defines the limits enforced - Spec LimitRangeSpec `json:"spec,omitempty"` -} - -// LimitRangeList is a list of LimitRange items. -type LimitRangeList struct { - TypeMeta `json:",inline"` - ListMeta `json:"metadata,omitempty"` - - // Items is a list of LimitRange objects - Items []LimitRange `json:"items"` -} -``` - -## AdmissionControl plugin: LimitRanger - -The **LimitRanger** plug-in introspects all incoming admission requests. - -It makes decisions by evaluating the incoming object against all defined **LimitRange** objects in the request context namespace. - -The following min/max limits are imposed: - -**Type: Container** - -| ResourceName | Description | -| ------------ | ----------- | -| cpu | Min/Max amount of cpu per container | -| memory | Min/Max amount of memory per container | - -**Type: Pod** - -| ResourceName | Description | -| ------------ | ----------- | -| cpu | Min/Max amount of cpu per pod | -| memory | Min/Max amount of memory per pod | - -If a resource specifies a default value, it may get applied on the incoming resource. For example, if a default -value is provided for container cpu, it is set on the incoming container if and only if the incoming container -does not specify a resource requirements limit field. - -If a resource specifies a min value, it may get applied on the incoming resource. For example, if a min -value is provided for container cpu, it is set on the incoming container if and only if the incoming container does -not specify a resource requirements requests field. - -If the incoming object would cause a violation of the enumerated constraints, the request is denied with a set of -messages explaining what constraints were the source of the denial. - -If a constraint is not enumerated by a **LimitRange** it is not tracked. - -## kube-apiserver - -The server is updated to be aware of **LimitRange** objects. - -The constraints are only enforced if the kube-apiserver is started as follows: - -``` -$ kube-apiserver -admission_control=LimitRanger -``` - -## kubectl - -kubectl is modified to support the **LimitRange** resource. - -```kubectl describe``` provides a human-readable output of limits. - -For example, - -```shell -$ kubectl namespace myspace -$ kubectl create -f examples/limitrange/limit-range.json -$ kubectl get limits -NAME -limits -$ kubectl describe limits limits -Name: limits -Type Resource Min Max Default ----- -------- --- --- --- -Pod memory 1Mi 1Gi - -Pod cpu 250m 2 - -Container memory 1Mi 1Gi 1Mi -Container cpu 250m 250m 250m -``` - -## Future Enhancements: Define limits for a particular pod or container. - -In the current proposal, the **LimitRangeItem** matches purely on **LimitRangeItem.Type** - -It is expected we will want to define limits for particular pods or containers by name/uid and label/field selector. - -To make a **LimitRangeItem** more restrictive, we will intend to add these additional restrictions at a future point in time. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/admission_control_limit_range.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/admission_control_limit_range.md?pixel)]() diff --git a/release-0.20.0/docs/design/admission_control_resource_quota.md b/release-0.20.0/docs/design/admission_control_resource_quota.md deleted file mode 100644 index 64dc9c3ed7a..00000000000 --- a/release-0.20.0/docs/design/admission_control_resource_quota.md +++ /dev/null @@ -1,159 +0,0 @@ -# Admission control plugin: ResourceQuota - -## Background - -This document proposes a system for enforcing hard resource usage limits per namespace as part of admission control. - -## Model Changes - -A new resource, **ResourceQuota**, is introduced to enumerate hard resource limits in a Kubernetes namespace. - -A new resource, **ResourceQuotaUsage**, is introduced to support atomic updates of a **ResourceQuota** status. - -```go -// The following identify resource constants for Kubernetes object types -const ( - // Pods, number - ResourcePods ResourceName = "pods" - // Services, number - ResourceServices ResourceName = "services" - // ReplicationControllers, number - ResourceReplicationControllers ResourceName = "replicationcontrollers" - // ResourceQuotas, number - ResourceQuotas ResourceName = "resourcequotas" -) - -// ResourceQuotaSpec defines the desired hard limits to enforce for Quota -type ResourceQuotaSpec struct { - // Hard is the set of desired hard limits for each named resource - Hard ResourceList `json:"hard,omitempty"` -} - -// ResourceQuotaStatus defines the enforced hard limits and observed use -type ResourceQuotaStatus struct { - // Hard is the set of enforced hard limits for each named resource - Hard ResourceList `json:"hard,omitempty"` - // Used is the current observed total usage of the resource in the namespace - Used ResourceList `json:"used,omitempty"` -} - -// ResourceQuota sets aggregate quota restrictions enforced per namespace -type ResourceQuota struct { - TypeMeta `json:",inline"` - ObjectMeta `json:"metadata,omitempty"` - - // Spec defines the desired quota - Spec ResourceQuotaSpec `json:"spec,omitempty"` - - // Status defines the actual enforced quota and its current usage - Status ResourceQuotaStatus `json:"status,omitempty"` -} - -// ResourceQuotaUsage captures system observed quota status per namespace -// It is used to enforce atomic updates of a backing ResourceQuota.Status field in storage -type ResourceQuotaUsage struct { - TypeMeta `json:",inline"` - ObjectMeta `json:"metadata,omitempty"` - - // Status defines the actual enforced quota and its current usage - Status ResourceQuotaStatus `json:"status,omitempty"` -} - -// ResourceQuotaList is a list of ResourceQuota items -type ResourceQuotaList struct { - TypeMeta `json:",inline"` - ListMeta `json:"metadata,omitempty"` - - // Items is a list of ResourceQuota objects - Items []ResourceQuota `json:"items"` -} - -``` - -## AdmissionControl plugin: ResourceQuota - -The **ResourceQuota** plug-in introspects all incoming admission requests. - -It makes decisions by evaluating the incoming object against all defined **ResourceQuota.Status.Hard** resource limits in the request -namespace. If acceptance of the resource would cause the total usage of a named resource to exceed its hard limit, the request is denied. - -The following resource limits are imposed as part of core Kubernetes at the namespace level: - -| ResourceName | Description | -| ------------ | ----------- | -| cpu | Total cpu usage | -| memory | Total memory usage | -| pods | Total number of pods | -| services | Total number of services | -| replicationcontrollers | Total number of replication controllers | -| resourcequotas | Total number of resource quotas | - -Any resource that is not part of core Kubernetes must follow the resource naming convention prescribed by Kubernetes. - -This means the resource must have a fully-qualified name (i.e. mycompany.org/shinynewresource) - -If the incoming request does not cause the total usage to exceed any of the enumerated hard resource limits, the plug-in will post a -**ResourceQuotaUsage** document to the server to atomically update the observed usage based on the previously read -**ResourceQuota.ResourceVersion**. This keeps incremental usage atomically consistent, but does introduce a bottleneck (intentionally) -into the system. - -To optimize system performance, it is encouraged that all resource quotas are tracked on the same **ResourceQuota** document. As a result, -its encouraged to actually impose a cap on the total number of individual quotas that are tracked in the **Namespace** to 1 by explicitly -capping it in **ResourceQuota** document. - -## kube-apiserver - -The server is updated to be aware of **ResourceQuota** objects. - -The quota is only enforced if the kube-apiserver is started as follows: - -``` -$ kube-apiserver -admission_control=ResourceQuota -``` - -## kube-controller-manager - -A new controller is defined that runs a synch loop to calculate quota usage across the namespace. - -**ResourceQuota** usage is only calculated if a namespace has a **ResourceQuota** object. - -If the observed usage is different than the recorded usage, the controller sends a **ResourceQuotaUsage** resource -to the server to atomically update. - -The synchronization loop frequency will control how quickly DELETE actions are recorded in the system and usage is ticked down. - -To optimize the synchronization loop, this controller will WATCH on Pod resources to track DELETE events, and in response, recalculate -usage. This is because a Pod deletion will have the most impact on observed cpu and memory usage in the system, and we anticipate -this being the resource most closely running at the prescribed quota limits. - -## kubectl - -kubectl is modified to support the **ResourceQuota** resource. - -```kubectl describe``` provides a human-readable output of quota. - -For example, - -``` -$ kubectl namespace myspace -$ kubectl create -f examples/resourcequota/resource-quota.json -$ kubectl get quota -NAME -quota -$ kubectl describe quota quota -Name: quota -Resource Used Hard --------- ---- ---- -cpu 0m 20 -memory 0 1Gi -pods 5 10 -replicationcontrollers 5 20 -resourcequotas 1 1 -services 3 5 -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/admission_control_resource_quota.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/admission_control_resource_quota.md?pixel)]() diff --git a/release-0.20.0/docs/design/architecture.md b/release-0.20.0/docs/design/architecture.md deleted file mode 100644 index 010a811917d..00000000000 --- a/release-0.20.0/docs/design/architecture.md +++ /dev/null @@ -1,50 +0,0 @@ -# Kubernetes architecture - -A running Kubernetes cluster contains node agents (kubelet) and master components (APIs, scheduler, etc), on top of a distributed storage solution. This diagram shows our desired eventual state, though we're still working on a few things, like making kubelet itself (all our components, really) run within containers, and making the scheduler 100% pluggable. - -![Architecture Diagram](../architecture.png?raw=true "Architecture overview") - -## The Kubernetes Node - -When looking at the architecture of the system, we'll break it down to services that run on the worker node and services that compose the cluster-level control plane. - -The Kubernetes node has the services necessary to run application containers and be managed from the master systems. - -Each node runs Docker, of course. Docker takes care of the details of downloading images and running containers. - -### Kubelet -The **Kubelet** manages [pods](../pods.md) and their containers, their images, their volumes, etc. - -### Kube-Proxy - -Each node also runs a simple network proxy and load balancer (see the [services FAQ](https://github.com/GoogleCloudPlatform/kubernetes/wiki/Services-FAQ) for more details). This reflects `services` (see [the services doc](../services.md) for more details) as defined in the Kubernetes API on each node and can do simple TCP and UDP stream forwarding (round robin) across a set of backends. - -Service endpoints are currently found via [DNS](../dns.md) or through environment variables (both [Docker-links-compatible](https://docs.docker.com/userguide/dockerlinks/) and Kubernetes {FOO}_SERVICE_HOST and {FOO}_SERVICE_PORT variables are supported). These variables resolve to ports managed by the service proxy. - -## The Kubernetes Control Plane - -The Kubernetes control plane is split into a set of components. Currently they all run on a single _master_ node, but that is expected to change soon in order to support high-availability clusters. These components work together to provide a unified view of the cluster. - -### etcd - -All persistent master state is stored in an instance of `etcd`. This provides a great way to store configuration data reliably. With `watch` support, coordinating components can be notified very quickly of changes. - -### Kubernetes API Server - -The apiserver serves up the [Kubernetes API](../api.md). It is intended to be a CRUD-y server, with most/all business logic implemented in separate components or in plug-ins. It mainly processes REST operations, validates them, and updates the corresponding objects in `etcd` (and eventually other stores). - -### Scheduler - -The scheduler binds unscheduled pods to nodes via the `/binding` API. The scheduler is pluggable, and we expect to support multiple cluster schedulers and even user-provided schedulers in the future. - -### Kubernetes Controller Manager Server - -All other cluster-level functions are currently performed by the Controller Manager. For instance, `Endpoints` objects are created and updated by the endpoints controller, and nodes are discovered, managed, and monitored by the node controller. These could eventually be split into separate components to make them independently pluggable. - -The [`replicationcontroller`](../replication-controller.md) is a mechanism that is layered on top of the simple [`pod`](../pods.md) API. We eventually plan to port it to a generic plug-in mechanism, once one is implemented. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/architecture.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/architecture.md?pixel)]() diff --git a/release-0.20.0/docs/design/clustering.md b/release-0.20.0/docs/design/clustering.md deleted file mode 100644 index 693c812500a..00000000000 --- a/release-0.20.0/docs/design/clustering.md +++ /dev/null @@ -1,66 +0,0 @@ -# Clustering in Kubernetes - - -## Overview -The term "clustering" refers to the process of having all members of the kubernetes cluster find and trust each other. There are multiple different ways to achieve clustering with different security and usability profiles. This document attempts to lay out the user experiences for clustering that Kubernetes aims to address. - -Once a cluster is established, the following is true: - -1. **Master -> Node** The master needs to know which nodes can take work and what their current status is wrt capacity. - 1. **Location** The master knows the name and location of all of the nodes in the cluster. - * For the purposes of this doc, location and name should be enough information so that the master can open a TCP connection to the Node. Most probably we will make this either an IP address or a DNS name. It is going to be important to be consistent here (master must be able to reach kubelet on that DNS name) so that we can verify certificates appropriately. - 2. **Target AuthN** A way to securely talk to the kubelet on that node. Currently we call out to the kubelet over HTTP. This should be over HTTPS and the master should know what CA to trust for that node. - 3. **Caller AuthN/Z** This would be the master verifying itself (and permissions) when calling the node. Currently, this is only used to collect statistics as authorization isn't critical. This may change in the future though. -2. **Node -> Master** The nodes currently talk to the master to know which pods have been assigned to them and to publish events. - 1. **Location** The nodes must know where the master is at. - 2. **Target AuthN** Since the master is assigning work to the nodes, it is critical that they verify whom they are talking to. - 3. **Caller AuthN/Z** The nodes publish events and so must be authenticated to the master. Ideally this authentication is specific to each node so that authorization can be narrowly scoped. The details of the work to run (including things like environment variables) might be considered sensitive and should be locked down also. - -**Note:** While the description here refers to a singular Master, in the future we should enable multiple Masters operating in an HA mode. While the "Master" is currently the combination of the API Server, Scheduler and Controller Manager, we will restrict ourselves to thinking about the main API and policy engine -- the API Server. - -## Current Implementation - -A central authority (generally the master) is responsible for determining the set of machines which are members of the cluster. Calls to create and remove worker nodes in the cluster are restricted to this single authority, and any other requests to add or remove worker nodes are rejected. (1.i). - -Communication from the master to nodes is currently over HTTP and is not secured or authenticated in any way. (1.ii, 1.iii). - -The location of the master is communicated out of band to the nodes. For GCE, this is done via Salt. Other cluster instructions/scripts use other methods. (2.i) - -Currently most communication from the node to the master is over HTTP. When it is done over HTTPS there is currently no verification of the cert of the master (2.ii). - -Currently, the node/kubelet is authenticated to the master via a token shared across all nodes. This token is distributed out of band (using Salt for GCE) and is optional. If it is not present then the kubelet is unable to publish events to the master. (2.iii) - -Our current mix of out of band communication doesn't meet all of our needs from a security point of view and is difficult to set up and configure. - -## Proposed Solution - -The proposed solution will provide a range of options for setting up and maintaining a secure Kubernetes cluster. We want to both allow for centrally controlled systems (leveraging pre-existing trust and configuration systems) or more ad-hoc automagic systems that are incredibly easy to set up. - -The building blocks of an easier solution: - -* **Move to TLS** We will move to using TLS for all intra-cluster communication. We will explicitly identify the trust chain (the set of trusted CAs) as opposed to trusting the system CAs. We will also use client certificates for all AuthN. -* [optional] **API driven CA** Optionally, we will run a CA in the master that will mint certificates for the nodes/kubelets. There will be pluggable policies that will automatically approve certificate requests here as appropriate. - * **CA approval policy** This is a pluggable policy object that can automatically approve CA signing requests. Stock policies will include `always-reject`, `queue` and `insecure-always-approve`. With `queue` there would be an API for evaluating and accepting/rejecting requests. Cloud providers could implement a policy here that verifies other out of band information and automatically approves/rejects based on other external factors. -* **Scoped Kubelet Accounts** These accounts are per-minion and (optionally) give a minion permission to register itself. - * To start with, we'd have the kubelets generate a cert/account in the form of `kubelet:`. To start we would then hard code policy such that we give that particular account appropriate permissions. Over time, we can make the policy engine more generic. -* [optional] **Bootstrap API endpoint** This is a helper service hosted outside of the Kubernetes cluster that helps with initial discovery of the master. - -### Static Clustering - -In this sequence diagram there is out of band admin entity that is creating all certificates and distributing them. It is also making sure that the kubelets know where to find the master. This provides for a lot of control but is more difficult to set up as lots of information must be communicated outside of Kubernetes. - -![Static Sequence Diagram](clustering/static.png) - -### Dynamic Clustering - -This diagram dynamic clustering using the bootstrap API endpoint. That API endpoint is used to both find the location of the master and communicate the root CA for the master. - -This flow has the admin manually approving the kubelet signing requests. This is the `queue` policy defined above.This manual intervention could be replaced by code that can verify the signing requests via other means. - -![Dynamic Sequence Diagram](clustering/dynamic.png) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/clustering.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/clustering.md?pixel)]() diff --git a/release-0.20.0/docs/design/clustering/.gitignore b/release-0.20.0/docs/design/clustering/.gitignore deleted file mode 100644 index 67bcd6cb58a..00000000000 --- a/release-0.20.0/docs/design/clustering/.gitignore +++ /dev/null @@ -1 +0,0 @@ -DroidSansMono.ttf diff --git a/release-0.20.0/docs/design/clustering/Dockerfile b/release-0.20.0/docs/design/clustering/Dockerfile deleted file mode 100644 index 3353419d843..00000000000 --- a/release-0.20.0/docs/design/clustering/Dockerfile +++ /dev/null @@ -1,12 +0,0 @@ -FROM debian:jessie - -RUN apt-get update -RUN apt-get -qy install python-seqdiag make curl - -WORKDIR /diagrams - -RUN curl -sLo DroidSansMono.ttf https://googlefontdirectory.googlecode.com/hg/apache/droidsansmono/DroidSansMono.ttf - -ADD . /diagrams - -CMD bash -c 'make >/dev/stderr && tar cf - *.png' \ No newline at end of file diff --git a/release-0.20.0/docs/design/clustering/Makefile b/release-0.20.0/docs/design/clustering/Makefile deleted file mode 100644 index f6aa53ed442..00000000000 --- a/release-0.20.0/docs/design/clustering/Makefile +++ /dev/null @@ -1,29 +0,0 @@ -FONT := DroidSansMono.ttf - -PNGS := $(patsubst %.seqdiag,%.png,$(wildcard *.seqdiag)) - -.PHONY: all -all: $(PNGS) - -.PHONY: watch -watch: - fswatch *.seqdiag | xargs -n 1 sh -c "make || true" - -$(FONT): - curl -sLo $@ https://googlefontdirectory.googlecode.com/hg/apache/droidsansmono/$(FONT) - -%.png: %.seqdiag $(FONT) - seqdiag --no-transparency -a -f '$(FONT)' $< - -# Build the stuff via a docker image -.PHONY: docker -docker: - docker build -t clustering-seqdiag . - docker run --rm clustering-seqdiag | tar xvf - - -docker-clean: - docker rmi clustering-seqdiag || true - docker images -q --filter "dangling=true" | xargs docker rmi - -fix-clock-skew: - boot2docker ssh sudo date -u -D "%Y%m%d%H%M.%S" --set "$(shell date -u +%Y%m%d%H%M.%S)" diff --git a/release-0.20.0/docs/design/clustering/README.md b/release-0.20.0/docs/design/clustering/README.md deleted file mode 100644 index bfff9e54853..00000000000 --- a/release-0.20.0/docs/design/clustering/README.md +++ /dev/null @@ -1,31 +0,0 @@ -This directory contains diagrams for the clustering design doc. - -This depends on the `seqdiag` [utility](http://blockdiag.com/en/seqdiag/index.html). Assuming you have a non-borked python install, this should be installable with - -```bash -pip install seqdiag -``` - -Just call `make` to regenerate the diagrams. - -## Building with Docker -If you are on a Mac or your pip install is messed up, you can easily build with docker. - -``` -make docker -``` - -The first run will be slow but things should be fast after that. - -To clean up the docker containers that are created (and other cruft that is left around) you can run `make docker-clean`. - -If you are using boot2docker and get warnings about clock skew (or if things aren't building for some reason) then you can fix that up with `make fix-clock-skew`. - -## Automatically rebuild on file changes - -If you have the fswatch utility installed, you can have it monitor the file system and automatically rebuild when files have changed. Just do a `make watch`. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/clustering/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/clustering/README.md?pixel)]() diff --git a/release-0.20.0/docs/design/clustering/dynamic.png b/release-0.20.0/docs/design/clustering/dynamic.png deleted file mode 100644 index 92b40fee36281ad3bdb474a52c12d2150eb40b53..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 72373 zcmeFZcR1GZ+deK)q7afzQYbSsdl!YsmXR$xBbiYWZpny{y>BZra+@W$viDtNC7UFB zf3LUttmk;1?{WN&-*No@`91ePm2U6x8rOAR=XqYQkXvfkP7%`)lO?8#!)OJ*UkrQX zK(J>j7ie~xkF}2wO{Ddem^G1}>cX=?Rvw38DK32KCr=8Sf|?2k2gr0n4boZh0}7(Q z{#@Ug*uBqO8BHEl6Y0%flkETN`crX%2N&5ztUDy9eF=?lwD1sknWWuwjL2Ue4anjj zhd*DKy=Z`^!po##b4Gs7dF%uO{2>$i|F{3f-d!X8rAeh2#g@PEy)6rkZjAh(@no}v z`ulND7QaW=(9IF4^O*h}WRUO*Uwo)yH|L@Y=P|6X|M=`QQ^fK38QY6Qa$MAgC1y?U zTqbIai~Fm4sh=^Eob!8h9IjFJc=K+aVL-3D5&4t3xj9q5FL}4wgBv5$dD+}g1g3Jd zj5h}7qtRCc1ZLUI*3`Tc;R4cm~>1qpIzI^%o`Nlcl ztCUw6NVT-;WiYPwT7yyWkxJ?J#t|=`3!o$j zkYldL%ZXmDXr6FU)R^JB6l&J8M@23jE3=D7_L1xtIl=pJ=RO?H#Cx%vG*~`%vN4!! z)E#FemBJeoHM{m$1+ zbak8W1qHnHo3M77iJVC{qvHI0lHf+FpM5vs-Bf&@UA?fJVN197fpRX_rvH2{dN8U* zmPEu(!0Vh^PVX+auR{%on5`m;`ytFcGI>OSFJ8VpLqw3v{9H(Ds$irzRwbU%fnpE; z%fZ=l#$NYY3`UHc$WwwzIcjFc_BGX;s@oLO=^S+JA`U~x=TaQ@)zwHuCL&kmqUy4k zGHyqe#s66qq8eoBT&)S&d%qgVqS*RzxcX%*J!dyr+~5g@_tP}_UF^fKR!AAe_^{s` zD;vjOuyJ0H+NT?2kVd0bqE<(|mtMYnshFXmt$j40;e3RI+|r|LTR~>)m|~c0sv!Q0 zq3QgqY(yWbm+HKm&ggFL`I-CM2(0+hJ6ZV{XAYAqmV6e!6v|2@*OM%`CFim5rNnn< zeQRa9x3Om)U0nR2>W+X_+ozV6&?d9DR_*B#Iicwi>tD>v@N5(P2dq7J@z`PFGTcVT zofTLk0|W7MdgJBxoEOK<);;|Eha`<~cK7bV3z(JA_&!svn$Sp`2rf+*8SykclHSj|AzF73c@y&C7V=<|I?~JNF_Eu63zSVj^sB|1g&06I@D7>0y6mX+zw152? zZf$#e+eR=UHa44sm{I2T?`bx!+qxV8d^Nd|^qlS@DQc_Z_-`;lp?j)~q@q>|? zhdgm%{IS>BtU6xPhASOENyF#)%M|G6Y?0UB z4gVx0p%zW*a2DMiv@5o>vidnvD^5i$`K#e*xb*EgjGE#8-jYAFgy%2j{a?XXU8nf4 z1hOpdlVMUn>RlnF1OR=qxn|lI-M-( z?IUHvMo~2xYsjYj+pD(QrmUvsHNVGF?M8ygil+psWO1nS?3pvZzdy5Mzx3_z?aaDb zutsw5@H}sxNXQPS7jgVrYMIVar2lqmJeXNH#p=T9Y1h5&wW_MB2+8#?KZmPrvpZ`P z?y*LuzSSz_(mnj#o*+7?4u;_Rj9D}Yhsa;PB0(5GjAqU?XBBeAF3SjY8`j}=GrM~;=kw4M`M8+_L?tjjpa5+g`{ux+~DO$ zUZ1Dt*9W`eT45?;OH0dcc4>ofNs5pf`1J?F?zmLh$1}_BMjKwWU%!6ET7@VC?%TD! z;&+|y5L(YPsfT5?)+@N!l_oFgwfd}iB8ts@w#TwJTQxu?wW30poqamsI8*BUI*l~r zcHZLGw>jP$KLc4lnw9+i{X6AgcY1bq7H(R~bt8%@qS?CRHD_z73no@fQSCFm=hJ2~ zXSv;mJhS9SY0=M1UO;(B!KCF)vvo;Au$P@mq)Ojx@CG1%fpXCnmB{z8F z?;k_f*4Esr9}1*%gbpq0P+g!1xwRE=@4o!glMnaSa7H|5lZeO(WHn-J1XUR2l(`w* z_O*J;V8VHgYeYpvDr;(X3oA#=PW6(Z(Z*i0S(kN-GIcE^K5>2?`Lkf9DQfTf%8Hc@ z3S({s95tS*qojYj8KK%+ma_YUol)Gw0(FW>Vl&zMXQX9(hg=Vpm!hH~uE=PXL~MsP zqWOH}vyxmxRaI3*MZ!}h#DQITw{xNnKTMKdGnoC=UiDr|+Qjb0p0cFI@h-t|x+NtP z&2q8--eqy|ME>i3`0JHEQ=n#~a!Ov;#W z)%D_{g@#7=lK+9Xxw!@vBk46OtBdAsvu+oYLMI;{?fkKMMC}>#CO-ty>uhq<45;%t z!kQNq`9ocnvKBH*6_~Fr1PH&0Mi^aXAgMB9l2iQ(2zUyCK>KZ>>|7tD0 zx7u63-CxX8^&?7;ODWt2RnnbtErM16JF&blT>StxN_>1g8l9b!voVk3g^z&1N=Ag# z{p#VBsdjPCU#X)@ORy`Ajgt}Vum$<&t_sr&`_#NzR zxOJTfZWQ_E+?W+-jDh5F`n-~bl~qstElftXZ6Hg{@0QDF?>HZEuezGl(Vi%xtF6r$ z`g{1nX!r43l|$S_auQ7bV*$rUd{$Jk5Mw+y$AcM3gNL8n;C0DyZ|(H|Zl^KFUQu3` z82=(y_ES@op{Tfc!&8DZ__36I@1@5&OT+%M_&8Sf?UHh~?4dUWZ?|R_sQFD(ANTzl zZ`||qmtcys+^XC8S-mxtct(*HVrcK|w>n>MKAJlf_Oz;Lb?bw6f~^W8+Rx-_G({g3Z3C~}9 zo_UujrE>#I@3b&le=uO^RG6PHkT8N`r<3v#HAf97UoCVJ*|k}aus$xGOubKBxhoQuynG%2yMR%M!3urqy$%S6hpGOwKY1KXZ<4|H_7a3hO? zx6?;FX@Eh(ldtg12Rc6`o;bVl4?%7ug-Lebg0PIAU`s;8tL(uk`|GzSo}s2rc<`7% z_T@`U38@gJ3?U(*`u(-yCCog}1U57Gm!|~f#hZNVulcPOJbEU)C6Zx-Wr`f(w>m!c zxIuY-Ls>*qF*bqD*7E&Dk;Z^5$+QV|eSKQ-_oKYqfd*VQZz1{hRAL{qDPEUgI%s6x zzhz`JoTHusiGV)%U1mGV%b1Hg!Q%1K)S6UbRz%T7=Qq%LF~c`T6<9uwr4YV_XIb^a1ji zp_(RKChDf1l3|)`u3wSH<@t)FD))7(qsko=H8Nj5v0)wF%%e@b;F~MN%z_f{(I}5^ zkBaRPlCI;IK6CPzZGVIn^?vFNQTovy8Iv9%;}H9vK@nm&<4CI$QII+jb$?P+8TcDSNi*oOzp5&j>| z_~Tj?6(d7KiDCIgr|h!PgXn)7P5`t+?v*Apq>n-Ns`lX~-j* zY0Y=m7ri0lbzYrj$auZ}ky8B*q%#COdap0&8yKKPxZWpx+&$jEX=h+y;00j)$JCUu z-`3<(%?hbG7exr*$y7-5SFc_LNS>N&@W%AL5bloa#_)rUg|Dt#zb6aQN~k(y1izZ5 zG@g2GuzD>kJNx47ro822h)Ijz!+1MBf2O@+aa~n49F2B&cW-KHf`qU%Qo95Aj3R`f z>FMZFPTy%tNCwu!JHQ#j!Mrkjs*Gmpvu?_g7L@ ze*fmFUG0HAs>$iNI9LwP2e|9u!-sHft5ZR{3aoegM(CWBO4vfpyu2`{NDPjN`P!=u zFI=5M5q~=|i}~p$Ha|aqu)k3+z46Vp+h%nQXX3xweNDH}08q#pq#2bcH-JnU$B^O(ku*QhDolfA6kz<_MT|+qivsb9ZCZ{{Y~ami8h9VzhRCXjm9L&*e*( zjD6Sop%l8^YwUfGOH!cRfuid3b7dQUHzR3yl9f(rCkFp}c6LyB^<>=;cbiF_-+sk! z&gAp!y>*JO2OuAagTZ9X08+I~quKH@GcC4PXE8<6%O5FG{0w>>458_6KfgT$Fj8E< zzl{y2H{#KSeD1Q(4jAcq5l3kA#8-?vPy$GHU0)ocHRr9{G<*24icJ|H?`y#IQ|*b6 zEVph=+^-raGTOUr%OsXW>eK$({Un zh8`a$)6vo*3j7rZ%Wy8g_-9`prMZ2>qa$T~Xx#iFycGx499#va&86i4Hqg`?2(A!$ z;1+ImjWiFgd)=E$RZ-cp2IvZ_IAwn|hfLy^jEBei@lwcb3Dmz&!qxVW=aPZlJ{6w#bKZsDj|>3|=6JC|MIOke%p zqLZ$PZ#hRO%zXuO2>Z8bI0Bmxc&4!uf8BS*)d zFr#6ip}Fo!JWZ!h9`luAR?K+#@yPL5kDD4X1qB5owcfWgDqP4@-;39ej(YZVwB>3@ z?r%;&HR1N%IEqcRcjmEdbfU&{j!?5W9wT75B;QtQ1rXoqo!PY&r1RaHj3Z-`xGtjh zif{ZgdkO4Xs zDSP8&{xrh&dZG*?u)7z&zI8V`m`ZdCd_VTRDXbpwoAkj}C&Y%meq9qu(}qV-7GuSo zm;{d+hBQyW$ZbQhLSv380)WxXZQYSGnaZ&Y8 z3@o+p4fikR=H+cQ@%k+TXe6WIGo5UC2~g_tg&7ES3E8koG`@J&jsS#HPZUB867-%t2hc6(?e%w+d_D{uYHK@_RWxU=W#On2I?naFEQCDY{c zDl+&uK{0;})Y;#@eFJJLuJuCbcgPkiu**9Vg!17(;!OM==BOpHDW|u%vXH-E`@9*q zZ_Hy-x4T$5s>Vj4F0uRsH($F{x6{+xJDb6$8gL`fks2rkC5Jf$JIKID@KT{*_D#fr30Y0AUZzk6s%A@o(Cw|ZlC~=apOCN zOXBaxa@dr$e!@;zt^B&^A+q&Ki8g|oBh3l0jSD7{G<%g-@^q4Lc#|0fQYKhW9ZBME z-@diwT5f(g`|EuA;}DnKS*VhIefJ7PB6C*hzs-&{V2U&H_p3+UGtRK_Aee7+RTf$^(FTznNmCwC7i(voU-kDq7c{a&P19uK)9<1yDJd? zM~!`!o07!b=lb$)TUl8Fc$=*D*q_`jnaEMb&YgscauPB;^NPR2Fs2-X@dB(+US1A6 zE#1Nn*bb-KHJ#??jDUW~i3no3^fdvu=;~HN+MQ^Q0KVo76%`*AfQ8Z6T_mR*bAs}2 zHY*P3K*)pgVJC6Gc5ct*zc+P;6j-K3U~a$sy@}*3PeD-;>9NNUlbL;2PlrEEdYVG_ zeVPj9dTVoH&5QGPaY2Dw^{}n2t=lUz)CF$Ez8@L-o~E|vK6Y~6-H-2Cz*kg+`mJ&N zy1KduYs>UXP~%zNegMF)=r6Z2@4 zybDB1B-8-w${_7mW8Im&>JD^>;#ng>*QvIYy#;GVF}GB*%5~IbpD{a1jQgQe=9(W0BdB4sv36OcCfYbJ)U+qeDoGa zOk`vl2eD)Z3(x0^ghR(FhWI3Sa&7A>`x4vj4%(C}aZ3`#(MbVCke8 z!noVHxbV9do?@1gh`i1q>E+g!s}Y*sHvmYWI(BMb*lENEO04rI zP@H0aE$5)t^ZS(6G0K~l6DczktoP%D=!{P9d*`iMN!{1LS~+Ik7-V)eh%Ylx7>a%U zs26)EB5W*;rWC!KT=uNnp1Ukd?zfUS%4JaYj6XIq5-R9qpWmMoo$BJLzoGNZbk-d6YDru3!C4%mel4>jX2Bo@F1YQKDsI4~7`55{5?YF|@6QOlN?Q}n{$ z+s8=9)Y48%n79&ebvoig#0jQU{nxD=Kb{_#qEb}8abu{& z{CE;7HJW7E^V_1wkfCwuBXQs@6BDPK!dp4ZBPP@Sg09eEw7 zD{e!t!y&vAGL%BSeLfTN;?K2oFR5t2&t4c!T`s1lIkdaL@Ncm(_}&hQ)x zLAYETkR}!uK%Yl>g`SW61i{00^8kvK&XyK4RP8@_B(?;(y-xrAw@|8m|Nh;S@7>+T zr}@Qo7~Nvy2&ruj$xlG5%6ZFm*1@AdV88doT6FXX-V0V_c#mQp!;HDv`Rv_x6|HTsnvOuaa6Fk`kjnMj-24 zb*BO&@iqR@hy&rVb2Y^;c`f6*tmB)m6eP|JHqQz{_ZvMN1YF4hv0 zO@5>NX>umX%S_^XFNzBbvu>0NyDpzdl;73EUpA+F#%%Yw)Mw!fKb>3@o3eJl)~-t? z!?puN{F@2vH?HO-HC$yNRgNmE+rEeKcu_RJ>V&4cZmUbbk(fhZzTZ80UjygU;`>}- zSC44f{OZSua@1zpxn(`BSoj$5o^$VBD(IcHm(Yxr(-aEG7&WdRJ=mx}s4Xfgs;H<) zPyY@pPI~v3Jh03F*nNF{C73{m(@C*j7f)7+(lRvk-uyL=Q1l@RANK1jr&?*m8AuKK zSubA>D;fqKrR@w+Vm-sh&e`D25|5N<7C$bF=P5wQTxa`@Fvm~VCf|SA;G* zsF4$_91#={=$%-8cZX+NF#b}G0J*e|?CuwW@6B>kn^4$CUe7Eo?OF7AFx%6#=wVp< zz&ahf=j`#ESss1SS%I8DKlY4bn#nOhCCi?`{uk;eTxXl9U${CU&q(HWGE^yp(}h*u zX3Sai4o@6zUiHR}m7P5ZlF!rf+*ywU*`a_&pX1mxrxieNPX zuTDnNIY79?J8^(Gr{5x z2@An*T}P~7+&VS|fqtts=57Binxs}gs?O~1Ak`;-qONiL&5D}vMIwAgH&ngh>bWno zZek42`?d*Cn^*V9rG*1PH($JDq|8f2j1c~SK>;9*`t2-Is!Ig;z3ZKTm+@*OJhsT7 z#+lO4%}yis=n9sBG`M+!|9Nsnq5mA_r$;qX+CXTS0gUesO2h;S!`Im5ieCP{iDl1P zW3fjU%hSFv9Bz$P7`I1PG>mW{m3B_g_hf~QE=4G?MzKAtHC}DhZ_+dA+TV-eeBD4h z{bm+VrM`bP(R3w)-TWrb9mb9{SdvK{l6bAL6G)n0{h8%w`R=WrCduO?#DWShx2s12 zBb8AV{ymuPg0EBxn=(Y45QXo+1p;WLGN1C+uWUVN`cjf9dDC{)0D?P}V#)MSGFuR( zsFj!D>_%*MblI_jyJ_cdY?RnS9acMnLY;&g69?tm_0J{UvG4rv$B{fX;+z1X*@5 zwUMA9UuUC;XtvbP-geY1-kY6v6N_ND`WqMuC}ZJy);L94+vtpXMmA4Qc~rynC@Cp% zP_=Y)kOs-Y-~&|kc|LMcb5j?0(`M!xe|^=uG%7SbH|KYjy_(kz^dI{LtO|QMDn+Qy zkKZk@NE1$-Ox4!T;s(Yt-km>t9@9E`Uo6S7a%l4Y=hD}q8kr&mM{^R7skKM*mkEa_ z;m+E#pJ1?C9kN^LP!V%v5_L{3D|7qs^-v!%5a@PY4i(gPh`-5eV_Yd`vMVg~MZ2dS`2%2C6ZQ6dV_%OUB{ zvgp#<5A{TIdAL8Is<2FmjVnax$;Fp~O?Qlp7VlR9I^|MvDHzVG;8#oTsZ=7pR{W`^ zF0~}Ua%V8c<4RCMx|@;u8YkZy^20o5A66;VuoN4JOc$jZpUk3lY`d2?>*i;9}6KmXs^hlmnH0=6T~;a8NeCZTt8 zlS-M5Q0ov6Y0Ww6^$AbBe#u984DN*7@I?>c1aO$$NDH*1gjMl`3IFdM#{%HGd_ngv z+zdE^ID%w$Wrj?N`!9m9duUiA#NCJQ2mIUjIkggH@U1Vbk{>#VV01DC4{dB+nz>_x z1TeR0!FY&!3-R!z2HIV{nPza}pRe5|{7SC;gw`00f2#Yf_vH)}qIRkO`aW`Jc*zrz z1b>GKkMq=_H?EB8(mUY*f)16Lb9i7MIDGirF$2=uxjG-HXyB=lhbcRieaiv=j3`{( zhEdCzJD8w@?%%$T+_`2+r__P$2;=B%WsDHRsGl!Y*!&H+lW^zJxWe}BI()ZwG`_1U&yR5BEVe~zH{*b86RudQ zOf+jz1^vuL&yBr*d;q$11iweS5N>x?-M`0u57CkYZ8bTlwn4j-xvGC-z2bs;=+p_O zSF8jud^Yqq(*_Af+!9qTJ$)#_RE*2FHQ=IN+46xW#1vUuS`Sg^)vr` z($+Q7*41SX{hlCXcOO2kt{|0o{QUNr2CBJc5LO1?T6Y3Hr0RL z*pC*=mq;DAf=TWJ>|V-$-Cy(^Ux!9V3Jijd*a(E@e@T-w@ueg}i) zb|#=u{r-JlIZD{^8^Q|$JqkmDgpDXRZ7nU(u=YVJBR=-{!i5XHIqEp~y%6?fQ+L- zm5#2Ew^oG8t(n=s#&6FnuGMlkj;j@%EQny#JyQWPDG2j7Q>2VEsAS1Ud^d(YB}UTZ zgZuM!fqgmfs2)b6HMcLc-beHXA&L;NVCiwKg9k6ke}Bt=tJQ>o^qQ(_JJ`-(6yOoR zMJ0iXp%o9-$8~2=nn1q!4z#xS+MIjiDUlfrNIcoL?Gm;?*#n#9;^G3jHeyzTBx?Rl z7UwRu;js1`4^J?hv=728$R{A9%aFa+b|&suY2P3hOg;n78SQ>p>PEP{pNcbVdD*u0 z2YXAyjvFB9?SrB={o}_sAS-y{T1D6LYz_EmR=0en=IG3C_LhO&0j3tbHo(~GQ7OV; z6tKxfpNhGnsb;m1%t8c2jqv6Fq8wQ0QxlA5s*8E8+IZz+Fqq7pnZg3+%=<6UG83F4F(CfYFn+xhH zGv|kC4gE6WOpJ`cYBl4%R9l&v`pB=29gR&pjDmQBM|MXBNf`}cQ~}i^Iu~%?pGzek z{)W<=Js+JA8Tp=0?JXLO=)p#~YLCTBL~^W=um13=({1stKzd#Zy+87BdT%vH8mP(b zeyg@uz(Uzjxndk^n-*1Tu(=c zn!{k(EIPl)pvC%#7Ci^U=hxadLC3;?`i#BWt&m3z!S{`2j-wBL)eX zTkMF%6nJ{KkE3IR^p zn+V(iEJRSg)j8a61+-^9ifRY97aEPNY=5Sdf#NsFW1CgNzQWA|;RNUxXi(sR;Qc^k zk1f%=8N~*4kYEw`C@zsFuU29{vj-`#c7yrZ;QUkm*pw7$m+v0~0|T*!6%u}Ubn?4+ z(go*juGXySh-r`oWZObHRmjx}mX6}%Lh0S{w=>eM?CsfZmVt{YhK4g#E`O75h+bDH ztLHfj5wNmP&sDB!VtHGC5kZRTF{O z7GKuRX`?d{ZGDGRo))7Yt%L-eiPpv~-RqAABY1{I+(pH2jt?Z5c)7X3?}&q40RB8@ zo-=q{!2nzu5*@QB*T~=9DLO%U@%8@Rkyc5NhJoQ5cm7lg;Y~iR>thIIa|AOpaS)BU z@>hDVTmQf@RRY_nmy-#z=NblQtf{sY40UxM>~Br$>gZg-0-Fl6zcDnrAFC;{vgXjf zAxB1BM*IEv;4vHmI%b7~MuP>28OaqjfCUFC;kBqsdL*Ws&uL=e6kdZIf@J*96a?6v zmNVyx%g@aG0W#BT@du6^ROu(kf*W1Zi>@K?1`w4gqikZsjw1rU(vGI%=92&>+T~)B zR^L23G*&{;C1!XOE_mDhDBhc+TFwX_LJ(P0*_;KzA2R6pUySiDcTm{|j(p zbJmd~JMtH3$*9O5HZpJr0UlxrcuV0$bT~{1>ih36E<*?v1D?TgBvJ*uJ@#+kM<5$u z)h>Cw|HZ2R!nO!j{of(~|GYf-e?R1@XJ(E@fS*ELN_iC24D=;)F6yw)rS^5^J=kz& zRj01ahs*jTcne4Wxf3*FScuSQ;y@W!JruucFUm69cud2w`z(H`P`5*2c1HA3bjE8=22y}LHxmSBLoXM-n?vV= z*r=d!=dG2hnwpxUqoc9$2)MyHM=2EfB_)$OyhGFVZr?scoZ=n}H0JhGhxpk71;Cv? z0+I9exTr%EyddR6IRjXhlwPj$%_B(g{9ARhOfp=( z&jvocb2M$9gT4H;2uXzr2q(AMH#@I2uPHYU9A8VT~MY$eOFcvX&fhS zIyk^l9~Slv$jpvYp@q8SUxZrdcXV{rfe3j)xkpfystJGxeR zH8j#}2SH?nv;$%(3lVs2iSGxp+&X6EC+G!!u5L(-hEBEp6U%N3Um{7LH$FY(z1(yb zbkboMF?z>$?>)(%ZU$7y?c$Xk&22bRM%B)srK2;4aYV(HKAofyRP_c+IWTzOpA^$S zG?MVziB62Ui4n^F+Svmepd_7YVGnm7MGi-3>!cY9@Lz#pC69;*(9u~yte0|`vm!YZ z$bw(*Tj{hEI6(;K=1$_fi$Bne22o~cPlSIsVF4{uw08WfJ)@X zNAp_RAIM!G=K!x9`YtA?r`aVFTpnm^Lm5sW+bh_z^56M7u#Du=T~?y|cw|U6TdIas z@xp)rDXiUorN7OU4<@xlxi1cCQ#C2D@&iJg?acuG?;qt_ekCe)o6e#o1t78~z8Qi!G<``X7r zYh})RfwBM;*u&GJbXT%mQvsZH#0!H*FSNAs(6UJ{ov=l1UVa*@=k6{fsR4VirU!N4s$0!Qb z@!*T=E7|ND2^5vTa63Ce?Hc;kQ^0(}gF*V2xjaxiP)<{N_KrVkvtBj`^J{F!QH*_E z&`Pt0_dpjFb+ojk82&Ae$4(~E) zVUy1Z1D{?A*$u!3KBEX835 zc9Lxb6g5!Rw!fbjj0Y}p_h`8KS_0nPEMoEF#Nj%?m!a>otxy zcv53uZ9R88*1Id(etqyRCQCgGAerO5eL~(VUxPzrk;mSbyQ~Qz4M)!P9%nL$O1PP$zlKqy;~ReF2pe zH5C=Ky8V|Pra3<-UJ(akt??4bf523qkGwuw=L_M;5CmAD(V-AhPnOV+$^=2&ey9SB z!(ex!K700BhQ^9j^hH&KBXV$9WIotz2BRpl$WbLwMS;imw8 zwtPyt5EE6bWn8Ne>_l)yNP)i;Xb8wNdpjGQpFV9uMI>ST*J)U&?XD-tY{d z@POL(frOWa_bzzy!0h)8FUK~4O<7sp3wWN)tgM%@u_{qe27sw8G&J-WDFaQo(gD*_}4*QD0^ZUfboEtj-R(RLy$pd0!!NQ@8eU)wNzulW+b7vL!G&7X8j?UDNA7H<>14mYh|NcV`Dl-%^gnmCFuOXff zQ@-nD^u$4CC9jI+AsvGdNJ7oUr-t8BYCnQfvjOWnlxbjv`Ksskn13Bv9@zBm87QYJ zVKjlT;taiyn9AxvJOUEQr#oFS#;(UZF*X*|E2f7(PRF&b!Mb^6;yqC&L{4<80zA(! z$woYJ*|y-2TZia#{1lzVx9<5hD{E^Kq^DHT+8b<68j2dwp>!4d1$Kwm#!pGtshe@F z{aH8SGULd@VVHAEoM7<{=v&jem-Cxr+mgg_?=ry4hLG%%8+TkYDE`!jsf;p&KilMJ z!4T&Q8`Smi!?|Ts8m5n10~>sc#2p@8K{}|@5Bs-JPg%ixsimFe21ujpKq*6G;EgDe z_-g#S;?5EP#*VztRY7?OM&@zy%D7_OH}Br0mKr_hq}Vsd_b6LIRcWB!;2okk-5!urNK%CGAy^KNDWM7 zPF5%RZ$16tCPo?ZgoOxT7`mWf7cd&FIXJYk2sFqE#9Wkjly1yE2k#VEqo*$Ef?fp- zHpsrkVV8;IpdSpRdE9(fxSgFHv^n(7X3nvkX#~bdOB4C@WLzUN!ln3a+j>1oNJxNZ z)z*Ie-c*9A9$Y4)(9F8>xY>-~{MmbsO|WOJuMatiEEz&W>Xvf&Ww&l|r-JZnwO#=- zEYxANt@s)LB=ZmPxy~9nQJ|?*HLlGH%uRCeV8A;5_qLjxWG^(huhk{j`XKB8J9av( z34$f??KWeGa~>MYI@;TlL|wjv_hb}y2{3n!vuBoZRX%>^< zX0)-h2MKaKhVwS;Drlb+x%+|OKm9$3Gon-a;115c#neBf;^HmR?vsR8Z-nsJ@M$O{RBQN-~MAS$j_=qzdL>{RzU@zDnj9SBCa z=;WB5@`MDs75oc7Po&;^0>1P4>q9UiY=ySuwk41moA?PuiH zt>{<@NKlp>eC)FQoGVr_qZSqxFa!~E56jx+$t3&WF&u^}lH3RMk-o_O2Y+lykkddG zf!@;rcrc8kcF#QGl>l0v30$?8OaO$U@7dbULeK}~0qL6*G9)mPiH?}h|oRZwHxqZ(IiVxp~mfhe$Z8rpyn@c~-+W~kVcLey^D z5HOaDUb>oOrRt>_*V;r=4Q;(B<|CH2h>0J@EG#VS@%u5L!VnYaiEo@FAY~265aKR6 zb8_3wUZM|&Uo%^?jkgBOWrJ-#EUM2qTL=#W9K8v z$8(aG2)}#_lpk7oJRrH^-F@3TZwyoNzs z-RIMb3hFKU-r*+ZgOAsBz}~4+fFLSvn0E0;qlThs7vH8|*>F-S^?G*jMc9%kJHC>OySeN90Rd_2?dFU2)AnMvtJW&TwKdL>(%jFhGbFdE3-s!1G9zz#oYjPm_*9^tv*8Eh!Bi-YyLQafGM2 zr%e`6rO)&T`0LGokYHC>b<*v`lF9-aYT~(C+35%$38<1x98Xn7^f#{aW|X-NU+J`m zXYf@3@d98=ClO1d0^OKe?vLi`(!+%BItRdP3zDLV^Ls)F3R=)f)Lrl7_@f!OxHHct z1}W$$LJERx`m4?`FP;hiyt^UBZ8qw{4dC}@sUw=r1((@Rokz3qj!omja#JX2<| zqM&nH*q~M5-15hKj;1U*dKN5PNGax>5 z=f7z3P%Co-;eGio@yWkh{NOQ!Eh0t^nkgd%l2#ty`qaNPd@@9a{15G(B@0ZNU;&7Q z<@leP{2{|}7X&e|Km5_+11jD_&6Rq{2^T*8V^lc$PYwSMPxT+#{dL>xWAGrUS%3G> zzo_M35SQ))`$>`A@Rw3fMK&l5A>v<{N915O=K-02QqhOi-hWWghdUH5Zo`T21^+=U zAJ)y;w+jE=aDlw|CFB^ME-{3LKk*ufn}1Nz63CtZ!!Gf^L;knG{(m~;ZV5RJf~u5? znG1`@vxx%09P(#DN>5j0i=;Y1-KG5!s_G^SeYHWZ+2_iYt)*N@kAEqbU4ln~G0acd zwZHRY&?BE}o6z-0lV2HFQaYh~F++pK+2T>7OSXWi0C zLTZF!UlyFsZYUdqOj0t#NU-Ere!F5%i;+ zHwtSq14aHP6H?0jhyURPl+mCq=b|qu_t^SWIfwogF*WHf@q1(<5dn~F_4m-rU`Ie2 zApxM?x(~+|AuWDS1)<9w+-d)66?JgnHixDGp8qg4oC#52Q|@seUfM{U_kf`&M06L# zhXMiE%_wKkP*(OmpfW&ly8xP0W}(3VK9vqb>(C?HjfDebpieXH)^*$(Qpv;%Oy}h! zg98A3v(P$v*l`VRMs4l0+y;Wa+in1ZJ-?s8@U}SRkxFtL8gY<72u>YA2!up|K%0V- z8@R{4-jsbei2X6?wh7Rl3FLL%!Tt^~Y#!CnBZ)@e&QV(&C>(+&J$DeKuVDYlhK5tA z;@tIP!Rm=dgOQzoYGq4p!|v(r<9}|~MLI@>UhFFApLLUhlW+dnp$9QOkmXrAhjJ80 zC}gN*uiA8uy0rnre{a51V~sRDMR^j+iI|n{MmXR`wKwp6YUi~4`Y}Ab!~GBM@wzNn zrnd|ltw8E^fDRah-+^Y(S!2@R^9-aQU3!7gj4A<#1KjduOboc#p~j}+b`(rCy_ptu zi=zzATmc2KE2BGplKRlBUl0g zS!@!(zwxf6r3Eoz%;VH?YcebiG?WDA$cbLv7TG5BhC#meoZ)lV-hlBRcMuZUti>q^ z-cQ~~yzfALlt~fU(Kwo-fJ%i=FE>~^c!eDXwV*%TqZ;bW^llDwE@-ZT)>A|1HL}~x zRXBh%2_#p$sxs)q0Se;PT6G#PEf04gv6XTbLJfS6W_GS@R ztD96MaynCwr+R{gy;AkruqK!w4O@LIpPbp7iPKzZn5_I0Hm@)V(~ ze{xZ1D>F2mrZ_Gc{2gGbfEg`@29CW4s;kY9IOPrvYlx@^2DI->=epc$K^g)-`0ix| zyJxR-mn~5z0!@uA6sVf?xWG9v4jMX~2_hgaE>2F=1&*7^3O6IC`vMd1!+T?tAF!3_ zvM0p?JBfYOJIes*3iuO!sHInJrj7%ZJo`K}{Ym3EbSuNbCeU8@Y1|o#7(qXumB)hq z+2za8bRu-caraW7rx@5lX_R4t|K}WnKXe9?_TLJ*o+|i!%I0n)Y~3|DPUBRN95fj} z>YR>dvjyp4sL}~e(SgHDT&wP&z>LZdJz8*30Q84~!$kla%WG2SJpKXn8i+~O78X9x z>4)Wg+L_=7!?|G-9|7E2z$#IRy>=U{eR~5NL@-4_>`D4YO`f8^?h! z1XTl7FWG7;+yM<}#n#*05F%C-e5&Y;GV-@E`CXrM(5%o`AT=!AfX59P1$T>cKU z*c?U*;wp$ngpc1RK{5UHZS(YsB5S0fV-=j4SB#?%S88o-r8S4+0*W6BL^LD2w+Jb*dOgua#4ba6S@E9uUgp~9id>F2j9Z1O5>VK^5mAshIpT%ehjJ?}(i@)%+4 z2g^d%x&Isp^{K55937dN%}C?G2vD$4v%{eVqj~~apG6eNpSJL-OShZQj zpgzzPo{$5B>`f=qJwmVVA?z2`UW;0MdI4+@RC&Ekmr#o*!ZW6zMa5GN&1Wiww zH=yS|m^)YMN}gWWK(Px=vAwdjY4qFxNe7ghp0`Kw%5ETlkh!Ly+lTCkuOtj4%(0tUU1 zpvvYwfW~w16hcFx9b-N0W~~5oRQC?7shJC1tehx*Ofr{UZbP?mJcwTwr;eTiVy@Q+mmjgbuypPh9I^8{8}Kosgr{>?sw~p(3>7*2h8J>V)z*(_I1LP; zqrfwzB#8Y2dl=gL;D+nK7XcsD)^-yP3Fz(JS(^uN5Emc61sWSP%7KCeSL|BafTJd^ z^72NsnEKU^ezAuRO~=Y=3}&!qios~-E^MDDHs9^p9LSKh93Y24;0BR;9MI@6s8k>& z%qWM?EAe5e6i*P~g8`I_i)#V&4hbe^L7Q6;zd-H={sQ{<5Vappjt~RufX5nQ$Az=b zpi9vis0)59*!z+|e}w)aEUI7g=dFl1|pPo^1~@0`aggE+%4EX zz0#g6naFSDcLGbopMvcdT(JD54?)q68Cc0g;S?f{J8Nk({efz#Y!H zw^eJe>eYL%)!~nOJzJ3PTi;r9j@d`=zp;vn3B;-?M6qMBgsxiZg|<)3^?jj#miC)O z^u&5-;LZ;5AAsW*$}HI+*?d9U0GJRA6ohx7>Iq((1TL_KrWYRCl~hcb77Vl{e=2!p z?Hi8{qIZ#*mWHl)d#V4Eo|GsC+pycWs}>}@?Wg=mY!aP&7)D)KHqk=}wa)v9vjfYf zo)3?Qwx9nnh;_NP2ri9evG${CDAyqL#S|u_f;x(Ouib|}oEtA$RpA-vtX0cWhrzkd7eeNc3$NUxE zT;5||v+d5<(q;j2C=ajAUOBUr?4xDlD`Z743l}k+SW7h+QuyeCFg|x;+9iAH@SF|n zz=f%);L*fVsw6hu)X0PPh2|=5!047A5=M+?wd{|##3!(!GA)+mDtxB6^{KE8UzV}$ z$?Hw;fS>$Ke_p)Dw7;qOM{@W*lSX`Gg9OLyht{*tY z6K0ciF6O~+Znf>K$#+ZJA70OTf}XRSe{4wWP*Nd$6AWj(d4D63#_Vk{^1b+tTHDjr|w~PDLtjn<~F^wf+7~5IR4!TPK^}*XbH&s0Mx8P3BF zA?ZeOpQuwY=4;?Bwk?{t-dHSkeLd?>&?FFt%Ojw~DXX7X_9w2qj$8CRlrE%>E~DLiY0&74PcfeQCqAodWE}B9mCQK1@P&&ffHqSETad(_d}3%ke#Tee0!a(HnjbJZJh0u^ae3c>er3UWh=Q zTMoVJtpy>-rOtXyF_oSA__B4T85y%M=>h{PVAKz+8|aT~dt}-RE>NUW6C0x0c`Mb= z520dmM+Ueu=B)X$iXqr!0+$D$7aW*h=5x;+23>itn;Bt_(EF_W%TGlzCcH324X+B# zuwjikF|V4E)Jn6DX@(6&>Kc+pS@X-a_+>({~l3%|3?j+TYm<= zT+%Z*Am>$d`s&tl`SC5JJ?umjCmPY|28T~7HUUc`+;}von#5oaa4WI-S(JPK+#hdL?h&udd9_<0GQXPvNl9tM;8bK_LstK|Mpe`Uzc?u_Jlsb5oXZ!$C839BR zWMwlybX7GVO2H~dTKR(f50e<-+Dfs&`i{d_yK}(`c&mu!>(X|2AtLu+nNr;mwGZ&( zpk7;ks2fLLd;14$zQ|z1xQN~aw)gFV=D$~T=oYz6pnm}R(B#;6B%=st1yUI4STCPp zgC7CDpR}}FFu`$F*yLSAt3SjESk5PHGs^$&ml-z4ff;?<(=syGC**9O4$64H*ywYF z@Nxb$^MI3ZQJhJBWYLRBacRH0mKOC@92*aUND7jsRs$iJ_#8>d$mk6a`<4cZr)weU zETfH?)HjKw;Q4`O@DfqVO$?SX&znuM9(P6(TJp9HHxgXFJ?<*chRpyjm)hD|7$cFF zK``OJbfZ{_H>2ALsxU;CnDea`;yv>;slZofh!<(UHA9T-qw$%`&P#|$w&GWguR?9Y z8b^5?@zcWiN+GHxXY}IWUPdQo_em=DpnHmP48xjh*#4Fu0uj6Xk3UZN^&pz|1zQW+ z`1nG87x5p^snF>>0i_te0qm+EE~eH!Mu!=m9V=A7!{hVO=>Gn*Ly3g40-;8w8I>iH zTLt=AIMO|x{#gMK%sXq*71vQ+kaGp?uVCWY=RJ6f9z_`$ktqf^-a=I1+YfmW;Uwx`1d#PBuK;rXl~wXF-W+u2iaroPApGK~fM#A# zsD8L0rSI@c70!Q$oj`8>3+kt%fhTJB9_OLNSM7u7X^$cy6*re4lLx%*1bs(j>d0L$ zXJYv{ye4=j^CK0c$MR`v>#kHl_c(2LRo_Q1x7FxUOGhu1@sF) zm3U1|Ow3FB=*YXFz=c#ZHTIo+JD4u8?3qg(k zh`dmd$V)UjP4i)dvU4F+Bva;?rBRmyCn6#uzz3ntj!S^sNhd75LXUcRUJJpGBke;t zF%&&$j(ZR%LJ+10gCWae8AM)7sP)2pPZ2p}?bi(G-ktpxqHq5BNLqi{P!fs0Li_)u zl(+b@_g04UC2KjXI230kfcUkY2#Xwls{ZhUh}_d4W6LTmsbiLIuQ{TY^hBUE?ddV$ z$W>drb<+^-3630l=~BCS#{KBx>iuUqllsBOSI^n5d~E&TGHZ16@Y_~h8hycL^I+~^ zvUySAYkztpB%NZEb**0L3n(=ACx!o>s@OL(*4FmWEHEPjKIY<^B!K$t9n=R zPNq%}k1;%8dlbTO$aA=RW4}PF@z98zN)8o_#?xJr#hsB>Sckz`z}*^LJ5jxN?5euN zkg3u)Mr&A=-aN77JRUUshtffI(r@acMCkSWVm>*@JQAwd5jDrh`u)WUCiBTxGEsN#H!5xAe<6$X-_qP!eGCjz70 zV6$3^Ge|{|v^sj{Bo5xLc!SwtvX;f52|UzMz(m{NjKPtH5oS4fDtAz87dWzW8HvGE z1IOwQxRYR#I)l9dN;-7U(3dQ79PI3%9TjBt0kpTA3=%=KpdZ35G>6|aGH}iZrC1AF z9E^NNkG?|AQPgwRjpLP2E1&#GWtTSGs&DY3@#x;uey|H#ErPjx`ypf@w}yN4uJ!|H zNv=6CQ%(aB9LACkhPANp7&Zw|_Z6FkOK-IdFfC~H7toR@y;afSihnGeQ|Bk_HWM?m zI97q1?gH`Pvz>NW2d;eH-;t_G>R%$ZNZMKAqWo%sizI$2%V((vH5t<$j56<&uWIua zVcVV&*C&oWh<+efC&Mc7uiZEhI0Q=J2O1@P$J-K5AhZB@y6kRIJeec%-v(`QB>UIU zEMw{!#_v%VxC6^+k?$mcJCX}O_ZS38NR>r!O6@#+oiqSIuGg2gZ1r{jfj)3DS0Sw(Sd@&aAAf`U@b1zlUL^N5;-e-swp zI~5%X4%rYvDmbbKLT;;%zW>^OBf-4i`cA9drB3qcxc$gp>Ar!Rho?-wv3jMM=CtY- zP|=_+R_3vWwoxX_58H|}fvCRkcqXbE+?H_PlVmyuub}dA8^8bJGl6pAvF3&nGCApL z`2z%07|*iq+<_%BA1CR_(E+gq9%qsnAC>R^$F`+`aEKe5ncYZ$@s1F+Nlk<}0{{ka zHTGb2eoHs?{;kI-2#M<$_d|pRYfGCm_slC_w5v3>2Pl89Jxo6(b9miw-a|B?>DJZm zhd&tRmAc_=?Gkz{88ytBp?B_6=o(2p16{$7)P^K&f>kQ6ITF zS(%^XDIN$EqW4kj2(q~*xF_!0b0o2bP!!4MTJKyd!P+d@$X7DCwdruU*;x5C# zm~iw4Dy)Qz-e8r32jE0SnOu=A4saZ*H_~a%uHe?7>43hC#Un~hSKvFN(OE2Hkc2q6 zxC)V9BBtei_nro2*~Ny3r?SbTAcCe?LMJd9*1B!zcC5wVvg)c&^6MH)2^B&?4%=h1KFx`Qj0EP6x@wny=r#E7Qxc|}iMn8_$}uy?0vWQsdh z0B~Zyk7<-Q+|?5{Qi(K_xymP#n2mCE z=E`?^t_~>7{jO<}b5{Nq#2$Xt1*|?$p-&0SDdzSL|-Aq*KOFl zJfFwnpwsRIHYlTyhn;ZBfI~QuUL`W;q95N;HS>wQq%Qg9JhUlN-Qo4rF^e&I8kUqQ z!1T<;p;F9e+-v_~9K^`d+(dv9v88NQd~;SGY|a`LsV)&4TtQnI_z=+q9# z^qN*>x!g{OD72nXSSbQO50|&ekxZ}9O!!C2j+@6*KU(q;z6*n>XKo!=k{H=7#Gv1! z9cNpW<@d&qfl(qm#X{-iZ_g|9d8}pD{>CD~@RwO`fiYsVS!s4jFw1N0?yC$RyMLy1 zHmE?8_I`nmCS1;24IDSF7p@jRTf2+BG*4-RARR+ncw?T`Iim&F=_(34X;$md8%K8G zf%DDCAm6Wa3-r@B1zGoW9}#e&-vjtdvEtpFyo$T%KKfyYsPXXX>FaOvm%&mGp{~tU z{5Hx|MCdHaL)ho%Sa{%XP~T$d!(SNt{Vn{kay^5lsw#|TH!Ew3)Gia$9qgqJ^h@VaZpyZh@@f~OI^=XEIV{YSkX?CoQDA{mB<0q;P6#O$B0xO z=2O5r38yjb(F;g+zaj0pqfZX4{R7cNL!7*EKuPU5S}CZ6NPjgBbw6?Jbn32tcB}U2 zv=rknXpXF@zE=@iVe>7x#{^O$cBr_RvjQ~T<60wVO$?W178Q9^MIV5LMdzu@Ae!W2 zPQ5SbF8*t4%qkN1>@CTobzdBiGepe^ZY-7-pbC~r-1{}y<-uLVw%+A|2(aZ09S-Z{eSLvbv{JxCx6<+qyuH@D9~JWCNFQhkLt*8v7cVTv}ltc zoI_*hw4kJX_OB7AZ5EJ^J-wXbNcoRVp>rNi9- zoI7qUc<*ueeRt1LGO$eG{5O5MAR?}y(2m?^2MvB6eKZhuzzMv|3y5^#{^3WWKvQ4$ zTarc^ilspDpR!=HW4sF(%3W_`nK2va?QQq>CgIj_(`P=c(tUhxk3nu9+Cb>AW^=B+ zd>_ypqaA{hl5^l%WBwC|8G1@gf!=%NfHX6s$EcElOBd)j4i%}1j{nu|L8rK39xx9H z3XXK##IO$eXrz@;L2oIcz9MADcj}XU?Kod7F903nKF4FLr>4dS<=`08h2>898fn+U zg=Gu;Xa$lDHN6FF1U;i1+k%<07$sl%beh>ud+mQgeT8f=B)nfH*X}LPA5y@jlMQNN zkPY~Smv?~PwbpsEva#~f)1bzW*7__~1AB5K-PCopuS%~dW4`1}QJhCH;19e6q6H|E z6}3x}D=mX25DrF%KCMdTW!IC4T?seGCu(DaKpcQ~Ha^I4#Q z^2zug_f3!uO3LU3YA7}~R%NSx_AqUUg>?9jUNCPU9d-MjTvx^{Ld*NkhJY;yCCZ%N zqkCNs1daXJCXU|NVvQLsLi*GiS`Byx5vF_Z8?&NskHIloyjWtbjWdWJ-3x9dR3vC8 zHYgZ~dWHlV!c03TVFys7S;rS`aYRkAyp^JP9kCV)lQcF3)0;9XgMM*I^5uyiTW}bI zdYnVYxgq~jJ1|?=KD!sd3C9$^c-M+>RDfpK+CGR08*!^P&;>|VAJ>+7x%WrPvK+IJ zG&P3vbxOh!w#zBZ(Lm$!&Z1oCY`CG>-@p9CA1g&}HkJmm$X(u%mLcDC$Xj4r0OH|) zJMZS~_fU0NCa}#D9;DO~uKx)2|2q&6s+Cpsq8ctP8QAs@1{<#i%~9&*azVPc zO8;%+mNMt~0eutheajXt*8@PomYNB;xnFl17<7ScQ4s7K z$lDk#m#ozwa;b4K2oay?O(7C3=&}4zoE)E<`(8IL-(5zES`AV=FfIa5BPo4URZk_^ z_ZNR2UnagB|NOE=nJ1dfLr`f72Lw7JQlL#v$Sh@$ znH%u`>S}5V!bgG%WBHXs4$WnD(@SLSNuFNVHvzUE3pD9TEnZ;XF5~vGsJJ!9A{ayW z&ZPkJ;HPYhG7Yq@b6~a;cc-a|zVt;R)}8w88ACzV+RNnKp(sg-|V-^$C#7pZu9hyf6-@Y6+9549jdAF~it_Op4 zpn5uBz9_vBMiF4H#uQja3h7ZP7WJ%6&&QXTuiPX8=*@=e4H1E<Jsyw^=UI_~J0KNK0M)CywGcGzrtJQ8TIfY$h?_bYok(*>A627Fd;vb5?Y;8uc&Vq{hUttIT`}D(qI5Gbn z)9^p5mmX?^UW;JKkn89F)f|vIAXQHnTnkX{~zbJVMHFjVd20KMr4sm zx|<|1LPIm--vL9xvgsy^&$lW%gdfm1jo~*bN8Kh4p9dy@W?y$@O4_v$!TgoNsr7NC z)YNKla!2F=K*pmO>p)~c{iS5T@sSz+tFrhUF&0EKaagdkArF>=Qc*N>PFsYsyaGy z2bd*5O@|wtZr!BYLE}HO9Mv0OPGUz?11L%yy)l%+(5XR7&>4faUwo$Yet|vvw)h2p zqq7YeS~zpUfbCK234u)JMpQ;d5DUFV8VktVIuBPKUWefK>IJ{O%#g;ZNU#t1ak*jG zIp154SSzP~zAAc>bxXZU%0u^oZoPwYespXW`neDU$-Gr32?7+Ihq-jt`yV__#$vz@ zXx#0g;J$z=U1)c?=aD;W9$$}kq^^?_%m*No3au07EnNuZ^@L$K&sMPY5DZ@!Rg!aG z_W1F}w%O4N1CarvgFCwZ)H zdGVh3MCs3u2>zy~`h-U}?zY}&lzY5=C51T`F>C>^7L(&$lD{SF0ApewA6;O{te7n? z_v>mAFANJG6t#n&JK>#6d#<(fnnCfcdpuL;E^kg9nmLUZfGFd943Oj`1`Thh&W}LG zhmxDTLFRUo@$;tUH_AJ~Ae!i8jD5Rx-AcVD<3D=Z^x7}LC=paZ<=Joc@)0MYC@-pi zG?p0&m9Sw>;+_NYSR{r~sMfw+@Q(cr``LPNH;(zC)QlUv{i9#Jt8{BCjUw2W49Ih< z-|zhnOisImMbHEK0nBzJiv!RXy933a(*6($@ex=r%0i2M^$({bjN3;E-`Shm9 z`me;D@${stx>6l{U#)OVBZ73@A)TVSm1yCbpE3_!C`DD*{4_{NLK;VYxQnNuMn`>D zM)D!gc+TB9u*w@ySs*T81-J-WI;3LK5~qWD31lC0%00HMNiX&=G0HF0r6( zK;F2GTLVK9#=msL2*c+Xy9e7b+dZN0 zCxcaV4Grhe0zy;n2Sgb7W01Bw82cTc4&1O~^hRh5NLt6r*UV!^vHGT}S}U2`C9MBo zGX`z`2kd}167sQ}!ia7enF~AV|I9hm!#n->a{p;Y5oby@>BR{ELMod5b)}tKkB&iG zTt9GsVmJ#_uB&s!(wzS*BMm5-Khtnfk4^%zn*6T&1SH zui)E=E955sH{F)dpBLdJ?}Fi6z#vbRx*X`T5F&Ro1u6v919(Dc$VJ#Y#4*eqiXVy2 z4Z9F3H24-0a1#>;^p!*HH4Nb$D-MbDWj;)kmN7d@Z-kZ!XfB#R65kl>z+s#dy{2#( ziU-(kW*|&q@RE4xJ6K?d35my`KvOLwDI78Cj{F?k9NlbiGlEV-9|z3X#K_ypfNJFx z>>J2D4fSk``o%^jQpcKTp-7;n4pxJ1A}&n62rCNB#?17BfD{YvaE19n*6T-*O-WXU z^vSuUqN*wYQ*pMIhW1-5d5me8MW5XNZANx!aHO!nXf+w_180-@rAvPskR6T*X=epS z{gqWg?#6>v+Xr{o;~kXP7_@j8{A&|y`uNuvm0q?Jw3D*kQ0Rq*@=KiCyw}kOg@@-| z7&0x;K3co0#;{6^6WNmU1BXbC|;jEG>iXa)C^vsk}zPfGw~0I<<(beu7o5A)^Jb~6~A#UD|W zK%fMc8|fe&aM?04FkTT41F}=ZCxn|73);UzOH2SQu|12_4tHLQfq{Xwad16f=hzgs zr+sp@KtN4mmAruo>t{r^6@9+WNCvW^5fezqclmZm)!9u))ll}}?ne$6@M+q>GEj&> z^#H!_0gPW&n^c1t5Tt?;ynzb*0Syel2cTn{0YOfDjY*_Mx=CIx2>p7Z zTLNE>PNwp0@rekt+hqO&Dq2A$P@b`TnEFK+ULKULOtlBZQ9+>(r1`-lEas9QJutn> z!FO-PPnbmT{LBLSVm3EBgKZYFhh*;uD}^tsJ{=)UNun2nFFVVwiI^>83%pJ+KQg&| zTB1e+jtC5Eh>@U)pKVfMzGejYu0-~Fx!}DpF5KGk3AhGqIQKF#kWpsVGry1LD!58F@Rnl67yNPUFnEb?^6_JqoQ0DL0oYAGaNSJ6vN(=e@D^>* zeQIL{6WBUj(e)uH2^=TdJuz);4wD^dwr&N>1(#+Rbte`E1lFSWTSva_(u0{}2lXjG z1H1^Eyr?V=bh_6hvH*HEhYIA6Y(;uII5}}6vY%*A>cZsm9s?nj+mU1bzL(KyM^9mm zgaw%v&nY3{j>2rh~G#V4cOKsJFn|<%^Xb3GX5Ck^hx*UzGj!u zN5?JB`4`mfws_mpwsZBq_+<#Y3d;0F*R7iEq?*+}Rt=R`uP0=fn$1`G#3Qry3bxf0 zUK7C3W%bqj@c5ol-)~g)!%ytCqd=pohrn!;ib2fNi|TWFIug zVQEY|oia$jj#R_81xk;uB$b)py26YObn0}rsa>bk^rdIob~*X^+Ve>Un7Q`(sd>uB{E;Rj_vAm2Q46djxD$*to{p7~%9`VaU>>CuTHA%;2%$YpBF{N8q<`KAhz z4vFUA5C~m9U`w#@i7kt$4ua8F3xUdZWS7_S4UzVE+;9h{q^3FqM3qFW9$coBP}&CZ zYc1?}ILbc7^8@AY*w*Gl3AX!WKlT67aZc$L@3Y=QiYIr{(zH=a+#Om~tqavs2A&{T z_wJz?fGVeMX+&qmC}7ND1SyTfn%#v{<}0^L;ba}UQsj~}2E@ei={~!}H+s)=<_`90 zzT?{3@6fI^jl3s}0S_H^*ME6nNi-PoW8xQ{r=B3ZPbg6ZHTmBXmdy7Qwo_1iQe>_8 ziFjK~NP$q@@O5_0ig@rlGL6?S1`XbrXZJSJk%IT@&BZ=1*+t~YVcZ}n$@xBYPXxvM zB#rx9QfwT*;CxGZ2kUm9Z#?vmVIK2FZl=Ev@%X<1hx7)EL0T;h*j_<*c;XGme`pzh zy0aFBlKhfJ{$gbR2T<~hUHtzU6XvXPo#37GOU}*@lPT#*jAHp{?zXQ2acl$Fy}oWB*FP39A-V;yt~7g4$i-_3tEC=73lg zntT|7mhf)a(6apyC@CT9+!0NVX5cw7M4P ze_fmo{^H$asv~^uF9Smne2wrFvq@t8096TzfP$=JyKdsJm4#Me-^fYWGhw5KbMFdK zW+Iqb8T^rjII0GO$pWi(a6A$jP#VhRl`0t)k!-%G?hCSPv75maN2DnP2sctLC!j1c zt@zJ@FW-{;Lwy4`%`VN+OQaQm$ z+S%D@gJ5+pEQ9|_OW^|Cba>d2;|sh#zF)wLbog_&%lFndba&u@c>Ov;(4rO=HG52@ z2Vn5w^`MYfk1>ruwERcBdGsv2v6Yhc6N2m zjph}TT*tgG6j8(}kqBnP6r*1v`zJ&=c;9ehd7Etpw<#%}<}C!FVJF{9#( zod~=l!q&|M3|Ns3ONW-0|B+pOV1xr|fipWTnZ5(hFP*r{{RB2t|Jj_7m3_|uUTl^*xI%1x$iOA$t^P}wFZDv*H;rSWezq}kqX@y9LwUZ*Xc4&|TtRq| z?qu{jiV7*MU3moqfgqE1^U(qnz2~MZU2qaS5rowUvocP}y#z{mlcfhtbG;n%o17Im z?jY`;_%J7A)CuDh`$iZ7<(z<3-vUb%+$nu9c$ZK3S<^vRr&t(|umH*G5=?wwi`dPx z9>~?bBHnxc?;;!|{?!?QeTh`wG~6F?$>u4>{_X#kwEY&>)5foG36{xD&q_ zbBP7XSQF2muUQ2pCZSi0##G@0RWrq4IyKWe!8ZfW0AFJyvz-Xr#d(AW?)j4-FZ(7$ z79SWEqFb;+-h|7de^Eak;IUoRnN`1fPaRZn`W)01AtgBi}Ht@bY zwP#vs1rwJa^N?vaC+nL>&*;~d#n$4VVD<}hvp z!p6fvr!rFLM&!-G*8_^CoHKa9BA@neiiQke83~^_wOkPB!O&n$!VPjyJzLuTb9HH8 ziGCk{ZQ@=}DYLsvchA+jz`0|cVnUg(-OmayOfJyvaeodOoqn(H43vLWr zxAW-E!pUUiwl>)j=V%0+*4h@#4~SEyK>`kjob&Ll^J{&iGpg_8toVt?4~YV+ZFX<% zO4;klUV*c!jhp}8@xkg3Yyw)v{eI;x_*^ilg?8F*JiUGUwv74gDUn&Jwbc=A=(1xyE$jaM#Uu2$Y(=G>NSnzTBF%(f&V$Yj z05gt==_RclQG_?A*M0e=`e03-m-H<2wJ+w?1%{QqMfD!*+M5n&4Cy1>!dec#)q`7q z&~GSXHV@tVb~FJZH2gpFZnA?O=I<}VkBKidXSiWrf^Bfy1~Lxz>Wt$zj(2PJ*kLf6 z=cSEQ6zpZ+wuewu?{^$w1V+RFFCD!58Mr0gJ~}l$kV%zB1at$L?&8*)O=>%0H!v6zMfr+dwTKUyz+8b_*TeiqFJ%;9HUowoe#W)6xn`s;yN= zk$n_7zlw$K3dWxld(14r`@egPJplx0-{G!T0GUyP&A}9h)jg2U(^Kx^Y!9I6feuAdseDPEaX9Wh5qpt%`aDvf{ zg{SSOuP`gkH~Ujn?~-|)HEz?@>{ZYtx6;zOqZTO0+UJ|lHwiELV5PuY4AO(-jKTx` z-pP5q-QS2#0II&CyNJROB@OE9J9nafA)!#1b{;eGgLCq6e!d8qm2wjSD>U?7#1DcG zA{T_&vp5N$&8B_$3GKTzxc&na9=1!G?=G|AD0Zlp#bH>~P^!&op9 z;SLpn>cpeFHj3Ip(yi!Fr|Ce9Kt)C6gjNIU+LpZU(4sI2r2;BH!XES-cDYvgJ8tg5_t4(VLxofzacPyqe@pP68X9)qU1^|K=uzp zmHC^EL#A@)&;E3N=ptT(D}r)GI{c^)>l}88GXCeDe3X%R`_2!B=F7LQF%?f( zS;7@V;6dOgP0ls77M2~;in%doc#-?H;x_?(zjGUHC1`mmn{_p%?}q4Pgy;7c{ZAMthj!1WZxP8b8?r{R^5G<(bhORoKx(OX700<<9Fkr*VcO- z-uI1_O=iCpT)p#kZPxbjr*l6Z2_XA#<`yJ=VRR^SKwNmpTv;ac!rqwH-%4P|=|`n0BV0i7%XOo7l&QtB))iV5KwhLQSb4Ye<& ze^c&qMq!Npf-DOb<#Ra1X1GU3<;d*Xh)G-c#&h`~qERjf6JaQ!thZ2qVqzKQ4*MrA zHCu^yQWG`)z*_8rc9W+T6^Yj%9aMuQ-V>2`+~QaVx7-H|NQk{JQm5O}(jq@<*roMGUw{HYVt(=DL3Km>Y$A9BEw znqCp!<5x^3Bj!xb!HBAO_UW|+sUz#k8!9iy zPUby4U(K2`|D_%F2rxf(6AcZG!-ua}xAckti*FY&amR2b9yw2>*^`A0`l15mFF4SAB!+S7308FlGVdZ3Ni5jERF0;tl)%*Vaff-+o3|7 zuOb_J&R)e^yk}lg?tGb7G;$Y%2jnOR!DB$$rZ4jlq@VFrV3+Oka)u$i&ZMDm`NM#LI706B0%Sd`kqi#D)}`0V=` z6~W(PC99!s?#aJux%gm*nIx;HYjR*Ra`c@DVgbW+YF^xTpvt8)zPni1N>mKP;)4;2 z&;@f-QcANqAJs;cwbLUF%S-1Nz@Dsm=h;WRwr8hQt?yVy2(VQTTvX#p+8>Z())};? z9E_H%f?kfDFPn;I3FojbijWO{nZO2JKL zpR^Ne15n@LtFr9L{`Ncl_FDj%L+a5#MUFdGd4=D}8Q{CHT%PfV8M;N*OYJ(W1s zP+Ot9ufPte*2=06$s3Fh4fLFD$8CaA(>6rOvLNyLWzYrxCPveIKq>VTDOZddBG=ar@Kw+Rs{|>hw zd5-aL=;{_Y59o$|z=8|G7J_hj`(ToKI@XSsTnW^Gfn~w6EFM3uFvGC%A$I`DZRN*C zosZMi-=mZL7+rW!GC`L_7Vn!F3YUf&fX6h_>tUjV0Y6eXwRq6qc6u<-lhC|0(lsIR z#lj>{;3dR!DaRTk2rXsjkwb^Ps8KA4bnPX(Ltz-;z;NfcrS2hgmC5j7?Y zSuuW}`@uGZ;Z3Webqo#fT~}%FcF3%X<(QuK0t~;@o<}p7Wo*~gl{4c$W$h6Me6jGH zNz+XQ4Z5t|-bru8M4*C`qjlB^@r4dQO<cYXQMs}W}6q$_iT67(KCNO)P;jygv^R60ySn8SZTi3Or1R|Ug?b4eK@ zrrf*F=!7}sW-L(-T^T4hJ$-0S_S?1I4J>wh2ba-^9!wlR&>PrZ*{@`9)k(MR;77)H zW=wA`)F`Jmz1Zh0ns>YHkJO8u%a%%dR!jCWngRBwFD=wJKIzrL6a+`_=Q>~J_a7zh zfzs2NM$=hX6oRk#>a)8$H`DltYTO| z*&`H9O-yD!t&*g}*#{CD?%x6s8&uhl(ES0p@KzccM@L684SdjLdY|D$ITlK+6&Ei~ z70yM77Vjy? z!J$<%=pQTmh+kHg$yAVkwq?|{5Gm6SWQ>m{#|V~ma@c$G<_(g46ZhsO?_s@-ifUvZx7?Y?l zd*cTNj!okSOWSmuOxT z4JY%E1CaD@Zz1>+&G&G;YF-yg$~zgZu#l-7oG@+@X1wtV_!L+64pJB>Piaij1RCNd zKSaf9jA^hA(2}Y)8|Gum8=qLV&irdt$pe`gC1i-dVCYeK z`Z=F(S!p;zKgx_O2n{RfD?#iOM`i;jvkY=~SiZ&lRO}=uVQe5Qs+Z%4p(?@TF9SPT zZI2@xO>cMic=?H<1P;3|b`e0i);jD^JXb|v z#o*jBwN8?sLRywx%i)#U`Sz1(HYMIRWWTR*m`)SZ8F5=KboqD1y;@7R`paCS#%4!G z(7G0Sj=x|&I6DsGSh##L@wS4LCBnn=Jt56vC+}PY~8)OeK zcO>w9qca!DyjApb7ZrcHxZ+3Qd%_mmX!YB>y##!imUdUiO5X*Vos&~Bwa#+I?|^^2 z-V?q})X^MK_<@0et@?H_aK=b_df>UhNOBJlPvqG_Lglw=# zuDlOHihHeFKmtJ^)fE;`)DH#5uQxdv)>qQDi^jlU`BBAlQbXukf$NAR&J>6=!&Hlc zc-U~Z!w^AO9Uc0^>tc6#%u1=X-NGG9#tCK{zXq-AXkdc~S%#Nav3OjPK1MZI*K=I$ zSo62GH!C$q_ZBej9r(P_Y)ZDPPT`ouhL*w)Vd@!%h1>_2bCs;`JpPVF4ql&@Tu1}( zm}WE8id;XXkAG`j(Go1_e#}C~aiv@N`}EQ^Z&@ouFAZwk=> z8p&L1GCxB4HykZi@3geC3M?oD4(1V8a{s7(V3|Xbdw{DVx>IMzM%-LQgmb3~xst^@ zLNvsg-X3Fi&w$#p$Iqi1*x!Eu`1NbkFqT4B#&jP4=5r35t@+HW@Xeze&?w4nBRkb}i)Y9wo zHBX#)8!I^nh`|jLoeW)`{H+;QcB>oKamPzzDy%z!(}EA=iV4L@^y|H-vD)I4Vs2r9 zBHFUB)J{ZSP0b!>k!vqLS4z;Iv0J@KB)EI$r2wWctPg|ztaG1y3{&45EC(B8(9r3Y z`rMG(?_)5w#-1x@zbT7aVS_h0vww$kmcyy9-b;RI*Ctc|H%kuTmv4VbMHBiv79FUA z_`;w%RwspI^^^BtEI5}%L3fNQntqsCYT-Kza6Hz6q*db~T0- z0Ru0$&<}Nvv$i`3`><T`rjD^F3=&fqdl z3(L2olz0t})RNsvDq6x=B>7&R+NAWd`p`6f>6KZq?@{rup`e(&z9!3_#m*GeiG}a4 z#*iR|-%BEnP%XhvqO#1tKhy!-bUNJuMB@Nxe zrHb<;KT49@akgon7>+F{42xGwF}`5=>S(z?KXu-?o8(QkCS30O$9o{BF{~L%XV$D+ zxKz~u_!cY&PK=^j7`yXsFM%sq0vE5=;^Ok>i>Iq5Gn=Gr$?;*~eqQ_lz<1rIk+zp_ z#mdF|f|>j%nKaeSh)aI6B;wGoPh4u1M%q6=>UHKUh5yNdUPhS-Yt;452l#cM$HW zZEI#xe@;~M!@BTYyDx$ywG{Z}G*1|$ASsmfGTx)~|jvseMS6v*K3|y2@`Sct`a`?fS0|jD6E&eU+-Wg@+ z_rt|QSe5(s5gZ315MVqmsBJ1^mpLc>$+fbH=MF6zu2q1tr7S1+`s(VP}mqw)`o|1>YQt~NRNVPJ6?oE9BAxexoZK$tz1jiEN zm#4l4s}zAN@ntZdIw3xOXQ(_G=~H7qe8X`1%;Cc?iUIug9K2zeV=WdcKQZIsbaaHV zZM+mcCg>$Ml~Z}Z$b|4oCRM;D26hQ**{?)=`0zoWy#uKzd>hesB;c>ElFK+7_%DmG zjj7IYlrZSg+ddh{1&HqW8Yo9bLSCc!gzR?VHPTD ze_dX_N&4&8uOec1mh&+MBCRszCs5^r8Bh3>SvI9-W!=V!bh)tdF8JP3*Hz{YDDV_Ietv$f*9rAA ze{3I|R44EK5|Jw1xc_DK(67oJfcc0GtUk07CE)S^^OT?yQ~3m9Jl`H7Rmcthpxr+L#|K84|i{o15|s z1c@CUC6uvVAwNmK5vL>A`te1;stqR)G8DL%mvJWzbu+@0)f$VPGe{H|tzGjwT zigf*Mj?;Kgy*HsMZB`aJL^%j^+z6t4Q1&tM0!dYP)V!ohCOk8)@2tmAI2?|Zxx2Rs z3~jXkTF(`ud}rhc|7Ibq&}yg*E^Z{%-1e7&73pnN5hu6=JPq&Ax?*fvu0xmd&X+{1 z$35-rDxXSwUf_Fo^}uce!$DbAnH5dz$E%l6*u`Y|Xm;+#YMMJhGRDydhGbQGCMsI{ ztCx{I;N_{63#CSx{U*uS$*FVS`m=`46@F0i=O2Fhu&iA!wGJOngyN{(nOM=rjgG4i zo+nizxyS(%;}i9p*E-Fqz6tN^ut9rbC}l(<8UVw>_nXU@X74Sd&_5>M<7jSTV|=jn zMHQ9+1RtR1_kHduJP?_%X92+{_rbViqkFo!ZO%X{2a|kd$`0)0u zzSQ~wv4LS6jQ_TUIj8EmY#*Z4A8X%~@vHD%w#y@0=ymi+Wl{(_)YO#dQllBf?^j7% zRe#1b%miBMeqrG@(1dzbt85^b%I%;=GXQaC$Pv(LWRD?FgIiQNOyk6f@ZeyFS~=GA zppz%UOlY@m6;sH^2qq-$U=hYiPtV-iTI+@@y64g#Jp>`#7pB`73ev3chc)5lW);Vu z3T7Sq&45lO`AFE5mS1@W6D$s{1_(h|zWTk=p>LRd#nL5RDcTXo9&%Rb2rI{&M8gVP zSA=CTQfV{gazp|MG4auJ{n*m&Kj`C8iH@hrGc^uqNjjx}J0>|<0~aL6RS>=Iz(ExFiR zc^-eo1lcg+1|;1fxO4G%%gOmTFLI+lz(iN$yXp#iNQmQRS%@J6=o)nvTWlM z6L({N8B?H21b@eTuZn0}ReB;=4DmZq0N_;;R1>B9AEuIH4}P80Bk){GdRof6qMh}otSmbytl2Ju zXV^Q?IZ+Y$d=(R?ZoEQ*3q3PN28Pb67~oXZ**ne`4aFeJC(n)wqHS*W{G+d#A^b7Q zTeog)YHGS;1Ph@4g^tke+qYwdp83#qFkF@eQ$nH>4eVdhl1@>`Pb}NrS1dSw$Qr z6~+g;U_TNR6vO~OF&mMBDL3N0P9w$#hlM zVsLk|W@r-gO!u+gHN;YZuckX5Uw(+1smnh)bJs)%1t^At!N7-}2Y!Q*MWna|$~X2x(~1*2s0j#_lM|tzxXAr~h(}sBv>~^HC1e6oc1#>AEiHu_ zYe30o|K%kLHgtH3Mui$~q7?o1bVzw*3#6F+7+uMpjD23r`K*r4`@G^AYbUPkmOSb; z*Rt}z_@Xt11{FFRc=(GTCz(atUw5sMWdStb2{<+r5A$AHVB9}CWOg@o|C6-u6R2A7p}?vhQ*Sw%yfOY0)wY+=VM%J>HY) zY~9V;tvCt5j)Z3huHfqGIMLSyMb~z3Kg4uf5-xiMh(~G4aswZnghb5p97VCdTDNSt zCS4`b|D>UZ!7A^V#*;@mIkN0A3doTISPd{G_>u==9D>+2&&U0FLNAk)^r*i#2RkrU zXY|Yr4B{V3TMBv{(4@fK^dpnQt z()AB-xk}9x*!9_)nIK>bU?jqs3ZpR1%*>cY>`E@I<+yZx6WAtpMCl_y8`qhAv+4agmXRgf(^RqfV{&mFww!|c>p&u zHtpbGEXxHa(WeF-!|dNvHSeoPQ(oj=mUq>=`Z08SQAaZ3`gxO&>_7C$9pdP z26E#2T=%l==g}_1y3Bgp<;>SVZd$tgLyB|y$+32$^t9((+Z^%El1Xq0H@E?_;N;+d zMmA6G{rKGjA3kW$rihz_nGm->k`2&0BQd)gDNWL#gQIJD+RZ5kG0{`JY*$GF6X8uS zD8KkZH?i>X;|r)%u+MGYs|b@k?9<4QNKe01C`bvX$SG5L zm5!o6tI?i<<7+Fwm;%dZvv>V^$WZwQJd8`rw_ zK35J&2WJhdl;M#Vj$s>nhLsy?MBO(?Fx#OkhY}t{>JHP<6v$!Egei!|!?)whu~C}` z4=O)uGBi2GqF%twj3{&3)gD9$`;fGaxeQgJm_$}VwdO-zDxUgO zhl(WAi(D1uew&5ome@sq+LZB24&n}EPBlEKMpe!|=Bge(LBo3NwZ7%E+yPu@*Z^^g zLyJn5eQuy_R>{QnBh%f!8_uGiZYpa#KW1&X*(#m7`CzY&L~N9ajz@8Eml$7~XSv%M zDxT(%9@M?x$Aa%XUOy*ELBZXSE+2B?Uh3|Fx`EdY4>u$dHI` zy}6;G_~Yc)wC{IRnvBtT`l$a*g6T(m)JvM3o!n z(f?Ehugt2^<|EAPSrNtsJIQWZ5smSE%OMB7vDbR$#0pK2WuMMr*jTsE{KhP_{zpVC z{mP~7eU#EW{}cfe!;#F*(GBYubiuAVx0-cjoG=l!KH8}Z-)lmd{GIr8NT28$b;y?h z2mK{>t2ttSokE7GC9B-7H1!d}y)LnG+(MtH>)_adhLWn`7W?Fuj-&ZYPi<@S{w0NN z6Y?Og5u9f$vdb$fu%QmV6&KD2LWldA_Xdh_W+>q>0N_Xle;`1s6VJC6{VtzOR>R6r zTl;9$hDMaF->M_&DHhk0b2~oVpe73n^nRljXa0z%m@5s3X&V>d2sCS8q``*m#OkyS zfbl@<7I=I>c{`KJm~n1JiO50MU&o6Af948eh9TMrPL+MA9vNUsyu4zqUo_K)>n$hp zNl@<7oLbW#_%8J473Ae1)f~^%wr|ui3k?s)nS8a(hCl^8OBw_I7vl?-Fc8{>+{2c60N71Uu<-B1kVu#n``lo=>tu!rSt%CLn98maDqrMh)fT>6%NxNanxS7N zLAQfw^*$?w;KFF^ILO}E39RiN7)f12pP^1wR0e!~fudH_-feOR2N$q0BT<)Vsu#aWm zz5C|E5y$i_CwGugHqOJLF;Zm0OF^`#KGmg_2}JH0mkDf?u5 z*TQcks{e;9WCllZ2S{Jt!ql=7&_V|oPVA<|u$PQ5;!$Er@XHLY~u#w6; zVw}?Vu{(!#!a^?yvT{{S^CJql6T=}qAfXC2;6ZTRug23>TwOcsm8`P%Gxa~E#VhO zosKRX>LU0ZrGJxU`7$&C&QVgx18o8_L)pH1)*F_N}2YONIQw5PO?N&3XwrVXgLx!BYXB1qK(Q@Q)J&p6fw3?N97cekTRB} zsF5UV*5`c0E%EpGl#~>Z7{N=@ zo8&av;h!)8Ffv9_gg8v9k0ZMUmG1e%MnKD7zqz4gi>qp((dk+-)P`fPTDsK56os{2 zT@lbF;8TFD3AEJITPzj}=xk9c!F+*A#Ls=^HYM0R!O4ovDr^)(J_YqvbR z;LLI7&M_n~;~(Ypu)$%GjHpQy$k>LATV~73xO^7f9#>9%ifO*bM-4M0Ooc7uLc3Ad zESqt5k3=_sF^3WF6T_4P-sJTZ$h;W-nl9?GI;G9wAZ6h=xKg zlpct(ls{Ol7!V`R1n2DbG8 z17NvA`0J}zyQ6PeUE~5BjrfybDttfIOu!0l`r*T}!vh_dNX$E{dJ`lN zSi+>5pYK~h2h2`=3jF2FnTcI|+ev%g;3k12 zV+@EsH@WRDOrkeV`hcvk!6=U}L$HB$g&%ozpz38Yy*I^|a$7`^T(k?UO$A}=qeo|{ zd;(~XyP5!#i##`Hfc7wLQCS-B1os`SE?@%)Fb#Lp>2!clU>g8=-(_l=oR@QyoqYRt z+d6Lw?|7630H#3vggqoRp#n%RMk{lt`2fUVCcB6n@2 z!+8Qt9|$mr&drI4XaMi#<_2rim9w%@&49{?v@}Q%zqyH*cu}zYTa1z2jW$Do z5D*_z|326WqtiK_YszL-W*CYGVPf)cT6Keq@))G;5YtTvbjbpQ0k9wsR7BXSd4fpx zupw-Ss;>Xa7~Cs#>`iSv&Y2Iicq1M!2XZB! zSe?5YAO8V7Bx0llj0H_1tj6>|e`r6hcjUUde}&r?S)n?7LO4N@0oBLyIFe?KRd1J? z289q%M&LAxSGb#0v`H7;XOOijM0C&IB{vqXG; zj@IYpg8!}lvEv(#3;-GPK!62>^wXzL*pD;A!x!0YSRdJ5I$$=Ar*LD}3K#BFtP4r% zSu;{`0416LS|iL;d^02;!IC~7n-?5z zB#hFwtIt3G=r`*+1t3?XGrxp(QD3j<*)y02h&PbX2hv6ZW{t_sbw_Tc)nFE&5KMpG z;w%cmSOF#tpnv;<>w%~8nCv|e`OiycZ=afm$aFqYL_$u`m$$DYu;ADCMMOUPgQHuy zPiN1bOwgo2XbPg^fG2r%<@CaD+EZhB%g!n&9Iv|(dUoVQX|ZH1&B>X&Uz&k9y(&}J zB+6SZIT6S)n$S=6`JMpu$iW(E3m#kKlJzG+L9v$$#S3gY(|8u^H-No}MuZsy*Tp^r z)M2o~^^z;lf8xcyci^mDx^i;==Gcm$mSrnprt#Lv1O zrvdQwgh6SzX(?q~bZ}fepPsvw;35rf755>OcJ;RP*Fj$W&2Pxlo{GRt3&{&EB@4 z^4i$}8{ULGNv-}VqI%u2c^&e(6N*wpYNg9l?d6i@wCO7?^h;ZCEJU|{8o>3R+^tH^ zh0b|z?h-1C__0IrBAKX6T39~H<|d%#)n?hnnH!SU4OyXrWBjt1If+F-X2f2$j}!b*k&5cjACf(NL~G=QgT(z1yZ~r*ilFsrapY~D*I;Z<(sY* zA-AsPEbMUc6A`l3Q%Ga6K&gApQgq-{V5#j4mD3lB5L6pb7Qq-2G%Y!*z)7Qo3~3{#&85&q3$o)xeB@T%h_TaJ0Q8# z*-wkjLu`a>50%3I3}aE^^$Tu$3LFa~BUSVpv)$(?Y7$CK^R^K-7QBIdRAL3`z8_=*3sT5z~v&Y~qoYSnWw?(pfC#R*}lo&Cq&-;MfceIbn|4yj87a zKMhlUj#dur*crr^X9BxkG|6*(bTfoK@@FXF zGU_bknfROjJ~(9%oecybIB>FWtdWW9m586>1n>(nB);Jdg+f1gJE5Io4okrI0xO{N z7e>~9Ni*V%CF2NWcuRPN4;-5OH{<9Bu5`NhKg&4!4}%L+=TX(gD|vV}kk$h%Id_ie zt^^>0IKCO0LjhXTCASGoCNRt>!Oy-z_*8KP!XoRA6-*V_)EoY0lB5@WC9uA}qj%hu5=h<&;2}c0pVf@i-tr~-4GDfw8dWg`ekc`VK#?B1Bm0>E(&f{xKrEOjq2%B zyM5jZ6@i(@_<^dnykdoFE;j%WhK{15vJ%W3E`#|fdyWc3k8#=AM(PZ$IAT$XH-MRC zcY79%?FeHV*AgFE1`P~f8|Nuu)A9VLObeM$RWC}#G|<4rB-j4qi(&`+ieb#=$svwn zukBUJ7T*1ayRknh2oFEe_JC_*1_1W_dh4%K?@z$*_1vf*ID|ni`sbFe>zfwx&x1N+ zjLVKxzi>;?lTh(0r>}F)twWMfW^8N|w%`ys2WFtOu)lFIh&>GhJ3`fCUTxZxQE4Up z(cT4BH1^?TgOVFJuuL**SG!yTm$K${E=aMs%CLl9wTg`m7mXaiKvZF&m2aenJNNfz zR_~sFU;2mEvbJ*E} zFC+42H>-GTc~_o~a*U0d$y}bo*)F?4mmC$oxP2IRTKA$IYYfjCZ|qfj&&ou3t}=AZ zHBH^XyIaLa7?21I6#v4V{G0#zH~;fL%K!Yn8%K{>HzD?|YWgPGz71~gy!OULMckga zYv8`OugG`us#-%d-J~OF$i3XiCx$9E>b592WbK$N-}XF_7}NvDyXuAjS$h{?9aMRk2ikcfr1hqSW#u_5;RjXGo1p5qv{HWn=J&(#rEdz{MfzR$JTWfhh?U1fC<0wFpez#`%`fqhT zc`IV>L26xiVZI%{GhyC>wfh!e-#)e@aH^m599X(wU4Tr)KT*W>QwnSyP`RTKhb#ly zc~2zPUf%u=!qt9|7sO-kf%nr?8WyG=gY`qGKrwC@-{afI9-0E~@^0kaR#(G49%f}L zG_OG$lu)9!Od0fq%*@QZJk!u)u&4#5_qwbs1x%Jw_s@1`RU?yxoP13fw@uu#g?mz6~b-veJ5id-@AX)oZ0Jmg zc;?;Zxcho)!~Z0g=Q|-hEoeu2Wvr8*cegQ>8+owEYwSxa*f_GE#4I6m3 z0)FE-;BY=Af$-W^^qsRb;q>OB)B%rSi0NgVW{%^`utM)4G#lgqqIe0**-_g~i7vOq z(BE^Yba*~^XAp-&#!V8;A<>^K3VeqI(&M_qcrd^H@dAW(U!rb{Dg&rpioFUX1RQrp zsLhRyZ^-$Y8(J+7ho>@jS!BxU0L}$&J~!{ng!Nloz|kXW2rQ0}wFl1x5(^4zybs<` z`iKr-uqVI2NWBH4P<@k>**^IPAshshUU6@$j!qdltsu|C3)CHxTo(|UG3H*sGe*rS zPgH0cI)sDRfQYdOP!N5wI_I+g2bA>(yDBNr7NtM1VUqiS`*a7b%h#{A`eitFO^~w< zhkI}%K-eT^?J(UguC4HWY|)=Tpu3g3S8{ z379)D(SR^dy~Z7oC=%S{mI)g5(iwOtaC@LA9r^-}l!5uV{DJpU9UUF)>S_;YD9Ba- z02`m{!9MO9#NWWDnX}qxX$+oMh;VL#C4r+r?jorq3_P$vVNk$83VaPPYqki7n1FFD=FzW;KooUm!b*@SDL?ftIy(rkA{s2J_#IPTb za=?unIoMbLu!4*ZZ7WWp-RVbuSShH-+`uRSkMzg11)gdL!UKHN9_SI-(fe;HQ*tHn;4(5Y z0&_I_Yf-VcQpi+?16alwFM8zHJC~75cpFsW+W zAdQV?OpQp8ctO!8Y}xk>6OICbML$Y%VS?)IU0z(GnBqRD^Txn>?QlZUmD6~~D# z{(Suso6k9yoCU_&^qv`S;xu!lTClVhXECX=sd-_QRHTchob|pf( z`r1yyI3YQemD`%m%f&U^+bm{YRU4um+j82ZJ^@w~vFlu3(RggmJi)5q*IkPm+C*PJ z9f}38k|ify-oV3hQeNT@4^m0Wdx6nttBZ%zPdz&-95wBy=ny^{q zw>&Zz@~PO_9UW+8Zwc``AlVSudcJ*h9`JR1wvJ5xT87GmiR(P1vUS9Rn90ez6RW6; zA6Eyb#+?FmHV2_yl? z^k&poD28FCeEMVzh|buDt!B?w=1sxI0%s$DF`CQe<>dZoAjJ^efa10#$(vhuuGvg< znk&CttJoqi=15dy{7`-Cm-yU;J$hTCV`APTX97nm!FAm*uO`>a>GSfc^;#eHt8nF< zZXYBc^^Eg7XLf&Ag_NFuA^ff}!9;@)Qn9o4k)MP}m>dwDb`#n}n23Ox8VVsOo|tez_w6_s?L-nsN3d&5!hBTV(i~a*8govR`=^;5B|;{N}2Iv8HgVn zcOp zcKHwiL=_~XuI-B`yF3Sd3p^*LxC_zc&2Xr^J=q#X9~Xue-P{mI%LoHDW>U#4I1%|( zY=Nu~;{HwuW(EeDm2M{{&Q$4j+fH=t5%Ob@-Uy;hHu28VRVinp=N~lgM+HM0{{%sK_TG? zip5|m+A70bQ_pR&&iO$5Mc~`Wb_?&NX8Sd4i{} z-Ql?5v6Mi@1|r`?Fi7AH?K* z62cVlccEJ{Boqy`n`3nsYT?L)abhy!~ z-%FD>H`3p%lYhd*mLRq{#`rqp1ZT_kz?y@Zu|wSuziDDJ2=>WdjP6u?mpCjN$Mc0j z6y*e1em3h`Rm*IjM4P*Zo;`J=6mE>=jUWg{$)M!_d+`tu5q3>KjH{?Z2b8L!CXiQR`xX6s%QvIG;;ScKSzYZyRFN4O z!$tW6=ONg~tLDMC%DS$@jGT=iO7#y8dTQKn_k!!i7bVPUAiGFT#_uQSamd66SRJrH zMd4BeC7MFh0e26e9--jJLFovCv|-e9<4)d3CxZWh03xU+pEY-Yso#LLn&x}ts&|3@wR1ylpyqO*pLFO-A<@!*Co_2YjY#~k*k87L zNt7)kZV)!ny*gKAk^lFe(1dWDhfZ?AzcFkZ#Q4aSh>EKM3!;!KMxQ z8?jvv50nlMlsM%r@j4EG4VaIF7ra-p;7kO;H`=b;PHIz`7X=6l{NU;6%;30%7~-4T zm&(b>N#+mOLhsK%@nFg;pbaagnYDUPu>l=D_0abn$z{G0D1*BfyRdPiq(oQ4k;oL7FJYv73{Y; zKJ{{PDKKyq-(t&&4r$Qn>9b(EfIkYjX{37x;ysTa?vc%44+5jwgKipsFMMqC0iqs& z56Q?T?N|5EUr-v^r#O;QC4veFyai{WNz;UURTmQ{$>jmT=1>g-20@obP3EGPgC6;U zYP%})ilY)DjjGhVDA1*Y*2PAw$*SA;QZbfT61t%H?c@_0Uw%^W?FLk%bkZYIGr$pr zc~>uNuz*Zops_*Lg-hpE^*=zPy$iA=#84oj41V!ZBC8eleaLI*BW{0S2JU`hxK6Nj z-FXTcRADIIa8w3_0#LSWW)|}@mw2&+6;2K|HOE0|qR_(ne zmTd{0laI+N{Nr#^a?V=0`;pGsv7OQ)nL>7JcazRjpGOgp~P2 zMQ*YXGT^z;xZwWxC4&9$K*}rVP>>a)`q*VLW6JsXsTLW@NBm^{EKT;gpKdxI9{Q`>|B!?` zI_%szXzKLa!-o1!z!pTuZf$Ka98HyMW+s|rc|T2+5POgL{Wn17h|FmPgO4Hg?o+H5 zyRF9>Xf-f5hQ=kKk4t4r<66p8w|(2CC>f(S`{9Hsb70+IXT3Xf&RH3ra3zT%Te<=2 zDb>X=3^?fOigc6K(U(+Lc@%+_?_maCOIcr#O1&NB0O9OLEv^o>2Qtux!y5+pFg<~!HNHRN&`skejrb0*%}vZIzEi%tjsvFomzwU+ z`_}wvV#oz0XLCKGMsGEn72wl#?2@0KAGeU)gdrSR8Y;e!%@e_niZ5mfaA?IAy&gR? zsDsGT0Iw9KYA<$jz3O%N4Wjgh5y+!+v$g26&OZtiPAWk9iAZO#C4VT95(#>C%XuP(0$tfO?Qj`@En(+()Ag66Nvu**3KPv2hJpw4 zkqZCqq@F#8+Ap+MX9xA4CCgzjWcg=lHQ?1S5TD_x2s$Hi{*H)<0DOvan4ALZ|4S)z zy?yykHM!go9r~|=W-!AX6{~SdMF$c;WC#mE?l3kmsH&?=uDc#+i#t5nf6ULBv&02E zIDGI{#Jr2UBo?SRhG%$-iQlaR@|vy!NgsS@6Ez}3lSP>>uYj=vXwMsLwN5;88C%NW zDTAUfM!_(#9Rcex83DMT0d+qnwHa8Tqh2T#F_oC9AfB{%W2%C};2lW9lXI4F8P?F^ z*VRdSfnNx>QKape1>;3S z;k-FV*^V&frLp^a+MqEwseIymoC(=8aKef*U}cIuV^b25MFCjF{l=sbV+Lk`X3}a4 z!`(VMm#bQWhBH<7R+ZnO^@HmNpf@6r8hZBnnh*B7OECSdZtG#Q7Ebnt*AHHP_AZLW zBC>x`2&>h49)QqXtGUKTesf1}b(%&EmQ zoSvMlWv&B32Ek(CS3okI{eIh@ohz>=XUdGb3^ZDZIu57w{W!9?zTZ4owz z-TV#wYJvNZSvb_&d*CR&cdr|MA7S)h*@q2&vLJHu5wluS?trC(@f#Uly#{fLdEpqm z5;~eo=lYcI)K@CnJ6}>>-W4t|m=qUd#Eu7j_|GN&@RBea4a3u-WjIYYcY1u1(ZR;|)Ve*gnZykF4jjT2B+MVhV^nx-L!eQ+-CcnobI z>-VM*+u#+kj=ERPD~C)1m|9gCsUuojnJH) z=#HtvdaJ;|7tYDzLkZ1tg&W~K=tbeQ-wbOx3WI8`ey3VkB9zf4tlW$SoR|jsaRBy{_oLCUhloi^e$F1Z zTIg|m**Kn|lguXx_0NuqD6yYn;$#dmfqD!PtojSD&Q2SrP8^7Tn(=f}lo70oM#0=&C#+EOB$SRbFNATDV)y;Z;TlD=ev*`PW{vJgZ*F^b0=qOpbR*EpPK9+uX zGdh9(Zr514wwRDNC%82cE6O*LTCOf}n;gW;(u`;eB;OmZdc}1;% zaE+|dG>I*)*=30smSFRZ8v{TYnb<6b(W)@|WslODoiPU>8fxj1+;eA#mdA+h(wZ3o0Bu$PdBu)iwVM7-lJscGx8zHmTpa{Zk3gWNQPUTiw~ zp2*y2f*wQ`=1Qa>f!4()bIx``5Sn?E9ZdbHw!EC2!B4^Yjan1v1rTy2rR@4 z3l|gK5%JJip|t*4={kVmLw}tb6BTt3ES7&1EMk5g9f;vJ5SS#e)mpbNJz)3}Uam2L zxWuUD#Cf6vNj!#Wk3oK)J_fMjL071BI76nTtwW|xR2fVjULEv@^&VdG+InisZHps6 zabs4vxMSlXG+dAvDUd_Zp%nEiSSDdMkLTaM_w`(9Gu$X~V8CG}A<*`D_-6FYnCXI- zL@nJ(OafILSg%>3fQiukv*|fBl-HQTqe!5t!}LW3Gg;#G$3L+iZnB^~Ny4IlOeIJV z;EEZ1MX3`7gx$bMlX=Ne;aUNjpt3{#7AS3}s+U4@MbC`c?IkMOneHE2JiYR#y6Nq}2)r!+>=L9sHdc)q^?q7gn|2x+$D%1MTUC|arcR4jW9prc2-)!IxeG}ml=Ml zWh@2&`<5LUIrMDu@laukZX@dh`y|i}^rdTZ& zWoS-=lo;5~Y!wBdg(|+-4`8c_I}T;~nKNeq*x)(Db=b9X)-=>Oe%qqp61B^q}uu)0`$E4pa z4-;#kwFug&!P>BLI9uFk@494CvsvZfybvicG&?$rSJ?7Zh7y;MV^^2F*JSh*L2nA& zirJOaY|%BKt=RUmYkJU&%9k&x57wU-sQqDD9CwwWCgr3XFy^hU;N*|b%CIK0Co)<6 zDS9`ooLcGyt%)E0q@U)rg@K#WuV;PPx~xaVVN&pP4DFnLU@#9GjMWd(eG7ITETNmQ zi$c`&rhbCyB#D^=Pf8Dam@GpZT29y)!3iK>hlOR0rn{U`hJaj#5vO4*hB1M*&^V&I zn&YEkqbS5|Igd|EFu_q*N576<9qatu+`*T|)-=E`T}zvXJ~MV6vdS3s={v$X=PAUy zYs1YeR1f&0gef?GZOy2!gHaY#XLRBlH|Q~pmKt-qH(>RyKHJrFIFx?wl5=$l+s3h_ zdu!!197K%f@a0sQxMjEaOU^^2@C#UI6H@4JZU|ISy!JA6+joDxbgSgRR6rb3Qrf&& zn7j`CWxzwgaVcK*dc;xosRO$34`oq^1yEfvhMJ|*ME?iLKU51j@2+T6Bu$gn)>L<{ zh%#SpY-N)P%{BkT)kRP;q|(?eT}YOiEc&*+mwc&@TWM?}p~Lu%8GIeIVU8dP6cG=Cc6@FPj#~z7q+J4*(+ebctL@x>;t$P5c zy(xfM!4aVYaRMF$P@2S_`im&J^?rdE+AtVvh_J1Hfo-~w8@TcIVZ&fK+a|g=ABdm2 zPS>4eEp9mLq_=SKctY51e5?ox6*l~sH=G9u8*BksmPL76KRj4Z`cM2kC@@e@Uq3;s zFj=a)tV{=NNLux}E)NhTV2ImMs&v~=35*ng%1|16_LY-Jsu$5a@K7OJd$*c=$*RoH zBz$AEbvY>OfnU>E&>a)VX@yTZEFZpEtp!#!EpEP6ZT9`P9vnR+_z*`6#Op=4rXE1` zrC<<%kVJ5kVO#*tnhq#(=&F|w**v<4S?NV)AO@*2tBjEMB#$1^%A(aLs};@8;F328M>t5P#gy_C`Ix&z8Q{LI`zC)~Z^0@Yv!F4c@^VvM(V z)@0%ah-eS&-5`fp9X(21FUh1GBH*niMu;Dv@`b$BRDwi5r-crf0S^GI)Mgj}L4**f z%-Q%_1fFbXiWy2y|Bk?|yvW>D2X z|K?V4PbIGO>1%M`M)mcV>~i|(UB}WiL$9>$k#NMJMi{^Iutq?J1x8=7{&lhxM?(6l zRvgA7869^@;+DpIa#`CqFZs>1S%oDcrsJl-^@+5&?&m}-vSddHKkLk|#jk`M@H%}P$D<42qs95`EpvkQLz20V{| zP=6QR<$h*F1J8Ae)A~^zICW#V|BHlv>$91^bGbjsEfLcG!B?+3!P=3441kXeL4qfe zUCcW8L`juuHuUu>nsNLEd>l;Upr?m7#4ZQf_3h!)DnD-3|6KXv#SGZqZUTUZkxnnd zO)8dEz!gJ{H-dADaXRhoHCzV?w;v-!SWb=bJ0MSkH^3+4c}4UO@4Evb|Eo{i=f`o? za(xgvkO#_axUcFe04+RnNC$90ngOcf5XWjug56A-ztQ#`<}X-5gro_C8!A?^fKZoV zI(Ct=7-=1lQ5;-EISvym5;vy0IK{EG8oM)$I1#{xA;&?`=d3c|j-qzaJ9%#wVh&J< zCfdu~&5NPO!}DUOYPioV)UW%mIZbf-gV_k`J5t1;vTP;6Gw`}1EL?GMl86Ey5j}AS zgxL5AZG0h?v{8!r;x^$0BHMHu>L1)VV!9lPVjjY8;5Dd+gVZl#aEa|jg?If+agrHz z=gy@Yk=c{y-hDP&dNszk2RH|u*}n8E80Ui{Jd}PsZua1SX5~+-T0m8=?1}Z@8#RFw zkFvte(l{4imkQDg|3pv`AsqpC)K23x0mq)BKIBqXsy8p&K`yCC_+4XAMXNq~(Q}@< zY`R|Byh=hsZ;-~YxRP~YyIiPa-Ko1@jGNjaSix%~P6{mmY~{d|tZKQqEef+f6yjDJ z^iPtqwlJpTW$G=EbpiWIfJZax&*|a|cQ3vA!7T!cY4FZXFTPgVj6xDE;p&cY*Ub&F z)=I9DS;pO@7grG=mZ!IX1Jb8VJx3wZ&ygep(ew|s*ry3=ZL!b#gMA~)d|I-j%UP)Y zi)Grnx5Cv@R_Jq|Hbcq+QB~t%fy+EjEVO=R5~!8Joa{TFC!TrZr|1%#!LV~h?OQ6@ zAn2`}C2c#!p!0;a3eWxFsNnl1DF+C>-;3grZ}!Z9>4Kfg6^ZH9A4|r_o=JFrifd-} z_F?ky!`VD{5!W)BRS@OVYqPuXIBeD7E|gEeD6eeGLq8Rh*AyHww;hUFdf`pfcWgR} z-K%3@kZan8c^^@xw?P>K6Y1mlXJdP&Icak+VSF|3fO1<`Q^}m(W|Goi9~-=bNFe_~ z1PPCVz$@8B?H3$YV$jCT#6qzOcu&nC%RJVGI1h~ zSIv4E0qbXb9%bzitB~Hp_l3t48YiEy(fi}sF7HwZK8W+YP@eVL=Nhm(?3D7jXDao2 z!T6S4*%SYj0-KCrf6dtVnNRT@Qu`bH`u`OC3ZLnqU)yOIo2AM+)Cey)dS&0a^E~wyo-Z5BwUCV9z_f{! zCoRudi!*&w4*hh&l$zJchvS=T8wica$q|B|Z*{d1%fEGmb|=k98+@fXY7$)FqF!!8T?xtMlAl2{Wghg#Yxvsw0`JaphXJ!CG654y9SA0n&@?m8!7c*R>vImVS)70(Y+#M?zt}D) z> +yv|6E`_j>YNEB1=maaprJU;QvWa1SGn0(c$BN%oY!2SUS504rul6;CUtl}X? z_CG>fHVb4YWjhd&4^m!6Kh+|S=Vv)S@H1C?R`+Hi30qO_ly*Q)*I#p3xVg2zbffy8d&g5`?=4z0^bHf4AMf_J{Q7VC_5XA7?`6@H31G4;p%u z-j8QJh~dcyNtHD0Jfl%kJUl1HoY9Eq;o%v_PvWTV^K2m_r8W020gmV4Uqc?5|L%{9 bhXv-PK3X(=MY$aQ2+xkKTB^w^`%e8Ic1I?; diff --git a/release-0.20.0/docs/design/clustering/dynamic.seqdiag b/release-0.20.0/docs/design/clustering/dynamic.seqdiag deleted file mode 100644 index 95bb395e886..00000000000 --- a/release-0.20.0/docs/design/clustering/dynamic.seqdiag +++ /dev/null @@ -1,24 +0,0 @@ -seqdiag { - activation = none; - - - user[label = "Admin User"]; - bootstrap[label = "Bootstrap API\nEndpoint"]; - master; - kubelet[stacked]; - - user -> bootstrap [label="createCluster", return="cluster ID"]; - user <-- bootstrap [label="returns\n- bootstrap-cluster-uri"]; - - user ->> master [label="start\n- bootstrap-cluster-uri"]; - master => bootstrap [label="setMaster\n- master-location\n- master-ca"]; - - user ->> kubelet [label="start\n- bootstrap-cluster-uri"]; - kubelet => bootstrap [label="get-master", return="returns\n- master-location\n- master-ca"]; - kubelet ->> master [label="signCert\n- unsigned-kubelet-cert", return="retuns\n- kubelet-cert"]; - user => master [label="getSignRequests"]; - user => master [label="approveSignRequests"]; - kubelet <<-- master [label="returns\n- kubelet-cert"]; - - kubelet => master [label="register\n- kubelet-location"] -} diff --git a/release-0.20.0/docs/design/clustering/static.png b/release-0.20.0/docs/design/clustering/static.png deleted file mode 100644 index bcdeca7e6f56222e00e8e6f23d9ea1ef3bf23a34..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 36583 zcmeFZc{rBq-#01^git9eLnu;0C^M1LV5*d4E<%|y&l*IQA{3dT0V$E8+f1c0g`|kv zJY**G%=@`$t=9AG=lx?p$3FHx-hDid^;^G{%6(nubza}^_cNWo>Z(fXXtvT&P*AKp zc2w~c1;xsP6cm*0)Rg#6`oc&n1%-doF-3U|r^tauXE%+`x~aw4&p}$L6|boeUrnf? zVPSGV^X)Hfv!e$!7-`SG*nDMu!s-SZ>U5gTE3TiKoRN+#BywjxC|Q~ zrO6fe{}|V!EyOSB*0NGi9Q5bBzLJ8Xc;60dd{4rA6+H#T_M&@l@drCtHi%PDTw^^% zNku_%@8bV~e@V8HDrR?ZiBq0lqtew5VU_BxvesQ(9%Eb{F*l~J|D_YaQAo0AEW(Xn zvn+0HI87aRbO*cJuXit#vUju41^KdH@HX5LTvEj0=~ka^_E`PsWb4?f;iv0|S8n>i zpuxIknA;|U(u7PhWLdXvUEtAY`UM`c(Sk~z_Zo~@j_?H6<+(b#ySpDd<~w({TlRSp zmq$AH@+U|7b0}GAwwROI#jRWX1oK&Z6`fYF;?us>*6KU8-U>1HC1vbrr1~!NA>ar; zicwCz^+SMJILSgg#F*?*F<#jDqm^`#Ofn14bDb2}z5A;>zYY$cD0K6&9^!B-sX6|-6Q6`5M6X-?bok1Rfn0U-SX`uaj}C#9+Nq( z*5W=vJ%yatZyq68@NV!m66Ra%`{16GOA*7o^yx1A!6hACT?KO^WmTpc6NM$=k#j=# zHqKj1Sl^C{89psVCPhRfqN$=t>Yr6yL& zE#{I)6HfzV&y&oxq}glTO{qde!Y=XJbauK-1xDL#+q%_dymzM;^(so)=*qtFpC5|! zsfM4@E?xb%5_ZMtO6GtfrMp`@CueP+a|~j=8s_HMC(Ox~=H}*>mJ`!%SOiAuj)vLw zfA1*zzx?N|E9}xDG+9apRta?Jz4YNAleEvD-{7n0;o-p(9M~mj(>WQmr^uOQX(PRR z_ce(_Rp1o&g6*xX8CQD@*%%)WZNQ2KmuT$%p0eU&c>%W=2YLOisp~XtR8)c047`i> zA@NrS;&14vw6w6tnUx-NOfutk@=*v~FQ+a)*J7}*o|-eLZ86^X!pMN>A zCY$bR&fUSA3Ke*!H>Tb(f6&rbPdd(BWb8G&b@Q>7nB6%;USjHY%a1Ofde}*tJz#d; zLv34Ye&0aQ+j;FArdisVGsePOIK4J9MsZZiG8}yLV8~6B2T%FSWiKU4<|CoGf$l7p zuCA27KK7JG2PIkYWREViU-C9Ae)*J?p1$g)d~_wRU=`2HtJwjAa=*kDno~W+^cz}^ z)sDWH|9D(e@2HWLW&4ZnQrT<$&&n;V)Wk&_q)mJTRhgNKyJsY~`cyYZo#WpeP_(Y_ zULWm@n=G?Oe&^v?D__O;Sp&mPZNr(>o5)Ey7d$7$GbWu27@xd(GyaZ>Be(03tDf8N z;i`#}OVRvgmrYGgGg#8i$Dbz>Uv>)-^D3PMd-v|O{rTC<%&bIKW2@qrjhbCaLCxK} zckS)%@$U-lQ_}2Krl!^wIRcVZAF1oQqOix>ho4oOWwFdJ93Xcs1U~JEIK=CDyyI?v zdE}yG_S8bPrAS@cuKKuD`L8)n`dW~Oopea=N@$;Di}W9B@nTf)u6lCVPav~}(pk5o zw6ru>RWczq_G2o)iSS2f$FfIfuBzT0NV`*IDZ;6E`0&T*g|YbNg^3J>+wKb~_qAQ5 zADvc}=&VxWu%}mRGGqC)QB69H{~dvO{y85 z=XDjSd(}PelBYM+Q4+lJ`nBdExgBzrYCD3Dgqxj@|s?0 zX9(zI{`#(|zi!P<1?sGqD3%5D16C%FoPW-Y_a$ex(S#<;`I`%0l4e(%(7tY(qiX8l zRXp3*+e=rtOF&@4N!nNO!n+%*w~1NO-BQSL7}&c1^0$ZkE_Q@qf5}ECKYxC7AtN?+ zr<|O=tTZcqS&O`C@Q_5D*_xa0!o$N&MSF*xE~K3E@W?l05q9U}C%!&cR))qi%}xyL zIlU#IsQTNt`z1zCs-EY%X%$U!Oq-O|Dd&IJID6Le$Lm&K-bd7HZem#-o829EF{L&- zI(*gAdEGv9V^Bh4xAkI3iBbN@gXI2(ERoHAw+dVH-DhXq@-_9{$H%JGI3(>%&CGg2 z_G)*ywwYlEElhWXhJ>g-6ngylu{`xY$H9gy+b$Z;%a<=#NRNL0^y!l_&*%V_|Nd#! zEz(ZEGOxDd7R<>ZSMMEL?Y2}Hn~qW67N6}n`5N35a)-WohMYK2GU0> zq^!EXJl4*z95}bOh_fZA`}mFxw9EoJuMOT^Td@*F{`*VKReibTmUBzeT z{(4U#Je02Is*;)P#zWnE2zil5j5)P{fb|jPL zJv_Mrr~334UCQ^@>R{9%UIh!XUfLxUclY@StNbhrGU?#Xm8;&lM|l>N!kMQ;kC&8Q4=E8)mqoPo&4oWOpcaI7#PU zsZGLu5t3@%s35&C)y}Nv)QZm?tu0vCAErDr@4>Z0^9QMM@KsDg!m&9Mug_s3MO~xi z5BEJyNx3>X*m&m5nX-_*qtkBJ4;s{^8sn>Z>XX=D!Qw*7#Uh>!zH2w~%>D9_yC0D^ zQGZ2Edf1EcNo;IvcD4&PwGzEx)HnyXIsi5y|5C!zUcvBZm!fqV8`ob>GK>&1d}auEbwD1g3Kx^ zMn^_!lJytM^cRF()10LBPM#e0)1P}16VsAX#IB8zWf#+iBxymxJ#0xb&bxQ& zY31r%EIbuG>(s*R5V8Gq<-E}n1vdN5w@}GVbp)%uc=>W&p%Y$g;(Ad)*K!{5XXT?} zQh59Y@6VH}?zh)h($dmK$=(bP-x^)nm5Ub_J?ZdJQ(ot>%~~rQEEL(3P%KYvXDk+Y zU80+ZnQ!OLomK_&4*Z*4C+bWDbNYoVp8TXClhT@LI*wI3tQR)_ffv|o?M4sW_2&q& zp)2~c^*cj#E|5w6L%ts`;KezU98}U#CRpIs=F2O)I5&zqnUrMNSMzEkuPVkbb}5H` ztW@8N(?`|U-#tR??+1G{J$}8Tx^?T80(C$UchTNXE3N#M>FMciqY=&h)$sw0ZIQMW z&ONcAfBp5>#9*T<3P~};UBSFDwD%ztiHQoV!}xd2$^N=(%QOR_bGo_~S~c;}9$W7o zx%niMNJx}b|5Fcq%$`>Cw;v+X_*!ID9fouHr%oQm@D^2WxU*u~slnOG|-26p~F))3%!=aSQ6R@2P!_-!v~e)iz9coVrsgc~d;YSZ=sO}|chYvN@o!GE zAiv?3Q=$}83}xgJ6ih}}D;I0N-zDEsz~Md?i1s`2>dr=1i-Ica4xO#b=vCnf;1nnbPC`{Sthm$0F#Ozj%8(G~4+(+`f9T=0!# zy+3s4oq;ue58sVAU{RlDq9(-RHaA>^0+nZ8mpU^u!zSgR<2H=Bp^mk_p@G#`vE!?7 z9aT%DoNk`WIB&EY*HEOa`^-pZS#s`3X_$z~U{fBsZ(Mftv&h9ych+0T?5Zdj>ExXZ zJ03eT*2As8&E}?qh_U#Gbfr*3meifo*?mc~6L{xC3+6udjiWuFpHOkQ{X&n^%Cd=V z80mf*kdHRhSf_Qzz0_lmsf9(OzE?j!q-#{=p-?Naxv^2ce*MZ7ACC8_{>>FEA)tl* z@JHro+X@MyoyfS@khX3)QlMw*QBGl_*P4&<&))DkiKx+5&6wzgI~g9xLvE~YEk6R zhNdjjmzWkJsJ}oob##sFw7=q{&EB}rPGC8(19Eev1Bz@>d=_!B#3G`CNnt`o9dgdo z(;5^I5D2OE8_}=R8UIztP%zczm!NUEBxvVj_3ob$Rsz^$&Icy~+Zn6bb)W3b($BOu z6k=hOb<5-*Y4n&KK&!3pJ{HapFPyWlQ_x82tZW_aA5F2Y8y?$hZ zY}IUCxDI1|*Qm_+x6`O!HbTx7krEyS1#xkogzgv!Wf~T)iT`z0UH#XmZC3c3eiuqw zVw4qD+qZYm9x|Zwm&b?jr1`u| z&CR7}x}O4U?|u-z@8YNax-@i^@BNd}7+z0Tq)A1ThwtyhXnQpF6b82|HHm0lw9!;d zotFjgrzL*siH}~GELfD;;QKuOm+<|l;0I`|!fHV)b%3>#x?7dMmC0Y>^b$EK80vw| zh)H}Tz*tvT7X`YqGN7ov)jBgNDG3vtX0l$1k?>}}!%wUFxkJS+U%5iQJ6~HQX-ubB~07HJ? z_m{QIlaY*aRDo%kcSg@L(%droIiPskt%y;f_)Rz_erdLX$~@!b16*Fa`1pEQ?z*g( zqdGh>q){PI{QP-x^5nD|%D$>1#@BQFA*%76k4udeJ6vxwaxu|h*zq5dvq=bdh+u1r zz8W2Q%Lco5acFTN8MpuD&6`6$^ba!n`ufz+qcN6wOqb~oq8p&6{^jS_xJ6T=WkKar zO4_fOx!Ld%qmFPkuDW>) zGE6z)veM*pP0Ibqa$`!=pl zi|J2Xi}p>S9a0aCwFa6FO-wITUllp#@Uev99@V6eYgcs@2v9+r(Zt{8RzF=mWQG9_T zwj!Kfx$K4S76bi-c33ag4CW>18Yb@1?=>n@9qgIGbq=I1%CtCk%xf}-Dr#zyb{w^- zkZq>w)3m(Y29=EF&~QiJP5vm6(u+Cc9>;Rp(6Q=MH{sWs)0-FCOREkx^`-oo{2$;TIIC z*7CK-4xL9bDkQXaQx<8^Hiz~>2aR*%gSfajWuA7OL#I3Hg9UGMsNCiV-R?1VJiZ!5 zr{b2WO7-WD`brgn$u-&8*>;kzX3yR4aG>lOozB%GDlGQDu@)e#r)})P-3+Vlg-JYuQpQ2OuY#MNBjDI8`uE#+Sb_CV}QP*9M8(8JJBUOAPYr9E_QO3ZCV zJ8yH`O>O68q5IT6jAcByUC7|=wS(JZX1o0r*=AcCSmpe|gY763!b1YPCb$M2jBZU~ zt2IyX@U$CHn@35Mh-_-Rd_ENbex!JyVLHC=?CktleHU&tCT2SmP08e!2FXDAIo1mw z0$ds8>fiW9+eyw7j08<&HACoAmA?kNI=;;I`2_3R3{VO2Wo#7Z^eSo}Mp6B!qpp5W zHGW+o0Jg6pS8xd??#TDnj{%_{xs8-a4A+FI$acv_tL0x0xqqLDi3ucFL38x{T5;Yb znzntzhX99)%2Vggbq_mvGjIsFrkzS)nz#1(EQ_0q%#g5=x^63bcY1z7eb){X=Q$5g zdHL&eQ+*?k*~409-DJf$jFiByiLrGJh0HPbPtLl_>RY-~@_5k8EUjH$$73L*YSE`v z-JkAmyK?z5Aek&0&(0GeUl<%s`;$3To2;G1JKZRG<=z#GsdIW&cG0f6S&RjLHYAVD6GGk<2y6(2W%GS%B$I7jjv)nFn zatR`ev$6{r9K?Jf%|7Xp_gMY5hq!L!`0B=HwXnjqk+$^O`PWM|-?;6}oNGKyZAf+y zV!8A2!aIXsC-i4d?P4l@ET%pjJ@k0Q;#&{*0UJXaWk$L4>*Y}N>m|x9gguO&8i}(` zxa0wZBxv-GR>}!tO4t`Nzsuccjw5pA6-O@#l?8qC4Go~Cr&Z7U&wqDU*X`7JAY+lL^j1gDw&Dm;6ik)oGUXlS ziU;?UrH+h@fMV(Q*~q3)e5UpO)A$ytuFnGE(WMQnssuA%k=C#AOjl~U^PW`<-XAoi zk<&Sqp%)8i+vPfI<}?qqDbcnmakmx882uXejInh(La4%>@V5Aua6pTJp3U*VCf&%VwYED;c;ehr})B>O8QkUo0)+W z0~GJEJ742S9_@c??85G$B24+#m0j4YEb|dKdqMaa>jkQLY zTN8~8Nr7eZ5pjGOcAJ@*W-fdt4WR7d-KAcIMaH`v{eh?I|-uODdWf*c0uw$vMe|A7DIZ{n$V1u~Ub=q4B#1rG%qe>Y+ zdvB6+QZHS%qar?stt|Dtw)U+)<_HPO&JW2qr>?$=oU&(>vkY!z;PtYmksIOS7-4$B zUuGtK)aNs|t?69s)Be%;Cl>riWXY(9_^LQ8+c3RV!h9ptIGbBlq}@KszL9qCj`2nI ztIXcMV?oBEzIf3K^q4c4-M4k?RvXc~Wgc6jXd-pOrDpkG)b`nHPev$G#s?R*8zvkX zV<9w(09xb8!p_dllEbI4W~oZ*Z!$DX`F?`($<57u>MwabPTYkd!6Y&`exyK^p4an9 z|M=>tb?Iz<`K&yrpG%aI26Un+Z!T+7NjuX-C9HcBX$KySuQsNf9LyOyd-iNam`FT{ zbU-=HcG(uY6FaMOO(WYLsbl1k%_-PSI}>sd@_p!={M z5TszGTvELx-j(;!ZuR*nd1LlsM=>5^>*?r2k$gfiR7(PrPDN)Q?awj%Zm@PAZ4gAu zmLr2Y`oDgiQ?mAK_(kVf)jImDi!1IeA@|X=@pfhI&M;t;ALzbb?aL=bC{#D51^czTA-=}AK5x0KL>W&dvkKo|((aTWXRlftsXE5E^s5gH_o@jI z_Mqm;clK*Hh(~pEUW2Sd{9xirPe1?j@!ebE)OByrK;P|V-__jx$Va4(X9$bC; zxqv)n{KkJirbCp_dB2>|u-3h?N|o1zdU>^|cH?@Am|mzVUzaC@#19NE-h3LNF@zeN z?StFcVeRte5XJKSs=s4;apKu>uhC<@*szGWHGR9ij0hAQ?3ZJ(u-HT7E&p}d@ zi!}SEv-I1>VwP@9!}`rdnlte$Rj-G|@m;y3mkj2Dnpo@Fz6a4xa~=f^zH`Y-EwgTt zn$t}-8br1$ImdAbkIfnckz+$aL%-kbvEjo8e=%Y?#^`X1?}7*Q2>x9!ELftWPchE& z$-u3SIn7=t@UNhVM!N_k18|>O*|lf)?)t8U6%^vzu~sLqS0Cch1Iu2YZQnQ6Q!V9j zBZa@Leb~G{y$6HWMg`P-e0{h8`p7jgH+L>jiG95S|M~P?Of+vuq>3mhu`p#lyQ;&X zIySz|L(RZ#V49&vY-gP6QS%HB4Xyq0L)>lZSAguyE*3g(g~wnNnrzDUD%`%iO-vS) zAFwI#+VN-4QhZ9bzfLmRCfL{wx$a1qFj0t z011JhAh|QqtmQ;&WPFmJ?*T3V^8$yOchU*ps+5cu{?8T z(m6F%%XnZx-6=_P#Psh9QzEk+D(91}=NZ1DW1O)PD zdS7B!=1;sy#-8%uB610=T8|wumJ8d1jSev`j}WthCjq)#Fq;)#MvIP0%_oTV zw(F`Lq91gg+5FX_UPa20o? zwc*f2sAO}2z`%=}-84%(`8rLU`kQtXxZa(nUA0|0ztY?1XB*C??`7^EcL^?eR@+ye zFRfWbRXXoS&u73}R6U-DOD|{^e0i#Y{w;$EZc{LFE=TPx-N99cLTbbebXTWt+Tuv*Njwr^kXLc zDP3T~13bo_K0f4QS(kd4It7GWwW^c_gfz$>&>sTFNhZ zE=Ifb@=d!#QtFS3;|VAlh4SE#FBbN>j-;!u{&ws8#={IW%Z>M{gCID;x1+w0i6lTD zLbW$H&u#l_4^cBgm(gtz?zqVy`^zQo`}gnhk6e0ZhYAF}SRksRctgYa0HjhaYC%qV zPJB6`!Em_t@5{;<@2g!L2`xx`@nXa!53k=N5t9mtQGMesVEjd#ezl-h!a@`sEx2Gi zBY(CYKRMyd%d>fSms6kXX=tQ_lms#4n4h7(%P9OOUNA>U2tP=9MkO1v)I#r^rJ$&9 zJx_G5r0NA1>JA!<2TNas$d_r|`rbh3$JOs*WYR21W(iVs6ZV1{u}6^@9M_E_qN^bBFS0 zp*G&*JhXeyo^^%4oTP;ZwgK)#5V7aX!lxGWXQyHQ1L$vce0-K9+!1B|uM zELiC|TI(X*vgtFoEPeJ;;k4ZG^7IIk$;3RH&p~6^4m#ITswCYU$i4?Q_$F#+fUOh| z6hsdM<(Qe7>GbihP0$ouu}Ubi=43DzV4+Lz^93I5c;q^`1*$1_Lg-%Ykomht>ngJ% zL#1CvxSI=6{yPdBZCq_bPDdb0O>9~kKw*P*=H=_Xc44*(SaVbBQC`bz?xA5c5< zC>&UQKE!^N>`Dro)mWqFZ+og9@V&0^VR>dP&RQA-y29%mgk~_Z9%EHX&7O<%E2-%3 zOH_l>rCPW3Te7}fbY+HJ&#AD9P0Y;6T4_A2^sds6lzBuf8!`zal@bJ+eMPLc-%ctu z;zCA*z&VmTwd;y_PG|2)%6#(VNgHvE#LtIbjBTI``5Nr{z=}y8x%tX4k*?mC$(xlf zPe$DF!R&tmYF3!ZqrfaD-tXdZ)Q^d=8I|;%LO%K)=LdlWJ$QqH=}N}GqnYU(`5;=Z zm*=uG_!wlp(P?N(FI~ZGpGbf8g=Zn{1#h3;NQ$@Ns+;ey-^mVm(LFpCR)qd~pyFi1 z^(Hg(oWTCtk9h-DvCZ6GbAcCA&cP^Wto8KB-I-PfPw~s&c1_3ne;42U)eBX&_Z;Q~rGKze|`sJR$<6OVQc) zhpDK`Xt~%T)Y*Fp5xEVAa|Wb*Ibt@Vhn{@*-9KJ0Ue$%#=?v@14i1fgqSKn1nx{?) zqbTy)2lojL*>-y^O*_{jKS^3&)9&c(+^bFM&zo%0er+Hxy0zR$*e0cu`|@_?Yh@|^ zF(=f2R{6419u+ zWTp254&CyEg;JdESGGNOS*k2VPqcEmUvF1phESk}^Oog^WK?8*!XYCg#zPt#YT0wt%>bhjatr+{KlwFeEhAiH# z<1TR0w4pwtP+t1>{3Kx|Jys|L1}iF{EKJ#(tW<14VZC;FxIW!QKv8%JQOcYjb6_OYw>R*To!5_F4!5K-l;MPc-NEUBEy z6fd;I$5_)e?R5IusLFF$_-;;rYFX;gDvE=&crmM1#w$6xQs?R=8?xAl5393sG~E6D z3_(n^IM*iR$gE;&y0`qzYmrA*|93az|GeXW*R=nV*!iDj{eOxt`n~jSKhS`e;KEy=-x-Xe3bFT%SW<^CyQ&rWI}k5 z_%{b1HYe=-HruL2qlzvGZ|Q2SSP7ACcBU^`ia{~y=~CVNn<})wLIc{|NH_~NnASp{ zf|1fa?lWVc9wwX?xL0TJzigB_wfh0^SD1{egEYH7j4De+nWVVf$}z+LK(ieg=?p9} zvdkGEfpQ5A6@%XZRL~6gAHq9tYdd<2S?`>N#u$7L(69)!nw&Qg&iEuT(Y*ghio$J0 zuHjU03A&#B1>Mu9xWGElIHnA$D%u1 zxQEg$q?l;Nd#a0s?!eN-ylGP%iH&-d$4GEAHRlH34?sb=P#aM3jD^E~vt)rs6=e@Z zsVZ>=LYwotedK9fqfN2ya_{R9-EE!3&8zJ9*Ix^uRTf~@;DB<8Iq>}X^InX2?5FrZ zb(l9aG~^n*y8(QbcrN8aS49-;N*gRVlF94#6~BMv&p}OLJr#4KZ-YjQ9YK}xt55dT zTEPkeN8>hOquUl_x!JnP4$W=bw!M7$QlVZrJ;dG{RV!4 zCr@-V!q}HP{Aq7SLlB}iF5Qp8N>Ow2ml3ushddSkI9P)XfyBTfq=By5e`WI_x-7rt zk+hH^Sz9cXAo-%~z8=HARf#;t&>PGDrlw3F%a>c{URg=u;*GI7ab>)Z&Mu?cBwaM#C|JH$_!-V>x4hD( zFI8<>(|DI-`?leg_KDoj+0^n>qb3=__Xz63U7bqBtfoVgaHxx5e1EJqvK&-4#2HdUbNrKjs@*{)J1JUjzh5TO z?HFCD>tAiSkRj3XbYk*H#bmT&g_!r zRBA@(Y)_`x^bpwDCO}Ha8izYu9^Y76#xEi|wBONRZ6ktpF}rN>UQf3Mmj9&)Q;4y1 zUQ=6J+q_IoYNCdNN6Yn{LOg#+*__wE!)jt3O``i z{RM6=0FC0xx;ocj257nPFFyi}fxN-h8ZDFkVq!qO>$V+$JsN-bF-Tq;trkTt&Ph4^ z65mJQ#Cd1ZjT@8&&5MU+E zB5=)96PX4E*{QdE<7YKB;ZG-wWZ0?RhIS3)M>4M9q};lq9K++ZV3WYr&(C$qc}{nR zVt0et62gyLoQ__chR06^{|$Lidb6L(Bk4M!J9y;@`~)l3YYSJ{&TKUAH`B}f&7-f4 z+*VQ@_@7ChhmHO`YL0L$U}RH+=N~Zy+ra=uE_hd6K^Y+rkycz>^GZ9~W5z5iBWEZd zwI{Z^2isN0vC$rJuSdIIB_^`s%0LWodp(qP9s!*Lhy4OPOGAY3c;)qjJ2q@NV15oZ zQaJ1(nDTEHQ4wJepyfV6pVmFK%f~Dn z%rlDn;`d~a{jliUN$Q?E_fVOKu;JF%pV#t1JqjMGg4Yg!+b*Z@UaV}P5XL?W@}^Cj zUY>mw#BA`O+#0$BJGO(B$7sZGdr{Ga6kOUUTzw%N1^>7tw_Fe(``73$SeDw6d97Rh z(nbrbcaR2pzQ#hV$btD0EdoUeK={sT+Rc$3Gd*F-KfN}pvWQ#9H2B);QW4&U;5{>& znVF?(tzPqAfnuU?8+8pXR(Ry4;rT-WD)e55w_&zK&7*B}8Y*Z$o_~ps#osw=QWQOb{*zzLD8}-BA`kpl%YT^IRGrE^AxJ10HVD-&+s_ZcG+;b1md6q$hLNqIm ziSsHS_A&P8>|Lps9C}}s_V2Cd>1g{%`BAE%edp+OKYx_;Sr4z$rX!ck>uPgD7fYqm zHtsJJ>WDqhaD3tt`9Np~CB@`LHhE}&@zwJEoTg&UU&i;;l+ly=S0A64{*g5FnySOm z%CS!1-+Um%s$+RR2kCbe*FVg42vNQn8K7vRCvOxr{5k(L_3+mdf>BpLZK=r8FcEM6LL2f12x@2J7|Z2Psqd2HGaCOop-AHOYA4 z&XRHmZBkD4-^0uvw0-!Bz@`L59&PNp*y)!xN^4RQYL{bG^&l_yR01ps)1zIG6XCej z@;`3ZszgO$dT6z#6eMW7t2Cdd2kfL%cGZqJ4Q6!_ZkKcX6XjMOws^M0)<1c&YOpaU zlwT|8cr4}hw{0K&j9(x;^Pi_5muc9AL-t-VHN|)Xp9z}Yk&`D+Ub)hTzzbA3h+(1* z{pXfKf}rrKpusD#J1bIOg^9lSih{UOTjY##>?t7IV?4nXAK4|FBP__Ua#%@5$+q7S z0sg!wp&(`ZQ(5*a8{=s&f~+6}LZ@DPNdpFX-gSl}UOfmGEn;+lbVg9|u(?=WzI;B_ zs01`M%wRB8whvEz@ZAV^@I~?jC|Xr$Znz-7kML;vST?mdCpYB^dGFug8^;2%}vT+RbjWD**Q zB^p0mTB_JmFzmR^kJl2z7v~4COM9wSnwYYe8x*Lg=wp)@=U`=tJ3exGj4fjy-9n?m0_t_F`O?5_OHVYH(`@jEe6;vzwgFuxegF48#%K-pF;5g^$8x6h#*ADhx8t zH6wT*D~yC0WXA3>UO=}h^kImWae%-mKUe~aU=KCkMua<#prV1gC2~k3E)!6CK@iT*4|&SLn1)eE-1S84sXAS|e^kpM zyaK;k3p+cm>ogwH6FgJjmGZHDc!_i^fyoa>SxaISwvo8?IBa-_xG>uLi_<=uVgv z;>?b41tPoVCy;Flv2)~vO-6~)*DX@kA=BMX#KIu}^v>XmmZUiJZ`kRhhRU5mzXOp} zjI+~!t#$I$q_6LdK={F^Xs{&7OYY(qD9!^3re@ z4M#JptjMP(@W-YkC1%ak!H&x`BaPE9UM3-qr-4@-F-rs?FjvrUe$ZbS37wmBD@z4& z8wZzyIyI;jHLy?zw$#q{Nk4Ns6V15Wsd97#(M1u&a3-htqf8Nln%_R{2p}m z+0{?qc~v7H!dSIukLIiM_Pq)5m=8Cyi)a34I^I+(M2CCw3kQo%h1TtHSQ8doZZc$l z&G6^;GS-6KZ0c7lM3V;CHL$QpmSYiRvA0v@*s2OwZBl-GS;-@&dg1sNc>NGr1!&k| z-MuPa=(XC&)(@ESklRm99dRs}Z3Jc@&`ST2)$rxSi?1F6Pi+ZYD&{_8*Qm5&yU!U- zP4I9;q0>vba7#xlLU=Dd7pCx&EmiH;YPpOA=%QNAhjbrJ+PTBa2@@l3?G__O76bt| zuzh+6qYg0^6X0Qt@z;xkyd4|{XnncYHwX!-j6$ZVMQ~!T7Yp(jn)xG}st(xXSH9cs z@(>jpx+oN^pTTjc}cfkP}On~0t?|H`XBE7|8T?A|6h1Hwl+Q?LU5aK zDz0bPsJvcb^=~0&O55YvJwb_pqC=(h6zYoD!5hS7vVR;h2)`s5r5az26r3w0Z42^< zs)^=EL7W*Whc`;K%xXtk2GBzO!c3pdwdaisCA~I(0~F#F8cq65W#<8*N4UqkB}~nG zOzVe*Ni05)Y{IN`A?3&1G%+s0RMS5?P2~TwJUbZw9;Vkuoel82z=3oLFn(7Q(pM(!)|1cw1sBL@12&=^uJa-fOAcwu2?w)U379?hgkm>Mj| znDqsjKFmQ-vay$uui}!mXV$w3F-)x%qEMj zv-dXs8A1sE;A|via6uqu$7Hw8J(xGZGgXAb>Y<9HR7R6aS=MNXw&gV7VC^eyUa#jb zUPxl#hhc2MRCKr3YyLiXETn+12yq;P&st8){OL=aA6}e!>BR`ThZkfJ$Kq5G(q{71 zSBd!L0ND}KH^PaHJ(`)DmxkkIm*pcnF=4vG)I{hyUPpJ}oQzqwe6)6n(w5J=yb2AS zkEeSsE}-G}jc+Ab5yI#K>lp|e5TsO;E3h|YO1Br>VpT$}T2VM`jED$aM*eWCrxC?L z`rq;(6$Go7Z$PWi+=`S!Am<;4n9A9f4oi%|NZO9Ut2fzGtwcTib|r(jvo=?tkV+an z3QRNzxU+mhY?XhHwF0$7&GG5Iy#MmzNDoO4r1`uRx}(f;_k;WltZ|B8hL zo5-cl-BnMkd&a<681?=n^!RYdMoS*C2p*}XPj|N10@C1Afd4RHUHz&2XYj!Y`WewN zM12Y5Am{YUpe*%$>n~*fb}pnHrwU!>khjP0`_OV^WMw&qS9h{SM#)E6qf-x}qYF%{ zo>+_XdqI=;HY75}dU=v8bl6JDJi*6f@pA|_*uTf3FUMM-H4z*qk?t02v3)14Jj7&+^rE_)mPAc1wxaGM_KF9KEU z2u#m5X{L47(D3o7ezhpl!vHZk{I1(dtt6Jk?WOhz6RzD`J|Q^KT5iB+s(Y0!=S<`Y zVeyDM(q6d@C1e}d>4VdK4ymFhi%(w7mZ$PNGgzz}EMnpW0{`7f8^14k%h-zOCG~vY zIUD3qY8TCymFjEym!~EQSgxfI|4cBXa&KK&6WMPla;4xJ3DT;EpSg|cZ09L%fMcO8Kh-NASL zhTr_kvX?g)ESnpxe^EQEn0JfXQ{(pPYgVkQnmCR+g31Al{>X_67n_PtVai7wzPXRT z)R#ddx~npp!|!8iL10>#w0S{u0iYf1N=S>S_FC5kG&VOWp4C-vvLciC*Qq{|mSCiQ zom%qS83rSAq%BlgoHP(z2V@Gl6tgHQh0S4oG6_}=1Wg#*9$xgv_>SLO$^|uR2|P1M8zxkWc9iVsYAZO3*jMP4bpw6}(Fn2=4`^Gzit5=7yAK7Sbooib~k^Y;mAPRek zaV*&`H5kwZ)3-7YB9zlhZnK}D{~ZT)I2Bb?%Ha&z;`b3IC24jJ8JDr&ejLOrbmLV1 z!)Xlz9Y>IAp7uv>M#jVnE*k(Ahd2AWOgrt*-(oB=O3lr614BvJ%0ON0^15Br&Q{O^ znt(W`V4G#8A$}97nAeHxw|bvEcdq!J3hzJFve)DgN7$3`sT7h$?YD2N2*(0awHE~} zb_#m(71*`k6;q9p{7xE>ah+fVuMNC})R3Hm28i$>r;wwRRyzTN1n=8g@z-3n z0&$*V;fiHKRQ))_6?}*^d#GHv1sRSb<;q8q++N4$DBue}l7AQ{BFuvDNVAC8_4QV2 z{Qrg6R6uoYlu*=SfbwuuORElPg*}yr0Y;}O)A&yaP(~h)#la~V`Qxvk3Y&d>hRp!W zVgXW&UC z`JAUV2Sik=|K#9vg+IvJ3wyTot60`FG?9hyt6*DeP97}XxsU$r zTuZSc95l<5$x;^=J-CD~55wO!%2F+gDE=Yv75Z?q@@)Oa1i3A8l*!`vcB3@E)ByHG*SL0yyLrK5SHjShweN z!Z)CQ@X_!q!;y+pCwA3pY{L<0*q9DDXB+`AQcV3W4X9f7U zw7(!2u#4%%t5-N1XynwS&BJv3Mx0XM(GNsadUuw*ippI>7Qz!q_0#<9sZ(u<2Wkh4 zN@Ood91EY{n;N>_EJLhLf|+g&dERay|FC9s1M80Hx99lrM=xmAfR7-KPVwKm|F}oO z#r=cVhF97VmcED+W?3r{EIClir5J*f!mx_o-fN~`@bB3ZvG1a{a{Gku(urX*hbX%U z3=E!)u*KCXa2Lwje7LYr;+|mF?Tlql99ViaL^+|g`73fMy{|K(khspLF;L7f);-5` zWcLFX_!>_qFs*G^zY}jKj460KFPVXxNiE8S6%zs;&aSbph_#`iBQWT1fIJ&PSyomS z0sii>9J^`8|Hcy+hY7L%=V8_*gs_sxv4mbo>blLfhYP#GW=a(L>eDL143Cpat}8c2 z`Z7{{Df@Z;`QY2&q|>}It8&@>ca5y8Y9Idg{W~0m;0+6pH3C2ARA;t7{iiHnR`Pp5 zWN?Dk>Tm@*!P=gj^)nnZyC3P>tKfvyOW65$-*fY82{jHfDhnz(|B#GTfc)tPnQBVf6*lUhdj+e!afQQ&A)O> zgpp2z$OBC->#z)ek~;*2^6!8U;g*7hE$Io=U>LgpajdBm1ujnA{=)L&Z}<2jLO|e6 zL>@>6To?EC>YIPOaYUx*-vOawGvd(5n3umTSAR@1#P#rLL_MUuxy&pqt&aSX8;1e6 zakOPD=1(9B)}4P_@Q^Pd&ZX?$z3g-N6H@|fMZ|=7|4wtkc@L>norqaA5?lt5;2#^I z0bG0k&RxL_^ncW{O5k8h*j64!tG62SB_QUwTYjlfuplUn}C^_g*@F@Hs>7F^W(@Pu&u6Z#w$m&?ZRiDCM znJ;HrwUjovSN;5LmOsQ|I~N@9L~x=|0p~pmD!a;vSkv021H90>>q!>jKSA{Z+n9&* zWH8i{kvDiON%{5+u@4W?xxg91@`>nOu&=|@($Ay*-|)rJL~yQggx;luGLbr3(l<^} z+L$+SI^1WJRdX^RvbQ0swIqk5a2Vav!Ym^-YnB%KJ|cSdzca=a4A{*6%3nv31gYO4 zQsMj4zIe0_Ub%f%n0{I4P_0WvRg!C6O&PWbykCwfR$O9}Z-lthTgvoM`J2&J$2#Ls z<7QuO)+Ka{tQ~u1Lkp}zh4%`5vjbLBSa)1lvaR-fYhW`t#)xctdSJrCTI6=} zf_c^GS5bNtG}oQ7Z0|qYbTK^67BLfu3Ybe^G#Htk|JG{5_6KbL<_g&Z;&Im8qe*_k z8IzNmY6Eqcu-^-@@FTnjpA#H4###VqBnzddCwX;G@C3J7pOcl|dKYX6)Mw&N|2NLv zr&8TF&i~z zBn5Glr!gEEa30`@h7Ag$Vq(ZpIRUo8Jo8D*Bx+MY5r|C-G7c4}vzJ16*AKIWI-;b} zgoUuIo{W0tFxcP>7!8MX>HQ?6MvxmpN|P`xcYrkbiLpB1$WxMqzUTZncmu)>XcmqL z5phOilw%X07xgWLII||uK>)2j7UUBl{DA?nb0K~I8lq530mi)z;RFNlHfhRr28#R) z^Rw|^m$c4e&NbE|EG?p2*DW2XD_TzE262AW5TGUCIUf<2L^;nw#yye=r!PQ{_4}w? zeW$2h;kLE7+jGxLtkTOEgLRGgtzOBIyzfJkf;f2-&*MaV^&xM%gv3Nqy2AEh1U>_b zM4-5;@9G$KLW-tY*R~voDiX)VVIgtuN4km-M#7RvwZWQy0Gv?WHj1Sw4C9Nq0by$* z>~4s({IzLMg=AkMI#QVu&RkeVK#&mEay|ks!JsIpO-hW3F#v_C>KDPPZXKr{YbrW} z02|0!-9eS4qc?OE|1Qu=adE<}XRHO?6O9nsQEzQB0yf&&b_vGd2mc8IZSywNssX)+ zoD>Xqg1Xl4R+B8CAQG-`oEuu9+SoyB4(|z$9DEZqJ76vUCm_dNC9RIGx2ESRQbHiMWvqJW9=p6P4$?0Ly0bo|rMl;!THAc{k7%cDL!7WyJ9p{QKn<5!hG*ST_#}RUKnp0sxlcyXl^|lDO`VSUt-lkKanjFkl@prXsl?GW zmVbxGp(ersFoTyGLyOk#2Q;fF5qF!Iofj6lQo9=`M*rIkk^(*zr^?pXyFg3CVUsw? z6cj^jYL@(<923o6olGG{>JRP1I03E;Rt1R0WE|xvVasCy1D+Q#0TU_!60mm;%+9@# zF2fO$YDwo(6c#k&OhLmVxeEpr3^o{7P+D8Oi<`9nD}g|&d0N%oJ&*AMR0K?N`{^!% zpR-v6_1-*P;Rqfd#4c>MN!h(GV0S`_TpMB3n=yYSt^DHw18_+g<$H~g_R$?i`Dad@ z`YLcYxFGY7CSdo!+B@@bs`s|-uWA=XQ7IabcAJ!`Qf3Op&QPHck&wvBP(+djqFs?} zw6f4hny_TaT&YZDNM%@tGPEirl%ZvK&hJuo`#$dbexBoa-{XCb<2~;6Z-Zs6-|zdo zuJbz2&oy_UhsAg@9JlOJ3I z18~VQQV%S6tGl=oL0a(4^Z$&Gce|KiEvPIO2J<31*~cv&mCTd8v-v6R4p+vqL@*{6 zu}l+tv11Lu>IMVTB*=XYI4VdgES!5YwbhX}VW_WxsRm3}W*xE@%9Be1KM)&TCzIu10`C1% zq4UDp>EjV|$B9l(;Q|7|1u*uWw~Q@pS;2qx+O<{!vT{8YgGm?UL|GOy|LYyM=X4cQ z-kHFtEQNc5YqyT&_c+8S@f)Wyoj1`W|_2fvRM zcYw!XcMnmOtp*WBTgnDhSlvsQYo2}ThkATW6^u6bgR-pu#t=TUXE z;pdI~oWsYwa?%>si>hW;F=XyK2vGDS;Xvr-u?RcyO6Q#Z62KDU^q1&bMO*bvXD?8R z@#?s-|5NyCW;LGOcoJGM98TRn>(nL1ImYOS_Mh;&ETCrCzpCTJv%DrnqfA2&FtzSh zP2>5iI?W;zQeFP?q-ld3@P!tAfO zT?q)Re>q^Ft#_a68IiOV=2pc$n@2~6+svt~s6orV-Twg4hA$(#^}K<@E79$CsiDEzKUn-B`~5MSQoCx?*f*|*A}nvXWELI`z?4EyCZoVE&}1`k=U%z83nnWj6_!Gx7i0R<^A-bz zNmKZ5+_{rZRTB&Aa!bPzJj`V6V>P{{CD8Pjz$Hu?eSCqKz(3uU8tP}2w)-rVh48#O z=<%o;AXK;D3aWHvX}-H)f2gl@p@dm84=M9|WWT}gW6N}+!I-gluLPe zBWINwm7#&e0dnW-;)QAlbC!dBt{FyJM2HquLdBSB@l4Uk*ZHNpGTl&;Ftl*02QHPD z$AIX7sc98~Q$tyQ2jGbR>+0$Z77M0qSej};|Ay!e$@=v^HDTAkm$p+*(A6hX`U$TG z?)Vge7eW^bTb%dpBdh`ZUU%+9#yWUXrF3gg3r1wUr0Yw^Pe5Y8i*SP4Bfr-e~88m@m6%Q(Ge}JzMAJ+n0;JD~x zsW|wm+s|&eit2&7Z(o!SKh$4*;-#7?=rcgyA2HAW_6js-2>;3pXG}RE+AmpaX?m|G zAHoxy^t6?~%|F}dRlS3M#euOpd95)Li#9vv?ZTuP4la-i2M4-a2)Y68-<6RY@f|OU zHHMM@E)ET}5S~Wq$0qS;f?`aT7=Y`79^&pE#Vnu`NN^O_aeH-g6WF8p?&!veq~qxF z@A5-!gkf@jQ$T)odqav{0SbNkb7*Xi8EaD(OY-#T|ATu(vG=H%W62R zaK^yq4}0iWrFlv!OoD^Out1eBK=*1Tu08IsfV%nVTJ`V`@r5*q?J1dmMyY|?PNa6zOeqsl+s#97cnP^m z|BW?#*lb5B#oAa0W0%HH`P#fRGnL-B4Kdy^r*5BKdXE)TQ$5FA?cG+<+1bXS)Ocqa z{ptImYzk$@3b0p@4i7s~qjN5{;$C*cr;FP=KZVo3Sr$H5tz~HjAb@ZaCkF1M_JIff zVpfHsC95}gjOMtw=;%yxwEx~Ie3zuZN-L;bI!8<`B@QdSSx-7*eJ4s)W6=h1I~dQT zTF7Ldl*$ONJ|Ep0rzW0=^Au7Z@v{(TL*O~^M%`-lnuml$mG&NVWms5PS@}JjEDV_c zA51OnGW%F@Y!NC_OY8Tx*u{;$5h0{)jc?^a^kv;X^t7`*tqCtbok`rENM+$!gRc?e z$u>05+iY#+t4F-nl;))*)u-hI1n4#Qa}teWykU35sI}CuuG1*NwDzE?A0C3WF`d0A z{%}#_7aw6YjbMtiIAC#Rvqzu6Z(-XSrG*to7RPy0ly?yT*s^$4(Ujmz_H3HYJ2}E$ zCvKtBPx1zzyOF&O1aAzk75=9m_$iAVpVVg&K=x2G8UVRP*nj|mFrLx+QlW$Uaqqr; zdDv@!)LA2HBHWs&00FdxVnHmw7?t976bsXWB_0o>F!i1g!Dd)#!>a?`LmwxdLo� z*>Cx=hM7Po!Q_s(2#yAlO!R$*8wq_VP{AVnWCDbG5+z^Hvb*rD0zfrKn-t&%(Q?#- zt{7KhU^TKR@cxH{n2E=Z=9E2#sS`gYbMw-BV4$pBBzXD>DdNydkXjWPWkfbUDC>LF zjOD^fzOmu$VDR%{*upA)XVY%WV*EXlKhmB*!VVZ=qvG?&XFpfYdMVeUxsqlGCMr0} z${xFrccfBt|Jy(z?pqz50-Q(KY&2_H5M*=}c*I#u*!sT*3fV$;YBuS`%DgP5Vy6fG zGT~o>h%E6KM+hi1zjMJ0{jpt#6R~yx083_J3qBnfK=WI#Jj5q~QU0*4#N(GqrfFe! zxZGqS@;nZindVd;`eav+8rcW1eA{h7Z4Ajv8|s)EShvC>=ChX91C0#Sr7d$m&Uh;S zeEpdIqRgLiCd4>4tQ)JAbQjxoIDJj$2Eh~IC)iVQ>42*2Dkj;(5T?<0p&nHYC_Ao2 z=OoaJ0{#xr>Zn@)$BLcB*JHLDaZUoQ2Nz6e&K!8LGTWkv@()8eyu{hw)5SH1;Cm3% zJ`9t|FsEr$?3Avm${Jtws>Dsg+V!w-X@~r+d&5o(_eWFF+yOSl!V@O|-)%=PJ9qFM zY$Z`z+I^`i_BXqIh%OT_(i`vh^&`5SgE&^Z>N8EnYOo*%@bP@i2Sc+;nKXe*uN!j`iIJvjlkm)9+KB2InNElGh5cFp$zq z_Xoj)xBzYtnBI;cb}(h)gepay%N1xyIQY$uz)bQSD3D$vkSKx?dH;ySw7JGfDV z>H=Ig7*Wn2Gzm9P>hh7>YOGLHu7hBh&9j|9IsUcd42876{Lc*k`rF>Q~!a<|q#O`>~;$b|PpRG0|-lpB98Vu1x~CvXYKvF!tYCr(C_`0umNj>+vH`np|)A z>7fd=Mpy#QgSov4VtUu*{he{YFph8CycsR5@EMU6SI`@x z?7M)$5k4Ut!cp<@NL6CaTv}2BZ#8^#b#q2l#jL301(9QK+o|eDj~=0qA;`3RxJQu^ zCW9%o{)lGdI)?V?OVkd-lx?>ywpd#a72=O^{r$dV77Q8{NbCj*!q>^E8Nreep!Wh$ zqLZU~loK%8MRG54a%2M>?ie4~+61^Aa)L<`A~&!D-bKwYcOufcmS2S_S;nCkz4Fcu zEwSCY^@+3@!QYwCv?J#v0pEA?{{0$7Bb7~yX5S}NeViXKfe{nk{@g*b7z!}3$c@Mx zbixQ1kwzO&%AT}?>k-8t?$nQZTHm%nY~d^YkvaI&KXuT%P||58NsuC)K*gm4+ZJ?j zBxkg6(;UGa4$V_OTp#p7Q{&4dI|3Dkgp}Zot7%?JwpW{rmN) zqEHN#!2)w}`SwKqhzF!?*rbY{UML$iahEmg^m(!4=IK-Ew{sn}O3*&^J6ejQQLXas zwFbQf>Pqo)!`CETtMGE^oKv@Nxq7vIb+(L36G|D9gC&t6!`7#}eOwq<=^c59edTLU zYNzK)c1`Osl_qUDTbX2SiSk9I>ka8wBX0#S{BpZeqhn2$z%MGN2G-$LXeN~=nJU5~ z7K~8Ep)Y%Um)Qrz=O#hHoNO%cH0AOq$b}pPo1}Oi9{sfVNXjOfVFDrx$Z~R$663bp z*yQD}zCh@Grpd%EBvbkg78XalQ~V1!y+}MDUZ#hp@u9HCq4~iY%{-#q1zo{_AG*JJ zfPpH+NoPDqg>4U~T6gt^eB9!pHA`6ug%tj1EG*9_AL^{!sc7?O{TttZY zfh)j_qnpH!?Z#8FwVBdca*u>Hj_DCXk;MX0o+WA(NwJrlLc|>+uI|(h!M&EqV8Gh7 zWy^{^6^knE9>f!+_V6vfDyC1oG99w&k|r2QiBEXXb(H zBO0Ik<;`|(Tn?7<(D6V8sBmY9JJ~Z;DpTDwTQ+kpS05XvnR3GwQ)#!eR$S;fLOd5o z-(UL}b#`oyGENU#r`B*Yiwv6Jeb}@3R(;qVA!2#Y!689NaeSkdV37hAkq zQPCo*t=k8iMO<0L@~7ll^O;cc;0l(Nle57R7#o{7$TBW2I0Ug0MYDuS&FqCkj>R!PxK?kC}`gw~R7k`WC42Cu{umukFD{A*OBz}NXl$6Q9p$q{h zIfURtOajeNa{2P*s6-GBSssX`E9q1Y2Cy2)`a&TOp1y$T&+(=O&Lf`TrKgp99=AiY zz~(3G?b}s>ti|)$h_|w$LID&?%vR$NtcEtT4Q1^>c?7c}q<$WSau7*kxPJgbNhXoP zX+a>9kQG|QAUJQ;Q^n^vyLaO8j^>VN#SnTzHTr5|_GKldr@vzNA~_9%IF5QhD1O=@ z0M=o8v*qfB&ic$=*f+7%RM7|_Y<&25k-#yWwGmAo_{d33a_iVKgPC~or$|aD3VU?2yhi}})r3Cvr`a`@6`!?TlENUW6^|c7&L(n`Slmk?P z#e#C^Fj-9W1(6^t*VSbm?6MiG;RX&IoMId;G4zJxlZKiPG=xd-KI(88LaSMIvsR`w3n>H1O>uxpzPN6X3=li4 z^p;WSdny;xI;Rq5wev-M$FasplR&j3lXCc+&|^V|IBADq1MYxsA2@-ryM`WHTDGQ? zF<0JZ;k2OEPE>ESUeOnc6rM-zbMZBXmmV&v-Bijz!vU|el4olXESOGiO#I^cO#v`~ z8(&mRx^_*MSHejcRKQ=uLkOG^$Y5}ooe3VMHnaFZ@x_f|#jN$t{HSgPk%>r2G2R#CV;&0eXAZwd91Xd5If~5O{7>B(OSTQJ~g<2OWZjFE>AX)JEWok+mtxqaWN(f0u>|>zZOcn=L%b3Y@(@@e<12LIR#t>34g|sJCulMh z=cmiu0+s={y{3NllViX6e%orS!YiQ-8?X?AY9+Vlg@<3%%*xP2F?=D;8GpoB9|c;v zV@@3;XmkPuGV3cH1S$p3iHAtUlwXH$m@M`2vqKMfCz;-;>%P`LUU}TNEHv1z5}oR~Mnq{Jy_}7f)Jip040I3Fiy$B~`qRq! zRFrKatL@!Ka0%7z@G$5|w3dPcbOM~~x>LV@VV<$8_8$uI;G)$gQ1q_I?H1cnZ)iLv z(HQq|CY`2j6IQ}S?^zo9I^>YL+1a|huFx7(U*8e>}spm6<6hDTrQnRK?1Xig=HRwpXDaUxZ%3~sxSxI{grtk;BMotRY@OTH}?4^HY7y2Et9{IPGFaNtN&n{SW9JJVU+|C5Wb!u z?KDnUXjD&IJZdZ3teYB~Yoh-eN~I;-9VkCW@qH_eA>g-H$q@U|%aw;c*;U(ARBOm< zXBh=RI~)|qlA-a`RIABiC`t9UD_?vwq+GU}GnC+Y0+A7ae$U0L{kA_UdhscSd@6rE zIPnVtF91j@?GxOMpfY1*f`E_tbId~Ko-UrF7^?D4#CNa~{|Q>n+$Awwgx2|~M&lEz z*kAPDZTOezmuS@@O-KiT4|F&f$jyMw`)5**O{S#&N*Y}&;7GQci{)$F7K*^>W!juV zoaxt@h>qaE0sU74qR)@rwDchTYrp0kZ=Yf|ZoyUVXes2*vDP3&2J20+15T81E}?4| zL^~vk=4iis`H~KBDr8iy;Q;3ivC5Oq0+Z3{1z7Pq?{CAb#BY)MOXyvDL{8T4@7uj{ z>T;|;HNSXJSue)lB)z2(Bcb3KT#^rBG8^Ssuj}fTbrFP$xX+sj5|7D#SD5{$i>iXA zZ~(%j=j;0|N@&S}wULpRkJfVAyZ2UMi!Wrn))721F+37%#%ZE~1*n8qPoUHdS+8mr z)W31}YnVt0br%a`A8p@T!<6Ma2hk9*Ia}FeomX{r9~BFV4TJ}VM}SfwZ5SRl4G?=U zx!i=!u*DHlqiEZamN?^lkt_~HKKyBzIOxu`Oox@eSOa^Y9>=8PUzR5;Z~7AVGWPB+ zDq<=aC;?|vh{bv2=LO>St;aM3S-a0;Pkd6kh~Pd39st%&cwGT~X~Kz)wdCC~*md*| zPg{IcE&x-KClfFTB&weK<;B=0PSAhI{5dtX8x9Cx2!N9i|hQ z_rj;$zi!gQVh+5fN#N=6D2T63x-wMw%NHMY9MIAjieiar+vKaQG+pRb()tAoNGD(v z_&OtR4*wJ>ql@>Tx!^IZ1bz7XW4JBp72!7hV(gh9j)!w(Xbj$rh0N}Y2{InoriPCR z)|HaIPFuN46C6f2v^IiaHUd}yvB1g8%g;iWx~2oAjwn7KLL9*nPgu>h%3N~uCq%k% zQDUKId{&DRZYyxvO{6WOV1dJkwkE}n)OLc+@Tim_%_Jv|a6G|%VBJ-8bo8*I*wZ=n z)@Z(d)D&5Bw0gRRg%7C*|Kr%LZFwdm)lLM{By6{8X%k#nHbkcSs*WW>?7{HfX`OM) zomN#T!jDWS)Q>Z*hc&$z8Lpk@6M?TI8;jwM_>Q`Uv#M347HKt0hcdmdMz@lUZpvQ2#*7$;=i|M?wg-a~ppDl34zQ%AZkf#^5BxTo$(m@K2yY$RYWOXN(Q+ma*+-t3~)V zK^O$#6iWa0tOL&Q?g0dX!QM$cunn=DbYCC-&-I}}SX~2|6B)ds1FN$0ev`ieUj-Q; z+-hhfP@^LE%X(~%0r-p2hPN<}$hi#7Iu5w->@agqRD7O22~_5OWj zHGy~hN4>52wo2Vy&r5FS1GBVhZ6UdG2q6$LVz_c?2G^gEt2MW6mzleZeaN)oe zW=q@h3SZZ6>mA&P=`2VaHT=V!3R+rCnG>CHuo~`J91b2JS|ra&v?bFQDsR?2R<;{A zgJ|Mxx|d;{sFjo-YDg4hjC@&+K5|FsBnM~GgPIuqw%k_}9(@igYcUZyr3(f*kc{^B z_L31FUfqhWH{A9HxbWTs#aG+5-`MvcVg_YE0Qt#04#@)(oLA`?_$GHM;CWHCGQJA# zMeL^@VdVz|u$hLo_@_h3ITGj+lzZ=#X?VIx(cO>d$dUBL`G-F>wV4?x>HNXVD=m#rc3p8h_|cvDH&Bhg<4AzBlB*5+rbq;;dzk;&nMB`vtyvI3qVab5*fjE02>i6y=-)0D zBDAmnxbXkiUHIdT!2gXf*9q@dYXf1W1lVAHURzc4jz0qN9?K~BEt;Z!B+){x8KG4b z6=a1p*}05%Ik$1rwiY4|jo;5tCbSg7lh?`(;$Xgvsu4N{Ua^TDe{V`+ABTZh7^avJ z7RZ88hS%=mZVwMU`60m@A_5IBJYCWFL8Lx?0%dgfSnlzAW(lWby=D&b@ct<4{M5zB zju5PlNO0aqSS3s1k;FBMy9+H_V$Rml7bc5yFh^g%nhNlaqAGK#u@s^9bHs7ztz@}pwIEXIm10-+$~9p z^U16=;PVObqL-i?)JjF4T}9z;!8&rhHhr(K#xL(DaN~*&5#1FvH5Ml1HMTGSxhyDm zD%o|PwwSqpZBF`ea6yM>LLUNWb_aa*a3IX3CM_7G#jL;rxCh||b8D~~9P`}=VSdp27pT>Zid~W21tl?3PCpoeqQruhEYGbG!1$ly4)>-MJs;J?5;H? zkNHvtQiogjeBtMA<{MiKNb%%P+&lqGBKb*zc5SEx$;Og@OrcOzPLg|JQQ)zGgdHlZs;t%1q diff --git a/release-0.20.0/docs/design/clustering/static.seqdiag b/release-0.20.0/docs/design/clustering/static.seqdiag deleted file mode 100644 index bdc54b764e2..00000000000 --- a/release-0.20.0/docs/design/clustering/static.seqdiag +++ /dev/null @@ -1,16 +0,0 @@ -seqdiag { - activation = none; - - admin[label = "Manual Admin"]; - ca[label = "Manual CA"] - master; - kubelet[stacked]; - - admin => ca [label="create\n- master-cert"]; - admin ->> master [label="start\n- ca-root\n- master-cert"]; - - admin => ca [label="create\n- kubelet-cert"]; - admin ->> kubelet [label="start\n- ca-root\n- kubelet-cert\n- master-location"]; - - kubelet => master [label="register\n- kubelet-location"]; -} diff --git a/release-0.20.0/docs/design/command_execution_port_forwarding.md b/release-0.20.0/docs/design/command_execution_port_forwarding.md deleted file mode 100644 index f06297f33ce..00000000000 --- a/release-0.20.0/docs/design/command_execution_port_forwarding.md +++ /dev/null @@ -1,149 +0,0 @@ -# Container Command Execution & Port Forwarding in Kubernetes - -## Abstract - -This describes an approach for providing support for: - -- executing commands in containers, with stdin/stdout/stderr streams attached -- port forwarding to containers - -## Background - -There are several related issues/PRs: - -- [Support attach](https://github.com/GoogleCloudPlatform/kubernetes/issues/1521) -- [Real container ssh](https://github.com/GoogleCloudPlatform/kubernetes/issues/1513) -- [Provide easy debug network access to services](https://github.com/GoogleCloudPlatform/kubernetes/issues/1863) -- [OpenShift container command execution proposal](https://github.com/openshift/origin/pull/576) - -## Motivation - -Users and administrators are accustomed to being able to access their systems -via SSH to run remote commands, get shell access, and do port forwarding. - -Supporting SSH to containers in Kubernetes is a difficult task. You must -specify a "user" and a hostname to make an SSH connection, and `sshd` requires -real users (resolvable by NSS and PAM). Because a container belongs to a pod, -and the pod belongs to a namespace, you need to specify namespace/pod/container -to uniquely identify the target container. Unfortunately, a -namespace/pod/container is not a real user as far as SSH is concerned. Also, -most Linux systems limit user names to 32 characters, which is unlikely to be -large enough to contain namespace/pod/container. We could devise some scheme to -map each namespace/pod/container to a 32-character user name, adding entries to -`/etc/passwd` (or LDAP, etc.) and keeping those entries fully in sync all the -time. Alternatively, we could write custom NSS and PAM modules that allow the -host to resolve a namespace/pod/container to a user without needing to keep -files or LDAP in sync. - -As an alternative to SSH, we are using a multiplexed streaming protocol that -runs on top of HTTP. There are no requirements about users being real users, -nor is there any limitation on user name length, as the protocol is under our -control. The only downside is that standard tooling that expects to use SSH -won't be able to work with this mechanism, unless adapters can be written. - -## Constraints and Assumptions - -- SSH support is not currently in scope -- CGroup confinement is ultimately desired, but implementing that support is not currently in scope -- SELinux confinement is ultimately desired, but implementing that support is not currently in scope - -## Use Cases - -- As a user of a Kubernetes cluster, I want to run arbitrary commands in a container, attaching my local stdin/stdout/stderr to the container -- As a user of a Kubernetes cluster, I want to be able to connect to local ports on my computer and have them forwarded to ports in the container - -## Process Flow - -### Remote Command Execution Flow -1. The client connects to the Kubernetes Master to initiate a remote command execution -request -2. The Master proxies the request to the Kubelet where the container lives -3. The Kubelet executes nsenter + the requested command and streams stdin/stdout/stderr back and forth between the client and the container - -### Port Forwarding Flow -1. The client connects to the Kubernetes Master to initiate a remote command execution -request -2. The Master proxies the request to the Kubelet where the container lives -3. The client listens on each specified local port, awaiting local connections -4. The client connects to one of the local listening ports -4. The client notifies the Kubelet of the new connection -5. The Kubelet executes nsenter + socat and streams data back and forth between the client and the port in the container - - -## Design Considerations - -### Streaming Protocol - -The current multiplexed streaming protocol used is SPDY. This is not the -long-term desire, however. As soon as there is viable support for HTTP/2 in Go, -we will switch to that. - -### Master as First Level Proxy - -Clients should not be allowed to communicate directly with the Kubelet for -security reasons. Therefore, the Master is currently the only suggested entry -point to be used for remote command execution and port forwarding. This is not -necessarily desirable, as it means that all remote command execution and port -forwarding traffic must travel through the Master, potentially impacting other -API requests. - -In the future, it might make more sense to retrieve an authorization token from -the Master, and then use that token to initiate a remote command execution or -port forwarding request with a load balanced proxy service dedicated to this -functionality. This would keep the streaming traffic out of the Master. - -### Kubelet as Backend Proxy - -The kubelet is currently responsible for handling remote command execution and -port forwarding requests. Just like with the Master described above, this means -that all remote command execution and port forwarding streaming traffic must -travel through the Kubelet, which could result in a degraded ability to service -other requests. - -In the future, it might make more sense to use a separate service on the node. - -Alternatively, we could possibly inject a process into the container that only -listens for a single request, expose that process's listening port on the node, -and then issue a redirect to the client such that it would connect to the first -level proxy, which would then proxy directly to the injected process's exposed -port. This would minimize the amount of proxying that takes place. - -### Scalability - -There are at least 2 different ways to execute a command in a container: -`docker exec` and `nsenter`. While `docker exec` might seem like an easier and -more obvious choice, it has some drawbacks. - -#### `docker exec` - -We could expose `docker exec` (i.e. have Docker listen on an exposed TCP port -on the node), but this would require proxying from the edge and securing the -Docker API. `docker exec` calls go through the Docker daemon, meaning that all -stdin/stdout/stderr traffic is proxied through the Daemon, adding an extra hop. -Additionally, you can't isolate 1 malicious `docker exec` call from normal -usage, meaning an attacker could initiate a denial of service or other attack -and take down the Docker daemon, or the node itself. - -We expect remote command execution and port forwarding requests to be long -running and/or high bandwidth operations, and routing all the streaming data -through the Docker daemon feels like a bottleneck we can avoid. - -#### `nsenter` - -The implementation currently uses `nsenter` to run commands in containers, -joining the appropriate container namespaces. `nsenter` runs directly on the -node and is not proxied through any single daemon process. - -### Security - -Authentication and authorization hasn't specifically been tested yet with this -functionality. We need to make sure that users are not allowed to execute -remote commands or do port forwarding to containers they aren't allowed to -access. - -Additional work is required to ensure that multiple command execution or port forwarding connections from different clients are not able to see each other's data. This can most likely be achieved via SELinux labeling and unique process contexts. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/command_execution_port_forwarding.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/command_execution_port_forwarding.md?pixel)]() diff --git a/release-0.20.0/docs/design/event_compression.md b/release-0.20.0/docs/design/event_compression.md deleted file mode 100644 index 2aa84becab5..00000000000 --- a/release-0.20.0/docs/design/event_compression.md +++ /dev/null @@ -1,84 +0,0 @@ -# Kubernetes Event Compression - -This document captures the design of event compression. - - -## Background - -Kubernetes components can get into a state where they generate tons of events which are identical except for the timestamp. For example, when pulling a non-existing image, Kubelet will repeatedly generate ```image_not_existing``` and ```container_is_waiting``` events until upstream components correct the image. When this happens, the spam from the repeated events makes the entire event mechanism useless. It also appears to cause memory pressure in etcd (see [#3853](https://github.com/GoogleCloudPlatform/kubernetes/issues/3853)). - -## Proposal -Each binary that generates events (for example, ```kubelet```) should keep track of previously generated events so that it can collapse recurring events into a single event instead of creating a new instance for each new event. - -Event compression should be best effort (not guaranteed). Meaning, in the worst case, ```n``` identical (minus timestamp) events may still result in ```n``` event entries. - -## Design -Instead of a single Timestamp, each event object [contains](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/pkg/api/types.go#L1111) the following fields: - * ```FirstTimestamp util.Time``` - * The date/time of the first occurrence of the event. - * ```LastTimestamp util.Time``` - * The date/time of the most recent occurrence of the event. - * On first occurrence, this is equal to the FirstTimestamp. - * ```Count int``` - * The number of occurrences of this event between FirstTimestamp and LastTimestamp - * On first occurrence, this is 1. - -Each binary that generates events: - * Maintains a historical record of previously generated events: - * Implemented with ["Least Recently Used Cache"](https://github.com/golang/groupcache/blob/master/lru/lru.go) in [```pkg/client/record/events_cache.go```](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/pkg/client/record/events_cache.go). - * The key in the cache is generated from the event object minus timestamps/count/transient fields, specifically the following events fields are used to construct a unique key for an event: - * ```event.Source.Component``` - * ```event.Source.Host``` - * ```event.InvolvedObject.Kind``` - * ```event.InvolvedObject.Namespace``` - * ```event.InvolvedObject.Name``` - * ```event.InvolvedObject.UID``` - * ```event.InvolvedObject.APIVersion``` - * ```event.Reason``` - * ```event.Message``` - * The LRU cache is capped at 4096 events. That means if a component (e.g. kubelet) runs for a long period of time and generates tons of unique events, the previously generated events cache will not grow unchecked in memory. Instead, after 4096 unique events are generated, the oldest events are evicted from the cache. - * When an event is generated, the previously generated events cache is checked (see [```pkg/client/record/event.go```](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/pkg/client/record/event.go)). - * If the key for the new event matches the key for a previously generated event (meaning all of the above fields match between the new event and some previously generated event), then the event is considered to be a duplicate and the existing event entry is updated in etcd: - * The new PUT (update) event API is called to update the existing event entry in etcd with the new last seen timestamp and count. - * The event is also updated in the previously generated events cache with an incremented count, updated last seen timestamp, name, and new resource version (all required to issue a future event update). - * If the key for the new event does not match the key for any previously generated event (meaning none of the above fields match between the new event and any previously generated events), then the event is considered to be new/unique and a new event entry is created in etcd: - * The usual POST/create event API is called to create a new event entry in etcd. - * An entry for the event is also added to the previously generated events cache. - -## Issues/Risks - * Compression is not guaranteed, because each component keeps track of event history in memory - * An application restart causes event history to be cleared, meaning event history is not preserved across application restarts and compression will not occur across component restarts. - * Because an LRU cache is used to keep track of previously generated events, if too many unique events are generated, old events will be evicted from the cache, so events will only be compressed until they age out of the events cache, at which point any new instance of the event will cause a new entry to be created in etcd. - -## Example -Sample kubectl output -``` -FIRSTSEEN LASTSEEN COUNT NAME KIND SUBOBJECT REASON SOURCE MESSAGE -Thu, 12 Feb 2015 01:13:02 +0000 Thu, 12 Feb 2015 01:13:02 +0000 1 kubernetes-minion-4.c.saad-dev-vms.internal Minion starting {kubelet kubernetes-minion-4.c.saad-dev-vms.internal} Starting kubelet. -Thu, 12 Feb 2015 01:13:09 +0000 Thu, 12 Feb 2015 01:13:09 +0000 1 kubernetes-minion-1.c.saad-dev-vms.internal Minion starting {kubelet kubernetes-minion-1.c.saad-dev-vms.internal} Starting kubelet. -Thu, 12 Feb 2015 01:13:09 +0000 Thu, 12 Feb 2015 01:13:09 +0000 1 kubernetes-minion-3.c.saad-dev-vms.internal Minion starting {kubelet kubernetes-minion-3.c.saad-dev-vms.internal} Starting kubelet. -Thu, 12 Feb 2015 01:13:09 +0000 Thu, 12 Feb 2015 01:13:09 +0000 1 kubernetes-minion-2.c.saad-dev-vms.internal Minion starting {kubelet kubernetes-minion-2.c.saad-dev-vms.internal} Starting kubelet. -Thu, 12 Feb 2015 01:13:05 +0000 Thu, 12 Feb 2015 01:13:12 +0000 4 monitoring-influx-grafana-controller-0133o Pod failedScheduling {scheduler } Error scheduling: no minions available to schedule pods -Thu, 12 Feb 2015 01:13:05 +0000 Thu, 12 Feb 2015 01:13:12 +0000 4 elasticsearch-logging-controller-fplln Pod failedScheduling {scheduler } Error scheduling: no minions available to schedule pods -Thu, 12 Feb 2015 01:13:05 +0000 Thu, 12 Feb 2015 01:13:12 +0000 4 kibana-logging-controller-gziey Pod failedScheduling {scheduler } Error scheduling: no minions available to schedule pods -Thu, 12 Feb 2015 01:13:05 +0000 Thu, 12 Feb 2015 01:13:12 +0000 4 skydns-ls6k1 Pod failedScheduling {scheduler } Error scheduling: no minions available to schedule pods -Thu, 12 Feb 2015 01:13:05 +0000 Thu, 12 Feb 2015 01:13:12 +0000 4 monitoring-heapster-controller-oh43e Pod failedScheduling {scheduler } Error scheduling: no minions available to schedule pods -Thu, 12 Feb 2015 01:13:20 +0000 Thu, 12 Feb 2015 01:13:20 +0000 1 kibana-logging-controller-gziey BoundPod implicitly required container POD pulled {kubelet kubernetes-minion-4.c.saad-dev-vms.internal} Successfully pulled image "kubernetes/pause:latest" -Thu, 12 Feb 2015 01:13:20 +0000 Thu, 12 Feb 2015 01:13:20 +0000 1 kibana-logging-controller-gziey Pod scheduled {scheduler } Successfully assigned kibana-logging-controller-gziey to kubernetes-minion-4.c.saad-dev-vms.internal - -``` - -This demonstrates what would have been 20 separate entries (indicating scheduling failure) collapsed/compressed down to 5 entries. - -## Related Pull Requests/Issues - * Issue [#4073](https://github.com/GoogleCloudPlatform/kubernetes/issues/4073): Compress duplicate events - * PR [#4157](https://github.com/GoogleCloudPlatform/kubernetes/issues/4157): Add "Update Event" to Kubernetes API - * PR [#4206](https://github.com/GoogleCloudPlatform/kubernetes/issues/4206): Modify Event struct to allow compressing multiple recurring events in to a single event - * PR [#4306](https://github.com/GoogleCloudPlatform/kubernetes/issues/4306): Compress recurring events in to a single event to optimize etcd storage - * PR [#4444](https://github.com/GoogleCloudPlatform/kubernetes/pull/4444): Switch events history to use LRU cache instead of map - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/event_compression.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/event_compression.md?pixel)]() diff --git a/release-0.20.0/docs/design/expansion.md b/release-0.20.0/docs/design/expansion.md deleted file mode 100644 index d1de3152061..00000000000 --- a/release-0.20.0/docs/design/expansion.md +++ /dev/null @@ -1,391 +0,0 @@ -# Variable expansion in pod command, args, and env - -## Abstract - -A proposal for the expansion of environment variables using a simple `$(var)` syntax. - -## Motivation - -It is extremely common for users to need to compose environment variables or pass arguments to -their commands using the values of environment variables. Kubernetes should provide a facility for -the 80% cases in order to decrease coupling and the use of workarounds. - -## Goals - -1. Define the syntax format -2. Define the scoping and ordering of substitutions -3. Define the behavior for unmatched variables -4. Define the behavior for unexpected/malformed input - -## Constraints and Assumptions - -* This design should describe the simplest possible syntax to accomplish the use-cases -* Expansion syntax will not support more complicated shell-like behaviors such as default values - (viz: `$(VARIABLE_NAME:"default")`), inline substitution, etc. - -## Use Cases - -1. As a user, I want to compose new environment variables for a container using a substitution - syntax to reference other variables in the container's environment and service environment - variables -1. As a user, I want to substitute environment variables into a container's command -1. As a user, I want to do the above without requiring the container's image to have a shell -1. As a user, I want to be able to specify a default value for a service variable which may - not exist -1. As a user, I want to see an event associated with the pod if an expansion fails (ie, references - variable names that cannot be expanded) - -### Use Case: Composition of environment variables - -Currently, containers are injected with docker-style environment variables for the services in -their pod's namespace. There are several variables for each service, but users routinely need -to compose URLs based on these variables because there is not a variable for the exact format -they need. Users should be able to build new environment variables with the exact format they need. -Eventually, it should also be possible to turn off the automatic injection of the docker-style -variables into pods and let the users consume the exact information they need via the downward API -and composition. - -#### Expanding expanded variables - -It should be possible to reference an variable which is itself the result of an expansion, if the -referenced variable is declared in the container's environment prior to the one referencing it. -Put another way -- a container's environment is expanded in order, and expanded variables are -available to subsequent expansions. - -### Use Case: Variable expansion in command - -Users frequently need to pass the values of environment variables to a container's command. -Currently, Kubernetes does not perform any expansion of variables. The workaround is to invoke a -shell in the container's command and have the shell perform the substitution, or to write a wrapper -script that sets up the environment and runs the command. This has a number of drawbacks: - -1. Solutions that require a shell are unfriendly to images that do not contain a shell -2. Wrapper scripts make it harder to use images as base images -3. Wrapper scripts increase coupling to kubernetes - -Users should be able to do the 80% case of variable expansion in command without writing a wrapper -script or adding a shell invocation to their containers' commands. - -### Use Case: Images without shells - -The current workaround for variable expansion in a container's command requires the container's -image to have a shell. This is unfriendly to images that do not contain a shell (`scratch` images, -for example). Users should be able to perform the other use-cases in this design without regard to -the content of their images. - -### Use Case: See an event for incomplete expansions - -It is possible that a container with incorrect variable values or command line may continue to run -for a long period of time, and that the end-user would have no visual or obvious warning of the -incorrect configuration. If the kubelet creates an event when an expansion references a variable -that cannot be expanded, it will help users quickly detect problems with expansions. - -## Design Considerations - -### What features should be supported? - -In order to limit complexity, we want to provide the right amount of functionality so that the 80% -cases can be realized and nothing more. We felt that the essentials boiled down to: - -1. Ability to perform direct expansion of variables in a string -2. Ability to specify default values via a prioritized mapping function but without support for - defaults as a syntax-level feature - -### What should the syntax be? - -The exact syntax for variable expansion has a large impact on how users perceive and relate to the -feature. We considered implementing a very restrictive subset of the shell `${var}` syntax. This -syntax is an attractive option on some level, because many people are familiar with it. However, -this syntax also has a large number of lesser known features such as the ability to provide -default values for unset variables, perform inline substitution, etc. - -In the interest of preventing conflation of the expansion feature in Kubernetes with the shell -feature, we chose a different syntax similar to the one in Makefiles, `$(var)`. We also chose not -to support the bar `$var` format, since it is not required to implement the required use-cases. - -Nested references, ie, variable expansion within variable names, are not supported. - -#### How should unmatched references be treated? - -Ideally, it should be extremely clear when a variable reference couldn't be expanded. We decided -the best experience for unmatched variable references would be to have the entire reference, syntax -included, show up in the output. As an example, if the reference `$(VARIABLE_NAME)` cannot be -expanded, then `$(VARIABLE_NAME)` should be present in the output. - -#### Escaping the operator - -Although the `$(var)` syntax does overlap with the `$(command)` form of command substitution -supported by many shells, because unexpanded variables are present verbatim in the output, we -expect this will not present a problem to many users. If there is a collision between a variable -name and command substitution syntax, the syntax can be escaped with the form `$$(VARIABLE_NAME)`, -which will evaluate to `$(VARIABLE_NAME)` whether `VARIABLE_NAME` can be expanded or not. - -## Design - -This design encompasses the variable expansion syntax and specification and the changes needed to -incorporate the expansion feature into the container's environment and command. - -### Syntax and expansion mechanics - -This section describes the expansion syntax, evaluation of variable values, and how unexpected or -malformed inputs are handled. - -#### Syntax - -The inputs to the expansion feature are: - -1. A utf-8 string (the input string) which may contain variable references -2. A function (the mapping function) that maps the name of a variable to the variable's value, of - type `func(string) string` - -Variable references in the input string are indicated exclusively with the syntax -`$()`. The syntax tokens are: - -- `$`: the operator -- `(`: the reference opener -- `)`: the reference closer - -The operator has no meaning unless accompanied by the reference opener and closer tokens. The -operator can be escaped using `$$`. One literal `$` will be emitted for each `$$` in the input. - -The reference opener and closer characters have no meaning when not part of a variable reference. -If a variable reference is malformed, viz: `$(VARIABLE_NAME` without a closing expression, the -operator and expression opening characters are treated as ordinary characters without special -meanings. - -#### Scope and ordering of substitutions - -The scope in which variable references are expanded is defined by the mapping function. Within the -mapping function, any arbitrary strategy may be used to determine the value of a variable name. -The most basic implementation of a mapping function is to use a `map[string]string` to lookup the -value of a variable. - -In order to support default values for variables like service variables presented by the kubelet, -which may not be bound because the service that provides them does not yet exist, there should be a -mapping function that uses a list of `map[string]string` like: - -```go -func MakeMappingFunc(maps ...map[string]string) func(string) string { - return func(input string) string { - for _, context := range maps { - val, ok := context[input] - if ok { - return val - } - } - - return "" - } -} - -// elsewhere -containerEnv := map[string]string{ - "FOO": "BAR", - "ZOO": "ZAB", - "SERVICE2_HOST": "some-host", -} - -serviceEnv := map[string]string{ - "SERVICE_HOST": "another-host", - "SERVICE_PORT": "8083", -} - -// single-map variation -mapping := MakeMappingFunc(containerEnv) - -// default variables not found in serviceEnv -mappingWithDefaults := MakeMappingFunc(serviceEnv, containerEnv) -``` - -### Implementation changes - -The necessary changes to implement this functionality are: - -1. Add a new interface, `ObjectEventRecorder`, which is like the `EventRecorder` interface, but - scoped to a single object, and a function that returns an `ObjectEventRecorder` given an - `ObjectReference` and an `EventRecorder` -2. Introduce `third_party/golang/expansion` package that provides: - 1. An `Expand(string, func(string) string) string` function - 2. A `MappingFuncFor(ObjectEventRecorder, ...map[string]string) string` function -3. Make the kubelet expand environment correctly -4. Make the kubelet expand command correctly - -#### Event Recording - -In order to provide an event when an expansion references undefined variables, the mapping function -must be able to create an event. In order to facilitate this, we should create a new interface in -the `api/client/record` package which is similar to `EventRecorder`, but scoped to a single object: - -```go -// ObjectEventRecorder knows how to record events about a single object. -type ObjectEventRecorder interface { - // Event constructs an event from the given information and puts it in the queue for sending. - // 'reason' is the reason this event is generated. 'reason' should be short and unique; it will - // be used to automate handling of events, so imagine people writing switch statements to - // handle them. You want to make that easy. - // 'message' is intended to be human readable. - // - // The resulting event will be created in the same namespace as the reference object. - Event(reason, message string) - - // Eventf is just like Event, but with Sprintf for the message field. - Eventf(reason, messageFmt string, args ...interface{}) - - // PastEventf is just like Eventf, but with an option to specify the event's 'timestamp' field. - PastEventf(timestamp util.Time, reason, messageFmt string, args ...interface{}) -} -``` - -There should also be a function that can construct an `ObjectEventRecorder` from a `runtime.Object` -and an `EventRecorder`: - -```go -type objectRecorderImpl struct { - object runtime.Object - recorder EventRecorder -} - -func (r *objectRecorderImpl) Event(reason, message string) { - r.recorder.Event(r.object, reason, message) -} - -func ObjectEventRecorderFor(object runtime.Object, recorder EventRecorder) ObjectEventRecorder { - return &objectRecorderImpl{object, recorder} -} -``` - -#### Expansion package - -The expansion package should provide two methods: - -```go -// MappingFuncFor returns a mapping function for use with Expand that -// implements the expansion semantics defined in the expansion spec; it -// returns the input string wrapped in the expansion syntax if no mapping -// for the input is found. If no expansion is found for a key, an event -// is raised on the given recorder. -func MappingFuncFor(recorder record.ObjectEventRecorder, context ...map[string]string) func(string) string { - // ... -} - -// Expand replaces variable references in the input string according to -// the expansion spec using the given mapping function to resolve the -// values of variables. -func Expand(input string, mapping func(string) string) string { - // ... -} -``` - -#### Kubelet changes - -The Kubelet should be made to correctly expand variables references in a container's environment, -command, and args. Changes will need to be made to: - -1. The `makeEnvironmentVariables` function in the kubelet; this is used by - `GenerateRunContainerOptions`, which is used by both the docker and rkt container runtimes -2. The docker manager `setEntrypointAndCommand` func has to be changed to perform variable - expansion -3. The rkt runtime should be made to support expansion in command and args when support for it is - implemented - -### Examples - -#### Inputs and outputs - -These examples are in the context of the mapping: - -| Name | Value | -|-------------|------------| -| `VAR_A` | `"A"` | -| `VAR_B` | `"B"` | -| `VAR_C` | `"C"` | -| `VAR_REF` | `$(VAR_A)` | -| `VAR_EMPTY` | `""` | - -No other variables are defined. - -| Input | Result | -|--------------------------------|----------------------------| -| `"$(VAR_A)"` | `"A"` | -| `"___$(VAR_B)___"` | `"___B___"` | -| `"___$(VAR_C)"` | `"___C"` | -| `"$(VAR_A)-$(VAR_A)"` | `"A-A"` | -| `"$(VAR_A)-1"` | `"A-1"` | -| `"$(VAR_A)_$(VAR_B)_$(VAR_C)"` | `"A_B_C"` | -| `"$$(VAR_B)_$(VAR_A)"` | `"$(VAR_B)_A"` | -| `"$$(VAR_A)_$$(VAR_B)"` | `"$(VAR_A)_$(VAR_B)"` | -| `"f000-$$VAR_A"` | `"f000-$VAR_A"` | -| `"foo\\$(VAR_C)bar"` | `"foo\Cbar"` | -| `"foo\\\\$(VAR_C)bar"` | `"foo\\Cbar"` | -| `"foo\\\\\\\\$(VAR_A)bar"` | `"foo\\\\Abar"` | -| `"$(VAR_A$(VAR_B))"` | `"$(VAR_A$(VAR_B))"` | -| `"$(VAR_A$(VAR_B)"` | `"$(VAR_A$(VAR_B)"` | -| `"$(VAR_REF)"` | `"$(VAR_A)"` | -| `"%%$(VAR_REF)--$(VAR_REF)%%"` | `"%%$(VAR_A)--$(VAR_A)%%"` | -| `"foo$(VAR_EMPTY)bar"` | `"foobar"` | -| `"foo$(VAR_Awhoops!"` | `"foo$(VAR_Awhoops!"` | -| `"f00__(VAR_A)__"` | `"f00__(VAR_A)__"` | -| `"$?_boo_$!"` | `"$?_boo_$!"` | -| `"$VAR_A"` | `"$VAR_A"` | -| `"$(VAR_DNE)"` | `"$(VAR_DNE)"` | -| `"$$$$$$(BIG_MONEY)"` | `"$$$(BIG_MONEY)"` | -| `"$$$$$$(VAR_A)"` | `"$$$(VAR_A)"` | -| `"$$$$$$$(GOOD_ODDS)"` | `"$$$$(GOOD_ODDS)"` | -| `"$$$$$$$(VAR_A)"` | `"$$$A"` | -| `"$VAR_A)"` | `"$VAR_A)"` | -| `"${VAR_A}"` | `"${VAR_A}"` | -| `"$(VAR_B)_______$(A"` | `"B_______$(A"` | -| `"$(VAR_C)_______$("` | `"C_______$("` | -| `"$(VAR_A)foobarzab$"` | `"Afoobarzab$"` | -| `"foo-\\$(VAR_A"` | `"foo-\$(VAR_A"` | -| `"--$($($($($--"` | `"--$($($($($--"` | -| `"$($($($($--foo$("` | `"$($($($($--foo$("` | -| `"foo0--$($($($("` | `"foo0--$($($($("` | -| `"$(foo$$var)` | `$(foo$$var)` | - -#### In a pod: building a URL - -Notice the `$(var)` syntax. - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: expansion-pod -spec: - containers: - - name: test-container - image: gcr.io/google_containers/busybox - command: [ "/bin/sh", "-c", "env" ] - env: - - name: PUBLIC_URL - value: "http://$(GITSERVER_SERVICE_HOST):$(GITSERVER_SERVICE_PORT)" - restartPolicy: Never -``` - -#### In a pod: building a URL using downward API - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: expansion-pod -spec: - containers: - - name: test-container - image: gcr.io/google_containers/busybox - command: [ "/bin/sh", "-c", "env" ] - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: "metadata.namespace" - - name: PUBLIC_URL - value: "http://gitserver.$(POD_NAMESPACE):$(SERVICE_PORT)" - restartPolicy: Never -``` - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/expansion.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/expansion.md?pixel)]() diff --git a/release-0.20.0/docs/design/identifiers.md b/release-0.20.0/docs/design/identifiers.md deleted file mode 100644 index 09a8aa27084..00000000000 --- a/release-0.20.0/docs/design/identifiers.md +++ /dev/null @@ -1,96 +0,0 @@ -# Identifiers and Names in Kubernetes - -A summarization of the goals and recommendations for identifiers in Kubernetes. Described in [GitHub issue #199](https://github.com/GoogleCloudPlatform/kubernetes/issues/199). - - -## Definitions - -UID -: A non-empty, opaque, system-generated value guaranteed to be unique in time and space; intended to distinguish between historical occurrences of similar entities. - -Name -: A non-empty string guaranteed to be unique within a given scope at a particular time; used in resource URLs; provided by clients at creation time and encouraged to be human friendly; intended to facilitate creation idempotence and space-uniqueness of singleton objects, distinguish distinct entities, and reference particular entities across operations. - -[rfc1035](http://www.ietf.org/rfc/rfc1035.txt)/[rfc1123](http://www.ietf.org/rfc/rfc1123.txt) label (DNS_LABEL) -: An alphanumeric (a-z, and 0-9) string, with a maximum length of 63 characters, with the '-' character allowed anywhere except the first or last character, suitable for use as a hostname or segment in a domain name - -[rfc1035](http://www.ietf.org/rfc/rfc1035.txt)/[rfc1123](http://www.ietf.org/rfc/rfc1123.txt) subdomain (DNS_SUBDOMAIN) -: One or more lowercase rfc1035/rfc1123 labels separated by '.' with a maximum length of 253 characters - -[rfc4122](http://www.ietf.org/rfc/rfc4122.txt) universally unique identifier (UUID) -: A 128 bit generated value that is extremely unlikely to collide across time and space and requires no central coordination - - -## Objectives for names and UIDs - -1. Uniquely identify (via a UID) an object across space and time - -2. Uniquely name (via a name) an object across space - -3. Provide human-friendly names in API operations and/or configuration files - -4. Allow idempotent creation of API resources (#148) and enforcement of space-uniqueness of singleton objects - -5. Allow DNS names to be automatically generated for some objects - - -## General design - -1. When an object is created via an API, a Name string (a DNS_SUBDOMAIN) must be specified. Name must be non-empty and unique within the apiserver. This enables idempotent and space-unique creation operations. Parts of the system (e.g. replication controller) may join strings (e.g. a base name and a random suffix) to create a unique Name. For situations where generating a name is impractical, some or all objects may support a param to auto-generate a name. Generating random names will defeat idempotency. - * Examples: "guestbook.user", "backend-x4eb1" - -2. When an object is created via an API, a Namespace string (a DNS_SUBDOMAIN? format TBD via #1114) may be specified. Depending on the API receiver, namespaces might be validated (e.g. apiserver might ensure that the namespace actually exists). If a namespace is not specified, one will be assigned by the API receiver. This assignment policy might vary across API receivers (e.g. apiserver might have a default, kubelet might generate something semi-random). - * Example: "api.k8s.example.com" - -3. Upon acceptance of an object via an API, the object is assigned a UID (a UUID). UID must be non-empty and unique across space and time. - * Example: "01234567-89ab-cdef-0123-456789abcdef" - - -## Case study: Scheduling a pod - -Pods can be placed onto a particular node in a number of ways. This case -study demonstrates how the above design can be applied to satisfy the -objectives. - -### A pod scheduled by a user through the apiserver - -1. A user submits a pod with Namespace="" and Name="guestbook" to the apiserver. - -2. The apiserver validates the input. - 1. A default Namespace is assigned. - 2. The pod name must be space-unique within the Namespace. - 3. Each container within the pod has a name which must be space-unique within the pod. - -3. The pod is accepted. - 1. A new UID is assigned. - -4. The pod is bound to a node. - 1. The kubelet on the node is passed the pod's UID, Namespace, and Name. - -5. Kubelet validates the input. - -6. Kubelet runs the pod. - 1. Each container is started up with enough metadata to distinguish the pod from whence it came. - 2. Each attempt to run a container is assigned a UID (a string) that is unique across time. - * This may correspond to Docker's container ID. - -### A pod placed by a config file on the node - -1. A config file is stored on the node, containing a pod with UID="", Namespace="", and Name="cadvisor". - -2. Kubelet validates the input. - 1. Since UID is not provided, kubelet generates one. - 2. Since Namespace is not provided, kubelet generates one. - 1. The generated namespace should be deterministic and cluster-unique for the source, such as a hash of the hostname and file path. - * E.g. Namespace="file-f4231812554558a718a01ca942782d81" - -3. Kubelet runs the pod. - 1. Each container is started up with enough metadata to distinguish the pod from whence it came. - 2. Each attempt to run a container is assigned a UID (a string) that is unique across time. - 1. This may correspond to Docker's container ID. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/identifiers.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/identifiers.md?pixel)]() diff --git a/release-0.20.0/docs/design/namespaces.md b/release-0.20.0/docs/design/namespaces.md deleted file mode 100644 index d2057e9e4cc..00000000000 --- a/release-0.20.0/docs/design/namespaces.md +++ /dev/null @@ -1,340 +0,0 @@ -# Namespaces - -## Abstract - -A Namespace is a mechanism to partition resources created by users into -a logically named group. - -## Motivation - -A single cluster should be able to satisfy the needs of multiple user communities. - -Each user community wants to be able to work in isolation from other communities. - -Each user community has its own: - -1. resources (pods, services, replication controllers, etc.) -2. policies (who can or cannot perform actions in their community) -3. constraints (this community is allowed this much quota, etc.) - -A cluster operator may create a Namespace for each unique user community. - -The Namespace provides a unique scope for: - -1. named resources (to avoid basic naming collisions) -2. delegated management authority to trusted users -3. ability to limit community resource consumption - -## Use cases - -1. As a cluster operator, I want to support multiple user communities on a single cluster. -2. As a cluster operator, I want to delegate authority to partitions of the cluster to trusted users - in those communities. -3. As a cluster operator, I want to limit the amount of resources each community can consume in order - to limit the impact to other communities using the cluster. -4. As a cluster user, I want to interact with resources that are pertinent to my user community in - isolation of what other user communities are doing on the cluster. - -## Design - -### Data Model - -A *Namespace* defines a logically named group for multiple *Kind*s of resources. - -``` -type Namespace struct { - TypeMeta `json:",inline"` - ObjectMeta `json:"metadata,omitempty"` - - Spec NamespaceSpec `json:"spec,omitempty"` - Status NamespaceStatus `json:"status,omitempty"` -} -``` - -A *Namespace* name is a DNS compatible label. - -A *Namespace* must exist prior to associating content with it. - -A *Namespace* must not be deleted if there is content associated with it. - -To associate a resource with a *Namespace* the following conditions must be satisfied: - -1. The resource's *Kind* must be registered as having *RESTScopeNamespace* with the server -2. The resource's *TypeMeta.Namespace* field must have a value that references an existing *Namespace* - -The *Name* of a resource associated with a *Namespace* is unique to that *Kind* in that *Namespace*. - -It is intended to be used in resource URLs; provided by clients at creation time, and encouraged to be -human friendly; intended to facilitate idempotent creation, space-uniqueness of singleton objects, -distinguish distinct entities, and reference particular entities across operations. - -### Authorization - -A *Namespace* provides an authorization scope for accessing content associated with the *Namespace*. - -See [Authorization plugins](../authorization.md) - -### Limit Resource Consumption - -A *Namespace* provides a scope to limit resource consumption. - -A *LimitRange* defines min/max constraints on the amount of resources a single entity can consume in -a *Namespace*. - -See [Admission control: Limit Range](admission_control_limit_range.md) - -A *ResourceQuota* tracks aggregate usage of resources in the *Namespace* and allows cluster operators -to define *Hard* resource usage limits that a *Namespace* may consume. - -See [Admission control: Resource Quota](admission_control_resource_quota.md) - -### Finalizers - -Upon creation of a *Namespace*, the creator may provide a list of *Finalizer* objects. - -``` -type FinalizerName string - -// These are internal finalizers to Kubernetes, must be qualified name unless defined here -const ( - FinalizerKubernetes FinalizerName = "kubernetes" -) - -// NamespaceSpec describes the attributes on a Namespace -type NamespaceSpec struct { - // Finalizers is an opaque list of values that must be empty to permanently remove object from storage - Finalizers []FinalizerName -} -``` - -A *FinalizerName* is a qualified name. - -The API Server enforces that a *Namespace* can only be deleted from storage if and only if -it's *Namespace.Spec.Finalizers* is empty. - -A *finalize* operation is the only mechanism to modify the *Namespace.Spec.Finalizers* field post creation. - -Each *Namespace* created has *kubernetes* as an item in its list of initial *Namespace.Spec.Finalizers* -set by default. - -### Phases - -A *Namespace* may exist in the following phases. - -``` -type NamespacePhase string -const( - NamespaceActive NamespacePhase = "Active" - NamespaceTerminating NamespaceTerminating = "Terminating" -) - -type NamespaceStatus struct { - ... - Phase NamespacePhase -} -``` - -A *Namespace* is in the **Active** phase if it does not have a *ObjectMeta.DeletionTimestamp*. - -A *Namespace* is in the **Terminating** phase if it has a *ObjectMeta.DeletionTimestamp*. - -**Active** - -Upon creation, a *Namespace* goes in the *Active* phase. This means that content may be associated with -a namespace, and all normal interactions with the namespace are allowed to occur in the cluster. - -If a DELETE request occurs for a *Namespace*, the *Namespace.ObjectMeta.DeletionTimestamp* is set -to the current server time. A *namespace controller* observes the change, and sets the *Namespace.Status.Phase* -to *Terminating*. - -**Terminating** - -A *namespace controller* watches for *Namespace* objects that have a *Namespace.ObjectMeta.DeletionTimestamp* -value set in order to know when to initiate graceful termination of the *Namespace* associated content that -are known to the cluster. - -The *namespace controller* enumerates each known resource type in that namespace and deletes it one by one. - -Admission control blocks creation of new resources in that namespace in order to prevent a race-condition -where the controller could believe all of a given resource type had been deleted from the namespace, -when in fact some other rogue client agent had created new objects. Using admission control in this -scenario allows each of registry implementations for the individual objects to not need to take into account Namespace life-cycle. - -Once all objects known to the *namespace controller* have been deleted, the *namespace controller* -executes a *finalize* operation on the namespace that removes the *kubernetes* value from -the *Namespace.Spec.Finalizers* list. - -If the *namespace controller* sees a *Namespace* whose *ObjectMeta.DeletionTimestamp* is set, and -whose *Namespace.Spec.Finalizers* list is empty, it will signal the server to permanently remove -the *Namespace* from storage by sending a final DELETE action to the API server. - -### REST API - -To interact with the Namespace API: - -| Action | HTTP Verb | Path | Description | -| ------ | --------- | ---- | ----------- | -| CREATE | POST | /api/{version}/namespaces | Create a namespace | -| LIST | GET | /api/{version}/namespaces | List all namespaces | -| UPDATE | PUT | /api/{version}/namespaces/{namespace} | Update namespace {namespace} | -| DELETE | DELETE | /api/{version}/namespaces/{namespace} | Delete namespace {namespace} | -| FINALIZE | POST | /api/{version}/namespaces/{namespace}/finalize | Finalize namespace {namespace} | -| WATCH | GET | /api/{version}/watch/namespaces | Watch all namespaces | - -This specification reserves the name *finalize* as a sub-resource to namespace. - -As a consequence, it is invalid to have a *resourceType* managed by a namespace whose kind is *finalize*. - -To interact with content associated with a Namespace: - -| Action | HTTP Verb | Path | Description | -| ---- | ---- | ---- | ---- | -| CREATE | POST | /api/{version}/namespaces/{namespace}/{resourceType}/ | Create instance of {resourceType} in namespace {namespace} | -| GET | GET | /api/{version}/namespaces/{namespace}/{resourceType}/{name} | Get instance of {resourceType} in namespace {namespace} with {name} | -| UPDATE | PUT | /api/{version}/namespaces/{namespace}/{resourceType}/{name} | Update instance of {resourceType} in namespace {namespace} with {name} | -| DELETE | DELETE | /api/{version}/namespaces/{namespace}/{resourceType}/{name} | Delete instance of {resourceType} in namespace {namespace} with {name} | -| LIST | GET | /api/{version}/namespaces/{namespace}/{resourceType} | List instances of {resourceType} in namespace {namespace} | -| WATCH | GET | /api/{version}/watch/namespaces/{namespace}/{resourceType} | Watch for changes to a {resourceType} in namespace {namespace} | -| WATCH | GET | /api/{version}/watch/{resourceType} | Watch for changes to a {resourceType} across all namespaces | -| LIST | GET | /api/{version}/list/{resourceType} | List instances of {resourceType} across all namespaces | - -The API server verifies the *Namespace* on resource creation matches the *{namespace}* on the path. - -The API server will associate a resource with a *Namespace* if not populated by the end-user based on the *Namespace* context -of the incoming request. If the *Namespace* of the resource being created, or updated does not match the *Namespace* on the request, -then the API server will reject the request. - -### Storage - -A namespace provides a unique identifier space and therefore must be in the storage path of a resource. - -In etcd, we want to continue to still support efficient WATCH across namespaces. - -Resources that persist content in etcd will have storage paths as follows: - -/{k8s_storage_prefix}/{resourceType}/{resource.Namespace}/{resource.Name} - -This enables consumers to WATCH /registry/{resourceType} for changes across namespace of a particular {resourceType}. - -### Kubelet - -The kubelet will register pod's it sources from a file or http source with a namespace associated with the -*cluster-id* - -### Example: OpenShift Origin managing a Kubernetes Namespace - -In this example, we demonstrate how the design allows for agents built on-top of -Kubernetes that manage their own set of resource types associated with a *Namespace* -to take part in Namespace termination. - -OpenShift creates a Namespace in Kubernetes - -``` -{ - "apiVersion":"v1", - "kind": "Namespace", - "metadata": { - "name": "development", - }, - "spec": { - "finalizers": ["openshift.com/origin", "kubernetes"], - }, - "status": { - "phase": "Active", - }, - "labels": { - "name": "development" - }, -} -``` - -OpenShift then goes and creates a set of resources (pods, services, etc) associated -with the "development" namespace. It also creates its own set of resources in its -own storage associated with the "development" namespace unknown to Kubernetes. - -User deletes the Namespace in Kubernetes, and Namespace now has following state: - -``` -{ - "apiVersion":"v1", - "kind": "Namespace", - "metadata": { - "name": "development", - "deletionTimestamp": "..." - }, - "spec": { - "finalizers": ["openshift.com/origin", "kubernetes"], - }, - "status": { - "phase": "Terminating", - }, - "labels": { - "name": "development" - }, -} -``` - -The Kubernetes *namespace controller* observes the namespace has a *deletionTimestamp* -and begins to terminate all of the content in the namespace that it knows about. Upon -success, it executes a *finalize* action that modifies the *Namespace* by -removing *kubernetes* from the list of finalizers: - -``` -{ - "apiVersion":"v1", - "kind": "Namespace", - "metadata": { - "name": "development", - "deletionTimestamp": "..." - }, - "spec": { - "finalizers": ["openshift.com/origin"], - }, - "status": { - "phase": "Terminating", - }, - "labels": { - "name": "development" - }, -} -``` - -OpenShift Origin has its own *namespace controller* that is observing cluster state, and -it observes the same namespace had a *deletionTimestamp* assigned to it. It too will go -and purge resources from its own storage that it manages associated with that namespace. -Upon completion, it executes a *finalize* action and removes the reference to "openshift.com/origin" -from the list of finalizers. - -This results in the following state: - -``` -{ - "apiVersion":"v1", - "kind": "Namespace", - "metadata": { - "name": "development", - "deletionTimestamp": "..." - }, - "spec": { - "finalizers": [], - }, - "status": { - "phase": "Terminating", - }, - "labels": { - "name": "development" - }, -} -``` - -At this point, the Kubernetes *namespace controller* in its sync loop will see that the namespace -has a deletion timestamp and that its list of finalizers is empty. As a result, it knows all -content associated from that namespace has been purged. It performs a final DELETE action -to remove that Namespace from the storage. - -At this point, all content associated with that Namespace, and the Namespace itself are gone. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/namespaces.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/namespaces.md?pixel)]() diff --git a/release-0.20.0/docs/design/networking.md b/release-0.20.0/docs/design/networking.md deleted file mode 100644 index 159dd570da6..00000000000 --- a/release-0.20.0/docs/design/networking.md +++ /dev/null @@ -1,114 +0,0 @@ -# Networking - -## Model and motivation - -Kubernetes deviates from the default Docker networking model. The goal is for each pod to have an IP in a flat shared networking namespace that has full communication with other physical computers and containers across the network. IP-per-pod creates a clean, backward-compatible model where pods can be treated much like VMs or physical hosts from the perspectives of port allocation, networking, naming, service discovery, load balancing, application configuration, and migration. - -OTOH, dynamic port allocation requires supporting both static ports (e.g., for externally accessible services) and dynamically allocated ports, requires partitioning centrally allocated and locally acquired dynamic ports, complicates scheduling (since ports are a scarce resource), is inconvenient for users, complicates application configuration, is plagued by port conflicts and reuse and exhaustion, requires non-standard approaches to naming (e.g., etcd rather than DNS), requires proxies and/or redirection for programs using standard naming/addressing mechanisms (e.g., web browsers), requires watching and cache invalidation for address/port changes for instances in addition to watching group membership changes, and obstructs container/pod migration (e.g., using CRIU). NAT introduces additional complexity by fragmenting the addressing space, which breaks self-registration mechanisms, among other problems. - -With the IP-per-pod model, all user containers within a pod behave as if they are on the same host with regard to networking. They can all reach each other’s ports on localhost. Ports which are published to the host interface are done so in the normal Docker way. All containers in all pods can talk to all other containers in all other pods by their 10-dot addresses. - -In addition to avoiding the aforementioned problems with dynamic port allocation, this approach reduces friction for applications moving from the world of uncontainerized apps on physical or virtual hosts to containers within pods. People running application stacks together on the same host have already figured out how to make ports not conflict (e.g., by configuring them through environment variables) and have arranged for clients to find them. - -The approach does reduce isolation between containers within a pod — ports could conflict, and there couldn't be private ports across containers within a pod, but applications requiring their own port spaces could just run as separate pods and processes requiring private communication could run within the same container. Besides, the premise of pods is that containers within a pod share some resources (volumes, cpu, ram, etc.) and therefore expect and tolerate reduced isolation. Additionally, the user can control what containers belong to the same pod whereas, in general, they don't control what pods land together on a host. - -When any container calls SIOCGIFADDR, it sees the IP that any peer container would see them coming from — each pod has its own IP address that other pods can know. By making IP addresses and ports the same within and outside the containers and pods, we create a NAT-less, flat address space. "ip addr show" should work as expected. This would enable all existing naming/discovery mechanisms to work out of the box, including self-registration mechanisms and applications that distribute IP addresses. (We should test that with etcd and perhaps one other option, such as Eureka (used by Acme Air) or Consul.) We should be optimizing for inter-pod network communication. Within a pod, containers are more likely to use communication through volumes (e.g., tmpfs) or IPC. - -This is different from the standard Docker model. In that mode, each container gets an IP in the 172-dot space and would only see that 172-dot address from SIOCGIFADDR. If these containers connect to another container the peer would see the connect coming from a different IP than the container itself knows. In short — you can never self-register anything from a container, because a container can not be reached on its private IP. - -An alternative we considered was an additional layer of addressing: pod-centric IP per container. Each container would have its own local IP address, visible only within that pod. This would perhaps make it easier for containerized applications to move from physical/virtual hosts to pods, but would be more complex to implement (e.g., requiring a bridge per pod, split-horizon/VP DNS) and to reason about, due to the additional layer of address translation, and would break self-registration and IP distribution mechanisms. - -## Current implementation - -For the Google Compute Engine cluster configuration scripts, [advanced routing](https://developers.google.com/compute/docs/networking#routing) is set up so that each VM has an extra 256 IP addresses that get routed to it. This is in addition to the 'main' IP address assigned to the VM that is NAT-ed for Internet access. The networking bridge (called `cbr0` to differentiate it from `docker0`) is set up outside of Docker proper and only does NAT for egress network traffic that isn't aimed at the virtual network. - -Ports mapped in from the 'main IP' (and hence the internet if the right firewall rules are set up) are proxied in user mode by Docker. In the future, this should be done with `iptables` by either the Kubelet or Docker: [Issue #15](https://github.com/GoogleCloudPlatform/kubernetes/issues/15). - -We start Docker with: - DOCKER_OPTS="--bridge cbr0 --iptables=false" - -We set up this bridge on each node with SaltStack, in [container_bridge.py](cluster/saltbase/salt/_states/container_bridge.py). - - cbr0: - container_bridge.ensure: - - cidr: {{ grains['cbr-cidr'] }} - ... - grains: - roles: - - kubernetes-pool - cbr-cidr: $MINION_IP_RANGE - -We make these addresses routable in GCE: - - gcloud compute routes add "${MINION_NAMES[$i]}" \ - --project "${PROJECT}" \ - --destination-range "${MINION_IP_RANGES[$i]}" \ - --network "${NETWORK}" \ - --next-hop-instance "${MINION_NAMES[$i]}" \ - --next-hop-instance-zone "${ZONE}" & - -The minion IP ranges are /24s in the 10-dot space. - -GCE itself does not know anything about these IPs, though. - -These are not externally routable, though, so containers that need to communicate with the outside world need to use host networking. To set up an external IP that forwards to the VM, it will only forward to the VM's primary IP (which is assigned to no pod). So we use docker's -p flag to map published ports to the main interface. This has the side effect of disallowing two pods from exposing the same port. (More discussion on this in [Issue #390](https://github.com/GoogleCloudPlatform/kubernetes/issues/390).) - -We create a container to use for the pod network namespace — a single loopback device and a single veth device. All the user's containers get their network namespaces from this pod networking container. - -Docker allocates IP addresses from a bridge we create on each node, using its “container†networking mode. - -1. Create a normal (in the networking sense) container which uses a minimal image and runs a command that blocks forever. This is not a user-defined container, and gets a special well-known name. - - creates a new network namespace (netns) and loopback device - - creates a new pair of veth devices and binds them to the netns - - auto-assigns an IP from docker’s IP range - -2. Create the user containers and specify the name of the pod infra container as their “POD†argument. Docker finds the PID of the command running in the pod infra container and attaches to the netns and ipcns of that PID. - -### Other networking implementation examples -With the primary aim of providing IP-per-pod-model, other implementations exist to serve the purpose outside of GCE. - - [OpenVSwitch with GRE/VxLAN](../ovs-networking.md) - - [Flannel](https://github.com/coreos/flannel#flannel) - -## Challenges and future work - -### Docker API - -Right now, docker inspect doesn't show the networking configuration of the containers, since they derive it from another container. That information should be exposed somehow. - -### External IP assignment - -We want to be able to assign IP addresses externally from Docker ([Docker issue #6743](https://github.com/dotcloud/docker/issues/6743)) so that we don't need to statically allocate fixed-size IP ranges to each node, so that IP addresses can be made stable across pod infra container restarts ([Docker issue #2801](https://github.com/dotcloud/docker/issues/2801)), and to facilitate pod migration. Right now, if the pod infra container dies, all the user containers must be stopped and restarted because the netns of the pod infra container will change on restart, and any subsequent user container restart will join that new netns, thereby not being able to see its peers. Additionally, a change in IP address would encounter DNS caching/TTL problems. External IP assignment would also simplify DNS support (see below). - -### Naming, discovery, and load balancing - -In addition to enabling self-registration with 3rd-party discovery mechanisms, we'd like to setup DDNS automatically ([Issue #146](https://github.com/GoogleCloudPlatform/kubernetes/issues/146)). hostname, $HOSTNAME, etc. should return a name for the pod ([Issue #298](https://github.com/GoogleCloudPlatform/kubernetes/issues/298)), and gethostbyname should be able to resolve names of other pods. Probably we need to set up a DNS resolver to do the latter ([Docker issue #2267](https://github.com/dotcloud/docker/issues/2267)), so that we don't need to keep /etc/hosts files up to date dynamically. - -[Service](http://docs.k8s.io/services.md) endpoints are currently found through environment variables. Both [Docker-links-compatible](https://docs.docker.com/userguide/dockerlinks/) variables and kubernetes-specific variables ({NAME}_SERVICE_HOST and {NAME}_SERVICE_BAR) are supported, and resolve to ports opened by the service proxy. We don't actually use [the Docker ambassador pattern](https://docs.docker.com/articles/ambassador_pattern_linking/) to link containers because we don't require applications to identify all clients at configuration time, yet. While services today are managed by the service proxy, this is an implementation detail that applications should not rely on. Clients should instead use the [service IP](http://docs.k8s.io/services.md) (which the above environment variables will resolve to). However, a flat service namespace doesn't scale and environment variables don't permit dynamic updates, which complicates service deployment by imposing implicit ordering constraints. We intend to register each service's IP in DNS, and for that to become the preferred resolution protocol. - -We'd also like to accommodate other load-balancing solutions (e.g., HAProxy), non-load-balanced services ([Issue #260](https://github.com/GoogleCloudPlatform/kubernetes/issues/260)), and other types of groups (worker pools, etc.). Providing the ability to Watch a label selector applied to pod addresses would enable efficient monitoring of group membership, which could be directly consumed or synced with a discovery mechanism. Event hooks ([Issue #140](https://github.com/GoogleCloudPlatform/kubernetes/issues/140)) for join/leave events would probably make this even easier. - -### External routability - -We want traffic between containers to use the pod IP addresses across nodes. Say we have Node A with a container IP space of 10.244.1.0/24 and Node B with a container IP space of 10.244.2.0/24. And we have Container A1 at 10.244.1.1 and Container B1 at 10.244.2.1. We want Container A1 to talk to Container B1 directly with no NAT. B1 should see the "source" in the IP packets of 10.244.1.1 — not the "primary" host IP for Node A. That means that we want to turn off NAT for traffic between containers (and also between VMs and containers). - -We'd also like to make pods directly routable from the external internet. However, we can't yet support the extra container IPs that we've provisioned talking to the internet directly. So, we don't map external IPs to the container IPs. Instead, we solve that problem by having traffic that isn't to the internal network (! 10.0.0.0/8) get NATed through the primary host IP address so that it can get 1:1 NATed by the GCE networking when talking to the internet. Similarly, incoming traffic from the internet has to get NATed/proxied through the host IP. - -So we end up with 3 cases: - -1. Container -> Container or Container <-> VM. These should use 10. addresses directly and there should be no NAT. - -2. Container -> Internet. These have to get mapped to the primary host IP so that GCE knows how to egress that traffic. There is actually 2 layers of NAT here: Container IP -> Internal Host IP -> External Host IP. The first level happens in the guest with IP tables and the second happens as part of GCE networking. The first one (Container IP -> internal host IP) does dynamic port allocation while the second maps ports 1:1. - -3. Internet -> Container. This also has to go through the primary host IP and also has 2 levels of NAT, ideally. However, the path currently is a proxy with (External Host IP -> Internal Host IP -> Docker) -> (Docker -> Container IP). Once [issue #15](https://github.com/GoogleCloudPlatform/kubernetes/issues/15) is closed, it should be External Host IP -> Internal Host IP -> Container IP. But to get that second arrow we have to set up the port forwarding iptables rules per mapped port. - -Another approach could be to create a new host interface alias for each pod, if we had a way to route an external IP to it. This would eliminate the scheduling constraints resulting from using the host's IP address. - -### IPv6 - -IPv6 would be a nice option, also, but we can't depend on it yet. Docker support is in progress: [Docker issue #2974](https://github.com/dotcloud/docker/issues/2974), [Docker issue #6923](https://github.com/dotcloud/docker/issues/6923), [Docker issue #6975](https://github.com/dotcloud/docker/issues/6975). Additionally, direct ipv6 assignment to instances doesn't appear to be supported by major cloud providers (e.g., AWS EC2, GCE) yet. We'd happily take pull requests from people running Kubernetes on bare metal, though. :-) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/networking.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/networking.md?pixel)]() diff --git a/release-0.20.0/docs/design/persistent-storage.md b/release-0.20.0/docs/design/persistent-storage.md deleted file mode 100644 index 3c6f2ed645b..00000000000 --- a/release-0.20.0/docs/design/persistent-storage.md +++ /dev/null @@ -1,220 +0,0 @@ -# Persistent Storage - -This document proposes a model for managing persistent, cluster-scoped storage for applications requiring long lived data. - -### tl;dr - -Two new API kinds: - -A `PersistentVolume` (PV) is a storage resource provisioned by an administrator. It is analogous to a node. - -A `PersistentVolumeClaim` (PVC) is a user's request for a persistent volume to use in a pod. It is analogous to a pod. - -One new system component: - -`PersistentVolumeClaimBinder` is a singleton running in master that watches all PersistentVolumeClaims in the system and binds them to the closest matching available PersistentVolume. The volume manager watches the API for newly created volumes to manage. - -One new volume: - -`PersistentVolumeClaimVolumeSource` references the user's PVC in the same namespace. This volume finds the bound PV and mounts that volume for the pod. A `PersistentVolumeClaimVolumeSource` is, essentially, a wrapper around another type of volume that is owned by someone else (the system). - -Kubernetes makes no guarantees at runtime that the underlying storage exists or is available. High availability is left to the storage provider. - -### Goals - -* Allow administrators to describe available storage -* Allow pod authors to discover and request persistent volumes to use with pods -* Enforce security through access control lists and securing storage to the same namespace as the pod volume -* Enforce quotas through admission control -* Enforce scheduler rules by resource counting -* Ensure developers can rely on storage being available without being closely bound to a particular disk, server, network, or storage device. - - -#### Describe available storage - -Cluster administrators use the API to manage *PersistentVolumes*. A custom store ```NewPersistentVolumeOrderedIndex``` will index volumes by access modes and sort by storage capacity. The ```PersistentVolumeClaimBinder``` watches for new claims for storage and binds them to an available volume by matching the volume's characteristics (AccessModes and storage size) to the user's request. - -PVs are system objects and, thus, have no namespace. - -Many means of dynamic provisioning will be eventually be implemented for various storage types. - - -##### PersistentVolume API - -| Action | HTTP Verb | Path | Description | -| ---- | ---- | ---- | ---- | -| CREATE | POST | /api/{version}/persistentvolumes/ | Create instance of PersistentVolume | -| GET | GET | /api/{version}persistentvolumes/{name} | Get instance of PersistentVolume with {name} | -| UPDATE | PUT | /api/{version}/persistentvolumes/{name} | Update instance of PersistentVolume with {name} | -| DELETE | DELETE | /api/{version}/persistentvolumes/{name} | Delete instance of PersistentVolume with {name} | -| LIST | GET | /api/{version}/persistentvolumes | List instances of PersistentVolume | -| WATCH | GET | /api/{version}/watch/persistentvolumes | Watch for changes to a PersistentVolume | - - -#### Request Storage - -Kubernetes users request persistent storage for their pod by creating a ```PersistentVolumeClaim```. Their request for storage is described by their requirements for resources and mount capabilities. - -Requests for volumes are bound to available volumes by the volume manager, if a suitable match is found. Requests for resources can go unfulfilled. - -Users attach their claim to their pod using a new ```PersistentVolumeClaimVolumeSource``` volume source. - - -##### PersistentVolumeClaim API - - -| Action | HTTP Verb | Path | Description | -| ---- | ---- | ---- | ---- | -| CREATE | POST | /api/{version}/namespaces/{ns}/persistentvolumeclaims/ | Create instance of PersistentVolumeClaim in namespace {ns} | -| GET | GET | /api/{version}/namespaces/{ns}/persistentvolumeclaims/{name} | Get instance of PersistentVolumeClaim in namespace {ns} with {name} | -| UPDATE | PUT | /api/{version}/namespaces/{ns}/persistentvolumeclaims/{name} | Update instance of PersistentVolumeClaim in namespace {ns} with {name} | -| DELETE | DELETE | /api/{version}/namespaces/{ns}/persistentvolumeclaims/{name} | Delete instance of PersistentVolumeClaim in namespace {ns} with {name} | -| LIST | GET | /api/{version}/namespaces/{ns}/persistentvolumeclaims | List instances of PersistentVolumeClaim in namespace {ns} | -| WATCH | GET | /api/{version}/watch/namespaces/{ns}/persistentvolumeclaims | Watch for changes to PersistentVolumeClaim in namespace {ns} | - - - -#### Scheduling constraints - -Scheduling constraints are to be handled similar to pod resource constraints. Pods will need to be annotated or decorated with the number of resources it requires on a node. Similarly, a node will need to list how many it has used or available. - -TBD - - -#### Events - -The implementation of persistent storage will not require events to communicate to the user the state of their claim. The CLI for bound claims contains a reference to the backing persistent volume. This is always present in the API and CLI, making an event to communicate the same unnecessary. - -Events that communicate the state of a mounted volume are left to the volume plugins. - - -### Example - -#### Admin provisions storage - -An administrator provisions storage by posting PVs to the API. Various way to automate this task can be scripted. Dynamic provisioning is a future feature that can maintain levels of PVs. - -``` -POST: - -kind: PersistentVolume -apiVersion: v1 -metadata: - name: pv0001 -spec: - capacity: - storage: 10 - persistentDisk: - pdName: "abc123" - fsType: "ext4" - --------------------------------------------------- - -kubectl get pv - -NAME LABELS CAPACITY ACCESSMODES STATUS CLAIM -pv0001 map[] 10737418240 RWO Pending - - -``` - -#### Users request storage - -A user requests storage by posting a PVC to the API. Their request contains the AccessModes they wish their volume to have and the minimum size needed. - -The user must be within a namespace to create PVCs. - -``` - -POST: -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: - name: myclaim-1 -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 3 - --------------------------------------------------- - -kubectl get pvc - - -NAME LABELS STATUS VOLUME -myclaim-1 map[] pending - -``` - - -#### Matching and binding - - The ```PersistentVolumeClaimBinder``` attempts to find an available volume that most closely matches the user's request. If one exists, they are bound by putting a reference on the PV to the PVC. Requests can go unfulfilled if a suitable match is not found. - -``` - -kubectl get pv - -NAME LABELS CAPACITY ACCESSMODES STATUS CLAIM -pv0001 map[] 10737418240 RWO Bound myclaim-1 / f4b3d283-c0ef-11e4-8be4-80e6500a981e - - -kubectl get pvc - -NAME LABELS STATUS VOLUME -myclaim-1 map[] Bound b16e91d6-c0ef-11e4-8be4-80e6500a981e - - -``` - -#### Claim usage - -The claim holder can use their claim as a volume. The ```PersistentVolumeClaimVolumeSource``` knows to fetch the PV backing the claim and mount its volume for a pod. - -The claim holder owns the claim and its data for as long as the claim exists. The pod using the claim can be deleted, but the claim remains in the user's namespace. It can be used again and again by many pods. - -``` -POST: - -kind: Pod -apiVersion: v1 -metadata: - name: mypod -spec: - containers: - - image: nginx - name: myfrontend - volumeMounts: - - mountPath: "/var/www/html" - name: mypd - volumes: - - name: mypd - source: - persistentVolumeClaim: - accessMode: ReadWriteOnce - claimRef: - name: myclaim-1 - -``` - -#### Releasing a claim and Recycling a volume - -When a claim holder is finished with their data, they can delete their claim. - -``` - -kubectl delete pvc myclaim-1 - -``` - -The ```PersistentVolumeClaimBinder``` will reconcile this by removing the claim reference from the PV and change the PVs status to 'Released'. - -Admins can script the recycling of released volumes. Future dynamic provisioners will understand how a volume should be recycled. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/persistent-storage.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/persistent-storage.md?pixel)]() diff --git a/release-0.20.0/docs/design/principles.md b/release-0.20.0/docs/design/principles.md deleted file mode 100644 index 548de192c81..00000000000 --- a/release-0.20.0/docs/design/principles.md +++ /dev/null @@ -1,61 +0,0 @@ -# Design Principles - -Principles to follow when extending Kubernetes. - -## API - -See also the [API conventions](../api-conventions.md). - -* All APIs should be declarative. -* API objects should be complementary and composable, not opaque wrappers. -* The control plane should be transparent -- there are no hidden internal APIs. -* The cost of API operations should be proportional to the number of objects intentionally operated upon. Therefore, common filtered lookups must be indexed. Beware of patterns of multiple API calls that would incur quadratic behavior. -* Object status must be 100% reconstructable by observation. Any history kept must be just an optimization and not required for correct operation. -* Cluster-wide invariants are difficult to enforce correctly. Try not to add them. If you must have them, don't enforce them atomically in master components, that is contention-prone and doesn't provide a recovery path in the case of a bug allowing the invariant to be violated. Instead, provide a series of checks to reduce the probability of a violation, and make every component involved able to recover from an invariant violation. -* Low-level APIs should be designed for control by higher-level systems. Higher-level APIs should be intent-oriented (think SLOs) rather than implementation-oriented (think control knobs). - -## Control logic - -* Functionality must be *level-based*, meaning the system must operate correctly given the desired state and the current/observed state, regardless of how many intermediate state updates may have been missed. Edge-triggered behavior must be just an optimization. -* Assume an open world: continually verify assumptions and gracefully adapt to external events and/or actors. Example: we allow users to kill pods under control of a replication controller; it just replaces them. -* Do not define comprehensive state machines for objects with behaviors associated with state transitions and/or "assumed" states that cannot be ascertained by observation. -* Don't assume a component's decisions will not be overridden or rejected, nor for the component to always understand why. For example, etcd may reject writes. Kubelet may reject pods. The scheduler may not be able to schedule pods. Retry, but back off and/or make alternative decisions. -* Components should be self-healing. For example, if you must keep some state (e.g., cache) the content needs to be periodically refreshed, so that if an item does get erroneously stored or a deletion event is missed etc, it will be soon fixed, ideally on timescales that are shorter than what will attract attention from humans. -* Component behavior should degrade gracefully. Prioritize actions so that the most important activities can continue to function even when overloaded and/or in states of partial failure. - -## Architecture - -* Only the apiserver should communicate with etcd/store, and not other components (scheduler, kubelet, etc.). -* Compromising a single node shouldn't compromise the cluster. -* Components should continue to do what they were last told in the absence of new instructions (e.g., due to network partition or component outage). -* All components should keep all relevant state in memory all the time. The apiserver should write through to etcd/store, other components should write through to the apiserver, and they should watch for updates made by other clients. -* Watch is preferred over polling. - -## Extensibility - -TODO: pluggability - -## Bootstrapping - -* [Self-hosting](https://github.com/GoogleCloudPlatform/kubernetes/issues/246) of all components is a goal. -* Minimize the number of dependencies, particularly those required for steady-state operation. -* Stratify the dependencies that remain via principled layering. -* Break any circular dependencies by converting hard dependencies to soft dependencies. - * Also accept that data from other components from another source, such as local files, which can then be manually populated at bootstrap time and then continuously updated once those other components are available. - * State should be rediscoverable and/or reconstructable. - * Make it easy to run temporary, bootstrap instances of all components in order to create the runtime state needed to run the components in the steady state; use a lock (master election for distributed components, file lock for local components like Kubelet) to coordinate handoff. We call this technique "pivoting". - * Have a solution to restart dead components. For distributed components, replication works well. For local components such as Kubelet, a process manager or even a simple shell loop works. - -## Availability - -TODO - -## General principles - -* [Eric Raymond's 17 UNIX rules](https://en.wikipedia.org/wiki/Unix_philosophy#Eric_Raymond.E2.80.99s_17_Unix_Rules) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/principles.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/principles.md?pixel)]() diff --git a/release-0.20.0/docs/design/secrets.md b/release-0.20.0/docs/design/secrets.md deleted file mode 100644 index 533ce73c2fa..00000000000 --- a/release-0.20.0/docs/design/secrets.md +++ /dev/null @@ -1,582 +0,0 @@ - -## Abstract - -A proposal for the distribution of secrets (passwords, keys, etc) to the Kubelet and to -containers inside Kubernetes using a custom volume type. - -## Motivation - -Secrets are needed in containers to access internal resources like the Kubernetes master or -external resources such as git repositories, databases, etc. Users may also want behaviors in the -kubelet that depend on secret data (credentials for image pull from a docker registry) associated -with pods. - -Goals of this design: - -1. Describe a secret resource -2. Define the various challenges attendant to managing secrets on the node -3. Define a mechanism for consuming secrets in containers without modification - -## Constraints and Assumptions - -* This design does not prescribe a method for storing secrets; storage of secrets should be - pluggable to accommodate different use-cases -* Encryption of secret data and node security are orthogonal concerns -* It is assumed that node and master are secure and that compromising their security could also - compromise secrets: - * If a node is compromised, the only secrets that could potentially be exposed should be the - secrets belonging to containers scheduled onto it - * If the master is compromised, all secrets in the cluster may be exposed -* Secret rotation is an orthogonal concern, but it should be facilitated by this proposal -* A user who can consume a secret in a container can know the value of the secret; secrets must - be provisioned judiciously - -## Use Cases - -1. As a user, I want to store secret artifacts for my applications and consume them securely in - containers, so that I can keep the configuration for my applications separate from the images - that use them: - 1. As a cluster operator, I want to allow a pod to access the Kubernetes master using a custom - `.kubeconfig` file, so that I can securely reach the master - 2. As a cluster operator, I want to allow a pod to access a Docker registry using credentials - from a `.dockercfg` file, so that containers can push images - 3. As a cluster operator, I want to allow a pod to access a git repository using SSH keys, - so that I can push and fetch to and from the repository -2. As a user, I want to allow containers to consume supplemental information about services such - as username and password which should be kept secret, so that I can share secrets about a - service amongst the containers in my application securely -3. As a user, I want to associate a pod with a `ServiceAccount` that consumes a secret and have - the kubelet implement some reserved behaviors based on the types of secrets the service account - consumes: - 1. Use credentials for a docker registry to pull the pod's docker image - 2. Present kubernetes auth token to the pod or transparently decorate traffic between the pod - and master service -4. As a user, I want to be able to indicate that a secret expires and for that secret's value to - be rotated once it expires, so that the system can help me follow good practices - -### Use-Case: Configuration artifacts - -Many configuration files contain secrets intermixed with other configuration information. For -example, a user's application may contain a properties file than contains database credentials, -SaaS API tokens, etc. Users should be able to consume configuration artifacts in their containers -and be able to control the path on the container's filesystems where the artifact will be -presented. - -### Use-Case: Metadata about services - -Most pieces of information about how to use a service are secrets. For example, a service that -provides a MySQL database needs to provide the username, password, and database name to consumers -so that they can authenticate and use the correct database. Containers in pods consuming the MySQL -service would also consume the secrets associated with the MySQL service. - -### Use-Case: Secrets associated with service accounts - -[Service Accounts](http://docs.k8s.io/design/service_accounts.md) are proposed as a -mechanism to decouple capabilities and security contexts from individual human users. A -`ServiceAccount` contains references to some number of secrets. A `Pod` can specify that it is -associated with a `ServiceAccount`. Secrets should have a `Type` field to allow the Kubelet and -other system components to take action based on the secret's type. - -#### Example: service account consumes auth token secret - -As an example, the service account proposal discusses service accounts consuming secrets which -contain kubernetes auth tokens. When a Kubelet starts a pod associated with a service account -which consumes this type of secret, the Kubelet may take a number of actions: - -1. Expose the secret in a `.kubernetes_auth` file in a well-known location in the container's - file system -2. Configure that node's `kube-proxy` to decorate HTTP requests from that pod to the - `kubernetes-master` service with the auth token, e. g. by adding a header to the request - (see the [LOAS Daemon](https://github.com/GoogleCloudPlatform/kubernetes/issues/2209) proposal) - -#### Example: service account consumes docker registry credentials - -Another example use case is where a pod is associated with a secret containing docker registry -credentials. The Kubelet could use these credentials for the docker pull to retrieve the image. - -### Use-Case: Secret expiry and rotation - -Rotation is considered a good practice for many types of secret data. It should be possible to -express that a secret has an expiry date; this would make it possible to implement a system -component that could regenerate expired secrets. As an example, consider a component that rotates -expired secrets. The rotator could periodically regenerate the values for expired secrets of -common types and update their expiry dates. - -## Deferral: Consuming secrets as environment variables - -Some images will expect to receive configuration items as environment variables instead of files. -We should consider what the best way to allow this is; there are a few different options: - -1. Force the user to adapt files into environment variables. Users can store secrets that need to - be presented as environment variables in a format that is easy to consume from a shell: - - $ cat /etc/secrets/my-secret.txt - export MY_SECRET_ENV=MY_SECRET_VALUE - - The user could `source` the file at `/etc/secrets/my-secret` prior to executing the command for - the image either inline in the command or in an init script, - -2. Give secrets an attribute that allows users to express the intent that the platform should - generate the above syntax in the file used to present a secret. The user could consume these - files in the same manner as the above option. - -3. Give secrets attributes that allow the user to express that the secret should be presented to - the container as an environment variable. The container's environment would contain the - desired values and the software in the container could use them without accommodation the - command or setup script. - -For our initial work, we will treat all secrets as files to narrow the problem space. There will -be a future proposal that handles exposing secrets as environment variables. - -## Flow analysis of secret data with respect to the API server - -There are two fundamentally different use-cases for access to secrets: - -1. CRUD operations on secrets by their owners -2. Read-only access to the secrets needed for a particular node by the kubelet - -### Use-Case: CRUD operations by owners - -In use cases for CRUD operations, the user experience for secrets should be no different than for -other API resources. - -#### Data store backing the REST API - -The data store backing the REST API should be pluggable because different cluster operators will -have different preferences for the central store of secret data. Some possibilities for storage: - -1. An etcd collection alongside the storage for other API resources -2. A collocated [HSM](http://en.wikipedia.org/wiki/Hardware_security_module) -3. A secrets server like [Vault](https://www.vaultproject.io/) or [Keywhiz](https://square.github.io/keywhiz/) -4. An external datastore such as an external etcd, RDBMS, etc. - -#### Size limit for secrets - -There should be a size limit for secrets in order to: - -1. Prevent DOS attacks against the API server -2. Allow kubelet implementations that prevent secret data from touching the node's filesystem - -The size limit should satisfy the following conditions: - -1. Large enough to store common artifact types (encryption keypairs, certificates, small - configuration files) -2. Small enough to avoid large impact on node resource consumption (storage, RAM for tmpfs, etc) - -To begin discussion, we propose an initial value for this size limit of **1MB**. - -#### Other limitations on secrets - -Defining a policy for limitations on how a secret may be referenced by another API resource and how -constraints should be applied throughout the cluster is tricky due to the number of variables -involved: - -1. Should there be a maximum number of secrets a pod can reference via a volume? -2. Should there be a maximum number of secrets a service account can reference? -3. Should there be a total maximum number of secrets a pod can reference via its own spec and its - associated service account? -4. Should there be a total size limit on the amount of secret data consumed by a pod? -5. How will cluster operators want to be able to configure these limits? -6. How will these limits impact API server validations? -7. How will these limits affect scheduling? - -For now, we will not implement validations around these limits. Cluster operators will decide how -much node storage is allocated to secrets. It will be the operator's responsibility to ensure that -the allocated storage is sufficient for the workload scheduled onto a node. - -For now, kubelets will only attach secrets to api-sourced pods, and not file- or http-sourced -ones. Doing so would: - - confuse the secrets admission controller in the case of mirror pods. - - create an apiserver-liveness dependency -- avoiding this dependency is a main reason to use non-api-source pods. - -### Use-Case: Kubelet read of secrets for node - -The use-case where the kubelet reads secrets has several additional requirements: - -1. Kubelets should only be able to receive secret data which is required by pods scheduled onto - the kubelet's node -2. Kubelets should have read-only access to secret data -3. Secret data should not be transmitted over the wire insecurely -4. Kubelets must ensure pods do not have access to each other's secrets - -#### Read of secret data by the Kubelet - -The Kubelet should only be allowed to read secrets which are consumed by pods scheduled onto that -Kubelet's node and their associated service accounts. Authorization of the Kubelet to read this -data would be delegated to an authorization plugin and associated policy rule. - -#### Secret data on the node: data at rest - -Consideration must be given to whether secret data should be allowed to be at rest on the node: - -1. If secret data is not allowed to be at rest, the size of secret data becomes another draw on - the node's RAM - should it affect scheduling? -2. If secret data is allowed to be at rest, should it be encrypted? - 1. If so, how should be this be done? - 2. If not, what threats exist? What types of secret are appropriate to store this way? - -For the sake of limiting complexity, we propose that initially secret data should not be allowed -to be at rest on a node; secret data should be stored on a node-level tmpfs filesystem. This -filesystem can be subdivided into directories for use by the kubelet and by the volume plugin. - -#### Secret data on the node: resource consumption - -The Kubelet will be responsible for creating the per-node tmpfs file system for secret storage. -It is hard to make a prescriptive declaration about how much storage is appropriate to reserve for -secrets because different installations will vary widely in available resources, desired pod to -node density, overcommit policy, and other operation dimensions. That being the case, we propose -for simplicity that the amount of secret storage be controlled by a new parameter to the kubelet -with a default value of **64MB**. It is the cluster operator's responsibility to handle choosing -the right storage size for their installation and configuring their Kubelets correctly. - -Configuring each Kubelet is not the ideal story for operator experience; it is more intuitive that -the cluster-wide storage size be readable from a central configuration store like the one proposed -in [#1553](https://github.com/GoogleCloudPlatform/kubernetes/issues/1553). When such a store -exists, the Kubelet could be modified to read this configuration item from the store. - -When the Kubelet is modified to advertise node resources (as proposed in -[#4441](https://github.com/GoogleCloudPlatform/kubernetes/issues/4441)), the capacity calculation -for available memory should factor in the potential size of the node-level tmpfs in order to avoid -memory overcommit on the node. - -#### Secret data on the node: isolation - -Every pod will have a [security context](http://docs.k8s.io/design/security_context.md). -Secret data on the node should be isolated according to the security context of the container. The -Kubelet volume plugin API will be changed so that a volume plugin receives the security context of -a volume along with the volume spec. This will allow volume plugins to implement setting the -security context of volumes they manage. - -## Community work: - -Several proposals / upstream patches are notable as background for this proposal: - -1. [Docker vault proposal](https://github.com/docker/docker/issues/10310) -2. [Specification for image/container standardization based on volumes](https://github.com/docker/docker/issues/9277) -3. [Kubernetes service account proposal](http://docs.k8s.io/design/service_accounts.md) -4. [Secrets proposal for docker (1)](https://github.com/docker/docker/pull/6075) -5. [Secrets proposal for docker (2)](https://github.com/docker/docker/pull/6697) - -## Proposed Design - -We propose a new `Secret` resource which is mounted into containers with a new volume type. Secret -volumes will be handled by a volume plugin that does the actual work of fetching the secret and -storing it. Secrets contain multiple pieces of data that are presented as different files within -the secret volume (example: SSH key pair). - -In order to remove the burden from the end user in specifying every file that a secret consists of, -it should be possible to mount all files provided by a secret with a single ```VolumeMount``` entry -in the container specification. - -### Secret API Resource - -A new resource for secrets will be added to the API: - -```go -type Secret struct { - TypeMeta - ObjectMeta - - // Data contains the secret data. Each key must be a valid DNS_SUBDOMAIN. - // The serialized form of the secret data is a base64 encoded string, - // representing the arbitrary (possibly non-string) data value here. - Data map[string][]byte `json:"data,omitempty"` - - // Used to facilitate programmatic handling of secret data. - Type SecretType `json:"type,omitempty"` -} - -type SecretType string - -const ( - SecretTypeOpaque SecretType = "Opaque" // Opaque (arbitrary data; default) - SecretTypeKubernetesAuthToken SecretType = "KubernetesAuth" // Kubernetes auth token - SecretTypeDockerRegistryAuth SecretType = "DockerRegistryAuth" // Docker registry auth - // FUTURE: other type values -) - -const MaxSecretSize = 1 * 1024 * 1024 -``` - -A Secret can declare a type in order to provide type information to system components that work -with secrets. The default type is `opaque`, which represents arbitrary user-owned data. - -Secrets are validated against `MaxSecretSize`. The keys in the `Data` field must be valid DNS -subdomains. - -A new REST API and registry interface will be added to accompany the `Secret` resource. The -default implementation of the registry will store `Secret` information in etcd. Future registry -implementations could store the `TypeMeta` and `ObjectMeta` fields in etcd and store the secret -data in another data store entirely, or store the whole object in another data store. - -#### Other validations related to secrets - -Initially there will be no validations for the number of secrets a pod references, or the number of -secrets that can be associated with a service account. These may be added in the future as the -finer points of secrets and resource allocation are fleshed out. - -### Secret Volume Source - -A new `SecretSource` type of volume source will be added to the ```VolumeSource``` struct in the -API: - -```go -type VolumeSource struct { - // Other fields omitted - - // SecretSource represents a secret that should be presented in a volume - SecretSource *SecretSource `json:"secret"` -} - -type SecretSource struct { - Target ObjectReference -} -``` - -Secret volume sources are validated to ensure that the specified object reference actually points -to an object of type `Secret`. - -In the future, the `SecretSource` will be extended to allow: - -1. Fine-grained control over which pieces of secret data are exposed in the volume -2. The paths and filenames for how secret data are exposed - -### Secret Volume Plugin - -A new Kubelet volume plugin will be added to handle volumes with a secret source. This plugin will -require access to the API server to retrieve secret data and therefore the volume `Host` interface -will have to change to expose a client interface: - -```go -type Host interface { - // Other methods omitted - - // GetKubeClient returns a client interface - GetKubeClient() client.Interface -} -``` - -The secret volume plugin will be responsible for: - -1. Returning a `volume.Builder` implementation from `NewBuilder` that: - 1. Retrieves the secret data for the volume from the API server - 2. Places the secret data onto the container's filesystem - 3. Sets the correct security attributes for the volume based on the pod's `SecurityContext` -2. Returning a `volume.Cleaner` implementation from `NewClear` that cleans the volume from the - container's filesystem - -### Kubelet: Node-level secret storage - -The Kubelet must be modified to accept a new parameter for the secret storage size and to create -a tmpfs file system of that size to store secret data. Rough accounting of specific changes: - -1. The Kubelet should have a new field added called `secretStorageSize`; units are megabytes -2. `NewMainKubelet` should accept a value for secret storage size -3. The Kubelet server should have a new flag added for secret storage size -4. The Kubelet's `setupDataDirs` method should be changed to create the secret storage - -### Kubelet: New behaviors for secrets associated with service accounts - -For use-cases where the Kubelet's behavior is affected by the secrets associated with a pod's -`ServiceAccount`, the Kubelet will need to be changed. For example, if secrets of type -`docker-reg-auth` affect how the pod's images are pulled, the Kubelet will need to be changed -to accommodate this. Subsequent proposals can address this on a type-by-type basis. - -## Examples - -For clarity, let's examine some detailed examples of some common use-cases in terms of the -suggested changes. All of these examples are assumed to be created in a namespace called -`example`. - -### Use-Case: Pod with ssh keys - -To create a pod that uses an ssh key stored as a secret, we first need to create a secret: - -```json -{ - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "ssh-key-secret" - }, - "data": { - "id-rsa": "dmFsdWUtMg0KDQo=", - "id-rsa.pub": "dmFsdWUtMQ0K" - } -} -``` - -**Note:** The serialized JSON and YAML values of secret data are encoded as -base64 strings. Newlines are not valid within these strings and must be -omitted. - -Now we can create a pod which references the secret with the ssh key and consumes it in a volume: - -```json -{ - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "secret-test-pod", - "labels": { - "name": "secret-test" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "ssh-key-secret" - } - } - ], - "containers": [ - { - "name": "ssh-test-container", - "image": "mySshImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } -} -``` - -When the container's command runs, the pieces of the key will be available in: - - /etc/secret-volume/id-rsa.pub - /etc/secret-volume/id-rsa - -The container is then free to use the secret data to establish an ssh connection. - -### Use-Case: Pods with pod / test credentials - -This example illustrates a pod which consumes a secret containing prod -credentials and another pod which consumes a secret with test environment -credentials. - -The secrets: - -```json -{ - "apiVersion": "v1", - "kind": "List", - "items": - [{ - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "prod-db-secret" - }, - "data": { - "password": "dmFsdWUtMg0KDQo=", - "username": "dmFsdWUtMQ0K" - } - }, - { - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "test-db-secret" - }, - "data": { - "password": "dmFsdWUtMg0KDQo=", - "username": "dmFsdWUtMQ0K" - } - }] -} -``` - -The pods: - -```json -{ - "apiVersion": "v1", - "kind": "List", - "items": - [{ - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "prod-db-client-pod", - "labels": { - "name": "prod-db-client" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "prod-db-secret" - } - } - ], - "containers": [ - { - "name": "db-client-container", - "image": "myClientImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } - }, - { - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "test-db-client-pod", - "labels": { - "name": "test-db-client" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "test-db-secret" - } - } - ], - "containers": [ - { - "name": "db-client-container", - "image": "myClientImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } - }] -} -``` - -The specs for the two pods differ only in the value of the object referred to by the secret volume -source. Both containers will have the following files present on their filesystems: - - /etc/secret-volume/username - /etc/secret-volume/password - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/secrets.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/secrets.md?pixel)]() diff --git a/release-0.20.0/docs/design/security.md b/release-0.20.0/docs/design/security.md deleted file mode 100644 index 52f25225dbf..00000000000 --- a/release-0.20.0/docs/design/security.md +++ /dev/null @@ -1,123 +0,0 @@ -# Security in Kubernetes - -Kubernetes should define a reasonable set of security best practices that allows processes to be isolated from each other, from the cluster infrastructure, and which preserves important boundaries between those who manage the cluster, and those who use the cluster. - -While Kubernetes today is not primarily a multi-tenant system, the long term evolution of Kubernetes will increasingly rely on proper boundaries between users and administrators. The code running on the cluster must be appropriately isolated and secured to prevent malicious parties from affecting the entire cluster. - - -## High Level Goals - -1. Ensure a clear isolation between the container and the underlying host it runs on -2. Limit the ability of the container to negatively impact the infrastructure or other containers -3. [Principle of Least Privilege](http://en.wikipedia.org/wiki/Principle_of_least_privilege) - ensure components are only authorized to perform the actions they need, and limit the scope of a compromise by limiting the capabilities of individual components -4. Reduce the number of systems that have to be hardened and secured by defining clear boundaries between components -5. Allow users of the system to be cleanly separated from administrators -6. Allow administrative functions to be delegated to users where necessary -7. Allow applications to be run on the cluster that have "secret" data (keys, certs, passwords) which is properly abstracted from "public" data. - - -## Use cases - -### Roles: - -We define "user" as a unique identity accessing the Kubernetes API server, which may be a human or an automated process. Human users fall into the following categories: - -1. k8s admin - administers a kubernetes cluster and has access to the underlying components of the system -2. k8s project administrator - administrates the security of a small subset of the cluster -3. k8s developer - launches pods on a kubernetes cluster and consumes cluster resources - -Automated process users fall into the following categories: - -1. k8s container user - a user that processes running inside a container (on the cluster) can use to access other cluster resources independent of the human users attached to a project -2. k8s infrastructure user - the user that kubernetes infrastructure components use to perform cluster functions with clearly defined roles - - -### Description of roles: - -* Developers: - * write pod specs. - * making some of their own images, and using some "community" docker images - * know which pods need to talk to which other pods - * decide which pods should share files with other pods, and which should not. - * reason about application level security, such as containing the effects of a local-file-read exploit in a webserver pod. - * do not often reason about operating system or organizational security. - * are not necessarily comfortable reasoning about the security properties of a system at the level of detail of Linux Capabilities, SELinux, AppArmor, etc. - -* Project Admins: - * allocate identity and roles within a namespace - * reason about organizational security within a namespace - * don't give a developer permissions that are not needed for role. - * protect files on shared storage from unnecessary cross-team access - * are less focused about application security - -* Administrators: - * are less focused on application security. Focused on operating system security. - * protect the node from bad actors in containers, and properly-configured innocent containers from bad actors in other containers. - * comfortable reasoning about the security properties of a system at the level of detail of Linux Capabilities, SELinux, AppArmor, etc. - * decides who can use which Linux Capabilities, run privileged containers, use hostDir, etc. - * e.g. a team that manages Ceph or a mysql server might be trusted to have raw access to storage devices in some organizations, but teams that develop the applications at higher layers would not. - - -## Proposed Design - -A pod runs in a *security context* under a *service account* that is defined by an administrator or project administrator, and the *secrets* a pod has access to is limited by that *service account*. - - -1. The API should authenticate and authorize user actions [authn and authz](http://docs.k8s.io/design/access.md) -2. All infrastructure components (kubelets, kube-proxies, controllers, scheduler) should have an infrastructure user that they can authenticate with and be authorized to perform only the functions they require against the API. -3. Most infrastructure components should use the API as a way of exchanging data and changing the system, and only the API should have access to the underlying data store (etcd) -4. When containers run on the cluster and need to talk to other containers or the API server, they should be identified and authorized clearly as an autonomous process via a [service account](http://docs.k8s.io/design/service_accounts.md) - 1. If the user who started a long-lived process is removed from access to the cluster, the process should be able to continue without interruption - 2. If the user who started processes are removed from the cluster, administrators may wish to terminate their processes in bulk - 3. When containers run with a service account, the user that created / triggered the service account behavior must be associated with the container's action -5. When container processes run on the cluster, they should run in a [security context](http://docs.k8s.io/design/security_context.md) that isolates those processes via Linux user security, user namespaces, and permissions. - 1. Administrators should be able to configure the cluster to automatically confine all container processes as a non-root, randomly assigned UID - 2. Administrators should be able to ensure that container processes within the same namespace are all assigned the same unix user UID - 3. Administrators should be able to limit which developers and project administrators have access to higher privilege actions - 4. Project administrators should be able to run pods within a namespace under different security contexts, and developers must be able to specify which of the available security contexts they may use - 5. Developers should be able to run their own images or images from the community and expect those images to run correctly - 6. Developers may need to ensure their images work within higher security requirements specified by administrators - 7. When available, Linux kernel user namespaces can be used to ensure 5.2 and 5.4 are met. - 8. When application developers want to share filesytem data via distributed filesystems, the Unix user ids on those filesystems must be consistent across different container processes -6. Developers should be able to define [secrets](http://docs.k8s.io/design/secrets.md) that are automatically added to the containers when pods are run - 1. Secrets are files injected into the container whose values should not be displayed within a pod. Examples: - 1. An SSH private key for git cloning remote data - 2. A client certificate for accessing a remote system - 3. A private key and certificate for a web server - 4. A .kubeconfig file with embedded cert / token data for accessing the Kubernetes master - 5. A .dockercfg file for pulling images from a protected registry - 2. Developers should be able to define the pod spec so that a secret lands in a specific location - 3. Project administrators should be able to limit developers within a namespace from viewing or modifying secrets (anyone who can launch an arbitrary pod can view secrets) - 4. Secrets are generally not copied from one namespace to another when a developer's application definitions are copied - - -### Related design discussion - -* Authorization and authentication http://docs.k8s.io/design/access.md -* Secret distribution via files https://github.com/GoogleCloudPlatform/kubernetes/pull/2030 -* Docker secrets https://github.com/docker/docker/pull/6697 -* Docker vault https://github.com/docker/docker/issues/10310 -* Service Accounts: http://docs.k8s.io/design/service_accounts.md -* Secret volumes https://github.com/GoogleCloudPlatform/kubernetes/4126 - -## Specific Design Points - -### TODO: authorization, authentication - -### Isolate the data store from the nodes and supporting infrastructure - -Access to the central data store (etcd) in Kubernetes allows an attacker to run arbitrary containers on hosts, to gain access to any protected information stored in either volumes or in pods (such as access tokens or shared secrets provided as environment variables), to intercept and redirect traffic from running services by inserting middlemen, or to simply delete the entire history of the custer. - -As a general principle, access to the central data store should be restricted to the components that need full control over the system and which can apply appropriate authorization and authentication of change requests. In the future, etcd may offer granular access control, but that granularity will require an administrator to understand the schema of the data to properly apply security. An administrator must be able to properly secure Kubernetes at a policy level, rather than at an implementation level, and schema changes over time should not risk unintended security leaks. - -Both the Kubelet and Kube Proxy need information related to their specific roles - for the Kubelet, the set of pods it should be running, and for the Proxy, the set of services and endpoints to load balance. The Kubelet also needs to provide information about running pods and historical termination data. The access pattern for both Kubelet and Proxy to load their configuration is an efficient "wait for changes" request over HTTP. It should be possible to limit the Kubelet and Proxy to only access the information they need to perform their roles and no more. - -The controller manager for Replication Controllers and other future controllers act on behalf of a user via delegation to perform automated maintenance on Kubernetes resources. Their ability to access or modify resource state should be strictly limited to their intended duties and they should be prevented from accessing information not pertinent to their role. For example, a replication controller needs only to create a copy of a known pod configuration, to determine the running state of an existing pod, or to delete an existing pod that it created - it does not need to know the contents or current state of a pod, nor have access to any data in the pods attached volumes. - -The Kubernetes pod scheduler is responsible for reading data from the pod to fit it onto a node in the cluster. At a minimum, it needs access to view the ID of a pod (to craft the binding), its current state, any resource information necessary to identify placement, and other data relevant to concerns like anti-affinity, zone or region preference, or custom logic. It does not need the ability to modify pods or see other resources, only to create bindings. It should not need the ability to delete bindings unless the scheduler takes control of relocating components on failed hosts (which could be implemented by a separate component that can delete bindings but not create them). The scheduler may need read access to user or project-container information to determine preferential location (underspecified at this time). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/security.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/security.md?pixel)]() diff --git a/release-0.20.0/docs/design/security_context.md b/release-0.20.0/docs/design/security_context.md deleted file mode 100644 index 0ca308241d7..00000000000 --- a/release-0.20.0/docs/design/security_context.md +++ /dev/null @@ -1,163 +0,0 @@ -# Security Contexts -## Abstract -A security context is a set of constraints that are applied to a container in order to achieve the following goals (from [security design](security.md)): - -1. Ensure a clear isolation between container and the underlying host it runs on -2. Limit the ability of the container to negatively impact the infrastructure or other containers - -## Background - -The problem of securing containers in Kubernetes has come up [before](https://github.com/GoogleCloudPlatform/kubernetes/issues/398) and the potential problems with container security are [well known](http://opensource.com/business/14/7/docker-security-selinux). Although it is not possible to completely isolate Docker containers from their hosts, new features like [user namespaces](https://github.com/docker/libcontainer/pull/304) make it possible to greatly reduce the attack surface. - -## Motivation - -### Container isolation - -In order to improve container isolation from host and other containers running on the host, containers should only be -granted the access they need to perform their work. To this end it should be possible to take advantage of Docker -features such as the ability to [add or remove capabilities](https://docs.docker.com/reference/run/#runtime-privilege-linux-capabilities-and-lxc-configuration) and [assign MCS labels](https://docs.docker.com/reference/run/#security-configuration) -to the container process. - -Support for user namespaces has recently been [merged](https://github.com/docker/libcontainer/pull/304) into Docker's libcontainer project and should soon surface in Docker itself. It will make it possible to assign a range of unprivileged uids and gids from the host to each container, improving the isolation between host and container and between containers. - -### External integration with shared storage -In order to support external integration with shared storage, processes running in a Kubernetes cluster -should be able to be uniquely identified by their Unix UID, such that a chain of ownership can be established. -Processes in pods will need to have consistent UID/GID/SELinux category labels in order to access shared disks. - -## Constraints and Assumptions -* It is out of the scope of this document to prescribe a specific set - of constraints to isolate containers from their host. Different use cases need different - settings. -* The concept of a security context should not be tied to a particular security mechanism or platform - (ie. SELinux, AppArmor) -* Applying a different security context to a scope (namespace or pod) requires a solution such as the one proposed for - [service accounts](./service_accounts.md). - -## Use Cases - -In order of increasing complexity, following are example use cases that would -be addressed with security contexts: - -1. Kubernetes is used to run a single cloud application. In order to protect - nodes from containers: - * All containers run as a single non-root user - * Privileged containers are disabled - * All containers run with a particular MCS label - * Kernel capabilities like CHOWN and MKNOD are removed from containers - -2. Just like case #1, except that I have more than one application running on - the Kubernetes cluster. - * Each application is run in its own namespace to avoid name collisions - * For each application a different uid and MCS label is used - -3. Kubernetes is used as the base for a PAAS with - multiple projects, each project represented by a namespace. - * Each namespace is associated with a range of uids/gids on the node that - are mapped to uids/gids on containers using linux user namespaces. - * Certain pods in each namespace have special privileges to perform system - actions such as talking back to the server for deployment, run docker - builds, etc. - * External NFS storage is assigned to each namespace and permissions set - using the range of uids/gids assigned to that namespace. - -## Proposed Design - -### Overview -A *security context* consists of a set of constraints that determine how a container -is secured before getting created and run. A security context resides on the container and represents the runtime parameters that will -be used to create and run the container via container APIs. A *security context provider* is passed to the Kubelet so it can have a chance -to mutate Docker API calls in order to apply the security context. - -It is recommended that this design be implemented in two phases: - -1. Implement the security context provider extension point in the Kubelet - so that a default security context can be applied on container run and creation. -2. Implement a security context structure that is part of a service account. The - default context provider can then be used to apply a security context based - on the service account associated with the pod. - -### Security Context Provider - -The Kubelet will have an interface that points to a `SecurityContextProvider`. The `SecurityContextProvider` is invoked before creating and running a given container: - -```go -type SecurityContextProvider interface { - // ModifyContainerConfig is called before the Docker createContainer call. - // The security context provider can make changes to the Config with which - // the container is created. - // An error is returned if it's not possible to secure the container as - // requested with a security context. - ModifyContainerConfig(pod *api.Pod, container *api.Container, config *docker.Config) - - // ModifyHostConfig is called before the Docker runContainer call. - // The security context provider can make changes to the HostConfig, affecting - // security options, whether the container is privileged, volume binds, etc. - // An error is returned if it's not possible to secure the container as requested - // with a security context. - ModifyHostConfig(pod *api.Pod, container *api.Container, hostConfig *docker.HostConfig) -} -``` - -If the value of the SecurityContextProvider field on the Kubelet is nil, the kubelet will create and run the container as it does today. - -### Security Context - -A security context resides on the container and represents the runtime parameters that will -be used to create and run the container via container APIs. Following is an example of an initial implementation: - -```go -type type Container struct { - ... other fields omitted ... - // Optional: SecurityContext defines the security options the pod should be run with - SecurityContext *SecurityContext -} - -// SecurityContext holds security configuration that will be applied to a container. SecurityContext -// contains duplication of some existing fields from the Container resource. These duplicate fields -// will be populated based on the Container configuration if they are not set. Defining them on -// both the Container AND the SecurityContext will result in an error. -type SecurityContext struct { - // Capabilities are the capabilities to add/drop when running the container - Capabilities *Capabilities - - // Run the container in privileged mode - Privileged *bool - - // SELinuxOptions are the labels to be applied to the container - // and volumes - SELinuxOptions *SELinuxOptions - - // RunAsUser is the UID to run the entrypoint of the container process. - RunAsUser *int64 -} - -// SELinuxOptions are the labels to be applied to the container. -type SELinuxOptions struct { - // SELinux user label - User string - - // SELinux role label - Role string - - // SELinux type label - Type string - - // SELinux level label. - Level string -} -``` -### Admission - -It is up to an admission plugin to determine if the security context is acceptable or not. At the -time of writing, the admission control plugin for security contexts will only allow a context that -has defined capabilities or privileged. Contexts that attempt to define a UID or SELinux options -will be denied by default. In the future the admission plugin will base this decision upon -configurable policies that reside within the [service account](https://github.com/GoogleCloudPlatform/kubernetes/pull/2297). - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/security_context.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/security_context.md?pixel)]() diff --git a/release-0.20.0/docs/design/service_accounts.md b/release-0.20.0/docs/design/service_accounts.md deleted file mode 100644 index cc9f72d18de..00000000000 --- a/release-0.20.0/docs/design/service_accounts.md +++ /dev/null @@ -1,170 +0,0 @@ -#Service Accounts - -## Motivation - -Processes in Pods may need to call the Kubernetes API. For example: - - scheduler - - replication controller - - node controller - - a map-reduce type framework which has a controller that then tries to make a dynamically determined number of workers and watch them - - continuous build and push system - - monitoring system - -They also may interact with services other than the Kubernetes API, such as: - - an image repository, such as docker -- both when the images are pulled to start the containers, and for writing - images in the case of pods that generate images. - - accessing other cloud services, such as blob storage, in the context of a large, integrated, cloud offering (hosted - or private). - - accessing files in an NFS volume attached to the pod - -## Design Overview -A service account binds together several things: - - a *name*, understood by users, and perhaps by peripheral systems, for an identity - - a *principal* that can be authenticated and [authorized](../authorization.md) - - a [security context](./security_context.md), which defines the Linux Capabilities, User IDs, Groups IDs, and other - capabilities and controls on interaction with the file system and OS. - - a set of [secrets](./secrets.md), which a container may use to - access various networked resources. - -## Design Discussion - -A new object Kind is added: -```go -type ServiceAccount struct { - TypeMeta `json:",inline" yaml:",inline"` - ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty"` - - username string - securityContext ObjectReference // (reference to a securityContext object) - secrets []ObjectReference // (references to secret objects -} -``` - -The name ServiceAccount is chosen because it is widely used already (e.g. by Kerberos and LDAP) -to refer to this type of account. Note that it has no relation to kubernetes Service objects. - -The ServiceAccount object does not include any information that could not be defined separately: - - username can be defined however users are defined. - - securityContext and secrets are only referenced and are created using the REST API. - -The purpose of the serviceAccount object is twofold: - - to bind usernames to securityContexts and secrets, so that the username can be used to refer succinctly - in contexts where explicitly naming securityContexts and secrets would be inconvenient - - to provide an interface to simplify allocation of new securityContexts and secrets. -These features are explained later. - -### Names - -From the standpoint of the Kubernetes API, a `user` is any principal which can authenticate to kubernetes API. -This includes a human running `kubectl` on her desktop and a container in a Pod on a Node making API calls. - -There is already a notion of a username in kubernetes, which is populated into a request context after authentication. -However, there is no API object representing a user. While this may evolve, it is expected that in mature installations, -the canonical storage of user identifiers will be handled by a system external to kubernetes. - -Kubernetes does not dictate how to divide up the space of user identifier strings. User names can be -simple Unix-style short usernames, (e.g. `alice`), or may be qualified to allow for federated identity ( -`alice@example.com` vs `alice@example.org`.) Naming convention may distinguish service accounts from user -accounts (e.g. `alice@example.com` vs `build-service-account-a3b7f0@foo-namespace.service-accounts.example.com`), -but Kubernetes does not require this. - -Kubernetes also does not require that there be a distinction between human and Pod users. It will be possible -to setup a cluster where Alice the human talks to the kubernetes API as username `alice` and starts pods that -also talk to the API as user `alice` and write files to NFS as user `alice`. But, this is not recommended. - -Instead, it is recommended that Pods and Humans have distinct identities, and reference implementations will -make this distinction. - -The distinction is useful for a number of reasons: - - the requirements for humans and automated processes are different: - - Humans need a wide range of capabilities to do their daily activities. Automated processes often have more narrowly-defined activities. - - Humans may better tolerate the exceptional conditions created by expiration of a token. Remembering to handle - this in a program is more annoying. So, either long-lasting credentials or automated rotation of credentials is - needed. - - A Human typically keeps credentials on a machine that is not part of the cluster and so not subject to automatic - management. A VM with a role/service-account can have its credentials automatically managed. - - the identity of a Pod cannot in general be mapped to a single human. - - If policy allows, it may be created by one human, and then updated by another, and another, until its behavior cannot be attributed to a single human. - -**TODO**: consider getting rid of separate serviceAccount object and just rolling its parts into the SecurityContext or -Pod Object. - -The `secrets` field is a list of references to /secret objects that an process started as that service account should -have access to to be able to assert that role. - -The secrets are not inline with the serviceAccount object. This way, most or all users can have permission to `GET /serviceAccounts` so they can remind themselves -what serviceAccounts are available for use. - -Nothing will prevent creation of a serviceAccount with two secrets of type `SecretTypeKubernetesAuth`, or secrets of two -different types. Kubelet and client libraries will have some behavior, TBD, to handle the case of multiple secrets of a -given type (pick first or provide all and try each in order, etc). - -When a serviceAccount and a matching secret exist, then a `User.Info` for the serviceAccount and a `BearerToken` from the secret -are added to the map of tokens used by the authentication process in the apiserver, and similarly for other types. (We -might have some types that do not do anything on apiserver but just get pushed to the kubelet.) - -### Pods -The `PodSpec` is extended to have a `Pods.Spec.ServiceAccountUsername` field. If this is unset, then a -default value is chosen. If it is set, then the corresponding value of `Pods.Spec.SecurityContext` is set by the -Service Account Finalizer (see below). - -TBD: how policy limits which users can make pods with which service accounts. - -### Authorization -Kubernetes API Authorization Policies refer to users. Pods created with a `Pods.Spec.ServiceAccountUsername` typically -get a `Secret` which allows them to authenticate to the Kubernetes APIserver as a particular user. So any -policy that is desired can be applied to them. - -A higher level workflow is needed to coordinate creation of serviceAccounts, secrets and relevant policy objects. -Users are free to extend kubernetes to put this business logic wherever is convenient for them, though the -Service Account Finalizer is one place where this can happen (see below). - -### Kubelet - -The kubelet will treat as "not ready to run" (needing a finalizer to act on it) any Pod which has an empty -SecurityContext. - -The kubelet will set a default, restrictive, security context for any pods created from non-Apiserver config -sources (http, file). - -Kubelet watches apiserver for secrets which are needed by pods bound to it. - -**TODO**: how to only let kubelet see secrets it needs to know. - -### The service account finalizer - -There are several ways to use Pods with SecurityContexts and Secrets. - -One way is to explicitly specify the securityContext and all secrets of a Pod when the pod is initially created, -like this: - -**TODO**: example of pod with explicit refs. - -Another way is with the *Service Account Finalizer*, a plugin process which is optional, and which handles -business logic around service accounts. - -The Service Account Finalizer watches Pods, Namespaces, and ServiceAccount definitions. - -First, if it finds pods which have a `Pod.Spec.ServiceAccountUsername` but no `Pod.Spec.SecurityContext` set, -then it copies in the referenced securityContext and secrets references for the corresponding `serviceAccount`. - -Second, if ServiceAccount definitions change, it may take some actions. -**TODO**: decide what actions it takes when a serviceAccount definition changes. Does it stop pods, or just -allow someone to list ones that out out of spec? In general, people may want to customize this? - -Third, if a new namespace is created, it may create a new serviceAccount for that namespace. This may include -a new username (e.g. `NAMESPACE-default-service-account@serviceaccounts.$CLUSTERID.kubernetes.io`), a new -securityContext, a newly generated secret to authenticate that serviceAccount to the Kubernetes API, and default -policies for that service account. -**TODO**: more concrete example. What are typical default permissions for default service account (e.g. readonly access -to services in the same namespace and read-write access to events in that namespace?) - -Finally, it may provide an interface to automate creation of new serviceAccounts. In that case, the user may want -to GET serviceAccounts to see what has been created. - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/service_accounts.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/service_accounts.md?pixel)]() diff --git a/release-0.20.0/docs/design/simple-rolling-update.md b/release-0.20.0/docs/design/simple-rolling-update.md deleted file mode 100644 index 0f6c4a269f7..00000000000 --- a/release-0.20.0/docs/design/simple-rolling-update.md +++ /dev/null @@ -1,97 +0,0 @@ -## Simple rolling update -This is a lightweight design document for simple rolling update in ```kubectl``` - -Complete execution flow can be found [here](#execution-details). - -### Lightweight rollout -Assume that we have a current replication controller named ```foo``` and it is running image ```image:v1``` - -```kubectl rolling-update rc foo [foo-v2] --image=myimage:v2``` - -If the user doesn't specify a name for the 'next' replication controller, then the 'next' replication controller is renamed to -the name of the original replication controller. - -Obviously there is a race here, where if you kill the client between delete foo, and creating the new version of 'foo' you might be surprised about what is there, but I think that's ok. -See [Recovery](#recovery) below - -If the user does specify a name for the 'next' replication controller, then the 'next' replication controller is retained with its existing name, -and the old 'foo' replication controller is deleted. For the purposes of the rollout, we add a unique-ifying label ```kubernetes.io/deployment``` to both the ```foo``` and ```foo-next``` replication controllers. -The value of that label is the hash of the complete JSON representation of the```foo-next``` or```foo``` replication controller. The name of this label can be overridden by the user with the ```--deployment-label-key``` flag. - -#### Recovery -If a rollout fails or is terminated in the middle, it is important that the user be able to resume the roll out. -To facilitate recovery in the case of a crash of the updating process itself, we add the following annotations to each replication controller in the ```kubernetes.io/``` annotation namespace: - * ```desired-replicas``` The desired number of replicas for this replication controller (either N or zero) - * ```update-partner``` A pointer to the replication controller resource that is the other half of this update (syntax `````` the namespace is assumed to be identical to the namespace of this replication controller.) - -Recovery is achieved by issuing the same command again: - -``` -kubectl rolling-update rc foo [foo-v2] --image=myimage:v2 -``` - -Whenever the rolling update command executes, the kubectl client looks for replication controllers called ```foo``` and ```foo-next```, if they exist, an attempt is -made to roll ```foo``` to ```foo-next```. If ```foo-next``` does not exist, then it is created, and the rollout is a new rollout. If ```foo``` doesn't exist, then -it is assumed that the rollout is nearly completed, and ```foo-next``` is renamed to ```foo```. Details of the execution flow are given below. - - -### Aborting a rollout -Abort is assumed to want to reverse a rollout in progress. - -```kubectl rolling-update rc foo [foo-v2] --rollback``` - -This is really just semantic sugar for: - -```kubectl rolling-update rc foo-v2 foo``` - -With the added detail that it moves the ```desired-replicas``` annotation from ```foo-v2``` to ```foo``` - - -### Execution Details - -For the purposes of this example, assume that we are rolling from ```foo``` to ```foo-next``` where the only change is an image update from `v1` to `v2` - -If the user doesn't specify a ```foo-next``` name, then it is either discovered from the ```update-partner``` annotation on ```foo```. If that annotation doesn't exist, -then ```foo-next``` is synthesized using the pattern ```-``` - -#### Initialization - * If ```foo``` and ```foo-next``` do not exist: - * Exit, and indicate an error to the user, that the specified controller doesn't exist. - * If ```foo``` exists, but ```foo-next``` does not: - * Create ```foo-next``` populate it with the ```v2``` image, set ```desired-replicas``` to ```foo.Spec.Replicas``` - * Goto Rollout - * If ```foo-next``` exists, but ```foo``` does not: - * Assume that we are in the rename phase. - * Goto Rename - * If both ```foo``` and ```foo-next``` exist: - * Assume that we are in a partial rollout - * If ```foo-next``` is missing the ```desired-replicas``` annotation - * Populate the ```desired-replicas``` annotation to ```foo-next``` using the current size of ```foo``` - * Goto Rollout - -#### Rollout - * While size of ```foo-next``` < ```desired-replicas``` annotation on ```foo-next``` - * increase size of ```foo-next``` - * if size of ```foo``` > 0 - decrease size of ```foo``` - * Goto Rename - -#### Rename - * delete ```foo``` - * create ```foo``` that is identical to ```foo-next``` - * delete ```foo-next``` - -#### Abort - * If ```foo-next``` doesn't exist - * Exit and indicate to the user that they may want to simply do a new rollout with the old version - * If ```foo``` doesn't exist - * Exit and indicate not found to the user - * Otherwise, ```foo-next``` and ```foo``` both exist - * Set ```desired-replicas``` annotation on ```foo``` to match the annotation on ```foo-next``` - * Goto Rollout with ```foo``` and ```foo-next``` trading places. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/design/simple-rolling-update.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/design/simple-rolling-update.md?pixel)]() diff --git a/release-0.20.0/docs/devel/README.md b/release-0.20.0/docs/devel/README.md deleted file mode 100644 index e97d71a892d..00000000000 --- a/release-0.20.0/docs/devel/README.md +++ /dev/null @@ -1,37 +0,0 @@ -# Developing Kubernetes - -Docs in this directory relate to developing Kubernetes. - -* **On Collaborative Development** ([collab.md](collab.md)): info on pull requests and code reviews. - -* **Development Guide** ([development.md](development.md)): Setting up your environment tests. - -* **Making release notes** ([making-release-notes.md](making-release-notes.md)): Generating release nodes for a new release. - -* **Hunting flaky tests** ([flaky-tests.md](flaky-tests.md)): We have a goal of 99.9% flake free tests. - Here's how to run your tests many times. - -* **GitHub Issues** ([issues.md](issues.md)): How incoming issues are reviewed and prioritized. - -* **Logging Conventions** ([logging.md](logging.md)]: Glog levels. - -* **Pull Request Process** ([pull-requests.md](pull-requests.md)): When and why pull requests are closed. - -* **Releasing Kubernetes** ([releasing.md](releasing.md)): How to create a Kubernetes release (as in version) - and how the version information gets embedded into the built binaries. - -* **Profiling Kubernetes** ([profiling.md](profiling.md)): How to plug in go pprof profiler to Kubernetes. - -* **Instrumenting Kubernetes with a new metric** - ([instrumentation.md](instrumentation.md)): How to add a new metrics to the - Kubernetes code base. - -* **Coding Conventions** ([coding-conventions.md](coding-conventions.md)): - Coding style advice for contributors. - -* **Faster PR reviews** ([faster_reviews.md](faster_reviews.md)): How to get faster PR reviews. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/README.md?pixel)]() diff --git a/release-0.20.0/docs/devel/api_changes.md b/release-0.20.0/docs/devel/api_changes.md deleted file mode 100644 index e6f7b9040a9..00000000000 --- a/release-0.20.0/docs/devel/api_changes.md +++ /dev/null @@ -1,348 +0,0 @@ -# So you want to change the API? - -The Kubernetes API has two major components - the internal structures and -the versioned APIs. The versioned APIs are intended to be stable, while the -internal structures are implemented to best reflect the needs of the Kubernetes -code itself. - -What this means for API changes is that you have to be somewhat thoughtful in -how you approach changes, and that you have to touch a number of pieces to make -a complete change. This document aims to guide you through the process, though -not all API changes will need all of these steps. - -## Operational overview - -It is important to have a high level understanding of the API system used in -Kubernetes in order to navigate the rest of this document. - -As mentioned above, the internal representation of an API object is decoupled -from any one API version. This provides a lot of freedom to evolve the code, -but it requires robust infrastructure to convert between representations. There -are multiple steps in processing an API operation - even something as simple as -a GET involves a great deal of machinery. - -The conversion process is logically a "star" with the internal form at the -center. Every versioned API can be converted to the internal form (and -vice-versa), but versioned APIs do not convert to other versioned APIs directly. -This sounds like a heavy process, but in reality we do not intend to keep more -than a small number of versions alive at once. While all of the Kubernetes code -operates on the internal structures, they are always converted to a versioned -form before being written to storage (disk or etcd) or being sent over a wire. -Clients should consume and operate on the versioned APIs exclusively. - -To demonstrate the general process, here is a (hypothetical) example: - - 1. A user POSTs a `Pod` object to `/api/v7beta1/...` - 2. The JSON is unmarshalled into a `v7beta1.Pod` structure - 3. Default values are applied to the `v7beta1.Pod` - 4. The `v7beta1.Pod` is converted to an `api.Pod` structure - 5. The `api.Pod` is validated, and any errors are returned to the user - 6. The `api.Pod` is converted to a `v6.Pod` (because v6 is the latest stable - version) - 7. The `v6.Pod` is marshalled into JSON and written to etcd - -Now that we have the `Pod` object stored, a user can GET that object in any -supported api version. For example: - - 1. A user GETs the `Pod` from `/api/v5/...` - 2. The JSON is read from etcd and unmarshalled into a `v6.Pod` structure - 3. Default values are applied to the `v6.Pod` - 4. The `v6.Pod` is converted to an `api.Pod` structure - 5. The `api.Pod` is converted to a `v5.Pod` structure - 6. The `v5.Pod` is marshalled into JSON and sent to the user - -The implication of this process is that API changes must be done carefully and -backward-compatibly. - -## On compatibility - -Before talking about how to make API changes, it is worthwhile to clarify what -we mean by API compatibility. An API change is considered backward-compatible -if it: - * adds new functionality that is not required for correct behavior - * does not change existing semantics - * does not change existing defaults - -Put another way: - -1. Any API call (e.g. a structure POSTed to a REST endpoint) that worked before - your change must work the same after your change. -2. Any API call that uses your change must not cause problems (e.g. crash or - degrade behavior) when issued against servers that do not include your change. -3. It must be possible to round-trip your change (convert to different API - versions and back) with no loss of information. - -If your change does not meet these criteria, it is not considered strictly -compatible. There are times when this might be OK, but mostly we want changes -that meet this definition. If you think you need to break compatibility, you -should talk to the Kubernetes team first. - -Let's consider some examples. In a hypothetical API (assume we're at version -v6), the `Frobber` struct looks something like this: - -```go -// API v6. -type Frobber struct { - Height int `json:"height"` - Param string `json:"param"` -} -``` - -You want to add a new `Width` field. It is generally safe to add new fields -without changing the API version, so you can simply change it to: - -```go -// Still API v6. -type Frobber struct { - Height int `json:"height"` - Width int `json:"width"` - Param string `json:"param"` -} -``` - -The onus is on you to define a sane default value for `Width` such that rule #1 -above is true - API calls and stored objects that used to work must continue to -work. - -For your next change you want to allow multiple `Param` values. You can not -simply change `Param string` to `Params []string` (without creating a whole new -API version) - that fails rules #1 and #2. You can instead do something like: - -```go -// Still API v6, but kind of clumsy. -type Frobber struct { - Height int `json:"height"` - Width int `json:"width"` - Param string `json:"param"` // the first param - ExtraParams []string `json:"params"` // additional params -} -``` - -Now you can satisfy the rules: API calls that provide the old style `Param` -will still work, while servers that don't understand `ExtraParams` can ignore -it. This is somewhat unsatisfying as an API, but it is strictly compatible. - -Part of the reason for versioning APIs and for using internal structs that are -distinct from any one version is to handle growth like this. The internal -representation can be implemented as: - -```go -// Internal, soon to be v7beta1. -type Frobber struct { - Height int - Width int - Params []string -} -``` - -The code that converts to/from versioned APIs can decode this into the somewhat -uglier (but compatible!) structures. Eventually, a new API version, let's call -it v7beta1, will be forked and it can use the clean internal structure. - -We've seen how to satisfy rules #1 and #2. Rule #3 means that you can not -extend one versioned API without also extending the others. For example, an -API call might POST an object in API v7beta1 format, which uses the cleaner -`Params` field, but the API server might store that object in trusty old v6 -form (since v7beta1 is "beta"). When the user reads the object back in the -v7beta1 API it would be unacceptable to have lost all but `Params[0]`. This -means that, even though it is ugly, a compatible change must be made to the v6 -API. - -As another interesting example, enumerated values provide a unique challenge. -Adding a new value to an enumerated set is *not* a compatible change. Clients -which assume they know how to handle all possible values of a given field will -not be able to handle the new values. However, removing value from an -enumerated set *can* be a compatible change, if handled properly (treat the -removed value as deprecated but allowed). - -## Changing versioned APIs - -For most changes, you will probably find it easiest to change the versioned -APIs first. This forces you to think about how to make your change in a -compatible way. Rather than doing each step in every version, it's usually -easier to do each versioned API one at a time, or to do all of one version -before starting "all the rest". - -### Edit types.go - -The struct definitions for each API are in `pkg/api//types.go`. Edit -those files to reflect the change you want to make. Note that all non-online -fields in versioned APIs must have description tags - these are used to generate -documentation. - -### Edit defaults.go - -If your change includes new fields for which you will need default values, you -need to add cases to `pkg/api//defaults.go`. Of course, since you -have added code, you have to add a test: `pkg/api//defaults_test.go`. - -Do use pointers to scalars when you need to distinguish between an unset value -and an an automatic zero value. For example, -`PodSpec.TerminationGracePeriodSeconds` is defined as `*int64` the go type -definition. A zero value means 0 seconds, and a nil value asks the system to -pick a default. - -Don't forget to run the tests! - -### Edit conversion.go - -Given that you have not yet changed the internal structs, this might feel -premature, and that's because it is. You don't yet have anything to convert to -or from. We will revisit this in the "internal" section. If you're doing this -all in a different order (i.e. you started with the internal structs), then you -should jump to that topic below. In the very rare case that you are making an -incompatible change you might or might not want to do this now, but you will -have to do more later. The files you want are -`pkg/api//conversion.go` and `pkg/api//conversion_test.go`. - -## Changing the internal structures - -Now it is time to change the internal structs so your versioned changes can be -used. - -### Edit types.go - -Similar to the versioned APIs, the definitions for the internal structs are in -`pkg/api/types.go`. Edit those files to reflect the change you want to make. -Keep in mind that the internal structs must be able to express *all* of the -versioned APIs. - -## Edit validation.go - -Most changes made to the internal structs need some form of input validation. -Validation is currently done on internal objects in -`pkg/api/validation/validation.go`. This validation is the one of the first -opportunities we have to make a great user experience - good error messages and -thorough validation help ensure that users are giving you what you expect and, -when they don't, that they know why and how to fix it. Think hard about the -contents of `string` fields, the bounds of `int` fields and the -requiredness/optionalness of fields. - -Of course, code needs tests - `pkg/api/validation/validation_test.go`. - -## Edit version conversions - -At this point you have both the versioned API changes and the internal -structure changes done. If there are any notable differences - field names, -types, structural change in particular - you must add some logic to convert -versioned APIs to and from the internal representation. If you see errors from -the `serialization_test`, it may indicate the need for explicit conversions. - -Performance of conversions very heavily influence performance of apiserver. -Thus, we are auto-generating conversion functions that are much more efficient -than the generic ones (which are based on reflections and thus are highly -inefficient). - -The conversion code resides with each versioned API. There are two files: - - `pkg/api//conversion.go` containing manually written conversion - functions - - `pkg/api//conversion_generated.go` containing auto-generated - conversion functions - -Since auto-generated conversion functions are using manually written ones, -those manually written should be named with a defined convention, i.e. a function -converting type X in pkg a to type Y in pkg b, should be named: -`convert_a_X_To_b_Y`. - -Also note that you can (and for efficiency reasons should) use auto-generated -conversion functions when writing your conversion functions. - -Once all the necessary manually written conversions are added, you need to -regenerate auto-generated ones. To regenerate them: - - run -``` - $ hack/update-generated-conversions.sh -``` - -If running the above script is impossible due to compile errors, the easiest -workaround is to comment out the code causing errors and let the script to -regenerate it. If the auto-generated conversion methods are not used by the -manually-written ones, it's fine to just remove the whole file and let the -generator to create it from scratch. - -Unsurprisingly, adding manually written conversion also requires you to add tests to -`pkg/api//conversion_test.go`. - -## Update the fuzzer - -Part of our testing regimen for APIs is to "fuzz" (fill with random values) API -objects and then convert them to and from the different API versions. This is -a great way of exposing places where you lost information or made bad -assumptions. If you have added any fields which need very careful formatting -(the test does not run validation) or if you have made assumptions such as -"this slice will always have at least 1 element", you may get an error or even -a panic from the `serialization_test`. If so, look at the diff it produces (or -the backtrace in case of a panic) and figure out what you forgot. Encode that -into the fuzzer's custom fuzz functions. Hint: if you added defaults for a field, -that field will need to have a custom fuzz function that ensures that the field is -fuzzed to a non-empty value. - -The fuzzer can be found in `pkg/api/testing/fuzzer.go`. - -## Update the semantic comparisons - -VERY VERY rarely is this needed, but when it hits, it hurts. In some rare -cases we end up with objects (e.g. resource quantities) that have morally -equivalent values with different bitwise representations (e.g. value 10 with a -base-2 formatter is the same as value 0 with a base-10 formatter). The only way -Go knows how to do deep-equality is through field-by-field bitwise comparisons. -This is a problem for us. - -The first thing you should do is try not to do that. If you really can't avoid -this, I'd like to introduce you to our semantic DeepEqual routine. It supports -custom overrides for specific types - you can find that in `pkg/api/helpers.go`. - -There's one other time when you might have to touch this: unexported fields. -You see, while Go's `reflect` package is allowed to touch unexported fields, us -mere mortals are not - this includes semantic DeepEqual. Fortunately, most of -our API objects are "dumb structs" all the way down - all fields are exported -(start with a capital letter) and there are no unexported fields. But sometimes -you want to include an object in our API that does have unexported fields -somewhere in it (for example, `time.Time` has unexported fields). If this hits -you, you may have to touch the semantic DeepEqual customization functions. - -## Implement your change - -Now you have the API all changed - go implement whatever it is that you're -doing! - -## Write end-to-end tests - -This is, sadly, still sort of painful. Talk to us and we'll try to help you -figure out the best way to make sure your cool feature keeps working forever. - -## Examples and docs - -At last, your change is done, all unit tests pass, e2e passes, you're done, -right? Actually, no. You just changed the API. If you are touching an -existing facet of the API, you have to try *really* hard to make sure that -*all* the examples and docs are updated. There's no easy way to do this, due -in part to JSON and YAML silently dropping unknown fields. You're clever - -you'll figure it out. Put `grep` or `ack` to good use. - -If you added functionality, you should consider documenting it and/or writing -an example to illustrate your change. - -Make sure you update the swagger API spec by running: - -```shell -$ hack/update-swagger-spec.sh -``` - -The API spec changes should be in a commit separate from your other changes. - -## Incompatible API changes -If your change is going to be backward incompatible or might be a breaking change for API -consumers, please send an announcement to `kubernetes-dev@googlegroups.com` before -the change gets in. If you are unsure, ask. Also make sure that the change gets documented in -`CHANGELOG.md` for the next release. - -## Adding new REST objects - -TODO(smarterclayton): write this. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/api_changes.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/api_changes.md?pixel)]() diff --git a/release-0.20.0/docs/devel/coding-conventions.md b/release-0.20.0/docs/devel/coding-conventions.md deleted file mode 100644 index 6affb41696f..00000000000 --- a/release-0.20.0/docs/devel/coding-conventions.md +++ /dev/null @@ -1,13 +0,0 @@ -Coding style advice for contributors - - Bash - - https://google-styleguide.googlecode.com/svn/trunk/shell.xml - - Go - - https://github.com/golang/go/wiki/CodeReviewComments - - https://gist.github.com/lavalamp/4bd23295a9f32706a48f - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/coding-conventions.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/coding-conventions.md?pixel)]() diff --git a/release-0.20.0/docs/devel/collab.md b/release-0.20.0/docs/devel/collab.md deleted file mode 100644 index ce2bba6aff0..00000000000 --- a/release-0.20.0/docs/devel/collab.md +++ /dev/null @@ -1,46 +0,0 @@ -# On Collaborative Development - -Kubernetes is open source, but many of the people working on it do so as their day job. In order to avoid forcing people to be "at work" effectively 24/7, we want to establish some semi-formal protocols around development. Hopefully these rules make things go more smoothly. If you find that this is not the case, please complain loudly. - -## Patches welcome - -First and foremost: as a potential contributor, your changes and ideas are welcome at any hour of the day or night, weekdays, weekends, and holidays. Please do not ever hesitate to ask a question or send a PR. - -## Code reviews - -All changes must be code reviewed. For non-maintainers this is obvious, since you can't commit anyway. But even for maintainers, we want all changes to get at least one review, preferably (for non-trivial changes obligatorily) from someone who knows the areas the change touches. For non-trivial changes we may want two reviewers. The primary reviewer will make this decision and nominate a second reviewer, if needed. Except for trivial changes, PRs should not be committed until relevant parties (e.g. owners of the subsystem affected by the PR) have had a reasonable chance to look at PR in their local business hours. - -Most PRs will find reviewers organically. If a maintainer intends to be the primary reviewer of a PR they should set themselves as the assignee on GitHub and say so in a reply to the PR. Only the primary reviewer of a change should actually do the merge, except in rare cases (e.g. they are unavailable in a reasonable timeframe). - -If a PR has gone 2 work days without an owner emerging, please poke the PR thread and ask for a reviewer to be assigned. - -Except for rare cases, such as trivial changes (e.g. typos, comments) or emergencies (e.g. broken builds), maintainers should not merge their own changes. - -Expect reviewers to request that you avoid [common go style mistakes](https://github.com/golang/go/wiki/CodeReviewComments) in your PRs. - -## Assigned reviews - -Maintainers can assign reviews to other maintainers, when appropriate. The assignee becomes the shepherd for that PR and is responsible for merging the PR once they are satisfied with it or else closing it. The assignee might request reviews from non-maintainers. - -## Merge hours - -Maintainers will do merges of appropriately reviewed-and-approved changes during their local "business hours" (typically 7:00 am Monday to 5:00 pm (17:00h) Friday). PRs that arrive over the weekend or on holidays will only be merged if there is a very good reason for it and if the code review requirements have been met. Concretely this means that nobody should merge changes immediately before going to bed for the night. - -There may be discussion an even approvals granted outside of the above hours, but merges will generally be deferred. - -If a PR is considered complex or controversial, the merge of that PR should be delayed to give all interested parties in all timezones the opportunity to provide feedback. Concretely, this means that such PRs should be held for 24 -hours before merging. Of course "complex" and "controversial" are left to the judgment of the people involved, but we trust that part of being a committer is the judgment required to evaluate such things honestly, and not be -motivated by your desire (or your cube-mate's desire) to get their code merged. Also see "Holds" below, any reviewer can issue a "hold" to indicate that the PR is in fact complicated or complex and deserves further review. - -PRs that are incorrectly judged to be merge-able, may be reverted and subject to re-review, if subsequent reviewers believe that they in fact are controversial or complex. - - -## Holds - -Any maintainer or core contributor who wants to review a PR but does not have time immediately may put a hold on a PR simply by saying so on the PR discussion and offering an ETA measured in single-digit days at most. Any PR that has a hold shall not be merged until the person who requested the hold acks the review, withdraws their hold, or is overruled by a preponderance of maintainers. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/collab.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/collab.md?pixel)]() diff --git a/release-0.20.0/docs/devel/developer-guides/vagrant.md b/release-0.20.0/docs/devel/developer-guides/vagrant.md deleted file mode 100644 index fa6aed032b8..00000000000 --- a/release-0.20.0/docs/devel/developer-guides/vagrant.md +++ /dev/null @@ -1,341 +0,0 @@ -## Getting started with Vagrant - -Running kubernetes with Vagrant (and VirtualBox) is an easy way to run/test/develop on your local machine (Linux, Mac OS X). - -### Prerequisites -1. Install latest version >= 1.6.2 of vagrant from http://www.vagrantup.com/downloads.html -2. Install one of: - 1. The latest version of Virtual Box from https://www.virtualbox.org/wiki/Downloads - 2. [VMWare Fusion](https://www.vmware.com/products/fusion/) version 5 or greater as well as the appropriate [Vagrant VMWare Fusion provider](https://www.vagrantup.com/vmware) - 3. [VMWare Workstation](https://www.vmware.com/products/workstation/) version 9 or greater as well as the [Vagrant VMWare Workstation provider](https://www.vagrantup.com/vmware) - 4. [Parallels Desktop](https://www.parallels.com/products/desktop/) version 9 or greater as well as the [Vagrant Parallels provider](https://parallels.github.io/vagrant-parallels/) -3. Get or build a [binary release](/docs/getting-started-guides/binary_release.md) - -### Setup - -By default, the Vagrant setup will create a single kubernetes-master and 1 kubernetes-minion. Each VM will take 1 GB, so make sure you have at least 2GB to 4GB of free memory (plus appropriate free disk space). To start your local cluster, open a shell and run: - -```sh -cd kubernetes - -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -The `KUBERNETES_PROVIDER` environment variable tells all of the various cluster management scripts which variant to use. If you forget to set this, the assumption is you are running on Google Compute Engine. - -If you installed more than one Vagrant provider, Kubernetes will usually pick the appropriate one. However, you can override which one Kubernetes will use by setting the [`VAGRANT_DEFAULT_PROVIDER`](https://docs.vagrantup.com/v2/providers/default.html) environment variable: - -```sh -export VAGRANT_DEFAULT_PROVIDER=parallels -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -Vagrant will provision each machine in the cluster with all the necessary components to run Kubernetes. The initial setup can take a few minutes to complete on each machine. - -By default, each VM in the cluster is running Fedora, and all of the Kubernetes services are installed into systemd. - -To access the master or any minion: - -```sh -vagrant ssh master -vagrant ssh minion-1 -``` - -If you are running more than one minion, you can access the others by: - -```sh -vagrant ssh minion-2 -vagrant ssh minion-3 -``` - -To view the service status and/or logs on the kubernetes-master: -```sh -vagrant ssh master -[vagrant@kubernetes-master ~] $ sudo systemctl status kube-apiserver -[vagrant@kubernetes-master ~] $ sudo journalctl -r -u kube-apiserver - -[vagrant@kubernetes-master ~] $ sudo systemctl status kube-controller-manager -[vagrant@kubernetes-master ~] $ sudo journalctl -r -u kube-controller-manager - -[vagrant@kubernetes-master ~] $ sudo systemctl status etcd -[vagrant@kubernetes-master ~] $ sudo systemctl status nginx -``` - -To view the services on any of the kubernetes-minion(s): -```sh -vagrant ssh minion-1 -[vagrant@kubernetes-minion-1] $ sudo systemctl status docker -[vagrant@kubernetes-minion-1] $ sudo journalctl -r -u docker -[vagrant@kubernetes-minion-1] $ sudo systemctl status kubelet -[vagrant@kubernetes-minion-1] $ sudo journalctl -r -u kubelet -``` - -### Interacting with your Kubernetes cluster with Vagrant. - -With your Kubernetes cluster up, you can manage the nodes in your cluster with the regular Vagrant commands. - -To push updates to new Kubernetes code after making source changes: -```sh -./cluster/kube-push.sh -``` - -To stop and then restart the cluster: -```sh -vagrant halt -./cluster/kube-up.sh -``` - -To destroy the cluster: -```sh -vagrant destroy -``` - -Once your Vagrant machines are up and provisioned, the first thing to do is to check that you can use the `kubectl.sh` script. - -You may need to build the binaries first, you can do this with ```make``` - -```sh -$ ./cluster/kubectl.sh get minions - -NAME LABELS -10.245.1.4 -10.245.1.5 -10.245.1.3 -``` - -### Interacting with your Kubernetes cluster with the `kube-*` scripts. - -Alternatively to using the vagrant commands, you can also use the `cluster/kube-*.sh` scripts to interact with the vagrant based provider just like any other hosting platform for kubernetes. - -All of these commands assume you have set `KUBERNETES_PROVIDER` appropriately: - -```sh -export KUBERNETES_PROVIDER=vagrant -``` - -Bring up a vagrant cluster - -```sh -./cluster/kube-up.sh -``` - -Destroy the vagrant cluster - -```sh -./cluster/kube-down.sh -``` - -Update the vagrant cluster after you make changes (only works when building your own releases locally): - -```sh -./cluster/kube-push.sh -``` - -Interact with the cluster - -```sh -./cluster/kubectl.sh -``` - -### Authenticating with your master - -When using the vagrant provider in Kubernetes, the `cluster/kubectl.sh` script will cache your credentials in a `~/.kubernetes_vagrant_auth` file so you will not be prompted for them in the future. - -```sh -cat ~/.kubernetes_vagrant_auth -{ "User": "vagrant", - "Password": "vagrant" - "CAFile": "/home/k8s_user/.kubernetes.vagrant.ca.crt", - "CertFile": "/home/k8s_user/.kubecfg.vagrant.crt", - "KeyFile": "/home/k8s_user/.kubecfg.vagrant.key" -} -``` - -You should now be set to use the `cluster/kubectl.sh` script. For example try to list the minions that you have started with: - -```sh -./cluster/kubectl.sh get minions -``` - -### Running containers - -Your cluster is running, you can list the minions in your cluster: - -```sh -$ ./cluster/kubectl.sh get minions - -NAME LABELS -10.245.2.4 -10.245.2.3 -10.245.2.2 -``` - -Now start running some containers! - -You can now use any of the cluster/kube-*.sh commands to interact with your VM machines. -Before starting a container there will be no pods, services and replication controllers. - -``` -$ cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS - -$ cluster/kubectl.sh get services -NAME LABELS SELECTOR IP PORT - -$ cluster/kubectl.sh get replicationcontrollers -NAME IMAGE(S SELECTOR REPLICAS -``` - -Start a container running nginx with a replication controller and three replicas - -``` -$ cluster/kubectl.sh run my-nginx --image=nginx --replicas=3 --port=80 -``` - -When listing the pods, you will see that three containers have been started and are in Waiting state: - -``` -$ cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -781191ff-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.4/10.245.2.4 name=myNginx Waiting -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Waiting -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Waiting -``` - -You need to wait for the provisioning to complete, you can monitor the minions by doing: - -```sh -$ sudo salt '*minion-1' cmd.run 'docker images' -kubernetes-minion-1: - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE - 96864a7d2df3 26 hours ago 204.4 MB - kubernetes/pause latest 6c4579af347b 8 weeks ago 239.8 kB -``` - -Once the docker image for nginx has been downloaded, the container will start and you can list it: - -```sh -$ sudo salt '*minion-1' cmd.run 'docker ps' -kubernetes-minion-1: - CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES - dbe79bf6e25b nginx:latest "nginx" 21 seconds ago Up 19 seconds k8s--mynginx.8c5b8a3a--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1.etcd--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1--fcfa837f - fa0e29c94501 kubernetes/pause:latest "/pause" 8 minutes ago Up 8 minutes 0.0.0.0:8080->80/tcp k8s--net.a90e7ce4--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1.etcd--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1--baf5b21b -``` - -Going back to listing the pods, services and replicationcontrollers, you now have: - -``` -$ cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -781191ff-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.4/10.245.2.4 name=myNginx Running -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Running -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Running - -$ cluster/kubectl.sh get services -NAME LABELS SELECTOR IP PORT - -$ cluster/kubectl.sh get replicationcontrollers -NAME IMAGE(S SELECTOR REPLICAS -myNginx nginx name=my-nginx 3 -``` - -We did not start any services, hence there are none listed. But we see three replicas displayed properly. -Check the [guestbook](/examples/guestbook/README.md) application to learn how to create a service. -You can already play with scaling the replicas with: - -```sh -$ ./cluster/kubectl.sh scale rc my-nginx --replicas=2 -$ ./cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Running -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Running -``` - -Congratulations! - -### Testing - -The following will run all of the end-to-end testing scenarios assuming you set your environment in `cluster/kube-env.sh`: - -```sh -NUM_MINIONS=3 hack/e2e-test.sh -``` - -### Troubleshooting - -#### I keep downloading the same (large) box all the time! - -By default the Vagrantfile will download the box from S3. You can change this (and cache the box locally) by providing a name and an alternate URL when calling `kube-up.sh` - -```sh -export KUBERNETES_BOX_NAME=choose_your_own_name_for_your_kuber_box -export KUBERNETES_BOX_URL=path_of_your_kuber_box -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -#### I just created the cluster, but I am getting authorization errors! - -You probably have an incorrect ~/.kubernetes_vagrant_auth file for the cluster you are attempting to contact. - -```sh -rm ~/.kubernetes_vagrant_auth -``` - -After using kubectl.sh make sure that the correct credentials are set: - -```sh -cat ~/.kubernetes_vagrant_auth -{ - "User": "vagrant", - "Password": "vagrant" -} -``` - -#### I just created the cluster, but I do not see my container running! - -If this is your first time creating the cluster, the kubelet on each minion schedules a number of docker pull requests to fetch prerequisite images. This can take some time and as a result may delay your initial pod getting provisioned. - -#### I changed Kubernetes code, but it's not running! - -Are you sure there was no build error? After running `$ vagrant provision`, scroll up and ensure that each Salt state was completed successfully on each box in the cluster. -It's very likely you see a build error due to an error in your source files! - -#### I have brought Vagrant up but the minions won't validate! - -Are you sure you built a release first? Did you install `net-tools`? For more clues, login to one of the minions (`vagrant ssh minion-1`) and inspect the salt minion log (`sudo cat /var/log/salt/minion`). - -#### I want to change the number of minions! - -You can control the number of minions that are instantiated via the environment variable `NUM_MINIONS` on your host machine. If you plan to work with replicas, we strongly encourage you to work with enough minions to satisfy your largest intended replica size. If you do not plan to work with replicas, you can save some system resources by running with a single minion. You do this, by setting `NUM_MINIONS` to 1 like so: - -```sh -export NUM_MINIONS=1 -``` - -#### I want my VMs to have more memory! - -You can control the memory allotted to virtual machines with the `KUBERNETES_MEMORY` environment variable. -Just set it to the number of megabytes you would like the machines to have. For example: - -```sh -export KUBERNETES_MEMORY=2048 -``` - -If you need more granular control, you can set the amount of memory for the master and minions independently. For example: - -```sh -export KUBERNETES_MASTER_MEMORY=1536 -export KUBERNETES_MINION_MEMORY=2048 -``` - -#### I ran vagrant suspend and nothing works! -```vagrant suspend``` seems to mess up the network. It's not supported at this time. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/developer-guides/vagrant.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/developer-guides/vagrant.md?pixel)]() diff --git a/release-0.20.0/docs/devel/development.md b/release-0.20.0/docs/devel/development.md deleted file mode 100644 index feeb1d553aa..00000000000 --- a/release-0.20.0/docs/devel/development.md +++ /dev/null @@ -1,292 +0,0 @@ -# Development Guide - -# Releases and Official Builds - -Official releases are built in Docker containers. Details are [here](../../build/README.md). You can do simple builds and development with just a local Docker installation. If want to build go locally outside of docker, please continue below. - -## Go development environment - -Kubernetes is written in [Go](http://golang.org) programming language. If you haven't set up Go development environment, please follow [this instruction](http://golang.org/doc/code.html) to install go tool and set up GOPATH. Ensure your version of Go is at least 1.3. - -## Git Setup - -Below, we outline one of the more common git workflows that core developers use. Other git workflows are also valid. - -### Visual overview -![Git workflow](git_workflow.png) - -### Fork the main repository - -1. Go to https://github.com/GoogleCloudPlatform/kubernetes -2. Click the "Fork" button (at the top right) - -### Clone your fork - -The commands below require that you have $GOPATH set ([$GOPATH docs](https://golang.org/doc/code.html#GOPATH)). We highly recommend you put kubernetes' code into your GOPATH. Note: the commands below will not work if there is more than one directory in your `$GOPATH`. - -``` -$ mkdir -p $GOPATH/src/github.com/GoogleCloudPlatform/ -$ cd $GOPATH/src/github.com/GoogleCloudPlatform/ -# Replace "$YOUR_GITHUB_USERNAME" below with your github username -$ git clone https://github.com/$YOUR_GITHUB_USERNAME/kubernetes.git -$ cd kubernetes -$ git remote add upstream 'https://github.com/GoogleCloudPlatform/kubernetes.git' -``` - -### Create a branch and make changes - -``` -$ git checkout -b myfeature -# Make your code changes -``` - -### Keeping your development fork in sync - -``` -$ git fetch upstream -$ git rebase upstream/master -``` - -Note: If you have write access to the main repository at github.com/GoogleCloudPlatform/kubernetes, you should modify your git configuration so that you can't accidentally push to upstream: - -``` -git remote set-url --push upstream no_push -``` - -### Commiting changes to your fork - -``` -$ git commit -$ git push -f origin myfeature -``` - -### Creating a pull request -1. Visit http://github.com/$YOUR_GITHUB_USERNAME/kubernetes -2. Click the "Compare and pull request" button next to your "myfeature" branch. - - -## godep and dependency management - -Kubernetes uses [godep](https://github.com/tools/godep) to manage dependencies. It is not strictly required for building Kubernetes but it is required when managing dependencies under the Godeps/ tree, and is required by a number of the build and test scripts. Please make sure that ``godep`` is installed and in your ``$PATH``. - -### Installing godep -There are many ways to build and host go binaries. Here is an easy way to get utilities like ```godep``` installed: - -1) Ensure that [mercurial](http://mercurial.selenic.com/wiki/Download) is installed on your system. (some of godep's dependencies use the mercurial -source control system). Use ```apt-get install mercurial``` or ```yum install mercurial``` on Linux, or [brew.sh](http://brew.sh) on OS X, or download -directly from mercurial. - -2) Create a new GOPATH for your tools and install godep: -``` -export GOPATH=$HOME/go-tools -mkdir -p $GOPATH -go get github.com/tools/godep -``` - -3) Add $GOPATH/bin to your path. Typically you'd add this to your ~/.profile: -``` -export GOPATH=$HOME/go-tools -export PATH=$PATH:$GOPATH/bin -``` - -### Using godep -Here's a quick walkthrough of one way to use godeps to add or update a Kubernetes dependency into Godeps/_workspace. For more details, please see the instructions in [godep's documentation](https://github.com/tools/godep). - -1) Devote a directory to this endeavor: -``` -export KPATH=$HOME/code/kubernetes -mkdir -p $KPATH/src/github.com/GoogleCloudPlatform/kubernetes -cd $KPATH/src/github.com/GoogleCloudPlatform/kubernetes -git clone https://path/to/your/fork . -# Or copy your existing local repo here. IMPORTANT: making a symlink doesn't work. -``` - -2) Set up your GOPATH. -``` -# Option A: this will let your builds see packages that exist elsewhere on your system. -export GOPATH=$KPATH:$GOPATH -# Option B: This will *not* let your local builds see packages that exist elsewhere on your system. -export GOPATH=$KPATH -# Option B is recommended if you're going to mess with the dependencies. -``` - -3) Populate your new GOPATH. -``` -cd $KPATH/src/github.com/GoogleCloudPlatform/kubernetes -godep restore -``` - -4) Next, you can either add a new dependency or update an existing one. -``` -# To add a new dependency, do: -cd $KPATH/src/github.com/GoogleCloudPlatform/kubernetes -go get path/to/dependency -# Change code in Kubernetes to use the dependency. -godep save ./... - -# To update an existing dependency, do: -cd $KPATH/src/github.com/GoogleCloudPlatform/kubernetes -go get -u path/to/dependency -# Change code in Kubernetes accordingly if necessary. -godep update path/to/dependency -``` - -5) Before sending your PR, it's a good idea to sanity check that your Godeps.json file is ok by re-restoring: ```godep restore``` - -It is sometimes expedient to manually fix the /Godeps/godeps.json file to minimize the changes. - -Please send dependency updates in separate commits within your PR, for easier reviewing. - -## Hooks - -Before committing any changes, please link/copy these hooks into your .git -directory. This will keep you from accidentally committing non-gofmt'd go code. - -``` -cd kubernetes/.git/hooks/ -ln -s ../../hooks/pre-commit . -``` - -## Unit tests - -``` -cd kubernetes -hack/test-go.sh -``` - -Alternatively, you could also run: - -``` -cd kubernetes -godep go test ./... -``` - -If you only want to run unit tests in one package, you could run ``godep go test`` under the package directory. For example, the following commands will run all unit tests in package kubelet: - -``` -$ cd kubernetes # step into kubernetes' directory. -$ cd pkg/kubelet -$ godep go test -# some output from unit tests -PASS -ok github.com/GoogleCloudPlatform/kubernetes/pkg/kubelet 0.317s -``` - -## Coverage - -Currently, collecting coverage is only supported for the Go unit tests. - -To run all unit tests and generate an HTML coverage report, run the following: - -``` -cd kubernetes -KUBE_COVER=y hack/test-go.sh -``` - -At the end of the run, an the HTML report will be generated with the path printed to stdout. - -To run tests and collect coverage in only one package, pass its relative path under the `kubernetes` directory as an argument, for example: -``` -cd kubernetes -KUBE_COVER=y hack/test-go.sh pkg/kubectl -``` - -Multiple arguments can be passed, in which case the coverage results will be combined for all tests run. - -Coverage results for the project can also be viewed on [Coveralls](https://coveralls.io/r/GoogleCloudPlatform/kubernetes), and are continuously updated as commits are merged. Additionally, all pull requests which spawn a Travis build will report unit test coverage results to Coveralls. - -## Integration tests - -You need an [etcd](https://github.com/coreos/etcd/releases/tag/v2.0.0) in your path, please make sure it is installed and in your ``$PATH``. -``` -cd kubernetes -hack/test-integration.sh -``` - -## End-to-End tests - -You can run an end-to-end test which will bring up a master and two minions, perform some tests, and then tear everything down. Make sure you have followed the getting started steps for your chosen cloud platform (which might involve changing the `KUBERNETES_PROVIDER` environment variable to something other than "gce". -``` -cd kubernetes -hack/e2e-test.sh -``` - -Pressing control-C should result in an orderly shutdown but if something goes wrong and you still have some VMs running you can force a cleanup with this command: -``` -go run hack/e2e.go --down -``` - -### Flag options -See the flag definitions in `hack/e2e.go` for more options, such as reusing an existing cluster, here is an overview: - -```sh -# Build binaries for testing -go run hack/e2e.go --build - -# Create a fresh cluster. Deletes a cluster first, if it exists -go run hack/e2e.go --up - -# Create a fresh cluster at a specific release version. -go run hack/e2e.go --up --version=0.7.0 - -# Test if a cluster is up. -go run hack/e2e.go --isup - -# Push code to an existing cluster -go run hack/e2e.go --push - -# Push to an existing cluster, or bring up a cluster if it's down. -go run hack/e2e.go --pushup - -# Run all tests -go run hack/e2e.go --test - -# Run tests matching the regex "Pods.*env" -go run hack/e2e.go -v -test --test_args="--ginkgo.focus=Pods.*env" - -# Alternately, if you have the e2e cluster up and no desire to see the event stream, you can run ginkgo-e2e.sh directly: -hack/ginkgo-e2e.sh --ginkgo.focus=Pods.*env -``` - -### Combining flags -```sh -# Flags can be combined, and their actions will take place in this order: -# -build, -push|-up|-pushup, -test|-tests=..., -down -# e.g.: -go run hack/e2e.go -build -pushup -test -down - -# -v (verbose) can be added if you want streaming output instead of only -# seeing the output of failed commands. - -# -ctl can be used to quickly call kubectl against your e2e cluster. Useful for -# cleaning up after a failed test or viewing logs. Use -v to avoid suppressing -# kubectl output. -go run hack/e2e.go -v -ctl='get events' -go run hack/e2e.go -v -ctl='delete pod foobar' -``` - -## Conformance testing -End-to-end testing, as described above, is for [development -distributions](../../docs/devel/writing-a-getting-started-guide.md). A conformance test is used on -a [versioned distro](../../docs/devel/writing-a-getting-started-guide.md). - -The conformance test runs a subset of the e2e-tests against a manually-created cluster. It does not -require support for up/push/down and other operations. To run a conformance test, you need to know the -IP of the master for your cluster and the authorization arguments to use. The conformance test is -intended to run against a cluster at a specific binary release of Kubernetes. -See [conformance-test.sh](../../hack/conformance-test.sh). - -## Testing out flaky tests -[Instructions here](flaky-tests.md) - -## Regenerating the CLI documentation - -``` -hack/run-gendocs.sh -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/development.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/development.md?pixel)]() diff --git a/release-0.20.0/docs/devel/faster_reviews.md b/release-0.20.0/docs/devel/faster_reviews.md deleted file mode 100644 index 64728cf3962..00000000000 --- a/release-0.20.0/docs/devel/faster_reviews.md +++ /dev/null @@ -1,183 +0,0 @@ -# How to get faster PR reviews - -Most of what is written here is not at all specific to Kubernetes, but it bears -being written down in the hope that it will occasionally remind people of "best -practices" around code reviews. - -You've just had a brilliant idea on how to make Kubernetes better. Let's call -that idea "FeatureX". Feature X is not even that complicated. You have a -pretty good idea of how to implement it. You jump in and implement it, fixing a -bunch of stuff along the way. You send your PR - this is awesome! And it sits. -And sits. A week goes by and nobody reviews it. Finally someone offers a few -comments, which you fix up and wait for more review. And you wait. Another -week or two goes by. This is horrible. - -What went wrong? One particular problem that comes up frequently is this - your -PR is too big to review. You've touched 39 files and have 8657 insertions. -When your would-be reviewers pull up the diffs they run away - this PR is going -to take 4 hours to review and they don't have 4 hours right now. They'll get to it -later, just as soon as they have more free time (ha!). - -Let's talk about how to avoid this. - -## 1. Don't build a cathedral in one PR - -Are you sure FeatureX is something the Kubernetes team wants or will accept, or -that it is implemented to fit with other changes in flight? Are you willing to -bet a few days or weeks of work on it? If you have any doubt at all about the -usefulness of your feature or the design - make a proposal doc or a sketch PR -or both. Write or code up just enough to express the idea and the design and -why you made those choices, then get feedback on this. Now, when we ask you to -change a bunch of facets of the design, you don't have to re-write it all. - -## 2. Smaller diffs are exponentially better - -Small PRs get reviewed faster and are more likely to be correct than big ones. -Let's face it - attention wanes over time. If your PR takes 60 minutes to -review, I almost guarantee that the reviewer's eye for details is not as keen in -the last 30 minutes as it was in the first. This leads to multiple rounds of -review when one might have sufficed. In some cases the review is delayed in its -entirety by the need for a large contiguous block of time to sit and read your -code. - -Whenever possible, break up your PRs into multiple commits. Making a series of -discrete commits is a powerful way to express the evolution of an idea or the -different ideas that make up a single feature. There's a balance to be struck, -obviously. If your commits are too small they become more cumbersome to deal -with. Strive to group logically distinct ideas into commits. - -For example, if you found that FeatureX needed some "prefactoring" to fit in, -make a commit that JUST does that prefactoring. Then make a new commit for -FeatureX. Don't lump unrelated things together just because you didn't think -about prefactoring. If you need to, fork a new branch, do the prefactoring -there and send a PR for that. If you can explain why you are doing seemingly -no-op work ("it makes the FeatureX change easier, I promise") we'll probably be -OK with it. - -Obviously, a PR with 25 commits is still very cumbersome to review, so use -common sense. - -## 3. Multiple small PRs are often better than multiple commits - -If you can extract whole ideas from your PR and send those as PRs of their own, -you can avoid the painful problem of continually rebasing. Kubernetes is a -fast-moving codebase - lock in your changes ASAP, and make merges be someone -else's problem. - -Obviously, we want every PR to be useful on its own, so you'll have to use -common sense in deciding what can be a PR vs what should be a commit in a larger -PR. Rule of thumb - if this commit or set of commits is directly related to -FeatureX and nothing else, it should probably be part of the FeatureX PR. If -you can plausibly imagine someone finding value in this commit outside of -FeatureX, try it as a PR. - -Don't worry about flooding us with PRs. We'd rather have 100 small, obvious PRs -than 10 unreviewable monoliths. - -## 4. Don't rename, reformat, comment, etc in the same PR - -Often, as you are implementing FeatureX, you find things that are just wrong. -Bad comments, poorly named functions, bad structure, weak type-safety. You -should absolutely fix those things (or at least file issues, please) - but not -in this PR. See the above points - break unrelated changes out into different -PRs or commits. Otherwise your diff will have WAY too many changes, and your -reviewer won't see the forest because of all the trees. - -## 5. Comments matter - -Read up on GoDoc - follow those general rules. If you're writing code and you -think there is any possible chance that someone might not understand why you did -something (or that you won't remember what you yourself did), comment it. If -you think there's something pretty obvious that we could follow up on, add a -TODO. Many code-review comments are about this exact issue. - -## 5. Tests are almost always required - -Nothing is more frustrating than doing a review, only to find that the tests are -inadequate or even entirely absent. Very few PRs can touch code and NOT touch -tests. If you don't know how to test FeatureX - ask! We'll be happy to help -you design things for easy testing or to suggest appropriate test cases. - -## 6. Look for opportunities to generify - -If you find yourself writing something that touches a lot of modules, think hard -about the dependencies you are introducing between packages. Can some of what -you're doing be made more generic and moved up and out of the FeatureX package? -Do you need to use a function or type from an otherwise unrelated package? If -so, promote! We have places specifically for hosting more generic code. - -Likewise if FeatureX is similar in form to FeatureW which was checked in last -month and it happens to exactly duplicate some tricky stuff from FeatureW, -consider prefactoring core logic out and using it in both FeatureW and FeatureX. -But do that in a different commit or PR, please. - -## 7. Fix feedback in a new commit - -Your reviewer has finally sent you some feedback on FeatureX. You make a bunch -of changes and ... what? You could patch those into your commits with git -"squash" or "fixup" logic. But that makes your changes hard to verify. Unless -your whole PR is pretty trivial, you should instead put your fixups into a new -commit and re-push. Your reviewer can then look at that commit on its own - so -much faster to review than starting over. - -We might still ask you to clean up your commits at the very end, for the sake -of a more readable history. - -## 8. KISS, YAGNI, MVP, etc - -Sometimes we need to remind each other of core tenets of software design - Keep -It Simple, You Aren't Gonna Need It, Minimum Viable Product, and so on. Adding -features "because we might need it later" is antithetical to software that -ships. Add the things you need NOW and (ideally) leave room for things you -might need later - but don't implement them now. - -## 9. Push back - -We understand that it is hard to imagine, but sometimes we make mistakes. It's -OK to push back on changes requested during a review. If you have a good reason -for doing something a certain way, you are absolutely allowed to debate the -merits of a requested change. You might be overruled, but you might also -prevail. We're mostly pretty reasonable people. Mostly. - -## 10. I'm still getting stalled - help?! - -So, you've done all that and you still aren't getting any PR love? Here's some -things you can do that might help kick a stalled process along: - - * Make sure that your PR has an assigned reviewer (assignee in GitHub). If - this is not the case, reply to the PR comment stream asking for one to be - assigned. - - * Ping the assignee (@username) on the PR comment stream asking for an - estimate of when they can get to it. - - * Ping the assignee by email (many of us have email addresses that are well - published or are the same as our GitHub handle @google.com or @redhat.com). - -If you think you have fixed all the issues in a round of review, and you haven't -heard back, you should ping the reviewer (assignee) on the comment stream with a -"please take another look" (PTAL) or similar comment indicating you are done and -you think it is ready for re-review. In fact, this is probably a good habit for -all PRs. - -One phenomenon of open-source projects (where anyone can comment on any issue) -is the dog-pile - your PR gets so many comments from so many people it becomes -hard to follow. In this situation you can ask the primary reviewer -(assignee) whether they want you to fork a new PR to clear out all the comments. -Remember: you don't HAVE to fix every issue raised by every person who feels -like commenting, but you should at least answer reasonable comments with an -explanation. - -## Final: Use common sense - -Obviously, none of these points are hard rules. There is no document that can -take the place of common sense and good taste. Use your best judgment, but put -a bit of thought into how your work can be made easier to review. If you do -these things your PRs will flow much more easily. - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/faster_reviews.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/faster_reviews.md?pixel)]() diff --git a/release-0.20.0/docs/devel/flaky-tests.md b/release-0.20.0/docs/devel/flaky-tests.md deleted file mode 100644 index 2f76cc9714c..00000000000 --- a/release-0.20.0/docs/devel/flaky-tests.md +++ /dev/null @@ -1,68 +0,0 @@ -# Hunting flaky tests in Kubernetes -Sometimes unit tests are flaky. This means that due to (usually) race conditions, they will occasionally fail, even though most of the time they pass. - -We have a goal of 99.9% flake free tests. This means that there is only one flake in one thousand runs of a test. - -Running a test 1000 times on your own machine can be tedious and time consuming. Fortunately, there is a better way to achieve this using Kubernetes. - -_Note: these instructions are mildly hacky for now, as we get run once semantics and logging they will get better_ - -There is a testing image ```brendanburns/flake``` up on the docker hub. We will use this image to test our fix. - -Create a replication controller with the following config: -```yaml -apiVersion: v1 -kind: ReplicationController -metadata: - name: flakecontroller -spec: - replicas: 24 - template: - metadata: - labels: - name: flake - spec: - containers: - - name: flake - image: brendanburns/flake - env: - - name: TEST_PACKAGE - value: pkg/tools - - name: REPO_SPEC - value: https://github.com/GoogleCloudPlatform/kubernetes -``` -Note that we omit the labels and the selector fields of the replication controller, because they will be populated from the labels field of the pod template by default. - -``` -kubectl create -f controller.yaml -``` - -This will spin up 24 instances of the test. They will run to completion, then exit, and the kubelet will restart them, accumulating more and more runs of the test. -You can examine the recent runs of the test by calling ```docker ps -a``` and looking for tasks that exited with non-zero exit codes. Unfortunately, docker ps -a only keeps around the exit status of the last 15-20 containers with the same image, so you have to check them frequently. -You can use this script to automate checking for failures, assuming your cluster is running on GCE and has four nodes: - -```sh -echo "" > output.txt -for i in {1..4}; do - echo "Checking kubernetes-minion-${i}" - echo "kubernetes-minion-${i}:" >> output.txt - gcloud compute ssh "kubernetes-minion-${i}" --command="sudo docker ps -a" >> output.txt -done -grep "Exited ([^0])" output.txt -``` - -Eventually you will have sufficient runs for your purposes. At that point you can stop and delete the replication controller by running: - -```sh -kubectl stop replicationcontroller flakecontroller -``` - -If you do a final check for flakes with ```docker ps -a```, ignore tasks that exited -1, since that's what happens when you stop the replication controller. - -Happy flake hunting! - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/flaky-tests.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/flaky-tests.md?pixel)]() diff --git a/release-0.20.0/docs/devel/git_workflow.png b/release-0.20.0/docs/devel/git_workflow.png deleted file mode 100644 index e3bd70da02c847da17fa1d645e81d22be9fce0bd..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 90004 zcmZs@by!th&_29r1O%iT0g*U_bazR2r_$XZjS5oI-5}E49fEXscefx72foeoKF|C9 z{`lrP7l*UYUcs!rX3fk!Hz7(2QZG@6PyhgUDg9nt1pwe@0RYwv85X?qXY?!?e1mfq zl~zMWMqXT3TmwH6x=3ibsM?#kxPNdm1=jh{6oJAa8D*LJ*V3`Ks zO{sqkHcHgc*~@YXUqiz*?_Xa~%GSakL#fpG5CA((j;Z^thVq?1ad4eSwfX6Zkb$rh z!1MOY_3pXVdcRkLv!}<&H4k)SH`5Q1A^=kq8T|1P>&fHeAABflgqD)oQg@WusV z{d12fG7IT|=!<{vNs92rONo6Jwz@ZTbcIb#o)@zb5fMLs{da z;}~Z8mYrgjsO^!TS2@`E$@xR4yVViXg~Ir3)QVo~--%g=8Tah+Y)dz70(+)CYi`9A zx;rAKH7*)jHJhVNY0=66IRvF@R5-%xLcp&l?kFRxFQi{0U8 zn0@o&b^g=DP+d|I0kFTn@43yZy|>;K6dMym%lw~iSfzY-4E;CDI- z&RhSd_>}bE|5+)~;Qg@%rT^bfXF+An%~@zE2sr(>N<)HfUzQFItXiGY8Q5uPXt=np zCvs)qqJ96jvp!?-b}1%~@c#x%=9{8Q{J(*Y#Q%K?MCF32{&&!7=C{w%Q<3(6*Ya}M zm@fXTcS%c2v#Z4Y*E`AW_MG9|w%&j0jN%b>-WrL&zdo(6qicV93_5LpTJI(IdpPUO z^lk82ToQS8{vP{BQ$= zGStQ$w}4l-QWu^Goky3(udYi)#)|n*huz;QO%X z8Sse!e~3!^(e1)PEo+w=9y%0Fn@8&M^F^#e^|j2){hJx`G0_ ze{e8zt5XVPZ2 zm}&3Tlc~A6bx#4fE{_v~q910&Yuef$g!)82sD0> zMf=`7^@3Yf%CEAn&dte*RhQwfyv9|gRCz|2U-ee~gnL4B`Ig|B^&HU+i-=Eap2gYt(=Ifs+L-6O+uDb+FD;@Nw<7!@Qe zQ91wX-?6Dr$Je5o%vZBQP@ej>wqGq2uSEM=uHa8+*C`f{ZEgYI35y6)MfJkA%tmiF!rQTBVTXt@C?auJuods@Vj|xDm^XLw^tvA+#-a!qvd)te zXMR-N-t&0?N4jP{f$Z*qwn?moCIby+b@1(vqeLjUlbn4fz)jX=s*{!YY*_W0TrA7P zl4rqgsz$degi!Tc_YS0kwOclbTW+{yfrp>t4-{0BOY4}TeGg_S;%d2fj}N!3SG%A} zRH;KTtLOeKlIFx0jJNb$xKxdSdnKokp73&Y7iI4DH))1v#9b8TM<$!uB}2zg0BFDN zH=fi|_$a}3T9u0mj?nlKP-ZX{{~gnLUEpl1$={(4>(bRYwh@tQykU&a!qU=IiuED1 zYY`k|2R$gNm*_NvhUKmLWZ{i=4=676H3 zn-{8GxUN4Meex+AV~D365Y1nUjkbGZ$6T7dAB@b>oU70|UitD#RoV2!0ols?nK!!kB}SDA_CK)~e6Y4;OEv>7Y(W%t09B3NkWxx4W70 zZHCJhl;`^Z%)uuU&wpW@7m7Crz;dU!`U(6;=(0o zo7XnmdZt8LPA)BMa@76V0($-|OgUKxj}pS;R3+`(TQm#_I$DaYvtOHnEWdK9=O`Bz z7r7QvZ3<%@Jdwbs3*kD^dyf2|J)=vZQF6Z~uuQw!Y&eDEZG@45g{`fzxvR62BZoUf z04Ay1l_E5>>)x*>h1_nn&F|?kR&k`J7&fSDdy!{I2DHTI7FAU>cmmDd8@6V}5;bk> z)>lE)ip_E~8lrt^gisA%fkZK}@Vo6UE(&4U;uz?!{_f?LXiQNw0V)^Ol>)f2g$2&P zk8iyBkSuBCzsMs~RL2I_)zwxCaibb0eI!?reI@R=$V;V;Kc7G zFRw0Dz*`s}S5{SJ!_Ut=jT_KC!eD29MG^TL{d)EYqtsUBuOxV|p^lFJ_r77&Oji=EcOSI3} zZXv`%R`!r2ND?`j)W=yhBt;F6=+!I7{fXR0ZfMID^gX%I$$KwUimmbAWm4A##CIDV zI&BuMC4nsNZ%o#2ypEI8v#m4n8qXx`9`MCX!mI!8-+7&#-cWKqhTWHq<;M?INW=|p z4r^NkMD4T94o&lF7sSS5*9I#1Gi3$vSAiR-x=}3Y=V=(WTY^$7W3qfo!bMgoxzEIu zP#S$v@~W28Ffo>Pl37gf!h_kq-ZyZfh2(O4jflev>KHwuO#X8~XY_4k`*R?AV-S^@(zX9R_2GlF=Puo@oE$omrR= z5Pl)$Zz*?Jt;M}n3J{!|uW+kipdlQNr@iOn%1$fv!5GF zgT5;$-?r}{wPVlj9P8j6Q#zBC5?ozzPBoLkCwGoo)oATbZwlAVFawlFJygJzMKqe& zaH}r6#op!XsWs|mj_>tGn4LFxvF5IOthLJ7588a9%+AF~k;BJN^k)?jU#|dHnZidIN?k{kFoO%D}sKmOwEuY6>3@bOdOAPtM zDs+3lb=Mriyt>D)$FFWzFRFCw3K$u~)0Ca>A4bOFWUV?_-sQhGg{wUh8u@1u#Nnva z&LM?!kgbrw7X5fQj~vhjA8s%f4enmLCcdfu-b}gAtjUB2btFXsTCkY(7+RgqnEj%( zV8t|779UTkNr4OunYKUMhF%LPUMWHl!InoJpj6`3#O9^v>|$Hki(B`G(UNd)^VMIa zhqH)*&c#i`cC z&XU1N)&=7;Y~lvbDQja36UV`OG z*G&&t<1Je`e+(=U<^%lhWxaj#9}PxZJk}qi=01qtmYSYo1=o_J zoX-O^=@6(Hy2NYh>rb=2qAjy!rb>Ru#7S@cBLoRg6I;%O*iIR-o>03l0up~st?Mk*cT z20SeC)z7{Wee1uj!|9c)L+F+BKDZ>~?U`o(KSvT4mIs={a(ym-GG8!)Tn>GC3+g9C z5A7sA9ML{1lfA`3QlP>cibA#j<9M)*a;kRSUbBr9#qaJHA}1takw_?`iRZ&%cWOGY z)_5#0BNEb974|gC#b{V9)PCDu_X1u~u|*&`&O8^1HFpR7BTSA=TnIt>YkW`by%Y{> zxmTzZCT;~~1{yF1Fk~}35#Sb}RepL059lpYOJYkxr0PaEF5J_zv+)$QBW7Pa?C!ij zUH*2Bb>8}fQ|FRENsa1nfI@#}V7u}OIhmwLJUMx!VGN8tNd&#;ZBiN`O**rz-r7mVPAA=g3cU@uq58&J@qi75uhhuzylqU0~ z#5xV@uuwfdQV6m0vub8f6w+J{tm2&i7Huoh@T29KBxqFV!$xftW%Y zx0mepS(vk}7>94N#~C!Cup`#<=#mPKRd=6jP=gp&OhLV_Qc+_$$m5FwmCsbKth9Pq@!F$65+THHF@zj!)(hT4X9y!E3DJ*$aBzhobNsiQ3 z1%*42(akfcb22&CI^{Px=frm~!1toZrHq?(nejg%q1KlQ>?FHQ&|0*drWEW(YXQH8 zo(7-M{4QL!@G5R5L5G{|WfIEaX(40)Tp)7L;!KYDTt@lHwK-i}d!@U^lLu%d$bNlG zRMN4@jiR46K3&#?)FJx1V$&%NA&o`XVzK(VG||xOUE!~+B83cXO|8Fn%e}9D?7J_J z7s;W@H_Qm07wfoIA8ZX5m7Kfd?!P+05VEn~XR)-9zE8rcJ=h7H3P3#{Fb>83^<`Z& zuaKMb&nNZKq+PaxBFI27WMDKzRw(x47)x3HPL!ru|K4EVk}c!lqJB2N20rS18JwxR z6j{S;8Li?)8$&+v`zlqSjv{;FyqL zM%9}WE&g#{7>si9%S0(z*-*8dcI){jneOn;(0cQUC9Z0jxF(G{cdvtCmP;{P^J+>i z6=jA<0bL?aRz^(c=07(PrQ4parA4t^#R_;qxV|oL#w4E_T=P3k5iksTM5ecowg!ix zyW0vpkM}Z?hKPB^g|wSeJ-gbty!d|s98bFTn+`*=J98^KgUo~yxf+Ze+`?7LP~+IH5go4jUWU(t`K z{*AW=F2iyflBcSA*1Ll3r4?&Uc^ZYv-WpBQgD6HsE2#2p7D^mr3GM0fB7rc{9QbYH zQ}i66%rZGGCH`dHpQ9d5=Z2fCKSColFM*}q`tAO53#<5)g+uxM(;G&_8u>!yMK<1x z$0nBnHrco^pV(EQRpm?h>%dO5t9}E%*U@COlb*-YOg6=LdH0>SEm@{O)`0w&&nrZ` zI4+nk@mMfm9KbNR+ma4sZGUY2;01TrMt=$by@?sATgw6`4sCZX4o+2kz;W*HfQMwg z_yJR&)^cc!J$tRpaNu8Uk-;(bcpv9Zk03Ig5S4hGLK|pZ-gKNE zxsskepR*i2;J@=l?3|D7g~!|Y0)xiy@*<>M-2;m_GV-M=YN@~#mI1}DUipqtu_4` zNOZ>`Cr87rYUN{)D0WLomtU+w7LH{o9mo<3_UcI<`jokSg{Nmt9N8x(?Mng>O!4;m zc)y)q6*Kx(Tc=G%8wO-IDOwZG$vmW6dOC^*li{z9-5xSx@z z{mf^F>G-Rwq3DA`*vl1h>_g^%HPH5Sb97pbNtc{Si;zy1N6k@cg}LTQrkWNU#jp4r=!^+oAV!jiNH zbpCi(>EC*6y7?;E>8%2g#RjQ&1B81U1*p@(ZP5ooM~IxMee-KS^y0N3pl;{VZwt*q zT`77mL~zhFl`>e1k7#m)Q3VTJu5DyhMMl1#ccN*J3;1dW4(4WkB)|ijN+t1U3HZ>c z@SIc@!^VjYVF}mPoCX4-9X(sAj(j#unArH6{$`XmL8%)C#q@cAq(_A=k)+t3vqjR< z$wXYe>k5k(NW!W;9A6I?2;jKRAvHik_wm?Ew1gN^q}ckl*jL0x7#4P*pNiTcN@P98 z*ZuajX)znHv%n+KK0>t=Zy)%*HOz9I!4Uu&Y{E$REV*Z+8Oe{xJ(W^TbV7-0w6>^S zv-i94<4y-7ProlTGhW@8PmPJ2b@FUME2x3CVJ~OnjoUi|M9@6mIah^8=e7bQeu*R( zL+t27&gf5KKe2%wCmC;^Qj}Y*A2=>e>_r<@OhDblGE9@aLqbd+cRyNW8@KRI4&U!_ z5e98E0IvSKOK4J!rRI;Myp19<09{w*!3A!UX%+k4PET#3-$;sVOhfete8-vKE4rCO z9-CHrrfzH?C9GJj3B$v7nX|5^+c_o}0KUvpy6m*nYM-lbW3E? zXH^zAF_5i=SrGie<^aFq{0JZ zZne%28XA(WwdpVwb6v82!mt%@Ui)5;y!Wg04`#Q-9tf-9->;fq@kfH8yl+`n(& zGe(*;b;~%AfRePd+otUn36i~uf&s|M=R=}3$=OkaKtijQi~ik2CW8j2!9H)b0J)6q z1NTwy8pjt|t;v}cXYq+(tk%$=Ywp@0 zXi;#St?tj_jO`Bv;iN7HSVlJ8ID8=(d`$aJsUw*Zy3w(AY9#23MRX3XQ?@HxPV>A| zNsl9HA)ascOtKXe6sGWG-sahzA_BVOlwHhBiKpzs0q|LF@<15vybM2{6;!VkhSo&MUS*pb}HGI5rJIxoQJ^xYY0IYm4X(7+iXSF@|{)6lVyA+eQaMJ$L!6s27|8Uhh+QOPAPl$~(Nj=1h z_p>QQ8GGvue+~PCjP4D0q@zBD!4Z$eghSs$uYS5mt9e>bMnXVl)c0!-;vU_$C(lLS z91Q5&8)kuDJ#J_38&(qD)xPWZmZIAmvNU&)^}#Yz%S?8#`spaI7m_lWFB@NQ`=he* zl|L9l8t@E9%jWfTj*|g*3nxSdI!PJmldhEP2@b4qlI7V8D;Zwja>a^#fr_fi^fg#s zZ=|wzpN_uxIOXL=fev6zr#igjninY?A**qA0`B_?cNzjTF-*<>wXo=97&e%&fRPa~ zhnZdI#{=&8!k0OT?6A_DH`ysf`Ai-(9%~@VRM5}O&ELaiOg+`z=hz}Ri-|H}Oe(_k zwFfL>k7|^t2Y!G2N6-dctHurv4u1Z8qZ%l_LzVHho)}5kFg^Nq#`BPfcUKUeDG?Qr zYyY)fRV-oppkUw?_()GD?5CfM0*FIslE}g#TI*mWr&{xP{&2OKA5btWOJ2YI7}e*?=Yb za<-VDYkK+xn2ul8h=)Cg87cJ2Zxb?}#ZIeik}7dn6dM~`9v3&+kAa`khhczzdbp7g z7p525%YO25DpR46BZR5~PNvp}2r+2{ArRtF0Zi=`SZUl#lfl1Ji%u+NZwqVMo8p=8 zePvu`C>C0Rh5$s&W~gId_ExwpZ}b)xPt|1%6~~hi@VOGJre+qySM>2s1rBy4$cM>R zofd89k96;+A@4CKZr8&3n^*jH2+i3iD1z9-+d#c7JkJ_g*x9oh?iw3&UV|aT?|NrU zfota2`52Y4`7Y;qtc@tYs$#Z7HT5Mam@5pj4=Lw@1!;1bbA%c{8tN#C<6N^#^9uPs z?SBQ55@J2%H;>qkWpHL8eX~VXCKbip+Y7o9ynnBKHRCivBSN@l2IH0a`oj*A%(1Dq zM$XeBneibfoTjQN7fc7^oL54OBzVrHeK6EZP{8xN0im)Wj8sYzRzK}KscsMTw=>I( zFP6H8d2twV7hqcDaS5Ye+;+K-_Z%LrBZcXvDE1`R8qvw5yuJeMHCY_Zg zLKt35?9kft8o0B1fLrSHsupRjX4^!m%}+YN>b2evftXi>uj|&o?3XeshVvUtz;%4k zwd$x=^~~7(Au|PHQ8bjQbtbYOJj1|9?Oen6C%ceSO z({M&yMAJk&FSns>--6?Vz$)F2k6{9pzo-&j%Pba?%Ojy)|J4FaFj*Q&d+CdmG`!Y0 zMGpMcg)P5upRc|Yjw08*H0i*r=Bcy$Kyoc`YTiSv``eU=y*?E8x+5Nb@?xXfeqW_` zv0i?xG!0X9$lhV^DdQ8IjL5Ek>r>@~?z*5yY0-fA(*R2=2EvK~^yuR!Y!;1>l!@EM zjlQ2zDa#V>wXO)28(+qq7Ul0ZKjow25WX-1UH9CH>(QFy)@l})AX%X z@W5E(_Ph<~|55jcbyj0#;)^lQ;}^)BKA7DvKJtx>+1zl#|1EBrVMLzU`$1bdwsu9r+d2q{-9gh9>Dx8IuC>r3iNO`cyKhjUu6+h)1H! zrMSA+$6YAvwMA#VI9h>aN}+H&shKJ`{GPE)W$B0nv~Tm)@uwN2?j#`sdPsXEV$;5epxi=s5)IBQnWOHY+lbDb&vq>We zU-9wMv+_;H(mH?VHyQU#^gW1|W;y4#Yi%%Y*`p^C z4iyNEIh1XX`J1Ndff-KJ!B5Ux2mkm`f`Wp1C?P|NvQYiTq1KUs%}OtNou;7jA7Bzj zZ>tOrg|UMBJ?DB!^>bN*hd6l5<>N6X&KXq{Gr6ulmfS6Np^mV$*5U@iUh5OUH$dFK zjZr3Sv1GF`xqx^Mh!U}=zA?#IlW`-DvY%-@*edMgtV@9b`Hv!cEV zV*V2&nLF+4^wu-M?8|eBNbtTAiWSxj1bs$7%DiR$kh+4P?46@cUbcw;YL2h>P?zvKe)j94_QVhNk9WJP4kWl9JNL zhkpC^Pr(NNTTp!gL!@0CI$B`l3p$}HDp;k<{}hLub7$dz`TzX4@qv=!;{T-n!RwKr zO?W}E^CLEpm*-iM>Heqk<0Iv4d)t6T5WZdx*y`g)(BXToRp~PhQW--iZ`Y!9TXu$lTRlhWJ zU^04fRz_iZWM%S}3F2EyyVE-1o30YhIxTeY^+&2tm!I{C#fu9KmzjiAdunpEkh6K=WB)6JYj~-ymjKv9FRo z>=P6)m%+gcVtsC;qL|!We-;qyo20r1{g=4Flmy9S>;|YnARf@b)D~TiaMR3-is#6F zedozbBn$alUGDm$nBJgCpGt_B+55sNgiwWRz%4Lu1r|VVxrRrI0f6zLO~*$1C)kCM6h`L{HrcW1ri2w(Dt zNl}wctpZDalKQWOSBKUMe1dlKJ2arj^chtOH*;2~l+sHxF1v9~^(;9m%qZ!bQW+iY zZp!(D;J+rqw^Fc@xG>;EaE*IwV&1}8*Zx@TfP3Fwr>c=jMBv&)DE~rg1R*0FGnsLw zaZHzXF~buT=(Rpfo><;s@z|+8DZ{e-gEzl2HkGP`C*FOpH>AVDOf=j8o2_+ZqSP|L zY%=W>a`DxyAWR`Xzhr^c-Te~r6dla**!LU!t;npd9*Qc;)_c*=x^vkl`5r`N6VlU5 z8^vBbi{um)O~Pv7;qPRp)@jSsA^wFpdvS}oLgfmE`7Ni7bhcjVFr1^fCey&g(q;2F z4F?qt%fziB7**0WzB}aD6ze(G{Ed5j4ePI)&qmfg?lZ~daA|SD!2yUw8KCfXc2aHs zW&yJ+nGb4>15+>~tQihrHq=OfT|8Ie?ztQq9H18_b<^{qd}C6hgXgz%A^5m}<^vDK zH4_nFC`G#?JPUA?N6Fp!J27=TS*hS$tmlZKH)>Sxfz8VD7OYF7q3M0DCaYG4sL1fb zIB1gf|EW(k5)%==h}d0*!hWF+yC9!%p=FJ*xn5Y~k1V_1i9ZGMm#<) zcYo%ujHRg_~_gKD@?;V*g%6I4UhhSFNUnq_KF8|<{^DyQ6gyhWe z;x-kIi$7#D#>L1JPnkmc zR`~J^@BH_nq6=EBPt&S3Y4f(5HZ&@aN}c@yi>0WT2Sh5WU!9B9pWeEBB4Ydpe^6R` zwxt@WVm}*u1dR`RI(7ZO*0*=D8$4t90R+aI7B2xtQ^_6db)CZsAL zlSiX!#8XmY*uEA0Kpef=ynN6bRU)N}u*uY<8^*@GM29g?rt9W@!^PCGbXcOg1)fFKD^Z#)0(m^2E&CVh1@0D-JRmhb!!N19 z7Y(&^E}ibu<>Q6*qUv=U7r#VsU3Fn5-}%jPXo^CIKCcj>N%R?E*?8xKC912F6Ig4@ zBEcPC*}TvRbeu<74!>H^$3FCHDMDHkY-d#Tl~667nliAL@$0o`$+DFRU&t6g%UYI; zerw9cUhi-GzqrOTiUQjZPu_I6_ti^ZZZO0LTt2{jK4a_ea;=Q~F_-N#t}!zcZ}`a~ zQ!AV`US0$t#$5)r%o;>JbWGiU6>=-0W?h;LU13uxTQ)IO$J&K?Cyd_U&8lUr#Vz%} zFmZQCcSpz%+OUMCDN`bJ{Cd#Ce9iF!iP z0@AnXOKLJL%x39E>7uAN(3rD{1f$VeD*W``t9`FAG&AqLHzO{_|Y`vQ0_y$ z%=AIq#^d?VK=;o$S8E*c(a3A8O86Z3#^{!6$vg>kHk0ie$g1FoZ-EnoU~l8VREGSQ zI(hBxJ%2aQB$k*C|&!~ZfzI8wfDwZm_8igmS>H7HWU5Ddpw9;I* zQiNLnmjK~N%5kAa6~A2nZ`UgJA{DF*JXh%gzAM?fQVV7$Q@DjdBGBKGEE^&ht$^1A zmLR84&59FDzlS9FvxT=3t4655gmv(cIy?KNM6uXmL8nt&ePpwcCjq3GSgLmkQ1Fc$ z)9u5*{v>ALNUJr3F1^bX51$X2_<94VHI7r)&)YUztEk$+I4u1=n^*JW6xu@3IA-9B zedF;dt$w>#feTI}rX~fO51Rh1+S(e#03t^-KamMr4>({UT)1BWfYjQ%OT|nbb|8BHBeyju9c3}sHHHZsXT)Tgi)d5 zci_Et+|t!r^e+T6@QqOYl?^gRJ{qdtb?~ocP%y`wt`N50zaI}t=RHpNQcpjD@vVue zcE{;B5QgynYY8AM(7;`Av`M8>x75!}y`Du3)FdnuO>zWV(zO&J_EMQVqRBrWYdZ*D znV^GP|3Cs*fKldGf680+L)SwtQoj7X%##aBIoa`-j6na%*X+)9E8@`}Dpm^lCW5th z@?77Z2CNTMH*u{xcut1qW6M3}s{M8wWvPGl&eP8uZF?0WhNb<5+o~le4Z&DUPH}o` zZSv~#$+vSe;f8_K84K+S3%!EmcVCZ;_?c!ac-}i3KkfMor~9q**r2BE%rsUt0}MYa zU)_-s+rX;S@xmFErK?`R3G2#-V1cKb_|L~bvWM!9bQ!>yo?b4jzkx)*DWbo*OPT@d zam*UFNCbw5f_qVw9c;zRkPD7I;}$id9Rz>NKFtCc;T+R)k-Hq6ybtuC1x@NHDYgPS zOUECZfDs9?dlF z6#)6;0uLOIu|Iy3+lTwR76(~H8OJbAnw_yVj_h)dsi@{cH3%Ei_UJZiyr%>R_WYs( zt(uDHPhrb`)kvZ~M@NT8n%(g}POWqTbR+ije^w8?jzKg1NG!HdreF{CD8oepQbGq^ z?E;;KWSWHqZ;jH zsgk~(suVK!v8fDzc}Gx|31;RRba7o2-m$v~yEYO6cUAS}QN)5J)3E+^)n(+L@zxlt zwqVhcJ|~ad^RWlgaOc+K7gz3+0jOsvUm>sEJ+dG)y4f66vo|+PZ4;&Aj*r-v!aMW) z5bevOq%YYg5#SM&yDw=gA&(8n9jA4H2aZR@=Z;B_G$mUJg(faKZjvjr(2i;4>oSzY zLEn+yfMw@W8H7)_jgv%-&q3W%1y1Qg4CNL*J;oUpYwo~O+?PT6nv5m*rAa{zJif3YPl2t4u;|)LFZJ@eMayfEM?y5B~8LY2NbtyhoQtfVx-QEr*E-ms> z4f7y*wj4&bYzF3*Onzx6^Li1FvFsKH?fS~&=-fdiKbupZ)tR=r5S(i-EBc_?T9>I| zb*SQ`E4q?#(1NCSy?oAZt7ak%`PybC;ag2f4$S@%7_*l((ee*y4II8Gl;l-sSva%S zw_0B4p_GDrm1i$<3dCEAXAfKdvId4)HF|y#OCX~r)9-Qq4TZo;gJ{2#+6)Y%Dc3hq z&3%pQM%iWk-kI?r&%CK%t~6K$;}$x0Ua2Iq^3I~_&loS~el1#$TTTnq=-ZMb8}N$! z&C1)l8G)SrW8Ye70k5qgxBq=K3+qyNEdu4TB|NL^d zew8T05${&)4Da%$g15?*A0m0u3qcXY`5lu>F5G2!5^tzw6%6RB{8sx^X5Y`RXm9IZ zlwFB5NJD00`BU<@K9Oe@`@5>jnyQwP9VZE~``3Kfz6Pqw1|u14=BmBlx3F3q+bjn{ z%0_M%=?@Tpoq2_Wh7OaGlJa}PQ|yXlja*paT=^U&4B)Dqv0m~HdsBx`8|Y{q5ixd8 zVZYV^5fBw4mOI0D(Db|57#IMt`3~?m?lpvWu$eE6X=?U-SwD5L%IO)PtkETJp6;q2 z`+l!sFgJq)7^>Cl77sILwe8N|j=z1;f7%~T?nbYO34EKR>53R5svRlr*Zp0Gc~$iN z`;K`Jx=WgXoUM+U=vTaoKVbuQMJnjNZj~pSLnZa@GCurA`Occ3IdU&`;42@Tuct92@Q6a2+og{mx`Q|GkH>Jn3?u>;)Tk{D8 zc#kuftjn!vXWNcFQ5X97aS3snQ@8P21tX8W8ja}Jf4@D-F#b;-E0UDhP& z$hbKiuyFbNy3K)y+`q1}&nSZhC@OXp0M-~B*I*NV#E$?D#VsT6t7eM}ERX;s=2!S@ zy!Xw3|G7@_ugfsY<{9=g&+HjkdkVlM!GMF6!dBP!wcoN%xqcy4Se}+l9l~E23+7&P zj)>IN6}m{~eRx1b>*pDrdj2^)jKkc1)|9~Yg+UXA`d7O-bh48$py1GI;pIyDVkj|o z?#Sftnm%hVs-y1RT6{y9o))FdQ9L4qmAfvM_$h)z;E z^5O{dP#9_!#pc$_<;^RIN@zIxSCX#&M13xmD!WJ01hK3~UdNkG*c(o(+|nqXdkB22i6;x4pVQ9n3zkgl!Yv=l992gKjE#Dx8K@ z(LC{I-W0(;1PLIK^+E?^%ip~q7WPgsXpOL>_bo4wUCueEaUych1!n#bG5Q+RNDjh| z|CbNcF5uCA&nl?!aS~2q1wGoNwEf6J($Vol_>Y<&+>mRfzEo!2_DU*|@fSc?Ypn6t zp!O&|4DFI~T>sQl>5nS1@iwPQlIoe*RRVQKU~0I(5~j;Jir1Eha0^*j8{|Atj3>ZtBm0sdBXN3V*Qf>%_Bts0(~ts!@BaI3jtWga?(=`-c(AuHMkP-$ zuz|4|3Ax4n9Mgiq>8f@Rh1m;fRqa-b}tjAeOI&5_-~Yva%N79GjI zYl>fUp_G6HJyV%d9lPuIRq0PM;HJn?j)$DUmWf2}6ESMf`w2ciA_ZYZCh>tG0|jc# zWvIpcUqC7GZT!xx8^)?TnTkHtc&%(w1_?t}_rmdpCW&qr;LjHr2Nozrg=T*`m6yl}WM zl&B_P!U3z#kJuYM!Sd0fva+(mLXc^}uC5laTa#Nb#) zlWWk3_=l@UOI-IH*h!{q_B8bPjG6hg&9+_W&<)bCd_s(t$BclbiK)4BKTKu}94|5I zm-7h>8Odtclk>O>W7|cHxMf@3M*FUQq($xbZxT=>Xuc15-uYjKe#Pw z+vfe44<1GTJe_B_5nfEJQ=>3mszWJ;zU#cD>-=3%&1Kkd9I^I$tCB)~5q{!EAvv=6 za`9$<9<>a9m7y~k1&0xZky*>lniqX{dv0rG7za&E;!^s-Jzv9fA&c9g+V+!Gs3ATy zvUeh+I*L6dg8h}-%pW~ZieQW?-IsiKCpH^pE^05~jwaW6?_ThnBOb5SUc;8dd~shy zq3UUN5V~+IXfl1~71sN@j9TxA@ez6qhr| z>m(oo!P){#soyu_AI2S@_NRi6e$w?qI*r3l>YmYxbikqKJEoHdSmn}WbU)E|J&JyW zs%SArq|x6n+OF=o_o2RJn(>^t~@A5;UxdMYrb^7Tk) zqs?t!o_no$n7l-bnEq(aEUo1v>ZUrKTebYnS>1WLYorD@O$PmslkU)o@h|*O(m4}W z%s9Da6UWCL`t0?x$h{Pw+;Tv8+?S_5|DH9z{7e6c;l-!?inSk0t8=!DsE!X(iM*_l z-3XtWd9=Rs%c8G#Lre}ULt|u3F{DNEAK*(hNeUtF!~QzsSNz3gbV`74(LL**w=n*? zR;uq#FGx4!*)<#P!%HH?+zzG@Sg(hMF=a9w%q98@O*lDi4M+8n^;+D2o7MX`y`_FF z+(IDS+_KXgJ$x*x%DSmhC1BMdVSX(x;GBQ{IT^biLca(Wwq(5Jo~1Hl2T>L&v%bNt?uolaT@U#$4ZFI=2$S(pn+qM>t?L3je!S4J zaQXgs2+QP8oV6fhn+zK)aLwV{ZTS*$K6yB(q1+lSNBdVO$m=1w3QJ;Bw4XrkI6Bc| zg}J#OZTIG}tfm3iKfai&^tD`{Nw~ZS&!mBA{BweWmnqTgCru>N0N6q=deo_`PEotj z@33&7E?T<|i5G|PY~n^2NTaIv9K#Kdk|s?3Vt0YMvB;CeMF!fc$ao2Zs;$kpN!OpF zLjI2`P!Y`EQ{oe&AR|hJ>l50teB$AW!Tarv$>5%jWS_}iZWdV?r0sUqFqP}gb0@eb zDtL7($4ly?iY=}&OAyJJDvLKJ1AvN%$3F|XIK1y2{WR*R4oRRb_1YIDJ79>xb zS;^4tT?;MsF#CRpX#npo!E6k zAdt9hBg67vEr22SwFo$5+TiV^rE`!lvd7dv8M@5$J&?eiha3cE*8}?Vvp}Ml>N9aX z59IDyonV4o*?0wAkoEK|$&?g-U#eDK2X4KobyH`>V7 zu|>q&+hV>Su)Lg+M0bA2>4>yymey9)%)Apye!~u~KVrTYSj2xM%H%io2 zA95VC1BRkM7fV5}w>kM*CdKi`5G;#G9W&RUIxQbBmwLeoIUn9Hl7dA5Jd*JRfjMCP zR*z(m3Z6_K$-ZTQ)l3Q>GOLt@q~5bKN5C%EjcA^kK{L<6VsUY?wUreXSXqRJ2a@x^ zYCZ*j%SY(JAJ|K=I?vlKW?5JUd90}ZcdL+4ruje{-4PD=HyG}RE^82SmyR>{OuxF- zc+@Orp^NEO`HH1aJE=8^c%o8m+MJmy;D8=AKlAg68D~Kkt*Pk_#IgQS<_-;5`PD62 zJoLoKWd)UuKJ}ZiJ`wIa%Heum(T=XJuDy?p|MM>ZER*qA*_LrxU_lB6-uY&jIvP;3 zUA7CdiiV|930iHFL-j>LCc|Rx7y*gYEz%IuOv|o)aSK7BLRwly*`+0e9JzXyw8HhZ`=uS$1EamR_8su~w7m;-Qzhn(f zk-e+;UpLVX%ZKmY$$)T2q)%R|n5ZB_+3~DUx|abBP$1}lkLs~eTNP2M2z8Tq%$D!k z#nLI&J!O_Vpqb1U?~Zn$A~8FL69jJ-Ue0`=8k9sBnQTCm8%bJmhJzJcSJbOl(s@fvpYb4`>t+4nA_`@9`if`^xTYLgj zfr)(7Kw=JK{>f`N{k*SW?nfERhh=L`wG0iljKK(A)rMhXm$H`6#X-MWZt2sVYc&$; zHHbXu`j&EVTvQqqy&44mKepaFEUNE&13e&uw4ih;ARQ{*2qTSjw{#@AC zFgOM7>od#ABjkyfLzsnq?@;$*X=8NU(v_H^)-X^pG*Eft5hJYDu##R%7jJrVw5ND4 zK5C~h;PNy&4``l$)*eKrFM^U+@bHvU^7SeeR(6i&|Y_f4`fO=N36X@tfrSA`kgW-)ROb@{`YQ z46#0$vi|PZR5?Ry6hCX3(8iOrAk|C-^HL~kw@~)o@mqGhxS|oPtIxeV==t0NiFsm} zsRo&x49Wfx20U^vtlE2hIQdiN#51=f)KpFRN5_|+oanby{pxrBmL|TLdS%wJ5ECzv3EFe3SboF4 z?eDX{YbghA5o8gyCtKfi*7MnV%VqpTwossaWZt??KD|29sHbyHNfNxw!M z!~lSxZR3~Jk3U60n`HI7lsSkb002FPnb9;E_113an%ZmMTF>K<|8`_TnOBQVi9<`~kI zJoaCn_+QQTj~Mw3;6NF`U8*yN?9|rkCe1hxZg&E|(73=Ds>+2kf&CxLt=gn=uXu)2 z<9!lv$FW)PQpefFgNJ_Wd;Gvu?%prL=d9rJtd~PP3>$QjOh;WPTZP2A(`T;*d*k(( z#-c17k5>;Bdq>8r-|j-Fe7CLp;3b4O?8k-rP2NmIq2>24r73=rkOH`aOHgPj+jjzS zC3C!Kw=ATMLp<@qS;x6ZA-plvu_^qnUxU(SgDcG&Y-|@kAKxLJ292UhJ8rjg21da6 z0{OW#=>O%}wHs{mxqo5U$h1jof$Q z7s)B@l2g1ox<@?TA~qks;uHN9ummlfmtoFpqZJp3GpHM?ab9(kd?_4ymlU?zg2C;D9AE*&Nf<7uc3#Z(?IJcUS~cTcf|9Jd5V~Pm%ox3h+BHo zY{QR{ve)-y<;HT?ur;x0820|A5=`+-41aux#rxDqr2!pp z=tjvtmq}++leYYp*?)>gm3_}9_<2=DC-KbGqktS*ZRJOIXBC6*FlP@=5qp(=L!81c zeB6hpD0Qdk6+O>xIK+g7WycyK*~#hNW(EId}UvC3KPlJ$o)sM3kbUP{hw9@#ok59hHoK;;g-EQ^9gMlQec)G?{LsqP`5i^l;&5|b!afwkPx%d2C^7N7GB%y^>7ZvF3%7Y{oGPe@6H z39V4=#v#Y6(*1z=c9^tf^Sn+tdo<&QQ>p3a$zPqr543sri(}l2J^#Z=Ap-gKxnkI*kpxnaiNs}a!Fn~b~}#7Ph~&8F-#Y({d_yfRD7vJMBvcp zykq@^n?e4_HXB6d65FwPFHRWk`)TLA&N-63(*|4XW^GLGq~Nlw>!hvM5qR*61M0q0 zw~K4U#}Nd_6kpcbq&7@6!c>s+1b5w=moE~2S9Qr**j6lbOA$Gl+Kqbbb@++--S^Yf zB7^1;w1r25eIFoK)GGF? zz6jo4du}Tq5_0ot+Q+T}-%`CT@Kv+V=ems{!`A4U)RBhY1fj?5$<1gn4Tq!ligj4i z@AR(1C9s#ZU=_>wTvDjtHJ0Bi%^4maU8%T9NeQ2|Mbfycx`j1uW;VeTUWk~B)I&F! z0m-FQFNI%2Qc-);uJI9|iE#}JXzW+|B$C^HX{zjvtcXK)r;FgEeV z-kpD+BWzenmJ}MhdbT}8!siHu&M|%W+}S31r-}MlUhHCTwQ9m?+WF(4wS0=#=?IZ( z+UkV7Uig$0V`wS-9Re$Gt@&$gyzom>{fA1r6^qHU@*jjY%PBnXe_Xv>G_3|QQao$6 zZ=O7QBzV5s2TufmSfzJ|$&U~2b7nL^2}Uc4KajxS$4b~AfVA|>wv?GzY9CqwySbk_ zg*TT{L-0DLDkbAk{ezjfyNRdlXP0xihXn($8rrq~ff1ikn5|-=UZHK(%t&cd%wACg^ua}96#jVt)v^+Bzo ze|`3td;Ns7PiYC^_pT@+*^>b%;!;fbVzVh0?#h{$()Ne|Tb^1$AT>qSV=H!zHb@g{ zuUbDY7UAViFe*7~|9CGZnudgp59+aZbtl#PWHo|I3xzwGx!5dL|KaYzEMH@)m*-?aD|c3-&Aek)smtyyyH!!Lm_znqi|6!@~+b*u|q)-s$YZ( zT^nG>B~n7kS<7*n7o}f&7Y%!yCz`QDdzWhcRqQu{$U8tPLDjr3 z@X?p}Ep{b6r7T4uj)angg3O{-rY93;SLeNJ{fW&y-mYg0I%&`t9TJq&w8oOz3Z@?B z0i1Y`+=ovrlEf~OdFqA4Y&=H3%2sYyzUEH&^rLmxP*-?gV+~^>h9XI59<9D^{}SBM z6e#!QU9iy6*!kkw7trby|kY$~Lebibs#wJ79l_qre2BkBX!gHw(QgS8G{p3`*R}5-4GP*pHsQ-EOsZ(J5u@&QXbDX zku%~yB{*)&&J>UW;vxinGj_dbhP&4!PcF4`xJHw&+}_DI?eQ1x9|!!J-#5~84v%9= zc!U>m?Wws`5uoMharjXwHFVFiejRj$WX zYkPik>1yE6Kkv5kwg#a|Dg3Fj+Z&QO#E<`}rCw0Q#3a2`BI7;d7GHd6Kj8Nuk!#9L z3a`n0NEpcTK3=bOOlnehtR6Gs^*;NRiMbi}_WFU(HnITYW>3dj1kmnPvWXRKxIQE{ zZksL5dO6+91A3=}G8~{E#=E-@_t9qXUgS*(zV<9-$)yw@{05(2Q}>;rgX@;_@_>^b zL=-N1(Gy!Ux_xX;bG5iX?|Vt-*R52dgSd{Sdg^=+&=;tHbt$WA>N?zg6lPGqm_h&~ zoCrg2Bn3MC;mk3DttV?Vx~>IxzZVe=%<&KcErgovR48d?(Kg%2c|?`{-f`)`oc>{e z8t|D-CV90_3?D(pkg;=d{b@%Jv@FT1>(uE0YKy-~A$BMS2Xhe#r^Y*8f#Oj2sHg7Q z=dSI?(hWt7MyglG5bUSV_mv!>`=jw8(x+5DzP+0RA_<;rRf7)nJ|bHswu(d?DV4{_ zVL{+tbPaoPl|f^Dovm6a{{ z4<#EDGuCoN&YkDxS~j@urZ%5n2G=hGY0mR%rOAu@nCGON86|E6qgTXIee!zLC~245 zUa8|gK9eU@R`uSOp>Q*AP;hZX{d$P6;gja+s`={a%4f`kiQA5%ugJUDP} z5h!5eLXo?(9xYf9j;W?Aj)7p9^64`I*MQ^1kCuS3>ag7auN4Xq$k_G@)o+TcGYKP~ zV_U~Z+Igj_Ef>ciOK*wUB^ww#((uVYoV9VGmP>kmGxuZ@-xvS8O^<*(ncrC$NsS1v zW$-M*(6$|Ov2RzfdQ;YIeCVL>aiyA+y4O~lIq+KN5^YgWn(eY={s?B;KRH3{k*`LYi%?%{Op;kWI7$p6Z{1~-`(!S6sf;XY?| zdLyCq+Un`UrmKydT*IrS*iH90XFr8@ecyCq=vknME3U^oH1R;@+QH?m4{?Rx?Pgcn z@uro+QTM$bHjvMed+mrB7>c8RFsPO~j{5ktXu2ubocc0sQ=+>!tJmHrB=@>uiOxi@ znV(_%PUJ5o{J#4(hmVZyehxFval;O0KD=sPXj7v`vbl9)W54deK>^-;-AXZ!?>wB> zAy|K^#d=h7GiB++c!-bvnpS$khaEpKuKH-PuViP7XeqFf`-#UcynLl!$JBl(N#qM@!I(!OB}-k>-_H4%_-js#0@!$0a7GApZfLzpzS{-T|QBc`g!$oP75Dv{p+j`YK?3TRsV5T<7VEuRbeaI(C2~LW(TyV z&+Cgdi|HYxm`&aj#(acU0`T2vI`-f8OL4Hgy?y#+x5 zW<~V0m#0(INUe?w#gj49F!lfi%)5TOc$2yQn#p4%m_LaMn9L5`@WEc1s1nJk<-Ig9RA{?*Z+-&B)Et}mYQ1%)MFhUz5}vuj ztYT|h2siz`DJLJAXn0QH7r!rCen@;SL`m!Xc=sc_7EAM;H0bH}+-7!ty~lEn7NTkbDCObsq_N}A8DlPvV*G1751yKJ zv~o68u$;%J_*EY`orJI&2~FMmsZ8>a4IhL2kUAmK2X#qkj@fII7l~dx-*mA+HLVD= zJ;S$~+&laBTSa`i{-fSaoyB-Q@uQWwa4f?wGk$OjPPOdWJuo_J#iT8iAXBTs9K>tTDI!%J{O;E_Siemmptmj=x0dFsoB_Sh*@ zYLDGqX`_b)>nUEyIf2r6g6r?;AF68uQ4qgo#C%;brDm`CC;Mt$_c`=`8hTF4GkjvZ zI@%NLY-!>N82P5rzyK_(ra%|#5z`F8Ciw!9$l(zsUr(~{Uo5e)rpC;4aT0g5Yc_?9 z5k>Q`=EeP$?$_F!ls?P;(bI6^5^i7E{+`M74ewawX5>zPekE)-ybtc7uI9hEH_Zua z8euXUU)Ci0osv4!N=gpb7PtwzWH26v={?tAKDdwR*MS`{@AIPm%9iyr{k39jB~#WR zpPQ4{O)C{qv;|;xj*GWe7n4OQVE%e3GY!)hX9vj)w%sL1Q3mT&j+A6K2Vt)E0wyv& zm4%gRHAx?=k-_KF0cZhXHu?GXsD5A1GL}YfqyY159H1X7p3CYcD-#R=KaO#cWvcrY{OLXL& zXIJrneNxq7ya>_kM$et}!&=zQWzUVbik6qaO}6x*QAOkaFGOv{h>yod`h#i@M_%^x ztLEKTO@#_Rr?E(XC0PBzmfJggqJhiShNzDPms2rnLgRDgl~>+Q-*lgN*c6Z)%PbiM*N{%N&m@poJ)J0tCkRI6cmfU)qZ$*ZH^v1?G9_$1r?o{h|*uEY&Q8 z65tW2+_dG_&zf2n*#mwN51IrV9zOSNO{o-0^>ueZpiLi@FC<#dB4_M1~gqV!Y(DbM;?6j34`)m*}ui9{*=#ZZ%E!rD%Xpb7n;s+L*^X2n@R zDs;23RWB9J>0xmXaM}5B^5n~7`Rg1V9xa<*Srr}AZ5=m*#4?D>+qIEii%^QY03Bl& zp_bj{!X~~3o~)htR)gf-L`}?RcSxC&VJqw5cyMIg%yeO+;NzfXG31`%cIu8|RH&_< z!_%E{m)PdAk#>r=Bgvf9f=6R6Zu2YEuIm9iNW(}EYXPrr=>4@kAbK3 zXW$bK-Lr|%dHOZ2GUPL~pL%Y;2lY6!I&K7;?7LgL-f-<`U$lVZk3STesjTFS4Ge5} z!4ccL>b!QC6yXI;QjkELo?A#c2)*iiLSvPPJ!Rs#Ap=LbWs=d0H!)J7ok~rH%*;|s^29yX4BSJUYBkBk^+;!m7U3| zinDQZh+HM?1K|)bl4+}X9i@ceGk6|*Y=hJ-)|7!z%`7C=X?_z4Rvo-nV@sA${Gw)>vUtf&BjhW{EuNFW$H3>L)y#eP=y=9rBpqm>|Zs@0ZIw@KuJMfZzdilBaUeAzr}cvvSjf_YOsGwS{khBm`b( z#$jt+4g`Kl8cu#G2MY*dB8aH`T{DkSs=tz@503MyHl2)X1%~jK%LYMo|608NJ1wMF ztI2jgyPDBzdc-*p{et?}l2G%&Y=f)5DsJo2s+TiOz5~fBx zKjMZiF)cu!fvfmaBFJhlfsd~l`fAdozxT;OAt(-0j2mW3u`=&?qu0j7Q(PcL#qhAV zxG-P%XdmMmFTm<+g}yDv+1k5w?wzy!MOkc;Ga=e>L52(n!H2n}w~2f$M2- ze7LHh7Bu+o+~>$xIk1M+(yFH^Gd;xeKlEs1L)h_>5D^{QP+rY~bsJixo)Y}LP?s5} z%QD~P$K*+Pz7_IuQnV2=nxz*oc`$hEXnrdqA2^>&GtFec|?^meWtI zj|&(jBqc8?hFx71AWsNo-&Xyc2anJ?@4TI)B?jO^$?X}zlY=L{)xTz_;;DQ)Pk(%1 zsMqI+ZJcNqM}QwRn1>VJjuf`tnY|7TuzKoL7pRLw_@19yzOhK( z**v2nrzEHLU4t%XM_l6uSph7?hOoQ+qhDz$BMyo~WinUFcxZvB&ElDjQA zY`?kYQy`F)pzwo}9pu@AMfa}z-Bmh4BMyoSKcCa?I@bkafztIH-GvIU%NLHKDzil6 zfy)p)2J~_%hHtLP^Elvy3vBsSaFU<^OGmg00WJW}dMu}prLb2Ml!(c%tBbi%OJoS+ z)ci4RMhXi%kAufDdq_KPw|UonSwxlgBw}K)4D%ZIixt2mqGl)P(j;<&_9#|KZ~r%) zXmcQ80p9wtXTTvyMQIlH_4jkIu^pKh-+^?_AEHTqmSK3=@g=0r!%Y0C-#&rbFIx~Ac`VG|LvyIo6K^NkN}syudmPJoQ6i&tae@8$?B{wFtL^K z6&WpA2P;#CgUw}nN%_8w!Ets^$Qnm%s;yDmryA!vs10?zDRIH5O){ujVF?LSSE*E& zOTWucQjY?=SU-G_ny+5yuXnLx9-#6V@3e9FB@Q?>rW>ov>$q$-+0lM+t zgv3Opl;=r;&?#g7zutN{?&c~$AkY^sE{74EVbC{66Cf{q9p<0s zyNM)G`6=Nw)E$}I!>NfF8yy`RLjgZnuwCaJ6(~q92A&#QW&$w0ihF7|F=(Zuo|?cX z0fC5)%*@zvCxB1r7v-I;=h`m3e5evDXbAEDgeKjaadBPa1R4PF$dN$Mv;N1vUe8|= z;DGA@yl_?DnWo!Rd$xYYrKEZSZsMS&%`kM9?DV}iU4Q@YEysi<*nj__onLHF{&NrQ z0hLAipCbSvD^M)|mem5KM%Q$U%KD}z;m41ENWUOB*8_)0A`QP>&rKD!h7c2VC$sl;pL*2DOAo_cxMW^CD-1YU$6Yn=$&aO6{jtv0#ZQ0S^vx^uIY2Jd+o9YY?P^SqRs$FxD1_H~9< z!bWbKKjH23Dn{kYRK-qTNx69Fjia2J-u7>?d);7sZw?oW7h)8xTBF$V$OFUI5mw(r zOCyjY&8)-OG6v1@J8Xr*v$850Zq4YO1MuEr8i?_w}SnyjqR~p2NB!v-5LHwaNNO zMy0+afz~w?)bDi*kJcs{90y1`ImU4_9wIy*svF<>Xe^^Pa4~?F*)C0^i+={B60BPa z!*{E5t%DrUxLEA6u%YgS&(idmseo0Sr_ishZLilRJdd0>(MNnI`?@rk9@-p2v9rPsY(Tm~gwiry>C!*tKd3y(fVj=`y3|32Cue;qd>ft0c9)ev zy@1{)Jx2exFhJ`cLOAnZh`BA2SSMtgo&}f2Mp6+xBO3Y0qs%uj6kf`Oy56OVuUQSOT?hS*YSATo#Q+8AN zQ9>mnu`@LJYPW(~gqPk}{h*lZ)AFsp`#7!OqJR8h{FFb{lK8I*H;;-s`FBYN(B|)6>Yll|1BFLa6Gpwr&EMoZl%aHK4Vxl zQ#vA|)X9M9&$>B(Wq92=&PH6P0ZI`XpMfue8|M8%=ii?)9_Q^J1Msjrw_D?=Z8+7` z->iRgxIrnck~JJE-uNpA2rL(>6}_To`3ddIfm|Zk)qq`@hhe8XS8?XS7oz_GQeXeS z%6VsEO*#zgWsp=jX$mRVXb8J>7=9{C^1X$G_KJ|{fD^J?)H%eT3Qu1a163uwhgIn4VQ3X^8e` ziSB7>k)V0`SG0F#OJ?gq70VwEidb%i4w}k*&uer{WTvbgK+6$r=fDQbCn*2;?9C7F6Px(J86m0}-!lFLR-8{eerpAPlkIKIH8;5}nw_@mO~d9RY+J-hcy!N_@R znvz=C~S9Vl%@}0qC z?h3APUAu6qzgQr7*1qFy{j|YX#uexB(k27qDV@g#f1b;r4hoDrv+GbZn0ayD*x58X zey2C~rF3u8DETq3CgY!bXldt7{w+?(T<$1nSc(rl#=8DF`dycLMQq9r3GjCr`U6?v ze}?L-YoSz$MEafz|GyuY1T4~TCs_t3vrtOIHsu|Mm*k`+uXFvwV81{fFliNlJhJB=C@7`dau$na$HZVa<7Y zR#z9tqS*hY2%R3x;vY24{vU$v&vUp|&h;~^7VLjg%D;Ho{|W}-^`FHK^bYuEUkN-? zHE#uY8}9$@cEqVGD>nE`P*Bi+MkWxQ10+qGKvlf$e8ShS3z`2kqR9kA!`FE4J-<7^ zmHj2sm6N2QVm<`=yG zDP@=BZT~$Q%auX z3t%MjQ(wFORilH%y#-@@JyJ2z8PBsMcQ<1tAZ2w8un?l4c=z z%e?9TdMx8+i)~O)eCR;G!u2nZ=o)948uRz$&?R0i&heb)u?>Ms?lBkN&Svre*FTeN z)M!x-kb-i5hwZAUIEURS&9aF;er8`=p!`bkIpn?Lla~6A3t{BQ`J$!7N?EC zp%I-CGI9L~K730qY7E%J#xGMNBdVILWpYExP{yL zFiWEC?>bA)*uTFF{5R>|xpJw|DfF@E!4QxJA!JZv;&Qdvjp15H_Vo0le4TM$b_!~P z5!+DMX9r1mS12FmrurPb;Jg$5r;XBYZ~n5M1~PPn}+en2C?Ql5^J;99razI5A zqx*$SRm&a~*a$r*V|IQ#CvL4DET^Zx>Rrl_;#kg0$J2lE>E-+3I>Z-B5_vs#sbr~m zvrTDw%qZrhUCR(IWgWZnI9Kv)2?pV5aUIo$v3EuxFABj@P1;cTKEx@L?yUq5f>{h2 z?Ch47r%z&|_yC}2G$&)r@*89K2sjxRML9W|{G>D+*KLSGP+WB0&*^GsypTOOEY7#g zjL92*XL=^HaCmm-z@A7n;jVU`I(V$S z%a<_yJr=I5alT$rUMp6?d|J1SnVEj+zLT>$V$Q64$mv!|TA`XX)NNaFI(_lJ`iFW{ zqxJbwSsf1SkSmX~U%BhsxEV?OC(CK$Dfo88x@EWJ_JT;5J#6kz6BUIS+RZYDx?qkK|NbU0r?Lvwo`Ck>k6rgCgMVW_<;vHsao-3V{mYpu2w(=UUzsZ>0HnbwTE zjJ`xFE=`PjWQ$eR)YKTVvTG;a2ed=Rvht3`uV{MnWOXb0&>peaZ^mksRNvmws9g5! zF_1ThlnL(O-P4UuEpYdC zODy*8uzywWd5nM7=vxbe$YIpL-x*-Z{pTTs)=xwE=d

    u zPmiRC?2hq&wVx)wGfLx&cAre3-PXiasf+2fQrTv0-Zh;#lNV0;oz&c-0I?Gz?k~vo zqjjt^t3a(~t6zpF_!*$QtAfg47`MJh^*Evsf%zKfGs}xa-FCoK z&*PyOcbF-V#l6G!x#-dcK(Qu|o>}Z=V&mbW!}4?WjcHx#pTKDpk~fom4v2qJB^ocU zd|EFI02_sW9q@UePA(TppsZ4a;4Cqdk_L;KTBOwU9VHNrgo>lCzX z952yYnCOWapE`ldb1t<)dk!OY#VM=m6HLs-HqiI=U#EYw2s0 zs=50Y&8-?u1{LLR0rEktXJ-FBV}&GPoa1&~jo@OR90+-AhOI(g;xmt(BnYU8z>AogxeL9v{2s~0C9@8+h=af%FtUmbq36oQy8mjcIe=3Uqs)JkR zm**{PJSIDqsw5JRt72i5^+eL?olI?5f~I75w!*vNQqWZZ<9=p0JtgFGqfx@|nN`-7 z7gcOM*w2n3D`!r%G14Zc`h}-gAF)5n$(l!CvzWVY%8FY{g-uKnnZQa<%cF z9Jfa4f?gh0PYuXDR~z4QyuV>-c)l2boqNd35e6uyGzv3kx+|}w=hO^C4vZAvHAeI# z=mLa6^oWlzL(i=KLVthnRAHpNo12Zbz5TI^A#H38oxn?UQYwXy7@l-~`tK?pkw5H3~V8jPFoEV441n=6GTwQW`^HY)d-9G_| zBPH_l?y040rwfsr5^UU%5Q;nBZ3fAb4~jh{n};wSPoUpVmOn;N;EtBiynahyA1ykM z22|7(OmiT=v6unM21RbK8vAr)BN;-e$zu%dFe7_AfimK?x~cbwq7kh-em|`zS#P^} ztWkqq8>gUH0QLV`7Ny{d15moLi3;pRk=u{F$(5a*$Ir~L*H$GaTKA7@NUyKg;U{I- zu>%VAST^k<@Il}=5_chRW06ki;c0{BcTj{A0F`F@{PW9|fdh#R9b0mhdc8oc79j&p zC;8zvpJO>GcYLRihk~SoR1B0_w^XYz1PFYfF5B-KAc#g0+pLU}28qnC9q?ptClAFG z7gsINr;W(X{em+1b$fz9IXW`J8r2UiJEO4V7AEEGTCr*qMr3^zoF&ash5&x`?rEHO zBA!R`i;pZ0=xZqiToyk#J$31L3tClNkkGq_AsI09I~pC@)R|9X4Mvfgo8EJ99VYsN zFF)H+{9JDi>JV(u=(~Rqg>0~54UJp_^)B{9(ZSV*qRZDGe+(YtmvBF^#sM~c%!64v zmCehw3%*gpYz8pvvR;=mU3+Sw%1xz zxi?6G)#-2FrV7(_em4A!%3=p^20Ff%n3Nkq$p-=>)G(^qG!T~+qy z+atN1`JPRAdW5+P}k8Z^@Rh4z+6J&c5a|d+acN=iD66-FD zkNb)7p>5r2x&9yd@hyg93<@3+`}dfMCWM9HJqQwcd)!Hbf_69bM9%i=!!3<{+`mTE zDFM|@mbp(FtK*$+?4m1yAbkb|cDAt@CTi&><=+Dx>H<>^bU;yEdGkI|N*R ztH9C1sx8qcePEKPCCb3^*gn$~o3LKalA~`rF6O?e*E^~qICtHR;^7I@?Hmi(Zglh# z;|KMKTztbde|TjEJ@COC*GBYk7$1||+)&tmwE*VblcV=!Sc`^P&^L^&KvMCT!Vv8# z2mkMSM7Bfip(^-oMIIl+$)j%rHP#+posFGgM6I)|QZL$1dE&i9Q9&=hI{78HiOfiB zWz98RV~RhBNx7iQi3MG+bYPeV2$YTBx_isoWcYAAWmb!PgkJPA9Mt!z6a75Cl`Ph8 zm0*3$2dUY|cU?71vW$cd+Mg|ck6f?oBM$lc0UexG9W1Q0nqn45cbT&3P<`8S`;q5w zKJ49IlNfu23gh%VNx4;RTlb$?{dPAW9YG9HjCIp>&MCtyVs&=JGhktMX?MwxD1|3L(is~<2 zYrDQwEOxrT^nzu2H}43YaQ6$`W)yQnS0P{XBVPHmf`mBZ408 zEanWjDvDuY5Ihhd4yF*imMqqEoGANI%lh&T5qWELRFOicW-ebGc@fZNnz8hdSx)2g zbB9O1a1<6J_a!f%!M4|JXs;>l@3O_k-FxQH*yjeNK#l-k%pGXW2%DFoiWP~aw^$iVEZn>JYTaOZG_2( z@!X%XD^GfweCJVw%&)%CQ(f;_)92Bc7>g-HT|^zuonB=seZYULU{gLw3F+NQZ_j2} z{C;{T{r>=3S?lZ*)cOY)lNrhY=p_qB1^<^FnTx7*OVvV`K>0o3O-FfF$3XyO4#faU zWNSm>06+2OIWI@sj+SmV1;8y^m1qzUhPYtWrBlJ z&9oPEFgw#$nz|Lw1l9`b;BE3`?!0MPo9SQHu-;@4x*+zZ_^O&uT_L zAqj$Hh?|#Z$9hfe_j|Rx024dHl=rTV3L{&7wA^)bC)XUP=EO=~(y`9iWhuRf0oMMA zgj%PS_5Rz^_($4Fh)wl_vT2&`=Ln;l=8vslT3f+<4fsO+On9hLA?@gJdgHh&ojPN9)v{&lSfXWk((n00{IX@mNHRbf`HB;|V!oERdEX}0#|1nD zD(SMT35FECM&^Y38_sxh+&L~?>{dfhXBz5T?&$I5nOwbU%wIw#oV*_d3zdv|yxTid z^)tI;Dm`D3!Tiv#DDp+`k8X!sV&1pR_OzE1j`N7V?KsdzMy3mP$|kY)5e|G3dOIf3 z+37haPtq_iPmSO%7KJJ z+u*eCxW}@9239|N1BcN-oxP5+D@$SZh8~lRR%Xhu`m0UsNMGD!uk}}X(5%?z!wR>K zd80Vu%2%2Fh+ib}Xq#CL~+3#7X3vn=tCFxGX_DI)>uO@dqP(HaicW-kSR|bQO;DNECW_&xDjIv0f#Dc zh9)H~8}0BQN}9Qm0LT7mM(@hEyd)n$8*tGC(tNZYiQW5e6{h6mPk19k*tj3>VnF56 zR3f7i%()YLC;&7F#9x;FxrUEV1HzTlUdO6s3Q?dq$pE03cBC~lpaA#3mg$tLbx#jd zndY!vkUgN)Oy#v%c_*N(N1UMSq?k%SqgpB-%jn4JHe?CWH7w_CkD1dn@9q>eM15nI z(2@j$Pc4=#P4uC|vcuh0Arx_JGw_o#Gmkw`>eT{6yFyQFjz-xu~ zJC0KUPHR;E4_E&HT-W#gkHa@+V>GsHqiN9CR+Gkd+So>8+qN64v2ELC|0nOy?>qC% z)5&z^p4^@u?7jASVXb{bTJcbTnCxkttyN?0kd@LP^MB!;K7*Q=Zh<2w~jIVALtADlN5r+Zw3| z9|V08vy7d-JI7dVI8+_B-s?*4*ABb{h(B-cc0LAp;a@IpLF)$kSSMGfZ*z(xockFa z4rj{^0DH#8Lr73*xJ2bbfgux2|u8j@js~-nl4l*YWrDo{8Yq@o%uUXIz1BzXn9Z<3 zFDZo_Gl&3UXZq$Y?FX2OX<7X~A(siu{z(~FUopp#$Rh}RuSAo_k_^n5)=mtT;_EA$A8KP-vX)7n&lpDN1dSr8K*r%snf^U1ebrH@F%LA;c z02>wNy%~;xVRNwj!6{UoU6)u6(*JlOK$M^v|44C_ObY{+*3c4TOQMbv1kqX9woj=# zhU1U>4M7yk9**+bao+-F>qOI(SM8})NhjEw8XMJ)*zgh3#7kIX!Ov2E7Y&4hX_Sqg zBM!X(cnCg|rWQ!~L(6^NDZV23>r37nD>gO(r_)t6qvA`ZcT9}(YpmP@6#R#(#QniG zkC`|sD#k?rm!^?kQ-v$4uY$fuh@kE}{YVx;okH*&$RFUj!=#pvf$&i@J+&vKmX-xN zitJ3R3i8Ti=8ygzW;&-$!x#Znb)a9iFsNF?jUTIY#e4Ixh6xOC{@5E|_hbsLeyQtM znly-3K-P9#DVZq>gorNM;XTLTg{AqBsg69>89&r9!1kC6R@GQD6c?P7h}(|&A?7{F zwAa9cdW?L>jen6F)Cw2H5uyi6W}xdq20?{^X`Ga~2~w$*4l`+FpnyPg6fbpL0v)^e zl6hhV*BGja=-hS1x?QyDOx}{ zvR~GFw%q=kO!FZul?;D>co;VvUD$PUJZ$RVmM;1IKcR&@rtsK}f9$W}ym>96z(3tZ zK#9Tt{y~en9z(chQVOoAJErI- zw$QdqT>tNq-xNY|?yL8rxH4iZgq`gVUfO^qVI$^S+%5o+`}@Z?jsaG6{c*%{l#9Cn zU|65TLBER@IZxxikpp~ie2vzqTisgd^ESS05UoI7FH<|3xsFt;xcaLeI7kIgho4K{ zdgCgytpvP5 zpAkQl-|1{lt3~FjdLVf_NO0j*PN2)0F3tt1CtL2rmo$VmZjxMg5Mm_Q(5=4 z3+N8`Cih*(O$y`_E7Q;$km2T8*qYDB@C|50J$Ke4_{n`v>xD-waa-oji;h@Mfdc4D zygXor7v_AQR;035c60WRQ!65sBdyVDC4Zd7bvlQ9bOvMUi@O*pi0(q~@M)fY3`_du zoSr89;_3&FCX?KtfMfSP-oSS~40z%HXL5>~3k4eFd19g|5-AHMlO?rMR3$BE>XEW%ePu@>;0aY~NFKz#_RjK}|4F97rL3LToj?_?An!POg1 zAs%}rYAJRvkDt>$P?=nZjex-h4(6sv_AWmI$nb|-c|kja!NEa6KS^r6q(2BHw}YFg zA31=o?l1K%2-Np$mpf~s&s0_ihRcnw z_eV23DhvAlG*O`h$^c{0C;3&3G{(&7HkM(qLRdvBlQFM1J*Qe_Y(N8G_H^U8&2J}j z@~GB2JZ9dnljkn1>o*42nQ7=ujWIyV_he1c1hi<9qNG!Yhr6<3YQ(e*5^2ZntX)AjU*pJ588$VzxaAi*F#YN~?9bmk)ai^xwNL6L4&wQCG_c5JeoQX|Vw?dzYS z?gq~M3iOpFY4)N3eBYNp<>c*{2s`*h=fGVq=CY+j-Y{~nXDjk3QoR2XAQ`cAtB;Lj%eVgC zHX;N!(PyDggoACuEVBFwh~Lvj;?iw|XkObecjVeAGzZCF57NtpiBKhMYOJQPWge|- z)lx`Av-lqoI0k?hJE^ew3lc`HfD0YlK)?nNc3c0;a7pK=ui>3?#by$pONTZq6R#OS zx=+^?ZwRRsHI)t4W7M=4N*~nUp_c@ ziM?w6lm0oP4v~tLa6J1Q zzdS&OkG>ITQYJRIoZmv@q06Qx6T|H(q}nx0yf^tfWPbcM??EoJdQd?vEWN9RU2^?m zN0#w7ongxTyunJY8j^s=>TnuoN^%<^s^9aSM@(hjis(SfU1wxmrvLL1Idt7rQy+ zhx4_zhp(!NCaf#!we9)+Qo=fcQ~TA&+hD|M2K7AnoZ*zUhVrhXxPghlV2i@{2}Wiiw#{r(!V?4dHRPcGqCpRes6@{!Zu`^QqATJDk~-HPAMf)|eK~j?Qk#E^i$N{a}7vHUqA64Kj*}HiKJ1 zzJYDZwzMkr$=0m~a0n?}JEj@p98?t5Fkmx=5EL{M)xq@tUIoq&ThXY!@3~=m;MYTpFVdUpOX}D-=gG z4lE1SkL0RLu?@cpTe-=V8JZI6@k;tZ4{kFi3st%Qut(KNqV_U`NqRQ@5uHdA*H55x zOhPFdxWBtwtx)W(iY@7N% zWurssParIls)pHGAswo^T%TO5Tf}2lwypv}%pP4CN`tIY@iTAnAKLe_=z)m5ZWizLp7=Z zy)_vf77{#1J3C+ND=)H-=S!@leRQ=3Jy!VL-<=utT|VDr9_>*#bN%(7r{r+(-zSn1 zh3U_GX5)*?mu&n_(44D}ZHe*K=`$B28BE=fcr)aRW;g^0b47sVqt*GOb(kDHM}m33 z2I)ye;uGEgV#f=kTS*RMyNK#`F!M}t_uG>S@K9v2F|oWGwxt zg3cYw&jsSPX25W{T(sfLHM2ITDw~>*FXN!P(Aik@}$n8TBP~B zG5@jPYesOslLGwDhk2vf&({eqr(OcXHfA_l+OF0fDu}rRT2EoDLfc%pdFgJ4#=E+R zS$JQTm2|uihj|<5XwK|^;Rbnib}pH(?~9rJKvuFrH($bMnCGyUeK7)|l*xj%Z( z)s6!#YDMZ>qz(|U7Ha+|bQi~ra+&Mu>N+7h;2^qys;g3N|E9uTsGIcFu!3BqN*2hi zcd{UGL4=18r&d2xOz~Uq&l#HL9$o%*JEb@!fKaOD){x)#hCl5`R!UmZ8cZZe$=E>% z*R~ECBmQb%-`+Ni8#1cV_`~qm4T#W)9)ej*sq&JNTlL;t;lhU%@!p=VGrCWs+^uN! zDAvhJ0zOAKbGLt28~y z)>T6W^@a44pv9qC%7_64qpxyBM8c=n>4y!5C)`-!6dWARe}9tz&Q>Ej_qa_7@Vs_OI|(3vQ{f2xy#f>{cG5@5ez|43qq^N24N;ZyerlI5a$Lf$PZk%L2{EeuoMPSLT%mvInBsZOHSk7O(3l zZqL{MzhVpK2DWe8Xj?g^gX6k`@+!6e6P}R9mkH_SDsleuR`1@qR z+f08%0VE$0@zP1BZad@T>FLSdA(Z!P7cOoYL8&d*0;h1?-yO;=hqZj*V3L3P@Nh1?Ysi;5duB_9D1u z>QFS`w$2e8-?_1|vdT~@Z~pE2!ZO5$O+JyH#c%nA3s;=@R?lYrGP9DNiO;3_bkSFv z%M%0y+I~Yt+63)JD-xF0fZ*8YXE*EfHs5{6A$d8CbPQP<=k1NC;eoCiVomp=E8x~Mw7Y;`vBa`w zjuI53lthS-%_>d1kebr0v1~j)OinkP%7pDi6!sO&XCjwN%c?OkY)L$bY{oop3AFla zrhwLe4!v5KQFjLtB`$ZQL;`BQQKo?R&ugo-mZhB8 zi54RKoo%1@v&z!d<5%f^evr>vAaD-Sfw5m9dj$0tgt6csXEH#8JwU z26n(A6RE03sg^B3k{>$G0QB+~CNKS$q-j=@@^9Mg#>2bRjO#XX8I3GalT_jZ0{1(p z1UeP9HN5BbMWJN3-M{}RfNy!#C5Ahn*#}1vu4jvs;XZV=eqJ_aq-SJg9OrT;WKSTQ z({3cM^G%KAa3t~$I11%-m6epWx=z;sneiM4ktGg72+JA_+yZtS8bXh5yGPnM;~%Ve zKA!Fa%JvTomtdy>R&^xBpQ!tjLYF`u6q=4yvZ>^z&pDR~l#VXocy{|RSRrX0xs#vz z3eQ+A^VF5H%Gfy9M zlCpBj?u4(uVXfYZ5v{Xeo1HmVvIsH%AO1GGl9JgcfESLy0s;&0y!y~bcmK}|!1@_+ z%^KSmg+nR|e`M{JFmJHf>y1@8Q}(rlI_yOMwS#lQ={F7)rIeAQiJ1LWl!DIc_qjj% zGDn+ARPSfskI^V7rCQsMZL55WKOSMq>Is)^UVK@CnFv%Foh*ythWL5~MQ z!4sl#T)>g|3hdj*n|7&M=r?La=xBnte2NIw6=O!9$p*D#KGXw^fYK}dZD>_>tJZ>o zME!s^qVSYQWB{r=DE!L9k8Dm$0JDu%84VY&tsfSBx)z~SXN)So5qV%XJ#Ty}o3Kb=4DNx5CMlHjIlb}l&mlpH!r#oUWlrmK+1AcF~lG9K45DyV| zRI}0H?0h?JM-)AU3;I~|nv;I-?e zS4Hc$c@cD>lkM<&jZoovL&}kDHRmi^HHKV~(WCiE6VJ}iSB!go`uIkz(h7RtV{o)k z!Ns~~KyIVwtyg`;39eb17CX&E{*urnRFQA+BFY0GmzBSCqF z<+A;`F-uP;G`}gd)L^OZNFxs^GEr1IeDyvbZNr7-9^yty?cji-ZjNatw?GzQyC+Pq%~^t z>%T{R6JmK1Oq?DAskZ;}L|sO8b8~ZSO~~b(tvU_*#BV2urPB9KW_9uXhBX>WH~t72 zlWG)6z=u9J^#ircmK9)Wa0nxGqDPo%gJlBEN zrYORfuwPGof182#9{EW1BhNj78LpMmT~(esY(xP_)cYeQ-BRBVeqn>catmd!T!Dj&W30)JPI;PWL45RTwhT>B7F@Z4l4~u(p5r4C2?(SZF1J1xFSkaCTibF-9I^N-Mb;I6|t==_~1FJvkMCsi!F4nGwu<1 zC|y0Gl4{3()Gm;pst=^4vtji1ht=JpAfXf-b~P{va_(;!DNmfQjqE4v@9#anIp?m! z_s0w?D=AGIp=wK`ElXt!E8gvuopHa_5JhJ{-$86T-JXJr#cPbkue9jn!bU>5T0PrX zyGfb>G@b7fT?Agg`$1m&nl+N|q$>`4^3Ax!OLA!oWn8G$HoBXj{=c`!(mBhhtm5x_ zf-I~yZ#U8=GGP}HmYy!~TOb=x*DB^4D2x3Fi;WEfpr-sy(WCFJ-` z46ns)pNQ+RW0Y)_T$)gkkx65I8@zZ);tmH@87@8c3UE@+M>jwg}^&q@N4(g z%U0?1>U{2xmz&N43G%6FEom^{_eb33n+ufvGEuw&qr`J5wbL0S$nk|{0Pp6W&ZZ!> zXu$Q6D?;Ft^T>e&2O)lD{(gI?2m+rXv!?is>vqh3WFmKn0W9;th5W)=vI7QGmMJ!4 zBwjznrbElO9V`*#{KiJci#KFPu6FF-*#H$&F8Sh|m5^=o;7TQ@0jBWwJoeH*!PoKq zH<^>yp!$h&K=EXHIzCqT9L>U&RwQmqz(fv!!}^n`>nX9Sw%6Ry)3wZ=48B&bq^$GpC&7?q)LA@Bg%4Q8NdsvqdlK%9mOsY#VJ3O4D^T&VB zJ}^1LRU$X5a2A?ZJ$b2dORL%IOkJr_IIYc(%Cy6JqQYvw6SrUg-JR&W3^Db?^qxyP zp-|!kVtRXyC3OxLT5u^LGLryiA>+`gwJ=H{ zKx~)wOeYt~dS;m1a`-i}>g{~EhodAgD1H~#A-M5q51>~#9-<#DPmQ1MYdv&_IqMWD z3PE=H7QbZdb0*B0x!ISi{~aLtcf%2@<;3!H&nz4K4xh(>soZx}$Er-RtijaeU@Rb~ z`(D>Mpc$LQvVL4qTPzk?HqGcS604|#UYiXZS4-AbGh-%l`E2y%%7HLWDz#Oh*&%X5 zS2MXSfAagPF$c|4clgf;T6?dpw-zsx!X+((DM>;Me+fP(rKeQZ4bSjXiWT+v&tp(X zair8|(JnX%(-eW{#4DZ=XKrueb&@w-2m($a0U{>uN(0q5iTx@UY)seb3tmAs3`mu=WHSdxy9>bJN! z^gX(t475wBtU>_T-q}KEy7-`)f&qdE&dT)4vtTx4u=sZ+bqN@s!Bb^e+5djMeuhx6 zG94%^dj(%I-3O~Km8;eVZioA+Q2~a+dIm28^ixWej#qBcaRFlicBT=(vh}(5jEFJb zMkWeOK{=T=(I~-w--@2s@$McttYRg-114-N7sZjCPQd$1-2M{^+sCB{t^TlTcPk`j z^Zk@fsZVfP?0jex0f|{?YuQ}0f{kPgoXi4%(5(ttm291pIDAxX+1owHO}78+atzg5 zQ9!4^X#G#VH0{#q)f7g^X>^p;hw-#@6YJMVq3`0~Yt4R~%bKoz@-n}QHO|x6GXEMz z|0w5&#}A9cC4}=tQ_kT0n#uE$8PnV!=)RNRh!>fDQ9db45Z}^Ma@iopWb24Lpj~=H zlT*)CZLDU=0~;r7IHf=qP?wrYO+G(AXJma&zVa5xSiGw3>O)=r!YjZuYpigv01DYK zV=*`KfCq5{WR;cPI6{`RHv6$55%FlF)~ys=(vy>d2Ou*Fq!S`M!p~`mJ1ZF`_`!5p zBSyv*Si9xn`6v`v>8|u9$CHLDGN9Y@0QB74=X#msKNDHiV;1v&`*p&$FDYpKNf@Ag zCM+DLK4DKEoq`N!WW{B(6|D%!9m;%jRVvgRg!rIlthiVDxbK-uZ(fyXaul) zbj#|3LXMJopg8N)NVXiQ!+MjbKNUtsAaQ7siO&c1@C%iM@Mz|+;T=?iJ&yWj>n-P~ zTDwBjj7V3AC&X`D=C_~)jvJ0)fxojl%OQY`AybiwBO>Pq&2tekuY+IxATos>j8?Db zj}tbdGd4CJB{ruVf~7!l!_2ZX8 znwWTGke<9hQ~b82Oo13w8={u^&s|yx@-QgS^2+z*g;K5;us%x%qntRNY5cW;)5sO4 zu-`~HHDT%1i8vl5>{y^b72lR+CIbY7qBI!cSu$Oik$&We&-A%Tl`Hi_T&DD_je3H` zRCg0t2whkV9`*i!j>hN20HMd@iS@#I;wO#t2kb8TZ`jT@hUjUeE% zlsI)qE?_`KV|#%i5W@Ki{Z&J?ZINziY7_ZBoX3lh&LII-V2XJ})u>@l3&ZGvLSC5+y3)`~X?{3A*?B z?gWUW*bO6Y0(wFqyC+nsH9Ik#%?|hifyx0h<<5-_C%2tgFjHdv9J#;4#pNtV*1Vws z;D4~%hhT^`87$8x=AiADZn>K{{&|=u^=HrEjH;#875)m}GPa4J+itw3%i$@@bz(iU zuRoW35YRt-ydn+DHA{UrZS%+hZ4U~L7f#iF_%d^bSH@jS(aMoYZoi00sf= zv^2L8(6UQCQ*83L3+$#)?&!ZEMX6N)STv23Y&ON-QSr`ynG;sZWJFLHb5OP?Bz~i* zQnkGXJB^QicQ_n7@!QoW0XJ++yVtt5aW~o=uhxS)G_54cuI}LdqxXb4 z@rn2GiQEa&*UZp0O_&%(%dc2LWVWQL%9Xo}EKD9)`XFO2Q_R>2%>4y&_UzEnDLOr$ z`Wf5Yw1Mw1F$(^T&`)M*-_hH4OI`o>fIgbcEy5=f0>5|jq*%#3zU8p!LqwPa1FN6n z@~f8$La>>D5x0Vlp)aB2pn62g0j022Y@e$~SyAyo^w82XX#9G0eiK_^$xn#wUqV2xGzo6ONpluJ5XlW^#YMB8j$Boo7V! z-V5um0e$Dv(2-rwudqN39>E@Qj_SaULHG{LYPQD%DD@Y$5TcPH0LR$v*H?6O2xU*d3h za&QI*c}qrds+de6`4@7tQ^k-eju?U-!{>Mmc;g$7<^pZ>BWLg!g8e!Tuc^!1ja6{P(CB-va0gs zO6!wFOS1F_Ea=A^QgJIwYAksI62w>-ty}JTQUHu@mszuelH^7W`;8aDvMK+SNPIwu zrPuw?1!|xGiaxY^r{Q>)6e%3Q2!<`3#n-iix#}Yn9>4(rg5Yfz_ zFhkNWo%~Fu9&xYn3AaFHwV5%ze=FRWw!MF@PpxV$Tk#uSq7i)vH*&TvfIQ|e`!p~l zW?%O{#93i8sEGa7=Zis{rIzi4e_qbUYUg|xSVWKfGQW^;xWAX$t+Fna`#heeZhs}2 zpRTVw?ApM^n~Ee9I9`**b8n`aJbPzst!W0m&wmc*a~xn3Xv9#K2dXN{=8g*ozmhsI zU`cCgE&*y(?oWeCk*tc0_!Fmn$pU6v2jK2*!sS{92nCZqXwNaa;n(v&M@nuN<~MV8gi_A+(izH_P%U1N05(;<}I$O zn!(pf>NE3l(~*P|hwZ_tnzp79qxdg?m%$O&Yk~H96@*sLqnnl~Dd})aGcaqIRmH68 z#{gX+HC!a@UJl)0D3(GbED|L*Z~EZOM;QMy+D8STU@&gC+mXz9j&PU5y;w{NFzBr0H$7hTQ zIZsmaUEF1)?8QT0-gj$zR%=E4?UUw;5lgAh8j1^Q`P~oS6DO>hK7{`7i-vW@5R`2Z z4nwiqsX^*iT^Ek(ShiL4>y;Dq4TtB0cQcH6O0D^mp59+NC;mf2#S6CVY3#bF9$$!2 zU<1~_SX=Ar{^&9Cx#(zn%=-5V)8+ksll8w3t0rN4^&e}eI5H8Z&F>j9X%#eLgq`mG-Gd(gs)Dy8X00gYH0a@bcte-`-dwUW~CAYT}!MO5*5bHVPd|>V{tl zgNs;@$O;#t&`FyY4}7AK5X=SwshUoDPzKbA*+a;tQD7O5-w^ zZ#pLfb%%dq&nOr&hg3gX!$*I?Pco1w?=fThrd8)?IH3#CM_EK?Ov+8qSdxzH(`fz~ zZdiJ$c%jsY6bV$-o3BdaICA>S(Rh`%j8bK*HC!4%OL>Y_iB~i~t;Hi9hFsib?Spiv z;70FKRj>Kmh)@_ej7JqiS};IWBZjlo>KLtW3AhcK=82A=E=whva7&PZo3COKiX+Gb zTf8H;dLXlCy3|U`M6pV2?3;qYGH1IQ&7LyotR}VI!dTCE3AZHuq?-E4`n3~SXJMyy zfFyLGQvbq+4pwm!$Q|;4f*Apil)H z7)8`8fW@-fqa#G>dHVv{Z+sq#%hsvSc{w5 z!1`?KQyU_lAtcBbQY!Fv_>N*(XrMTOrWI3WpG-d79mWcK%f89+;AN6zmR7bSs6!1{ zD~XVxd;EqL$$HBkEa3Q$*G&8x5nCF-_4|EdihcYpxgk&x1P5sM1Agv%hy%A8 zAg{C*lBJYJoC+_{&@wa}ywA22E@iE`cCV1`{|_ot{XwK3MyGg4KW{~{$)tRs@oWUn z0bmML6;+-P$g@bmrt$IWlmmD6-#xB@=zKT9^mIA5r&)r4MfJvdRg_Ce`lXCXcOL7V zf%prQpZ$f+@**9%nQDT+Ik1E0Q`NpG1=a(QAj@cOPUT75)iXEg4M!95Q_w1qrYsX9 zAi!a1lQvQAgTk@N^Cq4^(Vl05o+J88v!%CX-aE0+%4#r6LaIZ-K(0z2HGZx`y# z+DJf0{;qP{FZBKptbND1vb4P1ni<2t$%+Hu-|6~N1$8nCHS?KzN4~}H)MzZM4g5~> zy~fk(;32BJf77g7E)$M-%PEY#!q>MGM*Lke3}<>}_rEzhY~QFazV$~s@+f&88Ki|{ z4Luo*D0$EjJ#l112-wjeK|Ow-!6T^64x};vD@3=P!^H~*%aKZ%&_q)sg_)IR{E&jk zskKZy$P8E(oNxj1GS9t_2)D;`ATk0WA{Ysm-QzMl=*t933IobMxR`BmAYOJy$NO6a z5z9`CP!@iI#_Hxd{RD&L$)g{nQwBVMl`$n}yq*^PL{bZZ_2ljOsPFzPS2pW$_Z?jg zB-Rh(COU%ke?AQIavw6q5Je5FJIgR5gP}aV;FJ=(dfgrt_KXWtrEh>n?x#Ynji2L% ztxmeveI7J+n!9HRkD*SU02Tc8rvTCih|^>+QKpz&q{jZ_`?_+o+7XMnLo^gBA46xv zS|UTa6})6o*9z8^LXk^qHP77mjE}@b?#b)s1Kh1po&@5Al}>+#C>v0I-8r|g6*bu=GsFPTiT`xD8yvJhn2%BkBA=WJwJ%Cak$1}907s3obT-Nc zDm_(Jy+l82mi-4X&Vo4EdjVwaXwTPpGg9g1?(&AU*Tc`ce%ppWSGNt7{P*^JA z#%}^G6%S%w6K6zR&|xKp?3i0jT)0>B0zaWAU#ad4XGJ`p`B3UBTH6YYOF6S34~2l^ zPGxRb7=vshDs_j5?Tuaq^YwXcrk@WaChS0a!+Yd9#TWSuUTgZ*!HB#BB>3+S>Yri^>rBTEy`n{! zM2lv`=;QD{>_6u52)k&o?TM&lK?smLlfDBvpu#~R$-5JnO`r?~$OqWZEMf2&u|cnd z@^Q;Tpfh_hAv*S4)Ck8}Uu*f)=s!`5a zZ+GE<_@JkR(QvIgXPG+JE^XhkwsH2_*Y)4cY~BoeGmC`+Vj0?{JW8%eGyK@l&=I9H z;Eo)e>69^o*3Wn|eNj8qJXeU)po9bk56uJJwmFq|e})$0kr+nUrHxh=Uhp~@A_X%g zT9lKZ-FZ2$5bKyYegZWnn`araC9i@OX`pxBhT9P9M|yP1>_0{KXU`R@v}TvtJ)#9_ z+16NLfcwl?-GJ-VBr6s`ODk)emudBFUH3caD$f8z3JAhaiyZ?0+}`!?Jyfy&g6lGS z>)Fx-;K=}92x0=K-RhhvDVR@v+u$1aO3+8+Xu9tk{zWLTo(cKpo%z)8U6Kbayc?1C z4AXI|IixMLgg#ZwgD8dR|7Vc^O%lKzV-6)mOpYkx=;YY`l1asHn>c9vilGK+dRX5hz7sC^7#sava(y=yqoulgztH_ z#nY=9171jf2G0(TQatrB3MSyW={wbAOZJ`Hvf6;}KA-Hw!Vn)Uzb92Xo(4*UOeFWT z*wE3W+eWogjKnl=_FT_rvM)Wb+NTVGl3>(rBW;5Ksm^qmF8xH381peC6I4Jai7mu> z0m0Tehh3)Dy~k3Z1+EW&`w~5u9bbs`405TJ8(~+>5oKio0pu!f9o6P-JI{J@U#A_ceq=LIm!NkwsN)gVL$aRlPb0Pci*<|aD*Sh6`y z`01bD%RdVRd_cXgl*U%B;F|@Q$qictp@#c_>3D}x=Sl_t0|;(s4*zupKMjb)ii_P~ z4lbLtmH~m>*H@b*sDT1#gPLthh9SDVeIwfu3~=G>Lk4wo_WXWuua|p@xa|*YYFHB_ zqgA_xL@c;cYv^>C601 z7h=f{JCb>=K&6Fktj(kJ{FW+^$sU$yi zVYew0qLzD16N?X7)!?6bo&IW{Y!F9H%56(@Gd%)!!HJ9iA~XCYa9z-0RBJ zc}Am{Jk>s?H&S+Xw%xFiy{kvbuQAqh9XcvKgZe|DyvPWTcJw+QZF`OEzj>&xthfhw z;bHi*5W%~fXXBrcgH5XdE{XVy1QH&u7#!fJ(h~Rc>)Uo=1ssOHm*16?acifMxm;!} zVEm@?GIyiF0M;d31}5)^=E`QsuHmD_=?bQl?hjSsNxd{lvben#F!JKLEt-`7!XAnn z6tLv4J=|TX5_#j|dms?AC<1-m&h#?=;Q%qbo%2Cg+z+5Vh{MF}Pt2cpdL@#t{GM(I zqXy^B7Ognb7)1EGh&Tj9iBWn!3+Z8Cx*k?#z3;V*s2{btMteTZ0noDYpUV#2opwZQ zd2Q-;c}u^h0RTO*W3>4G7k611z4R@e)v^RG;Olh_KAtNOP>X=6!_0I084mYwq}Jm+ z-3+rI3a}U;+#pIs6E-k&P-uHLQR`r$zRQqS+jf`R|wR1iI(qBpp_RN zJCO9h%R(z<(yz(toK*1u|0WYJ^J2W+doYX;_um=-T+HPj&WmOe9!N}aL~l4`z83O7 zz~2n7+vz2sm;))IoV$mV!9ufsTn<#IJ~sf{Wng2v4$9&EXB*IE^!blzB6f-Z7C%Sz z%5;GXUe_lnyD<{znxEUdl5wpi_oC|6H|SrfBqukWCO7CMcdiCREsgy&=%aq}lQXeX zQBeV#hyV&UCGAoUNbjfkFd`B@|E`Po0!toj0JVLured|l*^Tm^vLPCzil2{Ea+mfW zv-h->2QTH7ak-X^$W9M0;4sQ4W82hLgU#XyVyAYy+4d^j$Cpw1Mw2t+Q`(Qdsm|Dl z-f}Jdfdosa{yvz1q~F*+Svl4Nd?a4kwcy{a(&9*ZBEmlEG!I4B_t)rU$%QU5Bv+RO5lIDceq1Yni-smCK+Z$gNy=rywobk6Q4GW<-K&-9Gxrqc) zWCWOqKs>$o^nA76`B%Q8TzybhTgT{H4T%{})sY!Pj@|QV`A)jQ`G8Ts zMa8wkyo&+w^N5mm14CgTJOEfFF5Jl4k_q@+34|28BeK#m@x|c6CY>e^67$9EjYSat z%S3#EPZipoU_Slt6M$0Q$Vc)H-2Wm|b8_=)C)TO%J*%V;u@mK3A2_3%kk-@G;&O3B2CyzN?%7CJTV z2d|VL=&{9jlsJl_GumfvFAKe^iN@?j_P8#wfU-o5VlJgF(nY)MiLkN`To?%0`fXu`b}1Yj~ai2yi+Q zQ*z)r&XXIjzXbETgT`0uCEFZ&HnX|B(S%6MYYYq49;K!eHW*ypI;c6$0GM^%~$`6d0%~{OvQfI9M9~2 z|0lnpwqL?_dvy>`j>c8~h+X%v^XLy02)uvTSlMe@Q~ijVOOCJ>BF{vKqxItKEh!qk0cj<*Jby?{#W4J6*<$Bv^T#nO{N zsQfeVe#U0X|Me9tL)4MO;cF>6;2_!E-DRu^1}yp?uBiKRoY6r*$Bxiz~%&M zmYun> z(PTl6o5%{xBvN&@R?P-3eF1lSQsp;llXJf%TN|OxFdfW6$I?yL6xQ|npp@`+zTMlG zkp;ONG{`>>rGzRBLl^Wb9adt!N3->PC3Ll137&W^SZ`y4X%k>R!ZjUFX4){xAP!!<&O0pJ$I_&eV|L%)1$wg;SW}{KU z>Z{n&wuwrF_*+Bu4zMnzt)DO~I9~J7iCAzb&Y)3MDpY+cofB36r~Jz>151QS%Y)Y5^5_u@9Js~uZGOYc+9i?Z z)MJQ^+L_lyLPiAhWZk+MM4XcnF zddvdJ&Ow&4sJ*?2CG6Gzw!K=G1x#7(L4hSS-a=m6&v!)Qx-Awj_kRE%OQKLX5qQ14S6PC-AD3z(!%F2tjzoL3^1mJe@H(Z+!;bMA@)|(X zTj*GGcri=6@7@J=%TZo%tzesWXcMX!^m?x;di_=OqV`ssr+UHY_G-aPAnIU$se2LA zep?`bL8wDYobdQ%MhD;WT;}q6Rgf^>`XX^Yn<1dsr7>O1`#MfGdKRtA zTh(7YWq|N-ru*16(zpk`;@4>r=Qedx1cCe%^`fu;=Y5dLg-X_1>(4{?>Yq`Jx;;dK z)l>X`1#6brOmtNUJU@#npKr0#lq z_5UO5t)trdg0A6EtUwDzS}5A4I23m+5Zv9}-3dY4QYaKFrMML@?k=Il-Q8V-yM*`l z_q@-y-nG80`(JXCn{(!z*|TS#nR#&=;2aXWIVFxDpWk))YI_KZ_xY$a%$yRH&F|WU z0Ckew)L$%N=)2cOofgE4T;%T;33Z}4ApgF@qGa=&n)T-g8$5tLo4?JZY)fZ-zb+N& z08Pq5AW(+!2mPIVnu*?V~;7Ur=Q)nd8i*`M9U zZ2fd&t_eREFA0aHe1)nN&L*l*MIT4#)Q_AP2ZN%ymUq6oqZMhZntmy2O;E%cQwi^= zD01^av?PsYs}kig_f$eZFhO6#u+`~Ozdeo2$`!N{a+cB$Vq+6wC`Hs!N$ES4zh3~V z9`0U@LqD!o8I1<~l3A-*EfJ{}OL-8x>8&l>D&yMHMs535&}*J@*XKrRtgB^&`7HUO zFCOm|?Fk0Tv2S6txmwVPsYR%EM*bQkR?bJZ|x& zcFB)?KNkwZ1cXR|&BBV!IA+M|`FsjWI^^V3J=?C8e>a6U5+@ZMl=^V6SVhuAzh6^R z)zOUPRXUtzzTL?=x+M-zplmPsQ)Q$JU!A2kebl=f9c0}ISPk)SSDGJtj&((Rl_6?V zf||$jlB=xC7yqB$09e=`LTP~@4%kq4<}UVkzO?>&mO;TJ4Bcb|@XC}$* z!(ct+f0_qj8O;l{n+Nb!TlpS0ba?#=aV*UIRNuw8|v)irS(4NiXBOyTvbTrV)`nBhkR)pdHnL6KdDCgDg*7KYY`9i z*9RdJy5{4#`%fU2Bjml%^OZcuq6=D3y4hq_`MLb1a{Pl4KF-QiX31m#sM`1OPZ21D z)!);|Mr`hnY`+$b@J^J{D~ci%HrVD7+A42nQn3LM=E~`(>;!->>7IU3JG)9C;Mnko zXO(3+@YRRMBzs~cb%!TEy(yw!Jw>qJxb-LDr6|kp_TK~}L;s#tOaQLrLA7{Np7m1J z_>3R6INL&-liRR-?N@YGRY1R-Yi^|GE zt=8m}9#pTpk0Y=r;{Tg8kvW_ z0jv-EPyQb==hH?o!P63pj?mT9pEm>ER|)aAQJWk0Kw1M3#b#BgsRCpukplG#y^j>* zRG^&{N8*>rGwB7;8*fInvQDuz$tR%SH+g+HBiiuNR#X#jwH$gCyM^YQPoP7-k_6C% zpZYGwh;g&G0bv>!a{#hFez4Ia=av?fIz*t9@`CVkc|elN0R7|MUcV9O06BnIA9`+l z##9@^vuL7!EXXv33UZ#Cp!E!EAk4#>v$J`ukUcXJG{f%y{>+@sS^V$kSsZI#0j%AW zgw*AqM~iU(N&P^PwhhzTY&JE(X5V7)YPZEFytu@j%yN0#2hNjB*=R|RYCL(H`sc4HpZ80o{kHvgqP*wc z-=h0|1Wgpc_dG8ePw!~loF*2YfQITrZ9N@~7T&DTI!)e!h6eRmLC;=2i}+0+a)yCY zx6Y$nn zA%o}>^f*r}G@}AHNgiY3lJ%n(zDvLQpYX;3dou8a^^DC@`P34%f38~{dtlw96?D3$ z{pj_lT0fJ+J336MdlEM5XW#Cr@9^>|y%RoBzNZ+*1gKWkOdvG|5PYbLV)@wJo;g&$ z?gsyJ$cf=wN+SJRN!O;d7ccv^&u;tzcy$5kkX*X{k6Nb(43OpHy_8TqE6KykLd_P* z2i5-Vq0uDVG3b#%(QwRsrtjFYa&m&e`R$})+90f?$9yDLS z69bqXNjsklG@wYqlT3+YZ}V3J8Ql?rlnHkLiOT#qNp9tL59y3bYZ9=d`ZPj*5O$W= z32N&d%m|#XRlmcFqIe2ga>t)nS~@mp!UCXB2Z)60bAhZr1%JkI$Qdc9qvLs2+t%?{ z)V7*_?ii~^DwP#$mxDJTm!=e39a3y%4rLH%8%k+cfwEguR`<%k;;yRBc*Zt*fjsv) zuXl!w_PMV_$IQx%*uy8Q^scmi#O}oDhf+kKsbdToh}E;3uDc~JKh^h=V&QlTqq8}u z$7x_{G!IWyz`Xiv}nsrc&CIs>e9zOy63j}+hY3D`k4YF#oKRc?Qel!5bSr2Z)D}rzco({Gp zHM_mW0}Tb_%ucu=QUwD9bly~S4{f1*xG0D{%!_r_Lfm11%;+MvK^hBOVu2vfO`w9I z9P8~uW-Jt70hCCdzw!Fa_o^+e@ZBNpcJ00dcf zU4e6D9f8%%ol#%`*nLyLbmML5o&b|_xO}u4{o9f8Eh`|-1WQi!pO977IG#o7f7MkQ zzdOxz;Q{{INsu=}Ld?DlK?MoEQ=1|u&eE9L^1zY8HxPi8)V!JQ76gpw1=gkVRBH?i z2z0m4`u=t?#`&GV&O-h(d1Id&lh6;O?Dne~pzGf@lx|< z>(99bMe=|DxIZ)dqQGyx$NI(;mfmc!sR4qvE`4{#xiMaU^t$@mofTX0+R9l1;t{Ci zeSaKzIxJ%4<2i=>#l$;-EXbxZQ3Q7Kw7y9R>Cz|bTioxj0mim53Xu6XUx_k{9P^)@ z0s;#Au>gt-J%|lhY}%rXl-cjP-v=kG=N z;h=b$G(`-;%YZvS3YLips}Odb*If?4I}|QdYOfinH*eaKI!Jr#T4D z%>;84yWtiEE!B~W5y0TQZM6K657uQ>xm`s8GjMLT%+%K-BxbeHIBqk(ugI}VM@VR$mF%aTmdS?$;fzEQr%Vr{VMzE ze7in2xt$z{P4PzSO%yt)d+t5@rBsZ9alry`+d)={mj==v`s4>+NZ9Mv+lwfUl$OTA z0#v~d|0XhYUeD;cf?xc(&D$4^(S?lNWcy13=2e`mu^Fk~;~GsslME>;zOB`0@+xDb z)%q{~rN-)aPrmO#fH{N!Xa(`kc8*m!gC97F-{OCD*!?xyqAvrnqP~^{k36#nJPao3J;|@cW>$vtxO5aDqI!nO0ur*Uyn<8AF42BWIoQn%P-3 z0?LDNMEUuTBPGj-HP^RhPouTt1IcT_zNu#2f`NMEQ%|`fY8T%8n`oInZM~!G;v*Ir z-z((9;CN|cp)O2dW9_8u@cv+Lj5x|jMEBaxZ}ou}t%_(ub$#|#q#fqOmpFZE3Vpxo zA?;Qc)2+tD%=Q9(Pi`pa1Do?hWl^A!|7}#ap?tO}=V#8hpD@3YZ9`jIz3Fa;A9p5N z83yTldHhWT!skxk;hG#|_2vNE{)i%Q=mX8*-_bvLYne{b*YmQ|w+A}Ay4n)2+5pV% zS&Md|_gpXSk41%m{XIx9gf6~MlQdFI+^Z$|KYXcbJ}duP;wvtS%gtO3{Glal9Vc(t z&#JIIQ*sShb3n#Npq2L12wIfMYLsxkL52g2$OZP0G=_1W+cvYAR zFp3aUS*inmWDyEv^bQH|@!7bomk1EdBbem+gHL`r>r> z`20#_770=5g*W=5j12P)CpSxVgoCded1dU(lK_gxOu0So7 z-zEJO&n0G)x2MRP6f*;nw1MR`$)H*_Bdzn>BBR*8p`(D(GZ?>?(#Gba^{>~kxP(37{gue7-Qx;9L#m<(?GcdBWAb$jJxTQEf)Z zR^>fZ>mKPL7-N21G`#E^MhgPXgmK=WA2|e0&xG#SMjh2o!cVU*N%Q8DJUSN7r9N|$ z+Wp>4Vg$QI$bH*P6zU9n`4u1Eb|cpurd9f1dG@XCJ5M^GhL)+RsaD}rlk>UjzFVOE zMq}gckRVjel8&lH9Uq@P)>l-}SO!wKXWz?k6iyiURk+OLr)z5KCgS>jdc2G$b?N+e zSCLj3>9-zcDBpctObhympVgr23-ol>^c?odT6KazP#ycsa--^*l@3x)nx(Y3hW#2u z`a3&gdOqCN@__FzIYwE7vHxX4O|s=cQgOVzEhm?k&5cLdTK9=G zJbwRZp`fH_zS1*=#If77+BNB-yFZ_pLPl9sPfx3$!SYSk$stmC(5OPAzOz|^02ro} z)<~DIe_(gNZX8GOr%-Z!A&82*XzQaqXyp&g zyWUxTp;FK?+NjLBv09fp^fd4`XFf-kU>55kO)$;J->ombzJ7A%54zOrx?j)X&*x0` z89~6E8k!7vls{^#YdP?!GIpvjXVKev(Gyhf{M`!=Alqqz7S?y4dHOnRNr9PBc(Ed= z;l87U#%3_%uuQzB#o29HxcB2xO>d)8MD)ZPioh9PFbMmtUiNtIa%-Jot+&w!0$zBT z4Z2N&H!VM}kY*9TOqE5si;F(I{uXFlH~h3vTh1)l`Wb}idn!49p2TmULrE9}nCr-3 zpwDNdR8VdvD4qZ?L1}4et10$9!!g^K7X4HmX4UgkxG}S-mkYnXOKD!-C2xvRH-{?l zW977IN_74FuC*(vCj-NIiVu?u{J_JJ9O@_BC;Yf^k%TNQ8O;;a&GcfvZBZj7Yi=0% zuu*?quFyf&)!Xw9lrc<1?T8Ye)3x-S$E6lQuiS8qi}M_E}0df>DV5gIX)He4f};Hn`7c`3apfoL$##u=KG%=2L19?x}p`0z8pe8uj)?X zE+{A{usbLJ$IO=^jGPKspJt@JURhs7p6qfCaEt=uO3-Sv8qV6Gx3Tu`w^18iDs*TC zO;ZE=NqL>b+QxC7q*G3@K%S);J#Kc&cReK~AZP}@xZQvJt=&(Wr)DBr_%UZ|EpADn zqP1VejtZ6=RdBxs5n;2D^E5XP&CiF2Cce?T^RLP+Jvc(tI9`+m@HjG_9XtGKs9T0< zXBSjVT%dqJ7#g`6re}NXJAXUZmL2h_Zn+jo#H`&PYDL~yRCB)!9sssg-|wtrdBpKI;sZ{i;#&Q@3IbuVtKoZ`E)O%%UTQG zWC5!kA?PJpqVtNdd=bXsdYtGaGZ8JG`RkL`*DPt4k8x~b z9*O^)g6;_C+P1ccNQJd3MCnlW*|)ztRw@oUYs1*58UD>fZqv;AXT_pSJ)-A1G>=|$ z-;MmejFE6hL-Yt1P0c=NEga}CAPpIK{QKKl1bI_stG*neSIch|JPF?6@0^@SjrE^j zol`_}jJ=Xl@$w51k9s;c{M~1xZ}SxB>Wi4K(=THDSYfFn4GHVnrlSO$-rfZ8R$zd< zKZfMHzZo^LGLSx=z63>T9EDWsUEi4hN)V7@Hi3 zLbRwJslmYf*OhH*Pm*qB8rHPafNQt}ek6Up+qzN1s>R@@iIKq&a!wZiXZXO}`-KRG z3RLJ6iEp1~Y>?mF-s9DILVm{jp00KN02cpX@=Ke7rU-_?!MUg?T*2AEXDcWR#Uj29 zY2QWvhy%{ykHi=g&kiM>?He0IF=}5szDXY#HfsUvCTbMY5sRtKk?8UX6)oB-GaL=gadm3Y~3lj>w+ZmSBgp2ZwhOv&R1}EV~fqPuZ_?=^EFXc{1^3 zZF&0fvSxvW`17TTHEjm_3;Y;b|HaSepNu<{iq+^i=cjijVY>XmkQ`+hGL!f{ozKA9 z=PQm^_G#z1l5l6h7ycgZ{vjZtcgtk=9FTt zMUV7Xb4$fv=-uiyqSqi`5Q2|ZNv-rMiARG*<8+dHl(VPEiFRD-TO!5 zi1Ab0xRAYB)9FU4Vw?oShDLVRYb&jILq_!rF5xym0$1+2D^hNayLILZgrzy$SQ!eP zq4o`KCM5DDw($+Q4Hk)}IdN z8&Y#w33#N3jARPH16#gccJFzVGqJckI2))!-%eZy(55{xcCqLijCSe#aZLl&M7#hI zkx|<}5&1#+?j_|n-x>gzCVImNzqoYVdYd6?-rm1|a4HclZ(#(zLT!1ghcs~}xyeyu zz{d&}k39pXf~OsAbeN-3PEIatr|K;D;{E$!ymk#jq;kgjS+ZB_X~s6wV*%VfU%hO& zS2!ud_#^Y}uNM%+;$RlMc|!EFNKT%(>&OsJ^3qoTaz#@#_#JE%pnkn9O`4+n{kjnM z9=WNQJJ$q&0BxqqGA)b17me?r+6EsURr06FjpI%OREhCpGBpcaQ$6bbhTxD*If&Xd z(<~O2@;!KU?wZ@f>3y<~<}y<(cgv&?;12b^Tk%_S!9l*Pm5+;>I?=L=LWq+1C0ybKL}_P9j%ZBB1=^2|j@HKDd~&BL>E7d0QLLXDq%ziU!G zy6X|RShq}~l)iOc3iJA;$bqFpPAI~}NVJ9H5BQ0#<9aQl``PJ&{^eApG{5_RSw&WM zyfh1LohJM74u*W@|Kd_j0?_x^*zqpysjpwqIPo^M;lgSzM$^_D5uHvQX76!)wiatx z2exk6trM9WE%$33bXjUC;AOyU4v4w-=AvTa&DWBU%nVlI8Gq|h6Y)W#0V|H84|d!L z(rnN56<$~_|3pNji9t%x$pTn47ZsfcjhipV^3>i(;(2c(SSKVWZ!7KmM;q=tNCLC+ zvJm)!!?hRigUNSC#GVabSr+ThE+XweXUr4rEp8Veq`8gyjUUSo&UqarJL7(c3W>(? zKR!k+?WoVV(tc3FHf*Xp@Th4m)-%3T%-z82&nMuvDD(GMPWlwu!zu1|6V7^hjgPO0 zwd{Kn-rP^s()Xq7t^BEqT$Ml(Tls!%rVqucLgd%SD_q2KhbhJ#EheNn<;d!(w{X+$Tx*@& zdQ`9?E!h7iy+pDuG=0Hs$GPd=_bWO@i-dL_kzy`L)oXlK6roGzbHxD8lI@3Xk%u3@ z0e|CdSkKuMgzvz>BFCb(*qXG3l7mr!56Es`rJSo4{e zb9Rtr6L@Jzk34r#&UiUh?^-5OHxu&C{CFohrA98UFiSjBqfp>3aC{JeWnHo4DISy@ zu1c;K=bO#|CgvLEE>u_;41%++t+BJoY2?VzY||zx|x) z&myc6_Ub)LgNA`y*!~eQeua(J%D`&~f9_Sd?NkQ~@0t7RSiZReel zh}3&M=YC7=>2BWUW~W;Z9B3cNH^?&+bP4uA8q}5zAN~{u8qot)Xf$TS;?BgGm&$s2 z5+#QW6KQ^|AIu|aw;u7+X@~?A^V)EN;m+IVr7lr`7dabcu|9wyzczPsLAOK zcv@1w{rwBEu&&{!ycr|=?1CfVrIYFx=#g(1IxASwR z`B2Pfvzb<5HPaJs#)m#|!TPAP=AoX3+~;51$QDAUM@EW zeyf4YHrJcY{Own7+ZJJ`g(D5}*29b?YH9FW<-BMod3$@M!`{?|Sc5<~>`eTL_36o7 z8~uhTOytlB2r1E2n??f=KEtZ^mmzrTjGfV~c-Iz})Mq5yJAacP5D)!%B?v}Io;98) zhlgiUOZ{|-{sRkpum1=`an#|K5@R6pRu%R5?5yXnF0 zX^Yf!IW|VeydsPYXd-MA zVS-+PUAmvDY!+62UI8mw9kq_H)ZW%WdiA7z z?^-Sby5w~@f8BF-J$T!C9aFkOQm*Faxf`GLSKT=EJ)gc_!7g~O(a2-(Axr%ZSHum6 zzWm*6O<~kZX;ul_=W&xEp()AyVK7*DchDW7HfN`RzKn^HwgS7w_q_jkEd%b`f1- zv5E9@AbnZ;W0->)u2#KgBJqIfjDU&kM~hjxI{#|3wITC{99xaQKZ_0FsfiEmLC9Kz z*FAJ2^OTgQu*{=aoMJMO-B&~_&6ATe2pnx$+~>VICnQx zacpkCK$-QdoK7I^aOG`5h4vm0)-Tpm|6LOApP5)Fo~*650UF8HN){pb*^F0br@45w z;kM(=i;MRyd9w(+C3(%h@r3?J-%n;QcYgEgOurpJggp7whCK;t^Ot17%@|tGJG?8e zx%di%*ti>MF9*E$8mz5!SKB`|oo!f(4Kw5T)5C)r%u&5CkrKhn zqhX7olxe8VYB)X2-W%_EldA`IJ5L$(q6U{ey}ZUFZTt;x+R?iHCi}qZQe-ojJSYi} zr-n^eJC%O~r$k7kA6Mvh9cUI??>o6Ae(!oapN&pu)p9A|K1D9#yI#Lp45Qq@4r#ns z&p$1yS zp(SSQ-Vb0~6cyjQ7i$zI2HoW;W_QyGG$^JY@H!UOHKk-sa|u4){sKmXHJtVJKU@2@ zDX-lHnJuR-&kSJr*}e)?x+l|o0?JFY%<7tL04&m|rPS!GxXq5@%s*faA8zv&p8@IL zaw>RHb4xa`Lytc>H3?j4@A;%#!hk{`-P7G)2QO=s9536bLtCr-x1D)fMDmbWGp`eL z1BG4~m9HI?>@lB|TJpE(=kQhLD}fs&_dXZZ{gpWC>P)$j9xK9Z_(|)l>~x>0>5p+s z3g`?+UySCwtnecSXZ2Q@OQgx;%r#-xQqto*II3izXN2^v2MSEN0Nr$x%zJes)7{s^ z3o1jaF=KPda4!xXdu^DO>x#tZmFBt%l$RoZt%rr48-{#s{LFLJc895ND>t3By^O`7 zJ5)#qPCkf06UYKUz)(+**{jb$fOfape%Ve~x@@yMW}+gR!ZYbP265))rNV=4q6UTd7-~@EZiBhC<)tDK?%Z8wnJr!@Z^>zff`__hy>q*M z62LG<-mDz5{EAYLb6_3j(-MJo<;Xe&Iwxcr|A~P!#6w-+mAe!BMGHT!N}g{kfx!~% zb@{ceakCJJdVLB)H*z4rQbD*F7PKr!HUA`(D3iDM?JSK_mrU65tyih0<>;`owqcHx=A$GoA zHgxZzKV2~WE_5zl|GKr~=Em8W%|=Am-DP)^H?JzOp2VQKpt`8#{NZKMGH+{q3l~g2 z$Xh-5Mw2$U`gC!lxFE|qYfuB!(B&{KBye&AAV ziy80MY7lOFSzqCMrCB@&l%3h>Aw!W4wGmQ1dbSl-wS0FL5Bf3^Ba=T)li%!ozjypU zq_hyES@(9J*gZ~Lu<1~zv2AqNc}^pi6KOP_7!*UsjcHMd2GoO<{3068P;dTx{GB#S zLQ3jUg7~Hz%+z%C5;0$*^$PS19{?o#i-_(jcQ@r!aGvF8#rm)?r##y_L&|-Zn^{E! zYK{W9WW3g(X>`QxEYEeS6#vY1o3i9Sq8=I0u8NS@-`OGW>-P&-s{rUo>PkXhJw1Gg z;~=M5H|A^%8DnE%H1#2lXzk>3Ob?K?f*qdtA5pN5oY@CnX?=l?+OK^o zUF|Wdz4~x{Qiqqftu;|Me$5ad*01g4XK(r4wlKA0`BqgHf~51U#QE0RvNRzHiJcL} z(`$8GkGJ%bmsSap?r?UW#P7bcu-Y&#ENoqrgbW?b;+y_Qf9$}8;wY*fd!C=n&n9pi zLI`Eu!+Q{7r7PFt&kMG#Q|~u|)CV$3!)@+~ctpX>htpP9pJT+b3uKjM%@?99fuJn` zUHHr;0Z5fp&Yiv>aaA~_!w>#~1}CYTE6tPMl@Ctk-&G_!9)*5G8(KVb1dej+=g^OF zh_+wAVxr&kOAy6B1PS?!v@}X_o(b!b;Q9-${UbRa#%=5(g0dhR0V?KhpZ&{^4IUk@`>eUsjE2!v!9Ee4l_oDm*~g?qb(aOL0*#ii`V|K z(HZXgcE_P~xoj(VX4@H?Bol-Dv3mP{Hi%9k7R%AFV^^FRYdXB z6jkWXxoDq!k;d>~I(PR_;9;~Kt(eDMl;Qq#=U2VDe0C5h8~7{$d4Mku$N5X?B=`#C zF3@5Wa4|o|IN8&mVIujz*~1$uT{sb_{FiRk6X>D0b?0gBK>O5u-J@6OG2(ofMU%l% ze@3SZZS)@n(yok`Pi#nE>nICi!?5gkyYf%$f{XwzJ}kpH>?!uEOh-8EK>XzLT}B47 zd-1JGU?5!4nfhL=c@h_FlP&Zf$Yl1qxwyEPz)rIzljK^ADEHS^R#q6)&ixp&Szr1H z@bU2-k552yv_tuDamUrUAdo`GaSC#Ba=x{@z<4|Lo*%(a((}WEfEQ|bd-N+=`S}nv z^8yVbvH|m@?Ulc)(zG(C6F#xTxhMbbLaXGlQ_WBlb`A70myq8(@S(vJdjGT;1Emb&Dv&yKTJ0B+lZJFD!dTB zy|@W1v=7}GZ{LM{!B+*9l7rA|V9GafXv3|%1 zphVWe8$SYkRs8}!weM&N8E}*1pe8t=~muR>hh8`deO(`dm{w{46m z1sJaYS8_76_J~Vr1fap^$g7^<6Hx{$m5Jup-+J9z7w`j_8el8`x8Ee3(v3O?II`mZ zB()T$B~}WX^F=ld9RjZqrmx1&-zW}sTV5Rqb`Wkd{DfgSfWf7F$^{yX7XG|0?C?0Q z_=cDB-bIHY@>G(FZ|ztY$ltS2P@nI;Ti1sU71{8bQPdEIWl`A(H?iO7@ii^qeB1c0_Hdz95$oc1TVbJ1kg@X)7{s?gAO+9 ztiB1FnBG3$O&9xp-dBu7*n`^#PuiYx_zO7SdKhWOaR_dIsc=;V(A0DoVTI8I?HciW z>a6}k`+s&o5+F(ZjgzA?QMVr0xu%4e%8N>xO*&K!9!rbmJT*&peSiGt*P8guVhjh z|H{W<70@j`eimTnu50;&p7rgpQ*F2y6#P*&v^NX*o0j|y3hQ92sKedMh!4L>aZ|^AW znYr#CGg*zfAE{oE8ifi!&LcAoGId5+g)6T|h2)&U66WS)F?9F^mbR7 zx~Y?iXrn_zL!J2H4u(Xa2rJQr=E>Pf%Y8ZYIIUTt zbT(F3or>l{epP6cz6E!$=$z3crT-a4(a_;e&=ReJcZPk4vqLIcu6=~s6 zmW6ag61faycw$9usw=(aj$@n)4dhi2a2qfhbUX2&wWHfhvY5{sD53`2-SW*y+67n! z0rc)K7DsCPe3cj(2n48^xgn%R-$vhUG1}_xA$YV9WBi~MaG?*kRS)t;Cg#~w_y^fY zZ4nod`Agfak0+0Y#O@M5S#3Nn&7_8yfIwvX=rkUfs^qs(VQsC zYhiK!cdU+KJ~UK_A9a(NI30a_y2aUZn3t!P5WnFV)9+n)yKCNGFS~t;)dPNn+cJZL z;N^+Rsx>D#LXV?Mko zm*NMR;80Q?k{Rnhnl0=BfP*+(K9MH7D^rz~x6UN}F@laSG`oFO<`2x=_|L`u8X_<4 z4Jd*KxTR@n5!w4kIq8VJUt`j9E}k2wyF+>@cq{A;Xlw zP|>Lpau;IGQB)}k|1=c(>c?mKO1xTU02k(d?q>W*Y?$!-vpp?0;|B$ICfPaLyXf&)0H`T8y^ou(f+!A zSgsRm3gF)@m!6=Hqvq>O`!EBR@#5dDxip$yYc%Km6zu>sGbnw0 zCKn23OnLTAC|6{RI;@7lLQa0^+c1|zeJ-c7qTSB28KydGv6a590=@s~wkmsLr(0u@P8-E@H@=Ud4-wZC{ucI(IHT>OzwjXEq)r4(57JTGxo>bV z&Y1A0s;xziz_y1zHCF-P-hTJMcm_ydVx$=b{xg?bvWvNRdtOouzvmgELEW2C_s6y! zYjhozqDqrCV;vl>M$4H}K>F8jD}6rr(xi*^BJxUKq!(K$)N4r2d0Hm+w4*Y>&^9iq zHyE-(AG+C;sJw6yq3|@jQk+qqV7t@ma=urxOy<=lNoXhqnf=n)PJs8Q_+hOhqZ$p3 zjQM8E{KN}<)og`SjoBroxDK*%=Q77P!A~MQm6Vi#5)nY+7{~^9{R_62#{fqPhTkI0 z*Sl_Dif3oZAt+;*pPyobYCEm&4i`?8_F5klppD~?^l&YpX6=us%!Cwi|3T?y7+_L* z56@#Mv?3Cn>c(NnciF2WsAeafy{cpNsh6Cte<~c+!che`ax})w2wXSZie=^eQaaKMETV&*``{Ii#rXztE81+1)GpL zO;|6dx`v{z{O8^5YKzQ|?O;1~3tF0|>Y5NP%Noc%+j?B{mul_tSANCpM5Q=U4nO4x zz%UkwBX$9wm!Xm%zAGUOs=^aWuK^!rpv#pTKpMvNZvu#azRtN$3pkG^4e+G^{XnXy z2;{3AZ9u04Br&%ThX5nV*d=q6>5K+cCv|r6p|BT2X}e8L zO+~(0@(~iGyXs&7H+p5i<=^j*lm{Q9`sIw*E*IO|7EISpaNF-!zYpqE0=s$or*^O3 z-d;y!nGXN)?vgtr`pnM|ms~vk%A&>V3hQv~R~M%x;tJLzU;a@sj#SN`oOj#Y4JaEy zOZe>7Q+{#XbfC{yu0mX^lhSQttFof5KOZZsyfcY8pz^+`wugpFyHLT78tgS84IBHk zzVF}gl=?J+N6a8TZ+D=UX1wkKe!Lg)N1jwmVo!-Wq5uENBDyMOTODeTfbalF#K);= zx^8|Gcb&X;*hkC*YN*QeBcfg)AO@%%XDDx7Z|noWLFSp=nG=WsM6+p?zvDkIWXNQm zHPb4Bi7R{I;}6_eP)W$N9sK2O~KgyV@RVKdM%wVvmoBF628ZMjbBjDn@hXD(gv;C?}mD>g5m8a+Wc#>~uwz_lOp<2FS(D-P(Hq-I>D zT!C6)VUn$3kZT&>sN*TMXqjzkENvq|8v;QlN$MZ_lc$U?o?_$RgxNff-s_5G#upHP znDhUC;UhgjO15RTcfnZ13?6I3U(M7~zscGIctSD5s@kfe@K8OcCA${SqU{J>x_J~} zXl`zA>zf)Bw_VvUx>A8)q~T4`A}*BUbx}DB5h&z~tz`!}XIOP!ZEarORDI~rQGiYZ zhMabJRD{PVweG7R{>=q$ya-P~bKR_Vm620vwn+hj6kxATz(fN=F~9hjNho0gZ+3!k z$MDi#<1MhtsX|DlOK>HoKR(z}MFF@0z`;VL@TMlg`DskJ4N2sf$&f&hG9=Qu!(%ZxesQ0;T+-f&xqN0_AiEJoI?rbc6pXlOjvDLGJ$!(RFsm6HY z`+h+F76WWv=bBDbNjSOv|EpCvmI0RRZHO9p%*IYYK%nqvVN}#m@|+&H@rv5$ZW^`? zH0|1KWvB)MbB$RntG%C=(qfT<{L#OZ8$srBHK%(I#umz8;;&Wy{%ThUpmB2=^e|^D z^?q}KALoYC!Ejn<6@lP3{rjcW+RxvQR>3~SC82@~3rY|>JJoK% z64Rrj>?=E^4Xfe5{56@%LW0Z6uPss9)FPH&&%yy*as;pQh4xWyz%K z!JSzsmvp*he0W#cia#+wzdxwxtW*0o^TV5&3iGe%tWQDlnueOaI0Xp8anoom7;ks0>k*h)H= zeIOJ3X&>tij=QR8W&j1j0o8DLCpZg$6TnP#!pr9W;ls@UkH-WMsO`@r}OCV zstZt<2wziMbLscE&iyUun7*)xk!+6(LiFmD)xI938sNGCo3C#aQGx)IMcyOmyLZZ4 z%YqG(;si|h<5!Ecr+sX=!K()hQkLBT%jfsOgop0sr~m-(mdsP%;C< zSMr%pKAGHIBBmIzKqe4I;F|%RRFe5VL`6zXjlkVyC&*B%o&xl&b7@gODF`J$HBtq@ z-%j!iYY2qozd`czYCV=gsXajj$#W=Xb}93NKqjTmXwR{*mM#vxfbRi+i;D8{@}kW; zt<3scr9**j;+r()uV4)3Nf92)Ur#ov@&|ka78aHjB@kvk{=9)Y-YL#&p@Xt9rhIRmT7S;V5LID8UfS!dpzN43*C*sf-FNeGo~j@=v!`gEQ3AyUJfKiAs^9+vx}0v%rYE5C z;zCBtKHtE%U;uvK#=qLiDFM?(#mq&i7(EXkxYLT;5GRRC`*)E?yj!>FapB8)}5Y+C};F)q$K>u(~m=ccx@>0xHd4ZoX%*(&*%nTIQ zi&|qn1A!=$(|~bZJG<$EHPA&7kyWVGd-@7=C+f-ygZ%9eLP%6@V20LYBWjERQ_hR{LYL^{OSAU5jobVD0F{GV?L!q$M!9qX~((XFktPX@n% zLgpg{29tmPYQ^{XdC^JnZRExsm|9m)|AnbwP+Lz35pef!VB;C6Ljo)x{M@X#q<>eM zF^*EiFOi>xmFb&qk6>KnYy+sBhVvn)W>joaGj5>0;9A_LGzUwfx1AMg74#&4f`H&1tVZ1QyR@o$vzLSG_%YzIgIYijTNb>w29 zSnm1KyruvUJQdRuBn-`VJT2K;Xoz&|6)J6+}+*X?ct0%GgA=g zSY~c+?u)pol2X*kfQGZzOx8=&@OaE2+!|9;6a2Zn#uP-!dqvN=yjy)l$=uO?-p#Ef z{F+REn)_DMfQ6Bn&voy5v~_%OeSMvVpjXF68V$r&tf2l|gONMB5LhzX8*VT)H8oSy z%-$OS9jLd=02faIHl@bZMWl3{m%K0KmHN+z4yJ>nl*9FH8aXtgokr&v_e99v^W$#u#g6(5-rqbK0Y-? z9o-A2bIMS2FcZQHuzBBI?>ye%_-r!n9v+Uk%DL_9F$gvmB=>x2Xbd9h$(a8_61Xik zbTXx8J;~byX4yS;{d+b#I-1~v3K=*64j`08QaO}aQUXMKrXjApNZD?Cw;^kqnEwJ{ z?E?l+{Nr`R<8{V;T>FUgRnDT!_G?G`Z4dvnXffryIsyLhTB%8+5Qi%4jx-30qj(V% zC`l2Okn&j06bu7Fdu-m>;o;#m7UV`>pPY;mN{Sq%$TC#U(_}@@QLDYY{p2kVMwj#y2(+NA#x-tyRpnT)COZ${v^zYSOD#pU8k3A2^Pe z)9qgZb7hnH9Sr5a>6EC=&;9G@h~@kww6ugxEhy0pSJIUo+zyPYoB7jGhK!__KU9jT zC@as8j-JqxkM~SoIJmlAA!C!CU7V0-?g$?GA!8rD6hKr_bl3o}eO%nq=YMFy!9I@y zOCnh@gM(VsOxTL=-v=Endo$UC#Q-j@>d(y&Z>1X$O*LW*fRCVuK$bD$BtoO$=m5%>wQfa(JoZ~_FciixSKO%uG; zjW4BlSLDv#TF1a!lPL+I1-D#r^J*rL>ExChxi~pls$YAVtfHivlP#20%vD|e@@4Az z3ftu1EKcyMiz+>qA4XO=DHJmEd=EpKs z3ajSgKuJzUg#BeIr@+VG&uYpruz+_CjM8(n=7>MMZ(TPBd_lR)$2~`cpQ973Fx6RE z@8-vTdt$Nv;VSCV0rNc94mZD_C;9DD6lgj5B0yCD#0m@YELN6Qu~MpF$1%J4 z?(gpts&;_iy?VHLcqo*K&tTf`NF$T*3xKmFsP2#qe~D6If@TX?M}Q1odErklMF>Ac^O|mw|p!s!GNFN4zTZVCDt+Eg&&Kc8qTSX*6+QY9vZ1 zXBB{ru9i~0Xx6@F@5mM;#Sg*(KE^u~cnBf}3R_J_kv6uFA-JzyZ|&fqbL|o>@M9e4 zow87TK!~7TaLA?L8%FE!9%~ya_N9API?ax zlJEO=zu{n%PG2WmfZ_qF7~3W?#`;pwIU61WtG%hgD<8ELndBI7malvXpSChI!J-yW z&Ii)}o|!!xO5tOOjPR~G4g}<`4cy>h2K9lweF~sZX2}0rWI+%P8ajLs_y27?NE6bD zg0?=K)SJ%5Frrr7P779wsjN=PL0r*h%81Yb2WsXWk6(}AN0B1g0w|9n6QNIab1%}CHdaEV|3jm4qyti<3t*7DJ6P36xcu% z_+JwnAV_VT#lLR@bZ#wRaMz@ImVlSAZ>S(VH= zxy**}R8(kXxIZTnvm+Ksz(C(|feiy5q+DLV@U64A_uJ*pbWs0`fL#dyt_pO;WAK!?4GGc;@2zF!2WJrE>t(-7Bw93Jtqx~? z!-Cr00ox`9&=J`o;7J2Doi*y`@2^?T3eJZs&|tKd+6QfFr8b?Pikfk_PRXX9}>&%+cA-AsO<)hBJN%L7)BPrF`Q&9&HF%+DjRRANN z)zJXNe;aW4|2HeVMp*pl#}=;19t<9DK=-7X?bT}-Ywb`e{)bVDeuM3c(3{E9^oz*r z6AXlqr9c}PIJ}jd^8V@YQcwV?d`irsfY~|0NIotmGBGwqu)laVHG#xj_}8gELG-`q zLGuL8Y|?ti`lesM>_Lp7#)t+%)-2j_$Q+!Sc%MV8 zocBt=D+1?qQxO+}Bp9N}6=d4s2^tFNH-N1J>a2@HksS?rUH4@fDK_$bPbN}5or`~QQ&az6&E8xCCj>SAry8fG z;_&;me@u!g{~a#MQPU(S9G!TbxBn6Et05kW7$p4GI&`~h2TXEzFR5RFBp^_C z8X+wuiX}bL(s+4k78FSp{Mu23HvXy^AkQcKCS{1k!@~oR%3dZP2;9}e`;z_-=f*Ic z%&7cNkoK`FCe+3Iq-u*4@=ns-N-D0ft|rUYEuy9(egY`KfCQoKAIK8}G@s}SN4J%k zwAl&9fYBh%6KJ&Pv&Sf)(ma2v6)`X{@R5X1_5q)p^1QG0C8PP-dR^t5*4$&fR-f=~ z<8LZn_8AXen)S=DpXB82+CH`Jch@H!Zo&|OUr5LqNGhs7-W&`j*9L9}XI9i}3NYB` zmh6GMxjeOx1_w_p0_Z;mD`iRS%xM#gK#~q2r9N!l4kzMhq=u(jMkg}J4N51ut9r^u zZT`ExNAN0yF_77f7X>z0t3)CXL`kc;a;V;atJyQ@PU0uVKF$=uW8t*fUfk~md5c4= z+<XV}$@%V> zV4_Nr<{WohG?+#oE++O*qIoIPm5HT{Rbm9Bp0M7+>|+A96O#jKrIEdjt}dYF^QR6? z0ad1vCYqr@i?g{E1^l+}AF>!fei&$QcA(JAx{0>*9}^K<@4c#8@znWG+0Z#PZO{6f z|3)^b9r$MMR5|tE9TNUe!EBB~y-o}8#jRpNT-D$}VN@?BX7Zsohk7kFEb*@~E|#Lk z*Nqx0P=nJ;=fQvRnF0kF*?Xr`Lt2**`VNOJ25fg=eog5i;DZ{8;Xo3E{~tbLS^e+s z=IlRwBxa3D@^2ny6tyZQT^wCvP`yoG)4I904#*wA@5_ZW6N^qJX3lJHZ_mJV%N+rI z3#enmVhVP4W%z4q+UpSz)Y11kkQ(sG_JSdZ(W1>p3u!S3g1*PJF z5*amD9ItXvu84xwH5o*xK5^QDbv_ysug>~JX?Qvg6trzUW3FN5 z|636BKldmH7*~{R-nh+dLs()6apS+6p3c>pQY45}!ri^I1!Fv64Q%PCE*c~OQ=lRx zCYmv_F4zTjPom~qK(@@YjWe@XUtvRafch^5m;ni>;ma^#hC*TA%@t75(e<{sw`)-W z$1{tbrK~P9KYOXZu7(*ABK-hxH*hM%CJLq>otM3ziWHCY5%!{P*IF<@rFm>0i0q`V z1=mnF4LbTo84=+L;PpbaOH>NAs^NZh{2wlWwoiUZkw98%B`6%3!UgiB*IKUdMI;g& zQBbK4s=Y~uhb$~?s3-uX2QYIDtLo#ayr3zg<-NWohAKCLC?51{Zo zF0D2R8o$AYQUd@2@O%^3zSRp8;v%MpQ~ zY$JpjXTE_1poRdXL(sXHeTp1*L5l?j)n}k89DqK$1pwO#>HIB1+m?@mU7f-QMuGz` zsD=pvK#NHJqGvW*J+Ge{o^sLxkjV#lN33uez@6o!f+dK}mEU6P$VmNspLhrR--5Az zj}i43UA+N4RaLMcNRV+YcqAbox2EJ7^gY7iHmB08m6Wd|aHKj1n{$j+@BPi1UMS~wK zo$w9#Ue?;k5LzvG2o+V1n2L_4h4KE&LiN5_F|ma|W!a<5rt*!)1H&+F+d2QQ{{Ylj zU73W%uP6GGbg|CzQI#N*tZjLL>OVmk4s8Z`pGSNQIIn_{aUd&S(sOHi?>!0?`d%kq z&A(L0DW(SF06|NJQm$ZFX#V8b{_66QA`{q?sB%~HWTjC+g{3fpZ-)~>f+x^^0ytl@ z3ok!8pQkScTr`SaLj>(a9R5uOsCv(j~Tt38uAH z)5Ag9!ASalNC>vx&T#xka0vH=2{75yg4!;hO7tn%gh8cn^p78)Ndy#1z!+}etfHb) z)mC{Gs+UTmJX?`HnlGEEIpe*o9;;59@U1P8BcT2j^b55T_Gz?XV5ti2e(QV1EYVRp zu@p%mgf}q0Pwtg`H&rwaKouqy7i~&@0HoI*>$O>*F}npU#x2;NZ{Ps>MrGHO zh6gq^H;=r;H`rfs@Mv)c@zQ+Fk6Viv1~jpWG~C+t>WE<#ZbDGZC|mgZd{8=Vg{Ftd zMu!ZVLC#k2Ws@x%!0ASC(gCzI5)vIZ*bK3ye0AyTr-!w7$u9nLrWxzc(nOCK{9s2z zL9fj-`Lu~F&5wv7T}lPK+zH*DY=T4&Npee{I44r+X9+;wLViu$VHobq{yjW& zX&r+xI0u;_R>ZDZOqasJI_VInnIbYT=Z!`(Z}aOzFa~!GjwDF(!XZ?oxGj*jO@jis zq)G)(K)!FebShzgGHLt|)!dJ2lr=>t<2)=YNIwo=4(af=>oCtpxvvatI@ZHn?YYm; zO0USKRx(o+$#i=vBC_-0R!IK1-uMZHoK;hu~b&T9~0#|96W4|_DdqYDbX(GV9~xQ<}v`gFNOKaiMD zXQo?~{Wt|zc+NN((-}k<-*TH#c@}WQ{4#v&1(s?q_4)JS-753;8c{gD04h@*3jpGQ ze-9bEMa_!V6tbUFL>A0ml`9evCn}k~GJJpV=26!Su+&{$J8~j2b1|#&ZNu>}ST`lb zY;p|SzfMS1B1wf+XtZ1L$%=))wYyvb#JVyUmNZdgT4_y8IzqRVOFcm&4%|Ma4-nR9 z%#4h`QbA@)x<8K(s0X`Diq>cIs`<)gRXq3%hfr}yOobZn`Fvkq zc(~lA0iZi|d_skO$qU*JZ^{7JsitI|y!?8!9e9MhN>y~QzTR{yuP_br@O;@a6w_R~ zM8rOR_`C8@X~8G@0e1eYE0Fwt4opQ~Ub>3MRGnuZempKO-M{Bi-ExQXF&idvd?}aA z`}?)gXs)2)Z_29G?ioqv7bA-Zp5JqY-V?iwAm9*nO@5z^io=?+H^`;SdRHhg|0+wC zFeTS5E_Wd7IfuyD7f}XFv$LXA$i5n~rO zn6@KMO#vv|^7-g34CN%@6;5nSaur+j+)b)PjkOt%o{yIN*>dteghU?Qc2vO+BO+*k zGQuj6`QxN-E+D$8RzT3Kly@weeW&Y)^=3R2lGmy z=mm8WKQ$%Gbgx%@c;X_E`$lq}d{V0T3 zDRg5L)v%-lP@l`mQ-MK+o7syLj>%33a6%}c1FKT7P`tEz4NSjI&yNIa*F$#ET40im z(aX^{|MlCMHtzm+39nGFA>)^#Y`&MxyKlRgiNx~vkv>n!^>WA~k=K5W%8!MG%-IPH zTLkXqzLhqh`f6ZLr+&e7L>xEgBnqSUcHbwcx2};ws;^`d#lnZ0(w^Pp-|G$YPOYEJ zN=cUW$GksHU_80WEaT4&H9eKbejb0{heVhF6}}J4 zNv%nf)GTkE!$y5WK#-Tb&k{cTQmS{*6g!DbKCZr1Z593U_fLYvrG!EF6=r4nkP_=P ztm_oKR8h4#SP>m_Qr3ssWs|W&piKGOUpe?i3UmZkD1=EE)y~t!%ZYP^uS+~H#I^NbS9 zFhMNDmC6x>VDh-UA8^W4Q=cvl?c-j#!brCf80bOU^n~%fWFPbuRH2PUfu0dz9}tly zXTd?QS6fQZZiV%AP<7M$XW33E!|@X<{4pJC6P=g6zzbpeS%zeZ4Z$_+N;_>W_k+5* z6c79oIx7_D?;TM9o28gwS%;FYwzjrSj-nHC{rsPy2~lStW4L}&sVS&G^~gA6QJT1$ zE%J9nDG8us41pG&R zB)CVyi@8XyU|}9zB+_o|JGH|{oX=S)sGlY`={YwgxRqL`KPoZs)IykhXy5Lc|1yMa zl8{2K1^g)i?Ci}^sd%3%Wi+kBNFqA&f0Q80zMd1l3YE;kfsjZ>^FQI`fq|1Ay6Dkr z)C{t$(e&WY&V*4{g3glB;TRi;LgY*}g;g4IWvC}#jxJ^1y$WW7@hn?Hv-ld@4 zBmdX0n@ew9e%t;m6-hZR`krml!)&WuLS+a^GLh89_dEL&2DKi!&2F%* z>eS+!Q1Abw>nSovJ$n4q0tFJEZ9A%RH|EySR*WufzL`ZHB7tm8Kd$?V?oF>#(bD(O zmG!K_NHSTzw10bvCYU);xXlFrt=%B?faPY7d%bM_I6a{FU8=ok&&w@g49(dHpZjGw zITuDhOm-yzXfwxmvqTi4I`fhUxa>>bRfc0ac4Ju-mu?pRP8m?)&R7rHfZxc|RSQFc z>h3afWmXwvYTmdLX2`^xJXa({5y|J|W0~(qt>934*ZWh1ahRpR$|)(v$O~dtAxe#x zSI5~j33ks2JN;&zk%^InRqD=CN(M>obKggawb(JIiEUc>N-S&WJngS|9!qL#@D; z4Q&JE;M0t=1i|jz6vXoxvsb(%JfQRIBWfZjEQ>(A%ZTX+! zQ}etK?RjRT47yX&!c+Mzz?grc5IvL%6{Fff;9r;|ayFLWY1^tGR7G(aAhjtE{V`Io zy&A9uvwd-E(Fg8N8Z~_TZPoM!>|2Qb3bP#Jro<1>+;J`z0WTT3?#Jku^vfjchu z8?LU@B#P*2nIaetWb)c|fc)%-Ad>xLjKO42O?Ya)OwyWC0q&?q5jHulrTk-A*igY- zuC_rfUYs(M-&t1oZ++Ak6r`=&|ybx>Y2gm(58T`T3QbVxyGy0F8 zL%pzW_OV5KKE2nZCHIrzs5Bc+;-G<_ppB1g6v^g0OyQ#|D8LAJ7hwM82WpL z3|spxtLgxA-J;(r&ViQ%UH>4EpFuC6cm4Qz%?om4&QJWHWpIc-X{`Te!8DLj3_=OQ z6zw6n9~TztY~ekf&Wa`mLRAy&*+n+2#XXb^v^dW1n|g%gVPVhJ#_!XaQFrDy)Rh5p zDCBFRPdS3I>kUQC{8?)?S{!T~EONida;*y9bARt$m9;Qp9%>!}(H;{KItquMtZi3K;Mq>#jl66pQCnknW)#Uo#n%o;W4 zOuF89#8eKQRT9?;tDacV412d1aZ$7sbopLp)}1W|J? z9@;Xps}he~r}%~FRO>_Mvs*)Ytz>N#CKcKwFV*wewTjh>J}?obj~t?T z`nMZaYYl244@SxMJPS!J@ZS|hCRdK_&i1rcHu3VLJnVHatIBsQ%{H3boaQmH zN&gIt|Bke#nkVerBayG|+tCnFjQb6xvk+FLl#LcEfAB{GZ^0@Wq-14zev`_N70~ff zB}&mX^F7TeK@Q1K#8fpT@_xhU3Y59G>lx`ZkHH%s4^t-tzMI7K!~cFgDu&m5bw)KXmnyB~&4EA~B2SFV~0JO+g{I zm((TfRqtCQGuXH*4m9pai{3I}`>(0uYG;u$NrcI*yXF%Ny@^nDfe{&RAoK5_^jrAP ztWXn-J$hi1p^*E9ep%i+h4IzMo2Ey2eB+|tJ9uNUW9NhTv*vPG8c*7S-$V3}fX8+r zzp&6$e{1vZ(=S8s_zzU`pI(nOa*V7BRk)60g;a}h8%y;fQ4t!ZcP}o%`zF)lv4z?v zNECSIDdx<08jHLi6M5es)tnr$&xJqx5&=G4ciW0HKSp~mD`Zl=Wi3U?e*L{CUx+B?yE}dV)s~gsZ24Uti$;J2Y(2^E92My;c+M*v6eqU5Q z{_G^)LLeetAVs{JbHrAFqrKM%y>T_~4@bg9#QyF4yO1I47Cph&F51N-;8U$Hzp``PFT{BDnWVLHaPt0&sX0*$$F7@n6 z=mwrau8B$wO;zG4wKP>tw({H4u9pxYCsfm54K8*EWL-+4~Buy>l>rVB;yvk}~nwi&9jlpLg z#_m5e?EkJSq^lScPl$rvG%=8{EjsVlboklMO7@Yvz97+ETs5ec(1}7+QB?iGt!c3}(iVix$x8}UrK=!`* zzcpHEFi_Lo`05~<$Ktp6gAISasJ$WS!2!Br-qaN_w4K(6A}*iB?|06`Rmplc>5n(* zilwqhiNU2h^@WS)D7T|6jvKoMoubR^J+wjfx}5RGeuvb2m&XDbW%CoiHzjBLajo&@ z9-F!HkK>&;(-H*UX}eR4x^@^Gf7V66RZV}hk{tfLz!^h3Jl+mt(eF3Ut7At?=Jz&i zID+h1EtVZui!kr)`E*ni49MK9teB;q+wt#iIyO@$6W_n|uBX6;+}uGMJrDkLe7;wr zJqPdjXvmGQ>WMdv^SZX)e@zL7K~~sy{pu;NDB*);OMA3yvqUK$`LXTP>A~$B*4F$hT-AZPM$eb}tYgJR#nHqx&il zh0YW1Z|A;{4(2S^r~sB8vu*y)|F8ejs? z`sMXaql;=90ANI-J0YdpXis2;(>5!{4QU6nJ zz3w8?vr;+am-@qz+)Z`iUJmCopl9)!5gPF7xTw*qy)f{p}vus;Ea?j-65{9?#GAZ0+7efiP)RkQ)-%m8!oYzFMhp&s>V66&uZY zx5%tSRo*|VIEw8lAce!WJdz_zlM|5pD}#4>8KIBX#RL<>e0zcA8LYp#Pt-S||)rVL|M zddz0n;7ay87OAC;>RQ8wwR9F>MI!a5&8PZi=9wv#@U%;;KOq>MYXmm!)8`HTj0?I( z>%i~jG-YUfjC-&_{}!*j_G>%l1$p{v2u`Od+^t^&L!{=CIfEK7|KP$ZQzudk5p^TC z1ksEN-T>5}oyI|Zq0QWDQBa%m4$ix<=c|>wpDtiT^p>_+^K&xDC_ICd%xsGLHenC$ z6Pu<@^ABMo>$^?IBs*HguPOYeta||}#A}n)_aH%g*x)fRHx_s7ukyXSWkp&AA;3wV z+83|cmXjl6DD92ag?zfH{^RPKGq-Meq(oj|t^+-TRr!Qd-*`;@6!#(}gO0_1Khysa zs=#T^kvxie5X>M`RRq)7Bm}KUzmU(Q!Z~@Dli6aP_%?UJ(2w%vGv98q?AOmJMS5@y zxRVD>o$efoDB~lw$$NPI3^)&}Z(k6`CTqb~QwPZB5ZQOjO>P^H^4PZw7!-}yd3u^G zBw$h$AlXx{oZWoM=YcQ$yZxC@A~WVhYQAyh;u<1{^s{<_#3&Z4ckL@?@Wdg#@ho7p z#0IcoZmE2>0@BK%@9@sMzva)ePE5qHz{=I)_t%_Yg^P2kU-R!kVnnH)XG#BjDS_;>ru7c;&D!rC`LuekHXfl* zP6$OOJMDdeGY7##Wv#0Yw|LJ>>z3CJj{$7g%9HIq`;2}2J|qpl$e=rH_Pi6f{nt%l zGb|U{^0;)fuZ>YaI2I;>U3urh<`2e*9k|?ziHrASpYhqCtIHg=A5)>^#5nL-56xJN z5JZV`z522yHF;u$f?^V^QdQMqadxeGZ|6i6T*oct86-m&b@6y`_4&VE=bvU6!{1Wi zb#m*$UW*Ei2s3(TtH#LSr3(j7bbiOOj$RG97D2oNlZ%K_MwmDY42}6^Elo5%8avm= zh-b0!q$ZTO=E%*SU3gf_K}ZvYFSsjFo`q}-OdjBQIlFaq zxAZB5n0(##cp{o%>Osb9Z~kV#a+p{y6#=M`?40|b*P`Sr5^a0W-}sXB99?{((y@~H zJ|Bzk85K#^f`6mq5Frl(3B}_>*O_nWg^|f!v#toBW zEZ;s@L?qfxZN@bisrQubRnt-OjQH^=e`i^RJAf;^{cVDX+-}L9#E70ZzKA8ML1B7^ zd|EQ{{rY2)1D&Tw%5@0*4(eHUAC}5gI1)BGab;vFxhp*O)>!3+ENpP={SF_ zYg%onYg}WiXZc-)B8nDADsiApzbaSgM5}gO`8oypQ=+kv~D>r2A7ie>!{a$1Xkb;#Gn4K*mMy!bauXNv3{9ueAE?2 z{C%vJ0^1LL9uFUSrD(xXV{5xpIF)>Xve+hpPg=Rep1EahJsJQiKnxaJw>(Mz*xR4uN)5RrpNN{pQRwox0VVkI3liY9N z1qjs-Z9@n4QIoJ+&FtaV=1V0)3J#5L-j#&={aE#`YYg3Wu6_yeRE}8Ft9?Ke{CKGu zpy^7RF;%tXSCV;08WGQuV#t&!W(kx+!$0Qaf>9bHnK&27QCH`2PyCY z?t35GT^Rr5)IX@LpShf%y6;PTH^0t(2Q7B zVIluTJED>@SyQJ??&FboCgS5X@3Z$kshv&_t=$Z$_Z=RasLNi6D~Q5%wa2mP5%x?$ zT?uv?db6Wdni;3bviv!LUzUwHEV-h(ZQh}98SXeHFrv4_4C8-5w5WswbD1|29g7-w zd3sg6L!w^F4{veqP3(m~gWk3%GQs}jBwDYLz4$`8XG~u<+vYv`Pe<*Wn)2K;Uj`nc z80FhUybd$FPA1c6)k3@z{~uU93>1E$2w_puJxr3k`Gwu4dr(_!m+MOCW<`=V^lIFg zt1w5gmanyY6}g$nOC?m29L6_X;{6>|OB&72bg<;%H`hgXk)WPGX5#dPIk|V#yvF4h zM-`d?{R_&Ex9%={j6>HQCrP-XEs~idTFua%T;xe^8d z%i|@dYiljTAForPTd6$XiFvKk=LU_aB;C$rilf{g5b&o)HU>S-f%JQX54Tca`2J7W##KO@j;*VCy9(s71H08l^tzcx_XGeAjd2yG5#wD zavoFKvt3q-W&$k*MA(JPwzcB&25YW~7w;vMK$%ozKBpmMzqgiabfFb;!KABuz!dm$ z(&7_}{>=@5uLxda-QS&Uo=t2;M;5FC9ApM72(orlWn@#WX#Rg4>P`Z28{l#PP@Btf_DDdfRXmNses6Qp&QwuAT%#8?OAI|vI3*C_9@ zTn*TmS-2=04diu;rWFMTY#gLk{ucxevL(>pr}g)X9E}3R0*kMNp;;9Q&3ePD_SE#R zMGv2Sp|mo#RHmgl;ZEWTUf5->nH;s(#GzD@a)%Vk#x*I%zdp&hR6{QJM2?yD8)ZNG zEFn0NTfH15GlvRc#yisFw>gYfh>;c}47qAAP>xObt0AN+PG>aXchY_eHjI6cZ(Iqx z_`1UXoi~sIG!fbyXhgMyp+?+W)h!h-RjGz&l2=o-6sSkx*(s_=S3gdlbKzmknm1Onb|mpjMW`X=*LsJ-{h8BG|38_}z$J|LB##W^J$YCdzSo%+X) z${@uKwaxS9cK-^^o>5bOg#asSVue>8mU;L=yZ%BF{}pq7Ww-%tI&!yUb&|^EhCN4> zSc%E6NnF!cy9!6C>Dp5`5J-GPxfo&=hEXL#BT6-=@Ar2$?Y*naWi{VK>#FF{B0yyf zO5KTdig99A^ac#<4AXC(@^@DY$(J(?6`xz1vNK;f{|V?*CwQsqUSNQ7w4q*Xip z{1sPOpK0Ai(r)_;#rXaM7auR+BC=zT9yV-^!~gx%E=`l?O!e(C#i4*#_m$cqKhJE& z!jHq@!kUfJo)>}Ol5<3LYrZ8fZP)2p1?OL@mxqQ)1PNc6wW*0`1I6HOtfjtp;7e79 z&+re}WB93vf4yk{z&3qgpQt!RlxRjmwj@&GcY>&{zZFNl@p-4ve@P44S`VW4bGwq+ z<@Ng>ryGVa_+P;E1!3WLY5GdzyEdGbDpG8|=*fI1BudFHgVjhbmYxApJSL z`_aIiXK{@l9}V)mpg(8NNSGy>c*fXv6NqhmuQnEhwcmRh=a)#jYZL^{94&c!Dv{;VQ->)j;d&~&KeaSxV z-sY~;x+-++!kQ1C&v|b@7t;a8{ShaPDy>~K0^{9Te-{^wRQ zDda}$qwJk)yp&P}U&{nf1=$0*zoOPhSO`2tqR`1LnIZUe-SBN4N^*QsqOyi<>wY#4 zSTS5$oM68&o2<>J^xeh9g;R6>=((|B z^H@W%{nZ=&&?0N--L(%^)F9e z7=&2;+8feb2qC6*vn9yn#y<$cy8QaHc12&J2k4ch2LcrS8MJbxRaMWRUOHPYp79(~==3 z@3KRkPkX=H67T$XU{7{yhn;<#%;$r1z<(heOeDC)`xXZ^MV+WxRe^L^uTRH&N!_w!&MRZ_K3MZEelo@kID^ z9JbzCZxAO}#4+On)gZ0Dg-3Q*?9-H9QyaSj>(H=r)4+ht?Y%i!{OJp?*9KWcO9Q8F zq*tRohN)USx1k4rwJ-?o{_hZ{>;dOi=ppS<-q%%f2Q2uGz}$ zBM1_gNQt`={K}}#*i?QpuO;#ovSA_l6kU}qPG#|Jo3qY%{c;xG_6NdxY96fn!*_#y z)!LRq_ce$RY-*Y^mq}7AUm58^D8roV>h|SANkHo^%*gcO)TaC z?BU54g;9}+turGsoXw4V4BgOqxt0083r&{&IUfoYp^=>$ZI?Hd6~CzYEzWC670fn@ zZw3QgrgIJ-el(`Ld)oNGk}Pe;9~J8-)ml9wyV8D_!)TQ4cdd1FvESGpqEX-VzCXdo z7v1W%na=}SbRa)#UO)W1`hyU%b*`EVs1L;YEj;)YzChR9yECEN3Eqhhxw=%Dd(k|x0C-f?Iw zoh(!iA5LGbRKIZSz9Dz@4D6oBva0&K3+;w(CkjQXH?MHt#JnhUkd?!F6GNRAFWAL_ z&8uGI?p<3_67YrzzwQGX^vUP)@SlHSrmN5c=O@zk2A5a59&J%jdc_ylW6z-EdAQV5yDvo&6jGe;kz6%B@ z!XbUNiI}&0fj!E7Tab3E+WPq@q|!`a!K^iZDOU={zTop&T;I&y!PrCXzIrrXAvaD- z%c|x^^zi2J25f4azIA~uoGH*3SJnEB!!C8;M?P&qy-pBWB;vm0bl6ZSg7h}7R_M90 zpmt5`jf=?;rGisBg3bxQkExGE~03jURJEDvct{5!(% zcGw)4roq_vJ{5w#V9%>>Sl7bG*VER$%(%vblk&m#5IG?GjXUk3^SrxdDF>6Q~I&%H@+15 zFZH}N>qYYW-2mUBZkG)_vIvs+Ws8Zs&2ih6FRJtCF9pU|h33JJ_o;{`Z=ub8B~)rW zO@={so61fI;T;wWEg0O|A1PA`;+D6}sk;;&wV2fJ=|4_ixXaV>2qnUKG4F!GvtY()zhbUD78t$FaIc3+a$Td?A7JT~$8d1l=q&KN}4 z%x!bu?K8n-UP(ws_h4Z))gY(bU+%3G2PkN_*H%t58f!_irrf z{~eH$W;df3pHq32(I|i3*M4eqHhUoD=u>@GggxBsgr!evb0+*I1cp^$FP6qEg@5Ww zHTEF+4u4C$#-J`0?dV$L-oMDfzTmVXRL-J_WR3n|%mXY8(L;OY_}kz9bzK=GVvb|m zeTq$2E%mjvuCTDunvG{W+jGBW8T9&_munu!CL_>2FN+p6;iya3g-$XpEW5=QIo3hiKDB)srtzAxXVzIy>9* ziA1NE#`Ache`A}25k&no-pSHwcxyBG+f5Vx!(91L)yXkQvijkKBJ-Ks(nwsX9~H3Te9 zCG;D|Eg|u{LJd_m-b9g2>+u_^!&S~yCQN}$9*p!rCxK&0&KUoB$EnSnFpF^adrCz9iOlUF=v+YHyNlb|ufQLo; zW73|5>Dt5LrUOZ)CF7+^In;mP@NM}LLa;N}6w`6btXH8{eShkV3!|7JHmpb$D>6{wL5}&iP zxOuGfCdi*Lr`W@Zr0YgkbH2T45rXR6Hbq};1sFAxd_zI_hR>o$&vtitcY_+0G#qHs zZ(Pq;WHwA{v}Od%{~-zb``;S?xaH&r?30C$cr1EVZYP<3c8g8!XW%3IdzWYUwo6UO zE1QE$XZXyYT=Y=CYwaviH`RYYF6{Ynv<9=deUr=K%Xd%s?zDJDCc?Q>^VY@WpaAbm z{r=q=+LwM}ZsZ+P23E5>`^Y!cGp46?X53JltdyV!O1!|=MF*;zBC*>`cV5rNUK%^FujZ~pjq{UwMYjBpR}{Xqw7d;*#^9a*Qp4Z>r7vR0b9PQxV#20VwuR-h zK~`Jr@gy1l=0^z{(n=6G{890KSV6pc0HmCYKWqK@57C&SFM|6-xrk&vZRh~UMqu)) z_0cOxY@j8)$>3#S!JE6S2x>}N2wAD*S)#gYN148-X{*5bbm%Q<5{tWeDec~9F%{kO zvXR}j&WuSjd`&a+|^5CIx{GpWN7Z0|++H4DaWVsrj>x?SQ$`^d} zG*7P{Ph4n4SY7-0&PAK|$tPe*NWL7&l2$j)zJ0vsJD{nxhmg=dlbfPBn!cVNnh@ei zgnJacI~EMOUZo1bAH9AD*iW4Qk(`W`KI!hCbYBtdw|s(!er!@bkN)O-Zxe6YO56rl zR1aGNhS5J@!zIvKU0r zZIB1jz%IRH6C`u}fes!=32fzd6&5F^q?S786#nWHfs9{xG{rL6r|4VDh<>Qjx{um> zb@5+R_HF)*AlJ#Z``cJcgy_c%(T73*Hq68iu*mO?v}}uGh1LNN&DvV?!D35>V}^|P zcT?nA^=2-*9nRJnO5k?YO2uvfRbf2K^1NC|X&W3z_Nwpw@))gYNYHa6HFx=j|ORM@BG9+b3pz zA4UV(+;vp23L9NC8f8he#jd`l`al+J_rw=J1q*C__$^Hc=T9wyRR#KE=Ec*OD+Ir&z@UQK zs5&dWss;)W^@V_>+kN+2=T9dM(0`M9jf0!0XS)$mLGFqCz+f z&og{II{lnwv^*3Nkemyfv$@_BQ^rIur4v}+nKwU)3GLWk!U^J7lpS<$c{1O_9Bf{5 zW{I>Q1U*m_i?O{V4$osNxM=5e_M#5O)f*~;Aw;Xhwbz-`VP|B`FclBvp!7*($#4gb;a=mP-I za_O(l6v$^&Lud~&yo`J#U&*r+?X!ns4%jeV!UoZ-#NN}QM|*(-G_f>44*1gyV&=Vb z;x!3P4Zh0w!CJ@Efiv29&Wm?QJx^C?3lFHiRo_PZpO90wt}+lf1{*8$j zjvN^8IdO*xG}CgLu66lcW2u*pm7{r$^?2}ai||QcMMjiS zW?BMJz)u&Ie1U@jn66`r0C{DWsXWoOA`yqpi0s|o{{D)riu`NAXdoO%iFm43#(q0#M2)MN0#5rRKK4>nAS>ZheF`S)87dNtj-P`)iE!_y63e^VMpske8RQpg)N zUKD{J1t5nN_=$W|IaLQ0H&{1+A1& AlK=n! diff --git a/release-0.20.0/docs/devel/instrumentation.md b/release-0.20.0/docs/devel/instrumentation.md deleted file mode 100644 index 81027edf792..00000000000 --- a/release-0.20.0/docs/devel/instrumentation.md +++ /dev/null @@ -1,39 +0,0 @@ -Instrumenting Kubernetes with a new metric -=================== - -The following is a step-by-step guide for adding a new metric to the Kubernetes code base. - -We use the Prometheus monitoring system's golang client library for instrumenting our code. Once you've picked out a file that you want to add a metric to, you should: - -1. Import "github.com/prometheus/client_golang/prometheus". - -2. Create a top-level var to define the metric. For this, you have to: - 1. Pick the type of metric. Use a Gauge for things you want to set to a particular value, a Counter for things you want to increment, or a Histogram or Summary for histograms/distributions of values (typically for latency). Histograms are better if you're going to aggregate the values across jobs, while summaries are better if you just want the job to give you a useful summary of the values. - 2. Give the metric a name and description. - 3. Pick whether you want to distinguish different categories of things using labels on the metric. If so, add "Vec" to the name of the type of metric you want and add a slice of the label names to the definition. - - https://github.com/GoogleCloudPlatform/kubernetes/blob/cd3299307d44665564e1a5c77d0daa0286603ff5/pkg/apiserver/apiserver.go#L53 - https://github.com/GoogleCloudPlatform/kubernetes/blob/cd3299307d44665564e1a5c77d0daa0286603ff5/pkg/kubelet/metrics/metrics.go#L31 - -3. Register the metric so that prometheus will know to export it. - - https://github.com/GoogleCloudPlatform/kubernetes/blob/cd3299307d44665564e1a5c77d0daa0286603ff5/pkg/kubelet/metrics/metrics.go#L74 - https://github.com/GoogleCloudPlatform/kubernetes/blob/cd3299307d44665564e1a5c77d0daa0286603ff5/pkg/apiserver/apiserver.go#L78 - -4. Use the metric by calling the appropriate method for your metric type (Set, Inc/Add, or Observe, respectively for Gauge, Counter, or Histogram/Summary), first calling WithLabelValues if your metric has any labels - - https://github.com/GoogleCloudPlatform/kubernetes/blob/3ce7fe8310ff081dbbd3d95490193e1d5250d2c9/pkg/kubelet/kubelet.go#L1384 - https://github.com/GoogleCloudPlatform/kubernetes/blob/cd3299307d44665564e1a5c77d0daa0286603ff5/pkg/apiserver/apiserver.go#L87 - - -These are the metric type definitions if you're curious to learn about them or need more information: -https://github.com/prometheus/client_golang/blob/master/prometheus/gauge.go -https://github.com/prometheus/client_golang/blob/master/prometheus/counter.go -https://github.com/prometheus/client_golang/blob/master/prometheus/histogram.go -https://github.com/prometheus/client_golang/blob/master/prometheus/summary.go - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/instrumentation.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/instrumentation.md?pixel)]() diff --git a/release-0.20.0/docs/devel/issues.md b/release-0.20.0/docs/devel/issues.md deleted file mode 100644 index 188e9ba1c88..00000000000 --- a/release-0.20.0/docs/devel/issues.md +++ /dev/null @@ -1,25 +0,0 @@ -GitHub Issues for the Kubernetes Project -======================================== - -A list quick overview of how we will review and prioritize incoming issues at https://github.com/GoogleCloudPlatform/kubernetes/issues - -Priorities ----------- - -We will use GitHub issue labels for prioritization. The absence of a priority label means the bug has not been reviewed and prioritized yet. - -Definitions ------------ -* P0 - something broken for users, build broken, or critical security issue. Someone must drop everything and work on it. -* P1 - must fix for earliest possible binary release (every two weeks) -* P2 - should be fixed in next major release version -* P3 - default priority for lower importance bugs that we still want to track and plan to fix at some point -* design - priority/design is for issues that are used to track design discussions -* support - priority/support is used for issues tracking user support requests -* untriaged - anything without a priority/X label will be considered untriaged - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/issues.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/issues.md?pixel)]() diff --git a/release-0.20.0/docs/devel/logging.md b/release-0.20.0/docs/devel/logging.md deleted file mode 100644 index 0b03c43c36a..00000000000 --- a/release-0.20.0/docs/devel/logging.md +++ /dev/null @@ -1,32 +0,0 @@ -Logging Conventions -=================== - -The following conventions for the glog levels to use. [glog](http://godoc.org/github.com/golang/glog) is globally preferred to [log](http://golang.org/pkg/log/) for better runtime control. - -* glog.Errorf() - Always an error -* glog.Warningf() - Something unexpected, but probably not an error -* glog.Infof() has multiple levels: - * glog.V(0) - Generally useful for this to ALWAYS be visible to an operator - * Programmer errors - * Logging extra info about a panic - * CLI argument handling - * glog.V(1) - A reasonable default log level if you don't want verbosity. - * Information about config (listening on X, watching Y) - * Errors that repeat frequently that relate to conditions that can be corrected (pod detected as unhealthy) - * glog.V(2) - Useful steady state information about the service and important log messages that may correlate to significant changes in the system. This is the recommended default log level for most systems. - * Logging HTTP requests and their exit code - * System state changing (killing pod) - * Controller state change events (starting pods) - * Scheduler log messages - * glog.V(3) - Extended information about changes - * More info about system state changes - * glog.V(4) - Debug level verbosity (for now) - * Logging in particularly thorny parts of code where you may want to come back later and check it - -As per the comments, the practical default level is V(2). Developers and QE environments may wish to run at V(3) or V(4). If you wish to change the log level, you can pass in `-v=X` where X is the desired maximum level to log. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/logging.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/logging.md?pixel)]() diff --git a/release-0.20.0/docs/devel/making-release-notes.md b/release-0.20.0/docs/devel/making-release-notes.md deleted file mode 100644 index 1725616c717..00000000000 --- a/release-0.20.0/docs/devel/making-release-notes.md +++ /dev/null @@ -1,36 +0,0 @@ -## Making release notes -This documents the process for making release notes for a release. - -### 1) Note the PR number of the previous release -Find the PR that was merged with the previous release. Remember this number -_TODO_: Figure out a way to record this somewhere to save the next release engineer time. - -### 2) Build the release-notes tool -```bash -${KUBERNETES_ROOT}/build/make-release-notes.sh -``` - -### 3) Trim the release notes -This generates a list of the entire set of PRs merged since the last release. It is likely long -and many PRs aren't worth mentioning. - -Open up ```candidate-notes.md``` in your favorite editor. - -Remove, regroup, organize to your hearts content. - - -### 4) Update CHANGELOG.md -With the final markdown all set, cut and paste it to the top of ```CHANGELOG.md``` - -### 5) Update the Release page - * Switch to the [releases](https://github.com/GoogleCloudPlatform/kubernetes/releases) page. - * Open up the release you are working on. - * Cut and paste the final markdown from above into the release notes - * Press Save. - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/making-release-notes.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/making-release-notes.md?pixel)]() diff --git a/release-0.20.0/docs/devel/profiling.md b/release-0.20.0/docs/devel/profiling.md deleted file mode 100644 index cb2acd1d2a9..00000000000 --- a/release-0.20.0/docs/devel/profiling.md +++ /dev/null @@ -1,40 +0,0 @@ -# Profiling Kubernetes - -This document explain how to plug in profiler and how to profile Kubernetes services. - -## Profiling library - -Go comes with inbuilt 'net/http/pprof' profiling library and profiling web service. The way service works is binding debug/pprof/ subtree on a running webserver to the profiler. Reading from subpages of debug/pprof returns pprof-formatted profiles of the running binary. The output can be processed offline by the tool of choice, or used as an input to handy 'go tool pprof', which can graphically represent the result. - -## Adding profiling to services to APIserver. - -TL;DR: Add lines: -``` - m.mux.HandleFunc("/debug/pprof/", pprof.Index) - m.mux.HandleFunc("/debug/pprof/profile", pprof.Profile) - m.mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol) -``` -to the init(c *Config) method in 'pkg/master/master.go' and import 'net/http/pprof' package. - -In most use cases to use profiler service it's enough to do 'import _ net/http/pprof', which automatically registers a handler in the default http.Server. Slight inconvenience is that APIserver uses default server for intra-cluster communication, so plugging profiler to it is not really useful. In 'pkg/master/server/server.go' more servers are created and started as separate goroutines. The one that is usually serving external traffic is secureServer. The handler for this traffic is defined in 'pkg/master/master.go' and stored in Handler variable. It is created from HTTP multiplexer, so the only thing that needs to be done is adding profiler handler functions to this multiplexer. This is exactly what lines after TL;DR do. - -## Connecting to the profiler -Even when running profiler I found not really straightforward to use 'go tool pprof' with it. The problem is that at least for dev purposes certificates generated for APIserver are not signed by anyone trusted and because secureServer serves only secure traffic it isn't straightforward to connect to the service. The best workaround I found is by creating an ssh tunnel from the kubernetes_master open unsecured port to some external server, and use this server as a proxy. To save everyone looking for correct ssh flags, it is done by running: -``` - ssh kubernetes_master -L:localhost:8080 -``` -or analogous one for you Cloud provider. Afterwards you can e.g. run -``` -go tool pprof http://localhost:/debug/pprof/profile -``` -to get 30 sec. CPU profile. - -## Contention profiling - -To enable contention profiling you need to add line ```rt.SetBlockProfileRate(1)``` in addition to ```m.mux.HandleFunc(...)``` added before (```rt``` stands for ```runtime``` in ```master.go```). This enables 'debug/pprof/block' subpage, which can be used as an input to ```go tool pprof```. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/profiling.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/profiling.md?pixel)]() diff --git a/release-0.20.0/docs/devel/pull-requests.md b/release-0.20.0/docs/devel/pull-requests.md deleted file mode 100644 index c71bbce946f..00000000000 --- a/release-0.20.0/docs/devel/pull-requests.md +++ /dev/null @@ -1,34 +0,0 @@ -Pull Request Process -==================== - -An overview of how we will manage old or out-of-date pull requests. - -Process -------- - -We will close any pull requests older than two weeks. - -Exceptions can be made for PRs that have active review comments, or that are awaiting other dependent PRs. Closed pull requests are easy to recreate, and little work is lost by closing a pull request that subsequently needs to be reopened. - -We want to limit the total number of PRs in flight to: -* Maintain a clean project -* Remove old PRs that would be difficult to rebase as the underlying code has changed over time -* Encourage code velocity - -RC to v1.0 Pull Requests ------------------------- - -Between the first RC build (~6/22) and v1.0, we will adopt a higher bar for PR merges. For v1.0 to be a stable release, we need to ensure that any fixes going in are very well tested and have a low risk of breaking anything. Refactors and complex changes will be rejected in favor of more strategic and smaller workarounds. - -These PRs require: -* A risk assessment by the code author in the PR. This should outline which parts of the code are being touched, the risk of regression, and complexity of the code. -* Two LGTMs from experienced reviewers. - -Once those requirements are met, they will be labeled [ok-to-merge](https://github.com/GoogleCloudPlatform/kubernetes/pulls?utf8=%E2%9C%93&q=is%3Aopen+is%3Apr+label%3Aok-to-merge) and can be merged. - -These restrictions will be relaxed after v1.0 is released. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/pull-requests.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/pull-requests.md?pixel)]() diff --git a/release-0.20.0/docs/devel/releasing.dot b/release-0.20.0/docs/devel/releasing.dot deleted file mode 100644 index fe8124c36da..00000000000 --- a/release-0.20.0/docs/devel/releasing.dot +++ /dev/null @@ -1,113 +0,0 @@ -// Build it with: -// $ dot -Tsvg releasing.dot >releasing.svg - -digraph tagged_release { - size = "5,5" - // Arrows go up. - rankdir = BT - subgraph left { - // Group the left nodes together. - ci012abc -> pr101 -> ci345cde -> pr102 - style = invis - } - subgraph right { - // Group the right nodes together. - version_commit -> dev_commit - style = invis - } - { // Align the version commit and the info about it. - rank = same - // Align them with pr101 - pr101 - version_commit - // release_info shows the change in the commit. - release_info - } - { // Align the dev commit and the info about it. - rank = same - // Align them with 345cde - ci345cde - dev_commit - dev_info - } - // Join the nodes from subgraph left. - pr99 -> ci012abc - pr102 -> pr100 - // Do the version node. - pr99 -> version_commit - dev_commit -> pr100 - tag -> version_commit - pr99 [ - label = "Merge PR #99" - shape = box - fillcolor = "#ccccff" - style = "filled" - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - ci012abc [ - label = "012abc" - shape = circle - fillcolor = "#ffffcc" - style = "filled" - fontname = "Consolas, Liberation Mono, Menlo, Courier, monospace" - ]; - pr101 [ - label = "Merge PR #101" - shape = box - fillcolor = "#ccccff" - style = "filled" - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - ci345cde [ - label = "345cde" - shape = circle - fillcolor = "#ffffcc" - style = "filled" - fontname = "Consolas, Liberation Mono, Menlo, Courier, monospace" - ]; - pr102 [ - label = "Merge PR #102" - shape = box - fillcolor = "#ccccff" - style = "filled" - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - version_commit [ - label = "678fed" - shape = circle - fillcolor = "#ccffcc" - style = "filled" - fontname = "Consolas, Liberation Mono, Menlo, Courier, monospace" - ]; - dev_commit [ - label = "456dcb" - shape = circle - fillcolor = "#ffffcc" - style = "filled" - fontname = "Consolas, Liberation Mono, Menlo, Courier, monospace" - ]; - pr100 [ - label = "Merge PR #100" - shape = box - fillcolor = "#ccccff" - style = "filled" - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - release_info [ - label = "pkg/version/base.go:\ngitVersion = \"v0.5\";" - shape = none - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - dev_info [ - label = "pkg/version/base.go:\ngitVersion = \"v0.5-dev\";" - shape = none - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; - tag [ - label = "$ git tag -a v0.5" - fillcolor = "#ffcccc" - style = "filled" - fontname = "Helvetica Neue, Helvetica, Segoe UI, Arial, freesans, sans-serif" - ]; -} - diff --git a/release-0.20.0/docs/devel/releasing.md b/release-0.20.0/docs/devel/releasing.md deleted file mode 100644 index 36140b2fd8f..00000000000 --- a/release-0.20.0/docs/devel/releasing.md +++ /dev/null @@ -1,171 +0,0 @@ -# Releasing Kubernetes - -This document explains how to create a Kubernetes release (as in version) and -how the version information gets embedded into the built binaries. - -## Origin of the Sources - -Kubernetes may be built from either a git tree (using `hack/build-go.sh`) or -from a tarball (using either `hack/build-go.sh` or `go install`) or directly by -the Go native build system (using `go get`). - -When building from git, we want to be able to insert specific information about -the build tree at build time. In particular, we want to use the output of `git -describe` to generate the version of Kubernetes and the status of the build -tree (add a `-dirty` prefix if the tree was modified.) - -When building from a tarball or using the Go build system, we will not have -access to the information about the git tree, but we still want to be able to -tell whether this build corresponds to an exact release (e.g. v0.3) or is -between releases (e.g. at some point in development between v0.3 and v0.4). - -## Version Number Format - -In order to account for these use cases, there are some specific formats that -may end up representing the Kubernetes version. Here are a few examples: - -- **v0.5**: This is official version 0.5 and this version will only be used - when building from a clean git tree at the v0.5 git tag, or from a tree - extracted from the tarball corresponding to that specific release. -- **v0.5-15-g0123abcd4567**: This is the `git describe` output and it indicates - that we are 15 commits past the v0.5 release and that the SHA1 of the commit - where the binaries were built was `0123abcd4567`. It is only possible to have - this level of detail in the version information when building from git, not - when building from a tarball. -- **v0.5-15-g0123abcd4567-dirty** or **v0.5-dirty**: The extra `-dirty` prefix - means that the tree had local modifications or untracked files at the time of - the build, so there's no guarantee that the source code matches exactly the - state of the tree at the `0123abcd4567` commit or at the `v0.5` git tag - (resp.) -- **v0.5-dev**: This means we are building from a tarball or using `go get` or, - if we have a git tree, we are using `go install` directly, so it is not - possible to inject the git version into the build information. Additionally, - this is not an official release, so the `-dev` prefix indicates that the - version we are building is after `v0.5` but before `v0.6`. (There is actually - an exception where a commit with `v0.5-dev` is not present on `v0.6`, see - later for details.) - -## Injecting Version into Binaries - -In order to cover the different build cases, we start by providing information -that can be used when using only Go build tools or when we do not have the git -version information available. - -To be able to provide a meaningful version in those cases, we set the contents -of variables in a Go source file that will be used when no overrides are -present. - -We are using `pkg/version/base.go` as the source of versioning in absence of -information from git. Here is a sample of that file's contents: - -``` - var ( - gitVersion string = "v0.4-dev" // version from git, output of $(git describe) - gitCommit string = "" // sha1 from git, output of $(git rev-parse HEAD) - ) -``` - -This means a build with `go install` or `go get` or a build from a tarball will -yield binaries that will identify themselves as `v0.4-dev` and will not be able -to provide you with a SHA1. - -To add the extra versioning information when building from git, the -`hack/build-go.sh` script will gather that information (using `git describe` and -`git rev-parse`) and then create a `-ldflags` string to pass to `go install` and -tell the Go linker to override the contents of those variables at build time. It -can, for instance, tell it to override `gitVersion` and set it to -`v0.4-13-g4567bcdef6789-dirty` and set `gitCommit` to `4567bcdef6789...` which -is the complete SHA1 of the (dirty) tree used at build time. - -## Handling Official Versions - -Handling official versions from git is easy, as long as there is an annotated -git tag pointing to a specific version then `git describe` will return that tag -exactly which will match the idea of an official version (e.g. `v0.5`). - -Handling it on tarballs is a bit harder since the exact version string must be -present in `pkg/version/base.go` for it to get embedded into the binaries. But -simply creating a commit with `v0.5` on its own would mean that the commits -coming after it would also get the `v0.5` version when built from tarball or `go -get` while in fact they do not match `v0.5` (the one that was tagged) exactly. - -To handle that case, creating a new release should involve creating two adjacent -commits where the first of them will set the version to `v0.5` and the second -will set it to `v0.5-dev`. In that case, even in the presence of merges, there -will be a single commit where the exact `v0.5` version will be used and all -others around it will either have `v0.4-dev` or `v0.5-dev`. - -The diagram below illustrates it. - -![Diagram of git commits involved in the release](./releasing.png) - -After working on `v0.4-dev` and merging PR 99 we decide it is time to release -`v0.5`. So we start a new branch, create one commit to update -`pkg/version/base.go` to include `gitVersion = "v0.5"` and `git commit` it. - -We test it and make sure everything is working as expected. - -Before sending a PR for it, we create a second commit on that same branch, -updating `pkg/version/base.go` to include `gitVersion = "v0.5-dev"`. That will -ensure that further builds (from tarball or `go install`) on that tree will -always include the `-dev` prefix and will not have a `v0.5` version (since they -do not match the official `v0.5` exactly.) - -We then send PR 100 with both commits in it. - -Once the PR is accepted, we can use `git tag -a` to create an annotated tag -*pointing to the one commit* that has `v0.5` in `pkg/version/base.go` and push -it to GitHub. (Unfortunately GitHub tags/releases are not annotated tags, so -this needs to be done from a git client and pushed to GitHub using SSH.) - -## Parallel Commits - -While we are working on releasing `v0.5`, other development takes place and -other PRs get merged. For instance, in the example above, PRs 101 and 102 get -merged to the master branch before the versioning PR gets merged. - -This is not a problem, it is only slightly inaccurate that checking out the tree -at commit `012abc` or commit `345cde` or at the commit of the merges of PR 101 -or 102 will yield a version of `v0.4-dev` *but* those commits are not present in -`v0.5`. - -In that sense, there is a small window in which commits will get a -`v0.4-dev` or `v0.4-N-gXXX` label and while they're indeed later than `v0.4` -but they are not really before `v0.5` in that `v0.5` does not contain those -commits. - -Unfortunately, there is not much we can do about it. On the other hand, other -projects seem to live with that and it does not really become a large problem. - -As an example, Docker commit a327d9b91edf has a `v1.1.1-N-gXXX` label but it is -not present in Docker `v1.2.0`: - -``` - $ git describe a327d9b91edf - v1.1.1-822-ga327d9b91edf - - $ git log --oneline v1.2.0..a327d9b91edf - a327d9b91edf Fix data space reporting from Kb/Mb to KB/MB - - (Non-empty output here means the commit is not present on v1.2.0.) -``` - -## Release Notes - -No official release should be made final without properly matching release notes. - -There should be made available, per release, a small summary, preamble, of the -major changes, both in terms of feature improvements/bug fixes and notes about -functional feature changes (if any) regarding the previous released version so -that the BOM regarding updating to it gets as obvious and trouble free as possible. - -After this summary, preamble, all the relevant PRs/issues that got in that -version should be listed and linked together with a small summary understandable -by plain mortals (in a perfect world PR/issue's title would be enough but often -it is just too cryptic/geeky/domain-specific that it isn't). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/releasing.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/releasing.md?pixel)]() diff --git a/release-0.20.0/docs/devel/releasing.png b/release-0.20.0/docs/devel/releasing.png deleted file mode 100644 index 935628deddc5ba9c608cd7f97d7c587bf519e333..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 30693 zcmag`1yq%7)HRH5O1ebp1_433r8}fUx}~H`q#FdJI|P*O?hfhhM!LKEzj)sNJ7aw3 z9cP@a4q>zJx?-)l=A4UQ1vv>+Bzzr*OP^<*{YR|u zv(-H3?zhmw1`SOb^ZIvM@zFXO(F*<_=6Ytk2Oplk-wpi=4LKd;Wlg;vD4gMPh#xus z!tXHbGJH))7$y#bf$#;l)2|wW0PD*<3P&2bibgUGefR0}=jnqvs_5u(b>vm;hK7$; zmPOBZ1LziH7z})7vT0CaTu{-KFwsZMh>@h9gVjRJQBfOl#5enf;9gGeH z8t+ID$6GLv=YP)pzuwk9hJGW>>Epf7>cwre<^w~A081D!J`{qD2upaDSt`)+*LXe% zU4w5N5q9w>9y9~P#M$|TIvE672&cpu%71Y1rldq}gFR_6E(vdBd`n5W4-c;jhp_+! zr6__(Yk`7~!tZKFG5GiDL#D*c1%sA);^CGF8brNyd1Jk&76PG-Tl>e9HddLOvR`YJ zBH&ijb#+)nPao!yBS>n-EUK;F|Hf}}(rm-Y)it%|>H`NGEg9M2Mpb1NWvR2{Ri0ui zy-q`RK|zsozVmT(bybdXe(Xp(vWjZ8urNcBE?;F)Q6%%oPzv?t#v2NX*0s|LA0N{@ z86Uw>!yk3t`S~8&i!d8b?hhhZF##8~d;5iad^jm71B2iHMT&GF)Su(x(Fr3?J`(RBoy`Ha&&Bf-nfm(rcXf6#!XoFx zX{elRRfs4u=^R6oqoaY$=wagbSH()7KSM!CsdLrU)TVggel@=Gfk5hLa!$4pkV9n? zGg6Z97-?vV3JTuQ(#mR$&)YZF4 zh{8V52vFqbf6-m$wHXd{dBD)Ev-I>>i5XN z?=dsUXJ7G5#r#-)Wm1ePTyh2ogo(L4BFuyI!-sw@LI~tXuvDP`m-jSzFp&8LsiC1u z$&Y8JISNmYqN}#N0(}CcH@9$yhcoxLM20d=9t+zY0ag$Qm;y;@JG-NHKPbNbHCryc zB<889O(dkR?Cftd#rv-141{09o>2t${(wOAEiLc&rY5?&dc?(Re(vVvTtPuCTUmA8 z-R%+aU@tbgM4#%2h@{Y|T~$|CfBROW*SK{#@bD<1ppe)6t1Gd>y}lN2@!hB<5jwbWP|NL1K7+LZ9{{6dK1eLvgbgmqGNpUd- zRtyGC&vRZ;;r?oLbd$^Z1|4n4OcD2}DH5zNHkb9B9~VFW)7d8JE-(n^sp5^P?*aQ8>~HWdamHxp0xog=a6v6suAY-^a&r3f-JNT461RRa z0<-~V=Mvm>$z^n8+rokc7Z29S%~+w@ai=CGY=?E=Fe~&H1~xXID;oj`N(k{N*DVlO zXdecM4~laJvLIEbJoP?4Tf~E3*y|M_kmzOs^{n<6d-`_ttSnAnA-w}#74jkR!xT_SaDopwT0!|xG zuZ4|+lbewNcF@l(g?tqckH@DOK@v>Ts@hrsucwFUVlA@*e?fJKqmLIe6BC!y-egxW zR(5ta6vW=%9vT|@k#TrnAoK#xmTPfmEOT>XqsDTMC1V*D))#T{A}eyr{r>83^tT8i zBI4V(Z$q)^E2^pp73}!=`CkW9g79Es5}%Ne@aq>JDVC35nQzKx)beE2!p}pg+*mG? z^1l_#*zieK+O*GxQaC?;{OIfJdvtVUVq$W2bycK@ah8Mudshwcax0kfO-;PM~#OpK9y zXjoVntLg9u8XA3h2aH}pyl);pI*s2B7wcoJupyAh*jN=66@NcygdUbAZBj5}O--qf z3;vy8{9^FLDWEBBPsTDO_V)HHt?|*2NK*%y_K*qr-Dl_Kk{+=k|1uyQb0`T!J>wG- zSl|g_V#;58qaZmtI+neL_&oeDU?wMx>6^%vZ}ohpwPlb9xOZtgDkS34#0RZ4b6v$81n_v8qe4Pki**qNDi z%MH1WLekUq#KiuBfth^|1AY5$uuc#}fi%9J)YNa4!lR@A1`_^sbR?{<{{9)f(&E9& z&OS6W^jG>V>^QZ|Fj_c1ySV%aq0V~|L}unb@HxKM#$UcrQd07JKK$r&KtkA%KnZn$ z8g3sRK000RQ7`lse1dU=s;SU#_mzksHYkRMzC|B}o9(Z&TTf0-E+{N4$A92>0?ctNAK0%ddm|t1%EZ0LYs~MMsaQuXmA=L75gN zjXV~_X@k5hk~d}zkbrSn(tlUS&m$FcFz}xNPC&{g_#3zbzSxk^^YRZJs6r>HaLvL( zsKaB0)z;40+|Df*hBzc9B{jR>Ry3x(yM~3vquIHJV_{uyZ1@;8^Tl4x#DsTGmMJ<} zdbl^E`MaXAzP`u7>^$)f!W!ET?k-dVj%c)+AK3EVnYiN zUFiIOVZzCjoiKm@s+fskkn@%eFf+v;YaDmu3koWhvzMDcO^+wbWh?P}F({}`AtBb6 zxn2%dR0wzTa@wTD#wh>%`4G}G@ak3Cd-_M)gV|&lcxa3jZb!3s4!$o7hdbjK8svUE zJM_qz(^GU=8SL?ug3{8f3vEkl23D_@=!66Z9i6ujZ^1S`FJePOaw+m^LcWIX4#U{y z=DSK$Az0{=kq3|QNfjJIcU=t^XtbdH)6Z@^@5#vpVm?B%Mt~Eis&IEao+^;P$J${4j<(yS+W>?2LAKc|Y>P z`B)bomQtsos<1KTVP`BiGV-9Ps4IQLR8-Fk*2kNbGa)z_@%*e|jN+GI8y4M|C-zP=p=1)6{U zJf}U!M4hs{-+d2Z=q-(oX6X&R+>ely?(gc6@b~|Mj2sFLSzK%aK*}>VJ!(>gh0%sY zO-TNDZw~>r+5WD|O+n$6QQ+yi6ByJtZ`pO5>I!pBOY)_5&h0^_IpfY9GgG03lai4N zKD)e3W$qjw8ghfwZne(N&homPi7G3{?BbJRsOa~#_)$?^m6xOY2Z-SX!9XBjcSlBk zfP-^_2)gm)*VhwEN$@YfK?+F23R=IFdV*>nVKlR8T^>2cFj_lY;KyOGgn{hrd#$); z)p1?_YxgELw&P0uIheS&XAcKgotzw^n7LujHvc!2CnVHiIJN$H!KOfF=eLoCMWgHG zS9$r7b`=o8iQ|iKm^f-YF89n0*NiAAw7MOYmG8YF$2A;=9v+wBM99|5ynQz%zkd(K z(cRC_Yx3|clPpg@p8bIt%Gf z15#39hBD3$=UeORmDQ>m6{4Ty|-g9su$;mY+=iggo=YiDe~QT;p3R4ZK$0w3!f7%0rm4O-QBkAd(n zuQC{{j0j@X4o$em@|v2b?R2l7VPP+4Xt7n$)BkP=wgVnsa5YkI*{cRfH(2{&gxnQb zS+Evlk*grQAAo}bc`${UU>hJ;VD+{2k|P9ysGTMiL*?=GkR(ZINDs>*>XI;!U)LGNOj{0Zg?>gedmSI#ZS%iGx6GAuSO)2_D%0MQr>tva#~3QwJzZd+$( zW^;2hz_x{j$QJZ|a3%QO`fxanf(8Z#ngExJudlDW-Cxm9+rJ8pj#d&85m8pg0*R^< zjo}*C)Nct5W>L(0RG5)mOUEG#Vj-%DLRQIZlZ z%;@<8J^ku87z~ciVhU)8ptEyrP*Bj%pM(C0Sm2^omX?8Sh$Jp9E&vYU<4+J`So`>W zBP5`4cXtPqFc43l!X8Ql|EB_;p1wFbI{NDB8yOi{QMF(ovNkt)#`)#|4jdd@k!r@z z-@gr%lwMEMl6E2-ee)?OC}1|~)-Q%O{&y~nkg{rslc7MPLK~NmfMY>MV`N}}iG}3{ z))$j+s7^*hgX@kHECd41Pfkv**Mjna0}t8&pW&Miqh8BTP`X;Y{a`Sh%B`rV2rvi= zPTeeA|G+@d@+4^oz`CoG5PvJ%a%7a%mbNPMiHgd~#>U2%wT%5gZ$cOuOG`?u!A!o) z88o=L-}5+-mnjN+`9R-05l2wn&AtK?Ze)}R(C9R+dO%Z?yM%;K9*GneAHT)*GQ>@!m243j zr?D;a7#RTpA+N9y-6s>9ln|}9p>5PtMiSnd57q!i`v6+RQxx(KJOw>iGAKbVP!R9H z!0wq+JuNM*m*?mQZv%Y#aJ68gUZ@XWX*v=f5z(Uw_l2gjm|=8mjCo@QnY0aH)hXLW z;;yBoCGP)TaBwbgaJOP&?|%LI#YKqbef$x#nU}X|Ybz%?IfhDRbP}Ld9Go5{HafD` z!2q4ggZT!fA{nARZ2s{TAf`hBErdauT17x|A0kENQ?V} z`qOG>LRMBS7h&n|-{tkUgr7bQke%m(YRb^i@XsIe&Q6k_gzpW_@>mUgeH$8lljqgp z;53NS(jMzd7|wF#;{pPV#l$x2>(iB$>_LfYVaDb55FMhV0SC$G4;*@K6Y zW+&boGV(`^3LD#1Q?r08@VL%%W&(pC{!J*5IjjW`++>Cz?j*jz>_ouS5l&0Hpbf39U`}pQb{a{&fXc!qmQKRB` z5xO}*pTL-&Sr9U;LJ~ELjfweuy)t6P_5=fu1`6jtO7sigAMdJbucM}?yQd0^2?=HX z{uNWqzZyu`Td2+S^-UW|Hm)-r@dS%Wr62$WmC4oz6k{SmXjIhHRtsBohJP0^Db(#* zq+Rdsv8bW<_av$1(?G$iFNU=f9Tl~@TdyqWU1O6T>eK$_Gn>$F1rd?Vk+kOGV!o+` z`z(O9=`?+8i7cIBPEe_UoyNpS+qZPc z5Xevbcb5;hVlFP8BArR8w*MrYoGuUM0->R^>goi_UuxHj-5A~0C%O*@$JG{U&Q4AS z?_hlCi(WSWl~^b?^e8TohsI~@k?|T&L{PCL%;4J`uh7#El^wpqdHXggX=u6JXe?jZ z+T9&Dy)3XNRKUYk_jA0>lRF)G)Q@6Z1gf%8ID7(v?cwS~ex2L#>_bpyR;bL4+lx!~ zuD<((O+`tmPfp6m2U4hur)T5Ap)3>TC;=hb_F=QZsxY5}Lriiqe$l4jENbBv9N=66 z0(S2%r|Hx*EB`zRo!y?#+@3o>UCyk4%2(gC5d?woaJ1{=^hB;Gtn^s{cU-RnbwCj| zfkJXxlk~vv-AnK=FgC7ttq!O>=bfaJ2pvgp9Zsn|JX*R}&MDhib+LrV;W_!tL^|>F)+}@#{CT^)Ch7N0?YB#bF+VaY|PG5T}?|* z&*tmbgZ;*-*~E#23%xp9p7;4X?S2SXyh8!{Xm`&;Y9-n^3dvk6fE9uD-O5+qPhfQZ zavAK+hClSz`0vruz<)nlsAWuud;8I84;F-DOK4*pu$?Yfyq=vN@1PtDjfu{;3Gi@# zu2hS4KT|?f zQK8=xzGgq?Z-c=WIT$BQF>KoSGyC`ilw*xaRM?jIkuS~y?Z`;czQl9fE-j5AgGS~ z)x*c-e9LmBrL9AlByN6IUP}w!r;L_%?_Eer^7Pac9=C`L`OF|>>9gLaAN-eI6l5#^6BCZhKoJh9o=Eb^)q0|LDa`*6@R!r-+sAG z497cYhwWq%{sT6TyR3G#0J1koPW^ATdwbPYYE}S`m&mPre7Ha=)Sh-vWsh^b;-y)+ z1-QrEmxGbs+(Fx{w7iQ-u3G|U1~JFl`ih@_TQUD|Z;FmiZFv0~*n(zX3nV{u`t`%Zddr|z{@tCO@o~-gglmIHbmTmhy_?go=H@f?u3UoKn*%=u zo`0esyZr#9!6#fxy^QK=b_Ry&>1o`z?1>aKy#hANgFk+>Kh;Z!iS6#1qoIP!4W<>R zBqV65sRjLaP!Y1IC~s9ca~rQDu~_P_?N_gs3BSApKvTUw+JPef6%tyIgCkq3+cnzf z;%n-Kzo9saE_r=j;y02LGH*68UhP907&s@;R|<+D1!d%No=)UO=j2f3SO9WUMpl-c z{a4^0+Chzm$+f3PH}%3BJacn%S65fR(jJg$3veHxX3iOs!7u6{ z6AdQCaGM&vRlya|%`YejF_M>mx;i8vj*xhVa5kB*tj-?x)-O6ODJegbHLb9;RbEEM zQMcu%LBq{Jf*lprN1DA=43nX8&&$2HpHkXZZ2|2P7ZnAv!_C7j>$(y4rqA0G$th=!I{Sc#b59pq*{`wdBM?s|vq;Y;gs`2a`2`nqb{q<3Ig$pm$y z?ZKo*V%S&~@g?GOVNp>0YCn*OkHj$j!Un6;HmlA<=Ce71oRXXjxN#H|lp0VY$QPBA zaBy<2G&or(Dq<$dfag;F_U#*>HTXodwHFWODgpihXdfApp_C7>>pmcjYps737X#+T z+{7d&B&5H=X$59kuhsKcY^-SJ7%wj`IR%AYv+LzXA6ECaF`%=#2utef>aw!Fbp5~t z-%7elNlD4c4gcbCzB*j!0T0?xSy@?8F+Mx{eIiE|j7`|LlYi}R={`@+%m{cse1Cp= zY}R^+67~nA<7M4431Vn?xXIo9cLjN*1O}Zdr^3shcri&OK1O4s>Ssqf{8%H%=4{D; z@d4x#or=Lg5PG&&?bGd=*oXaOFvB35OYz`za-rn8<Toah)hiUe!eA(A2yx&m;dd!7ZIPUW5oX7_0#46 zRC_~v1rHxUg32Uj@Pg^aW@m?U&9xR(`TW_iu9E8$9;daXR3G(K)!)uek!+>i*1NmA z63yzbV2A;C!Hj-JPD|TAKK>d)N<&j;HueX|4FCS=tEs6$yunl%7?6bl&|+3xT#Sc@ zCyChwq7vYt<{F&#JA=^aKX`KW4T1C8IB)bud9QLqH}4YP?o#t}b8%@mI3h;$xVgDq z&#gtgA-`~G_CO*)8Ek~aNn2T4uU1K{aS?u$AT~3jaeugp3ic%t@SGe~5EX-Qcz8fV z*?KxTJv}==2ND~zj)+&C=cB8d8pzDsVLyNFkZ_2IbY@CKm>3&_={sDgEd?KIZeAJ~ zKz6wXVc~qs!;1mzCPG}?8&L9r5(MH6O4Hg}&L~N+&UMT5+xudk5ec%#%#e_fjC#VC zTD`nJf5tXyo$c@c3K(9>*TJIXhd+99FaD1gV5xDYzrSGQSgSi{cWvYskLlO1As6re zWM%@E-@?equgfs9Z-bcrDxZmp>J_sP0YM7!%sqv{1-VRH6VRkpnNPD5l9MG!xsVZu zRFt)D{s|GTYdt-!{`AW1?k?dX^m*#6lG{>Hj$vdl$zfCg05GRp23J^sFd% zet=?7N1L#5=BltD{P7~VdI<_YjEatqfP}>B_RP535fc;B%j>zMqy*%T_cSy+dwckR zd>M1LT3Qs1xvp+*=clLnd3k2$=I?1~$F)@|5k50>cgB-YVW%Mo5*uLz88-MQSd zX?CBkTL+;xdfsDWy6^x;2#ix%W|bF!GHsDwpbu(2J4rn0>^g$%fgq^FeI zcdZY8?iYX}l~0eHA>nsdP*XGgg)8UHH#6Y=k~&pYRLn8})7)73y_}nb1eBUV1$(Vg z4-yei)h_2=-)PLu%<$Ny3nWg7co^hT^Uf|UHpVgurb`9FDFHeR^7EU^m5(?-liuO3 zwQ1#YshF>|VFnwM*Y@9t&)yp>EUMR9uQZV$qw~_>8$7doPhEb|}G_^tlO4+N`~7IGFA zmkgw&Z&2jr#u>HQ&k5)NxR4($?oyB&GMPskiFdnEmXGj^Za4oKGvjgo7)JQM!n4^! zT6$TqR8B_bM>Ye-n~P9~Y(OcUd~XU2eB~pE3smJtyCsDHaPvKmeSl5Kshv1DaCf*p zM)^ycxVOFO#j&G4iQvUB^vLk_k0|?yQF4e^=n5z z5=_5Ff{@bDp+X|#Io0w;sPPq(d>lX zfv9MDqzU;)aBy`E+AJKEjQYjN>cH@DNk)b#*cRl$7k$(l?9q9J`;OPvDsFDuQ-#-v z{)m!);--o!P5m^r7CJiDtEyYCJ#%FzF0Q>KDQj-;ma{p(7#rJOSz-iFdhSmvW5ry; zOi58jcXhpbAcF!vjxfsC@K;uI&jav~59&+djXR=6qL|`lV$eakt-xzkpN#jH{K|jrEtq!^5bks88`9@MMN)#+R1D zKFmM%NmRA8cs@PczJC20Bvc?@{-G{%OU3Gl@bxJA0Ast9PIBd;(dKb#>clL!XGYY^j5Is(-z+l zKFFv}4UZ~F2zsXr|AvOhrP_`R(Z|PC^Exx^%$A3}JaY|L+fV!M%@|k&bMqm>>GdPv znF;w1l4F!9DU675Z_xRg!A`i>Risf767saNVt`F1sK`jcr$@y!5RU<_0c@x0=g(I_lfH07 z3Q*G4ez@G9>HhBput=G*DoJ*tHF`wP%oHlu!*s9NSGnP(nwl964YGy?EZ3$_&s4Aw zTwIyH5%hOay6@h>W`=t>Ks-9lGHK0!(KZfq-T314ULRVE)K_Gxs zMMg#z3E_3W!PrG8BNNOMI5{~1W&pxl9LOk7B;puwX_y!otkP@M_y+||48+I9ot~X( zYG{NJ@qF9tk87sZCIINWNS*B6J9g{EI^Z~2mrz@393w8c!!zt^LhkMBQ&mNs8#3j0 zzxnf1pmh@d*vyh35gLXk7HdKzc==1T=-+-ttA@e!Ly8+RRPNfAbTO+fTc4k)0dSE1GFk|XPKMl*VS>ocJ1l~ z&>C>BfCL02?8NxEr{h#J!QtI6^8W_ts5A&K=DknPuA_v>n@S0APs;(wcZ`(;NT!qbQ z_H5!#PSvTYsXu;59v2=h?X*1+JdI@h37(vsZiFNPO=Si9+!yfdPzF*pD9>BghpW1%E^>4;*-^7#s^y5u$OL3?`nP*+T?@ z!(#pF3RD>v@*e~QTD`r2U*rB{6{Z=n+szkY|GdDBv!Bq<9tv7Wfc^4O|LZ@QuNDNN zqM|pqNsFS|8XEa|JIDngT)vZ&ygE9LHH!O0loK#4Nk5xxZEbHO2eyW=!?kIyTBP5Er!{Zg6nW$dJYJSH!}PFj-E{^iD@R)=KWNG4q#7^G_!0 zD+evyT_VcPn-TzCqoZG+;YakO0JEW#lx*UO2SZXelrZ0pmmcH-=?gT774BS&jPkm= zEp>G_Z9XtBcLaQPKy9d~t_E^|jkWcW9b)ez2m^rLPhv3+0T@ocq`^7!=LKt*nZh|V zs5?|u^UIhVyAZZ!NbN~2X42HF%$7h!n?#ou9c};guv%8O-a6dR2c%rPbwVVhki;W$ z<}=_j0&*0YQAtOKFksTZNTLVAoufe?s9iwz0XQ^5E<_=~4jUZ(;>@Nv7JYro*4q8xANx3FvHBYt8mMFxMg|&( z9KT@ZmVZ0!yFLFERZo~BB`I0we%tkUZPvz&i3gi7S0{K_?dc8hbxvkW%`>3d>{$qU{!{44=EIMz=AkeBB^#0;e z+}euI6CHp+y1KgJKWMl<-WjQU?ToB6wQ+Opm}~rv@{xhbVM~UXn2d_!YK>4b>uMs` zZ*&iV)N-L_eQ)X{@Ri9ohINeS7>5>5tG)6C_%A=0XH8)p`}_O1hFIn0Ti=tj{G*rR z_OV)UfAb~>90jxVwNwus5Q1}I1ovab@qCeeORlc1@bEz_I8*4W*a|#mDvFABebL6I z!?2lveCr#a3y$!rHJ`wqw9sw7yY}@BiH+5sv@n55U<^u5R2M|XJ`a=Fs2R9#R$)5G z(36A0fmJpzAfQy!>1QzC52i2c-4keNpESMzE0dMgVHiPek-8m%Sf?>? z-W~*D2Ed9QK!z}(h;VSI-@pI2UWs~{Job)^%wnlQ`Set(_lfmGc1z20ui5lm<CYckp2VT|| z=#dcn>-zmhRD!jh{*4=#*VDJJd%14cMXYl_t)vE zzasqo7lCeMtd$A8Z`a2Hi)E`Qk6)POD40&tGcxiTokhk%NCR!*iq70HF{4aJbo~RG z`R)DJuU2JbhbpU=JRa|g@mNjD>UV)tai!7OYgef>fsxxff{G-)F@aH{={u(1!8R%$ zf7usZZ#fBxo(kje)<>!}FamRwBo5>hE0#-p4$n`WAQBj4|IW+n9Uk7AEq6jgBP{1i z7tcIgIZlW=y>0gkI{DqkVcZ`pBD4< z)D;y8NYYO?`cj&j3+nIN=s}K5uk>$IUGkLuHmL+qa;)s0T&}Kq`rf;zCF%DS_#j9>8x#0h2{8CwBHQ zyYWOl&MHWhEtH z>j7XZ0CDr?CUCOP4gFh(*9 z7)XYPLGGC`d`YdBuGM6M+?5K~PdMFEbMc_~NYtkhQ&qf1jM485a9y zV!nA}X=4M-2>x2&VDE?5vpC);ujHJeW-)ir%NQYeC}4hUl`;g{S|DGTY#Wf40Xonmz}XG( zU#^7n|6XYnE)e>^OTK(@f(HezcSPKUV5|FY8(6_=tEvFJcfUP*M@1C~Y_l>lGTPeO zz!fr=h6|jt;5N$`+Ypju=0m7*VEC9){9O_B{(3~KF{uMYio0l5iDg89*?C#|VRBo(4rG;L1 zUFN*RBYy%(Q_*u9y$cGyN=YG3)6R+lcvJIhf#3bEY=1=OYs}Q_gqfv!(F#Uzc(IwZEVr)v8TomZyB4!5Dx$3pg}LCv zubvDlb^*0N6RyLv{H6Ic>@-d_(zq2Og(p?o+B|MJ{!=C_oP@7s((e5|yC9Q)<~?+$ zL7xJc%Ir8}ijq_NL1UQ@-r;HW%h`FKOc~Sp><=ds7Z(@*Iez&5*EaW1r{+NG z$;sKl<;ueQ+1-lyfS33K-+{(84;N^wmjOzN@F~KXm=crFp|a_5EMi^a5sNh5abAm= z(#;bINemTl25%@(O6FkaScI1(8M6Zenn2gOuLQE0-NHs7kSzy*i_SVvrC^<^c+>QsZQYWZ^R`$2b@M@JH8z69%ZJcN_&#KlZ`Ms=T9CB{+Q6=ymaTg|U7Fh4 zvjDySga3q%{*NIvK%|I2V6CpM`&36hk$<3dzqlHUYb~`jGi%dC_E)v7LawT*LCbD| z1dG})tZlvB`HP4ScOOv@U(iVvMAYc4PY>Hc`|^0RKlEE?Joi_M9bd?Fhwj3e>S#|JiJ@%0o1HjUUaRDMVE{g>`kl>~eKRTK28`6JKDB>@h@0o$OcHzIcarT1ZYu>G{ zUMW+Z@B>sTsC9?uC~XdAS3otINW(SbTH=@6sgjwW_sNje>)^>K`HZbL%=Z0QT0L40Q#1#t-gsv320B4@17@najm@5O0Z0+wCcP=O*I;dY=?Pf)Ckw}PH%4H zo2DH#h<%`$>MH=2v@T5qSlJBZGHjM4(6VC`698%LRq|}5h){W`r+bJjdTLK zCwPe?`gu2j6Nog2gNQ483Gm^-h2~3ZWlao~u5J93SB>MaMfWnH_H}N7J0vWE{<7?-tt=SpTS&W# z6#zGdCqWKcPJodPB>ooQT!MfemOy|1A|MPeH8_E30>CIKDG8t4d`&OyZc z-S%(D+sn&K&=Ujfp8}8!=THG91jx?0;r%2w5mDG@uZMdZIS^ z`DW8v{~G^ImQT}C9U+}^L42Iw@o{lcT4)K;)RdF}CR0*V%PlCFpPcOK>|{0Wj|B^L zV|#m`zdxLq?;{V7+h8J~^nig#Lqh|2TFIk0Y?j>tn+9rr;M4^EH_&PYWOAPWMle>C zd~81c9d0HphV9s zF7g6_A6N!EJ16GnL#h_En*RJTw6LIylOF2rrJj&| z)8}7#onv~gzWd*uy&chfU;qDf_KG1PA;)&pmA5WMB9l3M*-n(ax;~|Z;{2BsT8?i7 z*j9MWy=_3Uf*!Js>eABV0@Xs$X9WwBxS1v6MLP7RtQrsVIupt275fXN@x_)+Wc&xEH zHyw$eZCR?x-gK+2ajt1sR#C~y`^}X>zO-?aX%UY919vumKD#HIA{gbBWQLdFO4Ijs zu0Ff?lcMaHgdEYwZS%P)KQ)-wFlnm1BAc{#qIOM&LIzNp)jF-7pzn1b?0#`^@!p`J z(a{soLI)NPVCpzHI6&hZ0LfN1HrHoo!Xdn%xof%U*o~8ihX?-EE1;crjE!MJ^lfa8 z4-aK2UxN*Z^FiJAY(uKM#*8f)G)#atF;I%6$Hj>qBWr1B00bK$N**Pd)$Dc+i0;c< zyqK7Q6nn3Ni-iSz0ryR_{MBT)iuKQr_CD{GQIwQ3 zqh@w@?dInXW?7Ymh3EUsO{JuCkF9Ja!tShg$LRqd(fp~|Eukoz{g-sM`;&G?LBZSC z_6C=GNyf&{x6=(S=UJ(#hF><+cy&3LPEa5jBbI)-&CMPeba2okuli|w`RUynPG`Fd z;Y-Pb@z}Z^S(-$etUk|^1_x=QS@E1`9cY79DuN&o0AggbDb{I06Gy^rjiFqz%W2U zk{%Kg5+8rFm$CGJya4flx%UV`g9_>d1sRAQz?`pBXY2E%czt^MTPYvJJHWF6yUb5% zTmwrSAxTL|Ik_XCz5q2HWQ~o!7(n|0atbiY=UYP{s~f+}f|-GVP_`225u9B&^vXi* zi|BuR{@Vn)XNpS&*1Cdu0ILLg7O5crx`Hno8Y-`k_0p21LDg7TTFUQW;$ULZ6dCy= zJbX2t-ZU$F69IOy+^F4j*wXc`>fqtlN=iz;tBVq}pzmyMMn?(lS0XfvK|=*iE`shP zeAms*ffF9*W#*j!TB^aRJ+6-~>mAVXrd}iP4S{Cp+3@fh;GmrtfQB3#fd0|+_q1O@ zfIb9ylvp=0jd+Gf%jOjuc7Cx-=|5e8a|*8Ak4us*W7{U8)p6BYTUPZ?dkwvk zn2@%!_XC{27DbufHF;c4o92!j9xPm>!V;4CUD;4Otc-iGoUssuTb~FVtjK*`Io~FR zw1va*u;rL>9ojZ{KHL>g)Z(6B2Zcl<>2a>i;*`VCPEm6$GKLR&02Bc-B1qOy5YRgb z@=qSRI2XJOLyevX6b#IMY;4| zmpt~7loWJt>MSj7NJQ`l_F@oX6npUog0rC} z)pv}=^#7}|KMUa(i3i!l1ZV~n7AZ~TKO}y0k#1A=zq+pGuCs8$#6|9WfPqTdcU8V`)D4uDIcKQLRb7i1>C*HxWoru$atIpUFRl{_ykl^-OCY z7_b0o8E9jm#sy2EcfH{^5*5zE3TvpW%z=>+3HYrB$%!An$lzebpdj`sDJZ~0s%m4B zQ(8-_1^E|##w2kOj*Ns}ka&6ux!qrSdIsTQ*{odE+Zqr+1VNizw32qJ+ljtlLQZZmG{wzmzhwk2aUFVs1uCWdE%Fp%0^vW{JL>f@yh%KtRn? z6<@@~&Hc#hmzTH0_{*@@yYKIn^OO(h?<-W3$HF2Zz?);qNlBiEhy7k#jk&*H=zO4V zd%oqhWdzn^iT2#g^fd6ac^)RKd4*hH2?_na`u5tW|7??(T5hqr)_JHmqp$CMclY#V zjrX%&sE(*8U}nO8Ab{pGqd%8Vq*PSX;+6zv`E$r7D<2&Si>nXEE+zJqCwF&)Bd|<| z?nknU{xqyjwB`Of{52wy_Uta93`6IaQ7Lqob(LG2R>G+fLHSi~!hPqtENu4M%=OXB zQl0-{^~dmF_EkZT=p%sKt}df+0FIh^DPK7(@^=@QIyFvoo8#Z2a&o}_*J56SXPc&;5cyT^d1LuP_dL#Dco1}rnXRMnMsAsS0 zIPCavMdHrH^U)y@OfRuSsT97ttAA~J0*y%5SVw>B|HfCu3vK&y5HI|owEkGXt8v20 zqsl`hLgWeMNo%ZMIYdbw%%>$hzV05m=?Xw%d3pIoCnosC0u&S!2_H0A5|b6PKwYdc zdyf^GUs?((i56h50zQa{%LL_IxxbI;s017rl^yM!^VNRA!4W-SDQqS`Ss)ojMYanZ z3n#V=X-h;q^FrBn(&!;1Wpe0&?)}df*DbBjE*IzvnppzUiToZ70D&C0KBGat0}eTj z&kgwM=BU=U0gU4%)&q{yo^`LP4p%_p0V)`@FPxs7w5^|BY@)nDg42)%jm)r+f7{zQ z*w{z%0e(T%|4(0E9aUA=^?O7>+Cz7j(hZUl0!j%=NJ~q1mxMG(s-%EYA}Jt9tANtd zAt~M6a3}9KzWdKR?%jjo;Cb}GKI^Q#)||guPN<+T6LtIDke!`ZUHxZdWT4CTPVeU7 zt6S~-eOo&A+0_;9(UWhDmMAg&(Erd~G2|jRIXMx{73Q7bB74mM2)CRlO4kGAOWIqj z`{8t}te_PIXkOtG4Y42VDkA_}9Y|_Cf#8QCX}~ z;$ysHqW{aNNAtV#TZ8)Jrv>NwV7*J(KDn^$-bq~^KFKYhM<6QjxVgD+Bg!CjsVc(AtRjc@BX&C_BX^imLuUO2t&U5usHSjj4{y0GFY z&WG&VsAQz1P>VsVKn$gDPj@$NIXe7Sf1-l#aFIz5nyNq9qCbt(k~oNU1z8jzNI+J? zpD==u#SmSw0$M^4l?ez7S6X5b%9B*S-dUYj!hTe))k5$H`w>8v0T~W-=X|eU^*~4r znCuuC7?$^fg5&5=u5bsRN7Jp|_)IEQROa!45HF09-$L2T>mK5LPL7P><@Bu~VA%@` z3p;H5{rv$AsFwH{$ki-^gNrlGT>o7c?bNl}V_0jjsEDtU`%G<_|Me^U|KicRt^HKvI|_G2L4ds<4Hflq;UF;gP}go>iR6F=0eYXsr6nLPfZ6tJ2|{bIk>w2v z$6rR_kW)~|7b*2zRzWW2{aaNVQD_*Ky!m1o1P<(X@6wmXiE=0D|0c>Y?#Lr~QI^oqo9{1yu78iT$Ed;~Vo@N8^-tN)=}sdx zb%*X$NrrE?zL!N(nBe_~?+!l&ND)ATS`rtdt33)p4HC~ePFQno^2oK+WxIGiHubf{ z8DYS5Q@HhL{8&?o8$^nak2e_&QR2kcWJqD&iPL~tOPUTTA4encCHK|a`Ieh095QPT z0{9{KASeSG#7csSS6%-9dT(ZxxBIno8PM|jahbMak&==EL>v$hP#k(5_2I(@Angg! zf`fu-SS6NFN1Rv9wixB+4A8a6kz?gMQ7a1 zM~I6xJecs1cC5j@{QgZ(knS_Pj@IPo|Bs7rSO#7Bq2WVSlh_G);s4-k ztaZ&GWY^Ve+Hz20h~J#74gO5?r4RCW%G|zIq;5o44RAt(HX|>8EOpQO`SO}cIVZ*qlvYB@6AR(q2A?@hw%=JJ; zLh!}w#Mv+etadMjZ#qynX=;tO?^shQh6JD*v1WZs69WR8BV=Bmj-S8s(G67X7pMd2R5^DSz|GfJy}u^ z)f8?!DzYCQ7iZMubwSG;pcs?Vs;e~pK|cSocCYt%)Dxa{FreySw;!Or!UPaU^6S!! z>O=;vAg+$hN^o&Vag-jHym)vZ2@h2uZ|K|EFRd>?37gg}OnY0bM8FW!=HAurotggm zPjQ4Mgfpvw&r#N~jUz&9L$8PfdeJf+j2eFG0?P}MkeSMs_z}ij#@uW)9NPET#?kTd z{R83oZ-fl6BnhK8s8p0pJ2OLl8W;S1$oCQ&-MGy}5C#YzNISV&JV>iMuQRCr2IV48 z|MuaK-pI3(sLv#~ZlOnoha2bI2qJbg3}i&&<73vr8cp=iVtw)Jkkf2iXz{3FiJC5j zZpnJ1My8SfRgWL^*@psHvv-V*0)rjh-Fpqjt~o+EQ~X4FG#DClS}~{fxW56*sjFO5UvxBW$}DfF*WE4TE#$2+O)z5G z+u1cYw}3!|YzDH{q2{XK^jJVuE-%gmSzicM38>Vhm)PWq4S5#54u5=QQ}DT1B~GO` z`d6272RI^(HY!q;S;Ry|VP1jdZF_I8QdK;J9TIS2S%BvNl`tgt6#gn)SXcm*uKy^f z*FltHx2OkeSHqH%ay#X6jL{{#D5j-||f5NA#Pd+G>on-3*+Z1i982Y|F4Hz!ni1(P9*=j%$ehUi;azcTf^3D1-q$0%nPAS~oxg!OW|r zm7<;EapZdR+8bW8j8pd^gb6P!@lB$(x<>!N5Qv=zhK7=plFpf&A3O++iBa+K5hICm zb8-TaP+%{bJpVC$pa#qfP{cv$g9wc8^qJZ51b_~%!yph_^4BP>ZfpSJ29`*GM2W&M zWrMK&QQr4AHwQ*VDcP)r6}E?S?=rHoD&+RREq%zO0rp!U7Ap+yqo8Wt5C9Q!NpUfi zcP@h=8V_05wq9UnW@dPJIPh7F6WC05jEV1OfRQ2Z!v`RVajP8Xc_m4rsJ%JCY+YQe zOov2np%Gwg*CJK{0_K@Ml+}CSl#4a9bDWYw0unuOnkLBdfQ{wHw?I_1dXoDYp#21f z7yw8;X!$@1rmP%Iso4xhmd;LiH#We$-@6x7r-TxM;mH{&4=$D$4h~@Wi)(1OfZQn} zVq*NQIWS9gk)onJ2fGan%H%TKK^fM2{7@N)cjIPbOGr+Z@HynrJ|iF{HL7)9NM_dt zY@lr@mToY}1Jw%Haa&8v_DVZlVcSv1h2O+j54MF=f{-^pAt)Zm%Y*YI((>=@j;E#N z62R}72N>B{#V7>>!^4MAp+Z@-Q!xPc6A?q>!5~e98^FyF=%PX6fXe4ICr3=2yuNO0 z=#G_*3a@cFSk*L~!o$JD!;^HHL)|(HJ;u|z;R&WHHJeJ{}%NsC}U#*=4^0P#bJ}o16Cj%!nN{_}c`) zIo8*^+BXoe68QQ0g0=oQ8S#S@hC~sdBU*=BZ-wk9p`84g{jj^w3h@b{3lua2PeI+Y zBa92htDfFONC@g>-i;lCVic=u$9}>}1CZAMfBy3zL2fm(1(Njl_xqBw@FYNc@a4c8NbnVIau_Sb#Enh0XJk;l&T%>X%TX=rE|8TD?- z(HRD623~=`2L=Fu!sacxOIq~cF~}7HpV)B*#t-Z=tZgIkhl9cs+>uR$C*iQ(0BHEj zjIW9C*((N4&IYqz2@u7wD~2DwW=uR&2|pDkU9|`KT#-te&^6vw8->sG zO7 zd89#y0sl82NC1AaXu#C`Sy7zub+s61si=wz3a$-LDk`||lo=8q!j2Aa7cg}`J`r;A zbm-?n>kW#nxwOL_{5WlLbG65h`{3t5Q*{DwlamZRxTUnw#@ael(l7PhyUeVtcH_P; zRf7Bb0+^_pRCrO}pPQS3cbZ^DB4SX9;b3^U`svg9PbL1WEG&}dkyQ;BuAqE_u%20BR8;WU+e(Dcp$9()C2V>+_=tM8^yx}wWQje`4((iBpW50A;IT@Wwk47C z7u(vhJbdK8CYD|5K*#>+j-VhnC#QpPV4ca&N3>ZB%j7<18^AR{ABJY~eiIx^psa*i z{rcXC#XqA!d5CrU_S&-5!EWlx!a`Buuayf&6_xoao4X*7rw~@PX^%C6XA}QdqA=JC zF) zcSi@0kPt~R0Rk~v=f+MY&6M<218r{3zWd$0`~EVR@-IGoINp8%nI2yMIu^l9)0MvB zx@AbPMR?37P|Wum9TrQzcTjqD!9x{7AE1CFai@c|2}GW&tB*S5Exu3GbStHtuP#)v z@$iIC*ZKnV3FOB!EiI5mq|ob4b8&HP04w-K zkGkCLtWFcYozny#Y?)4>UQMfz-7aWDX8pFHF$HEd$Ph*c6-63k8DPbRd+nGhzyc5J z@#$&0DDj8lXazQUdrD!|h3(lGc5SYFjY9EFii}Uu6}L*HnUqC}P!!@`O^lM&)sE36 z<2rEYFBg}Vx*x8S8@dBD_U!RvIwXHaV`xT(0T>rye6D9*^QFs6&|Pjdd2rtePe@6T z6Jn)VUh#6UyO7l#C(Ptjb_9os$JP`)bvt=tG+*5}blu&BCTry|%8bw^CoRy?d(tHI znz>M4ogYAKk;&}AT8-zxU)W|%O-%Op_dN%wZ$G|61ZxazZZFf2H~fOS#e(2_iqG1P zN{~l7#y4_$YCTo_>6yMh2TUwwW?&+?xEg^%1lVK`R_G_ThS*>0M7O4!oL8R`{ve$D zI5{ND+P}U2I}0 z;G?RFmpsnC3_qX8^wmM5pElsf=GNA~8w~FdJ@WOff6uY_cY1mny0E^!KHx|OM@Rdo zrXGS_@`oxzIXDC>KSjwg@RH%+pno^!;X&*l96^9WM7ZxljuSQz^C(gpWXNHVF3vQ%X}CU{1IaI?P@?d`OHIS`NNV&w2`)QYP-W zH=uV({@M9^&Pk-cxOn|7Z#dKaYz;9VZ_$SzdNOHD)Nb#&*;rbdDkxybkIFDr<42I; z$Ct0J!i0;u-}h&Dm;uS6{PsQ_64jN9#JXG`4XRFC+dL>RnW^U63ZACEY)Qz;83CGC zf3I?61JJ?z$w9oFh#jzF?z9=jr7#zYhZMQD` z#CU+GfR&-@VCzr{q0jJTV_#xp_u2QTq@-M3S>HD(Ha4@d@z;lku*w4wk&qB{^nlpA zOdpNQ;1tqY>tSX4nuOf48*_%$Bc(=ITL|0M#>U0b@%U&uz)N4i$J^T(j31SidxrI% z1{yg`+z!u;jkELfOFw=T_CFW7(KNbANmc+4h38rI*Sfm*_2-&iwE(|`hW-@Lo7l3o zjgF3P^bSM8ZFeSyCQ2kgvadO?Im7puPU=cUv7<`NW7CE47?51x%8$U+9W#>!sZF2; z^Vy$~c6UF#A8;k`!QtV6VMFACp^Wcy7O|IcD6bOue`u#il{9M7yYr$c9d~Ceuoz(Q-ztsK@cZ_t- z!aKUUTpf{t1_C;QcBx=WkBy4Lu6Pcg7c`Y$pI$2wuOcIAscGYA`7O#52ZpG{FihK> za~WSUvapFhGYY6^^e?M9q6ojt>0ZE`r^$km18Q8Q8zCl$sFPodY4-e-_ zIc1Ljwt8rnvLq)TgoaYf3)vbQL!vix1!dxs!a*25eQ}SH$_BrM^|2^@efhoi%bMJQ zm3u#b27Jtu^u3&PnQe9R_lJ3Ru8PG8BQrcq5)l#hxFU}(sHkY_^D`F#Mn>$Gw>NLz z1Yt_4Q4>vYU$6&73<)8%-||e$ma?+Hep$2bYf_FmMrVhus-&d78V5=;%B|bjgcUb3 z)}PPD2DTUjdxT|#i9kSQH#pSrK*&NvBLPN4gLwvuEbu|7^^XJqmh34gC}$F@%BQn_ ziiSPhofRM^;RmiO_kny`NoUls?>l1L{wA~7$)J_O#eM4gJ)}j4o*D_wk}MMeesshj zTkgfhg%ldv1_sut&DNAs(|M~krZErMJ2W&h_D>4ESpl7Hv~5_k0eY^j#yr>=8Q8fw z`%Yh9XlcRfwcsIt{zHZsvfl%FTS2}_z@Dbv)T%ckQEWh z$>Ce3qxWP0G(cV)Za?n%`N;tAsnHLQCBRne>+2%X1Jlz|0h{`^4qF3Jq_|a8W8p~e zl|RFYtTzxo+=i1UxRrr5rTUnNw-6-OLF-o?KOtK8Z3+EWC)|reXG%|IrkcO??0j%} zg~{bu^J%diNbv(dD$RdyMG>-9JU(*>(I64$c={5|LMkf5C1~zjjmFkRXPbX7ekI}_ zZeC=J6?_tF`j#fXJA+Hv>b`mYQc)SSFAKM&Lii{_B41p(b(ho5)a;80=LT9OesBvD zlUYGg9gtWjN7L38rh0ly>ti=W(u3c<8;K%i=2*Z)^bJ0J0jbCb#a9G`g!2mvKc6Gf zgUiikWh_nSFZ}&Ya&p$u?)mI3e%^LO+;_EF{^)T0Kx%#KHt+)5R-_ zP}xiufPR-lWK=;_m4(ju*`we57L4)7A{@2@9l=pirQEvz7?_!PZH7I%_;^JWcaEee zD1F|4VmIw1$vRlOjYoa{@1gXApVLt!-Ny@WD!Wp${6(MJ77vWRrJ|^7>D`*?I5uKo zkJ=#LQU6{IQ?pp2tjKJ|%2#t9AM_b3!(L?B4rug?gGJ2I*xVrM2UvmM)Lj|-zU8X07QXc-#h`<2;p=Pg4G z2kwchM{HPFPGNXxw&R1H(#V#d8pO*jvpSR>{gact{`C~-rXLFn$45sGV=O~M^v9b5 zZXzI*x;}gMWpZ--hYum8rI4|7a}NQZo!gr8voT(O|4hiGvJhfnT>_;QO4xV*s|M5O zvw|tRz|=VYf$eyxQgZEoI>+=<6C(fRzH+e51sA9Cw=?n}5s&rN>G^F(yL$6g)e8n! zfBa}29qo#f`bV2CiHq>`+gr4xB*$sn#3uE%=-u=@KkkVjY|50nTCn==cQ{GUKKZva z{{t)zuHNgxx7J8F;EBbxv+Giz*Iivz+1U6V=diL|CLj=vh5Na|M;q8t7f+G2D|v9g zxC#g~)>KBxkA2{tGS0?&{fmj5JVjxo-%0?Taf`Ak?nD3b<)y;@L6wl*>9%yzyJyCB z8&TiyDJlgBgsQ8kU?SdsV45B}nEgC4HkSK=sn^9a z4-IK1C1T&kQ2f=s;P}jsRH^fvlv^Z%?!8U{3Uqe@6gGMnG1Q+Xr>4*l1ts=m!kg^9 zM0bda-i-7VK2bTpc!MVh+jdmbRmI{W5#LE}{#OXDMg$%nazRv^MN|b}V^#7+*tr0O zLDFBJtyxHHfKcS6-mKo|RJ^?9YEw+>FE-ZGO&x9{6z};QdahsHzR2shk}Z9pL-nF* zdnrrp;^0kA`s7R6fOG3Fe~vxn4QUv;x0-sW8JOwIJAN)`SzC8qoUKVn+(3}wSQJ+{ z`?>HVW(<^~+S(J}8zv=*2VBfPdMu-_uOSok{q9Y_n>Pt^optE3H4$Nn%<($kY@9u6 z8XW0MzNPuj$rXpSYty`S7<2aRp*maW{2L~Who`}!@@Hd4ma8@EI6dzF~)nFo8yn(rQ_x8@9tK4^eFPXhz^IAw0e2? zd?}~J`7z@jp~e$Ux8pRk*oKQ9m!%Gn6WzS&1A$NfB9eMP52|Ksz{Jg6>J50-;0^yI zI2{fQNR~gd7Rc+(6gv+j-rQ6_+Wh!$k?UgGq z&*~^S-7+_uhi-0HGc%1*q)Td9J-bak?IrmiyWa{%eWwcwuVTB;a#T(v!SsV$_$WCq z4+4L_Pc_gsTDBS&zcnJnYcLiKkhEX;-O$yReb{t$X?L)Sg;11)=ysQtnkOh$R`SR+?w0{r9B& z)7!?hI-5$KCGPLvMbO=4UmFB%J3LjNk4@T8iDyNVO#cFQU$y+g_!E>1@@H7P1B zwHtkEY`Q5B&0R5+D>&!~V@QUTIy>#b#v68YSz}2Iz@D>mIqeDxs*#(6+Oqc{^2X0r zj5$hS`+DD#I~?l+*!O0UM6Q2+n*W-_Z#w1h0;wAa7Loe;wj(_m<|ilR^z;NqdZSyN zJX%_^Bma~=`1n=8Puw1hhDaJ3>c+<7`sSCmaoiz4-(Xp4_*v4EhyLzEBcrV8+U*xp{IrD#+9T z@@W#YHNy)Emz$e1_(qeTx2a$Ir*la2_>y#c^xN=oaD4n&sZkh}2;|qG_~(DOEWY5w z$Iz9P^$3Ape&a_(dJhknsqdSe_E|y#O!~b5$-B%8>Msh*-;C_ojMV+gA`iv&8;`6Ku^ti3Ma{RD-r#ZXOvxIJg|IEa;XnWj zLI9-lIvm%M#%=f&Nl9pGYP||kW1@DcL`P!8u0y!EH3I|le0*j*o>w!*5M|^kAsAA{ z_BtcO?{vR~Quxq?o4)ZazvbG?o2*^k-D9yxz;m;*0#*m_qE?>rLDo@9iu>B>0r*P_ zSy(m)@@mIM3tBjDhQZ9{hP0X2X+Fa2O3E6}I~C?pZ#eobY^?JfO+RDd;Nek_Eo*AE zVLqY$__*NoREdq;w-P_rvCBb6-tUW1BA@IY-;+Jn~U~_U=Ea( z74}o-5E4UH%?M;XMCN}Dq$PBaQrFf#0!nnfs|%vTB20LM5?P+Dtfj52yiSzxF!PpmfacgLEQ?o zkvJ)P5C@xxwKn>lZF~9}8`A|nb1G?QkN^W0^jwN}sb$;bhb2aWj`K)VgjVdS@ zl$x3Xv`tY_T>=3`(aqo%tBrMAduU^=i>|+*jeSvQV{5y$`iD$xxUcW=^z~QYj~_ty z-`W&wrFVB{$Hl_p;eVpjkeb_4eaC52UtjiSaH3!b1Vi}(F?)Q)8ApE~a0ov?KWGQx zvQts9b31@MA()cWO#$3oEO`*b1zZXfYgqd%k)ud`bXTAKHFE6C$HzbxogR&Y9vpx5 z>V&jQBI;J*;E|sn5nJ-)gi^M~JH2H01Vv!L5|uB@^j_Go?eBNPKTG*tgU>fv$^?wZLNdWFu$r~8{8sT6S`(mQNNH= zQ9%a|Q1t5ZG9=ucm$}@FAB7YYMJ9^m@qq!^`~k>%Ajgr{_BhhM`RI|Nak&myl|f4$ z9u?Ku(GeaIHBU?=dENql5`owsG$eApJd;Kml}YL1Mg4pgLWO}N-ZPsJSFeyiaB&eA z8b&+s*cAYb+ELzZX=HENiK}DBc-1F2H*=5m`_6iX_7hcW9(>PM|NY`mM+N-?+%BXm zJ3C_(Yhg(H{#Y^nTxrQYI<8t-C0JFH6|E>UnUbEqckHy2$eM1i2C4RpN=iyPD0KAA zDS$VE0_o|4ng^Sqxdj2%uOY#} zS_Oo)ps+{RyS)M6x4>C+4`=8<_#n?-z$bIr*Y{;Dg0`c{`GbOM;1sHFO##UG!0@$= z4Ol9cN(|2OTvfv8F0Hd>rBX|(LUeO~94_qaf>CX%JBEFI6Yk}mnHj!&fmZ*JN*4y6CTMX;k{4R0$4l9oU1D*~-oiR3`!SW}Y}YiFV~a@_IA z`EO4Tm+;Zgx4fw&B#o9mlk01gGloWH&RgZCQS1z%9K%kWlz&`IOn<++QI&P|w{M?6Fr8iVUg(=s-Qu1+1c-jf zA_TQa=0xskcUKqm)R?F!+CDGoXy#uKlkI}We|fp%%a^Buf)5lFTzq^$#u4%8(XNq1 z`Nz=XUGtNHd~SX|tcV|(@AwUJb4);K=QZDkYrmwgqjNl|8X32fkA(xF zE8gcKoc#O^Ku6{V7v%D*Dp*qCvBq38SI~ShY0&UX z$Bz&mrLMlRwl+~^14z_FZL0NuFs6^CrF7lduiiVfEV1!WWvG^dpP;ai{^~XYjIh5t zt}iQCs$RT^sb_`!Kgbk;b9>^#!{15;NWO8VBqQVD;kk~Ceal;aoOd(G6Z1i*MPzt5 zyr!})i^^r87d9DiK0)#vcFT%Nk)1)jksr^aTjEE0HgPv z0D&nyTL`ypWHb%n1nNyNfV4hGdEG}?#5S|Me0|Q;)KskEml}s@n9A3od<3{bkCh6F zpw9<90#joT8!V^r$XW>?GxLL$!7s_KRov0ty}*MP+yeZTs+yX%rse}CUJMz|>^d-g z!ob7F0W69$87nxIT0<~lMbCX%rgJx_sCY88xSrE>mg_(LpCsWc6I>Dh9?_dUWSE;b-;p8&gv0fD|s5wHwkEL8zL24{Q#oe5sIkJmOkFd7?U2Fep> ze}*9iSBA|TJBlD0<`ynT~ z5agx_Vn}Z8Ey}pKsHnaDeJFb=>_Td>5G1$on$^GeEi?VoGzKOIsD-l>YAo2s3ZE9i zHg>xri0&!=E*l*)^8)POoSmykIJZ2!CVa zz&8>A8iVDn4tP4K$eLoI@DkwRfg%8|8FPDh`ylA7U&jxUpIZ?Qh1C=mBy@BO@wNDf z7USs2UEi;lmy)6xuYUgC<^Vz_`B95;L2d1``gNk~S5$%7Ik2`?#nTgoTkOH-Oq#hA z&dTEqG}M@&B@`s8A9*nfQeeD=4I!ON{r~wkI|r-J>M1*WS80>KKy<(e7cDzGPK^A5 ze4LgR*me*}5$1tRqLvq-R?d^}wPZ$^10xrF5Ei5{NRTmbLQ@E!A zNbvsWi$$F5)R}??hcL#7LtF(FVd4u{(a(8{Dz@uRf>k>YA68*vCTnPzav5OVK!m)y zcf0+Er!|KnfF{=i;ix}NGHL$07E|Xra$>D?(}9TjaFJd@bMu;H2=ohn~^R~ zBm^;5W?!Emzh#l9w`zTW)HwXb*t`_1oDwXHZ>y_kJ67cV{I&=QxZt#j|BTW-XS2Pm z0Gcn=B#Z=la6X@Q@hBWz35$h6!|9vBK|Ms^`FV7F3^GLZP7#W`J56t<1RR*+Dk{Os zIyOA)x2$jruh_*k-Q&pKPFWd_kL-DQbM5U0w~>WWX%_DjLX{tbJ6zvN7!Qd0aM{dTiiBcG_wknr`)4GYT)3R+EIPID9yhwO}hs~z&Na1en% zCNMD(PQeo=VdsaE2muFdnwny_#btrLbIoV^@5OUY%th~HW z4eGyoc!ElTHIDW+Izl;vt;g1Dhv5L;HUU9G*9dA5#Lj7GSerq`Kp43Rrr_AvJut`f z@o$NUbWu)iuCIHY?7o~b)KE~^Q^@x1- zSjg326Y&(Dv%xjDnCc%Aq!!bnL_mls36=QP;Rc`Cw;A+BUD?pkt8FoSt1q%6RS2KR z$O=5#DLJOr47-eO`dBirOg$%hdnNsluEi;xqF)(s4b4P)ZK_x&I(`hR}wDQc}KFQ51I_+9=I zs-b(N2@dFZ{Fe~Y^%*Lt(nzcpF_iy(?dBCi(4r^+UFaDI1Q3Xa4^-t!WQ>FU51c`T A2LJ#7 diff --git a/release-0.20.0/docs/devel/releasing.svg b/release-0.20.0/docs/devel/releasing.svg deleted file mode 100644 index f703e6e2ac9..00000000000 --- a/release-0.20.0/docs/devel/releasing.svg +++ /dev/null @@ -1,113 +0,0 @@ - - - - - - -tagged_release - - -ci012abc - -012abc - - -pr101 - -Merge PR #101 - - -ci012abc->pr101 - - - - -ci345cde - -345cde - - -pr101->ci345cde - - - - -pr102 - -Merge PR #102 - - -ci345cde->pr102 - - - - -pr100 - -Merge PR #100 - - -pr102->pr100 - - - - -version_commit - -678fed - - -dev_commit - -456dcb - - -version_commit->dev_commit - - - - -dev_commit->pr100 - - - - -release_info -pkg/version/base.go: -gitVersion = "v0.5"; - - -dev_info -pkg/version/base.go: -gitVersion = "v0.5-dev"; - - -pr99 - -Merge PR #99 - - -pr99->ci012abc - - - - -pr99->version_commit - - - - -tag - -$ git tag -a v0.5 - - -tag->version_commit - - - - - diff --git a/release-0.20.0/docs/devel/writing-a-getting-started-guide.md b/release-0.20.0/docs/devel/writing-a-getting-started-guide.md deleted file mode 100644 index 5653dbef96e..00000000000 --- a/release-0.20.0/docs/devel/writing-a-getting-started-guide.md +++ /dev/null @@ -1,105 +0,0 @@ -# Writing a Getting Started Guide -This page gives some advice for anyone planning to write or update a Getting Started Guide for Kubernetes. -It also gives some guidelines which reviewers should follow when reviewing a pull request for a -guide. - -A Getting Started Guide is instructions on how to create a Kubernetes cluster on top of a particular -type(s) of infrastructure. Infrastructure includes: the IaaS provider for VMs; -the node OS; inter-node networking; and node Configuration Management system. -A guide refers to scripts, Configuration Management files, and/or binary assets such as RPMs. We call -the combination of all these things needed to run on a particular type of infrastructure a -**distro**. - -[The Matrix](../../docs/getting-started-guides/README.md) lists the distros. If there is already a guide -which is similar to the one you have planned, consider improving that one. - - -Distros fall into two categories: - - **versioned distros** are tested to work with a particular binary release of Kubernetes. These - come in a wide variety, reflecting a wide range of ideas and preferences in how to run a cluster. - - **development distros** are tested work with the latest Kubernetes source code. But, there are - relatively few of these and the bar is much higher for creating one. - -There are different guidelines for each. - -## Versioned Distro Guidelines -These guidelines say *what* to do. See the Rationale section for *why*. - - Send us a PR. - - Put the instructions in `docs/getting-started-guides/...`. Scripts go there too. This helps devs easily - search for uses of flags by guides. - - We may ask that you host binary assets or large amounts of code in our `contrib` directory or on your - own repo. - - Setup a cluster and run the [conformance test](../../docs/devel/conformance-test.md) against it, and report the - results in your PR. - - Add or update a row in [The Matrix](../../docs/getting-started-guides/README.md). - - State the binary version of kubernetes that you tested clearly in your Guide doc and in The Matrix. - - Even if you are just updating the binary version used, please still do a conformance test. - - If it worked before and now fails, you can ask on IRC, - check the release notes since your last tested version, or look at git -logs for files in other distros - that are updated to the new version. - - Versioned distros should typically not modify or add code in `cluster/`. That is just scripts for developer - distros. - - If a versioned distro has not been updated for many binary releases, it may be dropped from the Matrix. - -If you have a cluster partially working, but doing all the above steps seems like too much work, -we still want to hear from you. We suggest you write a blog post or a Gist, and we will link to it on our wiki page. -Just file an issue or chat us on IRC and one of the committers will link to it from the wiki. - -## Development Distro Guidelines -These guidelines say *what* to do. See the Rationale section for *why*. - - the main reason to add a new development distro is to support a new IaaS provider (VM and - network management). This means implementing a new `pkg/cloudprovider/$IAAS_NAME`. - - Development distros should use Saltstack for Configuration Management. - - development distros need to support automated cluster creation, deletion, upgrading, etc. - This mean writing scripts in `cluster/$IAAS_NAME`. - - all commits to the tip of this repo need to not break any of the development distros - - the author of the change is responsible for making changes necessary on all the cloud-providers if the - change affects any of them, and reverting the change if it breaks any of the CIs. - - a development distro needs to have an organization which owns it. This organization needs to: - - Setting up and maintaining Continuous Integration that runs e2e frequently (multiple times per day) against the - Distro at head, and which notifies all devs of breakage. - - being reasonably available for questions and assisting with - refactoring and feature additions that affect code for their IaaS. - -## Rationale - - We want want people to create Kubernetes clusters with whatever IaaS, Node OS, - configuration management tools, and so on, which they are familiar with. The - guidelines for **versioned distros** are designed for flexibility. - - We want developers to be able to work without understanding all the permutations of - IaaS, NodeOS, and configuration management. The guidelines for **developer distros** are designed - for consistency. - - We want users to have a uniform experience with Kubernetes whenever they follow instructions anywhere - in our Github repository. So, we ask that versioned distros pass a **conformance test** to make sure - really work. - - We ask versioned distros to **clearly state a version**. People pulling from Github may - expect any instructions there to work at Head, so stuff that has not been tested at Head needs - to be called out. We are still changing things really fast, and, while the REST API is versioned, - it is not practical at this point to version or limit changes that affect distros. We still change - flags at the Kubernetes/Infrastructure interface. - - We want to **limit the number of development distros** for several reasons. Developers should - only have to change a limited number of places to add a new feature. Also, since we will - gate commits on passing CI for all distros, and since end-to-end tests are typically somewhat - flaky, it would be highly likely for there to be false positives and CI backlogs with many CI pipelines. - - We do not require versioned distros to do **CI** for several reasons. It is a steep - learning curve to understand our our automated testing scripts. And it is considerable effort - to fully automate setup and teardown of a cluster, which is needed for CI. And, not everyone - has the time and money to run CI. We do not want to - discourage people from writing and sharing guides because of this. - - Versioned distro authors are free to run their own CI and let us know if there is breakage, but we - will not include them as commit hooks -- there cannot be so many commit checks that it is impossible - to pass them all. - - We prefer a single Configuration Management tool for development distros. If there were more - than one, the core developers would have to learn multiple tools and update config in multiple - places. **Saltstack** happens to be the one we picked when we started the project. We - welcome versioned distros that use any tool; there are already examples of - CoreOS Fleet, Ansible, and others. - - You can still run code from head or your own branch - if you use another Configuration Management tool -- you just have to do some manual steps - during testing and deployment. - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/devel/writing-a-getting-started-guide.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/devel/writing-a-getting-started-guide.md?pixel)]() diff --git a/release-0.20.0/docs/developer-guide.md b/release-0.20.0/docs/developer-guide.md deleted file mode 100644 index a2dc2e62a0c..00000000000 --- a/release-0.20.0/docs/developer-guide.md +++ /dev/null @@ -1,41 +0,0 @@ -# Kubernetes Developer Guide - -The developer guide is for anyone wanting to either write code which directly accesses the -kubernetes API, or to contribute directly to the kubernetes project. -It assumes some familiarity with concepts in the [User Guide](user-guide.md) and the [Cluster Admin -Guide](cluster-admin-guide.md). - - -## Developing against the Kubernetes API - -* API objects are explained at [http://kubernetes.io/third_party/swagger-ui/](http://kubernetes.io/third_party/swagger-ui/). - -* **Annotations** ([annotations.md](annotations.md)): are for attaching arbitrary non-identifying metadata to objects. - Programs that automate Kubernetes objects may use annotations to store small amounts of their state. - -* **API Conventions** ([api-conventions.md](api-conventions.md)): - Defining the verbs and resources used in the Kubernetes API. - -* **API Client Libraries** ([client-libraries.md](client-libraries.md)): - A list of existing client libraries, both supported and user-contributed. - -## Writing Plugins - -* **Authentication Plugins** ([authentication.md](authentication.md)): - The current and planned states of authentication tokens. - -* **Authorization Plugins** ([authorization.md](authorization.md)): - Authorization applies to all HTTP requests on the main apiserver port. - This doc explains the available authorization implementations. - -* **Admission Control Plugins** ([admission_control](design/admission_control.md)) - -## Contributing to the Kubernetes Project - -See this [README](../docs/devel/README.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/developer-guide.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/developer-guide.md?pixel)]() diff --git a/release-0.20.0/docs/dns.md b/release-0.20.0/docs/dns.md deleted file mode 100644 index c03c02b46ed..00000000000 --- a/release-0.20.0/docs/dns.md +++ /dev/null @@ -1,44 +0,0 @@ -# DNS Integration with Kubernetes - -As of kubernetes 0.8, DNS is offered as a [cluster add-on](../cluster/addons/README.md). -If enabled, a DNS Pod and Service will be scheduled on the cluster, and the kubelets will be -configured to tell individual containers to use the DNS Service's IP. - -Every Service defined in the cluster (including the DNS server itself) will be -assigned a DNS name. By default, a client Pod's DNS search list will -include the Pod's own namespace and the cluster's default domain. This is best -illustrated by example: - -Assume a Service named `foo` in the kubernetes namespace `bar`. A Pod running -in namespace `bar` can look up this service by simply doing a DNS query for -`foo`. A Pod running in namespace `quux` can look up this service by doing a -DNS query for `foo.bar`. - -The cluster DNS server ([SkyDNS](https://github.com/skynetservices/skydns)) -supports forward lookups (A records) and service lookups (SRV records). - -## How it Works - -The DNS pod that runs holds 3 containers - skydns, etcd (which skydns uses), -and a kubernetes-to-skydns bridge called kube2sky. The kube2sky process -watches the kubernetes master for changes in Services, and then writes the -information to etcd, which skydns reads. This etcd instance is not linked to -any other etcd clusters that might exist, including the kubernetes master. - -## Issues - -The skydns service is reachable directly from kubernetes nodes (outside -of any container) and DNS resolution works if the skydns service is targeted -explicitly. However, nodes are not configured to use the cluster DNS service or -to search the cluster's DNS domain by default. This may be resolved at a later -time. - -## For more information - -See [the docs for the DNS cluster addon](../cluster/addons/dns/README.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/dns.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/dns.md?pixel)]() diff --git a/release-0.20.0/docs/downward_api.md b/release-0.20.0/docs/downward_api.md deleted file mode 100644 index 737519827f8..00000000000 --- a/release-0.20.0/docs/downward_api.md +++ /dev/null @@ -1,53 +0,0 @@ -# Downward API - -The downward API allows containers to consume information about the system without coupling to the -kubernetes client or REST API. - -### Capabilities - -Containers can consume the following information via the downward API: - -* Their pod's name -* Their pod's namespace - -### Consuming information about a pod in a container - -Containers consume information from the downward API using environment variables. In the future, -containers will also be able to consume the downward API via a volume plugin. The `valueFrom` -field of an environment variable allows you to specify an `ObjectFieldSelector` to select fields -from the pod's definition. The `ObjectFieldSelector` has an `apiVersion` field and a `fieldPath` -field. The `fieldPath` field is an expression designating a field on the pod. The `apiVersion` -field is the version of the API schema that the `fieldPath` is written in terms of. If the -`apiVersion` field is not specified it is defaulted to the API version of the enclosing object. - -### Example: consuming the downward API - -This is an example of a pod that consumes its name and namespace via the downward API: - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: dapi-test-pod -spec: - containers: - - name: test-container - image: gcr.io/google_containers/busybox - command: [ "/bin/sh", "-c", "env" ] - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - restartPolicy: Never -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/downward_api.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/downward_api.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/README.md b/release-0.20.0/docs/getting-started-guides/README.md deleted file mode 100644 index 35ffc8dac15..00000000000 --- a/release-0.20.0/docs/getting-started-guides/README.md +++ /dev/null @@ -1,66 +0,0 @@ -If you are not sure what OSes and infrastructure is supported, the table below lists all the combinations which have -been tested recently. - -For the easiest "kick the tires" experience, please try the [local docker](docker.md) guide. - -If you are considering contributing a new guide, please read the -[guidelines](../../docs/devel/writing-a-getting-started-guide.md). - -IaaS Provider | Config. Mgmt | OS | Networking | Docs | Conformance | Support Level | Notes --------------------- | ------------ | ------ | ---------- | ------------------------------------------------------------------------------ | ----------- | ---------------------------- | ----- -GKE | | | GCE | [docs](https://cloud.google.com/container-engine) | | Commercial | Uses K8s version 0.15.0 -Vagrant | Saltstack | Fedora | OVS | [docs](../../docs/getting-started-guides/vagrant.md) | | Project | Uses latest via https://get.k8s.io/ -GCE | Saltstack | Debian | GCE | [docs](../../docs/getting-started-guides/gce.md) | | Project | Tested with 0.15.0 by @robertbailey -Azure | CoreOS | CoreOS | Weave | [docs](../../docs/getting-started-guides/coreos/azure/README.md) | | Community ([@errordeveloper](https://github.com/errordeveloper), [@squillace](https://github.com/squillace), [@chanezon](https://github.com/chanezon), [@crossorigin](https://github.com/crossorigin)) | Uses K8s version 0.17.0 -Docker Single Node | custom | N/A | local | [docs](docker.md) | | Project (@brendandburns) | Tested @ 0.14.1 | -Docker Multi Node | Flannel | N/A | local | [docs](docker-multinode.md) | | Project (@brendandburns) | Tested @ 0.14.1 | -Bare-metal | Ansible | Fedora | flannel | [docs](../../docs/getting-started-guides/fedora/fedora_ansible_config.md) | | Project | Uses K8s v0.13.2 -Bare-metal | custom | Fedora | _none_ | [docs](../../docs/getting-started-guides/fedora/fedora_manual_config.md) | | Project | Uses K8s v0.13.2 -Bare-metal | custom | Fedora | flannel | [docs](../../docs/getting-started-guides/fedora/flannel_multi_node_cluster.md) | | Community ([@aveshagarwal](https://github.com/aveshagarwal))| Tested with 0.15.0 -libvirt | custom | Fedora | flannel | [docs](../../docs/getting-started-guides/fedora/flannel_multi_node_cluster.md) | | Community ([@aveshagarwal](https://github.com/aveshagarwal))| Tested with 0.15.0 -KVM | custom | Fedora | flannel | [docs](../../docs/getting-started-guides/fedora/flannel_multi_node_cluster.md) | | Community ([@aveshagarwal](https://github.com/aveshagarwal))| Tested with 0.15.0 -Mesos/GCE | | | | [docs](../../docs/getting-started-guides/mesos.md) | | [Community](https://github.com/mesosphere/kubernetes-mesos) ([@jdef](https://github.com/jdef)) | Uses K8s v0.11.2 -AWS | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/coreos.md) | | Community | Uses K8s version 0.17.0 -GCE | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/coreos.md) | | Community (@kelseyhightower) | Uses K8s version 0.15.0 -Vagrant | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/coreos.md) | | Community ( [@pires](https://github.com/pires), [@AntonioMeireles](https://github.com/AntonioMeireles) ) | Uses K8s version 0.15.0 -Bare-metal (Offline) | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/coreos/bare_metal_offline.md) | | Community([@jeffbean](https://github.com/jeffbean)) | Uses K8s version 0.15.0 -CloudStack | Ansible | CoreOS | flannel | [docs](../../docs/getting-started-guides/cloudstack.md) | | Community (@runseb) | Uses K8s version 0.9.1 -Vmware | | Debian | OVS | [docs](../../docs/getting-started-guides/vsphere.md) | | Community (@pietern) | Uses K8s version 0.9.1 -Bare-metal | custom | CentOS | _none_ | [docs](../../docs/getting-started-guides/centos/centos_manual_config.md) | | Community(@coolsvap) | Uses K8s v0.9.1 -AWS | Juju | Ubuntu | flannel | [docs](../../docs/getting-started-guides/juju.md) | | [Community](https://github.com/whitmo/bundle-kubernetes) ( [@whit](https://github.com/whitmo), [@matt](https://github.com/mbruzek), [@chuck](https://github.com/chuckbutler) ) | [Tested](http://reports.vapour.ws/charm-tests-by-charm/kubernetes) K8s v0.8.1 -OpenStack/HPCloud | Juju | Ubuntu | flannel | [docs](../../docs/getting-started-guides/juju.md) | | [Community](https://github.com/whitmo/bundle-kubernetes) ( [@whit](https://github.com/whitmo), [@matt](https://github.com/mbruzek), [@chuck](https://github.com/chuckbutler) ) | [Tested](http://reports.vapour.ws/charm-tests-by-charm/kubernetes) K8s v0.8.1 -Joyent | Juju | Ubuntu | flannel | [docs](../../docs/getting-started-guides/juju.md) | | [Community](https://github.com/whitmo/bundle-kubernetes) ( [@whit](https://github.com/whitmo), [@matt](https://github.com/mbruzek), [@chuck](https://github.com/chuckbutler) ) | [Tested](http://reports.vapour.ws/charm-tests-by-charm/kubernetes) K8s v0.8.1 -AWS | Saltstack | Ubuntu | OVS | [docs](../../docs/getting-started-guides/aws.md) | | Community (@justinsb) | Uses K8s version 0.5.0 -Vmware | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/coreos.md) | | Community (@kelseyhightower) | Uses K8s version 0.15.0 -Azure | Saltstack | Ubuntu | OpenVPN | [docs](../../docs/getting-started-guides/azure.md) | | Community | -Bare-metal | custom | Ubuntu | flannel | [docs](../../docs/getting-started-guides/ubuntu.md) | | Community (@resouer @WIZARD-CXY) | use k8s version 0.18.0 -Local | | | _none_ | [docs](../../docs/getting-started-guides/locally.md) | | Community (@preillyme) | -libvirt/KVM | CoreOS | CoreOS | libvirt/KVM | [docs](../../docs/getting-started-guides/libvirt-coreos.md) | | Community (@lhuard1A) | -oVirt | | | | [docs](../../docs/getting-started-guides/ovirt.md) | | Community (@simon3z) | -Rackspace | CoreOS | CoreOS | flannel | [docs](../../docs/getting-started-guides/rackspace.md) | | Community (@doublerr) | use k8s version 0.18.0 - - -*Note*: The above table is ordered by version test/used in notes followed by support level. - -Definition of columns: - - **IaaS Provider** is who/what provides the virtual or physical machines (nodes) that Kubernetes runs on. - - **OS** is the base operating system of the nodes. - - **Config. Mgmt** is the configuration management system that helps install and maintain kubernetes software on the - nodes. - - **Networking** is what implements the [networking model](../../docs/networking.md). Those with networking type - _none_ may not support more than one node, or may support multiple VM nodes only in the same physical node. - - **Conformance** indicates whether a cluster created with this configuration has passed the project's conformance - tests. - - Support Levels - - **Project**: Kubernetes Committers regularly use this configuration, so it usually works with the latest release - of Kubernetes. - - **Commercial**: A commercial offering with its own support arrangements. - - **Community**: Actively supported by community contributions. May not work with more recent releases of kubernetes. - - **Inactive**: No active maintainer. Not recommended for first-time K8s users, and may be deleted soon. - - **Notes** is relevant information such as version k8s used. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/README.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/all-lines.png b/release-0.20.0/docs/getting-started-guides/all-lines.png deleted file mode 100644 index 7de0438af632ee64e1efbb4e857f69b902cd1f35..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 226552 zcmce;by$__*EQ-kQ6xk{kq`w1K@deiQbAHeKCYa3#1WLN=cOlX#oo<0TJmI zkywOu!x`)MZr}5sKhAZXbG~zZ>yN#q*7H2~ea|_^7<0_^=&F(o**^Mx+qP{Zlasxy zx^3I;i`%wsrzP2r@7!K&+l&A0xFsQXjf8}xdr)~`+qR?Il#Zf)hGVv z%~br`viu7t`KjnM6Cbj&kp$dkdSxawHTB`oIi|EFw}&G$v7IB0o|pHV391~RQL5GQ z`^;8-&!jVUC^_!Ox!#Snq{a#d7cH0QUAvdx8LWR;yr!X{(eAY5RrcojsQ?Mw!GFEB z)3~OP{{3RxH>RCAf4?~Tg5~zEzhC@A_7B(Jf0LM#-1z6;FD_m@sLivwCbX1wE`B6+ z%&x|AsKu%_>aU7cI}k{)|~o_==abj2FCuRFC=m`P{0$lteVFX5NCmO}Quc6XJr z2Dh&T_qp`eu8t1;MfH#hU0t3vAAPp0`{Gouj=sLnP>{glX!B42_20ifx~<^Adn&;< zgCsIMzJ}Za@~_(oabn&cN=l7SxJg<3f3&v7iFy_qRQhO?9{u}A|0HwX-Dz?!HvLIq z+^qJ5d}NpsV@43^mR50k^Bb=+<+m3i|J?BCXP>OySIZJUb78A5YLrdpN($o&Q)1}6 zrtR!e#fO{n()FxzmbX@BhN^pQU8SX^uU(^NxvUcD=eIqkAu2qaikaDWepDrXBtI{2 zakAU2K-*cU_uEU!q@*P8TlOWoG9gShmX@;~<=(6FwO_wpd$1=eDvDn~z|7Q?NznfN zm{V$U@>Tf;(|rAG9uAHfH<7!$$r2-}B)DknYa>n`IdbGYy&|rftzX{Z`0s<=CR|S2 zp&72wr$x{%?*4S}Sl#FM5y~#^@d=4B{0g6_7*0iP{wc`+kk!Fqin3Z)^yOImDMghxb0ya+_w4r$&+hoFJQBF)Nn|90s0ZKi<3kl|Q$y~X zJtepLy_e!x&j?VFW_wJ>uXF3YS z<#DOWhcJuBKYMloPdqSiL!t&tryMKDLgLp>VDpa^^X?jRqTj#!5~Wg{P=Qr@R)zQ4 z_`+&lUY=dW%9o)T+3?Q}J%gVfwH5$L0vZ*R}KK<;x zM^vZLqk4Wozf4^AQ^Y+&Z+ft2{90GZ@6OPv{u1&5!A8phem=fe8#(MLDk>^|M-`s) zy?*)fWn$t_Z0e^66#Y4dJE|QHo=}jL!y1k*cx1O9p{90f5?$K4XOCS+&dZDp>()2d zz1J37&H4CaZ18XWY}cAlmZ2{}`P!MB8d+SNoH}JLlfAC}iX_eEeDp#0M^+9Tm-c_~ zpt`!6)Gx=PCH4FF@6Aav`J+$R1F%4B{`;B5ye2wwhlht_1njuExO$50`bV3SvSpqB zMy9S$9Qlp%e98UoE#eBTWbz|>S(bW|3k09I76tYXKbo65J8@wsw^YvY&_)Z_4jB@b z`6r%am1{j(hHFcae_BnYRBOrwEN@D3u>7ht8zr@5BU7f9$f_w8yhOP;(V6eLWV@J_ z$gZ8a_+bz8<42Ep5A7eS4%r${&n9OQ(KIlawii5h{P+X1BdMv>I|moL?UZF@kNSU& zy)ZWvBEINRULC^BeAc)ICt6BHL0p#5^=OidmGEiLWg!?jdz-@Y|3==yMXk5xfeMg~`OeS!O&sR}jEt<(Sg{FmZL zZ?tMt=c|pyeGZyfNT5lhX!Xj|$>2Yza_qcfUQ2op|J6?$^A^^J=nh}5&)64u!=&n# z2wRi)h(}wZ@n;8b)fG17ovtkvPWQO#$HvBHW@aixbN27vvF7XHv5GUU94GW7AtAeE zELAySO1Lj{#JyaD%I?n!az%z)Qk>0kyeZS8S;!L#Si4gLJNE_OX~YeL7~J|~f#>!TD$ zO62ZcyH-v_u|87m>gmbgR=IiIhH9tb>iig?Jv%!+T_@i(=)(IV@%6O=B(2&$J{2uvtp3-oUDM2L`}XZ>zp}Tm@rrbkv6eb@ z)%3=F?M!tQ>Vg(^nak4BeZE^8t*x!Jfx~|WKbe@A;P|LgOEK1x{Ch+84MUAfmtq(b ze;$9OAe$n^ZL_SL^ZQ1avE!-3VSJi0M#o-VIvS(w@k3dP$H9ZT%{h>A_P1qwOnUEj z8R>Z{AMbpZwRfTRqNiU)9I=^{3gdn~SAH*)Qq{nq(wU$hr_`P#Ly_KEYE%{A(kALY z%i1(Iv2lBFaB!mG?syvcgQV0{>8Rn)pFfjFr4<&s)P}RIElyrhP?%^*YuZ@q7k8gE zmXN)4>C#Ep1Ai0RsWz8wfoY$o)ER86elCwC=s7&vCsQLSd7g}XIJ1>IT@v?Rs=8Xu zucBI0%y5VDET0-l^Y^4Dv*SAw>ywH_>mJ1P(wN@c;%L0};<9%5NuTm7^Rl0hhb7X> zsgk6yYWkYor&N{KBqscFfhJe<|0Bj zlwCdPCj)9Kj zcjh5iIKNC}XQ*yK_QW%?v9Te#@sPg+ZF`Cx(lxUC@=UH+TAuQ}ax`VWChRzVK|8ZB zD=T=Y7&%Ag@?}bi@bGZkcQaq&gk61>dR-kH9F)>pO!IS#Xy3#jz4;{3q2AL-t;|$2 zyH0e>q#JCU;^46O_Tmx}-`4tE)6mcmBl&{{(;;^;0fD8n>Qw)(%6pnN>1~8B3M^v& zv*ObShQnmD-GV8pm=x%?DhE=8d#meMvlXUBk3ViWaDseUd3~%;rE6Yr%D_`JF?s&c zZ`+CEUL{w!__u^r&k5c&*u4C0R@5j+Yvz=(w1J^fmZ?I2qheL7UU)>ru1f>O3C@yg z)b~c*+bGg~w>E(@jPliofBkye@cYY`FW5BN_ut2yl4L@-d3an)bPpdsT<*EVB;uCy zyy+?LO;t5D3I@ReC!xE3ejbYx7aV`dI`7L|US8hZSX*m&bsk>>(0%)Mk>tS6JCu&q zjIOLFPULC*BHJw)!XzpkL_fSV^%sZUwmM?tyKm0LjrADk<@Qta*RHZ1CgbA`pR2n( zQ1j^QSaVfl@zvFAGe7T}M*7cc&Nkye*9Dfl`!`RJe7s8`cIdzXmVjf`4qU%}JZBGx zROJ^?mwA|2GbhqCM;Aea+r-!V^GSq%SjqaoNT?jk7qcJTwL0shr_IoAuKqjQzTjcq zrxNSoAmAaFdx_OH^B`&Z*CBM@m56Z%=M+Qkof9K2dN{k zsxtj8#(MAiugMTfT_rVQ*#q*p3#Ezf>BeSJuvp6k$%*N3obRNOFmKw)ohG9b zSCHj+QYm)8U5t~H)H~_#Z*#xCLiL_V6#nxX<<{8ZyY}}hdqv4@{|(l+({I=O`vb~v zl>hxVw{PFyM*H^%JNf=!1N#4YiRS}LOSwkb?_271Nwio7ciS01e8nE^+4A@8?N>Mg z5?jXJYTL+AsY$8)5I25yD51b)k3n8y+ylwP%1OJ5B;O5w!3{>5#p1g`qp+S=yk zW=6U7d?w9(EaY-CHPK~9B6W`CNszEqH1qv^^I~<5fbTOGDHpC-I$%^MdPAGpGRI1AzQOg=& z)UN)3ztfsOu*#3l{NK~B8{yxWb)%@8Fh0(n;!{r}B_}VBd<1N0TO`cMc_q7DdA$dD7ZC>sN_f7m)ZgCgunYjdM!<-ze3(4;|-!a&v zlcd~vY4obiReAUL=~-#_c)Fc0NyDzT~oj-qGI*FHqO>#$b^79uil+p&KbT3kC-U2QPLX4<6Fxj_$NprAEF|oP4;4~278VDjctu3s<>odM7VbZIum@n(XWXUiLa-Wjm2Hs~AAP@b=R3WC zMF0Eu@B8~xN*HVL$29nd=H#3ykkq<$>l~41JWL#QDbs2?k>8ooPFV2pCM4G7_5Aqp zYsO75m~`)6!wYMcmX<~beeOMYkS-G&#)^aWh;gZ=Mz;S$%!vp&%AMuq?<(+wNrzo{dRTCDNL_MxW4adeZ z^fO%yXJr)ih@|{D_l`XPwLn%@cC@!lfF-%4WCa|HJ35f;A5IRAvDS1touZ74jI1nx zj7N#!m*oDw2|a-C){X=_?+%Y|lV<@L)@tGPC?xXTDjcx|OP`YE!(Z)=v=W zH*enH@hhipW1Gl9rAx{fKi}@5;)Gdis-L4wCKlYT?PaRZo%ly1<`*JnO(Kn3fer8TzT z(Rm4EwcKN29|eU5MIF{kM_XG{l4|FNrO5RaHNVK{`5xUw0ERG&BS$^*bsU*Ld)x(sBcRTPpsa6U}03 zW_FU5HHYO6YQ^WYMm=u2rnyW`Rv{rFF|l~ckM}9DFVS%pnAwrox$1r{1_u_xT;o+4iifgIX%L(;9j4^l8PU zX4!Bjh!1m8+W&6Uz^U(5OqzLI2|~{DQ6>vbzkV4P)L)Mo%tWvt`cqR+1WC7~Yw+*~ zx@&1YYbRVUyPT4iHZnYXfg!l7tLyRO{SqWG6hPobaUW41SS0V~^eIb8Nzu^IKw5eB z>>1)7|8~JG7Cm_IKsZi`KPRhUrNk?D#_G|dN1dIW{-MRi#el^^aZ1FvNXgATS;(%QPj*gDn+3~TlUw7Zk3(Cuq3knKC4riziI>hTYj5pNAnO1@R zO9P$m2VOWNKn2@vaEfrijYJ#euUxU=*SUI?l8`W5J?WCq`%>}&xyeQvE|Z>~euSRh z=;lo;OG|71m=8Cu8eDvqkYE6vSVg5d+dw?9>Z3z!vpEBwIVB4#&JLq%OhfA8t7HDg zCMGG#$vIneG&Cymp7Wz0=%saadq9j3NXRsr+1!gv3T@roEG&kQLh`tZkRL8g{6#TY z$Ml#bYPPdI=BmdTri(ovyXzeQL(-Rb`q{O{$Na&T0o|p$u?-hcgh(GPj0p7`>sZR| z-+foeg@>0nx3I8n*fCdM4?O!s#OuOBepCabMwQ4vfBuk?57&SFI?nsHlV?I^9J0V}caV(?Cpe31D+6(dCcH+&GojX>Cn=rocZp zHy3Oc$<`?M)jt_7XH_HvEbVw)o@#D!v_+rh;(Dx#g2N_9wUg!Cx%`wAK$_gH#=1Jy zkxxdw(T(ko9+AzcQK!6kaTKREtz}`NGh#vTI8l>Uk;fiuvR#$`^yyRQOT(l~H*el# zlfz}n9{?sSki6M>=|=CoWgm5VVe8Wp_l8@NSR=?a(${5{uapgDGJ@)51m+RZD znTRp-mzP!<5m{~P_gRsq)TLwoP&px8{~j4plRrpBCA2vuQLdj59_~2RQ&L)5+SR2U zr$ood7#AM?aXjF<)b;Dv-Q6!-X$nR@$>SpRyNa8-emy0aW`Xp;s-cug{-f8VYO1O~ zHnl2he>6DT%l!MaN8dYdoc3o7anikNZJjYKys4S?hI{18&!b#E2k7WDu3h{5+tjF; zy?|6%m_Unoh>j*Wm7>(`bX*<+G?bH*vo?gRMfmtC?1Wa7 zl!~!vj3%pWc=G)GeDFJ$Zvp~^*p8V@vNpT)yIKX@$wx^701sC6%RLH80y?d;UcWY+ zsX!^OtCL@lx-;2c*00&vwzjt4!^0~TK~sM2c@|xr3D)XvLDEV0FK7zhmn!&i``TJZtfFNYYDTM={J1pW z3Xs`aeooHSC=&>x)YQ}r3}5e;43CVYAMZkOA!igyuK4`N3!*ZO)a&eQjkRM)%#RXl zQg_ew4!c<1-H>6th;ydMk(r%sHpIS{1$1NJ!(A+%_2-{sEop3W0U;qxjg6`Qfg>9^ z9mO?sHdzqzi;I_mwI1t^m4%|&8@zrz=014%>mEM$-N&@M&Lt$>D zTU}Q6p?bQB=vW6;NHxx?s=ofz+DG}nVR^#2bdUO4xudr7T0&LZ-@Es$;WwIVU%p7=kR(s|Q=;sw+UJU?qw=1m4?+an@UgJmS%|2ssS$Me z>ECJHSYLmRK8XCmr$Kx6fMWrP{cb|yI9QOT`C}$Ka&H27B(fL2eajvY{`~oymND&i zGb@oM;AjWq7>>>+13LmxDe;%~j^QOJX829SrF zuoO#Vf3A=^I%>}U(i1sBU!N%^=ka8u-Qy-Z0d#(p<3+R#4D5=!orU5WOy}H0u&e-M znFs$RzwZl@IYo0=<-$!$8bbd`xdt>qHJzBh(1+Nw;2t30-)AoG9z>{i|v6-8Ut+t_EyE=Lu!Tfg^}db*9Rt?7Xxz!B#R zU9eGPi=CJ3h2j<#7VxH#-|y_$^X7Q37vXdEp^}mkkV*aQqL(i}80FUF5!q;bd?VFz zt4$1Gl(CkJAOi}Sv%`3AnX98?UOVA@OatyaksVDyGzx(K!1}bJTE2gOt9?3!Pgpo+ z($v}ceD?ub+P9iqnQ7aI_9diTlqAZee2e(XZzm`! zDVYwDA&W!YG}bEYp3Lykyq7LI-7)y5SJ%mD9*@y+Sq~StE$TMs%e$x(bG{|4^k15M zJAL~C;k5Iwngg_6B~CGKyC<1Ks_|Q6wTGkYs}fK9Ob-wQX{UJUgM98qo2)=$J`rI7 zE=w0H-5bpwK>pw^*?tiNdfNNoUlw!c@41xeMVSOi53NnT3%()R3=XYr<0cZ1wZ8jd zpiGayh_2cJj4;kaGNHlrCXHuBfu_`qNWZCtl!{Y{uB9)xK}LGqQIa^1du)M+RtuQ_ zjZc!D*Z~yx9lQ6B_F3~7z8LrNyL(rM=LcaSE@*byLNr2vaO%2-2Ku&l@80cZ7Vmhj zo?briV{CGy^LM<9zmTwIyE)(Uw)Fg$VR|)_ewW@Za=wXE2De|n*c=@Fw=tQ;t8w(U zb0J$qLC^uJy^GpsJ$mf|R{aWDA$t$_f-=kC$JUv1+S|9>R>ZT`aribt;U7gTH; z{2rX<>Paod5~sD}=nIa0gMx`PLd~fT0-iRb6T9Y5-TS@Ienro2 zX{7z@*bnjBCPm#4c_v-fXgJ8;r@Ua7H#Rnwmk&7l_CW5!(2U!uQ>VCSNvBv}l%Zdi znwskJD{s)HjPul~40VDDJB{vXYN@?sWQuZfkW=UsCZ0Ue*c@K{`LL)a_}n2~N$T%B zj~f$SmAgL9I$n#y59r@LS@C1o@5&psB|D95fCn&0K8@S;6CP#a)61K?1;>{-H@-eQ z2hPUL9Xuqse*1ydHYDWXpFfT6eh39J{4fu41r6`?>7WsJuU!MjROEp!QIgEf%_Ss0 z?rNc+@!;U5BF}Q!2uU`u2pIUn75+ZgXpsX%|di(mGrm#;b z-xDfb%bl|;e8+bg9cBs{K}APP29+&3&CQ;}X>oJ%)UZn#Gy*ziW@aWPABcPQ<;8td zO~PfB|4f+){1cGaF}e8l>sPC_OM7(fAWc1b^g1(hQuZgnlfOSa4!2%k+10)m(B$x8 z3;r14@M1_0$B*x5pjZcC0Ua(q&JhwV>$;!v?9j>;J=WXx)|U%IX&bNe*KDZqgsO(K zM%U9YGJ0#(?TWsdHr1b{$`m3Kp8V?7D^5Mi+l2ZB7vH|u8)WvIcTPD+1*P*AlYC26 zQe;j#@kL`>sg#)+kI}dFi>Tapy33sj#=XttqEKH2@yK8{miGNgmk}Kb|xL%5Bn6~URNS^MSkE?2X z8M#|_C5&mTjBTTGV?CR6U+nC0@AmHocH1*I@$KxvdA;|JB%!kg_czECM#yfgOq#9v z9uxg;pf}b%;%QqdGJI*3aLQZeZOeLTxri+Dz*x7gL+L*{$K`^3XrdGDzC zBu_`px4+w#?VBvKY9;6`vz$d`K3qw?cI0W+s@CY=w*7V}+EyXPw=INkJ2!kD*;cx3 zk~!-rpZF-bxfC%6^(K`~HF2b%kdi;x!JENd_KHdK?USif>f0>K^LvZi+a-7De`<7H zUXL1LmnRkNoFp z>WdTkO()pc$``w=cHcDwIOC~U{wccDGxz5cg+bAIWe$K9yn+J)0vaWQa1>Gcg zZRsvU@DT8UcV*Q-i7mq=S3Tq{e0(;OLd1kT7bp7He+$IbC8(A<41HSaRVC3tiPBR`GP#022D36D%y3lA7N(RvYE= z@$^2w9hyo{EypF=}Bdn%vDKupgsP2{TI zefLhvyl9<&C^iyT&2G0ka|pa23J;Cc%Sd%~bq|qve&yo^mTmv}q<8XyqqwpioHTD!RU1qO8AD*ALQaEvNtu&ZPboJ56_?m_WvadUi z%7wRDwh|V0-+f7%&ZC(#0M*N%GP^yU+es)6(ylKdvxwU?x^rxKs%%=GL~h=L#nl(|T>QU%z$`iqlAZ`p;$RDx_Yb{liM! zsbOupa%(ItL2TiN8Ui7C+EFeXTmt~DGl3~2Ej9IvZIQvFv%5o`32mZiulsHg45mv) zm?Ua~8HMqD&|{&4vaqtVkKR9GdkB^yJ=b2TtmfMf<)enNv$zs>24Thx|Ln1KEsB0) zg_gvpK@uQQZ%N<0GmQ_Q(d+}8nkOtO9;d7gZ5ko6(TUlss1Qz8GGk+(h!>2 zcKhgKx1__9L6$&{t`t2AG%M=fTCNuFnq0(b=Mxdp)zeo|;dS`=*f4r_p05e`3jyC8kvSTKS?GqCd;+r!exM|zClPPaucKPVP7tj^r{k=qXa@f_H z6Q!_%Xh~}2{et%e{E7&G&zXLGIuh@h)j*{xuaTu&;x_XWJ`9-P5(bcpDprnK~z2h2WCbLcJ-Lx|X_xsA;vY>Ec%!%x}_KP(X1^G_yO_y5Pp`2{`0c=zAW zpoF+YnrQi~O%}Ch>S$UljeN3MKK%2g`L)w zYrWI!w&vN_5yv=Yup{lEV2V9!QfKEg7xVe^Wyj2ZFPCW2%6s3YJ5LZs+P;5xoGxDi z<%QGl>r>w2f`V=%jd3vd#qry8eF-{(_RjJ8JUfr`d)o3g3RAdex?fFG_0x23y=`EN z{0=S{aztRNRl{Ioh$P8p&j&pq6a-zp|dR>gohLPucTSO4yv^U-Ib+?$6TMQ6@b8#$S2}0QU z{QmlEqU3=`v3vZ|WdDabub9KDmfoMc?GkK!Dz%F!`|nk(b@*(&H8|AYP@r|Fa(m9s z1h3iJ{3fwAg#N1N!$rmZQa7LO1lcC{vKmh?l^&NrQN8-!9V?_jnCvl9j0BjqPibdW7A-m#Pk+3zgwk zu{yE1_|1XXxSF1ETaUWMK!?Uj82RN)t<1I<+fsB!8HAi(IlDf&^78n?r%k&vhaha% z+o+z8kEBWUypb60*v6URs7Rv(Tpd_l(=-YJ26I){auQaMtqm*?L6F zB$|J8T$O@r5|HK$J3E9%)M~4iR7KcZpNe|An3xO`qkLs@CA z{-KbyDp$wT(T7GgKqR8SuyFcR$~9^!DHYg^PAbQLC4Wmaib7vqovfHU%?iMco^ScE}m%$o0FA#H}q&`@≥5K-Vm^RVyk20yOSCh9J^W#;X@@rgoQfkeg5ABK0liEgEI!L1P`oM=9J@AMkigACOc z1zo&1zx?|ByDpDQ?t5dLutugfj2r8Hp40F#$c4|3h;O-91<>r+L+&--EQ7W#ILgvO zyFpWoK$C5e`0~KrCH!tAhngU$)D*Ic=h9Rh?@eiK?dK4?Sn-HWMa{drHm=9G3dfxe znNIDbv)ou+fU7tbP6*H-7(8XuvqzqE_1|_LWTLc*pNi(zgE(zlG8}~>99MM}TNf7@ zIS-Gn??S7F@8(>>h2WbfcWFi0@W;UE-hQ%;oknWLqa0=`5xe|Ov}x4Sudk8ju)(P8 zTwD!0(<0NL!>P0&G?na6_{9~BnfQA^X`wIQrgYK9_9LN zo{+NgPX59Hu;%f)bxSCYs|Wx=o`aNrl`*^RLH5SZcH>oUFAE)mBaP8p*p!`@NJvT3 zGc!d|z;X;f{TQ{`BamEp-Gw$^lMDUD>Fri28B$|TLj1+GMP$Xg+->fxf`Xb!&C7-Q z@~^vmaNkyXb;?cB@AP@f4%?LbQ{wIggAeY!vyg4v?x`N+)35G)%UUY1Dv>=vDNU_% zqGH%^tKG5yjluC9l5JfD+L_O9x9+ZXpbvtPJ*Vto|1|oJt+B929vM7BODhepYm`Z+ zWx*+;Q35(t_qt!vEiax5Z~d?5lQ!1T2Ay;)0SJfqIy*a?s_^Xl>i3QVyB?Hn8@^4 z7RZN#kJL>${`mMuq=`P+L(Di~)kpD1VqwMXF*9 z9K(o6*F4eL^3aun_4->r1jmCy2Ai4Zj5RdjB)I-~L-q!ptII%#gQ4qNu7fUVw)`

    elmyOf#;$03R`?sB0>T6b#szAEySUxw(jpAh*P(A7AW z)vz%syH=t)RyN?b>qcd%fOW@v`dWml?_5kjnp^1)mc5p4P8@n2q}33?=tMhcQ@LJo zlD3i{yz=_VYM*jm_%eUmoSuQ#k<%=!A|kOg(kj%@^d&4R%6L$~WxIxEV5ZTE!kEOG zo+r1Y=V%tQUd2j|9ugwX47HR?M9XjOi6wVyYcAo+umo;_$FSy>=uW&HDAQG;PHU;n zx*Yetb5&(2kg>XL$vK=gxB8WQIx~mgQ2_b2kv+jf0Q{Jff%0B<}!}4Kx2U?BqdQWj@;jW_^e&u zyN-^Io}M1C1SAo!t&JtF+hDZqJw09+Yj}K!_b2GyY`25_Yho9GS6JAyG4_Jb_2$(+ z9Z?!oA7BU2rywTL=R?K5>qE>w7ntE1&C0R`a-93!aNK`>tOZV(&5dc_emIKN)oH68 z02B@KGCsn|AJ3#?etBt|2pRbUC_-{zLTf9c+$Zc)o0uW%y~ zr(ri3UtgJ9n&?FDl7^O6U0**wIvT3g5@>l|LoePI^0M3b>oi&(eGwSa`sG{3oB+`i z&YA?!XI!HgHYu*qEnS-nj+Bw&K;0CIvmLH`Qsz1xkM(|Q(c*P-_n7u(Z&~G?)D}rM z_7t!W4AY>!0|fiZBe2$?htaiXX11OuKmVeU(Xo`b$;rkrmsbZfBC!FOzguY2nJyk8 zkAhLHS%%r0@5cLWQYvkkI%fPaXs%$c<~L}-Y5jL@*p3qs9Q^!I_bfV3CHSmbXlZqR zesnOJ$3P!*O$QF}8hw6f7VmzaF$A4L3bExI7+gU`;yLmic9dC^-Tg=SCx{9J)&ofj z?K#+;L2%sxZqc)g>~-bVD|G_0MWY$M&!S$JZXnQF_pZZbixKK(aya^Ro)4NjuY}Ekg_a{+t~9&Gi*f3($HZJT*4{#k~1v zkNg;T>f&_2xK&%m6Hbk({>p@r6`&EZ#g3bh0w*qPOPMd5uIL5|D!DcCSbFH;f#dNW z;~cbu;}XY7j2YeghCQ2HFXS>`6JP%$dF4v|)_T*H$WqTOOy!BYB6^<0o2dvWP5 z$PTY@4dud`8PqMNI5i$`pKg2~8(Ax8(pD&R~WM#E7TiRR1+H(vNuxqC?~!Kv+|rN&V{L#v$H3>p$Kl7A?a zTpVy>23mKzBLaLkJ6un}C}doq4ZBvFVvI|-O;N59F^)kIaoYBiQmDv>FbXe1WB^%R z-&~tM=?@lj5=u4TlunVYp0o2pINKEnQ8xVD0{vc}m{_Exq!gc?8N9QH>1u)kEKXH{ zbg&lTpu=O-k1Jpkr`_0cWau+4ER45WftP^oY8F_wCd);j*8fMvOz>XpL^m))-Ri$g z@eAK1DV)!2O<79x_I+8eh=E@MhrFWGIv#E!3>_JGPM!x+hNOo>NF~u@y973@sjpvw z^haCw!?FNM66Cqs`uYe~3(#SrHi@pG$0qD^TBS~7xE7q7n34q5YD%U1<0iuFvuuc* zATM7BiqA*i(7(A@w7$L$9?0hAV65?|MR#`qheIhrY;wj8 zPX6<_BD4-186SXH+yOMT1mDdSBpgKk5jr{R!>R0b*wS(^ zYv4jic5t0+ft>`0gxGoiV-llZ;y8?VAR7DH378~X9JosX9W%G^Wc@5+9Y2D&3I9Ln zORF+RN_NHS8}`cAw}xs8r^HPMANw(n!}e6 z=B6q3Q=FXe;-KhX)zn<>xEW$%YN{%aW(t(mcNmJmAOw6>@DHT#FeEClP>A3y!`0FD zCBkRX_tSk*ExX3&LKdAzcc+#u-B&LFNXxjL*$m>-G$;6?4h-{CauDwGaVdeTK?s_Vp>mqP=%N z{K5U@p5&dJIFRCmV~;r%?o+3Jy88gA;e!11L5OXHfGso07dkAtmfke zmr)S{5+5cm_uOhCV-U252X7(?!3s6EA}1$ws2H{d@jvf(z>qkRM7#kcgRKRFtrY&` z`rEzj4VV_euwuquqT8V1`FYnq_Yt&z3w z1rrTUm^YaA>m9p~A3L_XG~E>ctUzt|gHK@z3B=hc{u`l`R16Fv#x1BuSuOp;o}lx`9?hRVsl^eAfax1;|w{a}5INIvm{G zeenMZyA~LvR0t@cF2eb@3e?m|3xk>zFS4$XkhbDE^KVC!n#~KePt%f?Ntv146i;u} zx1OAi&b}>L?sPZ>mUUz>sX$t9aPI%03=LnJ$tsf;mu=}A&!IoVju&x4ah6fEdN&J? zK?RVhOT8y{6@Ud@`Mn2Ee6Fgp!SEC?2+o)hFMU~W1-L41lf>_g;m4gA(L|sVp983m zPRap$oX9?fnM9m?)ON&-e<%*|R968}Z-9=-Bw*Wv5D;IR$OnAeMM?{UCUjba-m*)h zwS|RNi6h&Qf~;0ctyelp&7)323+h9_I-*|7e?ax1SLEOTi*Jl6BZU*ixvm}uc@9t7 z@wEcOegPF~3MP?a?==@G6{LZLu&`WgJ1#1H`Em|v2QE9(5HqsiVOP1ah^_&a<$wf) z_5{zV3la}|ZMT2{egqnzBH%X#Y`T8nFVVz^7j!TJjKhmK@E)^oCP<)f8JXH+Vf?($ z`Z5wYk>kU7OO&U(D>F;R?HM%m^d{{E8(rg#gk#|0+@xlSex<~o;wgBAN%pT7U}@^~ zsZ+#^hd4qIR6--gs=s2~+pU|@@bO{d)97fk{7yK9LA4)CAFp-*d_{~w-6syu!nDC} z*GJ4cTf-QYH%tQV5C^V-wH3Po-aaAogBWxek)V`7QeFBP$a5;-?9DIx<3~E5ZlxhI ziYhlwvm`^)MH%B_BaW&9a=V6oPCl(m&Nxo?VS~)s})+-Cyz8e6}uoks0`6aUl=x3WLJ87kz z;kQ}DY0xroSfq9UECK>H;(dr!WDxgRH$bI;HyqP+l`fNAM2+OfYc*^af0?2$v~u9? z9-JmlWKXvoY{lVe|YdX!y}TG&EEtNgCcA;;ImJVnn2Y$5;wE|05XX+B)+a zl(kNvU`{IkZteWt9yULrGV(}MW zm+cuK_Y?Jdn1a!KSj2I4s;0sDbZxlM_7&| z_*UfR&S0Ny%#tJ~nsCQNFoXq$N`=agb}Q0CLY2|s^Oo0)jDF(5`n={Ez&r7m`jb{I zjfS9^mgpjyX`5?BL38SQ)>lAEo#-_Fzz4+hc!)@NLINn7ABF=DO1Mn-+2nWraA!Bx z5_6g8Ai{*Egr=xN`|l&mvhwpUrpDN!JE4suf}a6EH|kqB&i<-ROYkWzEL;TZ_%Y@L zoZpFLt7BJw-nK_jD+-+~!2fBNGJui82M>O7(7kzc2#^Lnj;G<_XQ2QA)hJ>>xa%zk z4^N190~T@SBPkE)hQiY`A8dZ`s+{QWnVOKi(rH!fF5!WXWsS zub(!kSg+@)#O5Bi`a~31(6We$jm3Hj2=MW7>6OkCyIl}1J0s?x3!)!uusIuTX$#G> z4|?*n@0O>;!}{SaTx6=Z3?K4v#?Y^NNDDLp)AYyDjT##2JZBGgU@vKzg@vW12ZT{f zYM!z9o_y)E+9654WLN@S0B3?A zK)*62R_!nud$RM6&Rg^5Ji{58Q=&YQqZW0O5}zr9L=Q>`TbGj&(`r_ z4BpT^;DtM(6kEe>Nu*i$R&+#!B*_J*(Qin{UxFDu$F^%``nD8SWT(G=JyV|D4M2kv z4kZTCO05G!43}JbE0Oe6Xw~M4IE`NAcTcA`xe@jnlLu`|U99zvnAKBLi_jLKWxL=q z0ZL6(#+P$Atiy}L@>WA#-K?8PM$run4%9bf$EBkS>*-U1`DMHwK76QSTf$bJ+4;hY z5TM#s>FXPn+7PRy`*rDwE{L{vX4I}`UG8?EH&&%+F z3t#yB&ECzX^qh-84@+zg}CnowSK35`vh=S4~h)@Df1@m{A>Z#rLI#t|d;;B;F z6(yw;;-Y7*q0XQS8Xh0NIp3lTlsFU@VE$?$qmjF5)(fYA7%4>c$8uXBWuA5C+4zy^ zcXN%y_0bV7mEIE-(cWdCkxP@^=xuzg;Ij5xN4K0v=#eHZ1qPuZtxS$pk#s;MF>C$3 zD=f$rV_ZDt^WSlL{vZ)PX1EaE`%8DdEjxwslEw)YTMLVqk@xT2%QZYc?if6@o18(` z$1;w2-FIpi~C?qX4q-SGh$U-=1oQz2bfTO64YxrXSmvKF^?_ zhr6m?_?1h|9U%Sgxpcd1$Yp7%daZtw-?iESHF$~O9$qcH=wjvyAFr8NU%ugvcOMz~ z%tJM~0AuDrWAQx1&jj%G^$lk=^!f(v^r&eYdZlgI2Fl^TP()DCs?U54J1!H&rRBIX zYhwPM>e1!>pJ41IV;0jr7UneeeHckq%y)AgMdrwP%bmP${G0ZEW22}rc;_~Qw(jC%W|2B4ex`&UB)kF9|B!u@LT95TdYqEz5ANR51*!Gmu@ zMaZ1DMj8w9^6Jq4CnIYB!>+0Mv$*IpKiZ5Vk0EfMm0>zp*Cm`598MUUK$ zwlw66>mX%#(EW@;*G@fgA+*^bQ~9pX$N*)&Y?k4o#VG#HojdIrMhJv5^X5cSI_{mj zcRMl^8P`%F`{RRCaEyYEK7Bi%66iIxD&siun@XzenaThZL5N&QEzw~>}1qBAyV@rX*5#JZAJI(|oqVblh6h|!J zfbX-;R#7IRqM|^LMfeUN8 z!dP2ddwGfch&P~#okB*$WZT}|ql|*~1AqaT{ELTZ`RI|HBe4QUpd%rQL?tX-h87b$ zb-+DRI*H>qaichuSY>=bL_Z2jLyUl=79R0vnCuU*RJn)~jNqDR38QE~>$$X8hHuXT0wq8{_05CfirF-$&kh=lbA}qV`+!TxhVk$8x}GR=JNa4?*og<523@0g>?* zzFw3D@QBXtZaQje0FFV_Zt&%-tSsmy*xvlyT&%q!f>$%j*~JB7(HtNe^sF-c6_HqB z5s04U?U{|DiD?;*>LM`FFp|UEe1hKO3I_r^-z+!Ua2I(tE8-~{7j(` zU0vw={iV*N@!W3IQfwzqfcbaS*K=Z0v%Ov8^|h&v+~a4@I-+Z?mZnthv*F?7^cEA* zz+Q2&u?W1Pq9vSqum~g|qlb#5NxSYn2y2@BBd@?k%cE1cU%M?MGZP})3JwUi3%$!} z{0r!fD4ZgAj-G`6{|E98coGIo1kRqt&b2_IfEddUJyfi?8w-V)CY3x+kWI6Go(ji5 z7WwU$ru%XkFV47E%Z6vXdL`&FZ;lSHm$x^Xup1j2AkhHfmL?{$Vb8ifKgEc#k^M^R{bOfmf`^PGUBZk7WU;B-VF(%sCH0%&Zkx3wE{Gxo}p=I zY|IB~2;)98LzR6&^aN+s*VwNt&D`y$Owk)QC~-8wMTqjdddf5BrRn}H92z8#i`j|e z-(M^~Rt*1zOF(52La_S$qW^T}8?VeVrv&Ajd*3=sPMkZ}^6i^Fq8qJxiEk6#Mbls@ zcZ!a;GR3_)uc1+i7M_Wg;ec<&PkBmIFf_6`F`IHD73PAuxjB>xy3^XmmX_KuyhYce zG!{7y%a2;8yHFm@F$L{;Ap@jz*>&B2$0(77NeNEBYzmjEU)_!IE>F$VTC zvMiKIvIIBJ^g+DGS;u(MnQKw3a`z+-P*U3CleEyVg166{tG=obE@#4Ptkc~jYr$|j;QxFjqV+9XrQ{i-@ETSJy`~V-MUL-Fu_$_;Tz?6OZV{yxfqhYkVIluY`EU(K*SdW-*Sx3=k68EvbdGj3V z!lBXTVuv9lc<9oQ?ld)1R13_Tw==0(Jii~z3JiYdr2X?$6iw=VQig^s{Wn-6YIjpG z?H{7W{fQwYQdAE!Gb@`v-btIfPwdUEyX?6Cz`!JSOJssGCqA~c9PFD*OG~rr6@H!y zs>Y9c1Xl(sfiE%#1eBpPZ5Wj0CItp5s*Pow!TOa7tZ9} zno$4*#^0_{)m9Y=;F~c`KT&Vtti)>)6c8}h?W(W82@4Fs*-?!nz(+5IuTke{pYo(el?7f;Yrx&)3+OcWyxK{BE# zB9%94H@mO^P3@D|*aPCtyWg@29VFmeT{Aa@(;jmv#40%*H&ek=g znW2$s-V}!igF|*ZWi9s6_ix`kQ7_K6*47fCGS0AZF;$l~K_cGb!kHBT*+{wD{*wF{*4TDHGkU z>gr@b^?2#-?R1E|`CI5LWz zru9rrhLE9qczAF)b)vT?=Jbmq=P97kbv#+TQKFcip2&wHBO?Pc$a(VQmFX5siI)f& z=o~(YRS3WJ{T-h|xI6WQuODdLUTp$5J9Fkti`Hej3&;Y#6F6xn(sS>IW5xtY0Si90xZ#vjkBR9WQ^?g;c9^S60&b^?`=5#khWOx1%-q# z@Ta|y>`J}N7^#SqNy3HA6|X4lw@|s4520FYP6hF|@LHwC% zOT8>Dy{+R0y6?otf?OBs+}R$5=1VP0nqKYX9Ve0|p0GbagJuE!bIvf}FBbe%$4qyc zlmRzN3hS${4`inZ=K}wWjfI6}-@YA;Irs1HDA-j|YS?x$yX6i16x&|z3O?Z1R@c%p ziwjTu9jQu>?2Smivay)~v^U{(I)!Hv>tGdauD;&hn%Y`_uQre9R%*&ZJW6680x1`= z&tts21_UcjC#S#9#*Rpu#PQkT)TBjx&Rn;I+CnVL~IC1qr2Z)O+aa**a zsQa`$>l-4~TIHxff2g0$>FI7tsb~wz3vZB$Mdq zS#_QE6}bii{l?l-B6wu@*uLWIO6Q#R9gk-G(-*JIhPJh-$10JXQeK|#!y1fK)P(O1 z#kX%O7wxcY(rR+3`89Z~RuZLEZ|YPvH;2wR>kTVto(TTb*oYtqrUEco+6HcgeE8se z{mR5lA>?%pj5=`surN1kxVI!C{AWj)l!8d=DP<3r78Oz4uarIeG3V0VyEUZqtvM9F zJUl!CA|gh(2kgP2%f$vXCi4z#KD2up^RYpY0pgr#X^cL(vg88R`_7$&+u#3s5H3b= zxuVZL9z}In2Ume*d>1J*9vN&$$|osT)^}VHL;l@CiO9Z4i?k3x#Su5R< zsv?IY={APj3LIZ>79n7fW@#ReY*7d_>jB8>=H`anWfQU8)6;X7A>DO;bhUE3Zv`vL zvi?%%lcZBeGTmYzTc6!i-+wBcYi6Kw3!ppRxdK->a4tQ4{k7#~uA@hdkTNdT@y;F* zFs=Oc>lPwBgd=7x?XMP z>?|T6;5{&TKTDR5v}|Dh&!3@sCfReNs17c0s-Yw8>ROC^fGygOs{wK^l;FL+2HB+< z&0Xj)ucV}*CdRtmB=XAp%O<9#*1*?A{VpwfR3h=mpuz-JJBru!4PTQO9QpwEH4_)h zQjb3h3v0z?0J6l3#R1-M=~&lMYAajGD8lV%y-bq3HcN%LkDMPo4yi9TU%QQ!1XMg*drQVsvl$9@xV-X-@XWNj;PxV zbaX6k-Xy2ZTQ@?~d4C;M<|!!^t@?9bDU+IK1>goED46;C6jjalyDTDB9Xu6n>i8F? zrcV=G~Uc^&D>Ko?&PAHtV?@&A-Q&IVmhm4TTwjjQ!sC!9$x!@`jYReWu;k z^ao7kX*dJ1QA=BUP;E~C{7FOvVEqE?DLsGn(W8}LxoN-8_& zvUNi(8&P0<=*D-F3s;G*%&Dm(C_`3SrphFy z$&*mez7N%n6?3#QH#djN2)3*Lj%`Mv0wz`u>3@sLso^hBTnYro9HzJq3KU{G(tq4)Qu>VS0W~ieU^~tWT9b4nuxQ> zw`X7Fc752mr{U$e`>p1X;X|uT>ypdompN($+%;sw&}jADN$UA>XsyE|K$0o@K{;5h>KbcjBn~NMg^*f0e%s~N>Ji{VX4O- zU1;6S4^sH@y9>>WQ&(IHgr6~w*t^Qg`aXQvfE0f5$A{f9Jx7Iw_g^pU{OX+=YfM-_ zAI|mpUW$6gvQ-r5O6BDey@l{S`!zI_hhz(A9Z?p9MQGER*@@y;8)W9*{=6!qC3P*M6@SX3Etp`BNZ1x-l5Do z=Qp@V*7|uc?cZJ9+cn-QDJ!F_W8Js!E&3H`Z{TPa6BQ+zIAi}ET~#h z;skni%?P!cUMo@=d9J<4JY7<(+g>&xh5c>Z#s{-aB&r!2?&_)P8E|L#R<6)IT|<53^y#a|BWp~csksJ-GWPUM z;A{?nGV%Cy^z?v3?lWgp)35BB-#N{U_;d~^3EUGt{~^!Tb|1SwG*_aXF17j6`VCvv zOLKvBq9qRzRCH5vc%8UKF60CkpXz<=M(kCeJxFC@Vq=d*DsB=U>qWJ@wXKBCvOX9V zwYctm65vM1#j%V-LLc|mkj{EBgP?~b6_PO6W31uMfO~l$7sYS>X&qRj8OC)iKL2t0 zr+!s3$`?TtTO@sV9j<20cNB?VNmc)Iz?b^JC&6o?8u>ORI5(HnQInx^%vz_nkC;1Q3Zx(nm}~i-}p}&TFUI%-`;6 z^zh#MgToI9Ao_=N*pK_9+Z_-!yGSW!XyOhe7@hUY@j0p(lp+b%1Il^pL#^tDJ6QuZ z%m2*JksrJ*4fY7Jzy2(!sD zinrU{=ZsI#9W;UC2v~-L(LH%L0+qP$+S{+9)d>IJYCEFmi9$H`!5eG~gszoVId_D5 zIb@f_iaC-qoNM~mFXLHKwaA*``{gc0R8wMbcq)h+&9;YM_u=D z$C&Bv*s&u zD5@btQv)hcUS5tp2Y_ubRYQOfwnDvV#{P)d5ES3pnv)A#O)+lLjRt#RW!U;KpDWeUE*%j?_;5jiG~1?RoiBV< zvrnW%sw-^dK!BZt0}Jp?G^3#b1*Su6@oe6UFHV^1j`-H2v6hfFfd^YxUw`iG+3L?) zq%u#q4lpsfU<>1gfo*6|Keeat;E(yEjrrix`MPXb0dj$J8mgXPbCA{g0Fwd>eg||4 zA`=SgSuFb@E5Jd!e7(2DyBAWV#Py~}O$`Q+OH@9{{C*o*2NEB@9xWbvu&wlgNt&xW zI=cj%^U27tl$ZYqZf7)~epFhLdx9@8ppZyUe_+;w zs)CwXD7~y~9rRuVaD>p?9qD_FY$qb54g~o0R3jAOneSm?S#LO+s8MLt*;#Te)Z9%z z907a;wJ(64I1!sKM-K}K%p!|LrhNdyrQba{1?pMkSsKTYh@zJNqx?iXz{I$J1O{Fx zHDjc21JOfx6L(wS8Q4Y|d08hJq{ZWro12?{Nk)7eMR5+lBzYsAKd0u~)55?V(Ey(` z;8uf$D7BFebgdUlKA-NC4%|Y#ud0$B*9De^nko=E44}0bJ`*f(wCOJcBNDoyqOH9t zKy|~)N(?kI^xI#)dPPo3I@=moz@PK?58>^Tkj1+!8#0YSRi@O6$g_{jH6Z^ZK zEE^;*`aGFAMR|YDIOPhD`%imUAVbl-x+$?-#RmLJ_kSO*V!R+2dkeI#xayjMesr3` z8%Ka?MUJ}jveX}=4?>>9NME|aakNfCRz?e9< z1gMChK%X8-tpKI}cCr{cQW8xoLcMGg>C`UPvsBd7sLeB1v_0-Tu+r2gWL+y7wt8gg z!Ib{zaPssm;AY_|=?E*2KKy`g1|Y$Zquwy3QRMIa*NSXmgapX4&i2g1Or19ZjmL$I zcX_1~BpDzJL(YP}Q!SgO$ksTT6= zCB~vlx4!0*__k5XaIXLvmk<|6`GYqUA0NM*JHS#8F#&NTM5zDKmjuhSH=P5bA@}tw zan#2u)#dXBpYgTvQT9yUymU5@m6esMR(i`qa!Jy4j!2Q1WlviSo;T8hsaRbdGZRyRb+^j0*abclwLW)ebeC(wrI>jeAyBK~rFO5$ z%%WKYMI8A$dh+NSR-^Xi2r_f*es1nlr}g;9((Eid#rA*}WU7F8%5kDCgFRwWibEFZ zFgRMqC_|_m+e+Sb7gcs-tgd9GRf?%5``VHS?4xPS7nU5HibxRY87LWzB&WK|0ynoV zH0^%;_<<}omv?veX)cAj_wTDTuA};fHxU3^Bzug(ACfFfz|8=b0%#9Q%O%@w*VACI zg=VDz2YL?G>;!Ds(+N)J`}Z%ClDxC5>JT4?2cGWr4c|^Fii+Uo%`tFtaPH1M``FL` zPFwIdCUaIJvsYWn&iT4gj?T`Ek3QfzW38m|PzJq2jpFgc&I;y*FD%`#5!VmtrK;m1 z(Hk1S@hQ%VDIhO57fhThXeAA4t&VDb7qJ5*P;3B(HcQA<{(AeWLg-C&%=EEYu4G zKYwnBWr0@V_8mKnGR$5&orVh*9$$n!7ocRc3^wDBB?nj zz{;e5+>RjJQ16R-6f@g6w_x6TB%u$#ZBuvz)obM7kv?B!r_o2ME4;hF@V)2`z!H zF@NvFm;Z~bb!0?zy?dsoIsXaJ!Bl4!*!hb{zYa1n5q0}W68XUuzs!_I9_os^70rQ~ zdJZJ}gVj4yCdUoS-Gq-E`A}PXo@=kGi;F5f5k7rTyaPm!yEs3(zwbkL_3+^r07ocq zYT_ZfTUljxMXAEl1AmKz|0>g$ImoSO*(A9X=CH$wB@))v&>9hF0@rNsL(;mz2rk`g z*S;)$pIchGse6W>UnN;pT3`m(@3FDijZO!Lf*?D)bcP06OY!NHiyP>Z;_hb;Uqg;F zVt;nwp1(`2V60O8)znYco=y)?l{dc z9qFSUE(kAp^{M6W-@nx}=w+3vL;x@W7xla5!`mo!_Uy{q+5l8g=->c`U0PW1dpigi z$;^ykH+*p@1gDRzA3@~Lmq{BO^hj?}QX|)?nL+29eec7hFyAYC+0sKyVh~ZvHcJk{B4w(bCdB=!1iXWb9a^>CKx&5D>zO3!NUbK(K+@qiv!3 z(xPkX+S;)lb+Rbb!%SkJD3UeUz8OaTDF}#G)6F9;&(DHeiRgupUUPzcGmxbow-y^0 z2cCn#(WB&oe{l!Lg6!?=S|w&kynCoHBqkv&tXf+Dn6ZtiDd`aXWktmTrk)eg{rH;LBV_1XxCX16v0Nzi~e-S)@sy zzkET9`4{8})RzLJ-00_?r!Gp?tS+FeN;Rv@S z;A%(qKJ@XaM*0d`osQu)<%;PT6Q=CPAH+|d%)wd(Um!u;70YlNbIT&fYte?0IRGN9 zLezKJb#!%slO#&qV<4lct$=AGyh;897BX}`Uv(K1RtpA#XID7<50@&`-5D<)S zlig0jWU>UW3oIpIt8OkX?vOkq@7e(A2ug%=j*|;0nb7P{IOohSCRPIOMO^o`vNP^~ zf5qlH4s>+T|1i=b=VXNH?G_Fhs7-e5-iV;KC z7M6N+Wfy+;t)Z6@2VozyE+~88rUCByUzmUb{Q{v1pM>5yDDn<7{m+Ms!1#rMcg>EM zj~-nHL`@_U1JlJ5MAdN%O;*r)0CL;rNk5H3?tzB@7y*UzO&k)o1DcnQZ-v5>0%6`{ zqAeBOMZ{_`u+fOBx!_;}Lqi~^IP)RMz}gT7hckxfF8%;E4RDq-r%tJTw~LWk0lNk7 z1LaJ9Ufz%>EGQeBn`aPABqb#QW!EI;@**qi1qV}9OblJ84b)7K+RR3kVxrhp8efThf4?=_mIP$Kr(Ce{myqPXy8b;kM z#cceGH1Z%cH0Sl}UtQS;k1;7+Qqw^FgP@FaN&=e5xq*FI^O@Fp>T8}*j{&?eC~?Rz z;3vYo&_m%lfr5tP`Mi`=B}n}6Y6pI6k5-O)29ec^AcPc4pr!=j8j2@e`5}=z@o(P} zi90Ck(5b&6Y6h4C0R?dwOdq7qF}69+Q-;z>*S9;LXrLCUoe*#{@9BaUF;qXa_9J z46t4E0r|!j#RPhqn;=<%mIh`pIs`U1ZoIfc=Pca9&KaP4gCeSHCx5TU;Vpx=MgJFQNoIF z#ct(NK;|2CAq8&Muqu&~k^-v`QDPm7pGbcLwF#?m3;ITcgJ-d^82k6Fx%ni#pTxv4 zZ)O%bg3^^MQXZ=gpk@_31T7zfjo`2Z&hIeuD1wpevJdP9 zVsn;Q>_Co+zs0J?gMefMd&;lc2Hanehk$4LT+$fe^?%hL` zk8I*Go0KPNVEhRQf+s)@ygo=R!S6}wSv>!CAb$1=l0I?U!730UKvt!=-wmePBIrV3 zv3p_I)@&1?5^x>sfoxs6cyZF}hr@k6w)dRwp=QU#&%!nV8yD2TM4Kx|DQf!rE6{u- z8t5Q&{Qh<*2MZhv>6InAmR(4Q>NZd!w;8IeE-#br+-V3}5ZFv8?vaG`72iD?9Gjgt zU5bVSZW%c#y6<&35_kEE;xPOCYz1U!nQuh@J>>L3DaHxcAw3VU1knVoeqgXr&`1GE z04ER~7{pHOi#h6woaw%f0kl9+p5cxv!LY$2j@dPd_>J9wq8I}7Tqc$}pb=olFR7@g zfG~;=7Z4Qmy%uX_EJfq#b2eq@Rsw%D(B_uB|FQ~8ZGvBs9f!KAuzCMi;1YIM9 zTkYL)tKURJtiQj@HsG%WJ_|Au5k^C_zK(S?LMzI|K8H6m33fI+uUf=E*5CM&sG zrXCoLHu%?`9yFTy3`@`+f_1M6J{8EI!2Tp9Zs--|Fl-Ka3z%qNE8rOOf*lV^D)2B6 z;}JO}PMpZX3@h~RscHc>juQD@NF!BLQ0WXM9{6ybsK`Rjhj{%|(F`o#9Y?YYZM`r1H-vux2uQH}Ws%()6_u94m=;wRoYaJjpqd!t}ePd$bh3x8vPy`YQ;?>CBc5eI177( z46p%udR&pJ)%cthFE)TU9{TSyCcT%yKx1L)#bSXC!=pzl?7XVA-g!r7F`*>hBnH76 zY9VB#c+EKIxVgFKN~01JX=_W33FrmURXp8j=;^2LkA~bFnzQ!yyLbUOp93Vnx<{Eaal>og`lM=9r|AZX+XVQaax=z);JMj>3?)v6! zQ_m=JNg}ZU@`8BaQd_RG}Z9T zjE%MRJ(R!TSYZ4tlI_{n4W@vGj~`o@A4CrqfekS(`{86SsQcJ5;O#hH!B=_Jr9Du*)>Vjo@4_HkTpaXJK_?q>=Yaw8`2zLwB%=srtK>9Y}+o0M5 zG5CLseA48(d{@L!QvDttt`$(i zIwmp&6jCjj$?WhO$Tu_Jy*(az9QrRQ8iDhG@_1_nV6^R1`z8Mu>=9sXjyh!M=T9MY>yZ)? znQ%yZ&?%(!Pr)&XD22!$FaS;p{z%-?2wjL1oC?86<7fO!w-8SOm%yy;3}m1# zN7?AEFY*t@u@`^K&) z3IldYAQ8pJ8y_8oEKC%!B1Xak1wD4(*LSxM{(N)fauireXtDyBMyCm4EC-NCS`D7$e`Sg!dftv_s9`Bmm#1h zICo5%_xQ_(#l@{M-wp2=cbpm_bp6_Wl^RebsqEn_LnCm)MKRP0CgWIfZ#0fOcGM3R zB2St7^M}av0$af``Z%nXb|%%?Lu60%&LH;c;O3p^wTTPHT0*&%sqczn8k1(Y>OOw7 zK-!IUCvN|fqHF>gFOd%qjB16X2Itq8FJDk~l8}(pENP;#ZhQCcckIIjmsFliuttDA zdJh>26pvYpR8&4YIF2T5J~9v-z|!xxxl|!6twAN{ms5b6lR#J`()@yj?)17qK~`fG z+Jde+gfftKE~6Bm=`C)5|K1eOpLiT&*P@I}7B&Gwjt}x5NrYqrNeuG;O7$I4Av<<& zj2hRJ;=uz3jWl5by3I7R%QDJS>c)``lAn%miUzsM!}wrx1>69S1T?J;Kcl zP#O0c7y)douY)^jBD<@J4L^qxP$feHAZ>ikTbWgiS-=Xih=UqJ5pe3leoO|&<3x6X zAWv^jtFwY{chIoc3V;d1N6KI1FtPUnzcor5_??&parn!U%==6xX&m?O-1ap-Ie7^A zizN0HB16qKV!?uyFLS{uRh?*FhqRO^O(m59F#|Vl&*BW=5a$ubuo@e;;Gdw9I?wwT zq-QWU5wd^+&adr!D~-$xZJoXfk8?02;pD8Ts$$1zu=MngaPGmC)+FaZr-v^(e#Mx5 z0Q1mia-{C5u}>32^Z>({_QfCc&;i7N*Mx;z;okr8^XH#z*FfPiFmMM~6KQZ2^R3&r zadgfiD_mJ!t$9v_EPzOdK6(U!ozMb@poj=+?LoZTj__=a^RMO=MO<1$csT4Pz>)`%D=W(y+$$W85fS^e_Y=nOPGBg}-OZ>+uq1X-eI8xn z+FPAd@V9*Ly9*THI0Lc9V*}GXLxWOHO+Nf-;|M@49I65*$rkdIl$4O6K9%Rft)V6H z4RIJJwyBMc5r)oyW6bafoe)+Tg+(A3;KDmofS06JB= z%-8pVHG?ndA`e3333_7QEx9#2&@S{G7l-XxxPJ z;`+wMiU$jH5)c<->zfH4ph`>E&S7QCA&m-aFol!j&89)(P5Dd%& zIVPCU6~hO2D1?LNhZ3-*Sg#QD9(?0jT%1*tr@-t{BJ17b>e>l8HCz!+ZBUc2Pw?lK zL$tn2xG9Jbb`Ok_pabb7?m0(|mi)DA{fIfqv#3AtHF`JNfFEFQb3=m(vGLu8Lj>-C zF$dtEL~?^FJ3HGX)bAB9sv3OMwK%*hNCaTvK}&q7{0h&LIvg!&6Vo~+6PLJC#^ zw6=aHAW%{Q#4f7B8HU0G{WpsQvm*NyYtUm+>;N+L%t?0KFES*w_ZUcsv#;3}%zUxMBh6 z?~n+7{1|p(Lr<&k(wFi3Zr*o)I5{}D?JOIAY)y^q(W6JlYZTNpKzRTRfewuvXBf^2 z$U6$I@6(h6H!@t~_~O#i7~54e9BA%lp>W51pgF!_A?2~Lv74r*RnuSl`}-kmP$^JM zbwlGFuw`H%xhWNoB~DyD4GmMccwjL0$XRXSJ8Ik!5}xZi+z}5yT*ttw2c93cFjP|L z)Tuq2lVfA#hbe(}p!9)o`+0 z=~6>hndH>y7U~-tt#Odm>`L>W;>Dzrrlye`(Y_I`jzpve?DGKUU@HRcV-x800D-MG z;*JHOGZWT0g6-@c^9V-(GQ*mWM)&UB8$ZFvBC+jAE`qLJ2UnCC4oS2nk1{+Os_}6H zD-{IoXvI|3!q%m3r}4Lci2oZg5nS! zPUL)vZa3AeI%#8Lv&<9S2r(n}%OMt)j=f|}PX&&Y*jA!LHso=}eMd7pVh_M>Fqi+5jZ}T+Hz}48=tgOTI-Wy*pb`Dr{s( zcSm;ma!TgO;4Y8u*6BpA^uwf&({lB`QYyD2yFw<^kL)bzy#gR0VQVckFp(-YY53EO zXz$F}%SukL>7c0yF+J?do-{qDc`(amy+Nv0S5GgMtms|#QO2n&U`dbT&&w%oppqLgTQ z0H|^0FEc@SN|I*v)#P+C&!nc!6R|r#-TB)}4m)%@SQ=>ZNE6Clt(<7`jo#WM(7xXE z+CM5GIajVCePA*Fj}n1QlIwD+IaXn zu0cL=Z@}`Bg!VkWb=2dy0Sohk*3JBf;uoO@Ojsde=3wcno% zVs5IOOb^|oDfb(hDySj(u$D!uMT;@#f^!u2rpM!4-ck@&0i~k$uQfs|D;F|SBHW1* zSM&P?$8L?sojbBijr#mwtUV}~$kFg>2c6|B3V&dsv=q9F{eP%+N)io?2wkt%`t@$G zrt?!HcZ1Gy>F;0Ia~nD8s-5sWzbal?rp_=T8j?1F)&a2-jv^3MemZ}&72mj@SLW}E zZTj@TbMyo|?nsEyY)_tkcx7o%`&jO_L$u7Dd{+(oTl5Zb7HGyhaA`V!P^zDB5wR-t zd?OVm?*On8iBo@V?J!CZI1KovWfdA0RJ3h&*>(Oc*gIN0DQVAgwCp-zGv4djd#~n1 z*1rR95AE5ia9K7Jm3hMZ&Ppe6RG8gBI!2ZdTBA_0@;KjjLOkm`9M&`KNQUB8Y;a(O zuu0Ky?1vl)tnv~272q?=JN>4{oMY(=j-~f;6=f##)F?*&o=-iu!L~G)BUAr}e)L4s zPNwQI*&4}XHP3v$Q9kqAmT^`?8=7lYqJpGdD&Rd)-tLfzw zueAE`Af!F{-2GkcX}aE1{QdrB`CUJrp6u#~8jIE_?X$R}QY4#Au9{u(ao2I%xQRV? z44W6b!`63Hwti-{n(8hyqzn!CMxtFxy=yn6L?hc~VBCtb%dYtW>!_&CNGZQ}>uL8~ zvwI$2Ax(b`H=t1mD*eRC6|m|-^tcm)!% z9-MpwxPPp2faYKg(*1rKvYzvzs>8!oOIvc^)|+Mv!$H20z(Sd9;ARdiYy?wle)iY1 z<2-D}B!qpL!dv^cBoEWeVN505BV19yvullXTOl4v?anF&9;I{9U@OIeROSLoyn zvsA_O$j}XBxp2fWlyA=BZx;BB?e=SIj40Vh(XUExW^H{A@F|hp);*~As%i>2fT8AOs7KUfxZy{`44~>QKI2lyR$Ti=t?!_ zqXY%GjCwX0)0-i6Q*KA!Gx6-*G|(Lc6u%ry+q$oF&1EWwPc-=Qtx== z-mQj@6*ez6-=XiIXEf$@>3Nf1iz`E7rYb(0h4je#U#s5=mZ~!ElWV*Uo2#vP#kO7D zy=85#+O>1tfP8+do{~oR0z>!e^_9a#>P22ld6&j-4^z$vH8yi3$5W~KuyFI42Ud&>ITRVy{hAaUev+ay zgO5*YG4H`d`edu4iqiPImU~NzS8~}J8ioD(na*q^(NdUe`_Z-SJ7bLRefQsg6{Du{ zW0N6UdK>F6dW>#W$xWXC z&o8*`*>`G6pxsd*I0VX_(1Ha$IY&>BO=R(1qp!;C>f#8u# zbn!87Zrpvxu|Ostu6iooK(3{r0^&)A#KX5U z1-h`*qY%~6*PnW8JEQf(=h=x1LKAnC^S}D~OEL(_^{SXhJSraT7rv6n7bcIg2J5DxA^c{iZ|Ev>oW@H;Ghq?)%jY!^JhcgABfzruW!TS)lTBu$Kt?$I=3$} z>VngTQW=Hl%n@ON?7u)JgDn!q|M>~xkEQdkb-R#;48sLWa>0r1;RUqWFzNSC#XjGE z{~``QD<3ynUP*_Jz;iYG>KeR?CNBN+3uHU%YJS!pk-ebu>`Hnj$=Vrk~BV?Vo4pG2VZj zmY3C5p`l`wYg~=E11<^Z!JB{8 z{r~G8d2udSrLOIVm4TTVFuV${t%{6{2_RYsz2JI{5pn0zQgCKbR>0Ks=)Wdu_kaDm zOw`OG`cwGYIy!pHXCMC0J5CO*)Boi|R1Sd&ascDCBR|3LhvtCbd(3y*d~X*ID^fsD z7_JB44he9I#&NiWV31MlujwPZ{_8$%7oPj8dJ&EOV=)~GTtgsY=edJg(fnkOlNNVbBP`-R$dIUzU)8)k4HD6>x%YS@}+1Vok5TpkbuFzM4gBJ z>-v9|4u_xgw1{yY?{|<#P|y3an+odU-vm>4L{bEmfINb{A5{~87-(eb^8R^gveNh3 z+nyD$Ra4zZuRIgnt5c_X-rd$WH|JJv@8rAEULc#SQ+Vf4V?HQ%aN>bLvX+eZpU)-j z|3oJnWrm>{pcd5S-vR`NtqQQzA})<5i0z;}W)rIkDWi%vtA2=n!6a_9+LA5xxQLJ>TA_EqM*&a=;&hs2Tw0`}8Dcc- zJzQLt!9=2>qJsSsh6>@a_M1}5ZokR#U+mg5{!<_XFG^baA;91gUBTsNOgD z?(s+72WS~Bs$Eo6eo_;ap4k%|3VRRc{`1QunK_$sk`(0m!k_*Q?c_^R&j7mzBmh)3 zpb6nR4FSL9^ET#lhCw~n11FQ;eFwJ}W@%(<8&-COiu%$0=fRHONJ%BvLg>Y=Frc7o*lxPSqs7w9OtaF{BTt7)S&vY3_Lt8;;clU|rESNf^y!D_u)qb8 zh*k_~=|t^!D*LaMB>(s?+3P~m?FIitG>(^2lO9Kt{&wD3I`!|DOu@0>>ETC>iB$jo zoADd!cXzAjZbC7483h=v7xT=gNm8!T=l+Ieq%RrxF_r2JR`ESz2a* zd$p#r`=49M-1+jG>bWR0cte^B_5_|Ig^@Kv11Jki&*}bs)f5~WyF32-ebHrJwMy{+ z=b=+1FH!vW_f?+<{P$g_tNdRZN#m8t4u=1_g!WvL|B6|imS4U9c^!U}Lc}!jKhMaK znV3!fd*vjHQUCw;v0>lF=H~3fxdtw)|NAbHJ$nV}@G?B?_?}jvZUjjB|9XCIS)w6O zpEmp3QE>e8q%!~YR2R0so|~WLX}r5tIrTbLfqTu=NM811O;jWuyAM0($CRY5)MviZJE6tPWBYa2<&UxyTz*_QUHyNpnMNs@yG9SNEj6q? z`@+TH%Tu$la{t8VviVyxbG)VWZwaOvX!82iNEJ0VT7oA{w={#*({HN|sj((MJERs=dy15K{K) zp)P*AO_LZ#oyy-(_%gAwrtwUk`OS_IJWYcqHolfkcdwi8g44Rw($+bakSQj{0F%ue z(YQ2AJv!1Q8wDh03>R5K=;c~VVP(b?@MoEi{)+(B#*C8o1C2xLr_MVHDWA`4k31Y% zCqN~XkY*XqB@yz9hmz9A?Iu694Bbx}l7v{yz)6vB7m`ym`cVIZC+L5iNbQT=&j>Qe zsbR>h@3y`rNoi(EOZT$S*gGXYD-Y&s?)5w5AZwJNGZ)>d+V^?i)GfC$&$`rDyMQ*( zADNiGg16f|kM>wwjI^`y=pv8IBn{OE;l{vgrNf&MJyc(w-WM3@`IFAL`A&xyzK}k$ z$rRMo&y|PTha?5tV>#6s&6y6&$gubFd-oV=w~?GqwBT_H$O~s?kM(Nr6DF1UJXZp` z!jLU`Pp=6CN6;o(ykisPl1Q6uzq>hqy74;6^{S`vNKC0VANAtrGcVU1kpRJJ4}wD! zLTapXP+%1se+tZA)25d@`&?zB*yE}lqqMPAjEUBBGap}eOcjDYS+gKLXBW@uw_Z-ifGN=r%k0iINn0ttWg2^hPdI@P)+hK`!MJJbvJ;f;ooUn?tpcbg@^^yQCk z++d0_LqiO+6fpG{S_H6a9n2*l_*8kGnUgc-dW|~*wzT5l9UNEYk9LN$(^-4dTepH! zc%G{O7GX$L$IKCG8VpVPsLkjyXH;Zced`S5x)BY~lmP2C{=1Q{FQP9Wj_Hpum)(L# z>$^LB%=Gj^cZYSOra|6uU&(JWhuAW!GYz&?1U<`(NtUa)1;|a|K`o>_wYUnDTOnsD zJaX7U3>`)cC^s;O7ZM5MvJ{NvH>&tm@sV_36e0%knLgIIG~5jc-0><9O(KVY%4?SS zWMqRtaD%DU?c3NM_)Fwh?TcY%Jy08f&JY|LdX;`;csK&ht$bb<+B6gRcMlFGu~YCi zLaTx?1KNUQW%ZcZ26sFcjF(G?Ergr}(Io=&lV#|zl0n@7@u6)T40sS;LPBT)Yh~IC zR9@+W8AHWjVrF)v-tKqp5eiw@mZ5DRLnj#fIy2MC!J%Ww7QMUjYl%@&+`8QDGVSn^ zaK3l16vjp{(R>q^k`8~PSM9L;!lX)Q>Wz&DQLa2yJQ7^@dF0BjS^@L7#c65g?(XsI z6shX5=r`=$%Nfhb+lVIe0V=Z6J{2_$Y3VBP1pBl}kK8E7N;WoT$H=tf@mva}eb==PWUfNQYahTEyiKv5v27mOc)Kul0k!?b^ zg_x^Z@!m2tV56=2qE-6d;NI-4tf`5KAtIKHu?^sz&x%VuU-=^N8QgvFE|6Nvl>czu zL@9ukXiKcpKh)Rn_T6^mqiOz^FDmz|k(J=MyBCN5b$BYrM{Qz5^if>lX!;(Wpw z@-+=fBr&!VEzI<3mH(s(l8y!m1w z1mZKisbDt>|1Cp9c;^sJe4C~i5TDKjn8YC6s;H1uqX%{BrN;5pKtAPmG>nl+3n_yL zS%QKLycfM};s}t6QTvaNtMXsh4t<5O?v*RFG1XvEgAjn>q;G}pAGyRLL+6rk6e&s( zaS*OkDRCkZIF||b;U(vbI7l9)@L;4Bx*6!Prgu()77GjoCgnCDv%tc3uM8cR0u43w z#vr*A22xVf(qg1M-0~2>s92(b>kRNM)D`o*rmeQd=v{ z*g6<*$`b@93^gA5t4>c~c!9x};7cIxAl8BxO`H$}$Iv3zd2@?(l$Pjby2{X@@rTc= zs;VLm0mRf_Oqtv-%u6csTgf8s4lq;r#x;(l@POjcGwtNdjs=qo;m&iFrOvioov6qL z)9wXjbKQ5ye)IFy=|~BBO?L5(Be>lk;A8`Nc1gWMpt}J$6{ltTn~I8x7cYnw zw=IkU0bplhoCZ&jy(o+7@YC`aJeeTjpbFzs$n3Ow)jnZg42OTHpk8-cDTHIpAS&kV zw}C4>4h@AZH=bna?-FapgJE0^ARC8*1@72w2oznsSp<9+ahE6T6ft4bPWNE9AtO@_ znw(7FDqNT0zyqgF3n46OU-pj9&fEQEJ>A{ir7#1)3csM{pxuIDO$47DEu+RjmXTY6wt|U!9K%gvnn4&jd9dey%6u|<^ALqpKGDe?6>$tkQ zN+cuwi028yqXsYr_6#E_CK9_)pwXUzA-fX}CExj+N+r-pzvmii)&t=Rn)xt>!|Qt6 z11AV-vRWK2slq1VT+k~MTQGt7DmD%lS&rk8MNn6V3j3mr0{fgbYRS+^UfyVbt^0WetwWoG?)q& zTkEqQvS(q$k;ud}-ftXW0_+G)@FA-qjDoVq+#P6Uj)68&ZuLYN4vQDt9iWy19<IXmdYG_7>$Q9y2@2%TL8^c-+H*hkXILh`9hy^*fl~Xh2~D93rcG3WUsM%!oj2Jb~g&T)Ygoi?N;0p+8xw zSOUl>UfQ>b0Wn1X(dQU!F-_>cV+vqarXt1rfE|RXs((QrFcpmbaQzq`-yvpZ5MhY} zetK!6Qf$&3%to1wX zFVcU&i?MwfUJ;kS0XG|P7LG?+0mTHx3`ZfHG?3rT{Q3oIfPX6y)Vg#jP%j$?2PR}| zWOZI;)})Jo0Q_u#2}l_LlA*W<+Hw{X62bM+(fMd+03Z$2BlLeEYU{9a1aA-o>?AQ~ zDZva^d;)-2w{q6iJ8yfi*mR;G#<*i{p2kjrZG;ej{{myx%YFxH4S~=JXH2MV+{!(X zHG<*69WjCBjYEON|MJ|-{k*-TGOyZ!ZYUhaa!^&JlcB>|30fK!6y&9taSTKc5d^;% zki+0ja;ZOG0&Q{e(TyMSe?8sv6a@efNmU;D-1j?=ARFbwaR6Eq#)v3p*r5sGP;7uD z2`EKE!UOzIE(I-3O<@rcph__QhdKA#9t>Lo6C0_KiVE57FPMrhBm{#m@A?+d(G2;c z^|Hy%e|*7!&m)clw!pN=4zq-@^8K8%&(3*mmML+AXa_+_u3k3LOOTlv<3`ZUVDA7A z3*6zSCNc0Sho9Ek>Z%IkOqE?PKrMxEyc*1^vK3{)o#SRP%ms%6-0Vt9ptt$@KMt3m z!Q$rN<%hNA+wc0-XYiIIq%p|Mo;{m#5OYnyzI`4OgYn@AAYjE1$w(hQAfh6;WBX!Z z;7w5abAnJKDcOIg5DTuPva%8~wd6on-y~U=1o`R0?|9H+V7%z9(UX$!KZAD6RXhXP zI~uZh(NJ@<%WJtg!E*&kl#fXa4pkh9PaFUm0_8%Ulxiy*&UO2YK6vRA?rk4_*%w3L z2oGLueSM6zw=KQ+l%2xYU|#~JjU=*Rs)7(Ratfj!UE)>xP6#%>eanOmp}jrqmN6Ze zNJ@aTBU|gl1`Cy}OULDQO7Sz`)uB69Jw}|SN*C4g%?jTapTuba0D?1^HsaV+{eQxsf@XcyLkvr z-}M5TQ*AwMHb^VxHdnGgFV=h2{FnxDqQh$ObhG%r0|#Iq_bf7!I4|w&bC8l%L~kK| z!;T%mcp2P2#ORfO9@}6lQD=8Ipv9_U_~BwEHBpcNJIGfBa<|SLtQ7!-8NCSN7g`z^ z2le+o+3tH=n;Y1$MBlE&L?h(YSFcEp=<$&E{)lWB~ARxMLS?{bAc0au6dY zCx;^SO|b#ymfEk$g#VnK6%hT1pF9J2rl2Vbu z8?-sPJ3FCu?<}{S{lt3cP&R%?P7WI@s}rqSG-o#Ws~s5H8@3O&0$p90cs_Z`PL;m1 zt&NjH7SnFf54`vSV_O0C!!ybJ?Sb&iP7V&U;%so^v>lR-RNQ~)(DP@{8tn|UwHcLe zYGn!Y^WOm_AEeok6H4tzDCN{(#sDusBs8eWp)-R8 z8cId~j~giEz*v3DTZ(Qy(jznp33?KSMew$r#R7%g0oSCLjqKVG#y9K~*mdH~&zeRP z5?Iyf!E{fG$3f{6y@1MZiEDRe5Kj<3#lAS6{Q=e^B0Pxt_{Ek&%&^M^W8cRprqzOr zA|*Rp84lOG8R5i&XONql3&)&rF4#jFuQ!>)*1uGUp8Xn9ee6NY*J#$!Q|^>gL*~Lw z0ju~GRHBNhf*{F49!virDvE(AzPeh5i6^6JQ2T3duXx{2P%l6%eyx>NKQSoE&%se$ zU;ipEuN6~ixW9XIHN1OwrnK+(*qAmbnp0C*omNnEdAPfah8#R_Alb5{yu5G10r?xh zZvKUAE!fw<&oG?JQh-U?EARU>#%sZu8zRQ5B{E>V+Zo^?DJcaDY2mW^!LXvd$j-&Z z1)DJtr50Cl+#+>1s-RjTG?`;IEF&ogaAH^>;^Ck^xcZlw1_d=%Ld!8PuPve_v#+rb zvod!??a=tIUq40f;JCw&B6#6dgV#tZgVpC^1b75az%fmuP-WQ;A_+$<{1@5axPU-Q zef?3yNPd3IxTe^FTwA=k8TBvzF@B4vC=-JbetqM}_S2ol0@A7iI$Jb>7-mrvy1zh~ zUJeA-Ed}8H(g*jGa)3SwR-Zcw((dGRyz*yF;7~x%mfdPmpf`<-%uF!0)xx3Ktvde} z<`Pv^Z7cgJpSatX4rw4Ot0Y{e1_naU9Q9>)=1t*&QtD-Ds?S}jud$>uEkY2AoSh9o zM8{G@m4w06HRy!Byrs+AI45poXy^fM10a@Tj>A|4IOeOWyoFxTQd6TQ^VWgkFyyTN zvS7}2zCj#-B#2+?0-+p{s*ciP3PZn*(4Uc01AQ6$dIyO$44?}OquC!Is6jRg+Qipe zXXKxm<>{=ht#Rnr;P-iXNnP0EId*Qqb#rCR#P_~A3T!N6P?Yh7+dpP<;&sx(;v#4e z_zsxB_&vBpd2%vk|1W27);@h252G*?{K=~BN6aIpma2SxFr(1#0_$LEvmMLwhw4UH zzxcIU1mmoH@W6Y=Px}?j1+lWWMxIX8B|mvG3m>mfruh@$|A(|UkIJ!q`@S_ul1f5S zgrpQgl0+p@$xxRNT`GmQXz>3Nsv`Vy zzt^&^YoR*N^Ei%u-?#0%eFr;RTJmR!r41&Qih~E^aFXn4pfiWRn3%IPPbiqZR173Y+sTc~C=`GUm#HXmtn-e~LaeHF_tzT#XFHNv#m zPg&GRpw->9X_Ed5n`5u)1)|1<7hj1QNlHtj>ckErZ<JBb?Eq06UXq=e#pVXu=rPf^GM@CVz;lv31vQC8MFutfU~62lWG6s?8G z;-&DIqHw6{Wlde(=vqtRxmal_{?OglEoUhwA}mbHo7+?D_AM0yCDUvYvAp9DQTU7K zhW3$?!n`Y78Bmy(Y-Y$qx9F@qV^}9N|;_Jr$Fzl5>VgCGM=ZZ!QMT z1a?9N`^E_+2-v}xG3Lh)kIL&Ye+S$jaiONXxiX^Bs~87U!*cTa=jd6=J#(I9BqI@c zui9hp-Q*&dv)9Yqbu8uR=}u+)DF*}x+Y_&VAFIk^Rtw`jnm7z82qYAH9$HYVhqqV3 zHEt4j^1J*9Q_GhX6+`iRR#fDu7`?mavDsMX;1LA7+sdl=YwOZ|3G(vty3n%7wb(an zB-%Qg)EPz{{{8zpMyK9{^_{fz;+#2i9Nj58v07r5Y4o*qMkbB7jNw{r8|NoksEXL9 zsK<&L4;nmJz3&Q^*UZy+o%;QBx|v+}G$!KsafxGh=shBnpPX`wtE0+di#;_PsUIT2 z3|oFURUb2Kc00=9H{p!l))hx4&t)zuFG=FZ877g(6S+osuF{B}*d12~|3)pOrAvm7 zHEdWsM(nl5iLx@$Ro}CChwu#uFQz5(jsxBp7uDyo+nFNq;pgw4HTzn0mI{P}BE~`o zXPHO0v75KNX^tBx<(Ok+PMYkyYgKMh72_O6WhW+b1Ot2-eM}V9FJqCjm*u2PqS-8t=yrmrR4#gf_?$wLS|hY*wi1g9OGlKGXF@jrKOeCHDuTET|bhn z=9&s16d;FFSVe!YrSaxIh#D=F`}t^Om?GFRIuG=$km6Bvl7SYI>p&S6_;YM(4?)rv zw0x?hI|N7}7)oBehdhYxR)g-=LZ7ZldU`uJj3fd-l&y^i6bN__M-`R=oGzD{dj&F0(A3=g2GZev{GFZ-zjPl&xs2)B5!O2}-kYDBKz5w#F@*r8YdhTnHIKQs8L z`mr^T;3~??=ay`yqa~^AGg{U4D`K8Ght?QI_$%K1-^qQLQDVP}`{^mOcpd$2%exgFEGl4HwtT+k0{QUW^wzezh&bA}Iu% zjX@}66iP~pC$?f`!OH#^k|>?Ilms~1e|>R@tH11pT*)zH@2J1ZC!=sWShnfF5-LXfb<+a54Hzk=yl!p@}1xX}bo!b{4 z$k8Y(-(FVhHP6E0g?3-B;XUs4l55(mw{yo1{3>}*CMJOewX5Wv(RETcevb%LE9RaFLFK?vH*mv+CV}gV^VPCg)&}rtH2hCd1)a!*d8Uc4Ld1e{P z-12@VmPsW>4hq)l;Zm-^{fVxWH%2mFw@wqCYku@et=G1snQbrjs`nk6R`yiOf>tiq z!9(w)SEjzYx+_ieBImurQw;eY*PHk>cQkod^__L(BSHp4BP!x&g@wI@iq04wcrYRa zQ{Kp5)&bo!NB9Ief(iD%abDu_YD-(6tv7=7N&6)~wZ3biCZ znlGSHnmcz>_Il)IQ$t(Z+JZIPJx1kxSJ8AS(O#cn3xnO^swa^5HveVlNv5c; z<7QpO(sxn)LGiZ+*8L{nEKlM-7m$QMp}7jqX)$%bsl^|CmD<#|y-$hu3M|hX?7NRE zi)-mP7>C(+ei%fgmyYHhNhv8mg%_2Tm9Jl`M$sY{(A#1;1N?)xH(D$`^l*4;=| zyGgcb{U%GfC1YM488sKw7$kGwD!taUO=PAyc!snKfr^768>--P~725KPfg81g>w#frq! zu7B*i|13kh%O0?F>ALhvc2`*{?OJu!8rw>oQVOmK%AdvJbSWEef16G0Mu+r+$BTOwTP6L-eCZHZcdk_I zcw%r+&`O`bTaKDzx_^DzcKaTn|4xXaFTR3I$?1T%8hPQ;U$e!0bz0m5=8@cV8z?R( zZxnnNpxd=TtTbrm=SGN+P*M3v-W*m{RSp8DMhtSO66a>1kr18PLJ!4zot{+UsuMeW z)acv4kfQvR8Lv9ODKrW^nU;*|BhgAmSQ;B|sM)X;{!7$-`wmGaS+2c%) zylnUh{ONB#{P9dQL!T8Y#zz!?on7(+B@s?N;(o+HssB(|X(Jv!D;nWy}A;mw`im-0>TjUIZ8uJ39|y=c5q z{p|&%QDro5J&is$G_aDB)ZEzOkc>MxI50*i4piA9dSO%HO_jewjZD5UCCv0PQ59su zqU5_l66?>O)7z{3fqaIR4tOUuRK4!3hEZpmyONB>S}pmU^-q>di8wAkQ)IfbrKzU( z5;-hXG>?HDy5`N>W_%f#0TeE=9z(V8WAJGqX)PWz;NAF^aZcQFtxZl&_g%EP1@E}= zO&u$9W0>+e+vrT5eDuWAom+?nXUKHayywwdNlPchSWs&yo5_9`^V_hJR*absUP(;F zK>xje464}YG;y%nHV*Ezsqe-8ly3}c(MRP_L$n9paPeL3`36B5R$7vDG-KA>h)kRx zS68{CflJ2_p^Hd*TI;3DmKps0Q9=pD(BpYwp?$gw#9$k`SdLPb&m&=KZ^pEIsv9>3 zU2oVDpJaMO)W^wB`CZLb!!5;b8Oonc4@)rQp&l~mC@a)fcn15^=X*rFu3{)7B?IPm zbQ)p$-yeZN5CeZwpqiiIy>RrYbS9v=vp2EQOSAtrZiK-B3ci-10%tELees5|Fh}9d zt-S6YQ|7+s>(zXAH6Fn1uAf(8EfRx*#Ez};=_s!R9=Pu`@vq?1PInZzLp>7;R-4;0 zF|JAe&4Zp+hAZo~p9~r@AhpZKNK%kVB1q2$Ppa&wXsa@QJgxo@Tk@4s1Asa?6Q(1* zk0r%Hhy}Fa?K3YX$)x}5yp*L4{TJv@*wh5nLD;ysn>t!AoRtONfmvudEy&RY2tqt$6spa?bYEfgKv- z+8^a?>}k{^kY#z#In7LXsiEOst7L#^?Rj}Sm2S=lSTa^qENm@)?M%I3H!k*>j=ug= zPdl~^_r-ILIPv9x&e9%&o-*32dD1pzsc#_X^OGilVS`g?O)ygXu%+;Way(N4cn<9J zef$T>2I)!b`e*&jKL*spO%DY#ZKRw!T5%+#w}V&%`_mfP5|+jg0kYzArj zIJxlo^Pto@?GhiBP{^8Xraa_PR#)GjaGudWiW5KyI0y@3-al5-8h5(3YTi;?+b6BN zR<4Z85;^%Y4yeyRw}-1?QtV$xtrg=2xj(C4S<2YCdX-30Dj7rSeS~Vx-n{w7MVrlq zsAKUFqHCK9CJQZ7Hj)uoTqPvTvb=QViUIaoxei(ihZuw~nt0)DDMvD%@%*NXT5DYO z3;j=@D{U~+V6G?d;fjvdl9xpBf^7K3?$8=`F=wA?bp23;vB=bV%EUvZuc>h7QNV%C z>iXv&_mz0%_LINWzdSu8f#CCf{wzq^rsDMoN=G$o0Z-u=`$$wWvlyPG`$W*0;{=0$ zjr-dM62wi@)U>!#I(N9ZsL|esUy8Im>ivSH&wdsj^c;-j%`e9%Dnp73`S2=ljim)s zZfnyc(A5J@`cVj=Nsy?Z5;Efr&rd4Z{k`YUDy)|vSOc}qKI7@(At*IUOSgG=q$VZJ zIcGIWMI|ySs`TZ{7JVPAHMJH}0`QA7;^6GnG~V~e?3nU!XJGN}ewKe;RC_>ZCOjBF)=n218?4_WrpNUsB&w(+G{Q~F5t+41LdiXBG!AcNO@0Y;VU<^xMD(misvvT zF$}MQe_`Fi;&65$$ZQbSV z?M~U;9)(uW0$%V`&j?E~+V~A3S_G16Q9y z{ZlCqum-%XLrpoamXdr0;q0t^NHwUk{!A^lASmk}dk# zE=41}&4QNJ*45!m%9zM^>SR4Vi7#PJKkU*v*|M=&NY#g!^JB+ud;9nz7aCw5`zj^q zOvC54xhoWEag_v_ayG|$UiC5`D`viQ%+ZRT#o7XIFQBc6$4f8U)t~k;x^)qsNRaxx zyW^T_=iUiAL7JRp@wKH`2-w>Xb04I&_POH5k;OwiCmOrKVd7$Vd6_(Ho%r8e059wj z@;x0Y%=$%&8l6A^o^W2^UmB_SV?I`rX~M^`5-qBK1;r zUNC+E%H>n;8<`$|utmd0dBv#Fqvx(BwV;Sy1KL7KNeTab`__D3Q>bX4okL%3uZ-57 zH-5z}xk!Z!TY&!Me3Z({D@87nV*ZgK8`u)r$|~|E)^3@stLy#oQ9nyL*g?ZZqPE%R zIJ9~cMw!EZ!6}q^o4}>#qioaUBP!eRoZ{Gl8bx8>w)6G-(x=Sb7!My=M@;cY*h-vj z)AaNhkX9R8FNRAXW8w)nYf`Y%-lnaj)cX1g-C2p_oP=7ynli{zS?@Ve1XjeWiXVrr zvGI_Myw}IjG5-5sA)1QkjHut3zp3_Ms?K==-V~wITY7z%KW(GJA^k!OG@uc+F(((< z)zsWPKBa~6Bt9EPA{fsX7H*`}=>A*T{l2JZg03zTTCz7pW9L4&w^@2qNLK#z>VY10 z{g#aG*>0@jz|H#n`TUQFdOeMh5g+fsg|pgVld^Qkz=4!0A1@nbcI+~XyO*H$=l5@_ z>-Ch=bkn+0td&lRw#_umQ zLLHWfrw2k%3Lc-X)_7#c!Wv&rH5O^(Jn{9ewrEz%(`%EeLdT7r?x{Fv=+Mh0_3Wwa zq|6_78V*x=>=(YcJzVAS{{6j^^>hPMS8Kl+ma6d#AlUpID>dxhvUUJ@^K-W#^`&1} zVDTq1Gh4T}U(4HdnEqvLqjU^^(6{HmEi*?|EB2Y*$@v#w0ZINF(R^kc0Jy^elru2> zzIK>-%MHq!u79jKbNaCPNsP3xH~J_U_PWeqi_tvBsNcMMC90X5+wFc|=+o);Uqnl*o2rAf#HdOf-mu<6VxPR*ScsQrv)lxSx!I2LT6UMnOA@N zX~oI_hbg8%m0hhmHRA}p&g0ra$w_6+C`TDqlBn(;#~iMnu$E{P#4sX`WDo3 zQZL6-HS#^q$+LTE9#7ZYWPfbU*ntOLxgC|g2C2bvToeUof6>z=_3}Z< z5Kz_B_PR)2d?j&A=8`Q0=7`7G>J`~vE6_w~JFxdo*f#=F@eo0cPPx<0MEF?EvUg!(EGf8!%( zr~|N(Zt4|ZV64kofsqT^$^-3T|K+U`#C`>X1YZVX|fSnmC%(D z0IjpV>R=@>fz>;?fdjC(PNt^!wZsma@XH!!iq!f>GRxFe)Y=?wyNAZz+glg(*ef(= z#(s~j`p?yM6LSys(8%*sJ{TGbba?Y})vxj6#tj`dtdKkR^y!KDcl<6YJinCx87x|9 z#;)i!W$0uDOw#kqRLqDhO~}exex($!)LS#j|DlRSlY=)_4;<(_n=L^P=Yp_~{(uB7^$fSp&tA>b8&t5s(EbOZh%x=-Koic-O6Agwyezgf}i<;B=38Y|X%RCfQ3PEhvW zjjab9w~ibU=~T^&(W1XZ#$nmj*f?F_t9ykwI0i>RK2JnXRMhqt_2lZ}VoAotqu36D z(OUJfq5E{T5{?4wf$`%D9kdh;_SnI}kqg0O2`-6C##`W&sDcdlvWcU{Q}S64Wt&NXEvE&8{w zDw~n4Ah&gQut5A(*VD$JWFWw+s-DyLaOp7tY0!Fl7cO2Lo=!J|M`cn%g7D%=fioE?6jfA6B?~dAQn3kE77wj~ zcS||3?b0m^Rez^=Y8D2xdyT?xEjZ%j;h|+>$)-rHFVoLv$&yhatEd2o+szw`)BnWN?@J z0|Eid#_-K*X3DxBwvX3F6Qrc{taTUmcP%Zc!~v>Z;3=rN84w_vN(6OY^;-rgUYYM| zy?jM1p&hqvxeTnL_Z~vdqDB4PwXw?mb!W=D$Xn?yX)dWNJid08qFr3Y1 z5h|G!1UD}a=ZpRmO*Ckta?RvN22JQEY4gjwvCuNaOa2}NB2*^Ef zSR+d=pB)me^1F`JgSTmdn!=%nm4BPIg-!ou4fdj`1NnxE_lOGfjsKb!Q{3tA0jE9Z zzQ5@K(~ma~3Y{iS$D5ib8|?r#uUGE=xnQAs0Jg(|sN}_C1VcgC2bOXeA(m7Kjzxz- z{Z>t^UAJ~^Qe^J?J4tw#3_NfS$pSqBJ>9CSo!`QI0#4mnr#kbT+7||Ts0@n7@A-B> zU|-wEeZBtsF-4nm4q_5`gVEi^SCC!ypev|Y{4?aHk+i0zT=(~=Y<4>s-U1tYb{V$@ z`fOz0JcrCQt(PqMiHH1+j11cJ-Sp&&`F}spF%TZTsV%`UuT{;5^9zb24pKVul1z0| z`#8eWh^)Rux!RH=!k*j>yZ8;9!lf74n#PLX10xhV;)dVv0yb3vP${^C2<|a~Te)P( zfT2V0;xw?ad0ku`w7w4J1n91Ju^mjC)&U2DVdVSU+c&LRHNr?n%wLe_MSaPo9F*N2 z=%fXG1H@h*XnM-yby5^F$4q1bpnYxGy7hW``Yu`m4lzztVmP)2#=?;`H5E6KVJGLn zH=x~Ojh-K^6FYX~$h^|hWnAA{FXSA&2R2@MqDL(g_4K|B9aXn7Ie*o|$e~s(r?azt zAn{^1hX^&-0d@(81q_jUpTYd0;y`4DEzJ5}ccYxrdDN7F#}hI7xd=GNwVob)M*I8Fr{0XtY%*Pb&)0QRsrwT!o&U4Z5ti-MOg zUZmo{vd`yheSJSsOy?Gji`r@72$L#y$`u?j+;s#{3K$H>f^*tbH8t_;yU)7nVNM5i zlLyA9yQ32SQ-~(wex?={l70HLdW;f#?8;aeh?&Q1-9K3sbV5YnPEO)}Rh#v=T0ELq z!MnOnke6&4%cSDu{G?3=+gK5Wg;%n(D>vNm?_$ymIi^RZEcW*!w#*UeK6cYk`<{^~ zxaQ$#dd_HE3(-#kQUGHIhRDF4s%8RfSFRx-5U{%5$;%fn7Es=q4mv+}%a$$3TL28P z#Suuo${W!=RE1AwB1DD(RCGF>eIr}smwQf3^1V@*@$poz4}BCLx9YbKFrQZWOm?9d z8EFy;)fAWK6dZqg<8=cgf}sd42G4J3SXi({I^}X9 zGIrG>>T4@rA_NUoggAe(=A-mh&Fryf{QMh=&XZYAw!5(7;t!Ma9Gbr*_)c zp(Nwe@e3@R(fI&Tp_N03UJ?Ja(bMzWqetR-THK@N+pVD;+wDR0#dg6YAMWy^vC z1AQ$aSHA+vVe(Z{a;CJQ`pyVC;#&)3M88TxqGo^?@Xb6)_SZ2q5!AeePoBV;4&U|) zeWb33p`Pr=RDh%%?RU*AV~V%*wAH^oC)fF8TGl1D$qfr~atQHCzI-{TwwUT{r?`~W zF9wG3JH8|jTInrVA*@nLwA9C%XAS(e_;Gd|HHQ#6fj3D7M-c;ggd`U^yB)**FU%RD z8@il_Uqo6z6g)!L-!NSbx!kCY-5zW39QQMwfNo>Pu~l@ zuiHL@ri?%XJc^mx!iNbisZTF+XL_TvTxN&#w157=e3+^oyV53y59vER;F-GPgTlX? zA|8t-C&Eu_Yh~C8rEk2ty6=(<8e)Mir(#BHs#NoaN^w6KdHMDa2gY|bZuFT(>{+gZ zvKgQLs6b4{Igu23f+MLDO~l{Y@jg@WVK$P%wIQqWFL5`+6&WQmAWkT9!L|A-@{1!X zs003KNBbO&e!0-6Evu4*d%=mAS|YG*$^MzL(X978$J6fM!VV6Ge@?&O5RcO7KYGq6 zXs!@Z{0E77Yau(~5rS=(^AexN`&v&KQ8{WD2003B@HcH5ez4(kRud_jzRHtB5lsa@{!PY8naN)LrntJ%s;W7At;vB0G|jqoi#pNl z2qqDB5PRobQk*b&?Z@iN!moqE!WMw60R=n003t0eDM^xCG04Odk~OW`SGZelZo-2E zPp;p7vH42`U>-k@IVr!y{V4q(J$Z8c`B(nW=IY|=iYP|n;952nhE|aa6r5+9{`y$t z6&B>0LAuBbC`FWb0uJ%mQCrGfv~LZQ^zl&4*OHu9GPK|F)J4+sN|e9t9flwXRu8YW z&DFJ@f{M~S}{L&Lm0S-gKF}tFVH7RJ>Oy7SbV3( zat~9pJT247g{)hTs^VE&U!z^GN^|rj6 zZ{BCNT4~(aFjJ?b67^B$cpq)JF*o**Y{a+Be=N+91m%~OGNP!7sX~$27$+KdY(b9X zr`+%Sxhq!|pfbBZcwa=UrRlQd&CZ-69U)V02YCPJvr;!;yNv0Vx1cpWZ-PTLJ#zi&IZ!MTNZ#P;6uC_zJQPdgh>^p4nt^K%jzDz(# z{cT`2X6laL$h)b{H|UyhUQx4P2D4BOBpHMG7SBgk`M?oZ7O!l7I0fbwBaCdLnZ1E{ z*m4Hq#w_glsC4+$dj}%w!<0`W`{{ahWzWyo%QvF@@~iz+Q_~7wHrD3aN4;al4y%~t zN4VdM4Ov^!H#%%>_fGn)lLohGv847E!HC!%2k)p#vUYu*kzVh%^rb!8U5&4e335!g zO__5|TKbe;YO90&OxKK%=-VFK{*~oP=q;u)SHV z%=Vnt+c!oWKz!R;e2CVQw)pH|uR)=Sn?A#h}^fLTH z(7jw}m=VzH+g9ETlhjq;*=KpxK1ZEcBQd|c#FANO@4ji=nrSCBRY`xok4VX-4<)z4WD?J&gj{i zrF}452F!ynYlgs%lEhe+CYhhJ8gtZY+PTp1MeB7%M%$iHE!Ue6vt)(dZp{Mpx!9-R zzGog&>MWhU>DFQ2p}Fl@cH@B0JWnn z9NyNUD{e^8xSz;p$$Ckn?ImzZe`eRqEEA$+H#kF+Cxo(qFzl&{xxKLXY0xA8Ey4juvpxJ0ul{9)k#@%*)FB0 z@3La2XBuC4!6bO1WGkW`qr084mi<~X!6FO6*LaYY)G6eP%AsR>-cD;W2DLy%2e8a3fiAKQR6Z6*+{?LBu{lO5GyN?>a9MAVr zFFmR(4&cC;m>raghVyx-8Y1SdXV%+SLIM!#mf7V>dp%Y%)i7K8$tfF$etOfj zO2&lXJ1sou02K8LEB8bVoK*n9AA4lX+hnf@KH?R{e|~)%%dgM7QtFd&|IBjV@#6x} z_u+0b%P&DK_8GRvGf&?f+gJA=g~NT`-!(UCrG$?}F_iQXTDj4F;L?i&zPG)v&z?}oD!Qy;<4*|s6@X`d-a)hDS9x9{=4b|y_~Ga~j*Zk+Mr-{(=D za_sF z?VdWh{+RQzA$tmM-l3wPPJNNoA{?pl~iGwTpo>G%Ip5Lnf z&hwwYiKUzoSx4{0YMO=2j=Wf7By;zj?Tn~nrfc0kiBzROe{pcIl%X>Au3k3L`5+4;~CxNoEA5@a&ljj&cAtF4|Ud=U%x% zbc_t%pWrevM%?d(TZUGCRunTF6lnRLko)NZYW6aX1%C;xpDEIj54#5 z2|#8LT4Q|-`eKN5>r1CMAc!V5UtBhcH5irR?Li($lA>%70RrVN=!9uteMJ2pz6LXSKATQ)0dbyesa9*lFx`9Y(O8 ziZ?eH`3~*1FG5Rl5Su9p2kFqHe* z@%{cGSKH&l_V0I;r`Vx98?U2tY)u(mI(v|ejPmx#U4h}37c^hNsXQdauYCKHAwIvr zqU+s;i<5UI*Yvr5Xq1XsP+(yF&mBip*2+6VlpL(U8w3(tdwJCG;l9y#(@;$8efmz) zN#})jBbXcr zmNHJ}RnLV}UjJ=gCzd!|{6pV7EsAge5Re{r#A<^!X838TyYLu6AOY-(l~Uqf0Ew`hJ6DM?{> z8WS%@MnC-_IplyvjKM#nD!~>m_?Q2}Eobq@4ZZ)%b?blrHc>>tXZW8#0x3RRlyfiA>i>9SUw;d~#OY9Q zA^+$1$ECPwWxsNJkpB7q_*$s`Mfv%4iA$^19Xu6-|IY(%;#{r&oX7w9IhiH7E5rql zkLYiouXom3FD`8p+mX1;;rs|?@qHmHQV%4!Xuiq1I^^h^QL=}|x{VmKH8-fIjESL1 zNJxUPPDsxImbaAeJkQYztl!iW{PW|xO>6h|FhA1KQP`22Kls;)TLo{Mca+-deLm$c z^`HN=#0Q1u6dUzY+Wg}G`cJh%UnSpj|MP|a`z@#Pd=&JA=l*|ui&1d5w)RDtE)BzO zVPC_&KFfb=+_V4uS>xsZ^`rm&vAXhJ_5ues3w}oxymFg-*wlT^l3BvOJsRm7PR<`K zyTxka|NCw68uK~}ZcB$GkcW+5$>K5p>=b*83V&*U%t2m?*W|x9yZ=Hs81D8tLNhuBon0vIl>gp1xQ`cFTR6n|2$vZ=dR? zjL!nh$i|`KtFGR}nrh6^J*5{re8>&5Ub>VCH`*5lQVZ3-?n}cafhJz<=o5}C-1hd* zD(<(osM@}lE4udX5B0dmnX1gRjKn}R#v*)CQJ0kUkP(N~A|AhVn|yM9X;0ZM=`%ll z&nfMe;UZW2^dNQ}z985(x4+-i?hF+lo*2M(Zv z7bJIFxNz;pjplu>bChMiR%UnO3=^R`j}aEqzw?N`VU@K_p9`}Ah)R%oMaD2}40sHl z_@GllWUb*f*Q_~54sb+%b?a}4BE%-?Oqz6Nq1v;PnEQ0WHF7WnN@_@Kkm?zhU-0OW zn!389;P$5}&A~gGK?FG)3|YqB9*+VrHkJhQH;KMMCxsPHJjpg3aX5WJK!OYXd!Oko z8wrHONDW;z*N1xNp*@w;_wGJN%}rFhJNijB8iO%0$KZ`mRg^k3yJW+ur58ymBX^Rh z8&Ij^`ul8C$l1YW_if*tNr$Fu1kUtT7Vm1Tib}twUIl>qS4nmH7Va*IhtA zP)d|ccWd{)t!n+PvGfwo8uDCMFhnkRpTvT#e z(^tQ_eh|&xU-EEiVwom`+VHpv@*(af<(#>7>kmH)Vl1vRo|`v+z1e^Ae&AnZrHGL4 z2*`PP#^AnnJdtqktbj7c>?FwuWvI7UcbIh|55pOL_g8q z($bZLOE8?_;|B-#3Yg_l+>8z*N{J|S|U+~3aMo0!v(hwOMg^05;*OiXgl)`0in>#YK%U{5c+5 zOJ#v6DYZ%La&xTL43(=qbSqDuZ8zA*8^<#ZHAG!)E!zu*ujyUbts0FujKUQT^q8X( zP5pQIGk=3ukI`CD{SUI94-K7uJlA1Y^E5+wNioc>51Yyu71nx{=NqL60mp-ZW%(EiaJBoj2%3Yi@Uu#`)_hH1`z_~Z3cLJSra;TA zP^!ddC#RL>=g+Cp6r^AOu8UWflTb7I=#`n4wu#Z^b)i@=0#*g%3Y-OAKhfAIE1-T@ ziTR(ta)rXJvfqJ`$Q#Vh%^GnST78VgVblB0Y2`b@;Zw8a9;)jcCVFW0#Vc3Vrj<#G z87D7hjI%jl1qCw)5jFrenoCixBWm2=QIw;T+6dX%J={o82F%U89R*K z9s#A`U1I*cbta#aC3_DIyTJ$yOLmaDi7`(dwD1Mc zAwG83kgL|6`c~cE4!AiIm{QWB#@l z8eFl@4o!gNg@ctn5ye;DYfhY4TwYEUK3g^7YS~w$_%|M3aCLFP1$%{;7dF@|k+;yD zU|GCLZ0Nkvk}`6ztYt<`aI|6&t96B&{D5p^b-!iTkkwqkWxO z4Yvajw%cr*z)+46Z_d-brhOR<%kGC~(=|c3fo+vdNx;PV{#{lgFqpg;kE*@r&ed{t zZMO#yt;S+1ssACca+TMrf=oe!O%zM^)<%Wbv(@A(vbGfxl$*0xNKn|7c)oC9cKz@t zaRukBavO%s*rj{dh;15&xl=~|=NG$m*yZ!``ub!_>}G&Wb;rLlKqUg!`liQl?Y)2N z(07wSxloRHRlEdiyfRbH&V|{}W5G^sevX+TrH!IgKI`J@Rm8?DP>e3vJ}@@pq{V-H z-j++gky3}x7kIi~Yey+zOe_TIE0nUe}!ny8zrs?a~ zr**BoyH-9$bC%*N~wCSUz*`oCF{Tpdpk-aY@sS; zt?>$>OvG^i%f15veMAlf<~oF%o|W36;9#&YdGWr6;?y_9q#q@zl5rJR0-nF3zIRJo zrO%DDv<5cZ*Pl2W1xA;+Wg%O`%#B0rO~$%qw>LL!ELD=-@3dx324;_1PjhZ>Y&Zmm z;NgP@>j}cGjZzMe3EwF>-MLx;gNdrqGkD37kUI?->PBd!(FPF%dscZ znsAYbKMe*(4EoEGLn>v}@V8n`YS5FpmEAyOWJMbjXx( zcn>Hm@6B~UH`IGwD`&#Fvu8LQ{qs35~=p-Kf zh(0GZ6*JT8TZ%h4TVNAh$A(lQ(2G=S4(NDYPvMOZ#6(5y=vLmQyAmIOFNz>;!O*Zr z-1oU=W(d>^Ni$|n?^Rzs3W$>9fkXeM(zX;4L)D0W;sG#}tZi&Ee%?T3!d%a@5VGQ- zgB!7aNM3xwDp@7s@z@{uF5A#lS|uYlitSVED&){f42964HS{t4mXCa60%LHbctTQA zDID5EgIzgAsQVMGl8Ga5o!I=4g@!hmUF_tE6EdRYH9h00r;pIWdhim~c#rr3K>%No zMx~OdaPET#YfvA%>+GbeCvT7qkpDs_Y)o}jo-BE2cG`^_8}lEqS@Jp}a@Ks6z$%S0 zpV*$a!;Q~hzC2J|l#9JS;blKjSQ(@R^RO#_9d>Kv*OB*u3zz9rd%q%FEsx>9!hs=F20KF#&@W&Du?o||cX zdLcHepLrb`&YyReD;&~sdwHJ6BQKx6XCwBZQ>F|m_uZ8Fj>nADV$#2ln4jA~Bs5%> z9qfjwj(MqzG;ymzyhPOf)IU8;EQ$4{!5MgSKO7nylT7B!5iFeAb>qg5C%JQ;)D)u4 zsj2>TfutV99{BNlVEE&Y6bQL05FMzbVzoyajdnre>fo@@((-imAUfhxN7vPAuCTQQ zPyySR{HYvO)KzPXGet1Ik9Q6a%dctutrntFcM!NAUIMFl=IK;&qcM}o{sY&HQ7)s# z`3md99&GbXPFBBU?@;4f5D1HP|19d-#ba=UlRYxH+J4+WE7%lITZ0h(%p2AveBG66+rcm?qa0)DsnuntP+&giS?W5 zv-89r>Y;|xE1B7XVBy!V;Tl9d{zw)nphnu-1&uoVEncpV18FTy$3+nd9B!&IG3MRJ zi``qb?&FX+utT`B_)aH8G4yC*``&nh`! zjpUI7uAKueEtnBs`MnHE2A?>_V#D*2M|G`B#tdKva@AV-v1@~djJT+^)A+D_W0_ey zKjF1Wz~82Vd>V=ohxg4-nli_0ylwjV+K~WAhT7};6j=WgS&rnEHLOHjGAZUMdvmUZ zL{L4qWI~@eP)67??(ggO=3p~k)lN(IP=r%-!-e8+ge-K<@WhVKB{A$7&g+Z-d{zZSyIw{`ry~$ zHxvZtbA5eGTwJKlM@CCj(B5}02M6bqRa5@s3p^-bj!e8N$?;PbNAfDj)1*d*bYkSs z&=e*P{+WX9+eilLBO?L=f@kg&HKGVasmtk zmpqTgmJP`7juF@i3bx~CrENbSlNq-SFACyTHa({=gxM3kprnNdfbJc0NIoMuo4R^> zsM<4AQw5Pv{6nw~kBi8!*T4|G#Jq8bIm@%RGz>gBzcSr*5j$(SXEsdSz+qBDbR@?s z^c38=y~ndE|1qi;oti2m>bYeLLaO<5=jMrD;*&A-oigPHYvo3&bkt)f=3VSi@_L&; zhYZko`|;^4%gATWZJ&!owoaTFBk4DriVplQBmp|MuIGnYz!aE}x?$GI6Hb8rv$t>A z*^20+@@i3AR_Zv=EiT78?={OGg2A*DSybH` zbl^dXfgcCmFS%LDGA*Laezml1hq_QQQ1XykLs9bml1*BAnEJp2nRXl4(KdB#RX8M8 zHrqCJCjG$9zkjxjIQ+S~`t)&h!}3Q?XkH_Hrw^X!v@fVo#H0uw+o2&-W{yrGZCo`CpANtmt@UUs!404Q zf@Of>5z9_-$ei@kC$SS57OKmyu6n?oaMgb6OT5LeubDss)Ni1vKn^i6y;bL+45uAH zzk8ZeH5LyO5rYtJ#Wjf99QIKKW-3R(L%^00hCzl#hP&t zk?d9Np^E~5a~g~^M$1unk6jgVi0{;DT(_?81>+lABzTD{HfaL)!3V3b4qmu=VV}Tz zJep%CPLx$M(21R=EW;(*j7DJ0QQKw9qN1a*R~#?9pY=UxzyR*hLb+NGT{IGJX74Yk zrB)Ltp@9!oj-amo_Ip=nr?Q*`XX_tAYyGs3;30VH)=*uK9;$UT0EqLj7{9yc?=2o= z{Jlt6x=W}6&lZ;icU3l4)(iA0&}Sgy=E`hoKXaYf#!sJu;->?dQgT6l0twFAwsG1n z=agKI`n}nyX=!-m%jgV0zxV$FJx9f6_z*9Czm=CPMw*=hU?5 zn3(O}-W-D5;_7Olw0JRgiTQE*HY-+4$Gqd0$&feY<%K7vM&vqRW-xB~b&I^IqUmyC zjkV3}BD-dElRq37MkT<*gGdNHVX1@V@|D||639G(81VM(t(2^((b}r>Pl(@v8R@~B z-B@uO%<$p0mF*oJi;`c`RI-wO1)idu0)&}&Lbu-xL6G^gXM*A#b^pfT)jx+loYK#l zN={9VWf(JSgix=tKU?H>zScU{QkkdHXNLoNro*NVJsfOa9G_Nj!>K-KowDqHa6ry% z)x)N0Ay#UUIB4Jn5A2Y0e1dDSim#!Jl2YHO=~TI$m;Gm-*$ps7MTW~O$i=@n^$*jw zadZ&VVW`}rBLDtdva5`ejo71O_k{6>M z@Eg7NG!1TEV=ve$=j%BKkwa9y=Y6jz;X>^V93$#z9rD(%*bP z@!wp4+jM3uV9E_0TR!J&=VYL3fo>E|K^ab?cjV34MRH>z>&A-wQhF;-b89-*r=S6n04f9jZ3zoi-n!4}60S-s(N>E`iFfq!`NKgM-l2k|q-@a>4uThKIvwIvi{V{gG zD}?)M1HP$L+~v=5LfA0r1GGgVAZX2*T5wzOuVSZwnWO)73^w9aK)`_ZS6B5s@L)%G z*X~)f0#2TM&#B)_Qhu+J8#(qZ@oc0zQN3Rk6dahJ3hf+gQtmegOW40HtUZ@~o zRrFdfAIZGjv3G#)?~P!1V9{3#@QWH`06rSd^ZgLdDnfmS?n&iRhgi z%62kv;KN$4GWTC}m$(tUJ$fiTw_b-Xhw-%4dpdli&o8DYuNENP0w|D%!@N-#$FV!Oz z#_e#4f$N?sg_1iCSqs!}_b4cObw^EQ6j+c4y zGyX=|?}5iO7ip2CB+Y!d2z4>_cG`st=D@+PzR<9=oD>h7*{fGCt#fK}PiR_E*$h!q z`pdzIx`9SeS~`sQWIsRQss|L0JanMf-joU~;;3WC;`FzB(SFYw;mMT6V-zBs>({TN zY4_(=*w~curnpPf_jGzwwLskg8@7|}{rLLM$4~pg1$!@DXe7GP!1%ph{<81oKtO92W ziBxljyX!1JX9cTStY=T5;b2*%{YK8-o1!KouCuWMm319&Mi>9Pj~{9B1Lr5LZq2qz z2LGz$Mhm3QZ02O9Lg#E_E1*YPgi$No3Ai)>>*m@g16mgMRnS(WnB*gZ;=cHc3BaFnGAJu&ihhnc&k~BZiPx(u<6bm+m!8*TVsl zKmEce*~hF>;MpMx3YQt#Q88jujY7lyDaVeWu4y4ms8F?e)R-|}xQPH@sBbwh*3Stk z2O8ab;t6^^|7)dtXP({{8Y=cjw!`WlWkFwXUS5$NHY44*I*a=B?OWSSy9%J5$?IOH zKeh`f$mvi@xpXO2^f=+&-x>{dlF8<8*KFO+ejKryS~w&pFs2cp9yuvM~9j zV46g!hJP;g>$PjLtMzgR^azGDrw~=p_%gZw$2^=LH+y&xj>*(tMOJ}>Zr=39d0^Iv32^dxvS6RjPg?8je0OJ?RNQ*H zC>+?OrdV59d9{9;=dq}bsX%(VHs!pw_U0#%>dNDA>XlK@a(SUl6~?y3Xn4e7YP;pe z4!P@RHVtPD4h@Tnjm1xjy@JP#n_62{y8Jx6e zr%nj_Iqbz5*DOB_bC{X1{OP6~SFc{QaA7!@Qba_WOHl&%F*oZnWAWrTXQivc{}q{TF`F^QxBEO4IW$u z{MYzd9+n;M>Jou?eD6S--FGy}ESOwp)4ic@YioMH_Sx}3`xUmm5d(wUb8#-b`hUoJ z4{)sizyCX1MyVu8LXt{46Kz5&8j>VwA<7I*Nm(To744*`B%!DzEu^BfgwiCMG*F6& z`|PI@L=4zGY=bn;COSM&C&D*W*RISI+6)cCl(nnm32IMQ;m&b-S~j> zxF-SXfq^d@FICuG6mi=mF!s)*?Fd?~Ki)p|jTXr@9->{K+L^NXWP zJWLb);?cX@_dq~Pm=!y7<^zt%yq!yLfD+R5ftrTyhN@#J&F9TqTXzkfth*N)^B;V2 zm>KE(@(Jcc_iKz>b&9)XlU58Y2Dl@U#bvsR3%eHAZ9U=9c6o*E7MTYgzSqv-y}o-_ z`qm2;LvJOe{7*mW99{*fB-x@?()zT1uOi(wmnkO>51-37e%SA)PoC^Ka%8;c(^EhC zWqf@9{u2Gyw`GECvTmikq&Qv{W*Zb-pD=Emr_$t%BE}R6@HGhm!Dizf54Ge%9kXGR zY%7DdAu|5d7)UFo${7YNNF3&7wDPQGKA-+oK8zcJ$W)M(Jv1qVNhJ@d^3mq76A=(l zGC}sbnMBlYVv+9+ zZ`E1fW>h~hMok$e?k0?^A5Kw4IKh zn-~CEbqc4-L&`4KjZK7267Fm_POUBYE~MkOWnVCMq1eDPvDcOJmcyYpPp{Lzk; zEwO*a4M$fIW|j$`O`HnRrD5Xoap5624r8Kb(taB^ z#m?2+$AAQig2VURFp(WCs)Z~6!*ocpOg&kaVAnHsCo8?@Hbh}Uq{1P`ihK7w`8+rU z;z#>B#p|z#Qh>AN{;UdY3z07lyn-SA`X$f;746wseq+^bkP4tou1^z!Y^b4u{wToP zc*yXnM<<2AOM2DM+Dbnh{-j@9Bss*nudiMmp9mfVk0^xy1-CR{vm~>eN@*dgY1o_W zCS}=hvh7H0(2wp?C(eu8ey67M=I-kzk}6}PWF;*Kcw-e(1#j+XUEwJHs?Urwv47;A zUM*atkd82x5?6C<-Ib>=!OL;585*L9w>fMmwa}ZAk}H@rIH{CpWo39rJ&}u`M!DMq zEgA1xYwk%)ZKB1@F=~@i#w+87UwR{m3B#GIK1|m%l}54z^n#iX4uE-+>vmx~;G zJMZ+|d54^BLMF_H{rdK543{YqpZ#*yv~KV^OPFi+;DHbKE-|9m6zRSbOg9AqDDf&s z_PWT4FNkoaCs!Iqge;&4j4Sy7E=RfAf6Pkta83AMcKyS9_X=e7N5?BRD<7jIc~>YC z6G3^8dIBb!)7ZjMz%ooXx3{o45g!K5WoO;s2%_XHPo4YjFs4oXqwha_$R1IqReYbh z+wrU4?XWzNo~{qi`(ugH-w77_DqLRiMYT-SJ~6KQJ^D_}089YMo>2*}TdWPfZS14T ze85jXNx0>7pb}rl%Lo4JL?7T=(K8~jS5t)9zOd0~u{fW>GWSn^lj#!id#yMn0%!B5 zhw;x(Yft+hd1ZtziZi95@-S49Uo$JmQ0S(I1hxg6GDrMf%tok$Y|Z@k6|{ zg-qX~3GUYOXHGO()T85X5GL1dF%AtMK~5diL?*OLQUGN%!X`!c@i#pKUe_q=Me?*{@{M;i+G} zyR^(H*9F7!sf67 z=XSC>_Eem+eX^!73T5hUjf@*6!~if>=|Fo)M*=I_s?s%O^pRdl1&{i+UTz52#s5L<$OP!WnMz`! z(W9UFH^XY2Sy1{nV)kJ}ckc1bz0^!=ctFsGbd0Bmi!Y`&KtB58&9#&sCU963+Gs2? zf6}hWI6fNvX8AM;3sWIf?e!HGZ*Ow?2^-}k*m_tla})}DPWiYdqYdi0iwyQp7hY?7 zeW(l~NSMq@?9Pl33LZIZyQSUY#Vk0jSt~3o!g0~q&x^EIMV{igM7jMo>RqD0o!8$- zZ#91Hn(wb)U`7D+QSX+LAy%Fd789emC0c4t4ekPT!4kmfP8WcVb z-rYZkDNP_(xT?wM>7o_+J)11944OIJcC+HfQ|jG5ajhs>L}|+2-iYK5ee&oYjzUt} zzYdzSyyROgRoWtvNKen|nu4-rM$JDr%~a313e_k$=u?vR!lj4HHA9|)2osX=_!Ey_ zxqU_DY-igMR^1F?Ui zha;4- zGWTcn+HSdN(?6hE=N(BL0Q>eSe|yxWVjom^{zi#j%oDUvwa@J5xA%v*+i!BM1n1oVQ$YXX75qklzU}gyS8!lMHj-<7a0`E_;ko*ZT$0{9}J}Jw9vl$6(%x*S0EO9 z<@RPTu!a!YAsNm+;q|1QWka#MZrwV~kE;R#UI0=P#6lkS%YD9KcU=6?Brn7TyqQt2&`4@{|`t%_tVX=+EMe++cBNZKSz75jJTenIj*!T_FAIuGp z)rQ_I=9Fhkk6A5gMyvN83=>n|_{5qH=jHqm-SOl90)ZiVrN!{{Rtq#k)+HbelqpOG znHfJiqyIGY!Vi~^=`$m|ddtvIRvIp$EvP`6^(lBm;`bkbCUJB`i!uZj3jPpnVcSD= zSm-P-C06+MbS~c{|4C}Q8nU#!WR+2od-m+X_6A4sg{DVs_MyUeP%gnfVy86x=7ye) z{5Hm|Sczjx^RsdF*RK;jo+JVaaSD91i5l}N@pw*$T1Ve5KR1JG0bl}mlMG6eA;bkP zT{`jcuJhw7)EmMk2AWkKu}f`lZyoi1w0Xx%y%^Pz;+MNJSqIe2?c$3)GoWrKk*7(= z@^F@Xl~o?p7ST$nRjanBh{!HHv&t4M+`-|r{ZNFbM-vkGO}o0byU3Kj|EZ%SyQiz= zvN2&xzbDznUp8UXhyi!=(8z56)Qk-oojsfn5+=MNxMRTk^X1zN4@a|=REuoH)@mG? zdvUakTFf(D#W`&por2tP#flZh5s{s}L~)7w60(xw;}hPVezKNts_Ok4(Ho(;B_Ay8 zq@YEq4ELE*+z(LUBUn=5juiJBIGIEhI#1!23E$aToINIJEABPb6ItkS9B% z2t0-IOfxfoS=g)=P$1pC)HItW9RArok@E7lesweLYe+~Z`T;&afC#_78X}Qqy`rcG zXuRIk&nErn4C*5>buwedJ$pHFuphr=irS3_W;}W{y)wDbJ-4HS{PX@^uXHh=rC_EV zNl8L#ex+e!baqkE+Q~tIdD`(4q|A?4vd!m2i#gLN2p$nyd4-?&Ss*-?_bjo

    #9~@#s#afj=TayG~ zAOMafzS8YmX$6FXzLz7jqO`PawB7PsHa80p3%MjG_?=9L@tUS`DsO9KgXPfuu8)u2a|?HWdb<3L8UjLG zAuYz;nl{#CsOcZ-);3kAr>EZ;qc!zb3mr`IDH?2!n|^!$UZ5YpHMBoVJax*AW{`G< z+J5D@afzdcZJWmV!YgA|ng9(a++HjpGV$6wBxJ&Pm@<+*Td#*bB0ZK?L7`|deGdq(>LOU$QG z(|5qPZC$QKtou6Rwre9-1W>&>XQ)R4KGI~#v` zA|9G@);j(*0jk=u)HUqD(SLq219x=%rf)BeA7sA&*-G~rSke2b-16)DWfc`S{rnh1 zr_H5)bED@EYB2T!pCUWScITp-!Q(`t%)~^qWv9KGHiVaq8!-YGkzBt%;$ewQc#0ns zY94AP^K~0t>mFT&3F*>1@jsn;XWPEcRc*o}?j@$2aA5(ZzZ#>Jqmb?N=9KY?umhj! zbi)K`cyg%+(j305YR!JZjJLapBN9+W2(E66yV5zFn0R%j8n5|m`%O}p!61%~BGqVa zc71h2);WvtrNgxP48tdOF8$UqAQ>5$_wMzSN6k#cnIRt5(DY$Ox~w1NBPn5{V{b+F z$+IaqpwhOS!k(tNd^6*$r zaL4iTC>;3I@3=OevfexXmV$S$o7r+&?Kr|YJotRAbdDIh%T2t!PW83FUb0=+reQNL z0O7iPMfBdSCev0Kg(|)x0Oie{9VQV4Pi&H6#+VdHB$k>P9GtvK`|C2Qn(~jMm`$mt zjJib);qfzX7n5fy3oae4mH4qCzw@}2PI$vwgpOQ;l?$pzddn_HfR$Js!Mr=-m$WB>xaPS2T>Nw0^D^pIC)Bl_Gsay?aLW$w7(ll2U7WLN4H zM$4S3I1+!`*oM6_0adW>bJ0ZO1F^9^`t%`Z6mD)|q6L|ow1UKCHNLglZrOy=6Bw7q z_Xtkkt5<<`o_btD)KB=N4i?(6K1f8VjS-+b=55}zcm1~?KSJP60K>nLMwx4= z1se+9W0B;~&Uz_%LfZL@?@HTCPh>FMk;lLH-qEoEt|j(TQ5EuXa+f-Zdu*lAgu66e zzXeeMYEe>+qBTsM3hyJYLczVrpwD;a3bVm#hRGC46R;y&W344N;O(Gp#-Y5}EI+zt zE8V?$*D6{_q@n&=&VkUi+8AJES-FwgK z3i-5f3Ra44J+5R<_9is!o?A=1D{RqZ1XU;@elFkk>|68oDZ`_aAMpd-t0koY6^y>HYaK$pVhBHJIZ>G~j2W}24Mra@5) zy9Vp#^b%p%!M1G(a5pojiqg+66(fxom=twTs=*O+Q=wz1`ftD-eU-_R{JgX4DZ()kKKb%%*AqV>WZ~~$Vj*~;5$7(0s?$_1`|En~ z#Ug`0tW^#n{1lWfv@_g2?XPoJyLg2^h3-~A0EHWBGP^jSk9utaD=Sr}E@0|8yvj^n&gGxY&Cr!w46C3c^pq_w$t>!ARJoV9w{myizFgR>y-{Pv zFhn3TD=SRBe^n2bI~)wR7X3Sy2{U3ZXw?oL!+SYd%7?{_p!>Y>x;iG9F|V4pj~wSK zs(Y~3s*uh%SSxr#m}VbO>eM$dI9=+&ZN+Y9DKbaHlrXpVt*DbY>N(vH+;ijEi*&SR z*drhSM2ML>W7e#gUArz{xKQ)6)lpLe|3R!3`y%s7mxBI%`s9GNIh>OX87f9wbb_HFd~>Tij7UvZdeWZP*hZE}xNXC%Wje3*D&FNAaWj zdPNj;3Kz>LIcZs;Nmzt5@+iP4&EB4t+zEP$28R4FiVii9jrA+61yP%ZhQK>Ao`6m} z>SH~4{(2lbEd-sqC$!{sX9KQf54g7poR;-!k6AvRj4aryY^~N)NK0mJQ_pl;~ z6B`i4&^(iRi>e33&Vg4wS8gk+EpTP}=lk~Ow#ji;r#MaFmZLg}Mer%=MNjY^Y-6>m6JQqZUDkv8u{DJ!#1pi3y zIDrOCSQl-RG7PLPq?7yFbJ066RRXH-xi!%q(J(izq0tNzIkpJ4t++T>T;kt`MUH+b zl}Cez*@9COg#`myxUbrml99x$Hizei!-p&CS$wO#zNwA*0;BtEYes%o*%c`R;Oq3s z4aWY}X5wMwz;62vxqP`ad6xF*;M5DlO6TPj%qqv_M9 z16VLPvpgwPtmBi5m)A@4QoTh6>sfth)Mdlz8nHN>amVc&2saB9j(h}x!D`SJxP6TY z>-0hQt*wz#92@Pcrn`*oa|;2{E+-efykZ&R0BTUb$-YlB!!eHEmAVs6&@x(341 zQPbXYTg8)Ey!Z`XbA~oD^f1!bfy&wh_XJOEa@;{Ahg^Qa6@9vGyU3L`Af!Ejn*lld z#+C*b78~Lvu!eQn124?LA04BO5+xKJdU8ej=$cVM^JBc3*3seH8q0KjL;;M z;{3D&2N#Fh>izop6E`!31IpE{M(Wjzz5o4WbV^`z-G2NAG)weJ`LTCv8ygziIQV($ zk;>HwBDeu$!=ri5NYz^=hq;Q6U8;C(- z`2mm!Ap;j|ms(y{Hut1WG7R%`qa}7?q+63-YR5sibEkZ)746fYgC&bebDi29Ya089 z%lTW{x*TXmXrk}v%@MQkz&W+V!<@O+59MmB>>T4$sj0G)rUvN=>nv2IV0ty$A`@z< zv10={vUu=(@NA(Ta$7MQ6wE*CC5G~u^J!1lKLYVP<&8+*`*qd9ee2UC+xBHya;4lh#GKVP2Ai*R(F7hBE{AU zXJ;1J!ZZ41HMYMGmU|_z{U{2DmcK*!9H3YRW^pCLJfh-WS(5 zj7qRMpPr7WVVja7#^Cz;ow0H7nL)Irut=Icd~u@?cRxK@ZKSKDqq%VDGCroMNsV}6 z;9BlXt)0Rl3i1x674o%mq~YP~tQTraj3v;;!WCXswRGryFdz`7dU}M6-2<^cD&0w6 ztn%fRn9V<215`PcFJ7S0gaYsb=M0=)TwcEBNuoL0I?(qo$hphc$uvos?}4VJE3$a; zSvVd(ex&rFzJMb~xkIM#Yn+bkL0%R$=^Z3apcP#0oF=-nk3}cPXI{Q6h#q+w5Qvz- zD4!p>8G;w1EU&Arl`!m!=?E$Xj~}urp-j$@T~#vr%_?*AFh~8VbJpN8>i<6esG<9P zYAwELJRl<_3kMY^rBB?irlzxJ&V<$-*6I0$cS`$CfCTG4 zW|14g1EioGgLK@>6kkY^ZT@_*cds}qD2?v8n%@ZT=IZoH(qh6PT^i^$vvJ08ioToC zrw_)~%hCPDJR<$Uc&KHy?Y`-QT0UnkrA0VX?LmHc+{RcdHy@t|%P+ck!ZCuTsQwYV zodTU}wdJL`4;o-}qzqtG*@*}nYD187hhR+xD!kR8@jBy%$k=Ot)s7>j@8jp z8*;zjscIfgs{JkyWcl58ddid^gOy~_6AaydHa&f2vRz*_H3qVPC;?RCyjZ#NEgS=6 zJ+B?&!p)G!wcN|gX~~k!&2{sXZllwa)f<&$J9f?IC(p*--7s+p6O?VAGZXp?MpTr6 zW=E*h2(vDB&H6|}{{+dv3}n=2H-;`*Ph-o|ZR$hDq$?QQiKqs={k6iX+OH zxeOfX*H6AFUra*!(&;1DEVa4R6yA*p6^l7>2Bq1$e`~28q$9F8#vklPEy`uhSR0u; zl8H78IH21ovwHRq&Kh_Mu7{Zn`T1s`2HHfLNQR9SfIDX@6;!8&VfO@{NIkq!tKTr{kt?ii%`@d}HT_?kJ^G z0T}?D>MARnKbM}wlLqWZ>B%Bgk!A}v@smS7#&n)X^()*ms49I7d_%5j9V~%EYz;R3 zxGnU?4MH>~tT#~E0GvYeH4nMAHy*KpqO9>6yfeg3<>f}ErX476@b-%Ry~cFA;;7xb zS%v&Azqwt*9coy%kQgU%=4 zGL|=kpaa#uf^;DT-238K-}{S%gDEb~j`y&^j>mR>Q;Mx`Mp6>QB1ATdk#6_p2;bjb z;4CR6RnW|0dz>&qXm7djPT1-J`#v}{GNbEiHkSZeugVQv266_AnQfXqm(d=8*+!== zk?JAe`?`!tGVGW9nHC*8b}^>3XjBVQPn|e~!rLtk;rV0cBqH2@b9J7rZI==d)^R?{ zjlP#QCPEvoUS0M%j1V2VE1o0m*YijB1Zfq&wW7S-Y|2N{tUZfbX6W>UgJInePIGC5 zM^sTQA9X7G=R*I72vS1up|rDJ&@PQy88)x{vojYNcR#BlGUyZZz}@F(eEaI{0Gtoq zDcc6p?6tmDkk(pSq91{1>umq|SWQ`oWEQ}%@}Z(S;+iA2N<&QI@+Ps$?CAjtUIX;U zTje8qrlCB;PB1ZC6JV{z3iJc6RQkZff=>n%~*FlvSY(VP=VCUm_LyvQlsiGuYFVQjJm< z?&21vK}0~Och_+>qap(A4BdFzg)|1tC1_~LDZx#%$1oV1c17BHRx=-i*{`J_MKSFK zf_wvP?aCqUUlX3Mv2n%g*TMWe=Zr4a@^v?olZDWtnD@Jp*!LPr5b?%8y0SGqc#u;1 zx!{uzs3cGnN|*Kq1;_{(dOm@g=^v!Pg-e$x%+A-ZpEVe5I2Wj>U_(%lkjA+2JgqJM zO*7B17+aAnh%WEsVgJQ6ZZuu_Y;C4YaYrQK#e;Za=)lqIXe_;E&WuJ9u-y_lCerUS zMei<;Pv~~}xe$JEb$6!;GdAfowso2PeKN2%8iA9ShJ$1IYcfpq4xK~HDyf^R-=ZMC zhW&2cy3y+4rGTkdoz92SAQE1tD%}dHlJ;ZCd_83ZDWSE;C?J;P*{ytgy)QNeQ8bAR zVD4jOcpF#A>c#3ai>RV7$6+HzJohj%{@d2Mylz>3c(IFm5u0lg)+3@yl$DJFYHqUv z0`HzyjeEO1Kiq0qaaPdR-Fz+{1<^+;*k1-2_?F!^knd3LW?V=Y0Gnm%#b=Jk49EKm& zDAXx+ZEAQod5_ed)|;?Fv}K?fm_v<>_GOH(7c=s?v83wcwC)Wp^Bf$|WOh@yTYUtR zLKJtn9=H~w@z6=r81hWA*^C;4p4$oJz_Zq6@G1Wcp|oOuxvfO{z>R|}^XS+TI<=^% zP))nBuDxm$-i4!i<+tAZuu7Cu@az_INg4*`dncVa^BK4flHWyj!h~zwHPk)fDueb< zHxI|-{^8T7Y15_^Dz?sLu7VJH9T5R4?O|>%<}r?FjT3qT_2s`Xa9_1vbzEuaqPrrZ zf-aF$wl|uqjG~rWz(4Xd30(a5*n=NI^$SWY=aj?t3vHUVcJ-!pYu9dCv13sB^pRwm zPnC}Zp6K@?j}igmx$4ZEfdhSKW9FxsMGbZ5&LH|aE)?w;`b?&qRGh7-+PiDKwzezM zu*?B+reVRp3@M5HqAo5sRx5w;D8IK8PhJ|xS@@O&2pZ`vU3*1e=%nob4m`#WI@;=g zO82PYy#P7|in#n2;+Y0dJ&gEdji0J%joa#|e{B5Pp?!R$NNMIUON9*rhdO;5#XjO5F!`?{$eN22~#Nq#^Boe5uNQVc>|7|&b=L;y%d4)1>DhWz{9FujXlI8 z+nkQJ?=ewcQkR#tt*?zinZcFYtHB6TG9 z#^ywwQ2h}p##WKt=g8%Mdl&R-^1Dx>);?X@{OX2xO}ge4qW$CO*7}@tM*SmQ(6hud z7n6oGBzU$%1pP?#<=~Fp;*EM!7o4pRlG)Ss$H27aAQOdBr>o^2pQf9HhQ9vW|5MZK z#w9%*o%8ExrqEqE*QBQXGBR}TYb`fcK}vkZ6`iWr_F~U}4$Q23xhJU0@008AJ~IE? znzL5QF~ntdlgycck@I{5iUM8}`*z@1>ZUnj+aPLg)qO)j>zqQx>@TXBbgeEhMAJs` za&Tuv#hLVUI*ZQw1W)a34{5Mo=YB+nxBI`8Q13onNpe!!r5>-(y>klueLd>F0!SM4|2Sql?-O-KUu*W_*|;fz8Q zvYt$3$ug{Jch|06b*u%X;PVp~DtEocz65<9+O_2T?j1Xt8XHG$dafnjI7TR8vm6(t zy!p&aGL_ahSgFlc;|8j#8qh81{M;v+A@W*BjS4#ZIPBGmP8-^})IYGO%|{E(zU=MJ zG1b40?*2Woh-L$;(VR;IlC~>`@rEg>!&=%>cZ;QsZ_ZQ?kWR-$!{2kNx@-(rcT^}O zXGKebT$=y)YlZ)JJ1;IozeH_?=dFP2n^UrG4H>@Y>+8?Qgdg>PzbYz3@yGriD&5|k z`Cu8nUR)+sRUr}p(5l(bRk`<}8`X(7{)`*g<$rwx-`*HoCR!+4B@4q%T%(_0Zk++Ke`(HYm6Nhj4U%y=V3A>N%9waXR-|ryo zOb@sG|Nix6!R4~i9nU*9;nZ$wV$+rU9BUHBk-v=oCwwCAl zq6gbXJNF$NFh*5jz@>@*^@#Z(6vFbyPCXm;!|&Ia@%xni`?WOA3H$%OLsKtPpWyk6 zQ|Gq#xnHsMzkXR`XV~tN(5*gp|NS;)2byY2IG8;3(~3Yz@V~y}cHXg&x1o1Lpv~ws z6@(e+7xZ`aJ04Rk)3LL5Y@ulEuDQyCl;ygL5Be!Qk=rsd>Vrj!E}gIM4Gx)YY#Mi0 zTZu)YV_h@0qhs5#fqg5h6AgSFTNK;qav_IKh8V(P{2gw7AG zTOTqvKS2F#SnU;uG-hVEnC+mt$2O%Si@e+}!y#{YUEiWcr`J}C{7xo**}YAA1M0~= zIt#AJWc|)6wY|P#NJI0>SFY2Sbq*GND2;#W7_M12GSDh6xTAdoc{v+*OxqKtxz9}c z=HoYBVs4uAU&{>ruq@Q&5KBJ6W}C|)q(@%aiUwH$>M5R1U;zr!2i%jcbRR#$EK%Y? z@qlyta(erURN=7ooydPDR$XcF*-{Vu7yjx@z!As=kq)m1<2tmeMxe0Ml&@ z3!0o#7B*G#PN~u28~Y;T!a@qaF0Z*Raj;_HnOo00bBv5u0d%(KO?r~Qsh>ijy@LZ4 z(|@96@aY~=m@=oql<6LM&#$S86rXFfHYfcE4eXbxsUusnNqR8<>e?C6UG`Js?207w zz?9;SjSl*b^A6s8-2ZKA_!z5&iTj-HzO9<8DB0yk0to`Pw$2z${wm!HSd?l{wonrd z4}3)@E?7>;@}$W!FcyJVB+XBqJ`I~cmd5(QIGzq>XNP4$Sp_EiKjz~S^a z4Gsj$B#7_Q<;yG0TBj;mLO2umz)v;=h@+6kJgA8{SEpy=d9ewLY0?PswI7qb29#rSPn_;Y# z{qrxqk2yh4I5-?Aa7K=Nt7Bu(odET7E(=Bv8&>lA^>vL4M^5P3jF5>o5?d+h0D-b^ zA3~S%Y+1dn?k^zW01x7H(z-9xV+PKIfdeO>L}OD~?)kpqcwo%&>%R6~+QVCJ6fAcB zdodysmIdk0p3N3XPd?X+CZgiUpbTkD?_4Ui=r}=}3@Ii}&R*`!!uFu1>=C$K=o*lq zgO&uuUDQC5ibw;eZ5o;ifZUhlpdodJLzK8#I(8S5;)fV>5#LZ%qSv}gQ^2L@Znz*} zdf4Wc_=EG;Zq>O5MDp$!P zOc*cYCciw~wEOG^K4BVJ+HMrvKjyW0@rs-*IV7$Su7R{2A|IslX4`j$bUvqhi0t20 zJPgUc6gV6J6qr-xm4Icuaw@Wzk1y8mGTU(iZX%1ai$0Kq3ZoW(Mlw?Vf(r-mv83A5 z*e_pjc~<;r#R*ciV{gLf0#6G0hq}7UDd+j@sM;3|(X1kr1|&EjAZw99NW8*KD!oUK zNZ2Bj%h#~M_h&bKrx-Wq#n+V2lFxBCHkN~d<}GG@mkq?fi1T++yzSwz$BEK>Lw&RAm=>;tbhEq%)9?c6jFRjtL_=CPmZ+ zPMLBCFc18le*~2L{Qdiq6fGxvd$*MeWw*C*Zk+IcaE*1E(q$i{gj2-K! z9c$FGP`~H)OHRI60`;eXh7Z}{RjKWGfS9Eb`uc=`qG3ZgGko~N;-Gnsj>5r^nVAVQ z1{H`%ShblV88%n=*>pZ77jUF8s0W{Mgt<+e8{7;{P_9Av_R9PB>*#FI0{y7+lQaj( zCrNnz!7Tj}d|Ift{`nfJ94!P4-_s?m?dWMw=+M9SvVzK!uqAP6Ug17qWPDP_p3VJZkEvo$za*rm&-8Z?45Y`;;w5}@0&C*i$LDSd!Q!8%D* zUi}9AD~riOc>X>&2c=Ipp_3fH@wZP<(D>^s*BVc+8M_%^klYrQVqXG2$WB{l@Fn)PekjnN-R zM*GScC+VF9{9*>5iOFK^*ekiYSW+__gkjQi$Ey?tY_-V3@B}|L**}Ji9g2P=E%N`i z&-3h0?{+h|^}>?#On5#DGy>Sz+6QoOEBd5u+km4;De{BVdmWN>c1jzvjspEC7u8v1 zFtx9UHdQ;k#MfdtL#!FhLHjvEFaEOj1%JKH?3oe)q1ldWNn4cus;_a+B~R+r-JF z#hn1C^L>3KYumPI-xg1gbA$FIT;K)A&H;A;=yYlA$kgxGqsKcO%(b<17yCw>^~!#U z!hp2h9Vd{fpg*n9oYHSU!g<_yw_QgTig>P5r5)mQVAT#MB$zg``>V6H?=JZ9OMoh+V@ZMj-!+R2Ey!MMDcA&83^q)GSq;jEa1 z4^N7lqk8yf~vF zvbNq1TH)+mjfZAjf#O9W@|W~NTSrH|p4$=U10Y!n^2Vid{s+HdM>|>SKfq97l*=ti zKR>@c#hT9$>VL1wJAUX;C81fgh|lJ|WWrtl{+sX$@WjA)h}_^}CEPJC{*8G$P`5Dj z5Qos+yQg`T7}-+G>Y_B+tUH8!i`>;r;^w44*eoY0-ZAsu1s^ytAzwi{g6suKmZJ#? zt*du)ErQ(PBP2QI{VG8a2_qiu^awb5Jv0hk{VZTHqr@_p@cg0nI218vaQzA&Yfe;)^I< z+OylPTBBK{G+}R-{N8=8#&uKa2p7;882_}gxX3g|6AkrUwcH+%itv_CawN^^^>AJA z_O4vJ_I$10vy*B%));O#fB~_*g{i^RdK3@DqF&&cP`VsC(cDuq_W1F<0=;&+cbpD_aJ62&SRPx1OhZ0)o))F! zKeP*PJx7ZD^9NZ)9hDeH)TFt=K{9j1j@^V(g(pMxa2gPv@!rW!^e-2wt#N+t(UysZwg$ zk~f-|8p1%oA+jaR%5mcY1`l~v)KQh;FCl4p>zvhZSExwOEvA-)^}C24H^(}ZX>2rtZif`1xpb}^u^I(^xxuA|A*Z_VkyD9}e^zlu<59j2pkCBL;wA@+GAus*6 zL2p?}TU3 z%}P!(3?w9)ltKZp7%d6>i6a1!c$fK>6diQv9RFV&WFuWjBMxM1QTU=I6^M7xNOY|J z>(+I&%}3 zy?5TBV&>B~3fLID)_d`{`OgAhOz>;EET6B65+e(aVGKpG%GPX~DdiR4?&V2@DEED{ z#eD&K2MRT+2PchR6VecglcLTw72jk#GsHhwHaw81LbjKrxH%L@f!1nP4lg)7IzM0{ zyywV~r4Jq`j9$dpBI|X`Y;JC850O+aVh|b}7^DPb^eE(q6k}k|)~WWJe?A=JQ}Ha6 zPjSn(ZEdZs49CzhFjz_7fzU>nac!$-lw6i5sH#ROEJGrFp5nosXpfwnG3y@+gDKfj zD0m^rSFD)-{PG^1zT_tJ@ClcOCVA;B`ug@p8;2{0i{K?o-^V~Gj#zYa=ww2PQwpMYA{wKG0>MnKbIpvgHd^K9B+_xYxY_bKMNv!@?+1~3p(9oxo8c_J? zQ8(T0VP;C43ZQ!6!+ee{2y*x+Uy-svhxMhxOqI|z#{&!wT!I9pUM+uEtQECA-5U|A znA*;8$yd7U&0+SQb7>gK0VcSsce1oU$V?lDWk6ws=taK zv*X^gOmU!IVvD&HM!Kj9CIH-y*m;$dzg_ zG?uc*X~6>Q2rK9&{I2zW^h(kGMsKH#-;+999}89KrsBn?pVvcOlOXIz5Hhut)6|w% zOC%4t57{AP3-ZCagi-fRbSvHidOzE=RWfad(~hVp)se2ZIfon%0JAe~K=^)oKtZ?t zW8?vMJ{gFQJX+3Fd;I6(5a;2VSlR78a3;HC2GDa#$v?XR__?ldL@)Cg@ znH{cKjF^Vv1|e3uuI{{Z+bmVh2QGfP<&sB;cD0Ht_b^JVa8|wBRb`LQ(HDI}btjA; zzbeRBp_;6jn5jUmT+5b9Tjo^v+f|F@W9WW{=)qkf>*!;ve5ctT**U=!IXUPhNdo%) z`#1FE61@ZNgfsDnyqy0eSkU1somp8v_^3;o#;c`f(ss&&RCd0L@h(5pqf=Z-7P(u^ zPGBg{Bj9bBG4faCqcxrLKd5w@`culP_l+eZ(oX!9f(IlZ&PDaR_-DP9lHu}_8Y3U% zHB?vE190l@rB`>Ecdm!hrr=Ha4|c$v}j!U-gycI4~J9oRTtljC3_=Rs6Aw z)1eOM`U}~TsqYO|Rj4pA#5i)&bJKy>d#M+>*hn6XC!>wyB**^zbH;uP5e__;LJ^u! zQe==4AxpLGz;!_x%$EI2etm)EB#H+ros0z+r6c!j7up9jU7tei=1*%w9fouTQwSaOcCFKL#QDZn$5en(h5-Po2v&iMA-F&~Vmk$>^+DcK7VB z`QLk;oRoFe-&?&1(wI|q)D;O?ahruTePmvyIAur=UqIQqO>Im}fxD7~t4Ni8D<^eF z#*PJP>FMS5%>WRS#s&Pr?XhREs*2Op@P0)BG~Kp(W9P@kHg?;A{#;4ay(~I*cGp7D zIW6Q+;<>ZFtUf2<(kWVTSo-IHkT>G}DI*QpYIO@A=FVffCBre(D#GPY1TFJCA}EQ^ z%rXvANX&ZjNy*^0$DcD_aZB^C+IX;Z(J0V zbP;7SXa<(i4f^{2YqVUYrVvS&9Q^0adT@$UdS@vu$(PS%f(`^&LgvL3tVM_|0bk8ip!A$Y zn7q04d>C`WBqCltuBbv<4nbX|KxdOaULx(>!Zj``9#2oPe|4>&R#eQ(aOgK~&%0xO zuYBch)gkHN#A0%r*q7&&W&9sG<%Oe?^@a`^@&&AhW?MB9_0FThLbA1$wRQ7MMsGvGBEuBwRz4{)Eu8vlz zasqG_Z<(vAKV!_3XY~0zjI=-i6o2^)LA9r&qwjPnDx}w*cPNUH;SzuOkgS=RMo|*_ zB`;sRSo`HEDQocb?CT#tW|yt8w3O8U4J5M`qbHX?r|sBrX^nQErDKqa)bVQBItsV;LwSB)H7z4SXvzY*LTrx^t<81{Te=U1WI($Gid7aAJcJ$A(o%_ut9 z$;xMWKev0Xicl(Q6dvA-3(1#A0={lPl&D@|wvtPLMxQ<@&+B=8)myVKUyeK_m*JEx z?mj!Mg5F#0^1jWDclxkkVWBr-;Ioc1Jp7do$kx@u;udWb1`PAkwd>a(H}bTj(rMk8 zmE-#g=0Wn_b+UbK{`>t3gppH*qGHJvf3XAoFjq2vfMtRA=>ENXp!b4jearK(tZZb7 zd=B8Qc%O#5N zLFqtAa0yt<@UNSi-h>p#G^=43cuhYa#`*$L3Of2!)KA6AjR2Vyto(ErIBwq$E9sWXipJ zg(LUH(Lp_}c^Ox}bY0U%v5ReyHjS4s#^>1dZrq5;b`XGRY4sc+xuTE*?qpTbFaij3 zk+U&#$7CS{0-9Rne&9coS!DWc=Rd>^>_ppz7A8}6>+jK?Pj5ebI9yvh+~p9jn!VBQ zCf+kmQ~PAQSRGH)SM(cT2K!!B+`f=*KlEGaNtySn>PQ5ryx5{BwqQNiD%qD1CeH^h zRV}&jKRPUevG}#vUuwrNP?&K0nTJH=xP>W5W<*X97hf_66(e~D{a+l8T3wSii0I)`AO;d0qG)SV$2FN!KgGr%7Co_d0}EQ7nuaqNEV7Fb+nvJ zOB+^x%0_omxF$AeHuc8lI;oYJfGj-oFI4GF+?xEgc%|dpl29Dp%=yt#s8wnIv2?Ki z_b~VV3L~BMwr&**$#aQNF1q35IM1gYR5*#Lh3MqaX?(@@GIrOi7cZnFB?(-gHf2iK z73ylmnP(aXyXi46D|PBgE$gSm9{=indFV^+Ns~Hxl%xpoq8V$=-;aJ~Q6|`Kj~}0{ zv}LAlJDr{%SEq-_uJY@%9(wb-ZIhL{Spt9iO?4 zTz=nPJQf{mM2-N;j^hr+$FD9~)u2o@K4#dk87E6apE0~~42R;Q?u(q9{?aDk%k_u? zPbANQmsWMyMXsn301Pc#c%Nj<^ydYUJtHtUm=Cx!tW(pr*T=7bfMIKxbocIBo8y6) z9Xnubj5+tSvk5q4bf#<8Smy4?OG>4#Aw)LAVTRHcGtJLWlXsR*fSKXs;SG23P13th z&J*H|o*Jb_{ZVI|s`E2oIhdh5yNI`TTS_8&FIB~@XQDVAlZg{qOk@A;b~(gFWp=3%!?&r~&x<7yYx(+MglrehKTtUuCmrVgNQUPr}vPWu6 zp~3(I7)ke{%?d@Cg~!i1sUKr6DLn~{!>}dkVS#O*Vv#QdorVra<3wgKioyjB4$n0E zhIb5LlJnG)sefLF)wU3uwT%&~+zvjz!vEgL9)y5p$48Wy z7#pu8AdBM>xC6k5>bZxkBs>&aJerN8I>!mqf6!m3Bub+#lx|}Q=L&O3BMV~G1-ZlF z1H;c=+Q2}ecL{$|M|qWB6h$jXQl7^ z5!-j~UdkMLimKHgqd6pA<(&VrLv2>s(Y$Tm;Y-fr$Jz2wA3765vgxVQw?q#L3r|u; zadwB7udTjoWo>;JQfuneyWn&@$KywjUI)>lyyFhpaa`+jLPK)jvF%zt6^j~KDlaQ5 zA=huc!G?^3YSo|bi){?%C|6u?FKK9KfSXn*r1?LN?^;FWGAXKXy75=y+!m-@o+z5P z;R+YY)H0(_&yA(ji*jWbgqiID4L)?}GobkUfDI{5q!8n%>tMzloHrxvzGDc@T=Kzy z90KZHN*nNh4kYLu^^vYyN;S@{zkEb9ij*ffnlht=*w`!vlbn<{t3s&-&5TtFxR{Oi z`XMb|FbQPDL}HQ63+d#aIvDYYbnnN5yuvqPx@s$}yB;qr-ZmuKQN zs7lxLN6<&0|4VMDmFu;v<1k`FE{(4`Ww&wGmHAzQSE2EeG-uhaer%OeR%)aepe^e0 z>eVYmnyP6p|2j|KRy+1seEc=cWbARIuslZ4XA;@`mr0aw$58U%_@qv7;r5nUpZ#h6 zI2uqK%AGicftiou2Gt=N-h{MBL>o0bM^yKrkm=PctfH&xTL2lEyq9~lCg+cq>6DtM z*c6Ld!O`F#qI+CUtAlRbJay_e1#w!%qr;;T}KVGr=J$gxwiHR&Y46dJ}B|R zOg?*|oB`W}Q{igd5giTKZK~666YV_2E0s|SSzpw{WH3^I2Dg37p^d;{ATzeG1NArz zgMdeprU7FQcybJgjuYUvYXGPMpFC(0EsF_?Vy4P)$d`O*;ywl976wkSmisHr88$5K zct}TIwT?IIs~Y>s=lAqPssU<1GtV{>%E7WDhh0<$4^E-3m^_5;=5FAz%~95ZZwC-U zx|{kLTRo5xtpaVg0qACBWo12{r5|Pn8%G9n#AJ0>;l-N7fSX-$3=$M#0Xc%ce*1Qf zSlWL5+7OZ;=UaVFH(XOQdk?oe1v3Q%VRgO1x$p>(j)yve*Yf4d297_EBM}i1d3ho1 z1~Pyp^9fXzk(M4memtY5tp3NTqr09YBXAgEFm5Srl}#5gtYY%C2eehix+;oGN-8o4 z#=;v3;bW;^L-yZ?GqId9#hB6nCK;ru`^_~IB>#^V;F2CbKh&|j-H*rmSH6KC;)&<4 zA1Ax@78O1C&|7B_#|jSK_uy85x#|RL;1Gf?qQ3wkpKot(#KjC?Bt#E@7=w+HflH-> z!ub%^)_oRbmku6$PT~2k)Q?j0Zj#bLJXWWNA)9LdnCL_iE5I@IY#ka5WcA=H=b*jLw6DhdMB zr@tE=!^8qK90a?byu0~mc~R&c2j42N1YrW0Y1`LPv;c>KX6-I?^}at}%KH(;U4uW@ z_>*WYIq64tB&RKn89FECPkJw<7m|I)08s+2iWE+IjwcBj$MwO35t9cJvzAhZnGADW zRBFN5OPA=ToK=^5dNTG+gXO~M1mFv48K=Xf6@*akJ5CU5%lL^cfjYXnLfH+6aQ-<$ z8}3JDZqa^#Xfo*NJOoRR|bCl@=lOcGL zY(Iba;J$qMZ;DhlUrS31?f|l7_*lrZECSBcS1G!E8yK;>P86zmwnE}EFnOT3B?}e^ z8Ur%*iFk#lV#6!qZL66}+s(5AGrNA{2KHtA_jL2SYT5fg9*Cp@W>V-ev*#mIk_p@wbOg){g>Hp$&aZ8e8zn_saV;#m z5yZrmy%VgWPJe;Bx}~64J5*nvsmr?t6v+R(a!EKXBDx+lV;*h0uI*R9<^LJo&u7Yj~Hca?Wqsv2hbdlw9Dz zdi(Y*7Z!~v4S|HzRbqI8SJ-@eVzk)7;UnW-92OsNr?MfF8w|4W1E{7bqK>zD z;`3v2hTPUKp;^rz8P#mMtRo@0T)a@kT2QJGKW_HAk=iLOZJLht>EvX_FoZD8*WX{O z(*ad9D#2pofBx%jyHZmz)_ac9m??AEFZO!Ms*%m#ULACQfse*w6ck+<85Y>vd+1Cu zaznhpTjpg;)vv})D4fWwZHgF1-F2UMB744c$VQ7UdO3Ur!Y-~ZTUVj#V!9H2FcN*2 zdGV#oA0JC#(VqNf?(QE+N5p&r8{=_vt$T z&|&x$ghg~2^;)smM5LYj|}N(XF)9FizUMa&vHS*JCoXzxh^c8T1Io2>#29H z#+=PA+Hrz%9WN4>((27-HORXj*I*n|my7~ztHnqVS(cTH z>NDs&ZktY!Bc*vbIZ!x2gCW}CKBk$HDS8P;-x?t$UVspW!g@4?FrQ!8obJ242(jWi zf<)n;#QwOzK!_BGDG?}^PY(`XbiE@?<(-`V8W7nb!%6Dl~At_^NY|A{1 z1Q3w@%xrX+7U)*05>6D7*{COP8*i)1&$&^e6i7J*Jx41r&hX_O;Z-rEc%Un}1Tnn6>Sfwhz1k5hmuga7e9TO+28@=K+vvu|# zJUH2;VAf6-)%Qj3$L#5B+qUz_`Nk>E3!X8jv1uphgc0*>Si#jIU0Ly6&Nb)M$$*Y@ z5sauicGMgjGIKni6n8N$1}NEkj~@?!FJ^3|knUTApM9u_LgBg}Z(+LX2}ocrkn+t5 zC|Zf`))>F0xT@;-tD`ILcflvM&E51&QS)cTo4IHIhP0MdfhFuFs}3reHxb}o5Ia5i zpRMj*UNF(buPQ4KIm+w_W3N$x&zwD*Sk!i475aXc)Lrv^_oinxRomjD3Ui!)?v}F) z`8q4%61SY~Avwp+u8C7dMpBYWo$)!Jne+H5PQ2H=qCAIfuZI6WWW9M@k89iZO{J2M zB1s5I2&E#S6rvQFDitcBL6l($(L_laluSt_NtB{VhLj|kDN4~GjfBjZdcWto-s|~1 z_jCK_TGvAB_dCzy*oST3wr!7zi0BqvTDRF>8A=5tC#0T70}KT9*6ZmPs3u`>&?Nn$ z_*Hg2bJ+RH6_J%otj9xMtsMEhPGWqAUxEji;XWnAKm%sqx#x5#J^$xeU0nqc3%oX% zBZG|50otovEzEs-191$jNrUoxTFNnIpM77&7j zA6oMQ#TdKiaU`&)qRec;U1;f8rvIEewf#T&U@%+zLhPZ!qB>V9!Rr`*H1fJcPaW8X zNR^bYh;4G+@~*N2=^X(T2M&a~&S>-!6IU--@KETKv|Vl{`67$0zf?^=ZrgH&13mNQ zRb(2Wq1XQt7U7vNz9V7u7N13J1;Ldm(;hbrtK#Ob3A!;OMzu%-lGD$3nU83D#fJY*F{4k zqL+r4Lg0(5+tTeONR(6}EC=}B3LGnB#C+MZUOyQ<@)u0YzA#H#GGk@W>51@N@K3zU zQzIa)ad&?(Bx0`2Eh-6~xv)rrVxOaiOE3~jVLy9DZN>ug3m4_+f1mO)+v4EZ0ZtsY z6Ax~4JNdJ5AA~jN8G_9?%tjJZ=?59zS+NE~%Cz0LEG?cEBRYIA@R7z@M#;iTguQ`* zq_iU&|439nV0y(i62o76eZZZbxw4Or_gk1Zf6-FfCuTjppGSqyo#?-G8g-Esvd

    |233n1z|>GVau307RYr4Zoi66;J^hjQUqEz!VzF%h{%_vDpU___VSZX#+HfyW zdE4d7Jr~S<+yS&k7G#8*Y<5h(cc98}*r#VtVR;=U2x;UZ4L<$qX zt7Ftywe>Pdh0n_F-jyb=#^~w6;Np3!dw|Fj_*?Vv8}%TB1j7N z-B1^*B`j01-0gc&w@{qsLejF=6BCu(*1Pi7@N&iUyN94S^1j(Rv2^81VV?qDo87Sk zPrN4N5Czln_0g(A)a)*ypnEg)R=+pz&To$U+g@JlyVt=Q{F&=T54~0I6%6FJ@812+ ziN4lar@LY8T2;2GH%Psbx|@X5DR{P>YDHj=FZaMhXrahN@WM8ER_TTfp1N^(iNn?k zzm@3>+;s2j5myt@xT_F1&3-|3}vV7opy_0}FHI|?TNtUA1Q?6~=bEQU)2eW|g`9^5|}1b8JRjE1wk zJn>RvdwcKAviB}|c*(zU-m-aflxfll30dDSwmN;rw)Bov=^0L@6RWI1)zK7Ey z%6tww<5$aq;g@Kl;E+u{G52AddQbnB7n#i*F0Q4%P@4}dJbQG;&VOjzls`Wt06nMo zq@lu;q3rwni|TH;tq_a|sobO9O1cq0J_Pt>oE!dyE5e{}2skv+0!;OFpC19mr{}3K zIrH4K$<*AOt*dX`G|rS8o`1HfG$7%va;M~!(S=Qxf9tx7${XAbH1IR5y*X~}4s#hL zaNE5elkX&a`#$<;fW6#%vBjxl&%C;QTXo{Z@HNW=3N0)x#TN~=`>L!tcf~#b&VBQJ z|Aaf0@dPNlw=7#cuksP;(dN~0yXDKNZ+g>#v>i;2zyAkf_s7w>g?IbA9#lBvcAF6g zdJ`2{_uBl}xWD2#{~W(mg8W2@`j?`VBdGDG@XMlx;xo>=GH%@-j+Tqk?C?7vCZkXM z41so^QRZ_BiPx*vT{idAva|<%gLQ)9MY;b{3#hk z{WhLwtfFJ>s(c7aOCbf7*WcfHPonMHT&uELX>Ei~WLIDHS|xioH(P_P`!@b?vmP|B z4404Zd>YGCYfpGnKLDI@UVBHq!#lG3EAvqEcK(bN%I0OzG3%0-mYnOe3Cd-H1%Dzc zQ{T6$uBAotMI+$nbOz(}R_;~W^Tv2JKOA!BeDSNew`Lj@vdbifJWnaj*mO+CP5$@t z(TmngW$3Wh>;qGOB8zh4yvTRh^ziizt@bRN@qK>i278!d8?+{+iX1qdMKXxFH$3oO zNlB1a=d$D-*F?Jf@{_d=XoZ!JoVdGPA+%sewNK|mue0NA2Rx*PVP%1}x<31FE9Tp) z@pICn`tARh2FLd)j2q_MWA>u{N=B?#6YTgEik||dC4L@3VWhk)thJX6gFne!u?8zx z^R$MryBwCYp;aJ5x5;f|B+hzXhAx8w{W?mgjA82pYNC&R+!_~`;D*a~6NYK6m9`eA zk-tvfhWJ7WQLpz!_%aDzp`Yq^ej3wr2`_yU0>N(i_XyMKwAo4Ta7!oG8j zBXpHL0#r&dO~te?U#WY{$aUcXQ{=>wo_rAvR*>}9_4#}4VC1bvPY(}|764I@HKm#Z z%VKS+Xg-)DN*7^p29##`XZ<4Uu30}u#{KHJ!*t`ZGZ z{Wkp*dL7W`uZ#`Q)sDE@S8VdEF=B?mi_q$`cdT~!%5LY@bLugCaq?2JMk?A4I@{Dm zM;sNz|H%OQ`B_vvxMJ{~-PvgSpegqS_@z9q^fAymnk6jXVtWpVI(gEvVw%hGzbM0? z)*n45dgFk!H5pgz)xeStxS++iZn48bE&8tBklfiax3E!Ao-1x}(!cM$OK2%>dtM_> z(_8<69uL$`TVfJPh+LVoemTv3Me6dAQKb-9g=!5CBv_LQgVKkaRm_VDm|BCW!_=wA zdfBd45MQuY;$mQf?uo#MU8jr^WI~EPj?0=YGA_Aj*fdeDEM57)JexF} z?G7&i6nRvn3WZ?X`}Yqwj&ZiA8|$0Bi<*^oX`a=P?#E7^oN#d7^cgegEb9(3XlL>U zeeuqgtHUp!(Wn`D@4*9|#XD=hnNcxhXQOrMKy}10;6r=+gCs+TQ(OSIHrn{_XmXi|pki9QU?)#<(_x|(8k9CtYD=HruZw(y0sc&rcn>9;^ zS*S8G%BNPxbN=DZr6adI>u&mC{h39@RHHD@4Y#s<$W(Mfa8Lg`puqRvtOn$-Wey;d?>RH1A&)=XVOiH%=^UqLx-D4k?X*4$R|AoDJQ#S+lkJ)osaDW8tXEwDR zUgM7$;?w-%U1VMqj9<(0n5TN%x-NI=(y^1n& zhZq-rx7hUT?AxU~Sxd0j2=17$s_SJfxR*CXc-m+tMFs@9HI8pXe!-tmorO?@_N z|49l6+6pudr4TUSTCz!kvD$vZNEbjOWi3n{aoa(cTgm=37f|oyX=j|HErgAdNn9FYjFx%+H~t zzMob;v0qCvixvk8^Ru^W@fG}SCz~mB;2%r3^}FjS(ETj z?=NO;CcC7qy~lL(0gM%FVpU8CymS3BJ{$~_k~UFRw;v&vEcfpI#+ioqCHfx$v3mC{*ma9VjW{=saRofY0Z-a%Bx-GfwsaBmLT8*Tz;xq?ktCUpl0t`$kU?GjJpp=bj`>8%j=5 zxjuHngun+6v5W_&qflD`e-nWlbbD-=u~Tb%{d#fu-TTLNV48y2;o&&-q#|&p{Yvpc zcls(gEf*v-3~zvyzIJo~)$`AcSYM6}2~gh0&(oAH16gi62aZG&fL`E?+E}=Y6OL4j z37&R)=LGe8mg%D{qv!mh04HDJEkHOV%>-S4BxZ<_rj=F2zJ2=$m4z2gBVMyY6x*?m z^Xd7MMy(ni)<8SOPlckP5J&~_>e_Z%qo|2(4&Q>q!UE;8hccgrL>v)uA}eT(?7hu9 zo{dqDRVf7(qfVvwb+63me)4nC&q`I;H>R=pLju8c2j z`HBzblpDp(GMM$zYwIp6Wf@_Q0W)_>j)?COnPZB|Q!URUs3_cg3_${LBiA~ycg&V& zh2LJzUNXbj1u&0KtZhzD!D$Su9Snn%ig#9^wBN3kU~CBE_cICkZddRiA~KTGRCo3a z0fp^zjtkT>q_Ehlg-qK{AWKljqByi%*_}u zBantNLu-HFr_!6j&1Q`^zVgsXco}`?B$olQU^frWx-?zZD-$T&gV7|9^!0SB5w)+2 zW~5$e>$1Q463f#QlWQ{WNgVw%aJ-F^hJw(SvG2^mnvoD@y!NLXBUMr?)PN5P6{E4> zR#e2NYp{aCo#hMiw%0mKqws-Qi4p^pQ&8s>X&hbyjDo?=Nu1F=>Wz5V(WX7#nt0ul zm6N00m*}%%!J;=e`v0yq9C)tS#-aQT16z6mSTKhUAHM5!>58hSPxBv|MgcBnwC_8< z^!al_b58v9%}4yC;R6p?p9qvlP85n3@WsYW+i7`08Z-G*g4)FP8vj7Iv#;1u!HRdm zNgzYHy}Ckou4OqOh_w^QQ}8FQAG1%YzCQfFT!7-&`}Rr76hqy{)@_QOqloW#o%kC9 z5smfLArtd8W(15saEh@HQ$)ze1l!|3)Z5qr&02<_>07`Gur}TRVE)F(>AWoMM)Spj znXi3rhRXe2xMBQDyoLxT$XL7Hrr!wM9Vk7Xf&384bb}=O_6U{jd;@Tk`AJVd9iqJv;R81`{Rwv91eZ4Pp_m!(xr{LcPvtrb!Bw#+}{Urwmi4M-w zkj~7?V&S5|KL?6NoV&-t+SwV0&_TH|&+guJ{n&N!dyVI!A#WSHrdDrrXuTd_pAhUn zZ>hS;?B1^LRs^55K4n~7V{29(qY&jbQEYzyopUWL%HyqP9-MH!=X~4Bnunc#I(|>D zz257!zvA`pS|1F&OW(h{e`4yAxb1f{9LDE}+KrVFdxEYVqW~PpdCW{&XMjgeoVc<4 zES~?y*kSS{@p-h(urK7kfy-$_hNZ(`^98n!4^Gbb6?;-nfAWVUzd1uD)j#5X{zJ*8 zp&^sAtzBb#L9N;tU+X=^jw#PvGcGR@*nbKue+La%y(l1RfgpksC{ysj3EWsV*U1Ih zEaKRws6C1A(|dA3MnI4!Tm{BI%DP8tUGXbQ%PL`=NO~PQfCPUQ5xRc6~`&vrtJrLT`B0`|b?`(>pVKEeu{L^c#dA!I^rjOZ`RT@nR zHxHFd|616-!+DwOFOl@Y-zGd(U8*rVETFkx1<42E1sF*AhH_KI)`(%F9-Cr3LOL?tbNZ(%DjY3#H#r8-L8tEdW zvPN4q#?G*NYWlA&XPZ&C4V_r5a#rzW=ezUCA&6noDEvv8*|1xted$*vb!k23Qx$64PZSJANl}fsBI>A6eJm3kr z3y&F#96#N#fH#Wzg`U@d*>Kgu`(nSZQhbNQ@jxqSqY3RJ@KmN0g^u0RUjgPV|D3&T zJ;9!Rs5LzTg}ufIhpHrGEy~A4Ut8eL5% z#S2UeZD4@2XXjC}fBE9=(^c3t1y4t5anaXW-qNqeC0JZ$Z9G;VGP6<4+f7(?*@JY7 zaVnvZ5gK*fs!L9#w7;acX^2`dOb|rqupfyebY=dnnt*f{F1%-4&FG)0E=eDn57oqm zxzPpP4i`K6jXc-)*ERbPu?6x_3M|x!bijS_A-&J-1+nejvuAhr?Rj>%89!sQdThIT zs4@1{wF*g@vtFf`M3B?N1w;62nac8QC?ZSDH%55AbDp$ifvNspkl$W30{2=1Q z32#msFIlk4F6p35dsb1AjvP$8yJ3&DOuldkJ_cUO0wb_(L107#YQJ}9n{2;+2M-^f zOwOc*N5IEK`fN_lKLC2uhxVPY==9=Nj?A19Pnf=$MA}_)3bsi*$pnarkm#&2R1m0- zI3SRIg^U|zi(ra1jl8FAVH=c6NZ|GJP=4Y#+rw|m>BTPSNKR~?7s=*>7}Srb{tr)F zrOzmw<1p~dT9NN{l8_Rp$@GMHXck^nJd!_3GnUektc4OH%A?p+Y}InhGZ>%%te z@P#2Y;*$Qpbl%Du%1gkeXw&TN zpV!K`Zmi6}$at1nE;vd-;U-u#8E*asg7dZwG!;9$6DZnUTv~ytG5p%PPM#HyNW&3P zlb@cKmy_MA84TQO6#STAiM3bJyCad(NQH;pZI2>TYukurO+!+HvxFTnzGM_+giJ*B08zrXt7@7Hu6sNsmf z`w<`@0sFw;vA0)#W&${j`>6+qjZy~UW`J{iN{S0gC_*mzcBJIZ%1T`gjgK$@m>+U~ z?-2r+ots384L@}9QLl$)DzZIU#)z6VI{KMJZPh^)!4!c`0ZZj%1TG{>N=s%JAm6^B ze>j-n7lk@nF%SNN%dk9q_&+t2_rfBG{!+uO=b~T^th~+2BeqIT1u!cuKFeQe;ji-qaY{{{+ zr$DFdSh8c~&waaiPy)(A;n{ca!3}JdLb^+}(&zR}ny^Dr7N0`D z{;BrWpH5Ps-$CxFs-`CS`+MjhE#t%|bdIA`RHl3X5MF@*JB}SYi7{+e)^woupdw!O zlji4d5{+u{<@r|ovpmqN;noZs;0dH36XN1(vHgKK)n{APA-kLb@vHm`6&u^E6Q5}7 z==2lo9@(F{XO5Rg-f&iSjve5ow#UrAq{#8&miMk-#N@w1QQ#=x3rKpG91g!^F=VT; zwUCR_5quzoPFAIn*)1!0#ff!PStJ7SPV z@wV2dJyx!Q8i|Mh)~!0avuU6NA3*Hqf`TN(tWiNhXh+hRP}T}0$AjkY^Jl3u40hW_{pdtyixdh$?MKJ z6dm2s=}k2rKE6OC*OCB9yI;R4j{`xiHVrZzhacx}9)zKr3!R(&SMjUAiAMo8)2vf0 z@@P}?a&qKH6ygm-(Z&)#5;ElY^t3c+^b}#}&tP1wLaH&KNxr0mqMv{P0p|wW1;<7s zoZ~_~#+m5KdB4vE3=sKpNA9uZ5fVrFn*w_cERR9mg7dY6eBS&P*S(CX&C z4s9#rqi}JH>@_ai30^)xrJrWO4qRM!bwbF;!Ar?6>;`(8C~UW31ehu1c)zA`tNk)}kL~mV-6n1)J=15MAT` zY5eh_$DVS|1pI%IB@g;WYrQPQsKHTTEz2|#E*JiYEp{Xs^jfpT2R?$SX7|9B|Gj98j!CAR<2T{72N%2E0Q-$Mukq zk)y?u?WuKm0MPZEFVs{^WsDAde1RWD+EMCLQc$3b!nsOpPk$aA_P`m9)_8@`VuzP# zQ8=SwI9t6ZF!1Kz(_D=N3s%Rv(Bc9VJoB7UGeX6LWdn4dY#HYE!=7i67L1P-J2&^0 z6SmQ(Zlh{|tc~GW-LhmpZrwF>$j^9^FJDfF6+}$DaN!|pc<9?DC3A$@ss-m6*USw zsj@3(Ljr4QAt5=hTQ_BMli9h=Mlmq;3jR1U4P)OO3oRIe(vBpzZ2O#I?PL7N*D=zxmU*S>Ja!|IG*R{)4$ z+j@9>B*z-O6O$|n0+q+*PG(mB0Rvc*Lux%C^^U>U%V@loEiNkOW2gmX73y~1*lZCDM%u=CNn5i;F zbh>B_zrlw6nAYl(H8pXvz$1@|Hy=`is!CcKXcN9QH&$k8ENU`aTV7*J%4U0KXUPjL zoIb&nBgfvgeZy0Kf02FWSVnVwpzxuLe$!okc)* z_4`JAc96lWix<03xe9ssO^27z0rcr}fsc6Z94f_ZO#85^#sr3`?)q2Tr`HTz<=uT! z|2#YW)wiW(EEES1{tmC>))y6%pPikQ;4^io;zlnxaT$1Q@^&xAF? zSa>FMY1gk^gD%E&3#|iBfo%tQb`w&=KQ3l~p95tfr>&K=j!`2F*F8A@i-~zxiVrur zl#)`)rFrtC-&&ia;-m~UPiaFLNd1>`a}lDcsjFvQy7Uu%M|Rw)uUqFPK0&nRJMIdP z6jFm;EN*gjy!wC#`%f+#C3%x$|KbJ4L2tQ_@S!ky7X+K%ZaU%Sl^YZ9$X?^eI7DTa zR!9Xp(6W2$8*q8!;|uQHbAux%bL9$902MM?f2u7S4tAT-ff3CfJbILS=@KioZcQ_< zFvuD0wc^Pc{Zp$zG8F|2Jeq==8tNJv8tUrnp{B=g_G=wJ@6^%>#g3X@I}*h($CUhS zZm%G2c$c!m@F<4L!&^k#Lq&}w_pi6Nf2@CXj$)`KJA>Zb={GqBn04;hu@_WSg>x0{ZgxQj z27&Mk?)#JjQG{L&IXHS>D%Z-vS2wgI%Bbd1Qi>U3U`?Im7laqWMHaPzC~*P{`aG(r z82G*~eIf_Y;d;kagF|Hi$*|M3lCzKWzH_$4Wd zA@`Kju#cM@Ryb%V&{=HRvgJTn7+%j}#V(Q)d;2?t8jEh*!2obo*Uy2{!=0DiF-)@* zj=fR2oS5JS8xb*chI)8OuReXmpU4`@Kpj7IQ+y$ovsb!1`%!-`U_;H<;iBVOxPvp@ zX4+n1GsfJ<%aayAuc#3GSBJpZEXPv&$jCx zP@(i&xS=}dK|z5%O%U+x^L&Htyb~%OD#yA&aG~@g-ffx^JgL#onhYd-L?#_OQ0(Y(uXX0Mg~^Up#>;lBY|D8%=j)A5pBVXT-x{(i z+3J>Xcy0UH9#vEE+0$s7GI{a_{l#Be{VHQD_qK;F7-ty3v`Zme#x6B);AHer{iQI~ zh}p84|z47Wqu}$=fKJ^Ice0 z&E4lJ2r{0)h0cum7OTLtf8tzVe7e&@B;`8RtnpvVhcs6Q1}_LPoMdr&jfTR5(Zf`u zde&Ff%lkQ(z7jjLraJ6;&s?dv-0Xoc0gFq2@AA#;`&ad4Z?T0ih@ESE&R&dv;>-@O zzi}s%vtoMPa$nlZqO|VC@ZORRTNS(4^fD{1nqe{b#f@m!me1EzOc+f-6>!86nkKx< z>-g8lZ|gqUUX^g%IOvIQm`?P!xbm*xDc=G?HT8yXJ-e~i(LC{q{lPzVX$j3rlBJXr zGY`G+?&IBjMbvn>ayQEOcH2qu%8~)1->o04)36o+YIo6Al=P^!k#eplO+~4=I6KeV z`|EUBEAmB;t1RK3HA{5Q4eCcIUUpIRhCs4$n&qM2o86-h{!`+7v2X5W1160bZ{BVh ztd_)9tH2yKbMEUEll&y1GaoIzf3G)960$8_JX6|N+Rx(R9^YQ-RS&%E(l2;6Gc&^V zg9>pkCyfoRo~wKJUc7Ya?8ws$A2%;7eLO??g23^c-FxFnyhIjHI6~n-apdz+SEnl( z<2w3hAk(aj3_vWA%aebow5MFZ+u{vly6`Zog6isvg2 zRsGfXj(hF$Th%o-G5ZT*@dQ@ym4ZH4kKfn3%hFzbwccrvy88&NF zzTdvMYsx3XNiK6Ui)?BsdxcX&-1aCedu~=`^Sb2Zlsbd1_E?!;$;O}jR z=R2h`s`i}Rcp=&;?$L(SuR9z!hAEA2iod?LOLS+7kFVv>Z*gzjH|{wzV79DJV(Hh1 zTJ_EMr~MkLGxA1Pd6$0D+EM<(?&&Z8MO~r4-I(r&$uIx> zwVrRhZ~SgHCKa>|J@m3lMSs@6OC5APl*lI>VuiqCF)==EZCTyaR#;kDH3&>?p&_qY zCzGXs-~8W@ZhzMNN$b;ZpU+T@iF2NgyVa!-m)I>tBuloc*?YftLp(foT*JtWIZfS; z`F0C=)SR2H`0t7hgFEXk6wJ$;GNSf!*ROINVO52gu;`+uuteVey47#V%OxAWZ%pwi zJZ3lTlE@M5Lyx6Q(uF^h&^IovMQY|)(f|B;3}^d%7*!w=KEA4BNR?DlE%;JF+NbJw z64||qYc9(LeDtXD^ZI``fULfjF8+L{X&Co9s0bb~!Tj{1pI!2|)|shBJy<)k!s@?2 z{ofBI({=vZk#28`%6$ucea7^){8{ot^y|1gY&`hy#}@tr9R{U4r+Ripe05G&9k|Io zcyxZ#@|i7xGrk)Hf+y<-BlKST1?y3h-9+p=v!-+lV;&;9@ZD?5xL-xv(p zn~{>zv*-W&gZMp^5`WIlsZ)y>_J4mSHtK8^@BCluR-P+&|DXG6#9n6_S4cchPBQ;? z;EvV6|M4Skb@hno`@cSB?@9lz&H2ARz4vqP9dbtg%GfQMCXJBvH%>gL65Np1y0~v2 zzu4Wrd*D*V2}dw@1<;br{P#mV4g!P4QXuPDuhX+fEQfrF*q9a%b2ii%*YMG3=cCp! zLIX*sJ!X9KJAT<;ACdtSRRQM5$%X;(^y$n*-vu05ylT}ATtlE9IVuP&3S3A^8$Zc2 zSGh~?oZC1n(uppeU*p!W8xf?BRlVO+wTu=@`kw{O#p5HcJ<38&o!L9<31%$kHkQKKIxY>1$sBZm*?uM2ztbb6ddoe17vsuwepVIyD96a>^8Zb$9(-uL|g6gP|-w(Fb9ha2y&MKK0Lm3(ks z`HoAhsUR-%0Q4U%+Tt{gxjYg!bTDgPZt7{`tu-(7Ged%)2lmFvHa zPA&SC_{15oKdO|UI$l-TM0U$qgB(}Z?r6NPiVawtq9W;ERDW%}pHYIc$)#wqpRAGc zRNB~h{YIuDSaq6Z?$aj8Kf@&*8EHTOOHWCey6yc5n!Ud_Q0t)FQR)+M7QO{ zeKL_J+uOkd7}JwhK{T$dYj)|U7>Y|Sz_Ljs<7v8tj*@*PMmRwXvSY~yb>!CD$JzPO z@p=wu5>61|CDk+=pUw6d)q|6v<=^%Clf+2+YF<@O( z026VlP?!JQDM)ZRlI+=SUkn`20u_uY*c$Z_8y!fnIoanJhi!0n_T46N?=FfLuo*1cdrqc`7_j` zcD-wiO7zbCI(GDEo$kt2tNO;FZ(_Um;*{AV7KPlF&{j0xc}*?aG@{35T_p(nm7>$8 zPHkN-7j3$gwiPT8q2oc7*7tzi-)osKEgvnM>2$k1<`xXf<<+g@GrwZ&$M}Gj0?~dn zPAg7Mryo9oL9>PTCf?9xu!^(>OhTi&Xtg`qU1las6zR#!Gn>Xo#>TokJMU}oqG!k8 zXs(nwNWlD~MGW0Fq}@u&*?vtJDW@{&yDG2m{>3Rw^x9ut&9zB;c=s;kke>?X%qb9Q zD9OvCEx`exzM-M)xf0Cm2M+`b3@xpl>l`DLrt0ZEbg15uGL`{1fGLm{Hnw9%bliG1tlbE-cCkOBU6Wn#v< z8)6emnNCepe4l~EOp_L?$U-mjV4hf28>zCL|K&f75u;KG6F&|NB<~ARr3faOxF%Yt zftR3EN-vvVoA>_Z4IcxT#d_Tjs+8Jm2(#ZD{d)|l7o40v=HNVlZJzmKW(`d)nEgP1 zL%uxv;5^0<^v5v^Thl%>k;J=_CKG8hL1o9zow?a3##$vv72rVBZ4i~JFY1ozzu%|pSFN^UXrVn;m}k=rx>O|h z8pSTTwXWBCb4XiRiIp1hr-NI)SMV-`jrI3DtZ#W?^=c1xDP)R?jB=N5|9981xJ z2e9bKjJ$gK)Ym!rOO#4zn%Tq?_Xv0wKFFDeE(IvZu5NwHf~qZBzLZ?f7jN037gfqG z*}4ud@}j!@{A9&pVo0`<%j&%ZBG%f>t^agEz!=2-07gbAJn4i!E0HxAVIxfkNZS-V z`x1CY(qcqd@?-txso22kBrzdK{m|U}9WufnVIy#;DozBmW)$O_K6Jo~Ez~ljn!F|Vz+{W;d#In|Z4PcN_%=Xc|wR00753!3lfo00Iix)ld z!6U8d|MTuBAMWH-0wiZZ4fiw}6C}*k8X#hf53#(De~RrQ#}A?iyt<1o-hJz74O^?& zk-*hsUvSLv<6E>(<8ld3=fy~g(DdzE6wouQ9s>o(LfLetVijUI*;O zAOLsje4Gd#GgI%Qq${JOl)CUQIw&}d^p;;_Ag?;Rx+=mRZRlX%Vo0%`&tGrsIFdE(W461{lS^Hy{q*6_HH@wtN(cRSlHVOJly6YEWHFa zJq(GSefzQsK^P<6y({30IWk?KRuG2q{ixekyDOJTJI@>2thUuqxMfVyinv9k(1hP*$Gw5&vSxdR@#(dOocV_l)7(M3uhr z0Jgz)Fs1nFQ`%1yk?~tcIZGEYs1gwosoIiMp&B0v9RW`J`pLgWzVgU?v7S$;AGdMC z2Ix~;OsC?h%oK{Jz#;A8pMVs>cZjyuHa3f0I3>c9qpJA&p|%V7lN9q8CQ5d5!L|$2 zm>-fz4n=F5y>s6cfshFYnkUuOJBgnVHu$6Zp0D?WDNP?WY7GybX&z?quyM^)Gt&kK zBN`T{b&!rQlOsTe!6y$135b2V?%_`N?a)aUwtdhlDSVVtGM z$S?g@_hG|~jov+Wl?%np4gAdl9T<{fiwe2Mz`zIRS%Eel4^?66)Ike$6as-}qfPfZ z93>1jk6gF({4?GY1SRx>F~}8BY2k7}AbHOA6$=;UU|X8*52Duw*1+C_%sXlPcz0-3 zKW|J6p3QKfd(vW)*zH&h@V2sgSOZtR$lo#4$$Ca4V=2`2c}_+33-WglgotUZ)}F+ScN{GEUYAsv`|7q5=f_;;M~`*rip&3l_fQpL1T z;Mn@yYv_R3dCW|eBGp5e_N6LPIA|1tv9TtR0O9VhjEz}UqJqV8_3+bcCmrLbiWxp` z-7?__V(ph3zSdjP`Vd|{uHSFm#N*!D$DU16?x0Utd9waEWU?dU7)lL*BQd|F%u!hs zj_82`P`oGE6VDHUZ9trtF5+|_p0HvE<7DP(gA^6>yGC*w_Zsz+k-^ErS)rBF#&0q& zU{0|q&yF(IWkm$zoxBqZlHmsAChCK3QMS?5shHG2roo<{R6IpXEAhF=pM#}NY`euX zAZ^_0B}<}6IEdQ#`kK<4@zMrep{MZqQ7`c)gdLznnd59T4s?KBhPf&p6+QyQ*A zQNff9I|sln%p_{hC@x0ocjpfGXm0-aLjDKNEfZ7F{%ZX}gMiN|LIeqS%GYn-1mP6U z!lMe#rKIGsUIRha%Q$|D566Pr#XR$Iv+mu74%Qm@Fh=SVl)1X3&(57Y#REF{9wj9u zh%CI|N)hfL*=1yAhV0v?p{Z#CM+Iu>fdkr;CSCFA+HGtcXr|iG;RSYz-a&Kn30Yt-pZD@FM*KI72pO=+=23^x|>*)NAqy=vm!Gk_xrdt1@Q#YxoskKm3@%MAG zv+0F|-SBw-%v>{xo)sdgeq1fYlH6=T>qW}`onsPQ>V#6s{Me*Mn!L1YcHLec$kG)& zip0;9(b~W}NIRdYpJAPfNkw6Q2QqN;=dG&VGgV|EGToeufqY^`>Do*~wUp-5-Cy5p z3dY~oG|6?%C-4}sDs4SmGYDjcZONAB_ZlTom49o);Jy3nwRHV!Gog9v2YS>N7Wx&{ z``+(Slp+798lzejS)#UnT;Fp?svJd}{Q&NF?bp)O90X?`YbaO`pEuU78vy>!*-jgL z0YyE6A5l@!2}j07o5r~P^p=4W8?OjM9Z`Mrm4QVX7#Kft(t&7adErE~Y0~Tw-A8q6 z+5bSN4t~$<5scBtPcVz$bFcYx;nDcw`RU(F=%_yjHvRM@xWatkOj`cQ{ zj*K2_NVkd&11w5`Y4B}~7bjhyzPzpYKzGAL0M6iX-XIJr+iPxJFTEyqmk(>mh;cEoZ+N^~IxC`mA(Vl=m@8-r8Ojt-Ox{gT6xG(P8c=OIX2o7X>ZduK$HG&T+f-pQ3>WGT`u? zSrB^#u>?K9f0pkxkoCEn8dIhOX>+{q}4*AY!yr**w?hOoy=AS1vLaIMY!*!i16U^niJ7MgTOST&E-(TSF|Z+!FS7NYRLzzvld zg>X5_$~H3?qvnElRB_`FL7CAa?&MU>wn>XU^Ip>MV#;#d#syaorS%N&aQdxpX%SY9 zkqTW0XHWoussN3XA2JEdP&b43@2|oy_191(KL>@_1slI#?-gp?@VV1NUlaZ(bE^)c z{H;absH9ict*f5A(NJ0sgLx(PK*%sh5tVlz~ zC(A2$m6g>IyuQ|EO7vDN*Eg5YkNY4@G>^g|+T10%e)8adf;N8kV13#C0 zmmDR5bP-JdWge}5+WX~rF5k| z&;2^{X1xb8h`~R6s0E-~V+_*kv*0iR5c8;^1KYTIwng%l2M#Q$_ke^AJ3&Jl7AewR z_yhOu%}=uwrsiCMCr>>24^q!_yo#Jd~$2I8+$!wJorwEEPMXkGQq-E~AcJ_QNv`1-X+($pEF>L~sW1P9|{LE)kowE|R;1`#XIoO3xWSf0fpr@T&ug9x<8 zwS#xeh1C*Y)>^e-CCfvZ7h|0!K0+4WSwTSomjKfK5~D$cGk(b&%9<1c@AAmY@%cwk zctQMxu83WA%f6jbQc_I2_cVA>m_QW#^Scw5F=}Z7e*DPG7c(+^&+C(k;C+Sw}KYfC-M6XlrA|?jBu=(h^x3 z`#(P3X=rOx#H+g}Bt0zLW?b$^@N3+Z#}orS9RMop4dHleCV9ez<+tcurz(YIXMe4} ze;!X&m^`iM}cp6UY$nX&<@)uU!CNpy~ES_wHD))3@IV;~O9P&)tq`tYyUD$7rq zizO{yW@R-iGeGllnE0+un?7-<6MmVqEqA+j28}T^emFP8eHOd1iHVDQv^KN8V1v7R+OEx;p}W9as#I}KcXPZb ztZ0qzSYc}mX{QCjMoWvruwm&-#{z=tJKPi-8^r?!cLAcJi*a+C#?r>v;^U=Gw2^e8 zEcbZx=F4QAIF3@qvu9tCtFUCNN6dr3nqD)^=Wdz;>__-qd@2{gZ-h!p`|S=G4@LyUC&E?l7L(lFC!r4cO)B#r2q%JH)| zk?PoUgi^vicl##NE-@cdUi%D|?!a`^_xWo_v41-MXZP(ByHlzyKL6~HtJ$xI-|R=6 z{?qf?)}z^m$9q);Mno>I_?cnxRF1VqIbSqJ<5qvC@e{cwQpIKM+NQ=vRtVq{siW9C z(18z7e%d5b<>hr2(E{7>Bq;J$zZ)qV%pbu|6lWEx4Mwfm;UyaC(55*YC7uAHbSR)G zbQTe3peF|zCvt7=5-bYVYQnrykwyG0CNADKuMi&}h>^PMvNJL;0FTdE9{-Rf0`?VH zquF-`t+@1U9P*)Y>gxSNiq}uBhUHOPyJ~0k=x9?^wrp-@*ntWsG}N4zlB1kBVD^Z9 zNAF#HvHqi8JzwOB^QKLkusH!C**biQP+nMc8(GUqYCii>0P+q&=>m=9Hd26)j?%_& zkQltv3oBRwr?XqJe8Q0>k8ZBb6#C}t*B#c5Hj!1o^TS&|yaY=FkU>uMI}UlwgP#Yfr8N|$0aN{n5t`r z)b*+jH80$4x|ev~UEoT8MgQmK)Wbr1AZ+rC+%Kl`w|ee1%CkEO4IbseWP|a6i>_!@ zja7KC-F7F?^Cz$AZKs}*U~6hts>?6wX}4kp3?fawZJfxz-6No1P})gr zNLEPlZ|)of$3->;vV?6&g-=N8=83YyhAoVAqWSxpK6QTQ48oAKKMP)+r{>ew(prMXV)STI$fNOR4&G}d z*HEYFhAkOkC0$fdADeS%?t~+-^8f7m?te2j%sw&T23y zox%r3XOOh`1(v;-r?swMl4tk+v`G{yD%cBhLxLP#v#;djeB+t&Jy4rNXLxYujxJh4 zTG6odL3h`b2=Mj6->vwqw_Q1#S4jL_j!q_^@aUv9`wt#m#1b0*cC;xNy`VraP8_7; zx)h6WmfnOEE7GlfIYr3@pZMHpDj9m2FJHFMSOAJ)G)%=kWA|@igg9vu+9BpjPE5X# zrBDO6fpsol{(}CM#skmuF(^guylIZ};p9{Ice3|%+}N=Q=#&Nzj){yEQH=mG% zUAL4a5omJ5(8|C=-~aQ3ib<&PW(pYUepXmTzF}T~w$EzSu4OA$P&o+3X$u!FWZg4U zPx=UP35js9`HL4j2vm9?LUi<5-{(=4bFlooYOih2EMC`L&VXtj8y2)Fc|+vS(DKx| zr7|WHu6U>Ax;|jJNcpOoCss~!S#^b>6Gg_I#!azzv-01cU3w0OTzDdL$42+T0|}4K zpGpy97*}J(Xm79l)r9j;k{>g22cH}PHYExVn6f8I1)_4L8{x=N?1sCI5r9Pu+?Z%Jqy|ck_GYsXAKY6m?mH@SGmxsEn zUvI{W%Y_SvX*!D8l>;qN8D~PUMg^@c&_S_*#uGumAu}OiIB4dDCb;`}B@h&h6E(H9 z50wfbRoECXuQ%`-*6=gcTi(7skH%-#HT=AE{phlXhFfu7*l>WG+Fhkt>hcELKg~{B zjDtTFK~vKit?n2Z(*#^UbLKYHO=aZ|%2%2(kgC4DdV!q)#{d$`28&glD5`(l`i0Di ztqRQa)`^CXHOEZk5mlsZoF9j*#$H2zik2oYOlu!|1yc2wxF{hK=9A4oiP2TZ#0?h+7JX=(6|UnssjmY$I>;5#o)0cbi zmp}M-&$T0~3J0+;L-3FxtwKsxP*Cu_Dp20v?hA&Ds-TXQxO?XjeGFxFtX`ifYptoN z!RD)^gQN=em-jL2hyo5E&>XPA$sX08Impi4yYs*Kxl>W#xdjN_@#V|oUUTlZr!2^2MmXtKpVUXT7R`1QZ zGi^zJyCr*giXJ@*FSMuY_IFxR^4JBth<2@0B^vMOq6EmB`X;M!E?_6U{MG*QAnLr@)I&J4m>`k}Hc15{B@CXuT zG4l$b5{7nEtQW28to7(HC>EgDkC1f4j!tm?ryIiN&yyC53q(^?)IGsGTzZEZZ$QlO znvYUxlW$lh45OKt^Om1w7XyNjqXnotC=79%4+mSM2PI$!h|B-*-=jq9wgpUzgt7yI zrAC`zfeo0lsOTg8EA0ej!F~h)DLauxaMpDN1IPdg@NjMbex5^RWkn2n0w739vCVg) z&VX$c5fdlEDsiDmMkGmTtZZqY`C`~3zopaaK6e5Ryd`a6XY`keEoKLkj+t2)muc3< zXsu(%y$}pJJ6X-+^y9D&eF&nY7Yh-nhEPkDjA`gcs*~M(VrIzp(bG9ed>ziT9C&~M zd0>l|*AJ#B;La?ONbre$+a{>dyr!>oalygy_t}OSlP7;;zXDIM;^aqCeW7Xa&pnTt z@wuaE`m;;z{IfRtZ{3>|rN(pS#7^C;s;|G&XS8$OhJ`!FG6f-Dl&|cw;EZgr6T(PT zD(LOtnKFlUj;duFrepi!f)ckmbM_)fii_Ig6ZuUtL+yqY%XB$&NJA8{slVe{wQl~| z88-7Gm*ULY*~`ubAHw}cvcYfMbM_1q(~Bk7fPhHbR%5B&l1hmK-gsdDev!^Fl0ToG znJ@(8twZH4&rrsoYoiZRL1xUZg7R{0>R1)o;*t`!2eCN`!4LU}1PhRf>h2HOh-!0G zK;aLz$Wm^Q&i5KQ&sroRUe>YyJ zXbf$WWO7{{3seZ@9ehRoPSV#amd8%&7v)R*HKR$E+B_ z3bh}tkn)bV48-`3_HVubuySyi6mj(Qju9{kn}WKUEl)RZitO=)Tn0&m3cLK-;k>-5 z*2hM%hXrfo^!v;>moJ?_-$XgKW}OZqhx$DBljI5if%~3H(eEz~e+y ziUncvn?CNRs5n563+GJ$CHbE&srj=VdA3U>rZ$nonzthXAA6v8DaMqGGxy$WA1z4Q` z%D7)&BV9Bzl^Qc#%(@*su#QP1h2*D>4wq4z9+!wtFlc%hJHOQF#rkh79=@>Z#?WEI zZn!=>M;}VO!Y0LuO>P;JXuG#^0SRgAgXI4|vfc!o%e7tqFR3V`l1zoNq*5VCBO0s} zq9jEk5*pB)G@xjp#Hvs-R7w(>OUV#wrH~9whLos8A(Z%ip5DEW|K9uG@gB$9TC4ba zp8LLr^E%J-`q@^wM|sE)@RjRx3%b=*R+s)5u(w9vPNWx;U6Gkp`d_Q7Ev>C{U9M4d zZT@0JC(E`I-d7ZX$YOrqpRnvJYM(mtm0vy6JyjXMD0;8l{_JWwd3oOSfSG-}6$tha z6P4%e-G4)^zAypkoJ~kv=L_c=7=sTNBkx1fM2a0B8a6 zn(toE!E}R6YGhhDJt&ukQ;<5VUc7hDhaAa)2d#BDyi_4ci>3&Wk@6_2$xj9*1FaJj zIHXK7>EGa`kIv~yfFd-3(_&4TOgf?Pb`WXqIcy{7s)Uk$O2=zqB^iF9RW7&YPR{VG zaQ*wBppm|{VUo7?vg@wLe)L|{yjE4?zFAieacgUPlOqj;*3DPYjyQUBUzaBi;w50w z0BN)p$Rf%x@Q>J)Be{3U=)i33KtA)s82s?PIgApXBuoFae!ba+;$1#IY;`a+2{STv zSigS7^5vfz8h-1kssybCcx8f@H7NyP@yp@&8+Sm|W0=R()pVwV33dI+$jE*>B_y(; z4j~ycH4&IPOTfmjxqZCL3l=PkxC}&nMBai+xeO&*^;adW5`Z?y)9|aG-kq{4<-v;b%Zfv$JQ%S};?*)my8>w8s*`;PK#`=kqt; zu`V_G5*$1+z;XI;mZ)XPmu6+LJ1}DaW{w#(-++iUn)hg>5#P2F4o+=tq)TE!2?Iyw zE3Sd_le?VPtbzA2JUfLlU~PZd$Xh)S9n0Hv=fffSMhYU|GKOX;H3s-#4pB3ADQs8? zDGN}hx#|%Fav6!#6Q@4`@OqX=?&&8g0`+oH0vwjfoEw|j0(T1&N*iTXsPc3-B~IEu z>s!gvm6_AeF7Bt+Cv|VvfL{r&7y8I{{;eT{x4J&KBNAw67wexN*{O)Q1JF8W6$LFY z@QgmI`ec3>H_2h9rv4GeOvt1kIbWUdpi_rT@XHp0$R!K0E|Iam=6^FD$LFR{io6Bz zO+v@%jEZ(ABV-E=Zp!sPd!(v9J}N7_g*P}qd`u?=`T3ntH{& zmhQ6OskxzQ4-a~7*#gF)_u^$mMHgAj%3JHv1(E0VJ+|r49Z;*KSb$mo0%@4~S^M5- zslZ|%Yt(y7oSe?GhIvaM{nqq#=c)xkd|#(FZR4{Jy0Tw#kL+L7ySJ60x5t9O)jMZ2 z2LAf@&W{Hw;}0AxXnxk%Yv`BZAgU8L739CIl~t>pw6Yz_)4@3)#=**!@OIi|#zmO+ zsn3X5NCe$7HEL19K9`^78i*Qs z%9PB3=M{qEFJI1AI~u@7%!{iOz0>HSV7`CJPJHVM?}>3@i}#Em5f;Q-jS0U02CS3K z6nRv(RDgZ5d3`KB{Vs69XlHV-L~*R4;<$hRB%fwex=H@M)yX~TkF3413nJJnj=b6 zzB5i=_a;kN2n^wGMWsStiK)}3;pgN+{U^QRbxazh<@;T|o_H#?!Oem4G1I3VATUF- zpzd~{q@u785wPdJy#Z(xD19yaVg zTpuV#)mgp6Lc(|=pEgf*8gk9}ELtwfsg{|zXPB%p4t*at_pr+8q?==QfO#-I5y;%h z$;l?a!lx%(yVg8PuH+q7gCtn87~T_E<(zQoA}1y79&S~iru-wT*~WQKydR7%{V$WN zC=5Vn9IZu6gT#C&xpe^Onu_o_dhUKBB}A`&jH&T(U&9{V|CnV^^={BKW(536ti&I?&wMq0aAJXbPDIxgUwTWkQ)J-0$NjUa(E;O`c%b?c_n#9AY2^Oc?zf|I`i@RKGYhQiBNMj-t zr2}VOUP+6NmB^WD+qz<~xQ|rkt|oEU&y_>$m;aibq8Bc=a9$`j>yLSYf&1IcE&pLn zp;3=t_O;`If2kNRt?yk@zgd`lnkQkA3>Lre`1}&87s6LrhlN}Ky-1C|{n3Q?D?bXz zCFBw+ji961TI$%8(f%q)tzlBRWw?YcBSnJd=gm`@H;2VvyLnTuVk4sOai9_8&X6Nd zJLiY0amL@!_LS|>AE;6F^G8D(NM@p@VUo#UTce=dCau5Glyi=tbbL9@%`g23AC zb7H=J8sfRK?R}->9gThx#kOtRrX{D<^$CT(+nX^sj0iqHcH_4Zin|Ye^qZ$9GQ^ zWBAqmi$~!6_BW?(rA1Z49tVBAy=~aLb)AoQetej_Y`)W~Ri#%}z~lq&ei^fGl>`G9 zAVB`72((>b(EY|W>5z3IEI^^H}2Tc!3$$8`t9qAXN)ZHVVQ|rc=7di}`6Cyya(==i)9+6R6_#9gxE;e&XPvZ`*|5QYQ2l z^@H6~YVTrrhfXXz|{<@`oTcN@Mj_c%ttGvc|U0;c{_TetP$D(&|heFwC9&ybS}emj8%H)!^E zY>LrugoOcD3i7Hw-f%%jG{x z=&N^0vNg`n$jZ{Ph-}jKOe~oFS0YE^fSmR;ygv#hX`S9Qj9Y0bn;w%KGU}6yw(UDG zxG8#s$#WbJ5w+Zy8)tsO$xoh^Q{#{~yJl)$;mf}EqGBgypqJ9*D?@DTS4@KMvYyYQcHe6^dh|~{ylD;)#kf(xmaw%!zl@?hZr$AL-+WVB0*I6C ziiAC8>G^7+y=Uo-t?9n>px)HVEx)nq90(?zB^^bcU7zIHYJ(!2zWEQi!!q`=WaY&o zruSv$W*!PwIRGNq@$)AG7#7t?Wb?8JTQdE6-~L;ehAmrGQkn)d6EAsqqT8W>ty4U! zbblP^DOa*2s(bYaDM%hnA`f~#LA1v$9wlAcv;MGn#xtVbxJjZO#52L_-w)rX?wbC2*&zTFVc~Vz zbVIg@VNj^jsN1yXIBZJ~D;&LDF@2ec>C9Y<2 zsl>g;YFf-A2T>6tX$!GUM)Xr+i9e&oEJtxlIfzHuY6<84aE|hXr%L*z+N1VQZ13n` zHK_-M3cMwk_u2Gvmr>AE_$0H?N1jQG5BW!Vq z|21##--ZnZczy^Lm}r(LRUGBE0;5S}2b~OZr~#=9G;oW&0vqS8uqBg|S^BxvQ^o;U zHS*?}svqGj9kgW=bEUevy3TGBYAb$Kd2IM{69BS?83%a9sli8Z>4Jq|Vj}JuT`gx6 zHv6_p)TZUjmy>$5C7u)%>}jqI{+X68hxiITpXy!@?F`EG1ic-P!P5ADDI3sMSL zoKFk#E*IBBpBp-8kPe2MbxY|aFut+DuyOtBeu3Gs8lP4iz6EV)-aB*47qAP0l&#Me z)wO!Z3!4W?%TQfjy-d%T{9yRf+e9TnxR_jaRAJJ;@5RdaF*se?wqB_=KHXir!baYe zLy9066CRr<*pheUme3{U)v&|^DoBPQl6n9Yv?s}LHB}~?&fErxOUogH*TCtz=2c@{ zyCr(sw((fT09v`+J%=!C6~uZ7FyKd3BR11&&>b5etpD`s7114l#57#Xx8NfH4KhX_ z$n!U5q&Vy=?O4tjIe4)T^jXM755}&^Vgh)B>`By{nD9_r!s*&emR!#SP^*!Z294NgF+fs$CZ7)W4B@RX5G3aBv2e=+kMi# z0{gD^-mqbOvk6BFyB2Wh&)Sit@q98sLCk)r{%GTsXZu2mfzvuqE#F9+X$XCj`cxzR zu%xX9&b4OcwQ`e19(|;i!}Sf)wJQ^k{H1)bBf-Ifnn&?m;9dF&U@Q*+6zMsz0m5wM z!7~L?H*b*)meH??!UDF6sYoUNhVX;}amdD6ybV{g7pza8(kmu2nvWcm@PV_iW5*Py zlv_7%1{C-Bl*u@wwDbqJebB*&?34xNnLeFARFr@73BszUPvMRSM_AKUX&hRmu8zT3 zjnhA$&(Tx!+%0rYJvBEq4LW?-_RdD;+=5yUYcF^^)VHAD>`0u9RWam0UJE=X{ogTN zSq6H_oBPG4#zn^0Q@}FQ$^7TdZPA_%_DmQ&uj`$9+UNcdXVbnpve5+|cKLgLXSBEc z_;K^vwf^GbQ)omH3IxAZ@>H7q%pVm|zv8`K;&K9+AbiTQAAqIQQapC{u^OMX(G=)h z#jvMTX-c=oZ28@PWO;E`W4`MArcvR3LJ73~QpjI#+sCJT?E7{w%wl>)hJ44551}GH z=5jjOTvIlCL8g`_3MCB<*Q|ZwLA&oVhXkT<_)(2TU4FgR7Lg&lPtGcwqm;4q#_N6B zdr!4opE_;0o!j$G8RenSB<$?+>+~7yLWaRvOIQ6suNvckmEma__0L+TYyQC;xGIz7 zBnTVTjXvDw zt3*%7;b<(rPylP9s!%WpCvEA3{-$n4IpAJ#uY+NdgRt@htn~Qf&4M^q*sr2;05BfX z!b`QjfvHJXX_$2UN}lZ)5LTCVW<_!t>Ek!dd0n%DaP91Kvl*%_lF8Bh$pUl=kBUi) zasT&7@4!)1PFYR@fLGw1FjPoM)_W#;(9wpJ1OW&@E;IH!kj&JmXYCpK5M>!X(IFZ3 z`2g;ml{Kqoqyvjs7zfc1=yTzQA4RaH3H)z=}F@#fq#RGL*J!pz0--vq0IdTk<{tA6%yW@%1WW$Sf^*3 zV8wDDZ>}kBSx)l>&J-zwr7rkwNx6;WJL`gn48Elf8{a|$a@^^=g@xYq)(nGWe(ikM z#W=||^2}t9;WhPNSm!7$R(d62!>J+v%>`I74JM>gp1;38XgzU>-r|l!rU=g6Bw4}S ziMI)sL|}&y$A(#BSV;5KJ|Tgf(oeJL41`fivjv!JL4~AahV`>SX*MH?bsioMn2JNn z!AnI(Mon7GQ>l_|oIE=UI1GeCQOVfYxVpLBfwB(VPbmxAU_IXmz0BpP!7+N6gA!I_ z#E6r&OO`Nf=6wS`>#p<_HiDv-l^wTyx_65Pg`|=a0Yu&W^dr}k5PfI|OhTRA-N($e ztO|QgR;RL+AG*ZO4jZgqCU0=)`BvLN@E3-03>1xzC{c6K$Iw%z;^0@)P)Kh;Ox&O) zM|!!jynz#+j7Y*XVpZJu(Ha_p3-RaH8-23?y^+WcK)%3tsMg;NK1n$ZjYZ-00#+VZ z%ff0tIsZHdYNC0#t5knkO;%Gy;)+RM0Ku3Se2Q<0(8VSBqIDww2w{e4$h^>fn`lZdY*w+Mrde`XGz+ZrzR~xw(Q%5J+QY|>>xFNL z7ry_GY!3MPqPX6NbAECJ^SdWZR5f{?nd!(Y1#)R_YaB=((?eX%`J6bGBiF z1}$2)?7!GgBz)c@v;|5JVWB(i(ug@c+9~MqC2LRi&-~GubP!i!d#d7 zt#VgeR9f0E@)Pmvd2uln!?T)ikoAeDTXEUuxFbL`fX=L{YJ}g4%pp7=$1S^hj))He zFD4~59IHOop)gCNc9j@A)+M%%qU_zf@6p|zqv(^knS7D`7y4LAd^-r5&4{6$Xu|dT zT2nJvK_T+Q3H4+11nsIyZ&@WP)B+5%ejQu1Nsya_7DCy&2M|Om2G14X{NAOMvVcCz zG_4tM{+C@r?Niv2r~)}ZFcc;rFCX-n_rzOUz^1>y3$LzTF#Kp6?URry2m=f@c_{Z7 zS3_wNq|x}$zU&2sr97smEj(G7eq8-3*Y@}&4zO%^F%?BcmPywBqeXOMv6EdTgIaYh z3<@s%FDid9!>uR`F@y>WoBb(z8wSp-6UzD648!wXZLO?=f;V^~lYxNY23NU&U~ZS` zq9D=nyk*5i9mJe%Zn&4gmJ$5b@kyufqox#Y-OKP({{PuaET~_2`2RIoznPlq8znH- ziHFby)V0YpI6lb*&(y zs{=Qzj~>M<+mt8b978 z)dq4GM*s|hcW`h~g7f!ZA!-0^Pa-1~4#hE2po)gE12GG#H5y_Xas~$iH$3zFg$vZb znh>8=RVfo^Ysf&#rC}kD@$>o`##m@%WoJ`H4MRh2lAKuN$~S=mda20uKO*PT%3td0 zaFQ@mf;L1H1Qgd{jUtER_HCQwGMsU_N)-7VAjWTKdr3@;q>5b8!Chb8z_DQTZJh`` z8Q@yiO!zQR7-3>gp1d^Hf*{Lh2iNh>>@iB2Qfa8HEU>MS2V1}q`Xa>S2dP@o4Hks2 z=Yb_#H*dxk1Y_Fq6DE|o>T*A8U1P{2WCmJ#n{tvBQGsfOZ+ft`S9S{5rcjr`$pn{f zHmRxXnPYEn52i~Si)IMUEY>IdT`s`7_3OLkx8x$YVrw-s&bI^=0t2yN1q+zrkqP4) zyKv|Xq&;2`-z%H1u6vo$EUN&?g^gHFP2*TB@L*=v^^{7Rg~_rVSDS zacvJE0kjj&)WmdEU9;H^dyu{oUnvlH0ZV>uK8oiAbs6NGB9> zfRNh>4mAI~j*3c^pdK8a1Cw-zpb6^i#D_lJwP*xtGl3dUPu)4&vqyQNp+aPC)S{&Z zFumyG60rxqejU0wLs49M7}~GVQ-s0K-5WptD>0V-j^TP0gYKY{=O75Net0J}4{r7xv}L z4ju>$;!4QkV8F-VEOGxRF!Yt40lF}JXuGm~&tOOhCZYK_ z_)1FN-_aazHRdul2ni4C9|KKqw+Vs#k2{>p_cR6$I1-b+;;XJp3pSYiWzQl&+EX zcQ$@tL>Ii?N-X2=}zjt&3 z&-&*n7pCvp8D&0{9#%oYef@e#Z`qoS%+BOwWhv@ak1v9T#?}T3f1}g0?j9wDpdF>K zgt7%|U3gcmkCfr3Gi9`t>Aef04;3Q|OkwEZxh~XIWUg`Jp62Gp19a`_?y4Pi7UKqn zWlS`LwH`dYQ`1{+^D{u^dHZ$-uNS|K5hMIm4p4r|wJA$vb3~>nNnN&~xF&Xk8EMgL zO9hUUJxq@@Il>fEh*s}iz!%U7u;>G8lXpXGSx!Vtwdo`U(0I~bqHv?VbE3kF(eVAw zV4fD35cuFhHxHaEeJL@~(T>o)NJGYY$r8Z=DDEOD4^scYk;YtT)`~M;LpwMTtatn^ z@;M96@zH^Vu-;;$?k4O}@V!QFa`ea%fSw=ZOEALwc+%Dklr+(U14wVouX&+@(v$Iw zqbsE)2n0l6@+rzr))-I{A5k-T^hwxFhu>IQzGAdkWx)RomP@*`U5cQc^ z`TF%Q?j2c|26h-5@n}T(HXJ54=VV;&B;Ha8VQRqKw$=ML4~FUO-^$9-eb&z<{$q7u zHKv4$-XLHP)(x18qZT3mGa*g*<8)j@pa_r}*6&&YJ_jrxVi#Riie-eUHK)tU%Gt@O z7@7f#_2#YqE9^1n7ktas&W=V8LB~hRpjo;0KqBaDfd2kcSEuw>S5xB|A|)kYZ=;UF)Q<9;(Lxy0{Cf=XNjip7S3kHaZY1v!t+_9rbcNd@Vz)4(09=K-IqTl{y8@MWYnc=@R8?{4 zf3a+aUko!z=00t2w@GdZ@~a7tl_qObmiukmKdWjF)M~?yis*hTrzGK*t>-1)j*~uk6}OmQ{)gY zYYEhYOeZ80zvv%Avi;Od0DNA&utEUCn}At>ui8P*w2kJ%g#}bFvmS>GJUuWCjvseQ zRTXJ}M#2SV1r!X_2gD~P_tR?Xd%1Zz9Pu?-p&s@d#U+COxC*@uZ`#Rvlm?!H;lpbd zoqE3E2KSiO<8}_tDUOasyjR+Dh2)JCM-jy%Je9V2c|nF6JJOYZ{iCjEq*%qig%nk6 z^K#sChHa6Z?Org6y1Xp>Xird&JUzJe*^?)%-V%#0pdX{2WB;p_r)P?FqNJD@08u*U z{(VXTgz(OG?H1if%lfN4~13xAb+y+8=^_O`~XS*P&SHDmsIWx9LdxK+8_<)RF zhfU7EBnIfuvP>>xIWpLpoK*Tg30Jz;UPt93<9R?*yVt0hJd2o!Q5m%3gLyS>Hen3nNXQXJxGd_XeBLO?P2hi#HFuyZ27If*0N49K=Go zKSu%-5s9#Yf!vW~fB)4(PbBH-;Fsu;*m67JH~$r;)YNO<2aXe9~0JmQ$P8{F{15CO1e5O=9oP)k$_S%^;*TO`K1G<{~9v=Ow}@l zC~5ezBzA^L@l$_YHP4ve_nB94`?kpV*rKX+SKI6d*v~T?UduKkrsI*Jp*YKVh23Ad zICGu^tdQdRPXz}szc5e>L&00}xpkdhnt3&i6qW-Tw-uMBclgYk+Vsr zkF-u?kf;9u4{f zVNS>pSy^vb+b`F7<}r>hF&N2t+STymVX)MU7`NrI7B8-tMipa`aK}1v3o`uQ$7jW| zxEW&^${N%zH-10CSg;}8^4EA>GaMicb05AsdUjC)PoL8*=GWBHqPxs_?D2o`PSTf5 zp}cEdcga!7sN&Yt3AA#QFuG>YI_^F@f6qSoXmId(w^uB9u=2fu*-Vc;1$0r}pPPT~ znZ}=amEt&?(<;)d7hUvkadjCC?EuX6k6>zmxSSH?#`@Q&wX!8!r(^1SV4EFsvpT^aL7qEUo$HEWrq4^^CHiEOK`<^IE+^OS zQP$hH-6KxBpQiCsbchT^h3ao!Qa^X~iT!)79M_aVy2~{`lmB>I?LWQJKg4AG+-{yE zIMBAQjEjlsk)5)zw6=p8I8(P!HCrr7pi1mXoBCh2yJ8O?EOe5wk-(etY>}bQ#@X3z z;nG=fQ;hjp3gsU8;sH;SuP|)Zf&b46_|I4WNBi@OgWGz#JxMh_Z#yx4xQ^}QtR3tj z&{`IfVm!>~|NilZ9bjRn0KI_7(6c&$_Vm%T;#0A=-a1sg+}zx@HqU`y5t`=nCH8H(tauabdA2brOe>K_KNFv`K$GhU}h%f zMB)BFKSiglVf^Uku%u$$_36c>fn!o;Dp|||!Pt{F;(z`zUSV#t>fgOf2OPTh-|oNv z^@V(%cm5h~v$x}$e~%+IjZaSq@B4rJ)pq5o#g-1*-WU4}o6}x&$^ZZSS1Uu+egET6 z^Is1vR5UkL_}nPgl?NgAU35p9kji+-Fd~%L5)O z9lgq>`k&vh)1%o$BW32pVu_sTBmU2SafGqh);gChIDGHx$oQwIQ1cLKZ5bTd%rE$_Z1KMTZL3tCSIy(Pkqs>s zw!ud?4<*5*<%EBnJ9>1tcI3IIPvu2|71e_;J`Svm>$=o6alrQh4$l%NH$T;jn*?P2 z=n=(LYv1{bp=#oOM9btd|8>4A42wl8CO;w6iHq>&9=n;}5$MmJUezW}n(*FYj90 zS+3S>{yW^@u}JX6g^O?G?iuzTBr2%8E3jdVt{G#D`}Q;xj3EWm!XfJ6O3CJNb1g-U zcpj1Q%QR&dIs8r*+1T8xH>PYVvZqp33C7X`mGVr4$@Q4yhq9}6>y(jvL+jx3Gg%ar zS|6VcqY`8!9y0C^)0^QOt3KA3-gDk3~a2c*~y^g{T3@fSey)MdQ% zkCeT5(Ftt?jFQPWAba}Gwhdr5j>{e!hMu!dOiDL)B9?eVq{i%9MX>*GHk!(Ng zD6YNyGWEeQqdX!A=pO8A|V)r}hf#c~TWzugI_2}3e#Q;9~P~mYbHqgNFk(0x^$ingwF_n|JlXQ#LRRW z!^^jSdTNg7}Kfix&A!7;)sY#1y zF7Y$at-c>K3Fs~viLjCq6moc~NRn2+u{AWzZ27xb_vDkLzxyC*^mbM;lE%$a%_OYC z#qRYF>jtlHb#;nc8%HP$UjU;hZ03h=-st4lPuXrSK%IshO| zBDP(`W*Arz|Ldmh_h|7@I-L_gf8w#qr0Qtp{x^oE**JYzcy=tTAxwc;ZD|i{k*#o` zBD8ChAAQ1z6I>3-KP%W46kmshjUTGuwRoXNTQFmIBuW^JNhs>&S5`hSDiBjR1i0+C zR4l;J!Bx1P@{{mq!&sgj^?WE0O+Gd&#++)FhsIq51Oijt_PKODon7w8BPwF$-jI9& zalsQVYu?y~2VPp4me(Q~E_QwSdPm1tq7wgYgSO#jP7;QnM*a_)byN&J4l|2Y|sR(uz?`y7uo40EM`VOG4X&y8fLU^ z^)@e3ahL9dbWJt zH*`@DR)CsJgYJoQl1hsi7=HNHjK~onE^ZAIk(f& z6rUL46As6y=1hEvI}i91>eH^*lh;)EnpAUgh%&&H&+9i+*`8+L(b0G$PQ#)Dvy<=J z??F#*!M)l|vM>hYi^}^u0TV^DQ%EwVr}WG;WU`7&?woPFxMpF?!KUQVDJn;Y6pyY< zjB~oOCVoloiJUr-{KwI&;WAR6K(3G1ppz18P9>MfW{v5FE&!OKB=wPrY}Y)g(`I5O zp*+{hNpmB`@5Nw@PENuYHz0jjdjwKXXOEg5#EHWKDH*Na- z{CxlDg1&BIi>8srw%!1}R&e~;HLptlO4(;HvCxnZEXe3J+SxMqtG!)r+xAd3Ch6df zfUDUx-_WjN%;3?y>w(cq`C-G>+cC=%s3a$*k&JaC0pN(|C;s{8`ns3GvN)gyk2+Za z;^*N_nX(LDB1S`~oq=1B$b7&gAZKB{FAASpUT~BjWZ#Wg{hFE__hH0 zF-5MhN`Im0iYWhQUMMy|QsUx_3Ae%`oV?*QI83*v(!)H$4a7jDshc06Wgs5JzWNKt z^66)ozglRtG&NyGpsgp1i3QrCSu5{v`Fz4^OwyX1W>sx7^lwZ605|w#4DHC7F8ZcUaVFNdgtdY)x)J$M{Yy#k6 za^`)1xWo#Ix5N^^wF@mQLZYKr&JI-j(Q`fZ!dF@s_BYI4-QvBAtql;wxxflP9|d0& z|5ArHdPrpCRD|b1%PXOj!$bnUJFVsD7tvrC`kt88b$ra10^~cK|78C{ikwROw2>bdnH!mUjWR4kF3Q5 z=fF00(uN0;*K)y+$_KydPUllRW1B(+&QjQAROrn@k zZ6&B1L`)KHa#{2C=?omm9$@ZU8Y_O^|E`qhbz?aU$a9R(V7;_py3EgqRvd4LXlxpQbMVeLCKa`Ch0Rj$4QuI0g_8*ah?mEeT@=y7>*? zuB6>tt2OH|7ns+w0d9!Pk#E})22@OY|M_T(cGtEr3O;o)rVE#tfX#|cAu#*Qj7CGX z_;nx0+Ivo&D(Xo_q3?zHAV?Z)B%W&NM1$wL;|3iB4}e1Kjk9F1@#5Eu1MXan9Y9hC z)P_U!ope4m(WqEAx&Ut{?i&Rrb2f73<1`JkVyY8X$!_0H>k@0>`h2dq-^D9e7${?; z{E68~MM*EWNHkq+hFky&So!+*r~1HF-O(nY^sH)wFyrLxF|By#v{}n$WBJRMa9d%( zvhUb2XX%KOXCwR`~4o4eT@%7 zv1K&wttqEGz)uA(KHHX&v~!ds`(y*50GBYQ?RBM$BKYG+j8b*(j)}ho+ZhX_g+_jR z4>n$i-p%CZ1dg@TKYUtL$O6#B>CgTdo`d4BckjM^{Tof7I1!3Ias@pqrZ*3`=;sFeav$ z(kFNV4%s;6c`cNgOG_Y+g=OncN@ViLvJ1rwp*Z2Cqi@7`B$l}UfithYRPVo7>uIKQ z-`PitMD~u@`{V;5HhX3S#;8-KaH3yLUiGir>C%el&qFb)T#j2r?y6KMo9izx9A&~f zd0iX~(i+oGP2aJR=Lr*xVy%);7v}Y_T~*KOTffDhaDIVsN9Rc4Q;FsT^-`)0J3Amr zg@5Qf{cLLX*@Jtq%4b8u`9+R$eG+d4SO>({Gnir_!D$Fz*4FUT5s&~(0_n+SYc+Ky zUr@-6?Wt>qqV439Ne>hpK51xb+NG|_p#6D))3p)k}yP z$pxO4lL#PZGWXzFLK^sXf7_0e*~2s+GEW7hHTyDy4eEJ$m6+>7O63d1x-CCjbb7|l zt(3bki5rK>^zqLuD=Vw4G{DRqKR*i2IJdjZxN(i(`ZI-e_zFtc(%j6Ts!lwjS@>xlJW}n;AZ4Aa}VrM zcmoeO{fw|P4ap zly!+LD5+$S6u&{lcW=jA2Q7;A_mo)%yMAsa(th$8mfuL-5t>Wgv0tV~j zr(&ad0@_eSgTqW+GuC1c6wUmwQ8nfUCt2M|^nDMpMRGy8wh~%l6hY~6aUzLpcNW~% z(n{ZMp>Q}y#MjAZsNDCE?uYO1XFq2VRQ8EOh}aZ2);)I^4X+1ry^7fRMQ&PhI7Svj zMI^oWIrrM>k5hWorN1;%27VnS zBFTq?io1ZoIlbEG6nDz#kWN;n&5x`@$2y8_Onpa&QxDCG-M(~^s7OzCj_#j!IL962 z!awqfl7ou0XwNQDI3^sMbECB+phgTnoMW?MhV-wr!7L;{Gi6h*T94q4uz0ugiymw0 z=_*JDW@mOMd#JZhF4C2p@a%SA#>^ZR!up7T*PMJZgb~RnhhW={d!Oe2nJ=*E4mv2Y zZ{XJQ%HoxjJ@{de?fU3=lKSxthyW+PH|LN*?&4(#Zf#If@l&j8{mJQvyOL4c|EH&w z)jwGL6LKJkEl*R3*-edxd#iHL;>dU`%{#8XI=zF{OPq=``d(S^pXs1t3NI*zo;#}c zn8_D>2h7>(4^K$f7&8XfKcS1lcQa434_qo(Av_|EzoX#_tZzq*7{My{>=b4{@OAJ^ zqjrWh!Kj(79{*-#jhHzzoqslx%IfaNTt-AS>td?H&j;!cUUc=VnEHMrl9R^el`j^* z*vUv?-16%r-dw)jhmBKy?D4--RTRFkY9S(`viO(`*1G`3+ls$Q)#xi(Qzi`b* zL1pg>&poWXBUfzV>jm)?vXK>l8Y152t z3DKC3QK-S?%#3SdG67EqA`%x`#O=Iw;vZjuzLk=Cr*^TbOexQ(HgeC|qlae2>N8^i zet||_iprPnfy>ypZ(q^}sl;#wV#96YPp07p%_N`N4H^iPIZB2y3}KyT`j@TvRd0An z6K)y3dDDdd=mUa|v1a=x(Rbyp){+4Roft*7Gt`75jRSd!e8|d=E5!VIIR4HaU_iS} zlz?g8Ocg^Nz&`NM$MJ2*il7qCiY+W}d#EJl2e}5nrI@Iw6%^t2*m7-nOT~g;O0U=A zHlbe;Cb8szNh}H%hL{4KA7X<1;C?2d7@+`-q2Q3`n2;z1j~2Q!KFV&Y;s;U!uDQ?r zbzyykn#p~84>vc0hT|#6tIne0nBiBn`r+D*Q7*Mvb2G%2`w-rX&i38ssvQ~_40LF37m?bMu!KZ^qq^k0jva~$*Z4%50Rk3%JLai@?<1SLC6O(7D*fbo! zmFa-NPv71eoo;rK_Q@1u6K!66I_4rX_d{(h4IL!ke+ho?k7v3FTt(UjN(|DkP8YZk zNyJf34;7ZpZ15pLrh*yaX-EM(U(Zi2gKS7?@&nd-1YH0yGiVW~2(#Zoii*>~v?xm% z!zxMy2pkor@~l>Y0K2EVi<7@ZLx$!$@Jbi31U25>v^1=}AMwFq)Gxa#n)i(wIHIG} zVJ)s;2|x>Mw}~?U$hCmP^7g?VhRj+66crT43_6(J{;t2D3gpRArr{|R`c#A0-Anq( zj$>T#>fW=?WqWx9Tx@2qGqpEt+J0fB&$k?i3~-qMP8>Qbm=OYIyST&~sx*E322l+y z6^6@lkYs>af}g}{;6AA+V_J2`#eABsn2kJqAa*?zhKIv|(zIqp4mp}c$)ug&gqts= zI$aDZdd=gInb4Cxc7`Xh=qp~l2_h%9C*{tp- z6O0BZC`d4koI9H%2|^=h@@Q2mauzI4#>yU!4aMOKCn=m}M;zO0NX$joMRy|fV=u3M z;Q#P>A@cHc^XdYse)Fwa-cjVr=WUSpjjw0lIvIuvVUT1&!;hGX6@BAVRJKio*k=D9@EN7L;`RA10EPY%o^8p@eXgNSI z8^Y*&7!L2B)pMrc;ooP7|MDcvx9_pAP)wBL#gjNh#RTg%#QspcTe&E7A4czZ=1ROs z$Uk!+XB8CWjF!9)8x0n%W57Yo=Yq=xu(hYgw?_k;)Yx-$?hEc`x@K&?Q}-Tf*AAW0 z;R&)Qlp0!cp)zydqWKs*mMI}fE%D~qJYB$wloSj(MdU;6$bb5uhFB$E0S5~ zGjyeoPH2oj6i z>zm`+SEb#(izG)!RW%l)+MDK6qrOrH0!T#aif3!ZTIfR;11JKyWjn{2gmLXMWfOY! z7U?;%m*U;}osIV(*4T|VK*>nGNRz^BBlf%G-Tljxu&%S`MyejTO2GwdQm6unLym3E zT5<>yrco-uj$|ezd-wwiYhpB?FJ2lN5n|F0e||x%kqWHgyAl}HmuUv^K~E#7lHLlq z4ABt8Yk%p*3pcRkA9Eb|0$k?F2M|PtZuqVGXNK@|Ioc5Z=xrSWtvP!(Hews)&+YZ9 zju|3y*a8k9B?t;i(noM`_tdEIGiD4c9kHc0*MGZi?J|8Ob0qZ3Sv|&fun?GS>@_&^ zoVo&Jj6*D3&JdSZPoJ8pNV7UaGFwaU)LVidr4>|?y2sx4D+&q<%F2e?_cRHG-o{Q) zBJjfto9!pDKezruG?ffLJi}BTA)_rtd3o`$zIN9Tol?FKj*%wOP_V&)j@BqyZ~P&Z z0|@sZ&wu@Tq~v+D`wc;?{u9Yzv{vY_(y83uGb}73a+qKE_2pUtj-RJPLeL8Y?Q%4< zz{cvDjV9mE=0?U+x}Jgp55!oQW$>rjH6mzj1`L4RrhTQ4jU^HKI?WgfX!7QSzoqA3 zMhO=h9TxoaKN}3H(XXLSr7!Mln@6Dp6&ENvZ(X67I~+PWckV1N1gnfs7NL~N*)9sfnlb7>7MINIqGIs4`Q)9|s?O7=HFauZjeLBz82-&S>f^ZoT{F^`tW1y4ccFi$ztyId&Ro<36=!% z*-OeUFLT=6+o4*_*Su#4M(oR}jMlsGmU$Y>9=GbF* zP@f|;(Yt=gU%qP+$~t2DWHw}k8LBv3p?2-r?Haxk!~)0(%5RXOX!@m(@oX0Wq2;83 zhp*JZNO9MfU5Waps4FMIedRd%%Q8XOv}Fr^lB`*(Af`tstx3_{ z|KYCyN80_>otlx-g(30h&KZs*Z7NQi?zhFA5Ke@_lYW&^r1n25sM?cl*ot^DF*;ylIy zcFAQ>ah6(JkH=7pYAz)5?+e9(f=e$Sz(7bi>wk;PwPc%PHh8P2lCTEX`N;;?u=KSR zJ>Qn%7l}qpSlhgF=P$%MVmY4*WBpH_9BL%ZUzyE1G4d5INJ6qX2Vp?)8Rj1xBo7@u z8a;8%5$p}NY=M3#NX+`}4;pk@?J>wLPJ~RYgaCqeG9|?mdN{?w+w@&&Y+tq;&rh(U zE-yw)q8MwKshjn8d{>Ju z2t0x8%Ln@I$tSxAOB7TnS)}&Y=ywswpm6(%ynw_Gn^`D2uU_4_WeYUj+sBWW(B+Hy z9XN8N3q~?LU!YmC0*g_EnE?^M3zsm{OM@k{cXxHH@l#QGvlBVwjS`4G1*9G|4imkoFJo*^ANtpEO5;gLY5jtf@% zjI343*#=faS(Nc_9c2+C6AR;09V(4c+cFjtu3P}OKv5YR0iM%l)G9v~`M2L4J7JMq zO0%OJ7Xqh@5PVBqj*I0^jF)VDn?^xqWZTcRTY2ZlVMB9Des@Q_?Dr%~WP!&b8OwF9 zGQHDQ&6PZ%p>Wp7Y@K$|oZv`@FDsl5Dr63~v`mdVpdq%^$Y|i`F`D<=8m2Y>s_6_b zo4&xyC}?IuTY7iXjq%qe3fk!pZwjXTecrFkLYN=9%e`>ck*~1OdRGv9LN29l%2SFT z^ikxXv4aj8&WigbIayy@q}asFEZAxcD|}S$#y$uPj#t0;I5K=)z1X@kyL;OQDoiGG zGTlqObcyT(poMagt>CEeIB=rP570(rR7hE0I6ZyWPu+4mHs)e3!<3xXEMrX1Z&E6y z3Tz4f^<%w{PbWoUbwk5bmupaKV7DO|JW|8t44f9BSHO}sa2Bu_UOv6D;b{r~8Aj6F zeEhDJCb~$JFQ%C#K++czlz^gu$j%={HF4p>r~pSsMCiq!?i73!<`4X#!l5>{w$KMe zWdx5~e&G+BvnumuHW&|YZ{n(lVs$d}LM7ORI8TjO9;4o)aRDBdcl8u{<$a?*pxl-F z;V`i4>)UDVY}pt+cI+uFN0I42>1Mfq8}(V{`5<>Xvf>{ok?>aUxyiOCkz2QJ~+2|b&aQ%v5qEqL;T z)3NG`XiUKrAd|$zwTup^h)>x%K^sAu1g*H16;oLjk^lTNM_^^f!0V-jO}PRghTlT7 z!2C15$C>};0t~XxWs)as_xY8z=pOeA+K_a3FZqFJmfB{6!kph zn>bm{EF$hA`GRs4_c-4D36r001^UZ9CHMHf9D_b>cMwO%e*ACAmYsYpX$Jsm3G3Fo z6J9|so2Qo5wb+q$J+AB52iM$AN@@_GFvBd`Dbkr>s6|KQ@V&;|hhAHes-x~|emn&2+|PCj`{$pc7@ z+#BWyO*kR&qcCWd*O`;I)-oujO4JC$_(@FB*+01KnX75)?D_Nm1v01Ta$V>-EYnM= zv&OLPC+Gr$ZTA&($Dd@1#MB94x!~|m%L@l()s+LA@62a?{G1>ZQ9K#Y`<9ieTX)Wz z_Xxpmgi&36<-Z>`V$}5FZIwO>a}_t2O=bm>y9XRqbXG9svXY04dN;G48sVf(NcKur zKFzV#(bjgmGFq}C0XhcR8W>KgLi%xIxA zW48x|hR%!@4mv=IJSD((%|vJ@g8(CGe`B z$YDJtynVUqC=FZw!=S;u6z@h}_M?LbniFJzJ9q5@hw=g9ym(OqGa58>)c#mtmOOmu%xsmQ$f#QS;2hpG4pW)5 zdPI`C!s#hRuUif@5tMrM>a{(|VPMhaNRL%-RK-vQO*1gqgG~dLkiI{sK!5?As4`kC zg9>$}q@0!tFAyIG>Iv!13(pqqeK>sGJ5FGh*K{o{>4&QYLOJ`_8|GNE>XuLWXzaVj zMh{n4q9`I+VH^U)$5uPc=4iuqqnN5%1jiL9{zO#Nedou6mOq=wbEHPZ+=n8r0aKB_ zbEliWh`7=7xthj~O?f|EmW*CukU#vO+G7arj3Ci2uyN@;#R`0Mk=`d#Q?=K(m%8eL zGXjH6Tj!~hHu}c$-$Wf6HA1=vmzX+OTudwk70Ss89%WbF3MP@!(E}9jvi?>wJB7?c zp-pguO8Dh%+GI7g_khBzs)&7JvapZq8kyQ)*w-B+u?myif{AqKeOY8tPNQE-WU!G(>fBs!!7eBY_(OIv4Uz}-i zukFY*xd6PG#P?@`W>aep5>-9#%Zzd$ZYU{?CnQI0_3>>hGT~@FjIWx_g`8bRUy{&|*#;4*#R) zeVJ)DytlPsO3JKLixaG>49&;N8T2VU&eAuu3u4zWRiwFR%LgkRPw{z;uCc^KaW$d@JnOigfbi8W)#7+O;I~D@Crzun8uAx>;v5Pv8=pHu)zC zw7|HFz_pYt%N8y~!Cy}(f_X$-X8cFY!|@C`e@a{LAL^lMb4Lt()89y%k6?~_JVyY` z7>^ew>G(@h%5uu}7&yxwJ{}$2P3Yyb@Fh0hc|#m0Yye)k^erm?Y-afnr7utwaira+ zi)t0Ho9GFt5}hO>Nxl^9H6s^c)Cb4$4-mI{-00Cq^DuNYh1QGJ^3lBJ)>dXzuy|>5 zxb~ud57GLFgYdxY6gZANl%G>$$mu7cx49L&V6jgYpitz`^Q0h!2@Xm9_S5>`-tyU+ zR()}@aTAoMA4@V!^!u1x&o12Y1``E0YqXL~|qzLjx*wadL3N}8Qupk@%c)=C} z@hGQ9>v#}RL)cwK!4_$uFuBiVZTCOR?i@q=4qhpH_`KDa`c-?Yk575ycL3v5Bh7`> zcWmC%^zEhMhONZYkI9X{->8U}*l_t5@T(Cx(@W1pv1i6Fue>w02EGyd9T^bN2P?Ezn|o_dU!X;_!QfcBa>xKh_g` z`&JeOcD$B-bGdYl>uH7HfGH!gYx^}6?<;xgofjl8a9z=T{EXjx=eqG(uWj25aC9mC zH!MyAH5qUL1)t|fXN6?i*@)CBtXPF%k)FPrQm4edl~;}xV{->B&Q26vgaF3V9TlO4 zxoPS_bFhxi7r(_)Hv~{$htKYGx?|VHAS&ZU9DOineRoOv9W7L|;DOXYFJHaV+ji?sMMXtU&Ifu=SOF>8S6a(JfjD}EY23%T-O>79?=T6W z{3*Ua?Jtw(%qAE)PMlbrnHkGhY4I?szCoYL<|yt`=CIUHit9)WDVj?!fnu=7g*vxMg$PO-rU6so{~%WRgz-z`B-8t4}-! zwi6SjwF@xXLEDRq!y2qdem`;B)h?&&H3UNfki>{u983&VAmsLyXcMHfaTtNYAH;e^ zAT%%@YS|I4Gahj>v*cB&eC1D#jRTe#Ej)CEg;QZO?$}914LJE^82ecSP6N1L z78t(r2>*}?;R>^UfbrSf-l-fdi9h>iH{d~(WW6w4 ztLKjZTf6911E6$26~QeFj(Obx8cD{2VguDQ4zVJ6;yOjhEN`DYIc&WvOK0Cx7uN0o zJ89b8mcF{EN?*{g((SWHa=;NL76*cY;3U@3zQ%S!VPMr#i1;XG#^eC$O#$|~ROE6B z3Oc%p&tw)!9cU&GldEyK5jn70ghsH4`B5d-GGf*ZIl?u<-kp zNRpY|_7R0|eFvCPqtSZ&KeFCDoXfp!`%WZ6RFY(>Bxy2}N~lDsC`m#{5|ts%WGa<1 z#402SO_HK$RFO(nL>Zb#4Tc6SRGPe>b6wm0JkNc-{c&yUYAyVn=XW@c{n!V%Pblmk zPDUD`u`IG4RPS_&GbH%6tYv1ez~XXZ?w`|w?Bqu%>=FtR)R6^FliO`D`ezVEMpg&d8R;v%!b4IA7Q*Re9e@E-%ihw?x)1*(n!LayF6yYL(lBZ9n%TAUli~}4qME<6VzJxX8{nmQitP$90!sn@xOtGOVM`!{y&VPfC*c1ItAe14S?V>(z8rt zTKhHa_>d-^u)t^_VnA`kRRJ) zIl&9|ym$I$K6m2&{WHJqFo6tja_T8kGi zPME!7^7w=>WNd6SuE(HruhU$R>WOZ9OJv#gQ zS!Lx1A@k`H(jGVsoI#>}!<}n4F*HCf4<8rVN5)Ohk1wuGF)#>bP!3<|-s1$1vyZr4 z7~?}5I{;wixa^;<5F$2kbV0Tulp7aP&E=+Hjsk84)3#T(#F$qvrxT9o43+B2)gw!D zTCV;YH)>SGD3#DgxQo=1&%5~a%Qt=YRMhOh)4f!5e;0?PM9Rzzg_DX*9Xn1+Wezuq zlO19t-5^ROn@1CPEkk!7DMDQ#0sEu3pK{El)x>IvcUHNX*(MY0<`KFV))%RZFzVu& zb<+2^JFJR`&6d=P(K9sMmNWGC5tnhWC!N2fjEWIb=mGRI6`j^7i0bs(UbXSvw?kHk zTaH|~uJ}Yed|nQ&E$GL9-+PZ#-(669e3#m|xJJFy511xMNJxP7`ktKY?Ka5l!4fI^ z-BvHhV{lBUwH;a4Z3^1BrkuyW|8A5s0$I6RA#TfrR&Zw&Xc zeB1kvj|2n-^&B+EE`)vZlkx?$q*s`Nij?$^zd&a|`Zug^$~CY2heMfu{pO7u<}0_e zk!YA>6?MsTx!Pl3v9(5IlUO)K$%zxNr)!@r$~LQX9eru1ZD&kK=yPv^7+!}-?GnU^ohw*50Z=aIONmT-i|>G zF@Cu@IUaF!ge35j85dKcQn{hOk*SUD^)2qfP5*5Y(y^<2jbv0>{#v=E`1-el8`&a^ z$vFFaNXc(6(=|3$)A!zuWwqn6;P7veUE>G*n0@~Ic{Ro}t3-yjW(}tN<~SGY)k|eU z(AEZt`QyviuV$1VQR!v2u~gW zzP5G^ygWI7)!ZS8H#`FwkGKv&xD9ScqCxs!ug1C05c^@yQG{LR;iE@|WZE77U@5@T zIlOIFhb+fAg|d)csJi|*RH-gP>Uq{q(q;QF9bkPkI8Vrj{l&G|$SLb=WrH^c)hPoQ zJOlue^CT6$9JcNlVSqw{kpu`0-4i_d;5BQOnhmqxyZ&#e~<%cq%JN^&DW-@9*Db_S$=)7_0vh57YgA@Wh~NGPnBY zWkmh1Cn;jzc3~z&GHIqALD-a-b}tSfo%m$p{zs;u|DlWKr-#b-Y5u+OM@+|phbxVC zw2g|v{w(;Xrp*}+j+>smE(r90UF{Qs5=dR)rqX`5+VvxoDoX6fkvlm`>X_C{ROxkf z;d@=jC_u!Z`VrL=)UI}SmMV&G*~Q4lxm4xl96-zGBtBd)SaqDZymf&OPRu*rB7WI> z)4^%)?;QWUBC=jmyfs5)FdxG~ z-`IJ|eP;~YL(K*_7)EK&vF+U3PM#q=TA20QEbrk-baaNKO(HiuAkb02&43o{Dw+*v zGUD}z;)QpSu^xPVBzrh@+4^6sO@8@h1AVTFj(d-^s?|E7(v=gqvgP{q(*>1aqv)Pr zfa^Ow-_f}lZZ0k-|D|&9O^I4V`%`EusS}#>V&=-gz52Yf7{S$uQ2U#)r0@%9t&gDFt4`Sc(VpgQ^y^D*LD9rK0eJYNnvv zksV(B%51r;o{al*Gm;dpETE`1S&%= zgYeXuXQ>qXj%6%A9rCZyH><*TLprbZZW^q3*SdeChhpX7QrR6j1GiZasW~%Q4?zux zlJ}S??;g*~RV=)pS6XG1x7TXTdwsk2kS!R-?%uwAhP%7^?W+AwC3V|DfW5sVzqSYv z3dnY)+y2WjWr4+zFd{FM?az?BnIIWnO3Qg&Eb5|R)ugKhxqt23cXeaCc-BU}ZZRR8 zQ^|TE?hW641jt48P-#^$@$6pj=H(O?7a#DM^J!&3>UOKR`YNxK#VNDLsANi0^kMSl zjWd;gzlndv-k;z)$Z7H)oS(0C|9Mhd+s60~s*`^(&j%NXmYd`J?Rke(uGFE_ZDvBFvn6q#tcZ~X5ZQkY@}a{8 zi+29du2J&dDIWf=r|fgT*;fwT?Yt%;HHRt?C^Th{Z)R6S7PAdu3=812ljA zh2X%79lbaPgVYTT2X6hCr`l+hY1h&E0PuU(usyIQ7&%kQ;CU@CUnuyKi)(Zw1?Myk z71a!KwwF&eF9KQdTd(6}rlp5a8@^)rq#M97U|oXffp^kV zW%A_nLnV4zPQBk{3aQGYV@2E6*k?*-WpC(Iay(|*)!YxlnV1vSCw;)ag8UEL-aUJG zL3DH|oq6(|(tC=QU+|rbXmGGB94{Q0$=C~71iPQOn`bzAa{8$QtTBaMHw!mf{MZk1 z6L=A?I@psqf^Oxj`og%wFNi_Kq*>V%X25*9`_nbQQu|aKQ zQdxd)vnVH5!w8#R(XZkc1}gVGM&%0H0e?*J*9UBC-R^K`it&Xshp>*U7a}KCC*Pvx zcqC!|*R-^Rh@;Q)QuU+6kJxZ}RJykW3}oVkJo)6<#QOYba5TRXA4=bNd+_(cWjZlgTP-tL~ckJy%@*rK1oU3b^keNWlh3KiA7AU0{AZeypT0$9ZllM6U%4gh#~|V2uQ^v%hBe zJK_pSMxo%^ziRBRn?dW=UF8QuTcJuyz2#_E&%kHbO;2j}AKC$f&}3jNqp?-Yg5}A~ zaBT8uc-kGkk<1a96DRU>%=WSfWzzt2%-^TmXKY;eqf|`WP7oCfg|v|WK#GT zj)|DRFEJdO(Ly0aAWR-eWl6rfMeB3S!)bI_iBM`6Q7{@RRZ+b&%TOOK(w+}H7$1CS zYK-E5hE85wC}P;#wuk$GT~)WI%0?#w|C!!#!cUCxSk*u|J8~?TkzvmL;{XH zoy{{8|Bx$`nOlq_)tMhbG`8qH+rK+egVEHY1q*sD9>vB^$V)Vnj4vN9(Q|dgx%?WL zcUSxkQszKi>#w9_3NFn@DLFAwQ_~x&tf_c^d`S@0@cY1=U|s<nA(LFA0<8?~E+YGcEm}HnER;q)oGQ>0s;XETTYY?-7jms0 zOm0|UK6$d&Z8^$2TF?s@On#)-`xwvxm|`625(iP1T=8Yg#xA+~l=5R-1wWiYHWN@L zg1XXJHziki0ot0*u^SbGC|D-0k&V|$?|oE}$}1^JG$N@fDAM$xy2Ov8O;63(KD*-L z+;9=(bO9cDH4-S3?g+6rB#@e$CjeTwz6S9S2ss8+j0kOE3IHC_F>DRLK24Rtx&Uz1 zk)}xCv2^SkdaLQsp`!4)q84(tYRWzzYYZXNLUMeH;%&yhVLn*?Z_zmjvBgl>`fCv!3GoLNhZ0U$?>!vD)c(*<4~Zf9+e zZs?4`AbHpx)V{S5o+Lqdzh2tlb=IhJ=#HP%JCc!#20k@(gU$tJ7#EWW0O%?t_`+W< zNv6sEkBrsxF0KF$+I!WaX_fb;HaAE6uUUG_44J*WuGk9t^3OAZR!Z2E#@?% zVB_Jb*Y%XS2Replt99DYVe>33L{uJjAX?)Ht0}ALC9dMQcCDf7?yXzJq|4xc?_YLC zvTxtMefmHHXRM<%Wy`N}iH3@$K-UU8`RmGVs#; z926W(SH>pX&k$|$#chQeT)UmCv|=L~H=wqlN2kRl=Y8QxCtVO%NBN6oGuLsAGNZ}R z@wm>Y@>b&)@G^Go1XQ?A{+6SK5C`CAjNf#nF9*GinR!IXG}!02Swe$rr0dR4q67Q% zk{EtyEvMJ?88aB|M8x--Zcl}NZ1`J03t6|>@e?&{7)Vo?V6tayZM1y^cOgqPaUI=3)Zv|2f?K_u; zi*RkmEALky5%m-5FhKeWLK{+F@Nw@sd1$l;zbc;4s@vU1tD2Q4&aL(rbKB0;w zqiLJc2C=LpxVNSVC8*BM^#K9&@IC?UgWqTb_&G1`Q(4_{xcAK4zib~!y1GttJskGk zuDh@@qwGu`cw9)QxMybvUy~l zkb%I0aW2g)Fm)Y$;X7Ac)MYK#S*#sSqV*sUf?@G8!KU)e*|U(mQuB6bRKP<3@-<4E z%m4#rPRzybMR0BY!$Cwu9spis*RB}7$k{ov2~z2KuB-fFBK(+=%mT%Rf?ihKFCk;) z(+j$2)z#&GK~<{sS#sztrpI`F`9f}v_JHq?CkVS`yQo%75XP_i`j`2o(Qad_OmhRu z09IVOeZPhcxFU5Ke}`0VfXgB@Y=ZP@>C*O%my)-h7@v|_wqh=87axsGQ zF-X{^P(p@yw&6 zwYB#TyrFVe4i-MGIZKk+HL#5tIK^Glp4kC>H0Vy}@jRylU}yKBre|a+P&89JeJ9_KZwys~Kz$R{- zsQ!HJ?AeBTdXXcM9q{k&+O87UH6I%40sl$mhKhF=%xd?9eX1<}8V)Em#nkc&;{%yMQ4mczbsju`qVGq0f@U$;Iw=24#3KjIq{$)Q<-DUI zL2fTxkEk9fYa*xi`WK-B2+oIt28a4%ih!6sb4`9UCanq&aTDYP@P?i9gh|Ax7;P=B z4QwY~65X9iawps%;CGxk#J)fX5K=%={q}-EazW#lfZqlHuFhXi9zMiZMf&S3Yz7b+ zU}QQ!RI`}5;u*v_4jzjuF(lXUJ+JBO zg!gkVSx%a9>2;hQs;fUQeN(7wWVD4t9fTcM{iVy6AqW;6SE(uy!qt2(f_sKl5FImM z>BWm(yfHUoi}zSl{D2f7!Ev2GUs!O+WVml?0hdA{ z@$q3$GY;sZ9zd^qe<<~cYN;_uC%S@AW>X#DgpgmeWlZ6t{b>}0T_;?qlO@7%sE z;aN6y)qMFPHUO`g&j|iDY0IyNwY5p9-IrFle{3fNgHD|al#jDzw}s;v1@x^zId_1y z$0(HFy2WW=tGyS4&y!piJX-4Kd<`DsZ0N;)N^y-?(AJFKdGj@|0aJY{j8;u62S>R zZ}C9vC7@6f3ewPU?)Y&ZI9PH=hfkXH6rt&LCPzxt|2jbt88yh?Iqy<-_Lc85Js?2G zLXQ3d*8mtP?8I#+noIn}<7Kn;wJg;*N;1a!~C*}O!yBn(tqXTqIx^Hl)! zavDr)>m8Pv7buu1Or>g7mCM0A8A9P2z@}zOccY7+-vV3L!9noK#R+%6p&z?-0Fp5- zGTz52=OQj%UwE(-lNk-sofhI_HYsOmu|{N6Oba=MYlfbCSOSY3cM39X`)s2NymU#a zOb5)EsS2j6Zf>WJ9b4|{dEZ%lj87G#qC-zH%V54pZ3yX=Yl*WZzo=;2Csl`gK90pP;5g&cpHJ62$?SiJ9kMdRUsSGkNlF@BlWak&X^#>_Xs5 zP|%r(2)H*=f6aVLHCL+dl6?;^?*5MXeCvE~O&dK>&AuBtTlTU8DIB3c{_B4Odk{JV zLP25EBDswA;GYRD8n)*!A`>q!lZg|BY@IDmAn4fjE?!Lk2kne$68=8ux7iA4bosyV zjgRu$5m2J$=)dy~k6bTxC2#xCN!-MQ28lWd-}k^@fF8)X64T7{jGFpOKrV-8Hg!4b zv)-ejYmrePaWo6f6oPoD(t-b&*J1J0x6?*$D;7`(4?brns*hUX?EDxuY^Gx_jE|DU z^u2qREnOPr;S?04r(xSmW)?R&4Yy4q>=6oBeo6EOTw6SM8aE;~(4JD*P}}i_)y3z` znw6WEM;Zs56i_SZL2!DvJr&|O5;j}k8MHszNFK3Pua!H1E#*olj~jRQ;lm9u#heQi zk#v|S$B|sKMpuyV0uT}7N72Sm3XKI5+mzH))L;v-K#?8ZsY|&`&x~b8T4v@@iGf7A z_qZo$rKO}Ua#HYU2#RLtPb1494rN<6)L|-`ubrJoE-y{gAT*WZ4sKv@a0fwq)3?`p zpMAugIBx9Nk0esoePwC~b|UCru50RZH^s(2!}2O3!UF7N1oFlzE~PJW-eUcz9SGTQkh&4CNb* z7Fh^FG(kh2kW9xfh4f|iXk$PkV2XUg9&W-oGAMIH+?XuJi*1G?%~4=?0wtQVleXHg$l?o73PgWoCchhA92B|JsrS)kz1Bn z-neb+R;De~W7!U{h5pbU@~!81t_Dd@nCmwD|mdn$DR|$ zO-F4-ByAaoap-SrE^ZZVPvW8W5*JrB32)G-SPv&kRp3nczT;iTH0LXUZZh>{^9QRy;JP2Twrv^< z>zsROB!+s8CeP`LV7u;A_&z|)e%`z@=xMmLtwUjRM6|TDfH0uMFG;!22IiL+>dBKs z650n%6YC^moJ0E)@q5&2)GX95yBojLCcr{u-vMqudHncpnsGHAN4Cz-pFcM}w;-j9 zdkUI)EUr2$r(T+*_bdlPBos&7ec*=X^J}2QmXw%--kM%bw9|6=PiPYFD|57>o|m<| z`ytxt>GlF@Us1tbMM@JlEHhaU0VWrmgKX!QKk|98WH7;2QJ%O?`kW=3SAcji<|F=9 zR5S`x2wLNjCMJyGB(@>28ARv;G~5|hRzg%fBW&P6{!mmY8~Xlbl?|m1kmwne2KsU! zxtDL>9=W`hCAvk>`Rc5s56C-}Ndv~F@hyVO@k|(1X(2%P+0})|QGUz3AZYXiAP^lW z*sj0a{trHTE7q}hf?K1h0G&Do(E136F`87 zXY5wYysU5Nv=#DYj-8fOtkN=H-ygbJzOPNLQe{Fi5rj4-acfLqJlqmU8n-6cN`Py- zKSFsLK#iZM(W|EgVKg*IO8xrLR2K5dsWxJ!W#Nm+-Xy%oLy?C%vj0wEn^4wz`T1QI zh(BxIU-!O$VnCx?nbA(^{v|qLkMsI{y^7M)($J-7^p~8(=U%XA zkxlE=(&y))vG6@GC+nAWqU@llN`Zy;-YvvY)ATSTqTJBZI!>`8v`5j>B5SSxWA6zq zFZ8w|;|wbJ8Sj_ZY=fe!bMhoFkK>5<1P5|>e0iGbTJ7Lzrf$7fLXsMv0cF9E8hp^CVW$($=Ei6ZXW>kz=2;} zq#SAE@Jd)&^>TOCv17>z2{kQ=58q|wIX`&Y8MQs8@jEvb#tk~seh{I!3JnQTgeR|K zT)aNCSCTc>UGwLcc^0U@R1+W~xPE7x#yFjZq0gv^e?^&g(FKNuX%ao(!amN7E! za5=Z=8)^5`h5-b=YwsGi$A@(>Np(EvpqZKKfhfT!&$mu1QXQKm;h~z!g%eWm=629! z+-G_O#-PMLNO&ZgH!-x^1i&Y|Ge|O0YxHO^V?xP~e*WvGC!^u;BMLni-fPi*ECz2t zh|<6um4k!z3P!d;lsB;dz=05Ga1yuQfBIzRU8x9@F*S7~j${Gbw&k{Mm_)_~Ulw_1 zvg3P+eFqNMe%7NC;5mX`NIh@Ip@%Z$@kCe;G?p-$aBp*0gk>H|t7q-iLlz5G&Rf=L z@q;gfS93w|vn@{yTDr6m#DP)BygWx)ZVD}VeoV8r_oh@lF zkTAqn5Ab{sqa7POlROGgG_ELJIW3!RyKG3Wz2KZDM2mC7=}ITvc}wLx-mUnM|Gu(U zNbS~DrsxJNp;#T+>S?nDcLoH<{O*w#|4L7Pwt2*vwtV;)=%GU0uR*jDi}++^;m;XNHQJMEUkM8>=9Mvi3`{5DJ7 zWq<$0w5R2&+jJj*Luz@Ble>ga!^dh!4}2{>`I^F^4`nSHg?gzlm?VNvGckS>c5BZz zyS^P^w9LN*$5L#!2nJu|Z+iHK_~c(R5NI?y zqpdqVomlk6-kzS8QVyxv;=691ICTo~#Jd0!hF0!wEAtCwdJeaTiKVh<#*!sVa=(O+ z88qxRGGD!277aJ+z4v8w?N}@Ab3f&m%eM_$v4-|7Q=)Y1*To2r@H`mhQReR| zbIpe*TWeq_T;512s;e?3P0QwYZi0rS&59wxSIS%78XkLL_`{9=-fJ_G)KyXqAMNI} z$u28!qUd)X{Isx-UAI-+r3=phP__5|jaYt+LSvPrS9W7I)_%}_^Sc;wOe`MPN85Gx z(N^WU8s;`~-k4fSDz^<8tpSIEN6BE2wcxK9mil&Ua$&EJ%AeMQZL$zQ|HpHAO0>Je z({d8i{&lV!W&5&VQy(d4o1<{Yfoy8_^_W4XKxm2sV=+UO3MB1GlC` zWVlYX({OReCM%ujW(7YDP5-4Oi+6fFEZBL2imYufxe%-7)4-M2isg@&j^zxpU?62<~>6E!;`wMrq z+Xw7RzEEDtbzumUBTAy9$FhMgARl5bT6%HXQagEi*t!(0X}e_g z+@Y?02f$q)94yrIzkmOR*;U{zKB8XFy)-6$OO<;AR4&@orkdYQ&k7~umMi54Upv+C z@vpsmJp|J_a}Rq)nd^p`=;vh+Fo^6i--pn9T6+2EbdG>DWM5b=M2H2K6Nk5o_wBSZ zRh5-Zy`>cjfIzT9P%el6KJ=rym%w;>8CibPTyeZd;c%NXCr|D^ca|>$jo%?NcaZ42 zJ|HMOq>hztq>>C7qA%)RdgBVRlEOmyGMzovUOqk&{X;K#vP{4;7?3eebQ)s>`WYxu z9tcl6a4{-T8=IZXZQZB3d)BEha@Sv8c_uU6p6{~1yKA7!OqQd?+qB<`TC|5h*wxxH;7f4(OTvm zzoU*-w83z<{HA8ibkIZ8g={C3Mbs{As1Ny@}YHF_iZ z+fcf&gQnZFligQl4eF+o=O;Vgd>M3+PgptLLzySPZQ~?;A9)Konu6L*!*uTT+jX;Y zzlKCsetyE1JLbyeCl&HN_`=fpxl@t|Ghq3t#{{n>psL94_jG@HBwJhQ=|XHgkM?_* zRT(l8sNzU%7vS}&6~s7vu3qg&K*%;mAJ=Z zB$}g)gam4QrTOz~vCIM!F#L9}F?Q<^|LH!pwgb+lh8CaO&B-)Gf! zU?MSb{hVBj)0oC+qs8LTqbvNmVQ`htEV%|RH|yg`3fCUYUT>!M+|V#rcZY_HyCN55!`3HWAfP_x@I_{s|=gd{A<3j_6 z{~B~_lk4AY9rX-R1uf}7z^ID z>}yYFS;ap$J}fA@yX4x+Se25(qkbyU54MH)wrN);`lw_t7+Lx0%%84i`#z`7zHa@K zsGlqKv-;1eKksj~Ol$pG6nAXd{MiRG3)1TKJanobIiv41JLp+>S3>&JblCCy$Shqmxp%%>qZd6Emn~7+*(ko&Eo_RypBpQOI+qupSF9Y~ z{9|SQ#@3+3AD4Fi=q)!}Gs&}l#M2ck*TnC8Qg?09538mvMZJbtNNB1@r{muUA@;&T zzel^KOyGnvG^~H|LhXJ-KH2l}0`bVBEIL$Lwiodu-{q9%-wIXd-H~$-B{errvX9)3 zumOFy^8{1zFC#Ec<=f|eJGzGj+*)n=d(jNhx66G?vQ`-bryv_sg)e*M%H(u=%Ww0p z|5F4m+0(mLe9XIR&QrR&w|Ogz+PnoRaehZ2%ddq!H2XhZIb*SN!Q3nNBFuk15Yej# zjhioD&(&7FYVFp>3p0;^OZEJXkz4xt^TzWlcM+S>{iH-%&2oOI<8S?*7NSvj!%S}& zEf!fJd<^h^2zsw049BLf$p6bE4o-}Y`@JvM(mL0i7#FI#Vf=7W1tFm2`K$pg#nmE5 z-w_}EE;>udCg~OlaM`>k(mcfRkY#u* z{qvZ$lmy-eX&VY{m|})IfnlR#{8eOk=J3nWetCa9BPs*55%&{4lzcr zTek;i-kEN(8I&2br2B3||5pS_h;~ZfHENB&)VxZ51f1=cm*HCw6I11_A1eD_p)}ok zAfJ{VO{+_Mb?P@S4cYX5V%sn%o*9?a|Id&A_rvV)#+8Xfeddv>nZxnIw$rNn@^Y^K ze@D0cT1a>XvS5{`E`#>(Rd9J?_$A59Eb>59_aFcN`q65AE#$`LSK~b1c-l;gARMPd z37vg-5&!o$d0mSr!>pxiXZ)sh!Xy2E|CJ~h`2YU98_Q$QiOl-e^xwHKH?FzQzTfwC z-2eOKe6tWopWcBWEHgar{nsZmwY2}Mpy11lD_hTr?7H)I*nif?|NU5&GZLhR{@2Ip zHr4w7{oUDj?RxIb<9biMuKT|}>5lH<>Vqu**I!B8SYGx1$bUag^}?FFmft^5wU@WS z!pm@>l$E`FT%(u;WBhmrqyPE_Bj48!$;YkXUxk4D^nPNQ*@LCZiL#q2sKDO0cioQu zKVdW>ld$dFA0#B&ydH4f8K%+5;z>4%#Gho^A^irzU5S&!$!`{NVrf<4e#y>xw{&)w zy+YU|=`SX{hwk8lz@_nYfnM47GFdS2B zZdlF}W`|&VMSX0Lt-vE6O_=jNAHZpeNF5y=pU&J6O(?LC*fACXT}3;~H&u;)(6X>= z(5>`pX!XG3v|KxP3Lc=?F;2PF#)d*H8mMe+U_b@8f)NThgFY^d1)oa{%98fx>;RPjcEquSzIH-}de?SaDs zIRINan)aln4N1OJ{~JGqy>OCu?cCYSSPF6$_M}vtl`flHuWVXNeNQI~2x2>H7Lu#) zilOjdmyx1OgN!DfaUW2pe#rMW$Bc`xSH?RRHi4Jn5c!=B4ps1E<|cV9^R)MZ_yBIs zLY2#D->T5#o;vVY+|HfA-!K<4No>&nprTnb##@?pr#G8k8;e! zT>=QlYQ_vao>%OJ>qD6>&o!z~z)OeFOfx_&)j5eSW$fi%>R?Uk>LpxV&!2CpJ5CY3 zz|71{E$F&97~vv30LU6~(C+;9%~(&bg}Kq1xt57<-e0povjgqq3|%y+5TFKgKZx_7 zyXQVFaQ1t8uV5xzPr$x@3JUAk1`OvN&o2vCo4YiuiacZq31J2gYwlfjMi}!%0Gp!K zB0AEW0ZzfstrI`Mo4{Eb?1}%VFz()wOE0%m4uZe?bXs~U5~U0`AdN_XO&v{qDiG~F zexJNQ)0m;sR?BDFJ!EnLU;?Nlt*B$3TQ11L*nq&g>(-sK*6_`j4WZFzs>yTP3iEgy zEzB06Ko^$-)YbcdD-$*Y26S(qwxNCz!##`fDqf zV~r9Q<}-{)Gr=XS(d6#?c3`l@>k>h#Kn-Lkh-T>$u54{B5M?0g+)>C7gwTxfu5T5n zad}SXym@&zZ)pj<$JxJAO?@O+lw^O^mv4c_OkoVCgBl+aj(B_p$X`VTTaPSh-_jP9 zOTFG1ceX}oRIqQDmNQ8_|2@@l;lkx!UdQWw0jV^Ny!jGf5FSrUyv(IT^Ky6`q@u20 z4^_jzEd`<;LtIWiZ|{beBKh*DW`ap&u^238%R2-dg++z44RfStCp)KLIQ(S;&z1+v z@`HxzTwR!--v$pL#0>9F0e@nbsx2)&i33Ido%Fa=MQGW{8Y;I_Aam3#14BO9G+S;S zzY`3x&O&#>_9DlD>b|aJ{(DXk+$k8yN|yyFZ-1p~6{1`|a`t{Nl3gz?Tqz9E2+mbI zI@(UL$a$5&KXk(HVaIx4(hc{S5m!Xl+*PYqfp-BJK0LV^o}|!}0`o)}&0na9 z&chfjz+iNKwh(uCl%{|rFLUhW7jQLzS@ZeIM0mf5%b+ANGOWMyrW1=d4p%0=1RkjG zkgZ!|7#$lcv+E{_3xE}1&ON?vy?0QCmxyCg(8oI$IBPIr~$=}^zsjdz7Xylx@|FK#GYHp_bcM!& z`5OJ3TU*i3kmQ>8=?8n9y$bz!lImQ|B%b%GM`yNuS{lIu;drjw|_zz>+(&0CF_ zLoRlH7bfKVTn1)^O6FKqUAqfiI<9C2+JLVEe?1E&SJ`aG3;B;&aT?;#&Ay{`@;!? zE0Y;O)q$7GiLk>nkMxn2##~EC+ysI>`Ex|L;K$QeCQFTQE6|03Gp`rr9~*-HT$fo% zna)L*EnGN1hTIeEjQaFpUCB=$>v|~|`Ioiz_n|j#-rSp<3I?1HoT@M@CAmfTLenaCS(5ZacUo?A&#(?H$-n93~3=``_1-8e<{H`{I*aHdhb7m_md!K7rkN6t1YZokj~qS9yP{fX@ev2#a=jYT#i7V6 z{R|mFJB{rtgsz>c=PcoPq|O0!pE7>@XWrBzxEnmbrc_nyIk)1~GDufudH!gW5ZjlI zfhv3q=~AWGTTh;(ne{0D!dy%MZJ5MN`Q0)9tag&*q*1Ezz2Cizf1{-#Cm|6DMn+OV z)^UZ(qh5N8U`z?3-Zi2M|0;fUbSNJ<8uO~69Wxi)O6P9D!34Ti@wY%qK{b5G5oo~d z%`XPBr9oQmwNSR8YEJtqg>wF8tkR_2>1QTFzk)of!bYR z&o*|+{+aUix&FAAvmd(;evI9AWW9yCeZPJ;<2DVsd0h9L&q|*i1-IM=44m~rv7pyw zty@Y`PI3e73x=xqj0x{KZ{PEM%NCvcT-pA5!>O*yFblCU$?HG0|BP|LKeu&-_(*2_(sCaS=Q!9jy}WU-GTvz~A;Q6lf^miyB7x!qtnwEX;sP0JT}Dz2lVW;j*oDTWQuJMJ;Tu)|skCoaJn zi7%YGI)FJg^LRKYyA^feg8Q|W+#6?db;x&>93E5VN%L=qa-G6do-|DQ&w-eKETfmM;&?z z2k7DgStR+BARAaaV-Og%x{fU zg&=2;s#e|%=Jp~2#%f$LM*jQf97A*aO2{f%_d#*(bzx-Bp~S6wgcre2cfPje3VDL{ znZeEXk5Hra78A3@r=IN()r?ifTy=GGg}SwQPyxSbUQ-*LetbEU+?TJT|N0u8wxY;6 z<%dCxV{X-*I|Fvz#D5vKP*qi)$3howZYJ1XdUOQ{L?Nl7t~prl83eJO_R@7SFbLdT*8>p`qYXqBENK8@>Z~DB!@RD_0pa9F+n4u50SQcjjJ1O>T@nx3gEy zzdp#|b}9Fat){-Qv0$4?^~E1)anbTXomMG|(pE6Tmj$$E9*#;0rU?KvGMimlI)twbSj6{9CYw##BC1sl2ULX z&q!ZC$+x8E=T>?m_(BhEB;5=wK6R>ZL!nIfEV&yX@cW(Kqj*p%%ZC*Q#r53I0S&%I zeYW*%cptl3;J7d)XK6tOQ~Y)3)-7-FaRVhxOvm83u`}D?Z9z>hUiyq(@h8N_u06yi*XGkV*ix<<<2!007 ztjGA|>?s^VIzmp2X8LTjXASGs}L-l8p59u?o8|tR|F}vPQ;@ z^2^Q9QBz^p(Bix0<-K1YBXJMk@_&ma;EaE}--94W004M`KX{OAn#{FC@51`ykIo#! zO>^G_5uA~iw%BO-Q@lgr#Da(777Kr$b_E*hRUOU#0P6V9?x8f}_U8+Kj+FPLiaB#T?hp%FUcJqC^aBBYhM-P)SIB8T12^Y&& z8Vxy|#ObD}qVlY1g}K^8zQ)m|Cp;-p<#OoX5|>s8YEYDx!bN817^xl^6-A@V4qB}8 zJ*fHq2#^JqA8DilPhNGB34#FpXF^m$LPP10bn&H;E*mpu3>}#<>z+C0g&{S5IBwi{ z{8$K$fxie!avakYzRO*DrOwM0Q;dpAOMZ2%hgXPV)?$z(? z8oagJe2(76dfs;3WP^UA57##H7KzZd(^~n^LQ(lVec#oq2lr>s`ZU;7lf%Pm`77QNE2$Q5lFCExto>&-9H9Kc#``0-HGU5l5#4V_N!4HC{fd;E=Bm?4vxu27OD624 z`vH@{VFpVh)yFNl`U~FZ{ctpvx8Aoud-m*=IGF)^_IUXFcQ43UY8eGKG*%3SYU^o$ zhJ^hV>yo9#molE_yt%1E4%0cx4k~<#!75{S55=SG!Qa1My#EruxDetOZSPXWb6yo_ zZ9n{rFgy+!KQ5`F;t;Ko+Uyz>uV+on{^hf};Y<_xJCg-xlvVp$zJko_+;x zB2+S*I6)S;*_fJ^&X6wSf%YFT;Ady6F^D5p&(OXy!v0L4Ycp_XvomYsHE?x8U)pj*^nHo$1kvUoQj^vq4x3XfXVPaJ@F47(Q zefMwFl^wme@BS7@&A`3%%0$S>@HLpRCj7Qa-|eD-b4hQk@+K3kZ6!c#DO9-cn+iA?+Ji$5KM{)=VPA+V}K;_=`!m|OYYf%5)5*7YbB-(>Thip03 zw(0&&&o8hjDIPRu@8?oL#BEII2oinGq>ZqpQqBteC9n<3n`ZDro~`?9e%U|(#dpW< z3evWo{SN&*sF``h*Z#ACdr6O$aDW$^Sg&I}jV^rqNGKM-5t3%aDNR zchLVvR3E(a7Rl2W-YK7o9SI$wcY!=*Dk>%ZQ2%punGJ- z)(W{=PELyW?`h6fnh@kQdi9Fh#=Bhjcwvnv7Nwk20*&lO5{f*R>X&ABUR3LuG+XV73r4J&Wr~?O3Ua@z=peGxpamnxr5J*$X zo?3E^a{)ecT0%mJ_gT_wi5c7Nq1YtD$%NzqtkZcBsk5hQo5iIS&F@x)a}h-5-FWe$ zTYpsVf=3_t6`~ew0=liM7X;U=W|nSIQ77nCy>Ah?Mc`8obmA|E&E8J4o36Jk1}cWR z`giEmv@fz371SWhJW{MRdisl{&&i-*v#5;Nxl{7{Bx@MH zBp6-vqJD#W!ZGf3ZUtxGU}-CeBU8Uz*0d56j}pcngn--Iqw}0vWxi6AZUlJc$&(>w zn>KF-iR2tg5I;!)#IZz@HYoMtJje6bCpj-%I8tF3U8(ii57cx$MMaU9R16$!umO8E zC8b#Jny#oTLmb9$wH$imS=eEN+T>T+`^wdW8qic~CgnV69jcz2dTqoiw>l9;OR#wy z&P5)K4%ymQ$<6hQ)6k1*|GZc8pOIbL%xCAy^eAwW^Sc7c8|09+M3apxCW6aZ8i@$? z!Y}%w)vD{z8kbBT%GGPKK^MIpEaT~q;|USq{ZJGGGglbfUe3&E4!%TD3_@eB{S%cF z7TK8S{q3$J5t%}oinRuSE0JrMEb)jbwF3HrveebNfSWOVYBRWQ&xC^S-AiFB_nw@N z=ULkFN9?nX{`1r4aDyR8nt3F#@EJ5_w2Mi_SC|A+6@+gbDeb_Mq4cln_l5bKjFeQ= z@;+6!pw8vi|LvtGU51yb0en>xA6wf>tb7ioeeLLg4laLjK>D2Z+$E?P!PULJ9r2=k zvA+5KGJb6bsh8jbOtFdA3NT?480QDPGC9ac8!#Z7_*c)1E}wu(N;kpIqVSb@u8pb4 zym>u`Zs#h{)PKA`sx(q$PQ0n#pqPGH z0F`&SvT5%D4NCStF{Y(6#*aTuKl>D858TV!W&>2S7wHsUh9Yi8;qXLIg#Z1w-Q)|7 z!}nMpTC(a{b%l)$GnvId7Vmg{_x5c#@TK%5jN-uMuoI_$g03qzxr=k0AmB%IosdMv zB@Y=iXg$dRtTgz!z6(9|>SNoUq_{8ORmGk``K6#P>1DqIAzU*-4k{kza zfb+Bkh(TGgkSOU(C`blVKT>}#9<cO`PVrb7dz|-p9wF-$LF}Yy3e-RlYkb64TA`Z z$_Aj&^4*w$O0h-=b|cl*jaJbG6SA?g*`5VOv$V>?V^3=81Zvu-J;?Sp(Q0uHVNw}6 z?Ze!-h&>WN!)}g~5Q3XmJBUp^{b1^~^pun)>dSm1q#JVqY;$G6A9O)JX}TQlz4-BC z6Y7hgBH5nZGUY`_nR#*h<()pg-Q(Va2kZIv;*m2E@^pW?EC^hMV%m3%te6tCY0f0d zTviULw88+7=fyX!vt8VG`_#KlbOO$sx~gu_HDt*`bU$8$M+gKZ93Pq+8`&BbR z%+a6+Fsz%0+r6slLD~rfJ|n$p7Tr9b0J5>qiJhRpCOtD12puwV7?r- zgxn+^^<~eBsLvB+@c&QJ?X*5{(mFdU75AT{dYaQ60gJKmgO^R4u9%^+ zL?=e`B$Q<*vHqA(;S#0(5Zv$B(WA~-q5dcE^wCjTirJ}py*yW8MBwY~y)P{-*G>x@ za2lCIlPB}$j?5di;UMRQg)3T@6O0pqu7DLsjS_}n%8L}E1&@4)5iAGp6y}N1GiAW} z(mC(B zGHn>6Ff@4IdBV1{XETH2@JY4x9#C+>fg1BN=GRF{ED2#&$6eTdjaNz$$DhcmA!Rzo z#>T)iW2@B9?W*v?#_}Ts1SDHoS=X6y*VP#SzljFp5X_N<2e%y9yLT;TK7*_)<3kSN6TtzDl38ZftF6(|*i-Zl@uW7@ zOHt-Pqf4Z*gjoZi;87NB=%TczcvGkLxN)lia>cWES!OCCt16<`a&lVI6jk+XA|87~W?r|c<;fX+fq26;lyAb z)e&?xzkORjZ{jv2ZwxPU9J;5EnoQnWOUn;}k7BJv`$$!F=jGB^6C^UKrv$w0A-#&@7XVnM{eiP0)r%5`1W437N+Dg&hjpE4))7!ELt z76E_>D-Yax$QX-3W1WLpQ7}OY-_4scQZCRPwo|lMe9&OUJp3fM9JrQV zdT{E~u=ah8ft@xJ*%hSrELybFLowDW%4<0d7xoQY6wF3>>{CwhX&%4Joz(_h2lzkQRybp0c}#k;VN&XvAM>FG+Sn z96b0#J{{g-PzeAVk0`Etq{)!$RzJ)avE7QKfnJbeURWm7Kd@}^YC+6Av?$3co7RC3 zKeckq2QQ{YlvLL+hQh4?0DA7l3v30 zjwKKKL0ZY+cvs(%s_{q@xh_2HyCnUmPenRKeF3q7YP9D+ly3B52p(;ptL;c!ol_j2 zlhaIv&3czwFrTD*VVO+%^Ii0h)E+gNu<6HkiJ z4KEgUw70jid&+iaF*XGkcy�>gs-Z2JV<+xwsUA9${gC)?P@r8dmH4xR+u_rcQT{ z(wkIrSKK&ShAv-x`a#swXUk*WXh`s^263`*b24z#$k5$hHW+QVPk%HajY7^94n!8S zqhjV9YybLH^J6&$9H=&5K>s6;QB0YNDHVTk$wH&U zY%PAUzPPtQz^u6rx{(IgvGF^D7WMF?>i6Vn5cU!-(#mH6Kc^W+1|6{`e3LG0%`g^+ zFg@#RegE+zRtRhP0Zhx7Ar6REHp`H$cF437Opw(j!otFCOXMTB=;-*>divVD`SUaL zq7Ghy^(dx}e72^(zLSksWqX1o0SrdK`8f;t2MC3fXpr{!XMP}&5t_p{m6XxlLPJyf z1e@VlVWGj~$)UFshQ3rSC@Pvv*FR@Y-wA_g0^C>PLV&W|=;2gXSD}^VNXI^UhN2XU zodS`A0{E{EsTF`bw+s}8K?4U0iq(c$h%bTUA;hc|Kgk)x)?~tWb-Z>Ff-n%Qn{enK6D~7H^*mw+iq|w+KutXYmh+LP3SOzI<-tpQsx}% z#y(Xhewe~80FSYItU1tiUa4M2` z0ixSI+BlyaEU{@hOAv0}LGbaWF{$E50r}`{J{H7r&VcQDU}iRlJ5V4`UDFn%q~^b)MTTik}CeP)<`IOexSCd zwUZ0)6T4!-s-qtBe9PYV8ldq{1zvY37Nb{pze~W&#J{&(hwFKZ78ygCWRaup&o9xN>G-zYjeG7MFx*2*)_* zsxaLKY-UQcqme|8ZMnIAtyb?HOWbvoR%KBm_HR)4TX3v4^h8e&FgchD0~BvdkE?zB zcz=t!eU1Y&ujvamF{eBJ>XzVFje`$xp)iWo89JCx0}u`00?Q;%_48sCGrfGm(GA`3 zH10OID$VhW|Kiv7cDTg-cTNL1Cg!3}Zi;x6$kmOCzh9icbkDblUk{7lp`S%B3O+>B zhTTH|!DLf(efXSXQTL~;aH_1T5;!~@;uaJ3SY@xp;nn#-%mGb{k)j9JY9>jRijBSW zhQbiNe~o!c_xxA?A6f4mkM-aF|C3p$vqF-JlC+VeWfdX2lC+S7q?AfUR#8ZyVI)#X zNs;zKDwGy!4^ou2N*egxU;S>M>-M=m-~PI;w{@Q9>p70&aXbdx*;lWcxzI=fETF0K zGkD6a#;EJ$qV3jYwOLEN{iT)iaUDx^+{oD?pr@2+bqgs|t*j~-svMq2=wln`Ib%$4 zcge!<*;6IMu6dY7|9zA9;+D)&r2|t7w|w(6?AmGh#{=UPT>K7C`$6U#Q34JQ`QG;i zoTwdj@+5r8yRAza9;c?Hw1MIQk71~Puq`+?h|eWPX&CGb&WfB}dgbM)lm;)`WOs;L zV}w%(Rsr{omh+GSgxK>qDu=bVz+T`WkWTOSIyxPhFcZRaJ&wGNuscMNP14bUOSs9? zG$}v@;3rk0fZNss7txDB>>V6?4PG7q$IaWf4U$J4u4!WO5g8YTl}PNhEa~{LTe4{kqyYRVqnV=sw!Qi|3TE}(?)gKrtx(!YS2X|Ss!GtAyv7) z4?mRT2D6jBk}BYW9%|7Nov<9?W_2l-X?%J4X8C8QPM+NO*R~arEx_B{k!1D_mJwDm z3uv&|x|Cp}{u|9zU0onhI~_*+k|`&*08)l@$LkJ%Qfm6gI~uO{JaY@{zvPLpqMzFY%}3=Ga(? zkEJx7mzHVc`~k*mV(~qfO84*gYJ0?sAT&Prmu;(WrAht_>4c{pzi^5J+ zX?|0`%@2m=59rdR%Ok(j^j7ijZ)S+KPV6&Df80547xlGvoi42z)^#zZ5Q5{SjvY#r zPbJrW{0d$-V|0P3<-{pZ$Zy&5q=peYHi!D7*I;Q+cp8O8;)lhx8V14I_Xj`C$%-hE zWxzVey_g=Z9l7~(wQij|YwYjiy3slJIUhHN7`4pPCP@qVQmP{%$hu)7S#S7w6~d^- zOmCM#B!ilA&l6GKnz?GupFa;Fn}V`rE(eC-E6I_1zjF7s1N#mP$uZIYwv(AB>}YFC zOJW@R_m@RPaTbd{j$p)gp}s zj&gAC#I;plCh2)M=8e?FF+<~TN?Co#3dcIZPvr4qEJ9)3(sjSDqs~OopK{UX*4i7) zL@l3xSwI1sTSKLQIzRD3R`ol|2B~Q&Lipv+mw;N-U<`J>2@hJZz!=VZQ$U~dzvhHg za4BOKp&|QfW#Ba%Ew15osynGQOnPaO&tpxAtb}s*@S(QL)5O-Kn`Rc2F(I`i^6KTEi0&u;lXLXoUOX` z!MT;x>ARyY`Bwv&xwyDMQ@V3t?KXE8>}UBa7#eeo%J0a_{QA0~;mQ+HsgA6uy*vqC zV$9a9c}I?Pl29)1-TSD%#`L`xbB8PE9y?~2TVwX{Pz_;QOAa4$M@qW;X2l*;tZOKM zIYx5II{jI8)_>5_1W1`{_B3sb)E^W1Q0DI`j!zl|PV|7>r+*KvTVSM-r|XvR(ByJ1 zFvjsCM_eH?;T8B(S3$~ORHJjptFXp*jHxK|>F<=IvtHkuJ$x6A^#sB7F8OYx8nRtl zt24lJk1d%?BtGgB)xODcbH{yq&JbFz`~7=J-V0o%*;LtiN|*A_`+h+)L|PIxb>Hew zkJg_z4+?!7INtI|(o+-D*>7)dG^@kRMWts?i8_scS$g66W3)Sg#o{3~wsJKEKE2e| zn2wT}Cr=)VTA~?R<1}WG$~V>3cejpgDW6}Oxz~hR6wPaC?4}PMO=E?!@=Gn+BNd{a z{>Y2Qr+4*T*2mi*WD*cpS@Vm-R`hqhjR3LAZ<>Qav4;`eXrKb`H zqQSuv5&i>O0&9$G+&}y4<`TEC)mp1W5nV37hU+V{h%@L@myb7q5Wy}ek=g-l zOdeucCRp#S8u^OH4c-x5;R#vd%$5@#85^lbK`p3_&z&k zSEj~G>AkK5?OQQBcJ&GP{lsd(c=zHx%pKY5d}frhv`gz4cf&^~7ESZ=%EtRZUf$0& zW`3SC8+^IF>fhMFMPq(X-elIDT<)13#DLv|{wc zZS_Z>4ngOS1&i+@_n{zO2M&0GD|wC_Z5ivd$Vq-zeE*Y)V@&}}X2c1+vcaRIKma9hyY4tM&C)WNnAjTWUTmg$ zlYS|TX+Ox@%Fe!CyIEn{s#EbSN<25!%5bHRzSI4k&9VB_7au~hC$(y<{ix7q8{jw@ zzkz|8ixiBa_>^ERKP)fzW^kJK;Fe#fw-U35KVVGme#vTtsqCV&pv5FWb{%#L552d6 z=Pm9?&VSkvR|Lfg%7eZyP2oS-O0^xo-h|j4G%s_REmKQm_J;T|Z`Q1-HF1$u;0OC~IplXL*(M^|VMGVG{g~_bBLrK3L`?(IAePO8x`DB0WJ&(XllOg3aRVL99x^6CFYm0R>Q>U8^i^*$P<}bq#mVQp zczFLUH{Y0PoU=%$pNaus`B%@WT_ue`(xV-9B*r%^SP8)!m4S4UyBV!8u zuppv@8@On07+e}!Tp1Y|E(w87*W3&awRuXG@YsF`QNW?uyR$Ut&4u12$4gavf!NTU zLv?h%FzIG$B3ulA#)or&vm_XmQXO^M#cZHPUOMu87%md@#SeW?0sGDBsjG;U1X3Ha z>mXn#{5TC`|16_psxJXFRh+VB)hbNnbiTiHd#fqyAt0;Q7pawDz6*u?DPu+2{77#- zIk{N=Tve5m>@#wBwmRn?R30CuQi~0vwknhr_<@Xp%O4Etu?2XY9>YSpr+CHb4yCV` z7HD7*Levo08oLmhcSdO#;h^38!zeh<%_VxiPx)qKgAFUr0SE{UG?Znia2Xl>6)lMI zVz?lZEq${BvHuV12!O)%v|Pvoxg^1G@~S^9IO9JL`s{t*Ra2&1ZPanAdGG+Tys2KS z-JzSeZf){YZK~>279g7lKZ1SymWp!PrMZYQ8JO@9bAYoywttwc5C#6Q4z9c4bB~`o zR*$F!jWQr&z|x}fhNaR=QSm#j9|8pEZ$?=H(9IMPd##hO=)3I|+h`uWaie^{iI48x zbIfy&-n6N^r2FEunCM7jBzeS5?Qh-dKjytU@5F}pRb<5e| zjql!}dq=fOL4n*WAfSM~xzekO3l&2&9uoDjVLUhq7FArWMI0!f(gg zWdkb(@ULrsBOCwe*wZao(9JA^cf0-5Ye4Qv72m%LJgjd)7g>G)l(&*~BmWB9Cn)GF zhzkChr%tV!KmP@*gt7+Ko@rl2UK!!BIQs3rsT6xHbKU#5Z!ITT!wn|S0kR(Kc1X_F zw`TfPXWs&$sujn;ge0i~m%r#B94>Wd{}B*c;>H{X5i~bN7s*a^@eOPC!Pny2C+3ZJ zLKS-S$dU0J->!MtBV)KnaPNi@G5`2+lxa6_R=@x8`lITkb%6ly@B&!%g7Y4~2k?xl zK`1$;r4t8DNac?$gDA=4Wna7I85kM0a|#JWE}n0B&`0;usCk!z$7yPMvZSbII0*5u zSC6%GQ^~G=SA1cJax4R6XJ=&>rHX^)48vhQ^JdvZ`<)JBUK|1_1S+eaI?vtDPl$OH znr?6e&zf3B7TPD~PHr6;@tOjtgzC#eOKg z`=#$8ucgdmi|{L_4&5n8u|P7pv!F!#wGV1|2m!ofx-l3Y9Lko5z0rv?0KDf-oD;9a=`cD*Wm!oWE-Y1b>5Pnw&$YEChpOpr z*sq}XM3@GAd@=@S7V1$5XMzQvrlv_$Go-Fm;}eQXN}HmixmdSatmLGz_b*;Ysu=|= zdQ3H<| z>3n>p?Ei29KEGf?(E{>ms3BB^j!}NW(ZPZBih&%S$#L75i~>?|$DSj#D&r0euFqtm ztXR3SWLVMSJN?l7bMHhB*tuY@y%+HXF5t$VU#~gKOnPMqef*FU!JWI1V%1u7jV|>n zggrK8fG#spS;-8Y#I35W02t8?GV{#b$k2B`)+P7#P=R1vw|=wJvE#>?0S}h# z6t`DYWoEsu=Yh0{ARNe&H?a;TZ7wSA)EdHZO-i!p6M>x^O?($trA0@c>Z&6aB+1-SvDq0w--IiHuk|C+xGJK~s1IN##hb34Rn+f3)RWoEdOQB8LGk(<(UYVsPSUdWL z%m+Gf6=0w$_8mz(HF9V@WDW{R4mO+ z-H%krDYi{NehZCLf8z}ZC!{CYdwDe=TVc4!b|m*)zIhO>2TbumGFkC4XIs}@kuu7# zR~|&b7cB|t(A1l3-!Zzn=Wu%m9hjMfQ`x%G`WYQBe_CWY@0QsXH|` z4b|1{exv)z0Xsf0#B@+izSAfpB~@o=1nq`DS2{=RunkA1Fe5{uL2PcjK5Vt)Mz(MC=1e%0Z;gT!CDr^ztjtO{CZ3aGH_Q z4H+_4`cN_0Er3}^&YypB>z3{Qdx%+M2Ji{qh zJ6M!p31R#se+DA^x%205c%DGJ#rZH@VKU6+*{6JW0#v)^U8c;Wd|`gTp}7pWR=yOY zdItv~`iQaUSIi!`deGl!C7r|V0;0#*Z~9P~j)U2#-r^3z?lH_=1dPhjaflD=QwkRIUiM*%>o}h@Ua<2C7?TUoiham^t)`m7cX8=?}ffx zG67;DkPDR;uOQ;#NA4>i5?uS?=oLY+172n;-SX4}3_d<%=wvgq)MZQQwK!%GzcA<- zVY|pz3lTU!1r`2ZKJR(diFoqg?=%7AibfB{!rpN!wUV#laj>{DS=^!uMgv|{u7|2w zmCIgCO!jPVzB%eZ&YtM#GMWb{4Kz|88XB@|e5pT?FtUy{HaTea5JVLm&GQMzy*LE6 zI%qf?zH}B2dA$&#@o*(9gSmfyB_(swRsPI1Pd&O;EGyLTIz7 zQ%t`cH`~n;6=hJ0H;hGUnhl9V=iqAN|xWI)G4gWY%FfHd4K`b&hx)hbt z_n$w7d{a{qW#EB(-mH}8$T(SwaQfJ3_!W}+aKOoj^O1*kFYBkBx(JWa$&Rf*XIiwY zBqk-{HVC@T@?QI;)>OU}IT_9hH4_DKCY3sQE8aLTgHvlI(V#gFu4Ez$!xvVQLsbCt zCiTuTbp?{92(CXrJ#z=ppj69l zyjdaGIy1%K3D=aA)Nuv!{A_pR`tE?}ap=H-JrmdJVR?kuf}@)ui0U=yj@Qu$b^On&K*~BMevnp3M8l@A=hxUzHMmmVvvB<#K(`eqK%Yh^l@-E z*ohA_S5$A_Tq+aZT!R{qdR1Vfje_}f9#RG$U}@g3%<#^Y$_|=o6`rZd$;I}8uK%j*r@Xl9C%G_ z>2UVO_3IV`5*W*iBsF?$p)@X@7~1^WN;(pI(S3~nZj;OnbRY_^(a#TcFj%#E^{0o& zsa!iab|?fbL{s3^L9{^FVLi^@F;;9(adqscH* zC|SqJz$2NSTl4Q0QFXB~+bRvEyuMx{WjJ*-9?Y{2&!|n5nq?ec?-}$ONZB+Da*O1R zGEOcD{V}|&yWU;X#k*|sz~M=BbFzcvH7d{I^)`zDu(+&^JN}Ly=O>cHIh=#Y-@`+X z8=dYI-y|LnS{`hC)CCgP!yI;NCEN;^U4xOifXjRVmHUl`ZDilQ)4)B%29% z1an`TzQakjgYv+I4L^wf$FyduzeKlk+mcjstT(lcBFl}A=Anbv|5y#E%-f< zg^Of|ou@E-9sBJRk=ziQA%ZR!8i>}#sYBcP*THe1jyq3HG1&fo&HEoLCAYQFC7T1c z2CZM8q}+vkk5t3EozVdtyeBg>sRH~Hx@BNsAV(5(r#`o&eIw|Tq0=K%Eeh?pqp=R2 zM#-qD^M}XR1M^7}Fc%Yp*EKUDzU(}FO5uqUZncpk70UvEiW$^4Ef-ueDl2U^uP2}} z=vVW>`Nx+L*|@fhZ2|5(fByX2n1okeHh&JsHv~U;1UvG(g^En5G7h$KYXA((Ml25u zq@o$7{T7FQ6us!Q)QycZO5B*i@Mjp=@hXya(D-s7k1abXGeOs7E&gs2-AsGd8dAh| zF>fn>*I#jK*6CxcgkppHw_sN-avLAYpTsx>gEWMQ@?HzTxIp`YxPhS1X59JN(&F!; z+{Pr&bGd${XVApG+~_5Fo40La9*;3Y&`ZhvOrj@EN}m`m6x191QfyjqT79JPcth!*R!k)l1kf8XSdGrFVX@{$#*r`LXcWzML^Y+vniLl!KknNGQgQqb1gy6XK8pdmCN z5nCa7=RChWcO-d>{3)rlTc`8$$>EwlO{$(OW`AdT?Bv~f%E+1cm{=q zJ7?M*S`SHo)s(PfTRv>9@m+;S9jmDL(rY~H={p|SW(bZZyLLsnCm%n4JbZ4i?KqzG z>BGca&Z5HkY6^BJ6r^a&p{?`jPv3uqUn1lfZC5rGalH>-FQ0Drlf_I}<7y8Ftxn3* zxwNS-?=DQb7t2MITeCr7{6z+^NFTJHiO5fdi?GkZklvMHJ5a}|U)Ec$+~)Y463@lmm-<~~E%7UaiG&AI0qi>uUSXooIHh)-8vZ?c+0K z_(dwvRCMT9i5zqY6Iv1|-NfnM@zcEqtAI3UYu%*fVpRbmMAfdBATT zDi0`oA!Lpfvi}Njin*>+`RrLRqArE0H`r|g+2yqza?L+AP5axH)q#LgVm_ju0OKrr z(mYv{^$e5;$TdE=RcH1iIp*z`rQM?H-@pG;@keNxesB_D&2%en#}xI;I)XGGiy63K z#@UL}ox;7P`YVMC)&gN+VKjW?p-9HX9@ypbZ4G&|roZAIm>dz61(d5sDw;KQbDtI| zdvw=)%VA=38f40RF3o@G{a8+Hc;NQ3pYQCyc1*IaK5Su|t6~;*F#NCR*QlVo+Z$U) zS$aprZc07XajjZCsei{dG)Mbb&t-v?rv*mnD`Kr^fq;;eZteH1hQs^%O$`iyxw`lO@^(yK}-c{d1yTaDQf7^^NA%oxGx z@b{!%{imoKDM7^oj+ilSBG#yjytj(Sp6qElv%9vzy}-(Qe^#4WxS1Xq(Ry{3mM?e3dq-$(VIm*2YPThWA0vHI)( z+f7-$J@4;l1GoSCAAhL-TKQk^L-y({1-<|KZI^xJ&7U#$*?vUvKYxekEGwCnLMwvB z?RyP*1($V~`t{EL?@v;6OS0_ioe=gs~5HJiQ6M3U$ljz;Um6-Vsf z@L=+Q|NG-ITh0mwzyIs6UiRHCE^O)l^3YFzhz20+3C`}{N2zAUEmtk%%3{p*-L z#QSCJ7rQxYMFER*2`pBc$V>A(66T3-wSc#67~fN}L{JR3s)fj{Rg^C+FAZtlA3SKg z1ojB@w>RTtGu~-0=)AzKHBzg~$BuyuHs1N!Pkcdx|90D6w&O&$rH_aJ`thxo|FD0= z%RFbf<0DVb8lP^rq(@xU^!Gp30rm_7A6$u+IV+2PSw|(#e!Xmj`c;ntTAnRa_~9N~ zpg&%9>!T8isOnpr{pM{O{VwJ8yHCc~gpwCMJGwqC4nDd{yjgnXIW2=fLH#uetU%mklyEGhkNe?w{tHdnTv`VOfFesk_FfF0c=e$KtU72SM~*Py;B7+AQ0q!W zXK1rTNO(Z>MqKk;j%Hstd`HGqMB$19&Z9>z!`ytAMY$C`=cC^U$G!>}#vFC1b2!}5DEy=(MzMmJ7}asMg3l^OcS zt^cDb(Jz~f^38+uhh5h$?J56u#H712gWdAQecXN}j=I#Z{Jf*qtAF8T-`kExXG?aUJJ>PRO-F?%E?`Jhll%7% zJi0zj;^=0Y%nq(aFb^T5mEsq;2(UD=@rtJ&+IMVmQ+c!7x2r41GQRAnSg_V`D`#~E zvNdw~fV=24o5%+Rup8{xFL3-N++n$ifnX79GfOL_hbr6Jr>t&y`BD{m3)%syIp)+L z>F|%EOMh)_G?`bd|N3T;-0LYxU3$OzDiwCwl6gdS_GNV2ez7AiHOfoZcP#vTp)|Gp z!P&)Hqpd7E?fa>vZs6<}c4^JEm?g6Umo6EVv*g^+2!*-#b}E@aoH;!A)e{Htn_Y$u zz0oB?z0&|$O9iVik&{=$pZbvG#r`G=N7sMe@N&&d;~;e#uiN8R-k!5z8G~G=zBGa5 zw{8uR73{a)je+U}nSR2AG)=1lmuFd1!z%HCwpNDhX_Rs2GIo}yT<6W1lZGRWo7-LA z<>F$DQ8W>j#l;0`VGW029fMXBliJwkbP8`@>0T7zR%C1JbAFJDnTxc;M6eMoK>zD;y}57&Q1kh7BXdbpQo=QKbn=-U zuuZ1z8jg0F`fJ%cJBvOGJuiRya(O^W0Ak?@{0=Y~(2IQV7AlN$XU_(kKlpy?b=REn z3lw9uV{mk%M1Xw%g^Gy}Ys4F~&_yaRA(fRGfKEiC&h#3LiU|q;O8fb$J*9OdoQ{}% z0`uy%>(<%roj4Bm0q)cvmKc2&bF=tEO9J-}2#eYN>tXTRdq=wFF^Ltl`m81p;l4e4 z)_?rC)XS?y>7{IRsg=Dwbv2azRaBm1mN;YI#pdlC;TDC>CY^`LU-1KvcHq&|0&2pP zi}M1fk-j;7{dq!wt`-(iF2lWY^-c6r;%-UwLFp~72ho*9&o@KsXSj%GT40{ZZQxW4 zDjORb5;Y%ZRZG4aNWL-U4yy(TZ2Y?JQSQq-U~KR+nAx`Is08N?2~o;x_$-~@esjo1 zn@66*3}j-mu#i3Il%V;mS6@?_ci9M$42IC#+?+=WT86myB*!QnzLjrLlA8J^iH%7jh+{ z(^@I6lb$`dHKQfoq>;d)ykp16sYE7JV>L+Z`rrghcnF;%mP3Kpv1;otKEHc*e2n^mKHv3WeaW zX3SC^p?C9#Mrt<4C;1GcM@uN2*taiSL02S+bL}mG7NDreD~eD@o=i!LyQfTx&(bmb zwBZzGBq!%M=bBEsThPJ~f0>`(-~JQi$m!!DbKbdqD|IueSJQDTo|V$v*m>e=IxkRk zpr+iK=Aes!nwa-iW3yp@j_CtP1xuDG6G6G*raZJIGz;>fr2!KS3|jbJbiZ_o6V@2n zn;iKcF2E-O3@u_`Yq6qXLSo2bqV5*6=Rr*kH??jTeNz!z2p~zoSCDh@@OhOl&o8IJo?|xftTEBF(m? z#SR4Z_H8(2npWq}om(3eq^YSX_%S`tqLg4RTT!tkOIxjM=FpiSgkWYIir_J0#~wd+ zOvpT;zcyMDoAnm!BKn0nj*jAGm?{ntX4meAAJ;7ph?563x65)?mqz zi1X{oQH57SYY!N~akcqYn^*>#4EnN&^;Py!4$lU4K1GS_;)znMT za(mebK@5e#S7oUCLqtMTfK2-1WAm&iG!%y5@7Td`m=Y74pRakzhDKiS`gI@)upq20 zePttXsGNvT5~L>f;q2Lu@oE&QsN^&bbWl8~-NZzO?pmzdPqrk_2dQdpGUq3;TU;4j zD%&)zX!#c|gp8RA9OA35ia}azEFkc0mARFt_xZT0i{#0>>%X_?*DUejT76C*lw2(T z>u3HBuZ2Y^?^EoP)t04~%Qo!&-80Ia(P$CAR~dIWjYzc~D4TU~S3cgSXx*m_A@uq0 z!cA%-ZCwan5Y$?SnbvmnHgiOVsjsiEtr+9H%zz=7(-5mfoS`~?iD`cs`22Fngi)h7 zk;VJzGSY$UQ!1qrB^b_KzupuqXMT^vsV(Gd@rXh4rN}m!8SvWS@j_7qIA*}YU7xJl z6ZnvkEI2!{cR!3>3Y{{gsh>MT5nd#W2Z@9O3}n7EH+w7y%X$k;LFLC6G4%nN7bb5Vn>HwhBuMN={rLL0-(9tp>ibPW;$I^WnIPWG%B|t(SX}wUE4sw;l9x>J zt`OTd>QU~Jrm~yNBGiG%q0Y7kc>eAg)Tkbnaq|tcxcozt6JJAm!2y%`?h{~2l*r)9 zefd^O$6Mq3%(3Rve)HzzvvWyh_2GpKxiDpPb0h5pfgA@u(!wih$`-nA9fwy=&OT}} zOrJSE@2+Rxz9SU7(3nwgW6b-tx8d^4+bh%hN`JfFyXK(z$S(4waEAbyg#0AG$5pI6 z216`55?0%wPyT+X$-RX?0tYj~@MF2TPuWMf4dvwt(>av`^`KJ7S(!d_zT`c1%^Vr} z^Z6RLaFXqKc?&;j4H|?-9AHQgh?BD?HX2z*1*~6n(c3*|Q7jYC0@Yz5GcJxhc8IL3 zEP(ZW8G|c2A5bSgJF~2R?P**esU7TWY$mR3kdJcbEQOgOWIQ-HI53F#&}FAJcWJT+ zxfs$s*HgYqQSLM&)ZENb-ajrpgk>4SALOU3$qB2Ph_3x}Eg@4Im#s7IrP2`9zzNr_ zT?^xNDQ}$5oSQ-{fwWvk(VQpv5(&lK*|R~Q*NmSh;6+gQfxC%2Wc8|5V{~*Z?d<%| zH*i>Px#hE#53L=9?e6Z&u=_1I=pK9uy5uK zr3Q;1`Gub|j!U|CYP;66$eV9eRaC-mE#q@9vN&M;Zs3|gt%&yZV@4{PgBapi^Oc1X zbM2LV%Cs*dptr)JymtM%|C5teWygOVeq)w;vAe-!H@Um`K2QO-{{GF%)Sn>l_8Fwn zR5WroJ}cRGdYsxp>|=W8%X8AjoD5sps%$5?39WIfd=@V3*{>f~p*NkoK3*BEZD#RX z|9NzrZr2NE-Zj9ci#UUkkEF@dSufpcyTAVS%P^iQ(#%_K=OsL$R(x%XCrLCs0yx0A%jbTVxHDg<1%~1XMzR(URp`cvUEW{2!lK1kZ%U#;E5vs#Qj_wRLsj?k>z2 zz+7=6HB_?;3AyB)i>F|1q2LBh{(MTxW8>bXzo!jdHcV__l*;#*yebXbAcex!ey<}G zdJgEg{c_HD`Is!I)fg!B@73$!_=o*%tEHu-306B7@@F;6px5!m_P=7I`;YW*xpC+3 z`)~FoI>U{PjSUQ(hbxD^ICOQ_`&;vi58OYk+PutJvv5?V&l6Axj_9hY=Fx9!8fQtE zZf76rr2NwN*$W%Mdmuv zSu@e=&pOs~rfSDLc=%8vVl?>}FbilazH)eZ6a?|y)K$^6!kA$gJO-B|W8)(3Vu~t! zDi^b}e(ye$>Eo)EwB?#dl)%fotFit1mvDG3Rr-^lcrdZZfcQ)~!Ky;1mcDmoNx(#c zKJcqx$Yf7jZ^f{-8VPs_`%^vt39CmQ!SY^g&A4)i_*ge4cuv666@{dC2f7^_H`mN zF@^d*E;T!4?)qBeuy?cwJtT?MmOL`Qday>NdZXGHX<#(8HF$X@(9Gp-x$TsOWZ=8&OF~)jV0W?PmWX>hWn2OuBCSPFj1E zoIr$lOj7Zu-MO=d<#5O*1*bx;YzMDwPMS^Xn^=nW&t;a{iffe#Jl7f+3g68>^Ci;_x^yQz3B zsRko=T4T+PuD;VaL)s8-Af}e0Gqj%qNh{oBIVB5ci~gTXtT54pLUfJ&wXyGF+r$IR z%`aRKrZr4%jwKaId?sj>o{nUD0mrCvO0Yy_5tDy%g3z@EP>7s5H733umsSA3JFC3A zbIC#}1D4A_gY)6z{hLB&BHL2h&tXn;uOnZ0@}y+HD|O3BM$^?rNk7%)x5~g^pH%0= zGxA%*R$SS^kQaa7WJB53i)YWOm^(5fZtc}at5iq+#wzL|d^*ml>qysX&K-FsE9({8 zh{F>}J@b2Pk16}(c8KR(yL(q;7FoBrTIyG9kGj|uGKmqG8f5NDf~E9NbJ91{XZtF- zd$F2Udac>FeNE=i*ijVC zLBM}>$9j4zR;>cmzH~=dzVP(vsGyZ|<~(JXW*|4duv*bICgiTZf^H(iL~K1FSRx_p zt5;F~6+Ug_t+a=S?E5EbLPY!n?Fc>_Yb89DX(E+bHNJtccZrW;&qLRRstgWblB`sI z7r{Sk1=o9Cn%C5_E)}X7lJ|;`u@Z*xL zTN2(nXiVFG?@Q3dqQlJtmV0v8lJ2p1=T@6YC2?21oFN~K9i0d4<48mb5-jvC1-ekR}1fObr|RBM^aX~^|uQu1jHlB^1$VI@op0jV)>9;Lus`68X8hx zlQ%_Y8H>*|M@>0iZ4VUut75Q|YPeNZ=Kdv6(?B$>R58ZOL1oZ zaRa$`;717*0mJcAr*JV-QB2kb)GSbQvO6#8n3woZ-GDRDWYGci>byAWX*y9UDOFPu zqEd3wQ4P>?;;cx+pFZIyhb@ZdSis3W8=5>zz@KXB6xs>YF=Orqb?{ zSGd3lCM4!S2&%87MI2D6UG*U)B2~O*uyLXKV7om*SXgm{>>9P;SkFq?QshQUu)p;7 zUcO?5$5SuMdLJ_pFnVZH_gWp};MV0FaHs@uh&))|GFWy1*v`j5t=9k6WR>U{w=$D*0{oM;+V^fa zE0XkL{7Y)c7dqE%VNGb$?93(vk?v&Nf1<6@C6lW)vn7OME zWZ8T?v`t`(wJXX>N}5tg(wrlynBnY@A+fH5-LTE;9tqzrS_Pw5l@%YcbqI}V` z!gWUC`*!6K?;78byURdDK*!Kw#$<_d%^mMkLoo@7R4=D+N3;f@gBlEB)f7`sOb!UM zus$xKtVTGi9j#x95bBF~13tfru7&Ebp;M+#?ZCQ)SIN%$k`9gBCRrz3T^87m*-4)B zQw|a!60D^$6C62iT<_9+_76cNu~|7>fiP2;Xpy(|0h>_ns7!ewyoSg1!F&$UTKHH- zsB>BRr6;w=UVXCym+?L6>D?t~V|qbn-h0~yQ&T|}i`0UWhN8^h&rja_FaQ9+TUbxC zmhTjXki-Fa@TR7ao^SZvF#gYC3x<>4QAC5D)b;1gMXc%0LJSNElTx(of54dS;S9I`jpl! zX9iJj=aj8|gLVuehOm@#O;L3G)g88KFW58YePDWAaHxg(w>Ex}78PPoIW`baBdnbHTs# zf)4^y6#I)s5w$|}E012R>FJ|K7{6^V*{dA`k~7WD4&hn!Ku_ec*m%Evf1t(}695>! z!#*++BUrLtA(xnP=omNcJ&@dgkQ*THg32Aw^+d5ZEjn_6a zdX37`4(o-ef{v>3!-v0XM@W|DV^zVYjL2Z~j04(TOmg9trem>Pcpim*Ug>W~MfjaahZC`9G2Sq-bw)}6 zLxl~TaXP)!$^aKygN>5T$WjNxG}PQ_%^UBQJTG>$CK~dW(>=5iNcnYF7$7+0mP$y2Di16liOTpi5u2b}F z3k&`@2Zu0X&m0Y9w)E!B+{ZcFy*isao}1fGO%4CIc{prx`J(yb0B___m_ujB)sBmj zb#5m+Fi|sFzPDMmzEz@752^J}cc&e2G=MvL z|GuKz8|4J&Tv7_UdeMEe_t3SUiGr7it*nUG(6JwX(sBAkis&a0H{)t58<4LRR-)0p789X zPtut)V?E1&-PVF}t=qe3b(~myJ${i~^C065-+ujGDX}_yCk$)E5Jc9M9P_&K{oBn> zy+wj1e49|T?MzF1O1HD>dYJnowDh<`F&8Q;`HOr`&H?wkvC9FOR(1xRX0A^Y#tX=zTsVEIWyN~jtwjC_AmZI8OV56 zD!gll)cz1ESZbo*WiNFFu!u3Uu5JKpjRjJv3dEG{s$*OIjSGcHytsF5eqJ> zDObOInc?rAXA>eDc$1^7w9BZuXC2C>uLnS5q=PzWEdwK`!}?T7Onb!qv$Ro83Oeqb z-&6?7{rleuia2DO7Nst0mB?)cDO~XNqCVu^#HyF0jzLY&7s3Y8>Y47ki<%5O0&RfO zcq1IpzyiU_aF7s5GF?UzLPLh-WwP@4kNh zA0{${sQ?r}?k9ytJ3U-oAh5D}rI(5m?hQq6qbyiN=(k&Ab&|h)`2tX|e%(6O5L~7$V$0J=G5v-JVYcrJbuSZ$OfR`jSFj(VG9ac> zS7QcC5nm=5`GI)WF>$W+;rR{wHXMf61c(79?mv$AYw5bKnGdXX2*{~>*G@+lqs@+T zNB;w%*uX&fs2h<3p!8zD?Hy-uVXB*t)YsoJFCi%_CoD`1cL`o3o^qVgz@S@0q+8>^tz0!^3 zm=Po38GFv0S;OtXC>8pGYZtf9n}i%?i9dJ<4`}{8bn5i4^mTo-H&sOa;3PBLs-Rzd zIJ0zN(b-0vBgl18vng;9qS?@NzB@j&cpn09o3`n6*gE4^y72iIR}|2sgBKw?CX&u1 z=cv&(v1^d+!i*BGA6YuSaAB-5c6i8Vf(Uyy*)y<@MEIsoxgS4Uc5gd>UsWvDcepv+ zh*dzfv_fZYpZaq+Ewav9B&j|j?hJHpb=gksdz{5){uZh4a5}srOPd;-7Qc8K^F1zT z(_SSyq+OfNTO2iN;MTW&^80`$pw-|Xx6BvETEli$Bjg{ovVHAl|J20y;KI{l`p_`D zt87d(JC)6P;`ZZKO|j8Rs$evYJ20L%sJ{4ba{5vug8qjKAScI{GFw)9cw_;Goz+{e zMugN$q7o>HF&v>K=OdvLK`+N6JvY}MLpBy9Gnb4zcPc8vt0rn%Vc1H8+cU91D1k9d zXWOy7>*^e5%-E5TAgBVl3Xo4u79vDWa72Cm6^sNAO|0Ph{=rYaluEOxb-s6MRD6<1 z-D~mUSurDfoNdNiq$uU~;L8Dc4PfS_aiTKB?HmOWG*H1jfJxfNk5rpN!Y6O= zdPJvQqWF5ahR^Q%g)6k@&^?<>jOW*3YEEg(VMF)!=@f~C8akAGGiF$eIBY(oUeJ!wD=iLCJHJ&x zMCT2cSI=i^iy6jrMe-O+k9C)DQ@grnvdJ4R4%E-l(K0I)G}nH7StPgy5j6bai{zv& z**-h17cE{av;Uya6FhcG>+;?8WNRelHfH-osDq*L-FLpYKp$JM;Pb0jS3W!y45rSl zc++2L_s`Jo-6e%^KR7Yo-sQ*U)eP_`Jv`#~fcScj^R3&qp%mFvWv6I9V*bTPWahG! zCr%W+Au(4QKmG|A1%L^q3oYBMSp+G9m~B(hz4GkYo_ouZ-Gj5^HqRY7R!1kyQbEf< zXH`;L<(dFBR88>XF~cArx@+6ZHPf*9+mHi2Ha?-C z#emCdOiOYfWa+lHw*Yd|wr{DxlX9cEQA47AUjS>x_rN4rYgMlIdJ z<$$(~PT_8uPVXm5m3`&ve#RSy7$(*?V%q-0v%B6q%hAo$VJ?z=3h##=`|z!WUSWGC zCp^4_+pDe^U=iME{?lpU9#r?u&R4^GNMhQ7@km#Cug{s+1~J&c zI!Le?=Jx;cj7!vAMOjH{XJVorBQTh~OP98B9cOBH>H2}~o5Aa4X0ts<7a0<@dt}V~ zxpRXd<1M@V%Zt!Brm2Q&n>FX?dKpw5`fedxA5pHj)4C=rVuE~#?<7Y>P7F{_70e_& zLOq%pjQ?HLMmPAH<$zX=5PI%{0;_Uwyy;58e*bf9fD(=1`IgUl|&a9|v3w$wtSw zi6fP}a6Mx-E=O#_SL4YsKgaIUmpe8s!+NZbJ<%Iv;3F%Y{urklbhD?)0R%xY(AVc4 z8FRb$)shDfR?`aW+p;!Kl-Va9K)eo<6N6~l2PbZ69xKK83P42WKRjmfQ<&;$>gk=J zRb)PtsfZ6Z))xUNKPjB>4fia5Kg!q0MtyZ*k9`Mozov{CESrV2NLw2gG{LK>zBUWV z{mwml6sXd(tCZ(Hv#71@3$=#~!8H95wBDIRYXD*dpR=yfP;pe<0y7-@)(z>h$!z5A z!eO7n)6`C+7Web>_OAW*3vL?{Hy8o2TepTF*+CPmxGvhV)P9oG-Sb3lTRJQ>lG!Wq z^_^d*E&2510AM_R{AQK4UcGs<$lYCBXZ-r#(0?$$8b2bkBmBO#nA{BHa1p4)ffs?{ z33m_Ew5l}?U1X9OTAUVXIVdIzP42#8mFae`KC72c-MnQBN?V}CyCz$$+PPICr!rM% zS$^ZOA?3V(E|Q0Uu!Q0jUk9)_=F6<$xpSY<>HPWhe1h2Awzf8nmB<{A36fiDYfMSg zM=yq^NC_lZW&$Ackx~8deOy(j;21xlt5@tjjvz0K{V6)`S2+2Ai&)G|1etVp8BrxT zxn^W6TeuL1N;Q{Kj71QtlaKoiTm%2R2>tEUvrsGeLikXtYW;<`F`vfRXuGBmTYLV( zg@LjFC%gG_I!+Blp->k>HfE^$Y!n}vx#$3(D9sQLLEfk>rEqHE0SF{Sx%2n{ekdvU z^Bs5(toroq@xzBdg%+pZM6qs+wuBI%y?a5-Cr+H(XrvOQ(0BaFef#PtCc&Yi-U>nX zEUz|DavR^h4%!=I9#U{lb#+a>{r*^99l3qc!HjoiXF8;;VgqZhFp`IWxRw3i3bB|T?V);C{>)IFiSc38cfC?4|wyQ;)rh*j*rT|MINm}eb zoR=3ukwvkOC!BaM2!gk%2qEr~Cu6?Zz}%4s%*HnrNzT0xS{Aol4L)Vd&!3}4j_fKY zw=haUvR?yK$!k}yf?xoBMn0T(=j$9-S2JmaKg0BGW2agnqTvt8ZYHIg$$VX$<$iof4mqOtBtMa5wsu~FaVn!HUmwo1HTF7T&t2qG zrP=rW5~dzKwn)kgG;P*5K6}RF$E#k=*(;e~jio7IKiGRy^`UN056*RP5TeC708Vml z5Fp*^%ZG&|@o5J0IM=)v+*QK<9_}JwyT?_m;6QRGS&lhuhZl?F@ZvvGy`=th`dv6~ zc*X#=GT5nYfB!lt3IUnCu19j6X78z;Cv(y)&v|soj|G~tv)6%2Np{WD7L=F}r3CX6 z03T4l587T_hio-=;dLPPzSBFG3}-eLHVTH<;>DQoe7AY(XB{WD^!Y<$^M9)3fy0L% zr2=DIh5TAv{~15!_!O>0vWBFoNl0Mp$n_`G1*17WEH4WBo zh#&cA!p0{=kVV*#e#rDPT#pD%U4A;KSP`jUD+aa4oPsDma zwUiL7r=nxJQlp-{c+pOM3Xw037>R9V814w>U>Zx+<^~$ZN6PBx=!m*(vI*>VF#&uR zpGS&~wAof%gY-XytBdaiQ%97&d&HcEx;pV*CIJ~>MSd?YPZ~T}#%+|rE*ZJ<_Kl@= zUxFrThe?e&o$P+nKdsGnj-t6^xCvtp7#}Jc~~$Knll$JEDD)KO`aRH_O#<>8cc|kY8PX*SWD0{NANiUZ(aBfip7@%y{0b` zpWCm>xWh+7alFuMru2|)5O7!(;UD%Eb;s8b@5FweDP%okmV#2| z?2%d2V$w@yi{X+7!@n$CsDfG2wU+a8o6O$E%6CL8>|B0^NHs~FAw#xQtlN|Z86a%Z zD8(-OWN99|PcQBEpto;-lQ*>x#x}Hm5$|`S{%ftgr6yTfJ!KmTbd^mBza^Qjo?d$vMdYv*AEYt6%MP~bK zzP|XW#Fth7A6M@I*7M)?|FBI(`u+a@`?{~=I_~Q}zI^NRdB0!dJfG)ts8<|ZF z96UYMT?)qX;ltK@wHzO{b$O#X%_X=0rZ!ESrvVGOlP0(tekkGW!r~dE z*{DGJa5pkrWdoN|2`~DopY97;>^pmj{0Y0=x8U7Sr(*$ zP|&{a|22JMn9<@zg}sawJ{*g;NSV|8DP!=jzmuvBHZs?6H{?2A+}y8oaMy~!l97+r z_cK<|4p$o6)k{YIxnJM@8kTuX%b5y`?8#-FdqT%1VU#Hcam)xK5%+s_b(q~5CpsfG zx7^EU{W)SDbjYgSoM{XVuq>De6@W4_C9H6b@Lw(a4gtKzjb+Lx+YB zi2pDoztWrijkDJP={!n{^rcTr6C@J*g=yeSkmg_uXjElEluXr@yfXb6aYP5n$Ccq!&kK?)XEMv95 zwExDnH^Z$q?%c+R+;`IyO&>jeJnfD543{q|U6o0bc?TPiSr8xkpU@EBF2Qk}+T28~ zdw1`^#ATiQ`xa~4>++^`M#`-U(U5+%xG7G5dF$#eKUPf{vs<}Gy|Y~ZHoudfYV~pt zbZh@ESNC_B#lRU`Y)j@(v#*15vSLsCU12~2(4$;%Vq38cSiaP-pP#C-1JrR_75vO; zjw#V7Z|`i9F?fl}$X%Pb*C9Lo>JPV$mIxUWG(kEHSDY?hzRoT#n$jdqVxg8aE546J zXkqR=k?FbmWg3<}U5mm~q|5Z-6KpjZiDt}h`sB%zFJ8D1XEn%T0yP(Cm9ulkLRZND z>3y`HSPwr?b~Gu&J@TnmNW%q;roaXdl52o>n-Zj9^O`Y3Wge|l`PMr1N5|$ES8?}| z9U((X)-uj!1_fj)D8sV1_qJ0k@fNoblQ|Ziv!yEB>G|(n5}$UbH=)OX(B^bO6H)cs zZ@qN{>$)dT03G3;*eOTNOBbzE$&e~9T#T$WIayO&ce9yap5|JMkK#Xp-@A4U(Xte4 zo<8pW2P5a4$sI=mHYI%+-f`};V&z(5V*8Bto{9A-=YI9I30&9H3Q*HQ^JQN7)Zmsw zN;QvZyrJQ{wxO!}Cs$q#SY@&9!BJb|og?O66h9}oQ*HgChX+IdC@PxrtdQXxJnYYe zKIFNkG^_;N%_vbYHl;QIBu(^_*V&0f?V&^JvSslOQPy2PFVG5!?EI0vdGeaiCAcpteG$bb*`v-;G9k)^kARQEvj zZS!Yv?gNGWU@mmf$|^CPSUbg*sus}4)%RBII=f+4g)KdrP zy!UE>%rm`T0U`pLnHOlFD(f$Gct?ZbGGAYg=<7P;6ip%31xdE(?EJR>j8uz`tlq`fmj}!w8S)TX(#=1f6q3 zHFV(SoGe$#mzLYU=f5O{y7qFx@%X_5xb%e9&bt<_d_&E2c8$=PQRr~1sGse zkJSMS^<|`dTB0YH?%#LI!(*zW`R7c>6O0$=J0?z;V6uF=*-K=2m}>U(eO1KlHQA2N zS;Xp_Mr7_BhAOre7N5U;dyMnU%-E$zH^h{L5?3Y>s--S>90j*_Z0<#A{S|NO21d4o z_#|Qn!4b}LVAdiBtJXm;h-IBZ=$1*75V6C*Gd$3E0caiZf)6hG4 zNvRMjBvm{(A%|rd$KIpzADt7b4f^)&yVTcr?Z+qMOU|NSAWcw^8{MfLX>B_gFW=@dKs^nCtyytbX5z zzPH4#Sc7Q9SuNr^q+d(8OB)scy!5_>tu2N++pcW>EQHrSet8_+rP;sdS=A*qHGP-L-3ecy-nTE@S?r+B zBZ^ADyVO2v^v+`#uAjw`57ZF=ik#m|AN{Z{j*UITEk|DpL)Yk~)>G$PiCbM5f`I*G zI?C+W0#DU7i^+At5ZN1VLO-;P87sfV7LC(^o058a(wk`8>EYjHco|rKYu|tlGr9*Q z4=gMg5*QFoS4hpsu+WYb@CGrt;*-Y8gX^yj0LS_bjz&j(rzyfmKEym}+gvj81gOu^QFOmuZO}b;;NP`f za^yBjPLj5{0}erME-VWh1qJh}V%&dR1Jp+zR}@RKQ`~A;a(T*|^y#(vMjG+smd^(= zW`zT(GCo@wXEOHJ!&7se|M3tTPH4!%>q;Ki|9f`Rxl6ospBcyVb3K&Z^S9ZUs z=sK!LOBkC5}rr*3d5Sj<}AF4Kg zs+0>{<-g@X*$a>iL4HHD`hvf|RO*(Aub=&P2s9v^^VBmbv0H8o{rDLFaO#`lOLpw+0&{|vSJ5825VaVJ*5!PEB0s*z*I zdY^`(4XB0tlO@0~tU-kyJpd-~@Ff-ZKl(kM4`7a-IX2kKi%+cu z6?+kxaj%&XDK*gHKZG%hDLNcl^Y7db6FfQkx4 z=s}=&(c|rB&lbX?p*3Jm>BGDu+Q5$FZVU(+T(fZ4LB@^e!1Ad>xkn@$w0d?`eO4lG zJS^1a^{)eSr>uA-ZFmGE0K3HU`=>ewppl<5N2O06%r1KL?CH5|*`3!bH1m5+C>k}# z#LWczILP#>?Np*vUQl4UTY^`uniBYO3jj36$-apYA(kqZm7H*^fqeG9^t{wik_<-J93y@Qj-@`akOg)8MtHl ziTnb17T=HNS*87I+%pwsRr`ic5&|yWu*&N?U4G{=W?W!?(Z=drna)C z(TbtB=;**67|nDl&BE9y(H}T9I?Cch#DQ!TL_zcEoR1VzN}es?l;f{tXI%h z;G?1=_1Y00kaH+-qAj#^_d$hL)RX4y^ry z+0%UTOh>L9_(d2-hN%xsOb0YisFLVApwIdXMnB8AEkNNM6j#D?q0onEK4$ET&?7bs zmsn1#f`hT{ctI`C-BJ-?!OrmRZ+xbw30qbmvqKYQ)r}iE^gZkvE^n!!ee^Ox|G1cc zHq|Z$fa4>bI(bs?aOEwtsc-99uusA?xTyXqYD_X6#SGXi_%-J6Kc;4848i_TaKYXO zaJ)rShkCkiSIE&0OebOe4zt~hIB>mFRQZ1Bg z^x3cK);|EtglldH@`eq&T~!tBJ6pUK!%Y|l3ir9ij_HXh_OJK?{f)l`6A@)KwB#(O zCGZV|v8F$X*R%>vA3xry%RfySWMdN{Wu&j#*FD~)S8GV_wPQ1G)r#thMM##;0)N!wV7M18Pji$s{lhK(D+ z3+)w|=8V?YS2YaK==cpe4^C60StG=ZF~s&hV0fN<(2Ix`2438V1qDC2BrNwLM9(-f z{K;h#_wCf8bh|?E2D;<0;f@qZ0#ia&)-VczBG&H$4UF3iKM_2mgwgdFzc{($yLRv1 zGTL19E?>4x?&c8&nsIS;>DGPDO63>IceuTzbyA-FXp!NBP~;7ByLO$AxJeOG#n!YEz2~X_0RteVYDL=Z&>x zW#WEj8#-Ew{zV1xK&IUrdp3z50fK}ggq0cy1jROnyM6DZ%K48E|5|JoQ|hAId!wnQ zn1ob2-7!a{oucF+LfVw1!|EP9*tTuk>UUM82u0{O;eAnF{%CEb9OH=N1Vq;tukRry z@uj<(fes^EET$(+NKE%duml*)So(s}G_ebPtVV2)NTKUDPW`0svsAfO6no zVH@x!SZ36XmBhlA2eYcF_&5P}2He^p-(3TR3-X;0AO z%Axd_D_nj4{O^MWoBs^xQ=t!7u^6f=GiMG_@O_aG4eol{_$H*d(Fb>fat}rZ{fOT0}tqvhmy3U_@xX!nDq{cYJ6F4IwkxFmk8$geg zZB#2Yu5V#&dN|-ZRzIo_>n*1OfjosCgGIUc^b0n$-XrefrKp zic5h2a98TNL-0Z1pr&-dyF9FzA*K@#Um$1jUw9K;x($f2n6UceB#$c+8&_#;D?=wG zy3GfR7FdsA24+&Z?`I&!z)Hn~vm1$i&mCIaCOSHmckV=8Pp80=m6oOyzi`1#t0#Xe z^q&s}s);U&sZ8*A4Z)mIlseetFwIunRZeb!$kYwB<-NzRc*SUv!i~kzrP@FsSpsth zs4oDFj2UR2^b7VQ@-C!eTO*R!)tB+EqMawBHe59*GTYQJ>cPExS->9+C84}R$}mi{ z1nXb!NY&fVA3j_I_k*$uq9A+#mVc^mG4*ba5;*~bW3MwZpr{4;Yg1#Er>y5J5-0=8 zC_GZ80mNEzOmV()@M7j(RJ1KafwGiGW@c{AXS!2eJrV=tmrr>;q zAGpiSMb?dRG!?9DnNh{Fb3ucHqpKDNHYkm5Ie58PLSms7XB?S*l!4G5XnZ8khCZ6A zX!_&R^Qo*W0|UVzS0K%!w369c)d{!Gmkkd3P|sz^D2N2@v)?I5SHal+m(&^u4J17+ zO#ne?;kap7F@U^mFx2>FYC%qDCE9?c*myYEj)%Ule~B>#XA9>dDB#{#*oq`A5^iKD z(7=pqCp|-N5&Ux2l&K5Oxg9xt_;%x$#HF`>K7e8dqZ3L2s+=Y8NKnJmqa5=srr(R6 z9UC2uF|VJyyT}b#gfF?TMa#pVg;iMw@%gC&t_2FJi?h8=?WuVsjPcm!fSLy-o59CI zI0Bp?P}Jm4=8|W9c>1}!y?kzJjB)*LI(hjK#9T2kqV}=uRgtm86UG;hY*-EoMXD3{ z9#snbTb@u)7@Wt7W@;ZCA4Fs(GC)OBD*a@gdP;I0M~Kb^`V>|PrxC^#u;pop{FW`d z1ko$~-Bp$GOvv%Ep#X{6xijokIu&x3+c_%Nz1OQ4sm`P3#yf)O^b?F*0s9>k#|VDS zc}=_4@6fu=`rw}lxilDd{muD#B+%ZirSa!2r&Z8{HKY`jBy)$}9{$ii_o|6v-NRmE z)aDvw7{@w$nl6moDJ4lGpAS&`S+>02XCs`W(DZW~e||x~ z!cQB?@ly4nv*nib-qTiTJZtR47cA(%xqrm0dGkn6Kwhf2C;Z`hyRKLZDeqdeY?;kE zS!4I{YrG3QZN=tBF`XoEZuo)okk90{ef!=t>+E|y6eay>Vo$U-t(Lk%)DDKO$Y%zcXWa}|M^6NVZZ+UG0>`X*DukAoA zw)t&gGm@>+#D1D^aN_7xxs~t`Aw|U5+2VLDgK*Lh=xB}1BRn2bM{-!rJYLH&62EVs z>G4`{LKi*GOXc`WtQL>Avf1zWJNmNW^;_9qRrkgRz4_e!8- ze|YWAdAOh6?{P~FqQs>)6A@|1JeC=-BfPYv9a3LkXn#VxO#gd_CezbEnU=F)X)ohm@jRt!V?)?E!Ej_ z+r&SuVkzS=))c(X&##$EqcmqB`Go+p_pea$2DjAD&U7SEGFn#&3IaZoK6@I^?%H*e zQs&_0`BkYz=olk?}SyPp)S5EoJ$WEa!yTt|Bmh3MYcJU z3B=|l--RL^5>ipoXpU7NEy2SA_p7*@TdcR@F44Vv3xk}0&X>r{=pjcN7;O2YtCjYQ z#Rd$Jxk%!2$H(&=4x?0MY4rF@(K`o|GlbJIVY_g#V7Yu*zZ^P zHJ8axjn2%DpD7?pr05+dXK>A$HR{*_(c<#42Tgm7?IZ;OUQxMFEVnP^o~1SY!(x`1SquA0VAD>DjwE zeO{UawKLfmG}N5apYUGh1=3U9pXVvE?J&i-S|s;`f!~%nk8v!eEdVKSw4GbkxMuBI z-_)u*@U%6$kxEgiak67afcj?Cw1gnI%(FpBh&rtAgt+{nJO_a(xap5tnZCu3zVJls zbl|xenG&`G8-j5d47T2~5j%ERa(uIGZh4qZ)s)LasBv%k8Y|jG?5Ag#2WGz%X zY-4L_+5SHJa>k~262_#RWf-2m=}tF~mT6k?%&$Qf2h47y7^q=_Z>6KS*JDhMs`Zgc z35l0>UiT6%Xsqoi2k08>{5Q%c*2zvdUr;RzJ+Nxcr{{OsAYVLPvQk4oTa z3uVrZ>A@2=Qkk$@N}qT9CU_ZapYAsL#Vfx8S6f^8=Jx1W7oGK@wr|(b)#aLk14OS6 zep?!RGr;_K?U^%YgdX=xant+vXjEg?`jvcK$w`c-KZ$fLEqHTS)VTDi2&6%wG9L9x z;+Zy|7Ak#o-1Gs})Cq_lIWdhDD3P$L;=c859>aGp^uq-Eaz*7U1`}uL?7}VGo0{lRe2NrYp4j_2ki`wHRsE z9ar4EVE%=S4C%tdoMwd9O78nYDXZ~Gwsq5q!3zdCD2Dny05HH_kwy?K#MajKvrSl| z;CI8nK;{m@U=qe@;q8pp;@?RDlXDLHSO7Yrz?EgTaxwG9WaZ^6^l!ngm9^lGiV>Yw z&p>~Q{}vTocu$-t4tNm;KhPwZ-5Pz}>p$~&=sm}$OtqUdVfb(|j@~sj(JG=Xxy7}v z_obCKDn4E{z>Om_8`ZaoNtkO^KSB>;V|&Sd#^Y3$Gj?=l*@C)wLR@a_mOE=eXm1^p($)T_p;O zmt*WOKWEe^YVb|M|Ng{`B?t-heen_|` zam-G~;_U*8Q`0`m$|Moto{9TdM#4~!ZV2pchGnNZon$Hs$}Jh>4hkkK**1y%0A$YL zb(5Q}JTZU0s&g$XpB=t;o zM@#z5gc>dkt^fvKIQ8_;vl&-=u`pGtX6t>O9E%{q5Xsn>@ao1-pQd6r0}lUrf^UIX zH-jHjo>1pQv3~{iU2mK*S<8 ziv9a9aB?Ef0!MzXNg7~63m}Cf7PwMYhSTe)1ePr)lW6Tp%#)Bq8?}g?bi^>0!Yrvu zd`lgu!2`Oaa?ja_*w3$)?|AM*+$89(R8w?GTDP5VIKnXcBM|{(BK5)vv~)?cxujY6 zxItpA7&mdll*{x7EVa7G)tfeT@*trrkCbIuaX=7Zpwf0f?B!TZ&E)iSDaCf?uh7;( zjT-LpD_0@E!2uD#ni^1yo0sX}pD{gc#!YAd;?>oaskuZQD2LdYK9GPnsxX9zG>a0( zI3r%5LKrh<-}fon4M|UN zr6}2iUsY*l;#v6i9l6S=QJWGF9L zG7%B@iSfnh>DrSfU0^Lk!mcx{MGWxj75;MXkykTY>blhgun?z1uppN#r;fI^4O`av zQ8~g42GesK-}6K4f{j0vwA{#wK$AJ~z|Hc`2TKExAlCh!nA4q_pW`us<^ZU7W%k}9 zM>cV&V$Qq98gHeBw{PFRcwwv?%&iQ7V(s@Us7h+npC1qEe(W_%8Kk9kXyWRq+unB% zj+5VT^Tklg0w!hgiz{0hnB2T6xUH(GWzai>9Za=Kd-<)Mm6O^_Sz4Jo#0r>CPd}-L z_GX)uYG}TcDT#4$TRa{vKDtrhco}Di8H9}2r}yJH`sWuV$PJ%8n_o6!gtqn@#)ArG z#ZdQaK8aV$sLEdZzY2OV50mEo@;VD&+*Wo^yWycZs#(eImUNU3gJfXKq@tQS66?WAK4>2iHx%_jj&& zwte-i^RWu&>)yGCU9s1WH5QLI8B?GCUC%nJP;JkEwOi7M7n<&vS2-o*UiYiIkxP8P zU-EI2_V?Au96Eh`!Mm>h&G(lal}we>FZDa67%3zT2t^OwHt6lNbTRGpO_vS=huKCl@ z{Bx0C<-M%x2g=2wk2D+PBW2~Wy?^$gP5YVooM`cG1Et!h`5L&Utj?-dGH&d;r7>JB zrt?zN{*MoCdW}M6O|+&VC<5KK&x2R(cG0#PvO|7|F7Z>krZ3yixB1w#&I7^IG`nnx zv(%Txoj*&pds5_*KhOKQ9e6GOY{?q2%<(s`FF$xxJUR4Zko&9>pK1GyS_Xw*7!cq* zFlckpcfHRwG4t+Oc(oTT*_g64Db(zvT1NL{n~qLAc;fZ)owoL&rc-{=C%WW$?I0nV z9veI^_h<32r?%P2B{fw>q4%XO)E3OENS-`9G_7N8rroFh?X7!9bX|GPOJ9{jxgs#b z!Sb*}=IfQEyC|XjX87yJUNOd0DM{||uZ@>(z3D$DQYuGz?;kClw19?vA&0gq1ZGa| zRl3~RT;$pDy3;k!%Ym^51Kp189bP-`he?CA#<)ILJG>Iq zMrTU}jCUNr!!08trTUh)!$MJ!vVj+J1LnO7uzzl};&82M(9`S#J6rFT&YF4tv-;UA zK^K2Yx91Kc4+;6Hdn%SJZ&6CR7%5SC{A6ZY{*bjce=e6#5n0or@tgo7S~9hziOms( z65>;}7WIwHR=ar3Ea>96AmtUAOY-GZT03Wlo$`w|HcRQQF8aHZF>-#9dR3QXJ0`Oa z{R?R>zFzd}#?dlm$|fAmVP!<0jSCj}U1?X)tacP?>-6c<(F)VXvSTTi0oi{uLf*VY z)5t*n*&D+f=^xdO*;k(XHC5lU|0~xicfQqLJCpy;%5qrAwgL&AeO3sHQ2SGK`KYe! zOv~T+wS9H^<5$Vr;EgyzctORBj1)31~-Q9UOVxrVROg5 zy63k)57EuBI9NiBf}527=FSZkp4NWjf~Q_A?6O}fRb^R={_o zv|_*0&)5wc{*HdxG7l{su3=pzmlVn@?qmB!wEgj!=o=s3 z^f3s^)z?_6-d#fE#WjvB2)a1aY^}Vsxp>xJdFdTu*+U5l#X|edn?kSaJx_eUr!n(1?b^S`Q4M!L6g}kvYCdqMk&p1XE9c?rY)r=tHyT*+^@{QLG%YH^ zGaSj3ogn=@Wz*I%$)|t)ooL-I<6w<_UjFbc3PMiC-v=QlN>n47;_cf8hBvNRx^&q0 z=&~1#Til0b+Uyek!m5(Z?Nb}pZ*9vKd;IKg$R{PSFQx5@O3r^jRebs*=bAizfRZz- zT+unJYBEDE8NGgcwkiHg0I7y+X46HGcK z_FjoT*LAK$-SYH)C(_LMh0<658c%V#rxbF<^k2S<@Q=FJpC}PKe%xtERON~O+~hsW z-gi#3TVL8ESbpAr$D$bhKJODNc5>K>p&^*BJwgDR6rK99_W|Qj$@-yV4@PeI-x)9` z^DRSvc&saNZ!jdx&OrCn81YAB0%SCFjGO?G^nb*UgtiTCd#mKE8d2R8oVtZ%jsKZf zVjyGH_y3Ea`OhDAg%LklQT;kbQCQ@|JP@$irLc;x;4dQ z(|`Y}?Y6z+u44N0Kfl`-%kcla&j0_PZnsS|JE71Sp09JH$Lr?*eiCh$MQ;4>-^P>B znv_$YF@4(U{}m1M*Q0Z-N5SAgoE6_-#P0f z6X?ShTG;S2Z%I!#%W^8JaG`d1;Yk_G|2}TSE9vF)FbgdJd^ZMIefFeaPa_sO6Q9AE zI*NsVLL!k{Y&A)S>znCll5D5Dudu>p3h0BH`{cdXy=b+p(()$X`5Jitu&qS0o%4bP zdpzPTwET|0#v=rNye%IV$UbX|Bk=v)O`S#Crw=&$!!!3R&EI4jY-+Cm%%}2{>L2Q( z_zN~xXK5`Dg18f>lkDkpFs{lx-iLtgkp;J_oX8Tsf0h#*AVrJq!rSSKJs!lS(c{J~ zudWxOL&e2mD7ej=Cpa7?-enL412UGUm#= zcPj!3>b$(toNr5Oh!ZWaHlZS!-a^IdSx|U<0@8P)NqX-dTP{IlK#-xjc5LP!a@gka z(N?Y`W$w}Cc}{xh>Tci0;%8F7>}n}2hQ^E`1-bspm17BwcxcTUJiIS|-j|sr#W=9J z>#w=GG;=tkbq_CP_;Y0RVz|K9=_DVoC@}+Ola`Tbewdr$tT(^Vzjst4&0~AR;&w&e zqcAODN`QG1B|c0pltzOwpOIg`f6tkZ(J=U;qd%j1qocu6KyF*D&0xPcl#tBYenEZ( zt^m6OLwkZedTQGT%tP{EY*YR-g~P>s(g@81Av5{9hO_LjQCWZ8eGn}HgcN34!CheyhN&N^i3>FQnyJY;iR zNEBY#Wr(h>gYG`MbJ8I0O*S^Lf^g;R9FG|*b}FtLqe*oQHPYYsE0~@`{$Y`_sJ6Lm z8GZ@%%dh>Gh7E+(E+7{Jc(Xpt7a&g2KYDxL-}Ds2RCL5t@cuuPqcpbDKB2|;^?h{f zH~y%P&yF84Y#6Z!H*TEBlwyI=`rW#9s`{zQKl^Pq3ri+bvQP3ve192@vhbl;^5|&u zYX2}HrruChQ_FkgU*I|{#=@Yr6+rgc<;_zK5V^@CdsVns@mF) zhQ+uKCT(r+0W_FnLq8b z8Wd?3d-Jtm_s$eOb1938@$DZxZY~lM&rpsYX_@aF@Pf}+4Z{%qTrJ`;V&K5=U(#^Q z8vu}DNx`{|+Pz!dz{hUJU6U154}zW>dhY8YTX%vPMFeuLp&^zh<{!|4hUKG)p-8QsEljD^J~EMc!84kplEdESgwt6J%cONZof z^fMN$a?-)uMi5Oi$uLU+CP!Dgi3c%k!cFF*STo9bo8pO!Vk^|oQ;*m$ruAN4sjgY+ zwN2O?QI5X)iUJd7l!C>kD2)79^|4m$A6lrJBOT`Rbf|SF@rs-+{kAxozA!u;7|^!! z*Z6lil}GbWkH$a{x{3eT$5mB=(`;6i9zm=OLm#eX+;k~z>fbhKm~aBHPG36r*I)~4 z>+V~cjrQl?@0;XNF)<*wH%7Q1jaw-s=b!-B--Sj`4L*^i!@NkB@U_>Q}j} zwU~{dq+lpZ7D4-lOIXWYzC88EKCU$C1b#~9>C@i1&X~^gfD`ywACIHSL>{C$4+|{2 zllNGDh~5S~R#aB*H)X?FC{oxf*3|{GxfX2rVmc%HwXoCCXs=x>m`&y8y5xFF{!nx@ zF)?A&O$MZ98dvyTZ$QjDxD-Ug^oTSI3J8EqcKq5pu6}_K0`^39E^KoqB|h(Gc`jVY zx{~Z!23euL%;C@GomA|sI<7GA-`q6qE~LJApXn|uOY5~`N7wMus`xnGSZBG)0wOd3 z1R=K+#h<?1uhxS9#5Y2RNLz#7OsaTKq8deNz)1f{)uB_8DG4@GC&6&~~i{kpUqA z8$3Q_vi}VB$o%5qA@5w=I|m0X!hVLCFs*u9_#q2(G8^t58o$up-RRCec%hZin%tD{ zE1Hb(h{2_sq&Gq_s#uzkM}F{=Q72%XU-d_W3yQG-c-1_-J1n&7IokO9c*6j+&nN^< zg9q3IILT@B{uRTS`wWR;hLzk!{#m%bjxjPr@56@<@i6LNZo*|63>Q7Jd5gKg0)Pj! zU{m{RmN{+GdYDKI%-O_t=4UGC`Zn>7uuhM$Fx%7bB5VOh`V>0c6QHf9-OdT7Rq)hS z5&|Dynl$B@Y6OB@NQt zGFzY#fM{T%$YBEM>QTOLuX7S4AakLXm6SBl)=`Nujhf2g4d{72H!CxfZw^H(r~2L| zTVI1jf;Xsl_;n&3Wb*pX ztR~nE&79TLIPFcxk4`yT4aa6JGz6+hYir4zQiHK$uRR;FxqqQ}-I% z7DBLupv1AwI`hR&h6}>0PyEW;w{D>Vo{I|oT~#u-W#92Dw)o>DAnY-=IXF2LkJ*A= zlyZdMP!Pw9vw0xwxCU!dc=H)vd~2tkrTu0F&WAI_d6u!13P`xkxnj9<*k1Q4D>KsW z;#*Y%dy*mKMPwelm7_?_Nn^tG(<_`6{|t?(hK4(yjRL8UixYbpC{|*#esNqA1~0Qq zJJTKCsZ2-YHv*{IlAQ88B;PkI+|6;RV%3=ZIjNg={#LmZ_GeQ2xF3(lUNU9A{HhvP8MZCecu*oL!LD|0yZ+GR-pdNBN;~lwg-#xrDAfvH&g!ju2^qsh;=d&hOl@S=f`M$g3CTm?LH1*B88J zIzjc!f}0Xo6lRs?IVwS58WLirr{~5R!z4p6#sKZ(;7LofoDWPN7&tP*gA*?+=rP}^ zlS&KTw7q>by6{O*HaVv#9SXl2N*F7usEkgSsamW|Z^&loe!qd`4hLbnnVB$dFa9*A zYuG!y{}3*eE+49|AHXsc2Go**$(~6{^@^Y%gcG%X@~hP=u%b;&_?>d>7#Fdp=YW+x zd?o4Tddh62?5H35h9VSUQE4^_CFjtfAQz?fYELV;i_f`TVjjW2>#53)DP|@MOxRUMG!zifu3tmr{P>YudLwrsWe2B{ zi8xgi1c!igPk0Nb=N6r=KJ(zg14eac6TU#C&MPRu)b16t5fTE4s^na3o#^T32M2z! zudn6tTKa^?LspfNBa!KdjKe6zFGa4c=Z@54$HH!V&vkL3>j~4yaGD17#@9DXdw>^*XFF8G!0KjeL&b(N? zjM4&r;04xe)}?4VT!D9q9~Lol*c{S7Kr`5k;XnMe%CS_Jn>gN}<{!{=sVP1qOoaYX z@41=2WBw5j6zJC?=?&={yGG%_bIfd5i z6{XiN^k$M+`u(Zn8WVKqkfh!xz#FKoUD70i5HH%}mj1f>w@6Fc-yB??I5p2CStR>S z`iC_zS&P4KA(FW9i^Rfbj{76MLkv>{TFmInJ9b>>2EihF3bS7ycbZ}@D;OPNw~Q68 z^1mSLQ!>|#+-J29fdbSHOcy;=$C8c5ri?9x?q6BW_cI%5*!G<} zf5H90JSnNsB|!bab-@cp4G#782NK41MYmOW&*xCZ1c z!>FQVYq_@|4Tf13&`n7g8x&8aGqql7&Haw8xWwYnxjSLEK>*0qzQmaeixNeSyDDyP z_Zfd9$z?>#p(c1r*BefpShnhEX{iS_PUHj?;^zd*csOB9AeL-BEm5YAa+c%BL-jsR zuq_HwkqhBe0aQ)yO8FVFZCfvi+<+HXlv|+HadGgqIC?`bM#sj^0^2ug#ax9t4)G3u zC=?3V5P(MQR2m8@sU%a*%~yFgmCedG5e(pSj9&*BQg0GbFvR)6$_mu(aW?_ZB#f~> z45{gIhXZLmV=!S<$uvbnL*!)`XS!LG`VJ50fPjECYtH88enBQNVBo+-qk4yzsv^=O zZR=yb0UT;rMbTeHAnFDf;_~xyNbsb}-GXu>-q^;6&tMp}L}%^`ABW8RcCFh`i6}Su zK7vPgYfYxpN%~`-`S36DCHt-MIcS@e<&a5Hf%7_!y7zpv7E;+E)aH{N!N(>pF7-7DX&$^GNWB}NaX9s3Be%){;`ddW~uXKF*SU~=oigG2VZ zt2}I+;7vjdx)89bu5TL%97_92y8}>cplOW6 zF2xbyj#N?CyyN3!BF)0JZV!mrUeP$_SJWx8bo@J$tW)y1NXd<+IOHXR46Yd^oK(%X~}ju&ZmsSr6i@Kc$oi5<#p4Jr9e@rT)K2AQ+UN* zy}}#M9yl-uFXr(l08s%cXrHfK@uaDUTxa|0%^MyUC>eNC(eTgb+E>2CACD%Mc8bUi z(qRaE;a;J>QYa8`LN~WViHTOnYY`?A!RM%}w0r!I`&TO}{&IK#J-}(emW(}LALvC@ z&dx`8b=}K#?%d7PB{YfG0xz6CEhH9?O89W*?v!p_yV6f%=>}vp!B~N!6j6X~ga_;p zZUh(_8>al_bm!dqr@i7F_j@OSc2@l6(UT{aOjJ6*SYMTG8D4-5TM@PRE0{X7VRZnx zD=dd^#Qd*o80>F~jKLkf00b2kCDyKiaZ})1tNm4)-V*lCkZoo5nT{-lo3EpKkJg6X zHvGW1H5Vu`%br*$OviMNs>#9LKAC)q@86;SLMoqjc$~X}`#s7b^I5Z1IE^>GzM+I3 zl?ucuRUtI(97hb?H2C~#MP)TLU%AQZ`iSoIO_*u+t6fM6fE1+&?KDxbXU`S5d7p@s zcw>|^+<;|?K#q)ZY7it=N@GuOEuL{c#qTNGOq^E$JRn@q9ok0d>O#W05;tU)Yt}_S zA0GrxteT;juHB`jAJQH3C@XJ1FI?JZp*26n*M z*&iJ(Vl3l7c0C`6=83Z*Nxt7$|9EFTw1C4u*m98=75kUiq*Kfd8Dgos4{{#nKt2+! z#A1*KE1fqd;G7%iuh6Bx21$>P$AZr)rMhiHCp9OIeDT=79=M4BQqcH#=CVt=SP91M z{J=~{$nW}VKD$RAnDn2VX1o4Z*-xdVp}WsS-+YbOLPrsD46_z&ZENKBRHU3Jriq2O zgp|4Dl82|~C^*(9=2#%h<2`%iHLf^Eg-@MCL|(C1Jf2d!ckO~SFjKqNgep#?G>3M| z4%xCNPoG+T+DpfB0otY(>ERPkSSn~gVNgWxuxuG>C{5*EkNjKlKy|+;det+~-~SZh zA=N%mbHEkqcNH6HSj?P>7mG->sKf|`dPm)R%ui^kv|MQxXg#qcWz`H@F%qEvGRMdG z5Q?jix}IL*!Y>=Qa@DFrXT8qK>XDmw9XT?e@RW1Cu>*UD1DnM>uY)W*`_UVIv^@Sv zGg9BtE6t&|iVCrNx&z7GY|t9cR9anv_{*=C~>^d?M5y!kq; zR^rD=$_9dDx9ql99S}f;SwHqPI1=|JS3LQKzgyaTzI}Z?gVLus0*SapmoAWMx48)! zs+5kFp=EfL-ng;zM9Df$t+N6V3 zeYcwQz}lX&kFo@>2*Jb&Y!c)L%>jFRtIME?6FUG~pml>(z524I;j%A{U1Q_4mAwaw z%fM<+ym2Rovl=*~G3nFeU3X$>GrJ`SDSC$47xt^0oN>BY09b(su=^(YM?u(Ny%JMK4-y3lx_xy zt~ea_-uB*xD;6;CHW{byG5&Gf2xdw%gq*(Ii(nedz; zz2rRlz(I>`dD$DgMm-96fQFtsuEGYfBNi?x8?O58h*b@dv2=`OSYX5pptnhwOW?%oTaq$&4E1mzhp18V9-+(d8J} z*4KvxC7AVrS;h+nA7PoyZCnX9+6LMOldhE@T8wZhFL4=kWOEX3-T@4=xa%p#ToTw}I@@hq>7E(ATe z#Cat;y8Zj5mO`I~Px6!gLy#_mNO0jH-9_Vqb0f4{)rcMCFDX>7RaAhnJj6F&V>?Ts z-^5j?AWmSvcXcn@_1!xkF6P-ModBi<&jL_6P#RpR2@0hVZs*kYHK=FVkfw!n`AlBk z?>~R|zm#HF7F^%97NDwOWexRw`jO890!gdSxPj_JODk1rTK%o!fr>H|a~fHDa&rUG z8&KaTIcpji0=EHCmNd2Tb%j)7>0IXvl%xQ&CI=~vz!~wDlUFk!aE$TQUw|sdgMnBZ zaVVgl244iX5ui@E)2NbB9A3sLQTyO+JSxcu(fUxsgbR0NurZ+VN)^bnUwM>l2dV{n z@Cc!q6DF(E4jK(l+`L3=`50NL#sdpBgmQ?Hl5&Uu0bqt;IIM4XhHC7WlIM|rt1|Y^ zrII%@iy+Hwh%8oSj4wIf9U6*=8niaqRgCom*!~dZU0lOBpkoIJHT>~_A7X|NVmquq zo23pPz@Niv2mGbNVQ|G*ibmAeK52mBoU~vdCk9lIl`-ar9s5tfv0GUmPWqo12a&Qvc`?dRD)<1@A?ImO!=98AuaXDKZUDk$w{z z9O`U#m}(^ZVmlDw!ShcoJqJrcN6|{F=Wd5LXUKC=3+poP7hD z?OXWjCdxVH*0`o{0#J@K?gSX4E~CSo)Xz4{31DPeZ$aq{mQSJ__iJ%+G5-&ZFTFOE zE8^mZ(MH-^IdoX@^q_k^?HnEJ*ieklsLP4)WReDo023a8Ur1vcWgahw0)}ddKVmb> zEbOM#zhUjLAw#<2^_%pZN#(x%`}sH+&)X)9l2k6|QE|D9Ot{6-KrIVdSGZs+zA)dN zr|1j>2yjozqJ}h#d5%=>ER$PVMjG46>wcI!&@IYQmqr2-J?~%5X=A`hAWiZ2r!zB$ z;F*8-E)i0mMn)o;^TO({M{ns zmAIhd0vE+2h^Y+nuB`Kq+@>wrf8{GeQ$tZeYqS2Z}LQTG41 z0FEzYYlaf-x?ox|V{Py;Y*&Z}23<|z?pVSp`7FryPC_n%xvUbTS z@0boFAa(RAP(1Ked`=#TJkhf3=-RgP?d#Vu#cOcEQk2QOu1M}8$ju<-T`^)OS2B?1 z2jW(_IW^h@O(BLORLLuGX;HWVbsUe0Gh8+>vAcBXGE{LV{iwStHiA>4dvI6@GaO!^ zVEk&(V;WC^b3;{DN^gG4RS0flifaVwfX(qTxdlH50%(#z?$%g- zRsR;Q+Vu7cqs~y)a)g$=*;3I+wejlpYaZM|f1c_ekP42ty&^FuzLQeD2Ll}R)6!)Td~1}hu4lZhNk+y!dY4B$Z+y?5ySypam;rsu zaxf$yb%I6=NmBmDp8B%8wr@8?EXmO{H^#*_*)GJmhkrx;bD&wir43g&*BhB=l!^lW z?yD6A17~K?Ozl}6dML9AxtrDF_E zJ199H6(j3`N=iT$w!fw`MA$jNJR6XU4vLM$p)DsZ-PU|E+sN8-pQ%ul05t(z^fwGJ z(%mNjI{lUh%rDayyo-SK0Br{P#(n+%U9jB;Rv|_}w3Ru_N&Za^QMeTih60C}u`@Ot z3x!x?Qj`IakdJeTCO;nc-HryTF1R{?lsB8}z z*}x~_!;~sK#rb>>HPieE{loknRSbAyV~wj-hbV;9N3&12{_`-DDzl_j*b5K z4X+Vy(Rz~i3JO+QSy93&e3(RGhGenKLwMed2;gJ9p%!9nUOdB!e9-UWvQjB)FV`1R z8URBKjlB-IKW&pU;K}^?Hcu0cBhO;y^mGpsVsKwBO2$)z4%`I9C;v@DQRe!bw&jcr zO_J%8_U=JzkCTMX2s*9TNeUS!Ptpi6Xic)`K{;{b@@<2k|KzYX2~lhBx~qJEw3y@D zdTiCWX{yO-H4sE)z!FA}FWC!O{19t{c(PObK#zN1*W?2xHG#!t~O2rbDcdSw=6(m-VR zHrCc-=ry@i-3^#?@aEp4D8UaCCly8|oVg$t%-~j2%LE3BHi{<wB$u*r7FH5ZRZ@Qnl!H@`i)cRf|y)UKPDcoVceXITaN-S&81xd%l zF=MIBnT7`j1=Z?I-O&2M1xKS@PDArbxU#5Ix-Xpw<d=N1WnO%Y zU9_N5DrqekQhS&8zMboL?A%#QvavxlO_y+mAY*5wYND=9iv5gi8lM}VuOdL`GZ9LU@_7Q~3Fv*tbs!hrT;^7;<-&mtUSan95(A;#s&^guAC# zoRNkhrcGF{aMu%o;qggJQ3hl4F>cGCO%T!W{K8s6gvRfAR9`=~ptD)*N0aB7M|7CA z%a|&c26jz-UHEvl<*OC#bQ$auh=9rVIy);G?K`Bje<{Bvsz~r7DE8R1y)0h%~%c>q1{F7tP>jd5lHhnz;On?-u_bpx;!Pa7$ZwAWbqcv5UAptyGS{W81P>g%7Gw09L z-=D>MD_3}*(X5zctRT$VWKz(mhZ^N9dpeA{~@TItjy-o|6{6RLVQDH+Y@a~*B$JhJGAy%daL)TkIwhL={*!lYXcFd|2 z6`7fxC$}`JIksEZhRkI?sAH$y{8pseyEnDfV|=>zcW_2wrP;*tMhO~z&VUp%_;w4+ zwWPzYdqH#ATlRv@t5a+FNBP-0hiL*H>U0vEzkp~QelhEES$%#Jrxur8c_3b<03t>f z%0KjEwq5}pyn9!^On>+RQnoWxx-~bL#kvBQK(1Mas5RAga)bx)#DmX1QWpE(4YoNr zDF^a2=K%GwmBLlPQ%(PZ$i86;f!eV{_E}y3-Oc^-R#|hkj*Ie=QH@lT7+6Q|nYHky z^)-vVf0sJe&(cv8zJ=)>_*NK{(5P|tHCWbFRk_n&DM)MdF-SeVr9L6YE~YxhuV5Xe zQLC;;U-uurJ{cV zI{XDhYte*IaE&pS3QyMbePMXVYt+G=NU77nKtQRPh8}w*203!zbUMBQd zp(Z;pAWY-X;lpE2XJD&1VS+31#)l^q47q5_u{3=^JGgxPkXN1IWFAHFRx$dP+&jcC zh=~qJ>CfhSyIgyOU%h$rJw+einybB5bpZV%7X-*nxP%~og!}h``;7ftf4+i0V7G1l zQm#^eX=Q`#3g+}Qao&>>I3on=$2`IA!_O~o4;?6zI4X|4*UI+qe<`+jxnGQoY#E)z z%8R0+jwzw8S=vX}wjHb&>DS@(Zj^$m06t>&q*C#PlB;0W)01yPU)t4OX%(@ER*e|4 zj|gPf?lFmXX@JLm{`z&my+JKqc9rK*{TCG>CWkU(J7Y#|<$iKW(|cGyKW+D1CE&`U zTxW({UadOP4pK!6=E>>ASkS=y;Wi7uZPuX|xv3^2$z*vqRB&dtv6qrhOiJz%$ zc*+;|Iww0jmIod$a%m2X@sWcw{r-Ay&I03Rx1LPlX-oMJ3kca6KRMqbRPtr-_670x zR_6QR(!6vj`6rH`tF6au*b{>PsFjr~q(c9N8Sx1TF*_&8mSOwqHk?N8nXIf-cw)a~ z?l3mqHa8QsW+_Hln>YU@`6e|j&A!)9k-DTA6ApL!Dqj$SHHa9ZLgpT~QIL>s1*ElKSrMQG}yd&s-(t+%zOI`MB2vRk`12FH!SJJN!T08yCC{) z!fNtF1>tlkxrc2GBJ}n_U3$Ybz-O{iJNWfN)sI_QT{fbUJrzTT4AC4R5hgSDL`tfR zJ_kR2$$Hf1u=_qZQ2`O~ot3o-P*L)Lvs5@}QKqt$ z`d-)P`YiDuE{HWa`383~lv-fQ%I2H~>|w^=71L)V*=UxHOQS~sq@(fWB>Qc7Xz;BT zt8B+x;-}nFHm^jOLA0Hw;DKT1@&f`SgEXwPKayFHl z?C?H_>YCXG`q&{>K8M5pSW7`oE3N_HkBO;G{j5AtDxoScI9Na7_k{0Tx1Lk+8xXWo z`guWZfNjR9=^p#+O~+_ff}~NG=4ff(x?lDd)^_XIA-d|dJvSHyKjY$K0=N94JT6eCX zsi{dIzu{G4uQV&sK~-Hn1j{*)0)Z7=Yg>~% zq2%u)n}$nN6fjk?kLPuQb$FCdme+Lp``Fm7X(Cz9A|h20c^i(1u{*+Ha3rMfo+nRFwnUg>>VU7^I`Yb7|1-IT zbwfRMEIq$n=D!vx=#LVrXw8!1A7caKZditGib#B~{d2}pnaj7|%1{b7 zBLAkV8qp$)Dd%>2sjfrsf%dj+*^)J}!M7s^ZUl`vZ@*VK)D&1{{(spg8DH^Y#dPe> zumy6Tk<1XO25B$THCtaHCw={|DNlRY4#A`#N0xo^gBf}cWb~94lND%d+wbW1Z>$7x zP~nZuS~TeD(d4<}&);aMEXB)G%<2&SfYZ{A!D2cb0z{`#Gna*vw*{I=4@ zUCo`&V;4}od>DAd24;>mYeb!;&jZa{0~H1hBGpjx!<1upp2x~(^K#nh!mN>7AO^=v zPkXw^-FEMAgs1px&VTaEqZfrsN+;+ice+d@n)KAGCF77~sDN6*I4us9hI3@i4Z6VT9(AK#&| zpkGtUQOACpf@emYrqFnK>0DC&`KHZzRe(DBw7kV2{=b77$h|7#vj8B8Aeq2wE;gC@ zXVG@AynzLNtKBn7Z!6YVN37vmolIlZ$4m6?cYmdy`GcY6VmPWXo{)&CR&(<*0;B_d zfZis}8!IEhmQ7K{>mJQ_NmpL1&YRX+=kN{t z6`K7L4@*qxq@|_1jYP{H*f?iQmeG`?&9VI6`+MQAqt|5jfqZYRZtE{8iGC=2cMnD* z@IV+Zb)E)wHq=&C&02g6Fg58x2-@1;TKd=G5UTAQMXNA|! zgC*O4Icv$9eXV>4XxWO2iv!|gzhuz!vX7zpCK#-k0mfeC8udenS`D24HEn!U0WvZxa9VwPn!}Wr1i??3_2+VYzRo`KqX!vHg zB&vn%aqUi^IDpV;nRz)t^Hb(K^w{0 zBX$-mW(|#jJ%6W_(W(O4XK?utx4J6)Z*V<$2X5b_pGFby;#v~ z*2f{mnuPCws>(BkuE;OM1145%cJ2(D5q9zdJ0I&oW>(A;iCqTD5Z?08s_2-Q`+$G3 zu{F>Gec`+&RH09R6IFooL!n&Y;AO+h5?!EimBf3d&);b5SZSirh5*W58TkBf`L;DerI)sldTkI>AG9V?jiq`fVo zbe%pez0jyoPS%n5I`z64y0z?xkP)22&mCT?`m{4voFWIR)630D<_VdWz`0;9XS=@p zy>_TLWPZnT^WM1FQFf+Ec4G}57G*^nxL-b=b|%bYhnLFY(&JAu<=vz$cDW9noV#_* zM04XbB$!8zIJ((q%gDI8>^q|9{!uJmPcK|gzv}DL&C~9cY}HM3eTe6ahNEL@a`HQ) zPrpC@{{2cU-JX-YtD9R0TprBZ*vyrujHE;jj^V_z(?vxK!zV&oXpF+PoWk9&1mUWySrlws(D;YXASw03z%y!|c9<8rW z`o|_R$N3MQC=h1;#YufF&@vAPbd`#4%dz-j3r-~gJS;7>YDmR|wWg{HxiYwHW;S z?_}l3*5#vgLCZE#eHT#u$50;}ZXcrdLLdD3imcV8^TFok=0eyM7zFdYvN9SItkxk^ zaiYWoZG)1@J-)$U#IaZ6vHAJ!Q4GEr7o=57R~3H=3Qcp(DK0A7Ca-zv0z|%Ojgeq! zlm7`JsT}PYJ6<`XtKdPH5mu#6=Z+C2%_RAPb$jXO{Gy^jUW{9BoelO))<_NeQUlaR z+r{YTWZ=Lj2n^Koi$n@G0l5k-y8x)&dCqi2i4ZtoQzfwV9-2eEn~IvJ9RPxyC*atp;o{k!jgc;ONxfjYncPrvB;vLU2hrYl0J zB}yTrVU4Er^HFSiK8HIM3VFp_mp&BL&-okH>vI#-O8RmE_VSy-UZ~fByF3qzdo~VtV*SxMod0-oN_?Dbf z4NZy3`0*ot^XqsUj`k6Qn+;?lZ$IJ9#j+ty@9 zL{zXD88BAi%&zmBq&`c-aZ4n-J{Zd3g8UJ%&hV=}=JrBGpev5s4HLHjU_^Fw|iYb8*pl7otNb4-)>>c(7-4dw- z`2S-br(gzO?xv896TpBsxc)54Y5G5t?5l5jI!R=+M2B%BFvU$P) zAn?n*R#U@ik~)5Q|M@$LaeqaZ^Lop7L284X{>kP+cXhvImXr*g{Z;yz%`J;JE2uA^ zN<84m04PX7Mrs&yPMPeGBE9}T9Xk>LOb>VyIi*l#V@~xCZ*s?|ESDF|7<)9Q4A#_~ zijWZwLAX_E+q#QP+(djCxfOV^JQbe%n}@gbem;pK=XRT_>gt^AY`i_D?N9O?;Bt#e zC71IXCpK;a#gTUU(fo<(vP3yk51%~o!j+Uk3&*0Q#Kc#PXVrGOa{tj6c!FB&+0r|5 z^yrn4$yn47fR4F39?CW|SNjiO#vePDRgMM7{ST+np9Rwf#rKoGbT2^|#prIeK9qu4 zQ2DU2F>lBvM)0p7#ySUHae~uP(iu_?S`TU&-SfV3B%`&yp+V-?Wi&#=rmXX!5MX=A ztF>D+d*)1;?KT_UHY3dFV@(Abr+;`;_os{BQg) z%cKyr!r*Lp*=xIT9e^nNB%U^&%;aesRVzfIWL>rA8$&`I4w?MN($X{C31#22wzhz# zbBUeKjnIVAh9Gxuf5*4Q*l^$fZ%jx>ID8~;;{%_bzLkol5@ScHs}SL&+Z7b7Hgyr= zF`d2Dj;T`zc-pfZBONCW9T_6<{t!86&vB>y9{-RU%*dk`T zkQg48)y2+(cioD;-Te7VcF9m#pldN%=sfZB^(DQmjz~r zW{iAK<7K}h31kVSut)!l7cZl2^L2PHEDU&trWhX}j)$H9X2bnoSVr=MV%uzo+539J zDTJj2J|u7efH|2@gbw+K=1K!?ZvOVE{^QD`-&mTwrv9SPv+%hZC$RqY^=+qFx=F|N zb7O{p;{tpRXa#GQI@ju*^TYXeUzHE7lyi2SK>Ko+HJpOH9s&;pI`$L#a}VhuKQAo& zLGKApNc5O;0%B~Xpr!mGOPYoeF{TE+)SXkKRfY*QyV8%=y z#kjKUYQ(YGy4Ob{T+H;Hj^EjwoI#_Px7H2JnsorVPq!?C20`IV{U-D^I1nk{UKiUq7m{1>mX#S6kzp#Kc9s zL|gja9mYmi2;4b+n#PT74euo-pbHJENJNsw!JF+7g9siN`6Auxc{iqc2$QeZ*2Y)2 zb@%k*8<^-|iZKb-M@%(nQL`D{L;b1`K-}r$-n@Um?W|q86S{(}!__yRd4Np`<;7{R+$>4jlOO!@nbi z1U;UOTEu=Ic!F6WVj93YCpA@md?i-jrSUq)rG}M2ga=Xs=e=?DY5`4VVIgXsoV+}~ z9xf@$;})YT7Nwe%tPK!7!QJ3QU1W3@>L<_UyyuyzK&WW+m2`b+Yp!7*+>uV+(oHef zwQGeS%PE1;Eg=j~hi~TRth zD>qAbp`S1IQ#%RsWVWG!0aFa`vZaY2gq8>|t*)M<9|nI6OKsPjQM*nKxbWr0m}mzK z9K%#tv*oezQYs}#XWJ<h}sgG{5Rlj_;T~N1NAKi< zPv9=RqIfb^KU%LPW~5qOQ$q&>D+$pGEXmeZ$w9W=-jw6%*fAmOnW={!6<4e`A3luw zD;oF<*NvJRH~y^hK@4LWIznyuvqTQ8xbP2g+t9lG7VKNoOHyDnHT-(cUTRS6O!R4fnY*RT54+e?lH z`r!df!n3oVFYW7AJGjKEWrPa8%zLVYZ|DygF~_5-d>oTZV{Ou{tk&SrPubg=tNX*y z4qUM|XAorgi5a)Jsij z&hg{3bLuyLY790vj0KwGZC5-KwN|=vZFAywov&E*c)d=x&tUbO>rqm8@wgU_=*Gr3 zE?qhbD?6tig7(LAwgANN0_c+#ySTK{RiGTu`sv=}Wh+($VbDvXn2x}x;;H8J&B?hf zmtc`BJTUbhBUtM^<|&xkcp09Ew9lAtxc`lT02&@<3nx`~%>gDG;vh&`Z`?lQWWSCG zH>j|-*WGS|jlc4v3~XgC3%&-NSMN$L)G3sYH`~3_PS@#m*`JpbhCB#=)gQI{}#Np7!gMe%AhDB^#IW5-a6JTfjzG*OHW? z<3OL}?&;ao*hsWW2iD3Ul?s0a14u(`6g`XxPnP-CZ05;}iL3sGZrHwjRR={l2;3K} zGcplpNNrs7_NQIjsatC@FkWI<;p(nlY%K7$#j1#yXu_>_3y%MB_r)!ya^&mvo@0KZ zL4=HSwdE1I***p-l<`-$;RAs4nf?Sl=#KR8#0RGLwEydrEX|BU!-$H-=A?e4Hy@U3 zV9Xph;ssq7QHXJ~#i!(f+G)8xLswYj{)%IQAE8b08g1<{q~n0Mg)uv}sT!Qr zU;+tMdX5&5G#TlU&ae|r(OO$!wVIC5-gj8Vf&EoJiXjj`kW1-Bo&@K#k=IFa{LTuU z;y`EIfB#ap=N;90R_RXg$t3=ckExuSQH!Vr?aSUhogE!!I9vfv+%QG!W!gC`Dl(Ec z8Xq0vUd?du*VnJG^C^8`{H+-ToH@Z%Bns1(s1Ol;MjQs$Gua*v0H1-#vLZe4g|Zbe z)G`u0QqY3~MYA8JB?lSqUXE2t0UT}|2}BV1vRSB!KUecos8jQ6WE;g+gr9leQfJw3iRtKs9_zrj14_HnKB-LD7pvgr z>`o3saIjzT1JAU8l&86}rJRJ&j(u7YW8?@enuy1F9gXJ4GHYd*Ht*ThKm z<@u%&qWPKy=iP&YC+p4mIAdHVFO}dJ!6De>dBih{Q-=C3DJi*$D)IW`b+Pm}5;mh; z42wURbw8Y$VfEH)+#erB!@irn+1s`~KHYg& zr~c%Dl^9wQW%?|r-&YyU%BN8q+aq#Wxb;_xv9pPm$*zB)U~#`+|G}l@Yc)T%k-K#g zKQv;pdS9*H5;6E--$3&Y$%4R05afQRv`v%bzUizD`WM9#7OOiyl@2dblXEvKSnzQcnPnk`CtUwjJ508FYGZWW?#R54;s)-Pg%2H$&{oR*gU?&D+2Fu^l5`mqJn zk&D5vQ{9Z%OPa-R`11A*+QeMkMu-<9^vc~GIu!W}5seeLjNYLJ#>Rvzgeo7m)!Dp} zu7d;dam*HNiSQ1!egnLey#JzogN#p>!H^ezUsfo|RH?;<16WqYT)TC2VPsC<#oD9O zg8~D6O*9NfY)Z0o!hzJPcY|V#oqA+w(a->T(^s!v#m$)Wr#F^?|N6J~70K#_)hCG8 zJy+Clqor3Y)v(G`@bwCRRvR{{;Qtua>L_YY)HYf=>nD}NMm>*$0jW#gr?%Vu_iy_5 z&-RWF8S^yYR+dEg@$eM!-jP3iB5?3LCVTg#*x8@<&))8>er~Oo-2Yg@{=;k zm!G!IbY{q+X3JK58D3g0l3ho%3!<~(1>f}eEdT4TY985MAzeUl@9q|}-9yrICY#2X z?XpR~^*oR^a>D<+@V=}~pT$)F?=O(39i;8>{~c??I|gab5%cqk@iGVn8~WdWpTf=W a;;&9#zjgMJhlLpb%$nh7cf!VN>wf`%>059B diff --git a/release-0.20.0/docs/getting-started-guides/aws-coreos.md b/release-0.20.0/docs/getting-started-guides/aws-coreos.md deleted file mode 100644 index 513878e9f7f..00000000000 --- a/release-0.20.0/docs/getting-started-guides/aws-coreos.md +++ /dev/null @@ -1,220 +0,0 @@ -# Getting started on Amazon EC2 with CoreOS - -The example below creates an elastic Kubernetes cluster with a custom number of worker nodes and a master. - -**Warning:** contrary to the [supported procedure](aws.md), the examples below provision Kubernetes with an insecure API server (plain HTTP, -no security tokens, no basic auth). For demonstration purposes only. - -## Highlights - -* Cluster bootstrapping using [cloud-config](https://coreos.com/docs/cluster-management/setup/cloudinit-cloud-config/) -* Cross container networking with [flannel](https://github.com/coreos/flannel#flannel) -* Auto worker registration with [kube-register](https://github.com/kelseyhightower/kube-register#kube-register) -* Kubernetes v0.17.0 [official binaries](https://github.com/GoogleCloudPlatform/kubernetes/releases/tag/v0.17.0) - -## Prerequisites - -* [aws CLI](http://aws.amazon.com/cli) -* [CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/) -* [kubectl CLI](aws/kubectl.md) - -## Starting a Cluster - -### CloudFormation - -The [cloudformation-template.json](aws/cloudformation-template.json) can be used to bootstrap a Kubernetes cluster with a single command: - -```bash -aws cloudformation create-stack --stack-name kubernetes --region us-west-2 \ ---template-body file://aws/cloudformation-template.json \ ---parameters ParameterKey=KeyPair,ParameterValue= \ - ParameterKey=ClusterSize,ParameterValue= \ - ParameterKey=VpcId,ParameterValue= \ - ParameterKey=SubnetId,ParameterValue= \ - ParameterKey=SubnetAZ,ParameterValue= -``` - -It will take a few minutes for the entire stack to come up. You can monitor the stack progress with the following command: - -```bash -aws cloudformation describe-stack-events --stack-name kubernetes -``` - -Record the Kubernetes Master IP address: - -```bash -aws cloudformation describe-stacks --stack-name kubernetes -``` - -[Skip to kubectl client configuration](#configure-the-kubectl-ssh-tunnel) - -### AWS CLI - -The following commands shall use the latest CoreOS alpha AMI for the `us-west-2` region. For a list of different regions and corresponding AMI IDs see the [CoreOS EC2 cloud provider documentation](https://coreos.com/docs/running-coreos/cloud-providers/ec2/#choosing-a-channel). - -#### Create the Kubernetes Security Group - -```bash -aws ec2 create-security-group --group-name kubernetes --description "Kubernetes Security Group" -aws ec2 authorize-security-group-ingress --group-name kubernetes --protocol tcp --port 22 --cidr 0.0.0.0/0 -aws ec2 authorize-security-group-ingress --group-name kubernetes --protocol tcp --port 80 --cidr 0.0.0.0/0 -aws ec2 authorize-security-group-ingress --group-name kubernetes --source-security-group-name kubernetes -``` - -#### Save the master and node cloud-configs - -* [master.yaml](aws/cloud-configs/master.yaml) -* [node.yaml](aws/cloud-configs/node.yaml) - -#### Launch the master - -*Attention:* replace `` below for a [suitable version of CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/). - -```bash -aws ec2 run-instances --image-id --key-name \ ---region us-west-2 --security-groups kubernetes --instance-type m3.medium \ ---user-data file://master.yaml -``` - -Record the `InstanceId` for the master. - -Gather the public and private IPs for the master node: - -```bash -aws ec2 describe-instances --instance-id -``` - -``` -{ - "Reservations": [ - { - "Instances": [ - { - "PublicDnsName": "ec2-54-68-97-117.us-west-2.compute.amazonaws.com", - "RootDeviceType": "ebs", - "State": { - "Code": 16, - "Name": "running" - }, - "PublicIpAddress": "54.68.97.117", - "PrivateIpAddress": "172.31.9.9", -... -``` - -#### Update the node.yaml cloud-config - -Edit `node.yaml` and replace all instances of `` with the **private** IP address of the master node. - -### Launch 3 worker nodes - -*Attention:* Replace `` below for a [suitable version of CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/#choosing-a-channel). - -```bash -aws ec2 run-instances --count 3 --image-id --key-name \ ---region us-west-2 --security-groups kubernetes --instance-type m3.medium \ ---user-data file://node.yaml -``` - -### Add additional worker nodes - -*Attention:* replace `` below for a [suitable version of CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/#choosing-a-channel). - -```bash -aws ec2 run-instances --count 1 --image-id --key-name \ ---region us-west-2 --security-groups kubernetes --instance-type m3.medium \ ---user-data file://node.yaml -``` - -### Configure the kubectl SSH tunnel - -This command enables secure communication between the kubectl client and the Kubernetes API. - -```bash -ssh -f -nNT -L 8080:127.0.0.1:8080 core@ -``` - -### Listing worker nodes - -Once the worker instances have fully booted, they will be automatically registered with the Kubernetes API server by the kube-register service running on the master node. It may take a few mins. - -```bash -kubectl get nodes -``` - -## Starting a simple pod - -Create a pod manifest: `pod.json` - -```json -{ - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "name": "hello", - "labels": { - "name": "hello", - "environment": "testing" - } - }, - "spec": { - "containers": [{ - "name": "hello", - "image": "quay.io/kelseyhightower/hello", - "ports": [{ - "containerPort": 80, - "hostPort": 80 - }] - }] - } -} -``` - -### Create the pod using the kubectl command line tool - -```bash -kubectl create -f pod.json -``` - -### Testing - -```bash -kubectl get pods -``` - -Record the **Host** of the pod, which should be the private IP address. - -Gather the public IP address for the worker node. - -```bash -aws ec2 describe-instances --filters 'Name=private-ip-address,Values=' -``` - -``` -{ - "Reservations": [ - { - "Instances": [ - { - "PublicDnsName": "ec2-54-68-97-117.us-west-2.compute.amazonaws.com", - "RootDeviceType": "ebs", - "State": { - "Code": 16, - "Name": "running" - }, - "PublicIpAddress": "54.68.97.117", -... -``` - -Visit the public IP address in your browser to view the running pod. - -### Delete the pod - -```bash -kubectl delete pods hello -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/aws-coreos.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/aws-coreos.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/aws.md b/release-0.20.0/docs/getting-started-guides/aws.md deleted file mode 100644 index 418cdda1c79..00000000000 --- a/release-0.20.0/docs/getting-started-guides/aws.md +++ /dev/null @@ -1,102 +0,0 @@ -Getting started on AWS EC2 --------------------------- - -**Table of Contents** - -- [Prerequisites](#prerequisites) -- [Cluster turnup](#cluster-turnup) - - [Supported procedure: `get-kube`](#supported-procedure-get-kube) - - [Alternatives](#alternatives) -- [Getting started with your cluster](#getting-started-with-your-cluster) - - [Command line administration tool: `kubectl`](#command-line-administration-tool-kubectl) - - [Examples](#examples) -- [Tearing down the cluster](#tearing-down-the-cluster) -- [Further reading](#further-reading) - -## Prerequisites - -1. You need an AWS account. Visit [http://aws.amazon.com](http://aws.amazon.com) to get started -2. Install and configure [AWS Command Line Interface](http://aws.amazon.com/cli) -3. You need an AWS [instance profile and role](http://docs.aws.amazon.com/IAM/latest/UserGuide/instance-profiles.html) with EC2 full access. - -## Cluster turnup -### Supported procedure: `get-kube` -```bash -#Using wget -export KUBERNETES_PROVIDER=aws; wget -q -O - https://get.k8s.io | bash - -#Using cURL -export KUBERNETES_PROVIDER=aws; curl -sS https://get.k8s.io | bash -``` - -NOTE: This script calls [cluster/kube-up.sh](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/kube-up.sh) -which in turn calls [cluster/aws/util.sh](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/aws/util.sh) -using [cluster/aws/config-default.sh](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/aws/config-default.sh). - -This process takes about 5 to 10 minutes. Once the cluster is up, the IP addresses of your master and node(s) will be printed, -as well as information about the default services running in the cluster (monitoring, logging, dns). User credentials and security -tokens are written in `~/.kube/kubeconfig`, they will be necessary to use the CLI or the HTTP Basic Auth. - -By default, the script will provision a new VPC and a 4 node k8s cluster in us-west-2a (Oregon) with `t2.micro` instances running on Ubuntu. -You can override the variables defined in [config-default.sh](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/aws/config-default.sh) to change this behavior as follows: - -```bash -export KUBE_AWS_ZONE=eu-west-1c -export NUM_MINIONS=2 -export MINION_SIZE=m3.medium -export AWS_S3_REGION=eu-west-1 -export AWS_S3_BUCKET=mycompany-kubernetes-artifacts -export INSTANCE_PREFIX=k8s -... -``` - -It will also try to create or reuse a keypair called "kubernetes", and IAM profiles called "kubernetes-master" and "kubernetes-minion". -If these already exist, make sure you want them to be used here. - -NOTE: If using an existing keypair named "kubernetes" then you must set the `AWS_SSH_KEY` key to point to your private key. - -### Alternatives -A contributed [example](aws-coreos.md) allows you to setup a Kubernetes cluster based on [CoreOS](http://www.coreos.com), either using -AWS CloudFormation or EC2 with user data (cloud-config). - -## Getting started with your cluster -### Command line administration tool: `kubectl` -Copy the appropriate `kubectl` binary to any location defined in your `PATH` environment variable, for example: - -```bash -# OS X -sudo cp kubernetes/platforms/darwin/amd64/kubectl /usr/local/bin/kubectl - -# Linux -sudo cp kubernetes/platforms/linux/amd64/kubectl /usr/local/bin/kubectl -``` - -An up-to-date documentation page for this tool is available here: [kubectl manual](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/kubectl.md) - -By default, `kubectl` will use the `kubeconfig` file generated during the cluster startup for authenticating against the API. -For more information, please read [kubeconfig files](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/kubeconfig-file.md) - -### Examples -See [a simple nginx example](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/simple-nginx.md) to try out your new cluster. - -The "Guestbook" application is another popular example to get started with Kubernetes: [guestbook example](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/examples/guestbook) - -For more complete applications, please look in the [examples directory](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples) - -## Tearing down the cluster -Make sure the environment variables you used to provision your cluster are still exported, then call the following script inside the -`kubernetes` directory: - -```bash -cluster/kube-down.sh -``` - -## Further reading -Please see the [Kubernetes docs](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/docs) for more details on administering -and using a Kubernetes cluster. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/aws.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/aws.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/aws/cloud-configs/master.yaml b/release-0.20.0/docs/getting-started-guides/aws/cloud-configs/master.yaml deleted file mode 100644 index af8d61078a7..00000000000 --- a/release-0.20.0/docs/getting-started-guides/aws/cloud-configs/master.yaml +++ /dev/null @@ -1,177 +0,0 @@ -#cloud-config - -write_files: - - path: /opt/bin/waiter.sh - owner: root - permissions: 0755 - content: | - #! /usr/bin/bash - until curl http://127.0.0.1:2379/v2/machines; do sleep 2; done - -coreos: - etcd2: - name: master - initial-cluster-token: k8s_etcd - initial-cluster: master=http://$private_ipv4:2380 - listen-peer-urls: http://$private_ipv4:2380,http://localhost:2380 - initial-advertise-peer-urls: http://$private_ipv4:2380 - listen-client-urls: http://$private_ipv4:2379,http://localhost:2379 - advertise-client-urls: http://$private_ipv4:2379 - fleet: - etcd_servers: http://localhost:2379 - metadata: k8srole=master - flannel: - etcd_endpoints: http://localhost:2379 - locksmithd: - endpoint: http://localhost:2379 - units: - - name: etcd2.service - command: start - - name: fleet.service - command: start - - name: etcd2-waiter.service - command: start - content: | - [Unit] - Description=etcd waiter - Wants=network-online.target - Wants=etcd2.service - After=etcd2.service - After=network-online.target - Before=flanneld.service fleet.service locksmithd.service - - [Service] - ExecStart=/usr/bin/bash /opt/bin/waiter.sh - RemainAfterExit=true - Type=oneshot - - name: flanneld.service - command: start - drop-ins: - - name: 50-network-config.conf - content: | - [Service] - ExecStartPre=-/usr/bin/etcdctl mk /coreos.com/network/config '{"Network": "10.244.0.0/16", "Backend": {"Type": "vxlan"}}' - - name: docker-cache.service - command: start - content: | - [Unit] - Description=Docker cache proxy - Requires=early-docker.service - After=early-docker.service - Before=early-docker.target - - [Service] - Restart=always - TimeoutStartSec=0 - RestartSec=5 - Environment=TMPDIR=/var/tmp/ - Environment=DOCKER_HOST=unix:///var/run/early-docker.sock - ExecStartPre=-/usr/bin/docker kill docker-registry - ExecStartPre=-/usr/bin/docker rm docker-registry - ExecStartPre=/usr/bin/docker pull quay.io/devops/docker-registry:latest - # GUNICORN_OPTS is an workaround for - # https://github.com/docker/docker-registry/issues/892 - ExecStart=/usr/bin/docker run --rm --net host --name docker-registry \ - -e STANDALONE=false \ - -e GUNICORN_OPTS=[--preload] \ - -e MIRROR_SOURCE=https://registry-1.docker.io \ - -e MIRROR_SOURCE_INDEX=https://index.docker.io \ - -e MIRROR_TAGS_CACHE_TTL=1800 \ - quay.io/devops/docker-registry:latest - - name: docker.service - drop-ins: - - name: 51-docker-mirror.conf - content: | - [Unit] - # making sure that docker-cache is up and that flanneld finished - # startup, otherwise containers won't land in flannel's network... - Requires=docker-cache.service - After=docker-cache.service - - [Service] - Environment=DOCKER_OPTS='--registry-mirror=http://$private_ipv4:5000' - - name: get-kubectl.service - command: start - content: | - [Unit] - Description=Get kubectl client tool - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=network-online.target - After=network-online.target - - [Service] - ExecStart=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kubectl - ExecStart=/usr/bin/chmod +x /opt/bin/kubectl - Type=oneshot - RemainAfterExit=true - - name: kube-apiserver.service - command: start - content: | - [Unit] - Description=Kubernetes API Server - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd2-waiter.service - After=etcd2-waiter.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-apiserver - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver - ExecStart=/opt/bin/kube-apiserver \ - --insecure-bind-address=0.0.0.0 \ - --service-cluster-ip-range=10.100.0.0/16 \ - --etcd-servers=http://localhost:2379 - Restart=always - RestartSec=10 - - name: kube-controller-manager.service - command: start - content: | - [Unit] - Description=Kubernetes Controller Manager - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-controller-manager - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager - ExecStart=/opt/bin/kube-controller-manager \ - --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - - name: kube-scheduler.service - command: start - content: | - [Unit] - Description=Kubernetes Scheduler - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-scheduler - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler - ExecStart=/opt/bin/kube-scheduler \ - --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - - name: kube-register.service - command: start - content: | - [Unit] - Description=Kubernetes Registration Service - Documentation=https://github.com/kelseyhightower/kube-register - Requires=kube-apiserver.service fleet.service - After=kube-apiserver.service fleet.service - - [Service] - ExecStartPre=-/usr/bin/wget -nc -O /opt/bin/kube-register https://github.com/kelseyhightower/kube-register/releases/download/v0.0.3/kube-register-0.0.3-linux-amd64 - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-register - ExecStart=/opt/bin/kube-register \ - --metadata=k8srole=node \ - --fleet-endpoint=unix:///var/run/fleet.sock \ - --api-endpoint=http://127.0.0.1:8080 - Restart=always - RestartSec=10 - update: - group: alpha - reboot-strategy: off diff --git a/release-0.20.0/docs/getting-started-guides/aws/cloud-configs/node.yaml b/release-0.20.0/docs/getting-started-guides/aws/cloud-configs/node.yaml deleted file mode 100644 index 9d3d61d868a..00000000000 --- a/release-0.20.0/docs/getting-started-guides/aws/cloud-configs/node.yaml +++ /dev/null @@ -1,81 +0,0 @@ -#cloud-config - -write_files: - - path: /opt/bin/wupiao - owner: root - permissions: 0755 - content: | - #!/bin/bash - # [w]ait [u]ntil [p]ort [i]s [a]ctually [o]pen - [ -n "$1" ] && [ -n "$2" ] && while ! curl --output /dev/null \ - --silent --head --fail \ - http://${1}:${2}; do sleep 1 && echo -n .; done; - exit $? - -coreos: - etcd2: - listen-client-urls: http://localhost:2379 - advertise-client-urls: http://0.0.0.0:2379 - initial-cluster: master=http://:2380 - proxy: on - fleet: - etcd_servers: http://localhost:2379 - metadata: k8srole=node - flannel: - etcd_endpoints: http://localhost:2379 - locksmithd: - endpoint: http://localhost:2379 - units: - - name: etcd2.service - command: start - - name: fleet.service - command: start - - name: flanneld.service - command: start - - name: docker.service - command: start - drop-ins: - - name: 50-docker-mirror.conf - content: | - [Service] - Environment=DOCKER_OPTS='--registry-mirror=http://:5000' - - name: kubelet.service - command: start - content: | - [Unit] - Description=Kubernetes Kubelet - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=network-online.target - After=network-online.target - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kubelet - ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet - # wait for kubernetes master to be up and ready - ExecStartPre=/opt/bin/wupiao 8080 - ExecStart=/opt/bin/kubelet \ - --api-servers=:8080 \ - --hostname-override=$private_ipv4 - Restart=always - RestartSec=10 - - name: kube-proxy.service - command: start - content: | - [Unit] - Description=Kubernetes Proxy - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=network-online.target - After=network-online.target - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kube-proxy - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy - # wait for kubernetes master to be up and ready - ExecStartPre=/opt/bin/wupiao 8080 - ExecStart=/opt/bin/kube-proxy \ - --master=http://:8080 - Restart=always - RestartSec=10 - update: - group: alpha - reboot-strategy: off diff --git a/release-0.20.0/docs/getting-started-guides/aws/cloudformation-template.json b/release-0.20.0/docs/getting-started-guides/aws/cloudformation-template.json deleted file mode 100644 index 5aa6ee83443..00000000000 --- a/release-0.20.0/docs/getting-started-guides/aws/cloudformation-template.json +++ /dev/null @@ -1,421 +0,0 @@ -{ - "AWSTemplateFormatVersion": "2010-09-09", - "Description": "Kubernetes 0.18.2 on EC2 powered by CoreOS 681.0.0 (alpha)", - "Mappings": { - "RegionMap": { - "eu-central-1" : { - "AMI" : "ami-4c4f7151" - }, - "ap-northeast-1" : { - "AMI" : "ami-3a35fd3a" - }, - "us-gov-west-1" : { - "AMI" : "ami-57117174" - }, - "sa-east-1" : { - "AMI" : "ami-fbcc4ae6" - }, - "ap-southeast-2" : { - "AMI" : "ami-593c4263" - }, - "ap-southeast-1" : { - "AMI" : "ami-3a083668" - }, - "us-east-1" : { - "AMI" : "ami-40322028" - }, - "us-west-2" : { - "AMI" : "ami-23b58613" - }, - "us-west-1" : { - "AMI" : "ami-15618f51" - }, - "eu-west-1" : { - "AMI" : "ami-8d1164fa" - } - } - }, - "Parameters": { - "InstanceType": { - "Description": "EC2 HVM instance type (m3.medium, etc).", - "Type": "String", - "Default": "m3.medium", - "AllowedValues": [ - "m3.medium", - "m3.large", - "m3.xlarge", - "m3.2xlarge", - "c3.large", - "c3.xlarge", - "c3.2xlarge", - "c3.4xlarge", - "c3.8xlarge", - "cc2.8xlarge", - "cr1.8xlarge", - "hi1.4xlarge", - "hs1.8xlarge", - "i2.xlarge", - "i2.2xlarge", - "i2.4xlarge", - "i2.8xlarge", - "r3.large", - "r3.xlarge", - "r3.2xlarge", - "r3.4xlarge", - "r3.8xlarge", - "t2.micro", - "t2.small", - "t2.medium" - ], - "ConstraintDescription": "Must be a valid EC2 HVM instance type." - }, - "ClusterSize": { - "Description": "Number of nodes in cluster (2-12).", - "Default": "2", - "MinValue": "2", - "MaxValue": "12", - "Type": "Number" - }, - "AllowSSHFrom": { - "Description": "The net block (CIDR) that SSH is available to.", - "Default": "0.0.0.0/0", - "Type": "String" - }, - "KeyPair": { - "Description": "The name of an EC2 Key Pair to allow SSH access to the instance.", - "Type": "AWS::EC2::KeyPair::KeyName" - }, - "VpcId": { - "Description": "The ID of the VPC to launch into.", - "Type": "AWS::EC2::VPC::Id" - }, - "SubnetId": { - "Description": "The ID of the subnet to launch into (that must be within the supplied VPC)", - "Type": "AWS::EC2::Subnet::Id" - }, - "SubnetAZ": { - "Description": "The availability zone of the subnet supplied (for example eu-west-1a)", - "Type": "String" - } - }, - "Conditions": { - "UseEC2Classic": {"Fn::Equals": [{"Ref": "VpcId"}, ""]} - }, - "Resources": { - "KubernetesSecurityGroup": { - "Type": "AWS::EC2::SecurityGroup", - "Properties": { - "VpcId": {"Fn::If": ["UseEC2Classic", {"Ref": "AWS::NoValue"}, {"Ref": "VpcId"}]}, - "GroupDescription": "Kubernetes SecurityGroup", - "SecurityGroupIngress": [ - { - "IpProtocol": "tcp", - "FromPort": "22", - "ToPort": "22", - "CidrIp": {"Ref": "AllowSSHFrom"} - } - ] - } - }, - "KubernetesIngress": { - "Type": "AWS::EC2::SecurityGroupIngress", - "Properties": { - "GroupId": {"Fn::GetAtt": ["KubernetesSecurityGroup", "GroupId"]}, - "IpProtocol": "tcp", - "FromPort": "1", - "ToPort": "65535", - "SourceSecurityGroupId": { - "Fn::GetAtt" : [ "KubernetesSecurityGroup", "GroupId" ] - } - } - }, - "KubernetesIngressUDP": { - "Type": "AWS::EC2::SecurityGroupIngress", - "Properties": { - "GroupId": {"Fn::GetAtt": ["KubernetesSecurityGroup", "GroupId"]}, - "IpProtocol": "udp", - "FromPort": "1", - "ToPort": "65535", - "SourceSecurityGroupId": { - "Fn::GetAtt" : [ "KubernetesSecurityGroup", "GroupId" ] - } - } - }, - "KubernetesMasterInstance": { - "Type": "AWS::EC2::Instance", - "Properties": { - "NetworkInterfaces" : [{ - "GroupSet" : [{"Fn::GetAtt": ["KubernetesSecurityGroup", "GroupId"]}], - "AssociatePublicIpAddress" : "true", - "DeviceIndex" : "0", - "DeleteOnTermination" : "true", - "SubnetId" : {"Fn::If": ["UseEC2Classic", {"Ref": "AWS::NoValue"}, {"Ref": "SubnetId"}]} - }], - "ImageId": {"Fn::FindInMap" : ["RegionMap", {"Ref": "AWS::Region" }, "AMI"]}, - "InstanceType": {"Ref": "InstanceType"}, - "KeyName": {"Ref": "KeyPair"}, - "Tags" : [ - {"Key" : "Name", "Value" : {"Fn::Join" : [ "-", [ {"Ref" : "AWS::StackName"}, "k8s-master" ] ]}}, - {"Key" : "KubernetesRole", "Value" : "node"} - ], - "UserData": { "Fn::Base64": {"Fn::Join" : ["", [ - "#cloud-config\n\n", - "write_files:\n", - "- path: /opt/bin/waiter.sh\n", - " owner: root\n", - " content: |\n", - " #! /usr/bin/bash\n", - " until curl http://127.0.0.1:2379/v2/machines; do sleep 2; done\n", - "coreos:\n", - " etcd2:\n", - " name: master\n", - " initial-cluster-token: k8s_etcd\n", - " initial-cluster: master=http://$private_ipv4:2380\n", - " listen-peer-urls: http://$private_ipv4:2380,http://localhost:2380\n", - " initial-advertise-peer-urls: http://$private_ipv4:2380\n", - " listen-client-urls: http://$private_ipv4:2379,http://localhost:2379\n", - " advertise-client-urls: http://$private_ipv4:2379\n", - " fleet:\n", - " etcd_servers: http://localhost:2379\n", - " metadata: k8srole=master\n", - " flannel:\n", - " etcd_endpoints: http://localhost:2379\n", - " locksmithd:\n", - " endpoint: http://localhost:2379\n", - " units:\n", - " - name: etcd2.service\n", - " command: start\n", - " - name: fleet.service\n", - " command: start\n", - " - name: etcd2-waiter.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=etcd waiter\n", - " Wants=network-online.target\n", - " Wants=etcd2.service\n", - " After=etcd2.service\n", - " After=network-online.target\n", - " Before=flanneld.service fleet.service locksmithd.service\n\n", - " [Service]\n", - " ExecStart=/usr/bin/bash /opt/bin/waiter.sh\n", - " RemainAfterExit=true\n", - " Type=oneshot\n", - " - name: flanneld.service\n", - " command: start\n", - " drop-ins:\n", - " - name: 50-network-config.conf\n", - " content: |\n", - " [Service]\n", - " ExecStartPre=-/usr/bin/etcdctl mk /coreos.com/network/config '{\"Network\": \"10.244.0.0/16\", \"Backend\": {\"Type\": \"vxlan\"}}'\n", - " - name: docker-cache.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Docker cache proxy\n", - " Requires=early-docker.service\n", - " After=early-docker.service\n", - " Before=early-docker.target\n\n", - " [Service]\n", - " Restart=always\n", - " TimeoutStartSec=0\n", - " RestartSec=5\n", - " Environment=TMPDIR=/var/tmp/\n", - " Environment=DOCKER_HOST=unix:///var/run/early-docker.sock\n", - " ExecStartPre=-/usr/bin/docker kill docker-registry\n", - " ExecStartPre=-/usr/bin/docker rm docker-registry\n", - " ExecStartPre=/usr/bin/docker pull quay.io/devops/docker-registry:latest\n", - " # GUNICORN_OPTS is an workaround for\n", - " # https://github.com/docker/docker-registry/issues/892\n", - " ExecStart=/usr/bin/docker run --rm --net host --name docker-registry \\\n", - " -e STANDALONE=false \\\n", - " -e GUNICORN_OPTS=[--preload] \\\n", - " -e MIRROR_SOURCE=https://registry-1.docker.io \\\n", - " -e MIRROR_SOURCE_INDEX=https://index.docker.io \\\n", - " -e MIRROR_TAGS_CACHE_TTL=1800 \\\n", - " quay.io/devops/docker-registry:latest\n", - " - name: get-kubectl.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Get kubectl client tool\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=network-online.target\n", - " After=network-online.target\n\n", - " [Service]\n", - " ExecStart=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kubectl\n", - " ExecStart=/usr/bin/chmod +x /opt/bin/kubectl\n", - " Type=oneshot\n", - " RemainAfterExit=true\n", - " - name: kube-apiserver.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes API Server\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=etcd2-waiter.service\n", - " After=etcd2-waiter.service\n\n", - " [Service]\n", - " ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-apiserver\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver\n", - " ExecStart=/opt/bin/kube-apiserver \\\n", - " --insecure-bind-address=0.0.0.0 \\\n", - " --service-cluster-ip-range=10.100.0.0/16 \\\n", - " --etcd-servers=http://localhost:2379\n", - " Restart=always\n", - " RestartSec=10\n", - " - name: kube-controller-manager.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes Controller Manager\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=kube-apiserver.service\n", - " After=kube-apiserver.service\n\n", - " [Service]\n", - " ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-controller-manager\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager\n", - " ExecStart=/opt/bin/kube-controller-manager \\\n", - " --master=127.0.0.1:8080\n", - " Restart=always\n", - " RestartSec=10\n", - " - name: kube-scheduler.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes Scheduler\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=kube-apiserver.service\n", - " After=kube-apiserver.service\n\n", - " [Service]\n", - " ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-scheduler\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler\n", - " ExecStart=/opt/bin/kube-scheduler \\\n", - " --master=127.0.0.1:8080\n", - " Restart=always\n", - " RestartSec=10\n", - " - name: kube-register.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes Registration Service\n", - " Documentation=https://github.com/kelseyhightower/kube-register\n", - " Requires=kube-apiserver.service fleet.service\n", - " After=kube-apiserver.service fleet.service\n\n", - " [Service]\n", - " ExecStartPre=-/usr/bin/wget -nc -O /opt/bin/kube-register https://github.com/kelseyhightower/kube-register/releases/download/v0.0.3/kube-register-0.0.3-linux-amd64\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-register\n", - " ExecStart=/opt/bin/kube-register \\\n", - " --metadata=k8srole=node \\\n", - " --fleet-endpoint=unix:///var/run/fleet.sock \\\n", - " --api-endpoint=http://127.0.0.1:8080\n", - " Restart=always\n", - " RestartSec=10\n", - " update:\n", - " group: alpha\n", - " reboot-strategy: off\n" - ]]} - } - } - }, - "KubernetesNodeLaunchConfig": { - "Type": "AWS::AutoScaling::LaunchConfiguration", - "Properties": { - "ImageId": {"Fn::FindInMap" : ["RegionMap", {"Ref": "AWS::Region" }, "AMI" ]}, - "InstanceType": {"Ref": "InstanceType"}, - "KeyName": {"Ref": "KeyPair"}, - "AssociatePublicIpAddress" : "true", - "SecurityGroups": [{"Fn::If": [ - "UseEC2Classic", - {"Ref": "KubernetesSecurityGroup"}, - {"Fn::GetAtt": ["KubernetesSecurityGroup", "GroupId"]}] - }], - "UserData": { "Fn::Base64": {"Fn::Join" : ["", [ - "#cloud-config\n\n", - "coreos:\n", - " etcd2:\n", - " listen-client-urls: http://localhost:2379\n", - " initial-cluster: master=http://", {"Fn::GetAtt" :["KubernetesMasterInstance" , "PrivateIp"]}, ":2380\n", - " proxy: on\n", - " fleet:\n", - " etcd_servers: http://localhost:2379\n", - " metadata: k8srole=node\n", - " flannel:\n", - " etcd_endpoints: http://localhost:2379\n", - " locksmithd:\n", - " endpoint: http://localhost:2379\n", - " units:\n", - " - name: etcd2.service\n", - " command: start\n", - " - name: fleet.service\n", - " command: start\n", - " - name: flanneld.service\n", - " command: start\n", - " - name: docker.service\n", - " command: start\n", - " drop-ins:\n", - " - name: 50-docker-mirror.conf\n", - " content: |\n", - " [Service]\n", - " Environment=DOCKER_OPTS='--registry-mirror=http://", {"Fn::GetAtt" :["KubernetesMasterInstance" , "PrivateIp"]}, ":5000'\n", - " - name: kubelet.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes Kubelet\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=network-online.target\n", - " After=network-online.target\n\n", - " [Service]\n", - " ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kubelet\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet\n", - " ExecStart=/opt/bin/kubelet \\\n", - " --api-servers=", {"Fn::GetAtt" :["KubernetesMasterInstance" , "PrivateIp"]}, ":8080 \\\n", - " --hostname-override=$private_ipv4\n", - " Restart=always\n", - " RestartSec=10\n", - " - name: kube-proxy.service\n", - " command: start\n", - " content: |\n", - " [Unit]\n", - " Description=Kubernetes Proxy\n", - " Documentation=https://github.com/GoogleCloudPlatform/kubernetes\n", - " Requires=network-online.target\n", - " After=network-online.target\n\n", - " [Service]\n", - " ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-proxy\n", - " ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy\n", - " ExecStart=/opt/bin/kube-proxy \\\n", - " --master=http://", {"Fn::GetAtt" :["KubernetesMasterInstance" , "PrivateIp"]}, ":8080\n", - " Restart=always\n", - " RestartSec=10\n", - " update:\n", - " group: alpha\n", - " reboot-strategy: off\n" - ]]} - } - } - }, - "KubernetesAutoScalingGroup": { - "Type": "AWS::AutoScaling::AutoScalingGroup", - "Properties": { - "AvailabilityZones": {"Fn::If": ["UseEC2Classic", {"Fn::GetAZs": ""}, [{"Ref": "SubnetAZ"}]]}, - "VPCZoneIdentifier": {"Fn::If": ["UseEC2Classic", {"Ref": "AWS::NoValue"}, [{"Ref": "SubnetId"}]]}, - "LaunchConfigurationName": {"Ref": "KubernetesNodeLaunchConfig"}, - "MinSize": "2", - "MaxSize": "12", - "DesiredCapacity": {"Ref": "ClusterSize"}, - "Tags" : [ - {"Key" : "Name", "Value" : {"Fn::Join" : [ "-", [ {"Ref" : "AWS::StackName"}, "k8s-node" ] ]}, "PropagateAtLaunch" : true}, - {"Key" : "KubernetesRole", "Value" : "node", "PropagateAtLaunch" : true} - ] - } - } - }, - "Outputs": { - "KubernetesMasterPublicIp": { - "Description": "Public Ip of the newly created Kubernetes Master instance", - "Value": {"Fn::GetAtt": ["KubernetesMasterInstance" , "PublicIp"]} - } - } -} diff --git a/release-0.20.0/docs/getting-started-guides/aws/kubectl.md b/release-0.20.0/docs/getting-started-guides/aws/kubectl.md deleted file mode 100644 index 8a8e7f7c4d9..00000000000 --- a/release-0.20.0/docs/getting-started-guides/aws/kubectl.md +++ /dev/null @@ -1,27 +0,0 @@ -# Install and configure kubectl - -## Download the kubectl CLI tool -```bash -### Darwin -wget https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/darwin/amd64/kubectl - -### Linux -wget https://storage.googleapis.com/kubernetes-release/release/v0.17.0/bin/linux/amd64/kubectl -``` - -### Copy kubectl to your path -```bash -chmod +x kubectl -mv kubectl /usr/local/bin/ -``` - -### Create a secure tunnel for API communication -```bash -ssh -f -nNT -L 8080:127.0.0.1:8080 core@ -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/aws/kubectl.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/aws/kubectl.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/azure.md b/release-0.20.0/docs/getting-started-guides/azure.md deleted file mode 100644 index b82d7d7ed8b..00000000000 --- a/release-0.20.0/docs/getting-started-guides/azure.md +++ /dev/null @@ -1,65 +0,0 @@ -Getting started on Microsoft Azure ----------------------------------- - -**Table of Contents** - - - [Prerequisites](#prerequisites) - - [Setup](#setup) - - [Getting started with your cluster](#getting-started-with-your-cluster) - - [Tearing down the cluster](#tearing-down-the-cluster) - - -## Prerequisites - -** Azure Prerequisites** - -1. You need an Azure account. Visit http://azure.microsoft.com/ to get started. -2. Install and configure the Azure cross-platform command-line interface. http://azure.microsoft.com/en-us/documentation/articles/xplat-cli/ -3. Make sure you have a default account set in the Azure cli, using `azure account set` - -**Prerequisites for your workstation** - -1. Be running a Linux or Mac OS X. -2. Get or build a [binary release](binary_release.md) -3. If you want to build your own release, you need to have [Docker -installed](https://docs.docker.com/installation/). On Mac OS X you can use -[boot2docker](http://boot2docker.io/). - -## Setup -The cluster setup scripts can setup Kubernetes for multiple targets. First modify `cluster/kube-env.sh` to specify azure: - - KUBERNETES_PROVIDER="azure" - -Next, specify an existing virtual network and subnet in `cluster/azure/config-default.sh`: - - AZ_VNET= - AZ_SUBNET= - -You can create a virtual network: - - azure network vnet create --subnet= --location "West US" -v - -Now you're ready. - -You can then use the `cluster/kube-*.sh` scripts to manage your azure cluster, start with: - - cluster/kube-up.sh - -The script above will start (by default) a single master VM along with 4 worker VMs. You -can tweak some of these parameters by editing `cluster/azure/config-default.sh`. - -## Getting started with your cluster -See [a simple nginx example](../../examples/simple-nginx.md) to try out your new cluster. - -For more complete applications, please look in the [examples directory](../../examples). - -## Tearing down the cluster -``` -cluster/kube-down.sh -``` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/azure.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/azure.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/bigquery-logging.png b/release-0.20.0/docs/getting-started-guides/bigquery-logging.png deleted file mode 100644 index b7a6f94c288e973636ac31a9d870157a8e7ae7dc..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 57417 zcmeEtRajh2ups$KAQ0T0;KAK3z+i&~hrxpD;I1JAch6uGTn5+R0fJj_ch|vPmOppz zKJ4C?ec5mK`?gb4@xxI^(gDV`d zT?_%?J%T(yLc=rTaLLaTcLu`$q&F*RO1ja(HvO3+>*f{9IKo$pQ`!-v( zhcjsrwIb8k(=KjCx}ekJu87rt?cy{X+?&g7X%B@6UJpUyOLB9AUQm813H?R32Cx2B zzqG{_{jGc)m&o~do(Kr?$l?Ez00DuPoR;ZtCC>GZmMKBKLaq3nP9`J`<(Bt zpLA+bsTu-XoACesIUael^=ZwoZT6!>&pH01JNM{!gQ z5=D{u%t#eG{KHg}DLG;yJ<}f&CU+Gc1>D&s<1Tp3l2I}myCm+0;-e5iI>vVWv#B~s zVENE_B@tiO;W{K-?v$7~d706zV$o8g_@aEIq+cRcdX+dC*nRS~oBXf^J@+*@0|lLdMw^uO>p6*1bYVP8&=59k0osQ>H%$cOdF{Rd zFE!OwS67b?edhRS+8cviY^C2W)$R!!R3%%ouk*f_*Q9MIYQHv@cUY+eFCdXp>WHp< z#$@`vKm3oTw=gAp{6pYd)qHj$dTKREih#V2JZG(_2|-y1=EP#jH;p3tso*Jtp~e6h~cOmv!;EZ?${%$j?;P2y@&S0Fa1BOE^dSjUItqvxl>{H zy#Hc|`0}N3F4i~J~Lca74VaJaZSzb&W z@l^~v5Dayjog*G(7fbuO0@nCZ*GY#Jti#dVmc>PA=7{EL-nZ$ zox);>llk9SZFOvpHuAOxJD+VV!SODO@Ti-JNI_YW>V?YSmttl0fti_^k+HwOU(oOF zB1_aKEiFwaB~!?4Uv7$j>>!*tbNCUU+NDR3UNHkk?}x|6edcuC!EEW!!9(|yL_I~S z`ap6Lf|n4qjAdJ^8$t3Hz8JMpC8N2!c#Ai$eEG#+mLXEyi??| zmx+U^J(kvt1w(4rkt$lRx_0h;l z!K2M=OH@9cJyH(%9u_vHho&o$I>G9M6iB1xFfIESqXx}sxZwX2!JS&pVx{9y?@dch zozRlMe&HlEX2RD#^{H~)csneNC?wmFW6^6x8pBg~g}i4s>MK1?((G}`iE--EF)F?1 zKTuroJ8PffB?H~h_0%f=BL0P)LE64WE~z-3^N=MtOgU3XQ%_IfbVMkgR(|c|ZGiRt zuW(dsTgRWNw(O5XL}dBhXAaR{yZ26STkO-vZaS|xW^Q@j=JLPOIJKvvA@ZVLe=Vh2 zo0B79$#-$DC}Qg9Ju{NH(sYfqY~?24M++jbVO}w47tMia+r(mym|R#$;OaV535XiT zPMGlcG{fkH?4*;$38MH?XLin;SddN|{G}^YE^b6^D~WlNx8kW`()_b0f4RlCisRPB zzV&ii5H~bn>uIuBeQRsWawLOT-2Wkpm|G`B)bGyqh1L7EnY4i#VLG`JZYtCHP_K0H z6Q6en4J*x7@%{U%QMTeI!cE7YD!=Ng0PaQ@cDz*ksF}E~yf{zkqL#N)uO9r9*$!C^ z9{XruOH{|lniZ|}KuVqL3CI!-c2&;8bxrW5o?k`(IvVMsp@PJ9D0!f$ZFIzp1*o>q z?7U`s<{v}b98K)1uhQ?+%z0`4JJDg=i2;whxv^qGJiljfJW!B=%+1Y}l$1ba?#GLb z+?FFPx7+FMXUP?P)h(8zS)Vxs)GjsLTwS9ybZO)JYf8Gqez)ng|=H=si5h+%k z%Flp(NNM;$UjiaqD*viW874`?<*mtISO`QBWqJ)S98ou#9v0NGy7K&V9Y3J9tB_da zDZPBbhF@{!nJKfV{Fndb+>K%YZ~m@JIkUF^cZ$E&RhN+e-kE@b^B-ziPDoDU@4NSV z?^XW}{gM~-fA*uq`SVa3*%*D8_g_SQ5iZnPPaw5B+CZTUDp?{q$yC%OWo4`^EM%u9 ze=%J3=A2BYCc68N`TbW0(0^qm4e-uTc$#wGgLEW#Kkwr0eOYb`H@IY&;>OROeVgp% zNqB$Jwu+G7-I-#^S0nzAXfx%0eH*W9trpfFWBHT^stfn2GWjt~*(TG=osNdghIYMi zlpU=HA*Az)i)@e!(Oe*lUn@s1&yi^OrjzTl#OFQ*)qvH5@~@~Wb|RZ#hP`P9?TbTC zCn`)nUaKW!W}G+k6~lcHeAPDIF;*Uz3LBDg`0MF`8FTW*ka3XxY4XC zkZP;1VuCO8uyJuo0eVhQlAPvo^DMGf`Sd4Y3KsXP$I@PKe%f^88~Tc#IfWFUtRpDh z&K!DdW1pMk^v-hS;8AG9`zRI0F04G7b`AJM#Q!jSoI7_palQ18;7tSsoB1r^YE^Fm z&2sx&JM*{Ognv5|`z!z9lohKCTHyLx*NVft^VH8@RIc`1>dG4td&@7z-9A%p@Dn`c z;Tr1i)CC>w379t9Ojl4WpF7Q@B6v7J8Z1{~o@Zpfm+9p{uCtk%)S!CsmhzH0m4L}Z zfxuzmhk)bQ%_X1X4qa{3)0QodyPc>uk_G8JPPR6AZO7oQ4Z<(Z7c|G0cq=a5U++NL z=6&V+#=d=cd+PU9ir1qA;d@YR0}T$FdLRm0`#`Nf>HWpjB-tgeRr6~tr#ZVX@t|NZ2& zl7-1Z?UlXl=Bs1CIb+w|EI&)Ahs%NNdmAGR;GY8SZ~Dg2QyU(QZinrmQWa+uXt8U5 z{!AlS?N{gJ?VH>hA##=g&8sRHDP)sVG8{OtTXDjFIx+e@W#qLLoSatH^IXp5zk$45 zyis&(w<t%G) zY{Sj_RDKk{Qwj#SPT#`YomK879G7n-lAq~1l~`-_4}^U8%v6LQHqpo#J6i9f9N_iJ zEfd_2Om6WN!j0Ei{wF1^#4bkhbpEY}XA#zTJsHw@JV}#P{eqgb^+{lV()-Tj@h-L=$>(R6zw! z%Vc_b`KL#1()h#NuL*l&xfm5&_^}cd4DMUsxWrbBl9{iJmCKKG+FOL7{Y`mX$wlI^~?fqGD|e{@O6Ypt6yGRR8! zaNwR6%jkU2y_*hqNe>&ZHh6YU|E?V2+V{}ov;xsdlEKH@6iylC+sVU<$0@EZhv@`t zn`j-s9-KXHm-6W|vY*3dbZC*wW6Kg+~z7lT1o}#6PGu>Am>vGUnu$!$v@xMqz77arQlSlK(etbk zTO^?|kiWq$Ki?l)GdR5a9yk3H#_KZ`6`9p~nU_xPnHR^PMy>fG7;Z0uQJfY`=d!49 z_S17~a9~(ZS-UoYUXvziaa}K=i`LM(JzoCj_<2I*wyC>J0h#LNw7Y!|*{GziP@VXF6?YGa> zeVmNJMRS+xP}pxG9y2U#)f$I$iF?`j2(5853q5#yx1gU!PQ3&GkW0*q&3V^2(anne zJVua~HSR$ALmj^f8VY`H`jaLF0JtUJS;AOU*sAGTo+l`n7A)tSOIqqY7UU*hPMH}8 z*Yi@WNh#)#rSeZb961VrY7J}M=e_1jLPpldtT+4~OEgWZD=od%=kTc)61WKN< zN2Z47tF0KMzZjgcKE z!YR;?AvxnajBh3_pulz4)M!K-#a7IiJ_dC%PQal>!@b1!Fb@oij5bX-5Wj3h@A)V% z^RWHhFb&_I1$spMN{w(Yq6HIwZxS#`;kn^=8b{q=h?l~C?ABYbReC;*7$c>GO?~uR ze#C(=y#kAvnmS@i(1_6`rnSGlB~F{66iwB~vDbbnP|iHP$@AE5wA$BDY4TYjDoif^ zYR}NRmc9St@NFo_G|5MOwMz1~4BS~IV(Z@etf)}LTQdnV*^$M?uA6LJUe@-mWRw(T z`z*_ZUZD{JGDQcQ>Ejw(;RPIkpByTO;$lbQf}H$4NP5Thjk8pKdL$LUGEZzUteh%y;9A~ zNv?Kg5J(}^V{kKkpXzQmk*wmZblbe~DR&X*+kf;#XP0vqig}2;QqJZ;u9-JD)5~T! zpYueWD|i1|8!SK&SpIESi6tAj;M4-#99cLl;CE4|KvP_fGbB^0&|Hydh`Z^xOgES8K^ zLhQ*`jDlkiR5s|Z`E)!ei>(Sv53Tc`T`RyQB-q&9U*WBvi}(dY{zPy58UN{&$E>+ZBLgfvED2a+i}*N!n`LeN z=x2CJtXsq4*kMp@oUD7=(h_<6I3K?h@*)| z!tsisTL(D&qT`^wKeT9GFv1R3(;Ab6O&oFb_`I%Ov9A|s&{pq|jI8oWD#da9UdCo5 z?Uuyz=9~qiVPc3I&zU4DCXUS7>OBqIJZueY*lsWyhvTfvf??$4hG<>eZ4o+XKE@!z z#OPnMe26(1Z#7x6afnuhr2UJg8j!GHRf)VM_szhKWAl)O>X5)wIM?zY37J}y1Y1AB z24B5jV6*#J1nmA-h23g*_U4Gz)e%t`6*DEdR5J8yz~nE<{IAidNl}B%A=roZ4ZNoX zIAelvpMXk#XQ2eH!KydIOa0+1&0)@qp_YA z-=$jP@u-~0tnOJ77Td2pBN5QST1Yu+YQuzPtHRt=j#{%zyh+Ez-ix>8Z1G(Uyid#}Y?(89cP%@sy~JW{5( zwckDb>*dI*YY50JAUciMG5=8}M4?uV_l2j6C!|!I>;`oY&YOoH$e-4!JPMLck;{;Y zW)jbb1sR<;?c&ssVifhamYJ$YQVU`VQhGiuAncr7t@dDcx9XP566(=MYf;xNp97LA z!54U9?u#=*z}`aK%N3;W^1;)KrsYA=({CUEJSG^bQU*0WMSg)Ca+J1!*N1b$NrjazAP#0BDuW?*Y4xxfTp!Fl#Oj>vSMyS;6M<8uxNuTa+9+Cj|&tXW~g{z6onHVT{?lSMZ4)-ivp^l?gb zd2ufAW;HPo(0V!lV}tLh#q9Rh@cj4T7b>avJJB#V-otwD-Z9b#mE|GW!d6%(RzF~j z`?4u?TeuEy@uuxWrtY@5ScKQd@c9o#`nu1t3{_co>oMYnx0W|8bc*2ixvU79ZNw@i zXpgqqVrHm^&DJP=C)OK}BY;Iuonvv`-{40J#!Mmu>tDEBi=Pwuf>rc}g+f)Tb#5zr?JAkw zp?FxcaSL`FAkThgXNwB6W3pA+OS08GEC!(milCVMI0ZaFB-T|pOTS^{t_BdXjL%@! z6#F>Z*&wneM6F`5Xh-f0^g6MK@T-=g<+(!rQ>Z`Z*WnEgR1wmv1+?>SHNU?2qURAJ zk!;7EKNX)UvW;508FXJx4K zDQq+q#z*vYUpja3&0(JCwokZoTYQ(|DT^+$GjyeDTKUQ!9@@jnDX4~T7UFT-PJlVV zo!I?L4N?1mzu8F6XKe*-fjRGZZTCoa`?+(Z<+G(>B{%!y{E}mS^@ttOwdBm%a~s{H zOoX#?HqTQH!{^+ei>`dE2C2o13ek-#wWfuL!tVR2T zDqPpc#}KNHTg)AGUORtRqZU>4l-De_)bt@%9d}TLJ#*a8USTYGh~u1?1v{GDAv2RA zWiv2KgCyOOdvmX+04sWWm=&jJF2H|RMUTG6tlC#7cTnpbmwT>OQH+hjnWRrM<$ZsJm?Np}w^`X0da97q^Ntf<3QsG)spvY|k@SqWe<(h$mD($=c@ zfOeza>nkwCZfUE9!jw^;O)He1W%|N zPlb|zE4Oc{P+W=wG_n6vMENGYi?+7?uf7YKvH0`-{q}6WyMgo@J#(6?7W-=$=0;6@!)^zG$zh;DY`Y4H9>q#+xHg4lK@v$dm8%a&QRqh%xPer#cs|b z->*XTi+64HNB0fLlu$UN@YLZf(tH?@S8MpbE)8_Bw-dN{{xar!^ zRj-g{egf(D;W!1qJDkfLWQ^yse7qSCZrCHHrXK}yDTy_SdouDA_jtWq&vd0{zDA8b zv9@Q)%NR1ne*W z+aT6Wz?J=C{Jn_fjg)aPk+K6;x#KKcoC`$@_;Pt;lHSJ+_#MgTH+z6Vw>aJN@q|{` zFHlfcsn{#Ui{D+8Z+V~nUISv|tVsGY!SwpR6t{WJDLDY3I4|Sf6f{wO*d`K9HylVY zTlX_pGH)9d{a6xFmE}b(oLwPt+B(lj9R-t8G&P(PC*zq^%o-209jsRCW(G7QX|N@S z857wgBMFJ2H>I2o9_79qh@+wYCTn+*V`)K6g_!O!Nmg|3>u-W_45ihn6CRI%4oZ=V zfT~Dzu#sw5(sYrcje&(_U87<=FeLClV*z;U+}S9fes*pP?^VPy0w%pVg-+K$Hp?nx z`b_l3NJSgl6cX{)=AY11Er~{%gvlwP=3C2N_;{Z68E8g|6Y}HrnLQEK3wXDDvIrs^cij2mX) zu(B#OXRygyPo$m13?j8DH}bXiAU-Dht<6qOT6wC7m4&@tl}=%Xqy6&gZC<_WyZ}9K z^h8{aEB^yuWAyi^^KC!I$do46tx__ruN?)^#PbS<6N?$s;zT~Sy{1{GF0O8`<_$`yEU;Fh+9@3?1sLl}+cz z0|1BsdR0M`*bHseXLMe72^%_hwV9qm^J=_AP{kiV%L$=tav3E&Tguf#uV5zWm^7m@ zv(zDv;V43m2qn7w}*v;!%Vp~%QF#d?9+LZ>#E`NLF%;xNqR6(w@H%0 z?z1$NYV-3);rtR}pz*kjs=LHqhGIw0KGW|>^NwOp1*;!(K_=LaClQ~ zL2`_5zlAQdq<`0sigvyz&&)k$sesd0W@efn`fft^9{xN$HrI(4TySZ{1Gy{h$g1T@ zbIR=9oaD(2@pUT$KokwbA-B=zR=J*C*p}de+XLM43qo^mC46eN%{av=w%m~kFO8R5 zG&EO;7D^M?J(M3yD@@Khthz-K02ENP^H9l}a!MN^osHP6(j#B~LCXvPN+B+Zo*3d@ z3EJhe1;}ZI6=hR_N}~=9r(p^mSm=1KmiOnd>V=1!@TVqilk}eNVilj6j~>_utCyZl zHyzidENykD*b2{Ghs>fjcFC}@d4WokpYD;LrZhsrij-8tV(W3tohRVu(_p8T>$ClH zpv3VEnF7EiB`su8rIjxn$j{5)_*={?)N?%wM@2(Tt+7Xng}luLP9PK3>A4PluI)(amG zFETh5tA?fy9l#pR&-2$6>BVZVXAzREG41C}lg}PiMhJUw>Ly8M4(|{3Jf-dUa{EWl z#RU~+u4hv^M>Dn{f|0wDjUTUvx5c zPvwu<%J)y>qnM=*T9L7Y80*!pz!ggMV%rtC)0lGE_JoNVt&H#2%|hr>;+pe!Lwuqi z=uuPi1xB^ULd-oj$$Kv7ttRP`tsA`-u;hILNEl7dcj`JEVLm#ibk%cf!l1IFQ`Y2B z%t@7fSg$vPCnTJ4P3HkH&jxj{>?t8ubAjY;-j#2GNRd65S$Lxdn?wp#U5FvR)7qH| z1UEBarZUKOhJXw-nP~>9Zp9@97?}ISqnYZnhl1sH(T;F!Oi3-artm~f-}+CR)>75REJkt#F{^wpA$V5raRL+}o93GwOC z&#xMMG@91-M|Zh=Aq#4P!}-UmE95$f{q@lJh4n`v=@|FA^(ZHOVD`iv`6)N1W~9uh z8%5g!NJ`bjWjriQ?Yxvf*5&A4?;|6o1%7j=YgsvN*S^kh>GQswM1(bPd+h6;b zx35#=u84(^wK>UVa&!Im0umHzJ<*rH%=B^Qy=H02o)J|D@rIsuQq=5jF8cSEnubZb zXD$a!RUn~Zy^^tX_Z-H^sa&z=0Rg*TEq_Y+z=dcX*Oh7TMi-U2H14Nuat|jhe=QSF z43%0^LHUivnW(#C9~qkl{5 zQ(~A}&G6Gq`x{aaenhZJlAvfv|X8rN(!x`PL5q&8S6! z!~>=!WEC`*xIbHJ-`;o)Wh3T?rsGpbFm}Y!85vynlr-`r#0;cP6WC%l#H`=4C@TSm zmkr|O9{S?T>Ne|tVho^SXI8jT95jJ(BKyHMqR;fZpTw)$URYOstdj%`6f>##T|d|@EM6F-WBgPxcu$?rb|^S+ zFmDc~S<}M!gCs+`ZJmsG&k`z^F>@f@qi9b*<2`M(^4Op}hVP=Ul)q6aIY}{pU(ApK zhID?);mfrcp5T>uW(*HAiOw=W7u5pd!D`xn>Nb?uJ8bn@?2Ut3riN2XR6kj1$O6Sn z62r}kt9bxDjdN)Ey9zxMRVw<0Y*@Va^_gV9(_dA5D4gZ28@_z<51+hCcQCW{%h!ws zE(jXU#TcZKmU(GEgZ-nFVJR3hga1;-Phc9q%Hlb2{$-EbZ*dkm;WeNJXM;@?_R^CB z&tH56VoaArf)mFc4jcYW@M?BFqHZkH7Kie!2Zr?&A@d&tfAU)kj`KD?D}EpzHCTJk zXC;_u_lEVVAr?t5ENru>W*N~f6(mQ}Rm+FuBZAA5u^|)ilUO~fjG;`gbBzd_u>+Ao ziZiEbgZ0f(7VA_t(b#RJsVpLY>&HUn78u56wSnd^Xr};~kNg6_h7~_PzRR8(a+)c< zm?W89H*Me&7`AEJ+p-i6%;~#eUW?}r-r(L<1Xl)!;X&KmvMtfs7c@608y_+fKD}55 zO9C{lXSq_#P3{rAJ`Lol&gW5rJfDLU&E6)fQpx{a`6k1I90@-j?QsAMG7k34@;$SiE((<%JG3f%n|eEGT5^Vl;c?8SprqnDwl z9AbJj9w-%a=V~kezy@3^z1xUE97e4R#nkpD;q5v0sOp|izJX!0Xo&3d-3^WKnSDbmsz_Fc1xxb2tlLT-!mXEu5e#wqO zjPM6}pF~M=?ww%7COBj+ddY@E4Rc`Ux`QM8_F3JSu+N4sx6(`77y|%6HQtGLldL~y zX^bXqz$mu7vyQQ6YYZJV-KNuxupUuv0|`<4AUke6j$&G(Y80(OA>$47} z5!~pPE?y)|_%%N^c0Vuva+*wVm>RMB4f{NKwlEW64EWR+uN~RdzEGChV&34H{j?j+ zLSLYE>SV_S9gxIjzZQioTGO26=OA9ayT!ZoZse|A<@Gbw6Rak-RPS8wn*EH@uGN7A zdko@1|FE7}-e{UtDYEvb#A{9XDM_jRI^b54ySrW1d~+GS_oU`=kh#>M9jX-&Z>6Cs zk>w}2ayd8_LZ^OlaOEgYE0cNT@0=x&QnzCCzO5>8C3|h0$WNl4kHUf1*2hZAYRTR} z7d1Vld?IGwj!^JTd3Rk(-NGWohL2T!l{byTQp%UB$1qR3 z|HtbKDt|jv?YJ@(@S(0IU4aIF{kMBsg#FX}p3`+wIHyCD3Bxj;ryUbz;*qVm>r?}C z8DVa1Xbo;+3f%8(`y0Ee(x{8L(BPH3U^^WN-MB?Sx7`3Au4?-Fxu%X`EZ=V2`$L&!=D{_DgdHcE z=|kT&%V_iDQhQ56I8b$GHg$`1#TU8~KcYfbF9O1#wNZ9br2^UzW9+T$&bcosi{zu!C1S58hpC zl;!mg)r-1DnzLZj*>E#{-Aft2^g&nAuC}(xr8MELVuQmZU^i8+jwxTw%9Jw4}u6ghs+}9ZHY+Ph%8t1r@ zkmDX1{eKv_48o_S>*kP(lhR+N-HB`N)Vgq12;&eX0^rGEvG3w3Q(42OfHo5yEyid8r^-)Fjr@kqD3$GY8-AMfSjzSzz@ChmDI6_AC-88lBU z(iXJHOZTm#pdQKqGOF>sXwGG!-anTyuPoH!O|R?^Y67bBOWf$_0_g;YIATa2Nd|qi zdP^OSHv;gYdsbk4L1A1hnE0X7lz*OgKfm}nZ+sxO%drIxE_JNn`V|n?ny@k(4`*B z!gp`%D#k=o;U$2{6+t?uqkC`>W0Q0P*ovh=^ne!|9}n+m8UKD54xAj3*wuVq>Zxl% z&$QNh=ciI;dV}+2CYxArrc2GWM&o5ND{Mgqf3M&+rPs(;c3^F(loySFrjA!@EqkQ1K7Gh_kMQuyHP2-S zi@vPM)}TFeG<=>lVXgPx0~=fQ7N$3yXff5!;;amm7YLA>wZ6WK;Md_3Ip1&}AQ2v} zvfKM;^gUi^&YCNY|2YjauWHD1NoW7iw{UwN?icss`&`>X$IdB@Lg`6QjgW%LF(~!$ zES;{n1c?3X<=h`}Fu1d6F0GiaUG}j(=SRC2mC5KnP`BfwX`sfTi*`>L+vah7jNun9 zwU7KIL>xlcD$x+gDWGprquE;{((C-yuwu{m9g3~1kDUc9iy>vp_3rD9uZ)Ao0w6NW z!1!OZtY67Q@>&B*n5y__`(K1#QGA zwvI{r!!j|(MANGnUea19I+r;Nr617IRdEFPyLJzszKE_pMgXus(N-+k6^8-Bt1Xr` zPG)^X_QhT{?2qbpNk`rVB9hV`!Ywg@Z7Lz@e$eJCrSm329VMpJ#KNN{r9tK9nf5=n zOAnp<+kDg(T2H0p4;9$)&QD>cJHiFqd^wXj4<^^-!Cg(T!u{Rd-KVv_c$!286$)ie z#QzZ_``P861Y>kx1*Dfaj2)Hv zfa+f&zid&;Au>CW!iSfP`p4*P@KK`0Ph<#RI&9tB&jMTN3-a)9pc%Q(Ib>!gfgS-i zc7{w#*HZ^qlNb4UuS;7v4^e#3wIA`_Macx6&E{*ZgN&X?#B={SfiOy_#2M^Woy;^* zYeRi69Ic0m?i(ta)g@}4O{MuoL)DGm9+o8321{~TFanaSeHP7{r;}d-fXmSaui@4D z2f(P>kjH#kd40a4CSl%=ON4M#eK=7Eo%~D_j<$iKd&|%BUP~U2bbHd@%~=VGECh>H zy*J)TR(SlJE0;%%4|V0(v^6Jdz@4@2K?~R=9e*0~HSpAyetLJ#oyYSQ*JIAh9WiyY z^=BTckD4YD64rU^<513qhVMjc=F06`j!uq?cmEMU+LVp)*hFA-^Y(9(h&c>;EUg|GOkm6K~)JFVr8o=n?*9e_#6%sCdAr=yjAG1ZtEc3E1e3eHPJ1 z{`(RdG?ptH>k0YajZOYvghs3#uBuyWHMUdF_80Ka@=GNRizef7ZK{0=<4T2y5f0`P!TWZq3@hVH~vyQBw!nxfzeUQ ze?fGF%j8DnD1PTKmV@4{cN=?RwT{|*a=u1Dki%&W@uyNC9_MlQ?Q6(l)Bky5zAI_X zllG2~4ee6hsAbiPC(T%Y{`r3zC9~;AN555eBUbU$6=iT^H6^0?^ zc=&Z=y|@&JFMt{^Yo@`3Ul0Vv;9X=&-cOskJ%?b>2=sqCGP9!X|Fp9Sq4tIb{GA=3 zB6Lqa|3%^ba(z2N^{?WS`#K1NcDWLD$cNY%2^W}E_vF4t2F%R37OiO&Ys|EaKu29YXPhd$>Jqc# zeN{JJfXV&^mM62dcrL7+L>|zP+gr1!L`cG9>>2w5c|r`tMg`&21(xT7!c~c7#HI4YI_bu*c0R{B(>u zdPrl5iIMxTJX(Ym4-DR0E$j+=$=-a)nz}r0aX#)ZE08mFlSNiVM(2p;(GqW*ay1m> zpVVB98QAeIuFlP+A>MxwR1EbXzfRM>XHvpO2Egwks9uKSKOP2X0n$ns{j(a!dB!y! zYo2vECp9mWG(seJH}*QOuM`iS8mw)fy1E$wCB&mo(3c*=-`Ln=yR}n#g{=*N!$jfq?Rv<&omqH@N&qkgMsMy;Dj0@LTv1WE<37B<@3tgw34H zbo%K`XKFi@!si!lM2_{`faO!A5k`=As6Vga(oc+A{?p4>jwiiZU}{Ct4S8ood%BD9PXY zc7M`S<+(URq@Uov&!th{DUc#1H&FGyIn@@6%Lxi|;klTPz%K2wjG@9-orTvDxw3R| zpbfsW2vt!FQ6H+ydAWNWq1b;;tzMxAJq9gM(Cu=hwHm*i^)Yf|HUwh$XIs_=30xqT zWP_(I%U0*WuHvfEKGfs3tr%Lm&ueZmuQ{pIXk#^3h57#wzT`_jSZGZJj|tP|j3{jh z#%#FC$bLN53^~LmYE{_3>vtg3QFaZ*o1-aWGj7s$Y<(-}+Cul^B@B;b*nSVBjr?Bs zQ2e&zcmv*35ppR^E^5D}lG@PL`q@}!CS$30Whvk+h^j0f{-+`)CMH`&SSW0Mz~AWd zAT`g;VLI4l{5P-Q#N_EMA-g-PS5;8hd{YV~?|Jjavy(nDwn1L`t${+p=*VL}_k9Wq z;lR_uCiDrG?KJ-#za3%)0g~e#>_&a`Z6ypBVpEgdc^K$xN-gn!RGV@zEV;XMIG`pJ zVspomCVjeqm8`VTf@c>KI9YA$qQj2_t`7VNdmjSk@9k*^Mk;;zqis}#17=7_N9r*z zW9P@l;)}Sk%kF|+BwqHWxefeyWx&r%zPRhT*A?IQVZ=Vb`?5kzK+OBf08`}WX8of2 z)^lS|Tlv0?TX<7p*V_?}~`1YQ_UfqTR9?hcf zy5`N_1<2*JfR&S0?{t0D1jw8ZS_oh&^a;Ka_ER0xH>dh2^Pbe*4)_ZF6mLVjB#;ky z77$Tz+A3$5!VFs(cI$SDsK^(&NimvTkKe!_rj#(U<+o`xJwr zhJ7hcE(*W*XtsB7dDs?gqqrcVu^aUSE*;yyRFNUzFRr zW8N}CSG;oufIyhrQ?odmW_*()!qn{jtx8jp&{I^Px3`S}&$m^Yu`>JNx)-14zYp%u z-3CxoH#ve(4mI528c)^gbC0Q4Bg~@FV`pGi;fA`y2L%OD>|$AL&H#70UO85=`14En z_Hu%kadR%)(N-vvDDD-Y)1>~JX_6~g0g>6D8c0I^IdAFT_ z9B{KfkIXO*ISN4I<9(CG0bw~PF=5i2cq&vZz^@3-VM=ZZSlVD#q*rZ$R~h*_a?NMk z%su}6P_9$6ZLIpRJUF_-5TSCIA}k~X!VqiLXn_+3MAGe36w91}JZrZ~6@M?ke|t_S zc9RQz_}p(mx1muIv)g|ZldK>;X2zvUVRYS)QnO%}W4%SG;_h0car*2aGB@Vre$8Be zzdqPf->~DCz{!1_Rz|<~_|Y#EIOW`TjZ(a`$jfRVb~AlY@w{hc5S^{}pRoXuCAo~X zr*p|UAJS4p?;f^G2sDQ&DF~EoulU>mu`Op`K8QW^l4#1BEtt|Lf)_qAZuNC%OGyLv zPq|+kzoZg=b@b^!JS9mkDYjW)r||oTCq01}+uCw&rkEdb9AE+23+#n@dqS+c2PwgR zlV;vG`8UHtgK5vRH}e|=iT!3?HZDqsXGA?1kNXfz&&l}m_gI!ix)kSxK&)J zm8Q7j_H^N&xOa+qp!x6OSf)TIJoo;5v_98#kR~T*%Ha;UoifGz4mdULy-Kr^4F%F6 zPm9($L*(&N%YCn6L(_ynS7OaPPlOdKSKs?< zR^a^5A5$XdIgyO61Fi!dYHBS8p;r422WIpSqHqoUCdmppigbzIbCJ=5XpDgGa;M=L z$~^lzTGuBo9+jDd8{xEtS^W1th9TOL_OM?rBBQ6?HNtsVj8qNMtAa5*o~^rReSip~ zO;?K=39Ji|!Uh2YzOnbaUWN{r!5i&c(qo@FNM5&ob_(^r{K5{?>$7Gp3%g-Kf*I`< zZi@!Dx?@^$p96q@j&@4<0_jX#3DVhi_aXaz9bZZtAZ|m?qsx!Iylz`48_xhG=Qm(B zZ zbH{3gUz`MG)V>IfLR__L4Wt@tAoGE~Ul<2GCFU<2?p!y3qQCV}~C`AN(?^!)D-40AKIO7QU{ic6oeTmL~I(xZ(?VmVv>^R{wCPQV(J zU4!wgoHrU=A-lONDkaOqs!nn!8c&1gUACgbr{*2Z|W9-rD=iLB*6ucWdg7bE;$8M-& zfeJy0xSzmrKtM**^{Q#W&GUKzuhGp+1LCXIicIvDy4-hp;vWoYTl8J#oz2Eu(;mqE zb9n4TJ9QPbM+oY*T0uWA1dqh^AhSbjI0SzRn#{K8)y7woX=7xtg1}Ou_44d}y|9i}Q$?lk#3OzS^axQ*U+y$}!H`?AZ zEUu<&7u;B|AR)LXxJz)C;1=8=1h>ZBJwbyz1a}DTZo%E%oyJ{G=Xu`m%$fP-&$-S_ z|LWems(RI`s#UAjeeboiS+QlZo`2?W|EX^*!TWW|`hMy5_4GtED{V7^U@otgcW~{Y zG^b*>Fm9Rc0~@ae@7)ke ziVWkhwmej3g2r!$E79X!|9Ib>z=0iEY6K?d_x7Ss`vX_TML_B zKKejdS-7FnkjEKLrLKa(VjHvd9I^Mky^WQ7mV&=I;5UYS+6+o>q8r6}#kdu(Rr7X2 znoLb)Hat%%>wL#%-lALBr#E`e&dgKD4#{Ij;N}%PNYG3#XOu3fR5FsSyVoxh^D~bc ztmu24nTU-nZ2LR)2AOv*4x)g)-~F(?TQa2aOilSX-MK6n$ z!GELrmHzcpulw=aGPTL)wVXJ7ydz=*!Y)fC0*%&K1Kd7K#YHx)5)xlSJT*g8&9PU_ zTLs$oh2tH7D{5i52nDI?wGF>j-O?1d4?JBh9uR>TB|ncRxaC4X6RTxu2<2=1L|d|S zVwd{o7DcUb;o!zqHm;VQ4>9br+9GV~)Nu*LD!K2tRdGqOwb4qiWpI;??uUW)Dh@(@ zuUrupIq>^!ceG>f3ar>WtJhR-rE*e!%CJ?QClv_bFS=;>DwKaT6(!)v*`w2T@ zG^f%7FZg`1RxiD8__us|pKNlAcW~vAq|ct@T$&*ty%d)dQp!h~#=c>6a$rbFx^{Kb zK%)XOj74vWN5R+j~^v{upWPX*C_g-b- z+&2oiueN>h-M2BZz|yaHD>(T3*RVUgEMDr*)o~;=16S*c^?>Qs-eD z2UHmZ5`WRx;}V$sF8xG5B$#KL=~-Hi-MA+E zApDz&{T;%`B{+|^C;E9?lgp4qQRsEIm%#<8&NID4#+F;Py&N&0*ylex&wUP&6+!P^ z(Gda}mK4DHPy3riYoHa+vdbHv%X4R@Q`^r!!hD+Pa*FC^Rn@h%kLJ~Ujy-$9>Z5bk zo_VvXd$xqU1pep*2tQaa?7tDI&h(Fl>Rf+drBYa&F%v+`x@->5+XzibUHrgqm)pJk zl|laZ%nq_}p^1#S>&vg-FILR(04c5E!DcDuJ0TrCt7}GyXU(cQfzP{)kQKFYzxG8| zZ6I=bcTr2-TDPnu-`>#cvTv%^~8?Z=#P~(q)De_ zJ3nz87+?k~Z)PL(a4A5Og?}VcUN`NX>Yn{HheWd{#BkA_@Me8!E~!LrI;7>C4O%;6 z4^i7S`Z-fuE^a>MWYj-aONupC2Ly`_px69LF>fK?pdD?Gu-Z@rk@ zyr1|nvhe~P{ytwA^4j~z7<16 zv=ce&B`=^9Un|7wZozr`N;b~MwrkF;=MgQB0Fcg@RqY~gDdiBd6Zw5<9_ti34s|L~ z{ed2CXn}$%L56Fe`@7evl%*Um8zZ|3{|MhOvT}pZ_;VJNj}$V}E|mm4GOJ5d@zH2Z zke3|@$p+nuf13yGs>zAY;TtJgQ=7A4YYuk<2H-n7lA4L@z!4Gn-Y@d2qqH=1S|JNI zr}WgW=`MqO>qH*DXg41pJkV#(@4Z-|KKK>@2#2CUf(6hb*iz1tLBcQ=u?53D$)$m# ztFL%1Yu1L_!Dkw+JZNK}DvHA{8Iv)zAuHl=9V-03jt6J_dD&JMjf`pb`=; z%^EK<2LS1!JiMHxirAH3)}aJ-I-=J#V_;*16yme(c7@k^#KsAe=>s-LJP8^$E!CJr z(wJ$8%bD@M8ylPnW@NZ|vC7^}uWd>qF^^06~2m=57RI|Ak1 zD=o9xa&?R8n*Oq>rQ;0+n!L_J=A)DF4Bt_OlP`v*rR0WFG^$!Dl|_&J*^gI`&NFTJ zwNhmhMSN;bV{T!4*4OTiY=Et|X|i-4+n?6_7hS)kf|);v04WweTuJq(UvIvvn_-dz z%+7m1^*S-s(8{W*C4pblY8ChzsrI(8xY@E~Qweh}y64Dj&Bl zL-hr7nx57M>)Wi31hdf@yFFH#47`)Qucm%M0e8D(>Nn5#Lp04Kx-DuCoBHif&nyVK zZEu(j`c&4({DkO93!pt680KRuW%*uDc$XN}+sN;Efv>;zPW4F<;1n|2GG6a6dxve> zFnX*s_|GrLDEVoFhuY|HnuDN#2{g)3SWn+f=A8{hV6NGJ&JBPPIy)N2$?P)LBSi`2mT7FPRDL_qMw+^(Gk_?&Wm>dv1Q~DZlRt0K3BU*4TrCoYumPtY8C6 zUPGUwTXz2^l-@9P)19(2&{RB^1;PAr--T2B$>g&C@$qyYk&_59fZ?5%_@&k`YG#o* zbmX~G1=9-FcOFZ-4vQS2X;eQAlUHt;7mAYh12_E=$)nEl6 zmXwE`Nv`4iOul5l#r9^SY5A z*2{fe-mX?^aDUA{v6#)B9;SS6PLN2(o>;cz<+_5rsKfMKQkdlVoG4iIsdGX%3X{H7jWjcfpJd z4JM{7#GJtk0k%4Km8|fa1#+N*U}#|d$vZL^feH{7Kix)X)RUl*;~?0}y%t~iBVmFU zd=&gHL-l=k%VF>JX)nslSF@$3Qvxp@Pg%2+uXr43nYP}75-5^ixe`>8mwAu@-?ieJ zpR}PWxcsG~*7ZwPYGtLeJ69=Ktxi$sEC4WD6kpOR9Uz}KSsYh7#k~FY1EI5$vB8sG z!3wB8b>>aZ>Qwe&`IG*%j zBj-n9`P*0DBi`;dGK_%L!}@#Qc8$KFcg*C_m{Qc~-Vy!g5V_qOg+bR^GY@`X*S7#h z{EVeC2EaepZL`_neS%A4i@-mg9f;-x*M4#vKtm&VUwOSl{aA{OB-U|Nq9E8hjCPqr ztC$@k?iA-2b^!kR8P3(uRf*H{?j~r6^vUD725WX z9M1kq22Sns+7t=9MC3}vsAY!F<)feLX>0DaOfO<631*^nzHs98bBS)2r9_JG6_@IR z$rCOAb*fL&+m&UzV6-(^S*ghT0S6Wfl>4c@Z`1b^mC>ecv6S+dx{p;`E3fNci*xsJ zHl_F(&@x|pmbliINE8orTUct+5~#V398|4J=No-|X6md%G`>r}Wc{v9fHJV?9PBNE zu0tjz2LNGDH9t(P*RDVedj}tC--i1l^0bOYO^0mny%Mn!1pSwB}CIcF=|*V@rdzM)hVlI9Yf!c^*mO1p!;?p7AVkt5yQ(h?m1 zZDX`^pD|;Ch$Yc`=|3a#guC?aLrY0`f=a5u#QDTYTa$HO-ykGa9cW2y2B|A>nuf?p z?t`SBPJ^TOl^Zs&PAlYSA#9>D_k%|*NsZYjR0usbEd$UkPmg?fIJ~G03L-dyhOxkY zX67VAntxv=WWw;0r2({B7JdFSnJ4n~=9qhVf6;(itI`>V3{bR}Fa90IjW&>MZhnB6 zH9L!*9E~MtKV%@g#XMZFNwS-ZC`x=;_YC1dKDSN6S0;1+h;G*0VD>=qB(fl(3?{`8 z-nUxOKODOSaZ_C5G*)&TQ?H(Zu78-!G3J~r(2wIs$nsGH!*c1XdmL+wWE`piz8i)R zp9(`=T+u}(OGscx#B(?#;} zF7h;L#F-opuZbIlmmUEEw0mih5{otW?9!i;^nG$Ba~Fg9c~Pi6*?uq04~Aq--N)O zHGa@y7XTb_;I$&9hdLe^v%-)mABAIA3y-=ddn@;XY;__lxiy12jm9lhSldSyut7Ao z1=c2}T*s6I1=D}HnuFDngtI0HMkpChTpke{#YdCEodp3~P=H82$D=Vmg()ZRGtkjA zQkVZHopXr!1?u)bP^SR4d0_-{;;&rLNR}4&Un-o_#sk**c3GojOR}Ycexe;CE!&0lLYgsTZ<4AFJ$?PaFI(}; z2%r1CdDvRMa$&@aM962~^At?hvQ#B=6q7JTM7?053sfp)Iz-cCZk=XTve=^)!ZIag zkn;9%S;Cf=RNUG~%th+0R3I_nLqHb-l|wQ7quQHP8zyV*C_VUt?)KpnT(0G(MbueA>%q0x&5d>+3@wYcr$j*=l$$jHwvAW(_BO8V zhQz4MS0_7}70%cUJ@RClHt%ywMg+xn*JlHoHS5PcWp=riV{rbn4q39@j}`q3CKT>qB zmb!)moz+#1cgj<48m_t~vlm#3=q~fRc(y`S`wS;40U|jffKS0>d*ltk!$jw|Cmh#O z?5OJQ_?$2q@wl*XAKay)*q-tpC$UX8E`4~G$HG%rh?4ws=l!9J3rA4ySXo?b*-Rhj z?Qfdu97z7dVMdN^=>^F7EWyxDq0Ebds{B>dJ!22*+qRn$@Ha|igPXkMjV+)4p)K4Y8Z>mRxP!b(1lgOa|ipuk*y96DsZxe5QCJ~%g(~_?uxV2 zi#Ds#eyeYAcYArW_Fw|$2xrnwlN|V&+=$raO%$+~v)g{9^duu zOXt-__<0t`MhSYc!tfn-J&b;bbGWQW)o9KSvl=DsV{T~Bw69?-)>}@=+I&|}m)j+* z9r>iiCHq$Fhe94zhg(Qvaghyw)K9%u^R3XUh8z5lFhsjaNDjd;ad5kM`qw28eXhD2H6Dh}IPCy{8b#ZpFWhh;)ptX($|n|&E8d_bd?O;<%*v8CKq z#!%;GF*|&pCE`O7TeG#+Xlb?-j}L+9ml|1dR*sTbxa8GB0~GtvY*lQfWDx-Pz*Mb? zDIXD@O_RJ@QK`iys`f>hw$&ddUYOhUW4x@*CnXaKxv84LkDnGCY3y@WB$HLyzu<<`LW)hXm9b5UJG{Ob+aqMbGs3a*lTQf$9>zwXnzJiDUTMj5g2AxW4PPCCf8M!hkR0rc`XcJS-G|gQV9au-^0eTlDtdf5@uXwNz))X=TJ8 zm&bKqR*a8&c?ID{KvMn6WePmMd9Qmayx_HK>!d3S>O7{&SxvkqwtO0bJnhl8?G&F{ zH9%nP13}s}t4$(kxdbx7(GtXs?VWg+li*t)!L9LL!sVqa(TGs&NawY%wukrS{MyA{ z1D5p!naMY#pP8;^ZnD*jw>Xa3X!AYc-PeC}^&MbobBY< z%hVhBpD$urN)`>j9GaJ0GO9qb^-7i7rs9^^hl8S?)#UJuS)x>(Tp};`jq!iG$!>XV z!0*k{4PrV!G8l~^c)fZ}C|yqaY=_^>-mhd5xqF)2l#v)u{%Ws)K@iuKPx^>`-TKLH zvim(*R9;1QU`Sy0O9Ww4>lbQwT=)7AZ?FQ!b%vIDcm1og4x61nAjD-CWA<&0Cgc_a zSxodY!jA!}vqwrW34yHUl4BIVyu0w6Z*1)xca$h0yJy({b3?jUbLuS~-JwWsi`j|t zwp`s_za#lZvz|BF7P{D8X)cs_yUov{!vnEo7PK!{r#4Hcgu-;H_4Ng7#WDQg1nb|a zry>dVF7GZ_tEF{Kl(nbV3J8=FpsW|}29(-FTTF8FZTjfpvVQlQnwV0)PR~4L)@S4u z53V_!erCF+;vHc-Vrg>K=WzMr}Gm1-KS#Fw|Y7D>3fxgkhqly!Usq| zV)w&Glh{RUPUGD&BbwCdx(O2+<}2;?(_5ocum-pD96qE;5rix-hPmhBBa>@}^a~Ae zHfJ!;s(ur8tA8fBH3iCfG4Pgv8&ZtR>A8Gz{Znx&>_*V(2R1Jbx9iyV+WYn$(!fe~ z$oHgI-LrlsEsMx>J7P<_42xSwxb_GPel|LJ0iS&Pm$y4+b9q;scZmo6-LGoxqB~~Y z4Cn}_9;skCNPBo_BgAOwMtn7HPjR@d9wed=vCL|SGn1e1hOJyJ!b^x!*A(4;4k>Q9 zdGpoW6UWuROFJJwZdUn5$n3sWhWimxeyg*CofaTP|LS)1Z{x6>Pf!Pt<~_#jz#i3L zr5}FL zvyk-fkU$2{mD!br|L?cI3U*2Quj_q8vMT=+fbaqnztzl^ zJ3qtyQ~v|o=~sx!`{y#g3$vo|zttjm|2LZbbl}Yi{FUo=XWbvdIsEq>0lhf-;m(Qu zBtB1|8rZ*6PPF6l=@|s`AHh+4mD~SI+EL#k{d$&$D0Gqi$CLAZlJ?dj{kvC8h}Z$) z7T=iVpZ`-Qf|u(W`M<dK+f#ys(|re9Ldu<{B84xHMhOd z^i%<_hi6c)s~yA+7bzF4g4LF>)GPE*-UL7h`)${{wud->J3L+p7a&}z;n}Y3H}2Ax zD-~O=*UD3@`=2qwXV2Jk%Rp=IxR93)-~MH`TzbSW^gr+U36Y{BxMuWUpvwGn6I{+8 z`5#rVS+t_HSGIIxka1Jva~`>)q5o&vh?m`Na3;8Dd?SY!+cMDwL;3$ZUB(MHxH>fA zaR-Da8Z_rTe8Ybh+Ulh$mc&dMaaEI<2Wgo)vo5zg4YiDbRYYzEvsT7&sRGrq`E9M zEu{!}`FPbSf!k~bu#PJCG2>*xMqqX1zw^bhe*OO@&D;A`1@_R!9z?W-BGhLp6 zio1QuWObJdW&Fy!E%a&GPzn9EEsrx=z{H#JtH@3ZTZ2YA)!F%U)RpkDhZuE4R<#W zp-Ck?X~QAv4ch&>(f)j-U}$r@pEa9O2KHXRsQmC=%M}*D-)QWw!A5=b>N~(1*>p>7(gX9cg%)2>2->X&^)=`Yo7 zOuPKu&?LO6Ul!|E#{>ku(zSl2aaw-_bPN?d)jXU^|M~Sf z=rZo$rUnX-%y|A|I5oaeU(3_Fnj2H`T0@YsI-z|9BJ#3Hb#sUlDN?$oB&WqXDX3Zl z!=7>B$;(8v_aOaU%xlIQA!}qScF>>47&W4?T&|B5WUr z(^geAeJ$n{qugyCo1LygZ~kc7KpzBVd9rIJ81B=(Ry=?!*^4zrJ8@KLt7KoeIN~|KZnHm<*tUUe(kGjUw>YNU zio;|B+krM?>Ca7-H%)gEMWTH~pwq>?Dg6gt3dA|6j|crdAsFw!PmSP=I_jlzSbx-M zo?aw|{m32dNzH7j_7pd8DcqI+-%H;skt^uib%pgOnH??UuND-a0 z&D8ytaflEkPY7h{kyLBdC8xAE~8Jm zpt6tuW@F!NNy|(O+q@yI>mp5_xl)vnZszLdj zZ*4w3WwxJ-C6Z2`%~m~OY2)LsX-2;;3$|a2PdMCL)ZUC7&Ynt+M8At^8l2RB(MivI zU1nOlTmPKsyLVsyFt|pqytlVk;`0*Kmof{=z;V2P*~+Yiymn#eO8ZD-e}Pj8b)hY_ zh~wpA@9^o#v-XBF{@SYj6Oz|;CP^AXv|DO;`%6e>nNIz=zGGwKL8bqfeS2+qAz6F( zhfjj{Vs-~j{=J$Q8JW>J(!N3~nMt4wG%sC;q#)RtC=798QCyZ7^=2Mu((ugK7nM_m zxj0-TWR;?9(lO-G=GFUtV~8LY*HxPgPB=_HY7aUuRW2l;Za96oCMeeL>r(3H7?n#dFE0}h*6h;3bHU~gtkn)a*@K~2 z&^>fj4h}vS!&}?T>}P;&<3Yfr>fgUYiND5i6JX`}h<^6e`!I;2Rm&sj6ZBFRP?oiX zuXq5uP2UlUd1#;9lgz8m{PHK3SSo4Ofr-TG`N)UJk&7^s*qBit#+RyJTs*Gwj1n=u>Wq+*upe zkH&*a-0o^^^};}qRQQ|NpR_M0WZCZ-t zU3C+XGr(;CZC};xski#Hya(1RGjRknp#j@PixciQdzJG`kmWR61hPiL>1PEwB(w8* z$z>(H1Aw%-+?XAkhpqEE5Cnal%4};F(9W+Dx5w(smDa8unV6nsNRTA|w$G>AY^vO* zV@c2qM|r!B{?`L&l5i*Sj#3fXc2coNLd>czqffgZ;|!k>V687~pr$HrE3SF^a(iq= zlUBh$i+$FZ0wp3>{wZ;+2_FIhEnJbWf7m{fq$_7Gm;8DpSoPo!nTji~CigG-Nz2)r z*=hR^#p*sTzhM?vZVZWN=%gcp{TpT%(QfMB1gxSBx}^JFWlyTxXC(*uF%VXHN&Gja z$}gM8bxjgv5p!|>?|XmaGbK|D1K+WbVv&)i2Ao6eRvZqEdw0c^GSac&Jw;4F(6Gxl zyI;?ag*lNC8=X`M8{p3M5%(U20$)!E* zxeufM)!RGecS&7SQ7V|LuASxcF1>u)(|=<|wX(yf5{0yd4$`bPR8sTrm%OZp4Rz+H z``FeNl$OkY(@A_c!r{IIa+M1y`mjvblp=c2H0iW3(e}KvYv{N7EWgKoW9XX0yAqv1_r4wCbz*<5(dil*VQQ`q=4pxs#YaSMKFe9v>7! z;^8TLNcJ9D-^Yz{vZExiyk9VZ$3rcY-UPa1S~E(Jqs*phK2E~qbI7N7OTUVx0Q7V& zFX^?7inROe3AE{DxG2G!v-s*)ua;|`WM-@eWSoGNwTxz1+h-*YQpbbk-jetE6q0>r zPsT#oUH7dUsU|F9v7+@9I~$*~Qm@x0TiN$G%+>@^02;AJd1sviuEq*#I3Uty@;XxH z^YGHy`9SP7$x?W+V>*Z!=rAu~Z$a6sonHimJY)ItoM)~w;ymqTFJg~~(gD&@_T(;P z^(VEJ2Zd%R^2Ss_L6@Du#xc%4X@KXo5V^wXR%@gdAa%RhLX9-mEYHcO7Q@K=xYbgh z5{n{ap1x8uh}AQxQ+kaA~??gW;=7d>L{DxgMib7kQ|JhBLHgq1n{Qi`xflbkELZ zva24{ee__jZ)BwG@`QbVowf?NtkzWsbz%}iozN^6(Pc!WB8>Q%LKdVpS1GRk=`+P= zC-zzPrpU^!nqwo#+LXlE%O$5Qkk0v4LN;G7|E-}I+K#)Tc0Ax~ zejm{;N)gnrWo2^y5*BPlLX;Q-SVdIcjig6R;JJk<=fG!loPDd3c2-ft4MnO_?od~5 zth`(41B7(M8Bug=XCg+*7cYhOjC)q}=0DTWae^1C>{ddTYm#o74jFoF7MFzM8gjR5 zyJ~!gHq4Bmpidx}69mCgKY8h^zMi2XJ>hkyTOLM2k@Jrt}|jXYW9u(y`mC~Aq&uCQA=Jd%`Itt2Y?M}2M8p=TWh z{}b&TRC(uF4pz)|yOb*zqroD1!y-|Wzco zKstjRUxhVUCokrmPzhOb=*T7TJ?i{chBB^#kLl;*n+-uxwDT>^6hJ2mS{>RqrynTWAXSWDlq5uh~U-Y zlY);U=@Tv6`474knXjjS$N*@s5Yd@1?UJLRF zF5e8$t$NqjP&4r}j_(&PH{6^+jM@nmMgC9pivQdWS4IjiYP+V&Q(X=}4+AehHt-drr)ZU}y|J7$Hh4Eh7pvEX_!!suGn{z&2hVrV zomuK3@B+Bd=z}sYCnd#IYM`as0ya6ehj;NmVhhAzY){fxHrknduJzf=x60JJeB}0r zxXNJy83|vH9mdrCe#9J{KVOa@iflxHUa0!1vFi zI!R~aIqbH>etn$@rW-?vGIXp8)XCeIvUX4PcAv`OADbazFoy>AuUP4UG8%1sG{E*@ ziXU9+Bfx9@U?h@1sm*8Tvg9QZ@~cL^eTkF`;7Zu}sEH0i=4)2FQ66c8mB@b+_Co>v zK~v;?H@DwW3`>o%#}@?L zwI(02_c&7ckYZ1E;bHFlW1JOo=% zA3$i&gzE!c(_P`?1JrqXD9&LaFkjP+Da8#}>e-44Xwv3(cb+J*zd46AZ1J`txN8Pq8F-phEzz+?wMic<+W<{UB1q5g004g{~w^P(Av%Bwtt?|*Ah;v!grsPqj8OUqiiRu z^ZULhlLO@G0)9EvU7|e_L8p_$bWS^S5*9g?mV2}C4nTl{g@b_RyS;z&0FpweiD;zK zqcIS(z1P;%C#pSrpjKXAe>+WRQDKQBe6iV;cbPL*4FKve{i}NQGvu?fTj^+4FWUZzgan z$9`<(Mt%QPJ>hi~IOdXl`lm>yb3E5~P+;^l0rl9~*suzT54!;bSJeKHVv#qr~K z4Wfg2V@BCOmV`9NBkO$^ZMMz`S;Rg3 zX{5>MEtr8tpZ>56DZlYL!l6;`=|1NGqIwVJEU1C6!w`nDG4&Mfle4yKR;w%p84&Cy zG-jvc(%$aQAvLI5OnBF-of~s}%PEC=_fzR06I<}r+$FYmSFy5g3LsTH!r~l=K#-

    7!K;Kt+n^!Itz`|sG&-slXR3Slujy+W4N{$E2U;t=QGO|TWq){Ba;LE z@u5MEyk!{&FbX=I;|Utb2hQ+=PjKtMTVC4Z_mxp{N9pCWHPqI%WuYmRt4Y+^Cmy7; zrYrW{%h5|o#3=g5MVCgv0ZPV|CB6>4kB7#7YKP(2t^Q|PHPZ3H7mMt-8+0Y_L=e0( z14+Em+K~u>UnOl8+WY`OGon{tCrJw}siA0rV8y~)rxF-g34tk}c|x|`zRL_n2I-cv zJ-=h+{)BhvIhi(1oq=}E`(;hoV^vD$eld6m3_@0qugk9C;x$2PW@~QhGSIL~l9&0A zb$z_xOYIVrRk)&|si-4UP(aafZ)?5b+-LN5Rj&awGr1_oOBZShWbYr>is4O+yXe^! zPu3eOCGeLQ>jH|12PLzuaiSNV!-I3PZ|aWiRn=#q5Da(jkG#{dx-VOV(8*paF+By6 z(i5>^$oh)=&oX0@DJp8)jmwJ{R5f9QCKoKj)XBqo6lJE+UcKiai7Y3l1F6s0>qA_% zl9FnZR#g{xnn}~Qp|s%SsI&oo|j|Kh$v6 zA^No18=JW8aCGwk1|ko|nm0Xweg>8ZCQv|+2_>64eu<{NbDMA??PhEAyZEFu zbq+SX`XGYX#&Ry+s&A(AX5q^Rfm6HG+g)$K$<-rk9k9{lcBg!J-0y+~{L}BgOs@6S zK3`Ak3vlya!^ctyo08fRJ?x>q&nf7Cr|;u6`-p{iYb(;8tQETzL+)dJ3_B1W(hGBx z2KjLu)9-Q^#`JY^T0&`076+zdJ7nv7{_gtpo!R;Hf$~P`Xwj#9ltpml8H`Sm4|mH~ z;!XW|m&m>QSb{G7Yl@6pM`@!dx75_`RO}#lrrneMWaX(A?v{w{ps|Xxr}!~_1VKA+ zs-we>k(`{@Wg{I-RQ$xF+vol^(_Y96ZDkTEgCGevyU@Uc{f!W(^s3HZu#p?aU4C;5 z6%rDDS)O&<;0!(Vu;96M8`+~8bGn*#C~s`b-@V+W;~R5f^LaU+&322fURhiQ565t% z9WOlR{6Wj*dp^g?0K3#RMz?!(#hxqnGZ1a6IZd~ueROm0M`*tCc0bKozRNvhKfY_> zBNH&ZlxlOkY>CSNbc)t~#;9D~$45r7l1EcIAA4wFAa2D+dFV%)HCW3B(-FBP>PSi7 zOJxXZX2e{H7&T|i5s?^6W~}0%s=dy^q%GZEwA{Hd%{iX&`RrU~=f)*^Fq&P?y2VHy zyJhTEc)o~Cwp_%DT5@S-O#1Nt4L99D05O?FMz6<{dW}_sAJK%E5sxdi;B1@rXJ?fq zw3K}DKPdTm5KeX7?WHkN`al^q-B<+tzQBw5djQC7u|lnQB$d>>%eu0Qg|J$FgJR1| z&4qNeYGHwO<<`|rV(M1itjic^j_BV3osZ41lZEbj%$1u6`t5tMoa)IxfTk z(!7%~2o<1?XM_QMS*Ml{AME*FYSk1UQ<0<-lX1F1Jz>vWZPy$hQ$e!SB9oVWDVn*k z%@B@(@F`U8bRaqVA^e@A+WqUy)m*%2F0z8RPUjuX1)Iz^=CEW zN6D*es23nW1I9I*t)GjZ_GAdHp9M@?>;BZgpQ5$qBI446;9f%Lm)q`C@smEkL%!fM z$ZSFVvK}jzFog9_I(A6`gkmgNi$R{25HiByU54Q1jQjmQh#oO{Rf(7wn)^9&bbALd zD{JI~XwF&r=4!xyAgbKn5n5<)$fWG8?_^R}CNYy6tGLk5z^@Mqt2QvcafuNYtjoX7 z{)`;Bc(dw~es^=6A^w(ObeAKsC`7Ywi(I!Oc%R$XQ*2}ZonUiWylnP(1Ly#=EonAt zi9@*G!3H6(ak=rVv&4Epx7!JJu+kp{;IwAs*a!+zYJn?H+d1vYdye5?QnZ59U*6YsZrY+k*|tBXkEjK&P_5Sxwlo1 z@7QfAXCfC$ghaWqkU=1>MtUvExCVM8_3P|PLY|I(y88?T{VOC;*9=a+^ zA(hj7e{%KndB^=|XhUVk^~Y=%fNmdfxh+AEk&Z($nnzBffMfliam^xm1 zBdb}pP+Xj06H~Nr)wisMxCyi6(KJJR%fB;~v`SP@W+utSCTKqy*TfGX0wN+05z;C7 zm~Z55KCNscBLTjZg+|4GYb+cVkPVwGJW3wBr*K6&R#Oc63w}-p8!dIH8m=%m7`yFe zIDgHtrL1myAOmdt>zWwV$h{<*jYcvw?%BlBYy$XJU{#G$zsRP4f<=8|y#% zZF+^x!T)-}E9dT&tPQ%<0C`7wNI;(cx!L9|fP$Deqi{}ri%1ZZVGP|erHRVg=n#*S z`>a{x{Vy~~{VSpKd(Wu?h4!_wI{_}2Q$q2oxkiV*T%`jDK(}IlFq!ukpnJHHIR7D6Fz|Ah@SdreHb#i$sa%11bM z$=Bb&usBhX{SQvr1pnX4G5ibgKA@ui_`I-g~Tc-cd^hE&tJJ&haJf~)6oZ1Qe+iW&BH&0#OpN1m7r$mQkDb|7eU-0Gs3)21n zAAmMhdKH9)?tHd@|9743KSu1`Yp=NqWlxTeGaL4WSAxdMcpP?zz4&;V^v{}dz}Ux? zkS>j%a6>K@*7XSd;*&H_?72@4Pi*1 zBV#jKY(U-&RBqhbkN^WO?`F{7Z*VDw=Jb@Izu^(1X_xB zo#(F0(;6Q{8wgpc1ijN0+(B62*4tGNu&SCGxGV_?yo($o8AG0@85A$U1I0CW0Y^~)tnVM@-t91=a;=@>;7EI9Xfv%H zBY`1mms(wRjgi&*{S=|_z)uZ&%(aqg5NFkEvVC5~F1NPPo1Jy`J%w?LbM%6NPnW1; z97D1Zk*-FflOQzPh%D9r{Xh+*(I(30;ZJZk~Dr4=s)7d~pdt9hkRZ**g?w;>agL*~_|Fd3*hD)-@$vB_-u8E`RKU8Kswfpub9}Op z4AHv!g%m-}iJoN4_Hs0&LD)h;Ioc7~XORV8jZfpG(ox8J6(A%sHXwfF_wc7nMo-Ljmnv>Kn4!zV{ zUJ@UMywgD(8nA2xG%(TaVb@`Z2Q{m7GH#3 zs46&eKo$WZ?gmFxQlpWVFd+mY*Hmuvj&yZ2?PrhMc^-EBsr@_u>6*e$!nq|${rC_z zv+{StAk|F!?Z!>0>UkTCac{f;qxZ&xYBeDA)KhFPns3xl{e79)x!Jj%@A4r8jMY<1 zvU0w8xDvw-w$}etP;DS#r@8i&6Z*g^+({ zcJdALv9+b=Zk5<4nPNz4lXA^!GfEdDHq(A5wNnAOO;ZjZjW$W>uFsd~y5UkvV{p%WN9`+7%o z&gzlLpNpZ(iGW{^>tobaHvLpr!BhyONF@qPR(qS|D+Q5`V=*eVHMKRuPhIR|-*w^9 zjs>pW8(qPE*yv1JvE09gYLD5~YP*NoXJ&RB5Y`h$WXD)l@k$1<%kavZ?N8$2d4->b zJxD-$r27v2kr$L;&2x?0B27cyI* z{L{zVo=xKEO+50=Hz{<)zgjm*gIvc!l48&rybHc=lYa4zUn$Su_!+|{-A?UX#02?I8P5%kD z111INfO1uExrO?An}hy1arQjs?YXO)k<{TPxS}km1QwX*1x(C;$DEviPhf=Bt-g*o z8{PcYH z_NqKQUT<}7Zu&hqXC80sY*v=u`0mKmw>Nkh(_Tni`Clo}$RPll-}Yb7VtW%u=^?mY zl_Lo8l;7>)>T6P0OZlJsvaxc(N3+LH{*z9A6kh?C>rtFWWWNO$Mg}H@o!sYf;?>QX z*DE{#cJvJbAhiCpGxVIeN9cU;ly@m3gwUPF?Q<{~R1X6SWO$dXF1K8s#KQbagm@5( zFu?B9^=*<3cWBjkK8JV9HHO~?|mwZ@Xd_pz#On`rV+!4E${`c>9PmWv!nyX;PPS@^8>yMzA zhlbcXRs%ZUyJeo73czRx5CEh$x*mysB&ye)P!2B_J9IYP)yhfAe|fT!AMJZ5GSPWbK)zpvBqoi3Lf&%fp-U*30dk zzTx0K|OoDm~bNrJKK^B z^vDiK5Jw07mRz^V-rrl7xZIqN?WGAkn{*BM3BTTV2dXH=yGySvw!>(xyfK3UF3u%s zB>XPnlC5{k(DGKq?eX!QgxlTq9!)^NqU<%WAWO8)X`|NBXy2NpA`sD4v*&cd>30qv z92hhJc;7kKn7I^P8zR^dmo~LkT)io+``%V*||Zg z=qQ07EyPk}0?E)2g<;rUwKuna+cjEKRsv%mp3IMDu_=OpXTW@m+IN+qootGjUs$+V zTrZ^{S-7zw**uxr*}wn^d#;ILqu)Glbzho2o=F)%+C^bEu6JF(FoH<>UQO$Rnzorj zZx;ND11>Kj1L3q63FyyxL7=9YI>)&waUmg45XylGqDL@vw(bUmjt=TQFcilHVm_0kV763|Z z)sgt|8+5o@=3{@8sxSVt!9FErX;I((WB~58?-+1+e+P%Xg*QzZBnY3QauTNi;b}y( z-?Qf+n=p{r4H%Ymvp#ieB-Z-Qsob#H!~Ude4flYiZ8+3^!|0$FuydbgWE>baUrw|- z&C{$?oE}es`b7Q1D={+l(Y!n^5>#vJoD7?e_PBoZUG1chPPSfr@3gOT3~;`ZU7Am6 zYWuiBiJ9%`403jMu4uhjbll&kZVLu}^z-?~09(xS{e_u#`HI>L=@JaRBvmA&lQRJa z~k1iovwJM&(x!9DQ!|UEj|C-bw2k zaB`mHw)(v^^1xq5$m^gTzb(Nj+pEHl;bb2lSWtZrW(uu&a*QNfzd_+}SZ@QYjxz^o z^2Wt;iR3kxlX0t0Oc>L}{ybs}L0#^-I@@jR9{@MJ4))lg+e7lcxZcQF5bMosg`e#~ zH0^8oYpY}*^{yanca@cmBz#P{gd1qOl7&KvIS$2#v17a9ln z1T57aO~@`DXO-7JgPoo3m*Pq`e}>olEv;}K7?{LJ_^;0P&!n9wqT|*I)&+`W^k-7s zz4bmgpQtNu>D-;4c{Us9vEJTo91y_3r8f3BLSeDJFvmz_Wv=yTB2w@GFg5XlR9ogw zOi~+=+m6?~i_I6?t&Iac;B#v*-_Uj#lj4C90;p}^`Ckqh z)+c)3g?n?}_Ez}qop6@r82g-ma^669g|D2HBP@mPxdDdv>jFN68%r(jvl1<6q@@vX zwU(mo1%a^NTyUaEdO5GJ90b;1RZ+woHs{pCL=SFbV?9#J5hpjL8eVbs2N_McILU*s zv+)K{F#IOv9gUywQwcXY(SjPl`by*=*D0Q~s32a;V@J`m()SkAgXlUTLbqW`oa}V6VE79jR|q14WKlFmH-P%ia0iJJAJX_AJR*W8?eMiqE#G zMYm<=2gWx!Gy@VVHe0_YaGhGC(;oWR-dynS-AVYb4;SVbBl@4IHP3QM_`*+SR2_?q z=WkZ?e4lf|+_y$%8F2#ce|LYIe(P_xunj7B<>Gr80NIWDT%6!Oas8)%OUpbt&1nC- zhaa;251YG)`#(JVSt9@N@T+8P6$ZfC3+@wC_m?u~JPVC2KR^1>Z71R*F6MKJF(`VC z^8In-{eY*g7!iKg|GPQA@UKjc#$Tlb#s9FyZ;t+>l;FQ{8w5(4%`j1t!4}Vpt)4NV zqKP64i|p5gGL=$N4m$9ZtT6HoOc^!lS4G&?Rj=fT8l?Lv;IprFw(+2RVyWxy#~<3% z31z&5H7dh6MLCoo>jJhTu;y{rl{@49WQsl`{Gq=rA$J>Uz9}jo@+z}nrI^LSDO{a_&VX>T#qFt zUV)f2{Z;=H8#GXm^{A%I`i<$vkC4WCdAW4qB)1jbao;27_kB=DS9+{C=?+$Tw`EsK zuv%{Y=;N2GSN83dd=klRBZ^ZYqX>%UUh+fayoO}As%y+2axs|lKQsz{c+nbZ&KaX8 zLS#)RIfSLg3lvb`NtF*^GO*5%I0+!`2IO$Fvy|LdARJ|ysLG!H3uXCY{AGk3Am|r* zzN)E8!=|L8(GYcVl|nICeB2j(L^oMR0%;A7^dm#J=Yzc#+srC-M1y+8>3fY-N#)ED zca)vXjLTnB>?T{Bl2=t^r!qxx-SzaOZf6j8-p8INdOT)CNz!o^`n3l$S;}Rnbs=9- zyh@eC#^MyicABhM94%Igr+;Mj6*CZgO?Wfea^Rs^_J!Fy4^b5#uGD+(UzZf@_f$8H zHwnd=oNO&nTp~4K>L*(d!YOclE$^sURx)!gi&4OWB9@r_cO}8q~#*yMOJV*onmUXd` zZe|rqX6(lIDvi2Kv4~bA5)~iW70~SYc^95&t1R1I%&?LHt}?r6fo^nmjd>NU1yA%a zs%Lq1LgtLr?7rYn4IvhUT|7jH%=ze*M&5k6TyaOae*{e1()dZh6h&-A&$&%Otv3^j z9N(G?o2kzz9ij#$sq3ae>>91LzM-Y4B_J#6aOYb#gn_F;Z6npWiTs4_{9FP@-}JEG zJ!fEu%q3K{r82RO8Gfz!sfZ?8}Z4VW|nA`kwNZrUR`IeS3przF}Kx z$!hATKwlMVP;VtF+Rhm-bU9Df4HcssTYpZ{ifN(MPc}pvfgCcS;PS@I3rR)$!PBGw z7(pZJN43e)TxryPKw`&CR<$CG*bq)$TkG4cc}S@^VvY&nxWcur8UD#+8N4C%Lj9Yb zWfm`ag0>uGWVCfn;tymzi8$rZQgHXNh+fYJsBRivNUW2c3v{%VSwwIk+i1&6TALuA z`IkbiS=>l`^L?5Cp`7(9w+gZ}(2>(J+vt2w&zjNx%Z?>y@mf--)U20a1(}os1vQSQ zIh@3sOD_!l`K40FFdJDKMTWVTkBlU(pH%5L^3E?QfyM($#w3+`XotgGn5GZn_{qaI zHnAfKKF23|C9j1@&o76jQKIYUj+BCp9y1m2yXo_s+jHx)7KE6hDDo@5!eDof@RLtK z@2;@x#EG-W1~J)>{jx%ULMndjSfFmJ23`%OfBNcz1A1RVM6`3=iipU)JLA;G&QFc4 zhUaO1-Tov2O;mDM?_7%QScC`=MNfPvp2FId5iVW!q%B;Y^$KLD0gtRsZF2Al20dCv z31L{|CycosX*E9hF{Ydb0zKx*|C+qG4wfAJKFDwQYo~06O};dvIQQtb)L&(OkciG` z7`xZbGSg2Xi#l8=xqvKs*j!dcneu(~21U}YMbxE5C7(}EQ6fYoSx9bzN@W?{QrBoX zGiJZ-t&o1{xW?iSrOKhNZyshvWit0$#NTg9*HpmROCk66$&b4673MSI^RpN$xdO9> zO#gtM{peb-6AK*5l)24*tN>Lo*%^8PKm|su4mtr4boP z;Jnng%Qvnb1Et37l1|9Nj>9D}oH;Rgb}H>mQft0QoN7tXeFzb9I)_sf)bdp@NkPx-`8j0L?U#vOS^ zxq#~^s+|DT-pga{ZpGLRj9-(5P+LSdnUX9Ei#1HsMT0(@_i7=Xf$LI~n{&WV))Uy; zNW6{IznOi2bGmxGcx6!N?8)qA7e({PMtW%JuMoarKS)LWqY&kyZq-$g%-s_!8 zBQr^=_7ePZUT}A+}SK&ALpt2%qqBc#2>fA@CJLnTF}df_JbY# z#y23}LW;hvszbegl*Bq8DQkJyb;elpA9Fm*x1^83Q~9+j*pLk7#aYINUlsL1;Qn znCm_O36Kj6k?yp$pl8{!B+tqnHl|@}?(@C25ue^9ZR0c$xqxUbujDleQNHxl2^P&L zbw_7?I2a*Tsn^jHo99Vsw2ryd3Gz?HJG0jORwNL{5Gkk98xT67X8B}FjWtWb?#-~Z zR(yP>bq)As@^_>yd>PQ7^w8PU!)lJuu>6 zFcy)6xFnEKLtGyqF0U3_=MmZx!rrA3Yr@mpq${E^?*2JxP5Y9pbc_r(t4tmyUZo|c z)~54kMJwsiu@edrZ+U$15;u_W_USK3uuyh{!+2{HXYDOlrRPbT`%&7diOFLa?Hhmh z_&RjsJ6GY)m#;Bp>#UE)x98-)7{xXJL_#2y%b0vB3*OE_1LNsH`NeY0zp;Z;-A>jk zz%qDpf}uX(UXk^D%KJDji!ZQmf4}SmpV~3&^Fky1QYP|XfB)JI;`TT_!a-1OaGBd- z;i5l_lt70C;;`W8RF0ZD86yntawvSKRI-f|U{~-C&w%a1U}2vai~PQB;B({YMv?JX_; zeJV{ecMeW1=&+v|^BCmw1&rRLD8XY@TZ5I0&4bvBx0jP+T4+*Rb_lC{Qr>O?PDFh6!n6BgwdVhkEegFIjiBF6Ss|OEo{gIv9+6|3acUo+1jZu7P^95aUG5I(NBgZ`KYt zr9#PzqmIawk$`BSZbv^4sY-&9*0HXF81pv>V&l$6^5`}>;@6HOFnDSDk!Uxan^i_wglzPqVPk<)wnZ-YpcN7_ z?aUYn(Tr0ZmEAief2c@hmeloz0H$K}SO;JePHWcjL(9T^mZyqpgqjq5ubu%m~j?@;X{U51q3ZLzpJbXpFxGJgK4g>1+Rl;pS zB4Bqp_ctM_HlOWrrg-HlckGcE)9t6rX6AGs4aXS_Uii0azvl@~+N<5WvErx7eM#Zq zSx|B?(?6>K0!iu5Rcde4So~m@-nzf~P0Jid2^wwl*qJ}@E`8~sa347{tZsSyIc;oP z+I(;OVTZJv!_39~iu_!z*0<$gW{kAs&vM!{w@3Q2`&YI9DL{wi=-tx|pK7^b1~!e_ z{bwL)52Xdqy#T%@QML4#eXMqSU`g?CQzMsxHrO>;r^7tF*}9&ad}Vw2Xy9fRG!Q%Z ziK0J1aQr2nfzyDfGF;*!V+vaM4o_*qx8t$tf%IliHg$^b`{yS9`ygR7O2q{89?y&| zyx&V_Qm`4`en&SZs?Sdnvqd^ix`Sp^!mqiVeaC?9AYZP~S|xMOxIts(?_L1cC}B$c zcO8S3UO)cmdd$EpDjv+ndNY{n$*ZruUT~!nbGEx`KO;(Ly2a#yomzu>h@mjKBN*FB*2)3V2LQnKvFYSAm z6P5W{DnKQlERsGMjZitWe^l24uVdh;3|P^Zk8z0s6H*2r8#gFAg*`9%u`USk-Oy6X zfr9X2+MH`rK^5#s_q-$3lfQIat(pc=Gd!c!V>UE!t0=*eiyBUIwZ)E}X~h?QXG8dicLbEpy19WJPOm zG5f}YvJfS&`ZHpfA3TT2OU5!2uzdd>db=esfqeSQ#$l?oYx8;F<2ioi31D{-`APY# zV?vu0ql_qh&ZsUslAEixOyu_*#!y`QX0DQ(`19_sWri`_pHBzQ_2_?c0bMfl?5^D= z#YfJp!K=VKg9L2Bxg8B#V}5Q-U0C4n{Z=*8wcQWDyaaX~NRw#MbXi$=*aqJ>2?G(J zXQSN+CAbbB%c-W{6|(*7d*-xkjNStpn7Z-jZtd$mS3+VAU>0sRBkVxk%e+I&7*xAC zCQbU~bu-x*UA@Q$3P&$KgEYG{OzN1ZI9ccZf*j zD$hp8WRC;j5;KFu1fSu=oAt~1cxIq3{oipE-GG2yL2b&aE>1XbI(N6Z;45dgX~tp$x$s(4frfj|U<%wkBi&FpSq>-G4DG5K51 z$Z(vOUC>4*Ne?r75aaB@-xnghUDkOUclbu@f1bqW5^3xP7FSa^-0!xhH^PzL|eY zi8LrWTe;``{8j76FGRd9YIrMYx#Zle`Q4@Tg6u5XMy{+@T0HSz+O41h5<6}pdQzHt zuEknP&XG4iIt8_+iit$C$9~q;Cnm=UNeQteEUfD3^$Yny3+;PKQaCI_LSK+W9kxmS zGlmk7lu)5#i)5i2v#~kugZU4JT3s!bBr8RQ6TIvy>}N8#uoq4aA`+^AYzU)|jFOV} zDuF-+$I0Ftl47EnKZXYSf`Ph%C#Rw!anhYPTl?rvfronygDr^d^%;`_O0lWQ~V8!7E=@PZfBf=fU#dcBbvFrGSEZB+4(4y$045+E~aA`7A+W>jeAwa zDuGO7sHEb%BAPA}53Gu}ZF;3kkE!x3E8kYwcnR^#;PG}m-qz*VNlkIRpE8i)f_)0# zU>JjBpo?XMgd05afCd+S`&3_(SmKP0>?SFcL2@=64T4( z+7rkSX2U&|AHx@W9yNZM;;i8tgAQd6u0`pted#?K?~@|jXeO?)A7)h0pVZfm?AJmm zmX^jTn<(?PHa%uM_B>4aLGR$t{$id-0-1|CI4(qparz8G?6ok`NTVTa8q9Ib(R85Tu0{#9x3HHBBzO-^= z_yGc;=5BScxR+;AQ!}PNyC9Z3)=5wV_JqtBJ&W$z-pVa)l&#vG4AD5#I;I=fde}ml z6L$Jw2sq3TvctwF&Ey$4LqPF~WK>{kyxoV7Pw0^nbFEr-`psaP!F3Bjd);CA$V*Al z+qqFoq!GVvFE?kFwzOY%L?6NlO|v(YH2vzb^s#~RY0UDq+NXV|Rz6KF{N%Jd9Z1U_ zkL=?>*w4ekb*`0dPH9EWcji5H84Wcy6~<9GvS2q}M5ynhuAl?p|CR!b+wDV(EyK2i zXgtL5(!5We{OQ2+nZ#{&@b$ggC3gcHlR59T61|0cy8zJ5?eRLGQ2_@zYOetYXnM^L z(O|^r0Fmt2GP>CZ6*tPPwdd{ z6}?TO<8A<9M7l37&%J%NhOHO$W6b>nZw$k{FHUldKapE|dQRlz0pZHKowe+p8xLL* z^G%!Yr~W_?g$jOXI8!q-!yOi}m-_CaY0gzd3FUX?SJAKLbU*I3q@O_T2oTfVXN5fG z_6PJn#;p3Z9NfU95;05O)Hy5&Lbvd!rfr&dE$_hzj10n?-j0EZlrzv-JyAfvzxu_V zBe0+>mELEF&S^XLmih#5C@(yl1{KbXF2aLrt7kWbre8&uMfyB+J|HQsrbrV7U*5&|hb1fhk36kVL z`IZi?^(~mPPpLD*LM_;#)^VQSKy!9^XIS0%*b+pm&PAdri1DH|4dx?)@f`vaq-_l1?%7B>8Kj{Z4IpKZlO-utdOoOZC!f?-LISha+ zgc?L(vYAru{Ts38OQQnvvn^tHJ(~Cf|0(l!!DLSg1O)ryAe0XfNy9b|fS zr^=25P5f26nkCCZK;j*<(kWf5K7*H~XFVWw`P2=izUaHG5pg_~i<>x~2Tn8iLxv#{ z4Szb_b0Npc?SKfCmcXkhjEFlTr1GTY$sdQvnPm^9S>ZlR0NUhL=*vW4q$4fzGy8@O}%590lWM-)nCYiE^ois)cg{$=3^|65hA7-v}1{QKxh5d2p+5Fo{&pJk5s{?6Js!o}0qhon9agcM_!~sXOx~H7w=FfrL7%C&6X;A3q z=ApmU6RB`lSU_fwF3ailL}ok0*@|*mC!JjJPd?QSzNwwxgCDb@s86;%V~Kpnfu;@fctmxg943k;09B-&*hY_WPsPvI4+ZO&K=f& z)Q%`|L1EDL1my&_WGG2OeA^?}g49@YnHv6~_Pe({qO9^5NcY7rQ-PU-<3IWpplV7l zj{Jp1tsf!x4pO@XD6Su!HUsm;j+-H>_01U1QDQc;oeMEYh=rO2w;biM+KB%|31ewg zW{EIJmiu$!rNIcqusUr;Q6bj`1gcOMd*%WHzDTR#$&V6hRZ9r>70zA*-DJWf+lP=c z-*7Em3h!Ax5Pmjjgsjj0=}iHku}EYmqJX6Q82A~D`|T#-mnW?47^QL2mlu9e_qxz8Fh0i^2UHW*~s3MLWiax)%(i05JEu14$6 z)Ng%rpn2x-u!bzKc61=os!w^#DMfXPoZgetEG4F8T*DQm~=0#Uq6Iy z(K}qURvZ^&izNP=8RN5uW?~webh7!U^+~H?3~Rr*_bt=A{}bgXb&>cYBGTz=l?I!K z7&Okwg@uF8CB#{sv9+h>Te{07Sal*^ms9^2#>rdA=@N!lj9}9E_qZWOF*(ukQ}%@n z@3l~IW51Z#{{`YCjQsp%_Ujctd3v9U1tSQg;oVCauKeVmNyq03Af2UkQ72>H3dzf( zMNp7YuBt2XIv-Db;u%l0irQ9rEP>Iwxc@h52ME?8$+IlqM%JUF;luuz&!Q!5S^eXU zC`6$f(%CwtORL>OqBxu=nG!1vK|Ju=~;SPR6P zitx~|yq@%Drxf1~-KiAYdKA1`lXJX6QZ*DG1}3AaNk#=5DPcsU>kL!q76+2+yf7&p zKYSlERHgGm=hS$-nB{FMS0!sMe}j;pIkMXbz*yH4|7pWCzX zCM@{)_@g~_-P6%>gAgmTnf{?_FQpk8-|ZBqx;kxSjk*NYJvH0E=|Qu1FXPr{+krge z*quhJU!69!_*t)mQ^;n3e4Vxt?$A={es0s+h9tk;QVTK=Li~;^z1FFly(5U(T-;Xi zt*R^2<FL_?sapzlDu~8Ow;hzd{=l; z^bNYUva2R67U<~4@q2-6Xo0SB#2t8bBe_8dzM8Whz#dy*M{lJ&OUrpQiizeHfD=dr&0dg$Hcj5x+l}*x=esqD?!*CS zd{cdJ7~61)a9RgTVS%30rb}e1U;NryGR@s`b#kGPlTOR;r4Ydj+&&rN7*-Rr>q9f>12_unC&a(*u!HJ6N?cN|Cm zQPC+79GN*Q9Rlgn;NaEi>qMg3fJDAECPh97=#^eOqfu;`>noLc2RDOoRi$TKan8=* zsM1J`8ryFYkGI2HLM9$+^kR*;NbGvi@|>){{F^t8bG<(2bK=2GUhKJCEH&(?i(-W4 zvNgpRF!}WZMTc5)a^=4O7CLOslfDY?I>V6fYbTB3wIuK921nS*7Nh8Zp=bMrYo*FMX~t@0Q7nP@ioPOMO+N4Ys7TX z6Qh@=#V<>SQyuaqdf1Qw@n&gFsgt~A_Zy##1wMhFHS#^>@|HS%2M`~v!pJyua5a(5zp7eLZ& zWH74v@7!@cfIDvgJiIPIOsMiY?EkCQxNI@`6AHx6rDh(@z`jaiL7wQl!&-GQuSQ~$ zc}}UP3!746AcVr@ZXurGW~}_n8yQBYgcv z;#46fjq|*~-_gr`@4d8~*_C4$4)w^6ID5!bSUr3SrW}gmIDyGs0t?CerA z&dPX|hFPj1e|Usn*YLQY8-=It{~1%?*7A2}loo z_ks6)y(}7{L~3{G0AIvT^;~e~Jbp6N3Re%CMvlU$q zhDuO~s)dFrbgZ&D23)ml2S`#&D;avTtY@5c{SIFXwMD3h#zN>nRK=I-tbU^}2aGnq z12vcuiU1$F`%1=1og}OR@^mcP+_EN7)frBc39ej=a6yVnMtb`bcfKQ1jFh7Th1RdY zbPGtXME7%x!E$NvBtC=nqRobTTRE)@$|H3+P`qqYLn_|>B**S>I}PiMcrC9W*6S+u z)aj^QDF&saWDCqz{+?hYy@7-5rY4nxNTaIA-a(|tprBEPJ zynNW5M~-mK1Rsfh)NpZZZjIN2+8)0-B~GVkYdAWJiuwMbgZHIZ#KmdMgXbYi#a|if zry5CwE*lCIz31G08H(L`wfM4IYX*C68q9tuHk#^|MkS~gkF4Nz5A)@z`SkrP?m_81 ziB|A9=JKo3A%|ILDu^&CX6EhSFdeVIaLzEgJBfED8p*1~NP)(5f95K#9DulunMa`u`xsD!qAZA#H3@(jUb4W+flHQY)grtErht*tkcV>d$I7VvUqDk$mxu5)Gt#(<+84p* ze|Fsb#io<+#(3Li1_#IlhZqH?sA^^hTn&{n0Tmdx=T6=^A%!GFEJmv*rRwqFFBrMc z?X90WrSYHZCzI$5x>8$(4rNa@%LpN7d)5=Rp9Fmjcp}ecwVX@a#Vf;arl}CCFYlzMLp8y6oSkNj^bR;ezAB!VG+s3TV{1zYK$0 zdm_mFtWOFPZv8yT$>e|eq{$W*olbOPa^gB30DblI%t5WrTeBlt5wWrR%g$JHrVsYt z)Q(dXF^e%B|FFYml8l*m@k(O~AwfAcl^V@a8_Jy~O=jSRQ`k#q8!sI>2ln(Au zM^xR7ErXN|kbw{KnB-RxRHR01Y;fIFPx0+~tCg2tX`T@CkGwvzy|m4jw}O7~#y@IK zK{oMH4UelCUeBFnLr7(iHV8zMC@=j&vqP$5$U>P!#JhY?2U!K&ep7S%gP=E4PyMo* z&tK^;VQ5qmyM(p^Z0{xAZKGSlwXxoBTKa)D#_{1#7fe-jLbZ(=68 zu0wX8wgEDqm&Iu~QqHA-6QoIB2mAMuf#)@|hdY0pw43sbr|((~EmhB%--72qt3S}4 z0sAipH$Wm0$3aP@I z;DKPqai+zo?h#w?iyQwY-DeZZ3w8bTuYEU!C*P|ft$fLzj! zfTut%7V3D$O6c76LuJ*|p?}kZ3>_|%swV)q95Cgi=(}VuK)Dwfy|{Y1zXK zb6IDvfTOZ-I%~JxHhMjH>+sD$AmpLbrNl;U6g#m)D2<4 z73Z)4?mz;WwA(k7V(_LFUA6$0JnWBWOCXn~(3)34XrEp}^&4~+>y$K&5S6QdX-JQ6 zl2aC)4%(20Xou|`LY!X0Yr-5&Ic5(Oy-K-i`ncvsJ7UnE@;XU`{9z%$Z+1hbaMdDt zZ4-F9IYi;q%nc7l_yToP#`AtB{o3x3)35)b<|iO5dsT3R?%pp2Y-15^|NYvc{~V?M z$-~AA2a1g{d26x{Y|L+Z!i3> znE9CEi*^@Uf5u$V)Oo-XiagqQS;^9v0L{7t;3zP{vhZ`4x0D*;V|=@gH1=UNnP+Mg zHSPAy?C$Ti$g8nWMZ9H9SUx;$&MemHNXberc+Y-stz*3!SdP&p3MJ9?#wvt;hq%y+oxfp(Zko5 zp{*pbzk%qwd0b>fue4hXEU*Rwvx_{Lk zm$Q}m7ls*SEyQ;i>k}8g`6?g$z~lh~6!k29Kgc{dakz>HaHY8l(0P}JEd^`EGsoL_ zf!;J*kkv%}L3^X7_{@BYm-uPvh*0I;zz>w3<$e6Ug`kuxR@1T;-CsY z1XFU5mV%}Ju}WTIM5I{vk=axIVu$xCrM%Wp{Nf%UWfC})CzZF^87UryRG2CBJM-6A zVUO=vgFEG-0jFLJMQx+;$Yy)g$4%p)LqM5T#^P+-`uhCKaJi?H_5+@WO#l0fOpE3RoJf_Zjmfv+)q1w82~}-wnY1i=rBwrD(LGSQn9i?6Hx)qAV4NvEEAWK9VletI-5lGMQa9`1)anq6unlHY$`nHC!>ZtUQX4!76@5`=I9q59RY8Yao{S2S56WmZw8E`BuSx z`bQ5H$khVJMXNt}R$T_nz4BT0rCErY@0MJ+T}tTkY%OX<+^rdB2SV90bJKi+V*?I3 zI&$M#fhspzh4y3KxAZ~g!h}H>V{!HuUmvzsc75^~43G+WJ6E{d~WczrI^< zBYN}{-S35<{x4UW{kBwm-NzV*3eW|poG5Jw9Yl|apu7d15L{%-3e^1BlF3}m*BL9* z8+qSYs|@|tdN!?CUd~ask)D72?M+DlD#(X9YOuR5O7#T`^mg6L(t*o{rD;fX^Ev23 zIzycXqwX#Z@AyZh!9(eibU4_wnnLwrb*L@bT@+)z;0?U_jnLryjI}h)8RghFs)?Gf zEk@(D8&3xE9R_~-{bXI6>|4_GABA?B(-t$HcCOGGyy*RU=vD=Z++Ne2G=UvA6YB%+alp_fRWCYgQ zvMZJSl1zmb8PHS8njeh2NE({U!q**1s}q&+R+n8G`bGt;m4*&-j#BS0O&^;a-Zdf3 zdF1ZDnC)_^>OvdTG_?LDel>&Ne;eg>p|%s8EJz)+C@rJq!5K`I%s$@Bqx$|+a^e?J z_gKkD-5NbY4A5i3P|rfqN2ZyIGcR5J7V~$M7`xe7`1J&~@jnOLPNdUS?2fhwJ<<|A zluKvDd~5KA%yQpz`nr~- zaJs3K8E(NTTUbMl%PT{8D;r4iLYqREo^OqHTqGhtQKM_H)YOts9R2#)GAsM)H|r5J zS>b^Ef@g2#{A*Roi#hT)W!Ja1P+B66&TmnL2Dr4%dJ}|!CQ8Mk!yGNMUw;8EID@gB z<}q?1ZJK-!sAe92HEY+qQ+8AO=l+d=x}}k)jGBEkx2GjB=e=eV5^qZkpZ+sLB9)XP(Az%T)CG5DgAQu=ZeB9K?L5;dwYo+zb%gC_+?l{*M^Gnoh$n+rV9I; zEn}f&ct-1Ff!5vk!O=CEcwnv+;`HReZ{wY0nR)_He}rt*bTh3+qd}%+*&qweD^`md zh$VROxCkaev!_Ibhm$Q*Sj+fm`}!HqLZ!dT>cUrSD@9mtnDY32U17^7j1Ua< z_y#?H88%kgVOeN$m`}8Cn#VQ&7-1zJ$9VzlxGQ&XFUdk?LvOq&f4_`<#r!kHj@UyA z#kSJdLSc7X+Bx$#;HPn~ny>RzbHr{tXQYR+tTE`A4x>cpnnSzm_PTfHPwsXE)aAqC zsC}h^_4u#cT^7!Y%s)w&>GK_maYB3RJoyO&%>VTD)znohyV?NNsiY4BMu~ zydkq5V8AhOWbU^Xmc+(n-~NANz}ix#Bd6D;J45AxeLS8A@b%9JlGpw#=_2S=0&xJ5NbZ3D-Oyi^6)MZA-H1i~mf9_BujQ`-K<8xbp@ zgVhADtP@Qht-_hg%`#6;N^h3Gp>O!Aw;tUzxAYVX*6C;Inr5ksGk9u!v(SO{zxTbSrR>D^f;WAqe0LUtOKP)4>$KjFd(W7-vgd|!Rq zxq7Y?mDS>B$ZT}nKm5_=y~T#v&{x6<26MEsgXt6OUvzwKd0M4UQWPq#AUtB5JT3j*GGoLpdi@I zO4k9+oDJO#L6V8rFUNdvUk?{Xhx1VD&q7j=iTYL7_*Y9`d6GVnjVYiIDq%n{%y*)9 zzTP_?=m{O)@M|pIXTG$=BLNE82nXVjPD`$aR}O_yQ!yLvCo|=YYzedmkSeHYcem@1 zvHK{6K=PdR2ov-PS_c7|YnGSVw4-Bnj_RY8ujP9u20q?|laRaIrkeAG>Uyk~z@QA4 z>oM>$k-%S)b(}D7^6gVT38X0@b*8yi4CEMUn`P^0f#WcZWn`XUm8CMaEw(R+vt`SQ7}Dz z1S%8pw>S#eZY-Y`ZG`mO_YWLayEBydBRH|f;h*xJrqs6+$u${%(SR|#0$*b&)NGU) zotJ{umhpj)2_LRc4}Z@ZseR=0wT2#LzY!oE1?s0t&Nta9CS~Q<<$=ZVP`%RfYNr1- z4y@zxN^_z=x0K`EmvOXx58mxmpy@+MO60X&(=^^!JHGJ~fM1!ert>`Zj9GB6 z56fKaRZV+3*us#hnBj(5Tkj`%S=ytUfb`+>~@+Mp(exRrsjgd8qtL+G!{Kq%8$-Vefd-b+dYmb`$RApFF#^lHpvcKn9PeS z@=W!5lZF{d4pv?DMv#Pk-{l$PxpMT2QX{-kBc#w}^cKKr=OWcs|0v?1n%rTPSL%=o zXxMq=IZRJxbVE!RWri}{U9l2&*gJL}n3DFT3!@De_TO2w==3qo$!3SHj=u)uP+oK( z%|>`|NhtE9bqPKEwZ+PO1DugU16Kd|6>9@Zw&Y%=V=IcZ=s+1C)XMOM{2+ zTo|yG)|NS8>vMg%FMF+=97=2&_STWH}xr)E!k)oaiF!X<6+v%ug8ZZ(Z zG*XUO+rJPJGyh}r=eu7a+li7|{f3(Z>yDtf`&FPG&%mo58j0I2s^i-X!(&5Z)|%}H z!60YXhJueReFxf z!8236uXsNfC0WMcRThoq7duXaYKxWglZ}#vKt^L|$!ho>Ve1zU-`X9YMPgMSZQo@Z z!1fybD$A0jae@dU|F6odX@;C%%M>&k1LVG0hOeyoW6%M)@bUExV#(JT z%O!rn4r-5UcYBda z9f}_2Y`)<>K~%30!!{?$`q*Og$xpjqTzl>|k_!o878T^(A8`0ln;bdTty2%};ev{YOwC&b*aR212sgNtPQ0{8 z<&ju@T`^w-)Bk9-QbP(XIGDCrW~cdpRzCey*S8^}iRa>nwiMdnU44z`CMbU1s;=p^ z=}s}gMTCfIct^%^J)oHM7Cw-TlUZl=+MK<_J^Rm`vl=YZ0FPv<`2oov=(ff%tIEWpm_2@*d0*OYPY5`3!rH&#!&5Q=`$&mJbPGm`z`3I|UsI zuCjxfp{Qz>WJG<{r@8w-uR*=|Z&r4bqm2pN`CRUg`8V{0FmA?9qdVLUR@h6(x^i;t zFLPQDz-ew&+MQjzk8P(n6Cl&{aJzZOL%E{wgAqO*hXgZ=usju1#Z7Bxb&?+SRcg9; zfHjioUw`eT9B6??LfCu34$@~e9G1`BKq~(h0%}x}w0NfL#$SJVP_p&%0Vgz$MryG? zg0Io}eg=C>IUS5F36BMX1?U@1U{HV^%P?ATd41=;f7vZKXKp7VTF>ro9CTU12km4F z%iskms*q^GLbF94#cnACV}5#`{Lqwm@23HWUxc?U{bKcY;~ufCN6!%vP-$ngv`u2! zZSTLFEY#}&Q53~;EhaZ2Y({OF8V)=8=xi*ElqH`u=r1E= zoqZ!8zwq&zM7U>2Kyb2EfSaz=FlOaxAL)nzkEIIzL~}2GQ$YWUjyo*mf62~=yH_#E zh@@=$NjbsnXmlJJXk&CHF!$TL9;j;7D;Pn8;7IRHcQ)Q-do+m70?) zU{k2c!^Dg;hxkD92|-Gz5urF|KzEnkttLvC=C9|iruX`0<~+)%2r zxIMS1n18T(!dfzad z*rX1eJ-pW}XjVuR(=*0u2xaAFL3luwH=o33@fPx)3vCRet)w84!j&akGT^taFsC+! zfH$3s)ulM0!2Bl!gAZ5sFt<*_LtNd=wp9emY<7w8HJ6&hboE3tm2Oe!{kiiFYKrU% z0&c$Cg<1WNqs6{~-lQMe1-;|9QK3l{OWg@Z0ikP431O=WxV2O+u9bALO_edB-ZQZVt%?P;(A`-&K=*M73k~BwHdhUv{_48}?s1HoMyRneAZ9)boh* zk9S02zAMZnjgc^E+HC*3aT*(-B(FcJk>G+5Pw|-g1=Z#Wbz-&T}6Z(hLTF3EL z4reE1hZemJvmfY7>q;elD^5IDzYulLK37=bfhfbHT`iY%akSkOP#M<)#Mz6>8#{OK z%EXnijL>P`SIPxb&9RP|Z5hjN80+DDT3+wGtQ*PzJ(M^*1t8HnTA;7HT~$zO^lBEk z$zSV?BmiA!iFkz)IQJkQQ`iyE5*ihNBnnJgy}ldT4Ja@T19#Rl5d~>wh1Z^!XP3uk zj29C-@;}I;y6QZR%zg1Lc4&>6L!^X%T-T_6rw4+tnMEVY{jak50hT!JxAfD)#5539o7W z7L+a`Bz}x8l?o6jop}7Jeio|@Tbo{ZKEk)NnG&-P!ZZ!*vBCB^_-9*W7skklTFEq- z9+@HUlrQm2C9kAwdyjQ@F3>#Zs`K%Y@J)kMxBXx(V(sLOSKDi6j6f2z1Z_URyZj<@aqRE-IM!d9)X8#EW0n(N}{@rzTw(g`p|;-Y4pM zVTo7!;&I+C1CW}(lhyq+0flD~f|*27wEp z1pN*D2+f~^RlVN!tZI)umby diff --git a/release-0.20.0/docs/getting-started-guides/binary_release.md b/release-0.20.0/docs/getting-started-guides/binary_release.md deleted file mode 100644 index 49a982da2c4..00000000000 --- a/release-0.20.0/docs/getting-started-guides/binary_release.md +++ /dev/null @@ -1,29 +0,0 @@ -## Getting a Binary Release - -You can either build a release from sources or download a pre-built release. If you do not plan on developing Kubernetes itself, we suggest a pre-built release. - -### Prebuilt Binary Release - -The list of binary releases is available for download from the [GitHub Kubernetes repo release page](https://github.com/GoogleCloudPlatform/kubernetes/releases). - -Download the latest release and unpack this tar file on Linux or OS X, cd to the created `kubernetes/` directory, and then follow the getting started guide for your cloud. - -### Building from source - -Get the Kubernetes source. If you are simply building a release from source there is no need to set up a full golang environment as all building happens in a Docker container. - -Building a release is simple. - -```bash -git clone https://github.com/GoogleCloudPlatform/kubernetes.git -cd kubernetes -make release -``` - -For more details on the release process see the [`build/` directory](../../build) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/binary_release.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/binary_release.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/centos/centos_manual_config.md b/release-0.20.0/docs/getting-started-guides/centos/centos_manual_config.md deleted file mode 100644 index a14ad3842c1..00000000000 --- a/release-0.20.0/docs/getting-started-guides/centos/centos_manual_config.md +++ /dev/null @@ -1,178 +0,0 @@ -Getting started on [CentOS](http://centos.org) ----------------------------------------------- - -**Table of Contents** - - - [Prerequisites](#prerequisites) - - [Starting a cluster](#starting-a-cluster) -## Prerequisites -You need two machines with CentOS installed on them. - -## Starting a cluster -This is a getting started guide for CentOS. It is a manual configuration so you understand all the underlying packages / services / ports, etc... - -This guide will only get ONE minion working. Multiple minions requires a functional [networking configuration](http://docs.k8s.io/networking.md) done outside of kubernetes. Although the additional kubernetes configuration requirements should be obvious. - -The kubernetes package provides a few services: kube-apiserver, kube-scheduler, kube-controller-manager, kubelet, kube-proxy. These services are managed by systemd and the configuration resides in a central location: /etc/kubernetes. We will break the services up between the hosts. The first host, centos-master, will be the kubernetes master. This host will run the kube-apiserver, kube-controller-manager, and kube-scheduler. In addition, the master will also run _etcd_. The remaining host, centos-minion will be the minion and run kubelet, proxy, cadvisor and docker. - -**System Information:** - -Hosts: -``` -centos-master = 192.168.121.9 -centos-minion = 192.168.121.65 -``` - -**Prepare the hosts:** - -* Create virt7-testing repo on all hosts - centos-{master,minion} with following information. - -``` -[virt7-testing] -name=virt7-testing -baseurl=http://cbs.centos.org/repos/virt7-testing/x86_64/os/ -gpgcheck=0 -``` - -* Install kubernetes on all hosts - centos-{master,minion}. This will also pull in etcd, docker, and cadvisor. - -``` -yum -y install --enablerepo=virt7-testing kubernetes -``` - -* Note * Using etcd-0.4.6-7 (This is temperory update in documentation) - -If you do not get etcd-0.4.6-7 installed with virt7-testing repo, - -In the current virt7-testing repo, the etcd package is updated which causes service failure. To avoid this, - -``` -yum erase etcd -``` - -It will uninstall the current available etcd package - -``` -yum install http://cbs.centos.org/kojifiles/packages/etcd/0.4.6/7.el7.centos/x86_64/etcd-0.4.6-7.el7.centos.x86_64.rpm -yum -y install --enablerepo=virt7-testing kubernetes -``` - -* Add master and minion to /etc/hosts on all machines (not needed if hostnames already in DNS) - -``` -echo "192.168.121.9 centos-master -192.168.121.65 centos-minion" >> /etc/hosts -``` - -* Edit /etc/kubernetes/config which will be the same on all hosts to contain: - -``` -# Comma separated list of nodes in the etcd cluster -KUBE_ETCD_SERVERS="--etcd_servers=http://centos-master:4001" - -# logging to stderr means we get it in the systemd journal -KUBE_LOGTOSTDERR="--logtostderr=true" - -# journal message level, 0 is debug -KUBE_LOG_LEVEL="--v=0" - -# Should this cluster be allowed to run privileged docker containers -KUBE_ALLOW_PRIV="--allow_privileged=false" -``` - -* Disable the firewall on both the master and minon, as docker does not play well with other firewall rule managers - -``` -systemctl disable iptables-services firewalld -systemctl stop iptables-services firewalld -``` - -**Configure the kubernetes services on the master.** - -* Edit /etc/kubernetes/apiserver to appear as such: - -``` -# The address on the local server to listen to. -KUBE_API_ADDRESS="--address=0.0.0.0" - -# The port on the local server to listen on. -KUBE_API_PORT="--port=8080" - -# How the replication controller and scheduler find the kube-apiserver -KUBE_MASTER="--master=http://centos-master:8080" - -# Port minions listen on -KUBELET_PORT="--kubelet_port=10250" - -# Address range to use for services -KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16" - -# Add your own! -KUBE_API_ARGS="" -``` - -* Edit /etc/kubernetes/controller-manager to appear as such: -``` -# Comma separated list of minions -KUBELET_ADDRESSES="--machines=centos-minion" -``` - -* Start the appropriate services on master: - -``` -for SERVICES in etcd kube-apiserver kube-controller-manager kube-scheduler; do - systemctl restart $SERVICES - systemctl enable $SERVICES - systemctl status $SERVICES -done -``` - -**Configure the kubernetes services on the minion.** - -***We need to configure the kubelet and start the kubelet and proxy*** - -* Edit /etc/kubernetes/kubelet to appear as such: - -``` -# The address for the info server to serve on -KUBELET_ADDRESS="--address=0.0.0.0" - -# The port for the info server to serve on -KUBELET_PORT="--port=10250" - -# You may leave this blank to use the actual hostname -KUBELET_HOSTNAME="--hostname_override=centos-minion" - -# Add your own! -KUBELET_ARGS="" -``` - -* Start the appropriate services on minion (centos-minion). - -``` -for SERVICES in kube-proxy kubelet docker; do - systemctl restart $SERVICES - systemctl enable $SERVICES - systemctl status $SERVICES -done -``` - -*You should be finished!* - -* Check to make sure the cluster can see the minion (on centos-master) - -``` -kubectl get minions -NAME LABELS STATUS -centos-minion Ready -``` - -**The cluster should be running! Launch a test pod.** - -You should have a functional cluster, check out [101](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/walkthrough/README.md)! - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/centos/centos_manual_config.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/centos/centos_manual_config.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/cloud-logging-console.png b/release-0.20.0/docs/getting-started-guides/cloud-logging-console.png deleted file mode 100644 index fae0aecbc53d78d3f5304da70b4b429e684a9134..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 87825 zcmb@tWmH^Evp-6nBoKlHw*U$51P>4(A%k0RcXxLflHeZP2X}Xe;10nV+}(#^fI;q% z=bZmp_pbNDJ$K#xWu|*~S5;ScS5@!+Rme9vag5g_uaS_DFeD`aibzN=fJjKs++O{I zsL@^{eUJEg?j$0q{OZ-K#dY~LM3LB8RNYz0&eYk>z|jQB%+}7vgvH6o(Zs~o$=uHQ z^m&I664E;)Nx&Cn_q3yBug}UR55i~TYa?HhbNFKUjrbe+~VWwCFo6~g2WJ88S#V~|g~Bi>^+)Y{GuKJK$!PHf&&3AuqvA-$N_Qc?X0h3J}AcRad=CNQO{P4{HF$R0EVPmf;@T&z=vGA91K^+MJ!w3k*e+tF*xaXzIcxPIzoY<`Pj_ zE+5z-QG*n|n?mfSlb&1F$ahE|})*ocE7~84gfo)hL|oMjrqekykGGx5vc&KQMSd#&To|jSJy zY}9YC!E!(wzN`b!E$*BC&X}B{gnvq;jS{ekc~#F>)9xHkj;f|~$gyA^--8Qp1L2#T zhI&Ac6{3CEJ|B&0b;2X(&3ybrEFp^yKij~)^+j}zDJ5lby*k%=Sb`8QkMl#<*@}*5 z5L+6>q?)BrBFL%Ns!w`YF9p)L4G*^))@i|f5*x|B!@+TO*ixDWr(e#6qEjl^nC(u^ zU8p04bSELJKq2~sN*%Ro(t^=|4LjODI_CExx_4q$yAGDQXueLxYR$?=AN_s{`09yY z0b5FLw9p6Z)^V8RUbIJMR+il&~t}DMFQqgMmr{ zIqqM5ockmrJuSMvnG?;6RfVQe;WRhe1`qdiUH?!bQ2yn`laSx9wwU|hM5u-&w(bZI zp)4gyk;>zYF)9qF$}kXPgO3B4hqWkPyKGDQgVLDO0&2$+C@FYohSFkVTiJ4&gJy-Py_Kip|FT4CBpYM> z7+08=J)sSuI4PFhJLro6EZ05sYG$94M5M1d=*Qp1>hq^4dSp)qtm9xu*WGP3sCm*e zuljmrfvZbRWAnm-1YC|MdL5Uwot87f#(8bqy`|cLBD^I`hKXq%?G)K zaMxSQkoNEq_{rfyY_;Ea>QY8EkyU4)E4d7yIt3e)6mMs1P*iJLYD0T}{$%(Nx>xb) z)vaqh9pCZcevFn0J9ob+DzC^@eK7EfZwl-2Ri10`UJf=lFN8xf)L2(kX}l_j3(I@3 zv0XfNEW{p7wzup;mT1;-nzZR`GGh^|#ldr=B-nJhS-a3!I#=^U3xJ zE|i9XD_l*JikD}iWHAqzXbvC%Wr;pD@rN|K{mGoi%~(3DSX^!)@mUqfwOy(2`1ohTdKYrzg>;TBc|EOy?k_T>2G*$R$;z3 z*Zp(^g1Z59UC*D|eWr81x!6vXN&{@dI@)6_wk5WpT|ca1)_~U@|1O8`v&+-*E;vvs z#fq8)Gu~j8lbAJBos9keGLlG{E)CwDPc8!S)DDj7{@0u$HT+XV__y-=@O$WAg(BJW z{cClRkXVEMHL*y)w|{y5D{*65Trgl5W57WQg_tFBfC{_{%?PvemXGHt6 z*rC5%q&v|JEG;wXO(PhWWpg=zoaC;!Ma3-#c&i zMMOsaD_ADy#n~AVm-!zXRZ5y{QeInh3ZYg(k$(r;IG4ufv~$JO`7-EVY5voA|A%@@ z@ARR9%UU6%0z{=JVkM5(+iN@H@_2}Vl$FQK+=y|G5+181h7umn`S!rEvBkS(; zJcLsYAK4VpDLCgnc{%{+^Ahs;CnltiklsT<dg`|&61}TFW>-+(MwIhJ=VmlDU;LH< zI41CNT{k>J0A5x;`PDP$C%Na6-r`zX^i1yKTyM#ar6ljnnm7u~pnSjmzLVd5B&RLc zczX=!CdY4mxds}oAvomrJ6RHq6^&~Y{%D`%=9>^~T|YD|><#OFWX?YNv5HQ*1O6%n zn6)At1GQWVhtYd|-W0UX^eYY?aP4-NE9fvRPZ%I~H?M3^9sE^yx4H_Vn=Q-!d4795 z5JUvGd?@LiiMzPH^VK^PaLg?T(r3Oq`3ExaIqO>Zv4ocYzU(ZxqoSEruSO*yL)fc* zL|e9w1z>EoU=HAU*mXjT5?F>Hzb9-x|C@YL>MQWUq|fict=njiXjQjfZ!AMlPg7wg zlZ5i{k(D4J?!H25<6*74y?grO^53=l$75-hfw+Mj3m$b9BfX`YBQCtuJ?eS9ghg29 zLxDyla9|LnHr6!;%CFWGFTD!bOSc(c5{u` z{`Y93=Xc1B_oV`-XSyF2p=iQsyI!7;u1E9H&-1p;T>4TDifshjdAYjHk7?Rz7WbK%@EKb?|6;*FwwYFy?yCA>M{8)FZXrd^K5^H&=1SL+R*r zIwKEOSup+*W9!2`RBo%NDp-ltop{dEK?VEvHMTBNQ;-{(k*dP4XYN8(FdwDR+6v zdajJe(FlH3o8Hp3YQI}5haK(~JOQkMVe5xV2+*UPg#uWd>`P?Ju zw&QWObtSLC570xaypYSRgqu~%^mSHm@mJ+XZCOVnPmH}hHhQx<7M(ph6;CWu`-iTk zyT{if&#^2}ti1S2We;fM(uCE3I+f97#i8WZ1V2V)ho-sSDy-Ll zgF45WKJ_@+MH9MFkw>GQH#$VhmY}5p-wv20FDCDbpCq-`quXt@o@FeF7%;6-)#cP} z*R`nuKke>0sqoerT6;pai*QA7d=kh9OiBptBju@9aU>kmY1~=!PA6S#NQ`T-Ur*6T zm?J%UY|l%jdiNrIv=W9pN8NGQ+am!P8x}sZQff-a*cjP2r4e#DsCmu4gu1P!G`xY) z&CwCok(M)4uJ7G`j+>wAu5>dx@4kiragOEDt=E;qd(!K4ujfKi=-$pQk&t_9p@}KnTKN{f&d zr`=&M!G$0d=)UIl<|DkpWqKgUvf|4n(VE~{;EA=aB)7}{td>A2;aA&H(un<>V_#9X zD`Vm&rd#)co*^kF?&jL+!>=n?spAI^t09&#E~mWiNhuaLir=0VDbk)fjso6z8Xu?k z^;u-3fAGLi`e;WX(arqVM&Q4v2>y`8@g!Eg_N5TepgwN-qxZR|nhM*N&fo6#QTtp) ziO@ufcBaOod=K@Ak$;1j6Yk?{|L#Sq<864)DL?I{9+%nQb0Fd*sPi9U7Riu- z?(WTzWKJ?N)W76En{BPHPuv2^qJy*D;dOuOkiK)KAG-ZF8I}J)=KozV_CLYN{||8# zBC>n&z1yig_^3?BzLM-CH|6pe5im9z*MYqn)$p5wX_%OT5p{3F5fM+ zkKHwS!}^dhblSba5y8NFsM=B4i6rxIz5S~f_bXL@1jq`v`-Hs)16vPQAoF&)ENO#1 z1aqz|c0yz?1z$B(aQd>YwpD$>g~B{TvV$)`%v!U=l&u-kmzbL5G`IJ*%mM{te>mt* zuc|qts#*?*G=yyzn8L zqzd<~#pnIdYLoQ$UGOHrY38;<_UdV0wbKDQi{FJUn*fB!YIUBGkufGV*2&2U>e;5v z3cI+tfI=feL#y>#+%NYg&d$!RLNN~3)-V2uiLBr5*SO)M0lZH_Q6WkZWMpr+y7I;{ zDyb9g&QNMOh1>@HMT@irWRYQsi(s3T2UeKeNo_>XZiHT%P6NsYhwfY93XCuwQwj-| zE+EgM#Bj#WMrFd zMRi_nFS;j2!wTeIp`s>#@EL^nOP_w08z;;oAK%ky$K6W!T zhxa;t{aT7nP|Oi}9g2#ZKv7ZXo7Z_+HnQk3G`WeQ7{ZI-(ZMvD#G0*e))s}6)`WjA{dt;@D5!oNu`>PrF5cdo5FhJ(ah%6I;&>k=8BR19rZP=*PT4>~{ zPKWVTF)lt-3mmeI(Y`w(Z0-Ce)xN5eGE%peD`egBARAeQd2CxNs?~y8Es71*!us5y zeQ;L6tm|l7K;9m3HD2^tgR9#B{7gaU4oIQ?vQP8uS8HLFR1s0I&D=$?Ktkn z>T1V{IyC!Rt%sC^QdngDuI~A4zk1EZ<^EJvRh3q~H3JLFv2qodlc@&$_RX70li>uT z{>Z%C+)}NEvHt#kYaTmrbsp>KL7`8VVClA3+X&q(8(5daa9e!8|KTCg#P6b^hYr-x zc$+d&5`cnbO2llF6tnegak8d5l1v~WKHlXBqE=hY!zP-aTz>&gdS8v%Q9M8Mv=h2o z^OYDxRaBbeT1#9ia21YMS;i4lS}dK6f<=(R|K({;V`9>3aX5DA2$iSXPdIlRqY9%eMU>h$9?Ns#;F z##>Wy!n|E(=b&;sZH=4ks2FDFL&iZ4bhv2c9^Mt?^tih=OE_gQ zw+|dnYQ9dMx!I}qfn<1;e13-$4nA%D=&{u3u$fVk{_SIv=>_L0K5D~~U!7K)yYymy z-d@{Fr&)4Vo`ksML*0r=nsRx3!iSqv4F-X(A=ffl78@bEcp(QUt5HuqTTL})+kwvY zLtr>Z2%z+1laDmWay!eYzuntNVm+aZPffH+s=?>ssE*;5<16uMW?(2s&61tYWTGB0 zIVR>}JA+bX)JUL%*Fa69XBMFeA+3F#Mjsmc;dMKwChF&|_J3AUjl;}^_ z(~-@mn*Bo3XA0M1k-vB~Uk~2%5gfV9WL@vIU`3k!-3z{5io2;bJobDG>bDYNO{hf5^ z1atg|+2(2#+3?WNE#w+S0LZr9S|1)BzPGoBunVc9J7aIOL`8ecby|YWw};~GTF?88 zq6BF}4PhtC&!0bE^?@ya|NdR8ux5KcGmBu{Gv1VLn~9LN=emSgA^){D(Js^04$%vR zTD$_ABw-qAF6WIq?w~La9MOrSR{gGQsFhI$CMv3j=U_Q59abp_mjnlg!^q{rBTS+v zL;aIM-@!~+zI-y#?PWGh&K{7xy>(DP__onpINy=W)$nLy@+StTAT!(9BRmVjvtJC5$n}Y+hD(U7i_Kxpogrl*dBFNdM?{?=S|u%l~LIdi3khpO6~0 zGCg*qu`vh%W%oLURgCjba|U$*qp{m`s~s714AkUy{!xAGUe!b|w|EvO4#LD#>py+H z78rvb+Q)|&`F0!?>>i!|;NirPSLu~^xoeeBsi+PLxU+E`m!pFgNI zbGi6v+4M2`9}&i_=g*&Cs5NSDr|VAnYPAl?nvW1tRhZL)}I} zAACiRrrs;@9KOJ*04>!SiXk-E!)K*5t`#g%t35JbsV{;UPY>TP79Kdt^cpX%}t!gX#{fH>gae-vJx-Gw-*GK0uD97Nki@tW>*h6{rH0|VvsTBm^i zlV7}eG^i}Oveo4ulUy89?s~$*5c8I{)M6-Rj^H{~rL_Png_qTRik3iF#}@OAG#DD= z+emdB(Txi?HV_UD3BSXHX~Aakx@tG!X^NoFOgTmsu84?8hOR^A0B~u+P-5|euZV>C z-c*N-FGw^mX8o9a6}jQ&5VMt>t-5?2Es(lb)~+| z#m(#JVBvOi5o=_+P|E1_-$x835VB)Bma>x)QoE*feR+3*ds_y%VWX~u0Co=xPq>+X z&Uj=AaTTr^MWX~DTRo*!f5Wg}d?U4iFJxop4rWx~@9!@})&jgg3Xyh9KQi+VD>@|n zySA#0)gDw7wk8b=n9FZ+IrDqvG=OPT;)~a0c9P;RIN36wCxqgW-q)YVbUSK)E>)78k_uUdboS#n!8X^&Nx zYO`9k>v|_^;1dw8_l9P733p{|JJbH?2}3c=&~>~lmH@OW=(ll)rjTrnQSMf&$t3&! z{wzmX#KdO$mhl`!oN2y*Fg@>aM2Qda-;(_%febTeOHj{Uf4D(`SoK3@?u^qX#c7#%b>hJSil20t3^pwKKD0$2C0 zkJ5*qT4m7m6>b4ZJMNU?=+2w8ROxEiDe?;F`aYn{oy^vG_YAkk#VFy`Q3=vGWKp`o z9t?jBRQhhRwyiej#*OnJqk1aU@LyMpDE;XhpNz$+ZT1P_|6yy< z7>4r=BFh54eT(b+l{S@6`l9$Ft+&xo;^G}KN?HG|-72WShlPeokUem8sj}tUJF}bt zgJs&9N2{Pon14;P4l4Y*uxuaU?y?(w4zKXhSez61H{>&HE@Mj!afH1_)%MBOS@29r zUr_2M7O5e>bdSklw~*071ZOoD-#mvR>1|j0?vW{3y@p+Ve%JriR@VatJYBEeC&*Kr zUT%2ZC+BAuWnA;tUA=ZTmGb#evVbDO@r~Bnylgtcu!>FI6GX62y}Mk*y}}n*MLuW& z4bSUW2nbpvo2>+5fLn8}tkWlX)on&*Ak=%Vc9KRLG1b+WWz#zXV5{lIuMzS;*}cAc zrx=1~SK<8k81alsA%^SX`wSt&%1xwc5loiz&VZjq-%iOMHEy#ae$c?(wjBXKZN2V< zSS`h+ZnNS+e5CbTifj4fuKo;o1_DBh1f{L}RhANR^X0I`xR`hl(I~lg%l!^dH!WP! za=5+Oc36eK1j@5qB{xU28>0vKqbximTfW-Mb$|5jR@~h&xgZ?SgKtVI*nLk{+Stvr z>(pR95I4T;K!2a}QAJWCe(GZiI;!qIVHT_8)cI3WB5v$ zPA;t`TT+IF<>&Ml2PVA>H5}~m_+<3Kb52@0Z_lv)b@qO za!XH)rI2RERDpocq}qD`h894O0x2$8rm2SPA7wqhuMttzxH+#=h_?ng7&G40eKRdJ z_h}+i$0XzD;^L|`AoTR|;uW@aNbQ$E=d%#A@$XRF$Iar--`2Kv^$$r|KBt6$@V0t~ z-oi+zj3m~i(A7l8&v;{S5KU?k*kO5ur8&YHy}j0>nRYD#fHtv~--SWjXem7TRRG`x#L zFTseo+PS!p7BwW=h(M-do0D6u z7asnU!n2UqmvO@Yjvd5wvZLMOb2O>VYumA&#zg}H-?xwGm+H4=*VEc$9Ez%;#iGU6 z7WYJ^Op@ zV|}eciYkQ~Z#<4!&QJU@`_9_j^OnKE3NJ> zz`*MDmPlB#i`I!wyD)Y82fmDRthpg>>}N7S$1lfZm7@y)#NK5$C3I9)h|}00=24vR z*4wHa4cL$&Lo8N{;GYV&a<6B&1n9mAv%TyM@TlSt{XIgTCsd>U4KAw~pS$l~l}%p* zz+KO=Z;c2Wn;YY10l!uqe4Q5iDT4`Dy{>wvr9&~#_@mJxMaM)!&c*0r!dpAP$ODUS zexi867V225U6TPDKBSmKX1yamrLqLFE;{coWfA`*|I}m;B zW8W?{R|nisY8mDUvY$CKnF8 z{#S>v8ae(pjaB_+^Qn=NksIlqDlMQ;RDl|&a5pJg^S*OQk&$U!w6=_5Z4z8&!{`9k&gx+!Gl;M%wy+{2~;Ag(zb@^19>{f@< zZ&L(3sUzVc6U#zsFl++@!+4<<4=)~@AI)X$59HyDa_<6N2u&6edCHgSyxg??qls|{ zU<=Y;SZv8wR#pJUkF|xvEori=j++9Yu;QVIb1cgEsGhc)0XHr~(L6e)y|+;%Vh|i` zNn@x>485jI8aR%SFj|*0YNQ~$xKpv%*0EGIS^9<8d1i}G2-dCa>sSdHaN2KV2CIaU zKh<3p{mfvUPX1_yh+*N)FS_c?9n*Ih>difdF-btmb zGF7)A%!D9;(Mc*!KJw^LU(a}lthOm&`^BvM$%^^V4n)=ANeJE|phOZ&_K>h*a-4#7 z_9c$2|Dzv{bd{e?D+`RGUQL>V`Rk`~T=00<*;{$$VH|Fmj2GqMX3BDMY4j@L`dcq9 zjDv%jIA2>=LX?*c9i9uGC4OR!p-r~+lQ`R0cFcG)nGI^`ms$EE}TQ59!;G-qMfTk?6=q;mt?1t2o^fI#In4}=vDgs0HMh)3v5JJv_^`eb`(e;Be6VAAX^V17 zW1GbT|88BeV9QvqrIolCfX3vAuU>^i)I1vUXT$YkrFh|dS_x&#AGZF8HRUMuyg?N~qY6@~ z^bXN@BN`aY7>YK8*Zx`*(#suQ*2zEQLs`4jSsTvSNvBIiRn1k{WGXXc!l-&em{B{? z@sOjtg^>@6#c>^>*3GDA2QI_ggLEOL{KaknX$416(@@$Q6}O*sd~+Weq?SwN`r9`3 zUlwgp76iN7^fSX>moJ|<(aX`$wI3DJ7l#1Q3U)ODw5jtI7H1!HI+&Y8Sncy)D=6cH zBq*lq{uv^xHJh4Gv1?L;IE72CesRQUR5XxS>gzG-**?{+x3%f}C5U}MusF52sD&r$ zwb|e_97Y)}!)~!DCc80N*YXo5@us>gQvC<#S@`66BL@M$^?36<5g*eW^E~L|aLpHW zk!3|=UOrV5M+~a8;zBU4Dv>iyxGIwxXDf(GF*sX-R&bmik2%={Lo@S>6&F~Z$9rx< zb$qveI>v4E;Tv8BNQzIzB-;erh42+k#>PKC)q`xZ$#IL9G7>{qeET}+)Tf%a z8y0WRjc;};@Y|zp%|^bhIFu6-k@FM0@fQzAb7Vs&1FsGK zlhD`jly2!y;(a{8`#glwRJmmCEl-rw96X4wSJZ=pGWy-Cp6Rq>hqL7zFwdU(@}ZvD zr`wt?i!sVjj_lWwxLcM@-Sr!2ZoQ{FX0~8;FJHXwV)gcU>R&0?Ar;`0x89~9l*CS$ z8M6R?3t|OovCjGNL~cDP(aw|jmYZZP9%RPUcBVbfNh$B_pVQeAJp;l1^XEByym~UKrVKM0(S{lNfcEhvIU$73_Q9peKhU|6El*<3fhwt?w_Ja=LPCpwkA$y;m&#CD*OY;i*W2V2eE9^R?dyeoA~SUgKd zv+eYc-GC$mSA(uNoO!M{5R+_S>!SE7TOM)h!@)G2{g|}Yy-R(#xbz}Yb3Cbro%OwB zKW=w%9J&HNAGv6$*cY1Qo3!7g7cuhOEi6$J{x=G`hWTIKb^b!^Dyw`+^Sm0OK>wHp zw6l02gOr#!=P^1NEl$JK2+8s9-%Qp)xpyh=I|N7Hy)t1y9iGi2eqo6Jn(ym$V7|T1 z=~)0n!QLRtVBKKa8V1TFj(wASn zAFWl0Gw;t*sqHMCh*m;e+&H$wO-Ka|^?i?ky7urnYO9c$Th|HBYElsha930&t#&fD z8?2ruvXYm574mubnTZqly z4RP05xa#o+1rycp^!?&-rNLH9(i*^yUSLx$l9rh|rzUc0sL)Q--f`zNR%XnnhQukn z3BTFbFkyM&DFC+wan9=4?Hrw^u64=n%F!I+DY+HQSUXs>6fimu7No5h7Gb_p0SU#4 z1HXVUSKXF&79`ufO%3yZ5H@yQj^NP2Jo(6Raxq`U?vgPo1FjiD-eQKQsxP~mOG0ZK z^ssn*E;iyEaPyfT0KwjnQ3;o0l2^nfv{9+m)bYtzx5HmaO>}h?I<0p?%~aFzh$;wI zfTF1#mP3uG5ZC1HRc}sp$sWSv)z%w(G*}wHN=$MsUH@;iR@UQh?>CPN3iF1C#z?W8kLRG}a z>I6%mCX?^krpqI$`;xMw#IN}RwXaJ%-6!clsoqYO^A$pIF^(^6z6UzIdwznIdc#BRVZadha7n5Kwo1XsGm0!SK?BX7w99Li=5F!x(L4he-zdg3fTqVcsj5d6JR=$s~Mi0_>Wc9ySBWKP+DzGxA7t zz+a_vx+pg=hq8HDA&I;KLKAz};-dl_fpRv<#01z4saRoASjM6XoGunbG`*st06XEb zZ!>A}icua5E!O=@FHtaZ(Y0D!!!6vj0qW|PvlQGy7?G~Ql-S7-RWbjWl;*6Hsdn1H z6eFIL!a9e0h;AxAHdHgeFpeD~r})0*yt$!%sinkP1F}DL@d9C5LKoEHfSmXKt;Xqp zDtik9a+EMN$DIxq)Ma%=l-1RhMY6^x^PZJ%D)ij4MNEKzMyi16p)JPvGz(8)3^7j2 z`xM!buvcN~36xRGZ*oikqI=CQ&+5XaEWEifD!wFQc=892YVvWu*Q>0M_D?Ww$6l#U zNg@j$)F4&8-QyVxeH9ig&EW|zH0H1wX-*!=Y7DNd)DRf@XT!*60kRUGdYs-B=S^!q z`^Mv#=^&GDMcXqWOQC}+wc(2mh;y!gu43&C1$Q^PW@Y{Q>%JR~?2SQ}!!DT?Bg(Gq z4JWQ)o*wj=kX&?4ewFAZ4o1VB=C@)jH5sH9jmPvNbG;~g4P&p-QtMQNY2OP;tY-?Q z)_s=MfNu5`R#pZV=7o4>Tpu6)#LJc#s+>6o-j>yLbx|hdml$o(6$zAYlLAUWwfw5_ zH4biH0%Eb5lrYv~4Joq;YNe9>fD zW(k$+zS6v8wZ)IB5gs90Zo5R1c-#u48?}6>3I^EhUL%}yERg7s($i{;2}ii8dvM4~ z<#ZH{>A=tV@72dnRFoSy!^)w^WfPZ$u1xTQ1kK4LVqspPsril7bR%DPZeEQF5WmH@ zW7To<3{cS|-EKU;EiR7Avn)o%>j2A?R$Z-*93Hx+)foQ|tPTdsfDv0kCOgjxwdK}_ zbJByL7x29|eApq`jPGQqru=Ui(rq?*-GFOXT8eyE+it>wx1+qP-cFZO4SGZ>FcXa( z;`7^n@s69FR4R(r57~pF{zt)TLJvEsId)No!HADk!rtz=rmk@Rqe9*&@AIKQsvQly zQBI;FZ!#J`Fj6u;yph#u>B^v?TNNakL0lWJPs>x0a?y3Rw~6-dUPj3Ve+x6T&>YFV zj)lsL*Ww*XezIYd)F4oS%bFZZqE)q5m3(blcIxiR<~i`*Q2PYl`lNVISITc_Q_3U! zo{`ylR;*3_?m*I#BcC-1FGKIKRz0h7pK^8^Et}n}e|GssP1LX!ZFbh%dQ5gpM6KeL zF_{>vV}YyPGRVl80F}5V*10%27P+q0&iRU;)7Y{wluL=u(vr@agNCmtYsX5rr_|ps zpAOfx;xd}I6zmY?HeK+wqz;_HMnOilyj~@n&ac9nxVycL__ECF%gey9kGQCHZ2Ck^ zol9oq$NyjW6yt$kuB{tW3L4Q3)~bqo4}#IhSBq#3iYbr{vy=11bS|YS2lgefV!;#! zh0v10>S{Fb)YwGyYAEr6-Dqw>VOgLz32^GHf3q1S%x`s9z;mWi((K~y50kNASP+82 z_VaI%XPM_4>=MjS064c-75#cn-mBl>HV!6(RZP+eG^}kis}amM=C)}-$)P@lYF8cD z6^quq8=ujqPjFFHfh0mHEiqbczT4km0*$&b z1#o-D@Kuc#;*>uzF~JyL4Cz5!7}vQRs#0E@pNB+7)<4EL8Wwm2qo*9y~%}#S|QAbTlDO5fKpq zy|`!&@X#UALLkNIL%pt!_jL4S*S64;*wV$mCsl_zf8-#jKF0hQ*Ejx&CS`-^j zSxsFfNeCG$b}f8RyT{Q)QIv;Y@6|?PcFk}pH5{3yJ<`wWRKGG8zT%WlS5jA3|NQy0 zl$4aNF6iC?;)jg!`qir>eiz2!jj$LrZvMmVA*aTpB$(23{ylV#Ljk9II!^vOX4jy& zvdHh4QD<`TLy|3#V$-#f{ZW#aazTmaH}FblC_zC8*w?v}Wt2(jWv`vDqv$bHI`BpP zLJV16j+R&-M|tFr=;0pIj?2(W{6c&v!C7JaCt?P$d4=p+K;Kq912tHIW^MuRoc&H2Nh zu@O@z#IMup5*2-U6=XAUu`{Lc$Il+FNxn!X(076WB%PFI-eVy^Nk8AkB_yaSD?6L(|9NP3 zIn19hC+a)LXxf8Cy7YUBTW79^HRwT>OSbzu9NRo$?CTl3|014Nup}Qo)>)mBM{-&o zVJ((#j~3))qO4!J?AXb=*;#*!b&#aS3CXRkRd&qqeg3?$AtYN}N9P`~VO^cyJz>9K z+yNpE!k@Is*B(sd+k#(pxI6*N{wR#4@qNXhsCkA2BZ7+tHr|mSYBM=MAH1|@vvLgk zi_v$+Ljdz(AOA(?r$77882S^9QQxt@05<;D|GCAJ6#sjaJpvtu04(wIqa&I7@}!nE zH!m1gE!m1{AGGdr5CG3R)w8a!>cLvp()fSrk9j`(jN8`@>5~PPeBRsp_*8j9g8;f^ zvVV28L`{aoqFw(B(qAM0iO4b_VK>foeCWu?V{Y7E3KM8@y5U5?_(@?S8;EQEtGRHn z-6*NB?NXyzLPy)uP@eoB4V(?(=3d=||5$el_-!X5{`#8M+5YY$l(PD-~Vy6qY^ znnBNb3+r-2Nd){r*UL9mHHhj!#@@7#tjI5PWUu7i}iqde>QChf<W;jg%%shD~E&q@*>T`%3r3l#t~6)cSl-lPb+2 zFTW`?^c+z~+39@JGCe(wyJK-$M#j=G?qhm*Hz%KDb#Op@vl7JqoYZ^HQ5#F)#x0}; zM)Bz8(UC`C3zVAR%D&*FQ&dvwNbGGT6i&0KB1bak%-XXrZyIX#9BN!p!`vmIDyZA8 z#ml)gzR{L@XBaH8Hsn5=p;8#vlXwn@sAgLk@DhUW1hKu*L-?=@?u={T?N2kWiYJ`p z=YpwQ4YqZW$<&bT&AG?pVYbI==dP&|P*Ye_V2VxN7oiJ%r0b^i~`$ z6>svaRLZ8GBk}%VlNc+=w9)fX+O%V{2oI{kuu0V*Bih%fwK|oQdsn^|>mv$^{sB7r zW6!qvqm3^7r~W68j}0>K5G(JBMX#N2k^W7Nay2^YKjgJfD+J~@tHkEi)HJTdzW#h0 z5Zd2Gk(l~mgj0Ce;;V*{!Cf!>_2P%T=oOnVun*9Ko(5f66l}8dU>z%xNXX<_wl;PXRx5F-K1x5NTyM`7c&(S%KStcNwhY1AI zC#FoyE?F%sR=^K=5=9@@!6s1*Y{9#Hh|Z^5{<%tGdh3%tIr)2Dh^J8omC zA8fl?<>@bGcH8VjpA5|jN|~O0AyJ$2{a#AP@OWBIrxTpBE6?%EN)0Vr4D4tyN!FC| zWzH|$=%$IIpZhUjZ`1w_@HVZ+Bi&AUuupMk-uIti1;LR3+(cvNJ1BUOHPuT9r^(r6 zWHVyS8%#K5{vPwt!m}A2NwX``2fjBiRzdHFhy-N-TQ}zu5|osorT00uF~}A4{p}Z> z^J*k&#h4G9{hhuDNcdja?(7G2>}bd7;ZxvwHQFpfUZhOimXLnySAY;&nJG_TgOSofUf?NzX}`8@akD8o5v0@1*UK*9?z&!Z zRiLb`*Apqz5B23KGmxqK-7o!t`9wB!jH@1ERs@$uy}E67QUJjCcDJ545~g*lYfM2& zNlazs>>D^T5&y&02NbMv`vMyqLz~3uu6Oz|4ol8+8+tkd5X{h|I4vaq^6tiHqJ~`U zL$15!?4Dn$oc6U_Uq0_qO)F%5vU9Yfbs6vp$-e)?*MfioTis6vH5&P6=~p`?IVnQN zZx8~kwNKPf4|~&|LjjOlsFm0v+lJBB{g#TEj0)GU_Z)gHv;**u!!9zb6!&ruJ=dL% zl!nF}lrb23_YG`TD{ap63W7dcU3FHb#R5?@u^1&8z0s+`C`c#o`j{@FD8wGBa=M?i zx#w=vxc03vuG!)c7FD53rs12Yn$b^@_(*q?k@$imLt4a1eMQ|wD7x0>5k^Z1 zY3fE{qbK*uU5~>&M5HzeH+uVSxNZNm-|y)>Ek=&Ag-V|DVq-l~NBT`R_q4ZVHXbYxl8}?3ern-*!-jWR7Mnq}| zmiTtNCI5&#Q2115*c%|bsGDYx59-cQ?H67-U|{Zt{$+yXjERV{nf{+HO1sU|<@#)$ zjO+;r{@dpO0nC0Kut5v@KlyLS|DUtXo*>uhq2JDCImeHg3HbS+IDEgNp`i@xot!X0 z`V23DOKxA4C$UM%vOs)!)MbrjbXq@pEd-q+Go{L^JgWNbKbegaHAPC#wI3+|x>lDW z!g0v4CcB#Z+UG1w&B~PbE^E>iUS2%oEx{zMGy0xSOyKyeA76a;>^p)H2y+4vn8tDD z6_09Ky-hUC(tkZ7ZO64-y#l@aVe$=pXym4Zj!nq=9jhCp7>4Hl&{I4J!6Z7K%1{^b zSTQgf)zZ${$3Ov*c6{`sqQnVx6XNxl8BB-~=}fvG3ybZKAmx2%+V(=T>}FVKLHHho zU(RUQDI=uoaG&2BxtT`jCEuxNtbC8zvBAjTvyEy<1mcP}51)zZxfL6$u^3m{3g-uP zjWmS;+-P>;3|J`95P!sf1~~a=r(0n{))$2yZ^Pz%WRW>-Q4v{_-&RaBN8S-un9b$;nE)G|KnIt`8#XW7}4*BM_faRk;zU zdtAE8AKa)ohxp|Cq5xzRNHtY<>xw)pm!;gn{MoJ`nT$aJCZ@3xXK2KZb&gqM1!N>F z7;!sXR=soeAx~-$5iH=*{!rm-t$Rw^$#k;Xt_*6tqDNL`MIC6e7Y8a|8>&>=fVLUDWMydrqXf@axy}Pk4(10j) zbhbV0Eqg@tYIuFs?G(rjHz zuo9t`Ti53mAj|zl4{%n%=3$#>aXrqLjEg=<^k#ol#?@qfT6JpVkMW!PYcY_p@}vm9 zh{kMwz*Jup1x3?Y#AQr^(VD#PRci=gVd#r7`we?B$@tHJ zaJ8OSLYuMHIiI~J*11bu@h<@A-LJGYrar1aN{nawCF9LALoB%jH;GT=n^4f=*V|c4 zb;He!Kg6~i#!`Y_Y=*RD*niD{s&RliA4Ud!g2LQ?u#HKumRmN&qad_lU*#&-wzQO@ zN*|g%YKkjbHN%iqmOCU)?vpD{T7iF@<#QRma_p^RAs)*R=+COzW}I7klQVSFDtsTW zG^E+_T;il=CyYuw@-3g^)}E=bm*CHb9A05Y4@U^0xR6d3U)^!UWkL*_ID6%nQ;H(! zVCZ{}nI5DF2+7do>b%2(7qmdUeSQr#1)6&-b|Zi8dmwL@`-;;Q=wN*MkH;+O;)S;J zY!KP`McD!2xHxYw8bx&zYjN~U7{eXL)dBPAsyuhppkH9G!`PP11eiSUa2 zu^hmd+teq9^;*c9FQ>)vYbNl$Q@*?OqtiR~io}ME#Nm#l@)oSu$@~x4blmC@V3dwY z9m3+0{ehsC;3as#Nb*In0JcW>%l=3oSghnbta!VDxK#{$I?CpUjMB>^3SaC(v>YNl z4wqIz4iqbkk%z64;S*zyCM=TjM#nz=b94{aP&X`&!x$`6Qafd}k}kcpbBWP5$JsDF z8uD17Y#u$Hl=9fykfK;}6{(O?!YN_N4)>g9&GR0Jlh|cp+3l@w^)dU0&>&x4_MSzd zqHdD39@op*3YmkI8MSgPW<{6ZJ@)Wgg3Y2Fad{HPVnl)oDYg(pX2;>lmeQ^4|Ha%} zM#T|z;hGJE0D%C(-2()7x8SZJxCD215AN<7AdS1b1Pku&?(RNCzWd!fvqskaIsJpx zbXQeZ9o^^I@7^a>_|LvK!_-zfruV}rVM>-Z!$q}B5>9LSZSSBr#!gE;aZRTh26h*N zbk~v$W&Z=rZmUTk`=ESBdVT`^?<}e`7K!cO?k*>)CHxPWc+ACCx!8zpfc_eK zDHe4AL@>9;Cp{}gMMFy^(zu?_N3WM=)GP8Z8Yfy`%V9psXfr5S(ll6*lQcSi8^UFV{$wmi+D<9BkB9{G(q%dw-@1EU{_L1*k|df5Zxp%-_E zS;3DZs?ezSvKj33J8C-inXMlV!ADnd?16Goz=N5iJx6;T=`Eg!n9KRTlyhG}gbAkc z`pPjR0Scb;h%y=GSM$m0n3%~-Z%483!?j+5^Kv}g;)WxSCSswoWykc?+{19RQ)98Q zCGjZ3Qxq9I2xDzEgfiixLitF?91cZA?SboFOy{zC3<>eDp~Rt8>Adb$1Mw@NMOB0{ zmJz=%Ke-6qyc{h&b|x!W6Wr(h%q8@%zd-n?e{cbqBpf7dYjIHT9V^%~8{Z}q=b#y- za?8a!5m8YfQ2(`gzNp#xbfwmO7N}OBa&^4!d(3JF7Hsg7?WbqqC;3OK-wSi{s!Zw5 zuaLt0l~~wZANOm*@@~-sAM&FoUSmD`*DIQNC(s>AJI;$>UKfl%FNcUzsmyE%X`yuy zDoBQGnaSNp=va-t8lS%8rZ!de{Ir(l$lk(9do&2n6&7PE{e_-K+5(EyMk-5ejM%h8@NBhnY76vvpF7i z8TAGmacjf-el+Vj`^uA~p?tDY6(>rJ#0(JgN0smwCW{H?sS~ITC-QhG2@wP-bYIy- zEqg2V^)T0+C3l-J`j`xidec>AF)xZ?b}qVHloaZLqNTkh_4u8~5l^UJTlV5V^Pv;J zBgT#6K&MOJZ}diLcXfPqoa|4YO%z7LfA=G+n9ISW55E2b@p-xm%l5WLab4TF)Oo+m z;VQQbgb$Ysk-w@O0iVZR`bXI8scm*aT`d`y5=N<=_a$(YazBYRch|dM_;v-PHRErS zptiLHV2@uG*Sq?fOei4+CdIBDzt`wXtqdk;?xYTZsBPboNx3mLRr82}2gYjpN@!a* zIbezXkp*wn_XY=3gmep4Ua8%IhU^63939%q@RR6h z0(@o&q{i;-lF~Wp(+DlHM5|#$bg&3P+T^CwLb@)u!fhv}AjqaUgJAtiqbI9CF9;jlf$qxEJQvR|5_MVi#P$p<@VS8HGG@99b- z$z1!Avi;C|5Ci8kdsyCs6FpkMqabVu>=Ii(Zn{&wNz2@Qa8A9?$Zxa_j==sTBGMW3a(8r1G zIU=pqOm?j}p5dKK@Jkkc(<{V6V@M#%d)+%cSkw>kOqVM~Suh>=D^UK#Q3o{KD9t}s z$D83h$uTU-XtB~9kOhIVKgrTPjR4{Zn}Kn*x3`yQ@%Hw1@%RSND*&O5K!0r1EQ^jt z4iUD)JiQ>91QG?IJ$cT0wJNl6WTHdDf;#N=S^9Z@EuC>#%7Peu(ztjaE5(V>Bt(4w z8edrP5wMy;kRqIjC~$ld-!)uy>p0kfQQ9G+Pl2-PWAAfj$L7-aFifO$>n~C!C1YUI z7l*6_SveqbxVwL)`~(N}E{UhsVOmMZ-d5Y*1->|qm}gzkxZIkQ<5>2mD%uiCxW2zS z|7n$%LSmfe&Z2y5Li6vYodgh)#y#>GZ>b1LKJ(M;_YdRmIu;x|(Hs3+;~;}FAGfR> zMsTa4_`^g$cbO(*k0di272m>v*dkYRAe;jgfQ z<1R6MM%ZU3G~-iQa!ww$E!BN+Agku>;&K{Ukd3{Tj#fo8gufsJtiTy)g_1TCkM#K1 z;@A$vLGN)Mpv9!c*T91ixVwRw!E0rs%~0nq1WVB?jiG7rT-Eo{s;v6jJbD=R(Bf{* zub1wmxEG1fWN)jDv*yx|SHGTy3mmVw>J0%BAHuy3YPnJ2qyLyuy6jwhvLV}&lJ>l_ zp2oc^OUUQcl(y+wb~qQbC>zH)D*6e8a=lb-u^Z&hq#RfzF za@n5l!%2@&))FWjoSuYZ_`F4*WgmaKbeTkVGrybjv@MXAKk^f`8PQqE?0K=Q{k+&sR%R{Q_XS1+{+IJ8h>mSL39{IimlvRwuI*AkP^9O4>zg{_ zALF|2as4!zaIV94^0JoxjmvgJ*v>p&gu$z7_tmM@_`1vnixv{puT_z z$GLX%EQj$C_b&4AdI%mZ`M7bySy|s{a_PcDFy<}qD9pfUdye9Lxp1U&GVlHrI=Ok? z(W9kI@h&zw95aEbzho+aS4ND_;}nFvFPG)YcP=|ai5%M>Yn@t0*ba1DfpxfC=tKDnas-FMl zZZr2U8ZX&Wq7bVL{Ly#7k@@2367NR7g!=wrkkFbDfc|9dLx$isg+J#4l+ zq7?oA__e0piYr0bdwC^8*%@wp2a8mQWGefKRmR9A#J3;aTZKr}hRufgnR?~uhB{;T zc7qS~#P58HRm%DHSdazvPj{#j2pvee)|(H^516OTpdWuRe|s`h$QlgPLzd@+W_&1$AeG&ijti(IDtrCIo$!9OD_qd%1o_Y5lu3|=AA zY2%6c94`2*NHaTO)QBYJ`|n9?IE*+7O~_wTAYqkRcT(LVuE`%h^SczZ^5LeDr`>8ex`>UkLQGZe1{EPq%LS2 z3;Zua$Bk{j7H(2*p4M}f8vH+hz(B>Om7}3lP^YTpf(ONjFl%arh2*CzlposNt1DE|$IOYGYicEobVHrtH_=X)LLIQW#-_4^I6k&70H}z zV+)=b8Aej>()%mNl{*Jd8yl&~3)>&~InPQpSgu)|HS}>z$I;9NHg6J!kt*Kz;**B@ zE_kl+Go728Be}jNH#j|J*VfnSdk(WL)g^=s(-jXBG>9n3H?Q7`rPx^p*vX?A?(=P{ zf+PQRhq30}L5l{>GHR7F=~Nce@Qp_LtcB`ZwBixj@4d0y(+NTILo&pLub+#{^&R;`5azvqGAj#hkjxqFneULNlYM)(tJ_pu7edj)!70@UJ z|3O!%u*WlRz2d!C@2_dPte+l72m>Vg>p(jcA%Qdqd@}eQFG+m0_L}O&d91V5qbD6 zl~2b365z4#H!r7G5IUQS zUKG}8i(^UkLITBe`5*uxoYfDT+t-*@$Hq}%PgTkz-N5fdgi&yC9**l*-FOJXdN%ADtq2XU zXzQQ9=`Y*fKJ|F@g}y&>H`s zEHx_p01=^8qqg|*LYgkcl^_f7n5sAA_CX+X{2}t()fk00qVsT5#DeV!?M_)w8d)hY zTtYm#nC3&4O-8%U_30A)W8>s2{zO_SjzauNf{cWH7hz7Fky{WJ8RHYJ)8aF`qbA32 zi1CPWFvOo66cnfQ24IsoIs<`~JLLUp_oN$>Wmd!%Y`e;GecXK}uX@+UGd9?5u* zDSNxr9<NL?M|`jx(T#p`NsWJu#Pc3j2Lu}m6uol3j`6YaK$MmQR%zz;?+ z7%Wmg>ue_g>!{HFDNqEzWzftdN=?W8Y)z~&T)UX{&U+)Ai!vB)ws7`vfkQVqj0;#B zxPI`Lul`!j?w}y(bAgr>^&iWx`yK20S@kGi8o&2TewG)PL#9#A(6KNYk|IqQ# ztC*m^>*E_T&|`Ed;{uR@rseCNUoIQS=L>y__66$d33Sd`1+F*B&mjAz?9r1?65Va1 zA}BG-Izl5RxhP z;KyAkn+GnUA+6`o{}{;xK5vj9owM3*dmt|_?>~^hqVBZ)HS-5n^YY8{?W#_jM~dNm zvrAGE+|V75H6)j7R^_EH3RjX-CyK$-VT}X;(56~;VHkJQ(pPd2c<1E^oVGmT|`vE z_(D}!p!m`eVPMfni0|m9$-7%M(b!oq^Ox6YORNIV{NdAE+alI#xC8XYJxiJa2jjGX zhwwV?$ZdyRhRd>Y;hnlW71Lm zLZFOP_<<#_(~TV=sG(e&%lSkRc*8l_cv5Ty$`*hXL=HYFVm}FX8IYc_z4_e_F*dtA zW0XXhx7_~_lnGyopR_zS>v<5*?$4lS6kqYUwLfTOV{a^%syiV)KF@pFzN))1!rJos zl3Bgfp6b-1!|gPfqa;~4cncUsD36QJVy%c)j{z(!C(FGWj+nEW>2b;>?Tz*$1?*VE zc%$~@LXOJZ67mCZpqSzWi@wMv#7w(V$7@Xo^*_UKfqtY2X;8?GTt69KB&;`nsv|T< zd}Gv+eG-ZO4DP4Bb}Yr)<~}%(E>WZf;G)74355E~Z+0a!#;5*{KKjreR<<`Q$e)1q zYlL*m#Q^nUoh9zHLnpB8?2n^>0)ZX=_`^LvKkHSh(zHF^O2Oq~Z&k#O3pPr5SvoB+=`j3==@v=4`aT)M=&0qxu8V71Zp#bb21o@LoEF_}bvGFj*)U zX*c>pDlI>h<@(SuGE4!TBXQ93nYkM|&&4Z7%iF{{VFivTRyM8GW&r_Y`wnap^>Z0^@UPguU_9%}E-L%>mSjO6yCd+8`$m>-HrWzqaF5?Id@AZgCs2W<-W z4~evEbC~`)a<~R0N0w=~?kXJV?i5`VkmK=iySFL?)qVyG%=`8LA`mT{*d-X7eXg8` zT37PAX;CNUaWAP?*>d2m~~rBb&3;cZSY&*Dz$ZS5|SXu zuXQkB?CGlyr1n02qL2O&H9|%*=efi+aU6&(KHT$P2j-wZ{mH;1LT;b36g;KiH@2Yp3mfLaBQ{H_xj(L z0FVgA+58y>2qCV4jBO2xqQJT@m{kA2U-~ijf@kl}H_Nq}cWgL-)nHw-=xvCN;(>WN z?;hE|hK20b9d5gij)CFy{{;u4kyw>?3|c3@_T^zW^($s2X-*A2J|?F+rs5??DiwAzayedhx#8F>CDln{HC8Tr+}`e)Z_ zwS*1RSh+{}Xebew1D?_!h8B(`LBE!-Q`2+UiltI306w7f6;z;Bub|{wviLa?Xanle ze-(4drMkYTDsc}#nYc^4&P1B9E?$^60|2!%Fm#nl4Ya0CUAz79xNhw4Z{G{j;~{3`=T>r zPQ7rP&4H_XTp~0LytPK8OF2M&YWI_kR7*v%Sq%>VdVApjqnMh7s_<70nT%}U;P+#A zBM%DmWk%c%-2DLRdKCl25m13d{`B{H2kw^Vv^=8vTZOOv>b2>~hZi3fRZgg-$OO3A zc1(WNIQg~I+Kk;x?op1o77s&IPz|bA*;ij6itYgwpY3fg2uf!7@yAaVikRibDp8w< zKU9Hi!1)`dB?~pX%I|)k)FA84iiUXfM@eiYM}^8f@@%KZ5`8I!TH5*?g<+ifE%U)m zvq2Py0>3b-c{L1r(i&{dWy^|^4c#x(=({R2$+0t392ugEC|XtZG>Mbwn5O0%P8dfe z%6CQZ7$$wa#EioU+gyrgySb7REsQ!EE9n)keDB#hrN%t8WxM=tZO= zHK1@5Y#pygAo;s2{YF%d7pgo@?>|(}apPvcVY`>%b$=oMG0;@rEXJXM`QQgVsO3v3 zRPApA*nfI=>B6?v7ienqo#81}iqH{$>>3+a<&8?Cfy93^F)N6+upeZP&o^Eg`o~a^ zReG?)=$aO?_b1WI8NlVrx1$Z#)-2x)O;j+#5y!Kq(8g!9I~iL_Z1|8B?kkbzYUjm& z(%rO|`Y=HPLGwO?)5*2d1Dn`l<07HbNNez{hYaN3+ZvBQiXs|=)^|pJa%1Y)iMM8X zER%&3Vwa-ciOj|)gO83w^w-BLVb^MjRPKlAc%x0KmT{nrVmT3=AEIJH_D zwv>-~IeXPS^|T$Nw8hB)nc3LAXPMRC`+x9r8GG{<7;yg=Cwt~V`hVhN#mlhBpkMLq zmu0e+fs%)d1OO{rO6?Q16w;5q^R4=rpsalV1qUUUj`EBApN^Y&iHqZSg@Q>m0d5)| zRBQ>WEu8){Bd>0K(s#Nxx$Cj#?mi#^*T^b3zsyw}w!fBG46~-S?@^IDH1MUb#0%ed zFS?Kip63Y|3`k@9GzP%14b1lWDXTfn9A$N1_CX-FX-!u4N)K!Q*h zaje9%#6`*ebw30iy)}o0i@M*#i-TwgtY%dM)+hUsqU~6P^4h>Ea zHb{P?n_2NaET{*}{MO6et-~qsxH4qZhHsX|E!Y+_cpjpVn`V>$nz-tH4Vh3ZoK^z` z)1CEe*TxfDfYrZY0nU`*aPBwZ1OZ1(b6q!c$((s7iT; zf1SEf2MetjTC$YwiPSM@>xYSrxum`bmKg#!Q0oPKN!5Ab)@ z`}LV}qlq>Usg70424-?*Tunt8NDTH5l(v-=FI+0yfQze(v(1vmy`q=}`5B}=zJ{b0 zPt9luWHyR^WTj?Ow5zMDj>&F&FIIVO7hJ#;s*y9BXfyyaNHP2jr?nlX^ewD5!}habiXDg_h80bL zMv*D2bdbsloXaObZYvW~)$Czw=N4H9oh-lF+wpbF)O;fOK{<^1qP|W7U9T-Im(-A2 zY9PGU;#paHdCYiD+~TVmol;g-j^vjTOw4#%6=dB6FxX7PP&=7)1}P4)(DcQP#gBvV?=E%kG`2VO`m_ax36x0I4eHgv%$N)+l-3BWfv52 z2Gr}PZI6+Le%cvxmW)#@H$^%!8B7-l5@N<$5sZB7+@g3ESIt`|_m5?P=J0-!Ru)cw zJ*QnoFfRSclAq_B+iJx1GK24kWoT;&R<2IUP;TQ5>cdIqBwO^z-8L5hb$lQ5?d=1) z!Z7JaQdy}BPJeNCVt=r&$*6x3!%00md0C&qYY8$bCO?cw)M)1n=q)L4&2?sZ^Y54( zWpLVyQYA#5f4m>dDgM8q;m2;Jud50YIa#r9XxLwVKYaH)&!gt#A|c{^F#q`qUF64W z{zzLtm%2Pr?jRp$U);AxLz3b@@~ZP#o%lPM_F=`d`AZ(vwDtKmJq${tf%)|WB^H*8 z%S>MVs|(jo=|T}UCLfJUwZUvS@Wjts9o{c1i{4-<>RWJZoOQXY`{Ys6>M*>KJlryU zN!3QQ-ImcUiUiHF_f=<}&)X2wadNL3ym(wUZ}I8VCw=ttzPT~ocsk7|&6>Y@1*UfS zJA4$VzK?>FFk-#*>JK_A9q`6*tG9KHkur^TfyTV!=zaBa?-My zq^J;}2HGI=RFfsS3}Y^Lw=dG#4J@Rhcgo8!6y&|)<(e&e)nR$`9>n)>{GXOEx=wm! zxvyPxUvH>D<68kz%$dj#K9hPpc3ZD)bqcUi;Tp;3I!YoS&`miaJNAfHHWAUpKD>^2 zAm6%Xcw*UH*f6gUoO& zt6=4#miN&Hc6iHg>KxVi_#FzSf#-$I!Yc=4R3a=GyY8w-=~Lf+<-dx)rx)tWTDi&I zOe%l!7;VP1TJ+dB_O*1_Ph90?|E2fw^VZEmuoK}6E@ri!1cH$6%7jkUU>aY2-h)|r zHsCl#rXnYu($tuv&0zI84|p_+cOIwS2`nb8i1)hCx4C8|LdOrSeRE+y1A0f^gps(&u?F?^)*quwTh)$;0r(t3Q3}i&f+G zn(8V0E)k=9PiR8B+QX1R485=86LVNnTWT}IQyQwyRl~C|@&FK#xkVp|E0>qQTdvu7 zp=`YjJyJ#*L4n82bfNORlK?&8O~5s^{SI^+fErl-8D2-N)=b&!=8qcbFlIc!YieiWfVxd-c9i%166@zs z8=XZLe$Kh3=0byhvx}W^T++QhUWI|v$XvmPI`ojK@{s|!yB#9LlCeZk$ zE{e?OIU`K$L#gN1(09^axVeF?;UcY9gC)SSz0038H=1&s8@6W2<2v(=5hR|+|G6@& z*#zb`!CTv503|CF**7{uBK-sA$kn@A$^oo{m&3d`#&X&a0)qMUQBGu3%G8J1Md}nEs1@0rx9_e}FtzfN1Hbz!@<0!3Q`qw~yOz`x@tT%-plyetUwI|ba`CB>5vW25}}{@B-Y&@uKNgL=Ykbtg;xzIl_H z2lifc-~S-55kGi4?Y+R5?2_Y1V!bh7X-fHlA@^c00+6!{5;A%6mxzDJWbX&cQR_K? zH&x2Dm*?iN3?5%zyqcF+W@j-82)vFLSd#|PQBX)?fK6Ew@1H=aWRlL<@gT3(c1ht&K&&A&(qC4ioiQ&2-8^$@;j*g+Tg~1M^<$FLV{SGR423J>hiV( zBg=qFv@kVeq~^HkZA9JH!h}bnC-UfUha%st(K{$P1;(Gp`LR%i&W)&j5k~nnBdcMu zg|LrL5eSR~z)CAzHwjx>R<^9P6kpjSsEas3vQ=MaGEW9ItOp~^@CqA|2st>9a+?2` zH=Etg3iP9aX34cj4+hl7ZcOL)eoA|mtNpGQ!s?O#_0+uHLew9bY;u!)LH4P2@Z>!x z|5cak+;! z4wpvr>G$QH3>Rkh$Kft^=aCFPk0S^6zDv#7N~HP>a{J5(5)j!zqw)L*(yhZq{G-Px z#nROjCp!feVkCnFqCj&L{!7c?z-7zzmCmYpm8`cF+abH)R?8ISA%*vSdalQAX1hb> zC?6(ZPciX2BBswdHl!&Yt~xzOWIYdJH}t;$?~tHS-qO-iR8*uOgNXnKcYhw`jR2xc zk|K$@y1fkw3WDL+8RuU|19RmWz5bjjq#p@OE(?FHvb}}b{XG$aN)fA(OXGVU$NO4; z$Xo0j&}H%oB%UcL)8^D≈ZYB7jVnfs_BTPkDR9?`!bTlFS_R@}ynt^B03o>&hQX zc)TBbHWJTt&dVPXx$vnFS}6+zavLw0J#^;<2|p-pUrvfW?l3x!hO~YZP3zk{_j&Ov zBJ~Xk2}`W`wkC_xu?0Ma4GqNy{sJg*=Q)bxDG5y#`9K82DL#ngd7pWdVx`~R z+uxvSD=qK1ue{UczGX@n1LUt1UlhPSkB6d#qA8!g^$ImhhYk|#rI08#%c>^8S^GS%ynWbW z4I&*cH_@(4EE`?eM3M8hTGoJ4NhHMkF^7lcc2b@O9NY*JBsI=AtD%1vik$K=b6{`X zmJxUIAtL=T)yb6QJPnH3cv^!#zO9+(nfJ|j*GP4}t0Vt6dy0+xE&t|qIm}+Ge*CN6 z?*4Mwc@@y~>1r2R)GrcxKbR%@WT(Jd=1Pxg1R(N2CZuS9S^@@l6Um+J^I3ryvf%{P_r)@gLZ!f*XOrTSj15z+5i4_P>YtQ+!#7Fn0W zBK@vSG1}1=U7S(CRZpO4T9E~jP|YT0_hpdk%BuH1REHwqfk3nBI;%KK87u%&HZ%=K zvXwAnoZ9E|r4AMCNJ~9r!`McTPz`<8U29QVNoHxbq?72fYfaxyI@OT7fOUDZ;)i}P z-d?!=Qzu8?ncx$kBQSnrDFoymDxNZ)vwp4R@t;d+)KWSiLA6*12MCG3tg1tJ>^=Ld z<{mYL!y#D@4-Xbjy@Y!;ld_br@|}ts)0&$f{Mc=Uv%?Kfyn#)>;1fopj89EQkseU+ zi!T8I+1^Xno5t&%@t6S^bDu^)BW&{WU}z=c;c3fb^@(OdtGr+0JD~dMxo%s1EmXUe z)vl5ROVXEEY=eAoSoik>L|pre(#@DxHIvip4W$$kfp14#`_`Imx74XU(^$Ar!FdBM z=@)b=Dz38H;1EPqR3Gb7x&c5*RCM(e5xCf=NptPme}8InG1;nPVpU2#qOhEq+f%{F zuLV~8yo;uc>uMdV#(DZ}g##-i1rju?sNFLC_j0&Lt(dQRo=;;N7pgg?l&aW9iW$Z) zYFx8?ddgvJT^~{vVMV{6%1taTfp6#x%esVMir+&_tCC$(A;UV^@AT~2!!ENIHwAbG zHIbeG&i($Ptrq926~UO(f?KcY#ai8Qbfebsor)6|&O>}sXdhgyn9SW{F|(o}i4p1n zITf&V3v1exW=33@>GjFNx0JXtM#X5bC6H^`y+7hn>6x34m}|%2Mf&j{ z2)t2#WtT8EZw-hS&mUxSeK7q$l!+eTi-IF<)(c(){-S&5uBDKv#4@*}~OEnUZqm9C6?!gU1e>T73=8uWWcr@Uqji&(| zr3rQD{7Dmy9I2bc9=oOu5=)t-5#Nm3(Es=z%>G}wH8T-o(tJ!!Yn?x%GG>{(R9a12 zPGvl!)zIws+9LK*iag*RwFatM(JN~V^|M8Dfg}-dKJ|6>gY2i&#FnW~wA@@%;PW=! zp(lVITMms2m>vhJLMA@w$w)c$XCaZJ=o@C|HF!PVNY8iZv#6{L>6=Jv=P%FE={zck zpfG;NY!yKl;+i%*CZmSAi7KgWY0z$Q+U*25ESeeBrWre>bV4c)<(#X0KNkCr>3~Ko zRXhUdjOEAh2op4`RX_dA!6wy2L0L=c=!zFZ#Bl))4c#n-gL z=|+j|=SRsc3@zL2I;KJ=p^`#HrO{&c<6&hRE}0+j&>+{Hn`2GcAGZ&l;PZEPJ9ed+ z{hrp=sY9AdEh8dUS0Ty@ip^iG3hC9eY3s^L=IXx!IfChnn0{Nz#eH0%Uu{w@211+6 zzg6d@ZaC5c!L0ahhE(jQzwbGljy%yN-vge8POa3f*RkM@Iw^;_TtW|mpvDpV`$v!e zwy6KB)|GE>Ug3?^*Z-Zdq7OEFswbK7$4syb6!18yQeBQ@ld`%x!H~E5PK^b5S z=4q4@0wPmPNueYK2|x(uRs$QC!3qeXXe{?asHz{xTx=VLyh$AtEo79_3>%+jhDnaG z$jOCZw`Gi^6gQq~xy@afDEr6ebjbR#Au9(s3V*uUOMe^8E=q$LI7IMJl(6EF0>uy7 zA6^_RHj;gb7B{R@907HIF|1iRC@=m8_V0J@nINMZJPa*nA~EcZb~^O&=DzyrUmUx| z(YWWUkATSXK8xU#2stq{c;B5Yms;G&g2O?SI+8^*I72MoGn-wxNs~VLxPW~vSkHeM zfP5mP|jNs{`=nD$A*KVkOraHW*^OCWm5hCK_)=11fU7Kbi znrIm6ygjrtL>b?cVac>)KdT&s)Ix_E`4e`a8t6k}sivsa*g3@fz?Ry;$DaAQqX_d$ zku$=}dsfexuTyE0dTNjssa!=XHo0U47>4^q^1*$6cdb8`AWqb%iO(r0)9w2*1i2)00Jbpr$ypG?c zOk>!)FI_LoS!`!hOj@ZFnC0wR3i?mk`GGM7_b^a^d)@#?>P37{l3!077lHbiqEH+` zQHelm)U7Z`9!;3Q&g{ZM?#J=D^LtzyxLw_+4D{?DPa<6fDS2I;RfdstyfTEY+w1rh3BRtLGGJ z0;4EtldFft-CA2NOIMAFonylffjF#c+d^&Kj+Y(caAz3WnOaSroM-rsA|k1&4GY^) zO`ov7kUm?V@(kb>n9g;Buz*r>Y?2LYAAk?e`E_IR^OQdEM1xR%C~2~;M||0L zAR+{*0@vi2l5yaT%b?}<tcnZa2oN5V9fU|%{Sz6-CnP+P z0wbQ1HbFfD+UIW$c3Ejpx6(+#tYf1`X+f!FedmzUh^o?LC;8{U;zv0yWo44a8xVJh z%ZUdwM0p$oaZ@FgMR^Ii0<^=^8V*JW_~aYIc+gmMKqe^EnrFTUCq z5TZ;?<2XHxAxT?$O*=yrh(6!I64018p_>Ovue6fVf`QK5r38Unz(T9K4)T(%KTBvI z5D5x;-*>8sepj0wLyana82Nyhc|qe`Hm zmdfAwF;v}w8zu2QhX_^M;6^(Txvi%f+Z4J{!8bK^C{)ZTttOsk3n9&XC)-e}&#!Wc za~#+Zx*JTW`zPp}xZHaTjB1Ykf&OI|Jygn)*|K#Wo~Z~0g=Lx=m_z1?!FsOq3ww1N z2+ES$2|`-xMR<)DvBe2Yn;K#8*LZ)K1|?CN1~BsrFwD6(B?p+q6kH)H4q`vrYAxu1 zf1{n$Rc`3^Dyur0n#Ptg@r!^5zMRJQ^~3$0ocYaoU5sJ8Wo;Qp)%_H)z1$-`JHw+q zP|oJmQ%b8))j?MFMd2dB^-EEF3y!!(RxuGsxKg~|qmHh)At83ocX*KWx(Ay|Su`e+ zyc-&ai_Fe3_8Z<~*c}lyJxQXNW1=zGprqjEP^_;iB$<<|DP5sXLQE{!Qa=#B>+RC^ z)AYu_x0D?j_1euT-gm!!&PL=-NPDlD#N}s4|>??(N z$7dW(ZK3i@7`uP7stYlobkfHv%g-01!3YWnfVP^Mo!zzJAOYkw5r=IK24a4sjv}H{ zf0@bfjrmt>5B3e)Gru6RJ>>R|znn)_!%^EAg^vw`K%RNLi;>h9+FovdT1Vk|Ev)FO zZC{@5)vAqn_Z*^;j$J6kgsig2o!HmIQ%f!iLKls5cw0EMydpdX`F ziJU?|BI_<^&QwkQG~eD&4*_wYBSmtS^=!hlk0xW?y$S*DHUGN#IIz2S_%|y2P2*O8 zni61Ouvsm^`k4ZW31`c+a2K`sIZg%xGu)34ejWT_Bo38SB}zqG8u>$#sm-8r0aYwW z`w+2^nkZXL%3?bCGI6(PUB}_6AnWRW)Etq9`urklT{!qS9hoNgySvrhrusHABK4p) z70`T0;XSXKOR-ZzJ^6afa)RW;y!35>_!%*iZ;D?{B~p0=5L+tMbC;K`piGByuEEeD zq>(effsgj{uO zdai*_C{@fGM$)iVBWb^a)6R1V=gg>taf-Fos>pww@eqO5(&}eyEcX6RCUo0cvlH;R zoUL{GiFrC=$}838EtD)Rx!9aO6x2oFX#MIVKjDK3ldT5x<{6xJ_Ex=9GPI58_eS(M z#E{_~UYT(@%iRvwR$9TkQasAf!ajac*Zs-m2zMn zuaV_GgFWlEX^NtdZJ^|Jv7Nc1MBytVBd{>v8+RN%?bo84O`ujGmq}$2Jzq+aJDztB zRW_!e7EX#hGI21bk;)`{=j^=6)@opzIiX?5F-rJ&H^=Xmo)bKOAOerB2Lg%R+P1z- zxi*UtrLeJI-*-#=0J85$1v#;BWqD1wHs$uM`%^lu)#U&i|B(op{x@+;9RzK|h+)(#ql9;2MD zIKC3aQcX!IqI(7A0;eCD>;bzhlZR#w-=y=Mrsrulne4o?NngG^kCAF6h&sAYV5h)q zdY!J2p?9&1&3%j=MvTLtk%-a{0099CCv)CyfNzS<<$A_n=yuv(tc5f9w;bJH`Ozyj zd^X>#B|y|>6GyVd>y)p=VCp4WRByQoo`I5~7+vJ`J^Lb;pU01i-tF+0yPG@@48e*6 zi{OTp#s2+djXCM_lxef|;!;U}c}^p`A(ZtlY@=tX*)OBkpJB9rBMo7PMu!b_W@^;97da_eDpJO2&J1s=V5vKOKSaz zFJD~SdV~H>PJ&3W3XQ?5?V1k|0kO0^EY?hRfGz?go0N((mU{OyDp4!C{>u2I>=M|_ zQ#{LIe+n7~6l_fAdVFnI6x^xfc&qK({h7Y~<{+nFaJa9vkNioZ*Sx%3Jj+gFvDo8;fxvDPAt|z0V3R?hR%SNO zRcSB)R(}=%Cbe6XW1Ycw9@RN=E-~q7GbVo#M)(6KHxhxN%>}65i?#A;VjJO&ssvBJ zH`pXLt7*ZK4`<+_zXu629;WqCMECOcfA~K*d&{7@g05}z;I4t-?rtHtLvV-SZovue z?gaPX?(XjH!5xCTyUot?eD60?Q#CbH(?6g%!r6Vgdv)*bYuz_ke|%vOk2^ldj|}mT zOXpp?{(f%}Rgj-TxkNgS_t7bEE_JrWsCNdj9Vn?N01q5YA(~Nz_6wj#kfWi;iUJ(- zq;Cag9a$jA0By#w>7Tqo&}_QvzIG5cF+DAbkfDIb`|%+ukb*^QasPz{B%{zTd1}^H z<==Kdv_2{6VD=#aE9|_#W^T9bDBpd2M##LF+|*w_PPmVT_Pyina3&+QX_SQ0V0ks| ztD036^@y?NXhb764M+h7B@k6QLbvK-*BA9T*PHAYcL+&wfPaczhI>b4Bt&p?ai1P? zLXjXWJKn9k2o?n-wS0i?67GMt3Hk8-f7?ASn`KR834F}T3uFL>STR3EgoOd6qJILI zfORi`e!~X!0^7>)|2cu0b?Es-vODSg^QV0DCAP0%zdKA-AZg9;1lPI^)dA${mCi*I zJg9r;XDd`VAX*^7dfP*jGu$KzyLI18^6$v6Lr(r;xr0Xr{PJtCBq4{OdIGK2`OJ>E z%hy#QR%;sz_gveGU;N6}^WF#`!9a_FsvXb70$4#}R9E>}Q1_WL45yxOY?VV0xLv?z z>Cl;7U*sfMtU6+5nVgF+tlFx;^HwnuNPiTeEcvy+$-|GD_jE8zbZa}^=CIB~6usuc zAy#zv+!WK-4$w_iulz&CN~Qy5-J~caLC$Q|Fh5O&_19Ym+1sac!3k0ma*!i1}V49=zXj zvSZ$W$ix3qBw+ieNWewqi`{+Z*c@aSt3Yii2EOdC7N8mJrT$+0q@Uf_`$rhjf>N1Ao z{f?MDzx@22L&UWgYEpOeo83x=aLr+7<(Uve1*K)0a}7Y#U4HvE89@Y9C*wf<2oDI( znLaWiKtcI^Ol`ctG^u95eaKt9qJK+5HifHb)Ay7_1Mx!Q8)uV^ zJzVE1cn8(-pWQ>w*Y6}FNdo(dDE^B3BT!2?9Vb~ZBL!${R$tBn<2K3!6^s~=}x-T zw=o}Ci0*NpcCN%!57{n)_bxW(kE;(iYy0gs0c|}*j)af5=l;X8n&<}+|UhZKx{w( zQLG?q3|B31cc17Fn{C(UG_Xf23o9%4jK3ag*F9B14}CLT<9%kzANRJBXagrc>fd?q zR?>V@L)_la77Z`giIO_sdgJ9Y!>=yV-LFTmHugU*QjO%11FKf(qykY{lb@MDASHfh zck+=-<<)$OQV|hpE))TavXVxq&j<%(e)@rXEc-@6E*G4C4zUwnT^R}Z_9G2@Lpu07 z*YY*i^ivqNZ%#n=6=B<+8_e={b0?8A+z|2dF!@V`e$!VVX;>^?!v13dD6cB@|NY&c zhziktLg9bhQkLg)(pZIBEZ12nn1>s{~ZQr(Qltrq% zE_^oL1V%YN-X2RnK1Q0%pMA>pvT8<^>MO0b8{R87Ddag-v|&IT#f=}1+{}MI(q<79 z>c2mCbZtJnBx~4v!*Ni5eZQPYes0sHqkXH)Iq%e>u*>*c#8U{tgmMpU3MN&s*=BU} zU<2j5T;jvyuwQ_H04n&?wc74==dw_n@-ar#5dgG56Fq&mwESC@;MFscmc_N#-=m!? zu!}OHNk-s_m$#3T=z$aO<{clK_j4o{6`Xf_?n{-$qg}WVfzG(S_}o8fwvW-Xm1;!> z>ksFZ&n!rw0h8xaqArZfcT-2Og^kybx4CR;@0WQ5EGaX9>}AwW$;!}6N$q6jtNU9x z;=k?b^zcAAh2rV>@|oI}@RY4WJsO8UlNcw&m|XZ=&dd`TM822yyA7Fq>gikf^Zj%4 zdh1(%dj9JM#2KZVH(Zt;OibE}R_@oANd^ZBR%;{i3h=#ozfvo6j#UB_D=zRq;RI)A zcmrZg0Gjo$#9BtNx9F{n_L|la07^T6#ClNZ%Vi(R$G+{m>AbBo1q!b=kdd8Z5$@@g z@=?V$6dWFB_8j5a(E?8!zLq2QHtJZoA+`!G;f69lf+et-JzS7aL{1gEJ zK@bANEA}%TXSMGCbQ0kAF76&JleXuH*5>nR-PCtJ=^Y?jPRq$e=KuN{ygpUAj!IzI z{uA9XH7$&xtFoCP)k7cHTz`(x^PHCgvY7r?(KgcFD=0dtY_st)@QhO47ZVljM3op< zRrX?TT~Ql>Z$H)a6-EBO*lf5NSc(BpXwCZdQH{^CzI*Iiko3M3m%{_f#kw zu2MGs&H&t9PJdBGY0D?f7#sD>QU?5e^-} z6=G3v^NCBN;P>J<>NSP0xb-|z=hTBq99<9!!Ij-gpGXl8ZPgatzUR^b-Dw1Fke*vh zbtiO3Cr$J74GmE>?w!*{e#Xx^%QBYZJ9neVc>;}Xpktq$dOHue4%8^x7Bx&BchOeT ztBdfTT9huF+&x>Aak#fc9|cB3ufwESSOxKJ#TS=RvPn{DlW)~>%;|U&$~Ehoi6rV) zaV#vo(cOagehY1}xQ)O*L&HC-Twuy;eYtUFDE|n}QqRQYUIu3r+J^d_QT-m^r0U+G ztG7PK_uB@ny^BOdf0jCU>S$;ntqhkt0B{=Uf4%26S}^f{xXxRbRn-u%?>P^ivxR}6 zYYHkiyy1iuUt2hy$5YFhiCYZz?6hy;m@e|aoLCn(5)wt%DZkDaoAluR zRV*T-w)FOPJuK0@TxnI4`eP3t=Daw+i{m+9KDRGXB_9g_Ga$#Wt1C{u<&s|(CB9ybg`OOxE znIn$ikwn1IF?5TUjcn5BYz}d8ad4~{5V$f%5R)(Ilh!>rRReOOBIgdS$+oIz(X#Qf zhzNlf5S=(eUgyKIG_6nIwFU>ntkMqhobfYmc5r(3!6etpt22$tAN1l@_}Rbi8Zmvzo)OZ(na`7_iv>CQ$$L&h=&Vip%f6`X&prJ+{qB2}hi9WjaQ9HZ3gk)jX<^yH!N#e1J-i?p-s`8}@pV{?!h4xC*L zpKSJvLbb~b6!_UI`TFOiMMcSB_jZC@M$^LT;<@zey%v(a6Z0(9!(zx6j5>)}4?|yli|mxez&-GUn$Ojg*>6 z@9G>{vm+>RrB8O!t;X*O=}+V=YO)OzPSrgCKv7n{@xzAQApsKojuW3hNl?f+V0R-8 z*HXD*;|J2GZbd!!ue=w$)L|`nzu4E&5X+k?Y1!4}b2H{6JVGB?)Rg}Xx37*-`*bd; zq6@ZFz-S)CT`k$gx3*c2UxbR&Wnb9M>ef|45qGzqM1|>o!Yw^MU1&X~&8y))B45x^ zHj$5f04^ty&!6nRbpGJMK{e=?`TATs^NHmTPP8mIJ|$HzX3|4Sd~FN#@}@#sBP~+G z2Gt9JG>P$Ge;#stINvCccd5( ztt1jVZXd(RDs{iNsU<$ok>}7dFib#0gT+}QB4(!dns*ia4rM684wE+=%r-$)u!v9E zABtZlBa(xbQx&nLRt;X8b9#2vTV0! z7wok`Keeyp6E>`bK3Nuh9SA8qPO2DZf}b+F$KQsenP8YOg@O_+Lz2>`Qp)g5SCFFA zfuOA-f;vk*(dHfTvrqdT+0RiB&`=#1G~gAO@)I-+9!`kh{fExfXdD9&sQjafv;n`N z$rsNRP@UtZw0g9&uIUR_Efr@$2`k3gKWV4NN{PdkEC~s+Qja^jN=Js^N=b$j5fAkU z4UZ{ENox`P^K2}s%1+ep6_3g-O`ExNhDNq~`nV^pAF4s*E7nd_<9s500Tm_@@ruU5 zOsk6mYkE_l?zK7W(?c9W_r^@*7G4(c?x(XT1&x!fONHoE7ard9+!~+khW7k+r|d38 zKS<-a;;|#~$f;=Z17fy=_L$ym{~8bii2O6YIIf8OH9N5-AvO@dazxg}m7c^3zn8!d ztSwAR%D!w}+WB;R(Qkrr1ED)Ddo9_y+C3Vl(e_LlN5*lU*1srteOwOfw^`(_p6~dg zaG&z4q-jH?oHiDi5=)Y@mRRv|@w!Tkxx0(Fy0Hf(Y8yJWQ78{{5#n$M%eknME?hY7 z>}m!kIdMU>Kp<}WBbQ~_99bwTKc({~>mPNz^@&V14vR>Jz$d2#-!1E~{JWkJWC(h> zJG1!=n5}@xb4lyP>0zMCu8;@ZHznex)y8UzBeO*>7Ci@cVsJ*&iZi=|vd&h&ikoPt zonDT1Pp@VOYUAvsuW8s2NK~(iXZPdh9#BvOw4&Rc)e@NZJ3Dn)!|pGS;-gE{oRmM$ z4MxR_UnELh@VVDYCqF%Ae44L*m0B=6$((aUj6@XBl6E^=M-$GqX@g0NMn=lAn%B=! zVQ=CC2ZEc2hR)4(!z>qnr3F71@2v{MBSEDEtwqY@9!YVh4mWqXsSqehoUC00zHh@8;rBNO2>-N?|S zLaiprbx8dD127_hiFVCy)JQh46h&w#*M31j(2gS&=gid9m-yPbeULULj4Y0d&<5v< z9KTc(3*69+hJ&qlHjK1BBqB0sggKdY- zq$0sXf&!5;!<7Kso*Ry_=ed0Tn~`edL|R>U1GU0%rtoBeDlP53VGKne!po3QiODpr zDU9eCYLo#mbfb*=^9=*y$a<-mhdF-BTEK$I!gR6 z60HEax=BZ69Gvhh_E)=>uo;1k7#Xw51TqjYh+;1Zh`5m1Gk?xm2z?Qr3}w8; zDI$Hpo+`S#4>dpkGQ&d0jFBV}wfnVKpNOaR48uICfKDSzYj6AuDj0GorZ7XuH{r$I zeHRf4gbN|kKB8!z`h6r<-3Qfj)nfh&`1Jgu`-$gHdm}ybH(D)A;E|PTk!}9QHKiIX zvVI1TB)t1uKr5v=$M}u?^nh6*nlOHx@Mi{0LM)|e#<@u=8NIV$lJ6ysJD@J@G;_Kpr z?ACAa7}}g`iPqe0CNP$X;1I zI>-RkSGXt#Tro3c?^lV&fyeIlSqDg=^Fae5!wQR9Rj6S^VIQGFAIT4UtdbwCJ_UEr zLc&t(rQSXmJiA`A#p4%Qw!S0$#3FfMxS}pOI1Zg2sz+VHM_}r{jx~#;Zk%s zujgSO1!v_BAblNYbKdiFB?{XX1&?Gf=MpxT&0UgE>ggaM;g>%tgHMV9)B0%Z5Yf_K zNNU9fWECYr(iZQ0RoqdpaU#{fCPYBoDK7+{9kQ-si+|9K1s!IGm0SdCx3W z+3lO-z}}<_ut7G>+rd?GV8GorAPO;ufFPHMAY?i?6(tf@y7fdXDoxXCAalbOHr=PC zEAytE+Y5QUXEV|hjynFg1#ZZ>gY2%Y9AD(yZ$b1H*4WmX9pAF1CW8n9Rczc)R*<&2MCxeZ;b;Qb{h@q;Q!E zE4StOz4}U^lL5ix8S^n}R6_a19|a+|!im~5HmSq11lFDxKP~Tex~)pB`Sdk)!&)B8 zs=$X;pv;iJh{VGEau|D)p4L3T&Vry`onQP0OA!wjHvSyB(BNcOY1C*z6>G^bQSte& zWpkGcdUk%UTegU1wmXI_8X-h6l4doGh8)^fqQ{?9dbP=#|6u{J!dmgYTRZibucRia z%*w*ucsb@hx;i=TY)1-DzbX``LBjuPIVR-CgrQa>IOc$>Pmozx_s@@rRX1k^h2amW z;B?67px3Agp#KJo+3={}Ouq_o^e}##R1kCMLKn(J;tEY7;|=n=A-Yn$^TMMUE@d)0 zBC0|Cx@6wK#SU?nh>`mkGix4U59+20{T#>C`>SLnlP|kq*|*Qs#rzp}FNLZ;nDI;F zANoOc=Q}W%Ao}3IFXTInWnSrIAWu&@IFR6pCQ9Jh`h)FJLWv`M2_!Wnr(a3 z$+$fzuI2W3ZH|60$@H;g{mXD*;Tb4ki*@o=W>rs+*tewO=bFu?8~kWJcTixGA}D1j zR972P5%14-vJqr9-3f{cILJ5GM6bHgB^`nS0_01U2|DDCiwuNqk<13JaV@K(IeVrb7Mf43Z}dP;Omteq<*kL5wWJiWymQ8l%+aD+y+2^FgH}cy@0aBZWYp z%%k2d5jg9KMGFm|Dy)7#u~Tm%64^_umw`)CmN?YCVJ(YAG|C>0N*4Exb_XoensPUV z50ZMHn5S8{bAGlUp$QvnM2W)%XX)1)r&8if`OA^y=eIX{=i!4LT1=c5>i@#NCZZ8l z&syiNG{2CPC9KtLOPeDk_(CVKWa7Z>??r&wt`8ODSt<(h?aTPiG50V}r6v$WoASwe z*<#lo3YhOkRo^RHVy-!j_AAp88BHW}np6cWQRFouSrKT+ z4a5aP2KRKb%c$CtER+eh z#0)3%pA;otPg<%{Hlht`=-8TDBLUMqdP8a)vB$kskWy0?q2wn1nEIkrqd3ORV-Y%A zw2cq@U7eAK)9#@!MV&-upM;d`bH`5DWTO9m1I>Q_{;6=a40RBA+?gmW^X%9^BHwEZO6Tns_(LHn{Q1=w2% zPFzG2%VJ8#w2&_kx3&pnlWJSI9&zjXvT!=NBMgL0IRC3MXflw?Vguz!R?y(*W^=}HAEO^~SpBdA3CU^LH<+S;Nb zAI*2gFzKcJQ@bRkv9px<5q32Q1Z?@psucg|-d^*V;0F2+w!B~z$c{eslS7^#cHZhR zadskf{Msk|8nH~CZ`42F?S!k_CY(`4Vy{$~f?TZSli@Rr$<$#_wS3Lbzozgj zb25AVQ8XdlaLaH%`sx~Ea-Wj$1$^lT3xVb3Q0TX6f6?h8K||d%Bc;Vy?*-IK{iN?) zz=HAL01AKnH-03b6Ux&|tgL2#GKOS92wvNV6Cn&RZ}Fdf5DaEFw|O?{GdF|&Ye7)lozEZ>wEb;;-8%_H90;o81w)Ms8%me`u9gCm z{o}Wk^Hv~Ih|$R3m_PY{$Cv}!`MyG@xtMzn`Sm8CNK>Swn-Gw_Mw2UH$&6Zr?32KT05l z&eKhk+*8K~CZm2r+Rb^;|5D+G1|uHKreMm{$9$k^;vh*ytnp)sLS;Nf>94c&rxrzjy{3h2N+_WF_nCbA^4|=b=FfLf^JWDP zU1K0X{PszhoTg-Le5}Vqaz*kocvcKdB|q@EQ`elnV)1Q98~Pi)8oG2)zUaB0%MK zt4xBvL1$XqK<7NhX);OS|w!qO}kCbYym4-8#Y8>LyplQO{6CD8uknCPMeM4?zbq}31%8Vx@*jk<}Nq{MUzmHCjuIUOGSg!p2#u^kCx2sG@bG*ucEZ&zy z=0IGrw6Ie78UG}C&QjZ%18%7lU)dopT<0vZghK>7;5%;0N|NU;@yw3dCkMM-?>97% zZ(Mkz-^EULT)}^0mtnOcxVa4tHgv zFRUyG#$A2<(Jg3F)qeBfYP4Cu)BxXDVP}VIB!r6o?8-%ZQcewXVIN)Ul;9*4Etcp!$ghp%AZw2;y0645i)ymSUtcm|W)} zxi^{P-bf6P%Gai&)2NJZMG1q>-&6wFEM(-7sI;@2egPKmPaUo^%)+GfuH|9h8^QvBZocm>b((L zwK2MoKwNdj@eHhLPJ^QpxsM|3dc<6$HFVpJcL!NXV-$4u$toVf2m*!4%JaRu7~#R_ zswU~z6KAqG7Ag0drilh%54f>_dlWsjv8IoF3dx)m}`lDG55O3ARc z>T@x%hAa{-Un_%V)g{TX=Mc`2Q5DcpWTV)wp*f0+^OwByv%(fM&PQW+VPe;1KIMIu4A?(BH9 z2HXY$ap1$o(*)vK%eI3eQL5^?bP(mKMbu&Dt-sr! z$IMK#JGB;bD7Nra)_wLGFM-_>aFU~|{Xq|1aBYm1$}dAxgH zKVPQUzhkmj2+wlSdaqCaMwT?s^y%NHKSAHz;Y?TAA3I(B6$_kh>TDRLGltDUz+%*1 z&+X#g7kEtux1i$##dGtIhKYulu*#u5-I|=Z!EBXn6Mmxk2DY(^IZ?JM%4C zpjOg3mHV>lqwwvp#pSO9C@#&X{Uui1Teqh7l{YMl=kIl@*{lB%WjY)IV zX>~mMQy>kr;mAr*vxPflT(aRaOcU1YVMpcbz3rO6TG;J^2jTk&pIN3W<$?U;>&$^` ztMR}hV1X=XAF{sF%=Uzoe@oXMKUFWlcK7LEWWAOHg@e%juZ-BmLiR)AgmNA8K& zS5MMdbwF%+KJLL_cdjJV@n+IvRJtYmVElDq#bbAX`QtscNUz0v=-dZDRzS=z8$=x+ z*B3-+jyu+AWsZC3Am7x7sjh3Oz&GQZL-)czKiZXb0XvzgjGJ_l(u=81_N#3ua1QH@ zj*i^Nsg0tkO?8sD!+>b?*#f+;A8U^Ryy*KaTVXk2=C#$Jq8E2CDchBHj~5gvF#V(m zK<=`uGmW_Vd*Mp^8<8yy6e#8WriHD?g`ZR*F#q5C)iceMcmMTpF9rB8(WBtie4@^Q zN!B!mRl0?q@&1xeLg&4`{^Qft&D(bG9XUmMH1B?%`w)yQNY`yXop;Wy*!u4sY?*8q zI_l~%8#--Pp~$SZl=`PV*V&>H&2<&9SiwcwCAz;k)}RPaS0a@C-ja ze?RbGWnDlIOuG0*p?vV(t;XxA2Nkqcxh{}*GSyDF`Fpg(o&xsRcl5lO?9PWZwcdCj zvgzu^tkC#@&zmaJx6{_;DfM7dmS0_$vN+&&ovo@*C)$>w2=&$YK|a&`?Jez*k>vsX z-v|XtOQX8i(GlP(-vN*od!rqWN9aR8Kc2Ea+yJR<>10M7Ky$mw=j~)%X5%Ip!6+#@ zogY)9$?bse$v%l3A%;BvEI;s3eUkj*)AB;J70LF| zJHe#uz1`uG{pb3!@5Q_2 zpQk%RyxnJOEsLlo+k2%r1e$$(`WDifx1`a$q2QiUsNfXd+AGgVA}sbjmHJ;_df2uR zn$BML-u2E)0|heN_BxgmEgzr+DYITCc6CrTE9ffgI*qgGV{J^gOhxkpt$0|ithUq7b72LcK`d=VCgd!d6zwJipvOs#A^m5 zEnNVI&r8~7C%=mW&fiVhEnaT&!otwo@8+-bR9U=OMRfTNS1#zuM%e#tOd#S{ft3~M z0*WACQ)T`okMD(d0(P2JZRf3B?{`%In*4g07rlRQAPv6+lav*7bj22MaB#5_>rz3T zcN$K#PU`p9Y4allNoKM;3Kq$<(u@~36ISLSctkp{IcRhQda z_?WO5`q5p10VEJUeMIsP&blDjx8vfOJcfO;w<;F~uiZ_>KiA!K4H^tgF`&1XhdExaO zX$VTm%F?0Us7}yM(CuP87!S|=GbcX)y17C4PYW=`1R;DX;=TARa%~th#RN*&C|}jY z;U)4sZ;;;t0&w%4oZBDbx_GAB4h$Gj^Uv9Uq*diq3UF#hT7OcIFRAZS&=cmXs)}ZU z6mEn**yn4VM&>$@`HtYxN&~Y1A5WKm;E@2|fg9j7Z>K!ZBlc98(x*e~P zx8#9KQWHbkc=eya5Lb1{O^@p3kHF;qz!CeHB}2(veOV*=n|8ft87l0X^O_a)^Z_^A zZ=mE)4Kg4=RRs@JaN#>|L+}-N04KI+5D^8KtpAoy8;obG*ZWo5k7KnifN!C_d{jwS0>h-o8FTcOPzW|8o+N`%uT`@4#_cR+h%yjX(aH9gw&qs#7q#$*PD#{77 zd_07@Fbxn~H*cy2bzH({%w#F)2xFH;Oh>{tVmhheM#Cdb74nX;IFDS9qX`$>i?&bu zW*aX%VQf8N;VQpXHN7|A-^!@%oEBoj$;D#6B9H4fg9c8dBGgbj&+pe?Y^UZ;?&DL9 z4I8Kp4Xm$DgXW@{dHA%*X&6pn2g@MCy7+N?^700kVxMy=TJQOr4ti=;FSK8I$>XfE zFWY{C@4*uDKfR})@;^I}b5ejD9GVotx)aIvNO@)(02-)Mw4X$!6oi5cib!d(7B z8pBF>k}8t6vA^t8{FkQtcgE)e&u2RQ;|nq(qIS|@YAQ~N%5UwL=Z%L>s#poms5Va| zHo)MZL&NOxJ?O>{Rscnz{d=eLJ(&$I$aKTwBp~S5+DUvE$3~jp(~-}|qRYWvQzcWd z6P^kO<>bfM?kz89T&_#t%IuxhA@vnKT)K)$N5XDadNFC^Ixo$1<8h}yqz=R^F!A;@ zwFX4^n|L2@A9up+=4RON>_fW8-1^-@_@kh(%U#6o(-+%zmJS;T2Z{qCM$gN^{*W8y z7jI);n%u|1@U(D#*pH(=x0C~_-V6WNg%e6SzPH9y9;NAD)ak=6z4&MK?#v(3Mh5P*c z{N4S%?t*giNMc zJ;`LS9^6K|;r{fLw@pgE+3qofLav}`v-UnhSCxM35d~(82sT6m5$2`SVu5f%_Cz zMcGoPG?kvq>cRw3rrTa>9uruc_s4nGcU@q}htJ5KZ1BuJ3<05Pzp^6n3kYKq2wzXv zbO9eP4N&SH@uSTxuUemc+U;@@=z&3GXJFuL@ZL*>#oto>k8KV6u(3T;9$`aVEiKdU zd-vO@pj$AaM3ayCCBh0grxNnxXF-5Qg0oIt_~Tx|v1xs#-}T!&8lHo=MuI&E-FR<| zpRC~gxfNnucbepRU0h9(1zWc>#nZcnU9afH{jE-Ry4(*I<>yo;5{JEC5r)p~6Vzai zC*Pt!+TRqs<`rW$p6iCrT*9*M{`V4VU)=$?Eof;;1T^CBs(jAuIBPpc6Qlpl$R`UG zT6bwWz{H%MnfVT=zdGRj4)>HzIncdNr;*A$V!FQD2P{tz5D@C>>WDlqd#sz*?^VkH zb@2a`>&=9w4R>kU#LD;E*Qt-!ss9%SmNYPXK1z=)u)LL(@_+gn@cTM)oAy9p^ZmX_ z;O%zyX#VkbR=(@)%vNtbSFDpfd~Yy>5ZwjOn~VgYzwUYtEjAJ9E^95p(7DugcEY_r zl`2uY){iW0>D_gwfisOkge{d>tes-6Jw1(ffPYs^>~CMN=-BvyfQA2$W}EMk*cju| z%b4K~S3|Q;JhPi<(&&9YV+Tk(n#-WUK?~C^DGTkJ^I?A!=LMX*XYPx{FHcNSsvT|v z>vKM2@F!K3&=HDXo*FI@2pe!uUb8N&y4$t)=E~~pRcI5v&Da4T_<+*{fPi!sK~@b&}Udh!~Np*OLP-1#^}n88G|sa(BfzUIEM_lqK&iPWd_t8V z9a@VGr-BagK=e05{0U&E`AE3-R>Uf#{{?901K>kYz8{sfDgUM~$-%Mx!$hSaJg!=I z8$Uxx0`kq%)rwTC0uaC7t>R2fF<2Mu3+n5!^F+SMYM-Mu*}jzD`~(Ra@_R_-PT=Vz zs27_-(MtTEP%7+FWT5rnUSX+L0Xx$}RE(s9bPG2<9Qn-o@t$VUD6n0Ss@s*GZ#u(lYRXQm{X79Qv#`N$Qq~4Iff10}_ra~d+;aVSJ^_uK zXz+ViVIV|j!T7DT;@obOnXWPPSMg+MF7GBJx)p-3DT#JDPu(i-MnI8P# zm7xF7$Gk^3kK@n*f785v?ffrBwm(#F5*j4c(G*#@rzg40IY>63OW`CIMXWu25(KZj zckm>*Wnt34_El|djm`Lb%*-To2wC^Yi0$8{UQ&`iacuNYmA zF}*P5?2Ni4#Q0s$;uv7f-Dp$ff@1G+rJ^vL@auG$xdwU3$WqSLqnJI0ytR zKFHR;GJUy6!rKK<+Fd&fIcL>MP5aVUiKcagJFh-yE~0u4PVE&xh*3;`nzmZbD2m@y z&nt5yRk6hIzIR+}=_O`My>{MO@qHCXwu;%kd~^yz#IG2!mh3nk^Q>(-|4u(YvxnoC zpQ!%$9zIQf0h z$Lx;Q(c=T(Kx@?_4O{+ceJcs;dJ^T5l35Ea_tL0;WcN1!?4I9+zlm9!RQ!JcY#Tnu zWZp>2$;YOYRSt4-aU7MGI1GgP%7E~lwd%}T;`YRO%4R=hOGkY3T*^ofEwea8-2aj2 z_VPz&`A-6F6eR-Ng5{(!VEjl7k`xtESw{J)vPa*sC1EjXC7C>)6;~HbzF%6>*n<2O z8wdf3^LP^#rcrT%xqye{5IXg+P0ZS7B_r$71-uFaU;|%z3WZVj#YD*P9NI|M1rp+< zqD;!Vm~3Y9_;_+oj@o1oN+d`em2C}9tp$DpHCC(V_%Dv1$% zJ$K3H|8LMOe5L2Mgo~_d0LM3pdXJeya;vgZNseai7ZGl$vg0_k5H5O-Q#KlEQ0t%k zoJVT;@AY=A=5-smMi#61VJ#M=R@>uacFi2V$2`c`7&yyO|3lUm8XpO3t~x(E`V8sL z*PbR+`vsH?CbZP{M&G-K8mKM*d26A>L>-2yaGD$e@REC4OH_!Mlug|xDFC=iV!Ww6XZP4x?8E;mQ`Wgr#b zpZr0^oJL~f&%9{*I1vSL-x6w_vyuYA>CvnZ{0Y$l`;{X62D#gq8k;wgv~|iYI9;m; zT{XtC{sZC0LG>s$HN?+5)gNT>QL(M1SMKayZW$09G z&?gTZZkSv#c{Un1i|Ajf0FVh_dg~%#pwOf43k5<)h$4&h6LJNRr{Ui)-@ZX>9V$G; zs(8nisFn(|G&MLV&GK{duIVu$Eu9Gw`ikl}6Me-e#OGfwl&WUacw*u79*76R%u@Q zQa*JaZoUE&BJYgtD=*Mv`hQ1q@iS8dJ@*u&$Mr`lE8~mgALjk1w!_f}v-5ICBGXQn zuoZ2U6^`#`$^Ml-ahGAKQHBzj!adlMaPf?kGFYMU;+LXNLYUuG?^Gj;;t^=9ADZ zg>h2T@;5khJ9e9q;6!qW=s!qrotwFn=yZMyxVes+574w?tJ6n}1Y)_2X?SUE!Q#R0 zLg{sK-;~YEV*+9;lm7QzWu!7gQ^n^d#Mpr&M04r2ypqAOM9dV;12}Q z_3zKLWWbZkYRH+7?~K+njkB-uDQk?7Q~_dE$KoSpZ7$Q9H7rOyUugsk{#2MIsHZ$0 z0<@*xJ;l-r|I9j$&^_eF_@nA8ZY2BnMQRjK%0OsRZi0XbY+Z_Wu$cp0=-e4ZhzfMYTgZSdK~Oo~6FXi%<$yLZndBxwJ!x%6rGa$31z%cYr=yyZS* zD8mV;uaiX-8Vx-`bO9lb9ew{;d=KpwzhCiW7%6LCE&*R(-&9jc?s^o6$~C!KgH@;= zf148;)#Bd(2Z^^@p9j(`XBkE}@cdHt!cz5cv}^Xs@}%wjgVh>{s{HQ^81Wye`vf=` zM2=!QD-oBNCP(Fb=l1UjX<_=Eh$8zS)okKpTy2b zS-y)Nv{E73B3qP=3L=K|HKGrpaWa|`3}NI68boWVh-Y`K$N9eUsH|kuSZprJ63hq9 z4FJjC@3A;OZ()pdv9=N%-+uZfxQ+%sF8eb@3BYpQEijj%sKtTLRn5{;;x9L zu`@o)LK;FgUlD(2+(Y>i=Q6B>3f=y5Bd#^+uepHMbM9i0n%tFw$Jqv<7byjN&nzLqwVs-32aA4denjLXc)I3 zbB!oz^s7`H-PR&o*T<)%+8Vi`y$o6s4yRkk6dXv2oLL3V7E~-JBAmtg1ylZY?J!9= zJZy+F-2iZ~0_KK>6y@k}ax1purnL{(n3B!pQ_Mgq$b|z$))!nh3+bgT?2O@ zjEDp8$Ns%)K}Q4L4H!sSUG%LsoqFzK)P5=2)RgH|ZM=#7G`v=xC$!Whq0uIf^OL{Y zWb7>(X76s|$d8HR)WJu)W)sy|!wg&@cg;irsBg-BA!5Xj20620>yu;irfHHQz`7M- z2qt4Pg%Y#;37nFuG&#T+dh8pQ@O5NE10r5ZcdrXvYEbDkOZgDqK3o)3)YDE0xWlTj zZnQBDnLBAIfIz7$$edh8yMMK&a`E=OG1oU3yK2PFS2qY7&DMADo4fRj&71ro03%75r)s;{YIIWB>lRCtXzh2SI15>MCfaWm|p z^f#vx4`KfwgneaH9oyDr;Shobw-7wIyMzP}5+u00ySuw2IKe^)?he77gS)%CyLRQ> zcfTIpWAy0y!GSuP+O>VjTx%*}C9MTHi%9ib9B}nx_?Au|TEFTE%{mPbL+=hrlhud^ z(NMzGK;RYkC+wjoDcBUr#e`%mYUZ!s)qe}yr}HFaP_NLeXKSYpZI|rU^#w_7K8kxP zd98@iUN~WbC}6eeS7;;x>pk0yaYTLnlGM1|Bwtn4CmdiMjh_5ABQ(Pkz1n{)+o6KV zE&)9+=ZAVQ@4XA0V-6!0I`DtuftA{~MI#F+@BYO8YMCOkMC_61u3QSBQ?b(b7;Z&{$}c~I_o!V6Rm6o|!!V&l(pj2Kq>V#x0o7Dyex-M^Q-*a2w5({@AEe^KPp%&P@_%3>0;(}f97e}`Tr7wPsfEpMPFY5w zw){}=P{7+A#GGv3Sb6Rj5&qb5#HxbH@Y6Ax5oY^WwrL0;j&98$ITq&>)A|32#=UD? zpd7a%CLXMyYWzI2@+%i;KZl%Jf?B(XV*JlmZCUEpG_>!M8O4H0(P|l-0@DUiL>GL; z*Va>z-g~jZJ)!9B{3P)_Zn4VE{U{tF?-$s*WVf}@0Wh@o!Qm}&EU8pR5$&&n*z;*W z!L<~*zMWkE9_`PXVdWGz$+(bSLHW0zX>Z;nZa$`kxWM#m6o$WH^jNN7olK zTJG&jjLhw*-va$s^Pw!J?-$=b-?gIS5DSkLSOrBnb}mX z0lYYjaIvKIyHBCe60JC_^JW(c3|{_gO&@W?v)j?-@h90y#VnK?hzy7d;zN+xZIFr2 zqmoiygMnC~V$4t=M*jB^sPg%Blz-Y2#M~q>6J(CA=B0#-|5*2FZ9je0FU;rx7Z8V$pPy8hBnN7` z>2KVqUD^6kJdgv#9TuP&7HtqcxEt9Zfu}@b3a@<89zMkn|CVN~Fkw&gT_T~kInY=X zW58nemrt*{(UZ^OM#GXpTF%*o9qbqlWvRJI1wbU0*2Ewq5A>=(kCk6JG>QD?;Iup@ zPX`N0?Dy_oX7G^t$WBJjs9XO=Y|)m6j4T$4lFo#daKSNcU~LEZ)|9s1`;kTZR-#R) z;SzdeHjFd^jK6dJRjo`e-cM}4yl@bs2M}GkGG_mTnaw>L8=?o&HgTfVX7j! zL6|S>GL$=3NQ9_)oM-QHB)ijjyNjg3!GOI;27q?Wu9KLd@1FSZ`qI2u`&S|?=+=`* zYY8|gQF!U_K{0o~l2=t%mFU0TIoe57$V9jJMaazB;BNFz5<&ST(={~p)ni06Dg@zbC8C+fO7RuaFa!k;h8ABh;~86p#= zzlZ;VgXaj)S}j_4m(c1{(%r`B#q`=%-pO5$;-E(Id_g1?ibY4aI7%B4DoKj-y5ZS5 z_8Jisx^C_md-sD>(a0?h31&u7(ata2*=-zA*N~%GdEB8f%J-nSubenx=EBH79-%Q}k zzoJ4=`rAWr>P8nRtt#kUm-VnLgv@ds0YOzlzY*8FFxaborW9t* zn(2d-3Jzhc4rAvgN<`BXb{Ym17!J4u0X%f#4-P6n;4`bPvl0nso@qWbATq{JIobo7 zWi8deA)A`A@9VKLGG9)=#iZhp7|a8Ga`>pYg3TZ4KJ~n=`Z9X3rs<{T#S|j5Q)DhZ z%to{9&p;0!>1W`$j*>n4;z-i=@OUv2!!z<3q_2RD^F9wrC>_1gZ)?7SQxkPh z+$dGT!TMWceVwGuFKmU)^XRftAy&sDN4Re$)yL>YOMt22rFzlU629FI_gSu5UBE!1dd!^Qz4NMnkV-nb6%ddW|>T9g*B2m zls~%~xY(Yd56+$GUpX{y`8tIQksXjF9LD(ix{0-xMUUsbd-1>1Ex439m$ej9@21NW zW_p-Qh3|W?=qgV1%5dv`f6MVK3XI!QE~&|%cxHl(8&k=^SQfj7@X9c>?gX3{_3eAp zw%{LHq6xzmNzaP`oA&dfFVJ5U;H<{EoWOp`D`-iI9iTZ}uRu`2)w)NSY35r_0f1Rv zp^}qL<{3pDJE$PKCv@MOf~KEM32>{tMYJBfws0tIHOKw5A=OJK(P^m;XKnSKg}vq- zyG6sP%$(_E#jJ2N*zp584d#h@NR~0)D%zAZA<=r#Rd7iHtoGb%uy7@>d+#gnNl{- zW4^YV7g5K28_I)xf5) z3L3|+AB^#ro*iAHjZyPG*xyqKwZ6pvEklYlW_SRNemR|l?X>6bERNQ?`FnrywU?A| z!TD$-Mv57f+QNz_N>{k3!q^uiKaqB?v~%?&QBofPmmU3AzV>4}IA%`KUygC|R%CBn#IML~}M~2aycnW>;wR`e)47_AL{l=&in$j~_T+Msr8YGIj zT1a?ZJ9ai&ldZ~kxL7;@05*J)e1praK_NkTd*=oVtHi6Mjp`e{)WFvmp7Nu8wOIHZ zBl>>YyCDlvvb$eDD+feW@ImaKO|PY6GI0xn>k6M?yU6j?80arcwo>6_6k2;sFqL0Bdpu*{k2f>;ZT9(l zCadP-4&&DC8W(njTOKEq4LCrg3QZZQCuH)W9=oC`e{%hsxL#hz+8X)Jx&;pe0W&hZ z@{u9_tj_ysHE$rlSezVtB(W&b4oTct>)sM(!a91<23T+Wuo#kqpM6ph*!VC$&> z1zc?D3Rc^pckZ-~7vDakOLREh;R_?q=2ps~7}IE6&97>6Lk=DUl{|Jn7VIuA4mSz3 zx>@ldcD>tQTr_k-#(=Z*wM7o7QF6{;FaN#MgQjfFS5$3i7COQt8s29yf!$SDIbr5W2VPyTR|EjG! z0$}H3bHA`pR8fVEJ*|FR`~v%P(5H^AY;_24K-YvZ7np2F^>}r@99iM}0kd==g*aUE z#>SUXsB_b^E93{1@Q;XI!M3UHGw)6rFD>pk#}8yeYAW&_7UWHg#ObL^89Sb612{&T z2akaJ!Ode3%cn7$;6w(ag15xufA$5FhkSXL-U1)Pw?^PIozyW~E zvDEx6F1^n0r3MdMsNo!j`rYp#onhZ&R%Ny1mxH%FETQLqRi~$t(*U7;gI~9?iq%`h zDbUc+k*FHnTzcBt+BUs~NzpSfgSm*bL6B%Su8!yUKL1qtl||e>2g!9d1_@v8kN9}x zf?gM<>w86B0BHXDzKAvw?S;YHYvudUvSsrfE^rfH%JB1|wXSRq9TB!8CUW`wcTMo% zpLFf?;HUkfvM&8I_A++?FuCh;v&V9L8k@;5h}g-!IfjMyV~$GRuL_qw*~|_4b=_a6 zU7#+!UYds{bd)txBc~qrmMrb@T7y-Qqu1egSn>XY1E@GD+6l{anaWs_Abf%aOuCLnDDc=(^ zNhrF+=Kc8l4k4N9^|WHZ!ekPX}fM1(nP!_M&;5B=EMTA!Wp1zDCq z_1?#8cLz=Qf59Q4OgmW`G9L1HZ=N+0L;s3n&jnjadsm;{U$ooFKrX!ezWDbqI^m$2 z#-%(uj;}e7+iN(#zjaJBlEb&UswsX`@%F0-+bpvl_HkL<`9?MFXT`uoTV%tfZb_=# zl<~cBE)KSh>Zvqs+&Ej5R3rX-X3_P(-HT2<|)+o@s0Q;N$ah z`^M-^unBD4>0aBnwg&AUHwT!H&_37X1G)ZP!u^+vgSPFr*xJXB8B&Qj(w++HSe4n= zmwOX=a+%Mb%*W7+iWw@)gw2iDmlc+CIa+R4$Kyc5l%GMlX6nmYg@Mm}p6I=Q6M-D2 z^pzW>3RXj}?9B1&llMafhjwK!GwQJ_0W}Ebaz625dl%uuLLI%DNZ zZqCx>criuD=b0T+<>SzBKWn63@D&cxCcPxThDq-0&`!XTs>g?u3uCEjw*GQ$o9Ewm zHgzQ(ZteXEpJ7A*0A~Z&{b}pK3pHcp0(m1*bTAVR&~0_f{WX0*&QwgCUdN#P?Y*Kh zA+@;k9mt`jNhZH>AT`_-f&dJGY9#!!Y+5Wmj13sp(8X2w91Fp6QmCu8s z0dudaa#|HiBcE^7z-8MwGU>JKw(yESi~H}tuNw38dmmVKBW0rx8fWn*w=CH$-8Zqi zZTUCoHmE;A<}_}IQTHk@*HA*PebTsp?mX$Ybh{2LB3xu+ZhSHo^nH3;gY7hP!bh~8 z&w<88G=Jip>9kLZ^+IOeVDDFz{~5{J(ITI_eK^ykb;+dWe49y|WQYD?Rr#PGIAZ33 zsA;Z+sk^(C%)^uVZWpnJz}Dl9KMTGS+vU=~bKaU<@nIzJB)M1gXmv171l?;F za0>a0eXwwXx=Ogus0M_Rct-_%T3{p2r=YO>cU^uBRLNF5L{KN0`~DqMaA;3|r?~FD z=i_T^ZS|?NM}UX7UT$)`*p}IeRRJfX(97M3__Cp?5mP3&vsu=3*F%y#ULAaMUiM-``7dSt%Z`u$U# zVxBt*;Jf7d><|!RucfT4ELKT78?w_->!>7kUUnFK&_XxUJ<{rQ7Yql8AY;zF2yz%N z&t}e_toVm^eLa{dj`wnSMmAZxeQEK0I+^Kyh^F>06OQunV(t>k=ie&;y3_j1ie^q^WuXD!)UbUd0?@Vo5GuFwbwjIs+d~mcMP3YzE+qRyBSWw*Z;i8s0YFAy8$=a)vDQvVQSt=b>%qF39c-BcOqm zBv@U6X10kLi4EKREmrhMUuCt}*IEo?HJK*AwV)$ARqXz*7=62po`k;OZ7wZ07?e#y03~a}n zwuOo_6&c(N&{6KR>9dxkr%jO&)7%X66R`#S0{YW0w)?sA~#5H?jeR^blEg zO>gZ7%prtTC|?6p4hRd`qOGbLoiAdWb{nqR!9PWV6D_F6&b0((GN^R>E@)75VgAFx|4wue%| z$ry>xwrPI{;^}3m=-fOhpLb_#*UtPP+Gm&dBUX zXeHuO=WDI#gxS~{ki~d(LpJo>=#I8I)HNy7KJ>do4pb?+IT0G`bk3Y@ZM~;`hzSmV z5?9YV3dQWfTY!H-27LXWtBxJ0^U#_YaRRZX1tS}0FL)%8c<$FytB&q-ueB35W;1fn zE9q$X=h2`@g^builfo24uePQzIH9OBBs;GHQ*$3^b4s+PVW#gNQTZ&c>BJ!XN8-q& zu)rL&LaBY7`Xo;Gw7BOBt&J9f{Pw_ug_FZ;u`8(bH5m`*-vbjIfDFzi^%T`+_bWdb z1gaV>+nz}L5y1y~KsRz{IGvA~nG`cj>C5W8Dd|9Gym zSs0Z2T!>Cp3=}V|*|rtH_>5lcFicW4JakPg(TNxSu+bn!MOfs%3}LzzL{@%w-g|6l zKkK*IzeI4J;b9|UOzS^KlH29Gan~|)czetLBK7!@0JyD8z75K|{OU2nr(1ghMlHkK zs-&K*;Hn=f4?I0M7cJ@SHLjSP)til5NOQbzeebZ%y!hvlh;o$+H*KEdvr(%mo3w19bRNSh=#+m00$#5#yhz19e5Yb^B0j;^)aN2X=TTYN= z12v@6yykx^ZU3Ifpg5(X6V|;RCO!hj!dzT zM~r?e%w%HQlRPE!I8bGdw0hhyLgGPTA~}V{06wM{1|W&yVrKsEk?EhUH&F5&)~lcn zB*9l()?6#6?H)UNbeQfKh(g9`Su=wvY~npy|5FzB1gs13-H6d*xA8FfO{dw2#I7jm zW1pS+L$Yc_;J^L8{P!^O2<1<*bMxX}zz5qL=<}{;lZV0#?Z1a>lOEVRZ?=tZSl#&E z0>_IDY$#F~|8^cMbUTVCkPP;4oN~Z_#Z~abd+^%{!JGdn)L{_vKNbF!XJ_AK;r>Tq z`A@I$JLmFTR;rg6SKTdyF{chG7dg4x$bd_jHxgyRk)VdErXE@DJjwEcvqY>!xj=z1 zx%bz648n$Ry0Lh#Az?DuUq9Qly49DoJ0~n4mIi-#tAaen%|UhO2RITfAb)q}<0iG> zo3l9Zv+<-QHBhs$U@r!Nz9n!t-G3_lQCQOMFD~zE0Z}rkwH+K& zvRa$ef1`pqTicw%TO*aDP{3ZmC+lnn0D};vDH>M7Imtx?!fT7Eg?X{v(8gCa^N^5Y z>n;~;3;3&X*_GMo1KxTDts;r`K{|Svm@Q%0Vsh(K$Q1!2+uF=c)X!v3-!B?zF@mN?4@97C%Z$~&o@tj=Zg+q$m8&XHOq4-zG7e$Qam zm&Wm>$x7u&GFh^te(lV`Xt?BOjOr68eS)8HvKKED1K)JAp!?WrIUN;9HlvrG0vqnM z9}Q0q4=g4M4EN@br}A)l!w||HOUx92edOFh{f&qB+$vGvQk$Tx)6ilqcdnQ1&zQKY zToMy;ZiQ`m%-8wL4!tR=Gm;c*a2oEPoQNY1r6C4>0axth@;yYa^=T!fDGE6cZmo)` z6_Yl7wbS~O(N0hk=Goz4Z}Heoqu+h}Da@U;=e~m!^YJz)jn1SmKcQeGl$9n?t?JmX;n%Xs=d>62^ubey6Lol!=f0)6aQA z&riLqs^;Q3!g{gx2t%UnjsriiGOz8tDPbf@X1>^9(3cOp-Ztx`!PP>4T6hip!jKTa zpo8;SP8k6Zd7nsO0|~>HtH3G!X)v(=_ln+uLl&tJ?LGMW#|qjfKvTnRd%3hN3cL3p zTE#Ldj=avlA_aq9O-0FVQ{pah)dIo(hR3NbIN%N;>T`JX4DlS91>G_W9&3Fu9N_DE zdhO)IF^rGyE@_{fbHB+hdIj5oE`fuM`~FVv&co7}!cOB_iG)YtkM^{Dn#ZVbdkIFv z75_$LA2B%i3kt~|qnM2~k9}w4MydKnB&mHlsM4L$&BWm);``C9Z=J1tj`d)GS9H9J zDk>^2O*G0Bh{F#1DmbDIXM~7hoyx@vEyF8~&Tmj8i}@6>f*1FgA?o!O*Jq@6xrJFb zduOpm`tqmYA2y4FBa))~gsi=UyZJoWnn0wtDI<#~cpKk-QGJm~%f7Il#4_qMmn2nME&y-}dn%BR)=Lh95D$(rM{G@Z>-EK=H^B<`O3 z5yo}28ojQhwJm>Q@+|Ie*xqiBFC$+qLWY4n`UP%`RC?pR*jZ0#A2K0o?!owtJJA7I zSY#!h>L7ueKW=>pylOndar#l!TG>J za|&WqevhH~S}+DJ5(#Z@2A?Zxx0M$0`z&-yr06JQXTmJS_9Cv5P$dadb)36t!WNuQ zN%%l{#TikNgsjq+&}eDzfR^dep8BGogJ~$NG@^)MViGp5?lkGIc_&Ma3|e_#EyizL z_^qkCQ1C0IvKPks000c4Qi`H#{!yX1m^)_5K5zA@6ur)BV)r^@F%{fFr}o=9@P?VI zV}A|_&ayQ1+c9hGXljodA6w}K7v_GRDO8%b@<3LcqP^-a16>wqFxM$LJ2DP zBz1Vw0r>L0aw3qq=3%=~%N5HW+YO%nUcR=;nGSBR2hM5w%p}ypsXT_4^#&ngE~5oJ zGqDA-Ho8!4uB?hhV@Hj~2g5Vw>;zWV21{8(oHi5Y)qK2`T&Tandoq96;-SD@w@5xl z-C^qo+tj=x_)y5AMp}V7c$4nua)0sjC2@w`$;U3G%U*se`x0{QkZi2b!@Hruf<;=8 z--(Ja>7@!!>gjBDevTUm=yKF#3OoqS4B{Do{+P)4a^>(5@NH@3;$(MPX>a?a|B^$e zBs-)zIXixmIP{vj( zY0V;g%EO2I{_uL8aZli31|v-y+ z6zx?RNQs-n$E`TgHIvF{daoAT6+3l+)sj8gHi#0;V!$tNxGM(DNhCc|+@c3_HlPu% zJRmN2m~Of0&lMa+ByYghiATv919~N~HXMwHZ*$a0JBYcs=Qtv`zeEBqM$bF!#?5FWtn5S9H%nV1-WkP-y3*AaF?h}htNy*)V8 zFmL=ic6D|tby}R4IO8zNP;GuqjLN<{UyUO5ELh)TjtXhwTgIQ4#c)Cl-NI*e3dv$sCTUq5vS#((=o=`Rpg-M179A$LX$z-u9xXn!H;S zkzP;VyH)k@Dm3-ji0HB}tF`MxeBmHXgt!90c@`Vxao%BwHKCBKtxBY+h6M+Z%F;8i znj930QYKL5apH0jtf(`lfLeMeubtLd}jMB+_TphZEWm`)DocLa6^dG;?qQiSBGVcb*!X> z)BVTo-jMEEsYI7>+$jq3)kAE)(Bou>fstZV{zOI8&T4M{37L*oj9*I;>fl-Uc6JSCgtYE#mbSOKB8ef^#9Enrq`Wu&h?b zQXNFnGii;+7aWgaPvZg$rygZLIY)-ALyd2f7sME)|LJ#!U&ZL{(sNEYEHzs$7 zZ7j=Z8=m*9?0E}3oZMHz(*c)HHCe}Hk1wtdE`&Zwk8e+nI(x4rYA-W|2fNy(1>d>o~z34zjoqCJHlqtYPQ>$ zuQ!pA$(vV0!(7zsHAYnX9$P6!sBdN$UcO>#Zrc2^p4z%_+gL}wT83iM`useRuiLrS z9Ngzru~Ga=120%llN+^0EUDSW)aB+=)rv>uXNntaW@7ql(lv|(uid=p+Br{zr+5qE zK{0Y1gz%K@rw2lO^>?)_OWR>5r=6f&l^Zs4+lN!*9mb{o4K+GE{vAbFB+7*@?UHwh0`8( z^x#28A-AlkrlwskHQfxRw&39rT56)}EHH)aI9Y$7PSl_ci=b$KY3t z$N!grNB^~DST)C{$y*}z!z^5?5SGj+tx2rDB!+mvmz((;rwdwxI7LL{t6Yqn(C|xs zrgd!;TugMp7zLgjAv6)egIpCWkqFE(?n}W+P#--q|7GzHH^}M`Ldp2Xg!UMCzNzznElVQ?Pupcp1rts_-i7Ne0`zZUuc5Ylbm0&V_cxF7^ z9(A&wY$1jNLn-g7xv4v^KKpJ3JBfd@F*y-O`C3_@8SaBPRqwb~)RLmAkHgMWix5(1 zq9jci6T^3iX+>m5B;2BN+C!bM3+I6(=!%$7ZOROrPo@{2FcR6Y+u))nGHID5)7H{f zQE3pJuARAvCQS0@d5xvtNI)o8Q$hNX^RWAZx!=asKbnEh!PtwamDu^&1KjQ^l9Wb?S)BXCC^Kms|lZj3w_Zal;=&`KqRY9+a?}J1*mFRL58RTgKHk{}G zxOR94GxYJ7Enjdm*I*EL?naz18<@-+?h@Q;$v!edqu;kYR?6wP*sN?)a3c#ntUHha zr)MuYaymCdg5@iBE2+w6T}(S?esXkV83BYkOV7`!tvoCl^ey?eZlN=ud)L|zn;nSa zI&w1YOJKGwebG5HEG#WKb)ldK-Po4y1A@anTen>ygrlCP>y9K^ooR62PF8sdFe5Nb zYIO(k8Ax%^j>XYGwfwk($@2mv9=iV)%7KC zvb(}#zo<6&oh8hsKJp^X>~_cD2*tsQ&Iu20MCt>CEZcvJHH@CydLxlCKRb(1PBcWk zIH>JNs0SHG*O}EJe%6+`akl=qu0_1VX@m%t?rT4d!u8KKUr~BkZI1XD z3*Q8{`5OpZ{b+!fI?PVfKnlGuHV}!=VE6G^# z{H(01jB$`oWlJ^O!5R*NQzb_{l?X`=J^(1kEo$7I#a`aD&N5Xe1KZAm!=WN{eKh`N zZ7R64r>7@BKOeNUA2#e{Tqqoa&JGc>G4Lmt-%7}!=QT;p%|zyN{D@EdQ&cn`7tzS+ zpw`T+PO$80@oAvGiE5`fSyrc|(`<<`U9v{u^DX6D;Ly1!;N*q59)0)>KdH)}`aeFn z1>%2va1|TgGhzJ}p0+sf1xrw*mr>CXrsih6o@XS3XAxhzgCx^Y^f{D#T*ILNS1R+G z>!g71l+ddeu5Dm29u%0#8||t4%{hF47zuaVT4{3Ux^Gqw)Y{>k?n%|WfW+>@!CJpD z8_-sD)~a#0xO#NgF&98~D}m@-HHA7Y*k~JVT0Rsg_^}tIXv1T6xv4GP=rN8xVdB@Sqp3K4NFs1D$~sUtZ%j;uDF!TTMn)rigQM|KwoR zoqD5&d4mvRE#O+04cSMUX`W#8OlBkE3Q9kWp(|c=CTauV)ao)9^ju zO-|8TMAx`Wv}6^+l{EEx39qbVnP)@cyLJ}E`HJ(Nrj0mgzQb&4&SJN3YJpq@#`p*F zM8u5?y{FLN)kXkK3Zf37y(vy23=%*pbv~Ny7gPaoaH?U{@~2lMFGPDp+G-(GAvY$0 zfI>X=xik{;UmN|yT~W`CpIiMXo-x}yb1E^o?BBIhg4VYl6nHk+&pth*2QAHJcc+P5ndJduJiL03o8xAW z8{?4-tGb1gmDZQOmGh6!g$Z;U-ri-RD7(G_ds%0J3b7X;~1{MLFv%QE$$j}9~1Om7QZ_a;s5In_@-WfW(V-@Jx=E(L&7W z;VWE)mXUjD$7n-`gk_N3-k=fDsMl59nrxpPpi1>=+j{5gpkoSLY+D$oi4Y|sdPfXv zYh>4R^_~7qrxP0%9=NR#3HIu?1qXL(O%8lE1Y*l2!p?S0w1{*K44jg1^D(*jlFx|EkULh+l0=AMPjMPJ;jk4=qRt^z=+6*%Fu z0beV=InFIM^g)PaiFGd)7o%NpVj?3B%uf~wK02lFVT}d(Z>bJ4${s~rH9!~iYs?0h zjrU|v5fcFm_VwQrdf^oS2_hO}zCYmCjGUT;W|b1sP!nrfE$QNi+`tDi7FIqFoAdfT zZZy{&p{3_rL+fLnyF`D(yH9lIx*{6_G2-L|Iy|`EpD^+1SV*3V17LLd1o?U)II`vK z&S|KzecbpLb7P!14q8*KDa+W_%>@o`~q5^ z4##sYZb>iE+_rtxpBG4@5+6=WytqnJj9(t%>QX2)*EW=)b-2ZM>y7teR(z`N(a9f2va=x$r;{MRUY^S4g!10aN#3}vO zfR4#LXuT*-hnq~L>CtIvt_4?xB3R&F($RMeJ^&s1_pG{uanXfbaPyx*LXE=k;2n&) zM61*rVf(!=v9D{hD`21lp1Rwri3LafI$jwf0)`czcLxKewAvxD$NM9yFPrklLQ?*p ziG!Jh*dIbvdL_S!^gvL(ovW=N_aAca^Zm3d5&)-z(L;3h#KQk6*#|wu2VV=%kc|etZXK4RmIhL4GkG6x=^M=2l`^`O1ZX8 zsFlc9f<9xBF-24Bu^C)b4F%KXv^{Q(5r;%DZ~_%Rhl#(|$PES?;=~}8CFgcR?KnMy z(yr2)hfMH(+^W!k-zyA9I4LkhySwMt)kFA24ZJ9gPS)Dko`BPq8-($cQW;<3i?s_!wkHZK~z!%2s z3_;|xRADVGI&nf(&EMB=eM7-iMtf>I4(JqF*Xva*^~v52y0r`KxPnHUHqh-xY@0g{ zkqJe3i4yN$hmSLiw356?3PE;R26LJ9-E3{%Ak@vcj_P^p*fOLb-7SGa8{2ylimzGGa1`olcH+Yc3TBwcoc{~g>Pwf+O9=Kjp5@s~_i;8+c#YwdSNKqq~6qtF*Ut^~c zAI#nv^d#htx2o+lt&pdXm-m8Fa*=$=*8tdFYz5Iu2AmwEM30=4UTYqOYTyuN&Z zvw80$)E{N7w3!H!QnMVBDn` zB{gIf5`la%#A$-IBjD+3Xjeq05gs?`0q3~+u%!`z0S-SEE{^doYJ>=8ilu~(oBgtT zuC0cDKRnrskwz__4qfH!RYg>g*?czU%jyRm;hRoEh4vz4iSw!r!VeTWTD83w%Xi`j z;NEqJ zl8eUR(w$_~FmmkItppp$BHs7UBO7y}J*)FJeaek zI8$^lz{Un0Ajb;quJ+h~?o_QF6Jx;lcnB$vl>6k?7M?O9g(XHhw!PL z;O-d=<)$|tj7;vtVKeASG~?e88jJ*?T&Y8GhJjzCq@>i;Qn(i2TA!{p-oDNJ9<~9p z*>vltfC?@s%?C4G-`w0>T|Hgq30*16G!_(8UbooGq%plcIoF{xTO>e^+PJF-5!7WYRoX+u_*}R+&hkep|si3lU9$149{Tv-QZ9qLg z1foZvKnR5Eh)7ckp4dWb>65`k6PF^H8BmmUAA^exfwW%kJy={-FdeIg4BXQswh}XJ z#q`_aHCXO3g|HGuC#}lXu_e^pWF}l|9W*02Jd$m!f805PYIDy%8l0O3+m-xe*{85o zw&O^AKOwp{UZ-REQayLpzkpok<=#(pUVA(<@ompLupMaY^TYKW7%gHED8MT#BH}IX z<~*6z^t9`~Q6BL>pt1ml1Td*PbyNKWrCJkDl8E zu;Uh*MMxh%cd-A?2)1KVSL1s7Ew>4l z2u{4)Gv*d~2mXAdQu#;!*=;K`1PZu>RFa(~#K5=6X<1oo>Z{?ikeH5!?Zaxt0jY>w z`^d~w*muO@r1k3_D9u!G1C>HgdveW4&7i$S;|EpZ6V}I%OdS)wqafcRDU$5)-2HU+ zTSlt?0Bug0I@p7?C-~hncpSEO9hgen@#OF_K=4WjyRf)bS)}{8)IWfnTU?VLpUVEi zL~c%2d`?&WcJyIjV5&?;GL|*ov{2tFO#R@HQ%CwQ01|rby}^%9Oj%!Oumt_Oy#5RQ z`3r3M6nuCOVu${FC$Jawe=tPgy|s!@{{ngb7H~cMHu^V|*+v?US3|_!xZHt!u;Pi|Njsh_tVvOs}nH#r2TRkjNjmQx}4sj=q_4U zbaq;oe2%s1mkd=Y(AQVkmx&Rrd5hM(C3)s{6lbLiwkrS{jIfcQ-E(tiNSP}8YQ;Sw zV8($MNIk?JqWw?I$qOe2+4o&At|ji9MJt${&#YwZSVnDNO78g-@^t{q;*?#t;T-Zd z+R+2|kKk^>bEkNcx*pmc^X_jJs`YM%WW-PSwO#nR zL{4d5+3s-VbEfS`e|?X1BE!IGM+ruK%zgVE9`^T=gB0x%k(ehBCmB=b>w_0&r8$+0 zF78b{RldEt_--iQ%4dmW&%S*z&z;g+JZhu~uG$UW0f%X-zoiw-#d>-V?_yETSXfvJ zf2S47%E7SI*6>qPF3;%`O8p2nO1^C5r0DML>dL2j{k|a=g#}Hm$b`BG2CzNaQbUrZ zl+p-+t4`!)lGQ|hnos^+*#2yMpa?!!y4c%lP&N1-_h#S4O5#g5_yA1K`078{Q62{_ zD1xThnQV)SaY_Gag-)YI{n+dUrP_NW@HJS#SeN=dinT20v*F&bDUGeDIsoxY$ zGs9Q$6qE_FM{_A@fhTsfP+%h|6RvGbc+M>HxVtwxT-<0D@3cFV2*=1RpKgEdoVf}C zKq<#(j`_{>FR!e67NAJ9nh~g`Vzoc7@>-my$s_XPMWtlO<*Jf}oq;nw>T9 zD}{9fuzQr=H!dzT@eu>%k}uj)p3>5hw3KBnphRFjM6hF^Kh0@p{Rn?t0?|nQ+YZU( zQzZ7UIg#H|IQ~K0EI{2%^HD}xU!O%NZjNB9+7P~QtGF)N{7)Q03@S`@VdL`0QQ4M5Y*l%zzx-LL= znURpJALA{M7!iErgpxbsBQy4kZbM#CM#&DnoT^$KRm9kLdi0<7doTm58Ru#K$m`W; z(NiQ36T>bacO@YrK<59=+v!od+>t2SaFXofXzjYTm-~eroW1!6jp6AbGFZkqa zQQkx#~#No-j@kSM` zK7I~5w3GJmX<7Xbg~R>!bPlsC6DrXlWGk&>uIlz)Ga>syq3L6;>i=?th+6&hn4`$2 z-Fo3%L+(^qyQbagq~*@Xc6Rwj4`4W>zYL)OZ|DE!a5(8n?J8Y!F-AYbz`p)UHO@xo zMrdog@uXDOpubWGgCE=)U-78wEg)?IHr&27;l93+cY)}~Yz-Qm?aU>T6I7X)JwrW@ zZxWP%hd@%Bw)z!{?Q-{7t3m>+k~B>+^)>wG&zJcW5h;>|bs(bRPb?m^oG;qOAnB=T zze$iq-|{7QwUX;28tJH2l7CCD7vsqJ zOH@Q5C8oqZcPnR|6oy^VCBC5L$b8`4x20`nE&>1MkV@rzI(x<7nVYh?_#{kFwgnqWkRfa=0b;dRNM;jL;cZ5Feo z5DRqz$BB^5#B)lV4|jfAb?#CuLKjfZLN zEZ}@S?tN!f zX008phBy

    u{e7;Hs{NvhBm)0o5#1}&p#}?lC zo^oPs3`M-UJ~HINt|36um076%E#xqBkQYHDa}USi`c{B|+&q!DYBz%TV=-4wCcCi# zM$GLWrgLjIOhWKZc1$6=BsX8W&eJS5H9Hi*9ClnmH>HSe3}bE1=&;G#f%&ekN_Vg5 z`9GKrQ&Q1yNk2rGg(6!OX!$H>Oe%ktdjk#W^fbwn8VwZT6p228CXv`qJMF0HVujgLw9JS(P4=76YwQ6Vj^rkk$5@tPwpOuSD zOsHL2sQ9AC>GllU&1+1OUjE!+2VV27QnSoeNmE!(dmTF2IJsGbtRhJyn;)53NMTo! z-YT6<2`%SNBrA;GJN-cgf#CkKE2U0pX4Q57^ycPsx^1VQaq6~x$ZY`yNw?#IpL@xx za1^g-m%;V`Q~WL(Ma(W;5r`fy^GU!bh`^ZhV|_UwZ<3@n9}Hx67TUU0zM&-l5_4L% zAy;rQSM&syAX;2VLXo$z{))(RjMe`g<%S;l+K+0Zzy6%!3~ou=lRRwuM`mE)?&Jrz zLMRXlQ|7qh54$x{RW&kJt?u4xE91;-gD-8)WhnIKW!8rZUOhd`qoYFNEmb%f3i+fV z#aJ#r*GoLR#`w}ttE_qQ+1eBN$E>?^r&*3kl5090PKFhSs+{vy8vPT?i%H3yzs9X6 z)&UhHc1a9XRJ>(19q2@;0g~g|*rxaF*xIkV85YLXK zvt>%@0P>NK*8@H>*Nzb=mHX>(!_))HdP-M@NEET`_(t|`mNRMOQybW~JV>C;^WyA6Sz|FT4RegO2(SZxLLSdlL>$lbG@aam8>{3*1zK!STwP?uq z*TOPJ#=6eyFT<)PukR0?x))Kcn*y=#eHbZFR5P`#6`GPCXR{?)&>%gwtdG^rn~xQ) zkDQ`$uMb~pV1E<$Xn(bZY|WuMwOU)SF@A-ZOSH91DaDNSkt8B|#D?0yxW+@?H z`(e{%$0T0>B))MCoyO2)FM!d2gJqHw1#DZd{n zq_C!E_QL4+{LavU*Z4ukfj6M}cF!6djb3T6UP;QA7ZD5Y)a10*9`AIs${r|R{dxC@ zL2%m&;(vB>dGFkBr#C&79~$9?PEo zh0|zF_1B=Y>GB-f3lpAbhwE=|?UK9u6URgg?eh<}(~EY`r9wulrG`B=_^#>2*I4Mz zXt?u|C0k9kI1ZVI>XB~y7{Z?1A&pk+jmgvVFZF8+lOhxb{V_85p*6^T{`BYr*<9s{ z&Z_h$3niQAZk_~1DCS}#xk6)zobfJP_`8>*ZvstCJeETPhV1QxJh!eEken3W^3;OY zBEKl~We2r=&kNAsS=V%<#ZfC8Zo$|qbsYMzZ^Kb@9!D`CQbUIn85MV7`spMI)}F*D zJU2W6rv{jmZ;*|C+tF17AF+HX2mLO1r7e9BeuOYKp0(ckM?)W8u2nHr6o^09{l5Bc zJgz_0Xb&;SmE&G%WzWeNn+%`L^TzZtOF^7ln03R$vyx7Ml=9XIFF0OuK>_v6vGX_z zX8birbhH`kScB7~+Fzmk3=RhKB|0N8;W6VdSJKioX*oeeT_~=4_PW~Yc!zL8(S`_2 zyb0o0+m*xZRh@UDCI0p28!9gHFc-b-@M>Lt$mf>kHa0c-K_Ga{{Kep_-#3~2ya<8| zORkkoB+ZfHU21kDOQfO7L6I+%oG6Vpk^mH|4Ne$@o0^uMUcpTmw3f>w0~=;iXzkT2Aa@3Ccjz=b`4&eDI?66^rVNtR5z!2ZgH+Dgt7E~;ekoOiiHoVx~N z00ySlQCutw5{{+)8Y;;7(b(b!2@=Pb3Y>I5hMPt^{7M1h?9a*P`j`#`^OKxDQ81tY z#T6eOC?bAX%TWtWm1{|o4V!aj^|Z;JdD9YQzeDO!yYyZ?tb6h#$cG{?f3s`g#fSJN zi=eq{r`6tvWS)B7D73uSR6(YwpeDsxB3-*+oAbITO*Njx!DR^6XNaOlqU?vGZ0nwM^zlXe2gyq3-fz(hu16(OXe(YDf9!ap zYLJN$>ln4q*;giq3{RWXX7pl(m4nA!D|3RMDXIvAB>MERf3e>^H~PLbev?XBZDKge z#Lmml?>D&m0Dwb}cAe1PEtgg@>Vc4crpxYD=L=8t3Pg1(xTgCViVte2seC@|9AxjS zA!nr3YVXZ3ow$2unrpn^ciG3SQ{v+*DEP%+Ai{*{cXu!OKkj^mfUVPDcE(=IIXH~1 zK0+g3`?dM(Ok}pV*Y~i3D+<|(=k3H?t%05G&Nh1-;aJ}BcXBIrapp)LCE~YurLR0> z8ej2ft}X-hCt_5`zJQHp#^{p*Gx>9KAco|1eH1+ecs}@%tK1c! zg7BlWF?cS+-#)ojel&VtUO|--g!2pYwQousHfs6WMQ(WAvM6aOpkoFwcZ&y;)Gf!< zA}2{4Im>0j*$|l>*j|G@%Lvdc&pe)YCr>(@PCFIFFMb0>+$~HY(+Gjn=~3Up^1r;) zhMC}twoi9_1&#DY6 zo2T_x`1?iA-?5n%txCJzVy;xVOow+ilpmRY6Dnu7V;wnf?+YqA*%k~O&Mx=DqlwFkLhr)WHMR2c?468!O8C+zFaH2h9Y|5&OFP4(e zeODC#C3oLOHupyeFFL*GmP+50M5Mx3Lqo$I3~PF8z2=my)C5UJBf*iHD*Sfa|6>8B zn2ts9d9J0=J7W8=CD|yf2X)l%1HR{}oBAC-c3s)~@2rj2uDpKUN#=xp{Iq7Tdt>kjzh5_EK+Wul5HJfZ^I_$BQE>>L@U(h`cm0zE}U=n6X z5dprWLyAWb2A+st0g^V1tj+}y*m6cb-c9~hWX?Zn} zY)^B+l4P(QF9~e8QJli+8#QJ; zCxe7VM4s^FQT+yYU~k%lzxvvV$Zz_`smBiP`R8u>2~$E{L<`7b!n5(d?xbIEfPoBD ztcKoAKlbuTYfTW}QX$)3bD(XI+`dgId~8VNeZzmzV|Ohk=y3l~_vk&5P$K04r}UX3 z28w`0vsky(9m_c)$w(r|X@b1=D6^c992L+-orXb8CoI`AP>uA{PnwWjYzt4EzDRsZ zuY%uNW|^*%0wxJD*Pw(I;Ow&f-U9b!eo&AH{Z@l3mjUzp)WuB(!Wmw#3k0oV8iF`b zJn69DL2_`-latdJmSNG!!+3+0aJQd0z=atUM4KNTiypfiq0+!lv(Np5*K@wzKf@_78&#Cb6syd#=*?Ml?6OR`61z0|s-*+I! z28cUG{O=q#GO%k_+3130mg*jMzh_6TEa;?R;7o%j5c_Re*H>2wgmSXE=$E(dTM)>E z|7P-k!EUg%lt1+_RNS_!7q85LOotHS2De*$UUd*M8iUUTv4P38btAW)pP>)t!CFQ? zKvU{GytH$Ia!(GaRw&0!@Y(ugjt>xMR1P=X45J=mYWrWx;UDlf(#65fUwzAli{=i( zaxtvQwd=sD^9xV+7D_oW&Lv>qp9v{bdRS9+Cn1YL2mq(Vn`cJI4w++Qn8o12lhLg9 z7uuEJOG}ImRc+D5QW-(1m5eM&p0jORG0xkAKr-~u&fa!B%U3WAI0K?bxp@Ugg_AeHHlyS9dc^akv5hpMuuRqT&1v(k z2eY7BrEQY`cdrmD#&OR|Z?sV;SkzG*CAiq3PgsMSJ%3Rt@y@8hqW+5<&}R zr+dSteNK=5wmJUM=rV`exP;t-eVoSi;wG@^nf9=-Xnb=p0w%Xjmv~v|s_{&}nYAB+ zU!cYQ+TO(zs-shHlV`l0q$R*%ouf3VbjoeC<7bQvlANXM8&mG6uxHqCtSL-{&Pn=p z<#kiY3qo!g*ZIsvI^KxOxxBiETs^tq&>)7(HL2y$M8?%kKP2zBwmbu8*gCGF4HC|%egXSNbOY5%tdbe(?~JveI@wOYH2DG5ez=2GNm>%x2z{-f7{x5wunbF zaZ(&p&dP*y&AGf%s_Qkm<&#csIsyF{G^q705DWy0p&G+z#cdNT{I_h+K zwoSx!{;arhygKD|SnoZixKj4%k%}hM8~jo1FT_YfQbvz=LwJ#qyabgZE{pP*cSp#S zb4}skgD&P!at$izQdLGf^SV=T$852|!usmp&GMktIo)Oe2^!dM<{1hPeX*^DQcIrD zCBNYE42K4F+$a@$K9aAgsxDA~E-@_Ao*qYq;XqT8X&;lr5Pmz;>Y93qB8+gj1Tu9S z50_(WBY_Yg;UVM?{f*fGlPJppL$&5&`*Ne<@veiaIwLaEiL$*JWM}WzbdhXoPy(1m4aUT z&n#7;tP;9iSsNca?P$cxc!h6f4CUPj1~gy_yPB%X28mzS$bYKV#-7DErF}~ zJkH8)aCc;Q;k+s~=xbO0932U9&hb24>Rjb~|ES@rJ91xN*3h^byN4I=5}Qh`uAr;S zM=`VEbu*U1;Rp!+9f9R?QxkjY$eta0me=)=#0z_rICG+Q`P)&AqBH@wxp=O~^k8A2 zY6m7L#l_pA#*>HSMHJD?VUJ+KLT$oVx51rYB7-F0SA^+-R>$J<&Exi?m`J1TqP4EL zZyK@#S-2iI_H=;wSDLF^F9y)5oUhw{BE_jEh6Z2wkk_*q6AxR*;S+e)4>zx((2FDc zv2arYG?8$ANcn`4P=iu&!>l50RoVycvgp`9y6v3EZ!=^BnUAVFm-o6y&(}ky`JIoO zf&Pb&WCT$0x8^EN$A9)l$P^F#WoaL}b~J{_?m~g!z?4kmSd(YMbmHSy>E^TY{c_Tg z1U7gfG!Z2E6;kxYTla%1&&zy=0bAxO7kA8G-PQMDANmf4I*CskORq%a2mLdfO&W@K zL}|MCksv}=rc9qbHEq=d`E})mE~+RJ3$A%VIRY;ayb>tj7N1Uqv``(Tf5mfl<^h&d zR^ssgK4<;5Y!BZ|@=_W#gGgrr@$;IqS4TFfBiK->S5+FGgBfe4onG&LVE+~=nnsGG z@@X#s?;CynT!{1a3#bp<)%p*Ht>!(V0Y(v-BuSjY>25~6RqdBiip{F|xmlq03y86w zPTJF3Y5;h>_WX84YN}FG|EQPY(Y)WUJvBRaJQP}#;vIA3nVVfuj*?_|8aW^V`Pz8C zR#%nhrkp(US;0idL%@L3Ppi>V(e$c8`7^4>U`SOX5!RoxjrS8c3_qp#hWgn~AEhTcm1lKiHeZHXFp}&nclH!+lDQkQ9nr;*oP3l`%R6cqR z4x-@NU}vr%jY8U?mZQ*=y6ZQlqgg^?+#8;r7GVZ~_UV+ZJqM4$8JJ{sTgXn0cGV1z zzI!g+&lRr{n(X7e(HX=17HQSlXsI&zs7mDkGaA=$KSfz9tU@D3~JilKc?V{aX>&z zY4=u`%9i;FKIyP4>*vfVA-{)$pt&lUKlVyKHAEgLe6)DDMZ z&;^0tAd-p6Dz`nB*{UX;xwLr8vg;))l-u<7NL5wLpQ6mbKeXM2l0pI=bOV3>q%O?M zC2_O5`~`xRqwiu%_r`Qh0;P|07gFBY$%~@_qx*lH%Z_)iZj#Cuv5}(+xZB&@RuXCn zqc<)GPPPulH&%cr9jYz!cN;pLBCryz#)oL>t4YV(WNTBr#XX1Kb7ge}%K4^;yHVs$ z#P`h}PTY8(PaozROPpmR=4UH2VJHQu9Q(0L9* z<$G`h>xeddD^w!!=C+Mqo*S7GIw73rt zGVYJsoNnvk#y^7;L^QV6H(qXuGLQ^ug5>mat8$yllN|$rx2O5VMdI&CAZsNn#6-}k zzx7)W>f;bnk&l@d(e?;3bVdNSWB#nCr^!+VgK5C_h4&sHog5q;V{tjY4mow7EL45W z@VzN+4qRdGq_f#hGxHb@L~R9jXtVvZNGVCrqNBy-+MBk~8i?pJ?6f;gdNc2}&H9Kx zht7Rtos)<7TX_Ghe5@_3Nk{I;iU|7QT2~z0xy} zG}g3oL?%vf6ET!9o~J~k?bh9;=pZuX*_9?nQwL^Mo4)U@!h`COLZ62EEz9vKboTUu>bHEZzw>&|Ta!#?J9Rxy~(11{h7`^+QVTq zQtU##4goGN+w)O!r}}G?*(_pcWQy@P&hnOBTd-UQ3m(^=0Rh3`lM^T}+l!a#WQiag zwAt`B+`K=Mjp(MYGTLcmF+=dSyQqor?H5NWlEubN!5;U9;>zC-DH)w-=2IsELLLzE z;uSbdng>f~TMIbG>)@mTO-JEl@&fH=*uhUT7tTJ>T|A$S`^D(&ZA!LNHKly{7~NRr z1;q)z>jTmDQ~lYC#u;zs^4>-}O%qh^jhX!t7Xhb0k(N2-8nZO)X`>7f5U0`|ZFsza z$(Z-3MyM)N==xeZ)TY7&eI&Avcf2~(o>we5E6U-D^|t6PjPW^eC#+e(Y!LkoBtZ_i z?1m=zyN7bC?DM)qAZvDTGr^b5ez)A=?dk6BuD6XEa#f-#_dV0&O9z)*hZ*O+&FrC3 zGXGEP*M9GQWg2g@tt_^l52>Vwut~?lSV_qwk`CjS7NOCs9nFh_Ihddec)^LKTGm2d z$Ln^xT;r9N+7`BZ-o?F>AkPqPc5ot0B<8y`RNTR_Urb~PvnS7YCkVYke9@QMK?OQN zp|QDw#cHFZSgvP`UfCvA|APrNRsAqLW*KWg5W{!hy+2!FGL^ZkI$8%t+;bZRfJjBK zob9)dkS9?83l*I+&186tW%0ZKo8`0%eJh`UpFKV3q}}+#@E7(Ed{<=tUnU6&>)*cu z(Lztce;NC{>IRPfHxBiJDDi)mNudCnY-+lQoBb~w>YR%h^ayz7c389h zzl;<3)=Lx&2;cj5%68@R|FKy9{Exgs-~XG0@(wNdKX)UbVY>~YlK&dhs%sI)9X2km z6KAHbY|zXRE-r4yx)cgbP$;73j7+{x@kCkOKN`w*&3y9230qnR#Z_193+lK^vx9xZ``Rc+G zlfo9ueCJ8bv0z+LR$ALqZ(zd5PzZu;uS_AxQIJeN#tV5z6`eO`4uxRE# z_1LZZx8e%k(BOH&F&HQlABBbPhTczW<1rwDn)+3}pI*b*J#F<07Z0QK-rii@8tt`R zIWuO=?!^!{h8=JGxjKMvMHH8;TCa28W6W`;yT`vqG2xKv5LY%wlY>RufnTM6Dulp! z_VI%J^h#KgQDR`turWK!`E*VxrQ_?TKq7F|O+ z75wLa8aF0X{6m-{+y*w~XWcr#2Lw>{nNzs@!HpHWnb!-LVwM1K9^jmvi!NRC+kWd0 zoL44^yccymUO&J$We%{0X#&ptrrg{tF2;AMxw~>9t+=e1@f%?AxbC17akpXfwDn~g zQgDi}`>HRccM`K+@_{ zMgmvLEr26$7C;rN$D^H4ykN$Rt*v8x$VxB_4I2G5a&wCvEt;x2Z8Qj2ef-#A7FC?2 z44V9G#iy;HH*3y}-5X>}=t@l2Rb+nH%Df&bG3al}BWE`Gh^VS5IH>P52{Fs`7>H6% z_G)2G|JmG4{LKsbhvTvH!8l&fBngT?a*N}^_^r)oq-t_086Bo!p@zkT*1EYZBBjE53S!au+va1U@f0yt#i zzE94ea2HSmbuF#9bu#E__Cv~vRoe5+#8{b*$v0Yx+oT(si>`Lx3&)qIN%TFuX%VUB zPl2}EOmtZpFDS5%$HI+av2a|id}MH^)}UcuNWDP0J9{q7K_II# zTArRll?-m*_eVq#G2>=;2Ruj4{L&iWxH77dq#patzO=Zw=ypG61WD+mgpObR-HO-c z&(&@Xo(2@$5w?rN_G~m7%U~=4jlv!NlJlf1#-fV0hP7-3`;uE**x7IDt73#Og`#~_ z>xsB%7Lps?j+&ZoHgLh>ebUxrSy@FDSwaN=MdpgMCz~T47l)_@GvBeRozQD_sXf|k zjZiaTqGVGo5;zgNy{(lISLIel7hE2nYqz-+1XioCfafljWZY_US6o}}Ckuy*E$w<% zP?DBC&<8Mlkr1VF%KInPWYOTs&p}2*RIKOgm>BA-1w!aJ6RM>7a=brS5%;f$S<@Em|c*%G&@7hpnY_@GVg@Th(N+=%L=TgOPZ^wVA@Skzo1Y`% zW2aPWl`$~k5rfW7h(ijsSn=U2g0ZCqP+~JP{M1xFbx=z9cc)$wm_3l~|71!%IAX@m z>{jBNdd&ZTgCXMYl@>Fjnf;6w-ZbORnaH=tt~Z&En3N6|<&oL#L~KPEPb`!kpV1X% z5gV`k9PfoIMnT!OphJ^8ECj@k4%|^s&1HuT*-iLX6^u5wK8c@UH5J| zx13Cz78XN)fqaHjZn>=DnZxfk&svE?X4FW!SukUNF*C>I+!g`VtLAXDM|;WGP$tFf z$(_fJ93Je7*Pe1_%`R@}6+3)LPp)Vz%{LFj`U%I}b~)8aAc6Vjlq+D%y?Am?%W`<< z5qQ)wKDn>yihUdMHL~?XJWHo)0pk%m%dK`OXCb<@8LlFjQ^;SwcnSmmH}$NglY8jf z80}#oyfo=E)>n

    ?&y$dgco8F_~ohH5c5LFTpBVo5Q>@o5Q`jW%cw=B9;m2X?g0& zlwK~_qtKP@L*qsVq%&a(#s}n&thIC(fE|%;B!N9$lMRU8d>O$RTqqg?CbzxMY?Z?# zZ(#B>QtOxDP(Ad3K`<_B-0Ed01n>g6V#dYsV9!UPg~sgGsKkZe3n~qio$GmYtZQo-U{#M7)i?OoNHft|EX|4cc9AwO==&hYL*43-@RkzexQ87$SQ)#$cFw=W3-eR?;su{e5%6GBbsr_ss1a!22##iL=l z@Sz1OR{Z+Fv~(By^2rbbCxs%v+nDE0CUPfbVZ^8-<1MMr_ullP!(HGuY4xtTmjiTt zplX(#D+0=zNV7=eZQZ*Y&SKjq6+!xi|EL)`0ZsZcM3+LV@+|Y&f+)!Lz;fMr_`t0S z2>~%;_qgy^ha)r|-ob?KQR`83+MTdMkqREkub2ZoR8I9WC@XUzdQnTLk$8)R>(ztf zkry#M8@eSY$b(Z)mg;Fj{IbLj(N+dc2_m@z>S8u#XFClVl-U4T_WLrdAWZAZ(uTGY z&sxcEPL1}Xz%G@hA}@xb5CiKh)<*8&yv5HT&0u_ApCj@ zDzRJG3QD7qG^(QEvjS$0UuByz>8#oV4DYoRBI7Bz=tDnOqlbUW+vrth?_^-gCSiqC z`&rLH1>e2d#PO&q#d9(D53G5*1)hT@BX&=t)9Z)hak^zZDQ&gn%@W(h(OGba`|N1?P`@v@lXIDsAspyE1TS zv8swn&mkI>t;@L;2x&4jtHz(WfG6@Vr6c|ByuAi z4CVQ^-eo^?p`ICTn(vjiIfE-4^{!ZfwNQ!A?JFKzYa<5ZOly&Mmr8w6nYmsDGeB+^J95jZoAvbf9G@w@4Pbked0j6DiuIz5T z_4%_Ta1f!$drgR!XMN42j#8s0iwP*uvUOAi*IJHnbO{Pl(6g{)Ia$%(A^5ASk_}DC zkKaobMWEF`vtuujiRuxSbadoZN^?pDV4%N$kd)b_2Rx2C(!38ERMO5Y9n|@M982MR z2{f`~J@{*sUo~J)5-x`sV4gZ@e`(iPy1mQr?VH`a&W3v_9?R!N4VzUGDy}p>Myd%N zO^vaqx)b58B1_~QzLt|}>+UkL*b+O>r=n|~;j{=jU2K>B_ZBoSMgOS`#YVpBiV&4f zaaaR?8P9rJ=|g%fL^^gC>dmuUCdy+*H%I>(^CT#9(IuiK0mH)T{Qci+Mx3T2%9QqD z&=}8D$o@XyT|paPavL@EzN#@xN0Va;B$N4{*eM{WYUkLVI7{p>Uc1_k|I`xd(P~7g zp;nW@t)`s+t=9Lz3FQYH%)!srljdrV8yYMR=Auo-c1S-tJex80ghdT^(W?eeg!)rj zo4=7oyMfH~?`eg#3@eNN_7G7(VF%u$rbGhURe_mm>4MxTaf*L2?p130f)r>)w5Oj5%fesu|(Nz@F_={9=| zJTWe3`;?QOnahKCK9AiprE*^w$H*oBy&618kA2e|h2j)#E6?Al^SY+fqHyit9`S=(J^PfuB~4$fs-AI+4V=U=XI~MlN%*p%#_p8M8f1v zNke(?T-nsgonPhHRsUOc|GvnWy`#{nqqK`kLHptNtcBxUum)!V^fUhsEaN51AmZSLHv;U%Yp zJI5(JN#ygvM9i6FjK2X^pX1w_i@E40!^V3@+#+?X&2uJewao0YJTUUTYnG^rA!0v0 zmX)Kur6FcQR_AEWaxEF`63MbW5OO+h==V2DgVP>>Ibum)p>_1@1MH5xzgzLi>mV(U zEr+isU&SM!-vc~MtsfK{VbGbiiDTL4$S-~-vG-oQ->p!`9gorR( zSHrS)Z@w-gsc3v2aG3jsWmd8#G3QZYfL&v>KUP*(FPS;A0VpN) znSX*gAd&*I$KHU;dR52s@Xl2j$xmo>?2E2YXM!m5LTcSf20oO%u7; zgEJDstRUIC6aNZ18_;8356`T0{|x89=DVocW_c&Z|ZVh5*Bi1B+s&o(KpfIv~fkL?8o zNX!w&`|OI9_^4_exi|{D{7uafY15ytsyDqC{a?2|1bTQW2#~*hilVqX4+&A7DX>8Z z6NCwhkyK>a#piKXJrhvi} z5|m$CDn+B#!)5KLlgunPQdh|xrx}jkT3!ZpBuSK95X+@v6TgMb4y6U@U52}zdQC76 zs65NyRn48gi~$x&k?>lq$J=g=wL`nMn8A0rdSHRJ9+gAC7l0)Uu$T#dQ-}b)I@*Bs z!JJohDIA}1)%`Y)Wsu6Bph9XCgGWE5WtM5J?usVI7RRE1A%cGDSPARK@X(b<0qw*g zop%sB;nL%|94J}cf6o0OOR}8~H&9N7l*=6k9;TU?`Gcg7)RZpgG}Zb)JQ6B67^-DV zX2p=IAAIDLux@ir3j+mtuttSKbvd!S$dqXEq<+Je#1pcl|5>p#7tN6IAkG9EK21U< zLvo$WEY~L8g62^an$TLuCK4hA8~VZD@n0(DD!)d5h-Rp9=b`>Dq$E_kl#!C+0%Q`J z9S=m!T!D%O3MEd!*G8MQGzLRaC8b#;-$$YNL!Es#kIv%KbQtI$&!J6`7Zfn&}7w8=l$50ps%6!aeM)E7KGhepECl zc@Rh*gkMEAdJ~Z#{FFFAei^_vYp#=u5fT8ApkCX>M1KftsK1%NoCYkAyHM0SH8~c1 z-Q$f?HiBRzx^{4HyEgsA7&VV$f01fzpAp>h`aPACTZ zo(DCkJUdY~A(3SAv4CtVADrLueaM43!L%DV><5zABKhfC;KRr%HhsF;WRbZte?}w{ z3)d(dy1;>$K`sv9eL;WN&ceV}&+XsX89+a{c}x%#phz;zPfTkK)grb^t6=}6VnT)) z6#Nhrk?tVA)DjQ{b7=vQgSf+Oum)^`ULC0+3~&VWDGh!?VriZ4+hGUuZ&J4<8Ta0O z4T>4AfYx4m85vNmB^$F_B-;s$GLElJ@9iS&%9x`t`D)~MW{oZ&pERrh%9%EyzmrBM zBM)c|D}d1>Pj@iX4MYSpm@98>=#5DvS%yJek-cE7r*Od?CdlfD_{lDLxJOTp3^F}& zWm<}7p<{rvLjh6zsa^V9Z=K=Mqp|bmuV5BQStmlMRt7JfERDrt`5hk|iGO%j{l$(Zu?rj2Y{t`eDqXbAqnR z%QL%ts7p2t<-e>Gq<_1X&bZjBPeRnrVhn+RE!%c6n`Xx!mM0mK0hZCK@yWyz_RR(G zwfT+Ai{SbW66N&WfbWCZ^2E{={lmWOzQoDM81l7_GPk`Uy4TNIx?bhDSqa@wLWSub z#k3q8*w|Xf7QptW*%R&khsu-}%l@Qs(Lr`gf6}w=JZ(1m#9v+CpmEwp2y-8^9C)VI z%uK7dd1mKNWD7t|sQEb=?QuCd6e{1&_x=MlsZ|c_ll+64Y%Oi;FF{F+LR-v@D`5PG zybE7gAGS4-RMRUm{GdEnIMUfg_fD<})p7fsZ{a|T^EUfMX`cG0J)55}ea4e4niJR- z8XPfKM(fcF=D!EM*1^s92JbaMwMNz>Y);w2-G8{>ZrR5p;NR2#i!8V6h9-3^8w^M5 z=Ne#3_h3;8IR*9`GCQmWK>-zWqv7hTyG95R%2QsRiNS+v)eUJJltkZeU9%*{)cw+j z%T_qR;4|v$hrW8OrZT1eJT81PPFFS~MF<-cFRYlmQvtidyEA=cx4ssy*8z2%`~9@X z+jpTFga@}}At*mHMu(L7C{%P*(t0~8v2`B*g`|p4FKbnkZm7Xaq?2#QGs4(IUhjnf@inUav2cmRCy2$21qw2gvt5 z*p;w>4K3t7{aLK2w?3>$P?zR-9qefU?Dxf(8-ICA_4CniM11)9XB1XW7LrkR5xF(Y zKk#nlzriohxS~V+q#4~Jo98})Eh~5p1cplfXQ|q~!{1L{pyinem>YNGm#j3VaWnyS zJgeC~cC6 z7*5D!gI6VpF{g-V!boest?LYe`Vi1|NFB31^9t|0Pf#M09Z9pm#Ht|ndB3H)xoKWh zaM&|U5zC_r3(UT)gc6fZlO_GpT&P^!H%HBTw_Ny?mmLwE^^a8Y@fq{*wo$0dzv=Zq zY+5u!9#i1`GUv9Jf8v;E3^7mDPB@Wa&U3e){JRcqI99gvLb=NAymkN{f=@F(lbc6* zjsHjh22A1HjJ>n>LA3#5pyxfWC1T57xWoHkJ}}PF%q$UM-JpR#fKuj@me|=Bcu88r zFQ96y5+{AH%mf-tj1%!JWI@#c_P%~ zN|QvZxna3DOi5R)ARXZ{7G#oURa#a-f10B5BD|o$yT&c+_dK7qL4?unv1?ic+F9 zT%w;-1qqX^_-hYHV)!xBI*-_VJfjt8C6+NJV@4z36f4kgQ&7|OrF?Ba`hx@7{2NkE zGCk|<%#{=-v(nM4pkY3`3^D3RmmK^{Ki2ak{aO3mXQq^?1HyhqR;5rLw0gw7^JPPY zvsJ}dV0C{-S>xk7mLUli_kYq6{*vo$o*vPYG75i6bshOGB8ApVxTOr4 zlFi>zNPtWB3fb3$ggBRq1IE9YKeY9pVhS~W#9CNF@|F5nwEM;s3TaIA^Pq) z%s*Pmfhld6?Xa{zsr2x$%$&$8e^$g;%h-6U^xw7I=Qu-G#s;-|Ia-+SeKM^7Az2HH zLZ<@*<>DYC!#Y^ec;Z;rBFY`$R&&8c-w|82Y{*#-3sKV*Yxqd|ssj0% zsu9Hsvb%jPY)da(I9jC^(!8O6rpC;d>;E^VR88e#dqhK_u6z+7p9(K2cV}4F+URsa zt)9Mz&IErw;?VPmEXY=UR&76nMF!%3m{&gFSN3vngZ`G9==jN|w!878=1+nn#J{(i zqe#3gLC+KYyx=4|;oiWX)M2WBCkR$xUn0^9f$kYy57_Y)kF^oI3g}e>`9M|Iv&z7Q z*NEd6V(7?T`HC(MjuJoPjKoCP#l78(MHX*GUeTZSz)oHxSB7!WB(RrNT3Sl{i}vwu zL03#n4B7_w!lhN4b|F8Om-9d15|BLvOza-FkbE&q((%Ql##$R07c32hH;-&f%wM&d zpGEF)tMcF0T)Au|jsFbd-+0|Odl`?@?T2a2x1@a}^p8ECUaTJCA@W&vPEIem&cMsp z8aW;qn|z=6^5n`6xxpGPgz#Q*K4vK)8VKlCCe<}x8lg^V(GvcHEvZZGJjHfiixNF; zXC%u?5ZQ$a0ak~m)6B=1;e%HT09xwU*oOT7Y{%||j^Atd8d$$Rn!eBK>$I=WUvJ%f zD|@!X?8R-`^;TD3egW=?Y5<-&yW)6ISi1VH|XQ`=v=YZXK z`K$k5{$0=3e!e$Mui7wHPipJog;g&frMHz?$mAb}`=Grk_#b95%~a`M{O_Ilo8`+sacS01(Z{QeyazRxW_SE(;mZ^&zX zm)(P(fu(E@L({UjXH8qDRwSPVty$WdlKu3l;=>cVT9^3NUfeQQPk-&cGdq_SO3p49 zU)sAQE?I|x;eOqMEuUhxbI*7lcWYmA@A|m2+o$L2=0Cop(CdBnZlK5p#b^QU8OGu7 zY%W}Te|e?szsb$N6(Ux7pMI_DH$hcLU+dibWh~#KkJl-!fAFa*`M3OoDQb5DlPuIv zSr&KsPIcXriSB>0^A9x{&NHwDp1ahN+2nUScJjAeYv5(xpe08CEr9Ei{yt#0-vMm> z1Fw@iJiiP$YaY2d&G-FMPJWJwF`MiDZhs59>lwV1>B9uWvn!{&C{6U(*V_9VY2DFo zo|#|W;YT%be3u2f3od<#z=9(ehJwe(deN3FDKj-3m#cnryA0{pw0*^2zJB$cu4(je z0^(e#ch)LjmEa4lTF}=}83R`X06n(e{TPs3{{0fr(+d~BfAei?zopr0DY=g(EtDd diff --git a/release-0.20.0/docs/getting-started-guides/cloudstack.md b/release-0.20.0/docs/getting-started-guides/cloudstack.md deleted file mode 100644 index 52ac5dabeb4..00000000000 --- a/release-0.20.0/docs/getting-started-guides/cloudstack.md +++ /dev/null @@ -1,97 +0,0 @@ -Getting started on [CloudStack](http://cloudstack.apache.org) ------------------------------------------------------------- - -**Table of Contents** - - - [Introduction](#introduction) - - [Prerequisites](#prerequisites) - - [Clone the playbook](#clone-the-playbook) - - [Create a Kubernetes cluster](#create-a-kubernetes-cluster) - -### Introduction - -CloudStack is a software to build public and private clouds based on hardware virtualization principles (traditional IaaS). To deploy Kubernetes on CloudStack there are several possibilities depending on the Cloud being used and what images are made available. [Exoscale](http://exoscale.ch) for instance makes a [CoreOS](http://coreos.com) template available, therefore instructions to deploy Kubernetes on coreOS can be used. CloudStack also has a vagrant plugin available, hence Vagrant could be used to deploy Kubernetes either using the existing shell provisioner or using new Salt based recipes. - -[CoreOS](http://coreos.com) templates for CloudStack are built [nightly](http://stable.release.core-os.net/amd64-usr/current/). CloudStack operators need to [register](http://docs.cloudstack.apache.org/projects/cloudstack-administration/en/latest/templates.html) this template in their cloud before proceeding with these Kubernetes deployment instructions. - -This guide uses an [Ansible playbook](https://github.com/runseb/ansible-kubernetes). -This is a completely automated, a single playbook deploys Kubernetes based on the coreOS [instructions](http://docs.k8s.io/getting-started-guides/coreos/coreos_multinode_cluster.md). - - -This [Ansible](http://ansibleworks.com) playbook deploys Kubernetes on a CloudStack based Cloud using CoreOS images. The playbook, creates an ssh key pair, creates a security group and associated rules and finally starts coreOS instances configured via cloud-init. - -###Prerequisites - - $ sudo apt-get install -y python-pip - $ sudo pip install ansible - $ sudo pip install cs - -[_cs_](http://github.com/exoscale/cs) is a python module for the CloudStack API. - -Set your CloudStack endpoint, API keys and HTTP method used. - -You can define them as environment variables: `CLOUDSTACK_ENDPOINT`, `CLOUDSTACK_KEY`, `CLOUDSTACK_SECRET` and `CLOUDSTACK_METHOD`. - -Or create a `~/.cloudstack.ini` file: - - [cloudstack] - endpoint = - key = - secret = - method = post - -We need to use the http POST method to pass the _large_ userdata to the coreOS instances. - -###Clone the playbook - - $ git clone --recursive https://github.com/runseb/ansible-kubernetes.git - $ cd ansible-kubernetes - -The [ansible-cloudstack](https://github.com/resmo/ansible-cloudstack) module is setup in this repository as a submodule, hence the `--recursive`. - -###Create a Kubernetes cluster - -You simply need to run the playbook. - - $ ansible-playbook k8s.yml - -Some variables can be edited in the `k8s.yml` file. - - vars: - ssh_key: k8s - k8s_num_nodes: 2 - k8s_security_group_name: k8s - k8s_node_prefix: k8s2 - k8s_template: Linux CoreOS alpha 435 64-bit 10GB Disk - k8s_instance_type: Tiny - -This will start a Kubernetes master node and a number of compute nodes (by default 2). -The `instance_type` and `template` by default are specific to [exoscale](http://exoscale.ch), edit them to specify your CloudStack cloud specific template and instance type (i.e service offering). - -Check the tasks and templates in `roles/k8s` if you want to modify anything. - -Once the playbook as finished, it will print out the IP of the Kubernetes master: - - TASK: [k8s | debug msg='k8s master IP is {{ k8s_master.default_ip }}'] ******** - -SSH to it using the key that was created and using the _core_ user and you can list the machines in your cluster: - - $ ssh -i ~/.ssh/id_rsa_k8s core@ - $ fleetctl list-machines - MACHINE IP METADATA - a017c422... role=node - ad13bf84... role=master - e9af8293... role=node - - - - - - - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/cloudstack.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/cloudstack.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/coreos.md b/release-0.20.0/docs/getting-started-guides/coreos.md deleted file mode 100644 index fa03e9e66be..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos.md +++ /dev/null @@ -1,18 +0,0 @@ -## Getting started on [CoreOS](http://coreos.com) - -There are multiple guides on running Kubernetes with [CoreOS](http://coreos.com): - -* [Single Node Cluster](coreos/coreos_single_node_cluster.md) -* [Multi-node Cluster](coreos/coreos_multinode_cluster.md) -* [Setup Multi-node Cluster on GCE in an easy way](https://github.com/rimusz/coreos-multi-node-k8s-gce/blob/master/README.md) -* [Multi-node cluster using cloud-config and Weave on Vagrant](https://github.com/errordeveloper/weave-demos/blob/master/poseidon/README.md) -* [Multi-node cluster using cloud-config and Vagrant](https://github.com/pires/kubernetes-vagrant-coreos-cluster/blob/master/README.md) -* [Yet another multi-node cluster using cloud-config and Vagrant](https://github.com/AntonioMeireles/kubernetes-vagrant-coreos-cluster/blob/master/README.md) (similar to the one above but with an increased, more *aggressive* focus on features and flexibility) -* [Multi-node cluster with Vagrant and fleet units using a small OS X App](https://github.com/rimusz/coreos-osx-gui-kubernetes-cluster/blob/master/README.md) -* [Resizable multi-node cluster on Azure with Weave](coreos/azure/README.md) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/coreos.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/coreos.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/.gitignore b/release-0.20.0/docs/getting-started-guides/coreos/azure/.gitignore deleted file mode 100644 index c2658d7d1b3..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/.gitignore +++ /dev/null @@ -1 +0,0 @@ -node_modules/ diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/README.md b/release-0.20.0/docs/getting-started-guides/coreos/azure/README.md deleted file mode 100644 index b1b9e7a08fe..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/README.md +++ /dev/null @@ -1,210 +0,0 @@ -Kubernetes on Azure with CoreOS and [Weave](http://weave.works) ---------------------------------------------------------------- - -**Table of Contents** - -- [Introduction](#introduction) -- [Prerequisites](#prerequisites) -- [Let's go!](#lets-go) -- [Deploying the workload](#deploying-the-workload) -- [Scaling](#scaling) -- [Exposing the app to the outside world](#exposing-the-app-to-the-outside-world) -- [Next steps](#next-steps) -- [Tear down...](#tear-down) - -## Introduction - -In this guide I will demonstrate how to deploy a Kubernetes cluster to Azure cloud. You will be using CoreOS with Weave, which implements simple and secure networking, in a transparent, yet robust way. The purpose of this guide is to provide an out-of-the-box implementation that can ultimately be taken into production with little change. It will demonstrate how to provision a dedicated Kubernetes master and etcd nodes, and show how to scale the cluster with ease. - -### Prerequisites -1. You need an Azure account. - -## Let's go! - -To get started, you need to checkout the code: -``` -git clone https://github.com/GoogleCloudPlatform/kubernetes -cd kubernetes/docs/getting-started-guides/coreos/azure/ -``` - -You will need to have [Node.js installed](http://nodejs.org/download/) on you machine. If you have previously used Azure CLI, you should have it already. - -First, you need to install some of the dependencies with - -``` -npm install -``` - -Now, all you need to do is: - -``` -./azure-login.js -u -./create-kubernetes-cluster.js -``` - -This script will provision a cluster suitable for production use, where there is a ring of 3 dedicated etcd nodes, Kubernetes master and 2 nodes. The `kube-00` VM will be the master, your work loads are only to be deployed on the minion nodes, `kube-01` and `kube-02`. Initially, all VMs are single-core, to ensure a user of the free tier can reproduce it without paying extra. I will show how to add more bigger VMs later. - -![VMs in Azure](initial_cluster.png) - -Once the creation of Azure VMs has finished, you should see the following: - -``` -... -azure_wrapper/info: Saved SSH config, you can use it like so: `ssh -F ./output/kube_1c1496016083b4_ssh_conf ` -azure_wrapper/info: The hosts in this deployment are: - [ 'etcd-00', 'etcd-01', 'etcd-02', 'kube-00', 'kube-01', 'kube-02' ] -azure_wrapper/info: Saved state into `./output/kube_1c1496016083b4_deployment.yml` -``` - -Let's login to the master node like so: -``` -ssh -F ./output/kube_1c1496016083b4_ssh_conf kube-00 -``` -> Note: config file name will be different, make sure to use the one you see. - -Check there are 2 nodes in the cluster: -``` -core@kube-00 ~ $ kubectl get nodes -NAME LABELS STATUS -kube-01 environment=production Ready -kube-02 environment=production Ready -``` - -## Deploying the workload - -Let's follow the Guestbook example now: -``` -cd guestbook-example -kubectl create -f redis-master-controller.json -kubectl create -f redis-master-service.json -kubectl create -f redis-slave-controller.json -kubectl create -f redis-slave-service.json -kubectl create -f frontend-controller.json -kubectl create -f frontend-service.json -``` - -You need to wait for the pods to get deployed, run the following and wait for `STATUS` to change from `Unknown`, through `Pending` to `Running`. -``` -kubectl get pods --watch -``` -> Note: the most time it will spend downloading Docker container images on each of the nodes. - -Eventually you should see: -``` -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -frontend-controller-0133o 10.2.1.14 php-redis kubernetes/example-guestbook-php-redis kube-01/172.18.0.13 name=frontend,uses=redisslave,redis-master Running -frontend-controller-ls6k1 10.2.3.10 php-redis kubernetes/example-guestbook-php-redis name=frontend,uses=redisslave,redis-master Running -frontend-controller-oh43e 10.2.2.15 php-redis kubernetes/example-guestbook-php-redis kube-02/172.18.0.14 name=frontend,uses=redisslave,redis-master Running -redis-master 10.2.1.3 master redis kube-01/172.18.0.13 name=redis-master Running -redis-slave-controller-fplln 10.2.2.3 slave brendanburns/redis-slave kube-02/172.18.0.14 name=redisslave,uses=redis-master Running -redis-slave-controller-gziey 10.2.1.4 slave brendanburns/redis-slave kube-01/172.18.0.13 name=redisslave,uses=redis-master Running - -``` - -## Scaling - -Two single-core nodes are certainly not enough for a production system of today, and, as you can see, there is one _unassigned_ pod. Let's scale the cluster by adding a couple of bigger nodes. - -You will need to open another terminal window on your machine and go to the same working directory (e.g. `~/Workspace/weave-demos/coreos-azure`). - -First, lets set the size of new VMs: -``` -export AZ_VM_SIZE=Large -``` -Now, run scale script with state file of the previous deployment and number of nodes to add: -``` -./scale-kubernetes-cluster.js ./output/kube_1c1496016083b4_deployment.yml 2 -... -azure_wrapper/info: Saved SSH config, you can use it like so: `ssh -F ./output/kube_8f984af944f572_ssh_conf ` -azure_wrapper/info: The hosts in this deployment are: - [ 'etcd-00', - 'etcd-01', - 'etcd-02', - 'kube-00', - 'kube-01', - 'kube-02', - 'kube-03', - 'kube-04' ] -azure_wrapper/info: Saved state into `./output/kube_8f984af944f572_deployment.yml` -``` -> Note: this step has created new files in `./output`. - -Back on `kube-00`: -``` -core@kube-00 ~ $ kubectl get nodes -NAME LABELS STATUS -kube-01 environment=production Ready -kube-02 environment=production Ready -kube-03 environment=production Ready -kube-04 environment=production Ready -``` - -You can see that two more nodes joined happily. Let's scale the number of Guestbook instances now. - -First, double-check how many replication controllers there are: - -``` -core@kube-00 ~ $ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -frontend php-redis kubernetes/example-guestbook-php-redis:v2 name=frontend 3 -redis-master master redis name=redis-master 1 -redis-slave slave kubernetes/redis-slave:v2 name=redis-slave 2 -``` -As there are 4 nodes, let's scale proportionally: -``` -core@kube-00 ~ $ kubectl scale --replicas=4 rc redis-slave -scaled -core@kube-00 ~ $ kubectl scale --replicas=4 rc frontend -scaled -``` -Check what you have now: -``` -core@kube-00 ~ $ kubectl get rc -CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS -frontend php-redis kubernetes/example-guestbook-php-redis:v2 name=frontend 4 -redis-master master redis name=redis-master 1 -redis-slave slave kubernetes/redis-slave:v2 name=redis-slave 4 -``` - -You now will have more instances of front-end Guestbook apps and Redis slaves; and, if you look up all pods labeled `name=frontend`, you should see one running on each node. - -``` -core@kube-00 ~/guestbook-example $ kubectl get pods -l name=frontend -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -frontend-controller-0133o 10.2.1.19 php-redis kubernetes/example-guestbook-php-redis kube-01/172.18.0.13 name=frontend,uses=redisslave,redis-master Running -frontend-controller-i7hvs 10.2.4.5 php-redis kubernetes/example-guestbook-php-redis kube-04/172.18.0.21 name=frontend,uses=redisslave,redis-master Running -frontend-controller-ls6k1 10.2.3.18 php-redis kubernetes/example-guestbook-php-redis kube-03/172.18.0.20 name=frontend,uses=redisslave,redis-master Running -frontend-controller-oh43e 10.2.2.22 php-redis kubernetes/example-guestbook-php-redis kube-02/172.18.0.14 name=frontend,uses=redisslave,redis-master Running -``` - -## Exposing the app to the outside world - -To makes sure the app is working, you probably want to load it in the browser. For accessing the Guestbook service from the outside world, an Azure endpoint needs to be created like shown on the picture below. - -![Creating an endpoint](external_access.png) - -You then should be able to access it from anywhere via the Azure virtual IP for `kube-01`, i.e. `http://104.40.211.194:8000/` as per screenshot. - -## Next steps - -You now have a full-blow cluster running in Azure, congrats! - -You should probably try deploy other [example apps](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/examples) or write your own ;) - -## Tear down... - -If you don't wish care about the Azure bill, you can tear down the cluster. It's easy to redeploy it, as you can see. - -``` -./destroy-cluster.js ./output/kube_8f984af944f572_deployment.yml -``` - -> Note: make sure to use the _latest state file_, as after scaling there is a new one. - -By the way, with the scripts shown, you can deploy multiple clusters, if you like :) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/coreos/azure/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/coreos/azure/README.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/grafana-service.yaml b/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/grafana-service.yaml deleted file mode 100644 index 76e49087231..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/grafana-service.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - kubernetes.io/cluster-service: "true" - kubernetes.io/name: "Grafana" - name: monitoring-grafana -spec: - ports: - - port: 80 - targetPort: 8080 - selector: - name: influxGrafana - diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/heapster-controller.yaml b/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/heapster-controller.yaml deleted file mode 100644 index bac59a62c7f..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/heapster-controller.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: v1 -kind: ReplicationController -metadata: - labels: - name: heapster - kubernetes.io/cluster-service: "true" - name: monitoring-heapster-controller -spec: - replicas: 1 - selector: - name: heapster - template: - metadata: - labels: - name: heapster - kubernetes.io/cluster-service: "true" - spec: - containers: - - image: gcr.io/google_containers/heapster:v0.12.1 - name: heapster - command: - - /heapster - - --source=kubernetes:http://kubernetes?auth= - - --sink=influxdb:http://monitoring-influxdb:8086 diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml b/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml deleted file mode 100644 index 92ee15d0c23..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: v1 -kind: ReplicationController -metadata: - labels: - name: influxGrafana - kubernetes.io/cluster-service: "true" - name: monitoring-influx-grafana-controller -spec: - replicas: 1 - selector: - name: influxGrafana - template: - metadata: - labels: - name: influxGrafana - kubernetes.io/cluster-service: "true" - spec: - containers: - - image: gcr.io/google_containers/heapster_influxdb:v0.3 - name: influxdb - ports: - - containerPort: 8083 - hostPort: 8083 - - containerPort: 8086 - hostPort: 8086 - - image: gcr.io/google_containers/heapster_grafana:v0.7 - name: grafana - env: - - name: INFLUXDB_EXTERNAL_URL - value: /api/v1/proxy/namespaces/default/services/monitoring-grafana/db/ - - name: INFLUXDB_HOST - value: monitoring-influxdb - - name: INFLUXDB_PORT - value: "8086" - diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-service.yaml b/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-service.yaml deleted file mode 100644 index 8301d782597..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/cluster-monitoring/influxdb/influxdb-service.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - name: influxGrafana - name: monitoring-influxdb -spec: - ports: - - name: http - port: 8083 - targetPort: 8083 - - name: api - port: 8086 - targetPort: 8086 - selector: - name: influxGrafana - diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-controller.yaml b/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-controller.yaml deleted file mode 100644 index f4cda7b032a..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-controller.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: v1 -kind: ReplicationController -metadata: - name: elasticsearch-logging-v1 - namespace: default - labels: - k8s-app: elasticsearch-logging - version: v1 - kubernetes.io/cluster-service: "true" -spec: - replicas: 2 - selector: - k8s-app: elasticsearch-logging - version: v1 - template: - metadata: - labels: - k8s-app: elasticsearch-logging - version: v1 - kubernetes.io/cluster-service: "true" - spec: - containers: - - image: gcr.io/google_containers/elasticsearch:1.3 - name: elasticsearch-logging - ports: - - containerPort: 9200 - name: es-port - protocol: TCP - - containerPort: 9300 - name: es-transport-port - protocol: TCP - volumeMounts: - - name: es-persistent-storage - mountPath: /data - volumes: - - name: es-persistent-storage - emptyDir: {} diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-service.yaml b/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-service.yaml deleted file mode 100644 index 3b7ae06e7aa..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/es-service.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: elasticsearch-logging - namespace: default - labels: - k8s-app: elasticsearch-logging - kubernetes.io/cluster-service: "true" - kubernetes.io/name: "Elasticsearch" -spec: - ports: - - port: 9200 - protocol: TCP - targetPort: es-port - selector: - k8s-app: elasticsearch-logging diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-controller.yaml b/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-controller.yaml deleted file mode 100644 index 677bc5f664a..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-controller.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: v1 -kind: ReplicationController -metadata: - name: kibana-logging-v1 - namespace: default - labels: - k8s-app: kibana-logging - version: v1 - kubernetes.io/cluster-service: "true" -spec: - replicas: 1 - selector: - k8s-app: kibana-logging - version: v1 - template: - metadata: - labels: - k8s-app: kibana-logging - version: v1 - kubernetes.io/cluster-service: "true" - spec: - containers: - - name: kibana-logging - image: gcr.io/google_containers/kibana:1.3 - env: - - name: "ELASTICSEARCH_URL" - value: "http://elasticsearch-logging:9200" - ports: - - containerPort: 5601 - name: kibana-port - protocol: TCP diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-service.yaml b/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-service.yaml deleted file mode 100644 index ac9aa5ce320..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/addons/fluentd-elasticsearch/kibana-service.yaml +++ /dev/null @@ -1,17 +0,0 @@ - -apiVersion: v1 -kind: Service -metadata: - name: kibana-logging - namespace: default - labels: - k8s-app: kibana-logging - kubernetes.io/cluster-service: "true" - kubernetes.io/name: "Kibana" -spec: - ports: - - port: 5601 - protocol: TCP - targetPort: kibana-port - selector: - k8s-app: kibana-logging diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/azure-login.js b/release-0.20.0/docs/getting-started-guides/coreos/azure/azure-login.js deleted file mode 100755 index 624916b2b56..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/azure-login.js +++ /dev/null @@ -1,3 +0,0 @@ -#!/usr/bin/env node - -require('child_process').fork('node_modules/azure-cli/bin/azure', ['login'].concat(process.argv)); diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-etcd-node-template.yml b/release-0.20.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-etcd-node-template.yml deleted file mode 100644 index cb1c1b254dd..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-etcd-node-template.yml +++ /dev/null @@ -1,60 +0,0 @@ -## This file is used as input to deployment script, which ammends it as needed. -## More specifically, we need to add peer hosts for each but the elected peer. - -write_files: - - path: /opt/bin/curl-retry.sh - permissions: '0755' - owner: root - content: | - #!/bin/sh -x - until curl $@ - do sleep 1 - done - -coreos: - units: - - name: download-etcd2.service - enable: true - command: start - content: | - [Unit] - After=network-online.target - Before=etcd2.service - Description=Download etcd2 Binaries - Documentation=https://github.com/coreos/etcd/ - Requires=network-online.target - [Service] - Environment=ETCD2_RELEASE_TARBALL=https://github.com/coreos/etcd/releases/download/v2.0.11/etcd-v2.0.11-linux-amd64.tar.gz - ExecStartPre=/bin/mkdir -p /opt/bin - ExecStart=/opt/bin/curl-retry.sh --silent --location $ETCD2_RELEASE_TARBALL --output /tmp/etcd2.tgz - ExecStart=/bin/tar xzvf /tmp/etcd2.tgz -C /opt - ExecStartPost=/bin/ln -s /opt/etcd-v2.0.11-linux-amd64/etcd /opt/bin/etcd2 - ExecStartPost=/bin/ln -s /opt/etcd-v2.0.11-linux-amd64/etcdctl /opt/bin/etcdctl2 - RemainAfterExit=yes - Type=oneshot - [Install] - WantedBy=multi-user.target - - name: etcd2.service - enable: true - command: start - content: | - [Unit] - After=download-etcd2.service - Description=etcd 2 - Documentation=https://github.com/coreos/etcd/ - [Service] - Environment=ETCD_NAME=%H - Environment=ETCD_INITIAL_CLUSTER_TOKEN=etcd-cluster - Environment=ETCD_INITIAL_ADVERTISE_PEER_URLS=http://%H:2380 - Environment=ETCD_LISTEN_PEER_URLS=http://%H:2380 - Environment=ETCD_LISTEN_CLIENT_URLS=http://0.0.0.0:2379,http://0.0.0.0:4001 - Environment=ETCD_ADVERTISE_CLIENT_URLS=http://%H:2379,http://%H:4001 - Environment=ETCD_INITIAL_CLUSTER_STATE=new - ExecStart=/opt/bin/etcd2 - Restart=always - RestartSec=10 - [Install] - WantedBy=multi-user.target - update: - group: stable - reboot-strategy: off diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-main-nodes-template.yml b/release-0.20.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-main-nodes-template.yml deleted file mode 100644 index 16638e87199..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/cloud_config_templates/kubernetes-cluster-main-nodes-template.yml +++ /dev/null @@ -1,388 +0,0 @@ -## This file is used as input to deployment script, which ammends it as needed. -## More specifically, we need to add environment files for as many nodes as we -## are going to deploy. - -write_files: - - path: /opt/bin/curl-retry.sh - permissions: '0755' - owner: root - content: | - #!/bin/sh -x - until curl $@ - do sleep 1 - done - - - path: /opt/bin/register_minion.sh - permissions: '0755' - owner: root - content: | - #!/bin/sh -xe - minion_id="${1}" - master_url="${2}" - env_label="${3}" - until healthcheck=$(curl --fail --silent "${master_url}/healthz") - do sleep 2 - done - test -n "${healthcheck}" - test "${healthcheck}" = "ok" - printf '{ - "id": "%s", - "kind": "Minion", - "apiVersion": "v1beta1", - "labels": { "environment": "%s" } - }' "${minion_id}" "${env_label}" \ - | /opt/bin/kubectl create -s "${master_url}" -f - - - - path: /etc/kubernetes/manifests/fluentd.manifest - permissions: '0755' - owner: root - content: | - apiVersion: v1 - kind: Pod - metadata: - name: fluentd-elasticsearch - spec: - containers: - - name: fluentd-elasticsearch - image: gcr.io/google_containers/fluentd-elasticsearch:1.5 - env: - - name: "FLUENTD_ARGS" - value: "-qq" - volumeMounts: - - name: varlog - mountPath: /varlog - - name: containers - mountPath: /var/lib/docker/containers - volumes: - - name: varlog - hostPath: - path: /var/log - - name: containers - hostPath: - path: /var/lib/docker/containers - -coreos: - update: - group: stable - reboot-strategy: off - units: - - name: systemd-networkd-wait-online.service - drop-ins: - - name: 50-check-github-is-reachable.conf - content: | - [Service] - ExecStart=/bin/sh -x -c \ - 'until curl --silent --fail https://status.github.com/api/status.json | grep -q \"good\"; do sleep 2; done' - - - name: docker.service - drop-ins: - - name: 50-weave-kubernetes.conf - content: | - [Service] - Environment=DOCKER_OPTS='--bridge="weave" -r="false"' - - - name: weave-network.target - enable: true - content: | - [Unit] - Description=Weave Network Setup Complete - Documentation=man:systemd.special(7) - RefuseManualStart=no - After=network-online.target - [Install] - WantedBy=multi-user.target - WantedBy=kubernetes-master.target - WantedBy=kubernetes-minion.target - - - name: kubernetes-master.target - enable: true - command: start - content: | - [Unit] - Description=Kubernetes Cluster Master - Documentation=http://kubernetes.io/ - RefuseManualStart=no - After=weave-network.target - Requires=weave-network.target - ConditionHost=kube-00 - Wants=apiserver.service - Wants=scheduler.service - Wants=controller-manager.service - [Install] - WantedBy=multi-user.target - - - name: kubernetes-minion.target - enable: true - command: start - content: | - [Unit] - Description=Kubernetes Cluster Minion - Documentation=http://kubernetes.io/ - RefuseManualStart=no - After=weave-network.target - Requires=weave-network.target - ConditionHost=!kube-00 - Wants=proxy.service - Wants=kubelet.service - [Install] - WantedBy=multi-user.target - - - name: 10-weave.network - runtime: false - content: | - [Match] - Type=bridge - Name=weave* - [Network] - - - name: install-weave.service - enable: true - content: | - [Unit] - After=network-online.target - Before=weave.service - Before=weave-helper.service - Before=docker.service - Description=Install Weave - Documentation=http://docs.weave.works/ - Requires=network-online.target - [Service] - Type=oneshot - RemainAfterExit=yes - ExecStartPre=/bin/mkdir -p /opt/bin/ - ExecStartPre=/opt/bin/curl-retry.sh \ - --silent \ - --location \ - https://github.com/weaveworks/weave/releases/download/latest_release/weave \ - --output /opt/bin/weave - ExecStartPre=/opt/bin/curl-retry.sh \ - --silent \ - --location \ - https://raw.github.com/errordeveloper/weave-demos/master/poseidon/weave-helper \ - --output /opt/bin/weave-helper - ExecStartPre=/usr/bin/chmod +x /opt/bin/weave - ExecStartPre=/usr/bin/chmod +x /opt/bin/weave-helper - ExecStart=/bin/echo Weave Installed - [Install] - WantedBy=weave-network.target - WantedBy=weave.service - - - name: weave-helper.service - enable: true - content: | - [Unit] - After=install-weave.service - After=docker.service - Description=Weave Network Router - Documentation=http://docs.weave.works/ - Requires=docker.service - Requires=install-weave.service - [Service] - ExecStart=/opt/bin/weave-helper - Restart=always - [Install] - WantedBy=weave-network.target - - - name: weave.service - enable: true - content: | - [Unit] - After=install-weave.service - After=docker.service - Description=Weave Network Router - Documentation=http://docs.weave.works/ - Requires=docker.service - Requires=install-weave.service - [Service] - TimeoutStartSec=0 - EnvironmentFile=/etc/weave.%H.env - ExecStartPre=/opt/bin/weave setup - ExecStartPre=/opt/bin/weave launch $WEAVE_PEERS - ExecStart=/usr/bin/docker attach weave - Restart=on-failure - Restart=always - ExecStop=/opt/bin/weave stop - [Install] - WantedBy=weave-network.target - - - name: weave-create-bridge.service - enable: true - content: | - [Unit] - After=network.target - After=install-weave.service - Before=weave.service - Before=docker.service - Requires=network.target - Requires=install-weave.service - [Service] - Type=oneshot - EnvironmentFile=/etc/weave.%H.env - ExecStart=/opt/bin/weave --local create-bridge - ExecStart=/usr/bin/ip addr add dev weave $BRIDGE_ADDRESS_CIDR - ExecStart=/usr/bin/ip route add $BREAKOUT_ROUTE dev weave scope link - ExecStart=/usr/bin/ip route add 224.0.0.0/4 dev weave - [Install] - WantedBy=multi-user.target - WantedBy=weave-network.target - - - name: download-kubernetes.service - enable: true - content: | - [Unit] - After=network-online.target - Before=apiserver.service - Before=controller-manager.service - Before=kubelet.service - Before=proxy.service - Description=Download Kubernetes Binaries - Documentation=http://kubernetes.io/ - Requires=network-online.target - [Service] - Environment=KUBE_RELEASE_TARBALL=https://github.com/GoogleCloudPlatform/kubernetes/releases/download/v0.18.0/kubernetes.tar.gz - ExecStartPre=/bin/mkdir -p /opt/ - ExecStart=/opt/bin/curl-retry.sh --silent --location $KUBE_RELEASE_TARBALL --output /tmp/kubernetes.tgz - ExecStart=/bin/tar xzvf /tmp/kubernetes.tgz -C /tmp/ - ExecStart=/bin/tar xzvf /tmp/kubernetes/server/kubernetes-server-linux-amd64.tar.gz -C /opt - ExecStartPost=/bin/chmod o+rx -R /opt/kubernetes - ExecStartPost=/bin/ln -s /opt/kubernetes/server/bin/kubectl /opt/bin/ - ExecStartPost=/bin/mv /tmp/kubernetes/examples/guestbook /home/core/guestbook-example - ExecStartPost=/bin/chown core. -R /home/core/guestbook-example - ExecStartPost=/bin/rm -rf /tmp/kubernetes - ExecStartPost=/bin/sed 's/\("createExternalLoadBalancer":\) true/\1 false/' -i /home/core/guestbook-example/frontend-service.json - RemainAfterExit=yes - Type=oneshot - [Install] - WantedBy=kubernetes-master.target - WantedBy=kubernetes-minion.target - - - name: apiserver.service - enable: true - content: | - [Unit] - After=download-kubernetes.service - Before=controller-manager.service - Before=scheduler.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kube-apiserver - Description=Kubernetes API Server - Documentation=http://kubernetes.io/ - Wants=download-kubernetes.service - ConditionHost=kube-00 - [Service] - ExecStart=/opt/kubernetes/server/bin/kube-apiserver \ - --address=0.0.0.0 \ - --port=8080 \ - $ETCD_SERVERS \ - --service-cluster-ip-range=10.1.0.0/16 \ - --cloud_provider=vagrant \ - --logtostderr=true --v=3 - Restart=always - RestartSec=10 - [Install] - WantedBy=kubernetes-master.target - - - name: scheduler.service - enable: true - content: | - [Unit] - After=apiserver.service - After=download-kubernetes.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kube-scheduler - Description=Kubernetes Scheduler - Documentation=http://kubernetes.io/ - Wants=apiserver.service - ConditionHost=kube-00 - [Service] - ExecStart=/opt/kubernetes/server/bin/kube-scheduler \ - --logtostderr=true \ - --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - [Install] - WantedBy=kubernetes-master.target - - - name: controller-manager.service - enable: true - content: | - [Unit] - After=download-kubernetes.service - After=apiserver.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kube-controller-manager - Description=Kubernetes Controller Manager - Documentation=http://kubernetes.io/ - Wants=apiserver.service - Wants=download-kubernetes.service - ConditionHost=kube-00 - [Service] - ExecStart=/opt/kubernetes/server/bin/kube-controller-manager \ - --cloud_provider=vagrant \ - --master=127.0.0.1:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - [Install] - WantedBy=kubernetes-master.target - - - name: kubelet.service - enable: true - content: | - [Unit] - After=download-kubernetes.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kubelet - Description=Kubernetes Kubelet - Documentation=http://kubernetes.io/ - Wants=download-kubernetes.service - ConditionHost=!kube-00 - [Service] - ExecStartPre=/bin/mkdir -p /etc/kubernetes/manifests/ - ExecStart=/opt/kubernetes/server/bin/kubelet \ - --address=0.0.0.0 \ - --port=10250 \ - --hostname_override=%H \ - --api_servers=http://kube-00:8080 \ - --logtostderr=true \ - --cluster_dns=10.1.0.3 \ - --cluster_domain=kube.local \ - --config=/etc/kubernetes/manifests/ - Restart=always - RestartSec=10 - [Install] - WantedBy=kubernetes-minion.target - - - name: proxy.service - enable: true - content: | - [Unit] - After=download-kubernetes.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kube-proxy - Description=Kubernetes Proxy - Documentation=http://kubernetes.io/ - Wants=download-kubernetes.service - ConditionHost=!kube-00 - [Service] - ExecStart=/opt/kubernetes/server/bin/kube-proxy \ - --master=http://kube-00:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - [Install] - WantedBy=kubernetes-minion.target - - - name: kubectl-create-minion.service - enable: true - content: | - [Unit] - After=download-kubernetes.service - Before=proxy.service - Before=kubelet.service - ConditionFileIsExecutable=/opt/kubernetes/server/bin/kubectl - ConditionFileIsExecutable=/opt/bin/register_minion.sh - Description=Kubernetes Create Minion - Documentation=http://kubernetes.io/ - Wants=download-kubernetes.service - ConditionHost=!kube-00 - [Service] - ExecStart=/opt/bin/register_minion.sh %H http://kube-00:8080 production - Type=oneshot - [Install] - WantedBy=kubernetes-minion.target diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/create-kubernetes-cluster.js b/release-0.20.0/docs/getting-started-guides/coreos/azure/create-kubernetes-cluster.js deleted file mode 100755 index 70248c596c6..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/create-kubernetes-cluster.js +++ /dev/null @@ -1,15 +0,0 @@ -#!/usr/bin/env node - -var azure = require('./lib/azure_wrapper.js'); -var kube = require('./lib/deployment_logic/kubernetes.js'); - -azure.create_config('kube', { 'etcd': 3, 'kube': 3 }); - -azure.run_task_queue([ - azure.queue_default_network(), - azure.queue_storage_if_needed(), - azure.queue_machines('etcd', 'stable', - kube.create_etcd_cloud_config), - azure.queue_machines('kube', 'stable', - kube.create_node_cloud_config), -]); diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/destroy-cluster.js b/release-0.20.0/docs/getting-started-guides/coreos/azure/destroy-cluster.js deleted file mode 100755 index ce441e538a5..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/destroy-cluster.js +++ /dev/null @@ -1,7 +0,0 @@ -#!/usr/bin/env node - -var azure = require('./lib/azure_wrapper.js'); - -azure.destroy_cluster(process.argv[2]); - -console.log('The cluster had been destroyed, you can delete the state file now.'); diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/external_access.png b/release-0.20.0/docs/getting-started-guides/coreos/azure/external_access.png deleted file mode 100644 index 6541309b0ac87c4081315c071295400d52614447..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 292367 zcma&N1z42d);>%aAP5K|(g*?~-CZKx-QA6J4=AB@Hw@j~4T^MkcQXvlkOSX%&JXoH z=l!nt?{zuX!_3~#+Iu}~uXV3`t>>GZjOg=cc+cSA;GT<%eN=#hdnN@3_ec!s3G5q* zE!#pkIMi3>LPB!lLP8{R_O>SGR>p8}V&7uppDIQ7zUtnlrt*6mBk(BOZ|TvlvO7J( z*mn^z1V2n6lKh!b;m6Z-neW~=B4qApz^S8<2KfuO>)?D;Qkm-f{5+Oj9L}q?ZabBI zdmvu-V8LUXKRS_~8SdRoh5rvJr58Rlf~D`6+LN(?5j~_(cnkqV$8>a-*%X2d)sG+F zU3Q-wygCcmZ1jIS&3^-(&iuK#X$L1jN;?XD1dn%*=y zjLm5EEJjco8xQ&x3;0__-D;;z0QwVo(xL}t2u)|zvi_6IPp*jR%k;879I~Fy99H3#kNnejARxmb}zS;$SeD0Qf|&BW|NIzze{~ zgYgk?hsgV0n*MYRt$eQeHq`&l>@`38JNKAqVFyyt(=4}Ug0_4{nf1s1VOv_{J*fEW zCofw87)JGDBkNb@qo0^k%_NEV*-)7X?L}oolzQ^-vu;^{<&4CU915AUa3}LGBLUe1 zPZj(7aPe_Wdi5n)^93OT(!ppkod(CvDVHOR)>>(0KqSVZTb=Ec9R`7poJ?!SN$V(mt ziz>ej2VLM^Tr&m_yEy#x2fpEVHz+DMRHJrAYYIvIu?LUB9n7j{J!6g>Ugk$R7RxZD znXRPxWT1oiw4$(LukQMmxTQ)I`)hU^d(Y-zf2Qb2-ZXW91bLj%Rz{sqE0S9;pgGtw%oSs2P2#<0E*4hDwI?;e#0xqP(ahhR{!f z3c(Z%m!Ig!!laRp-Xe<&Kl=Jw{VR=VP-JM2vk|&N=xtES$Dudzkun=}V_(k5$|7ao z1t`d4E1|G{pv;oV$HDt7lEpl##DYI4s+w*&s!)x<`*kW~d!%Sbx*Ffh7fl~7x;r6( z&cv5fpHGb=?rV-7sTHG&U#uRs8toJk00dHFXY=v;`Hch7boG^;*ON6yj;F(2IO~>2 zU{`FNz`B*`VPGR4G3xHlv=2&x<`3Hx<{;<{Nuj$)g@< zB?O_QjC#C*V2^wScZJ#zd>g_;llRW_-8Lx>U3Y9UeVvRAP%CSJwSlieKM1okVNK*) zZnk2ayaZKE3`)$?81|Es6Zey$lkttK6Uj}<&F~)GsKdy6G3DGOd9Qrte1km=3-X$8 z?(x?FB3ZbjJm%l3wdOQ5SiwBt7huFx!Mg0HqYY=|XH4#dEx~sRf->LbzDw%IeQ5pg z?FXa3cbGk26Li^k@pU~G0X~!OR3jH7*UnMfjF4#ROE0V}OtmQ9t9P0b+J(f15J;f_&9x>(ZgM#zGt{I%Y_HwnlYd4Dd`|P~iw^OR^a5^-)20BsgJLej^K|9`+YtNwLmrF5T zitdYN3o|wz3yq8F2jT}!i%q*(X=vgPzz*K>NI)hG0tiUix>v z?iJzhv~MON@*}`+!i5Gu2xo*Ujuw1ZWS92BFnLXZRD}L?Rd6-=2eHU&Q6te?wondQ z1C810yvV6Y6f(`M*YZ_aXdhdGAz?Z=Ui@8eMF_?TiZHmzYPld@DYgq;^#_-|$H8l5 z6lQOau<$U&zg2v@!3xa1kzQtMu?>KR{J^a=0oDU}TszG7NlV~&jkSoTzmS{#4n z=BVyeH|J^Yp#%WXbw9TW*WM;s0OhHER${70Oz-+S9e!!H0?Nc zuUP0OwCk<(he^wXJzkLoN8_;5kLp$$h%b-%t~9C>gXw#SFC_f>Ni8Ft5s;U zM{g9{Wm)~tKFF_vV@s)BN`9ywtJaj&YPVRQPm|h=#u^l@MXe26a#)t$T0tFlhsi7z zr)tX_)Kpv3>UGNRrk;d9SH_QJ+p^tXWN}hlG@07U9JH+)Sh8>US!y(`(x-AfbuczE z7GV8ke#-Wynb-Pekm<0pgPX;rclxK&h%M|jFhpOn0qJ|j-~RK6Z@m=T~6 zJjWZD7#JMxL$*c+xJx<%m1MmUO%CTIEaJ6s_3TFO`j*L+ZR5SD=cVE0BJ@FMyLTme zFtjw3(!1)mxpmMx0Z#p$2Mg5b>hSl9{28I53d&7i7%V1UVAuyaDkY%hPdE*~} z5>I!n%d@;U=?;mS&ryumrUN#wIp*9Ic1$+1-PB^W&EI=xE@reGB(2v3plyeB4N;|< zHu5wMXAB&8H7O{8OI4=b?IBi2h<`-S+UDB2Zn{W1XmReSCB#AMIUh*n=s-1|P z%6Agy0tgPAclZ|9=f@!&d&f{6nZsa8PFcQ-5?2WijT5PD^>c^h?YwK~4fkEjo#`^l zYVfM>kG7b*x#O{o&Eq!SdmH=^;(ZTtch(d4LHu*}SX=NC8@ezmuY3Ht&864q({prX z;#9s`@1UDAE7t?lvF$PXTwT1j08cN5C{`v?qu`mbEVw7sNl^&xAPG1#Ap!1HC3;W`ihyG6{t_kCN7t_961t4q`Jk2V6Z(oE zOU`smojX{ffNUqG?f?h(iu~7qcyWcdM{scPKyxKEM>T0FE<;;uI(;Ks17kW@YdhFz zI5-|xF4(2Dv7AyyB!LEOOO;1YluOW_>yrgQjZC-{K8pM^9rhP5shOjr9Tz>li;D}L3p1Uqy(v8-CnqO80~0+H6D@26 zt%IA5qrNMxjRV=gZ}M=TkH!v$_U3ku=C(E@zwWDVVC&?_OG^4n(C>f$UZ=6E`5#F( z4*zTmwn6$|ztA(%G0^|MH*6};uWz~J%w3JG)IOS98{0U*WbiSuF|+afYr=p1^he}h zQ`P@WWn|#|A5;JO>7S`Q^uM<7*OvaRuYY|DQyAYf9{S(P=X>U?E2aVmCjck@QBcVh zet+?)E4K1n`!UXk9SnEr9pNC-7RkskpT`&<_bs7Haxa^T8$lY*PEMVl*Mf|(v6bWm zB9@9I=*NQ3FeUJgQeA#XZ7nS%FT7>%l|JDg);XA9HuYu)F*9$cUThR8lw1pEkodqM zApOUOQA4}`={9dzB0tT5VH)lu3;{U!Umw0HZ`z%-hb~ji$p6Qj2x5faWBxVp|NbDU zL&0E3oCoL+q5t25|1JHWaehAHcSsK_`hT2DGW|;$2w)(C@&7pEK_pVbhV8@k|Eo~@ z76D%^K)@UC&*ytnv1z=Gnk8DzMg_$hEnM@O3k`~t4b7j(8eHW!)@Au3nN5d`Jd(}+ z`yu?tGx3XSUlIJ0ZQy@`iH}cB?0G3~#u_&D*Ps<4A0Khzcj^s0rQC-R`a*#kfhotQ zQVr|$fZo228=k3gS)Mn~@!1&Qqj5^~#GfY(l;r3xw_?6{@dkMtYh$6|_0?S<@t9ZP zW?x)v9?(;vHHAYyj#fAAzGtDeWEG~kv*`pc4|_tO z7lZ)!K~#?gJOV|P#sbLo`1p7z>hhAql#82kO$*EcSoL&fBUcP7VYfYOISs3}oELe9 zL%07ag#G@ikw&-Tg9zVs{yzUvUUy@R$u;DFwyfnk=wl2GRc89XF877xLvRZ$3SCgT|_EOca=1fiIRfhMEq0BfkeYm<+xol>XT70}stH+@|9^ z;VH&iA^vUmzEW8AmEu@ems#jJav2}&S3UQk*fR;$EaruJ-#?FKczGmp8U|>& zbO_8=I$4fM@GIVXo-5<>n5AzF1DEI4*8EYtYmFEm?)I=dH$}aLn?v!#G+uJuR!=H~ z7#j5tbJaGq%0)`ZJ83+feU+{`VLb9V_Qu=!T$#c$Jm}kx68<^su*cBD;+x+iMx~h> z;+H7UBM|&V^%cF&4=Wnz`##chu33>TNc^Oq!*bu z`~oR%p~j<5Dw(h2nt;>(=kYsZE>=Fq`CO$Z=y-4YU(rUrVMlZROs+VW=JcOVXhYcd zK52l{%l-TWDUQeeEdTa;-nP>07*oAvOO?~{vYgcqc%3r*8RrGJ%iddJ0Ef&}vQ^wL z@2O)Ue}8nAX#eeOmGS7U8^ycIs9|t;f&-WPenQnj2(F3e@*Q-D2kS3^GYH#5sa2FE zwu55{5fKqNuX;*Bm)tf@(yhR=l49*DjYj9)lmkc=*>7zN%suX5 zNOWd~^kg6aLx|~(rE8zk;?V2F)Ggyumo-C@x@SF^?#OnX&nKrUE#&1-=&SA`yNOO` zwji3ev8(Lp(bwmDZZxJ(9!&rDBj9;_(6mj|&}gY@y82xxaAQ+dC$_BZs!QEOmc?qM z9d(vhp-{CfZr3+JmjBp~#cHOVtJ=g@s^APXuX@mSK?E}HO_-T^S#`bOunf&41b#aH z#AJTrg4&&mNdx-h&S-oS5?=2vHHBL(w-QELVfO5ST%}J=Hg>vm%tkX+fX3$*lU2I| zoHP$xj$nU0_L89h$2zsNQ6lIiRZ>wkUBbZQ(a}-++n=A*Til&Wx!7eWdsQ6q;&t8h%I!tHO0X?sA+bA!FJPvz{=-X)Y_4O4R z9nE(qvjRQ2-70Imjtx3fp^#+#nkBD$MBMx3`@V2~&qEqhg#R*&pYHG#7L(cgp^CY8 zJM3zh^nbk2$jf}a>!&~hs2_6NKo0av{AcX>n#sHG$FpPn3H*S&k=tW)><2Z#{6vEi z$qMyRhERZ!Te*?z=5bWpjBTO_Fd{;436FdAk>sB5d)3mn(`Vpl^X}}m{TF6a)ddbK zS134KxMZpRrO4oRPOH!FYj&h9U?(W02A|zFDm0m`mwA|%o_4;r>N9z2tkhpY>ffHp zM;3l?r2cwZ*Q>NY%zvA{g`=pO&jX?rBt6sWkXNO15zOf_mH21lJzxYO8-k?G?@_DD zd_zfhf~qFneX-Qz{0Z~-2|_!!jz-*+!7b*~$A;ZP`A#g49~9ODMSwR=C{}MViL=!D zN==W0C1Kq6iFNR5cRa6CE0m(BO%VE|H_rIt^Jq9P1s6|s?&dTJ-=M{18+}`4()sGm zp`?;h_RsF_ezGj0Xj;v>+?j=Voy($X^F<97y))vnRtksh!P6!$wL1pOMP-wGe^Jq} zi2l9l__faHN}4^nEzp#01pD%J9gSA?j4kg0_Lry6qvmaJ>CQou(LelAxQk@cxX9b? z@0xhd_Z=#|Zk$csL@1NkEh#1oh1Dl_2D@(`qbL?D*eW>h&rrp_SE;UT$~@j2f}n?c z{!BFaZ_7}4(Gx#BM*_UEnalp>2_0lF*vFXJJLA!G1;+x!#;MC<9JURz^*gdn`FY(P z^D}P6$6&g97(Cbj zyL4%s)+KEdvZJ?%pKK0O@=GV%Od6KdpM{s5w|Jb#M56Q3)L2fRxXNULM;d{y*XAzR z-g)PY>OJANW>qLbSa*5$GlP2>B7VBhNubiVik5&T<5Tq|% zn|B?G-p--B&ZoL)Oatqd-HTA$+!B<^bhMx0yf>Q6m`>v2xgIm_-++1T3%Argke09i|*?a6GmaZibfR&74dc-1(8rp`HrXJ$CAPFH{@rvvItTmCpa5dA+f zp}kI^9X@)N@#V!;7Sywj>x<-YDmUf!K!*V!M=Ua%gby%pw0ROp>?wCQto0W3xbl_P zNQ=#)yQPM$3YW8)?PEp@2E7|+u)^~MtHsJ#mim1rkU?{9gPRzYoEmW{IRc*uErv=RRGRLG`{o@Gw*n_VM8V}Eek%^VLjwoZ`z zG#x5^zg+ zYlu>*7H9NsRhc7rOqd98BA$4=c(IhsdAcdJvRa2lDUr%mlWKf`Y@Mgm1lgMva(6s5 z(Qe{n-zqzhPBE`DG|}!Z^4AG2@^>lFDM{+i#O&m)6W?{$Et_`&NUNN7-rvRVUoT}D znEZ_aU}3GLWlEcd7XLIBqLaeB6`WwQx2<6AZV?^xExguLXisxlZEPS6g6KZDGjrbv z;-zywe@@ku(q^}mc6LLEL%dxqY3}j7oxpiqj{589((2D|Sd|XbbRc*)R)^yf!7z<8 zaNfL4L#Gj#$FNeR)x!4RnAhQ&#e9Z@>dTj<*XG)R=)^C)gerpE#L9$i_0m{pvBH2H zxG@7*)=~m_smN<98DHR?28y*B6wajC7G(qV^OcKK$YnY3 z@orU2S=+6`ljpc=R-m-YLs4Rh3!BA-;E%dKi&ZXV$nG?6Yb>U!nN;_x@V(wl(alXg zI^FNkZgc{_mklKXuT~8kq0a$Ue9kLNYo~cnzIy29{)2o-Y>|ptprq_&qF3XUP$9*%@Wj@%^x&For`o&S4D|xTt2lf zh9$ZYmOa5^D6p8+g8ox<3L=JcE6dp(jLC4;lHy>5iQ@~VSY3r-C_GlmHcAaqb$VR zD&|~HC!E)PB1;fC!I3!IXSYYpauf~Y*|TUaQl-pU)kREL338`D(Y<13u|DvFy#RQAJW zXx#ZeS(l?7c-)Vg$ymH`fET_vx8Nw zqC962qUG6TjgB34OP)fdZ4ixc8FgL4x$uN|XRw}v7g~VsEtoR3e(Z zfry}&f1qFpikX1^0Ovi~`eS!LJuO`ehK==Hz>v4O*q75Tud~SJvx|7%qzu8>EF!O; zy#fXEmKb^x!ibMqPaEP0xt)8m!o%Z?`{O2F0ngZ(X){C?d?>(yR=lK$`?|UQgpK{+APy3aj`R!Yv zbPN9`EB>8%kWeC<<>|G-BW{eWcF0sY_0<2$*p^kxqMjZ!4XdY(eJlsk{-k_s>@H;| zePi*(B)_8n@pvLQHFi`dKF!ukum*@L{D?PUM-P2%9v}pmcJnqoT)&&TCM{B_d1Y>TF>|pb`wF)7Wd`4rlKHxL zTj^T4KPD^C_1JOdbX)o}CZRKDPIy>AoJMcYdCnBHuOHx2$z$;$QdERDjz&$P&f@}l zVO%bLl1cwEr)Eb|fRM{Y9CqJxROYPN!4%g1g33nRYmbq3-=St1p5x1PiXwwGr=lUi zDY%Zwb!WurdsO3ru5ByTbTVAWc%Ce%IM)0mt!=?r+H?aL!Ubej2ZINa=gno zW4%YE>I{di7p=eMwdowX>`csVb7{*8{#NnPOQc<&Ued=WlHqtc!fmGtqbw)uQb*~j z&N{Yi2aLA-B{0&gANLIYin^>Nj>a&%>5Xmcd7RZu`KbCtjU>)!;J&llk?&2((;Kcb zp$}Jmb9%Nno2ppGr(3jB#U{ng-yQLcs?G8~YfstE=*gb^@ih+|i8@L8tZY)P8CAb( z@exN7TKL5TR+jPc=PQa}DavrCCFWVE)pr}&a@|5tz(Sxmu%TG3Va!b=vzy-0-1S2f zEuw9`&U=-7y}`ZHWE|-!;zKEBNbNN=Tvhkn)q7pXR5lP>3@>D>9r$#=)06DC)b|n7 z*H6#!PVu5AJz=QJn;&|kO_s{#EOqYE({pYd+ZUT{9Q+gYt9yFyG61+H$uwts1P zsO@d>HDPSK{~ovy93>sjlt{Shkwb`-u#D)rF)-Y$5ZuBT=RFALKL3Y>V<*V zkfvUlxX)js$a5@W-%s(mua8w4OPb#IF5j<6-6X5kl2Spvjn^YbD*^ZL;-K<5%E5Al zg6D)0qs|rl|LKC=#8(=9zid!Nb8a84k`d*VbliDCdI82TPRos^&h*3T?B~TeJ#S(T zyY{}R1cg*;l@do4c8dfKzxo!v^4{t!`ecjQ2Fv*2fhb5VEO(ojz>?}pmn~_rf|3#<~CHco=T>;sV7`W*y}R+GV8E)>80PZ zbpN$CrPZ|;(?g{%p8im(&U#Vfy-Km!pe6s3->|}A$3!UWe4~lcbS8Wuv~<@}I&T|x zHu5$ToIn#V1_cU*4}+UUuOub4t%CnVzPEBD=1eTPd-1gIr>AM@pZ8Jd+?p2!`ESRA zK(Wzb@-I%Vu7xVE^&HJu*m_F7%8Er$ZCRHnym+B9h(~j^V;Js{orZq$MzO@^bZfA{ zCJSE*$R|WZ%qjuPV6tT=b0WNxVTsqrH74c~cDn9x;<|uYw0>ffl8d|TYTQE5{;b1P z?X?}>_k{ZX6m{m3)eKC`p(Y#;DIA*DbkVIhGDP@LznW%=*uJU3@Sz!YY$EQu|15rb&E~ojNGsCZV z-Vb--aw|%?C(AK3r&ocBbxpX(siX-QzZc%=U`(!#tCp#g@iw~D71lR@GE`?Ut!+L# z;Wz3U=Fd~2{Y_x`qM~f<-U*HqU#?yrQ$ZwmCF!x+t|)}JLv(asQ75suFU-|g8uw3? zP!Y+hrtx5>7Sj(e%eWJAnJ)1Fig@G7)EfHw5DG4k_4UQQf|SXMxMc9)V5hB@=;kVU z)N+y6<08nUVR|jKWpUZNHO_QmRyFl5ZZL^g6D=VG3c=VAvTc?x6c+CNDoP~I*woy1 zt@fKPB8hm1!2};|9Q-l@v=;aj$oa|TLC2_D$qq}1Lv z!Xu_oSe9?V_!FQ(p@-?ZR0@atnVLWiXkLeLdr19zqLDh6UuapZDakQ=YD4FfO3b5H=yk>#w7nCpBXN{~Q-rcmCwQ7l@ ztZJ2?dl}TrY_zF;6st-t1H@>%Wm7Po`=M4_EjCJ*T8;gjYtF`{rEek68ZzfS;9vGs z)B$V~%dD8eQeLBm-u41|?w0%S99N&_s;gCcArBr;APuJn@}?p9We+{q0z{I~GUqkT z?p+Sc%?9kcNBTMS*8?Da|7ZW;jVk)qo+-s~{P^YRl0iBAW<>OH4fRM;|4uZOiSz;1 zwmS-siv!8ytb!w#{e{&Vxvi8jjWg+r@w}|@M*R8Tp8vPt_Xu?h-hsb}St7#J=X6a{ zzhJWIupXbL-TUXh-~9Ztad^fj38tCDK5uPK>b>-WjMaFc&(?y`!}nP1PIf7Q5f325 zknj&ya(}c#ETvF|2p1ifZTlYP(2h$%mHPvgDc%HYLk{`% z9xLoMF9OWUB*8ZWv)LlBEMrfk^qS&vlLsA+J^wvLXsp-Cf*#?L8dXr${497do}MRHy&PP zzkNP!E|)0AVLoa@9ZyE1`5hazNLW0{sCP<4%YrtEPabNsz&Xr?;9?TvxCXW#V|DW? z+@TY3O*GB133$4v!CDd2mqzgu;mbPlZIC7l^aNMfGWC%nbhw#Ty0i}p!Q?0e} z3~k*^@YV0VjlC7P*GsBD+2|71${PHY96`X#wwy8axsW`ZVf z9p*%eo3jJj9MUKet77e@IM1uA?Gp&M;b!c#PQQ4bu;#-V@U_B1qH(9`8624|#i*o zbHh@xgj+{-$z)wLo>p9pH-AnGtH0N`wayZ0M2@cn#&l#Y&$5Ieg$7_F@Y*qSQ@@x3{Wrcl*d-5+TfS3Yq$jXG4^ zGS>YKSuyfqr{7n?c-VRMaTMml&&1YNz4#v#R}x^!>C1x2#at(9Q>48e#Ze;MUB&t7 zW%rASbirAdVtj#Rwl7m!|v2-2RRed@g@a${FdKgu(ZQ*IE9rud)T+@cYQB| zB!YHb9Vl5(k{p&AS+&KjW;{MxWq)aPM2z;d$jf)iLHhpA+|>*;bBn;Giuu$ zi%mIqo}IG^$PaG39chIB^&H?y6J*~RPpuBt5zUqJ4F<+OBECVSawpWNwMrCVi>1cX zJ+N|-k75#{({7X+0`l9I1c!uFM`d&1=Q7EcT5*~NAHj)cJ2)d%AbV95INd-_mXWbi zJl+v<9>yixqE*C=5j;pFVR>9huBSjnVarKM2AHKlftb*2Uga8YZ`ew@^w%$=sj+Kh z^b)uhL5MFEZJNy!e*XNa#=Se(@dceH!eGQm%hMn|-)6p4I{78~RIQUGm3E_J(0sir zo8{aDFUX})b2>Y41E$YvCV`!{^Fd=UI@0UrNGH_7-^K7LYrSi98;G9K*Upu~El{m1wM3!#eS{|-!~E^y zyQW$W$DIg=onPetulRR*M1-Q`Coax4|? z=;+uyXj|BX(PkfR?kpzqZLBk=s~ol|ClklKGg=RJO@YzsZMSPIRVIUYLo9z)Ebksy z^5|76Dp4`NbYUzKzNScg!o^pmm)FbTHUyydD(1AO6XavKx%29!o3*Nxw4fr0lf{db zES~SC<1`s9YlBh%7z-xA#b2FAHegiH&M5(1ifrG+Y@sqWaDE1*25oQ*!>m9dCy4c@ zg2X&OEEAOJb7|>KI9qfX+Dbas+bYgRacXJUBhrf#C;WA)APWsL%3OX*hdR8eZinBx zMMLdFoDb&6i&V-WOMY$-=JHpt&^t;Ogtv;V7w?7;rdWp)aql&UB;pRg8e>{W_YgZm z!HG)y&JjA8`|S$l6_;qKTE^#{)5MrQShg;?E+S4iOl1wSUEG_rOhIM4tJUXxNFG)s zeeMKx-;4J@%g#8YGcQ|_kxsfz9cM52{xypTH*pQVP^t7S;`O=YC;Y=$7{e`713aox zy?gT*eh2!@4KFP zPQZyh_me7-T5|uGme!{IN~cf8eC=(HOabXwu7#f&v>{`FtwVsH#UT6b+qdp!BO8X{ ze5B~mWyD??S;Uv%x|?(OtH8rHpcTIM(IEh;n8b?mD>MGA8L&(f9_~KT(vt|wkyq{S zTP`?G@$@)W$A?qgQeDr_r&B@_lhC~P=WWHO=~8)XKMgN>kM3{{tXQ!Y~NZE*NTe{FGO zR1`<+X&txOzr;2y9Y(;pMsVSKa}e8f*f^f(B5Ss?w+w>{o%>O+qaB?%p4VG+?>gI3 z)Ll)~;r-$QM#@wggH*!L2Y%NU?qCq;jFM~$1IAELLiDee-=9vKAwhdkS&6oTR?dzG0fLv)rCww!QmoG@W9&>@|!V z*JPLR;pECs_I4@{TN+jfaVX310sy@s4T=C~=^aV^r_!}jv~y1vt_q7h*@Ur1X|(I* z4(h>dK#-IEa2jul)4a>RU2fu^diD{$T>E|DfVSe`BS{rz!Dvu;N~D{IjM)BFunOEp zA%9kmY6;U=l?g7DMmuww!{m3fD=VlV=ialzVl^7Ay%@Upt5?xWKYAD9Otry^-na67 zF|=g#VYr68Au^~*o=OJmYa3AXF3#tPW&t0s+nyf8OT-66PVIk#wX(#7-`{*QgENHn zU}WF3PK*62D0q!AWpqyt#I(3WVyF}WF|ab8M2q|RMpCQSMo>R}9ohjVMR%Q*oW%39!qZDg6+00fBj)OI>a2IIQ6xJ+OWQn#E zNnG5%P@MMYl3ETJKc&*FEgk?ei+U$8DSIceNf#!b-Eq;x!uYwTu#lP<=+KBh6!xE% zwjmD>j+lt&26~?$gUIE;?emS+$@}wl!+m(;XMNPdq6zP`>dVO-M^GPM_86wkVt#>I z>EHVz4ju1J6&N~YdK>7#wG;|HH6Pn}*3juFw#QhL!h=nlCmopU`~<}855uLFIzNg@ zVF_}42K&;xe$~ge-zSqhF}uIke(xA9tUud+xge(1aT5C>TKY49C> z3s2f|_CzbJW5#?Y-S><&(LIh%ldeCGKH3^^`{p^FCCRj|OUceii1Tdu8>*cNoi6qV zcM*{ULqom(XPvQB%YehTqT;Q>Yf%XLkEH1q|Zu;=I4T>{<1fmidExMrMI#)Fu=F=z_D#hX4bBP=@o}#H& z8WmtqG~Ty+Hx#ZbkF_ncPC?_QGA?w2L#Te2<^@Qce63Its*`ht%%D9$nKkFU<@ zdnhH-ki$bBetUGN+RsNNb8Yc_9lOR%lRMq2quUfNOI~$l$~3>*@(?h4K+rF9qMLNi z3NJ61bjKs(qrxsVa6*iKA^%ZXUhwF)T9t{k+sIp+W93)LaD37;3K^bmmQE7TFiM%U z>d&~WU$S*v_UgEkvzxqI=wG|8V{DUCTyUj&yKazS>X2wXIg=&8)B>Hl5Lz8J!J4>m zJ*gUkTWGl3SjUZ%r%F<@Ibp34FQI0$6%Kjl*6Ashj?XD3hhf2waZCn*17Id>ThPmgPcxwI57> zYi&T=cC&OdfT3}J_L{D58tvxdFrNJmYP;(Ku4z>Sl(_yQaxA(VWcmS_%DgsqaW_p>IAHk1K5K}{c}#B zTWgB%?zQP;@;sME9V&5RhhI|Jho4{$dGOJX>J27VnOqHAuY0FO&pD(`OnKCib6r8Ikey&6ZoxL8PN>oWxcRvqiRIy-|sc0^g#%k3h6CPqr%#;TnX zSQg^GATJq~zMbs0{|C?Y%pW;2fiSnF$^<*}WTDFvFu~n-#i>!tfd+V$g_sZT|UO`P9 zn{=(ts|_R1hVXG^uH@ZBc_OXd)7Q zOcR zk9T=-nzpz$Es@F$JX&jmp`CA-V@ za&hCVD)Dq&zk@q5nUK(4Yx%kobYnhuhFZs*v)(wpdsS_=wD9OlTEtk6MDP>uyBl!b zVlu;jRxSi`pJ^RE8|WwA0=)eyWi9qfsWef}v3}d$xL@2=@O0qEqkY25Qy3f+vCH0r#Hn}LO0I#(3TP6~a@w*)wB`PI}jB)2<<+~f@A zO4PG@s3xpvlGN!;w_FTy6Hzu#ouS+G0bNU0D@bD#Bld}T8sz)lra;WxWDbbWI3h^~ zVO_i`?vR}~vDB)S*QY~CK0V4s(~ms0^E*Q6b(?$e{OKqtMBH`9hmrj}jea5(Xcxu3 zq){4aWFPTvM3-*MDziE*NDW&u)#BFkF?%w!P8p^N^?oXyzVTTY1sWC>uaT-=qZ0~a z#QRh zj;I> z$l>tsWAm9NLbD813A^i^cx5pl!bd!rXS}rqk)kR21*q0`InBH~%iyn!3E>424FY3C z5|dl9z!!4n23)1^-_ZNPL%@)dK-kOrIirN?{xn{XeevIolfDty=>P^J03KezpIHK7 z*gcH!(VQv?0sqBJ{u&iAhyd_7eq5kbkvSQJf#GJKU~Z$iGu;2#j{6(Q|Js$#i+2&K zGBKwgf9H;W5VQaZJMu({q9}~CeAgdO6A5e4>x;^fG+ytLuC#%=e+vqUDb;Qi3nyCq z1!x@RlC)29;&q+3{sQ5D-3%t+Bnl2b+HH4wOY0%Qe;~$xjk6CGX!X1*b{IW`HSDSb zV`S(k*i_PpPgN5+Vb$#93ba3iebZ5Pg1P@x%|QbY5aqC=kf|l)rl!y*{{waZH+}!IrmwI) zaBc)=H#anYFr7Q8K1cIvr=eP2s0EXmwDavKy`D4DNSAd?L2`!JnM(jUWZ!J~c&^y$q9x zh;I7%4!!;rO3!YU=|(ruJF1AwF{Ur}J?{3S#FO=KOswcje8<+p@tn=H^N+x=xKMod zzS6~})VU@X5XEL+jPz|uN=_PMyAihD{kA^X16!RiDZ&QQkJn50U-i_F+ zL$Aj&-I%|HhQ@#J|6zPQmIG@pMr&(wv04@+B_kUI?mu=&IrRnv?@bnpccXzztPKnd zplMk*02pVZ5Rc4JVETnhu?mhW!^`7==7@QQ{uR>GGZD>a-m= z#0K*<(Fa@J9CUO#KL(&%F8rSKFUTdcL04bOJk-5PGcK+GR`)_vx7S4uTB%1hEiHoX zhh82R`{b~P5aqBvBo0d)jlkFEOxD+qO&Z~cLD+r$BX5LCPQ6b{>OA?dPG)?6zxPJs z_bABxex=iah_=z}`f-Uj-Stymt=mDn)B&f;wzlVSf1;vM=&ueo%U<)*aBY@+S}raP zx@)AEs=8Hfc@n_g?O3@WBG!m%k4Cw7hx=^3xgt{czlm2=COf!kiAfSbs}dTK|`eWqRZOxSBmW`R4lb#i?e2g5eiS z#Oy< zHES>QJ6*#HPD6-pixia>%D8sY{FbLxCaJF$m$d`w#_Qm~#*i-_E{jPo##JloI1eqN zJ(>dISz)=YQ^ON#i;?^?gXtX5e(mMl&@|H_M7dOHwvS*HhNo#YxV}e0+;zLh(BkHsQQw0Icg#OxSyV%+|Djz4!Ld_HU8u50w|k*_R!ov1r^5v_e9>?!7>r zJQvVn4-c1f2;0FnI)urC+lvAdKlx=yKD`7QAJG_L|H7o#0KKvo5GH zuR*5P|8GnVE3Y98F*I0p+VAQINSx4BR8-h^J(AzdJ?UTIO!Vd|QYndw8`M-o2eGdE zphfQgf9!o{SX0~9t{|X@Ac}y1QdB@iK)Q64-j&`#>Ai!LP((pNiuB%l?=4gjkzN8s z5(pqQK#0@;q1?qjM>l65_jmXA^FGi02U%+-bImp89QA#Nk5QSw-D#aJEaM7HvqVlr zt*T6Fr51?)YKGkuG%Fd;XiYNk$l=jHsXVyG%hR{=&H*jBnGuvzO+~G9{;nbDXh)%& z_8U<0gkdN_#xm(HqOGA!x~aqXu+ z2?DY%mW3~|VYf60!njeN|0@-qO+U0>sB{X`v?gk9Jzky*7fKDvF1HpdI{wz8FS5U_ zY7Hld(`Vu%p^kps_`2InyVQotS=8rqR_cdI?8-&@u_E=V6^OIPswny^k}I!Y=31!9 zk97a>%|J7gcWJrGWVew1uYYRdc?tiVUe#r~rs(uL%&Bo@yo0Gx`$qvSVMV?5O1sP* zKcfbxru1ueQis59*(j!7z*82|Nq=J0a32s!0$=Vc6`Ex_D96+Ujx6!JY4y=HTtY&V z$cN?OIaE}x4YB8aY0GKr;j1cGHqzAV=k~IwRN%MXA*~Gst!LkEz1O}1vW@y^nwY`y zfRjT!i=--Nf}%zuAtN`0QvPP)gF8E3XzL5|uwK`To8{$?yv7g4Nr;KB)dVoAa$3Q- zIcC(jB-dcgy(<(I?fA4W zR#q14)+upED4stowQ~EWfR?OSZ00f!ARu(ZmaGelI2|J_jl zQ-LH({!U5G(zbG%$epCuW1{tUtg#oSmU>+|q224P7k(MwTnw@R>D#}!0C4asrRWuL zqF{GHy$|C3-vUtPs9qXg8O+4`WDQq7O4eO`q+%{Oh9yTIUaJwI-%rg`{P5j@(X{Z* zx&do~*VWOSro9Q%_cf{qjsf`a#Kjm)?<^ zvD7b>{IiUL6<5<8xnk3T3Kumw_&_z_{fK!Raex4$W3QQAe|N2uOuA-h>FTsX;{29~ z@EuGGA>sQwt`=?cX%}|AlBI0)ih1nu6%sSrraEbn9nBwpg@5Qr@d2PHJpl!UXmrJK zyFS=0;W&7W$mQ}ly3^Gu@-DPnmO|lIwaG=3QnAGIOaW5>c!s$ALo|@(@B6ww(O722 zAmqLG4gmGY0zh>We1OEv-|O)@3hplB?XA~_8l7oLvTNd)*!4_C=PAk73RO|ob8*uO zxO}BfUD-~6IBm|~x0bQ#N94oTrs~+26(=k!1#gNve!2`&|3Y=F8*XdfG)fXGDNi8_ z=uB@~T~-<%D~l2c!`1N;xRGnA%|xRlHJ_CYzDlhHqOV7wfM(%}e9wG>0|TlfX>}tr z^ERlKQJAPhVO)XL&=*@WX;t~k0y$Nccesm1kGoi%Sa_|Bm&{dYtEpYbiK4yzXR7sI z`Z!xs4Bgp!G8Uk=& zN(mAwAuSQ?cOodoG4oF7bFhU*ziM74O8Zw_?x)=-Q{`u-*R-%Wy9pqJ5Bm1v7cVut z4cSCucTsV#-+s#RZrB_@szwk^3mls5&qI`>h*L_ySTJS`I|E=XO{V1GLBr-3b?fY6 z*qN28DfbWAUP^hU|9RG%r23@{3vPu))bIc%YYpNi@y}ltqqirzD`{q$C0^alsr~74 ze+uPkJ|SDW&TgQ562C9N{g#|=2uV@1E1cI_V91yI>n7j>mSp7V)XDXkJZtghw=@rI zGiY+LOdrED6(o)>)+|d^)m&0akq|}X_#7P!ILsqfIXMmUpFJ7&8>JO)l&^Pe21pX- z_JaUA21|7;P@k?ny?-}tu%nv0Lld6kS+lbFX=@N(HBgtr;0z>gon{a5%{@9d$&-;{ z%-rSA1?`*UfpqJ_mnQ*DlzEoNNwQHn22-Bn&%PgEa-I|()J3XnKvSc4U;Ki4|8(^c zxSl5sCKH^N6HN^s_lNK}6PKR*4RewaVbpsH}lVwf>(L=OpfMo^sN0`}cK8 z539se#k)01C&c{Ab$JsZHgeXieSYHScq+5>6I@Sy=u=Nh1p0w`SN-ha_^Jr4xbL&pKB0sbw^gmQQmcC0{ ze`YmMgNvJj=N3^x%x%d_Nk%P=1-7xJJC2TyUmT-q>}ARBd2A_)mss{cu6QN;@>~H` zJd5^Jr^1r7n#q_+Z!_g`1Khs=cHcN|(JX)cQ?4=NjZQ-`bDfp(t)q49XNJM*egNNF zEl@C`asmF=vZ@GLoc>tnp z$f!J}?rd~R6kV>;&R$;v-(VJP^I)mjYtE@olETp??jVvQq(LY5uh@^@)qGk2$d0@c z`!Ko#dtoQs?{r=F!*PDyA+~$b#JbHSM~*xjlvGP4u*JgO`l%-|E<>);V`KGfvsh)UCtVuR){ zmenH4`9L~^D-Bp{C493_*iOioP#S@vod!R5Srh_;0jl2@3e{=p`sE4$pSMKGRiN;# zzRNxI${5-Cd&b6d^UD=;yARHsOdrH@f^&V#ZIdo*0}$EGo71BC=k%D(mk0e)&cwxK z;>2P}y7l`mgG=l~)C;v_3niuG5=M}{ua-qrOXdQt%VL0FM33DTzwK*m*h2Y*;Z;Sc zuRb8`<0nC$J_48hNw$)QHvv@3=8u3YI_X{!3QoUnlD=qxupAl~0kjwuR!p;of^MCM-Dh)~Dn4 zbgiVu4$R^=4Hx@jJ+>fe3!lKO{sX@J8`f09R?%J4iLD^(vEut6Ps}xpZX)3Z;U?q* zvRfeiaIF2TOZ0~=Gl@H`xc>yu$o=J$3nfc9rw(<~@fVu$Ex&CcUk7Lj0-T31tQFre!x8{FxbqYMWn|~%0 z?C*#Fn)VU@t06I#cS`5s-pvhk4!tAwFOGUwuv2$tRmMA5na2sc|YE|1-nVR3H3r#3b!i&B^t zHxObPq9`SEWLvZBs9R%&Y<_=J&_|DgO~;1S-P}URW%*g9k?hp+JHnTz)G!d)ktR#k zgjR=)dib1m{(6Tr3HD07i)n}hHvdT)qPe8j^4a3lR74*I<9^q?>v3>$|HO z&oV?r8!_wPh5kB3rNMyw>edCc@k(zzaJp_A*a*8P2)o-=E&#s9nAbdzz2_gK0qS-c z4k|)KeD`L%3U-UPQbs`Fs;hsx7$jsjgq~q9tZIQ|){hhVL_$4x&Lin2naElRGmf8> zMl~o6teqG?`x9U#7K|%<)&0I5#a>S&Q;`7>3oR*j!S5iFyXRdkeDMC>bIu=R-QQW` zSe1JY@~=#4mdYi%^L3`=JP(*&`)=P*dNLu@1pN@B!@c?>$PHC&iA{U+=JSi}sSZo{ z>YDwnf&GpRI^8E9cR8`TaIjUsRi3kW9JEv&V!&$cgY8e)P1V}69%)Qu%F3X?G`zAe z+j4Y#kJ_nWV_HnE(yC&BnZ{7@4L*Q|M_x^ z{=K^*FxsQ#9kYAnr!SEtr&SvEXS7Aq-&?&%F_9s;hT;MHy9o?s&4L7*g`pUa)klk`A<*RNsQJ(Dqny_D zRG#HwcKiN}X8&PC&a>j6R|_$O~4X82L%WH{yYjLXL@^;bo9NQZ55{o5Q6 zqb2*g3Uzg#as-bSYO~z+-I*L0{p#u@bDS`I@0Z!{fAcQsHbX;r0v`rQ8qh@I0daq# zZnuSMsawKslO`6AQz3~dtSDjfTdW8FO;0BV!*d$hx&V@O8bo{^zB}R;YxB#gpC|D* z&YjM;Nr+giLbk)0{{PM56PIvW1VgJJn=v|%v2EP3q_fvNM{OLdb!qfEg>z?scq4{OK{LPJj z8TTd~NK7;AWewf^?`i)$W`3JtyI2YgY~RV|{ojsz0_4)fe@JJ@{$HNxFB7FF)jLhX zt;*W|Z^ymH#Zw5J34a>(+vhk98vgzQeLXOc02&4R{pG(OhlhVL{&G9rTc*EQSATt? zpDx7D2NH8Q9azd-^S>Q;@e=7Hs@I~I6wf3(|8{z3F8I%!4%Ab&`c<*_&mPsE^g2+M zf#-WY@qa6)?Wgq|^{J!3t>^e3Bo@e*x0(DUU;cOR?aTuL@nDu`=`TAkwU>PS&1>{0 zz54jok7w_y-3hU?l^G3{)znA)u6XNC1d*!H}^k&=i7`s`A zBmXa6zCT}m#1cMRvMBmR#6RT36bqC+CivSQ`~3xgrt z;cqVVc9-O#F3#Kf$5$+YjhL-ZbVJJ1n5>9G}_k)|txzY&XnFUpLv z(R69bv4(c92V2VRD=cRM7hlJ4J#KfHl+g+c`FzgLmqD81Rs&V5q|~?oKW>Ds9W4|2 zgXk-v1jE5Dgr`+;RQxLyE~s9m-!Av>W?)h)miiU&l4sgX!l)(q0U9ZjUTt7&PuzJ{ zX(D@yzI~|Os7ArAohTeSlTSr4lrGDP?B-6G4NwJ~bdvo3Pvrt`2J5qCPoDi*Y_|x_M8oP> zB~av>wyO2+ADm)hZkOiw7#euAHdonC%t1cKNM@?}9;Sl!NaIw{cwQNSR@hCBr!F*L zfW~&@Em29Ig-+hM;*)d!#gy*=&IADo_bCC_%Hx@v9QSY&IE3ns`E*X;r`Ojghy1=) zF0dRNl0Hm0YQ4hx_r~EbRrrJTU-jRhvP(xfZspnT=lX#Ql2(t6U-NgsS>le6b+ZEU-Ujh8Ut>*a?21|V@%s?T5PhEEj3!s}P z%yV(V{4e+G*La4iDR1}t9z*axPa7S3HMJkQd%WB0AxXAkwDA+8xb!($IPR@T0ssf-19eH)K&Vb_$F!Q3|Lk9|x4X$?WjsKhT6?c9iuF$4y=L7q1X) z#h;;wr8mFmpiimO3Te?7RJD0VKbWIh>=$!ZLL-dvowg$;spppgP*v+20uj#(qPg2d zJ1Y|%OI9Ut%_9*$GX_A~g8j(*Y&eyCL`{Ql3b;I04SSN)PI-}Ai!wkz|GOVl3G=eF4V`0>tENW9cJe+AN+oR11(IdXsFCHxWufX3X0{Oho| zQ<2`Is(6o+YXBN1Tp^94!^<%&aZpj*iI4Y*R)3?mW^DVl#z&m#`gPM zO^qa|rdQo6=7vm9rRi&?2d7l}m3Tp42FLAJ3{q+GoL3?yr@eP#s%;^#Ic9!v zyJXT4ZcE$i%2e~=_4?(g^%Ow1N;VLUj14iT&I9)s4f%G{tw%{L7ZOtN_UB4V@6B!_h!$Tn@dJ)%RnvZc<3W>`+Lx z)(%cV9hylV=0{NBbwPfm$6q|~>%q>dDXMX26ChUPhhO02_&zLM(%;0T80N97jRX=N z^y=lrxEHfkXEu9jdga+$A_kg;-MtnkmP}AE*Hof}f8w>!6X82~w`J?FYBzFEM3f)` zX?Sg-JIw@HQ3^A99f8D6d>ipln>W!zrwp`~Hf^;Q*zV$G7X=k@%bzP%)S;se#v z7XSC&h zQm(UT3-xi)i9-tbN>))xB@_on50Sp(*2WJ|2cU>##fACIN%-7;N>z#)`4QX-Uc7ww zmFZfZXGziGga&7vq};*`OVhGZbMrfm8q@ZwB=K9mPL}>~;JdqizNMfrbZ)N$fj{BZ z9l?-KuS#liom4IQzLMIcjo!Up|1EM!M;wxy56Mlm#df83N%0d*(TWLZ4<#>SAUmrA z8_90%2x4-d#x`4yAdb<_p3+GuM>?E-3oZ_TQ1+Unm_6^__uev-*-S~=RfuDjboj=N zybgg>n(IPZH~zs%TmJ{f?FD4dX8oM0=07tlZ1a z8~EzGpEH#zPD2Al_8i`o4S$et$AwKD1f&Q|$W?_qcI|vK73()Y>a>nINaBKm!y!bi)`Kx<}A?yn&?$cE?g5D0T zpwS=mEFi<0!4PtGCV+$K*$_g6g=RJ(X*C-HY)AfLZq(W3^J*{1;4={q>X zo=@QzV-2;oo-JTi)b@T0CTIEl*cwQinHuHzaF+Xu&XQE#NGL_ViGLu@B;DC#?KxvJ zDV`pWY}5xYlO&0V^V&~*=Lq%BrhMj$$sMCNCMsENQp%CVEWGrxJ0Fjh)~I)0WLc@v zHx~;3CpzGdZB$Q$r}tLY_fw>&Ur6lUG!Hs3lx9lt6+obb^DyGRDpNy|y8Q5^ii6}> zZ`|V+QNw=P{Yyrk7kJ9djvoHXtNst0^wdrvZNkOTe8Krj8DBb<)Ia`#%ojCBP6oJ9 zLfdtjJC?Z4T>%zl02f2lyhZhE2OD+&D3h$>>;Ghd0bN5sga4ZMkv7;&u~k_qCz$*w zkx$6G&TxwZs9x6-^ndqmD_4FU>Cz1%R%!>JX^eO823hyYj;XuJ$h@^^!Hnh1drS9n6#xsC0Ranjz3T@ya&{61=~^xmMEcM6&ep9=Z5MxM0<_(Q==1I zSHCofm;u_(nmIiK=oWO6T0YMsfDdqKY=3i-2|M`|MN3xdM9<%N+|r|O;`o18n}5v5 z|N1>rpxYo&2-B^3M@lAYv0t(y>IKC7^Vfq}FSP7{)`O48YMioWin+}WX&=@a1(`~( zGJ{PoEv*k*95^_5rOj=Ck~i(EcXayx`Mq^3SAolwCKOM-L9tea#Mlq=H-=3nvYB=P zG5<7rfR`sG=H6X0+kG5BAZr0(5*Z8&bo~-a%X)gioR(y9gloi(mS+!;snUozW#44> zCMQ#l{BSbU!5{*~el`yGaM@XPW)hVi0J3`;#d^r4$-dYT{OU_XB-hR`gA;8fky=+)SriYoNBDcwh8H|5)Wm0ZNA-8a<7PaVC6o=ae>iQQl|l^ zW)u-|5Bumt^d=~%3+CF04X)N*{03WO)qR=NSAFiEon1bVLB?aH-(9G`kgda<6Z0dz~cB2y9+x_cuJ zryDr5zMVL}Wpr&1CV%ki;b2=0xz@5e19yg3)~pWNE`Y3&Ef(yCd-dwlLY-`sX(HkB z)z~JtrFO4gYQ53&1}_$%Z^-t_a0f{3b(*N%gZ`C+NjOmOICa6}Pwuq8Gai5H-w(Jr zbn!OO+LG(6I(NUES6Id)URZ9lye}>$9+u^^_k@I2C_4Sth+j$|V>8%Hd8kKgIq{MO z{xGl^4DzpgDk_VAph1gTJgc?@IHID=GBSq0beT(}z-lC+bBJoe-Oq&v$QFatza&Kd z_OJm&vCX}E3gEK2E6DYJBE}{XW%5901CSxxXKW%thwVY)-?;?0avgAouE&lUV2>iyhT9nyLooRYiw;i-?N9F)@p7-5`^$Fp~&_Q2GOfNqr_&A0i~d#Xg4!7h#^ zB>+O?6la1p%(DhpIGG}cGMZEB8WN=bk;#{H5zpmq_grq08L`USH}gM!jIw$0*-YNc zP)vIDA>5MQ=HM~_KzvzU+Uz>jNK1Wsp5hRH=}+X61{mQ>r`tc^S^bD1*7yedWa3oB?v zV$7~k{NrtWNGhXR|LQ%9PhVW7d4Wlz-{_@}O3y|><~1r4k#C8z)cGMER#O^- zQs9H}9@BQxuMO9Jm_v{Heh6vdSFfadL4Isimp>xYQ<@^jgJe5u680?}91G1KVRC@* zy(Z`!-b7hq1o_>pwgxWqC`W7Ax&qQI=h3{h%Q5hkaSl=Ww|8HOtL7cCfeb-vcn=dEpZAb#nu<4ZrBQ(9HJ zx#;}6=N-*h&R9lxnWwr7#lDBm)ip%70qCl^BmLxkz^I_YtM;7vw*rcKVQq7pAHVvg z{pnua`}%RD$O~hE?y5kA1j4abs3qR<^4`s5h)}@Qxy7mVK!S;kD(N4X6*4by3o<`t zC$jTQIZ?9eeD0)Eb)PJydOc4_&J-{&L9qXV`wDT4Hc%u9Xp{&#%R>@&tp^I8bTt~u zmwA?&luC3KK@IuWxlU3r<|TIvSo`p%c-E98W$lFn&r8zZU{N3l205)UlQTt$C)l2z znFZ2*auNkgdd}JZUINld+(W&%$^mwACe`tMBl|OEtc)yf0n?*|$e}1_!;1<`dA#ta z^p5zic^)Oy%M}y*N8cAS;xtW-`wU~jje5`6?fJ)0HDK+x1b)fOYjMA{)z@=EPS?*Y zIX&qiu4TXpDgT)=)H5PHh=6gZvU6c{|7i&R<-WiE>#s%+tPOdx3CUlZcKy#^<3GvotG8ia}Db-iq_NjCp#!m$;TJC#(c0e93-x+4+{IgHSnFaB` z{@};rYJkbNp$wqa4)QVP*-7c%M#L4#xQt)h6Oauthl|A}SLy{&mJ1bZ`jMuZW{PQS0HNx~3v|nOiK%&%Vr_GCL%HjlTcRI6f68gzeH#fu z_O6}+G*1nWd(MjkF?XcHbC^iNc;wQ3n&E42gVq*5y_TWgItd2w1WL8GaHcA=!S{(F zLD9DzRL2T82WIMo+?W9dJg1e>``SRuxTYjr#!1Qm@HnnAUWDsq!mee5{#o4k?Q?7iQT5 z%ICBOeZ>4L{hik1#lrEcBNNdQ~L7i`=Iz=Zs&s_ga==!7FJaja= z%1qloNxCH-UyBw76Vytu8GN{WL{5#w93%|79wjO~7{X?fHdP`8bj-+kGUo)@-PnI|euV?@|n zvI7Y1WSi3n5f$eQpPgSBE7Ihm40Dzcj07BVne$s7VX6AtI@sZ}X-fF`=z5IyN_H~C(J@{v72>lq7cr73D zX_P)>R!Y9;*Q}VTKf2Kilm~=-vwX@cHgODmJ=-S5JPvY+g z_W;o8-RJI{1<K$i#JWu9e zM*_fDa*k{S>~X_9oR&V)*xj@Dm1#J`=z;3m4g z^b|L$yJzsrnMMBha{K#{TX=W*c4}`XwDMH*jNR@ErK2nF>IggQZ-{LY-IX`01eh3i zzYfHM%h#w!J%zW2jd59t0Qisj(1aeI|{p0?^D51RF;VOH= zu9w#L5+T3w`6k*FsKGguXC$gH(6Ra!zmr7E@h(`a&Ut(Jxu8C{=H0t@#X1zLxEsmw zqpRUd>v*5n4ieYL^1_QEvo+4A@)$SHbA$t@pKPS@w?+_{*ka{YOP*4S!nW<*odYsZ zP_st7T3Vh#(tGD;=Z9belF1>?hg*CeY zl5IIsKi*DuR)l3hxZT&{M=u2cg_#rU!d{0e$A=K*Y#>0A>oxbmsq+vHILb&^a}x2o zi^a4Ot;aIMednVcH~kvx@n~5xrgz6aRa0+ldlJ{1ofrEo10gbHslxLU=Bcsg7sEHM z2yf;$?H|yC5e1OkZZEpSLAJ6vAfkImG>n#&F_@BXsvp5>3CXU3r*N5<3T+*34ex5l zSpr~BlfL-wH^d__yLRTo-6WwQq>py%ivXeN60mgw2H~M=SELKoP?d`lX-*b$RB6E; zV=boMfhjJgGXpN%b(DsFl19un-@^iZo+88c*Z7Kct;n?o2owkfteQ@2F0lFI;%_Fb zWQQ)iMy7f+5?a-?EYZT7^9jVbZwSJZ(`*-$1yKmE^;$^YVEl_ha)cSwcYl*ywPZcB zSQ|W`(d)eEO6%HkDHj%-+6%-XzY>z+B?`Kyc6quQOvMrG(8wUXJs3mx^T@fBQv`ry z4Qo`AePegaqKgR1rwMX&%l4w_(ZNoole&Yucxl&K5t4tvrg3VV;>9QXikk7Gtnpy zl8o6-^WE?Cw%2@wZgrKIz5wt-Gi!62zjr+v5Kvh$ek!6om@s3_qKa|_x;#X7G>KZm zn@mH5rkjIS50Oh&ab0wA{YiYiQG-IOj(h8ANuq~)S(mZ%WLwSZlLM;dVmJw#a0#ze zA8KJKDW9#-u1duD#!`y@B>CE6ZN*0dPXUfqQx+w!!KKSreCCJ=iEXV0lfodTX8p%# zZ)?m7(D~=1{_N~77eaeIw@`f{rQJRO+J%oCugY6}Of%^N-UcBVhiO<-dD2h-C6q#w z=t+t#-bj{Dt7n}Edy|E)8TI4z*8Mek7WSqg_?<@+E&961;Vkg=N938Vje#c8ppyW@ zDR*n~S#--jOrvrXbG7-S(fAtw=Deyhd}_#9HOq`x*Iz5Ib^9qDTzC&KN3zAcluGq) zaU9BHx1w6EEHAYjd+&@w2EWp7O^E$2ZUAg(RKKf2^B3Q>Zyee{mX+Ja0jyTyWL#}M z7WQHH(k_4tl|!oJpm?mCTONO3wVwytp$yh%;IKwK^zR1fNJ9cCs~=3vzbDIv1YBu+5bLpO8NV1_{^+#BZP#7m#r{Wg zy35>(hT?6_+mTI4ys_b|k=fO1!`eu}P9A*1gI6Rn{Y;vaJb*985z)pIf}GmLjG}d}KoqzRyFNq0hP6aIzm~h~g$5M(&S_ zb#^e_O+w%)rQ~i+8^3m&^EuZ3)Zq?)rvLG_q>V#fKL|4+ZEo=KLuMHRaovDn`4CT| zeiF8CH@G2i=RJYEPSQ|Zpp!<~`?W@Z^wUaZ@QuL^r3of?sZrwnwNhxB669!v^dm3v zOzwDFHbG1^)|Tgi$?FQMgVi_h$2*VY$BVU#GYsa3a=(NbQXCl^h_Bts#LrYnF-?Jn z478dcRRkMlW^YHrlUsF|Bv8jX!yt!&l(HSc)p-s(|3W^5h51NCmY0^(nzATtCIL&m zE$kjmsJMfID!0(=G+$>^d-f?;sb=XbNTfuziB|5GRHJ+~Kk;M6eO9g;6 z|B_fi>0n0_x|CfiCW_v{j%g!mRJJ6F5|mOObHE01Z+~0@ONHt(R(GbxUbOz_EY5`+HOov1n^(5O_Ez?DitsBz51vL+zeQbeU9NVc*AkZK_I4Z zkVP; zld$VNIEysdJ^_I$Q14WYe20Lr+LB}slqDo>3}{-y4puzpcHG2YYE+tH(X!mny0tX$ zk%AS?$ya!Y`mp#r&k^urmv=r3)L2d2(KioPw}^ONCcCl+1k<{8?ORb9L#4L59?;49 z)#JK*DRs(ascs_ZRQu|^?xR}*uZr&!HEe*bsY&2(<*d>miIy0<1k8}TG zSuO=8@p1kE-?VBy2HMpUrq~3y@mPDaX!2uL*V@*%7K@xVf}K^c&y%qS z=241%R_&kO=DwWa2V2OJi4{9qo6vV1v568twwFKc4g>G@+%(DmH6J+llzp4M&joasT(1&EavYf z&7M*#eY1!nv{ZQXBz3{}*pfwI9bPwWXAJZ?cJm>oD>110qM@kU^78GiIGxsqC(dts zTU-iMYGFkNZ4UN8_gx-!fjD@uyMV!YE*(jmjxV9Lo_S#qXhN#)5hCGbVF#N*Ac3|mhtL+oz|4LI15}$#dqo~I4juNmNZMoCnXOG zYyonPiST)f!(8w&Tm)fs^O_VBgpmawUVyQlIXqMk-!z_S!BVOey`C zGRQ8-xe_v0kd{P!_r&V643;)83X>Go{5mrtEZRB8I(hg!<4+>cxQbEk~u(&!Y zLk*5EQH`#oKB+H7P! zzRu>Lmw=8ZJzud%!}9GtThSyrHEO9*UgzV#e1lPl=C30F9kG^T||We-jDib4HD#G{!}x%=qWlL`f(5CTy4m*5W^Ju6-gXLdS`BwxrY(W+5#TmOdSPy)Y(Lf^Yh z6_-htSRlFegA5++W2Q?6^0lDo#P`g!xSlOOY1j5!7DS$iuPD{^ANZVh#F*%&R*HA!Au}6|@DNeWsk2Su<^7gRw$ogD;)hc^Qr^PeIK5v~b_L~gG?Ejt*&cMVl`mC1 zTTjJxQcn3PIn-iiH!3{v8-{o)%xg@Z*x0fT;yK%ASpjHaW=7EitjCJaufi9(0#c1)^6pzuTte2Vhr!w}& zKCCUHK_xCLlfA>(0acYz-us)dkO6%K44kYVQ(TMWGW(j=8w-<*bx#OR+p)7Z%2kZk zU`1EsdAAkxK*-b=^Uys3DZW)H(U~^CCndVD+Fns`X-R&P}qde=* z{tOnRQ`8rk%40DCM}U1VKY^>7F6ng>lG;}NqkF`(x47MTP{_7S5Lq*f5!p-g22h{3 zM6Gvk0v(Ob$x>bHJ|j!eDp%lcFy;> zQ$)a!+o9ZO_BQ-&9hVXd$qKu%rvmk|B?vRcJ2^|c?6^q$S(>;dH&nn-$-T$%RuDwL z(X%0l(UqV0t0lf{iP_SsQgf@~kKyLGXoT(gsP(zzC8Zi^^H*D~y4iXSl}?>_NN$C= z`&on&lFfG9HzwL$kVRwL)ksH6$W|pIAu1Q(kxi zy!s6F9d%V=u_a!AP3HRSS)n}BuQU7O)jceq%h;(H{k7cY(3Sb8=uGoIJ-kE`a6 zSRJP;@+)t?jiYrUm>n97}YRwC1LZIRww>}F~GKx4fQ3-zAvPv(zW71m!G zepJCrJk)=YDC(3CNgjlS0cj;rt81cL!Wsf7VX$e`DquFeaw2z${DH}Ilz89afpFe* znNsdm?6i*FC}@ z(#`f?YP~7QV%-exQ2ROCw}=P=d~l}c%MT2WcERX|LAx|-%sTaFSA?@>nSrr*B#ao` zQY(;X=e&&tK}#LF<3!Vl*H$`5XcTyKK&{Z8JXOUU9Sj9@sTJGQzN^l@Ss z;*E73)J`Wh-|`|EolWX?bvQ;mrd?wzxEewC)gE#B6-`GSY)w@ui`wR;3cHWjAQTos z?O@YjPhsR9Cp6Bn*?u{c;{_xaHcMnS9Zb$@MLE`Uj^An7tJ6TR@3%W-hGHlwd*`66 zR#db2`V!L&+V@a)ox|4)(kkfUap*-Pfsj9eKb6q_VfKN|FkOGYB*$c(kX{x0_BH6a#cuUue?>P4{fw}JE> z?m>cC`r$$0H{FDx%sPdJV7nGH!VAT24P?J%AWWgAz_uRwa>z-stjGdJvgc6Cjmf1Q zR|_>b!zZf2`i6=D!Z2XR*?oHUaciXFfLSUSmb?N~3s6f^0ScAZ^A!C-kxw(lj*;3RTs(`VM+3e}pWj=Xz zM5ju#{UvEJdHO+J{E9<^0{+ZtssyFL$2{k|uMODK3-J`rp(iULgE^8_Cl9n5nIwcA z8%^B5*iW}ic~D1(SAbG|HWoBXjYW(e+_sh(X|~+!(*)n>#TJ(BA5m$7HCUnMOR3GN z=()xwjQJ8P-?WW*`GLnwk>^IKKKOP3n(4X+m~cpmYZe~sUQ0?msKKNDVRcFax<2lr z`o8ibQZ6sM0o>%6C7A7y@yV@umPw{SU1dsFFYRP~ivaH2{H@5gwc)-|2%&^wm?!bF z`Mj;`9oFXX2|`J)@G`A}OlviTDL3;+lx4=&jmcY825&F%?In-x>+SM?{P?Gs{Q1`t z<{!lcH;~t5hFk9k+E1I=SGoqrF5_5V;r7fbJD!sB${VRYX*;%nN`&c5DxRv2roo3FvBi+`cMY1jBoKGXqM?P*Y*CKIy5l&#<3#6R9y zZB?)pvR(Sa0ZZgU{k}yRj9KHwDYJ6Z2dWz%`ob1^55M0`g6tXk)U?miuxQq1jJ?dY zGO_XRmLf(wyk)E@+9}Dkc0-M8ia#5;m4kqX43%@C3h}ugyTZJ~l{v=t7Wr7cp)i{1o}I}VnQCOmr7Xm;}?;|FJfL#7-}cz{TE z_pjrbLIcR{5rPMK@ph?1@zA0c&C&WD4VwJX9X7*_JkcU$@~!15jH#l!xor>$ZDouY zz(8sowA1XiU%3$3{$_kCNyA_~qOfc+8GIU^rIBK)|1>(#M5PcnO>=Sp^uOI-E*78G z^x+X@*|%!+K}Qso?cWGGdo=x9=16bi65F><&50#j4-I4~jkYoiAI=1D_Nhg#V56F=6mwj*8>83Y zG+|dq$)F2PCHS^`=)9 zH#Flq^z>ZTVPTfJ0K@LPz||elXxiWakb>!*OA&+@MpOHFF9{FYH2@I=V-`}Yg%`xz zE7n_Oib)El-SBLWs%KcL=0TUP7MBUmEf3uh4aPAHjV-L-{o6Lxu7}mhsn@wbbL6fc zdqi-#e7aZXiSD%fPUa@id6bSlH%Jk@V}&s(P(t;Uoz9LR68KA;u_8%|p&?g6MX!os zYppj-x31EjDWJUQjdLQmsK4NN8jI5gJH6drLrf9;ANJlmuBk3-8x{o=1uTdNNK*j? z1*A$x5s{7{oe+`Udk{iEKtZL0^xk_BNRSR9z1IMtDZPXq0)Zs&ah{pE^`3j?o%hf0 z`#t|1I48+IyR5bL+Sj@+?xa!Jej{w&|C5Sw9ejc|f`pxyIhI?+pCz(AaI3)sm;P6{64dNkF#dPSxeoMeP-rntf+_R~J` zXbownjes9x=(@EzY!_$H2*S<6Q7$-os=8Z>W0a0cAVqMR$CBG1CwLXI-&htCz=VQZ znG~|F?Za{sHS8G94|REN7XM5T-sDnVaAhlqekQBTcLy%wHiB#cwA)_tD8F!Wx_T#E zjX@stasc`GEk%=+5(@@jR2uU2-TCSz_Y}+6>!QlKdWnz;{YlcW`Qab>K3-$d`pZlJ zPVJrnvtF{=8O!MupP7bI^aRsHuk!_(H(u%PymVpS{lP-fcV>m6-@+yF3sJihoT*=O zY!vfO+|6unoX^h*!kkRF)#z4+~f#HNeGTm1JMD+NMDLLlKe#QQ@*t9PgU+df#DZ7 zC5^|j>69=;k_r|9^FG&NUbsYOvUnBR$bcIpJ&+%zoGhX6lz8aBZc+BYq`fQEr=;wL zj{^=RW#r%uIob()&isUh>L^t?X*;O>A=X!GY55`Es4wPzVK8pfz(uyzXKPU{&ZXLs zV0hOBw$T5iCMkv6Zm}!6DhwwF4(jXoD{a^4_gl*I?GEp`VT*k}7H;E(-{wr(7Bsv~DP zfHXmq5%M4gg)pgQ(wZW@*NFS!f;7b&nEB%{pqAg@SBJ8rXLuWK&$oqDfj%$sFJfgAg+CAXrAXc?)}LL!w?;G> zVc8qbR3lI0Uls>si{3+_&u zM;iT~$^GlVE&83dffTPdr)!bgDkDv)%di%Qss_ct9Ggx zzpqu0Ro_wtY$s@>q%FVdi-MM&{f~?W5s+!IV_4q0=juBtVTsb_FAjhxw-~~~q0qov z@`QWB?r{P`o3k{w@3<25oD%#>zfrrJ^6k>rvXxhu+0eq>-AV4!@l(kusX{rZwSA7P zqSVZWgn-GUy`AGvcM%1fmNYd%`39InFUVRi894qzYCZIzj81UYXPIfQE>{wH)C=_$ zE*8W&&+33`g{_8euTB&v!X&L|I{}I!loi9+R0DttK(4(Pvbo8dRC6sD{Q354t|sKcWLG5=qX0hL11axShTvlqSOWR@jb9yvl*5n7MFk5l7$X zvaE`%n^E(|SydKaEfG=uB%t+1CmtE$Eo>dGQ9i{WxgtzcgQS8~nlY0Hn$M z&@x;QC>u2*S`QY*+v-+K9%w8XhK+=*xwY>v)d>Bz@K1wT?VN9X1q5mAIuxq1+2Sq@ zzsuFWIGkg)ZBS*!4Lx`YAx^ZDGB@JwKT)Ap_8*g7sCgV9-ovsAN7?6MU}zzO`-*`= zj=Af7k?a-865m|O@_o-+BxuJB<$OP7rkW(KzR!#%Mtu+&~f!{+$AB$&XdTs%5IL}%LXoB zz(kpf!`hUQ>reby8NLngWv5G^5eA9Ov+kKsJB?hV;MI)*a3x(dmp-Zn!)RD4pDdra zXL(j*g3b+953Qx zm85)4U4wQdNN{=T$a`c55ic%ZZ=k%6O$qxxPPSjK?+@@LDr2Vv`nzt^#0{6>9?(F> za!8II=P2f-$Wndd1;p_}rJWb@U|YR$4>F583YRq+IhXqqIn@#{mc!ViR28jPOr^8Z zo_!UjeK#}PgK4QStDxYo!<8HbwPM+Qvn1lbSxnAP∾^*s<$@7TQ-t(eaByz zRx#{|epU2SdDOeSegl{k0O?!ARLwY}!@L8;=s4j8rYGF~V$#NSR4B(-SL{)8FLL(A?D@pywmgM9#M#ZhY zNUvhjMoBY=;NIJR+~JcbIDx^&b7|REMkT^+7rDmMkjY6lT~W&4ui+C@gqIzBJYk=^ zht*IvCSpdV7OR+Nc*gLVp3*Q+m=cls(XTiG-zK`h!P-|kGj5CVptWmzFi2Dh1DtUT z3=pESg~SQxPFLlqrS_d%xmo`5`(u<@RjCJy@U-M|M~bZAsbyyUk8aFF(m8=2Vvc9cACp(bm-!A?GA?^@cxAK~kwkr)xo9EY zz&y%Rod~SLQz3-iJYjt%)fShAgqfY(WqJQAj3NYfK-ytf$RILo7&gX}1-Fvpr-I|G zkMW@mB|GitmrZX2PW zjou7w(JjO0zgVBL0BUO~yoleL?-W2uZ^tK{ zzARCKzJ0LoV$sKOz!e39xdVXJuIT$VRfQswULtGIM(iW*HzIaJ-}*|WF9h>Wp-hQ9I0~N0*H66D# zRz4S*V;{rmUHoTyPG(%yVK47c5;vpsE> z&)xKup;RWnEFI|Aq(wn0`*OG7l%JRJ>8MBEexedU;+{30?6Ad?-@iiiA6b0X52T0H zJRe@_-T!A>f9~AFJ5ER7Uvcg#`g^zmdDv&n-rJ81^c(@A&T=23cfLVxD86*M-&(7V zw~>LlhxEq(BV!l|CjjRr$-NhH_gEXQNP9dB+X`LlctIQ9BYOz}X8Y9j{TO7~DqTS?DE&SgB+~{+4wS+i)Zf8wC)4wz`D${FXNT zBOmr}uN3Zw=Q!?M(TViDRYaVm0CeMx#Jv!~OpPUsj7;2;Tc<^gF|k726+h*Z=a$5A>$Vv@F#)^y06_CBFm^ z|L%L#UHa>b{x|RTzeDyf^X`9#?3dO1|L0XUbQXWv`OUvI?EiD)cDhV{WVYm3 z3demRB?*~7u}EmVKh;>A9Zu71|DQe3zuc7>qEI*HU$xZ}_|3Ea*`djBUAm(Vh><I8GNa{N4|L zUci8{9H%A```bL;=k=064L)KP1JBHGW3Poe`N$B;c?tOVb?3em-WngKT(x4 zER)w1c7RmptG^%Nj^}I&3!TR5yzHvv^RY0K`p1H7lAY^YO8-|=#Tp(5EI}I0D7Rm0 zQUA6x{7Ck+Wc=JK1_!HoO-$# zefY$m=uO^awf=>1`@-N`Wlp5A&>e!|w|Y>vH5*bJQXiN9lXH@Z{8{1b{7U%G{!wQ8 zyydpjVBf7BsitNZks$4ytUq_rZy)Jo2aIQR)&%vRedwb*e9oOvlI9lm{^O47eHc(QeQ5cB_xC2tG+nS%cV5XTE`Ql>JjfNOTBs=@ zVytksrN14<*?%OOyEOq!hE3>clm9RSPWj%x#L5>>n%4>M+Mb3koE+^%NJCp#8m-`t;lZpXI2mAogZ?mJ71NYLFun{e-z@M1ePL_#p&3J zH*L5_*G8h`Yb5Ri`BEL)MQdd5?r&ow!*|}R{#9(9m`PNBnW^?Lm3z?ck%`1cZ=hPY ziFD}|SQdMVjPFML6$i7TU(}iZ)danlWu2kr@JW==s*ykng^qp{w3&S3edzfmONDVu z**s~Tx{@AYKg%;4jBDOJD5dd^iiKh$0mOq5#@MtwX0#;JvDq(@LnWcmh=u!i$LOc^ za&7kPLSnSIi9{Vr@tYw?gIkF@WiM<)nwD*vqckc^f98(ao@tO1DBtRFeBDIpnqz5y z$h;OwIp2Ti(r-$vGgbg#k{<{6od*Q9fpX=O1d#!Yp@KwiozjRc@54?=1R5q$U0SQU zyZGT`-k?pH{x%5bI#Xdd$~P)e`Z4U?uM>o|gY4(T1lHw^_2-B?bS`e4=|PCDM){l2 z=L0-h$Erjn!6yndC^?VhAJsI%rCbQ*|O!BlcHZWb3h;|2v@6g;iSRg3yr%$p)n z%`SgXSlATtnEJTDeZKvH30iE^VRo|s*?RuBpu{(hG=OJ@VfePVQSG~i>as1PQ*9-v zTgHhOU*9W@=4d1U1slbhT_#@EOqT8@#(I@|&+0CMr%l$$C1x;jv{P%#ayet1r$=FaQi{KAJj zX&@)@Q8p8OyNc@tO7>D-`ck0s-sM-)4&%4%RMgAVLzSg+b8{jXgzHN+jGxo^7>ot4 zF7)Qmo+Kw9U3wOMIKz4V8rs{4Eb=)1fYtK)85Y@BumsT(QH0hNaaS|*} zkNV`3IQgtpGc*-6Yf%SP-Md#EH%ljYUI(%#&)rV%w1Fs&|2oS^cz-T+y?X3hTPfEr zw|i!L=Gf~Hm2JB|-hFF=bJm;af3+iZ7NTji*w&?y?&Se>61Qzr7KJSpE%e9gtc@1W>xb># z_QKi&LN5*XbnC|Lv4H$W#&p8$X!*M-7o9>Zn0=02ta1{ZxJ^*`BupbK%Zs}A3gzA8potvb?I28t@o;7 z@$2BFh8W`;ryEH3#k!ujpqD@8E3On;xwUn3NO*LsXu(uecjh4hfv9zbn#{$n7=@i< zsF3&<%N-5Im=U)dQqKF<+O6e(4CQZEGD)X9uf+j)e~x^pJWZ;2mU|DFkL25O%G!^F zl6f)dqhOnHd}khud^d)JR4>z02s>DAjux|m68)VAUeG!^h!K`4Xcm1#(Tn(Ihe`D; z0ocSY?XD}58M2*;osH&|5B&t7z(k|anLNbr?WrBXcN-Nj2KI>gN~J6khdOqESYSU6 z8|{4t)KZG|=_Th7`gY{pNCKIegj*{z?ak&Z<_lb;$K_Lct=l1;H`TtH6W9P=IVE$o z)Ft=W8GV)Sa9@XxT(H+_1J|)vThRpn<}%oH!mm1#Tc^)*ILi60yRP%NJkiB2bRa9p zkMq~JpUZs%slxZw^?LWAp@_HwCC`5RPKMnT#L=7fl`l28gE-M>N+7J1-)|(>gP+bF zK5yQC52LskaU-YZHkEH7t*%|k@JdL&>M-Nu(psKa)2_Hq(#_B~#i+{%ZR6`ovCifc zU)t{z?cv8oB8S&_m-JSJvzdAZP1-klyU$WHM=qtSWGOCoG1ulr-)bj{4I0v+*vv{A zjW+9RquX62)eI2!(ZTcr32Tw=ua!;yBIf&>9erl|(}KKiJp zU{%GA4=rX+(+dzRkb50if?7;h#dZUA!rA@YrIS0eM8T)!=Dl1FjZyVKk`5rzgcGc9=JsYlamlx4KlUte5e6 zfy^#hr`CT+`^(EmNCf)a9=lgR^K!l`^uVfm!j^crL-S)Jj9lhy!%>Wv)c&o;g2&#X zKWxIv7P?`c6K_^kHC6U1cmrz@(Mf8rE+~mLD?EN}8acr5 zBdE}dPavlx2b&Un?xXbw2Ky=J!(dZQ8k*PlKHbtZy!TlZxrtbH7T3PX!J$64GHAj- zJ!QC7IlvLJn8PI^=6~QcJWG5Zz~y4vzxhBaocyc1ybxPP~3`t}s@&sSAX&hC_!1u&6$DPA!5}W6#AeN}7Mw`RK5Ib~{2Ou zrCiB_4p~HG*6}okP8o@kG*_s1&Xl~m z8OD3C#s>3rb~_VMdL!G*ko~cvqJOA1;Y^#&U)! zCvOM6UFi7UpcuBC+n=;^ea!b(PHnml*z-}1#6ezr>j}_lSredQG-Mf|6o4mgekpit zt@E9RLj{2vz{iW)Mar}LEvI@Y#+2&b6?MKn%R=>Y2(JUULW*B;g)&Vnz74~~T?>Tn zvZxCovhoD-p}`-2CwCIL^Fw>j^v+C~m!-DbcNy#QP=0DI?a7`xHw5oa*ygqdX2SHV;^JY z$M8s$-*JtU{i5Fe0T@I7W2Gf$W(#21ABX zLy2b7rRay;Ah>z4Ex@26`l>+R=)vqI;BY$f=DQ2=_L+X1Ud279(uruc^U z2IWOMben!6IVD_w$=L<1a{y-%`kG|ODmAE7$7a6sZN6l2@=f`r|Jq^(M5Im!ZU1U;@v&AhJiA|NN{Q8-V=~^|O zIL1ggK;jtAFj{a#xm3g3?edQV$nT!x+zsEt^U64A9Gj@DVTIKGYq}%5lQ_#qQb@|B zP9S>QNQ21Xm&CUe8g-1ELAsFCeh&ibQ+}T&P!Z-6%?`TN8wHRB+!2Ypu$oAixVL=M zi)f5y*92*tc{hV@>x#C;Jey{zXO#M!=&q~5d$K0yi1s__7|bl`wYtt<64SiV2oWzq zV^;;9)Us`jq$h(x9_{eWL)9=f-61`ZbOm`o`Cl9UUO}b>qA+OB9nnsExF>Q?kHcYC zYfEjzB;^3>9o7{&vyQayK+WimXZkJWzYi)mpQYH+LvPQC-gFQOF+%r4&8e)ZQ)=~8 z6Xh9B?_3^e0)0E$gItDc~ zMY51_+bG8iT_h>RaKctO@43*Jc0}tgfH28}kCh_sYMQs%%z_FMDQw zM%Yf2PcXkqn#*OfY5=$^TcsocjcY3965VP=!bDxGk;5?F(J!y>b+TURqSd+KdZvet z>J1D>ArixjPMtp>G`pRexuzpw((&h$bEhms0xZmSD`!FT`*nhO;C|YH6SE(;kqy=6 z{A#YEu<64B(={oUf0OuPbtKKmJ%gWeFD5+n8FTHlVaE8u-CZs+ueGj6vVTOCWWy6v zxT?lta(l^o1I63~+1ge>x8e0waLOaoI8Zhuy_h)5FfywhdQW$*(VC@CSm@7yJ;4guZdts~?bmMfJ*_y--p`Uph9b40CH1(Db%*-+2KtM4NI?2yNZwR-!${Q=)ZsHoi)qe@c$0dD#ID~Ajnz1PU4G;OlF z^}cI^B|8tfhnr^TZawY#KobEnv=Bkc*;nTmpjS=ClB$KTzwUawQF+riWNmcg72uFu z-m!Oo;<=x#6nlk=l84_|o=Vd?+?hx?vt&MZ6XK2i7~Tg_in(KKKQ3uem8nJ3PUL?? z5L$OjAm8pX1nY+;tVJ`NDBFbIw-}*n|6WThY$z~Rs4vNuEL-umCVL{uQGYG>`xD8S z@dSNQV}x` zXQAfH;Vf6C^ss%g57SB6@%LJX#0%NcpbKkqCdsp_)M(Wq2&3|wKd{KXdJn17-Wl9I3PaZ%^Y!XU2IeW;=!M*aE!${i? zVyd;=o~xtYOPkoi4+tZwq&1e)Nj$@F{-sP%3SxcBp}@^rS8FRvt?OVu&Iy76iVtWx zPtm8MMY~S~AxRXGsA6PB@hiUA^yIJYQtHrur1E20-m7X}PAC=S5FH zpb)h43baKvOlw(b6w-Ka52{0>Ea8a`9}(l9tc**_vI2;LhO3nT`D&*Q*vF(LkYU3` zAEL?h*}3)nP>~f)*t!uwx)fuTBXZHMJ(R_TjANSnv31^F#98qPp4?=N)yqK&CF^aq z+LfQkSpmJZk%GHGsuJETM@4UaXTYjzG~bR}My$otfA{2F&_-J6`M5r>zD#ZSNKW@E z6~fbYl1r!H4wXYGZ)_${Kr$a{#t>-q>}D-FNil`CF3M)=CT9;zd^3onN3X+>xU%Vjk0sz z9!Teh{iq@V_d#i$EnjWRbFdiDV2M<@t0$H3^;IeIgCd7{-;2~U27as8Pd8M zjMh)(Vdr$tT*UZl>j-LQ5J>5$N?ha`4V+t3FPHa6>yVNvS(7XDzR$~k+nMniF9fT@ zyPz>z{+Pm)EN%4lUN z$k20{BoTy+2?lr`++|?y8lxxei*ta7^^CM>r7C!A z{?+kbi(17ZqIUDMEPf?w!=VlzTDQ}sgisT??Y;=;ySKMaqaEejTMR0Zrc{SZj^?MC z`Ygxi)OusveSLztw8~9mE@r=ax9jXai&}_bEQ$SW{yII;zOm&1?mTLJ zhiYeT0s7GFCT*~JvTdumA02}x3z3_2lbhcBE%LR&{yqtmk*Sn8W$JjMp@L-i8dZHU zNpwk8+^MeAUcLz%B;FXX3s

    x|V8l99BH`CfU>K7!K2Uj?g zhDMVr>_&Jo{0&WX`8XeEVyY?$BvTNRc2r2toVQTDyizuk3M6sFdNhF;neBm;Vj(qO zM+8gPjfj{i|9Kt&N^)hpps@;bDucP{vCprsMIg=QoOnVcZq${)53^(~kaN^^7W%SP z9(D=V9PQX#za^nV9A*Ph|7NLJxz&fQ)`Vbh1??v+``vZL{X1n!B==51t0fg>ec_IDM z@#9RSAA;?ZOj&y;X1>I8jSOYpWbHnP(9~Xh&O>^NnDdZkqqznbENc?eklf&Hi^ z8U~JcjZiVaC{BJa<8a>gG4~i!tBXWF#?j=iC{{pNDRy5F&;yP6X5PR`S@o*K){(}0 z)g7d-ZLQaQp#7AYoJ^%cBz5ArzRt?XvkLeQ+&g0gLjXb4Uz^h-|VuFFI9pRCzd*MCyNA{sEUp7qc8smqwsaXjd#I?=H}+4 zc`#aG*!}ZQAn`mwnd(1&5*lwPcG;kNnya`2y2uop3v2rOe~u8l4-*uQBd$B_t9+YK zuN@89A}>gMTdeuu?A)ViS6~F9coXP&k4Bjzw$-tB7HcN$!&jZ#SCbXIKlz0w<#0iY z<7>x8fAD;j=>e17e)qg&QnR?0R01!&PwFYT*+O|L(0#ll1j#A!adMTzJ^6Nq+xDUx zXNgLz35Xea^;ovNPtx?-XnqR7|Fny&if#9-Mc`h+kRM^(F-4zB7LAd=i0VCeF0>=G zOHG7)x3bT}F|<1TAY}A3Cilgz8)k>^)9KBq9pZiO^DwOdvbtn!98v<-y{z%}v#h8# z&|$7@@f%M2Q%VfISpaqwD6L7vXIrlZ@;D*69k%ZEE)IR_Aj}YdLCx`sdAd}+RllQy%tOei*d$r@rW=@N`uW8Fk$r5GYHWS%P_>*_0&_ZPZH&C+GN0b`!#y zD4@d2Bt@+Srty(%0}+!oD>0KKXOq3OHbyJ+HW0$nky><=dPMr6+k6bv9{5Z>r;C5k zB4IXDqH7w@IYEC(9>q-)eMup@MYD_#N0)To1JX~GQ|XS1Swi0;Dh|i6uB$rU{k7iM zVsEkl@!|N6193D?*sqI^>Hg8NuCf1_(o(ky0SXds=Be_@aX_WDD;mWTA5q~Osjh>y z=%9`+<+G(uZA7q!!2N^$FV_>ATMvbbxnokC>B2#51># z`anq>H@G!)Prfj0GyKL2=0S(X8>DNS*MmNr33nAHlJjXs5q5OlkAp>dylXaGm7yql zK}|F@cvmso`mt+Dm$W_NqKhTlv(&)YN=>bEOXhQO>0H30H#+ESfHs$pj&UQez#7&# z`{iw!jatDgY1M;$BjGq~`V*D{o4cHGU%Z?#Y5?!fopsXRegc(k-GAckkE10ExaNq` z?hD)y{Z3v~sI=dc=}O~5ldlcyd^(#L4PA;%1%(S+_Y|YHIynJ4lt4ta5P8!V$_v+P zs=RFdpL+9CMtSgsUMdG@w?{FA7-(WbKzs}|BE1o$UtYKzUL&hKk24;|$ONbtN)Q5( zh2!DO7etm15TPm3{PGN4JtU)80#Mug^wW4VTUaZu>chxc8rLk$hYPWZ`}}3^!o6GO z8tr0O@xQff2UQBzv#^H8*7-(RLM9g||KwQlAt1AW1s+&4s&TqCchAUhEceb2f$kt6 z*pWG=k4K5bd)BwH8e{emSUP|(j$UKAw6V8N>i`!IEkyXgobd+z^5GP`}gWKiR|t5Cf^cWJW1G!(SyJ{|aTsQF+?*<^=Pe z|5^n4m*Mg-p#fiJ@&L8E{mbY7%^Ci6&_70yMdj()R~0M``j;8~b$I_KgkGl9z?V%Q zUwk|NHJ|#|5eTb2dmd?omHy(V)%m{}|ExOj<=K1KFFSwRj9(ghSj{sK;t8gAuzzgr ze+M}K`l5<@;LCDOpqZJvq?Qu~s*SJ1zJ2>9n;-BWx;v_^((pA<8KiCRP+ne+jDjOU zOIvPG+b4>0(?pn=F>W{1J({k?q;yOWV zycef0YJ1`LLw#2G(h#ZtlOCPdjnO^(m0w&(~3_*(o>ZXw=lx%lG%Er z$n`;{L7r@Pz7Rr1MFnGW>)D7$3{~zC$pe3ADu>LK6gGFv?fHF}sj2BC@UA3Ihm=h! zRdJ8u_(DZHJFE2PsjlLj4Gx4BG&FWD#?Xni=9$As9>U9?ZxU`j7MQCG*zTy+8~8OE zuF_m@PRHgp#3t+x*>D1)&s|@z)Y+VHKaG#bdC0-uGzh`r2`(=0kuOOZJ{(Gv7_J+( zt@D=sqSR~F^E3c-ARebEP)8E*N2J*0Npbg;iKp27_w=FX*qJe0z`oHjhzx;fgf@HCckkVsY<8rtsu06SB% zoL1WXIX1BwxJYpX0^T*3OD93Rm{5&DOx0WoN%dixC5hJgcN?>CO#|db549YRz8W3sG{nGdtiO z?+}Bb$3%P61)h`?+~^%n9V|OB&r1b=E#u`(U~`JN&qtTmZ04f;DVfLLKscf=J@%&MhHiuN z6#Qx@wfm}^A6?qtF)Dw*Q*$~K+*D7vo#l$VyCnaaCh%uW3aD{xY<0uLE_Bg@x$)TL`ous5!f0un0FdToqM zL`0PBEDEfr@P+o*m%ru!O4acXCIyHkPm(2Z^iYWpcszk6O~3jAyI;9QJsMp&BjB4w zC|@dRhQz7&Fr-Ovop$GRu^Zuw>hMzPXkrScFY zt0>18L`+QbO59VH_2V&JpbFS7^5KZxGA!o4ad7?d{P0>%kC7pUQMNHvE_WoaJph}M zb+ZuBSbAfD+t9ylOwtC+Fw4op}ux?_prP9fU_e`Iv@aAqVa`E~) z7kzSuk^}}6OHg&Ec-NIO>iXn{wnsesK;J|BlNagD0g0wi8qP5cnehFq{nS>+U&J7e zHt!%LfUUShCR2~gc{r_<{Y0(Nl0mKe{10!4jYH(n_78my^0PR*{m zPW9+pTnsKMF3NYCXZnIce{gVMH)oAn2-w4j;$oa?quC^EZ0z+%v>iFtXUoT1Cd$?J zIGl*Qi0|L80##evMb25=hHwL@V(sPqp zwu)0OFd!2_m>N*mD?-COTLY*=ix&R8;h->ZkM?*LOs_pVj z)QPrx)ntt;7gcZQ|G;Qf|twCKQh| zkXY(I#CmI(s8%TGBr%()Io0a}Z3?^lw~rj^%PE{)=tGvIi8DQZ*KTo~4qOL_sj;Ch zR}7G(8*p@|^x8WYnK=KX7XQ8HP3q4(8wY6|?;EcU^C#X|x24*zwte~}7BgO}D})6b zx31mKl?oRo!BnhKjPy3Y3g_xV3AxS*S|W}?rO{-rMi=dYI460b;(f5>GjIs`kUR4X z7>+n@7gVZOJhpaamkS)y#g@7R#cAiuQvm}2WNi$A@ z7YT~q;5zC9hs{=$Yq~0mxC1`zG4yZBX&v>OAJ zkxb^!n{`FH4|BFiMAzDOlA||G!_NnLZ>E?Kl$cO}Y5(h2Wk!7I{GR33NcR*1CD!Xu zyswVor!xyqw)c((5Stm}uL{&)!ZagBq zYF)nY`0h5Ur6Pl6XRVHp5iwbvlZt5F2TA+45@+yJh$i(9z*~q9Jo)8j z@)o-%Pm^w-*Qwo)Gl6@Uatibd59|ptvvPBDIku>D8q9RP(wZjv`b4Hz{bbHTb?9&D z@!>ye{aVxzMg>L*7sugri_GbG?SHuFf$za0Cw1rWC*x|I`DU#p=63EZYBRnF{Ey?!Pp!_CaH zP2a)}X*GOU3RmsXLbgHd?sPVNGE1G7rcki4g3-9c^5{6YO?6{8-A{!S1e1k+GdW^e z%&-N){sIn5GE`vn4FqDyjq%66G_h<6<5FzLEBDZ)3aC)NrJYII>Rp2)F>!JEy@UqT zYVUwg7hZ|$QIk!Lay^&piOi(|39}~j+`_Mj<)(zQxx%k;6o07u1bDGd85`zTrrRV+ZFaUcRZ70kTLBe4E^=O=|O{2D4Ly zB~4B1)Y#srcvbDZe7I?I$SiYCMz17}rEBYL1UZGujZ63?F^mDL>BF0#n9)U-s|`>N z`lkfGJ zuWlS&u=b_Bp<(Plm^l`@vHLs|SV|t5Q7TltMV**1^oHyPFn&11_6@HCKzuMdm!S?N zj7Kd$y={QU`hnd_3!iy}a>2pH#A=O~)`|Fzmc6Z~p=Q!_L(r*=Yf*`3yPGf1)Xy=B z#EC0k>(R=2WyrGL(H=X8fj!iR5Kj?nplYP+=X|>#zkq$ePL@s5sb^|RDe-FS;%stR z&&9o0Z(@#72g*d^S$?^$evesFds0s#pyAkbHM zVad!5c|5s8Z#>-|>U@>u?hJ4Lb#|_gib**nch872f;O8FTvKv zj+V_})mO5Q*EJt!uxoa9A0{&CeYsU3&@ouA$KGtGw`EZt-=k#`F5K+uq?45*hLR5b z&MJ)5;^@gr%gJn&z=Z`O+2Gs|f4*b&%P&zOO`G4>11JRZJiT=s;PK252n_Scmz}KB z$LgCs%XF`@=wU*HS&3V1x;evWJ+ZJbl%l2{&c~$zYBvS18WVcYKU7sLb)TQd$HisU z3?~m<*IRzN{^(eZi~5tT8HIeqDRqMzj5v!d5q(`3bu<r*E$N8a8h|;BR zUI{EGPQAS&p8M#(%7dywDPzCIh)-G-sow>_`luAQcv^a=(0FiS?T6ue@beuZx2Q$7 z()WFG`n#qKHbk#qw+|-xPVvL=`J##4HQ8KIM^mVEZ{KjZ7sZ=TZcCbe{M~Ce<$#0` zgpCah1PSYzEFo3Ja-q%=M4N^{y);BxKtX<^6olsClcbTfUbTQt*|+gEAo5hG1pTJk zvQM`D0=OIk12*n+a8Tr3^ye{-C6QwBWTs@6z12~#R77sd_5pwj0R|Z=Q%xQXn_#`N zyySMbaT$mL0#hQ@+74XAGN~TYn@a1O+{SR=12M(=_MSDC>Y{p?ZTYzBH(+5#77)NRdlbN9P zRTpdlE{7|>f!a8{HRMZJ#=OKxrt8~H1$xuGQQ?v*67EyJV3uWXD6ciDpSOB)|c>AMnog^dgig`Vyk#SMbincSS+ zg;Q{GGqmtD8A*Zr4|3l7a7C(+!rBMIDiWA%)GkZOI=GS1i2=Eme4bU=x@WTun;pEiy(_ok z{m|`2fyk%Rjb6>B9*i3d;f>L+zsT6CsN?g2664_DeCW6?pUlt@a+=i&#t;JTSdsC0 zo)J+gYaQ0<;}>dczI!I|l$!Gx(^apze}3)T44{|&kGXsMOVvTVsHDTljOHCzH1_ya zKjP7KX)m^F<9>=YQ!o0*Bne%i;K};&4INC=VcVfkxu%=iUC$r5#`7~PS9fZ*5< zPHttBitd^Gj%Uw1;HVg-(v7<4U97BqpVIIsz)lr~6iWK%*8xq&ptpvnF_ij(RkqQj z=yA!G=p7uc#5pN0(Em`% z8^lAcBs~#<#fLHZNSSaS>^WQK#F8LNQFTD#gnhX1s6ipueX(zYe3*RUaf&o?AYu-` zRwp_pSPi>YtBKR7)+=h*asS86p&ZjFMC?xGQ!$^~&P*6Qidg9+n8Nj{0Y{2qA7qhu zZWR44MlCRwM*20Ff=x5D8J>j-tuLr z{~I{(N$R0Qrtk^tvzo)^+wo1a`He#$&c);enh;Z-->kH+Z|;&`oiMEFw%mjSMv;pt z>`f}=#qQ0`2tJDHKfHl7dFYVU9_L z+du2Dl2)~1H_XK5uu5P&+Y-5-KyU7TX~bO#A30~(wl67-_$#{n46LGwr-5GFc-fTM zzB4g51Dhj_dnkonOYf?pvq zJcqiy19Fn3u_<<9cSTyYAuy!+cyQPU=dD-cHp-Jfs(IHxcvZD%IjJ53&O7H+p+L+} zMz;s)=>yvE@O7udT3>g!po>jItW#3u`!$2=#TuN(-c~&kyTu6bVQJRA(B(Yct&$3- zEpt3{+s^isqlY66J9Y@U5|vV?XP+t!Q`kMcuAif@yRcUeKQ&xQ#|BebK3h#s(;%3r z_A6hsP6QgmMFz{ww!?QHe+?Zdm@@hBr7S%^)i2;A$=bi}+HtPj22CRMBDO+gYig?N z({za{ai!Ppe%l{b>VJm{O_v}$!*BET*iSF}GwHjsYV?3;e7iQ4QBIW0{q!S~*(|Zc z8FK8NB4w_*2Ahde>;R|$YFe6EV*ZEl4xqkOPj`}L3zSlmv+BALDK-FJG_IEw5-bSmGW4Y3dRiOFrN_7?|DnpudL* z__Iu!pXq6blI6A&2OH*f+NYyb-(;Kd;rROpq zJCsskVv3QuBrDzgTpiUgS6aiAP#&LnOt0wL)HG#MOoEGTWiz2S%%B)sOLpXyZe$y#5JpEy zsSXDAHO#M(-N`X-*imowb%kr?_BJ{zPJM82wPjhRYm1Yzrs@hp@C$i;L;ExcSm+>9Yxdzo@L+dbzCFeuThO4d*9eBm!A5_EKR`zS)u zSOHRp^M#>@>*+ZeYY>F+_4A;8MaMxTOjPm`+EB^2+d=9=%F5`#d6s@!SZo|h-#5hTGZK&m?pDcZBvDgS`-b;N8Rh>PSR77&;LlzFf7e(#rDtQ# z@q0l_{~XRxA`1%#ra@ojjCYPcM1>(2Pl%nJ&aXQw4}#Bm+{h)nHOc0*JtL25^jTF5vk7R3YXLA^kY$R@ea^ViMVvByW95_5>mc$ zc?N(djHPK_zxJY5Z{qKfOv*x_h4zZfBn0xNGC&)Uyebbea`n8hIiSEY3LrMJaVMsy zW4^7e=|6ygpUR~y)K4`idwLQaudMR1Iq!olHhQG$=m2(3%Dg}}|J6-2X^A|oV|5m+ zLx)n7gu~eQ{RQochGQv6mQodVBrBqT3n{ zxoo}CKqL`c*iXz^00c75Rp6L~@;__(C*9=P1-YHD%++Mqy(0KPr^`8p^~Yn58sGq> z-`CZpqS=z1ytvozx#!ChgM!ZasHR$NP&~V3NO|luvgCF?J36ATU6mhFW1%i(p$Hk) zSZg{D+_&OkP(W^HIurB#=(#`;GOY>(yC&Xqxb9@uI}1!k`=+s=Lmy52LC&Ki$&wgeM6#JrbP#RP?JDuWeOTE1 za)4F1En*~r$jll6gPJG^GV30VJ}3!6^4}80-C*};7evfL+{qf$a02-`%M8h8P2col zr4~`8w@pM{af?gNyn~}7ha1XKh(1)9FE(`B>;7j+eyFjYjh8GD<5PDL0+9Fo{}?;# zxT>~q?Mo|4Nl7D0r=&CnUDDmTX*Qi3M3C<8?(PnyHYqJ#8<6gQ|@9*4m-_QM* zX018L9OD_!_|C|vJei_?AWsVtVwWywvv#tbL=>_^LcdCQeQ5#^_N>i3_VV5(O&T(? z%KuE6VwrTFpMy-ws-4PJw(Sno4p*$d@keYPRrK0JeG!1~xi7VZ=~QN`<3BFTYp)^t zSx(-$J3z`FQ&LimR3}s!hVL<8NhS1;MYR%hzDKIeM&nv<1uRSGKwbHHzfJTfACVS_ z)+oR|oC{p<_K0uxB|8b0pwgp-%)_AGfcUHMZtg5q7nm8a?n_Fp58^7| z$0=Mxd_Ij}`HoG{~9!mrnOM{k^1q1S~*N*`GVNj>}6VSPRQ;I<#5IM1<|sCuO$@Naa^| zNw(m`-7AOf@VYvD4-R8K%b7-LnF%dG3|EuAj;q)ynz^n>u0k3;R#SM%0LrTFqDRzL zY`+rb6>|Gulr-3TZ_nGSk(I6>yOo^f#D6})_D^0<+f9v(j53i&S`koywqokr>mRM; zKDy#oJHP=0R52NVPXX;}#Uf^=r#GfQ3fXf;b`ZyT?Fcu}-=E#|Gg?{P1C&|P?=4!? zs*y;}sC(YG*W$rH;-9%5ofM!Nh$r2yunqe9Ktw$Sq=3Ev$=S|A3Y}6hxr&Q~OODOb zfe#ACT472G6?Rc2Mp@ZsFUm9y$(d%-#QMHCTCXQj%nC$3zo%6GGc#e)NO!rkq}uN8 z>Ka-8D*9uxL<0w(%(^nQGV87HgF@9e$2}fK8fIk=W2K}~uK)bwLPK~{S-HS9Nv9;d0@lGbLS(y(D;+urL-H z9LPHJ>HfOo_84a#gOs1Wm(a8ti*sG|=UD9unE@poow`-1e{i&d9)6xan7_p`GBVP1 zV#c9zmp6rnzd6;z-LJzDD@>kPmyFrO;L!Nbd) zLM{6Bo!&dln7|0Xj>jqP>HcEc&CN~aJ<>Ap)4d;{u-Ce5Tk^Q=eSEVGNCabmd&Y?T zrOCvVdnZjIzjf=ImNj~1IiE%cG!Ha z0TiX2_8kMx062x%b3a=C`||+|5)2~eR5d~GP1 z`A|{^lf64No61#ylg)PR`eGJw_GBh# z41X)!r|h)fDq=bIF^Z&Xz1xrdZXU$!2N1{Hdu|OTH|NHn;Xt=U*4!CW6ahSXeZB+M zw6f*uqZt%pEZ`!RY$_lkkK31H z{4?+SYk@7rJlbiyDHy6Szmk68BnoL@TnGl$I}j#S=*yJ9bi&5O^hy_JgIC1&tfhuxcj>R`L9txs26fDt|Q{Wn8AHy;}wW?^zFs#x?uhDgm;65hnC z)6EjnI{7YC9C}t8H4Tk^OF-O@Df{Vl3Rvwa9J7w2-IbkhwCCjEXEq6Xd}B=sD6=B9 zyN8}!eUzlVnxqvfEvF!yKo$k9(T$WQc$=#2PpeS|7cNFh& zL`;^1MD(+NuVD-ydlyo?1JwHl=~Q}@?HuI+v{=QfZ|I4NwJm*90FuD<;s6VPrv<<5 z8szn)Tb!OwK*gt{@kA|12-iO227h}qTelD~CNo(qr39{SV8*hjLwOMaZ> zn`zi^OHIi7@?WH#o9U|Fp~+ay&UbJD0RgOIM?X6<$Ct}_I=zE~Ap*DgvV|L;Q@BOR zONJ9G=xee=Dm=^4;5V^=8ppNz1OC4*T5?HLoAT^3Ywe&R#+HuAzBke7;zqYh%|~cK zAU5NXpG`Cu=T^8jx9waN&X%m8penw)8~rP$weC!4)Zcw9XCwI1($Y>fDsG#nZ=%X} zEZeF>R(3IEWMU%xj=`Gi$qn*|TwqKEv4GO422>V_=Gx1|kX&^j2nJ1a8 zp}2K#MA>CH~|0$S)lc*i_P-rZWJu>*_QQ zT5xyXnU2NTj0gYIl;??nJOUW~V5i_Sk)f6RlmbPvFUg#IDO@O*tI)**gZ_c~cX=Ep0el=w& zPIN0!jt(aYtX5C};mp66n6QU%l0K9%K^y5%6{S+Gwl^{66Vk^A5m*t?@!|2tEd!;P z1UU%{^i^R#cYnpsb}$^Gw7S*jSZ>iJgI8$hgR^y@y^q4IHlOnP*T0Neo!=~ZaIh2t z4Rv;x6(@F!PC$(59a;5g{yl8s~7(5%auH(4Ja?GZBfF^Kw4bp2HhUX(Un?a{# zehA~OH~KWwsXtc8EnByef zBZWmxX?X72*7o8v-W)tYx#hH)7CCcKGh``KZx{`73_4R&ZJ!%XJfr+M5Xc|<{D1;J zk*|Sy6k+D~RP;Y&2y!CSX47(5QL|y{$0oP^Xxb7W4HDW`X37f63mq8@GTA&zz{dIM znmF3yEjwbjwfHNg>-B>Nip9ef+780Llesu%ogqJ!PYQlQSBS6sVa!pjdACiqa*Nvh zz%+?SSPpthle~pRabwBU=lRVq&@9%b>`L3^$Q;F{H`tAC`>mCa03*8)IyTL&j)XRr z$?9ymZB>`bRC;S~=eZ}>&%XN#DCTm}`eAH!Jew#NpX<#hLI!A+STawu;Giz_q*~lH zHCw>c?gN>s8YqCE2z3-)ryNeAesJIOAg+i{guX$d7BeHIO ze$8hO^B-xw2K9ZB$|4Ce= z@Xxp}yznsj-+k;}r9v5VBx2V+L*4J{KKhzZ^Q%TOUuP=&m35?@=8fk%!Is4TR%?V@ zkucd4v|o)67r^tyCZ5dK!E{EMCnW7LJE)Q)BJ*JD`bI`EW*$3$+*w)XRTYIDa&u$n z0!K_fU+uu_dU8<#eJmj*#omCyOCBEEp6EbiNG@O!n|wHnvm(_CiaDvRsIASd{3+9eV!S{0In*;j`)-*2a@gbCtOCMjolItw4^(bE`+W@i6^$2W}8D8ywgq=e5=5CsSE!XK@IJ$CNG1(H;%UEgT+l|D^n20&pFD5 z`_i1b)IIikS(VBP@oSgl5Z<$~&=%4Bx6|_DH3n>w7$J^-(ztdC?_^8{D1K^uIQVNw z+5jX1eDULzdfoGIN2FcKRH}Z!Lnv_>gEQvFk=a;d9&j4{Y9Xb`3Di@{k5dg1h zqtl_o0@uN%+AVavO1T@UK<0OOnL{cR`^v;yoBZGiQD0xbK=?Y80@E!28Oj6|HMOYA zfd@s=q_1Qm?PiRH&1!3s7}C)OJ{%RvxW$4>nO0u9$F&hr&O$%08}TD}Oy>ju3CNW* zWZee92g}ldJX)^6OX6o*I9{L8+e%$|N9_-(0<`9D9Y7^?%-oil6SO{-gbS~|PP?MY z{eEckhuFt-{BhA8+rgNY6*IawhcWGqz<|MG2*IE89 z+4U^ylNrdvOTD0f=uDuDwu@}uHE4`u;yi;*2$ihf{<4Do>X}C)t!H7ITCBSV;M@>r z_-zO`O!s2V6_b)+{V~x)kIzx65VF9aGOC+afX2Pct93X+W|zVP@x?2B$gW$C#Z?}J zbCPq$xTPRK#_V&O(D0m!Q~7S08ptz9DDF&TT<{2=n~S^`PEa6m_+11#hajElY?j!a z!uhsR{ZtB`8on<#G~AKqakwT*IWAONVNN-XtB@~Nl{;m5*Y@m944pC#*UlK15w~pE zgmpXlOr^)?nYhYw%N{0zc4r#XIKl@kYjvP4G>n|oqejp+C*k!V;!FiM%lt-#{wd+s z{JugC{pl&JV2s^zodIyEKLr$&phl8k;{E{`*twVB7TanS`tTFJ0DWO{i49nREIn{O z09u}+Y#|Ww6uTF7WHS2UUM5>^A4g=t#+$=P1!4)>>sd|4%tnd}EP6c51a~qWW1GV# zfr?)hAX~BOv?m9LCkvmQ>rg2yzeU;v{5*Y8SNZosQPlWkWY%CZN1=AW2x&Ex%FFD; z4B%!jdK3%PvUp0gTB9R7Tk3!w#w4#Xf>W0>>^F zP^>8_)3UM#<_=#;-W_zK!mS0|GnV0?m%~0|hC8TXLDkBbkB<|oU^X0TZ^+jUZP6^93{0tP4vBe8-+3<^_b)L+`ZT`?@2FPVYOiZ!-x25xBe`al2blMe7=d+ef zR+`+f2X$IIc80XioUWFmHb6(gzV=7S>jmH{S#}cKF}C%U_Azq`yEEph*l(#m)T6f1 z!6jx!#;sNZBGDClKhS<9f8kL`Uoy+0&SY1PO@o-ZUI09UjxCPtK?>86IVlmKR>?{{CEP@m3?;av1nSqIix}&p?Kob*@tOo^B4O)y-0zUt z=!h=)x;?l$maJ|1JPpd+t3-KKBl9XWS*_90w(bMeJ(kLuO-p*c0)F8_%4CEdB{FC? z*SkKI$c6UDvF-1_*y<>M;2rmJ>1Cx|jpe)qf1+bK>><`cg~cH}H!j_xhQ){?HYPM? zIJF5F5^%&(tE;or%rl;;tgWOnF)^9WODWM~N~%69qV@rbnx&ja^)K%slhfR%&)_u< z?>B**JBuV~vgpm|74_!U%3Fh0!Z)7kiy1P|gv)tNt&<`H5_lf?fBDBDw}jCYIG0b}H5p-z4v`9!-Q8V}tD@}pMmb!Vwri0C z3QBK#Ng$@s>T_h0-wlNDTSQhmRaSbfhO7&>$sGcSzYtX9sM@)YVdzsQ*Q@R@QsEl& zNfwtzzFZOkv+5z~+qBj+K!0#4w7fdql?FV}3V9hY64^9?EIA#|H^k%lDRP-EW8FV} z9|_+2dGV!5d7Eb^QrCXHB|xIv9BX#@B3#P!i(lK)YNM=)f4H_W<@Yz>eK1xE>n_ z2Y1v_79ReA8?CM;9=C6DQl^vU^@qK=h9`}n$$BjQCdjNVFQ<@@PJ873L&+IavO2Y> zZu>i!oa@PJ)mze&!?VfKOeU2wbz#p~G8B{`i>Qc|)|i@`g#jQhyto%?{2DRtSrN{U z$Z!eZ9;n<*ml&#&yc}r|u9O@mL$L)wT7SDY8s{ug1iu9VM zTs6ZzTCfcN=iu)QXURLCYsZND^pz|U9^1(spVs1i`@5_HpB5^~nw0sX%N|m}A95^d z7`T0DaS}L;VgP3(afYjmx#VK~{1KLE;C}=5q+|6405zYRM&EE4lYi1PK$uqGgwnp4 zwRinYSZDDrZ}=IR?C}|38iI22mB0oT^R|Gsj*en$PzK8KJ5t)bIj0pI`R0va|B=!~ zN1Kd{kW-B9l-MMpxhN(;9%R1bkP{!ML2GxPSO7?%vxSPTQLXpJ$(k*;$9P)xpKMF@ zeg0|zmq`HO;C(Js{UT3XM3rT*p<|#iKxfx}0>~jk*XqIXj9xt#9=#&#vJ7 zjtut@rU~b1Q*0VRan$w*aLf{-#SS#6gwgkl!{6NI-txy!)*L!z98GWROCw6=Qu^Hj zJ**h@Q(W?dl5#UxcGcyx( zSU5=0Zy5QIf#zix1YkDIw4Oh73CP>f;4Gz_h4w+)&dB(sufvjaZLl5<`-aI4wISAk zZZ7UfJzrJO>gH?F9*Qx)}Ae`Oe9sGABeji{CLzw{nFo689eZLZa6&AYF4evq@W-_nXe6*;L#i& z{j#}rDj9>CskW{0o7L9q^>wOilxWc zjSfX^AeLIi?r0Mx?HvDJnoClb`i2iJgfX2iagmmn__9Sq`)zmC9T*0!)|UF(m_bJ(5?VDP6Uz^$P_#K}@A(;i!Rk4uO6 zqu3+{7hPHNa+u<$TFkK;mQaXrS?e$B>D7Am z>Zb1PuNuc0xHawDOIGRDEhqS%ztNrlB|%6cvNGx(UF}}8n|DZzVticMq*t+?69+hv z8E`ENN(h)2uyJJviX2K+Wfhd(6`eP9nR^M40*#_fC?5DAaFPWQ?efj%rHCQT6~A#f)qL%>RL3o8^ex9C z{WQor-|pb6S858hM>0x)mxoFQEu4=Lp5^48rdd4sIt3+c)5l32bo%KJ@<-}XXLr}; z&gfk!zvp@;Ax z48LsT3$8a$4-6L_9ac~(im@quMv(+7MdXzp%Y} z>$BO|kY+2Wljlj+Oj!k@^DrDYcXx;9pL#67F~LQ2!{b))L}H@!>uU8+jw^uoqtGpn zZKRh99`Ss|Dl+S_RIe_2t@m`nd2iGqvCg8!-RphHOFU(Z@1-q;OnIlIcEacfPjE0+ zP4SH^T<(q>wkCwxv&VCmQv^|41W~;XfJ425$9$wego@y-TndXB__Hc zgU|1f++Kuh<3yKh2hXW2!?O)4v2lc+ZcqKZCTOA%gd_>>dU&|h6A(o`!P%USD0RgB zBP~v*OQl-A%9VqsR?xq8cTPC%$+K*kI)1<|3Fd)TWQi1-bSoIyE`!Q%C1VuplB#R~ z;YXdhQXv)KHFH|d8_QrvIXvz15!HO{W|$RQ(&ap(wy|%f?E)SHd}!lmCc`Pztunt> zVJ{*44NH#W@=L=1$rAG}W(uc;i*nDp9QG{&MEydFV*_cd^k-NEj6Rgy2IIG)9o435 zR2=@{))x1Cc38qedHoI1G|E8IQ$WYYx6AGPaWBy8T@j2=@aBXk?kGp{Lx{wh;aS1j zb}cmNE}0{e?fvC7E-t~Rg=nrDW}P-hjY+KO&rdta^cQI&b!s<+#F@^{YRwjJhA#!z z8C85Jg91TsfqakY?Np!4eGS$R`T$^--Aq?DVY*L*FJpMjgE~+U*(MxOmVTyI zjUV-KSUP0NA_jfqz2l1^)wS&?QBv$b9%>e*gM<SET+?yqCPOL1#{kVFX~e#{L~Y z0Dy@#2G1fy~u-|^U4P8suY(Km%)x~;u0vi zF<-HBBNzc-l{M#2J}7m&+%J7lxLNFAUKkFnH~G{i>mNOBD7aRo0{Sc;+2!&qr7NO8 zgn7vi<@b80(N9^&P1R^1`hksQL{Z$PHwJv^Cs5P@;8}+8sd?{}Ip=;PoZnU6pg}8A zKUeSeng%r=@+x`PV~V7;Sb(hMrLyY?YU#1aN0bCp$)@g$AEOTE4yE_IYU%X)z`uCCm7cYVc94)V3F35%?iIOkZN4+L(r*lE`i$ zlov*ty$IZ0VBMDXvMG_rl83{3<~dEUxkP*mHkuD$2Nb72rBX*Q3d%c-$SKt$2x>yy`ME zkDwKIyLz5eaaJ9>0RTot^$Vq$l;9=CnsyUuCf-kGp6R3ZlCM}uB%em+Ight;miBVZ zp`2|-63>XkXg^Zt20f5M*R8kT#e=6(lKwpo&JHg(l9-g5yqtir!0B&`h$0M5*Q&aj zK#PAZ7TR{s@y4g|I%famsqo`KAqf-i!6VNIxevU$M@tn|tl`7TbIB#dOU&2IOWV>{ z26%T1X?zA5#P|n3q?&~)bo6awE>FHFvORO!__#V$}rd zIuyoR>&L!979jvGFJ0f41H&diWUQin3Mw+(b^rRc?QH5-`-2ODX#_z`c_l=&T;=bz z0Pyk1HJTw%xGQ>@5BDmK;#)M^+fV*G!8hqWF1FGVc!N9>bbak|dr4&lAD=~euo;CC z2`37<8HI$o5ZAmhL|XfD-HNj+ zzSjKTfQr=cYTUY!2>cBP=5=)%g{zfE6fBCgvhUu;2ye|)_$G2U*I(?U|2}=gtA2`L zST95{Wk)Q{2=|ihC(zN++3lAe5Io`5KT&l7HJu?Az(w`d`1$$f@GvQC9d3sS$^tD> zE#VJOOp1#&3n*ONT%yA2@Nb*+aZkzk6q^F3`;#}1;>aMF7<`lo7TDCREhy3S=3qg` zU+cCXOQ;;yZ`&>RTh{r#NXd^8S^0D$txa|6UEifvtc$n;^{O?DXoEz9Gkfv<8D%R0 zWbKNiP_^_W3Er5d-Ey#ubj?S~HIWt_IEt#5_~?D^46G7Jf@rwYnW=s4k0?JVfHDn( zSBj%oY(TNACQMKsVvBDTMhHGvj6@R@=*>$Y=3&kHTx=HTRQGh~g%Yjst`}}_E^XAOwNn(|o^>$g_S02vlIkmkEP+vBm;~D`MJPHKv z7~9~O8e{PWDpH~v3sr?Yjn-5=G_x(Ks=<9)LB%gQUJnZufoFq!7}WDQ=Qa?EViIk6 zRd%)iO7_vv{v-VRr(OQmv7()#{SMTkD0DOe)X8!H;Mbp+Yyk^n-9|4@iO5m@Gv4VF z(nLAd5W5!K?Yc*Gv8>OcrvALPULJU-)Vn-8Ru_K4@RX3xL!5TXuf@Pu_FoU9xGhh& zJE;TP-udp0PiwL`xuu*IR~|vm_7DUDSAq~OUbI9YK5PNl_4_SOwDQ?B@`~jTu2AIO z%YAr*1&8z=YqRCk&(EDF3K7yCq;bWmovDMJUSdWr-Uvc16B1Hx_Y!6W&(EZeW$5Wu8}IU{30r$2lcbeM1*tAe z+V5Tn2%{G{u|4Rx3Rnqv%*+_8(iB2(?|qvOWr}}ykag+W2@q#F3toKO0w?TIwCa>| zu)Q#Gnyc9NfAWFvB|L$-BAqmT>0J192{%r;2<5voQGtgj0y6j333JwtA9y+QuOE8S zz%(LG50qkw)!0Tg7>Pazsn53NFF;P%8MRxW3_qfJia%1hsHH^JxV?~-bt*MhTxr5r zBp?qV>?&1l?B>&|BOKF?5RZba(1pC$-FSpm4OL@uBI6Tr>y#D85}Ga6R$`<9dgn(z zJjwh~c^jnsdOQ_+V~rCQo?%@a$UDEsp2_tPW#-~d$0N#A-h76q3gK~q#vJ5p81j^6 z6S5GHkO0ZmWi*?i81sIf3%3T|yIMQ+Y|S=X?3RgE66;!ZK*5mA8zv;>+nU*AtOBe} z&O4otigp=ymmtgv(*j)9(}1aXA+uPGRiiNQmnkG15fPIi0g(yb?;mZv2k?(5!fD{5 z%nX@U$OIU1@AOlAu%xTrfamL5g*I-10WJmCBEyJ1t5W@$?eXYWO%@@n!~RW6@HP0{yrR$rfIf?H#1_J_%tnFjB}v&jw*Ef@jfeol?Xx#IO!ilx`M+0}?P^N^4_gOqS0lewONqQedP%WmS9QJc&>y|Ahg2cMq4GZg(f^S&`pd9sL3** zRe187`bY%|MaazEpD2H4Kjh(vNU^1=;=pZ1I11JnPrW~PPXiU~4d!sL+P&!uX1U_{ zScfLzs$6!n0VnVx_1D()72zOx;7*j9MziJChxt-*oF(cpWj(T~(H`6Tr=g_0GK(SC zBl+6y^zO0)9dUp*7xgA(F@#7~(BnSES-0nA5nDEuhjFj}MS;EeyV#S9t8UM~{u(h= zI7CURVrtjlOYpb(%zKJn_l`OI5ew-ZiW*bh-a_5?*{E<9#tW~u_>Ih&xrXz0eWDuM z+gko3N$Vla@#B*9XhA2(8c9UnImo6^_xFq-5D8iTYQBZY7CE0x>RtrkC0I+BP{RL% z80%yXf90W`R7KIfm}DD*niCY@1r4#^Sa{cHcmF&^0HUUxuihFRTX9hRFi^20GQ?aZ zV@9dpEQLX{A>gbtYVbo*u|_XuxZmq%%oV7DERmCoTnhzIMv}DsQOBNC?DIqIx>^d= zQBmbJ-67^q#YH~LdeCyayreLHXXaww-u6Z6uzbY{WqppT84(J!aP?$sJQ8(%FvC&J zLprWIPGDzD+&KKnT(btUFqjPB%jSM`0e>L0-MgWLOx1?a@MUsZ&e(d@?g-HAi(`-o zzQ}vZtoE{P;_mmbEwH0rB6;gT(j;!iHd06x^Ni7et8<6|N951>T+@|oXtl=%lV$uw zq4H$xF>FYf4Ba`+^X`-j^$}W*nFGD_e$!8HjR$e*!s_2&R;nW`J+eC z^lI_3$W|Gq5x$2y5#lU#bP_VJv})f!w~W4V8Sa|xk22f*NXcz_@O|@GonP{Ct~bPt zZp&>&VC8HcC7SjfkK~}XD-jAOkNVqpUjrcZ;|0pvk7Hq{yKZ5%xWLPwB3m^VM^o-uuEYJ=M7jA5!hyILZ885Dd2&D z>bPmZ_amC@*3&$m5~6N4q7%y~&cFo_Z*e8?a}FtHX;4g&1<~c24pILG6}1yl9Q+u0 zcL>}N{3P~TVoR7m`^zefT;#4o`7Vj$9U>nd%gpU`c!&M=8A)Q3ZpNGdtZKPa@G4Ru zW!ZC55>fALZ`wzI^sHg-cB0N80AfKqoGO_0%vP{8&~q-C!0xUMqEO-|4ch}|D?fZ) z2VewQDjvL9B){N;-tV!6$_+C|G7bL3pTFO&a|k?oju?!&2cUa0vWXqBf8N^I3Yk68 zbnlo;H>PxvAWl9Q8;5LmWcAF@0&K+ONvmnbDK?{rm}6HL{ZC|TielN!vMOI6bw`;n zLpPsZ)<4hilLD~73)$)4nJXLaX(7y$m5P0#`Ve7Z(f%Bk2;6|49^W3LlJO#KZ$*|L zX?C%r0OGZ#kdNddx(%OzRWq=F<+KA&o$_}bLmqC3c)`{pcE<I#_lz8Ia^{?JjE!Lc1~vaJY%GfK0VaeYyss>#}_KGNV)ZHu&<>FtLIv3 zr*S}H&e{WAU;7&1^x?1}W`mU_tg_(wrgcXLTsUQmN|C=}EW*M({MT;Q%-JEA$c(Em zr?}l$h;R3=7me`bv~{XL_=7qXBQz|d_FD&46dz*uw@Hy(>SfXJ$AXSsY?lj${$z;G zRfuPMv$E#!Q&hbe=P~1wz^pR}c90QGpLe=5OLnp^`q|Ms54gB6Atm&)vnlLc$1_(A zB14J$45SV^KtX`^^k`Ul=3UR8%zh%1E(#B;<6=x^ONwQTFWR-k9#{SoDzK0`UhZh5UZeN5+*_iW%_&WI zxvzE@Qs5HRJ)W(H0QhF`d_~{;LwN0;V_;zPg$uOj^Dn+|*!q?Vm}q1G{7c07$7D4= z$@KyC7SXyV)3c{Nu=aroN&HQ&1V)pAaBt5`TVfCX6^Q-$9Y437Tq zqF<+kEfSEr*0=undkFCNf%O1UyUgny0o5uYD`a_SEu~H!=nUZ2Xqyl$;K%I<1T7hoW#$dzIjWIcpae*g>iZMzDH(*isgobeMW`{@cZ9n!xE$s z5fw`gC|KSad5!X5KDMH;A&g7(g*;84Mv0?i?YL!|k*7mSCgwdP~3yKFH zbS|_r#8V1qQrcI;KU}U^w`xvz;S6>eD&d=~YUHk;nww(C@r>6y#^9f` zWeVc@_jvm`bhQKzcJ*DV^T;M$_0 zyXM?APVDI=K8gTX2oxI(H(p`n0qQvi6}}D_NKHfgkvpGsxcZV#wGuqNqR4o*FfguE zTL&Jx2_N_dH?I?{VaTx|pj2*HppPVMoXuVtWTD2IpV8|j;Sd7e=zaTcVfQUx>yypV zK9$nmbJs1xL)(S@g`ph*rESbV)1J-pa5`acv+r$X)-p&0MMHOH!1~NT!nzE;g$2av zI2}r-BvzXAivYxf%((_|ANf1CJCeZtwR#V4_e(=EHC7YWt8|At)bt!a2kB52QcqsH+L^YHA@)nXG6e22@qO*~0q<5|3qHiqx1 zQitft*npW=Zf^9yofW@jv-an3tCy4{Tks+O6x4p#K7anO1w-#QKFD$l%`R)SfW{%+ z8u^U(*AD)#FYTmUdO9WZr-c8nPyF@w3CUwQKeY{&&yk?~9M#=a?H=Mn`X)n`ISFlK zjDxL#=Nh`3AzSug;MgXMXQ+S=I?JCohlh(TwJcW`e0CgI=f(tJ0)cgiEG(oE*l zImcY#ze{52c9w<5{omhBHYTt{a>E~ojQzdx{`0q4Cki3A^@)4-T7P*K#Ychs@4xZq zGg!iXq${zff*A7kKYzmS=k=ZX!|Q&O%8vOZEu341xz_Fg%_KHSaCtVN0Rm{wRYWq|H=RVkBU73o*k7R-PP|$*RJO+8upQfhi7K_td<>i z_ktpI6u79~vcO7(gtU#H@_A3j5IqB*US3i4M&iNcfvmpHJGWrDe;+RR$Jz(}opyMp zTGoL?{?BJ*d}5_crR-*%8-T;vvVs=EEpW8`3WpF+0=Tz5%c-%=vVzna2Fin5QR$ZvH&Q6-X>0~TK=1s#@PQhAc_Z62#!b9f}l>7ELxk( zr-dI%i{%&>?sx0SXf+WL)UTgRa{2rFvox7Zm%BW^eYMK0UgemgTw@yXcDziM%xp0i zx1pgWo>RO?cl8T^GTV&O)A@Er!VB6zV}$Kn-?pv~%{Q^%mbGnOlR+k3nbk61pYG3o zo~br_z8_Le!pT4^;2Q0j#+kCtq?$ibs#S&T!Dfbt%cS~Y)_DJ|`_%hWr?o95^=5nS zTTUawdA9>0%UtEbB)R?6`2w>wi5bp6#m>JhrTZ8Q7Ndtv;2;(DzNX7MbG$0>-CL z%@ItZ8(nvK)&`@Jl9MfDtDyu*TbyPRfOk8{&NQoy_|5I&F188DPY?B93#y&G+X=FR+I`1-hzwdWt179wnh8GLPvu$8yHt@h@Am7SqFm;ZdcNVEsu+ zoJgg$S0DUA9yLSfIQ=T6xdOK+ebQH}g*;bNSv{c&gUBJLNx`x7N;I;^_qVg_wgVdV z{tF}r-g0DDF-nqn@@s*(CrK9SwQGqsqRG;g;1V8N?YMii>u6*Q){F1G%Wa3I z7?FRexOH0@c#zXwq@5zq9Z?ljrMc$ie|Ni(lb=shqtOapdOz~TH@H^s?|A+I&H(PN zS+mND-{bu2g)`avrC9CM)RSeeJ22s{V!=Qa-*Ii##_(A6Cfk~~*+j8SfdUa}_e1i zT=hoq^Ok5;1QW8GKlh@bmG9}x)RGcx;RKD_rDY?l|N)!RjDKLC6O_i5$a(+I>d5nMNy^WSY z6NJw!lE7;G?W_QaV~|odjfBMD;$xdSaMk)+33{{uxsVc@>sqn&Hm5~4w!X!ijyJHR znK+498YTo}@J1gkKv<^Aeb^?#cAv^PJ74dTv_6m`3mOGT;f60K3Y4N)vt_NvP2LtG zA|VAGYcaF(H^^6YqXCrX`QljwiifAg2mRsC5hid~KL{_@8dXu*DCU2~pw z32YzyL?;@S_N}qd=(z?L3QeumbaL(f9AzF+oBd_rz(qbsWqJ6wsZSVKgiq`F8dt_JZ^V< zN;KybM)$kCPHXm2b1DG4R+v2FkOi39rkyP`D40S^s{NL4-I_B296C9HxZ}nv%uDxN zX6(|5tV*-FczDbjOl+j5kU9*2=bYfIrSnsfttG5?7tchLT4;fUEf8Hix2>f@_p8QX zfqLiLtqJhg*LmvEk7~-QozW0FpmHv%LpQ zO!kqD71;Hlv!5lE`6Gxc1_TF2=JHKkCAa1F>&oK}6mHqL)!rVTi;w3TJ+4u6t2uWC zp;i2P2(;>6f*8_1hbdj`qoFwHb7|}@ffh4OCQf~^96?(1hR|ea>6K;z8S;oAroJSK z?_=EP3FpL}hR1kN6f#BLJBE9YnKbak@M2tZOUpP@P+9U}l4NNzH;tt6yKlLmuE;K( zxu(NctMrdtq%TxeI&YB{AA>8-6MIE2{*Q1#Ofez2rgf2lWZEpwn$^r4NpV3+4rXSZ z8g=xNz=v1#3XRd6NUP`((_%U@sRAV>U@ed3rDnWc9m~pl55V2*C>_4Rp>Q({*XZV+HTr2yZ%sjsW+u1Gl8% zHIub@N2I%_0whJOA8#OswoT^S(D`D+asIj6ZAdQ6UScg9$F0bUM>uOKQSWiz_sye^E<#b52h*B|Z zIyrPX)b-XPnf{Q#rj79wBgW=(F~1D7bCLGmagW|!$}nhWZk1%$JF+56RKfk6;Cyc} z?$(CN)X9mf!QzTOq^)f;SEcgqWK&_L(vr8v%(@9Qa-AdxAlGtPl zr6TFDDN)uB*^_}+kQ4S9Ev|_8q)x=peISZAPIF^3`)76+qEY*ND4gAT`7I%zY5D+D zgUOCT($lPJdm!2Zzua!icXbw>de?J@A%&+lz@%4MyukUyd=IJoB|hDeoSc- zAma{nM%@8wfvYcL8exQo4RTbXw|8-Bwb5&~gEOb#M(Mq}ntFk@8+I9Fg~C;KtM6V{ zCq(2v&$-=TG7*o)?RgxO>a5FBPX^;&RGTZ6N`Y)i=s)z-x%JWs-m(VVB?w6On}POE z<$F4QYjqijq=GJQ+wS#x2QC~p>Z;vPG_E!nCJcIR#i(TnN!KsZA%eSX-(t_sCYMoO z12ed<_@yZbZ*NK;lo^$j*3V2vR}Yv2_1n&6M9b-Qx~NDNYV30O+y*~JW=hZSz8 zKd4luEWf{GqXYv;>J=VxEw6`Q7DSAE&YQL7P5T775jit1VS$kG*j=rqcIj03q$>GM zNNky=@QB;J6%~#hkk+UrM3Ou@9L+t<`&NF?$-{p2`x5s5?Rfc}RDEaARq+$w*W4`f(u^+4UxWeTN=!#MF=nrC-sinp2qxP7i9uf) zbD3GJX&Eu`Oxt3U$VNL#5FT6tDXAYr+#{ERx|upQ-btV`pkd&wQUuyIP_CMeg_C-M z(LCzZKDVLfOA6EH1HDQUyZ2T)Mbl}o**3-nO?o$Fm;(ylNnXcc-i2y0JMjIEOxns` zWDnx`b}^>W1XbmV#juhZf5LuGiB2M(9IPVW2z}{1Ts1^CO5(98f4W$dUp#n|{T%YCviIYNET%$9Ff?7^9?FVUZSR-OdHim7?KuyZ^`8 zS4U;Ft$T}rAP9&O3P^WKcS=Zim(tyxBGTO*N_Tf7-HnuVcQ<^Kv$yB$v%h`L-S;}) zKh|KNu6NBfpZUZu-f_Jmg;ZcoyNJqDG+di6TWy#sYLX>t9jrp?Au8=u9_mg@#Q^L9Zy4x9)u5mv*PD3au`WsaeYqnC}7AzGE2OQ*hXnt)bco|SA$`V>veEFT7832R8MAIg)O2^woJ~qXR&h1_~P{D zPR`DTr{d@%Fi^2(;k?g{(l{qYD}Ke41zl)~6jsq0`@QhFgWE?i+wF=MZfTaiOez(~ zOUEvu)%sGhYR2p@9PrrK;ssrg3wEM#YJU_v5$X1Y^0JEnnI2O0X@;>{ZT;5_H9$U@ zs;p9>yY+Kb%;}&x{P;^#*$1ddBdbG&c3ow;rVeh=e7V=`&-Gh~ht5DAlD$WWI)Y<-)V~pb<9Q!mXHQ7h8I)$hTO--lU&Mx7rA0V8yyC7h!;Acn>m3Df0mag#J?-LcGT zGa8Ob6&{VvS-MW-x+WgR(VMD}OXF{!Zc`>oTTQ2Ht~{sKtRV-+KG$qMp4$JV&G&~I zg9i@Xmm47hI&}%3o)CuEB6I~JjP^))XRPn?Xe|?Ks_b<|Hd?~z!QCy4%|;jU<#$vJ z-_2_AGM*etZw`TshEb_Z(S+zb<`Y?ri=TDnPP;0g+0tT#b+hU+Xg{B&dwfsNo;=K> zIV{pP3TsKo?GwDVWa3t%rsXME^L?2_@&(K{6^d&l?8rKiC`w)~uAh42OGbmT#<@$I zhOuThx`i=Y@V|gJLeTi2%lE)xKgPfx3f+fZBBxM<8L5Nh3YBMpTmno$8I`c%LwQu1 zLG(D>M z=_s3DgGQs;>)q#Og@w~}e*vxj>zA%brTOc#2*c6zuRU5$`qY{(m#E@5r_438mGTr; zjFi)`ZY2{;YG?q@KAB$coz=`^u@#>Ku;I zp;yJ>zQ^J9X3N%L8TIg?Q*?~~WrQu#Ai zK?w!=u`j0HR+-J?UE83IM&%lgp293H$QbLkZ!ub-!}Nd&kTf+(+i9sC$8SXv1Z*3L z#p<*?8*t3XpQ!!_8IWR{i!{JAcbfFms=_U4y4+>4UJaey#=BpZOO~5{lL^9p1=H|B5Oc4GuQ%r6Yh4h-3_n^6Jl48lt#o^1{w_!zZ z*{kfN{&ura3mVHGZN)@L9Fv)FK%vbe)QD{lW4te`b!DLk2w@rWx&k9hTxDEMuCjno z5=Cm$nIDJT%1PegWpB2!zPsJ5w4)#9Le7unxt6l^M9{S@;r64jbZL(8Ewf9CF^AZ88pwd@z zbercnHj7I{WouZ0N9%pcR?cbOr`?mx6>4@TPH}G@{Te19!tVU2QLS9M4)X`vUsKB6WW{>P>y*KZaS!d%d98$>JEwlYQNCy3%E;R+Z$C-ko!Q8G_ku13Mcs-ylEH_!s zyghVidVTFV+jo{3*CoCUc*1}EzW({Ap|Ot?4MJl^#n$ki}V*-N_DYNB)W@lC1XhyH%3Y&Y0`(+R6mDy|vXsJTN zA-EnA-TUCU3j$0S_v@Wb2!xx}n@f0fGK)DU*YjzsMh?gF)#g*o6-OX)9SrZq5}x|hi?uNhYgbv6APY&5~$jdtE7jj-Q9Jj7*6c4(k(=soBycy0+i2}gJDZQ zZ#DKcRJ^KcPt&_c?^07!Khy+yQnuRp{h)z)_|kIS9+x$?Nd zz8$Gude+N&gr3<~bL{5~+IMzBXcr%Y_te>XGjEE8Z7sRWKot*%Hfm_CxBJ@t{@okk zeNyXoKgV@MAJfTwv~5nR-||haQAK?BF5r55CNC@B{jQa0>wfVAkcSFWn+G&KMx$XB z>SIsxAk6xU9d7GAEZv@{kkVBuQtV2l%r}F>UZyklGGQ{S2Hi)fCqN9;5eXSMl66WZ zrXw!7TxbOJvUAq9vzykYY4foEsZIRnb^ldReWC)h4!Ke}66eZ%xlB1>Dq}o-R7I@>KR)M8v|IyM&_l^6)Hvixv6lVng_-9Fwl(?4r(=xT|m`Q;c{f z*UXz?bH&~?K^F-Q`6_Y0z2k#h)i zt}+knT%`>C&UL4h0C(aU!VP48sf>(F5d({}RtBOX&<5hfP1$Y3`n^M53EXI_IEaa^ z-wOe!!pypITf}&ipOv1Kg_^N%_nenfQRJ~2G;%pLe%EZxe7r?JVNfx>? zff;7@$)AB+&Ohae ze>kRpyR1iq@Sz9T;xQnkHqoJ0BtaFx8>+^e@-Zx{pHeY1a$>*+&p5iT+}0J>mBHZC zCUuQQogP9w?XGKC2CLDONfiHXzW1CWm5W{A znMNX!8Wggi@6M>2KN__OgKb5IcaEzIrD*F#rC?&jgT^#HL5FnItiXj(_oJ2C1|niM;wJ@ZBPGOC}&?p3xu*M1YWxcy#ro()5;}k!qlS+E7!na3os1ad<$E#PH)PD$ z4%g51lLPaznP!{HBCP9Am$!N+TwVG=@!_`sMPjK@7|ANz;o!+(va34od_wB`x$Ptw z;FPSkj-I_9iKvRgl}v7}*BI4%n3POc>k&m!D}Rn;hw(pPDbw%O8+|3uu38v_LGfz~ z2&;d}>Xpd9hT2Q;(;!9C4ZXZV{^Twuy!To2OqpG>Y zRnXATvT`;k8A!0jDxE*yxZJ=XVfS2zWZ}n-&-7jcTkR=!iLu`?uY`;qQF)L--fc)~ z-~Nz{*E>EAK%*hCM`AWzs4f~ME&dg4et)NNg`cu;5S{0-z$0QU;Hdg1BqTiJD$gj) zU4D-_J~6DwMJ)L>DV8V*mU0zGIlogx>CI=(y(=t6D6d!Mx}Nd; zz`%gz6CSIkGZ)0`YgM;L?KUoF`7_oo&Q}8J|HC5wx-lNUhdZ+8LwI!ihwt(CFFo4O zfPS48e46{;{15+acWcx==$u~@Iov|}`UN}QdN#xU4@Km^{q^5}*N+tFKJvG@%GRD8 z9fiLG9=ndR-hr0?LGbLqMVp-$JYN#k)w+vHeSFwWl^XCblU@zL{>_Zy*CPeDnEIfG z{^kkV?*aKgok4%~WuCuJ1}dOp$&;x6C*SQ)5|3o9w%->2XBfpFzCSL}Q+^?#e`GUc z>%9p+0QM54BYA%mMFDh51g6UL0DC5ckX_>0vwuAT+)bdfO1G(j8Tf}E{^8&J_e+QV z$Gp5P<@*b~Y}RL3obGpt9J6!X>NhJrah^b@j0dzn-1`Y!YQAd%lUZ_wB5|&tKW$9z zv5(Hroof(Z=GcOMYsKD=I8fnmMD!H!Xd=Myk4Hj6;;6~oczqA} z5!2GrMzY&ei|j6ID+ED?NP?Oj1_|dYsCtf04nkWxr^<9QTD{<8f_J7Wm~NO?d&cvo zY1P%#NJXF?TNhhRMuxRXR<2X7b2Td9K$PN}r;3iKdGs@- z`{pr8+334w9lE+ymN$Q6w=Aqev+(R!k&SL7lyJ9AO|>0z56vXa`qsCwVU9r`FA zaKT)-Uw?PFTFiQ?XG;Ft>|gas&$d0=hF;L&NM$EQyNKNDS_Z3(B{owK^$EaK*BW>qS%f>T9R zA{Ra&nmX-qyU1|1J08I05|apTF&_RNf=pX6I6oNSI5&aiwcv&k?5>A$imCYns) zqb7TAH(D9crua17bQjB~&Tbn?dX0#cj_rEgeV(RaxRpX*{-GP-Lx#g0tv9|y?Dvvm z&HlJEGanLCDPGZk$MsDYeoY1x6f2gEnCArI$!A$^N=g!Xj~(2J%i!Zb zOTfG)mK|#E$oV^A%M$)Tu4XkC<1=UVT5OS^4Dj*o>Kz@;UQ83>E&p)%;^^>@X*wB2 z5!kzkoVS&K=h&qIelZ7ppCIcmgdPTAthcPzXt!_m7*6-5)SEew0cHA6~u2HNrjy~^abLR#Eqxi;oQ95A%0*9Vib zfR0fblajFGV_-}WL9z?vBh}fPbfJdIEeU9Coe^txuK-t*3o&)2)uaA9_vH@*ksbS5 z+cdfik)B%)&U*5*%EiH6;9=XdW~y3&a{q=wR=pc{zGU8oXp&XwzPaVyG#4e|A0C4c zvdqYM$1fN6|9ZMAK(oO5)9YDYnzn|}Ime9mpxIeG>W;72-T+a-N@N7&NtokHw;sT= zT*~6@c&_vu<#yt9lgX+P&|H7sB7-NFVMVlcqyQ5zRl|b0mfKum17r^U{etmmXe7xs z%1JAX=lpMOZ&ynA_`Vx-7OGoex!=;OK5_E)@{;yjYR|T4`7F4+ob$OzqfW5tjw^~< zqn4j~fI3nc%Bf+lCIan)_86`mXhf=)7%?URg$x&0SHCR70>vyeM&prK7ul@JF@7`a z@+3naaOmJiOgSN^FN>I&6^@BPA#Xwsi#>D)Xb75REsy2CtFhpkwqES(en@X{_4dC< zq>5TwYQo%0f$TS%Zy>l=t&~HWk@5c2V}|tt!~P&Y;8^fqmhrg%6znA=XM!* zw(U-re*+|*p%>ETT|S;G?;svlC%d^~d)1Q7*2EkovKtemr-I|Ta+#oA(LG3ph}AK# z+Z~nfws;$tPp$9I_8MR#vwMRg{&K3}M+2}=9&OyP!M}0~o>CN2)k>364w}TV1cHP4 z8)&QI#F7Bd+Z`%k#>D{K4{Kdk$)Tw=`7$9Q>fL|%(p21D89K3U6q#mG)AK{Dn*|m4aXV%l#o;b>-&r&-Clzk$ChC`!KAjr;+&sB zSzhBI!!npAp3S|mY7KVkPdqGfG@soD%3NR6i`na$5+rj)&9J1U0yESpH2a^w{$<0b2=%+g=WlJs7=m<(Kj$Nx6t*=WL+gLZ9m6qIV21pa^qa0n$DKW%adT! z!;t3!efIs6RB;aq!_E#{hPyi2Qfz&G*Pl4qHI~IXAab6_ z7eDiWLSLZFSG#EH7d+i=lDkiopC~t(t5i2z`XJ1$$vrx!B>C~Na+yvhPDfz0e!sg9 z_w9{)IY@fqyyR~C?`#fyA_2}zxsxpFC2Ji^@9He8waS=GOO#O-fhh|lEjoA8SR|M0 zr>&k1Mxn|bt2vu1$21Wo$291JJC`&XO@C|-IXUkE?vMS4 z!2LoKR|IMv)Mwq0%Dqxu5I|*+n;zpCOb}?49A}hb6wVa;+3nAfT#xIA_a%@p7icyl ziYR2`(>t0@mx_y3&4mvnveRr^HBYp%mQ|1`!mkZVawHY?ES)M`+m&KVM!AA+-<8e5 zhppKX&*6(xidh^S8X>!Pp`yTo#$Y`fVXR)WKQNEaj7NB;%$9Y3${chxzi!o(wp%`+jm|P;vVl%uI3CYaquW}&k4$Ok z|K*e)85RyvBGgUx+5uBsyAPrnK87+wTDvjgmf1*2Q_RxbRpc7#H58j80o2dUJEmLK zW135Qhv}2JHtyVm`CUAmXJcHR4!Ju+Qr~U%Z))^JEz`x{zxUl?J2FJ!44}PJlj{r& zF4?`v<K5TYNzJeY_ zR7%5gT05^Y_73^RH@8t}lsQ|_z8@05raTMFTNg;x^Nnqd>g<#KY;CAiR0z9dLKJh_ z1lm@D1U^Vn53nnmtVO%>q()5*J5-2-mu|N~cQ?k-v+YxpwYHl&DhS)p-=jdFO6{&u z)73aRvbhBI<3Dnm9en8r8P;^S=S(h>i`Bq<@NNnRrsZKwoAyb>2kDEqdHJLJIjqBR zW;&&C$uIMmH*r!qe2$J9H>}P3n26P@R)EQ58gEw9(pq%=4FTN^iJg_5b!^SVWTDY( zuR>h05Tmq&jWuJW@*|$((}ml(`a*pXHcXvZF=0i_^~esfH^*C0pUU)^A& z`fD^*2=nIPc(PsQtwPbH)XYhLHu4w%9+?8!SBI#_A3rXxtgWpL;js>x_MI>HO-~f4 zM-T_&2mv4+!;B9CndArC1-5tw-CPdKf%NMKgvFrGYMz2@m4@r8K0ip|vYjUfv@q;7 zU(0px(-?a}F4ko4ga(&Cg?)SSarad{r}^Hj)p^7Zp6lu@t@#A9Pv`3ij&pB~@S((( z)PJ3G|Lv*q@W8Uvv55NkW=ZyQaB$2TUVGb4pV8xYmB<9KP1mNuU-d=fef@f}xT`2@!Uz=%82`};pi+n139Fp=@I@k}A=(Hugz68+i7#?b*xoVuvbxjiK z1O+Po=5!q0u2>B{+%=Q>N)(~#mAFwo{H>X!* zw54^6C^WNqE!7KzDl#?QnRPT|XAa;%Q-~A`Gqew)4R{OKURXRxkR+SiM=3*G*N=L# z*&2j=5cXk=(ElDAtAD~U^1OK-Fc7KA((g=Et4ydB-wB`z-CbV+BIsog=Acp>)Adbz zKqa;q^oK-PCY$FtQ+y@P`cYRsG;m8Cf=S}{&8ZX@1sDmc&~_V~qV*S37_84r zoyN)0+(8@s<5=J5s3)LB3i{aXr$Srb4WB(Q1=`zQWui|qb(A%)-yAHy3#b6*3Lh)g zb(d$W9RsGgDi&wG;Ekl6ZOfA;Jd~8`w8&1khQ-Y=PW!7)Is=Pnt@@S}D`Gg5#o z>^-*jNtO1d8{R{ z$sGBBn;VzzFeWgR4U=`Z76SBu@hb)RL|2Qsjv%Xw64)~vD?W$tQsLkt@HTbk#n%r$ zbq@!z2o={qyN_xBV-uG*MsK^lAIhnhH}5h$vKla8*RRZ1sVSX38>MNIl9DPOcB{~$dd0h2q?$)8o^TSNc6xYN65HQ9 z&bXH!YrPhiV$R1t%{)w#{2+5kXhg%Dly zgVOQfVgdoU?ELzBzoxC3ZlPL((b!r?zpB>N-uwzv zRK-Xb69oRUMZlW4F1KdTrGf-S5%*BAdfjGQ_vnKG0BUc{IMC3id(nJN|608d#f}^i zMvMzx3dnF|!7G{#UG`3H?%fKt&1hr-FPG7n<*Z>}oXnxL)J~dF`ETVxD9opTv>eGj zY{wO*JNSuOy+OF?w&D{IRB$zvbq)@w{k`=&iT9zGvmJ&!J7R28D z;`1~f0mO1ORD)P-7DB==ETP`;O`xLdUVR`~WGf*eg`|c`E$8c~EdoAHCYV_cJ=WZt zYm(%=s;BVOaJWysyY&sKE;k=lX|!rqO7a%p*eF@HN^+lTwDx%*me?$vy18B(OtoW~ zcHU;U&X1R#&br@?(A~No9A+`txA4hB7d?M3=h1<%9dWgP1_&>5#r&`1t1OT?pDU|e z?nB)-EZifqSkzi{m)elp87=X@L1B}$dyJ*?v%py2QDd9Q?Au_|jYwnB#Xg%p(;Ln+ zn0R{g#@YECZRa?ua77kTTJ$^i`P_FTfFxb1w$Aiso=IoDKZ+hkzCa6hVm&FiT-tqb zP_vrJN9o%P^W7eruLY#{p0^M;8}S^-u?QVj7e58A;;ghdyJ4ES+yHk2&;( zag!P>#wlZIqK39-Gm)bx!{_mY5M!}`+z_YxSs>Te4A2gFzb?h?H@?waGRk1T$u{Ns zT_q~VtisCAD%%~c@M~Ju0J1Z&fDb>bq0Mh82bo0kgfm>D{N+{_cN_PTz;o^-&aH^X zm8G4;rFx6jUr8RJqqvdN%r^vlig?~0rRd8@}_(H;;>MqAe$KXuEOTdT`o;U z-qiIfzsaym|9ge4#)Z?${R2|I+onEOW^S6%@OviusHr>K#XF3v!w+eFQ4ftkjr~(a z@s-#Hj)uSvx{tHx4}-S?L>iWnU`R{AlOm_L+1h1!g9!oboUK5ZGWdCp*6 zICiYBWOXFoobNJEkL?3#s}F=QukQ~=p+xI~Dj(`-)SlO+JC@INL%8;()1I6fo&|E3 zf6z*MqU6Do{|IKja_`4O>7hUV#S@3QK$(aeM~>)@nZz};adZBpf+AYxvQ$^j_R`24 z^A2&pcUaqC$-Jrej4naP%W7I5#@%dpx;AViL)_Q~E1wYOp?Nh}A!ewrrRd$gK=PI0 zYJJnDgRhwIyXDI2txvRU+YDSU?`Jg`)*PbmPBIs}WHNPm;bgbHx4iCHFUTKDP7VWE zj$wLa+*}&$J@5N>z|xNV=8VP*_lx~1oWx6nTNQ{SnbVpAM34NwSCS+X|fLg1C%$Omn31Bt1deOUB784fj zqj?Y@Y>!9HTtZm7UYc|XF{~GDP7^2h$U%!vpvig-#-7!oJ(I0>kTzADZGwxYl+7h9 zP_Fy|V5jUmvtJ=k9qIxmm}#;fNitTjgqU|`p2{^zm?}%+P_nxAm_Kl%08K?LN4yuU z9PET#w1kYn&U~C+?{SL0&qQxb*CTuU>g(%Qew^5GQ0*Lf9W(C#yuHHI-H1dufPZWU z>(JRaSg+NTP&^S?R)7dffoYU#nJ3&Txt$O?0Ie=~dAv4m=j>0`Py;Zq6O|t!9#25A z1k69Qc0oyAsiX_!J<45|*>;b4<(GVz*X}rFuk)qcM=z~E-!mmV5w&7>p0NY+MU{^$C14aH;&E9x^(*}6qBk3(0I%3d-+MU3Hw1UC;aQo%fq{`i*0#0;n)72zyyou?k}L2m>JqBV zy2(nkwUVU=u%=9V2s?N8e%47!ONY_%gh687-rP`PuMMZ+9-3$2E%92TUoO;CIOWpn zYX=4f;v*+`aVJXO=XiTa#&Xgs0)KWpzY%~=wlG(@gr^|Q3`V)6a6+9?%CLvDr{9dp{(2Y2GhZZd*(C6{9mBIP=dUf}Snv4}=T zTyP^~wrfIt`6W6Tp7x309L1%`W3Xf8!mOF~KcrT;oA3wcj-aS2cTSz9cCIu*tmsYb zu3XL#UY5MkHeNId1f@U+U{7Rr+JlZJw~|luHrm1YIeqWZd2Q#HWfB^QJ2hdP=N~48 zEiqNOW#u}9%NLuSgt*wpXb-Q};6Wn1rujY6<_Qywn15$X*Hrh}>w4B%%hQe|E&n~- zT*ZdRy4?mhLf0EP$L053!sL-O%<^Q4vp>|Z0`6nYe%gjs?y{n=>)Mj{#8J`Pnn+9P zX#n>xw{7ZznOdRrQlxJOzOb)(Qz%r?fO1Q;vO3q^S`y5L^nvyiw7x@M3NeJ zw%4zR2R%rldQh@z$9sFZmaZ$-hn})ou04*TAse}dxfsQwUF*cdD^+Hr9jH>7$of>? zaj(B~)&SFbg{$6RDXJEeRZ6XoU`m!xukUc^Cbev%HK#jTD__9?Onj^-tf4BmZH-*Tw9jf)XWI)UqiwQE`u&kD z93PHW9NAp&-~>2=7~tg=Qk&=XsX|+xUo}elKkA_AluX0hxBL1G!W-q#88JE4E01X_ zuX{C(WKd?#Xtn&4@SgRNCj92nsj8suyYKk?Jxj}S6)sPEV)5SO&{|uhHqO>we=7Cw zi^sAc#Xrc-gl+C3+_IK7WqJFSkWlQ2bZ+JBJ<#a!Tj-z0=P7xmUhN`&VyUnjZ5xuz zMly*5%^8hm&yU-AIEvmSpDtl0mG_NF{XE0C%3y0gfK*USxsb*skjR*6G}*J$@Iw)z z%I$&gdn%rzSXh+RW`5VFv!w}z^Nm7tGt9&0mDMhLON@>U7x9PJpE%{8BGidvCGIAhb5CaT`RQ7Ru-Y9bzc&zdXC*fZ|t(J?SNkqOQQuR$`l%Mbq326Zg)OIrC0~UUDK&f{pFN-logTAqg1BkAGFr&du0;iR!2Wr%k;uuGmW22 zT{Vt7av`^bC;FA~_KTc+Op%Z)vwBU%z5+ZCHiZpd0iz7jC*~`IN$Q9}LS0h@?Xt1V zMVjgpx=7SmMm2;M0cc9OI3)WtDsPMOH7of)YDAqz7tE1+62Y(blAX&_s*BB3xy&)u z^fjfA?ht{d;_8LU0gEWg0L`|=qy73-%oV!dIKj=^$O}z_cJs2av&;wUhT}&>IVxT< zM?T!5RW^+=>3*BWgpYg79@VUNLJ!L7ZUU#Gh6l1L)S=sj-h1F8JWfc2ldR1a0xx8?@L}TXt zAurL%6{nwSQyX)I1r@HW{J4aYo&Bo<1N`rp#0S)}Ka)9d>x&2GSyWQGMhhTHtx!f< z#}r0ru%Exl@YYi6-;z(0U8f#pr6mTlLL>6bxk?6c8?n9svG7DxQC-EIk%#g~3--~< zp$l=MTM}1{L$35dYqv*SPD4YWcaQcZ50oWFD^0uHqFW>W^4ep^0eu>c@lst3KvQkq zt+O|P`{1emOAA2oMq{CMay90MwkG-jhae*EDH;SB73Ks(4|cq~TG7VFt0l1z-WEwx z;>yAu(lc}z{@lPAj$1Z;m}TpwR@rFlPoy!GT3dTQye%W4kX+-IissWqF_$VXgaeAY z5WCZrVX*@VzGaS9?$Xl3U36qbhwuPE16JK(${9`*$NZ4>c!?L0D}XV<-k4-m7?`%` zGl}JFw@(qZn z>iVNc7R?$jvqc4+N0Aavj$3AoUW!_&0#PS?QU*q7PQ)uNFLFr|Z8jC*pDV^`T| zWub;~Kc+W+%ReD}wjn6XJIU|c5P$mI{$VVR(5KqPcEYC|up!^J9LMEDnwKO!# zr>>H-5SmffPR&;A{PH?JB+irJc&$&uM=}xg`w}WkY}LiD)pHFX0>m$V4B(d$=&QKA zcwwZ_DJo`eCf8OyHa0Ifv#h*mI3ga902{pWZP2%SyLZAY?Ts^1@A;FW8JXERbt=V| z%d3yxyGk!l;wZ9mqA0%?x_K+0`Q|tHAyC47v6Q@&1N%9V)!d7NeE|Pbq4#P!j*Z>& zZPV8sP8&6-eVoZNP&fVRGyD%3h({#R2YYW}PDvgWZa@sAvNh0UKfkQ(4KFt@a|to%Vp zN8Yn!C&Z+}4kIafu1MEz(?^dO6jWyslygss{8~s87!HXpi-Nj#D6?xVKlBWR#?nm# zd#xqj^0cKT!Uby-2f2nkKOai3V;t`{<71w0PwV?Q+fRU>%7mfY`>#NU?r6WU!Xw^| zINKI+w%l(2<1Y^WUp1Kjd@?WezbNMX{5JTQT(R^m5YF`qPG%EIT-}U|MN`3HGob1k zG>XArXlds=z?0ks@B_1neBOS4InA3Lc9(Dk(;vJa7m-2AN1#$|_3|Mx&$}nRDEVk) zW-8iBt;8mojDJ1dKSSe+yXVteP0=4iG6R(zQV1q*e`A}&ErcoA;m?ja z#tDKd2XK<;T()OgWhRk_Zxm7l=n89l9uB0jZ@j0~xmq~?c>4)?Aw%_AJfM>4Od8 zKUUW6=?`bgk2%L6Iu31#v#%D;PSMK-iDdNWI#$<($?oWXk5-52KhuW%+Yy6I=s^u( zVBkT)^yJpOjQ{O485}}DsL1dzZMlq&Er;XTH#Nzaju5#|-+F8uPF9pl?!#vXZ~J2F z`1Cv?G4pSxi%o%iiUZ$Fo$Ed_@>|FEg)r&IS%I%dx@pBOmbq&!E^8HNM8qsM{$?bWf}U3(LMHmEiA z62@4LR9$X6sd~Y!0V<`8n4EmV&ub)x!If zhO$RROGd2+ZR#ZpFJ?d2fj_e8JgRqSD(Q0BRXk+nQYwi{dm6L;b?jdrS;pM=)lBt| zuXMbBJby5|GiAN@qb^}3{CYP~abPF1e^lMH*Y|TkSwv#ASCNoJl44A;>pX33Sny~0 zHMt@|B34ZYe!_m`YVX!og0ag>CztaXd^V@6Zz?{IVLv^B1*&r-q2cE!S9v-g?{0K4 zecdOEl^TV7){YvWo4BPlI6{&N5Kt+?HSL;g_wfoQt~mRn)~V;yyXWsE25&Wlaamvpe1>jJl-d=;hrJhA^m6 zD@ZL7yn>VMXVI-e>99ho=x^C0^%F9L4wTVkbX26@v=R14r7gocs~s+NFJ%OBbcR3E zonBJh^N`(WCx_ufvjsp-DMhlTsv5Hv<_}$InKZ1a!4%;2QKR)G1hC-i$;mOiVR7=7 zNN%8%vFLoo-ywIF$yr=tYgCm$PN6-XucqM3FgP3#b9b_lLnD4`iS1ZhCxRT*Dy+(H zXv6_jA0L(~oyKFOKI?5|xbC)nE^^}K`4n>#HG{=5b)@8-#_m`yvMaN5n9IC{$W8Ly z{t_eb`OM@wO!k-;?V9f-b}Pbs<`4J3SgA)Il%mZ$uo0BRq?)<07@RWhosL$zS(fjd zr5a~h$BEG{8S@m?Q4dPqdI%tReR*4~(q1|;INf9M6zgj^0dy$~9YY|2fMHuW<#Q}{ z!jFh(?@JdvsOZQ=P(`g6at8RYq}#J1O_piIL3YcPq}uad)@5M%iH|`?|JtI68Fjp6 zb&$AUa1QI}HTi@t0aW~zLVFeiD=QnU<%fLo=#>T=!%-z)p}dW1`mE`3@@(4e0LLYm%#us3LZ2Dt*Yc zAjfS>jOvY%o00nM)pt0Ck~vD|Qzp8{Uh+Y}hL?7c(bF!tY-mH05PLP3Vzqh@sjkIu zBXT#F>PtisNyW=r>PX0lHO>17isx^CN?9P_@jftMlhcL;S)z14Lgow;@Ta8g!;{gm z{vssXVVJ(p=|rAj`h}(F0~d{KA=@d|)6h}*GTdMSzEaZBSj#cd`)1sdC&pH&o2hei zYJoL5wvw*5I<*pLCMzgQPlKPt$!I%ZRrq_M1J{+*_^96D-RqEyw__@>jBsnc1w@Vv zi9~N%zTEIL@U!DR>Ryf_kk-s#9t4s!FSU4y;32H_&fkw?M_P_9UmW-q`BLTp5&W=5 z2ARQ=*lr84Mt5v(XFSXcl@+wj9%V6j$bSTlE)J;h>ty^23dNuF2P`+(9kcTdIZ5cZ z|9UdbC>{Xgy2VgoHl?8qvYsD&7MEYNkaO= z4gZY=r9*=F&e0jCZ>se4*RB5Zp8xhmIuO+$9)%)!^1q6}e~i^#eNecuVxD;~(a}kS zN-8C!y^k4`Ab@?w|0YiS;g{bBK0UU`=exKu*U|J33L;X)#H4p>hW=l?=l`}N z7Q|nE`ap-^tE#Gud^TP|L1?AobXYLj>?FbPQHGaCBv2xDMH-~k-K3(miS>55|`;jgv=!v zNQ3HENWUJHIiyEy>?=SQ4lM%0kyRf>x3Gh;*d^wi&eKA;F6H(lO}iFaQ`~93d3+Zf zs)u&hKM-LUg?R!k{eC0C)jUGO`iK(?1C6-I-o}P}{zlh7FQQZ+9eqBsfOyxLY%sqi$ zNDK`$x8q&`gYU9Xty8IMOimI4lS7)YMSL_#aiV=j>PLbFZ~F>dP|!rfv=Aimp)G#h zgO2oLO7a=^1I_7TM~VWqG6j8f0GLQ`Cd@s-#Nr}@5VkqTDpptcZ-BHkZ|d>zVeJI`oZ zR^=;?ebM_d;Q-H2xC*ATG`o(UD;9o?5_r{O)2NH$1@o2ICyrFbRJ#^rSP0R5`*X&CO3uJ8x zl9|wSqP(D7>wRjc@;7szdy@B7BKx<^K+xhp3GA?9Q3+2|7|MYC8b!HoVscLYB&oIf z^BD@pOX}?>E8SSq88&FXFMq!W2Tv%L7n(824e}*A8E{+-E?v0fp)@$kGe3sB0%A5M zYno)=Tllu*DkYwKJ^!%@AN~wW`cM!SK(|CuMUTF0eS|Q>OR%Dg<7Bj>ite=n*72pBb@9IoARM0@BRgE`$Zk<l(^~OcKZu#+ zR}b#P^R9AvlIHr~&sd4U16=re>L7`$NHCw0QJ;y4>Be9adXI76F6Wn2739048vL78 zgTiI*S9!_Sn5wb98%jlXRQDz`u#2-m{cefkjm`fw1%xPyq6Gf?^HgUT3Q~oD2 z7^9{YHC=nS-P>jcvgFwDK>WQE4ObZ|oGMmM&>rPm*R8x-sThi|?p$WD`zzrv&LbmI zQ)dh!fk;dWHd$HcL^&K98c(#c?O{J=PHpLh`Oi#s`zgKc=pge~W|^#% z7mYA}2HbeUw7G|nQ{rqS1R(ZYY!^ImPXe=FIQxkFl&TKFM`+&-@TE{G=juUjJy9vz9EE# zF9Sbzg*H<%LF6>P^0{F%^AI4Sa}jWZ0&7r^(D7Q`;5jE z6uIhkOpcDLPTI#>`2X5aU4c;KiiL@H+t$be) zI8*ekT;k`NxVHK4xx~Q}SbhPaZe^B{>FVJ$o3`+tlZlB5x#6sOi4ztxYrl|LJ+g1S z6vHc#Tr9*PJVstHSY#(Drla>5^ChB69EkAR zr7x@M^P7Y;<93N4kdPFJou zqEIgYaB#Gd4C)+Bk6nsd7|<<65? zq+Y3&VZ&;1@Vo$ZGlgm?t-8W+DpARy4Gj%VLMRv~>m493t>!7}zR7AcC30c2Hz@L_ z*7dw-4SQ<8H}!5}f@!Q#oB|H^S^B(NiqJLU9fgdjb9i0=1%R#w0jt+k8(J37upagn zPcR&fHbr^!Qk+BcP1seHWXK-hm@Y>{FL_9?RDAu z`>J@x+|k%D0-I{$ac_d@)4|#@MFU?VlkcV_0Qinvo*_6*n=x!zq$^-{DvUlYa^16fKtojgn=v+B>5zV zPgu9>{bKRbM?zDy&#mrxb+2F%NZ`M&gu{gS*E!V_@JG%`_zZ>e*)in2r@K!r4A#SiX(biCHck5>5yOyCb`rN7He=UEk+OWuW>T8LhZ~14$rUqdmolyY zA7^g?6jz&VfhHsb0!e^i!QCymOQ3P5ad!>w4j}}0_uvk}9fG?zZo%E%-{H?cQ*$RX z_rCY4QeEAr1KphSo&D{-_S$RBH(ByZK3>4gwwN_YW$|jYpr56FNXvX_czX6-hiGXk zAqYl=t|J`CT5Pd`3TExLbVvL)Z0mCku@MvjLj}O8(IyXuk`KeVzXr@aQii)vJR?7UC zyJ&-nV?8EowJ#?sIp1fWRdEa`vvE8hN(`u1PJ0{l!^ z|JpDL#?V@0DI-@Tg2)hG??C0TnaMAW$iE7$VV$>kl|(Er{{d%nEHgcKL%q!}D*uB+N_ z4b0e*I_eskiMM}ylYzwlGRNGF$7Wh)XDOFeWzP7kM7mCT0X#f5YsrIOb&*QPkw*tk`(m9EZapiEmh%+u8H|xw4q%dz(a##et=b_reMg7PLl%(m5GaafidP z1VFtSvc~}yi2;$b(eG{x+@Tv5hu}TuohsCiJ(eJ#$LY; zN6O6d3cQuNw}YCQC4uc>)6K3{wpn@PiPU@Kwk*+4!z?3~egO25Fpfj}GnZVY;d+%j zCJF>?OEOwOvuhBckmwf)*Xuh~yJJz~=&tL128N~44ZdHA=Zyql5ST=8EQflA-QDwL zPZfdF4^Avqt&V3YRuR>5=MltN@l2C?4>iR*VM}YgR1v6LZd6lpwmf|qkjY(M8<`p5 za5%07q{>%VipAgUAE}XbCv|Na*Qu07r5QaZFgO`gfABd@CNHgzvDw=f?|jQJ4&`&^ za|^(I~u`?rCuXi|;*bbkBx}fSXN}PZhgotJs#` z`~NNedHtLd=gWL2()!Q_>f2jZ;`hChuCe_pg2z_imC`Fe{nkcxyscb{Bc*ErHaqX? zSy1Ofk#Ug7I1N+GSPqKycT-_z-M(DHrc0zpRjg~8&r=Y8=|YXpO<-F`+Y zYo1b^VGv}I+J(uWgqF6_rkCGzwl;#pFh&eDA5^9b$pI_P>>owwk!CW7VqD`&BI$~T zj<6lv%Z{augQXKMe5q|aI?wruyY#S}RpT^p-!FJld0cZ+H~Jz3XvlIuZiZbK#4GX!>T5&{ zHD%X^abE7xWCjcYx`YuzO(~-ETVIwuGo|+Dwk2Bhrf``FiQqp9zriWW$>*tbL=VBf z^+o~Hsy9ZzIzKeC`JD2JacgaCo$91{Wt&X$ssn$WW6IChPh5vMP9=})bLEE7tF(&s z!BxS+SlaZlY%x>H$g93D;{aJ+luioIk`m7JD>*{ ztQGk5dtXD>i(BY_fg}IKF-7phbz6x&No$p|dRYv!lZ!*(NHzATw}u(&b$juVG;ECS z*zSHl*2BHl6~&!X0VL@QzP@mGqL3GggghIFl>RqozRJyZIRzer~iN z7ikR-S2*nJ2!rxKyIyt;#+;t6Z8^_Ltq8Nl01v9JtQ6~zNq>w;QrDdf%-@-`O2o6E zSPM-KVJ-JtZW`5kbqjAnr@Ni;iUtXqlyQH=5a=jCbf2IDY5h!40vaCWJ8IBFB+smt zvfWInV=1xV7cfZ7OprSNtW=}oTX1p@|4(!ex(R3Y`mFcop;H5+Bc(6#7k$=GupJ`c&3n|l3 zOL0Mi+%o}$Dm`zyCBNAz?-snPMU^HCAM9Hop-fQySZ8?ustz5EJMsPUiTeVe7Edtg zE~cqj2MTm@t+!b(xZxfq)I>AEL(`Q-`$T3C@g*IYx3U8t(B1O@ABK!%v%90ze=6YW z@LrgUdFmiwE52~DB=ccqGx}ke88=hD_q|Qtvq!!a*j#EZzo&ZfXM@;JB9`PnmBy^E z)3ccG?`n_{T+M8d^TqEd?zyyd@_M*_Tx@lIs@dpKzvPiXDO$9Dhr2(n!%KdiRz$pJ4Re-)k`;kq>Tsn7=w$8Q7@iUti#6LkxrCjGNy33ntK_qopQtsja0C=*9U4wC z(t}OQbNAaVe~hZ`0=c?KiS!{|4m8sbjG?9lo`-_3mqwhB@_iADcw7&}XD_L4VPIei z+cg^P5(*UZi&Bkp+WM7BjXV1$Y((8%E|@4#*0=$@x4d=i{;ShvH%7%)81G}G`6`)* zP|{S1Sd>WCD1BGyYw3=upYhhj3-m<7{<|0g56>Suw%459KjXQdP^55retJ-cpw(hx z!Pr0L@<+7Dd3wjm*gZYNDi7cYCvn8@&T85y5f$UkHlclj))AUQa|YRNzZ6f&D!ja& zVRR~AH}$pfCb3!?*3+r}?~99p`DtbC;L@G?}0lP5Nifq`=%`?G~~_YICl<%CORP8RElRZO}AFug*(+u7XQ^C1_7@~wVo zTU9?s0z!NPu-}eETXSfE9Ufa>B%X9mRhsOwfN4p0H8hwb!p?A_&me+9s3d6Fn2cy~ z>-}af8eKQ!_Pd}CiO!1yUi=J;=5Sfox}nL*P>0Ukn~lmIYQrRj01$JqV43BK~w`z27E5bb%9_xy)svfPv<+44KSCn^(X(+vjMs#%MUT|B$GJ z*WvDEOre~{5=nn@zpI2l?#yhBdCH#s>E%yWEjKCYG@hs>qZ-R40yJ5d^}d)b<#&Yq z1`&jU#KL6A8Pj*pr=y{gyV=I^ExEuX=BLaq_vo!!Kp~b?3a3=nHAA-DulH=1x=6G9 z4sVC5V?@DM8SQs-MmyPyF!l|p860YV+Ij_in)U``e$ZmWOQX;wYS-MPEoC@qiuiL zWtt3;>Bx^^*I+NbJT1);PfuPc_0;Fp%gI6*iX*G(?eU$L4v5zO{03}~y>Ho6OBy(s zz^X-o$vyON@3=G3R2W=o0wD;YeB^YL3XOh$tSc7#J>}*WFnZ_}YZ^GU=5Vgg0`{ck zx;m4uWq0YQORKY8U;6K^PfV4v^Y*rk$?GLX`Ap^m*vq`ai*rOSH3#N61sOkfN33kZ z!bh=da0O{ZzL&7UBPri&A;j5*M=EAf8cOCk8@#tjMisDX;UhS3ojOG?@-Ga*5s@>eYtC~GJ<$CnP7ZC%T0GyEh(P&;H z+{a~yFJ2jH9%_kl9p2Fc%k!EC3iyQ5iBSG7f7OECHIdJRVUtg0Ue3Dy@`1nU`C%(Q!`l-1ACQ(N@2|69AbOW~(4ft@F)Nu*mGF6%-ZdNJqg5Z99;JM{+{K zG2>YasY5q$(5!gLJynM{HJjdQUJ@=Tp^av(mFUevy}J_Vout+=`VwPu;O$i}7@z>& z>j$An^?TiGXlUr`%No+3PA%ot)GjHX8J18W(c|$t3jy#MffACzMEsN3djx=?A;X_W zn-%UC&il>US65f>Y!BeI3+Bs)=y}`(mVt-KE4CZ!|jHxWV2k=DU*+@#6}m`rZ@IzW`Ab`V}4#fRU`^0Ht9rR zP-8|=!HJYm=_{XzLZb&;;Mpkp_>2u1-J@C$f^?NNN9*RBF+c~3R(uVX@ z&IdfE$OGTb_dzcu-MM;n zMOiH9ma_sBdsjsF&*tY-6$V%tLNitvgV1ftvJQht{7IY<28ggt>MQ!zJ2-xqjAP-? za@*`}Y@&&}I)zuj-!>6QW`eVO+{t;0^jGs-$4Na4h+@}ng5pY#2nLJfMMHW*z|yvq z8hTwwCk|b?d6O0h@Cdn_j!a)V5xRmi0Nd|v|JE-ZFv#e%8e<2#4t0j-rekrPv0WXB z^F0xSD%$bbt4()R#sPbBdD_os%Prm(t29Hl%=*7E?~ItSewOdwmesb-e@`<$bt&i~ zq4SY6*LlO=_cL`)68$Z!&sNy0luAmtwc*lK9Bv1GnqBnNTb^8?0nuxUj{HUap2uxy zmrA8E{&T(CxoL)3f03@J=3Ot?XbtyD{M__)1olLqK8jSzgS1NpUxH^>yq>vgbvUo| zbR1FhVzcd3vIWJ7^U;w`29!ytRd1K9sLt;@mx5@d%*o-VPF5E4AS#J;l3WB@eel*j zynKeCL`h#i%PD@d%FWl;*Jz$!V&HCmD$aD$5`z?bshwUdX);+k2~_m%cUPONVd;BjqGQwpq_$s zLd?&2dc7Vss`3`X#75^+LqiRQN$9_`yuYK%U(vjmG<^AsC_;qCEGFHKL$zx`KlP5jHR)X3k{j9P2%g>T(1Iu&vhU*XPe7Y5HqWW=yN{wEphr1Tp<=sH zu$>kohW26TTCds0^x}A9f6lbBg@@bqLx_6*8^uZyqylhZ4wpua2hnw>aJKyH_(>0v zKjqC;4?$Q8o5_!*%4BiZBAzCfyj(`lBynU?=@_J7h*%TUk`J|}c7F_2E~W9^L3i5r z!;5y247U`Ilv_UzF#xfK*vLV1a;i~kN)W{-*Zi`?SRYr$LzCrlzLCh?22?954}Z3- zxE>Wqxw|BTK%nqQeoare#mAdLHGO;8!?rbz+8@n9L+nBM=Pie*FwKu1$@JjV`ntOC z+}zx;=&gv%Z&FuRMBD9cTdxLHb5xJCspZg0!+bvkDikPxq9_nvcZsG_lM-T6z>@i0 z&&s@Z61?h#%p~)u-73VmZ8xdw$b%qD^)>-RX)SyaVHR>qQ+zusn4r$Kw4E!nONG8v zS??XLc`fG!w8Jolq``zsGUqr7I<4^>�MLVZV2H*=DRvZApUtis2`GD0C3TMn75V zVnW(nhXKyZgHZtOT`Qjqf<0<&CFpxU;eV>0{>axghWaSN>w$25mT+)OWB&~0DILX+ zLb5`Ouwm~b21O<8wP~~e>ze!h+(Zn&9XhHg23zr`)B)?cPlH7H#0;_LG^{>Df7IdH!w62Qtshk3u4$+NW0BR)fe3Y#IE8v|zJgbP~Yy z+mtM&ps7YY6mdLwZ+(B|ohW}cQ+JklsTK)D{{pYSPunx^8n2%%!l5!j4mkPXu*FK} zIR}iY5MO=lx7IVfg?SE{IXkpeyRZF}`FguXkr8mX#i*}zy-7Sr3bIHy{5^Sx6D7q! z)rC`~V4y8CfnYe%3RdZfVI+HtJFOMkwret-fqJa|Ir%0mbKnev36#3)S%$g|4H(`T zoWF?}bAD{~%$^Rq9egw+XnI_Bx~DZvv)wV2iW{s3ltJhxAGc;sH&2p%RgiPtq$)Ou zwYd5Sr8*N?O^Q%LaA|00OhmY_nsJl+IJt{KZcLp(*^cN*eoq>l$yRbJe7ej&+}+jz zr(ibrir{3mN3@wvvj<%mZ{1A2R$fK5*|bU>Q&=R0X&G6?kjEaAIa7o1eg1psozYb? zCbzQ>sz0pC&M;`l#?YyDX!qAyvJUFpXE+?U!u7?Z zLXYHY^;Kr8_2PoR_pOLNcyKsv0Wyh8%Bc9#NnGqI+YGnoJE98>cCowK9zbU&^B9>o zGboN${5iGOrYj-pU7|e}G3$1GPaN=O-ysZI_Q~$1N{d`sIVyy_iYAfyNnCF$_~*)K z6QGyCfkt?GiT>tkv*hE8;|rDiGCUgV0%u;S!v1nWX9dO32n`bt$S42(^iPeBfx?PW*n$=!RqH9Bd-iXO|)Qa@0MTu0}uefsh8IVeLN3V z*v#X|8&8s1_J@nYM2c(VVPpt+S@rg&NV$QA$Am%eu48b!R!BO9-e3`e(&qF*5~($c zKBQvc3}G`fvla4?WV9qfWolgJDcuZY&ktX_AI{^_@*D&PRiB);?!*QvFZBn)ct;ev zei?fP@{Puq%5}HVHnUK}-hp8s0i)6EC#UylLEOHDCIgt zYJfS(q<`i^5ccMUG+fVPZr7ULVY3kS*3G0V1Q{|puXGb~Y+s(>ZY?@`je1C8F{7;X zg@sg;DE4N|l;%pN59fFgEWB!ArKES9x!5^3Q>g8pqGFCkS%OEW&2I;^HbXfo&5MyG zC#S-E{SmUH6UMUTmpb6?njo&fw4-RB2pND@Zv1D~$)8Kownq2-2K~{1j7xJgEw#Qv zM^V>}RZ5e4n}Cj6iQCe_f@k=Z!N8U30RNsKEkuRHMz+#Wt$|Wh_LHQjpyfus^ zdC!Yze=_oX1%??8l~Tk6Rg|HLr3ayRZ>cH;3JQu`jYYZwuki!d_q40WfDLYw{P&&q zvFNzCp9beDLv~IcxfB&w5PU5Yjs-~Xo}sr$Z(hb$SHDIAEtMDRa^fFNBFTWF zk~7o-a*DDxQ|a|yp#}{bA5EHLWBpl^IFZ2;b20^JxQT$&sNj!b2G{7z8AiSRW)x-; zZqR;^fCbQyC~7@vm%lUW=t-N+Dvif9CI?%#3*DuZd45u(Z13wpiBF16hCpV|{g}I@ z=Zvz$kSBUdm}T$06m`YLsn}(Cj0P9adZ#CY?LKa>+*@L6U-yfEvYeX+T|U>#jFbNabvMCdER7r!-Ux-?N#R=++AJlVIb; zVmN`Q(Cw?6E(EQW=A(b`mL8Uyr z_Vd7dz%JZ#?MHg0$)H%~sx4<}zT>5ZdbGpt1&*`+a#@W?VJfD0AYG6;su|Ft@D>U8 zB@cY^{H93cI=R#pEvB!+xps|cLEue0Gl{&cci_z)m@++cZC|@&^n8pj2gHT?%^WUw zNB|k|uc1kLcibgl49_+_3*^hz0)rsIdUK^0=x7EN$M&P4iUz;@{~klA7fG$`YvXh- zjqj_ZEGe3CpPY-%;!aiAsuoz35KM+n-eonPbYA+&Uj=Y!dPFu7OvEav;`#V&1=f9%P%^EliF{Mb-$beLIC_M>0cNe%){?5 z@-?&}lZsF;HG!||0}$^%e=kdyUN`BA+URlG6ZfARfGR8Ck|IhgSZ8#7i%&@z2?*Gv z=swRc>t$PamzS^nTwYOud}-w1b8Pg$636ps%He)83RCcXa$4C$p?irDJ3FXFc)U-u znmF?K1ITx5hPVa zk|(n&5&I1|}I zZ3!d3qNK=7rv`6I2a5doce~vw4%TXx9Rb1dTI`^iJrTP_B0;G{JtuLjI8`u#0?Ckr zZ91sOT2y#Me7lYDi=fz4VxmVfLjw5Te6~Ksa3Gb4$0^kWvFao9YSMVz;kKJI7|oor zsT3@?yMl0Vxi?2wGt+2-Y+IdVnilQWLd6-uMI=0Tl%`q5u%J|8x!#GrfoL=5KE^?yufw$acQAF?gH7K(&g=36Kp(wjYPa zntdL}02iGscwTDROjYKcnPTxsgn?=Qys*YYAORe^z-iceXou;z?~kDoz?rLJuGch| zy89^#piIFugWnGxd|>P(J}%$0nnOf*_}UTp_huWExUNtMIwJwi%%O!!mj##O<_T30 zR7l1wvsob1PWL){i<0U5_vY4VvCb#n79@f3q%z`&@zR?HZR%jYDK6CCSu?P5|MT4s zsVAk+5Rs(=!mlznT~p>h{@V2>{Vahf+mP!|^vy#rZqJd-O493v0fPxe>lQ)bZvUqJ z$a4UX$`llj>xE584&<(z(!jxnMttV|hTuCW5rQU3$nE$|9Zmx7k8(a-=w)Q7ghXZl z{hPm`;@`0+i{$yk$3(D1g|-dAc!6kUZCOz99Qh^)du1{J@STLvvpzVayn#7|$%}fA z)12U|-iE7VS~b!EqB(D-jU}b=%bI@-EhpbXT96% z$@B_VQ-?D&jF?>tit9_IF5g^Qzgx_c*p8Ho2ka+#ne0aRe3nR(OKz9ih4ot^I~`v? z$_W{1HQS&{0>qt}YV&qgig^8HwFcUSZD66iav##FC0`0-Hiv}A(%py)`}fM00{mO5 zTQ{HqGxMbvNPA>5H;UJMUfv)-I392TKyaE<G4ErQj%C@n1}n; zb}#uC8pe3ph(Wm)gD2TcCOhahX~}Z;Ys)^QczubNQ%g*itxGm}QGV~@N#fTk_kF&F z$>&V5pSZ8kfWjvVj0s~XL)^F6TB$-T>6#<4yq$7iz z8{eQwiOvSnFT4G_Pq!OYX8xI}Z49x`f@EH`o-^t>h5%xg0GW0WF)wO3 z#KS^fUYI(6Ai2Hu+qc`boB(Dxz`H0^%sz*A@rl|^d$BtKexNlP)jGsoSf5pCyjYsC z<+#=Uv<`C^Cb#Rb9RM5iEqp{ql?+!%hiXS7zCf{rxL=k(Ynu+YR$Gsrkhiv+-=8Q~ z;tn)F^mv?Ap21qi(?-uVEG`G#h6{{L$(#X)k%Sm=TpYm5t5VJiK#b;~PRl zN{<_1wT7?JMJz0dMGP1GGCkY*sNclW08c8p)obMhxx!VF z2w-vsbL~O@o_YHpyaewee*9&+XcdD_WwL*{yw6~X`M;}eN&zymWZgwXb|U)XmRSKr zB&bx0N3By>2`EwV#6Q~tHPo00VTEB}qCAYBeyg{muNShQ>_zR7yk#8N%8@eFC;9Vx z&u_KzEHFEtBYbl38q#*ympYy$2?m;Vsxny?p!o6?dy|_H-qPF}WlNBmQ^?s8 zQ>!$70J?ioXmnbi4&UPF9{uV7vM_zl%WJEFThmGrDFqx_IeohOU1?K_4f!tf(W3m| zj_GoDGWJ21h}b&EFbmTL21lE)Il9Cxy6>ZN&hXsE9H2 zArfx7vjqex?CoRB=UdEo6(N=OoX$hCXu@x>beT>_f`q|(&?lR@;zm-v(erPUYNFMh z9}GMn^V@S3`Zt)&Z)$8PLz6A2tF8m0auuGN3?FFN-z2H7maUROasaLsV9B_fzv%;W zhHNrK_r6q?-otCvCyb0d_iPH!7C?EkzYx_s?k$3a=+{N!+CeB_G>a0|YUTRiv?~l6 zg#t)&!#zm|NhRK5Cs&nML+STr5Kzx4-Au2-B>Nrs5*4U@n`CV zI9$R9Y7$wor-lwgB?vHjE%eu!CCyuZxQ zrRJGnY5qnXslQrf#UyI3_h>*U$$@n!%IjNQUFtBy!;?X#)!(N(eA6|G2h0IX>_p`b zBj!>Wt@fk?8?wS&Z8(vu!_D@bC8YkvBd%P(`iPVUE|%V1;+EY{U@DR?7XQ0HDUu0; zxH>KM`+rZU_dwv>?A$joKTY;CPR zyU{+R;W#7b!%2gV-nG0D{j_fWD09-gE%6qP*uPu8TSAeIc8t1WI-=M!P1E$H2+w9- z7&d!&2w3iL!BZx-s)fmHOqqM3Ok9b)hrdZOsiyBD6lXR9NYx7H(9eADkqB4TcBdZf zE*IUA1Z9ztn26cF>SpNK-DIzQ?R1=+tnamHYbVXIL5NgHj=h}@h?*UIGJ6C7wcMgr zl)apbtZ~s~uFLZn1+I;$rTg%#aQpE|^BqK-x!pjLm{*|(y|Q96Y%AmdCiZIq|JmqT zgLO)o_}_WwKLe7J+Uu={m}Bz=l8gV;Hh3zW!q;Kt3sqxMxm`;t4#sn(cazC3v+^2V ztlO4lRt)=?9A_H=j4ZQ)sNtB&rK3y{B*-}qT5}5LtjSOIKV16>g?%W2I|@x>%g%8>7_ADL z6{dKyfmhq0Sa~<= zm(LNMIA3o)7D2+|ZygRW8~(&bdUk-B+kqV=#9f#_dbxjv@S1q9xHt>>_R8skrWlfm zfmN~W3eK@snCF%1SzEMghSJWy;bUELtg~9G196&q#=@9u>^m$bsax`Z({Hx8Qi+^k z+DSoLF#k+T8j1vu$4M|P+;i-pbLF#gK)!fe3DWQ}hDJkdza2WY!8PrHFvOAHP8i3J ziHF^8jT~UVaw}vCz4p$fSlx<2rMl`tftW<_&qKI2CIOiWQG!*vmIonD$3vuTNZJ$Y zo}7|0Ft%8k!p{WQ0WeX=ldZ+$C`AG8Zf@v;YyLr+RD#eGtBq6gZpo=HYEImITq@t3 zl0Sck8qT}5bvBnAs0SN6Uw-Mlyqzx7+ny{|+o4TKPBz{cNRTgzC*3KU_4=(-@%y&^ z$D=+26rzM-IsBLPzw7LOyz$SMjTlfC)%?V9{RtMgexj{wNeRsRhBIYm(&aE}b%w>E z+L17MYPqo-LjZuCt$hNxLz&KQ0uV|ma!e#x2LYRfA65J&nof9CC@f2NaWR@m*x|&= zF}G}$Hy!o(i@5y}3Yv0qK27Z2bP3Hl8Wb-Y;zm!bhLF!^NO@IaA{WUx&V9>;GvoFfI!6re>V z8~~VCBio4g4B|ZXGI3^Ues(QJuuevla1-li8*Gwcug@c8aTOkw?qb5Xx&3!;b5vm3> z)Bv{ZxAGvKKmdU7d4;eg439>e1LRGkkYQ3d?^GeK9zE6~EotkR?pp-Byo{!@Oreoz zX);9N0tgE_y3zi)e2jD|N9Kjr(XAyU-<=c40SCTZrbf^BlSk%I6El6)?8;4Yu#s?~ z2CrrrxLZf?tBb}pJ6-caifzeeo6TyH2`zEy3KS}Y0&{GUD7qUQ4#>5-rINFNNw#oZ zFq+}eo%y@LyJJ@heg!$3Q}q@UBIcl>@ta^ccEwR!U$6nCQjB6b>dmxmQWz(*(%yWHrq1X6EcyRzjS zf(aRSE}Jd`CO(;*v^}?PSJuUKBa*9CU=>J&&GlC=0M7164$a(}bN9P_a)35cUgWk+ z?iXl{0&*`S7RG9{I*we4+*v&a=dOLAo?m5x++3VYP{sIqBwbts5v@|%zK961WAyY z+}2{FeNx6MIBpZ5HHQx8&z>J9$V&%52kMJ*Y~b`%%#*Z#`LpnlK=jfcd-*~BPj12Q zGpNr46)GjQlR-#GNRE%s$1Po8HA6>CfnLR}3Nmd(M=VJ-s&3n{-<==W(ok|-<9 zC*;f%IX%581HqJ3ibt}7w)d|PGE-bH`bg10<=^GzDu+wq3DTN@x$V%AX;`J9}M zg@FM{Lzz|BxUHF*x;pkfn_iAXOz%n7aLae`xY7@mfJw5~1M4!Q$|3au9a>5=h3m;4 z#xbshia;4!=t-~ckfHf(VcQ5GVV|(0TmAraVNfv93`Y*Omp=i_#=`Ty^ND7oE)S;E z)Z3c^o>^$LB8!D)a6{jBY#d~B89xB6^ez&3rrTR&Tl_=r-*?Ps-dV5tJ|-{`IsNu2M^nTt17BR*kc%XwXvP#mc~N@AjQ<5XyT@F`(c1bL7%^InqGP zHnO{3GI6}1YBy^nw$rEKaz7Vt!mMzV1m^ru{Q6`=(k2}H!>)h{kdztx}R49{>Ck6_W#;)w0DiKA$$?}1MXI2fquC@yJO_)5P zQt#ef?9}B$}zK4!@_r;!$rkN!4n0GpHO?&dwJJN+whbDDP=&dNqg~R+7gZ>Y$Qfd$m<2 zCcD{V(o6Ort+a=Mg)UA%`uftR?AY#A0I%pk7!ezbsZ3gIi84h~x7!)-3i{m8AXZ+Y zk%5Y0vmG!uvq5vE#-9D$-L)`7sA??uOH@=Q%C`$VhWR{J#?+H-5OW53>1pm^&N#p& z(bpGmCcAlqsar{>RNhh@L#L(4y?##RdS$bt@8c?M4+18f@xe%5$_!wQchrACntb>n zu=s8InBE;9|2)aRkEr4Az5qNhd%S|EL8wxvHNjB_-P2% zpV%oXIXR`LPc=#|DMjU|AU-qGM=n~Jtk`b%;=;icOIT&T!kv-1$TFTX2|810C^dF> z;~fC4k0TvW=#|5sO}92NIZo2;)Xw^9c|HKS9%oYJ=DLG8yts{{V_eCNUame}Uov2y zm`;}?AtyCKBzyy@86y!d*d9CGIL^SFDA;a@w=YT2RcmQKBJkNddRQQ=H^fcJ*<0b6 zZZL;;=h+6Qxa>#er%7fBo_dmri!bmpqtmHIE7Gdu?Nj!b(AM)CynuP?6X?T1A&MIY z_InBb8AGyO0G)|STXl}$Ac8+5^lyMD691>{LuIjj{|1mxC5dYH#}<#B5;~75z#}la zW)Bt1Y$2b#bESsaUMjWRdDY+6^u)yWO-l=Q>Op#AyFQRm(%^h?#}54pI-)9uxvrru zBG>4o^b#mx&IT^oXJ$-633W}41A$`+Kz-&>s@XznMnGwAYfr*jM&{mNdx@)1qM)Sc z33LjcT3|O%%!b*|sdVHbL@3oYHDm|`u*_s)Cd$fe+%9+VD;>NnMr1~P2}BLbt}CL! zwRl>rR8-;wB30<_Ht|iGPx=%3Z-7k++~xioRX@^xwm6j?Oyu&^ApO^Wd@jf$ccm)Z z+?-wiIhTGyM3@M}gW5zg*8?+q^2k%<`%IX8If9MkzpHx0!5OK>B8{M1~t`K~<8Twk9UXnBBEs~5*#Fs3umg{&qCMbG9;4$vIo zo5X)sraxILrA+cazZ~#I`TCx=1{;U1*MEemzgSrK;jdw*XJ=&fK`+-)zVu>Sr=uW# z5WyBbl#Gu&xt1L8Wnbim0%p!kX3s3wyOLN$x{&3>DyR97jP*8`{>^M&986Jq{p3`jJga#Ky+znu;gJ|7bQzU2ne| zI~#=u7td}>ib|y@Q7rJEWD?3bfZDy{2DRhnKd9nQ&<;K8W!qs1Jp?B~T4#KEwG4P*Ok>wX4&A0r*u<_3l{@) zUsZHvAAf2)haGXh__O|d`a<5UqTe+dsx56e2L2nG^LHGAh9wsNh=GX0zci=`8l|Tf zs_B9fYf*YGG&fMJKS~m&r<0JV9J4VL%f$=B$yw#2^iH}eIg(%73f6qVHX6$3i?Q+H zJAD(A{C9emMpXTPg2LL`+V@E#W$&rwEqv&x1B)R;VWVH??f-3+{U68i84*QdwQV|Y za0-;m`4d(k^@UU2Ytp$I*0T zBMKH4#Y#1qR=2u**9KCClMDwxVQF`h%NDY&PH|5-cmy(l*abLZAlREu{QMcW$!&G^ zrs*AQw1Cyu?hIcz89%i1-myNpl7#N%t%Nws`E>ARiHx0HrLiTSApB-#l^TNo*$f&a z-{1w1DaUTNJEzU(YK(K7@n;b))t)}{{pQ<$yr7|xr`P{Y9^aDI`QgMKf1k@r!e%*e zWaOi2vqzji0|wP(gjV^l`#nyZ#B$eKaDP{o9U(_KtaVcS;ayA;3Mwi|_nO^IRl(H< zt6-GwWINqsTYVhU8zlh!Ry zF=WQpU-KG9PC}wcWXW8bdzO`~;R>?CF~s&iu>F6#{{PEM?>G3`&DwI*Lxeo<3E^)p z?p)<^LZm(qK58@yd4D2^o}$W4*FNc^sdw1r0fxCTVegekE^k+uJ68D38wg(pr#&*I z@n9|{*%)4iOOib_NC1MU;|@{lfD*XODu;r6D{&aRY(p0@Uqx^oOz#G98qM}QBLhmJ(|m5GLqo~=IpW$kjd2Yr4xE7mY;e7%w4 zw{t#*CSkGU7<_@pT|Dkrx@`%sv6KjgcXhF;e42s zf+^TPI3uLtU7ri58rIHi4t)sbNDSsgzF76jJU{4*{O5<0kOJkg_Jx=m2NRO+VukER zlrIIl0a}cgtMphCC4`%_@l)bL)AD0RW?{v9j3WLd>>P#_H_XQKBdPK&h9t}!Yd8Ba z`t4#a9sI(_1>&+0-XOP75V4R_g|hg%0hKb1d_(e)H~_yjMrr& zuJ4DNq_Dp|$K&saU|QMH$~`w8__kqdFMGEm;=^G8 z(};7U4XkWtu}A`r&|6bQMX(_Hz@{J#CPaqJ{c4SUq4`!O)fI4mX}`6TpM!%XAkJMi zTxD7bv}PI{^{JOF*-I5eh4%ZJZ=eT#aJqb?X^MwNZiCVngXJi$DJ-q=eM48nJQ0#! z$a**`Sw<=xA=OYN(qL{vyuhAYqZmByA>7^3GrsuOrmQQ5>`urw_+UoD?Y1J0?HlEr z0Ehvba-uuY==u7CBf{$&>H__f%+^vZ=bgU`^+UF!dtO(}Rv-GGY3uBM9et7YGn&e! z(o#&5y*z(^?6uZ^T$}&*LHrl5<8gH4RP+FSVUry{fjqloLa`W>o%@eQuW@*sHH*c~ z)4~1U3Y6tA3Jr)teuQ_rB&TvvQYHer&ibdz;LYuaOryZUq2r@oc)1TfU%EU9%d^ph($M*kLJMiCAEk0F5k!tNoGJCrpxz86=$GeGcWtX9x*Ep0RH6~Lnb`O1$&Z&uX z)JLaQj`SbeBta=_=t)&EB!J~`-b!ou$j2M=Wz!pn3qlU(gFq>*^r&b>P|-x|qEzl6 zBp{MuPQIbc#Zjr9xk6;TLEG)d+<>5qgG@Fz>%K%Lr&d-vb&irJ#Yx7>-#aYRA1Yr@ zmqu*IGR1{anr(qqZ(V7$?fQ*twvAi+bJ>3or2mgS_;*(IFOL*t;e@SO3>ps7teB&v zjP_=8pb*VkgG++I5J?e|;w#cis|MvmVbvass}=!uEw7p7p=_$d~2) z?%iufD@(-|4)@b-@}04qvS5$icg-H9Ci|239L=RKpbShcQu>&<=&PlrBJPg@j^&qo z6B4_1Tz7VjfLy~W50TvTYr=-mC=-W_4OM5olZ76juqN|=4AB4Ao9eH0F=IdB5RkkJ z4Go|-27^2t@wi4!R$+mRabY}voM+hs*m+AdNc#PxlA}hc*xv%T8?@bQU5Tpi7}I$> zK}Q7L4Ahq|>$0LogM@uaj<|jGXIC}{<;#hH$Z`%GoVW`*Q~ab@78+|eFvMd-tFGW1 zF?&Ch+)_|3JCqL1`)^v5 zEYe4Q9D!=;mHdz9)sypGvKht>fwJh)=uqm{=b{I;(8qyzj9~X+S`@LQa(%6GgSc=K zBnq*6HPPyD;*1nf`B!QJwOHzzDmwm|82*da4-cD;hN(seO}0iGLmzyvlc&r!c>0~I zFKrLa?OHA!_0PXq?%54ttB^<^VB74RVO(qXVVfv7l%r6|{VWM$5->>%3&edtkD+*r z3--3Dc#UZ)V>=HS&RV^HJ9v#=c8`F=PI?+w5)rGKGNwM9U8&*v7`}ZPE7~tqwdb|s zihvzm7G*f6@hai}VedV|np(Ft&}G9KEQkmQhzdv%lqwy?LPzNxl-@f50z^bXK>_JC zh;%T7-U5k;NGJ5r15!du0t6Bulsnz~?6q9$>~+pQ_vd}?A08lc5;DK>jc<&1yyG2( z$#X7Is7t0F@dbp6+E7{A!9|c{VGg=Ig@q2T4S%VYQrkmemb3}?vL93Pu!>+m1=+*O zw_or)TQS#_uI*ukamW+GBi>Cf=6vz4?X2a9W0R(~k8>5}xTo_`qQ`=8*R^eg>e9k& zaVM_6`0eoDe$g-aLX?GA5q3Z^-vb`$<>}pOgUK3yvPF82i5u?Esf?fx&XOgkcxfY( zT{)_%fY@q|!hXP87xY#{&N`+y>jJYMFkcKVaP0I0XwX9K^xIe->**g{7cO3O!l+}@ zrNMd?A0sG2y6cbHlCOv1xesX~a5c(4#8Ixy%x6BSWc>9mTPSCYw7v$fX<_#E86ikL zO$tK!+(`>~w&C*>p92U1#dHS@Esdp-qlBBCT#%cWc)e%dqfB?Zj{`$Hfj;G!*zZd6 z)t@1nw>*ipKUPQ!Ps!Vbi+OttOXR`2%}>;gFTwIRmhQ*-(OV^^s>H`gRXVEVzGGHj zi?5-6l}wt91rUB^fDOOmzTumvkscEr{bcMRb~&&+Rywi47Ep}z5}!MN=;%3x-~RC> z_~^02^lD3HFV)X!9SQBn-`YfK?;Y2SfH;nNv#b{xZVR%m_pi>rS|oFM=DHbsKRNIP zMzTgFpHArb%IHXt*V9OkWDhrv>dmz`WmOs|OgK)@E_|sA!Pq&M z2>P2gcUs`i-PUb|Aj;XLwf^~$Ok~K*z8b{<4tYa4<>0mmrd{)h}8 z-kDxT!Od5qt4V?aJ7;~-j)N!n{ znW-*YOU>w%AHP3W(;~aNf)V|D69a5dVd>m(jeUg75E)8&&V)(5K3A6bp88eu@q^Yc zoQiXMXXQ4=@Y`~MbCsMS+5I5|^`72?1?RA+D<6i~*gdMD1z68@G!Hu%pZ->Ue^;A* zv9~{YlQvvQR$Sl8nmByQ-k)gkW41upd*=-1p;& zFG&74upTlBhL_KW;$9q%4IW(xT#$B)UKwp@VMmyyL#+D3ED5&Xh$oZYqUrZ;MIDfs zkxC@EYre;jt!IvBH4&ETt3HNrO1Ew%8`VpF>(mj&nio7jMmAh9M3C39)W|WHc&r(- zz>bpQKaJ(5#a!h)ba3!#wfr^RRaai!uXMEC&j|s39__KFMyZ7%wG)GY)o54NvrhG2 zO%L4&PqMJ69doVP>)Ts{klM6+Io03;`GW$osd_E%s*^3Azd32QQzh+s z%el}cH}R(Sbl*wUrAoV!5}P^chPoo{9FOYSj$M#FyF<6w`y!sc0&mL#IBb4vbfEvF zYN0(k52;l3xmTBGf^GSM41W0xIbGa&s@4$GV>@XgIlHDo9a}A6e?$s~#llR1++iGl zUyFjEWpe&c4(No*#NkZ#*AI3Bi|0*%&(9*}y2zL?Q26p}6+|KYqTsAotSyB4!7PwA zhGCg_&CcLBR7_4{*!FGbxiD?}4O!7RnGrFeQs{yG7$K|Rg71rCGMGl{Bt4tlH4THZy(4hKo|ixxhF+GM)zSm`a7Si*e*w^Udvc@< zh0h5LAdO&gK|Ga95^*20aDD3bzj)nm{L$Z!UfxSoc?V`FZTx1L>;H*vR@5M=qM`N#=Dxi0Of>}k9TB6=bwC(#{z{+9 z{JZHGF;#Bp#JDwd*SnP-4{t<`*OrYrL=)R@XxyAEat*X9k`pg7H|0yXbsbHZbUiqf z)#S(|=$8I?_71TdU~O{&J+$$+$x+_}{5-jau_H!NwT_rW+THTs=(s)coj%IgsTHag zyZ6>wdG2UV0t$_C3zA6k=cQR0|LzR`%Pkgr2VKT5{yrM6qguV5}ZN zx{iE$zB4X-uA`PLmB|4XZ$Q7_-Nc&PoLC?brJ#XOT&-&Rq-isSS$xZSv9BO2eTcId zIp@Wjzx{p6+)BTnT6h;TdBlkTVQtrxcl8#p z#{O`e@}q}QDL{RBcE73=OWEn+?3>?Dh?xZX^eaeeTwNwMNu&Vm93y7Wck*-|g1q2o z=Iw}$X=C_at1Cn$;DlToB);>zE$ftcRpEa*VGd~qzu;H%cga>XVQSBK9L~ghbz8kv zD6=HnC9m-wp-4VBl*?NhWI1W@xnx3v-{3pe!v^!5cCkG}qPHZQI8!$+>3r~fKEP{X zCC-86(tuv)QMyf|h#MCY22d=k11~bA9%0`P-%Kth6|9K2vJ_I_2+W&4Rou_+*sXLtjY+6QdH3b(+1@9f>H}CwH z*+fQ-=7fQGBWA6p7*rS8Y^#`@hDo}UCC!o{C=@M^ zJ`?Eo!rOD_eE^wo7jxd0E$WxOdV~M=N!I`IJo_0?x$zzbdTiZ__`oLnp8M#}nh?atMF|G<=!%P0ynEBQA4g>1=e_H6@_wpYn+LSrda8+O!q!Soe zitI-**!Sl$vW1VB_fMzD!=wg_3-zh&ZE2F_0}VX>=07nN=O|6zr>sV82513P%k!iHC)|E2vUu-^bA6#g9sh-- z%i_;psU?XTeh<3axW90F47%%gJNQ<;zWr30!<@?G>EvHd=`T^g1uM(nR5qQB`-p{p z?)~4M!BzL*!^hT<>4IinJbN1BPd>deE#_=ZM_MYr!tJew7>|@FXN6X2Ca1c_#7I1# zX2^IO#qd9H*dl6Z6P}JGxS~F66|#)dukH3t;oL;VYhZ}}GMla+YIRW>$CTJ&>Ys0W z`1k>Q&xuXd=Y_U)r(jg*e89o8A>f7daUsO}eNYcc-e)o<9FyVJxt$SEs>mF~OoXG+Pcw z*N(Zc6sXL9^0Ax3EWk9T#7^;7+bbNX+GfDJDJZKNzkocL0$-rAbvN$gFWyEucZG<{up^{jiImB^0>XX z`Dt*nNNg#))pV(f#Er#%NhJN&9WEz86it9IS`nkn?JMQc7pul(W>h0vi60**2C2#h7 z{#V;*JA8b9OVI^YP=Oik= zN~v(V#WH?nbAGI^YH;ta?*=SfYlZFYFi}LkV9vpzQ;TA}fUgh9auIzI4*? zLy{Oy#GZ3e$0W0e-nDDp->Rj$*Q0ney{X1Hox(HXueH5=moWIwI79+;db9ttd)D2t z3~5$gd^gN9k%`aX2>>fI5d}pVfbD{@-p{q|-tNTxIGUJ~t*)V6>OSj;7@dIwsiwog zd)5n^^@$kjB0s*n*$n!UC*?lBK76|!q^5_^<7yk^)m{)C2K~O)Uv#gYqv>W8O<74k z{2xz1U(1f?Zh7E zrOQLjV2gue^c}K}6x;Q${Ric`yy=@e3y}S8Dfk<|0`YEC+E4zj(hP*PbsWQVH=>^1 zJ89$89Pt83$3eF<&wSyQ;&D*LJ#9=ROZL0)x^uQ~*0ze9J&n`5_wTB_L<~PiY<1U@2 z-!B&R3p^3cca&Q*T@b*DDw>R>nM|^uaPoSR)rD)I<^_6rC{r1)trH^^))Bj;w=K>+ zE_mX^x(PzgrSdVzKs?{Lg)&j=SS?^sF{~kxZ>|pvGG1C44IIcsirp@7-hcVpJ+u-g zy2(&WtgH9n;3PM>(v;q%>V@rD|pi<9czLPhMo-HOw=xhRf ztZJ-_RI?}EW_KT&k?IMK9E7Xl@8WaQIS73Z{be>Q2-QI|j|yxHP5s63yO^}Ma2PX; z)8rHrpKqHutfki;H+n+lYo!h?%JWH?~@8p=-DL>e0}z( zC(8V^{YYI;6F1cBX2(zOUCP})oaLu^f_^Kov36+oie~j7;gjHlxBEw=dZ^d%N%~8c zR}qyr$?_i8u4Bejx2kd4u|MYhV4R%xgmc_$&KwKmVLupG6?!YO$>Z<#TyV$rkGk~f z6bjAq0aRwJW6!KCxXrkITtFmGBjJ+s=;&aF-sg*ZYtAeQ10PLyHWpV3n^hC*Om{&M zaDLT`LM~rDxt!y_7xde-GE8uISNFbEH%2AU#(Y+daz()7K1J^W@wXT@_&=2&lGr<# z(jb5KT@dJ3Ndof4@V(CO1-~T&>0ZF3-sIwsO@nRXDdO&{D4q`4N{2eK)HG?AU+<<6 zHN_!XLp59-cyq3$fEBU3G&lCsvlt#rT#$C17j)ckcGFg{Gj9$_S6xIF_sg4Q1g)R+D8twtOZ1j-~Y&g>637bGi@z z8b1!*;;KT-x+D$ES7DmCNkA%R)cnRO{h465~yiKsLTO zSs5YfIy&t7WvN5A$Qr;}VwW~mi#YHCv5ZhY`wj%r?HP=-j|zJvX~nWI0^p`pD#qf4~OO^xQ23z0k+f)ql& z{Kg$5f@|ONZP#Jmq#(^2q^n%{73nsj$m~q5WZ%VbA?tVBdaFzw`ZctGish#DCp4dV z=nKEIZ$HVgtVWV#zfJ@vmmI)vH#J;DqVn<2bAQ=_e?AvuZk}_IJEE5Fr|0t7u%U3b z#yV^Jpq11*e3r-8Irji(9Og50_W8Q3oIjPp{1vWkJBVhC+yLPKH}&QJgQJ5~<7=$L$u(Wy%}EfS@vA{u!~ z$EI^H*p~2io_~Idau+{0Rt<#h6j(tiL+&P_N#>V>0e0BFvl{svJvmp){bJFZRlMC& zHp8PSs)H#|uo~wdfx8vOF3Y`{D(YD@x$V;jeHBn^^(;J0M^s0YM1D<_NKbRUwoUi5 zXPoDh48DEdcyfGdM>JuO+N~SCn)s1GOu_

    cgf{Bj!`^beXjlZFMY4cD+g+8W7FnF zTWfKevv2bFynD#|pV`x)vN@4z|{2D4yRc8tu6hL(d%SEQIKzuj&5* z=|%S)RxZ9>aOm4ZbAk9wL<7v?c02ijSc&k$;4_zl-1jW)o|^LZ`h6_76G7NZSf7;_|BZ^b*ma`}Y-RL)I9a zE~{g!QHY1(VO)duTdY}oY;uj(Z4-ix>D-ocIhSElfunJ=Q6Ol;z_R4_Z~NE(r3KLI z`if0H=>86f-9S1U^gt4ww-W_@DZl%aP+R=#1Fg0k5LMQUzH0a-?`~R@3DfIc) zG~U>SvxFt49*2}2#b0vgDU}OK9u^+d$%ejC)#@9jA@uH2;7PnsYF+Lb+Aw(1>xfJs z1bvlRU2-$goS9oXXp9$t@m1?}`C>hK7|n}M-4!UH4Ti_E)Py7K?=C-PSlwR4!@1M6 zTjTazFPUSlgv^maA!_Mz*W1Q;z{ndMH$Q*`n^#*hf_y?;73nCkkC8Gf?9QVt4B2ae za3>3odgfwdte@VAL5ojSOM`{OoJoO4Vu_JjcGsSeX6yBK)1QBA>35x%ge&atc3Z`8 z#6pBN#6BIW+V+&&Je9WScAixa;l^JRbbJ4L!PClcP}gD`7uDA&-h+rgy|THjSDbd6 zB5U7MQ5)E>8<->Q^_>E*YIk_L}!dm|epR|JPg$Qq`|u zEk-BTdomS$$gn6dxGAQ4pD&Idj|!t>NgFzstM>ztlr(r+z$6k^U9S0SeEsLc{V!lZ zF&g%%LZ7=`P-or>DN{-tkDJe#zTsf+P)YUSwD}3>rAYBGu`GRZs^|p*@$K z&1zg*I}lbi<#u_)J*w9MjMMq1L5FvC2O!)P*~lr&0$#GrJk6gQLeGA9_ko zu~-4gSfVU?^$hb$7MWkNCF0$?I4;%15mQkS(h(TrVl>4~Pwgl`tpdp!?RyE7XtcWO$%f%=HSdhR<*n^55yZRB2-DTfa(tifkN zgrSvuH^h&4l!cC7RHnhD>5*Z%_>Qbg{>c#sg)wt!0D%pt^?xs5Qt`ltG+~KcfIOd5 zVa&NVAr&K`$&ToX8O1qT+WckV|Mo}02!)svAg}B& zCZUAD`Zr0s)*jzKkN7~1Om72?mS(geX11@?k;%Xx0_IMKwU30=UyHzZy=Q3c{Vg7S zPB$(6Xo*FC0)pYpfSqp#v+yVw4CFp>oK2w}gGuKhy<>I^lZq@C4nFplIf0Lvty{`(DGmsg z6E+rx1}9QOJ#ehj-QBirDTZI08jgT9T1rZ48VzktRb;par6m!J81k77U*PTHh?;VQ z+5&i}6fx_q&&Ury&ukM)nb|T!it<~?wCe$IewH>BX2|&U9o>1(9}EQV#}9VKLLY42 zog>xtG>G1Y`nPt~*)KNrg)C`g6)&xxU=lJY_8L7BR4)v7hlhAjFlgv`L z3ih;jDs!uFNx#9XR^Ls3!YJZ=zK(}5(Lm8rc>zC=DkuZgeZ8b9stg%6=S#TrY@GX+ zv9T%!w6Uj-I~$4?Hjo0ZOcnRxi|ZVVNVdby)mbeM6fl-E0W^5^C^h4$E6Vxn*!zZ; z;ebkT7CoOYte&rm4V^CfPG*Nc>#kyxuBB1Ni%>i;IkxFdSp2{~ zjAqI57kB%2KTfTmya7=nW~XV@c|BWSIe=B9+Fj1`4vSm|YLzMBo=Ej6_k31^-sw6Z zm&8{tgIj{8fC7*mcFl4!{&hxIjE}R?ND%GpF0VStm5arw{)&3jV<1$=5bFSZ+ylJ5 z?oQ8O&lkle>pvjqI#lyPja^;?wG~jz%)ND|n#7P1#;WDQ`R1!`8JEbHQpisAe}RNCfmA zw{{+;#I)jNCd0S>V{MX?wVwF#rbRd0ehPit%68C&g>zjnTHjIx42YN31(QUyZ8Xva zOr^XxRvhwTN9A+O9f4B7lbsFd2%QbUmw1sb7bt}w4=DKTad(ZEWRp>aB*U!Gv*ieP z42T}k{v0UAwSp9U2)oe&DbmK@>%~S16g32s^QOA(y$5Ow#yBC-qw=2JCI$T^Z>^BU zA9aeoqhz*M$e-fbWQ{*!X4s?To=fy+4iya*IyS8U*syl4TB;zm`aQj~-c4{Kj_QD! zS=^Ao1(HIiX%ynz=H!o!LF$Jxu)cd!Or?WP>|!j>=mGua^4`n-u0S;hC|HsEZ~e_* zUJyho#PF+eQ{MryyiP^+pv$}AcDllQYfkZ`;+sM;WO>ZPG9VsVoB+Qt&As=n_qrJa z{CM5c^TG?pPGHD1I>KpG`5uV7j9PpQ+}e|Nof8Y zOFpipb!k$KsmENqJzp)T;#n3!I!I)&*QHmt%6=FDM8OesP|=D3QnT415Odl%A#H|x zBY*G;?aXC6Wd7#LqBg;M;cx>C;O8jk6-R~ZQO{Hyd!GNSYCq7wquS=p)XyR!r%~Q| zs%IM3ob8%ek-oPL!SY+Oi1_6K5f-4$YUU(jbDKODzZfeg9#5z0e@nByb8dqIW>=Pl z=@|@gzz^p)J#tJHa}FPO3eDEgP$f3JAsMjrKsMGEzEn_p3tzx)T(-b*z-tjRQHRz!R3w8$&w7&SZZJ({m~s6ROy40tizwN zHOaDwN4JPzA7_ru2CsRZ*gcd!#Ag8C1i%Wz4_Q_|n`VXL9i-uiW?M7gUekTz!iT=P zxj{?MMJU*2mcS`uwPK8tE-3;NB8(2-#Ok}Xv{M377^&k7Z_OS(tusk zwCSuMv*@t^=re1A7qEK$qx73_vJvl!M}?*>rW83iWeQ&!+-1MdZ|Bf_2UC*WU;1p% zzuPLUh1wFh5PCeJsxKCCMTOBIQ7!{4){%%YfUc_ev@oD@f z;tG=yU--=Ci;@SHp?EpBsk6pUJpnFaP_^OnufZCdo%gsa zbV>sx(R%?*++gX3OCT?6B@V(|tvQ@H1fX3fL7;fcmZ&jZ7PrEuUC5NIa&^@5x(dKj zoG8gFAIDjK43(PoDWb3u1Vz)N+{ce|zcA_xMP0gO$ahwL)KqkL_@lii`HJDvFJE)_ok%)=#!L0mp7BJmh-`T)YXMNp%-8ZQ?s z99SC(o;-S!Cs4Qxroy5;IgeA^#TLD7#miJXKUz~dS z9kEb^#mmx7#Kbpf;235dgi?4#XfUviI2p9?> zM7HfJAwi_hRH1MSWV0gp(kd{*s3PV=Q)nHAHq)Y6L!C*^^RMfeK?;Jbq;3Jdq-9{7 z+}n5WKr^}OtOED$_0~c_e8h=r+$(KQ--fe}jNh5H<$R8iswcI+qj2`ohQb zU(k_=?$Y$f@TuV{OIwL=!_`=F)mO_Q0YkMKPqYk{#idu9|xqVv8 zv53TBYZgJcsfdfWvgtOyF~lW6p-qbcRhNk6&KoO0|=bOoo6oT$Kq`%U*JyxS%; zz#k9Y=lQruylr#;h$5hjQa#;>KyMET-ZJ}C1CraO4Elk1FSTZ1aD{g}4&NELok2fX ztR9lmaVbd9&jas6%~8Ay$dst3RQi7j<*rOI!$-1>Z|-x8R&2I^*?{z*eD-lscXXpj&G(i>@ySq7PtxVv+1sO#CaV&kQyjo)2k>EHjTtoL?Rw$ zo#d7KY1&dyxxT<4^QDFw-?dLC2SG8_I1bAwPyG?;&L^Fu7FH!y;#&9PW&`qP{gX0^^gEw4k!MxB$4H89MZ)dBDD*Nc|p* z$i+RqtLPLbhO)tiAN!WaH1p8g`{Rz;=TGJNUJDFk(Pq1g;bBjHZR#$(za$aUf#1}DDv09zd{-*ZWY1d$ zD^Eewuw|br$C3JileG6`MZ2%JMANc3^WvPO>Wk>faJX*7{2IM!k)j55QKE;^pP8Mf z39|}~LG^YoBW7&gEMI$lx;CCi%pm996VM5J+RhkhB`ST5tjhn*-f?_&(#jc(mIMQ< zc)4IO@Ye2?M#zVmnzp0*7?>=+dMQ=!*!VL(aqgkRVjEYu>kWFZ1%a0h2ercJB88@A zk)?RIuEowCq6QL(3$>piUWu^cpN62?YBeLlX>8nOS8Fj53Q>te^{^Cihon}+H`r)` zasv}f@v^+#8`gw?{l&c5WS)#S)XFR%NP=X@8jBmh*9j@vG1+AL7J1k65h~mdg!5Ux zMT9(fPBp{u-&Bu2nmV0Z>Ab(=*gKuX;NQ(vi6%;LnLF0WV{#eA_;o+q9f>vTP=E0> zHMDed({SngFqIDz)LlXEO{f@DWs1-m%Kqc21fwze1^1JE%R!NS@QvZh3#DFryd2p;2ww>mCp<;rT-(2 z2`(~y(f&lA#x}eAH^sPMNA0Py#zu@O83 zUpZGHMH<_vlTVgwf(H!&45r?m7`*_sZXZALH+p9RL;y-=>`08gGxL4Sa|i;ULF4Ty z{#^iWvR++_EmHsiba?&Bf%nj{+73sK?suVU16rwi^QSA;Cvv-boA?}il$(r$t7a$j zvi+s;WLFN1WHD(bXFQ^ES)z3TJXwwe2p|ZVp~?snai)`p>dT^rTrQUWnXw5&8}IvN zlNH@xCL?_aKIV^s+$q9y<<+HZRi=45`b6k<&J}4NnZ{FZfbG(v(S}VSRW2+mVn*z{ zmvgo@vC`FEv&@(C{3{9RL;3)uiLqnq ztKyjn1N$cl5#GP19e?)jzi>r>7kGu-Mu7FuLN@BG_fKmw37K-UO1PHZG>YP9J`f)-KxW6SCa6tis1TlND?*M#s^=H~o^~1Z8vnl8}Y>J-WAhr2N^YbIoFnsp(pnXPnMFhZQ z?FGf-JChYvCeQ5!?JljJ*J^NJG!7mDSU^676bCL%eB}suszVE|VvSaG;sDD30AIyZ zF=uCz;3Q$U0LY8&A3JGTI(zs26nCszV=`}*8#^?J>kG) ze|vH5K$aiME@OuuL?xaCZHFqzR)ce6pC?IbbN^&+_-KRf>lPS31_(NnI<3;&P!6dZ zGxD$-@KM=?6(e>?b_DB>fpE`3IAfTVUetCGTlS@d@ITQZy&wLl^}`wI=;g|E4(zDs&k*eH>v7}jlS z-Bvc2piP3}f}eDTUbFAT&aaP02(<~J_xV^Z4&YI!M|l9|1xO)R;Ird(Q$_2s8p}ePL6b-2D;FK% z{^>hq-;R!4zt%lW?U7ewoWeeejPXgYdo$Vc*|1zG%BA;^D=1R$vyryA)2P6QT#u4a zzRgX^?bt=F^`SB%B!g%i)lZo2ma-37m(B1q^TPQ@8Wog2i=d5TZ2;hsa!Pyj{f}*L zO*jiNWis&i@B#ONr*hGweG8apCCT|FP=-k-^nbEvaKBF_KC=0NH?JBsWQ(K?8DA*A zTrehmu-AuQGmS55rONNxA!b%a$|*)h)ufw1u3Je1067f#`G1c0p8j?V9skbqQF@e$ zTM00vVW^Sd*ROle~cVVFk_mW2Obm6@AmG*Ub}E#2m)72Ug?vZwyq_ zeRNd~&vY5<(h2WZh|%L5yqd_cwLU>|RHSQjmgCHe&C?hOPeTQ!Z^I@y;%(luN|hfh zT0Td_A8gD%r-!9M&c|_!L*Ro7n>?8m4|Jm1IYbd5CT(UhR7!xF1fGnufq!bMf@K=v zhfyTn?sWxru?-2o-MjXqWtD*%->F7DFLJ8@^BBMy)fBYfr8J$S@Sv8H*L%aXu0rJy zgDf9^Mj}qbPt2v^YEzi%MMxpJ&Sk7FUckJzo$kqIr6Iyy1V;?QOM_Rg{_Oe#xTz!5 zb5PQCqsnrX9ORx0$@Lj*yjDHFrL7N`=7*F*9dO&}K4rTkck?F2uYh$y%z3z?&7~;F zu-vK?$V>g#wr!o2v~U@sqDEb>)B=s;+vCR{0uYHy>(O5rD}V7RfBNx@HPfm_>?^q^i|bkmpdB~r z$j6#_hoxJkbyZ^`@%dwmON~}Pigx{77Sg`PGH_34AZ?{4p?1n(P_Cv!q zCm!MZTh27XgV|e#%;j+a1)>`)pQAc?6X$Hg52(IxnsWUF1=!>RZ2?WJcmS$;!=TbP zr+jB%f3fd%+rZnIxryHE6NSNby;~esA5c*GDl=Q_)#;cXxSZ5 z@~VE6dexH|(ch!6@UD#`g6>3Ms*A{C(^)6C{&E!rMHQe!kdCFIjjThKP_)7ApC~e* zP4uuSet+}>G;*{V9N(b$_3QmT?=_=b(j77|)eabX>~{-nvk~B+7Zr#AcD1d%%wO`$ zzddkFf`UbJf9Q>`zewD!0Yb~z8J@_oEUPn^ng@e5{=co7^+x*q(J&vKZS$eH@#UQDj?^ z_^Lzfza38(U3Nq3B$0#R2lEI8T;bk`fpXWX?W-@f^-4(hZaJ%wxyplL(C~p zkqh7Xq5o)9ECjM0L}KT;2^_e+hnm>w7(i&r+N8y2!BgC_>vad%aJ#gvo+ z4<9I72yfo;Z2r?8{RfVqU~=eith>6w%YUH?Chrd))hDja%OSY8d~4F(`aItdn#`Cp_rC zTi>7V&b}60X5Eqdsc25?*A(@t*oi04gvG|Ki+^p#`qjYyJ?kV`M^M2+I9~oxO~C(t z@vqNBE9AG}wgI=q+DHG#`)YyvboP%mpX6^AV&E#U5dW_h zFj_p`Ts|@CPiAs;>Uzn}f?oz#=QTINX`QzAgKM=ElCb`pKVS8S^NJolmVY~WG~Shnw}1-5B}oWzobj0(WyMg^Z#|n@ zdqw6ZbbmXq!mf85BI)^ysr}go^|Jww$G=|XruFYG(J)wFX}-EGsV+X^eJATd?#YDc zh^HQkJ?^!OKjaTi#o$V;IzIrD1U3h7!_Q2qoWBe3%vQ!L$6y+z%MmJ1p7cO{ z9CoUAnj@|OvHG4ZK058lvL9l{0e(fwt957avzfXFAbXrJ3>}hu9 z6Z1x{XwoPbz{-z)H$A=HG!FtYw1k7%80fxrkxrpslq_W)q4zda0ufqu@P(tVWIM17 zp#D+4067p(^`qRFB&>QrZEV=F-;oa}_)%GsfA_P+7k_@J_Vg*4zkI0OQ)#tV%P4l) zruw&x-yCfTpj^axprvb1U4n^V{Z@7#wlVq>pfx^>`~oty>_E|7dveFajN2EDMV^k@RT&F2;XQzG_j=h0Q}$qkWtsoR4H>gn~C#*i2;RU4{NG3D** z>KV#~3#VAj3E0-{|8ja?25%`?tS_OUX@3qF-E>bSIRPm&)$gq^$Hj{(Oafr5Na$9v z7`MQ7Z?PvuDkA%A!m|2ppbe~p&|b8H-7ja#ree-NFEjMeuCnmUT!7Lt`*pv!ESk+6 zetcuVEHjh~qI>g(@!5)%9dz zwC^eY(A>B5N=ptH1M7f}8FoUu`Fe}t`B=8fTcV6-aPxkTgQNrR(YZ!ME2;N>7Y)>? zH@Mbtv17`wCB0H6S3I~U;;GL~mj)Nw`fXRbf)(qSQ5Q*U#Lv@tmE)wH0l?~pm07mX z`>nU}%)OVGyehiQF>#t6Vtq1A##;pjEk&roZfm>@>5|v8(|@NByt{2R*}2H;BZpV> z-X6*5s-#7TPPcXR_9YjlajARn0$H09Fbi0yg>#ta_j6j|8W0;X9C|MH`)~dc9VoP) zvJ+fAt!>(8|AG5-<(fg9PP@N1bX63OP)hckO3MbRTqh;8o#XkfuIuQLumhh*-4D#- zICJ_{gS|?heF40Wl9b3rs-MV>YG!X4T`|x@l&_*cq9q7h^?MP`{zD;g zZmw?F$^KK=w@J_4cV`T%ACFGNJ-)QJANC+EN@HZ`1DZ=U)MC5;jAi1ruIxlYSe8b( zBrN^W!(<*lLfMIY0<3|i7QOpvwmn{3*t#=mc4i^^T}vceVsvzc)~b22T*_>$^$}n( zr%s)}EbCtZQe9fK^Ns15W%RJT`=0;4#af?rnZ?=#`+<-9jP7!2-{#JrP)^l*+5hO^ zx~OSgNry)?P@8TCs)OneJL_W_b-veMG9K{ThkMd*;x2rdK?7FwfXrLq8YNu#wWk$Z)T;q{)T1Cq3FOGYOfMa3YJi&J=J|!KA!Lb)-(k z2pE=qtKFYziAud%b#Rt{vuUJblhZAYLHWl^oDVT>UDsh4ZpJ41q|PVk=3B@)<6{o< zX_y=OkypyxyHwgz#ELaz!0mLvuKgk=xcZGjbNI`wD|*ic5!W*-7SvQ*|KjK+K%psX zGD!cDfRTWvJXW=R!cY(Bcw+0Rf&q#@+eY(31~<`8d%D85-2y+`#7D)7R23P%bOQY$ zw%8ZBRD%3f?OgRlR}{@mFeT9X4s^M~-Y?_lz;GSQsJ)i_phMPcOsaDWrIuRNKF+lk z`;&pRhCAzfQSvIIQxzV2n-AwQDTM3?YtMtCAR7yJwynPBt#`FffeRzNhr~$+Q zo_0bHel~o8QpK6GWVFitb$gfDfqLSVJLWdMmN>24cV0_98US&IMD?w^&8znl`go{{ zx(z*>7Y_{AQ!y~`YVD=UBouFH$!)p41l?SM7eP+x8qZXWYnSI*VPIW?xCYxO5GIJWclJ}`mov!J?F|-u1cp$SJ zmD>+0m|KtM|Jg(7v$=l+=zq5tSrOl<4gk1t<6Rr1T}FQWHl_}}R^Y?mxOr2_1K-W{ zp6F~rTdcPwH<)3(rQrB_pFO(rsByCvL$rG=5Gtttls|)L{^T0TX^L2PS~;@|Qwz14 zPoa?IWT}8{U|5P(=30~t6K{*=mBdjo2PH?cOub&n#~@CFe?_DEIY2m5v|i=j_or~? z%OL-4D#G)}>@mg8gBfgQ5;grcrwRjiCp)fYT)%NH_iXt76Ta4fyNp+8+i{Tj|A)Hw zjB7I6+J_YsL@1MkOr&_Sh;H^^2t166ze zB&i#LJTTidV%*N>bq{9sIx_VrGC{@!)L=#;{owU24CG*<@D6u@z8Lt32m=5%5pS9S zXu5W>M$klcfM(-u0DOGMlyUX8jVqjEM(X(U`NOX>4oHSwex;c8ULN1yeYta5GOb!h zHrn9{PuYkS-k}6}<2ZEg(GFu-=~E8?{vO(cRVRMO?{`bJ9?6}fizlGBnyh!H{M;Kb z{0yrBqg5Op0K8$YDAuh-g1T|NzuqZhWJo&m_rNKDrcyD|;dqdKq&{Bg7D5oV%%;go zxUVDqVhjJ}1SHdE8+h{}mp*QCd8rifI$+afy;{u<0Gi+I<+p3OTG?YIdCU#~b}MBY z?fjcoiYfq9Qqc(;R6LNvN(S0*_!q0jB>4_R zmi>W}WjDFXq$%e2mBI7SJG=0e{Z%&IwS!lZ?l@hDSWv_Xx@+&|C3jmW9Rm!^NsQ)U!Yhk4)hFEp=m&l;s2w2RTP?I-&9_r-&yC^!$O6!ISd$?rcGMp(3*zu@X~A zS1E^80l$zbU$B0QY|AG4X?O%><&8!>nvT_Yv?TerRx@|PPT-R0i{~Qqy-td9ePs*A zK)&gu_-%+?^D@Pawy_L^rl3f^r3{0Qe+}8w)o=IULc`N)rLu(pHnCnW%e=~cH!rr= zZzUyCfP13qfxO|)=bMK0)^DZ&Dz}XfZ;-snytPAT0mvNQdVDrzqw#3aWrkKz&WxVF zLyB}*p%pTDov>4w-1VIgJK1at@M@USpi48LxV^9XBwf_8-kz{Vpcd3`zFI#IztuO% z8Skk5#!+3Edk?_lRRD<9fSF#&(eoMJ^nyDL=Dj<%d?TuoTrb5)quiQEo>V*71H4fu zS@Maxebs>MYHe6eSZO0C;t)OrWG#c#t1w^V{=m+x3w2%XO=*J?vHe*(Sx0x~5uzkW zFyqeh52gDbRr~lMxw8l(>ubJut$H0GkEMDPo;XO08NAUmE;O3&#mmt!P(g|uxLqp;PaK*fX!;vNm6>mqAj>$^UyHOy`I z-JQYubE31qL5F*&()NxJ3LOcbhq@RbR(+;p>eAOZwsr%aYW37R8G~1EPAxbLho_##vp?>SWM;M#$yXWv)bZOTei1K(%nHb8v z_3yg(kUMv4@0-`R$peiwt=X_+4%(Cl7TRLRq(Myf-Uu&e^ymdzd$Vrn`4UQE5nNC0 z6xAd1prG8tS>wpQcYo-S*{5s;0!Yu(VFqEOsOsvGvxuWz@qx!*KIBE8_`zvf#uZ-m z_8~6VroD)&hSF!KCa;2ck7b5hRMc$4*Vb66I`*v&$IGokz8P@7Lb#Vm|_vTgVMt zds`O(rs~Y(oz8o;J1Jgx%3_(EhVvGe`q#3FLzgM1O0I*0hJ0I!+9&TyM(3wJwt7y$ zYXdne7j%jT3QST5^|JEc$+q4g-k*?p%VREq1yPGQKOzp%>5d!6j}|&%ZSqM`(Imps zX%Z790h<{1yx~{E4KSk$ZZVSr*^dw%c2zylg@zh>)x@}aw)Wonj_+V$eF`z_6M3HP zlofVZGup%603o%>;;z>C8$tfH%i~n-Cz&j-LPZ;)kowRCGY2l_Q9It)@K6tKAwxd=X2=K(Ryh7WM7;j8hhE?7(Q@X>eccH^0l5oK3M*0f|$Uaj~9>| zhNc5NYAxn&n^FK)9uxt6y|gEvr~XEZW1U)HSRU>s7p`HTtu$DY#9l06a7&l}nIb7U zi`q)Xam=}a5MBLVh+b4$P%i$Oh6&#AwoY7P4;=FpUhL?!Fmo{TObYSt82}0I)2DjhM`U7c6|xEtj-Qz zzEDHxm(uWzv8aIX59xjyhPHE9^)|_W(JF9^Ng17bTcx3dV)T8 zwG$F3scpkRPuB%EnU{6tr_E+j-p|xR*?wpglV`^JeK8c~#yAfhg$em+_qmN_P4_;+ zmj~3AxEc%^8Z@aSiCkfc%@(=gxztl@x{t?f0Mm8hx9hwmueR9wY0`pPTUWRbnnVlp z3GU#TwC7}Xe1`9`T)eIm9w`ZvUII$d{Cp!W3}RX+HE2rPZyyTTsSSmGKtSaykG~FS zniXCmSM~Ri3X$56Hd^kz*I8d#ZtkHAwo_h*FZq3;P4=o8TYj(zh%vp5N>JBKBS&~{Y_FF} z@%jy1V!_J$D^$mKPq(!~-SUYBm`*iWehf5LQ&gE=veEhWKt58VF!@eXk?=zfw2-{% z8jdD9FTsSZ3R4yGNIJp&>Sw>W6R_8S)7x&kUskOb5NBZnO=K8&>{S9;(Xnd!+E5zR&iwl9pDS#Q5%M!%Cmb3^4{tkEd?g3*BI6w3Nmv{n&@& zcHh05^wB^esH8&Il6upV_r30|pr@*v67>qLTArLAQJiV>{yk(}ec|aECUGh4g2D@_uyYv_G_37CnvSmfH|znh3aUAm zGTL_```z1CZj#AefV&i+(?}Lv8%0`fg{=UTpY-_q^QPbFieF}O-t~KYQC3=7w9Cilsp>bz*#!6Zt z#_hRUaa1KhFup{*bdK=F52$DE602mQh*=e#ez;3X_)<%vl6ewD_UY&V3Qv@QuFDJk zUs$y3A1V5kO%wan$>nEb-)({cjNc**i>NK!KG+l>Ab_fRaGk1M`t#?Y3hN1e!zSBe zQAB%N;-=F|P02vRP>5&x9Ta#y?man8k^EZnoxE>NJFEf%!y9X& zZ(3b=j4E`8v4O*WYkF^e-3!c$qlWoq&j*?Pjx$#Z?ayUtVIdkIl4J~0SnAGXH?DO7 z$n*m`8hBIE2Z$aWyFSj?Mi5$zKA@}KK072O^){WH9S@;j3zWNaOJGUW1v&)O&9M!S zU}^$~KfW z!xLBb8sRMmhbyIurqAQwr*ftpjaFXxv8U@Uogq5rI#3ZY?mhkEy+4BUvmY+^1J+mT zz?I(Z%3Pe`po$t)Q!Q9i#rk|QR((f?;n1ZZ{wy&wu zR&iBGn%$7y%`+PLt0A-B$JVX5t)kbR9Axt-lC*cb3$|k#ui+yp7sX-Joh$$-LUVC!Wj4n)RopnHs!uf%&aF)+{Ie6NewCCtg~ z%NBSNOyeItfwk&{uU?`a3i-N$+35|CAMB10aOyRo{r*vvADdp9tNnRM5?tApHZbVd zzYcTnt|JqAK2$s7X$oT7!AQ&8i#ZyuoaE^{^2s8b%Q!h^I281X(%f7(oY-YFcd4f& zUK$7~*pWzKYev*0@o3MK^s|n*DvU?Sn9|fn@5c)1ts;N)vF}9Mj{1riH#d<7wIe;SiAQa!sJvUP6hJ zO0-S+p}TS%A1-zkB;?Iuu1rk}G~*_g&8p^oxOA?1nE>d=*V#0IyyfMrLBf?l&CWBE z&>W=P5qUEvfNaI9*R2s3Z-RRBuE-eifK3C!>0ra<^`ve4h^06_$pY?S)7f!66QcjI zl{jQ(D4?P0$;2R?QjUKn|9)Nj<&i9x42L|)HHnlRRW{m8WBDz`__@!~5P+GjHZ<`R zETg6q$^FtlI8Ag5P2prSnjwmt%1POf%$wN~tY4+u3!L-4&&86TuYRw~=fkE|LFK*g zHDDsH9q>TynGaho2|8>3v1xjubWFZtTUC=ff2MaboKIu(<=6=;*QtKq>^WNJiUepG zsF+kKJwe~-1~+0^aLw4rjl!+LRw0AIuv8cq_(`e&DA(4+t5XjI6+Vhe;ITDYla{>6 z)T*8g%D*mX$O~rt7A!hJU;WB%RM{?j%Ae}u{I#!Izp*8}xGEW4X{Eh%saCK+dQS7Z zlK<+1tNUjcvb?jExr_Shq-<4z$uVbN8^BM$e#MUTZG9jz>1#0g;F96ILDG zT#|nE%x}+%`$@5BU-&9*x)8?=>H!ji5AOwkm!_9k(Otb9*hk@yw2s|A!oG4V%e7tD zd)yJgAGmUnaLNeJB5z1!t34Y+pzoF5qjA-8aYzoZ~|sMMKO{kz?L{@8@en z?3LeV`e@fW#N|+P`#l`uTL0$lsJ#3IPU7ZIqUuwRWu(O;&-oRhT3r#6{*oLZ+u+5L zweOq$v$Dc*4@}MdzK8|{Ppj{$q2GqZj)B(~^wvZo8n>Vqg77Z&i%|M$|Gu*n9gWZ) zZ?kq^Y_agd@eC99hV)a*goR?X>zqjF8I_=O1W=b z^_?BHNES=@G*xw8;AnkVQAr88GiJ(#xMOxZq3xABY=8DxDls>AnAf6#p1*!}D*OYX z^I-_IevFArZ`_6M!Uz18Q3m)BTY){Sb=4F}KH3=+f^f9=pf6?2>Me`yZ>H$9<2F*f ze`Fl|_RP$pEvA`Dg{Woyg*Z=occH(R<72BFpO#UF>$B0- z?`)otC0^fhYqW39O%|c<*u$lX_;owOnpuF><-&Xro}tbX`$rt=(C+5bFKXr`zOwM` zO}s!W&o#}bOl|ldvGm2h9%x&JWxj}y!xh;>l?X;$1js$a_s-x|cYh=fXsxrg<$)wr?jTaud;)NwnX# zhC;sAY=1#=1NzX5)4{G=OnqVdK6Re$tJNC6uBEZm^~740cGPCskoBrA#NjN_s!)D+ z>H)+AAigjiA?*`m-9aB8u*6CYbd5SNQMbn=lkBWb?C9M|OLwR+zQ0wovF?AoY@X;; z(x9^aWv|y1W({zM)|i0|V)j?$K|R*E%aQ)UvC@<301$n_HpRr1-(*$Z{m$yZP8eZ2 zv`2%%EnccA`y%>+MtEePMUXcW#iflyUn(+k)gw38$lZ+vj2%gbQufOV7q8B(waF@> zpj({+v9sf%<~?yA9)7T=saerop&QRJ%(@N8S;mM+qu(08Ic*c95|=_Pu-7Y&Rn8PU z3R`v9QIsUwGtJQ~&BDDxekeBA_T9|WKhRJ*J`OQW7h?PBQvLFpsLEztb%Jh*?m(gG z6Ed;DomaKa(@E;QG(DZEW(6Ue^*)s|;%bM15mVmnE~nGij`5iR;h_}#?~AnHjVmdt z+rbXs+gTPrlJ|nKV_y0cy#YJL;K2<=)2oNu2_``{I;B4JLar4<22P8DOJ*Db!`)sM zW}+^O-u>JqPxGhD^J-yP*};3uVM>fi>l(+!2&R3Tn>_}5QF~4Hff!b{X#2XcFFTAo z)t3pQOIf-bRiBd8dM}nhW`Jor!WDFSrZurGXj=YHrhUC~Ub=}HAv1ovV5^lfOCeC; zi@6y@t&UXo=1igOvcdZA$=4HT%>q=WS1PEp=k=iQFNsn3<^G%|LDF~@>`isLRx|In zivyDnaLUEQ`kFfVEia4&+T8pvo=*13XAaJAg3bmnzO<*+M!eVM$vP-Eh!u5!9Vb3; z>3Y`Hl*B>|XDqtJA?PXc9`t-jxe`;Jxc=H-BN|WI>-u_yA#!CTg(S*HXy|dQ{Y4hA zUi4#-#->D|oY4N6yZ#$1l^*#Rmcr6B#nyu-tXJHp&j*{MSCJ8p<8B zl3btJzZ+7h#MWukm4eDSJ^kJgA|Rp_PA#drjB-mNY;LX_F7i0lWV~Ub1druwT*H#6 ziY4vm>?OoTh!)bqkFibQDU16q>uOdapVdBZB))Dv?xRTdS`~OK15$Dv2n`(xIkZXf zj`C!$%p-X$))MdYZtqRYyM5*<4ww%ssp{(f;wySsOMLGxz=oz$oF*|>E? z>eKYv@A)PzcR>=}^*3Qf8aXTDWYjLnZ>-put;$v!qE=JW=Be6Tdoxua2kZi>eier>3cZQutnth>i`@-HAE^Mc~XKk*fdUwAUH~ZUekE&6Xzkt>oskKwXEt^d{XcrG`xalJLxMspzaFADeC$PcoYJi>akE>#Kfz0<<5x2mQ z!tzW0m@EwbQg4R@Xv#KhT#FY{?$D~l;A~?gz^O*ZBCjYthwx#$-2;NA%>x*`+{rmK@ z9=$PV2GmlsK7V?NTs~&lDpK*RSA;yqI6q;_j34k5-Kf}tA9c9z*?X>Du9!?AQH9$- zF^Ohn@9WUOuNy0$J?~kTYvz&Z)8O^_gLa7uMS)gRO-2aD2Db~t!VnZ`d0OFwCmf3J z-ZiDI$?p@BQguoj*K}kx1x&lpy1rQAoiy^(INE@Pyd#3GZXW1}@g z1w4ZNx}aNE?idY^1|9Y|4`AAe)yGzRdWnGj92av+HUTqRRv>fEm!u~TESILfKbkHM zoyZ05Fxj-dxKc{&+Uo@TQ9Lf8ZG}h6GU5*YmY~!HKR5d~|)h)Z?RhiQU%Cvhx3v3CWVUv*M zj(*Dma|`#Fgi#oYvR;AdSk{(}e(hrr6&$}y{}#fX89$__f!JqMyZFvlOM->f*cEXa ziSHNe71KYuYuFN-s})C)A&h}eR|2HJ(4Mq8D%atz}%t4xc(?ont<~2*xjR< zL_@gLn~U?&;}4i%hEvtGaoRw-L@gxa%IQ{n0)JVqG zc38h#Z`>~HzB|@MMj~mko1NrwSmm-h;kya(>{=D(!^t~ zdmc0J7Ey-v8iR&byoQ7P@oFGnzW!j1=@WNPwY2F*=4PYu_Kl!wP;c@+jo_usw_;iY zn38Jy9DuqmiAb>A+wu)EYzc{#nAOi66(b5a|+uV0K8y(PIWM2pPz$I zl+&zINyuq>RBB<2bfj06n1oIUK85MDJs7x>xim?ZA>#GDtjZPLLPEoBbfD9G>a!{@ zyh9CQFtYouT^j)>&hiB5HIOPBK95#C4AERBG>pSD`7nf$;?ioX!w$8>0vn7QqU()( zMqTCcO zU9Rw*$|Lc+Ip`r*+vU_pe3$5wahCjxx#CrB?Bq+q^R`u^91S6c6~nG0MMIv5eK~$hnTyxS|mebOk+eW{7AnjxlM>}Qx8oCk0#%6I(X zlcO9OHQ%23$p5 zOZDS!UK-}kz9g7 z#okXaz+SL*IJ=(r5IgJe^-<%Cv`O&SrxFCaj2<=z+kEfvD?9G8kvQa#WMo6g zzk{3~w|K%7z%6}q|2i9MaGTGXc=3)Q+u;|^1X`U~!B6XjehS;79cBA`mn>(T@~nf0 zH_#i(RlJg$&6RKS>KFyW;|D~=P}TX2f;Vk)L^UZcqg)P{%-t0}_FTJ^aqo1D_op*A zG2>DM_8E9!U#;`N%Tn`DSCHwI+XmY02lmy<{HnG_uOr|@``G3h`ET*>$)DAk1U=ND z{*-bsdoW(^`{McYDyp!)4*|9jI?^PMhB#=mgP{oXnlu>~$u&9o1mbf7S_6>%NzZ`0 zUCUXXK6iVFYrKg>h+VcX`1D5((_UduNRW~Vo==jsooqWZz`c&Ei20Nl~s4s=PKl5DNF$juCe=UB{mS7H+D{y8PffB`U*O*UZA-sHs`P zNvV>>I3N>KfS(&jb@uJsn=V@Bwh?B4S-8MU-JEJBy1ZVwo}%jmImR=JCtF~N1?)Gg zJQfF0cY0jtKJCsJyLFHsW((57sm6W2eEChg#F-YcJ_KAL{wP6v?eLBLbi$dQl51D5 zx+0vlyAKE@i?yE%!qRF!&bI@h&D@##<&LO4X%wd2J7F`#{~2yGC{D=}%xA!LSkXCi zeB_P?Uo}cqn+;n9RW^C#Md9Z0=t)eO;KfD*wFjOvNW+#LBkVLx6X>*NU2#7G5-@4M zrI;D7Q48@O%Ng5lgJ#;xV6wZC$N3bLlng_f+|;lJ{!C+pZ;WpzWOwj#2xr~53ho>_ z4OI;KIaZFL#qdE+O}xL{_M-82mVV_&aKj$kM6FwP6O>QUD%T66U4!{Pz!C(uWcU%| z>ChoMqqbDg)nf6}y%P3>wQN<(#YEdc3~a^m22$xxP%O zOI&}M)e^sGCAaYA!;CEJh9-H6In}LB+k~V+4ollr7xs5@6bXCfpE1AjciD+KOMal0 z^AM*Vy7Fb+VihE&)VERaj%L8hfqAKmO&kgeW;dvKOB)dFVae~2fUlae`<&XH2Bpr= zT;9vFDKT}UR!AGz@$3~J$5%aJB|seNoUZIhR9XZ;gDkH;e!?2-cSLTkEIV24;#AR8 z)m2^@GOgCNqPCGw)lDijq)%t|ILlAjyjS8oFITpD7Uwi07P9nBpr5UY+q!pq)WOF> z=$5bAPNo@b-PQBSb?=7GswfhvVd2xKH3l%9kraNK{t~#dKneesA`^^)GT&kXu);g0 z8{rN?{Y82H)s7V_uzFnUM@8H|Dty|ZJ>>}AtuZaSnef}-2Srbm4&^x0>)E^G+t)rv(^L{xaEJIQRu|*ic(MexF3)f?AA&#N1TPGcQClCayQ$rS-mc9$ z3#h(k{ZNbh=D&^p*3lT6P|Uj(kc-wPrrSwEeU1@l9kM8EAMAcgH+;<*=}>49Te=}w z2h!qr$f>uTgi=H}=eDF9W#qJXU*EDmG+Qwcc&=l9`A>CulN_XA9#g( zEn^HiTMOqm78sa|+==oRbhCa!LvK1Osh%vPTsY%o7n{_suC-9k`MP4p+GNTNnij*~ z@-jcYC}mOd-CfDaY+4!|q?QlML6aq4NPEe^&rvr2 zxbaZ3*LsU+nwveGT###i4BcI0MkClL!xk*o$vdQ8Fy2fRmk=MHUq9;bmWoj#v6%EA zgxmZEjrsW9S??hWwGHV)MdFK@9QCEn{`F*cogsN80`i0Oyi^s2e)j_Tjm&}%)lq%3 zKsQh*eF;q;H-xVH{gBA2)AT+C?qgSJ=Qgk1dtA0 zQXMm`?UqUSqMLAw`sQ84u@a61gWBMCfk&Td1`FoZW${SLbIe*IXU-*aUmt^1{#+4u zzTwpAgtLd|J%26TD+wjx%d+9;Ced+B3vEf80fpzoU?hxsI1MSx$jq&V#I0yjVUkkH zCng0pZRTB82V#8Rwl@k+CzPkn48GG93QJDXeB{B`!z}tXETrsxdz^s+vwfJU(xnA^ z?Jrpo;`UW)n`J=+O7QB6xa-CO4R^sbQ0&fc;ntftmFD0+fm+xZqH2-Gh3yq;1bZhHJwYzp6{mWqVF|+aUp(f`;3CWe<3~up(x&l7t2x z1h%CZo=^3PfkJM%tv+rVE;5uaaSbXiHrpCAvIAj(xKwD$sg`)N>qS6>iiC(yu?cYw zBI_yirQ~Qua{s zG3{10`AzG(sw)RF%-Q6+ytJ$j-rVrGeM2oFMx!-(oXr`Baw%DETR!!OQ(`@JZfrdca?-~g$$AN_#{?#8IF7PKf zJm{Ls4tZTpeGq;#mhn|eKES2zQnAk>Az>nLO*fhZ49B&l$ET)VD}y}@DM>~rAAWI- zjuz(xB3&M1k~F=A=6$9kIcj&rKGy)9Ff@oMD4T#r956bDD?n3Y|ND_@VLf zYPwq&uWGUw%(rRHS5V$2FtE}1csWflcuZB;F%&vv$CvOq{-h@P`}vF97_N_EKx&=! zG53sGtwkpSRdcoxtL!Ab`nP&X5eQM(v0Na(QgiuFx75ic#;kNUcsl#m7MQKG3Bi!u zuHTO2qK}=FLBdiPlPO5!iID=D#$zAY`I4+-vTkJFnB{%!)^z@DDg4!k&a;cr0fPNI zwdo_t!M4VTdn1iCn9k^wvAEzAy=s?0{Em}J2N!25CSxt@K|5!l$fMlGt(l7xHc!su z*C)6VplS)wJ4X2&UM+qU3g$*aE=R_6rUTt1QmX=Jp!;KdtWxajHP=Sbo&0 z1F$5NUQ-oRAMm6M?Ef8zG%7GzJug|bO` z&&$jGba?>66em)Y*Um4V_Fkx47n_?lE`NS=u+}G0_b&GGne$PhwkcjJ)$y+@ya=*( z551;29;)W@kbc;j9&<=wLML201i9GaC8F*rbpiL|9YAYVno1ty3g4D?U+$R_aqbB4 zuuR}`_UxG%ZwMkqm5-F@E48#cavx$yxHn=YXmTMV|#xj%O(b~zwNYR2!FctAe~*FB`!pyMDu z^in)4Y!X3OO7{_SwKHA@`XfIq)ayD4e?L4Vk>K6O-N{-mX@3#*GO>OOUdxNFX$Z!A zrnwKq$%$Rw0?c0L3jjUyZ2P0<)+dKg;JnQhT1kK+kFFbPw6@8Lg6Z`{-8OStB3hJEF)KR%DsY zF|wpi!LW&4BiUJeL2$5Cc>OgiTPRL>&VA2ogtFA7;VofRXc~MZO*p7o9*HVTbVw5< zwtNnWnyP&o!D_byxD#Ke6N`5Ounjs=*A9}+ndsh&_)X>W2MwM98$TtB-{!7%9F42y z3KrHeL(dtyqzE>>j~9(59Kwrd)}< zyuwwmUQ@hD|891WSSOdN?cx4%1Fg6uY85x4FPOAfiAc89XCqA&L$!8$&A2u4E8hze z=q|toU_H>1xWy{ul8Nf1i&!zZo!;%M)3R>k!GR29cS7Vv6pre)&*ayWoUdxA1@fbJ zljzTFfphMXUFJiFQXUAde#~vI|E2i0j!1f4)hoqNCa3J231d2)mN$Q&VSeupH(<9_JCJf9Yr}EDY2#!gS-&}%DeFC=AM zcP0QIMG|}u5-OERIf<-Gg(OJ%tfx93;-v!ur!@hyB&TQUHeq)og#qR>Sum74chIXLbgO;jkxu-;Ps zZA;VI`e`Cx7=%wTnq*2)N@_+e1a3U6p~^?CWz?WskW*sZ98;ihDvXF#rp$VjXF0I| zbc>&JNA>*Fm`%^?rk@md*wodI1M|C{0k^jQOhEsoAArmCB2jz1Mh4CT$sA!kn|4o0 z>He$Lk%~Yw8+D6pc!iOGr>##6Q@6XI&bx$SJ`f@4wwcLx(uDR0-J%t)@k?}coFj!c zM|28l4)t96AFi!i+5=znOc@ZEoL9N%!yi`c@7gCP?)>+@5gp|lA}&9@|A%S{J7CFa ziAPbkFK3?yY5(y7Tpe&Y{SJuuBz_(ccKtVI3x1_*m@_}TtG|UBX06FYTH=9noFW#F z>wk_fIY9nc=f^;Kc&fzNmFt)OVXn-+ zr|G%!Kvts~~tUuNKUjn`S zIBZKJ`ZXGSy~Yl6MwPM4s({s4m-k_FDN%mp$*rK3dL|n)t5`m78Q?8 z-FmP7_dGj)7 z|M@WPc__)PONpsUJS45Zir|m!0I1%28D%LZ>DGS`#6LaqulM*bGq+ktCue~tY8)%i$3<&(F2FLD3PF#7pfzl`|f&)dU*gMW3ks}K24lKD$U zzrH$g8&dzlZTQD8`P)2lw8)-?7k%+j@J-sd+Y_dJgp%``fbzI!V0r2^s#d{+A z#}#Mf}#b}|IQ%Dz4( zV$)0$BK_4!It4fq7Q}2lUQoKpS31`+i-s+;klc@|x4>@pNVL2v6rGx@j0(V9JTgsQotv;67M6Pjv&5|&*^ zm9af0WLS~rviy7@{xqKsFp+g?H#p_x>3^q)LS@PT4MxIs@0arSpC0~CD+7EX5ZZ*P zwuSyXjVZ%y0IYWSm3Kc=4g7gFf0gN<|5y+Q#%)crS~dU6U2(Ap2*tES4g8<%O}}gt zTqZDXZ!@0H;{Rja|7mH?>4kqD~ec{^wDej*KKe+;!Vg`JZ|8}pzsey55Q+|?v%Y@c){^DKQqH7!f zcCVpN0;yOYTH<^E$7%j$0m3W*O>#l+nW&80m%QV#ZpXc#E2UW)BY{y-QsqF5*-Fyt;Rn&5&wHThkd+rQLj!jyYgp&;7Xcb*NIHjxWF!R zXe)fsExBcB8Thnob>t&|p~w2~e!{P!{h_`tUk?jRu;iDLG6SNy^k1t(j*qU_-;_SY z6())`Md=op>Ia+d8`lsH>=$mM%uga+CDX9VX>+qR=KLny^=UZj8Y(G7oYa4?al_NM$wS-D1U>)#Jd(#1j`RIyq9RRA}{zG zRw7=~9fec?z}H)xoGOl^?-{+A@;yj?F7$FeRmCTPd(^xvxZ)mIa0pz9QEfnF9V?6+cDhV#0C; zow+RB?E;l5Mf}UC^9QVNGdyycejJ_ub>KUK!U9t)`6c81m$O(#3LjR}vW*p)vfsad z-^ag&#oZnE45ESk^n%)>#c%okhLNC6=Q3y^@)`MJ|C?41)pq(kzsf@EEp$j%tn?vw z+I^^Br7h4hupl(j7-9LY`@09UJ7edSl-M7CLO2*fo9YOIE+|mORg8EqQlFIDeBqGhit$?xx3~ z_t+$1S(p^T&UJh+G$X86U}Cu0xS{9Cgl>+J$MP6#g49-n(b~MhjEQ- z5-Dt_tgwj*djnPDmNLLdCC%IP{U&T<**sZ!Y%>eNylvG~K`r zI=T6dh;wDXq~-EKkSE~jzai~u@e>LhfciE8nDRfhv1#@dQ?U@Xne3TJ%mGM^A&?uy zOygG431IqYJLvD@of^8iJ!eJ3>k!Mx_+l-u{`ueH0*MDQH#(ZJG|>jDYiOpfPc zuMFlHgZntCKh>*=p~pUt`emu!GlSvRU#Giao$>h9{-Tw73jUU2bD)Rg70uFF*WUGN z53t2wrD#Cr>pzuDjAeZVLw3qf>e)AUwP=t9gnNAfwiLrBnI42y?DfNfM#9qCATn^E zU|PMl4qvAsPq9uf=3MuZX{Wr(Irx>13!3`UC8EuD^xg;ndsAzkMMprM!)FCd*(Iz8 zHQFgLr4gKh92~5P1O%0Jq(khHok6A30|(c3Fd~?NwflA>L1TnPK3n6~2%0+Y7M_)z z27F5-@g_7o(h(9m5UnEx^PP!A+?_R~zfHU1*(b4O^FGBaU^;LU!jr_AwK)dXnuhWz=U@~ycvuof2 z9ve6M^3@hE%K?QxpFUkqYOotF4-4PFtE)rer^1L%sK zta<~rmrZyt00D#dQ*lhc5ZNlVKi+h_Ia67?(#63mEv?1*@WXB1ru_y2?d(8%0J4u9 z4o1AsbrEd#%tl@

    dbgD&O3dIsnM57l0NJ)jMf^+TphZQMt(<9&)0J5&&>v)!M#1 zzG-2Oe6cw!+~dVw(Hl0S3V(DVfutcHF>3wwzzyZ&_jwAmc6b0_C`O^ODL{S12$uma zEC5>rS;1q`ya`Z^EyDVoAJfsgCvRQ5r_{S5km23T{o-TS1Sj#STU*QB9w6OSO2g`o z;yxu&8_c7!|8>p%u|{#&v**>Cb8T5M!pwr9WdPzPn5LbKxk$JCNq2_OXNhygkMf5# zPCA9H8T0vkwA*YoqBtTvn!F|Y&c~&8!W2AZ%Otj%I19O>@i>21*k#UFlu*>*qn{aJ z3~CZFLsNV^uqUB z+fq=6GroRtQ(*A28vYFhDb-#xMRFkSMY{qhK+KR|@cY)EMKVj>>Fi?=%qdA#pOPdy zY3@HgfoG;N;i$HlV>J~BCNW6$(W56-h+U%>QBhUt$)yIEU^g?WM7zTW;?>0J(EolHQrpb-{(|uo218; zfIP982!0pGks`}Aqx68~$N&jfY|suPE>bbNar2IM!}7at-}r4mJ$9I`sHb0fkDp58 zsPHCG)?`B};jd9WK~*GjQqyZ>#`!}J&_j8Jrdd*ZAOOW31Y6%@Da1Fy@!Q$yeZ*pd zbvk0xfeD9!?oL=8c8jJ_xg^qj;1K%UwOHt(RreF~2iEu6fy=~!gF z2CbCWbN#a1QJPmV$+hMoBeuQnlbPN44RN0iacqbMRRPr-$#B+cZDRIpzy14!GUKs! zjnv!il2ENNvHUXu#Tkdbf4NJ_S5|;4ryjA!5?pFW3TFn$C%x%6CzI0N9N^ksOIabLF#>gf#jywg^e0C~oJKpouqb7y@0!MDn<0CHuvN6?4W_aC_Nl-x za_tY;m+hnIz)1$_>UxlX4-W>vKG~YK5+$ct9RtZ$mG^!?6NdZR_JWo;LM9ymhO$Uk z)B{^1w?j23tN2ydNDlIrV5v?QRrI&=zqP;nNofB$&mm`VroefY5M65|2f9_Q{$3~H zvn1-VwUIgP9I-F+_~5{4&Kw-%3{lJ^Rll@hMZ zHFmiA$VycOwl+EWftt;LU#r<#uOw-i&)~1f%{h%61>~hoN&td!^VoS}u4H-l$xOQw zi85NdLg7BO0wm*wDKLV zqM)@IBLuUi{A>}Ms12h&Oea@72u5I3ZJ(}G0;5;eik(iqyLxya(4l6$Nq-^Dj9pBy zKH+et)|A4kcmi8pWDM&)e59{;Cy>zB37Ane+YBsg|9B++bEBLh+SAWzRznu2@&${&>4a|APTv&o^Bl3ylDFgvh2;N7MT+XNB$# zmOfBXw6?|#M>)9k74M6HBpY-9+eWbj{-I!fvZ=iwUW@v|2Z-beQhn4x=7VkjFtbWu ze3H{*y>!=KQ$y+)9Dm&q)*d}`Yjt}Vt_TtkQw$#w2z47;LTnTsDZa{eN+INJZPccP zegb9uKhC~7E~>Q)_ke^63IZajfJ#eCqaYp99nv)*odW_2A`Q|K(%m%-Dc!=*snRvn zz)-{7jVC;MJm=o;{^M_E)IEFN{l05GYprKJ%M@}zNu0n(yi6StapT_Jahvn)760WF zs_iqLy8=&uL6=For?XsFzPboAg%_Lk#Q<&OFSbNcw{bKhMowlgI>^hvFcn84zTEio zIFte62J~0eXwC(I5v42ZnajAH=Ro4}Vo&yznVA(k{JaGRg9mDT%+-lcJ`#Hpbr}gw=0; zcp9h zavXm#IEKB<6%Jt5wrQ7?L`5FnTHOl>L=U%?Z@tSX`0Q+%3bGgqo!%R)eb1m-zqMbN zZ99~sSTqf@@|UcS;hDBi^r!`&2;V=hogdZCP}tH_+Cf}~a}NL-4+kDa$IN57sy)Rl z`NRzr*d8GY{+V01G{0N2A94KetJm51XUuG`ot@a`qE$a#ht(nA%M{j5#TBsI|0*uA zL%w(`81pVZl~Cj?98%R6f2M%H4Ulgpt;G^ZISSM8n}bMLV@6H?#v+qX6WO;MF&=br zSPXa_w6I@|+vEFGcru+81qOPc2DRG3>`$~Rw^R5|Xz|!!0YkaPTR^aXEd~&9NfsF0 zd_MTH5g73;oja}pKwf$vC}@>Mu1-7zJlUm7fi^tA7!c>!3(UsL$$HtxXC9j=+~uZ? z7y}clko{Xm?Q-E3u*UGMh9hafpMG)CNWu}UFFTCYKjk(X`BXn-$^&GY=WspL+(N2fFWz)i!cfeD3*@_8C#KkL&+ zL@^V$SfKx%|9bxfC?|3F%x$0U%>=wn?+A?rf;_D0bpVE>;p;k-i#>fR-GN83affq$ z5om>C0TL=+0px6!?+SD(CyRy3i2|i^@#VwXJItJUrr^GN15s-ud6SEPzK^ySn@^I@ zTcP(!XN$6d_+@Aju;Tap>U9l~^54Y8#Ia^ql=EQ>9`c17)}z5uu{;*m>gnlevfQo1 zvP%;XTgT&pLKli^<_MVNf3VZTHGU-9uO);I zc&$|ZSo8?UQX}cnXZ7aug2Bdp7w6K;%5xxkjqTg)p$DD`H}UTlT}Xmt8NO#$R08t zP)v3T1vU5>-*E~H`fz1rY_Trr_5|w#i|Yjk`OBzwV4&kGsVI<(DucST1H*OzC0JIE zJLLkRJk+aSqtrecQfzx4$RC*@3w87Tbs`AF@`)x&ODIg|C2X`!jm$UR{^|t(^;via zmXdPILa9&E+byRi{PHedpBHm7x; zJpx0R#Nw!c`wfL*CRABb*(8m`ZUBI@p^!}@%;WwXYB3Gb|bV#tNjfDFhtUH?U z{#2^N0GWBV%bch3TN1`4n{GJRNDJ8u$LRGnORRt=32qf9f!Bxg=zw19n@NURJxNHR z&(^!{WAu40TL&qob@rLk2Qp&r3I&=lGN79fKDII>b1p%{J$~*sAYcV5LS+?Bk40Ui z@QPDW|J&IB6ggZTE#84<$*J; z1YNhMYyI>xfbo%CPoCJLzWpvY(>i|0VwRso&SKt8I2R+8%4<7WV75Nd%*FZ0ckg!R z*Q2@ao&o#{eS+P3voUd?f!btY8+~pH-8c0oJbk(@vGlEhi=A_jh~uLt7r4Pe?yQ;! zKTkH3G$=hEU$<_*`IlPmLYVdLXB4vA*R4Dg=;Oke@_cy6%wHrz<^jmec^ec19zZ!-z%s zzCce5J!7*#&d9ulc&c}mb%fESOG>S$gruZ)()DGAO+tU}l9x2wb5)>z!`iK*qchFy zFSFI&jeQS_kS|N=WD-&V#qJsy-_FJ?Pu7U7{P5OPwZ1ca(xm)}jHlio)-nnxp(osOFJBEcOQzo{1_+gn*MDB$Q*aIFW7%zF^ZumD+Nr1m~ zKpCRiL{HRmsy1`X-Agwf!g!|i9N0=vsg#8$Y_fJWFj!jdv*I)O zI=j;@=a1y6-H6|m?ag)!0U=5~L^R1;d7>5VP@om!20iS#m73(h)z}6Qht>ex&EMZY zp+I1So$u<@_o~b88xf$$kXCFUewH;Q1s7 z_Q&l_^$C^WaOKk!;4p_*^Rlxmtqm6~s;9)i-Ow=3LL(*@{7u|DjL7~Q@SNSaXk)W} z>Y#`1m65PXSI-XU6Kg^&D?#=hh1JqKhHXPu{oMbz`pb_H`*OuOXJmVK&C!i0Z!88- z#E9+lMl%Nn2EsL0INuC3BHjudi?LQ0DR+>~nEcIkeRpF2{^~(6rfgRdezCiulKo3# zASoKyP@yw|xXkOg5`GG32#t|~5si0b12*YC{ulf0uYmN=4J-2eoIEL1x0Wdr9qG_t zw9d8bHaCF095eh|_j%3&;LX=fmi|a_J-qx#zkBGoCSBrpjjlhh^_LI&+rbp^x&H0? z!6rTLBCs9IdI0^Kh2qL}W1t5wGCZ7mXQv}WC0BzNYNMO0S}ramz~TP`KP3A}s#Y`u zyHz_Uuh(f!*E9Wnm8(8R{|)b`!`ILGNqly2id3D6vNYBoS0tRmr?XQMa`@4IV$~P? zeG~q2@jLg<*L|7w#)bc_^8cI920&Z+|Kmn9y_Ah4Wqc*T-}u z+H_Lfd}P!c{JqZn9R>m{?t;k_YN`8m3TM;fFSahHRBlRy^@OHN=~WV?wPffR-zerA zh;E&~zc6qiFj&G+l$6IQJb8b#H3$EX<_>htc2Gd#Tkp{k` zf<0HR^`_K35wNO@^`1+l-m7Z!P^~JsMXw$mhREB~2^418U2T6fzz}$e@$SGVjls~B z*F^vJom7`H_Ocf|9f_|J{o8$g|J6Ufl9T}0S&lEhwMzfv2>oi?|M3~NDDeM$?I?J! z{L4-K_%+|x>i_=>shNsX+Jocuy8uB1TEI9?>QAXX5fw%GzmJQ10L${eb1CqW5(BrI z7I&k#*YTqIM2$t1n3!0%6G$r_c@a7XG_u*PCxyzte{|;$lfbyBz~7e}Lq*II$*f&H zDKsse@>dm)tOn13>uJd|s`qDCc76q7)R06TnVqj~nV|d_r3}d% zjojzGn~Z9OWmA@8d2~RZXH#*AnrpJmiPe;(MjU!^xO62Bk4nh;1XfyQIVfP@t>s3` zBH!?E>CT-Gk>M|7fsWyZ_li*Grh{_Rfr$E(gLvma`$eKyDPYL%g{r**od(0q)6;c= ziQ_qMAmF6r&$>O5F9YjIkn}s=w}$n;kDXu9v2}9nSM}EK29iPm;Ca2dm8yxh9OWTU zq7@5Gd1T`qhCp^z7tECm25*kZqWT}5tnJ&*7R0|}(e2Lt`d4H3_owvluc+}aA4-fb zmOjQq9}>nl8hoG_!44vm1kxm@;)h6K?FB%;s&e0DcC-tJHT2l=eej8O+B-&N@uG&Z zT(XC&!zWIWN`s99%0uZ>E%yu_wr&V_9Ym;UXEzLH#!BwxCw7JE@-GhFcb`}TO0C#e zGMb}+wN%FHK?Y9XOZ9@;NN-(nZn|CUh@o_f=>u3bQ8`*75iwf zmX?4!@Kz^LcJWA*XV~O0pk7QGbx$L#_x)Hlp->c1zk6d;9GbkGw=c(PYj|>EJH=h> zz~{RCtuiz0m(9csMEPzt9fXh3{VSCXHIAZi9$wW>DcOIhyx{ zuO*fKZ2rUPeFTK*kTm#Cb_#&F+EaMh^2f9`VMxBq^kkPQGm~Cjoc1#0vt}_V-Fg1{ zTDZfc0MNa*yEs<9VL8IkMM}u1TJU*9oQF6l@J8X7Qogv8M{mie;X~N=_6ukqGQh#J z4{_@Obm2UaY#=p*lyI=oBFT9K#-3anew`p2!N&G9Np%9^QQdpwoD79SQkxTKB)r!& z=@c>8*(@*IPlZ_sOk(-Aw^2B$)z9)+Pt!V)aUuXGYaNO2;wGY{=TNDxt=rY>M#P-p zDW421;F{)^n{EYK4}2VG8iioK5z(b730?m!5t4(frVM+3Cv-_fv01HmVQ zE<2P*moQ^&*P&0n$&`QPk>%;tpZh(0dM_>QG2v;zL!LoqJnPJ}=+G zJiWraVg6j%hL_ZHI(NB++Cj~kG=<4u&@OTI>NQk9h>%R%Z!h4$cmhhfm| zI9?7q4V5t%!)*=TuTg_ltl1%^C8xjypZBUr!8>;zQ@Yk9LcM@~(DOXw0#uX31gOTD zoUTNaO=t+s?Cp?qIO50jKLHYh*qoAPBqtsV%kdoOPnQ&M55zWmLL{b9Vu+!{Q#RscH6=gI_eq$mfbY@vI}ChVrzG z4bn)+A3v%_*DEHQdqgAZs^U){f_9~Zy~J_f3wi}l>lJ5Rtx5MIACEe9DGxq)eqKm_ z_6fTPg1kYmULWI;fF)OZlj$d~d6W9vs*M7PlhOqs!5c&6eLN8~=fDRaW!82DT`@HY zJDT4O-Q=Iq^}K+dzGnL61q&*|4d`Gmvmdea$Vs%RnUyCgVze-^t+?iQ_~CI}!gHmb zR(j?71A!OYsh+#58rm)ZiN_tZr)yVcU^&{IXj}JKOD9R7@L<>iW`ax>)az?Z7M#-c zUayR$V_+E49WcLhmtAKl;oj6Gy}lg$xy=*>a@N~5xtRkTC}8H&W`o?2j)JX#1-upK zpU#{*7RxIc6)oWSwB@S)mhebRe^#VS%f)e!q-2~n6~XN_mgU#jDCk_wzSYLFQRWlf zs(9JB-%}(JIdO*eQ+u`qoL#Ixb&!bo5Oq_EfMaJs@8g}PIcn^hKT?4VvM5i^JR+yC*5){_nC8dyft)*I?(t_6 z@9$kTAE|0&mg#4isGCrIter z&D1mtLRSpg;P&#&8#54HVlOs1?lZ{U?AmYSxX&3EuXDO7#qnPJG1zOOzbT2zL(-Fr zi3g0*mlWH&B-QPv-u%_mWgREJH6R{S$C*)>ysemDg#Kn z5|KZ!dHI^2qwjCFkX3R1${JH6YZqPZ^YkIK5IHZHQP8y(Hv)9@(*lgP*jaE&X>-UN zxQqRjq-D4H4ND_S;d7R!+{7Q>-hKME)5sP~4Xs9*neqfi zULMI?&iPo?m$;#_FuA%}e$ z6=hb|y=nL9AM=1AcfyY@woE^AzYeZq*SyMQpp?CMwi>H1*JR9Zmo?8qOh}`yXQz3+ z9@{3bIr2ivDw(Sh%NPrwqmcNeY<00~InBEcG+L2+EzYrwM{g|4DMsQvHUtPvEFf8t zmEK~rt`~%Fa$!lf;}uefL#@fg-}(?)G%jTZYmU>)$>5m215Hl8NgP9%9KR~fRsb|0Qy3ERDS7q+Qy%i-tw(|;Ux#p*ynOY$L4i8+XaH#HZ@3s|YjodET zzIp=48r3R&@N}!zt#|0ZQ7`{Jjrph9@6`3Vpv^61=$a$oSc|qh*bI$5Y!!>JEIlJD ze^zeRGe&M5g;Sc zSr4r!5sIwtk!)Oj!FAoX`&DU~E!qombkJW_DZgK!Nyv5KOBd7a)WeB|T=<~LZ=Dbj< z7BdZg*HkC~PTaNMt z5Gp*?;L@ebcMaI3wmy2_=Rs3uSqg+SX`km0!j-TuCdlTxgt~pNc71bdVszn#XNK7^ z+3@kA!mH$`rKh{=wq^YnyZJp2ZNVUlsp^oOvL~ys>}bQMK`WoD`_{)KEBW^KHD>hP zpL%ImYpIBs$jV6OM098j%V*-qPrx_EN;>&j+4pLWT6`~%(1~t z32?ZLQto3Th|~UCYu!p&JnI>zYFoY7hct&3OM9SyaGZ zkB#sOGaVN#6^r0EERBh0szK#K2P$duhoOM6jlwDQ$+~B3oqj z({ko4A+s>5h^TqSeXO3T)Qc9OxOvO^bcaXau+TX0E4y`P0N<^>gs)MLbXODTOjI2kFQu-e9`py7ld9?fnjua06`f_i0NYJv( zv26TPY;yVApLm7}LbvAb%QT>*{d;woNXv{vhP}+ksMry&xg*w8+gPtGOBWJ{PN|$k z%s>~`A8+Nzxvd9D?XLUs?k=}qbDul4+x_e{alEJGR_n&N%59!=<0Yw^g%wfip-IZ@ z?m#Kc((}=BKCh8rs*snT%rciHT3UrceED*q@!Rj*^WNSVKAgLJzY4^*!|S&FQkMKv z2V9`rZhESCjc*Z@EQ6gG>IwBzo@=-8@K~+ULvN@y8MENeGm(~eUx3DB%%vP%`EghNoV;60fP9bHN1Ml!;~-7?|MLl#vIEf5`8`l~`yNeFqpp-Mx+yJULjU z%LmL#`zQUC`Q2|rk;Yd*n5V6KUM~{5h!n!<}ZOT(5aa(%V$iP^&%} z6F1L18`1jWm~0l^%G$a)?o->R{A0yzzDMpd#712Xs=mRj=(C5`C9`V6d_;0m#YdSm5jHPN5tRX@ zIu)A04s#}Yl@m$hv!q{N1!}i6 z!W5RM8%F~(9t9tgEuIZbhSm%&Oo*$E0F#aPtK68?L|j;e4S-VB|1cGL2i^5RlXB_xZkW71_} zLGTh)eIcfhnF3ldOD?|P+6ErG^E;WKCAmUj%)~LGo!JRWv)L;|E0)AAJT5zE7h#zt zSvBfH&~?jK1ImaG-CtWCUl6NLRta>~a}cT>Y!2&<|7zRCirb?6`k!S1F~;qd68y#d zGh1=@UUESl-wR30E!HS;eMXHT0jcIllZ@zyLPetJ*GeYVoI%~Au1ni@>ZejgNs=^` z3eya=Evv2X?@u~a6x!D&G205Q3cA-3FDIM6k8TDd0sGm)j^iK-adRIp$?Lgr5 z8H@S06WB6&p$tuXNrB1*MloLK5Ug1jxPen}$qnU{ivj%8`-t5bf!9GRRl8j4T7Zg% zS*5_CQD#p9RN&kIcS$#0P3YB1E#WF|g1Q)wN^Et$p5NIY!L~Bz{<*UA#>MAm^m8R$ za6_Hj;_(s3;FG#3BuFvrO`B%@S~li#110*kmzaS3W_~K){+lA>ffza5rwwR5Z=-?ZT>Anj~ zz?j7pThNV)qvfi;D%H^{#=TO$a-V-bs*LLxl{XQvJ}ut&psu&7A;+b)eJzJiiZq=; z8Xz0#q|r?pRAG;`_4pTTO@1qX$T|YDzYcB_raqPFzQG?|q#~yxlG%Oz2nkP0Q^VNV z-VPTe8`IX!=RCI6w8`I{3t@unb~*^^MP@2DL}<6qrQ6Kam@@THB-3*k>PwuI?$~k4 zx7K>N*sS)(=6Q{d5762UepNaRyien7L9|oFg+~Hww0m2xZP2Oa=I})pJTc6PQ1gC^YGI#2o!o?)-jEZ?s-OR_mIkn zE`qb21jI@@m!#IryF?NJS`Oz@n0*s4u_>&URX3|HW1TM>zclpKIVo*CFjwKGsHU8z z!!j49s&;pK+uqYYtCcID48ZHPmwhdkD&1AkVuWenmYhE#T4fBLQibbZR?vQttHbfc zKU$(D8YY8Ay?&aj&6)pz4(HDoh~Mh!z>Wt`iO5NJZlsJYz~LVP7`4vmclP(f_CDPa z2gWBo)s^_*9h=4NN2{t2SJy>x`9uX;!YW z>%Q)k)YfG5LYPy2NL+fSPjTQwF8T9&t)bm+((v_I`s`)Dx}ccf7`8Jv?@SeT51K*u z5$DGn7qLGVRDjHqF8#t}oI7@+XU*)2*!$SnLT~nZ{Vw<|dB7hj{gvL-bMuhpzBj2#dNSI>eiAg0hN#3dI9HmIG{*3yBP4wf`w5!2LIKvo zj(qpapU~*eWn)uU%qxl z*&|2gBm%UYEW4~!JwtlUFf4{N_Pb1Iyh{m&K%bt)Bi8XOjwZE7D`LEaHRY+!dM3@j z-4`Avmdw2XXcPHQ2IVUt17oa%&HGE~4j&1zCLKI&lP3Z@V_wVlD^9^pt&5+ZX6zsF_g#2t&%!l zmOD48#ygYDwx-PMv|^BPAcKA%LnVxQHkQ8;ZjwJ*a;%c0Ixu!muVl+7K%ED$W!_aC2nq-mg3c|s zPsUAZ4R-o{-k%5BcwX67uRbI;`ALB7Tk^}t_|Ep{0}#DhN$RU*8b^W57ICWLmsdl{ zlqEMuu8;)FzMUhJk5`sReI*NHOBS+Xf|2Oqa(V1Oxx->O)Sk6#QuWqtE$V|b$t7=qjxRAvKb(%qj4 zxUj%aYQU{MU`gqhbw+E!VOq8}EUtp1SUGX+t8vHJoWAsJnK$__rHDT9W>{&@DEFBR zM^=t1%4B=etbNI;@JcUU02joi-&;H1B4UKV78%Upz44R1x_h~V*5$6D1H-R=XDi_g z2NyyrDykjCP6%R~eN82CElMdUAi!$wwVI69Nw%DkuIaI?CZb9~#uJ3{^L_vBAs$L>i3pd}8wFG-HKr_;JzlPr! z@>qDZbFd#cTo98F7jlh5ByATO_aw3^LG#Q3L&NTV;$b}}59Sm4^KeQD5YUZ(cl@60+vEG| z59&ME)BQ=p09%w2*G$0WprEMm*#}=gwYFIP^ieli)oTBSqO1QFfwIe6Z=|9QL|f}6Bx$(J*1HoMQ> zy3fY0!yD|oISO^B(rX=hIv=_%FFDz{AUQF~z;s4c8()dPoQYK&f%h*TmD$?r3L1|Z z8g;F)+as6cAf`;2n~Ox0I?PkPYi`q8EI8KTh> z^oub}8Z|1Op7n*RSuu0#1y>AzS3>-AktOLc54^9*(~-29{8Tmk{cS21yKyJA1*Pj7 z=#6I<+5#VaY5iPsrYj1K`P(s9gM;6!-55(NdnO(o$X>g{vD{0c8%t|3U~U}csCEj= zAlgqozf6}DHE>5!QP>VY)uJSm0Pa{;KQLPFCrA11%Wq)<6O6;xks&X;yg5h`9wdM8 ziEIgYDFyR0`~5Urj9K6UF8_CDy8Yl{jqqiXF0P+x3qSt5M#f(;)mwuQSS2;!*7^UjGxKE#rdw1(zr>-(3Kkx&0g;RiGUFP z5;OVIBW}@OVldzm&X^+!oFuCb}P$WwuZeIfBG>#t^@#cP~b89)gM;# z$3^>nNBsC1tv&|3?7caUmfl}2&fSXwbuKc#l#}Z2rrVKdVz(+=Wsmr2-^HOMT<2@? zr^6|2(;I8nE}p@~q_{J+7TR=rc^>YpP(J5hUG3XvN}<3)(l6_=DgX0ve2yS_KpOP2 zZKDC6M#)B>4CKVyFScg<>b}2ymO%-$rYH~8FG&CM>wHugUjV22ePjh&ZNrI8a@iEW zRdA?cQkbjhn;katA6MaT-w=L^ZFn$pyx=X^`xANL-{@!GH`NN9<{FI#uC7*_qq$5sSrWz=Ckrm5i$lCM6|r1c3Hsq=QxE8qt*_F z7zv1pW17s&T>tri{(T92h97Kq8pqXvmqUY5_P)UsXjRL)u-v5t`6MA`TO<`Vnb*v% z)db8_6wL^oW7`)0SvbA$=>yGjW4RUOHp^2Fit#$Uwoc9(?c*+pE#!FpI&*#d~4#K0N$cyr6A^40ygA z#&K<}C%@kPZ9ss8Cti=n|8g6_SV~S!3#Ie-jXO(jlmUY4w?2I0wZpDDYtYpL?}2#T z)*QbkkH0R5K(muo*9Y`#K7S;-FH2G;b1#@N{l9JD-xuTMI%Y1r!EX0RKA?)^;(p0y zjD97495dkTO#8fQ#iU)zUaEkSOx_w=>BZy!yl%|Mo7z9M0DiDn;h!;c?;0pE*8{mG zrX$0TtysA8Sfzv)uU(7Qg(5p+3GYWJvOB*b|7Gy^Z(HIzuFp-fhi>Z!pouc4M9=-c z>N1O-(MQ)`m_NC!Q{$>QT7-V;e@j!Cm5fw`euwc>1IX$;0W0GNKX#~=L9Lu?Oa6V0 z|LbjrxX(?ZhorY|<&@v-*RRpYI(@{3`V8;k(#MDoq)}@oP%0 zj4agD`^Gn|M>9&_3)^ujPJ=z`OxDm@GIK7t;vNkJ@f?ZGLT}w`;{0fIt!dh1T7sa>Me37@804`U1yEwFtN`qUUNh@UpR6=!p%?2*f7~t?{#N%i<53*t^T{Y_~)~2 zReD)rTl#ALA=X!IgPkE0`;{%4LA*qMbv%o~I*SUFHGd5h5)=@z%9fYb-j^(>t)grG zml)vxgCkHX5Xrk1M~*%+=LIjYx_#ZTr$1QAI0(!)$@JE%6LCg2@K)+uR*bm-`)AZYwc{|vwV z>et0LBOCvQUw(CL!h&C#S=I~zyI*{?{%mOX$TYI8Q_EaCP1}FGigoG|V=B9J=n+>dkwq3Yb_UTM{_CM_VC=AFOXA1wojpc!%r;rb9zoNqo1A__ zGI%4>^0Gu2Rha3$yDnQZ-*OaFVZacd|L21vB7O6PLSU3>|HTX(pE%=Ka-jv9oxQz~ zeUrIHZ{bO!eD%VQk<)_=gWq+e{vBKViLvv}k>h?p+ty9i5`!)Rz?K2$LJ=s@<|^l# zR-nF4Hjj1OFA{wr@V_jBHK1QATUG5Jm}%;xU2W5K7^n|*3>3v_WSyOzW!ZNcrGNBb zT$6DBfB5lDGeDmr>Cb0j^E{4o&qy&y9SLq5L|+KMFsC3s4>kJZ5<@>+n;^J z-r3uau5;VfnAZawWYJvBoryBj=-zmC&Hb=RadYz=EFA2>#uWWXz2h$BY}yBpG+W&|~eO!qTmp6DJ?)!N) zP-ss}0De+vQNyzjn01$lnW%x{ncXC7DOqTW0DUw-N&zfS*;d#bov1$|Q1JClw+6sh zE`~IqjN!gdM^6L14jwsFzRkqZdZ6;Y=?XDtTI|m)LEz~OO;dsaJXj=#J^&FkRQVm z`Bp(qvc!SyKh=)I3C=fipi2mEwg$%j*9wiK?D;Q|AUv z-Y@17dX7uVmv2jq^<^HM;8S+)%y;Onty^XT>J{BQfMCU@{t8Q5x6lXS z&e>}8%lrTs{vXDN;9081;9YkF(1QHts6pec*Mz)xQ>mskkIGRrJSq0M(rUk7Qr^G zjxkK)pNu_kMw_&^z-Wa0?fLw*e0Nrl2Rhfm$6b|HV@U_;f7)sSz0WfZwmtiMW(%>Z zj0F;a4?zS?a5uhm-S}26=&hI#a(gXuPY@1b~1_GhG=!b69 zWSHl-()X3+zJViWjZbvF25sP4wFQ^}+K)u-XEy=d8JUGPRZ0?fyYAH*8hh})*nUjSLY13>64okgv zHnplFr4)q$=DbKCqTrffh3q z36J^|{%oGyODRi*UQyp!5d&Q0J|4PiJ~aY)4S27C{ISmcb)JGbq-kILeFZhwC%(ZR zV;PE~J4ZY<{ex~QN$lFyU(_e|mu(oL$vz7WktDNlSxePM%PG496Xmt}mx)!kAR7~9t5)7s&o4ml0687UgFYZCyz9L& zNoUFHu;1WO>cK;=DR5eE;qtOHeKvoOn1y||c*-%#y_g%cTae?OE{4>4`-u4DKR1c} zO<=e4&Jr!XTf^#4<}Vh$>Ad){maNAP3hmI}9ZOB6R+lH+0t1sDnH77&t8HO?vmK^? zw$V!7@)>C-=mPP(gmBhe&PjZ9q`f+lo_O`hARO;~tqZ!LZg81`qQsQ4#0p8d3a}k# z!RY!kK7(CEJcl@rWk-(~db^R7-L(mNZua`_7@`Es&M@6_k%@Sr`o>uD?$TSaEz6mF ztqXj87)fEQ=M!)1D(ow`LKG(9Q)^D^ znE*xfuH4g^tyDj2zIPPy=oHW?C=PXVIV_^{?Y!p3AKGBq?4#9^_*DyXL1 zZJpa~v#`N=1b_<#$dN-27i&UcBa0X1IVX=61E}`j_wwx*%(}p`WMh`^Vx>`@u7`8l z&h*3gGmi5!VF4lJbigFBXdUq;x?d3v{=&$TU6?y0(b17aar~HY>TJ?Kvf`A>j<=Qs#!bedM--nG3?2%}v7` z@DCv`tVV@272Kg}U^S8m`P6Ki$L>-@zB@u9DoOWrG7N0Rch35tE;!6y$B_)PcS9>CwMM&8X!B#c$n^WC2gEWijNZd*6 z0Zj^PZkw69Oyt^V5j{iPvl%iIvlyO}{n*c+4IFr8lP?5sr1XU_MdkJCS9Eq7x=-0y zR|;Ff1$4hLI{7>|Cr9Lg5^KavdB*ww=dpOsL-e$qtx`eY%I@HdZc3xTu0tji&eh1wz2%i&`5j&s zqd($Pk<&{8uGb%Id6Op}$%B22X5N}a(kqLvW9^yA$GYG&6myv7U-f68aX#}rLPSpH z!2q|lZta6QK}6tzrZhToL$0pE)?XHdZcg6nA@I-u?V0w64-qk}p^Wa!-;T%HjP0%B z6EC;h8KQHmR}h|&!M5|lN5&1`u-M)(6xEhk||H4S<54k z>RTfEv~ooJSZ2&Ebvg$8ndauO@qRhC{DRr?lO15JMMITo{+_cuqWIZYBytbJpm)%{7dM*dfa3da~HQ9w4eJ+`uY4bDKA$za**B+NS2 z=)}Wjw__w)K zy`+`ewwn59KA2@*i}p!u=3AkKy8!%N9R6~_{;X9I;<@xn=V&=YN7!53+cjUPNp*@u zo^k}mU8G6RK+^{#z&j4>mN2HOw!%}?i`iV<{t%t?F@CU(jG*BgmzM+Ws?To%Fg7VM zF)>Hh+4RU{{+pE)(0KAjsZK*tae_}(v&1z}!1M5#ZT@m5+SE+FIPCOjcglyr9qC@9?> zO6SnsA|0dD07EIw5E4Vjch5P;bJX`d&-=aqZ5)0w``&A>b**b%Yc2FE-2C$#1_W+w z>Vs>Uv8HOIRifyz%$jx5YFK1EpD<(DkB5s?hU(PlYhr#K4DuU9&ol&uxa|4*&dI38 zS4S<*tL(5cDS?@Wy!ozF{^{cGp{@o4<4{{i8z2|x&L`C zRI366+W<+#H-9Tnt=_4@1X>~6@n~gSKD1VTO#Dqq<8GmwOBHiVT>hGE7pmc;k1r0=#+cg^SMU9t(d3lVQgEiN4#cLT}G+L z0W(F?d|;YdH^!yu5#b6LL=UW&h(p*;RG8sf#@Zq4tv2KI28)YPYG#H;x7C?E71b}- zqMAnMa`!4s2bXVTgi^=f+gJ1C?%Cs8;`{Ua_%a?~0eWhZH-$IhCtdSn}aYs}tIgA|v4c1M2fw`_trvvq6#-~@}a?**b z&bI<|@rD-smf!xBc)X*YU0Bb8B9-6JeCq6ke|1%nw4Xv3DJ$2oI+mRM~S_gvUz zF&Shu^cx!rG@rxP9gU%}{hHaDI*apkN=OkSE@DBa;AlqOzV4BFT@rY0t(SinzY29H zGryat)w4{(m|FQeG2;qGMrs=U)u&A&n*|rzathS!O{u}I(}%ulLCb|3y{d)LsZ+Y) zGFnxuo*c4sVpti(G>>aJLg%Sdv{=fDeMZLPkvY@``dMZxLjI+5_iy|m zL{4>;a)XAGPWUzVgPUP!46vH2+em{q*L&uSdOyu2+_K7@thMV|TM_IrG3ZzgC@|41 zHRAw@=Zi0YX4F2Ecr}iQs!Db{59zO?>+r$31+}8*-H$pVKaJ$8#s(9xzCB|VYd&N3 zTwHscLeI{wOy+$&KoZyauHP}=C=E&?_@H1E5)&p!0%6OCow z0;5`@dr~&ggk~X}^FrMD+*nKJtjh<-y+LB5(56l7=;Ee?!sgkX5m*%R1AR~ygT~}7 z#95skzr?u7w;HJER9s0($+IE(&C0jEuHvgt(a|{3?$C!5^!WS9{BB-93Ijfd4{kbQ z#u~CpWcvWlRKE9uY|>ejl#+L?iCp7wid0IJFinhpzIR&nF2*E8)&xiv?al=VOtq2e zWPh@p@93Tz$HN;OleFtR+P~)c`S~q`rPMpX+XBA!B6-$cD!G3BCd#mEHB>h;c=~2Q zvG5sgcPvN2hU4y-ZPIipoSjXYnXQaUtXkPcyLbo+RZA3vJw2PO(pcXN%`F8gs;;{+l&Q_g!IGNI5 zotEQOGN|%qmDRD%X0_?~6AY_5o|gs`-xYzmHn_s~%4~;>8)rUP5}mH~guQNPh9nDe z@6zcO#w!;nYM3b(5Uwa7RtUvf4A15t$}Ij@>iLrtCKn$!=SeCEh~t5KZoKkikLE0sMecJXQtL&&Ff&s+vimk+gQmK zmjb~Z6@~Ew;+VHm7m|cu(fjF7H@L20k9*I)w}3abL6|vtISSNZ0ePjIRugy&H@6&9 zRw>Q6!H{RdVrU$-3}Ha4CoX?_qPE8XQ~pl8o?=ba<3=yf-AC?w8$-|{E%vyNZ!kMv5|@`V?8DZQl%dlC zy5GL8;4Td<^&}`s#xO!U6%x2p(9iQ(UMu{tsb9qff4;K+$Y2D=F>{U3b?C4{vM_e$ z2i7HFhA?p^C_m_}WA2wif3DqZJCxPr@YldHpHFwXqIlzWS!3B%jpmp1mIG=(Rbr-U z*1CmMtnd0-d1niI(rG;4tC3X6wTJ?{UWY83?+M2^hgim_Xr6j|KYRHW((HlE?@Op| z(OgtRuc$Pek*ID*iudOfNP$#s_aUgt10Et)Gl5#=73@S*s?aFaz&(XQ6%q@ZUS&8> z<~Nbq_uq2w4^$~Yo{<=E+pr;wl}Sfiu{mGxa$$(nD&HZ#U3i@5UcefZXw{$VJO3}WJ1+?AvzhZO6 z>rc;D6cnN1I~3t)=))Mx*F$iYbm)qLah&-1`E^zj838EJ>0NL|&Awk~a`QE+cpC?TqxnAYndWU?oQz z&_iY+vXS-j3M+>_=62&<4wkWF+Buk4PfhoT>2?gMx{uXuO+RNQ+-6kJ#4yRX)$?2t zeH3>ktfwv6uY75&ub-HKopN~6VdW4I$Xcg~Rb~t$h|#$8EV4L!wH-iJ9c!q-az^uN8d zfD3F@rZ7pVro0UJ4UF9@O*Skg4 zD@bS1>7A8h?LISyaJ%=!2Rg)lH+>9) zM8wB8DcHCp2oZF>y|ufk*O2QlJ^Ou0(Qw+uB;8j!}X(k9X(|f|I6k6{q!SgT`}}QK)T(KslOUk*vjUF!7-lMCl7aUbP{%I%S{}sG4IgV4DxI2x_&2@2jh_+thP1h1|HpXJkHh=_5A)+!ovq_ zP?3C-&ymhws(EG$dSBL92}RxI@f_qe)P^HNKx!AVw`Rt@K_DnC@r8`f|IHhTCDKO2 z_8yflx|_>i(SKA06E5G^{|_9roNY$lEv;sJ%#E(?F?m5p7N+Iy3 zypI}vPz62iC9;gVSBxF_5y>%y8fA~o17U7RDq6MXt9OPFeesX{asvve=);yf-mXlh z6G1iVH6{5>Le~Zo$?}fkr)M%d6bSh37y58Fhro@2g5;;;nj1f`^}o7cN(|J?JKYNDW#OL5}a zK8oo@G4Zl+(`Vyo<}hoU6||mcIws)%?eeVcHg?G$%7>B(ZVcW&4as6K&;krE3x!x% z#0r~ zx1+Du)H+7R?qC_Zuwy${B(TsE8?h)u7*t={H`UsV-M!|z%ys=GCdOQNTX+{FFs-mqoQN%L|vch%@%FHGBoVK+|Z+qg0%$J6xbq zyUsxawTBCx4ufb@6duWe@b2}FrPr8zxF5;yzOSKk)Wju^sz-aycuf6IweP<{pTGW1 zF%8tcwru27F3h`=dC)3(#b=B6rZ5Eboor#yDb++FN%MX~;aEGhX*nrIty3 z030v2+#|PxoWTrp{HeQyg!JzFWZ@eujp>^(E2$MwJ$tSim@_lDR?u;_ zJJ+h1Z+NY|XQezK0$B+RaT|GHTL)bzP+Rzz6(oB+^k4D#Z(dyQ)r~0Ih5$3V4crdJ z$^6_`5L*MW)t0V!Z15w;Ttmv5*#@EKP9x0%k%g(U@DPcmjO$4Yy$!yL%+Dqbe1+yBh?-sar?ADQH zo#BvP?)hfat6ewG$)xr658Y6deU5du$EKZFepo_WMFzx$yua0h{4l2=Ds8dYfPG^RHhC_XU;s;JJQY&@Ve)VN^i60Q4C# z6=Ed@(t(--?jK=MM&HBb9*|T4*5L49=59KKXx z%X|J}dyOz%HwEP@jeg!Fk&8uejf*CW7eMYCrB5N=y=o-Y?PQw%scolrXK4XMc;*o0 zN;|5!qxQ<7(_@_7o7ZrY0c~wuQo^v~(a{AlyRuz3sE7VOU+B5YFk&XAFG3*%u|jYt z=qxCk_5tVGvs>gVgV{l=HWUBFA^eS`{&a2RZ?1zL7h>yK;Cptj(u+(1MzzzWA|lNj zFnI!7F5DVb&mk7Ns0o_-fw_-VTr)O#%j}SZ^`%4ESU7#j+jHzBjN<_89PSltDdsCn zkVNl6$L$r1WIah36R63BvSm{Z8Sk7Wc?j6mkS?v&ULVXkcgG_nG~==|n^e#cih~?z zOgL`P6WA|~gn{}{Fa9m+o;N{T)i-uhJ&(1&DeY%~xgX5P5c3?P4#zn6{IUUULRhIq zm|ChOk5g$;pq-YHUXg00WVGi4PTfbWQi(n-sKTK_iP5Lh;WH5P7eK|H#~l%o(U}P} z!}Gn~akt3$U#RDI9jq+Z<^BK5{d{bEy69lx?;={j$WMdenW}P4e|X>L{TKTX6oJgc zmbt1__S7~{F)xzcbX?Me>EwBrd>(Rl2s@6Q^yn+b;PHZPl}K+inb+_!y}acVw3o`g z%EGM~q~UJwtnaL4v!WPc=|FrYGiM9432yg|hKlt`D#bKfi4;0c{!6Q+Ti29WFCiuXQ0`5VGiet z#FQong=+c#LEo7t{fD>su!z@&%62z5@iV>vpQp30mOzQoGz0~dDn@ts{YH>7<7^WB>q zkE_^CaY=0mN7@}%r zgc9mW!H9V6*ui;>0nn1(Q{#aeHQ7lPtKe-?$a9FNUu*|p{FYhcmVyf~*h^Atm zm}R{@2uC**r-FOU_?3D z$i=6=b+{-)<$2_Q9p>JktwC|g5ZB!F+uM{xPA|?u#gBjsjg88YML;eI++!3ECFSsK z{aF4zuh3IhSGNq5Y^S_{2<5FvcH-%#cf2w8Q)dOwX-_$z-(aAB#=(gqNg~SBd5D%k zcE@Wj8SUn{$?Jsp07W_=%@pewhZNJ*6}lt%>kkNon*}<|AJfvRGwU>2G>GkYzo0m9 z>KxE1O@)85HK1q|GhiJvGBDlfRfF71P_Q2-SzP&gAgBlQLN+xX`?D7}dwN;+q5-z0 zc+cABB6rHvCKehCXv&`OuW1rsC1R!soYQIP`F~C5emyqDuvc?$GluOw-#JkU`?TWW z5q{e~R5q5x!NHkoR(^+veW^h?1C;k%T>SU#*!(HGeKNj> zTuLK5ei%Ni?$aJ|#S+{p56fs{q4J{(1{S<$p1bkuR?+Y`n77}S@jn8})CtDb2>C2P z(FJEMFm#x?;Dnvy&0fL45GTw)jcYhPAt>;g_7&a!W?tMosttFKzb!8f-uq&JzRV*W>9Py!N0KT;;obm3_9L z$f85~2#}`xjXh(4H%`-eaX6{^gIVtX?l3An+XsJCeYZa9taOeylW~&%DKa7HqkNL;^UQHWUEWt5A13 ztL3c{5p|v9ry-!r;Cn0ff52(BD6qU0dw6`<-Qqm`B_o$H3Q5Gp;Y-ZIOES_&pU0!j z<$F(Myvj46lyUoRBgs~0u!jAgBRAd$wT9H%EmrtGZa#7=8%rH>Lbb)fH?r&2KZk$6 z0rLEKOy&?7h2F%?@p@R6h>F-?&1Kv=he*neU4S82&BkcH&CT6fN^mfn86eCMg=24b zLIjIW-xBGjDwxFYZU;_!fhz2w!#pj2G^Vjk5~s{3{c%*o;s0N-_fdX;%2X!1#IO)j za8)McGmxspzA#D)=ib5Z0$|c%u?r=p{Ma5;<}z+arvULisionoku~ySFITFvm{Ev5 zZ|Lb^&+{ed3?^cs5Ilbpc02&Lu5VB->FI-^IJe}UKCbU=Ve71Vsm(SD{x^v37x6ea z)hIjjg;O5h?0K(~G|CL6puU)gi_vItxr_AZ_}M43fMd}hzQq!O5A=S1zPHSlpUu&? zF*O&)pqRg;B(2Q7F=e1HRRS;~6Q|LBAAVok5&%U7*`T+nz4lK+-dG~dA`H?qykWPKOpT8_@OZlr$wWmI|0aG z7xa=dDhwptqft1A*zVSAyhu*6|4;AiUoXT>1@b+_f*3Jf!bT^1?{f=g5%d6=d%T*U zEJ2ac5jrH&FnlbNBZ7_*fKi&a79B+s9ETDNG^Nz-M*|(JV&1o?GOM=Y(XEt;>KIUf zS3fpu(-?hLuGHydX#`aJJnjpih$PCN>e7&$%)JwqD;=M&oTp9K?&(4hg`?%}4 zR0zd~bDwPWYKX(l2$P^F%GFBjm>A9&`vrR~Q=}X3Yi~QRX=vOk5Ks1wDWtu_BzAHR zJHNNK2<3=yU>kaeNw2z4{>T8?Hay-*LTaLe(B z6A((jN-XHANI#NWbk1J_q__sB^``04qwP_-ED?F$_;v<+53w4gW6fz6>Xq85rZ-715R^7!`k&Z*zCfo~ zQ!7r^n>M?jJkZzvC_m`qgKp|?o{6{uAU+#i&M*xFvsl)DVC1q z$~(4r@)E!pyU0cg+%=#mp8v)=|l9ujO6RJ?2vNx!3;EuHWb{g!~F(Oh}?Ab!H~lqkG<61W5+kwE}{IdZ+iZ7(A8C$zp_A znSs(hNUF|Z1?ZW8c1&n*T;35Pe}}I8+|cfNsPqdw*&nz) zPrIe};Iy;t!1pb^VS(%dS5oi)lJ&Fzv2A4B#UE}Gg;UgLTUwh9x5^d(0<{8ck018U zLdCpv)N=>V$=rE?*J&fth`}qi8Jpy8Oac#B*t9y5Mx#ekL;kKm$?3AUaW?@BnCcf|cp4sQK;`-k!NN!jKfD9J$_D z%VsICB{0*fDA5j(4Pfg{$m`esU0FeKj{A8-*-{~9Dhtz%?uyN_B;ZBJ;0Rt7wEp^F zyum05Qg5)v1>~9)7SoI!z0xxeA>N~tuG_sGGZk%2ZACfy3Yj+g2#*2I7k1uOQ%y{O zw#CK4kuyEhHn8OO8sx$wzD-FGVr~v32SCmd3lzxRry?!x#c|wma_+38^B=C`P?&F}*9CV@@t@Hb-e85xlvr@z~GCV?86IpP7k z%2=qI)0E8TsOjdg{y-|0Ij&c&SaaPh!>&EY5H++@X+PC&cJ_WfXC<4}?z5G_(nb|Q z=d&j(Bga^ITJ_nuug8UsuvS^Bl{!(qC#o!3^tHjSgw=Y;>d&H&LXyPBIm{RP$~=dP zBkzm273f)PKxf3mB(n%Bk@vueMwDb!b1s3%Z`!l71VZJQYHFc6&R?uotKAdFU_O!} zU@z9AQfRg=K6#ICR>$=?WLnknsWaP!!9o_0rsCckmlh!7n&#=4%mpLZq?5Lp5(H&# zrt09?Ae*7gSg~(YoK9;yH!MPkI4a;K|0F-;Mpu7~gXrFNPZ4eXA@BLqafcUPo{So? zi2r2>z$XnMBk#3SCqV{vMRf9f@|N}H(+5g4a(H*5O=5w5(saBj185sr1+74+s zFc7;jG_^6=$bgl|K9oS%KgT!8Pf6aQx0%lvp3j&fD9&lE&LBf1Sg>DhIdgx3K@HX# z3Gm0rQW_gYL-FeO?(fj~K$-BYYPkapDOCB&k4i=8+Y<_T`=!_!!?j#oH)&*sRG2Q% zL)(uwxoW#nFl6_{-z$A;0ZpQ*ZmNn%!>+7D4M&tF-meWN+SXGA?g{kUz>c4hQz zwGt7sP}f$T)*71$dk7af;~MYvM8>3x#saUwil7)JlfYOYQtlEU3- zYO`MAR;Fn|6_}N(q97bk;qO%l%^N62n;VX&zq!>XXhIbvb0J5d!O7b>?vGc*7Oq7j1V4^~@ zK9;X|a^P1ox+I0_7>)p?%KX?PI^BxgsZv~Lpsu)~lZD0tD^!1hgr>2iotRy|E-;hb z=tyP}77})x!PuPgSeK8#?fkIXqLq(M=R>+<;wH7H5hDv}>S3AIlI-@wwGX?V*6%^E ztw!||_c$fo_jF6SQ(;ig>7>E8)Ss*$;@qdMdV0P#buC%Ok*H;>bFF~jxJf(~^Ihhf zs}WC=C?`}VD3P&FF?(;SRkHBzKiQg)q-7dqq~g`+Yzi3<*yl4zo}1>~pRQ%I@0?6H zJQYl{g&uA$xkGfV`BR(gGaA<0wV5|+5!eKKAMN+{ZTBiRGl3o`esdmi?bbp*125c? zS)}$~c0~M~V3EVn4CDJa2rm8fk5{!X_A_&PeWSGZGZ`tM@C&AhEP5_s4%64yH~yZy zciM54Z+P%95ZlfZN~(%~ywhM0jac&M)1MAwLmS(5c?km>)%W48krSwLgY)zRbS?X$ z@BWN^^$;oHaIv)s9-qr{IKpA^v{&q=&eNwgO7O$}#6VJ(A|nuvWyf(+c#d465?nuS zBt%BW@PEnwyp+siS?7A(6C|?!T%w>+q`oTs_)FP~1^R-C^(D|WxK^9$?e><0(bSQd zgovTdU%+~5BJIpgkWd}Wid~&|dtGCEGMqjWv7u&!{weWJ2g^Eh{cs(-pHfj$;2rvS z@mwu&b1ft&B4ukBVE&i|z|kz|*4%zIez$VjdG6~m#$!*e^o;c2=c9$2p~X9&fAnJg zbZ)=k7(Mi^hbslQPk;KH77Z;g&$Mj#D)sR8=T{evzo+L|(&S`z9bpmmEeeQTNHHf* z=75;T4Qzib84`b?g&Z|W8pYR)+cN=+CtY=#Jh=1J?=!GvOuf{89bkkml6cWc?E41; z)2aL{_0AW(qlijKmbf%nD67o=zT|z+^yzW%Tvm0$klymtZ|)Y z0(Tgh94mtVG_u4bj2~tcr@dCC^=5maeB^lU^yQu$tS`aM!ZjKh6xWC{7VXs!2K7gzg}QkNX@g|mD=t!m|{GKG1H`0ku} z6KS$rTV0-g!`)w$K*93Tw#oH!<(19a*qXsC`x_1L8vP7PYSQYkAg2_H=KWA;gT0z> z!$A*%G-tR)%(^{MDr^s;Oy~YRH?+U2uZy!i!9@_XIQJMAT?_(Sp4r3NohFA9y+_U2COi zXBUb%9^?`fw(N{*Fwt|UZXL`ru)mRMu76p(qod<77Hls0db-EM6H71>*FQpkdlz?l zlqVq}L9t#{1~G~-(KM?|wt0MIvedpK&v{Wj2Zny?H8?b+6X)Pw+!;9Ix_N$MAnTdDokt=ODaQ z*4Csse5*lU?4&l6GTkcktxN`+)STB>D~pZEJ=XiH`?uC7bmjuvEBKNO4e}_b)%xf&(FrFSiL6| z!FcJzmHk5_QtJPhOwp=eTpDITufJRVORh(7b9oAJ#r{tJ%dsYVHI2O`O!pBH(EL{d zn_>5*Jb#3+s;SCRno%h@FFQ6w1!x)Bj4o-mk6wT@=k4MX~o8 zQteBNC`nXA#C^g-7x$Sa<4x-vFB*|lci}yvRMqj65^;ZQcNIu;Z7~>vR^)Z0!NaKv zS+@<*;IQ3R2K`LVpLm#0m%n6e5ATQ=brg<=imV}oTm?flSep~r$GsL~3RHud7=GOx z`S*+Xx4DQ41EM9-sGO;}_u0e3G(i$$SGardf(%%%4s6(#QlxDm~bhe0)?NsEwLX=3N?Nu7u z?UYw#&Bn&IZZ3yUNN&1*9EqLslugd;aFf?M(AcspZ18soH*tDZCuYs|Tt5 zN}V^fOnkVC*iz-%8M4)jz{MSW@8wy3mbc_DIiAna|ES>X2wsS=S7Jdqf7hY}CPdnh zG>^jyHC8aRqn{<*`7CK+@o~=hct4Btj8{^Ekz$fASDA!r0lejERfDKm%G6T<;={Zo zTn!ahPeD=|zLD@KZ)5+R<2>D>!~|QV071@q)4Y-Qr4?+xwn*`2F77*WVyUb4iD5sw zHvjPzzg}&lXj$Fidp~=QSJx+9rYc#z_ipe$W7#^eMHSfrZi%br2wi~~3$|9m9OB;C zFLhB_GP5GibjwFK+`Y=PS)CUhR$w{RQ+h1ElIRl3%F!B2ZpoFZnwF)Hz8I6i^wQ-* zLc+qFEm=cxH;p!Q*d%y1v^E`CQh0U0vS%yjDYEV+SyI%hg%yim&<9%7+1+K2$gL1b9H~`(zSP2uI8T| z7WME*?mMvxT)tQE(k3U?B<&>ZWNSyRL*W|-6(gUyWkHzN;=<|c*M=l&kR5b%lk;ZJ zJ3Vn+aaZ|~g`tQQ$M1Pt5fQk?QKY;AUb}I2uJGPIcTbi?9mSbb8y3L%|TPMj$rn##pMZ=Litt$ zJ#Q`#u2XM2_|$$+ObSoW7*voWtYg%mwQ_m7Kp8TB+hxhhlV9<8xilj(!SxAfrHKLU z=yizLBH6I9QHy{_UlclO2FE9&qLhLuYJsqW{c~C2qvAWe2}SnUcg&Iv4G)G*2KhUl z*5lASa>?j7k(mpQ?n{Ies1?ws`Z5=tc|5SmzU*rlz)JeX zX*OS1AHVFGP}30c=%Ku%x_bO@p#p^({EKwxQ4~DAHGVqKShG-}v96j~pgN($)dBnU zepJ$C6qNQ4tt{VF5AGud9Hu6fnTg_JYm$}!I1ftx!R4~Fe$@x0Ndf=Ym9&wlVQvy` za6X2gVw$bxswcq|5 zlc(g59x0G|9q5mj=(iDQgo*xSQh&VmkB89io45&&{>r~iUaP3htqdkW=0!88srvf) zO*wwR{xiXBzQ$gk{$W_4IuUk=SG5+Wk#@3Li4*eYAHI!$kwM*Vt|NriW>&~`f66(_ z>-4C7Vao;k_o9%r&nukx$qGl_V$6RMS04*Bq#3MBRb2GT-CWhmz-632+g5$p?%&j- zQ{4^t(etE%Mj;k_6DxK&y*28xjB)MvpHCHh6`?J>*=HNykOHoRzyD!y06usR!V?qe zF>pwGww7EJ6|doLtv}jdn_|GPv}7^L9}Wj?LP*P-jeqw8c? z6o~BoIAgeegq01CGwAF_^1DB?v9Spa{bP(vV7-vEbnweq39RJF3e%{=8r9E~o%ZpZ}d066Ho^+@In9WH3|3j ziDhC5FEi>{^iF>u(599l5V5_`BjM)eRz*Xnl`Y-GMr$=)rlMIXYLNNnYeBQps5YRz^$AI3!+C;n&!;X21R6Qy_<7!{jlRjLwZJ|5 zJYWIqzaqTf@cn&oe?H1r7#Bn5_b!NV{Pg1f`4|2KbmUANI)jQsm<|Q^@3-!qeE9HT zkK<3I+pgAvnK*uq_~bjsgVvIG2?yOC`K)t`kTsA=hMcj)yR9tgcJFj=eTF5f`B?YvNrOB#DGw!2lia4R-4GVcy)U!YWK%ccv`zaE z874U2;&W-SPo+RPB8b_7YO2mDVl4h%IWryixJO46ja;I55Esv}1#CTjUp$N?O2ghO zd@~ywo>K2bAf6f*gF>z#JV`<~)RH(MmmCMi!63)ZsK~4rZ?^4L+AYD$fn;@E-7oWK z$3%6^a6?n7_t=)U9EfX*q2KBR_QA7w)r?;FULtg9ubT0L%iJ&t{$3> z-k`Ww>N|8mHzOCtyFoCkY%=A6M7rduRYOq8n?|LgyL`=zfDOm@+MgGaYv(IMwg{FxH>3qfZOo!%Ni1 zk1_VpN3qMDZrvrN*Z-=|Z6)JJD0n_kvEsCjWjuqg=PJ|TwUt2fJx2oz^yp1gn)Mj? zT}dQ(ki>39>%PBMeu>GkQ-Xk-ob_`Mi##_{$<{aI>jr?e2(F16;k`+)Lbw;3-a_^plEP!d?D+~wzY1&)lX zZj^>>x`xzFTYEFI!Ygfazs5a}Z#?>TeNUI2mSdu8dK{Gu(kfn}sN}P_tZEj%9JaIA zYoZs-iEtoEIi4`DOWHq@vPx?w?Lr4GM7{;>vdrCw4~KpZ({E14C0JST(@r8F5?cEIvj4t>9Cyva~!THdp!g* zylxp*GpqF+yo;J|3Lt&t9!89;ReJwHm6}x0%ZxgrSj_VQkC+txT$eQ#qXn$Cz*W#- z(Sm^QyFN%e@?FpCaX-C`>7MIM^el4s90hq?l5mo0N;T9HUd@Xx#j_#OiEP@svI5ec zFYo1;CED8o{7W?9H&v|He>>d2;>Ihz%e!Ms^&9nq@G#QWl*q^z z#UC^X((dtf-IyQhX_dPXQBlEuXum+ub|8l!1QBW=`1_RVC>nql%*9PtKo z3@Od1-MTZL6*nW39jBh*&5#@6;ziUs(3~`vN$l7P!o*Z($PHIM21EuaT@&y9Rx?&# z;qtPlt948R)>bere4Z-cmjM^FWN4tLdieYRKEC(CGLg>iV?0ZdReI+;b0-<+g`u$N zYCo!?J%sySNf_l!g=sk@bt?94vKF0nI|Ni(*T3VlNvFBfTts9JGn}Pq|o)#wyB83)-hJEw0 zX=z+^wDLN1hC3ZEBU1V6q);Ry7VNnU{|h)hK?1>O)@hz_7}tK?mnP?inzhKFb$EFA z5XRE7!Z%I!aIoilI($w-!l`*uJ2Nx0Co@l}|NiRdB6Iw(HkSH>7u?MnO68ty9Ws#- z5vLmLC5mirb+Mq)dS#l4K`YxlsX4XXQFjC7hP*LvvaiU=EdJF>_{0AI{CZhB)ztPk z0Q=W{wuGS(8rC>1u#Pty6s*CU+E+~a1GDhR$l@$3A!<%#<@`;6R%Eqqg&LC~Xg4e_ z+2z{wmE?9R>$xkD?Oe6w7lR+wo-Jz4@15-@u$kJ-?UC?K4G_B08)TYi)RRlE+qYHn zuS4pbkZvZu0cjre*WCBUkWIRV#)gSH9Bsx9%F&(rZl4a(bINSYV!P%#%P~w<3p7>O z9}nu}X=Vl1n>7mr!O?S3*~AI$d!O&2?OWd0i4nEGH++zXU!FWCsu!BL@BT~X^AD;h zM*FJ&6_1#hG12u4vU5rZ%g%LcJSQcQl$BL#agWw2=NhpU`vv=j{1I6}KvdW)-;Yd9 z-Ec^QB?0|zPxLiCUM#Zhwd;eq?! zCvs&l4f@SVNf|}=dfog?QA37GFluZw__Z7yDsGSoXs^PGtzovms}6<8F_Q)Asc$-W zrv9rPKE8woFnJ`ERP20>;?h8h-I|gzkHuuexM@L99COtC{Oxza!8ZBOb(ye&dWm90 zaf}03r?Qs4X^G*f8?q4Y;ayd~rZ`^pl`Mhd7{hh77Qb(<)^QN!%7-^|dQZ67vUI0- z1d8ojx?X9hx6eQo)uF8b7|8RXUyWr<-Hgfk)wm=h0d}BTvD_*A*$@AT3NN5pp$`rY zZacg#hj#}GEu=QOXTg}NdDeG9FfklnE}lPg-*C#`U!bO7Yuj)Fe8GH=EXn#Ynnz^KR<64J|}n~d)t8c!_l#C?ci|-QQvV+8W}x6i`1~7r=nux1|6Pk3akx= zaTUCGXWK>bt0Kuvq@(+dY{25~bZ8!s z1}uWE>-f&5L(8t-@_A>O4wQ3-fYmc~fi^!BA%7jPyfSc9jQQ4~p8x8=pI?3bCV)_| z31dwrnNQTXFVS*>e`_p5OkV#Ih(Y(^Wt%C^N#geKI~{Kfu5?EaD|b@w)M<{;JAKYF z&L`$~(ykIvZErvq?A>_HKWf<|$YnYGK%%>Qd=X?O!R-8-eD%{>P7>?4Z{Mc;V?($1 z=Q+8a2nz8vcfk{)YtxRx_Raf zG5FX&yToEGYNr%0lY>eVPp7Nr`YhCB%TeYCmCH?|Y&lzm=+{#dQUF89%4nN7_JaSi z-k;AqT;{!`bo{cM1S3o1Q5~$)%2D__9f_9a2HE4Tjs4c|&XlaIADfyRXP8*09~*1> zT?}a2POLC@PavSpB>{!Oc~**tig3IzvN&db2wSHLt(xpz7H#saEn6|pPWy$qeSi4H z1cMHlhrV}d#&&phU%!5QZr`q~MStA) zY!Fy=(?t8_AGyXK%G&q2*K8=A72FNh@PCBBU!uJTIprAl^5AG=lsrG2uz1z z#{~MYT!F`t&(XdX_cgcY_EX-QL#s+)MfVOX54EPR$fSwy4JUP);rp}Os}P++(=yL# zdl*TX%`}c;qoztdQ(xC@)0o`cXNbYGLhZcBzBD!^FuhW=eqiefzjzbZlMb*A=&R;L zsRW>h30gC@jCBCG;Jae#|HePja~N7Wzo$XmX&3Sb)_L_@!rP4X=gJUx_(J5@q9-cd zo%ihBCf96W11ZLqL3f!ZD-?f%g+kpo$5O&)hy1peOw!{2n7@7?(*pArIJOiPl&Ls@ z#>leijAWG$c}g@N+U=@w<5jSRK4;ddvIsr3TebNP&-vL{ zxp*XCMGb2FKvU(mtOh*^nbt80zf&Lf8lzfO@Tc~6Zl^7HrExB*PEHJ5_5cAc?tP=+ z7SYZdiLM%q{f`GcmLOANce}~iT-a%8pXICOy&x4%jXU%pP?Cp!>z&v|MS0~{&$}Bu zaj4}IsK4Uo_-!BB>r4|9{B&#JU~X5uvi8PmeDBAH7jB6o@8py218Ru27s<D8Nz z8V_{Ya8PLTF9;2;qF?$9EiFX9yh8e~`@w#gC2cKm@v)Q6(5PR1Ih6#c+eGeGx&DtS zIX{DfmXMaWxDxJZ` z{eS&dS1%WWV1M!0Z0z38_xjIW|9NF&eEG$T7f;KjIV~rm`yx&JlU08H*5ILG3X^Bv z95s~q2bulLmCuD+CBD>`EVL|sd%Z7QY`zw*KWH5-{eRgLfckDe^z!qp(i>y7QmPOz z0rM6fB^8It$0s6Lb_`J#aHih8Qmz1 zL`G6J7K?~8(SEo{OZ-L194%jrvH=UA3~rha0F3CiYBoxeUw8#`0A5V)LfotbzNM~fD+YmJkxb(XU!cJl#}MI(3EnNqCI@{B!Sb^_vNe1yD(Sn&K1w0oq-r}(gr=yk8OCx zqYg2ro^#PEPWQ`rVO^P$IKlB@j@6~7m2F#@nZ&25_xPS&5qK!{v8|0HE`n_FjPjJs zr7Ld$nQgLPu#j565q@1ucXnbPIgO7mE~U4({mmZQb!mUkxqbuabTXy(Q_G-NpH(zz z5r(g5dT4ao23KZt48SLOWc{3qn-A~q99x7`F1kA{OObjDzDz^7X;T0>56vA0>|7QE?mUmiV_<|=#gE8 z&i+{^MHW=1k#ewWdI|FSGOyBJ^ZCU?WDXe>BV(VAGo2bUL%BYflb^z>UpHW|?id## zBk#9gvAi?swBKk7GvO}SH%rc=t?nJI_>ZxXYo$$W_&K=cO*CFH7>w-?7}XR@IPon|qms zJvyPOx1l^L-g#O(u;N0dOyA{27J)l3(};Pe2d)FiwU>swHyky!F4>){H$1yLaQcOg ze9YFe^Hd{hMS#R|)N+hG&SBY*BWb1@5ao&ERQN=)f+y@ytGVCm9jIJ<5>(0ra}1dO z#kc+8|9$Y7XNec^-`}(MiU)j2D5%_0*ldaMK9sFKIqDTL8klr7cItln)+XU_$}orK z3!^6qq(O2NGDB{k?M=g^mApB;u_1QpQ5+C1aG7@WG>;Z;nHFMC)R+bZlkyIjt4glt z5RgpWaZbQMa;p|(wL4W_d(v)`$L7|J1{sq-c^XxQ0D0OaSit@F2>mQ=uyrP4PfY2jg)&+^8Fx zvgipcmbaMGy;{3hy?i7X!>HDsTNoA3{JLni$2;+q9fB2H-aY z;*G59P5={zkl+48ZSVa70cKXglLAjcGoUGPJz6@MdYsl0dw;dJB7h0%v&!4m*||3= zsDLDjA0OZWH{38omXYyxeV;e9M>l(386=IJAe&`^utD<;<03zv_JMj5``s4t=Ct?UR zHNRzI-r;f>9~~WL^7G;-tN+RB=X7=4K{>Qsggjj%=u7OvU`|XLv6=f|;ESvq-T%Jq zG_HkQ`Dl^KhT0e!S&$p(R$q5DBqJhk*wyzQW#gVA14!O1?B;!3sCCC-*R9bic68v( zwo4^ZQC40#-7hft&PmV8Di$GE{Xr4gxh|K)y=F!PZTINr+q5b%S0&-(dl9;72SQ0t zm6@$1+RydwKz*;oQrVonwDT#pkSCwXVhd@wXs7LtB@ApSsVFmnl6O@=L0DLoL+9Un zApfa~0$Ly;Xt&5;=H_VVO-)siUaY7%y@56X98B8!e&|yoOD?xo?$sDUZ+HT@oDf4B5{fW`BxJu>v zsUtO|=olDXh)erd9sTjVI>*~{TdoRUSvunK`;vCUOCqwHw!vKb9o{wtD)o?R^I|)o zouWTON{s(yJGK_90{s{6wTHy*oB&}R)oX2h|yM_y8GvQWdbwGy%C&q zeeSz;dIq)}hEv_9dCT?3HS(!`R+`}n>UtAP|2BpH^`6-JQ{ukV$~6|d36r+@wTA?f z`7$$IK%azI>&R^yc~vu6hBV+GEa(`U>+SU+;&5Ab73|ya<1SOMpNw%X$qpwxem$-< zpP2AFE{snne`*qXOp=(pzZA;Cw(E|Vx0~4dXfAzWJ^3WD6D8*B4-?u3|+x-cikR`?*Nm9wR>VbIk=RyXg*r+|$L7px`+`Oz4|l`F>& zl9J#I#EjZ|-(2PtL}yvG%T#^!PxIHk69FIoqsBw~+QWHNUlyOikZ6&mU+s(;sIvAn zeVlD``QbKiQ1kWIQDInu&&vb+>L51>mS4()fA_8bZ+P^;bh*tjz*FhW{gTM@pj5)H z=?1>6eOdu|D14^+d!~J%+k3U|qTX)4mSUmc>U(G|{@zgT(6_yS*R8QSRGZVL+i$^l zWINqECGO4p^y*qCYkr@V&ngrPz#KP(Y%tIVw0T&pomG~?dqu7Z|i{d1B z-8|^+ZM=!11w%5GtG>x0r-eE9Dd*LbrM*R}+Qiq)oSFms61Vx>=}uFBs6@yQ^uD|5 zC*ko>%$B{JpX~wqveA($gj~pSfO?gHEH}T7G%@ej6$~Ti^RqL3+qfE()O#{|5?*h1 z9;UTg;Lyk=EAGcN?2BU%=VUQbjv6a79x6_Ust=`&0SekK5~>o&fAc;5lY>Qs|vQV zVJ>WCNUJlSBTFdz7P9V2o1cHNEdqz&1q=W@J(6zR9wY8bAH41<-lP3HRWH6R3-9QRASyM$84nT6yj9**s zaW=`oxB0EaJn;hFF?B;&+phGQbIQNzHiHIkI+1@$7XHn*k3OS4_pixKK2`-{spn2E z9sE31aHR;f!_7`^JuZrE*-&Q_mmK76d+q!~+L;CMaw#C9m)t$&2FLs%6Bmq`30Hj$ zgr?s)%?SRGaPPI|-7X-G(zLX+@M8Cs3i8s3;gEIn^=sdLURVY&3(mGfhgK2oaypsP zDck;m>I*kkHoS5~I@R*fUBanXg;fq;dPA)X4+Xha7;YeQyvH#o9y4!X$B2rwhuk+@ zk1a2KDy66>p(BD^00$i{RN?Pv+;rT?Xu9Z5EuZ@MbY`OHsYAqR@$5Uh0bL7wmt;CY z=DGcG*j5hx$-u=?^mUXk$ScXYK(|sGFoUtyHyAtQI|H={3>g}@|Ii?wC_PV!7w|3U zO*{-ZYC__adwy#RSV_OH1K)~wn{ci9&t>pHaxi7aE5m$~w z{~j_hINjgDlYvel6);<(I}>oxWf>n{{tgAS61>%z#w^@u>>%vZ!>X@RD%srt?Kwd& zky{YtbIN+(?~toE*KYfC-)&q5hPh08sp=+H*jyyx?rFAu=*4g*sIObN;Nu?18;2<} zUZB<1a14*D7c_uS> z=6RykC}ZLim+=#=DKSowlg5X_Rf%PwbL(ikpSd9~_+4W#oXw~EfL2pUaqTaGDc?*+xoSM?VS7?Rceg%Y*3U`BYp+9|*baTUl`C zoLiuMP(R{qIhW~Z(kn!ydeX7xF`;-}BM22*HET zo}+a(PIZI)W9>3Op1C0Z@*sq>&ljlbA;ru=fkE-h$j?B8p72Vx znF&W655dE46_DL|hW)gv;hRv|6|#CEw)v{x;2o^Gl894a=1SjtOX3&Q`%l>0ubWnJ z5={&kaT!4<+7~+&6~e3cff(1(mS5n+ZE99gn4Yqm5Z{=Y7-KapY-No-G3OHW_VI85iw*B z((?9RkB$(uCg*K*oAaXj%_(?l9OllN3kV}ebM)sncq?|wLT4shA`HSw=>WOIu}>0Ak9NnzShn++wCsST?vXLD(F55dNW0KDUykh&cJ&i0_BTs+vLLorC z%#TMNWB>#19g}G_CZ6NzXG}lq+RIe$AFu9badti>o@+~|kr6bvAER14*_pDC z&s})#ti6%m-#M>AD$;U(8(N*Kb2|bN6mnmp&X){V}&LQHZQXXupu@>1qph) zUSC`6h)8nG#*@i?`XRXkX$iEI9^Lvm9f3BOvUAl}mhac^Pzgun0UlQ6Z_3eFIDdP0 zz9NN3NNCirrr2Dw^J97>v2x24=+mv1^<3*d2Ydlv7S|KEl+A}cd6^67;reQ-t0|#7I#;^>#br_EeDS9N94k< zUQmpd7PE2z?KP*}fQK?2`E@65%R-)4!lftE)XO5tGmI;skrW}87*5g0P7^ z=01>tiv0bFm`;Can85EXdq2fnI;)PVcei041c0pseut)uy%7PbN3TTrT)MjTttxe( zUKL&oNe*T9h=Js?4{lpdSrztU!xunBe(YJ>fH1phzj*t|bB%-<&i+g@48Hr28+x)j zQ-&shz#?He$~kvVKP8}M8rM1R1n7Eou_Lk}{Seuk`{bE_z-qXPK`yG#VH<-|Lf2i1(OH?7w<|)qgK- z)O`!_`INrR1|a0X+i-U$O-NafP(0?NFhDl4D^r78v94`wV%*E9AYo)fv1Y@H&55%7 zZRahOqDE*jSDia{An8S?h}G1Rk8{BmYn+}_X%vG?x_}`%n#$kY) zO*tqqFj1n-`+ki;G-{;s=-CcHca!$=N(>ANk^*G!wKzV4Bi`nM{{`XQdu{0c`h&s< zW-Am5nx;TndipySp{WYZhbEE(D zD>0=sNs=zT$3|1^|M(dHHa`C2CD3mM#rq$!O#Zjd;6Hua$C1E=80b9}|MOw=k2m=B z^&as6#3aoAdPBPZ<%NnOH%$LWOe6mrR2+B@k)MF+1|iSxhm>DG%D?=K|Medtx3C_) z)DkI?4gJq<_%N>yX^`?ltzZ*%&D58%(^T&|!-@W(WfA$WKqAe5u4)wZ4@mCZ{Za7%s z4zU)0X2bn`a zZRQP`W`BQQxztz;CNzr<`Ie`LZ;IS;SWz6taW*ka&+DmGvyVBu4^I;P-UiTdq7pC_mG4OadY@)J&rd08 z!*eVgk;*9D375yB(L3*baz=W=sb$jVFE7H}o?9M-IhEg#JbqHA`AOZl9N!QL78kYr zN~x)-Rns#lX;}KN{Tvt9OHI z59Ns6B7^2z{?WW4XVn3$E#UExL_2Vrlnm7g)a!w}5+fiT$g2LKk1LYKbN7a(*Y3wI zbptt1bkr6)kZ<^i-2q5mvEMt^nBOa34|i7(vYU-Q%`k(0YJLn1u6|RyU$?aa7>md> z*10z9ZDF-=z2)rw0oE6m3UxlPe64 z{2`}hVM!EwMkZ_h@N)gN{$X{2R=GG!Qw_F+E9wJeK&TcAQURf~90qq@S}1j~Y@C{+ z%kf#iyP<PEslk^gm!A8z7AyYVC=^HgW`!w$d0Gw{YSsG& zsKNIS0T2dW%gNf~%-X~RU)xoAKaumIaw19UOx8StCB z&9{xNz4LX#g!1Ipn(IQ?pCyvNE~^N|Ai6YSx{-gYx1PkU%4SWzTms;tIjs}&^r6Bi zI)NJ#230*fk<23*=!|i_13qYIv3|9PhflE0(WLB>6L{wiVN1+cWg0%&y!Id&45}J1 zSlA!XYjmEwZc$UQzsTW)O)Z5LM4I))MA0vww&mm$TtCyxmThnhTyd0A7`PWCC(XwK zxbw!EtU5+WG|B@!2x{*WM0ClZB9-NVajsT*(8LwTsvZT*u)E|K}a#{Zp{H!Zd?Fd*D_tyQ!&*8y8|LL9BWU|;U3iz4scIC9^_xHULq%nQ21)!rCuwfq&Y@K$}{31ai# z&_2@NlrQ%kLjf+#)tWTy{J+GKVfqU&Em4$djs?vGi1EpN4 zJPry@C38i&q(j?b1Hhc9EG1`v>N=J}4{D?zJ#aa!Cn5U0|K!F-|Nl0M}i>QTc6CH;H_M%Zr<{6KS{K5nyIoo*vv1kv&rt4@UOI)IG>ER2bk`7=(Muu z>N}u!hW^5Nm@-1w!!HTo%KME39Eg}>~EfA-bW?%scV_Ff8G^}?(JS1a+I zDh@TjMef0xHv{HfN9`*92X@D(Bgoz04Pownnm+%dO(( zu6^nOEs?giFs4*-^VDSg9*;xobu$xAM5FZ>6`QR=S%J~N&7GzWcXbe4TMwiiMy4=}j74A!YK9;XmnRjuXJLR-XwrAJ` zh;-zv23PFd7hWWivX6Eer>Zb)Bb}$o|IX$Av6w$4@ylFMaCtQeTf{7j<*6mrPo)5| zLuC#Rr;b-thw!UqHqSYsTrIxWd=m^*aq1C0JuW}oWaV4HiArVWUp9du2l&mzfrO&* ze8reX_ETkQ5YM}q(f~izd?1x7h2Ndhk`3zcyt)NkmwfZLCn%g!3h4&W)Vprcl9Ym0 z4KguhHlrpht;fIs&Aq$zYa2xZ#B zdf%+8Y!*WSARz?{oPUobnb>r6<-VcNo2GWguy*($Dw{DWj{SZ|oYWI=-Uugr3`ECNJaRBYNnt)mRbhz=`Ig<;QJdm`8LBl#Wb)yQh9n>#!?yicF# z)pbn+13HguYbU-O9N|aE#CFGS3*CrpfkB2eZTfyAMb7T8c6yYY%wXX=i3hsX{hdPd z=VizG9S@1mlV^ufw85^Y?3>{!^(#|fS-Swrq9+M4J}GlEYrKtVd%H6VqX`Ga zqn~I^SBJcVWF}|O7b#UPYH|JYCx0L#J;weo(}wRGBi*O}<2m~NTBY=H{o^0EK@SSB+vU?aNf3lIaWk=$6s;5!2j_ zyNsAwzwGVRnML6nnQ^!%RislYu41lebj&Q)3b&@R#v#OtjhS5xhZ+&h`qY5Ax++n8 zF!R$ybka9TYzqA{(_HFjEuvN%8)W83`XHO;rg{FA!9=KG7fE(D@10xjEnvP(zw3f; z^lWmgze%#A-C|1X5cE6kf|0rBXwg{s3X1`l{c@E;0^7bgg&CdILQ!Fq)~hKy@_eUk z-1rS<&4Yc>+c&93rYgf)bDApPlSAgcVnp@1tW1E%vV>EwY5-Tfz5T_s!A><(^!b`p zAKFG?82M$b%Z`Uw6^oa^sRenXgE<}7E#k9ZK70y9sI6qK?mLrRv}3MDh4 zz{7&(F)pMwb2h)_2qg)bNHNL8vEcXdtrT%s&34+9m@1!(p1oMqNod>=K0uA*ioaWt z<&CcxN@e6qF9Q`mt&g~(**dwRxX;!2JR{B}j(l8@p+5X#W3*#GTdfD;wEx47B!AmR zFjeO^BSX{uQ!342?LI)~_()|UkL`n*f~4`Lo#9HD1eyY zbhNG%;T`<>bEGDf2^7-)g;-`RPc3Uc_d4Z}=W~$pi@kwqS2AcJAbuKNZM`p8wU%vk z(=hY-c&Jn!zP#XfLW+fr?OM?7R(R{Pf}oHlpb<+c?8`evo(TKg+p9SDMqMD?2mCXM z&^=E`t38SBtA2EJbR7;nh(g^F+N|2W@ea%GOM)lUekrefdVD^`1q@#OYfbvcX!Jw! zhAL>`z)SDtQ`sDXDP1(}q3cFhGqAp7m7?bzZ8o7F#hHZP$HJK}A)PU;gh#OCM(xlwsmfiC8bxzx7?Z{`S z`H_$2smW!VWE&pG_m%6n&8F%+@84W!0MPtx`b?gdV`sKL?qtv$Hcs4+a265Gkk*iC z3(?T&TV0!O99e-1jwEj$iAOBS_sI6BD-4=)fpyikUxhES6o6+8rRFRE#Gw}fD_}{0rK8kzX~SJ zl5ZEiy}gh79(jywSxBLd5m~lVW#)p-kNy1Lw7Ykz)NUQm+^DcroQpR791r8<3$XZz zIxL|J1-Y(U$a1B&@;;{M)DN_k`s_-;$P4cjI+(a1j!s0+u_~GGo-e~LjdSL54d9R@ zgV1gh3!s{dU3kjePw-M}a;tuZ?jM%$e_WkEtleX}8_$^wvrlW+@kwz{OC2SgiUMfn z3d{TA=|=BDY;Doy&hyvHAu;c};62wd50)jJCzJunK|}(L#`cA@8;RC7-*?s%wWWSX zVkRrOBGG6-t@^l+aYK^>l}gqJ3VyQ}Y2q!_e9Wn-%>K3xvgydIo4=yj%`)XV$tx4P ztTa1?`RoZ`SEG^8Soh{wIwSkA);VSK{)>83ec<%?g3nF6xk z9NIleIUSeYYL%ORA$Ycvgi$n2E3;=SXBOCqA85Z-mXIPYoVw!NMaJkH8xjHks`GrK+ zg~i8FUKbWW0zct=;gi*YT3`mt3)Gj4H+nLFG@8R^Q>aG~_}hELpzylD8B~19z2VZ9 zm-Tj6?Q!sT2h9M`HI!#2!=REK=4#_-KV6}Phc`>kZ12wK|Fj8HW;L!INpJ6ds3jU* zM<;D~e}ztS*ozH2@#1H|!vY;4(BnNC&EZ7p09wwrB9kH6=r~=cV3Q{kzIYyoecXM^ zgNI4H191pyI=Y_DC@T1F^Yt;{xfPNt0?1V^4orcexzWM|tou9~<=JbVw$2l2TAhNi zpmr#8^)63})vQW$@}@IiUV}KxhhWam^2+@+3829*fR7)+&k39y@=1&TtTg{w4gKLO ze`ETeI?{2kefFq=6Y!o!H)kM8s>#XmDdY4Xu@YCqI-71=wGYK4g!l34OT0yw`RHUc zToZmBzFb8xX2FbQ))s`cCoj+aWGE#V#Lt>Q)Aq)Au4q}4kbs1Sl(>mn-2l5+w`7A| ztJ=M4cG^1eZQyrax42_*NSXtkf@9uD5>S^CNjSTAs~af4=vOTHwJ8 ze184as3$>9rGde~mov+KiIU7pfdpD+tOemaI3)By!BBRGnuaFW^+C1X#yin$sXJk4 z4L2r5pfI;vEXy3OfC*P`0=q;aht-nmfLs@D4q!`XK<3ug{)KD}U}Tl4=4+3c)Yk`f z$1+N_VIs`{nd(j=ytsKn@=zDks7}7ZvP*e_5!GZCdPvjV*_xPiGiWkmj0@J4N8j+@6$-C#@1DMw5`0}R*7mH~Nh1V1wmeZx(pK{`HO#!bWkq(%omvk( z!cHT&oJk_x|4y5ggSzvRDEvlXQ&Cb1aPp4<-t;pYz5uwpq`fxkpJYrEX-|@ch)C~{@n&30buO}W z+nH@emQju4s!WY{ znbq2Cps45)tfIWV11w4-?%$DK>DzC})wM64i*?6g#cId49$pZA2*a;2c^%OATUY$c zwf7zCpC1iDiOkAY7u-0+!0hrXo`nrK7w!sq>*WL|Wu83{+lU;Au<>F8VV%p;QS{(@ z%r5|3TA3xUNmqRrOREZ$Ng~zdJ8LYdm^u2nSuu}TI6O;d`Fgs#L)pD&{I+n9L47l4 z0G-ZgjaYw?N9}1w9f#7Sjv_*eXsCB4Nl@`N!ePLpn zz%+F$+JaG2dEt%m<||%?+UrK?!OTqzb%xJ|Qd?M9i51jNC%o39^ixf9&V!N5wnQ9+ zX6S;P4)e36iCaDZYFn?)(y(`QojT_{Ab2ok0i9yER?Nh#%+AhE6!r>pvkxU}Ap?Au z7Z(@PC)6p-f^g|!git_rXQhxUYS|G^TE1H=@=e1ZpjLWrdr2jQI+6P1Naz|2XIJ*d zbIu?dg!_|NtC0vQPr)YrfT!2GrLBlrZO$Fa1wPUtJ(w-OmEzaX zK%x#C?-!+uYAdsOjlIyqJARO9GuHBYztVMU;3>~H8fuQtH2PsL4{|O3Ld@L_F;fl* z<;eMt)GDYAL9Hb`fQ)9;j3`_*H}d;Oho+ir@7!^HHI$76478=Bu>7SA zz6peZ0P8#CZyEPk^0<6X-<`o({TQ~!t-fB{%~TW%>twP%mzwFxTecf`1z-V}f&!@R za^!CXW(DVU$KyHqJFdD_M{`CBg?3JAs#GQ?jmLGQ*?e@H*c+qO~hH*%Nz z7zVP-qcrpNP3>v39U$D^s!yio|7(T!547_p^4z8J7sZWNoo7^>92})lY5#81!n14; zcuYfWh0-Up-dbSuty()+t*k|rY%^KMUcND8u!k$T?WH{rRdVg>&PEvT*bkHQzgUQI zOt6pyGiW>%>nHK7{cg3`l|CI|X1&AKSeCgMJm)eUM6)pIm7>Z;{*L#2S@1-A7&ABmY5nqmbkoF@5&M7qE|(fm>M>soH^C}2f1|DYUZHM z&IP64h#eZ9KY8-Rsha_|u0}DI6D`jt<(D&oI@x`y7OX5t&gUZOR|Sd~eWoGzkqXd~ zzGeQA3XJDu?I_9%IM&wk(VHc_g8%UjKg2*BkaS+SWZ&5Qi_(k zx9$}XuEqBZHk6G41MVYP@oEbaXSh zlo@#}T0=Emd{r>m8#j%@C?%^yYW`AphPRb5Rc5?)Ti=A5=!-6g5m7%}`G1sBX5~@x z+RtiE0mh+or8G2IZ&+S#Ffdt#NJoYj5%AL~5Sy^eM}7!XNe;?wx~wG5Dza-F5ppLj zRVvlSP+Fte#geO2A)W*U(%c!J7@3M=(X-~Je(|Eme#UJ%FTV&3Xn{Mc7kq6HLd#+7 zMucV9WUxTf8tfRcst)MDx@1mad8kPI}@HbwEzw#x@h%c}(Tfaq^F z-{1+5{fy0&L?w_ft;fd3ygm=RL5XZ0hg6W7coxpvAbHl80&pOX0uSwPIm5Q3`*s*f z-Q3;1D_2~C|D_Y| zZ-|9{RsBI|eq;L;!-1Mo0FwU6OVu%2waItmr_>30k<_I_xZ{@~kkZJiFIH1i>claR znv#>BXZ_>YN%6Jqu4kDuKMcxiak+^;moc6bpx4|X#@T#r!ioDtq?XW2oU-;fzF?FQA3JN6fywjy`%G5JrX556 z!qO8NC)@C3*U?LG?8~lq4V%q|s|IGGBiskW6B<$=os>nMj{e!qQZ|znCr{@Y((rmy z`XJh;aynZpk2-N$!TzIMP2*>4P=|)LuNog|)&`)(cW6o7y1HXuAXzd7S1PPVRvJ&{ z%lTId%KO2uOxh=rx%WZ_gir-~3qYrB<#aisdW*Q57=b`|y;J^3=j`l^%qnG$eXduV z^IJjvqk?6}zP>&$o-#nF>Zfi{Zna1?I6wb<&Br~#c6xhm!q|1~eslSE=5O#grnpaj zeg@5uW;gF!-28JGf^#GU6?%;_(baX0zJ3r~cW+}mi<079E8p#3xebpvjh1`6;&?vE#AojTsYV6EkVA4=XfD)ZA8ey6&x?4klRp$Iv3O zcI0j5xSdzb&TU>ttAo=TD3}Nz9}DS?;z3;8OK3PY>>r>m=+e-#H@~(<=jHxpW^J8! zMM6xRFFd1f_x&@jS7l>%Hmyzdy*GI@4QeVf_W2X&)P({@XX$J2A}Xrt9&Vp`EsuS& z&V<1_@};AjQfEd^gYnzFiSU$BYR?X8c%4@q{QMZ`5APi#1Dr;5AOHJ3bBi0T33h)j z*_OhMnV0WPKQx887zA%fE{A*lxT7N`s4AoIC91(TI;?;2wHm_^7?0eJ(EN1P`Lsl} zvQ8g7xJSXA0(o!xMkQ`^JSi)8s=hl`gZbI>P5rh?Qa)9Liw)NPzI>0Py9;NqmUoTK zl$1p6%p45V0SERDfiM*|qP<1lb-1;AjLmrk?zT42)rH%U2YwR!#E3lph>OYU6Wsg_ z^NbyqOjV-y%H^f&LDwzR$x@FKVnAFWmWe2uMTX8)`n5}$u1l};!5VfbcH9hC9m!WI zs@QKxT*!lDSHI#4pEIYfo}R-^4n__wW#y$YP0TZmZ+L0I#61py{T!u?qby%+_hDXB zbWCe2TLm>-HP=xH!8Io5SP~>Yp2u)kPp|RvgzTzLQ5o#+j01!S*XHEE7&-iz@8YjW zaQEz6W~;Z?*;}dLQ1JETN}5E^^tn89&Ll$;TyovsR6f}>>#bA+gK`--qjK%8R9Ns} zTTCUwe7~|L^PX5$)rlkw^08pzLzJGL;PB)uv+J}gYFJhCzz-6J==mD38sDC64yz?n zi?iJ+ct>P06NMM&P$*(Kvl}s?(GSwoS@LY|QOUBNaI?(=XPOu)GusjM_bnJnnYk|2 zKs6U8EUMKyn}X)^zyuwu{bV*zCQm}FvuaB9?4faVxuu?E9^Ht8_VH^A!p;4J!Ayzt zTZAH-P9mCjwln90XqfT$TpQp#skkB(J{Wlw4|^W(lIt36rl&8ZH9c=>@>O(54gJM& zUWoCc2uq+-@fBhLBBz`EtyCREN24tetc%8p0-?3mvzF_cTX1E$bb zGA<2ttGND82EtEd;NG_5cR z4GwlBic3!3<_WVyf3*JTy*9YMzUOMoQdk~FK0P=||EZD@v7_y!ooH%iD(NcsrQS$r zmpF$p%$hPoBI3YPXr4q-MPyPj7;F~?s-320PV}%dGset0-m~g0%ce4 zFFY?r3%fI}eb4wG`Acf}y<0M&g4f|obmrkpSlw!r)M#tXYyOe8X)G}kr5OPGno4C+MkC>usI|GIvW#cF0R?I<(Mjbs{zFtWnHYu4{9#l`arm8%w{%+dTqKqyO;rt+ql|S#oN89e7_@5j z#yg?I_HIJsPP(=(A@D5Zl%8c-$)@v^?s4)6-u8Ha=VGNuS}Ryz;j{lO+-JhR4LP4+ zkknL`IDM~Nn9(-5;jJfEkdo5U!{oPpwB*St{GTCiGfwC?Dks|JfjX>i zt&Z8uM=5amTJwa;u$-s%CJV_;SD00P(H8YheJifrG{i>ql{uvl6cLjW4L|v|BBE~8 z+r53+)Os3zK3|_vG6-+UW2>d{A^MM#@+a}CJB)@N9j!iswx_GdM4q;K3EM2>Bu_4B zA1FkULphWovVG6kM5THbVvBajdU|{XlhVTjx5DH{Rdmun(NK~2esaLG3tkIy_=2k|CQanbdl~1N0$(9>= z1BS!l2LSrq10eNTRaNSB*N4~3si|ZDg8!(eJh3_tEfFx<9)T&uC9qorwHCg-!;Pk- zq~tUPkK_IFEcc_S9tN$SN8bs2Jy(L46#pLS(5wC@-OPuHye4(jw6vOBZ&s)DYL04n zJG>r1k59xufG)54q04{6u-b!tOS>YG`JvHVoB0(fCp#cjdl z6cmU*k9^wZ{Q_AMV)4rw=y~Vu93U>^$WJz5yyN#s<0CEcj10U@P+>ZyDShMp92apD z)+5MKU+BC;@nk%2C=%o$HnjF!`x9o2G9-*>);hEdmM?pQ%NAhCNH>&W&Ay+?0{yfjr>>auX-g(d_|O z)!(L)2)4Jp*(KV4Jy(B0$X-4}zqn57rkHhgQ!ZpmI0z;Ywho9H--du(waO~fMXEHy z;%>WAWwwzJM{50OkFQiTE$n@!#ZWG;+7noy-6hoxiK)q;VYe#c`m}f}p~JBDvl2$y zY5arW(EiBI&(B_o(MijiI*4^qs}yNek43-II|hwyj!jU~Kj-ScCrN4oxEp#)ZHr+Dxb z_xUJb&@j@5Eze2M)wNRKd_BXdgVgq#{h>dnFMq)EOoHMKF~7yx>wJxiZ!!*A$LOsdCxa1J5wbho(3HTc@) zm|KdMkKr&{HoF5^s?rr;VSJr!`dy0)byUy__B*?vwA!_H=M$oHj8P#cO~tqiR5nC8 zxJV>&c;5cnLQCz+*_N4^d3bcxbfSm8^4Qd-pxtN^vcQp5MGpcUY-eAbhD+6 z?t&k*STi`NnJKG5kE*Owm(Qkf$o(fZqkDy~Jb)>HgL~Q5mAki5!(0w$?QkRZ3Yt|E zemu!5pBmXz9?^Tvb9NqIAnFUkF(zC|@CAcf9NGv{6~jjLl46IHyR3f)WSIDiK8;ru z?YjJQ_58+-x%i2^duQ(WITU(*u_jN;I9lg>=~aIP z^x@Wf7-w9|a3N@SD(`t_Wo5Aepi=Ep$cvQ(i_|C(>R3ugC#k~Ps3bfbXXC(_ceSR5 zM`^L^^wdM}z305=npWJ(JmB5Rq~E~9blJL*olbe@3VJJ-L83{We;QP_uX47?xo~2I zW%oo#_e5&=X+-m}w%m~-6xynPdf(bgcl)i=HZ`6v~!2cZW5qVX8) z((vJ)*G{gFez)~PbQhH`^;B0;n|pW%&bVFWh1;7q8FNQEIw^7G_Pf@j9~^$1*A&?^ zR}48*ALa0|H@3 zYAldMIl}G9$~iV+D0D80Sz+PW=+7u^RK^+iqoGo^=t;oXIM@v_&$Zfea{nAA z9}>GO-#gr~o#!=Ur#Za-HnkNTUAETU8x^=8wk?1ZyuLU*NZIv~sIs5iGWJ#Y7 zF`%DfQ-Y(-VTX7xC&PO`H~(jdIo2f!OWHX!ClY% zT0QMv(&3@GG1NQFAU5_ErdPOdJo0F2scco|!PrdZ;<=N^%ptiP3QG<5XcECqw~RTX zp{K>na~qS^Tgh>X;a`9rxOsJ9YYeGgpK*wE#n!`daWk>3kt}>rPRxqS9>x0SFVazF z?9hE1%d$F8s87X-ycW-fz2IHXH7Sg;9gzT^EVU$oQR{Ivw&e^l<|z=kPkGkC7Ui$X z5$jdBDyMnSy*!WS8d1@7pC^d+HZEivWy?Dp`~Kdy+*L*nD=e8jc#4`KnClc>^@&s^ zb+xs1usu>SmTIirOv?~iP!$>yQoyYV16>vs7f-|;s2fQ=0cT>f_@AF+YF&;KwMnt+ zyJTl()?EAc?ui8S`!Ij!@mxY@xNxg((T`%iZtQ}6TY*7A_8w$op7XpGGP=42J(u%4 z@jy1(^YsTx#XQC|n5(ylb#kIQ=>aj&MEOSX zgx+d9aOmTGH*9i+VC%}sh(Zj z;9;sg?@;_qxv#-+Wmfp zog3!YBZ{+4_i%5K?9Au7M|r+P4MKkSf#9>;ctBJYP%Rwhbc0##>)wWJ zH5kaplw=nE{MK9*NXy!Iq+E;I0SsP_eqN`Lp4Q{+JfWnbqG9YljB~AwDOl#|_!bVA zXZkADQw7&jqgRckQPTtykfCihx*&a5S5^W$QL2R6fohK*e-)4bIttm|)W%;~290;3TBivv+uRr_w1(GF zcX*xf)3bC?LyBfHyPuG@yPh7#Vc#XhI%9f02%$v9e%}V%gp2=W34#fIzh){HxohRu zm+zY*s;3jZoyV^KVKC`_?t8P!D)d}0S?QjbiW+JMoI`6_t+{$5;`rXKE-nt9cWJUZ zbAX~35AQo*hmo23-g zwge_Ilb?H}k{GLXJjHGTluPjK}+s+ z6cLnhyv+=*p7+#%FbfX6Yqnc^QQZ7IuQfwSrN>c$-z#s31&T5@k#kx+TeI=+s(%mx zT8Z!j_ps=*;J4T7+v}2gobDObp7`Iv9{9?qMl%q0eOg4VPeGrm?7ITZjIhyXY>S7sBwK&5X)4Emvv7e)w2A+zb9boS5NwXaD^U$Z+2RN z-TaP5O?WCxbIJg8O*uNx`l8jr`Th_5TsSFdzBEK5h983#-=r+dZBn0E=9gG!U$1cVT{ z2WOn$9cS)`yZ#^kUoIcAl9jbMIq&sdTg!NFxSVTEpOm4~P9?QS7uLZ0aEHkA|@ILvK& z4^-E9Og*>1W4L8o-bB{zX?^8AY^0XA?h~H(Vxmq+8%b!V(dM|`-90tYp>2m!J@33} zFI)`q;eLT80nH3|7krI(D|UW~o-;>2+R6JRT<(L*UI0yK!-y0oPrYvZ^&3WvE%0{L zqxRx5@Wfk}u-~cK+WSORdA@IIB(wEZHL?s0lwNwY)rjTQ zYg%GRa@F_$Ou)nGeHnYq!`^c)=f#YVKg*3uJginwNnOjJ`p)08?$y`jAn54<(X>hu zNX1y{lytCLk^lhNNTs!M1J@{{!2c8l2EJt_zqUHGaZqkiTejDyqKHrjcU~{z22YOV zM?;q%FYj9I9X1`iI-CmW0FZuSXNpXyEVuo}xK<+AlN-d=I9>Rd^w*c~_j4f5}4>QvfE#b@{li{UjS=7ktdbsiJPa4d;eQ2WQ=4elEGY?{- zK!DHIHKJp}E$Xq}UyL9P2b1l9J>1+n=FWC1yUKG>T;7L{{&~TKcXEN^LSM}0rUU!R z_d22aC9IC{zJUnJ7G|;I4at=?pqwo%DqpCK;C(omcgV`d(h=O%>sfzRPi34yP{4Z= zO0zp6IGd1U;w$5Syk}r}&`40(^8TomcUAUATNGliS9oesc!YmSaAxZSJ<3|rsIde1!_dCmS!5uhxb@_5E4=3OS1eZ zKU30UYu4N|!e~ZZf6n2h$cR6UT+OtHtwNNWhiK}1SvIAo?_@E1_&(+Ur6(k*n@;>2 z9)jrI^%Ot%J*D&H*4lj7MlXEIdQS528j{}HtXCqL0Lg2@Q&Lj$q?#T*4>xijf%4mq za@nFqqA8p4H1m}QI3dWSq^^9G)OUyStzUaV`e@^3-vL%t&)lF8@;ay^0=fQxq zT;_-AJD%`{mOiP@<0YP=(g(H@hu3WERkwv|0#DYd6!T?P_SzQJ;yU<640caeE(KLew*R1N!fP9 zGo0gZI2Wa}^xV2E)j{Pj9O{bAOLdDE;3wG{)e4oe#1R9Ss_L`o3gZ6sDG|=R8AJ1- z8_7vP0MRh!`dN|2jXg?)o?=9Q@CU-I;?!MGVx|Ui7RFk8+Pm2$!w&n<{ zCk!GgQahlp%RkWL5*t0=YCkpBZ(-$$nbDXI{05ZB6zxkNQsWa{y=sX&-go&D#;#w0 z0h(TMHJJWfB1mtB#GFs0&(8ZBYUB1**FbpeX-+|DuD!y?Bqe%PY<>=0-CMcMS#P&V zp}HEuZ0%8WoCeJkFrl`w-d@sqB7;sacz1X{rjy1hW9=ZpbMEX}VJO;uVvyBkB)rRz zbgls&+69NTYjZ!=1K1A>bXp@&NSK6EpOMQRuOTl%DY4`CmA+}?R_A4$Cr)*#8`M@Y zWg|L1=9xmy0K|Wi(VvwVKZA$2Z-kd3NF#OTls}F7R9ceiT)`tV= z48cMe0v0{iL+v0=^(W{-{Th#h%X>ab@MF5T??Qg6LwqQs&+q*Urtk+Z1^*uOKZ9Ic zt_d|HCFzak;a056S<3w8UJs*)kBsOv%`c(^&3Mw{D{Q&?jyFPaBSG3(eII-d3dAZdB(+*MC^A`1Y`k&$y z7zbM8SJ|Lmz!@1KQvZj4dIx4+xP&0W$XzWck~A~W3Dr4he!*g|Ha_dEND48PiC9e^ zZYuJnC*o#TxLTGk#9LvE!d)=JU1+Odg_(`XYDUk#qRrsl8CZ#y!D}!wFkm;R^_zF= zNlT;e?Adr#Fw}c%^s|a}WqnoW{MI<;Qo#*Rg5M^D45U8VZ9u`}*#*JjW5ILF5h4`zSZ3F2x=ck?-a zV}4(ycxA?nyM%G<|OzP@q4HE2JIdaFKJ87uwq6uGyw9E031ABe4Yij%Ts0xio*tf) z`@#-s509+)1-w8D}a_Dsqt`MXP6IcRJdv zb97X@eytP(=w4a$&v4%G;Jts2%q=1f00%HDvJDvHQI3cECA;zaEREEIcseHT!HgP> zUw1jN3r_Pf0e8GYr*vHLY6Jyz6z2n~q6 zye@i|4F_s|{w7P^e1HW4BoVdpI=qMC{Y32D-rtAYY=mjfzZYmae4do&&M>*k8k$%A z_O!KbqG$m0YRbAi#k_oS6+IVcTV}F&uv?Js7oX<$1y6W>Skq!vy;P@N_pDR?-bpPw zeB31C3}d)Gljl$@jKLIc9L8?8Rs7&bF<0YXuOZ7X;y`c+)q8Fk!(EX5EM2alqrM;P zesMI%JfGlUh-Q-<6NUWu`I8J~cp)Y_iAs8!C6ti@V83oBuu3vZSjEwkaMd+UT@9nm zlAMp`A4D->-<)L#SVyKu#Dzjw8MbO-lCB)JY9)3?MiLizj|vKWd`bmj50Td0jo@ub zm=sxNoq}e*SdCY8EYOuk)ONZ0R^2>YNb?Rc19wp%>2Y<1e9Z#y;+w7cC@+pB0%pMB z^yEnU_PcoP@N(ZQR6Zy`S9U^}jM+^B4#G|r zLYU~%`zkb{WqzO1G2gK3wz`8Zy+B&ZPX?6GF95_Ptubp(*PCeX#zw~Y$f)?B1YMd` zT6WgyXIvBHf-R?7;=i(YPgqJMd(GC11uWoC(oyjNjlx0chBYk@d&}Q44pbH zHGJNjK954)h@{ap^}d%QPkdMej60Py{v*!wxd^e2S3*2LEm^qy%O)9K!QT`tJlO;p(h|AU?UcFO~U(D=9u5C>7BdAej6{eyr)Ysh*?prlnjaIDD z4(ozy9*Ss9uA4vYoFoG!0MRnW00iW?8u19r^ZXI_c6K}mp5n3GD_vkCtDw*obi^*S zKQzE;N~ogGq2i+-F8YW=8`vfG7{3U%xjVs$1zz+8m&uWCPXWBH#I-;w=6KJ36on0W z0_hLB8{IR7brFlUH@}#pgg~&VRFblB+2mcpPyw=3Ne_C3T34Ef$CgC58iyv&-u}ka zFi$K|% z05#+0Y3C{41!TrF%kg0d#se&8nP`z)0C`nw2#-8)*X;3r_kD*ypLuS1&o>3~ADYx< z4O2(w2!KVin0$}$x}!)X>i2st$?xS9lu-9R^3dA|B&D~8=9SK17mK2L&8EgC2e?x` zYOPH!O_ybw`gTjU_^TF&rxk%RQ8Ts)2kt<76&Q53JLj@>iA7X^n@;GgN@oe<< zXbYphr#0`>zLa|=ug?_EJWbzT@Z+v(qWlBpkT!U8JtcS0!n#GR`%e+*pLtxS<9X7Y zrsLF9d$L(P*l)b$7AhX*;lQq#&EO?{;5Yg06i4Lc*G%q9+N(JX>Xz_ZR!;H3tYCKOH**Jg*Q{b%@a90J6E31Q+a5Moa!oOtsi@> zcPI6cy^Cn{t1Di2$Z2Sb2#DKP$Q;`aEhCAnc*GAy;ljh))D*L69^bTZWJd4ct@pswwKRGg^;btkhGr z7zX`Ehemv*AGVvKV+7$6~`g>~iOYMTXo<@~lI3~XDOwK;b ztI@gq&9<_~((8vV&;2X-S5!!Y1jFwAGBE5L_*2KEEL_Cz6Pbot@nY4fjQ@DJp_V<;X_~G+F}w4-#-0Q-2kr`jTI7 zx0*v*pbzhOZhj(QtXRB(PMmGNL!)K0tq5MhxA{Er+04?CZ+|0AdK$(+CD!uXW&!a;=m!VD`|o`}*SVHt78V{g}Gpxn7q823waO&}+&Wmjwv5y5^0dmYcJPJ(pD#A`Zbx$Qh#5L1`w`GL?1AXnu=Y0)*H8fiwrjXj zZ~6)6%QV+?raloNwTA(xgvaq?02DiT>9=p0qr}|0FVoX0W9jT19FSx+Os8X`6QTCp zRB8|iVn|i|LuF?b8D6?H0v5IrT`FIa{TjO(2a7CTtRsZ@_{+>r`80galp7iq*)L}L zofIjt)jXXv6gBu+9eC(W0&woaZeL^DD~N&00|dzx2b77|q6!z$Ch&de+M~aM^gu}> zu_nLlZt9oJho{A|`cu9V?_s_;HtvP-;b{(Rmw`QIf6S(cPZciD;J!Z_$}zIDQxUh@ z9>Ml8KIcKCDpe&MfJSjZ6X{R@TpNhso-b02zF7#YhXDXj0wX(Au?(W4Cwt=cc8epUn^YM%leIMl(W{oHHdgv* zdy~fIV{SfA_s)HZy3yLyF<^r(;9VqV7NEIc!Sf3YOnyHw)+ByPU7CQ{QN$Z@aB0QF z*Kl@hXZ-QFwi(YuPj|8xtiE$`$;s5}S)KT)rXd@?c|i##emnJcbImd$qHruh$cA^L zcavq8;O?qz8HNPHV_f}sIL!ur12_^Ra|AgD4xa;P+^6=NDmH%em_m}gi>D+^zeY`c z5hyjz)55G6fXQ7(?wvs2H93;FMlkH?M|{S7AD=*rqJ0D1lbDevtWU=21IY}EofT^o z&mdAl2^ZEA*OuotC_o3C-=55uplz{c1BD%TGK!-kHjLnMB~y|l>gj~%hT z{#aY@)tz>Wk(kIcxI@#k)(C*)wt5q3=(a?2Tu5tg`8IW?r0}H++Y9~vz zOt64C3D-#l-NCRI=MZ(K8eUh@;c0w>ib4F&IUC~nZ)686V)TD$t9>_Me#oP-sheCT zF*~h&r?{paGi6I$ta`jR$-z?Z1q(?lfFkH4Z-EseDkl4&TqT8ty6>L~+d*13Tx+x~ z{b$(ezLlOw`04Ota9GsCm8mXdI=e*uXP=1zTz8wMd#7Wq1Hv^4-siJwmEkYVWdLXJ#rv&?{3t|mj#d4tm4W{$M0{23@UTUjF(B-575 z8+%fHgAnXfR3?omfI*BLXDj7^F3tyHN(Af?HB3tZJ0Ftx{ilUGyXd%4*R@UbZET7X z5(*WvP|DJOP7Nl}awjJUu-j>gsVu8MHZVgU4){vk}qJpZv&N-x0ER(-z=x=$r{1FV#%h)yv;aDLg6!pw5Gu5n<7Boj2GO zKcg}G&vIC~Y=n6pK9q}oDcoAQ@{OM1MhX0iM@w4cHrE;m`f7K&D#osuA(WKi$n#^^ ziiRZ&-K#$(vzOs`1mgHcez3$3@OZIMCK((A#dB2P_ZnXclvot7wt8 zpU*O|`5bl0XABsQ1~B!zM&8la*VhB%?J~uE0=Ah-aFQnW#ZIv>4n=_Ke49f{OI@$% z(EC^o5Lm3$8u1fPUa{fA!l{5g)_U6!KzTYl4+eY&%dXEGUjsEX9R}bpV*tT057C;a z$8=jlElyJ)fZVd-umVs(lV&iUQ~Scv>Y@_3Z<=~7{!KG=nrh*H(3Vo7jg`yS1&R_Ds5} z+m~7MVs0_~g1cby|tR@iZMR{Pk>5OJJG_((!lQDC#8F`B^`tvS3#jlbKtvCK7Ttrf&_` zpC{swEUT#W4u7M5W?NuJd}Gk8bVNG7XVA5-OGLhDR`aNlagsj6wVpDqv7^DUym4Hw zuB)JE$wq>y{<|;L$MX`J0J^$E57L`7q$aNC->`aFTnJD_{k-c35GxiEjDHD%Q1{cSnuY~QVH6v}XE zX^D8jQV1O-2{0dCu-adM`_WKbTOQ)2fs4TvNn)aUuM{2Kr@?Q$_Ip%RB4=5n2I%#WJ;;7hP7#9B06H~5wj5U7tYVr<-Yi2XTI=6n?!YDMpESqT0=l8iO%zFq{)Fq5nTFpk12We z6?I+SBp79k19`iYq8gCIvEMqx4&5lIXCjyPMa;Ja56n1m%7B4@bEI-MxfbX@>Aj^A-sY)W&F_U9gdO?s35u>gA$xxTp)AC456(1%Nc zM0Hu_w351_Q#jV<*FK8xI`4=aEpI-oEd6d$Sp|D8P`iPMF7?5L$EUNE1*M^m7fo&U z_eos(aAaSHpl0oa^Nme}3r==`w^W_4tgNID1#4*~4Aot`BQF${ljDd7AVZaID;hSAj$=tH zJX~DE8FaL?#~#ufclXna`Yp`Oa}H{%rB~P1UU8@%ySPv^r-9%N-LFJ-068kSa6-k; z8+)b@h{`8nY^Nr<>rfcCTC1I7qzdPr45#EK*&iI7xHmuOXJViI`m{-^O5ku_4aCZ^ zP&lc?{XIEl^=OW~)>Jbl<#tO8R`uvZpFc<6$-ZzsR^oG4D3h<@IZHtpU|!X>?z7f1 z!M88guck149m8$R9NI_(@cjt!9nt{0jJ5Y*(9yAZ-z_afLtz|3dImb2H8nMp zyEEK_MYy1x($ZcBN)F;&4k#Pj0cd$?K|^j(^{(3^EpnHm*Ho6S6Rx{@I|z*lKgoTr%{zaWfSGg zz+pdGZDTwGladNNZ(zxSrV4LV4~dZ=zJ9eXYx5Snc4?ZZFdP9eK}VTjnM99K<>t=L z75g=-I&cOChSfYxh??3MAjMmj!!cgi%!9JpH{Lq;qSTsj@~oN~D6HBfyExRG?jZ_I zA$WdLdIYddhKe+0iQy zO;_Ume3S&}V3~cf`OI4}1BK%8UR+E%@Sc1*xg&A5qQY;8ZFU;zL4RE?dR`P~R;377*5-}=R$#^PU5zD$_jb*#oLC>Xk(b0#FSq|8AL7IOJCOG?3# zmKcCmqtXRPo|%kWLkl#KlD}UqypV_ftmEil35-z8{tq#Qc^DryMaTMpXJXlgRkpp$ z`A#&lv^8$9e}H+3v1+(>1Y&gsetgVut-)iM^irw!w z)WT3Fx|#-e0MQAT%=JvMLp0TEh?Bum-Em^lw+q>pQ$wyc6BmUy-)k=BuLZDlA$j5k za^yeW=eE|bTQdMseduUwRV9B(S(GtXKXUMN>VaCPC1=^F=iK+I3|oqRb3jrHxiST4 zP{-QV>=m)Ls7dTwbbkDJoubwd`&q#Sr{*x)UTA8q6uxy)Kj*0b2Q>HT)de%~RvPu+ zh0>YtdjY3}H2pCAst>mo;&!PdlI}gC=z>~8 zay)>_!UEaZo^QQWu~*R~nL`~oJ11xHgmrlZfP?4y9GZ;8X=)W1y(D#`r(#1?0efUB ziGKw`dWDnyuaNAIFycz(g}_ecmWzh}rr7vK_f0Mox!#Wwq8tU9)eWnFa_JCoF94EpbPTOmz51xOp6<&&2&j}+7pWS2!5sRXSB=yekpWH5O^yfy+U@Mzj>7J$Mh>C5-q8w6t0FWkR9PSN3k+e&`;I57LWiKdtOznScJ8kvpR?~1WsuvTTs z)aOb4ca=9&XA;5*oMf zG-A1&WY*Bvq)z0zVvC@ArQ%T9$+Z$+l>VBmxNI#rrB>O~ z;R!M~nV*I4kxVuTUc$zb3@DUU6w@;Z+l-}jEf}sv!}^}C?c1B=zRwR&nSX2z5MHtw zFU<@NYRHLO|F8pZuK_F@de74E|85PgFp~>i#6tvDEh+t*u>f6pFQ3ogcSAz5JsjadxH+@BY%s-1%IQ>hc^PMT4Aqo)-IJRD40?Sy(qPtz@pZGwjc2 ziXc#d(OVW6N@o5_Nm@Ec>}0!@-|QW}Ez@5>=TCn~y^e>^_8V5TW1I)q;4p|Q_9 z{|LyQOEdHFsRPg|z~ohNsQY}G140_^83q2u`hDk+G#%98Yx}oGVSFRzM;vl&%V`A? zT!DxZBl^#vA(1B{`WRD7RCZw-o034qxpfaZu>z~aS*{zapCWJh12wnaA z5&8Q;{_%wU@fw`nPmwI@6%*E5)b`v z1yarkf&3za^?xg@5=c(L{C^kxdyVy{HTl0K{l&We{P_QJXifrZO7XJ^d+BSlKhzN>`fP|z-cb9Z20@5ik^w8ZRBHi8HLo+le(hM*l3^1fL!+^BZ z@QvrZ=e&=Pp0&>R|I1p;Vt#S&z3;vE9oKzrLRDYN5!@!bje&tdpdc@;hJkTw3IhYP z>=q9C%B7Ly4-AYukF2DmR28J8s8yZp0amu=7#Q-QiOIMc@dJjdtg}H^k#p*|{;EP1gi}R@S%|z#<8H#?_VnFgvE7=IREK1eQw1RLs4t5_MeOPM=rh|!JT*30btgSgb|y~)V>9luLgeN1VJVUqjrSeS zF#B7dwmOeb>-W#cFq)e~0xKkfZR0KtvcCEcrHW+5Ltau?%xD(`?+lIJ1JrI@XHV>R zDrpvZR1k`4ms;g@$q%F~x4khR#*5|n8kKRME+kk=^Mg<5XyUoj55qJ84!~FcfcO=x zjXNASByJ=l$uUVs=m#HIeDR2^CD5ab3`SW#7UzHFl@KrEOe1%g@7eaGvxM{I3U+YR zx;}mX9rBff2Oa)IW=-Q`D`!?vN3KjuB}#F=J6se_axY~y`b)0!FL|=7IjLd=)beI9 z4&V=B{R@V1)rSU2$w>eMCQ7^|k|)C|;dc{y-tM<${21f3)6c5PR>taG!+R^sYwF{X4EAwZ(QHminK(DSuvjX|?R;K2F~?~IYVQ88P63wX}7dFHbYPu^ov zE#YfR+_B+G!5Y8O>6_z+;TPZV1B;I+P@@a$QGQa*M**vF46%F(u^;&N30EWfJeBl3 zsR?I0BlOH);m6R}LE>f20*Yhm90=wp+GH55wUy@}$an!8oj*w^mJUqWTwm)e9=-Gy9|Z*w3N;PbY;GR*bR?*TVo)`*98 z?DYv)7pFs!a&PFO5vQc5=bYiA?#^F=v!9B4y)Cac)n<0P+ZvJidHV*wa5%5A-Lw^6 zbk%#t@kEX(y#ftAoZ)V&!!;b}>{QYZ?p+wtT*@BPrNkJxFgQ8)=uYSW-&;?#Z`@(P$OzBjJWh|SB9oY`#Nj*gA(OUi5s^aEK0EKe(afG_L*Tl31I$y(~tV``yk6048SLyS6Di# z$NJSoELg!gk1KHXy40>PSO2D#ByJPlZg&F|*Dyfx``tUVw_d!k zyoL2z&V@+o%aa<(3?lb0gm^MEu{Y`P6l89Ge5~`4MJ_Bhvfs^&P%ZK@EJJ$aX>#n# zRkrbMZm0$iIYdq?#|Elak16_bDtBY7d{d>K z+&A#92}XQhN(vhwP|!q7TOjFUp)rjur{?=aU;Q@8vP2yK480N*d60$3Kyj~sk) zzHtiRj`otQ*nCHNJTwdeFTwUHeTc3VbMEort=}YhLG&~$MlnU{8C?R=3GquJwl0cE zIS)Cy`>E2Vd9-uscwbz;VSXd~_VSy_TjHAdX{9GLvGUt=&T-^S8DALI;%+Oz<#81( z6buT)#&K&!bV6*UP8b>Euvami@Xj#K?lgyAMu@N!KeKqYK|{jUmzd5DehJLh&!6LM z7Hc*MyWf-YO*XWsKt1WTB2z;GegbX+|G~k5*TKla#Om3B(wfp*biYyDUhK8}o1(PW zz9rlxZ?|===^H}5lFvWL=95B2tU~McXLWUXks`=@NUTgrZ~-o~`H23A%Zs8t9Hl1t z@{{T(C6lBV9WO#Za|YYo#tL%^lMNFKv+d~#GY?~YXwQ6?i8G-h@pEEr!qhVg)s~7Q z{nP^6f}P^wH-@=wT4!xe>{zCo+&+(=^g8v5^%ZHYIK-{koHES>@JLb-~@p~gz-!%_;( z*3uJ&%);H`tlSRCcEhV&9FR#7r-~^^wz(HOGBETxu>qqK!y^?Dq5Uj|GOHre(q;+g zDnR;rOj4s}K$5CW`jlto4ZEVoVz-tP0Frz5O6U%SJ4MF`AhS-$zg9!XutHgrsXUms zq`Z{8gn4Q{9}W_(u&5x(*UE9%-pdt}SyT|0@vrl%L*)cUebNXD#^J>|y|Z>F^UlN_ zFj*s62R|2I7`LvKhW*i;HbkIbV6mz9M<5>LOE(?7;PdJSCg|4zo^F?7s}NFafPE4` z6W|7U!t2hlk-o>Xmm!_9Dx$zq`gYt7zbrUeCQBw#CYpYN>uYUS?ZUyDSr$iI7FW_yBxQ(z(*f8+r8n;q;9Jja56tNDsF)H}@UV6LqB4 zEI-`e(ZPjC@T<^~Fqr^@;I2a(vf$f;<@(;OIPOm~aL>>~rj2N}yKK#Dat0{31_y|P z=+e1Q*#3is1YdQp`J=gMp!ZzMyw0w|ZtHxjsEg<{&s48MZ;B(Y zExR?=1F_|+g}xq(*jMrF>*Py%tMJ|89g-FB{9bHlmVcRltR0{iM#X;!6a0%y6rm5O-N}IsG%0 z>|;4Ixl6uC0oJ#=Gxf!>Q?dB8dijrE*X7@pZVx|+G9>X8@1>J{GV!FGNSL-!=)^a} zey+D^_s76~__rzsOS; z0u_<34&|8@$d@j@gAa`gaf|j8{j=|7y-wwfBTe=c2+v4Na8=7;=_jfmhGucwzbqcp z*M7D$;x@1lC;II6J>;mQ6JVWZwX7@uW%{)AWqcFksAv_-UiaK|bKg1>gm~B{-JZ|? z_|oDGb=Jw!MdI*?hyANTldZ`pO_hxIBiitI5`K25QSDoW#qof`H$%^cxRS06jo(z) zEFlk?)*_kfHCYUx7wTQFc!Q5#yk15of|%VaKWpu4HB>bkwA&rSXn@efx8>jBzKz-l z*nlo=ubj6=X>HV}8mpYOwK}qz469L7IMD=e$P@Y2?RVyRT-E0RQ|oyUd+_jrQ}Y*) z8BB9fbAM`gd~E!K9S(fT{-RCP?gGNKSKBSj<6g0_@5ktFq19~RiDauZ=xG&0uJ3i! zF&e)z2!1UyVEApJt^L($&#ui?&sOsG71>4jsekDM4L2l(U8=T@aO>AZ?yiXv?D}i{!_X1XhDi{QJ{xUA6{>0o=^eMZ{FBf z*VkR@h1ABtQamIQ6v^mUcUgImuv=O?QC1Ag%+1ho1gzSkW^x%!Cc2uxI=4gW()Y5X z#r^Zmb(JoHWAKyN&W%JCw4Ik|T`NP*eR7L(zcHK6`=2zeoCj#61SB5Y5!Wji$iJew@D0=H2C~xQ-JEw0H zpI==FqcTtyi}=go%YmOe6Hv4JG6CF9Okq*%r1l? zh9%zj9gIE42Q51&de)CSBhTo+zhY_4R|v<#NX)|c!h%ixAnWy@3GaL5;Ow{+_j*PN zJG(xF<$yv>L+o1KXT3Yi-TnRKtQhi<7(VwRBkt@yAw8=l3~R@iP;cB>U}Tc^=v}O2 z%WZ^*E%hC+*M!*!=G-?#p%Vo>2YDT542(zgKYwp1sL_4Lz_^iRrJ?Pjt)eVsYH!D8 zVrKu=oXx||0sS-vhKPp{`cFG^7ZYj^J6oW$kcTMEKb{am|NZkaI}P8PPx0^^dD)eTm%`VgI-8#cn%r ze`UhJkibxomelaLu``dI@$k(>*M5k0%x)5pNK)~Im88&3Wz{dcUX!q0ALNq#+wdHD zrg2P~$M4^}C@3j{uMeLHbPvyayYICRVGg10X0N@>NEJNHY;t$cy2!X=1FO8ydUlIC z00Z-v4+)|BDWcvd3iI%wkazx3R*Q`g1v^4=IgA@Oi6nmgxWyjBd1+Qe^LG({llbqi zF&)^qDijv`vfKY8?Qg>W@%1CMgt5xa#|*UpWfKMVH!y9+PxmeM?)^#JAFk2dBGM+l z@nPT>9sIk;zc;(37tob<!>?OQ3Yyb!8(dZE9h3 zUnXxodhzRm`{VHc@yL<}@yF-Y>x=%^iToGsra{)bO>45vC);9yY}tcJOsp!SHa=xY za-`%R1Pb6`?)zcw(D5Xy{I-<4tk`14@3fNU@6WW_XJ4LNxRe@{7aeWQGZSeLLk_ z%IIcUHR{d#Ml!hoJ0604W-ZX&Jeow(I#kRtf?qxzU)L*8xFxfO*e^j}&{;9){Mf8_ zSSN4G6O|$?$7MeJOeLKscGo~iY58;Tj`iu@BD-nd^)uQIDkgvXSxZDca8l9BZ4Urj zUUaht!R_SW+}^t)sX|DSRBrn$+nJU(wRC2&l=Cf$A#Nm!FJ8PWw>EO$ouxPJB`r_m zEp#c3b6f0-%BI$XIH{2FC)Jt{4HiMt3+xd1bV^Aqf#z4VKvDCdgjih**!R)5kN?}n zjuZIPbSd$vt#<`tImu*qFi4nn`0Ve8yvDU<(W`kO=uIUbwKKDp2g)@6{6(SG`j|}5{>M_F zT8V@tTnti{e?!6!-WVIpaLb|&PZ7E=Y2?Qs6aL_&F*^-070II8CVg(`A3xs_#gAUf ziiyvjVs)ToISM_1 zS)6UviWhftno#}SO3UwIGF^GgXc$OZxh0l+oz_kz8+bM-XI!dl?51*4Zt-nLROrN4 zWYbziNgr~jn)9kh;T&43LfYLInI;$_lP~s~m1GI1Xhy}(QViD1I$%Qt;00i7nb&%# zocXtDs@1^jIaXp>e|Exo|0)9D*6FTypt5jjGtlm9+u0$~jS98r%Vqb?!}A)+zZ#3X zmu$rFs(Qv+vqGOf2#2r+>3%I(uC=&h5oDdk5y;tzI?5+7JHN~)EYK^CYTPb?n$FRL z8WK{8u^9RB_TvyY*e>uueHec8TmQkJO0yHaF^&YiY^5HTc*x4X;8xuBInVQ|kSI%aQW}HzxV~>THt3ay?6zttX6bys*>xwO-TU+` zeU)I*x6f{T-Yk6}=4nu760;T?beNa7Oe^tex2&{_(LT)R0I@e=*PC_8piYSW-|hsz zz!EGQ7vf}tIjIHj3zgOeRJI=*L0V&seFw$!kh>Ik0im6w%gMtjg7L_^TL(&PclDOv zC9&?f5NKG<*P7=Ek)@0`zERTYG|8{fYh~jQ=Y<)7lu1jqJA912fznuZBQ{@E-S%c# zFHZN|_}fSLB3`q+t}--W(l0TdPV-b|AYn~5 zoKqhWp!IQAPpzYy7P=s$tgk{{qo)9c{1L*NQiOJND22dfK0CG;AJ0RaqUP8S1S1VW zw0@6SXOZ!pJJZb*W_6@&4K|YrgAbX{EjT0o)U`icBMOmN7f8B?1ZNS2moI~%Z+NMt_hU(7qvoWp+{{HMkl76Fd zt)X|p_~t*{Y1>b%0BH_|VR&JV1`@#|?79Wj$X)BO`#_Zu2q7d$lLoC~=>dVNk|Ec!-v8fjyFp@8hNuwK9N0O9u-m)Yz)(hFoA(_sd#m z80x%6F{8KbJ%TAK2cW3E5Y}(5{`Z*aACK(ge@U$A?QCXY&>Qweo0f7Ii2D<*c-ju{ z&}xPCo2xhDlhtkmE>?SDeBR27%-#xMw#-70nzwPhh?)waVEhLOa@jsYY{_Z7qe-{d z1_wj3eP}X;8r2`+b5D4q9iP-;^YM0SXZ*v&%=JABojO2+Kg>zE$*&t{rrtArbud**F`;VV9FW@&a7|!qtqmrc4gbJ%gWk1cj{rRUQ*bd}-!` zCs+zs8_53VP(r&L!#x~3Z?sdIA8o|~ikr9alUZsExOnYn z>1^SIX`rn2Q6nNZ!+K)9dP@M7O)pB|^m3zA=1liY z%3X~+ZFMMFs}?ZuJRNMynQC(~!}2WcA$?^My;AZ_k&WA?8h!LtBV$y1i=$Llmn%!%JF#mniyreGcO6%kYCe*Aj$QMT;=`Et30Co1>w9E=efNQ6|h2rz`WR(dj_>!A3X{QkEdv$}yX zZnH19wtQy_0~xHd$N3k$MOjVLkKcfBJsB~@7 zRJ$VhprBxVD`!dOQdc(uerqF=l-&W|AHC+PcZZc}Y0F_14Xlt%Veo2ymS|7qROc3} zQO##iv1ROMCPO10W^J=tK`IW?^adV#rw$U0{1q||m*d2C7Y<5_N3lu%vQGn_0djCe=j4yQl#6n&Vi;{08*Fq$FXsGpbW2($9k!BApg9Odu<@^E78+; zm(9k3`s4Ynmba%B#8qOGjr=Fv(hFwv?(T>m;Dd#qhg^%Ygb-53p<_`GCWrYpZNuYq zj$C?P*nF*yy63m8jn!rnqohvF$|N=l;pvlTQhvjQz3Untt2z0!H1X$cc9^khYGl0D z#z>xz#d;efal-DPgo-Hh-_{pKpt|PLDJgebC!wn?Otb7wWn4++o99~huN2BePq^8mxY>sfv9o6aIq{Zj#9dT)lO+*Bw2$^t5{? zy8LUU5@YioNO-kea*Sz##KlQ$w*T219;sI!B1q?0 z1`^KX73W0O$rYdpZJr16RudcbI8*gj^Uu>{N`n4iZWIC&{VQvcBi5)#8qI1wDJLdZ z9|*YCHmqvhuDr-IoR_+8K!J^|F55)?Mc*`q(AM-|9b{ z;lY)6L}x_$_k843iPvOV+~OsH&C&G!!KnDP{QCQ0r!#sIZyk%1-Faqpl~Z{#m)gEN zHUqXTa?kY|BkF-OpBuXuDdKQGS)ODr`en1VDtART(i$zaje}HdnDm=s*s{z>PgkU8 zY&t3$f95N%lCwFiYG+=`qJyOv9ucsg@tL6W#=uUqbGxr5?R++0rS1%{A1jeIB7%!F z*hLVcTDg`ppnKT8$$8S?7=+U}KT`hU%*p9Q$705788hsy-L=LcxY5&p1Z*@mv69%6 z!C0BbujB%{G*M1wGh#bGZN)i844jHbBsCzWX593Rqkmp^Eg|+q8P!UxvIsNoRUn)?ovH3e6qBc;Ls{Qc24t8Pp-FgJj3+2i8j3!N#Oz4|1lr8Ub;!nryx{j}k zC)XKK77Ba$mvEa2KiuMi;dE4kXCQ;A6Z2<@4^5{?_ zmCIE(PYC$gRqHg?=j>qcW32e}5>Y0|hz4G_A&(JNUR;&txqhMtyidRprV(eI%$6@n z4-zi=>3)}TyCIDy(z=-hpc1`ew=ZWxrYl7%2g`lgvK9G~%x{z>5)R9>bKebg%|WM( zsx4#hP@pm?cE9FkCa~#@my-a4bCFa>5HMdqo&NlovkZ7|B!BGOIuCJID~{`!3Ss1T zVc^GeLwPxjvUP}k%j#Wy7<`7TD-S@%LJX?6a}Ff&DLCxBFi9BBJhf;lb4&Bnsj|;z zZa=9yPc*S@4Jp@%L~LBQTyVhj3z)=hLn8E~6pocmnCp;jg8>tshgFd8XGg z3B?{gh3Js>U@bRhc2pTt+F_X{|uNxwh8- z+V5=UW{;(BCfKBVQSD%ucAn>qdw4o{*xy_+IjQ~PWEN?u8Ciu(SVO8d=Y#yLSQli= zJLBM&F4k>kJF;|@32_Z6aOEwLtxHGuB+9NB$97Z9Dkc^Hfcl1N+*c;q`H4rM5u<7L zJ}Xg3N*tp*WxVf3PKH7L2LqS=@xs92aT%2)bvQt2IBJXA zVqkioc&GNZfVWKgxLOW-ytaxT1P%pP1M=bw2E1`=S7v+$>>$cFpfbE+R8`-=KZE9r&evyn|7 ztL-)0c9b+hv8e8PG@ZAIidw)b3^vS>e#Ahhe`slqZCNDOfg9eX=@ogEx=JS+jligCDS}$y;YTzZ}%;9sfg!!^Ae$@&+H? zFw&7PNj^J2rc~8#(lTVl;5t&8SaN)>!h?=kK0P9PzY>OH-v+y;CEv{X#0Xj)j+GiI z(|p5b>nllZEEgmzo5mJdZ+l^pPNKa+C^423Q|@H|Y}Ii>OkhwW-Q<-5FVE~?s;J#z za$W(gM%x+d)=6kUG=*@~%^Ox%hh)47y##2Lj(51E(Liew(d8vik8TMWq*4Df!+|DO7=3f|^!xSJD(p_Y&LNeW6x0 z8L;k7a?%OcAK`fKoj!@Bwad3kJIhqzitd8QpYvyG{ZbuRlD_q1i|AC^Hq`D3e;}2z zc%Sn+Bw5M(C}ytNnF4%VOY_U)|AS~h=m&5?=6t$c8S)2G4G(#iq_~rO#Fm)%Oxi}i zhU~GmM&i)?2(otR0K9bz#B236pw86EdtYzwoy-3UVeLq&?J}L6IZYKXhNxA-l;ll| zm8~1Lgy!5u0{W>mOf6Ebd2UICi*HJ`UY+1hZeG3!j&gmyipl2UrDl$LM@#Bg4=)+p znIQ96#eB>|-AkphGBuOqC(3X6E=|*`I~M22qeA;EIkR%c?NX9g2cq9n0O@-rQ{SRM7s^?wB&X1-4I2R#w; z=tmqVVA<;n8n<|z&%2Bk%t-SbhTz~dQDax;r@rQSCLJ!0A=$dWk2|+{S=x!R#(L(` zWF8I}0L*;H_2seg>R@~HtX#9QaYe2+`T_nhK7XDhH#y&vf!=&cLADrqgf(2NQmnS) zGr+L9*4)J@P9`WSjyVlm&cFUW&cKiM%R}@Oq1@;u{Rk4E&Jy7`r4dhfdnrdFQlotR z9pH`rJ3a(=9VPkLVx*&2nmcly>T!l%U)mA6S0uCP0b3E{Z+18Xb&Y&@H~T%~m!}nZ zC1jOi(ba<*0m~6dEr!(Hg=AKvr>tqb3NDn*ODvV}G8t#E{1+|vimSfQR1xcszWUC( z)svTTD?KgusMX3{Ds3d;6D6>9L47NqeDF5)X6fP+nb z*&a*Mw{Q9j3&rXI^j_m{vd2e@oh59=d!~VhZP?qFe7$?p`+u>-{{+q)((pA{j0|_% zjsa(0--)Wq=?RpfAh&vWk>??a2PWD38kA)~C_j`x$AHHw70{9c#lXEHS1wS?k?>>3 zM^8(xTV-0H49_#O{W#h{s#%#hK#l^aDTfduqE;;tC_Tyh{Y5x{B$UCX5A9>ZaBf>M z=@muzx?V#vPm7Z)WrG-L64#hDr*+7NiP_*UH=X=bm#C7li}jnA#4g$|Z}70?$b)kY zT$Xga zAcVPsx<``o2IBIH&vll))*PWJ?0uZZ%NHY!RnOMm6k?aHYdseANHm%UgFzqa3-{#7 zVS4&Byb_(o&YJe+*``W|S9039NSdbY_ddMdAKUG^q)$53Mf5sT@CkO-5TrTTP1uT_ ztFKgS|I9)Bogd5oQnh+nf)U8em>}E{xkW_+Y&~O`5O#vUOu#XQdyaeeNwsiM;4O4)b5c9;ez#Jr4Q5N}Kb*DVx|Z)+ zuUCM^{$@a#C%bS)qq|ScNLba&62Q0pFV3iC$w{Mq_Q{%rc<(0o zXvnkD)wKO?!>3uh$$9YN^A(26XWW3RW$YG6s_>|rmaE^2tXt>bz%2nNx(=OTxi0{A zPg3wL6Myi_p8Dr(2GU}J!f6SJ#+D+avBsHN${LU zyXC1QDB_7|FM*;bvF%EjIL1@ClO15K?=h~|>R=)>2m9Pd@y+gRNYCV?G6!3bT=2ms zWe(8GO~k=NW+dHw^5@{&*Z_;cjDaW%P6HcrzE4ccgW33xygpIBQOSzOQ(rpffVz5KDrGBmXzD$xh zFme>sVKr_2J*30H+|o22%@XDE`&RJrqVw&Vks*g%?mO)J*v?J32f54+lFx;F50hB= zawI|!uu5X>zFw7d=~k8TJV}0;um_FZ1K8A0xB~G(EV@o~h;VYk(=`3DkWQr{%Xcq$ z9Nuoo;4_D(zKC*>oi? z(#f2=l<(^X^xco`9rx1Ry1q+Gw&rmIz|yL442~ zow9?QZGPV~`*KR_8sA8lcu$78;?gFuvUo>x0z+ zB!U0_Bz4^)qRkQMw*k5K*5cWeRVu!VY`Z#n9!xq`Aq1ovN(F{r(#L5P1mvyG?qN#u zD2*^?`;$)dBVUwV7iSNk6aNkKv(V=Py^F?+4h4-DWtNLtZZ2R!eq2B9X*kGjk7vT8 zcJ0qrVKe8@Z<@EG!bm8)~pljpKEHf#S; z{N#Fg70%$^y2zwjiLs>BOj{~N<241r$=OD>zu7|eA(GDEy34+U*MJ3buzl8w7w#gW zzotEE1J>t(Eq|5?Ukgq)BB)n^3-{N z_E&8un&NuyBW<1_!M{N*j(9}dR3zm1e~q~QRc@q^>0HF*&QlP6hM&W7)aSzdsfvx z@JOx3$CE#86)|2owBs`mwA9R$H!Rnp5|o{V#C8f-uFm?ugw&aj%+UtkC-d3g4Y?w2 z=(LQbFil5MIW=fXSwfC{>z}uG6S$`e@1%x%=F)N6b%pqSK zZ(V=iqHe&Hr5>M-)vE$=K9Vm^!a{VlpDm~R>hw5FiG514D#N73-{}Sett^UqF`5jC zUDBlJRiSt>f_D8Y3tV|a)JahZs5BsyyJ4~mZotVK>NU#0vug*{`Z`$q{tvT zl0Vhk#Zxq!S6;5})m95nlfuxP=b;_U!R`I^FBPCbft&r>#JFVPe=0~8fFy!%ugPHD zq)9~ASO$KgO}Y$YpN-f$3yLkL2(@@tg7GcUIeqa@2p+G4$=YHAUGd;irLA9u#LJQK z+b&_3B(Q6Zl;;s1HEhKky^fOc_mc!TI#w$f}D(B05&oaLBmEXhmLSDk6q1@ z@hTh-nG@L4E&ZDCW@^pjx8IcG0L*yU@7Vj%>~eQL~`Lb8;G@gZU9~jGIp16XYftsA*;&3D_?5#ap?H(4 z!T`K0FW1GSgFo~KdukmvWgV?AXp z+4D3(X9g%+>7KZ%TuW|0x6{q5l@x*r6808A{vm^ z=sCGP8TZMIN&!Rwtzb_QYPp7k_o@NG_z!DmUcX3&Meto;)*0}0_jg`XCdnVaNEW`g z0Mh`? zScwvxDDL`9DYFcz;1ugKJO(UwT=7vejJI6Do!|r1q|#WgX)>=-=6R%1==Fah^wn3t z71)kQOs8 zDS-^?dNoVci(fjuNsaz%2maYghH9WI0+v07tl|8_SObsfC3@42T-#>!{&4q~*8WG2 zfzQw!)zJH4)_)wtUnb>WYS~iyNeKP_Yk^BnC;HC~NYnr1P`;kbzyAw5{g1{R%J5@q z)-}Xm)c>t){U7zYRB#LZMnQGm>)%JebVO{4=JsxZ)pzdw)>eVd4X&vIMEB^(f6Kg; zzK>?D#@(6ty#)CuE#J5~-hhtyw$8uT9sak9j=hPV7`kqk--q(Y@dvuFqPfE@VwXE2 zzYXsX(}?bc1RZ+Q&Q2_gmbT9M~c{%`5e@-XzC z`M+uSFn4gZbV_&=lc$7tf$Wra3MsT0Qw|H*JW4C1rsw`rrP zq4YYnW{LBy?n)Df7u{+mwqZU7|6hBsp}uP=mU059#uIxKDz}LTDi#B zotZlC!xk4?_EawOgWmZrbV4|^&1*81ic{=eDiFR;Q&1skIOzjL`BXCCT zU~S0e1L5ozE}HLihm^}>XjAmL%~XY2^IMrx%?3r|EUm50uCPRA^Mi!agX9@-WIEqW z=~-lIW1UX?A-&c}#{F`gO}-a>XaJr~{AC&ox^fiX9YUzo8$l`q)~WFkEVWQ(PSIlR zGrdM58&bUyLx~YMs@`s1_h21DY?;;pyL0VV;4411{1epEnJmZN7QnZ2 zM)USvb{$qld;KFW@i%Mwv)QwKN1v%RRr^2cF8&xGTy!q@#puX6FpKuw(5ORyrW*Eo z(*p1Mz-y;G#rz7^wm|NZisp%&g1{MqPKuRvHuC7Kc_@`W>_W>VMBOQp!Ik|eyUuG5 zF$St!9qcK1Ae3PP9nL`LKJn|JaiZb^ENW`s(UZvq@EQucN_Yl+rm{ z@ReegCm>JeNQ~2KP9POclrw|G^(@GhYn1~)&2DPwilp@MRUc zFIlqG`6a8>TuJVg$nthpSQR?J4U-Gz`xC}N9T32Xrhn)+Z=JNZ?f+!Ye7DC@Tp#X3 zwKc;j_P)V^B1P9HS+af468+=a zj<=P5p2WeLa9OQm$L(jfZ+n=6`f3{OfgqRh(Tu%bBoL@HbU#rwZ_#7YeJ9SsOzb|KF z?>zaSKbF^gww&Azx~sqNGF8BsR!b#cMeX-4!qNd(*Im% zZ(;MzcY+7cRV6;$Av4CZ^@*3+D}N<^n%8!<>x~)+Gy!L74`VXlB8BF>>&x&zm!k25|Qj<%pG+!qP;}S0}QH7dE7@Y%U*J!}F}v z$$jp5Ma&6ZRq-3TM~XP?iNrM^-;pK7 zR=tiU+pLC_SM879y(50M+3hq$0P~!P+Tbl?CTJ%)AJv)fMAM~0Q<_#SL9Me5){6cs zug64q{I{Do+HHDmeBR$^FJ2vp7j{@A<9Cv#t_JKa_#S*KubR0q-?YXdpnSXcw1wS$ z-c4z#?(L?d^1#Nx7?LYW!U+@Zz7tapYJa-p9mQ4-o30X9Nf2~iAAq>eWzKEy`1p#q z<(P+eZQLLjY&}`m!y00wGfPtPav@YE7je;!+iO4#dS#bs)V!G6^C#0j-3ezO2(M~e zH?lLH_RYGbEYc&(mGu^xEBGJ6X$c8xr74y`N66gwvw*-rt5hyP+!Mhl^IRy)jodZ# zQJMo!`J9L;(reRiA!S1I*^{z;4L*Rz^2M9S$p-7`IcVE_@~XDmBE^;n^nN!eeFV*K zLW4a#uq?5ieO#zaT|}d9ouK|~>#Hw0WR>b|me4N#0av})ch>bCNt`Q;^4$!q(pcj9 z1BuMV!X1t;i}rW30mY?ibuYi*W&m5;FAN#?POqmU6*o^VPd&Am;$${C zosO@nt`>ZavV2ZF)91UzGneC;iMCSC^$KCH`@+3ubME?n+)->Ay${UlXlX%LPh!o` zMQMmzZ_S-YrH+vw7Vv2^>vCa%jjZ*XD3@Kw&>f!Co2IO}h||SAo|F<_Somk0$sgeS z3-l2r8_evP7ty9|*^F0klgELUH;;rmk4L=Yd`Ck81_P64pUk@P(fkiiY6sT$Bhdhn zqn3!Zt12`bg`QL+AMT#bm}fOKP)2-N;99Hu$?ZR6P=SwcQhM#+!FdCUUPd>v7}jbW zNxri5?7Wt9a@{kGV};k?YUaASv?&&baZMHgjm}`ttHQA|#oQONYmK3ADI&@?!AOVQR-_iaNil$-^8-yqr zRFU2KR%^Bu*5a~b%uV-zV^L_)tVQ{Jp~5+CYrIEPAe+lIt?m0k`2wHoQe!$WMs}Ti zgPh;)u2}{&}B9kD^RhgRZ@YT$r32SqwV#DLpS0_7)ldNH6FvBhOG| z<7uEA6~6(L<(BQToAaVIw4(G0no|k5;?&FHxIt}AsvF0JUy11DmDn${0lDX&ys2vx zIsHo9i2noAWjpJ%fHd_IFH81Rh5nsAlg z0Szjpu)%Bl%O-7BGf%~NQs17;JZEZ`U1=schd&aU+dI~>1zR4jk0vARo9ELjPx}(r zH$vqo4~ne7JcQyW1tc*g7o`Se6sXf`^zq0pm*s?`jTZMvsZERKYtf5(Bn@Kp41dRW zz|QvTv|}TAS$K6utLr*)d21sMzW;Qax$nVM^OT>%4 zRHyDk+u|PUgpB$-x|E%abISdN5ULp&*JhGz@7W6qnxj)(NEo;A7!1h0VAHf{+LN1t`bdaUtn{wzW~}MtUXU?05=1F)TbS4O<)XMufRav^qaIUHQ`W*1qE)E@QDN z_e{i5d!1eT8KKyT$CuONu6K-{@4M3CeK4l~LuUSkEoU*HWABsPY8`41cl?sEp=i(V z@k6&pu^-S~eSNJvCd_9HC;=-c>gsjxIzwNKosL9&93L<+mv0`d4=_I*Os<0&PCidGKbiB)gHqoHVVJ$>i;lj+oa+)Ivm zN?zrZfpt#QsXxPY!srgtcQPpkEu_tXdybzbBis}%wu9QnKza3*{QBOJXCFMj^(iZ) zdXnRlKIXE0PqLa{S1(*~deP3*?7VSeZ7m@M9?3LAOxcBE=I9q%p4gwGk8P$t*N5&J zd7kleWUn*(5t!BGM}_rdfmcJ>NwM_)w{@|p?()0~ z*R_Yqo-5}us7Sx-4eTiwOK+3B-LLiK#SZ52&3p@f8>03}3+b|VFQ!`Mwj1<14d=T~ z8pzAs>~!VsWJPTp7QirYh(1c@NCaLkc>2%Ki^?p@89+}#StPE!d)PX5s)hJX6K5fW z*9hz>G!@1#u2X85$B6nn?q$m{!e(=ieS;sknr#aI57`1>JD}g71YH zx-PJgaeHkj4Oq%{u+TS@#AGLi-*D919#*_0(W_pq!h`o8vS@j_98%NE9$#Xe;w}En z_~&T^Cf{Rn4HI*Na8m5w8m>kXlJ95oKe6gEFFZSkKQ$COM#8~E)q5SM@2p*B3eX=N zsK7b%>M=+3;iL?K8}7(0tnFil!%${4&G(MC0fTEhU?>T~3N)(Xna8oxB=d)cnCTu# zCVLwfuDGW}kf3tNo+-I){_B4MWNPMlaC)xq%ejs**Tvl$KYZRJxU^?I*cm1n)Oj2| z*hkgIJXxlRr#x{Fa`2E$AZH?;YvL?dhN|BG$3EkNnXfjgaUfusuxuZY7Kmm7pUctS zm7DGSBo%_4?rfAiEaYK)f=o)eb1{klJ*=j{z}JgoDY|ZDFeUB`oBkji_Z13pd(8D)*Gi-=Mwd*!_W)p~ty` z=W)-*e97hF#U5_s2ILm^lD$^S45!K<`gnmEnslHC7#Lq`9Fii4bEQ`=GCiEHSKm+U zN>kr28Dsb}On_blfvmHU@7&0j1}RSGn9-GF;;VdQZcxbFs&v(P%n)|(rWCxz)jAy{ zO6Glx4g*=z#6wmel=d)QUpm=Krh)lGi(24T!o$e2x4ha%6Rq|+KX@zTU$*uwZ# zE%VN+IzFT=m}h{s&j-yZOAWyJY^4SCPm5r2pFdrcaQ}JMjqt*5s{jORaUH?qk*E4$ zUGyQzPI%h>Ln|&!cfcI%fR9di#|dx@$+Nsc?p07ycq4`P_Xj19{~vpA8CT`@wF@h0 z5Gn%F2ny0lBe6hA8tDe5yK?~xWD6oC-QC?C3#7Y2a?#zjU@aD$oAbW^bKdjpy?=YZ zAI`Vui$8@mm-oEqoMVo0jcZ(E^Sj9hpxC||heYT@$(eJrN`~8~L_qGV5j;$3yN@f! zqk2AoVvmW4(yTk*@^hK)3>ktRH&|w+)hk%u1=;Il<6L7$hmszk_d)=XpC5DvHM@(822&7_#RJrgWgi+|l@ zk0tNr%Q4i$=sNG|Sb^&`;#9t|h&(?pdVg-!C7`RwF>}>l_mCjlrTuhmXV+HRsU`P} zG-Ok6%T{}<%tbv@{LtO7OYXq{9&r?L-jnw4w<$Y9{ok~k{CeN4v9V^RCB{SyN7_&{ z(L4$Aaj_>t@c#;_U0_%*nEE-4jf2y4*j1qi(cQPPnAj>`%<|uyiuK3c0k4vdRE%7+ zI%fneQZ>46Kl@#TMHF4ACYl1-CIpIOMGY471tNGQVfph~v%qEYR}S{JmN1poqRVLr z`-H&rDQsFq+1hb#>eE5qrCV;JH)FN!{@}<4m+e8kR1Hia( zZ*wbIAu&x_#zHTBFDMzh=WE{Wm{kjSo+X}$W$cW29?r-xs7%6&c#w2ga5+ShKSHz4 z+7ixsdLuA}D}Qr+)od|K5d+m`Nq`E^~8b2L!)uYC3mv4o<{MA89#0FX-jr$*q zGYA0cX6uILQ3LEBds=7Lb;iUWxTe{*FBFI_$`dvwMj3%KA3IP4`jKz&@5Wf-sojZ(hq zD6Gx0*;VBjmQCiB2g6fz!oertH(CZs@FiZT$~R!#$4 zs|uq#e?V6-)!DEK=mq+?R7V&-5>M>9m+(%J6 zzqWrOR||VhKqr6Fg+d?qzLGneTP@K6kFzM{8EG;ouQQi|-z3A^^WJ5M@GkegjOY>A{Q8Ym3!FQEL zu~ALV{UWftX;(wNfaDWE*HjAJ@R;0FMYNi2RHbH38^>a(W$Ut;)rx<6M1&)oirh@~ zwdbj@x^g&7Tz}63zOZtM!TO^vf)+eRVttnGogZP^u;V*DC)ZWlqJEAi3*O5&wJJ-O zpSVX0nPvegB+|{*1{~6{l|6%fZL`2R)v6&`UWA6hLZn zy2b=w*~FRUJcL}G6pCcDz5Y+g6h04_L|rD*ksN$@nCY=;_*jtwa2Mk?B4DN%huh(3 zB!(yf5*I^RF={MdG&AJ;Jl(?VeheoB-VFe2f4hwmN`44q*be^CnR$B<{ zYAI8pX!M4LS;1-64$3m-1OH~;N094uwIQdl3r2nP(6JC zZ8A@9VQSRoi%vY}75z+wb0JxEDL|!r{WgVRwOp9|HaG~Z^Xe9SVV+3RE_Vx*U662I zYV%k$_Bqlbjv8R#L$EKajfYaHRQxw>d8leCmyDY26qw5U6_jdUt<+}UG0U*AX6!V> zCh#jx6Q(En=$?K#jd;`RvzM#2qJEoxLrGAB&uNbfBydT;V{w|hBzNJ48Pg-WjAX_S zDs@H;dB-r!8zNqQ;L#$zJ_~r5p;^DBKxTG4y>jKyyv;~kpTBr2TxWQ;fS+mf z+Z6^5DNxRJ`R!8xRP-kdKXY$_d*jwQ&Qw%c(m+NXAt%2_0c0<*(RO?fzof(QE^cv} zdklX+;qUxc>wCTnq1N#^N>z*VZNC&Qn zXRG8#0Q@r2{>|Rjuffz$0(@?pGt%7gN5D5x$K8u;PSFQR!OrL5EjmwZ0InfNN<;)4 zbc>RMY?`}%w$v1Yl$iZYg?2RF-Z*D%y!GYE&+l*eYlw$>5~Ip8nn&NAq4)f@+9KN1 zmeQ?019oFG(`3HXJvcs{p3|Q<60mO5a#LQrDXzPa2cHEBGRT%30p2`YrY{f2K&$-e zJ;)ucQ|7CQv>oVk0Xq=Zgl77ox0w0yrciax1_|wJZNUuw~a6ODCXqq%P zfI)7MKd+nZGZ#{OmAzxM4;#7@0T~&*UW z%0_?^-wa?y4*kh+02e8=e$sm&2nI;?*(bm`yc5c(vskoLGSPbt69$qK^Cs-umofkv zDBc(g$ljDD7tM5JJk$v`xxHRMZ1>qhH}wDvtUF@{?W`@=gWJa57s}_LTFN9=xnOpT z%_YlqU+%6@GJ_7Wq!mBA;e{qhis6gVjY+XI5TsGks z`*ZtT#~qc!GNpy3xMlOkXpnXaSKK9jyColZOX=aQ$AMY>CKSK#R?kcDC!fNh`i!Rt zrw#4@W1||Z1HgmELSfs^;lobl`S>v9Le4yW&=Iv>BUe((EVXXib>w?Q{_JcnJGzL}(t0KXb7mSwKP_DPH`a8zZN9i;m z&T`O&3FT<#+NJ93GMFVBw&jB zt>mB(i3>hhVLHDNXneUFGrqV$+)D=_+yFG(!-qRmiQkow1W7UDCV@;lHdHXv*@*?2 z^t+!A8qQdq2{{~G4emGD-3p?9)9P^t<;V>^o(FSoi9vovV;?q73j`~?e;gx3j)XZ5 ze+;k@++*a-TPx2^iFRG|lw(vcirZ>IbgH9^Lq5pBZFE1-ODUOzAJ|)KRaf8-m<}M? zwe?eXzqWBN2EW0In1zmIOZR5t&$ESrPLpbLZUv5hZYk6`e2N{aL5lE{O4gS6uIBj? zA_z)!CU;NlBI9HHF@Gh)ZWij{CHz?_y&4210!Cjq&${(FeQYkL_2X?|75(FP;sJMZ zI-D;QDy6Q1b|aXxr}IiUroib?3VKToKbI7@wU>u2+56v}Y{%RaigOeW_1?!>NgbRT zRWPNYp-Da1I?qYP)vDe#YXA+rB#y(0BOM@}B{X(8Tv+BVH#`1v40Ua}7<)Wc?3gR8 ziYm(RZPlux7&je!w(r6^_3RLtYO=q(0RMPVT$230&xSxH53U61HU9c_!K)X9QX!=? z9L#s(G<*ElzR)YCCkX4V+eOD(uO;$^G{A+8?QUt)O!u5AJFg<6S3g@mSz}P%Gpifm zLKJTRq6Kw37uDNWA^W?_kj&jjjAd^DNe4S649>y<8M?9#{gTG37$d0MeksJ@_P(tO zmCCm0(MTGpSC3w^ma4V_Rg^+9FKdBqF8-~F0d90yQxYHG>rD1H}uO9jYkjWwA^3eVAom`$v9K!H-?3jiY*Aq;t1^1GdWV+S3X4&Zhh=ZU)y27J$rHq<}fs-ldOhgNRuysOWb6Ow_#*?iLw$J}W|oO{ye`&$@cm`7THac3PpQuvSQ6I0jie(B zAn|DD!2LIT!tw`3Lr%=cE_ZbYUWuPLsQ(bMq@yM(tTZjp`H zrYk=IBA&;WrGmFy#oA-oVsMyaZ0#tZS<>Ip8=2XnN0y|m|GuhmM0*jW2*9-5iXBkz zyhBHhY>PkyG0^cUKDtj_se((hZtTXp%?aY|dI{X-U*aPryH>?3!9!I2*N5@Fn)WKylkWT&FSW~|`l~^2N^7b(c z;-2Hg(MyNb>S+vKNekS_IuW2 zb;#e1hv->Gc3o4mBv3pSkm=h0^_t^m-;HG$ zgBQ?}@Lu=tHXmhgriPO!=l-_21xoa~-^C0^-Z;Mv78XE5H2zA?397T}Os*8g@+P@J zbwPtooR5i7&)PI1L%IlY1(>wfdXN=~Ii**p>yc`7GNDWf43do*K`OscEo(bnh?`uJ zHGl&>+iHqi%jz{bEJ)BDD(%#a*iB+=Cz&eIjx{n>wG6w+*UXhqR?Z%*LjQAATZXnf zRT?Jq1z2`_7S|@C_ik@4H(#Ju-~LCdY%Hg>1wdJ+OBNy+lqF^$OFp<|kG2QaD#3Ij@`WBSPl5E#Hlo{9N*^ol2F!>`w*P4{{ygLV`87()0P}KU!g%3N@BBYJ-v9Cob2VT9CwR+@ z_uo$2;t{|GO=u`0`}6tv(@VYk2=(CI026!)+<#36mAm7YE5|zj>)oLV3>e!>&s_d5 zv-{hB<}(1KS&N+tn}54IIGKO}34%_XC+Sd(w<@`0F+vLyo(KikgD9z#^dHh#j`&U29!oD*Q?Vn7j{;eVXa;Hvh z!cO#;Chaeb???PQQyq{wAoOnwMLL)Pi!xxu{5OXA&u^I$C=8IomyGuk`-}houb%V! zU9n4Cug1UpxG=RKAQB!)8Oo0Q8xQ+W&-A1cxMkl(mjBBO&_~$g3GiA4$&D|b{#!F@ z0<7E@I>UeY@q4~!cT(yeynTDL|Mo%~09LL;w(DPh94K`b0bc8wUDS-^zdE=8-W_*W zYZD)g`RASd*V7vFyDJ)5ep4Ctr#JpLyXDrh8O08DeVPS1oJ>GIR3D(PA*CnslFv`Dz3KTgZ=Iwv*`=?6dxI`K%Iz1yk+xB(QEnNWyY zk)9~{;vmyk|ALl>M?Eq0)J7I3nVEY%%qACKjJlWPrqBiJAgr zAF*->%N>Zn&hwn9hyuM$ojK)olq2O%19JYa=VFh4$i$Y8wETS1@XS40r^EU9eqMuYu#7m0gJXk!827;VUo)4tq3>hkR|lmA) zq-ecK-Wy--%p8y0~AZ~VY#*lh}8Bt z2$f1*YYR(X)W3)o3GK!DP6!RA1oX6>-~L|v4vrbN-bX<4R<#$_=P}XHS+J(;%0@mu z^*KGQJI3n%Wt+nFX8#6-VKHA({eby>l$DL%aW|V`p6DDmU9I5oDtozHI zDW#2Di~7Bc@c4H^>7b zO}9n&TiTV~JW}l5Ek6sy`Ask#>X?j>Au4KcJr;JGWe-KAH}p@RlX2e-PUOmdmnktq z{nRs4tCS5f=0B)Cq3t&vHD8%DV|qU8{9Gl!fJmi1Qp>^n`tqGK@n*qS3*M3K+Vafx zdO+xQYAH_XWaAhb#(NeKkW|EJ;-ZLSW!>#|Q$0|R;!i&FtR8#Eq zo%W)|epTWTK7On+CMM?7+q7&UUpeiXv5-WbZ2(-&KU~vWB2mp(3BSZrJsx~S19QOTCtj#%IbIfiU z;vVzNLPzO`%r`DV5sw{G&OG&4EpA(BXELrx*fjZ*-t6+TeRrx@Z+#8_f7;uh?vYr^ z>Nw*u#&eoKW6`SmK9tN)58<}@EzG1|!Z|uuUigJlAcKlKV3a=ye=PKr$K3k2^G^At z4^D;sUW)8+*JjUV!B8UZ?+=)>ag^VxOEY`|0s;iAOpo6ZBP7+gpV|)S8eU;)ss%QrR;w7twZQLA!dB-^T3csNq(38h~1pw1UV88 zlQeJ!h9Zzn&of)jouT>CK@P~>X9H}E{uTjKj&SD;=b$xwNPYXw2zr&gQR$Lp8;j)> z^U16o9S)d-&(1u4aIR*2gJo`Or`pm15YTXt$(1JT>xU!sfwloe)1U8)izU&s=HH3+ z?9Ar-wO!dkoKx4%;JFs6jN>b}EV;>z5ksZ!m2^(1S?80BiwqB%BVh=I?jb8w>#(g9E^zJ>XIyFVj%U!`Fiv29Ej02 z?a)Dn5I#a^BgR%ja=bhBA|??+1?OPVXo})(jLJ6IjSGrpH78MTxhY7+aVqCz!%k(^ zZ290~K370!`~+r==<-zra=p|;Un^D4kRPHV0QXIn=tTxqX3Rn-MDon{jr$+*^)9qK zIrGnn$>=M8y@=I0y*P=w5AuZCt0kI!?t$IUmX66fSmEaY$}xL$CRuU*dn{nI#NVS_;eGFC{HVK*MhPlM1PKf)AAe!F!%T-Y;-=`RG# z^22jbJxGM!@PTNm3SQRNcmb9Rg~vkelsp+3M!k_xI=Rt}4a^~och}vi zTd9-%y_d^}4o}ZcOu}4o5vPfOGoTElV$BD7p3b&g;=S4eZE0(c{lW1z`1;B`Kh{B^ z&w4OUP|~De>vsuDXJ_YVMRXy~#>UudKfq;5g(H3&2%55(EtFS!wid%$yM>H?+i5jB zJym_)_Qn&Z*#jPp|6LX2{ibBdm#U_4DR7luUMZ-C0ta#Of)#nv-t(!-rqkhs82@{{ zeXBg|M!)|Vo5Qz*>0jb9c_!5sy_9{s4X?D_C`6B;r1qp zE>+I0ZJ=-Dar^CH4^bsfHC^?2h>F@txxSebnQcyo2^k|~&3op6CPggpcEa$@Z;QyqLFvUUR);EwzEQ)3E5fpc4Wim^K}@* zWiS1<{8A2IV0^Z3{cgWOxLTgGSUJZd+7b(Y9DC1VvFah}Vj4qPx7zt4czFqAlO%Q5 zFUKMN(A*}c0&{^lJ4B_X0^pGugI4vkrK5fp@@~C8{+ywM_q;81eke&$vhiXsx=rai zCCvH98}!aWWsG*ClherlDR1MUsEM#JU%$oRIni?c7JTFxm04LJ6us;Ego%X!Mocc2 zYny~A0h@padMA6wqhr0KrO(^#Q_)eI_Df6YRin}pBpk~0+RX;X&)gMG-c{a@ z?e&N7lrg}v{YY7D+NM~PobWeYYGQw;zmy%VcX}$98^1L#g}-xN0tQ4 z=IA*ZDLg7sKD?^7SeK@`m;Fs=vPce`AYhHPPjsK#7VfFfdg>2ELN8YbI2?RN*@RM# zp|=dvL@Y|bsq@5~*RA-j`8E$LUZ38?On-;2s;suM-^k0Duihgadf#50@IY*}$mE-J z)YM+VR6bKh63a_fJ?Z@b^vF8y~OTV_$iBp^abVH8RQdikSXBI=_A0e?aDe6I!qQKzbDC5++fpC@(borg{CxW47 zY z%wf^Al6a1~6cs|r%I{aOi;_fMuUupD(PKjajfaVsr-f22+b{);anB;m4II*=Xt!1> z;pUbtrb;%uGR)Z9W$Xlfd=kb0d(A9Rci1HR_!0VQFbVs}_f&5pW2u}#rB}LgLc-k9 z;vy8-P?CRd}oPJ|(#pciF(#1N`1}*nA0gCk| zkMTxAS*0o9o_@%fmseVn_WC4bemP=W9RTb6K@=VjK6|ZSl^myOFegaEgv*2XY{iPY z!2Ssi$Z6x`{d`>$F~1|nknHJjAK^rWm!vs|<&ci1ixkz*cEh^sso-7$;~G4?ouy#X zB$n^!HoUt}Kpj)26&ftkIQFZ1oH_;lI;+@w=uo)^&}BN}NA}}6S0Vf%$__{V z6}>S!Zml>Wr0xDGyK9$90b7M`Ue|PvA+m=3w{)@NL}4*p6kgl#4BKCh81_0TIS)ph zN@CRMu0~b^tFozn@X@X2kUm8+wfqMNo4?j7EvI<4Z+K+Oel_3!Qtu-h+GnL%UeTyW zOC-qgkH>tc3JsED{PD?v?Aeaq4WhR>KQ+#;mv_Xl3+8Axo}kJe^b}jEE3m?To^t2w zqw`f+mdbYg6|hgghCRp7t9DpA0z5iF-V_RwL}7W-hFp2YhEiO18jV9@>e2OShjNs2 zKNEa%VUv%6a}1psJJ4`2C8y|Mdl}^J^ubw8^=BC?7DFh`GcS_E+oof?0xf&jFQWv* zG}C((N{xDW+g*tar)VjLBxG3^#%Ntcj(;{?v+&vgN+xy^_k2C>ihn?OXg})g^yIRe zUG^tLOq@s5Ua;8Z#{kEiq-cG0wUy9oRrrZ2&DsLxf>Av^%7s-oyW+rVp+!(r0`s8X z7Z=f`DbI_JQM(Moo&0K{lKP&@vWJ=N`erF|jNM{xbhR6ZLUwnGJ*(;Sx(w3X+Kpo_ zMJijiH|NUSgXTN9tqN>)W^>@VsXeMm`F>O-WVJ8-ut=j?ms=BEinaS}fUqd%10?Xwmonm=eX?MAjKs(mBL)bj4XRkYuI?p>u8wCP@$vCuOZ-Us$FR-V7lO zS6r>(puO6nOT0pQc7#a5&3-K;E$H>5wA9^XF?n9hcK$j~jn&TRDwEZ(Mt_ z8l*}(>3SlRN=@PEH(ZZD;n|KGYdeWDvtnUkJ-hwG-(Q+zNYOCAoCR*oVY!~gJZNY^ z22xbHZAh(k%!&O$7;#e#&A(yLoi1@^ii|hr70#5-mS)eC7>HzNU~Kh=bFJjQQ=x{W zwb>lbyOXXNku$eakOfAFcFicC5!mGut?m&gWxobg6Gv;^p1$d7!=ArM;ZMC5-$(-l za9#{F1I=&iQ4$k!@!{evUByLl5n>t!^-J8n$}I;=|;yZvvbIY z@Xm_Ti^VBS)xMBJmX<^B>l=O++DLCa*2mde(p`DwJI*s1S6X&7sjJia7q4#?S1RO` zbBCkiGwPa1V24S^eLAc6Xl?MHQI4(Bizu~2NQ=F?)NgIeT`2rLIeb*MYg*7-Vs=#- zK&WdSiDJ2K)>&^;`S_0jct7I$PGe)YNIHPT>WM95(4G>3m{bdYM$t0}NWgN{vg)Hz z640M?Tg#EVJfGk;i$~0aoOQb6zG!uU`gqAp)8Df!>~<7B^gFJ>Ta(;@SLQU?nhd}OHgpy(f0@OnB8tk&E4lkcrWn(!48i_ zw2sp|=U*1p?~NB}R(3!$YRSoeVI<*ZN=GxEbU!7rpfP+VCOpVD`%;>_`Mb;3j_%G| zS5P&>vVtx4=1W`RT+>+=Y$8G?wP2U;&xpx*Y^r!;`>;B^8lAR33}*_cAi0b4wW9lo z!f3O}ygEdU97Cw=9Of!*p`O3D_g0FWRY?e|2qhkOk$iS@1c<#M9waT!1n_j05Du+8 zCF-Q`^|?dHTmE1w=DD#kenFI0o##5E7msJw%xCi7?ZtrjM#b|;#w&J%ktZvutQ2zu zvEzLae3dhN6Ig^z?T0Yp_0%E#rjO$$LoxW%fO3iNUYBuBo#zwm;Uhm|e0+Q^9ig)6 z#ouK|9=%E{r#GArByo?AFJjg!>N+OK!_#vN8@bt6JFdlLjACuR-0q||kQyFTf4O?J zmd`Jti~@G(c5(3L+6f<`t4+}TWNoU{EJ+tqs0EIVOl2UEw8|hfc?ySyrSictz+7g^W*HInTnp_G@-I?gS62^ zAX(HSOr(cG)}>abk$MleebqnTmP-=(;U`BY8=t`Z(P(tc_-qK9%HEY^qSC2NXQje8 zh7|iA33kE@xVq*yE7TronED~e`?lFA6><{{Iax-YjhgC@Kvzz4(cJ1(h-2BRp2uZv zOhR`!qyU&I2@n~OkC{gTcsb|kVf~p6+{TFfr_r$eHvF6MKjw&c(G*hCv=5Qe7fZ~H zK}0MS+rNQ78T+Y?2jWI^Zeredet#zSI7}zqJe`=?8Ei90MA`hIP(eRafe}-w{exzz zIf&dKs{(Gv(r@b-5a`9GgHl%;sX&Zh2(Qdni@S7B0;h#=&~2?O*5r`~YeL11XbMMU*la!&Ss^`0N*1#Z*$Xb-Dn2eC5nRD8P^zb~|4CqabycMRxTKQG?kCU zX9%MJNe#|cWF+kp8U8<`^w6X>@mWYE!IA~x(7n5i&{er?2i+Igl48IRS+kHC)svhk9K zPGA}Nbjpl5cKz@V-^9$5(kI}j3g&rl{C>@l^8Q}0dsD5lajrD`Jif!vf_2)^bFdoE zh4ne3hOm}{T8J+ALMewnUV$;Nf*sI|u5z!TXmknMqy5Bf%3i*y$IePo|S02&>$F@kriUUI@~V!_`Y<_JbssB0@yYzq@HiW1AHJdH2a)_!uo{6d+ql- zF5@41$zy!xB)L|}t^Mue2k#isrCA}6`b0sbsL_*zW5KN9jg^fZi6p+D+s2;Pp%(`* z1t6Ox;}Uo6zNXe_B6o6rp1!4BTP1XSEJad$mq9$}>gsuom+&dx^941H;Q@UlBFRN%zgj)m2$`25Z)gYh9C}hS%i0j*87ZJFgNM6-u&-6y<4{ z@KXt}XUoWH_sOO{9e)w8es>MaQiLBa&TUV&G$CYHTz4N83e!wk=yE!&O*! z9hu!_oT^o8BbVxV66on>mS4&;2UKo}Hpftfw=v&3D~8;-4NJf>ht(*v@9)Y#i_P(v z>cZEW3EuxbqEzXE%N(LQxAJAxXgkZD!?b6Nx~b)J&{P%Z%x8y2zh3N7Z8Z%#hAGJ? z4_+ttXGib$)ZY=AN&ZLh4~8RP(L)mHl%SX zKxPWdQ_7E+?~FTM6|b-4r*rL&e>cEodOV^5yB2?|a{NUqTiqM!_;o-w6IK$#GS~~p zG)-DkQk+l<%LH^^jqKxyWnvgjl*|0qlo=KOxjzgM*mLconT@itf z$6JV1ix1kD+iz@Pi3M%Vh{jZg+cIA>qSl0#aj28*yOqFt@Q9oDcvM`oR&=y7-Cc7k zB&AZyxggGpIE0zswa|h$0Z#7+S8n;6UjE7qF=qaUYvgsZ7zZNhuzx&U(tX_ ziZPmFik^_lVY@&+JQd6Fih3P5eE!Pm<`-st5umKM{#zdsYfCm+N)Or$3`_CeEPgVR z9ZY8GKyr&rb*S#!>PQ_vhFrg%_CkzeyI@WpQMcf`9!Nbp3Xc@HBJ^hc(C>0Cv9G0N zLhePS9dm{Bk@;nhbo^!X;~5Nz=$i4miQ|A@eNWGMY&}#~XzRrw+qY(| zOE0nTBWO$YB4-R|opuVMzmu|C@d6q01p_M6_TkZs;1=EyF3x=Hce9-R|}jkhR!1R6Y9-D8W{7`I*B;}e*=447`@Z8V!PuX~kh!9db( z81$Sq%eZ>yTFvzlpPiz7@6X>k2sd5b5}I^V=NqL~jMb!gD6&n66-jzMJ;Y>vsGZB;KW#7E@z|YC%8t*0o}z zNOMDPXxscF7wIS29lSC)i6`D18$HE>uQnajJAb?~o>(5^f}+?ZSZ-jzKZAT zMQ%h1ruj5cUK=EGNXJ=4=4rHh0EpmqzuLsXK09II7@)(q{b?oBNOaQu$p3_< zOv3mP5YW8ni{XI^c(=4Lj!1#-hgENS+Y!TFe(Tswm}_kl?HvY%HHG0(30~+}pLJXH zpZJJ~uGQCWPkeh6%}mQ-cwFb*49WyD_;c*yKM-*ZLQ{0?JpLRb*W4GTd`Tc;TTTn< z`p3`Hnd?uVLIUgynb;fi_L#3zD#ZsABBDaR`4#@aj;7^aI>dyG?@r$WziPoRP*L?}JHf&eSY_s!zx4hDgx%POv~><#k)X|%%kU?zb7Z%J;sz^Fg<%IAL`eBAUP|<5$L^lw>-QpdSUr+*M zzT$2p8Z2=>=K6u>igXApQoZ6IHB++1)kY6DMqjyjQ5Bd9jTk0<@ac`G_}TIy9C%%@T7gCtBfm7 zr;+Jd7rfa|bN~x5%|6pRYKHE2v&cfOFNa5C%wWQpKNpi20~^Ge((*C6*=UtLZE<2B zMjI0Xj`~V;EvRfV`H6z}i2>5zS?dTJ`?sCM3!7_dk6)!wvv_~E1W_wVvxQQooo^Zd46bU+!swiGxSo=u26)}^(!Aqs z!aMh`Q>qYvF=WF)wQ(xpxVikYDTXypX3%N+4==vo!TkhYJeOpAKDK((wmZl za2)woJUABD>UsZpg=1ojsy~RW0N~*f4ko-04DN5|ve8Hd0NWhn041zz-2vZFAkLh4 zexj;diN7eG7>bj>M)ik;1wkY0*&zB} z;~<8gz3sHy$nS?hdq?eFW;w)-L)m2~%nMv&O;^KZb3q<^tkD$k4+OO*WvoZD(LFs7 z7UxEXtBQGYa&oKuIhk7PrB>hGPzGvhACHT@c&lbXre8K)qnF9cXY8?_6`P(aFa&1h z7=1K)?_6g~K#N6_M>4NHjkuUtUhV8|+2{7Eb>i~Y^$!PK^MoXNl#yX!JjN%dmF~5! zhF`We2F;E~c#poXbmqQ@sB8W%3G&$d$yjkA1r+b|qZFC?S&*RROUR(lm zzMkF$m`xSr&mbigCWBv&5jkt#OYDY8_3i!RqU5mgdykw2Q({9BV6(fOGO<;|A{(;t z)oHIRSM{d$uV$(@vM}J)&D$3s;~aP^M=SI0 zm~Xu&W$??9jx@Z`b!k}X!b+3nK+=otc+=kxCj>nb!ZD3V@?{n`-+dmuyPfAeqtKYY0+PqYU`<;Mvf--|fO z6;BzXJu8kUs%%nd@^Y*LlK|>xZOzc)x7gQZU5l#{kpCK}xp84W(Kxlx<00qzE62i3 z6=Mv_h>g&vG&Pb1dH#6nqiV@)r&X&`A?;Zbqi| z`K#IcijJ2=z7CXWRERz7+fHr2X9i#Na*{V1bhfwW(ipaVMnLr=qNLi`L{0g$;JyIF zPLYIBCCz7`s_x4<=?{Wz0Y3ipga8g2#Ac8D>mS6ls=qWtc+N=)$YcNrgka`*a@C%H z6BQd9TVEs-@f{`1L~A0f`dnusPKKuaY-j-tfccs$%z^U`2xNanX*6S$`a;z-z=IhF zk@1Z8D(8y%cWA^nR{+heCi1)m-SxD(=^rP(i(=s|G($Bw%bJ`nG@G&|^Fvaa#B1ie zaCiD0<$CLP;e*J9a!a0M0k4D-oxm)~3@2vOAr`%=HhySuyl+nJgFy_pO5 z&HbxRQK?hxeb!!kt?sXT_4oDAAJ%|}qKMXUGs4~_zh*`E!>%Bn)N`|DXaSktfN9qO z3%$V;SjFQswWi4CcPQ|?A8v|*l z<8{fwtKM*O)BEb^}6B6#D=+D zpky!u_t-siiNrZ-x}xxKI)ZejT9=f;c${-qt?@?*-z9}S8Q=RHEzh7n^p=ZA!>Uo%tlEmO)QR)JHi!KYOKzI-xWBcuIseK1%2sO2c@{W@< z%TPf8po304Sto!(Zyv6|2Vs5bRokT{4WkGbS9K8nswF=RYGer~=aN;En}$Z(T^@Hh zHjo5!lOSvl%*pXl+tPe-xOW0P^gu8#4un{Su3}V~_OuW7Ccx29)OPyaQmtbI5Q_1h zo?cH+LCAZ?}hEemfzf{!&kxr;_A^ z@`?5`H=7I6z`&qtZbkm~#mmGwUaZ$vP;C!A3Orm`m#1QK4%O7#j17Hqy(3aoE!qAV zfd2l6(ai$a@#UBI59KsbuyAXOe=r{=NS`0v?-<_;HzdtPUF3NGtQehmME^Eg_9+i0 z-3pg$4*)h+4y2MPiTM&Jq;Gzk$M3D8G^Hk^E)?fZ zR=@i-&DVS=q_h9AukbLOo$CLV@J;_gUIeH&+sg|alf#TX2$N1iq5&vS@-(5_y6W6_ z$K(ujYJAK-Kq3Y+;yk!yDO#=-*6&=k65PX{#GV?`Tjau$Q=}bAZhy^~BjIB>Ys3qO zof*azGI=Kn)Ls}(Hs+y$x8EP%=rcJ|CT1Dj6}IeVTss*(rr5SkSsR4l35JZ?F*$X> zPn4;vTG`u2>~{s5KftkS#kh(X8_O*rN-WqD>@4U96bY)yn|F+%434GiJHJ zuHx_9Du^owgddx+2qj}Gn!ai@#IMOJDodKgtt`7gM=jP~$Zf+NnqcUZN$MlMn&1a% zTYg=CmFSP!hb7k8t(*^nt_u!%+}3oPtR9YK_fV<%mJOs_ya|88jQV%NRt0`u?|K$s z%E+kt60G(a$fUR#_mtvQs#C?&CDgY}%ERVMV=?!Kx(8I|t z3Oy%xqtPfts;MRG3$NLJ``x_Df=NE(W#<(s87O?GYX~$~32!b@^YD6o69X#DMZk4hp0`(wkn^l1&}!IcShwWQu!_D~+kMJy(!`6uu7-BoP_ zFRR_N@qtc?6#=HAS^o9b5Q|TGnT1IKz`2B<72M~$!r>Sc9M}GhW?dcK-5Wn-D^-9J zlbhDls++%gG0el^Y!i{-Fmz&#m|dUsEs1K|ZTCzsjAbh`F-4SXGGBVI*mc&4qrvW& zC+F9%gLtf@-;+rqud-4jzrtu1K!6CJ;*hL7(6F0$uW{K$R>f${l=j!2CW=gO*ACeJ zFh5Y-D|*NykYZ{LZb@jADunQ1bXB0?_`wwm8qGS9b+^YPppILNVuu(gRGO%i=JRxW z(BIf8ldEuIa5`D>Sm@$m#U5#!)wno3i~5A}>4)rBoA)>zc8T?uE}HXdq9CraDs{iW z%=>F(G7XTva)lem`&(@>*Xwt0vUQB$83>(UhtZ4|EQ#iWhd%)Niv& zi!~ZZMA@ z{!A@I%I`>NSESU$XuCU;>~wwSbq29f_4yOy@4)08fGTu%2$nlJT*USX)5)0=m^M$p zJhc1!9a+g=udq*4gCy?s448{x8_bI5-RqM@72oG7_Y{Xqnpo1ZN~k>KK!zm!p$a)v z9~?La;s>Z>sihUG7lWb4mFH%Y%Bs7B@XWL~ecpAAxKlm{xO9Uy}1LkUNZeiB& zCYhyj#QV{D!Hn&W7X=+*(E-n|NS*h>F}qrt1H+3sEqlpQEX0k6N3qFRV_Z+Ch_3#C zFg%}=m#c95IH~@2-=cM>kUS#Svi;7=)hQ>({Y+F$Y~n6nr6+1!Qx(T)1wYEMDe~$` z8O?;{xDlBf2=pr-7|VsXTPf)-3|yv4!W*8V|9ry@a@#8hEau2Tu;s=bcJ_ zwFyE^z{b+F+XG5lhYx-&f~#1uiaf~;Zi*%a=zWwl*q5(helyS-50R%X?2e&jeX|Gf zJ098JTIA(RQfx-V*&f6_w^k|n*E(y$oeHHS`|DfP7%<=Q{s}ptK#L{P2HglQzc3Lr z-6w}Z3K46a{!&*al613?lo|^lE;yq+spdjPD#+AK`|87CUD2&aDnP@|Q?|C$yc^9^ zmm#@puC7rdpGX~wjYl?nIMcl4nFnhr>z?hReWdMzXV|{dwsGa)z~p4bk2H;6?JY8!#d#BO-^#@*HwnZ#A01?Rc^yyKd z-bHT4=PMTJ&?B)>$GS8&6&*PPg%ON;pj8?1bA9m~D%Bd<7LVl~N3P>*R8y6T zzSNEIDx9l>C&s4f47NuGM}IUj`h#w1db^1bl8P(er6&Bfri}|6bI&J-7k-)3%79QEQcqF#5fzLg(-`=M)^BcFm#lVF z;26<00n{c}>RhTgZF`1nWCHXm?t@B`sysPXEWX-NuZmZFPPO^Zc z)_8CjDTm9&2OuTM^8(NAW9e;KffF7>D|a;#|9&%|P?5$BgRV!<)sKW4UT*=H%T3HD z1bb2;fwpXOApniMaPV|<+Hh;qiyd-NzS8%9eLeWEJm`s5*7n4x zi>Vot$`TR^#2XP4-1?)W*3FXPL6u&Cx^JJKcQVJr+!4$Z~I?@ueHH z*r)j+^kU^>E?Wwd`g_N7c1JS=?+C2wzC(e@9JYCaubsP8h?3S(Fj7nC8`e2bmx5TH z2lW=r-A9g^?m;b6R0*=l3w4|2IX*e@!CirPlGDYS(@W>SfIzC!a!DhZ#4{N%b?kN4 z(tyX^Sir8m0F(^Lj+Vy9_a(+?;Vt9do|b%a<7DtLoy? zXqU7J^YHu1iA4a&?9eF21rm#mf|@4mq7@;Uq;Mi-S(_(zQEk*OV2YayUe$YMk~AUa zldE!5DkV>6R<4ODWO3(Mz3;a*69yX90DuSKKArx5o?%g)4A^akr+CEmV$tbH!#aE`bf zFA<8N#(AXIiLKrPVjnURMg?c{ecl%%roB^Beh;uI{X}^!x6oZH?0|mIAz4o1@d1HM zpLR@cSn3^i!_|&PHmOYG34cbEx7wJ@E5PEfuEYT(lyMPhnB9@pkCl4!c1Ba#9IjkC znT$sjAzTw+pa*MEPVnJepQ(%3q|tPSZMqFoND{3p34`gP1lF}gO^sg=B?BM`mX*`| zY!}KHS#cXlt{JyQqat?C2j7FI5kqC}#%gsCJ0(e_RG-Xdf0!Mv_h}>&gKl@`6xoLO zjN%YsKfcn854)qiNX`#QAw>NUw&bsvEz}NTEN4;H{fbW0nL55&qfwj+RxkVQ?Sn~t zXCw-H$$mtXGCNp3#xx zo->Lk3Ap#&0?sDG4oR;5)IiPWn*boc$;%Za-anYYnB6;W&|^Y_{TXPSCz~%@;mw1F zDZ0J3yUUXX2`^n^&-J+u*dXz;y=$EtjMT_g--b+#0J;#nKHS#s*kclCy%u~T{MPy_ zf`o=C)-zT1utC$ep$7;noDkFHOHmxts<1;H3(-Qx6*s`3bv+lgP6RR@cTTKbVwGw2yhy*HRqMz;(I7U*oA z;9H}{E8RFBc_=oMvy)ub@g7O+SUzy@G z;||oDs7w{_GPn^VT|7N(oUiNA>T-s6$sBM%jzJ3wRR_>+rk=U9?$Z8fl0OOs*|G$x zvZ`2=)mjiWwPe4HqqB3~>e=M%Y#dL!%Ci|C^%H_-qxr);pF4!nlwvViR z@x%eWhf2`Dg}o!NjdsMeV>*4|pJHhGpW52m?ks5@&w!NbvlapZ0yof_q|)gC8=ubQ z+OgnK%oeI|OFSvSAdB*7D4Q`s4ILwbyXD|rP7-=Jn6Q}LSkZ=zOcMnJl0i#Zj%kAp zX(w@t|Ba)}sMwK$J(K0ySASn$p(*p3Qh=nVtb%BFL|C*?%lCx1pTRWm%LT(?xJaW` zClH`$PN;b5lW)&fg-=R4eyYu6zL<7+4=2lggdNF}L1VgvDsqjCl&i2=juP9gIb{Dd zCO?N^^>ymlji~$@G#u`?H=WCECQvnN?}M9l0;@>&^yGRAnIWdrd^hXOt$Xm^}V_NnnnuE@oZfnm|lFC$3jD51tIz}@4T#?jG1>Jlc4Trs#1 zK=GxU?C;;My#Jqw%;Q-J|7>p(1*Z+*Aj#4XNqZvUVLY*91F$?e9`ii&wFkfeMIkLO zv$#Tgy7w(9xokn?a5(v%ZoWup&%|_l{azDK6A1b%g!cgri_WgD-WJ=FWo>2z-{+%K zcFdG{peyL+vgR0D7AgEG(>qnLq5&MyA2+HaP0ptmpHB%`0$SoMN+URLdKQ=qe^0)X zdE`8M@fWr2(?NS_1Q0x}o=IJTJ@kyv+Kl+Pk+L+Z8#+9u+W?(fFq?@3fpX{_CgXm! ztKA5HkB(Wh1HjR9llxuO9$VjJI;fWo_Cq8ijP4l{7Sx##zD{BviY5tSG zx`3EnnGJ^1?uf64iRtO){jKp-&Tu0h899}gjjfN*@l9U!)kZ>Y7%m`$zQCUaJ6DSz zJl*VdbjSrBqy-?ROlGOJSoN9F;h|Wp!h?PIM-qy#{JGTX`dES!p)zW3?&Zj9GocC{ zSxp;n_=bBc5IeTjGJXhU99&>3v-x;-ON?(Vrb&{9iJsc*IAF`eQ4^c~qEXA%+pod6 zs3W~4@gWeq7*O zTI%4UNe7x^QsTrE6cpUti;pdXC@45xSpY~D8{yb>DJmg28h`R_Plg>!9v~oT zzCS%;elz$GtY`QX_KBY10&LOwq_UVPCeTQgHfNAH#i2R(#;0<>Z!xBR0~s$TFZ!dg zOrIWHsb4J$Ic@32MExNg2gx)4)JH@)Ye`V(sV$>eK_P3ly-1%`I}ZbPqHNZ|J}m;N zT(fk)$(IHPCc*DtT^@%J!S617rMl?CuDm6ojM6Qql!iwV& zXe-1xy;@5<98|do{>(VH3?r7)lDvhl7NQ>xxm zwQO`rOhk)Me#oE^-EPIOl9LL`@nHiph&&GgWq~MePqa83whBXtG$KZpTX<&8YnmX2 zLV4u}QAPt5s-fe%!EbYwpS=9hpi=3!X_Pr6S)kp1583~Khydq07WxXzIC;G@Skgrd z8J>S^&blVoy3B+zN@lIyP;o2;6KzO9_F6MF7SeBmgBjjZ0ZUbNp}o73^o)8@*dacv zbE=F+6yS=SBJBFEe^rP@#j2L=q$MUxAzSWvO{Kj}{mtigXH?g8c8s?@J_@8vGHGxX zUS;*geMxQNA}HT#w!1%Kj=|MapGt#Dl*Cd26Lsd7VYsIVS~PJ|t&1#oF}4u}@RC%h z4TfSpSOc`MC-eQ0q%_ix^${D9963bZ7K2WNZ(ELNIel3Ar~1_`rNpnV#PzbVG^Eol zQXf_~InobMuq;z*<`}0$WNg1_#5~1Uc_Dqp+!_Bh{?pU(YlTg6`I~=lx-?oln=P(6 z-!Ho+=lc&Zs1Z^GILjb-W~n;|luI^IY*$QlZd5N4@`-~M-bBo6WJM*`Wmz6lRBCO$ zjZ4y3+(BH!bG1e`bYXebt+Jkq2$w2-SeDB*bXi}wSdYwyW$!Jeqa$O7KcvteWE{zb zvd_VzQRC_5^9P)-+i|VFHeIw1#bp;_<)Ti>8oG4*#fKr){y30CYR>2R zdyw~se8Ov}Oa@?2Hnx6hejLMrsl()Z5B8X=@g2{RH380BsFxtA&Ne0ZYiBlSN0hCL zOI6>g!4!F}`5Iq6q*)xEU&=QGDl<>z$yTM&DWa$2tWqvIE23v-|05VES!EgdHMtt0 zpX$XS+gbO*4R;uEj#3*pD=wOZz3%$A!7cSl?QYI|^}0gJv<~YM)+-8b5$$PlI4?GofRnKmxp6G#79fCq#w88<+n<#!$9_LI2p8C z`==Q6H}La9-aMfIq^GvH>P48=kqy;)^e7U0J?s5nC9rcA+u;ZU+aJY=3OHk$VK_lO z9>|J;!xryrlu5U6OBmW(?)K)P!!;}3*gc}A8?lJSfQv7iV*Vsn@Rot>NP~S)rCcFe zjMa%k4OG#aGiZBqgORUX7T6{Sz?rc7)u>`Z>-S95>mA}zdg10BB?Z$Npw>{Q5_bk$ zxT7`p8wasN#h}4>@{EC=_Bd-1w6Y_;UG~Yu-wxUS_*8&T%0%_ZxwIVX!)O6*JML|9 z+&Rs NSsGb?pP+pVZj76tf9T=FnjULOUdMml2(>#Ti@uQ|Z0PYK1Ron)3K#{%Q8 zY!iT;r6tu1nQcDCSFg1i)Y^|;gxu+fgQ`243;M=taZp*kINr`d-X5gX9%o*=IgrfX zY?VjM5UjX>z8N1~v`q5G(1qU)Cn|{~Li6n`mmE0MDU0R$nB23;GHDD8RtOapfRM@) zPTd@bJiFUBsuNklgAad26;$50e(^L6@kz=UTvMx?wMu^LdHVLZfZ@+FaiMR)L(8^^ z>w5l`MyqpR%unv0-jG%g7EXO6%=NCQ&iq;JXixStsev0iGMv-ZsortF+HNk$NS?%C zJ94?1fdXQ57B)uDJGQfcNm@V?&kF6n7SUDo?Jqe1A6%olZd02gc9+RUdh|tpdDGd^ zC8PG>T1WLcq{XF3y^b=8!#xg{-Gxl_E8u%YaF5IYPdt*V&?3OUR`_MX9~COqT4(u1 zng*`|O?pbq&E~R8oGKy+W=2|fu&G%(D{E_E>UXbuTT&glFK~&p@N6e-FYthhuS-Vgbh?j|~FF*AQ zF`VyY(+?rLaGHb8*9NDNv^Q+yA)v_hrt7LSQVKZR9yFX1Hnp%4sc+I0jX@bnpE@sy ziQOKY3hL?Zmo0842K!dL95_|pztNwBLf`(Hb^(`!#D67*j4C(VBu@uLF1>W2>oq3_ z8v}ZraX4+y$!UHnCLGM(Lb(T&RxjoKS;>!EE98*vE5Luw#`N=@vf2(=V0`CB+e=9 zKV2){;2I4`7=~XSd!zbehy^VyPCj+gTCB8!y0QK<`Vp&Ma_IC+IHd;yp!G?b4OeY0 zcuXbokX~0RF6Rg&Jk>@ul5Q3qJwz@^ig+1_r_kNERZIVRwsWuS_ zGSH$L9Ua|(3ZW~ytoq8Y-qr_~Q!H}PwTYt&ANlbncL$&XZH2w-IlVd?F{f3MpwL7m zEnjBtwUWnhZF*n5zf9z79ng&Yk#>m4--NlD-P4s>z^$4euBJNuiHRg@s>iPR23@8{>{|B5*NTOG!K`;%D; zf3wO4+W{dK25bwQ`IVP@vOz!P50%2I0XK|7+pu{Kjs;(L6T{-QMk~-DNK~=F)nvAW z%GHEJvH;Qx?qA;Jzuoaqe|pH_f0vQUTOnLS`7?I=^S9VEKz%`Xf{ws%c>3>M{L4?Z z#>-hCTEhIp!TpDY4F*(Vg4V^qeEgqt`ghj%KOT~s0!RUhQ`Gu0L;M>9eBBL;U)pt= z9sBR-S>mI0oK7-~X^*Z**rz1Zp2 zQ=qiRvXNZ>e-qjJ?=M9N0=P&R0v$2u&!+y*->x_SNQQX{h3-$sM1S|7nP9+0nLh%2 zWnWOipKtv8w-${+NP%tckMa9q>wkZa|9MLp58xs(wXc!}r5`F`)_HX59lmzUDC>-Wg>1p}o( zgF`~*d|MV8)bTF*Mq-bt!10|GwO{0Dcbr5PP7>Wn`7<4A&yKzTbiqG=Q0_fc?k>zv z)73njT=~(T-cYf)dQR~#l#j95nq1jhro%ind!0$Kf4cc6d7JoEsM){WAVI&3}IBG*W;V zE_o~5(2@8<#f=S05eK?B;B#d^_xFDxihx1`(8={C^9O8*f4=Y>{J_VWzILB2z!MV^ z{xDmt-zL_!B7u8fd}<>hc-)li*<2DG0(0N=kQF(W;~dl%V8V9!h8790Ap;X~vh=@-i34o^ zJOzLHc0~_Ss46SnoTp_O*%GJhaSKVCUs!1Q-s8QyFH)QTK`jJX3eNl+ z9wph6J0Gr4n}+&45)ikEXD~*K`vjY%#-ior4oLg+0W>EPCZ=xiY?Q$biS~TR5rwci z{c5OE$K=hlv%6a9&>orfo~}68TAL{VaGAtM_jB3qj`7#e)4xjk-LU*=A-?Q{R#CFh zy*I`)iEoVWt`0@n><&WP2%w>%(P$tbL%qDbdR}3{4Oq$*B=;*u>Yrs-ZKoR=Dn({w zN1cO^W-T4esQET~&@eG61`8pGPdU}q)w7hNDCDsnp<@3j76ldskViBG2ot?ltpE}& zeTTC8juPN#hg(3C!%^k|TBz+Jn3gM|1-x;2DrTC}xO=QPwP?D#p9{^bZAAn(tsP|b z5tY_^&~R}j08)M?aDp~VPi1hkD#jJuccwcoF$(?99X7k52R*7%docFRXsxBLGNDnY zKPn0$qIOu!8&ML;WJ*y!7Fr9U04T59MiU8EOS)td?0PXEhNi;x$qOQ;bC&i93?^61 z+S)FcOf2hGSqa<20|2$@TxD7y23@}VKMrF7AeG09KL|0EThO(c29$UUzbNhjYa+Z# zMv!8}%hL*b7N`oz`BDWtf+>w_)VoX8x4&*==QMn=yEEh|7}-Allj80^_VAh#i+N_J z)#HsqPERO-=Q}A1g~Hg$=AGZ2`v3Dne_1RV{2ugJN*UB>klrWo28Od`x{$;~M7iR< z8Z5P4qaF-Kr0>se5ucTes?Ir|3qMc&Fj7-j_Y*a;yuzjb695dIg3!^`C8wr7$^xBS zToBRFl*F9PSV;ZlXJ2+JKmH)(R4#0%2O;)n9dcb*$f(S#uI+EswYg$(v=f=a$jTC* zs@PT@{g!N9=6lbkFpEXr;3On>HCgJ2o8u^4&(>=p50 zxUi0--jcRNMGmcR&<*xt*f8gM&jZst%3_&U_%yPI-QOr8T>IJJn0=*y zte(ux<5e0s?=eCqI>gsqoUH4mEZ?RRf^^^XR4|?6T&=Wg>Lz=HP(t4^FqkoLFznnB z=znPefFnVj48}1hxCS-GcuiP8ZXO;TOgtYAaVDN0P3j#j)KL)-#B5F#slwT+iDzo( zW3%?YLBfCi*N;#KI9Xv`f2T((5wX7rKE4PvVS0m_Q!?Ri|MNetO@S&5d$5u~8W}gI zm|Se_p*Co6kc%Y?{a=6k_tE^1Z#-g=Q%gy< z4wS-wyXn7vV=a(-mGWt<$i%ES%tIo3{T;=pKMdSM32CKeOcy$|^AF?u&s*U$g45n) zMIUXR2_^kdwq>Y-ecM;Ai+-_u={sMR7q9on3w4CQ|B6=v16ls1 z|v04+wb0TLE*872Yd8_R{)D|2qVRb!w%jGR>1(>ew(iv>5Wr^O+4u^3#n-u8Yq6n?bUG9gsEk7qOW}JFVG{Sxf=7oUm z5{wW|4>~!qsIwOASmtsK-zjN|IA!pen-4sGTv_kl>>5mv$>rwh4Q*TA--tp4 zh&_Pz;`i#QUf1lKTJb|dLp-u;M3`Bjxmi0dzq}DUy~d)P{NW@rNjRMU*kjRU21`=W zL55e+Yodh>_t%O1zf()Z2sZuEtRGk`8xNOIDfM=1R<$NtLS!kio%UN<{R%>pbC;LP zKx$fd@}b1}st;YaC2F`C^An!yRUM^zGp|`bL`uVKmM8&$t?qYYH21BRU7s_sS)2~c z_#J}5Wxzc$+S+8Y>^KZZGV8p&)S3-+-ArdJ@}!Ru<5+d4IE+0}Nj1Uf^oPU1uA?F$ z3#P*h($a+OQn%D^HqPH{00uzV4*M#2UA^Amn3Khcawhq}@);=UWqnTZf!}9`bmJm( z^z;{PPVbD^aAs-Vk_zEIK81#wo3lI0ZfQB3Z&}`-3cmy9FLfZc5W1CbFlRr%cdmUM zFk}m_zrTXilR~r2M9JumkF?5Sk@%aP-~mo5MfutDfYqA+xr!=I788At8Y2oFOVUmp z+H&j3Q6s=IlvFai(u(Bb2n<%z_RHfEl28n1(&Q_*JUnDrSlAeX_N7QXQVBb9T)E6r zN>%3JBGSa7dH1mFqWQW=o?k%kO&X2{TTAC)KcY}1sGBT5wYPq|*1J?0fVSIS;dMQZ z`F*>Kuum(_W*=zxEULaeO_7gyE!%u;zJp%ooO&RI$vph3Q8#v}*;VyzhP z?ozXMQKtAlOCaglwd)ziY?X6}T#14_+F&w4!}SrvWN!;PwNTkTpkyMfP1?LQ;-wSD zDsR*qNuFW$WHvoj=PvwM&l=*>O&-$P=qlNlEc;1^!2-%8`xqA=6_zr3YO}j5zc^EB z=DcMtg7; z1q?wHIdl-Cc7y-VzDq2o-jy_Sp=y_(8#RxRNY#9!mBCW5kI8ORMY(VJJwsALyQt=& zewoZ1nx$iIIIm{K=v_5No{P$`VI4)hf?jY2v)-Z!4d49K=hZ8F?5f*a3E@S$Kiv>R zU#O`V&t$wNOBUbZPjoR?)iKAAau>yFYvj0h>Q?`5sonj-ai@3_9*-lRpP}dC*SI81 z-*le5sL^CDbr7B*8N}Iki!q>*aT57v^#FO8lLp~%1PR__Ms2!-4(5s|3&|H&Iw)!J zD578Q$y{#R0Lbd{>DCe^#kjRsX*ac>Lc^U|+j(RyfLqqgG>_nI{D-J2Vt?KvHHP7po5U-_Sb zz}r4kog(-S+KRJhXi3TtdSpRDcF)NMv6&%ErygyXpiB{M7xb6CjO9-sA{DSrEB)|h z_>Bmo+lm)wL2K1-Nmbf*wY-mr6gjDxkJdk+eRO2oD@v`5Ji;K%psie5^cCKKm&agrswsF1{4x63q9v*w*Ua8}LuOfsP z;2eijsiwNzt$r{jIN8V>XDu1(fqz-+zIKC;>MB(x#q)9W zw()8$xLeiYzUris3B|*YuvC%3yx-0_sPTVXavCbA71N8ZPDCVlo$N_QP zDZ~4#M-o5;1NA}1>Crn#0id!63JpEGNr!X*rK7NDSDg1og+mn*n?=$^`B5osz$6j6 z<8o3qxGhpab;{C{3FWiPDF@@iMw_-gq$j7bkELqhpo_)6VKiUN-tt{gx!Fo200Jad zXo4C2q2!NBA6oKxYZ*+(gjlQ0N#mZ7)0t!L?>ETf(!uRoj%GjE%k{(*8c8=Bcf-ll z*ikKVMJx|k#_;lHO1FDkFT%LQ|uqY8FrPy_oci()IC@IwfA4bHs(GJ6GrCvbsR*rB) zRqk;-%qeSpNaD4Hr(9$RN)HqN0Q3Vdla5c?$W$-Z(3*!Bve_g)~F6Nr==QL z#aj`D%VvNS5>0PDHnVNKt{34)s5-AerS}kmY@^iWdVjrtKU$}2S7r=rTY}l(vg!YV zAWlys0MUKbYZsgAku1>|P-p&ReLV4=^Y8$RwJlDa_2$HNVw1-9F$0;`wpnlaCiP*w zbpoS#SkPWvhqZ?Rt!8uM82=!PJf53S4MqaIwYx4Hg-mU!3)>UqM}ftLL|7I7YYpK=O6wPTbg3RaElypp{i=hIk zk3gp%ON4&>`Fw``jrHM{$YDUDn#PR~d?Hlae7BRvnE?v=Czper2l|JPg>7q+<5PzR z%0-XL72ADRLHmW8Ni;G6@f`P8HA4wWv*%k0iyut+Cf6#<&NllfJjCp*b8G6XHp9n^ z2=-P|d?pB;aua3O@Su#JIBom-u1i&H?5cr2QA)xX~l8Z$?=o-$f1A8;9{*OUVa zMe56#hu%^B7f%wzdk$Nj9y03CqX4^P_iVuASue-7IT@*G=BIt`tKsbe^G5RJ!26|q zEVfSyC1KLXuK1r~C?f%hdzM7i+^;lEcO0vs-kum0Te%QBL#*rw>`HA1)(a~hZ$JZr zDLXbU>3Q(xxjy4f7pTw2ha7IRAL_DG&DmQxn&WeAJ^if6R-J}7 z4RLzrb9`Qx#K~`G+uAqp?uE=)igFWa{Wh>b3ZL&-E!P_!&os1(Bb%%Bn#$Wt>MTZl zpU6C!Jv(+O{YgK92gwOrZZS#-VRO8_#>UYv{=gcm3G1#oAgKcpY23hmE zuIfkcQB-q}N&xNLI~&t9b3cP@ z$N4L>V=iBPe6qxcb%!s%1Z0=r5u4F3h^cJYC11hZEXW3*Qzu`aay@OF;UKAz1U@SS z+>3FHsw*x)9!5HxWJq!`@n4{=dkPu-x;e&fB)?;YWRdH8gLLwvb!vr%h>~z2AaT?H zx=%sCA5=oH9~@}k8^}1K(6q*n%5-mDJ1 z1PKD0X~rE1CH>vUAyWYlWSaQy8n<`v$TlpWmI?TM_PK{_b*3O`-Btg^3IpSRfS%=^5DDgoamTh~SV0we;82VF5v*L3D-#$HL-(AzKI zjaV%6DL!z@k4}YxOs;bi+b+w8@)~`(hEromlP=6onI`HjbK2P1Zkor$vefld;3DEG zRaHkp=*f;E6@i0Qe#L_wcDTveb7Un9rGV8lG$+2|{N>zR85g!Hk9$0>>R5JOBhlWF z#6~y0aEtrHz91)MrzC~OVS~Jk5_t|Yd_(Ju{zul zA~8I#$sF2$1Yw>kY&_QJXSGHkywgE-C@;g>lK7b4rbOz>B{6Jxt}lk_;%;qV{?1)B zz-VN7ah_4x8ubj$Q8)Gq4AkeiW?XE1a*C`X=V{+|hbpSKct$+s^5dykscB9wtEPE~ z2kxgMH<$*(jFU?^dR_W35|BY*q{e?j}zk z;>K+pJXQB%#+6XKKW|1&FOO`Vc<{$SFT0aY=Cc=$mxeOCPMMsF?&r9ha##&O!Z~i| z-StJ27jaMm#6)ooZ2B42<9&&aBB%nPTovYDCDDi8othOwdXg=umi?@adAvl-2`xw) zANZQ+k%V@^WeQH5W3g6vAOey<`)c+@Q6cAiTlzq&1&#&^e^%hj-R^k0NQj}OR){I8QR9ic%0S$ zkouZzvM{ZgA1WHQx`{w*zWd8jrcS^#35PdO=NfhL9_ZXOx+H0##Xhcux4o(diA!Dj zp;_Rk++OOhN_^0}cfYs?hCLzSBF&Q6cInSw55s@p?=vFgqk{d2R-J4E9grY>a6Py3D(#)`-nX) zuvqWj=K>1BaJUfzx3MN~D)gfyxjtmHH_RUQ1N2T&paqCclwhP_Nh%?~j!cs%#yvI! zjj99Zz`6Ia&3=?G6}O+ec7XnH_?>vXVf4LQ08Cw!#Lt=ij4f`j20Ad_jc$8R_7((E zg1}@%H9q#+hgP1R^ps&sP4~3+oYfE3n7jw8vzClduVMyLbfKy4FAmbSS2-owi%RZS zKMH1rpJ{9q@!+#q-6Tw@RhX>07y|tc(WVGCuz7Q}as3amH%#4QX*Q9V9rQiCy2EPX zhv1*IemcSoeAqyvXq-wN9CO5OpRXTG^g{aB!a$S;S5fevTjh`clKZ?ugGHomow;6i zG4(SFovKl!*;ky}XEKQdn#S#QPJbVG9jyqt0Sg5+va5e;4s;ca?tYb+!sT2~oZn`t zrKNzA{w9D@iL$+$0)wTdWB5V+6^7g!t+nx6ArFFjJG;er!2Q-(XeL5A&=ygoMfGZKpf zxMnI#Fi-3@N~H4~F^x}q{n5Eyk-M`+1xuaSC@yQY!qwG4s1c^ZkgwW3#MT*rDxV&# z57)bc=k>|1otMeW>+^sf)HR67tC&{9e#(3yx6}LTe8#66tAQtx*?g5SiGJ@85xD0D zj}RvmpB4i7%wf%&d->ReiYua&uMBVyldpM?R@8Nv8iWj@obXy(--;b>9j9o#ZN6!g zm@74`fa^Bk3VB>@_h$97X>(4Ky{~4)V$UET3i;At5Rr3#ZC$rTf>-Smf?LJA<5C0; zZYLeoYp`Tk))XV=I;83gpH1$8@Gc#y0T=><>*wxXTh)3w;r-+!I(HA^AD!o(2x_0% zRrz7i&oDgBIY1P(7>KuO>UEe#j&`)$I`xA^>T0qSy|^;WqEa{6Y>*i6tg+hCp|pOzMQO&d|;ac1UO*QUq^xSIPw;(Q)Q2hP2FC7PIg z9X7~1xgKyN3qk}J%M4kO0XWqdJOalzgq?cYh%tJ1#hke9qMh;yU-oyK$T#iH^TlUW zXf)~z*+PMi1HbINih$(V9}_R3--B8;6@O((eJ^M*QH^dmdO~(uFW!z=?^UhIXe`%q zF)u)XKs9Ya<8<7MtP(ovzcF73)bT5o(G!U}%V%bvt5x+aQ7wpW)eWw|kq?mVV)Hs@ z@v?Df9M*;Fb)KZDGzV%g%2zf+dv{-H5Dg`9m9TSf*t53t0jU+t}fTJ9IUzuqjCN`_c9ZO^gyii@eaT9Jul~1#1lrac8;^v zoRs}jAn+ZMBL|4>_-CX>%v4BIIt zM_4RVYm|#ENfFH83)EShrc)~2R0xdc@v+4iP_ybM9}#R@**i}qoeS8%3lUe163lVE zhllz~&t`u-^$SIox_Hj1Qu|HJG2In{2oF#3umle(60*J*t=(&Y9qg>vJ*0U_SLxaf zx4CH)vs<1iW1X;jJ*7$5B+p>_kn8zjzVARg#{=nsMHNuj!||FM+UCHSF4PdW+O|UF zSWhlfHQB~@R$m}}EeS56xpcf6IlYStOCRnJ;iPoCee5hl{ZqX%ILUr3U3{Ar`Hoo` z#+aInm_G1VyjOG64Cmji*`(G&t|4I_;zC0?`UH^pHb8@F_<%;xMlelGv>*-ADPgNS zVuLl9DpV~&BcJYesy#8$J!nqnA1t0fY<`q}rmO$1a`I)B?;x(k5vmFVe-0WBdHh^e z3eleKU-oKKzMb-29KF|@TOgeTM94MA3wBB?;stJlhb9Q~GlNUP97*>?p<_@sMQp`*N~(0#D@@m`~wed0?f47x9>6XLo~4%)lPgq zOF`vq1{qL)T;hR{%sY|ne!dfROJr8|DdS~E|Ii4!a4pQ?X7{{h%s3;|HUVPhSoM-> z)FXFp$8kTT)mUET$QXLBe%_vhJc>kZps7n`t5(-R9jhqbBxj?wgYIO$++;HKQ8W|D zb$C*g^`gV^%=@+EUtdl-bV@$59JG%kz56kxX?HM@=2LBU&yUAP33LkBJaph#^M-={*aF4}83sN94XYfcov}8f!0gqz7anX|k&Z&{ldqaq+MWaeYE&jlq6-b^%Ss z4?(gsN>5?6D6wU@u7IuDI<$c`P5^8OoLc?4o27TPR(LlCbltmab=S8Hx4VUJ&dp<} z?pDYWX)7qu*H$rKsB6!*iWo+yW4|446u;k69lj?tWB&Jt6=2{`3L3`E%g!qKo5O@r zXCSm^`s9o%!CcL2ym|-mA+IGdu#XK)>I1O^Ms3JcT09H01)hc&0TphBP4}9~X-22a zoP|;zKgxmL05O^-AKyhPqtM8*_Nl_Tx#HluwYRN9pw+`aJT*+Jd!hHN9MizdyN#R? zSsdJ0#+*O^k_1(KDAaNzIi17>`1V5h7)alJvz%ij>`|xjL4slfNAEl98kG-huhzap z+?Hv&WTV+G4r|8JEc|?3pEtHXmn@qm70+b4hBVh(iHs0BtH(*V&2HLqckz*jncSf4 z?HQj52)<&h#Gb}*w9pTK0`4nADIg-+_jAW>Z2=>Hz$Dw?MJ^uAD$HyX7M#Uv9t50R>aB(G#5SNPSSPdA6>!_CpM3J2v^<5x1k=)a=#Y}#D zqJ!{xxcmF8m~Px;62}U;P?$cfLCJa5dSBzv9P2DUh1(TaEYRVqoub_#v!Bi#Hqcw-s!s>s5WvLB`QGbMngN|sS_USDmGa#XMl;H(K za{^+PB0e{*wv$69&Fem69vhRhtsodGT5+m!`~8Jc-5c-w{-}!l`Fhs`?j105a62}u z0b5I?Z933NOg=mpXn3z2FP5Rt_%-kUVec)Y;##)0(FAuI55e8tT>^nXu;A_x+@;YF zECd1scY?dSyIX?0OK^9)E9bm>zi00x`y1!pG48lO?il@J_3G}`wW?~)sx{~HJku}f zW{Zf%SvLxYz|TyW7YXsJc+}Jr`XlTL@azmg*q!ch)FUwm_TDO*=ey$KVqW!H3m!56^ZWGA*OBReF6gh17rPjua|TLHgaAm zu18M=nvt|d7!MR3fnR2>=b^Z}ZAVaSG`YO&9e8wCco~8ZJiWahGl+$ReYE|qigF&> z=CSWFwC{9Xu3Iil<_Ms4>YZBb#b4)@~0x zujgyJp8pcD@o#X7B~*K~xe544Jl=6RB&h+rPVM&aJhA-T=mWyNm;$o=^>x^x8{O#-d{p>t!ZqKau6RcZkOiL9|gA6aLnIuVykS8^e;wrGTvo z!T8)y15<*UTFp`%5o8_;z9gX8CpXVitjI3*-af%9H(j!ETe=2ts(6fta9jMtJ)oj9 z_rh3NFCa!eT4!q0^yv8LrNeNhdUq%YAbJR04ooh0bjo!l8iVKk$s06VBG!2P=sVo8 zmS8n1cXP#cK?lnD@+&FGQ`&KoYu`{$VLLU4In}{#_M8~$$oEW{{4+EAKt6kZ(r_da zbbBH1L?O+MFuLqx+JA=2xR9?&cXEqXTews^v*BSNU90LKZ-7U28)*wwegj)?#ZOPF z1#iYn$HejZF@SmXxu4hj3A%?`DB}{V=;Y>tz%Lo;ZQPCi=@AIv6;mx$F$3srJ_ z?ur{xpS{Q>zl9k5qN*GDLkq>7$g5CbcwC+ka<8S)`?_i>%X5m5cf1v-aIkUhm;cO38sE^^ezuL&Wi6&?eWW9>hz(?U_Wib2 zFrWr~tqD5#7>*7S@92b%RsTe(&P(7m(TnlRTOx1C2F8V|BRQ(Y4phGxUlIDR%@!`e zlfZ|G*^PnN^Hry=zyiJx*2FIxFLbHN2fN@r-#@&7gD8_tO%ZS+h^x_ccc@KLwG6p; zxCyx+981%bqZ1oHa*^ocrqHTHbPvTBpgih@cEA=&sGqkYdEY*dG@>0qb0XsCdNlH) z{zKjf97XsCuwzH|kc#HY%8I$ZS7elT>Bqh51*&=oCPDM5{FQLT_W`pU_+$92(&yVf_(M~YFS_|_OD;P!xWVud!$9Jw_~wEz^g*pjFmbV&_Jc#7 z+LzDc3>OK?)&TON&M&B3wtnVV4sV%~!;FeTT3?1X=#I%u_xZ)|AYlNU?gIUeha>?{SNP#nOcI|09>9Y<4PJU9y!?6)^vy~wr$Ew~lPx2HUM3dD>Sg29nEBf?l z_XA|h?%Lh;i8&Juw_24+a+KS$h}l9}FeZcI;tIGEOg7jm=!eqHETLSat!vKVp(GVk zlG_RAd7d{I&)T;|)NBK$Ynx}azhYK=4TMwGPL@u84ESo}b6w!pxWRq%IW~*JQMzi4U`o!1i zaC8R!v8_M_zAIgS3_Ib~j1+2LPpX95<5P({5m(61WNLWMs1t=5IKw28W~1K~v`e^% zmNAP(d-Y_Y6e|(iV6bQO;arrf9Wy18TU!fHHcW|j9S1YuFjQ*AaLvZktJaZei%Ver z;8Gf^rVk;tgZ3c_`$D*3`WB)u2`XK<*v@?p=Q$_LQ}rw7t>0f0eK2~kQ=WR9$Qj&~fh!eNP8 z)62lP_NON!No;aCWLi@z84~AS2DeXk8438f9Sh9XUZV6g6UJE_Xcdbc8}P#4(JJMo z9j*`p1vyRe+t;>I!BVL`_d%vuBQnLJ;^z+QS~#JI*wlIpa;}pfqv#6;(&%?S&^d7R zbY@!H_C>K|u)AfZF`^u@XO9@u3TAeFy>LU8h`Qbk9w}7xO!au_u>G|t5VN)*D}m9PF4{N}Cu2 zDJ=|&;W8l@Ltfr_dhYi@B)3%3E>G8W7+;@ z71($e;c>n#!8pU*Ts43#?duk5MMmbwd2r+Jphli5BJK2r<=jtW*fRWq%EuIAkc({b8Epx2D0*g_A^aX2#m66rs6`i)A@p#b3fael0;csG zyQS~<_pm4$!4p;*)#3YiQ?CG6+>XO0J{Q#p zK*B9mps(0%-i72Ms!b(kW}O7WJQcg8=SoD_^QsSxy(LYyRJtE;IEBZb@mRUFcP`A#0v$U3Y1oARAcFE@x|WeF1``dfG7HgP+|FMjc>-^7T@lzK39CApT7CXIf(Dp zbe=6!LMKg*tC)PVmCEO`JCGMib-vvnO}E6Lna=A%e#NwqY9Qi|uG}(>`>U;$Pc6mK z$o3dZzU|>+6ALYlsy}H``yIQ@b6gnG;vG|g;}?3zs}%N{_YsrUswFyDexD@iV_pRb z@>aUEe27)M`EDU}MEBMYR97Sl*~)6#Pd`&(+F-$f!=w|j+wbrcI~}6Jqze1VzJKW# zuZN}68=Ob~uli-ZikjZ3 z{8>E#U+LARhx5Co0QB|;o~M4~^&T7LCn!MW6eD<$-@D^UQ1SYbHxu=@7v}f$9S*M? zO=e#J;p!H#DcGbQe)o%c@J8B3K#F@~yxg+YW&lFfMyg=b9M6nkj{)Owv08h9Uq#wJ zpqRH)hle)8@*I4@?0VaQrpnHTe?_cI|2;t?`*3gjUIw5^BdP4hr9z_G^6-cNUb(=}i(9n** zmb=L4`DCgLCA_I+_V(B$VA=e;tMyrz(A!^eF<$t5tb<%=;Pa9fb6jpNQTj-H37XX@ z_&n0BYmHK?Sd}0&=e6Cf;z!pV_C#QN@E7jEpKpEqC~bAWrS})S`f{PQYN1=4t4mm- zSu;$>M4sCqo6L)Tr27`xX0E?bYtZz8i9M*sI4eFEf@PN$x=YDkFJEHL5?wY z*_-ZmFAt`3xd_IJLIQx<^XMpt2L1HI{~;&nz=`3!?^UEa*&HHM%#l5&wN!G$Qppet zT209ZR?MH14X)(Nhq21DQQmR@)OeXC?B1_rCH1v>rB8K4MwV=-?`quNX&QepDkO=^ zFnWRN?yA~noT;kOEEqpsUHBuJJg*#GocUsWsxfPSABaCXQF0sz zG}cGu-u4Xtj7cRYf{>94`;2f+^y&0zn(TOT(x>)>bq^;V&fkrQ*ekuMV(rzU(#^B& zG5h1yE-@Yy=Z`=29q~5kt-~Xi-A-M$b(z1J*KTd*{pseR>NouSY zBG^oaC0$)>tqC>pAFsDk?JxG!k55kzyoZ2V9lcY!-VB#Z-Yx6H$(j(5kWQZ4V>z+> z;1kINb~AEdDLWPrtCsjF)gKN8-`emR@R+QJHLB$Nq$f)S%_w9|x^8BQ4^2h{4}HU( z4c<+2(zd^c)<`ZFLs81bljbSr*d7hQnaO3EHryc-<%!nCk-0@qT6hx zzc{9-uo6pX&pf~L|1k|Me2}3yCO)2pn~RJD0U?zdC#oJX1dE6@<&ED@jX&qee;%{~ zoM^)xETa5JloWO1HXN@0?SWg0y-h40hjSZkTDi^ltErsACnhvGP4mLxk?6qaM!8P# znEaxdKP=G4U5YqYGTcuKr7p)RuD`a4tJ{)-S{EPv(^Y_5AudCgjA>6$il8k!F=_d&Vf^P!|Hp9zoR1MrVI7%E z1e}+1V$uL> zNzC1Bn&rR!r60MlzKrOo>D+Hk=#LKn+ZTdjo&YZYVzkuoZy)?0-@^Z(Sovj+RR2Rb z@9&-Zul`1702oy0`&s%uzx?UG?v`6TIRP_^XtJ0e+z#_F`Lqr zZkR`|OfOYI{nG;R@9q(P4YxO6$41$u7VvAMIN!HR|2O%M9rpiVBwLwy zP}rg~r9wOYVK4TZm1Fg@Fc4~(|IBy%AzbFa_B9d^NYK&vCA2+a|E1-FEFk(u4P^@R zN+Etb{{R#*P?MU1oqaqw={S`_G5d7{kHhAbO&r57;P}F=r5SCP|dc3lx{@=M2TOD-J75z6oS z`;OE>gF{5Uq)n}fw@yA>wo-}pa526OOy| zr+)4F-a$pc_;5t%4hMO+J8?#v^D>uTTXL23`oCxL0a z-wxrQe(Em=K4PLjwhi_q)5yR1rB9U17h7!aZ57U%^H=$hcyd zThZT`OE@W9RR3p%l-zJRdt=F6yGHKI%zi})aA~{;kX@|B-(+Eu`^(ntkM$8ApT9yl zRCk^{hv|`0A5C@rEV{)>84QW=u|@aY`p_F40Dw=CXZEr35y{`=rn(35sSWY^sAsJ_o_yVhifd{w?iO($Ax)+0hXv4-7O6t){X%GUrF zVd1UbWMKrKYVp-T2Tq+M44wLrih*#*| zjG-pMK#nj3P`4l!>EYpWkMI*}=BD-sJD{pNvtYt&bSuBWz=32w(uarbNHOpIw+#;UW_x8vb#MyQ8>F8Y*=zrI7}-QTZm*BL1pbMU z4edn15nRHnXTb+X!l>;B$q>ET|-g)C23wFI_5q%WcMAQEF^%xU5WY=TgnjUpM-r7&qRez>|l+f&X7lcFq4+IN77VzR@`e(?LEYrSZ+~@094u zUpwd4r(=4xL}nh(=$&ig3eHbA?|u9zk^WV8@+Ohl`SEm zb$PZN8J4}N3P~nwmrY=#t%X{yR*PLE65&k%zzCJ}n)4=B2!lz(z7e=D)Koy`CG@!S zW4E4p2{P$;)_t})cPJHfg2kYKJiJgK&y}tHul;Q+C=S5TMkzUb1^C!9=rw}qtw{?% zKu7?AhTUeeGe@3XkQ2*h=0%Bia831r@e3eM5R*fAn3LG*eibH!x=>ZuArWS-fXv!- zbQbyk#L0Xj0)QF+fWb@o++81PEMAlIZ?FS}FH&4Dz&>vSV_e}nH|r@=6iTURqJI$B zyET*yO#_eQPrcpyQ=;fEBY`Pq1kU27{;dUye6baF+g9KV+Y=(9-F>JhU)sNx2r^}q z3bO}iI$j{zAGJGOn_RxSR`m~-ij>M!x(JD2a){!JGI~lv2=jF6feGb#AvDd~gKYF- zaudyF`zm^!`oW#mvmhZUUpFV?WOP`k@3Sv*3>9n+?)*m!+*RAsjYquhi;mTy>;4rG zIF{5Ksz0}v1rME2YH9O3)AeyE1C_wqh!~F1a#hat`=ZGLn@3{vx%^X|oj@HsQq7u2Qa}L);&0^Zr>^-k4(8%XsGgU78xe~(rR+2U zl*7BS^jN@N$)FB>5B3-Pk{|1V@JCX4MpMe|TVcVx7@=TbrJy9M!H)$v>$?nM93txX zSsFftm=m2x#lrt0U@KqU=7j0XTsA+$9-x#9({Oa(D$*a7yf0rE8IgNVYd4fw(q!&r zFk3hSameXhpjeQtb5@aK_pfl$s;_W&2(A-bv!8rWm{%Dx`Ug6QAK7RXhQ!?+N||KJ zsgl6DqUS64e^RZ3^vnN&YHhcZ*Ino37sCrc_Z{rZd9s0d;6TFz`rSOpeAy}_W1d&+ z$6@SX66GKGI02D}k9(IXRvof>*t68hqbmm|uad9p%cNZ`D$1xEBTW*!?sKw{1z;ZD zq`R^t6M$oi)M!jcl4E})nUwFC^&`fM)n5SdIvNJ$+)s|%>5WhHKU-esE9cMC@_0Wq z8udkp+iwk1I4M0y;Bkhtn~kcS;|tk|0%gu9_?-9ATiCsTov8`#-RKjndNSYWo~h)D ztzq>=b0A?rzOPYZpPO#A8^h|c{x-SVX356>W>6hVmNc~yNKa(~Ji|A~KDQjPvJ37! zQER})vvmRf4t!O*cjHuplB)7odNnE7eoH|oW2aW>9gp7Wq?LJSZ;`*vFm6bz(M2OP ztHT9;TlDByh5-jITSKuH&fB)^~Dftwo zdY5f-AO$qOzzHr6(1`@lUf(NIDP>|TXCO8bPO{JchhaSlLTk64oClYiovI|m5Ef~$ zM_yQI0Aa`C^d1126ur^U23HJ?bjngJGhiY^uxaSYnt%$2Hf23cZ82pf@34iN++e#R znxJ@||CvyHPkC>#K~+029v$C9%X+DffkHYeJY}JtI|TN6$n*VILD!l=AX~?26NIn3 ztHQ8en2-Yr!D{h2v*F0&Nc6ph-w8+};U78Hm8c?(O|ke0VDLLoFd{ZX%rZs~1+&E$ zBjv+^dMEQ&r<9*On>lqjq)G9}(&bB7mDx5+!?ac>%4vXF-xSpX1t+Or&6oK}mZcoS?vTM#2g z%^u*a-~@+!!Mkv4Hcq0=hi-hOOk4eH=R4H=qM@4<8s&1ov+uLwCmTZe($*+A2%?yww(TK<3>U4Shv@F>lkt6&ix?S-WACN_q~qOrmS!BXcu=_vo)b$2<4f z+lqY&u)P3mCVOnUh`6J`CM4;ebgZb+UhVPZCBH2|BMggTAmGR$X-RHr*fn1yxmx5s zxFst3PqH8X~!iKWwi^%=^~9M5}Zzsw{-h|0Pb;w z&>+lvOKY@5$vtzhIgSF4kd7b>{W#R_%x3G8^M>{LEH1QWn(dO$3r@w&6)H@Z9#Fux z%N#V@Wmo~(gqd=A)TyfUi-IRRK8b2I^^VVYx9QIOu#!DrYNW=h3?19y-3teZ8tzDXL!P>5Y2uB{xH{FRR zL$!xR^<@=6SG^YZ{}QjdDWfxZQxIHg0L@?vW%F#2#UBCttAQjO zh4)OQEI`y)lc(ZOM0$Rba4-d+nkU+yD-s>>ZQUXmya$STH86{14X+(-=-7W(Vuv*y zPKmY-J9nz%lDAB&Z`m0y+#ah6%B~Z0c@BYgN*K@zFUn-fMjH2p)IZB(rhL*2jxWXI zKz#Q$5H0fm3%u$S#Z>oxyTz_k!H1qyt>zc+2mFqg%faPmAm;+;PPu<(yP+4E>6iSx$6*BICK=~W}larKD7C2Z){ZT{>{=fB2yFnoXcJmd*0ZG7Cclq z%2dyWS701l>lUKB4s+BNEf<|!3AF-1Za@QE z3v81>e19iTOWLR$b*>DLNjh#V;R?JAHV1?=ND5*f=;t^KKR*gQ78c(op~IzXyK~o6 z?Q*HT$D}W1N?=or^;w31v0-1z6@P0OxAr=Yk1XFu5~e+DZ>D0~@+bS+Bp!ap>fi^8M$%$OO5{55VDwFt~ zG+nviCQ`+!$bHS< zG-Z_D(7`I*f~_n$Fei_*-vZh4q7gi+8PpVZq{C{pNuPY?n!4B@oZRB{d~tt1zHW2) z64aEBE^!WOn}B7dl?ArUL6qHIiXw5kXMYbT~|ou8YJEzF!8PHA>(< zJKVVOP9^y25xptPsY16ILcFE;((S1}?l?!vf&}0?K zp-OTX&J|$BB%GZDXkpdE5DBG;bGYIZ>Xs=@GUyr%QGGxBI8h*@?6$j$zb+pKOTG;4 zQ`AER{!Dj6@AEK|dFrcJX`AiPB{z;LI@*9ai!EVQrwK)GnviD`GO+Pf$FkzUU@{Hn$w@RBlnliw_C_^UBS;E1zTb79J(U^!eTzf8$ff%*J(?4GDbN*D^GxDy(9 z>I5A4A@ne_=?FWWw+^`#pUZ?L@Q{(+!8ilWLk($z+kFd#{f#B?1?XuTaw7`KdI&D! z36p}pkKU22ue^2&Qi@h=1(Nbc27DW{M-Xrw(29ZDzxhHN6WPmynS|ReJ*60CW`t3}PDXIYKC3w}$ za{-{w(?&;KlG-3c^nLDFs@zO4M%&K$WU}2!Gn${J3c$ zt>jw?%ro_ta-A0aAHsRcOwBMxD5Z_O#Ja-5?_>jWVXEEsc?S%i07jHz9b|5c|13_q zl=!_kHhs*B>Qp!7<5?5-#PT!5!lrtcXsVlYmK^PB&_L~Ng?kaRKOwd5u>RA@Ob6+I zEjT~(q{krXF@+XdS}5{ajDhX01(@#Y^s9cd<)zliO#zc;`g6r>)0$#890&QMpf$>w z*^9kNaX?bent<;RlSxG>h&O?UJi{AQJdKRF077qPjwP9oTmaSgyDq4=*kxej&5jrn z5!wK>iPc8`V8_wi8VR-Z=aH}^*ThIZBAI$MODKD)`qsmeK?{4N z$;vyPPayG_s}fth-Egl~PkGG%OgS%p>OKEOAS&JtXcYR;AE3YNSRRE0g!6arrO2cl zERAd=BzjB}3c8IWq@7lwgQmqfC{w{XT^Bm6=R7tff^iqRadaO@_kbo$oweapO<8Tf zp(t{91}a*{z+sP|irTgvSz^&>^_oHrUxw!`n~1GDIBl5cZp`#01#ffKATR|TGB_(B z@ARjM%E#BO#Gy}i`lmHNml8IqsV*XG8YD)B;Qfgw9hjP$nvw|oX(rj3qC3TzFA(1x zF{spEGf56Ov?a=ucTj-XTM|&M>v4e#%#o8LkMYYg z9Y*CYK#?gg9G-kxjQDExWlmHaK{cb0=n0J2$ANZI#(^_!PyT?|j|H5DlVk3R{fCQ6 z0~$Z)1OCizB*EV~QD`AR*VYd>4{vQ>rGCXrk)@bB)2tzT;TQL`xkwaKsq$XqYCTVJ zlC-XGZRnzVh&l$2PB~kN#^$5h@uvp=tNJQ)c>Yc9IfW{2jbFA5cIP7L20(i=Bh zLt0^O0l^A2AQq0=5aaLXr*=Es4oZ3li)?yGqw=(Btie5vL{kT89*pau$z zg;#s~oukP!Q^fOnJ-DRO6i$oI&qg#iwh?^t{d5zOp3rQuT?F53xUHfGph``M#>NaK z>~Ma){3M0RW-`v__HD5_9903T@l&g9n8(%jmYc`+Xcn7te~RbrnHO~@GFs>%`G?r| z2smXY3CXYkt~2;J7emJ@M9(x9!N!-}^-G?1M@0_FxM4d~`9WBCf4RR(F|dw|^&Z(E3Vot>DX>GQ_tO>UabV)rNC2f11;Ne}gzDmO{C;78kOctpIN9`I4IJ#D|I0MK*lc{~@rH9-{Ty0^7tGFYQ zi@_;CVZ_A*^>p1s@HK;FTWPKVy)bx!8Sw=r@`~_-Ah;jj{)dN@hDheCY_Yh?oK`v< zW_zE9n$9y_t?T^usrIa+*$~ZuVMz3H<=P$^Ob(jtw)JM}A|HwAj#3`QC*9}T6BA$M z!Mn+y2@8c=eC;WH_{F zhHN1kUpZn9@ME7>1Re8e20gYX&-k+*y*ux$7#a9DVUbkPAi!ymq#@O~dBB%ACrXR9 znpaysNZS~FddcJB)C2e{RjM(`*7(+}-A8UJ9(*pEdjQ4Hqb;j@Jx8*Dzm7~zT{IBJ z5mpnLer$#0MAHvwIMi%JUN4FEis4h0w{PE0>b zfmwsSpO1W-B^xifMb&PkG!?a>Oh@aqQDrsxpm8KNpayce*wJ(I>r!v2T)bx*k*{*a zCsF}qi`DD(iU*jg(O~-NKgQA!Y%svKG^3!ltSlcxATGdqJud7pwj+K8T&IET6a6qC ze&?uahb-#c*}1nUpEQuzrDMv3q83hc+huC5Fm-?Df8DPA>`Nl8K=D2g7D5(yjFK@e z`8D6ur}5gGY!1U?7X@-c=zfv**cQY>oi8t#>F(VwBd~`O;6(R@l^_$@o$Bc|o8L^* z>yiS>tz(OCf$jVbvD7&31T1#mkSK2>lxJakD{+g{?~K3&amS~l#M$7_(wmqu?`~_=BfHC8w^=>IINzj& znhd67(6C#~s=1dQWA!Z@km&Ay1XiQZ=k7bW3{awrs1jjO2^{&as#}Ho@;1`|$=Asd zO~>=jF7Ui!jSUY%t$axZG4ARb*ULsgJ_d&WGNjUaMhooQSJdguW7K?tJ+2#My=Nj8 zqB>p?DUThw`#h3|I<33MITG6^yj0qnZx6sY6S})50GV46T5211AuF40(qfU6;b=;Y z4PPe9@T$Nb^_~=G{vb#G4LOAEgO)4`|CEZb|BaRX4Luj`2X86hr0yl)Aijf*5M|G! z?T_9@qJJ{A!CZ&6F-Q&{#<{88BPv%{p5@ewO8>0+esfm`%BG&<(0Uuv)?lZbTw;sJ_=jP3edXE_<_4Hbkpm09TYO5MCoQVSE=rmdkRZSK|?5Fofs zTjVUhumO$7F`70I-uS%a7rK;7%?_G?z&J{>F)Gb_ zaTY%WJDt652n?_Dr0z{+I1-ue$D_!OuEh$M)C;NQ@b4WW2U>NV2TjX>T+8@=I)bb0 zv-5{Q6{{brsK?}b$?JeX`a1~-KvcUbHg_9?>TL;O?{uY%`w#KeK-QPvt1UNZ_l-Nf z&{yN+n(sza*2{%V4?K9l{T%D<`5YEi!XRi`e%lttOX2Gix8OP}Aera3v=B&zN_%k9 zO^%$RZLU&M9PD*>z4gA7?qCm)gg=OIN^pR~@^kf}M!(pYwkhI~p_&#vP%(AG>feE{ zq7IdpFP;8~O+1c&dcgN)_SN{C91|Js$I%TsqmkyNv*yztK&V%15p5Wp6h@-4eW}Kj zd^Z>jndLCD==Qk%aNnr$z2s`i6M}_`|6qRTV4}&WCDawC4)K+9jTc3a1DrZc8dEcB z<=ZKR;AZ0a0;RNe0leY{=Fi<3M4PA|YLcwVPtMjYDaG(^baUlJ0>@hRg_f%c17E}2 z>Y*yDmiuK8BNMu2zfN5lEdX|{+w8W$GfKt4b!Uui$>x_%PT32p6*!}FRL412HL+Us zQAZUW^NXF+ms-AG*=wQT;Ni(To556rCWrR1TA~oK18jE(&MqDg6R2xzq2N(-Cy>!%2Ba&~M=<+|qWA+ugP2#j% z6kWQ%s;J~vlvYFfDg+iN}1=J$_!CXU*3Uq^jzA6PEQI#Q*ibA%yteOVs)b3zPfS&j$q3c<& z?Mc1e81>iaqhy!^1+OVlD>T;fX0>$$j3qDYfrktt(>f&Hu0CUk{047h&tCF@eRMQNRnIrbK<*<;MFl1Eu6Vyj=)4-p6Lo zBn&bbn%8+(WNTRWs|KKAADK7>aD~}H3#HGFzbUFpHey%oVjKt|il`Ni0di&PuqAV; z-aH=<5IAY)8=W*Y!nVhoVmC?6$7>AD%0Y}f{sK6RI_a$on+*54Hz8s4?^mn9zG^~P zio+F}a5N)H0#p@rELrGMwnl*1>f5d2g@g~3w6s!|gNNxS%K2kx3!bEOrOQRu$r>2Yo2;QWp9}C@+ipNL^_g}&`pxn95yY?|<98je6_#Cz{xp$HJTbEpN z0K{i_3lfjRe6Q_#COPl}E$n#qiE;rh+%O6Oj}*@db|#~M+rX`O^xC0r=;QZD5=!w( z+NEIr&9mb)Ky(Dp(MP<*GL5mxw>-RS(ymyifwG{*TS$!X-s4n0S_hae18X+pm?a*?Aj@|M1;?k8Pge5-7oi@Z4NM&|q3GxX&T?WrlEIqeAxhzi6-)!IN zwCE7X2>0yHjAGGM-3E1e1jiPA)pFe)Xv#ee(el+9kNaBegm&aSWKsQsJ}TZjw*)lk z*T+v^Y^M3(k{{JVGr@FGr(%5_R^hRLkv_@L_0P0VTfSHooTavMcN;92TDI z?Ir=V8wv#RlfS>ZzJJQFRY4jYcOWpmfA@p(P6(IWvqeigEN6=nYHIPZW3iH+82aL1Icmk3egDfYQ*5gmg@ z{cDXjy_CCE=VG0vY!>}AG>3H@L>sU8BdW5mpNkg0&)CfkC2}gr()X^=e|t%l_J^ z$?>RBV+xZ+CGSCUi*F~{geg24ZVhJGIN`c*!tG9*6#=a86)g$m7-sJiF(~(#hR=9$Uh@ zOzmBjN+w%AAY~?25G$uf?{d(IHpB|wlXr1-H?Y!?D>23BK?~U+u8`^?!ItVYfkQ<_ zr98OY%lMi5S&sKjUk|&>O^b%kLCb8T2}{qoHzg%NYd#$Hzd74Ui(ZM`OM#cmtEh^M z4#xTV{WDpmBX&(`6%vZ&#@f_j3&z349>wLR47xv?oAdr$W%kgn3cRY$b*0-IUi|{& zB27vSjIm&I*CK6h)9lLpj2*Ml+%!y88ZHG(r$B~w+hq>di0Mq#m;mnKiHT^`D7u`m zy@p2SsceSni%KPBT8Ofh6!SVRBGa|V0BcpU%z&g>p5*-8S?U6 zzaR7f?<=;+%+~@lU6UUq0r@mFuT@m=MjmkjX zwk?{Xyv@<`wXfband~LB$t^F=NUDG<(hrLeQ$RfM>|{oXYh>u#eJa<=KqyVj-JnAE zdrLbUkwIal@g|I8qtAJ5bLeWF*KzH}DPF6}d}6&^U3u33OF_AitHyACHgq!JlYtfC zFE1ZQD%;b^BK8UJp4xlVV|FarKv9;L)?OOblD3eaQIs=2ZULCJgepv`l+1}hpvI9w z4ca97y#MzMMTxOQ*U8bI@eAM7_a-=`cI_NbU{PIAPmcROTXK+)pnfka)oR64Sk%#( zh56D9vdLX)a#0mzIsE?Jh?6K*{}NIzg`Z@&2aji)!APGA`m(dTB6#|l7ya-LL4{KF z%tNkWkta~Bp-&pf5!|0q(zkXhTwJ!OgUwA|9rrrEKILYg(3v9##4w~ ztk`q#U0q_osn+m3N6jrUyHcqC)c9V?48Tdu?uTA#qMO@dXEf}akI$!ST029k(-q{g zkGp^9%XNR{ZKK93beG)iBTjJBTHLX>zZW?eSm)|FQ|LUr`^weT53?>V!KIn&{UMAr zy`}L-2AeF*anIphyx_@ES_Ij=7KRqqpJ$zDbSMlV zUv?!-5?ko`3T7s^)(#m{OVxTx(OiMCztT^Y_HG_(BWH;xM)hxxB@-lVSEvqZ_I}$M zdc6gjG|HY4)dl)a_@@^VoUoeVJ4l?7_*S5-%=hs;KcQ#ch_M*@`lvLNl$$)4?H&$| zB5!h>t!S0tif0EEMG@fMJ^9OPn$yQ>t0ik6CtHoZSL!-ZN>zUBvMTe7k(Ok9L7`XK z!}ymgTZg`QPC`x*w*B$6wcj~urU>D0q~dsVcKq}zi*HJr$t9vaGC4xd$p+U?mWy6=6SH|KG|bib4W!|TNl%I`u_E{fAqpT zbqGcjo$=y37xu?q;R^5>JSypnvsmm@2fXTMr@~VqaN7G z0k41V7WGhJvn5WY4BH$eJg%uBt7-FhrQIr~*lQ4fGul7imYPGL67rYsJfu1Ne6{Kq zU%=bPN-VmOjzplTKBqZ*;A%0ZIEIja{QNJD;3=q73L+4NfK=L_17IDehlf|juU7ZB zWhnl9X(m761_bY%f{lcmt{aRgv)#6~N!Sm^K0o)^zt6OuQXZ}MVSN1bDQm9AMo~#A z$}%O)!xJDf*E?*X@NlbLN_9m3y5zm{^fVj}zl49W!n5v(b;k*$YD3@oE<>E}rm7zZlOy z+Dk62cag+nWNK=|8Ww2kysB#6aUTxb$+QN-!I1{C7A&FN9DlKaf15-cx%_MmGV-8$ z>IIa{7lBw)b^20$5gFl?6wKwvr*+(}@r85PWF&=UUFuzNKilFzooPjSirvjlEvVHz zJg*}nLgM2{w?{7iQYdq7Wy**~Hw;IzDYz?~i=3~eU$;i_O7_&ZXxg?QFhBjxxZeq5leNB&FQiQvEc53`F1V6Q7llY0g%w`S^M~mhj-e-Fziz>*^-u^Ql1vPy}jf3YKEb~+qF>7 z*{TP>vHU0|ap=?Qh^*^ckL8C9O!S-Zy?ykQl9lS@Uy3Gb722GP!U-kZUWUip1Vaf zYt?#uawg(`>6EXW9;-{sFqV-bHdgng0F#I)m0U>TYGatjpCe{-jWuTkR-rSa$HN>X zo7^DDcR`T0NT3;B5L^*cy>;|z*5P}tbCGPjIKd^6-g~xF4A&0*sIQDtO8=D}^9o zz|Cg9xgf}VenBhiLqHe5{tBAo-Wk~J`sEabI*iSqz4Z43y#grW!m^3@uG*jHV`1pK zuo@g_C7P1+|BJJ?4vKSI)`xcpPLLo&a0#x#9fAdS2=4Cg7J>vPL4&)yy99TF4({%Q zJHI#k+_UdJcW2-F>Z_VRrY4!1m$iEJ>VEp^r^Dzwq_r!e4FZ3fJdZ0)HQ5u;j|_~5 zShPN%&mnx1ariOer6pFHK>PIz+K^p=QYoqRVq>~&S}UDZBp3|Ac1;!fTevRKWE}W-lkz!`7pC^^nxjiuYN!DlzgWLHS9p+eoW?`6i zk+%|$3Z>@}Ngk#Au)8x!O4ar!(ImEFX%V9WV9Unb%kPP~px{smr5SL{f4?B7o$$(~ z8f-Gw!fG)TR#d+WwhAfHK!k!j4BENhXVsd#jzFo6Xk@hdVJy?M@k|Bp*x4hWc-)4G zBN-o%ZWI_&;rjqfaXAh}_Id};zpOKrXRl2kc|Xx?h@@X?LJ6bYEU5K7>MfSjpYQJf z$2g$p$te4G!~CyLI%W`ni1&ac{5R2w8nWL#s*w3*yf*BkJ_!<%=AxGNtM%K@OU!#q zymLrl9LsZjlPO~j8UFsQnB#By9FvcdrnB+tPbTs@9=jhS!$Y%-59*bU5@;3K-oE~7 z@2+L44Q1|qMtgwX)&F;^0G_BM6*&7d{KC6Le?R*pXm(Cc8CqN|xma&pT9v8Vi2zR* zulCLmUrSr7KxKm))+Rmt{IoXrmh;5YI!V!ni1F^^Cjz(KA!|=}_rx86XQ6s4Zb}N- zCI&;+tjCDDzOm_2-7^&fL!=7Tsm2$p@C`oikzA)wJ&ppS40--{KZc<#wOrvj~ zV<}Bhk{XR7Fk!UYe2_YE9V^gK|KY;YQ-Y4>M>kdK>eBnoBX)SeSM*?8A~+YTl3nK? z=g-)#2;0-GOHjC(UK68oa3pq(1_Y)Wg_0ut<3VDk2d+%!-=`#X(!}iS@#}#qI4pYv5!)CngEoGtB0BP3J8$<-;Y|&y449z@yXZyVV0;)Zz(BjjxiwtJ+ z(C-Dv3co+9fCtm_gx0Ix`ya!g_a@|D zkAQK=1KbMj_K!{Yn$txpEF*6ip|#_@>9=*?O19M`|1^A29%(Eb1W#nrEYeUX{}n74JXyoN_b%?}O^HZ6Lajo94W9P{Oi z*awv;kKg!SVkxvw6%QUf(l)+Gxk6 zmy=rsY$fhCe6;G8#Fb~n{7^|8%ZM5 z_42|G3<^@PvMLeOXozbnWZorX_{~mrg#NlAdt&^{{>d7FBt?^&2qtDI?7)hByv9}N zoGXh+F|NY2+UtBB_H+DyK5?7I@$SF10RFU5=~m zJflP2bNuGH|6J25c0Zvx?E=p^-q=a34|&yBsh`IGZZK*XFCG||l1yHD{{{j5^9c7l zKx+{k7Km}_7O8efMYh_!u+{M0YxClZ3>k9ZeW&-EGgUzWMW9sbd&k!2IKB zdj$wR?0v9R8J23)CO}@l#7?=Y>sOLft4Q?TXV*puo1)yn|IL>t0y`2HXm=g@8Je(M zK9d>}PLzHD8@2kR!Swh1h}oc0aE-`3bu@lgE2hU=SP2N z06@+=31SM0AO;xicynN~RIb$=^Y)KLO#mP2_lG;HPM_@SGtxyvfEsx1c5%bh*wkP& z%a^3JuosuthUAV9gM=wwZo%Tsr=XyK$ymprt(C&Eq?QK8y(9ert=%Rqmz7vrs z<0!@=PBNXD;kOWW6KgBIHzhKFo$=TeYi3WGun7esbG+eDCLTn? z_R@Xx$AO{L=I3=sPA5;^j-o)gq#o4KlR;dhQ~!d^VmVq!xQp3pF+B=jv=)~&4`{PA zR>LcpbwQw0YY8~Rrk7B$n8`d14wmMTztq0D`tp*Rot=F$Qg{UdaAL>D4g2=ibBVoc z=FWl9;{6Y%W9bR*vZ?&SK2JT=w%^vfosH{GTV{S@_XNUNA2quqw68>_^P1apFy8}9 zC~s6_4kcDLmZMt__p|OiW+c=?`i0&Ll!Ub^t1XIR=;Ru;7!?ZCjei0b`n8}#-J2&e z7f`o~y$7_WN`g@v5op=BJKvIYt9x9PVQ$zF>bi6a09oASP(G^H$k?V~6_ zPr}R`8Wiymoi~z_n$zIBCRF3I#r#r=6S5AuCLdCrz&mM6CupwO&g>GF4r#*Ir{{q;f+_*&>v^vA569 zho<6PF((@uIB@|!1>)i(5#;)`Ep?%Pe7pruZgl13=z90(w`^sW4A@eQmQTQZ)x4sZ z&tL=5Ff(xC+NOJHCSz!zHam}lt82^%B}aYlGbmxsLx_)0K~Gf!XUGQ2NM+>r(qu7v4xZ#G+wC zFri$&dgds2$*REaxHHg5lr1Gnl;a+iP*K$G*XH>-kyjYqBGRb0p^tp$t~nyQ<>bg7K+uqHnx6$;rDgE&d8Z}4nfsqU(m1b~1Jm7hUS~SL}e#VqY z>disw)76!;P5X{BT-)D%1>PCPM}P>55XL^%F`PovJQjOl`pvTqx(y@Qqx? zTu(&XS07D~ylH` z175X+%WAeJ@Ye__XZxpN^Qi(s?|Fu9!PKV9SV&7@y|P-t-cojQ%SX9yo(;{Dzlz6q z&Iez!{j=?moIf?SF3S}koD4iGP7lUy!lr{l{zR(8;h;3@Pcl|LucMt+6HrEGy|8L6 zVbR*rN}}GskFbd4F_m>sFJGxi{3Wqn7n59X6Jwqtkm2F%t^*A4(V(US=a8rH`1)NP zF32q}FL!^|hdv-Vr8~Fa%YH9cMf##n+3}*c*NNy3D1!9Q=~J;W^6@Vn)Wsv}SN3X{ zKt28r9{JOID?$%$Ipq5=ZsmURn%k39Ba65_VUC!^A&a6bf?PXfetOVBo6doh>ABJk z)(EJst*@u_CNa0Yv5g-|OK;e_8c}^)Sm;)@^y7!0&g=CgMuBJPgYFj5u#nOPJ3G6I z1i6lM-kPW;r^EMc?q^@4*MD{wz|DdVJQ`X6z60` zsN(lN2%~>*L)coQKK5uhi6;v1kgRhQ&5kL2wr$b}Gqu%dU2ciP2}$CYw`Ui2UpU#> zR=;9HzwaRPdkZ$rE6&B;_%K^L1zdFD+1A^*AWJI~8YZ+~f3KT8v_XIxKPd>{$8fwf z!-1{>y`XHi+C+4Bn@MsC2mRNLY4!b6SS!IaW@l1W6N*ktkiaNPsS^%_`8ro&l) zR>F7;<@l6F!@Qk?WDQhzvJoD;Eoh5&II!+-k78aB1nT6H3fkSgk<>*DmKHS2CFR%jNOAf zD^{6yyP#u0$MNa7Ats|%n_Gy?Eim|0LQ45=tXyM*Fd#^AQdI}IkL;4zT=})zJmR=( zZN+48*q^?kOM?&vw$PMPU&u))MW7(q+VTId?l55d?>7&MMM~TolvftU-vP+@jkRY|6{qf7+$?i?$>*g zGtbbzaUpo>VwKXYqBt?B6LNnckWNKd4_5Jv{Li?d&7&qB) z`SxWtxI0NHdw!^D#ME8snxkAW5D6QfJ2tZF$^ zme79C*=^fAN-(d~cV!&|A97ReC0_!z!V)hQcblA~dP&gPu1WdK zBXiHN3UM|A_geYVYx}?AjzmJM`1IaLnyOTQrT25nSiJFVh}?jHsW-%T&J-J)UsG

    zQAS5N?X?0T%-Z18*}S~G(U6|_?cHrn@c5|UZ)tW<8kdPMMOS^O{YQ1p3yupw$Uen^bx;McOwV| zSA4_wPLx))RPu9&0WdsJ=#K{ZP?WdbNtJ;11U+i{X%d^mZ2kpAjOb1Gd5}Y&4d1U2 z2^O+=t*{cA3k-Tt`h=EkN5qfID$>-efYTU`+Z8+(WFZu*ls_ilJX(&kxy5{_XgYjz zV%}907b|C_<+$n$C~v%G1xRr2rM?@N4T4Ke^ByH~EUu#)=F^o*(I?2GW0uc@qUW`@ z8+Cm?&u_h-&&y$_A+E!^F%*-(_+3D(Vrjn5U#M6}8b_n9c(yI_6iKZ{+>R++CGYTD zcC@*3P#m{`QD?>MHoH@$Yui39hiIwn?X`llqDn`xJ5wx&9;B53;Z$^Fw0D>4I^uCH zXtrZA^Rl(Ojaz>zQf+oA+U}ijDJ3UD5}CSwhm@kWYm6TY-`j3SLZe$(5t?dKm=%(oXqM z_s4Nx-eoZfR@mKGu9P<{`+4 zfdvr6T<2GjlRO{17K9@qeAol8sJwRHgj9-K^v3$WDxuDEL1r$%#3t5z;m0S4LB&il z_&J5z6f&j|gm^!d1yDf928ONeG?7D5<)Y)~-k#1%nWPI|5d9|a{8s{RmGXz}dfoBQ zIXy?Gj{6hI1Tl+UB5&q^D*{gOE0?QHgHEW=gZTo-=rb_kqHHa%?*Dn&E&B20DUb$YjA&ASrFkLQys%wMUJ8r|3Ojm*<{g;y2u>dgk`N>pLBJ+C`sgd(^kTw z1`pk+y)_!~w*F|g5JAz+-+MYbu<8{O17`(WQhN_Y4Pr|#HHWLDau+EM$ftsq6UB-; z@MV~#n)3PFs$h-n4!g!X&!9RJfDTTe-QXs%y-~lrYqo#op=-U7q&-0}TiccK3d!_% zsa?*dQwY4vDE4z~B`PNQL5ts)U*K*dfyn%!UUx{wCem<-x)zV^+h;T#&3xIrFqGqE z34sWrp#i7IUV2>C3l@M*5eK%46ArOhJ_LWME7O%}4*2w`FFyX=(~fSA< zy7JBEQaqe5fC!cOqerW$YhuYhOWR2#0tA zO>Rk_DOD@-j(4|)Z}L)CiOI{>@Sp8`9cH0M)|LLKFUw&4+wf@fKLKWe9Wk#kuK7g}AEs%b0_hor1u%U*jmnTMzK!eV^gq!Q+ z!qc9D^4x-;drzYi2J6!Gmaeup)TMtEI&9w*xg$4uiH2I-H0$;CI@fr2X;|~EJ=rW) ziK>uC6#};s;sz8n9dX6Z86A>CZc5JrIh=DTvlyaj)5kkeUbOX;oS(~17PJyQjGUbp z7Ehmf0=NGYL;KGI^#1kg2ugI2ZRAsve)dZDAIVxW znzhqu+&XP`X->9iv}q~ZGWtGux0A1R`yC#7lNnf^9=|{psm9p1eB<;TH*m0X`YNXx zh4bt$xNMx&R%I+Hg@nYiGn@@1LKb_4d?6t+HBfjY?2+N6L#Ny2^Er}*HXxE#$ml&T zoPi%)9}?E6w9m;f{t1cz)8Ukxb#)&~=T&bmp6@f_0 zuU2TZXq?e)G-i!o!GU1U?s%Pk67Mh9hJ`EHTHX4+46|V`*QQ^z-1-Iv=)6e9nzw~g zQOgs|J&j1%-FZF|^S-AU(zY`?S_Qza6H^l)P`^<}AB*F_-nY|3)PADAnYbnrZ+T6GXpwZJYRz1*4D zZEk)VzT9jGU(VUiK%C~X7|^@RQt>@!V$$K_>MTpw_YLDx^WMpjsH3UUZPB!G9Cm;x z<8x==q@s5;^Br4gsTE{L*n9bgV+n=C;2hJ2jjKeXB^a08SEY*Ahje@^9zeq{u`G$3 zo0Xu1M#tK3Z_bC-$y~C*S`8mII@SkJ;gI8ZhF#8dF>>x%BUjl<+bY<5(+M^@+7o9O zbh8lX@2~c$!E0@{t+YEpKWLb;dT<;)GTm2vmVGJfQuTHRE;h@hkBA4eTlmfL8_v7x zU}C9ze=qffU(h8LO=`)sQz^5GdctP`Uf32HT5VQdpT`8Y&tDz||pVu1(4qZMzUbbSCl(ET4rQYg-pssl9 z1-7skUaejbFB#=7@ba=wHy&xrKxeY?!&EI|b^bH0D4W*^UP-H`Q+EB`waS1*Bwaky z<%DLbe4q}E?x^0&k3E_Wn-MvArStui^(sEg((A}p&}jYp(2IPFTX#RR<$Pt_dZD7H ztfDnKzjB1Gc%RG2C}$4>W2SYgKiUBkdT>hXwV2ndNdRU-+}?C+GVc}})$X7%Rw;p} zvv0)yR8gTeUOJ#VArj23!xp^#RB0zl1dI|348V7zH*}S|lP}N{9N8a@?08SjK9zsY zrP(qL2cl%qY?S;E@#s-QQKaBL3q&%)oE74NM6xN|)QgLY<6^mz%7*gtS`|YCPYmO5 zt>UKDH~gy|R^JQx0eoyS;|0-RL29#$l&jaB6F(7~LxZ0b_LI);L}lx6Z~XWyc@(0@ z5XDK`oWMXzv6mOGFC=SQXor!6_-B}fGXG`jRmpX9(b!G@y1%;+akro7YY&Bp!Q#7& zGV4pVCS{4EH0>&{K#I>>W2num>mBK(oq>pXxPE|D(*#FK+-UK=iuy^%Q&>|&cn*IZ z{m?ARShUvUfQYSZVckFm1pKcX+BAgT=b;`gP^cxYan|u?ivYXS-l}6h`$=w3)~D@H|YPr%Ll#CW&Gh;pVK5pjPZ6@T)kP=LmJ7F zBcdXt>|STV-qhMDbd*IXHvo+wbrNOkbX@!)vPJ_oxj+hREWt$G##H-Sw_TRNAdIVb zEo(MKafT#(ayGXM&s&!xn4co;r%63kFP;u;qO{g&kfOgy5ZUDYMZAV2IlSpGk?1yhg$XO4+dpm3=|_Y7lauPJc74wW&BxKr2DPA6&;<_1M`}k zInL*u&?Sz_Vr&6j-Ndrx@1lSv&8zNjG!gWk(hrZS)K2D)7D#ij*L?E92E9>_A8h6i zIL_2Df6RQ~JmovvC~qHvaB*=J((LU*HqLlI_aHL`tw_-6oG~h^4He54DVLFPY&6Q& zon=GwdGU9YrAw3-6ez>2;)G3JBNsVRO+N(yqo zeDB_NnI-sD1~8(TTw>ev15uhY@&q{05$&DW>c?3LM+s1$>flN&&DKfbmafl(wFeqb z7T{EJ#FBfR+jcGCEp;wlWqAJr(SGytqZ8H}fBszf32lazKH9$}h3V<(f zVuI4mflzLlrA<#+b9l&H*t_JuNAlk+~*IemQU0qR_Ef;y6klNl^R`mwqjSh1%Wj= z^hJdNfu_bRS$gh|C8yC9c`;O-3V~HfwC0BlVcN^XSjVrLo%hIKV39zKaq4%WS99E7 z$VoChkj?i<8(RQVyC?}i*ghff*0Yz(WK}a52kRs4Seb_aEj|mrs~JvwHKr#%K({D$ zD?s$>vpgoOs`0WoPv!Rh(A2fT)Y9K^jTv?mE*z47JbEF7Q}^j|=AH;wZIgu|zx|^@ z3b#;;$v#IifB92NkJ26%Z-6K5#)@O!zRwI>zjA8u%NK?K&wPb7lDWY~=MID0!JB`{ z!)=6EM;qux$f(<*ERve{(SMcNSgqR3?u?EVLrlsZ7q7lS_q^gsfve9x7$4#hR`yS1 z3?p(VaKLnuZ`4v206`a4mBTg8CST7Gz6A!8VxI-uh>9;a2>3g&873c?cRo*!^50oXE@WwQ@9%>FTF36fiUM{ly03)f)y0xUeW2Cez-22 z%&$GJ@_d1HGvMA@5X4b5L#HWp*aQQxJUUokxOh%&)B+N!mb1oU8lRVOL+#yb=Pa#y z{5Uo#Wp8BE?3r49ARhXI$nrJ8awn&Lc7YRBqUU5~smeTQX@n9pEO92sH#_A518f6o zB|mP}t#VweC)(v~EiNq_4ODsPiq_s)9(!rD>tk3iRm7j|4AGX3Tdh=#zK^A13FTPM z`G~h?MZRmg1{<_=CzHw~RZYWgwW(So)NriMZCmFTR%oG8{Ih^DD2AHDTT1{uvH^y3 zIX7jf2*d`>Jk*<(qlxJxFd*#kI~PyoZ53~al82z8qH=J}kl~1mSRCh)c4~;9PD@D? zt+`KV9nco0PGbiWd!Swbw-K$V#1-0zNwsL25d*q!x4fni{{JT%G^DaJBF4o80DdK%v zPs3=ocd8mDyY9^1;rZQ^ywL+eWWV!Ie>yEUedw!2`0TEFBE`qg%gPL@S@J^8R8*|d zWkI5fR-k7kY}<=iT1}0nhgIaR@^*avZ_`jc4K{&e#>Y_+j5a&m_yP{fas)LVwQzP;4;|(!FPMv zbgESRqQ(6D=~Gng9gvJ=-?HQ@IDlAchB;sO(S7(Nz;oWcq{O$(>E18pNCn_MJv+K4$j1xD#+J7A8@_3ydu4KK-(xO%C5bZ3Q{?s!1h=d)_ za57QdI?*|uMvd*UJ%2h9^JN)p#sr9SMJG*1GUdd=V}(8eN||QI=dt1gS_F4D6Xa48 zt}EerBt)ngH+9RU}sSjVWu=G|p6iM}6DXLX_ zjuCQ|)1|C;*sO9sy2G^oA?jN;&w=H7;F4uo-Z6sLeNxO!)2wwes@qVYtvQ4cmWRsg ze9H>C*3IeASgDsvU_4;lYSbY5i11=*;qgA{(K{h$6)95ugl!iF6>h{71SJQi$A)9{ zXuTUGTTd#Bqx@EHsn3-J_f6I8X|0}lsDGk0eVgcu#C4uL$v;+HKYdDjA1gm%1&^4i zo^PXcnjJ7Q?-`YCK6WX;c88FKYqCYW7~|$a7OduGXgiCon^;3}+U~d`{%qu+<%QqV z``tA)*Oj_6+2D|-+pRj8jV&L=BhyX_bY2{4x}bu%pd_R z$6u@xiuHyN4BMX-ic3|m!K_kHcpSEwET&@vtRUp!bT)!4+z3qB_Z?r~i?{{UptJdI zzcQcpSJJFG5C`f+>;Ot)bHHI8|M9~`2wmjuR+PYng2ZS7owh94mdv@a!u^1qdUp*9 zOSg!4s8zYGh4*Z}&goXt-DZCz1qMsWeGaDUQmqbeOJ7DbdC8gJjr zpgh}y6h_MRz+@j?mp1^vr0L+yjima~HblnW1*T_BT@;CK3jg_tLwR0&O0nFsy6S8!^{t>!UNkLJTp|jj4EFAto(?h{Wx5)mgIm@NOuRh`>{^H z@lI3CgBfK|6z{rS?*|m@0HtgivwDo0waOyUUo)8WK+Vu|v7a3N3_8j9># zl9(u^C(Q;L?C>b>&e!4H8r_nuc$q0A;mw;6Y1#UWn$W=&2b3ttq3wcC{LWik?IQwH zF%9A5Kfqmf5tTXNwL5+lz4NB?u}qW<;h# zGTB#9wI4eIl)q&Bdn4vN(-?X)n2;#a&b{8;bEoSMy=8rj76p~-sB0Vy+Fuzr1g7$* z@~I$V#Z&PTg|a#Slg^|@^a3=k<@U8gf1oUjw7Mw~cL@{Hy9s1s7EECY^!bu(7U-G` zdQ2mA1Uw-ebT9YWvL-w4J|P0U`ka+dI1h6>HG=R8ZTApUbNjsbiZ>a)XFmNqZwn0T z({wJy88&K%8z(IN|6zAK)@Q4oBdbh03_NSi4_i~3@{t6V9f zi)UwX$3CBZP1uB&Wj}|IyU; zj9L%~M8Q!`t5R%E+_dJrJ3iSi2GJPy?b>Yjt40gx;Ra?}M?0T3J>Di{@0RIhcaCV* z=U#pXMD-=4aPS587b;oR;ju3}(|{tV!m7=AypOVXuNX)W!rdTPl781dbOI8RBo|lq zwN(&8D9e`VW2kWi+Z@?40sJHbLm%w8a>dk0_}9i3!b{w>uR<#_GHvL)IQ?HWA-VA6 zh=~3wu!PdZeTqFnbs@O9Y=A`Tepr&?je5D_3*3XEh)X&rmc*PJt*C9TD(y~73HiLf z4+P3>7Hltn;50K0f2${U-W%6kW-P+@eRg;dOMk^gouzWCv&obnh010*KbwI>=V6TG zyhjilNLLq`eN}n9g8FUb=5{-iCJw!u*FVTBuhfvPdt+?e)>l?~g21>Z2wVsg7H^i$ z2ZDD+Z}%%<>hA5a5Hcsk4m0PhxJ>0(cGs=m%|G#c^l)Z`(R+Ya)h3DE zgv=VWf@r49S6gs65NNuA^c>)*Kln2Ybi- z6?W+8=FwqKhY{E^4M|_*`+ze{IuS!q8HK9r^=8#uWKr1R)prrZ1m8_wkA^ z-yALH`&MljS4tXJuGIi_w!|n7NYj;PA=g4n^|&4+x!;ydSs#*BMVTjNa7-PAUwPvQ6@&`+Og@VmTvuEgFNogv-U4+AWKTv4e63EDTqF}jPR)5Ty`iidjl?S4kk@-J}U_FBHq z1t1PtbJ)&{u%)hl;}S){W*(G$RX?<$=%>9CN1v*v(6_J<_H=V(Dzo{+rqitq7z;$+ zLt7NiWl4W`|9(qFtWLal{mrHKxNwT2=Kzcf(fOmtCbp1~yE0x0@p+=B_N93~T_@t|8CwjBU3TIpI>~GBVWK9}Tu;F8idbK#wJs zUq8ME0*_ZO+7Gt?`lvZep$O3Y9I%!2u@h^G#=*W{)@P0u(OxEt^Q8Y$-D&djqg1RVQ-0x^m1#R&ot1JA)Fd$zFg=3iHQMLZ5Fc zb$5nw*BRhhid09@`Ou40@jOHWp(neN!Blro1c(C8-w6-rqW7siF5ZRnpDc!caI%&f zqL2}CtL3%G;isU_7^d^$)Dz~zv%h4Sog+6( zOzpv_j)#4U0%uwyTr0)8P0-51SNx*L{PikHcyHV!hP<2SH64nWMWb)3Gh5u9O*?}` z6T!D3Q$p11BLx&uC$t)Ni`QjZiQ4gmfw?`?VnZVkpH>VyiZ^7ut*7Ugx!OXz&(py< zc%M^p^N$fOvP2*DZv0vugwM_G-B(Az?ksueVLHm<2P>a~kZ%K?9xf?WB3w5Ats;`& z0|@~%Kz`IVB2k)(IZ6b>y-23)INszu-RY3snTZGlN$re{_l|*#XR8p(IkMZ|$flzb zl;l!>8?qI`tTsEQ!?8U~67?p0zIB9>Nq?vxc08NHk$FE+=1e<}-H;lJMV~c2L`fIV zpI71_xl>{$)_V!jZ!_O3<5Ta;*~`_3nJ&{qBt%G-nw>KFTRqH-Z^)WWJC*jWj*Pa}Vb1gg85C{V(qpsD=YH?8mGLYmo!)HD?7vk8B)0ml>DjtQlRkb8*c0P_^Z{IPpB)Lo30Faz%QGV1G+c< zUb6n*Z^kg^Yn+Q&k&+jQUZyL#O0xqcG+qLDDWB4ih30Xix$w~8ZLdUpFKmV3QbNq< zZbsoG1nlF@S^N@vJ4VgKMMd*Qle^h+v#u1JPJ;-d2<;kn^)QNNRmOY){(ChI0i0$x zwk>M;;F*ymNikRJ>>}i3#SMla-{E)1>5xm`gO3x#mDz>oV(Ic-k>xm)0tpALcr!n3 z)4kru;k5|)`#kap&ur{4qp?IRHsOn;*I0me*VKbmB=4;10Zf*OR3t9Pul2#A#hm+h8t9#E^-Fg@8V%yR2@#1 zy-7SOV$zN4w4xQ|kL=sRHFOpCU*?~4ds5z%&1$;+OKK%o&pV-Xg!gq>omTe>gLLV@ z9a}uufaphbspK0tn|mMeV6FS_FC01I#u`!@Ep4s^%?j|5$_wZCs`210q~nm8(CE3Jo@%<9NN7cHs9Sp#sCT7({hEA&kaw+%P{T>KkYAb3v-l-sE&}kD)plj zaLnl`JhcN8+liMg^a^sk+Uy{v=CUMp!F>vt15}!;f|;VovzJ(QY9dS#uAs89h){GdT`SlQx;K!q{K{4#NHigkisIX!E}BM(wST7MO6;uVPXT_xG(xL_)@6 z%@7K#s{1;KpNx(5OvarQ&!9_^92FE7Xqpt{x_l`2AS6!UceBfjd7pvX(?@2j!RA~` zvAOL`O?Q~NoiN=H`Q39}fT<932Ab8DK9CI%$@!VfLRsh)q0u`%Xj!LGV+`SS*U9tv zV+->$63U3@RUD)Hx50Xh=9knLPkf=3uSra3zSvIB4Yg_c-vs`hi)kH^Nt}5Kfy8v&VwlB5e1mgx_dR4yBD-%;ASv##cpGNs z)9vhJw8>xbVv8D-6+IbwJ>RxRzX7IkV~-Z$#*L}@SVNg<s}U)mEU&ajgM&}YfeH~^E5m`TT> z(G~;}b^7TnT$@k-)_~ccWJ*Mz7U@|~P-CZTiW!MJ>lVm6gvj-CX{JmoR){Efr3yIT z0W`sn>|s_xQ%{A7D(tr*e?av@6Mkh8MVhR|0j>97prNMoUnc9}uxKZ(Q<4(#c}UwE z5ai~^*R*C6;Z6}yrfo}DpE7F4BVy7Df*De>TRUs48~52{_#@tU9nqvNx2t|!DKJzW znXx?O1*pn{;k+=s6n2HXof6mQfM!`d?AYUvHQN{Qh`GH5=Pf2dS5GIe5Q>St?GV zP(ao!UaPZW(t{fTnNAOXN9no$d26+dP}nI6k?@ffvtm!kkf*^TGKhmp4h|L@&?sVJ znQ{tQzFZ+R|M-1Gd!|rDiNCVObj7EMY|&Ds=mtHGT7^b}2LPb*9CyZ)ZmWy~8GkxR zOsHFRnxN(bsKJ8kajdVG;QlHE{bcC)>44n|6YmJ6v))8%@1+Ycma8)y!iReX`GZEIJAKA>kxWLH-EvXwdvRp8 z0EKLpA*C$ZeJLGK(!V;Ij*-M3EA(3|7o}mp;5*YB~K1jo+ZzOzt%= zrv1T;ZO-@EH%*Q_KQ30MaHbAPlJTNdkE@2{nZDtM27 zHKy3u3)mAlA529bh9adGPZxbu5UqK;qfRXyA_l*bx6iM1tsUsFCEYY-a6Snn(K$yv zP`SRwS4Zk~(l{0iMdVlz#*%4kYsxRwlrVkGYMS+m$EaaWi^$cj4z}(3BDiHKfepE` z#V)KT;FG=8_=u^k>>rznZwuYmHaww>j}8?Jl()Jm<;L*2-@BHxl-1ZN`i(=B&qw6Rcu)aoVhYxN zlZw@5*6MgWAys=&WKp}3YN@&#PIVGTi>gwhEf=;E^L2H>iOvpAo7X;;wEGSda{A&n zfk6y;-j#esXw1cyAJJF*OPw`(+c-hNhe_4F#qq8hk2?WOTIotpM3#mZ^z-t$+?QLp z?k6)c^Q{&*+Wej$u1I{ptxwfx+75JNbgi!|h;XLPwTp!&2z@@0&uO@NEtfT8v!rm! zegZl_dzPJiim=@49LU~0-lGo;Brk4}W(y=I<%oiAUtf&(kI8o98ovzNF`J(9rBeQG z7Lm_MqrPWsF;$4?zQyWADh1)#E=~t~J@uF^RKYmuoqISqpJPfN7Ahnho6s+vayz=+ zo6IvVUWkU&ru3<4sPz=Clqp4DHIDK2!NDA4C{a?eQ^eosY~7d46kGRq-S3?sjt2h^ zx2qoeUPES}TJxaMap$`eqho0ERjsLd=l;Ms5=DbVxBR5{$JS_~QjLA6&(kAn>EeRzMNC$j{@eDf zj3HICZc|}%U_#@W))1NOQxa=pJY$L&&;n|}iqFEVhannLKro_U&3{S{x1uc`vFC0JJPOs4ti#t`C zOjBLLoA!}_hddFfEFqAN7JCF7z#Si{eYux`_T0juho(}f{7o{Bj`{>ac8L4|_W5Ly zYrfT#5sUF-z|%sVXflt=)!=mT#T}mQ&`{&#bKG^}QyZ-=gTlKXi6A;1(jBchIbMbs zXWvuV2~SEU)X|cN_dOoSxfMZ6%&9yc!9}cQRzG{*tQlC}PrxuUWQfv|e3p2yuks%7 zny>U?x_raD_+Bl0J=y6 zBwnFWp854?JOmv5zN~i5Z~EMDxvbk#EaToZSQPfE_Y`LP&Yi&;Dnb53Ktb(Ku{2CF z!c_@sJN{o}!~gvfr}dj?vo83s_I}>eT|uK*yiO~kGc|ajV*0BeKc^Lz`ZgXIa)S@> zhMf`J#y=&T#}o^9(swYZk0Sa-)CORa6zQ+Q!huwFMcEc+%EzJcfJ!cNRG6FMu(CMy zV=5|~BuO83SI`8|{AYGPuQFBP^EnU>1b$#9QGoBdv|XrF!kDfQHw4(hHL6x0tHp!5 zN*d4iPNgn`GiB=INyf(0<>X9y8F$1 zqP~bs$O?rGZoTD_WN?sA)=8gNwz|B;(d-N&EvKaNxk)>Jjq{_$Jb8)7!@DcZ()2`u40!x zxLtP`wa{mx7>Y^f?SZD$vlJNZ+Q3{gln2|j-6D=;NiyZw_DK*9dm#?mTq zY^wh)kJtHrQ)&Nti(>)?D`8}BN6gmyk)W0TkhX}bq}5LEfChh&w;E5aKlU)#gK)BJ7MGcy^n>URy`59Hru2fA}K4kSxh`9P} zr5$;D31643oG#BmL8k8-w%-Nr`L=w9;re=JOG*R#`!y<2Yvz(LUFZ7MrLhme1tH(7 zM#iCv|Hs%j#>cs?d#|=}8mqBwPuwJpZ6}SbiQU*}Y}-1RZsV!bpuN%Z(*?f`RWT4Pb& zPIl}?&a{P0!f?W%lqoF8jbuA=xVib>D6Ji+(p&&=rCQ=Gk*Tk%%QGC1lMipiH&Vdl zu+pq!S>vM1{@gTqqra=#%G06Dvd(@Ouh762KTz$+So zL;o~gqob92|HPQ;6lbp&or~A~(hoM3%N zbH~Em8sU;8GnShQysPeF{o)VmOr?XXY4x4{}V z8EWt;U)wf~2R1eMG<}Q}?=G&9FH0>sQ8A>Jlc$O}2{8G&KfGhWy1q)nCH} zEV%Gm%N;K{jn3P&iV>w8R=GN5t@ndhcVnwNnr$8Y_|y>m%=PB$R^08@tb7F5@=`NN ztS*&=giRxxnR1%!u}jh6PvROsxkw-~JZs)mJfxsYYyJ_F6pV~!G;x}8JTf+?;>4vB)#9)dKQH`S{rYGmYeKG-ZkSs8F5h$? zOc>Oc$gdPkpxejhrs~SV*Gg@1J8F~`pw)(=PEsJ{$IT73PzLD=xpw(N;s_e#EdU~3 zfdRh7{eTxQ5Q#YWpEzww22;WO)sqLmtr1+cRUZ3)G`Dd|#3@hDDq$VU=M>P>E9N(k zynffouLkQO&{h8=fe)vnS1neMjBFKLdDd!F8Ls8eR36;CpOy z8PD%HYbOl%2CR83;Ipj8y?X9V%DW#kA`O*;hoBa+@W#d}x%3^`!SEa=HeervoZft+ z7vw{*FHrLAQOVL^vB-1BkcP4ZnVjnCmV_85j) zzsihqnA>%^p<`YW)N*&+vMDu z7kg6WJn!o|NjfSeCcti=A_4B|%KV5?Y6sMdYeNi;#+*T;Hj~(gr=~5?R5-)(qdxzj zS8VO^ma?N*)aiKF9ND9mN2<`S#UiX1loDSYv~qk_E_*mBbU3 zAeYkr`50Z5`t~~{?S_rd zExAm7x5jY{yUi`07fSeD%b7kJ!iG*Ms-7jgZoJD*U%id~pC)sQT+GofgdA$nl(wfqLlh3Q~I zZ}E{t`nb3GCJZ0e`5PJxVsU}TeNxRD1IUx*2C2rrlfM2iLYYwhX2!q6Kvf6)(Ka#~ z>YapVMbF8=WSw*b#Kjj>?s4FJu3w24!WC#FDdXVx-^K2Xj;nAi10t(o??3yT#>#RHjjgIUir zn%@`RE)boLmPL4WGs?^9P8O9vbsL0(goDlY#!jR^aW-l;=H=yK(nw~|QPIT zUPJ0N+negvXx0jTVA@z3EQnMIbtwgS*JM%ubm28d?_kuzoN8Dhu>~}mk%{yac z;LpqrR^ek?$a-2>u|)|_!^6indz_^$2nihMbXswCziLq1zr5Ir&^Ex~xwFwBrD}Ib z_J#pwJ()BSBSJfEZc`u5to-7wy=ayP(9zyG5hh^hi(~stA zUn>{aOGVYE3v;NcD_kP+aV&;@@nlJ8%&2;NuIEta_Z4I_+C;}*H*G_n{+Pz50>`&0 zix*eP!nMtM%dg6`0;0XkBU{v*ng};s zr+^QCO~NC8c8i1u+_w(HD)10HYl{@Cc+YVbm>Qw}kXCYY!(Ow0Iw@QNK>e@8{f~Eb z5V`M7CiD0W%}tM?>si5&I+}_wPlHAwV+weSpy06r5C|zQufl#iefhBA#^FR!T}jYM zVA1vntCDzYkBRD7xyKJ@-G=?@s~euN{LF|14$HEX+FnM}dhy&r0W)bCeSNe=k_e@t zsE(-ftuu|3L&Ow|v@;+ehTqM#`MV3g4UaP>KSX0=EhdsR!W&9*T9O!Jd+q0qgeh-T z=f){}8EAx*6=Tw%83A37gjbF;jiqDOD?KuA`%lFW6TC9sot-Q{8kr1sc2pR+@50aJ z?Dxi}lHRnaz+nqRCyQqiCakdpUliIu-r=+1-7Pbq+gRoke!MONm*pI0r))W2mDHWe z3lhD&nl`RoTyt4f9b*>O%eqU@>Mj0GTGnEeoOnVt5Eqynq+_oBMM>$>p*HWS7Y9Jm z8;40C!*aB$qO_JcY^pF=TxKGnkH9mZuOm(L7BgP&(u2blK;R!F|Jlr`OI2q}3H0rd zW-! zU~Zu}qZQH0D)n@Nk;h|Xc3aheUTw>`Df?{QEw5jHckk0YP)@*y-VqB+w{G9^;c&W$ zaqVe34Sl&oEYkWH#J`5sfjQW}Y1l^;Kf6CUr-K$Q@^{eFY7$WEqUH4^5XpBkll+nF z5KwaRR;eaCI0HQ*Nieq^duJWxoViIlIG9X*Xoz@d7P zoPBix{YJvWb494u=pS`FKUOSjuK=5HB*cuJVb$B!L*hAGPh0dUka3!GZ+Ev8mjC*J z{ba$##%0Z$RtH>HzO-AlpwHR0ZFoNMRp{15ag=M2Ln@$v^y7gHg_=oprTR4ylE<1? zQ7}1<8*47pSb9FfS>CUKyzI8G@b%9ND)rlKfu+T(97d;L#!%AY=2Mi`9xA-$BJ~02 z=`7Db7;(lPq}!uE7=%b*RGF%vtD%v?J3chVK71Ae&F7h3@HIw+HL)<0UzUVd8DNe1 zz9&#Dwm7?9($Ux)cTA(Q$j;cn6wMh?{|?>7R&Tj>6xn${jLV^nD_)%?u|LQSh)(>T zUIx}w&O8?{mQ{%zlV}=>I=Ke^NaBz zml0JlTCd9;6S7PgrBI zNg+7J-&6CWNVbRhUm{|Y5D@B2GYa4*@r(5>e?2ypYQ_Y{v1~BcP*r!?HKBPo1tr70 zE6PKVj^hdjlPU;KHBZ-}vSh3=(H6!QOPVg$+zbb8Q_%nYs+p5CH$7j%@}x;>duDhr zG(sASOsoI#O1&>$hED!3e-Ro!Xe8^)R|`w|iitqC7Uix=Ig-&B{)7~O$wf=Ep_nns z+vNE5Vf2rfIw_UpywUh=OtiWE0gVN36UkVPO2}|EMfK=RO$^Lkoe-Wf{4)HVKOD@S zOu`}vifgrA<{8N%z!IkBKs#VQD6VK|!Ph$NVC=~@NyX>s(ZOB-apnsku`w9+CH-+NWC6tnJp%FwqTdnuE%$i?BG*wJKRPbdx= zNKc;uK&Q>tJK}s=%S!b8AxX?GgqY?K2u9P=m-S}VJx za^AV!e(}=x&gWm?{+44rx{cZ|+`}LcBQe08h4;=S6TkA1^VTL_acW)q;bhowSwY;hyi7D`2*w-Qg-peO zQ;+{3vL>30N{gwAv{AZ6xrpnHHrQ|aq9C^VBMKS$U&Jvbnq#Q&t)^$nAjEot zK6!&CNK$=Xk3Ps~JM3D0TytE(XJ@b2se{@4{)0~h8#{$1T3EB=W&P>8%EyN;`s~LY z!{x7Oel6iO(xS=TMOU#SKvxmoH?`N`M$LjSUuoWXxD}?rAtmPJG ziG;Ofw?FM*_JCCr=@?MI|3paTJ_tiPCDYQ}Z=9g7$YHxeQNw7g!z z(!;*#T5Yn~ARbW6@+grHdDjoCM&cZ*Al>r)q`M@jhuL27gx%=0)|Y$zUjKTGQ`=VA zVmLoEHd4U^0orgN6cRDYIj>RYmT?3yVvZJ#D)-z$!n1a|pSW?mY&JXVo={<> zdEqY1)U35BbDU_lg}t)AnV&SXpTsBOu66^S=NmDkLVutE`tbO^*sj@ndl9nERC53` z9ymwyXMz#Ul!nJf^ZN*&<@=U!pt_u-W9%Xp?c1bia1*X#{jvT^J5b z2Fau~(DVc&q9D?_SPam$tDkRrKHfCVv7CY9kopUk+;p-+5^Qj+wPp+K*2gGVO;LKD zLPKVH%^5f6E4N46=$WIpd&-kFpKn1?1Y#W?BBAHP&W^u+5ifmgJK6uOLMr0SS?zxN zkQAbqK40}H()wY})aLn@fC}KQx@-h(;#uc5BR!r(__KZ5DrdMNoeb|pZnsdX!^lZ3 z+(h(V0jgfOu7bjH%j39CLys2uo z4QKjk`a!F008FC`Kt9xcGQ1<$^qAKsfCs9UKda0?+z#|P&ZHlW zMu}mXLE7SVnqRd@r;@Ll6n^;xVSa;;3Ga}YE}f8*eW=ycGQtyP$$MB@cF=aW9;;)o zUQk`E%kHeDt7~$rE%Q*yRK4x?XFuRs8A-(MP~n9;UqF9JVit)PBq1#dcN&w3*molL|V4 zL$TaA`0!->;GNg6QnoPpkuRxr7wi|xX`fN$c8>CRuyHoE)DyfPijB6DZf#}N;8trG zE!hY8Q15nN@UUrT^yp@vLfy1JSGoYhj%4*WL%zQN4u79?*~}2j4b_F8n-!Y@JnTVo zX_al{Yh!*FD_Zh}2VwC^YVty&3>Zn8EF2?GHy4gg?bVg}adDv6^P39}pl|a|Aubgq zr&ySvy7tvGE&P54ryixLg7-o6##Gz{uhTPo-mUgxIn zWo3wQPLu%oY8o28&z;~O4=xwB5+~rmW3eDi^tv@<_#9S6E4+1j?f0*I+{_{sE7PV? zC%aw{dldqYTUH~apQ~Tzu(FEcie$|hm^`~XS-wbn?e<&CqyQ8Qv(G%{BMz=N9VX<( z?I?u@Fx%_)O&{w^47AUNrrj0B+9_Wpk=9+1>_1T@9P-?yp3=@`F4qEf8(TPM+8-Fj zi&AsIjdCSXElxExxAGrVfV`|`f`Qw!LbVN7DMK(FoQ?yBjYxCeVRlUotTWHPyQID{ z=#c>Lc!VlAKRqiGQ4dcWjW0ekFxhX{+Bl&k2luG33#~~(1}){gIp$hTJ_|1iQJFE7cK81 z!gY@{ymY+CAeO^Y4fNFlT(9TRjs52orCQyDViUFpDD3&d*8Vbqs(v<&6NW9h)#**;&KqAq-Kn`7Dq4SWLH~PM=7932>LX0xeRcYlaQ4th>bOP zKweuLs~Eq~la`K^#jIo)-)7jgOr^`fz01h_PTb9jAr1we@7-+LEHeiC4x{VKxH3cu zS#6!}+K?49({IGIq%}@y4}=ki6KMz31-KM^6TL|y6{<=|jE_x9DjG)JtT}Y^)Z5+J z2|wCat$LzuY4&qA#T7a*!%serKhv~~uk+;&C35U1fy{f)j>pRZ_>w6x%!nDquHndE zH0);i^;;VH;yw4=^AdnzK1c4BQeIPV&h>-#F;#a@C|+POMP7A0BH7;jWZT2>$jmDn zxBlLVTxJjDr=5mCe=Fi_Dtc;S9uH{X6-!9<_0}%a=ZBUhWrle^(~Bh+G?L_HR3DSt zX~hz0&wjuIWbnLd`&{}KGZq%+pxYyieuQ-aQFZ0JQg@CkR40>7*8?W77 z8bD4xLn`G(>=8*lni#u#a9xGgWhrXKdF(e%>>(0bsrZlo*~vHaf?x<^3Pz9s_dTt| z8z{<@G)NBqAq!#N0@Xi{c5DaU;7%NL+2&Kv)YBK@zF6^pv?1+mmfL057!Ek~ZTFwO}^fhsz zK-Q9qbnbyHY}>cT3arx8f>rl>HmeMCvkocdg-2~%H95IWEY$z2pYjKc{jps-M;B#-$Wvsj|r7g!m6t`Cp#<|7z~ZLo63m_iF(> z>?Fmd3%k2XBxPkNeKwYRRH%q#I*b?aEG;cBQ044-%p`{y{E7?xbv>kUAvD9jcxIT32_fQ3jpX@F10N@R!!HX6#hQajA=|iObf9&UZg{Kzm4U=xU^c(AL3vhR zXX-5+t zHset+R`(Yw>Unij0X2%Q;@7$dZHj^rc5!k-O07c%Z3{dnP|hsZzj2cP=fVCH@13PX z$_e?z`g)Y7SNpc(Vgm&wXVp?szgK#j-IO>Od|0~})T5Zu79+m1gE7V*H9z?-+ya#~ zOtVLx2@3qi5Jj`=?DE0lH=om-LI9^ndvFSoq7Xd)l=A+okBP`;;C5rgsMRJGC8rwJ z<;`vU6I~@p%>h;`UP;FK1Pd!EggJlcqJFRG*iSLUV)+WPfAw>ABucf&ViAXPACva~ z?}h(a;hEw8e)T~a`u7E~!ELyZk591;2?>rBp*&fiHI}$!7^*?%at)ytv#x+I@%+;9 z!?uhoez8EwQ93KenJ(TxYy5v_!AJFW)H9>>e1)`|joCWqG@7 z0SuVm{Z^{IR%Kp{M-$s2ITd zd>*&je!5fSe}5ITGG8aN1)Z>1lyZgPEYYDYEorf%N=k%S`ZC%+7Z@9tK4>=KxgRR# ze|GUmU0zAM%@`^0+H;5uVj}8IfC^}xt`eK3W^PmGG1c6A^!468{3`sm_MK{^x|o82 zJnQ(R`~U=-VK$Otwd}8s!6=mSmWskXInymWPrkQZoSZID#U~y0& zJArItt+uK@_KS;D!Z*=`Em`lyj4y7R?UFv&YoYzlSNSgUnMxXq^Fl=Ad~u%bydh`o zWXNW=5U(ERBnW5Qf*(GlI^)yR(HA9`zn2`QHJ=#_t7RElU-K_Nf3TfdK=J<{TM^$z z$?TjT&lY7@eShyOu`B?#*GN6b@$hh$*Y)=ONUNe%w=Q)4)zVT)>$?eG)1GG(`eZZA zLP|S{ziZ%~hH{VjS4uTfeFVZi%mhnB&a^-?@Ey@LFS*_F))WWLM6C1o8l+%*d2ZLZ zfW-1r_*24B{5wu;RATIsJr3*qKq=d{R^LXjgZbj;ybt5jxX*>G8y4ByWP z5Wuhzvx`vlM}_v{_){{~1(xrj0D_@z(^RpVvg}%wChW~ldI7-fcj${6>zxCE&uM4(|o4Urv z+|NFG50{sYlwxAg)b*g3$zR!045gq08-8o#`G~1dy~PBRnG`yMsmL_Ds)OAC_ZsOid3pXTPhE0K4O(V{rP zwVFtV>Q^NtuEk!ywm@#tQ9&5y4^W7O)ip_RaZUPsV`1S1o9W9v2+la%eqeYxW!7Nv za^Xg?L#T&~(q)%de3If0&3rMG!oM=!{Kx8EliAl98!k+QE{VGZz%#e6?NBn%-<_;P z9mo)?W9(YmJhNDf>YrxoCzO5;!s-8PW5ERTpNqRwCV6Th!zjw?y9yIOeF+ zm>omQNzccXDPW@bIpfRi!8Ivmx!GKrm@jUE7<#UBIz1%XGHr#Cn>Fgk(&|(#;DiLs zQNp^)9~5nqttc!sot|b-qvmAHGMLcIjx*h&u9Y&)W2w0KDHedU z1Jny-P-1!@lDT81)nX(jjT;6)0%4PY{zXTIsX2@`tzv#&qY1l zd+-!^>tv}N2}7$d!E&2Ol|U*_Yyd(jyN%DO%CTU{W&D?9&p7+B$yLufddtqF99=&s z{=1$~N(*`Yr94gtUtah}+`jHqdy?`Q4=q$9Z0C#zD_OFdViRTK5NgcPeKdGGMBTwW z><%yU*UL}DqZf$-5-B3_T4pc@ESj?&F$z?|qAyMl8eTUP8;mGOe8yfFC^Gmn?Xwe9_{ zjN10@VaQ5a)T}&70A(ekFQz!Gbef48HQu!3MJCk>kPmPJ=_P2Q!`zy}2BsUJILBvc zyq%rBkyqYTZS&*vccL#D5nN&evVD`ELG5VE)Sp%N>RS;uPjXX?lpOys7gx8R5_KKZldmggUL(yo*+Z_=~pMz&52+KX`9)} z6?mc(k@MaENm0lE?u6e?ncJzk1u)Z$@?obvDl@DA-vbF2EgCrFE&n4EeXXo*K4=-7 z&ue`l}LuoKZBdB)M%MuqCc#9N6S07aU@A)7l{LZJL)S7JG zAAkOBj#-DkZ^DRgg<2PG+~)<`a*0Ry@uPi#3nwlFD_yC?C{?Vn`X8i$%pL9KfyhhM zv38{RHXcNI zBZ>u@1qX`KT&Ta1_PcM4sl|B}#6d>u@0_hDqx7g=H#mmchinq`?kqQ zCJBlt{b~5(-Nzkvh$A~7J5X!|-W#+b14T4((_17$GH>zu^_3ZRwcmTy+QF`|JV{>K zKr*O``u7Odp^2j$&26GlYYN~olr~V(T3Xh+0CT!yr6t#Y1b6q##Tq0;%utrJj}ieK zFRFAPl9FPGw5?Hxx>m%{=8eLT6^#QS(d)b;S1s_qtUp+%QM>k10a3b9WkWq)^N+7C zG*Q;6>8WD$vyKCPQc!}@oufq9q4W{Ht0mcN{{l(aJBzX zqBP>Ho=7EODa-~ZXuRE&pVTq;b`_6<8iMS!N@Erid%;>;XWp?*47hFos)YQ9??2Cf zon(fs4%szuhDCtEjG`2J?ndOGDXEroLF9y?zgK50RoF>{HBEiZeWe$Ej_hR}jtmlE zXB7#dVlZW(t{D|J_|Xr@~Loh#ze(CCJ^sSi4oC@xfgJ&0GNBY3UN4w{)L>;14Q zsW4VdJmt86z-l&r9l8xVrI>i5PFF)!n%?P*v=f%Mf!z^GW_3G;(dbnA)?Nr$UY`5~q zcLyA-0C0T-(dGhz9b*}U>nNh*Zki+YIFDnT&Y|90`+hD$AuVY3*U^xDsSS{=(q>pw zaXr>uBOU5YWRlko(lOkgZ#}%4ID(?YTxf=XP)Hh5Dw&x?A;bJ5CChy~X0=vc1lDww zCs-*dR84Vlab$?S7;Om_8b9eL(E-JlJhsI!Js|!)G(yfdUw^Q;HEu~U6{QCj=aP34 zwc2-ELSiQL_kEX&AZLm%Z0Y5$Rte)^@w$uCb^lhGG(mno_u(rcFRFC=()s%OxPbjZM9mvp9)~+rQDHLy?SgGWxD&vBc;O{Qm_@!DOX02o+wIO zCE44)FVq47XfyENnB##XuMpy++?=$-%Dug)3C9I|N!Yg^M-+$n*DN{&ZhSJQTw0y{ zYg7IlnFOB&j&Ws+V!=~}75G{|)U{Rm0Cu|0Pzl=Ebc<3=vIFIw0UvC9Z5iI4-_WBA zyZWi&gQH9SaAS409#FP)AFHIJ!^p4Cn$Cc^dW&!Z2N+Usm{Af0#JgTlYWz=={@y9J zW<7NK{ahj+LgLqC$#K~zpeLU95L+ZJbBMb$eB4e|2DdKS54-!?k}WZD=0Q8qE-I># zUG%SWahgb+>1cx16Yj%}I^32P?vZmD!yts1B8RI>l^V^a3?9hoQHi{vzNJugCN>kZ zdb%unJcnyp?gn-iX&9fy$Y4lD-udw^!CKc;81@3ir137tGa0oJCbeVCtsM|W0B>IY z*C0qqy51>Df{BJ1ib4CEsEF)$9Uf*yT%H&_XM-FNwz7fUkm6%*!7$c+C6?+iI(%*) z!Nsz?x;T-JzzbYTR^s;(9mW*jCRIVAF^dme8WVYyjY?%5Le@5`YKf}`VeGSum|7`vJ5X;45jG>)>G?duO;ZpgGuO@Zgv@g&%H zvcxRBaawjTT<+LkfKmLN+XT}oyh1(o#6h|oLETl!WPN}}66H9~;Cwiy5H=~GLp{)9 zKr6)D)8pp*DI32+hmkl1zZ#v8nmr98H96+I-6nHz6lN|L@iC~z{u3>ttqMgqzj5Ed zFv}~+HhNRhgP>QQ(LR;4{uE^;Ap-;BP0!o@2Tf$sk%))X z?DYn0wHZYiI7p6B+qwWSVu_B#bVCv0IT1>ffyljqyrdBe@KTg#s7CF&EigG@b0Gie zokAhc*9yQjYFi`BcbVhIxo!NVxb{{Ni*eP`tT15DUP<>CqJh071u5L9`8Ot7;F9|r z*YBdn&?Xn3nQ{6JKkR%-v8v>$nJna7%4MobEUTb_QfzWL&-^)}q2KWYOKhlTC=t9% zdGcQ53CF9**JTIedKt>JqmSdY#b{L^&E1~XLFFhnyr+-1=U@p=gg}5z00dRLvY9Onb$?K6vYe&rxi&1i^K;|yrpmU{C1YtgSboK;{ z(J{fm6h-Sx=esV$`kRRlk92unm_!G02h9OEqL~~Rlm|z4xDSwlBxFf~p1pqDEw|@|uYv%=2&A(npK#2!qR~bW56iGOsC|ab77kFnPKN4ZhvSt%~FCkx^RdH!nk{ z`vQZCR(WAO<|*R*)MN!dUWUWGfyTZYQ%!YnmkMaXf9xi5}pvSPvf$<0hQ6pm0m zJYeXW{-NYfH&;-gV4sk*Awx-w>tTANx{`H(VFbU%k&wE*w|*<~P{_?s(ef<3&LQpL zD!QJ%OH_n$%fcP?`re@`+xm~#Dr9)}motjg-dATNjtTIP2-uZ@bu1O(hW|#7*f&b% zkM2}w_ZNY64$%;caZWSmW1E?|JCVnm!Lj%_ftGm=X-M|R?nD@aOSqBZLSREf#aR*8 z-GlFGrf?7w*>R!)>8fHnKE6>BMgk%%`_0+GDMe;KBgIMJ5ItVA^%mW8Fx!F=V^zm}X4$pwX`jPl{h^?OAH!pm8aUV->f zJ?;*RVXEE&bK8QtL~tZr7$zu>H}G5{6nO2#6@floK>9N`6^+tFq0>poA4CdD`;KsNX|p}=I&C0r-Qe)%BB!$(W?M3G9CzDX`6Nnv?_&QE|u2NQqm7^ zxy%IV49Wy}N%FZbBI`<&`=&6P2K*|Dcn|%NrPN?~y^qhwEEfj}RJuij2LxCtUv{p= zJLKpu=rTStA8NaNCGDObBKsor>h*Xqu6&{i&q+`=%p|YBRh69{;1KV<3BcGf3TNI^ zSS{S3*50n$Li{(TVc@R8KG@bauV_m4)`#bnjC_YfS~*XQso_p&m<}d;d$ctJ?)qkV z=Jm2c%P5&Va|R1We@0GURe z(l^4fOcqs3@*mR`1stYW6?X6^+UPm8>M=%)1kMu~?0rNGs9r^3G4gn=CDdr)>DuY( z+w4Fzo6l1nt(?YJW@Vu;>5*>Y&G78f>N$i$tt;-ejIic6s~kwfH5jalEoz(om)&&}KCwE9n&!%`BMpbXSvp#THLO>~=5vJJqfo<fuSI10oQU5t!&vnH6oS>avB&~h{jtj>mF61)lLCn z;z>Raqv;o+I@`qgwd0|54?}mSrp6HeYZsqC#}3?d@AQj&XER~&Uf>S?7V2H>p~=j+m*cTxId|_ZDzdobE2pus#%ZbY3i3#W6!nsWzO@L$ z0T(SOZ1WSUU}jH$Ttdb}wMYZPBsr0ICd2qxPQ0*6&TJS9E7eYM7vyka4{?o@5-S>)Dmem9hMqg zhQrwS4|Uc*jWhrIqjlW3nmN&x^bevHq}A8wO09X1C!)}Dxmyxx#ntuVW&2;%B)xdv zzIYhgfRPJZTuuXksBQkEQ- zTM+c{F&)|*dwFRKPP*ozepl=)7vP(0U$2s=DhIeirgm#?l?Q6J+RtgGmNpPFL%sMr zZizaHf$;}}8@~v;y7T0)=o74B6=(9pBQ0b?{b%hfwAR|U0ki`-%b$1*h%!RuVjS+> z=Absum7E(J<6|?4pYXVf50~ebkz_fz-XXrj@Hy>(YU1HN<_70et7bBr)$%+3Gt@ud z1S{5*%90c>r(TxryZjrQ)Lp#d$2GW+xMY;9sQYH_)| z8QP@K35^z*Jhtyv85t#1JmIwlhExJv8WA&^0UD*K-Gf0i8_jxBsKIG)p8(0@wrgbR zo|4qgFE~KtN*3+3fnBQp0|p_rhwDRO32-vnw%ZG41zdLYrpi-{*a`g3WnCbLs7dG& zkhcKb-#gSt;A?ApdjqQ#ueWfFkU56@{tX1}ZxF2{xF=tqr{%k55$2ei{3uO7?DJ{t z_=;I3YB*P}Q6_t|n}*VlS!bb13p}!%NS2C1L_|kf4i!Z>5M$T`m6_x4XE(tJZi}Zm zpA;yfG?FuutI(pZ(Z=?})&%ow%>820r-dL&2jhU&=#Q5Ygvc;VN^PSn9bXMtG5}~| zA|zyzwXRExi^zLt0yG4ED=Xg*{jaz*!lC;;~`EnA^Ju-i{2shu2MT|aSfKqY3L z+ORn<{?TQUh2BWTG1cKQITdFbx@LK7g<#0WscNINbF@c()pxULuMUg<&B8xWwn>*Y zL0vg6BaO08%tD*Mrt*@z)X+*R@v}*P7?jIkZt9SN?PPT|^g)?`32udigoGY8tR=5d zHx7BZJrb<#IUudoVDCZ=nWt_$ton-(c5djpIt(fm1O*;WNuyE0s+wb#i={4_wj*t;KiXF5hrKT zfu`)?B8;*kc!*qj%=+)cO4D%{w# z70`SPJI{7Py0tDjjd+xhlt_A?oV$q%cYeizTK@^d%Fn<3S%{i|8Uqm?FIAE;)7)=2 ztsd67TtapPy*p3w^5T-nlo%{SAD{YNgq*yf78i*#3G<+?Wp7q>S&pGHdu<8o)?zd` zS~lD7Jvb#Ft}`03oc1E+9LcRY(AqB(umx+;xl9laF17p^o#4e17Q^&WsfZ}RPU5@u zD-h8t*A9ef>W!j1o;KRsr&{}}S$c&EVo_367Mgc%Wci2&FE$m-MSf zD3GgUMdNpLs5r-2EujPlvOWig`?s~B_a$>^Clh~RKkii$PN@aA?oo&f7TE@5VXmwK z&0tGTP+*+u3p*>JzMHJz@`--@4;sqkECd6EY9QE}a0MDE)rG!74mXloOS9jnM!CRT zO}3Kzr*0at9R~#%&dWFNxYdC9{`|84Ei#o++X)^HZg71(sy~`g&e!*y45w)Q-?c;V zBfdQp8RLHx@<=(oFzWH&e;gf{nimAjwKIya2No<{zpV3=f-Rl-1e#bYG}V=|xHz3O zFlXwOf%eYmh}TmoAdI`VU@)0U9@fJa~}{BJD)q=Y>&_GTUD zN&P0U7>SU2r}YX)>u%~2f(;VJ-vDH@^U#M@?rBB8Cza)AQk$0!J zi%qE~*M2=#O9R&Tg+CvR1iKMV5gPnQ_JSk*RlBJzFnOZO>V@kAe}a$z|HB-iS_;Nv ziYgr~4cl1l{U;l8%se5%e@gdRA>e2s=}ctVsmkbXmZ8EeXlRD1Sy{n~AI0ys8>g96 zEIb$g#?RujCFLXozGXY#*jrdh$r;YgHAJf&(~DrlLzc0R9n(p zuXXp6n^pPEh4YB^sDA@u`Rk7NU+ZjP)Nj>=8G6pn#Ts7E5?oR@L@P5>;kzHT$*x%7 zw+^1X?&c+Os(V|;S*ZRaKXO9(+V!z*%1+S|75>HK_C0Sha=r}sqp|6D=Aiy; zuDCaj56rf%kGQrHps!9veeTrC`H*^RZG zce5T~-jj~dNPxvTnodbQRc7NX!xBBLKyzm}!U5aMl6#Kk@{OfXsq7Op)H^Vajq}|M z`$1z4tuc8|s$;N-Wo&SR0HjNFd0X9M;-Gl0!G$9A&3TrEnvHc&YnWMpC2t105ldTt7xPB_UC+!fx#ziQ0?IeBIC``m^;pKod+L544* zj)q|ec@m~&b?ZDSFsKT-I243$O(%ioAzc`%kdugReZgYb<~qG-6ZGb4aWOsxHdgo? z3E}CI?-FD`6Ev`75sa7YdP`I~Qz zek#M@tkOT-E}*p?jd+utC097zcop<^WKl?*t?|#V=Ra;#6Q*8DUxxn5dZ8#Nm`^#c zI*4){sTSWlD;FHXAuqPuHRPWcVfUtLl<26#Sbo2;Y?Sk>mKsrg1T0Nw*G{^T%~Tmv z%*l&w9nH06XS{H)p~lswMiKz@Kl2VNGCv~`nzlCiAU|*|%>h*TU9zZHMFER+ys2L< zmIB!m`(Xd(3eBi|wky5hVw|#1xd&7Q8M=_o)Z!$3+q-EDfRvnv@HlJC3uFa-$2dBg?_FtV7!ps! z0s_Bh=!|U^ncza;fa%_5Ebj{n3eeGTDObQ&?eH2J8tfV?k3pz$u~ek2anCQ$g99sC zK5$P&Ur~IY{oaF{iB^psv$=w7wK0#KyKVtN0c^Dmw@Mww#UV5_Az(iL@@l@O1wu#s zSA(t1;^zDSA%Ee)p`oeGocf(3iwiP^>NPYfx-ry#e8TDR#Wz@HneR&vr7(aRA%CI< zs7ATz^K&h;WTqFp`V)YHF;O|Qhe!R|C@vI3t_vqZ5qMbPnW^CgCIifd!X-~R`+nU9 z2Srl+=ex?coGr>dMU51Y0NEHqA%89oA|nR>KDEOb5z;@$>oSBd7_O>`A1CWQ{%-ro z=)q^~|MB+KQBk&QzlumoC?Wz(loMzLTk(`ek>o#jkPQyUv%M8sp> zxZryf+BUK1W?wmWLI70{4}tiE1m*Gq<|c0he`v6EZgA{DPzPj2n}XL8e?3y8&GpC%L@bZQ;%dL86Zlk5#zyJBw$z&AglN>1ae<|1b()KI6 zEHx+`4Qg(L^YK?5(uXJPB+DP(%6c&HkUG@EE(tGZ=LPR#@$Qww4D^fiRZ|8a5-AEI zfCudQIW`V0I*3mj>b1Jg4ylqyEwCoyxyL9s4*a0aAz*qNV(GiJ>(vUInD_@b0(7R| z2&S#wJrF)%)N*)z%L2z>aURLN^t33>fbnn<0EFy{dUb;ey@}rt6i$=7VmxQ*G)Wn0 zUCgFl1~WRaGd_Qut%I?$Xc8#6FIBz8I%KLcH085&qq$yZkk%S%n=UB`7J_Zg9qpXtZ_2)< zm||(3o4@FgG?(H*pL=>RzH3kBx5fS|_QxI9F*1;#W(u;r_FSnau*>QKo7~?rs9$=X z`lDyOrciB{^mAVAcN>nSsp;uy7u15A>>#4m<9kGd29Q7rB!ceOnF<9G&A-(L4i>0z zTd(6Jdv|XA!k0&H<4nGOzmo~4 zU@IDP>-@r!K-Fdhnqr62l~^Sv#xo0EJxV4)vJ1>iiy6{~0GoVf@bFw5M0o2D&N+>B zX-AE50)yI=?i-KbrW_U-J=PWUAVguRMCR5g|E2*m*oe3HH^rU3?vCa-ay%z%S4E*y z;m@ILl`g`q;)J03XryoQBPzwb)hegml>>!481p{|#%3aO*ak^WY$-4tTF=rSrT35Y zhSVY364-lE^I&I1-x*L2V{V-Dfx91vnwHSbzBP*_uWx`xs{M_RbrA=Ay3}IN^s8)x z01;Hbc&UKH4~>7S_L&$JALk;>S9@JmREqcoim@uSBm;eg9da!OE-bZ6wRz&V(iKb$ zggWWA+WVA7mM&GOq;H*~%OK<7be(CIL5^iGC2t~ZH@u?SwjDIg*U0Fw*v-SIGr}J% z=yRqeGhTsfF9tE_cS12|3O74~Y86Ei)0pQrViX$0nec2!l>|oaii_e)wPw8?{FjRVpV%2% zvfD+8I~b8QRT~kbQ*o8hdb;NQ+ti0M$GoK(aomy~VR5#KO|2_e0A( z-71$xz)kUpSgxT+_Rp~~KWdMw*RU7vu4oY3r44p5Z@nud(eo5T4`Wfq2kmiN$|{M` zl=35DXElJs=5De3&2zNBDxAb6arlKOzi&-31~JL z@bHERgSt4_5r4{#&}kUhh?syk5J%YsAvnbU=@*muB0Qw9=r!o64QJTHPps{lgWJ&)-|5yE3J- z{m~ojxA}B=nV2z%GflFZna_*MY{NbqfymZ%BP66-U!4yT7RkGxD20Xv|GQYdRO%S( zNtVVjR^%|U(ETW=h-d4aYFpTxSbeoZ;!9%DcOgbeA`e7^od5ur611uk^dUqfV!Owg zMp~teFYfzyqN^bCl+vH+tJ~FVp5o(eCmLym3G1C4z4K~v8h?|0Rzw@Fg_dqRNFY!F zjW$IphN#Hx=(yE%v6*7|zQ&{8;!$l0NxL@6?n1Y}e>iWjL}3@4Pqg5Ube(L~)0(R3 zo}=%LlI6oG8!ffL{8gn}JV3`t-LPdp+vF26sCV8)bY6iY@+JLCX5&-?T2<~Ran%U6 zaM^6Scz*2M<2)M8?27vqr+^r+c}Bc#iK&z>s^|qhU?S`$xlgTxR%cHQ)c{Bs)7>lV z(ZG);MRZ}|(fJ2LZegQaH>w5Zy5hJBz7PBxXn@yASDo%PtgG{U1MiR9#TMldU#d*V4lKTRbB}Q;KD-Zu5ePGj!ehss|iKji2%G z@i%7Pey-wMauk8VuKS-CDcBo|+RYhj1KY06={!6!30ZDT4j;C{Eh8PVR%|+dRm>Tt?5LG(tPY#%BuH4X5J1#CLG$UNpID(zKx>lr&sGv+O!@ z+I~iye20Af@K8yZ=;me|$l)lKuqdBrQnl`WHf>jfNHk*M6;(pelredPevF{v`kbej zq<>^%A`2`Bxn?3{75CmenZiF)z{n!Pg-`e3l^0Z5-**SB)h)1mB7U3aJWbUxp2}c}hpF)w&Q^A9ug*CX~;p;0{MyW~2LOMu008 zJSh1byQ1)~Vy=OSR*1vrx|!QTGspP2zbs#Np4)nqM5pJ;>_&;6tlR%MDbl@jo5)LV zcX#Iv3yk66>L!j#WDr@96bE?Tz4{R&OM@D%oo=(Pu)0Eq7xi_xZBW;%2x@`x?Zh?j z8?;S2HXKdy>ic%fZaR(3$4~~sq?~s~KGmUyJ|Ej2)^5{$%lquetYriYxO}fTrGsv% z*?M*pa$a7)^p(g`qm5xMZc@E;2F=vDdl3nAfGp29)*(7ckT@o4moxcX(N?c7<#N`$S;yqwy`(#$3zC@1=3dK?B4Tu(2q7RgD z*xw!~5DK7T?^9ZHqYU-{B;5ka=zbiTe8J)VN{*4jLqi}Ax+Speg= z=Q;qdRPe4(e^_|K`i*KiTh1oN%{b%cO;FGZ6;UzeO&-^yn>*4l;Y%_jpGZwMWLPl% zE4=6x6g5zS1o_dpEPL}9nh%-`WPTe>m0w)m+*!byxD_Lazvvx4ji~Y$48sPeUeUox z&Tf=Iz>8Yp>2|goE8Iv*k=cFSQjYwkEttORQ0>&TDSH>ujTY;TVYBZ%)W)Gz@rma< zkUR2bdtzjpro2@Sje=ARkXvA4t=hj&&f;+>`va?VF|#&5lOmw zL*WcDyJ+G~xSZ4NuM~gd<51NRCgq+d8}|Ntm!KNRu(f7_b$_{C;A-(bn4f`B4LpBN zeM(9wVDVviJdbUzhWDyj7rF3#ZRWXzL~@N+22e9uJg9B>Fm|#Ba}u}VbIAgC}nvw!UKgEC@(@T^y;@git=MURO^dt z-*Mf5zpo=Ex;blwYLGT=z$#^S_eN0k3)oYA*JZDZsOxCov-qV|(kL5SeaY>%VIw=7 ziv8a5c07*@r1hfL$I-|ZF}C>C)hmT~q*sr*5%&Meo*Na#J?2PsXy5WZSiu&nxOUwc z`9ViHqmx&s4))N1Zh#l#4$iv9PD~=xUZnfnFsvFK7XKhh&L3$T-oAZEPb4C)7MSu$ z4h01>1vU>;yIPI`ddtLWoYMULYkX?g_V(y$E(=W-sfBzcgiQG`C$LdUQBmBqg1RpP zsD3F;?Pnbr58~^}j3ikl)=W9{OZY2ELJawtxVrTWwv0TGiY!Hqp4S@ZaEBLG-~@v6 z86)biQ)+=%QShk{qqzo;a7LLG?EQAMIa1Q)kFWF#Ud!hxwM4P0iJc@nI~JIdp(si0 zh=m1le0lk`dxj;5B-}<@{p@^+I$x~LHizbsFB{F_S!1H1SHN&;^a>{t+9zI1{TIzQ07E0-;<)W$XrlR7c%WWx-&&WqdbbV7ABCt_~OOi_) z2p&U2&V*jtE=i!g&v+mf--F(GBKqqs~PzTf`HJQu=^Sb2YuH7CQ=S@4s|sdm?J? z|8T0}mf1r2iwIE%)*F-8Npkzt-S*n4hF&{&yO8z9RF$#BOpl5yVk1RQW((i&2!kDN z;7R%u2{*@fwe36Vty_lPIyVcwYYXi*DRr7BFprU;L?y8zTSf0FS2GoKUGr7*`?J|4 z%ZX%-St_(NV!wyFIT!mO@kHqfq4DUa zZR-zY9^>ngz}6D#XD2MkE_aPd!@!QJ`^E(4g*7GWLW3kkSq)S^t08^6nTet_aN5yD zTD)l%L(r_bB=q@Bj4QRg@E1_^!!8rd7H8}BfU53B1;qW}^F-zThCTxK5 z6+Aq+*01ZS58|dd`Nh;8N4tz+diwdb*o`d6=Y(OwV~; z>L)`$tVl>U+^$=dg4?Nvbyy;z%;4$z&Flqb4jh+;*@9wm>ukTOi;xWQ(mMdB(4`b- z;yaxQe`QQGxQ&Shm};Nw+&ZY{u#Z4XYrZ|L(uXUxh>eelp^htGNfp3L-o-9?{H~i3 z?gccmz{6KKL`+5>8@=7j-uSh8O3Q9hZ{W~T7Oq7?4j+_pr)od@VSJ|k;l9EbVzT3= z;jk{RR~AZn!`yqCHxkvG^UM(MvjaEI{jY{GU9K~1l8x_rHtoYTn6vNU)(|tM}ffX;86LZ5^s`U6u`9}hz(&hnb^YXe~j6z0i`Z+#^ zZSZUSWZ@IMQcR;1$}N4SZcSZtp@o%-uil^vTHAIUNDs(3{u0+OURNz|`>No~)eg-* z8jDNdcZ+YqLv6D^U&*F9{G6WX3Rr~qrkpxZB7GXK=7J_IMwKD!WldW-J{+>bSiI z%qS+d{47SN;v}wPe73>ZeCGz8f_>dCpSpS(!Qgg^K_&9PT+v_NDEV!n7f;>vS~_k) zZyow2G-9WgbZ7kyqG{9^7t;;zDS$_r$m}uZ+!=W5bx7{<%+zv1iv1{c=y4a62z3#q z=~I5i<7#i8?w!$ROrU;!#6*KeB^+)(o7Sr}@^@IQig$8yGE?!b82C;$k?1+oMdWZn zG}zU(hl(jS0xe1txlBE-yo;{a?&zM9^1ZZgL$WJk_F{a^GZeadeR2mnpB-lXaBC0U z+GQROEm_&BFNPU_z-wGZ_3Yhwr-?|XM4Fl2p58)RyMet4Gz@2r$wV3&FE+5iq)3G~ zIy&gZ^$((^b|XaWU=y@V$h3h8>G6o|IXDds*497Detp(562*7@gPloU3-Pqt&?EsBx z&U1U`t%P_6*;IkkKJ|~nO6XVX5to6bw@bKwXaOsQ?r>04LJ=TnU#>^kT5t#fC9;9v z6eD0O#QLdM)uhu9{>c;uVFff5=jTiwH}>BL+Av!%xt3+>0q+x@PNz7OT-M(fx+$!s zlSbDXKmF)MAM{B9WIn{*Fz86#Ji@F(K;!k<@>yauO>c8t>er|Bh#m}c!<2LM?rn{} z1LI`US0yw1JvXbwtb9vz}(f5AGGcLZHjF>x=< z+pRXHw@cSuePs!kCr^SnsiKeG4ji1m-Tzf!SR;X9D51mEKT$>+bx-miL5*ptWqqal zK}{O<19dKOWM`k**k;)W(4c*Z#&<+fr#5!JPaYYgQH5*Q^5&E1^sy8sD(C`oWuzM? zj$u_!l8;F=F3s*s)9FIPHv{p>YOrBN_Z$Rja6+EHRNPlM?wwXVy&Ws+qHb$@fxVaK zsu)f5*~t5>iyv7&t~jv#7*i1A_M?1eKCE<(X6Ab|=8hJY{V*fokZtuaC+lc~?GKzC z^%#16XMPqxf}{4EXtx4AFnddJE*e$YZV8R5%rx`5Yf?n2m=<8)zL8-4odEC_hs#4o zUs;3kxicXVW8yfn zS_kvvZ&q;Z9~elSdl7gx&`g8S6O=rzT|HKOvdi$2RyG(uV%{7A8-5`=xF9;!dDv-BpL#`Y%*Q=kU0tfmN!v1*+a-ODrE6ErtIQd-$|+5V~W;r>uM5}x}~YRaaljnPmv zb9Ra5npkcVvy1L&AOjOa+!zX3g<5`%?ivF^+(TA+)jKxM76&V6ey~$pTZC6?-7&`iI-*Uc(yR{4#fKX>j-*~V_I2?sbBWKfROz5ROUx&KrD zj2U8;ehoQgaZg+xx@EUT5_8UGh$1f?ZpsEQoe9EXVLps72k<&B`a}bl2mOP>72fVX zJu<(YpEkVy>BSw^NhJ}K)AI6dNE_RM-a?b1kX7mflPVW}D#c+=DnrwWO}1gya-38E zh9nljc^_7M?5)bm&i3Oy)6}a=IE`(GUZ;fBkrk7PLPgz`Mc|mHV5+KguFT3Ph5&x5 zN(YtdVMk|x6RMpCw`tBNtkB4oPbR(tXDE6k=d#IX|5wVR@H>Mfm5*L0lwqypAK{I;0;|Nij z@Fdm;O5~_Xu3=M|@}cB(tE!!xyDR*Z-90~MR;sw0XP7GjCXazlkaZR+hOi8w*1bM} z0t^FkTe>8JJli@CGnMN{tXt90b2BT)=TDT(#=PVLt`PDIBwcA9cg(o&Ovj^BsX;!K z9qpbS9!!t(18@zUgT3*!#~h3^+N%*ofx>#TIspjsJ`?=Hz7T7p<5JB;2Rt+XS^ zV1rOg$7ul#DTSa<;7XFKA%Gh=x8QFRAIl!1X^`K9>Vq0>}$a8jnS=f(aPdrPJ*{#UOU z#?3Mur|)_pN2=e25i)Jilw@A;%={D@?4MCd?3W_DB&M={d&j26(!9L!Of>QC*=8sq zb^!$VXc#`p6gsNO-F^<+amlf1%^!OCQp-S8deM7J#N*;ejL+I(tC4w9rdM9OSf@p3 zp|fr}1JS&5Vu4#m7JT{)`iQEZLwoEV2Zi?8(71!*%Qf?Ay9forS0$<-Lo%#6)`inM z*o2tEU>DLM|B`umo}puZp_};_dp^&!7ILo|38!(Dlx}8&jR{-7#a^<@ZFZ2iAb2r* zVNm(4TAorh9@*u-J=ctB{IhH?=3;n%NgJUQ@8zz|d^=^j_x^pWrLss_bz&y7A?NL2 zJ$w9bvK-Y&bBoqRwccnLmg9~u0u?;*e#ML0`zJxsn6V)I^3bfRGmftlU}l=v_sAs( zx9Q{&Q|QNbkE7J0uW5V9X%?e}f?`oA?U9sVw{fv#k~mQj-)}uGq-UgCoy; z{IW4YN!^w`dr$@Z1n47=dJi`8 z?cll2wft84ygu(Gzqiq!TCCm|NJ#L0Mgy`N<~9hhMn`Q~*@lQI`IbKBFBAe=thf3* ze0}Bvwkzm{iJu%wjQsdQ0=X|7j-h0Y9S4MU-z&|zEwY%ErV>fXQ_=O+GJjJNx({DcDG~cg&b3 z)mb^8!j#T2GAUI5b}M)Z2xXfqY;l^R*x|Aa9ZY(~v*4(#)WbwzK6>j8lT6naf#lSW z8EZv6HmOCT<$~U0Ume;i2U1PkU!*Qn1z9GOvdn*4)=|ja~BvH>ADB^4%lvy z_9xcgjx}MYVsU8aQ?YM{8&cxDv^W%Q^gcHOI5WwxRQv2)qZ`Nft)YCC?U7)D(`EYT zzGjl8`cC%ZX~amrf!W}hUI_fG9SuKCubk%Tx~DBq<+PRJ(C!?-K3iwScA=PISzy-3 zCvVm}oVFAE1Fz0U^N<16G5j7rxzCuq^Gt|b$Nzv!j2*mO)OiO!*O6SF$X*N9xRYPA z{nD{XwEQ#Qt!|-%Ct{;jrE}xKm%75hbl6;OrrLt&(R7(SO~;-lzZ3~Y45BNH4rJ(i zLr&SUZ`U6jxf9aol1@aEbgQYjCu;cgSbq_@wc(;97I0d1@Z<#zeyY1YX&5_8Vr_C7 zdxN=5xE4d1C4rZ}S2Thy7TCl|1KRK75xD{zE7`Z(M*fq8evwrY&aG8`_~7U}%qh%OA#2W_2nqpx7fa%N{hMeTyR8JSa;l(VV&++Le$+tF z@bkHk=kvgE)uiSZ7z)DY+iO`6gVZcP-ufkjr9vc@Ze~ zp!;$A5-_pE*Q@DcS1|7#KWg;=W6^I3f)Sy^4s&e=)Rd?krCBFKF#Bb#ccT;UPe#|m zpIjU*mems5E#@EG&%<4Kiu(W**CUsR5!y zdzEz)e!h1HG9DDz0}`yv6EE%NW);yO_a0-$S{U(?Aw<}^wuvyJ%q+LGOI0Wn_KJ$oHa#-Hua0 zKw!P()v)HZ4)8Pp+RKo{b87kz^yLqN-fgEx-&gYG;93JJ_z5q;$ zudLYssZ~L$Dun<`*U;*4EPdO6Hg3mqscQ2^K$Bmvt4r0!&Y5IDJz@YecBikMU$Vvu zUaV2PTYU|VFUC0R%^zp^c0#D3RbF=FrG;Wo;rEbh(sVr>?POO=lnQTGsu!Jqv_8$n zJU<+JnJVb_RcaN38X+V16*q_cL)BzS#a-c%5p&u z+D5)9*Wp41F{cCJq**?{3#?z%cAq2THP7B<9zc6nS>>&a8p(O`5ntMxE;aCqPN3LB zmuY%=B{A7J%eQ)uyC6@qR2TgKtK}j2@>X^uHkd9J0VRvzJq2bdA=6>&g+)TKmm@A! zZfzMMbFa$gqIn??xvTvE>5DF17l-Wm!{1oYo-FB5Sw<(f5&N}Vjasc@zOz|vUrbE= z12Qeup7fui8FM=?2^?B3qF8w#MAru1VM3{rX|p`Jc6*ut@GMODdi?&OvCCsps_XT9 zkk(Jd`e+h@$Bw@QXqqgV?%Zz=@n%cn4yE7td6ki!@6wBvUv;OI>*YrY`3y8Po5G{0 z&~}faeKT6VTYS`tXAJrG&H$bO{o z?O6yBP34(jT;DDV`3_5;Q-9IZ&EFs)rQHQbh>e2vrQ^0E%;!K5>KGOlR(I9}6R`8~ zx92_^&Lokf+i_M35gog!z1sD@0jxKI?s+s8z?*Uk%&A;>P}Ycjulk<1T~#>0B%WYWK&m*d!IH)Dd$`U@ ziM*T~C)JsJPM=PxY2%jYSW{+P6xA$DeFBZ~eBhl3Q$HTuu8>qx9=pmTD}d5ddv=JE|-veG%t|B5c~37MkDshPAo_XI3VzjO~^Nsi}#kZniB ze5jeK+f90-`zqs10A!wqO1!U!+MHoi;3o2`mfr38!T?I~{E_ONYV&4jEY_J~+N%Mo z?*q*Xg~`K1zjQoP6r~}?N2wQg?P9R{6%2W2F$bT`3R37#)c2i@x5)AB=);xVnv>cM z)9k-7yP16odwSOdgLP;r9H*pj2^>95{|EI>OMHT%gq`o4C1_M)sp0{@&`Oi4GbtPS z)X5tjj@7L1Y-Y_=r}jD|Vm#BRW`bQ?;0F4!{;a1kJMG=(UBPBBJD(#+o>%;Z$H$l->IYzR+O-8#&jGRMu1*aoO>wbxsGF= zm`7}n7iQaKJEwwg;0dX7*@;vb-8y-5lLdwgNgJeo6Ve%NeV#9Y!*35^*0*~4HHr_s z&A1TB=CWg)z)p!m;HJ(v7_)N9cIL+xGJCIegpt6-@pBtW&u#xX)o`=;E{~PH|NWjB z4TjHTiCZA=??akduN|X>9m}he2vUpni_1g|Aw?(SWdpFwB-bC9Zu|_R&iy)DEuM3$ ztY>Xly5)YK-R7NQOY>e6l?nnX542J!E+_|T`4;yVg3_ih>-q057f^vUY`|o8?Ibwd zh_7^q)q7KXi*Zdot1andI%QLhUDaQ58Y zompaAKS72hI@5DVsonURHEjr>%4Te(4BaAds37}x1cxZJ#-Qvq^|g*ltG(n7K*gx= zu~Dxf5t0=rp|snJW+u(u*9z+u6TdVW5g%mw+?|}%0=NqwZG|=@0l6Eb=W;tWJ%N^R zmr#~cP?{G@Hm^IFV1Efb)RKJ^mS<7_@#x@@o#0O<=gmC${^UWe!GN!>JsKd0iPr(L zdU!eHwpcsy%TXeHwK0i$KYOoPKV(n0*|$|sER}Kc`fE5gjJwbRYA<@GllHN!5d}bZ zZLSNSEY~RpTvAiNy2MMlEf?Th3b1+J!^_plV?{2S=-~S?ZJF zaKZuQ%fBPymd5qUHndOr7^Xkw0JUK;%xZX(l$l!dkULHN5$ls)!WE@ z!J~35LwC)d1<&e(pDqbDZ|6`V*A*>iJ;jGFxrPOOrjR1AEBf)AkMu{YF?l?pme=dD zjN03uT`u4kZ8DEIt`yL^3OL4lvjxdVkj>S33qVN(>gDrY_Ow5V=iqKD+v(zwvNPY! z!fVLS_j@+M^v-3ACp*HNcMN(O0G(%WTLgqRD{&=QdJJQB^N*0CGIc)4#Z|Z(!bk8K zw~t7LTG4iPeYNgV@e-RMbFIx(&0eYz#r!3_e89(_BX!Lx4Sq<$)HUQhz#_;h_iDnb zL<*$i_jw{gA_(uUE}P)9ua8g{^-Bnjr1MMQf?W+#i5FCsCe)Ww-kQqJY&x^t32+y6 zqvyI$8GFs+ZmA#KFX}jKc{(K{HawFsr-Uh1O_9;91Seg$-iLBXI4}_D- zx3;@7YNHROXxlkGu{@w;md+LpMb;X{4Zx$w=8H!#@I_%#tPABm)?Ag8vrrm@i)Y63$irPskF&XK*b{m0B%wq!pkv)erT1Pjbhx&2aw3)l)yB7pJ4nFO~~zbtg`Noc>h7Rs)(g|tA*>>*WV(o^59 z7n%aa?7Xad^HIH~+B|VR|8PG$WN{I-t~PabMwK6=>gomxBUKT>u$?I`*TyVh95mWp@g?dtjAX5 z00*;n{?vFg&~$V5z7qc43D3LukE*D;ljEP3hl_UA9nDyA*5ruVa4YAT_C-{eSk@(( za!n=>c9U&;RSWie6lpywMt z1V;+rZ7ieWJ*%05@8;T(O|E-^ReHO>v(GZU z^0TI#bDPr!1w-HLk<<5FI#f4(kZ5YjXwtA;@n`7|w*vpmTO2Xl{2Gj%3d*phxMSPy`hs5?-g?lb%yc({=>g!KwEP6@^FE2`XKw`?<+w+ zn%(Jcr3v$YB1X56e<<`-{tedjJ|u#tZxtTm%+xz*DYh2#tS^6?M6La4x{&RTbkBPO^->&%U?RR}z0Rf#TDj~+X zI=k4MoM&^oK2xwIU$|nO!xH=0SSAvzFDLi8<$PRzyv9n6#i*_22fEh_l9XLv`?-1n zExOOKYJqa*OR`Ll-=?`jn*lLfm3NIHZ(n4WWhq1%4p}$jy(LTVRiuvIUIDc*W+L|% zn(t2hcHO_;#$<=R*sVsS{dADcm&ng%nlt2G74g8ZXFz=6c zd}DV#tP-=S8~Pe35^iR*DktFN(rznM(Pyub`9_09^`$i0sH)Sk=ce6qVa1$IjnYbU zmi_}J|J3liqByDIc;(t~sxJ})@#veG*wXWFwClUM|L;uaH=!ba$6N`Vk)&M4=f{)D ztb+Xq8oTAkisN!H%Ya{7`1v2>UU{xet4}H2{HI<2<7fQw822f))e4k5)pq(T|2CXI zJ^Npuoi>W2sn=3jG5#~@DJ(Y=_UG;VrvsL+O8fMV4LS%R?#HE+`=a+x%k}R|@;_tv zxrKq26_Uz|qU|rNME?=B{aqIP^;(tf}r(gfy&wkSX8fG8SYaVot zut`Iaa8sYay}vKJ_#yseRCxj%dj;o@!(K;cV-ntt?+t!J_}?x+26~z%k%sx}>)FO4 zPto{I`$3jj1F}`;=>%Ste8B?z^5KyFal}6>|)_)0x@HOZ7j{ z)~Uj;>;J`1_rBbr`!A{KO}h9S^O8c{LjTl{J>*~9YWeB^G2{QcssH|;pD;=2&j=pO zsdWgl%kMv|>2Ley7fSkTi9=g;Qy>4G7XBk4i>KqFIm%-43C?f#`cH3Z#c$9}_o6Qbkglp`<)*sp=Jkdmd)!%dj}NT+|09r>VN z%PN3mr?-gsk5l{m7cmnUnA7Vu%y7y7lEXrA(30cnDyP$f|8`UYY~t?~mBOpU{@X1M zC8n)le9BJG@m(a;N`z zt&LWpcI9{3qgblnDZsG_4^4xLXz`Q3cd_2`8#kZIygz}84W#?PbLHo%pXIq%etNr5 zYXM@t@eNWhRX5b-Ep^y?qA2@ibcxeprQYcoi_U7X#@Efr-TvJrl67dH;sdG;p$9e7Y`QrW zE_R7cMEPlVv$N-sR`4vmhcVXiFJuB{d2-%&h9WpHq25X2v_cqr;L?#{^VjuZ&yke~ zpMtO_Vw1F%X@i=USZQc$Pmc|@t)f$98g}mqKW+7pcJx2U<2B}$Q6=q5*5B1LExq5A z4axd)X4iO~nHq^UNyFx)ftP6)D20JV078%6q%AE*X^WQslVeQ zq}>Y0ww*sud?J#(iZ#tYXWbEwbuOc>`+f*sEgFk1i<(1n7imqjm7$!&OHd|iO+I@V z1pPbXjIK0FLU%L}c3m`_z&_}BgQ1;3c^5>qQ`m2}`X2gRe)(tEt%Ov;EfXPZGcPS5 z%18h5Kt9f-Hww1DCjO03ZDT^l{CDYwV}fSA?^mm%+<)gJzhlzSD7m4-)gg+tCEfg} zv!XrxZyDdX6qLi!#!gc8vQ6Xus^JcXW-2R}Umcreu-liKZxk^1n+JRad3yQNs^#W9 z%?=hcQ!ljQ`WZhlF));NwaTpcKX82-8|fS|^PoG|cp(|x;I-2HY?`XdY>u$GJifg& zHc(N|bZ~j`5CFK_PAuMm#~RaLCHXm3kiduWM=o{S~xgcdCqX)B3z)bH7p~(#!j58*?ph*OjL5B}g;A>}j72 zD}Qd0{#dCWnC4~}qG|7?Npkd5sAe*iqrDR1%q=;x#ptEzM$+L?A;LS8FHlf%^h0_wq8YEa>Wp7)6oD}7&z-W;ukYdIZISLSk$=DU@?iY>ifTY zVt?tjj%4A9HSymChpC!)fPp8#ihgWN1)yCJy#=H?O?OG5YQF4mky@IyTP@Zcei^Rt zS`B3?pU=y-&+dX#yq?X%)GSnoR@>3yW7`-`9@TQEM^Pu^+2&Sfy7JdkY%iKp|7ptQ zYkn$kPt^rRMg5(-90l=HKL+E5TG7)0E8o-|&9aG=8@?Elcw8kLV(JN;7Ji{s=EAZA zZdD8ZY(v7E^!{7+SEoVKrdLv26O#q1Dn;t7i7SA`_}n4Kf$s1}Ujjm+e}Yo#Wg)5z zt;I>wxBP7J&daqlo4OMdR_{*uTe^6D(pjw3l});wQ_`sl8ytkJn{oY}?$P#(?x&9A zSVmLqf3DZE!8)EaVm3Dsc!{^#B*QpHM?VA<$cH1s`^&Z?H5nZRxf!^{7fuvfrz&XID&EKl zJ2_#S+5A2r44e`OuRQOe&Qm=SU_3nw+-&bgu}-u5TM;^_^2_b|LXj&Z6L8vk$Ce6) zKJW=c*bI{YW`hS7caRqn>_KWvTW)R?1k5@6z0Y9}$VaQ?f3n>i$8!AQxd){22?yVS zYgM_c&&o_AsGQ`$J0Ev{XkC;ith5l`j{o{q5HpTYO6v73zkS^8V}eBiADCW&kw~M#cyVlDQLB`+;I!_3qO>lE%u1r#N@1-HlvbxtYtb` zF@-jDvu9pm;F#)(qkJJT6=U{B`2aS7E=>F_X-Jb@%08r7t3UAt6Z#Mi-4VQE1c!{@ z<*MQ#o9Z+0;aJPEvuOE+aFNE)Y&+j+mQVifV>Fc6=F*3!QlB4+YAF7^{CKuYo_v6{ z*%6FO$v1nie5y!2K8sP_rhq}r2&_Ev#q$e?<1;gmck_vqPV#XXZk{Zj`*)>Jir>?x zs$ABv8Gml_T9JsU>Vg}l6+ohphyYZ%o;dHL-_{lFk0_ymUs0X2g&O$HdT6fRO0auC zMT%&CiH?oM8*bIrU$|-)$a1NL1mR7WaSa`-lBIzSJwZ#IH`}8sio0MuO_AkOA2`v^ zO!`7p-`9A$9E`(=Ae_`5j1aY`fq8;vv#pg$@mgh;8ySVK|P@|4A~UyouwXO>9>)x z6mLOR_k{!8M$KKoNc;(Fd7HPX)Vxu^K<*foD`bGl|L%A0_%5EIligHhZRc-0S1B)Q z(4hW2k%O{EgN3Cxr>>8GVzVT#$_2tva&DJ~64(LMMKAKP;G1-6 z)HfkhQ2qC;Zuxa|_E&6RBv7W2(`@~4&f%=goWd`Z%+WudCqUXh!D&Mk1sFJ3Ti+C@ zI8vj}NTL%b>6{d*sz@TcX+2*e1~QV)-rrBvfJ@?1eV(yO_NCJ&}#4qh>ZLJ zE?{5sxiAY(+ON6!R$TVQYyg;0XQw;xRxSVMDd~&(;Dgy#J!^2$&hS=9Sc_+H`txuM zi-*Kp4(%nTEQ3ej3w00Y`Q!UnE<<*VYD0Z@@7R1ATHoN4OQDd@@e1he+FExiWavaq zrORWR*8eUgX^FMPtNS0m^h2L$Y(fLY?r3q!<3D6Z!@r~SW@{{2UDt{sp13J>KM@RK zmQ_a|6tp;l*&8i8GCsZL@$@}XOlIX< z5LK#?d^fPz3SaNC;>wXqxg3YC%G)YO8gz1?$%!`PZr)HT!$mT8q8p<^|B47mw0VMd zxH6kP{;Ua*U`TfPb6lBwrRX6GXzKc?teAtwCW%M<0(jeBuND0M;QE5MKsph5MxzA* z*1PVGz80*pd9g4e_O3|1Y`-*pr^dW(2jccg-{auo(84>9QibjvrqX89rtBR791L=t z!K;m;SVDBa0K<@wWZ2%+qSSo>#h&EQmXg$me>djE4RN2y%JEtaN6*=^55F2hMarwI z$8k}f+C=ny9i27Jgl+cLIPhRC%si2l=OBsT8oPJ5)@REeW;Ucd=2K(6$n3fiwlo~W zlDyNSmzC`^cU7-bxb$txc^tL8)ZkI<4WE#M*a=$J#znBu9Sn<3D4n6Li7F0dk-Uls zOZC^9hr-PGsQDM=NJJuTI)t8{LMsLWk0|sEcInKk z{bDO+g`#%b!Zk&+bl+v_dAwO&pMGrGDSXzo>b&`gft`JLYbgZ+A)8w->FCo3r`q9q zNz&S2Bo}UOv4PC&vWcxZ&;fb8w@Zv76cI$3fSZyBU;KD-S3jI>O=V2|M&dAO@jJ>j z3NU6KyXN{8LClT~Nw_;1ObIkI?Pk2IZ$t91+T6~6ACmakvR1k+N6%Llgui|v%e67O zLVsF|+s{I-C$S4II-H&`yIwPrzPHU{CLixYhH5k`7KShN9k#eVZL>DpnJCR3Dp)fZ z=0>YXql}M`Rn=y76`0lBZJj0t6>6Aywt6(%Q{Xe|N})&&oi|0_XjA>~D!myuLn+%P zMc?Iy51x}(&vUuMBeil>y08E@!Fy$2I27{h2vstr?pSkI^aurNphR2Eu1g>Q5wxv+ z%P;j2vnH$SRZGde%&!x6?}0e$dE!aqxw-F-3{QLXj=tUdcr?JHWqAK(@#q(NSnD8K$c#Jy)!6x-JKs~`xHRFZ%sm7J6uB#Gpt@+s7Quxn$+YBO>S}n4b5Ag=bSV4+1ve$GwyxIy<_m90##kB)~u?v z=KRm!Y^wAX$WVF{Mo1g~MJ&lIURrVKM@X(!1D@Z6NDqfvZsiW}a!tR63>+T zZU{RI&{34Lz-ylm%qfKxp7oF>v;^@H7brz<4-OM6r|`$a&`0mwH^;u;((mpEhE~pD z`OX5C7&mXNHq_Z!OsNhyJk=XI^Rn>(DMGFK8x{h&Nc**;+*;ff3UUzz6$t@sYXb=h zN6qdk4fD89lWZ}T#S(>;Yt1f!Sn5cPtN_Jx=eH!{_dYClECJvI^W{~R!%+y^U{pp= zUhXFRfzJWm=4@54YGtaJ*?PcflXv}2j3Yda3E%)#c7AubJW{0?>&P&0cGON;dL#AX z9j_B8f2_<S8dQ<(^rFM-CVDJzkMdHP^bdkm$#j>9fx zcTC86KZ^aFk*^Z5i)555QgdE>j6no!w00Ph>h| zhi1CPvw|RT{A%!7pt|2vhvqrib61O9QTUvb6VH2{tQYN51SkFiR(q}PJ>yrK%?ymp zo>kteTc{TcF>$P#v5JE{1t&sQc5yMR;Hxr7Cgpg^K#5bUP2@>ko7EPqgza&t(WAJ* z1@#Md=nd1W6ysxYxXj7 zZllNsVi!6H?$jufsoixQ?Dhs?gNttz-^?nT< zsly@_#uFdi8h_tgBFTjrM(7zPU#!-Y&3V$?JPEOemd8y}4lw~W?)=;|a+|?%y zgv2;>QLLHNHDw|o525x8zw$IR^p=N#Tc`5K#H~$_y-6`cINWpLdZQfi=AF@HaM_8d zZ;vRlkFDYwHrJryciM&FeSB~o1A!05Z;cn9m!>$pGvcK7&4X~KB^@sDj@}gg$0!#y z4?`X|`XU-2c{7g9ue-%hKDW#XS><8RxAB;MRZ2b#BG?e|+Rq%kI3sR|R8dNMroKn* z*>bs^0Xt`h5nA}?bLyjOAg&H5Od@esH%p~Be#QsVGy9MfM~`51ZMEY{YUiBi>^gRK zsa~7RFHNngVOfRL)^lz&ZW0n|Ut}*_UT4jODqGo$7nl#|0s98}3wkuWZ%#g2teMt_ zh?K$Ipx-1n)BE&fMbK7(f>Uh)K0C4*UTW?eqE1jaQn8|)^BTF)$qgFI+hYavr*s1s zCtJEshD8}d|F;MMI2hnoBci$l)9W2Ak(h> z^Szk|a{5M#ZCGO5Z+WvwMe&IUS$x_v1mD5vu-><1O*0i&q7bJe02l zm&yc`qC6xK<>sGo9o=XBw0iMTN^N_#3-I#xg$1weUH3p_(SQh}Std48h@ob?82SAM z@$<8>8i+{Bq_(Iy!B-!61necIck0)1tEd|43Y_<>mAp$>LSMh~Tr+;)8h>RQ>&S!$ zYm467_rVv{N)YzU(@$6+C+S5nNud5TO8BQMbMcsX*opH?^RjKjk(5ZOSkg0P_g?HF z_L$dw_H8x0QePq)P%tnQP?iaW?`|6+MVT*#{0ppQ-4Hj)QSOWL&b#8dVSS8?v4Qh` zC4J>bIXqM&+X4##@QD(GqOT&mO0gXJ-JnyUBXk88c(LQ{m2#r2MDQ)%w?A3J;gFin z!c9N=m@b8IOW#9m@KngUw&nKq)ub1d#%Kjn`mn2jcA&wSBP!4^ux!pR47YuBW$S2w z1yGCk6UadcPru~*n>0Y*;&J?%sZ=DYSQoq`{qS|UOFhik^_?xRoD8P8LIS5niA_EU z2cbeX3Vg1d^``h8xFk#M36z)Bte*>Dj?;i#}+oV*KWxe)VOjt(5~_l&5y$@KkndyJ?aEvIJN(~O=w z-ok@Sp*BZ#N9T~$VpR9}9o<1OW!i9x+(0IqR}t8K8@_?FWdbu-n>Cey?B4;{l<9}= zv(G@LU|-uvB&qZI##(lc9Bu?73+4my#K?!9$aIT=n zN^Sr|z1xcYW~^LuR3(r8&E zY5`EbKj{oTvs4`$B+}#EumsG1XkTw_*RL%3K&?)Jl;ZiNT1wI~(qmhxAVBmS-81&B zbIYIGFliw`&T)6!w)65SQ9Xj}QZECHfq6kyqBn0o|xxZsw7{IbSeT!*&Q}3C*#@XRg~}=J?n{_e1NKYnZxNQ%BlK3OZqN(2!Ac1| zUXcjGane%j{4Xtgs%_%DPZx72XcgLoJ!ZFjXeh^uP~eZgeREX{KWB&;n-K}f1#k6c zW9N2#sfwXtdh!_)Hc!*{DjStweKM>iCS7^VQ`*DQ4r6dDUDH`apNoMn292%|^aTOu z)oVNc?gwuJ#3*7?Po}&h*mTv>uR0EZx}^yJ^QBzekz5P5mH`jO9Bn^>1=Fw9ZtQd2 zsLvzp`WI;Dd8Z5H$RpyPWa^Lj9_;57(JH`b$n^${1C*&;OQQN-@=QO+^k@`edix4l zcJnFNIYIbyI`LrX_ZZlMd$?8=0s=Gk`A(RTe{`WVN`HFXwqneC!x=niC#OmRua79sIlbe$u&vrz2>hls9yu4hPBn=ZSF!p6n)eYITv>6;j~TFG z0#d(KFuD{;8W3$uIo-{Y&Xf{gMWUCgv;#(s~CRTZijQb4#n-F$>5_OONVN>Y>AEfLhi<}&L06sUz8=H!ZZ@*D#tc;EB zNb0Ga8o8druZuHe5h*w5IVee%2#Q^{gdLpMAD?K38M*IG+3;9R-MA;J?SH*-*Ff*M zO*5w%@yZD#&De1XnDPZQb__WlaMTbQGu5Y?Fb6wa1FHCThF#q9-E8Mw$vCo~Gy%j- z*&FETq#N8$n+pPb1D`oZZwLe5Irz%5Lch0R%SNvKLRDw`78f;OY1_$2&!`pQJ6XVn3a@PI1MV)uEOOy zbZnRJ2%0#+soYQkm}lM$J>K1YV!6qhNhkSJOBBENE7tB@>;!6g`PjYzncLJxtOb!t zZSm`1Eof7X{^?)UaQ|>(p)msYRKMCj+Z?q(!SML6Vc%CxN>swv2ml&ZCwA+>gvj3c zRwYgw*ACztUVTX$WAUw{Rt#=W^<>4o0D96BSwLvEJm%kvpEEpr6tO;}U*AZ5u0riU zo+a&Gh;f~rgxjv)It+U14NQaN9^#EvUtxZ~T8vQ=ml)kXn z;@h`L7Q7OGC$gSj{d+(RpKLg>NzUk(tA$ZDAQY75KG5!OV@!8Sgb!6nmh2Sw{nS#G z^nlORy!ji!P~@x5ikP$g=*Rp|r5e)C&?LkUbmYIr#Q2|z`cK%mYy(Q>rkhwG$tdF) z&pl@zuZ_E`9TkRl7_R90I*)~E`f{m7Yay@wD1Xrf^8oMlkn738yFO*^XN=Tad2d4Q zfZC1}Ilu^yXpz*fH3r6fH9Z3maXU=I;~L2?Sq{eb@7{EaUpUR!Aa;9UnK(oI+0ux6 zL!tQtcSu>y6E-U{fHY?n+Ofq@k_C7hHdmLnD($gXe4kQ&+Cj7G(BaCh9czhv&QZ8u z59m7&!RAdqswlFdv(c@cc#!a9#m=l^GDD8{c5Nx!yuV#Nzr)c)*~~1YV)ml+ghn8> z;3S>eF%);ycPmE7ZH`|oGo+?;nyN>i`&?G0@CJim?h;7Ngf zo6lp+8RcTr{)i2|Z1ig)P;vo8^=5|7^G%x=UaeBhSa%+j>orw7gc38a3>DY-b=^5% z>dDyg-Dsf=c&b|-FQgpLGgvcZgB(G0Gz|EHI=(RtPnA71Up64#hZ_UU-XZLOcW~x- z4_WK98%()t9;Y9~1D5NJ?Bd1veyg6b9KW7*b#17`J!V}~rt!oI?HacuTHTX|%;^1S zc7Zt3fDr4r6<6Ho`Hd#*uAsv$vC9R*B3lf*=5clg2D}iov72vXuH29I&T6i{1}Q{s zkcdn6ya}0MZd!ao#DjP{d=+>D@MUi4Rqq+V!waD6-XWd2H z*IOC)WMJFQ3KVgVLZt9k*_~x>dddk6_5K^A@lg`yt?eZO@z_WWqoGC^?(&rVzvgIw zev|+S@;b=zf9c-W>GJgVa*vj z;1iK$&QmU#;2)Ki@u+d*@-DkXmUX`J4#!4nKx7!n5Mqx^^>{dJpr+9F>m^x{}8Z6sCcRs}zj#ihoix3>%#19#>nU8ut7$Kjy}c(Jf1CA8uCM$4NZ}Xw5YPC|0L6QrAr)eu z5$%x#c!xA@61<@Z=v%}OwsY@|+#zw|C%N8D0~=kl6He1#AL2oh*g4xF7*?p**x0w7 zH>mjr+?oxnLSJl-*T^p^B2CvEbL;nC_>dj<^4I3W(LCu6O(EG`Eee{ssdojJ`Wg8~xTtj+C!^W$C@1HEapx=_6;se-H z_?`G?x_fhpJ6TUQJxnWyMmWTs7bU*ADQiR7d;8loM)A2CS0DtNpd46VN|h|z6DI09 z-OnSMVnbvb{(h!k_73|B+;&B$hwwdkEw*?|oJ}En{K3jv^4!f~)y)-yTidV9%_`cv zuUeM+dT63gccm()(oq;hh3_W+rK1Q)SRHI+|!W2Y4#tu&r1nk+=O-J~*j z(p+f(0;ANP)hF@tOj*yP%RQSHDa&|ryIS^6aa%gR0)gl~@a+^FvRvZQfB+quvx?fw zVb|#ozcE1|VnwC{L}mh}>y3rA!(+NF!V5%V-uuh0LViAW-9fmQsLWtdYVg?in%LNc zPBxxLij)Qai?p{*`*S?|J3gh!;w>9N zU*Z2BxEO=46z4&4&md0JdywnoFxSr#9$VvOW*i>9X#m+BOwepSlV3L`5R{!2&#=HA z2Yk@;sqV8)p6WIwTw;m@@2c0NSm(#=n49C)LoOQ)f=jT8cAPNn+KrmWjI;?-N3uJ= zZCNfSu1F_^FgH7_R9 za~Q=nX7laf?uj0TDWNy}{rsw#V8@HbVM0w;)qMXM$NiV_m_Ld#&$e7=*oj7JImA$h zsfpNmQj4)F3Lto-#P4Yke?S!WJ>aojb%th1rn;Vsm)E7~gIhr)!cv*mR*S$0TDZi% z2kLe$uV}GXj`Q?jIOj_^VfZo$L2c93o^Pt|=15b{5IZq7HBhBcP2}f^*UDa#xJh^L z^%c6s{A6Y{f{MSE0_Qk0ISU?aQ`Grk9o<`em?yZhvVUW=L3 z!ZwF3h(<(F`W1FR(Llgq5v4Y_hgW)22Bbk(rj?CPa6O6K_?S~cK-A$vX{wdsDhlt2 z+|MQ$;T~*h#a}m*HkJF)e;nR@oK&;xo@xA@yYN0G$hm0(<#WV7>mq2lvt5k+G;Z`v~W2yGrr#*5>6*?G+$#NRH- zkv84XPUZ$}j4kdhq`feL;9!W4&XMFg<1G*eDm=&a9U2v`!Y1k%!zVsTF)WbetFs-i9=%Y+bTabU^*FcfgK=9= z%0W#{Ua(BlyJ>Bog3f}x^JChMutaAgUFHI6`|>lB2x^ax^Qp=`J%v2Fm2Bpl%dA0I z1o`K#Q0?rrVh7Uxs4Osf5{ht(1A17xe`UBbF6smmY2bkxd7H z0NGz&6#mVIDRauwojD8eKRZLN-WmC?!bv+CkAU!}OMw%GXTq;J71*w_&%twU_Xyva z&4;lzro|T_b~rO#x2Hxh`QX{Qt4PI^LMl7UG(|;czjf2W#LQY6Zp`Zb(qoWO7`N_K z$93OZ#n1tLgi7Ur>rn!sX@PVw7B(R@Comy^({Mg}1_c=jh!>Qp4o6td3%S2xe&P?_ z9A=shAh-oJNrOI?o%Y}0IRK+*qSCs%SppsAENgl;c%~>GZ3TtV#sPrV8TfV@R3)j zB#s?9%cLg|J5nVjl3`0ZJY1EA;Lf;{PC*Uo#bu=gxM|rz9RDC(ETpj05Q*~7U#v~E z<-!iS?JDZZMj$`45+Y7<1r?u8y*Qrtm|nAKPaE5YWh?vIj2u49cw6&J{i7CF{4oIJ zi>X7-ZeX5peYCERiCuVsxYigB4>%rTY?-T>i1JX7}nn1RpuMD3Z!AeF6h)LZGETyC0J)a$R;sNfb+#kx#Kz%SClrXfLvOfPyzobGoNZ zlF?G3eYq?))aPKa7yfPN%EpsbOuU zl-@pq`>m#@W1Ey3)J=o6`8z9Y;z>Au#q=($(i!}f@9GbQD(~EV0qXi_JZ}|)Ei5R# za1Dg(;t1h}bbvrf;5&}lPVxP&@PQ*$u_a43C_c&minEAC);4f}LGv()ZN66rk@}9+ z>l1gpa;AP(VK%^d6^3J>152VL;=`T@RPDRH)9m;>`1=N233%J$@TRtA>r7i=2r z!T+II#BphZ2_m6goyzrmqDC@ZQyCXx?g&xGby|XQD9ENVZk~2pjQWkjwiVo{zmQlsqS0#mtUwj5z%on*WxW!-5x}Vx&JE#fMNs#Q6k&DwivHx}wnN|c( z0aEU3PWB`*lmvHiEBmdWePY3Wpl*CX-~kAJ2`hOWp!1J?mDZEPXBU${RShXQE9-?q z0R3dlS_(YR;qDI&%N~4Fa#QV)Z^@M{Pk4WqazxjGTYGmji#~8F10;|84_W=GI&zry zJc4WVluRHEs=}gO|9R+s&XHz`M!XPDfl!Hk!EomnaZ{0_2WR%^E*83!Jyi! zg&d**5vSHILY|d586*;@>L3@>9nl&tl{`V0y&1!lWRk@;GLC?u9_h9&@<0c%gFX>v zy&80XYQv(@Xp+gwE=8A(xvjIJCHUKAOYNx1FzO+=n&v_vO;h>*XEZ?+Uk67~4>+zTH^mBoM5bQ~7nFkyfmjUDMBO*zm?z*p!3?|g-m25H~7%js`iU=lxr>^~rl9;LT z888#nC?OIej+Wc&5aF4!zK90NLJ9 z%B;us#Xi@^n$`-7813L_%`5I}&ePI6ZaVB9u<0D#^nki{CB8ll&@x6?b^PDrSFrzo z&9B%aUI~l`KiLu}rBpWib5e~2-2etKOh{gHa1SPB(=xYfNu6fya!SlF5>*ci>Mgpe z$!NWIwi+YENc8~`SVk@A4D`hZXBNsRZflc8l~!jPGslLfEGi%mY&w+I(l^(zr zLPkzCfJBI4Ecdg5pI09lMSi+`jEJ~LjlnpU-5IwtT{m+}l;r8nhte;363n##XiM8W zEWD}6H$w{1FzF1_8P6SF3O%(9K1ycwYV&SgE#4WWY6@G$uw}gC*3rzov=&hFl%@ie z;t=bS@$qB}a_5<(N?2J?^X+1Ihhe3+=-#|PYNu(##AQP@p&qrFQKmf?iA zzGgjO>Uaj>=1g3z;zX8cw~Xy0Wz0BC3xHO^l?iK!A` z93a7yCvu0u7h_w%K1!1*l<<58Unn}U(O6AQt-7JcU{XOuPPo>IYrNz(*!(MAn0dmV z#HFT;`)ku-7E8?nFKjiBSm$beKDc(Od7nR6&+pQYO0~^v)vx#f=qh7%;bEWiu zD~iB*^a>E#eq^JtYR}4em@Bj2^-o;IMohJsmqYZwh!xz$a6|1MxrtmZZ>;YlT=V~Q zG8Nh&{sUOwNCYAzw$Ac=-TP~0iA6lmcwxR}3Divb4KNS+JB&aS6EKKq!CCtT*ngCK z3}Yy-y@n}Ismxrn$BQWrk3T;#`}dgd8>(IKc^fctbwI7WE0anIuUB_uzhw1%`l&{D zU)2^e{}M_IWYGL6rR&!!kmz5emKT*wX4@78l41DI41u6gl}yPHv61HPOal?8xdxiY zYX6{3%(tliP1db9VhIIkHLK2fK1l#lFF&s0bvOOR z7=T&+YG9DXK)ifm5TAa7W1Oh(>FRaNI{u%Uu2S?DY(;Jc9UPFW{#n;$abE1k0;p-Wvj=s~~83tkD+UsORdHLuBBOm!>eh1cH63@m)!Iq96A$W=* zcSxVGvMKM2xjQP52@Xv$v zyRUxrjH_7^xEjy^{ez5xY0sOPuN-l21VE**+&AQ2Y=7)RAH)~!r76VppZ)rKwF2Pq z`tTOJ+r7vw;Yzp0A^ypZF1tRlc7JpZ%3>x+8B}tIp;!T!I{+@fsv*~$n?eO<^p)%G zty`%)zq{Y%cYeY?B=~DpNd_&Odej->x2p{bF0hMzSS|AKNhewpG8e(#bndNi-&nC@DjKXT-nR z_W!6g00iQHc_;k!vH<-z=?Cy$=u+z(0EMwXQt0Xmb>p$2`fpqH0Pm%Fck1i$IQKjzZsaJjYriv{p6TcpeQ_4QHZBpG`7 z$AA6T?%!n3(I*@!Nf+YZKBd16RY?Fwaf6xtFT{<%>+)Za znA06)lB=x$`ZuBsgEn>?AAo0e=UX8B6&eQif&wx1|7|b72VfM;+ z@WU{Xf3o~bdgR~Sv(>U2L44lZL(so{_55ka;YZ+r^VJtnrT@jC{{!mLN(vAkoZ5sa z|7r!l>lYw?a}PKm!+<&Y2$6gpY~&hg1Kt`mLPEt?bSho8DeJ)0mexysF|F#C{J(89P*+&#;kvZw5boB?H z=lC9LpZ%0brHsIb%J)z1j00tV{`@D=%oIg$C~4v863rBf#Sh8okV7)zV*as@|C?nw zZwv}Gos~rsRTY(~+`@HJIk|py>F~erfyY69jw)kqxkTQ=R&tL=`9~x`zqxyIRJXWy z0ymqU&u*^on)r|$CO)5??FC2fE&;EizqI9lwn$7rTHG;_6;(J_n|r=jZRT<4H5@;H zTw53|gxi$VY!LkBICE|c3N4)#cJ>K#PnUcqQ&pBTAl7$upm3m$+R=R?{oI%Fr6?$N z2pT>4RmF!$8v}Dw*Zj#EL9Y}TTousy_|c<{kp1Sa_;*J9vxIlDZxhje{n8-dz21LP zJVyMIJ>fVqj@n zX&s8F3UP%(%G}_;9(4of32_iUTdAp$m{B^3*RIUx#`ShV6^iK4`$x|MIb#`{zrCT| zQ@6#n2MW8&GpSxF646r7bdMEj#<0e+m28_{wwS7BsI_p;Z7M8kPFDvIXqFkslL`8- zvyc1KMbBRQUemA|6q;O;GDKbUCA!r5%=skmPZb=4-!|OuO*`&eTDmt@@75r=qI41e z>hW(IX36ksa5Q9|H6f)ntw!(VHyfw$=N=(gDaIItzOvC|QpuKoZ%8K6pFStuZ8=0a6G*mG=!`&LC6G;c`BIhQ35j&+{d|2=Fg7tO zs9x+)i}|}(O_U36Z=n#h8fIf{#BXuGXQ8mvFL zOM3O;UGTMRLvTFKGv)WXI0`05g2(JwSQYmlrKt8o8br>|@SoiF4Hhx0!Q#;|FO8VO z=YPugkgW2|%lB(qqpoFxQXhqm;1TnxORI7vX$sv^GHc$CBRIrnG0HT#a6MG~5|zzMDBQQ){ct=x`FJWTm-~nfVEs9)$cnYU^`4nV4>N-TPc8 zt^S0T%aMAaA!P!+Pwk+y-*zbyxUAFau+ZiagPyO7L!UXYI2iC|oR(fiU_jEz9Ooj+ z9D4L|?@Q8A6XP_4r2Pu0paq6AYC3Xq)e+_gu^*3JS}bd==8DbjFiEWpFi`xZ`Djf= zD2jt}c$6uWylZsDdK_`GqZ-OI)$8+b6Jxta!vy_}!Z9w(&ros`>9~+xgn2P?a?NQC z6wSH!cvO_QLZ5JlRk3dqg=1kXdo@i>}0 z`sfN#(c}40vFbI-+qZpl?l-(c46l{I{_(-vfBJJd<2AjD2@4mVWhp`Qi?Nv5Ag6Av za$UBR&Ea~2Iy>rZ#GvG5jOg0Y0rxJr&DVX^`qHWXiKp?X-W8O^IbdWu5lZ`;FYAq< zRi@$Q4@@4+>&o+-x_Ks+lab+M98i0*c!1&0G23WWQ{XBl^d7Hhr*EN;cmBoMXeIA_ zXD-61_sW;IDo~&%o6^w%wq?B8gPZe_{8&ThaLqg%sBh?o-nf@6V)-((iaE18f&=HR zME`xkMsHDqV(k!6xj}q2fmP;&&d+l_Sh_|%h`M;TGTQxi+wuE;kgI&ri@wo& ze!Hx5PaivuXOzqYCFB-{uIQcm$29sC+13@ljI-6qa>QJ+Wo{7jeTQP7e*h~W9zvgq z<}94u!h0lDP3)C)l)RHBg-I86BS=vjyREiRX5m&#STl*B4s9Gg(#+VjH>$JdIWws5 zXHdh=kB`^vA*nQuGV(}TF>Ya%K}pw^yk)VumcWc()fro0Wr|GanB@q&`RCrbcm@8q z2}im)^o!(kVE0eRRC-r>YQ4AlmsE#>^!V*w0Q~Eip^cT9dRs|2*fN3}wj#|FCNsJN($k`MYur^6|pz5VwwI3F>h|5=_4`Dca zG<#!Z>axY!1@%)d(zxRSum<^KQMECOL&5h(cEfL*KXG$5`*48d5}Y>=NiVkdO*ik9 zsFWqw+V1)YJMXI|naw7?j(yy+ltuob`PmcLPMjHm6fGYBjd3Jt*g-umkiRb z=y!9wTxEGv^(DNrT_azEWoxqB;i2QbAF^=poUipvWSaZ#g@<>$zh7&SX88J8Wk8!C z{2C$^ws{!GrqOPo%lf)B(UCWFt|Me}>ql3(Mzgs*t9o;6d^uNwxUrbt@zH%@U-WZQ zR-LGM>a+TLcJ+z1j-4{iu6$9?XGMGGh9Ur6m@-E)|2>#u>F{pV;{MDQU+wkVAPP5| zx$36M$}yRi^jg9X)cTDZ1E#;5IgDTg`IS!5xReZ(&BUzwB~tdbRhkicEjx$AjUpScXcUJ@#cRQNq2Z=bJ0u;eA}j zlGCkTVjLMlhTRCgx_6YG+sfzR39&up&mgmt$;vBx{=Ea@Z(q=g#hzbJAGQp-*~18% z1C~;?WMq~xe|@Fw>GmN({>O43uCpJFR>YA~g{Ii+Dr%L>T!uxR;*gZ+=%P;#Jp$|z zV6Q+P)t!aMx4(6acd=?jql}ua^45}ne%_f_Q&huAX=}f2AjpVq!X57oSoP<*7vpqM zbT{iY+z|7Tw~nTgm*(eo&7F|X)*z^mGU-uev=UosRn5Q)@2ji#5|5J~g?s}>K0-QF zN+JBk5B007_|3gi2Fmy}$8;w^FU%d$jxKk7N-~gnV6z(T+*- z!pOmHCY=u|Eo+rS$*}sZ6t11d^9EXyhc9!)cyxMSpX^LFrC37F(?O1NPj0c`mbiB$ zqDhsnwy1P3htU3cjW5UR0#+Eet}gVqUd@!BIgp<0OoX(jUxZZZkoY#;#&c0cmCtQ1 zj9S&Tws!hc3R#xEPUX98e_%B{j4XO{?y3RQEzxUU*4F);2S(zuCt8}yDR4MYn)uSJEmz=!u@DHcrI2s zSvaEJQAZWsbXEIAztK9R@^^znn9-J9*+xp~JbsL9vjbkL95c($z_w zJ+p7n|L9{)H={Q&xVhmlrFE;?YJ=_=Un-_j3Qn1Q1p?(qm zwKGoaZ146#=w%5vSD?A4TR{VpQeKKSI>!!<59!Lzj#;R#pSZaLOgzj5F(ScWS0zGS zvy2X_M#(o4Ny%^Rzy=z5F6z_mJLJ_7Ro&xI}AK%Y8Sle~fgk;x0@erf!>EG;dj z1W#0Cs2)8`BiLgx{3%RTu?cvdaNd3!xZCK9gg>d%FqzO|VLCRurWq@!MLJyY-PidP8i7t>J5}=0R%ensV9;8~XuKPun4s=r8XY1{`|wBCkaENP74PdI+0HQe z0cLwXi|&S+5Wb{{{2?ZBEQzLdn%zm(Q#7(zlv# zKZ)u2!cd<~%t7;s{T>GGy5CvvYuk}x4(iFK;8ZimGXq1n-ix$1?D&0{b76Vzq~g~F z(%b@g30vdk%2w~kDceJJB*tnzM3h%~UOI2gX0<7aoWbamAKg-8bzZP*o0g-gzF{{3 z8!fWm9I5qP5c3KADc9_BR6iM@)WM$0g(YHN)UC%^Okgkh?-K6+UZCS3cCK#7p+q}s zj0}WK7`HM>^QD6cj}=tNU0uIneBy)effh-dotJT@tUO4_0v{K>%qw0^9*v2-tcv@I z`NZ`u5)JM3LE;V)0n=2R~5O290gdYT>j!{1lEc=%f2W0t} zYsUw9KGe->(IXa`{5c%@>|*Us0@Mq2Y3VqM5LFuSTp;i5b=m}VZ-Zg{H9Y>fI*a^H)uJ z9xJ(QL485WKZ?&o`F`T9EUCUI%Jw4EYmwG>tv2Df+AB+`wc2%Z-&|0)w>9SMhdGX? zD`;0(9PgyV6U|yYhhw5-HQK=?Bs65K^)QafS-Mx!DvCPum;Xn1{iHJQOPBun@Y0!%6Yr-YGwhDaGfi=nAV*X33 zF2eNbaSLSe!$MwO-mjxwNsIdJl!w6M+%X|vtPkFt6p158J8mPP!6M(e6FenoSeXP# zE37M-v$=dWkL9OZKnz$Pt)N^RLRcj1FHWXC`6-Fu+Aw)e@jzD1I&A9M)*$ee!vo{E zZVu*E$EQMTz4ToX>k~#}Ld%DFCF5gTHSUJe&k4vo?DRK&qUV-9H*YpIHsAY_^X}}5 zRgd%3GYDn5Tldr3f#CYm<1Ko={^L7GgS?$`nq^3w!Y8}h!;%OGF@gH}wB+*=J{y)0 zK6_El{aG6!?Zi{~R+rnflU-h@a@}g>aF4sjEb+dmEa`W7!y{ZnDb*J=BYkZx=AyDc zr@`n2Sg-JzZ!awMbsIrSFN&h8yV}vC?>l;} zD})OclgpL18Nw(3F&0apAsE4^lNa3R;z25)(MLU*Mi^#wFZ%eo@I*&-`&{8h>@$cC zU7*->okh;w^9SuO+0iE2N=M|J+2eK-&|acYJ2Iu?s}=wHSJ|b#l^=o!SS>ii&1Jsu zd~ls~7*5q)u#UIU@rxPl44xbrBEln6yPj{$Eqvd_*>5|TeZHX1wxp&I5^}UYJoz!k zdVNQTwSV0qN1JLm`~0X^{zKh#y)Dat(`;+pWXS#7Z5GKtLhg)!4v4gxiuv*yE#Z4@ zKklni341PO4-UM^jZ+MSPLlYpkxm)6S!8*Ob4GdVCRUq{SNxo?*I?GquO(Tpd=OGL zwKLz6kj&4IqpOjgFr{*~qwZt%Op%N^e!wuVhj6N0q<%E}Qpu+zp}sQzFk`kM zVdCm(*!%;5B+6Puc6Qlx=xn(EyiS{q;=%odgU55vLyVzYxOli(I90>DcaQK@6o+^B zsZLsZb1=9x=-*0MKKT|tO z&JNTXAgydkls5jH!_n~|-M<)HbxAKW5q(dHn3loqGapnThh^7Q?$+5Fm4 zTJUm`djdV}t8IaZnN_ScF6`rc#cLdwFPzQ`34uIu-RuUOP0q9dXZE>_7b~R(G7(v$ zQA^2p*S5}Uj=NIYJ|DWG&3r*4{fPGbD)EZ@cozW=8OWysFZ}Qw^wHtZCjuL<+avom zDjY!N6Yx>Qkr!j@JO?;+&>KvRN|6~d&Q23IT7;uZ(@|yZcb3n6N0+h2Jjc9j$Lb2= z^UGsiCmsZaaWU5yWre9Cev=<#6$~>y)BzKXdI(aVaO@ggh!8c@y!Ng}qj1CLuVha7BbG-?r@!N)NDd1-*bN zJzQ(i;sRL_tVg}H>|460-$)yy<(MmYawn@&>^XkBL;akHKsnS`d3&?Q79|p3XbEy0 z=GJM-SfJH1Nvw zS!MBEWYOKQz|V58(zM$NZ9kyu>y9i-9=Q&z%v_`Nd=T40tA#ulCfg6qHCPA%L^Ouv z|7q{5qT=ehEfWF(LXhAZ2m~)6xI=J<;10pv-Gc=wB)Ge~yA9n-VboOvS}#<6(VjXZSo+y$#}GBSz~=(bkvrs6x?g#ccd~%Npah^^BQ8j6REO z{J6+vXfp02O21sH(u92q8cxm#$6rC4fnTs{XiNsT->uI5aZ35HfbB=sow922Aq<~m z%ZJJn&+|$%aKxm*rDfUM*9k=#K#__!8iWiiJ}aP>2^i~=XB$Kd800#hRx~diz|bQ4 z7!hl0X|K`rMooKbiYucOL-|BO(jtGYSI(@Mai2{XROr!|tb_D5_IA;i{f1Rmc5@U) z;FRTup47akfJvXUyFAPpC5xrhJ_b#xsadPMS)2F2WUBUzhkmqoHLH|n9>-SZX2Vjq zcJP^ZDyaX2!y$A=1T$M63&3%6dkkS4T!})r_@BGGA_+Np4cREq(JA1u!Ig#i-I-b0 zV^)`)N5tD3dr>M~?t#cR34eP{; zFXI&E5L6_B)#NXM_hE#zI899o^{GtNLJrgj>u#6J`!&L8KHor$7)B}3oMb+6e`NG5 zm~&%b>^QkF-|j|-Mehzj82}5*Q{NLX<6vSA(H@T!#mLyTlLCJ$0k6i-?2n%wa5A$( zBbg*M(_S|SHZ47b9@CHb>9MT*4K^mD37-oOUpj=A#Z@L=j}caroe7zpUibI?Os0Wq zQt1J6+X;QfT@c^liY&&=B>}H*e)+OK3yLzR3>;09@H-w(a`V0?6kp@oL$TU3$sy)j ziWyxRos6=@q?R)<(9E(-nE2N9^nQk^SRSk+TAmG9b|`ePc1Kpm1j|jWR1BZu05_G^ zP6bxw`s5RC_+k$Y;}4YY=<>w)m;t2_-VTyaI_rmKBiXujr%dC>onRPc){uo_&b?YR z_^LwVwJnBi7f|=wjiDD0PK4={aHzT34<_qD^PE!x=J?qjeGRCJE+;RBN(#s2{hp%R zlUJ2_3LS3mT}ryJYmD*v3yexO!`dQerue^J8P!!E}3>@tx@Q zx|Oq?|LNu-oe15%tHm`ClU^K7TDspZ1@LO4(s2IW#dw-#<9iR|OS$<2r$eLrw3eGK zx8D%+ivmlgqc4wpHIP&EZI?MaNW(p^?hxj4If4ZXv~$gEBf>Yn?~3I5c{N zxzLf7tCFphqa_Lkbg$;`NfZI|jjnuEXhGd7RbO=)r8#pF`VIY(P`&jIlhBR|(TK3h zoa@T`{mG0zSRB-OW>e{{_79qhm~LN5gwO^^mrl=NZVmMWMAScjKbLye zubL%~*3V1}LMfQ7K%Go~U1PzP(R!B`m!PRiFLfhv^c+<7-*R9!3 z6DfxXrt-c+wt(%wImw2IMGm+cCH+L@NGm(43`Ej-&rcojwJsn9+u5dn{XP(4e`3M@ zJvf!t$Z(|pdKUdF?-S{#+)!E|9o9p#UtWTdrMuboeOQ#lhg^6{Wb z%gK+e0h>q4(**+VzIG>4X zyy&TF$HTNV-5DjXH~0s>&cUI_qK5;T&btu;4z?2PVm34;Y1roP47Qn$ADA8&-IS_y zO25aBBS*&ds^IZfE{eCys-gAKFWz#OcIElVnupQMGJArQl36vUEX3pN#<%Gzax~~P z2-Kw&_Cw~I8=I#H3@GKb?QC*D0IB&a=73)g?Y$Iw*NC$^|n7Uwdsn z2pAJFBATE0A zD?kG9nXfMYcqBns^3Q z$Ad23xv*1{7wd`NLAGN`32Th7_%KH^4r1-$wn;q2+NBdYoTUjZShRFi(!@i`x;*)e zk|$Oh9NNLj;h3QwEdb{YVhj&F)mrf*CeOvfsRRp9t7(rUC{PSt+L4(*;Jv;jk&~ zD&v7PK~Rk6Pg=s)KC%v^TCqUoH+2X@WQLH(dVr&vRA3o?xZFBIlAk!4Xcpi8Ra^K z${eD(#u}GpNj>VENEI3vU%zSZwJ*oG+)%&|(GWvLD?RjdMOA2JQrH$iB5}~$=PpEGrliv)vRpy`98 z9?QfczRHq#=mscWz5w-wTH9hDs`*-Wv!~sBwxnGnLXdPkvKkbueNmX%U^!W90^-=! z+TJ`q?vP6UacT9bc@k)@#7A!GHg6#@W7536n&Wl&-U92$U7Dd--c6Z!+D>$Nhgty& zsJ|?<3V5ief%t=5EaSU(PF3`U+w;M{^l^!>s9m~y+C&{4H)hL}w9OCKw`GvI99hw4 zY?DjG=&h^~u)C6T5k_)c^NK~4m2J!`nYyFeM8jrI{3ue)L|O{3`(ps32e1BlQnzplyec_UHRi!@O4rax*84+*Zzf2w^n z<$o8+q}It)MqRYPQpV02sVjT@E16er(~2A6{HMQvO{I6VJI(SyBC!@W9V{GNOiGCb zq4`j+tTSU$N^$9?p=@vP4Ii!maA%y^zAE<=MYA^vaxAU4-SbFJL@sTS{LYNjX@~8~ z>D;@~wJ<92*DsMom$$7Vbjhsb*msFY<>j2UDM<&)CBH|daG(JBG0O>LaIzUm)3%6w z!J7Z>K0bLah=&gzqHMx-{dG6iR< zBOWooY>^%(kv^59n4A`gKqCN)`^esS9;|4(nSG~Wt;6#y-O8FaIxhk2MnN!ign4|D zpT%`8wG_#MrUxYWjx+?n>7BInb^+1#eeV{UY6RCHYV{?sY@U@DKFlG3U+&Sc(Ji8$ z)P8jIr>p5*P$P&r^$=5~q@q^wZI-c- zFmk&ZO~QW7BA_g*N(6a(EO2w42qOsLleMefg#vvBbH*Y<>{lb^!e)4&K4Qjv-V6D@r3x}jhAw=g{4Ag3Q zt~yP%A`;b9CeU$Jk+-jvsP1LoqEvnnK@ud4$IQ}7d%KXFP%L*U7y=^8?;Hl}ic)8V ztrU;tO;PTHFgCb9moGyoBYyW{yhX*T{*kzdnd8upJX;J+*_(cLWV0H+Y?K~t&X*T# zjgfHx;ZQQB2cyT8M7I>ErV^HatipETI5*nOA0 zZ>qEwEbz~dK$=+Q!h=gU(u^dWwmryaXVBN@$DS@U3;!C|#)*1msk;UPu=T;*=oct9 zz#VBmQ&_(I`Hb`V<`VBeko01?XM@I1`sx*z|Z24UU@&)?K2WQFaZp&;sQV;VU1la2W#l{|>5b=ea?%2|^B0&a- zBhjr0zypXCJn3nlDYFT}$uL17{;XYAcx$d7<=)Y=FFK2*gkMkcOC4d_dWK%-MuMTc zGt~%IIRkw?jo({XL*=_&$h(JG0zhA(!IV{PQUdFInu6!2k{l<&F+kU3i#;{Y$7|ux zbHEJ2_1t%-WrgNYFhhFHVJa4LyOM-m{Wxitk(R`|Mx-`l)!wh}aYc$D(ETx&{B9O; zvUYAfo)hu7K@T_KjBuk*vjYVG7>%L0nk0C+$#(B*qG0-)TKK>LmDWDuYu}u)@Cj&Y z&+wxKKNO&lQI{#5b5KtpELRfKGO^UQs;InGP;DHm#-L9@d2Clvc{1NUQQ$F?;TEA) z`b4>VtD7t{QkNSbyK{fm)kE_E=phZKzB6QW$x*M<(2ruFD@q z0B8%bsTvyjLMc;|I9)^^BR{de(NzR&Fe5hw4s+o-3gXrOxLWQ%oe1%2k*P`Ht*>Er zEvNbfaHlTuH)c*2J^+bPNU#xeA>OD+?qTSzCqVO#B?M+9nFu@{*cO~Jz55L^K-7Xw z_V}see(=@ALVJeAM{`B@2tiycMmrnjb+)cnX8pW3q<)YXf5?(iS(Tba6ao?^j!WKl0 zHtV*>*Qv~h1TtER^^RuqHrV#1IxXq^# z4={&*s6}ZM2O5(B_=yw_O)Ph$7@MkrK8`+E zW4CeMY7a$qpZTX!c4W}RGl*FZ?g007s(enCl!^`QIA;f^+H>(|iu?8>i-j|8xYw&K zP8yhN+lzQwW!~d>x&1Ao{Hj4_tF2accfMs+d~zy^<>~M%rp*m!W$Bcv>Z|Lz04^M_ zL_3b}B!0&2eK)qn4Y@-U%q`Ju+>{THt0lMpC z4ZAfsxB6;*8&RHqr>gCuS9NoxB|J1CTHSlax!7G;lD(=a!EB>1Cmg#2*4Lcn?I=@E z4V1Fv4C}H(N~N85=|INY1Hc~3!9q+ii={MtgXJ$Mld3zuE#mmup8}vuS=z7_-_~RC#IZ~je5Xj4TN9W0Y(OEu`O(X)Ka{+dwa;jEgBoM+_w^`?{R!!(&=4$QENa#C z<~DwX3$|kBogcfhl;@T@#9bLb_ff;IX_1f^0HvHRTVIx2ocvP*=Zwb};+W*H2mob) z{D?C;iLB-wBffOtXq)!O+P%3uj=D-CH*BJPp;*^XNp#3Y*B#dBH0=w)5$}MkKJQ$< zZ6CHnGsC)MRZ8gRmYsdGXsfJ-7TSp0CaQ+3;kd=i?Ej>zB$bLJ=a+c~WJZJ_{Shn{ z5)4`H7%^kuY2e9rMN6Wt10Rty2!#GHy$~5@}yS z*N~EVU{5NzXGEZgm9I9X{Xf>}Yq?bi${@?>f+4002U@Z10M_ITl)6x|@^v0<8o+F* zb`vPUS^H6dyS^6V`toO9t|I}eo=h{Z)2vgg;)An-n!`D0nB{R(&U9!OBiD5kD(o{| z4ipHOESI5$@=qJeyOai4kCt7aD%@zvoE|7;S~c-=8iVXp`2#5~&L5^*%`g@k-H_UD z*2NT_1`T$2ETgs`dx0zmHRsb>YFlnX!D6?44O0ErwT`_NJ@nQ0Al_fb-kfQV4i6uI zHt~QLWqZj3J?H&7-}Vg9*ZTP^P1Iy&i=V~v$^z2Y&!9p$3ynr4OQ=}wKkkhEL|BC0qUN^Spk(r+66JsN(k;N#mCaf5emj+D z*_&_j!fuFHuQS~&QhK*xu1quRiap`U3ej};8Q@mXf~@8ZPuHv-GL6onVt;63cdf*H zvGr-b+NT^>PXF;Eu^whW#l~bR04h_bdX6d%(rMfCkILC{ySf|^Ax0sP1R!kM9y+6q zKG?l}a=W!zsI(7!G#SvKuZHpbTZo8HdA2)>#)W;Ec(8qysi0$rqhG=EuE65cI%ZmB ze>e-@WbWZdpt&n!tL?sh?e~p>YW;fCwUd1r)|9$Q{0lT|p;#moI)#RuQnJ15k&~Yx zz0y;*+ec>meL}>i@l!Du(Cq4R^jWs?%{p0Gb?I6Hh~!+?v$Gp4C&gFmg;Yn(F)}dv zUbFq%KfC7IT7LrY#JW|AGJ4z1=u3~j(~k3IR%eH7{^t&dF8I~49Cdy9q-91K_cr)& z^+uiuZYuASA%Rf5IrE^(yxUg*Hb4|Mc~|-*ggL(EENyE7K7DARMLnAqjK% zQ=YpbSCQ_T&D;a2uTlC+jY@bWC6Kf0DAEov*HtFJx27nt9hWljm6(flf#|aPpu1(2 zMtXs*`~kB)pw8n#TZ7L4|5&3=FjTu-hsS1`L6tE9hfY@lV@GXS4+-zhJFKj1EZT{? z9I?HliSFb*KkZ*t-=-IAcTR;c?O&`36V&2|7VYVhn%`}5A=mSTS(qGBsP@)rH*3gj z21q;iSV-3ewy7(OM*4l9Z*%E@%W!9B-DGCfv1C8~-4aCgwUs@Yvt!{qIc=n9WM zmw-Vqin%N~43yKA{mK9B!0bGXL=_WOp}|eM5-3FAd#65dTr|A)p#S*}xGPvhly*cW zPamoz^)u;N>ato9(S-0NcMk+b8a zwxG+Ch=bX3k!3EIXs2T+w@p&HRPeavn&h+<&d4q444wFZn86FnQh8?+btOUGQaj%~ z?Ov%xkIe1k1rDu<|0+TGIQ{Y$I`wwHA%v*}Hy~y~AKl_N0X>E2vTIx1%j=W{&DVf< zyvKSybb|zSa$2R?gL1mqCqU|YrQrk&nG~mTU}e6meD~->ECYyQ^)b+hJI-Pz4%^G{ z6EkuCZa<4ukh9g^74)G_ED$=yrsgBLiOKCEC?%uTZVLOD3rgq&?%)Fh#VUe%kW=bD zj}33$y2qcH(E8~QofMUBlOp{mH}U`E&O_f%a`+--CC|HWzkc%M3O)(ID}A%%fiK~+ z;`&*O9|~BXT#AVC<*0HykvSu0!+^X-ftoaPi`>CD!S7WNTp7=Le0gak=n0?NZPT3z zSI0t=ro>P*@l`IBlty`eiv|`5mU>+*OO1}cBOy-Gko`yqNFi0N zwA+{Nl5oz{l{r0?G+-M> z4)p5&Z1HZv#oTk1-tm)hr;6U-iE$;Hx8=C3nUQcWB)*sN{xqIX=J=(_?9FnEmlTot zV$6e!lmM#O7K2%3k4~m5bL?mAo#A{?DqshHA!~jU>B^m)FGpEMdY~P(L zCvvEhWbQwzsKt1dhBz5cpRR^DI(9|S zzJGOmKcv6Oz~?Y#>)Bdwe~^U=$7;#v^aqdVpzp4%)Q3cQLwt_kEybHx{9bDhOh#~$ z#Ja^AbZ!IL^*%3Lg>sTH4}+}md4rwVibaAQ6O84QSSRAHN&#q-jvrLaWrw_}?T}l% zH@<-e2$V=viJHcVha<0JjcS8kom110MR7I;qfeqqN+n#NPw7ITl^;^lEBYx^c)RP{ zi$XX@KGB}GIKZ6Xl)rxzkfDr&}1@x3Ef zzh=E*m%wR#Xn&`Q`9d9As~gK{e_*Zg(UHiZi%3%K+YA84K}z}4x1aqy^RmQ3+c6Uaz1>Ak^LP&4J$H+scS z_>s`nOQ$LgT-4#mL-^&=NJ`6b(?2+DJ*|=G@fsJW#>^|c4KiAl&a#riA*k!5Ka+iV zN|44G!tS08mBSV|PwjVT&>!lZ8w$3kE(~Cjr0U#{xpzqbVbRbrk@`K~9lk=gQUcPa zJqOjyVM?l$>BVNiA?Fq2_Tw4-CaPTgL{6&BYl8iBy$nv~P}Df$w+mAl0SC2xfAtFc zorJJ}QYt-M&Y%n zI_G6Jn>`iTjhv*@Onb}}?%yACn_+K;q3c|H zRUgFH2n}IeGFz^{0TuaRh9D--b zcMs&BsIGW2`AWzxuaTWZCV-d0eRiShKpg!rwqE zZX;skbbVq(D<+aK#B!0yodbJkwMS;k7&Z?#h4`PoBv`}4O)zIQMq)n$pv4y=n)FIJ z8p`e_KRVGP+Qaf7Ipf_AWy$Q!__P_Q?Ch%Q4SWn487}bcGB%gTIocT`2q!z^!8b+$)$_QYc`-HJTwqFG-OHE;!B<(l*%!@K_1P~Lh|^1u zM-0U2(y!5Im3MPHH@nY#hI0Dr3C`%TFtA;esdQV?(K;?O|4Bp3w{kqqpmpo#4#mt_ z0o!dRp!`xZn`nkd&oFuA)^86JsexN0OFtdH+2oc;A6@@^83{b2)Z5Aa01tzg{Pjnr z`xond{QFW(P0q0i?S+9R|K;p0^b;_?%c+cJ0w6o);d*lI?M$Iz9lqm2*vy-!r5+%N z=IrLBdp10;H~ts53(M=&7}vK?vyBWa7UYkFwcwzf+NRJzhewkIo%v)Z<(Z8;?M+y?r?WJFEEA=*d4K0 z{tcAXe&>3Vq!^3VOGV4LL?0;y=R6TB*I2mG0n^7$DI4R^_DJ`^y6aYJ`@{G?L;9D- z%ym!6t&WHLOc2WDdF$!PHeD~{NU+edGm(+UMMqaqapavd@iXERr7$W_P)*~{7fEob z%nRWhr4+5VbC*#Pln)ZPvndQVT}d880#Yr;zmS43gz&+PT>PHa&FwexsrEb(FS2RB z15hmoLjtV`oy)&Gs-(|R0yq(I6h($rW5KUl7`Hl3nv<_i7QL(FmNQ&v{ByiEr_^JjF<$g`);Qq+~WRm$}KSWU?(_i0AW zV+FTckNTsOqAk_T%xfamI~`{W>j(+yw2@wkQjE9?P2G1J*QIyiw-rAscXD^gz1l*_ z67asxO=V@Mv{m%ig|7MqtFfP|9e$~NaQ@l> z^BN~18WZ1rOt84p5AXS_TDcjumVgx+eb&;zcv&hMcx2*&7PijPv+{fqk)#k zKM}O323HM?#G7a>EgSMQKn5Rm3ssQ1v%|u|?r^EFEx1rV8XGnx;w;>UCw~)d+QySjqE*eDVR!1?m3|8)6bBd?_4NyFFeHvoV&qKbPTjTg@lQ8 zzO|Z?Zdfu7nIwm>iH8E;L~pkX`w^7xYyRxLnHupH$7HD$p5iRCro=E-IlT zn3`MObgA9qZ}_Y8i`!xEZXTwBHd7-52cbloT~o3{ z?)ZBKW{ulm8Glg!Q#e)=xrMV;0=DMw_S2_f@}M|>6jcLd4Fc(nO!G( z-u@y#3jSyrAbzW3lTN8QbxF=twl21uIOw^7JPT4hdB-kHY?dSs`T?UaggLQI%3y_ks(&SJv>YOKtW+E)!LSnXnV0W*n=rm%_L7@?XAHA)V`Id7FEc~4tF6_%$k|DU^@8iT#aEf zc_3tJN+lA^zBMIT=`bdnj;xUvcakf~PZ}7vBIe?sH}{h}6DLz`F{`D)dJ;)5+z-c6 z%fTIwjw7kWU)zxf&04ncJv?OsVRmY#LUq$)eGjja zoL<(aOXxy%{=i^Xjf89QriE4y2>@^$P96>63D}Mf@H3Bu%p)PKwcZZ9eis`J(1Jj``dk#Uld8{iRUY$ppfi+})0r_~0$Z)0*6)xn#$GJ!~IDO>JC7 zX@R4k7uGDMlOf&ZE*zDGLd0`UiD_wGsSrJC9bLAXV~8jE^HxZr+|g*dOFNt3$!e6^ z5mB|de%>ud(P8Q?yWA%w6_wKs+L#5igXSH+-Lo@sTOEZb`n1gibnT%;o zC+o%)=*%R);*i&c)&;w_hMj4VJ_m`D+&1k@0Kk<4#wX8jC$nW>dc&fRkD&!bcZ#BR zX8V~<32y6lf?ffY6rTje{{qLoMiZ}rg+`*91r#-i7U`?+J~zATq{Fgd5TjotW@l$l zjz|oWVykEktK?XESJ?mylE$*g{=D!~3$FEz4mv_+1xprah<~d!``zz=CCSbmSP%uUeGgw5T@$tax`v`j&q>_&;0BqQCwI^;3~< zWhr|hwGareN1~gAE*8K2^`}iFifB|y-<_j1%FoA_6B@_DJ`ytBzhdP3!>Io{_u^(S z45S$oz}<;U;b8sjbl#XzejjWBxzpt=cvUDHvhBOQZRN#;mLq1G#`POF96FJ)^p&kW z^E36+wLS6qHcx6`8n4mdLE@y4u*aVU?EiYDnP4|A52T0l7Mz&)`J!q?^s}vv3~Pv= zTByZmlDX;v;OA$o_|K$-V*?bPU+v4bxBCxtuAEJZ8Gl94 zlQHHP#{H`v%zq8!PfVZ(?Yo}zj~DT~o3l=Lcg*IDt}a=mC>bhVFL$9GduOQf%LC!o zhJu1dlb(RA@q4sc!@imb#=nwOp+Eka_O%$u^YSR9@=FX%C!+^x>1ys*&~Mm3?iye3 zNjm(JMre|&cHRr986cByz5XwE{;?Pd5N?%<41}x=|0=#EUIKeGY2N>v;g8eyFMsfV z9w{yZgEpH>;Z=+Lmkr^c^WcBC{4z%Tsup7`hs^c%-|d-dcYOcv_GJBMu*sJbY=1c6U(bqv=E>J&@>hB?$-Jz4xc_cX^M3}*x}Rh9 zZ~DZSMe0>oGK+`#Z^nPO=k#ajV9h7R7XP=K{-$vB=eK6@uL4-juBS5%{`~I0Zz+<1 z4t6>>vi>gxzW=Mz_it||0k07(CXb2)`v30izxDagBNbwxgDsLEw)$5K@XrPQpDnpi zaXPbllYi;Tug#=u1g=clS2$^ZU1bBpu&p%Y=9QIdF;tdR|BcYwUr#!eBif-aBg)^6 zOZ@k#l#Avo8Haweqx#MXb@cBx{1}D(Ue#x8NcGo$_-`72;UPd50Nxl=AHu)6TE8ZYW1fWhC@^8TA?#fI^t^8Xw8FHZRX6Hj)$ybju8u)jHcdH)Lf Ok`R#\n\tPort <%= port %>\n")(host); - })).join('\n')); - console.log(clr.yellow('azure_wrapper/info:'), clr.green('Saved SSH config, you can use it like so: `ssh -F ', file_name, '`')); - console.log(clr.yellow('azure_wrapper/info:'), clr.green('The hosts in this deployment are:\n'), _.map(hosts.collection, function (host) { return host.name; })); -}; - -var get_location = function () { - if (process.env['AZ_AFFINITY']) { - return '--affinity-group=' + process.env['AZ_AFFINITY']; - } else if (process.env['AZ_LOCATION']) { - return '--location=' + process.env['AZ_LOCATION']; - } else { - return '--location=West Europe'; - } -} -var get_vm_size = function () { - if (process.env['AZ_VM_SIZE']) { - return '--vm-size=' + process.env['AZ_VM_SIZE']; - } else { - return '--vm-size=Small'; - } -} - -exports.queue_default_network = function () { - task_queue.push([ - 'network', 'vnet', 'create', - get_location(), - '--address-space=172.16.0.0', - conf.resources['vnet'], - ]); -} - -exports.queue_storage_if_needed = function() { - if (!process.env['AZURE_STORAGE_ACCOUNT']) { - conf.resources['storage_account'] = util.rand_suffix; - task_queue.push([ - 'storage', 'account', 'create', - '--type=LRS', - get_location(), - conf.resources['storage_account'], - ]); - process.env['AZURE_STORAGE_ACCOUNT'] = conf.resources['storage_account']; - } else { - // Preserve it for resizing, so we don't create a new one by accedent, - // when the environment variable is unset - conf.resources['storage_account'] = process.env['AZURE_STORAGE_ACCOUNT']; - } -}; - -exports.queue_machines = function (name_prefix, coreos_update_channel, cloud_config_creator) { - var x = conf.nodes[name_prefix]; - var vm_create_base_args = [ - 'vm', 'create', - get_location(), - get_vm_size(), - '--connect=' + conf.resources['service'], - '--virtual-network-name=' + conf.resources['vnet'], - '--no-ssh-password', - '--ssh-cert=' + conf.resources['ssh_key']['pem'], - ]; - - var cloud_config = cloud_config_creator(x, conf); - - var next_host = function (n) { - hosts.ssh_port_counter += 1; - var host = { name: util.hostname(n, name_prefix), port: hosts.ssh_port_counter }; - if (cloud_config instanceof Array) { - host.cloud_config_file = cloud_config[n]; - } else { - host.cloud_config_file = cloud_config; - } - hosts.collection.push(host); - return _.map([ - "--vm-name=<%= name %>", - "--ssh=<%= port %>", - "--custom-data=<%= cloud_config_file %>", - ], function (arg) { return _.template(arg)(host); }); - }; - - task_queue = task_queue.concat(_(x).times(function (n) { - if (conf.resizing && n < conf.old_size) { - return []; - } else { - return vm_create_base_args.concat(next_host(n), [ - coreos_image_ids[coreos_update_channel], 'core', - ]); - } - })); -}; - -exports.create_config = function (name, nodes) { - conf = { - name: name, - nodes: nodes, - weave_salt: util.rand_string(), - resources: { - vnet: [name, 'internal-vnet', util.rand_suffix].join('-'), - service: [name, util.rand_suffix].join('-'), - ssh_key: create_ssh_key(name), - } - }; - -}; - -exports.destroy_cluster = function (state_file) { - load_state(state_file); - if (conf.hosts === undefined) { - console.log(clr.red('azure_wrapper/fail: Nothing to delete.')); - process.abort(); - } - - conf.destroying = true; - task_queue = _.map(conf.hosts, function (host) { - return ['vm', 'delete', '--quiet', '--blob-delete', host.name]; - }); - - task_queue.push(['network', 'vnet', 'delete', '--quiet', conf.resources['vnet']]); - task_queue.push(['storage', 'account', 'delete', '--quiet', conf.resources['storage_account']]); - - exports.run_task_queue(); -}; - -exports.load_state_for_resizing = function (state_file, node_type, new_nodes) { - load_state(state_file); - if (conf.hosts === undefined) { - console.log(clr.red('azure_wrapper/fail: Nothing to look at.')); - process.abort(); - } - conf.resizing = true; - conf.old_size = conf.nodes[node_type]; - conf.old_state_file = state_file; - conf.nodes[node_type] += new_nodes; - hosts.collection = conf.hosts; - hosts.ssh_port_counter += conf.hosts.length; - process.env['AZURE_STORAGE_ACCOUNT'] = conf.resources['storage_account']; -} diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/lib/cloud_config.js b/release-0.20.0/docs/getting-started-guides/coreos/azure/lib/cloud_config.js deleted file mode 100644 index 75cff6cf2db..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/lib/cloud_config.js +++ /dev/null @@ -1,43 +0,0 @@ -var _ = require('underscore'); -var fs = require('fs'); -var yaml = require('js-yaml'); -var colors = require('colors/safe'); - - -var write_cloud_config_from_object = function (data, output_file) { - try { - fs.writeFileSync(output_file, [ - '#cloud-config', - yaml.safeDump(data), - ].join("\n")); - return output_file; - } catch (e) { - console.log(colors.red(e)); - } -}; - -exports.generate_environment_file_entry_from_object = function (hostname, environ) { - var data = { - hostname: hostname, - environ_array: _.map(environ, function (value, key) { - return [key.toUpperCase(), JSON.stringify(value.toString())].join('='); - }), - }; - - return { - permissions: '0600', - owner: 'root', - content: _.template("<%= environ_array.join('\\n') %>\n")(data), - path: _.template("/etc/weave.<%= hostname %>.env")(data), - }; -}; - -exports.process_template = function (input_file, output_file, processor) { - var data = {}; - try { - data = yaml.safeLoad(fs.readFileSync(input_file, 'utf8')); - } catch (e) { - console.log(colors.red(e)); - } - return write_cloud_config_from_object(processor(_.clone(data)), output_file); -}; diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/lib/deployment_logic/kubernetes.js b/release-0.20.0/docs/getting-started-guides/coreos/azure/lib/deployment_logic/kubernetes.js deleted file mode 100644 index e497a55708d..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/lib/deployment_logic/kubernetes.js +++ /dev/null @@ -1,76 +0,0 @@ -var _ = require('underscore'); -_.mixin(require('underscore.string').exports()); - -var util = require('../util.js'); -var cloud_config = require('../cloud_config.js'); - - -etcd_initial_cluster_conf_self = function (conf) { - var port = '2380'; - - var data = { - nodes: _(conf.nodes.etcd).times(function (n) { - var host = util.hostname(n, 'etcd'); - return [host, [host, port].join(':')].join('=http://'); - }), - }; - - return { - 'name': 'etcd2.service', - 'drop-ins': [{ - 'name': '50-etcd-initial-cluster.conf', - 'content': _.template("[Service]\nEnvironment=ETCD_INITIAL_CLUSTER=<%= nodes.join(',') %>\n")(data), - }], - }; -}; - -etcd_initial_cluster_conf_kube = function (conf) { - var port = '4001'; - - var data = { - nodes: _(conf.nodes.etcd).times(function (n) { - var host = util.hostname(n, 'etcd'); - return 'http://' + [host, port].join(':'); - }), - }; - - return { - 'name': 'apiserver.service', - 'drop-ins': [{ - 'name': '50-etcd-initial-cluster.conf', - 'content': _.template("[Service]\nEnvironment=ETCD_SERVERS=--etcd_servers=<%= nodes.join(',') %>\n")(data), - }], - }; -}; - -exports.create_etcd_cloud_config = function (node_count, conf) { - var input_file = './cloud_config_templates/kubernetes-cluster-etcd-node-template.yml'; - var output_file = util.join_output_file_path('kubernetes-cluster-etcd-nodes', 'generated.yml'); - - return cloud_config.process_template(input_file, output_file, function(data) { - data.coreos.units.push(etcd_initial_cluster_conf_self(conf)); - return data; - }); -}; - -exports.create_node_cloud_config = function (node_count, conf) { - var elected_node = 0; - - var input_file = './cloud_config_templates/kubernetes-cluster-main-nodes-template.yml'; - var output_file = util.join_output_file_path('kubernetes-cluster-main-nodes', 'generated.yml'); - - var make_node_config = function (n) { - return cloud_config.generate_environment_file_entry_from_object(util.hostname(n, 'kube'), { - weave_password: conf.weave_salt, - weave_peers: n === elected_node ? "" : util.hostname(elected_node, 'kube'), - breakout_route: util.ipv4([10, 2, 0, 0], 16), - bridge_address_cidr: util.ipv4([10, 2, n, 1], 24), - }); - }; - - return cloud_config.process_template(input_file, output_file, function(data) { - data.write_files = data.write_files.concat(_(node_count).times(make_node_config)); - data.coreos.units.push(etcd_initial_cluster_conf_kube(conf)); - return data; - }); -}; diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/lib/util.js b/release-0.20.0/docs/getting-started-guides/coreos/azure/lib/util.js deleted file mode 100644 index 2c88b8cff35..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/lib/util.js +++ /dev/null @@ -1,33 +0,0 @@ -var _ = require('underscore'); -_.mixin(require('underscore.string').exports()); - -exports.ipv4 = function (ocets, prefix) { - return { - ocets: ocets, - prefix: prefix, - toString: function () { - return [ocets.join('.'), prefix].join('/'); - } - } -}; - -exports.hostname = function hostname (n, prefix) { - return _.template("<%= pre %>-<%= seq %>")({ - pre: prefix || 'core', - seq: _.pad(n, 2, '0'), - }); -}; - -exports.rand_string = function () { - var crypto = require('crypto'); - var shasum = crypto.createHash('sha256'); - shasum.update(crypto.randomBytes(256)); - return shasum.digest('hex'); -}; - - -exports.rand_suffix = exports.rand_string().substring(50); - -exports.join_output_file_path = function(prefix, suffix) { - return './output/' + [prefix, exports.rand_suffix, suffix].join('_'); -}; diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/package.json b/release-0.20.0/docs/getting-started-guides/coreos/azure/package.json deleted file mode 100644 index 2eb45fd03ff..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/package.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "name": "coreos-azure-weave", - "version": "1.0.0", - "description": "Small utility to bring up a woven CoreOS cluster", - "main": "index.js", - "scripts": { - "test": "echo \"Error: no test specified\" && exit 1" - }, - "author": "Ilya Dmitrichenko ", - "license": "Apache 2.0", - "dependencies": { - "azure-cli": "^0.9.2", - "colors": "^1.0.3", - "js-yaml": "^3.2.5", - "openssl-wrapper": "^0.2.1", - "underscore": "^1.7.0", - "underscore.string": "^3.0.2" - } -} diff --git a/release-0.20.0/docs/getting-started-guides/coreos/azure/scale-kubernetes-cluster.js b/release-0.20.0/docs/getting-started-guides/coreos/azure/scale-kubernetes-cluster.js deleted file mode 100755 index f606898874c..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/azure/scale-kubernetes-cluster.js +++ /dev/null @@ -1,10 +0,0 @@ -#!/usr/bin/env node - -var azure = require('./lib/azure_wrapper.js'); -var kube = require('./lib/deployment_logic/kubernetes.js'); - -azure.load_state_for_resizing(process.argv[2], 'kube', parseInt(process.argv[3] || 1)); - -azure.run_task_queue([ - azure.queue_machines('kube', 'stable', kube.create_node_cloud_config), -]); diff --git a/release-0.20.0/docs/getting-started-guides/coreos/bare_metal_offline.md b/release-0.20.0/docs/getting-started-guides/coreos/bare_metal_offline.md deleted file mode 100644 index 00182e01562..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/bare_metal_offline.md +++ /dev/null @@ -1,663 +0,0 @@ -Bare Metal CoreOS with Kubernetes (OFFLINE) ------------------------------------------- -Deploy a CoreOS running Kubernetes environment. This particular guild is made to help those in an OFFLINE system, wither for testing a POC before the real deal, or you are restricted to be totally offline for your applications. - -**Table of Contents** - -- [Prerequisites](#prerequisites) -- [High Level Design](#high-level-design) -- [This Guides variables](#this-guides-variables) -- [Setup PXELINUX CentOS](#setup-pxelinux-centos) -- [Adding CoreOS to PXE](#adding-coreos-to-pxe) -- [DHCP configuration](#dhcp-configuration) -- [Kubernetes](#kubernetes) -- [Cloud Configs](#cloud-configs) - - [master.yml](#masteryml) - - [node.yml](#nodeyml) -- [New pxelinux.cfg file](#new-pxelinuxcfg-file) -- [Specify the pxelinux targets](#specify-the-pxelinux-targets) -- [Creating test pod](#creating-test-pod) -- [Helping commands for debugging](#helping-commands-for-debugging) - - -## Prerequisites -1. Installed *CentOS 6* for PXE server -2. At least two bare metal nodes to work with - -## High Level Design -1. Manage the tftp directory - * /tftpboot/(coreos)(centos)(RHEL) - * /tftpboot/pxelinux.0/(MAC) -> linked to Linux image config file -2. Update per install the link for pxelinux -3. Update the DHCP config to reflect the host needing deployment -4. Setup nodes to deploy CoreOS creating a etcd cluster. -5. Have no access to the public [etcd discovery tool](https://discovery.etcd.io/). -6. Installing the CoreOS slaves to become Kubernetes minions. - -## This Guides variables -| Node Description | MAC | IP | -| :---------------------------- | :---------------: | :---------: | -| CoreOS/etcd/Kubernetes Master | d0:00:67:13:0d:00 | 10.20.30.40 | -| CoreOS Slave 1 | d0:00:67:13:0d:01 | 10.20.30.41 | -| CoreOS Slave 2 | d0:00:67:13:0d:02 | 10.20.30.42 | - - -## Setup PXELINUX CentOS -To setup CentOS PXELINUX environment there is a complete [guide here](http://docs.fedoraproject.org/en-US/Fedora/7/html/Installation_Guide/ap-pxe-server.html). This section is the abbreviated version. - -1. Install packages needed on CentOS - - sudo yum install tftp-server dhcp syslinux - -2. ```vi /etc/xinetd.d/tftp``` to enable tftp service and change disable to 'no' - disable = no - -3. Copy over the syslinux images we will need. - - su - - mkdir -p /tftpboot - cd /tftpboot - cp /usr/share/syslinux/pxelinux.0 /tftpboot - cp /usr/share/syslinux/menu.c32 /tftpboot - cp /usr/share/syslinux/memdisk /tftpboot - cp /usr/share/syslinux/mboot.c32 /tftpboot - cp /usr/share/syslinux/chain.c32 /tftpboot - - /sbin/service dhcpd start - /sbin/service xinetd start - /sbin/chkconfig tftp on - -4. Setup default boot menu - - mkdir /tftpboot/pxelinux.cfg - touch /tftpboot/pxelinux.cfg/default - -5. Edit the menu ```vi /tftpboot/pxelinux.cfg/default``` - - default menu.c32 - prompt 0 - timeout 15 - ONTIMEOUT local - display boot.msg - - MENU TITLE Main Menu - - LABEL local - MENU LABEL Boot local hard drive - LOCALBOOT 0 - -Now you should have a working PXELINUX setup to image CoreOS nodes. You can verify the services by using VirtualBox locally or with bare metal servers. - -## Adding CoreOS to PXE -This section describes how to setup the CoreOS images to live alongside a pre-existing PXELINUX environment. - -1. Find or create the TFTP root directory that everything will be based off of. - * For this document we will assume ```/tftpboot/``` is our root directory. -2. Once we know and have our tftp root directory we will create a new directory structure for our CoreOS images. -3. Download the CoreOS PXE files provided by the CoreOS team. - - MY_TFTPROOT_DIR=/tftpboot - mkdir -p $MY_TFTPROOT_DIR/images/coreos/ - cd $MY_TFTPROOT_DIR/images/coreos/ - wget http://stable.release.core-os.net/amd64-usr/current/coreos_production_pxe.vmlinuz - wget http://stable.release.core-os.net/amd64-usr/current/coreos_production_pxe.vmlinuz.sig - wget http://stable.release.core-os.net/amd64-usr/current/coreos_production_pxe_image.cpio.gz - wget http://stable.release.core-os.net/amd64-usr/current/coreos_production_pxe_image.cpio.gz.sig - gpg --verify coreos_production_pxe.vmlinuz.sig - gpg --verify coreos_production_pxe_image.cpio.gz.sig - -4. Edit the menu ```vi /tftpboot/pxelinux.cfg/default``` again - - default menu.c32 - prompt 0 - timeout 300 - ONTIMEOUT local - display boot.msg - - MENU TITLE Main Menu - - LABEL local - MENU LABEL Boot local hard drive - LOCALBOOT 0 - - MENU BEGIN CoreOS Menu - - LABEL coreos-master - MENU LABEL CoreOS Master - KERNEL images/coreos/coreos_production_pxe.vmlinuz - APPEND initrd=images/coreos/coreos_production_pxe_image.cpio.gz cloud-config-url=http:///pxe-cloud-config-single-master.yml - - LABEL coreos-slave - MENU LABEL CoreOS Slave - KERNEL images/coreos/coreos_production_pxe.vmlinuz - APPEND initrd=images/coreos/coreos_production_pxe_image.cpio.gz cloud-config-url=http:///pxe-cloud-config-slave.yml - MENU END - -This configuration file will now boot from local drive but have the option to PXE image CoreOS. - -## DHCP configuration -This section covers configuring the DHCP server to hand out our new images. In this case we are assuming that there are other servers that will boot alongside other images. - -1. Add the ```filename``` to the _host_ or _subnet_ sections. - - filename "/tftpboot/pxelinux.0"; - -2. At this point we want to make pxelinux configuration files that will be the templates for the different CoreOS deployments. - - subnet 10.20.30.0 netmask 255.255.255.0 { - next-server 10.20.30.242; - option broadcast-address 10.20.30.255; - filename ""; - - ... - # http://www.syslinux.org/wiki/index.php/PXELINUX - host core_os_master { - hardware ethernet d0:00:67:13:0d:00; - option routers 10.20.30.1; - fixed-address 10.20.30.40; - option domain-name-servers 10.20.30.242; - filename "/pxelinux.0"; - } - host core_os_slave { - hardware ethernet d0:00:67:13:0d:01; - option routers 10.20.30.1; - fixed-address 10.20.30.41; - option domain-name-servers 10.20.30.242; - filename "/pxelinux.0"; - } - host core_os_slave2 { - hardware ethernet d0:00:67:13:0d:02; - option routers 10.20.30.1; - fixed-address 10.20.30.42; - option domain-name-servers 10.20.30.242; - filename "/pxelinux.0"; - } - ... - } - -We will be specifying the node configuration later in the guide. - -## Kubernetes -To deploy our configuration we need to create an ```etcd``` master. To do so we want to pxe CoreOS with a specific cloud-config.yml. There are two options we have here. -1. Is to template the cloud config file and programmatically create new static configs for different cluster setups. -2. Have a service discovery protocol running in our stack to do auto discovery. - -This demo we just make a static single ```etcd``` server to host our Kubernetes and ```etcd``` master servers. - -Since we are OFFLINE here most of the helping processes in CoreOS and Kubernetes are then limited. To do our setup we will then have to download and serve up our binaries for Kubernetes in our local environment. - -An easy solution is to host a small web server on the DHCP/TFTP host for all our binaries to make them available to the local CoreOS PXE machines. - -To get this up and running we are going to setup a simple ```apache``` server to serve our binaries needed to bootstrap Kubernetes. - -This is on the PXE server from the previous section: - - rm /etc/httpd/conf.d/welcome.conf - cd /var/www/html/ - wget -O kube-register https://github.com/kelseyhightower/kube-register/releases/download/v0.0.2/kube-register-0.0.2-linux-amd64 - wget -O setup-network-environment https://github.com/kelseyhightower/setup-network-environment/releases/download/v1.0.0/setup-network-environment - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kubernetes --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-apiserver --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-controller-manager --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-scheduler --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kubectl --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kubecfg --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kubelet --no-check-certificate - wget https://storage.googleapis.com/kubernetes-release/release/v0.15.0/bin/linux/amd64/kube-proxy --no-check-certificate - wget -O flanneld https://storage.googleapis.com/k8s/flanneld --no-check-certificate - -This sets up our binaries we need to run Kubernetes. This would need to be enhanced to download from the Internet for updates in the future. - -Now for the good stuff! - -## Cloud Configs -The following config files are tailored for the OFFLINE version of a Kubernetes deployment. - -These are based on the work found here: [master.yml](http://docs.k8s.io/getting-started-guides/coreos/cloud-configs/master.yaml), [node.yml](http://docs.k8s.io/getting-started-guides/coreos/cloud-configs/node.yaml) - -To make the setup work, you need to replace a few placeholders: - - - Replace `` with your PXE server ip address (e.g. 10.20.30.242) - - Replace `` with the kubernetes master ip address (e.g. 10.20.30.40) - - If you run a private docker registry, replace `rdocker.example.com` with your docker registry dns name. - - If you use a proxy, replace `rproxy.example.com` with your proxy server (and port) - - Add your own SSH public key(s) to the cloud config at the end - -### master.yml -On the PXE server make and fill in the variables ```vi /var/www/html/coreos/pxe-cloud-config-master.yml```. - - - #cloud-config - --- - write_files: - - path: /opt/bin/waiter.sh - owner: root - content: | - #! /usr/bin/bash - until curl http://127.0.0.1:4001/v2/machines; do sleep 2; done - - path: /opt/bin/kubernetes-download.sh - owner: root - permissions: 0755 - content: | - #! /usr/bin/bash - /usr/bin/wget -N -P "/opt/bin" "http:///kubectl" - /usr/bin/wget -N -P "/opt/bin" "http:///kubernetes" - /usr/bin/wget -N -P "/opt/bin" "http:///kubecfg" - chmod +x /opt/bin/* - - path: /etc/profile.d/opt-path.sh - owner: root - permissions: 0755 - content: | - #! /usr/bin/bash - PATH=$PATH/opt/bin - coreos: - units: - - name: 10-eno1.network - runtime: true - content: | - [Match] - Name=eno1 - [Network] - DHCP=yes - - name: 20-nodhcp.network - runtime: true - content: | - [Match] - Name=en* - [Network] - DHCP=none - - name: get-kube-tools.service - runtime: true - command: start - content: | - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStart=/opt/bin/kubernetes-download.sh - RemainAfterExit=yes - Type=oneshot - - name: setup-network-environment.service - command: start - content: | - [Unit] - Description=Setup Network Environment - Documentation=https://github.com/kelseyhightower/setup-network-environment - Requires=network-online.target - After=network-online.target - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///setup-network-environment - ExecStartPre=/usr/bin/chmod +x /opt/bin/setup-network-environment - ExecStart=/opt/bin/setup-network-environment - RemainAfterExit=yes - Type=oneshot - - name: etcd.service - command: start - content: | - [Unit] - Description=etcd - Requires=setup-network-environment.service - After=setup-network-environment.service - [Service] - EnvironmentFile=/etc/network-environment - User=etcd - PermissionsStartOnly=true - ExecStart=/usr/bin/etcd \ - --name ${DEFAULT_IPV4} \ - --addr ${DEFAULT_IPV4}:4001 \ - --bind-addr 0.0.0.0 \ - --cluster-active-size 1 \ - --data-dir /var/lib/etcd \ - --http-read-timeout 86400 \ - --peer-addr ${DEFAULT_IPV4}:7001 \ - --snapshot true - Restart=always - RestartSec=10s - - name: fleet.socket - command: start - content: | - [Socket] - ListenStream=/var/run/fleet.sock - - name: fleet.service - command: start - content: | - [Unit] - Description=fleet daemon - Wants=etcd.service - After=etcd.service - Wants=fleet.socket - After=fleet.socket - [Service] - Environment="FLEET_ETCD_SERVERS=http://127.0.0.1:4001" - Environment="FLEET_METADATA=role=master" - ExecStart=/usr/bin/fleetd - Restart=always - RestartSec=10s - - name: etcd-waiter.service - command: start - content: | - [Unit] - Description=etcd waiter - Wants=network-online.target - Wants=etcd.service - After=etcd.service - After=network-online.target - Before=flannel.service - Before=setup-network-environment.service - [Service] - ExecStartPre=/usr/bin/chmod +x /opt/bin/waiter.sh - ExecStart=/usr/bin/bash /opt/bin/waiter.sh - RemainAfterExit=true - Type=oneshot - - name: flannel.service - command: start - content: | - [Unit] - Wants=etcd-waiter.service - After=etcd-waiter.service - Requires=etcd.service - After=etcd.service - After=network-online.target - Wants=network-online.target - Description=flannel is an etcd backed overlay network for containers - [Service] - Type=notify - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///flanneld - ExecStartPre=/usr/bin/chmod +x /opt/bin/flanneld - ExecStartPre=-/usr/bin/etcdctl mk /coreos.com/network/config '{"Network":"10.100.0.0/16", "Backend": {"Type": "vxlan"}}' - ExecStart=/opt/bin/flanneld - - name: kube-apiserver.service - command: start - content: | - [Unit] - Description=Kubernetes API Server - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd.service - After=etcd.service - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kube-apiserver - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver - ExecStart=/opt/bin/kube-apiserver \ - --address=0.0.0.0 \ - --port=8080 \ - --service-cluster-ip-range=10.100.0.0/16 \ - --etcd_servers=http://127.0.0.1:4001 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-controller-manager.service - command: start - content: | - [Unit] - Description=Kubernetes Controller Manager - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kube-controller-manager - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager - ExecStart=/opt/bin/kube-controller-manager \ - --master=127.0.0.1:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-scheduler.service - command: start - content: | - [Unit] - Description=Kubernetes Scheduler - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kube-scheduler - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler - ExecStart=/opt/bin/kube-scheduler --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - - name: kube-register.service - command: start - content: | - [Unit] - Description=Kubernetes Registration Service - Documentation=https://github.com/kelseyhightower/kube-register - Requires=kube-apiserver.service - After=kube-apiserver.service - Requires=fleet.service - After=fleet.service - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kube-register - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-register - ExecStart=/opt/bin/kube-register \ - --metadata=role=node \ - --fleet-endpoint=unix:///var/run/fleet.sock \ - --healthz-port=10248 \ - --api-endpoint=http://127.0.0.1:8080 - Restart=always - RestartSec=10 - update: - group: stable - reboot-strategy: off - ssh_authorized_keys: - - ssh-rsa AAAAB3NzaC1yc2EAAAAD... - - -### node.yml -On the PXE server make and fill in the variables ```vi /var/www/html/coreos/pxe-cloud-config-slave.yml```. - - #cloud-config - --- - write_files: - - path: /etc/default/docker - content: | - DOCKER_EXTRA_OPTS='--insecure-registry="rdocker.example.com:5000"' - coreos: - units: - - name: 10-eno1.network - runtime: true - content: | - [Match] - Name=eno1 - [Network] - DHCP=yes - - name: 20-nodhcp.network - runtime: true - content: | - [Match] - Name=en* - [Network] - DHCP=none - - name: etcd.service - mask: true - - name: docker.service - drop-ins: - - name: 50-insecure-registry.conf - content: | - [Service] - Environment="HTTP_PROXY=http://rproxy.example.com:3128/" "NO_PROXY=localhost,127.0.0.0/8,rdocker.example.com" - - name: fleet.service - command: start - content: | - [Unit] - Description=fleet daemon - Wants=fleet.socket - After=fleet.socket - [Service] - Environment="FLEET_ETCD_SERVERS=http://:4001" - Environment="FLEET_METADATA=role=node" - ExecStart=/usr/bin/fleetd - Restart=always - RestartSec=10s - - name: flannel.service - command: start - content: | - [Unit] - After=network-online.target - Wants=network-online.target - Description=flannel is an etcd backed overlay network for containers - [Service] - Type=notify - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///flanneld - ExecStartPre=/usr/bin/chmod +x /opt/bin/flanneld - ExecStart=/opt/bin/flanneld -etcd-endpoints http://:4001 - - name: docker.service - command: start - content: | - [Unit] - After=flannel.service - Wants=flannel.service - Description=Docker Application Container Engine - Documentation=http://docs.docker.io - [Service] - EnvironmentFile=-/etc/default/docker - EnvironmentFile=/run/flannel/subnet.env - ExecStartPre=/bin/mount --make-rprivate / - ExecStart=/usr/bin/docker -d --bip=${FLANNEL_SUBNET} --mtu=${FLANNEL_MTU} -s=overlay -H fd:// ${DOCKER_EXTRA_OPTS} - [Install] - WantedBy=multi-user.target - - name: setup-network-environment.service - command: start - content: | - [Unit] - Description=Setup Network Environment - Documentation=https://github.com/kelseyhightower/setup-network-environment - Requires=network-online.target - After=network-online.target - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///setup-network-environment - ExecStartPre=/usr/bin/chmod +x /opt/bin/setup-network-environment - ExecStart=/opt/bin/setup-network-environment - RemainAfterExit=yes - Type=oneshot - - name: kube-proxy.service - command: start - content: | - [Unit] - Description=Kubernetes Proxy - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=setup-network-environment.service - After=setup-network-environment.service - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kube-proxy - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy - ExecStart=/opt/bin/kube-proxy \ - --etcd_servers=http://:4001 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-kubelet.service - command: start - content: | - [Unit] - Description=Kubernetes Kubelet - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=setup-network-environment.service - After=setup-network-environment.service - [Service] - EnvironmentFile=/etc/network-environment - ExecStartPre=/usr/bin/wget -N -P /opt/bin http:///kubelet - ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet - ExecStart=/opt/bin/kubelet \ - --address=0.0.0.0 \ - --port=10250 \ - --hostname_override=${DEFAULT_IPV4} \ - --api_servers=:8080 \ - --healthz_bind_address=0.0.0.0 \ - --healthz_port=10248 \ - --logtostderr=true - Restart=always - RestartSec=10 - update: - group: stable - reboot-strategy: off - ssh_authorized_keys: - - ssh-rsa AAAAB3NzaC1yc2EAAAAD... - - -## New pxelinux.cfg file -Create a pxelinux target file for a _slave_ node: ```vi /tftpboot/pxelinux.cfg/coreos-node-slave``` - - default coreos - prompt 1 - timeout 15 - - display boot.msg - - label coreos - menu default - kernel images/coreos/coreos_production_pxe.vmlinuz - append initrd=images/coreos/coreos_production_pxe_image.cpio.gz cloud-config-url=http:///coreos/pxe-cloud-config-slave.yml console=tty0 console=ttyS0 coreos.autologin=tty1 coreos.autologin=ttyS0 - -And one for the _master_ node: ```vi /tftpboot/pxelinux.cfg/coreos-node-master``` - - default coreos - prompt 1 - timeout 15 - - display boot.msg - - label coreos - menu default - kernel images/coreos/coreos_production_pxe.vmlinuz - append initrd=images/coreos/coreos_production_pxe_image.cpio.gz cloud-config-url=http:///coreos/pxe-cloud-config-master.yml console=tty0 console=ttyS0 coreos.autologin=tty1 coreos.autologin=ttyS0 - -## Specify the pxelinux targets -Now that we have our new targets setup for master and slave we want to configure the specific hosts to those targets. We will do this by using the pxelinux mechanism of setting a specific MAC addresses to a specific pxelinux.cfg file. - -Refer to the MAC address table in the beginning of this guide. Documentation for more details can be found [here](http://www.syslinux.org/wiki/index.php/PXELINUX). - - cd /tftpboot/pxelinux.cfg - ln -s coreos-node-master 01-d0-00-67-13-0d-00 - ln -s coreos-node-slave 01-d0-00-67-13-0d-01 - ln -s coreos-node-slave 01-d0-00-67-13-0d-02 - - -Reboot these servers to get the images PXEd and ready for running containers! - -## Creating test pod -Now that the CoreOS with Kubernetes installed is up and running lets spin up some Kubernetes pods to demonstrate the system. - -See [a simple nginx example](../../../examples/simple-nginx.md) to try out your new cluster. - -For more complete applications, please look in the [examples directory](../../../examples). - -## Helping commands for debugging - -List all keys in etcd: - - etcdctl ls --recursive - -List fleet machines - - fleetctl list-machines - -Check system status of services on master node: - - systemctl status kube-apiserver - systemctl status kube-controller-manager - systemctl status kube-scheduler - systemctl status kube-register - -Check system status of services on a minion node: - - systemctl status kube-kubelet - systemctl status docker.service - -List Kubernetes - - kubectl get pods - kubectl get minions - - -Kill all pods: - - for i in `kubectl get pods | awk '{print $1}'`; do kubectl stop pod $i; done - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/coreos/bare_metal_offline.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/coreos/bare_metal_offline.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/master.yaml b/release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/master.yaml deleted file mode 100644 index 7310c22582c..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/master.yaml +++ /dev/null @@ -1,180 +0,0 @@ -#cloud-config - ---- -hostname: master -coreos: - etcd2: - name: master - listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001 - advertise-client-urls: http://$private_ipv4:2379,http://$private_ipv4:4001 - initial-cluster-token: k8s_etcd - listen-peer-urls: http://$private_ipv4:2380,http://$private_ipv4:7001 - initial-advertise-peer-urls: http://$private_ipv4:2380 - initial-cluster: master=http://$private_ipv4:2380 - initial-cluster-state: new - fleet: - metadata: "role=master" - units: - - name: setup-network-environment.service - command: start - content: | - [Unit] - Description=Setup Network Environment - Documentation=https://github.com/kelseyhightower/setup-network-environment - Requires=network-online.target - After=network-online.target - - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/curl -L -o /opt/bin/setup-network-environment -z /opt/bin/setup-network-environment https://github.com/kelseyhightower/setup-network-environment/releases/download/v1.0.0/setup-network-environment - ExecStartPre=/usr/bin/chmod +x /opt/bin/setup-network-environment - ExecStart=/opt/bin/setup-network-environment - RemainAfterExit=yes - Type=oneshot - - name: fleet.service - command: start - - name: flanneld.service - command: start - drop-ins: - - name: 50-network-config.conf - content: | - [Unit] - Requires=etcd2.service - [Service] - ExecStartPre=/usr/bin/etcdctl set /coreos.com/network/config '{"Network":"10.244.0.0/16", "Backend": {"Type": "vxlan"}}' - - name: docker-cache.service - command: start - content: | - [Unit] - Description=Docker cache proxy - Requires=early-docker.service - After=early-docker.service - Before=early-docker.target - - [Service] - Restart=always - TimeoutStartSec=0 - RestartSec=5 - Environment="TMPDIR=/var/tmp/" - Environment="DOCKER_HOST=unix:///var/run/early-docker.sock" - ExecStartPre=-/usr/bin/docker kill docker-registry - ExecStartPre=-/usr/bin/docker rm docker-registry - ExecStartPre=/usr/bin/docker pull quay.io/devops/docker-registry:latest - # GUNICORN_OPTS is an workaround for - # https://github.com/docker/docker-registry/issues/892 - ExecStart=/usr/bin/docker run --rm --net host --name docker-registry \ - -e STANDALONE=false \ - -e GUNICORN_OPTS=[--preload] \ - -e MIRROR_SOURCE=https://registry-1.docker.io \ - -e MIRROR_SOURCE_INDEX=https://index.docker.io \ - -e MIRROR_TAGS_CACHE_TTL=1800 \ - quay.io/devops/docker-registry:latest - - name: docker.service - content: | - [Unit] - Description=Docker Application Container Engine - Documentation=http://docs.docker.com - After=docker.socket early-docker.target network.target - Requires=docker.socket early-docker.target - - [Service] - Environment=TMPDIR=/var/tmp - EnvironmentFile=-/run/flannel_docker_opts.env - EnvironmentFile=/etc/network-environment - MountFlags=slave - LimitNOFILE=1048576 - LimitNPROC=1048576 - ExecStart=/usr/lib/coreos/dockerd --daemon --host=fd:// --registry-mirror=http://${DEFAULT_IPV4}:5000 $DOCKER_OPT_BIP $DOCKER_OPT_MTU $DOCKER_OPT_IPMASQ - - [Install] - WantedBy=multi-user.target - drop-ins: - - name: 51-docker-mirror.conf - content: | - [Unit] - # making sure that docker-cache is up and that flanneld finished - # startup, otherwise containers won't land in flannel's network... - Requires=docker-cache.service flanneld.service - After=docker-cache.service flanneld.service - - name: kube-apiserver.service - command: start - content: | - [Unit] - Description=Kubernetes API Server - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd2.service setup-network-environment.service - After=etcd2.service setup-network-environment.service - - [Service] - EnvironmentFile=/etc/network-environment - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-apiserver -z /opt/bin/kube-apiserver https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-apiserver - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver - ExecStart=/opt/bin/kube-apiserver \ - --allow_privileged=true \ - --insecure_bind_address=0.0.0.0 \ - --insecure_port=8080 \ - --kubelet_https=true \ - --secure_port=6443 \ - --service-cluster-ip-range=10.100.0.0/16 \ - --etcd_servers=http://127.0.0.1:4001 \ - --public_address_override=${DEFAULT_IPV4} \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-controller-manager.service - command: start - content: | - [Unit] - Description=Kubernetes Controller Manager - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-controller-manager -z /opt/bin/kube-controller-manager https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-controller-manager - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager - ExecStart=/opt/bin/kube-controller-manager \ - --master=127.0.0.1:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-scheduler.service - command: start - content: | - [Unit] - Description=Kubernetes Scheduler - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-scheduler -z /opt/bin/kube-scheduler https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-scheduler - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler - ExecStart=/opt/bin/kube-scheduler --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - - name: kube-register.service - command: start - content: | - [Unit] - Description=Kubernetes Registration Service - Documentation=https://github.com/kelseyhightower/kube-register - Requires=kube-apiserver.service - After=kube-apiserver.service - Requires=fleet.service - After=fleet.service - - [Service] - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-register -z /opt/bin/kube-register https://github.com/kelseyhightower/kube-register/releases/download/v0.0.3/kube-register-0.0.3-linux-amd64 - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-register - ExecStart=/opt/bin/kube-register \ - --metadata=role=node \ - --fleet-endpoint=unix:///var/run/fleet.sock \ - --api-endpoint=http://127.0.0.1:8080 \ - --healthz-port=10248 - Restart=always - RestartSec=10 - update: - group: alpha - reboot-strategy: off diff --git a/release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/node.yaml b/release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/node.yaml deleted file mode 100644 index c13c7a97fc1..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/node.yaml +++ /dev/null @@ -1,105 +0,0 @@ -#cloud-config -write-files: - - path: /opt/bin/wupiao - permissions: '0755' - content: | - #!/bin/bash - # [w]ait [u]ntil [p]ort [i]s [a]ctually [o]pen - [ -n "$1" ] && [ -n "$2" ] && while ! curl --output /dev/null \ - --silent --head --fail \ - http://${1}:${2}; do sleep 1 && echo -n .; done; - exit $? -coreos: - etcd2: - listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001 - advertise-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001 - initial-cluster: master=http://:2380 - proxy: on - fleet: - metadata: "role=node" - units: - - name: fleet.service - command: start - - name: flanneld.service - command: start - drop-ins: - - name: 50-network-config.conf - content: | - [Unit] - Requires=etcd2.service - [Service] - ExecStartPre=/usr/bin/etcdctl set /coreos.com/network/config '{"Network":"10.244.0.0/16", "Backend": {"Type": "vxlan"}}' - - name: docker.service - command: start - drop-ins: - - name: 51-docker-mirror.conf - content: | - [Unit] - Requires=flanneld.service - After=flanneld.service - [Service] - Environment=DOCKER_OPTS='--registry-mirror=http://:5000' - - name: setup-network-environment.service - command: start - content: | - [Unit] - Description=Setup Network Environment - Documentation=https://github.com/kelseyhightower/setup-network-environment - Requires=network-online.target - After=network-online.target - - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/curl -L -o /opt/bin/setup-network-environment -z /opt/bin/setup-network-environment https://github.com/kelseyhightower/setup-network-environment/releases/download/v1.0.0/setup-network-environment - ExecStartPre=/usr/bin/chmod +x /opt/bin/setup-network-environment - ExecStart=/opt/bin/setup-network-environment - RemainAfterExit=yes - Type=oneshot - - name: kube-proxy.service - command: start - content: | - [Unit] - Description=Kubernetes Proxy - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=setup-network-environment.service - After=setup-network-environment.service - - [Service] - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kube-proxy -z /opt/bin/kube-proxy https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-proxy - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy - # wait for kubernetes master to be up and ready - ExecStartPre=/opt/bin/wupiao 8080 - ExecStart=/opt/bin/kube-proxy \ - --master=:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-kubelet.service - command: start - content: | - [Unit] - Description=Kubernetes Kubelet - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=setup-network-environment.service - After=setup-network-environment.service - - [Service] - EnvironmentFile=/etc/network-environment - ExecStartPre=/usr/bin/curl -L -o /opt/bin/kubelet -z /opt/bin/kubelet https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kubelet - ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet - # wait for kubernetes master to be up and ready - ExecStartPre=/opt/bin/wupiao 8080 - ExecStart=/opt/bin/kubelet \ - --address=0.0.0.0 \ - --port=10250 \ - --hostname_override=${DEFAULT_IPV4} \ - --api_servers=:8080 \ - --allow_privileged=true \ - --logtostderr=true \ - --healthz_bind_address=0.0.0.0 \ - --healthz_port=10248 - Restart=always - RestartSec=10 - update: - group: alpha - reboot-strategy: off diff --git a/release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/standalone.yaml b/release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/standalone.yaml deleted file mode 100644 index 722e5a3c060..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/cloud-configs/standalone.yaml +++ /dev/null @@ -1,168 +0,0 @@ -#cloud-config - ---- -hostname: master -coreos: - etcd2: - name: master - listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001 - advertise-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001 - initial-cluster-token: k8s_etcd - listen-peer-urls: http://0.0.0.0:2380,http://0.0.0.0:7001 - initial-advertise-peer-urls: http://0.0.0.0:2380 - initial-cluster: master=http://0.0.0.0:2380 - initial-cluster-state: new - units: - - name: etcd2.service - command: start - - name: fleet.service - command: start - - name: flanneld.service - command: start - drop-ins: - - name: 50-network-config.conf - content: | - [Unit] - Requires=etcd2.service - [Service] - ExecStartPre=/usr/bin/etcdctl set /coreos.com/network/config '{"Network":"10.244.0.0/16", "Backend": {"Type": "vxlan"}}' - - name: docker-cache.service - command: start - content: | - [Unit] - Description=Docker cache proxy - Requires=early-docker.service - After=early-docker.service - Before=early-docker.target - - [Service] - Restart=always - TimeoutStartSec=0 - RestartSec=5 - Environment="TMPDIR=/var/tmp/" - Environment="DOCKER_HOST=unix:///var/run/early-docker.sock" - ExecStartPre=-/usr/bin/docker kill docker-registry - ExecStartPre=-/usr/bin/docker rm docker-registry - ExecStartPre=/usr/bin/docker pull quay.io/devops/docker-registry:latest - # GUNICORN_OPTS is an workaround for - # https://github.com/docker/docker-registry/issues/892 - ExecStart=/usr/bin/docker run --rm --net host --name docker-registry \ - -e STANDALONE=false \ - -e GUNICORN_OPTS=[--preload] \ - -e MIRROR_SOURCE=https://registry-1.docker.io \ - -e MIRROR_SOURCE_INDEX=https://index.docker.io \ - -e MIRROR_TAGS_CACHE_TTL=1800 \ - quay.io/devops/docker-registry:latest - - name: docker.service - command: start - drop-ins: - - name: 51-docker-mirror.conf - content: | - [Unit] - # making sure that docker-cache is up and that flanneld finished - # startup, otherwise containers won't land in flannel's network... - Requires=docker-cache.service flanneld.service - After=docker-cache.service flanneld.service - [Service] - Environment=DOCKER_OPTS='--registry-mirror=http://$private_ipv4:5000' - - name: kube-apiserver.service - command: start - content: | - [Unit] - Description=Kubernetes API Server - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd2.service - After=etcd2.service - - [Service] - ExecStartPre=-/usr/bin/mkdir -p /opt/bin - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-apiserver - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver - ExecStart=/opt/bin/kube-apiserver \ - --allow_privileged=true \ - --insecure_bind_address=0.0.0.0 \ - --insecure_port=8080 \ - --kubelet_https=true \ - --secure_port=6443 \ - --service-cluster-ip-range=10.100.0.0/16 \ - --etcd_servers=http://127.0.0.1:4001 \ - --public_address_override=127.0.0.1 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-controller-manager.service - command: start - content: | - [Unit] - Description=Kubernetes Controller Manager - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-controller-manager - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager - ExecStart=/opt/bin/kube-controller-manager \ - --machines=127.0.0.1 \ - --master=127.0.0.1:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-scheduler.service - command: start - content: | - [Unit] - Description=Kubernetes Scheduler - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=kube-apiserver.service - After=kube-apiserver.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-scheduler - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler - ExecStart=/opt/bin/kube-scheduler --master=127.0.0.1:8080 - Restart=always - RestartSec=10 - - name: kube-proxy.service - command: start - content: | - [Unit] - Description=Kubernetes Proxy - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd2.service - After=etcd2.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kube-proxy - ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy - ExecStart=/opt/bin/kube-proxy \ - --master=127.0.0.1:8080 \ - --logtostderr=true - Restart=always - RestartSec=10 - - name: kube-kubelet.service - command: start - content: | - [Unit] - Description=Kubernetes Kubelet - Documentation=https://github.com/GoogleCloudPlatform/kubernetes - Requires=etcd2.service - After=etcd2.service - - [Service] - ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kubelet - ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet - ExecStart=/opt/bin/kubelet \ - --address=0.0.0.0 \ - --port=10250 \ - --hostname_override=127.0.0.1 \ - --api_servers=127.0.0.1:8080 \ - --allow_privileged=true \ - --logtostderr=true \ - --healthz_bind_address=0.0.0.0 \ - --healthz_port=10248 - Restart=always - RestartSec=10 - update: - group: alpha - reboot-strategy: off diff --git a/release-0.20.0/docs/getting-started-guides/coreos/coreos_multinode_cluster.md b/release-0.20.0/docs/getting-started-guides/coreos/coreos_multinode_cluster.md deleted file mode 100644 index 8fab7f6ae70..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/coreos_multinode_cluster.md +++ /dev/null @@ -1,142 +0,0 @@ -# CoreOS Multinode Cluster - -Use the [master.yaml](cloud-configs/master.yaml) and [node.yaml](cloud-configs/node.yaml) cloud-configs to provision a multi-node Kubernetes cluster. - -> **Attention**: This requires at least CoreOS version **[653.0.0][coreos653]**, as this was the first release to include etcd2. - -[coreos653]: https://coreos.com/releases/#653.0.0 - -## Overview - -* Provision the master node -* Capture the master node private IP address -* Edit node.yaml -* Provision one or more worker nodes - -### AWS - -*Attention:* Replace `````` below for a [suitable version of CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/). - -#### Provision the Master - -``` -aws ec2 create-security-group --group-name kubernetes --description "Kubernetes Security Group" -aws ec2 authorize-security-group-ingress --group-name kubernetes --protocol tcp --port 22 --cidr 0.0.0.0/0 -aws ec2 authorize-security-group-ingress --group-name kubernetes --protocol tcp --port 80 --cidr 0.0.0.0/0 -aws ec2 authorize-security-group-ingress --group-name kubernetes --source-security-group-name kubernetes -``` - -``` -aws ec2 run-instances \ ---image-id \ ---key-name \ ---region us-west-2 \ ---security-groups kubernetes \ ---instance-type m3.medium \ ---user-data file://master.yaml -``` - -#### Capture the private IP address - -``` -aws ec2 describe-instances --instance-id -``` - -#### Edit node.yaml - -Edit `node.yaml` and replace all instances of `` with the private IP address of the master node. - -#### Provision worker nodes - -``` -aws ec2 run-instances \ ---count 1 \ ---image-id \ ---key-name \ ---region us-west-2 \ ---security-groups kubernetes \ ---instance-type m3.medium \ ---user-data file://node.yaml -``` - -### GCE - -*Attention:* Replace `````` below for a [suitable version of CoreOS image for GCE](https://coreos.com/docs/running-coreos/cloud-providers/google-compute-engine/). - -#### Provision the Master - -``` -gcloud compute instances create master \ ---image-project coreos-cloud \ ---image \ ---boot-disk-size 200GB \ ---machine-type n1-standard-1 \ ---zone us-central1-a \ ---metadata-from-file user-data=master.yaml -``` - -#### Capture the private IP address - -``` -gcloud compute instances list -``` - -#### Edit node.yaml - -Edit `node.yaml` and replace all instances of `` with the private IP address of the master node. - -#### Provision worker nodes - -``` -gcloud compute instances create node1 \ ---image-project coreos-cloud \ ---image \ ---boot-disk-size 200GB \ ---machine-type n1-standard-1 \ ---zone us-central1-a \ ---metadata-from-file user-data=node.yaml -``` - -#### Establish network connectivity - -Next, setup an ssh tunnel to the master so you can run kubectl from your local host. -In one terminal, run `gcloud compute ssh master --ssh-flag="-L 8080:127.0.0.1:8080"` and in a second -run `gcloud compute ssh master --ssh-flag="-R 8080:127.0.0.1:8080"`. - -### VMware Fusion - -#### Create the master config-drive - -``` -mkdir -p /tmp/new-drive/openstack/latest/ -cp master.yaml /tmp/new-drive/openstack/latest/user_data -hdiutil makehybrid -iso -joliet -joliet-volume-name "config-2" -joliet -o master.iso /tmp/new-drive -``` - -#### Provision the Master - -Boot the [vmware image](https://coreos.com/docs/running-coreos/platforms/vmware) using `master.iso` as a config drive. - -#### Capture the master private IP address - -#### Edit node.yaml - -Edit `node.yaml` and replace all instances of `` with the private IP address of the master node. - -#### Create the node config-drive - -``` -mkdir -p /tmp/new-drive/openstack/latest/ -cp node.yaml /tmp/new-drive/openstack/latest/user_data -hdiutil makehybrid -iso -joliet -joliet-volume-name "config-2" -joliet -o node.iso /tmp/new-drive -``` - -#### Provision worker nodes - -Boot one or more the [vmware image](https://coreos.com/docs/running-coreos/platforms/vmware) using `node.iso` as a config drive. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/coreos/coreos_multinode_cluster.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/coreos/coreos_multinode_cluster.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/coreos/coreos_single_node_cluster.md b/release-0.20.0/docs/getting-started-guides/coreos/coreos_single_node_cluster.md deleted file mode 100644 index ae95fd56c31..00000000000 --- a/release-0.20.0/docs/getting-started-guides/coreos/coreos_single_node_cluster.md +++ /dev/null @@ -1,66 +0,0 @@ -# CoreOS - Single Node Kubernetes Cluster - -Use the [standalone.yaml](cloud-configs/standalone.yaml) cloud-config to provision a single node Kubernetes cluster. - -> **Attention**: This requires at least CoreOS version **[653.0.0][coreos653]**, as this was the first release to include etcd2. - -[coreos653]: https://coreos.com/releases/#653.0.0 - -### CoreOS image versions - -### AWS - -``` -aws ec2 create-security-group --group-name kubernetes --description "Kubernetes Security Group" -aws ec2 authorize-security-group-ingress --group-name kubernetes --protocol tcp --port 22 --cidr 0.0.0.0/0 -aws ec2 authorize-security-group-ingress --group-name kubernetes --source-security-group-name kubernetes -``` - -*Attention:* Replace `````` bellow for a [suitable version of CoreOS image for AWS](https://coreos.com/docs/running-coreos/cloud-providers/ec2/). - -``` -aws ec2 run-instances \ ---image-id \ ---key-name \ ---region us-west-2 \ ---security-groups kubernetes \ ---instance-type m3.medium \ ---user-data file://standalone.yaml -``` - -### GCE - -*Attention:* Replace `````` bellow for a [suitable version of CoreOS image for GCE](https://coreos.com/docs/running-coreos/cloud-providers/google-compute-engine/). - -``` -gcloud compute instances create standalone \ ---image-project coreos-cloud \ ---image \ ---boot-disk-size 200GB \ ---machine-type n1-standard-1 \ ---zone us-central1-a \ ---metadata-from-file user-data=standalone.yaml -``` - -Next, setup an ssh tunnel to the instance so you can run kubectl from your local host. -In one terminal, run `gcloud compute ssh standalone --ssh-flag="-L 8080:127.0.0.1:8080"` and in a second -run `gcloud compute ssh standalone --ssh-flag="-R 8080:127.0.0.1:8080"`. - - -### VMware Fusion - -Create a [config-drive](https://coreos.com/docs/cluster-management/setup/cloudinit-config-drive) ISO. - -``` -mkdir -p /tmp/new-drive/openstack/latest/ -cp standalone.yaml /tmp/new-drive/openstack/latest/user_data -hdiutil makehybrid -iso -joliet -joliet-volume-name "config-2" -joliet -o standalone.iso /tmp/new-drive -``` - -Boot the [vmware image](https://coreos.com/docs/running-coreos/platforms/vmware) using the `standalone.iso` as a config drive. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/coreos/coreos_single_node_cluster.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/coreos/coreos_single_node_cluster.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/docker-multinode.md b/release-0.20.0/docs/getting-started-guides/docker-multinode.md deleted file mode 100644 index b9e4bdab70d..00000000000 --- a/release-0.20.0/docs/getting-started-guides/docker-multinode.md +++ /dev/null @@ -1,58 +0,0 @@ -Running Multi-Node Kubernetes Using Docker ------------------------------------------- - -_Note_: -These instructions are somewhat significantly more advanced than the [single node](docker.md) instructions. If you are -interested in just starting to explore Kubernetes, we recommend that you start there. - -**Table of Contents** - -- [Prerequisites](#prerequisites) -- [Overview](#overview) - - [Bootstrap Docker](#bootstrap-docker) -- [Master Node](#master-node) -- [Adding a worker node](#adding-a-worker-node) -- [Testing your cluster](#testing-your-cluster) - -## Prerequisites -1. You need a machine with docker installed. - -## Overview -This guide will set up a 2-node kubernetes cluster, consisting of a _master_ node which hosts the API server and orchestrates work -and a _worker_ node which receives work from the master. You can repeat the process of adding worker nodes an arbitrary number of -times to create larger clusters. - -Here's a diagram of what the final result will look like: -![Kubernetes Single Node on Docker](k8s-docker.png) - -### Bootstrap Docker -This guide also uses a pattern of running two instances of the Docker daemon - 1) A _bootstrap_ Docker instance which is used to start system daemons like ```flanneld``` and ```etcd``` - 2) A _main_ Docker instance which is used for the Kubernetes infrastructure and user's scheduled containers - -This pattern is necessary because the ```flannel``` daemon is responsible for setting up and managing the network that interconnects -all of the Docker containers created by Kubernetes. To achieve this, it must run outside of the _main_ Docker daemon. However, -it is still useful to use containers for deployment and management, so we create a simpler _bootstrap_ daemon to achieve this. - -## Master Node -The first step in the process is to initialize the master node. - -See [here](docker-multinode/master.md) for detailed instructions. - -## Adding a worker node - -Once your master is up and running you can add one or more workers on different machines. - -See [here](docker-multinode/worker.md) for detailed instructions. - -## Testing your cluster - -Once your cluster has been created you can [test it out](docker-multinode/testing.md) - -For more complete applications, please look in the [examples directory](../../examples) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/docker-multinode.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/docker-multinode.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/docker-multinode/master.md b/release-0.20.0/docs/getting-started-guides/docker-multinode/master.md deleted file mode 100644 index 5638b2bdad2..00000000000 --- a/release-0.20.0/docs/getting-started-guides/docker-multinode/master.md +++ /dev/null @@ -1,149 +0,0 @@ -## Installing a Kubernetes Master Node via Docker -We'll begin by setting up the master node. For the purposes of illustration, we'll assume that the IP of this machine is ```${MASTER_IP}``` - -There are two main phases to installing the master: - * [Setting up ```flanneld``` and ```etcd```](#setting-up-flanneld-and-etcd) - * [Starting the Kubernetes master components](#starting-the-kubernetes-master) - - -## Setting up flanneld and etcd - -### Setup Docker-Bootstrap -We're going to use ```flannel``` to set up networking between Docker daemons. Flannel itself (and etcd on which it relies) will run inside of -Docker containers themselves. To achieve this, we need a separate "bootstrap" instance of the Docker daemon. This daemon will be started with -```--iptables=false``` so that it can only run containers with ```--net=host```. That's sufficient to bootstrap our system. - -Run: -```sh -sudo sh -c 'docker -d -H unix:///var/run/docker-bootstrap.sock -p /var/run/docker-bootstrap.pid --iptables=false --ip-masq=false --bridge=none --graph=/var/lib/docker-bootstrap 2> /var/log/docker-bootstrap.log 1> /dev/null &' -``` - -_Important Note_: -If you are running this on a long running system, rather than experimenting, you should run the bootstrap Docker instance under something like SysV init, upstart or systemd so that it is restarted -across reboots and failures. - - -### Startup etcd for flannel and the API server to use -Run: -``` -sudo docker -H unix:///var/run/docker-bootstrap.sock run --net=host -d gcr.io/google_containers/etcd:2.0.9 /usr/local/bin/etcd --addr=127.0.0.1:4001 --bind-addr=0.0.0.0:4001 --data-dir=/var/etcd/data -``` - -Next, you need to set a CIDR range for flannel. This CIDR should be chosen to be non-overlapping with any existing network you are using: - -```sh -sudo docker -H unix:///var/run/docker-bootstrap.sock run --net=host gcr.io/google_containers/etcd:2.0.9 etcdctl set /coreos.com/network/config '{ "Network": "10.1.0.0/16" }' -``` - - -### Set up Flannel on the master node -Flannel is a network abstraction layer build by CoreOS, we will use it to provide simplfied networking between our Pods of containers. - -Flannel re-configures the bridge that Docker uses for networking. As a result we need to stop Docker, reconfigure its networking, and then restart Docker. - -#### Bring down Docker -To re-configure Docker to use flannel, we need to take docker down, run flannel and then restart Docker. - -Turning down Docker is system dependent, it may be: - -```sh -sudo /etc/init.d/docker stop -``` - -or - -```sh -sudo systemctl stop docker -``` - -or it may be something else. - -#### Run flannel - -Now run flanneld itself: -```sh -sudo docker -H unix:///var/run/docker-bootstrap.sock run -d --net=host --privileged -v /dev/net:/dev/net quay.io/coreos/flannel:0.3.0 -``` - -The previous command should have printed a really long hash, copy this hash. - -Now get the subnet settings from flannel: -``` -sudo docker -H unix:///var/run/docker-bootstrap.sock exec cat /run/flannel/subnet.env -``` - -#### Edit the docker configuration -You now need to edit the docker configuration to activate new flags. Again, this is system specific. - -This may be in ```/etc/default/docker``` or ```/etc/systemd/service/docker.service``` or it may be elsewhere. - -Regardless, you need to add the following to the docker command line: -```sh ---bip=${FLANNEL_SUBNET} --mtu=${FLANNEL_MTU} -``` - -#### Remove the existing Docker bridge -Docker creates a bridge named ```docker0``` by default. You need to remove this: - -```sh -sudo /sbin/ifconfig docker0 down -sudo brctl delbr docker0 -``` - -You may need to install the ```bridge-utils``` package for the ```brctl``` binary. - -#### Restart Docker -Again this is system dependent, it may be: - -```sh -sudo /etc/init.d/docker start -``` - -it may be: -```sh -systemctl start docker -``` - -## Starting the Kubernetes Master -Ok, now that your networking is set up, you can startup Kubernetes, this is the same as the single-node case, we will use the "main" instance of the Docker daemon for the Kubernetes components. - -```sh -sudo docker run --net=host -d -v /var/run/docker.sock:/var/run/docker.sock gcr.io/google_containers/hyperkube:v0.18.2 /hyperkube kubelet --api_servers=http://localhost:8080 --v=2 --address=0.0.0.0 --enable_server --hostname_override=127.0.0.1 --config=/etc/kubernetes/manifests-multi -``` - -### Also run the service proxy -```sh -sudo docker run -d --net=host --privileged gcr.io/google_containers/hyperkube:v0.18.2 /hyperkube proxy --master=http://127.0.0.1:8080 --v=2 -``` - -### Test it out -At this point, you should have a functioning 1-node cluster. Let's test it out! - -Download the kubectl binary -([OS X](http://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/darwin/amd64/kubectl)) -([linux](http://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kubectl)) - -List the nodes - -```sh -kubectl get nodes -``` - -This should print: -``` -NAME LABELS STATUS -127.0.0.1 kubernetes.io/hostname=127.0.0.1 Ready -``` - -If the status of the node is ```NotReady``` or ```Unknown``` please check that all of the containers you created are successfully running. -If all else fails, ask questions on IRC at #google-containers. - - -### Next steps -Move on to [adding one or more workers](worker.md) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/docker-multinode/master.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/docker-multinode/master.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/docker-multinode/testing.md b/release-0.20.0/docs/getting-started-guides/docker-multinode/testing.md deleted file mode 100644 index 595e00e0e1b..00000000000 --- a/release-0.20.0/docs/getting-started-guides/docker-multinode/testing.md +++ /dev/null @@ -1,63 +0,0 @@ -## Testing your Kubernetes cluster. - -To validate that your node(s) have been added, run: - -```sh -kubectl get nodes -``` - -That should show something like: -``` -NAME LABELS STATUS -10.240.99.26 kubernetes.io/hostname=10.240.99.26 Ready -127.0.0.1 kubernetes.io/hostname=127.0.0.1 Ready -``` - -If the status of any node is ```Unknown``` or ```NotReady``` your cluster is broken, double check that all containers are running properly, and if all else fails, contact us on IRC at -```#google-containers``` for advice. - -### Run an application -```sh -kubectl -s http://localhost:8080 run nginx --image=nginx --port=80 -``` - -now run ```docker ps``` you should see nginx running. You may need to wait a few minutes for the image to get pulled. - -### Expose it as a service: -```sh -kubectl expose rc nginx --port=80 -``` - -This should print: -``` -NAME LABELS SELECTOR IP PORT(S) -nginx run=nginx 80/TCP -``` - -Hit the webserver: -```sh -curl -``` - -Note that you will need run this curl command on your boot2docker VM if you are running on OS X. - -### Scaling - -Now try to scale up the nginx you created before: - -```sh -kubectl scale rc nginx --replicas=3 -``` - -And list the pods - -```sh -kubectl get pods -``` - -You should see pods landing on the newly added machine. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/docker-multinode/testing.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/docker-multinode/testing.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/docker-multinode/worker.md b/release-0.20.0/docs/getting-started-guides/docker-multinode/worker.md deleted file mode 100644 index 7ed3a8fb89c..00000000000 --- a/release-0.20.0/docs/getting-started-guides/docker-multinode/worker.md +++ /dev/null @@ -1,114 +0,0 @@ -## Adding a Kubernetes worker node via Docker. - -These instructions are very similar to the master set-up above, but they are duplicated for clarity. -You need to repeat these instructions for each node you want to join the cluster. -We will assume that the IP address of this node is ```${NODE_IP}``` and you have the IP address of the master in ```${MASTER_IP}``` that you created in the [master instructions](master.md). - -For each worker node, there are three steps: - * [Set up ```flanneld``` on the worker node](#set-up-flanneld-on-the-worker-node) - * [Start kubernetes on the worker node](#start-kubernetes-on-the-worker-node) - * [Add the worker to the cluster](#add-the-node-to-the-cluster) - -### Set up Flanneld on the worker node -As before, the Flannel daemon is going to provide network connectivity. - -#### Set up a bootstrap docker: -As previously, we need a second instance of the Docker daemon running to bootstrap the flannel networking. - -Run: -```sh -sudo sh -c 'docker -d -H unix:///var/run/docker-bootstrap.sock -p /var/run/docker-bootstrap.pid --iptables=false --ip-masq=false --bridge=none --graph=/var/lib/docker-bootstrap 2> /var/log/docker-bootstrap.log 1> /dev/null &' -``` - -_Important Note_: -If you are running this on a long running system, rather than experimenting, you should run the bootstrap Docker instance under something like SysV init, upstart or systemd so that it is restarted -across reboots and failures. - -#### Bring down Docker -To re-configure Docker to use flannel, we need to take docker down, run flannel and then restart Docker. - -Turning down Docker is system dependent, it may be: - -```sh -sudo /etc/init.d/docker stop -``` - -or - -```sh -sudo systemctl stop docker -``` - -or it may be something else. - -#### Run flannel - -Now run flanneld itself, this call is slightly different from the above, since we point it at the etcd instance on the master. -```sh -sudo docker -H unix:///var/run/docker-bootstrap.sock run -d --net=host --privileged -v /dev/net:/dev/net quay.io/coreos/flannel:0.3.0 /opt/bin/flanneld --etcd-endpoints=http://${MASTER_IP}:4001 -``` - -The previous command should have printed a really long hash, copy this hash. - -Now get the subnet settings from flannel: -``` -sudo docker -H unix:///var/run/docker-bootstrap.sock exec cat /run/flannel/subnet.env -``` - - -#### Edit the docker configuration -You now need to edit the docker configuration to activate new flags. Again, this is system specific. - -This may be in ```/etc/default/docker``` or ```/etc/systemd/service/docker.service``` or it may be elsewhere. - -Regardless, you need to add the following to the docker command line: -```sh ---bip=${FLANNEL_SUBNET} --mtu=${FLANNEL_MTU} -``` - -#### Remove the existing Docker bridge -Docker creates a bridge named ```docker0``` by default. You need to remove this: - -```sh -sudo /sbin/ifconfig docker0 down -sudo brctl delbr docker0 -``` - -You may need to install the ```bridge-utils``` package for the ```brctl``` binary. - -#### Restart Docker -Again this is system dependent, it may be: - -```sh -sudo /etc/init.d/docker start -``` - -it may be: -```sh -systemctl start docker -``` - -### Start Kubernetes on the worker node -#### Run the kubelet -Again this is similar to the above, but the ```--api_servers``` now points to the master we set up in the beginning. - -```sh -sudo docker run --net=host -d -v /var/run/docker.sock:/var/run/docker.sock gcr.io/google_containers/hyperkube:v0.18.2 /hyperkube kubelet --api_servers=http://${MASTER_IP}:8080 --v=2 --address=0.0.0.0 --enable_server --hostname_override=$(hostname -i) -``` - -#### Run the service proxy -The service proxy provides load-balancing between groups of containers defined by Kubernetes ```Services``` - -```sh -sudo docker run -d --net=host --privileged gcr.io/google_containers/hyperkube:v0.18.2 /hyperkube proxy --master=http://${MASTER_IP}:8080 --v=2 -``` - -### Next steps - -Move on to [testing your cluster](testing.md) or [add another node](#adding-a-kubernetes-worker-node-via-docker) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/docker-multinode/worker.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/docker-multinode/worker.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/docker.md b/release-0.20.0/docs/getting-started-guides/docker.md deleted file mode 100644 index 03dd6491cea..00000000000 --- a/release-0.20.0/docs/getting-started-guides/docker.md +++ /dev/null @@ -1,105 +0,0 @@ -Running kubernetes locally via Docker -------------------------------------- - -**Table of Contents** - -- [Overview](#setting-up-a-cluster) -- [Prerequisites](#prerequisites) -- [Step One: Run etcd](#step-one-run-etcd) -- [Step Two: Run the master](#step-two-run-the-master) -- [Step Three: Run the service proxy](#step-three-run-the-service-proxy) -- [Test it out](#test-it-out) -- [Run an application](#run-an-application) -- [Expose it as a service:](#expose-it-as-a-service) -- [A note on turning down your cluster](#a-note-on-turning-down-your-cluster) - -### Overview - -The following instructions show you how to set up a simple, single node kubernetes cluster using Docker. - -Here's a diagram of what the final result will look like: -![Kubernetes Single Node on Docker](k8s-singlenode-docker.png) - -### Prerequisites -1. You need to have docker installed on one machine. - -### Step One: Run etcd -```sh -docker run --net=host -d gcr.io/google_containers/etcd:2.0.9 /usr/local/bin/etcd --addr=127.0.0.1:4001 --bind-addr=0.0.0.0:4001 --data-dir=/var/etcd/data -``` - -### Step Two: Run the master -```sh -docker run --net=host -d -v /var/run/docker.sock:/var/run/docker.sock gcr.io/google_containers/hyperkube:v0.18.2 /hyperkube kubelet --api_servers=http://localhost:8080 --v=2 --address=0.0.0.0 --enable_server --hostname_override=127.0.0.1 --config=/etc/kubernetes/manifests -``` - -This actually runs the kubelet, which in turn runs a [pod](http://docs.k8s.io/pods.md) that contains the other master components. - -### Step Three: Run the service proxy -*Note, this could be combined with master above, but it requires --privileged for iptables manipulation* -```sh -docker run -d --net=host --privileged gcr.io/google_containers/hyperkube:v0.18.2 /hyperkube proxy --master=http://127.0.0.1:8080 --v=2 -``` - -### Test it out -At this point you should have a running kubernetes cluster. You can test this by downloading the kubectl -binary -([OS X](https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/darwin/amd64/kubectl)) -([linux](https://storage.googleapis.com/kubernetes-release/release/v0.18.2/bin/linux/amd64/kubectl)) - -*Note:* -On OS/X you will need to set up port forwarding via ssh: -```sh -boot2docker ssh -L8080:localhost:8080 -``` - -List the nodes in your cluster by running:: - -```sh -kubectl get nodes -``` - -This should print: -``` -NAME LABELS STATUS -127.0.0.1 Ready -``` - -If you are running different kubernetes clusters, you may need to specify ```-s http://localhost:8080``` to select the local cluster. - -### Run an application -```sh -kubectl -s http://localhost:8080 run-container nginx --image=nginx --port=80 -``` - -now run ```docker ps``` you should see nginx running. You may need to wait a few minutes for the image to get pulled. - -### Expose it as a service: -```sh -kubectl expose rc nginx --port=80 -``` - -This should print: -``` -NAME LABELS SELECTOR IP PORT(S) -nginx run=nginx 80/TCP -``` - -Hit the webserver: -```sh -curl -``` - -Note that you will need run this curl command on your boot2docker VM if you are running on OS X. - -### A note on turning down your cluster -Many of these containers run under the management of the ```kubelet``` binary, which attempts to keep containers running, even if they fail. So, in order to turn down -the cluster, you need to first kill the kubelet container, and then any other containers. - -You may use ```docker ps -a | awk '{print $1}' | xargs docker kill```, note this removes _all_ containers running under Docker, so use with caution. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/docker.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/docker.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/es-browser.png b/release-0.20.0/docs/getting-started-guides/es-browser.png deleted file mode 100644 index f556fa8c5619b8574279eeabaa1302b12aa16331..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 40769 zcmZU)WmsIzwl3O8kl+w3XmHnH0fGj1cXxM(213xrgIfe`+#$Go6Wrb19l9^yT4$}j z&$;7I&6>|M%Z9#V)QnP5lE!%Z{w)9iz>t-ZR09AIJ^}!6G$`<|Z@hH3l3p7GcX3$_ z6cm)D4dwOMF0scK9S?P9D-Ul|H%oxEle42GtGl_IrKOX*jkCuYLdRzSfD#}pDW>6* zeH<8QqS4n3<<9z+9rlfd$Rebe1mlm%^tXQ86eD;kl6Ur<^Py^A`k12~)$Pyv^!%H( z?Dy;6Gcqkdis66Mn%2Sjtp*ZNkD6mB?Z@TG)KS%ntr`@E(6wAaq3Id!uMZC@DrHx7 z;VS~%XF_L!?zgRbIqbalvt{egnu1`o#aPNd)xctrRR z&V&>xKr*2vZd56N8VQM!l#3gMN>d}hW)MC&sVCot>WjhE+%pew%=q68EDN&6dPpyp zEU$@ZoJ1Sh#KNNXjzkKRDJczG0Wp}H!z>>W$6OK-7s;$wl+s12VMWFkK$VCBAnhfJ z{2JmaMJb#2H7tM%K7F_H!5*5~@$UxK0f2!}@#sK|Lhj1e;$U&?)gOPA9wTYcN^3@k zSzt+272l~j=+s$mL;tWailDW0UfS+Z6hdiBsgQ6d%c+J*wb=f%#DA?6=KSg30}6QE z<_4n5e@+MEr>5=8;ApVwG3iH39{o;%h^qBz2nXlrUJPPP!N~qZL|#ZW zJZ|4Tw?7m{asmwSKTw%%7k~M`SzsL8;R1ooxADPgq6)kf%%`bNFvhQ^@!B>iV)7uM zr{_5=$WS8_=HhOl+HI9fiu!*~8YobP8cBJV0N{kTu0h26DO|rA0!LG~^Ghvb zSObF;y_?69(!LMA6OJ)eLq+*JjWr53Q}G~5uwIp%q#0b8ns_ftO3nXok4}KzD6~)O zO8t|i)O4j^70gY{92wPvC}iV$J5fx~d!s`5&DROgfX~O;1}r9&;Scrz~85z?*xInW(Wr&Ng_k!i!mZ7L(g#7 zoHh3dlu|>_+<>#%Q+|3|R?Y0jjfP5@HM8-7d53Z^htO>v>{ zH?$ebLiHJ7xKynM3L8V3;LflolmmIL(rgd+4}~LLLrZRA8m_tt7C{WQv)c4(SK5R! zS0XOYmh`6R0CScok%GNSzvhHt(xD_kiFVxdGrqiB-QLt^`dBC)PFeiom7}TRRxnggA1LFhshN{2qJefj z+EWn71A7_FYfc|kM1*fn2d!g7ihMXwj%Sj&@V1cw4Be3yttJ8Fp+DZLalznj|M#>m z&*gaVD2Kqyb2zC4F-~lAJ3fQK3wzN+pFMKOmQtk{L0uXMet5^Cjf;O@ z_jhf#J7qyCEn-^$UJW!U$9NuW&3bFeU%+ksB@-63apu;%ED>S3a}P45j%qeAk-@g! zOe#wz>fGTkzE@&0v7So)Y3(_~Nq`2=*n{MxBGbW{BX`Y-ZQ8yN)|1<4V%)h5qyoa8)xia=LbtZjw!H%@3N^rlrQXbFb zh5D;s{`@&XAC5V6&w}e1bjN-7*P-8F8)cuXzYK~bZ9tshYHX%*VTxpLTeqKVGF(sn zl5!ljWt;il8-Vaa-I=sM|5jH^|d1H?5)NcUNX>F;sHi)bbu&8i~yMCcCar;e5 z=cK^lijNLJg=TjWHSt7gDAA}S6ZR@HYE4BFa$yz|GCkdi|Bo^5vs1)$0~sdiK&44R zoJ!e|IP`>~0A-i+u;#P<*5l`k-w8<+kX>K~C}o?BJ%Fs}ldoR#TDOwA%N2uJrTuJ&^IovzQJa_SUwo38D` ztt}fncb{L5@yvT|T;~#B;AsSflgUUy?xA`d2uSczj+Q!$P-TE5EW$vpr*klf^VO}Z zjikv|Kuq&*Bf|gOpn^o%>K7>S6lSt;_v}Ws|Fa)h!_{~?hp9M3b#1MUo$WwhsR+9` zKtyUC8x0=UpPGWLB3)=B(jdRfzOwDMhXQ)8gKXq?P>`CMil@Z?!4T)iN&7c6C%!$S zK&7BcT?ebBRO<#0P%g);OkRyKwy)JiNsN)u1EIVUc?R#7tr(Mi?7Q9m#&C;xk7k2j z1H@jzyKJKCv)Gnf&j~^(kWU&CS+?F=O%d4YZf#LHlEY~1sKM7@AV?)J)M>QHvSxey z-1a0wxt2;4(u@4GBWsoF9qng~`^BO_;YBjxMfaWeB=rF7e9K# zj%~?HwNQpG#xA^-mB^Fqpv^=XEC_0_ZGSK9%O+Nk%WWPkz?h<7vU~Y4qS@N$VGy%6 z{`*Vl;BE_FW-@z5R^I162mkeF>V-sY=MzIui>sMrA`)My)n38ithBR%$67xH|wbs}6T-B{7?Fk6P^?EjmY zhm7XeNu|)!J(_di>QPxJdt64JbZv!UYYQ_@{FNj;>ZzM`L+eXo%#Cpa77hPxzl}0T z3Dy{edgU%h6B+65qU2VWE8$^!q20=mh{%sa+uIZr4P{4*mM5jL#C3(ISL*GH6v5e3 zX|}}4ND9^wH8;e6h{{)}_?-M*`F~vc8N6t=dMFAhsnCa%4OF!}(QNn4@06QS5SsyA z+T@zp4~Gvj!ntX`F2Bc5US3}E*h5)zzKn<{KFZ7GCQOVx(Yk5K+=^_o99_%HR;x0~ z_6TyD_kOmq@G0KGIojLCDR)6gzyWNJR z@eH5KnXK3h?Uk497~oT0GPi#T!Nb7s1_ezO!xLKWnv0}l!g6jl-Mh`wN~b2%%UR<* z-~KU2VGaA1m+TB}=UktjN^ErqITO^XPD0I<9bO^ho(`w|yQSJV7 z_v2J5(m#s75zqgbz(xN@(@8Te9{63^6Yl>y_Ruerms=Vb*$6Z%5}VoXxiY=xc|gD0 zQS+$uVfwsz8j6u#07RgZC6Z$e0jtb^J;XC7=jpU<&nOgyJ;`OK7YLw=H~M7z&KzV( zru#TDu$r8U&IxejQyO+_P9NbpNaeklcW$|uXXz(0AAtUh#SXe0o|N5^geQ5*i8dCQ zw8BN;>~v_hpBOSX1aYQ%PM6HJ*@fE7^Cc7DW8%0Y;+*(g#*OXDrj6d{gTLjq z8s=jM-_07j?R*+FY;lrp&!;Uxn7>$ma6f~tOhpR%&FpodAi z+|l%V)?68RB?5D?oOXm;-AfG+}u9FF82Eedud_r zC)vq#$m0fXSM~I!N9vWQR1C~q-3^|N&i%y9+H3;maxS}lF!#H9=<4we1QJ zX7}}Mcx_ZTX*5f5%yWwctX%XxADiZH~qk2hXcv5fAusBz(7g6_Mpk7fiGg za5cuaqH*(lHLhDOmA`C^WR~vlS9Nt2Un1Cr=L*3CVJy`0wVMxEU+;9;8iVpU4ytta z_8?19^pSXxc=Rgp2A*yePE4MH7(ZZmQGBd4(`|=MB9_wYVPUNZC)%8H?L9wNvt?Fb z>zm;FlfVCUeZa;OyoBgzj%p>baA6b>KXRup75UQM9kKM2H2s^=Y$)+p54|MUi@r3S zytxX)(q%Xq0lQ^FyglgQqV9u~&j^{ek+;&fvlZ>2ME0wDHs9@`Qg|d2&=rEIwcPA{ zz&eFKpYv)e@MN*Y>T%v*{}j67iLc&J4jXuE{#^IGku5*x3#|5<^2Mw5s;{@)vHtX1 zP>X@#d09AXECcwd$GU`IwM_o}-0J$Cs zItPSKlK#RX|8raDE$7r+bbS68J8DN)Is+IMXg7mi0OCJ3inF{|-P#jh$k!4q+9aL& zNa4GUlQ!~Z{R{|u3VnlCsLZY!%O1vUYatc#JK&+cEPiZ7!jPKSpaOmOebUQg)=2@k zv?nbGWj+alr3`leV=HyIW$&L+(1-BjBsbyO%sJFx-MH%P55ti%qrD#2Ko0&V5t(|l zGkgZEI+=}usw8Lrz^?nd5fyXehO2-2Eya+`><4Wk+yCS^*7Trk zqL|&dUrFgw#6D56QPfhkrpb7?bF2AHPDn}u5{WKw;}ukuraSrfKp$3M0(&Nu^>(3f zCT`y`Ox$e2-jkB-RE{l@!V2jM%~Hc3G>bS;h7+;@@FRJg-dqjBjjZBQ=V1GBjx#pl zOF^`XmOW?FsavChyf2jE_e1`?B-RE(_Mn2rxLB&bwEWD=Fw|dd-a_ZeM~e_$*Av-{ zN&GbM$zzjn=(Dc;Zl0cyub~y5Dp4 z8Nj67;ECcrF3((C{c^)rvr3*&Gc&5hE%*;Dfig-o-Rl+)iWIi1bKafFog?CA!#V6% zHLgBz7)m;*M0!qD4}f9^Ze5fpABI0rk92owd*KeP(}dR{Ps6?el+3~b5edrTVyfT1 z+kPpu4A28zkI0*q)c;;u%oAX=XN>-juZ1-xcj$kXjgsMaUpCSoj_mz~xQR-2xY*)8 zdlz?WVJ&y5#amMEm)#ScT@bYE=JbZx60R6ygT+zIf{26I6Fz)-00W}8p-|n$q8u?q zNivx3(}za^SqvB_Yg~0Zu;qiECPk1yy(`930RS8S?OfLW(FkkbpP5xBsu@XTnOh>* zsyl3t+!h@qTx90ZBCIdqB3&k{b;sqq%f@!z>> z8=(!&AAGh#1zjAE9!oD#wVw~cf=bNKL%){xKEmvNITBHwfsXQC&L3r(90{eY+U~cu z*c|e_o+FicVGj>0d6+G&+ZknL$HxwhOTrEV&V(mARjr4}<~d-2_iAdmV=}U-jd~}u zhx*2^(Y-rF0J)PoUZ_S8x1_90L2XP66A+FylFjonZ*6?QAqBD=9YZ<&nOk1j=5Mf( zXeHE4oBZBWl+r|I_b;mS<6=+ZPbo||h46aQ69;Mo1<`hPP8=Gmsz;Hb^|}>Fa6E@4 z(ulJq1VZ`Q6{&wGCb0_6+Jt6p%mPurRgZH7q}6CSylD{h-wb3&%4q%X{(I9EK<#%{?cYFTEhNM} zz?G_ykx1RE3l?a`9pu|<-`z}?!xV8jwQanIU3W(}rYye>|*GnFnXQac)SG5(V(o2H=m|yt79X+s_3OwG= z5B}hdPoOGI)$bPYAg~b&gHn);m3ZfRXLCMA9%6i1VcRuh>o;i0?Kt@Jrw97d7^C!F z-UYm?p&b6D{HIGPb%~aKqtgl+d#j4-E4gCg{Ap>Kt272qtG=<$;SrSOsovp4G09f% zyDJh>HBLSt9%I}vW1%+RhZyE;xJ2;XC3uj9Pa5uj3taj5zzTc3iIipN)44v2;ngLt~0#QX*ZD{(#G9=gpsFD>Zj#VwmQ zI4HtsvV6Jk?38g+nhbIwu`&=Ek!zMJ0Elik>j$~}`}9jvKTorYEJPABvt>F2ulip@ z_OR3U@2H-aV+2hUZiyvZ@*Xd$t%dovHVW(A18jiDA?5wVbK`^6*$cdhTvJQxJVg{} z!L1K)l?4kjd2l^PdFgo)=>ZS;^edMmFddJrdE+szhLwjiEGebOm%e0fY7)Zv8#zZu z%Wtb{g*KFxvb;R62k)cSTo2~BJ+^h?i zsTcPE(CBUX&xTu|gYV(0{^Ln!|43PLS3cr$z_WO zi$UG?vbk`a64TOzlk7xHlHSR2?Krux-?eQ~j+BYXM`x%|#~N(qENISers}$836KAC zLK@#E_ab7l?&Z<3bvKM5QmB;st4;mA8Q6S{ATAWrgDFVk&k*mOK`gt@?P#! z^Bhb83Eb9wc@<6TX&nN0A3OagHI=iqwG7%fft5|`B9d|!uYJA|G=Od*p>x}HDlcAp z@@}P%S0Dbvx<$Bg;B}#Xo;^354?W~@rUxd-jI1KYxA`L#`E=zl$33umPOW^W%fHcY z&j6?v=b}Lh=A@aZLzmk|LB#F!fsW_-G+a%>ns&<0UXWI!+$(@yeVTA8y=;j!Gol6` zIRG^z=!h;``A2!aL?SO^&Ppxx@I(*vIgOhOYvaTS)__Da{R+X8I^?nEA#N*!oAblc zT?H;c%`P8U3t?+m!piNP0g|Mqb-joBg^|mGqh=|_2)UM?-}}h2UH05hnm16I85aE* zl&k03La3=@vYxIvI4gp~1F@RQmMY2>hhSue$x{t+1_2 zpOlYlvj5_5_unw&GxRmlpxb^hvIc9KQWYFhmZVhr{t7ZD&h5uve50)A|I*}5QdvdO zApJdQTyuTcNu$O%ZM}lf%2&vEDWpGAw<1`+-`QQn3Qz?t#As-qu=0@smsz{4KQ}oS zCekRRs8|wHW{EXV!I}>4x13Qw*S@r8gy+|tcn?qj<Ra7Up3|H< z9N{3J<69A7o&bgQ82O36|Iq#8-y>4_H=*aF{I08Q&T|L!6x;zibdAdj0_>peQN9bI z6d2B)$J2@TwQ8vcv1VP=cjgfXS+1|eiY&A=kr?v5x0IL7%7{`82xX*iXwlb)>g7TR z<{;%*t1V-Kjeq#nKh0Q#TSWg{)`+lsEp4H9$8OXR@L(wK3SfhA=1nx!&(N6Q=am21 z!j2DUN;%{HnM4r7o35F^lS{by40_dbgXNt2xMDsKH!?=F3FU$=R0uzH-VO{QAc)np zJdS!Tf$c0NegPPf^#qOKtm{stXak$dor-N@+2 zSqnt#Ze-T|$B%#Qro+evYRvu-#;*MHu8K}oytkv5?)^$mB96lVUMXzlZK3D`2JbN^ z-_7*ti-5pbyEve>otFNN$#TwWZVuTG&(kRJf_nFRh31o;hPlIRU*kzv)6WHJL*k6l zl&*BN(G;0pNz7ZzR_=bT<$gl;il6_`MSVBMwNJL&L53K=^#x>QsnWm)7tdaLh9L|8 zvnkW{CXv1c*JlZ;LU{k%B){$vYhHIy-9l|P<#2GiXFePPWuu7aXixH5pOB{jk<4s1 zQwfo-8Y`35jGP=UuzXSbM<&{Fs6f&4xbQd@XLvHR1b-ALAu(}?2*Ev&anGS@|B3cs zJ>vi3Di->*onmmLIu-fZX}+X4l~d@I&z#ZK6`493R*wJTg;3XyQgxiH3{4SkNJ##X z6n0CC7>hn-(r0+{-YCxbBeD!VO1ox^IMa{BP*tF8Gkle`0Vt!uVKQ`O-^e1^5GXfjoS2Q+4bGF+Q#rISH zQXu|8%DrqHSMqqzlO_C^pzbY0Ashsk<%#y%qH&?4X*@22Zq0-c(m@&2>1BrI8AMM1 z@TN=RZOT+(_hF+LhDHRquhfcvu=Cqdy0l^~9^hupMAa~Z%TlwcjyvO+O5OBS)WLOj z#^rWwgr}_=zXtMF9$i+L&jM^5Ie-0|U5*ji?z6WWr}L|rSWga42l)r|{15!*TbKdXI$0^lhbk=x@Cje1DLWMvLENlPfJUn zFjR7wt)REGATN=4Q5wFi0U6|N8;d0s%Qx#v~_EHQ;x;mX*b(S%zseRZ8 z<8rkqPC(?*j_z805UZ*y0^@z1uQ3`^h!FmOW}w9qV6sb8^WRNnYAKc$Y6>=KszY?C zl!OvRf@p9;C}p_|@+Jwf_j2(7HINFb7-Ug7iVS1^P;u~dDCxnhXX0j)MPRMkhc^p- z{GEfl1EL0uXr5dphT@T*P&Ca!QR|G!#>byDt*bg}^U**8pCxuYXqZB{Rw}wucZ)}K z5zHao=y6UN+4LFo@^VUG$=4Tyv9 zDk#MldL!QTZYZW8#*TqY+k6<)Uh|UX;%)u1{2+qNx8ICm+(X}FQoa2ox@G&tO5UG8 zl2iikyKZ%~6=o1F-v7|3?`J1USO3`Z^@dq`YHe7ctY_KR|vf+{#tS4uU2^42!t zEgnjCh%50ELT3{S87?&)1l|l0AB$!a#EEmdnZS#LLbDk<{FjQL-*Jgl63n@N(zv?X z;(Zpi_Hvr=LE^{11pVhlx%B0Qq9jCBR6yy7RQtOt&jxbR`X+{tjWpJCHrhuXrI=JR=_5A}x#RRmbi2E|c6$o1#nD$nXd9o^ zpbkaHPGpQg_^l-Kj+3u~u96dJL?0JUL{n=Qkp30`=J=i+F+kMYnNK#WMl#CH0UrSh zh$5n_P0bq?Fs-q>5do}o`3;H2q1tNApRcQ7Af}C^WMq^Gb7TCQLdX-j0lfw4ANWe> zi$8p}uMXZhiPSxJ%ksT2r1?6O*h_x3QEro*>53&PQ~ykd-;!jW9PDD>DcUi_ z(rt{W7L)~E#mwYXeM5xFJJZ|zB`yQ>{@=9bMMIWEZ9sYeF20Z~4Bwx&gUd*ZBwE<| zK_g7EL8Ds{C4;?CHh%fGmR%P1mgzSwrW?M6nj)sEMKY}bi#(_d{DEK2HBOV%j<`J2 zIsB#IeJ8;8Rs{y;91&j5lS$u&5`JRn?fI#g^}aDHu)yY6`q=yGlrRKY`8S1-0w&Y7 zWvb6J^CotzB+_5DwS59oln1!QjjX79fd3R#uTKg`G7Ub|v z(@`-dbNbF5^=5t1wDPG2E?x0yEV`EiA{9Qb5y}s7)6!EN+M+||nS6qE1XT=^pL60M zv0|@P-z!2xKU)g0tQaLEpw_rXI}_7A$1|4VpyVHGvolHeC}kxlt@zDb`s48AhEeHrM*GW&_= z`Nzkup6wsvpK8;~?VWWRYTADT;g(43w6s|D8ypsDNVI0Ybp#6%+8TJedn&qjbZ8^D zzfoU9d3u9DDWW2X4nS5(WDm2s$|P~pnfVxu_jvmoM-6oiX!T$hq?{C=mYPT-sAhp2 z7OBscdR>JZmF4uOYhoyP^B_OlfE5R4eznaX=Dz@hUDJz{S60SLQc1pxlH_$>4cJMd?Pxjh zuGX1b@m|rqQi)aPp$(CE^bIWO@0=BRK35L9oI)n|Q915POi8gMlKM2`P(up1;mlu{ zoUC!(>K{s`H}={1Ci1i}&enR~{n{0|nO0|IWj!F7K9264G>8tb@TZVP9da2PI|r;5Vt2_G|@P0feBv1$vz>6}^y zc&CZ0Mjhaq*7-9Y&?e7@25m>W3wNEBYt)(vh|}1`$TKi=Ez!kL)3{sumx6w8x=+e7oCFGPT98e2~2I8&k@YS7pynQF)YaBiU?fVx$ z{c3y1LWH_UQx|!%^hR4ZYZi8De0<%1?hxw{D|2r=)FFM>PZ6jaHiC6_1v*EbDP6lu!Dq*?%2$*P0nW|_spvnA zFD~Anu29iFo%didv$N|ox%dPHMZ^C(BDlRA(}-R$(r)wF;86yGvcKa?9Wswp_?Ga! zEcVg5YjvdfjxM03X{8~?v@xOq;WjpScKQfsklD)os+I{W%Jm+vh)?EcbryQMt!!+E zUX#*OK(D%BL?^zH=rQ$6gIeZ!Wb=mNHDG+TMP8)-NF+1 z)}WCxru#CB3VSdJ)ReVrL^oFP@mIW=sxI-KE!RCpP%+wcB=(;GFQyI`$gb+<2kGAE z3yAoE8~%)39?jl zpB`i$Tv^SuBi&rTh{PnPL&k5f(;c<>h^f4q7Mq5VU+Cd#_D36)HB-Ae z>lcpzdUzkI>VSt!6$X#{jR=JM)w}k)*ZUfOIalJ3YYyYxR!Bp0@CQjD&Hx7I=X)%X zXP5C@;dV~*?v3*X$0hg>(MgrUuPN$fv^zQ8tG+ua+OOsPa4d?T8BJ~9wpAaY*OD~c zJAC}MyH)>JXF$wj_inGXrDaKv#3Z>v^T#TfvntKl>6OXkf?j2FM`MG7=YDP3SFhUn z$}U!ZV2EY15m+EUvf0x%yVggDEexIFbL-VX(WuCZ>*`{J$nidQltpGD1?;bmhwtp2 z^$p8|-VAs9a2v%yg1f?LH~365&A&{3eB4)N+N&3syU<=GJ#4EFyxr)?d+=Hj*;Ms+ z@aT0NP;Ro>Fx}ZXy`%7}t~ngSXAUMcf80#^1D-fNA<vVsMX5;#PCRhj1JI9 z&#t4Ts%<|NGrMvjQbR{iVb{X*fV&!4B*K@PhW@Ea9=g^eFZjs0#HbE+cnSEF@P?+3yK|_CT znmnp!5JQ2PJuj7B=F97>PBwP2>A_3M+8>=wb#q&=YV)b7zc?1#+Z}Mg_2{eAm>9WM z_^aF$?(>QYkuFx5s$bpOkV;jE@Vylz&D7!tcuZ@umm&b}37`E;jr^GwFX9xLwRwGZ zSq*728CKh&yFBG@&?+lraNL%R)a%g!>x@PQy1VXo`I%C`J!t$rs@6*)ctu{khS_rF zk^-nnDFyE=6~1|t=lx23CzVCeUP|!=bSt*NL6%p?=j`VB4e)oOs?bio7j)Nj@F+FB z2IpJSW-4JQAwQ3}&fD4y-HeVlbLAPM-NQ08?m!4cQ@#lnRFOH!){P*TZxJs>A1MWk zSGIY*s#}Xe1)j2y>uRg-g`|Pw5p6cM73x=fa`iYYbyr6F1U$rk12+X+H)d{Z{)^U& zEs^>5Hutqx5*H)aTv@*2C)6ORWW+eGwk{mqz^4oQ-=1&uw6wJR zByd>uKWoe4b0+6=BF&bFi>9u9=J321$C@EBcW!^!z1$hW64*{q{Vio_VF4H%9K^0z zJqx;Pfjw5jGChuIHlsCa>{O6tWoiz(re#h1p&ru5-!NA2tz-3Jy_^H2J&LuzH_PTn zvi=AtZ)98gNwby-EymltfW4ivu0Yi{$4opfzN6!XY|Ibcv1-(KrbsNg@7RV&-X7|lkfxWS^m)zDU8=>0*4jS4X~3_$C9&7UtVo{weC4(nIqMYxb>||G_yPz7h z6Ke8Sdyc@S7wzgVt`p_}!Y1Q;TU)+F!clI351M=tTx3yhTUIYPesRpD*w>$ioxl9= zUX=9K=Suzl?ak(p%}F6|X?b<^6L8#p3R+BS$U-fe-rU>_FERnapQWQ&z5z5QE96!u znnaNI$A}FGb6t?UIv3-$?qV={!N-JvN71IYB)!Rqt zC7qUxIKBKxyWBC(4=q{_t<@@@I@i7lS>HL@2@kcrt+auxy?b+0NIAbvVA@o`+V&e7 zQAkaVcsz-Vf8goII`!KGk8^@Cwi^-vdR~Cer;@@62H~MxGKWyU%j+fEKXnMmgOC>@ z^$+#LV;c3n>O^A#v^?La7DPcQfkk=cInCLYmdXM|S?KccZc0U%YW+4S7FBjX!UukS!01S~sg`TwQDke2Nf` z@LQgCBsqe5{F;E8nwrRbOog(McTS{f$SzDG$)bpa{&y?hm9KGA zBDM4@Jl7KkSXfw)x($BFzB;Oeosl@TR<9SstC?4KZ{dCYozR|d5b{^hEmejFdYRVo z>I?(6`eS<{uz=SS(j#ZEk%&F0$(?+b8NRhSz7bnR#wFR{A3``qX3Uz!LpF<=6J z01Ml=?T|CLWTB0PU+($&Uhes7I07DE)?yTWjO6L;do#II_Nymi>uLkPi0^qdEe|U_ zj}2p%wKAZ-`uW}TS)65@u9l&W6@XuE`}Q4M@#u+Y#fRAqiJSZ)nHfyHnw*XEE>cdtB?Fh+obNdlbZIauN60vDi@+Y&3e9Xaupdo4Niw1)Yk#| z&t3fm!hziPBfDf*SN340(im-4^!JIkDuMEd9H#J66y3;gr^3!qoc9|>_STRntq;fT z>`F%hUO15bGUiUQcv}< z!_vAJ{ z`x!UMmDfTsrI@94{6;06q`8?_O~*)e*Bzk`PWfh7k##JQ%b0C*Bm57+lzOX=X~sCl zyEmYenXLDjpQ7d35@$J7RCxXM#3~tN?P{CUlP^3zI@rYdMH3hbEV+LDc7$Z?oTU5u zx#EfISzR9&)X+e~MO#x*14X&$dw`bjbBM{$Ke7wwBnOEzN#=FfphDxY-*u@QK5AGXE8n zDULhU%<_O~<1V>t)6|C_tjY2Md7YMOQ_Q`wD!rWE-!H8ofKj>_%e zN`w)aQ?yA67|E($zMjk(17E64d)(aJSDg58GTusVd$mZ%lM6ef?>)lW{~4nyLfrCT zdnR8-c#nl3Ch%43+}{-{WK33DkKf-Yo7f##$7VrYmj}n+^O@Qm+(*C;hldYq0|T3B z&9N~BdPw{i7on<#FOnShX{vo29P`#NWXdyS5&nZ*|DY!KrF>bF-^w?G8PNXy;R5Q5 zi-CGpl<%>SsK8dA)zW%aLrhzz%JDrh*VpWea_x?05Zr!o`{QVUBB7+V=DE_6)R zhb-uOzSO5${=sW5%yyHuA*-l{M(GV!^gHIm~|dIzl}vjB&2i*KAY!;pZ5S@$vDVEV8aqavhbRhzRR+OU>Bj z8S|RjbUnWIC78S?Gk6)IkYglydrys!#bZB9;@tYd%jFG%`6!1P!^VYAp>iJP&LO9O zym9o-EaRzJ9CLY{2c+BnS&_&PTFCMAe#N}r^d*Jj{*o~r1_P0RZ5hBmS?0xKEmw7mFue1_-Qihav)e(IJ6(GQ_f6y>PZ10HwZRtg z+Um5^d+2tPZv1x-n@ZhVY)DYqvUMiiXrwKCxNRn#1r~|Anr?H|JU~SamxF}fs1{ri zcwq(vnmrM&8W{#nY(e#x4w+s=H8o#0*Fig1sblsfm~`Hb)Kyi5fkvM4@-4Ra0UO|T z&h4F)&gOAq#6>j+;g=ue==>Bj~E{P?0x=wt??=dsvaU9Z66IvTi)VM>U(U zuEgUGc?uOltT1ak?!w77=cz)CZM1op;0~se(xW$?Q_WX}DcXqnm$^bc#8*dK-jq&W z>A?eg2Zr(#X^-JIf`8+~LPQ|9$bK4|>CSo2$dcLj-_QtGfop-ztry{@M23dd|3DJx z^MgVTWy$U?H%|TG>EUU;efVJK&V!s9+xW*bvvy%FgEg2}I0&?Dz=~iJwnpQ{csq z5aluN4nw68W@Ib+?JB22Wz~-x71l%^(^m*vy7m$J9OyUndZjEgCkI2EDlxK80g|G@ z*&vUIq@=(&o@kZFO(jQzYnGJVIhaU&H4qOh*gPKpy(~OR7T@25O;rQ5e{{8VA zeYl-bxxq8!OW*REQIb#%(W}_n{qeuI5>}g>#RL1Iws2aPO|7*uh}e&rw;YbN22mV# zVEBD2qU)DV(ELlym98uB->PHKfE&jZ?ua$HArUZ<Qc`>6t>(HFxJ+Ic25=eV=Lo#$`f2EK5dy$G)J z3ORLx3X2QkR+#TIPmHAbm_Hfwi=l8DvC=j&c=J~6%|hK3&381_nshb@gDbiz6gzB8z%LYOeI8V z^e#N3nE0dFlED3E88Zn31HxQk$b;J=QjSI+>_bDE`c>#P_5AMPRd6BS>&{cl7R|Pr z2ZFrNT}FYQ8!R=W2*W$d_~~bL@RGj9TFD!tt+U^f07h?BiaR)f#@!n?@QDORf3dlj zap8K;Z0t6yo-)6oQ7j7Y)_{GX&@ik>BV|c(Pu5_OeeT!TV5;>ZZWfa$WWloU+nb<{ zj?O%i| zzcz~L$D{I5wZki`9E_T=c5i28oR#~y&?XZv?qA4X$CiDn!~C;qWTndMe72&DOt~!X zN8;z!CMqpIJms_;{AqdM#1mlxb1%EZgEc*W!bAohVSf^N6cQ*?b^O;^TcM($apFazXPv-{6o0FoTBI7x6IZ70BubN2Ffsm1H$GFHIjY}E!5iSvp8kK(*z3gXSoxn*OB zY6;j;R?V0{_FrO-WC>Ybl2mqd5k2k9Xyc^4&`7)1!4 zW6EQ6zDRq(0SEfuT&4RRUGyO>&ONt*X^Z&NEz?_$z}_F+6{^{(7h4Pc0$T*DOb%M% z2P>Aiop?Lp{G5L@%|i*CF5poJ2$5R>t+XSlx#xd*c6L_5eSK0kiaUq#@l9ogqiB+L zBM9!fyg}CnO@;aKlzPV9@=W8940nB9fmBwO3#r37mX?#3?Ap@d0O4=a;+~#AQ~Up9 zW=0r2^6x!)^JrQd9*!6j-;kMylTcs>*+E)yIz*P zeOup~&pnO}{~v3A9TwI1egVS+A|R3?ouU!~(jbjUNDLhg-AH$*Qqm&b(%s!6NcYg) zFvJi;=X3D$t>61Te?D_va2+^j_KCgsz1Ldz+WXLXfGC_SCY_%XuG7rVKc9`5A5&_J z67YIw>_Kv8hIBr=sW7h1TBfIGfuzLc-c}<+;R)@-_`n6WP)ihlpAG;ohUd;(fV|SA zUu!)*vV+Y;k07&-QA0_d;+*6rWKN5F`YV;kO2b-NTbZ#LTCDvPb@cX%Z9!!DEH;L~ ze{!lsV}g?DWUFy)Gy)sNG=8&TbW}xiX$5gD0C%mgd4XBCbl?;k;9M}U8j<^A?cqzD zWj2i##@YGh)KmET+pHmdxmcx(izas0(k4XQWmqNJBu`Ku3CRnL6{=aBWsFl>e!j?i z99F};dr-)Lan%CfcAf)sH0$taknwO`^@SjgF$6vr>*`vddTpbVi5t5K7UYiiSYf7Q z|H&(R>$SX>5|`J3{e{y+b|G|LFr1rzI+8|Q!mxwd^4&Mhmo*DtVU_3BM3Sb5dAAfI zI#R(bDpR&oN!!(WX-!!*49_3iBmGLf8v~67`M(zgK+lh@lrP`*U|NFb*GgGmfk8pI zbs4$wpcUYKUN;wZENwT(tA9dYXD4pq2?d4W5|`oarUEr}Ado>@DYi#_M>p z4U8mobf)tcM+RZ?LnU?6eXNkNGo#7v*Ybytw^-^=qc!n^#Uv!Ub|#9{OSKYHV_RI7 z76%3fKHvy)a&R~dB(TwWpNm=4n2l{)JllOWK};@}Ku|BEQGsFM1_-lEm)V;?Pw{y1 z)8}SqG2UuEdt@SX7++%3N)j%i>vcLoC3rPux|yzNJ3}y}BrnHH0qPhk?!Y;ZjUm_3 zfxGP{(Ul#A3wdDsD#}>U)eU%9opNb@d7GY(8cC}GuUq1SvHT}~ znb$2piD60Gno%G!pC8A3NTcWo@o$R@Xtibh8A#Tq{YZQ_HgmUmdg{b1{uCJ%WK&+P zrwq2Rwu{n02<5}4>R_m-@+-}Z3(4G;7+hB7NXusz7*Az?;YTJ%?Pn-d%?~pvH0n8v z@a8fM{zwbUvt2Y$6#u{oU^>js6*AeDqqFBGY#46{Sq`nH$BE7Jqq#N-zLCRXNMo?V zzlH=6y@G5f>s z1;fdHnG6**f8G|X`U6Coqib-y@tjqIdNGm)Kcb%^1q;o=BD;FdH)@_l=^h*8Tj#n$ zGd?*P#BGJ%-ZO{*DRN11-{v6Er25}pyd$HYE{0TjLgU+R;bhixX3@~ zE%n9k8TQZUgd~?T~|0&yxp|^lcA=@#yzmf#<)+9 zzT#U6nGItlM*M^na*43|(256B!e&8U>)80ou+LppRTXsYh#Yw0bcCtzx?Dap5w5XU zZp@2)c)XFF+~tu^D{I8J>4AslaQZO@f6zTYH`CJqo9t5|uW4At2W;N;g1j{8Da$O$ zNJ7SE?#tK1!s)FgfMabXR}H%FQY->b&8(oRSQ>27Me)W8w+>9!N{XJ=gj3jhJk4b;@0NBtmkGA{4rzU_;;}{szWXUTzlUBIIGZdBvh_e98;6?o zZ#z)Mx5gY^oL!Z*zK;&%x_6!m0Fr#Ec^PB(8*wE7=7QMop04Z27v z+INSJ;`a9zozWln>E5f6V>%N|Qqxw+F_+7ILhda181dmpaadgPA7Xrt1!4-zLK28X zzb3OXtvm_4(YGqqPJckcS?tJDCFQ7_OHE9K38aYp zsJp>!eAev2wZzC!`PkzH(z>|>y(wB}?;!?cyX-mqo^)-4gUh}#()028ui~oy72+E| z3~}Dveg4hxFOWy6nJFKiSN{3;L}(w#hK$3#EXT`}^@pp14Yl)(`5Y|Brc3%Nn- zZAAj-MiTfR3t_konLGKCn0+fhQdqR$8is+a9DGjP_uVAAxw)ASINqm~}#&6ZrRo>W*Wf;UPHv{!K$wD*@e3#eL%JSt#2E`Aq54V&RB_ z!%0#(2&3}#n5c@4mC;IZ7vKF@L#a}TvWM;~EZ&gA#NvK7@cvIFX2Q^LO0VraigeF< zFaE8e{n_GgDW~nDa%#9kO5l?G8U(`xh|7V6g#Ct2P)3qTK^5N9$22?%p`5hGOU~ny z9IvH%tvvB>)A54|bu!XiQ0>M}?rRt(90bCnbDGTgAgLNj5Jf|;E+wmF7;z-R%i23} zM{bT8^@X}_(G=9lU9yV5{wwQehRH>dHZKUGM2@D%ZzF1~kM(tyB<@Ra_%!z03H0Zo zi48&PS6!aL+A3U}e?NBtBZiDvu<2>UgjIULI2ufauXH*M>mvo|=T}Ia1w*PlOn}Yg zQd4S(Suc{i&`K`{|LMkez6B-IV#eNJXG=Y#ch2X+(<(BrTut-Lu4mtP;0*JVND+C& zZQo{&?D|y+RADk%xWHTIqGKqWs&(+(*(-1F*Z=FXez;+7>WLrNLPQQVBIIv0UX3wJ z1{E8J6w=6L)0!3pr0uNR;>G_U3c$6?#Ou|I>0w#bETn}*s%oiWzE;fs#Fg(@ls!1e zC-_7x`@gQ@hhonL6-w0C2NK^C!0>)6-6Uk;g5KHVjprAOhY>rtmKp66qtaAL+!t49 zzw7J!NKiFye6~dSwt$>3W;{Ah{C5Sn^8fmjlhpR9RhfHvIlzdG_~d{2c7Z7cTp3$< zB3o&iM>U6kUGopWKmZCg`~0tuXUoV?;y;ZpuL^Kta>|9sCU+kB(-D)?ce8UV&H7BHAq0 z&rIUt>*dP#Rm=h^O2x5jl($s4k2p!egZ+0NYx&DkbM<>_eSWy2=r2yd9tUY046im) z79}7L|L|{hqhj9*16{6fhyZ`#iXJYuCl(*0CcJ0k`|$9OMl2qjAr*q{^`<3HdB5qk zI(2H`DD(`QnL$4egRXEsuSp@@mdJbMf`L&Sk z7_CW<@o*B{tM8ade=l}BPR};*;WiwD{lac)b^LmZxjt;q7Z9Bq>W=E4iGHg+ds}-%$s|O_v6OuOEI={ z8z9hR4tuHSfSBV!-C%ODgf+^wcs@QTCwm7kGl>bTu?g|_{eb~eqmTsJzzEL<5!IxT zby5)L`QU-cTFkDzx)tFxs%eZ;UvXROWqJ1Qfg4m_Y9h+eR6?VR_Av+~+MB2}KIC7B zOc8@D+MBfYw?*Z820lib$F8cxTd2pNKJ_!uuAZQch~HJ5kY>oCr@~(TJ%jSrD*=@6 zc0(J_pSHM_n;ud4a!$@wBWK9-Q@m~H2hE{4>%LqmRfRMWDd(l*$&l9Ox4 zW2DLuCPsa`#Ay{^5rO5}w%22dll0$>Ij^D`zDP}yr<+&(LKx2LJbLI7JGZOtiO zx6e7jO{Nmdc~MS6yi4TbYP)u#3{^h}bD^h?h)L#IWuc6Tyq`h}zpY4?VmOJ?bLBo| z4aVzABL(*DeeU+KCPIA8Cn&-2=f>4FNR z{n0Cm7^bAY-8~l%Z6^WR-boDRs0mi+ZJ!ppJ3iK!p6znc7hHc>f6*A6Vc0 zXQPR^5F1N^VYGVY&0wgQ$+MT%!e_Lx!v&hFG;$9m7uhAZL&(TF-((Mz$m0gi2PYTu zEe{kKB@=h{na-KzkG+^BpV%+Q1zPks^A~fLO)eWb`FOM$PHyot+-%A&1nFeSeIdqL!Tyw{wyy1?ow$ti@bArvf4Ld`UdYYi4vHB0Cmf(NO% zI1k6^mg@4oQ_hhoptz_tvz2a$=7h?TsES9l2j`kq?Zsn&M6zl1<9eTrE{t##OUHa92m`o-XGxV=dSITIx$RY$xcM|lDtl;ov+E0RyQ3$ z_ZGVDogy)mb;;9qD0JjaeUX%Vq?be|LRdOPJW(CmkyI%4uh1sTlKPt9dxLmAnQLu< zgS3-PnvM!#h83%Q1@!ObrVm@8nhsFrWV|mR$$jZj;Id^kF>9t;XJxIb&x%$1T)`ry zF1j?Clda$9AbWq$(wx?b;MbDUvpPC?DazPqB1WYIwQ`Hj3)vViDqAk8*9wzMbB(Td zoT}cYXi(3G8%8RdgpZBX8%(iH#6h4OOtrZ(VZ{0qA+!sPtcy~`#dw(!JRX`-K&Jt3 zj?Ca_FyzEk4&H{}#T|ep*$Ps*GMUc;544srE8XXvw38Djs8U7+wxBb+(twe^8r+A_ z;|$+^&Pw;@PxdaYDk!)rUo!LBZk@evVcWS2{4gvz=FH7+g>6Rw*2U@4D$iz{$J~!V z=IUKAd!S#1|CQoC$Dh`{*3hJ&~3CGs>igCKnoNNFBuE6 z4WSb}+Tm`hTMLI#`LKEr$kI7FfXb&ISfy-eNU#37+1^I~XT_iZ4>X!jOPEmFktKm3 z9MW1B^}Gbx4csKjB z#MEi7maaQ!xENSDMLsn{Ya(Nf$2v`$>MWSXe$Y%@2{BwYG-UDP2SoK5D1k!FX=m>0 z#1ei}?#TUcR-sV-O6s3ra+ayA!dN9~MIrKEjl^FRQqQ>88dLFxCQfKjXw z7Vdew#iX6qo-1S^N)7^jo3FwrBM)9PC(&}V#BD?TIcUf_DB33e7 ztEKY!-(Hl`gqOm=@XEGB4+SJfxn(n%KAif?vV*$hHOSYpNZ|VLH4?kaJ09WQub|g+ z?ER#AU7lkkE2#L!ZqQI=i45lC4O2z%o@;EhDP^1DlUE8IBTqm*>_a-KC4$-*;`JHI zAO$dC?Cx-y1rQ(CbS`zD;OQEmup0R#VFoRzi(DCbTLMs5Xlj>@?=-}R+DYEI1D z7Fn_)BPmJFAbQR~;?STCVjT#aZTDC&l_fqgf>eWOvtl4iZQj>B$%=iLZAzedFpXeM zy>&uv^fQP0T9&X+imMp9TY+Y?`i8_jJG{!7AMdZcj__0?9*|aS_4WBd)qdN}+Wiee z_x}9i;OOApR(jLN?Fb9Q+o>qGk?cu=UDbz%eqwi*K68H)-!v8+2(gHRVm157n`a-M;*igC&zk%60o|MJ!8AK<0UQA?pDc2)#~q7t=QiK$gf}KF{P+ zpVI{PPb0ifVV_AyQ(dFt-%kefc;z`>vgVIv41f)X*HaYx7PRC%zWgiZp61ZniVx=V zu@XZUsD^cJXNNQ)#;KX z5;o9i6I~1oxDl9z061;=r62lU7E;e=r~-Y9X;E5?1d-qd4y&iQxFVYV6AV--e!UN{ zO37XK{oTPGU@vaFO{b%yTcG3Q^**}UFq=wk^}JhkWfyiob}X7&aonsSPUcKBr-1w@{(Xm8m1Wbt@j z+_;W8t@%kN-wt+n%a}d_oRY$cj@nbaZRYex{t$XDkE;+&&` zG>2{M;S*(s$M#J;)54_b0!tLwwdv$w!Ww(0ngbjp?lT;@CTq`&&s99GuB@;|_{pVQ zTifl$Vf8L;_b?^q6^_n82q&-Wh~MJoT|cyRx3L#?1k2v-VyQ(6^gvrH-IdebJ26#< zD03`a{BgEfyAf^z4qBtrY-#t)lUyq$qY|8fNs$S-g@K7N1UORU!L?GYdIe~R@JdFUJ)2;3+UQh|EYg?rq+8@U|OIyS2{YRT#k(# z$~{;i>IuVoz|)&r@~-Fb4eyo=&4Xy}ClAZznTDs^oTGXKMZ?!&o18S-p7m`A`z!xw zKeU#`v(V7d&WGnwF3f+w4l}XYoq=6VIjWvGRtsynJ4E{}-02&sI zT-9=(Z7X3ac^n(zbP6G_TCS%;#Z-e8e@K$L^Ad9NKS@C|>K z1H~laR7jNelH|nv9o;s&zW~S%8IicWGyB^U)zrp^DVEI=dLn@s@CX~Ue}voh?Kwt_ z<*R17y%`Re^Bd5*+pSV+3qL{H53>!>7l?SP&0vq(ui*?{{?w*`q(w)kIfa0dL9HeO zF$^i#C%-ERY>)PKwIPo}-p3Est_f^gT7MKh*3j3E$o@Ok zb-aZZ2U!O2^AeIih!34L##ZXb&#H6O&ZAC@WqEH=E@Bi_YY=p?B`AILpbeD?1jcvK z)>Oh&dsJ~or0vx`GNDuU-^5Y-2BhiVO{r}09x!aPuIGDSII8AgPx_fDy`r%=|2>{Q zZ4h5keCw+x9K4+3B_NUKQkTwmeziS)63Czoe-WF}jK?DRa;lo#TS(8?9!0LV=O@Uq z5;;{kLL>9CQOt??kU)^GnW7rqg7j+ELTuqbUqPb2fU#vakv~Fv#<7aK7S@RcYiN_6YB!)FCT%o3(sgP@$aUMv%B_ z=b;t7gj5Mg4DWTB^;re?Q@+V=mVbKz1cbZxxgIFRQGeOwy0>E3=N(osG#`%%jc`E9 zpz3DOB}pP|CQWTT;$@aCFr0h0hu`gasP*!lGUu8lbn*Z8hsRqyK;4OJlX~1;)7CF<$VX2WgGLj^*O#Ps+hG01Nyh$#ew( z0>`?~=LbusZI}JRcZl?RcZZvEpL>d}8wa8%87zJSOx*TKw97=;MPtU4%*mY>`BA&v z+$T(yjOR)1tK5@56p3hHbFUtSH$YHm+KR}w5#4_Jq9`-T>Q`JBmrJqPUUrfJUtHlV z)7x(w-k*d(iiEKWAnKx5W>~|`&ZOz|4h<%mx2m#{SNNCiT;09;Cz7LJXc9reuO*5qIzxP-!~+mx1cO z`@&HrDRrob->Cv)7qm2@*cs5S%iBZ4zufj%i4`3`N}Y)yeE3@Wl6nKRFKMZ%CtOtP zgY<-97lB(ia8^LGyABBAGB#1BWa8!^N)&f}cPkH(hO#XYj;zNB|Oac+$%Ot#w*CQV_ArOLoS zU|MNSn&Ha|WuLTaFGyk{k|5T=^xcN{1Lh?+fFEW1~jv-7VSe5ee^UY1skXpJu=$JuHln|6ZXgCHZu<*ku* z4(kk&w|`6y28L+5=zUCTUIr}z)zi6)u#|c6WUZ<^SV8W6$R%2j05dm0>c;oWQjBz7 z&~?k7(1fuf{enBb4^?k zq;ZxJ`Jjj5So*i7{o{yRKlt1!CbYIB4CMrg!-IPal5!W;oD<3pRFo>^yh6>Aa@p!C ze>f)jmxGz)7`X0lcJ?IWm8BarKY|RpE|seseR9ms!|*QLHWxlq&Uh#u3lgFX2qSuB z9{5NG3;E{cjjWMLg)b5Ks`vWv;c1_|zJ3Gc@p_U^A#Sp7C%g2w7aHpt2l}!gbNMx6 z3%M{n9Ol@qH~gSL`HxV1{VPQQ8^>T2(?Umjgq=Cj!yb5R6Mjm;n6dkG58rsA=Hj4; z^aPTr&g;2OY9fvzpJ#wd9EA>PwB+UYq?|^j18(Ku3Z%RlSKIk*uEtco!W0I*IhsF- zQ!?>-QubGH16D~|#w-!V;*mY>PUaD8t2^5M%&v^)xlkZoJsupg20b$4TKz+1Nwvlb zT=q7iajiYE@R3{?wXN(2Q-8=PQ?LmjNy+9x`c(1l4K|*sY_OSs;+x2ap<&aJ)~vc^ zB2Ad20i7J+25F{LpAjRI1rHR++qo5CMYh`+Huh_h*Dxk=B`CMu5?^y_zxwtUpwgPS zrCE^O2>!@cW_MYrNqvV+u521ZV!e&Mq%t8H^Ot{99l%jc#m?7yjANP<_jY9z|3H*? z?I1i>8^Ma-Yj#;WzE-;FPcEs;y~f_7O?+&yvyT%SRjuuk^q{;bW`RUhzwDb>s(>5i zjMO&xkCZ}&s?t}rB6rl#XN)N6KqB>I-IRF)q&XROSqp}-mbwd^b|ALjjz)@w*LHg? z@~qCIGetd_G3*P+KTb(jSa6+QqvrOS8beO`{?=s?d_>4}z@7rI?b@-BACR>6KLKsm zz8{mO_i>sRO&DT$oQjnr$H0-8B2JfGhkpeKD*Tw-&{sBD-_`AAHOw}4P<%hF^nB}R ze)7S~xgvxA7!w&Ja=Ay$l^0+bQPk#uV1(&I19*y&ep|&q0u7k2e!zX{diR5jPt^*~ z&8M1tECxESW>G+UhP;w{NwaWMIQ6%EYB~jdt%@at3_f{bt6gd<3VM#4&`pehG8k5U zh*ADtqVm(<)#EHH4*@%k{ozk4-M&{PXj0Bn*8R=alyn*C99nJECMCV19WAZGRbU~` zS^8`Xx<&p#p+`I}pM9-j#04oJ-hunb2GF8K2Y$buk^Y(Tj5_QT4JVYFtF4)M&!jZn zkvnui^jqKFO9`dFbiZIemDltjV295vR0G+!cx-iW#)(S7R9H;vHIf+KAFOk73g3h; zlE-=~)fk|d{Ltdh!cJ0iotrmVgeV|iC20oGV`=SeUKOX$K$2mIF0PlaKcq2MI+zyc zR@T~W(#>X?KR^+@`YD4nwxFLy*K?4=_{&x|RioHneRkI~qn)H8bJ|*92nz}h=H1r5 z{&E)qxz>VuZ>XvLK;r{}*s|Dbc7E08nUPK`MJ$_EnKk6ZHI5M`5JVx3^=<6^v4{M`8^w**QK~tb^a7A6vQUA5kLjh#M zC~VD%4jSH;2Rj;UY=u6Xn>L7f1~y#Wsrg335sX)7@wO>t1kq72mb2S;^cuIpMhPJE zJ4|h4kU+whNx6!!jG_Nv z1!mzL#xFBjuULm%R5so-WYareQ)&0iy#|t7!QXTGYu>Cy7&b(d5%<)AgIlAx{jIf$M8h z)ODU$c_K(B_76SLqKhyd{oEPnAW6*4JC7TiEXyhMwIFS2WiEL$fKeG{nF{2#9O)X( z;A1iYia9bh4qG;wY84g=RvL!y7t?f?`;sope|yHnT4jZY=SYqb`cM?`*@mLe;M12J%1xh1V@mm2 zH@RAfAb~@B5StUpuKl}fU))9+xSZ|T6UB~G@_G0jtA{tCO=m`IWy|GM3!)WTDNxK0rt%mzelmS#5{w{Q|B?qkl{Q?%}E@|taFg`#bGe!CWWs`_fGpWwVNVXLhwc@K^mCNLU!un=|7Jo+sP`c?()Rw>|^v; z22>I!MR?N0ebyA{B|CClDQX(sdb&?2r|D;9w{<9#Wp|_r<}KFp<0{wn0o>iczPXtj|SEk*I8(+)}q%GU%F%B5MI2bS7=pXgR^%{>=)o|*QnTYVb~ z9~+O6N845cuJ-TXjesnYW_?zhmMS;Q>&>}m)kf^1Jq5--=SK7M#?f_Zoh8m_3y)W=$d#Gpv!n9%gcA8HTkXFjjkWxmgQGvb!&En zFT}6y%I`Nu(euMzI@*8YfJUe=QT@VU z$$Vb54l9R;?FeWozgO+!tzo-kBYbX3Di>`YUUyFa!8|&dZYqkhw*wb{xKFm24eZP3 z4)&W<9E;{8rT}@&*2e)c+K$MP2U-N6pWWy=fIuT;)(36mWel=B-j|jZ5_zh7dqZziVY_gfJpmybGxg`2eO=Q|bn-mI7M3>#WLHoJwW)#F z0A9DsnYrn?Vfiz8H~q`8w=W^bGH11lU4;PT$?oPPxrBdXdomizUKqpo5C zu*KO5s5U)vSRS}Jau>$AfpxvQrMWb1Tl?y^lg;?Fd>3!OqR29LaCApE4tG!s=Y5 zn{u);QS-4i@!8`ECgPUkg*VD^L-bNyxLO!6_zEZ1*AsP6+cTT|i1qm@=_hXAwL&sw zCUk~y%So#w%|0ub2f}*NavhbxqtE1&CG*5y&YzSKv&T5ioMCxfNu2z&6i+@l3-Svr&BzN-gid={ij9o4w&#_dKJ&6Y2?4IW5*?hWXRHtUpG4H!#xs!`V~;K{ zZAecfMlX~1q)G`g2y&IHd6=IDD5NGrbQqJ*Q9+AF*m*H_2my}Ab@R-S>{uXuk;eI< zd!n~538GExTczG`A~OTt!F|@9?u;5TQ1g4Tcdj&9<%QT*s=sL&Vsc2Fhd0;_{+93S z_#D-nmu5|H$JtVrx`?M%k3d7-7?{%Z9DCH76HRX1Rw$K+Ol9mpOvb>o{-&kZav>ZO zYC!&eH#J04VtLi(3ZnV+(~OB2wAnZiTb10uL60`5w)y+E=!D%oaYml*+rEG`MjibB zV;O)5i~&s}wutPFXHOdrfa51qVZ2RaCuMV&>1%6Sb1kqXSdsfsE+B`VSdTbx1N!T( zaKe4B`^{(csq>VV4IX;;T1mg8ts9Ms!XQ#v9cr}8-}cnfr&gLjtdjEd=0*{M5{N1wIr zVi9-fnxi`?vd(m=@OHl&N}0k1bhkTOp(HLqyk5WYR<8-~9nBhC>4;w|O>WkL3-ivC zF}Z`^))%tI54ko#$>3DrTx~ARVL9ycz?Sgaj%ZWOs)($k{!|^G^X1gxQhHgJtK-Z5 zjHd>e1t_dQe|Gl-0{78M^uADv@Up6v$rUUs zt2?=+9o`=u&u@F=;%Z;czkQ%}7rz#=28@zGJSzSpb!+gG zl#+2n%d+j( zj0uxGi3R#L!1aNcBD~4k{&k_W$FCBkD*5`jRoeKXQj|#$Mj*VQ9sD65)cTKK%HTTJPFwC zPMSoj7EY~4j3Q{Juc|Jw-*h1Vg{`-pg46nRVpLp312^8|nrP2XrE7lhnzu2~fcoem zGbZS-f1+&bmx!4_H!zZglw%nAJ?YN>Y^)XOL<7zb?%aD^*4;9j@l~Shkg1BX!oU#R zt2j@j_L;;4A65Dn&y7()=qW)G)EhyMd7uY~OX29P`vbw?0Vf0W5H)EA&u1^EGt7%>^O93QxI-f2@%Of$ zAPG-ntI=^)QVIJo1^ke4tIe}o}96)pSNVZ!TLN734Bl8x* zAKZ)o*eijY8icAeKqXcCj6OZ~zjDGV5azBsKIj&JR5uiaHYe~Vk*F0P zTSusMhpQ%dZNpuq2DpvBphusYw;6T1r5Q=zh;AnzKSnV}u=7=&LgE zFhKM04j0rM-Yjsq28WF;{%@2Guzoy>lmrA`(xh=k5_0g09UAg`EvS=3ruHBn}! zst*F`GM%IEqSA zAVo2|4naxX1#YoKW8;_EKQf2DE~6P-LuU*s3wG4rFzk$~}Y{}7iqJ6dYSw$M~4dfc| zmtWqjIz77`@Vd9Jzl0wVlu1dw_(F#I5=4Fc&Zo*T7O3IX#F(#DIZ0Zh3RBA9RgZSC zOX7R<1uqw$p_u>zw@?yAx?yLYtJ{^$$)S$hg?7uNsb1*5e%n$y^Y^{;>yC}su(giv zIVgcbC<(=yUpGHl$4b}c<{2D*h+4!|mbA?+l%-h}Y7@HihE_%xbeqiW)qG9Cj1j*jJPqTJ1S z*C7aiP;DKq*aI~^WQuOPB;{T5LQyk#rrj@2KHq`V337Lb;@^utpx02ugtK~GxOlKm zYn29K)bn!B)}wXSSzKREXU_@?tz)pHWFPJNTC?Rcv(qdYh9qLM)_#mx(|d#{QnzT; zOz2(7Dp~PNn(G?Mnz`yJO(qvkF403FwiI&p6bjzoNor_hC5lIb3-Gn|UD&p2;Jb$c zjy((b@WapU`KtNg?rc{tVqu2=>!R)M3RHYBMPP0rp-gYy$If1;Zs!K#;WwBHv!X-8 zc?*8~i7BetaS3*?vwqR*IKy!Qa0nfZV>hQ{SYz)f6o!8qIM**D1{{mlQW6@?s7|SS zl+=Y5SsUcHvI#8FHney*^i#MfQMGLCxZ|z7RC8uVDTjB%BceGz0Nm#Ozex%XfJ^q| zkAlHWdh+h5u*cR72LTxjhS7qA3w z>Tq5-o^R`iH}K!m?BYAEHY_V{^pkj*@K91v2m*?tn)9+TuzUA z3^1Y>0&KmWz-SAGC64zg1t9!bJdo!S>wpg_Q#+(|Zh9o{(=G=gay~Z#{E+IB6$W0J zQD{yByj3or_S7mB4^TZ!>W?h5%DE?NLQnFM5))^ea%-A1Su@eCgqj-Tbr5`N&rwC< zGB}Es$!?9S3Qbg^FQMldiVOXZLB4M&>^Jbe#&q=o2S_fUv+m(%2JZ5_93|!|JRT!@GL8kjP`PE(4};I&eNSeks-B)#72dq(kFel zx7W!28RF*Ld0y+nY&FklZ5BmGnp02Q&5KV+P;TH#J}&twX!$({8%W`;U@h5{PS@ z`i`O#J7u~Wu;yro-=_u*fgM=r!h0L&x%HOKGvL-t781dq=>U2gF4?`7B}wM@$0X#y zl9O+4)_%gfJi4Q0u>I!}zkEfD=dDcea1-D^5J)<}YN)HL@W!A0%Ww4>d$;vii81Ra zhie5X+U6ICF|UZ6zoa~PDtPL6u11z-=X_ZA-uqnlS{{r<6Gi5d8J(eOdJGfI*~>+w z3#Py|=5}%F@-(4x5obJTez4jMXwwioSRMec)>wJhD%iD@Ldk^2$3WVCX?AhDUC-3V z#{d#Hs2h)W3t!_M1OQ5EOI;JxLBdfu zLQA57Oq-lS;JSc1OT%ex%XYn0MCTf@>G%T(zFO5Yrss0OS7;AC^F{v1UdVZZcfIF!S3y zX;ADE=P&8z;lc`SwBAt}*5*lesr)x3KC_-&pr6}xa;QQ%`H!XZI>cK1FVFk`^Jynp zaHGGwW?-ey7%2C%^x7evm@K<)e80nqJ{CyqesC(l_`13xy?i_5WPP`{(egSFc#X?P zHAUKeJukH$r+|h-SDU09@=!q4Rhzty4S?7o&Q6Oq`gOF4C!RB}a5_0kbN&Y3+gnpd zUF&3YL(1#7`W`y9=)ne%gZRZX#YPW6W|jzS>%fdZpnQ_RT&7BSZWieYGbHD2G8A+d z$wmH(2}v5+tr+`MET>c@YxWsw1=W;VHS#7tq@QZ<*poPQG0S^v3pAgIIPE6kDP?+m zv9QMg4IH;%vE4h<4Xnq&u6&dEa`^Jh)1dCl7n__o*#{$U5(gD%=A9{02a4`#hmDB} zl^dL*ZFDpFO9w&IC$#ZB=IavW>4Bma88RRcWww;qdlkUC@LDwzcVgY_hw4{cWOFNN z5A$#x@)%?7_yU>ArR2p%@+|2$)F?)&xn^ooKOMbKxsMFkL#A*-T8qGfZJcZCt6O4t z8_OtDoo#A7C(iNq+Xvi)pvZFi+`o3uI9Sklw%C@|?e!g)OFZHUF2v<&clA|Gpo> zIj5(qG6d2ZtA5ZNAJW1Ia(<36c5Yblr*&Bdb5l`O0BCAQGp3P77?SW!Ve!jGTgB2L zNHl0thdXtPsi|Xpm43A-_5EI>-ZW$(@3fwi@yI0|DH&2ih5PW(%Tx7LGFeace5w}`xUgw84 z3X&zI_?n0A3`Y9g)Z_vV()$Bo!5P3!DwzTs;Z2NS1H@C+e#LJ+f>4{=O7yo*1_gY< z-jja)L1pxN69Iq?xLdrau@qmmQ=@%wmybi8aI;J8d7!O>>PF}|f{`CQ6}dnIj2#NP zBDSc)l0e?pC{~QXLBJ2BpiO6`Cf87eN+t!|8U+Ek4&@5F^==c^(ukc5$Dy*p0fF4-hD}3Z0Frd!4(tdY9Nb@6Sh<== zLXZjj)XyB8y5HVydcNPtDtX_wbTD|pH$BgvA`6%)c_=C50ZSfPN6SB!yu)R^F{cHi z3IGM)hVQq)j{D&!e-ejXh($nAeg0e?!VW(pvR z*$4^l(*hs@uwO2$fA)DdFP!99eV1rag=Zp^!)TwD zTH+idGnp~QZv(F+=Dj~l*@Obw{lz9!A)J4u`WUsVX1*1EFuW2v$%lB60)?JfHS)J7 zzR}JN3NQYU+F*hISts-Xs>{p$2ddw&=a1#=rF!-JE2+1jg!|^0mGHeFj1N*e$CpN| z$ZV8s<#QZ{`M?^~my1#yB(SEgF}A`N?EdDq2JQ16W*>bH01!>>k00WCY?)?aE~}7Q zI5%65z*2^}s1Vg3l~@~AiQrsj9E(!g{*g^FD0-bF&vdKS^Nc~jWI(DP7(W;YpY5b> zq^buHdf&j$1gc?AnLIJTYE2TFSu~b0ZchPabsPe-SZoPu6-o*E0e~NUL#;l>SYxuH z2$)cpK%i=0z{)oYc(b80rq^9O6@N%v?#|8z&$&&*>^QFepVF>6AgZTbuMG+k5&{wu zf^@eaNV9-+qr|c_NGvR^ASs|U2>7F6DW$uX5LlL2Wu?1Qy18e$-~H})|Gs~nGjrZ^ z&di)M^FA~4JTo(Le-XQc{@GvVsteG~`Ioc<(C6fCB~^U8&yUa*;Z7HJ|4_x0(E+x5iWusOQb1X4iT${b zP-a!tSiN#(+E0$T|2-$sJQS^6?r0_=qAWPjm__bbC%qy4)A*^}*MXW!Bh6d-#+tX( z9LD*M7jYAOtg@`fJ19-u*G=~X^7}S%{V`d=Z0*R$Kjs1iTz6mg^9n+~_?1UL(#^l~ zC)1gjVS*Npw3n8d0gtFLkr7)Psir*fp~Y8k=5CukQyqh!8+OCJi zt>&PY1lVOYqw2l&pZ|@VfEE3`jb&{3ZlZRJ{f+VOF!WVsZT52|P%B!-U_mp#6Q zM#-Dvr)phv;id&nj#)kH#ij2PrV4N9vi{XLWjiFi|B^7ks!y^L4OBbXH)RrJX(hv! z4itAty22WjHPHQRxWQurIS-hcC(Zv7e0idVhv2EMvLNfie<0*OiDLnTP_1lAt3-hS6ZqM@`ZctTP3c$~5fpp*C0zX5yzJd(LKGbD-3qv#oH zis4m{>WJg*OqFRmd=dMccrD?c5%@~Jl>`x=JV)TJp;h-LF9*#~R1ru^+Mp)jE`)5s z;-_ZyoMhlvDH`9)V~83dYM|C+QU5n+vA88pcr%_@D|~~=dk@D?kl1>Fhn`txW4{wv z99v)!4Fw3O>p5I@zyO>|qzD#8aSOySu~6Qd)O8s)Yn%gC!3QB!FzZWcGR9Vb*fa38 z>_0UtTn(|YTAEHP?%oH-`ME{kE{ItYZWGJLSJvADlaYpta4s?su`K>m`!aQ|f%s82 zd$K^b>=o9f+GWdx_($-dryceM!XMZ4i}h8-}XZ0Ovl#}s5UZTLK9_YX7ZWieYdO^h4TUEAWJwI9Eu#XFV4 zlVyFVbbXpu@1(_$7_!N#WB3ZDfe8~b1uJa|KCpW0GRcb^d2A*Cki64RDKLU+mQE0s z!ftGu+NLNUN9a1Befhzg1gIO^qBXAxBqMsUcTV?rv%;QSWaQZ%q43THjmBSeG;$u9 zTTNgp-_+%vaK@lIS37o?^goI}ji;Us?dDRcbatv_n6a}5mh%cDc_tN%OGJTyDckp~ zyZisiiG>v^{U?9KkLy}vGkv~D4{UQ1&?I(w)^Zi?c3Bs>pP-$Kl++W(&(pjj8#B1_ zu%Z(zlrNK}!a0VUzBd4pNC|VViIXCUf;CWQo9S@mw3w$j-l_97@6`MaHXYfh<#p|C zf(P@1+eTS_?X(-KUC0%iRM)_70hI;MugAsU5%5Gnj8g~D#QvqhDH}gnU(Z(w-35t! z!VMBNdwa41vckUo?_WF$1Uxf>zSO}vQseM+;(sbf@=ash@ccM#30f32^L>T5?oN_qb%G2cTjx&->P2&8hnz8c9xAMiOM< zF;31y?NkmE)C4?kg{kB6m92(qb}Fhy6!0Z35}X~KG0cU|t7&|_8#(D28QvIwCfT~G zKa$mIjyT<;Dl#<-4?3xg+NUra0LXp+_F%_5k~aX4b4fyVGcUD6W8cPVDhCrI(Y$OB z8K0?L{^@~BR%=dhs*Keuk|eA=E=R-a*5hYcS1nCv_nc_zjzE`4uyrk>wzN{;RvX`z zu~8*i`Kbv@Ex)tY<1$h$s={C$3vrkNe+ph1sdl)2c=~5X%N$aZ@X}yaCQ*4jjr(on zv&wC{AN4=Svl+*;j7nw5QyGdTYh;t#PYbhex)}O!CtR7U>{5wWKHi~H@TV%r!#C?677RzI)*N=1RdquBQ#l6!4k89e(DOlMpv93M}5;S_qMy`fvOb<`X;jG7JgLFZj2>u6- zGIH_@@bJ;+2!s}VqMVgPzW$xr!cfI&f<c!o`vtsc;R zol)kqZ|LRQx;P0-a2XGB#lsJ`5+!c)t_Ejv)O|Nf&wDqDObRtKzWv_sN=iC`^`uTv zp5&exaZ-Eivf=g;;SHU!U5lbgekt~YEiMpH1fUElztgYMm-G5l)BeD&*ryl%Re>R_ z;~Z7}`pCkhQy=@PgNurx@q7u6swkw4t}b$(vac#Cs3N90V8799T=L1MD{;|@f|6!Q z+7`_Km|&wXeA!*+Ny+9xesk0LoR>jA?9|o6F;5!Z{8qPAnNgOco?qtga$A*oTb z40iL4jkno)(-SY&h!7ftF&V%0t2Mao_(cB{n2xMD1T+cz*R<5=8BcBw*wxbO2RK_o z_GXF^A>GCvW1@{)C@GIq*8~O10)&E^%KF*GJS9if@6GwkOYuoxu@F`Xdk*8WyShTY zRWb+5ibS55K$eeormN5?>=m)9Cz_$*>=8uEWu~Ul)uj3etBKe1%}J3Lom5O(Ib@nC zl>4tR@ofw95gRlUx9AdB$RPY%Q%aNU~=Yhuk3ZsYZW_;X2YtKZ~(L6qy@e~nZkLN#4 z{(2$T!3C^dSmKly7Qu`+6&B()9qwIG(DA$Tf*$X!p1zv64J$I$jy+}3(OAXDn~rV> zvcUa&L1SXqF(P%dGKZh=E6M28FTGTH{aBIMNT=DJ@7C|F?t(xuKP~Z~%+#BM;AX!p zTh!x{fX-ruN&$Tpq`NrEB%>J9`iTL)h-mc%manKW%JvZ!2+Fa{ZT^vCON~vRS&EnQ z7Kol;{2rVKbXlAfL8k|(uuh$V+5UQHwQQeb0b7;R#a2- zxKeJw(_1a%a=bIRMJW&8NH?BIYrAlx7?>DmVN5YbU9ow7^UO>BWD{%fpAwq#mzRk| zw@!ryE(P|-G>=^Uo1dnL>u zP-~33&*^^Q@gWh=*K4`jyWB4exU7ob%`Cc&YZWjDY~E<#1mw?7H+1U;kqTt;dz`;G z_w&uAeF8QhK9DEK1ttOZOntvMScMB;c|RV(-D<$F_W){WgO3iLg*p2Rk^)g6ZWK@2 zs=rpeVO)KQ`r(PjEnH;3pMmzuheBC%a&{mTXqT4dIJbJIZw@gT5nuo`S!+~ z9%pN_HT#LGzgqizi&AxhfNu{NYXQx;Ej6JHr)*)P=)VlSKeRZ2xK?O?-76IHwl?9FcRoeuvYj%x>7b@vFN?5eIT z1b;QBQ+nq=={4nrdk6zpK&8pshidK7IrM@Ziq4DgvNA%|ZjD~20CDo7r0`66cEGDB z#X{~8U^_!iB(RLT1}gpN0{lgw?=R_~qT1m_ZfGGj0SPR@XY2Rq;)3(P>vudehrd5f z$+Jb_(VZQVz{lTWFDZb`Z`ozcauN|*cS5KPQFwc+BF+2iUB&8piK|;in`1Q}C+*JO z?AN|md6Fqo!SA@%uH1a+>Hx9g%QlS@W5EChz(+bgBcjIWuBpx*_BJ}s1OVA^ zp^2$j-VmsrttC7u$hflz`%|seB3AEHB)B6!v3-1sl?HU~YWYw_<>k11n*bAt8JoG^ zL0`^r-e#9~^1~3M4Bfq$jZmN*c9=p15=85XL#~h~G#Y?HV3Ml)i`gJ=R}<~m`ZAg%f2B~l`x+<7x|jn3C8!Hjn^ZJ*VWKHPG+3%(>!0O zE(1lX_BiUh=g=qi1D2XG+5zeWyPCbf>*+o3f@e)GlXb@4sg>GNi}-PV2MYQKx2N3n z`Cs~$-OIzi?aN==M@3~eUfy0iYsCn(8SRsdhxt=0+agbOyHYa$~0$ zfoK~VarJZCU)u5Vsj4pba1k#CqR>Wun~ST*98kr3p{zl6F0NiK?rQkhw2i-!kgS8C zwqZehb~Fz)JoQS` zc3AJ;Ti2PM@NbqqfZo$y7AS(0a_s|N-M^|y+HdjUX#)T+I1;GdY*ZkqGq#*Z>}e=N zx3)`3xunNwOwVPm+z;y>#=I$h?dJx)T3K*7RTS|$@U5$^zCcJ9hd|5Bihqe5o@HCo zZ*0*Y+|$)1jDAy!T^oq$dP9@pP)1zhK)bJ)n{gPbtD8ZdN6gK`%+SpqT)0c_AAq6g+O&?g=EY+YG%|Kl%6x{lF_5Dw$@zbjIB|i>*yNPf%5dm`xQ$SM>*( z@r+_D2bz3$0!!^v3_q%j|HFwcXVwdeh?R^Kur}J2N~lvej0Y=86(%g`P$a#os?w;r z@m1cypH)55&I`6tf%c4osp~8)o`jYPG>;4u@GE4)IDInhS3kI+>$aN2^tGjL=snt9 zLpAbq*eIwSFNF3!{^I?I9&jp>77s|#yD((b{y#}c5JQTd5&kGAM-x|F@YWzi)4z6? zOJSeI^W`%+KR5@vJ0gp-!lmsno*EMG%O7MLpDM~^AxIAD9q$l&#ta=^4^fyCn_t!T z(fO!n=*Cw!*Is? z*+<#flr2Fy9y}iw&6MD_uNB?t(Xu?x_)J_iebol!WFZP2HWKyq2&~$xk7Mv?nL7NXRR3dMJefAx6 z>^MtY*24wnr>UB#*`Vu5!1EpCy2eN+sGZg6O`m?|C}!m9<1CY$@K0n!qMi zvP=%pr2oW*hb5B-!eH``WKA+oVxeG2-6s4KG6c~v8^GS_)S7#?b>K}u31 zp37B}#s0D+o?H&-$F za{%-LRt>ovIK#ADo?x|lLraIj5G-klLgLA8ru|JUTYaLtA!|%}sHrp|(8Rnm{wxNq zNNB1Rp@xAa%-Lxuw$399!3`->_rIWkqHRVE(AD4krfp4&by|oBTUUQvMd8pc1$L2O z-v})QAXn>r&CV>ieiG%kq5{~1&Xp+q4X(jR{=(rb_`o+vfLraVh=&pftw2mQL{Jm~ zrW{Ny-|*2i9T&GWAB{`}KmI^AqIeGoCdWt&h#`@&IO{z(tV`F&1^7hYvL+=E4*b^G z5F%iG=l$=q>2LNETNX=HKy0f%4C|6N{GFV}Cm%`Lu#dab*TeH6)X?Z>NQvdzwat?W zv9#wOp*L|Cmln+=ZZllJ9Mw&WG)!R;!*5&G#@Pjat8Z|eX3qI)B=eRj4VOGr=YZ3N zvUP|p3Hk>PDuP_f#Gtq%FFoG%@xkp`9OQcYp5fY_lQ>ua2nOEy@Gk^Le2ru&@Y=7_ kaZ^SVhYSrE{$Dp=5rxc%rC&xlUl*#fyt-Ve?As6j1zv|b ~/rootpassword -``` - -**Agree to accept each machine's ssh public key** - -After this is completed, ansible is now enabled to ssh into any of the machines you're configuring. - -``` -ansible-playbook -i inventory ping.yml # This will look like it fails, that's ok -``` - -**Push your ssh public key to every machine** - -Again, you can skip this step if your ansible machine has ssh access to the nodes you are going to use in the kubernetes cluster. -``` -ansible-playbook -i inventory keys.yml -``` - -## Configuring the internal kubernetes network - -If you already have configured your network and docker will use it correctly, skip to [setting up the cluster](#setting-up-the-cluster) - -The ansible scripts are quite hacky configuring the network, you can see the [README](https://github.com/eparis/kubernetes-ansible) for details, or you can simply enter in variants of the 'kube_service_addresses' (in the all.yaml file) as `kube_ip_addr` entries in the minions field, as shown in the next section. - -**Configure the ip addresses which should be used to run pods on each machine** - -The IP address pool used to assign addresses to pods for each minion is the `kube_ip_addr`= option. Choose a /24 to use for each minion and add that to you inventory file. - -For this example, as shown earlier, we can do something like this... - -``` -[minions] -192.168.121.84 kube_ip_addr=10.254.0.1 -192.168.121.116 kube_ip_addr=10.254.0.2 -``` - -**Run the network setup playbook** - -There are two ways to do this: via flannel, or using NetworkManager. - -Flannel is a cleaner mechanism to use, and is the recommended choice. - -- If you are using flannel, you should check the kubernetes-ansible repository above. - -Currently, you essentially have to (1) update group_vars/all.yml, and then (2) run -``` -ansible-playbook -i inventory flannel.yml -``` - -- On the other hand, if using the NetworkManager based setup (i.e. you do not want to use flannel). - -On EACH node, make sure NetworkManager is installed, and the service "NetworkManager" is running, then you can run -the network manager playbook... - -``` -ansible-playbook -i inventory ./old-network-config/hack-network.yml -``` - -## Setting up the cluster - -**Configure the IP addresses used for services** - -Each kubernetes service gets its own IP address. These are not real IPs. You need only select a range of IPs which are not in use elsewhere in your environment. This must be done even if you do not use the network setup provided by the ansible scripts. - -edit: group_vars/all.yml - -``` -kube_service_addresses: 10.254.0.0/16 -``` - -**Tell ansible to get to work!** - -This will finally setup your whole kubernetes cluster for you. - -``` -ansible-playbook -i inventory setup.yml -``` - -## Testing and using your new cluster - -That's all there is to it. It's really that easy. At this point you should have a functioning kubernetes cluster. - - -**Show services running on masters and minions.** - -``` -systemctl | grep -i kube -``` - -**Show firewall rules on the masters and minions.** - -``` -iptables -nvL -``` - -**Create the following apache.json file and deploy pod to minion.** - -``` -cat << EOF > apache.json -{ - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "fedoraapache", - "labels": { - "name": "fedoraapache" - } - }, - "spec": { - "containers": [ - { - "name": "fedoraapache", - "image": "fedora/apache", - "ports": [ - { - "hostPort": 80, - "containerPort": 80 - } - ] - } - ] - } -} -EOF - -/usr/bin/kubectl create -f apache.json - -**Testing your new kube cluster** - -``` - -**Check where the pod was created** - -``` -kubectl get pods -``` - -Important : Note that the IP of the pods IP fields are on the network which you created in the kube_ip_addr file. - -In this example, that was the 10.254 network. - -If you see 172 in the IP fields, networking was not setup correctly, and you may want to re run or dive deeper into the way networking is being setup by looking at the details of the networking scripts used above. - -**Check Docker status on minion.** - -``` -docker ps -docker images -``` - -**After the pod is 'Running' Check web server access on the minion** - -``` -curl http://localhost -``` - -That's it ! - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/fedora/fedora_ansible_config.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/fedora/fedora_ansible_config.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/fedora/fedora_manual_config.md b/release-0.20.0/docs/getting-started-guides/fedora/fedora_manual_config.md deleted file mode 100644 index 58fad0b57bc..00000000000 --- a/release-0.20.0/docs/getting-started-guides/fedora/fedora_manual_config.md +++ /dev/null @@ -1,199 +0,0 @@ -Getting started on [Fedora](http://fedoraproject.org) ------------------------------------------------------ - -**Table of Contents** - -- [Prerequisites](#prerequisites) -- [Instructions](#instructions) - -## Prerequisites -1. You need 2 or more machines with Fedora installed. - -## Instructions - -This is a getting started guide for Fedora. It is a manual configuration so you understand all the underlying packages / services / ports, etc... - -This guide will only get ONE node (previously minion) working. Multiple nodes require a functional [networking configuration](http://docs.k8s.io/networking.md) done outside of kubernetes. Although the additional kubernetes configuration requirements should be obvious. - -The kubernetes package provides a few services: kube-apiserver, kube-scheduler, kube-controller-manager, kubelet, kube-proxy. These services are managed by systemd and the configuration resides in a central location: /etc/kubernetes. We will break the services up between the hosts. The first host, fed-master, will be the kubernetes master. This host will run the kube-apiserver, kube-controller-manager, and kube-scheduler. In addition, the master will also run _etcd_ (not needed if _etcd_ runs on a different host but this guide assumes that _etcd_ and kubernetes master run on the same host). The remaining host, fed-node will be the node and run kubelet, proxy and docker. - -**System Information:** - -Hosts: -``` -fed-master = 192.168.121.9 -fed-node = 192.168.121.65 -``` - -**Prepare the hosts:** - -* Install kubernetes on all hosts - fed-{master,node}. This will also pull in docker. Also install etcd on fed-master. This guide has been tested with kubernetes-0.15.0 but should work with other versions too. -* The [--enablerepo=update-testing](https://fedoraproject.org/wiki/QA:Updates_Testing) directive in the yum command below will ensure that the most recent Kubernetes version that is scheduled for pre-release will be installed. This should be a more recent version than the Fedora "stable" release for Kubernetes that you would get without adding the directive. -* If you want the very latest Kubernetes release [you can download and yum install the RPM directly from Fedora Koji](http://koji.fedoraproject.org/koji/packageinfo?packageID=19202) instead of using the yum install command below. - -``` -yum -y install --enablerepo=updates-testing kubernetes -``` -* Install etcd and iptables - -``` -yum -y install etcd iptables -``` - -* Add master and node to /etc/hosts on all machines (not needed if hostnames already in DNS). Make sure that communication works between fed-master and fed-node by using a utility such as ping. - -``` -echo "192.168.121.9 fed-master -192.168.121.65 fed-node" >> /etc/hosts -``` - -* Edit /etc/kubernetes/config which will be the same on all hosts (master and node) to contain: - -``` -# Comma separated list of nodes in the etcd cluster -KUBE_MASTER="--master=http://fed-master:8080" - -# logging to stderr means we get it in the systemd journal -KUBE_LOGTOSTDERR="--logtostderr=true" - -# journal message level, 0 is debug -KUBE_LOG_LEVEL="--v=0" - -# Should this cluster be allowed to run privileged docker containers -KUBE_ALLOW_PRIV="--allow_privileged=false" -``` - -* Disable the firewall on both the master and node, as docker does not play well with other firewall rule managers. Please note that iptables-services does not exist on default fedora server install. - -``` -systemctl disable iptables-services firewalld -systemctl stop iptables-services firewalld -``` - -**Configure the kubernetes services on the master.** - -* Edit /etc/kubernetes/apiserver to appear as such. The service_cluster_ip_range IP addresses must be an unused block of addresses, not used anywhere else. They do not need to be routed or assigned to anything. - -``` -# The address on the local server to listen to. -KUBE_API_ADDRESS="--address=0.0.0.0" - -# Comma separated list of nodes in the etcd cluster -KUBE_ETCD_SERVERS="--etcd_servers=http://127.0.0.1:4001" - -# Address range to use for services -KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16" - -# Add your own! -KUBE_API_ARGS="" -``` - -* Edit /etc/etcd/etcd.conf,let the etcd to listen all the ip instead of 127.0.0.1, if not, you will get the error like "connection refused" -``` -ETCD_LISTEN_CLIENT_URLS="http://0.0.0.0:4001" -``` - -* Start the appropriate services on master: - -``` -for SERVICES in etcd kube-apiserver kube-controller-manager kube-scheduler; do - systemctl restart $SERVICES - systemctl enable $SERVICES - systemctl status $SERVICES -done -``` - -* Addition of nodes: - -* Create following node.json file on kubernetes master node: - -```json -{ - "apiVersion": "v1", - "kind": "Node", - "metadata": { - "name": "fed-node", - "labels":{ "name": "fed-node-label"} - }, - "spec": { - "externalID": "fed-node" - } -} -``` - -Now create a node object internally in your kubernetes cluster by running: - -``` -$ kubectl create -f node.json - -$ kubectl get nodes -NAME LABELS STATUS -fed-node name=fed-node-label Unknown - -``` - -Please note that in the above, it only creates a representation for the node -_fed-node_ internally. It does not provision the actual _fed-node_. Also, it -is assumed that _fed-node_ (as specified in `name`) can be resolved and is -reachable from kubernetes master node. This guide will discuss how to provision -a kubernetes node (fed-node) below. - -**Configure the kubernetes services on the node.** - -***We need to configure the kubelet on the node.*** - -* Edit /etc/kubernetes/kubelet to appear as such: - -``` -### -# kubernetes kubelet (node) config - -# The address for the info server to serve on (set to 0.0.0.0 or "" for all interfaces) -KUBELET_ADDRESS="--address=0.0.0.0" - -# You may leave this blank to use the actual hostname -KUBELET_HOSTNAME="--hostname_override=fed-node" - -# location of the api-server -KUBELET_API_SERVER="--api_servers=http://fed-master:8080" - -# Add your own! -#KUBELET_ARGS="" -``` - -* Start the appropriate services on the node (fed-node). - -``` -for SERVICES in kube-proxy kubelet docker; do - systemctl restart $SERVICES - systemctl enable $SERVICES - systemctl status $SERVICES -done -``` - -* Check to make sure now the cluster can see the fed-node on fed-master, and its status changes to _Ready_. - -``` -kubectl get nodes -NAME LABELS STATUS -fed-node name=fed-node-label Ready -``` -* Deletion of nodes: - -To delete _fed-node_ from your kubernetes cluster, one should run the following on fed-master (Please do not do it, it is just for information): - -``` -$ kubectl delete -f node.json -``` - -*You should be finished!* - -**The cluster should be running! Launch a test pod.** - -You should have a functional cluster, check out [101](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/walkthrough/README.md)! - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/fedora/fedora_manual_config.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/fedora/fedora_manual_config.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md b/release-0.20.0/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md deleted file mode 100644 index 214ac15d943..00000000000 --- a/release-0.20.0/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md +++ /dev/null @@ -1,183 +0,0 @@ -Kubernetes multiple nodes cluster with flannel on Fedora --------------------------------------------------------- - -**Table of Contents** - -- [Introduction](#introduction) -- [Prerequisites](#prerequisites) -- [Master Setup](#master-setup) -- [Node Setup](#node-setup) -- [**Test the cluster and flannel configuration**](#test-the-cluster-and-flannel-configuration) - -## Introduction - -This document describes how to deploy kubernetes on multiple hosts to set up a multi-node cluster and networking with flannel. Follow fedora [getting started guide](fedora_manual_config.md) to setup 1 master (fed-master) and 2 or more nodes (minions). Make sure that all nodes (minions) have different names (fed-node1, fed-node2 and so on) and labels (fed-node1-label, fed-node2-label, and so on) to avoid any conflict. Also make sure that the kubernetes master host is running etcd, kube-controller-manager, kube-scheduler, and kube-apiserver services, and the nodes (minions) are running docker, kube-proxy and kubelet services. Now install flannel on kubernetes nodes (minions). flannel on each node configures an overlay network that docker uses. flannel runs on each node to setup a unique class-C container network. - -## Prerequisites -1. You need 2 or more machines with Fedora installed. - -## Master Setup - -**Perform following commands on the kubernetes master** - -* Configure flannel by creating a `flannel-config.json` in your current directory on fed-master. flannel provides udp and vxlan among other overlay networking backend options. In this guide, we choose kernel based vxlan backend. The contents of the json are: - -``` -{ - "Network": "18.16.0.0/16", - "SubnetLen": 24, - "Backend": { - "Type": "vxlan", - "VNI": 1 - } -} -``` -**NOTE:** Choose an IP range that is *NOT* part of the public IP address range. - -* Add the configuration to the etcd server on fed-master. - -``` -# etcdctl set /coreos.com/network/config < flannel-config.json -``` - -* Verify the key exists in the etcd server on fed-master. - -``` -# etcdctl get /coreos.com/network/config -``` - -## Node Setup - -**Perform following commands on all kubernetes nodes** - -* Edit the flannel configuration file /etc/sysconfig/flanneld as follows: - -``` -# Flanneld configuration options - -# etcd url location. Point this to the server where etcd runs -FLANNEL_ETCD="http://fed-master:4001" - -# etcd config key. This is the configuration key that flannel queries -# For address range assignment -FLANNEL_ETCD_KEY="/coreos.com/network" - -# Any additional options that you want to pass -FLANNEL_OPTIONS="" -``` - -**Note:** By default, flannel uses the interface for the default route. If you have multiple interfaces and would like to use an interface other than the default route one, you could add "-iface=" to FLANNEL_OPTIONS. For additional options, run `flanneld --help` on command line. - -* Enable the flannel service. - -``` -# systemctl enable flanneld -``` - -* If docker is not running, then starting flannel service is enough and skip the next step. - -``` -# systemctl start flanneld -``` - -* If docker is already running, then stop docker, delete docker bridge (docker0), start flanneld and restart docker as follows. Another alternative is to just reboot the system (`systemctl reboot`). - -``` -# systemctl stop docker -# ip link delete docker0 -# systemctl start flanneld -# systemctl start docker -``` - -*** - -##**Test the cluster and flannel configuration** - -* Now check the interfaces on the nodes. Notice there is now a flannel.1 interface, and the ip addresses of docker0 and flannel.1 interfaces are in the same network. You will notice that docker0 is assigned a subnet (18.16.29.0/24 as shown below) on each kubernetes node out of the IP range configured above. A working output should look like this: - -``` -# ip -4 a|grep inet - inet 127.0.0.1/8 scope host lo - inet 192.168.122.77/24 brd 192.168.122.255 scope global dynamic eth0 - inet 18.16.29.0/16 scope global flannel.1 - inet 18.16.29.1/24 scope global docker0 -``` - -* From any node in the cluster, check the cluster members by issuing a query to etcd server via curl (only partial output is shown using `grep -E "\{|\}|key|value"`). If you set up a 1 master and 3 nodes cluster, you should see one block for each node showing the subnets they have been assigned. You can associate those subnets to each node by the MAC address (VtepMAC) and IP address (Public IP) that is listed in the output. - -``` -# curl -s http://fed-master:4001/v2/keys/coreos.com/network/subnets | python -mjson.tool -{ - "node": { - "key": "/coreos.com/network/subnets", - { - "key": "/coreos.com/network/subnets/18.16.29.0-24", - "value": "{\"PublicIP\":\"192.168.122.77\",\"BackendType\":\"vxlan\",\"BackendData\":{\"VtepMAC\":\"46:f1:d0:18:d0:65\"}}" - }, - { - "key": "/coreos.com/network/subnets/18.16.83.0-24", - "value": "{\"PublicIP\":\"192.168.122.36\",\"BackendType\":\"vxlan\",\"BackendData\":{\"VtepMAC\":\"ca:38:78:fc:72:29\"}}" - }, - { - "key": "/coreos.com/network/subnets/18.16.90.0-24", - "value": "{\"PublicIP\":\"192.168.122.127\",\"BackendType\":\"vxlan\",\"BackendData\":{\"VtepMAC\":\"92:e2:80:ba:2d:4d\"}}" - } - } -} -``` - -* From all nodes, review the `/run/flannel/subnet.env` file. This file was generated automatically by flannel. - -``` -# cat /run/flannel/subnet.env -FLANNEL_SUBNET=18.16.29.1/24 -FLANNEL_MTU=1450 -FLANNEL_IPMASQ=false -``` - -* At this point, we have etcd running on the kubernetes master, and flannel / docker running on kubernetes nodes. Next steps are for testing cross-host container communication which will confirm that docker and flannel are configured properly. - -* Issue the following commands on any 2 nodes: - -``` -#docker run -it fedora:latest bash -bash-4.3# -``` - -* This will place you inside the container. Install iproute and iputils packages to install ip and ping utilities. Due to a [bug](https://bugzilla.redhat.com/show_bug.cgi?id=1142311), it is required to modify capabilities of ping binary to work around "Operation not permitted" error. - -``` -bash-4.3# yum -y install iproute iputils -bash-4.3# setcap cap_net_raw-ep /usr/bin/ping -``` - -* Now note the IP address on the first node: - -``` -bash-4.3# ip -4 a l eth0 | grep inet - inet 18.16.29.4/24 scope global eth0 -``` - -* And also note the IP address on the other node: - -``` -bash-4.3# ip a l eth0 | grep inet - inet 18.16.90.4/24 scope global eth0 -``` - -* Now ping from the first node to the other node: - -``` -bash-4.3# ping 18.16.90.4 -PING 18.16.90.4 (18.16.90.4) 56(84) bytes of data. -64 bytes from 18.16.90.4: icmp_seq=1 ttl=62 time=0.275 ms -64 bytes from 18.16.90.4: icmp_seq=2 ttl=62 time=0.372 ms -``` - -* Now kubernetes multi-node cluster is set up with overlay networking set up by flannel. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/fedora/flannel_multi_node_cluster.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/gce.md b/release-0.20.0/docs/getting-started-guides/gce.md deleted file mode 100644 index 87c881554b5..00000000000 --- a/release-0.20.0/docs/getting-started-guides/gce.md +++ /dev/null @@ -1,204 +0,0 @@ -Getting started on Google Compute Engine ----------------------------------------- - -**Table of Contents** - -- [Before you start](#before-you-start) -- [Prerequisites](#prerequisites) -- [Starting a cluster](#starting-a-cluster) -- [Installing the kubernetes command line tools on your workstation](#installing-the-kubernetes-command-line-tools-on-your-workstation) -- [Getting started with your cluster](#getting-started-with-your-cluster) - - [Inspect your cluster](#inspect-your-cluster) - - [Run some examples](#run-some-examples) -- [Tearing down the cluster](#tearing-down-the-cluster) -- [Customizing](#customizing) -- [Troubleshooting](#troubleshooting) - - [Project settings](#project-settings) - - [Cluster initialization hang](#cluster-initialization-hang) - - [SSH](#ssh) - - [Networking](#networking) - - -The example below creates a Kubernetes cluster with 4 worker node Virtual Machines and a master Virtual Machine (i.e. 5 VMs in your cluster). This cluster is set up and controlled from your workstation (or wherever you find convenient). - -### Before you start - -If you want a simplified getting started experience and GUI for managing clusters, please consider trying [Google Container Engine](https://cloud.google.com/container-engine/) for hosted cluster installation and management. - -If you want to use custom binaries or pure open source Kubernetes, please continue with the instructions below. - -### Prerequisites - -1. You need a Google Cloud Platform account with billing enabled. Visit the [Google Developers Console](http://cloud.google.com/console) for more details. -1. Install `gcloud` as necessary. `gcloud` can be installed as a part of the [Google Cloud SDK](https://cloud.google.com/sdk/). -1. Then, make sure you have the `gcloud preview` command line component installed. Run `gcloud preview` at the command line - if it asks to install any components, go ahead and install them. If it simply shows help text, you're good to go. This is required as the cluster setup script uses GCE [Instance Groups](https://cloud.google.com/compute/docs/instance-groups/), which are in the gcloud preview namespace. You will also need to **enable [`Compute Engine Instance Group Manager API`](https://developers.google.com/console/help/new/#activatingapis)** in the developers console. -1. Make sure that gcloud is set to use the Google Cloud Platform project you want. You can check the current project using `gcloud config list project` and change it via `gcloud config set project `. -1. Make sure you have credentials for GCloud by running ` gcloud auth login`. -1. Make sure you can start up a GCE VM from the command line. At least make sure you can do the [Create an instance](https://cloud.google.com/compute/docs/quickstart#create_an_instance) part of the GCE Quickstart. -1. Make sure you can ssh into the VM without interactive prompts. See the [Log in to the instance](https://cloud.google.com/compute/docs/quickstart#ssh) part of the GCE Quickstart. - -### Starting a cluster - -You can install a client and start a cluster with this command: - -```bash -curl -sS https://get.k8s.io | bash -``` - -Once this command completes, you will have a master VM and four worker VMs, running as a Kubernetes cluster. By default, some containers will already be running on your cluster. Containers like `kibana` and `elasticsearch` provide [logging](../logging.md), while `heapster` provides [monitoring](../../cluster/addons/cluster-monitoring/README.md) services. - -Alternately, if you prefer, you can download and install the latest Kubernetes release from [this page](https://github.com/GoogleCloudPlatform/kubernetes/releases), then run the `/cluster/kube-up.sh` script to start the cluster: - -```bash -cd kubernetes -cluster/kube-up.sh -``` - -If you run into trouble, please see the section on [troubleshooting](gce.md#troubleshooting), post to the -[google-containers group](https://groups.google.com/forum/#!forum/google-containers), or come ask questions on IRC at #google-containers on freenode. - -The next few steps will show you: - -1. how to set up the command line client on your workstation to manage the cluster -1. examples of how to use the cluster -1. how to delete the cluster -1. how to start clusters with non-default options (like larger clusters) - -### Installing the kubernetes command line tools on your workstation - -The cluster startup script will leave you with a running cluster and a ```kubernetes``` directory on your workstation. -The next step is to make sure the `kubectl` tool is in your path. - -The [kubectl](../kubectl.md) tool controls the Kubernetes cluster manager. It lets you inspect your cluster resources, create, delete, and update components, and much more. -You will use it to look at your new cluster and bring up example apps. - -Add the appropriate binary folder to your ```PATH``` to access kubectl: - -```bash -# OS X -export PATH=/platforms/darwin/amd64:$PATH - -# Linux -export PATH=/platforms/linux/amd64:$PATH -``` - -**Note**: gcloud also ships with ```kubectl```, which by default is added to your path. -However the gcloud bundled kubectl version may be older than the one downloaded by the -get.k8s.io install script. We recommend you use the downloaded binary to avoid -potential issues with client/server version skew. - -### Getting started with your cluster - -#### Inspect your cluster - -Once `kubectl` is in your path, you can use it to look at your cluster. E.g., running: - -```shell -$ kubectl get services -``` - -should show a set of [services](../services.md) that look something like this: - -```shell -NAME LABELS SELECTOR IP(S) PORT(S) -elasticsearch-logging k8s-app=elasticsearch-logging,kubernetes.io/cluster-service=true,kubernetes.io/name=Elasticsearch k8s-app=elasticsearch-logging 10.0.198.255 9200/TCP -kibana-logging k8s-app=kibana-logging,kubernetes.io/cluster-service=true,kubernetes.io/name=Kibana k8s-app=kibana-logging 10.0.56.44 5601/TCP -kube-dns k8s-app=kube-dns,kubernetes.io/cluster-service=true,kubernetes.io/name=KubeDNS k8s-app=kube-dns 10.0.0.10 53/UDP -kubernetes component=apiserver,provider=kubernetes 10.0.0.1 443/TCP -``` - -Similarly, you can take a look at the set of [pods](../pods.md) that were created during cluster startup. -You can do this via the - -```shell -$ kubectl get pods -``` -command. - -You'll see see a list of pods that looks something like this (the name specifics will be different): - -```shell -NAME READY REASON RESTARTS AGE -elasticsearch-logging-v1-ab87r 1/1 Running 0 1m -elasticsearch-logging-v1-v9lqa 1/1 Running 0 1m -fluentd-elasticsearch-kubernetes-minion-419y 1/1 Running 0 12s -fluentd-elasticsearch-kubernetes-minion-k0xh 1/1 Running 0 1m -fluentd-elasticsearch-kubernetes-minion-oa8l 1/1 Running 0 1m -fluentd-elasticsearch-kubernetes-minion-xuj5 1/1 Running 0 1m -kibana-logging-v1-cx2p8 1/1 Running 0 1m -kube-dns-v3-pa3w9 3/3 Running 0 1m -monitoring-heapster-v1-m1xkz 1/1 Running 0 1m -``` - -Some of the pods may take a few seconds to start up (during this time they'll show `Pending`), but check that they all show as `Running` after a short period. - -#### Run some examples - -Then, see [a simple nginx example](../../examples/simple-nginx.md) to try out your new cluster. - -For more complete applications, please look in the [examples directory](../../examples). The [guestbook example](../../examples/guestbook) is a good "getting started" walkthrough. - -### Tearing down the cluster -To remove/delete/teardown the cluster, use the `kube-down.sh` script. - -```bash -cd kubernetes -cluster/kube-down.sh -``` - -Likewise, the `kube-up.sh` in the same directory will bring it back up. You do not need to rerun the `curl` or `wget` command: everything needed to setup the Kubernetes cluster is now on your workstation. - -### Customizing - -The script above relies on Google Storage to stage the Kubernetes release. It -then will start (by default) a single master VM along with 4 worker VMs. You -can tweak some of these parameters by editing `kubernetes/cluster/gce/config-default.sh` -You can view a transcript of a successful cluster creation -[here](https://gist.github.com/satnam6502/fc689d1b46db9772adea). - -### Troubleshooting - -#### Project settings - -You need to have the Google Cloud Storage API, and the Google Cloud Storage -JSON API enabled. It is activated by default for new projects. Otherwise, it -can be done in the Google Cloud Console. See the [Google Cloud Storage JSON -API Overview](https://cloud.google.com/storage/docs/json_api/) for more -details. - -Also ensure that-- as listed in the [Prerequsites section](#prerequisites)-- you've enabled the `Compute Engine Instance Group Manager API`, and can start up a GCE VM from the command line as in the [GCE Quickstart](https://cloud.google.com/compute/docs/quickstart) instructions. - -#### Cluster initialization hang - -If the Kubernetes startup script hangs waiting for the API to be reachable, you can troubleshoot by SSHing into the master and minion VMs and looking at logs such as `/var/log/startupscript.log`. - -**Once you fix the issue, you should run `kube-down.sh` to cleanup** after the partial cluster creation, before running `kube-up.sh` to try again. - -#### SSH - -If you're having trouble SSHing into your instances, ensure the GCE firewall -isn't blocking port 22 to your VMs. By default, this should work but if you -have edited firewall rules or created a new non-default network, you'll need to -expose it: `gcloud compute firewall-rules create --network= ---description "SSH allowed from anywhere" --allow tcp:22 default-ssh` - -Additionally, your GCE SSH key must either have no passcode or you need to be -using `ssh-agent`. - -#### Networking - -The instances must be able to connect to each other using their private IP. The -script uses the "default" network which should have a firewall rule called -"default-allow-internal" which allows traffic on any port on the private IPs. -If this rule is missing from the default network or if you change the network -being used in `cluster/config-default.sh` create a new rule with the following -field values: - -* Source Ranges: `10.0.0.0/8` -* Allowed Protocols and Port: `tcp:1-65535;udp:1-65535;icmp` - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/gce.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/gce.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/juju.md b/release-0.20.0/docs/getting-started-guides/juju.md deleted file mode 100644 index 9f6dca5e18c..00000000000 --- a/release-0.20.0/docs/getting-started-guides/juju.md +++ /dev/null @@ -1,239 +0,0 @@ -Getting started with Juju -------------------------- - -Juju handles provisioning machines and deploying complex systems to a -wide number of clouds, supporting service orchestration once the bundle of -services has been deployed. - -**Table of Contents** - -- [Prerequisites](#prerequisites) - - [On Ubuntu](#on-ubuntu) - - [With Docker](#with-docker) -- [Launch Kubernetes cluster](#launch-kubernetes-cluster) -- [Exploring the cluster](#exploring-the-cluster) -- [Run some containers!](#run-some-containers) -- [Scale out cluster](#scale-out-cluster) -- [Launch the "k8petstore" example app](#launch-the-k8petstore-example-app) -- [Tear down cluster](#tear-down-cluster) -- [More Info](#more-info) - - [Cloud compatibility](#cloud-compatibility) - - -## Prerequisites - -> Note: If you're running kube-up, on ubuntu - all of the dependencies -> will be handled for you. You may safely skip to the section: -> [Launch Kubernetes Cluster](#launch-kubernetes-cluster) - -### On Ubuntu - -[Install the Juju client](https://juju.ubuntu.com/install) on your -local ubuntu system: - - sudo add-apt-repository ppa:juju/stable - sudo apt-get update - sudo apt-get install juju-core juju-quickstart - - -### With Docker - -If you are not using ubuntu or prefer the isolation of docker, you may -run the following: - - mkdir ~/.juju - sudo docker run -v ~/.juju:/home/ubuntu/.juju -ti whitmo/jujubox:latest - -At this point from either path you will have access to the `juju -quickstart` command. - -To set up the credentials for your chosen cloud run: - - juju quickstart --constraints="mem=3.75G" -i - -Follow the dialogue and choose `save` and `use`. Quickstart will now -bootstrap the juju root node and setup the juju web based user -interface. - - -## Launch Kubernetes cluster - -You will need to have the Kubernetes tools compiled before launching the cluster - - make all WHAT=cmd/kubectl - export KUBERNETES_PROVIDER=juju - cluster/kube-up.sh - -If this is your first time running the `kube-up.sh` script, it will install -the required predependencies to get started with Juju, additionally it will -launch a curses based configuration utility allowing you to select your cloud -provider and enter the proper access credentials. - -Next it will deploy the kubernetes master, etcd, 2 minions with flannel based -Software Defined Networking. - - -## Exploring the cluster - -Juju status provides information about each unit in the cluster: - - juju status --format=oneline - - docker/0: 52.4.92.78 (started) - - flannel-docker/0: 52.4.92.78 (started) - - kubernetes/0: 52.4.92.78 (started) - - docker/1: 52.6.104.142 (started) - - flannel-docker/1: 52.6.104.142 (started) - - kubernetes/1: 52.6.104.142 (started) - - etcd/0: 52.5.216.210 (started) 4001/tcp - - juju-gui/0: 52.5.205.174 (started) 80/tcp, 443/tcp - - kubernetes-master/0: 52.6.19.238 (started) 8080/tcp - -You can use `juju ssh` to access any of the units: - - juju ssh kubernetes-master/0 - - -## Run some containers! - -`kubectl` is available on the kubernetes master node. We'll ssh in to -launch some containers, but one could use kubectl locally setting -KUBERNETES_MASTER to point at the ip of `kubernetes-master/0`. - -No pods will be available before starting a container: - - kubectl get pods - POD CONTAINER(S) IMAGE(S) HOST LABELS STATUS - - kubectl get replicationcontrollers - CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS - -We'll follow the aws-coreos example. Create a pod manifest: `pod.json` - -``` -{ - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "name": "hello", - "labels": { - "name": "hello", - "environment": "testing" - } - }, - "spec": { - "containers": [{ - "name": "hello", - "image": "quay.io/kelseyhightower/hello", - "ports": [{ - "containerPort": 80, - "hostPort": 80 - }] - }] - } -} -``` - -Create the pod with kubectl: - - kubectl create -f pod.json - - -Get info on the pod: - - kubectl get pods - - -To test the hello app, we need to locate which minion is hosting -the container. Better tooling for using juju to introspect container -is in the works but we can use `juju run` and `juju status` to find -our hello app. - -Exit out of our ssh session and run: - - juju run --unit kubernetes/0 "docker ps -n=1" - ... - juju run --unit kubernetes/1 "docker ps -n=1" - CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES - 02beb61339d8 quay.io/kelseyhightower/hello:latest /hello About an hour ago Up About an hour k8s_hello.... - - -We see `kubernetes/1` has our container, we can open port 80: - - juju run --unit kubernetes/1 "open-port 80" - juju expose kubernetes - sudo apt-get install curl - curl $(juju status --format=oneline kubernetes/1 | cut -d' ' -f3) - -Finally delete the pod: - - juju ssh kubernetes-master/0 - kubectl delete pods hello - - -## Scale out cluster - -We can add minion units like so: - - juju add-unit docker # creates unit docker/2, kubernetes/2, docker-flannel/2 - -## Launch the "k8petstore" example app - -The [k8petstore example](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/k8petstore) is available as a -[juju action](https://jujucharms.com/docs/devel/actions). - - juju action do kubernetes-master/0 - -Note: this example includes curl statements to exercise the app, which automatically generates "petstore" transactions written to redis, and allows you to visualize the throughput in your browswer. - -## Tear down cluster - - ./kube-down.sh - -or - - juju destroy-environment --force `juju env` - -## More Info - -Kubernetes Bundle on Github - - - [Bundle Repository](https://github.com/whitmo/bundle-kubernetes) - * [Kubernetes master charm](https://github.com/whitmo/charm-kubernetes-master) - * [Kubernetes mininion charm](https://github.com/whitmo/charm-kubernetes) - - [Bundle Documentation](http://whitmo.github.io/bundle-kubernetes) - - [More about Juju](https://juju.ubuntu.com) - - -### Cloud compatibility - -Juju runs natively against a variety of cloud providers and can be -made to work against many more using a generic manual provider. - -Provider | v0.15.0 --------------- | ------- -AWS | TBD -HPCloud | TBD -OpenStack | TBD -Joyent | TBD -Azure | TBD -Digital Ocean | TBD -MAAS (bare metal) | TBD -GCE | TBD - - -Provider | v0.8.1 --------------- | ------- -AWS | [Pass](http://reports.vapour.ws/charm-test-details/charm-bundle-test-parent-136) -HPCloud | [Pass](http://reports.vapour.ws/charm-test-details/charm-bundle-test-parent-136) -OpenStack | [Pass](http://reports.vapour.ws/charm-test-details/charm-bundle-test-parent-136) -Joyent | [Pass](http://reports.vapour.ws/charm-test-details/charm-bundle-test-parent-136) -Azure | TBD -Digital Ocean | TBD -MAAS (bare metal) | TBD -GCE | TBD - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/juju.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/juju.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/k8s-docker.png b/release-0.20.0/docs/getting-started-guides/k8s-docker.png deleted file mode 100644 index 6795e35e83d5bf1350903e1a0a0a0028b99ad6ac..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 52545 zcmdqIby!qk*Eb5o07J>p4MTS+okK}Vh#(;yN(myJGc-u3bb}JoEsd0dptKT7OV`jX zXOH^4@AG~Co&U~tu4~}Z&7QsYecx-{>lbTB>uReK;nU({U|j;_V}(EHL&XT0cD4 zn6w%NST9-~p$m!#9J$S!HE5)(LN~ zLiBJh22EVG%ciHlQ~OkRvMYeFZT-RbL6_tC_nY8XEaFORI2iaU-^65sIH*=YN&0mk zX>Q+u2ab}tZ$}8woej=rrzPO}?*0K$MI^-8w6-+FN_ z`6LI!r|9vo7;v<@brH#An#0O^zx~C2o&LGCFmF=Ny~QXWt>L43!gwJnM3rlb3MRX; zOZt;nI~DXhJI3EvpPYY~o@Wfwzn1OyyENG6*dESNh|Mvccit`+Y^TIHVKd2OsOv~J zz^He@fv+r<>+HcW4zMxm=dunNBb?1&_bw4~61>>nc7BeT>m|y zaQD(sx`;|1$*N9q$4+IXsJKW|`O6o=TdBjg*Qd~%1!fn6bYZpuek7AxKYALYjubvPl*t)a7;iGvwALiTzB7KSLk%upW z6c7UOSrXAB?zmyi!7#!QYEY~cECDr;0~}ndAU6espzsu?SE!>K#st!D1gsq*=7#eK z{IHYAjeroL3dfJ=(iFm+Lpnf0P*93D3Z*Y83y9MdzeDLvAihcpx)S7AAC;nCLSMtr zM>yV5^Msb>E9uG}v3k(9K+Hlf@^D9BA~@HWfng+Rpm8grDUA1s>1t_uh-&xXg0c@q z7A{rik423pO1WE&-BgQoC=9-Ei|#}SydQ!!de;a-x38@D(ufU{gxTp8O97}vCFA9- z0=ninwO7x6Vc|sPTcuG`exg~9G>%=gHnjR~ts(R+%_hxIi)vNO9(o6P9#Uxit)|F` zvs~T_PmClpj=$H?GQrZcI<*FC%4%Dh{#IWn%@Vy^P!si|+fPL+!HvX|v8{-$9->8# zeV;a-Ir6;_;;!c?>j35s{9yWE#`y%MPaim6;+cS*LWr4DU~JB851_P=HOO@sNwsy*b|SfY1RK?THtzI#wRYdW^l0nO1SU(08n<{$9P*jNOb7gQ|GJ z<#^)8$0Mfo_9Hwyc01D*t`+(f+LgM2`#9Y~mS=bF(-g)g#L9Ez+q4=)e@5UX-9 zziH!6KIeJL6Ohc3Y@dvooKUJ|;QEdHTXv~Ssm_FuBZs4v zk(*yvk(<>m(SA)Aj>kQlvYUyt8MGa=G_(e^sUn|5X)>N>e9l1PX^1z*tq=e_dLlS znf`#czM1E|1hOxTUSw0wQd;os@agk!@i7^58)F-})NfW_^vv{TIGNc5_C+`@+tdve z&8{|7lQvYP)i>oy(@Egh2`eM`2 ze(W+Xr$1-SxO(w?w($`65Yf7AXDoxX0m@NFR3_jjdqy8JSw&7;j4#LjjvCw_Z;_%<)q}I z<>KVXI=ni{0tL^ku0hvc7qf?xsI`m9OC7KTxEyaCzW{s}Y=|pIa2t;l+Y{W=h1t~_ z!X!9m!S-l^5~O&g0s+Q0{*01^^ zj#87-`|fAek1F3(@2U8!q^fA98u1y|{kj`#5(_JmrDUR`@MrUKFF75X)r?%;Ucz7A z6}a;#rEYu1yVwOTIdU)t}Xm zE3#X~RP&nMk>zX`>=Ah@q|`Ft@NL(C>tRDT!`1N#<;q&3=%OFvEQE$)39bUg9uDV2boo-cxf3JM>qgmVAtgB`5 zxMM591?HkQjT*c=7-vT}|1@T9LN8CRy2J8G-QMaa#b!ml#diK7(_79Tohh7mX6@@L z9Dk&;n2#P?4=%+l>9GHNy)|zf`0#x8%SqTyd*MmprT2mt#QW#$M$4g5y0x+S^ho7` zS;fkigEt3_tq-?546RI`SrR)W*e2B9eplPBQRS%mt$4Fw6G@wpvD&`r-?)=K)AwWY z!@NuIIA$EyM_f5Za{9L5{!?A23I&&sRzDZZdxp2(Y_@!O9BdJ+yrZ`NYFIT~wXm-{ z!SkE+#H9E;@g%YCxYwU*mY?;xUN0Og`ID7x=-zqTd z;JnT~c|T$jW0L><=lAIM1!4~VTK@AJi1BQOAqIZ=%$tCt*pu{(x`D@@)YvN9!e zy@L)EKZWnVh^C5^dgvk7QvYi#yRy1+ZV;JTWxn6+Uh<>;^2#8!>~W=}nRH-wVEazQ zb=-Hx)|?cJ?I4GZhCP?|4Y#`Ml;w)}4(!0S3$shXxs#T_mH3-%I;TyCulak;~ z@_Cg`5B6}$Fz?;^yPK*Ns>8A8v9o?PM;}pxv8m(B;UBnvzdubLEz1q^zHEPN{ka$A zG`f{8uQB(oL-OMLiOZVp`mb?shrOcWn7OhJ`4i-I{-w=P->Z#noim-}+&Fpf0KBUM z9}XA$)%nw~!^_)J#z6q4#B)604$HV??f^SIb4o8xteQXkEiasX|hI79A0z63N09!eXnW zq^@_L6%w=m_|uoYHo4{J*^d>0!T<+-_t0F5V zDeV6zA62N^`S?KoUf}G#N0qd{e_5HJhZe;Jl9Vi_x;hH?B>Bc676Dd6pg-2Jh+!5m zsF%Hx*gBTDRTIPp4F|ik6-$S!9sM+tgT2V{|D5v@{)IHE3)gmEZr<4k?yg+Q&Z+h- z37lIe%#8OE15X(r`TXJS6=%Pqk+*c*-UX-~H+k5d-}0mATXZ&qA6WQ|X@C@5uF)!2Dq2UZ`ShZYjCEKKUy_86!K=^7SB)YHXAH7Y-oYkZ{O?zx;h{$VJ`OgOrPTkL{~vcuSuQ8yv*800AkGFdKh5T@8Nf zw*bL-VjF2;FHuzC%=Kry@C7goo@Fg>aS0cg?f24nKCO)&G3o_eS6MBSX6XF&Wc|#r zyLqPPk8^Dh`hvPb$g;-lwd37Zw%f(A6k3_wf7VADnHL3J3;g=RR_5SV%tK&NfWuk$ z7WxRXH;y}ehof%{vaegazb9hgfpgIpM`eDc{m=A?LAK=+Dd-sN1ksBb15CZv>{GA5 zEB5C?z=_>Duy>kAew%Z>!Tikk$|5Tr`6zw{c}2*4DbV~eF1zUaCpFa3lsmbybG6dcFK6~hC&I}~mEl?%Bx~N~sLyXneKqm5Q zld>?AF$+F~#QC@8wVu4ai$~6kt+3?z=ZQ%`>`Tv27vH61!3^|CtqUf%Iq+V>MMxyP z+4YmeKdzK676gTBh1FMl74+u3wyv%~KLb<~SpS*tpR?c7X(8A0c`6x@)o~cO%9JntU!sMm{wGUN zJY343`OTwKEj+mNqDa${(PxC{AXwPWVvUu;phgXj$!wgQnp@v1SPN8~asK3x@)bH1YT^ExDNfb)z2dN=c_kE=xWMJddmetA(NW8F z?_%w2a9~~C&X2~j-%IUW6~Q;ZZwFo+z2SRp_X-2Aml~-?1zY{Gf7n3$YmDfVN=7;= z4Xg%phvMkn3EVF^5)~Wu~00tl2Tup2(kNB?mop#SIotezWT|&;Cl%uKeBQ=L2BKS*oz| z@fxpdme0PuF-;%)5|~ooswQY$UmUw=nz#AX^nU!P?&al{Yrix9!NRc0oS%$SJIQ@z zVETRGJDs6Sah(>=t<{=66*H#6KU2{SJ=^bI5ahK;JMkUxKQxb*N&R);k-mmreHb6O zn@6#GY#CBouMmpk{;Qt^N!6_#mL(Tx;tTeWYAwo@c%~?KxqZj8#HuIa{@c4mt+wv# zBg~S|S7Uqo`ZSk6#T5eg=3!_fdZ+5oaEnQf57ksqRJ6*C>)=*l`}s9b@W&X6*-6*g z7WOB&1HH#)tzMrs1>4!;Xhq$NYZwa(3i`j5JzS}1oV!mrB49!2BJH+-u(h-M%v;rF zJxH{YckfBxY^!&n*UrrSVr_G+arzT)Y3^SfOU}RHv`b#@z%){_&!FWW8oELq*f!9NBNoIOjryOSr_0d`^>< z2D$rKIqB(l9uJ@vd%j6RUZ(JyYLppPfEkl7PxlCB7Vm{Us4y{T@!qSvkoDYru!4N{ z(DFIrB$i(CJ|(|N(i+c_=0cZ3XR}y+e&FSa``QpgpoZVk`l6f|6Q6Od^4(Z!=JfRR z-SPexznA7l{yPa{a^OZPYNOtL#_UTD*Lez|V60&9yVH&FzFAC}WQ%6^!cKw^&fkVT zd9X(IO!DR*%Mc`S=-dxrhd%z|L;JI~Y2wW5NjLw8=1kUc zarxJm30YKSOT79;KzK))19jV~tr5x$g{};yQuPLn{6i*Af`rN#DJhbklQ*@5Hxf^477o#V8ZRKVoW zt1mdWT<%GGuE$_}K)AbW3!ZHd%%wW>TT78Ms}N4iF9|{Sel%7cXl2Rx-uLCy#lh(s zmOag)Rb$QRainhR5rV7A>EO7knwVs0<;WOE(?bX$uYgSRA6SyBO6_+UD~P7uZWW}) zP1Ck>Nu3V0*52Bo)_)J<5c-O*h{Z@*#%zv-JcpVYhW6pI*#3C$q7l}ah&2vU4ipM9 z3f<}22J%S5QXw{-h>-?`gkZ`48K@5n2Il>eZPw}Y=3?@E$s5Jp=WIU)e!tFP4_>qm zeeVnaus6{NUe)_?zZWPF&9>|Q7Mfh)5EV6y#*%k+me6>lNX}eOBBD#M4U~qD{mOlR z>0^Ka3!F|r5ucPSinuF@UCXMQfRRuuHRLgtVs~bjDM;xu!~rE?Y4W{5J@FtKcj84y z_jXa?2KS>VGvuPIu&~}h3V)fL{{`kgPUsp$PGKP&;;{c4|t2D<m4ZT)-2#iueZI+ZNTDk2{{q-Nk74rOi6eXryTPvf-nJF0N?2th~y?)h3ND zunTd205jAzI>arGg$<&M#qHjSz;x7C>=l8*81{)TxIZ+=^!jGW`Ws?9vEJ%Vv_e#- z4uy|&S<(si%3301Z9WmQ>&mQ53X?-6zO(zwuHYTX3`D{Z4;8Dv6b_CtLXUpXLlU+i zEs^=bLO$LLDj}!Jx%yOm@<*Z*6x$ufrK_sw^7i)=*U#Nz%7^VgND71%S!ybNk+T^B{N`` zKKz^*a@0Yc!W~h(y3iHs`N2!{u# z2-s7sGCKtfpW9mbe&;Kx$&(nG=iN3TuxErhRwh}Uyoil^)Uh_xGh!|??+ODJ9gyka zw+6zfK>Mr^%D$lu>h0ld>4zT^CMrxHHW1fPLO_x4x@wy{wASt?pQEtsY)aD__AEm; zY}R|6s@jWYh!ny$oTfOjcSiR4QG^@qO0ez`ITYNajG3B|k+ZE6q_B>9pC|CE$3tT4 zNX&`m>d(@n7aYCj^2iZB`=|9=Z{O~&^jx{xk*~rLO+jy}S|b$%hir_^8J3Yw)Nadd zx88s1r1p2WtW#_s#%TjZ?RSm`K8K6q%+x&|HuSf%e6GN!`NDmHMo7n{TZG?7OIIK) zQVd+k%0DAz)eUA>6MENIFAU+Jo^gDdJG8YiTe&C2uM7?&8%vWFe6q##8->f>1nrFP z$Qz#8QfgF6MP6$|>xuOuoQ&`Yc*Br!>5^?s0GxTaMA(gW)kQYPRZxsEs{D_B{27ai zX6K62vrjEOWO0QbI2tNUOFI{&b)@r$*Y)miKIC3?N>)%`D{*-jJKhr#k`?|M-V0Te ze#Pw2cZaQyJ(2Q=S6(vEGq4!ni-hHE_P_;O&s%K7{+{B1F`M&(_uOuY_ex5!gOCUG4SkX`7;0ERT0c9 z!I%e_A!55y$%Vfy7^QEF#MAfC%b@!UtVl`r#l&pJ0GAVqGYRw2~KRq_3n; z<4VpU-Z&gEx=gkVR)^W+p)%R+U1g>J@-L_c00`H@YFk)J%JyFOXWcer%eFy3n-x2p zgw*h=JnPRRzziW*K2{N|t$v3&hrNlc3U#AwP#b`zT5m_xwW1#c9TLQ7Omw9_RR8CH zWSB9~Tp?kSKg{rdm@Hh61mbJyrze`V@{b_{q$27LB6(%* zp@%c736KE4J%0bYe+Kt=h;R^zI&hf9m4NR5BpJZj$c<5d*XcWdHz8covvnhTHIvyI zb49gHD|YmZSgImedgJkj0i^%unbII%=6`dsiRy=if$#7F3=IWGjMvB@79IX~FGD{Y zasiqL!MpV^MdN>;L|A3v;&@B$^z?g$sa&yL_c|M}T-m3|?EroJJ01uE?&sICJzb}2 z?eH=HK+j!eLhql>N;!<=A%|7aco4V%r?IiI+?rMQIt%c1v(vbv{1ximKiXBEnvLmggL zhoVL!>WkAo!Pyqi!)6*$$BCEN1eE<*lFyUYKCi`UQHz3`qzos1YIueHjb>WN_JzuQ z5s#idIT7b6-IXr=phL@(u29@vg-rmS7Cs)%*{xj^mhjw65^?&jwY2>9v0B}eQI>DR zcjIWAFKJ6~p;1l500lZ~jcyu7ikp#c`{;WLx%$ATXFQN z3YY4MOYx3^bb#1~PGu(Ky|=Fmdba(4+u!|vnanvPGvfr?*Q*jA)*uGLWUf2b8|aZ|Ex5V&eqBhcNMri z+0hrq^T{91q0&!y!;-!wg7*=f&miFJ_d2<9Ai+58R;NjU=I3ki z9@|rTg~B)R@>??n(+jjS_0}Kpxy@SYr5z$~F+8AyPQ_p9ykGz+?1z<88x1@IU$zZp z+c0>KPg$aK2Neq6AY~CqWui$F`2{|L9RWmbw`K7fQT+D#+R$c}qyU&#N+ECEL6cfb zi4TrIvkzZRw^*bsPUmV{3!r)uGRZxHl2?W&bVPXjfOI)v=g@AsIavl){Dz~Hh;cakmz2i5Y1aI7~wRJ3I+M@Rr zX03+4++UWkT|#|AjJid5qp*@B9VfWhVG%@ht54+y5E~^P7oeG+4NebB9yQlm$6xg~ zK3l%a?(8Ae_I6hA!&R+g)lx0Py;^97f3-v!w_Z$ zW%%dU?B5;}rY*XpNqLq^6SZ-0HJUUyI&Kb6*F82cxdyl&Ln-0)^wlj)P(ri;0c6aE|1(1z6y&qiOw<{F!YzEBaVQSrY*Layd9S3?zm+agpV`0q7mC zAkk*`k)Re+Xk@=L>Pu(c(QfM={y-$Nd~aO#yO2hR;@2To8-dimQ56_h4m1v;_{&>f z=XGu2qx&p!wdV6dLxo|a*ijv(0i5W~d@(Eip!nB$YGH{&eU2u2TP^Ec$sSMsbg3xE>s|7@i z)LM5G)9tMQ-rOb$C0g~lHDRS)Jh*=nFM}Gflp>em^1{J^8UTBlI{m`hUANDfaFK7YWMje0KMo9olV-Vk`Tu?p;9pU+1VJK)IxZ_kYYg?#|#ewrS+m4Unk>^OhY&V?Y4M-77=c6!n z1g;Ws1oPdZdznSn3P%V7okhje{eq5w^Mm(T%YXpD!;=FlsOX0Z1s<;6YrxDMDjR>) z=A*~ZJ&s7tp5F1cP96Fo$=64KgW^h)<&{dP?BRQPBpMZ}k<8P){76Jl>(zlhl+p-- zVNRygt$wFhw)T#Xxf?ObO^x5Nqi6#m2&Y?ZUb8hohRPHiBA{qZ!0G>Yn*(+_U1|`N zBFzNsij^~$X~PA*L@v1YMt3S9I~`@i2|TSwwjCC>9Xhv5Dp0nt2+%XKs2aps4J~MB zvAyPw%Vm_XqN>lK*g0<0jTu*);~N1co&4248Pid{A~`t=}3E6-@QPo zGr_Da1n;w)lIj1XAEX5|cld3IFf+WcY)mRQTdToj$@$sy13^&=i$AItG85~?1ihCv zwo-u%grgK;l7@wf(DrE$i*o%hFL4Nk?6h!qoQNSZ3>Q<6QsnNYL%r8+6#Rqp=%ZB1 z(%S{n?nh9~gr3p%j#+A?op&hcc6$Vuuk1hfAkBkB4_ywJ{{=7-Nu5=foKp2GD&x+C z88u53OL$Nw>-cjx5tJECIS-;NxlQY=KH!5T1RpgC4P($Mf@(<8X6(d0KR=3)1H!oF zpwv=I4=CCOSGZymN^Mvv;0RS5e_P9F(?f&_0ceX{!0ah(57ljHLU~~?c7(04#}t4< zZdUn1iL0;(wJf2!X>;M7?hqaqOB+fTs5gW|RpwS$=JYsL4I`AhYco*r1bvhYs zi@@XL87yq`Ti{fs2YI?z&vL7`WXHy> zU%;J%$3K2=w|D(VMmtHs^`}_o#AOQP3mfuZ+SHllY~13y% z>`^ZXEVz!2&Jeq!VHG{^oy zlIPj|l&T#JD%5^qyA=OL;m62kegKR-nBzR0;63!5<$zGPlUJQfg3)JMe-6CTb7E|gkGxpuw_x-qhvh%j)cYQ(a3|*%t|=n# z>pLvZaDBwt_^l{Biyvj`5+RR-{>mo|JzND<0 zXSvgwe*ioZ!r`{GWV8Q^J9@#s&Ven@uwD@%R}^D4lOd|zN5<0o7DjBo>O-ot;VX9m z@F3-RS-XV)ReNE!VCX5P9LV;U@ieYq3=HH&{{uX7Fo{?tScExE=yY5@23(SJ4ffB1ezTO$gX8apz^kvj6_Q z{tw`=z8a=6SuY1vTo?}?s!W8(l~?*NNrUo%J}_mnY2vbJ(6_U6DSmMWLf;wz+=TF_ zt=Hcb$$Nqquoo^dZRMkKA;NE7k6riIFd+emr?C6m>3e^9(ZAnOXg>PNopb8e|9SZT z?b%k-!q?-6#4DRSeZnDWvw(}t#fPNI<>#m}6c%&H`^OZ4ihzxL`2q@gne4x-j4k5@ zD1xwhFqg98U}nRA*km;%>`~YgVzq`};F65j(DI-fz->lyF}v+*6lL8TE;tp@*yU_h z_(w}%PU(#qoIz_6MNXV|}EO@~7ho1s06~T%pBsBY~F)j{m4FB(E z4X6aqcH3>xZu$SLuv+IUKoFq!{W10A-?^PNVeafR=SfIUcw*3G+yH2!|g zIyNK@0j{nrh8gp+zeC=c;V(r_f^xYydoH_A`2>vzyJ4ntogdqX ztHGAg5&M(hD)jHo-z0YqJyXB`h4}_ZYF%z_voWhuZj<0=Q-Y*XilAHPJh6%gfP?>s zbZe2GT~DzYOTqM(SUdve7yLikP71y*=x$`GM+%>t_Gl-|C=qO5n4wn^OpN^Jy-9Lh_>jobLALT zQ>y*`YeJE_WKm~nF9G5Im(BfJTXhFO2ag53566jjulA&L$hGnu#*5s~4_0LGcn!LER)f9AQ*Pq~Hv*QX)a_?Wy)xd8Uo%8Exi7lI3G9ZlBz-F>j&aNSI&%+% zt0P}_Bjm>jmxcyBfoeYnuzQCe?cJ63RRP50XnR`USEqb~QN{-by#p|^`>C{|js;_zC2FYmj{rNAAI71R z!^cIeA63u%-U=9^`{}Nk=hsJ6V@~@ukB1qP3jvcx;{h|%Ogy(8^nO$vA}vG+k$+DO zD*-&@x%<=jo`ODA9Mco3naBf}#|ZI6_=ZE8cH!XYMquFH_liu%!6a^da0vKXn6BxK z;JV-@=*6#Jw$DjDW4+!6u0PxuD=Y-unXyW<)_{#KoFl|OvASXxd4u1sdji7?i;D1P zO0Y>U;sSul(qHQY&E2jp{GT)jB2*%+6J6(S`R|zw?ZwXza>p`%kY6F^HRS6{i%G5; z0D%13!VCfv>*wU{J9nPPZkTMg2_wD=FWq&I#dOnFR8$-qNamg0a6^5hviL)US-AIwU*OTGDi6^Z-7`v_ zIA;6@zmK;j%beE9Hp?tNbolk{pC7J$YiOJgGR;;px9QB*uY4qV>^oMVz9|*7{`+l0 z%d8Z`0nHqhw@E8jJ&~YvtNTg}&v@FKm5u;l5wZZIvSmv#xCTJ{&EKV?ZB9-I(<5p2`j7q$>gloPxBS>D{I zHlA}95T;%NI@93U{_^ZiJW3>BXQtsc+NZ>JobL#-lC}^;V28>(mt?TD7gXL(Fe2z zs&tlUqHEXn)=ErC;$0J^%#JwDR!H$RDk?9q-<5F8zyewUs4{CU z8l%SY{@D2_LB0Y<$EgI?a}|fDVKQ zr4Q8Yhq5+uN<$S60Ii8#TKb3Vli3ERR8m49yA1UGJ$?grGgl3ULWszm7H+Q%eyW(3 zjtS67K*|i&?x0pC>Wvhu_Xf7K+b%OA-b_NWgqY{+p`PldJ!A!G>sQpBlYol>=#`~7 z%NK1Q_R==NR^ah+3;&%48U3u0T|lRaS!CC9xoe^|+5Pw@LHYYaq8d)Sfg}>(`#R0@ z%xcZW<4WRtU`h~(`#})NX;=f4d?{5-? zP7+~eK%*Nt^tdXk>Ua%EiE4mo^=;g>c;@p>b4YWw`tV`h(cy4_^ ze+n8>=!Fp}M{_D=qkSYexYGtv|H*?{6#CvzS|%BJ_c$Q8zuh=&yVWs192 zwo$Kw{ZDrdn3yA84mqPFx_GU{qKN-Eo&P8#{1+K|^^RaR@xhE4P)r}%Tdp|q$M}X) zX_7kD%UEq(X+zlK=7e>)ie^GV>(A3lSH8l?g}ymiyn93dU}sFr*|ojrbZSieiNuHLUH(l*cqN@VZCSoRz5Zn3_{B^x1WK(;d63c0 zd683TRHKM`^WS@$GA^d7R$r}B9Oq(MM)(;np?Sku=LEBKC~CwUOSb7f8SQVvH;Y!& zZN7B@hhN1VFUYJ}g(@IA$5^7ht(F(my+jug5`=A^;u*G{zw)C^-mMy@$z=

    W5r- z`Rmo6RcBg9v@9UUJU1>aQ@>X-q%DOTG%c_z@Wnrs9&=<4EwPhuJ+0+U{6Bh&STYed zDv)YLWuV2Sq>D#}Axg5-z1c7nqYJ_K1~bAzUr2UVHPGiksV`(*WYuZaMvGYSr5Ird zWc)R%o)L2;jiaDlU{$7re(NMN74xp#jsvQYP+yo&qKK%87hr5i>A?QV%l8LZYozdSJL^`E6oXd7W<$ z<>vq;z2wTWNQJJAPJ+0KcwiEzicCgiT@ci5HTAI9h~r_lxWCfEPUnDuVSEc;wQ?p& zLa4!j<)_!J_bW_9DQ;{iSr%eXtQv&=J17x{5D69zFfUI!ZaxZO*`f>N*a7$sD<#$v z2CuT!3Y$!_YNv=7Ums~riO!M+%%qx!!V9}k5(xn)cNl*> zponcMW(rC4eTt5mkwOGU@UL(MAxjN%Fc_TUyJ7Pv5`j?b z;y?l=-C%rvh(efu%zK*|+CTjz|KKuU=(CuIS^6b@6O#B?s)I62`v~gAK8fsnP{MEe zo~sIs(?xx>JnP&~T!rVwJ2{>jdk>V{sN5&Ie&qMrg0Q>68`D835W;I@rAtT*83^OV zMjqJrz-jdxVWb{Gz~bMDq9p8G{Mxl?sFvVmCUeXY1wrG3;V$FP9Ck7Gwxe@yr;{ZWf3XEJirATzeRWjC={Qn47*FzX?cMi7t6cHUHn-fF%?$IB9Q5 zrSdRd%h9wk37{PVlg{U3h1vZt>z8TnPq`mZ(A#jrz}4h})?5q8`LE#hq+A1ggl2~S zq4o8*UlayWoCGKS&W0QX-?uvK8*8^lw-~Y{B7QRx9N&Cu>hJ9`{O|n+*bS9=0YdSl zy>6T8zcLCq%!Q0fz>C&>YUN64Ehj`V*mB2ritZE6-~AJ;yzq~dVXoM5pfy`I)KcBY zU*CAx>48RjsOsGNpV_lC1WO~CefDS)fC$F`_YcT=^F2QQ!zKe*7nGS5NtS-J+wuH| z3(;ckV3z#trVKG8CIE1H6eDP@(sp3_NUP6Jms|18n)fT&zy6z>1SaHVcR73mwOe-% zl%*i(A8K~hPpYR*lg6mm7#jBaFM*(1B2CmNEIHbb^uE#5e2lcaFHzKanzNtL7#!|#?zzS&HnMq zvojx2pPljIgo$$FJHw(usJPBjgECvdbn+!l<$b6*WjJo@O3{;lS0*{*VniL72Nc$cX5YkKN0ypOXSkG87T7K761H~VOk=G7? z`D^FHL3#?7r@OPh7f8(Kp*Tdgy-_4+CL%K#a}ml|E$@SZ<-K9`h08x4qF29n&+`;$ zDKr}cSm7T&CLi>O=V9e`$0sZx<~sq74gM6@tOj$$t3Mm|FLj;wXVy-+r4~CARBOWq zjROl2l?7d2xT6*ny2h_+?FL&~@oK6AFTIeuUF2^8U)rBu%c3K|xG+5REnu5!jI5Wa zNqAozIUpfO2DtzuhD_X@cXXc2W+v0Z1?#X^FK+(Qw_bRN{>T$;F-L13# zTA=s#ZfRwCIUf>+;DqcrOjYM!W@uPmA)2~GtKmTf_q4SQ$1_Lv;DkHDfNw!j2O#D_ zz)n0Mx7ig0<4?WOmX`KAdPgte1|Ok1qOqg01^5WrPqJ!&2A4`pQg>~Idnbka3G?gF zUECUKdJj-dgHLI~Hb-_HiEtx4nd^H*PIrtX(H#SL@F!^JxPvFS;V}R5r$xsQrOw9B zXdkpJ@C*zz-wNR2;i3Bqy?>nS%~uu4nKiqsEG;duNlTly+rVR}!F5(I(S4cTv<3In z)n7F@O=7s+$>p?8aI;nYgY3&ZIp7yzQMTn2cFBxK_;(84(e7`eLOInPu~+zMl$V=Rep<67J3R@|sV1Xq{nFC~*G z{9i8f9qm$)o!$Wv5{O0ac1oB}Bv&VbHq_!*-|M-I9oKQGCc=5QiW>>IH5Bdl-^Mp>;ubz|+>I2oKp`nS9wf4s$W-L!!@l}-t zX869$_}JLbB@iLB7=#%q7s4#VVi}j`RfkOOi1$}#MXI6g2X60>9T*Zu_C#LVJ0rO{ zBV3wMqcxqzw>SD+DxNqvy;bD>v5Y*hQHAAVToyU7NbLvja^C9^y|IyTctj zJAC%78>ukHUoT7}B9~{q=RJ$FMI2ry30jz&jq9fhQQ-65T~xmTT0&+Wc5VsTK|;+5 zzaQ5#Yw2Xj2Y1lYXJU2i9Be&@0_hfae+4Fwvjd0?sdj@Y!22QG4=+mOa8~SoW>{5v_Xq(P^O^) zV{stqeDJPL)ViL=tJArMYJ10PlBR0fUNhaX8y!+DT~somNDX%Bl=biSr!w~EBkLp! za)}z9YJOhKXV&sSR(Mho-D=_3=}7dT58ec5VH&UnZaF!N77z6Wv(B1nA;d>=uB5%M zLKs!|3u6KR0YszP1JHno287R!A7cpNC3U(v{N>lG=w@AU+rDwEA#o& zNFyYopU$?VC*lSWzBdvbY+<`C!)o-MYP=lA0u{$1#vd{!I(1t8lKymIBq3WRtnY z@fT0~-e>$=JDYycn)`e{2hnw#6^}dwkyBdmq7%*#`cSK+JC82ZhH#=m6<$2P=jT?6 zdnn;bfg!~ohB(1kf9|#Cvl+jk;mpYcr#@Um2Ec*dy2}lM%Vz4EZG>vHYyhk)|YB|Q4sRG2p^~Jp7PG{xJGwhv@kCOVvzQFK$E~A zT{O4v@pIhLEVpk0#z0*$jBVKZjuYkMM?6euttBK%(276{02M>zYRze-VL-FQBb#Gh z!r#NW^0}^6t{Cc zl;~%*hCFe_#`z$`HymRG>2)$9!tx{Z*%x8La-#pSGmlgdDss%{bB)+gfHJBPC*T_n zDQ@G1jFRxy+JB{Wot8CM${fMn4i3rNgKNFG%@4cc$3o6SeENczP5NOA=7OP4{KPJw z$i>{=0Y+$xbGBS~A_|2_r&O1S+^~+aQsBGQ#60!r1+A8^k_?2pxTt8Rqka4%(iM(gTX;2Zf(M{;tOrZu~*~oKzuV|KT;YcDF!JCbzZ}%A@C=BM%D1>XuzZ^ zqqH0$94|92A^t=x^G&t$j*iok(4bmW zhRJ?B)QdmXjmR?tcW(9QyG{16RFrsMZ`xtrJwI&TtUe4z&DHMm8sSY_OnK-Rw4h2M zC5CN$G}Z>u6{nlQ)`_zxeigYASTh+lU4}V)%i3)YFhd)w6(n0eFi3gm^5!h&q;0`X zh4{bnY>qrG?=HlC(R@#a1F6Q^nf6kxmDQOTi1SX@1Y1fL@jBprABi{&L!Ge*Bxg=3 zD+aB;FRGV5LO~p-1$Ec*8ynvieoY9bu;Huj0fU)pK7pKt59h0yju>&pXHZ_FyOf%v z*1F~Q{K=uk$lD}0$gQby5b}Fke7Fb{?DHm}I&R9C`Y0Ita_&l#| zBvLMK$7hUK;Z3{r%;np0)_BkkLJiTRm?zUl9c3_D=Cx7pwKrv<)aQ`LgaTQqTlG4o z+1OWW?E;$T1HxNVJ(^g|h&W7=>Zfy|*kztp_!LEj4zBno^vyo|Z+Ipv863$bNirkfw~B|}uxS6)a0myU3WIjM~X z2lZ~=Iqd-aD*U%&LVQQOUk!-zfi2`{U7DsnHV8z9B z?1YR|eut$$17oWxCKy}FS+9jDc0xU^4i%rbbIlLjZ_M6fgFXcbSkMW1d~ArWq)(rC z|CHOoloPc<^|uEl0(@WF>fmB#_>BfG6>mg3dmQhGCUz7IChmefT`K&EEkk$*dl5a67+ zp`#%qEtuDq`PRju96n9Xt#;3*Mo%lxY}UtkM7*YxvHSUA8HR!twy)G}##KlPis2>` zx7P2&&0HFY?hE)I?*Y)g3askpc4^D1|6}Mj_N2gS#+X{?2G|^U5&AKKbnHFcud81N zttgo!PEx)Gbz^B}E`SUquo8L#vZPF~JulHHe zteOinh0Q1kNIh^{GDsOGTfWgV-;zf}=PQ*K{dd?0HD)#BU;52Eu&ihnlXHuLV**d6 zAM?B<(4^di3u~n-Zbz82KzS`;7+=~BuxUdKxB>I%t>HlD0J+qM=2u)>ok%Q4<2Im6 zEkkfW4XmiKpkra@Up~A&EkqFe%H_pimdK^U1GVBqgDb-)Ii|MMWph7oTbFhSgG_V3 z#w7Cgh-(~MTV1yt^e6p4WPJr#lW*8Bi~$1#Mk6SU7C}syFpyQ7Z)Pi*xv1ZpXa`Rb)zgS^pR+gX&dl{#;GDUkVD2k z?{Z#Ri_0x(*u^mVyKZ<{|q*+4d|)C5^|{63)&LURBvk181KIV>)r; zqE6^7(r;_P*#0Q^eyBAgkXENcv?vLK$*HWKn2lU{ z$b?yV4hw+|oJBDLtwFEn>%v?@K!1EYaf$#1^1&9e>ZPHENAy2JwJ94q@BeAbnE9;# zD7_<6V`;Z~sZW5IaV2pj$qD!N`bLyWr{cFBo$rN7MhVYXB$C7Q2p9K0?yq60n~^ip z_mOM*WUQka3DAmm0ZuN-I^ca1@iW~_>aP%0c(%Hi*2L5hBYw%mu1s|fPrbt`rm<$wnfMs_l({N%w=_T-4LxPu zt-d2>ge>+&%3q|Q$qBL>zwl~Nxj6mv+j#SfzN`Ji$rMgc(RbW;UzRLcOO+okV(+<} z(o)Ou@9P$weg!S*P;rSag+Yl!w0qT|*Cg=GJ$wzDOE)@xx(;X3)k(hxiIbkK?K>C$HEbpw znbgzKa5%qx?7EmHtMMZu%)axncwFwCiltX!>w<3_?D?M_@0d0-#871B*6uG(tq7Q# zb6Z-zpq}7m!L`uboaFr=G{gG(mG`&IY1oZBuSeUo_;+)w@6Odd_1hNtP@VaaUeTE4 zTTsrOT?pf@87GUB^$$uzS6vhvW zXl<3PDvJ?+d>s8o!E`kJn|(M%Gv6Hp=Zi_#z6f#zC@*24>WgS%^Hqy+3dDc!xP`V9|fW=^_`lOLRQ}1@lS9 z!NZYS)yOv+%8D{N>;eZba<5wU+pR)MNX;s~_FOyNE4glVXGOamKP{fWXDU%phx;_Y zt2ejzxb_uf$d{JXbd9VCP&ZpVz1Vts(>minzvdNj!^&SxkCCp#5zr7(;Rr@ZzS$;E zAfXVe6{y6PJzi~loav>0b&|K@lWFuVdBl!%U`(_jf5e*ocUi=`KR&TFKHK z^A%GEy=q5Ack`9y&6RnJ*JaJCjiTbrB|h#7#z$v<9iwfh(Q(x;%l4hGx5%9C3~PB> z)KzA&y05I`Svnfl%~r+Us{iG6@Y&_T@q=)K(w#&&j-e;I>f;O4ZXd1N!0x+B?-L|3n6-?|b*(_igF*KkXwdJo&MC zjtmtweD!Sd3-*~?!*OS0Z++-VTyRiTxQPD;VfRHQ^R-01m!hDnYM>H$kc+&Q#8Kg= zp?KW{sn%>5yDAw0mkG$Fd}2Ia%Ek_jDr4K|(w*YI)HRrteNw|*#C0)P&SgRwr@lK!015#LN6VBi7uB2{HNiqX>ai-q88dtlcK+j6V?N{upXsr%PLDO+Ee&JyF zuGZ(&?s;w;QnJ9-d5)^YVir2nkNLUWg?my~TVsR-R$c}<$B*(1hl?=%?jdTU*;u*C zSOc|Q`qW#;F%J4^8UlWmfv1hsM+U?FItUb&_t=(b^#2&Z?9jCw_+x14|S?k&pDHG8s=vOI| z2POGNcy^aof#vRQ@pGO%_n#~!bFa@l_dVHG%{RVswzAHkwBz0@FOye|5PQTpHz!8; zap8Z=BP_(QT9(DM_&&vyFECto{pV`GfEPm_zYsu-wt7Y$x5dwXF;qFh%*4(PR^Q$Z z5irl>_V)qY@xuY#{t5s{DOtO1j%xuTm2)&4&Sog}xd-^mx>7i|r?D-*#nP1nyrH?j zp5>+IW;n%|d5=7@Y1AU>9%K%&6Em}WWk2_3Ml|-Bzve?ehmOyTffv>`_6pW~wX9l% zyke1Lu736DC8q|64miWJnGCwLbPf`j`0`&^J20FH{*;JVg$Kx8)HKShdS5ZY@k;gE zUx)xBes{&%5Fqb|Ug*GY4883AiI6tY{Z27Zj^G(CHe>?;T-Sc!rQAXB8k{%v6Q9S9 z36TGP@B%=CWW*cbH~(NbtYvy31)-yN-p_cJ?YuK-K6d4=*MCOqioBS+wrjbTI2QR( zP3Iy4oAo`r5lXcE`zu@=qJBr(xfUT_iMH!@4&M(HlPbdM!{O&`?S4%sF|S(m?wL__ z#>!)27=rbNhbrxA@q+j+;Ebbq#=} zJA`p(^)$@o@Y9OcIT6*i|4)wR? zgn*=gBb8ah#v+>+d;5JOUek4@x7JPdQ2W*Iub(mi@9^4U@|K1;LiEFbkqq~p`KZ^g zco@ePzArEp`tOeF(%_Ctj*LLUhDii8T)9E-(eM#O3b1x8DT$GpwGBJ^BXXu^#N8FyqWkrVVZoo}qchOf;daE- zC^m6JciL<(c|yzq`6r4m$Re}cYTdA6!*)t6_RZTfm=Rnd4r zte5EP+pbJUqUP?>MocwMX4YZ9c+MXeolem_O2Ao$CQ%U!aBf{BOAfc-@yC9S)8*nz z8KK-7U(~ZTbltdw_I#9+Ivyv`{CY_r_ZeBnh41+4vZ)|j8<`Iq@W=lL`2B9bSKRi-; z2pMHrXpOig^h8t!H$h_Rn<{WiI@1JJ$tWwvUljp zV*+^~b4z{We=FACV#y!{NxW!+#vTdZ+mu5tx09VTZ?a0mWmB26Pv!RT88pC!b)tmk z-}qa83jQ<<6TQ_scwGEsG0qJswX3GH{`u?%lXQk+&l|DOA(h_>3&E6tEAOX{grhEh z=s*RQAGWWM1I2#(+j)zg=4nPEc47=N7c<5cdE4t(oOD|sHmrrVZxKO$-S{lqT|#sIN3jYg zfB=9h0r2)p($YbRfOo?pxN!^ER^nMT-hBg}y_*cu2uYL&5acRwss$r@f!Hw*mH9030q?yu8chr^W+(&X z-U2Xb4?o%K8JBb8)1~N0WKLh( znMlg7sKXhwqs%|rQ7afK)ugL6Sx>4~ABeORL znklAdm3%Bnta_SrDk?_z)92Zkz~7z6LmFj_bU9qpI$Q-!jLY0tOg=swjqm60*b&wbCvwAuC9lcUN2;Xp3Daq z)S9)uxc#Q4E@=Ga)4GFx<^K2T3{Hxkcd%fU2jwi^j>;4rA;X9x!3FjD?6Ljp!QmzI z48~R&&Llwk`*s%nFP$#S83=4WU3tnWn%FC#Q1Ce1ntG&Nq-#211H(0t@VoeY?v>7c z8)aL#cAclymq2O`MTvaHctSD$@ZrP3M9!Oc#k~%!$x_Ok=cKQ5n+01~Ef>2)j3yq> z_#0zJt=FaU4+ADk$YUo!L}ZTM!5LD&$kTc)UIIWf)hz5B23Dn<|_K3N-NT^%Y+xkhzY zLD=mVVt03UZ?+kO$#&LMY6`|2Ch!h$R|WThW%W=n>6+9r9AUlkUj416Crl~KIj4;r zU1V-Hs_8?Cy#b9XPt!X0uln=$Be?27-ToX#wLq@=kO8-u&Q%N*vs%DtAoq9mU=Oqw zR87JN?}onguUb_lf1wxxkI*Dfl9-|oN-_1v%Zf`4S3g&5a9$j_Pf&UDTgt`qt%b+U z^iYjgMn1c8T1=3B?mJxxrfa0{xU1~P`Zu#B&wzee(bl$LW4wwj2KE6EarV=7V`7)K z^Q{r(E=x+sJWb192;#ND4{sl2tAwKnNgPp5U<6G>nL#OxeX_Odzs7&z8U%=`8B?h9 z)JB9l&P&=sI_&h|LZ$}D=muSAfmY*&+-%$9$j(A7CBcH;vf)vzu`%W7*0zW_jEGRsoKLnR-(7iQc^tzb}+zs?6$37|UH%~cs zpg5v*@a?g*IjhQ34WvNV(c>}WXL8&wK&t>jFL&vCLs`QILbzll&~f9wHFUt~;{Oqb5`-77Cix9OsM-p>cD4H9%HorD;|V>~2Z8?_&;5H)E$ z7Ofxh@B6-v{zwJ#Qx$ERu+^ifHgIaFte+=oq4kVO|HZ3c;#?)sd=^W-$DZrWDLNHNpI65|f4-=^-cf8N z4ip|==0MH}hR1x~{yuPeH1VRZ576vWd|WYTFjhoa6@2=d6Tz99%^Z*#1B47X+U2%D zUan9mzk#d0D9u$TG4Q@Xr=)lshmar&D%rHuHPx{ok9>2BL_QX2aK?wh)+UG~-kKy#vr_T{ur9H83`C=wR4wI$&# ze)kcLn3tyiqW3l8lio(}jDpiGdBQ1KTmSr2O^@$t9GI!6bCWs(`$*0^2oX;35h$p_ zwrPOI2nj8MybUXR`sFn8fSOP>;(?JLJ0IH_ylllkA@w<^9Hntg^bAxYypE@y4fWUU zC~SbJuA{A~LVbHO7P+w~z*Kgk9Hl0rM|jO!TX4jv@*?2IQSn-jwyz~0qvA|}OxD=Q zdy}tfgL52Qx;!9pOGTYO&Qk6=y1musfz$@f^UUU&ptds!k`eNw`-xOD-_I|uSR#EQ zJI|UWc96FyUq#Wksyy#Nr9*5qSbT(qBKroaejM_>>0>uL;6q7mWI51VJxqiQ*?-#c z`?P!3eczFn$V*eV_lV`A@kE>?kn!!SVM+*KJYr>%2QS()G<50E2pqA?R}IE^VWz;@?$$1>IzZ2f!ei*I2OA+zmv0@Y%Oz85& zJBN6D&7-_F6O=Q{g*iQq)8CT)l()Ps%r1$K868E*oACa=n{YD-3kQ|mCYH4#lfho& z+YF9o5yvTv(}k3n=Ub*Yr8PupQUB6G0!en{!gVpjwPbU4s^&nK~^tVB(sm7DmXq~JaqYW%?drpb>PbrUg_TUk!S6}CrU3? z6`JUvj?)#$uY^2X5>a2^2*>{SV$q>H$kO=T*k1cH ze~ZFbyL%Hvd3&OoGHeatfu{=RDiJXHJaX!{M9O-k9M%0N|C!3XwBMH|hLUnlpMHyn=1?H_m2O#>-ciJZ)&}VzPehI9NTLa+? zdY|mma7{WC!*LQt0Q4s0dsewIT|e>WllDjbHC`xg5vT-}g55woo>gDQow2d8HPJ5F zm$Nx+%1rm+Xa2i;+`ez!o7i*sfL4dUd+Y4i=D`Gx}^JHwHsh=LYDIgI)) zZ&qehpVxKkzS@yMj#N~)au9wOlR=-y!S71|uvdC*Jgd#Tr}~R5?e9QT1I3jCO?8>I zI-4};7W1{+sCcbj7U@;oqvE%JFG}}R;5rRSYgCg)P}4SuV|hPRiBR%7Tw~e^Pu0oQ zue6Rk`1Mo9^Zx8+z&G78vydK;c!}AtE{w1S%5-L0|BEusB3<=T+o4j^77Ku&qC}BN z*Q9emX@A?AW&{)`cYtFf36)YJ98D`x9NB#weIyltat(o=wWPHJM1*NwC^xiEC}>>g;ZB6s@Pe?eyEl0c^(A82Lpd7wKs{ z{>=D(-n{5t%r^%e(9Hg~;Uf1$DWjlffla&-H5CPYRQ@a;sO;l(Wl5x%NHz9Vm8h+p z0yw9pau$G7jMV4IBDG+s%v_#H@S%o=7LUj6X}@!a>pT|W#F(I{a(x_@f>CH^^BO3{ zi0O9TrQQJ%cAjFD0jLN?@Abf5Dl}ao>&f9H ze*cx<%=t_n$$2|}f+Rap0NPLgzOsI&*Vzh1ZkIL^ME>ZiSl5h*RAQuGVzuIIG(WEs zvDL@KPrd@0%+3^o46-|tno{kAm)B|FH(E6I0N3@w+>o|^ZPfx!{gfU$O-%XDJMDf) zwpwuNhaFv#CK~$nu$3(`5PpzayBYT&etYV5>bI294wBU&e^h*K?kmC!xad?!;rPhG z7aTZZ34czNA<&uyZikU#-I%#Si_?k=bm}b6s4`$G348pPofDiPjonCF)8_#$t&!G0 zO+U)yS7eMlp`E$hdiF8pM5rAnwJn4!#9hGM$tG^(wxrK)Ibw#os!p{+spO~b){p}e zt9yoHM!3(@r}MI*>4F(_fJiw_oG!kW@i!z4U{&k@zG}aeyifo{C`uk3R4+GsJ@A?N zP=VI%VfxW(ppUiX0aDBfTR6jf?`&CiTz~`=!Pqk|Ook$UrCbXrv(Q?a3T(ypppy)$C+s@9_Q$WDVwX5&2;fZ7RNgaFBP7JY zLV{-`4kxa+CF^IP-Ft+eBU$1TV(0ZGk?&2FW91XzbL0WxdZ?6_A>!Kiv}|UkHHLR2 zOL20lI5pm>sMnUFk_00ti^@YRL+FeUIo4(JCR3#kL&(Xl9@<^TOh5l|c_(HStg3(P zEIFCrRlzr^15<_&cXxQGWkD^>yPZW~YIcN7iTVBEcdO0P4*?IGA#7lO05dj@LNVB*NtLiS) z1dQxcv%hmJcOuZ_!c|jK!$E%btVmz&Vu`>W$BZ2r#dyn{vJ6w|E`6n&=bl5 zRIHpNDX}hhY2u!VCeOT#$#eb1nVFW`O0ip~{q5;&{|XdPijmTxdr7~5Ge^>+v%qzQ zxPGo!HR$K1_H4vaW6!%XGyji=BoG2j0HkQ)DT;_;*r=zBSrq#Df5|y;1F(EFFLn3- zJq?;zAekBdw?MvhLqM=<5*G;mlhh>g*c~(5vrQt7-XM_+XK-$;$_y?=NtpAkuLB1tqK@Vb@x zPqp8Qg`%U}mD=t-MulJmN)!ENqj0qpD0y8Yrn$a89{TS+L;V1cMCBLm7FYa@Pyc%( z{2nAaJvv0l*;(rMekuRIuz27ELRm-lRLqJOu%rb4uMO267zBVQ0i{dGf&ze^N~dqC z<`kR}7@M5?0MwU7`wgz&K<_mr`E%8v4qFA~b+H$8#@Tg(75=v}qZoxidgi941A45k z`Ty?y=Z89g!0vtz`x}b?-;FO)fjp21!}7`hb&!&fX`mMMSZOKze|{~e5H<;?zL3IPHxvaK3(-n_Z*DV_*bUpeg-Lm^G^X@YC_t_1J19D-+2`Rw-!R5`%N-2 zgKHXoIVD93j!6{2Nl2Z`LDF=Pj=DZbSg-_GrsoT=qSsbB%@_&0uQAF; z--tUoi6vCss|=$BA5@Skg57^fKOEZVUG#fe1NdD|f+PS0a}8=-x}FEHY77U8yu0BG z9Lh?v03j8k4F-<#_cq!)vQ4)^@B{F|_bq4vb|PkDs#XWZ+JArB18Ph~pxDm^jtDq0!RkH>(6ok zm|$QKhzO}Sxu^1nr$Gf|nluHVyKIj0jaAxcG#r`Eg1mB8;6>_shTps#PIjH&J{84@ z;6wm+=7TF}KHc-f&;q%d5;-ZcrcXpcy^%zYv7Nx8S`dg_FKOgJF;J_J(`@YRTN>1B zb|AizYV@t4b(kYd9gEd-kJGE;MozG;tF8V>1~sQL@N*E~N{HgPyT1~!4F)FzyTs~2*O&JBdw8@|6<=ihw;H46ckP|>8#QNr&P2(bo3 z=!$|m7i{IpB~FnPoXH?@45#jzcFXM9d|Tw+ZU=2Q@J3^nF{NT1?##)g0py;~v!M^= zw|A$Xy?F}1QIa3Jq`a|!<6)NJy(PqC>y`{2(7lrBUo1-JA_~>k>o_Sm2GRwJ9#ub}SoIr$Ku6|qq)h7gVI+yCoh+HR#8Jt% zMnt93`V~@?QfS$t{us#KB``F=EDCifQ%{b52kL-C9GFQGt7uKf>?7>=>(Q$LZXQxx zf}g0~-MpM5^j8}QJK!sN7{Y3_V^3<~vFDV*Gn6BT$7U?H#0;hcS?t$mv+-#t!lSZf z!f+w`Rm~dDhw6JWs0^M96lAd)f4PRj0!5kN$*HmVL;HWCRzN)g5|p{_TZ0e{PspIV zq_CL~S86qtnE==549Fuj`4RO&&cm?L&(QOF(dx&{!%C)o&(;v@zTi`ztd1~3T5Y`v zkg`$&yUAXXAHDjl^>He`Lr`_Q?T%HG_wx_>uFE~0uBSjyy0#CjElHobjb%k)b&^)R zku>|BG~o4k03YT28^V&msvb#MlJ^?<(Jx*%5m$$gG|gT|U-b~qOiwSGXDGTUc>^YT z4HdyPSg4~~p#AX`XX(@{meI_)GAVDaJls&fCQ%$3gXhjXjWTX0W?oK7K-_aX4r}`b zzu|I@TqMBP!4pCQfnfp@{dVL(I7p4Ssgmtx*47<_VKojlg<0w4YJO(H2YFb*Jy8tp z3EULGfGM{nfoTT?%+|Zv`H#~kEXi(tnR;r|dwRf~47taJ1k)w7Oul$_y&~s<`E+>J zrf`IzvVsG_zJZf|)Ahe&gG>5g@uSNI2t)dbumc70RYN81Jk;RW#5kdWSHEG@yUhnY zx-FsjLn6t`Rj-V$D|6x$ooDA;rVTKBzS)iY8ei&HYJW&7QLDd7Dp#|wUPs{Q(E5W` zlzmVdJR9p>Y4U%Hj5(%&{9|Fso7`|%@{yHph!SUSq#GQa*Q!U2P1&=X;-wud2Lv6| zNK#6Xn%Gia)5x7IlXMo=&g>8UOu|m|Qmgr(ydm6IQ9&UV$X37PKcN#dlYn!+JwEzj z`RmzW*q6uO(^>UL5yen?M{sW1IuXAiHzIG1RRM5u<~#^ElB9!iG3UZ}{*3qlD=&Qr zTE-SbH2U)=*ShMjYsX1@UHi1VNE-x|W@KWLYqOjk9cY?*RMTJ}Gl{L87BokxeEu~O zquInL4|n7zZ6$sN&BjC^tNzZ@EML@ohZmkw!uBRG!XLnumDd&e7&_2fTErRr@~HR% zxmk~wsyURlg>)Cdze~{uW1x(JOL1GHVYW#KeOgw*jC50q^*qjA?OcQM&yML!_JNu}F5F0`R_lrP6kYn$KmANpgqEVoN zgiI*qI@?7+%PqP#CMHzwzX~m*dqVPl(<$Lfwe@^Ld*WhzS2pSG(k_7aW3QmZhxOS@ zgU3z`zS8|j|HS{tNu3Lv)bX1CpYQqrtQYZD|DW#~+`Ho-_sdQDYp8-ylf`*E9$kh> ziV}CWnm%D?~y{ZynpJ)!Dz5_Z=P@i?;9GNqMVM6t(5KwX1=_l9+}vF#qICkw?{d2gsY-ji1!>=#*%1mjpF@&I4cC7URr$I zSNh2JQQX6mIi|01R^{>O z2}c1k+>RNlb_HjZD&&v@C^E<$1s`VmS{QsM}vXY7UK+oP_c`LEZit zX_)#aMJ@muABMU;!@C(s^@@JqF8r?J%=qiU-^=UYdRPTcsE2GmJ;3<-?^mcF;HbO; z-3V^6|8*FW`oy~RQRfebMxydm6@25Y#Qyg~@E^?17>m#$pSmX4ZhqdHiAnoBb1`S} zYy8aLjz)Mz(G1l8jL9s@sOBOtm;T?WDD;6Usp0LT~KwTXeu+|R2WzyRN$BY{GU!5jAy ztusE4_}dFH*B6VwPg~wHkB-1uwqh%hai-}DJxc*)emMn$(X{mHVM9HoY+K>`g*UZ0QTl_Av{j$cv6!X-l!gJp$lQj*b z3nCnFnjrHq_)5OJjJCFkjPMa}Va{Ve?Y6N~-HcBf6N2n?ZI(fYrwhHt2fc)Ozh1jB zc8kYJo{>1?k(AId^v-*~R;<--4ih?$fm)2R%hw17YE;#QpT;PA5#<=Bi9B=EB!bMT zzvco^_$h$3Q9k!7R%Ui55NWoQ{K%2}$*uDt9pfaCtK^fw>bo?_t!`MYg4FkOL=*DbcN4FegcfVXBG*-`=p>CNE)|!=q|E!fNm>0 zj0RV(e*e3O%lT$CswURG;N#qztDZaXxQVi((ME76b5S&#p`y{Qd z9%u7>>U&EV;Um_d{H3L(AaT3bKOR(8zsvHKHr_-NzlCx5H3emuKeE&VV~J`A>8?lH|c-h{N0pjKYgS70szt$EIG$g-ulk3+ zA#(z_qeqVQhuTrg{}x!V3{#~yNr+vaTzT6}{T1tkK9-msDpoTWN}UUi0fOx=(nNQY zP1W;bdI&Iv?okdd7+_=^Fr1`m9}a4$Mi7k0q1^t0sW$q6gY`!g0cwd}RdiQY*AR{k z&;!1&=o(eD(|FnzFLzo9Wp)LnXz3(p1u)0~I_f}y#-?CtnJ4Ld zixyUcL&BWOWAdi#`LJon?w^?%f3}OjrU*fP5zb%Z--=v9l8QHUcsp>WR6n2EaH!0M zCFs0LETc1Ze!1k34^V|0gJm~LgmY!GnqJHjQ0kh$BF5TLmAG{K)hWJrir@R%dpj}0 zMm+*|&6)7$9D(i{1)EL%@wB%UA&IW#EZ+R5GXy6)>C+}RUX|?eM*qfLyTG?~H!G*f z*tB6rRFzJ*eeR00u*j=={^>Oo)FB>%Av5rE^hb4u&D+LXA0wdiij!#N>9>)9`BHgu7V?o`?QFVOxs5D1@GSJi@E+y-!hos- zUt4of&b)NDyyt9<^W4``3T-OXFw`ig7w?w-eC!A@SW}6*K;=h=m>n*>*BA5E{Oag< zS-IWq%@Jl_T`q`rYMrqARDgtAZxIAv*$i5B1tt*%QDvy&B}6YO}5FMi7UucFaOL4eRHSu3XEGrAtGyq4d28?CYK)WM2I`F!`iXBgy&#!B|G+86*85+$8!>^dFJ{UU) zXulF(c*$!4ATqi}GK1&3dO+&9i>^L!SC%3eLpBwcNLOu##w-V{zWVmRU~yR8eW2~- z0O^UaO;yNaKd#obM@O3ci34Dm!xknn{kOkModk5}QREmFALhl?c%ukkUUkV^pUeBz z3!V=kd_*S_$C#I*vEPplPZTMfGDnuSlR6c(IiB zT=K+8#_7&eGc%pAc69s6&%@n*{b(*C$TK$bYq+(!XC@X#A_he>vSxV~+I$v}=f0^` zz=erNkG}Z@aPGY>wG@VKae7!3-eD%UlR^R1^tz^Qv;=w?c!-g6t^4w8wM@Rfjh9%C z--%a~s%*+dJ=iIF-R?LC{A%K9EKO}%rS)U^{Qb}80@{(;u)rD8!_6k5ZFh7MrhwH4 z;UhMxRD|k*_nlNlHt#O<1YL|p&zw&mzg!UNuMzm+zS8V1>Lw$c+aV(~ z_&h{sQ0L)9j9Af*G&RZ6@%#`?I}=M_67AV*j>9p5xq%WInjeEjFPDZ2gN)@f#+Q<= z-fcAxeX1+w=17<9KMyu(5r6Y3_kM?!H)ZMi!&<5maq=&O*zT|cIoGf(9EXU)u8y+zpAC(6tMpPby0*FuiCj3z;Y%J*7`PRJ1PF0i|%`Dw-c*8B4Nw<$#ftJz`oc0WAl!@rj2uR&zj` zTIr++P5J6eOkMGvQatp5;N90jVdkR%X-EkZa5C`cdT!brgn94Rq}#y#4>^9~(-qJZdw2%fx-P)dxRW|dym8=BzNh5J4_9DD*M5ToYMC4w)GSzX1gysOm1+Bn4rb1KG^C#JWy607_SWnBhWhT_`zd1 z@0Waea{qbe-B-inImSO5f;TI5<45cijqkseU_3L5aU=*2ql_44;Vjmti2;YbdVhAB z2_sbLX_oEtY{qrREHlRj&Gb7W1j|aZ1K+wG?%5uFe{M zsVc!4`S37M4pXlOJGdVkHhl;N^1neH+E;VcSmeIp=wx(o5r8zKMAs4r=eWCQk>XHH zzv>-C&&^q79CQd>j>BLY{A9CT=I&r%nCE-K=F8WP^rtLuanil5K9yWmJ0v+2(SIt{ z`&6S6di3J*yiF%WJIBGlCn2iQfxgkvRPLV8<@rzMz2mnvz zfFgg80Z;o+RJREc7lctcSqU+jHlWl$n;*DwhuFEDT!a8>{Dkk@^+$KD{T$rxjK{rk zt|<+uV3X2xl;~$xy0#ZYt%D=g-5!L(YXN|yBqOaSYq-s zGQ<_V$T-y_d%W_@K85Ygc>7hZ%i||$q?>mVLc2;->;?!Hr>d}%;mBsATugG0N0KL; zOkPTdzO92CDs5l8l66m@S5!}bd;mqwCeQG-bE@wWAitFalNMf*JV;nWd4Z!|!gs z(&^rFoveLU0_1BLK7xrYC12~o6m^%Jyj^1c9mCdn7Nfa~{l4QD1RtTR8IB(#v^IWu z)9}VfB9&b&hva|0>8E2Ke7sOjAhb8P<-FpiMlDpWd2~_F;~4NBW1z<9OLZ5LG5PBk zLt`)ltvomDb>nvVR|ggpghT4~tO4n>_{2(FSi3`4U$feVReCL%Q~9qoFEE!OAj)s9 zB~Yt)Ru!Et{?~mUQwOOgdam2fv!VpZXk7^Zuv`FdZAM3Yrp-WR(`RaGJR_JRTd2;q zzgV43m0R4Np{u&RjHTeGiJ*=`zjjQVll^|WJO5SFm2?4^iU@*P4RrJ%u@7#ZMs5#v zVuBfJZW7#ZPInT8T!?Q3kd+(xom$$AmFMkZ2f~_(cS;(sys9pxVu#<%aNtoBFf@g= z-HatX<@3-pKA?(W+%Zy5I+XcHp9MaP+3^xA{^sUj>(#sX(Z`2}jb+(yI0wG7O7m<+ zS2X_ZxlD+fUTBOa;CeeWJ;p#+{=y)-_l+TF=tC(5ne2;VaZ3(;e}oyr3W2MJbp&aC z*Z{_T;(YYLRK6!C7ovx62jZr!^gI&rJ3N5Up@B}jY?)LVXR~EZA62365;fl~2lmu1 z(8tg)KR^_#Z3FvE3qR65rSo`Ic{ajyNJn>I`f6gkMXbkxF30BJf7<1ZiSbgA^Fr z_#5gWy)IMe-798Ew>Ql5(5V;3yBpu$P&xeq+QK|groZYDERbn^f5_xEH;7Y29TE~^ zMN5*HZ@Ij@{A#G)4abBr?3Z4nU;UT>l=^fF2+a&{%;XCN(q>X$o__Hz(7a1$_I7RI z#G8vT8K7!rp5^~+RSLEcU4juY2OM(fwNVGV)=Ha!p7PH-o047|Z$cQ754C2l38pOw zPq*Yi*kD}&7{Xm{*x`h_w@tXEgkivVQuv`k>t7atS1{A_HrbF+qb6~E`0Y_m3QlOH zyzhOL;C<|+?a{K9+@Jhwd^7`@lAWCa2mS@Q?a^OC6e_Rz@pB%qS>y~QM2y^$=J_8Y z`Z}27-OOh4V~gf9!$%P@{>33QwilPvcW&K%;~N|sk^H^z<||tFu|u0W--Cqq2Yveo zbhGjS)=oo>4DkU?2W)z$FsOru@Id=oMTbx9`n6STPcjIC-WeaxTe!ldo0% z*5FjAE$}V(bz4KcoYp~8+vYZGKoDp~e zf{(;_KqsAx3G4`!pQHXL1sU-J1(@%qP(QwrP+RQ4-csC?P&o9aEV}AXeEfOpF6}Gsn zFxvmc)o)m{L0FAd0tmZs3R^hd(_i5aZ<_J!iRQ_MPt(ER5)%VU7TH)&oVx~SMFu!Iq1iU^yED?iY!ulwNX@5x@we-CmN9k z&a<9xssBNfsFgMe_VP;6Jnc9?!Sw!>oD@m3^7D}{eb1=F+c6Q$YR?iDiKiYW|EKZ! z{WMSDCpIMp=FLBnit64y?5$-e(eLz(Dl9?_aq#45L#=T>kcnF{2OcoY`VlW4%DwTc zxB5H3gC|fjdjCYMe_Ow!q9CJJ_2!^v@s}TZwvpN2ftq9Rx<0uIq*GB+4l4s|u6vZg zt2cV#pLD?jH&6k>q;Y1PdFh5PwN_y}40dI;OeliOJ}wYH`6AfRe}Vp&pCGWq{e@Bj z{2`UWCy(0_8DpP9?bV4txFXM_ZTJSNmKR9gDhyKo8-oY(BEkD|SGW#LQ#65%=E(Ft zL0=)IzhI#YTtuipe7xtVAE{@WJO-%0$Ez{8sdVi%dJsNX>7pc^&sLD5Ae7 zsP8MSSC*wmYvp_B3E}{hK@o$(SQ1Eb6cDR8&hACIjdJz~oYs4im@t>2Dzu1?mMG=X zzrIQeV#6lg0KAZCV4Ru#Xek}tG1XF*XyWVl0ejlT25Il-bqR2S?=(}hMW<}_@;+ED zwRgJ=M3#g$3|!thq_*=;1zzAkrzXM|CwJ40Jv;=68PY^jGBb_WMS$}6p2jrahyep2 z`%2tBZ=r40Zho4u0L(iMYfK0VdZxdhch(zTr>4$#nxKg#t>_5`aQu694X_jc$<;zZ z<^n=UTU(pUX4Oa+pd{Dc3J=FggE$Y|5{{Gmk!~2?%U)zeFP^KF8G|$Xeix_lQ}`L^8qx>sx+%(57*KL-^DCOLLVpdSDQi$IE0S9dq&Km|v`$$V+u znH8x2%0UZlGhX=tB}Wl{wpEmpLj$tw*inPXL0)F6sKBK2bAU0|Y3cT8q)6C#aqsbjh2)-5kZJ7 zMiPV$#x#iE`-9=gcmg**AYbT#6-@FC{2M7~>}=UPU9zNBzfZ&LJTj_RAD^Wjny zqU-@P>2R~>FUVZ+=u)T>z0M$QkG_Wzj6{;(ng60w>e!_8WXgR6r-;d!9lU@qo+a8O z;rOsv;1<>f2uzj77|F|Fn zC3$jJK!fCFJ*p5c3X}u9`XE`LG%GiKZgH1ty9@7E?we-lEw6R>)V^KC#Eqa9E!NvW|!ZkPMk=_d>iLgTRT$=}$sI;KfMp{@HUTZ&w$WmjQu8 z7}=mG;j!wWT)+tWU~!FcRt}+^ztbx>?fU8eRQHxqQHI<5FbsnX>5w8ymo(Dd-O?Z_ zT}nvjASvAf5(@3GD~zi;oy*X44}k{Ra7``P>2SD3BXP74WK z^uAmAEL=QvbZ#E&&$RA0BF@JbOke7v&oljB=rbvz>IQXvBGEaQnd0k>-TK0u03T8b zeL7BKC4c1^mS7Z0LKuPn3vvZ)Wu<(SE4<@0GoiGfAMSkx5{yFygPZD*yZBzmM{VSz zO?3a1tya!-<C~vV2{jNv5E5c_T1>+F7 z5KrB^_u0Hivh|V@a7oH+3|opFysfP*y9ke0&0ama#@GwlRae(Fx-S=~(-> zU{S>%(pY}0b%9Ld=;L?AQ9kNGrn?e&9NlC0ozeB@(d<5+) zRJ(NfzCfpkc8+`8_F7tKi=!93oT6`lA4->uMs3)RrXbm@J|9k!hhy$Cm0iT#V1!oB^6d^xZ_FRT} zxR|2LiXCxAlG^K*7p#ThloOX8I#58357fbb?gR-TxYzR4?X_vFqKtsfl>sv`3Q;NL)d!#P993XZ zn1^RUu-3#{IJBn}l|_5@0_4X!0jP9Ub_x~k+B1RVx2P_UnhsKnFoL1F_z{s{3>WHT zAF=BwemxmAhxoYEjQA~hykd6r0O@r5YS2{=7yy}_KJhTa@VrK#0r}Dl6~A&g*2=cE zyO(`dZ;IV5IIaA(l%(_1pDGm#Un5GE4s~ucg>X@FE!=Qq48g{LHQ#HiwpwORVI*l_VXhkAu>Si6*zKk}#ee|ChN%96$epD7dgNVh07?Vd30 zz4F~#h`C};n|nlUNBXDs$Ti2rIaZClEt>soI^VV>VR><4?N(ojxLo$sw=%lKN{@kb zg@Lnn-2@3E=y?P>8>wAk6G8I?!erQ@j@xNWJ^k4A;aBGSWfrF$m#RF%NDPZEeji$P z+y^M3wCoB=`{ZV5qL};cB}b72RG_vY)D0isnqw1v!?#9$X|$k2_W`SSo4+c=@>m?D zA;$#jnx#|H%X}_=Fu83I>Uhj5(2wQow-44@qK#r6juy*+eSfjO?LHut1ARaoiVVz; z6aSn&A@0@5>{8_73Ak#q{IYttNmLD7q?j+Rh{hBgP6ua99(qU-)0mJXw)o%L476LC z_a;V-rFf&i9SzmYZoM@YKvC{-ts%=oh*(B})qG6hG_a#R$_^ZB%_J0(XKk8ipp+mw z&H~1Tl~bDMMU$2L4hLUNlM77?hsxxMsO`M8CSQGG*zS(hQC`KXqtP?ubN7D6NE#=G ztK?kH`b(dd__S5}x+vX*8&0tu@MX$V9OdIHcp7xZugFI1Q=+tTwJtuUeRLpD>h2+9 z+N;~YdgwVG*q0pR?BBkRkzVqCZ|_TwVrRHoc1{VNo&h{O<1Ye((eoR#w1e!#e&4Na(6m$~Wn- zZm5l2-0bV?vjR$?U&Ytp3u#`(3H&qX7i{`=1P8Pnhn=hAr8(&k;?xQ6CtP4!Xnxbz z^TNYtpU{d%W;H6yNR%>8oW8)o8z{19ki3go~^w)$Mw-y7=ce>3FfL?NX+ zTFT8XnKm{jzbA$}xH*oQA~o8M;e$=uGYk)Ak$uB_3M%6&9<(g-k(&=_fmKZT&I5Y_ z1p~6MqJmv}Q~zz)&7SVdqrHu_a*aauq8e>B3wf zGET#j%7jWHJK)qV>Dmei$zf4WWyN&DDT$;uDWl#7lm3O1rJQlw&$J;}P`na6IA7V! zbMK$&uAfDZLiko>MW8TNMvkU^O?}~Vy&F>n<^VF13o-%(00zH8*)5TLS<6dA)L%}vnKAQm5jvD9o!@Wx6}>6_ zs9w**Wm<9NY)I1LIM2`+VFe$yZTjTu>Cgq6%|7zDxtNYBe;d#(-BE1 ztxG%-=OOhR>3uvX7Xmo8nY43N4^=pPSBnZ&M6UArP-`SwpHwQC&)Y~kOoPYHPfu2o z*&v_waW#j#X;Z9tghg)?=CTYzcYjin3Fd?=FeQp-50@uiQIv<$Y1lx&nKo{6?AQ{2 zc;1g((3+u~{#aV?Iq4lhiPH5Mf_4sOgrP!Bp!J}|q9QUYDnmOL|KYnOD$L9is!VHM z6ciVB&DdRO`m0tEoF52@+!WD=z|8;C8CdYs^DZ#NZkIK->Mei_GG5&{W%fEcItd=9 zy`MT!-c*}_Mlq`VQvgVbkn|V*+tYO7h`@9$nk#R0Zp6XmP70&SlLP)OP$qL#Zs)U3 zkovW8X&N?sgdFT@;8CU!v&f{f6L%jeEqs|It~lZN7|20W9Zy3?aI-5(A_ISrWBOLM z0K?)yQc|G6+fxggd>8BlNA}$W>nqH4Jj`QS&VX|-Zd|M}jAQAApFhbQpis=)9r&EM zSg3uYb2{UwG%ykpm0_u%X)FjdP8d0WOptUC4xZ5_=1lnjL;X z!67`+;`W5&b4uFu^#P*6X~m{y=f~O68RKQQu1~dF9BrC$2)VnKP(6C;$ma2UmPu;; zexDm?Nh}%4x(wUL)rIv$NiUNJ)hP-{w~(~4EP;l_XBl6#MHN)XJq-6hBm1ls-nx^7 zda@D-&H9|ye4hazS#J;HRb{(H{oAu-cqp0G@-pCEBjt1IqK_hRvA#N*q0V;Cv{fxEzzs|m9CWex6@E~u2KJ(!KB!ILc|{(& zJ{h<>82|&Oxjev((WTLhd}Z*(6J+xd0k3AI5`8!B9<+!qMs0sGczSn3xzOJ37S(fj zy~l=qEXabqtJN~-31bcWM3t)>vou|@=vVC1T7AV4WBDn%U{`0*YsnzbV$iK5)(2A= zzN9qht2}QnW{BN2`n(oTYg*0o&oV9x5*i|=%L5jq- zq=j+oP>sEngop{*ySkrbpjwJ?Aq_W`16djei3T@|0l}U+d}lC}RITh~N)r#e?z&Vh zW?XO7tlVEuqkD?=vSm6_FP6-%G5BJ{p5 zMa_v?;Uz|`lVGv4@Y#iox}K??mSzZw*9&LSpQopc=Av}*3XtP-Bx1>P8&$y20v>yD zm-AWo>b+8-yevY-;DLrIuH)cV>IN`Iw??_XhB^e&56086=02gjK%kffwl8k8`U|(; zB$xDRRV4R~HDj7q@I}~)eu;HvZvj-U=tVTOWn}J~U5(I7ixl>%z2>t`>}tYPyprBf z+C!#$#UN|y#an$r?2RXcA|>>z+yrmQ8&k!gjU^YEQOpao(-;@gRfQfxqI$(o3yPvF zEaZ)da9U|_CZ5Q5e3_Mt7brH%Jeu~S1<8bSto1Xnr!+Pqjny*0d9S=t@Twa$bOusN zk@3U36}bFZP6;w27m5cHf#RWP#?6+Je=u~U{1|7`bF(jyw0m>eYZ+(M#x#K0N@ z&08PW46|JCO>he8!1wJd2_dM;llF&8tIuKu)`eo5q-SpIp01VB_U3-z6`m)Er%5<>uoUERk5WFf#qXG6<>e zSv#}wa^`gIMI?RPbVd5RhnP4n=Q62RjrQ){iG&Dy2$U^oMq}q*4ck*Aq3BpR?L$cj zc4Q@_T7;9<^@nzCq9#rLQK%&0w&yFR#yhUe=XyM5w>)p3Q%<_f@Ydyir>dLzw23=G zplh54)Mfj7Mrj9Sj$n%O2vQa@p_Leq_3{Jx%+hT4I9l_~dg1y8oW}6M$nM!&XI^H* zZ5hGS9_>o=)rt>FoT6&Pc@Lh9uVuGRXAxJf4_>YGa65oupY8o7=tm)&oOlTg)dZhz zfP}a9A(U4yk~)XxS_|u9VffrN<+;kENl*2A%?$s|k3P|CpOyD76jst;W4-!P;*y%p zupZ$rzsmiZ%FfTEj+?w#%t6i3xa~wWk}c_f(m>-Sn(zfGUx~YvueKdiI?H8bA4nkP zd)naKh~&zUj&IV|e;8k2^<#q6ztmCU&4^JIhBz>~N@z!zIDTkW53+ z8N%Jfta}_G39Q6?#K+#>8glKwe^v0#5Qtl;WShs@on6FB*lifz@plLCuC`4(>EC@p zlFNwb2Alk29WN?q?E9{k9?fFkmQ;BD_;8E$_~5SHdUP~)pdz+{b`WO0g0e!eM8*Gn zHjI9IA1 zp@nE2c+#eNr~Iasxk113#w)3uiLO=XfRLy>`^I4YDSFr6Mic^*pz}I$w*7K+&c1vj znCE@2z$T7#Mz*2L(WaJN*M-f(_mOH53Jb<~O=L9HY#43%QKFz`xWwUgdf_GO$?B!> ziZu=*>LR!KIR~at1;204evcM%ts%Ua_-wP{W6zU|*?SVgQ=y%5RetZyzMPA6$y0&R z#b3Z})zjkH@iv#;CEjk`7(=cx6e@-EbiF_l!B83^gL`>aswpiyf=R zdg4MK)XX!l+WLZbhfQLv_SFRrwdEoO3X)-8@T7x?9!CXM-ee00qEf^uqsAS2xsZ{- z{y!PyRD_u4%V&bty`$K-dM!WZsCR|rS`D*$AKbX@)&=dinM)?37CY;*{0G7yUzowZ zrRT7CQ8yl|rL+3=-H$gq%ahyfVcWmYle@ZoT~>j--RjGKf8wM3%== zTd|@J|E%bLF%_ff0E0fECM)ZI|2vFU0)NPP-2fp?UV-$lER7D16n7B`G|E6$R9YRl85&x|T~hD( zO&Gr9H1uhbyZeA}0ZjinP#u9my%)0o)r>oqdDXh_NHoXsYU1O$0aud+H)=& zjJBT=g&p>$SY>`_;h~nhBSV94A%Z!Aix}Pw<}UUmNpqncte5%Z5ZnHDT+%0`#XY*)RBsetKxptv7dSx53EZ*B5`3L0ZatSn6ZpgfaF_( zK%fd>jRs=9oZj|XpwelWLLa};c3NvFk*-B4@5|)NFH!+5@Q+KHip37K&&ZmpgP

      Vol)QC&uPdtGJ_9S&93e7-4XwO-tis)!8@F*YK-|G zeYcsrUu{p1b`1w!b%ez90jH^lt>)WY6B)1LeIM;?GxZGN(`dvD-v%@5|~&$k{mn)}6G!zIgCOq}zo?eINeDKWId z4$~()J28EtwzMfC-bAA(XL{qYT6gtJ|Hskp+;hJFj`%8+YqgyI+5+jqni;u3w)fAQ zd#-uj2cvpcz}92a7HJrQBqmr7Mz=9vD+g#bZ?FuZMXv8h`m~F4ZZQHl^o3rCqReC&iFOj96H*Ah?l@(5=l>Z zcFsxCFFwo@7cp&ey<_rooPIstL4|-p8}y zs+8^;agR4qP=mz)G@t1!=!*7`yDi?QmsO@Fwsr?cZeF%P$!TS zTp(UMZ7U6iIQVi?VU~h;J`8?2C=u6<`NqY@5ABUSqNlI**kHri;(lrUe_zV4BPF6g z#AZBI{;@{d7)L4o11I7JcuIRpmvfDcn+CEyYCb7I`smkW!0@Eq#X{v(`yVXS_w`t+LB{$ zSm#Q52$baoxNtRFv=VVLD%Zh>i$RyUrnVf%YCt*oyf_rL(~Eu}acA~N{ay=TMncp) zf~?SKFpfSsF;x!pcAN+czhNag8L)oBET$&lvr!uU=01}%xd)-X!kC&PJ6ndOtm9$C zbZXc;ySf*!CCiaU=AC)>?`p_y5!5WmvgH#)JU$Kdi6IQGPr|v~LB;hWNK(82pE~zB zxR*3t-P~f(AugoPAAsXqiRXnMSGWoSieRs#Z?}WnoCy$Wv75^;kxo>OK~bn&1=Nzq zwq8g);k)gVLrkq`2DRsRkb-Xjt2tMU%6l(By>*RHb1E#Q|+IolCy4;E9gR2cVpdjwleE#xC>bm_W#!r1LO|6cIb zixvI%3d{2_IIg_9m-=G+K~p%(qRmxlhri!^=tmRpC zFiZ6N%zXYGv;`XYm90qKDSkQcGwUaX2TR$$@6yHco@_+iw6C2xM6~)It1q{D4;QEw zK=rB3F3QkWFXy5-*6+-x!AV?JWALUn9LnxYplXFtscq*^<2~~U3F2!jrPGuEq5+)t zjocHL5Q%mZmNH$lH$(%o-H;r3_3H_53qkp>8@c{tOb%w))5Q8wBQ@x{*k$hFNc7IE zx>cJAMq7n1CLS>Ldbom<{*(Xb0fBiOtrlZbr>pSwiq&1CP`UK(iKYe16f+5-1LBV^ z6w2D#{Lex%PDT;E8dD5)G>q;1D*P)|KQsyi)DCa|V7uQEpeJ_T_f^w}OSyu%3mC|B z+#{$&))x{V@Pl%w3zX-NaJg}iI)&FUZB;8bxvfdBlttEqiKj2_udt(B$8lffvlj6> zDXQPw7R97PLr(afc_eM9cytpn`)TCi_Rcp^d!5EIuE18^IDuN#D{3#Rw5n=kA6sq8 zr0p<$yWT`s*P4|jVRy}p63rV%bzEd-uL~3gX3ik``8c?wPg1Z0qrf!Feat}axK=jz za1G#j{9}7w3l zvP5df2A6+W@v9#W_egYp^D7d#?{WK6N^9W&?V!Mi-(1zG;@b-;>y$#go=3*Q&tvXp zVNhy{basbNX6r6AcLdeRs^^R=!7eT?#bN7AIy2B8u}{JNHTLusHolbb@RtST&^a zU-EdVSVLmy;(0sO(a*V&@oT@I~F^^28 zym&${mDU+Lx)gTnA*Vku{K_&TF0Ut`Mv8&Wy@yr#LpN{Gj7V9q3k7m6;x$v2E$3!& z8h^kj1nmBw0l6_>HbdFvab^=8`!?(;=LG}ytwPg6MM;MRYBFs>Jm#1TfZm^^; z&GXtyX8t^aK>yx3o<55ke_vZ7M^@UH{)PTM1NLyGU=n;Hqd8lmMtkzXo*?eB8+&iu zUEED1M)zwE@#YVAMwS-(Je$|{Ec$QN=O9Yv^!K<#F)f8q{qNYhm0gf*cs=)h6-N^1 zAe7ox7iQ~jOGcqcbrZ(pN|B(tGaUcFHaoY*!B6lDA8Q{Q=gA5NrQe`Fw%Nfw1VqvtLmre{WSb=o@_Jb5KVcN#x~RC-MHf{ zdYH3P_dXZw#&IH5u1Lw_uw!i!MrJCK=}g8$EWKq~C@lDC%uK_KX{o?j{h41VH@V~X z;$`!#iawu@D~0?C1u@Et%aM<=#_@}Av}4}i^T=B_5@ah)x$Swbro`b`zx;ICvl@Z=tnQM`)EJS6V4Wl|HDOGnl?V`aTx_h}9x+!1!)sm0x!&`-{-TjFS#`4EI$ z3;F4kwm2?%rCD>H9^F+icc!9b+RQ$l_{ldrtUe{naZ@F5dU#43R9dz`bgPzI2?Kf? zLXx*&tM%>~K(P3g+a5SSwKCkXLe0VUY;C=zwpk`+MipyiKZ_G1$pyLA`;0k6AUW=W zcUv3sQ(M4jtyg2yb>2Hp$Q-kctHG8KiaLei#-7@yW5b6tG^-t3_fp`2EW5zF**@$O zKp7$Kz5W8S$5A3DR7vkuf z+qXie+iX!6XZb0IE4I(#FkU1SJd|Y#A6LkwhULGt5Mo6s^O`{`LPb*+x!XN3P1-v5 zA*L>U;xpQ?Hzy_G6UX)Oa$twfEiv9`i04PdSxETgfk;vKGnY~sL?Ow<5rl=!e33rl zdbQ!>^@%S;k!^1q{0(npH~ONlKifRCLBN74n>L@t?(Psl)i=MG;=&0g@}TNRIz}^O zP@G-qh!cx{FEZZXLyXa`CyCg3tCeK%F9K9=|~5K;TWmVdd&b>uaGjW8OnYdVa)i(mjL0W4R=)Igy1dIscB|nFpCCLGNNtbwrf(g#M5}oCT_r6_{+W&^u7Ss0ftxRxjnb(3 zzNsy}N0Gc#fOKRH0NX$$0gVl~k%iuh9dV*(1?J@d2C{q#a(Ier0-1DWAP3TBm&V?s z(9njT2DHV(<>Pb=x|c800oS6I-m=x|9LuG0(U;)$BZxif$_Sqxm~gz^S~Z{qR}ch- z6p(<)$4#p*3oshgD*@JEXktuIn$?Gg^AobKG?SJG_pJtS;*4zEjcQQZ4sxdB1+6U> z+kljl1#D9A!*3(p23yy^%0j-th?FAnslN>6f8~7||F|J<{W|7z8jU1)d7-H+0i6dK z|Ad0~x0U06Ow=GisG8GP?ly)Z_mGYSp&ts7k>{CxaS>f@)ZhJ^3iIn61fj4|pNj+H z0V7JAMpBuxsb`CxOv~B0h+rvij`5xAe+834&^Z9~5m55~q(LOp>`sI=LyqS=wEuH)N>`+(YgouVD zo=lBN${wYo@4r7$q)bJ!ga0-y0UBm}xjji=VTp6J7TI;L)TN>(5$R#_o8Sxn1zMa5 z$O}I5C^`v^0{@Li)9ChEs&b33U>{$9?f+w_4R&(^3e02Kkq*tb#r!5>e|nR_6_Qb0 z^1NpIlQv&-Qdca&Llt->DDasC$%}0trJMQsA_<%$v_YRa0J|ETGi*eECciRZX(BcK zNRlO^a^*y-+ieDZj;FwCavPrl;Um7PKD8nC^b0$-_jIhL1v?O0K(p8Fte}mx}4V_FU z`2S-X0+u9f)Z@qEE1K#=+Xj#->mOit;uOs(|;SffGRUj{57 z4RMKX+|W}N2M!f=%P*s(4ggFw8q8Ps0cmjn5HZ|W(znDwmF>y(`REQ|bgRr7U@a$6 zONaFU)u`wmXGH+!gf2V+N{lsq`wb6d-j}Tcnu?EGo1MnO<@&IQ=(0koWZC_Uw9K!+ z+UTs_*i+f&DT#DHwB-Ihw+Fxk{!jC+-~=%Zyr^E1pm^eIG>n4E36j>i%>p;;mKG*$ za#D78UF#0U?tcjB0aBkuP#xVU;d-^AL2~UZ$8R^13GYPXkWgL3yrT^;eiplKJsNrQ zh8%cFQ&IYDBXDl`SPjmc&-kU=hX0QJwT#l3dAC z;ays(6_r0e-zzd6a>Bps-HAE5ca%|ha+DsR(%XK-faBgvLiK&1c*;sNIfyYEs`*eT z)rN!gcSsYGm!Sax0(8E`x4>!`IN4eaP*V(u9vJ~wj(0P+=jM>)X`nJvM*`e-UtWeP zBAFN~BSlHAyXBT26Ezw*m&0oZAHTrHSL1B`{P{D#-d62A9ugU|1ai?`0K#JaxIs+( z5kOo}U92iX5<+N1A+W~Ic)tNm3o`he?1wf$0)rVZlBe)^5Qo68 zr1Qmj8ATJ|G;#qpdPc>b4>`d^g|HE|h@i-_yrbTUlilER^Qf>Z-rAy1273MCNl{4x@N9!+Lufq?ZKj)@%+W76dF5un5Py-|c6lMu^H z?!@*gCjZ$ca_u17Zy&CUJE~P1so)lulq5$IGKN861XWI7$Eq-$o-Crx0zzyW_kaK` zorFsM-V#vIf6;OqdB2SB8(}MPrV~Vk_Y#A~8i2AHA>G$#IA@a=rHd&AOSRRdyWhVJ z9?l;jfZQEwR(;Rf%>P+mNea_J0Fl>lKZwUwZp82*?&N%PbX>T_u^Y5mKnqQ_-uNE% zB$G&DAwAt@AiDM6$-zE-kSI4NJX{A&3_hWZru7;L)(i$wijlxL8n=UQE_~&2-snl7 z1?B*5DxtyXvS_SiNL;n~t%u`ub5rYeG_7K|8K&eiXmkaq0;x#hob>C+9(N9NahzyS zUD){wo+-EboP#XOh78+$ThC^%wes`p-QhAe>Z`f+l^2q-A^ygtqmPX&1Y5_G`BK;5 z6fC+Ctj5f9qz5WNu(obX2N#J2j`HMGBcNbRTni}U{d;>I2p12gni@S;anu zw+2x*-|%X?LL1I`*mB`9KY<$+iWP%TD@PiBpx>}a!p^%GuHFUkODU~-ZK~GQA%GH< zt=F#-cMwT|&@K`3-49%XkE+x+y_(fkfhw&4$DUbB_x90x2%7{C0*lB|PCv)|@{^JG z!K)tLfU~zfpVECq#|1y8u$_)AeK}}swRzXUmcEMIFz4`(I(im7 znkOF@Zy|V2S;jSH5hu#9%7_~H)X_%s6nN?vN5Vm4m|%7m)Pc1KY%Zw_y%t6n5$%*N2Td{yWvqta3K38*WLt47KWd#mpO3;j3>OHuzwRX6FNQT-^kk4CG%Il?va(>3A_-eb z@KAmRn`sCJ&m$@q=*)T(Fz&2$C6+-yXDMqZDloANnrW3FUzv%(Rff$`K|pAfm2Qrd zp+0Vz$R;4ZM~7OTAMaRC-WRBhyUE>^j3~Ol6NVI*u$%P<5uO8eP_#O1>In)0Vdd#w zXWSuOn=7v0i6zG9Tp%y;bueK40FlxHmQaLSa~fOJCf;e(1bOqx z3W1+eSI|LFbA_vDAMXQ$f$qAw`4(ebum2` z;hWIzG@$Q;6zo1?K>vOo8UH4c?6TyCY>%C{B!9qb{$J&TLhE(Zi_Pt%R69`r&=9t| zR!u0tW0$dXmqI@8hFgg2!LGem^F@@#ZQWARoQbMc=*e;rxD5&|m z*OP}Utd!?7AE?g<_aMqzdkyM+NLZY>X{pB9T#(Xj>%$B!h&8bROK5xpQ%L|9E{kLeZjKr_!=#NMgB?DtWv ztzVRr!pbcrhaaQ`oAv#PNZM~C3N#|XGhee|QkOtM4pPP};n-@3VA4Xev4-DqlJ|Mc zb@4De;=$xMfI#b34m`g)?X~Qc8FicXYhV@A0~~~GJ+61#>v#yUPDZ&t$jU(flDpV0 zj-Gnm^QMRJJ@F~GPGUXMsOU`bLyWe9@Onp%f+X`^(h|W{)474Xt@5WgdOa{|+?vjW zrWtRbx(kf!)}cpq&DUOV5Dy(-=#V6w5>a^we|rF(`Y{PCP*Sp(4+e?@Gge<*zpXNY zW~uvkERGLb4*JpTc>l(_R|JXs=KJ~YOK>tTZ*-g=cimaCXKDgkRyakmGjC3{seh$8 zU?bpf@XH<-MNkavGaZG6R=+*C5fv9+@L=?PiOd2xcrRsX^sXz)6yfU0VLfsgavs$G z?*YEVF8tYSxpckW+BdC|#vz%fQOW$8e)+EUx31p}zM0_NZ+~C&!_PvPo&IGB=$Zag z9b;mi%ft?j;#e`q{pHTkc|zDpRSC6bB>AX0tUak)Y(M*fhia%`$iTaoejmum}q zyObxRtqkQn33hCNLQH~_{m1F4pZ5lDgl{!qjlSP55Wk_H`CUc524+S1u77IJ(Ge&8)`2Jr0r8cLC!;*|yb9n&DkTOkCsCly8p ze0=q?9mdo$@^rH=>>gcp8v(Gwf<3cR0RY(a z^7Y3@GQ&H|aiD#>6u3+Lx1B~V`d9=(US2~>)?p^!&sK=*@CzNiU)ektN6J6{Z=<9% zGlVBdO^yF?Xm)dol94a%w%9vQ3&jcFr|}^#EG7T@png;f8h(>FkJrg6_4F`R@kKJ7 z{MsZIa=#)FD9tUTLrD^iEvmv%C*ld&SNQ8-i-2?2Hk(uhL^FC|20PPq>SMtDNineh zw$S}ERzorqWn734$H~`ZvZJWCzbXUznfoE1P7N}>EdpyyAqGRb+Mbuz2_z0o@aulpYjKSMve=M>QB z&J7xJekddx@kkpPSp_O!2_W>PO1j4W(Hmoe85|>h%)z^&x(`(Tsd9h4 zhfae9+#J>I-JkyZ%z)SB$ObxvbQo+aazFq69eE0vG;g=>{`akoJPajJ;HOUCwf}#9 z%l`+bL*#FHi*#}{oVBq2bwm)4f2o79UeW!0XO^}r6Xx|bp@*-G73|CiRnS(HHXa~d z`5jGo{C>9~eh-$yU96yI3RSrgugoWy1aD5^D`%#sg6FItZ23suwW=$S<&M;O-3KL_&H#Ulko*>q4^Bsli3bptQJ+i5yDmk{w5>+S!w}NcSnjKI3e`kss8=qm>#$y z|DUxD{Ddw9TnAE|74ZMra4OUm@LSFk{{z|m-Z4Z791we8a)3MZKN~rdCPCYR`7fkN zp*2(D%MUK5WP+`zXry}qf{r0*t27KoM2#z%<^G2RhmI%-BFdu$R-vC**n~ROz}5h6 z*o9be>443so@@z-dj7Sh4kffsOm9$<_awewnczQ+1eXCfa6S389Hf7_fB4rG^gqv< je-EAizrA=svwelq?WJ@g9$1Ni0{$q!^QG7J8H)}Q5r diff --git a/release-0.20.0/docs/getting-started-guides/k8s-singlenode-docker.png b/release-0.20.0/docs/getting-started-guides/k8s-singlenode-docker.png deleted file mode 100644 index 5ebf812682d27e325cabf532f6a67f7bd69cf86d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 31801 zcmeFZRZv`A*RBnOBxs-s8r&_o2MrP+1WoYZ?!h5w6M}1ScXxN!;O;c;?$XF!Jn#E_ z$>Cpr?OnAGcGcp5S*sVb=bUTEb&r9+oQyas(iV$Ve#9-+V_T8RM0} zf|vJ~^pu11@uqSRef|LxM60C#r4?4(mrPF#6Zwai?lj^lx?Fdgyr|g5Vvrf)Q4z-( zB>uifb!m31W_s4>$ZfhFM()lFzTHj*){{L=1@myP?JLIX{?02nTy)r1DzL39hKBIs z*P?I}cTN0pak&!R6_nt(9%-N)G_#GQVwVw7ybqKGKJvpdB4iZnfk`V--_BEDr z*(k&Hr9smd$#|HJE1L1~>%>nm%$RXn16x#S=Kic=n0SZ&r*JR`k)1q^Hm?G2c#M-_ zoU)D91K|B7b+bX!u_hbay@t0Z6`yZ(S?D7>q*wf$J`JB&qJ%Kxc$Qd2i@{Q=TErQL z9~2QB9H>rh8sD_cE)ltZzUS}#4pls%+8<7SAC#=RWWHa>)PxOlNuicNSkWA%2vceC zLTF>9Q1*xf=JYvCB_#2T$j4msSLZ4UHFDtozPT-IiWwvQHWxI-%c`%%hvzD;{}8Ig zn~fs~CYQuwGZ5Rz&dHV%9T-4)6*H`Ve}(?I*2-ft_`Bn6VoEE{$_mw4_;W|+qIS}<-udE{y(U-nw@!-$YSqp%eG4(GO~j?RMA z+uUee6kcK*%KH6b>y{Y#Yk=j-r}t!^H!o2_^=&BA-{NH~d7HPvVT8T3OGRP_Gcv=y z)kY=oWc&6ELIUIMDS`eh`Wd4HoQV*8`FnvG;0UtJz&iXe{RT4u{yqXP+%&-u!34+%#I#&Ao{4nfHv^e1@bbK`gXOZ`E+?db0MEt|he+k`; zQ03y%{m4%fk>funw|i5Mpz-52_2mc&`-^*6H*ZiZ+_(Y$-1Rf_QuXvZxbQ z;!B*?`IV2g*aEL=+HqF!k73^a)M}4F5b8yEHu^yY0sll)I822C7DQ?mPL>ImCl(*} zDigmhSR&kd{n-oOG@V#n>~6d@U)7)$T_v3<-H*(Zv3jvepKvxg4bj=aH(pt~lV#Z| z)P;f$h@7B=V1`a5?NDv?(wMSmGdlac1h0Bp@m2}Gx!2-;WwqoehOa@J4r=h+>p)$h zI&o^GgJ2$cp|#l_>$;LQBY6;b5G{ogcehZ7A*#Wfd7+U;lTesbd_jMMu!V5%4QgkX z2j|M#k@=uIcYf8SEen}>-zZ5yB@=-u=|h2|KtUT<3H~B!N~S@@Pt`;k@%x>=xDBqV zkfv-gMGA=)CE71Rxkwr+OxceFV#2dBJRj?XoQ0f4vJ_BrEhkj+W9yUDWSd0YKDsf9 zN3g}5#jO1 zr=(bXdX%o8ZoIC)?vGWDE_uqvU*KOg7_xanJEdckS)^}-$FrQrYAdBH-_04!F%yb& zWkSazcDl}qx0}up4JZxNH)u8pHr{Mh^eMb(XV$)EQ^3m#iU?{53O!@rtQ%e%p64tv z(R^&Ajk=+;q;riTi!zLYjS9{Gq-ZsXIhmAikuN*JY)WOSV>)XJon$Ns9?ltdOdd|s zVt-t}^W812_y1mdYkJYK%fB1(CjL$H8@xA)Z(`WHIq>2wuD=I$7VHg$2TrA)((#x$-G0Kps7<#Soi&35Hea+XJ&yK>f zQcNmLS|##FX#(;oMJbsr;w|bPeXS!TbJ~IL6WVgq0@7M^l65jx^vLtW3r6WO)G~Ox zx%H~815O0i)Tv7SlO%sh2LG1+JTn3LqFp~+IgDbqX-vglz|qi?Ub>*FTKHiqm8XNR z*EPdA;f5ZWKTstw340M+>+QkY&kTESiB)M;pQ~6@?v~zm%yq__Y3RB2_?WKgRSab> zZdMiLF)TT>9JukuYm_cxH^?*$U%t8|gHl0RUh?}o`8K_}nz3`BY4CQN1nq6F)DE2l zt-Yjnp)MPj%vnlO9ikmV9m+sP!8yj6V8FE*wO*+uunA|>XAIJE`j$4KI3Km9ws$)q zJsrH|&}q@RIKw}CUkjy2lR^s@5A2D|iP(BGjI8MwQ=%NMTvGGvO83b0C`aI(fWJVn z!0Tp*<^ngSYn^+zdxzV_v+3il+i9pQJU4tH;x~?5!yS}D;^k( zErsp);kS5~*rd3$n2T79m{g3)Th)s74?$`{B-#Af#Q0b)6b?3dS7VD(zH9rdNNb0T zY+s`*_UCM>HuCz1i^H_qRITZV@QDeR&>#I@x94qqDn8e$bKHQRj%e_O{@UuM-wHm_ zxHh;8hmY|t_Z}6E>D2JolPs3Rl3at6eP6X~U#@iuUeAjRi_D;9%NxxbH1V#yt{fMp z)Cnl1*I?tPZer?S&tMj*?=zV^RD7K-G#dVi##Ys^AvWaU(}hG3MFQmyRpbiOa)^<* zK}w(e0BG}kJ$~J?pYZqDZ>T$mA%~;AQM1E?&s`hGq1mgVpHszO=j&t~HQMS|E}Hj3 zEl4aRW{>+n^amT@FIfgaCgfA)OPjTgD~>k1h3kanSDF}x)L)r*nPZtBEE-l6na;8fhZjubCz6m1Ng zrk~a{DDO8b>8M+4qnU*2hgP!YmN$JYF%_T8+0EPqzX^@sY}$3HIY^r8nV)W1vhWy( z4Sv@3Qh*4PpwXlEO3tk4y+xPK!b)Ms@Lu|EeT$KYmWSwp#7X$D_)qbyp7v1tN#2QR zu3WB2&i3G6-DPXmJy!S27a}gN3wGq#GU~43xk-6WR(r0AkCIXNW}O4v@^`53Q!cAV z)B@DfrWU6Bt1~%GTt2xh?RbtS5e^YD2qrwbo(EmV#aHwhNezb&VI?N;q&T{t3U~iJ z3G~PDeWz?EP+z$|mQ-9?4Cx2QlxUvR+2qYPLGKh}3XF<*G6 z_T5c(s*Wt0cD_~IN3RuyG(UISy48R(K`!gvHbNeg@Sg>~xIJWSc6roX;NNkB+>gG@ zL(>!-_|AQAe6P2^mQIZ%OP8E4Sad&mJ#CoRbiSWDtvy`fXB6sFE5h^`byFhS@q9RM znEpfMhh6a^@!_DGpvCWH=UvDBK{4ZNKU-)Ys;{C(3sT%2p-o1*zdMi3M)%?bKSFYw zd2XjJEw=Qx*T)@Ajdq8?_u5o52H_fYnfK~FBzL;IqJh?QlcxZrMML!1Ai%Nvh1k_W!`WSC)yeh^1 zrI+7@8k#UX<2+4dR$Rvjt-h?k>p7~qOf(y?cH2}tdKh;68f}Y2MgsSL`z2QmZ;E7b zGu!e2Whu@!^c5bbPeSnX{Pz+HM_}h{c03Dh;j7~}qnDr{LpS?6`0PNntPcYgg#Pbk zEC?4|d@^&18Bq0{0~Jj-!}bSsvhMx;9#UVr=-*2~D60)g|IX!T-DGwIT51%y4U}HQ5t+W!d1z{ zlcD-w*nSI1EgqxWukLP;YFzCz4YB@APzZhup|U~3TxDxvm{=o8Ns_jOXJ1e`+U9J6 z^UtbnW5OLUVxTo=+xf;;fQXzmZmM|HwJ@3f9GZjosf%K|Jg*>tjU=K`^!ayNJQ2RU z0z2UNNB#J~5Bhg*=-^#Sl5mx#D@}f!KVyaP@63@C%{eq5m=+h^=W$BZs#o!x??2XL zHxs;UuaN)J_~)T^Z^7w#RddBd(hc7-LJp*bcQnirU2Hy$yZf0tXZ(Gb!%~DseG+&@ zNV*$5ZXFxCGR`&s-5g*?NWen!qN^e5SXuGjhgstH-%9Gw5t{yI5rJbPK_Q2E!MTc$ zVdQ^~Mf>LqQ+`aPAuAJw790Bi&l&VY&?l9v{7HXu>tUzf^GKk%6x>j|7kUILQ9Jsx z*+THA=-ce!*Q0{(+@<2}_olXXni&KCdI$w*3)Y>MzHfpc)tc9>srd}*UU2Kq3R%->*oTNo1X&qFIiJVkZ)YO83cVP6s~J4q+= z@fh(GD3>^pe+W7@p?}}IU_Y&4x!xPzJSt$a^vISv{gk+8N!%^~JVX^|wKe>1*}_+HHZG_18;Fz^B>Os{;PrQduFgveyC# z!-9{EYxaxw(;J0J9_zz=XF;;iwwJ`~pXQ?j{kXhw;L^#Td71AO)m$pFv$NOw61&eZ zXf|>eeVqGtwdmL&89`<6HG#`2IpLkXsoJfLTZP?@f``_QS@lcLD~QW*4r!6sf6oPG zf>2J8W%5bI>SKs)*~(^t)l{MCVb!#zZNpKsi|*LGWy7HT&RAEG)>2tPrIypmbH}5m ztNMPXmIaHlE^L1b6SMV!IJU*Ro3lkp>ZJ9+H}C9nUG~d*7U)YFS6}h&mwq`xc~o0o z7<+xS8pw1j1wCviq0IAJtJ_N6d&PI$8tGZ=CzJR3Ki0uOHg#N7cQ(RI@8#u;9@^Dz zLCL#DCrPr=Mu}*~y!x6Y_xYxW+r5XeWS7GohZ!B;O#Q=+7%d0e%>nDGsw&GAw@d4J zi<%@^U!2hI0|~y`9eVzr$j?k_r!vIRQkELQnQi@D-)IbM+`5DCESFosmL*M>NP)+Y zaze)i7Oa-X2PkyUuSbqT0N6FlacM651oLwLH9k!L^B+RQ?X7&gyIBnPw->gN((3I( z{9iK;{A5+UFMLc+Y{(K35fsMMgeF?fhIoq|k08y-a$oR=Nkx3FtNE@LY%OaR9c+1z z8Y>Kjxi62FmKfA3dxMGi=UkN7F!cRPU1aBLuYSBh{rE{T!T6;cnZ`_v(~H9<#FMWE z-Df*Z|Lm5K0fzCzk@ETj;q@67p{8Do0LS4&#dmur{-QjX_r77y%ixy_s9XzSq^9Vh z-mhi2+X8==zIr$zw(bPsoeZostcCC@2$QJSv*>l#7L+v41!jE{fSmLY9~HcpLr2## zN_NgBzP$jA67wZYYq}KiZYA2fV!~O^l`NqWM(*X< z=Jnh%!J_&%9mdM_@(;B7y^$fMA_Iycjy7+ znd_`U%m$`^C9(iYlWZI-rDF6XNbpy*L#OYe$yreiB>s}89@xIcT=|TzZf;FXJ}yRA z+;3x`gGQ^->XwpcYV%tZp9*aMvCrUL(o`P*B)gK6?@89(c$y2HIHjf9&riTO);UQI zea56@u+|?0#uTv0z@%%XZyP^5y#XO-c6{z^2Z<6{`{8fika8nB%{y7GG@cEe>6*2B zBWm`BJ%)+AvffJZXvT?+4k5Rt2ALsbAu}~HH?Hrg)mUo8D~G}RanFg*BRK5{K=;`k zx6^#Tr}gq!!{1&{sas`<;#)gGRqni&sR(s@8ol3MBSMA0&-qPb>mU|n3Z;PjO4&$1 zy~CCFW$B6V^+g8}m%Ic!{ickm-5JlJ4k&kO;-fHcJn4Qo3$xP9MHKC%{v_dX(uD(k z7%@by40X+@yC~#DamE=*}p_tM(mi5<=)ILKDpAE(0t**LEmXWG^n~ ztpsbntq7-tmiNjozdJ%iAjVcC5g2~A_x31l^_{iT$YJA|Ov=y$i3CkTo&AZ96+Dw0 zs;}X1F7`K5hRs=sIPgR|*T*XlKezfGfpCj*F`-XR(!(WEojfGu_5m;LeQMc<%*s zLAH;0APwfQG6?)Cp9QXhb#Ca3Yuih_a`>rKK$oSIAr7rXoKEo_p1u0-K`Dp=BEZUU zFNX&&Z84V&{l^p0B>-N58lvTsaMH}e1sV>0E=qoOYK}X;deAHA?v4MreDZLji_1ZD zY&V$1J58E>42OYEF)RQz_o*4yLU|wwLhz$KokO+`JZ8}`Ql;Ud9bvi^7hG%Gq>P8r z&&4D4m3V*0%rqogGHG-MIuT%Z*Tpze_v&ukE zbdFa9bskPIgY!GD#XMFI%C5hPZ)&pYhx(4s^o%EH%e-MVREg6zIW9lNL-M_^BeKG` zMF-V?LxFaSz~38KNBzeS2-#zVN$jsf-EVhtpx85|M7p5|*650UVQ7MP%o#uL*u>>Z z(SPt*Tn12gnt5-xjeD2kGi!Txs2f7EooLz?u^mAw10spm+qri-Y7VbyF7D_6T?$oCphUv#t8NBX`3@fYVYVCWHjz;=& zC=S`gmfH>1;<_VIxUuq+Nb2xOs~dG}&2-D`agJHg9gReCO}uhT>C_?=jk-I3i zPzuHz`1JgAkR>-}IYK4|zuBk3mQWIX;&XPIY*(CA!m-eI;w3u%UM;>{(K^CpOB!c{ zi{_Am49d!^s!Kkx`2}HPNBfZ(ChbR^rI`4iS#O|+NxTKS`1|R~KiA|E#X9RKcLw9m z=_BBQ+7{}~VL>M9<0Jy;{EaGKytqQN&V+;vk*QG7@%^%=;1ksGkcypnB7?Wi(|n0e ziF)K}ZH5x1;n{6bIvkkILRf3JNIg?oCbSq_KF*B>rzq7))dKSKvo(v z0{!#J;@O~9xDqmvO&w+?x^o>EW{GK7S`h^ZRe)x0^5uX!HR(Cdp!bAI#Yt*%{}M zinwSA;Xq}59YVPK$;%e&ux)b#BjmYX<7 zCEkoF_(tJvj@SKnPhQgmNZjo$@m}JH^xbokzB{HOi@x?HL`rsALN_%3I9N)fNyZm~ zGCj9BOhp7@DD*N2N1lg}yg`4Bz$Hv0N*i$+8`Hxh(&+cx`&lvrJn}&WYBA`e6RWMi z=v>>exhqFe3E#B{9tv`W6Io)Yv1DvaZ?f;eB%5r!Mn=+GIvsoh_*VvHe!k~^pXVTB zLU`u)?VN(gLZzS{9%MC|=}u}QL2umTxl2s{h0mSNuJmcg$s?~05!;h@o)Np9hqw4r z5$y0@#k()NWxEYH1_z2Z2CW+%(p|+3KS#s(CYo5ms!3Lsl|q*F6n%o}$i7`JN-+}O z?@pr=mq1uoYA`VRN;WrQMkrukg1CtdJZ(UJ`j!+HO*;$<3SxYzB)c3d}Q-{ z&XtRV(Y-aU_&#P*?7t~zE)AU6Yk#?fbA=`kMa=j1AO56lbYVg6n|1NvXKvP z82%RUx%+?eayfq>JEA`+&X@f&_Wy4C|GgkU_Wx*d7SG9%(s@$-I&uKkpVXd?a^#Q<6vF0SEw8$~|K_6k>zo?4(4@q_gaI5t zDmO3B|K7F8+*d{Qk@7`ZgYNlm6_M96Q_@_GCj{;2y8rdKGZvHrW%UGqAG9{Ga0o z3z`wq&R5?N(=~cF+8#C3{48JV&r$jq1_Z*05KIoqKV$Enf@7m4*vY?e3#9~*Ou$nL>b2lEIa0%7XgwuE%5zc7yx zfO+=!c~fuydbi*aB`BhorR5|3K)cimU~IGY+4NW2VBU?$&o-GOlz$dB_Y)i?1I9}f z+~w7haB}hbC#XZ?xR#fbYy$ujEBRdo%D>j{BfP0p9?MDfTb0t*gYtgH!{ZLLs~Bu1 z&3$xBaU$nT-rMbrCeMN*h8@PvhRmzKK8X$gQBwyMkF`_7{bqwU78MoMav+xFFgwB0 zM%}#Zr(ibYuIQg76;0JZh-{Pyy22P<0rL7~!{Ouu%a(fw$A_D(hJ)&P#whcf(~ZLi z=#eA9G2%n#%}SaUp7Qzc=iA{Q^{69RoKN+Aeap34+z(^*LahD9zJe@Asf_vhD9^F{(#}%PW`c0E)!3c`2QOCDOQ)8XSBnzP|?HpsPzrTldTr=0{dZqHbFYHXY4k7vsgPBj->wQM-p z#9OT+XGR(16XW~tv|~6JzXAEa$G~MV$9@I4`dc#ropU1q18J6)AsCLPiyh7yrPvR6 z07&XtQ)vY&1HU-@svn4aA(6*+AyYD9p&5F($Hb&jKLMa3YlzGBVZ%{9knKYTQv{ci zoL2oIYyO@n&xE5dMPYoTx$3Ix0=yt8o07n$CYU0L<*Z9j`&apbwLYy(g47 z<;`WbMWmQEH!q4_Pl$BY@GZLL^naq(f9Pc-9Jo9oA{KQHAanOw9j|!blK=iE{i3*o-rJ2fu0%qp`WgV*MEpS-36z%&7*P!e$EiY^Xu+*;^CR4+4& zNN3thbZd#)<91}*$ke|ahMXpRpArRY<0tJ4*0xSk+m~x#9)I}Pj)nR%A903_j>JQW z4!X7{m9-9<{0SJ$%YRcnM4qlwveUi$51$1zj7VN^d18bg^>H`8m7N>(QhE?gKQ|UV zMOGpa6;VB&&|#(x?OD%HGR^nyK1To_AW^3)-FW4~LG-N^_HfRuM7p4(dcgUxZcAau zp6t)@*^o)y7bPPS?VS5XDYcN~2#Gs|u;7$=JU)axrzj+;ZvD8CVAVYP*hn0xf{^hc z*yiHm!bE)neRzr!h2d&v+_%OAmWg5-J)1i5n^%R7;iYzALBSca;oFcP6yJ*P?<6a; zu?o5VG6`OQNuUro9}&r0vVu6R1uq`2bP&!Dm9p5^f;dE)&;+hiwVcXMs=Olc!Y%b z3NR5+))^n)X@DdULfI|rHlj~-|EBsMlZ7OQCG|_%n9Z9mrXFzQ(S0S)9%EB_A$~Or zHd3Y;yU2{StybV4t;o-S6+Kx8za%V=I=CIM`Pf4rY5#H!rcdJ1 zV3CseUt`~ZAm?X=!pA=!&3yw5DcTlH%KsUoNdz3+N@3(*T2;OeFf_SfYX9Yr(MF;M zd>J==)*oLA&L;(iIBL`g{|fK^&reOrqVD`W_{MCZC#8fwW;6dO0zibX-XEWIvlY7X zrVr>77vf|lCe^?Jk5S2mT$a2QCF{0c9WcmpyPA9l1QK3|5;WLBebkYt=6Fn5*kA=J zIhm)s(w)&?UKQB>xSftVZBm{GEJ8VYY)vj?P~&R}2>jO7My&tEW_pGhncOXW-{eEo zPl?L;P$2@A%$TN0Ad5;3Lil7)-z4!igDU3hXM<-_htaw3$>e~*rOHFCR$=5ok?hZ+ z=Q08tF=^j2ss3k-#!pBUl?!KroDv8Zj5)y1Jeu3L?ssDvYI#3gnA`L8{o@TbL|e_5 zrV<>i9q%)93J%m{ijHcl`yytn%@xZLA}L_md``OWZEoYgOlUneLky&1K4!jt`WrOl zaI@xfca(ddn^dl6zjNKiXZvn^(Z@;w&dtf7@^pc3YoElU4#}Xz918{WhAirex<@l7 z8y$Ht**~`N3u2+wfEDz^Vi{e=O}~;j9#*1H!UZXiV3RPP-VRW&sVA$hB_}ow6%`L# zqG&mLB+Xm71UGzX6BpIM1P4%j8<~u&KGL%My7MM|X;Y<)s^OsF(7(!ZA$;yyE4ee^ zPA&H{Sy)Qzk)}m2Ejq2ve&i$sI#b&gEpVQ58!3M3STeO$B1-$uTsje4o6A{pgfi=x z2275ti*-6A&I{3|vdot_LOEmyY0HYMTx{1R%^fr8@@Jwyz_0XdFg2HkvM;wa!x29F#h`HTpiW&b{_RGE|6b$OvQ{C^Rs+$$?sglU&y~$?>$n#%ORBAiug@qhdV{c>hk*+WuWV zMUb|9Up*>zkTaKL;FmdMiD65Q1I5U`C;1c132L31d@0irQt76V-+69QTPIB{X@CtL zBh&tH;VI5YaGO>vY zr!Ogf3OR*b(7AW22i#trMe$zb;MZBIV#<+LAN3mJCz+PIol9Br5PpH1$$Y+(5aQ)IEaQv1xHxZb55$SOP z8`2}<=)C(v$9$DJT=*?=m0R^*$KKhra^XRQg!v#ft8DVgT2I4gS$+;#It^^_CFQr? z;;O^Vh%HrszhkH(*D!3H;nYBfgBykm=etUKwXoZi%Q@( zQw=Qg?pieyW^i5n)x@I`By=%X&*fV^7E1j@@yXnmHD?a0BupW=3+`c=T~ge{$fMT zT9@mdfZJ{DQvfvI^-q>CB~zL;Bfn3}i3^qDsjAv}w1l`rEv_~btm>sXXFCr7-Lu)1 zo}6zr*mWz(aiJCbY*EwYAWB{)HrjSKr|2m&>5p>U8OsX6x&Mh(o$TO!p8}}MF83GH zZXVjWni*Os8R}Xc4kIt%EIgUq*0ElkD!ef0p7q|b)5Hb8)Er_Q8Ss%;Fotp-X{-ro zBsYHKsdW2UmCE`#%fl>iqNggsb@l?Et=kQRSeq3pu&eaA!E{)$bU$RjX!m)V4MXiR ze+SYu$)JmS-u;$k9G=eO@o?7O&f#y_zb!7XO<^kRkKx<9 zXb#+4tihSgi5lmPN3J!!G@m}6HL}z=S0lp1(;Veu-7wgf=i;V2lTz&u){12{2zX>Y z>uS8+Ex3QZz)-WWI_zxPaCh3@G)e{ld={tmaPjQs^=U1SCfWX?RLU&KGWghY)o zWOz0(nb29h-+oy^mQ{_Qk`CaKJQ7RoKv;k6a1vmf)uY{AQo(cZ8GrNaQv=OeeUw%A z6eMQe`jFbHVOWWQ_P60}Z#>E4;RYi06TQ=tbfUQF zQcdecHBy2PuJC|%i-hlB=Vzz8lb)R2??4JpczF(N)5YaCAR)cdMZ|v-Aj%i)&1{t) zwhgbtq1%aI_&j=@nWg>!fKB@Fu;*mcy1at@! z$zPN$AsE0D+LM}s`qI8p9EhOtuR~jG+0!qAtz3W504ZWmUEb%McZtu_ENV_^0w16I z9RgW#Rwr|^Wa8_4=+)K53jb4S$|B$&Hh$*t;2MfQo}v4e#^8*STTQ0a7WFCjT5}ma zhJz{Qd%XB6%tG&6N>JvFFI3;SXi4_WN#KMIPN$WKoguiXY%h$t`rCdz!q-^aK%%8S zU0%^yznG-yPgB3Eu+fxua| zRqm-!z%s`88b8BSOWT`Lw%Xj{2YC56u88+&TdrEGu{I2|E)tm>9enj7pA9TF?!a;! z>?@B=I%SYnp{bqLu4)9mWMxt(WE(-z`63)At!cPhGk-ROB*GIkO!d0Nj|B?->jN0qH!{u z<`HJJ8h;?r@3WDG``Up}HrkLrOJivo-fJhgeWYj00)>lSJ{e2$hN4TrzZqBRlc+e$!-{ z9`rSWIOoHISf-PWckMxcIQzkv%cE7(Jn3+HTP2FYxlb^2_okT@dnmf>>IhI=m#!FC zbVV@~%;$ebCac?+crgkWjpcEdp^k%B%se3~>xnOBEB8?IsCjtuJfR-6cxH73CXE&J zX!Z!`r11e$YbKN3q#Lp64n*kq-HwQ$Nh6BVKg$Rt72=*FAVLwstu$>3i|Hej7^?u?H42WL40AG=I zeo5?cXWfH-4wMR{ObKjKVxZg9iR%7B1*)MU+*)E?a05C4H_BPWfFS4PKXbf_XOy^d zoZmiNeC7eZB%>3&I~I9td5M|MUzVrB|m_yGMowU zlt`HU)!)PS`L~8yG}O-$7x&NUpOL6}F+kZ}NFUGLFI}x%OCfGXzNgjE2%T0Iwx0G) z`XMRq^^LFQoVL*7Tr1Hv_LSW}uBUHLdSVd|y7s3_goPpFud0etoZ2NfMvycDKW1%%|IKCyI8oh|j z1GU;)Y-RY-*>#}gJEb(AmbFE@0Iz%hB2??jxcww1o#``EwUl3wv^rcztJAXx;a}i@ z96iP$FNDZvus#w>MHY6xn#!?$wGY=s{kmW()Dj+v4h=hE3i*4(G}EB3kxl=IQI7G>6@z z$4%*d2DiWKu!WxnY#h#qtf9e-*Z`VSe`%3&(?OA2RrV61P`Zv0oz}g+a|-WD7LF3# zSeY#ba?b-ji=Fpt%9xQS6KRVWVq~^xs+kyQvf{R-3;sdX=HKk^gsvdtzcQALGhDt-?|CL0+UT^(AxqwYj6^mv z3;+EC{%>983dANS=y%bI4@y=}sqV{Jw}tA<=GYdX(Xm!xoP_!DvBr-}4sd?L`^2kg z_`QLo@|)dT6YOTR z8-Lw&>Q`5Ht<7c!X=l7Y*}F_$`3{F{uxc{<$`}3J8)Gi|EY>~9i6lHlEWk1 zB9nghd~t`NZ1OhnfM6?fEEy{oDXZwFc+ z<@u}TTJsC`q@&o0)5U6=0yh^W8b?+h^A?2n-iw=~bd{Ire(bO(J}iw-1s0+krK$tU z`Yv8y!Ay?;V!Dsvu_RGt@b&%Gdi)+J0!djW{7#5Rl}7X&w2cDCl{m705jahZ)JxrM zzCM7!s1|>W&_sIn<8g|wX&pLk=4g`pU|7uvV?W(oYk0NPwJ*E_hipS94s-uv?Cu5}5DygU%wiJGEK?wnJk zUxXNoohBa~P!^G=B^`*`$;iUqC&$doIK#(nj$4iN-am;K zx?gec#jEsC{__=4qpNNJ(F%jeUFiW%a^;9i^n_lcuOFQfk)CZFMrQ{%XAIAe>iF23 z2&cu;l9@vwm*FY#=nJL&ryMd9Cd-1-fsjUvQ7Km0iuG0b5#KDIa041at&JAnuFZ$54V zTBh!Anif7Rj*H7d?$j^qW}-vatcJ|pb6>6X-!y&}UELkLwT~5AH`L}+0eAZpn`8I; z%<$a@zu};>_{HfJ?v@|B94xP!3-b)D;tIsT_e82d4P!`4i+LWi^XYmemOU;z3i^u> zyMZ*F(6`A0EPX)aVGfs4)XT808DBFb9q9hf^jeV1?SkcJU2<#Dy=3=9aaU-3C@!_a z!qp5JJaRJg{u^)?{fsbnl}c+t58dWd&DrX#&kO6$Ku@c@zf>m@;v3o? zI5;HUKna5`4k8IrlKBaASrUGWjKSB`GUo+VCx@i3K(Tf3WH%tcNFL5z{4;n}+F&8W znMF8}(@NAf0<>?!pIG^m>>$6WORtn(Uu)oEv&XxHTS+ zTD{nH+e2KR&)-`co^E(_wF!n^9XZM>jzOxe3Z%<&qp*;6N`1H9b%#Xl$zTkPMl_&c^wia*X0%R|!(u1m){548Bnv9~_76qV<^3v=he9G3foIp>7R z5(!9><9ANV5~f)I1ENudV*vTtwKx8dd~tRMRo+^lqV|^a6G9o^`wE{Q4)Zw*0Y!wq zk_jA*AZj{f04;Vl4|cgNYIoqG{X$Z0WfiC%FRE+pT)+w1W`^_QXLD!B%j9q_yrTe{ zOxppV_M1Dog_3Q>a~V=wvaZ4nczvkaP~ix{O^+WEgX9i?((*%E_s)inG0vEC)Oc5GdolGApTyR~>^K$2{~>70Rho399! zfAIMe_9#&X3gw_91XG~;wOAc}puAUj?=qcs`ULn$h{3f*fi1%^Em_m}=~^y%=KyHl zaa6f~4fYedK2s=q&PuaVBgxXv@%$isWKJzg_K8!g$!dSEBnG5|O~e+yi{2Kib<+Z& z_W)KaN+H_70ke`YH?}TuO7Hf`FXh`Cy)uKS5BQYu-qP~tF$6r7`Gcd;uQl<_my(|~ z)Ta=SH->Kd83&eCjka%@mb+p2Gu%|t79m8^f-@Pa> zgC(vCehWqK94J))IFS?GuUhUC%1oJ-pz;w>iek#-Zs;KaznDE86)yi;6j5}=E9O$*ke-KGDOt;$Klm%3@_eeBs^3B4*gt3E0oFMr&0 zqbxI))&lS*D#r#0%u1o{6K-MVfIq^K@iHS_>s9P|&$*WJtRr;54i68D^hpAu{M5Rs z|9EknIn{yFE%L*+JU~aFTGNyLGl-WVuM%{O0TlpM-?e zuZR?gqI>5AQ=k_dMi+Dde*pxG*ts4G7S(0N>G~fj z%TGx0saIilzGUbxv6~fK9v{JNCEt{=t3-7rTJ|(QY0sk);dzAK7uCTjHh}QaFIv3v-D`|JA3W@T7LoISL>ARb2vf_=l_fZ@o{BQ+>IS#UmJc zeP&PTE%P)1V_Gl+)Xsj1V5BK)Hd26$1V1+vj1b8MwyE?mAjMz_d2PfE2-9pUC)^hY z&^E=>jg{ZBA_SQ8mHsG2AL9V^h<1sv>fd58;N5)Z4~$WRm8*bl{O={#2Nc{$-5lmx z{23dOgzqz5`AE&8@aIOXPs^<-CC5$kr&1h;hiu>L4i&_cefj*c?$VT}pRC0{S3E*2 zdeGVR-qLhVy1+yFC}8TPy;!hRyQs(d6kX3I?Lo$f;40K$%T6XGL;bjuieT1N%zs{v zETL4=+qCMHY4$(?Z`}pMB!{j1pzH@d=ZyJ6N9hl)RbqfbGEb=NQIOmkz!7}-a@r`M zi92>A%+LjnI#dIByr+N6<>>$cAz+$N<*mP&d7<^*6qnkU?vr}zDZrFuq@YJh3|t%2 z2*cAwc>31~yTmZuw=y|eXZSkWzD`!#+hj5!$|h~{)=jgEk^$bj3WQ}1JH`f~^W~r)Wf_K%k^Edtn<6X7hDc~Zy4*EUfA0!-_(!?>PPXJzGaHVXUUj=# zVa<203Wn?+Uf!rx{H{H#Om1$h!7jAjf;7yfNYPXymaziwV!2Qr#Ln^5TYzKK%0}eYHF6?i%^iYbm9&H&~fs!9#aHD6M_}-8$b-< zBMz^9!vGKe1E>fWqDE&Pk1lu8M; z@qg;hS?mobzpon25N`l#6tbh*@HeHNu&Th|Q>BJC;%kDAHTXFp)ylY59(x}!D}$i@ zqD?i$06YMt6Gkupxg5$HXsd&00eKm*U2!uYf0kLpjI3|a!>5Z|jLficH5)Eq#l zZ_TL@TwiG(Oyn7_@D!o-0bu^&Vg+Zlf!Br0Ba`!JKak>T3P|YRM4*$t5^yE7HPFAfSA9{r=FgWv}Z^IvnU~ z(8_&0(1%&@#Vt@wbG}mz`EI7QRnvS?#I7Tz%C+QL0Wi?}g(u_~3{(~MyCqFX;{kmi z)#R^W?EsPg`-vW0*lnzB9neKo|I`-t)c>Wq@Ptb>X+{N3Ph`DV5fXicBkmgZ%L9j( zO0)!14ijyMBsZ?&(gmLis(A0u$K9OIjh;%1N;_WJu5|}jQ22}AvN-Ik__m6ik7d(- z&c41{U(^fbR|o=WF5q~_KcAC=(qsVbR3Y`m&g-C;{U+nts;nN55{^K3+>KqS=kMZ% z!`&m)3k7W5@Ye9FZVUkgxmy{6n>wy_G-9~z;itxr=BuWo8=IZav_7L(nfOv{?v)&T zHPz}1sSN6dNWD41hQa9}U1Y6}j)wY7rB+B}+VBt1!t5mMeYfJZ#hk12>Qb|q{WHA* z#!Wh3vzHdJ9`}Iac_^4-K1W2Ym2A@hDSt%Sm}&k(~k>J_>R0i*{b9bvscHS6 z%CIp>>YKZl#IB`GG38X!@$17N5xCHB=eMh>> z)#2fo6jPOc^Khn!IRNH5lArG&I7xz9C#*-saBjFm8i`r;{XAs(nL8p7MRv&qgLWKo zqX9O0SiAPhW4QOT>B^ANbauR*P2~u@i1_t!#KqxOsNoyt;)v*B4GT@x$2`g{#dWejHx=vqC_RG-In7meVJmE0 z@{_B)Tch3TGxs%$U1zdA=J-BePLxOyy&E#>A8^+^n|X89xqmKS`}Ke($1JY0FYm&6 z&UAj7QNNRY_)CgW63aWRgWj*z z3Fxr;e3H2Etpl}KJahn+r=;=pKB0w1nq;?h~QfeOR~wA5_AL zK?W;@6+<@oR*hv>Gaw@fSECvB_VA+P(m|I(^K+I;UVV2!Ca7itKSgaogkXYm`B7@9q*%MbiO^O0 zOc$pjBAUB020P|}TL2>v5Q*rEM5c)0VMLPr*cwICW=h!^c&HH5n=a@6S950-6-T>9 zY0^M|;E>?%L4pLQkpvGA0t9!5;O-VYxRc-n4GxWK(BKwaI=H(u)-XlRf6keitGSt3 zvlbUn-Bf>4{Z-Yw_p@sdy#Nr?`VIheZW*z5n0LXQU0Z`!oG!?|Aq6IDiWgJQis8@Tz;CowV&PFj}9sL&xH`2UY78&KvOFZhVWH)IC=Kv z0s;bO{9_hCi*%3^_6gb8ds1F$s&cIh{hIXGompE<afyRNE+5v{+L32lR$b9*5*WmR&(TuouuSXkr%!h%*wavoh z=HbY(P_K#x*Wn6qVBXvY{xqV{ugQ?q)l$9f3tbS z8Eqd2$|8{-US9cZwQGl6=XU#h%;KXufa490G!(k>J!wVjp*t(~7hG z9f@P3GP-Uv_Nru?{U~Kt$%Fc)VE+T(8Lmf+LUz=FsY*?)+{uQx!9dAesF(P{^DnK# zUNa4fDSV>bp{+c(M7^qO9tWYK*ZmvUf+Ab&*cfogR*Ejv#pUoUcsOlybC9ro8Av<0 zz0AEKND*(dQR66WQfc{BderQ^vl{h6v5<%yEIAZxHEKW;$f!kH*OSn**bt4udpAfX z3QlFiWJu?jU$M7W7Wj=Us^`w+k=u7=JVtza$V58~mTw7lXOo9ah}>HqBj7wG;xLcv zfcM`1GNSC}j;uz;|0R!NaWpDbCn&^x|5KC)n@6ROmvnPU9!%@>*3E*h%jtEVp-#?0 zZHvdG+t;=G(;a=?E^VH}8lJ2MQ!7!YsH!ZBo$36vw9|IC4YnV`_@$pLzBviNj_jHh z+pZdfBWzQuH+@N#ps)0!2IgxeH>h#0M~*ekU)f&ieo}g)v}*r~UF8!|@ygGWPIUHj z>`3{*H&k3HgkEn9JfFI(I+#Si*1OO1Z-9g<*C_UpIYp9!-7D*tW2H;<_*HIYKnT3m6fl2KlT>E;xF; zk{J{wZ;5s{Nsut2W_?-syz8^#jMq^%aYr7nh|`HwG_o(0w7oN!v@4!5QjRP0N@KxmkpoB7}|&RXx>Bl<A+#Lv`Bj8N1koG28s%Knpz=0uA`~38bcVf{G(72Ro-6tirinV5nrY_yOVnS zG0}=ZlUT(~nI&w?dPWl~k&UzPd{cdURvi>hnE z*XC!s$8=cazuQMJ4`)0TR~LWL^0S}P)j`Nk*}}l#KBqj~D}tSoh1zx8hN(eGC1GC< z>Y>YpW>9c9-44f(M`toqj|Vmhx(H4N5)z3X55eoylOBs|_n<-}0=Lu;-8DSEckXsY z!)vJ;vH@|BfSeBm4OC(BR};P=9vU1*A@e~mjYcEEaMST;K1+ZqsQfl2hj#O(a`zjX zA&#v3c50tVgaeLcqNGKHI*qDT4J5x>?(VI;RmMd36xp zaw~`(a~>r9!~36L6VaT6as*Fc5uuy*)m^7Rd^bwMBgNvF*$(+7s9KDixoIaiyq;3ISMEXUiUYfsLs!r3pqcB1z0w4K&^8`KuN zc4H_uvYK_+b0PJ2TZb6BcS^}0Bi#aykb-XGS=$j@l~Q+lay_23#9=Z@^wQa$B2M*C z0U;tY2{cR2bcTT|r}X4P-%F!Y~wRSTb<$&K-Kbyja%O8Ub;(@Hqq! z>9Ooy-yAH>@It4eW(}k@@=ojX&lX!0mmU1zea*guX)b$vx}%4rjg;PSi89+|d#8fw z3g@GTG7r++w}-@+kw;jxAdDr~pbr=eKi%TXN-ObC#K_JF}>=`OztYky53VgWRFM#dk+0XYmG?0 z*SFK$5xEC{%Z|snB$?%*=JoqH^QzXi!%XN(U5DfTeiZhOX;V6t2N^pQOvd@86BY40 zQx4{@Z&e-WvwWXDuC9D>`U0KgD9S5ak)${}%c{Kd?!&}{@c6HVTx?eAhRvrGIHt z*LsN)ExU@lMq2lCAkSvsCY62c$Q|0RV&RLVO|3l;bRhGIeWqq9jgBD<@}Ve>Qpq;+ z{W5+-%$-v|4Et$7+HhKYMa~M%?~0a>b>dY&2=uF zPitMv#*E_)(reZgU>9s|gMxllW7Q>`BG5y+K+<8j|94!)Z=pPj9fR zmxv>(4^SI{MDSLtq*#fp+3AY=lzah1mo}7_7OC5(^k^fAx1a`G%>&rQ!Zr z!vyOUOL788MgCZdYgbGQd^&_{b`vTrc8c)J?0V>|rzWOILMQ%kPyfMlUNIrWh2w2k zpdbjJTJGBYRuglWo46oDgF|r}h?OpzkE_t+7Sx%CQB>+uyU~!khYV}WNV1)^#CtCatWC)Ez@mph` zac|_w+n7TR6hh9BUtNQJOi#u8O0Qy2LQ2shV`B-F>Nk?LJy$Hn2iI$DT#1Oq#&G*S zVoHHmX%P&`Au$=xa8eRSw-I(usJM=1L7!)Qr@lDL-ll13k(WgHd%Q^SB)_-bo~8BT z*B*)=yyX|3hyUypXt#tD2&qXmQm{BSH0s!e%(H>W6{u3Eht>H!5?aEOz?MRk3Cb-a zZNXs>`!?>}h#p(k(zSGdeiK}xcKgo5C#)mJj8D?O+xQr}p`LPFAS%+da|9zubZcrR zPj9|c>AgK_KdR`fuco1N%9FKvk`qppcVO)&>7^k|o>eEFl`0pN64%rvqNOSLMGPQqV>?ZkdvSySfQ~sMTWIrsNnL8 z7y(Fl_tWC;&3Z7sW_81%QYH`E5I*}}IOnk9;)#`~zBeeW;)A~?I?hK2rJmcXyPpjl z=+LciGgcQ=SE*SRPA}M&qh${&tuTc97K~^1W$yC?rd@UWcIjg6UYv=laW_4kd-NT7M9_CEw{7E<=V&!{nXINYL`aB2KtJWNtE#Lk|2<8fA>Z4kmBYq ze3G#TnC9f>VsWJ4Uw=0qb)|?WV2xt`cA!;fCJeI`U$u}?zA5|;H5_5YktQD-WDs+ty0|mg{hD7;sZeO%WtP$|JGcJDvQwwFj%8~u@ND&5L(c6DG z{-Z4;8P;wMI*x~yU(S?!u)_OL;s=CnkA|+BWp@SyUOo6FIv!@szXGXB`R61eelOh6 zp_ZMc?+G@w7qB$VrrSulA9d;Y7m)b$O+Z3M_FN<*W#2WE5D4}Oo;?k9&F)h=7DBO#e*))?6=^<@E?g{^GK0&h{rZgPA zD5SYm4t1NfW|1el<5~I zMv6U(cs*1dF!dZ8BooAiUd2X9K*UHafwQ2;UFBygV2uJ)E;&0g(2Y}i1L)T2!J89p zTR?G&7;V$w8S!l@OcQNRBjqqDBRv&n%Vi>f8O<0&H;iT$=5GKc>afOV^3xEz8uDO* z)`IZ{Al7bkgNS5qMclM#2P%z>8Avrk_$oRWL}7!6w&RQCwl&MTi(%-m3Duu#M8+p^ z{G*gLZkf@^UEP=b?eLf(&{81`8`oy+4<9B=4i(|McsobHwY@EXtP;LQrSeHE`#RMa&~>zC)efLB0^f8LS_-8ZcC?g z;}Z*<+TLw@$)nN9%h7YIXS(&?u8?!rA%d)$Z3M3 z|BrW>;f>E|yY($7H{VvIE??(ef3m1{%T)S7Q_sTxVe9+*6zx3~bLkKBj1{OafZLk* zK`WA_S={E!Pm}MDRm>}#Rm{trZP*H9d0C?VX0-q`D0%=QmOY@E0W_89R;Ev#j#ing z>+^u*U3xjF##-;P_dBS=!PF}@9ZU9jX6gTmu)u;NVT8OS?;`o%ZSxUgNsDi>^yBwGHl_mz;*-nSqxs+splLnkT;RDuKS_6yB66VIA0+dl?rAqVjtK6zrc@VG02Nb{f6q>L)8c|a`rdCp6K0G zel*IWb`P>wn1ObifmN^;&%mVyFjnF{Vbgh;->hV6V`))TjaAb8*p4v}s5*|#KR=KB zEx^-@SN<4#i@NBN;xw4D_5SOT=iy=#^W$kCUzRG%M!RKJVDl48n3(xv%#-|$s-9cB z??@C;oG#P*ud9G=rivxI1e|e-WI!ppy>`zS-7o`wZO#iFBzo&s(R^Ti>?ci`Cl@LP z<>BJ~oWfg&gZa(DEbrCDacLp9PPCB>&reP*BY%6ZjGFEo@6;6{z~||F6Uap&g+wDh zEFSXlo!wN7BYk!-%ZBF`bM}(3C%@a($_SuPEZ$u!kl&nTWsvfZHNIf^7Rk6Q1+0HS zYq&wE9dWc7%@=B0L_8}wUpu(d+1u<7S0mDv_bLG2@)Hj{p@g+H`%7_r#0+zXb@Z}E=#3!VVyi}(&BxsMu5atZAcs?cZ;UwRg!9qX0@C~O5 z=DK|O**fa2d5f1xn>1?sWomuEz~P|=ElXhXFd`^_EPUJ*_xX=m)FAN@^UUJLuwF@N z;DoSCh2x3O^IL};)}rJ2GEU=_+mFtL{@5B|Cszt;FkmOucpP@QA>V3fCW7Bnec-*N zYx~C_k>M|+N)RmOw-wD_H8QNFbF>(8VE;wAg83!$e=HM4E^6;gs{@i88Ear`$7_3w zH0nnLlA>JMA3Tr-#vdupZvOY_jisj|oV!XS0c@A9w!5Verq<#QAiOVZ%~jO_Y-_6J z#qC@lc`J2}bmiuC|5sR4x|x*)n3F{E0FQ{>rNv(=*3hl$Juyb!S-_*>x~lMDiU#0^ z{&7_Jy!qc96?$~ZN(pl1#nl1yZgRh=aG8Lsgn3cmi?Myl9QV&6@Hpj!zzJx#3A$VM z-)+w&fNuzu{JZ}tgknk(*wl1b@5%CSmjx9F8JDRfm<9PlCj9Y0{?|`-1}Yg4wn$8m z3HK~(-aj6Io~hDsu1&MN1T=&1E`9+YIe z^QAW(Gaax{D9?oI*L3ojTw}(3^|Q5a={zrveBn$Jr}2hQMHe^VEt<~F!qj2D$MEzK zBlKW1dX7c&swXS=0cN+i*u6D#^TXHWlOmtJ+_2Wm#O4WrM0}pofg(5Eta7BGYM<}m zMQC=nlIa56rO!0aQSvUlpMX-#{e1J{6AC?Em!kiOWcFJ$dG}9Iw{TKSO)prr4Zx*=ae8XSQk_eI`T3hltO`1>5sbb8&K^-?+apChx z;FfJwS1C;b7?-;}0QuJE*MzQ4j9d@zLcj?lhZ}8o`QIS?uVW=BxP61YHgh)(zd?ck zTOshhlBBbr3$$9K+}iZ*V1o!Wc2mv_VL1*Z)s5Y}W6S6be|He=Eavqn_QQaz0%x&) z=ITT=1Beza&YDl>aSt+$<=eo9whcjUy{P2~u~1x%2K$^xjxjW;;Rf@=jW(kk_g z*(<%AnOa@B!Xxr=yzuVmY%L?xXyVtsm?Ydql4ai>Gf_E>r6Nw594v7(S|FSk&I{87 z!EZT=OOKm`l^F9?(jS2cz?3lh81s-Zhcu;&1Pay7VqKpv`DDEa%T-F?kZ-Q6mi|D8 z*VU}Mu{D^&?gnVlDP7r*n)V?e)Rj2WY|Oy(SxA>o+I8lrG5f^cp}L}Ky#Ur@AWi8J zY8jk?RKy>V6e{v9)>f5 z*?8wXHty%lL-RrzwK0yPKvo9~2tQ~9YS`1cF08bm9`B|Dyi&t!i(&@4*_5Eg^|oh2Ft4S$&J9w+mlOe15C`dI-`n-PUqI?Y4o6Z=Ihy6@(t>?AgK{ zMj_XeknQ@1>A@vuWo*LKs?Q`}_#@G~-ItJGe3S}jR;J_98DODEP2e)<@P}*zGJd13 z+tQQ`5ba@gSc2PBGbQTmkDR7gS^#E*=pW_jzmAvCsPF~Znr0wlA!5OK zQbD)f7hd`;axL+tinlgkMcLmw0+3F{EEDzqp)QsU?WTM9t=BDay$yu)HsavB=&V!0 z*mJx{QkS1WO;=fBX?pG}!Ee8O_=ZR2?=$cGonhfpf0D~)QoVh#$7Z>?H>%CNHjN^m z91qSfR);e`#n}7taHOh+NZ0{Q21Z-f}->~P@3P2+MHArJ@^Y?D)FA6ju=M^^gc?wA|m%F zT~hOpF`kb|^b!zovCIVZJ{x{i(N7L4n>?D9ff0h^A0QLz{2|PK^aEi9##H%TOsThW ze#eUBwdpI0A{Uxgm-E^j`nooHQ7DK?)~+~NF#B-vy};1G>y#(3{^;_Nj~^CgG(EZA z))2U!Na}P6dV(!NP~LX)iJc_%eH>dla1`C&cDuA?Nt3%IrU|*(s#SHta10xKyCx1F zSz^B!O7G*J)~e6xDbn8Du7RFa5S_UHLTwTKgITS>7On1 zMC|apMegoo!ks3~X7i|*Cm1emPBu&^%Z7u=N^bCD2oVrt;tX@1K5^)qWHcHN zB2g>=;!PU8cJfnN5FpNhDA<=2Umjy_wl=VzS_9e8nh#ZZcv6f2<(Eb|&(q}u(2!mM ze1MSSHmzyiNFnTbbxH`puM|G#N^ZZXL-VR9_3l>;J2;Ywbc3ifLG%4894mPV?@ym* z`nf(!lBKf!WJ*=sz5AynF>?KU zXVOwxOAKKHFC1(iYzU+gANCOHI|HL{0)*500XVV>Xq=|_yAFt!S}vLO1iP&l*(*Tf zt%ZXG|7sjPxseS(TEmuT$&H?Ay8sDDdHa}zSst6j^#H>{5VW#iGx{F?Y@JlZyTQ-D z05j;32DO2VOJNB`xWxkDvo}Dlwnxrm%JNO9?*vevcFaDZ&Z4ck!U=IQ zY{}4Wy=;q*{%ZUo>31{Ohm-mOfV=aR@n8Tn*9ZvfGkwFE!V6viExHnvD7FqVvVRO^ zPEyyC75<9v2l#*p>2PEt#$E^f@(M983cV>#0b-1>-B*a7Nvs0L?MKnlAs5iX)Ul$? z?;<73r)l@UDm^4rPx>NNEq;r{sDVRQ?6S(;(j>dsg39;??LbUc-Ru*L!4HR1H{1d4 zzw6`uCfG~sQ@3QrGZ;9kYXhkV+&jFI*bER?srAWE&NHr;=VPv3AJH7VSzqCipu(%< zbjMSmy7{$@ovCJx)m20A=fyLLmcZBMBl2FsEhz>VdaSs#_ZhjnZHfGx7YXs#~&utzzZR3H+S8weDRL`0IO9Pq1;eTE*Gj>^ z#8Dj~IhK2&bLl|#?pQ8YG{E=AQ08K>b0lW47<3Uu<-D(HmvzdYyM3{#mRXC^oXWzn zHE~G1LnQD`)X%q^wMi`mX?2wi;*?W(60kj!cO%u#P+QOj7=7o@Lsz)=U7PtDe@Frk za5C=x@QNmuQ4WK_NrR~TPx$QS#qmdS!q1n>;P?X%x1yO{tk$Tx-O56p5Yy*BLObB> zPrb$^mfCE3wb=1EW6ho)36-Rvocd9I`W8_q;>bGB^J>xY9d^C=L%F4ci1-t~)sO~% zR!P}Tw}h7jmj-=ZDZ*E#RtVzdsG<@mP?$HijyL-pnm>>nOV{cFt)5bPcLJdl>J#Te zm#y@}Ab$<}>M_BKq>xtSV0KiB-6AdVT3tvx8yphSHHK$bGS^`Zd)3eTEtI?THMnrp zj6GbDnO45yY=XX$isVH&iuHm^AI!e_DY`Prw*so0yd|2c*N>4Mzc89YzvJQ}(d2mP zM&178+gmI`+$E#v8KOxV_z=^b7BHF){C2%DlyDJxF4kh2MN-f8uG-qAMtE7~_G%L&TO&(?Nk07ZL>I zKlK4m5}@Z1Wn|^cmnod!rQdiI-l;Ql@?;WA3sZ5R)kwl(h#nm21CJF zhy6n-dNV?q{^9uztr6|!<|q{LUG5?FUmyCoN%o(DVy?sF2RTp7ggf*&%`4fcOVb>S zfVygngoKD|EQ;YKdC0QpMD=m30WXfWYzGU;)7`Kce7zZu4ZN$XvtEEjQKXC_D0z-| zC@Lq4hfoM;jI0!fuP94SIh^I?&FIPSv%5NIuv>zMlvZ}|W0nAi!=dEY;r5?@s^_De ziBv<9W%?*S4M`gvRZfRIK8B%U^?TIsQCE`R_^(6^2g8Br@|&g;M`b>I$XB`Uw(vSQ zl42jm9>+|GBgeA**k=0F$g?TQ4v8G{u4P4c=Ib3Hd6n(!(*l&sw+Sq|xTvY>u|5x# zh%K`TNj7br{u$I9FfNGI{(c7yMHV>*Mf&-@vGl<5KcIde=0 zZgZg*$mxRP{)4sU0kxnlOZ)GdUQvlq?1|*UZ_zIV7Kii#tOI^-jUhSs@y$wQ~!!K~dlg!4ue?Rukk%diB@{7b~QRNn~VutnM zz@114+boQQY_+GT^5KQ{%a-fSv}GKdcKBtnFn(8B)CUthUhQQAdl|wkSZ6{B@id2B zol}Ub^{UW;Jaa+|M!*@Jf}e)$FEBZ2G}d5&EpJDUQ^%sjo|{~#c51@ZL|f3on8yxY zDp=5`i2nXuez1#iOFwghdp$le8iL~8N~3_P%d*$8ieXJq5;&Lq)a&Olhr>!bn4pmA z7m-WHQ$uZ>WQGnjhK^bVHBI*z#RQ6LHFj~9edc!sJBZ2dGO-th1`r>3<57J#Ks}Of=y(zU9BL0 z(Ck*muSY3Z*j{^X!@X1kJ?7+DR&=94m~`4Y*)nU}T`&=X1kqZYw4OZ9$LpCauYoygH_GV>B`%IPXqm{bW`MdKqWh38}}@GuSNhaLM|S z5A|(Jmr5wF;`u9xUOo#}Km&R9bY7^&s&$y4`d}(;7`)#saCMbgU2}zJw@>>k`+7}# zGSoW1bxR}6XY}$Rz|-R;Km@Vz+GCYG0qP4!zgvc~|s2dEm(KM~NVAzyR%W z4W%=?23>iCR8+HVYA~49^T!B*S}%dT;+;4vjkZ+JBc~-6heicIEqj9{9L8<8BI>w> zYD4dl!fNH*C#B-@gY)BhXVRyZxZN7mb(-VadtGHvoO7dsiKi?yViV5vsD6mO#7m_J zZ%7V7Y+HsLsMmR4a@fq+rDa}c-z_nJ{Y1NGm-U&3f_NaxZd9dvS5@@|UV}^5V&}9o zyfbcTY0}OV%krU5Nvn2(By(UALPX!zU)K;OCXHKJ%;OMar0kO>(e6U|bda>y!MA@U zNt80qcOU^38K`p^gMx|LRI3yW(fbpy`$hBz;oO<*?d5+v<%PraJG06z7x}cCa5+l2 zIyBAE_H4Dy$v2^;Z)OKYZB)nF1MdJI$lL$O5g=Y+^-U3VrD$v_)R~MO~!60a{mn9AB(@9S1;_PWXm( zOu+3&J7MM!@P=n1W0lTPI-t5g3HUIJJT3s-+UG_8%bs!$vk z;IT>BMMzrA>sU=q{S4(Alid0aTV)AbTJ?~{T-PQf%=N zy|qIBPHyv)$tUd^L;Zc8i(&i*+|P*h`>Q|^@TQ_9^14> zPuRqw{AkV!Qyy5ZFiiaPlc<8gC)`Tq;H<1{HaZ(v7M02mB|YEk}PB&^xU$DALCsT z!wiR80EOHR(_6!rQpViKU%*d>Mh@3}SQ;yzj%FQ|NsDUoI$azUhNM7~yG{t9VrXhw zlk{T#9TuRss}>MJ1`fr5ngncdj|Nm6DlvaCxsJZ4Y~(gbfB!-V$OFAKn&{N#eFFNs zC7Yg#uFe^P3%nBn*cAUP=*DPb_`pm9^Wg!_YeGwlH$W3T5mvFs@x<$op|75T0dqjn zt$tYSmF4wSz}AK5>%`Cqgn$On1)R(c8E&pOydMBRh?4okhP>-_&2~#xQ-MQ$a=zD> z@pB0d@G>+`b!UsxS8VrzI+AzZbcuu5`tXgw+PFzpErIH2iDW#gGC7(k~Wy z=#q1PXA|X!ZOZ)9m0!$2*ECt|mi|3GA^x$m9pe)Jd6|mNtgOWa|DT?c0F#F(jsMTw zQI+_|rq-TLEBy0r3slr_OfrRk@2V7d^Ynl=-@j*?nu?Csp8MZ3UHuF-{D1l2j)?a< zFHzoCgos8R{^wn&=g*n0tt0m|sU51wr%jLdF3ey=#xyr{{~8HY9QRhSVXKOxl^qsB zAim7c^<)or?aE1Z@PN+tPdlD~R8SNBuhwq2vQ#2%*4LJF{8Ft4`p--v|h@lJ6zT-x_@WAArgsDgXcg diff --git a/release-0.20.0/docs/getting-started-guides/kibana-logs.png b/release-0.20.0/docs/getting-started-guides/kibana-logs.png deleted file mode 100644 index 15b2f6759b3e0e4d3c1b18bc0328e9992e640040..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 183775 zcmZ^~Wk6fOx-J}~NO37r+}%ro0u9Aoin~K`cL~x$u;Lz|P~6?MxEFVKcbDAkbHBas zKIiOj{;bT(O4iK0_RRY}6Q-;vh4J?NTL1unAtNpR6##f+1ppxEqrk)NSk+pg!Y&9d zqB3eIC@4!CO6#yLv8#lZtEz*AtB0|(Il$81!Oon`#njo{+}`DzgXg(oB=XY>utL0aB+`cp-ndn6d?dx6sc&C(ADFZ)I5xG zgq;YLZ66D`SbQGm85d}|f>`cWT219gr8j+>Yggoi48CL{1H`{@ z_5r|?;@Iy1lt>op$N^zUo#JHZ)xt6JVwCxxW0#qZ%;jh0<#WJxDnJ}A&e4ho-j3b5 z=QP7B8~=ZH4AEZ6ZXCu^oDQC%LVw0}+$fU-Bupn%1c0Po((xFSmTt{MS6TIVueNuy%X`AOS<@B>GvqHgmV==Dx-ZDjm4vGhxc~;(G~XS(>Q0e z%TxU?%Y7Lm$G1{c!$PE_Jw*J;WjtQs1$^@yXQ#Je#Xr=g3#AbIdf>8=2ZLm36nlse zzzC55PRt9LkIdGV_-7zTM@jj8IZ72O?Ys~FYy7aufXME{#1r?&)|xw*E+3XGJkdN8 z@E}ZLagrd1eLi~ky|t?go7yuPDM@z4CQdrH`HS6T*>mxy;GXv1RUO=DTPErK4}vXyAJ)k}qy>;tJBlU|4qKb?l_*xejrpJQ`G>GxD=>gzzrIj|mR@&*(+yKS zcfr~gu_oESdZBL*D#J zMG&QwF^Jl}myDKF`x*J}q}Al|Abwn6p_r%ri>J-YZSvY;!tq$;y+rTrBR}0dXl+b^ zryx2@&-1clr6!VJNK8uV_C%-_v`2Bq?gM*%2ZMz$%9)Mo89|+f}gaTU@wW0*@Wo7 z>EpkY6FL{1RpR7H4chA}TPOp|A%wk z(Tj|xolFiGwTMMWN9R-{+wYgM2u@-h(ezg410ecRc55ms>725{cAvAV->=VsH?peOK(%~3K$f&qkLr2{m z_=E##3lfpjV;)sqd^?K}kERr2-r5s2_=BONa#J{`@kNF>sdL*<(fz3allbP(+G_gq zNj%ikV?pWED@-Kx*6*UgX9&<*x!G2m{dPU+~= zAseiX6m>P+oGT+j%V4NwKtGHvvM&EgsLQ<^BQXUX;@C&zG>{Tj`Ga}z*MBhVH0V(m zg~R9AwaC+PVXF@~Y=-SZNgpjbmO8d-a%l}!mdf3LP1cvwMTEp57lRC0Lia6Fx}F8! zu8RsX;m^B}NnXdtL0-^5PkoWZ@v*TuVd9yf*M~U`O%MK7eZ^zP0=Hw&r$Fevhl=xf zrf@~ut&WPygjGQXL74dK8Pu=U{fdNX?bXS{AAWjXz#fFFjo`X{o9u>*(-|f%=k$aJ zcR$K=W`|*4v-s}z?&+nY`IVH#=8K3k_1G80pm0&;pqHuE-(b$Y)8x$NJ7iGv9&(4* zZd&4wQLwb?W|?&&E8~&>Q>W?@WaxWPp@{qs74_HqeAE!lCIbgp_S}lf za=|!rdJs@;pNAtCE>u<75k+%MQ7y@mQAb3gnIH4<;rnciPuy7S0 z>oM;I4xk&{b?gw?aIA#bS9x=F7vLi8Cf|xBQzk=c{k!~D>E@@bvzNc`T?DB8Zpcs{ zNZuKJ=I;dNh=HV0JxN@Y7*JzxL*4{{gF8DrMM%*pCD-MdX_K80x8!e1E76iOy(-zfsPJzXJm+Gh20 zS~y;)X|P)&=qv1at+T#8UTFFq8k!b71~Fc_4|A!~$XR(sglEvYb#M@#f4{mwER0f8 zVteb+JT(;(spxL0bxSybuh;_)YmD%{FoRef77Wo}yQqG1BaRidym$#| z!vUntn81UmAEB|?L7v9}c!X^j_8us>{)V zkx0N$X@8c@g+xOGTql1p%hV=evMhDSP68s*rqdoF+OP1IbpCH!Kx*j!i19F4P!M!{ zlSbz`ezx~`OTl}v{<;zU`DW-W>wZcd*l4@)2id;$q9E(UbE_Z7+H(E}jfa~%XW|<_ zsRh6^q_8}gRBV~43;^hhfqZ86cI4x>vlwey%9vcJ&%$%tAoPB#&-Ua3Pu2ArdVALDH!Dz(0ig@gzevF#3Q%g`1wKCm z<0QRVpMpEXI>UIdagrA>hF)nsoDVHP)gwd=Kqv4J;2kD*EMoc#)`^4l3bZ#1^nyUW ze7AS^>N0i@T=Ut9hMHO({++N|RdI*nM3AA>WndSfSl9OdG7!jqoUShAmo1jiR=llu z7SZ~9!IIWn#j^u6hQw2 z+DJH~NV;>?v*$y4Mr-r>6nDbD;C+qur;K49%$$DzhkQZtNWnsXK`_EwzV;( zvQhr|`GrMWbP~ddkHEX-xFXd8|EDF(Xws&mNjZ+Toh03~wD!jP&A4HX4hTyApunDt zjG`1R(ZWd;c_S_k4?49;q=L{Hgq`6JyLgB(zzChIM(o>;BWKl0VwOlQ`522JZlJCz zX3qodNd>F%lCo#d$t^?S$Qx>GPm}c!gn^qqBp?V2P_r<1c86eX*XyZDz5Gi@)b}*( z-sRgGVW^J#=c^+YI6WwZ9L(!hK-G76I@%A%JK8TFp`Nj@*e|L5N@My4LOCn@T`wRo zu%{I4smZ_(hlj|GPUj>}%zlybp<>1DxGpTV$eGCJC5MylW7@p;A4x1J^{KWiF#*px zZaoA4G$_#}Pw?QRIAu(i*=u*eJt`{H)hYFy4|K5 z5jR@zZRVRBASV*MDR)gETn`aVUPj8(A5;MH8Tk7W=IO^JOlSK)yZD#lJ$TF6@E=Qc z;dGI;d04(1%RD5jqyC+_8F)y|9x1;kXx?N0dqZ$Rt-(z$;(ih~JJuX{`fr*ib zOnOrJX_sh`90dly_|hkyV)w^;2^<#M<-9@ZA*zv$xO7&>?n`mQsx7dF>oHRd;TJD1 z3Vi5LQ~F=1421tY;@Be}kF%H1sZ`3tMt86oQLy4V6(u7h)8c;O{e006eeK$lDZN@c zYgJWI*|_kejvWZWAklKB|0?;O)POwp>wF78wOWb14#T-Ug12JG!7%&Xa~tVoB>3UHi#0|$!Z z*HJ%+D44c-*=R=c|KQ5gvN?jS!ya`a|>GeVJh1XewVp z@McmfJ#8tk*m}Qkx#yB4Q4HP~ZgW}aerI+{NjB5vK_HMzyWEVS_M6J&s8{425Tiu1rbya!)G^zxCpDQ#0@>_N#uXY{j7) z*@`LSnP)y6ho&}{X_x)KjoLrWAUXg99ebRh2~`cRsLQ~;*G<~Jc(YCH3+(%OZEu(TM665R+0CZ4h~<2`>S$|SGfqumtSz!?x^HQGW?yL%d32J#s?J2Ui$kYaSGu1 zD=mkc_9CCmbdPYBpx4W_ZqWG@u1z&~%u_3fU}RVs>-1$f(yo4#1uNUw9=7REfgTrlik@`DhA?^U@l~$ zcms1r!n#w%3zDQ(%wM937Z6k=3$JQtr~DxIO<8=Ev3omZ0<+7n2!SbXMO{gjGY!yT zJmVGV?Ei(Mf!zKzziv0XXE^4E8c`Ku;W#S zjQ{UsC_nnvSeAUI)74bf*oL&MF=ih>-Uh zIlbE?;4qNX$U1{CoUovA?QR3QxtY`e_*xflGW*|i0{_4Zm>o0%bi7ZcFFqcf&!sy? zK2im|5+bPami=8sxSx3h;fUn6lLLSBEaECvA&u!X*IpnXhIXfNnQ8fV-7|WSg{PtN zV&hB@w&+S?juU03nw9*-fIuTw*sRmwz=b=V*&C@v-EA`RNW_@Y|G2Gug^zOGOHQJj zJlk?yWo3Q=s%rUx0>KkM7SX`iF*TV=BkJzt?~xOPWi}kih5z~<$Kfr6@;kXbgb8NzM@hFk5g@Xx z(wpE_$`-Ro5yW(H1^~qB!0pe#&*pOYl_sEn+SN;p*z zB9O2_&Bl)i-c(%KgVbr904*vAg_#x&sVWU)>VGH|)G!7(87{4hPW1N->iMnn{n1;0 zDqJEbfBODmC;vX&`&3F51#bF~5oHTXBou%8TaO(jMdCQfr|ta*R6s0?Ihe(KfNOmZ zf-+bn7B?Bp%lqlhE|h;};Hs=cX&OmqDX6&>b^ zaXiU+qkek%W+xC&!MW8;e(bNR(&e$O@V-f^JZr)?%J&PPlbyZD_nE6}3)B5vQ`-vJ zNxabe=ixS=W#aCgHw+H;G3|;yxxv9sipn@DoY>N>V@WrMP(+b?;5KzFdSr?$d>og+ z%_dIV(IPkTn7J$*d?3yMr6f9l>kIRlL!`^VoYJ>{W!?UzV9;M%(H*~4CQ;456Hspj z;Dn~sQ#vbq9(Ao~8u))~Hwl{^WnnC4EwnCVz3`v0qp*?rOQ)t<<*4#yP6hbLfEZe{MZB1&#Lbwa(?n*ON5M> z0w5IzD}*K=f(5&zjS&$9Gxj177Ew*4ZKbJ zA7-nvJltWZqu&JV)O}!me~ori-A9u^)SvDCXDoR9-;p{TuGJEn%n&X{N_#}RiKqwxN36fc*;CHjVRBZIM_Moaog)-m8ed`;cN71g zXUAn3s2XX6z2)qM1`i&-eghDPh^!-q*GZ&tuzjYP$!HAOjt!4=2cXYWEJiKs8hYhV z59e&GhZOfl8-VP4a|Er63FXg&-~yW}Y*R|csN$x$wlOcVr01~T52R92!V{TlsA>=o zphUBhX!cGPmRKX2Y~s^SXXpO}r%C4p(iSdU-nQmgDK$IzwODk0mp5@K`8bkTtm}r? z+0H$aQ|CdD%!)}-WR3pqZ2x|#q{2W&qYvLpVRR{;KBHn?T|pf1Revy9ehBo^#<8** zi^<<;OeDkPMqww&vPL0XJc0n&kL=o#{d__~^LYu!DL)qhaSRM5Mhue2GBN6DgzSp- z5SvbhOb+9{P%t}55g`Nk1HbehlqynDBW>o4i_a?~oruV9!)v>w+lC}f2(gcCPOkTW zWB=1?e)R9Q&MajFzvXenEL=x)8WV`_9l1p?97}mtptg7eL`+p%cNEWLtz!V3|IBcF z&6Vj@wM-Z{)T=o-(S120NE-8L`2h}4KvU#v)tsy4!p^~n7>@8oGL39{*&DC0iAO@K z@XKu-II{@pY7I=~I7Z^4Y(0%l&8ZaRv|F82P{CGdY<5MtTB)aEuI4K|Ir-XvqxBa+ zEm?bXf-H;Hiex%M!k7wuWCwhIDcMtEIWOSsL*Hdj>7Zi%3x|!TD__`U>kfy*`24t> zGZ+n%$k9o-Oe(-Mod6O2Y@}gHI>b`P`izx4{ttSeuY@K?@d_4wWVM}>l@W^Rh!N9k zPSd!pHJ*A%@opx?c^*-SG3V}W7O=vaMJD-I*?0mHYye0uPvdPDsUd}jbd;+$EzFil z?6(}n&8Co13h|Kece;nVyg40hkB3uAz?YU#a@@~QSoTEtyfbK~WGzXbMLpg?3O(6S z?XSBLpIe{j$hJ_Q)?}C1Zn?hC!Tt|b8$k+>KA96c08^3Q9^q=J?UYt#qf-S%{9cb!{$HDdiU(wp4pqz( zwOV+@CTE(OzPm_%v5m>zc2{3Ajxm|9Y4J!u!tTsgQNH>p{RQy-+sfqP?Q*KB3o3Ya z)%|r_;*=!Q^CS#lP0@C78^JOB>U+}4m0hRK!uNQ3Ka8j9ha%MvIW^&?&n2JXiQ7m+ zR0yhA_I%liX!B@&dPI;gFgLBXk^|(d=Cour`9un8)t%R;hl_pl^s#3bX-9RT@Z8YI zBHU>L{|fv4E0+w1sA*x)P&T>(8r)oq=nd<5=*%5`6PYsj0fP z#;*q^A1dTY^;~bF-11;yrqmSYO3m;=_Bthn-}MZov6n2h?x2R6Cyj zU5UF{t!PLa(Hq5!sEfSgpY^mPVnpcOU6HxdSU^n0RH0hafFk5Jx<<|(6dJ$P$PZFJ zQq!^9N$gC79O`l*fS8F-8*`%S)K$`9qtGs+I}o-E#g6c&PY5CqaU7%=->I;~Mg*h< z*3xg;)(|ISt9OvVaD40k6uve*-~q`Kh(zdsSnI$r&+mgM5dI6T57j>Tc8TKQP;+6* z8xBz}T4vhPH-G_jc?=^ju@&|N&#f|*rPmP7RtcVbMdovE`~eS%5S!CB57SdNiq=b! zK)J&K?DF=z%&4Y@cIeP^%?jWhp;xeJc~eb}@orF+L`{U=9BUco7}ov7Y-O#thx?#9 z93Si#9uvE$(Y~*t&Oi}7c%{&KtLI@|U%u9xM+Cf9_nF)Wv#OCzLGl#cW2A{`YD3479W+8aM$oz~pI%^59vt9T zP7rbuds}|9F_Z&dOa#FFqAFLQ=xqAc3C>#b<(rklH-jcD@l%n(NB|MaW$eVu8sMhqW6&Ch;$^Y9Aw$|m3IQR|Dj1UW^?m|_ENbo8i+s7vAdX5O)kFxXg9qxbVOMeP`J zz5t}0Co``4Ar8DQ=0&&*%d9Q@2CilwkOULT$E_2 zam9S8V@MIi>RpLMb2n)sr={Of(o5yzSHy-%qi^qXnJ;skX1@1xzf5r$ZFRX=Y7y7) z*R5%3h8#_4>4$MCEI9LPUwXL)~xC)m3*TFNkf)vvQ$aR~a1#NcFr9MHMgpt0ihuwWXJ%a86ROCqC58Q`wI>T2oOM{&yT ztUZL%kT~&EeCC(q52ar98gI5m0)_u-QT0-GZS?9iF$%oR`>j)6PoKF3O@u;-ECF(g zOReU6u@afh(mo7+F2~X}FO++TaX4J5?g)iYT1e)ImSM$4iieI{cjf6m)U@831yqeMEabu)?v4xQT$|CKvS~f33r! zhtgGUGi|!MJhL0EXl`2dEy@$B)k1AGTzQ<+!UYl-WgBz(e34MqCe!b_>j$veXrpbe z?fH}^&*T#TKkcum21hY1{QB1!Kx%J8LL6}#I2@6CY+MdrFj ze!$X^hYDw)wk>CX-qxxA(b<)_N&`@HK?473)boC&prXa@^4%PS>}}i4oGu#fY8j;< z{1C`C2~MT^ce4J4(RDNMc?S#c`7~(uL(&LC@g?aD z2RkhbDnJi0QL?dsF~SA;I~?MK0~zYdepVh)3!i~BIL8O={}f%3JMaQX?ZvRc3OA^T zij+w9^%A#wP7~tP?5=hA^a5$-{GwD(^_6fU;%p^nO@3ZJw{8viUUo4tQOz&Cd_sCc zPa#qrSEEZ5rT)KM>p_!RbEZd0e64L{v*0?i55 zoYimND1Fw}Zg5>{6tpMWqYr3uVR)k#Ju_3kGsf=7G6UB3GrB=X`BOMTlA@gJUStqm zvhDsPo8@_Twi+?s@*~aXkwQ$HJ3|ga-U;e0atYp9Z57=>_|pFy{z!b-ynd0 zUNvFYFMXLuo5iGl%SW3TcOn{5sOg^K&}VoEw8uN`t9)8uVfUPdUavvVUjjbZXwDcZ zbXPs=6-$l-q0fS_G@}Nrxxc~rBq*57rt3b$^AYM#$)N$T7Q=<8lGof5*zvB`u+`ulhLFn*V zXwZfa6^BvlX4@LE?~w;bM;|Z91~UG}OtI}Lq-syt{bJ|z$sy(NPEw5OF1I9H&fn)~ z{tq%oJN?s!ZbWNW-rY*=q~C<0J#jL;qq4UM`i8DRNscjOMHIR3) zGr>#~+meRHTqg;}%x9l94oypc=z}hTIFX<+E4lCSs^tsRJ!yQUT3{KoDK})trpGAH z78@lM&S}U5+7UIZXl3=yijb`*jK>8b6@62k@_e^>V{8Ot`z@NPUi7OPf-x*N+#QP5 z0jofvqDNX72v42eMNGFYEUv*Hrg0|i0grj3>p#1lwU_5He>?53J0;) zLUDT|H*(`c^5|V^Xbz>FneI#ws}-of{$#_S31#UtVnp$_oi+S-1IJB zL@+>&%!v(CNevS*P-OMkw)APMj_?^LfW^mlB6k7wx-xD_h;g7ujxodDc2)&lnZ=}Z zIhFuIk6^_GaYrT3`%(3U2545lee-6Qdt-Hn#}RboKC@!|mDj=I_4>BIylp+%aYr%j z9czc26@ zDSX6c<}tQxiV&wLx^oM1iqHw6jo~`jfIhtRIlNw{+2s2_SC*Y|qtPq8Z+V`885_39 zZsQsBdFP$SI1wCn)XTUz2y?XQs824_26=sGgv=vxEzu~<6J7L`>?w-_Dsa8kVqcxL zNiSDt-$t;vj&9po%muJ2vQo|0Ln$Jo`StA&;?6SaYyNUd#C3WJN5**z-BCulD>Y^~ z9bEya)#|9{YK+zri-o@WwB<1Y6K`vbw5I$NO)5@FFF7)>Q-oTNI*1niLQXj?CZ#!u z$v=vl)A8MEd?+QeQEs`1S5**?iQYU8wSyRuE^Ts*n^m#?1qlLbx^BIRMq229iivMu zVYI3TdbZ{ImQf9XK{je^hH%(URQlW2()jCieA39avB-CB@fJh?+F>8S^I~iXuGOa> z6!w)&I@4YV$;fUePPpr$axi9Yw@4xXH8xnYsOfEWPyg>6HhLFkYzO^m5n169Znuz6 z$#9cH`auHdeuaGr7p4Am+Bn)#x(q!>6U8^Vi-BS%y>qYZD|}Z$H7|D{Z((6U$L+dr6FCwQ1Z+CB|Mx>WQ5zX0xD$?HOi=gE@H(UF zz=|E03zxSd$P6EmKW8KJJ#|Dj!(iAu6B2w5ksR$Ne%e?qoXJlXiF7hFV&s{Co;$iKp++oP6+itVfA~q9kaA2sGiZE(hP@jFnMhn^Y5k9`z*~RI zXrHh~yCvJ`W2W?v!KGZKo<9|o7clDKb~aEDVow$Xwx{fm7CvfQkx^%h31M1Vlahf% z#!IOx7#W?pwrdfQEb_h%)R?o(G9|fh zC9z3v5~2a8k8A*94u!4OvR{Uwx8(~9^mvXx)ktNSip2U!A09+;Raw1-z44iF`!)an z$Ni6K{Djp{T?oJ?l!dv$T9&%}!6%PP@ld3y^`MzdKUYGfLe1cz)1|PdO(_(k*@B*x zm9g*!0*4B$159h6s8O-8&y!AFg$Qq7{>%PEFi|4pQ;%a~%7)PhfXAfDT_uQ2;XHsV zbZP~}^)C_s*9UG+CwP5HA3Y>YN)u!YUAd{zojvZVN~*zL;?mG@dEv%-%t6Z?XD+0= zF$7yNrLSVLyfhRhx9zORPMFd{ACW0FLnG&yrFSf=zEgz7vT9#F0jDpe>t7sPL1bD>K*^6N!%ac&iwAcwN}h3+GDe0#-XNrU!;?*glG z9+XP|M;Airf0GI0ji`=%5L{xMCFc3PzI@D&FI;IO`U)QA5Q^w;BpMu2C+sDrb^hBW z!d)#Ap!G|Ib)Io=0U;8Hp$||_uFP{|jclV<5>kwKbFTLyXPx_&S0w2#q}0p{K5*En zf>E^6`F7_qP+3e%0F$BI0{+`f`_~!%EltIz*(Feg&)F8n>4?ghS+p^~5fM5PdN5b8 zpE(-Ae>a*WdlUZn)D6x^+FeI(i-8+VFhAdtpw3-`)U9JpaQ`A4#4F9AFLyB6fOE_k z99!y(j`;u~wl-+@6{g`52wVM_n@D_kq5X8xfD)ix!q9U!h{Illm19yOQ5{k=%l(?$ zS5U28t%(C-Egw^-V^f)WfUR$tbx0tCzst)dv|%If@UGz)UF_e?7$#%%_gtjx-Kocy zkTP-54Bgrd#IkUzj&m-|Lp#+^DG>9elzq zjy2WJi`F>#Ufh?`&8amK`EpfstF&yR!&{c7p-_^qK2>ZrQ)~TS-IFX`-aai$DJj~? z$9b0$n~w}FlhvdJncl_yppEtW1N&QTGWWbo0ZxaZN!6bhW($mJR z)b?~rE=%zx+f&)T5s65?L;m z5x21|x=w;)Y7eL23K(`*a|}_7c3h|g*K+E9ZvUSv@ox)L7g&^(IM%qJxU5zcoFXIi z(c&7L8vaZDD1QDQB=Gd-I9cq0YJ8Ema!JT20fp*+V(dEH^p2~@sy}P{P_cw(^}$Ix zeMZ_W7NlH7GX{#O@uH}kMuwr|(gS;z)coErvlt* zwj*DSJ$Q9OfSXN(E;|!|1$=be`MfT5mnzedp^fljGQZ~;!S zz%P+RT)2`UBX^XWkz6?08!`FtD72TK6WWO2D9QOID8EL*W!b-8!*TB<5<@Yd(YeSmn)6oIyxBhH zMePWYMN|~ESNb&J$?PvW^Vi?6R5(yd*>CA;%DtE(8aB7p!Q#9YM97%r{KAgj8X8GI z$^P9Z?HKC8_AMETmRm_|Mt}l5L4zj-@^JDH>%*R&dAL$iG$b%MSb-^3nu^Dme=rxN z&xn_%ntZyc8nILDH2kgZKprVk@IWY7$|U6zqU5@=6|Py`c;~b?PO;Su5U|euBREj4 z896~TSdkYSz1y)#?~~)Ne@78)FyaP#a)bcsuX}7QED5Dw)&$nctq6b~b1?wJS7vx> z099QAsfjugW|ba|bTK15_Hua9d@!@KSQ&sy?cD;|S3Y9<*adP~bx!O-GmMxas4@-- zJkt;Ls|$WCJcR(`%A(yE7u`)S%75aP|61|O3Rd~3a;1CElPpihPmVLC8n`CNxwyE~ zvQhFgjHOhXu9a%FN%fV+y5O*g0-<>GwBSJ`_D#%jqC|=l&Cgll}_>I}{G(RWk$R*~+do$75lSArJ z;ZsX0Ca}9JO#couQ;|Z5HdywNJHqPE0x#Q1Bd7QuoPxO}!w%mvALTAW3yHMuG1jaG zite-(9{A`Q^h!d-M$$kMbR-6fR+F@RmzWeI>}+)L$0oDKzq?wVD|0(RFFN7vY^3?5 z?R>ZsEETPnFm^4(b#iddz()Z{_}TQ3>J^nd+<7xLIM$J$bn#tyeO=f^b@#!@fb`vi zFY&6pX0_bc?78g1_hTSosRiLNZEO{kzF%JtcTlvR88lrfQ}L-nmg5438^fm6do`!G zF=MH-=?x24W(V}!#lM!q4h4AVfR|Cb0eeG?%---pTHloOsu+8Fao-JnLdRA$OX>RP zu=?CL#0R_hp09UZUtfz*I!;U%nJNh@Ft+YvMc6kwu{%|(1^d1$Ks?grMfz>O6%rH# zuLud$cNyiiva$j_Zc#{R6}4F7M&s;>WO*S+MMc@nm9Mnc<)43A zHx>)X4b2J0GkCa$-Ff)wUwAz~`JKn0GarnyPV~`Xv01SCc=~a0C>W8Deco*R;hkxr3YpRD!Y{OhW%}oSL zl0?2Mi;JH5uQtc;i4=m}(<%D z#dg!D`nJ*0_G280t#S7PbD|Ig5nbJ-Oktli_v87?1TKW9@B$s^eG z?$?Xe9mdjlOIlkY@$gl1O3GXWx(fA5_!U}-YJIPTufI9k@2M?a$B5U2#12f3!ua#; zT8`qd0j8mt68?8BYp@vKLLSXPN7u_4>B#>)tLp$OP?hXufnHA<*4oVm_?B!q9( z)AVwCaA9F#aBz@}jI71u%>U(P&a_I45_^9q_nTB>Te8^3-<*f6kiAU4j?Rgr%yu&$ z^_ic=#V6|O7IG2uE{;dD*IcH}JRiy&KCC?axTqLC^$}Iykw{i2tiWJrKO`@W{K(4q z`DM%v&tP6%aLRIxqEuT?rK+(wpB-Ndzm)CHP4H@fIeL~YlkY6Ex1^zt#%EdmiiKd5 z<@A71zR*HjSVDBz*tWnIG~H*0yZ3voZ>E zLZgLNX(~Kbd2pIUMTYg?w10OzTbjR?n@5Kn&JV3q5vxtMXg5EKaqRJ_u^G&)kFhYL z-b3;i&Ze&YkI-f{Dx&d|6bBD9CN%#B3mc&Hi*KHfB7A#nq=ZNdgoKDqX{Yu8P&vnT}4VyZec zvpBjB%bQ_{%eB@@!F;FK2$3AxQ=O{%yy+2va*w|v)g<=W_r_x0`Ja-mf9gg=b|+kL?mQv#LY*TVR9eKr{<8R;MW z;!=je-Z68&V22gg;&16HmIgAQ*WPHp>uSzCzCo#O78^waOw;DTuhPLBgTsq~7o8Hj0?1 zZ^IF0D7krgWS?9M%gWdYBHEy@PcFM7R(5uyV`E7gir|1w?_mpvVy=+G!$TCr*Y-xpFoEs_mfK)KAjp*s~<)3a0GSVY7Xo@t2M|6b_(zp39>u!n- zbEpMNW&FQY@G_s{n7lSgRt^R)-~$%a+RW4kfPNZOhs7FdhhCB*T~*x&{M}XGX<`<` zGS|9!u0(R*`*}ebAaJRjd7;`|&fouYfP?>4Itco-_LQ<=8WrtL8h$HmfDkZm(27!f zCV~GA*?u*`9UJKr{yRaK!bE?59spWIf+Dj5e3DNdhle;Em`J>)B)TzlC$hUk{O)|# z^lKh7VCMmGXe8%DbC~f&rXA8@)Z9Kj_PJ>oi(OwxVT`=8guaH{Nb{s_&d{*QIgj@( z`8uP|OtE@uYHEn_^(<3HMutP%&1^5B;fR`~6xMHBb>oIrYA<;Rs~ErdEePCCz^Zk> z5lXSUy9+}NifJEY-q7^qz{w(4n-DT1{$2&h+~T9o996dM;2JggL%V{Jr5+?t7ReTC zt)>nNvJ@cz$G`z1nkrv9Q;1p|>X%Z6>^NR#W@Z@o7-oQ>7$hG}`yydX{px2=Z&z#UKc-rY(yIdO@*P_3@67$ zHmGqoGki2vv&}$VW%G?i(!JQL)w{dtkqYLETlI&43s{Xo@HvmiGU>KdpCXasDsV=G z85a0_TB|>Ajtvf5TSt-_(-}sglgE9bld?~42(v>g2L{u?x}?wWmN znex4LIOXt}8$9^Cs7k~5-oai%MW`p*ki|Rj=yU10Sj5qh*hG%0P=oOM(xPbZaC-9B zM=HaWAJDo48opyqj!f2ysrWqh_fwH+=evaXh`4`89mO~gGx+m3IncE6Y>wtWd`R~< zto84G1XtwJjvLG#aHMK~rjyc(V;te3(3!0KOvJ=`4w&dWT(q!U9l5LyKxVv7eM zLPDPeYRi|S)j2+*e|fcivW9s{^Sv<+|MOr901=moxV80S5}U3f@a38uErM=)`<&m2 zaS`fShR3NW`E;99%_))!B7)yCbG4pTs)??892$S$x52eU=CfTY|O< z&-D7MLCl9$e{FAXhsD#EmusKM+~wxy7QdxD-&U?zVk8lf^6?q@(A(`KP|%g1CR>ah z>@mAKf$76(ZuI+@rQ*5E=jb&yhU~9GzQKog({qe1cdfzSYeBm6qBjK5y#(xfTAG?3 zuuTKP{i#QX&rYIdT7IHxd<<|xSgbn}1Ae}k;fVo|z~g;AmLZ5mF0?;9hWSGj#+QDJ z2!CNto*0N5%#J#sTW{+HeYtaScAlJ?a_D$*ub8t*vtYG=XJlo4hAHS=xxS$5zVeut zr6ofz7n4D}ezy1w(LC_Asy!#iWP2dipkfXdoZ1Y=yd)$fbaWO=Z7j7v9^~uHA;zzo zAm>|!%fkM6Nu!wstnAdqYQ@I{_kZ~Q@|;k{X9qa|v7U;Bx>_gtiVKovc%|U@g$3TwnbSQOFksv1 z)Y(e-sWOtj0eEN_bR`_9iodtbwVx0RbEzzQJK8t&M((|{#TZ9&2i-`1F$^hPjY15` z9iQOes9vIlUs9`M@qTn?s8_w2XeKT$)2V9bnkMCiD`=>E-aQad6o0R&u3q6_`}5Di z4I#b~2h)Hv^`!EHr@7dy>jOT`Vq>X^OfYD7^oLtCgNP&v0Y{-NdkRm58tvkR_; zWMi>)@1tbwcZe!~O)G8xLa4TPaIAV+p~2c;(l^Vit()3B5!H~;8G9^ygp};&cPtt+ zd=m1FHP6~OJz28XIs$+Xnwrb17=ZKfM|Cg7N(S2+ubHjrii;5lP|7uySnu}lW?yS2 z9(_79;W7f?9Dg)}fn1jE*KLl9LySIY>3R^(4GZvOBG2VLF30yR)4j&;M@d2k@2(R^ z*f^Z$JerWY-P9vy5yfyiPlh=%KkKt!%{4@j|J1yr5jF_8RCXKQ{Wh6icBK!;-iMi4W^WR$jgf@!r!?Q8^D}s@|iai4AnlLcSp-lZ41%gLj1jr<|~a& zd^UT+Ku=5Iu#5$nh^3_^t3@U(e^Fzh&ypE4Tu?H*K20E8`Ps)NBmjW79z(LZ_R{IM zv?0FhvU-knw^b^4kp=2*N>=vOnmbd*pQx{I^SSfeYjuH3;qpG(3MNxI9h4uEcZwv= zJde;}Q+H`bw^iE2|w#v(Ah&rtd$kWvS?RYg3@HV5_ha zL}2atkelBT3mRz%^|$lWiio2TvKB5iUTnuJeMH}axQwL=xa1S_?0kC5Efb`j*!9+j zu{Y&yo>tR4N=}ObUlbNi*g3V7&A1Pqm&N$F4DXc5 z8Gz{!D0T8MJASDP+iXDlZlDhPj3tw-OKHbBVd=Ed|CN+BJ7fNv)X){N$rs52WqrX zQE0L06XtpGn?IChxl2wm-+iP_k;jmB(a+fCBgw%yoiY`Z~YTa9hoMw4&%zVE&FH@@-y zlZ-RY-e<49@T@tX`OLY%c0;}xl4v$Ivk}nHFdr$7X+bqKIpf?uZl(y=Kbh;4qg|m6#3UdmOec zta!Xi+%ELiL=GFO|FY8+Z$NqMLP1{ZOR>FtPrrB0P*kd5jY{a?M5XX_5`mdh-^;yP zWcozL7(z$D@$4<$Pc@Bsn9tPHc>a)HpDX=&z$ zT?T}k>h@dwOL=)Nd(EWOTgUPQzILOzl1&p!GmaYh8V*}lr@wOuk+x7Kg3t>0)$D7t z=GFry2Brt9t**Y6Qxw<>^3?r>gRCurX_toL+&lfSEXUcj`?_#fqgVT&6TIiMcGTw; zzxoy@aF5So`7G15oqz709UZ;PjWRd*bLw6Hz9{y5ovT9T@fpY-ekpG?|8uv~NnI6; zkKcQR@ge|1feVpye_PO;J)XGE?c~7_$@XY=yYFiw>hNimt0A0=ETGb?%pu~p#%z7H zAHFb`$Ti@&ruN(vS`GH?*zA1i!tzW2Fs)io=XFefBRMH)&M4q|cM@0Vo!~Xw>$1b{ z_2JwXGpsH&NgeE$_jm7h@$Mpxye|TpGM(_=v@5E|7+c6Bicjr__Sw3QzlQS6V|N=R zDH1NOo7ZVU1khuDWP9^8eSKf*h3<0>oW??6=ShCDVnwErhnm?uJ4bqJkq3DP1q$p6 zIV63`2-H(MwV<(N7V1{|+zo^iyoe*vq{s%A#%NZR^IkKd(z0_?tSNXr!2NrO-q*j7 z*~g`)kMj8KMsuYwXrYCF`Mmh_QgN~r-NQN`M)b638 zGW&;#B#O0Z3@~*O33-!PKYP0`{Pao}dbJ*-Ey*NPC#n?_{hBjU#-h$N7DLDfScW`@ zW;s5e4|Pk$4VXKgb~5ZbdHAiGac&_brKCvfHV%b#p%lCK@!3_0(SI1!P71!B0U(Lb zW-JK=Nz~v#VSTLDODun$eID0eGdABpUncP@qca9$YuW{3;Qh!xA%ck*_zp0W-#tBF ztZF(^va{b8fi(ZSF8#IVpv$I8o%wIB7Rw1gT~qY%^qNKm45b$mezrc4_;;`MLOBV5 z4pK}%M``J6EjudoC|-x`(?3iyU`9GNTfvm&~S#)bIW zm8q}TVZQ;>Sag_IT(q9-qafxRj^9n2-$3oR&|Yb3thIS{BBJnCBL67RA#Fe1F1B4! z4gfXv8Y}82^~J`54%=_t9Ug9cfS`2nO)T>8F)ff~Yjm4QTk&34?>cK%TwNh`uUdzY z$tTa%cX0~rjgoz6!}T!G15+$=6k%=KKu_)q&JQy9=GRj1T(s!kpQlw`cY_tgP;orl z3!~)`X!=5X!d$n&axMA!gB;5Da5r*+gG0R7819S5ZDa|C2be4aQ>CxBlFfa&fp1z@ z4Sd$SH*sLki|Op8(`XL3me~6{`h(}uouGCT5*SN{hT5WpK#0>p#E>mIf=?t}xkeQ{ zR?@S;bJ6UghALn`@(5I%$og4WbixSBiy)Qbor)F<4Z#Hm$tgYE_*}e8McmXA)s$A( zSY<1dK~wmo+V1p|F@J@2P~+}usO&$4i~!G$7}DUJ3zPBIV)CKFUhlCp+;47f(TTK{lqQHcPq1e$ z4C3vXnQUG;O^As3=)*%Te==$jPta%at#3|{ffS57%#ILZ9rpo_o3068+7KCBf6Z zo~s+Iq;)dIx^sZLx8yQYS6Z%Yx4ku9)6$YB!9x<;x~B9Fp;`;`x_`)KdK>OmxI8sY zRnt@^BkZ%f-L9S~_>iPqT`$nbgm%_By7dzIZ25s{Ooj7c-d>Ghe7U(IfQEJd(71HY zr9;pcJhY2cRa32v+XkijXi1-A7k;~Sp4<#Ilh6-Xi1*;L+KO>J0(yQD+{`Fcgv zimoCf%fn=V&5w!zia)zK&^8tyHmsl+S75yD#ZW&sJVn+%;~QUTjr?)-*|sn1eLncq zK0eE}&M_>;Sx1`}y4z*f%Rd-J3+n@$8Y1>nR%Edy0Rc{H_`rAdToJ}rm|v1$B;v(u zo|lBwfpGk`lf&mJFIJ-?5I%@v`!di|F72+lMU(>MUowYq+D_I;C#zoSJnRm8%)OVq zNJiP$LUBe|2Qx?H(duF5w&H{OMPnAY*9AuboT*PtNTATip7$h*fM*;|kDaQqjG9iM zoP6w1&+prAJ}Iww7xFqJLJ_+cxMHszudW>)WojikNryEzC@u8I(4>niElqu*$@|Jm z{45(Kz5l9q9d9Qy)44-FKp{2&NemYv2^SFvC)q+FBn;K>8t?P#_SMLg`0N6)EuyA1 z$L?Ow^x|}_h23c~&1ur-FpDKRs7s15qnE`J+(d(9*srVz4|4wetKoLC?Rx9-%F1^f zQxlWg$gXKsBv>}I9|Zh&{+JV z$9wC}uiR)_&lBT46dEdChZy+w(-Ipj9qY7^0+#I!I%ao)!D=)wkOa2TbEZ%VP|L5h z+MKR5S^iVi%$f8aYRB4*fG$%_bv03iVYfe+3!2noLn4d2rq6rJW(VK= zVNOs_Un>!h;d~y%Iv}nF<&iWa%wZjORZ=wBeRO)?K$xyNJ23*(-;P~~l6yvj9WA5laf6{9@;v6h>+G0JmS!Y!Kr3uf^OpHE@ z@Y1^)X!xY{wW2sZWjJ3voxLzeSx99cqv-NaB^qL6%=b)Bt1XWgco8+V6-hq2C<<#U z)v%&DCMT%QsF@=_B;H@!xK|P+!A3*wE(FP=V<3x zpWUYT_4Y8*b)4T6T5UpDM|Qj&T8gJJJ_$-@NfE~#7Hgs}i{DRqGJK)>ikV|RtOp{V zcvQk#94rx(kuem}NwYQPb|$eVbGn}D2b2WM^T*MWX*e_$Gjdu5ECwPzY~@Edbon(1?=v4rLsJBUBg&*6W*!yayroT(;bxpfDh(YMvkKKsTJI3*i5e$ZFT_i$1T z)`qHx^tnY|=OdED5n&a7GmSqzlpX0wCvX*X^4J3XEN6b$c;de5FB2Z4b8?_OMH<+A zs0Pn6b<{zQ&cB}80Av0D_?+TVIELCBcxp-IBi4)=Aa1{R{@9`2StBzux9wi2!0wf) zx)Ib|zx`p$Ibp?j47?I}o2|jx+S;9+@7*-$u%U(oG2t2lKgT}7!-Gdt2Hq@8VN?|B z@|P-H`WxmGk(H^6;wsVHLW2St8yYyc#+r5c*y_v0<{K*z;%o{T$mU+4sy?7_S>r4H z*Oa#birz6TYM@t&9uZWmN`oP7LO;zxg)hg~Xo8Zv09i%xiWmfd8xX}ZKNwGAz(Roi z7X{-Z-}JCL(pg@{W@D3IUS9d7x$yh#KavClo7Q{{Chzgam?w@fy8(Wmrw4jfq5W zRI^?UiR6;#C&0F8&EnCAj7v%)JY;vanTsf$nGmcB`#i+Xt47e+(xA$)3meiXCHN&# ztcOf~m9Ysn+wACVZcaJgkByetX*y$Ei zR9s4Fz1A=@B3~ONINgNTd^dk~zWOgO=~SfA__m{#BK`c+T8jsqh%N%ZhMp!zbw&>C zj5LDfmp&*p%Esq{{2{>kJhw7&ZYpeAX~M}I9g44tJP7YNVyEJqOcp)QG{8yX*sAJ^A2Ks z&pp>e8BQ*Sb?kylO)pusi9Zu*(AOx!tvjlSs}pK@!VBjl)({#eL5l|b+^Ap6b_8(s8*hAU|C@Hz%yJGME{QP36%dV+QgbXSyN?Uf}?~-g9bXsK}sLoUA z-sHqSKl({)tcaT3+2XnAPK$V4_aa+ZlA zUzju<2idB8-i&#ce)DA!`g_x-(?tCD_aSp0gjEA`EXmyC52-GF&kZW`VJ1PVSP$8do^9}FNIQxr9R{hEgN}>5zHqZLO`^T3QxZTILU%AQIU8lRsI-5^}(Lmz$x=hL{{!)|#IY zO%7IyL>YD*jz$RV*n7 z5v7nG!5}r=oK$;{%|k{8!Q&g#PnZteLgli+z(BvJ?SFA|l&P5+vY%sfmU3lt&D0RHtDJfWN!Vpp=@>!m)=h`?t2XKpv~5Q8T|#boW~!J!e-@i zDVtYU17`xYksH<_4`Kh;oua%f;6ZczndQemTmh`BZv zcd^>I7W;HL^c8>d8*~xJs%E7H@$Jy{)zqBybbac(PtkW6j#_mQQFFR@ku9=xYVqQi>< zzN_t*WZh0zI_jAVuY*l>oaE^`?pZ?e){uP%}$f&GS)-QHlwjQJh>fz zQa{D@z17a#M#@#((^otqf-5H~(zsQ}9IxP<;IG^7{d-5m))2bi>gA_SxA0uSoya_( z^f)b3=OUs(jj7`}$_uztF7u*LQ!6tpG znqAERQqy}6m_sYGI?7yNg3-?;>q%$edw zN_cI;1b)HVq>T_sbPw%HT|l+Eb!26&7fLB!pv<1oh^v&;D$S}U#@DcEIMn*tj zM~W1-As{sx$>j!7{aIZJ&We@F%P5BJPzT z4)5fv-w+mOzpqNm`zxN6j#WxlqiAubN(rRm*#1Ov6TR1+dx)x-lmI4dv|vrm3j|1n zf{N<>pKRpqW-R8MFBB1%?Y`r2MOBPe4GT0E%%lAo1xKV*A{vjAiY$<}o5)|fNSO{J zofE&f(VDF&Zxd{vAdi!&;YCuuG^zY?!!L(}cxmf1p!)&fDhCz6VnN}nn8wup95F=t zQY0Q!ItY>cF4=BXDy4;4HfYu4%~b|qkDQjzg$zIC*?UFshn$I{WW`WK&epO|l={+!!o zy?opJAShLBByPLXtl3oJ+d1Q2lSpR0)oSg#ckm zac9QTxL<4DF4s;`u~WSW8y?3AuG!=ja?$v0P$@(*;YbHy5*R0kwUq3QrK}vOFrd1b zab=K#5GoAFcqd;urX)7*A#Fo^n~kU@nNU<+X9bpoVqISjiwV8ts|2y{l8LEuQfYMW zgjF_av{+gZNKjA|$q4|Eit>t5h!`{XQsS0g#Q~%Jbfm5+O>IR41_cEoggfG!;%e+g zc16fCvE}7VI{RpjRp)MJ06?fK&|9uax@fvSr)tA2X(s4E5im1@AqZC!}U2u=NAnr@08YeMTEo0e@#DaNEpxak>{Xyjf9^e!taoS`20nwnMZ)xSh1B zJYUJ=PDE*yQFsxjE+YS}+@M1&0c(+-e7P&WRbN&gxsJ}oBWjw0T0gLzaXVDUULf_w}iJ=fc&p;F-vvy-wCzG=a$Cq z>l-xTbsm|p(&qwgH%uH`;cDsrfc(IGUZH{~ONFU(lXfz4 z9}k8!?%QsjGJVxx?4JWWmX8N4ZgCmC{UCNcWJCqJS)=iUHaL)`=c~rF=%!uNHIhH| zUSPAj^rOj4Z?T}b>p@uFK8}C@17^=0rBQRx9g%MC%tWAO74L(TIN@J}KqxkwbJ@q{ zzS1S!{b@^oUJri?@Ebfc5@+^sLoqGDpcA>$K? z5G3e_8pFbKmZruRDp?25vVKBr3^5k3;EkO$HVka;WT>+3U~(MuY+w`ZYoRUz4;|fi z)i59p4UIq+)E&7hbuLb+*Sq5{R@_tX3Wp}uB{gY>Zn^s9QfhOBouP)BVMxCL+zc5reaC?5D(@8mY*kz9Ln41(g?5EWNns%* zB%)Tk`}Ig7HBfBWjGn$?M5UOeA|DSMnniz%3RaOWS@>iHk5NZox@u;Vt}>98G2?C7 zlONS`osz7Hm;}TEUZ4x^uUL@`zYp;6O@5o5R*N-&T79Xk%q}t5n|p0QZe#Z z(!YiSX9-LYMW01eQ7MKBoU#>wvpjdnf5G&x?X8`;xdGfa*fwWd%LHEMv!k7zd{tVh zRmhfkig|`WU4$SDSz;VUG^$_g0JGp^zw+qO*Fz3rHdc{$)~bp$qw_RW_!DoIh%3h&>^XH4P~6j?F}Q zhYfHHiWe9_|A3OFv>RNn)p;bFWBbGL59}t6AjSDp)#xaxQ09}x+RYM@2|5#E?gF1?eU++XiH1rS5jSfk>BjBcN>EpSOQg53cE7_W!6IcdOl9;3 zrF=0D8WhOh<~{9)vQjB*#LQTtlfhN7uP*^gi7rqZ;Oh3cJ6>RX?G3b~_ZGY`laMrF z@jc~m?umvg*VHQX8_YpJF9?)fl9O{$v!YA{dU|^HxB>ZNx0Ag$_KlH|xl1|tX67e7 zkGOe_%YNDi<0zJJkD1t!ZCA{|8^5wOrQ>&h#|itTBT8-{=FC#V%4af=A|1vml_%QQ ziyz6x9w~jxuA+kc;kih7dEN zFjFEET>JXpS^x@4A%RUUCPfg4VX<3SM8s4C>I%G(uTG2QZRLp9$p9|s%X-8No7)A( zt9v*kLvlkkl6P-dOI>a?i9nk?4Vt4?`AWo^wn6w;yteQ%TSF-eygoGOu-4>4%(IP+ zqtkt=E$Pz}?#{e`lzFQ)Mg~LsW{r`6e27(iA8-B;T{WW+ss)Z9MXWng35=r=9>w(E zeDjME{YFw1q-oc6*W7nTtIIYX2!ZitQ@yl$G zXa8ANl^S4^Ty)ay&%(Zz#fzEt8U?q}lr1eJ24yF7@bGkaTKPW=$*?M>cStQCN*B7| z$yV@Dbc2FI#L`;YR0;zGt1DY00?BCoK_GuIzfoBnX%^P+9-?5wstg*;3i0#^C(=dT zs2(lh&N6rmxO*>C$Sk|p!kbD4o>5wkTxI>ot18mQ)$x%f?A17CM_gEw$qO=B15QpR z`;jsysi=rZY+TCSmC+vq)<-k!m;o3+KP4kI|(7OgsiGU>%xP`|X@&Jv?|U$7xT zN0yJq%|mh>SVfdD&Q8qdF#~ znpIY3F?ecU^JK4IV>MJtS-voepG;9~dOGy$D;TK7QN&8*2f-TcRFICh#KClOVxs;& zk;7JOR|EY-WCNKq)>UWf`$~UPTY@-@B{D>GN|kb148ikzNzNbUZ|$ihKhDn1eE)vC z^}JVuR!g$R!Bv}h7*Cw$@gvO)WIR4<#4&Pb&cUVuY@2GlvYJ> zZF7tvC$4%;o^EThVo{QB?KbiGoA|oL{qUbWpX86;lGan(x1We9h^Myu` z;)AIaEbdD{b>tB#CJk4}MkdtYRxtq=fcbj-9KXoN!{Y&j zR(}&(XAp7zT0R2=aP`Y)OnR;Df=4drf~ZxQg4&I($>yowkS)Pg70HqB6yn4)7V<5| zsH0KR*JVCUKk_yEy#8JtUv~6wLh|*yAN*9N>bXCf94?`dna0s$b0G23BL4{opoTb{ zk2dsh2-XD10(E|$&9UXprv3tL;pA*|ahz!1)K!2!2MJwJ?K*Sv180mN2@+bW*p0U$ zOcm|+%k}Ub@;T;;Ei5H<+)nO=fk1lSoU{^gQFfQJ1?)9~ypkVT6W4jy-JCFn08g0r>~PIzCbt50e0)b)EoCLcvjjfKaxT}YDu+b90QEOBM!fV%ILwfjSabBzL!U* z3i;{GB<8+p5(rew&7UV(sz*G8c2h{%lEwy#>2}go{hHeo2G)8i=G#G|=mC|1Zl8LQ z-=x-tRc-cF7lVtup5{XruC}>a5EXS>kY91$)GTRKx9`h{xc%3@UNK6G<+P&CJvN!_ zNtPz3GE8tG{fTT_tWQD*)$GXC8gm2-Em2NlP>0fB{sWkvEhC_2y5!1V<)x)xp@pS| zIM-B+xLB7N@1nOo#RlTl_S8WjiKE>z@I1=<@_wq;kX6W92Q^(A#Ad_*rjf5u_*H&aC z&Ob1<@WGVb1R#yS>*zQxJ6q40sQ{K6T!YC!i7t9ODQzm*;6_}1UVSdWe=f|}Wk(#P z`B*?v*3=MZuQdwbr~2J`fv*B?Bi^GWdB}vLf%Jud1pTO=?qa1^|=`IrO_1ZkZ^qaOq<>vpp z@Ea{>$dX}1K;x@x@?q_dt8VqzZeUZyk__4I8~$V1f)t6jkeZT~kiXOVA};2h@aIG= z8dMkIbd1^Rtt(A#0{5jvA*3NHaLtJhOJffk6II%$=l4_DJI*8dxmZbyFkRWPdSk0S zsC(N%^PCcVY{DGz^b0%ZcdXb4$Jr6leXn+}9u11Q_S5JJ#fo`AR~i|S4hw=50enGb zZ02ug3stMl4!hPiHh?|VV4$0nM-Hm?m8Ahx3Z@NG4HJP9 z_P^+|q{}EOrvWADwr$)dXLoHrb>!uJ%TrugakW1^Uubc{R(3$Yu@2_PZ>+QEX|43# z_#3$C9b~NvLvXseTD|jO{D`OK7x7`|Giryv5izAIdt|jdmcrQPusgWj7sh3?(f~lK zPLr*Pai;hEe5XV#(fpCWb|Ty}ennXs>D`J=Oo|-ndiMF2pJ;N)zCf%@^}zTLz&x-P zA(E<;Payx0kPx__g_I8m3CGI=g-!9MhEm$Zkijf4tE_A`Ap;!SKHh{B*XNsk;4FpO zT9(H2ZvPbyv{^AH5}8~Ep7h<7Xhu$3^z??pWC)1f(b4ka-|9Dyn}oD|0pNG8y>qcK zr8b%BA5?cM5r&$8?Fg`e)!#bG6=@_TAn57offPG}As-(fYS~l}$g)wJ9#7=_s+1ZM zb5@i(Jvn(^g4k#8>4-Djeergtz;Cr}K;1a|s zV|;XaS9`c$%I8MNf>qmT_(WS&t%9vE&uEnBV$=L$#{O8Hq@HrPHF&4sRY9Pp{k#n(yJ`g+2C zbf!0`=s4wJuPg8Nn5FAbP3;)p^=GsA@%J^-m5_&%C07p-oOUeK^RRL{pS}y_rlWy) z)5-|%9uKOzq@O=?1haVTHr5VImyv}E*IS&1Ha9 zY5hDTX|m+LqsP;sANM_C^QI(Y_lKi;YzVsU_XYJr<8`;4<+ZLXH!hje9|6Z!%j{-< zG+F#QMa%f@w}iib4VIpFyxF@}NMZPUeRn*Q(UpM_Z8D)uhY2K7vg>nE4#oWOFyg5|^D3?eX4eV3f zb?rIJ5YfD2%v?lL9K{Ws!pG19jy$*($rUcxz;4(^%+PfCTuf7+`KvlhH7bW zUT0ys=%b4Rs7GpMP3ELLS$xwzZ|=;6^WPwaDt8asr5h{*5taMrZx zi;so1P@z$inVIv+(GVvz;PX;IJe_4|=L1DK4Hyc?ogAGI2-?7GY##vgt)#cDxdz4=%xW~qqE8M)MpWr=8?0x4p^4b_ft_@fMs40L~Zy$(AY7iIn9;OihLyH>x_pamu5m4&nx*<+Zdd zOOfDkS^~!^VB!vnRH@UejUJfd9!c9$rXPUM{s=_{-g;X4_Gp^i@jiT8M31@wE&9y- z9L#7HEOH;_d39B%c5HDrEWPR(FAZtMs0X|^)%9}2mG+89*ICU- z$<@=Bu-4r+K*a@tbn1$IL}reWSxF_@qYPgmR$5&{M~Q+d4h&T5UY(sc+gE0nk64mj zYOkjDyGY;}`OI5O%v3uxoaQIPc1)GVwKNTVyCT?81-`8l>*W+6|`$Cscy2m-0qfZ_}FYrIBq>y0|xfAoaR zPbSKyrPT(DMCl@ca8PP$IP$q!JedEm2{3nT(QQN7C?z0IZLkIfaUvYLDX27-vgi>= zNNeg*h_eY&w9r#}q_Ipur$9DRiFrYB#^aZgAgOj)2uL-=V66zyxjf)I`ar31G*mhZe}F;vh>aM)&?S!+dclPn0?O$L zQ+zw8Kw%OTSV-^y;2$$5V62bMSNQM?5D8fN#;YkAE= zk;Jz^{9t2|4qB+z3By*wgaRp!fedEbH6lOUxu^P&K;Ru7En=LQdx7kn z*E{9;Smw*B2-?d?ETebAS{xjPs4g2Hsp68O?%;*Y;e&%BYEnMei}m^-lesBfFWFOl zkppt%1QT>&ai*!tlqqZVGBeL<*R*2UiQm|&V(FjbU2)DYu@yMLVSz38uZ_@u_ZlqZ zjy}S1pPh}3Sh+iM9UVMqY6cPHP14Xc<~O`>XB=l6|bdXDh~ zkY5VAUv*DUqcRHrM>jfZYimo(*zs~-Y0oiE>ghv>t6{KU(R@IIDnCA#=V=@cG6?;2 z+@S)2Od%kzdjVNQKColuF7r>>PXxN6i)38~L@|}J+n5g&t`SHgz!{{9yDf%8tb81a zWlar+6j}~QYJklMgX6LLyOu$jypo)A0>}P3}mT$_kd@J|2 zDlMgV#(b>nt*CO8RT&XqzvPon$C*oVP~f3`3J?9i9~<%wQ(cB)9=ru}5XV2rD)O`V z+&VS>Qa2pAZuWhXEA-WJ^1OGPZ8#896-yIipQ!^weAEIprjtm3o5Ygn6c!`m1iyo3 zb&ab~L#7r)pyj&n_!)+GSU5$p=R8deg#FXckPtzzjSEFzK0#tO2fSq@$k(Gnfs)bZ zgh6?U+Ovju%qWe;hx3-;UejO6{o}?=z&nMP#9;sLiUa;#*GLp8kL)`tC;G&zO@E9Z zHNC7BkDi1Ll5t=2`QB_)%sqZ!D`PgwjzNP81n_7(bg)MisKXYZ!SH579-`#6N&K~u z@>rG4tH_cJBWBK7Wml)vLz$=2`Gk$eW^kH?jVfojw2m{(v~iajct*NdY(6>-@*5jU zGcrtg`7)_m0@SKGtK{(xSU!{C{hgYOwctxF*PH#^QNQBN`z39`+kA;EYq|bj?f==q zk_|&Ba&E!au^VZJWf3t1)?AKPEYQ=#(CxM5G(qO+A26beD77=#N^(*q(9r>3nCa&U zL{*@ZLrB)?VM#c2I8g955dsyhd{shFA+`9l_|vl4s4e*7K{h}MD^MW zd&u+$&XWkT=m)6(F#f+MUjOYrR3qX4e*Slpi12TS|FaYP->YOvR)KR1{^KsHxO32d zeuhLJcKy#@=*_{FM;Yi;B85rZZzs3_U-)c$yXWv$t{6BL@bz|5h*`fgGbe``Q2A%@ znop4=me_8zdz>yXp63t|5fz9>!^6VbJ36vSdR%UF?Ck7RR#yHq!IddDM@KCIg=IiM zz{bV~P;3T1(&Re_FaW^g@VRW?UQTNOUlp)uu+;uz9Dh(B=2-B#Uv@m2j;Hp-Z2>my z*u(@-i6o16U|?XHQbs|6Ytz-h!~_!^o!w*<10Nqh(M*giUXmi6#Zc7HaQoqWm7b1n zoBl*=T=W)c50*AOHx^tE($omEz{+W|oqEhjzg0 z0a7kve*7@Ewf!?bE-NGRdRo&pUIz6auXWxl#In%?sNudF8R4R>wR_ywPYPOXVnQMz zA?f=*n>af+Nc9DPLBJrr9c0*1$)*~ZZto7oZZ_F%0&Q3?-tGn=BgX~@2Ll`hG7d|3 zeiVhbpdY|EB8Ecv=<4Y$*64Qu^_xE9AMfqm0dZtTt-3-v;0FOA8xEiA8L*bI8MXV* zRR6=o`r*2lbKrKhVpZewa$JHFI!#$xS*crREcM#j>BOB0B&WN3dZyq9I;=(C}5Ne2uiVD0MP&Awx zHn5r%XhN=zy&)3d(gI)D+S(#uF~p4kCtM-@@0xzI;_-Rma0&!SiN8W0O1?1bZEpG< zo}7I@KfE3<7q;AucXDxeKDKBq1&Ef^@XBEgrYU*R%n`EWp~OHrJ-NwzdX} zQZzarD?6cu1qW*yo3oHmQ5^u;_k$Ipfo)YI^A#zcc|G|L;~1augSBDz`&EfIWN*`-g{zdwb3w?|(n5 z2!?NiK*6HhK+cOr?bm#uq9-uN{1U!@>SnP9WR9ncHFiU6sQ&|f0&if`aM$c%5!z71 z74-6}=?$b6f(F+w=1Z(b_n5}g<{I{gaZvagF^^L&t)*sN0bqHvSo%U3UG}p@FJ`k* zeu3xR07DNz$m7jTzD%wv9XcACFCZZ^o6Q~^90dGxX$mwxzBZt8kRvz2!Ci;vJvVXJ{xWES7VnNQAtp<3I%wPV=c; z;8nCJVwB6q|NQ9$s5D^M-~s_q!sBh0@G`^Z(j0YYQ!c0uT zXw;rA;Go*$`<@H*3TUC#1%ARz2_LWH!;crId*o=oq#VJ=`A#Q=tWBcvqKRdy=Eahd zKYqB~`_O(_PL{v<-urEQl$*&P-d*?0A98Mmto2dOtbOaR0<7e7w0LsWpxYnwsn00U z@7;YoPwsw#oog4P>Ry&|mX$E;{XHL@-*k+z)%v=Lx)y-Yxh$A~3MvPUgDE~T|y#VdG&Sq zZ4Dpe*V~SP2~X7%=BFQ9;y-O><}~sD*%RdxVs$7VdeSRFmUAtB$9o#UUFW~LgHO~l zKVe~oGycluQ-`92Bz`(H@U(S{& z0GrNzEX!GWYEDj0e7uO;@4C8#p8D>5?hwGj(D%L;`|>5|x@=}<1}I0~UQ`sqR8wDH z|89$I{kcscN03Sd4e}R|58UlFI&UI3STCjnKirLnv z`Lr?m5p`|}G1?Wws9)O{ykLEcrsQO(PxPd4?J`Huy-r^6)#P=?R+S)=u&G@5Wlv2K z0nNya7_AEh%fe&bjri%Fm?QUtq{|IWzOIk!BK!RBTQuGz!J5^#8SBTu zrJ$R*!uv$AV!pt0wkaLqmvJ8CJIrlRZmD(6um9Rf`@3M;OL8O~sa&se!T!R0IubH} z`>n&=zc?QkVjtz>_efoY9HDAI(iiE)#!h;==6F=MTVSYeewe1U+kT~Pd06|QN=in zEfwLkIjYp?C911JF+Ce=3-J-y53Kjr>7NFH$W0}(6Wv01l-5yl>a(sH9 z;Y8#N_d^fwF%%zL*x|D2Z^mM_=hebXP09M3^U8-UeNXXfe-$72%y*$bZkgPE$C}7Y zAjyw$K(*~AqEgdbv)JjXurknh{bysDIH&nmbuZzY^oXiA`#?^PPdO3D{&85*cl+fG zuYG8ZkWXMCR*MEnI}L+xD*ID&JFnePothctmo5Q5cC(pgpYI^s;U+V)Y(g%k#to0B z5~+F!-KFk>x(cVy43hk19#!@}T}zFH6t3UphhsiM;}(d$u(4lX&}WA#X`Eu^-@ey1 z34kO=**-IDURSEy2jo);Q3}#-sd_hDR*QMCupC4xkawIr7}W2ZNT6Zcw)G-?d)ZGg z07K%Q!=|EUP^bU{{T^ztldpQ*+J(PfRzpCWoPz){rPooC_dvmT+=s}GsUOaPnD8*W zOuxk;;0u%eS$SCwt;A!Q781ZBTs_fYbhtj)+<589tjjIzx7cVFRc20E+O=_K79i!e zjio;s;Jk+i#if)`GA6?8I+83dR;6K|1wsh>Y%BzS8i3IF<79?l>Q_&gP*ETX=`Hz^ zvr|8x!2H{zl9;{3x<9W^X?_utiHUoYh*{`K>n$6NcGFHt`OO^px304Ow+Xiz8Jwod zHKU6c1qr_TfM}UfWF`ekT5(sH|MFr^x4gXCYOe=|{zN{(Ux(<8{Ul~wR1tp;MURz+ zS{!pv@4t`H1~|S&C=kT}ANnqGioe_3X!5K#6t{ojndD5J&GY@AU0~x2!lGovIqyl4 zDIaiTQiTAyk*p)&xe;U1frC7H2Ir~o$;o%}M@|#P+sr>wgeLCc-?pHv4x&+(Au^(6 zsxP&hSsDpE738%!m+^-Js!(#YFuP<}*|XDg`u%FPt&qCCqOy4iX3*5dsu$0`A082H zMctO13%o+*=p{B$TRdmed(NVIZ>8^ALGI6cn*|6E_v2bLiS_)=)YHAX$&$e$s=Ui? za*8G+^)4~5Q5q8cvEA>!BRW7mcPAxi_J?wMZ6B^+-2qg}EU%U9UaM)jqpeb9A4~8Z znPg-o-SDO&BmYV9W}vi?llmoB^4*L{F^yt;Y=8G#URSoy{JWG-cL zaxxGBF_kBemvp^Y8;R=%XyuPdpk5T4N>WM+TN?{V81M>@tDRSEdgF0MhW08$_DtX@l$ zEWWw~%G)vMy_xnk5y!@+bJ$qT=OR;gP`tk%;$YQk}G zk552%54y}rZd`^T6m=5+H7j&ptb8Od*oghR88oF}hWrZxWPf&Juo$Mai=E@k8wvpe zi7oehncqkh{R#r3eDn_*Ia&+f7dw#miGQ`BJA8djcQxJi9Fo1Iks;vX zx9-nSNhCElHAep8RGM$R+VJBl9(5aCXskSCO|Z`K3+Y8pt)Oz9(acpXYF~+U1+s!P ztY@+BRl-fXrB^%*u^SO8dxVeuLn>-tpZK6Ys$BT}{sRuD9pqUinjpWm?i(e4w|+1L z$ab z@#wo0U2e}Z@qoxd8{IQs)1H3~>oqg`ky07k!=7Tt`19v^D(m4<+9xS3mwT;i;>ynQ zrizFTc0Q|-LWj$k$gUkhr{By!@iS}b3T-9kYHP2Ky(q~9@j*}TP9;|ggPr(--s71Z zEp{x?VG#f21brCWgXuf|{eE&2ZU+-BNB5vvDiym1?98K{^FubW>#ji%cB_MW=xLE!0hg7Z!Q48bd9wk>F7p(h zZ??dGdH4rvpO9oV`ltJDgvMKRA0cqD{T`lr^}=Myy_K1>bISb?YA$*Fch{#tg7@)z z`XItjC+N*Tx}rR}`02`4yp#)#7o$quhJ2JR1WYo+-unk?jpR6VX$8yE1hbT*v^yP3 z-Jh3$i7_Pm8bg@XU{7M}m;l6qyyJ(7K>gUGN4$-B+-+!}|Btt~4yvR3wnaA~2}y8= zV8MeE+zGG=?(V_e-9xaAyL)hVcM0z9?(QzP^X2=UbL!Q*@4l*6_4==_y<67mUcKg; zbBsBrI#+7D86b_pxjUXc06@doEx!N=*mAM%Y>sIgK%(GQcB+$kJw2`u=R!k6$wnIL z>(|&yq@{`7j^?YwX5y7Joqw~rbm)esrL7oz+-5_#k3jyD(Xuy@%lnNH_!5DXuM71Q z*!fqrP|a5K{hW7#<31y;OS1CPZtRvPp-rw1E#*t-zOEO?6j1n^<_XC#4t#}6A3f&m z>XAW-qG2zmJ-fzGC7jm;BPln1c|5LEXxd)4F%mP0iw4e|AIve_xUHZ-AgeXLG+LHw z(0CFrCO7>&sM1{qGLjQ55rjX*X|CqprsvrgP^a?-boEtsdANmW?sg?JU+MegAekD7^kC!kov8YQ#1t$dt0d98( zlb+J!1X!Twj&STD9~17juUK<^1c7GRgf-?}zVuPiZB79hsSR29i${3PubR-E&)Ati z{76jp#w>uDhZgQ1LA$^_;Y5;_j&~%qS4ezA>-mrK`Y0!jW|@R8@f^KPLLL{Eh`H&d zMUkT!_ze~DR8^Zx!lndqRVgR=bHuB!&L)?=@{8_#aE)%A0csyUtu(>b`q$aQ25XJ} z0wD@&KW2YqnEQPn({}r_rnU!ocvtq{Y=kY*x0e_=?$M+d=P@46+QN}-F>kDpon03; z-k7PoJeWbX>?i3SJHJsnm$X<6p8?hNHjPtyD&G=rWoXv1vRkT;8#!7yw4{cXq^(R)pjrDpg9$64 zIXn=W)QrVfSzB$XwMEi3d~z!C8&m@IseWkD#5gRT!|)gB7od8Yr;C$n@8SExUR1Up zuV&fqdhOtrZvXmL6M0xqSYxv~Ckb0`hOvjexzxJ-h8mXdDj^Tb)MMXxji;o11>G!KVN9W4*>e_7BV=qY_3jL&6 z{D9K?zcm`Q)Vc6xgjNYccQ`L?jtKgMZ2ArUczp;4BvQReF@mv1s!_SR zy4qGGwcP5dbr;<_U;-qXXePA)BIH3q*uxB9fzh7!_V%70Lm>795EsV!W2mB{qNGwd z>>qE>s!eAYPP~nH5D9pga-j);==G+(ikeyw_*Z&*`pvSdWnUyI5INlfGI{~YfkwlT zRCe3#rd2<03#h2LmYKU7-CQcBX8oCy4ey5>*cUcWql1R(o`Sk14qeYprBx5Y(hE>} z)XAj;j*g(CM~Ri2?&AR$sO$olu|-KvhA##s8a)@N=gMMUV>!_m%o~$l)Jr9I8IZhb z4D)@$T(4u9rV@sGKm#|+`JqC)YcN5E_RT|u$>qo_ym~@vc~|!1X3NxB0F0%rAno<1 ze5H3yi$_qW%Y+f!v!EYAKbz}+yGFJw+A=+`@Ybbq53?Xw8m#83q1n z!{prJL;Qmf;V?y>V;Jrd4$P`c80_Ai-O?!96!YPa*_a?9mkVpqqVpEi6s=`4yer^8`mJv2j5qR66z}4iT#x&8&DB^!=Sbs0^Uhq_;e(} z?BpkxJd&N&ny%a8I5fA?>)?UlKV!XX!0Xiw9;>5u9VbE?9ul{le2VioLy?{kGJM?f z0Aty!m=2enGs0$|1@4Q9ONHHEHN6&r95PE>kRw7OSF|f<i_8 za|DzdE(l9=^lEEP9|XexA~RxINWJ)*w=H{n)vubu*f3}g8gOcGU_5$b8S^J*-w4$f zKbzSbG&jQ#uo`;20)04r7ovg7_yhJwqyNaI!e(}LRAJ#+7uHus_sCfNm|4UCJkky* ztCIvZ#G|B*A^N`PSi=~oA7a8;oCxViJ869!u4D&?2~BE~%v%WYxcxBUm`P3jM}uN} zj-zD6--6k!*SoF`X43dH03Mt<`M9)#!f&fsZMkp2BnyBHPa%N7I3QXJBz_t2J>UoB z?ntKt;D?~*GvpZ1pO2rej|%W+ zVnFFl7Xy8qW3Z=qyifVBf8;a`rJZP1e7`y#1AS^vsd4G~O}2Y=xG5h^ARdLAVwlFV z^nFZK?krW~jmVjhXK362pKOh(ph1XyIn~|$y^rn=>gLrO=Pi4DP++9DYl)e<4GD3M zCZPDBRbq%)zrn2QR&w(%G*ztD@(SL2O8`yIKNb$i4c3JnrbF?lRV&V9ty zgUxxQ^8}1u?|~&It_D_PrZSY3_Do;z?NRRI0Z;~J{rn&j>R2*{Lank@oGqMDiV&v$ z7Az}T&#%`Y9?+$GT_O)k)<}yj<7(uCYQ!jBFBRcPg$4nhu!2~mG7PNbx8Cn} zt3jn?!HokQd4Im&kozdp@@)2K=Ft(!zLKmq{1z0zcG4TEPi~49-e44C^m`rJ5EZn^ z?2LmFIe-pg*Z=A3AIdQTnNM=mXtC}&v*b||wZt@MtK=GU)pgq+IkOQ7Q6`ELL;Ey5 z>p*0*)iN<=^X78_o!M;>7W+RS=(?8w<#+)pjFLzBfjae%U-uo|f_*Njsex*M5%6=_ zFphjxLpxi|V0sLBUyFAeSMTqnCFHb~TXHDmR?OeR^bpK(0z zBrb&P=lw4t8ND%1IJxU3iSlWw>)`QeAMdM)hCqY~Gw zE0?B3$B|%Q_MOr@>PxMqnAPv_#5D9Q<0!3WtGj@7Z4q9B?6F;GN5$qXzH4i1ccfQu zc`imQHafdq+(O%1Vr2=xjQ9r%A>0d1hdl61=_5B!mTKfU~KXFj-!#bDA!wr=`P+8N1lk;db|FFWP%<&olpVhhJD-@^~ zc0*{G~+xO)D(csLVXnw=#0PPopn6E7`fyG{QywTFl@%0p(D67+yL;n1JMNv zj;99@iyjF?r&3o>wFze;e)rSq<8M_pwUGoyL%@h{TiyVeyrx6ey3X%KA7b`8euVS= zrVuKu7SLY+&dEBT9h*0()p&qQ%hh3ImEwK7oN7w(uxdkBZ0 zvf+jb9vK@M)!83RueN*B^k2c1)zoNKn@oih3Q+e8B6a-^!gP0Yt6MZ|kRy2IWyHE) z$tq}Q>9Sn>7X&)%5*Cxy>DdekOkvdr|L`Zn`q^}U@0&@{mp}LU_)L!9`oP~;_k(w) zLAUsay`Ee+nDhOgMU&i|VVVWb220OUHF$Q1v(|ubc`#kZiWxqGB z52%rE;~)UgO^HUM0}x&Us#7=vLZ@`;N8bUs1^5f#cl?3$0UTg)aS>RN13U$y|E5Bm zEk?wqEi&zFlC{+j)4GLEPEHa>wKIMt9A2)ac3oj;yBi*^%gXt7f7tkxU5lq)Z=(-D z@^*$op}5X~lq$J8;)r-psDYr>CvAw|yJ97#!30Ksc57SPix?^;QBhHg#X4&M>UVGK zgoPv}E%>}gji2~aKV*NZ5CDHa)6f(b6u20unGyXLn*&xx*tCnT>g_qApp2F-$K~q8 z&Q=XxGKakh@Ie5$|K-&ca{>Shnza9XQ)w{d;u4rAnDp)%s6Dr4CIDUiVRmZjYKV0u zOKf^^u?avs2s|Gnf;Vnu>5a!psHo=Q`2adX695RWc;>=y`>zxK4U@itDk1ZsV__2&9Wf3~x;V`41#_lH@cs8-dGk>Ps=AnKfnD)bM(0mvl` zm%ZaVTUjsqI`(&6T~sVAVaIC#*bc&^GoZ))s`mWxzi?52pHk3NRO1c2tGm{hCpu$> zyu7^IvmOF$l#yiii@oC59(rmvw%NfhK0ZFXT!1WHU5?V+)U+Fk$LrBlR1{o~!IL(U zyoxm}#LljdR;y(ZP@{XeHfJ2F^x;beAP8=! z(;w^)L1h0Ebzg9zFo*fz%bzd5Pmo_)%IkFcNgx&i`6Fn-oqgSO-cLm=6sjlbtvy?$ zQi+A~CwF3g1&;RK+=3mDslWY2u>dDY07Ow7ljg9eIsf}@yk5sXm7PZrk4#K-d3knk zs00X<0P64LLU^-1lr)noMd0_kyu2Ks9YSd4GI-Z1C{0)>R zxO=);AqYhTNDes?N!I{dqw9XVNxK50RmMe1XOwt1G8~4jap4tcQ?=eo7mV`0=Lul z>0-5oQg{{?mOrw@x_FV%(U)IO?ty9!VTqd~YgUTIs`kK~1(;xsW|x?Ot@(w8mn}Na zv-5M4A$eb*O_=ED`SJxqZ$4{kYOVl75^xQJ0s|*as+Fl7Y;FJO)#EdtuR}@6IE-?! z?as-G6RZQ9E$k6{ijO%rrMD%k88^zK@$Pf5~tN_+wIu~!PP5EOG{qfR=~C- zZrWX4T>+zX8JOkMcomu-dRg%-v9s|WQnC9_; z*<*84US0jMPCrc=$VLGAwKJ4-QwO7{pg^Ns_8o9t!uk<_DN0sOF0Ib%Xji74FB2gM zF&yuoCVfq+Cgn8BKphvnCkLLN`S(6u7T7#r_pRs;iYk`Bn0 z9M2XjrZxpgJQOBiSSO@|+ng1Lp_HWmLbN)BGsh8Lx#}*|#JeuzJ$~U`Xoh0yo zPj*_y9pE?{80oRQ%5g@){n2M{c~4ha1IK6OXq&=zmh$|Bhm8C8HdP5J=4nzG?t_dw z_6`Cd{PC3D!@h33;L|g*UsU?&C=tCar6B?HZ~i%YG^1o@+TH>>IT<%FNDS~pw9D5wQIr*EXlIceFh^R0Lt&WF6okMNG<`ZwmhNCn(j> z%>$8#AgVnhsKXZH?{A=V(q4rByInHnlYf71;Lv<2b4Jy}Ks2AxiXvF7J-M_Oct~9q zH!?PEceg5B>t^`x)RJf8BG7d&d|+J*d+-7Rc16PqnfempS77h@4$ORoN(p@ z&*6Q9GeM46o1U0?b}&(5?UZ%!F`&EiKQFlo-F0hs_~?Pb7Ttx22nF8h$&x_g)Dgwb zrc!mps&aLP`;A|#Clda*6|%Gv^W57Xooh0C5!}vn?zeuV5gFfCYEphbk&WOGN^uSgXXja+yPKUkR*Qcd_f zqdynv8C0$iK_ib+kO#X3x5we<+$MKS&Jt(|u%7fLiTQNM%R`bUL8IYCMxXnBn=wXv&h zIy)zaQE75s>orj+a!Ud+SOnvk?A(`dLu>yB&Qp$tzvc#Hp3C0oezo>t9RUlo`tzcO zI5>+!SOc?}k$dNzVaYhPpGMil?Rp7}R0&&7c$Q9yDJCR&T*+9E&r-l~lFXZL} z@Bf5u3>!)0n&c_|RhM}`=x1se$&y@u!`S0;SoGa7U&UHQNF1A9ojWy=)h>`T46^&} zj?_1ysx{;da>RYBzocXP>JJV=PI{vl>e`dG78dSC)QBG^939`o3+>^%7>T_LHXj3m zW~Sb*e{gAp_t5?-g)l~=uy-eiSvplw8!+fHSKqX0Ol%~b(mObDV-T&xtj?+O17_!( zVCSO5WIrEgWqi!FOu&+;;kV*u8jprYW-4$_<2^zJKil6|MkZ%#pcNZi=WXcu@z{f$ z6shhljj}vF6`5GeO?(HZ^n5^Yp5@4wy^oce#lNC zcS!KD*7Ls@ujg3B&(yr}a*Qn7kt9MN4f@%CEU zRSh3GV%_O*JGk)e`fOMt^U^|~kLUZKa7~W-6Msex8ou4r!#4Fz9p{7AIrduIVl!7U zYC$g89=;YZxJxnR<>+V4%IKOm$x@8(PG}07^XdbZ}t!n{gx0Mk-ZCMDrZSWT5zA11za%F;Y$ome+C~7(212Dk-4fkO!)= z#CC$6KK&gh@ox*+1>*yF7)6 zVSZ$M)j0*L&)Qt*3x+yTK(Tq4sQwcTksi!HbM1FZxHyRNlXucp7CF)W zzF4U>xJJ?)e2oF-G9_nK($)}Sn(bgTbBMoy4hv{<-pieJ$Fs5_BFflFYCl$ZU?CW0 zY@jC|A!IAk8VbmAII6`#V{c9VdEPqX{s%ll4V!@(xkV))B=IR4;sxfQtBCR zPJle^$DEWU=j3BBxE3x^4cE(Aj`q93a%C-hL}DJN(CF=e<#aPAvi;bO`ahj(lM5)v zG3${iZH{+onsVV%j!jEKL= zp!lfde?0VV_3|tY-N3lLe)^f5eEkacVTIw!A=QV#Z|3Ca@kk#TZQ&9 z?=5DGC)`D6y|pjeV{Pe4dSjX8mL-js17Q#6oQ_6*)_5s+yOfdy{rYa-5GvMCkiYPY z-FQW=%k|^9;PB)o)jzF{dAlS65`E*wDhxZu{gThMfhSMr1J{qoz$-m79rhm3bl5p< zz+rOqLuZ=QV9#AetU6w;{cE#Fu-n7mLyeChXoy2JN2u?6M?}76QSjF2E_GMBtRuo+ zVc0uBt4&JBULV~@HLI_rVoh#b9%oH_C}uPA(>1IuNU>&T7DCKIpTSu$w0P;~Y#;x* zWX)c1ZTT)Y>;~u9G0uHec~LDha_7v?F)axDh*kI35C;e6stDe_^l{(ePd;d~tXBwy zG8o%hmPqhu*4Q?O`7fFDr6ZqimT@(H-@!SjG>?=$U)APu`u7}3c2RzyQ^2wa!pGwK zK3&<$yff=77DI%YbiChT8`poE>Wv?PS5{!E;F3`sZ8)7?SR`wk9ot+FzAC6VAgM;z z{_=N$VZ?0Ew!)JlkCG6dgkDQe6*{oBf8|I#QAX&hIq#>tX zEPLu=@8CV3aC|;OPDvgNxm_H&eNI9@pIq9*y9oZ)Ikn;XY|h#)mvX0e1W;6J!1v=? zH(ScB+r(VWCr+4f2zjX6)K)b9t(#;cH0+N11*wn*Thi&_Qm5HdNUy^v73)YE$CIm< z7Xo84f$gm&h_vLM_ppX0g z!*f{gVa^ybU9E}Oa9WYAo4~x%cj^AEIPfyD%gym{fv9A^Witt$$-b-is7Enx5%pTsT_vE5uI9WSlR4lpC;m+KrtO z;%r1O9(zCc*TS_`iqr2tDGbzWnU7SW+GVs4HH^EPDmqR=!>_7%AO3ScP}}5d?`1Xo zg}D$AeZq0d(%)Y}pxyERtkwRv3-bSQfOt5bdZXgSe=m1ck0fFWYAV&BzAvKc!wAOF zqRKccOvRjwqE`Q%a95q>6|#GWnn&k~LG+;)BrpU3=V7r`Yo(U# z7d?L&0q7Q1R^q$@E*HYtJ3u$v{E!A*b*0I9LjJ$p0QqPok7}2~63v-8cqsbgfNne_ z8BGs9O%E@T#DDz^kOop}<$wAJWOM!>cAc$?yZQ^aQpW$YP~T0&A4ITN&fAZ6099$8 zw-C78?9TyR__O^m9J-os7`EWY^!?Yh1c63T{xvZFpLUM~zrXxsuC2uR`(i;OBsHoT zdv%qBoS%r=%k&?@aOYZ`;@jlkaOZZDnX9q!pU3yiwI*2seEGWaX`0sHhmPc>6*@*0 z)4vx;N1vqKM(7ekD# zJUS%{5pWpACmAMQ^bv22t|7o|i%qYudmmy^Xdjs&QH&9 z%(B@UUk2hQA0Dm~58<^Q4~qJysoE^dgsra|6>x@)AbD;laax8NIZ&NVxL2eJ zs4{oU_A9AH-?=miI342U33~%pMsef4rVCDD zBp&RM=m>9M;$+sATR)@ZMxNpMKD@r?May5qzcRl&yC)bGp_V_c6du5V0%Kq#etpE$(x^a%E{6>gwb6mVSrYsOaV z6;e_PNsm|eg0>McCVPJo>ColiQy{vG93R8JK8{jyFF~H=_#jUX(BK)bUeU(ok!-~O z?0xDSA#$I~j6k*~-OKG4IIJV0MV=Y!p=(pf?&DD48|-BDyQ+t2o%Osd;vcDXH9pU^ zeJmD^NGMxd%(}gsFKuDVo|;(S3luD`eDk1No7IP|y1oDpo5IfBTg}~_r@Pn=T?8Fl znzVM(9c_@U-#dk%sXZ|Bt*MQ)q;|QQt`qVDO`qBQoqk-xF~& zF(2nw86_#@es4jH2NB(f`|YNcgQ>?TQuyc#2CLH|&(%5inN&!U4oZe&PVEMK<`%;y zL#3>YY#k{g5{<`8H5Q05$w(6CVi+Czw)<&&8VOk>Szl8@r6&rL#4xRN993rH{$2lM z{I0}KpC-4NkWWZ+b@=OH+i6`AG7cX)LSZ~u8{ZMG7RmIFGtsgT+36@EVmAm_+};s=408#E}Sa0r5GvqltwQbEWVf!u1cVHFH@M>hu*S~0K;fapgnm2dkj=+5!MTo+n zH(cW}lZZ)#l*i3k1wed;hf#=X3ceNR%c6dnwqQ{wLYW;%Oigb?msN4;_<2eJtHY9` zMY zI{U3F#Qd@L5Um@a6aLxkex3(gPJ5h5q_$1T6xA!IlScLzCE8!lt!qTcK0m=(h#Ac2b+sj?gd2; zy`)A)+Dr{Hn(vG4?w8qneRqVmOZ?N_s)ljzmmc-uVsc0f3q=bV#5y~0I}}SQh7D4l zntcG**8ZJp6XhUZN?KyF;w+o^R~5z1NYzf12!YW{VKVEmL@_X2Cpz1Mc;aq1(ib?D zu;fY$KOD9A*!aX!G9n`VeAy+HlYcw+9Q~tTDrG3fGn<#{^Q{Ko=GpN(&hccGm$_?{ zg;tud%j!sxxz0I%#ou{vZDB(dk(`6CDs)^zE+gfJ#Biv6ZDu3&dM*5j#e_d0{?8k zP!zwip4>6O<1VbYN_@Qg^_2p71MRt$AnZ^G({rRnIFuNOi|7e~75QYuy8E)GazpjD z%N;s-)W5j*ZVWPgPkw9?JTKiT>P3@C#H19}0!V5L+Ke^Pu0u&1FTI3EQoj~<$1=?y zl`z#Q8)afVt)3PW3#B&0r&XGX;plbl>uk3oqXY zoM>_b3)z3h>1k2DrrOOdjPY=Zrq!&cMzo_V7tYva-4XWY(i1eoJd|LGQVmrJ!;9C>mqf^Eg!goJ z8}D?$uC2*KsQt%k(`ZYWs2JA%U6g}3V!ro2UI}nCA|D~n@tGRiv}kc%Jq%m?^*KRb zg*sIO{%P+2i&Y*NY_K#Y#Db9a7kvPMkYx~UFaB9I?oj`G5hUaUMs*-gptUkO`V~mQ zb+By+hpF`5bmz4b<^1;;juiGzb8)0p1t1&OobAK^F{=E3jWu(q>i0)~sbrWWE65p~ z=b+*OL><}K+}fwjNRg4%;!(Isnb?@v*z82@Ob8!xnU$UGPOId%+>=Bnro~~+i*RC+ zS7zt?gLBLgqZM{6Q&3vYh5_GtGG4|pIH2F+>@mhzCgX+&u7;l3K-I{|$jZt|KJd)1 z@=h%`I3YI2>|R@9w^?pTwDE){oP(F0k_)&Oo1NkWxxoJ6?VGjs_Kb|R2_5{azR!%m zehSQNvL4Il3^lm^l*z!kn9FI9;|KEj1aiBwVxI4M77mxz$5$o}$1BfwS7nAIL`s@k zMe@hw_`SV>V~YEX<}(K^TyEB2*DnYjg&UW%VL(pvYuJA{#8Qm*ii3%A6$&CrOFkxd z-Ns|4dLo5IsBxqfa$D9DbTVw}t-GJthq!cgOT&gaWyGh@ZaMCOMP zQ_Xiq^Wm-bDorlyHO*cu{lR$@RH**k^5B$a3bJN#%ZbZOhE~XX2zS+J$QM~ne9RO| zmAZ`|m~vRW=4Xk)=7mk?x;o>eu#QC+5qTFIhI9*?O&je3bK}vw5;pL6tWU}gP5Zv= zE0ze6z_L6s53Mf}udpe8JbJEjCd-w1Wx+Z%TWq8^mVj-%PAmbPk&};}yf<6B&13`}diic@9#hi}^Deq~|~CNk4-*{O=FlFCdp&#kVGj#7+K z=p!!jqjN~9vyr!X5fTMdiszNcSBN^RCb;(s!}tlWqmt=L>Bpj!`%(nh)b0&*tF9dR z=a1}sp2}79g9&?&poNs?{v!RuAX=qSZZ3T*f^N|n0Yfd?CHYm(+j*pjF3-LieL|KH z$E>8K_n`rD{t`E6i|h(Aiunyj2UVkAbomX<%>YgF;do{;u9oQ8UzcVEU2F;A5bO8v zBQ|p}@~O7;gQxx5d+@=uRhhz&-o**95%iFb?MWLk~LEY`Mw2$HvgPm+%9>nR`H+zm78Vo^5l%pk zE4uy=@qS95IXFZ@cO(#*4R%U_nfePYa$&5$^U?tiN}+tv(l>GSnvFIub2-wzu`%PY zU4GHWxS~XyUANMQ--@vX*!{t&7$0$QIm{<0VznVywZ5D+5{|l%+40TY6H;4@P%{St zWg5E+>{_dZ<+Ml)jx^Ouw)$w{-AXPBmO(FN{cP3UPsV2PqpISGl+_`FsWG_*3Kd{c z=l!#S#Qq1Djr}5K)4-n?-`G|fy^6Jq^@(#!B{<3)%^@6LOeAVlH53JZ_DAPYWVE-h z!J=$Z>*@^(EO52PJxh8$-qyLzC5wbWzdBZTQIyLvIQ%UEq{Gqg6OpPZbOs(JeRy}| zyDv)mz@+5@`cZ=TCl>Q{rbAdSl?4n&as5)LSh@dLb)j%x*9%ZMPL01Lh}IPBuHh#z zm<}E8UJ%F9AvSSNs%gZdpeOW#i;~A?Q8ze(?V^y7i5;TKM41)(ZD(_E%2Cpg=*r7$ z%Ce2eDp~Ud6lu?pQN+MEH!;E2$yjk^3J2Twv-DlFw^DHB6r!F+4EMxkMVeX;>UdQ) zCtl5_J^35NtbHm(-#$mY3z)o9Q!?ns7>RhFlrlwTb=TnQg#Z`PWjZeJ-#>^;iVP(4 z9bbx`w3ZINbC0D)lsQSo`-t1XrolF-Ir@kvpYxlf3^ndGJJUjM-H>uEB|jMQBgp!%sFfcIftX1M`(R{;u2Jm7^=+;L<`l++KjP;)s3dY)!GX z4s)S=MaM&~a^Xc(<}W$YC>`CCD|bpp9U|745akMUzqn0{a+sIV;Bxc+!;m0do8%oc zwROu*;A7Y9-KJ6@@`FsF<@*l5()G{3m>8$hCwz8vseqf9Z>;1GsBUvnhQ#?ma32L0 z*VoTuNKA`5F|zeA(2WgXa*_6~T>9Uq$pQic(y^(Q1ZcY*NX*ytN%mOS0U^>FStOB2 z5e)@?UDI&oMOVFBoE=z1I$K}X5{7S%6P55+=;){-{lioQT$)pj9P(^b#`(z@qrUkt zxkFrZu)dkmY;(Z))x8hsCH>Sz#*-aP8kfV6-M1!(S^%(-l$$&&JttzivMtf8xk$B8 zn07L%QLxG@!)Xe%`@9HsVq%JB<$8s?vH(}&eSok=j)57;jpP)?pZP&$hPej_Dw{|c z)&hgGt!nbFk=1;tNH1SDH5-jX3=8E$otcUZsaV#q)If=Imo-Xl1WR^bfDJP;MWs%T zxC*hQ17jSGL};+6qgsXeUGs7#2bFQ&3;lYOh%Yy*T=Jpi4SG=!o{G&Ui!BZ!su>|?Y< zlB}2tk-bO%P0TPK!+YdHdCDnpu)8)NBvA)#6#7Q1T{5QvD`3z+MO zfI)0YTWiwtCd5H8c8uTxM7KCu4gSX*3GfxgSsdN zZo|W3@f+Gj6o>WI$T+Xlx+N?%`<&c?7$u9}?TV!6~~tpk)Ai4s>~vT#?s?PUeh~z)e8NX|(#9(ex&Lqh zxJitY%F!=KpT%M~g)BcH8U#c*NvLx6gb;pEZz=n1U~NP+K#ww)r62Wt$@jMI($i%R z_{0>u1BK=nAE;*^IpdZ|bySoGD=6Bn;fT)?Tc~^eAdi@|(L!_x@MPbN2+G{*gZCo; ze2a5qe;6?=&xNqGF-v*%b~9nWvo7X=)S$_oTYnJ zgnxG4GmL5%e9d;o_^zLWQQ4Xb= zpo=NOm6PtNtw&bSng&=NFlsLk%1GW^b%q=(q=*DABv6))Mj5po5Dcd2T|EU_4qR1f zE9&))$E<}WGB&b!T-cWIkD%AX3?_3s1H?+25y(Q>#tjP1%2-d(r5+RPYGAg`nY*W0 z`Idj{a>pmaNov+n1ka z6u~%v)%Xg|D$x^?yyQDMWA_0Ts;6d7k5>q<@pa!;`s=npR?@6%>Qn{vFqwE67Gns< zljq8G4C@c0ZoAwAWS*x2#?*#c)T-NVmlK1lwX$VK3w+#NSv-wmp04gQ$5q65%QiTM z7n)cWBkFDFU9PO38?}z_39Tpe_WGs@ueAtkoJKHL)bZ&(7kICWUXoUI0yJNCyFV&L zmD9SEvV0fpXyIPqacI81!VGvbl(U9i>bbQV%jCY>(B;lc;>J<8-e?)B$a_r=IIE|N zC=Iu+bB}iet8?D}bi@eoG}n>SEFR9i+wT`AeSS~mhNj*2?MF9#BpTnuV-r{=2)RLG zB*CJ02qdsQw`yNHZM)T+nwuQ>)g}TZ`AR2inSe&)E<)*|@$UB?uhMMD%jk;a*Wj2F zAL*XJ%fZOV%MHqz_iF-RIO2~eJjV2K4^}tOhdM=CQZl}8bLe2%Pm@|veRk~bCJoV`RrnPq1O7!$|N zRUgn}NFJY#d>VUBi}y{KRZHY2(Xgxp9f%mN#oxBfG-a=ahLq~m{nQ*>@`tWWv_Yr1 zro(D|IS#7FXTCAuF)9d|s&#pq5G+V}c)6O&c+EXCP33k!m<|M!y!ksS@hnvI=|q$=OkZYzOQTUE}7@5w~l~TR485#EXr#-WAhqozNd!L zS18OY-_W#mc*#&bk-ljp-w?Y~54+h=3N|{-uAKT1k{(ACP)et?my{}0R4|RDb@KJQ zzUj=&>?X&zPv}AukDVHy}I{J(LS8zIcv4_lok9ex}~e>(swFF z?3n$_8kfB$UCnrZ-!zT~F@w#V=Ns53W(*e9 zntyyzO{004@yj+vL^pyUiwM5*8^FX$q5K<{0-Y8)KeEIAB%GKTUZ`|GDcKcJC0ZBN zaN~J&t0;v)+;)WWYr5Q#%Z0>9KCZIfOuUzbLubV!XK09fB*u*Cu?S1PuTG`9!fM`) zl2HWXKOc*5DhMNiDQxQ%46Hknk*hrjpt46)Mnl&VJWRR$Va*_$W}U)B$K)_Dp1-meKxKo?ZW-Eo zTh7bzcX0g3m98Dj6k50~rL6=IlC#R$&1O{|4 zfP5CWNmGD|%HncqL?lZYV>$HF-Z5V+VM_Xns}(LL;YD2beh}Vz6=_d2^hl)9s<~Z! z^WJ3k0D+$&+VI8oWsgz=dS%Y?kPY$mUjpMPwNWSIN2pXSzrq*x@LUF_Cuxt{xC)Pr z<*-Nk-sbZeV$v(W{g=o1PS1;{{0Pqrd4hpn=Ihr;|8(I;Eki)O3RR0!78OWZ(|U%pz267GrX&OtajTNA?&ZhEK3R-WeUGLN8;lW5i#PYG0po8n^66|=X*j!_Js`S|f8gpwsEIAzbY-Lx))cpZ7K z>Z&Ofga3V|T*X@=1m@i;lHI;V?q`6yiimjxB(;R#u&T0A#SLtoIpuh={&U&Ua@FTJ zPbw8s@g@o#VHE zf#`YoY0=mJv>Wsz_S1jjd;h=e#uIVU@50xLOaDcJK%jE(!@hEDc;ai{KB)rwGGNn+D<~0ICc`%6;9?loKu9V>- zh_H+CL4%AA(NF?9vWSP;Omo&Om#H@p&koPUtNK16&et7#3;l)?V2*ltjujy*nu*-U z);-k&Fz(7#aROsc-G|iGe`x`rwkSQAr38EfaMzyxl3Isn(e78`7Zwp@v_|%}zyd~= zBQCiwpX_@>82tCssloqY@E#C0uD8W1oh_}8(^R)y^(*$s{d!;GE0 ztWc|SHzXSfA1zGaz>ld-Jt?=JtZ?@-?p@j+iwGI$(rS4w9ra3Z2dCiT4=sC;B4$mC zq;%{Q-{5?|{9ZDt>w_l%4veaI2}|fKfn@=d>d%b+_xo z1Ud572OyCuie-qTc?@&^#LRHc6{r5vs%Bt1x)7qgj+ol|JVE%1h)7W(b0>(P(Hu0Y zUp#ns{ZY*{QdTb6`_-W)lSuv!wyPNL$>ujXg`|z^5>q-DIR#e>jWIla91!) zHLon_EF?7R4WiMNtj|Zc{5#&{*TUQs3gnu+4MD0T_5Y=m zj91Gs>D_YsY*gNZMgA?K{5~q>XK&rzF{Bm*n(s4ju=vH~54o(Bur-8EFC1eo%el{4 zG|OWZ!TUj*Ct1oe#k%FEsT;`w8eIgQGOm}sRA_^wTsG5XwObMKZ#sAS<6FNsa@QZ~ zzz#f&D~{-axV#CcSFz~Gt^tHznVysCTF9NDXO&2i7>VrGMr?f}&0elQV+^w**Ql%ouC*WsUq{#E8e9B%}FzvV77 zo@}zuJYLb;dFgX`c?d%rx!+zE7H|KNE;YTP^lkNa6$2#qMSXz1;^c-B&)S9kq3NO_ zD*S)Z_LgCBblsXTPXt16w*aBB;K5xI8n@sM!QG{CNdh$P5Ind;aF^ij?(Xh%Bhv|a z-ZN*ubA8wRnfg`TRkeMuz2shNiL2UM%FX%hqZk9GRoity=uzo>&}FEc>Mr5Uke5NX z>&3wVN4r6T6BO4X!xh#H$8E>ss~6#IzpW_I1vZ~;lJc-?8VFRrxoRjaHG1ue)=5a7 z4h#fbk(fp)$fZ#CqH3hWG=l!fo%i$jg+F%BJ?3$F;2aa@kOUu=PV8?GNVeF!qfw2u zs=O67oSu%wGHB2bo!X42@s@S=v5D$!)0(cZ25lpVIDuAIj|Jx(+^qid!loMUL7SfpV{qAoh`6f<~6JB5)`(^oX`4|NUh5WE(kO zGm}6D`>2PLF5Rq8>J_Z>@b;UX<9$d}G)87i`!dk@(4)DChFmqP#77v;`KXiG)01Rr z$+qE_(sT;A5-arQUVWC38C(ic_!l`?|0-LP1=Elh!X<>`I_rWjzk&C_{`S7iVe7UjG4-u zv;Cr0QUh%kYK<=_H^96Guf3Q>L7N3Z-py`f6ea}pBqswV2#@l~P%*ni3CY>3pIXQ4 z(=bwB)R#0pPWxaGrNCf_K)fDbn7fCZqyDR3ek2#G;%gg`svBX*?7KQsV z=S=HFZp9LNjz(vRU)F;Jr4{V7dlWL@+y-|Mt~|EC^L+5 zCXO$P#~*GNQhT$=_ic^#@3PJ+MaP&wFaBWCR_ft%XlsaYhyY_)4A4>E@H>3gww9DU zW1fE{=C(pK(H2qzbLpHmGQ{XnX9f?hGOOlG{!p?h)C0RsY7hUL(zjvD+hkVCz6 zyuv0OYSy!@Sz%uo!8ipw&bjHxA*FvCrBQ#55kTmufq7wgM6%f8{fMwfCiA;MIG@~? zxNr!j#KM!uW(0LrKqU}auILT`Q&Q_-Z#b=lBO;v&#-b6u+nXGYbKtJg5>wLjP@r*+ z2PFNGhI~x^fpEYTkN5M>)a(hJ)exX`>|d|lkm;|1#hQ#$8oj4?yG+=45*>Q>Wv0C! z9mKx;3OPRDRq+pavbeUg!WcCnIy-uPQIUnmw{Rv&2hy3PX>2tSp9(BtK6g8iizL8FtDe~lQM5p;vK|v{` z#lV#>G(px}6nLpRWVo%))v`g+rutOv3dV@um+gRr)sHIX7*fD06ECTzhPvF~ALny_ z%eo}v_1O-nb7uH8Xwq#V}TCc16H4+csXH zNtiB7H~4!VR6ZiSPUVDGUW&}hG)i>WEb5Z;c7I!XuJO10Di}A9WpD|paCKFsExdrg zUnkk0s5$-&0{Qn_h5NHJD;d3^8$WU96~C2fx!{d@dT_M;S z%gKGgAh=Yk4i@)}$|Br!&%?!@f{=-OP>eP%rI%if zx5`GH#Hp?ufo4T2!&2F2yWR7X>yp2A$7GHGi}$V@(R&tBW$OsdYsE2tg&C7=*j3j|t9?D@|$nb20c!I-*>fV4)= z7i2FgvCfw~51~YfRx4`yaDT-OBVSNhNDgPU2pA))B!X5Xqv^+TQP4ddJ_KmaC zx!n>Ov@wGll|d?eQ*3rOE9;4@BKIT+4ckNv@y|JX6xGk2HarRw;ls)pku#vH+{uQk zoG!+t{B21i1Ct?C(r*$-!^o_W2ZPg#41qe9Zyf-DexDz99p5ACuYKF8Y3E!$zXnW9 zPvw;mfb-JReZf7_^c;7+WKYX)xQe4B_8t1{>?}cw(p&WZLGxqB)Lw(Nk5ph0m<8-G zhs`DcFo^SV+8uI+?$1Wq9W`aO@N<~@2$uUz!$p*B2c`y)h~w{BI2fYp3IQW0?$7z- zhFOrl2|#2OXgvR#&cbV?dnsgr{8!uHQhAia_|BGeKV9x|%k~2bMj==AW;B7+b!-I) zG=Cf7B!93NYv)HPBLNx8gvmXTw5%MEV15&G@CyYxM!S~)_+P&&zRb^Or?D@GfO~8i zj=Lv3dB-0#=WdAfsO)zvCNo)yy2~mt_Ji#EG}%vDZ5g&ts%>Olm4gq;tAV5t_k`dH8;z%Ryg=|;uuh; zjjYm3g>WCeF?|M%SwF__S|kl*0BNZX&;`_X)RZ^628jp3VE1897h(?v&#YCr8acUT zv>D(bG;fn_sG*)*R#}SQf=WuB6B*_~%pOOBAYG({6R(w<>ZA%&ht=FyTaQtg{A6M; z$8>I{mq;s8a+V{^&fs$@aIzccnq(*1RI5ina52EF)8~)xIruR{&SKB zhLKD5g+>+m`T1&9G*o7NDPQ%f0$+S7yLHpA@K!Q1+G28=d8Nu)rRII8Jt52U4jU&b z3^AtGw`UgBLrq|?&0>6ML%}2sQvV=4MAHuZTLqKLlxLoed>+>R zjbMD<{_U{a4|qse&@&)KV)E0>C{X-PAI4aSpXb zC6;Fx1Z}__@Hee>OzxMFg=>18ar-IVR_QS#Gw~Fz@{By%D4Lom)CN zH9Z@1p46FFKf^To^6a=p9{(dV>SXLg%w3_m=?KsrHFo6r@>|yR?n(-c<|e)lRrHGT=Ppo%C*dwaKwn&RYX+QYs3 z)~=+9Zj#_VEq;O5T$+&!v*8!9@gBsmj?NN+ea9+jVHA-ocTq}d9^P`?xq)@vP^qrx zsYLdSqFbpcEbRbkUH~k{-|s6Gw+HpdIvZ>*ueL$<7wZCW1hv&RQ8_i1Ea~pIyUtW&@^65 zWMdDLtP6+()S%CmRsx+6*74IT-KC)N9= zdB+AKCyRdHnn1l;Dx2Zw^i3ag&K}RbxpAsGYA#RQCKW?UpIRe?G-CD)tD>Tev9ze( zGpU~6*v%GpQ14F-4$akj&N&5qC}cUY;`3NOeJgC0lCCPJ15JIZY9)WVse%Y@n9xQp zAtls_$REuy(>lx(ifRY42@qYBclR2;(w3NI2f}zqw@1)ErdQJsvu>=Xg~j(AhE$Rc zS+)0kWGSl9)QjQZ0dUw``+#*m7Sh#AI#^t=v4D~ z1%b_O`*Gb{f+{+~mg3cmK>METkuNtG)i}i&FM~TZ7Um}9%BuHrCrhdVAp3I-i{=)E zR!$AsSA|nnhq)@+GgF0av?M>gT3_nnDZQwBfhdOgKCsvDqqnzDo=~261bDbxu+N?9 z*kI}0Yj`7;`>E*%r1}W9!=IC587GvKw5IK1|5^U7nnl_BY1+5w$@Sc)sr?*vWr>Uw z>I0H>dx$ITZ)!5sXJMP3Aw|g zUlYowTR0&(^#ABPQx~rIk&3AnW9i_B)>^qFwYA>7tS-WS>J;2e=zJjYNxgr0a24T^ zThPcX|K}_Ps!H{$zt3A`FL<0s%xkqgN|xRO518Bf$2%kMCuhdgbd{G~N_trK1V|Gm z?=El>1do>D9X?nX`+WpN-G~S#Uj)>CHk%(?vk~AYyq}ADe;$Z~bS>Dt`4w?&-bOJ1 z@^!yC{kBx*{O1Rqzja;bEp?%CDZ4i5fhQiDBVR{8Pe>|M5^nT-wpkMU5|7P@U6|Z6 zdy(&hZ$r%KDFVW`QwLr3mXEWz*eirVV~^Lto4L_Tx;Xn1S*1NpqhVx#-P%VRgS-J; z-{*jmRcSk!2$}M~15|5r$>RKZEUzT0M=Bqk8y(|R)T-jEK3AYtlV{c(i&M1Mw~0E3 z6Q72Y`|d}jX2`ZlZ0x+C=cza%^+kA4&1xa|zRW9(+ztYIY$o&TK5@^gobbHa?Yp}sF zxAAwRL9t6sCh4)PiDuxL1WJH;m2KSA)D`8kz!))Hq&GDdQe9B zn+nE(4J8qkZDDRB-QQ~zn^`wie_-R#y6!9H;1A};lT zi`~~xW3G|(&Yk|-^UVYM?1WMM*%wn&%$p`d8)-wg55>phsY@rLSz%S|>ZHw;5~R`C zc)0xhJhkcXLI+Y_{~%e$(A#p;czunj6CHgOY~FT2(2fsaQ8B!?J@JSZd5e_FvaLr- zy=GzWEzz$?z!2pl5l-b-hwSL|L=!E4fUfD$*EiNFa|)|EHxu`3sK09#Fe;gQ8S(k| zH$1#&y7;6Z68d3po34mkK8vj6p<_CYWYW#QZ_k0#(^lwq0_%Yu15uqNsaVTrK5JO~I8+V#``x z$4GrU0S;C3!$j)G-jG`)RX&`O{yzG)P{u#=^ZwlhjQpa8wTr?NF~zVcZ*opbW&v_y z8|)|V=(uac@OO{tcOd^vJ&xKz(7fK=+CGf!pb2WSiRF2`r{VcjYjcle6VN3Hb+&(R z#ue57rOU+&dfLYMSnCBTp7P+kcE{7OQE7jOQFz3 zpF%oNp1AY&+@wF=^x>{In)T~+iMw8zG*$HNOR*kW+A6IMo0wm(v*#9%>7|(?*xs3S zjzKNYj}U5uPYV`4dd|dfNmUmd+BlhozNMIoCbLIFiQh<>=5U`lYmSc52iSeC)U;kQ zQdIk4>SKZOr^_QIO`)(bEhB^8N?DqUp^}UGY}%Av>WtTCSB?$`R50-$*q-LXV0MpC zsGuJe?{QnCJD-gxfdn4c>RC!C*Uvq6I3A9dx{sRnj+X`k%Xqu6Fhoiq9OZ}SmNOQb zoYjw<7qJX!m>7|4^sdU1XEK{N)FpG@T@-^n+JXkL<{pSHwp3Y5nbd@U*o}4;(6rQX zPOoW_iU>JP=ph@RfD9ADe|u$dy=wlv)?Z#$Rw*j|$BD+5)gbu|2AIoB8PL$OZcI9P zrah7jfC;9|;#7mrD|p&$)s94E&jI%6b#5V!m$jW$>YJ6yL~Zuh*`5t2^17BR62G5Q@L?cl-;i1nu}E7qg^u=Bo^ zJw)@zm?L9pDz%QHRu7G^VM+6nw2^#hWL_Pg7z5g6tzy{|1LO1X?U)0uCRn~pM)^P- zs;M*2OLz}N78!i?U^G3&&?toYes%N}-{+^|;a_&3!nuiHMkX(uMxj!-NCc;*IkqcA z+OG}7Q=~{2%_K#B=*H^R&U?;4WUkvOqjtJBa#!eMaC$ zuwWHET|cP7#D8!98w2w{7u<&I_}5Pa?#LRibV7%D-(Bs4w+JX$y)IBIRsl^@sV~kF zgLh@H@oU5{oPX)Q9Hfk|Nl0_9{k8GeUEGSq0(?#;+j<6CBPq|ju4QutU0V8P$HLR6 zQGkQ1oxfmk9w{h%XT!q9#eKz+lvrtmH1!bBz$}sW_^_}k#_n10Z~JGoU@T%WgUNY6 zdkZFk#c)h@<<(YZ-wo%q0N%io*X-ZE*#=x}x*`+>5RET%1aB-gw`VoI{y354eWKFq zpxfk}MrJZzZ&OYh-D`H>v(*AcW(|%VHSLl`scEVUTrqU8I_Om=||D^z!GO$<3%R>80cj0^e$-Do7Nh}R&+_zb^=N+Rua7pio_U zucZOW*k3FQ6>uQ#|By~k8Ik3~9{RH+0xIGio~LDVp}xFSf&OO8PBTr3%4%UQPQ>tR zo~G9`@3{~0sCL1oCpAqcaIMv}W}&e^=cmx9km~C{wf`uEVDi?!yhPyih?})_Aly%= z-H1i3!E=QBY0%j0i{)O)4+nf37qRr2VCOH2W=2S`80-6=f#KPTHSRV?NkF#n z8-HYsg*_OIRy81Ra?g4!6jd>~dqH-ye%uNJxWU=cu9EG77@$G7`A@Iu*B;Yog^k9n zc?Fk>UjL;2343L$n<|U?fX-Q!Y%Zh*n^zcq6<+PhMjSLoTu#e0ak`pTwRQOIrF&D> zl9Au>HDlM_cl?^$dTo1xIg^J?xvp0ngKzddKej@Gro`B;Ci|}Ml;Z$fxT0BkWRNbV zNkiL8IVi-by1K3lED9MpT*R48xGp`jmRi*qIwvMT~EeL?^z& z;M`mcG6t=Ze^R5{B+G>kwk$0y`Qz$ugkDv=5ah1XE@f~tfn=}>zSO} zf-u>A_W2qwBPm~5@2J_Q9L#{GSxBw=-sgUzV}dn-%&x?30U8ViE#-{<{`~xWz1w`zTgS-%K_ELqaysp z;b~&H1*v3@rUZTw_AZI$oU=Dod<*N48$xb-!y3}E-jx~zjbdlpN~00BZ}9S(@G`=t z=v6OK%7nk>{A~csQ)^7Y#DvmTySOmA$PQw28pgJ&q}Uc7@d`Xyc^3X+ z%c360>dGxuun;bv(NMd9>|*vz>O)%z@pku+9P($F0*`)R##6zF!r0XG;2==aZo7(| zdtMQVe4Fw0`gygt_m6b)MdrQy4VPgHMat6N`N#e;DR`YM7t=2C(Nt+pn(FRpV!1^r zyI`umK(7kLn|ktw>OupZ)XjEuvtSlyLuCSqw+C0?ghMniS(bRei6Ec_uy2>}Q?&qJ*{U$z>9J_OCIcO$?chKa5^F($3QY)mfzs`D+T|oMi5QWbG3xO zj#fuV;qhCR1lbtT`5Q2q_x$$aZ3ElBrK!KkhpxDtQ&@yl@)i+fcH!q!B8 z4opYkgPK#HVbCxxmBimT|3J^{c(Zo$EgK7`zAC^B(}yfhoH2cY6fN@AkOX=|T zVJ7frouV}#7G*Q@@ktrHtSE4Ug~L^1K9}(Pp*a)aafi}PVP)6FOjxty_m-CbCqonL zs86oX>am>1)KPS#Fc@x0O75z7Fg!)T&xb@fr%pr z+ab|T*h>#JdnXV2x%m#;5cMDh&=JFxCiaru&9+i}!U^}|xU;zw(8DvX>TqB>ZLjhj z5cd64%9vTt^#sivPqAfNa;H3J$19%WS{Pxi3Rwr#9%B-BU01q3U?DGg}7DtJ?xI#~~TgDW9+IgGe$t!*|5WyK6^KED# z5O}v)GzhJ$9og5Nsdo-4FM@rRwxuULny&TWTgMbo=F|;3>`{0rt*FI2gWMW%+|Fl7 z3!R;lUqao|D|>7-k^+N!KE)&^u3xuaj>qa)ZToUvmUF{64Y+Bx_%wQluoRM+2hC^8 z-$ApkYicirDUjqmj0|iut><%yQR32BtQe=bg` z(qDMiB%`bhv1kC4(puYwq1uvR(zM@ym&%?ip{ceGq^%>AB7i`;eI z;_xJYAm4&f4=CCmgbZ6~W9=oT%jdS!WZt1v+n@6F&82;617yv1kIB4| zQuIB0qJ1zBrKzyw49n2T(H#fcwGmue&~60=+qJ`CV(Z>yq>dX~J35a+QDgkP>xyg> z1eSjb&c{MajFMmUZnHhX$~&=gkfNX$;%=M}2RaQ;I*kay-^`-Mi~L45mLlkpoU!!+ z-+6-wmJ>W2mWa3roGzsr0ywU=sn8GXnbBWC(N?hJC15@~4e!LzRi1j_T=tl41rHt0 zsc0CW(`1rJ21Q|EahWuSt4ViolJKgLurS!|^o|jguUN>YSfjdTF~AKVhikHFzRjeg zq%t;zc7DZFjTFglS)1VYqt0hY0$c?r?TdwWpU*!Y>G4MApNTs=Y>+Dg6SxoOKQP;U zIo~3FWC{m2>f@pq^qA*rnNi6etoEQ|Aa-Dm5z#MBYmoI+UK!s-#}#UPbJ@CAOlI^3aw>cx~Z?1|7-H2xfq1k$0RgG3Ci64~&L6r9}1- zC>HD3>?F5E%XpvY$3$br8oqni7&nr!`SJ@^Lp2`fiEMi&Ng9c>C-3>2^{w-jiJ4b{ zSHL+r-m^{C3GM2NS}WBJWt0?LJID}C^-+whaC5FK^8|R|E4jh?^Mpil!9&RH!dhKs zGS6W$@wsrkEVCB#<#ELE0u4W^D@q+IS`sE{$$RX>xiZd0a#zUv$B621?IHf9jPG31 z9pD4k9?(ELLsv;kTg1_wuN4BFBMEcxf*bysGdtROC{>`1?M6u8>t;5G`PBBHmx%x5 z$VU5Ix~diKZ<8%2xz?UXfOI{)<74s~^n1>oV6ni%!Y8#yhqhP!ON3L&00z7HZwR5% z^EPcN+j^c3f@rszJ29#L9<3WE>+_(ZL4dv}pTKeonYnHq!8hdo1?0$NDN} zELzuZ`Giz;)6SemPRlysM;0}-W46Dl&$@6>EV3~%5OEfja%l_Y>}SV28Y-7gcog(@ zJI#L~za)6ZZrG&AQgstO^em_I zrA3(M!#E`xa9sdq9>ZWsf1Vb{N*k zfs5Uub^Akw$cu&})pT>dsXU#OYh?-J&$aQRZbU`;*tV4yAM}ly6c3DhuvjhI8oS$K z_4OA%lDz&=Fm^Sc8XAAz46U0pant%fu@rDub-3V}%jHKwuYEOvEWZ>+1QG%8rUnp{ z=5^Fz#maW{JnQz8QtC|XVvH7ooe8$Nay9N;OHKr5^(8c*?ug?t8uQ>w?a`8LJv!kf zTLD#eHrkE3s-v1YntQ>GhJ9=c;iVauo9&O&W^zqs2i~}%2`pD>h9WTBs^q8uQNg=f^Yr)_SObDHKLW%6{4Vo@9`lCIvB4zvD!5C$&0BN96h%B`EUK%65$M4KF zo>g~+5;lz+$2Mtvs8MtJXvI{gk@V0G5`hP-5d|rY{ftZ@6@F)jb2@m47ekOJbMQ%i zI_AMT5XLqXzV26!P0+QvbGuK~@Z4-3RxAujq%D?m$s-aDk(yBhX`5x9x+(HF`Bp>| zStvR1!F1@RZ}XAnTTt}WK>3+AwJjlJr#~ZX1JiRh=Sar2v|Z|GK+{v<59RAwqDgh0 z+lcI^6hvt;jca};xN_IqGDR8d9v>;}D8H5*hM_e1<8e!6Yb!u*v%X-|iEn0hp<-dI zV`3f+acb2)RMpq<bo3 zZMd$LHo5;SR4Hm5T|^vD@>!Y}vCw2Z*8=00Lff?`H)TMb`Kq84{mXYYXy@-SFqYMn z2495idE82uR-gN%xy^oI&_`%Yu&MgM0ry$ABgpnPwyhi&Fs4mw<$UUF1P*~uiR>U_ zeZ1(4;*8_J&fO+asQt#r>K&ypH`v$M+}VS*j+@7p(qFh8IE{^G--n)1D<$cjrc@gc z@(hl{mjgw67q4eIWO(@<*fC9m>G>akQo?Om2W)wyOm%*6;Gq&cdD`upqnyXU+OR!1!HD(5|N@<2Bkx>+p z4~==x>y4kwZA=)!mbsU8(4{Pyl#G|NXo4@ew3luI1xe9a6OS%s&00`66^xu6fQB=5 z3WS_t#RGr+!}vR=^oPTlS=L;~yB~(j!p)w%phIkh6u$536VgD2Z6tPC-)WEtOm>oJ zRfV|^DjQI+sBGYAHj;Y)8l<01@pfLyqPgy$zjq=&TeDU;3L;z1R%~o6J_>Rc_{|Cf zI|}I%vwVa0!wIXWXvTP9lH4JTnCQ@68z;VIN&t(ix;Cp99PD62NzSx+MaBl@m%O(0 z003bt;?h^OdYQjz$Y6dv%BwG5z9iqRC$cdlH`^Umeu~UAun|}?SD40*HzVfXTqCywM;4Mzl-NbGEq7jq>xQ}4r)SMXhx*?Fx^B?=2#mcHR&9LeWD zGPUl3h6|X6v;+%J$0o_$A1}+*`7Iw)5v@+Sc-U;Mj#H|7P!GT1jd8NwO&()nFk>7j zC1Q4tNqWxBg$9!s#;@K8+U0yf3rxYFG6%Qet z;7qZ%;_aUc-kRK&EA$r$cXqP9I5Ft=o^?17x0d(YY0j#JOZeKQkqgca(t|wS-G6pg zv5TJmcGKJUK%fr`stsgLrs=&q9chtGv${&*Is71}*X?W_K2}56k0g~40Ttuo;i55w zh5JK;X<5>!hVuhk&N0rXokdicY<4>bE&nuYEB>UZ3U87SzyJ!AZ3uan%J^ zJZCOxK7z3*q&yd;8B%S`;erR-6J;q)d>+6_0%&>IT_G?t_CCqzX6R{k)^ynr9eB~E&+{4aI7YJhy zfMw8&bEvl7c`hf7PgW+dacD-;ENGaeDfN)f-~AY?NEwvM%sy~Cr_v;Vc<~;s0%X{; zJolT!4(=4@&0W9|_6ixB&sEF?7o}m&T=L!N`nKDUoQ0tR{iPoJSYOD!vNKzrECThV z5S;Nl_n{XGr#cZbhcHRY3A)fehM4aN2aZ035udleU;c;StcDv+N*l)b9PUj7gQrs; zR1bglKueoUqK*fhNp=*O=wPfmMr>T1B!vpoM`nCvSOOfNBP@3jF~V?AGM_&zLyJpi z2}7Nlr-;*4uAKKVJ*eVp)w;4ed6;P$+(>?WzN4&ZF&5XPe72xkx;TBV(;w>rSu;ts z$)%ukkLF%L@~>ZdX(RMxU--$%z`y`>TxtCW1Oi#?!*aDyQBa^qY80p5?k%U_WJ1w% z&8)bSbW3hyd(_->DzjBV4DZ&LwV+xj+O|@E?HsNArA+bYWhBZ4?oibI#ZCbG zE@|VRCVZb}nxhE3C@LN$s&otQEoGELjf-k_f#%Ze;=G|#hD7@E1%hiKSj!#|Ve98& z6v|x!_xARA9GAt@s>;UFVsm@9*lB=8I@mdW22nAiMv27CA7Uo1dw&IjnFrc^T-fMs7oVWL&$Rgkxp z*Hu*LJm0pp3+s;TzeXvz6`hHInGbZ+mK6GwVfWWOhtb$pwjUVv4cE$%^(CzjEMX8#5e`r&oMhF#Z>Z3BeB>{L;k5VAtZ(Qm zR=3!uSnYc0u=pS~pa0hLGt?`L*hSWTx83aiFK8ZSrOSo=`TK<#|NJA5httNfzIr;C zS=4vJ0O+DL0ZXwCbBRkoxLGyu?{OWE34u)DdG~K0r!`&ZfrwIePC~ckjIdeCB+y)D z_w%DmE_OaDXH#ddpwk} z{sla%G9^l~I0^o>n&mel;YOJv1cY}C*QMrA7l-A9^0oDQBu>r zwA2%(C~Qf%S0iT)7728sK_~GSn8hM&Y!mVO`HpZfGal-5?cY`n9}@O><77OU1QPvT z$@}gWhE=%%-PAWjx@+PaC2w$VKEcJt+G9k2)DG;~2RW?S+{nrTfjRyDKKT`?32#~1 zlZRnC!6a6?p!EGJsN=&YXNh2d-cYii#OmvM z1?S!$;2=a?j6hKeiq3bg$~x&m*TD&_+oLn9T8Awa!AbK-3hX@w+XJ#EPZwN1K*Cxa}FPDAr%L*GB@=YBi_j+-=NAl6$5wH|+ z1AL>!g(#we!1VAbyKZK4YX;Oz2_JKYy&m!dy6aC0SYjjV8Ad-?PG;dyKRljSW`MrFAvut2-77 zRKX?WHF3k&uGeq+JslRcN584YL1I~YQZxn~{!XKi_ zOiJ}1idIN!3T6hif!Uo`OC&JPncew zhvcn02I%2u5XpMe;{vu3wyEXp$aR+WvFo^)fvFCu*Sxwe&5dUYR$eM1USjKH++Axag+os3}*eDeVRBwn{dF1%AA>*W-Ew(I}k`V%*QFx zds1&KdqAsqQ-B5R5a;n8=io?XQao+{*v99X48S3XHxFiVShc1f#mVgbXgHPxeu0@w zWQ~Ll?PTzz{rR)D@*t{!Ua%qSr}5C2cZHPI)1lKkDhXLf{7c$z(UImJ4xQ64$I_%; z3EjbB?u3#30h&0=9BeU8sj@LI$pS+~w&}E!`@;+i!HwCW-D6=m^+1N#=#dgaKwKv? zc|VGQOzz0p(Fi1^Uec1ML7f*c7FKpfvV;y%JZ zRB>+{`^ZS{p=Bf~*uAheb`kxc$X9rEz%+F$(0EZ+U3#e99G|4rJszH~WqyhFP6_6b zH$={_Mm_rOrID&pO5dn0HzDSYKTRoK?{5ocoXx9*M0C8N_=8983SU;1@}DJ?Lkj+A zSXzxS?r-B!@RUs6FtDR~yPReTO^?Ik&Ls39dMVk}j|i2lw=EEuA89cFqTUG`PJD9b ztLbC!h>D+gEWSwNiTAP~!hnN=fBkgEP2-23e4@G(((4Jy_i_(2v{~NVIpkCVURJ5k zVq=~UynxxMfeOcE&0z?%!Dz`bP}zpb2GnL&oQWV(CA%zQLq!tn-9kz7 z%%c=5H#8(z=JoCwLEuL%SIcWN*$s^ET=)Ml`KRXxB6@VKj<;A+`|h7WP2`a5GYXE* zol%llg)8<)T3E-VB-RMH`H#rt{NG&!-gGUB1+$imZ{Q@d9d^ajzt@pxMq_`&8=0yh z4a6Mo*)1c}_utI{zD_#LGxs)@RoN236c1Pyba#u8-b>^Ay6jNNW#CPNnCuB4l}X%L z^12kkJBkb!D0$dy-SyObU?AGvrx}^hq`6nACWC`R{!WI7h^SL$A;qYoE1z<|JHE`@ zzX)G13D;tkw_p5_2XpcJ3a6`k(|&Y76+Uvh>PsHb&<_LvqGcD=)YUy$Y9t}8MRf)Z zcOf=%PX{)-fXPFM-lB5FAwQCJ853o={hl!_WP}exRb?gmsPA)xg~i3<;_;c8?-3C~ zK=UfMtwL{*N=WtgI{j}NjDfLEAYkJQlDGC+>J4d6yvjv;4P@y&!9b&;6hm&`zlXg8 z!TU4$ww&k<0Wu*-Nn9h7wG8EXbv8hC-GQ3{?dpx8Nm%fTAJ=c->;JOQaG$6DH&prm z49e0Ep83aSOVcXi2?_|~BGU!BP&H)sr2IPL9jo*IqOjm*QkpwaHJorZW#AF0yO)d= zy=@ogzM^>2{);<0`Xs51$ugBnW3@Y}jil9{uts=)i1%;lpx5I8!{z@a zR7GC_UZoGq{R^D_OoDd=2{^dF9EMf^=Zb1{`@xSZ`5D)OC8t*_7xV-dX8~!NJp5{s zTK9oA0{3J!zT{D~25Da0t|5(RIDaKKAI+(NebhH1_VyQ=f0m#P z4D#&ISI&G(Bse^_5bhU*no>OO(NUCiC(=uZw259? z5~ssWj%0fnGm`Dyl<*;veEGTscOS=_ zi=Ktk>)j=Npts{>U{9KVBuDmeUPLH^-_CL}_n~d$N z=Wsrnb_g(c)<0mdQJ4tT)T2GuAM)*EMLL7@+hFO}i`5+23pPjot5*HBa~Ixm(n+NB zRz0!}Z$ne}$uh-f(ag;7GVoqVT$(iNlr^u;wls2naE2-exCb|-ym|)b<5@n;w8s_n z51bGGj_`p`B&`;{cCb$NRzSn`QDzayG2*sjQ;N-d=|n$*%@TsYYi2ce6V^>CnH8(c zwjM7k$$J*- z&);P1yBrFl{Mk;;pe?w2RrmxXgPD!lIXIReeV%SAzibKxYga1<{FBDjhC3)rrA?7| zY;P^_N{8ZQyfzO%^R@ooez0prR$N?sXA*M%hW8}-YAj&fO>IcDx!UP^kmlF$BW1QX z-EY;xh;D7c*QD{3E&3okqMbz8KQpp02-@!gj)=9)_6m$>{ET@r-0llG^)X-$G(NxD z^nUztSbP7@@dYYa+`({gZ8Blcw*(XRF!X6hj+k)5qt3nkElYlV^=FU6c{&)Z2njq~ zG7!awU}BQ}d4%xyQLFMIHrLFJPSNm=`aUNkqSy`WLwK|&OeRFglLKn0x$^mJpJ+Mw z5&!^j*iHoyuYUc4WmNx9(Oa0Dw!F&!2WI5C!hYBu3Ynxaie6T89S_EtX;mk+HdM_` zPHD6^iW&D&hWQ({;yw|O9V}Qm?)we85jRVa4qolw^5%T|Q$euXe<7g<^82MNW2G&q zjtsDW!B5|slH1z8PZ)fz9lXy~q5c*f`M*6}e}}n?3?DtaV2;poMZ_)ZeOUmcC)o*t zeUHAX{wJ8Y6|g8m+oAVd?2=^HT!R0lbRF2^!c$565 z*rXk%U%HDb#_^>6HzE+c^#2JKT`Bonjn9XCrepQb{0rZ=sB|cxgY<&ZdBj9P(B`Q7lIegVJ>pv* z!ecEPHX8rmH-54{C**zWI&n@a!Y}v(Mo0f#J|vf$#G!wGyuW#3VSoSpe}|RU`+ahQ zUS2MBde3~CqOt3cS}x{ma8a+Hk2H5JM)vM$t*ZW2*Ys*iRP0UZ6T62L0sjYGg*c7x3t+;c(&tW3$7HsKxp6}xEY#r6|_$Aaf zeKnyu47+ert;*zB3O`cB9hFfSv|DL$*n#8asTsyqMjd5(o`w4CM->z zgnvg%x4!8=Y8`P9Qk6bHmSUno0Z!E7a^%VE)*V6G^=(gFTZedm&&8)jsgKkY#@LpQ zbNxq|{qGsSFp&+wGZ5L^;5g;`=rtuR;yBKU%!e8luYR}4ib@%=J_j)|zE!yzDB9`_ z*VRUo*0MU2LUS*&@5!rpe>)p2IECW2-G9ukfhjWw_X=VrT8bz*ScRQ+`nuBrV=D8h zwL;;fzBh`^f0ovJ6lA!oasl^vrO&v18Mkq^1{4g2Lw=8r5|^u0sMl<@ zwRUH_8vQL9Uf+LC@D5WDA`>gc9ZfX!nPa+5hM$Kua)ub^1Wui1E|0;PvQRd-J^H)q z=?2QJduxN=rP|P4r9V%%fsaqd;vj*P#`NC>& z1MBd;&wV;Et@Plb&m580s56!EUv3U2eINeydElR}3pKM3e1?|n%<4-Wwd23Ze(x+1B7oVV7$b~5tVD?@ItX2;v zpX&Dz^8l~*& zib|L_YXj-SwwLFh5+NROkGVXrMdl&SAYDq|?G-7zNh7%*4pw7atcdx zF_097+Ss2~sRVVLy16)^J6ddmr@i+AgGo=3wYttIsb9=`-|3yO#AaEo)eFhB8n32& zr9X`1emUHh^VJioUT^Fmci7h35-b&R>g9Q8NE9UGE4hEi;g%gI_%xLfuQ#=#qCEu`PD@AYjPy`tj*TFH%mI-85mI8xA}@n{5sfHuucY^W>61D zT>c5ekldnpt<1nSHpn9Z$M+?%t1bF~pZpCZ{8>>xCNwkIZKEDPfq|ZWlX)T<=={9H zda9S&^^F)G9h>8-MO`?hP)CvO;zecm&CS!!@^gRiJ6xna)|m2N6>Q>_ct81~JngUN+Lcmt0J|54-4O=LG~ z)Q5ksqurIqN+%m-!C`*`L_VKQFAs;^WTT0bKD*ZoShor<$Frtw4{(%b~hN>B z-@!@3WAyG~?f1Afm$aMgFv`61RdI$wYnT!rAOVMLUvUuhF1MT!sO`mjOa2aOu!Xop`EWsT#f-(L8)FOkMLL zAJBZ58=l6t_BFeS4JJs4mDYS%d#7MKH}a1c;|Ek2ad$@qquk5o^}%QEhk(60^QX>| z4^{dum;62x6>yow@_22=FN6iyD~on|er~fNpe#GFADON4@y(9g%>a*%?eOuj?mE$r zo8azF3Dnk!6vox(v%RCCH^AzvP3@eSFa|S-6SrkBM9=JSG&#er`{p z3QXuV*5~DYh!TBNm9iCUf6l^VIIA_Z?x-8}m=sc5-5p#FlWthfT)fs-zp_4dkaiL1 zba-5p&36$u_$ZKRSco?LPA^v@b~L6TBE9+P zhEuIeT;t>;d)KCLXL9Js)1Ejin3a(7%e1TRBt1sU6Zy$}0HB-4U=8jj{9Ap=l zmaAY$pnKI&Bu381O^s;PekGJ2;f@JhSxP2n%eB^vsW5yQ#)Gvd(d#iS0d6E;*1+cq zXr{hwUH5y+Sl4Ynz5_ec;~F6HC9YLARZl8+hf}_atbz!!;mvmc$qEh z)k?IhO*B$Fn{2Nu2u0z*x&SS0_4w%m$c6S+)nhCjcXxpA^JqG5u26!mWe0+oSnG*f zLZTY6vfHyxoaY?9uWl6XF;-eLt7vM+9g{?1dDULK;UHXXpJ#txEZOX0465_AkB0W* zns$Un65c`IW1o=VVkudJh*{-7ZaAO~v;eWPTsEV+z~pT&Gg`)8O-aV_Iccx>G{W#7MK(yj?PmA}|jgY|WRPJyP0r}+1757#iIE?pgl zYAU5HLJ#tXKf?Zt1-Sp)U2yBpHwq1uZfAqa#)e|Mlt5(o0FtTp+2x?!)pw`64a7AM zfrk+-&#;uojjh8-j?)b^V>jn?7I{7I$)$4z*R40R^OwM-)~e5MH)qF-cV1I1O$RHX zMP|5*uZUhuZAR1_Dd*Zr_yy_GvLZ8}6Le|HMA&PLouxSF-&m3ql9b;mi3m?Lsh|q` z3t?!~CS&Yjhd2~X8Tc9mFh|z;E_)9aZ@ zj_vC3{h9>ntXQkBEn?-Ch#gcu-Sh;*RJ9kIOC`&TLo!T*kM>)V0%hzD8PXuYqhHWB zEfeQMkZ1P0`3rnqo|~PWS)M7QENT7L%Ht9V`a~(jG(VKOjvbd4B9L7tGY`ia=r0x? zw|t67B?3|(HLiwKSvtNbgaZ4MOcU|YdN!q+>=;nsKOX5wxg$%T7$%rp zmTio`;{bm|A!qsYosk$|$~vAj?~_pN{quRt3GVV-xF~eo$NEBPBTjCj=vQ2DtC7T= zS?6H_O!(Q!!Tr}y2DTjgN6NuOry>299mD|=wO(MuY})r(cj zZ$=(d5pKBV4@bZebe9IbK_N==I+i}$43Jq2+;SbwS~h6y zV?+OY)pxBH)~Up36HAwE(RuqXW>pLoM2*SayqhQ5XCz&ud)hZ4l%f2> zFP`|=7HT?+P(OaHdDZGon0ku{ zpN_7(tVg>z1dMAxnePNwSL;G*p4cSB}H8(E06xSJT4|4KkPY8uAB2mE# zX`Fb-Zam|ZsmKmK1pUlYZb*$n<>5%G1d8Bs!?g+MmCZ3Nvh)pmAPLrEj)4pV0!p#B zyFbrJQPL1Hp0Es(0vevRSb9R2$VP=MN=bpx+|DUcX~ol^hr=Py=1tkDjxn*bFAJ9f zU0;@Ad2o%7CPgWDZ78VwQ<(aqZUG09K zQxg~N_570TGVxoO%H+-~7Okm|k&SX8fzPqS&m2+*`{P8HoXK?>*P{Fl$dzJee6^fN z3oK4a@d*!YCb3LO9@D}D^Be2@j0?Lus1ECw+BpF-#p1eaq^PLq=*%)2pWELvNc2o% z?&)|nSg%1!}$D%bvSW;Zy>s;Ox z);2B+ib>)dxYyfWN@=ylFr!}n3VQrz%_GgX?4luD1Cm4t$A>M6{9J7osFT5jAtgma z^rZ;xorFe>cG?UL5`^{MKrjjtoPtylr`4JyRe?Qc=Co6~B(#zuc}pHcn2D%lkYW>A zntL1$7ES`F_Y95B8IcW=O4U4a=#Me)CmF~6&)7H=d`X@W+vMNShQ1?t2=XTQJCx3uryf!R3sXkjlReXj<_)-cuhhzMnDZt)mszI;h_{xgI+_T+Fl+1P}cbp@ZK! zyrey)b^)pjI9N(VwZ}J&WUxf_st1*36||O7*d_yeFwyNAdU;K{Mg=k7BEZtx3DYJp zaF|$E+gj8nUjOD@&?#G~nmW6nIOxD@&Y`Nz`G|2*^9cSVq7k1F(T^j>;bGNmStuae zVex2suySlX`9jD^|H8U$bYY=My&`R1SE*Pv6`$}_^(DYeDBD5f@5tAPo?TO~xsU(d zpdyLg)Y9WV;IS7}lV4FGYd2Cc=LAEvC<%@1Sz9G**O2|4jo@ZvoGM+URs9IDz=eIJ z7zjOijKG{5XeB7n?b;&CDloCPo>u*Pn?pj0e8z}+z70v5J_egoMH-9>`|J(GSd4eD z_)^J@VbD|x#LOQ*s)a$2MebZuuzgNQQfCtF+q%{Z8^dssGx)s3Dm8@7j_^5wiW(!K zJYZ?TDvCB_9-n#Tqb2XB8sn%xwH4MHY652@B~Z8lTShp6qN4FhV()Ryrwg_W}2{m0D*`&fFcVzC6({l@Qre;ah8&{m<_N`Sm zNQka?5MFBEeI$&j3p9H?igGbac^#W=S=@rF9C_aLpO=H}jqeSil+Y7=Y4ZS@w>@uu zZDMw%!GLm4HNfw%bhy2P0-g_f_Ig9i{HEPnYxaH_^v1V#S|EYUI?VLSg{;B7>-)o) zo)35{2DCGax+b9DvtYmTV{>t7e*LLe0O<6+JcwVKKSmBY%HfsgArW-E@ALB0jx%*X zn*;Yl;jw+~leGEl6dY`q(yxl>`v^Y4HTZ%q^H z*{}73pwH8INHPzNb7xh46-%En;wuc$t?iKc9lY3KyO_-(yas=A?N~cHvEu&QT^YW0 za5n7$!02c|Y_e~j0|z%{$%4+MG9w2!irEePMqF(C=C|5`{x-aLA*0U)IS>L);(Al= z19R$T6?8KtN@ImZ0D!_jW7#v%n=gpvz6>$JgDYkoun9uQ7CuK5$BQ!Zbqm8DQ3~ag zq$@bs2uQ&jHwEXbo|Nj15%NQV0x;iscBH@18zs&a8%(cEkx95u6%kMHW@Pv%%1AUg zFU}x&U`H0b7e)r0C-Fy**1OZ063nH)e|@tL`{}ITCneJWheQ0#1_jbk_fAET_Y6e; zW^jOSm$OZvn8ZZvKIJdewwfMUfHQyui=*oKXGV#VyiBa^@q~BJ`Zr;vjOF)cb;j@y zp-`NrqP>&`Wnz>=nlQO9W8yEhmG9{1hs^I_{E)Ws@AT2=8`z;GsfrRH)IhKR%}%y- zoZ^(|NBc?B-z@aCD<0&fst~Uq-JrMA+$IOXOA7lZUDSv^+H-Y3FBji(MJIE(SL>}) z`S~2+&uLy_SEo=;lS~V)UT3XnVh@k7`&D$x-s|xP0@O5-yNAiwakkh&jwL5qdT4;E zl1UuGOd7r4Kn=iZRYrE8h(aoX4GH1f-RyiNgUwaWD%dVKeF_)7>b}3fcdxd{D_9pCiM+QOrq6U;Jb}=73Nve$`2>e^J@89^ z@WFhjlx@O2QozxMycSjs8wVry={X_9{~{81&@0CD1KXZ{AUfxQnDX2tKPTrT!^L7N z6cRWd(XB1dwR`(Q7ODQQaM4DC7avAvuzS)xHs;LANu0e=b~NkpacDS2s;Gux<5zL- zK*2lTU00)YO&yK%#3t7RRcI!IfL`CPM=8a6qb~WPmG6a@#_(EG{GOl(^DlU_o@Vol z$hcPW)N8T$Pr!*@%UQF3wA6k`cDm(_(aV!ksOYMqI6Wa5DedMZ2*V7H41pb3*H$Q2 zRci>6;agV0m*^3vXa_qjKgE5k7;7lQZN8!?Dq{EU2dmXH5NhVZti$OIMl@GgS{$Zn z<{+BVxQ=2b7ZZJY&kKFG=7kE4Q_I?rQ58w|j2jaZY_75Wm&L{u!q~cA8p8`oLydKN z=QHt7WXyIGhk7{~X+OURJr$^p3M<>tCNKdz!WSp8y56esaDdh<%kNJ2XOG#GqAEi> z-PVRvFJbS^#Y@^I4Dj)(UdQ{L6IaRWepTKqUN23Ji8)jN*~P=nLqK5iEKBE~>zJLW zeP_KT3%~5u$`#+cJ=&RNlvBz*@3V=S61pbgTJEl?OL?+*qnf~%Ro{4%zU_-B)WTKw zX`Y{jec6pu;I1*Hq{#+sc(|`)V)TeeSxcsM%0B?xO*}VjOW+Y<)<EG+JDGq0Dx zBz1;P8`VSv2(t|91#xK~<$iey8%&W9Wf<_^Gd|6C*@&_W2%ussE`AVlej|aCB#UXY zc1hmdl{h7DX^~2l|C-Ncl@LSVBd2p0#rd>qSku_iL3Q?>Uafrg(KD2#ZYNqUT3d>$ zxYcq*>0ly=btBB`UYz~Rwp?16%k%?6qH>dRBBhJCkz6FE6tsqPGP#Dbu_XugBLU+` zxwS!X5i|1$-dp(PrSz3Lq^+}Za%xG%=(Vz+lZ}drNpj0mNJZXA?Flyw@t>B}*BfUf zqWYBN)Oo&qG?(8gscH+;BPOH!QDF^B`CR8S7h;*ZDc{wX=g8VjD;cV-GZ_Tt;v=Br z^AJltskXv*wQ!|pmo!D)NSRr9_=k?hl|cwnE?R*C*41D*Jb8{$(W%X1C@lVck0|1b zM|?zxD>2esN-F888RzMt!msrCKyrtNEf@qAF(wBf- zsY)1~`w`1hIsy%#pJDhqNjyMrmnX(cWB@39zRY)d)`#~v@+#djtmNHm6F0L=pERag zWyeVV*kXvTiEY30iaxSyY}|)!2nu&+xyJy_9783fdxgB`U1A7+J$uC-=Eo#L$=%u& zk~5Us@0Rpa3#1TQIn~tEj^9ceesy+N0jOMqjlY^GD!=lC+u|mIR~~ii&DEZDDI70Z_O&B`2&Rg&uK? zH%umYmdVEs&H6~7nvNnuHa{!{P$@_%?AbXLm1%zGqN5W@fTG^=LXEs7dzgE9dA57Y zc-`uH3s3fTqxH*5*|!=r)ux40F0?wIb$IqyY!_gCb$lc}d`l>+!v%XV4OhGSgVz-t zmG}^ZoP|3tF{UtX`>^pCaBoyt=dvX z{58I@L9LBX1yoOw@kzIE#o5wXF4k%HMx>eF4VTPrxlsT>+p(Jn)pxvoU*{!+5Z6^F z0st_}SLDq*o}g@ZA9r^s{J7z{xvzIH88!Sdh%%!#DT)Y?%7x72$2#QV@~x2Hn~faY z8V_tD0kSrsP_%TzPtz*vSH@~6~5>jy?q4U1c76Mt3l?yac?cuSH6o963 zgPKm2?wcd4pCFC<4nd3xg$*xF3_}vV;U4WX1i*m~I|oe!*4D(N)bvX8bX-(c4FJ#! zF=h$Y2eD&1m@p)_YTS=d2)IXNV!VC&KzQD%de4-e-eO4blS}1kaXkUnA;(-yAB0Hm zA-+ztVX$O^HeDT%hL$rSTR zCNUrYAhBhAgvSgW@(N|Ln2YqhL39MNN_ILr=-lrNG{-Ln;{%Y6T5LL#lJ!j*dLlI1rDbK5sE7s9rO>f5-iXoadjp%;%+a5- z^q;WlJRSit!`igs7`_q;8i$oKyL9QcFs|fsh_IgFY+Yit5wc%C$s2!NQWFT*tEBDf zmk$#@scU}w(@$S>d0+Re$^uS=$s4hlG%yw(JaF`16(bL)dkWg>q`I$C<#S%?Sliq| zG5czW*pR9#;vd__0^dx>YewTVm1I|aZd+e@afn$P8jjhK3ymQY^Mh}`P*J61S7~6A zVqB?7w65i(X(XITrI;)}v;q7Ph-iTIY6=`r>e_@_7QuLKp9w%)9SoyLW{VwA6P?1{A|U`jDWA$@Y|)(JsP!}V9Y<9b|I*I=s<=VgdfL7PsuCsv8Dfg zkwuLd5he3L4D^zct%cu*D+tOaZ!Fy7zQA#yGO5KU%3ERNbIX?~lUlr=!#~V3nXj{1Ir}_`&kNv~gu*3U#6*E`dj8 zJj?^e18}NyJL|Dc%6#)CA@kEB!Pub$JuJ3RSqHYTsII-rj?4QAp{}phcxlBPa~E+o zFv@|9bhWZp(Un~pB!Teapb9rwNM!)q&HBVym=Y45nyCiKWMO0nk{$yRvzVxoohZx=PTT_@sIU_K4UFj7;G%AcAATTvCstFY0p>?V4)(D{iT;if#HM14z0R zeM?HjFsaDIK0vBTw(5244vC(_83i9ue81m0yWa2_=%z_cx=XX8Vw%%rCy4kXNTm86 zy7W*7Nik529kH#4^H=}jS0;7?`Ev4rqHZ>;L0Yp|%6Mg2F}1?D5HGU+_Qv9m(<_M{ zJ_G4@e39t75nuUwA`Lu(aM?6*HmN^B5-|tjn2x#kDc z=;Bfc=KyF#k5d<)w5FdN^YusC-^PA+Gu4z&SNLr$*AP&tg3lsqUBMAiS+k*hCfurs1Sws%C-D-PQ(DQ0r{Ch_>_nv!^wO+{d4G@$`vP7jY{YrxPPO z1(C0{fsr)f&3pA12nC3XPmElRjn_qfom7!(j?ayXme1SA8(v3&xOCC zgK;0eAt15ROYYjiU>(E-AyF$fsjd=?85#+d6g9{#08Od08Hi zVI06AiEKuPbH>2Rv8KF&M}vWPa%+^%Z4{<{MuLlL)fbO$76*|VXe1<_KT6aRaJ!t* zYVj%b^Jivk?mc4HM>E4x4BlsT)r1;o!tg%{@&c)3T#MhVR9Niyf`iy2kojNGk-A6k zSJ(_KLZi&a=MSyMD_VuxTXCBQk<0>}V)3cyRpNeryhDQG-6KXZv~VD&w<5kPOtVjV z7yd$Q6d4jYJM-ZawxPe2ADuV{67jba5~RoonLhd)xCjg-NXYo4w0ybafE6Or)`MGlIWr7C^R`=klF=`6?ocyL zcD_elyqxtLHV_`mx2LN#X>Gn%FCDO*FH_5NO`7ui1m}REuN`X$xlIK+Q_DAa7&O%P zpZz{3D8eAN1Ryb?di8fOK;{=3GohIRe@2t|J1Z8-6UVX|#w5vrU+WEaZV=h8*6*`k zU1xcq-<`r@$Rk1RkWQ$#faF$}I(DjPlw)kVPN9O?qq8 zA|Anw^&E+*Sf$hlOPmN+pIM17y>J5&s}8e}3{z1&pg53V0cg;qqQF|iyU#QalJxb# zo1M0}DaUijn#lzzj_b^ILo2cC5DdAUH@i7+k9R$l%Wvgm1?UtHgL)lTujl9bqoS{v z1I61NXrRGnzecLBH0^{rW2&Q3Av^0%y89 zy+chBr4|&Qw~mVgdlqXRo2qP={m)0o)}{8!V@@*OUTzj!T8uyTTM18{dE4U#dAPf~ zcV_46Jf^<7Jg%I-klsESJVkz?YeYbOxxZQDIQKbm^Fw*?8i}1(^MwOkJN_))nSFV^ zE%UM*{OGZ^OXhXXhKk|;&Q(h*00!-hzKKaEJvqs|{{=<6fm^+QNl_+Nbwslw*@O(u zs?C$b6Hi8#7{|JaaMl3_ev?GS<~Sg+NKC6dvsNwH1v9DEDOV-NuxjA3lQl4r$*Z#1 z5KZCR_?i*B7z49T@mb8Cv;+qH6ogVJyVuX122%|snIeKPDB|rbL@FLP)n)6OU6d5G zv-yTb@H(1XUzwsG*&vOa4@D3RUqsbW*t)A;Us>Y_jg6D~3p)I!ERHeiP0VB&8O)P? zXZXTjqf|CGmpkiQ-wq`PXPGK7sjdVAkcl}8s26m`W1Z03*{H<<-D0b*S`q>XB3L*X znzf{RWIuhSa*KM<;S?@vxU-;vW-ajw8!ouzZ`bk(SU5O{s?LmwVYGi*YcMWGJqkRS zAOQP^KXU_08zs(%15aQ^Kv9M9$2l`YAQvjnqzfzND;KFTU7on zDL}MYVrJSveW7}cceTF0(cMGP;g<#JiTn>BpvTZ@|8nNOXoE(BGgdi{;Gm5891Oh} zcuY)=uv5)7as_EtsO&P4Gw8ziLu#wg$!fRgA0J3Uf^z?e+?3f}Re>{rQ@1vT*k?32 zQXxQ=nwkWqCbRxDa1%g4aVmlW$OQR-{Ij!<5&F7>RRiBw-H*)%&>{cTZc6+>( z>NAoiH-N!5Rf}PN3wf7DsN;9|Uo60;rTwU&Y24_FZSCR_BQX>FopNKN*`dVv;iv`- z-_hCGvGfmsY^A{BNFB!uPBOjf8y52uj~R=xF7;eJlG(oFo%?&TkNz9u5(Vdah7e)T z9lL`$i|MbC`Z*U*Px7y~k9`|1_l>Q`-L|%?x=aGWw7K#|gB_4)T z%U)>xPQ9LjSh@}n$RXTXd_76^X?E(D`L>uqBAU~aweDE5!*YD_4K*t;kfo(}74lKW zd#=&5szzc|^bA<&^u4fmWnso4njVR>=2*DWcQT**5?-9;YCohpyKr>YKmCgQma)GQ zh=W;k6RzX&r(XvEe*WCPIco9}NEPmEJ@0W7*rffgLt_^psMAV@#Z3N;)Lby83fHNCQf^P1Kq zCYlJ{$kXm#cls87=G+|US5!G{4drC}S>Vd@$8hPXIA{A<@T?G+*N8_3tqITjx zUp2iQmcNHYohbN~)Ac+;Qy5S}T)g)sZqICAZz;Yvzt#WY*F9l0ipH0eKM=8`?t8Lw z@0MGSw##|-XZeiZC_Uf}R4!8|QCtN4%*wa>vX+ooaM7y@vfs?XuS2ndE#KEq}X> zrC5BqCw|WH`|^rScAoQ^V~tCCc}w5qYkxLNbB_6i=vmEY3{wk8c_Kw$j>uVn1nwJI zc!j;LvL0msfJuG}Y*Jk-k7ZQL>Rq%z)-`oD3ysuXF#!;Cc7s1p;epGh{oOI*6@TEb zVX^WmEyxR=z}-97HV*IB?)81=J8k+-&V^du^>qfqWH3G0_xX^E9kT1u`bBlei@+N@ zA`C$f7UQK;?;ekjLgyE1(}>rvz?a*v>eyH&`v*Byp;4^OTa zQ|IUJmV}8wTUAkNZJnPqi+JcIV1EXZ=g^TCvZ_ zn>^Y(-5RmZveKs_9e98&T@v&)?fLqoyu|JtJSM&*F}SY2ob(ovGQYg8F?RQYr4Aay z8gtZxC0Y-b4DnWFuJeA!6t=#fysc&}`cBzp?`-zb1(w!(buPs`fh>sKW{C|OkkH}w zlF6iok8f{Xy*?n70V}6q!>ki60Fu*d$SD!#*Rto2$7TmymXxz}Njd-W4}kuLsS%@2BWI8f<@>PD1bX$?c`}n zbvI_mi}ZmpLq+RP#c?Ig{8~)ar_}1T)rb6{dlpDZZNZnpwhD&O^M!v(v4Xi=Z+E+k z@$)TPgni`u;AO6&-!<88ivI=IO%c0a%XN7W!)b?l>#G(1NA{6}gW}|nP_XQ8f?S2y zT{a)8Td`shFlM@!V$lR$|JJz{am{M!xx8}+u4Yz%Jk55B<|3s4{GWs8vsb0^r3;=wlit~U7~a5@{-=lh>ml1~W6hA- z^qteMzb*Hl0%i~Xr_}!Z|M=2HWpyhc@NbDF@_TiJTCetO-|UJUy-L2~9h2}Cz3}$g zeEGkH;3mzK9i>gwbD{rNskq_RT>tjAD`be!6VL4jd~a0YqK>i0h+6iB)&cD0YezvM zl1hfjL>CjsUTX8ye0(G`cY(KADuq_)}D@=K7^YX#tUtK}9Sap4S!Cjwq4b#LW z(HX@~s7$5VsdQ1 z#2)C3MqqhQ;WL0}^@n6mTfnKaI6q&uvg*g`$VAu2KaEg-hvZ;1QV(W0XM==_p))GI zV%hlA#njwOA5D_2l7Xntn9Cy=Q|d4j?uLFMxB)XtmBJ1}aZ5fzwJHllhC-o{tg-F_ zxNt}b$S)W}TA>4j{4zmSZ_X2%3xc3ejb07bCgnY!$nnj=JK@v!Qd?{zjQqUD)n7{{ ztL>IsQNhI2w{JT~5q!(WRLR)H2UcK8N@nbmV{L3n!bCd7ND3lMZs`ji<8Mos#c9r; z9A?)?pBYZ_keiTBg=f?Y!22jin7$#53Sf|Gj_6my`)mhIFdEU&nm^ttkIhbnmQg=j zC>yV;W=vj^b~lR90X~pD6+h!CK!Z7F#bfG~gO)+Dixh?VIh()QjzZRcVa(ifK;lbs zgwhxL$+Bvve)IG2+TfZW_yJLri%}+*IduG+W`@07k7KI}>rM7x=V4}1Nm7HU&8Fb@ z58n?Ky6@e;6dkOMT!a1_K#L7>$pj;NVDVPU-2ra~UY5V_FAfM3H7P1;uncZCgIram z<>nord9;#hn(d5nz2*g_(~%_Uu@O*BbVGwYi_K zKJCDDS}j0L&={blp%GuY71)SkCC0R17Q_|*2Uk*)SqEDRG%-agryZ1(xSmMAR;L=J zI-ysFOw|?9s2RDMxQWPAZ+?88;o@fdM{MJ5n(xr*m53Ya%~R5QzD|u4U|I}#4hKWF zymxAKFRrd+(R8%5HtbWx`_a@=tKy%SR$j?ZXGNTjcPxM=w9d{81x^#TbRtxH+Y@A# zFEPklxth-73$AJ1j4=r=?KHgODH_G}jlk<%T(w9nQ)^sg zbf7+!?-)S2cI6uSBpyH=^yG4yRUA#<%DYwDbn}oe1vVV)%>6W^Ab?5#E7j$N=tBEg z@%TUDmJ$06W<-66Bg^Qo_o6f(WYB(GsKhs*-xm!xtE(IMh)&;6H#!NLLtc zpZT+}XT?+@90G)Zylfq)w#9^&|1xWn6_PJ|iUIZ{%Sr9h5ftIm{cdO^G&bH#xyZ4o z`4W^EAV|>9cZ(#jUEg@46CQW~k`8h(cw{>jwmWv!k@+EJAoVGuNI3wE@o(>X0N3`3g#4HFZStr&l3T85e)Do<}{79}@j2(tnoOsTH9I%Pp8 z%4=R;^LR)#BI*-NNUk^~G|3=Q+UcwrJzmO-WvSW5G>mK+Bx}B4dD@kNCMhG`?I*{< znu`eqpl}|yeV&Euk=IKbD6Dm&%Ub5sVHf-(9+^Ssk$2IbbuhlG_wrm4L)>9{Theg8 z0u6wcW8PdBAcERmemqEV@~h6@ZxR83!=Ev|&PH4as<%InSLfa><@&EQZRN&yndg_! zF~d2ocy43@$3E5jQ0x0{{&Wj>*OArF8&c%Js2<6I=ei)r1mup5O6T<+;}`T)zn=8@ zmGg1ew;o~e>u4}f^?Rg*caUzn53d8QIqUD~6!vs({d{@!UVG;W8~A5bzPujpo#;^b z4aP7NszafP!l%%X-T{%|T3vbK0%r{GK@XX3bR$ko1Tq8DF{M3D)F1s+RH$F}zG8hs zPcV;7pZ1$qWrWRuQmDWzK=NSwDO7H=qbW+ptgux9=axAn8bTecXx;z{6oM|F5rfb3 zT7^ouRAla!g|8IQl&1~rt)j0mPiB!97no67cQyH9H8D~;ODM4-q-o0iOA>mxfUj)M zg}QiFQA4#qt-Qt}&GNuTrSMH~HzEw#1`!d$gqOiZ$9^I$g36f}B^b5{4+0CjywB$h z56W>If2afU(XLRIY)j_eaQOj=77EZzBQFF{z1^43>lwINaG7deTB;J0*ZuoS zx&*G)ijJL_z-@p>sK>Yp8<*+&VLV#vGHvu+BF+7_;;OMhHwo`GA1FA71>^o?=Keqf-eRbO! zLws(tlQ&p6nG@nqcKt6dl)fc^3L@c-Nv^- z`?6@A$O*9ewvEYsW07_DEGI`ZQ>vbRpCL$QMS2nCW^o`wk)>c=+p-uOb1Uyo0~?e7 z6K9b9ZB48@8o8rj8+Q)CO5^GjppxHV85sk1Y*#_!UL5C@)wML+mcmF%h()9e!^n>v@4@ITm$U`DwA#*vCD z1^%1UIL2Gs2&ekXAuVjA{Xyb_uMSqL=ZX0b#At7C-E%+jj&?7(n#*F(_h~%C?&aCd zExe6~Wu4qrIbF|t^D6|f^LFgSG6!a9(uv^#M3hc_--{L~k8-7Si7zB{X>X%$W_Cj; zw~cp+8r?JJ9XC$v`wzqC!fKtV9j{u;Ltiie_s98t8q+_C6R!u@SEwq>;Z*O)!0h{k zUYCbk=+Po+r@Bt9$=Rd&-6V4+c{P^P>qEz*w8yLWAKVgQU3Xr;higLSF*_gL7ZGj4 zMah3?C_a72)LvYuU#w~Kfe4{^@zyS({h|s?3QPhz8Mr8X*7DW|Ie(DSgMXUOr4Oc` zz@}pT2TzpYLz{(w^7OH#=NKf{w-w)K*tO}NMqXq%uON(fGMn@Wrnvju^HcprISn=o=ML-++6?P0Zu9%aQ zhRlRha>M{BlFWW3cMF3cat)2E)ua{|p)cdiPs+H zZDNT+he#W8{VfR}*}#qgMrXi>R}dQlXaMV!dC-7}^bWqtPB8TCfpi}rGUUSk7{QWI zWFlGgksf^Ga!w5vm4PbRsRV|sC}`zE!B+bQmx0}gA;J@8@GnJ|qjk{DB_w@V zivu?JoA zXhdx5H0&NpUy z%7k@wG#*bb$|}2IY3Diylkz4xe7Hj4(+o7+_Qk zk9$cC9AD6~#Ew*|$%jGJUmp8}?`LGP%mn}zGm>@|;>bWeJS$D|>9#cB=?IOMKI?-Q zKI2Ctg^_@OBx0e-ggz)4Swrc6o1}$PMFgCdl^>x%0Vn5ayhS4K9^%a}{L*+Moy_s2 zr7`lNsC#6CKE6XBW2jWxFwQisb|JiparQEh{-!Ze9N4>xV#XQ*Vb4A!O==uO{Xck? zcS7k~hFR{D__@jKO|kJjOuVsVVtcm#hp)E`i{shay&HE41P{R_xVr^+32wn%gKKby z;BLV}aEIW*-Q6X)yUXeP_ukLh=bY<(=fhmnGdvylU5QX@2GKqmk@aHvxrm)#DYov#s%wD3G`dRT}r`YwGXr zYWm*G(EpG@QaBx@gz&zFV@&dTaa=37U2D7&cuW1Q{XVVOm$zpt@=>>MZ>F)QF@PD# zUB|uP-o+0cxVX4P060>=W>oO7mo|kwZ1sLBB=aS=c47i2ael0Fs5&cCm7Nf`%1qPLrjFOa0jcgc!+*~i^(k>!0h!hHpI2iFgY|hi%SjxX^!xiV~DSlD=UgW=Gax15g*3{Um` zRz_$@Xk6t2GsYxH(cos~WTs!2O|D#2qbrTgfcsMYHiR#+kEZ~1e2wdz<{KDoq$F6x ztoC?lkO&&xvpC$2@&R7w2Fk}FNYOjHQ&Se{Cr1)ZC<#sdZ1zgL3mQ{`e0lENR<{oE zpm0eGcN6kWm={J_uY9>;;!JA$Lo`*0hf)w2O}K|S^v$|k zD5a=O78GqsjK3x|1EJIm1R$l-$D`T@jQvVGY<`r%Dk7vQIKDQY+e((rCxDn@qbz_P zoMdtGcpWl!9u~_F?B1yL_rptrcmwzfi6Y3*aqEuub=V#;d9>DPg=H}FbgUBv!ZR{WD*$<6gmHw9-*J}RFR_VPDd98)cV{Bll7h+^VwrT z$F{55-`4E&y5TIhI47^PB1rA*Vgmjmf;?Z%Wjy*ZVYGqo>qVHS0@ssIN7o7hT=$2+ z$L(xC$niFMSh!4{Z_G5dP-Q*Gy5KaeCI_TnEsyZt6=mv;j#dGI`UYA5TWMiqPp3aj z3Qeo}RfF}nT8&=^G60_GfJxraBx^+DT z1pz#XuUzCb{$*5PkCx2MGxR_HQ+f8x&MdM80f`QROKFe za0Mutz@ynPgVRGZ`ly3<5r<$v^R}y)6k3)~5(yD$0NH&7=N%?hJ29HR?aip}d{o?J z_88Qb-H?bq4&ZCT4C}@DD2AQTE(S39IC3DYX|fS*ZSO+-p1mMaCz3tIA+gh5oPwva zUCS~FqhE5}c`qPJryiC%U|#%Z)}W3U6aG!juX&0;$hnf;^e&uGw)c{Q&MZx9gre$( zlf`o3YLelBfhu!LVDO5rnnYD%(p09_-t`!%Od)fVA<`V;f_}xAI5J6DNFdpM;QNzx zDWc>o&xyr~IXw}>Qzpzm)=ZR7vYX~^x@h|3Qy*g2CUEj0013!d=kji{oP^wG8Tp+} zs2&w#W3GN+`~}HYt2j2+Hy;>mm164yk-1<4 zz;GLw2%t>z5tkL25~%=ul$q&_USZjZN)2cb4+HC|MOYLY#e2<+*W#bUZz= zVS4Oqe0OlM-94bZEAR4Rh^?=Ee&WRTdOx(gTB*e=;TYj6~oc|OfeH#Ii?1Kn1=-e}Ie5)3xYnA}aW_hdTD0HLzU#iqF98uxShXaEpI#t5NA%&##{qIzY zvG#pw6Y`Cb%6UOIzXJti##vBW`Kdg9;soghx0m&#gZPuB3AM=QTZrB6H}C0|VC*k- zcK2`J*|ifG8#M2%a|qq@1_GDrlr33k5&~mcNA+>1HZV62ymlF0r^!Suk7`rR>df#r z7NB~5gYfaWaEh~#(TC-xLt+l6cQ)fzCE_~DRfizV6$llISpx0$F(hHqe*OU`c*tCv zgvh=+WMX*Twj65F(6%fC65xqVm7jE^s5H0j6LW3|4?2g>e>Y+QZ=oL|Ur&dHH)0fl zbA6|k>tac5QdI7DFSxM3tG;ulJYVJ~s04PsP{;+wB}$v$hGxU+`*(G{sWNTn3a}r@ ze=;uZ6#tD23YM&0(vL(8Sf5Z|24AjEL+#Gh;Q#hf38>;_*n$%}v4ClNA_6 zK2Y&v5RaMJ99* zB{SyaQU*DalE%u!Ecn(In zw#{W^S`SfGUpvo!3AOjyd%Y781e7XeR5PLh1Vm_80etUQ3?!kgQ+mOd z;nC?ss|%0nX`L^1o?b^$M&_pb|J}mprJ`nd8L~R#W^`4d}qB-`imlNgW ze?<}cQq8C)c=}fT?o5CF@sjzHS2mdGL0o)H#1h&CX5x#B;!yookR`3%>%khSNY2_| zRa%cvMk=M06WU)L*7*%he&pl+x`qE@!VRN4LM}`AWrdxD~uQOcM=7*cM(KbA7j3u2-(S3@$ zDzt1L=J~cZMpbR9F*DgjUx%%!2*%WfK_i%&L%3oC9&c>tlviUDp`@Y`p#-*hj2br&hd2ST>G}&ex&plY>a*4nf1)qSlct zC}6d1m{WJ5fPfByt3^T5Lj1tFFFM=nfCHcZW3`5d8FkUB^eZf**KfZB_A8fS>X;NB zt*R9z<<+E@QDHUq5S28!a%{(YTzGbV5o|mRt0lS|4$s6U6zCudlp=#MdYxa1*~6;+ zSbUDF=I=p~!t&3G4BuxPBfJ)NBGlLY{laYQ5_$R8=)KqQkgt~~8$NGs`-isv%RRzO zz>as_J@kK68)#!q-N9A|{yP)$Jr2(3V;Myj2HGJf8(q8UXsB#zTyI;E(zl~9LGltp zpr#sY2Jx;I&*tYd?dj1r5!!I7pwE5s_N(k?pHnI|yU+Ju9D6#-%)j>f;L+A9z;ia{ zqb0c88Lf=j;XJ#Y9S0CBZJn{WvVvIU8!C~;d7@6%vL-uG`>ee@^*i&~rJ@^>p;|`k_19zsZDtS|vR?*#JnJ9aFSSpbzxt%B+qyXf zBiyGxn?l)ft#7~%Sd|ozlzd*}YLv>p@#;5BM$oZmby%V7t#^0Yz-Gu895d?kUe>%@ z(i6^JeYkjqeCoqdH+%W4bfvHi3w<+cHiyZ3!cXv*;b&D~rXXB#*42{xp-ZZw*jO0x z$=@}V(NBzUm_n~p!YBw^B5epeN3!%@@5U>EwtZI`}&^u zUVocGZ_q6<=m;^w1*S3+A}JhdDVO?eqq z*n-yc`o)GntPGPNvpY6TG@Lcot1Q1R4Yh#4lHgZaH>s0)j6SNDHKe-!Y^v z%%gmzyqgG{NG;=c!XNZ*ncvgx+e25wj?|XZ`?bkji!S6852c(bdq!g8-xZAJaW(%F zZbqNC!$t7a2LoxJd#u87^zt&pD;=A>K=0{kKiEQKEm>xRDr*6$Ko5^?S#G`McE|>E zW3XK@`!U$FzW?O?a}4?Qva*fOM?t6U^N;W(f#^-*mEO_g*GA9xZf7@Lw3w7}Wm z-uVvaW7|~`T-&TqOV!VxKll2f4ssn|zs80Wy%@?Y%<*DVTeKpbAw%@$)b>9Y4^L9N$`DQHdk2-hkM}an zAOZQGgA2Rsg4OxvpQ;7lt_XlW)PGepxTOOBjgUBST#j+araA?gC$s!R|EY@(U`WOh zPbTZiiw{rY)YWmg%Y$H-Y2bNVH*cI-L>7qGpxLQyX4(3Xu_00x%wxAH{nf*pU8%fZ zE++7}vkD5lF&gbV{3zq)3t8uRD9IMmQ#zlnm02Yz)z$G5D~F&daxatr*mP+R$krhH;zSux5@gWOvNu5m5137dBqzofJ^mjaF8z_w)FfRx{b zTyk)5@fc6RcXcaoPa47^70oTGzMW4z6vP^+Q$5z5nPktN2<>CeVnLN38~ZlP`n8a@ z9||x~*}3VcD%#&K!mJziAHrJ)LYsE4tVdPsiZpVI6fuZDmDO3|Dw@cuuASQe`*$_19=r_M3fXxz=2VUH z@kLAt?-CrClqDoti+`#n?>cgAgJzl$UDn^e(jSbkm@NJ-%XlGd|Ng#+!Q^NAoZk0F zuoWXG%})u_)3UNI=C=)88DRYjHL`e=zrV#0Xh0*k%KKeRbEHd8kvqe7=ZCYV|F zj`g@0lCc4sA&5{148Qj)f8H`Fs4sx`y`>2J3bL`5k^2|Fk_nVhrs9jV8~Nu&+Ut>} z!9~hw8jV@G{9V&$l=|6N`|>_XOvh240C}^@TKS$iu`o0q>-ukL08)E;9>hltw{$gFgwf*sN4pl2pyhOx=0# zHvr9lQBYU5aGKzbP4dF}5m}`{QQlWvU2jTBFOxUcVN}siR16wx| zI|2eLW=tK+M-`DMKXT2NqBx7+X|UmKQ&5;l!}_Wos&0ysC$@)CX&}m0Y3b4#;RPoS ztygi&2$&diOG1xJ}t~o2~jJPZ7R|2hz zZ&AyRTKeKi6+}BV_j8k~^>7Ro-zA0a8-#>%=7@2nvo&*Lt2f)u5QFLj9-W-X8$^KZ zs5Vu$45?_#sb;{KWg%mT8!QqZU!tX4JYqnfY1(90_I{g!1Xer5^@BFSeSiN2={uPz zAts0zT`W7R+C8VFZxCjgAI;_uAS+u-y1&K6>^`KzBO6!D9I6$}(>2ynvmG%lh#Lku z>{yN$isVWc2$Ko^=^Rh{++seUy3_ zJ;lyD>Crd3FyD$ng)D7GPVT z!11a>zmlu#?VV73#}59Ud1(zUvUAC8?+Dfhy-^@)q!FKf0fRsTg*YL?Z`62*lDJ~T zIapi=drI1UGIYrBOK{PddmjuB9c9EHYs!-%)>PRay|LRfPzgKO7rtYba+671jf5_2AorNf!+nuU~g@7f2s z0g`vkD+a1#(@(PPSx9AvT}lFAl~0|n(lf{Fj6w;_8?fv-&16ngw`Dn)9w+}=H%|G$ zS}vPL?j=W=Szg^cqW!ouV+D(bac&%!xAcvk2+h&3AROlV0KCMO1H1yNZ17LvkH5@| z^%q3>onZq8X1A`ev{V@0(Gj72K_>VzgI8TL*uaS=`zI$~vOH-!PMf%SwvTv_RT_`z z9p0HZZh=k$d?B^{IhToQoT$FJIRlAORjRQu1u9!CnB202P^W_&9xnZ{=YfaJi%wiK zC)e!h4JtLxg;?m1QhO6@d7W+(@FAxt<%08rLzGcWOqR)GY-$1!e{E^%3VQ6ibt3XJI zH&QpX5a-dXByWs$?b2FmFM!^-@YylaL}fNfi=rkY=p?7Vstp`_@0A1k>cAMsxhH8U zsoYAGv1%xz!^6X}PG#JVtV%w28oS-Y`%{G;Q7n*Qjo^Z-2rnx$o3MoBPiB^mYdSp` zUo9&;o5(7bo=bOV$cB8Ti|TkdRqV@Sx4!$}X*2|YuIb*Y%Sa||HS|!hm|lUQo(jEj zXx2G*tff+~Ffyia`wpqO`SNz;Vn=qB+`90sFG$LK{NGM8p+=|n7Tw- zsz1G?O-T=)ZRhAy{>Uz&_NuGpj>;Hw?6Lp{EBIQj^y(XGu@APvP0xPMb|Ek(40*97 z+ZHa$#=qb@*T=DEO|W^ju;;R0P+8O5Vy`Xyi?pZLGi1|*>c_4b&rDU#P(yGg)`^R* zH?0*M1;hN{q6wFaFS;-%TAGwHaiI9_6HIH=sRgLHs##E9Nyu$?c|Faj(%Mk6!$*rB=0 z#aI<6{$;pX*+i^3=I6&TvSp@*%5CsyUUc>jBrpj>+Youj_~~5S^F@UMw|7m)X<a91JnwBBt@ZXr$_}t zvMg*q0Rhxyna|GwMqT`BV%;kTbd~FROd5lQtOG(CGXl)KyjnwdnWMjxE?vEhyX%N; z%r)^S`m=QjNMm4yMF+&%*N8TJ(WNaov;xQP{MXvi3q+w4^oqj6gTwCcE38sy&;#R% z(XD5LdE$39SiEHdrq|TUN=i?@{nS26>vYycS6YChlJ{sTA^&)59?IwzZd1(aF6}4Y z%O5*Q?>W3c3==0be*r4*0|L4Njti#eRyg9?**~QG?S-N<0<1nwW(8xdU7Zv(C5Z?& z%MC*01s)U-`Uw=D@D+@$NR`ZoX6Ou5wih?c5Q9~dt*`?7Yq8Sm<`4w%q8#7irb@R) zwIn3Xs8GWLOe`=^VXVqZnq{rRAAS1=%e3IfdZ>Xs4gz*WSil&+CRj?mdJa{b#7Lu2 zWw|9hhsS#BVmh?!!f0n6e7!nsTcm|ndE%w$xd=S}JgoXdfeAiH zP3kmz0Hr;v882$|yvnUh3YBY@vPj^=>|F7$9x(km@$9r|NPL)VETP7mfol^)$lt}a zbU1QK{pzuSLGDR2O!kn)6iBwQzUNdq4N$1GkhQ+a7!I5^E< zrg4N45#H5p%iz|sQDOc~JtTw65SOdSWmX@A<|z_6VXMX*Q)aF`Q+a(+O9A%K&0#~~ zSo$TyR%ds3qmZEH6}P|L!;GS>D6wwo#^&z!I0W@Xnh#u5>GG3eV17?1yL;G2^qtQq zsMk1`CvQ{>)(|!iECleTxCFYMnai)!<8n)@ywyI!QE?#Tf4cr)wk0;nPsYZcmq{5t)HAs zojsBbG=u5wEHrDmevqQjPQ_Kh*vT3&=q{a+BM-5ZR<%;-pWh`#F1=^a0B6ICI_K4G zFBdwUc#wS5Wk!W%;Cz#Y^gbO~G>2XtjJpy^f4rd|!YEvaPpX0F-+>_xP3l~x)Ptda zt#%!1#4J5D1I?vpRL6@5*q6HA1e#JPvF$iI(G@oZkA$;N^vCNGYz~I{eNwE;=0On> zA(6(7i^495tTz)!`aL2CVQ`_=!zYD~$Z>kgNfd$BxG4VJz-jU4_l?-mZ#y|1RkYON z!6tZWOXC=yt+SAq*cTxS=X-g`FzH~z=30MR<1tWbk9BTKL6*##mL%lnv>H_PHse~w zP!J}K_Bh>`*(CA+u`QPN^K=QU(Dgov^ItXwuh<9A<5xAry3)dHs~h|QA=5$%;?M~f zXR&3fOb*w${-L9lV=QeaSQLq;#x8`Vv?_yy~ghiBMaGbTNadWu#tsYDi;4nyxi|TlD zzQ`}eW+#Rrd@ssF=sZtHeyc#La0x_qE_(BAhpn{pw z^mLP3w=O9Yt_$vWO3giXR|xShU25s6n}efE)bMXCr z|2KqIsa#dIp9wHlZC&%Py1NmupulAa*IHC)#iA`nU`4hlY4A3Z+X-aGiZl>IAi8KM ze6{isT=)Lbv3dPq1UA*YC7!N4WcHSWl;lo(h7QEU#LWw)gPxJ&ZK%tUTX~XkI5V%nwyCtubdyhdCgzcjzpn{@2g-t2`+KHpkmSV8ei*qZwT^h`zprcVfGO5ZwzTQ&V{!jAO7DXpHi zp|Tihq`x0d(omAj8F9NmIsDo?&Su!MQa*}u^OO|3`8!WPwOIx*!53(>z%-aP#o86b zlT~cmB0|F~`?5`P6saR0heS|6O7*Nvf@)66ga=voSqdP2gB*ytFoFavq~j*a?`XPA zl=oYLvXwdYB?UP&S4X7t&kF@28#eA((BMy+gbW{MSiq~h;l&+Jr?Sg*p|=KuWC`O3 zz*bW(Ci_8wq^3S|m{BZ=D{D6iQluRCP@;z6E2=+9pd)?8M}!pR>93+%&&Mm0H-*$P zSgd>UJf31ViKDgYmK6ab&Sw^8>72)h!fTUMmhGRE;#e!kaL;TC=(SP=*rTq zB*4OrWioU{i_#q>wVn*=XCFBvK1-NSlgDDm3=b>w77L$}??i9Yj}kK8pqOr?xgZ{? zX>mEDuAwzUH_H0uXfcrb%Ea2(iKSDSfo*#`p%()WP{L_$0_Ye&%e}B|RGKWR%fz-Zq+mSGHZsDga z9lZUM?B4+|p`MM`$TCNhgu#HnVi~TYW~e64Pu2kq0|>l9g*JTa>yRL+>HrJ;is4LH zC5_>$cTb%E`uDakEf(&$FZ6#05M^ZyfA;mOltv&zp#pr7?n$kJ`5RJMHJAP-&J*t) zcXJwXxRJ#Vl`SF$Vl+}BjjNYbG|y9_dLogb+q zy_v%WvrguiGi^DYtGo)2#b11i+E!E&Q>)L7Tl8r0)o~h>9uw zwP!Wsal!H@rWk%Y9K=8)Fjm$Zky$xIyC&|P5>~|4SQO7?h)>094i;Dj8l6E%wi9r^ zklZyZ;oUz+@K<*S1S&%G5MdkK#@B)=rL*b-^~K^669x^3On6gEuGRH^fz0v)nhFV9?PfiZ}V9IQj4(0 zLht+55HB|tNp@YU7Qj7ib)x~Agtwf@(|7Zcw{mA>3&E$DJJ*U8IRLRpf&WSi0 z`P8^{N(-L&8KXNi3b5o7B~2a|!M{VOo(I_6j#S?RzBAH}TUqoC*s+;R9X~@(L zmYSo$gni;ulSVFFhqNoi+*&hJdAcaR4g)F<$9K{87|;PDVjkX^Z}^gA*H#+0uGrLW z%!J7KO;0Q|>HB1PVx=YLx`is=62HOCyds|hNC%X>&FoxkCHLOubvm0qf?;zJ>~y23 zn&X;liZK%CmAk|{$nC$hd*%x!LIB{-+IC%OtB`ptb1akWuh?`!PwHWE+%fPEjWl+ORN2c^%HFVUp-So&3&6TIvnV5dUD&Kf02rj)GLz@`U(Y367f?Gx4DPP*A zBC(-PYm|CxFt5aFDonCSy2+-=T+5-fsjr+A_-?*uQ^=4kmptq%=}_C!R^qi30`1F( zCB|8m%b@o78Rca4 z8;t_K=ww{*=d!cdB(nOdFw%eQSmBGKf6h;4i$9Pu(kq84Yf~6B-{~u>-Xa0OxVCQU zlJS?BvQkJ2h8X&EZOvxuF{5aHO4`@O2*K#~*vO~#iuZyJTm7~Y2q1>?^h>v@l~d2g zAAN;>?lkWK-_5_YU7>A!D3%qV3X3q*Gg+RdX}-m%oJacdH#;dYC3Q z#kth|rnp7Fi;aLXj%dru-+!QN1v;_9g5P0BTiPEk#dl?Du6Sv@JK!rX)JC=F7WI&XlaAu`0St zQ@%19vlMy{Uc(>Uk>%}O)USv^yA-~G|>MK|N8fS zKhgi1>i@l;BFR67kAH3E2;UsLK>usECWDrT#lzF*k9LAiXRU(N9u3FRx{GZDO|!bY z?&)LBS-W6f`+o|_afOr9lP%b{?Smvy0pto9eoQqJMi2o1m@w_$+Llj@zg=&*RK@?I zX$>W#UF*I-X zO3lBVgO7yz914MH1IsI$38&ovx!@nf*(s$pr53pp^UFe3nInc(^IC9_v>&(d$o02& z{;>DWmxNX+cCSW3gb{8bqwvy2wL#;Uv#`O`$hqQQHl|ts!vz1qeX#t0abI=R=McuE zAyEOA$q94jJ*Ou2qID>_CeGO^#i!$iXjHig;9<=^#Yu>M>Z9&Cme7N4cO_+_9w=d zVZB}p(s``Y+$}JZEjRv^CutY&8`rJs1a51+mKuXBf;Vy$qT4r^RE0mpm!ie^2~UpnWk4e;YDv=%)51sTT#?K_ppZvM)WJs8 zQ~kR4M}_2qivx$%uiSCBi2sM)z3AXX(*Hl?P-ub)G`8{bdRB`eOj?c|{e2ZtsRlAc zIYoC5$;*z(*A0o3g9k<;a^P*5K1j_XEHisTRj(AXlVJJ_WdHo17_*a&0ID!q>#r?e z;V-Ua^?6$!Kn?%^Z8EyY@eOVaSvFDT(~EhR_vs*aU&ymkmCn0#Bs;T8vJJ<_^_3HU z^qKfV2da@HC!Ye*e6}PSU-JifMjxITT^ek{lF7GRdHoLCS(%yUiaP0`A4)N4&o5Ml z#6GnuNfGaisHNTC?_*LZDctsd%3;b^&04s>UnnY%``O3*RaX}36n2pDJW{yh$c3*w zhZiNlNASK?(EV(uo&7WYzsTU=!MpGR3w@KgXe3m&G$)?SB8#hGY)1;Gfu+Ax8aBNv z`FqJ_VMorlHkFx8c z#Ri1S<|9iG{pH@)8PY#+cx5T$2PTz%RsdeqIP{qVJ1Jl@c2gcAm(gNsg8iU~y&p;! zzcNJ&E~6|8BtnxsjiMwC*yGbpG1Bs!>EOR@oLL07T{-@qVu8_6d9Y$F=*#r(hxo40 zpMwkp6z3Fcs8v78bdZ5*l=mFSGpyeXYCYhyu|NvF#d6`N%aF47LyZ{Nj~q4Xrxqb^=D0m*?HFc;Ia~FqX+d__70i;MluVn} zs{?p_AJDg`#dG@c142Ds%IqgW`1rD{MM+-WsA-KxebzGUdH`yAS>72Bpg)bGkXA>7 zH$+pbR>MaaWe-mLuX>DU@lj-O>*~Y@=W zn}#j%x(35%iXn9=Hs-5oqNGXwB1UOVNa%jcNYRp4B!F#4Z(W654NFABCMq@RVU!#& zpT>c-38+dT3BOomp*%vV$dE(OD;e2AE_>0Y{(IjhL;hbBnDni0bYD?vOKl1eYjN!$ zDX#WaNQCeQJ5q})3Bo-(;6d*Zbk$?`w1F9|o$a>#Ao|=tm<97NbYHwKAZNsuGzflO92N(uYch97D4Ukvoa=VxSucw+6cH*<^oETS?bcHDdZb6%9r&!JXZ^jB-mU*5Q znUX%zKmc8>j4?JJG_b_%-bnu!!>(vzY2AFhz>Mbfe&hoJGqb^w?T+Z{9~`!4*|kEV zhDEATC}2D}tGG%)>5qHtXXIL~Y`2#EqV|XQ#lA9y>Dzk;cE;!2iuT6dhweYK3Y@o( zpLJFi+H15V$QaTGruouk@3rM9;|m7TeJXi2%2?}ysfApyQcc`jBYuwr1rt(682ttb zJS(1c^{?IDI(kY;4310fgm8)`|2z1NIhEv@C8y(54RGw{mYP_*e03R5 zIdh8c1Mk(Yv*FKzp#hZg^x3}jHy0aZftA}RlDQR>A2D-L-&zOhaM~WW&~tw z83$9?DN7n@PLDZXt-pd;t8}T<7y#ZDcxZMfYdgHVWIUs(;UN&^Nt?YzR>;7grt0G- z`RY!;9>x+@YiSQsG1FX`OgTt7*!Y5#!W{({8Zxpx-s8KpsEPeb9^ZZ*&{{ zNmBF^u_`n3+HXbQ_@4_-e4|kP($ZKu`UYWe_(%_btiw3gNDFRx5bh5nMMuenW34JJ z{FZfJ8U-IZjnK+?HyB{E@lka9-@PdAZzO-cn`|oS>M?tLP~hc#IpSrs^&E4aCW2LM z6!(l2ZNTUIH~cjnIl#fc;cA`c;o%iDNDln7@C#lK%Y;H)a~bEeqb7TCLz?q9ch6S+ z6E@me)Ru|#UzDdW+>z_-r#EiN<-N=d9uNA!HX~atxWL&3UIYGdfM+ae%Cd zb?v2im#T5;5!H%NsZL>d7+Fo4;sF!vV})(DtNYdH8|g^k5EpjcJ>M;w&6C!8ywlhS z-|(q?c|$_L?zPiQ2G#mSW@l}T$bGYhi05oaX6^AtVe(%7b4Lr7&-WV{laTfM)2~an zt#ry=mL>J8@&liZe^#&-og9C7aln3M*AwjzLPJ zrr4heSI0Fbi0?(_Y`sth5i>mt^`*JP)Da$C@2qiofU3oxra-809{GU3E)?m9lG#D{ zel`#8C@Powvc%pUVHMpHM#|qmOHH>QvYIrMt%hB;Ov0^iW0VrDBJetkhw8%1W@QH1 zu<-FndKMknk$?oGLUK#)u&7&k;pekqQCGZe*F{;1Qt3g-gi_HQeOx@5Pwz(5H=%($ zH@;pa{kJf?6Mk7`_DD!NrDo1?BX#%xg?u+K3hHXweeA7&^%aNy(ncz+$3acH z*q3ENR|A`Q^xG`U*Fr}Ev=6#C+JJtot`Q~`9Pjn?E<>eg+JyzNXoAkwF>rh@!^eObAyDY1Ied|W zHgc)NDe?MQ%DcSFMVFjJ59Bnn9?rGxT4s*NXXh2^p+wa5j6PTWX<=U_v$fq2*3XQ5 zo(gXS?*|J{n~K*htQkZTO{B$(R3}0OwTSE4SWdzc7Oz>VZ+89uB6V7LCd(4l&u1E- z?8Go4VhNW=(#^B4sH(t=9eQJ9>uvY?{29XI#FksSk;!rL-p@u^ zSfF&VbaRw$EB)+;l24$y)sP9ahFsm}rW1@|nB^=t_hfJGm&p2_a#ZIzm4o8Nr^(H|d{neytIE8KEd^lC6$jjb24jks3jvz0<`x7EsU z%P|@yls_vy#6Sb6g1KO_Mj0Y>sL<02FAZp%tgkm%9s=lX@Nn;oez|ftplP?Aap#S^ zERX@aIN;(rI~&DponZ*as)R=1x#ysn7&FWJi|c2amcURCNlw~zSBXRml-Yh7iv$6x-yy*RvmWFd;UMSWc0>$7{_RTX+65| zLV~OOa=bw*x0uQy8&W(dvrliS`;>Aq%$DAk#=Q|kghu}}-~a?Bn!JYmh}YRET{1m4 zrb=)hq`6$3yAPe?-$Lne2c)O)Qg>FC-xOE65GlBert0baC)B|2s?`O|v=+YtKGXV+MA_qHT*lN2esEf`X>f&vZ(6r zL(nifNN)Fp1M>j3%-}d3e&Piv$oNNzaxw|yMr1Qw*hzJMxdwlRsM^L&6YuBkg%pfn z08RRE-hy^KG$LH`$gnDw0>YKL`-@ctkfR=c|;WrmPm2(QR42SVkVYD$_L zg(T9|XPqwsleYauYzPU%t1t%#nr0W4p^sB(bQyi~OMP-p=He^qb_h|1w8a&08{Q2y zLtfRf0dH4)sK7T*s^3E;KD0D~%$jWhm4+{@AA(dtxk1v0q9vjNODsA&Fg&MRg{RU2 zi;k@RaZ#eYlIgWH#fN2t_(WV2vNk5Ya-A#3;)m^W*Q^r5&fRyrQQjzr5~zl&p9QCw z%vTQ}xLM@fZ)mIk*u;u8GY;dK&;jVC-1W#JcgDe>8=Jv1eRM1<`saHv>riuET6uY5 zELs!W^pSiDTwxiF#s$yf;_^im_Ls=9ZV7z)_{Kw`v4q_d$VTO?XqaUiLe!aVgtGPH zM1=ys*qw52j1MB4+WB{bp+vG6P;2kv$288is zDkm7nVtxCxcE-o-z7L1dbgFhr%Qf+0Sx2M)gc`#4x?yDm0>1v!Dk16l!E^c!ult%8 zh2Cm-1Z`aiwy7R3_yi@=Vs#LDUm5+{`m7sy(~R`jfVQ{u5f=}N(Y}#@IeYyh9f^=e zlHxbhbWN`gip4-BCbmJdc4_x-a326)jX~+bMXC!Y?b%!zvTt9?>t7S9QUD_By2u^K z;KX`Bx1Im|Kxxu$kRSeblj1o9wZWj5JiPHVy?xwZcGAAyqp|4i9R?1J(m zv4#OlA~ZG`g4SnQUxi@qDxFaP<&o?=cMizJQ+qWA*~Y~7=Lle_EFtbaYO89SVk- z7?nTxz(L0ncJDzI<~;r@p8e#Ih&@hz`@}Zk4|U$#?E#9;>OclPrMtTW`e?Mql{a!A z_`OD!$#tqQY1&kI<7wKihU1V^h(1jAucEYhQ6J#Z8zs@FUukvnNU0#G?g~+i9(FpXsJ_wh1NIv^kM6QGJbUBKFE$?X)KqoEaBGwY{2t7wchH>MTigUBR4He1>vI>#b)t8cIu`uaI(EHKW&@>x9(5%objo` z(3kp}rfDzw6VSAEi{rKGSDLSaeG9`4u47j1ZK15Isv;5Gdutx$?=`5=2b)bu;$caZ zY2X2JY)Z1!ity}=`Ky8`llx4uIc!^@5OPtWGh?$=+)a^VuZv%l+xjn zQN5HGL3EL57!lZUTDDe;&8mCVgdH(se}>aM-P4(a?B{Y^#Ib2y}^ zJ#$)z8i`V|;3d2+)0@JG?t8>)zUn=@U&}VNf?50q9z zR?*Ce(q(2dc_-U)_u(MUe#XKVZ<5V*wFYppBg|Px>R9Vp6n=*xE^ck6F1ubZ1bTrs z4qdGSu3JL7+r`iI6@7o4_y=5x-xmS>A2ZfPo1sq=VmHN@a_gn1ry{DE7Yv1(*$)*{ z-d;zeQi$RDG{sa#jFL=nr92w1FdbRehx)GZVG*iU`_s$; zNr^J)451?r82H-BD4)a{pOl*PX+r*;Btn2{FjC+gk-r6Sx=*UpDLqN)a>ekiW=O&n z#{eK8_Pz>EI{*Mqxh1Fo!}K(PQ!Lg!KGL|YVL8n145GE*_r#D6Tjo>SdL!YB+4;v# zKk|*UX%yP6ux~av?WC#Db#bqYLZTc$??=6LkXQH{{x2!^h ztyRoGH5Yr-3yLjhr78ZTsdun@OCkiWeIkhKRiNcK`hLjyPzHzN#1r(t>Mx z*B}*A4z3hqyIHw|tz1}UfjScR$xxfWdmvZ+lSQH6Y=3uQ<|voMj$~qP?gKauL9cr-A2>xG3p9$ymRW;-cg&(o|^i3 zQQ!;?Lf9=GxiBabQuy4e9P-V1Ei^%nJm7}=R$7wd#;7WrAiX}Dr-9a4J*aU(v;rlw zPwe7m30wt_JsSDmBC^0qjP(dnP`J53Btd%9sC)SKf}zu)!b<#8E!0u^zsr#n9DBZ% zV>F+#i@4M3-HV)m9X*BekNNNKFkSTJ51vLAb5kaeb2nEzn6J69HdXYKI{ndYXJtvI z&{UA$^eC0j|Kc~6)WH<5zrLn-k8lF$E>0+|T+2_<$rMUdlmz*ii^HR!%qR@m8aQxu zmu~v7q-r$$N8zB4s{%YD>3^#CL;t&q9-eGmBW(`0b`r`c7kL{;T6uIdMDf+wjt={- zZBVrIb%6Y5lQX7kGjFw($XW(y4t{m`*xm54Sr=Ce~LI&cj>66n1dnY5*lbL0VG7m*+a`LYtgP6j3#&?bl>W zjW`vP!P_Ub??;6N(0-jD&Gk9*LytL)A_UsOvewT$UQZA3FE}Nf>CX4-omz`VgT-#o zKshzSZ%p!^tF;MdU*Dtn_O+#|NLn_69`HU{!<3a)o}`4JQm%8em&FOp6MfEzfGOya ze&d9HqY`PFN6TaV4K%g34QL)4BwrfY#@gyB>r&Cl04v}Qm}&xs2xajKrR<~{(h&3m z{)Uv53uiiblUUY;mqa1%_CB#whYnSjW)if5Wscx7V}$O7nM9|SBjz^vYrx3+htK|& zXvo@Umj~{6=~{rR*ysUYo3+zwN660{>OJ4eQl~^!5B;dUr&in3h*5h;1-t9dMfSEI@!J0WlJ@^5>4K4fm`x)x06TT<_%$1u- z25{R^@jJUdt5b|l75I?y*Fkuv%)d%b8!wx*M&5?#d%2l6uQg@h>1H^vOaDxADLe?7 zS@%5xSpvPgA1M5uG62AN&;bn=nqRa0`A!n*?y1-MM)QQ^r``Q)tQAJ43 ziByU)j6HgmSMH=(1>duGq`bNVN@$Gc7eBFr^}wBM%QyMi= zY0XD`UM|l~UGQZLnbkEAcoK?Bl~BSnQ)(O7e%q2%t(vM$I>-l0DTx3k!zU(&t{iV$ z@}{oDUu8lE)YrQJVI$1do>C-vWIcb$y6cQ^bf1o%zEDH@PY14GtoF`xoOLtGCeAvp z$~o4B?%3$rIaRuyBzVuMWI{2nL#tC|b7_;7raYfPaMw!!AkFK3mal8LZ0wX_RNDnR zc#>Im8K~H{Z8YV&UI&X^j3N;iyX@bDUY?4hW1PN;9*chB>qtwO)2Xx(<5~K%nD#PW zM|W+yn0GFU zJzfr|Vr8rtHGerf1)S;rE7@DM@l}Krl^PlTOkF%5<%_=`Zv(d{>kT^|%xyE~+_*;= z3V{5#6ZOMO4$eho+IX=2-_N&V>{~x385znuihTeJ`i|v1JGoa~iK73ffPcEQ@KgMH z;|a(_e<0hO$G+-+5VIONG-j#3CKf(1+v0uS{{Jgw;B@kzIm1#R8~-mjLsi}=x+*VZ z=niJuToCvVoKRKh*G7f_2OZ`!=7XxleVVo=I^9mX37$RID@`ugmPu0mZ;Vv^=I^RM zo#CFCCdEQ~_MzoR#<%yDs?q+yi*=4u(^#mX{V78%DIh@k^012x^cZrrvfS*~eppr7xx6n8zXQb3nkQjFKLVrRu4-fCt`cac8~ zf>lsb3|p@GRy-W7H7j>}n~}Q9C!SAJ!NvRQo+KMhZ4}Usr3tITeEUMOzu3e<=)bfE z-vW(L_sM$m{;+==P~0`Z&h}*EwE13dwn)5gP5VVezxsOGW1ElOaqQ|#$4rPYI11=L zFy#iTCK~J%e1I`6kKUak;lz_Z_2I=DqCKCAuU~fVmYgm&cO7I89%VoGWdQ(Bw*;-l zuTY)_CZG<~HT&B)23YH^$Ax{>xAE;=pyTMf)jJ>1{XGPD(sr*7E&;k+bc!=4bt60s z=G4HTWC?myH`9j~>WO(MdWv+*mv49VQ7WW+oSCIMeazhY$6@ozreh z(Y*%wc7M7L+tizoG4xXM&FLJtJkJyPvg$4=qw0!4+#ToG(9=6V0UlIF|)YD`$+>&7S+3yJ1`Rbp1`f(&XZ!Fvp8~QZ&#lJ z`hUP0e&YY7jxqB*y#`%lWj`;hrhv|JE@6x=u?p@Rl{qNT!^|JQpt^INS1{Kjio13C zB_x2;CWE*ba0Aci9&fH^#L-axha)oJXUC7*C^|G0>iEo&8PL&yhR^a7LWinmf*_f&MPiW-E@Bne`suR zw*THUCuG$pgr@E2(w4(W%x%Jv;1o%|1MS<%8l-fe$dK}=pdT1%=p9tGQh9qK+#Nn& zDf}}@j9>H_K4awZk7ASk?$6rWSl6)8Ze1S5H{fYkmPN9Lk8^s>E6y5EI%!86$?+ll z{_clb5AT6HTW*36;$7U3UnD7;O$B>L3BE{l|K28^OiIbWIm94nQpcU|kDW6;0Os=_ zxmjS*cD341U(RH)>kY7&lM@H&$L}TUMzrHGWN~__5TE;b!-AT-?#(u=>eu+)GnSJ*%tIB z=PIlQciI+4==JrC8O4-@B2jN$$<2PwHB{;2pTz+89iRKd`tSc0b+to=FmwE!T5_=RPy5B8N zAvbm)7)}%ENeFsfzyF@1-4T2(j^QrfycSis|2pgBn!GeryC_eoO@1MBA z?MUZh0VChvp}0&);uEaiEmO2%ZJf>e_?*R`G;Lm)pfznB#i0CD>m!bNQyravfnW zfN_4N>!uT?=DuF^1}1djC>}xad_FkGQq5p|_WfOTF-Hed{$0;9Plu|@Ppcb*P@mgV zOSr*76B%%>wu1G{1=-WTIWfH0>_y?&_iuooI@GIel7@QS|K@>P=}GMTAdEmtkLLEQ zL&jI)1uPAA_wU?cU8(<@z!(n+1An>G_k6e+0lYoiotK&Rp?li!L)oo^IMS;*BItLf zdiv$uOL&M&?QNA;!ydT+?T+x?vcer*cioZ};Ea?tU6OOjTMr8gfEjzI%c0gqCH!8x zq;KDk3Io8)a+oU~@8+G?+a6;EP8KAgB^_7@ju3I*nU^JzLo3C1thUN#0pD6Bc7o)$ifOwCA`*SYVGUY+ z5AL8$*9p=6@~ElhJBavtod3gitoXPYaBvjzr{fT%6yI$pROK0YhhW|^n1QA z0^gHpNjp5*KDJT7_H(M(>0y^saukr=-i5X(p!}_GG;6Wn#Td-*!iMx%1G>+3=#OJ9{V^<3FDvVm1FRa_a&w(&9%F>oDU9xo^!7F@2{W1+Ol2)R>lcf zV8^QmyW)LdYyyRrYABr_773MMFs0E01rTyG(!Boie7*~+z16Ys1cPvPlLx>-IrFzSWVgp*Z zkHS9z0^LI?U`o$7ZD7_KK8k;ERX+#6`^~Tn7}vzr`omP0zf6ALKf46vb7$t8DI){` zG{fI_UmN^Lk}2@7&#f2mm%lwg-)Q3K0Tmy}0lI5|r;PYm|CaK}b9ed+!gc~2+Onvc z9iMssdPh{jF8}O3{{0!7`NjT!FGe%|H^c1jA7M+CU}ydh7#9ei#Q%JNnkV(odH>h1 zAsZ|Io%(J0@BX;!f2V%`KMn-+T|$;PD0-U75r1xo`j0{RN9NBSkH*Fk_c15;*BP9s z{<&jt1H1p`KQ~3dLj6ojLqc07q^1%F3N(wSBEY$M-{A?5b!yeA`yQ$9x4@Etenly&rSYyw0I` ze1q5hv^0V`%Tr&p>Lh}ihX1t8UTXIdKnhe@t~A(yhEh(G78LN_$rn&&+j$(`6b6oe z-wg*0_?Pc2IcPtg6*TW{63HDRkuA1m!dPN!B2ldXq=$1Z6>XC#zQTxZ05;t)(F^*Ngl`Yz?4;rRsEy*HAdE_SWnP64iQ_cv~udr zxL_+yIW7*_0qN-{JOHKHu?+P$Wp#62=_jH6WU)lzuwsm~eq2s%(}MNfaeik2wkz-! zImuufY52g{RPX6GbSl*3w|YpXXZ7mYc13aV+}HA()Ui_1#? z)JCf=`*bfJ?btsbXYycoou-cEr5{Yyv|KH@WIzrlC>$Of9Txt+eGEBF@ZH5kq-vpK zt8-4o8pe~~wZbn^^n<9#fsUE?gE3iXXv+ztRA##~oES^YY(a;!}FKc$Ov2!UD<&RF3ho~l%#@D@E*LLcK&1XI_u@LBzW zJ=Aipc}CA1OEC~!bbiq_W@4SOnF1wq3(@h5mQ`FZdEcRU-uB+j9LMT6ftgbIr7GFZ zXjJGb!X(d|NL}jrKgo5H+8-I?i2j`gIbv|rVPrQo^v6C!Y~j0x2&?@OMfRJ|{ej8#HN5u5q*02SAGmi4pu>4v(HBDB~#q@S!y?R#J z`NIx9dPgQ}bQrQ06~S{5gFclO6`Z`5&YPy6Sp2ZNo0Oc4#~p9)k6U!b9-I4F&>g@- z7&~aH^f2ie&cOBd#h}VJkv_-NdH2t6?0G1}%*1?u``$k^^ZB$p zYI15Dm@93BPS8+Isu}J_+CTT-P*)Wc4ZCEi0B2#Z)_9ucDm6oX=N3*A_9<||4c1$X z1`R{Y>Z?V`peDtU(htZ}Tb9HlBpuBXL~bKE?Q$a|DMrSt>2MqCw<*J*XP>hYGW`3x z&;_xZiIn5_fPA9`#tVM`QNm}xnB2M+>znl3g>SuY=lSL>a?D+K zc?UcnG~WmxaM$;%CoCdaDAD2cI{+;1+`!e5 zYt8x{`kY+(i*Pc0aS}hlbb;~7I5X;6L902*H)dB-xQUTs*E1-Dmq$yQ7eqvUdBO>fAXIvcN>1)kcAW|@ zudJ%mhbNB=e~?r4L^n!wTQmPVS6hc=2QRflHjJYb;2$c>)yq*iBDQ>{-w*Sun1~wB zd3UJA>^LHhGKBK7e$GI1xso=cpy#1GV$`d~m%2i%;cuO`CYKo_vkH~s@`f<0ymp5Q zbHHU5x8SbG&z9Kx=$}Vo7Gl07`(qP-eo%uQSi4?v*UjggSk}LFOvrF^bI|DgG|Ywx zUwsn}qLG_M9r>w0U$m<-eWarPkslNdXVT5MbeGx@f2cjcNC5}W#^p4hmuB(|bZw}d z^5+z6eKO`oRA*W)sZH1+$iEc$agM%xs0$`QD9mk8$$a~6IB;634QIh5T2_-ag{VCG zPZ5$-H{Mz&$q#H&^nig1W*y{TxY!b3$i=w5r4bZ{u|1SDDZhmS3iTI{#%<$m2o?`kv}z2N+Z*jO z>HIuN%kZ|U!(`>S^qKAL_kWPSSn64z@sdRrn)-Uz?Hk`~JpJ}vV+H`;MgD=e9YFFz z>XquG8Gkyp5Bl0^YUS(Vo2$z)0y=`{Ngq9C=UrUnRZagGvADYgNaz$!Es2YW2@3kR zC*KI3tUY7FlyD4-1}p0VXl5D?Q8_I3cdkE*9@h$@VQjiKDWB~PGie+CxIc_ge)^z# zs~s-GY}&ce1dz&PE^B)^FsOQ$5mDSWlhlm%kTABmQ6arNDfkY4da+sOcP9-P{glV zW8j|mN`X{f3*gtV?w-Wpf%MXB8h62;=U(Dm9BsXF)u|~TGxIn(DxL+KE}f+rbJlx2 z^x&j=4Q#6-oo89sn&U(|Tx6Eu?L&N%O)JGRT*o7-ZveafAasg1=n05{FQ>f}zmrCX z&TQ*b;pSyZjXIQ~sTID#&AVntr6S*v;nHoIJ8WMjP}d;H6#AV=#E^(1_8t0t;JpaV zCl}1?vp>9}6AIuxeK+{$S);V;6UElXLO8wydf+ndKU ztn0E=WwP9p;74@OqL-H;scFC%0AK$Yo)qjkiz0s5>YOb7i`Q^SB+$Kf~$X8^Rpc{GC7*n?=NK{Hn!Fk^{L9`hClYL-V$fj&L_crhoa<*gEHz$ z41t7L4O_+;M!I}W)vK0Y1$|#7B@OKvEdqZx@)pt_V7>y_)hcST?&>5bD$)g0rR@=4 z;h8?+L}!``wy4n=8FulAPXlXzC~z2vdPxMu2#rkDVvHxRNZPoBnhcR_A{z@1E9JGj zP&kV@2{DSA@RskAjtprsTSIx|YaguZwV3t=T9)(+*svO;3vG0$5NR6~U{{KW9A7a{a&=FT@>VWjH|z=s zyZP5lO?#R=thZn~d=?RYwhLPHy^niv8jCfALZ|`08_=oE_i~_406_AoV6QhU z+xLbH4RF5Zn2wo70U7K`(L2JV;G%FKZI?zk_d^ot`FAF*xDT)Y3}-%*D;P7($*Djk$h#Hm(osPhy!ft!lj_?1~d# zjNY{!Kn6P6`i*VAhhObcOou1^YD1jo@mz9iZ`kMu*iOS-D%Lz~L|BOo=99u<(0bXE zjN&MDpkZphZ7lzr=ouX#A+RsFGdV@O$?IW-1_gk< zSFhx+yf`qn{7tZJbvMaoH#xcXD+{8_b!>cX>t%9b$D4RbCG#jFfDq`H#-huwwP~wT zR(^A}F@8k^cp*{q&{uj`QMVD@ElAh>GO6~d0@z=RRa$~@0;f~g@e~y_4}q_xD|YUU zJ-)wT=kcNxwbBUA3W8HO04l<3@2hIzZ(|Fe2N#OYEC}+Hl$H+L%PYrnXXh z-w`x^C2i39{3{CUwGe6580&1lMsD2KIhOl}mJ94=u}O*1Ig`4DDPeVQ`Pp03;ePq8%oBmcgo;?4d`Z0YzTZG4|IW-xj zuH}jvEr|G;CL6Vo6CAGk@okbFd_n)(N5Zk_|MX{zJsP?xdVP9G1W(FGm}Dv7fFAwY zis?vyI#_fqmsPvIoX7@Mb=V*LqG!MgmRK*H49p%{TwIKR(hzgPfpg7QuYOJ=eIoWi zk;wA8lf(OBA|@sxv{ZnGg^A1rC_YU~O+OIo{+%9LTvSx_lDIBR$o+zJ{+)>Mq9gW- zicwL$L*s-(Mp&_B@e>B8<-YujfD$3u;-Z+8NIFf3I{YXgJ3JMYUQJT*bhn1w{!woi zGg!gwFpHYe=hIqJ1+e|~F**ljuI7_EtjxbKZ>fIbBB4+z?EewAg$(d5JW7J~`=?RVQ5 z003N>`jMAVz%v1}$j^9~(I(8N%-~Vj-U2*`tbff6!O$`nr|RRps#deIP&6-sT$2HF zwlxy5i_WlnYniE-rd;zUG=T3rG+ZY#UUR}Ej@2xav(6UChrJuTBp$-(!G|$Nw$GSq ziNg3wfhJ*D?tga{1s=dWnO(tHf#{rVT?M-mPEkeRXdj=ZF)>Ep+r??=pbf`z*7?J- z<=#S3gQa%MUs}}dW>6D6NgFi2`SgO1j2!Y4*nvgeWkI|c#Dy-6-|UzcpD|SSQI6pk z75T{7)YA4v^N!%+C$)>IbrTCN;`?G`c!AQ9Pvdi5_E701@60R>YQk7rEz%596ks`3 zoK|j%|IP5Vh~N1X#dFQ!(~?iB85$sx-18bmRitbU0np|aJ1>4Qd)ENu;FmhOJO-aY z|J+f48n${2UQa4jL+^__fl)l`{uNuDvmxtCM!qx%fCwN5>zQv!*=@ui#bRP+j-S`N zdMglTqpIsf*Ci3}iiTQZmx;Sm*HqQ#Wu-mY8$_Gh{&jt7a8g44@u5;4JZ7A1BUPXCa!2@59`6j%g>IM9rTLIxeoSQpp%kuLF zaMXAkkGNkA-+XxdQ9rIRzrbJ3*xsyTb8y5QEqu%j&)z&tok{81hwJeg2*$}U~Yb`;u&nK}O{OuHm;b8?L$XaE} z;sMw#R8LhbqVC4OMWS(>BMc=0I{lKbq6g4aO1PiOF%$`PLT)KX!f^48*G^-Yjx%`F z{z<#p*>5^uV=)@Xb*L6okl)_gySS48>3@>gc< z=P`tM8(ZEqB{mNS_GAo!e16N~cW7FYKdL^cCg7C%DgnzYWhafz9;ZzZyO}X;aIb@{ zy&FGLlg6M*{4~+LczJC6M)UDbt&r}e^(ZiVVxB86O}@x{=X1Tq+y|=<-SH$0nxzZB ze+tvW+0X1-x&VtaEa}Braqp!?UAo&l4CEJpbmhq%FV*PmZa=W zMSO!kHu+*=!oszO>%9g9KjC}YcCo48zBY7VXepJRK+u0E@xl<-so~AE+PSpXo2^1 zA09JVq_y@NL-4FeoIS#)g?N36lp0qW1ToK&r6?=eaF7EuwrnC>yo%j_5canKu33OjOn9V>@l%`R-pZjDSNP6ks`d2YRZaP%=OF-a9bLPv5=D z7v1v|hi4!tlaf~{RJaJ`t$c^iE)oE+P+In`#N$_t-=iE)8`X_u-TB^RJ1WAkTmdHn zYO{;qbnB5!JA$NUc?zDfrbRvLlXX?wmdD7ji?HFJrR^ z;TkUq;4NBgkab0`es-Fhy{u11q88U-?ts=<@z0Run5?1twKkaw3&xq4&IfP~f;MJV zu~bE~9_02wx~D_jOQUjX+vjN~>&|7N*;Ap>-0%RX<@~2vv(mGzDM4;8Ys`xj+GdCvx z!teuXxny)3TRkSwt3&zN|P;Iow2br zXA2Pa0K-?C{CuBC%2fTI^e1}Ci1@2*>MsDoV5YAdm(xg>-SwuXdcOna+}wg6RhHTO zoT*vtj~bGPUd5TbXYv^(!_}w|mQZX>d3mm+RQn2mPdDh5*e93Yy8dRkzWU7XXEuNvrp3si{LR%v+Re!{vWX$4N-a(*`Cv zDN!Ua0^sqD?$!VrM;H`@O{*{I?CWv4aQ_KfpP^9crmrM=VBI5vl0yip=}cl3R4c z>q^W2I5?IPD@I^x91@JS6yC|R4%TKC7y!%#pY}YA@Fj@P zgg-=ge8$`eZF05@n!UF8I?Ebn!ij_-IGv|+IVV{)H4JZx9BN@ZxxR<_DLQ>eK>Ui- z`4=K%*_cfXprl-B!4z6!{Jri$m6q6fd1>!E8PY(~zQ~9(Yq7mUHuvJddknIcVm@tY zPlVh+0NqI$DhDyZ-+~l1L;SaLRq~>gE5T^gU2KSe-<3s?k7sqq9G&%%c!F3*a{_$s zqfoLkm|($;!}Upw}{ZO z4Z#eE*Sx`c#Bw;J>15g=S@+AoUd?$l1f3Sn8wF(@6=#EF+v?AA-T}e- z*$VP(>_q@VBS%M1(Wj}#5ZcN9c_aUa`M{7uq60T)_u^mOWulU1Ml-*=`0VRO<2s9Z zt}%p&!?rYBYVztwQo+88^o%S+YcN_9i-#F^V880`ExqlI>JJkfcPB#{%t@cyU)B_R zG9UyPv;n(!cfmx~v9Y^v`*tN0_j{?4FN3g-G7_0h`E!t&hkK-GGA7|j)mnoN~(PF?~?JI|e__lwyk!7ALH-mX~ zos~m&rPdXtdoBd4sz)qA-xr9JYjuZ7%}fo5Lf1~LA*t%@^1icl*_>{Ra+=TfYeQ$# z(hZ#9akC~47-+wh4dX63{8SHc@qc zei@q#W)v>6m>(A|gpC~GhDTseeEVp{#f}|A*BvQC+2;k|gHR#MqmTwhwF9~lK8n!? zoCuY5zkO+ek#V1`!4%r^@taN5&?74GalPWJDdisAG$BAu|I1_NAcEk@jatGmJ#iZq z@xH2zA3<(_BxRbuM2R0iBt|BKIB}tob>7h@+RFothyhs_Qwb|9UZkLVJ zn|;f18WmbJCOm^ADcLhTroG1In3@le2k-yhmIGsD$#A{#FRK1Lktcf~1C;6HALhb3I+b(nW&`^o*N2 z37F715pVs(EBuu{HF+&+3;cn=z_F9l-}9%qEw}Qqx2Tg|z~$P`JT7-Az^vs-&RQYK zZc>!!+hfUa>(o}%*kZ1^nAhKeQP&DIWmOS#;D*UD+NDNIl(iaC)bnKuPJP^}fwJv12pQOY!{ZyO^O z*bcAQpxjAK`h`C5K|Q*tbvHbKGFXMIK1`{#_4V{_lr_uHo}Clb4spg%A1v*VBq9>a zV*3O&kW;)Q1>}%AM>>)1I@3W%4TtmHEVd}&Q_1A9hIG(bO{EVzInf3F(}{cEqV6&m zeEIkrhsy;&UxpB&FmyO})u*nBb(`gU2I3PSbnli>zJeCnWMV>puL?rq`$se#IpWI*^X)rfeMg0V51pAdi$1~5_Ddzv66J= z{A}u9HqG)o`73C*uk72=LbxkEH2|;+ZvmEyAJ>l!K*}vYoo3?xvXEV5HeDr8aPK#Jfb~`SOCehyY ztF_%+%g`ncQ_%Y6(U{;^sj{S0vuU|(Sdy0a8gpk=o89rCNiD25KdLwY2R#1=Xhx(v zjB%4LDCh1)(QEA;Dy%`f=OD=UhR}*DNytcBP)fjWq8o?q3-6z`(9W|aW=q^RLp`Am zA2z?19%X#5Jk=C3#`I9VDTyd6E&k&muC=MmxrH@sJ*5id22Ep43_tN1^cpdB2ThD%o^>Z;@QLGh8k)Qln_f#-e)x&eZ%3O3_*7YWc@Cd@J3c ze%({eVCW-?+>O7geK89>8+#_2f+Rbx!?qkblwkeUi<`Y+RXBrV`bY3nNO#wAw5Qe|fesxQg=s`GSh zhY3~o0}OX${!*X^f{F0Pz{Q*HHL`Okys`Y$dsVWTj!AK!TcG1A$ce-C>{9m70kORH z^BiH@YNe1v+;PS=xlfk0ewjdx(SZJ_e^`9UmzKe)A5WoGRjIw7w5QS#Wh*{r=%L^B zw_Kh^2$K$$c_+djujKoB=9!c##{rR52fOjb{cw8qZh6c%l`QNfjVbS;f6YNs$Lb~` z3t@64N#PE338Q)Rw)He#jy&GRs2y&UV0c)NJ%+H`lf^4*LX^LB?me8JS_#!SptF3x zOd<`ND9&D~kKjE0%duFf6F##M7T0x2+y_ih2!ZmeMCWSv2DPobEnJwN!p54Vl+L-M zlZTEX0-tfN(F>@;`Ul*i#r*IfaFr z$gXBvM}s6EbGDrWVm)oXQ#?`eI!NUg{( zH?8kld(sX5ht9j&R@Wtpv?YRffFpqOdJg0#cT+e2=KsiqtqQ`CB0Y@T5Byk7Y>%{? zjy%-=rvSX27}Yko_W?hBbEY`tp;xsHwHfUh!Rxy8NyH%5Q!;OYUH@Ntt^s1jRhz2p zzf|}aGi*ZnO9f66z4!~esb5_SLBHQMr7@3;xVH)c?UqMwhJH4dbx-glQ{13sJTU)* z#F3EmQF)fts{KVJqGg&i@QEAr{`rq%5q<~a9-oGG=g{>&e#bdx-*a!h_olrpj_Zo% zkNE|G$-_ePY)h5vT+f zOyH%|gl4AH1FvWH+4MqAajpbcm1p4L?6fcSzDghk4YC4tbK8@!P!H+iS}fs`Y$NIXw6qjZXFyF+fIe*c$;o0(w3m>xZB>axI}iciaO zX^r8CDk@lW_2e0*K~q!v2n2h`TI?`ivK2km%Y?S-#?HNS zs;h!%(Zm$KrD!Lh7pyA=a+LN|W!ZZ6NACL{c!#^gi*X3QAkFX~?MqwO;f1qhBJ0Ak zn1CvRM7X+)`+WEP{h>eig&WXe=JVH;p}m$uY!%%v3;t1!u5gS}q^I=1bw~Am2T- z8~B>&6gDZ3`7ISLXa$GQX?`&H5UJWm`SuM94pp$2_`!4OfR-w2nzE#xIUSX>HQCuz zjl_Ef;$@Lqv&c%97;+{<;>^kLyYIb+EvfQ%P+i(rcMS$~B{@m79i8 zctLNZV!PX+D1{6E4x!EHS=G$hIsj*N!Rltj*PQ?@oSXN9(kYPu)E>#UUU&9v6Iv7! zA>nWRaC#I&kd?2eqL^JZoJhhPKK>s0>$okh_nhYrbz5w&G1`!F54rH`Uo{=bH8d{l{du`_Ccm=C=X`0wfxUY5_5m`R?K^G1`%q6`ZJ zq?T8W8;LuM0DE_Y<1euhi|sJ)9;DHv6B3Hns<@b>2abr5c<}}s?TXT3Legbp%S{zquVm+5LS4cN3f0Pu6`8H6Pm_{sfSgQz?qJ&B&bGXWsL>)-+8wI_xc_uOpR zbvK=Jcc$N-xun+$E(4!zWtV}Dnog+PdY)`x6TV>l2WxC?>ea1PLty)vTbjTrpoZ^FXhM$JNGS>Y>1D zg3?ZyUDW29@?0X=!0_h){^_FY9pM>#NktqXGCIR!g)_ugq?1t`+30dF#wX`|r27$f zMABThc;sTtpw&&SZY50kg&&o7LTND4U=Agku?@)ivy60Jm$+Yp_@3?`g5^Jz?#vpuBZt#_5gSeXlnRANTIf@SxRVWS^!e9;^(T9xnE7!_{5Y6YbX)XWKoFx@p1sk z!DbHI`2QhWhu~zZmCZN(jwk(5;|;VG0@JhPKb%!wx$mDVEO=Gi#i-3Egk90aB|bst20$$jjBY>LQ8{HRKNrLV45DT(%V-94%z zz0Vy^_g_E68@lsd^cy;VRR+qNxQxCeI)!JXjl z65QS0A-Dz$1a}GU5Zv7Y1PJaP+}$BSfLmF6pZC^1KkwDo1ZLG7v#8NWAFZ|CTWF|4 zBQFzOWx-#fwNnzNzJJasKK@R1Ggv>dzJ7abnuqMq-Q)jg0owgS;eej=8lT1DnVEX1 zMzpY!X~SJG`4V2@5agRH--im9ldMf^;^ZpD|C*geQuX%T={WYW4<-aE2dbQ0RvLlB z^0EoS|JLoQSp_=K;bSk{#m2tp`cg+lun%K%)v4TsVE!F@bL4p zPKpnl9D3w?=?+j^3knGE*%iw&ChD3My092{`#QUqsbUM}_;nNG+x{=11OQTDyc~0e zZ_$rq760Cc0n#Lz@;1p5OH1mf+e?v^pYtiadwlWE8KlS8!p|2VV}9dQqTB-s{FJ?! zj^nG>|E%a%RP_{-94b!?t2Giq3AY)87tI*2}HcS)KVYicpmZjzyl|~2baavBz!HV_H>auJ;8jq z>vw)mhKJd+*yn^uf7ABuoX0iBY2T;Xh$j`?PqzM-(a=EWO}S?A{$X(J%f=V^^@X)Q z3RNKgm)BH3Qfl?-l;GntwT3@<_FU#-Wm@s_Nzw7I-XBJvm zyW2L@YonDlQH}pr=Vjz-(gFdBQjp0ehC0yS5@ApbH^MRCM5wg#J{>-GSWQ}cC|^(B zoLD7t<1u>f?#j7GHe*S9uE>F+4LAFeKP#Qo`tUIiBK0(F1*u<#C8F zJ(yK!<#DXFMnO0gkkS3ymx~e5qWtkgWZdp148pt4y9B=0ero^_by zK}#pu{qWmL0yVBJX6$r!Ul&q#+nfLl#}2cnQ{BjR_Qx;xlg%ZD2Oqnel|>hVx_%hU zY&XUpp3{>9=g$Loz2{7NjNZbpVP`$Wn(J*c5DBmIj!#RiOq2KabR_Z&;zBc<(0dkz1o#Aus2noh zkqLJ>Gz-_+jza@R*o|Y2h`q#mwdiD;uRlvsBEo!_{MxQTo&PVT1VOQR{n!UST!Q;S zSzc-j#b$cZU@;LyAZUGxmj=(9%F=SMQpM04CGwZ2vx!ZEcF)Oq=GXM}bnfhIbD;GB z^brsMk;kPWJEj;ht;8P_&V&J+eSdwD_5ddZD!ap5pRxa*%7Vu}48TOr#+ z;ssZ^Et=2>F)%=-SiQSOzawG*2@+s^ter*GktKOoZ~kg$Muw(4r+h5i9hH ze&xzq-jxhaWe$JanRpa0 zh3QwBki(byIwW4jkwVJ@`5osN#rZ8(clZhg0wDjn4;=ztvtl??@=7I`{RHu<#^MMN zrwfjNA#-jFvb#VY_=#-60Vn>cMs4^DrfwNz^eFVVG7Uqy0QL0fh`DMz@gp5ER0oz3wZre1XCQT=BN@oW0#w4w zY4=E?iylhrvH-6u@_Q|B|ErV4bylnH+pnc~8xyJ3dLvny#n0~P*}t=Urf(KW0zz74 zbEG$*C5&Kxdz14Ppx}AymXW$%Oy9jsW2|GZ#K8i zkQKvrDZA2Mo$5mlyD6gF_Ad9AFE4?gY!Tc%njFM#nz27`Xayvx(P}gR$~q+$6AaxJ zMWPt+##=5VvD81H-X=}=s>g9fjgM#RWfK?vyEtJgIrjS6!9z}4|3HM=(ttg=P#7L% z!qeB~BN=qcaI#SKaoln5hfDz%5F1Uj7xJw;Tp}&S^YnN;>4iOHDI*nJP&22gE_=$p zbI`izd=X^1f4#`b@w@U-d^reNvm_yl>tG?4>tUKvZB#dp6;$s;Qt3HFxo6#_z4>FL z@8xDGJg?O4tq+t;+w6Rn<}g3{wa*vy_Ab8yj9HEau^3vD{1Bu&AT``?lSB=26`lcBxU zv#)ifAKp;{;$;R^1E7vH4Zfs$-U;}7hX?uhO}%(ieS>pE)s?;;&x{;uwcfDR@1or^ z{N2xEVVfk)?P#gs|BK~rH%vujh4`UY+-+LKkSVK_%dZ%&lJr8TF(8Tt2>&J53!m)B z6KW_B0ktsr(gULcYlhBQ4K$E8r5Dj?yL0Q_a4bFIM+Mzsh)HQi_#nv`AY`=V7m{ED za_~VbNIgNh!nD`XItB_%tbmzj-FM@c?y??1C)G6;%|yVtL&X^q6hL&4Em%dh^hc}i z#{aWt1lZb%8)oG5RZ18ldY~C5nVyB5Na9C9x2_2jXN%=X=ZHVsc7ojV`>rsiSOHXt zwEbgIH5C6BneQ%N-0*{j_#=#G^z=5S+SpS6yU#TlIf&$GGl^)@LfB}FCl3fi(3A-$ zdGTQy&s@EXFv}P>ODVD4%wErft4?z+; z&e8WieA>hR$mh8+)xaOcy)4K31^;yX7cJGkfY3*U4mY>MS7wib+|`D7dE)#XSGA7QsLyF7(+Abp_}v*JeSIo_zY{7j9$nW&gSd*;stAPj3 zU-KJZaF=3naM@C49JYrH37eIUwn8`ALeo;(@@l=FXJAkr9sX)IPH34DYS<|zf32Qz z{#+GuwkgPW{E5qYFwt&WS5^d0fZMO@(;q-nIT!$3oMl>c8M|)mgAjAE-miYAnljVV z68gIM$0>*^;rno1R;oBOJJrsi-WBpEM76-M9|;`$d?-uugT5btI5pI0PP+v#UE2Ix zsp=nZNO90hG;F? z)Z$B_4+oGhkQ`2tK=7VB@Xd3n6)OnkIfn*n_qF{=2$y@OlwDF0^cGxjCiq_wVQ}{_ zG{&c$ECNJe3;+ZmK)N?vwlZTmQ!&`DiPeha>!b|Ak6&(XXGKSru+6Twku!vm6a6@Z z6@w@mXrjS`Iz$f7-?ZNV(+PA-xjsyIx5~-tjegAPSD87svx^5s=ky6)NQj{Asyi$%maIHs~@14LD&o>Hj$`oaV2n#8oE!CE5Qh^~?cAh2P z6QP7bBS#;m?O!TS4b|&XpTcn-N=#KjcFDt=!@)$`5;34itOaXD6nL02^RxJXDkfhi zl)Lzyt@cPjqTK_n1r~^tQAWJc*^Fi=Ja9n&zO@@d;p=DpXe2fD23S=Y1ZLQcUq(Xd@CJG8Fv{%zJuP%b30&QGdG+`Fjg>{cfy!GOg!=X8>H-!yx34 z9i*hhBF{mrGJs|xQhnd{DKAnbP}JtZID`h-<|5XUJZYfgouG)hUPNk56C${56?*&t zeI4Pb{0?~m(ks|Kn16a)PQfzM^=(&ydD|8~QY~ELl_(?IK7uO1dwz)(k=hVONI-X-tbHD!m7 z_493XmcUwyvIZie=kSgGR6G3m@deXPzp>f*{Y3lnvM-{oM`h4t5iP=7*Q2ijded{} zagdDM$|5`FHWm}Y+f2OqaPQ}*UK*^9b{k%&=p@(XeMD4usBLP z7@j6?XOgQ17HV=}N4Ds*w${3Wa>Oj5Ijb_hS}gj||6Lj}9i$H8YW-%lFez06*5M)~ zF3~Wabe{(X`t(W#Gm6mgu7j6bERF(TPjP0Zc601TvvAAb(|Ju;`$tWCO-RRCAVJY(F-tlANg)l_h9`h@VDZM%NH;S=m+oRl3`T0F89)E(fTq>DH5~5 z{Z{$wRejE%mRo8^WwcdCCDw~Bk1PL9ufwaNdPljJlLg$m{dsV6aE1R#syfsc5oKtVfOI;3>ZkDU|DYjWeaW-Ot9OrABBAQqUwj%W zz~TUx&(P`7W)nqFOPJ;^jxITU29>hFJ3*rp6>Pl*xrj0ObPb=zs*I&|Uhldn`l?fY zjB|(b=_296Z#C{IAA#>S6~uw=KGEZE1#>lJzup8Su(@glpElVLOTRgqOOR_JFU>2b z-*cK(cP$P;r=Q)^7{e)-`KO#83kaz1>ZPSS%{fr2JKAF^7&9=Og4=pl*ViA}d{|J2 z0Pt$lT}aCh6jJRCcycIj5UbzW2J5PwmKCks*E)$&?K#*gkAgM7u+4UzV$|0#($;5(xB4XW>C2CEe2DgnC4GM(|5L=ntowzI>+vVk zJypfm%ldUMUfFQ=)G?W>>*&HCXR`)hqnJLKB2z3E#0oNWy6!#fzp%c}LbUvTb`(T) zG7LUv3xbd(^?GD}QF{MJ^tTW5X9x-@QuZX$x59-|Mb-Y6dk^RP0EHAumG`46>P~mp zsTOIqtG40Y*x1WM`1dI(5+2B!?TemHb<&B@pz0p<)AQGw#w66r}v-Cge7-Dn-d?bQY=_a!6o|5lwiP4#s>z8zM-*==IRf;|=!VrYm)$v4nX*1q zSCwK2;Mg9V#k6%cs{4^K+a7rADt@dr)qlH*DRsAq`+BnVeW4ro%?lxsSIg01%Fz?V z#)ydJk(@IE`mHx9EiK6VBlL9$?quah=5}EH3qx(fAhsf8(+xV&F zh6aKBkEdG_ug@KS3dt4Rkpi5m!|o(RNtoS#f=tYA1lwuPW1yOM|86V;46*JPf<_w2cxV zQ`cy?TU3j4RB1BQ`^+b_^*vESx;2_v>Ce}WQ-MhY3aR4MiP?m zN{;cnFIObub3fT24+a@Ni-hzt$A~tIM>oRuU{~|pF8T!lFBoRQb$|A03*!0ciZzCF zeUsTG49C?3@rDRV0R_}Ufs5X?-&f!DpB@Mu9sW4p4H~|xdK@^-%`hDo+$W6CZ>D}5 zzhYey9K13W$aY%B&-Qm3B%G+evM_o?0?DP_1ph-^wE-#LbTQzE{%QUHv6i!h{GW zH#}FU^xNVpiJS7YRM!RWD$b#-;nR$eXW3bO6|)fO??KJ`U0TG0;K10B2bEMPxHoYu z`S#yb2Yg7h)@MSUDM<)S8_w_f4!9-2L{bk(2vg zuZPzE4jMkM(xI4RS`*=(As4Fo(6=xx5|`PLn2${Atn+*TZ>kRyQ6II+ZUXWjamQ!0 zWyGg@czq$xoLCRPg99m420D1ZfX(ZFH5x*W`B$SMJfeR!8e;vo>!-=T`*HUFyB}x7 z|79;4{BL_v*unq(L6h>#n~qJoW0D26JfozpdH_a&LOGudDlY-(TH4oh=aQJzz1Gow ztYcEPwv68swZgPp-Q1+_H+~V%>C!3WMk&5aQ&PWdwN!u zYV98hIddO(3x_&&TAqz>`Y7oa?HQRC1yfd}I@-s(7qwI4RP9Sv><%aO7qz7dCE!bf zQ+qLVhuizCTaEfD@G7TcPn;+b)cUNhhR zTstRhZPTOb$UzXj=j}lz5=jw=%0alm!H5+dWK;v_xi-Wh%@?C+H_6knPwtIc2GrZT zmYiV3^hB(mvJ*y2+9rC4jY~?coJfMBb2MNK>7*3l))E12CN*JC2BJqL&Int69@sc@ zX~qaZ(<{Zd{1nb3vHJ#3>;GH~M2!(frVhY@=en>fpJjy!#rGLX6PQgq?s4NCcEN7`?PYSCsJyH&n^LEVvE#NPvDph{f9t+I z|28nAA+_;8zM5Q^OgonhwUs6NmT-(+SCTs774BbNd-=*Ti&kNVF@zYC2Ot^RAML zatUqpz$vOTKL!{pq<~#0otc?2B`&($R50wqQVAq6RGSeH5Lz+BAw5dhLYIdG0>oE8 zc?&ug)@k|6aWATUU&V*keFbY`XQ=gIQ^KAzudF9IZeryXV{bLgp3i&-!pu^g;OPql z3Wg$7>#t{shr^nw{ZV_Rd>w?`Kr^mb4i=H-=0(3iBaF|%*c7e|Dp#X&Z(sK;;mXZa zD&^m$BlxD5*?LPAmnfq0O4n2mGN(h=8o|(GyyIfOi;|ldSBP~>?f@Uk;lQO7~H4_?i zdoxGr&r^6dd~I@d(WGk)ofZ1Mf31Dn!Y`ElqgdyTus_q*vRgekkx>aQv`v~dwXcrd zDwOzbXPVLN*bgh_=wx(AoIzWS+BS2xucRMkxjz+$-}F{=FD-ErF#cklo((ElvjgXV z{mhWO@>ZWiNqznAQC=XR*Qj*Xc4u1NJ$jh)+VtCtA#EjVxau+ z1dKR%qh)&DBh#nWL&Kv18{{Pg5tzhpvLej2k~PY;PJd4(Bdk9-r+%pQx(JZ$ydB>w z6~FxUetE#s&O18DT;2PNd|LD%Hz3Ujhk+j@$56Izq@+tR)(X*kn^=*&W7AU{6qq#7B|jKN}e+&-VnIyo}NK? zxOC3gxVxXRw08QiqhDa9cr9jpF~I`o>vn_AO3M4gC7kj(8#iwammpoM_gvABo$~JG zOLkQg6KPlFNG_w}3a>Iol910r4Wny^tB}v zVGTK@lfqqnLuDha58#(|ELFIwEov#B9Lc)j!xBT265+Z6qv`e*gwXP4jhy2&Vb@KpHrsr z)*Bm=i%swzSydcHXx`it-~s7^Bdk}mT8WL5&kET2@rb`uV%v$1>`O~Z&3MPA^aoQE zC3#A9`XDD=qu$9-ikH9^ldBbx>+!2L*lqRQTGY=iogiT8sxc8Upx9eClN+sA~`+KIRUE~PVd0O=GBZbr9qoH+6 zvYYSQ+7Jo&iB~a*)59?bOD~6pKH2-aR!k~dju7bKP%5i&w#Y?nNr)wJYTDC|SP@ma z9f=C;yz9!-vIe&lTU(4%Li5HZU+8)I#T3ZQE(lawZ)D%{$9hg++=85U*F+fIX=&+$vBfN9~B%*nh^^G zAdD3XoBBayHfDZIwz0VxLo*F}^NtPs;F77FuNW8C(nq$Si{#RWZ7LI8zSlt}Fewu+ zCxfswUUuYZe{XNk;_)`5u#|y#yFN1V`rVrgpAJxBqW66}8eR|bvvYA=c!mx_K)zcj zQmgKORiBY#ktja`J8tZdE;a7{Akpmkc&evK*=l`-6>*MXCTT-qs1MaVTYPb9Z`u51 zE1TsWtnIaCuO4re6H3g4ocqt-K2>^vOe>Y}$J>w|FwSvry+<1^9ArNtLAP(5Aj`m*odjwi)BG=F&G(>{!JPx+Z%#U$U6 zM*E|U`^PHT4DM!c>qXtov-!FEx;v$ve7`1K7mO_ial>15(_) zY(|6~ujKn64n{?#pK{1@p5v6R`a5MU&+?B!c^y!R$_iFp=wi&jAWyBZ)ZwG zedHkkFV&Eg(tvnbC56D<2t zhC=wEvFw{orkX974(Q`|&yX2)GHDb}3N6*>Y#5`4 zH(%(m`J3-0h{->oktaY0G9TF|>%c$>t6_7Z$Pe%Uf^BHb6e7moRy+~VklbzQA@bd* zQnjzxZz<*dB;eiv0L2kOMkqx7`#I|eX&Mn@N;GL}0zGdS2o;mE8K;rskqqIo^7lxsznaj;;E{JY6uUWCte5*^fjH#mlg%LJ%2 zT`jRC1L3r!CpBAHKM^~TOQR<76d~}U%bTaTj_e6!RlT%L6{{K7VTxH}JI!g4fUES{ zAxZTYOJvoS6Lbwk-w3#$7BqeD%kzfu3ASl3(im8ro1CP1#1a-L9zwo>XcCB-=-z56 zXz19h$c|Sz-dTdSg(#JkBkuRE6}7rzcz|29*dPX=FV8cB5p!K!c+TFK#a;twHg=^~ zMK$>(Vn0)(gnVX$_Eh25-2sKn++-Ez9N?;iwm?qV>BcXt#yRn?1XH}He&2eW~q}=+<x zAG8P~xxPw#ops0UXPsZ+bnB{i=4484JWF_nMw7GQGBic?q}JuO?KKbw1*B_TJScqG z<_C(Fh*XnxBe~E-DdI@=R#Vkg+7*MGo<6W?8zq&a)aW6y_e1GT6&&5+l3qWB{)snx zi;2zKMu{-(*9BeJm$rR1d!>?JRe0c~5EeDIk87+IYEdWrc5HY2A@goiR3Nv)`xKg@ zLZ^v?n|$>Gp(r2w1N^S)lHIS35;Mwc&gdw*Q)Ytcqh1 z;4=)W%qocnC`$2^sYPpemqUs?I2O$gxPTYbzyR^Q2)m119Y ziCoqFr05mH9F<>EFN_5(O!v;$`?k;St(qhiO!_7Sm_Lo3$WFAwOKu1(<_x@V(O@$a_&BmW1BIP7L^l#X3<;3PFQg2t4E%oM1aN(H> z)R){uP1Zu!MSkNQD4|tyC@m4tV_U2=2jFF;HCPb(b;22I*IYK=KT1B=`0(m1yyc&5 zaMbcMt?oj%qT8{)dLwoFoS*E$!AO`2%R(oqvdrscGt!EZ=l>pXi*7RO4 zGOT*V9^>X3ZcsN%Jxzoj>vLgl~8Kd@@#X zDLaQVA&hq3Z)_8VFe)BlpUCdK*73la_=VeJhqKVZj#sBJrf!LN!F)jL;&y08?PQ3@ z(Bx2H;&gcK6lOjS_^;<7i%v!;Qudn?8hr!>@$j`e_mL5rWQxuP^J8CLZsN^=Vo_D} z$@E!hKxI>jJ$b!D7%1$Qnsu?H4njcmwHwY+`YMAhtOiRQt^ln`GbwJBk49Hes^-$O z3k_V3uhb?xtt9E&_^|SYf`TJfM+ea~f9*^Do|ULL9gzb^5wnL`cLM=Km5~f67CcMqf+rfS#00e!X z#uY_m8CzCL@H7p}Qzjd&XonfglKkmmY>9tVe%R0y&9e#`k($RXCW!nU z;nQOjUZyfAP8~$gKdEL#Co{L3uglw7)4V#!^T>;Q;%ydEFN>y}Mz^@Qs1{YCXSO_1 z%4m)VWze>2_biCKe1Jh>a40ffeAK z^pj)w&kXZ({K=cZutjtF+9wM5=A4RRm429#J|ciLD}9*jyRcScRIHRL@LdA37Nvfy zeKf6OH5n2B3XH7YcNvFkFd>QOX`q7;hJ3&C!zuBy499*>j1y3LG3($ArXfs>dNZ(OMQiy^`n56{W<6s8DiL(v*?+TmgB@VUAyy4lBa zW<3DNO@hm9y+!H+^Yb6FdO!c>A$@;YRaZ7+l+{(`=H{j{)E#q_=c-$Dk9>P4>*e;c zXfm(~)bRp35cjjuHGj=hkY2!GZnfMLOpaN*7iLn&A*AQ9EA=HxRKpt7un+6rl!zF7 z${#F-1oGW(7rgix)%$qDD`w|cD@_4m<3o1|pXJj}q4BiI)AFe@f{Ejk#5u{*AYfUw zgbaLtNICMNIZYENvIJpGd&6-E0GUe-MV21cvW?@jkkHgFUj{@RarF^*Yuh~ZM!OaJV?#{=%Dt*$+%dLH_;zaCw|1w#_Q3J3W}PrOaVj? zD{P#u@KKbtymd_V&(g~>#lZnrSJmK)lOYU`F3n_jbuj?a$>wg)tD)qPSTMnq1e%To zgEJ}unNUlYM`s38Xul8CSh7NlHQhetNp!h`5F?q&^y19dGwbr~ar>WQk_*eWE4x3x@xF6sXxl<{J_^0E4@n;>eoy-lx_~YRldz;$ z*V)E$UVWBM%*x_}pz)1dd4qfg6O+202S{6mq7e zZn{JG!u%Eb^1pKhLfE`aT`}to6|zLJVn1f4AR)5kO$ugmzXEH3+)l&7Oybb)#MLb| zd%*B?uHoJMS3eAmbs;9+{ckllcf}oRk7e0J(q=YU1^TGDb&VP=Ag0Hf5>FdjUeqhJ z%7fBwO?j69=J2Zj7ZItZ5KFB<)c(IOQh)_*URJrYjj@(0Crx%v>Vneu`+n} zgPz@iQ|#;uZJQNT zSJ!)UBVmBqd5*zv>2mayWeM~XS$Itfb^V2KGce<3S5DEiDoo2tsL}OpX>Hr*2Y{P7 zaBHKj=f+$v9gbu+a%V6P(Y|{*NUDj~<-A!k)I42#{^>T{bTEe4H3_tU=p=0kq1v|_ z8x8x7c@tT{T0O&fnB{BXSpI-6%Ed!)%PTO+w^V!I^mezpI*X1l``0bhhbayxdD*}! z_h`RL7lT5Q~(DBq<%o$;QVcRuW8w7uC1&d}j`CKzxr1io{WqmpcAuqg!Wm zOW`iT|6C8e=p-D>zdR}?U;6&S=l}K6!2bWBuKxSJZ~uQeG9ums`2SdVxc2=9DcG)8 zxaY}LkIq*(iG}6B*`n3b>}HdyYyQE%!S(M*^a<=kp|fYSW{#1# zGB^PLFma?bzeE#Td48Plm4i?yADo8!!S!@gdp$cUEQpHzVJ zGMxIhazrG5a#p@zi4n2+&VJ9^|0uU0aPsyGs>kw}g>53&=&A14n>k#a^p{-oEyLz! zv>R%}kKEaIJlBt1#3#d3(izw*Az-KTk>lu?*f$*7(UJwNpXeZjHA9ao|I%f*;_D0a zn`hp%?U#@De1sVUIZs0l!QQV5YsZxtf&VapRgk3k**_NtaBy*{bEe`1o|FE8U!Cz=kDs99XVe>o|1)4VYKNQiKO9pvb?Q~5wFTpRGTYkiM&c+ZTizx-dr zKa|}Y0eMExqw6dK4>IMS;)0yZOJ-bz(E})@8)9PvZt_SHj?^&0FdO*=Ss~Kw*yUzH zwM7X2mYs8U>;%ykJ}zBWm<0;k8h3$sFuC-fnrFaYSIV!UG?MYAldjZrp-M!oqajg) zG@h}ZXYP^>JHgoac&R8xzC*pRUcbr3Cn}NLaiHKlhlkBTO02|#d-66IwGlsh0BjKF zYh5^IcZ>5r4YfJ#G~=uSL-kg&V6J|K`+Tk;f}PW7T~8!S6(Ki%e2n9*za*t()M>{mmMp{TOr4FpB(IVltl#C}_5Tw1qz$*V4C1Ll*K>>#Ar zq(E}Z>E#WXjvfj5J8a^##I3I$2gAL&rE@v$lR$kc#bmN_pi#)jx3QMtr`!V7+s~(r zXU1b@Us9}mCPrs^8P#T0&&}!POj^l&EABZEKwBd^^Ur7NBv8&LE~ctEE7g-tTLnEW zYP9kU;yjVYgXleK-*E$M{g6c2Cq_qee(sY-qs)0^Hz$<`e0yB575$-lzFF?Z5U_a4 z6~BNSvrr1S^IqQx?|#i}#@JH7WAw{O&` zynWE7W8zo(D#XFJBKhv2;4;tR`l!Qx*wE1dDYBou`>xiSH%tGlL8nr~r{q8rTpFd{ z>PVK)bjCpf(sFYdEAv!!AdzpY`xUP3y-{-$isy2Arbd0Iy-kRyF=K9{J#AvPeJyzQ z{-fC^ssrmff@n#feFa+x=mP8!$DJBZFWB_?eL1VbnIobLRCc~fi~6N5(sI7mxQS}3 zQ^#3actBabO|Hh3vpxkd$3Vaor=aPKEfz!hG@sqD9sdA?unkX~61R;TgK3s_$fl5VWXJSoPYJb{fjg4GRGi4L;YZ+lMW$u8T4rYXf7~Df79>e;$`ZbZ}zX=J6C(8X8w1>AxPC-T~DSno-6}u zvpQHq!tvS{kWB0+mV`EQ)3>o23$9uj9kOY?_Kim6UlG~0GZql}SdSWT?9-62*;sdx z-n;2@&J8G9+l}HX=Nx=v;GGruT4`xuGHYGs;lVk_cj|7rqIP-X9G_p<3Vpf?-*Yqon_}aG0HMd9`K-Ub~ks+1c{6LZ_XBnshu1bx7J`dxs7{e=VwldqMy0_L~s8P z)nH(-X~`wunx>jvw;Lja_A-YGkvz5;iUm_1<}8#ULG zUH>0OMT$_UdAUsYv$fajuV26P;y*|NT4`4>dB(mU!S{3w7K0)+wOuL+1|==$ zOn9bCf(%Ylan5Xx+ZefVApUNl4GNO*3~LNcGFleF*9fKL2&YTA+O;k{`OOx+Jy%2UgEg#< zojl!ZpHh7e7EFy9Yq#eON%h!wRSfRSZ&+SB?92lHwJ#I{Qr3@d|=reS_ zj4=D1PPFrO|LG0UKW~kJE68O%xGAFOn%RIL#pfGaA#f$s=$<^N8B`=Ty^c&|(q>PK zjdUviMpI9d5O@%3F_*t;JEb`Q-sqYW-TUF5DEaw84VOTQH3-YwHrKT ztfdITHhJ}I!ZuQSAP;IgB))L5Cr^?T2|IBmQ<<=|vU?jr{IIC%|NEiD^$Wy?!S+6Z z;OmVg%01d)wZKalG}H6Oi3H$%*`K-|+86ujO6zSsa|pALUG+RkE79}bLYD_R*;Aj$ zJ=eHF+dk{DrJxss%Uy;c!He?dRo9@76gzREi%YP&bK2o7I9W#Pn@q}oeTFyG1FWbN zh)M>ish=7z|Cnp;fPy{QR%g&DGV}O4hnBD7nYq=!-ScE_u(X2kv`!}~g`O-(bk z+n*d{(C*@<@NOuPjT>P*ZAxyd5kb2q5$W)?Tyuy3=cy>Ua*FWqE?O(Rw2YI|+&>1E z#_;9wZ0|YfRZH`RV{8!@WvfS)%GBXUfs7X#!E%Z*yCK1Ia*OhS~* zGsBjl9HA>}h-=2sZk6Z*;xH1!!(os-L`-=4G-4Q-VpcfUe0RFVupVVr=Y22)Pp&07 zDw!A|fMHc5X(}9KSaSTh1R`u^y?l4qEPftt!RceAeqZ}+^6QGA9u>h1*)RF&F+&dz zwY*dZmnU1aHW?;JKvb8H@70Y_YB;Pf<`$Q1(gft&gd1lTyr_@D@I~yTjG|V~w0L?E zs^k#E)$-F|&pce*9DUL>Oppqx@zRwE+^fTa&$|rSn06+BhiLmK%F@VBsJX}>;lQ?b zPZ2hUud-z|IiNU?m$fD!_~J%*D7FjRXFA9!cO!N;SELEV2)^_Sc{~s02)LcA!zli} z|5ZwCHl3jZL6_vUMYZ9ZTCF36WQ6`C5f{t6i4j178+VdKY@_i7S#3v0WL|Jmw_}h_ z+Yx6p&Q!9pqSE}LzVA)|jXkkn3GAShLTgM3_42B%Z8ycBJvJg>)X0hA;r_v{H)9}} zHNTpT2EL|^AkkM9b2P-a?}J#gEyqh#*IZHb&8!A~`AYEBfCdy&94{ZS=4>mSI&@g? z#-y05+o8I5TaOjH#+>UIhHAMOj89vK0grR{xRUlu7&7>UY~H6M@1lNyC`8rp(}PSk z@I7?%X2t46{z6*$=fK8+w9)^i9;f7(Z4h8$GW==g&rdqm(|K2NTt=Vc-L_}&Q(~W) zXjB$Pyd6_q!$AcTkkqGQc3;9iE7F5;UUw9R8ErCHb3hy_-QkI{GSFD1oKld~l1<7s5ekTK&M@gE-MmTPz^JyL!@3GavslnoMNrkElLd_2+yjx= z=YDSiK#|{diEDnKIa|_Cq(O4$!{Tmq4aSv0l)5DbO60slZgoCa2DC}t*_lfLSn?s} zANsOR3JpKBRW+qdJljT=Qr`}i^Lpn@MWT`x_KJ1Y7U4-jSaBkmhjaDr< z2E_<@;)BTVc7;Jz6^NsVwLjmC@Qvt$EZ(w&15`kzvYNqb#X3?g=t9k1y8lW|vs->h zN3R-ddd{%796hW5vqIoD_W?y^`G-E9b6VK6jzhf08=_PB(`0z>2rW8hfI*xU`LCnP z4x-S}IK-EADIeQ;q6lYVRBTYlr)c)Bry`koRB;+}z5^!TaHMA8-Qj-ijg>7vcAEfs zS9hyg|NB!on#RNNwR^U6D>&^xI&se9#!JaH7G?geJE{KJ<-HmCtjQ={{m_p_E3%X& zlOOd3$nJkD)o|(s(PneMq6ImifI6VkW+2DgegaG}j&vVEpO+wgpPaU}&}mA8_6(&d zeH$p4u&J>+Zbbzdl+M|*i1PHXK$nbg@BS(sxGgzAIFcKH!qrEp+=T8#-|s|6!~1pA!e9cmhI_1Bzn0DFNh>JeBou^c02)j zTV|`gJl8~Zv)+vMzbS-T)P`CI*yAIM&#Eeed%kH2D1H(MjE%1U<%Lox8;%8fzBN5K z(c#S9BvtoHu(BM=Gs9J5NpS0HLzvGcF;$lOy}i&yP?b4Hh~An#5vRwqBKbo~!mrzh zwc}1AW~W@Pj9tDAP&47K?O8N!ou&V-#halKI8UUi$Mo zchT_>NUfhNRM^?r?m-4H7o{5gtbx?QNce5K-yJN9(XpUMGT}PL?(T43W>_s%nJli& z#0}oqG~O8f3BATW-{|-01{cZO6AEoWVJxTkn11(%$W0Z(KW;3s$kZ56$I*s zs)9UWs>EVxekKPOc<`$v&05FJ9Q2dLk>AfOQl{drr(gKpA&N){)$?dVY>OG5V@P6T zf9;;yStv`<5VbG)Sg(jrkwVZcpeWsxsa^W8Do$6p$nQ$E#Nv#-JR$!+U}JlRnqW7b zCg!(slv4ftLvg%qp`%+Kx%A6ADY_JlA;RW`+*7jp(NltK&O)14vlZD!0KH=MzCyMO zBo;YPNPZQnW~lZiVRB|bEuC-JuF;i?rA=YSM(2xK@aYz~`1y65ZM>@;ViT~P3m*%! z=nHb_BA7Din}Im(CC%>oc!hFm6Ai)T}6Dind(*?7*@i9j6Swc2%lt%$Vy@wJw# zWMOW(ZahxNJJ4z_+|mfeHnJcn5=UwCCi6T}hKZ)xj5-B1SGf!Wl%HH^+|*glRc5Xl z&yO#rnatM{*w2mQalDj#`T`ZmwK6GH``=4UJi!M^b;jXdWR#EQevQ3HR<~I^>xq|Q zVbm4!-x_ONNPCi7`X_!@>b3ai*t^FwRwzjBnSWKoErVC?_`u|lQ)!Lc^d`f?LHd$- z+z|GSMu-t6iGsdtXZOd9s8AYKpnDs#ScI!xt~2as%_qZ;f7n2$6CJAF;aNr;WN8>h zOpfvM1-=#RVb~r5M}oqv1ghA_*UY`sv!(Q|b{!v8>{SXL)CgkEf0pd=>lkUb#OHh~ ziqoN7TK`8d-tZD3NIeZL>7}_31FikvG~N zp13_Eta2*nR5j89#9mZ6F&c0++fdE$XF72lXpsfX0Ip*B=7sm!G@BTZA&ncqzI6WJ zUA`_J7`5WJ4B>}8H0VPg9#gVlE)6XK<{pA$Y8Js(URS5a%UZ!)F7C{zQYC7WGE@n< z-wZyTGe&9;A?JyLZx_}d2AoTN89VxScM^gNV!Dx4C_t)1pQG864F6g3teZ&s+lS*~ z>(23I{Arje`MkZAM|P^HELZma=bjoUa2j7jG(U1&!t}3<&$54mI%%EgUbo*}^!SFt zl7^qiWDv(V_^FiLJ5Ip|iM`?+?&nuR~30u5n=`KJQ;&2ttlEX{+{cv{fu;L>KQp=DF`8sOU^ z?EM087vNp0cR^^XD!NteMInaA}?ve`7or@4;$7}>4HUOsP5>l`3h^pKSkZz*Rhc-e}6fcAdb%AMRzN=tiv%FZi{ zn{Rke{?;kwq|3_cjYYZ|Sk%2iS9JqRE7AYWvh!%y-32poXw?SI5{x|(OPebNlnfFt zxV!q3N~f>9f%-eV{VRd!JwSr&!^MTt*pNpS=7=wDxeL5ZjxUKVquarv6eRt1WM8C~ zqn=W_m4NHvhox3VziIy(FSy3Y_G&BWe-|8gY1jWZ&F@O#SNUk+yLl3lOyZSqrgFjl z^ExKivRZx!&j$BCO4~XfOsS3ix+W+txNCBw5X+4k|N1LK*Kb2@4VT>hUSO@Fh98Tj zHm1!Ys0g-)lc~(kST!$Ao5!)RF-j|bbNpPNJi)J2+qBf=eelFc;gNRH9D*(NQK(Mn z@PeWCU0lDM-Kztg)P`446_$0OLRaphLm!j+c(_zs4Ors$=EUT{1|M>{-7bj&K!Tvt zR9Ew&hTVeXqA_zW$C{jdI^cd$iUx=-PeTiecxJXLO9o{(w;1oSWPhkM)cL(b2fbcW z=3%RNk+G*?KALrXd1ZzqR?1d(aKdqoB?K@bz0-@kXTQ|(cf{OVn_D!6p8TF0r21dQ z^tr@6Sy>Y$ljfodZvjSdx`6lj4sxE&QC*WTE?5N6-;a-=%1KNqqxpQx9hi*bujg7T z3OY!eTk`B3?7)=$L!|e!6!U+varN1@BlkomcDH)mJZAK`CvRZ277Vb#B^MJ>jt2`f z_#IJTc&yMp{o@oa=i`>vW@zLrCA%mZXS;W3j?0AMM~!yg>jD)u!{|r zs*v?Q>NQo=SQuYqT5f!MA9E~|QZ%!hl$7S`EDJycy(nw)yo;JTb=Peh!nI@jg5K;D z269)9cyu)zg)zrKhb*?XHs-2^_EJW4!c^@Y%h{cP_$)W@2(Yz2O;nlHOo&Y7>1F0& zfYrj_*L~L#>$`OlAS8Nb(zxhZbC`pU0eYuVB3N^|zC|lARcMBCqv0n+hSiQH{R@JS zj$J_qL8d2tyl(IINOtr=fn7Hu=L6{ZG<{9RUzev}>^g%-f`+;I=K+;^23%z8P@4^A zp6;7>wT6+|D_Ouw6oFgBYvinH)IL z&>(j#=jtqK%ehbU!|+EYITt-mA%))SszhYmF}(8d4=m?i-F(z z+)op9l9zz$X&EqH+_y*Fme}%As4*F+4DnmwdRMb?bjs@rRIdr_@C&zhZ5wiI+P_56 zkuG~bL^ya6(lnvptUzlwV+8I0>>mD<1yD4u*x$?!m(VzP-u+cuW8bjc{wue(#n64o zWIvlp^*>`A!T6{!&G%l<2R;wmEwqTb$8`d|B_xboYTJ)KoelC=!G4Bv=SPtsw>W zB8w|Bx6ki{ec*&Mxo#hf`Rx#rR}?p|W7>sWKl#UW1f7873f5J^?vV;2q?~1Zc<_7xP5I8_yE~4n9zi* z-A~;O>4=J4U-rv(9cPDz0r8BO0eNv*eqf&*kDcxMBBW9A*vKg*TMY8%9yx%md&5tK?O}vZ3Dn_{9H~7XA4%*Stm56cN{( zaC{a9zHB=$*lQ8Bo&EnG3t*ovNH<-K@gN2~;E#Y9{|{7fJ(Uw20|MN~4@T0BPErg? zAI>S0DB6Q4DVz0J+Uz_~rbH1%sSc=c=Fv8kaIGs7$jv;Wu!%L`!R4*ViZ;B#1Mg>F zKvCs!Vjmug7{}xKihQdloaW{@69R?PFFq220(EWkFAjEA*q`+I=U&Jm6!hsnA^%2h zecX>)xu3a#Z(Vt;jtj@~3SC%5%jB+nee7y5?_#ZjTyQMiO`Puwz#M!rK>qM9$V>c( zi=KvM)W(bUScD?9=*oGZax&)cS-496TL-MOMDuQV$!Ry46?RnN@j85>xFybvk%Zr%ia@LH1p@FbEWmN7Pb?i4L1lg1d9M4mt3-20XwQS7aaisA=wD z2CY}D_z$BbS)Qj|;T(wCfMLdkTwqv+uR^dfvt3B=9B?BZ zP+wRny^V%Rd3h zJSjlHuxoc#yz!5P?8}&+kuiz?MSGfa)}CPg#oTYBs#d%a4#`jtvW_)_M};Hd`OPur zR*!e_ZLl@OK~9T(XjduMk#vmAg$ep5?{ z%h{8b;C4xmuRM>j0rv>iFMT-p%V?*|>6TW98Y9)x)tC*IP=0{EcCTjEW z6H|MGmKI3TBPT@dar5L|w)f=egh4O7FN(zTr)0zv*mA|@_?SV;ecy6uc}4SN!C9%;~G!$WwExcA9^JXC|gb|>Tz2V1l5itK;ct8rY6*}wB{WTVYv zCFwPr+T5>z^g|4nJE%b?r;B5s9zxXThH`qwjqwXSeQqIg!YW8nF8?QOkAEix>#^2= zF6-N1Z-;TcBu}IYVpGl>?jYU{xsGTBZ9@SuLUBf}L=3*LeB!;%{9r5W@|Yiboq7@F z=w4Op?b=yHLu%6PylHc)G6jvoG+DHK&{F6PU>ZY~j za?b?5 z`{q+^)Dsc!8w7lM4<8BC{_Um?!2x}pec1xJLo~wN48TxqP_+@Q3%=w@zpBV}2;nMZ zbY;YM?f5QdKL$7bduaTN)DfN3O~i!n78W0TnNnoo_Y(UbE~^Cko7cmy@E=FE705um zh!OVz9S9@=#31>rD|Y$9OVZ#Ty=_|#JDD*~A-$jBZUx>IyrlDcg^|~x*D~^-fqe8& zYX_(Z?^06ch_CArX$Kmp@!FzuiFO%-tUJMnkG|3Xz46&9DZRV~3tldh&td@VWDx{^ zSPM-o8dY$39MpINoFwyL8Vsn(dT_cIErip-V2BIIN((_{AAAFG7aKj08rs5lat|A6 zS-q#EMVzJAs=d{rfUoxo^4c1Am*^opY=@0&q)HecTN)n666}UPKJ@iFtl+I&G$15} zZ!Vq;`w?z`e8@YXYJLWn-yoxZH-CYIb28T$X>`0m^|aS1*m6qvB9)!-`yrZ>;;8Vf zYJh8Bm;%nljyyFD;vu}YsF2tHZUO?vu#29nUgK~|#(*clPk_cDKB!bbeKudrHbems_z8GcwBq^v^f$Rz6- z?wo~@)f^k~>OSt?cZQr8LHcc<1a=RjQ$pF>eNaHUQ7+`!jd+eb9}=!YeN^#}$+iRX z-n{dOgBuC`MjZ>~JG^x;NQSyS-e0M^lR=6fSSONhOahwyh2gN337<{;B|$-TJqSD{ z+T*RUbDu%NN*laSR5vRUvA0lX6VOc9#9gb>d=+IXa^&KGfHe(8&LfBw-4k68QjQzR zo1Af}oVHNll^L)Tg}TnG+n%?G8q3H+N2T+W9c0L~w~?lj3|^(zGaoTrNi)kaeWM-K<&1Rz^O7ciwB zmcgx^YaYK&@A5^_W*y?5N5uKeBgY2hv7D3%o1JV5L?=6j)`OjyFGmG|xnXsTID0=) zII`FfvfSbb$Irzj8z5t%HZjT;Lv}L595_Lz|9^mX~b@AP>T`NBluEY-8RfWm36F zYz1_GvLM`aQ$esxv}0c;&4gYquE%gPoRiW?lh3v}5g&C~*1uY|Qgzv9=R@PY`0Wj( z1fil}`ezsdpTIXna?-YAZt>X# zefRnXGehP-U+7BK^&iUk?-T#0f6M>-N#AGWB8AU;n||?M*!uT!U_j4#{TEQhc6p!f z*K6QOA%Ud4j=CzWofFSd^k&M0cy(EKWdqAg1DS3G-Bwy*p%7?40teKR{ zrI9A-<%)E#laB{1CCa(~)N}8efEJ+*A zW5fD_a<|^Y^WnFaguY8_9~}xPqLF1VV-3|{;gjg8HBveQD(Oo%?strxPVqtx0dlo( zc)ASB{wE6{Ni@0IDs3AR@8T5is^sNT`@RQswfNZGtb|i?X9_Lm3c+#;DhtP!s2~0=Au6i4GSXv#xKXUr1Hz& zEtMxsiaDssnS?u6e^Ou~i6MV9O)81h2%Nfs=>Tc1wU*LWM!uaG9A0bo8ZuL4$P@7>#Br(Nc(>JiRb5$tde41D3J(CX} z(9+1M`@VT*7>EMWXbFI*B(j>!>*`sx(~)9KU3yJ0Yv$D{S8@JYSRzQX>IyQf;oeML zRW~ChlGL(Gjl^wMdY?eg`g)(+`3(VP{ZO<#P=z$W{+ifQy@tMIl;P!BBQ48RP)Tq^ z%cyl7Y@75o*B;&gn;B{HYiqgGg!EJSf-0aS>ZI;dMReZMQUFX3saLr$iGX2Nt7N4L!(f;>RNT0*eWURO=%V%L=JblKTaoT9{axTkOMm> z@Kz~1$a!!hPRHjQqXaw|+6N`Z80GTBvs4B>9c~CT162m!69llSS#1;@Zg+MX+d$(d z#sx$%rrSJXJbEtG*_ga)AZvj*}w@8Wv-BXm3 zFPKfSXhhclNYNcF~2yo#1lx1}Ln)fhfNQ@8=^ zTp!gPF51lBbnZ=4oalhN!792tu(`*Gn`t7Tc%L=EsVVLtu&GhGYL@cUKZqpS&CLc( z{l|{I{>~`@huT#zuf2JljNDB`uy{qoR=By8N_)xD&FJcu{q+;5^X(Z*==23=wY>rm zrbTW#C9mq0j-`kOaPP2?J4%1Ck$hDN>@WHJqrA0HOgymPm6-ij(|>ro?G+xRwBGzI z?Yh6X>*e%x@|egF))vnI^G5|1G?~huwl|aSkvoYQi*!B(L zKZ$R~s`cOd2HFvJ{=wh$qeL|B;UT%AlXN_8NW+f(&%xC;YF`SzE1yO>_LcWzr+pXt zePUGe<#uyk`(~&Jm$j0=N)?~xBGhG8hm_P!9oPeIYah2JQ^LiHcanDd34jVDnryfG zq=WnJ;{^@Hrf*Pcmp$6 zYwgsm(J1ySWl1dq#IoW*k%t7giInvV@I!#_@Llcq+;&M&Y_k1ln(H2YN3finRK7g` zj^1?~s>q}VDi2}!fA2kS-TgyQ>z~uv`^zORDqW{)RtF}zr;Rqr8GX3! zO?xsI0gvPb^1?9ieO&xO*Igckv3`UA3&SsBJvHQlGqh|j9ZJUCgq zT+D%!@+}14bt^P7%ak{*<#Bmhys{Y^{Yhk&S58nW-e>;A3Zd=@o}6^ab$}4At4n?7 z0Rsl(02hL-FZ^b%ocbHbmxZTkj-k&BTjf6!hhEU&AboskcW~;M9+QJfg+rZs(QLGC z7jRQ7UIb?weYGUSRiV;=M<8xbAEL51NScO|5K75FYx#$Q^5s5vueaUk;`XBmHKBs6 zf=#sZSrJWBeSS`pdh_aAQpW{vlityspYbM1U;BJL;5+Yn#k~ z1>+k%F%+iM+x~*%))tMul z$0(<+(x*}j2uDC$8UxD;m$~6u){DJwi{?Oh!)CROXO7GzHGRXK$4yz6b~k=;NV`gMQ173xCrt{XypX6`Td;cOgoMb-sw3XjRKVo320am{wh;Am3i|b%i!Z7s94JybtV4|c z9)akF&eQw4FM$FGc?No#1nWwF&Nnah;IhKNw-gvSe$hh9ZMj6{5yijDMt>~me1L`SpHaly62Xu-1-!y zSYY_qudPr%Z4+^t@T-)H$0`lm@D2!^v$n8MXrg+e z*Nj(v#hsd@cq+3&e7)IZwy|qz!-lSYv^cL1U8v3nqa_3I4~^<_c{8@z2+8)>3bR(I zFvk3MfW>$qnXsXLHMQl4lRFUY>gw+M9|Ew!)M^huh(& zB8~wbE6XUNS!f{0qtj4(n-T=hfeP|GA>jeW6hiHW)r|;tt$hvl$Swl8dOu8`B%J_B zf{w;Tr_xFc5=iXfl8lp_X~hQk&~wi%mnwugT40u6iLJqw3p#u9d4O}fs%E{z$>-Ss zLBX_%p_43Ne72>6Nqp>?RgIk7xW1|PyLIT=9$_$y)_sqPiW+e%dHHQVl%i)kCh`uN zDWTaD$~sM3`K42UGh1XnslcY!%EQOc?C(_Y^I^qnccq#C^;GcDTdxOrCN02yVUP{R zg1CY@8c_^w*IIk|ZRDv>;311rxhA?5PfgQ&9D@~00`XyoR#Bhyez z9$*j?^ToJydfh^EHlh_=cFU@j>Zq#Xl)p5=H_vx1h7)-R1X5t^ZC~G1RsYwo3;VFtG|4(^iJjzM zQ_Pws8zD7o%1zF{i>%HE6GNf;cp!erP_~m_uwjjqQNIOB-#v=ZmM;p2qSeydhK}rW z5I2&`%GN{P2K;H?#nKGVS4llBbZPZwfuM7F>LVaxnAB%+A{BwCm6%WQ& z$DdTyupJ2jtE99Y2UFk%_c0HxwJqyuLHyY=roNr(o7D4WOk;;OTiDiK>WFq%p3a^i zEoXhx3d#=>nEw6zd}{g80{Y&7TGVm=ZYZC=XM4%n+&oy3;IH}8kc$Zh6zNsF20K=Ek8I)tXas4{~51n(mg*(hD^1;-M+Tgbw_9=yK{Pa>S*BN z?1Mk?i{Y8Ru69)$oXJ9lxM7}3Z-bizm*1|fwZz5LHh)NBseUupan#P^R=onnr0WQ6 zl+S17#lEmBcSeAxrER0^D}lFUpCpU1Y9pl?TfZ!1tvzE56CC1deM4N`i$NNxr3GG` zo}Ha4|6c8J>k0b4e{w2jHU?N($S6h0rh0Ki^>!Hw0Ij;`tk#=#baQ^OKRcrfcrR!i@)%4}a9=R#(q?cN~xYD%L%XnA&BIiT@A-W;~gEl@|{t`X1(|67OrD`}u~K zm}LK|K;buVr_)==s!qn>EP-gfk4yVHQn$%uI*6U1wE9B!?qXcoYqD>8ho#GltlC| zPt6I&FRB6%;m=ZP>I{5xcYk-!8!Q-jv!a21%2`-AQ!q0J><{$S_ZIc)?g+TKHOskrb-FNL5pS)J*+q}>wH-!P)Xc$6Ug=wPbpRK@QOWwHk~QOZ)nBz{ zj=&f?tyVz;{W7YJ8OaC0uTz5pdVDFY_ejY_-Ylsl%6r^pqMYhW`|&y0l97^;S;i^Qk<8{> zeONQ%Tt<8hDq8Xb*G!J=9FvhumaMjp)=6?UUq;tBQGld3eR78!moZiSv-aAufg z)l^>*L=H(Ngwe}nCoNS>r@aaaO6IxO+)Qt?@d(f#dEn#RR{Sc?w^waPD02}?rLoW*5JdG7 zi!@g^Z*Tin=9L#0_x5~i7(xBM`uM2-J4LgEX1I_lgCwuSjz`?VOhsk>&GLBKe(2uc z;KitvfjS3w-SEh&^g3>_CeS5)_YQZ;Au|hULJ~b2W`E?e0uDHQJoV*%vCZ_F3w(|g z!t}NFq&Yziy>}kmkRTMC0D3(rtV$YVnxRZ`#Ku$l!th(Ou>AQO`@y4_ViucUT*!2@ z%9ZO3v!~0fpOhg(eJ^a}Sq^wvovpdJ$Q-*3Q!_jJwNQT+3cZv4VETneuVRK&T#}A&a|ftWG5hlr!YGqi z7Ha(4Fao`EyVONf3!PS#F@O`CZ1L?q!>Hq)Hp6Suk9A)qEG9UbG1xKr&(8+_STk_1 z;+=Mc_r@x92NqW1OM$26J(lKGY0liqFU~;R6nSTFvl>hMOih2dDUHuh3cvr%bdmIs zKSYxA?cxUS3H9%>I_e2>3NkX?tCKYjELGYUU+8gje{t6}cwD>IX+QrQBjB@uim-~| zAG`QDAS-J&*57}I)>LJ}Q#N=f)?gx`4Ho2+>#$7sxsUPSeOcU+$MwK{ zx1Qvkoy?14uG-Y+OK9i}s{6*=AehTCqC*NaEg#Ak>}ga9k78yu;1)8)Ba)JQ48Q-a zW%Eru?eDT+))+{VB1(-s52eby+pSPbs|%mX$jM0|Q4zFcJQe;?HzT430OOnf(UnvV zDNjJo6mNEMn_FLDa}wy-XhUGQd1nVoB6^Lug<-9f64#p9Ugrm4lcf$v$c>Kct~jgk zK0LSf)30@}S5Dn7x@cr{n{NRV-p%5uulwZv3r3#uEvST)-EST66r!H~(B&sz`&@l- zAo`>f=)ick?;IQi%B$Dftj)&KBbwDoGpB3Gdbb2`b4cE$;Q3Cuh;s^GocgApc58=R zL-E*mGVQz5RC+|oXCdMVm>jWNS*~PzNizq^q>)n95wl}@264Nba>lc`eI(GJmTSw^ z@!six>4_MZzbSnI(onNDeamg1W|RT~QR0OI^-U6O+~jvOK|nlNVZv^HAZJSz0R3Dj zHU~vW%SowGTY+SuHAt8?}%av%43Ag`fmDx9InIp=sE zlBiHP-oTCe0k%IkH|emi4Re(fm0RyZQp_+&cTyzKPzuoZzswe#8bbc|D&3SW431rmny!p_Cz$3`P`fq?$} zAuTx!85JqPX4nF+8KpJN2`00g(?oXLR514h#I-U;&`Aejp?R_n65CMWa4PJwc4wG< zefkYt>GY10G8!pQ*FRPa#r@)UBw#Bo7kdRRh>m<2s}iO_6ctf`gM0e?R*U=vv)~Oi zCJJavQiu(kKLOZd0CPZ9yPC@61cN}J7W`=PnQ|I!X(X{?pc5YksT7wEI%W=17BUkX zJIrL%1YJ(M*tDUfsgA{s?D@aD_hPoY#{DheoRD%Jp#r1GB{K`Nqc~gogLQz^w>pcvj%kp*Fu}z z>^-mtzfznewTp{ORx573peAm;E%{RmSeXqdv+eEw7~g*m0%4ih1+Ogb;we{zVO)-J zOJ}?W4XQ?k(Sy<^g|>h2^{1Q4-^WNv+UsoOmo^RksvdjGHdNibupnD&N2NT?CREo% z)rk$dx??gTe(yPf?3jll_We@aJVe_ZcO>Zz=jbA(A#Pn+>TwRz&6A=^J#s87*&z%* z{*wcKMTH{)V#D8b(T+p;UwG`RJY;PIZWxv5*A(SKVMWRle!MPIrq+>Ke(@AybewyK zT$pt@pQjCgJ%YFreO4+1c(2-Bia-C^cC5btg>+mV012J!IddT*ciS`WQbW3j<&h1y zM+!^%EJT|HUZD$IY_nE9Eb$57AZL!UQK(B*TPi)BSDAu2@RYH=rNdVOOE=`*Ykm88 zqh9wbZStzf^DEcn{6V%lO&Y>=9(?wU%f_v2sNnMOO9Cg zJHo&I*fAh2y^-7UL0-8$AE_aGYG32~p*dYijxrlHcefggA}V5EDLOg<}!+gTkVDeD<1_r5V zA)$KLW#&81C^;%>Uv9T>i4B#kY8<2wG-x7&NUsO*nZ>wPF)}thLBxU11QeTm%BVAQ zJm$JRH>NC@@@O>bDRRlu<62qZAp9aMV!3IgzyTg!a$a5#<*ta`@Z++s!d+O;{M>R0;2pa$r^o1K256@@dwZNcvJ%YNjj==u8>cDfGIL7 z*PEx`UXpP=aE=;N{=J|1hSIyq8(R>Gq8nCWubn5Td9ZGkan zPAv)lV9$=Io>if>NL#OR;;lLtmH9HZi|!i!9Bkrw_4WSk$p@?FB5R! z;6)ED);UzopU)HGKT3U6)10-wcF!kskCbSDC^S&+erq{1?E8tVa1S!=+{k0Al3G5> zx(sJ5ZZ<0DAt|es81g;;i&yL>e)v-n9JOKv6bH0=*${VxWT~%ZG5%b zX=7K_dhC0K4u2wK=xK^QpKzm0Os6Pd;ME38npI>^n=T|-_FRM2^K=V-Kler<&x{pF zCiNvkqdo9&|C%V&_2mSP(M33#?Gz;<=KLmjZ2n*e1iFoLSmJ}##6}c^V54d3h5~*R zq{~P0$8^1R1e1!)|?q)t*~gw$7qk1370Nhq7}e5+(Z6vul{@ z5yN64BQ|a$ve0;3k!YM&36{-IwpE!h3{tt$xaU_mxBNfi&*18>0xzOrl0u-T1dW#_Dcr-0ylv+jv5hZ192&Vh<0_AKhSHYHqotq56d z;0LSps|`Acx@_RZRZA}lb<7T}f6COWq#dApvxc3z^Dz=9dI!4hF-D68BTyNLicFpL z_Z85W8k|~P?R1T@0zu-|Pb7b0XnxKnRqBmilWbqc;{?B)s%#_?S+5ZaX5(HxzW`+f zSO#fYPDxj;w#MA!jXD>L_l=V9axI^nD*{rXqjw35s2%1E;TnC?t#!~JQ|n54X=+J* z>IT+anJ^LEK*d)Tyqe^nTK&G?T=|ICo-zia>U^mFO#}!-%zZYSG-gK~jqdJFVPBkt| zaTjiU?|XOH!V1YOAPIoy9>El<%6XTOq*^!N7^pJ(1U)V(?`a4m|A@9KSfxRV+XR+NWTcFZ;j@`K0Z7tqB(&!reQ^H8jb#w+9{_v zu=f*rDIg6D4P}niSJ~JsjfcDWFWs9u8XdkAfy6)m!n8T`+4X z*}S(62OdGyj{_%ucJ~DaS=aLReo~okli7`D-_hT!IEA;-CxhY+*{r{>aFzA*4aU5) z+B-KS8p6O=$p4=#fLsL|t0vFfj?re@XAEeK=GzUl{H@O@dce) zC7G_@h}|Q!>~xfB)1;Q%&|89qq8SM-SibmR+E^YeRMC8`&uJ^&P&SEti$}AURVukK zjH;$NQ@o%4@seu6#j;UB@(+*QmOJb>jfDi=yq&fE%xh2wX*$`1LcOZ6%*_jK)dccA zqAdkj7rPrhid0rg6=9!7X{YtsG73FAFuhlmtyHWD1j}sfuNQ%wDqO6&$l2&gv>6x# zidR?gVZGd0U(b9$QbCFax~=Xr5`7+x60zw8R!BA2etKpfT2(Ul64h!MPMnAg3eovs zZd-ZQ@F!glhcJtB;k1hS+Ij$nMf5?Wj`c zt&i*jpiFL|eM@poMlrgvGHV;HTN*o&M%gg3ZqqnY%PKZ&bPz~Z#bTwFh30MjAG9>v zg7=t!3mETnYz(kCg`nG#|E@AQsQX-aOU^&tcBZ+M&REK-JZoPycnmr0N8_BTjNV+C4J9r|wIpK46Q0of?yRrfEDz<&l zz-YqE4C+uIGfDJ&l2HUk{Z~hq5yt9Oru?BO#U`PQ8s|IC4Z8JsEve?>F{gHa(Zm4H z-_a1qp}5PUxl-*gG#GTvlSbEo>)S&@ja9K+U!Yi#!lEbux|zxq%Wr*kZI|j~Pt3sr zru^wD7UkJA)jIhZx+vwtL^>u&l0@uVtzJrsLQS1gijTqle0LN&LyZe%Ld0t6c(y;zH~dEOYsrZx zfm*2si`+LX-&HhI^Xr>w_#%?PdR1wrz*5}0dY-jB#3^;1n5$KIs5uXkU25e|v|#U-zLB(LZ%VeDlHKrHxgrUu`W2=*z$_b)4j z7vC3glz%&BdA$&Z7Cmk6QHD=O6h<1{r*A|N$Lw+PEoyYcUz%>Z;~^qXAqFsDCkW5W zEv84JiBvTy851JL-dZGf)rSOJ)?RHlYc{>*uU28u{`}f5f*4?&K<%ux97{gA z=g0_()Q~2YJ}STN`V#6jbgUWzIC|-r`$5mC;jk zZdtD8hZVsVv0ECJnD)OG1k?rQl0<_1&AC^r7o;lu#+JJ&(Zw6S)fUSU+HLy|2l}zaHF`h>~|6BNYkj>xUG!|^F>lFA;LMKOxpzG z4)~oveB&H026J_K>G{_z*7%Du|E0t#R3475dyyt8Id?kl8Wb6+d}gn~X#QfI{091NSFT0bQ2On(5G}t=78Sj zSK$R@#QT-SgOPJwpDM`*(()t|ck8U^HMoAbDMu0A^{@ zLOJ6WB>!nTryameksjG6dZhaIAVB;%m|*rs2^fs#O9QmWt9vXDQ|Qpu zKx18LN3;eB#fu%y3oxnU_X=qZA=_4jRw~ESG|BS4VnF_e*D&o00}Ey`=rzdWb4@RtW>gRa;MF>YA#@b@|fTgO{~Y<^^&A zDYnkXE;uDlxuI@u8}iwPBU35zd{XCOv%rt|z7= zO(*PvqNMCKfQ39FadLhu2L3tQOEa02{{ly}aBJ41>3_@lu* zE&usw)CI-6zcL+mMfBt6`Bb&fts+I90g!M$S3GVMlLE*E|!~G^cz3lX*3Ep zzf$)9V)6XT;=$^&_xcX>)m4%iAd*s4*^>!CChbFDSb~TOgvE-_>4(AtAa$93EyM+Y z4mB4H7E(5f4#9&2-r@H=f4%kA{cz_CHC1yCU1xUh?%r$dwG@_5-mGVt`Gi#|>b{d3s|T8>L(Gt=s6i6(sRQN{hBUXrvW}WS4|{; z+HwCYA2;_c#Wh};o5^<7Hv5xRObn6>zEKCK*=3Isb=4%z$Y6j{ZPWhl7Diu*GYtOi zEaN~cnOGi8sYQhn$PJb1(FE!D&W|}N66MDNaqj#OQ3C@(XlkMg>B$iI+{$YQ;r$r0 z;dOR?XRG7z$Wg>D+yeWC@Nr;is-eQthO3o*$F<&BA!wUqNlSI*;d?R+@XK4m<~G;K zVOTzpl9Q;6z*}t)5c@$WhoXR6(B?8yjgtneGY{>5=e9yvsWKfT*;-syxRf{wnke}9 zS#C4DIl6@ACYnPQu;JZIhltntGzK#vhut2W`=JT7zT$^&h<_#ji)QBNq*X(2%>0~& zhBa&yD|X~%;`ChoD?hax_Tlt)U1b_Nte|aFXPLg`aG7GxrXowVOp1H#f`p5sNn2I+ zA^C#H!Z8whdn@zJIKma4^N5Mnp&%B_AyHS%t zbAtV?aOgQKFZlONc7F2({vcOj_Zt_kjK5@-#{ASLWtQ$3VrEp_$5sSQ|FH7BUL78H z&F0TDE(PrF8%pVYK9tEo4SQ8lM}zR2+~=>B21~y_6DC*|1qP&b_N5KIwesOsfZB)b zK~qa6wyfJhKWfrgY}e(F^A8*#62XY1E^^`@Y|U-$rYbL@V^ObHtOqCh z`$wL&G-_FAARV+H=d>0=l7FyvXCTJ zb+?B&omW`X!+z*v$Cp(Gr+;ePEGZ$t$4$Q9OB@H1WN0)tRX&8`I9)bqQFWwLnwEFn z=w>?TlpS5%G0GZXnb@s)Zs1o!1ffA*f!d0&5zVx;{B6kbPQ_nHvp5`SxeGM z>NAJ{Im{93MQ0-`Zt8?v1MGWFK1o9QQ@B{F}n0kl`&v>iH}D zHbwd@ba4d~;k@CR)Rz}tFpX+B^McUE^NoCmAC{QTE&qjVltU=@Jai3c^hzbh zgKC}dJ@*|sAZ8!9W@XJw(FNmF%y5eKqT2xo4bQ(sBoZOccT zx6XJUetD0vH}~`3THc8 zeaJP|T#}>*JZ$>FE3lL_wIu5lk4Vs3)0%KQEjU>yDin3K+ z;9%vPQ4#k{&p=$b`|)4MZ(ZX6x-Pe@RuVa@@AZMXSe_xqv~UqjYq-0n^7_)xpKj&~ zIejc65W>cJ`COJK1bFY>z2jG{)ZhH5NH%7ni)ZOzn|3ng_b0 zaELdJ&JtIss8PsGC4pw98+M@&|C zV2Voy7jRV6Nud#{-h}p=tNx)HTGq1@gY9=xuN2180Up)`4LTkS-MMvk-c7Z+Tcm7m zmQ}6B)|(3A_M7}TywkfQ+r&8n)emHOQG0p?Z~Ao*4>4GLI#`Q5LQq#$s0 zQ}GJedDQNeQr#Le$eD!jw^NzzWrm{?jcuegb3ZSz|NpQEgePB48scakes6C)%a1oX zqlRt412y*g&U+`pkBVZ#TNim*K%UbdHPShy*T z*2L9x;)e@mT#RAJx<;j7hJkxhM8pU>{20%lUJAVD=XYORr^^Dx=+Th}_M+cKz3~vI z+3r}A(1j4E!TI>al2(Jjjvgic9uXbRUW^ge?O9xiPZW z<0B+XY}vQi$DwHl`8?C@P3A5`eJe`mEueqhbLn<;mMy&@M51ZNO&#vD0v+wyCX1w4{Ony z#y7V~*Q(P=mnZ}v09+Ffo0j-$FKlaQG<;&MC?z~c1NRMHn+7oYCq2{R) zuC$-5+^+3Xcn5-e#Xz?g;mulmjg7grbsa(sT4k1vm6LN-tCG^Hy%*dsMN65yvOyG&Z9OrWQFoXvFN9@+w0 z0-iQ}PoeGQ}FXkeBrKQ$t}$WIFBpVoGpeV8_ldNAkF>4M;kDUp9hY z5eeQWmNyTp9A?X6@~Q-Ur2u3rdrE#mO{X`@#RF5C%(z=FIM0Fo4obF(ZVk00CQkcw@htyNp zs=}v;1eQcje+R}x;IE`Z?--DnqLX-{ z4er|K=ZSb%mzL(2VkOoXZjRCZ+CYF*@%J7SBQOlYs>pptRC@+>%7Q3CVR;EeF;v|U zq=_?QYKp2iQBfVdLVS`Q2uR^D{6tMmZw%ve5Q+DTSI@%A*k=QyKk2i-Ef$7Dj`pOa z%om0mOQQ49=Mp~X56|Rx!2a|&8@1uly4P}E_R-#AXXhH>Fl=taqqC@AQ&aguZq0{T z;9~EQWceo3&*SXSPVny<&PvxETEL&Bw|De?)H11ESGvl$pW4<@X(8%Q$x6*+H zF7L~-k%41K%?9~$60stNse7-iNZDa{7|M2rP$_xrHgzwU!yVYH5$=UO*`?+`(VUHzvrrsLNZ%Me0+P65nh0&JG1s=T=r!~IaODF zklHvql_B(>iiBV>HF0jF`X?!qk`-+pG#H>J*NOSmS8qhZJ+`{^B07%6o>n}-k${5M z;nEJ52g(-!1hHYo(+KLqHAiBZ0Y$-ns@}Evz2_Zeoh&owt14)`rJ0|9+nXv2c0te9 zTHl;uxp_X3{B*PEHS`# z|97}PcIgS1_0I2)`IpK(6HSWu2n7spL3BS=&cC|U3jsgIF`SK1y^d{OKT)lyYjW@D zFQI&jkO+i1f0p9<7@Q1(%;@vCtHqvpY_PvRO)r6Flx^5kPf))6Qug=J^3uTjAm;LH z1hUdIDLC?M1i0^wej@zh;m)^Hk^>RXQPm?2-znbYuKaak!TI{Zcq$Y9>({UsiYu&R1=*yPPJlH zE!5QcGlR5yc?+v4YO~CsI^6s9U#%HHjvz4wl9mn@oTxu+Vc~udjCuEmkH($D7Tp3p zrB-aV)Hq`i{@;K?>z;Bd1VH33;V=UlNJV}7g=*seWPa#vex+W|VB1hS7=v{HF%ume zeep_PW+>qNrJ(bYs*ZSktU$h)p-98eR$H{xsoYZ@SK^p9`bGgSYuw#Ec)%#}vsqiS z=ExMF5FEPZLc;%A-K^bS6dN+<-i{uU+4CH_ykhBSk(UBUAb|fw+11qe zrv#X-5)}7V5I4WtIlCsW%zt*mZL%%*85xzA;LxRDFrpQbycf=gkSEVH;Hhp# zkb1IqXi=<10mO1wHi}kIok!N(tG6`+DDQ(t@Y{Ywj$TF#Dn|+PM6*i29iC#w0@& z-_S7%IW!8n8@3g7foC;DFai=V_Mo`5y(KG&_F zJ$xLsSKXf@zI~ybmCfEZ4Gg{o(%}>9xBh>o?S!rld`cOaMp{q-$4=#%I{@N!>Jvq4oHWzi2^@!UvkE@>H(c*ptV8fDNZ;+x}(s`h&VFHek*8FnB4U zJQ)$&K+!N0_JdJBLq6=x>(k0nU+B;rFP;#-JW(?iJ>gJ4dhev($<`~=;w_Qu&%ob* zhDzjU&%O;R$bU>MJjSeu{THI1!g7U|Rr=kKrVqBo1Ow&JmI_X5wN{KwetoDqmOvsb z5(3D5jpoVaGGW#6KBIA~id`zif5f9sL*iK233MG`n3YoN`;SjbWz(gAeRSBT7?;N5sdpUoVWnepmR|a@@FN`DINM6zO zwhjWo-Zw?)UhS0)<~^Y=1Pco2dvABv4}QDkH`$TKgUC^_)v%1<`kW-&kFx`DFt?M3 zju!rPb0R}4ew~&N-M-VoFANqSGlUz14LAA^;Phi~Hba1>bn~a*KZxs-)dN7Nw}0ap zUI{G4YS=fltvOGOx;sX7Q zPoCamSI2Iq0Qzh~)^yFqhAiTp&87cE9R0Uc0=&D-F858F^YG5jVQ#?Zu9&HFPJsP+ zqK$1h38Ic=E_ol+GTyR5JzIpF?doX%+Um`HIkWjw-}3Q-y*s&`u+;n+WHx)Pn_9io z)oX{ceKNl@C+SrYWZy*jx^uMSX_%Fkz%>`3)DSMsoE}}f4-bU}Ybel`qDW)}%Fbf-BmuwFm z&~maUjzCTI$A1l8tqki;>@q(3H=dswfhCF=;>~IQU8q}Sg6r2-;tzq^NHwseHeuax zzc(T9znU99bIPp$Jco(07@mUw@tr-WE1@N7kOjSMH^33_3pj< zmLw6)DvJGPL!*YiTjw7rKS&~G{#qExTXp#EvC_DUnrtN9k&Kh%rz+c!{-u;`zr!0p zpKaKUs+S%Mge^Vs2Do)%;s*n}*A}fE9Z|cdrxWXqR({{+;oFxww-==-y}R6lu9gPZ zm1!w{-cpA7=)?<*3;d-HY7fK~tK3Tb3h_MbRxXiS3~4e+s8wh=q# z^dLR4cK-q-DQG#EL#%|*A?;o}HD`)6H;nO)aMPs{mqJ<39S@!~ZVBIE^>yuY)bNdc zxNioLgBz0uY$D5M=RUVfpcKw_#^j6KHTNVRK=$6g-qO-fRGgg>N@{$7lV-}=n-ShK zB3Y8XZT^G_eydAxAn?1U?#4kr7Kl%};=)Tx~|yu$Zd%2%p2-nzRQBuGF5pymqdP93Q82BE}d! zI#3w_(?7W^W_TT|8Kj;CopD+Fgi;)xSIdv$cDT8Y^}~e++zM;w=qS{hjiT04wXR=v z^!RrT=mM#E3oLne3VAmF!3C&lHBX&u=KtaA7vZ7m+UWOODBf6P^GDa$IcG^1vZZmD zZ*>R~FuF#efc;ys=byJ=s5ml0D80bBBZvH;J(lym4mUAr5UbSs{d--KsdaW;$W#$4 z`iv~y$MwR~<_yF$6K9HX%IdU>l8#R+bXkgcxL@#U}Zhj{L^*a(=X{ChHg zS-lOOX11PQe1g`ie7rs-ebwR`7hEn#hJ~C+j_7eB2SLxKzfvT;lVN@P$L0vbliK+8 zwRD5X_NW6AS-v|-c1#_&HTy45g?0i41!DTN*e1L8;>z33#|G&N6+SL+j2}X?JVku} z&d@QvINg^**`KxksJiq^q#__?>|+yu&nTD3yPzYc%g7D3aIa@rM=wA{*IlnDmO$<8Z4^ON5wx zv}he+L8Hsa{fM+#|EBl8dr(}^&FHCoL+(c>RBfo> ziEkJXD|CR@^48O2bAGo9s=HJo>*>Jg((*IGaGWhND!Z}RIiA(kqgR>;#p^^<^;P=f zUZ->V>rv(lcj;~1G~ac-Q0W!H=EpY@*1EX)ZuG=(*X-F$kVEq>jq4Tq2>IvE)IL6P zO0iaa#rlpV=Co61GH}kvFes6gZkA*HUy7WZ!`_IT%Jn7P(W{>BF^emhIZw^jLnDm# zw`)kKHh#AA$aF1;F#oC?eO;eNs?-_k#Q%`d3 zf1YmhhXuWcm>XQ`yuFt!+!Tu34A7^s(=OZo8t?Qg+@7Vt5-m;oJ};cTVEbJsbzKiA za0r~&2;IQ7)TI6qI)acZTojUNd_CZ){uPA-Lj+Z zBHSMRRuJpCl1MO9_6pPA)F>{aY}4Fpj$%0b>BNt)cDU?t8)MyrMKLH`U{L0@NQkBAhd#yh@ID>=LI!G)G^ghs8^?)&;C7iS`V*M%qsTitySSx=*O-WPr6tE2IA+&@fXE<8g-*9J^e zVqDt-HI_npuFj)>=+(al&8pi!vRR<`iSOMk{-I8g7xq;6ij%-hZ-W)rZ46=TEU551 zfjixYh_HreYx|#ip3A6@cW`TbxB4;XUN54={52&c*Nh>Pplo(W& zA5Fr4O9{>YW2W`*=gR&iQ2DRt)c(8MXW5&<|I#8-MUMV2Eus>9g8$``M#Yuv7NE=4&ycmn(9X!m37X zIMT-_hR09!qhqs(4ji?|O|Q-bBVtidn_r#sPEOKgFLk^@soD=_mQKEbOETW*P6+KbsrfCKIXv10);dgWN zAonH@iJ!CvH}-}-kiSb0r5P97TuqiBbiLar^(FwfjqA@#6hwjJVUw@px~=T4%#f42 z<9YqxOC2uQ(J9aupFR@uW3LgorMcBfZ*ZNA+k&G+F)MU@BgRy78XNE1wzP`1_E4#b zPX1*#Az_#N1U}hR14=I`#^>TR;k_dR0goAqRIjguK#Q}}s?8lm%(C4c*{Qsr^df;< z8>$Sn+jgUC^{j`GuWo7naB$qi zHQCd*kBPoq?Pc&yRlPT!i*~ALI2nibm~>V8)9-H3Hrwte`AhKBgz)X_+n@Ry6!ZA^ z*!p}RsSsZ0^8`-oohKt#I9hP-65H1F*e`we0FCsRS7-iL#&=gzSo+L!ot9 zjkcdGzb50+yRZPGldYNFfh!^m8S?jZJ3Uh@oORXAY%_|He@5`$$LVd6TFavmGT3>Ch6PX61g^}CN>tmq+|CY76<@4 z)(NVqrI#6YGImi2!LlP{e^v1N{jnO$@ce9DlXPM+u*b)ud^dY!r1RX@D?`Hu+rY-$&hldp$q!VWs(6Ea7Sm$SsY2y%=#4_0;EuOlzIpwgjC*fAn zx7D^j7By8lF%p@B`CQ%2pnIR+Tg2Co!GYR#e&6{)ooBHQF56bVHS<|IpeXppaeMD1 zeO=$SkBagUG&lvb>s{3uy{9zF;@WoHg>BQCWdrYD8U&H{l_Qi$RObf1iiO+E#*0rM z;zv^TM#E0@w)r5)=~$Ro)^?#Kc{NSVd4JX0Wh;QuoB521)phpgkN@o1wI0o`2slX4 zXt$%m(|=|}gv{!vu{5t4`KZ~&C`MNFUcbcZ$yvf-UH{KKbLuilc5^lTEoPE<0?D^P{{<|5|n4GU@?^(Zk|{RNL($ zlh{rzmOfR=q{YXXY1!F?Gv6NrrNDiTCFM6oPn?B?g=8~2jEi`47TDv2I!_Dn6e;zw20+wzkp1-dM>U80<>@r{O&8#jflghDLl9Mk< zTY+KhTign1N!b{QnMiepZDkk)Z$=5N%r6lN@|BJVggPU|P20jP-hy2T^I+VgHeN<_ zm=rD70K$^N7@rdLU8;3Bv4<@QkZBJy;@bP0&F#0p4;HTR$TpCNnfy8H!mK5L5ln)j z5Npj$S_3tjiy5-m<}JgO14hl942DLYatsPAmvpmro?p+QsS%>ZUrwtDj07+s4y8sgl8$ zX6mJO{M^0Z`0nHA+(%R=57D#CY-TLO8hX%KF_o7e8*94N^Nw*|P*Y~r5WW9cfsvPB zaq9JTCyQIE^n5<_VgplzY_HM;WGN3lrCMv=3S!|yAU8!cu-jy|VJ;7+uTF*bNZ3{1RA34It(#CzRMlP}`2cR)XqVtH( zCj9M@J)P=ZUY^lhOY*Pce`>))`H^GfYGY$#;<}hy!P!rvY#P?sl12VLX)8UPvPZG> z7)9UhyM?ubheLsS(d`%`IDQ2eTLuhjy^b;0iAn~!#UOL@OsMdTI9kbmW@Qw2J8O*R zXQ_4N=(E_5@Pp-D{g3EdFf@Ezys1{r)%A`1C6oF~miWq*4ZC4ru@BB_wjJQAL0RnmT*b0TRvCtVo3x=os&Y z^eqO5D!7blVg-u8;Kq*YS<+49Oa8mhPF<+i|XM8 zVS;p(SuNspJs`sA>(ButR_#C-5u{~yakH4`PXE&NI8s7Gc=zsW^ion%guV+aH^HvI z`MdgFaq?lMk>WjURz-AI-qsLAE31h8=vGD*NoXhz#jnzTW3!PRJC7me^`j~%hB_XZSU*+z z61YV1Hh>I`Y}Bsbu!bEqNKtxpnk;Bar{Bh2>oe&ymLTKIh?B6| zWfwqw#Gnn?ZGN1{KB%@3WFAQ=AcLDZtf|rw5Ao@SGCu?@sb;#mEeq{3l|Ugt>99Y< z;8umRp3@QzV5UWeTHOtfEE}IKAr)4oOnIwZu7%KjK*$*w0s$oTeExKK=(yHnu8LHy zKBAQwuV#*?O}&wk_+DXTdL>CePJ1gkorj2<$5Eu|#m404#84D#9k2BM zO1{zzo)yDcmTq%77g>+$cFPHZ@Yt{9cE%5YgQ{0%sFJ$&Y~s zjv$Az1g|;wHBY8vce5v9rsDzu`?X+?Gkfhp62oA*kKTq^9jaYWXr% zFARa3X;#3-O?Z$ttYV_K|2r&y6{g6dtIn(g4j4&Jy_c7}H$zgfxP_yG4Zr}t!i-dp zsh3EH6u}^f~^c za#LI`r2vHB@;v$&0L(>K>M~nXMVjV!1|Y9ZC5qP3;Xl^OFr}de#X%M3TruiH<_wcl zAkj!fDF5KDwTAwsf#c5{|51qyJkUr#>tAYmlVzAPbV%Tx&y;$6td zO1@!I9`wLKtSs3RWZbBO5IWmuvE{pV{?_(Bd6x5Oll3JP^N%h}7J?;14D3S>wmlSd~n2 z9^*;6#^rdRg~cVm$`F zztqcCq}7V;R}7%TW)o~mP<@t}`v~Db-5fHBCBh~!-lwW`jEjGmxUNT`Z7La65pWn@ z1S5bU7ymGQ`gz7k*Uh-xHvTQ-M<8c_mdA-*q!aL}Y_0G{JC+IKZfB}di!F)8`t-P3 zTXrc_M)_f9N17x0aWzCgc@A$y7SSh3GEJN23(B}Tm-4CYpwPNylg_+*J4F;2t?%#-41S`>WzO2Tow?9QnYvGv13}iw zwY&qL*<@F0mQ%6U{jmE3DWoePFUbOG8cR7=0u)-ByZoXrWZjXKS@OQ@NWGV4cyD}( z38uxA;UrZ?7zp(WN^f3;4g5RE-)ugMjrPZ8L6Fdsew@xIRhKzIyj!G7VR6M5?F?2;*YGYmZ2TOR`TmD| zj_&FP7F=PZQGBo)9Yb5n8)kfQ^%Xw9&y($(_Hmn^TAzELUDwz4Ov{#VaN&acW9sNZ{034Y`mMYz@U?a8 zS2%Oim06n>+b1m}gg7wTw!zW^r?NTq-5U7(0XVn~1VG~VydFL#7Di9*@Gs;SdP%ya zd_sPerW?fH@YCV#IIh9aL#&f4~1C!|WLv9it~}pJ@AIPr2WGWqo(NWS+dM)9%Gxmp2r{D(X`zyZFt<>M`KBBoV&NvFwJ2+M`K8N<&7|kDMJF;+S)kmulBg!yqQ?g0Wu$-ax;8?;=6*y;LK1Vm?)i_n^3$- z^Qx?=Q}faz8+=A|`Ab#FP#jk4K$Et>W+C`qQ~s=x%iW(^O3)+Y`T{s|3JT3L48icrWTzPCC)8(KONdOH9pK}_V{O=N*8|E z9ug^9PZTzf=e=jR1@Hb(T1L+~R-5zQ%h+g1@(=8bj=9?~0SXdO0f{4@XMt+Z^yC;u za(94~Fx=64ZK-1MvC#?p$U;>ZzS5>wBDN~VI5dZVG3;^FdqqXJeNrd_i?a!czNYT?nYp4G5$OTY$fU_-vbLddxRA6A3;<5KsA< z+cH+U%UMWHxaBI!bABDH6!Q%n;yL1GY?Sgg30|dI>>L3NRwLDZn z&2g^;CL9DqMc7q+^<%12B?&Hbx_tC7!#jh_KPb=7m)Gj-bL!IEH2FG00RGAl{>h)( zYCCWAldth`oN`iJX6)BqGqi%{?3CgNj=2p!jEUahH#4*T%mY6D*5@8mwxJ{OltCnD zz*t%!(~8T0VPujMISLmS$PwX1{~fa@^NM(#f0{qUB&(Vyhds^Zr#_xU=3@thud`}6 zySj>LKwQa^P*n8I8$h*@RKc=&1Mf3#ur|ZStSUmVcL34Dcd=HU!&`bR0I0lWuM$4} zJp=PzR7KG1MI1yk=cX~^xn${44#VtSY?<9#fE@0X9f7Wfb8Z~OiC_c@AhmXaWs9Nf zPH`LeY#iw^4d*M#E5gNz1x&44e)>eA0h!v`=`?1w+_8{4i8G?`p?qf5=^bJUA`JJ& zv@;Rt2quSd#dHuh!nvAGblt$7WIXcVly8$XPC_Q7h{I@b9TSZWAzWE$_3j<3npOcd zIHx?sdH+6V?J2^8xNE35xhR_Qre-G`se+ToOuH^Gd94g)=^??{80sAdQ=;o78m{O$ z2xOj{BYfGiz8VU1paT8@-nNBaD^88*haD#3N1D!T=-Um1H?W{bJ(xPDQrJ75C;B`2+fH}3=VL44oFP{txpL>r8v%>3hAv~lO9_63t4Mg>GHW?#Q9C%=t}2K@gQ zYCYtgkmnVqlrzR*$^}!!iWt9as8pI}m^r?6 zSt^=M&8fjGNxahX0_R#z)e?eZ(&{E#hl0}a-R3eXCJ6%!ceQ014sq5zi=(`s&pq~1%~XqU3?5TfnJy3Q z{0^7c%qB9N6G5bB4f)A3#jDiBLHYsyVSd`V`!peHtjoRtcJY1CI)gdwuiL(%_PakW zP&gKL$UlSkVxEMRoncp}>x8)mS72pCxm0*#F-fQQQ4T4~_yvDGzt@j7pV>z`q%^fN z-MMUR8}!n$>$q8%?i#y#8hm~tUN4{fXGsNh>cL}-k5!cn9l_O-B>;%I53+MsR*QzngOIUc<;Y)A>EK=_CM6!f8%0J#QztJ>;DBz+Y3l| zb+da#-Oh1^9`AMBUUJU;e*1ub4&?dbYQf#YfwEi7enp}e|D?lf@_l{O?G3{^HRhqz zAS9_O3xt)hHi$!Tev*na$%;CxV^o$a3|_Vw5?Uvm0Ochk za{qNizHMCZ@x1ZQ_bv>oC3H08PLFTbJ8#LnW$IhSX{Tfo`*|hW?HrAS&;mmX(W!&L z-N_>AS@5HTtpH|{2lm1O<9I7OP_Vapa(O9McZou9q$jlO!`F(}gduni(w?Rm&@N%} zrpmxzIoD@@cla*y*h|6;nRcl1;Q_X9Su3Szgh^F=rESxD8j_05gAwU4kzIg`n;&hC z5#R z=T5nl8fC{CEdZ3Z%jgf=X$B6eTS=M6hgwy27VyS>eLab`&Yu^AXA<-T`eqxh_ASZ# z6gfjpC+C6ej5ECJ@%f4D^0zS=e`?O&sV-vTMu{JZcvE>U@?M}WBt-Y~LH=VH{Wvl~ z@U_m%+iQ~{8~406ecaURZfsW+TXkl9$RCV*owZJC3Aa53j0B(8KnF1qjXF%=V9z;a zZJlTYtLo2*YgA-94nT}T@R0InnXb5~9Ni!7ypgwURlTmmi+{?7OJ{{@ zww_gGdH>i7#8M~vsG1;xf+kOiN;**hT%UbJlzjPtTKxRcTt?Fwe!%|S^!Jf@%TMt6 zZVi_AH;a@2P-;=nf$vO9#)pPdTH?uk@u}{3Go#aOC|85!dzpAuxuX>ok*rN9|MY$gPC|@aIPuj5EvxU(M&;U=qA1DV_ z2KOgUldV}^3pcuh*SA?P4+#x8ZQ9vhjSVk!!|%NO6rYBVt2%Cfq)P~Kj`z>Vik8bI zMX0C4Fl}$=!mUh~C7pZMHx%`)V`(y}+PZwS`pCF!a=tFOv}DoLVL7f#^KHqV`A0o6 zFMFF%;bH10Wv_`9O_!2D=Eth`llqnAvv&uUZhV<%o%T1^m&3!hZA;d!uCS12nLf}- zB=1Ewp0l@W5ijLl7Lx_Gp*Om|X zz^U)OjNkO__v4o68uP*(EQ5%wa|;)NyYI)_0{i(@rza;u`lb1Y{wucUTEjSoKH%E6 zL>Q-!4KnXeeWVZ+^*`>dYM+zMG*2Z?o?S;hwyvzXmbcBENV794cO<5}*p!Z{b;=7p zZ{21ETU~+cr>@`4E|d3diVO znoK{jbDp2fEH95FB9c9Kvz*6_S`im(Ctg0(?1C3a=CiJVcyXvF&l)&?_I5AZ6h3jqL@$V8#_ceFgmnF4k@ z3v9`y!M-2K;<5WDxq&94jL{WJbr1x^mRPx_hXBHjASfOdrtgy)8Vcj;4uAb#KtnRZ z%OsvNHT+`bT7!sxva@_s|TTle6spb zxUHdm{W;9*z|9a5_#Z%Ud^@(e;Cp86q}XpnF$H)P+CK^rF#qUA*Yd*PWM}B^V)8a7 zD%cGMINp0_tt|Z^O9RP8bX|*X*v-xmiM*8W2(u%v5Cn9_c3sWzvf+xqy-Dw9KZPg% z&^ksvhm<0_5h91UqcmIme9bn=-?IOuEzaG8(xc;gD)gAx^Dkf3c`2c-_seKDF~Og$ zp9XxFS;w;UFuVypnlh}R$V70%sS#iD`>L&O5aoiO-X5iCX{Fy$E4Mi6_FH{a%LG$K zk*iuc=ikqD6H7zp&;)@f<7ZCtv$Fxsml=1l0}AY1KaCo+GylKRzB?$2uIsY}1p`5% z2qGXNL4pz`4w8{1ISNRSoHGM62#QEf0|JsIXAux2O3s-f50Z1v3^UvKZ0)|^Q(IfR z^__ous^|7p->$j0?>)b8-qbr2mMdpA-{XKIJ(FsG@o<%K|XU^nP&m^Rf5qn`cgGx{XOOAQZ+UEAjaythW_>IrjF z&Q}w<-WN05i~O-2ORbMOpNwyCAxt~1yM@x`GJ>CimU|HIY{xSjqnnp$L$!3}BP7Wl zFfXqR`MgpC9YaGypH5XfL=x3r+YLWT?iRPV?l72QDyzUR(y$OuuBBzs!;u`()HAc0 zyZ|`s`#x>iRrIum0Ii#ied@z;334565|L38wThwCf-N1$iUC zN`u-b^nvX3`@)B`8RV3DEWGw+M&l3 zy~R)R>U-5B{RXQaOxAgbE=@_wSa6R$`!Jdmn%FG#g-tT^rLyriuLf95sutfL~;{x!3K`>~#^L zNb00!jb_k7e8b%0NQ!&9&|!s1#*;Z7jz?8zLQZBQk~*Ay)lwJa<`FIv`7; zEH)y?b@mK_NZ^06d_wn!)fx&8R1oHI$IQ2+eUu4s84^&?V8LPdj+SAkR5%d7nf2oV zhlHiQD5ZY?>qoe3wkktc+0HS;$@>X0ul{1XeK;HxppcrUpzJ72i`aRqFvl*Q5+F3L2^Pb|*FqZlONx>yMW;M%h7n?d)01ZQ+Yzk7P$hQ2!;2x)`heH^ z=3PXm`G=9Qp#ro7So6o;`o6)VIKz0ne1VdS2)E%5e1hz@b7l%)cR-!8yj27H^MN=f zJv*Xf?z{j6k1-6%v2V=Fp@#fKOc4u04p@_>4mx=NB){QPa`=yEwkF2Dm8nD;2*#(I z@%5{sT6bs`@X39Am9Ju__YyEM_AcrNWZZtg zkE)nB4fARdkcrtT$McoXC9sp4!tH)B)1TTY+KvUgUjL95aG3r4XV%H`sD2uxiF>7x zCf82q7*~X{zhUw#6tBdgFU&_1>-8LDJ$+flqmlBOlBED)i~Q*N_{Dwsl5-X6hCtJQ5Zs?8e#@p{ehaYe z<=h=Cjx)vs(%fB_{9kgHn!G19U(%6cMI8u$XkL}mlueo3ElEo;$qG)~JJ&<`w>NNG5Ti+ ztcLw!P=53uf@bkD$En+dGherf7pdF&w2%GC0{s9zSXuK%?z=2{kA(nfwh0M4BXTzssP1IU*1fs?iGowdHAtmhXCT^;Y$2E6WZT^lfqCJl_ulx8)3pv#Z5 zTX08sNss;d;NzehPchK{M8)S)eAg$AD|7#2=W;J{@j*ve{Ygtq zDeXju;;R{9mnQdBomr(c2p3M{8nGw=kOMh=)~Movai4T$uoaTgnHXR4Z_6^hVuA2d zb-%77s;sQsynOfgXZluhK11on5E~^+xw<-QKI%i>x^4cN<*R2_0w%S^rW@`$8Cr`O z7{Mm~v1*S+dYb!T&y&f*n;-tn;QrEOq?){;;^3LVI-6~B&F`6hnK{*?MFn!Hq1(_T z5t&|b>kAc$M^rsjfq|7f%WKPKDv>UV?A5NN_xFxY@JGw*_6uKkDR~GsBhFQf6%kr# z&YgEAJWJt?IY|x1vG#_<4>l@eAQRu>eX-8yRG0x8nn3R<7QQF~4MpIu=r@;k(mKmMGnSNOHu#bE$rIX;YiLClfEG2Zg<_ zQ{sNV_e}1o#@nL%sXHqE z1}`mPPst8ETnfCK^aVm)q2HY_XL#W#NBPSL0 zVvo1;h5iFYPC{LDTIvXV;%KYp?R4Bdy(l9>#e39k$3-LkGP2Dre5!VPV7`rxPmNte zPoV1{cChQQ^XF3bbbY?yQk#v?NCLd!z**hqK8iMQ!(O1rA%q85vlAV;K5Kd}+1z0b zUE$iCc~(`hX2vV?iDA4dCH+a>vgV>r)w;2B=fYTy@*8FL-j>_wh7LSWFkHvFCc2H_ZWeT0+!o|T2_ju91Wfe&WC?Y zJ{xw;(8Kmpgg6kOgGV2#82td4RqkP*h*8LE@;8o+ zQ-1-|mbE(?9ZweIJ2~$BC+vsNHP`BP>%1cAp}CrpC?-*HqT1r?*l&r_sXIC(Q3HsRy-=OZHFRf~zEz_LwA`8vu@YkPkFt zf37T8+SvLBJ8&~^)f*F;@-~kuRl$+`baBYLdPJ+48E?9;IR$ZZI==+c<0%6@`e0A2 z^KZ!bLMHGEqqcBV7!Pe%*EPKR!Pc4cOIi&Z@vD1;ap0XQT60#i0!#CM$VbNtm?ZCp zaNHx7B~3CA#JfVS<=Xr#*$HjEpM0fcNi_)C)zeSD?PqC+C)d;ZJ=S@z+U@1ec&9Gs z(2DDY`$JxqsOx3Mt^GKe;8J6}^}6iZJ6lfa(8?m4h<9;gHv4Wny8n(S$#Sa8TuIuRwU^APrqeqNuObCXp@p9?wa_QM2@Vb}{U z`0NUezQ|;s%eFIni7inPqSrO|PCQbO-Z~)hNv3?b+FKXVXhuEJJE40LOCWJ`Wn*bS z@H2vyMu9gBFFHK?Ixxqd@ymv7P)}9ULf!n`6Gk)x4dtoSvsj+vN~`yAh)f#79##Dk zrHU1Gz^{n7QtaErDOjYM>DFc!-0op`syizm zqa>p)tyL6hZ73b#76MN7gg^;bzfo|j02>XFoYJs*&fM09LvsLLH@*kOWNJyR=bxo} z?e*@2bA#vY6#L9}-uKbG^@sfs&#fb5J$8LayWuGFl}3d2dj8vrSBdhQwds^p714{) zg170vX+QmS5iy+1f;EOOJemYoR3DL8)_Tf|96A)h@@6WisJOMkLrH|Ig$rCy)lpvV z3!wZGA@>hNSbx>;XE|((a2$m>TvqIa1Q?0+9T2rZUoqn#|7uCT{h#!&-Z5gSQ@zh_ zSEw-*xC`W2(byhDxL0#=hpH7#=#}KGJvbT?Z?x+JLB|(1>r~M?3v#ZswC69uYe3i$ zs>S$A?QDEBednZlhOMGfs~~o(WCB@PwlHJKv9J<8m9Cg*Z$PXD6O_ z%C_99)@g(!g6hDLqvQbLBum`@Ne>t=qaa5;b7v*df=pT~b!=H%*#yI7I%M1dP8!t5 zGrxN#lqj)Z9*1YgL>wNrOj@R6IOts5)ducQ1_HB9rxhw?c0RV%!5RM(A{?ov7Mn!! zB$HT{Y19nar!p3r+pafmdVFlTzrrukBwnn8lkk1)&&))Z&zz2}WC`Q8gNKZcRSFojCMPA15R?#wsP1D0ABMd^)#e0{#WUy zRX`laK|1lIa`^nOnS8+O9L%baZP^RS9< z)2UDU3D*0`*-^DXYCZ(Fq~0ke{UDDjCl~ebVrWD^mZvPtHm93=QHdB|FDV!Zo?K2h zT>I>haS*EGgK-ylOO>U^I#sc63@?%cx&rWRd_-4yzWp zSFP9cX3NTO{9I%3K_WyJpm(XyQrqk{qK(dp$9aFSAY{=X`=zk~TPG9~ih*1@stt(|0AL+{R2+Oo3%(cW~@4sr{Q*>sQ>^lu4wcS8r4 zS7IDkm1z>M-%+3N+FcvNtZ+94o4boDHQ0j~F3duN)-vomabiDG6hn25-h!Gi2WeF2 zG-*6hZu@V^F-{}hVd(VDy6?N|`^al^BaAAr!{^m4PWIHMhpsaCqDl&BrHVaJw-1BR z$&pLnzHaJ@!muZDmAo+&U|-H znRI@p@5U5*B)zH`f1uZ?Y9)AMev=_7;Ou9K1>S>M!=w}@jk`Awl%Z?>ByP+i>sTjviYs?AiG`D~C=wOzb)rtd(@2>-Xx z71PZ8TRztz&d?0@i8xg`j*j$8n6z_#U_RI5NP>kfP0L*!qU6WsN{nQNzVC`rc2!f! zmzpW95qI-n$q~FrzT8-^>=WkdjK={00_!U-z=@BrtAJzYVmA2Cp$*%!Uh5Uxu{@k4 zo{z8J->)iemLyaX5KRvoD4V-tt9c9jBVF}~m*-6oe%=x5Kb}0Fe7YJwz7GR^Z{u^}>Fc{$@IDsFUrW z=cdu1K>hkzH-hE@B6fft@fsdX{TLV?_D*{x1AkVrliGl@F7oRd-2--i#bUlAB0Bg4 z@)j#>r$p>XAn5`kdUUuNy0RBgG!aGzX1c3Wf9DbNo$$ivid%MQw|Xlc_V=iqz|SK^ zPorsEcBuZR-u148Y=r{{F9&+@JZz}mqOx<57;?V5HLZpTHxv#3w#lJzcwS+1k-8{h zmP2>mxJE{O6D}KHrFM_dRVIn*&VQh?>84!x1X@jU0G&cLFVDs@D)rGGwkGp ziT~`{F(T^(aw^PB5p&W1zSb8fHP2<^@89M6 zRO}M&vkqCC)fU4bS`!>>(NkP>#{C#4{VCc0uQ+~cn9+tL=+QbK2Dx+DjNy7AMvn`y zWaZ%1J0BqtbK?-|)8BA4E%`XPQox~MZ(X2%FByBZ%=PE}r_^=NKV(9mr5X^J9hA;1 z+xoL^qh=^X2Q|HnMxlrS$i*zGR|dOMVT7ihtBZgwMofvl)#wV3b-#L?=^o^NA^soz zP_vvbDA=5+z{wQq)NYwvaA>@#1kQxcp2g%8w=3gTm7N}aY`_{D$!us-2NX8yRyW%fXJ?R z1;3KWxDonvXJujMtT{YA!e_1u)_DmbzT1hyuHVD{DT81(%jwRO@$J$59g2@@_r_Dl zp3cRd6Q>@aS5T^GN^-*n-YP0(u|fTk7tZhgYNG4Z|LUV>v|*R!bOyn-iOcXC`>4y( z*1^*kxBxx6+k+8%3ddfQEH+#~BPfO;(DSoOX4sv%cq8=G>FKOmvy}01sdHWqw zWKY-m`A1pA(7vVZa#9wEtpfej-*EvQg*M1VntA@-;jd2x)7v2{T$m!!y>~;28}&YU z%rNwdMa*R5rxla{W6h&S+&&9*qGL}X7j8pN7J=%+3?xy}q7Y1LN`n3hcA)-*IftK` zxSQ=@FB{ok_l8V>d*&XOLG3icv%D#BnV@E{rR~cTZZS4@=^{bc#tv;$c3bbpQE}(=d;uau*ZuVA z29ZSd*a-}&_iUa|=~Fnrc2P~YiF4NX?Ze2}SPT6=Y`u+HAB!FO_;aTGN?C8$q8z_Q zUEPoI7$~+GQjdJT_UhXn6f$0}2YP(~yNU~hq=1fOHr~VB&zI1A0uq}AO!m>RZ>FHr zaNY2r9e&k|d>uY$B7e*8I}V7NnF{L*7aP^`Wy+8Wp9mmj zG)VZ&gh}2|kf{1++ld-Hj;w>Ol@yUZdX&YLB4SX?iKw62U(=Z%_lQ;{A<-cgFOrcs6Oit)&>Mtu7(xpOCsw+@|ptvgP`l1Fy8-A-=zCuS7U(74m9E zbtMz-J!MR&9TyuWD!)wi9n$yS9j(jij$^*A#AB%?KsU|rzSJG%W6m^8dJSkylynCG zn@`p)ChlWy(i$XAcV152vdIWsQ03Y2dUTCM;NFj-`3F*>S`8PDb#iYrHr6Y`-`7aG zy(J;JwK_Kc92^9~1MU{Z^Nlv2G7~))?C2`2?sQ7zI$yl++M4gpp479Sk=L$!oxz%K z^(o{RhNAa7N1bO5T|WG*=v-DPMQNsXaD|u7N)PRc1NEKmQ?w8r#8vB1vf2ASJ_JZg z^Vm(j)}~s>UC%Ce{VrRiqeU2x5VYTu54N6kZ*q__dwV!mAv_r#pJ<~sNu8cAGd^Sv zJ6gd76P4xT;+8R~$EmPL!jF>qK|hC0P1U_r9;e+X3R16i(vBC) zbYc+JxqK%AIX0I~tua3dzukOLJHPfLT8ZYcXYTatic$o@(%1FL)#iA%{v@P?`-|Kj zt_K^v;Y2w(D+b8q?r+;!75g>Ob81`RG)UpV1L6jw>Ox&Z?RN50*PdfoTIx-eU_u=d>2^?08LnCAvP_9Nfo^N$TjU}sZc&x> z>UZD6f0#RXUUOPEJ5?o3h;W$I$w)#FYSvx8NzSavzrmO_=q0HswY*ZkaGBTS&zzx4 zQ#mGl?QF6br}unv`a_AM#ZY+-E2GDhtd!K_yLk#@lfj1HnFNu-18z_`|0pG4Qe|-| zGcn=A*5pBdx$!UCRt+3~63u+2I?dHic21y=-W$ItE2=S>=m9Gk(9C}K^I7`79N1Q5 zzaxIpYpB{A+_pF`{Tipnel>r;^x|xDJk%O5+k47^OT<`$u}5T;=DxEuPNHVA zZ7wf%!-y6f;n?R(EuYCK+F`>JGXh=>m;DXCzlw{ut*WjAp3b)un$m4W%4QFBlZXMp zkMC(rr_Vt^dt2M=>1gVsCHZ4^pwXqVdu7IpBub)>C)qM+4t&M{_S)Ys#Ba$lq`F8; zRb|GZM8v`Kb0lW?!0v /etc/polkit-1/rules.d/50-org.libvirt.unix.manage.rules" << EOF -polkit.addRule(function(action, subject) { - if (action.id == "org.libvirt.unix.manage" && - subject.user == "$USER") { - return polkit.Result.YES; - polkit.log("action=" + action); - polkit.log("subject=" + subject); - } -}); -EOF -``` - -If your libvirt has not been compiled with Polkit (ex: Ubuntu 14.04.1 LTS), check the permissions on the libvirt unix socket: - -``` -ls -l /var/run/libvirt/libvirt-sock -srwxrwx--- 1 root libvirtd 0 févr. 12 16:03 /var/run/libvirt/libvirt-sock - -usermod -a -G libvirtd $USER -# $USER needs to logout/login to have the new group be taken into account -``` - -(Replace `$USER` with your login name) - -#### ² Qemu will run with a specific user. It must have access to the VMs drives - -All the disk drive resources needed by the VM (CoreOS disk image, kubernetes binaries, cloud-init files, etc.) are put inside `./cluster/libvirt-coreos/libvirt_storage_pool`. - -As we’re using the `qemu:///system` instance of libvirt, qemu will run with a specific `user:group` distinct from your user. It is configured in `/etc/libvirt/qemu.conf`. That qemu user must have access to that libvirt storage pool. - -If your `$HOME` is world readable, everything is fine. If your $HOME is private, `cluster/kube-up.sh` will fail with an error message like: - -``` -error: Cannot access storage file '$HOME/.../kubernetes/cluster/libvirt-coreos/libvirt_storage_pool/kubernetes_master.img' (as uid:99, gid:78): Permission denied -``` - -In order to fix that issue, you have several possibilities: -* set `POOL_PATH` inside `cluster/libvirt-coreos/config-default.sh` to a directory: - * backed by a filesystem with a lot of free disk space - * writable by your user; - * accessible by the qemu user. -* Grant the qemu user access to the storage pool. - -On Arch: - -``` -setfacl -m g:kvm:--x ~ -``` - -### Setup - -By default, the libvirt-coreos setup will create a single kubernetes master and 3 kubernetes minions. Because the VM drives use Copy-on-Write and because of memory ballooning and KSM, there is a lot of resource over-allocation. - -To start your local cluster, open a shell and run: - -```shell -cd kubernetes - -export KUBERNETES_PROVIDER=libvirt-coreos -cluster/kube-up.sh -``` - -The `KUBERNETES_PROVIDER` environment variable tells all of the various cluster management scripts which variant to use. If you forget to set this, the assumption is you are running on Google Compute Engine. - -The `NUM_MINIONS` environment variable may be set to specify the number of minions to start. If it is not set, the number of minions defaults to 3. - -The `KUBE_PUSH` environment variable may be set to specify which kubernetes binaries must be deployed on the cluster. Its possible values are: - -* `release` (default if `KUBE_PUSH` is not set) will deploy the binaries of `_output/release-tars/kubernetes-server-….tar.gz`. This is built with `make release` or `make release-skip-tests`. -* `local` will deploy the binaries of `_output/local/go/bin`. These are built with `make`. - -You can check that your machines are there and running with: - -``` -virsh -c qemu:///system list - Id Name State ----------------------------------------------------- - 15 kubernetes_master running - 16 kubernetes_minion-01 running - 17 kubernetes_minion-02 running - 18 kubernetes_minion-03 running - ``` - -You can check that the kubernetes cluster is working with: - -``` -$ kubectl get nodes -NAME LABELS STATUS -192.168.10.2 Ready -192.168.10.3 Ready -192.168.10.4 Ready -``` - -The VMs are running [CoreOS](https://coreos.com/). -Your ssh keys have already been pushed to the VM. (It looks for ~/.ssh/id_*.pub) -The user to use to connect to the VM is `core`. -The IP to connect to the master is 192.168.10.1. -The IPs to connect to the minions are 192.168.10.2 and onwards. - -Connect to `kubernetes_master`: -``` -ssh core@192.168.10.1 -``` - -Connect to `kubernetes_minion-01`: -``` -ssh core@192.168.10.2 -``` - -### Interacting with your Kubernetes cluster with the `kube-*` scripts. - -All of the following commands assume you have set `KUBERNETES_PROVIDER` appropriately: - -``` -export KUBERNETES_PROVIDER=libvirt-coreos -``` - -Bring up a libvirt-CoreOS cluster of 5 minions - -``` -NUM_MINIONS=5 cluster/kube-up.sh -``` - -Destroy the libvirt-CoreOS cluster - -``` -cluster/kube-down.sh -``` - -Update the libvirt-CoreOS cluster with a new Kubernetes release produced by `make release` or `make release-skip-tests`: - -``` -cluster/kube-push.sh -``` - -Update the libvirt-CoreOS cluster with the locally built Kubernetes binaries produced by `make`: -``` -KUBE_PUSH=local cluster/kube-push.sh -``` - -Interact with the cluster - -``` -kubectl ... -``` - -### Troubleshooting - -#### !!! Cannot find kubernetes-server-linux-amd64.tar.gz - -Build the release tarballs: - -``` -make release -``` - -#### Can't find virsh in PATH, please fix and retry. - -Install libvirt - -On Arch: - -``` -pacman -S qemu libvirt -``` - -On Ubuntu 14.04.1: - -``` -aptitude install qemu-system-x86 libvirt-bin -``` - -On Fedora 21: - -``` -yum install qemu libvirt -``` - -#### error: Failed to connect socket to '/var/run/libvirt/libvirt-sock': No such file or directory - -Start the libvirt daemon - -On Arch: - -``` -systemctl start libvirtd -``` - -On Ubuntu 14.04.1: - -``` -service libvirt-bin start -``` - -#### error: Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied - -Fix libvirt access permission (Remember to adapt `$USER`) - -On Arch and Fedora 21: - -``` -cat > /etc/polkit-1/rules.d/50-org.libvirt.unix.manage.rules < - -Mesos allows dynamic sharing of cluster resources between Kubernetes and other first-class Mesos frameworks such as [Hadoop][1], [Spark][2], and [Chronos][3]. -Mesos also ensures applications from different frameworks running on your cluster are isolated and that resources are allocated fairly. - -Running Kubernetes on Mesos allows you to easily move Kubernetes workloads from one cloud provider to another to your own physical datacenter. - -This tutorial will walk you through setting up Kubernetes on a Mesos cluster. -It provides a step by step walk through of adding Kubernetes to a Mesos cluster and running the classic GuestBook demo application. -The walkthrough presented here is based on the v0.4.x series of the Kubernetes-Mesos project, which itself is based on Kubernetes v0.11.0. - -**NOTE:** There are [known issues with the current implementation][11]. -Please [file an issue against the kubernetes-mesos project][12] if you have problems completing the steps below. - -### Prerequisites - -* Understanding of [Apache Mesos][10] -* Mesos cluster on [Google Compute Engine][5] -* A VPN connection to the cluster. - -### Deploy Kubernetes-Mesos - -Log into the master node over SSH, replacing the placeholder below with the correct IP address. - -```bash -ssh jclouds@${ip_address_of_master_node} -``` - -Build Kubernetes-Mesos. - -```bash -$ git clone https://github.com/mesosphere/kubernetes-mesos k8sm -$ mkdir -p bin && sudo docker run --rm -v $(pwd)/bin:/target \ - -v $(pwd)/k8sm:/snapshot -e GIT_BRANCH=release-0.4 \ - mesosphere/kubernetes-mesos:build -``` - -Set some environment variables. -The internal IP address of the master may be obtained via `hostname -i`. - -```bash -$ export servicehost=$(hostname -i) -$ export mesos_master=${servicehost}:5050 -$ export KUBERNETES_MASTER=http://${servicehost}:8888 -``` -### Deploy etcd -Start etcd and verify that it is running: - -```bash -$ sudo docker run -d --hostname $(uname -n) --name etcd -p 4001:4001 -p 7001:7001 coreos/etcd -``` - -```bash -$ sudo docker ps -CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES -fd7bac9e2301 coreos/etcd:latest "/etcd" 5s ago Up 3s 2379/tcp, 2380/... etcd -``` -It's also a good idea to ensure your etcd instance is reachable by testing it -```bash -curl -L http://$servicehost:4001/v2/keys/ -``` -If connectivity is OK, you will see an output of the available keys in etcd (if any). - -### Start Kubernetes-Mesos Services -Start the kubernetes-mesos API server, controller manager, and scheduler on a Mesos master node: - -```bash -$ ./bin/km apiserver \ - --address=${servicehost} \ - --mesos_master=${mesos_master} \ - --etcd_servers=http://${servicehost}:4001 \ - --service-cluster-ip-range=10.10.10.0/24 \ - --port=8888 \ - --cloud_provider=mesos \ - --v=1 >apiserver.log 2>&1 & - -$ ./bin/km controller-manager \ - --master=$servicehost:8888 \ - --mesos_master=${mesos_master} \ - --v=1 >controller.log 2>&1 & - -$ ./bin/km scheduler \ - --address=${servicehost} \ - --mesos_master=${mesos_master} \ - --etcd_servers=http://${servicehost}:4001 \ - --mesos_user=root \ - --api_servers=$servicehost:8888 \ - --v=2 >scheduler.log 2>&1 & -``` - -Also on the master node, we'll start up a proxy instance to act as a -public-facing service router, for testing the web interface a little -later on. - -```bash -$ sudo ./bin/km proxy \ - --bind_address=${servicehost} \ - --etcd_servers=http://${servicehost}:4001 \ - --logtostderr=true >proxy.log 2>&1 & -``` - -Disown your background jobs so that they'll stay running if you log out. - -```bash -$ disown -a -``` -#### Validate KM Services -Interact with the kubernetes-mesos framework via `kubectl`: - -```bash -$ bin/kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -``` - -```bash -$ bin/kubectl get services # your service IPs will likely differ -NAME LABELS SELECTOR IP PORT -kubernetes component=apiserver,provider=kubernetes 10.10.10.2 443 -``` -Lastly, use the Mesos CLI tool to validate the Kubernetes scheduler framework has been registered and running: -```bash -$ mesos state | grep "Kubernetes" - "name": "Kubernetes", -``` -Or, look for Kubernetes in the Mesos web GUI by pointing your browser to -`http://${mesos_master}`. Make sure you have an active VPN connection. -Go to the Frameworks tab, and look for an active framework named "Kubernetes". - -## Spin up a pod - -Write a JSON pod description to a local file: - -```bash -$ cat <nginx.json -{ "kind": "Pod", -"apiVersion": "v1beta1", -"id": "nginx-id-01", -"desiredState": { - "manifest": { - "version": "v1beta1", - "containers": [{ - "name": "nginx-01", - "image": "nginx", - "ports": [{ - "containerPort": 80, - "hostPort": 31000 - }], - "livenessProbe": { - "enabled": true, - "type": "http", - "initialDelaySeconds": 30, - "httpGet": { - "path": "/index.html", - "port": "8081" - } - } - }] - } -}, -"labels": { - "name": "foo" -} } -EOPOD -``` - -Send the pod description to Kubernetes using the `kubectl` CLI: - -```bash -$ bin/kubectl create -f nginx.json -nginx-id-01 -``` - -Wait a minute or two while `dockerd` downloads the image layers from the internet. -We can use the `kubectl` interface to monitor the status of our pod: - -```bash -$ bin/kubectl get pods -POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS -nginx-id-01 172.17.5.27 nginx-01 nginx 10.72.72.178/10.72.72.178 cluster=gce,name=foo Running -``` - -Verify that the pod task is running in the Mesos web GUI. Click on the -Kubernetes framework. The next screen should show the running Mesos task that -started the Kubernetes pod. - -## Run the Example Guestbook App - -Following the instructions from the kubernetes-mesos [examples/guestbook][6]: - -```bash -$ export ex=k8sm/examples/guestbook -$ bin/kubectl create -f $ex/redis-master.json -$ bin/kubectl create -f $ex/redis-master-service.json -$ bin/kubectl create -f $ex/redis-slave-controller.json -$ bin/kubectl create -f $ex/redis-slave-service.json -$ bin/kubectl create -f $ex/frontend-controller.json - -$ cat </tmp/frontend-service -{ - "id": "frontend", - "kind": "Service", - "apiVersion": "v1beta1", - "port": 9998, - "selector": { - "name": "frontend" - }, - "publicIPs": [ - "${servicehost}" - ] -} -EOS -$ bin/kubectl create -f /tmp/frontend-service -``` - -Watch your pods transition from `Pending` to `Running`: - -```bash -$ watch 'bin/kubectl get pods' -``` - -Review your Mesos cluster's tasks: - -```bash -$ mesos ps - TIME STATE RSS CPU %MEM COMMAND USER ID - 0:00:05 R 41.25 MB 0.5 64.45 none root 0597e78b-d826-11e4-9162-42010acb46e2 - 0:00:08 R 41.58 MB 0.5 64.97 none root 0595b321-d826-11e4-9162-42010acb46e2 - 0:00:10 R 41.93 MB 0.75 65.51 none root ff8fff87-d825-11e4-9162-42010acb46e2 - 0:00:10 R 41.93 MB 0.75 65.51 none root 0597fa32-d826-11e4-9162-42010acb46e2 - 0:00:05 R 41.25 MB 0.5 64.45 none root ff8e01f9-d825-11e4-9162-42010acb46e2 - 0:00:10 R 41.93 MB 0.75 65.51 none root fa1da063-d825-11e4-9162-42010acb46e2 - 0:00:08 R 41.58 MB 0.5 64.97 none root b9b2e0b2-d825-11e4-9162-42010acb46e2 -``` -The number of Kubernetes pods listed earlier (from `bin/kubectl get pods`) should equal to the number active Mesos tasks listed the previous listing (`mesos ps`). - -Next, determine the internal IP address of the front end [service][7]: - -```bash -$ bin/kubectl get services -NAME LABELS SELECTOR IP PORT -kubernetes component=apiserver,provider=kubernetes 10.10.10.2 443 -redismaster name=redis-master 10.10.10.49 10000 -redisslave name=redisslave name=redisslave 10.10.10.109 10001 -frontend name=frontend 10.10.10.149 9998 -``` - -Interact with the frontend application via curl using the front-end service IP address from above: - -```bash -$ curl http://${frontend_service_ip_address}:9998/index.php?cmd=get\&key=messages -{"data": ""} -``` - -Or via the Redis CLI: - -```bash -$ sudo apt-get install redis-tools -$ redis-cli -h ${redis_master_service_ip_address} -p 10000 -10.233.254.108:10000> dump messages -"\x00\x06,world\x06\x00\xc9\x82\x8eHj\xe5\xd1\x12" -``` -#### Test Guestbook App -Or interact with the frontend application via your browser, in 2 steps: - -First, open the firewall on the master machine. - -```bash -# determine the internal port for the frontend service -$ sudo iptables-save|grep -e frontend # -- port 36336 in this case --A KUBE-PORTALS-CONTAINER -d 10.10.10.149/32 -p tcp -m comment --comment frontend -m tcp --dport 9998 -j DNAT --to-destination 10.22.183.23:36336 --A KUBE-PORTALS-CONTAINER -d 10.22.183.23/32 -p tcp -m comment --comment frontend -m tcp --dport 9998 -j DNAT --to-destination 10.22.183.23:36336 --A KUBE-PORTALS-HOST -d 10.10.10.149/32 -p tcp -m comment --comment frontend -m tcp --dport 9998 -j DNAT --to-destination 10.22.183.23:36336 --A KUBE-PORTALS-HOST -d 10.22.183.23/32 -p tcp -m comment --comment frontend -m tcp --dport 9998 -j DNAT --to-destination 10.22.183.23:36336 - -# open up access to the internal port for the frontend service -$ sudo iptables -A INPUT -i eth0 -p tcp -m state --state NEW,ESTABLISHED -m tcp \ - --dport ${internal_frontend_service_port} -j ACCEPT -``` - -Next, add a firewall rule in the Google Cloud Platform Console. Choose Compute > -Compute Engine > Networks, click on the name of your mesosphere-* network, then -click "New firewall rule" and allow access to TCP port 9998. - -![Google Cloud Platform firewall configuration][8] - -Now, you can visit the guestbook in your browser! - -![Kubernetes Guestbook app running on Mesos][9] - -[1]: http://mesosphere.com/docs/tutorials/run-hadoop-on-mesos-using-installer -[2]: http://mesosphere.com/docs/tutorials/run-spark-on-mesos -[3]: http://mesosphere.com/docs/tutorials/run-chronos-on-mesos -[4]: http://cloud.google.com -[5]: https://cloud.google.com/compute/ -[6]: https://github.com/mesosphere/kubernetes-mesos/tree/v0.4.0/examples/guestbook -[7]: https://github.com/GoogleCloudPlatform/kubernetes/blob/v0.11.0/docs/services.md#ips-and-vips -[8]: mesos/k8s-firewall.png -[9]: mesos/k8s-guestbook.png -[10]: http://mesos.apache.org/ -[11]: https://github.com/mesosphere/kubernetes-mesos/blob/master/docs/issues.md -[12]: https://github.com/mesosphere/kubernetes-mesos/issues - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/mesos.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/mesos.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/mesos/k8s-firewall.png b/release-0.20.0/docs/getting-started-guides/mesos/k8s-firewall.png deleted file mode 100755 index ed1c57ca7d0980056b9d088b4d3822c4dc0fd223..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 88722 zcmXtA2Ou16v|V*|t9Mo}(WBQ5qD2rywCF)d^oVW|L4+lUXh9G?T101cBBDj~PW0aU z`~2^{Yj<{L?97_k@4NThbI%p2tF1;%Ku-XHK!`QeRrDYb%tG+Yz{3Q4cy$BVArLr3 zL*<@3fkUQ;EjhdStR#i|>&G>GVNH&>Rl$8E`vQcz2a_)EqHDZGVagf*6G}HiVXlSUb zs{>15H8q)AMMXsi2ObkmH8oO-ip}6xO-+HG0l=y+*7&bMuBIHheZEG!%z z9-f|_zArhbtgMWRB1}8j+$0jZeS;c`S>Eq>GaIFFe!7TKygpr|5iH9vqg-5Qrsk<+d9_Vz~o zXJJaL8T~W_VP*=7vXa1(dY4@@dY8-Wot>TS?CgBO)6UM(*Vo@_OQ`0CXw!IoukTy@vt!P)M&wNr#JEm4>&VHo(MkY49l!3g1q>P^quG(nng z18eRh;1Ck%1-2YBYBUOK>N0d6irJ!zw}KzmmZi%BBU-Sr_iLSZh&rP0`qSAC3R{bLc@`^JkMB`!8d~$z*VhMw z&BKH6`nBGFTOJ-BPEL2WP0yNj{rvpY)S%ait6g4~em|;hvMVboWMyS!WMpOQ>*~M@ zm~CJk*yO~xqK%rGnjbXC8tUh4>Sqcj!;>fWuV25`(fMjob~`lQzQx7Gy?qG}A3vT0 z1}CAVMUSdkSXj6O1+jP??~e=*huZ9_FpdHPt7_%GetuAJ3~u-vCre99Z*TASrIC@5 zn?@3;ecD>L_8yG9_wVOEfOA5jP&X^@R}Gq6@oV6IJ?R#-v9;w$Woq;3?CRp?>g49) z`U)oIf96p;wYkaPWSEzCM#DS%IXSsS(p4d&tJ*C~*9e%2iHWhXv4zF#*x1<2#Ke*l zxDntuKPRVfq0JWM$;nAs@H07?nwko(9f{9aSzTS-T>aYB75*j*%-P{eeI;}dKEdRR zAKd=Htq?H)@8WxTx(B|wws6ut&%x23CYZtK@$vDNmKHG6w*RyF`T4;?GSW1_j-KIlQ#A1pL_LQYkYh> z@Q7g9mYt1N+|~xx78e(5jj^e}?hTe&yd+dpkSeAOHPBp4Xb)`Yqs2{H?7$ zJw06=^1;E?r9$y*Ypbi9tE=rn-nVz#&kqbmVEX?pA2{7_fa<`@bh5)3;93pgz{ z4AXA&)hm*4EZRj^nU@m4t&|pdjJ=SE8gcwqAd>P6H+#@Qbd4A{yT`z$+@#nryT?{I zAz_8$tW3*wBUJ;dMu3oMlPoiG37F*)GT)lD?w)oy$(PSgG0&ous zi;6m|<@geNazvAr3KDvjH4`+ZW8gY|nT<)`H;Ako;D)7wB&E@3e1WRCGbD7FJ{>9@b zQJm!X+PsP2;tR|KpYZJ&7ZT%!_SlN1_KAy&bHx{Y{n}|=Zd77;*Mcivqjc1%$^^U< z1OxhL&5{qj%c99zS-M~goIsby)$T?2vU{RtG+5sS9*)=?Tz+8!U$jZ+iuJr@y0*O- zeV<+Bh$9$%+rwdRLba%m6e)abY@$=7J_y-0y>4K1q!)VAu8M`RJ z&(AL;Q2OoLx8maBZ{OHXOwG;BfoBB%5jaP4^UiDF0FI6pIy*ao2TKZR^=-VKZwqgx z2)nO%IZvvit?l*tb=1cFHxj^MbR4~cvsr%x&J4Jf_;?C4$N-biE}7pd?U{)1>FVyS zXWN~Fs4eih)ovoQZ>=r6?dmF^;f|H_!?Nfi4ymr9VLt^aU@C{6?p|I$g%*JeWSqxY z4d>SREa!K8IGFA9?k!ANuEE#a$H&Ll*Vohkdv$gAnB{91)E5kFw+`#LK%J-u4<7XP z0_RjzRCMP~5n)u+!G8vJpO&ob`>4d!`Ue8&1W*-#RKWhjQ+8g?g5X;x4D-)IHW&63 z6aW{!2O?2qWWn0=DLW%Enb0{)TTf3**UY>;?)V;0dr|quMgXs-leIup1Oe91Pd2ux zwpMz4Y%Eq?OiZkOVecHECDBMzIc7Ds8L*Fo97G37j5q9Yt{jZf_p`x3W=5&74;m5S ze^G?(o;NU;LZ274t$Eg@30C(md+oWlSXEAzR8?_R(#;n9OQ8pTN@DbrlcOX5NBXD^ zOEJ-$Cp=38IN>}6W?67C&QIKU33E{vS&*_h^DKkHKaN$Z*?%3xOiJ`}Tk$){@#h(l zFsUvjf=KL7P^lbY%&xgyjBtn~qq4V9eD5Bmj5JARcVTQ7tBM6#-LQ6mjNGv8CAIM*gzn$ z`gHEYF7?l!KlzFZVfnh2@+4?-BI(pLImo>}zk9d8 zzh6;N0haswx9i~0pFcGxz}Woujha0IbG_HrJy)r~>JjR zA-htnrEtXPyAEq_>36umdvcItd>a1 zAKCiW)z{xmCb}q35}|7hXv};V{`PHz784y^%keF|;D{pU;s$Vu>+9FAXhBMXFn_^} z)LWm|5!L|$!ARl=cqA?-CO%VTe&PIrI;z9E94}4a8%; z0KD91zPUUb&eJJiM7~3}ZG@v(6a!B|q83hi@0o5sChq5-7)ePdNo`tDt6>Eu4UE|A-VhpVZo;^IOt&VgNAoL_(w)z{VU zLEjlLS8Gqbe)Y=h)ho~2`<=OMYGP_?^sT?<+*5`aS0Pb5Pp{yu3g(SFnBap({4ry4 zahYWhQb`W-y>nj`tYFK5tvxA55SBm^^Hi|9ZSDKtzW{es)^^%Tq-xn^588^Q&@QDq zY4Ja-Fe)~T8u=;OG+}a1=8x1a&Esc0gy?xi8;0^T(&E0y7{l_7>t<6peOU%=ZA`FQ zRJSr%tA2z~U2 zY|iCv$a70+2ckDpcn+|XIb$i5c4^mh-q5`KumPqFh@Ow_fj7+m}8K#sA(hV7i z03ojdUx^_h2ku|dP07_Nne;)2KWmsSrFuQ9Yx?8~^lQtS=il*-2tPyuax=~S905maLSv=Kquaq8hj_RWz>61u5CK( zgQSR7lJLc09mT739{##l8-GFO;YjuV%G}iS>C>ksCYZdztw-m+ZUK!Ey3YUrcLGVF zlhbQ^n(lY`*tG9sm*(b>wC)YczAkwF`K}>tfW6QamzvwzJw5%jAGn#LBrAbv9hUGW zmHCG(O;Y%In?dyTfs4Krb=8m*Pc0FUtE;U7$wOnuPf6JhYcl>m;L;a{hAvx`nsh&< zr>3T*S(D8zEwzJe=TD!t;zJ#shv4US8LjgkpbKp+Z99R#Bm6r-m^9=y1fN-Bo{al7oaA z#A72lW&ra*GEJ@KzH@XY2bhSRJaX&G6fErW)dO>l zj1GRUl+w1E@-dzb4jXr@mHr1}80TA-aI$oS7%mfT`+cd9sFp;EIHZn7uHhX6P0g!B zzC@GkN6-I^am_FzG5bOt)JX7!Yih z78g@Sb?`tVI;s80F`~KEv!|du%mx$)$)-M>meR;_3DAXu(V3W*7@EE;0oM;^-t~}OC7so~7E5gWEW>iVw;8h$ z>R*2R_-kDbhG%NuTL;JrRN1m}yx2e4$r1LJ_PuK3y;8}!lvk?pgJw2AjQCaKBQ+VM zuuic^SMc8~5EbIUxm=Zq*=umICG&YtuL9Xa;W!B}D-G zBxM0l7cK?y6cWAY=l~&;bFOuNXb6n&{h|H!b$U@{y#TVIN?pswh;$Bk=H1h*~r!}rq#|MHWq_)r}*0(ryEKca0_w7J1=(N(yHV{R9ILOR{@rHW7FIn&_8xl zV(S;xmbPhVXh>NU03oV!j8eH-SO{VA@_I)L^--jvL7cKLD=H{_kwm?N%n0jdut7Ms zRdV22dFu)!nf*8{eVv_LGeUuY@OWx!Y60f{zuW)=Y~4*LMOi~dMOlqhb6M<4NYi+2 z?Rc#;p2pWa`>!p#IuC(GqfqQp08uc}(=*f2-QUFTA<91Y^OdQuGkTh#Z#11ubPT@; zH_9(5Am#&0CXekFZg@$IJkxY=Zz z`EdQDM<#iH^B+5YT-0OC99aYD_l%{klUS>#h1%>CSA5J({>a*!TG3WK$Op3)q`uKJ znu`LzbmTxYgb8j$FkfAB+YH}2>1Tr@kP(Ne4aTg%*U!1HW)d{)@Tggn2oQ3 zb0E3Ye#0Ik6Q2G15eSV-b|z0Eh+cRZM&?(Im^i(xl1Tdrrd5`l>n(+egB=K*<4OGX zhxSk3=TD%BYqji0Y|J74!5`uL&@8;C9OS+*NaluVN~)=eNy^aL$B!R>{E&D%c{_3* zzQkk|IYv-G{$-Yz$9ZDydCLtBAQ4%B$xOGyRwnGgP9s{~-d6qAFCKXXLc|^3Pe zF^Y&3FElBQ}vuU}gA)xbJu8?L97g;kP1wqEu6P6w=EMR`e<%#J+ zv1HrszUjTFP1qx|jsP`@2p$c5^-cNT{;sZN)y+CWjU9iFW!OZoA1Ec1)z^o|6330M zuk+zcBKBdESb7d1<+QdAiNm0vuo>qciM}OD0ptV(EHwNait7u2XXeqyTF>EO=Eqq; z-i^*G3QI*O{sI`G>H7LQ7(9YMfBrnv)bx1Gu7s@ za?%>{CLy3Eu5Oo82~z|r6}qoUZ9n(Yn)^csDiE)^EK2t|M#X}k`a!#OtKSgSPg~JH3h75;9YkgdI+c6>_VrGVxV)Vc4?s~2JG=}065~*en=8tYXQV`y=Q8&mRUZYL2 z6rN(V6E$|^hvP@YBaAG|O<>fJPZ|WeEBPKW=@O~LJTYdB_psbf;pIXF#k8ePB z1mNlHY(|!l4$qC6+8{q<{?EX!@H1n;(KztX-nw=s1|~YNeD>-p?h!)4iLN_F|4|TN zMVy^umai^TS(q@+l$h^hP~ye@>-+sXs~IAKv5q4JQ4+DeL0$|_y118*HiD@*5bgHw8)62lX_oHRJBXK3I_JvsUOJc$H} znqi|L5tAvQZf{C<+6fEs4{gaD1~hfLc^(#;UAN{rg>Lx)QaFFU47hU#E7;#1x|hH8 z9e@7bV+qxgf#JbZyF`EwrVRuH`yyda-Lzfx_zSO8rhHONNOI%w8g}r`TLu|OHlrnTFIbUU~&wfE0q6AH3l60%Md|z?!AidDSPXo#3S7kvi$W|6dC*5=r|bFE6jO6m=g0?i@Qi z3`#^oOiV;_OiEkC-ux370!dwPA*{-~Wt5s7`B6};NOE5jV!$u`Kt(~y+%$GAx5 zd^-5bsKJjxe%T?twEPcZhV-EYm?dI#77JS%`9iih-qB{7LvjeI76~h=p0%~I!a_$r zOMMaMf%_(}`Ji~OLOj{o8oyMK7b7&D^CsS`iSi`Um{T>1&5Jl5ApKca_4tHd5NB2^ z=is=zt#`41Z8U*9d#};2GVg?h%Z{89MWW}JpwCpkWKKa0vBHCw5IvdS8{QYPTHi}% zDeb^cq@qepOoVT-UPE!SQObZi_)fpDMMfB#g0jY}GI^*@D%DkPQbO%1pCzhsrvAc3 zH2E;Wks(?uK7Y{Rl}Y10l>8rGHAhJ7fkCSMGUV&J4L57>=N^Zljl-Nv?iTpZEt96$ zOL&%o>c6wc*tvRg;{gAp%3u@`B05fGcVPv-BbSgJn?b^4yusIkpnd zBo)+lCnjB{NG2vHt-KM6A+%@|$O}MX6A;j-iy0FW&ALXry1{FyI(M2sg3 z3G{Bxh<8lFfp;Pr0<_vfHeF@Yq zHm|~fi4jtb3IdC%gNPnYPd`-=0b&g>1z-eaN%gn7l7;GCzyyNw2pXlK>2{^G%1ND=_5fH=K7VC<#Qh&P(HJA zV@InK6&y4EY9nU{Fw=uPeakVh2?rfc;;*(2^9->cZ^^R17&pKm`1OOhNp7F{*9l z$h*-QHMw$fb`>a9g1AAMAR=Ucy)nu~CXcz^rL!}$DJ`n}J5gL!r5aDyiU62Smxszs zt#dBtOGR;U8m-@#_D8;5#KLb?5BA>yT=e#@(noWiflxSvhi7v``7!ea{^`9z3Qj@) zgx^{O_xLy=o(0mn>J$1c%$xGlgwYspP9M@MFL1y4pwZ1fz=mP)XzxAaLyG(y-5r)N zCXNS`Kk0dXvL2xyBn3a=b`1XA^ZS=UpmoA}Si8ak^~VIPqY+2Gy6gcGGZj9R;luS( zEHAxfbKrfKMRWBcy|kJ72Yav}wvcVIu(@1TZjQK2Ey0zNI6eY?yiNQZUP^c*!~u(d z9%c*ija$|y{!D+czP`SBEK@(NO@^zyJz-KIX}J|_S2^xKOwk<~0BtGkU%~P~1?gu% z-dibC;o&-0Y$1>&h!0G7*sb#n9vszO(HjlV`IlsxT%{P1ksn7N>?vwO0D}+1`;vmv zV!9vj9T)FmECL_!`IqXilna^W)cGhNYx@460$TN>DsG%iBC~^il>Ibax0-p|*vaCx zWaO7vQQ(AIj`NzESw37n(!L-iCLtjqIzBl$IX*lDXzW#>#^T6JY``Eq*`5V8M-S1Xb-o<>xL-L!308bzbg8b_Ok|R*N zoL>RF-rO9_@e&Iwv@B)g~O|^g}t{b%3^N?Z{Qxqi#*yKii``NNkH2;$B~>O)PN1|r{>%G$=)LSgq$#IOhGTh6VPPGJM~|ObVa?Fk z9V-z8|K8P$W01_kW65JPVaWAGGuLis8lWaFLqCvf_K^|eQMg$#G`f<~lVsgMi*)QW zwS7O(%gt5bHV8f^dd@&69YVgq`bOzK-%1oGSnDQ7I^dJr>Gk8x*Ofg(s7seAL4pX# z7IW6o5-9zB23L4i1?D*p-ew<{$HRxj5&S<(%3nyx796Y7qTpyycOT#S zF=4W_r!>w)2A9I4LUffCiaoH-<%3ol5DIRn$c|7p%S9?C^O4Y|JcO zVNmH}Cv!N;stu*m0dgsKr~9j?n8C=5E04;VR!jKY;zP`VlX7m=?8vvcq9Q5_pS8I3 zqoaTIgrA(=`-N&?p+Oop0$T0-?QONiJAg4Qh%a5~8_JV~VJS^L9j6Q%tuY6G(~8lE z?FrG?J_xOhOj4_GaML34hfRG+vEul)m|Z3QZzc4Fmp#q;DT9vmw|^HEx?`5Ya=wSFoRoo! z(UO6CQ5OE^Yk7({XZ?y-hqvsx!EIm)y$blM%}-q|A^Fxa}D@lgx-G zsvAMOSL&_~dV3#uFS8xOd1ueg&cIv%${l9TM92t-da;`Pn~M-Zg_?6FW)RR=Hn%rF zP++>@|KeI(T8i+y+}g_8$~dCTivVYdl*?N+x z2&?7)O*Ed^+HDn zOujosg`dVyk{~1y&}p+#KgrV6dxXKw^8G*~hn!;;Fu31hdzXm1gIhRA;F8P{7~}VQ zazF`(FJ3c;eCVc^%Dq5~FHU`lpjIl(>-N)@DF_(KT4j5#@hSJ&$M(MZyaLw z!sVYWfPyB!?y0^OVqEbZPKZJvr~`jD;z!%nPyYkqKpT1hUFw~8{o}U9jD740QT83U zmiv(JA+;MDc0)RUIc7!lza(oe>pm;zEDXS#jA@)H_ zV{x&z%YVU+JjDx{pASBkirZqEi@+0wNt;b_jM0+iwSH_G7F4b zZW}&XUnlU#p{GJv#6pp-B71Nl_qi%pIU!;*OVS1Wgfrt}SHK3ix5{E3dwIRimnJ70 zKmIMzqBwCyM^W}2yH_#)hK8EPqgIamN@M0q5e$2f*8tF}pzyiRZvObLg2M0jRe(!V zQw6*l@(@HS-ESb~ei_X8DUUw#@|IaI#7ia4--~ziPC+ilQH?gnIM*jz?9rv)BtXsfsInq zM9{itv9oB%j0NT_CLG46lZ0wjj(0QphfVmw<*TmaBT)N(htMV!TA*|gn2lu59qKnG zT#TH$HYy$6&~=6#4x1v!K_D*UxC^PkhK!U-(&}b$Q!#t&6%|-5Km-Ke)e;sx<||Rn z9$x!SFK~hQLoaA%N%nTovONlD=jzi7PB41@1nqeFF$xcONz=1ZM97~`(TeP)BJ?wosrp+)vTl;+j>>7!J?v}O@)E-SG@?xtR& z#m?N;582xk_Lp;oc-)t}(p;mm z>}7jgWAQ12`*+Z*#Hl&MzurT5^VjDS^mH?ux5CU#a)#*hD@Cj@P<`yj_LAivTp4Nx zgwb&2a1^iyhIfJv`Xpz)7o)-SXxRJ5;L>!)6&h60bWdBW%8M&$(NVdui%{qpn4LiY zcDX!pxDycqrhXv;Q4_Io+R7^{cB%$bPW!ya(nB13pL~k;(*oS^&x$b0?;qaxHqWpc zwE@@e@RL|)YX&ZSQ`4occ1MZ)!=S*v{{EGHAQO{TzvRkuesd+}daI|jv@B~50y-pU zq5S0o-5chOsg2vKcpK^>D|y|fyv4M&d+Ox;Ty>;bBr&8-N0}`+W(;`uNLBXJAd>Lp z{ft@og?)4b<9=wCB?mnSxGII={DV`hmLPZ2(^b|}y>g@`u7OZyPR4f}12x$3#XN-VEN*qt_l>xp zm2@a&Nc#cd15yKe?}EFr3M?`L-&itOnaRx+6A}{}=&~3)WiLnD`{Iq5QTMSG=1-z& zW5qBC!c^FTZ7DRG0nR9R>=>Q$$HSHZF&zqM3qhMayy3^BW7n5G>n4KHOFKn7H+?f*r$0Bm=3aH>RH>G=k7DM8NPhnxE6E5>iXN zFwt#E>yELC5qy|`uCJ7_w!OWvrCdA!X2AU0rW{rWN8f_bxz1IZ0E_`*1SEo9QTjB* zhiP6SC}$^oo|f2Eg%vQjV5(D4LKLCK>yd#mm19;OO^@+>qj^M``PJHXtKItyIwouV)#CA-oaT zl-?I(-_`ZpcLY$^27$MNJA3Y&I}YbNxvYjE*MWAp1EbtTOgtgCvLh#u^gM4ViK7{c zU2VH$A%J|kR<#k)J77KHo(#&zaQIFt%4#=fp^rsxLHJ6{e(|wml~T))ZrK3L43r?5 z>|Z=LBVH%O%^v)v`AwXw(%41J@kl07HPlzp`1j*T7y7B@pKCXq((=za!hElj>{te# z!MjG?M_4x?OV4FYu5%f4pSepv7~&)!JH^}B27`|^X;>FxurN3-MCFa2DHk-1gT}{= z*oiHOHzGBV>p4lb?Qd_m98ky{UL(SlU-kWYgfT-jmwc$p>&ebFqy$952?SIp%y!o| zGJlQK+5BrZq!>w(Chvc{mS7m(1?BhD%qr9;d^sit%hTZP;x{{_u~O*8z0*sD(j7Y) z6qJ~3ZA9a+mpo2Bi~U0Gskmd>S>1a; z*r#MGhH$!*>fPEt_yWcjuWetafsLLhIKQwel93XN=xi>3L49;hHr2~Ei#2v-`z<xmzS1M2J6Depl3qA{BZZs?Foxn+!tRAn(W-4$$2X8#{)fEJ zf~Gu;K`A063cD*zEsU(_R%$MP`lQt34N5 zWrhe;O!@3woy_{}H2R%vH(ni2x-=gBO;tP}1W&S5ysLkyE)8e@Hb4XlT=|_YIa71c z$xu35djME8@ZxcC3|^bB&(meAErPC&H%bA?wl%slb=G6*GTnTGSWVLxpnekNlJYZ_ zr#Yea-5Hv}a|~AMt=qD83B4DjYifLAu&;&(kG%hIszWp$9#h8Xb}6#5 zNwV2~0u)e)DXSIS08>v-aMKLtxD!03)PYsNR3Kaay_o17b_6+`JLfO{2llzw?`#}W zRdDAX@UXG!!_TqwWA}t9R_^dVv{x^%Y;(_dvgn5CYJ7eZtQD)Xgt4<3z8X(}(+yvCE#HMZBkaCGYV z60UJmQ_=ss8QYt^>EY>1U8ka|$??~ioEx^xmerG4l$nD;Vy9g@2Q9v-4Sv(kk}mBY zAHMJY3v+ZTP}K#c@HjC2JnNhpG1Ig=Im@)0`$-+Rih};~!dLmxRXzc~9PnNSFA@0P zHRqv^zHbw!j@_0tu7dQW*k!)^Aod$vbamT~KG5Jc8JqMbM{z+ir7D69Fn~yq%-xb( zETFMb>(A^ou_{s^;U;o^XJ?0Hl?Aa*n$ZNbU$GT%NX2+LP#PCo2G@rX!CKKkh%uf# zZYC&6nsL+WuaKk`8FcH!12MJ(ElZFmUVHjZhz!Uc)==vbzW`U*|-m}1+ z;lIDv#nSA(w*Y!iz(&vQ9`I|%3&pdgc+gunH;6hrUtL6vb>8;Y4XV*VBYq~9~ttG_Fg8kCm3~x*%REM${U)U*|BmbK0dTe{oeg}`I!a0D^_Q}OJ;_Pi;G`1 zu2AaOV!QINNZe2N8>>Lc(RhiZ-@(jGh9wlP|f`F?&0GWzFNeQR|C;z4t}QKv_NQbpGn1 zMolt%;5@dBMaJ(}E0&WWnfLWOPV#aiElV8%p9TXVs*jKy&`ZIUN3H0J^&S3m__oi) zByac;w0Y3hmUPe0e9it`A>F(y<$7F-#hD83fY2=<6D;Ef^qZ?t0Ab$h!zpIu-ocAj z*d1(#nrJwosCP5g0+AgLhc0|b7-0bA`3xh$t}vR*>@y-xAbBII?065mzrQbNU7c;t z{q9u|k`!C%t2Rl!ZAshV>oqP)Xx#AKmrVTw3wu(RmzI;Sho@tBxSLTS zBz%yCdf+Y0cU8=f>27}8`tzv4o;e6KY_dWFi?G=*ys=%g_v1Bl`KWTP()gES%WS;do*Ts5Ocs-$I307DxK(K7;i8Fa+RVOZiw7QcywPf@wX-aDF&$e5 zkkl0?J+`7)S6EZ%ARbwXx1x7i&c;@G+|LIGAH6_jZMk@g$x29k?u)VMAERYX0hN%? zpMQfw`L3&#qdU1crU{sNXJ*d-0X&O2#%uqqGC(5#ez*XnrQItmMp$`L6>(3^%v73b zzd&j6u9X2O4LNslNxC;VI8Ww__xiP09NzZUwumuv1|G6iaislGQZwiU-ap01g;Yca zp&txja=_&jZBpt(udcuYDC`XQUIhe1TP_vFDOyBdp0&m)lH_^VdLE99nqTZ*2e5X+ zX7nGVYLWOS?!If%TFq5{_QI-}MfXe<_1m5>PJ{%Vx=y0R4j+QyJv_zda^o18d(8OL z0Ud0X70bH>)S%xC1~3df^OWAI2%G9$`|Pm0^JeC&AG^r^pgm&8+jmL1yT^)%Z7I5z z`hO>mE@!ge1Qw!R4&qEsCaf*BRrX*H?l0$jHe1oXrCIO$ zoou^timHH}lAw!L-CXfF`y{9XBq-jI(aqo9g+Sg(6E&!1cD9cBg?L%T2kDuaCAZ^sq7h;A~)_ zs`_puBysoA45yAoh(9{e=>eh4p@SC-8)Ox<$Ppcp35Qv7VeMJ!d<6xOAX{(jSkl9A zc0$fWP&IS*^7@E6>0ADnA9?dtySWT~e&N%YL1_c3b3mJV=gu9FbsrECnlZ+5|3<#W zK|g?mARjXmXUZS~E`_poJI-*h_d$)2yQ?eqIvtOCbe<`8B0bF`YbTV3q;4HjS~eVT zx|_B7x5SiYW#zs9%rpAat&*+u^ru!|&H1SZ348(ruSdEwN>#5f7ukdA>guaxwx;V} z8$bBG)Olqt6`+=n6^rin`ohIh_Mh!Hz7|I?O(EPC-B0K zaO?OQWY1yUkWbPa87IpZu_x@Ju7uQDxJ*<21M`5eTsITs zeuVi*wNuUNh6e9cV;$Ah1UiwUy2>6xbfO_Vj0n82HpF7~4ohv|`%jRz-2c}CR4-O~ zvx0=-lQ=AjgYErso+$Q`@xzBe-d*yt1kh(MnN}^9n9mnW@X6=urUTlw=oHVuEMCD^&`cQJ+ux#c~fYx*j z2@NPBQh|O|eKwpjg?_Fd*zf+VbQ-``KH!l@w*ksrs`m`XsYX#s%E8G=dDHcfl!#$$ zMs`}dVQNBga!Pi3Ox}1}&S+A`Wb)E+sXwSDPSL!yw6bUe0O=8Hk>wV^`|-yCy=eGO z!^O7jPSeHj`km><*E?I)vrT?GGk!bGK_@ef^#H6NY}dQYHeMW0*Sj)v+(zcq40+ zhAj&9W6Sn9?_-Le;uFW@$G|t;bJCT5BiAW8?zcz(f#kSkDq-P4+NqbWqY9g2BZ2Ho zN`Qi8)pK=CGS%r5T|!Sg$BCrP-XXpAr#oj#>!hs+sZ!J-M)w~Jz7@jgD|{jR4?ycL zV0h>Gl^DH%8^lDw!KVszuxjRJCcOzG5@XbSCM+7;!uP22aWuR<;k0u8D8PK-iIbQK zlOHcrhlqoGW?*wlN{Y#yyVnQ1Q|aP6dwYszH7onR@|PJssK5Zx9l~9!fbQCsM#AWG zUU(*k5_5Ie%F&}k&@{z1?+X4;fX8zW<$!=MS**-apgkV%$qL4AY5&R?Spy1CMH=1M zJ98GqXH^oW#pXtMHAmWpXkC5iu~q((m6e5IzNqU6TJXH(J#gNBMx0927D@RXAr-;D zAb9@MRb|%%PKCaM*5Cnm1>hMQ_OB4gDC?e0|Ve3Fx2eg=N2pk65()jCA0y*SMAF z$Nybl&$wjof(CCO!CW5U{9rm|v5SKj1h9s(!+9x-xqO3?_51KlnYO941CM`&U3J)` zqyT~_jGmBA_=EnbZ>1Dj(YCMc?6?v&f%xJ|xeb>*dqpw&a+)+P$fNhTcV{fwG=Jf`{T`O?mZY?|93hLYH~_qJV{k=+5BXV!BQwzxo`fM#cB2X3?X&K=hWms>b` zIFqr)X!Ga6JHM6>fWGhX$jIxR>7xANV)7?gx?$71LVLt2sCaSaxLwI4?$xX8KN*&f z5s$hlGpeWZax#4J@SE{lBmKAo*tUDVefr6mkgorobyEeNXfZ<5r$zqbY#uVkobbfp zgK98kNDlOk!S40d#S3a>A0K05x>6;B>{1jyWER73COjp$LZD={|6rtlK+B7jsKwD65P#--owl9yz^xKdzwycgG! zt(gDUgs_|y6VDL`y9F%}x+&(2-trRBoZZ;-1#$}Lx? z$~nYKh03V=v;_n1)P-xSq_TLoS#jn+G|G5M3neRvGTfFL1oXVBdv zDe(q<&rYFxQ3Jm_LvM6L z_r9*r)!=h?xI{_tNS})yK7Fp%x#)C1hfFU|gP-8-PIe8%M z9aqSCt(|yr&t#V2&y<{~=EdQoTcElEqSXKbCPS-UZx{@h6E8uY)>eQma(aO_enC6$H| zvQX8gu1~^*H0Nz#T)W{JnH>NZSK>QG;srNv*~AJ;CDh~v;GAg0L8k=U?t{D$1q&y z6q#x|K}s`YI!HOhK3188=GhFF}{NzCJSSe0&!nJV)YHz@Q6HMU%&o*@IgWV@W`( zQQh4?5Mhq~`Ga1SJvBwq#PRFD|LR|Uv_*LuXVVUibHOm0mwxi(1q(FtYGZ?v|B5x6 z&lx`b`#1XQbMz}saej+)@or`(g(a%R7lLlrF2SAR2q00?jOYN(;dk%8Cui3{Xak1V zUfWpVTIM%gsRgvjK^Kq4Dl7EjRFKO05r?a6{WD3S%8`t~2)0j}+_i|(zh?rpKy)otL#?fbpq*t4F%^~@Ex&8lYmkz~B-U4i|Q8tv7@ z8_sLB>DvSPE1{yBUz=__hI8|LE~}c0S(|)hkCE2Q@ci-!h1Lt-){C1~jg1L}ODLiaq`im;!jJe;){J{sNJ&Wn z?ShoFnq5LlNE zi@YAs5}F{DD8ET{=!jHN`s(6V<3v+Rv|id~|0Ry-%QsE`|C?^e3j+&@y8Sa z0m6#a;-Db9yXQ$K2GMGuI$LmX94OK`RwrW-M6xqPMHGWKvdPeTiJy*w7~g(LUdOY9 zSXZT42D99-XA_>@8J1C4|0b-3qyx~7L_H6Y9GcoE^kGCkLl;U6?q0a}z`YvXt%hAo zA*_v4AD|LM{?W&#aA5_sN>kwlzK-o#>9e%JN&H}Fus9i&A2g^pzU3}BizS7at)1*q zQE%f2)E6cr_}7a&iUJ!YH-9SgjJ~{Qkl_cu!Vk@%fX&n30lu{B_R;Tod8Ci;IW|s? zZ#jxC!Q`Q(rG?&cKS~nlcmEHg6dV*v46jqFggZDmJR4}ZVPj_-`z=N8Gz!jg)5}+HoQtX5X%^Oz!Q>TQ_ra z*Ff{p-;X0z7f#3!uv8J)-tnjQJ@O#i5PtV>&O~EX!$Shv@{c>ORC;9m zf&Bu-(Njl@XojAfSiqTRjlxS6%*PdMDo{|^;hf3mkwUPJj0;RI@syZuXfz4v)_f<^ zTZksK{^V^?rp1smy;Ju%Hto`{YBu`w)7$tjL)L09KK<^e^4QMW(D0>z3I6m>!n5O{ z$Ul>Lmok9P!=5N*mLt;=$nj`&5_Jm4hJUf9DE>=ZDw}oOY|O#|>H35va1MI?Bz?Z27n|EGCZ_ft=lp5#d@=SO68Rg5pC=)4CQOvFQT`vHsMj7%8!ag}&G7q4K@-HmxtA~kc3lqTn z**PCPsIY}@V9dF14{Q$%goY68rUtfy$6voP(%dPLwD$F>uJN$WLV19EL!>c0g8V3z=M^x1#^0RQMMc;I2c*Ln{3KbA(WUUp_@ zW&(>*rm@k_{m!08fearNeg?7wEnw&x!KyDm+cW8dA5ALVrHvya_4qP|zlZKW60GOB zySn~d^a(w=vOD=;K+{maxU0wY;6fsu!7D)Z4rPL05 z+}x^)by!G}zy10JME7$B%l`MLPLIMqe@>xXIfznN5W%Y=@sMJuXD9iGKdAoTDZ4p1 z4o0SP2?629{#Dv0-|G9>-L8;}vh*lqG3e<4&69J*K5%2i?w&K8V9r-qg6WXK13Bmv zKI9p2CtCz)D`i8@hNou<5l0?id(iOS#(rXphTbv?;Fq+^0V_R8d~%MPX4;T&fMKIaUZJ=_yVoexzxfe?V>}zd7u4 zko%20ml>E65Qi8@+kMNyCy{}DG2=l$;DenoB;CfRB+`|SQm3SCJO5@lf29dSFvvj# zm&!{@MJIclx{panWsGGGvD=noSVV;(b7%nB zGbm#577n|Tc-lK$t{JzM`0K$H!JgP|Z2|<_(t_Vw?ps>G72Pu50xI_ZCMFi9rAMXt zg@w^3vonY`%d2MlutiQ%wotpB!tUC5BK(Z3-=)>1bE0~wBf4U-+XSAN`p^hK-xO(! zA_2stQvdHVvtL^|swYV^7##ZN zvAkkpx8KXlh%tVYmxIrJo7e*L6k7OLMW7P*=T_=_>G>xGErut3$NksVE@z7bL zRt~@00gFS~dq=S3(%xT|^WE96@NMor& zuHN4Pz%-;xNg3GJ19zsZ2Xqd7rSd820*xJ#I}2Qif9QaSzUSlz_;SC7&J&HN+|P6S zhe1IVqdIm$TOa((HNGepKl=G2-)K+ueFj?CKV+7_BV`g~l6<0OfjE+0m|}W55v(K( z!ZJI0$Ux;&**hTJk68LI*J9_dZ^({l(N5kh^?${3T~2-mC`te(rhSGVzd7_p{ab0{IzG6XeJ1|S&d!gG*|so~ z+}XbQUMgWx&rI@904O#+YHA)iMJd#N+8cU&t@oTMezRQnf8xjLbzSh73?IMJ>)E>3 z#?8fUybakb9B_I1;4qTA6weH;n;s@&UV@Jb9mIFR<^Fq*3q;AV!#m8v*V_%9IQIa3 z?46J*3j!|M!e_)AK7q~pL5w86-x7XZ2*1{YpXo_oE)hOFIlu)x>mULl;ot4%QsSbc zrD*`uTj~2gO=Y9=ecywvv+Kx6>``wE$Z@3r;;F?w;Ms8!5JkAxHKep7H)r&vvcm&j zh|Q;5V+T$pj1bbZ=zQDvTkiht_w2{$tB8Hu&xHTlsDTt+8HjTcKG4foToGPGBFnf? zdU-Du#lwWQIK23xP@oa}s1ZUfy@m58r!5)(`)|lEOut~O^S^(>Aqm}(+=J}zcQTV; zf}WC;1jIJU-~rf>J$#&^r=z2zt1J6lAJn4S+S+g0IsDTAWux8Tlj4Q9i80ac(-z1! z%aFXEDL+-T-zkCjO>lL2aWQm+4~xKE43!qcW$qFF*V$+T$O|Oux1b;FsHQ*nPzxZx z5M$UG9*{)1(3`q2a$=rrhOMZSw!S0gceok!v6M0a%;c;29iOmaq7;SeGV@TX2SnmC zD^P!~e(%}+GhsVZ1pNI9g6*ZD08z;zlX-fc%0Q){*D>^6?%OjN4!KCFX;hzPBSPh8 zXz3hO1Yge}M^L{&z}P}~+uVbuQb{E-2{h>_%^jhHDvXO@BLIw-U$wP0o~HLE614YU zv%(r>l$0b4pf_l15KB4>3yWJ{E5C#ko4|dvGhlc#H>WLt+MpZ<2}sMh;GN3{r=3ht&}vtS7_KVm;L3lUrRF8>_6YK0Um?#tp~!6S;@qTklAhRo`!P z2M%SHErV5K0eQE83@ZnQwB&!yLorhmPRPEIf&I+;)j#RhT~Sf$HOi;{BhNf9NWZV3 zPjlz$8L0td3^*t$Q&LJ>7$O1|O-xSiWKQLg80AMMCX`^U@L#BMjW1SY3G_Ux&_n51 z{9dYhn)1WXFm%(`qaM{ddh`t^iEcG>YDZ6Vy|`^X>vfC=PCsNHGp>b?*IGcRn#7;iU9YI$d~@Haokuwbj?h zx$riA^9Q^GYzfnU=Io~DN|TBb;GLeI0pyXSB);wfk$+xEWo`L+54hRycs1L>bno8f zI_W$)pSo8*{Zw+g2s59XV~A96G7zF3NY6zY&>!qS7)G{nQvBY6+rP7~#5Lpyo~6w8 zKf|=*$PJu{q`5?uE&c*DBZ-{KT_R0x=3>|OAI4>v@?TAR^Gdx+`xl)X?1b0WKvQ2> zYX60GReMCcbc6mg-o$~{t0AX=lk|n8KFcv1GRK-|@+V(Rb#ak%I#2iRku$zkIlq1i zzja>-kMU__U(N~-ct$9?oK-mC(vaH-yvp3AKQn`m@Gydv2A|E%%wSlwrFv(*6QT+J z{VZ5UPDpN02n(Aiv0X!=ic5&wzV}D}s+6Do-5jD#qfm(ZhK!p`ACLfi_nNKlCNAJ6 zucyS{y&D~3q6cP_WY;f`C+~@;2G;z^HuGGRh8eV8b&;w|;kR6CYo>UfzP! zJW<{PF-~3qkzL@tl$1@ol6JN`%93V;FJ{~lVQd7^#b{n&++{>uKq0+c(v`|WBG^)XBv3cyv}Jwju~4$&WdAVt!Opv=Upy}`!DKEgh#bg9IS#OA-nj^qiC zC83HxXJ=v2r^A}Zp`xa~T9g&OqBXbslb@g8)x|Qo`^F|K89RkZTR}Q5DG9BQ@aI0- za;J;gO0f$sA0MIZhs8tBC-}K$BPAXQ=_x?xoRXs1d~ZH)5_HF$t@*Td${0SDxD0qz zhdqb4cy&G1dNvPBByEJHkqu_*?Z=NF`}>u;PQ!1J0Nu&ePpt>T@FNp2AVMju9sr-Q zt3x5;#6=Z`7(<28KE9B;zR>b2_#hRBbR&@AbU|{8Uos>cO&t#fdo>#qW{Ku@$~MI) zNFJ>U1}vn#v71ujc|nI@p^k>GsJ+(bK?W;7s&Np=Vi*&9vPYUj7$^|p99YBt1vcZ@ zQD4<94MTqV`_!C}ANvtrSWplO|J^Lvqs!a_xMS?yPIlwHnG4LqdGMK#Q1kSy=A_h{ z>%)y!{9~hrRhgK+>uaBr_p)M{k{E{_UOyy9Ov9@s-#0U3)uw-?j&Oax@m3bg)*gK9 zY2X~z#yd4n6atHsy32QF((T#AdRNF`LKUrAHp1KM5zIlpSpXxs>V084| z%tp_1?nj&_q*BouXB24JBt=-;?ss-IPeNwDYDo{fqq+RkyW=pChGm6_5TgB04(q z)7kO4Q~+>Jt@Hp9vxT|E8wi~brMo2KS5MA7dSdF?xv3AQo7!OPK&YviYB*i0=XP=o z3slxcIL4fWV!o^ncwIpJs**F`uj|PsO1e%vsCtGdFRuV+yzs@cLi|%(XoN4i#U;d(Nc#xj z)VhQ7Qo>izXnL*dKZJCMb9hh!;3x$J@eaZLvAd6~cBOJ0-unx2K%EgsM@Kis&Cz<4 z15Mb5{)yGS<`WWnoJ`K?)gm39`el?j>?y>UIj>*d+y_a@&v)-fcfNL zr37?jx^{>tVLQfew6UETO#Ro^z9;7Z22w&`*K&^nl8d{T7$T7v%E!n2bqU7{6^|7b zKM5tB8HGgZe7rRL&mb_R1F>|ly`P|3koorQcou!aRr^R3;J(@mw_WBLXnyx=xDTi} z?7)_xl!3!r70cH7A!oc#TN#HTxYCfym0dhCgLReh&mS+k-fPlcK{}%3{RCu(e{5ze z`>DX%XhfsF9CP493{{L8WCj>T+j8Ns`>x6Zpp&_rq4Fyj8Y;Yr#OK+uXo<%~&OUBR zx`#7&1~Xf{Qoe`ZolQ@zwwA8+mm|G*r0=b2zPSbmUu8Q!qZ<+j7vLiWBN=PAw{b9| z^0d-=UMyJ>FJ6R{Y7p9z^;`K0*k3!#42;rJp!3>e405iu_;vW*`IpW1tWX=4v3n?X z$G`KkvQJYI9cf0k=eA2a-{u`eczLLvqo`K7xfR7n#||v-h2*(3uaHKMI$K&=8c{g0 zV+HCa`eT0p7cxVk3#_4Yta83CPflj-Qo#ygngV;oz(DsXu{(gp?=t6Y`LtaPj`7o% z>kYU_VhVp+g5-UQi(#R$RZnle-jMpw%e2+8oP! zpg?|f#$4JkrnV{o-HiWXYM=l9%}FmEOn4}CVd;FivAVuaNk$fyK@yT(&q}_&wvpGO zr(=Ytiol#l-a6e^UZJDUWPxRyY=4_H`Ac%<>Ecw`_ubuHhbdO9ENvYHH&?gJw?;9v z;z0|u%t|q0PoIAKR`8p(tB0KhwjUc2jfdN+$msm$;jM;|EpSDG_6r& zJ^<$CSG|^ksV7n~NG0>u(#A$0T}YG$+{FSND3L5$wZVHGclX5_d$P<|2iamr1UJ{` zj3}P+vi6rIC```w?1l(kc1|&>%xhUuN2AsNNuoj3XNmBW^`V{Va+B78I}H6`$Axdl z;(UYQ;lU*-)4Sr?rZdfl&RiUSt;Ul)M;9r5L;+^>6b!39scn$-O_(L=A9s9(oCQYF{l5Sf2C&Th>C>IF9sek*sMy3u(fm-zq^rUE7l0B$=F1nX|5uGdajUe~w;{n{-tU{;bM5cdrb4 zLeYxj2{VwO#Fc!>$x7tw;{#6Ozo;j%a(U5DqkVi;KE35i?)R~BO#^UcU`#e>Fx@@7 z4q!q49twQzQ5^^!McuhM1C8YzOez{0lsA3+44ZTn=W&F1uz3FNR|gdxIxoQgmj5VU z;;awsy9bAd<$5s6kZcnj%S=MIT{!A2z6zf;&4kEX(iZtD58?wsO^}_I1%$|9XaDpZ zOzn0p?URs~z1odr8(I+U#ax3QNj8v-gB^~KV@8S1B| zXA7mNNh$@w}AO6 zT<#g-*)*=IR(x*qlIDXVQNVgU4igM^|M6oKE)FhkZqvLAfkuDd(zaCO1q$Ea2z6Dp z*eEO<6d!33Uf!o{82tB}V6fQLrIx~nd>9q|tKdJS3<(RnKTc_F^1E_Xu*|PJjP(=5 zvsARUwz4W{4o0=HH}mH+ZqP9_jFP&iH$F}|`j}xvc8rS1ds+GikgSK&#C5pPF*j^# z<~~ooMj{~j99U|6-)8bQGtfLDaGg>x2(@>KH%5>GO(?Rt8SMlii=Q5eii?v>%hUnC zfGv`!k`PZ?{YmI0);BW~70g%~e2!BkXE-|=&E)suxSY`F$FOZFi{04Bm`_!%moRlq z3r+QhX_SMJk%OEcK&P8Odv_4|>C^N2Y|qW#U&mrtg7)41w&-UPR!da6xLmTNd2b&D z3p21@tt>B(2DRx!z20V%1yWmm^-viLxlz+l1z64j<&ob0L4~1=2?wiEB9@uR=F|rC8}7~eB6ZB4Bo~2 zMGm4eiGY9y5?Y?suFPvCS;8RL$D-m^6WZl;b+(lzmwXRe*k0nWZ&~K z?OsfBgemQV@EP%SYy|Z6>(@No-0D)MR_MJxtCON4B4|LHT{Zjc$rJoMQ7I_`o|`t{ zhSk(mQRyqp4)Cd%X*&*CjU9(ys>L39Pa`D-CdHpQ($J*Qf-^mh;Z-kX46%vQzi<@VdvQy&!$K!dA=Vy zfk&91O{Vc}Ck0&7peLU4nI;HbRxE8Q7DKMjLzd`=-U@{VCkZOawPH`VA~^CZ8E}GN zepJkK>n&!1jWDcz@yoEjoz5TgWyw}wkN9p%U`>=SQAcuiyUWp*9dpmkPJ?Y^S&(jfK9dhs2m!jo^uI_gQzO%mHKu;)H zlE<6Mnh)#Tv;A5RNSnYP9Q>o-hhcS$`2XZ)(EXhBnSuiFMkS>jOsEI zG7~ew={IuG@jEW{^tAf)@yC{9Yh5nrN%jcd z2cu{96S2#J?M5#kci|UQ;!x7`nCNJh!&WMN*aye1eYp&dOqn@<4#`8=<{+a@4ldO} zia0 zWa2!w+ALbU<1rV zjvyRdyq8F=tDbVTY$E~zlX@e964U1<+23pR#-<;kl>m+~CT4A|fIpB{IB?W%M%q`{msBT=#YN z_4U)@!KhD9w>Bcjx1-&|r-FZD0p~EV(koQ5f2)6QW3zd1P^-^VPWH&_hsW#`7JQpT zYVRuBuzzCYI>xa#md00uCRp>${N1ctqsf=tjt`OeM0R82UiM1f68Zk%7XpIm*{T@+ zohgaOJ3EUqBI!E{_<`*tStMr7*Fi9>o>wn}&={3}R+uKCeI0RfsWd(;s!Yo{oGvr{rzgHV5SQ~A-D(n4`$uwvf;Nq z@LLAt%H>e>a_;hSM=li-j=Uh0x?Ef>PK=4EU3PO76ciGwBFS@{x3sfZr0VNcexarY zPIXmPbyXkzmkFs!c*Ds2)zyTAgv+k3%MgWpoZf`cf4F%l-YT}XFI|70T%APN$nVeN zH$Pfm+EV%B&w}(7pJaIBKNG+?Ar-d__a^j)HW|YXb|!3u-^|V$&(D)NGvmX$hrV9o zcj8SvBEN&NiBSB(;ckXsO6Ci6;oUY~-*EP`=bG%QUlA%SP4dW~Vku{ z)t;d*VR9TWk<}%$4lddB(b6(CU98!e#`5bfq8TzbFbL&ea z+Z;hRI{tz=l9Vz>`V#YE{~zwg-aQMZGk8Sw84rg%{4(BVqmdF6y3G-X5x!;@`i7>K ztHDK>NtLlNfOQlZ%D9o=B*2pu^NG0>uNqo|)MhpT_48>krofnhz}VO-6YRw4(+yze ztpE`T)zuFwl|u+u5FvezWFQThc(SRxy89s5Tjw%VsF4j#V0<@Ze98vKEdq@3Gg!;u zo6IfZMJhgGcC>4#YN)6TDKCsI$M&O;AHVUXKlsI74;$XISX(Pl4`8Dt58>7V%`A7g ziva4KfY3-g&TsQB6BmJ+-8{XBKuTp4ufhl!;E&UGA*O+TrAKRnkq~~@uJ}%thWf1T z1H>L#`lA@5i9sErUS3{6eJEM1Gxr}i>XFnA)LLG{!=DLDjtyc9`J9CQNA=yiTAh!r zNoJOU(yrp_EeV9*(2BI(3K+^X3hAh*sOV{!+N8U#yS#n5_V`@4B#3Y3GpPE*?*ZCE zJZ3kYom<_#_V5v)u)ScLNKmc@baeC@F;xIkh3CL^HaAMd-P_8ytl=A{5^M_ zbF+j2^O=8kc3O7tLkT&zS!nCZkto3FJAt9j?#g)^+!Amr?#pu}B z*ytFPx1K*SDu&AV17=1)x%(R%$CZe%h)8X< zFgU@o_JlQqGUNpN#SH25vM@#N3x=WqL=tB?2W9+ih2y>8`~u>WF`W4TJ ziGG}kKIDTmB2=*ICu|87%hmklOLOq%`tU&RB~yrB-0cRB%u&&PPgl2rO5pM`y@FCt z_wV0b-L5n6!Qf3Bs;VMPLVbh>G5~ysuToDqgTMRQ$I_Hq(I8tw&5?)*<Ld_f42X%uNwyyZ8U-AUv;LgrZ^O!Q!oXZ;BKMQz*ffaK6((Hs zR_I1UMSDufKuLN-WJfp@5K@oIOyq-9P9l7S?V;&_fT8^@XyC@+CVDO7u!Vi7>Dpa! zx4IAkg)SSTqCg`S?_jgoxXr$lTmGL5u?bqdg)Y~J(!2KLJAklG=`djV^mz`R5FgVO z<6c{Y?=!#JmzXDk8E~-i+WeWw103M$YGm@x%w0o)EcgiaYUTBo zh*iu3B}I}JC(2g7Hh;h`GM$w_qYJQ#{syq%mRBffEZDwU9$no7i=X)0fb5@L}< zf{`qw{~QquCMd#+e+QIBDiIC@oTjG`adB^>Om1f8;ObDB?cWOM^`@piJ{Z?nalXI_ zvjl}c&Y^(^$VxrAeibEMcgta@1!iFSXusf}898`(ER!RG{I&%-)^!lQ)G+QgF57aAG>dI|Vczd(<4db+%Wn!3ud7^#ggXGz<5gyN$)& zZ#59V8k;E9Snsh~K4Fw$)|H6+mSganhT%{s$G;lsxhV4ii+0Y zF8gqTAQ&GX1CRovs`~P!AWhup7FuIgQU)z0gQmAb*HEvHl2Q+XHO_T8?I_ zSA>ZN>3uXWCnpammMGx0z9(TL z>esRxs?@OK1kt*vlx3hOkbTv$36qcO2hM>^*JQUCV)`7sup7BGjAv$XSj5MRA~5u> zjgeW51HtlT`iQ$okMRC0j-{vjRUn{)^3Wn z`z8Dc@%ye-q^+%OYPV{CdY0^KYF43cnxr@xaqO(v2u*McMZkzWiNC)ONlP;~lbP`y z#Gnkp=%XeT4*Uz|%VfvwT9@y1k+;vb(IL2Ayoq}j*cct;t}!rfmbgNSB3d)LYC4gu z6i7+?T`a>>feFAar~8PqybU=*BQnbQoPw=j$+?nMhv@AJDSd0g6uPU)*9<7@AvPAPOr^TPgd4vWhZtQmv0X{P9tpH{Q|sf%=`wyMK-=n zvg{=$2Aqne_V%f1m!a#QUT2{hU^Iu6S65d9OyQtuh_K_6_$UNg@7&W@sB%cuB}Q${^*3 zrJ$u^i>-ARfd^{Hs(94FKIlI_{kx?-`J3=AKcT9h_<8}B zeBF$M*ux1T_rR*3Avr)#K=5vNZ)E1bY!7#!EPJ}KyX(H60rKi5>fMHUc{lis>YR_3 z3kFj79*oQ51*MLTwT=sHp(cW>7fc<+!Nl~~t|a*{Bk1Bpl#UsOp=%?3A+KK0rJKD6pc50izhTq~0VJmZV??*xrjlw~Z6|qmzZ7`0>yKIrDM1%;w2x!>m3LzF2-lA5R z{dD_HkC*SIT#!>#@72NI77KEey3Wh{?=F5ERlhAAm$-?7iJVc@OTwq;ilYdN&u%Ub zl;&eu#-#VDLk?2epJjZ+0u}1mn1iNb&p^TLvR5fR5BC`6b0sAu$%v1@=ccZ@3JD6) zAB%{Jjfz?rBgGQVPW{Ai4~;+Wcm#VgpRr5(4I?RDr5E{qP`y-2%bLv=CB7WOB<)3F zuBK_@H#3(Dj%D+t6LDughOfZcX6)$5OV;EHRC!fZz5fwSQ0As1P6HJtCEozpO8WWR z;H?wazmR&AO*sTEwAe%k4F-vz@94+DAP>1JFaA*sOkPD!kYv69E^oAjsj>M$)6BbE zRo}Srcf{~_>`OPwLYd0&N;)&im)A)fl%4lrm6oR{)nPfpWQSz<1J$mUuhMtIO3`2& zn3jU2*dX;Cm^*M-aJyU+j zhI}bExA~mhu@(34<|@#R0^YgV`#83iu}t+&fEfUYqs?bk29TrX*1VIU2Z0y;u~ zkg`G-fcObKk$g@aU?~xS>SF1RMntGC*hS9ZGJqc(48o=O#fo+g^s0_qfws-Anx^0- z=Rx8Hs9gIkfpUS4E)$ls3GPo|uCTJ;;e`Q+gvt)U6ZB_tQrXVlKI>T}j+uaD%y!S8 zKf19Dz?G&a8DMm>s`6rp^fSBHF`6Tk_&yI!OG`gOs%PK(m^)`-wN6vE30a>D^jo)d>bd-4XcK_qFzeIG{L2VqW-#jc!J!{2IFQ`nI;6} zv-rjN5tu}tgY)$G_^8JGFTw|vk$pMaHVhxC*LkP*1nsK+IR zs3TfD$6=;~`c^nL(pe1UfNxP9o|`Xeaiykg8gfgEr~DXFw9wg*mrfx6eFbyOIN|P7 zRMZP)Wk?1;n@CtuNWvw|T83$LWc__5H8t#91ym*)Bn3pKh>7v>mkEi~d_)`M8V~D< zs$7+fD$ai~ytLccEPRZTlAkUv-sM>_e4~+w&<_#fY#s^0sQRgYn3b;fQxa@Nl4I$0 zb#!vCdCeE!Q7c{Fc)e?t8WeeQ5yco%amT^Le^ik{D+ZmchnPS+pjH_=h&jy7wTF;R zJ?YQNEWI~*jf7j8OqVOFwq=V~?NSdxp*ZhyoAa9U@-j2R03W3(-;ueFk}fmTnG9r* z)E$nb-{2YB z1^`g-vWGxIbfqF1+iZk~M})9CgkyVEkceYOQolGwe)41RG6GWh!xWsy06u?Rac#LS z+wx36JTMyH>RtebB1@2?*m>yh{OHL;W(7!OtT@Vin>kL;X{S6h{x~_eg9Z3yB*z_# z$y}sa;B#~TfvQHE*v7^oNts2Hg+%#Q5@_y-%D$IcJVDGEoVUTFudlhP=_ws)|rq1x)eb{9Yz`y7zPW~r|$Zmhsh{7;W7-dAmV|Fg8Vls zD}+QQ34588q~cLOGNd9ZBD#)}SmQGW)Dt`_K-AF_L)W;xy}iD_zqf+QjpeK2A~KjN z))Uh$?n0A+$0%g+tWwj%W%ayoSo>2p$#KPXQXu7j+S@t7P>j#>b5crQkID=u^E8`e z6hsv^H24E@&*h^vVuGm1l^roNf2L+_4rzbFqirjOV~_M=?o48Jx7IoyeMfywMoa6r zasEE_!!jBk0YMA7pBf$|?1fY#K3Tggq?b>9gIAryQT|!NdwZML8%}cqaS*DqG8!)SJMEt%nRkyM_>3>{qTarmX^%e(4XLto5wigW~T+iB3V6#DE8KEx=u0XJh=Pl828keu^$Db!gpc zK(Js#8zm=1^ax$MVh9bcvR@8>Y!ww1AjfF7>Rp%Usec6i=m1z}laqD5BqMGr3AZlW ztq-vF3k#22K~mnl4NK@UNVMsNj2{n1t)nMmC*!J{3)5_T0>1LW_%u<2X>n0$QP2ta zO@jF<2ZF+m+65{iLVUu`EdYa|DSMqa2Eoi3v-xA^ku5hi@S6qX-sDVAkIrDRntZdI zo$0MB+1cKHMDyiKdfEa=(;lD0*;KVRGz6!cni}Xk%3ClO{a~%Bi3Of^@#O=MY=>Cs zs2?5}7+K>9NJHSe2`ubpI6NB}?C&3*m0eFnd7L;nsE!r+t?*SAOn{RUU`-hXh*idB z^c6R8Czt~0y^;5z%@nuyj?N$hdSUFP&~Y}{bLm*?2nCgqNsH@R zNqYLupVEDLdT`$}Ha3PW{5D}QG2wG^YFYx95IC2%w)U4?{tV%dNM0&+F`OQscVlje z`>e_sp&HT4!R?Ap&Q3a&oVD%`gNr$KV$jk4 zH8E<)!KfiDXdaKu1(X98PiJj?yuEKOiQ{|51Xl4^ARPIks396YZO}giS(9S|0$tWg=k>itUI96BHsQF~yzW zwB{w!3}kUjK>g;Bp>T*IU>A7aBO8w%xboap^);`Yu?vjee4DL}LYSG~!Sp#gDNj)e zQ-Z8&EQ%&#W7QZU19GegeN4SbZ1~X9iHu2FaDsb-{~P?dh5Ut^ZbedkhmDzCsD0!{XIMr$tx2_FR+r@g(sMCDpUn#4ue z!8BF;1WS7!e75p z<`npUT7XXdH)by-o2W-@EN`EkDCSYIsPwmP4l5Nv!ez`Acy@7%n4XbTzk{(04S%|x zxtw{(Y#SX#1pdCL*l9a%A9z(f^8(y#>bTYa=;dh_Ps(6$h&|O|O9Xs`C+`YnB_KcC z`C9P(ahTHN*m8iT0_2gGH8%s5%9y^0D3Ci$0ZJ#X!P{5zzf72l%Sy}POz}E;)6aZ# zbk8mYHbwp~HW@U@86-=%K>8sZj|f6WL9ymits!g181c;2)$Qc?M0UHU4GQ8l)6&x3 zq-{}Ca~2n?D8FE1XRY`yqwZkD1Az)uR@!JcKBA!b5S!dg9Q^X0meIkPpE>v4_i9<$ zNEMZ`_wRwR4D3Y2Jg%#O%&WQiZcFH$M#eMm<*rBzkXuqyRVDFZcc#)pX|@&Iwxk38 z_xYGvI*AWp`!nZyJXs8qFaHC3o(xHVtb?C}H7zCvFugt8U30_1M(3S)!s7QlW)brN zu-NU<(H?RZx@`=LOJuu!kn-H8^&cJUi`=tzavIUbf^cL=xvigq0zo6Y8->cby?yC4 zO~@-qWjIq}V|O{|$zomV2KbDFNQ=W@q|j6EZL$wy;N5$1@9oJ*Qg&yBr@|j3Jg$ZP zr{?FgzOq(0`1;<_TlK(cqxJsf!e6N&bZ$7_n$v!#{~nad*cOadOwWn{jPq3 zWi$)aMc^=Q@w*Zv@IGS7s&6m`b|*Jaw??0{?LVb@V8r#d+{g@RR1Ywr{UQww$D(DO zL!ag?ah)wX|8;hvY9xczhmRou99nHCwaYd3(?8yJy4{AxDjD|X9ba7Z0GI{}edUiz4M<0y0h-nmnZRrtJn(Hj-KjBx z3COk+5YF{*#70wjiNE_lz_h6;#4!m3CUKAf{7LB_!FZ)ijnY4X*KfcEDVZzuCAJWu zh%NsF^byBO4SZM^+^PTl1NICc$oxAVR1Np{mzTG&@JF>jmrq0Xk*auj;1}J24#WVM zb*T-E9zRT#jf^rhCF@vOK?a*L#;RNK@NE!^-z&5ADrJw1LbR7)gCHab7AkLB=`^l8 za2Xfd+JbTkJOI}yc4TCw%TY9xAET)4GId4_GQ36XEzPxSEQaO0>7?&fCzi-SM|x6J zQUW-yINxyb*Boxmn3yts%}+C^%#@PE+9fz02wC9-|G%>(b9Dq*S7v5X0Vvq6hO7?0 zV2-Mv`@Gu7jummj=y+;kZ2XG{^&Im$kd7M5B`*iPIp~%Li>fb@lBx#fiW-+KkxG~! z*zXxp?3NEMyTqKX8R+?`wC)*SU`>(1QqE4#QNnP3`fO@cd%EjC()jAcot*nBCy(@w z^E+-%RaK(CBSg;@@QWQBzLz`2O-@P0D}xaF(h_<-o!75rSn?jI{JEfsgoQ?jjt-u1 zXL3d~Ev93NrQNSe?1Zh9P0~bk2vBtv+v1U6^|yj)`{gBC^;yqvcF0I^uZElE!p^2mzSBW zQI(0{OJ-kBNLpq9KCGXmXc_f0b{DDupE>g$KbRX2N1+4bg~iHB(OvLuk10PM6&@-E z>PI0woSZS3JYu!gXny*?|J0gDcd_G;@85$>IOO{jNJpET1d423on@rPa}Z+&u+-13 ztZZ#LIfTJn6)+-Vrnl{$fvpPoBYs`KsB3s2{YwP@6&2-+wLQ1A%;``0JdEO>v`*zi z^K=cO!p_FR#`?Rb$3mjcUuz702zv^o=mei$y10Nl26(}_xEvLs=iF+_ayc~wZ{aHu zQGPfuj!^Do6Xw}ZCADpn<&YZC$DmNFQRxYOTBg62@5`3&V_1f;p~xP6 z{@(`=AD6CE)f{0K35oc7qhzYcYD zK^w;YQSg0@XLW5&ZEbZmks2(Iz`>T0tsR8gH8g;oAcipRWTd4CLRcYP#^c3{C+rho zPyIwQ3+CT*>weC`$H~db{Z1|jXgjsAY9br6?E{i!${P2;(UK9&lebPS-5F3a#dK;j*Rg5;JvfP5jU9*FL_fweVuZq_$Rns z?BK#lb^{6%ppX%~PE7#va=gRmR%)<5wHacy{(*ij5UQ;3hIjN&)fbyLw&>axj4MO+ zN5yRYn;TwF%2Eq^w*EbYOX?cFW?Qb{E|^L2-6dB>OoX}aB+!5KR7CD4exY%m9Yywo zNZc^VJmOr@PwH0~Qv}Gyok!cUA=5KxTw~upzdj!r{X4FHv$Bz!86PF2_{_ob)f3^# zX;FkzcVw_tC2`ffhaN8dN>N84zA_b46(Yg#{= z2^ik*iSt~sSh*B4*TCV4EXtPqU}wYb+h8txkWG$P3-0s38Wbgc7muDd(psR*%mqQ8 z4>YG9GK>fi8eosUICOU-ef8eaQ3`%fn_CCAJbw4L^`>B~{p%MnOyc0;L@TZkvWXyC zbtZeRz>8PfzajF>|M)@gb-e`&5~=&k-w({nt-@CSqh(eatT8(1v{^i*T!aC&P!uk^ zTa{bV2>UGSwhc@U!};!*0OfOKT3Tl2moJLEfmHCDGaqm%>2Dx@>~8M|9XUFh@dvo) zfx)or%|8f}ef2My!-vryC|V?$S3oHyy9q^=k&IiiLmA^EuoQ!c1ws*qsH_Aa{LOUn z2}nxpJw* zsZ)dUXa;I(3LDAImO1DyhoqVZrFP>D4YTn4h-$qH(SGJ}r{zTICLQ4qMiF zxO?7m<3N{y^jtUW1VXk*i!5lq%^%R9Fd7W?L_FA`rIvM2rrzha{9ad+IoOz(!kjQV zlUI*!bDrE}lsdp3QZn7s!5z?@HDV>DPEkNn97+;7oQsDBVd+DwKVLW8U+XUQEaaMm z#DS)r(AI;@gsJf=8i9ecr!?33Ny1` zg@sO_TGhIOtqMGuxqiXe;gYZLbpe6zQU)iiIh`mMPJL+f=Q($q66`kBJ=SZSpDbtw zJIIN3_o#0?t2uy8!U4;0sg#VI!tIRdOFOfBIUJqK)E`adEq|(~sq;RqJoc!+K^Xj! zF<`FOV3JZ%;L;XlJxtL|HT_|0ZH=EtLhX?Mdu~4u#D#=_2UJ;Fdf*pu@jqVE$u^7>KLF6H@wGja*;rX<>IEH2uA~xhqpdzL$)WSjS4or|5&tBqG6MEn@cx$aDpn2Nb(lRnSiUaF}r@HCX z*{PlpQg%`wd3d@UH|y|P%~nmzl@vSyTH>Dkx*at=C&gH?at!Tnt33557_J3`O%BlTG)Xpl-&9wv5k(z*#?LRe1!uP4RNktv zjfD34cSim!XwU738X6i_R@W5>$$LbYa|Re$6OHnojmug26zhE9f6FmCd`G43su9I6 z4*yxo<`TaZhD|LN1wnnJP9$VFx`v&Q4E1wXoo}GI#@2bpd68EQCdK z%?TPhIuP+t(1bb|PG%pR{c413TuNycFi`7FK2;+Psv8Xdt9bNBNMbN&okNHzw30}G ziN8>rpBo$QqLOm&z;!cfb(O8Ht&O)x^46_GR}^;4d*9sNJ}*6;7wAq9JA)c%>FIy1 z#E2gaKK<(uaDhbb5b*IfHZ}l$q=nV!d`rG&20srEXS*luPSnitV*G1a^jri3!AELlmb8uKgb)1a;LBSnq1FoLl-!4#^JAf^?%>b#w~fIVDu8 zM?Sx1b@W6F69$+O?T*A7o>~UC%)%9wd&7`Lwy$terGh!aggx%=fq{LgpOm{0Tq=FpuoK{cIg=K2EYQ`SAwu`` zM{>B4>S=}9*{ZysFD1(*$g^;qBA>-|^&kKdZ>kJ@cQn%6-F+CqB#@+cwYM*G+x(uI zI={O-02zq_`jrb)Q(GWt0`>zAS{#CA5JvjN`atzzh=ZyLCwbZo;wG&ZXPu9cTxw66 zs6}1kMPa_>F;}z<+?a~>>X`WOBn~E;un%^wt^;PGkaRcb@pEi|gbj2L_R@Th2ODMQ z+F9`9p%tUsVx9mw2iUCn`SL$zLFN#Ygs)t=f<+Hewi2^Tsu4=HJOP0bOmyR0bzutI z#22ij_G7QkfVN|0S;S{b@o#Z%6V;c za7UhCfj0t6Hn2E=6=V@{uD!XsT~5{2<;y1*Sb7l$6O`iOB`Q$@kjePFaNQRp_>Hl_ zy|Lcn@)vP^1A`J?YKK$FeMLnfAt4X|0hx+E3kXX?mJ+b8+U6RLMk=?`@m!_iB)q(e zF%^R#9-!7204M~E3zEK|!tho1?=XykwVt7sqhD%AjtsvCOt!DF-(tVU$`znD{s={o zGnEs(PpiP}{aHI@U>WdCwAa2KFq|Np0jw8Sw3j#^pCwE&7cVB2lrVnw?j-9Q7*MgW zjP^~qLxHh;Cm$Xgi#wc87^zeS`W%$E>FVk#RB&?InVK^8^u!Td_mm6?$k={jCyuz# z7`8Qv3R_>&5hwQFU9+SMrq63bA1cx1mU)8YCV^H zGfpvV7^y)9SrkVu>gwrrX?=0b$>dHtc$B@^VFk90I)JQ;Oz~TDhqO!6w z#K$j_XMOv|Qu*pGf$`jV0Vc*@WeN9o9`%-77vy@warW#^Ej5SF_x!}fiJ|`Ul9>L} z{W;lL*_oI8Q8~R6l}|TZVV;Ce434$EeE=`vU~`? zOLxMoQ2U*H7Ze|xWsiQ4{fKvVOEyJ)2#q#)`gAu2jhh2l`{Un6h!=sMNNQA=szg{G zk_w?JDZye6wNO*Y$tcWhY)s}5GI+9W=s28Wdmbe#%tA}=%Xufc4}Ys=QjLF%=qScr zHaJkOMi;ROGEkR^Z#-CS71Ipx{u&a{AD1-}t~&3N=B{Y-KxSqhaQO5>=dQ{zpoalc!;##r7l+ zc982A5cowk==u#0y%wecy%uL-ekFKuug$~}?m@G$ZyFPQFB}Wfx4gW(?x*AfR{ft0 zb{-;w4w)TQg-BReDOBTJ{s$qKmlobBr!*3z7gd~^&U}}4NHb{@scl^rA$bhm8 z_bec&n%JDwWd@STNFo-!Ue0HL+#V=ho5%oRFOPa>Y9zkRz-;FTz|->a*&U+Qbw&>dC91kORU>T&aXPH+Q@?3<38 zh!2M0*mZdGomUoXHM-t3tY0|$mWAGR@KRTHvFV^p)b6gV(x~fGu^hj)NQB{B)%f3W zK9`AWb?UIX08n&w`bVvYh#yIVtyf&ctZ;ZI zI9L#ca~RM&>@grrXd8(W85`=6#p_~V$d$>aTTkgl-R1ggt(HmQpbvmU3&q8$~k{#NY2$j~5Yt>)RWgir))Sdx`at@~%nUt3c&Qhuadb49zCY+`n8QoI~oN zU@YFakyl*27KX%4XO}>VVg=C3-n@AObiR;~lQf59AL(-AkLnRsRQS%TxVuAgxs0I>bzY~}GmwabWmLO#xN0#Oh~EdoJNUQvr8RT1Fa!3F?zq4sKT?+#d^ zVr2{Hp0>84-QA*H=SLJT99rQPTsV7nW_5LSW<~@IKahrWpe))73kiAC!Euh92E$B6 z4b=`=RQSj%$_cY)CN77O+Y+|q5u7q4HJK`0_8AqS?Hf`aXp z(b&qI9H8fxr2sX&2oQvnq7=xW_!a}vQz+tF$5jUvfsqGwHVTAUtpo!B>^*!_{+eLV zo@_7jdWG&@SCqlfkrUN2+iJIoD$OZ+MLu3lmJNgoWdFX+=)lZMXtnj#L<5<=wXsZ1 zj5A{~@kE97H*2nY>lbp<{T}2v&ksaD-wD@}AVW`mLT&5V&W2v7oU=70xO#c)Gx>L#f`MBLC*!B!@P)&@K= z*map#F^o%z%S5(TVzn#I`N3{`M&ACN@rj5v!UyNyQRTXt#krr`4!2qa6Qsj`fZkws zc3_FlQRH!2TCq}HL4tY*dk_8iGvwyfT}{m|U{FK+5f*B8SVSGQaks&!2~KuqDMz868a=NF1s9j-b9LZnLQ)0l~q} zu9@~k!O!o0ii4+T?1DeYjDT3gJO4M7{MWBDF`l2BOPnMrKPQBT+wU$t1#UZFI%(JR zu^g;1Ut?n_9vParlhAi>n?Ui?p=u9mMwsSwQD85u-DhqC~7gh?ZBa{(Qume$t=5ONN0^Bf5q11Rl`MiLGNYvsm#bTFiGo%=H|**Bf)_K z+8zu)P#~S1eMP_B5HXnO~M=VbVrn!_?8bQrrpxV#T9IqGrie-9BE8T6-kk5vA}pjH?mJQEQ8KHHq)4KZbMF3%+8Ev_P!j4$>Fs(%5klPDLBC}Pt z5$f(5rqsHmmP*x>C||>>MD*}qkjp83RD8a8`4e(sfv9tpNLR{|bKqOmer0SPTa$$- zAr`MMz>vDY$Vl8BFz7i?f(VU_ZVN<_itYleb3OM|dBfd;=EB^<`fms1q_k9(78RWi z(oKYX+Og5maU>B>O~+ni!jL6sg!jR5?;-}h?Y9!h$sS(ybb$!y>j1Ax;5t=T>!+xz zq^MWvhiOuP4lX-6llN8HRwFO7Bb>v?Wc!P^Zb4arU1(FNob}koW)0w-jSZpFJrFA) zdEF>*NFcg9ahRIaZ}t&KU6i1h@igrT6d_4_vUlw)?Yr+NR6;8XlrHY4EG@3We-&;9 zSAogD4lHF$Tg&wYx!%BSLy^YnC*;o_Kxn%iB<^+(_9#@VcQfx!UI z^~msWy-sE(@&h3tb$zk15e!Wd*<=$um3WyEPmB}LXQ#sugag_5+r@KKTRE+4)?()SV+Q^PYWaW+ltvNWEZYW%Y#TY&Uxvl$N#j@-jDX z&NsdxDBx>2Xr`OkdgSW|6NyLm4i*;fCho=##(>(|wiZ~Kf;VQS= zrAQi(a5^57zuzS$CN?)W=WXTz9+fniRGU;w?suEc0SzKU_!CT25J7$a-d|Bs$sYF#34$AtSOgp7fWiOuS`_K$Fs2@Pd6U^NIClqdI_F)|z$*e!(%BifxysgA-iDk~ zQu7^9uq_+AgUyk3{CntJXQ4i1yfLm+XAz;%o`b47M6+8BJ^qb8?EZL3bp`cFcZ$RF zr^{6jR1f#yI~>xv1--|5vBa97kBF3r+@&AM7ndVIiA_Z0<>5PLS00FQDe#ACS+^R- zH7FK)uM@C27J|NB^T$w2x>igL_?$u6)XMEU<0lSL#J9E%O5^?erX4L+=)SnCPGQbP z=km6!b3$-{V|u4Wevp@a{JTc6cwq06>t$w_nJ(8oa=Xhl?T(T(heUVHo;~JO*F?NP zuPk=t;N)w{8RBvb(QEA>esFY82df{VHC{1*ix_N|TD=x(wayIH4?(p1FK8LS^d^q> zOztwHr>7?gKqPnZL^T751Y9yBY(P+yC7xeEfIqs;Wcv5-%B~NYpz*Ek?OmOkY6?V> zAuB3;X!FZUdK~?dW_g^=9Xt5z=X)1#z^vYxMi(N>LlGPj($?B;A@U9U+am3gKc34)G9uJh((WnMnH<%w+${3Wac#{X=&W`~_xo~j{Na<&sv;|~ zFNo?G0Uehb0(F+f{#2ZG^=`TFx@*Ju!6&+BbzopeZ=78JGjd2+aW|i?u=sT6?(7_U z=lyDIj5VvdttAnkzFu6c!S>8})HYm-(WJn)l26LoBU-AlM2J|dRZV zt~pT(SZbi>A8JGGzkBNuM=1_FV8(6T8ys8!etLarOUe33O815(9Ro1$- zjUMbf&1f;s62CB1hZrqaU|4Rg+TOs{_H7Qt&#kW@dg(m=+OCJLGb6V>QXlceeESA~ z_ctI8Yigc~yG2?F|B0eTeMi0}01Cj$ss_f3Tm)T@YJNWH zwvN@;)Hr`<7$2rE-N|QNsKrHh> zC>z4KAXRq!Y7ePTA4o`2z+4A}6e=oUt@wExCIY`)J>#iG(ft&PDUK69|B7xgpLqXN zw&q(WsK@kKEMg$Y2(}d5{iH{Kuoy5}z$Rgfivy1%B;;YpLsGNBUO_?O`OuKZwP?al z6vE0Yul%4ncyYFOylIMCSjQl9t!JOuI4$*!sIW||3gzg;6}-iaNUiB4Y^>77p!-Tp zPPjx-RM&|hO^Hd~6B-0UD-lf?_rffuf=H*x+0xz8ZQYJ#Z#7IiqM+tCT?%qyRb^WK(hc6tN*M3TMG*dF!lfK-^@Tkh|5Jq_izX> zC_Q(6eb3L&tgJ+#5Rf9Bb4bL*pa_eC$b+qn4kWS9)Puvod-pJbu;uUdj5zM*skBXG z$wk#|&P`K`5`E1o-}zPV9zzpy5B0o`HyXNr-;)YK)e#>dHm)I&b3`Tgb&{()`zlC3 zM^HdOae+>!0vu5@F~3#nU5~GJmni@bcC9@CMhM~3X@k=zdAmF8UOf0qF{Aup|1H0g z9VFG{dIzb1joVym2#sKB0)I^B0rUuIgxR(1unY>QlJ=w*&*>S-+;NkC z#AzlXtgrshDdchn7BLVHQ%_l1*5G-{3rHp()Y{9}kIn=eO@|kF3(rFWAezda*`i%JR^U*I7NkU+S9nuq33_{$Ucm$DX)7CO=cnyokE}dO(Bjn zH$NBBit90uIDK}Ri%938wox@14iVDu@UAmwcd4nVnSUegPG=Id<1}*y7^>+;k}#Ct z4dPU((>WlLrJeyvJnAX(nkcQS%ZrPvi>suho~o)bb#qg#D3DmXpP~nrtGc<8k}2dZ z=y-ToTJqf^u*Q4?hwUSYH3NC)*Lipjps?$Mp|Af7_4!XzGm#t|z!$*5dHwnj(4~@M za9T#+y00%SrN8_0`b*TK-%YvCzFcFq)fTFqVaTIP$1+W6%H3c;J;$M;eTPzz`D@Kf z?X$;DQ%Zj*0jf^xN-KGs9UsPCH98 z?dwm-6IU3et3wDGLbN>*moWg+Zg@P#yGXH)hU^KibhzJ{dsmmg-1n$Cewh^2Cf(JN z65x~mfH{8Ron;8P%*{Oyy8W2t|3#4h%M@rg&I1)N$g=$W z`P`t^<;gaaZC~>@?uVQyb(!nFXI@i0n*#9b?*_wfNZXuC8YL5)7rYpr+iw0|t1JP+ zyP8^>pm|02LHW%C6X7jl<58}FGZ#k_Vq@QOfT|w(0}d8)u=i@WVYG?L2veGng5+t7 z=9iBFdIPLH*dCo_0)7b8OL{=IeQXB<kF2n`NDO>MQSsz+xz*LxX=Sh7+)A^v1;hmfVUB{Zs06hLnU81(G0ojF6=kv?(;p1&q~ySW{Vy1wdz`U*Z874u7&&|#*&N}zCwE?NT1?cCHP7|1s0qHacDr(uK<-kv$?VfFk5-_N? z+q|?o=f0Z`=L?URiVAr6r*g-?koloExj6f7+W6#3=lHlADSM`AfRQeiv40(Y6V76C zF~E6BZl}AY<+zf)qpR!w#>VBi6C516r-whx7pl529z;~$;boPDdsba-MgL%Kd3kzS zCE@}TaKqwpM>hM39pe=;qT#DZ;-O$^EU&G}TIGoT>Xu1*X0M~s>g#lG4KzkC7&V{9 zFTD2nNvJsu1uxIvL#9)=A9G%!4xopO9XX04G?zGEaE3>AadIbLXpNt7-CPuTc#7%D z;EhUyyKR@fo{cH5cxUZCPbm6EmE#arjoa=(EC#Rxq7WDyT*+j=2@$oz4ZtjrghTGC zD`r?kdt7p~fF8#sY1nZ48zi@DAK^{JhoL*-q?B~jZ;`(H;RA`g2GCX60O{p_HaMWu zCOumaKXD&Hz^@|{@Z#9p@XdWRk~lreG5@-#_drET!1O)|zh6VEh3y#HXM^ z1&J%qpAW%Tp_&`Yep=DOVhO_XaQ;w-&V6;b2x7-SbzgP7X_w~b50UZ*E5hnaY-?*K z{F>=#JLy2+e!|w#BKSw}PshIvoX8HrKhQ@(@(+S^*RS(JY981!FiG<9C6ly!VMxFp zM3pKa5rtHte!R*9eHYB_SFdIv4GrvDP*mm_!~in^mIZ*3ph%KfulQ*|w81N-W0(Gw z^@`g#wKePgd(wYF8UQZ<74o+QfqR`M=kCd8t*fL_Dn?@UbZRWeOM8$0+cMSDz{?pP z8HQr&Qo|#V;|!ab%@7H=_^0j+5=1t?hrnuqM3nC1f5jn!4>KPmBo<_V>_LzR=EO-^ zSd-j`4-4TOQ&au-Qs(DQ7glIzt-%=lJ2^8;|2*v8_4BMDjRMYEs;Z}Cn8R@Q&p3Na z;td212)kQ?;6KJD1>gqHBlgY6+#l9@ie(_Z<6{s$d@iF605-sU_-i}<%g3)Lsp@{! z%3b1M9;0M-he(N2uTbmU+R4cEwAgEmPtHs>a&2&*n24YT;eYOUHEEB%;7}VOrX36{ z=Uqt`Wt>kwGE7uTCRt~;wpt`OCx5dm`F&%fKeXTS(!zWyBOPRv1Dde}^Vu>7(EopB zJ(YHoBL{=#{m*|JG(CJ;l=g0j{Nsl9Bf3z%MEJ)*Sa5K+e@aIR2m4$jS3Vc3lH$VA zS$=hluYL}P(?b;@IXdnih%8NUp+w+e6%Bi5efiB<<>j?AD!+z4b4A<{6IdaK|0 zv}?*YFhyQlTW7HojPZE?#5#xC&tO2M#>K5>GyFshKW>nE%KJs8j$7?h7>A>VfS9a1 zc(n(AKt1K<{7a|X^SF9Zn}V{kXxbliHC~9qx9^>Er==65C$o`jNB3ttJ%)|S~l?L)_}TUn5^%76AAl;S;7tT=}V_x z5p+MktOWUY9$kx0VA||_%a)ZC(DPieU#xfAe`TTFxziR=w%L zrH^)jCfOMO0h=|-%$n<~z{y^ymmUV=ORXDiJZO%B>pD)J47*JtfFW%Mq z-k`DQ2_j}WCn|gH(nBLt6OL!Z!1ZgiwgvdEpq-7<6u>W_nxK0XNGV}N(U=%Z5f*a{+n$yP z6ToOc8Qn$C_cpW-J1rf3MO8{gE0D{zZ(@2aSZytpo2ZU{0~J@w6Zfh>T>dKg z4;x<)kzNzsy_)-~eJzwCF`BA0{OBm)UU&bzIvW}m#(E;zy~?{r)LacQ^3oK$o>0E9 zV!Zr($!2f(X9bxIO=3#QI~%zt&tI^msoSgZfa9btt0`-2AZ?@08}sQe2IjT*@0A`t ze3CJv4@2{ZDS?+=`VkL%?$iDyi}cfv+9qoKsP{9{flmUh(j0o0N05{SaT%EWw8yt0 zKtxOH05ln4VOt=``7sKE)`M!L!z{=WO?~DI(8|7ig_|25SFd*Km>XZ>Px?cSzmocc z^zK#tq>{7uK0;Ll?#uPcmm#JIawDV-p5@t}Rs9ee5CD&WkQCIy*M%1F9Uea>*)A8D zl`WHvjlaJz7En^uuXGBapp1eANI+j2Ir%$bzC)vMLjF#DN=wvY80rOv_zb7wRJ3TnjAZ9#0Wfmh5aG6(9@~W7a>ZO3lduG#L0VVm$ zBzeU3lS-6e&u`c%-Bs#29;kmu@$Td12cFWOnYqI+-%Fu?A1-vli+|_RZQc}H(c8SQ zKs}FvzLa>MfniY;-(?#P3#eB~Ay?LS*MT5@$9d z0`d$aK7G0)2>;55Oz!~&_De^40#q1O(+Bd3p_l5RsQVRKQHqkE(qidNUnoDz-!(4 z-42jF_4+VQ>KxP!NV?)sh9g;A(3!y$fG0B!uR*Z83dmDGW`Rfo6|l2@{YrcaPr+(% zD61?i%)FziuK#b-)>iaSehMFf>EU%retvrT5*QP@8Wnq!3KnX7X9Jg(SSAPfvUMc?@GuSJ&KMtfh_3PaAJq zYMIOo4QaQH#Ny)W>i9;2%&)90h#aP;XIGN$f(Oh>uz~${Z*NB{`O#k%LyNzkXMVtF>*fpS1_^sU zt*I3CEsfw7nIDSuEwe3|i_@1QN+pzI@BFr|WBzpZ?iU!_mlzB}gJ-U@a)%3TZqBG+ zxE^-f-)hsyd-CR>BLPVuKp-z3(XlIaN4L`L*3Is$a=BOP2{c3d_tojEt~5BzYQ(*F znIAA*uu8M3^*Swi#4GUEg4yubKD(DQ?>>CkW)z6Ub|BmF^N6!*sYC}sf;5rr6eGmoMomacRBnsi4JuKW1oVPS-NKhH?HFsVc6B}Rn`{RO(5rtNX8+ua!s*r5 z-?@ADE_lj{isgX;mt-8@xGu2;I$sRG_Xh)ZI85#3pAzn2)RdLW+(q9ND%qCRNLb6g zG1P`Z=&-s}^yyPZrB{ynncsH2srx?%gmNNhWS ziohJAXp<>j^uxRpAs!eOv*aI?VHe-^dn%+r~f4>bR25W|jitDoq?{?Vh4P)8#sDk{N1 zZk6Es`?qm)@TkEPU0`LaUynR@_Pn|bryv5sEzZp?E-uCGUyoegTa8&6g_Y7eX8 zzbICxDk93htUc2L#pqn}B7<9^4%MkwuN6HsCzZ*Fy(2%e9rNeq&ey?bH)R4=aqo`z zHsfHd=_c$G_mPASR7X4>ABHHcc2NyHdpVKurBe2IO$wu3Re!8T2Mp3!%UdTMC#i4B z#IZ&()fN?)U-Wt=d3tdVK$^2ci8Rz~amTgounrdkp-RBl(r0TG-;12ira!gYJ+{X8 zz5GlG`TjTT*5b&VYCur(BMuzLd^_I%CO>pJwc5|e8Gm(PhKkx%280p_9 zy(@$i1Tk6JczM=BFDR@6WbK9%5Tg7=^$||*Bj@a;lge5V5qeJpp-`2jRt`v0a9_Ei zr(7w|wyH&+^XQeYlgbo;3)&VIpyMZ6Y^xqA2_p*P3gB2uNyTXI^`^vu8BrIps{K)U z)i(X~D5PAFYyg|wxFKHdJNy9nPBRnqhq0$cq9sm%o zT?=o139drQzrroL+~p6h!m*M|p7bRSJh{sQ;DUg_Pa(etn({3{fq}=5A5Xi_8QEOA zb~t6s%;p<R=jtjq^CTrwAz zl>!u4a4?P#QFH8+VNJeQvpqlEks#x-XJxf=c(5HX-vM^@uY#Bij^GfP8L*@kWNm8lw`0a zg#y5!rm6}S$^6WW91-5Cc`SGNd=Sv~7vH#bBH#_Xv!??ZreH-}-gO7Dbv)^dO61|s zu6qMl3_u`nZ`mC>c<;i|L1iT9Oq|A1!>dr5OL@=0xB?pp6ac9H-?!r9;!>0d|NSW+ zYdlCUqRSkqG5@|qQ4vkjYW_dJ3sgJ^7Ueta{O1T1@VoKR(Ti(q0@ts(eB!K^`7ePR5v~H zaH?C~BNb!xq9>UhU+Sst{-xL=&&3pFN zVFTnL+DsT`I?3xz3gAG@A&sEuh0)B?Tn5Ti=lpDFn~5+>hbP+EBT1D1`tAJt~UHSLg@LyDDw0t;;3*!wm6*~p49o14)f zrwFm^Kl?xk089v4?)E`hB9cswr}h-CXL*<09G@Xt1=k1{OMa`&hv78dL+@4IGtl-x z*~jd93=nsAc1B}`&ei6S!Totl58X)`sx(3&8mEbVBD8Q_<4dOG`~D_MP#BGSfgV&mg!KW`t=54zdWX0J@xQBwY(ziaC*I)D%w z90&RQRpH>UbzvSuBz|Od58AOrfGnutCKw73oe&c~E0+qYmJRad1H% zsHyd=#RquDV^UX1wa8#=YMP&$8>OJXEF{S{-1_q7YZslt)jgP@;Fyv-qoc87HuD_s ze(x$KhtuY1XPxqY;po`&@@7aG&>}~oL{erMP#AA-VT`)P}Q z+eiw@*TZrBUfeQ{~&pSaI`7P}&wJ3AssR!Ih% ztOnzxE4XA}{AdWumb}ee*$v7cvI3`6U#sjkN1)W{{iFl#2Pq)exaDk<_v~Q)fin$3 zE3dk`{Tw)qH)Unp5jq`LY%u82(HRbVxOR7U7Eze7q_NlHOKeQDb>dlELHDTCs$pW8 zZD2`<&2Q|c`OHv({ZRTMT}#KgA$!w~##el$v%;St{c>Z zh~RxS?EVj=;m38WlG!%v)l>e{FjeK|nHw*?8xbqS8NFcGJ=-}Wk2^W)*@3Kp@d$G% zd|dN!RBdFjOI?9|N94uodqgk<;;Se5-VS%-iZnAmtGv_E)!hk>9a(iD9NUO96=A6o zlQCz^j+PP=n|rNUcyc}qLbPg(TXpAb_OARAT}j1BBPz6b9!-{wW+gOeU5CV@t|eOB z2A{sovnxzp{9j~q&1M>ZvmO`RM@wdWGuq8@tFE4gR*(XjV&!F|i;Ebi8ZNn-=pXXX zKqQrYb*gN1$0Ag7NY*n^u`HFqc8a=a-TbrZ<0puTZwH=u$EUO-{&bNVJ$OpL1h&wF zyBOf?Y+s;}vvzlX*yTXbCM?`GxHQSwGC-6y_kk9Pt@E^QyoU7f7+E$g9I}e#@+ul5 z%_LLA>fC472{Skk>rV{0rO=!jKbU-q^F~(TOZp6Kqvckk_a}U>*gO^Q;0&yre5R{= z2gl*V^|u{R3t)S1R1#K(F!MXZdhaT{i9$WMf%LeIL1cVOBCfwF9)B&99+BD@7ozex zLlMPu0C`bDLPB;M{fLHfuh-wMj%irBr>Vr3@0HC}nEJ&85m80j*Rm&yo@w8mbhq)a z$y%+W_GU=PA;Rb=T*~TO5^d{@>{v>uz-o95Gmh?gHo=m$HIk@%>KnKI=k=oETDEtN z5rTNu5Jhd(1bd?Jyk*}u-}fWsFhP2~zg_Mueqfv+c@ibM9tKV7KW0;+odq+2jlGA# z8-}KF_6y>8EG7`volr3weq7m_PT>4<#qy=6j?kay_uKO~-H|#()2G6xnsk-!|M;6c zTVHhG+MmFuekmZmrX#hW@w(k&G+L&^KZE&^lFvXU zh4x)hO82%D3K$w-SSp3Z+^X;>CZKpUH=pCTDG69xWkAU6LMC8hyoDtQYwEn4}9!&R!@6iYL@MY*^Bo0v%m z0Mo+Dm>wG|)Ff*_fjUY|!El4L(lwuT(Kg?a_c{%Tz=29tGO~@|{?VtxDsgeMx6AmD z#Mh`5tJ;bDIu87{ippo#R?m&H719j=BLAQJ_bG19BL+;-<7s;=ly*G`R2aJ8LLjZ( zEu76JsqUVV+7p|{Z~BUyZF&<%_Tr<7xYpW^{4heAWi;9o%{>s@0a{KclU8B&=JwKlQMBam-lU(A=P18YhvN}q zd%LQmjueuXbY30JWK{l2p6{4Tg~*UeF$7l^m(n|Lo72oQoQEduDvPweX2~$!h>$<7 z+v3Wz1>|HAALlO%yHwx{K%gBTnK4?NDu3`f0>u5md97ZO<`X#EI5^*0WznY11Cw?u zD=T&di{Sk=1TZJzip<>J-rO23PP#}I#x7psntpP68fGU3 z4M9)m8y^?PEY68!Bx?6SXSr8PWrN{dyL__4Qx&I#DJh*mq_$hKMrn_qrQ)o-8Vwo1 z9&B!k$t}P5+gH~tM^Sa3rT-(Pmkna#G@a) ze6`lHX?m6{g{E`hcbph;ByrJcRQA)zF>Eq1FYgB7@vrrS42Ho~7fB-4gmHd6)fI^QP^E(Y?_ZI|q+;e36>f zr`phs7DZd)Be04Nza&``s?M)oHFVq}8?C;Sllsu{Vo$W&Nny9u%2fSxIZB(m3M&O~ z#%%U=OUufXi+%}W{`@;hE+iE-HJ$8++OzXfU)W_Hm!+I`(4!*E@4pkn&UC}DmyleM z-CVEeN6eDBdku27aZG$UV)yb5$@!5eeS?&Y%Z8vAwhs|mhMbY(ldBW-d;?h5t=mM@EsqE8;KYla?gK+=;E%w{oOH^s$kNzER zmz%_7STt(QoZ%QGH?Fi$LP%&skD3@zqREH+W#p0iEq;M(=QW%GS#87G57h0O8zdKy z%s&MB7r?IB$yWsueiD3xx#+N+lLna3kyPz?lOV4xlf!!OET*nduZTfItYSfW6L3S1 z-f2uZT+8VuuhIYCfs5CH?}U1$c>?dpdHcVIb{R#wx{6~6w>LOoz0{XI-p^C=?Qsf$I*kp*iR>kXf2q7kr)*HB*O|T+OYPm~Pr0 zRBiA5Y%4CqzoPauz2H{-68pR0NNtA^P6tF82_TPZ^y&Iph$L(4>z~J5CnG~&vDz@m z8GyrM(}*NJq>vD6TaR>i=k$;PpOWV%*mfV*^^GwcKlyyc1^d(a z{`QY>iX(L@G3=1}5@Rxe=wi}yLF=-tnHe*xJ{LbsqAI4%wfIrB#5z)ad4<)xORUnS@qB%uAfN96q~LWueywMfBgHD z_dwtlw7O=-Q#&1M+<$)4kmE49XAu{@r<5}Qazp54uU&k_cQSArZO~trCho3SH@0I! z(@tWu38ZJ-RK+cZ9-10xv7)8wp2|1nIGG)URh~6C@2hQss$68X^>9bH@%~KzuE=m6 z2W8%0A0{Mh6I-;2{~ujn9uL+2|F2S%ij*aak~N{ozD$W^4AJzv}NpmE)zTqK+ zHF;*L93 z?uWp0SV?#WS&c!4NTkbA){ScHpKM@YHf$Y?W0;U8_lv9&4Yo^1vSUO z75o<3oVrC%hS(2|%SdyRLGY7*Yy4~&Sj)SS%P8GxGbEBIvat&an#@YAI&d(ccH;?X z(n07t zfup?s+MSTWHO|i`8Q$~nOaxX-ZC2jXu&|fomAS(<-8%peuG~Kp({8!Hnqb0nzhw*X zt$+@X@^+;4BPcX6K15+Y^uV#5k1ZO3XeC39yF}&Wd=c0$FKZEt!P$53h)GOD{qqoU zUd^P7{^a{;`q9%n?)=1T)14{kk~~~ceEzNL6G`jB622b}f`xdm3!H&y)Xlf7$BxO( zU;1Pr5l25>zLUzA#ZzMMr$>Sq{|f}FT*eFHRPFXk7qaDIxrY)$o1do~Sdd+K z;88wE1~|T(>?1*TkYF!`tgLoZoW2a+{6|8-^D}pVLMTTkr%>?mEJK&d*c8zPdNg9% zNx_dGNzlvd=UnmsvekL(=ORp0FA&=i51kDBXsP2y;N4B8UcH1zmC9Ea_3^fpzFv#k@nZJ$J z6zPK$EsBf*F10n*H$VWrGobyUY1?9PeRUl&`ZtTo$lRQF5>$k?w6$Tp33i|#KQod@B=+qkk&s^H3Dqg=T2mwmd%tf1f*RE3kfAr0M-dS*eXiq zGg!4=vIzLNbwMd;q`*r@HbQ`X3X(Rq*Zbt&83-g_gu}q|0IKOITczqfIb1X04LGFx4k_Oh1C-tqZ2PLPm z4mAjfcK|H-d+nD&QW;!<0T|`Zc{afH4HBY~pkEXGVTS05m;+wqTQ)YAkYBr6TMnZu zJlmHGcjf&0)Ri$a1Y}SFclxJKtfa>j!1<74gn*Ki?9J8W*#Or zLIAGaB4dXO#z>a8bnRKS&XLq6@6yN@jfAE|5sFtG1QDKkkmH(vf=ccCg>dBzHd*M_ zYu8lgro^4w`+K4qtbffINXLwBntc2g5sDCvun>*n#Y}8(57mx(m7f@AkU+tAA_j3J zp^p=SNj@aMHpaDQ4ShV?QKI`JUK(Yb>t8!oE0O2KuVG=Edavu_R}q!lrf(=@+>_IC zyG)nV{Sp1*xB<_mcg?rnl@<*MqzE%}$%ErerK)uC znzLHonMhGxBEM5_WTQ?=*(2^#r})w{Z6+q08j@6qdl?%57aENLVlQIXnS8SYS2+8K zW^(|SW=85oV6%U(kwPFsM+c7R4lVL36JcEi*;3ju=vfqLVd@r4%yqpyaQ17?aBQa4 zYuC)kX1&&_6S1>b~Cb)q)=c~f?#6F&vjJZ?E!DJ$j?_t`KTsPh7#XN+cfyv#c z8aG3rN?&4Offz8Nu97@nWQuy-`GH4oLBn7M(GXt?RI zf%_(G!=cLUY_-dYVtmB=b3b{~X#bsUKd2-I=8ds~PxI03qx$}b%P6IdMgAEo7dQeI z6u+FJgI(&*K`IZTd!j#tt{Dis6J^Ml_C}COX>Xe8XWe1!=Z7}ppE=(*DtFb`Z z0@+5jPHywC66L5RV@$yTBXW?-+fI*`--7UH*??vU%qQttTNkC;tCn>glO3%-tVp$L zHiLc-MW{8Njl`;m`0c0LDjS7f{A8jamJ{##*I%G^?|v+?n8>p8!!tv%r;#OJKbkMT zAhu~Qik?1C7NpHu-{8bno` z20j^KlyOv?Egj$ZG7^t>4G(~H9sPccEbY+e(^V_G4C;`auMJ*(`LZ>ae3M+T3*m~1 zPh0!}D$dvHCvA{K#PHuu2R9Xz$%0JXhzOVKE^zr{s#hxP`#ksvF;k>9Ba3v8qe7%% zp|Ynw56Hz{y=uHX1@DZq zs@1;}o|t%x`}MWJjrmQ8gcs07-Xgez>gu2i!XY8%q&6T@1KAUIAs}a6OjPtO^0pmQ z%Ck^%7!?e7@2P(Et>M5=w{{RxV+T%&vC*UF-V`=(umpRk!RYul%vArTcJ z-Nx#lt{h1kSs{Co+cCnL+#wFPrOmomAC3mU9u1v56q6aua=9i2mX#BUl^5oCWYPEczZ3x4Fc zp6}gqUvd3P=T3YjbF-wYQl(F~{?QXH=E_kFK?+t#B`QdoWq+H564P&glUcM|V*eQS zxVKB`Q)FJ~a8Y4fUVUv{dHoWxw8yx{EWN0Q(O)hrZH(I_u=MA7lcUQ-FLF1s7(f|H z9>6gN!?ekuHa!W4l(!?fOlQQ?m6Or-&Gy2^H!E>1B5t@tuD7|`!*AQ=K4f9?v6@7r z{V%(WXzN9T{E&g4w}Se0T}VExOa{0KOR`ENs`%3-Uwp@R0vd?G+l$c7Clk{lu zLbZUCGkq&4hHY$5dZ(%LOTRg?$p#mBbHfxInPl*q&gX7&6;>^!sbP03haH?YH!2=y zL7W(FV6h!ZEPw&Wlnu>T0OsPi^)#d{9WI?i^{DIlBIR1 za0-MM+NP%DO~If-zrUi`9>-J#5fwD&?zf z5@PFu4lLN%Rj*jQm-eGntJI)U8Is#=i$luF>3;iN@g~ToUoK_(z1i7lGx7c4WJM?| z=bJh`z_o4albp8PwAmhsyuw6_0Vv-+1~yY%WOz+=j}2f_wvK};xY+Z!>`>)^&dW%@w7KfGd*Hqewk1@ zb|fwjQ*149-Z}wpscf%6-*zc!-Bx+Z8}?{f^YQ9ll7zg5wPO2S=F8%H`04 z+Cig?lBLHLb6|OEI<61qWOQngPcV`{*qiolc(OU?uH6yE>9N)Olh(ZeOZDc}E%_9j z{Kif)ZoPD^Rccha;eH-v9X(`vJtIyQPTTpDhdx2!+n3^D+ieKg!$G!WrmyZxJFMtp;40CtjL(?w==rJES>9~EK1PFJ5B5&- zsg8}kT(MJmrQlzfb2Kw0|a< z2@4C7WsJNfHVxJ$9M4sTIlb+RjM2p`(UB8%6BoB3|A9pMEk6=IgDM8$t5NS2k+3uCP&ss7|i*4 zI4if^7)CVD93e>p=PH29dC~}9;(1AsG0dct1GP>tI|$Ehfo17`z(V#}{5k_!y*E|- z0_^;{x|eXTjclh&S6y#e$k<{`(C62PkN#hXLP239TX&eWMq2M*cLMwMZb`=>*Pd?B zQ+)gd>vS#@Ub$8XH$B37y@NGTTBUiN`cs7%)9Yualwe`J6No}lQL_S(vG?#6Hjap~ zIyww~W(#Sks`f{fJ5(6Qs`?>oIacFcTd%;-=D!li7|0;%ZX5~t<}h#A;`-kLXX!z110|;G>mWIUX7Ce2+4f^a3&MRLrv+BgvBrIGOFX+Vo8}eG zNK5L)#;tHntYKDyB?0NVi#naraA6m+IKuevig}PhesYCTYU8(Wv<*hc*~M*Z#s=d| z>CpTgwGI97Oa1HE9twIp@W*Zg0dSwKi6<9aU{0A|ASVpR2fMjVPEGw~XFa=Y34GG{ zZF_`P6L0#oANT~w^6#p1sSH@1QLf)j?HhchOQQ+>$Cmv+Lp${Nk z$}j7cR@L|57SJ45$Pcy+K5hk3gpW@@^OeRw<|?hSZyHQ#EdWv=lTsmIz(uBsbRajH zF)+{X9ri;&CuvYziKU=y=>l~%YpZBy@w=%`{dY{zeIyLDp8GGVte8WHt4{z!G3^Ud zNoKT|TEtv}gSlX|wcVKj`8|P@+Yu(EV1j^Z1KMs97I=iC=L{Es%hbB#n_lYvQ<_os zKTAvn10hp@SP7BS5_S?Foc@Nd~B0rl*592gNun?(m z)p5hW=Gnp3wV#_AG#YlpUsgcwv7n~WHQk6E+qgLy;O5cq-)qatKmjU^CKmBEl<7QM zq|9zqSo*Z1knj8lL62Nk$7iYySM+)5$-SroNB@ETe&VP6WsA6Oj3Q>q(a+Cna$!r( zn6he$%;@l~m?P5xn8nW!3xM~aS_qXhN`s)o&kwg;dBr_kwQAePw3W!7Em$7I5cT}D zp6jU%ic#YVkRRZ|1O4H5U&3NSfhe;3Tn=<03G0jauYz7{!1M1bYv6I}qQ!OWkT2%r zM~i~~o?dKB;d(^!#IW`DnYA4gBj7+1d5sOc`Wn|5*+_UL1pM43E!r^#3pC#`MVJe^ zBZxP6T*9*$zW$e+j|eTju|s`~MP7g!%5TPK_?bG-_7%FC3c3p1ym=Fp=7K00xChn+ zM!*dV@=JS$vKyP5_j7=BwyZi~ugu8ALwE0wB8^R26068sLOLV_5TK)DRm>erF+|Tw zvzC_{p?EP)D_E1oSR)(j6{!)-?(Hz#XfQCw@^mvmWd-G;O3?zUdtiCUeYY#B8A(`+ z!?VzD1;L+p%uG)+kdA;5V(_RW4UUA&nxg*eH+}2Oo_B^28HThqitKa0ZNAP|2&O?)(%|0-Po= zNRR?79dYvC=LjGnqfL<-Q?rBW^ONlD3~&x1-#~u?#VTNw{$vJCn6DnF z{@>4X9zA;77tgo`)e7l=od z!+91^6^QRp(fSANq6$3x+36rKP^F}<1LGc$Cj!%vh0%UE#uCvuI{Xu(eRR?(zug_~ zLxu7ZLoe%v9p4l%FKIzr=g7Lu_r=J}EwU@*GRXmxkT`~bpw4aS-N;@@ApmW-@hWM$ zm$OzW8O<&PM|uTMcPJ&FA6_?-p~A9U%tQc9lw{U5(Bk|NaN?cJ?@5qeYlGfo#Qvzn zrXbJie=G|KVCI(*+s1sr_BACBqu$5_vNs;r1YObnF2G<+C0+BMtvA;R=R?Q^#+&sP>slQlz(&LP8oiK07b z%>u6>ha(~!92_o+FJj-_VohyuEXkXld}@j*o9bRPhVH`{cGKh$4ozu2@p0kBpiDGu z*!{F~X2@2yZEl{g-D%F0vPWp~ao0{1C#U`n$5GB1?2o&?w>z=K$sEWm_6o(`)X=$i zsprWDV08hgdmC7x^GdG*hUMmaLs;y=6modD&O9CV(4NDZI)^M=z22FcKpU#>L>zDe zM$EiYtYgcJYc9aPp0kODktgSlmne(@fqZ*9K-2G4qzLIlZS=}JC-zSFZp)fdl zfH(uxwFw&L(k4T>N1fty)70(j9XL!pXA$+KWJI#kE1zc|HN1H8$$)(?hqfZ}c?Y^n zOdmOn=E3@*jPPxh#LcOG>K$766ajD%#Pp}KnB&nYP#|gs2PhdWG)QxLNZI)+Z8L9z z3Q|!;m8(*{>F*=9r?1wfymQUIEO|)}^(ct!dAcHaCm~S?+du@{)xor9RAFd@zD~CI z-+|`aSZdbb$+&jRu%oVM(16ui6zVeoDh>KG;w#q#YOm;J5tt=-KZt8L>F#4MOz_~* zEbt*<`r?>OWQ&*EizRe?a;}i~k?0Su1$+CPpPWkczgNkrNt}t!-0j!|ghYJ}r_*<~ z=xG(bWL@2FFggd>#br8&I@2=h#VP`f#;9jgKF8izNt!_|S6z)=lc$3?CuI|~7$M8A z4SKoURGc|T5z8!#{YVq_3D>>4WWXpudwwC@XAY&8i+0zi2Dde$|7?+3oye`;!Md!} zm~9hd@M+`zCy(KhXd3m`u3lCb?`f@mVF%tBI>+P@a2sYJ6BeX%q@6TawvqS^k!#mx zCU+9N{V2de>c`pLNlOA*W_nG}H!eKiYo#Ri_nm7I$Fn#z_IXgxTL{3!DECE5kg>p%w z-j?in)@prr4~HG?R=SYK%4UQdK zhz-Cy1_;P*-^Tj4B9)(^IGvaVcbHQN@u4GhA+ml(TRD$1qIhyN?iIL?4L1%ZHL7<% z0DArG9~If=i~t5RMJsq!Who}|>9wNzIdlr5BYld~ZIae|8W~f}`stb3yHd;QH!*08F0Y;8br>nD}#~mb!_-a=0L!5k8$JNTL z4S|8#|B5fRfa}y@PS)@1^gI7jl42X^%_R#pwGa@-?&zx7W4H(h;GIhHv;^q3E!cKf z`K9?y^c%-$tQz1)eDWeKN+OGsMae9yr|l9l`u2}5Rlw)MVJWQ{QS_?J{l@&zCi4;3b1JHpvV;+tO{XvgJhNs z>p#O9A>{SW0fvp-z0Zlre*x0DIqcF>tqjF$Or!h!ucnp;EU4}wq z2N3r0eA{goR4GfOh3VRAqJ3}86_nOASzn;m*LKs7=wUnYSk-O?r%Q< zRAk%ipsIdABzjrkv_=S^wpUn0gg*5)v~d9$jRRd~1n~mE&3tGZmE?8XG0}6FR(ex# z*5`{1zo+UezvNMvl=Q>fwv|Xve&F=@58N?BKpvk6=H zp>aINWLislH9Rql(yDptE^)ffQHL&k93s|h*N2hu;pnkB>tcEOyYuPL79+N}TK2rj z&o`Ff4`Rx$Y+Gh#@1A}fOn-W>eo`wKGEJwTC@Ageq8Fz8a5!MKtJ(m(MNY zJl#JBsDB-F%!qpZnwHF|PcE+jq~}tzQ;B9Zc#Ecn=haUY#YPxj&P<|LcUwQe2B8`SJIc~6?;bJwFlVS(_$3}@ZE{M7#E-NFFPD;1?jLy*^rkoN)2( zzd&Ds1_m|rmu5NfI9D06EgAQ*@@+XWG%IEiJ%=s5S`>F=RCWW``WgJ$@fZH_V0c{n zxn+Hdd9A(>MRkAIFF^~ML;~X&^q2;*XJl#6W}&gH ziNuVy`53&1tu1W?ypw8YAh2^1T>y&TU;sCo+_;6cm4&u6y19$6lCA=%@`*Y0PpF!J zdqG4xMRKnpm3w!m2%r#rrwtyu@JE7j#vqlIfU^noX$$DUs0vuIULLqHG$vxX@$Qzv zX%!)p3VpQ*%-1}&@`()HM=#PE#aB%d2M6fMnAr&I6-}WzZ|7Ttwr87&bj7rK9T|5V zi)s4=`FmbuX-g&SRzh0+>dC8X1GcghztF=A+eX~Ft@q+ECYtp_0CWp_WWknJ>`4bI zWA|n0Q&@p?4W`tNUOvrfRs?0h(M3V~Yr#OGx=VF0llq6Z+98{f)ZpOwSEn)|hO>X> z0sLgGOhx1^RV!S-R*eN46-P())RzC~a9XRW)hVZT(H*L7H)`J#w3!`i~W-BbxEb>XxXr4JRWgKiQ0cE%09g? zNV>`j!-3M9@p^dWYk>r!dgzoo<~XEUxZERch+9vW_+U5K}~*8tMW%=*<>v z5AMQ%&ziGi%AWTV5Cx*2*h!8 zI#x2L^cMtrlN)ZaUe1j{7lGVJeIU3MW;1k*JSwJV3 z%ufAQ<{OKfd6`-o`@0HJpLg?;4;+1}EjYUegr7sne=W(uEkOaHXCYz0$ACC}@kuGm z)ddtEx2*JAA~yNSaU_Qa_^wm!LJZ#(v3CIp`iKC0sLFTwiq3b@bo?ATOx@krxEQa9(EF%SdXV zwy}Y?Q?qp|zf=x$IC1l63tBzP(avh5aEr`lET^~_>G7O0oilQS;(N~<=+2L3ELQ?e zC~Tj3I#yge%akrdX4(3_M1;P?!3yW&?3CEHJp~%ZuVTu|WCWy-0$GaL!EwO57raKp zAl2xjYyyriis@tB@y|#*UJG~(Pf&D_nz}mRWCDZ^fa674R@Po34pfJ402#9q67ujNaB7o~Jpe3d zwW!bTGb(5=hu8Uibp^6!(SrpE(Fb=q9s+=nfr_GwO%R8L1*=Ibz)%PrX~=;kb);1_ zRYQ6~AMsg7>lzwlMgz}t%cqxRj9@|bgW1tO+IENa&bk7|x3?S{>~}687wZ9%kB`OL zp7xsoy$O-c9YNV@m4z)P)RZN^xGkbVus=lB17zxxA;BRr#Om2NX99;G;`V603qsqx zRZ>9vA+c8Jl4O_i0jze3K{7~IV>tK=FZB0=^fwMpPI}62(dLcA=}{j;E~h4Ifb()X zYP=9X?&=bxVUXdq+TRR?k0L6kBpGjv-j33co}mXB`LHW$gYhkk%j# z_V5Y{02VC(LIK48^CIkLs5Jf}fC~TPG93@V?Aisk<>uWzh#}$LBZ~=Acb?D<5Q2Si zCDs}|Vfv4l1Mq&NUB}q?^xo=16fX~jZpz`TqZezu1#9X|Q)ppKAyA$6ANxTJK{X;S zE-s6hd^5WZfZw=8qyK%9LOmI~xA_!wos1(OAB&$8y~#cTNK?qgB~D*4Fyzk^(ojEf zw*@kSU-W_l%@@zzD=4+}t=~B4W99c|+3G3m-RGuGU+m-2TgaS2b3us7=t@*!NOEAZ zqNRA@mHQVMHFmZiIS|Ykd4vBtf1@fRgY<626MM6(NoLvH+!jI;45orV$ZSWCT3hEv z9UY6$BgCZdrb7LwaK15!FDYK?MPJHa(9VlJ5e#S!1FyP!l2LZw*545;9B|^16QQ($ z-=w1Q&L5N}H#^?Z`x#2hH6HnHWS(0U(+Z(Ecm9xMJv)%}D!%aqtzx9!JKRTMX2oR5 z_p73`Zh6oY)Yd{_nTew}IW2r#Ta!m=EY`+yn^<22E;I4u6&INKZljuBN)Ebkz1Hgh z4b{@&R(6^mb{GbXclBY%>7KznYE~o3h{^#XwN7#`nlJ->d#=s!a5_^rOQ@~wMDYG6 z4YPAn*EM)Q609Mztcp+hEEw{MklAu?l?3jY`K#6pN|()_7-tDLo}}ec8Jshn4`i5} zh$=CPo<%KuX=Ac;Q{{N!J@Kt!wzXmTN6*W{k6%XUwV8`3yyTu(W7%nOU`qTLRkgO1 z)3Mitymnh*bSYzqJaU`NUcMg;sl%F2_1?GVDh!QbVPDNR&E4w8rtc45n>bX-N5UoN z9erw8dD6eS3v<5}A|?3N@~gh&zTIPU82`8E9 zPb;`ifB#XV;>WD6+92)-on+{_YhJs9YU|-@U4RkdT?v;dy?pbA<22bsr4r^8oj7!~ zQFto3nP z0lDG#=K)5Pq}$fEHq_Rz$H^{?%KRIm&ki+n$62f(UVEKs;z-7U$~8j`vPmgi|JWo% z_aF~n=!$=B7wUtsRNfCND*qa<@#;(joolA9DbJ=xj#w*ZOe8;utZ1&mOcJzZdptZu!iCrXMBZ_ILX8ci0Xi2qrYrsIfz zFZtd=bXUq;I86MehDUlAOxq`G#>TKO-J!+>5$YPYR(mO``-yi)q|VNvedY`1tNdjmMU~u0_<>G6NZ*}B!%&?5gF80cWA@_&Zv)`{}71Fsh^E&87kIlCK=kF_j*kNE*CdSGBxXu3>eBIR*p_30wQ9?B*@;- zPZiGCA9#XRN9#pZ6Wh)Qd0BF8i>i6?a-gBP`}{=ISXsIyxFKh~KP_T+{Sso#&UMtv=si&HQS>-P_;Kwyv5m*3@iDP4SB^VpUg+LxPJ#B8U>Ioa|LpL` zh49NR=WsXg(Wb$KOfjG<48>fDKo0EE(!W5v~k)sg{1! z@SO#MD_Pev@hg`!LFhjN$wt680E;E(zOTioR&xjQNA-isc9wbC^_8>x1HWB$msaf< z6nvf|iBUr)k86=SPKKWd=88z*R_(Am-O$vOh2vRp;Gw=a!LJFtY-YS}92Xe^b{$YB z;NnPHSe&7g5d7T&olmbyBWFzsGYTl6&|@316ZO@BcU9doQ`K?BICCn zR1n)=9RH4_S>LWl_qBeNk2E$8(XlAD6LE#0wh8x1?zV%T zwNHG-Ns{4V^_?))tC_9G@I?l| zK*nf9cFH1g(1s))qw2M_ac;o}s2p|Bus1c2%D|KHk92uTHZ+`KIpPaVd@BQP@)U3_ zL|4?hK+$$q#c8f>16xu zJem5EC2gKc&*qY)aI0Bt5vPaCCfyD#RzMyRwCS3SL&5>iFH_jg-;%+i)C^G+C5YS@ zOnjMCTD8xW} z^X6f0UiMCQ=b05pvYYixw}_~p zTtKO=u^^y_NrILK+R!@~IfJCaxS9P6yYt%>ZVwWTLYg0cd{w>anA~d3_?1M2l!T82pD&9%vL`>TRSAPD7kM*V1x%Ip4ZhlX`e%I_TY*z<}3iYd7c zzYf^YCa1_EfE$*qrzkG+ytebu z?OeB~KH7H|H7ebeH zfSeK4wN#h={(bi4pN8NNT}mBHDULpPuFAM!v&ni|(6@ebOrNrqN8Ze$Qw<(F{zTzu zfm`~n5nJ0A<$6`2BTUKD(A=KONM7^t>pMg2MEYhE@KdOd`JN9oqhBT$2puNpWn13o z9Stvi7!knNVhLeWY9;=f}ChF!hCBY{5u*UH;RODSt#sD7xQf;%P)wai&&4Z+=AQ-F=D{g4*{xW_v25EP$ zQoSo-cGJ}~;I?z1&-~46EnL{|ZCjAlV)ZGFVFn}G&mgJ1ld9vN1)y|frJ2()QLR=|$kp_S`~ zf=u54L-#fC39Tw4C*+J)%OGULqt0s6|EM`ZLGRI%Mzg`d-QjKsRfU3QCKROmA|md= zHU7GgyxXJk&qi%?%e9E!8>p88Q zvZid%@*bOpv1waG-KC;<6uf^+?@MF-jKEkSK43v*sL;q;BBDk;Go70srYJ9^`TbI0 z2I^*sm{z=g7zF*#Yi{&l6f@*}7KZ}9DE(*n%_LA%P29a(;L{}ie;$T5HT7NT%3x^O z@;DgNr7R8177EN9I6tvJpvF+u$&W(N>?fl7@;l1&+3S{{fX(E3VE>(;#cnsv*F_>4 zT5s7vn+qj#y~y()c6%<~nuvN|WbCGDzULx?wD&40s7l7WoBASy9VMTR>g}suh}Ie& z98?2P&A`Kp%ikti6sTZ1j^cGTwH0ORi?`w%4cX)?cUIa3p5XRQF~4{E!3iZ|W3i5X zG@KcHLR3q2wnghDw`!J-BEwNNKeGOz9}VN`yxf=V@2|{Uqi0NsiU&>*_S=SLD6cb= zX5^*lxiY@(dc(NAuQVa6kDVutHdq+ke4c_3>48f3m&ZgW4pW~j%j~jiS{0+^x^(j+ z>0rY*K^^-jL&|t=1v8^3y6A~=IFBaWTK*Vs7Wn~-p27dd#_OkV0>iU_c znZ(5{?T8}Tx6p^rf1Y53FfpwZOtl8x>cr}#d?{IKll2QxfGj8$k2l zzKN{!`e-Y82ydI_?zk>Yp{3!iZa`GKVn20SHl4EGe?RnI5ZC4%erCAckm~q|10aQ8}mp8zF^XR6+( z{l|bVc0*FrKYpwlE@uG}Ly`~hl~&zN3?q;c9W%4a8Xc-X_*RpgCFQYb`o0b(?g7U6 zUds|tGG^GfqM$fL`W(dF?R}Nny|45MHUb8hukxo?Xa{|4p2BCwZcS0U6HDeWi$C+ zwRQ3-sbq%H^5Kdj3;1G=&XIEc!Y@mw*pg0M6jOwv#MJXR`9qA8A>?>BO)axr*8>6B!*r`oGpNWDuI<aE|Ip;{k?xo5hoc6j$*=3W-oGAVF75&vJk;<61-5cD0xtzSCdf^FPVI4-P(&`7w5i9<#_*eMLB*xEHmQ~l5 zgtk%$fGF?7!1qLBKRoBLhV&j8fy{G)r)P7rjh&Jur98AWG^7OV-rq}4gezHgUsLai zgOl4rLK^LEsi!_V?NOzwf?PxYaCZV3*EhyTGvHJn9;0+^%b&>4PE>@}gE~01#+E|` z@$Va$6v%HkZ}4#zPg9{wWsX)BetM`;C^AbpVe$-sr&VM)u#9}Ed?7p$z8&R5vy+#N zj*gvg>x`z3>$|Fg4k-J^d$5XAFF*GimaS@%_P5q$vpPv4N)A0Hc!Ae?0wJ;QHHQIl z5ECeU_Sk0}e}wAB1Aqh7)zk{K5`W@yp}Aco8*3}l)OsJLg*&QC$ffcJO1j#L@oQaL zD5GUy9>dNhEWRWokUNd-@9h(v*xvyVWn!PWcy=l{DR2?n5alT6A`y%=EC#5HsV_8o{7PL~CN(y#CPbK5m zIX9848|6qJM&#UVP9TQAQ4$1rL*e@GITNfTR&7zgj{E&v`!oE4a7siKWX|LXfI2(m zx-r=mTlg5Uz0+IRYZP^>X7>r4^i8b!xmDEZlO;E%u-IF%L~WfebkHCITLT+14#LJ1 zeX^xkXgyd^(47pgX(?JXefgMi_*rSWT!Yg>qZwA1n(97NwH^SC?@%zlbJ3}a60iEe zp{QHCs~*I~UQlTh0KWRDl?b~10@vWqe_VrtP9t&{R&T+5X1&G+S-DV{VWmBfVv->LK>^UdlXzWCn9@FlHSSyQfxvBY0B73Ora09rVf9*7BS!Gdzd|Z5jB`SJ~zdU|UUN0~9IcrY9?ddI= zyaT_L&e=KSva@sA6}+aeoFqwdu0VZY9$z4tW2kur`2HwJNvG>W3?soY_!yIBResSV`Ifx7mly^xhRar!echeh?Im<`Bqd+4N`^`)K z^Vh8?(T=AmVKv!PPJR^1;6Bq8Jy8IO|0m3H^>o`C*%BudOF7&RplUe5r~9Zv;(F#@ z#o@UY%hO!kyn-f~oS!Wb05^LOLYi~gDm33-M8SQ>56+DzcL~y;dDDu#Vg$Zk&cD_P z$fBjkrhjTND(zIT>19^WE zWt&!2kL*bHaOZ!LRi{&Y4P}sms2J*feJ1i265iYA*$1`x8=85$-jVT>2|MWf)uA)YC{9P&^e#_wG z>enS-4}y=2954*OF`sA>Xu9Ad&Be0k`Y_kC(6tFVnOhAGdjbh43XTZ%nZE97Gr``s zS%B#a@t|>h#lR|3G>x^MDR`=>6-K|Vz%S$cX-S6@kHlJ(&n%rzMso5( zU>0YJ$ALIp$x1~faiB?)yg8edClLeFaGJ_OT;h}ExL_AUr;^wCb6ESwE!`)NZI(>8 z+76h_6M+&E0|1}W&W}T$gcGS64Tmq$N{}Z-vXi`*nvrR#+mhoa^SUsa(LnSScb-D_ z3+|@c{t~p@odtS6kjGF65Hm<`qo_QgDQ9zC_6yfDI=pnPfS*ms2;*IFH~Rp=6@uBi zccdNIo#3h}T9~avTVM8?w`|e>;ylo7y*CKc63-Jv9&YorNJux6qK`1A9r_ZD_NNre z085XH-kOZY2&luq zD^%X@?Xo}K$5!)b-Pg;t^c4etzX%je%K48`%lzVyIizZ2bW{ii4ZZ>MaQQF?VX+(s zI8SXtl(1jwDN!Fl?(pq_5h5CMW)45|EBk`NKjd|G4p<||>|EYIY%&v{vk?&PIz;`s zT?m@5eDu;6gf|`n7cAE50Fmay9JG};5J#W*Yi`GSrjhHH_wdERu>|R(j1T&OMS5G3 zo%^WtfVqt=D$ooO;S3IsMD_xaO%;6iH31oPQU>i8$}wIGb1-o9E4{I>J@+}gtrZwY z+^R2uzjxvqu$_VJTl|dji%L5#ZTswKN>p2?s;o(7+eQ5FTXd~mEpUEUG%s%EIp*F>y%0u=o8^<*drq>^>CqdNfE$C`D2P(}sXhBT30EU=D z!@+sY1AKjMa~MNSa9<4LUgU2)D$%Y+m3Q->*p`mT%0-QecsFcTJHM}7l65-sw(I9at@Ov^w;)_^P!AC?a<@6$}9+G zCHU?qMwaLiqh0Q6<+pd2On_&&)kwf1{?g#TX@~4{HqEN2_@mQNl zw39{^wg#=k`gzG0D8NJ`#mS^xiv{;Zkvwu^Dw4oNZ1P$x(L-vj@qMP>F2gDC=Qi^C zex~Nl!0b^eS(-Ja;&GQpi@e*TteLr|P{U3ytIChi5WDY1B04|`t!-=5ycmwoj;0u* zlH!kRtaWvRJ+3mbk{>1JkOD~=8JlDL&?66ipn%Tz@82^xM*h<6Y7BFQHPq?f)HRD4 z>-OJ{MUQ=^aQkM~L5aa|^FrX*8(%M|aCY>kV^2 zL|Mze0afIH}1;UveHrB*%z4B3m3D@GfJ`EuleUL9bmrOG-q1Se*I!N2N>VEZ!XhK=heg1o6wU zv74p|tM7~+^0StFuIbrfE#iv`tAlnoIIi+(RfbICDRCxP z=w)N4mr{+Z@XzV|!ci_AAFoIWU5r?H3)nywg)*_FjfzY!i0jxg=q`6ZgT|juol=5Wq!ix#iB9Rsqa2hRkbRJQIPIEHkFacgYUibR(z4kXl{hCKtgnzfsb!tD|Ae^hOQqZoX`88fQ0?8@4~2C?VU zk#UAknVyi;QR90}$1W9VHoxM1i>2X@+gS0G8IX*hQ`tp7*>-pkqKb-Ap!LcihZY6d zi^cBU`vZs4V4|m!NmW)hC%0~!(zZDVp^5-6qu1p@r7E&dyRaFp+P=LRGou^kLp692{yClu9x3yi*NFhA79Ju|!yz_7_ zQk_X5p4RSg$*pRqOcTFU-uKQLiZg&otS?$b9c@B``Hgo}(Qt2=H$q%TrFd4z_**sV zun}@6rFp;B50!@-{rs_Ft(Hdy3Pu1C%*lniRJR<_F|BZKDcbDd(wB`b~JI|t) z71@lgB4zYIJ5o}qm{LY0-SFPxPbRs2&T20JxvQXS+FQ)HredI`nJRJt(qzMqngzy8 z$9ET*SXUT_kK?o1PPbzFqXwy-A$orQ@W7f!;8vIJ+#!VsE>0FS!|t4jd~%fWdHc}k zp?yDASv$wU)9d2nOLc9u9Sl38CwEq~jR?AJ~=CR`ge z?*EMDX`9YI%ttSb;_M1b(~a#)PU~*YLR2!FCP-ffRrtMT26UtS0%H=cX7{HATcDn6 zUGl9=LOa{-kzDt1Cpq)NF43q2q<{nP_N zS&E4yKIe9k?lISa(gi41AMEGvC~<4H@}Y1J=i^S}^MS-ah3y^hs%14$cyfopj~-$7`8ll&DF%HBgXGV+w z_ro;>$is?>9L3(FXPHYCLf@_O z4(tV0`}A+2Q)ccwWgG`oC!n|7;TF{LkSm2!wwIUBBl`GS8&*O&?!{;i2B=-iKp!Iwx| zr(v!wzYDn|GdjTMfdV7cUqkAU<$P1QOD!9@SvRH3_6L~0jSg1s%XYw>9n+01>OABh zhs5-jo98$;4`@PP4s2PabKW1*sR1L^2le%EVZtp&3+QdyMCl37uSrs7gr3ppiRRB9 zsTrr>8m7bxW%#lVZBe(QrvN2haXtOuK|S}TyemT45f3|Kpn9NG_fXCo zUllKngS?ND-OH|~wR)vTexO&X^h*xYKJ6+aebwxSt)}BzMPXhUGq@w>98U9%&pGR@ z+w>KD#u$^EIsk9YY`w}DF@OCe@;P~|DRwXc)xWKQEPi-)Yapg29j;69-=nNil)0fM z%s%IBgSl(DY-jiS&M94PWsWZOnzjIKSxoF%jiQfZK3g~G+_b9aR(|SVq?2E0apw-O zVli96A5(kuXywMhdx#wyZA74cjF>uH)uVXRbz1@RAMSx1UUh+eD}PFC3Ai);UzK+$3xIN(b_F*1rgH)%_c2$d{Cqz%5Wd8dfLUb@NCH zGWPRFHPM&)WduN93p#NrDj&f|sE7UxlSCt2n9VMW1}jg#+0B#L zyC1M}p3Ht|q*sH5oLE2vCB2{=6EQMBfgWHbjvl@p4YYwJAaB3mHgOXXg}p_wH96AEkHv3?$;&9hRXJ z(DnVhduh$}>S~(I@9kQDz%lgu3*FB&DULW>kg>w0}_q_l!~N=GYCP zqli5X<48D!v@BO6`kZuR0xKc{g1s-)Am$Wd?Wp>krZKKz>+dOQdzQGqR|b$RyQV@_ zpCYuI*rp{r>&y5QX)Uj01WU`QzJE%L1Z{TwZ17n#bFY7KA3%cX=AZzHPFF5pps| z46X2mE>GK$j9k%dTVK@)oKBM8!lb9Fszmp%0;`u{&VgH%q@$z2=^urjra2z*ZmST# z=u26z?;Ftxw>;+bSt!R!4#khD>o@X-Ff&bB7CE~f{9f)?9ZW@F?F|nH)a4+#ZCF*= zv$6uVdSMUM^fk_m-1onjfR05VUAEsL(uSWxZa9dN{wGwQJB(9PQ==_}YP~Z@<8I;i zs74fJnkT1CykZ|iW-P4kbsf8|LgqaFM{-ch~l1qKvO5&5qJDeaN zCj2jWT!#sp`)_#MvxxVZX-SQwl>lO}QaZe`rIH;YY_mNN=cvdjP18itmopEx&HdyMmL-o_%fT*#NJwb|-oMOP!aR3wZDgsv6%P3a-X_TH zrYL<8c!`9H7QggWI!vZwz1N-nu6R4G72PCrhMnzSTiqw<(#J1+9HLCUfWa{902ZJC z*j%Yf&X=dW zXs2seuL(QvjaKg4@ialywu~+uE2=xbv7$XrQGay0U$^cGe_~iV8~jm&|Hzh0ZeO3K za#!9duRSlN)|@(41mV9sg#WN?gipGx-GIJC#CdJ{=xq)Ur**0GGwhsowW?+EUl_C% zZ;am@Df)wZuaXa||56vNWuYSO7<4^VzX|UH`=~1aJs1)Q@4y@sk5;`s& zD;Ang*0OhyE&p&0a3TvbdLEmUXODgT@vU$2c~|68xKnT3c$hGbD!$LHL+_(YHix4z zO=v)?twVeFbBCqCzH`r6!28kc& zjak`JEF=U&0eK>rUdTchW}z?nkzo`Ym?av%rd$P3G^c`EkCb6=E zlV%jZ)id-|z`y%R)OKURec3=T6!S|R4I8Zac9TWlz`MKyUCtrQEojEFN=`hCGs4_b zd0ijONL>he;~2@bkG}i%*$cU$Aeu~0}`V*l8XmI6y}c$*fT5T@Sz%CZyt;}^gcn)n59uis)a z%6Ey1y^Oe1wCZ1^?9R99pyB7W1_F!_O7XmDH!maiJPOo8)VLp^dP)_9<6esb&1M}K zHe+p_t8GdpRawrQl@3xJlTs6)BB)Li%b+Ha0j>zjQZqhr2?pOjq z*F5rlvX_8?fD3sje326lZ3%hV)0U>s+II!b>84xznC;+t|9-EUZ|Fo+7lYoEr^W)n zt+yk#z#{q9wd&yB8B;2zV(($ICfNnddIRZs?DYJ_`5#%=-h5I!{K(K6`8{!h?rLnnM#xt0NIQu7zTi6xk=s@cUIP!yEpM!v{_N8=sMy2KZ)6a(4oy0k5&;r@ox>nW> z_%v3__+h`1M|E|e1QnYSR2@494u=UU_(b;N*4~x+1LGbs#ld*_HSq`^owI|Ws86(X zewt*LW~?q!P8;XR2vCqyExR7;&XbW6zqb|rIF#{|*jqap95tItd)SuI6;a6Ct2`dq z92fDNds#LQ_zirsVo}w)I*a4;jt&<@`5WR~NE-}s74QvKu21)>Ctj9FA z*-z$F{40f`gdy`Jk}n_@RZm1@zlx}~Sxsda?jJ9kJWa#+7#YV)ZR*_&Nlkyiu$7fn z;X-X~Ep!H-a`WyeCslgW8lvRatwR@Ps`I*0qelkuc0$fiLD9ly>GV;?Q0lyDsv+tw zCnCf__dw>d*NWCu_=qW~*yf^bx+)DQQGtii#k~oah^=MGt^drOyrLSCeS&ZwUHNM=H*!tvWTTP9y*1-Nz^@b zI75hB;ZmgErZ%nj=zt^fsrlANHJ8U?bGF+Snv12(R+6--k4r0G-Jh0w-7cjJoVJPh zp{yLjZpyy4h^^w7wlD9M!#HtXSnq#WjXjp`7R{kC3k#eI3oP3&?jQA)UXF_JAmLq{ z&$y*Ja}IMG7MHG+^zNJ**TWsqE78*CmN63NQ5QHn=HtRI)wwHmPUG0Qny^F5Kv@ld z@;X?hY}YjbHh}REdJNxyhzv;k%KR5hUt8gZoA5` z#>>;E1}X;gMo^PmOwZb*mZ*XhAxr#nJF1q5rUzPGwwZca|LaTOzVQC(NDFGW_x~RX zcR|_bc@k%!8QQgy+^oXa&2Z1CxfeG6$_~hsi%AZNy4JG59DGZlMdZF%BqYrtDfJ~= zz77hd8}(~K5#n2o>*i7j;Lswep8Fh}k3f;Smsdg3=7T|kOd~MfhF}+0!4sDPLBw_| z2ohQib1teXcpMS@74_w@s+cZ+PAiRzi9bqDtYYV(TnC@7UxRVMC;=_7 zrtaBux4MIHi4i)y=3YY8WG76##sNW z^}ZwZb#ZS{O3J zPM#FpT&k6ilaG(jwU$1|<@Sq8`|6vQLhg^^_t^V3x)+75S5BUHD8P*nE*_3B6y3;6 z{EU7-m04*5g=E49-cZ)YqAW`SZ#`8;(N^?_fSDb0jLz{iyeH@F+H5=HU}mSmV;rJh1mj?wFHjOV~)%bQxVo4-`Qg6 z{uJQ;O@RAegV=d&zrLZiG11=rL_oBjRdmX2Fel7b%@gbWbeH`SySQN~#VS;Y?A&>g zmno4$r%o)nKX!qg(QZQStl;SlXbPTa7*2E$a%*_3P(g}X#AUphQ{j|l)qPbGt?!>D zC59+`t6+AoJk9`r2kZT!S|VD072Z^KjL*Lvcy@7yk78MqZCApt8L0#_k_D6hqfGoZ zM~pZ-Z3%rx4@T<2=nSjndtNXDp-{R>_p0JhyXCsR%U_XP9})U26wCa+^*2Rxc!|aQ zOwKj`W`2sNnxk^vNoQGE3(Eu6h1Thc3=IvHpmX@&K9F`aJ-3ocGh<~+0Eu+&t})6o z!GRWs@U8J?{`P6pK zwe;sLa-o-j$(+$&wIm*m${$~;PK&#Jz3bZfZpG0$a z>D*tKZ9ufM8|lv&KK-oFZIs)!QHY`s>{G(4jQHkh`Ad1F!znt4BMwMWdjhS8ufomX ziQ?VIkN1}wn;RI2>5iKmDrC}oZPoU6b6^x2z_JtD{$a$jsz5kE;2HyrT3 z8XFz8eX65A=@Z>|X!jW;4WgQq>1WR_=ODY`n|8d14ai5csggmj-a!*lWgX=0{%BYa zEqJGFLkT=k8HZNxska;2dKa++ex}Tq#7vYXtTlqBsUE8MawVREvsuXGgOq!rj-qBJ zb(_EAq~QI?S_F|W>Q*T4A^fBI3@H=w(Zj*S@`8NC!0dlm;R?ZI-ml5OB^4hnnn*8oCJRiIdBzd>^YLcgFM1cJ^7 zkX7NmWkf>*Lg%L00rpO2E8*vWdN@+)E)N8*_q-V*`4wO`$_uE0=DlXG=QXz5z9sMa_0+yC2|jD!u60 zyU;)`e?tqA2w{@=g$>xD$DK`=#W2=L1m4I3=IIpT_u^rawGw)td3x1buWF*1;-EK) zfLTMs$yZG*n6XxyVxvmCM=$USkw}=141u1NZO5KDdgHu zM5*|km$@?;V*xk|?h-3Mk5*xsD}eO6B<~@MdVZbcQaFPi1HfwcD+YlDPuOO#0X5)& zoh)~gBN?L|QZ$D6`T1E`?0gmnEMHgNSroinj^V65M_^4hY9F=rDf!LtD4w&4V^EUJ z`Hp{iHN!#csB%$oIi-vBlHkua&z~ZPjAE47AU2=%o@Wu?Mj|cPO;9Cy@S)iqGoI@E z%&L8NT!)c&B}5hpzC0?Q!)^M*W%A2LHnfY?zp=LTb&5yp$W5JbJHL9;!fSldCa)&0 z8Mpx??EJ~YnthvhbFr){-aj{q8zKQbbFX|NE*UP0VPW62*aRWLixabWaYEn03D~Cc zEIcTLjM^(TEh~TQ(U-RGJt`t8pek3?LOfbTn_Cc;JfxXHuxbos$C`&Q@!xCDlEnOu zN?_qT{-fKyweGUlJ*&`NjXXTZk1EUEbTl@IGV`d&e)5NYf6tMc#qeU!(NJe=$U;T?1NZrUsqV-tC!ynkyz!{=-7 zzDBw?k3Ja9j@r}(9V176lqa}zW8KSrThWXh?Uyi@;Q*6n9m$vbR4_mrLm>-ThM(Oo zU+;Y|tADcO_5M%3j|ThURauc@Qgn}&5AS!0AF1Nq3CnceR(3C{9DS zTJ~z5C>OOI6&HwAu{E9gel%*2{H?`sQ%gCi9KVrwmwVFM-TPaJiulGa7>`KlW-+yo8f2_x z?2QH}lV4llR7S#IHC%imLTmP!to!m}Ki8Gx<^AII?uX2`df)>;xvyLKSzqBU2-$#1 zSc)6e>Od!mD66n}p75Ji)K)kyAFX-*aHmNdlZL6Ej81*wJn~O)tk;#)v~`9CRiBHu zT1L=@)3sA^WUY~#F4~ny?rc7+O&%jhA+9&>Lt~fUg&r_X)RHdm*UGuhGg&t4@`2TO zp)tzEgCtogt^ec;^x{o`Nj>G(eA3auPhqHdKz7IHWPT_1Z$V5$ATd}Q44k`8RB7U+ zZqUH8wwj=h7>rqCL6Oh3+fGgWS%nUA7V@nptW$a8q=FsgB7O1?^L(h3QwjI|?3j&DD4L#9qHdbX1n7#|=drrdIeJ>M*TSkYXD z3b8vJGaVz(vWxh%&s&Kktd82WNA)}J34+3g{QMFS& zzQCH$UoI`k3ZG~AbD6uxZ;xVHvG>`Gs7vTR1ttdL$EQh?mKMzrEYtq-&2gY z=PwLRs>nT^{JPf)DnWrk!l$McBmjQR{KiO#Z_A^h(k4N!JupeN+{@q*Qz1wDzP<8$p41auvPW%%H z=HrU6PwFw`rpBhGCQZV1rrF`px=&(u(-V$r@{%aKoN$XI3e}Oinh;-!1*8(w7cIdp z5rWP!zQPBudkAN6I3k%$zPL(4UcSG(yJQ7w#pa=rH!w>A=IDkImB70+aigUSaU8*R zG5lLDbSuztxQ&(h&O0s(qm-IUX7ov0lw*(TJd}}E;(`VwdsH3XqubfcIS=+SuUG>q zvNkXsv9oxwQ%`4R{nEl| z92?wN(2#2kfC1z}5%1Q%BNXMGAHn_tpxeP-u=wHyn9jAZ3~u08SU^>{zHtd1O$_jbS1BkcI7uRrrlu-x4z2l1RiE#ZA(kOIRzhCCp&iR`h2H*$ z9EV=4mnAQw^5ZfGW6{#mf1#xg#Mon!*59a;i?x9mR&e-lCIK^s>2zqKWx4C^=kG8a z?`j?aw~dFIq<>{TR66}=8LY;m6S&`yw+os7QUL50Iyw~c8!cy{kUY&`=Xmc+-i%Tl z-weI!_!>D=A?((d=EN8Hg_Fq}<&<6w3DCTIO7fwQ%Dt7l);+|2pp zX)tsmGs?zG2D*gQI_?W$PGqEr#d(m$#gTM-42-2?&X~rzL&Lv1N-1uHXx7TgcPj?N z8^h!$op7X_IEz2wPN?Yp??8g{g-8*khe<1N&>Oak~r?JQq9HL(6Onk^hyJ$R%`)T>A>fyhVD*Lk|r?nCimIL%oZO6&ASKLRfIOz5^S= z6bc?t2{uKbLuv^vT#ySA>;r>8%}0$BQ`u8eK7jZrtkG90({=3DGC#NnKwIEPG0_qIBvzx?UB|q5R?Kq62 zR!Pob30$;6sCCB&WZvO!F*`bxPMZS?Rajbf| zt?X0w0wxrm@Yo@76VB14Zd7(Qn~9>mr4fCFx7i*KmBw|4U7NR0ezi08+VP}8uKtA+ z_A3OIqGua!1z}!U)mT~{H$MMzjmqVx3CD-&LRIEVBiT7jYvb@es@%$A=-o@R7&bPq zv{*Dj)chyb&tr5pkzn7ylxoATtj)FRg|piJpYTQ*i4$IY0XGG$jSaY!jl-p*Q=s2{ zYkz-jZ?9bwfotU=5V+<#i(1c;LebW1NBGDJsLm%h=G;lG_Cm(A_{;= zyjWlUdV%T|xU^0A=Fds2@KqRF1;9?B7<+XF8BgP!z-v0 zpS51IZDnI?GM+pH6%k(9_udq2o)b-eoZo4iEWD)JPR^Uf>32#E6TE5S!InjAJMPZ- z;)2)&Yx57<UKc=Z5wxTUB=U3k4df_a^ zapBDE!z;JFg$@RSe&^T5XAsPD{dcUbKJsvv6bW01(_lbgEm@1%p}6sL&kLZI*i@A@ Km2wm>-T8lGZ)9Kq diff --git a/release-0.20.0/docs/getting-started-guides/mesos/k8s-guestbook.png b/release-0.20.0/docs/getting-started-guides/mesos/k8s-guestbook.png deleted file mode 100755 index 07d2458b3b54fd0975f35f0a6f78fb0e48e287ef..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 44000 zcmagFXEa>j8}~gk2Ez^yQ}J}0sxKa&*B zCj31D=T3e&Jk7RO!xzsjF~-ukjB zz^|f>6#w?X;dASv-K?E^N#N3I6{=d{eq=g$mpD=VoCShM z2t`3_YwJVCcb@EYtUx|=s{$TH{r7KMy0Wyhh9@h*+umNH?a!ky=vZk3#SO8owCX!Z zjFu#{fv2Bh-pnd;9IUOT$W@c7GNi;f@9xYg(@b--BZhimk&azd!--+ zG!A^;_J{p?FR0Z%Ry$&pnlg&TxuO!l*qqokD{HhjevES)RO)rl%Qz?mUub5gkSv#5 zUHym=65653-{lb$LQ~mqey^0=bG>m}yb8wU$G7IoVxy73LvVqK7!!d*vV$~Uh*HgX z^LMurOWDcZ@7`O~I%2e-xRwg!c_W?$pw|I6kFp!no^IvGNOL-1xN7g31=6|SoXttv z_|+GSvZinwsg`9hmT6Va*9=L z8QqF`nv0tSEZc%n`_r5;1e$B~pon7gM|5u+B7cc>2Yu&86`;N$!*16fJ(I6D zz1gFMjE_#X?7Lx<^A zxMjkAHTowZnFQ6OsH6SdpCG0vw<+eE2+o8C#5>Fez+pK=k|-?59w}L&Ye59)B&Tc* zIvxEuy(2KA=~cxILLPx{Z5l&WoCm(Jfo*jkDda`P=`3ozxPz<;Kod5EZHU(K)!ynK z-AMG~(t00d99ZO|H{?E~f&8_>gUB3m_N|W^x>7)^SJl-uHKHC`&>|0YYgM%y0~$*9 z2nr~TGI>*jG;qfm0)(8|X%p(5)tNZdRxEWj63d9Z@hvZ6jNa381~>w9^5yWR$XrHZ zpw=I;WDx72$3klJ^uiq9Ki{~n?y2V#bVF8y2&X)n4@f55?A#kJ*Qs~H)DUEzg#((9 zln-q1(mKf3(O8WzEBQU{K6(4{qQ1WVTm5}{?*9^=Qly!#^@u@I?n%iK1*2(n((aqr z9ai)+nZZ2yCn{Q1Y0h%W7k>QAwuz(diQk_VLB;^i60eJTof?R1-yy~!b!VUJH^=r$ z`AnH*Cd|joN zrq*zj-1;eKPN^gem5wlT?P<7ruag4nbKOV%pu!Z+dr6aqjyAF*Z$+XyU_cr)Photz zzLeHAtpI6H3v=%p#Przk z3UB;^U2mFt_hES?y+RW-6NKejuzrpb_c7lQX|s1rr^r&}ny?luJDIW};#!LdKVzxx zvCnK>tJ0n11{yj?LD@47IySg6xD7@bpFMF31S7;e6@%_1+XrVhD%~BpZ_=QTvv68E z74uDicIPrm3(wVgu?_c1GtLV=sU-yrR7mUdm$$@GQWoNP&HnP7lgI)|Ekb4YSs`-V zny~g{Dhm#m!}`A_JyNPZT=F&tx>A`z&=AQbV=#)nLqN?u^7^|0bpUF0Q{@Jc-&U+Q z-C?d3iCGZ|+F`Q|n65UfDfKaMBTHk7WUCUIWNR`)QW3V0#%ys0;qR28pFV`o-WxB*a%u-z=k5|6n^ZjG{N zJzALmDic4wv-9GOZgCrIRacarlUrRSW*EDRP8X?^VhK;yyyr@*`4O0>N-!pvuVq%S zmasM&dHM{2VzIvb0#l$^O5NpH>oZ?uG?unfk7&uL#^L+SA+N&U4^hz5Qd%bTT#qiVU4iFDp2pQ9B8 zdn+L+gNfo^mNhvsPrjrYyTkYfZwKpgpIyPr=5H1GRy@;=Te!uQrd3}B|Y_kIef z_j2hengtGj*K;UDG|DxyFgR(BWfUy8Qc?eGGBL9|4$dB*Bs<-mmFPKhx~Cujch%#4 zlcDa&E0-T|A>rN?l3puH8t?!nA){2dK7Sh}Jkm@t|td7Q)IuQ zabUtUFNG>JiCy&xf!z4}nS-Oohj)+#wYY^Ft|w{XvNCoc-zDXbB9e~r#@%3V>{+eF zyz-{J?2^V}WNta6f59@d$!Jio`6E|=v&S^vI)ygqS?rSx^Vl ztPY>D$~cu@l~6y*_EqYk06iwgyh?_w(#8)!>@XoQ$G)6tz@d&Q*`1$&r(BhUr=vE6 zto`OYMujE3quxG%>+SUe4qwZcY(e+Z%yl1h(Ij8=zV2expGB0n$dRK3*Aand z0FWj##>4n6|I@@j5}!J_o3(Bhj2K5h5tP==N>rt-^*eQBU!mdS zCe-vH=ytfHYD{r`HTk!OM*+}r)-?l;-7^+Us!uJ|Wm6G$03Q>!^1VII(=1l7hm46x z%ElwgYz{U3U)^krP{HU0RhAizF};Ia@ovU2 zW$RC6W#%s-*Z)BsJ!Xc?hHkVfk$Y8pGhydk&-Is?CPbT_E~8`#JLo3JF6UWz~bniF=Sj!)6}1V0oxO|plJ;C@x1(=eSIuhz2&e_ zL_#h@=-fhScL-9gsR4E%j(Nu}!%PMawcC7bXC)CAU~?AtcoZ1a&Yde44b)(6StXL zKiY9xO5Rh=hH}rFn^SuPJW_`WIxO?pjuH`A%<(1@HlQZ=YQA*07ElQmTg z-TGf$KgdBi069Lg*jn@15NX)b`Vsblc5O;q|NX}u`$dzJIFXoeHx`R=IDNq^Tb@=J z`fgAil0&1Q0W+^3HhQl?+RUNh zyOtR+N8Wxn`RM6fK;_AXGuWyAYU&yuR`o59%HviG#d9ar>>f^D`|ml^pTdIs(Tj5n zUr($F&;o#F+0T2gy-v`pd*c(gCFupT9OpP^TT<3^=+&t(g9Z5-4r{QvAEK|?o0@B8 zZS~-SO!xJB1)Zw++|ZUwEi{}t(46NIY4)6gy&0~w_IF73$GNI^YbpB@uHP~wI=Q;Y zvV$De$U&o$L|)0I++?gMv2$2IPVd$@Z%P6^=y(Xub2u)r26U}s=~u3`a=VJsNd}40u43D|z_k0~qR6qII&Ym?aET!^X+na=L?PP8iW9CaoBm5`8(j zt<+$SW4*9TjzE9_+ySq_k)^DX_1+{+CC37jJD>j;zt46w9Qnz?D94f6VN`v6@HRC; zTp~dp%iD-t@s`em?=q=~ZGS`av&RxBqF|0JX&HkUX;}>H#+iZ%;STPlh;n64Ju5q9 zU|`@Br-Nmz>Kk!{k5JYO+yZYpE7AR9#;nGC&<@7>;W%8cRQR=|j`Y#)u!^2+Sn?e< zA9tOw(+hEeTdZR0t8my)sEK4Ucv?69_8R-=>CqfLv<3}yVscm}viu5rOI zn`nP14z<~;{36v-i`#WQE4*t@11bqa^nJ`sWjp3>vL9rA!l-lF&^(ptFpejv!QzGG z&3qduo;ODA1MTJY+^1Sydo+6Wjrk*hEpMoZCs>y`&&%o)(- z6E6ixn;)qxx!$qOKhR2C>84(@77ZVj*_F%9RI(88An_@JY9L0PB?;&`eGz$El0X*+DI2cm_ zFt@!UvfpiK%=1|5HCM6}NNG2WzKY+hbga9-of?8)`@S&20&TaQ(p$=$_h?g9!K)1e zFD%W)_>YoR&@|b671^Tpf-S060s#5siM$+GyosUlC$%I>n@G*&Eu+i-bNF8%H1NdxYV;UPs6C5@<6 zZ?l?g1Un~sARs|?cH~v5foIBwZ5wND$079vN@=PqdZG5@(ind4oeTX9A7?9 z%bcAt>0Q@w!g)n>-E!wgH~(ngx02c%pvO#UQygsjq!r1D zcL;{ZQpz1>hU5Nfz30iw*F*U@^$lV3@}uMr0UD<&l7 zQb^*@zTrVYvDs03@GE)kTYJ@Pnp3-X$KB~tdBf%4h&URcH$t)|Y>watA;LBk2HN)D z+}NCls9xiqlal%RrI$ZS1&dHN4p7dy4oe!%dwrwqO@H5u6VTHqPFg8Rb-i*{WtP7q z|7fnPtZ2TZ8ywzHd0R3VC4AGbl{EH(K6-DtXm7rJO)nHU$rmo*yenZsE?D$47zzg?tS7w6&t*cSM-%cy;tfsa4-FK+{ad z<#qvClIFrhTxLaU9wnCAv8pAgl=}~FJ+i%Bd>zJ^X)`cL z;SSl&i}-Zvx810f#L90VuY%r30>J7Cj&y$biKe#_qxE^ol(lMODISBk*Oq$<>-g{# za$mUsYfI`db7E>R|3!9u?I)<7y>N;;#j38wNSbDDckGlklYjin13X6CM6=H+7{J$j&->kU(qMAEaP?EtY5)wF82lj3hF60|l@^W->RhBep`m z665`Ls^yTq67D^g$@H4fHeR)*>8xn3o;$+0)jI&j&X!qKN;cx zQPv>QmtJRg$l;@jZzWvEQ#s4L?6A6?R0LzfP!E0S2{d-*6@bT$%&gC>|C&u;#OOhu zs8M?oNl~Au^pm-slzCx1uFV~11Lvh(G$_d;I+Ixdlo61aB<0rVv?0Zc1G8T+)`SlM ze|o^sZ{FE@;a^ctvKw3lU~(-0gD3|PYTCi?F90%s$s^f{=5=Z` zJvo-4n+lv`0eYq4Ne?Qsb){UEZ#d4)_GU_Oq%E0%9G@hkzjTmsl9lE2CQFXwDRa}C zvde#TN*o?G)aaGocjo@@GOya=XP{r9O7` zf2(s-iV~HH0IdWff}P4V`Q*brp|@>(e2*J>pYkx>e|wRR&2-d1+7uKa%C2h1^S@$R zP_y7z)6iY|Pyu)7Pf3Y!jBF}ASU20Aii6nYIZ71!UW*K^Q4L2)k<~CcnLqqS2E}Sb7F%*c+E8`CmIyAj^oTl+M8|vAX>j2}MLi~UF%e|vv z87+_`lk_((x;c?r1MYFXb~{e>$iT9J#R_Rr26U|o=VJi5g{C)Pqn;o~-}^<-Z`59; zJn7b0ik(v>jI!{=xevge8mLX@NBKI1hR36+^y74s`ZfG-sRm)|pvB;add__J{=~8c z1q3WL9=P48q7W?*NM6_unRa|{Xe$@6h54lJ=MYf5u6j#_DN%-{dDVM#*Ta#P9a3QT zhdZlPZqG$Q3yQsCy#(AwnG4}H|KrOI;Mc##Ty{qdcRhvr#>4Zwi+n9fiRd!Y1nb6& zSxqW?jT%8k(`^R@4jLSo{u&04G~Tj$t?;{54z*=v0VQ(rmoN7w+|{P#-{!4r`dy|Y z&>t-;1~5rNO9=-fVIW7bSY;A7ndI@7oMeD<7a)aOV z=K*3KA_(km<|Vc*!|EvE?@`e-HqmQXk@DYU0)gjF83rKO$d)-QW;%I`6H4sWT(%XD1=BJ7Cmpc|>G=Vh4iLW)#M zLPczUK~O$y%pA4Jo1a7jR~TYlI{g`c0N5d3N;tW-$l*( z+JT*IKD61(O*v_XupfA+6U_SNIAv@ha^O;-W(Uvam;|U628LE&gVI0zCh`EC5)NxF{~kBo}lHWdhj%tqv9QgtjDnpiBzz8TD_Z9N@He zBxR6V5eNrfLpGCPtV?ga=l@{Q&9Mw}P>kKga^BXX?>1HE!aU_o3H?j7NAdh_tvFoI zGoGbXO~%@F(X{gV_}H3mhAhC-%8xx5`OE*XWkMTIKQUGRhI~{D)sFQNV}zPjwY5z; zAvN9}Zsjbq)Ulj=j7#u*HRR>_la5Ak^fZ&?6)3uEza$3s2&{0vb+*u0z^??W=7^)* z77gvjWx}La!2!2MM9ePcYtlQn91&?Qm{-S^y@HLpsfRYRot>RuQI7J`>Zu#hClp;; zn%Vfs*!YD`sqZ~}l-x3;%Ab^!Q##~lXr>wO)R#qitfVT^Jyr!HLv3!UfN9Yuz; z%2wIuhpKF9dn{w2EvGE9()!HUM&>(>=Rr3=dD5a$KYi0vy36ldwCU}s!|!Iz_syX5 z701Aqy`!zglsh||!@AeNm;N?1(qk%C#u+x+MGiv8sFF;f!sm3#g(C~%9qXI%41p!t z0l*b9N@}~@$qU}%JDh@>@Johuw82WbT;4oF7*% zlybH*gOr>H97>ux{Hlh6Q7?q;Nk(rntw z4-3?chxmIc<9i*6@s?q~(G-*E^2pgVx!W$h$M0FVm@q1qA6~7oWVagq`ew~-3*-c- z)5A&)*m!we7SJ!-7E&X3J zLy`@-ypXu0!l`=8#`Udy`}+?b#JjQV^){+4fw0V_x;K^FlAj@#+T{h{F+$^U?35;x zuelu9y?a%tI2w_e+OkO>rZD@5Wj$6JxzvgDheB!Ov{IHhb^3x6`lzzj9ktm|-!vX)p`%f}#%ukn!=J7%F$+>PiALD5bq&Obksf~xn5h&;!F~Ksg;1pBaCLEX@59nxiN*V#E1H2G1?}fnS z-w+t7El%nf1d(o;tqw?S+&ZlZ(c!V~h-Cz+>46-nq3!f^BL#;UEfi9T^=w%f4~6mA z5V)4ah1;{j%+`U*?*;5Xb0pVWdP$20chI)ECAs zcknDH#2>3Wwy9uKAMlC#BXPtj++PO>}V(lwus^MqUWGtuEqXZ_Xtd<`^v z0($2ncrCgix4_rFdil&Pa;>~nq(*gUi8u+5GytAIZ{^!0G2R%e>b?cKvg1CZ0)^}V z$eCIY-rM-*0T0Y9VjS;MZfFXuTQDWaIwOUR0r*Xf-XQYt4XFIcZHj<5Cz_V_~O|)P1yEYYEey7c^i|cZc=-Rhx1h z)(h4r8iJcl#0EBb{n=u$w`eomA!#NW*Yx&>QPR!j77!Ez5LFA+FrIyTzViKUtrb?N zKa(Ec`r#gZFykY$pJYvF;e5~ew~zlV{5QWsiMvm3@!rC*MC+ly)>AaeERXxiN#W>^ zt=+br8;qnKoS4Z$SB!%4#H;=GB*4I!hP*<7QeSW7-9soJryWEKqh7P8`iK4%vKh&l zzS~WDraNO?ne3#l-akcB|NMGP{Oy}x|5?~s$$Bp#lxgo9=l^Zsi~Ypqlb0$sT$>Tf zOQ;Wwk_V(wIw**Ek>OJPdK zVA@AAqolU{9Mrb6+#1eJX2bd@C*{RIsPa|1CqZS4kMpf6+g685P2Ej5RRO$1I{xJK zN~?>)ipTw9s5S^5A3@(5*%-X9bE90&5pOA5z$f*lH6t}W8IY&0D~XD!sG>?*g>t#i zhIizt0`lIA)lgUyzMD`<0;+~(_3jEjdDAtY2vms&Vgx%Xp}@J3tY^0ye?bzBjizGR zSkM*Eb;YP{EqKos21`>rp`X9)JW9)x_IVQI=vZ15c{Ir8?^fpKx~XTP`y>74zTex{ z&Z;ldIG(>tL(1Eo;#X&dstN}^%EkKzv4a^Lb>qC*uM<}wE(KX);S?Qp-p{o}U&Q?X z)&?incdZX~I}KKh(0VCk#h~(Wo1T~Cxh5dZ;m;is2lZ77uu!h zI!2*MUsAl~FjtgDhlLKkhu6t-tE~uWMRoR`M#bw{8;i?5bIH$K5=Rqo`1CudXzG;c z=&!x2&J$2pG6IDRTvqjPpM4$sQ1kIIu&d$!*p))ZfGC8JnB|Q4z~=P@LG`mX8G2o} zeCHfPIE`GBUd9`*I3qH@1fxWq4fc+%Qmj{Slyl4mmXP8f9?>(P8GT>FF;EBpAA(RG zvq2h%%nrY9@#U3UVcO&gFW6=#xN0L93)mxF3+t1a^ipOgx(4b_GsYh}1Nr^wJI?qG z{FFpAN2Kc6h(~E`M^@g9U0qbTKVoxBAFYtLqNAr?Bm*S;v`~cWys?KumHX1)x-WKc zwks4}bz5uDtB6@P0GxiU1l#w7%M(pvX!LbIK9Y}nP|4+BvH&{WMF&{C z$AD=yA+^&*hs%M;03T`r3_^^Z8gyk=)QVHMz=Z^9t-||Y!jD%AZ#~kE(YBnFLN&@g zVLbVtSy4~6+@2%S(A|Dm7-}Nrq-lh-Rly+C71T4b_b#Hv#w@c79!Xt`#CTS<0H9M# zl{?EEYrJ~x%Q6~E>t3xRc~uwYkK-3#+`>&1{XB!7*drCZ3&8O7I{8XYEqVRw6RQ)E zv??TLUwLW!BDE2<9`$#)FE8ix3zgnXuYA(ZBl$v_9ngoQmV)&9I@KvMn&#h9-eXOU zOx49aU`>gm7waw@hIYPU9vUEpFLq1_tVhIrFH}=slCxWV;@nHRGM9MRJ3QEZYaw(c z;$X6G=>Z7jf>)3Vt=`C1ki&;;gT)dpNh2=~8el@QjlR!WBLi}2 zA$-I5iVqn5b~^ARk4kv3=hUzG6L`B88;Gb8r1w%2R-VB2lKL|!Pt4Q>;dQsD7lxBm+ZYg#8_bFd zbG`-eM5Qr@{N zT12iy>!I)3s80{Y#1P9LKE&#wwH6K5rpP}sa6m99Ar^RjB8waJZKgBF2{JyxiO z&>sXiIqqGvTN_pbaNJ_pn7a}R=|>C>2Fu$#3wdQbwow4z5l)SP`e;TEux}bLwzp}J zM@sUl3g*jE!(8itbMW)KS_1v?mU>BN`p|9R>WqeG9RN_Ep{gzNC_dgspvG zXha2@UfbM!^7~5(&&~Uv)(4ZJpDn5Fq)o#^Et#pgLr^3XLn?ux`U!;IPI~3K zzBzClj{+IJ+mgE7=@iGWof*RZK{=cNs1{+*WSe0Cz8W?d-Vl$7x5&E*(d6wrOw1g< zVO1LM87I4=*!3=rD{Qas_1&N-`C^wkpSqG~SjV%&HKF)eIrRl_T0>T05)JR2nH>>7 zKL+2mXv)VShpPWc+;98fCU)Gh+@Y3b>aZ^bbZkg z*Q(n=cijKV1PIq6Vfr%);eg7{f+kftH?_{e9AgiwC5^mqHveV8Si#{em+k}>$6_ckB+9Gbpf|=*2nRr4vvz{q!HjFv;ck$X}YX5LSW>6S$l>nC_Hu2k{_=NtH zsnxt#uTf}S-#DLXj_3&9vixN>NUfDg`RGyDwz6Vy)zhHmpeH`&f%QpKTSy>3U-b;n zzr%Rv^jqepX*Km7)h}OuEsdc+&f(R-*t2;-N|75b1d7t9lpYXh>GSrD9PDj#6#>`~ z^m;hxIUzUQQK9e4+uL@h|K8JolKwJw?!s`RPeOd7y@7AKIs)%AUR1A3aqJ?xyIgyD z8FgvY@$g+@n6NfW#kB_zR6t)qpvtWzF7S=`3fE_Mip&e#h&Nr$Ll=Us0Vf6D{U{DY zMqL>QYlT)m zM-%UY(yEv8(saKy#!nN=q>H%RKyJx)7S`t_mp|?Iv2ieVHKG(UwEX8M<0K_$dtT-$ zKns(|s|P87E1)D@La#~sR1WUb^BQ4CX>RB(s0mO_&7wf>vu0?Ag zXBpUH^Zu&MlHKPVdxi00XDMy8P7e{^kkKfl6{&v!j-<3{p!VL^1*+#-$%tF^Kw*rznn= zjF?6(FfEXC8N^Kk*0q6JUpo{&NI2b(Dwm-%b^k!rR z4}iOVM+H26yS$7~L6kxdjF|xf>PwAYaxJ}3zVnoT`D(L4tj%l-l}xnH+1b&?2X-_; zzKTF1f1+TxSUV}XUEkb1CX$*;H}_*B{gNyZd6fM2_mgzqRc5Lcva+=5kGJ7No; zEX*n5?WO;&^J#hS2Zvz(Y%QL4o=?S#|JgL^prA;%kv(4e_xSO}T- zu(L9T+yVp!kjzrw#Wk^vEzw99v(Gj5XBc{V#Ch{LUWpO1BZB4dfQi?X%e*BB0AwkR zCcQ(;lFM@3_>C7%ZPY4O{v&AoTsKzB_LF2zhlbJ4ULw)#K_|uG^6e z)a;swNG>MHHL6fKbFuI~9HnxvWHo$yHC8UBJi!G`3(^zgWp?6d!cwg{a26gGUPl!0 z@k#z354)=J)m1CkUaAD<`Fvh6n&W&EH>#Xu%#0-#>k&-`EHhkE77G$UH;got_8|yJ zWLpYGj}40-pvVSPFefQ0`yz(-51_O*adns_`IWuivy}$QuZL(j9fXd99 zbgKF#az`hx>c3819`RfrO{a4cT{fc$1#MX)Q)90$HdRMYlaqHJC>gt$R^e({16aR!UBzeJ;Nm~imwyHxNStlvxx6<0xn!s;-MIU%s>Lw9 zAOcDjPufqQU~Gv&^JOKD_i`dbE{gtMTKtrGtmJ685|Q@Y3)TE5^cpWoGZr|%9^S^0 zbdD`h)B2~Ka9Mw~pOsDuPSz8K#b7j1GGdll7BoZu=F6vvn-pxh2;(<5*UwSV8es}-7dE_zw$8x`Mh@0W| z#bGohv~9^L`Olw60UIHwT!C|$eh=<^^I-KUE;+8z8wo?G!_V4W72q1Yc&}Q&cPZ== zU1#g1R~1}l_&l%(A!IegrXg{NQnB~h;(Y$Y`dyKJRg8L zlq>U0EWci!V0=z1`ERVO38{zk;%jN&;=B$6MUnjN>sboEbECYW1%vhKQp~@Fp6Lnt zyEG3M5fZsP{Q^fyd~o>-INuSo;Lrju8F+IAuTN( zxz5a!Uc6h&$9&whd76EC%QO8WTX9oK<-tz(j;_S#pqa?vi10s}%x!5YN{@bv;~1_& zly2A!*~4L0o{NiE$J2(9x1AwmS$MjwwTIf1A0;(?1W=Bm7LqJ4_#4>_+_i!Vn{pYw+gJ z8gr0^XUN6pci}Gswo;f+tGO*7zJJU4PvSCg#*q80B&`&8gvStAz#jDa&cy zd;le4IT?Zxn$uqr*!86?BxlliKWf=QfLcmd!xHl9aa@Goc~K2eaDfz9YGDBW3QRFe zc=^&#=$J&#jAFdX@G4tn28@D{&$x&iFY9WY0rc^x+0;N4d8ZmVL$`lB5koouoc~)? zw)r`n9{f*lUgB9v%gyP@;y?dGtK^YypN8>=^z zLss@LZ{1s+uF?AY_lj|DUj7-u6nP`kL4T(Ze4~i zz1@Gbl_C+Y{eYt&XZE@L=9emR+Q#$=_my7d*dNy@SrU2qch0LL**@|&fr7r&SHi9d zYss%q4Le72w9E8mSc4NjON#`MRzO6k7eEJp z)-s&)I$^CS(OP+tm-|gKQiwrHY3bE~H#q(7*aV2j2NLH|2XPG4E6nf!guZ9=J$0gF zO=j%SPflwY6W~^lXf@})hPO2FgSa)C?t@r8An~+79-tseCwSrb{JZOF!45Mn!_o}q9(z5VO%b@DqFjMFAj-RvZa zA$*m&eiXt}cA)L|wbFxIw@RPlFsxeCy)UX*_=U_iJb5pZ)X8HIq)dX;`&= zQRq?X{7^|`Z^G?=L+*+K2EUKvi?$--m;XQwL;XHozWDcE)Jv-z!|Mq9AUwMgz-Rf*e_W`$mzgfJ`wHlYsJlki#7alJ}27SM6SZMn9`B={n z(!1f+(qG>{O8u&NyZ>*z=kc41iXsWazq@un84dfz!w#gs&nbqbDQ!mhr2qTTHdDnA zzTbY?ys7v);xAw7v)Z@y+AN}$G>Oc7Y0SE>dV12@wLv(x?;J^#eFMWJHX%hFp)9NP zM{}T#Ve+e2vn2;Y)2&V8@N-w)h51EYi&sBAtk~Mr$hMYM$$Zi3St$9<2G+RV>QMtz z-cu4V=K*sEA6xn!fQLu?5QD+!PfWbO*pje)`t(YvSZfdu+hPUvGQN2A<=(UDz}D6n zD!S!|W0;b#Z*S1*aY8p_WKvU8p$M_FDef>KU1iU;CY4s+=J(tK?+x)3Ksf`p<}o)S zO0>Q0bdb%im(gUQ_Gxz)H{%<(zO1`fbxy(^Z%cG_-Q5MpxXZe`SBUPTF9NrOUYW?! z7a(kJ>*y>FtoFsw5agxqEGDqH;E2Yv^zUypLC--!xV_L$FIGdFPfba+8=0Sv2<(Ds zz2U&-lK>|gXu=1G$g>;_&S@S?=wJgT@w=G03s#nT#$c3tS=|aUZ}jeeqUToPU+&W@ zu`rKTN#fv8@-j?P>Fn%Ch$>feXk$D&GAn^vyf`)mGB1KazO|JGm?2Ud@XBy@|fyBIcik6 z-6}{G+||$^um{n6vA*ZKGaLvz=jZzIW}*lUbuOGX&glsHSY+k2HRAQ>$oSsO&tEz|&33&<$FCgyr1$#Oir{77e#f@UDO*>hGbLZ!;Ki&T|^NOwK$FXj3?y2{O#OrcG z#dE1kq3JU#x_KCUNbuK~tKIGCv}R$(@cESD`6a%c5E%D#?B5zsj zp=OFcb?Bm1Szvjqvdgf8Y}UlYgnB&vNAKnd+0Wk1YyI&LIwxeUAGFS2-I@mx*51ki zLLUTviv02$9^pI66qVBIDmJY1@i{oCc-zglYk(UP`2#QZia3h30ga@0E3sz9FvXXc zZSIdVV1&JVbbcj|wqC{}AGBaYHipM&f|w{r9CB0to0 z`LjAbCBl*|+2csQfW{r}!o5zFnyPkVv{k9ro1? z4C3efL#YNLK&tccVGQJkiNK3-oYk)^s*3!JS$cN85iU@PDaxd0Szh|;j~o1W1`WR? zgfv&z<3W@8@M-G6`%kwd1RxWS0OOEeQlKnqm|ulz>iUBh&hZG=E#AqXS+BzA243I$ zXa|Mg^zW)FoZS!u-#w)i-!m%rHUGEssA#IlvpX-|y-J3eja%1gn4Pai*nvVXtcN_4$YWW1WUO?p7JhFDiD0Z}b_@W^^Z*jJ1{=QANi$V8c`RDD=IF zsaQ9l`q|#MwSZ~XVaZ+}4T%zth0MMVUa0S=Z&m{>BjQnxN)`}p{b5-ZDPsX%yDzv>@2bSYs;FwB{J6J;qu*jaY@<*9%Rt-XE*!t$z^BwBer>`8}yUgPiho~RM&^+ zZk{=Ka5?9=)Nk_6c4Q^Cw6$iv&%eTk=lOQ{24CPoS*(qvon6~LYc;or?VBcBR-5Uo z<(PHDB7a6GNI6(u!^lASdQ08Y$39Kz<~YTn^wC0B@4<)iIWjcEAzq?=MkFVwXQA7LLp))ye;Ji%nwzxdHWXr{<)P+jyg+j}hGl zdE*bMKffezinE;S>Z>_ZPuR48H&#T83nHnuzp*Ckl)R7yF`An}w4tG;g8~k7?wRUp zVtMzx`6-UKela!L&w51$l_m&F1gb0!4!>h}YT}L+;vpx*@?|rLz6NA$UVPDR{LhrF zY*gsG-$N3pfx-x__Vkibp8YU4x1xc+1!Zk*q0+cJoGvlwcZDRiN}7`!(Q7u2bme*o zHX>0mO@NW9=op^(P~fHbPEZp=LhI-nKh?to#&MCTKa|(~N_Ct#rT=oVH~Xsb=Fg7? znM%)p24s5N?O9{*1o=^oIome@5p>UWZn4Nd7g->2G_$e;HGP2EH z?Aof8gMHsX_G}W)$jiiZ+2c7RXDN-osgBwIjY-c82vvXm7AL*OfJbAx{*&jaHP6y| zBG!s7{6~FN*LJcSE!jjSv#Rc)H(mSI*6uOts*U0A1qON#TpiKBTHD$@1&(YOk0Wc; z@c>&J)m_&+D){HE;eq6Rk|BjVdQgqc=wO|{QP%5VxVtdtr9LsAHDVe zF&-Rn%lqwGe3L(!ddYCLV#DQS9`!|2?%Saedv6C>jM5742`SD_n$_PC14|83J~1_s ze!ZMj^k&|?W5>I7%U5>41MA(mm1nc{lgHxRQGJ5|OZ&Q)p;hCZQ6U$Wdy^i_x$bg* zbCg;q*-lmBtPDANMNX;))^=Mswr$(CZFFoq>DacNj&0kv)3H0YZTLpUTe{7dZID%b{vVs zR#3U^oHVBYE1LCro(j868IQeA00*TIHk z$vvJVKqMN}(YTUeqN%olzG`Bd<={Bc6#EhQUba}S(tEZc9Wxx82@1NuWSPQQphwtL z%oL+oS)?tw`j-IrH8Be$i9>3GO3PE(Y_H4UOZ>)}r2mqcwq(%HK@vaHXMmzY`va%H z?!+SwPHy}A+612Ov1;3o@D7#y_ot$HqCJA?)_qsq=W^1ByYBatIFB~j?`voGREgg$ z=oVW-XMazQX>M}RFt^-37oB12m{GV7vRn_Pz*L`SBiY{&=24OI{19SyBDLf#8G}*rj#P@jm@y!21&T z`)Wxqju}L09wuUNQn;}4bvzLS1Lp*t*b2G1MfrG5(8hjydwzN1*QvQIZdC|r!B6wg zX(?UhX#%tMFUc^j7A@Xp7VM``Q>PfM`|SK_RY{(|v@MP+z$+5jRO_L!_;Ogq*(1m? zGR30k;K;#v#(>4XG8cHa(uZ2x@E`W&-`nwt2dEf#|f z9DWwKHLX*|(y`)gvPgeSvCcZc&;+I9hmV%wxe{3`hm8kr%O>L8WTgP#q=-hR++73H zLT#pKfF!8*+iVKKsTG!pQyiG{szy2zG`G5Xd0J`|C{@q1}W%w#6cRv-5R57t|!%? z0K+EF>e?dkG`CnCc}{S)jbpJcpE!~(VMLZn>k>8Q*v)UqlBR8MEumlWWTTu;DE@I$ZI4>u^ZF-S{Q)?I0rWeZUtJuN9q{{_V-i-}}98gy(9s48g;)?I4%$ z^OpCfn>FO`>)T@T^Re1P4!7$|Bqn5=D$i5r`cHlQv1H)uf#S>i$EVh4-Phv)szhYE z>y_lU`!YN0&q=t{=+w*S1G2@>%UG%WM;~!f+umU~OLQlRGM%F_ zkYE)3Zz63Vl2n=2uCfv#M!ilrjn?iX44v+7Q|K}FznnSeK;qs_)3sgKoi1m;zU0q1 zHp^XUQ#68Qi2BGlb(@h+CYUnB{NiHz28=*TBzI7K zRQ%WGg9;jCx?-P!>@3r=4G=C!!68;gXz+_kkzSB<_ojP5r4aCtenxY^b0sZ>(Fi^g zdz)xf!^L>3R@$b!SmleZHrN3qrPT=chjqvhJ|HvE0YW@Tx9c{r3wIsZsLGY18yLn+ zaqXDu0l$d@m}r!c#Zw)itpcGvA~gcZjI~>S2@(>++QM65FLZr>>hwk?D9=#!jR>dt zOOcFb1h}U|0bTOKS-v7QgH6&x#ugWm!z!!s(_}F-$9S=t>Ult+axWHCErp6Cf@u%$ zB|@t=vY=SNurS$y0rI60WhjAk4!g#o-Z|yb!k77AX;TEWG;&7z;Y2|xRRP=zECG)( z0pxeMq<4B|llkmz5!Lk~Rc4&|7RTJ1zk7}Zd*7Gq zydIa^FB_)>-X`ueN1iz$au0 zC|eL=#Oa7ey&^kIJ=;2mKiy(V2n74!B^^gGWgV55i4of^2a?Vrz;-cj92=HPxVfS- zV405bnHFyYRj{-XVYcI3(t|-00v*bklV%hYq_wh3l!MT#@j`{4oMDmkxssL^qx2_X zh@Rm=w5M~lgf{)kjp<9VXT8xy!Lau({2%aJ^}3>g!0>=(o}ek%#PFhMo^8AV{smz6 z?gT{r8o5mt1A(&YkT>JF4o$-Ak(gph9Fa0aBE5hm<>>m6-PyB!EI^E=be*qSHh*{3 zm;epOV?u^~6$Sw*24dgE1(H@ld1UM@AJFGA(-?V@R> zuN18`c9UD#ErQ`S+pcq*W#)s2GS$n2wARny;4qvSkJ2Qnh?%r_pdi3;aXcKTMcJ$u zjP!!m7u{nekA#)#Vvw<#6MCg;31CNK751I;0TW>Neb)Ci1f zf?{KaXvEN)0(FTNh0tSy z#W73>out6mLWsE}se#qcK};Tm&p(<}U?x#`i!HQAzgc8F!iTZPKsw?ho9ZUiY_>!W z{RYULnkexE-eLFCcq9eIB(`VIJj=I#c}*0%{qX!=%WNt4RiyxgS&+2NNAn0DU?042 z5rZ?OnZh)V@e;^Ka$dE`#1KeAiDsNy?tm{0c|#eT9JR&Ev{jZN0ue92Fu7fi%>+!$b5J39oRN;saqR z@N%qx+Vs>ZAYqvLjz`2s_y#cY_I+L1V>0UhTUt77+q9$yB($Q9hMw0g0JcyJ603QR z89P`$z4TOqRgaL3CbZ-9e}=+xj{EPvAq1v7SO*xwn~;!nSJ*+8QeYMYf*NCqZexNC zJPFu05eNilF--A@xdkMj0C!kWcV-b-ctX!t2U~1CM6IwHQ6A1kBSZK#E_w^1 zo9l$b>Om|yk`P2loDg@PNc+4{%;6p{qe+cynenEVdAR#=jj0n!><<_IsC3J1_~BXu zCt|H;BGb8LnO44#Sgt%NbGJ!8mf|Ls?Y|^MHfzyl(M&A2iO|d$p+Z&ZyhVRmWTs`# zjR-XX&bf_BF(zyVzV&;&-y`WwO*)e+9`y5Zlf}&U?I|KB8=H_fE5c4Ga~#x{0Q6QH`P)kqANHiuEn9`5tUP1zTpqpO}R0fj#lU7ok8(92fuY$x$rPI zsnO&7AZj2rLEawEZKvSSo)DHml6F3`U9AM2HrMcAd2n$spPm9zH?agWg}w{3lvGR- za42Dw?ujOz{ud}f z%woq)(D~h?)@E?8Q{G(7;J+VFcD%bQ;o=gRp)o^>W}5ILvU=Y98aza9G)3QL8*>vN zMnG@DxIeitbYQ7gN0zRl`xzcn*uVTrK61E#qPxCP+5HY9Ogw-rDB*5PjhWwi8-ivjLGv{y_ z(VQTczVCpvuTW%GEfvlGUXV$i!Nih5HDJCFg=!9rw`3LSk!4wGG*xv4HW=LL(NxJT zR$?ca&&S%l@@F9MyHlG#a|GIq985&CAEYKNq-DJOYOzH=(rmkldoX;Cou=EvzdGpP zqd`tR(AvaAXp!(00z@09ToDtayv(yhpknedw zvC1KB)RG&@G|$G;f#0^gz=^G{-r6o5J7$hxyvQ|}nlvlp*3kD0W1(9z@Ns}I#)bTA zjDvrRwUz>Mgz|+Y&#jK)6?v6tE(<5AvUNx~9bBrue=3fqvmlCkQ!q#pH-n20$@d(2 zCt^8bDy0f`93usBN>-zS0xHAXpUh-ojMgS|yoz}$iyUqPm2h#2PLHJu*j;?0l0$Vs zik7ydxuqu!!X824JIxQS?LDs~zH4xPUClVaE(n3-nzNP1A;oXVdQ`%riqWu zZTkT;JeX^S>wu+`1_V&*M728w_LHV&Ic+zJbWmFjfeG<#=0n|Jkr=82_Z{X)RJKXN zE(%RCwR7u6{)M_F>=8fM2(S^HVVDOZf&nseYT@3UrzD_|%C^!%`;PU^yQFVYV8a?M z3oe6pekPb9UKFBCcw_%amG`!i9Jr{cMCxy^VhO-H#e~UD*I7`Ql;acB6p=;O7MmGS zNvKapR)|wULqw)mb6ad_R2v_)e^F*~kic-oI4o%*X7iHC{Oo$e6jTOFVGh>JSPyD% zA^)!iz>+aBvGHXL{$X~b4_84>sLUGv*>YDI+ zgg{BR8Khg-_<(wcd?FG=oRME{;s7{@dVb3po$)4a~i2gnYiR8#fJW~YH51N>dA1rAMbT!kZ zrS!3dh{t4MNigfHgDE8fGs_A)sw<^>?GWc*zRDC;jhoJkT3C$k*N>eqzgKmg0i%j` z7*SFQ*lGnE@iqrKm3|IK9BC!8P$s!BD2No?;%J~Gs5x@gO&1&b_yrQ%AYw~(?+%8L zz@x#SS$$SJLW&Tb7$z_y1UE}~R%}Q0S6a5r7f)dXuh%d`awB!;W(ru&Vd1-aCl^JOlJ6d|3uN~(2Rcw&Z|Yv>$o-& zkysRZH$8N4gv9nkCAcs9Iq(6#WXj=1u2{Kz=Xln1NpO&^Ubon{)qCD<&HWE0Lzzw3t(bUK{K;I ztJu0OGLzP5gVEjmo&!tCkrF%JrL!Uu)j+sMkCeB(tE!?7#Rzx~Y<6&n5awAsl!`{B z&3(ME^n4n=0-qS82|@iZ;1{p5m6gCyY6h_Xs&dH!^9P*Aipl&57M|zkk6>D4f^Q@k zkfB_BFkJD3w56mWT&_cLL1RK_u=Zi>=PZ?4)~x94s%gy36QIhWq*^PL6A0YjcQIyq zK>I@Z3P?~HqI@{9QT<5F2M~ljv25}=h%q$d*`tk$pqEAD{@j6#sqiQOOO0^beJ9Jl z!)#)IL>>@W9D9#b3q;l?CocqZ*jIyYE8=rH8pE@66dB0?17u^cp%%j$_e8OoMNOKJ zXs1D(xuE2xAdIZ^z~t2;2cTG>swWg;Xt3C|X!|^omHqA)AwApR*6U)ks7^^lOLm|RbYvBt|4~&5)z?4>O( zEe|BZu#WyJ03RTsfJAaLIsn2ELc=pmz1aZvS_`OKWS2o@OO;BuK{MaOR0f9P;-NUL zqO(L3=pcu+V}S=&R`#`OX&4&dI~yBZEn3fSv#VnOCVi-AhI#+g&3WLSP2-a{F0=2dC1uVMAomF*bgka{M>B< zyn=G8fP`fjV;s*^LssyU@LFdq^7Mcn&S{L2{Rlj2LvbRaNbsp4F}+b|0k9R*KFPjA zX!w-m?{C1Yx#s(_Wx@abnwRU7)$_-c4vObG)Zg%Qk*`^<#}bgV#aJT6hm#NL4n+Nj6443%1x;q+7a z44Zc?p_7zOiL*d{R*}i6%FTx$3@I2f7;d^|Dcf|L&B$(eR#4R1prFj{JSYZw)4L;g z!%$)zk`%eD=uMj>1cu^mlt*s1NjfW$c27Hfm zqTc(6%-zKa4@SHAA@Ex8L4(#^9FQ=;f9)h1fb3jfV=@nZJAMyILUd7?e z`Uk^R*DxpG?(~z2w3EGf9oPjO!g*Q|>;{l^QT~dLHPMRNR#(3qg*k&ELx7d^!4o=Rt=4RUtz{I1FWsWVPVT_IvE=0(%N4}6!5iqTa z)GmZ26rS3zB-}4Kf1esMi#^MS9RzJV3@k*%nBgD~o4`Cn)uEQ;49v9=a=g=}cWVV3 z2O8iI%>)+p{JS*tYW!2AcQ;=X?7%kvs5}9Tz^pu7{4GJ!4qhb$egG*c^hgL#)j)SB zliqOLvA=;m9fslgk0vU*P*^HKtzj77n5wh{2q{wkdAmhT7{LgzR$yF+FNE5e@GDaU z2dsWLO0Ns)E0hd?)Kx}C48|Ic%ivNi_&ZEac#?P=0(3&hVkE*I#VWIkO_&y;bq~yi z5&@Uyxk@7>V43r$5xaS6~Ce*|wx2^3W71=dLxzK`{@6 zu&;x33PzIIh2*%bWRxfa71O>GdKmCRwd!H^)k4}?q0mHgEY%T01q#}`n8x6X z61#x%KT92^>LU!`FeD-%E~Hktgko7h!4Cux5<@eRLo|CjRT7bUCcO}?7ti<@?Hn+? zEB31KgLfkx<%ad}?@=U_Oza0`UGxwR&ysPWl=dQf25`uS&K0`OcgWh+!`L;XDE>SuxBQ1tfzWsxDVjV~H0nTpAs9cR%8QJhw}s-2 z^zRSJ{sOoCpzACJh-4R3Bu_?QI%1+JNZJgkB3$X2d@Pw(emv;(gK%0v2xp*3;wf;E zrAJ(bs~VxVhqaeV5tZwojfeZST7FJR(e;$UE>?l~dubR4x77L+G3jQlbUMGoe}j4U(PS(Zg434%xq4v@-l z=;%(-Xb_3b-MV)VI-klS;Lk_>kbIz%Zi|hRPs0_n3scR1A@GuY|nO(2^pI z#)_I902rpwg&|N;+>WS2b!a!b5eZP<*|>0fz1A!&krGo4fENrL9_ICRGAWg`g9P4$ zByf@{wE`9`l^-`RAEE{n5%hy`@N2uk0&6SX@{7r8oIB<KcqC=C@GhRefRu;CE}QS1GzF;7<)w-lEJvZ3`X1-A zim`-(y@0kjj3bmlCTo1&e1TK0BMU~nEQv6Tes=}({FIvQGbR}}AXgy4ymRZ1)M9e6 z_`z@oRVKS(8o;2B96&#(JynxbuA(RzK_hAHWnyuz3@Ha@Is==S-caI&R_|+&ARQqB zv$}o-A_DEo1w*7Aq`EDlcdtz1Dh{m>FL1Z?Ko3V{Q3C8A7)&o#o(U42+mJ9n0xC|< zpqL1EgweQ2N}&(M1*Bl89bRUJ+)p`$3EYy-!b#A(1RpgX=!9Ys5vYt}%$TXS7PG9l zyn-r_jm~s88!{nnuFQN6j?gJ^%_14qC|WcHedkdE{5JWPDUwYPvmeBvV-$i6Ng_rD zH%mN`^F@Nbja;vC0W(c)$7P^Z>o0M=zC3@SUsuYQW?qvhi+WHwKRt8K9$2_#nkCK@k zU)d*PvW7^NgOg(LJ>_KVI*KOK&w-B%!^372zV7vl0DRj@OI*(kw}K9IQUOYo6-Qxs zjwUhy=u;#e7UX-dX0j+97z-+cAt0L%yq*-FP-Z4Av{wb#S9}o?; zn9XFrP7v)p!1Y8j9*V;&02%`;t{8Wvot!rmnGQfKYeba};ZSyZ&Q7wK0HhTZ5*?3Mp@gpyJ{eRL zT?0L?V!av>0-rai&VD~qkSHnC2fSYrC9RnSHC|tuNWy5({dRZ2-|xIa92PUlbA~uC zVzrwjKr(MNA)ZxnjNR5cmge;~=}%IEc!b7qK_pJuILS-@t--pSw6|QLRSKZAd|@TCJ%d;((vEJQPCqgyI>e zF%wFhtv%ad9F8HNM<^CzLKaMcqLQpYcR-gsV5B?{l3G`|A;E;i^#`1cl*Sp!*@-Nb zu-zD{pUsFOVMYo>ZbJk}2s4h(#3;-(BVj&jMf7$k$|JRbhu*~zr!!P5|8#>3&Rhah zud_LHvHWUX_mCaa0qa*o1($SAgOl{8BP<_{h;o(9gh+n@4io=5gS2ux_pUb%K`fRF z79UKwdfKx?#SlhTt8oN|LD(a{&NS>emy&$n<^9Qt;7=JqcS!>2p*M=V55f zAVQQ&!8J+|9q1^W815vAOb1^}!_Q_xidqX9tvb9Px9T8Eu#O?7gk_e0g#PRFms%Su zkopCgh7FI=Xol<=q#Gmz7YFxbCa24EA_)-5X<+CzBLTdEz{msuc8{QI0Dxe_m1?ae zm&xq*w;d=YuRa&wx|XjZETQ*AUbKB zmE-g#=_{i0G_0dLTy5tfxXnY1ydoInc3+97>2y_6^!z&@&T~ckeefP1pYNXo^P?$u zwm{^B7fmPwNYI>9GCX?qU))k4|IvW13A5^={$Y?!il5;v-L>z1JNExPn2yZLz{CH*D&9sMvzPHj6)_Q@te5kZbbFkf>5N+(@o+Cls=b-sf|?KSNBtY9A@bRDI28 zW@U{a%7B%sWvzaG52;_6G$>4b``kc?06zIfI%U*7ZqspPezcq~|H>YzoFn2#il6V3 zj4s$y=%<_*CZIi%V|pkO4{Er>aBtA}Wj*{6#Z*K@WKcrn|C~E}dwYXMQ)ss3aBb1e zBEj|vznUUeKP-){0RP_XuS4$ft*uIN7Wc7yy_c420#cjYk>}F z7)I$xQAB=c5=Sh4nj!u9)YBn{4D()S2rcOJkQ2*LHX$SA;R#rcjQL7cPpFwt0QEv- z>feNr&u7Js#}FOEC$D`-0pW<1{mZNxH`x|-`a3pigrk7(yiupai`|-e@cxVb>Fq4#M zuBk?wt}H9iM)@62%fHuW(>r8DL|;*euq$;xu?Wo9&5MF2EY&`IjG!dh;XWX<54jj{ z2jVvw;n>-h#_B!+RXHf=_?Oc;yf0~epGP%q+g>L*?h1JVUjR}h-T(ntqC@-(a7es` z3-aMGd!O{R!%cwSjs!GD%Uga45ETqlCGItJbYKVbUUfSc`K3GFx&s)UaErfq?zaQF zFicWdhf*DJ8K>Hk30|~|t8;4+`+gr+W5q~PfX|v#xtmI0OT*Q*KDJ>0cO-x7M z*nDK&xobL=6V*s7&#k;{X_31c1Gv6`kXcU#tA%m)xm*aM!0WDi??X<73L|A$*6+?U zjlOp^jWoYo&RQWa#{OJg$5H!PP!MtjZM)3_6P;R#FVHXB30z3{_ZfRX=Yd05zpp9- zM_=QgZ8lRWXBE^^7f}iz_)i2;&aFQ1`S7|6$s&f?mNC|`d-wDiwapB@(>1u zh(3Ll=MRE9DNox@bnojYt4=T0e{F>KVC+rCq3c3dH3jV-7ADh1UkJyspzYx*&+dkr zu*?5$XdLJ9|7s71!v>N6T_Y4(oUQCw-Vx7tKOTWhdfoTqcg45vJ&N!4#bNF1tD>@a zoMqp;Zk`2?%V7&3tIbs|^HxSSc7b}4R$AMX`!MXpsGkY(o~AR|ZQ8cnydUQ!{ofb! zNMgw7F(44<QQw8uu?=hLqH63&MczbLvWD2|4$Al#gf@pMI^46u80e9Y+hf)QZ0n> z&$Io{^XATXs;$p$FrjJOf5_N30LA%={qyu>RO9TFoL%^EyrsEOX0};P*_|o+$Kb_t zqCcH=HmhLi^YY;c$KTZ>YwBo}6y`dsy47CkrQhDlXqxM0n%SO=bwlP*bLx2%v1dJ_ zmsLr=tli^g8bY1zW4o2ZzI>gRQKz-~&)>;EOzZM0q2-eQy*(jWQJ`Z{fmgW&Km|I; z@Xg8N@RL$?E%^$bpJWRurR%oq4O>+dq?k+0K&mQ6ioXe*mlu8dD#r6aW7$I$hMmVR z63vNVVRx$>AqTq^jDd{clj<6tU!2!=p3@YTq&Vxn4Py2Rf&Z+u^@@9c-i;v=3iyQM zyX_7(9mMfEO%&)lkz>t)-hf&*Wgaq93?Uf?<>b6SPrkbPe=Qm4*=QOWZh~+ zfhuBTN9ijcF<8ZtwNDZm!D_C-8m>kPR^f*wZ+{RLT^d!vDZ2XFvb^4-<1Ffa zneQb2Mhb~vxudMauZj6z%;?2&O1SH3J~pXPZhLIU{M!%Q$#m2|8;xAGtmx?|&>R`t zaxf++tfehsEmND^n6c(r&e#{Gr~T~)YRPfD(dq7@WWkNJ)bTJYm^V3ykjCorcseiX z_r5r;gj7-C@EFbx3b2R2mo|NLg5%(Of9JHdoC|zR1%kt3ocaps=CKiG5d-K3`DN0dS%{>j>#dZ8!hgtH+~tk}od&^&QRkHqnsC zUjZyOtHgfrO2NkbSTBJWz&HME^Z(#1B)3IlKB}arCCV*0#F6OC_JnbhNC|WoUwW)g zHp#MU4a{@ZhkS_QjC)%NKIb`}MyYZWt5@W)ie+d~Kf>Hww&#wPk2ZYXuva|c?^KsI z2qsO7->!Es+=Cw*fydA%%+WA^SayIztoB>2!dgL9CQ!+zt8b4nrBb0n)nEMUb+{VL zNnq5WcZ-9(U~r)cb&;9VgE?kdGt_{wg2I5vfII1B;~wg&PyuICl_LJ(m+aHSS;vd}u8V3`e5=eBb~XnjSv3YG!p%U-_cReTvv>r!+-En0 zr>C0Y#K%da;6=RKp{KcW7L-kfFx{NPgHnQ+GL~KI2kuNFSRef zOtgJ{&aSlEeOEToC=vK9b+}3nTk#tkPwdt8p1^SSi86i*tb1xP*z#(fX~uur9KcI( zF>u1F_jwzHkF_Ag#*K7Z05CI&Hv;FcwR+G@6Va9xDaO0rzkj^#x?8*Kbe`9D-!~SV z{=K_w&ncz6EWhXww43k8nr%M2^Qtbc$F{b#GzMQ^+!Q_5XI(~x|7z~LJ~c$0QRuFb z_kIRkFWZl+wlWayjQth>U<+Vr2tSpu-FAFmQd3iRzMtDJJ$oi%jjvCLDvn!vM+m&t z^B11yh7kJz1iGYqd_d%u+h#0}LZle1XC+N709236p^9M9G%%=>m3M8qzCUe}=XWU| zH-=(1$T)vMR0U4{y0j4dNY48_`~c9weV;o&A6NGNfUb+Ty#F4YGW{*fgdOT?1>
      NdlsC{ZEfuA7bbgvz`f(d;eP*7 zVil}bL{zQ3m;86j`_b+eH2W8TQEWk@XG<&RfBClvQU_lt>egxF*n7P-zAVIC*SYEU zz4Rbsp`X2qa?Y$=tt?g;khXg1>Y#sM>a+V{@|W*AEZX2{{WNo6aYo$53G;(0&wO3! zpL1;6jEz18!e=Ud4e_)p!{3or(jOiV6J!Dp!;G3`?|#lhNB$<*6#Syqv3JB%8zaz` z6*)#{uY)^q{jr?mJ`9_g<@N@2AN*aGsV%fK`ZEN43xci0^|}ZtE7G zW!Qb0crEYO*j_xLU@mp%Xvdne^!f(r{tB4*Rr^64ZEH`c&uHYAYxlX49bJ=nnOl+N z?h@FjqlT(l1Zg~9lGA#1yhN6Av6yj6K;dNC`+n6jFecn2@%?^2b^zSXQQJQ!*cw6nkr420gzn=)e^Bx*cVcc@7r~y-Y*U@Fl(N{( zh%!Bw__E8hOsZ0m;p`q(>iSd%3IcSuock<<+=~1x+Ca{IN8hGRsqVkPdWiZO7iwo) zRMkT{G_NBiDiiyiJ508`*HrY)%fX%F>0ZvFb0ZeTG*@1fcVXAiJ-i9NTov$5y%b#E zrh>gyAt(@ee7~e!A41QyG(G@i>dzWrA64xzcJAEq`_MybKP`;5q*Tn6`vCk?b`1a( zErNHEitT8X>Jl?i#+!=Lu7BX-&)sUZ+4mwy|MK4OHLvk5<`M=3OvEjJ7|5KYGn>S5 z?L)bsH~iLB8uqUE(^)gWwKYG#UD5aOXy9FW#1G~}M(D8%OvBFBdFkz{92M@cwyL5Y z&IVsFd~STODIXiFtLidD{##<+LRE!``>vl?MZ3|1d0+_4cH2|q?(<| z_$@7N4INdrN(kZ+RLpV4yPq+;^TQ3rsE_1ef8q!4OKDY9A29RWWf;N25vF&#Dm)MPE?V3`k^wOmAnvxBO69Ss4PJ9Ds#v z4={sCf{z{p3KOTgz+N3mspe|?OhnS`T5=s9-FhVyZ%)4@T%Uj;38cu$12*mZe9s!q zhLtKSjosdZzyJOPrKyoS+Z7alp`6L*3BRzz@2XPeolbRCxx`vvNh)VFii?C zAOM!WI^QcBi(F3%`bSE^H|gV`f&Z4jE1Ct&t3Mw&i^H+c|2o`%}C%eouKucl4Q>YspK41E>a!mVP> z#hl*@HGTqS{Nu?uTn$I_jfzejKBsC~0qw4>d-jgo#O0+bo)<|sLQwIY6cxE{~BYtih%~l%vp5$4-m#CXk_?H{0g3xqPH&RD^5udXT z5#l@Hk##(vNQ0pL6xC_#I?pR134M?-(H0Q>Ux)I(AIt8ffNXuJgILfxPhAPiB>Jc; z6+xKRHf70{)SFweTERDcLXZ#W0fXC1SKue^O99|(geWM3voqem0l@0P{Scn-$GE?n zSet@BLlrLh#?Zq#BSA!LFDS&?ODtNg#x;okY2)(AISX0tawH_LE3B;f!MA{sCf3^0 z#r`;HyjWuQmd8QtEZ>9NsIN^vFZG4L?ANHQSD?n0h!V3$vSLI{uXm$>>Brt$OdWl9 zZ5O!Ny*=v6&E1p5i}~#aq>HbIZ;d?8Rn^v+q21aa%Np;1BaZ{oIspdzYo}KPp_a%f z4wq9UYix8@j<`zRU>r!h*7f7g4*a%OUs$Y+<5Kh1fu9TiuR1`nOZY-7fQ|a-;K%f} zACj-)8hs#3A)ZXtNfXqTEj+boh7NXzt~|O!Ccl&<^hG6Pe4hNg#{awm1cHYc*1zpnt()oh z01mNdRo@#QaL{x@7j->6weR|ZVzMxpiV|7jvFfqmCmd>oj0)2C7@bta)%n=Tha!28q}K+ef&Xh z`0M)9P`z57;^CElfXRV0bNMNrYOWK2SToL1XbT z=`anT+!mo&Ljne#^~Di}75eC}4*?vh5yk;vl-dD2+FDI7|6rz-jG!R^&^(xS#h$`5l^8Y-?AuG zi>ieT2d~TXvI3Nx&mQDXH|VM5D(VXteK#sE9*7DSaJ<_XYua#3I@!T&CL2g;`Q=eZ>^o4Pj})+Udgnt*RfgtpHF}UFZ@&tqhh|M`pc6_RBDc;#&`$1 z#%oyC^=Y@xW)4H-ItzXNu236wB6g3lqs zZzKvgrjMsO|D5LW-C3-WAaWt5| z>}7Cp`iu8XuGy$gTA9ki7P8_-pa`eD;j4&^B&Bz?LDuhxez%}eTL2;Ftz*{r?@N0H zud3VDP=ubTvZvl941y~Rvo@wm7~eU~M1oE=@oo}4B+j5VOOOnoJ!l#XeBNNV@2FTf zsW!(>h@pyy(YQoCqTvQk0AoY@vcjskL7Nv2E`1<U+e4wlZ)1ZVOAoOV@XO$u7FR)6WdkL5|jUZI%HE&7eu=o1}+)m%>R83X{qqWsq z4iI>!J$3_=d*9UqAiUqw~t3heXrma!FKNJhZ} zFkorQ@BSR2{mzdEgG4MH1)i+>*N!0xUW`BGcfGaM7ol) zp~1-Bdf^4wv~Bl580R!d6q9tVO>3}7zb>W@VMQ-7H}{BEoldL!_2{*AJ8gdtBP?Pk z4V5C_22sVZuNuhu-1=he@1{UgJ**yIO7kztu}W@5!LO6DTrcZ5plT;T-9v zHAKit^@Y&7!7`kh&P!kJq*BWo@GA@=+ulG&ZD-Y>9`M$>HFp&rersu^i1|*~ns_15 z+ja&^O#DwMF2sC)p|%Ox&LNX5CUVsLXsnQ{4~}RvmyC(wHT4&-v{=dFj$0xzyah3N z#p(l0eyb!rZ1}~w2uqB;6q__F+yOEeIKWZ$chO?{bwiqx`K~@G0pJ`c&rx)?a(u90 z2#G%cu{}kq6JCt?qMXM~=3Of&L04$6FVa!0jgss#uo;HSPGRW8ryLr@R-H&>K7B&f za6ACJ4FhF3RC-@{6g;(A3csj;>GAZST6Aj=hWx_#0;UN5EStpgm&Z{|atHi3{JWD+ zuP&B3y+_1?vUX5TUh+oSC>)~ppj!~q9h1|eahZ^siMUagb==S0CZEA|0)O$>%50bhWU z@AW$bMzSGtaOh`AX5Lny=vFJ%j+t*tNy4VlSpR@WyrGCiJBdO2R*!ja4GK?9!#DVk z+YT`;AoJ>~t8n1vbFG^F4skAd}3S@5# z!vG5Q{U7^&L$}*e!^cV$8o$|LkbKJi@So8prRF`^B8C-Vm3`&;Ws)o?Vl_a2mU=Ws zPqXRWK0pcG!+#0^d}0A1D**CQ^xvopP-7PVt4Or{RaY*&gdc^59*t7+Raa7USfP*b zsBwX+%1>PM+eh6B8w$O#U2&fniY^^{L}@iV6KCCY9K$CZ5(IdXggySAGAm^_mtYtO zLsv9$Pn?h=OnmF$_N23=Mb%|Eze9H%UL%o-s%hCvAK3pVGX-eC9>uAlG8%N$EQ`MN468Vvgore)0Dy+Sj&xJ?F&0&s|;mhOb z|Ht1!L=MBGaZlC!Q47C8n#8Yo;9>CxPW4Ef+ENHEQ{NRn%p=jyw4WI$vQcdrl|(E1 zSd^-I98?c#Kb%8Yhiu>kL9hL9IvKVQk7A2X5cC@zWuhnhr#*HUA51KRACl?2W|2-U zED_-KeI18MZ-9OO>9x9OU(uUxU|l3SP8>a4-xZR3ftGZS*ZVq@S=*8~3^AOcX<-LJixI*>>o`dr%#w4-~^`B_+`lQH-tn;haGr_X^g4Q2MxRq z?{r!_1CEAghdcV=kpxs3jI>BN1rz~<0S#+jdxk&LL?lxnPIyRcDpi;wfzrUP8sjy$ zH`b6~fQcJmdFI|{{Mfa zTT)3vsE*N6anFImb%n$ZeQ&OU@bQ7-KVj zulGKmK7D`hzgo7}`}KOhp0CIAd_A8N=f0jl!$&Hz-hhJ<9il!Izpzoa**$8XX%xY7SSPWlJot&D_ag0R~0 zEsu9^PCDr0Ua~>3?yi8J@`(=r@1P5exZu-QpSP<_O-GdO-m6&aGW3RAHcAb%);s02 zviPZPUyA*4QqZF>DJlm)XQ;&Y-iX~JzoT|@UaDV%p;lpg*JgVqom=wR)n~149M)2m zu|IL}PSCS!SEp6I9{>4tv(S$%WnpM%y4ArOgRgB5mLN0_P1HOoJ`=v7#%MrXYJ1$L zO)-U!1hCJyjNGnyTzlqeqLoA(LbgD4`?8~U*=7D)Z}Mf^V(6O)`hCS)+(VCm2I?9k z*ET%faOd`)g_a#UDHG=oqj9H==CsmY$US;y^i)32Am{}5^tnI7PIIq3g{SMKHtf%iNv-*Zmj5vVz}hFP+^}Euy%0`G&!Uy&8X{4nI*G)mjcus~;(D8=lE` zkbf3j<8o2)QtXv0j}HI+;fC&}2m6OQYKK0=sAO)~-r49?f8xB+_T>xdk9|AE!+JFb zTXFC>`OnE$tcv_ozC_HTRB?wxCk zxT0!cg?e9b!TWJUo2umotBsfc&dc{EJ%4lY%Zh(T^!&b{Lq{Cg3XcK~*?;@f=F-j` zk!M5xVC{UX9d?qSp`oF=>Bg;-QLP+5vZhG}y5-S8PcD_DRIn00VY)@p}rhCpB`=9&);*57pFT2@D z{H)gOeiSTWbbFiFm1IH5VA1^jCBua$g^Egk9I>(v3c0oYvby#c1taN(JqM<~o!A$- zA+6+=pU}P+(KUtn-zNI94D-^qNEUC%6XqBGF}%r4?A8Ik4ama2hT|D`k8M@hlrp#d z@WJA(F^$<{Y0=pJ_F{`N zX`qUc3WwQ?cfw5BOVOvMns$vEQZ-Yi`IHE4!5f~2>(10%YdZJw$Jw^aaO!9dM)KP; zYtE^siTvVq`$)kdIwGQ9?qm#sevm=x_6D~%T-oKKq<8DyJ-DIF&cEjmI&QrwDr&0U zlG5Yv7Qe*>*ApJUHCeyNGw!f=hOnCV=6G2h@8Q2wK3pyndvPRk%geeL-1|rN=fCb3 zmO0_~#`SC3u}!C=(awjTD^aewRF{aJ?7-@5;2hu=+(bx992nK{?KCRS{8}pJ`|NtR z*Wn*&*X5@hyWX6An38AS)Ut7ZO}+f)jZ&L5pUTGBw;elb7QL!&~{ts5_u zAHB0D=3@0D!=ORSoo6h0v!|VI%ICI5NDwlQ+{)+@{=h(vAF+INq5CZcx5Y2-gm-11 zaP~q-;*C$aM&X}I9ZC=0U!C0N8Yo=E-+APR^7KT_#U%X~mOAoB9=Lx~e(vm@m=bch zIeggrnQ2ha!P0NnzG~XQpT=AQK0Ke017}}{q&=8eic~yn_SxjY}ouzwA3Lz`sg>RPYCSsHHV|b*Pk2q;|~j`hE|Tgel@F| zu(y+$Ws3U<$AFvkP(>*&YyH_GNDJGy@6_&Wnifc75IJ*Wb_7_HoGJWxGA8f>q_)2_ zacRr1mRb8M75A3+G1bJF8nDoukg%Be!x2)3kD8q@BjpU^!wAT=oQ=EzFYE+)AJdOd ztEs9s89)g&nI@STu!&eS6K(zLHy^RK78X*1TE}@q$eWS4=nreBA3;j$)9=9`Ro8wP zlocd-$?X8o+udEv>}7tl^#}w=pwiYJ)mBP$-OaQ)1O0Kw+g)AW+*~UsC!_^it%El} zh^xQH>L*A4nPVVRFSR2TJA*)7X|3YDOVy0D=uov04=sJ)sr}isplyPZ=kDt3=mc5v z#uMJz#Vjc)0iNViWKqI@%O-~fPMjP>U4ho)epd;7>sE?PV2d(%!I9JluLj|uJYF*v zi~Y6YTna7$TDyMc&CCoW=!@*_?fuXv{=ea*_B$K3o`aTerfdfFQR~g-`#mRsmRv5^ z+}!*Zy#S4Ka=5~ijvjZsWql`StdA!v(U$FNr(qGqOmn;*?EP(V~)kQD$yK z5^2OzblB!G(#Z@g3ZY^~qJ9jujcKYJi=GP&VDnQo86hag7QcL1``Esu1TSjdIGV$s ztU0pm<%!8w8m^{)_C6k=Hu6Hn5(ZW{WD}a3frmSldUj`Aq&Ja{LTrH0<^|T`!$CCrH?Hh9YWs+^x?<&s3U2(F} zLR0(;L~QsSDGz37z%X~4D;$nW_U?}Ecgh>;nyK~;LcszQj*^E1#*}dVN-pU+cV4(@?{TJ#yZ>~Q8h2)ks2tdWs-WBqa(DN24=h#_F(w-*f45ag za8ULcS@+9?oE>Jth6N{bqRDyd1!4KP{N(d9Z|qiE1X#j?y+s>)cT#{&0dsScGm+_}hB_59l%!+w4fU=zL zJRi$!uM77JQnL3oY@9WoE#7Q{KQ6T%%uimpWx#qTUajepH|~~17>hfq*BVEZmV~5JsT9h58x1qNCbdV7@LO*=SH=%+&-cMVm zmd)CP_EG32#)zHnSZcntvQx(MSF#91m+xeVm*=d_YDT+^T}_J?>g!lOy+yM|uty#F z<$VLmLZsRfdGp8$J58<}HECHFE+uhLZ7ABSfVkGAaZH{QBf7w}67wOPvC&XaO@D3? zIur_*8Vw9l^QnLt_}z|4bGaGJkF1QBaB z7khI&7VTU)B<5!SxyUPEqu~|}u%7~5%%!Cz&>6kZ8s;|KHeEGRA2a5QPH0n|?lVlA zh)`y~PQWE8m-MW_c2PZQRLInTrGsx5XRHxrGQ=x|cPW)V41dG)82kL^SU;|UtmwGF z?eXWP1)5GZp7G-$)4CE`D@%qyzdY%vIqi9JrzgFLju2>F3=J$$?+h7|wTHj+UpS^0 zWm3TDrsGCg4X~T`#zigf0=|nPUncR$xnN>kkd>8{lar?8_9mrV^F?pYOH5_??p)47 z8|-PmC5f@)=Z`mV(Td1%_mYHr^Ra2O&1FuGV|RVSkc`37q`7bSi~&t<))qHz`})>9 ziOJhxQ5tj1o&_XTL4&hE%C}Tx@c;aQZ#}d=X%ZTxF**_yL||0MpKTYWl`U~q^0tQQ*Mx3* z8V-8RlrO2-t=HfLRh*}mg-$XQVG|c$9~#!pTM!zW)`cI;B7+)u0SXN|5*nVJ1RW1a zjkA)BGtJm>&Wd<`p%|%EWi71NCShzk1R;6}-~#GkHjR&u&%FcIj1QOAB~(U_IVeqe zT%@Zro;U@Jzv<0bH?Nnve3Nj#phvdOsGMCi^{}YD%KO47y2DAZ7cuaB+_OidJ>1aL@iv>|EBYuSPcn34o1|XAApzSo-zrZ2b8To?ypHYpl(;tm>s&I7bk(9ZRw?;^Ty3> zg}l0vUmR&2XL_cv?F0K*cMQA^bD@A zbKAEuvrs5f%WYnkG{d%acQ@pBYVk`$zI1G{92a)~Jmqqq5A${6fSsXk_`QdYR}+e7 za{i>}x&$67axkP8_uh->a&AaEA)&d}q-bgm*Iz#U$kpEtk&Gb56&Lo*JR`xM6^wQ0 zkn92yweC+@$uA`NtiIwti)o)DM5-zC&y){!ho1qWY=)dHmdeamd_EBs;k2c~Dz+)Xj}wi*dI;HulNtO`r@DH@He_tdai@=a#|W*L zal}V99)|w@Jek|lWP$jZP$$8V`CJ}u6zAQ{^fP?mWRu75IQXDNgbPz!3{CRQgyjpQ z)k+@OqVe6gMHYX3o6`#ZY{cMV(y(sTPf@?KZy@*-#OR&}`xr@5E~!YU8eR#)&& ztx1YbEg-==Il}!YVQlb0_w(^@R0>fOtDCI8f|7~B1lg0DyaeM%h((tCi}uw>$Hr1( zTHTG~wl+)TcWlo`tL0TbX@O0>FnGL)y81arjF1*8sX&IV%WaPxKy~-5#xGc!)&|b? z{gINQE8{D^FcJb zQ|O~q^NG3^A)KvzU?PUnD?iE1iZ!|!`l8)?HlA$vLD#`UW$Xz#T8lH*wM8PFS*xkj z-z4hQUDiOlH_i(Aryk~;{gEbQ)Zj51U{-TBX-g`&dixwty;1wfd6$L8y zOMSN798)#qPZHE*H)WL$qPR3V+q4IkT6lHp!rUQD-`qgDlg*oKe*m-s1lEI<(O4o# zGQvAHvm5Q!J~qtoRQIEm)AdWVkbkxG7gK@$cAs*27Q;?pF~H$)B$9P}U95ojU!|hi zw5c{2_a6&l2LfcdiHnJC6_ixJTfgVGqMf33OO>a>Yo}sut*xzv>{2|h^NfsOZJ&Vz zW_1x94k_{XGBY?sOk*aO1}U~X7zfQr{e69X{rweqyH)5L`k7|H$T@%h1Dt9`eEteD zmS(SBRI2hPaqF)^1J+XlXuw69|Oza=$tWq`PwulPHyiT>~-3m)JFMWy*z8 z=_hVVIynKNf+L_MCk$9?%pw%@e${p|x%9#4cZbFp^n{L7--v^a68d}eNq&*D?=({~%4R60+7Pd?v=MF;$Pk ze~6S#yDx{fM`S>^gN{}X16?IAFE6UV@%-t3cJ$RWY1q25gN1{>V0OWbq^72Z+VtC^ z3Kf*9?z(R60WM29RxSGe{B9prHUB(!VXH|!BJ&PJGCL98Hmj@qWeM1J`2 zVFz|`>DG!4IdLIf?htB9z|9*AxXyLn0#iA7e-UYSB~m6Q_65tS$qMd_7D~X>E&Yy zB3d`hI7&wvk_A=f^z?1HRfX{NAL168uQZ3CVNHw~;Gxq|3F~9dQ{$1YqBZm-j?_TM z9J4a^$oT3cdo)?CVXC8hTOu=^i(4O0qo0}7Z|Pq*l$lc8PYC3EfwOONF>60l7o*pq zT_H+>MKYP*4F9j$+WNz_H4- z$Db2J@WWtPTPd=;dR;l6M_dq_0ePjohv)Rrek(o+~qCg(26L#|JUU&b2IvH&(l(XR6H11$Hrs z{4u^F@$RA~X@LCIh?QvqxJoip#iA55m>TaOq9L{XQ79<+tUXQ7iEF%hnq-k@ zm9A$;P;LIt3u0km9>nhRW6T#RiU@fIipoASfX){5*7mG#&wfv#>y7 zFvQ<}iDnqJvb>z;v9|jklrsjNk?!tpU`DjGFb50)&uTm9C{^X>M;fzh*K56fd=~px zk4-_#5Z;-6Oi7XMu3CS`!h(E!B{6MmYz$z5Ln1W!r;GOBaCbK4;%O;ZP3N{0&_XJL zierF)K4_)Y@%QDh4o~P{-$tisL;0VeerKwqW3KTwH0%=;NnBYN*IMeaht7L#0Bpl8 zd{h>g7jwTcbc|H5+1NDiPJGhhsA}(_nwepzx%dE0ZOrX$1`NX z7=SRp&gjQ+TVH+?yX0yH&yfQNM(OF%H-=-pAbc>P0c#K81_084WeefMDT!>Fc~_S? zJ1Y(OSx$oIo^sy|(omF?l%jopgZ@+-X?O&p31cHq1@0!}TJ?FD0{AxPx=#tH=3QL; z+gAf@p!^rqqe}ncN~$Vl5C~&~f895#m2h&@tBmBM&{53v&djg?^aW3MH}*eo4}&({ zj-gR_8x$`_1M;E!>#5S{xwqybT>q9PzsCLw_POinxAk>E zFW}VmaZ~A1sS79UAtIS=|A^JZtnq_=6j~T-?vKM>y|`ZEAh`6_)zyuDij}aH&EcR> zC|5)D`dU}i`;Xu%poyi)XkJc%n{#IWGF7^2mh9!f&2^G4eu|xA|5NURnEzJSxU01g z<7e*4Twd~K0Wk3a4zR_HxjMf_uxB5y1_wQtPt1i5xyca#-U9BcGViBt(85(Za@&Nm z2BJ2DEnRcn%V8!ZQ79CqsUEatZzD5lX3Xkp-ksKec6`+$y+Ys@%b3-HvBf6EFRYcv z@)#R=z!Dg-dB)Tq&~BK}>Ss#LEX=zys4Be40l^L--IgYQIs2Tv$R25Fh!H3#9;O!L z=LcG2qP+2WYb%(Ug+|4tbp#j2jIAK%xj>?F{f58WR9%#& zCv{!ZuQUyBo8>~+s4QMzjD4t<^-X<*mFPd>Nlp~AUMrYc5=1f77e`XygY-)9Peek$ zk)|IGEoP`TUA`_C)qi}McOaB9GX!U;pFZ`M!5KHYE&CqE4iZ;}#&XN@&y;i&1k09W z`cEv?X$DSLZZkBl3veAt6|HzkmM~;d=6mW8wgl&TN1=7k8~s6et-x=JtP)tjUFKDk z)43n%Bsuh2drQXxUP^VoHujt?1PmyCNNFuzTwE+JM)V_$h~8_An6ud~V(W#1wwT%p zyFj1TlX^4vCa(APxcyksYF(Kz9Zdfg)|x~ixYxg&^ZRUj9x($SL&lD2aC$oaa-qFg zkh*DZRX+7S*d{#$%X0byS`|hZ?50&$*Is$L$0x%m4bC@1DfWEx0s=$uxP}-E)s+94 zT>W7jhVMT~*I|5&tx%kQo>cPJ^a1IQwn#*a+}l1?)yf^1EEu}$BBT{a+)1`Akb@(f zoxy-#6c-NItTy6~+pN^r71%IiJ5qFNXI=_GXZdL5Ngf>3MRAze#hBqYs5O=-DiFVV zG8R z7#eW9)RgtCRUhW2$rP%PDso_?;m4h%k|TYoWz7Z*DvGRAa<+h$Zlkpvs8L(pRq{r# zCl`<x>-Y`d{Qf(PD`?U(>@=y9|2bo!(iVA4rye)0*cl@1!LrGkiVJAz?-rUSkv z5?4R3FMP&^t}V3U)?XFIwj@{I=^e9PYm8+Pe6VPD!>u!eQOtx|eauckeZ7^NxHI8f}LA8Jh`lN|5>bRH025GP5ga9{x1 zEOGN7y^{R{sTt$LL-UP&IH0ck0^rjL*`@Fce6bV~iPYQMJ4mws7aae{p$!fWR`G;A z&zrt&lexK@mO&gi?+{KI%LzoEnE3b4!2M4bXX?F2472_n4GjKb~Q(`CK1Lw z6(#c$*f(;gnT3VmF88SdBfcjCNCR%ryu88XD1A7mv%c>y1dt4u8QnXob8_${ops*lcnb*rlPVzZH$MV` zE^9#N2L*fEAra~eA@>?U?(za}Z;MHCESQ61=+%qVz@C(F9+UylgsdcpnwEG+j{swy z9pbw!6(t7*p3nb;IM8VHA0+A_9@c|s1IphY=(GME3pD6-2m>9Wwzd}ZirOWq-t(V1 zqIxT5w-HaZh9W%u{r!tv+Aj$PRE+BC>I3h`{}H=~vT3I#ii^8w|3L1}P**~=N+Ra> zhFIj@D1304o^77_JY(BCQ#&{BZbqt0#S zSyAcW)upASL?UJwGY)A@M}`uET~!w=@i}4ZzXmVMV40`Oi1H-5)IVnN;v%q&|C13U z5b{w6N)Bj)`CBUh^?+|y-?@xJRai2%#|#9155x^rAEj4asjLf!*w-D9q2i*21>3e3 zI-Lf34;c=#FOMYrWaw9n4F=9U9|o-}h=s#&b=Hz!Z_xSA5?TkAu&W)fYL=lZVd}>%*x0PS%LJwbQ+(M;8LQS=&^RVxzf)1!}07$ObQ z_ew7{owzMAPd~rb4HC*o(6RGPNcoFG?kD&5mY)oa@~)VBgB!&3ci|#V8&}MRB}-yj zin{;Ga_f$^uZ0utI9fDL?7-bTw-T)oKZU))^5 zN2Q;laW0&4qjA~V^=nT(jR#?g;PQ#7iu3Fb(1I9GIZtp*Qd^2^P^?<8k$0=D)ToOT zqqGf}Xt{O2yH(Oc7<<>?Wnfs*KM{_-$BwbM>ECE7W_gcuclq&RLjehld-shI1SUh% zPhI_;EG+a;C?_YJB|=Of4Nhb)r<)%CY8q%)>BNlYkL-=SgPiY@kyA%hO0KGnhK!ML z?5>9KUxekg8ki%kX323CexC-7-YaVMO{XAAZDyH*~frx@PD}(`5D*B2H~w#!ch>2BRl-j`Ui|ba5_r4WiX9ml1cK`C1HvZ68ZVr&2OAHZ89Ta| zfCSv*x@_}sh=;+UXFm#jUX)G9sQnK^{9~(~OLJt#v0gwC@abq|ErFHOp4xy-e{%w0$UO8>rTTh|;&B<5Rt&m4SY`G(bxn9t2MJJ10Ku4s;r&>S;1!hAogi{!(7e zrj;?=Pva-aO--;t_a+%?Ad5Czm!zm+vE#knG8BO9*#ik~a|?5Gpq#`nI<{AWJ6SBF zq@{&0zEqfoJS|(!2_G(SQ660il?q&@WQDer!t7LXI(S&wOnEOvg8ahed?{1hgO`3a?C_tvjOH*T_#AVjRh`XZ$ zhZF%b-R4WhN)q*~_?r9|oO>7AIyCSnC%qg86g&sMUXxWEJCpLhwG7QHdzIcD>~$bg zve@fdv9)gG+2WD|tXVpqyon~F2|?!t5F1Bxxj=R#{49?h)Qw7jc^v5S9V=^>E)`eG z_o;o??T2TGYIwFrtogMt`I8}GQos-R0*meI!%`xulFx=8^7p3LM4Gqhct$od3e%v~TgNti8OrBh+C;a;5mlUeB21sB|0;Q)w zfsxiQ5xJ{GJuHtm+cc|Sfl=qVE&s`)jEoE{h6YpMNiZM>6B84;Xwbv*Ay4=Kd-O|) zfH){-13Y8D?6j{{u|UmXhk#2B5XGS6hPS7$=iVs)yVxV5;1VzVov94i&)nSNqWNO-drh!7a= zU$GBXhps~Nak&X2$Vi9)`zRMPGw7x1rW(8n1_09v%$S8Yg;R?YAOiM6KDr$H1WoxA zE);I(rE*jOEvcd+p^ETZ=3^%(vnMAX|7+s`vZe!==F!>}q z>ouz=zd_6ng8|Ov^*{YJArA=TwvnW=I;iA+x8F1dYbY)*R^--tL#qnrX(@v58M8ba z6ZiyR7cT5_adkB!DkMUL7 -$ export KUBE_GCE_MINION_PROJECT=coreos-cloud -$ export KUBE_CONTAINER_RUNTIME=rkt -``` - -You can optionally choose the version of rkt used by setting `KUBE_RKT_VERSION`: -```shell -$ export KUBE_RKT_VERSION=0.5.6 -``` - -Then you can launch the cluster by: -````shell -$ kube-up.sh -``` - -Note that we are still working on making all containerized the master components run smoothly in rkt. Before that we are not able to run the master node with rkt yet. - -### CoreOS cluster on AWS - -To use rkt as the container runtime for your CoreOS cluster on AWS, you need to specify the provider and OS distribution: -```shell -$ export KUBERNETES_PROVIDER=aws -$ export KUBE_OS_DISTRIBUTION=coreos -$ export KUBE_CONTAINER_RUNTIME=rkt -``` - -You can optionally choose the version of rkt used by setting `KUBE_RKT_VERSION`: -```shell -$ export KUBE_RKT_VERSION=0.5.6 -``` - -You can optionally choose the CoreOS channel by setting `COREOS_CHANNEL`: -```shell -$ export COREOS_CHANNEL=stable -``` - -Then you can launch the cluster by: -````shell -$ kube-up.sh -``` - -Note: CoreOS is not supported as the master using the automated launch -scripts. The master node is always Ubuntu. - -### Getting started with your cluster -See [a simple nginx example](../../examples/simple-nginx.md) to try out your new cluster. - -For more complete applications, please look in the [examples directory](../../examples). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/rkt/README.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/rkt/README.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/ubuntu.md b/release-0.20.0/docs/getting-started-guides/ubuntu.md deleted file mode 100644 index c38bcb61419..00000000000 --- a/release-0.20.0/docs/getting-started-guides/ubuntu.md +++ /dev/null @@ -1,191 +0,0 @@ -Kubernetes Deployment On Bare-metal Ubuntu Nodes ------------------------------------------------- - -- [Introduction](#introduction) -- [Prerequisites](#prerequisites) - - [Starting a Cluster](#starting-a-cluster) - - [Make *kubernetes* , *etcd* and *flanneld* binaries](#make-kubernetes--etcd-and-flanneld-binaries) - - [Configure and start the kubernetes cluster](#configure-and-start-the-kubernetes-cluster) - - [Deploy addons](#deploy-addons) - - [Trouble Shooting](#trouble-shooting) - -## Introduction - -This document describes how to deploy kubernetes on ubuntu nodes, including 1 master node and 3 minion nodes, and people uses this approach can scale to **any number of minion nodes** by changing some settings with ease. The original idea was heavily inspired by @jainvipin 's ubuntu single node work, which has been merge into this document. - -[Cloud team from Zhejiang University](https://github.com/ZJU-SEL) will maintain this work. - -## Prerequisites -*1 The minion nodes have installed docker version 1.2+ and bridge-utils to manipulate linux bridge* - -*2 All machines can communicate with each other, no need to connect Internet (should use private docker registry in this case)* - -*3 These guide is tested OK on Ubuntu 14.04 LTS 64bit server, but it should also work on most Ubuntu versions* - -*4 Dependences of this guide: etcd-2.0.9, flannel-0.4.0, k8s-0.18.0, but it may work with higher versions* - -*5 All the remote servers can be ssh logged in without a password by using key authentication* - - -### Starting a Cluster -#### Make *kubernetes* , *etcd* and *flanneld* binaries - -First clone the kubernetes github repo, `$ git clone https://github.com/GoogleCloudPlatform/kubernetes.git` -then `$ cd kubernetes/cluster/ubuntu`. - -Then run `$ ./build.sh`, this will download all the needed binaries into `./binaries`. - -You can customize your etcd version, flannel version, k8s version by changing variable `ETCD_VERSION` , `FLANNEL_VERSION` and `K8S_VERSION` in build.sh, default etcd version is 2.0.9, flannel version is 0.4.0 and K8s version is 0.18.0. - -Please make sure that there are `kube-apiserver`, `kube-controller-manager`, `kube-scheduler`, `kubelet`, `kube-proxy`, `etcd`, `etcdctl` and `flannel` in the binaries/master or binaries/minion directory. - -> We used flannel here because we want to use overlay network, but please remember it is not the only choice, and it is also not a k8s' necessary dependence. Actually you can just build up k8s cluster natively, or use flannel, Open vSwitch or any other SDN tool you like, we just choose flannel here as a example. - -#### Configure and start the kubernetes cluster -An example cluster is listed as below: - -| IP Address|Role | -|---------|------| -|10.10.103.223| minion | -|10.10.103.162| minion | -|10.10.103.250| both master and minion| - -First configure the cluster information in cluster/ubuntu/config-default.sh, below is a simple sample. - -``` -export nodes="vcap@10.10.103.250 vcap@10.10.103.162 vcap@10.10.103.223" - -export roles=("ai" "i" "i") - -export NUM_MINIONS=${NUM_MINIONS:-3} - -export SERVICE_CLUSTER_IP_RANGE=11.1.1.0/24 - -export FLANNEL_NET=172.16.0.0/16 - - -``` - -The first variable `nodes` defines all your cluster nodes, MASTER node comes first and separated with blank space like ` ` - -Then the `roles ` variable defines the role of above machine in the same order, "ai" stands for machine acts as both master and minion, "a" stands for master, "i" stands for minion. So they are just defined the k8s cluster as the table above described. - -The `NUM_MINIONS` variable defines the total number of minions. - -The `SERVICE_CLUSTER_IP_RANGE` variable defines the kubernetes service IP range. Please make sure that you do have a valid private ip range defined here, because some IaaS provider may reserve private ips. You can use below three private network range according to rfc1918. Besides you'd better not choose the one that conflicts with your own private network range. - - 10.0.0.0 - 10.255.255.255 (10/8 prefix) - - 172.16.0.0 - 172.31.255.255 (172.16/12 prefix) - - 192.168.0.0 - 192.168.255.255 (192.168/16 prefix) - -The `FLANNEL_NET` variable defines the IP range used for flannel overlay network, should not conflict with above `SERVICE_CLUSTER_IP_RANGE`. - -After all the above variable being set correctly. We can use below command in cluster/ directory to bring up the whole cluster. - -`$ KUBERNETES_PROVIDER=ubuntu ./kube-up.sh` - -The scripts is automatically scp binaries and config files to all the machines and start the k8s service on them. The only thing you need to do is to type the sudo password when promoted. The current machine name is shown below like. So you will not type in the wrong password. - -``` - -Deploying minion on machine 10.10.103.223 - -... - -[sudo] password to copy files and start minion: - -``` - -If all things goes right, you will see the below message from console -`Cluster validation succeeded` indicating the k8s is up. - -**All done !** - -You can also use `kubectl` command to see if the newly created k8s is working correctly. The `kubectl` binary is under the `cluster/ubuntu/binaries` directory. You can move it into your PATH. Then you can use the below command smoothly. - -For example, use `$ kubectl get nodes` to see if all your minion nodes are in ready status. It may take some time for the minions ready to use like below. - -``` - -NAME LABELS STATUS - -10.10.103.162 kubernetes.io/hostname=10.10.103.162 Ready - -10.10.103.223 kubernetes.io/hostname=10.10.103.223 Ready - -10.10.103.250 kubernetes.io/hostname=10.10.103.250 Ready - - -``` - -Also you can run kubernetes [guest-example](https://github.com/GoogleCloudPlatform/kubernetes/tree/master/examples/guestbook) to build a redis backend cluster on the k8s． - - -#### Deploy addons - -After the previous parts, you will have a working k8s cluster, this part will teach you how to deploy addons like dns onto the existing cluster. - -The configuration of dns is configured in cluster/ubuntu/config-default.sh. - -``` - -ENABLE_CLUSTER_DNS=true - -DNS_SERVER_IP="192.168.3.10" - -DNS_DOMAIN="kubernetes.local" - -DNS_REPLICAS=1 - -``` -The `DNS_SERVER_IP` is defining the ip of dns server which must be in the service_cluster_ip_range. - -The `DNS_REPLICAS` describes how many dns pod running in the cluster. - -After all the above variable have been set. Just type the below command - -``` - -$ cd cluster/ubuntu - -$ KUBERNETES_PROVIDER=ubuntu ./deployAddons.sh - -``` - -After some time, you can use `$ kubectl get pods` to see the dns pod is running in the cluster. Done! - - -#### Trouble Shooting - -Generally, what this approach did is quite simple: - -1. Download and copy binaries and configuration files to proper directories on every node - -2. Configure `etcd` using IPs based on input from user - -3. Create and start flannel network - -So, if you see a problem, **check etcd configuration first** - -Please try: - -1. Check `/var/log/upstart/etcd.log` for suspicious etcd log - -2. Check `/etc/default/etcd`, as we do not have much input validation, a right config should be like: - ``` - ETCD_OPTS="-name infra1 -initial-advertise-peer-urls -listen-peer-urls -initial-cluster-token etcd-cluster-1 -initial-cluster infra1=,infra2=,infra3= -initial-cluster-state new" - ``` - -3. You can use below command - `$ KUBERNETES_PROVIDER=ubuntu ./kube-down.sh` to bring down the cluster and run - `$ KUBERNETES_PROVIDER=ubuntu ./kube-up.sh` again to start again. - -4. You can also customize your own settings in `/etc/default/{component_name}` after configured success. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/ubuntu.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/ubuntu.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/vagrant.md b/release-0.20.0/docs/getting-started-guides/vagrant.md deleted file mode 100644 index 63e77042226..00000000000 --- a/release-0.20.0/docs/getting-started-guides/vagrant.md +++ /dev/null @@ -1,337 +0,0 @@ -## Getting started with Vagrant - -Running kubernetes with Vagrant (and VirtualBox) is an easy way to run/test/develop on your local machine (Linux, Mac OS X). - -**Table of Contents** - -- [Prerequisites](#prerequisites) -- [Setup](#setup) -- [Interacting with your Kubernetes cluster with Vagrant.](#interacting-with-your-kubernetes-cluster-with-vagrant) -- [Authenticating with your master](#authenticating-with-your-master) -- [Running containers](#running-containers) -- [Troubleshooting](#troubleshooting) - - [I keep downloading the same (large) box all the time!](#i-keep-downloading-the-same-large-box-all-the-time) - - [I just created the cluster, but I am getting authorization errors!](#i-just-created-the-cluster-but-i-am-getting-authorization-errors) - - [I just created the cluster, but I do not see my container running!](#i-just-created-the-cluster-but-i-do-not-see-my-container-running) - - [I want to make changes to Kubernetes code!](#i-want-to-make-changes-to-kubernetes-code) - - [I have brought Vagrant up but the nodes cannot validate!](#i-have-brought-vagrant-up-but-the-nodes-cannot-validate) - - [I want to change the number of nodes!](#i-want-to-change-the-number-of-nodes) - - [I want my VMs to have more memory!](#i-want-my-vms-to-have-more-memory) - - [I ran vagrant suspend and nothing works!](#i-ran-vagrant-suspend-and-nothing-works) - - -### Prerequisites -1. Install latest version >= 1.6.2 of vagrant from http://www.vagrantup.com/downloads.html -2. Install one of: - 1. The latest version of Virtual Box from https://www.virtualbox.org/wiki/Downloads - 2. [VMWare Fusion](https://www.vmware.com/products/fusion/) version 5 or greater as well as the appropriate [Vagrant VMWare Fusion provider](https://www.vagrantup.com/vmware) - 3. [VMWare Workstation](https://www.vmware.com/products/workstation/) version 9 or greater as well as the [Vagrant VMWare Workstation provider](https://www.vagrantup.com/vmware) - 4. [Parallels Desktop](https://www.parallels.com/products/desktop/) version 9 or greater as well as the [Vagrant Parallels provider](https://parallels.github.io/vagrant-parallels/) - 5. libvirt with KVM and enable support of hardware virtualisation. [Vagrant-libvirt](https://github.com/pradels/vagrant-libvirt). For fedora provided official rpm, and possible to use ```yum install vagrant-libvirt``` - -### Setup - -Setting up a cluster is as simple as running: - -```sh -export KUBERNETES_PROVIDER=vagrant -curl -sS https://get.k8s.io | bash -``` - -The `KUBERNETES_PROVIDER` environment variable tells all of the various cluster management scripts which variant to use. If you forget to set this, the assumption is you are running on Google Compute Engine. - -By default, the Vagrant setup will create a single kubernetes-master and 1 kubernetes-minion. Each VM will take 1 GB, so make sure you have at least 2GB to 4GB of free memory (plus appropriate free disk space). To start your local cluster, open a shell and run: - -```sh -cd kubernetes - -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -Vagrant will provision each machine in the cluster with all the necessary components to run Kubernetes. The initial setup can take a few minutes to complete on each machine. - -If you installed more than one Vagrant provider, Kubernetes will usually pick the appropriate one. However, you can override which one Kubernetes will use by setting the [`VAGRANT_DEFAULT_PROVIDER`](https://docs.vagrantup.com/v2/providers/default.html) environment variable: - -```sh -export VAGRANT_DEFAULT_PROVIDER=parallels -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -By default, each VM in the cluster is running Fedora. - -To access the master or any minion: - -```sh -vagrant ssh master -vagrant ssh minion-1 -``` - -If you are running more than one minion, you can access the others by: - -```sh -vagrant ssh minion-2 -vagrant ssh minion-3 -``` - -Each node in the cluster installs the docker daemon and the kubelet. - -The master node instantiates the Kubernetes master components as pods on the machine. - -To view the service status and/or logs on the kubernetes-master: - -```sh -vagrant ssh master -[vagrant@kubernetes-master ~] $ sudo su - -[root@kubernetes-master ~] $ systemctl status kubelet -[root@kubernetes-master ~] $ journalctl -ru kubelet - -[root@kubernetes-master ~] $ systemctl status docker -[root@kubernetes-master ~] $ journalctl -ru docker - -[root@kubernetes-master ~] $ tail -f /var/log/kube-apiserver.log -[root@kubernetes-master ~] $ tail -f /var/log/kube-controller-manager.log -[root@kubernetes-master ~] $ tail -f /var/log/kube-scheduler.log -``` - -To view the services on any of the kubernetes-minion(s): -```sh -vagrant ssh minion-1 -[vagrant@kubernetes-master ~] $ sudo su - -[root@kubernetes-master ~] $ systemctl status kubelet -[root@kubernetes-master ~] $ journalctl -ru kubelet - -[root@kubernetes-master ~] $ systemctl status docker -[root@kubernetes-master ~] $ journalctl -ru docker -``` - -### Interacting with your Kubernetes cluster with Vagrant. - -With your Kubernetes cluster up, you can manage the nodes in your cluster with the regular Vagrant commands. - -To push updates to new Kubernetes code after making source changes: -```sh -./cluster/kube-push.sh -``` - -To stop and then restart the cluster: -```sh -vagrant halt -./cluster/kube-up.sh -``` - -To destroy the cluster: -```sh -vagrant destroy -``` - -Once your Vagrant machines are up and provisioned, the first thing to do is to check that you can use the `kubectl.sh` script. - -You may need to build the binaries first, you can do this with ```make``` - -```sh -$ ./cluster/kubectl.sh get nodes - -NAME LABELS -10.245.1.4 -10.245.1.5 -10.245.1.3 -``` - -### Authenticating with your master - -When using the vagrant provider in Kubernetes, the `cluster/kubectl.sh` script will cache your credentials in a `~/.kubernetes_vagrant_auth` file so you will not be prompted for them in the future. - -```sh -cat ~/.kubernetes_vagrant_auth -{ "User": "vagrant", - "Password": "vagrant", - "CAFile": "/home/k8s_user/.kubernetes.vagrant.ca.crt", - "CertFile": "/home/k8s_user/.kubecfg.vagrant.crt", - "KeyFile": "/home/k8s_user/.kubecfg.vagrant.key" -} -``` - -You should now be set to use the `cluster/kubectl.sh` script. For example try to list the nodes that you have started with: - -```sh -./cluster/kubectl.sh get nodes -``` - -### Running containers - -Your cluster is running, you can list the nodes in your cluster: - -```sh -$ ./cluster/kubectl.sh get nodes - -NAME LABELS -10.245.2.4 -10.245.2.3 -10.245.2.2 -``` - -Now start running some containers! - -You can now use any of the `cluster/kube-*.sh` commands to interact with your VM machines. -Before starting a container there will be no pods, services and replication controllers. - -```sh -$ ./cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS - -$ ./cluster/kubectl.sh get services -NAME LABELS SELECTOR IP PORT - -$ ./cluster/kubectl.sh get replicationcontrollers -NAME IMAGE(S SELECTOR REPLICAS -``` - -Start a container running nginx with a replication controller and three replicas - -```sh -$ ./cluster/kubectl.sh run my-nginx --image=nginx --replicas=3 --port=80 -``` - -When listing the pods, you will see that three containers have been started and are in Waiting state: - -```sh -$ ./cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -781191ff-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.4/10.245.2.4 name=myNginx Waiting -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Waiting -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Waiting -``` - -You need to wait for the provisioning to complete, you can monitor the nodes by doing: - -```sh -$ vagrant ssh minion-1 -c 'sudo docker images' -kubernetes-minion-1: - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE - 96864a7d2df3 26 hours ago 204.4 MB - google/cadvisor latest e0575e677c50 13 days ago 12.64 MB - kubernetes/pause latest 6c4579af347b 8 weeks ago 239.8 kB -``` - -Once the docker image for nginx has been downloaded, the container will start and you can list it: - -```sh -$ vagrant ssh minion-1 -c 'sudo docker ps' -kubernetes-minion-1: - CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES - dbe79bf6e25b nginx:latest "nginx" 21 seconds ago Up 19 seconds k8s--mynginx.8c5b8a3a--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1.etcd--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1--fcfa837f - fa0e29c94501 kubernetes/pause:latest "/pause" 8 minutes ago Up 8 minutes 0.0.0.0:8080->80/tcp k8s--net.a90e7ce4--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1.etcd--7813c8bd_-_3ffe_-_11e4_-_9036_-_0800279696e1--baf5b21b - aa2ee3ed844a google/cadvisor:latest "/usr/bin/cadvisor" 38 minutes ago Up 38 minutes k8s--cadvisor.9e90d182--cadvisor_-_agent.file--4626b3a2 - 65a3a926f357 kubernetes/pause:latest "/pause" 39 minutes ago Up 39 minutes 0.0.0.0:4194->8080/tcp k8s--net.c5ba7f0e--cadvisor_-_agent.file--342fd561 -``` - -Going back to listing the pods, services and replicationcontrollers, you now have: - -```sh -$ ./cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -781191ff-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.4/10.245.2.4 name=myNginx Running -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Running -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Running - -$ ./cluster/kubectl.sh get services -NAME LABELS SELECTOR IP PORT - -$ ./cluster/kubectl.sh get replicationcontrollers -NAME IMAGE(S SELECTOR REPLICAS -myNginx nginx name=my-nginx 3 -``` - -We did not start any services, hence there are none listed. But we see three replicas displayed properly. -Check the [guestbook](../../examples/guestbook/README.md) application to learn how to create a service. -You can already play with scaling the replicas with: - -```sh -$ ./cluster/kubectl.sh scale rc my-nginx --replicas=2 -$ ./cluster/kubectl.sh get pods -NAME IMAGE(S) HOST LABELS STATUS -7813c8bd-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.2/10.245.2.2 name=myNginx Running -78140853-3ffe-11e4-9036-0800279696e1 nginx 10.245.2.3/10.245.2.3 name=myNginx Running -``` - -Congratulations! - -### Troubleshooting - -#### I keep downloading the same (large) box all the time! - -By default the Vagrantfile will download the box from S3. You can change this (and cache the box locally) by providing a name and an alternate URL when calling `kube-up.sh` - -```sh -export KUBERNETES_BOX_NAME=choose_your_own_name_for_your_kuber_box -export KUBERNETES_BOX_URL=path_of_your_kuber_box -export KUBERNETES_PROVIDER=vagrant -./cluster/kube-up.sh -``` - -#### I just created the cluster, but I am getting authorization errors! - -You probably have an incorrect ~/.kubernetes_vagrant_auth file for the cluster you are attempting to contact. - -```sh -rm ~/.kubernetes_vagrant_auth -``` - -After using kubectl.sh make sure that the correct credentials are set: - -```sh -cat ~/.kubernetes_vagrant_auth -{ - "User": "vagrant", - "Password": "vagrant" -} -``` - -#### I just created the cluster, but I do not see my container running! - -If this is your first time creating the cluster, the kubelet on each minion schedules a number of docker pull requests to fetch prerequisite images. This can take some time and as a result may delay your initial pod getting provisioned. - -#### I want to make changes to Kubernetes code! - -To set up a vagrant cluster for hacking, follow the [vagrant developer guide](../devel/developer-guides/vagrant.md). - -#### I have brought Vagrant up but the nodes cannot validate! - -Log on to one of the nodes (`vagrant ssh minion-1`) and inspect the salt minion log (`sudo cat /var/log/salt/minion`). - -#### I want to change the number of nodes! - -You can control the number of nodes that are instantiated via the environment variable `NUM_MINIONS` on your host machine. If you plan to work with replicas, we strongly encourage you to work with enough nodes to satisfy your largest intended replica size. If you do not plan to work with replicas, you can save some system resources by running with a single minion. You do this, by setting `NUM_MINIONS` to 1 like so: - -```sh -export NUM_MINIONS=1 -``` - -#### I want my VMs to have more memory! - -You can control the memory allotted to virtual machines with the `KUBERNETES_MEMORY` environment variable. -Just set it to the number of megabytes you would like the machines to have. For example: - -```sh -export KUBERNETES_MEMORY=2048 -``` - -If you need more granular control, you can set the amount of memory for the master and nodes independently. For example: - -```sh -export KUBERNETES_MASTER_MEMORY=1536 -export KUBERNETES_MINION_MEMORY=2048 -``` - -#### I ran vagrant suspend and nothing works! -```vagrant suspend``` seems to mess up the network. This is not supported at this time. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/vagrant.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/vagrant.md?pixel)]() diff --git a/release-0.20.0/docs/getting-started-guides/vsphere.md b/release-0.20.0/docs/getting-started-guides/vsphere.md deleted file mode 100644 index 7fb8f07ee43..00000000000 --- a/release-0.20.0/docs/getting-started-guides/vsphere.md +++ /dev/null @@ -1,94 +0,0 @@ -Getting started with vSphere -------------------------------- - -The example below creates a Kubernetes cluster with 4 worker node Virtual -Machines and a master Virtual Machine (i.e. 5 VMs in your cluster). This -cluster is set up and controlled from your workstation (or wherever you find -convenient). - -**Table of Contents** - -- [Prerequisites](#prerequisites) -- [Setup](#setup) -- [Starting a cluster](#starting-a-cluster) -- [Extra: debugging deployment failure](#extra-debugging-deployment-failure) - -### Prerequisites - -1. You need administrator credentials to an ESXi machine or vCenter instance. -2. You must have Go (version 1.2 or later) installed: [www.golang.org](http://www.golang.org). -3. You must have your `GOPATH` set up and include `$GOPATH/bin` in your `PATH`. - - ```sh - export GOPATH=$HOME/src/go - mkdir -p $GOPATH - export PATH=$PATH:$GOPATH/bin - ``` - -4. Install the govc tool to interact with ESXi/vCenter: - - ```sh - go get github.com/vmware/govmomi/govc - ``` - -5. Get or build a [binary release](binary_release.md) - -### Setup - -Download a prebuilt Debian 7.7 VMDK that we'll use as a base image: - -```sh -curl --remote-name-all https://storage.googleapis.com/govmomi/vmdk/2014-11-11/kube.vmdk.gz{,.md5} -md5sum -c kube.vmdk.gz.md5 -gzip -d kube.vmdk.gz -``` - -Import this VMDK into your vSphere datastore: - -```sh -export GOVC_URL='user:pass@hostname' -export GOVC_INSECURE=1 # If the host above uses a self-signed cert -export GOVC_DATASTORE='target datastore' -export GOVC_RESOURCE_POOL='resource pool or cluster with access to datastore' - -govc import.vmdk kube.vmdk ./kube/ -``` - -Verify that the VMDK was correctly uploaded and expanded to ~3GiB: - -```sh -govc datastore.ls ./kube/ -``` - -Take a look at the file `cluster/vsphere/config-common.sh` fill in the required -parameters. The guest login for the image that you imported is `kube:kube`. - -### Starting a cluster - -Now, let's continue with deploying Kubernetes. -This process takes about ~10 minutes. - -```sh -cd kubernetes # Extracted binary release OR repository root -export KUBERNETES_PROVIDER=vsphere -cluster/kube-up.sh -``` - -Refer to the top level README and the getting started guide for Google Compute -Engine. Once you have successfully reached this point, your vSphere Kubernetes -deployment works just as any other one! - -**Enjoy!** - -### Extra: debugging deployment failure - -The output of `kube-up.sh` displays the IP addresses of the VMs it deploys. You -can log into any VM as the `kube` user to poke around and figure out what is -going on (find yourself authorized with your SSH key, or use the password -`kube` otherwise). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/getting-started-guides/vsphere.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/getting-started-guides/vsphere.md?pixel)]() diff --git a/release-0.20.0/docs/glossary.md b/release-0.20.0/docs/glossary.md deleted file mode 100644 index fc470a92220..00000000000 --- a/release-0.20.0/docs/glossary.md +++ /dev/null @@ -1,61 +0,0 @@ - -# Glossary and Concept Index - -**Authorization** -:Kubernetes does not currently have an authorization system. Anyone with the cluster password can do anything. We plan -to add sophisticated authorization, and to make it pluggable. See the [access control design doc](./design/access.md) and -[this issue](https://github.com/GoogleCloudPlatform/kubernetes/issues/1430). - -**Annotation** -: A key/value pair that can hold large (compared to a Label), and possibly not human-readable data. Intended to store -non-identifying metadata associated with an object, such as provenance information. Not indexed. - -**Image** -: A [Docker Image](https://docs.docker.com/userguide/dockerimages/). See [images](./images.md). - -**Label** -: A key/value pair conveying user-defined identifying attributes of an object, and used to form sets of related objects, such as -pods which are replicas in a load-balanced service. Not intended to hold large or non-human-readable data. See [labels](./labels.md). - -**Name** -: A user-provided name for an object. See [identifiers](identifiers.md). - -**Namespace** -: A namespace is like a prefix to the name of an object. You can configure your client to use a particular namespace, -so you do not have to type it all the time. Namespaces allow multiple projects to prevent naming collisions between unrelated teams. - -**Pod** -: A collection of containers which will be scheduled onto the same node, which share and an IP and port space, and which -can be created/destroyed together. See [pods](./pods.md). - -**Replication Controller** -: A _replication controller_ ensures that a specified number of pod "replicas" are running at any one time. Both allows -for easy scaling of replicated systems, and handles restarting of a Pod when the machine it is on reboots or otherwise fails. - -**Resource** -: CPU, memory, and other things that a pod can request. See [resources](resources.md). - -**Secret** -: An object containing sensitive information, such as authentication tokens, which can be made available to containers upon request. See [secrets](secrets.md). - -**Selector** -: An expression that matches Labels. Can identify related objects, such as pods which are replicas in a load-balanced -service. See [labels](labels.md). - -**Service** -: A load-balanced set of `pods` which can be accessed via a single stable IP address. See [services](./services.md). - -**UID** -: An identifier on all Kubernetes objects that is set by the Kubernetes API server. Can be used to distinguish between historical -occurrences of same-Name objects. See [identifiers](identifiers.md). - -**Volume** -: A directory, possibly with some data in it, which is accessible to a Container as part of its filesystem. Kubernetes -Volumes build upon [Docker Volumes](https://docs.docker.com/userguide/dockervolumes/), adding provisioning of the Volume -directory and/or device. See [volumes](volumes.md). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/glossary.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/glossary.md?pixel)]() diff --git a/release-0.20.0/docs/identifiers.md b/release-0.20.0/docs/identifiers.md deleted file mode 100644 index 0e52b44c40e..00000000000 --- a/release-0.20.0/docs/identifiers.md +++ /dev/null @@ -1,16 +0,0 @@ -# Identifiers -All objects in the Kubernetes REST API are unambiguously identified by a Name and a UID. - -For non-unique user-provided attributes, Kubernetes provides [labels](labels.md) and [annotations](annotations.md). - -## Names -Names are generally client-provided. Only one object of a given kind can have a given name at a time (i.e., they are spatially unique). But if you delete an object, you can make a new object with the same name. Names are the used to refer to an object in a resource URL, such as `/api/v1/pods/some-name`. By convention, the names of Kubernetes resources should be up to maximum length of 253 characters and consist of lower case alphanumeric characters, `-`, and `.`, but certain resources have more specific restrictions. See the [identifiers design doc](design/identifiers.md) for the precise syntax rules for names. - -## UIDs -UID are generated by Kubernetes. Every object created over the whole lifetime of a Kubernetes cluster has a distinct UID (i.e., they are spatially and temporally unique). - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/identifiers.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/identifiers.md?pixel)]() diff --git a/release-0.20.0/docs/images.md b/release-0.20.0/docs/images.md deleted file mode 100644 index 3f1e1cb28b6..00000000000 --- a/release-0.20.0/docs/images.md +++ /dev/null @@ -1,159 +0,0 @@ -# Images -Each container in a pod has its own image. Currently, the only type of image supported is a [Docker Image](https://docs.docker.com/userguide/dockerimages/). - -You create your Docker image and push it to a registry before referring to it in a kubernetes pod. - -The `image` property of a container supports the same syntax as the `docker` command does, including private registries and tags. - -## Updating Images - -The default pull policy is `PullIfNotPresent` which causes the Kubelet to not -pull an image if it already exists. If you would like to always force a pull -you must set a pull image policy of `PullAlways` or specify a `:latest` tag on -your image. - -## Using a Private Registry -Private registries may require keys to read images from them. -Credentials can be provided in several ways: - - Using Google Container Registry - - Per-cluster - - automatically configured on GCE/GKE - - all pods can read the project's private registry - - Configuring Nodes to Authenticate to a Private Registry - - all pods can read any configured private registries - - requires node configuration by cluster administrator - - Pre-pulling Images - - all pods can use any images cached on a node - - requires root access to all nodes to setup - - Specifying ImagePullKeys on a Pod - - only pods which provide own keys can access the private registry -Each option is described in more detail below. - - -### Using Google Container Registry - -Kubernetes has native support for the [Google Container -Registry (GCR)](https://cloud.google.com/tools/container-registry/), when running on Google Compute -Engine (GCE). If you are running your cluster on GCE or Google Container Engine (GKE), simply -use the full image name (e.g. gcr.io/my_project/image:tag). - -All pods in a cluster will have read access to images in this registry. - -The kubelet kubelet will authenticate to GCR using the instance's -Google service account. The service account on the instance -will have a `https://www.googleapis.com/auth/devstorage.read_only`, -so it can pull from the project's GCR, but not push. - -### Configuring Nodes to Authenticate to a Private Registry -Docker stores keys for private registries in a `.dockercfg` file. Create a config file by running -`docker login .` and then copy the resulting `.dockercfg` file to the root user's -`$HOME` directory (e.g. `/root/.dockercfg`) on each node in the cluster. - -You must ensure all nodes in the cluster have the same `.dockercfg`. Otherwise, pods will run on -some nodes and fail to run on others. For example, if you use node autoscaling, then each instance -template needs to include the `.dockercfg` or mount a drive that contains it. - -All pods will have read access to images in any private registry with keys in the `.dockercfg`. - -### Pre-pulling Images - -Be default, the kubelet will try to pull each image from the specified registry. -However, if the `imagePullPolicy` property of the container is set to `IfNotPresent` or `Never`, -then a local image is used (preferentially or exclusively, respectively). - -If you want to rely on pre-pulled images as a substitute for registry authentication, -you must ensure all nodes in the cluster have the same pre-pulled images. - -This can be used to preload certain images for speed or as an alternative to authenticating to a private registry. - -All pods will have read access to any pre-pulled images. - -### Specifying ImagePullSecrets on a Pod -Kubernetes supports specifying registry keys on a pod. - -First, create a `.dockercfg`, such as running `docker login `. -Then put the resulting `.dockercfg` file into a [secret resource](../docs/secret.md). For example: -``` -cat > dockercfg < secret.json <

      0$tn^+&am${V`pFs2 zn4-jG&yzD&WNJ|V7oxRn0nTXg4v7Yk8Nc|MIwY%&+~^o!a%5 zgnEmk=f)9r+9|0+bWX&2N9L)$XB~~l5zU_OyoF?Pyn+{t#RdldP>PICBweqpJIx5| zt1?rcs#ae8+Q#qP@2a`%FRtQ5Rgp1iyfRuAQ8VC^DVxGb94sso{)Wl9D!6sS@X_(M zb5y&M?e8S90@!X_y2*Yaud(xk#WAACBIi*BMlPfAAv%qB`;DO;W3c($u#6v%xGmGW zU2pf9w%tuVrCbY~yTQJ^2bC|&L0z7JUc7hQG0#c$6Wkq{v%1Ox4sRLLZXrs<1z(d8 z^X(4YkFqGc>lm~#rc6BaS4G2=vVX{Nqu3>J%)sjX^_xT(hbi)cveQctTa$PxY1gaR zxej5*cq-5MQM$OJRLhmtxKXB#8Q`cozIYElG=fllR#SVXsvK||alGBLe|Cg*u|t#J z2d%L%OzqjSw^{6I{wy&J0E0k4Op3GSme7?M0$)o~xp(-YyIS0*88q~$O@QccOlIuu zY3a8+EI`5^qty?kwE~UZ&hS(VmR5I;+PU~xr{7d56b!xyQV59Jc3I9w;}ss`+6g~| zGfaN&+1{?@tMoLI(@=B9GjMGb=Nz-X0LK%6z1&m3!r7ZZE(!*@Ye(Y+i(aFGd6{?X zruGu@{}yQF?m=neQCaE=D!t0y?MsDP5qZf^+cqZgnM?e|ir1dRv(Bq`Z9cnZThgjiO*J%MNWpZs4@#6RoZU&xEOWM*HbwiR=hYv)E%cp5c@k`$@%-B>Nc zxE)S8gXLcRQNsVY4EfziV|89~g@BJqCV_s=&i9&yf10F{#lvRKnhFnX-z_?y-P(e7 zZbC0_Ascrx7k&g?HuLtgGa|p=^h`T@*bn1muIY9L#-H%c-OiZE%kNhezM^r8-%JuNh)sMS1*OLPT z5;uQ(Ke+f~&F5>9Xc|vX_G5y%N9HaQ(9wWz{N}?orcolZPdwP1La^bJIGfn3;BdH? z7t^gfSMiT$k&wAMUZ(^Rvk#gShx zxr{DQNP2*g;ndV9li9`v1$Lm=nN6w{Xv zl>-1_cOtdnQp`Q^dio!_0hFIMa-TOu4DX!(_- z?(9{O&2&6B9mtn1_`|=s52qMN{(YP=TEk0Yl|8dt7m<+DR%vc{i|gNmRPpen9(@)P ziex;m8Y=`q(lYpte&e>|8wN5azyHdd^Nsw%-+Hq`*m*Md;XAipCcM^2-H$V3v&gUq z+6K%OnNPZjJZ5h?x5x6r&yN}~Z+eZm#-$eDR5ARm{4eTTY5q7=hq$Fb-147)1719D z7KOXU3;TU%t8soYmZUcU!wV$9eE1<}-+lV88*#JmKL5QDkc50uEwu8q(7$N7Pk??h zxS{uPs$J2yIeA?_YU^`1*8igtu z*Yj1#$Go_G(a@k6hb23CXgs+nCU_BZuL?no(B$_R@pY1a52MRTg1kg+U{a34<-5DjEwY-&xH>!J;Q_Or z(T;h6{;N2n^ulGWygI8i?HBDouNW;aqDol1j)-xC%cJYtb)rD^UO>(|pYF=jFL(NSD;}o(uei>XOIMs@ zq?p7}Zp6iUzw`)7wdxBDg@-$E6`~K_c|SWTAVnq5ZG{zuoZ8=k7SQr29dpy3U-2pC zY62*Y`uU?y&vE)-2597mw4D+D6+8^Z)^lyvt6E6&)v%+6_scdz$LCXzWA+WpPw3qO z_en7+qcueg!(oX_vHs3MHtK^1GMDr^z10bO7>P9YChpxolSsmMR@=D>V269D#rkLE zQ}jkR2PBj3q|0&@&e%d!Z4K`oe;RznfhbJ$*R3x7uJ?pFH?8~y>Y_!l=zxc#4v}Ke zRb=qU)@-sr#dZfxkyYKJD zOS@mj_jGSB2w3}dz*(xy=+u_H+-}8_Fj52USe=rQ5tS0s5}kBmw4%uL-Mo1wvC+D! zlxEVGa^?4HlPKwM+^LV9e0rMViu2{(dZxi5YjMd5mOk7Cz)a}0=2D}pyf z7aa|@>oYJpq6`}XOFvFjek&U0?@qu6_E)O3b7H%*hHOz)-+r#S)zdzdmw9cB#!-;2 zCXO8PaHv%IA5}J_XK7ovdG=Q1OVMYVz*T#Swy2g3N={(1(|VpZPCikMnVb@h!>1(r zxCX6iQC!v4xb@Im>0YSX&m+u}PQ862;cncHmSJ^(KF!z1aDrQl2|~=SlsV=4SrXmT z#rp-G#ZqMFF9dEZAWmh>0Gh}O=x^FWpZc?ttm%n&^D=qjH>I@dch+Sh$`e(e7B|R? zrDVw#*RDrdYufw0Cw^LfbxRmd0vI{+bMquYI>fk5VI%Jo$YAm8-nS?_R1L~WX+1fs zlA+!3Xv&Kt1{rwlV{xeXHTyMj_-#Nq8P2f2utm>CI9^n#O7fFJpOT8R$vu)evErI_ zMKRp2G4XNh)9#rR-Yb_?q;%?jEXeyg5r2=+sn85K75ofV2$989T|&v~F|hEENICw@ zxek^qB~6z`D%{Z%3{)9{)xRW*;#Ah~nLXc`-!tVZr(IyuFKje`xtO(Dc^qviZ{RLZ_QnKK18ip7T8?_z zU@r*pbEb%9^jg)v)##>f0G4AVuVTMYr&^?51H8faO*PLPtnG7k`!np$I*vJWS;$==-4TWV#Sc^iJhBz%@I{zbHnyFeb2N&RI8B-iz#( zOuhVGVkFpJbmk#S(!B?!^HVf&Ak`X+MA6PUgB~O@D>*3ln#s>i)l6%ex%-Geya~+w zY)zyjRJtShx2jtc@!m&Sziu z^Q9&|sHpmw*zPZ?ys9%{q)`G{ubZJ`Bx2K4_hV|VWLMltbKdH?`&he|4}usqND6$Vb~Te=*-c7!Wmn}$_yesxcLiU5I_5_+1%D}s$Z|Vn@*TB{)w)^UU}T& zbK3f%9Xk)@_C&2{bjDgP^)$0g0-MHc;4VSGdyYcj)PY?b2fH2jNMgSYqQ{rJ4_sVRxXHh( z=!VlLeV`GL@5$42Iu0|FH#AKf4X-H3Z2#>|XjBrW0662Tq0P2XI%W!c&fD z8K;y<$FzSv$cLA8l1~q?lDnj1rr+^k8W#TafryWXv@fj`)6-g^r}Cq1o?&#~VdRF; zzvy2a_R=4+Y}0)*yd+*O__EdpO|O-O;#ZCz#d!(eK0a;tCw^R)I)q%JnVn~VG#*&H z0ug7&PVJ4tE01l7QQWc?n;LREZnxPY?b^2yMqSjLGx|PlFEDQo=0ajdp*~l@7soCw zu$L%88gN&wh?$fwaiQZ^)|(}>8Is+W9#yG86pVHr5x>(O^Mh0SeT!d0g}{3)DYiQq zse?OwDvh1=R^LYHQz=q(9~--@$i4+!1?Z^d$nlE@XQi zGxK?0BgI5_asfY{5`(_6_CHeskcx}l)a zq@*h`MO)tAR@kvkhJ{2E;6#zCzS|8Q9?V5V_XKGom!2r{y?=-=@_*#B?= zpam=%j`3X`Q=T&^41t$695fpbYWwbKa0 z(^44QzP16KVb9K*IQ@NBB$NH=Z94|;O5am@V|et*9&t3?y<(YCcHItB4b!ZD``~32 zvvgx?*MCE(fI0=@p+V5M7I3dc+d3g#)cE%eS$pvVqnv77W``3;##`*Ii}!cDQ-Nn z*E2MXn{@3G=s2+TXYSw#{T0K}k|f)lo}Lb14ba+`WXw%LKE>ymp4#50$GQZjyh{M6 z_&%^bT;5;#TxQQ zKkdi>N;-Wuef4MLJ-)`X>1r&dH|R3MKa>VwQ0{9}F3chQS}b&e0_-)P3wYI$wipMlqK)(PwL1sgs(&l4I5PoZHCT*w7=8NxCW z2IeaU7wh5Jb<}ukp zDAb^h-IH{0u7unrA{t}LfM|_El18IOC@Hr7Tpf`l2N$_AZ(e}DV%`MrJy`a{Qg@K8 z_OLfG>`unJGl`JC>1b8ui{)#AC)!#t;?@i;)?>{R+^PP4={c0S^$=XNL-x}BBSUlP zgGy;*ZjAt(K|@(a<%>&1qnKCQ$(&c90m=tA9u(`5)i~WItr>fjFSKh?1R_eA8cLSy z`4)!H>sp+XFo(pTLDI1$lSmL!FJ3RG^cHvz4k%sXEqs5zjn$v-^X14q0SeOU3;=}rc=XHdjkEd^<8PR7j!5|TT^(4S;-^^i9^ zq#Xv*27I+~L7v}Nk{+a-ZInfiU!=dr7+;goWmMT)Mq1OCft(&$nf+cfOz++1D_Ivh z^e{iZrqT_XTfoQrv-FV5H8*ykWOTA8YCSNp@pQ}jT4)kf(o z{#lMlV$>$>Evh}AC+PZb82eE2Ej#*g>-90}9+n|twNwGlie|bxbk(VuNPL&j`hzYX zc2^w6$N{iu4i<-X2_yHon)D(m%BPhJMKsWMBG5+;ymy-vy;BVwn9V-6FT`%(>=~(2r+*XLU}+ zS`Z23?w{j8b=_=ejSiWtaQ;M+A#4@SrW~NNiWNDs$nX3VHvpSbN&giKy`Q~%PtM@h@L`f57clo?UI=V*_Eb-_Zzhf;!P6P|?lx(dKFx-yRjmIc ztx@l)zBYMxVqK)kZHY^#ylM_s9;IcfdP*B^uZ2a}CO$Zp)U}Q5zapDP+-)GZyJ=yp z(ob(3LS1HpYfV~AmZv}g*7!p($JoU3W? z;^^xjGKpJW_rHq^I5I8;61$T6 z&+CU~cFkdap;vmdySnrr-{Ri8)Nnf7n%rd<9@(Z;JAwHI%&8+h4*Gh3C1}Gj6coZh z8Ww$-pc|k=YIn3tOjHO!O+tS+z>TB#VD)*|rsvAi=x;=aY7IQNp{68Bves(u1PWIr z9m{69yw^f~;;2bG`&b{rk?7y~;YgCO|Ao@kl-LdXF#4U3$}0_$-eYJ7nf<&$RHDFj zE0GF1wuwYF77tir<`c z$$byfX(eS#FS@Z~ei;XQ(zjAE6J8)D^}P46Rc+cRJcpy{A3K@sEWPQ!oYDa~`_bq8 zD}>eO!C@(4JaMS7s~G(PvDJJj25IRJ5YqRei>SbI<$WaPy?2c{inb-NAmRh4~w#) zpbNl6U?c@h@CgfiXz}=CBt*-AU#A0i{FAO9R#sT7C2OcB_qpx1%&w1eS8BZFQ%Mi~ zEcKCLCo zgWrnW3`rhiwu)qAH6mrx_Ac8=gWeWllS(vmvU8Nh+){ItEwFq8DW~VhRsaDpSiz?$ zRjCiIQv3#Cw%bCL%xx`ruXkuLlUNj5PdHZ@Zc?^<0UW@CWk#c$SJ&B5Z!47-eo(*L zr*mHnt@tK3by_mM-{nNikAB2u5N<90e4@hh{)nP)Zvg|{>=G4tZ})a;6jp;~wkw)& zQa6Gq45Q}RhgZB{Ady)fuvL;ThUIk7%qH_u1<8?v8`mghQSmpbcNu3>$hUx~+g(ic zTW`{v0IaSVxP#}0EjylVhc0-|b?Ik0^Wv9DwSNA7`_A^Z4M`3ii~9+roZNaATbt3K_nOlqJa_b}jvWepjB8 zm&7fX2vpatjn{edHtqdtH7U$q`Wi8jWGYQR3ye^^-DaU)6AkUhyqnq@N1WS1~xDc`{S(Sw%w9P{7bh zS9D*qOi($%jn}j*aT@){mVcSC;Ty_&K5@qSmr%|?YA$o#Ml9{OL`w3K!rOdTWKH+F z>LADpDvP%?#Ve&b6je6drc7?zwwir)KMGnK{gLM1u(j7~U5f4($iwgL6liR6?%_S9 z(l>e&j`qvdbiT}sz#~^OSZ@;(i%j8k`E{q9MsMJHKI%R@yNG^zu8Z}0fgs|Zc74=@Z14usGTd< z2YXD2jZ`#pn?DPzk#ZZHuk)8@o%{_r#LlkZ8$7WzUcNQyvR-FC(x1;Ufq>m#KqXIT z++WJvd*0XQh?6~88`p6vl0I6QnPhMJTpio?i~G{0(0E)&^jyQIP=jFEV&Uh;Rd@dI zrJaanhL=9;+VmP#G+R~rIk?0vTfDzC9Y3R8aH^!KT$L$fN5U^VoOZCRig&-0rtHfJ zSuu>vWO#f!#O?1@j+H1p4tWy5x#8uYD0lMg3kwrqj3cyBE?QyQsC#Q+JDQ@a`;sxE zH7dpGkF!^_>^`eHI1` zK|o}o&3=DE7*-A``yM5v_mpoO;QIKRB6unFkDR|CQbOl-*?jz*a9eih^)CxyGFP&P zf{JIh4wqBaqO7XJqO5at>=fgn)hC9scPz3_>qGgeqoRuQMe5QTS;qasDpgnB-s+dZ zSj@Rw*d6R)3Sf+G+X*Rt%qc@+rjC32N8yAD)#_2B3>M-v-u^@y{`0Y7h5+?-+SwAg zr^+7B@s*qb-w;i+!T}p>)O^RR#IMLFlJE)*oS8rK5eN1Ug@6t^w;Xnw4`87s1}j=A z+Indxw5*-e(P_i-M>h4%e54r!F~H1+(12uHZYb-FIQuQL9J&L}-iY$!sylPY$8~z7 zHQ6}7LtDF(BafWYso+iby+`K!mJB-}4Zn`lk4?e5++G^BnOF&aRZ}%N;RcfhSzLn6 z$C=}UHax1CeP%8q1h8iECtF1P$|C(^00bHYCeJ6x1hfPo2j&l$UnjIslW%R)SedB) z{CzpW_r_dIpR-@rl$T`eoger^5%jjh;i9mkkzCk=E?bE6Ks}CK@vE|_^4&riq`nGY zYT9inW_l~e8!2&7YwsK_??SyR7wfnCjy+DxcZQC9{Z1bDm8hYInn%%6hGn3z9gUQZ z`^(lO{B{}8=hBUlQGuYYwcnqi({$(95Qxtb*igg39wTU&fg)YVZGe5b)5IP$C(Xm<5K2cBBAw_{ z;Qzzz)$Ue~Pa#j=d3m%mK*!s4;wd~dTC~~P*Ol9z^1YCWwLq(M(by1*p$Vee&KAu}6V>O2 zT;;AWRIKG&%6xBZU+<{EY^`J>4eoAb`>)9+k??%ShNyL+g=I{?o6|;Kk&TC%(VEg~ zTV9mU9ojrTDt6ifc1S|{F&--c=dR*H9EqPsZ+Ml)r`l80n|qgX9^Zv}NaGXlBFYtl zjfmKfC*{9BBQxRx`>vLVppV{6*_rbR zIU&CCW7Q4;j`i4+t$Y@XzXcZp$ETW~O|WMxR{13~ba&{&x*bg2J{6%xP+GOKA6T z-SxF>UpbRUCxvz_L7Tkr(ZxZ=HtR?(ioZPv(u9{vw=Sk;|4a8T(aiGk+LpE_RHX2F zmT4zp-f*hVdxtM~h*=MKAFlVyOc=6ZqZCpqmi<#l(V55GJ8s{1KRrd1IV$Yy5A3Ou zN_=b=0+^TcVCcQS)X1&dU_s@&yojb>!6H%l50+kg6&TeR>2#WtbqZi|1U_ettUE4O z#`=hs75PG6oB6m5uIdc*+RF}+ku;RB@-6wCvqk`x_!p-V4f4cM49At32a9QJ+D3G` zhG3Ris&-zomSXLg4Fp?`F}pq{{_14r+N;beT$n)j=U?!mMmHm6<~y0a{ZvN7P(C%1 z_YhA{Qe4b@-l9O&`8RdWJJLCy0Ei4os7lZz{C)XLdOzkvBuCd=%|?aeE%i()lLt4& zA*>_wWu0~@>I?21H7P~+Z<&!c7*?A^8mmLQc*n5@R!JUjENJEbDA33uQ_BpNvjto#+Zt-X{O{ ztqz3`i_f8<1>*U43YZv+t_#z~-}XJxE~ZD$-N(sEubi~FUd=&2IHp3wqqAhoN#=BN;I&*JWk~4u_G1aW1$oAlbvLO5eLrPof*{~ zNTr|p;lpwc=H`ewCH{Exkez5^`RF7_vC4*IjbPk=0)#{WYLEoXb@d*r7s9A<-4{=X z)}saQZ6Bb|rZQIJ&G2>*^O^vF{Q`qMc%vPhaP{yYG5SG`rTWXfpLeD24StWte$m}a z*pwpKW({-nRO&J+?1yHUvtNmP2Ljzlf2{P-!2d__mX{^%G9Q!4E;ni}yP}AT!!<38 z{K(xR_&*&*_jtj_|G|uhk})4o)3t2>6$XOc%yy(FTNCIKf0GIIrr8}jMw#px$Vyq) z(P3zGC!I3h5wghM3`fL!wmbTmc3In++{nm2%2VHZA6nygD!~xFOf%lcsKxz9rkGg0 zRJH%oc6dgz+I?j00oVgTc!1|~F2u0-b zfxeNe-5oI_tn6Fs@sr;C`asI?;^23YGVT0SW4z4Tm(I*}9ytGJ+fwLUUF>T`6}C*| z(_ovnX$^iUTG5rJXt5 zt0u7Px?u`CfT=fVjFz+2)_;B!zrLj9?iqg<4S)hAtdBH)<^13api8RPzsXUM8}OOb zb|*O(k`aDIH4vw~7;hfT+O)Ggc_8R}xN>)YB-l6UuxAimXG_8_qEs)NNOc)}Q6a!a zZ4=LvcMZ^|%qB^v`t6N3P&Jg+Nge*d%Dr2lO~CWDEM}r6JvUJumi~mkJ#c2h0lO_oEr3Wbo}-qzG3R&^Sj`D}z6Fu;XOk-?A}fXv)j>v{E^<6LL;Q zpU>2{6OBzw9@o{^i*x7rYMdm+q#c#+FW81~MS8a5A~$+a@N#&A-^r%@VT*0oxeVs~ zH4s?t^)(q8ndHe=Z7e3vIY97c(%(l5styZYas@Om|I*S>!x~PHaEI8yklitXs+6L_3C`7bOBwUmffL;{%P$s{1{(`Y*lQnb~)xtMq#ql zJtWu-s?DOnyo_m?c{{Hw_m?00JEH{HJ*nL-ZD1{L_S^*~>JXC!z&YY>YAmcq)=pb* zrD>gcC+E71-x!(y<2_`5PE!80nE$Yq#+tQXuaeaismTrFo|H$i1KUX%@={56q~8LN zEIeo?u0Ar8D^n1TiYr5u`sRC<`f`&v68KdE@-^;hSR}v-)J?L#fW%|(H7z=Ma(_;F z8Zs>Xl3JR!d*a%J@wy=Hd)0dz%lZpo!A0@BtZ+i(FYtN3f0<>@{$(-m(B2|d%pC?R z#y~HvvqoCUTGPpqXT!+RbWs~0tY{jp4jvuWzx#!HpfYh$doaAP?R^mhV@kfd*)WoO zT>qkT@Va?GR6$#wAi5|mzmsNG*}}hLsOy6hHuTWxzOhd5xZsK_&rAho8D35F9UsaZ z@-bqQFYC=1NAoqG*2db{5m46)2A_4ZNC#&NN9q79h@@64& zpRW3fW4Wj>+EUs4w#iML5(PjYMj;E+0d1Trk~(SLAdY=AJqvZvPD#(*c1e}VU2hvA91gujHwCpspur%YZKfeVRuO9#Jv3nvexG6dw2jC1 z`F?2a7yR3eCE(3t zMtQ23{PCFEODO&HDExXAPK+z?WLbC@DY7mvguXDCCA+XQ`FQ6*65i!tsv42F@tyS& z!fn1Hi_s;>i_{5#Zpl^1EphvvTh($swhsxc-82a}Z#s@_SVIQ-t>N+L#eY-$3Ju(= z!C^Ww?z*zgt)vIfe_wF5;QX0OQ>^4YQ$+TNk&dOlM~_UR;r9+5>2RViL!fVPWp7HB z+2Cb&hMj;y#(sX~0Jx4Nd_hG;pY4OuJ9o!K!I(|E@&*;$%*IS58#Tn)PE*OdBGEvN zX=f(C8EPt#uk6Cg?oKAdO67}|f%|JUFX(eBj;QHFm zgg@e8ir`DL@|{G2&j|cBOgA5f6Bm}J&0yqVZ%XGuKQZbqUE|vpf72Ap>F6VQ>T}^Q zJ+I@t@Q#}RSB2)k2VHnRI6q(umGe;}tC5@!^zHSndR3`byZ}f_1Q-9v*y3f8pMR|= zH*5w~ET)hPj%d)%erxyid)OD#SN@AW_;s*5jF9LN^eisjbUN?rbe6~-U?TT~A$UhbJ^Xv2)H&If+R!r4?kSM-LH0~s9iq`c!gnJs%S^@EEr|`(g zrQ&AR^+S-JYAn4x@wCVn!+5xU?(Zru1J+37l0lXpce6U3)ePPBU&~;MErVdTz15jP z9+=Y<2Y3(Bm+e@M*(unyKRg!c9PJ!K-@L4x;U+ZT!@wE?aGKWYsrs;ru#(0TF(1-vXcxm`ZydyrLQj^M!7Y>df8>7VEjUs)&Z0N?Xi8z*-H&hRj2)F zz1~$7MORlmYG|FAs-x<}`+C`1W9eo^f{icdV$EKXTTb!MnOtkQy&CRotXunZllkzM zL1xuf@2_B*S;bp`w!!?AsbHg5ItG2bly=8MsiXh(*~wuQAub#J0d(Q|w+VQPLTg*1 z#_dM0FMtgEt91;vqGp|rA&##})`zW$dvb3sS=*=0RFhgalWeT^fYiEC(|-g*mqlf0 zs!g0+(FU3)V>)m5&y;+WY>I2R;0toNZ7_)VY+RJHQ|+mu>M9RjrFGf07I5xhL_HKmV%c9?j{FG>CDGZ39&Qx%sey60a3=L zS9PU$!)@?I(u0?6@2KUzpl=YTbk1&AtHxd@%pAn{CV91Z`WfLFATm*)3$Y4GE8y)I zp50qkULG7xe$h}?d7%+w+WyjkMQ*V?afT#@eT9Jhij5ZR!;|iTMVSlcMIaqq6^;Xj za}BcP(z$5O?Jn7H8O&<%szhuEHDguYuEdd#A^!6 z--S(9ZafO8uT0)Mv;a!?{I^Q{+NTcpCao;|y1>D1xkQt-B3={JEw`}uvt?M!C$0uJy9tPx_&+Q5i z@_y#?j!vw!^cS1tOGKorN2a}5v0wO6c8z3haih-3=Fw;=1Hp&0=?X6;unqgl2O8~* z?zLat2TCr3_ZU`AO*#p0laCUDGPQf{CUqYc2!RcGJ2E#I|S;51qt zW=-PT2h~rz9VV}o`-evzImZhxyLgo&vLdJ)OyUh2ib+vn z;yd-LYAgrLml$5x`>Wu2%h6%=G**_Ir}SElsl^wumMP=tt>aX_GQXL|8?WV$pTDm1 zJFp$^bMWiIX=RCW5HDoOhC3wUmM$t3j?CvdwN$s5l&2)8Qjfm2EUx+C5aY_YjxZ%i z72^t5_Z&KDtPq0>b@2#;t~rcl{<%!X@wJD?6502|ORQ>8Z~vYocn`V`PK6Y!*8c=H2v0ONk89a)pUAU-rIM)vjS*O9Qe|Mgbl;p<<-} z14e4ll}W(VUvkNoqpjKynf72;3OFIJe8i#eSsHDbl!eFBD7Yz0c%oZ6@7PT1wcfsX zc6d`N!jA`QsiRwEuVq%S;Y-X5yLGn3r8wqa_pYoek(tt#eZaKPE6QONOf*+- z>JwgiQE&BLyfY8>6T}kjdj)D(P!dDJp@AQTubzcnMw0zI>!;% z;4=$XT%mJ!bxdz0qB4Dy>ki*8>4e*>yni0u z+Wch1Iz<=>?y2>W+Zjuj_IEyCk^pLBT+u4XW&&LOKQ2G>iyISt4_a<(=jG)MOpiUh zHUDY+hlbxe?LR055V_p_vxv0RPW4{RJ$^;#9~p^9Qmrs%8ST7j<(A*(>llieulF{* z@t?<^|Ii5jK-JfB?Odw^Bp^IU2VjZwOY-~IKK?_j{PXKyEQ<@BFjj0DoY?w@HMt4j ztK(&xllDqHTmHJ=EdY)w0CE<HNvRLe_xvJ1F+=;ydqwRWttO z=E0O{m*dlfx|k<_=`N=38vlMUDoVX#hBpTkHE8-*yI4n*hgzSb9DtR4wi&KUj>fsbP(HQM;oVRoGUOizHKp2>&A$dI(_l zkVLPz=Bw5HeBMuWZXNQY(u@o?j`0uUhRf^xd&!+Py&n{|g@=Aqdye&fkiS)Qk%S+o zm1FLaliZv5V2^QD4%lsCi3gJ~Bm;;8s{L7qTt#ymxa%Uky1K;>F*M^mSESEtR*Jp*VN(DGNe9;*Vz!IUp%pr>N9!b8X_1A5H3a_qiXrAJe5Wz#VFy)h^nPg{qNW&Hh z0D(a}8ETlX>R%C1v9&vU!V@JL;8ZF++`}wH5|9e8qmb|LRW*3;0OeFwc6Ux|*}u!^ zNHk>*X5V@BADqv^fWLL?Z2NLrUv(0|^V#ZzU;&?NrTx=9^V_Y*5Ma|833fN(x#1EM zX!>U_PMY=<@)8+UhqQ#00k{#Mrsh0(UE|tVRi_e5yRj)@NQ`0nn!;GhW>jBa4LqK@;2^?ph;OF&-6Q9So^Zm#q4g2~~ zl>TQtCHa$-x6~r#)+c|t;sHS~=n$T0bVqd6wu9)X6rk+OP+?w%7D@Ey z|73s8K+w$E+)7DF@fv@5`t}mu6`)2;@Rc?S=E{~?k4-8iMx z{C&*`fBqA%3fZh(#u=~DjUiuH4WWjw!J~b^MyX!Nc!p7^3b$+TZ=;e03lx-&aSu7Y zzw-r;k$HYbGz@^T7jB(2!kviSnD6t4c@}(KdKPhW|52hd_W*Qn zp5Edg(*>B-)c>-NVz3Z4-*evOkZ`&?YB^KwX>iW5{*Ai$FaZnZT=7HtI*U<452>iB zxh;tkqkC&!|Ke?EtOD60;eZwR=kdQnLEsYLH_lDNc_P36kmlbuQ}djDIll>T=l_0` zq&rCJ-%p&s_OFNkf0yT+#rcc>2Y>uOkDllDuj2ggFI}#a))W>BAfnZ2NS~~Hnql~- zdaqu%;Qb7^RXQrvq$7Bq{jG}>tnB20V=W5)zzF_->HnS@nEil110$p)?n<5IpD*+S OJyzCMDtcrU_`d*c#Da?e diff --git a/release-0.20.0/docs/pod-states.md b/release-0.20.0/docs/pod-states.md deleted file mode 100644 index 090d5c2c91a..00000000000 --- a/release-0.20.0/docs/pod-states.md +++ /dev/null @@ -1,111 +0,0 @@ -# The life of a pod - -Updated: 4/14/2015 - -This document covers the lifecycle of a pod. It is not an exhaustive document, but an introduction to the topic. - -## Pod Phase - -As consistent with the overall [API convention](api-conventions.md#typical-status-properties), phase is a simple, high-level summary of the phase of the lifecycle of a pod. It is not intended to be a comprehensive rollup of observations of container-level or even pod-level conditions or other state, nor is it intended to be a comprehensive state machine. - -The number and meanings of `PodPhase` values are tightly guarded. Other than what is documented here, nothing should be assumed about pods with a given `PodPhase`. - -* Pending: The pod has been accepted by the system, but one or more of the container images has not been created. This includes time before being scheduled as well as time spent downloading images over the network, which could take a while. -* Running: The pod has been bound to a node, and all of the containers have been created. At least one container is still running, or is in the process of starting or restarting. -* Succeeded: All containers in the pod have terminated in success, and will not be restarted. -* Failed: All containers in the pod have terminated, at least one container has terminated in failure (exited with non-zero exit status or was terminated by the system). - -## Pod Conditions - -A pod containing containers that specify readiness probes will also report the Ready condition. Condition status values may be `True`, `False`, or `Unknown`. - -## Container Probes - -A [Probe](https://godoc.org/github.com/GoogleCloudPlatform/kubernetes/pkg/api/v1#Probe) is a diagnostic performed periodically by the kubelet on a container. Specifically the diagnostic is one of three [Handlers](https://godoc.org/github.com/GoogleCloudPlatform/kubernetes/pkg/api/v1#Handler): - -* `ExecAction`: executes a specified command inside the container expecting on success that the command exits with status code 0. -* `TCPSocketAction`: performs a tcp check against the container's IP address on a specified port expecting on success that the port is open. -* `HTTPGetAction`: performs an HTTP Get againsts the container's IP address on a specified port and path expecting on success that the response has a status code greater than or equal to 200 and less than 400. - -Each probe will have one of three results: - -* `Success`: indicates that the container passed the diagnostic. -* `Failure`: indicates that the container failed the diagnostic. -* `Unknown`: indicates that the diagnostic failed so no action should be taken. - -Currently, the kubelet optionally performs two independent diagnostics on running containers which trigger action: - -* `LivenessProbe`: indicates whether the container is *live*, i.e. still running. The LivenessProbe hints to the kubelet when a container is unhealthy. If the LivenessProbe fails, the kubelet will kill the container and the container will be subjected to it's [RestartPolicy](#restartpolicy). The default state of Liveness before the initial delay is `Success`. The state of Liveness for a container when no probe is provided is assumed to be `Success`. -* `ReadinessProbe`: indicates whether the container is *ready* to service requests. If the ReadinessProbe fails, the endpoints controller will remove the pod's IP address from the endpoints of all services that match the pod. Thus, the ReadinessProbe is sometimes useful to signal to the endpoints controller that even though a pod may be running, it should not receive traffic from the proxy (e.g. the container has a long startup time before it starts listening or the container is down for maintenance). The default state of Readiness before the initial delay is `Failure`. The state of Readiness for a container when no probe is provided is assumed to be `Success`. - -## Container Statuses - -More detailed information about the current (and previous) container statuses can be found in [ContainerStatuses](https://godoc.org/github.com/GoogleCloudPlatform/kubernetes/pkg/api/v1#PodStatus). The information reported depends on the current [ContainerState](https://godoc.org/github.com/GoogleCloudPlatform/kubernetes/pkg/api/v1#ContainerState), which may be Waiting, Running, or Terminated. - -## RestartPolicy - -The possible values for RestartPolicy are `Always`, `OnFailure`, or `Never`. If RestartPolicy is not set, the default value is `Always`. RestartPolicy applies to all containers in the pod. RestartPolicy only refers to restarts of the containers by the Kubelet on the same node. As discussed in the [pods document](pods.md#durability-of-pods-or-lack-thereof), once bound to a node, a pod will never be rebound to another node. This means that some kind of controller is necessary in order for a pod to survive node failure, even if just a single pod at a time is desired. - -The only controller we have today is [`ReplicationController`](replication-controller.md). `ReplicationController` is *only* appropriate for pods with `RestartPolicy = Always`. `ReplicationController` should refuse to instantiate any pod that has a different restart policy. - -There is a legitimate need for a controller which keeps pods with other policies alive. Pods having any of the other policies (`OnFailure` or `Never`) eventually terminate, at which point the controller should stop recreating them. Because of this fundamental distinction, let's hypothesize a new controller, called [`JobController`](https://github.com/GoogleCloudPlatform/kubernetes/issues/1624) for the sake of this document, which can implement this policy. - -## Pod lifetime - -In general, pods which are created do not disappear until someone destroys them. This might be a human or a `ReplicationController`. The only exception to this rule is that pods with a `PodPhase` of `Succeeded` or `Failed` for more than some duration (determined by the master) will expire and be automatically reaped. - -If a node dies or is disconnected from the rest of the cluster, some entity within the system (call it the NodeController for now) is responsible for applying policy (e.g. a timeout) and marking any pods on the lost node as `Failed`. - -## Examples - - * Pod is `Running`, 1 container, container exits success - * Log completion event - * If RestartPolicy is: - * Always: restart container, pod stays `Running` - * OnFailure: pod becomes `Succeeded` - * Never: pod becomes `Succeeded` - - * Pod is `Running`, 1 container, container exits failure - * Log failure event - * If RestartPolicy is: - * Always: restart container, pod stays `Running` - * OnFailure: restart container, pod stays `Running` - * Never: pod becomes `Failed` - - * Pod is `Running`, 2 containers, container 1 exits failure - * Log failure event - * If RestartPolicy is: - * Always: restart container, pod stays `Running` - * OnFailure: restart container, pod stays `Running` - * Never: pod stays `Running` - * When container 2 exits... - * Log failure event - * If RestartPolicy is: - * Always: restart container, pod stays `Running` - * OnFailure: restart container, pod stays `Running` - * Never: pod becomes `Failed` - - * Pod is `Running`, container becomes OOM - * Container terminates in failure - * Log OOM event - * If RestartPolicy is: - * Always: restart container, pod stays `Running` - * OnFailure: restart container, pod stays `Running` - * Never: log failure event, pod becomes `Failed` - - * Pod is `Running`, a disk dies - * All containers are killed - * Log appropriate event - * Pod becomes `Failed` - * If running under a controller, pod will be recreated elsewhere - - * Pod is `Running`, its node is segmented out - * NodeController waits for timeout - * NodeController marks pod `Failed` - * If running under a controller, pod will be recreated elsewhere - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/pod-states.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/pod-states.md?pixel)]() diff --git a/release-0.20.0/docs/pods.md b/release-0.20.0/docs/pods.md deleted file mode 100644 index 5fbe12f0790..00000000000 --- a/release-0.20.0/docs/pods.md +++ /dev/null @@ -1,85 +0,0 @@ -# Pods - -In Kubernetes, rather than individual application containers, _pods_ are the smallest deployable units that can be created, scheduled, and managed. - -## What is a _pod_? - -A _pod_ (as in a pod of whales or pea pod) corresponds to a colocated group of applications running with a shared context. Within that context, the applications may also have individual cgroup isolations applied. A pod models an application-specific "logical host" in a containerized environment. It may contain one or more applications which are relatively tightly coupled — in a pre-container world, they would have executed on the same physical or virtual host. - -The context of the pod can be defined as the conjunction of several Linux namespaces: - -* PID namespace (applications within the pod can see each other's processes) -* network namespace (applications within the pod have access to the same IP and port space) -* IPC namespace (applications within the pod can use SystemV IPC or POSIX message queues to communicate) -* UTS namespace (applications within the pod share a hostname) - -Applications within a pod also have access to shared volumes, which are defined at the pod level and made available in each application's filesystem. Additionally, a pod may define top-level cgroup isolations which form an outer bound to any individual isolation applied to constituent applications. - -In terms of [Docker](https://www.docker.com/) constructs, a pod consists of a colocated group of Docker containers with shared [volumes](volumes.md). PID namespace sharing is not yet implemented with Docker. - -Like individual application containers, pods are considered to be relatively ephemeral rather than durable entities. As discussed in [life of a pod](pod-states.md), pods are scheduled to nodes and remain there until termination (according to restart policy) or deletion. When a node dies, the pods scheduled to that node are deleted. Specific pods are never rescheduled to new nodes; instead, they must be replaced (see [replication controller](replication-controller.md) for more details). (In the future, a higher-level API may support pod migration.) - -## Motivation for pods - -### Resource sharing and communication - -Pods facilitate data sharing and communication among their constituents. - -The applications in the pod all use the same network namespace/IP and port space, and can find and communicate with each other using localhost. Each pod has an IP address in a flat shared networking namespace that has full communication with other physical computers and containers across the network. The hostname is set to the pod's Name for the application containers within the pod. [More details on networking](networking.md). - -In addition to defining the application containers that run in the pod, the pod specifies a set of shared storage volumes. Volumes enable data to survive container restarts and to be shared among the applications within the pod. - -### Management - -Pods also simplify application deployment and management by providing a higher-level abstraction than the raw, low-level container interface. Pods serve as units of deployment and horizontal scaling/replication. Co-location (co-scheduling), fate sharing, coordinated replication, resource sharing, and dependency management are handled automatically. - -## Uses of pods - -Pods can be used to host vertically integrated application stacks, but their primary motivation is to support co-located, co-managed helper programs, such as: - -* content management systems, file and data loaders, local cache managers, etc. -* log and checkpoint backup, compression, rotation, snapshotting, etc. -* data change watchers, log tailers, logging and monitoring adapters, event publishers, etc. -* proxies, bridges, and adapters -* controllers, managers, configurators, and updaters - -Individual pods are not intended to run multiple instances of the same application, in general. - -## Alternatives considered - -_Why not just run multiple programs in a single (Docker) container?_ - -1. Transparency. Making the containers within the pod visible to the infrastructure enables the infrastructure to provide services to those containers, such as process management and resource monitoring. This facilitates a number of conveniences for users. -2. Decoupling software dependencies. The individual containers may be rebuilt and redeployed independently. Kubernetes may even support live updates of individual containers someday. -3. Ease of use. Users don't need to run their own process managers, worry about signal and exit-code propagation, etc. -4. Efficiency. Because the infrastructure takes on more responsibility, containers can be lighter weight. - -_Why not support affinity-based co-scheduling of containers?_ - -That approach would provide co-location, but would not provide most of the benefits of pods, such as resource sharing, IPC, guaranteed fate sharing, and simplified management. - -## Durability of pods (or lack thereof) - -Pods aren't intended to be treated as durable [pets](https://blog.engineyard.com/2014/pets-vs-cattle). They won't survive scheduling failures, node failures, or other evictions, such as due to lack of resources, or in the case of node maintenance. - -In general, users shouldn't need to create pods directly. They should almost always use controllers (e.g., [replication controller](replication-controller.md)), even for singletons. Controllers provide self-healing with a cluster scope, as well as replication and rollout management. - -The use of collective APIs as the primary user-facing primitive is relatively common among cluster scheduling systems, including [Borg](https://research.google.com/pubs/pub43438.html), [Marathon](https://mesosphere.github.io/marathon/docs/rest-api.html), [Aurora](http://aurora.apache.org/documentation/latest/configuration-reference/#job-schema), and [Tupperware](http://www.slideshare.net/Docker/aravindnarayanan-facebook140613153626phpapp02-37588997). - -Pod is exposed as a primitive in order to facilitate: - -* scheduler and controller pluggability -* support for pod-level operations without the need to "proxy" them via controller APIs -* decoupling of pod lifetime from controller lifetime, such as for bootstrapping -* decoupling of controllers and services — the endpoint controller just watches pods -* clean composition of Kubelet-level functionality with cluster-level functionality — Kubelet is effectively the "pod controller" -* high-availability applications, which will expect pods to be replaced in advance of their termination and certainly in advance of deletion, such as in the case of planned evictions, image prefetching, or live pod migration [#3949](https://github.com/GoogleCloudPlatform/kubernetes/issues/3949) - -The current best practice for pets is to create a replication controller with `replicas` equal to `1` and a corresponding service. If you find this cumbersome, please comment on [issue #260](https://github.com/GoogleCloudPlatform/kubernetes/issues/260). - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/pods.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/pods.md?pixel)]() diff --git a/release-0.20.0/docs/proposals/autoscaling.md b/release-0.20.0/docs/proposals/autoscaling.md deleted file mode 100644 index 501ada1e99b..00000000000 --- a/release-0.20.0/docs/proposals/autoscaling.md +++ /dev/null @@ -1,260 +0,0 @@ -## Abstract -Auto-scaling is a data-driven feature that allows users to increase or decrease capacity as needed by controlling the -number of pods deployed within the system automatically. - -## Motivation - -Applications experience peaks and valleys in usage. In order to respond to increases and decreases in load, administrators -scale their applications by adding computing resources. In the cloud computing environment this can be -done automatically based on statistical analysis and thresholds. - -### Goals - -* Provide a concrete proposal for implementing auto-scaling pods within Kubernetes -* Implementation proposal should be in line with current discussions in existing issues: - * Scale verb - [1629](https://github.com/GoogleCloudPlatform/kubernetes/issues/1629) - * Config conflicts - [Config](https://github.com/GoogleCloudPlatform/kubernetes/blob/c7cb991987193d4ca33544137a5cb7d0292cf7df/docs/config.md#automated-re-configuration-processes) - * Rolling updates - [1353](https://github.com/GoogleCloudPlatform/kubernetes/issues/1353) - * Multiple scalable types - [1624](https://github.com/GoogleCloudPlatform/kubernetes/issues/1624) - -## Constraints and Assumptions - -* This proposal is for horizontal scaling only. Vertical scaling will be handled in [issue 2072](https://github.com/GoogleCloudPlatform/kubernetes/issues/2072) -* `ReplicationControllers` will not know about the auto-scaler, they are the target of the auto-scaler. The `ReplicationController` responsibilities are -constrained to only ensuring that the desired number of pods are operational per the [Replication Controller Design](http://docs.k8s.io/replication-controller.md#responsibilities-of-the-replication-controller) -* Auto-scalers will be loosely coupled with data gathering components in order to allow a wide variety of input sources -* Auto-scalable resources will support a scale verb ([1629](https://github.com/GoogleCloudPlatform/kubernetes/issues/1629)) -such that the auto-scaler does not directly manipulate the underlying resource. -* Initially, most thresholds will be set by application administrators. It should be possible for an autoscaler to be -written later that sets thresholds automatically based on past behavior (CPU used vs incoming requests). -* The auto-scaler must be aware of user defined actions so it does not override them unintentionally (for instance someone -explicitly setting the replica count to 0 should mean that the auto-scaler does not try to scale the application up) -* It should be possible to write and deploy a custom auto-scaler without modifying existing auto-scalers -* Auto-scalers must be able to monitor multiple replication controllers while only targeting a single scalable -object (for now a ReplicationController, but in the future it could be a job or any resource that implements scale) - -## Use Cases - -### Scaling based on traffic - -The current, most obvious, use case is scaling an application based on network traffic like requests per second. Most -applications will expose one or more network endpoints for clients to connect to. Many of those endpoints will be load -balanced or situated behind a proxy - the data from those proxies and load balancers can be used to estimate client to -server traffic for applications. This is the primary, but not sole, source of data for making decisions. - -Within Kubernetes a [kube proxy](http://docs.k8s.io/services.md#ips-and-vips) -running on each node directs service requests to the underlying implementation. - -While the proxy provides internal inter-pod connections, there will be L3 and L7 proxies and load balancers that manage -traffic to backends. OpenShift, for instance, adds a "route" resource for defining external to internal traffic flow. -The "routers" are HAProxy or Apache load balancers that aggregate many different services and pods and can serve as a -data source for the number of backends. - -### Scaling based on predictive analysis - -Scaling may also occur based on predictions of system state like anticipated load, historical data, etc. Hand in hand -with scaling based on traffic, predictive analysis may be used to determine anticipated system load and scale the application automatically. - -### Scaling based on arbitrary data - -Administrators may wish to scale the application based on any number of arbitrary data points such as job execution time or -duration of active sessions. There are any number of reasons an administrator may wish to increase or decrease capacity which -means the auto-scaler must be a configurable, extensible component. - -## Specification - -In order to facilitate talking about auto-scaling the following definitions are used: - -* `ReplicationController` - the first building block of auto scaling. Pods are deployed and scaled by a `ReplicationController`. -* kube proxy - The proxy handles internal inter-pod traffic, an example of a data source to drive an auto-scaler -* L3/L7 proxies - A routing layer handling outside to inside traffic requests, an example of a data source to drive an auto-scaler -* auto-scaler - scales replicas up and down by using the `scale` endpoint provided by scalable resources (`ReplicationController`) - - -### Auto-Scaler - -The Auto-Scaler is a state reconciler responsible for checking data against configured scaling thresholds -and calling the `scale` endpoint to change the number of replicas. The scaler will -use a client/cache implementation to receive watch data from the data aggregators and respond to them by -scaling the application. Auto-scalers are created and defined like other resources via REST endpoints and belong to the -namespace just as a `ReplicationController` or `Service`. - -Since an auto-scaler is a durable object it is best represented as a resource. - -```go - //The auto scaler interface - type AutoScalerInterface interface { - //ScaleApplication adjusts a resource's replica count. Calls scale endpoint. - //Args to this are based on what the endpoint - //can support. See https://github.com/GoogleCloudPlatform/kubernetes/issues/1629 - ScaleApplication(num int) error - } - - type AutoScaler struct { - //common construct - TypeMeta - //common construct - ObjectMeta - - //Spec defines the configuration options that drive the behavior for this auto-scaler - Spec AutoScalerSpec - - //Status defines the current status of this auto-scaler. - Status AutoScalerStatus - } - - type AutoScalerSpec struct { - //AutoScaleThresholds holds a collection of AutoScaleThresholds that drive the auto scaler - AutoScaleThresholds []AutoScaleThreshold - - //Enabled turns auto scaling on or off - Enabled boolean - - //MaxAutoScaleCount defines the max replicas that the auto scaler can use. - //This value must be greater than 0 and >= MinAutoScaleCount - MaxAutoScaleCount int - - //MinAutoScaleCount defines the minimum number replicas that the auto scaler can reduce to, - //0 means that the application is allowed to idle - MinAutoScaleCount int - - //TargetSelector provides the scalable target(s). Right now this is a ReplicationController - //in the future it could be a job or any resource that implements scale. - TargetSelector map[string]string - - //MonitorSelector defines a set of capacity that the auto-scaler is monitoring - //(replication controllers). Monitored objects are used by thresholds to examine - //statistics. Example: get statistic X for object Y to see if threshold is passed - MonitorSelector map[string]string - } - - type AutoScalerStatus struct { - // TODO: open for discussion on what meaningful information can be reported in the status - // The status may return the replica count here but we may want more information - // such as if the count reflects a threshold being passed - } - - - //AutoScaleThresholdInterface abstracts the data analysis from the auto-scaler - //example: scale by 1 (Increment) when RequestsPerSecond (Type) pass - //comparison (Comparison) of 50 (Value) for 30 seconds (Duration) - type AutoScaleThresholdInterface interface { - //called by the auto-scaler to determine if this threshold is met or not - ShouldScale() boolean - } - - - //AutoScaleThreshold is a single statistic used to drive the auto-scaler in scaling decisions - type AutoScaleThreshold struct { - // Type is the type of threshold being used, intention or value - Type AutoScaleThresholdType - - // ValueConfig holds the config for value based thresholds - ValueConfig AutoScaleValueThresholdConfig - - // IntentionConfig holds the config for intention based thresholds - IntentionConfig AutoScaleIntentionThresholdConfig - } - - // AutoScaleIntentionThresholdConfig holds configuration for intention based thresholds - // a intention based threshold defines no increment, the scaler will adjust by 1 accordingly - // and maintain once the intention is reached. Also, no selector is defined, the intention - // should dictate the selector used for statistics. Same for duration although we - // may want a configurable duration later so intentions are more customizable. - type AutoScaleIntentionThresholdConfig struct { - // Intent is the lexicon of what intention is requested - Intent AutoScaleIntentionType - - // Value is intention dependent in terms of above, below, equal and represents - // the value to check against - Value float - } - - // AutoScaleValueThresholdConfig holds configuration for value based thresholds - type AutoScaleValueThresholdConfig struct { - //Increment determines how the auot-scaler should scale up or down (positive number to - //scale up based on this threshold negative number to scale down by this threshold) - Increment int - //Selector represents the retrieval mechanism for a statistic value from statistics - //storage. Once statistics are better defined the retrieval mechanism may change. - //Ultimately, the selector returns a representation of a statistic that can be - //compared against the threshold value. - Selector map[string]string - //Duration is the time lapse after which this threshold is considered passed - Duration time.Duration - //Value is the number at which, after the duration is passed, this threshold is considered - //to be triggered - Value float - //Comparison component to be applied to the value. - Comparison string - } - - // AutoScaleThresholdType is either intention based or value based - type AutoScaleThresholdType string - - // AutoScaleIntentionType is a lexicon for intentions such as "cpu-utilization", - // "max-rps-per-endpoint" - type AutoScaleIntentionType string -``` - -#### Boundary Definitions -The `AutoScaleThreshold` definitions provide the boundaries for the auto-scaler. By defining comparisons that form a range -along with positive and negative increments you may define bi-directional scaling. For example the upper bound may be -specified as "when requests per second rise above 50 for 30 seconds scale the application up by 1" and a lower bound may -be specified as "when requests per second fall below 25 for 30 seconds scale the application down by 1 (implemented by using -1)". - -### Data Aggregator - -This section has intentionally been left empty. I will defer to folks who have more experience gathering and analyzing -time series statistics. - -Data aggregation is opaque to the the auto-scaler resource. The auto-scaler is configured to use `AutoScaleThresholds` -that know how to work with the underlying data in order to know if an application must be scaled up or down. Data aggregation -must feed a common data structure to ease the development of `AutoScaleThreshold`s but it does not matter to the -auto-scaler whether this occurs in a push or pull implementation, whether or not the data is stored at a granular level, -or what algorithm is used to determine the final statistics value. Ultimately, the auto-scaler only requires that a statistic -resolves to a value that can be checked against a configured threshold. - -Of note: If the statistics gathering mechanisms can be initialized with a registry other components storing statistics can -potentially piggyback on this registry. - -### Multi-target Scaling Policy -If multiple scalable targets satisfy the `TargetSelector` criteria the auto-scaler should be configurable as to which -target(s) are scaled. To begin with, if multiple targets are found the auto-scaler will scale the largest target up -or down as appropriate. In the future this may be more configurable. - -### Interactions with a deployment - -In a deployment it is likely that multiple replication controllers must be monitored. For instance, in a [rolling deployment](http://docs.k8s.io/replication-controller.md#rolling-updates) -there will be multiple replication controllers, with one scaling up and another scaling down. This means that an -auto-scaler must be aware of the entire set of capacity that backs a service so it does not fight with the deployer. `AutoScalerSpec.MonitorSelector` -is what provides this ability. By using a selector that spans the entire service the auto-scaler can monitor capacity -of multiple replication controllers and check that capacity against the `AutoScalerSpec.MaxAutoScaleCount` and -`AutoScalerSpec.MinAutoScaleCount` while still only targeting a specific set of `ReplicationController`s with `TargetSelector`. - -In the course of a deployment it is up to the deployment orchestration to decide how to manage the labels -on the replication controllers if it needs to ensure that only specific replication controllers are targeted by -the auto-scaler. By default, the auto-scaler will scale the largest replication controller that meets the target label -selector criteria. - -During deployment orchestration the auto-scaler may be making decisions to scale its target up or down. In order to prevent -the scaler from fighting with a deployment process that is scaling one replication controller up and scaling another one -down the deployment process must assume that the current replica count may be changed by objects other than itself and -account for this in the scale up or down process. Therefore, the deployment process may no longer target an exact number -of instances to be deployed. It must be satisfied that the replica count for the deployment meets or exceeds the number -of requested instances. - -Auto-scaling down in a deployment scenario is a special case. In order for the deployment to complete successfully the -deployment orchestration must ensure that the desired number of instances that are supposed to be deployed has been met. -If the auto-scaler is trying to scale the application down (due to no traffic, or other statistics) then the deployment -process and auto-scaler are fighting to increase and decrease the count of the targeted replication controller. In order -to prevent this, deployment orchestration should notify the auto-scaler that a deployment is occurring. This will -temporarily disable negative decrement thresholds until the deployment process is completed. It is more important for -an auto-scaler to be able to grow capacity during a deployment than to shrink the number of instances precisely. - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/proposals/autoscaling.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/proposals/autoscaling.md?pixel)]() diff --git a/release-0.20.0/docs/proposals/federation-high-level-arch.png b/release-0.20.0/docs/proposals/federation-high-level-arch.png deleted file mode 100644 index 8a416cc1e687aac784afb03edc6eac295f433a51..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 31793 zcmb^Y^;eYN_dbr#fD9c9(kTcA-OZqaASoc-jkMIzLyMG%(kUg<-QAti3=G{hbbf9g z@8@fM|AFsX@C&T_oPDmd_dYwW9jdJO9v_Di2LuA)%gVe{0fEp)fM04X2=JFh?*vs4 z$n!$>ounFUcDE5fKIN19K_hp9y!j7V@*iNdM-k-DgJhzEDQ#8*rKxyHI}8IN;zo0L zbGzOuW_;z>mqxC2ey}A_!4Xqld0aa}=5B&d8g&xS_*3QEH&X8-k|@|WvFW!@pK?Lr zxBH7cJE>abWvRD(*DEug_xDpS2IU)r^SU^vA560U|N2qs=hLk+LnywS zn{BCDonE)B|JBL`aglp2`&l`uuPXnW?U?PuUfM4WU8QCw!A)w(d;}hMrP*PCd(41o^qEcD{{@26jOy9 z+)$dcyToQuq|L-z`$W}z>_QVS;GPF(PMHb zLDcTp-h=Fvqbf^IM;DK;51BXMpSNnvx|P}vG02*7D|Q&CVv8EB?6)RG4qh*u7SjEs zz1Uz$vb%0Rx*f|ssL4GkRr0E;K=tLz9e7Pi#f;#a<`%h37HAC*rik3!|B_f-Vt(_k z>y%hd#Vb+4J1rvKy72-<&;sTb1eR9sX= zUuH@;ecbG{UOdbh$PBMO&tLTX{k=ptAAAj!IK1DkEEZuR$-41}$ECow|Gj$hg9$$Q z9|p$wQQ_fDA_Rl<)F!COz3k>1GlMB~CpM@878dPkW~4a(nc{t868XEVa5~_lSOB&w zT{%)V%0)3z?t_;BQcI54&*@(5E!15(!1NMI8V+aNi6; zo98EI;BG4QR_jy(GyxDo<=jf_>HXhv1I8NL%m_Ni2@bD-{2Smu|J_)fynxD)Jq)FT zQDs{(b#ryK;T7PS@-6-Uo%0K?I$-IsakjRGN&QvNjgo%v#bWUP)tRMUc+=@SUlxaB zGiPZk@)&>_IB-_ezaM3VujabS_Q>@drccAVqi&LEpo?i8H1Ceuus}H(cC(3yF~ESk+w3{`i#s2p31 zYZFu5{L}fh9Z^m<*lKjGQ^Du+9K*2oqI9w1y@Rv?C(Ep**BdnR2}w^ z9b7AJ#iU(-*=nEid1gXvt|)G@pp{LmC|p}%h%~A-)VtFk#=|4CVf!)jtGcKJ3E}QD|s{avOg5yYyg!U0Mrc zD@v|aItLBK&U*@;atDn!nb}T@bafrd(Rihv*XB_u#;w_ucYlgKz%F~s%5AWlEK#>ar?;x- zb2>X^mO&`swO)Mf!yZxJbQ&n zW(Zm4*imfVc4n^x?^}4z&XiBNamqY=wW1K$vk_O?kO>s!>I z5eyP=`}OvAnnheB^Lu#uf)eFNP=}1b7n?TwcI+co`3e~ZIy^NdYb*|i)^qVCX5*YV z7cpoO*OQ4aPf=!}N2)f?wr7|1O$qqqCHuHI{0kzK&Vc>%?x${V-yUC%jb^IunF$ay>gx0wV?>4S^Wc1K zyMcr1)?AsU`K+DCkEB+}H(5;$LXgo!B+Zjuuhl6ADym98oW;# zI|bS9pHDR*6^z7N21FDL8=#lUD}&KR-wq?5d{=ZqVWmF@pYX!Pm&9^oJMM=%T>Hg1 zsdS59&#n0wh!(exx`=Kgk7HZf^^P~(JLpWT9f}qni%M)&-xe3#|I)bCR>xd^{#!EJ zVkmXxh%xdTi*()Cee zO5&zx`-}>`ecOIsLtjL3Vbdwdna^?DW}-FZQDdD0T2NSN-(6!c%x!$SowpCN&NN2ylndfcUQ=vJ#FXOqVoh#*o0rf%tSn1jNQ+>5g@0l?%##V-S6v?gg zVHuQAl<~e-u}e)d!naJ1Nc#B9R)qV&mJe>8G~tfL#up{9QohMmO@vz&<=H=o)hv@z zt<~kW+G%ErXdpxT-ZcKytHtOOoS>OLgSwS>f6lR~bWjflL4d9Zb$*`q9%+!uGZl~BCf&F6QI;7*a&UqHgc1dliv&@A)fDs3GchQ=rD z+Bx=Q1T^r|{WK>zJh%FDgT|jo%Qe0gGr7TV3nCcMHckgSY{a~4;Sjv$OnMi^^khCt z&=g}m?-y}WbZ-EPn%}jiGhJf;Rj%|N0i0k(ceix27ahRuzFK(7pex}`u_!7Bk5{y1`t=8V+4R#TJ70!0ojxLzRJdY|JC9NKuYQ^KDhSqs$1Xnh! z=qZt(AK#~v(5qW&J2%zO=~OL^7#AJnp^1JCkM&T_t=WFLRrP#{|3F9veA4*%rjvde z4_;NXe0x_jBTUIebr{h77XnAr)>?y>-yirzVe* zaMH6=-CNUmEcTmc`%B#Q=By_7S8ksNwuQ%A$T8qKk+Xp7S>+-`(AoX0<@S~F(-ZI? zONS+3AdokK$!!w5?R-IVEutykip}373ONN2P~E1#o~Cc706TyF`*|q_?Me2l1W3BG z#37@j{_&&Plh{HZs*cxo<0{9}U6o&GNFpb2;bJzr930>dLOzrv@KTFqm4d#YoKuo; zjIc7!VmqpgutI1&4Tc=!m_?BhXeU256LbDWmy$7qM>H;n^NBZF1D*tbW({q4)$V8E zZV+@`)0Vwbpg|VR5jt&S(u> zs7Tsv<}6>Ea7mIMzm0mYHKM3wChm5uZv%a!EhqKS<^LR1m94|!5w-489J-yp-A zP2`+*@?GbE;WQp$8BGBDchPjhh_*f->M((F^-dSSGtvGsOVmsQ-knQqH%m*u&e~3f zN3lhAvJN({hSx@2^Pj~hzl4eqrecc5D@{h@l{hx-2-w8?OLo-zqjL3eY`UNgFQ{%d z!ZK|k3mKR3CKOp|s-183zNo%DdNiUU(U)3oGoo9rGFJI4kdcp*lUAABVzt(GrSejpdQVCyMe_Kq zBspXw7jzu^Z|Lv|px&9WONOS+UjThJG^3FAn+J>8e5qhQ4+ zI0vDIM2Hx>S0e9uKprU)Q|+_^{T#>52`L{cfZJHC@ES_a$ekS&97MC!47z&GQIVle$a}c; zWo+f>&EsH~Lkh*V=pKvhdhM2ay|bhZTYe>8mvLAw?sU;_k|NFle+Z5}VK7TPnnmn} zA9KgE`AC1W?v@zcte>91^4$zqcOAH_R%`t0(7jJ!XG-M*d7JtnIu`N$?adn=49kti z&G8|rxX+@!V7)vbJgpjB@G)rPcCF9DR@oKlL^o1@lxkeg@esMAHdd9mDS}Pd*v-{ zJ#ANLtrV#YtvNYcoQu8|wf8=!n?>DZSS}hJe3Z!Ub1U<#EE~u7XFB!oI~*uTPavy) zF;wmWPUJEhA{54JMh~S*Rx;DDCMD>f_sisxM{8YrQx+P;qp-r{-~%<$$C716t89=8e?GHG;x}Fi zsYZ~km@X{fk{vdd&@rTs_hz#YG6J)+%`rVQQ?~*onCLV(S;7kRT7MJ2383qrvICSq zHX(BjMDzBAgm4h(tKIwKFAoVQ5U+0&4$@FumOpEw6K&=Dmoyl*M*;1gW`l6@_^_I@ zKt&!o;kqddzL2rR>Ryg_pE5>2n@zZ`-G^;PG~XuYi=RX7!Mt5M3_CBdj2Mgz>FgCd zmI56m8pK91TB%67EOy4ez7@O}Xlf|@sQfk0+;>Q7p6I%php;r&OdVQF`hP;OvuV~G z))yI;)-RaHVi)#IS#r(pj|?a_;*ap#W({V&RVS!>67Lt1gx0}*HI9e`eXb+vSqLvJ zR>-9aaX3skZQ+JckLww!y3XE_5Xf1fTaKr+dZ;Xv6h7pzz%DMo%94+a*iE$dD8?LQ zesslo%Ake(HYiS_^z#0|Koz16uIQAalAk;IWezHPe#hLzl6;F>V(!r^3WwCJK)t@G zgb1W++Vr39{@!|RYx);h_P-LvHf1!G*p31z$&|!S8rVt@TH52f>&Q_h|9<1-DU_#- zM5d}5i&+PId;}T9OlK6Y9<+BvAL1zV63#r-eP=Q8vKu=p0%^uP6f)f6?B&f0#PC2C z3MADFrwz+ePf4cIM#B#^&+)#lgsm2m;yn|>D`5<4L0hVO$qWha)#CoOZdWQGzKNuGny&uoa&JKx4I&eF#=uSPLPVjp6_ z+pQ~V%#y51o;+KA9uzCO$wO~-=%OL|GaF)oI+DFuvnvvY+R2B zI1O|Tw7Vg4zO+Ho9z9~O@{NyX)Ey2N<^NX`1OtNhyy6PB)8%3E@P>^9mpt#jD#dEm zAG7R`pJp?S+W&&5jKjN$t&mSEP8$0E^8k8n5&7^V@J|$Hrw7hVrb35vjK6Vyl{! z33^oi@l|mgn-DRjSP_LKUZ!zsMLt$!BD{_K29IFNda_L2u<_{W4xA9+Xz zdW%Ukn6kvo6Z)%}Np-32Ql5r5k`CQR>-`suAGC)QjJ^K2#;GghmQIME4SGMcG}&~b zHm;Qx&0*moqf_c$Qu5?!J3HelOHYPZbFpnC>|p0^(GiI+;0Q~$|^kAIyEv3bEh_{*tbyff6;OHPfaP9KRq651Pq9Uj-|OVU z)JiDPED_7c(m#i?lCu6Ws<7p-4BS(9VYjZ&7e74h8Sn+<-fbcmwUwXGsG;u-E%emeOrws<&4~`GW-7ui zl}_ZiluYQT(y94KiecIXn}A{I^}%XzK$M62tDg@-eBnf-8Yjt?G+7^g{X|P{?B3S) zFO-BMR5Fmt8oq)4`Oot_lV{1>cbf?$qH-#3R$B#H<#&^p-w9@y)fG&~Eb*KhyzxeU zeG%b#Q9=rjr1`}K<@u<`$87Zr^_XQNr`q69*P*DoyTXRpW*A68?(5H zK`YD2{#QR6hJUDGf%^$@Q=jMMOGSx4Cjj%;1u7<vjp8czgDAh6iO^GgH=nQ& zd`;xgpG3D4T8?zmguS44E}h0whsWCD{RV5|;J*AM$eyWw`Ee$gF3p?#Wgi##2zXT( zs9SiZ`j2W5dvRX$atCNkb0o;2+!!N@Dcd=L$LW~ft)-_DVTOqmV^!CCKxvyvHZftc z3M~s?AFK#t9NrbJMB`;(DZwl-nGu$8BqPuUB69S~L&6R0YBMO~d5F_6?@5qT!>OCk zy&+n%(pIehI49JJn2mIHz;ImJIoSRMoC7K!&db?<#mPnj-cpBM7zv8gQ>T(?R!0AU zb8O%>&cb>1*Bt14EUErchByR*@c)#v4^)0VPqh9$LJkeF_fGC#dxRP`eD>6s?Z9Q+ zByDjwr`upGqCx94^+94jx~%tPtX_Vt&WG}hF(DH_f*4newZW8`-3twaoI@k?$N||< zKJ@g6UO{&0EKrw4OWi0qzJzApc~Zz;NOQe4U;$@{2V&V!d$cKEpV#uD7H{R0mGPaw zS1{Gd1_kGero7p+_P2w_(?VD~M8>Vc(-6TR3&Ye4$~We+?o)fzTn+6a zoKy`VN45G0?2H7jt5)wdo|kVlT&?kW8-U3MOPDwSoo=N@p$nLZBnE$bDJpM&a5rq^GpZ1jfK$G+W?a` zd6N`weeTUxgZm_^G+N5UYa3_Z16Sez^f*^fT^jmJLhS*$DhM#up< zRn?h`y&$Lk-3@vp&LA76CHH4g55oYZ&9QnLTnu+2Dq{?>Z8MVbRAxC`h{N9JCA_L6 zijyBx+3jQaW2kL69yrkjR^0w*CGa;3Z_5s9!vAlr6&QRC#;4yYb@ra0?~pW95jLB8r&m78+B$02V>lS6L=G z(j20xE`nGG$IYG#R6buWmXBDR_8D5dfEFOv9xkT-TTn!GHK`>N3Zie=P@hK^S55A} z6;SN;O zo|J_1v!MvfKapVGxOb_Ad;n1OW?oLPAMz7d`D1IlTx)3|aKV30An=dJ>+3_mWQ$n+ z?wG@8CBoi^Ac{}y3{QoLx{^lU)Pz+KE94pHUDcxZdAYTZ_pMS~?X2iInx$61`7@g;^|~#gZ1?Y>lG`VytSfhZbI9gqdFGhjx+zy!@rtxY0d}xr z=xoczGpw5+`!MaoU$kSzDCOJl{d6tlfdK=a5c`8=#z?PiscsJ6oni5V-l??uEs*1I-T*C?Kr_!AL}c%T$EU4ndKADtmzr1(Z(oiAv5whaHLM_i zQZ@5ZR1LI%39{AR^Pi8kGv+3JRqv|Q#VuZEh%~63#dPX1moJy*&fFdwg1u<$bxG$U+1&ZhrFfhj5-4u^&IGf7_sJo8QKwK= z$b0Fs4-w!b{-^a1n0oZv7&cbB!Z>a912Hr8CqJzCK!SW8QYo>R4;J~wmTkS7>Xk17 znfkqqDb#?2%1v45m$^bVgE9D9wfZq<%!lWSxZU@sIp3^5 zp`mEeH%nCN<`sq+6kauCH!64iw=Hcs#ZiMmjh6QE+#i^!dpGTo;T`vDBe9rYMAmZb7GUSMzb5$XJP5WHc*4zyq5Z&O9-366+ydVI zoVWtIEM75Jr0KFGiqgSAR58pDlMfoLqIPg~89M7eL))aVsy&B>WF}ChgiC?gfa9QT zdQ`M2q!A6Y;cDQ{Wi?@1LVh~hnPY@cahWmkkSu#w?bF}Q?)nc*1av2s5aLbqNAX>k z-6rfT3Sy782&ZXvosl&il;y~0&$NSVpREmw3wS#_H3slL8Ues%h8I;1VzWq;I<%<< zTK@nEbG{Mi87g_`Yn6^1o&0(Uhom0qHlN|!_oZL_J~#NN?bY#-f_wwaTl&wYUD&t) z`!T~nrrx-jD;G3rvTiGMYlotO0d98;qM`b3Wu#OUN%r=x_~#xI!s0w4t*B0EG$IbE zt|u`*|HU`nd`jFY&AO4@)6w9e$Jf|yk&M3g*K;4}EGxK>I;7QN{!IEXr&arb;#5qP zG-S^Ari#OC=OTZjfdedTXVTWI1hlnNC^z3{11W%@rzOaQl6>8)+IE>JQlj=wb%r15 z2sb`c2yy_e-}nN_a)PcByYY}#;bS5w-7|l}q#Rz*EJ_SH*0nKfTw*r_c}}o;f;~lhTCp7HWtq-cr>+A$K7+ z9$%gOsC=RzBG92B6A+2od@ zqjc9D7Cgnrua!i+DMJ~ zv>H9#9ebnv)OC%5WAg-dB!aY!+^It$s`x~P0BVADf8!PtG}nhrpIzT^+iHB<9qeoX zc4mx8lL2nG;OmNALrD_lrUICE$!obc*PPxFpt4vXDKu%Js0Bgwzptb1w7|~olqW|c zM&d&vPf9i8t?_K&LEVwC02a%v8!Pla!a_ z=|{6m*#uN-av^bOmd07&%^I%soodzE-=2@s+dnwQC8egJV(DEKKnuUgEurjq7KzwU zVoEb*3&R+HkyMs8G#imNl4*hYU<;B=x33n-aeArm?>25=^o3JBk&^Z*c#a*EAsfqA zZHMebt>uHlqD|C1yBW&}2cJnN{5(zjqOdq35ljZsj?j=(jE$0mo=SC(Bgnj<#)WYV zx3M=i1Fq!3xZ8Zpf?K`0==2evs=Xtjqj(_FUf1LzJm@^w(-L8KZF@nm+h6-fqOjp3mmV=}`h+uI6YXP+}ruqmQCVElfx(BU2yXAJ>ZPj;QiQM&# zI^%xOEk7$^zb+3b(Mg-y87KV+50xS)G1YonKGX+;`NTRdUNpYMw6QSare?HxT@yF2 z+Qc~3a=UUJwD@td;w+-h05A}=O?7g5Yg+VIoY(SitrlF=Jk(2_Qq*?U;A)AyuDp=R z=~?mh&I~`!sHz~ZlE~pe?-vnzave)ioW2{9U}sMoW)MyH%CSuuH4%3G{K_6HH5gvH z?@&(=W*;%^awk$nGe*_<#dE9Dulb1Qv$B-8A?-5BAF!F|{n;3ed9b05X99oExBBZm zM#>Zq1hfQkteEn?k;GGe4+c4bjKB>yp9_>!3UhD-w);?}3yVhm%g6|k5KZ&5YXl93 zMKzun-7w!EZi0~qr0BdHZ*PYCb#)<@xNUyPXDQ42c%Bs82i)|jIK&w?s`}bAF^CWl z&AJ1^z$iH!XuwmYC|nRTS1Gni?a$7m}bp!Xgx$2DB=Q-WmTug48v+53`B%!y2Q zRHiTtgOJo2;H#F;H^(CdCsq-linR^_nF##p3T4cCjrmNNh)+Hd>ua#{bh)9?tBh)X zc8!+CPU(7PQ{)ottnDXRTdQ}d$syoZ_|1#XH~c2> z)Ghg{2i6ZpjMfbzX!!cu+A=M>j&&Qm=&#brBo{3WG|P0}KppE{l^HBN)3;yI@ZQqn z48CFh3s&HRGvl@16}uJzRqk-q8Gbt&$V_x2@RugSoXj-D(mD8_C?QOceB_H<_hK_C zT+uAwk|dpNTtGy^Esf_!+D63h znpeWy()mVkcRH^Gr(wz{=W7BQFK3dQg5!2Q`48A*(9dHKIVaD-msfh!M`iq)Tu&!e zl$4;X6Tp6TUJ7q;hb&!%buO| z?P>+CjYiZr1bMtE4NLI?6WeNT-~f%HveKpAJp_N&2n8+c0N_X^zfJzt`kFyT{*s=)q$j%vfA-GmTeNPJRq&?tF3teHWcA60@|I+fM z-eM2Ul8Uv@ez5YW?cGg9wy4dcbX(A~?(~8~8h6Q3-aqcdi#>_rT^q?*SqYj_LK)fn z}B7YRN^uVgsiR~Xk@J#lvExif{%X~yQd4h8fvl0Ol|$HbcLe=Biswg~f^J?1#hN3HH7h0}Xmt$r`h^zoUiDg@v@5Y7)E| zu_uF~M6~6b6B>0jVIjXVwZXG*oOjm-@cvAaEYnahaeR-hGgx^~dn&X;n(tDlrsXXi zAmr=ZiYjs|w-1lqlf1tz!i~jE7cp%?JA~&JlG?wTTe>XZ&v-QFC|_mkGXJ7`L-$`3 zI_>NPh;y4qU-z|{2B@c218&Tw8YaM9^4%naxJ-?^s4`*dhnxK?g)g0#VI!o|jn=NN zcp^pS^sMh<^9Jp%P7q!QChnLzsemxjDBrou(VY)#<6bcFFTGqGC$P;f{JU%LXgiuE z5U~U9t&bjYP3>P{&i1oTT8@-eboX9UFr=;`kw+G<)Kya8q!FPyXFa>xOoya;o$2zw zuW+-nQzxf^MD@m)99OeYL?f2Jt~!%^V4+B0{EYSWT+E$_om>IgL&Bn!mObvwle7V^ z`hiCig<-pSt2pi_Cp9(F(_@bxHQ?EI*~)_VLB+;-&oLM8i&4pU-%YwLWQfm*#%Hf# z9jB^Zb4K}WCLnp?*0QGvF!fFwl9&=({b3!{ zFq}HE>oC!z4Pr4PZyV#l6{@TKP6I90O0K? z)ISiJD+8R?@x1dt8Rdwxaz5JfE^@Ot{pImau8Y9nh6{I(vzS+i&)xFsIStWPMO*00 zfj$oMdzCv+D-0zYrC&kma(iQxRV<|J{nfLZyLJz0)axQ7Jw<}RaG8RwjU&}hw5>)o ztGrE0+IXIgb3y~&yNHq3whJeC^z_LYsSTM@=iEFxPq`Xadn3~?6OI=}=HHQi^Z9UR zmm%ghS#z7d$73-xg0l8CX~)HT_45HnH!7agyY1rJdh}K%qx!jNQt+5YT^@D=UX}*V zzpUS37YKzwSRlZbfycabJ(@<#D2&faPmsQ|M*Pkr`fAZ-Lg|}36A%E??{#lzJvCR4 z_*^%!7}njuQkPm*#?qAbaE2Xh#$@~Vn4VH@nDpKw)dKxNRw~t&gEttsMaC+zK-Vc% zR?PH)Pf2>#TG7_fxPR4Cnb4isE3HkV8ljO)gqJh$+?7IkU07y{Ov#%Xgo+6W2rzIZ zo?*Ib^t7xjj;|5ep%U%FG3ed@@o=W8ImJa<5~G$Id8o&H8s+wm^Shx9?xPu|=u`iTmbTBE_$wTkB?N4xuPw~p18(B9N z;+#e2HiiV{I!PV2rx8E>`e8u^=}P5q!a9|-7G5!^!LD?LS)!W$Ofz~m&xTaNqg16) zpVciwNsCqX@9Qw|Sb-;djeW|lk>0iuOk}Fsu+`{#BPvo{yQ*6+hUOcSAGu!1(xQVt zEs&g^vrS$M7o06cqj~{Kct#_6JKnOA*Z(!F$50k?`}|iAru=*Re=-^&FiTvOX2^SK&XtdSU zvLWsA08&WBeI8!7nn~Jg3jzbtyW#h&LLT>5W!#KwbV;nWAGRVY)?gYvvtMX>*G6eF~&I~J@661mK z{`d7<;c&ed2dh|d#CnXrdX=ryM&!JD70a?on!{LcHom>Mgxt|J%arfmlP!_`m-7Qd zx`b1mr;aJQ98)yDakcG?O2lYohOPeRf@ZH`vgD~2)W|gQ>2UaP9ysV~8da)}yH0(y zE|tS>C7;idh3?&9rU*hkV@14%db*}F;-ECb%vk3ZSiz;ZsbE<14q!|^J_Ds3S7QK| ze8?5&{QH%1gV>x7$`x4AP|8f@3G_VvbINqsfU3J#36t2gIJfVKZ_Nu5liQgMGn8({ zvzy;CX95P-c4x-W0T)pnlz&jj?e6A^{>?@aUoR$8p2Kp)k-osMvG)=FOqw4Pem)v$ z%n9pvjj-QkRSqn5$);lL&*~4K$`=1pFv;c4d1ue%-XnJ4!aov+ZN;xlgR5> zRj-PP=f=z#0ZoT?%9->J93Id@h&J~Fg+Y%~kccCXzWP*J29ImZB#cz4>pflhiIkp} zkH96Sk~;O=#P7w#`Pirn9FuB5m4RK+HpM5#+)?lEXD-41@)>L;djm{t9q;Gl2Dmsp zj&gO$6uQcK|HW$RPWo75yjxt3x`l?|=KY@;h-5rVgey>0e;HJj` z6&3Tfi%pZr`u;T~Q`LqLr+-_;y|iz%HX;^(OZ`HU`p&Z~bo|WuO!6>5f}MUXYrQ@| z;n8)8NA=BxJ#yhNp*eMc&U^J^_f1Sv56R>LVQxX=}R` ztJM(94bkpKk3A}cTHOJ%yOSEDyz#m@)(nai(01;KzE=lXq=D*&!HK$Igcm0JAO8NARG|$@r{HoeMqw7|oL}Vd~OhXxg;z1WLJ0{eQCD zl)C=;`2AsD_&yIC4WJaP=MUvh(s^|Z)k7b_JE>5P%7hMDjVt$tgeYhtVJFDd2RlRoDWB(oi@9S&51a`(kW&i#~Im3Gh8FVpV}q$Rg8^mYxf3U#Sp z%;^(OWW@jVaY+ItaxoS50YegW22Y^*MK;h(-0r)Aq>Bx}&R(UI?ibj2SbO|Ua%{K| zT)-Nc1`Ns4%*&#@KNN!PillEP1)sn`6!m}`5&ON@#Hzd2_@RN^?lqO8BjJ05r9O4_ zgEw&Y-T9gsc?UVqrpnnefAYBK^atVH(dxwH>N`6==t{ytu-EiFS&=skwwhtyUJhAv z`F|^mH*+`|1bimRq8$xD%u!pXa4=E@m;v4ea23Jp1mkj_X73{o$Y_ZK8ZK{G<-zIC zP5pKd4KAKvlxYm9L$XQ;`>}5gY0`xBFKJEFz#~NI9A1lN3Asu4Gm$7VcXjD{7DQLl zl|yg)ym!DO9f0$F<70}@{0kt(1#c3upebo6u#ppWP%%GL**)8Nf4dQKTi4z1n!kv^ zpl?8=d~Z*qQTu~C-UZ@vj6Za<9H!-k7@0@QfBSLatnOJ-*z&BN07$>OV2=tW1u z&AYPqm(1V_;GHz$3ebBP2_&OUrP##WZ1ULKVUFW+h@9S=7QwqYZhV+sQuHX{xE|jr z_XukSad#t8z+|Aslk^1kBo`>}4y)+zo(!6KOz2`9iqF=w#$~#D zU5xo9CEdZp6YFjx%DcFiCWOAp!>x_ZgEau+M^R^UF z$?d+b4!O@7ri;_=YyUz{w9%^}9j9o{l|%%FV)JQN5oGxA#-8)7ju@rNFHIjoY;Zeu zGeJt&R1x3`PXF-N=DpmKL#TSjgcy^xmIOKAc_<@@Y@H%PrXA9B+P{Pf^ia|nztCzr zs$Qgs?d9^thm7QlUUV&lMPZmtgFJLfe9V4-BtMyAfyb(8oC#8agG;LuIPvtCwWe&~ zKETuv%Uc;ujn(US#pxUyIuBhk^H0G77>HUUz_g;Q^Fp@75HVgY3d42L-~4D#=SmjW z?4CJ4gKX*<)n;Xsb%oqpEj=+iCUCRFJE=*cT!jI2?Q<-!hgn;_I4RAB@c+Bc(VZAS zqiA;|FwxoXBVsO_HG~}@9O5Fdc=sy@&H0sDd!){)C&qnImfDW2GKvxabwu6+J?-J&TK_`FCjdcXE7-#_+I2V)y zcgQ=>Al5?~@M-|~KTmf#?J{~ATA-5XmfP_onq9)%X+D^iZSq)RM{8bc0OF}uW;OEx zDETr1z@vRD`d9SD=DzT;W$kk0^8oAOJVKZKNf7`1UTFiv%4b?JyNV0;NhW!kLWn_)|!cUYK+m z?ov$HzltN^O@yTNomY-Ew^zb|)1D)aUNa6~tpG2ri`fe01KDoB-(bG1_<&p~Q6q6SVtiXaQ%$%eTnh@NBpFzZNFOrVC=+T#u}N zVZ!q6BX9$BunfBM7LQ`gG0%Yeb_@6(paS97_kQ+cqWdSq1Glsd)@YWyK#S)OFDIv= z*|DAPdArK=%+;e%3XU8(G_6vuz)ca;Wmu*iw*3b`f6O7)z7Q3Z|c$7vGlJ2 zQxx7ZICcQ zb-kIAGTIk!n7)yANyg$A;rA5sc_&F8p2>+5b)j4A;1{$D;}TZeT8zv`fCh1;54|-i zPLVit+`A|@Z=Pxqzf)43_5r@LfJ$yik4iPs$`~#O8XL$GgzUC^qSattExsc}<`S*whQ^aXsBimspLrkbx^Css-58tsPlhgKt> z72>v}&q$|Ke>tP6V<-R}uCL;xN@u?XH4f1Te-b2WRQ+EtQqgBtWK+<_;MiWaOod)^ zxo19@c5oaW^o4N6hbwRq-nR3uu5f zQn7OTs9ldHrpuPKN$N^77zs77MmmNLr`Dwi(JO3Y$pGqKU_iCNvMH9A1r3(~seQYv zSJ#lHn|iED&|2Efe4N}yvx&~uC+nesoC(vu4-E^jG+XDFzB3X8NJEh-i&WRhUMRfe zu$)aGeodEnijGr2+ zyl^?~m=YpzHY|+|OYCV|t8mV*M`do_tFt!F!q)eD2r62X^#6R409P~1fm2HvWPpI0_b11oOB*PDJpU3SAJC;5G#&j|11x0{Vw)s#2rbMwKeoPcM9#3FzQ7<`Q>!7C^zX>L{{?dDwFPoi z-Xe*oU)-!+zv)M~S8es{c`O$Uq4TDN%C6(%2{Ox29oW%AyZhTi_#atT5l#{F;H$0h zF)J}xnI4)>p^d=mS6;qg)5vfyQ7xG_0o@urgZZTYvo`_46i8)fHVYO5|GoO6p>6&O zEG03ui59NEJUfRARJasU)wTq%_OKU;qRBi(?^0h?{e69{X5D|rbiS*hUhEDgc+%oJ z`Bj)4C^)H{Aog;;oRATwW3PZ<6uTCxV(K_ZthX$0;tL;*kfu>LA(3K580kmqG3p$@ zl;@9y&cIOL!Ta0Vq@GJr0Nd?nZ~|nl{>Ux_-ZWn6;2<|tDYkq3K5Ne2q4eIS%f?3j zsShwTgHv4Gxs(NOXkJy7iBhY?ulvNJ<<$T5wcm`?nGj6h!_ z$zXrkb|9%cA3%d15WL|1OAK5>kw@v+M_<8-X1WGg?WAOb6TiICMwDvzX_)>-8Bq0qr67VS$E9> z)?xu>59I%A?<>QiYP)dvFfeq9bO@p#(p>`#s7M-ghe&r1JxGa^O4l%`fGE-((xB9! zAl-<7G)N1aJ-qMto$v4YfBfaewf7TiuV+1L-D|CT25w%ID;T_w;-wTIjsUbmR~-ON zdP2)<2;trx0h$$4Vhp$#cV&jP=$dLsEDH^$3)qk%B}^9|%kgyklqJiOG)4%VF^ZEo zT&<@9QzMi=TlV;gr9KY}QbJC&C|?l5;bu%5cN}i#uLTc>$*_&M8ExET^GK&Vbq|SM zI)|IkTat%M!BhYR>-+ zIFqJ4avuHR7Q)X=IrP$Xf7aKY6=)hMndAe_ERW_;8et8efWKF3n=SuzF?)@7*#Ky9 zV|>lbzeM$t2~lV_Li&E%Qw)ul#WjVN4Yct(F`8#BIjJLIh%A{D#$Lb(Mvd3U66I+y z|I?p{vvsj=S!#eOL2^x689uM}H)uCyzvb?2P!nAsD@$x>b=un<_pdasvPsHSkHY%Q zR&#frT!avPJB7En>`t1j=0{2Ld1`ak`39u1{#o{$%JIx5{LX!LVOVG4*YknTiQJBh zhRQUyv9IKKe_xO5YkYfJxGX%2=^fjjZo?(Z^IW3R@#P228y|rDk9qd>op&1c5Wy`W zvmhG3*{=qv{H?|_${bXnINcj!zcj>?|Ek~Vz`kpSV4mq=Ek#tp2-%=$nN%F>%N{_n zQS3GYo}D-eo}Hxl(c)L&hArM;jq>FB!JN8v!-OkMfUE27OD4QO10Ba(aVe(sCiK&F zjPR(XSA7VO4&Zi#+tfy=j7w5`YP8m$D?*zW=31S1d|D*M<_`n;9FXghV;d!u4O8aY zU$++V2S4!Uy_i^8d$x{7dms2=uUbBRMy+IN z$xPQ<^z9>Vby|RH%N`Tur<+@>E>|(&`idwU->1T?IV*#LkL`fLwJXcBiMJ9G@Ga8) z)NX~@{Hd)g6zIN+xb~-a!BK`Ga5m`tLiWtpz_7h(nr*7LYG(c1MdL3l;biLx46*gx z!Wj5euhlbJ8gdM`!2aD4l%2N?_j&I3JI3AYFw)a3P1JVf7_-?}(dA#_3rx&hPcwb# zM&j*Eg!yqxg%~ONaLr;a&TNJq(e3`-@ocv$_yWpipj~|fSgDEw#3-JP#T%Y1z)@_z z+GT--Yjt9FX@Uobzc91Q=eOBbPEF4>-ks7kx0V~_D9{@JNY=Wy!zVoO#6vzZH@6P^ zd9`NdJgM=!J?DCgurr7kuPaIhoxf-*zT-X+0pQvs;-2XcU{deJQ37X(pJy77Kbpj- z88+vNuY%?a`Q>UItMNx6d{QA`xzc!OoAC9mqr;1`*MujC2ZrQ?r~Jg51f%uiTfVvj zL2{j%*Z!tHo1?`wKm6`V33w-YY#Y2w;4`jnevp`baTxOZw2yT-?k-P}q3_6^Vqk^z z)ejNxi80of8nlAn7~x)*AJr&%J$$D73J~NAWd3a$(p(ZTTcwEORu1Qd%V?u)S};qQ zl8YfJ`oK!lIRnSA@z__ct>}byBiNa5GuQHGvqf_yWzR;d`6gO0F4i#}_y6>~>HCE31;xMVFJgW`n?G?!VPIa|$A( z-00P~^Sm5U(`hxZGap@oL0J+$F_QW8@{wD05)t(MNE6mh<{&I{DTe)xe((A~rzrIer z>`YsG-L9uv4!2#+02eoH)1*a+3G}n^^q=iy#b&33=3l+Mz?Mizks8!R@6aW1_Z_&09kT;>LHfIQ+1gQ7m z?0bJMqzT${g2Dd)TkFL9J9DZhs!F2_y*qaa4EmkG=0pX#z@4K+b@0?Kn)`S1D9G>p z)R*7MFgL$&y(~Z_Uv@beCy*5g;`$W@V%`^wBRM-0qZfbQB|bbOK4l47cUM@Jii%@B z-*Z_0GwR*kJYafWpZaG5vZ%v;#V+2aw9v z?OmD&ebqe8tk!_$*cbQSc)=zx0JNEL2XefB04KP>B$MD> z6|W!4IHpT>DHiQ_$&D}MN_u0fk&_JT6>ZmS3)z-n027t9>|AZik@cJiiviIbULi6L zq7zT+pXVHOJG|XOs!^GpZpB7zn_*YlpwIhL-uPU44y)77W_qKcJ((T55%Igqi2Qdj@O!0QthjAObS;X@&?;6lI( z;fP|wtLFcRKWIru4sQ?F>R5((@t-P#x&P^E#TPc=Ii+%=_H4V`wZHByXSFm~AFh-V z)~Cm9-+*6h{=1atdoe$tG+FZbBsPPYpql^Wkmp18#ldVGGiPWHVB`RxWpzsqj7#yJiV#;esr=0t zZ>b=|BAiRvRH}}iVv;miIvAKSBY1;kW4%zjh7>o(Tv`*tQc!hv9_@uNDD>}_@lj$J zAE_|hUw>6%{b-2{sHY9XFKG2V4wjp7-sVHO2*SbPm(`d-C54@zX`L0B6iV9q~u@ zqR@>!j4Zxgal%IX+M*{iNEnfb$?}|!u)StRCFRO%W8tLDIa&43yt9F)rk7LFw|OcI zCxh@eDC8>`as)&Tk+{mV)0JNhRT+A{KEd6NbB*kakdx9fb^?EXJXJ9M)eelgW}I^E}4%bQa?XXw2|HfM-S zRWtxE`eXWIpLeJvGKOzcks7;;_L`5cr{n80!%IRI>+)O`PKJsJA|ZS>~D`*d{&w5fbcWhDph4kiBsGi@r1Co!2knLfb>TvjM$6 zrsFN zI1&8glp5ZOjMLV6iM1#g!@!>sTb%nHgMRe&2Y%l45f)-^;+D2fvsyg`pJ8yPacU{< zaqnDu>i3Jaw;^og*8?@YhO-$jU8Y~J55T9&5N+ePGEDVjp|niHef?4H+G3Oo3X zb%k7x+Or~DXf0?o}l0A)9f0M8qJ}Y z*FFZ6lmrwfsRz+x7T+tKw`WY)_eaX7Wrc*cONyIB&E+0fpHAOJTZ>o;jk(qZzqwO6 zK6kv34bm=9loV^zB1qNe z3%m$jRNJ0fJtxd~ zT_Tp{@n4}smj_W#90l8)Snj80anxDImr|QEd^S8={qKmdA=?I@vdNgoJ^%!@tH&j-clva zzBTVWC~j4)qUjO#koB%i@dh(IJ+sR7qxFz~wn0k=zFlrSU-uC4PH=9V%z*81kLTrP zG5G4o%U55|)x}R0J(@-p{ODsMXw3K{t z%y6sa<}+XQt@HNmaynyfoSvzIV}%wiZcnv#*-gzEwrG!^2oWMV>xX+@g9-8b-k@qc zvrV6?Ta0^!Dga)7zr)_Pe@P(fB;#nf78lSjS3tI}ntfAMt6eTc(gu z#zW&F)Jh;?hwGss!CE7*MKkb5QgujH?ya7ktDCj?mPmUIElWO#haOOR0T^-NSOuSN z2iD9P>OBP&ixi|15CQX`m(zm_RiQ@o;>ZWVO@TJJlKme0o85n?91`01zIF2jfsN$6 zGT`L|=D#i}4cC|0;EDp4)4{YJ1A4hXC#Q8=zxlA^r)x*Ky8Kah9&hpIvPv8sXA{W( zm3aEMlmAq$f{;)h43J8^#&gVa#v>(ja;7Uxuhr=RpJWWcj5kP0qB|o3@p8rUB0-md zbfW6GR;sTT3dePVwug(j29L9luKEg*1kb>~U<*!_7g$X~g3%@X=z`-1dDmmih1!%u z4TRY`?NHy>gs$Ky9DNjAn)W`ghmdYOPq+Yy@C;A3t8%CiA1U;vaUV}LxdtRyFb15r zH4K!=uyhxVAfKZl5g`X-xEs|Q%e824u5c@mY1U>`9sVbXQlVHe{6m=NX=X`K&7X+o zQ=d)$9+I`P+P@nYU56D*xRXwcZ53W&dz`7%G5;4xm~9_2Pi$bAoNM zt021!`p@ksSX${hm~2jc06!ik%a8Vqw<^GzTy(7)m`HZxl{X`2eZk5bGeYD1>|q($ z+t0g|Llyh;C_R5cCk0V|8Pv`Z1AWuQiz1EsTjE^SDIPrk*$|k^l^FvBklWkrR+f?E zD1uuQCG9Zs{Box`Mf}=v^q9SfN9A{Be$=KJPFy{tOOYOjGrbBK`*y(BkzQ*5!c|tw zkd!^G?&>5gt{cBPWJW#rKOYF(hh=H&Tc-=rTU08R+d2Gi)w9-~bEE}fgVs`tVzM1I z{4yZ)2YKqIpxzFIEem~SJ55|uNaiQZ&~ElVT7cQnyuDVS+kvCnt(F_N{I5C@4Dzd6 z5mvgHG5_s0KTm)V96>PAngsP$MCC`iAmlX1fVl%E+2m)?QUN27mU)jJ>fZKkj`NVt z!UA15j(p`(fxz|U0nWYAJXNj6fv}W*QfD)JXx83r8Go2vF>Q(HDRltJ*sbt8-fl#L zNd;=#EcvRjt*IBLFXgG<#y&nET2diL{a{xDkMSjR1@STlGTg{8>Dv?-dZQcf(2N~I)`!cZSb90Ix4U0Ht zou%|A3Oa@d3w@>R)uwV5bko=kBg~kg9Oynkmg0;p?i8bNy6H6v5!-g^MVX{fXHa(w zEEaZUvK)GCEA*-w>N_Sx`!(=t{sehq{y8rYcy3yRYA` zRDZgrVx7#PfYbQPPw^6GA~zktL>e?fB$rMj_{uLIt{G`>zJ&~D)>AhVCE48pO((HQ zstJz&J2+@q8kjKcs@iE}oiOx-YdzQ>$?`fqY^hJguJ_B;c9Hxz?x&o6;{69Leo}_u z6#t!T={_+11BiQNHAPUk@!Z>n3bU6ki?UikXFrT%=u%E(!m=}2SzKpxIL$d5Q~uW; z0xE!MB7_M!@1#Uy@f2i39@6Rqd6@c7}Fw$X*F(fUnk&R#7n>GblMo${Lf9I;{x8nOJEOC z%|<%M)i<<2{|-@AOH7|UG7jtj?ruBX2y_rh$)xUr7)bKk82$I6099681Pp!@M8ma9 z1!v}m{gs5iq=lx|vZ1=R<#F{}hGPWmeRpZY?K%(|GO`D$|B!^##D)c%r8mJY+(<}G#WTZ9U+8#WXZfXqAg-S z5-p(`#+GCcoR@Yk{UeOE!_yNBE~UmMjr=QZ zU_vR9@6(%0s;x^m0+8dh+Pw<2ms{(IqH48#8$Km)+m{ue9KoxDq#|m$v{q+i(o#9+ zq{Sa6Bt!h!q;mFyE159T#s4$JCtGE}^vmvDETo%cabCOb3&aUJ!GM9drWhh0u1`~N zPn8`7fWTDdRtstFC+K&^tGzp_iC@k~dM%f)r{s7$+0Lu)NJ|g&*M!_$i{LQf(HOmj zvlh7CGg6FhF#aGpv->s!hur=zE=g4JPhlHBhKW6px0I_r(qN#jor>Bb)s1s`u>|6~ zMgaLq%-e?R)lHmqM(!OC70{hpr^p>NI>iP zp#IU8T$Ac#^@WRNpmE`gA*b|TY5i5PBubA9UvT~)!QgELyjS@t+za8+qQ%wO)^ln0 zWMYga&kZRS6L;t)oihBoD~6+!`#e(i(jhM{gBQ@$zXW8~KH~_Mz1I&3!WUvm@K!d9 z!_s5Bbs3-94t=fI(16Iq2H7aUC^Pi^LBDXBEkVcMGEG_hpQT8$T~WjaxNYb5MPhisH|wyHCIK;3`D&kpgjLETCFKx*}d2&VpulD^g^D6bFdgmoWd zW5?@(Bn*>z{eTZ<*0@}P(iu`^Xv!Z|-{Su1mS6OEK&e*zp$G>fAlvN|{3th6IHaAyzQ;MOJl+brEP;IKNZx9W zGcY)lK!>p1Zad$JbwEMTRN%W$-w?fuwax^J!{hYF_o9|o&>8bkwMxlK8Ttu}7 z<4#{B3o}*{N`fmmxs#tknBgaF)gUCF>FF5i+rgPmmS7c=wGgBQv_8l^@BIvo(3>6B6q;6f|>&xJuh2)s11%uR8@8Z~_W@r4Lu zyW0nRLI$*3dl}IrdVY4SY&Z?=}tFkw@0i%(^aWC_qVdI7#`FABN+jryCbo_i?RumrMTs5R5tqG0~^75GISIw6Z)@n!quGi?f3@&dt6I$9iwOGMi>Q zAVY1T<|wgn+m>X82dEUON6de&6pUZ*8aP(u?HF*M?)X71*yC~VNnD=lxqEO5Zx}5* zde1{{zV1^SIpKuZP%UBLg}*r-{@^s>V2V9ESu>!=6W~4})Fz_E!2;)Yr=xrVa(jFT z1CyJoul@DdEts@1Cf& zRzaFt)jvY&zyBlvsmbx|NUMl!!=S-_5>7Aam*UORga*?043FC3tafQz16T!uy~miICt|Xbd;-oE$4YDQwheM4(=)LW1Ex zpV)oZg}&1!{G`R!y!e&S%WVR{U?H!qIQwjo9^Xu0EY+%mb7~`tr8{1CtJ`p7lT3%vJP3G)(y6%iSw{IiMHKvlmOU1ZL-!g8yl%9PU# z`vZuVFq$z~y~mBA>zfJ}Wtg2m{MHa$G9&sCU|RBcOM>?;m>U6)7wC}ymHjVmD$F~j zU9330TC2sa+$?U7q%XC+i79sja+4c-ELpspOo!s|DxGa}*>h{C4629y3Kt=*0@S|! za;535ZJu~KRmeH8-5Y6x$4Q1#2G>B?W^pfc10ij)?xJ&8r9yynQ_k zLrGw)5NJ)_O!`cxba6nraRljrE2w5<0SF2O>=D!e2YMVvDWeeK#1fLFwohvdx631( zDED{!gpAWB*ZqwQ6l@$uMm`Z0tb};-3-aKtEXaxeP!j);9>Ju0dkv@t( z*Wn)JSFGJlx~B~?JvK-z=+Yy6T~h;^@AOnj1_=bp`@E-c=|dJS%hTO-F$2Y@H4F73 z^OOh@PWEP~FyX0)%sah4l74Y)Onk*2AK2GXP8i%?$16*2V+A}gsXU2b&#sU2dOJv& zXU%MOi|oxFkl{pL)GNAYgHuqDB#{G-%@ALcU23-a5XQVGuTA+YJ9S3HpTJ#(icS9^ zl1eVJZ|c85Usj7_G_^>}KE#bjqhR$kRxkK!atPPD~! zY(@WUqch*lG-qvI1axNpaM@^_i*3bD@aj}z<0AE97U7AQi4WhguUrh&P*NIg;zL}eM8-tG1YH(3eSpC6xG=+G#QjAB$)iE`A+F=;t3iy zQ=PR~U`BQHV7_W1sN(dBgxfCy%679_TjY0Mzb4TABY?w68*g+i(PKCol-HXUt>ZR6 zMRAGkF-2;R>`eheNzBD^finy_RLgk+M#rmg zg2UIl)cIqJjVy!}km&GdZlC;w2Z4qqldiV|{!GN`4{b-u|CX}OGP;T)$f-O7nb{dA zT%JmkGn3OT&z+WLSx?bVrbhBLg88IFs2GSWzqvw5g0HeLn_Avc?Jh`=!{gdWWOQ5+ zZM;qKy=uS@8C*mN{gS(`_j`Kv>G7&1Zadnr1ut|GYmau?Ja_PF!QY>(LvykR4$x^9 zeH`8f%0EKPy~QHWq_$bR6=dy=l{mK zh~br`5^T?%fX$i`Zr?1@umBN)H8>=m0G@fs`lz*mt)0XS(HL$LmQ4t}X?-Gn7!kyX zVpygu_Q8UuoseyhOuKk-_O%C7JK<8S?X69t8sey1zI4}VZBI+tlH3#q6vuCa-@+ZY z_=b)-XS1G-i0S-ik`*&zBTKA_{%I#dRq--7&?N;Ie0P?TU^0D5$n91cRa?vV*T-U5 z1z$8)LVAI?&hN$yuObc^5Ct}Q_%GU0rPhLT>>ZkHQgY-`%kg+#Qy;1GIr=NqhT8Xx zmlQ=#FBwuV@ijVxN$+;^eyDAv_$a@ zJ<(;hWT-O<3FjJ!WC(d>yZwwam1UYf3#Iq%JceZ_J-#!Io`=_3J-dI;Atkh9A`0lQ zi{FIH(ImyG6|Ok3`%1~Tw~a~t6M^7DXV83UZ;F~(?wuGm@}OI#vYvq)!2K;l^!~&U z8i0lJI$KMleL7>M8sA6q2RE~y)UqKy4BwlL-yH%$>N1%$`f?pQip-a{S;CaQyv(a6 z1uFts^JnmrctZa88z8BAiy9*UXCC>*9TwbOsN;u=AXYv^)+7uPw}^|uzgnuvBHA$% z$H-NoZkai&af>#oWro+hesv&@97Kd={TRltX~S~uVM2s8=aX#@DT_&e#KO2%yEUSU zyrNMYAa5`1)p}TL|H0wgclTNT2&~l zJzrWz{;js0fSVB+x)v(_2Ok1WsQ9c^{Won6dI?MnRf3RrHaSu3-XY$dB2u}bUsbRo zX|@)Zba@l8N7QfEnhaN|)_4?x$gr%R!u(VnZA?T2JsRga{rdQ;W!Ng;GhB-3RFSJn z6DZL8O5aB6qSv>w&4(t8Z~GJI@9v%cBbnDN33%#t+|G{;U;c z#BicEKbbM3HGA&QIE6{HK9=RUw>@>d+u;}OU2J>hgW5ia<(y5A!McVaIb_(k0*NCRK0UTBgVds8@6G-N6boBr9f$|@cLG>2yp=p-0lnp-=TT2_h^E6^!cHY8nn z-~6!KRPkU_u#@U)&d?~F_dyDtIranf zJPdfdA}7dsp4ldI;~YZp_?X?rtcTR^7KlUF4bKJQo5wXW&U zpl(2aEKuPCX~TxX2F$g3FM7qlbQm)W5V~cO4Ebo2B!P|W3ccGy6@_&(Q} zJuEj3x!K!`L2>7#f>iK8y*9v)bTRcS51jYw+Do|eHpS|3l$fZX7s-J(P0cV<(Ix0TnCAA!qZ$wCI#%tGSl>d1k9i>2BJa}lhzur)#d3tHWT&Vx@` z>){fu_q0PsWi40>`ZYX%)ik)Mw^X1ZAbN6*Br}{*>^FZWUxB-*+zme<``LgIh$=}v zp_DbnunhH~#y17Yfs4`K)DFr_@*bL!-|cX>OF!zWXsf3qM5bim`kzpGJ4F4EbsJ0< z+YuJ$X`PQXlUn?u-Mk$c6d zBioUb*A0n!>785S?49W#_0c=<+B!_1|NLto_T}8Je2N$i(i2Lk-<&kK#kkMrO&wOX zL$asz@HxJmRjh7V=#*2c+C!40?&EA}ws~K&mt0i^tfE4welghAuQy6 zVg1q)RC0+$!W&>p3=8I;WJkYvvJ`l{_3)NX=X(F>YhbIyk2x{6KBb80(HbJaIZm%C zTI~s{>p6KhXOg5lWHynWX!Fx_7#MR4vc@5E@CWNA^gc!1 zD(1PilRZ!R)-w_fX3srO10 zJ5+lDntX z55-)29xwOJME{ewSHbUpzpR7aac43Ml(_J(kdm~@q>Y721dCp!UOI@sSU4#~Y4V}aNX)ffYtxUI`Qt>W;xB@o^?-Rs#?}Oc$oE3eHBjL*H#r_Ty&y%h zlI|GRhQv#rTb!JDG(+ve_OS4E=cqFVO)r3><(~mo#@;`CpZMNtL701Bd8Gt4C}G3d zC{YdhtexvP{4LyIu-&fIgcuWDQSC@fXl@1j?Ke8EVw0;k>io?~FVocD!io*>e(me>q_DDC9b!(`;Yu=ttho8e7TCLkHDT&Nh6eMWztqZ6k{N8>ZgSq@R@w{x z<87z6A!6Q5aZpuF-hqP@JwbVHz3_h*X^ZcuH|u4CetqS#IYLONN-Jy2utIKc1=wu=F>8PabK-R^o7=Q5%lnXJ!iVUcsB8P<+hzLa3-!Js# zTlP%*H4Mm1jlfc)y7SOAR8(DU9l3#sLk$}ZCor9SsUI1-nj_*MJz0+1!dDLX$8TWf zmml9wU6=4ycUTK?m8bk2s(6ZCuJAh%R>BnR)da8QoE`{tw>yt3t=Qwg=Z~R=mhF9Z zE!abV4D2{G8l=$&5ApB0RppXvr(Ng?2ds}nK)LzgUaH!-YLO>fC0^CL^7hF-b9MLo zM+D2|ka?Dr8Kv}$ZKhJ=w09;*z7P5g<;9Sd zhvz?nTPxnl7|bm5<<~RXYcLmHP5@>Vy~)80X7h=oBX02))^uuJwl!~EXyBJ=dQd?8 z$P^vIUK!IGVsM*a255~5MF&?0(X{O1{~01`8}2w#RL~Qmzb2dvK0jgjKhHk^TR!C8 zfTJ7!b2;GBWTpgzw%L1hmx~%HyVL`)kznt{&|C9!aHzVBLn|4f)_rPd0$EmT;jiC#O;z6;W|@qiqqsUS-qN1V4o3q>Tn@I zJt5}e!e`z5X0A~DVyW9Rmg^*Bi7xG(t%Ze!yw9t{BTb&&xuaT@Jg7BnW~_cVcvH+v z_)MCWe-SCOAe+VrrwnvO{A~)9GL{WkU~Fs+IjOehLPHX2`h5^FwnxXXQRe>h{_(An zL*p1*1Y)w8ctsH&;yih*SeSgu+pgyC0$&n_?2ZTzvg^+s0WN9XG8bAJ@7I-PuF z`s~gQ89-!5Gsxk1EsN{%)o5D)fyhMBVF46MBJ&aWnzWAt?*9;0IxPJF89+72g}Kis zzxv{z2PwwCja!SD3pB_4_eB72f{SKwf${QDC{%_Xd${^5ixyzVXd>v>YXkVv5CGy# zcV%!{()a7a_g!#>0Dk3o+CP)h4bn0E^D^E99`5CY%aLq2@#@*p^jVbPF#RNWC%+Fk z3=2ohIz_>?RSQF!K9{BII64Y~&ms`U2!t&tA^-+4brm~peJWwFrSK|xnH${ccA+lQ zd5>MntY^J$0UjX4@{P6P87Pkj_~5TO|NnpgUjqLR5;!`5RAmb3#KiKa;oefc_uy`^ IlEt(C1MeTu7XSbN diff --git a/release-0.20.0/docs/proposals/federation.md b/release-0.20.0/docs/proposals/federation.md deleted file mode 100644 index 0980d9df65a..00000000000 --- a/release-0.20.0/docs/proposals/federation.md +++ /dev/null @@ -1,437 +0,0 @@ -#Kubernetes Cluster Federation -##(a.k.a. "Ubernetes") - -## Requirements Analysis and Product Proposal - -## _by Quinton Hoole ([quinton@google.com](mailto:quinton@google.com))_ -_Initial revision: 2015-03-05_ -_Last updated: 2015-03-09_ -This doc: [tinyurl.com/ubernetes](http://tinyurl.com/ubernetes) -Slides: [tinyurl.com/ubernetes-slides](http://tinyurl.com/ubernetes-slides) - -## Introduction - -Today, each Kubernetes cluster is a relatively self-contained unit, -which typically runs in a single "on-premise" data centre or single -availability zone of a cloud provider (Google's GCE, Amazon's AWS, -etc). - -Several current and potential Kubernetes users and customers have -expressed a keen interest in tying together ("federating") multiple -clusters in some sensible way in order to enable the following kinds -of use cases (intentionally vague): - -1. _"Preferentially run my workloads in my on-premise cluster(s), but - automatically overflow to my cloud-hosted cluster(s) if I run out - of on-premise capacity"_. -1. _"Most of my workloads should run in my preferred cloud-hosted - cluster(s), but some are privacy-sensitive, and should be - automatically diverted to run in my secure, on-premise - cluster(s)"_. -1. _"I want to avoid vendor lock-in, so I want my workloads to run - across multiple cloud providers all the time. I change my set of - such cloud providers, and my pricing contracts with them, - periodically"_. -1. _"I want to be immune to any single data centre or cloud - availability zone outage, so I want to spread my service across - multiple such zones (and ideally even across multiple cloud - providers)."_ - -The above use cases are by necessity left imprecisely defined. The -rest of this document explores these use cases and their implications -in further detail, and compares a few alternative high level -approaches to addressing them. The idea of cluster federation has -informally become known as_ "Ubernetes"_. - -## Summary/TL;DR - -TBD - -## What exactly is a Kubernetes Cluster? - -A central design concept in Kubernetes is that of a _cluster_. While -loosely speaking, a cluster can be thought of as running in a single -data center, or cloud provider availability zone, a more precise -definition is that each cluster provides: - -1. a single Kubernetes API entry point, -1. a consistent, cluster-wide resource naming scheme -1. a scheduling/container placement domain -1. a service network routing domain -1. (in future) an authentication and authorization model. -1. .... - -The above in turn imply the need for a relatively performant, reliable -and cheap network within each cluster. - -There is also assumed to be some degree of failure correlation across -a cluster, i.e. whole clusters are expected to fail, at least -occasionally (due to cluster-wide power and network failures, natural -disasters etc). Clusters are often relatively homogenous in that all -compute nodes are typically provided by a single cloud provider or -hardware vendor, and connected by a common, unified network fabric. -But these are not hard requirements of Kubernetes. - -Other classes of Kubernetes deployments than the one sketched above -are technically feasible, but come with some challenges of their own, -and are not yet common or explicitly supported. - -More specifically, having a Kubernetes cluster span multiple -well-connected availability zones within a single geographical region -(e.g. US North East, UK, Japan etc) is worthy of further -consideration, in particular because it potentially addresses -some of these requirements. - -## What use cases require Cluster Federation? - -Let's name a few concrete use cases to aid the discussion: - -## 1.Capacity Overflow - -_"I want to preferentially run my workloads in my on-premise cluster(s), but automatically "overflow" to my cloud-hosted cluster(s) when I run out of on-premise capacity."_ - -This idea is known in some circles as "[cloudbursting](http://searchcloudcomputing.techtarget.com/definition/cloud-bursting)". - -**Clarifying questions:** What is the unit of overflow? Individual - pods? Probably not always. Replication controllers and their - associated sets of pods? Groups of replication controllers - (a.k.a. distributed applications)? How are persistent disks - overflowed? Can the "overflowed" pods communicate with their - brethren and sistren pods and services in the other cluster(s)? - Presumably yes, at higher cost and latency, provided that they use - external service discovery. Is "overflow" enabled only when creating - new workloads/replication controllers, or are existing workloads - dynamically migrated between clusters based on fluctuating available - capacity? If so, what is the desired behaviour, and how is it - achieved? How, if at all, does this relate to quota enforcement - (e.g. if we run out of on-premise capacity, can all or only some - quotas transfer to other, potentially more expensive off-premise - capacity?) - -It seems that most of this boils down to: - -1. **location affinity** (pods relative to each other, and to other - stateful services like persistent storage - how is this expressed - and enforced?) -1. **cross-cluster scheduling** (given location affinity constraints - and other scheduling policy, which resources are assigned to which - clusters, and by what?) -1. **cross-cluster service discovery** (how do pods in one cluster - discover and communicate with pods in another cluster?) -1. **cross-cluster migration** (how do compute and storage resources, - and the distributed applications to which they belong, move from - one cluster to another) - -## 2. Sensitive Workloads - -_"I want most of my workloads to run in my preferred cloud-hosted -cluster(s), but some are privacy-sensitive, and should be -automatically diverted to run in my secure, on-premise cluster(s). The -list of privacy-sensitive workloads changes over time, and they're -subject to external auditing."_ - -**Clarifying questions:** What kinds of rules determine which - workloads go where? Is a static mapping from container (or more - typically, replication controller) to cluster maintained and - enforced? If so, is it only enforced on startup, or are things - migrated between clusters when the mappings change? This starts to - look quite similar to "1. Capacity Overflow", and again seems to - boil down to: - -1. location affinity -1. cross-cluster scheduling -1. cross-cluster service discovery -1. cross-cluster migration -with the possible addition of: - -+ cross-cluster monitoring and auditing (which is conveniently deemed - to be outside the scope of this document, for the time being at - least) - -## 3. Vendor lock-in avoidance - -_"My CTO wants us to avoid vendor lock-in, so she wants our workloads -to run across multiple cloud providers at all times. She changes our -set of preferred cloud providers and pricing contracts with them -periodically, and doesn't want to have to communicate and manually -enforce these policy changes across the organization every time this -happens. She wants it centrally and automatically enforced, monitored -and audited."_ - -**Clarifying questions:** Again, I think that this can potentially be - reformulated as a Capacity Overflow problem - the fundamental - principles seem to be the same or substantially similar to those - above. - -## 4. "Unavailability Zones" - -_"I want to be immune to any single data centre or cloud availability -zone outage, so I want to spread my service across multiple such zones -(and ideally even across multiple cloud providers), and have my -service remain available even if one of the availability zones or -cloud providers "goes down"_. - -It seems useful to split this into two sub use cases: - -1. Multiple availability zones within a single cloud provider (across - which feature sets like private networks, load balancing, - persistent disks, data snapshots etc are typically consistent and - explicitly designed to inter-operate). -1. Multiple cloud providers (typically with inconsistent feature sets - and more limited interoperability). - -The single cloud provider case might be easier to implement (although -the multi-cloud provider implementation should just work for a single -cloud provider). Propose high-level design catering for both, with -initial implementation targeting single cloud provider only. - -**Clarifying questions:** -**How does global external service discovery work?** In the steady - state, which external clients connect to which clusters? GeoDNS or - similar? What is the tolerable failover latency if a cluster goes - down? Maybe something like (make up some numbers, notwithstanding - some buggy DNS resolvers, TTL's, caches etc) ~3 minutes for ~90% of - clients to re-issue DNS lookups and reconnect to a new cluster when - their home cluster fails is good enough for most Kubernetes users - (or at least way better than the status quo), given that these sorts - of failure only happen a small number of times a year? - -**How does dynamic load balancing across clusters work, if at all?** - One simple starting point might be "it doesn't". i.e. if a service - in a cluster is deemed to be "up", it receives as much traffic as is - generated "nearby" (even if it overloads). If the service is deemed - to "be down" in a given cluster, "all" nearby traffic is redirected - to some other cluster within some number of seconds (failover could - be automatic or manual). Failover is essentially binary. An - improvement would be to detect when a service in a cluster reaches - maximum serving capacity, and dynamically divert additional traffic - to other clusters. But how exactly does all of this work, and how - much of it is provided by Kubernetes, as opposed to something else - bolted on top (e.g. external monitoring and manipulation of GeoDNS)? - -**How does this tie in with auto-scaling of services?** More - specifically, if I run my service across _n_ clusters globally, and - one (or more) of them fail, how do I ensure that the remaining _n-1_ - clusters have enough capacity to serve the additional, failed-over - traffic? Either: - -1. I constantly over-provision all clusters by 1/n (potentially expensive), or -1. I "manually" update my replica count configurations in the - remaining clusters by 1/n when the failure occurs, and Kubernetes - takes care of the rest for me, or -1. Auto-scaling (not yet available) in the remaining clusters takes - care of it for me automagically as the additional failed-over - traffic arrives (with some latency). -1. I manually specify "additional resources to be provisioned" per - remaining cluster, possibly proportional to both the remaining functioning resources - and the unavailable resources in the failed cluster(s). - (All the benefits of over-provisioning, without expensive idle resources.) - -Doing nothing (i.e. forcing users to choose between 1 and 2 on their -own) is probably an OK starting point. Kubernetes autoscaling can get -us to 3 at some later date. - -Up to this point, this use case ("Unavailability Zones") seems materially different from all the others above. It does not require dynamic cross-cluster service migration (we assume that the service is already running in more than one cluster when the failure occurs). Nor does it necessarily involve cross-cluster service discovery or location affinity. As a result, I propose that we address this use case somewhat independently of the others (although I strongly suspect that it will become substantially easier once we've solved the others). - -All of the above (regarding "Unavailibility Zones") refers primarily -to already-running user-facing services, and minimizing the impact on -end users of those services becoming unavailable in a given cluster. -What about the people and systems that deploy Kubernetes services -(devops etc)? Should they be automatically shielded from the impact -of the cluster outage? i.e. have their new resource creation requests -automatically diverted to another cluster during the outage? While -this specific requirement seems non-critical (manual fail-over seems -relatively non-arduous, ignoring the user-facing issues above), it -smells a lot like the first three use cases listed above ("Capacity -Overflow, Sensitive Services, Vendor lock-in..."), so if we address -those, we probably get this one free of charge. - -## Core Challenges of Cluster Federation - -As we saw above, a few common challenges fall out of most of the use -cases considered above, namely: - -## Location Affinity - -Can the pods comprising a single distributed application be -partitioned across more than one cluster? More generally, how far -apart, in network terms, can a given client and server within a -distributed application reasonably be? A server need not necessarily -be a pod, but could instead be a persistent disk housing data, or some -other stateful network service. What is tolerable is typically -application-dependent, primarily influenced by network bandwidth -consumption, latency requirements and cost sensitivity. - -For simplicity, lets assume that all Kubernetes distributed -applications fall into one of three categories with respect to relative -location affinity: - -1. **"Strictly Coupled"**: Those applications that strictly cannot be - partitioned between clusters. They simply fail if they are - partitioned. When scheduled, all pods _must_ be scheduled to the - same cluster. To move them, we need to shut the whole distributed - application down (all pods) in one cluster, possibly move some - data, and then bring the up all of the pods in another cluster. To - avoid downtime, we might bring up the replacement cluster and - divert traffic there before turning down the original, but the - principle is much the same. In some cases moving the data might be - prohibitively expensive or time-consuming, in which case these - applications may be effectively _immovable_. -1. **"Strictly Decoupled"**: Those applications that can be - indefinitely partitioned across more than one cluster, to no - disadvantage. An embarrassingly parallel YouTube porn detector, - where each pod repeatedly dequeues a video URL from a remote work - queue, downloads and chews on the video for a few hours, and - arrives at a binary verdict, might be one such example. The pods - derive no benefit from being close to each other, or anything else - (other than the source of YouTube videos, which is assumed to be - equally remote from all clusters in this example). Each pod can be - scheduled independently, in any cluster, and moved at any time. -1. **"Preferentially Coupled"**: Somewhere between Coupled and Decoupled. These applications prefer to have all of their pods located in the same cluster (e.g. for failure correlation, network latency or bandwidth cost reasons), but can tolerate being partitioned for "short" periods of time (for example while migrating the application from one cluster to another). Most small to medium sized LAMP stacks with not-very-strict latency goals probably fall into this category (provided that they use sane service discovery and reconnect-on-fail, which they need to do anyway to run effectively, even in a single Kubernetes cluster). - -And then there's what I'll call _absolute_ location affinity. Some -applications are required to run in bounded geographical or network -topology locations. The reasons for this are typically -political/legislative (data privacy laws etc), or driven by network -proximity to consumers (or data providers) of the application ("most -of our users are in Western Europe, U.S. West Coast" etc). - -**Proposal:** First tackle Strictly Decoupled applications (which can - be trivially scheduled, partitioned or moved, one pod at a time). - Then tackle Preferentially Coupled applications (which must be - scheduled in totality in a single cluster, and can be moved, but - ultimately in total, and necessarily within some bounded time). - Leave strictly coupled applications to be manually moved between - clusters as required for the foreseeable future. - -## Cross-cluster service discovery - -I propose having pods use standard discovery methods used by external clients of Kubernetes applications (i.e. DNS). DNS might resolve to a public endpoint in the local or a remote cluster. Other than Strictly Coupled applications, software should be largely oblivious of which of the two occurs. -_Aside:_ How do we avoid "tromboning" through an external VIP when DNS -resolves to a public IP on the local cluster? Strictly speaking this -would be an optimization, and probably only matters to high bandwidth, -low latency communications. We could potentially eliminate the -trombone with some kube-proxy magic if necessary. More detail to be -added here, but feel free to shoot down the basic DNS idea in the mean -time. - -## Cross-cluster Scheduling - -This is closely related to location affinity above, and also discussed -there. The basic idea is that some controller, logically outside of -the basic kubernetes control plane of the clusters in question, needs -to be able to: - -1. Receive "global" resource creation requests. -1. Make policy-based decisions as to which cluster(s) should be used - to fulfill each given resource request. In a simple case, the - request is just redirected to one cluster. In a more complex case, - the request is "demultiplexed" into multiple sub-requests, each to - a different cluster. Knowledge of the (albeit approximate) - available capacity in each cluster will be required by the - controller to sanely split the request. Similarly, knowledge of - the properties of the application (Location Affinity class -- - Strictly Coupled, Strictly Decoupled etc, privacy class etc) will - be required. -1. Multiplex the responses from the individual clusters into an - aggregate response. - -## Cross-cluster Migration - -Again this is closely related to location affinity discussed above, -and is in some sense an extension of Cross-cluster Scheduling. When -certain events occur, it becomes necessary or desirable for the -cluster federation system to proactively move distributed applications -(either in part or in whole) from one cluster to another. Examples of -such events include: - -1. A low capacity event in a cluster (or a cluster failure). -1. A change of scheduling policy ("we no longer use cloud provider X"). -1. A change of resource pricing ("cloud provider Y dropped their prices - lets migrate there"). - -Strictly Decoupled applications can be trivially moved, in part or in whole, one pod at a time, to one or more clusters. -For Preferentially Decoupled applications, the federation system must first locate a single cluster with sufficient capacity to accommodate the entire application, then reserve that capacity, and incrementally move the application, one (or more) resources at a time, over to the new cluster, within some bounded time period (and possibly within a predefined "maintenance" window). -Strictly Coupled applications (with the exception of those deemed -completely immovable) require the federation system to: - -1. start up an entire replica application in the destination cluster -1. copy persistent data to the new application instance -1. switch traffic across -1. tear down the original application instance - -It is proposed that support for automated migration of Strictly Coupled applications be -deferred to a later date. - -## Other Requirements - -These are often left implicit by customers, but are worth calling out explicitly: - -1. Software failure isolation between Kubernetes clusters should be - retained as far as is practically possible. The federation system - should not materially increase the failure correlation across - clusters. For this reason the federation system should ideally be - completely independent of the Kubernetes cluster control software, - and look just like any other Kubernetes API client, with no special - treatment. If the federation system fails catastrophically, the - underlying Kubernetes clusters should remain independently usable. -1. Unified monitoring, alerting and auditing across federated Kubernetes clusters. -1. Unified authentication, authorization and quota management across - clusters (this is in direct conflict with failure isolation above, - so there are some tough trade-offs to be made here). - -## Proposed High-Level Architecture - -TBD: All very hand-wavey still, but some initial thoughts to get the conversation going... - -![image](federation-high-level-arch.png) - -## Ubernetes API - -This looks a lot like the existing Kubernetes API but is explicitly multi-cluster. - -+ Clusters become first class objects, which can be registered, listed, described, deregistered etc via the API. -+ Compute resources can be explicitly requested in specific clusters, or automatically scheduled to the "best" cluster by Ubernetes (by a pluggable Policy Engine). -+ There is a federated equivalent of a replication controller type, which is multicluster-aware, and delegates to cluster-specific replication controllers as required (e.g. a federated RC for n replicas might simply spawn multiple replication controllers in different clusters to do the hard work). -+ These federated replication controllers (and in fact all the - services comprising the Ubernetes Control Plane) have to run - somewhere. For high availability Ubernetes deployments, these - services may run in a dedicated Kubernetes cluster, not physically - co-located with any of the federated clusters. But for simpler - deployments, they may be run in one of the federated clusters (but - when that cluster goes down, Ubernetes is down, obviously). - -## Policy Engine and Migration/Replication Controllers - -The Policy Engine decides which parts of each application go into each -cluster at any point in time, and stores this desired state in the -Desired Federation State store (an etcd or -similar). Migration/Replication Controllers reconcile this against the -desired states stored in the underlying Kubernetes clusters (by -watching both, and creating or updating the underlying Replication -Controllers and related Services accordingly). - -## Authentication and Authorization - -This should ideally be delegated to some external auth system, shared -by the underlying clusters, to avoid duplication and inconsistency. -Either that, or we end up with multilevel auth. Local readonly -eventually consistent auth slaves in each cluster and in Ubernetes -could potentially cache auth, to mitigate an SPOF auth system. - -## Proposed Next Steps - -Identify concrete applications of each use case and configure a proof -of concept service that exercises the use case. For example, cluster -failure tolerance seems popular, so set up an apache frontend with -replicas in each of three availability zones with either an Amazon Elastic -Load Balancer or Google Cloud Load Balancer pointing at them? What -does the zookeeper config look like for N=3 across 3 AZs -- and how -does each replica find the other replicas and how do clients find -their primary zookeeper replica? And now how do I do a shared, highly -available redis database? - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/proposals/federation.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/proposals/federation.md?pixel)]() diff --git a/release-0.20.0/docs/proposals/high-availability.md b/release-0.20.0/docs/proposals/high-availability.md deleted file mode 100644 index 132023a7889..00000000000 --- a/release-0.20.0/docs/proposals/high-availability.md +++ /dev/null @@ -1,52 +0,0 @@ -# High Availability of Scheduling and Controller Components in Kubernetes -This document serves as a proposal for high availability of the scheduler and controller components in kubernetes. This proposal is intended to provide a simple High Availability api for kubernetes components with the potential to extend to services running on kubernetes. Those services would be subject to their own constraints. - -## Design Options -For complete reference see [this](https://www.ibm.com/developerworks/community/blogs/RohitShetty/entry/high_availability_cold_warm_hot?lang=en) - -1. Hot Standby: In this scenario, data and state are shared between the two components such that an immediate failure in one component causes the the standby daemon to take over exactly where the failed component had left off. This would be an ideal solution for kubernetes, however it poses a series of challenges in the case of controllers where component-state is cached locally and not persisted in a transactional way to a storage facility. This would also introduce additional load on the apiserver, which is not desirable. As a result, we are **NOT** planning on this approach at this time. - -2. **Warm Standby**: In this scenario there is only one active component acting as the master and additional components running but not providing service or responding to requests. Data and state are not shared between the active and standby components. When a failure occurs, the standby component that becomes the master must determine the current state of the system before resuming functionality. This is the approach that this proposal will leverage. - -3. Active-Active (Load Balanced): Clients can simply load-balance across any number of servers that are currently running. Their general availability can be continuously updated, or published, such that load balancing only occurs across active participants. This aspect of HA is outside of the scope of *this* proposal because there is already a partial implementation in the apiserver. - -## Design Discussion Notes on Leader Election -Implementation References: -* [zookeeper](http://zookeeper.apache.org/doc/trunk/recipes.html#sc_leaderElection) -* [etcd](https://groups.google.com/forum/#!topic/etcd-dev/EbAa4fjypb4) -* [initialPOC](https://github.com/rrati/etcd-ha) - -In HA, the apiserver will provide an api for sets of replicated clients to do master election: acquire the lease, renew the lease, and release the lease. This api is component agnostic, so a client will need to provide the component type and the lease duration when attempting to become master. The lease duration should be tuned per component. The apiserver will attempt to create a key in etcd based on the component type that contains the client's hostname/ip and port information. This key will be created with a ttl from the lease duration provided in the request. Failure to create this key means there is already a master of that component type, and the error from etcd will propagate to the client. Successfully creating the key means the client making the request is the master. Only the current master can renew the lease. When renewing the lease, the apiserver will update the existing key with a new ttl. The location in etcd for the HA keys is TBD. - -The first component to request leadership will become the master. All other components of that type will fail until the current leader releases the lease, or fails to renew the lease within the expiration time. On startup, all components should attempt to become master. The component that succeeds becomes the master, and should perform all functions of that component. The components that fail to become the master should not perform any tasks and sleep for their lease duration and then attempt to become the master again. A clean shutdown of the leader will cause a release of the lease and a new master will be elected. - -The component that becomes master should create a thread to manage the lease. This thread should be created with a channel that the main process can use to release the master lease. The master should release the lease in cases of an unrecoverable error and clean shutdown. Otherwise, this process will renew the lease and sleep, waiting for the next renewal time or notification to release the lease. If there is a failure to renew the lease, this process should force the entire component to exit. Daemon exit is meant to prevent potential split-brain conditions. Daemon restart is implied in this scenario, by either the init system (systemd), or possible watchdog processes. (See Design Discussion Notes) - -## Options added to components with HA functionality -Some command line options would be added to components that can do HA: - -* Lease Duration - How long a component can be master - -## Design Discussion Notes -Some components may run numerous threads in order to perform tasks in parallel. Upon losing master status, such components should exit instantly instead of attempting to gracefully shut down such threads. This is to ensure that, in the case there's some propagation delay in informing the threads they should stop, the lame-duck threads won't interfere with the new master. The component should exit with an exit code indicating that the component is not the master. Since all components will be run by systemd or some other monitoring system, this will just result in a restart. - -There is a short window after a new master acquires the lease, during which data from the old master might be committed. This is because there is currently no way to condition a write on its source being the master. Having the daemons exit shortens this window but does not eliminate it. A proper solution for this problem will be addressed at a later date. The proposed solution is: - -1. This requires transaction support in etcd (which is already planned - see [coreos/etcd#2675](https://github.com/coreos/etcd/pull/2675)) - -2. The entry in etcd that is tracking the lease for a given component (the "current master" entry) would have as its value the host:port of the lease-holder (as described earlier) and a sequence number. The sequence number is incremented whenever a new master gets the lease. - -3. Master replica is aware of the latest sequence number. - -4. Whenever master replica sends a mutating operation to the API server, it includes the sequence number. - -5. When the API server makes the corresponding write to etcd, it includes it in a transaction that does a compare-and-swap on the "current master" entry (old value == new value == host:port and sequence number from the replica that sent the mutating operation). This basically guarantees that if we elect the new master, all transactions coming from the old master will fail. You can think of this as the master attaching a "precondition" of its belief about who is the latest master. - -## Open Questions: -* Is there a desire to keep track of all nodes for a specific component type? - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/proposals/high-availability.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/proposals/high-availability.md?pixel)]() diff --git a/release-0.20.0/docs/replication-controller.md b/release-0.20.0/docs/replication-controller.md deleted file mode 100644 index 565df4539b0..00000000000 --- a/release-0.20.0/docs/replication-controller.md +++ /dev/null @@ -1,74 +0,0 @@ -# Replication Controller - -## What is a _replication controller_? - -A _replication controller_ ensures that a specified number of pod "replicas" are running at any one time. If there are too many, it will kill some. If there are too few, it will start more. Unlike in the case where a user directly created pods, a replication controller replaces pods that are deleted or terminated for any reason, such as in the case of node failure or disruptive node maintenance, such as a kernel upgrade. For this reason, we recommend that you use a replication controller even if your application requires only a single pod. Think of it similarly to a process supervisor, only it supervises multiple pods across multiple nodes instead of individual processes on a single node. A replication controller delegates local container restarts to some agent on the node (e.g., Kubelet or Docker). - -As discussed in [life of a pod](pod-states.md), `ReplicationController` is *only* appropriate for pods with `RestartPolicy = Always`. (Note: If `RestartPolicy` is not set, the default value is `Always`.) `ReplicationController` should refuse to instantiate any pod that has a different restart policy. As discussed in [issue #503](https://github.com/GoogleCloudPlatform/kubernetes/issues/503#issuecomment-50169443), we expect other types of controllers to be added to Kubernetes to handle other types of workloads, such as build/test and batch workloads, in the future. - -A replication controller will never terminate on its own, but it isn't expected to be as long-lived as services. Services may be composed of pods controlled by multiple replication controllers, and it is expected that many replication controllers may be created and destroyed over the lifetime of a service (for instance, to perform an update of pods that run the service). Both services themselves and their clients should remain oblivious to the replication controllers that maintain the pods of the services. - -## How does a replication controller work? - -### Pod template - -A replication controller creates new pods from a template, which is currently inline in the `ReplicationController` object, but which we plan to extract into its own resource [#170](https://github.com/GoogleCloudPlatform/kubernetes/issues/170). - -Rather than specifying the current desired state of all replicas, pod templates are like cookie cutters. Once a cookie has been cut, the cookie has no relationship to the cutter. There is no quantum entanglement. Subsequent changes to the template or even switching to a new template has no direct effect on the pods already created. Similarly, pods created by a replication controller may subsequently be updated directly. This is in deliberate contrast to pods, which do specify the current desired state of all containers belonging to the pod. This approach radically simplifies system semantics and increases the flexibility of the primitive, as demonstrated by the use cases explained below. - -Pods created by a replication controller are intended to be fungible and semantically identical, though their configurations may become heterogeneous over time. This is an obvious fit for replicated stateless servers, but replication controllers can also be used to maintain availability of master-elected, sharded, and worker-pool applications. Such applications should use dynamic work assignment mechanisms, such as the [etcd lock module](https://coreos.com/docs/distributed-configuration/etcd-modules/) or [RabbitMQ work queues](https://www.rabbitmq.com/tutorials/tutorial-two-python.html), as opposed to static/one-time customization of the configuration of each pod, which is considered an anti-pattern. Any pod customization performed, such as vertical auto-sizing of resources (e.g., cpu or memory), should be performed by another online controller process, not unlike the replication controller itself. - -### Labels - -The population of pods that a replication controller is monitoring is defined with a [label selector](labels.md#label-selectors), which creates a loosely coupled relationship between the controller and the pods controlled, in contrast to pods, which are more tightly coupled to their definition. We deliberately chose not to represent the set of pods controlled using a fixed-length array of pod specifications, because our experience is that that approach increases complexity of management operations, for both clients and the system. - -The replication controller should verify that the pods created from the specified template have labels that match its label selector. Though it isn't verified yet, you should also ensure that only one replication controller controls any given pod, by ensuring that the label selectors of replication controllers do not target overlapping sets. - -Note that replication controllers may themselves have labels and would generally carry the labels their corresponding pods have in common, but these labels do not affect the behavior of the replication controllers. - -Pods may be removed from a replication controller's target set by changing their labels. This technique may be used to remove pods from service for debugging, data recovery, etc. Pods that are removed in this way will be replaced automatically (assuming that the number of replicas is not also changed). - -Similarly, deleting a replication controller does not affect the pods it created. Its `replicas` field must first be set to 0 in order to delete the pods controlled. (Note that the client tool, kubectl, provides a single operation, [stop](kubectl_stop.md) to delete both the replication controller and the pods it controlls. However, there is no such operation in the API at the moment) - -## Responsibilities of the replication controller - -The replication controller simply ensures that the desired number of pods matches its label selector and are operational. Currently, only terminated pods are excluded from its count. In the future, [readiness](https://github.com/GoogleCloudPlatform/kubernetes/issues/620) and other information available from the system may be taken into account, we may add more controls over the replacement policy, and we plan to emit events that could be used by external clients to implement arbitrarily sophisticated replacement and/or scale-down policies. - -The replication controller is forever constrained to this narrow responsibility. It itself will not perform readiness nor liveness probes. Rather than performing auto-scaling, it is intended to be controlled by an external auto-scaler (as discussed in [#492](https://github.com/GoogleCloudPlatform/kubernetes/issues/492)), which would change its `replicas` field. We will not add scheduling policies (e.g., [spreading](https://github.com/GoogleCloudPlatform/kubernetes/issues/367#issuecomment-48428019)) to the replication controller. Nor should it verify that the pods controlled match the currently specified template, as that would obstruct auto-sizing and other automated processes. Similarly, completion deadlines, ordering dependencies, configuration expansion, and other features belong elsewhere. We even plan to factor out the mechanism for bulk pod creation ([#170](https://github.com/GoogleCloudPlatform/kubernetes/issues/170)). - -The replication controller is intended to be a composable building-block primitive. We expect higher-level APIs and/or tools to be built on top of it and other complementary primitives for user convenience in the future. The "macro" operations currently supported by kubectl (run, stop, scale, rolling-update) are proof-of-concept examples of this. For instance, we could imagine something like [Asgard](http://techblog.netflix.com/2012/06/asgard-web-based-cloud-management-and.html) managing replication controllers, auto-scalers, services, scheduling policies, canaries, etc. - -## Common usage patterns - -### Rescheduling - -As mentioned above, whether you have 1 pod you want to keep running, or 1000, a replication controller will ensure that the specified number of pods exists, even in the event of node failure or pod termination (e.g., due to an action by another control agent). - -### Scaling - -The replication controller makes it easy to scale the number of replicas up or down, either manually or by an auto-scaling control agent, by simply updating the `replicas` field. - -### Rolling updates - -The replication controller is designed to facilitate rolling updates to a service by replacing pods one-by-one. - -As explained in [#1353](https://github.com/GoogleCloudPlatform/kubernetes/issues/1353), the recommended approach is to create a new replication controller with 1 replica, scale the new (+1) and old (-1) controllers one by one, and then delete the old controller after it reaches 0 replicas. This predictably updates the set of pods regardless of unexpected failures. - -Ideally, the rolling update controller would take application readiness into account, and would ensure that a sufficient number of pods were productively serving at any given time. - -The two replication controllers would need to create pods with at least one differentiating label, such as the image tag of the primary container of the pod, since it is typically image updates that motivate rolling updates. - -Rolling update is implemented in the client tool -[kubectl](kubectl_rolling-update.md) - -### Multiple release tracks - -In addition to running multiple releases of an application while a rolling update is in progress, it's common to run multiple releases for an extended period of time, or even continuously, using multiple release tracks. The tracks would be differentiated by labels. - -For instance, a service might target all pods with `tier in (frontend), environment in (prod)`. Now say you have 10 replicated pods that make up this tier. But you want to be able to 'canary' a new version of this component. You could set up a replication controller with `replicas` set to 9 for the bulk of the replicas, with labels `tier=frontend, environment=prod, track=stable`, and another replication controller with `replicas` set to 1 for the canary, with labels `tier=frontend, environment=prod, track=canary`. Now the service is covering both the canary and non-canary pods. But you can mess with the replication controllers separately to test things out, monitor the results, etc. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/replication-controller.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/replication-controller.md?pixel)]() diff --git a/release-0.20.0/docs/resource_quota_admin.md b/release-0.20.0/docs/resource_quota_admin.md deleted file mode 100644 index d2904b2cc76..00000000000 --- a/release-0.20.0/docs/resource_quota_admin.md +++ /dev/null @@ -1,107 +0,0 @@ -# Administering Resource Quotas - -Kubernetes can limit both the number of objects created in a namespace, and the -total amount of resources requested by pods in a namespace. This facilitates -sharing of a single Kubernetes cluster by several teams or tenants, each in -a namespace. - -## Enabling Resource Quota - -Resource Quota support is enabled by default for many kubernetes distributions. It is -enabled when the apiserver `--admission_control=` flag has `ResourceQuota` as -one of its arguments. - -Resource Quota is enforced in a particular namespace when there is a -`ResourceQuota` object in that namespace. There should be at most one -`ResourceQuota` object in a namespace. - -## Object Count Quota -The number of objects of a given type can be restricted. The following types -are supported: - -| ResourceName | Description | -| ------------ | ----------- | -| pods | Total number of pods | -| services | Total number of services | -| replicationcontrollers | Total number of replication controllers | -| resourcequotas | Total number of resource quotas | -| secrets | Total number of secrets | -| persistentvolumeclaims | Total number of persistent volume claims | - -For example, `pods` quota counts and enforces a maximum on the number of `pods` -created in a single namespace. - -## Compute Resource Quota -The total number of objects of a given type can be restricted. The following types -are supported: - -| ResourceName | Description | -| ------------ | ----------- | -| cpu | Total cpu limits of containers | -| memory | Total memory usage limits of containers -| `example.com/customresource` | Total of `resources.limits."example.com/customresource"` of containers | - -For example, `cpu` quota sums up the `resources.limits.cpu` fields of every -container of every pod in the namespace, and enforces a maximum on that sum. - -Any resource that is not part of core Kubernetes must follow the resource naming convention prescribed by Kubernetes. - -This means the resource must have a fully-qualified name (i.e. mycompany.org/shinynewresource) - -## Viewing and Setting Quotas -Kubectl supports creating, updating, and viewing quotas -``` -$ kubectl namespace myspace -$ cat < quota.json -{ - "apiVersion": "v1", - "kind": "ResourceQuota", - "metadata": { - "name": "quota", - }, - "spec": { - "hard": { - "memory": "1Gi", - "cpu": "20", - "pods": "10", - "services": "5", - "replicationcontrollers":"20", - "resourcequotas":"1", - }, - } -} -EOF -$ kubectl create -f quota.json -$ kubectl get quota -NAME -quota -$ kubectl describe quota quota -Name: quota -Resource Used Hard --------- ---- ---- -cpu 0m 20 -memory 0 1Gi -pods 5 10 -replicationcontrollers 5 20 -resourcequotas 1 1 -services 3 5 -``` - -## Quota and Cluster Capacity -Resource Quota objects are independent of the Cluster Capacity. They are -expressed in absolute units. - -Sometimes more complex policies may be desired, such as: - - proportionally divide total cluster resources among several teams. - - allow each tenant to grow resource usage as needed, but have a generous - limit to prevent accidental resource exhaustion. - -Such policies could be implemented using ResourceQuota as a building-block, by -writing a 'controller' which watches the quota usage and adjusts the quota -hard limits of each namespace. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/resource_quota_admin.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/resource_quota_admin.md?pixel)]() diff --git a/release-0.20.0/docs/resources.md b/release-0.20.0/docs/resources.md deleted file mode 100644 index f4775200068..00000000000 --- a/release-0.20.0/docs/resources.md +++ /dev/null @@ -1,214 +0,0 @@ -**Note that the model described in this document has not yet been implemented. The tracking issue for implementation of this model is [#168](https://github.com/GoogleCloudPlatform/kubernetes/issues/168). Currently, only memory and cpu limits on containers (not pods) are supported. "memory" is in bytes and "cpu" is in milli-cores.** - -# The Kubernetes resource model - -To do good pod placement, Kubernetes needs to know how big pods are, as well as the sizes of the nodes onto which they are being placed. The definition of "how big" is given by the Kubernetes resource model — the subject of this document. - -The resource model aims to be: -* simple, for common cases; -* extensible, to accommodate future growth; -* regular, with few special cases; and -* precise, to avoid misunderstandings and promote pod portability. - -## The resource model -A Kubernetes _resource_ is something that can be requested by, allocated to, or consumed by a pod or container. Examples include memory (RAM), CPU, disk-time, and network bandwidth. - -Once resources on a node have been allocated to one pod, they should not be allocated to another until that pod is removed or exits. This means that Kubernetes schedulers should ensure that the sum of the resources allocated (requested and granted) to its pods never exceeds the usable capacity of the node. Testing whether a pod will fit on a node is called _feasibility checking_. - -Note that the resource model currently prohibits over-committing resources; we will want to relax that restriction later. - -### Resource types - -All resources have a _type_ that is identified by their _typename_ (a string, e.g., "memory"). Several resource types are predefined by Kubernetes (a full list is below), although only two will be supported at first: CPU and memory. Users and system administrators can define their own resource types if they wish (e.g., Hadoop slots). - -A fully-qualified resource typename is constructed from a DNS-style _subdomain_, followed by a slash `/`, followed by a name. -* The subdomain must conform to [RFC 1123](http://www.ietf.org/rfc/rfc1123.txt) (e.g., `kubernetes.io`, `example.com`). -* The name must be not more than 63 characters, consisting of upper- or lower-case alphanumeric characters, with the `-`, `_`, and `.` characters allowed anywhere except the first or last character. -* As a shorthand, any resource typename that does not start with a subdomain and a slash will automatically be prefixed with the built-in Kubernetes _namespace_, `kubernetes.io/` in order to fully-qualify it. This namespace is reserved for code in the open source Kubernetes repository; as a result, all user typenames MUST be fully qualified, and cannot be created in this namespace. - -Some example typenames include `memory` (which will be fully-qualified as `kubernetes.io/memory`), and `example.com/Shiny_New-Resource.Type`. - -For future reference, note that some resources, such as CPU and network bandwidth, are _compressible_, which means that their usage can potentially be throttled in a relatively benign manner. All other resources are _incompressible_, which means that any attempt to throttle them is likely to cause grief. This distinction will be important if a Kubernetes implementation supports over-committing of resources. - -### Resource quantities - -Initially, all Kubernetes resource types are _quantitative_, and have an associated _unit_ for quantities of the associated resource (e.g., bytes for memory, bytes per seconds for bandwidth, instances for software licences). The units will always be a resource type's natural base units (e.g., bytes, not MB), to avoid confusion between binary and decimal multipliers and the underlying unit multiplier (e.g., is memory measured in MiB, MB, or GB?). - -Resource quantities can be added and subtracted: for example, a node has a fixed quantity of each resource type that can be allocated to pods/containers; once such an allocation has been made, the allocated resources cannot be made available to other pods/containers without over-committing the resources. - -To make life easier for people, quantities can be represented externally as unadorned integers, or as fixed-point integers with one of these SI suffices (E, P, T, G, M, K, m) or their power-of-two equivalents (Ei, Pi, Ti, Gi, Mi, Ki). For example, the following represent roughly the same value: 128974848, "129e6", "129M" , "123Mi". Small quantities can be represented directly as decimals (e.g., 0.3), or using milli-units (e.g., "300m"). - * "Externally" means in user interfaces, reports, graphs, and in JSON or YAML resource specifications that might be generated or read by people. - * Case is significant: "m" and "M" are not the same, so "k" is not a valid SI suffix. There are no power-of-two equivalents for SI suffixes that represent multipliers less than 1. - * These conventions only apply to resource quantities, not arbitrary values. - -Internally (i.e., everywhere else), Kubernetes will represent resource quantities as integers so it can avoid problems with rounding errors, and will not use strings to represent numeric values. To achieve this, quantities that naturally have fractional parts (e.g., CPU seconds/second) will be scaled to integral numbers of milli-units (e.g., milli-CPUs) as soon as they are read in. Internal APIs, data structures, and protobufs will use these scaled integer units. Raw measurement data such as usage may still need to be tracked and calculated using floating point values, but internally they should be rescaled to avoid some values being in milli-units and some not. - * Note that reading in a resource quantity and writing it out again may change the way its values are represented, and truncate precision (e.g., 1.0001 may become 1.000), so comparison and difference operations (e.g., by an updater) must be done on the internal representations. - * Avoiding milli-units in external representations has advantages for people who will use Kubernetes, but runs the risk of developers forgetting to rescale or accidentally using floating-point representations. That seems like the right choice. We will try to reduce the risk by providing libraries that automatically do the quantization for JSON/YAML inputs. - -### Resource specifications - -Both users and a number of system components, such as schedulers, (horizontal) auto-scalers, (vertical) auto-sizers, load balancers, and worker-pool managers need to reason about resource requirements of workloads, resource capacities of nodes, and resource usage. Kubernetes divides specifications of *desired state*, aka the Spec, and representations of *current state*, aka the Status. Resource requirements and total node capacity fall into the specification category, while resource usage, characterizations derived from usage (e.g., maximum usage, histograms), and other resource demand signals (e.g., CPU load) clearly fall into the status category and are discussed in the Appendix for now. - -Resource requirements for a container or pod should have the following form: -``` -resourceRequirementSpec: [ - request: [ cpu: 2.5, memory: "40Mi" ], - limit: [ cpu: 4.0, memory: "99Mi" ], -] -``` -Where: -* _request_ [optional]: the amount of resources being requested, or that were requested and have been allocated. Scheduler algorithms will use these quantities to test feasibility (whether a pod will fit onto a node). If a container (or pod) tries to use more resources than its _request_, any associated SLOs are voided — e.g., the program it is running may be throttled (compressible resource types), or the attempt may be denied. If _request_ is omitted for a container, it defaults to _limit_ if that is explicitly specified, otherwise to an implementation-defined value; this will always be 0 for a user-defined resource type. If _request_ is omitted for a pod, it defaults to the sum of the (explicit or implicit) _request_ values for the containers it encloses. - -* _limit_ [optional]: an upper bound or cap on the maximum amount of resources that will be made available to a container or pod; if a container or pod uses more resources than its _limit_, it may be terminated. The _limit_ defaults to "unbounded"; in practice, this probably means the capacity of an enclosing container, pod, or node, but may result in non-deterministic behavior, especially for memory. - -Total capacity for a node should have a similar structure: -``` -resourceCapacitySpec: [ - total: [ cpu: 12, memory: "128Gi" ] -] -``` -Where: -* _total_: the total allocatable resources of a node. Initially, the resources at a given scope will bound the resources of the sum of inner scopes. - -#### Notes - - * It is an error to specify the same resource type more than once in each list. - - * It is an error for the _request_ or _limit_ values for a pod to be less than the sum of the (explicit or defaulted) values for the containers it encloses. (We may relax this later.) - - * If multiple pods are running on the same node and attempting to use more resources than they have requested, the result is implementation-defined. For example: unallocated or unused resources might be spread equally across claimants, or the assignment might be weighted by the size of the original request, or as a function of limits, or priority, or the phase of the moon, perhaps modulated by the direction of the tide. Thus, although it's not mandatory to provide a _request_, it's probably a good idea. (Note that the _request_ could be filled in by an automated system that is observing actual usage and/or historical data.) - - * Internally, the Kubernetes master can decide the defaulting behavior and the kubelet implementation may expected an absolute specification. For example, if the master decided that "the default is unbounded" it would pass 2^64 to the kubelet. - - - -## Kubernetes-defined resource types -The following resource types are predefined ("reserved") by Kubernetes in the `kubernetes.io` namespace, and so cannot be used for user-defined resources. Note that the syntax of all resource types in the resource spec is deliberately similar, but some resource types (e.g., CPU) may receive significantly more support than simply tracking quantities in the schedulers and/or the Kubelet. - -### Processor cycles - * Name: `cpu` (or `kubernetes.io/cpu`) - * Units: Kubernetes Compute Unit seconds/second (i.e., CPU cores normalized to a canonical "Kubernetes CPU") - * Internal representation: milli-KCUs - * Compressible? yes - * Qualities: this is a placeholder for the kind of thing that may be supported in the future — see [#147](https://github.com/GoogleCloudPlatform/kubernetes/issues/147) - * [future] `schedulingLatency`: as per lmctfy - * [future] `cpuConversionFactor`: property of a node: the speed of a CPU core on the node's processor divided by the speed of the canonical Kubernetes CPU (a floating point value; default = 1.0). - -To reduce performance portability problems for pods, and to avoid worse-case provisioning behavior, the units of CPU will be normalized to a canonical "Kubernetes Compute Unit" (KCU, pronounced ˈkoÍokoÍžo), which will roughly be equivalent to a single CPU hyperthreaded core for some recent x86 processor. The normalization may be implementation-defined, although some reasonable defaults will be provided in the open-source Kubernetes code. - -Note that requesting 2 KCU won't guarantee that precisely 2 physical cores will be allocated — control of aspects like this will be handled by resource _qualities_ (a future feature). - - -### Memory - * Name: `memory` (or `kubernetes.io/memory`) - * Units: bytes - * Compressible? no (at least initially) - -The precise meaning of what "memory" means is implementation dependent, but the basic idea is to rely on the underlying `memcg` mechanisms, support, and definitions. - -Note that most people will want to use power-of-two suffixes (Mi, Gi) for memory quantities -rather than decimal ones: "64MiB" rather than "64MB". - - -## Resource metadata -A resource type may have an associated read-only ResourceType structure, that contains metadata about the type. For example: -``` -resourceTypes: [ - "kubernetes.io/memory": [ - isCompressible: false, ... - ] - "kubernetes.io/cpu": [ - isCompressible: true, internalScaleExponent: 3, ... - ] - "kubernetes.io/disk-space": [ ... } -] -``` - -Kubernetes will provide ResourceType metadata for its predefined types. If no resource metadata can be found for a resource type, Kubernetes will assume that it is a quantified, incompressible resource that is not specified in milli-units, and has no default value. - -The defined properties are as follows: - -| field name | type | contents | -| ---------- | ---- | -------- | -| name | string, required | the typename, as a fully-qualified string (e.g., `kubernetes.io/cpu`) | -| internalScaleExponent | int, default=0 | external values are multiplied by 10 to this power for internal storage (e.g., 3 for milli-units) | -| units | string, required | format: `unit* [per unit+]` (e.g., `second`, `byte per second`). An empty unit field means "dimensionless". | -| isCompressible | bool, default=false | true if the resource type is compressible | -| defaultRequest | string, default=none | in the same format as a user-supplied value | -| _[future]_ quantization | number, default=1 | smallest granularity of allocation: requests may be rounded up to a multiple of this unit; implementation-defined unit (e.g., the page size for RAM). | - - -# Appendix: future extensions - -The following are planned future extensions to the resource model, included here to encourage comments. - -## Usage data - -Because resource usage and related metrics change continuously, need to be tracked over time (i.e., historically), can be characterized in a variety of ways, and are fairly voluminous, we will not include usage in core API objects, such as [Pods](pods.md) and Nodes, but will provide separate APIs for accessing and managing that data. See the Appendix for possible representations of usage data, but the representation we'll use is TBD. - -Singleton values for observed and predicted future usage will rapidly prove inadequate, so we will support the following structure for extended usage information: - -``` -resourceStatus: [ - usage: [ cpu: , memory: ], - maxusage: [ cpu: , memory: ], - predicted: [ cpu: , memory: ], -] -``` - -where a `` or `` structure looks like this: -``` -{ - mean: # arithmetic mean - max: # minimum value - min: # maximum value - count: # number of data points - percentiles: [ # map from %iles to values - "10": <10th-percentile-value>, - "50": , - "99": <99th-percentile-value>, - "99.9": <99.9th-percentile-value>, - ... - ] - } -``` -All parts of this structure are optional, although we strongly encourage including quantities for 50, 90, 95, 99, 99.5, and 99.9 percentiles. _[In practice, it will be important to include additional info such as the length of the time window over which the averages are calculated, the confidence level, and information-quality metrics such as the number of dropped or discarded data points.]_ -and predicted - -## Future resource types - -### _[future] Network bandwidth_ - * Name: "network-bandwidth" (or `kubernetes.io/network-bandwidth`) - * Units: bytes per second - * Compressible? yes - -### _[future] Network operations_ - * Name: "network-iops" (or `kubernetes.io/network-iops`) - * Units: operations (messages) per second - * Compressible? yes - -### _[future] Storage space_ - * Name: "storage-space" (or `kubernetes.io/storage-space`) - * Units: bytes - * Compressible? no - -The amount of secondary storage space available to a container. The main target is local disk drives and SSDs, although this could also be used to qualify remotely-mounted volumes. Specifying whether a resource is a raw disk, an SSD, a disk array, or a file system fronting any of these, is left for future work. - -### _[future] Storage time_ - * Name: storage-time (or `kubernetes.io/storage-time`) - * Units: seconds per second of disk time - * Internal representation: milli-units - * Compressible? yes - -This is the amount of time a container spends accessing disk, including actuator and transfer time. A standard disk drive provides 1.0 diskTime seconds per second. - -### _[future] Storage operations_ - * Name: "storage-iops" (or `kubernetes.io/storage-iops`) - * Units: operations per second - * Compressible? yes - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/resources.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/resources.md?pixel)]() diff --git a/release-0.20.0/docs/roadmap.md b/release-0.20.0/docs/roadmap.md deleted file mode 100644 index 32d4e6c4bd5..00000000000 --- a/release-0.20.0/docs/roadmap.md +++ /dev/null @@ -1,97 +0,0 @@ -# Kubernetes v1 - -Updated May 28, 2015 - -This document is intended to capture the set of supported use cases, features, -docs, and patterns that we feel are required to call Kubernetes “feature -complete†for a 1.0 release candidate. - -This list does not emphasize the bug fixes and stabilization that will be required to take it all the way to -production ready. Please see the [Github issues] (https://github.com/GoogleCloudPlatform/kubernetes/issues) for a more detailed view. - -This is a living document, where suggested changes can be made via a pull request. - -## Target workloads - -Most realistic examples of production services include a load-balanced web -frontend exposed to the public Internet, with a stateful backend, such as a -clustered database or key-value store. We will target such workloads for our -1.0 release. - -## v1 APIs -For existing and future workloads, we want to provide a consistent, stable set of APIs, over which developers can build and extend Kubernetes. This includes input validation, a consistent API structure, clean semantics, and improved diagnosability of the system. -||||||| merged common ancestors -## APIs and core features -1. Consistent v1 API - - Status: DONE. [v1beta3](http://kubernetesio.blogspot.com/2015/04/introducing-kubernetes-v1beta3.html) was developed as the release candidate for the v1 API. -2. Multi-port services for apps which need more than one port on the same portal IP ([#1802](https://github.com/GoogleCloudPlatform/kubernetes/issues/1802)) - - Status: DONE. Released in 0.15.0 -3. Nominal services for applications which need one stable IP per pod instance ([#260](https://github.com/GoogleCloudPlatform/kubernetes/issues/260)) - - Status: #2585 covers some design options. -4. API input is scrubbed of status fields in favor of a new API to set status ([#4248](https://github.com/GoogleCloudPlatform/kubernetes/issues/4248)) - - Status: DONE -5. Input validation reporting versioned field names ([#3084](https://github.com/GoogleCloudPlatform/kubernetes/issues/3084)) - - Status: in progress -6. Error reporting: Report common problems in ways that users can discover - - Status: -7. Event management: Make events usable and useful - - Status: -8. Persistent storage support ([#5105](https://github.com/GoogleCloudPlatform/kubernetes/issues/5105)) - - Status: in progress -9. Allow nodes to join/leave a cluster ([#6087](https://github.com/GoogleCloudPlatform/kubernetes/issues/6087),[#3168](https://github.com/GoogleCloudPlatform/kubernetes/issues/3168)) - - Status: in progress ([#6949](https://github.com/GoogleCloudPlatform/kubernetes/pull/6949)) -10. Handle node death - - Status: mostly covered by nodes joining/leaving a cluster -11. Allow live cluster upgrades ([#6075](https://github.com/GoogleCloudPlatform/kubernetes/issues/6075),[#6079](https://github.com/GoogleCloudPlatform/kubernetes/issues/6079)) - - Status: design in progress -12. Allow kernel upgrades - - Status: mostly covered by nodes joining/leaving a cluster, need demonstration -13. Allow rolling-updates to fail gracefully ([#1353](https://github.com/GoogleCloudPlatform/kubernetes/issues/1353)) - - Status: -14. Easy .dockercfg - - Status: -15. Demonstrate cluster stability over time - - Status -16. Kubelet use the kubernetes API to fetch jobs to run (instead of etcd) on supported platforms - - Status: DONE - -## Reliability and performance - -1. Restart system components in case of crash (#2884) - - Status: in progress -2. Scale to 100 nodes (#3876) - - Status: in progress -3. Scale to 30-50 pods (1-2 containers each) per node (#4188) - - Status: -4. Scheduling throughput: 99% of scheduling decisions made in less than 1s on 100 node, 3000 pod cluster; linear time to number of nodes and pods (#3954) -5. Startup time: 99% of end-to-end pod startup time with prepulled images is less than 5s on 100 node, 3000 pod cluster; linear time to number of nodes and pods (#3952, #3954) - - Status: -6. API performance: 99% of API calls return in less than 1s; constant time to number of nodes and pods (#4521) - - Status: -7. Manage and report disk space on nodes (#4135) - - Status: in progress -8. API test coverage more than 85% in e2e tests - - Status: - -In addition, we will provide versioning and deprecation policies for the APIs. - -## Cluster Environment -Currently, a cluster is a set of nodes (VMs, machines), managed by a master, running a version of Kubernetes. This master is the cluster-level control-plane. For the purpose of running production workloads, members of the cluster must be serviceable and upgradeable. - -## Micro-services and Resources -For applications / micro-services that run on Kubernetes, we want deployments to be easy but powerful. An Operations user should be able to launch a micro-service, letting the scheduler find the right placement. That micro-service should be able to require “pet storage†resources, fulfilled by external storage and with help from the cluster. We also want to improve the tools, experience for how users can roll-out applications through patterns like canary deployments. - -## Performance and Reliability -The system should be performant, especially from the perspective of micro-service running on top of the cluster and for Operations users. As part of being production grade, the system should have a measured availability and be resilient to failures, including fatal failures due to hardware. - -In terms of performance, the objectives include: -- API call return times at 99%tile ([#4521](https://github.com/GoogleCloudPlatform/kubernetes/issues/4521)) -- scale to 100 nodes with 30-50 pods (1-2 containers) per node -- scheduling throughput at the 99%tile ([#3954](https://github.com/GoogleCloudPlatform/kubernetes/issues/3954)) -- startup time at the 99%tile ([#3552](https://github.com/GoogleCloudPlatform/kubernetes/issues/3952)) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/roadmap.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/roadmap.md?pixel)]() diff --git a/release-0.20.0/docs/salt.md b/release-0.20.0/docs/salt.md deleted file mode 100644 index 95bee8c588b..00000000000 --- a/release-0.20.0/docs/salt.md +++ /dev/null @@ -1,104 +0,0 @@ -# Using Salt to configure Kubernetes - -The Kubernetes cluster can be configured using Salt. - -The Salt scripts are shared across multiple hosting providers, so it's important to understand some background information prior to making a modification to ensure your changes do not break hosting Kubernetes across multiple environments. Depending on where you host your Kubernetes cluster, you may be using different operating systems and different networking configurations. As a result, it's important to understand some background information before making Salt changes in order to minimize introducing failures for other hosting providers. - -## Salt cluster setup - -The **salt-master** service runs on the kubernetes-master node [(except on the default GCE setup)](#standalone-salt-configuration-on-gce). - -The **salt-minion** service runs on the kubernetes-master node and each kubernetes-minion node in the cluster. - -Each salt-minion service is configured to interact with the **salt-master** service hosted on the kubernetes-master via the **master.conf** file [(except on GCE)](#standalone-salt-configuration-on-gce). - -``` -[root@kubernetes-master] $ cat /etc/salt/minion.d/master.conf -master: kubernetes-master -``` -The salt-master is contacted by each salt-minion and depending upon the machine information presented, the salt-master will provision the machine as either a kubernetes-master or kubernetes-minion with all the required capabilities needed to run Kubernetes. - -If you are running the Vagrant based environment, the **salt-api** service is running on the kubernetes-master. It is configured to enable the vagrant user to introspect the salt cluster in order to find out about machines in the Vagrant environment via a REST API. - -## Standalone Salt Configuration on GCE - -On GCE, the master and nodes are all configured as [standalone minions](http://docs.saltstack.com/en/latest/topics/tutorials/standalone_minion.html). The configuration for each VM is derived from the VM's [instance metadata](https://cloud.google.com/compute/docs/metadata) and then stored in Salt grains (`/etc/salt/minion.d/grains.conf`) and pillars (`/srv/salt-overlay/pillar/cluster-params.sls`) that local Salt uses to enforce state. - -All remaining sections that refer to master/minion setups should be ignored for GCE. One fallout of the GCE setup is that the Salt mine doesn't exist - there is no sharing of configuration amongst nodes. - -## Salt security - -*(Not applicable on default GCE setup.)* - -Security is not enabled on the salt-master, and the salt-master is configured to auto-accept incoming requests from minions. It is not recommended to use this security configuration in production environments without deeper study. (In some environments this isn't as bad as it might sound if the salt master port isn't externally accessible and you trust everyone on your network.) - -``` -[root@kubernetes-master] $ cat /etc/salt/master.d/auto-accept.conf -open_mode: True -auto_accept: True -``` - -## Salt minion configuration - -Each minion in the salt cluster has an associated configuration that instructs the salt-master how to provision the required resources on the machine. - -An example file is presented below using the Vagrant based environment. - -``` -[root@kubernetes-master] $ cat /etc/salt/minion.d/grains.conf -grains: - etcd_servers: $MASTER_IP - cloud_provider: vagrant - roles: - - kubernetes-master -``` - -Each hosting environment has a slightly different grains.conf file that is used to build conditional logic where required in the Salt files. - -The following enumerates the set of defined key/value pairs that are supported today. If you add new ones, please make sure to update this list. - -Key | Value -------------- | ------------- -`api_servers` | (Optional) The IP address / host name where a kubelet can get read-only access to kube-apiserver -`cbr-cidr` | (Optional) The minion IP address range used for the docker container bridge. -`cloud` | (Optional) Which IaaS platform is used to host kubernetes, *gce*, *azure*, *aws*, *vagrant* -`etcd_servers` | (Optional) Comma-delimited list of IP addresses the kube-apiserver and kubelet use to reach etcd. Uses the IP of the first machine in the kubernetes_master role, or 127.0.0.1 on GCE. -`hostnamef` | (Optional) The full host name of the machine, i.e. uname -n -`node_ip` | (Optional) The IP address to use to address this node -`hostname_override` | (Optional) Mapped to the kubelet hostname_override -`network_mode` | (Optional) Networking model to use among nodes: *openvswitch* -`networkInterfaceName` | (Optional) Networking interface to use to bind addresses, default value *eth0* -`publicAddressOverride` | (Optional) The IP address the kube-apiserver should use to bind against for external read-only access -`roles` | (Required) 1. `kubernetes-master` means this machine is the master in the kubernetes cluster. 2. `kubernetes-pool` means this machine is a kubernetes-minion. Depending on the role, the Salt scripts will provision different resources on the machine. - -These keys may be leveraged by the Salt sls files to branch behavior. - -In addition, a cluster may be running a Debian based operating system or Red Hat based operating system (Centos, Fedora, RHEL, etc.). As a result, its important to sometimes distinguish behavior based on operating system using if branches like the following. - -``` -{% if grains['os_family'] == 'RedHat' %} -// something specific to a RedHat environment (Centos, Fedora, RHEL) where you may use yum, systemd, etc. -{% else %} -// something specific to Debian environment (apt-get, initd) -{% endif %} -``` - -## Best Practices - -1. When configuring default arguments for processes, its best to avoid the use of EnvironmentFiles (Systemd in Red Hat environments) or init.d files (Debian distributions) to hold default values that should be common across operating system environments. This helps keep our Salt template files easy to understand for editors that may not be familiar with the particulars of each distribution. - -## Future enhancements (Networking) - -Per pod IP configuration is provider specific, so when making networking changes, its important to sand-box these as all providers may not use the same mechanisms (iptables, openvswitch, etc.) - -We should define a grains.conf key that captures more specifically what network configuration environment is being used to avoid future confusion across providers. - -## Further reading - -The [cluster/saltbase](../cluster/saltbase) tree has more details on the current SaltStack configuration. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/salt.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/salt.md?pixel)]() diff --git a/release-0.20.0/docs/secrets.md b/release-0.20.0/docs/secrets.md deleted file mode 100644 index 69e25e0972a..00000000000 --- a/release-0.20.0/docs/secrets.md +++ /dev/null @@ -1,470 +0,0 @@ -# Secrets - -Objects of type `secret` are intended to hold sensitive information, such as -passwords, OAuth tokens, and ssh keys. Putting this information in a `secret` -is safer and more flexible than putting it verbatim in a `pod` definition or in -a docker image. - -## Overview of Secrets - - -Creation of secrets can be manual (done by the user) or automatic (done by -automation built into the cluster). - -A secret can be used with a pod in two ways: either as files in a volume mounted on one or more of -its containers, or used by kubelet when pulling images for the pod. - -To use a secret, a pod needs to reference the secret. This reference -can likewise be added manually or automatically. - -A single Pod may use various combination of the above options. - -### Service Accounts Automatically Create and Use Secrets with API Credentials - -Kubernetes automatically creates secrets which contain credentials for -accessing the API and it automatically modifies your pods to use this type of -secret. - -The automatic creation and use of API credentials can be disabled or overridden -if desired. However, if all you need to do is securely access the apiserver, -this is the recommended workflow. - -See the [Service Account](service_accounts.md) documentation for more -information on how Service Accounts work. - -### Creating a Secret Manually - -This is an example of a simple secret, in yaml format: -```yaml -apiVersion: v1 -kind: Secret -metadata: - name: mysecret -type: Opaque -data: - password: dmFsdWUtMg0K - username: dmFsdWUtMQ0K -``` - -The data field is a map. Its keys must match -[DNS_SUBDOMAIN](design/identifiers.md), except that leading dots are also -allowed. The values are arbitrary data, encoded using base64. The values of -username and password in the example above, before base64 encoding, -are `value-1` and `value-2`, respectively, with carriage return and newline characters at the end. - -Create the secret using [`kubectl create`](kubectl-create.md). - -Once the secret is created, you can: - - create pods that automatically use it via a [Service Account](service_accounts.md). - - modify your pod specification to use the secret - -### Manually specifying a Secret to be Mounted on a Pod - -This is an example of a pod that mounts a secret in a volume: -```json -{ - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "name": "mypod", - "namespace": "myns" - }, - "spec": { - "containers": [{ - "name": "mypod", - "image": "redis", - "volumeMounts": [{ - "name": "foo", - "mountPath": "/etc/foo", - "readOnly": true - }] - }], - "volumes": [{ - "name": "foo", - "secret": { - "secretName": "mysecret" - } - }] - } -} -``` - -Each secret you want to use needs its own `spec.volumes`. - -If there are multiple containers in the pod, then each container needs its -own `volumeMounts` block, but only one `spec.volumes` is needed per secret. - -You can package many files into one secret, or use many secrets, -whichever is convenient. - -### Manually specifying an imagePullSecret -Use of imagePullSecrets is desribed in the [images documentation]( -images.md#specifying-imagepullsecrets-on-a-pod) -### Automatic use of Manually Created Secrets - -*This feature is planned but not implemented. See [issue -9902](https://github.com/GoogleCloudPlatform/kubernetes/issues/9902).* - -You can reference manually created secrets from a [service account]( -service_accounts.md). -Then, pods which use that service account will have -`volumeMounts` and/or `imagePullSecrets` added to them. -The secrets will be mounted at **TBD**. - -## Details -### Restrictions -Secret volume sources are validated to ensure that the specified object -reference actually points to an object of type `Secret`. Therefore, a secret -needs to be created before any pods that depend on it. - -Secret API objects reside in a namespace. They can only be referenced by pods -in that same namespace. - -Individual secrets are limited to 1MB in size. This is to discourage creation -of very large secrets which would exhaust apiserver and kubelet memory. -However, creation of many smaller secrets could also exhaust memory. More -comprehensive limits on memory usage due to secrets is a planned feature. - -Kubelet only supports use of secrets for Pods it gets from the API server. -This includes any pods created using kubectl, or indirectly via a replication -controller. It does not include pods created via the kubelets -`--manifest-url` flag, its `--config` flag, or its REST API (these are -not common ways to create pods.) - -### Consuming Secret Values - -Inside the container that mounts a secret volume, the secret keys appear as -files and the secret values are base-64 decoded and stored inside these files. -This is the result of commands -executed inside the container from the example above: - -``` -$ ls /etc/foo/ -username -password -$ cat /etc/foo/username -value-1 -$ cat /etc/foo/password -value-2 -``` - -The program in a container is responsible for reading the secret(s) from the -files. Currently, if a program expects a secret to be stored in an environment -variable, then the user needs to modify the image to populate the environment -variable from the file as an step before running the main program. Future -versions of Kubernetes are expected to provide more automation for populating -environment variables from files. - - -### Secret and Pod Lifetime interaction - -When a pod is created via the API, there is no check whether a referenced -secret exists. Once a pod is scheduled, the kubelet will try to fetch the -secret value. If the secret cannot be fetched because it does not exist or -because of a temporary lack of connection to the API server, kubelet will -periodically retry. It will report an event about the pod explaining the -reason it is not started yet. Once the a secret is fetched, the kubelet will -create and mount a volume containing it. None of the pod's containers will -start until all the pod's volumes are mounted. - -Once the kubelet has started a pod's containers, its secret volumes will not -change, even if the secret resource is modified. To change the secret used, -the original pod must be deleted, and a new pod (perhaps with an identical -`PodSpec`) must be created. Therefore, updating a secret follows the same -workflow as deploying a new container image. The `kubectl rolling-update` -command can be used ([man page](kubectl_rolling-update.md)). - -The [`resourceVersion`](api-conventions.md#concurrency-control-and-consistency) -of the secret is not specified when it is referenced. -Therefore, if a secret is updated at about the same time as pods are starting, -then it is not defined which version of the secret will be used for the pod. It -is not possible currently to check what resource version of a secret object was -used when a pod was created. It is planned that pods will report this -information, so that a replication controller restarts ones using an old -`resourceVersion`. In the interim, if this is a concern, it is recommended to not -update the data of existing secrets, but to create new ones with distinct names. - -## Use cases - -### Use-Case: Pod with ssh keys - -To create a pod that uses an ssh key stored as a secret, we first need to create a secret: - -```json -{ - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "ssh-key-secret" - }, - "data": { - "id-rsa": "dmFsdWUtMg0KDQo=", - "id-rsa.pub": "dmFsdWUtMQ0K" - } -} -``` - -**Note:** The serialized JSON and YAML values of secret data are encoded as -base64 strings. Newlines are not valid within these strings and must be -omitted. - -Now we can create a pod which references the secret with the ssh key and -consumes it in a volume: - -```json -{ - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "secret-test-pod", - "labels": { - "name": "secret-test" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "ssh-key-secret" - } - } - ], - "containers": [ - { - "name": "ssh-test-container", - "image": "mySshImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } -} -``` - -When the container's command runs, the pieces of the key will be available in: - - /etc/secret-volume/id-rsa.pub - /etc/secret-volume/id-rsa - -The container is then free to use the secret data to establish an ssh connection. - -### Use-Case: Pods with prod / test credentials - -This example illustrates a pod which consumes a secret containing prod -credentials and another pod which consumes a secret with test environment -credentials. - -The secrets: - -```json -{ - "apiVersion": "v1", - "kind": "List", - "items": - [{ - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "prod-db-secret" - }, - "data": { - "password": "dmFsdWUtMg0KDQo=", - "username": "dmFsdWUtMQ0K" - } - }, - { - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "test-db-secret" - }, - "data": { - "password": "dmFsdWUtMg0KDQo=", - "username": "dmFsdWUtMQ0K" - } - }] -} -``` - -The pods: - -```json -{ - "apiVersion": "v1", - "kind": "List", - "items": - [{ - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "prod-db-client-pod", - "labels": { - "name": "prod-db-client" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "prod-db-secret" - } - } - ], - "containers": [ - { - "name": "db-client-container", - "image": "myClientImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } - }, - { - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "test-db-client-pod", - "labels": { - "name": "test-db-client" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "test-db-secret" - } - } - ], - "containers": [ - { - "name": "db-client-container", - "image": "myClientImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } - }] -} -``` - -Both containers will have the following files present on their filesystems: -``` - /etc/secret-volume/username - /etc/secret-volume/password -``` - -Note how the specs for the two pods differ only in one field; this facilitates -creating pods with different capabilities from a common pod config template. - -You could further simplify the base pod specification by using two service accounts: -one called, say, `prod-user` with the `prod-db-secret`, and one called, say, -`test-user` with the `test-db-secret`. Then, the pod spec can be shortened to, for example: -```json -{ -"kind": "Pod", -"apiVersion": "v1", -"metadata": { - "name": "prod-db-client-pod", - "labels": { - "name": "prod-db-client" - } -}, -"spec": { - "serviceAccount": "prod-db-client", - "containers": [ - { - "name": "db-client-container", - "image": "myClientImage", - } - ] -} -``` - -### Use-case: Secret visible to one container in a pod - - -Consider a program that needs to handle HTTP requests, do some complex business -logic, and then sign some messages with an HMAC. Because it has complex -application logic, there might be an unnoticed remote file reading exploit in -the server, which could expose the private key to an attacker. - -This could be divided into two processes in two containers: a frontend container -which handles user interaction and business logic, but which cannot see the -private key; and a signer container that can see the private key, and responds -to simple signing requests from the frontend (e.g. over localhost networking). - -With this partitioned approach, an attacker now has to trick the application -server into doing something rather arbitrary, which may be harder than getting -it to read a file. - - - -## Security Properties - -### Protections - -Because `secret` objects can be created independently of the `pods` that use -them, there is less risk of the secret being exposed during the workflow of -creating, viewing, and editing pods. The system can also take additional -precautions with `secret` objects, such as avoiding writing them to disk where -possible. - -A secret is only sent to a node if a pod on that node requires it. It is not -written to disk. It is stored in a tmpfs. It is deleted once the pod that -depends on it is deleted. - -On most Kubernetes-project-maintained distributions, communication between user -to the apiserver, and from apiserver to the kubelets, is protected by SSL/TLS. -Secrets are protected when transmitted over these channels. - -There may be secrets for several pods on the same node. However, only the -secrets that a pod requests are potentially visible within its containers. -Therefore, one Pod does not have access to the secrets of another pod. - -There may be several containers in a pod. However, each container in a pod has -to request the secret volume in its `volumeMounts` for it to be visible within -the container. This can be used to construct useful [security partitions at the -Pod level](#use-case-two-containers). - -### Risks - - - Applications still need to protect the value of secret after reading it from the volume, - such as not accidentally logging it or transmitting it to an untrusted party. - - A user who can create a pod that uses a secret can also see the value of that secret. Even - if apiserver policy does not allow that user to read the secret object, the user could - run a pod which exposes the secret. - If multiple replicas of etcd are run, then the secrets will be shared between them. - By default, etcd does not secure peer-to-peer communication with SSL/TLS, though this can be configured. - - It is not possible currently to control which users of a kubernetes cluster can - access a secret. Support for this is planned. - - Currently, anyone with root on any node can read any secret from the apiserver, - by impersonating the kubelet. It is a planned feature to only send secrets to - nodes that actually require them, to restrict the impact of a root exploit on a - single node. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/secrets.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/secrets.md?pixel)]() diff --git a/release-0.20.0/docs/security_context.md b/release-0.20.0/docs/security_context.md deleted file mode 100644 index 3eb19498ac4..00000000000 --- a/release-0.20.0/docs/security_context.md +++ /dev/null @@ -1,9 +0,0 @@ -# Security Contexts - -A security context defines the operating system security settings (uid, gid, capabilities, SELinux role, etc..) applied to a container. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/security_context.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/security_context.md?pixel)]() diff --git a/release-0.20.0/docs/service_accounts.md b/release-0.20.0/docs/service_accounts.md deleted file mode 100644 index 322efd3d9b1..00000000000 --- a/release-0.20.0/docs/service_accounts.md +++ /dev/null @@ -1,96 +0,0 @@ -# Service Accounts - -A service account provides an identity for processes that run in a Pod. - -*This is a user introduction to Service Accounts. See also the -[Cluster Admin Guide to Service Accounts](service_accounts_admin.md).* - -*Note: This document descibes how service accounts behave in a cluster set up -as recommended by the Kubernetes project. Your cluster administrator may have -customized the behavior in your cluster, in which case this documentation may -not apply.* - -When you (a human) access the cluster (e.g. using kubectl), you are -authenticated by the apiserver as a particular User Account (currently this is -usually "admin", unless your cluster administrator has customized your -cluster). Processes in containers inside pods can also contact the apiserver. -When they do, they are authenticated as a particular Service Account (e.g. -"default"). - -## Using the Default Service Account to access the API server. - -When you create a pod, you do not need to specify a service account. It is -automatically assigned the `default` service account of the same namespace. If -you get the raw json or yaml for a pod you have created (e.g. `kubectl get -pods/podname -o yaml`), you can see the `spec.serviceAccount` field has been -[automatically set](working_with_resources.md#resources-are-automatically-modified). - -You can access the API using a proxy or with a client library, as described in -[Accessing the Cluster](accessing-the-cluster.md#accessing-the-api-from-a-pod). - -## Using Multiple Service Accounts - -Every namespace has a default service account resource called "default". -You can list this and any other serviceAccount resources in the namespace with this command: -``` -kubectl get serviceAccounts -$ NAME SECRETS -default 1 -``` - -You can create additional serviceAccounts like this: -``` -$ cat > serviceaccount.yaml < - -## Adding Secrets to a service account. -TODO: Test and explain how to use additional non-K8s secrets with an existing service account. - -TODO explain: - - The token goes to: "/var/run/secrets/kubernetes.io/serviceaccount/$WHATFILENAME" - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/service_accounts.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/service_accounts.md?pixel)]() diff --git a/release-0.20.0/docs/service_accounts_admin.md b/release-0.20.0/docs/service_accounts_admin.md deleted file mode 100644 index 91b4afa63b8..00000000000 --- a/release-0.20.0/docs/service_accounts_admin.md +++ /dev/null @@ -1,87 +0,0 @@ -# Cluster Admin Guide to Service Accounts - -*This is a Cluster Administrator guide to service accounts. It assumes knowledge of -the [User Guide to Service Accounts](service_accounts.md).* - -*Support for authorization and user accounts is planned but incomplete. Sometimes -incomplete features are referred to in order to better describe service accounts.* - -## User accounts vs service accounts - -Kubernetes distinguished between the concept of a user account and a service accounts -for a number of reasons: - - User accounts are for humans. Service accounts are for processes, which - run in pods. - - User accounts are intended to be global. Names must be unique across all - namespaces of a cluster, future user resource will not be namespaced). - Service accounts are namespaced. - - Typically, a clusters User accounts might be synced from a corporate - database, where new user account creation requires special privileges and - is tied to complex business processes. Service account creation is intended - to be more lightweight, allowing cluster users to create service accounts for - specific tasks (i.e. principle of least privilege). - - Auditing considerations for humans and service accounts may differ. - - A config bundle for a complex system may include definition of various service - accounts for components of that system. Because service accounts can be created - ad-hoc and have namespaced names, such config is portable. - -## Service account automation - -Three separate components cooperate to implement the automation around service accounts: - - A Service account admission controller - - A Token controller - - A Service account controller - -### Service Account Admission Controller - -The modification of pods is implemented via a plugin -called an [Admission Controller](admission_controllers.md). It is part of the apiserver. -It acts synchronously to modify pods as they are created or updated. When this plugin is active -(and it is by default on most distributions), then it does the following when a pod is created or modified: - 1. If the pod does not have a `ServiceAccount` set, it sets the `ServiceAccount` to `default`. - 2. It ensures that the `ServiceAccount` referenced by the pod exists, and otherwise rejects it. - 4. If the pod does not contain any `ImagePullSecrets`, then `ImagePullSecrets` of the -`ServiceAccount` are added to the pod. - 5. It adds a `volume` to the pod which contains a token for API access. - 6. It adds a `volumeSource` to each container of the pod mounted at `/var/run/secrets/kubernetes.io/serviceaccount`. - -### Token Controller -TokenController runs as part of controller-manager. It acts asynchronously. It: -- observes serviceAccount creation and creates a corresponding Secret to allow API access. -- observes serviceAccount deletion and deletes all corresponding ServiceAccountToken Secrets -- observes secret addition, and ensures the referenced ServiceAccount exists, and adds a token to the secret if needed -- observer secret deleteion and removes a reference from the corresponding ServiceAccount if needed - -#### To create additional API tokens - -A controller loop ensures a secret with an API token exists for each service -account. To create additional API tokens for a service account, create a secret -of type `ServiceAccountToken` with an annotation referencing the service -account, and the controller will update it with a generated token: - -``` -secret.json: -{ - "kind": "Secret", - "metadata": { - "name": "mysecretname", - "annotations": { - "kubernetes.io/service-account.name": "myserviceaccount" - } - } - "type": "kubernetes.io/service-account-token" -} - -$ kubectl create -f secret.json -$ kubectl describe secret mysecretname -``` - -#### To delete/invalidate a service account token: -``` -kubectl delete secret mysecretname -``` - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/service_accounts_admin.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/service_accounts_admin.md?pixel)]() diff --git a/release-0.20.0/docs/services-firewalls.md b/release-0.20.0/docs/services-firewalls.md deleted file mode 100644 index ac863fe8c95..00000000000 --- a/release-0.20.0/docs/services-firewalls.md +++ /dev/null @@ -1,40 +0,0 @@ -# Services and Firewalls - -Many cloud providers (e.g. Google Compute Engine) define firewalls that help keep prevent inadvertent -exposure to the internet. When exposing a service to the external world, you may need to open up -one or more ports in these firewalls to serve traffic. This document describes this process, as -well as any provider specific details that may be necessary. - - -### Google Compute Engine -Google Compute Engine firewalls are documented [elsewhere](https://cloud.google.com/compute/docs/networking#firewalls_1). - -You can add a firewall with the ```gcloud``` command line tool: - -``` -gcloud compute firewall-rules create my-rule --allow=tcp: -``` - -**Note** -There is one important security note when using firewalls on Google Compute Engine: - -Firewalls are defined per-vm, rather than per-ip address. This means that if you open a firewall for that service's ports, -anything that serves on that port on that VM's host IP address may potentially serve traffic. - -Note that this is not a problem for other Kubernetes services, as they listen on IP addresses that are different than the -host node's external IP address. - -Consider: - * You create a Service with an external load balancer (IP Address 1.2.3.4) and port 80 - * You open the firewall for port 80 for all nodes in your cluster, so that the external Service actually can deliver packets to your Service - * You start an nginx server, running on port 80 on the host virtual machine (IP Address 2.3.4.5). This nginx is **also** exposed to the internet on the VM's external IP address. - -Consequently, please be careful when opening firewalls in Google Compute Engine or Google Container Engine. You may accidentally be exposing other services to the wilds of the internet. - -### Other cloud providers -Coming soon. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/services-firewalls.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/services-firewalls.md?pixel)]() diff --git a/release-0.20.0/docs/services.md b/release-0.20.0/docs/services.md deleted file mode 100644 index a0ad02adc63..00000000000 --- a/release-0.20.0/docs/services.md +++ /dev/null @@ -1,470 +0,0 @@ -# Services in Kubernetes - -## Overview - -Kubernetes [`Pods`](pods.md) are mortal. They are born and they die, and they -are not resurrected. [`ReplicationControllers`](replication-controller.md) in -particular create and destroy `Pods` dynamically (e.g. when scaling up or down -or when doing rolling updates). While each `Pod` gets its own IP address, even -those IP addresses cannot be relied upon to be stable over time. This leads to -a problem: if some set of `Pods` (let's call them backends) provides -functionality to other `Pods` (let's call them frontends) inside the Kubernetes -cluster, how do those frontends find out and keep track of which backends are -in that set? - -Enter `Services`. - -A Kubernetes `Service` is an abstraction which defines a logical set of `Pods` -and a policy by which to access them - sometimes called a micro-service. The -set of `Pods` targeted by a `Service` is (usually) determined by a [`Label -Selector`](labels.md#label-selectors) (see below for why you might want a `Service` without a -selector). - -As an example, consider an image-processing backend which is running with 3 -replicas. Those replicas are fungible - frontends do not care which backend -they use. While the actual `Pods` that compose the backend set may change, the -frontend clients should not need to be aware of that or keep track of the list -of backends themselves. The `Service` abstraction enables this decoupling. - -For Kubernetes-native applications, Kubernetes offers a simple `Endpoints` API -that is updated whenever the set of `Pods` in a `Service` changes. For -non-native applications, Kubernetes offers a virtual-IP-based bridge to Services -which redirects to the backend `Pods`. - -## Defining a service - -A `Service` in Kubernetes is a REST object, similar to a `Pod`. Like all of the -REST objects, a `Service` definition can be POSTed to the apiserver to create a -new instance. For example, suppose you have a set of `Pods` that each expose -port 9376 and carry a label "app=MyApp". - -```json -{ - "kind": "Service", - "apiVersion": "v1", - "metadata": { - "name": "my-service" - }, - "spec": { - "selector": { - "app": "MyApp" - }, - "ports": [ - { - "protocol": "TCP", - "port": 80, - "targetPort": 9376 - } - ] - } -} -``` - -This specification will create a new `Service` object named "my-service" which -targets TCP port 9376 on any `Pod` with the "app=MyApp" label. This `Service` -will also be assigned an IP address (sometimes called the "cluster IP"), which -is used by the service proxies (see below). The `Service`'s selector will be -evaluated continuously and the results will be posted in an `Endpoints` object -also named "my-service". - -Note that a `Service` can map an incoming port to any `targetPort`. By default -the `targetPort` is the same as the `port` field. Perhaps more interesting is -that `targetPort` can be a string, referring to the name of a port in the -backend `Pods`. The actual port number assigned to that name can be different -in each backend `Pod`. This offers a lot of flexibility for deploying and -evolving your `Services`. For example, you can change the port number that -pods expose in the next version of your backend software, without breaking -clients. - -Kubernetes `Services` support `TCP` and `UDP` for protocols. The default -is `TCP`. - -### Services without selectors - -Services generally abstract access to Kubernetes `Pods`, but they can also -abstract other kinds of backends. For example: - - * You want to have an external database cluster in production, but in test - you use your own databases. - * You want to point your service to a service in another - [`Namespace`](namespaces.md) or on another cluster. - * You are migrating your workload to Kubernetes and some of your backends run - outside of Kubernetes. - -In any of these scenarios you can define a service without a selector: - -```json -{ - "kind": "Service", - "apiVersion": "v1", - "metadata": { - "name": "my-service" - }, - "spec": { - "ports": [ - { - "protocol": "TCP", - "port": 80, - "targetPort": 9376 - } - ] - } -} -``` - -Because this has no selector, the corresponding `Endpoints` object will not be -created. You can manually map the service to your own specific endpoints: - -```json -{ - "kind": "Endpoints", - "apiVersion": "v1", - "metadata": { - "name": "my-service" - }, - "subsets": [ - { - "addresses": [ - { "IP": "1.2.3.4" } - ], - "ports": [ - { "port": 80 } - ] - } - ] -} -``` - -Accessing a `Service` without a selector works the same as if it had selector. -The traffic will be routed to endpoints defined by the user (`1.2.3.4:80` in -this example). - -## Virtual IPs and service proxies - -Every node in a Kubernetes cluster runs a `kube-proxy`. This application -watches the Kubernetes master for the addition and removal of `Service` -and `Endpoints` objects. For each `Service` it opens a port (random) on the -local node. Any connections made to that port will be proxied to one of the -corresponding backend `Pods`. Which backend to use is decided based on the -`SessionAffinity` of the `Service`. Lastly, it installs iptables rules which -capture traffic to the `Service`'s `Port` on the `Service`'s cluster IP (which -is entirely virtual) and redirects that traffic to the previously described -port. - -The net result is that any traffic bound for the `Service` is proxied to an -appropriate backend without the clients knowing anything about Kubernetes or -`Services` or `Pods`. - -![Services overview diagram](services_overview.png) - -By default, the choice of backend is random. Client-IP based session affinity -can be selected by setting `service.spec.sessionAffinity` to `"ClientIP"` (the -default is `"None"`). - -As of Kubernetes 1.0, `Services` are a "layer 3" (TCP/UDP over IP) construct. We do not -yet have a concept of "layer 7" (HTTP) services. - -## Multi-Port Services - -Many `Services` need to expose more than one port. For this case, Kubernetes -supports multiple port definitions on a `Service` object. When using multiple -ports you must give all of your ports names, so that endpoints can be -disambiguated. For example: - -```json -{ - "kind": "Service", - "apiVersion": "v1", - "metadata": { - "name": "my-service" - }, - "spec": { - "selector": { - "app": "MyApp" - }, - "ports": [ - { - "name": "http", - "protocol": "TCP", - "port": 80, - "targetPort": 9376 - }, - { - "name": "https", - "protocol": "TCP", - "port": 443, - "targetPort": 9377 - } - ] - } -} -``` - -## Choosing your own IP address - -A user can specify their own cluster IP address as part of a `Service` creation -request. To do this, set the `spec.clusterIP` field. For example, if they -already have an existing DNS entry that they wish to replace, or legacy systems -that are configured for a specific IP address and difficult to re-configure. -The IP address that a user chooses must be a valid IP address and within the -service_cluster_ip_range CIDR range that is specified by flag to the API server. -If the IP address value is invalid, the apiserver returns a 422 HTTP status code -to indicate that the value is invalid. - -### Why not use round-robin DNS? - -A question that pops up every now and then is why we do all this stuff with -virtual IPs rather than just use standard round-robin DNS. There are a few -reasons: - - * There is a long history of DNS libraries not respecting DNS TTLs and - caching the results of name lookups. - * Many apps do DNS lookups once and cache the results. - * Even if apps and libraries did proper re-resolution, the load of every - client re-resolving DNS over and over would be difficult to manage. - -We try to discourage users from doing things that hurt themselves. That said, -if enough people ask for this, we may implement it as an alternative. - -## Discovering services - -Kubernetes supports 2 primary modes of finding a `Service` - environment -variables and DNS. - -### Environment variables - -When a `Pod` is run on a `Node`, the kubelet adds a set of environment variables -for each active `Service`. It supports both [Docker links -compatible](https://docs.docker.com/userguide/dockerlinks/) variables (see -[makeLinkVariables](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/pkg/kubelet/envvars/envvars.go#L49)) -and simpler `{SVCNAME}_SERVICE_HOST` and `{SVCNAME}_SERVICE_PORT` variables, -where the Service name is upper-cased and dashes are converted to underscores. - -For example, the Service "redis-master" which exposes TCP port 6379 and has been -allocated cluster IP address 10.0.0.11 produces the following environment -variables: - -``` -REDIS_MASTER_SERVICE_HOST=10.0.0.11 -REDIS_MASTER_SERVICE_PORT=6379 -REDIS_MASTER_PORT=tcp://10.0.0.11:6379 -REDIS_MASTER_PORT_6379_TCP=tcp://10.0.0.11:6379 -REDIS_MASTER_PORT_6379_TCP_PROTO=tcp -REDIS_MASTER_PORT_6379_TCP_PORT=6379 -REDIS_MASTER_PORT_6379_TCP_ADDR=10.0.0.11 -``` - -*This does imply an ordering requirement* - any `Service` that a `Pod` wants to -access must be created before the `Pod` itself, or else the environment -variables will not be populated. DNS does not have this restriction. - -### DNS - -An optional (though strongly recommended) [cluster -add-on](../cluster/addons/README.md) is a DNS server. The -DNS server watches the Kubernetes API for new `Services` and creates a set of -DNS records for each. If DNS has been enabled throughout the cluster then all -`Pods` should be able to do name resolution of `Services` automatically. - -For example, if you have a `Service` called "my-service" in Kubernetes -`Namespace` "my-ns" a DNS record for "my-service.my-ns" is created. `Pods` -which exist in the "my-ns" `Namespace` should be able to find it by simply doing -a name lookup for "my-service". `Pods` which exist in other `Namespaces` must -qualify the name as "my-service.my-ns". The result of these name lookups is the -cluster IP. - -We will soon add DNS support for multi-port `Services` in the form of SRV -records. - -## Headless services - -Sometimes you don't need or want load-balancing and a single service IP. In -this case, you can create "headless" services by specifying `"None"` for the -cluster IP (`spec.clusterIP`). -For such `Services`, a cluster IP is not allocated and service-specific -environment variables for `Pods` are not created. DNS is configured to return -multiple A records (addresses) for the `Service` name, which point directly to -the `Pods` backing the `Service`. Additionally, the kube proxy does not handle -these services and there is no load balancing or proxying done by the platform -for them. The endpoints controller will still create `Endpoints` records in -the API. - -This option allows developers to reduce coupling to the Kubernetes system, if -they desire, but leaves them freedom to do discovery in their own way. -Applications can still use a self-registration pattern and adapters for other -discovery systems could easily be built upon this API. - -##External services - -For some parts of your application (e.g. frontends) you may want to expose a -Service onto an external (outside of your cluster, maybe public internet) IP -address. Kubernetes supports two ways of doing this: `NodePort`s and -`LoadBalancer`s. - -Every `Service` has a `Type` field which defines how the `Service` can be -accessed. Valid values for this field are: - - * `ClusterIP`: use a cluster-internal IP only - this is the default - * `NodePort`: use a cluster IP, but also expose the service on a port on each - node of the cluster (the same port on each) - * `LoadBalancer`: use a ClusterIP and a NodePort, but also ask the cloud - provider for a load balancer which forwards to the `Service` - -Note that while `NodePort`s can be TCP or UDP, `LoadBalancer`s only support TCP -as of Kubernetes 1.0. - -### Type = NodePort - -If you set the `type` field to `"NodePort"`, the Kubernetes master will -allocate you a port (from a flag-configured range, default: 30,000 - 32,767) -on each node for each port exposed by your `Service`. That port will be -reported in your `Service`'s `spec.ports[*].nodePort` field. If you specify -a value in that field, the system will allocate you that port or else will -fail the API transaction. - -This gives developers the freedom to set up their own load balancers, to -configure cloud environments that are not fully supported by Kubernetes, or -even to just expose one or more nodes' IPs directly. - -### Type = LoadBalancer - -On cloud providers which support external load balancers, setting the `type` -field to `"LoadBalancer"` will provision a load balancer for your `Service`. -The actual creation of the load balancer happens asynchronously, and -information about the provisioned balancer will be published in the `Service`'s -`status.loadBalancer` field. For example: - -```json -{ - "kind": "Service", - "apiVersion": "v1", - "metadata": { - "name": "my-service" - }, - "spec": { - "selector": { - "app": "MyApp" - }, - "ports": [ - { - "protocol": "TCP", - "port": 80, - "targetPort": 9376, - "nodePort": 30061 - } - ], - "clusterIP": "10.0.171.239", - "type": "LoadBalancer" - }, - "status": { - "loadBalancer": { - "ingress": [ - { - "ip": "146.148.47.155" - } - ] - } - } -} -``` - -Traffic from the external load balancer will be directed at the backend `Pods`, -though exactly how that works depends on the cloud provider. - -## Shortcomings - -We expect that using iptables and userspace proxies for VIPs will work at -small to medium scale, but may not scale to very large clusters with thousands -of Services. See [the original design proposal for -portals](https://github.com/GoogleCloudPlatform/kubernetes/issues/1107) for more -details. - -Using the kube-proxy obscures the source-IP of a packet accessing a `Service`. -This makes some kinds of firewalling impossible. - -LoadBalancers only support TCP, not UDP. - -The `Type` field is designed as nested functionality - each level adds to the -previous. This is not strictly required on all cloud providers (e.g. GCE does -not need to allocate a `NodePort` to make `LoadBalancer` work, but AWS does) -but the current API requires it. - -## Future work - -In the future we envision that the proxy policy can become more nuanced than -simple round robin balancing, for example master-elected or sharded. We also -envision that some `Services` will have "real" load balancers, in which case the -VIP will simply transport the packets there. - -There's a -[proposal](https://github.com/GoogleCloudPlatform/kubernetes/issues/3760) to -eliminate userspace proxying in favor of doing it all in iptables. This should -perform better and fix the source-IP obfuscation, though is less flexible than -arbitrary userspace code. - -We intend to have first-class support for L7 (HTTP) `Services`. - -We intend to have more flexible ingress modes for `Services` which encompass -the current `ClusterIP`, `NodePort`, and `LoadBalancer` modes and more. - -## The gory details of virtual IPs - -The previous information should be sufficient for many people who just want to -use `Services`. However, there is a lot going on behind the scenes that may be -worth understanding. - -### Avoiding collisions - -One of the primary philosophies of Kubernetes is that users should not be -exposed to situations that could cause their actions to fail through no fault -of their own. In this situation, we are looking at network ports - users -should not have to choose a port number if that choice might collide with -another user. That is an isolation failure. - -In order to allow users to choose a port number for their `Services`, we must -ensure that no two `Services` can collide. We do that by allocating each -`Service` its own IP address. - -To ensure each service receives a unique IP, an internal allocator atomically -updates a global allocation map in etcd prior to each service. The map object -must exist in the registry for services to get IPs, otherwise creations will -fail with a message indicating an IP could not be allocated. A background -controller is responsible for creating that map (to migrate from older versions -of Kubernetes that used in memory locking) as well as checking for invalid -assignments due to administrator intervention and cleaning up any any IPs -that were allocated but which no service currently uses. - -### IPs and VIPs - -Unlike `Pod` IP addresses, which actually route to a fixed destination, -`Service` IPs are not actually answered by a single host. Instead, we use -`iptables` (packet processing logic in Linux) to define virtual IP addresses -which are transparently redirected as needed. When clients connect to the -VIP, their traffic is automatically transported to an appropriate endpoint. -The environment variables and DNS for `Services` are actually populated in -terms of the `Service`'s VIP and port. - -As an example, consider the image processing application described above. -When the backend `Service` is created, the Kubernetes master assigns a virtual -IP address, for example 10.0.0.1. Assuming the `Service` port is 1234, the -`Service` is observed by all of the `kube-proxy` instances in the cluster. -When a proxy sees a new `Service`, it opens a new random port, establishes an -iptables redirect from the VIP to this new port, and starts accepting -connections on it. - -When a client connects to the VIP the iptables rule kicks in, and redirects -the packets to the `Service proxy`'s own port. The `Service proxy` chooses a -backend, and starts proxying traffic from the client to the backend. - -This means that `Service` owners can choose any port they want without risk of -collision. Clients can simply connect to an IP and port, without being aware -of which `Pods` they are actually accessing. - -![Services detailed diagram](services_detail.png) - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/services.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.20.0/docs/services.md?pixel)]() diff --git a/release-0.20.0/docs/services_detail.png b/release-0.20.0/docs/services_detail.png deleted file mode 100644 index 7ff19b8209b513668ed6aca0441179aade3b30d7..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 68514 zcmdR$byt;b*X}_C1VjZ91Vlty8l(jT=?(#D0Rd^GJ48gJr6r}iLmH(Q-5t{1o$us% z-o5|ZA7HOB9QVL=uZ!zC*Llu3j^ETzURDenlL!+D2?<+5Tv!na>6RxF67tp^H29nQ z6Sd*+pW8M<5^wLo%k|EOZ}2mQmAIM>5)#(n%^&1%o%`|dmxQ(=?`)MU4Q(BCtqqVI z92^*pElh3nb*&5-Ev=1Ww_Xt;Aw5Hq5Egvv7`G8`=lHgD#B*jUu-Zik_YT=-UOa~i z{Jh@&eteVCG)bvNRf5dE=M0P@{?$^qFuZQhku^ffR)Y&BC73{YArDw;1k*zKhEX=|HE!``&h*Ek^P4wiybA z40()a1G&$w=sbCv;VC)F=b>$HDDV@N+7@MHD57rOdPhH&yWhK&F8|8>qluSPb^iU$ zNVu9;@n20v{rvG;NM6RCsdiDw-ze`FoMPT7y{+dR(hCEhO17tKcjjhSdp5Qm_&YT)@4Vz?i3%z@x}=p+U+(M~(SNTu zooWZyvgLm|Si0?c9b-A5Yc)_VgX|UA{qvaWA+ha~Pc~T3pZ)J^#|j7UHS&L7UafZp zk?|h<_vP66;Q#r?p7=}8n$p-WiDPe!bs5QZu97R8jq&~&9fjaJ#c)ia4^(w{F5zdi zXVTOCL;REZKq<;{(cCQb#SAOGsyHs>4PqwyIsi3#g5No76cz*bq2q0ohiuMr?rCrx z#r(vx;P90PH7?k#Df17z7=jwKzHwCqhqt{~FWU}uD8T7rkoBf*?|FVO%3-ZI7hU*X z!p46fHC0%PYN?+kpfh)ceK&0hUySZEY9aFE9qz7Qi;32oO+iceX?;)BPPvWB=_#2u z4Q>4UQ}Gs4i;hQpG$$`P`_~ZgnOVm0M@vOUs}r}k)CCRH6yU-%`A^6G77gj(cr2R1 zXBM8Q@6sAoTnK5a|3%5V)-~tf;j-FDEa0j&#!&O?>tc{h5wHIgkJ7 zmCb#UX1$;C6Q^Z#RWQ>~xse`gjJ`K92v$8NJ2@iu4@wYZlcKev#xXj^b=##mCG>lX zN021n#!_bAG(Hxla#g!S%#0i=J~*kzf$1aEJ(QwRY3=xM_0vcu4Q{cRWY#mRtV-p{7{JzgR_WL7Md+48R zeOwYP%o0V~PD#qGJqfD1b2@mKi2y~DA2_7lJ|rF{d<6D-=wd2ve^Pzw`wW^o|8sru z?|0_@9vKj|T52n+|LZo>MtngPm>+QHY{cKJ<33q_US{-A%9f_PD~XHKyU7&!pyurP z{LERFpk4W6)WS%Gf~(*o6lxUtxTrs6Vb#A2-3U1g67+le9ilI$NxSHOd2&$I)Z+DY zUq0}s3|}z9u~~f#yA-kLz0UHo?EPTQwW$RTv52wYz1FK!(x{_+3kwAz;p%B}!sDgj zZ+5mcOo-*BA)C1I9r9+Um|Qh3zY0!m!Q_;YNj=O-!PZ|&ga@5M6jjb|!|{GRC1}}Y zp9y(_)3nr+I6ovH_e!xoR$5)g-kM$|XzQ-qKmGBeCqZ6*gvKntHm*(?;D}q#1_$q~ zvSI3DO)TN7qPUSOX=~WsBjIz)?&xUyP55Vwq5kH2`J~#d`O3VS<95atET~%zf2Sjs z>n4JP#qP(HeutgbZFc4JrEve^eDTRr0oQ(;%x9MXmxR=HuLHL=_Q?z9_lEQ0Lhq2g zuJfK&Kb?(4kbIa;hBI9Cjb5K=dLoX6a(t(#J(T>?vQc8~=9u7}bpjyjeeb{5Uo%h}Xrza5yUVM7N4G z!l0Q#l?aRz9FM( zmCcwVeC6c>{U<)q4 zm5F`r6~+aNg805i(UE^J-=>hcZ>TX;gDMUJ_RLf zbld{hcWX9gW{$?c(~neVwjAw9KMRXhXj`|SCQ{Im;T8ok!ud!k(qsrzdFXC<-;JFBbs+`C=&`=6E} zEP}-R(se%E(9Erq)X8w-CQTkmlY>V{W}3BDduyYq#r{otjGG#7>_oWZzsl&J`1_9? zbxn$iA`gD8%^>B-*Zx4=9Fi}BOy4F+wl~RNjGIEsgb<_3Yw7PJ;dQX&!H##9JNAc- zspl;h681#Q-T4--79ZTbmGKB_!Pc9tv$|6u@L10N{e z`R6vtfR;hTQ&{Qy?7eM>zW8#!uek2^OvXj3$TFzR3>@LaWEm3v*v)O7m`2;(CkKQ+ zzp@PC4^_hPah%)*Xcfr97Yy_k7j|Dimzd%`7;>JR>?V}*Rar=*4hh4<3jP*bkzYqP zUHdgG?1_|f7whHbTh+*$FD|Q3m4=}+tvL5Fn<;v(mimDE?1GEzmmGwY->dq>jfHpC zKjuTEa#&uL{QWZ!JgkMDNz38zMqOEO=gO|lKyic5)p*J-Ni+s32VpHPapy^Pq$ld< z|E5fD!$K1o&~-?P`&UY;n?YuhfH3ncs=d(KTD8vd_??POaJA^~R;>y0eJ9c@x;>#Xy^!9bq^;STWJ-#GT4>+h@&Qij&fB^90kL@}lckFBQWD_6&84NnD5QciqP1m<5W~ zY!ZPI1LN9+w5$hy!qH5Q(!Ja&Su7c&(7r$DT(5t95lo$4*ZnO@V1!FmSsQU=snfTj zaqC*csb~44NvBzaWMllM_^%Kfy{?Kl&1)1)AI(c5V(N58^(^)XDHS0KV*D-&PIm3h zlbEji1;HU529UmxKPvBOu!^u>t)&nD^m?{PiJDzBD;rdB`n9OQLvBPt&NNPmW49JZkLetHZN@Nb=K)+<^Aj9nWuNg% za=QBWqyC9IO@kvtLFgM7{wW?FYRh~Y4ulN{&8Ez(CH-6u?i1Tj&eoL{tjG8aJVK%; zDv=N~a=$`y2#Me*mu#*_(K2}1PT%$rudWSd%Y32pqKYvP+*nk*AA!nnL+%NIF z_o_3kHpj2d@e5mQ6th`3waEzH2da|2E(La+)+*bl{3x)qqsO=ul@&x)^zbk%pA;=j z>-23RX2M7rGA@(aiH^^f<9FXGhyUx(r{kmU{DWxsE{)EKdv{E-tJ+<-e?Ag@c`2KB zc>MVImBkew3o{F~0ADE9L{w;EXj71-PTJ7d1d}>8h`70q`V_GJqSbkO^(Xg7%S^-| z!K((Fkx^4_CG-rurNP5g7BgO5aG&_ZokJk|oPh%m^7`4U(-%ii>poBl;}q^QS!naM zA~;2Nm&T<`{*bc}1Q#EAFx~1!)Dvu?%lvJd{2AWXahvp=n6i^`7~;B+A^kqCkI&3+L$y3!`Ura_Z@LOEKo9uPts)6 zzied_ufa#6K}X)!ZY;9>=%dM)!A$3~@a@^;#Wu;RQ}y16-Qa+<>oP%^3oV{ChdZl3 zycfV=wjwak5Le5q6du++)+HqYEoa39|yOme=$LJXm09{EKYV63N~L9 zZ8PpRQ~REy;}F_e{(?!DDba*~x1`JZkvPDXItwASUqP zRBKmDcUSC2>f`(;W4XWZ_-WtuTT`KX88d?D&WO|-klFHD%{ zW=5ymT4A%(BQjdPH(d4E(8NIQItGim#9r9zbF69)Zm9z{r;x18hsEXpEc+f5o=XkI z!N>-QYXc52F&rt|6>i;o7Il1(p~&|B3R-CLA2uXr zK)31b!I;cU_sB+rTHRrFCTU$G?$%?-mX%q%;yEv%%%S4hxdWTMbc-hhLQBTs&wJh( zAD@_x7~y?Q$B&yX{gUKnI*9kWQW{aOQ}(fz5` zZWXsJo;70?hQ}$GA(dLl(m{7_4%KVpzIr#s5tqG=jf*RGMpDh0Oe1p|AGNF|9d4AQ zqw|Hdsf7y_1Nq653issYF9gcVRe?@H>{!&Hj(i~~9v@+nWHN{wqM~f=+QsSF-ycup7LmH+ zzp_HeZ2ZsC1|dZ9X!6i zrLS`>n-XYGY-2go^S%E$#G0@ZI-^f!0}0C>qiIDZkr5BtS7i{X9VJ&4e)hFu+1*aZ zL|$G+gpidRi|Vg4l#ySSd`j&xk35Cd)z#f@`S-{lW4b=*7n5s%Um8i$TY1@h<)8^I z(Qdsx7mv(wyXAju9|z3u#0t1@;mjgzg|Ba|ZHhBS6>X0k%hTYU@Uuh`Cgv#z_GyWB zF0^I$aM$h{K{N`@Pch6&U?AK0Y=UZfHphN)NSu*fa=f5AdUU8cbomq4SQ&Mq-Yudy z`ITadP$mt-->w2`w)%H7vq(kwQFnOeHne4PFC!sY;X>032Wf@yabNzicoVLK_u3kl z?Te& zmaDwPm-OH7CAhzkQql}LN?YM&DKBiUuV=-UkS(qfDd12qTVF963>T13*KzDMw*Aom zVz1xgCd=DjCTR-Y>_2*v$+rgGBVURgNDfQC{?%O{j+_qDL6etigbGneJ+Qtj$!KQ4 zv9F9_SD^bti?5Adp0zRa#~Jm#fr$LO<}UYIdvh)7nazJYtmKU6ku&iLZfb5?j=Aj7 z1*%*nGdJRe3vc+JWB^S?SdmiZ+wA0FFX7RIYqYxVpQrO)W^(qH@E2(wwCc@)`f3U|MyrfPh3so0p9E$M#lSAjBUjQys)16djA5c*TTO0*1Z zf4U0LAzGZi-gXdx0LN8yq;d28c*b`~VAkKE@wVAecjC-sgzVvZ7If?7ghE69qqap> zD9+1XcpUzE#ufujBS>BJ+Ecze{Y<{4qAKX5?}DY(edK0XOb|K@ml<@_Q^rNV!XGUT ztxxk&(@ca4k*Q96c*Zl!EK<4pO<3=1=asy^Vuq!e`u4IZ{bDmJ#TTvjQ07v6i5E*w z>6jfO&Fr43$u=W>9{TMc6T|T16m)@eeh|RkMn+^(=H`=_#@Fy<(t4Dw5c5SFg>`(; zUlpkUh{HpnCR?Fh*m3$W7eaAiO=*>~iMGU)ha@ z$?ll3nazgoDKXQr07rvXQ6qh8*?xwtdn9qGt`=H;H2I|-+0XV; zrH=HLLt2Cfle3Is73Gbp5|7t-I8co-Uh%bUAKme)_1bFZV8GcN+N9!#DIj-(V1;JG zOK@PqQvw>YawUYV7aiY`S6-T_r!3TzE|W4|RY)2OUR!a;`^t@|=R@v;j@Prl;w`z+ zQ~4i>*stA18z&SD)L3A*Wi#A1ovHAh3cBTxH`|}!0aZ7&Xzbh>jOuB_8H*IOyspr` zmcHn;aOZ=HI60Rl7<%+48s|z1ikW+#Ozsi*e*Yn)QqLO-y-xH5H{1UHR}F@zRL*Fk z(&{I?NpI2i*?!zqL5e3LDmDC{F}CUR*nD+$?TNA!qG&s1->A+YVYzVPSsTnay71mg z6X5X#tuOG5zhCbScm1IQ$Ze|}XKIi{Qe}_R0)Do8`laO!+kX*)rcaPDN+BdhlW9G- zE|eCHYUyV25<^qfix7DVXyzJDrqUcwDJru#-@Tf==Ogs1yeT)wvMp1!UJ;9^Gk;8^ zx&K$h@ca8Dd?@M;ByB?}*FRz&WbtU{tZ)o&Z@KreGcR^k-EzN(L(Fq3jD9Rew*AY7@`v400WD(>Am1Nl-m@1KO3BlHZ;%iQtPS?$3W z26i#q+ajMV&~(`+{@6X`Pmx``|7`wiu`U6~&bwi14tW)1QYE5G2vId<1^e~001afi z`z1wQ{Z%xPEAKxV`uWt-Mc%W3Y^|*SH3l9L6R*(vV_M#eGMdVb)Q?a;z;oaB^r?*< zHoZLv64cN~F>;;L&w+`rWI!t@_uz{ z4lB-E_KfIB5jw%uR3qJz-xRq+u8#+%7(~-h$Ha5!)+1amj{f9jC%;WYS{f-$gWV#m zhr#1~_KlJUY6RVXy_ms4ZmZn8B7w_Uhs$MEUG+z@AhFTXA(XJKomMN(?(F+snB8;| z+FYTfqw>;u8!`I>+SpPSQg3ooa{7WGQiOoUHVYNqX!U{CE8fFKMEe`Ny3%L9Br|oA zooV_+UfkoLE&tHa_p&z`_{~DQabk~jH=t{UbH1zkEPq7Z+xsX_L9J>%`59Z~G$DRK zS6&tkZR%M$3#|YjGE#@{MZVV^kQpEN6_#2xg2=~vUne1&M~D13bB3XwQ-;Up=3tP- zScQ3|YOl2Z4{-{W%D0scD^kH2HYdj&1i#(a1dcBD7`6Gnny~*cPHCp~951vr6Djbs z;jYnR0VO?)))SdG%I5u;m}h@RzTJpdv^uxEvbGQ$+na)2LC1VPlTL3}J6e5gen_8& z%$LI&T99`gDp_V|Cc+XEl8AnX z^E=Aj2$c~jymgl?x{C{5$t{=qS~JcUe?u_@bx>(MmI)})a9v;jhB<<vZoUY1DS`o(;AL7quJTxic;KnsMVx&C}p@9m)nW>e#kMc!Df1)@7Ap8o-bRShH5gkQBHMV^MHQ<2ek zF@cT0a~T z8uX6-AKaJ;%{x}(vah#j`udt%hWsJyr_TJIPNJ+)2T_~#sw;7{^n?(urMr2q6n)z4 zoaaPhK2<}*(AF~D81<*eEh()$y>VFPly{k;V$%MD)&SaGKkgcRm<}7&RGqNd1VSUG zku~i!v8yEwo2TmRCjLw+suD9W-brON@#fgDG?nkq##GMdy+%Hqxl=iOoK^EK1~a+H zmXtTvsDA8w!Y`H)xoyLJqaNc0Zfmp6U~vk_TH9V3K@a?zvIV&vudC3V3tFDz`W4!! z{wyenA51t(=deaVz)AZy>T(8egmxH!B!6J_<xy#)l`Kz_R zlfx1b7HRgh6)e!GFGLu$7TFw=ak3{wSOyHPG#%UxRK`!~)t?}8D>$2zXJe^!cMkr# zSdu1Rz46q^y?(f9P=VlH=I0rc^H+=3wR;X8@7#pJAoHpYuY8!{x)U`lF_ZFDT3tjv zfEA~9%6#j-G5hJLnTFHMK$SgjS-o7_uRs%If9yZKgP+G{wo_q4z#@&Ew9_Zwx@R12 zldEP}=k9!rBKK!*RPatwGtqbRki`dQ{;BHYI6`#zBb%Q?wzritkCwXGwvn~JAG zoCK(9wAuVgWRZtrLdXG?j^Y07?W!P!CGq5^73n%QkuOay%rWqGGxIpL@^N&ul6G8A_x5tm>3BKbnY26V8zn4BENiafJ)1Hk zrcTMlUhBodZgWxe^%)@0J^GACUw-H}DRhj}JS1#UHeco)Xn_~IL?ytxKa#E{4vC8>?6^$MlC zr45v`Ibzq8)l^k^HC&1CdzH`b!!LP!(phb?czGVYe2`8Fr3;C~zbJ4+JR?e|tz)Dg znP&$|Y+rU;+MLO&hcs5*&zJ)WA)`FL$jVAYMOi{n1ry`fa!mbPfGBPk@9xUMZ8rRZ z8x{NZriOn+Nydxtr|%a!5^d)9BruB=Pxd3c9PPJ)<6U?S`qw@`0l&VNlht5p`8ZKE zS1VD$@%V}CK{NTr`KFstuw`rQ8&X@_Lz?am6C910GB9pt+~>b>RYx6?%CuG=-+?X# zJR&Nd*$38@cR^QKdFA?b+^$jk;>$Oia|kuM&Fkd5TkKEJjDWoY%Zgxm!@$OXXqAn zQ?RGglS{w--FW*WU+craVXMun-`EYHkm@qg>unccMQ9ZA&4h7Gq3Ij0r%IwtO+Jp% zVAIa&^nu67(#Z_XM;TES8uJd?gql)W0qsK zqw8I=P=b38h+RK(Xrb$E_7lB%h=q{ClnBOZ1m{Wu%cDA{6WT!9ZKjl(-=1J&=AM5f zD#+u?`7r?3S153A-b$RA+xvqpjQS*5W<>BEPq`3TltNsTNdKXKfXlvEgr2QHK+H9E zhc=g}{}LTq$RbzfHl{G7 z#2jo7@6v!LcyVB%to{oF%iTggyCO0LX_!mD6^&%%-3#{e!e1k)l?Mq2#b38a3JC<# z;PGZr*2}at2%yugspJW1q~oVv2w^q7+N>-#X_pMhA6Y_do(1UjvSD!-ZSe->pW*h% zUMk0aA&$}5KNCRSIJYBH4Kn)&;1%+wwd<6ARt1%1YiYzx9ORG21n9V4MO~qdcWK zg58iZC`Pp@JOcA2cDKQQft64?Co#df0T&E7{GRuj_G>~Pak`yR(bgm0PsB3TJDDmY z16H~2N4@TD((oLtiUQ^vTVOmRhy8*U8LCz~>S6cR7#S%zu9*l+2j0UeluL_n$ahrn z#znf>?KK=#z`_mNg_9`o=R;@SdX|I(-~EtEzL3LtKQO$CeQ7~EE935R(J zt-#UIoj}9_K=RsNF<^LcV$XSL5fF{&vt3E|#ED>N|H|F?qPV4wvd>zeLThX(W1pyZ z@_}MiDA=@0d2oy0rhc^Yd}ka{Vs^ds=m)uX+0lL6_$88HDAZWD3zW>x4hX?g9vrVK z^1+sKD-|*g(Ff&TUw0d^MTrF(uKXfe4T;~v)kLT!RT>So_m2zuJjs&Ec(z6z&0Kb) z)u{*ULqFPUANV)>Y>}M(oJt72vIh$as=G9hM6!!|ZpEAu5ycDk3#_!nSU8C%;y%yws2Nq<)^5oDPvxaHA?M%r8bUz@ zSt2-l@LO&erob8l*qU!6@pb>rrbmW630J724Mp4=>Z(9st9K{zJvuzhuDdPRuPJc5&{X8k z7fADXCA?T?>A@5%o^#EnL)?%ZgDp5a)9M+w{KW^H7x>Csx2*!6`~1Koc=qw~2ay?qcMZDlbbF|Q3fAS<7ywWTa@Slqo* zQ-!VaE;(!r`2QbkywiuY5@mmUwYmPrJTcGo{b=TE7ErALbVwD|`Bn8F765`pW5ei1 z{)lp9Lii{fn$^Tl*DaUSyL+)KAA`O#}+uj`&y(x~#UXRqnXFlWheZvS7Nve)(wW|HTBUk&T(9j!D%VQP=`2D0n^BF&&?N}zNQIitqkazg!6U10*?WpZ zM#QR2&<4Jgn7VaKMo{wY9e@Ls6S1W`jVJV1+=gPHD+NJ>=Wc>Ed?*B5Bv2-^d(K+Y zq5hkuu*16Z64htS7`#Av-lYMDmsMw91M^Ej1p@Pht783gOxgV9cX0&^9*kcEgF$8M zY?yo~Dd+hbv%5*a2D(Jnyit(-xn@&uY&jWqD^tEr?R1Ie;w;dV71auA>GmFRMYk=s zMP-0nKPo_(`ex^Ktt*Ygv6i$z_})rsz-Qjy zj$+CraoL`^0||*(%jgEXxV}Wu)-0}stS6#veX?)h)&CGv$<|Z09;R^~Y<*6DC-k#`CEFr1vS>Sqri1zFXp(gws2UO>qQYBj(U!Vmpx z>3CYNlbYqV)MTAL@#7!m1G$FfS(^R%chda3(P~9k(uY}eVpq-38h|VUqCBp|KZ01v z4XS^kaqhl}V~s@~bzm!ERcd|(@$L$Ry3cZaoe1A&V}VPBDGsnHyMRu5DD{JJZ0ezh z6wcFxW%iBokhK25+@CE8J6J3LQ*VIj2v^fVDuvTisvC0jE=m=*A-kPvV9>k-+l4}&!YH}T%i4Ym|eK@GKTmS5`% z#qBQEit@mO1v>fzC`^>#IRf`I^rV6b?zQb#7oH&{Kog#owRCwG&Ns{qv_?4yO6~g# zol9vz@If)-55Q)SIS=#6*fDspb$@y$aREYnKcQ;VE>$gIXF!-f98|iu-MkaU51fZ= zUalsU!8vDv72ClR>nuD#Zti-lDnU~-h>!qNt#ZrdrpXEq3j&vJs^yhb1xpXRq^OUO zY(w{=CSS47=UluGL(1Ua|67}g&+=C>4lkgmTWT8L4p~`Y2CsO#!&rdh6>9imBaO5MYpxdZzvTCo~mqX5Rq|#DMyWw zKsfYtqgMQMC}7FK1TqrP(SOr*oPaU+moGCv@7`>z9=T)jH9-|y6LiBTC-dav_kRla zU@&D56}hzE!ess7cr;=DO<2<9^;{VioW_3O&%spk!{llT?8x{yVH3Sp1vwF@;D-=W zpc#Vh_`81Wy}QnaWZl#8%8P)Ca{b=W2f|lTJ;WPC5)k`t@Ror>V{G@ONJJ!40_==u z5e6clzvz!-lf2P6c??w?I|6M(y&G^8Fs6I}2L~@t{9G`M9pOVVBMX)!AaQzn26C|$ z-jA>5G6LN*=0D3>8+IsK|Ih;uT4<&hZ$ia9X6Hx|HYqzoXMF!Yln8{(`!LUDZ)-=klx2^U?^qDYE8WioZaxbnG8f3L`SFtybl2M1>k#cmug}pD zN1=&O*y4b(6=^36XE*gf!0aFfduFu4<)dW#0v z&uV|$4;lf?$~b76VXA?!xpMX9*2;<@_^qt0^?hm!gGIFdbUZ`x1(n(Iloo`Q2m{=d z6VvGjO}JV-*s-Dp#yGmv_JwnY|7tGI70T}A)!nG~3*X*fpi3vs_hz-FD#HMRFk_er zgNI|YkudsGs)JFL8kc+Z1qOyi!oGkl+9fIbq5(lKMQI`3hev z;3$GBS|VWNm|c9p_fB+6BGL4D*vTVmAjW2xO zQRV5Knl?%R(Fz-WXN~_0Xmkc6!Itvs(XE~_SVZ*mS%(7FW{0W}k3=f^dXkJjNNStB ziddvn@6h2c_Oa3MKxvpBkUOm7L@N>xP@0fE;r>mA>*t5f)7@@26BZTOFc_?wjX>Sj z@fWB6}z%}{O9FF$cV$zyRz$*{W*k8*QwJtEmFocKv?xAySZ?)G!G|9wph=$My_R9(F*Jslp-jf7c zZ3f5&Rv+o)eq2+fhX*niEouOQ1Z76d<9KgN|sO&gh;1wkN0L$Ss_rm|#Bh6sK6q3RcPF7mJ(fXpu`? znoT4H7UIyv0A1jiAJAT;XH1(^9(6p?ZuN{!Ip-ng#f)XQJ99~5cE@C=1HTmM@zEUh%@P`M zTuK-CF+olqe@0jke|2Ap&Si;yEW=PH$A8?O0-P?}k3&f=Qxfa>C^zW++J1u(eleiL z;G-Z;I6dB)X57oW1bT@ny9e&1>D1f9C6c zipU;PM4iq|ig~cENe;a`z`c4~%bwQl<^VcXp3F$X@WuBW%j4<`%wV*N`-4bzasi8p z4%Al0+a@hFM|tCwpn>-0_s}4H<-ca}=pw$E;e&aRyFd?sNO*IsQYKc6VotUSfMSF) z^V^gZz7=d|m=PJCZM*tbat=_8^tG*BZSDsu{PGpz7U z9=J-JFu)EQq*aA)$LU||RQM2$r{VBD7|ZE69Jt1LWEBFcIQiBdZ5iczh=_hL0tuw6 zGQL@*wB+33>sP$TO2iMrF%N{&7Suna*(n^7xZIrd!TN7TP?aIDgYkD%1OQ5G{j-yBvMcACyG zFE6{%za!8r@XD{F!Lz=}(8oIpQo1SFfQXBBUOuUm&c;vrL=D=1D3ga@f>-DZAq0$N zO{){zj(DiZZXtyeERy&2HRhZ@fJ$0(wC?WA)jSk7$eGCm&3YKH9RSP`(pAY`y8?$t zcfMbgeG~-}ZJ;z7ra z6dgaDd7MlM;&a&+50WS7qGkJfe!>j((K&LQHO_Y_m--bVif_Qin_?G1O7lnz&L0$@ z&-V?5y%&p*cYcA+3IxmV9L2X%(BwGHCn8O2+F$@6ie0Cp1y2smVxFm@CGlW)RbN`<} z_ko#IU{p_XjMnHgfP-3b(g7Oa4sTIPw{`FfOrKl9L^*5mn|I`6ZxjAh?{z`YL6Wd0 z7hY|3x-9K~&$7`hH;A`2-tN+W*nrmYVfmNs5bWG6bscpA=dUd_B?`voPbTj)Co@_c zvY~jnRFFd-eB+!&Lz7KIn_ChGYzvs3Nu|$XPkwHH+8~~pDI<|_vLsA06GOt)GSGSS z+Y}XyePFS^35%&R{H)X3R)AhFlQt3ryc;5rkYd3)24SLIeM{a{F!)vdb$$=PLp>{} zh;RQ2T@FZ53~K``NyKe*Iga` z4lT_uC>%@-=O=Ldnn3(g-FBG_gvvW^YL709MKu$|$w5TI-jC1Drx=6X(xB>Zsmu2C zJ_eSe7&jSt@z`X2_$c8J#8zmpU>hgrSbo#F-UV0d@3EhTN>%nmP5-TW`6x5qwNb`ZaA!jo;;mQi}`}et}CZH=#2O)v|aFgR;4hzKkkXUP! zBHlG=W6T-h8@ZWzIU?JhMGev0DgAQZ5 z;_F80I}o!B%Y!`U66SG|);MjHA_yOV?SPCK`6|UCD<|+-mz31ULRY9FsK_>M{W%}O zb+QnESaFkpcedDt8nZS0i+p6lKGbC9(=RuTTULTU2mm_VIt#06koU2PSdtkj6lb9k zkL^aT=7&cg-ArgBH2n|TD&8q5-ln0>xyejz*-Sf|yf-?Q0dJN0KDrzELzv&pRul)3 z)UVnV_ccS5vE&D40}&?^^9C4PltSl(nJ;CHzW%R)IRre;Xdk9ht{+I*7CIc0!B-Bs zG(tne&1nIz;XfE6H)g1~aPX%d{rO>hHM>Vq_br}rKhM;@nY$Ba?`SIX4uhNeJ@{{( zI`ZY@^AU(F_!gDj5sk4h_RQ7_6Tu+H{0-bYtl9_Ev1a?hc-?9t+Hk8!Wo+H7;iF1Ne(% za;3FJa;~>J+Y&*pvBG&N1G6eA@@+#zD#n5wAW1;8hkw8RQH?zBL_n?WMgodz-m5(q zVcy}$uq%N!mfuUY?Ww|O1IDAaFcmLK-}ldO#YyO%dChTi(w@>of66w4Vj^@851#vp zzsg+oajRp2M1@ut#FBP2- z$I=qWwlmwuuY6`NO=;VtMSB{)0rhq!zst-C`y126|gu6^|ckPQG{xvKX3owal(f+&8BZ|4*F<-5mAIjaP| z`w_9S!m>K0v&wGF2-5*whf3Et`+YBO=+#^%j+dkCDP(5a7xaAu!LtHZ&ruBP0)ZDQlt>Vh&cOy{k*dJ2I#fLSlr}6tv@8 zp2_DIOW4}34e?X(I78Npz{w>m->yZAO<=??HegvJ;i7{ z;GOwhM4T3;_Ss>G`obU-OQB9|dkG^W-CVix+fNTE!Q_gHO#1$`L&8sq8+*j3^}5Jm z=9BW!HA<@v>Cw~AZHmH8wGLcTHW|h`Hp)K@%1d+)>4*)>%`!J9$!)?Td5@oRDG9zt z#gP}}C~jRoZmrdT&N=f+_5S4TF@Nuk$dRSP5?m_Lz3YIV`Y1%*t#$C5d-YNSG9=nb>q!!WJ`X+`! z{uQKD>4sdtoqt4yDJ`AfY53b;HHhKw!~Dy*;q_0nyA+FOk5oK3LgS_CQWc`=2F=I+ zB)Ph4GYWmf>|$}eT9LJ&Xx<&=73j;q?yAcpq{T3hM8d+{llWFA&QO3xN#*hWq@qH% zdm`-!+19c*ZX@6&y?MZhRrF7_l_{|#HLcar7Ro16g?9)F(8SeV$JTL*&81Vf+E8xb z$=pI)`B{Y(&-**(o6@^p?oxO=}9s;MTJjB9HhbDf|Pq_en3q{MZoWC&h%&aXXWY z^v3L9OieQ(d9|F|JvWz;;NT3@VNqG#3(XO+wv9DcYT90R;JW^Vjyi8up!hsDBi29z z%Mn6-v2%V*=i>Q&UVOPFonKGKT(a!~YiD0exep;}XgM{6?d^i)+a9gA)AcooR=gj_ zjZPba@(A-L^}3~`N0TM;>7c76rJfTJpK6@8P%!@N^2g~B#UBk-M-%dz8z=s|pbuqc z_}H&)LM1S%uF~EAH<+OePxdWOo-9U1xh?m~jUSc9kUsM?e6^5ajx^cTl+o03K7 zlO0KE!Kv)i!C`0{{Rhp*7NaCxGifgCXAc*n@|;JTvdYTS!@1E0Uq`#K@X107_pA&4 zero~eS4v7Mtkb}txONh(p8deG5L#V?OKc^Jmd+~H;XB{qFgbh)R1g?N417z@0Lss8@JDBoLFDVDokfVR{1Hr zme{6_f%UgULw4RX0h{W%yB<464o|OT$yr;oyrp`>UH3pQ8NHGG$oJw7OZR1mal(qisD~7ZwA5#ra5~n@q{X^lHya*kg3I!c4 z@LZ780JhN9IXuz;?iFHN+88~|c9$oJAmXsKLXIfwi+&@1>a}H;$vc_-u`rZ4=*hs; zza&8#=UQKqnICzHocGky98;dxVzMK-@}y>|rnnB@iSmw>oYp21UyF1dtUSGqw-_j~FwovR`L#CDHl$BOuEpWX$ZaB4?j;(Wa_Qu_X%gAAo+qwv;p5h%W`uwi;U z2Rl^b8RvS2w7Jiy5hwJk>yyQ(4uclNce?~DSqw`DlL+KUn-K@Bs(e&uloe?^ftJY@ zlv?%u*LvJ}>vHK96k5zQw*yn`tUKcYKkj&hFio<9w)wXWY;{y_kJr9u6R7nW8(4gC z@LyKo*l!l``!NoF)$NtUU>oKRB>USTmUMmegimfu-pJm786$2FgJ{ECUcCkBI zV`WCL4MCscsypg7)j}Mu8$xrSy9=!?dC^`i%|Wcr+bttY>+m66qt5`?s~C_;Jv8o2 zLSZ(W9XE|kr4nbux-hp`cUptfdEEUY(?wj<0M$A1(D$6|NniNQ*ghFVqoR}ouq{kJ zM|qiZ5gC~j7+d6HvEeVx-#7#tLp?Gddy7io2v+E+wf>G_-8ZPYGXNN%5i&D9Z`zj% zhwot+Kr-Fi(1VyaTSyVdenBa$MdOgJvdXnhA^`X@igpWzfBM@3e%EmM*>5XLJA>CP zZz;P(#w4d?urITralT(|cGs~h~solNhw)W}d>H0fvfd233 zthn*NRVj0S8e`Sgj#MQP%pu1O**ZGVMf%vit&1E%#Gi7y{Xnc$)wm* zK0{{yMGe|daBM0?@xqG`^BmHf8%Ka1*4KMF45+9p)1|S+jSHY7Ro#o)Za4d=-yFh0 zCH7KGPh0dDhxN|BXLY%1PuWs-`i_jRc zv4J3zr0DbajLE-dd^$6HW~mKPp3Y zvp6eU>A~ChsHQb3n;zDJ)5^v7F>Sa_jkA7}6hKXxb)kq))jS}+Y*_;o^e)fW`v;qu zM)<_z;)~?XsRpO}(-xcGuZ;77h8mXW$M)|+hV@_+OHJ$^sSB)Wu{{xJ;w*7hn078} z#y2u|Q$~yV8}q2P%U2dBwl+pnWgPBl9wq9CN)2x+TN?#!vkskasz0h`Ezkev1uYBv zmD{+sMDC9}b=7kcowMcaI5GDmp5gQcwHp+UeXgIo@k6$pG}w;K8_%6|{1<#r{dTIK z3E<-a=A)W2zdN$IeYt(zo?LBPtJpc+7BDgvS86ytnKIM#OihenhCqe%>Q~M}>%WoM zXtl?sy|m^YP@FS^F9FdzGPkvTh6TPb!eR2-jc=>Lad<|nhI%)1nK_ATxjkU}Y}j*@ z8dO8?$cvC59@~U|BFLxli}oC6>MSZb+!`-=vbC02n#LoU|dk!~Mht>pkcQNbZD~r+SlHIBa(*;5R zy@PuXMARINByKzAByOXnvr#?;)M+o&UOG6@8pM73v(J&_G30K>WbLUE)T^32*xpVF z^C&3B92)%KjP?i0$$*M{vfGFCUw7j1>bTA=A$l?6z>yG;_Yrwtqw6Fh?R) ze%aYQ2s3WtWgV$vmBG*if7x-@2CJ+!tzkS=5i{s@PTiKXOVZpn9`Isb{gHg^X-K@Z7;?A-#$(K}AXC60$1N+%DY=RD=Zvf&_a&Y^AZbb#o zTc=xj;arcFeFlyIY-Z-Ft-h|uC;9UA-y;aWg0*n4%^~OUA?cplFBMojI98qR*94fw zo%Px@!Mf^FTabq<<*_r%)vqBs@=eW~@kol&EfSTnsn$N@SF}Ku&P_PyAFxj#6)M0$ zN5Co31QpvP#e%3{n2)ZUCjqf$##`H5R_>bJQn0vu_VjzMaqJHIsv5#_F)N7)NwLoM zFGb{nmF#M#Zd-Yq@k=vlg26ur8~r=ao@`^vjP z9b>%+!z^~Y*Jr;MqGYTi$<;sARZQ7VoR|niqlONNq(ml(n>jI|GZSnx8L4+LO68S( zgyJwUvvl?T`!zZUfvuf|PYB;RdNrib@w}GYiEw|WS z$~-_j@6V?Z-PijapnakIlV<<`CY+(&~-ZlwN?^R9qx00gnMqAZyS+2$mT$ zv8dJDTP7_jp)r0hBM}~A(3<>Nyv_#Qu^AsQht;D+TTarN)UJhl6{UmGZNz?eb21=L z$4}1QA4?#0vC}V4b&Bvjj$vxxynf{t8pe;`tZ7kk5CPr{RM_3={H`y_0|A^oi|x!g zX-H7sO@g9@*6@No-Q(7mPLJ|XgL%@t7+VRI7E)4Pk>RFu@WLH)qe*}w*|_x`^6=Ug zS-ejKE8LWhEnuMfaq!^0yH|YmY_NH%+6I&H?hj)1jWm3>ge?6r-^Ys5kK%BrHsw>b zYm&f~NV{uLhwF4d&XIsSL^$tJ5Ek_CfTcYxxo1;is0KX;)qUxUTUGn+!J5{&$(ss~ z3pLgkuQSvR3dVjK8cqG;01Xe7jP2psBL8gIeSrs=c6$hrl5j^?x2La-pucBe@OuZfEH1#^oT{SCdoOA@ zqghMVBG<>EBc4;fW$-@dB!h5+Z>PFZJh}v2Om}3uNY@cM?JyDgYXxGevU?X2&gYFcS7$*gch`M`v^S6Ma>RZjt?MZ!v zMq3qXJmf@mvjltrXU&U%Z-Q4vWoBx`bWiP$*_@cVx_HTZIT{XFR|KFH*xz#1xQu$V z;O?n0CxhkJKrk{fz)aXpH5@uQtidN~2Y0)xI24dR*Y}{fIOfq3{XF@^9mYNhag-H0 z6DijG^w~v%=WjdSCCUKM`h!LvqtfFg6^`U|DSlWN?u!61S!SK9e^&EFiK5nJnUy1I zwWp`S8}Q$>2Xnj2uJi7%7L*#BqL~|r{3~aI{lRn5KsCM&BPXXK2HxFz)54D*Za*%H zvjk@k>ejF_hQn_nW2yG=z>%yE8fBGbYvpa47x4j(?7vsK? zuO#IWq&yxlP#|ac-a`_y`ume5%Uj>#gDN;)-QLO{&;w&p9h0v&tXpcrSI(WYn-ksIOV{%`nWl<>cBt=_b zJsyI9SvzOpeyaU#{e)#G;Eq14R9&JvhtRIAOKp|Zg-R4~&Pj+b!!6W+#kV?Ej?u-z zsJ9ftVpn-1LW}Fm^y@ThsND9L07c`cg*kFJDDwNg>fH71zLt2tNmt9Z%fp{Gy#6`O z4@Bws8olmsC8iaUk*vBhho&3%Onvs>qVRQOC^e0{B7E{Rqb@L%qU7b&tR4WwJBv@V zuzF*CJ%a+U4bSheoHxXd?XJxu8_SV!bRLdK(}c!e8yhK?H)I;ME(6@m+X3b-w+7ko zPxo=n0h!x4zT6z`6_*xN0g4R%wOfW0$Jp7UWFR`D_2VC3(}YB|mF>m4sgE2{D^s;s z7=VvuiIj-h&tjaMDs$Y@1D48c)=M0FH&6X;h-9N$>4wnk(qc5cYcV|_q&nR~%|@M- zmXAbiyjHKy9I)%>=_fvd(PRB`^x#Z<{A97aK;h)J!vp8Qa2++q{W#iKZPd%uSWa5l zY<5)LwDw3seRkCRXO}~?B=5rEH?;;eBggF0)HjFlnt$hvW9~>_OPn`x`ijzdk->J} z@N!67-d-THh|4w&RxB1N^(?xt?J^hHFJkzarK%IMue$HfF2P-*m&=#g&b?@{=M6Ru5a44|jLY^RBZ5gTu7kKv?@6 zrhwYh2j$sqMjx-YKU^13PEf(qosDl6{+q+%E6PxlamSx_? z{mH*Rz~7MoO8HZjHN+TQ$=dET+oQni*+eJJ#OKMEjHgS{mXYz%1Bvsd(yK%;8#)_2K$*IEBT&^+vqKdh)xGZcz%wS6WC_fCeC z27GSTgiRYTIzcQDSq?{TA!DJvyCozw^~J{>a2xSJbZV}(PqPFbqCl4dM$)P~^wf;w zeZrrFIVhg<1@3xRdJ+%%z>wz@MvEwgW^9O( z(caU@z?n$sf~7Q2_rl<0CCm5ibZ2(@!fK?F;mTxF{DHfk`!Yi+XJAYe@R6cQH2!rs z)Thk3*SH+hf$-oA<=qUP2ladPv0IPsp}u8RK;uRTrmJ=F9V&P5xN{L%D?J1L-TesA z!e~^r8=ez;3UcaiOD#Lho}HXppPK*h3<&s8#Aq!ozmFqec}ok`d=WX(Oud@6o(dI;l-{&yCjSgSidonJPa3c!`Jvru3j4))vEdL1K;VFfC~+^d!))>qK&BIi zvDN_qmp#EsvTRz}y8MsZ_gXl7(C~-yOKBUfF1u9Zf8EJ$ws3>0sW6 zAo{*9vf+kXL>13fQ;W6uWCcA)XtTq*isOh>IG_OWo|IhLjhj7eXiyFpnD*YKS_R3O~ znr=%u(5Iqj6pYwjqnJWAq3lrdSITc!6xIO?SB5h8*QAqiE{QKk1v@TAG{P zfA5-P&T&pWjErk?*N`9gzK4UZWWGofTH1*IGFsU!5wb611=89{{I|>dv8_DZrW7Ug zJpDehjV}b~Wwm@xDtUHRCyS}E!d&BzwH`!l%iYxv^B19dF;7wou6umt<+k6?#6lA5 z7@~lkz3!Lpc)V9AEe;7=5CdlM)gL#naG$QzyNKCRTN|KJ(nCqOoeo`o$NX^_wvuTz z+jn1E+bAj!v;+CYjL@E7!n{zUz?YR4CKUE=H}P5gk#hq*9bDJdAD+l->-=|fK~)#|CjS6 zxr@eUfw2KfYL>UO+^F+(c)%&QbG>^7>}jB0;UVku^;>W9XQ;hYIHKUCqw$TBeg$Jb z&?wXlOt!*XnZNqNW3_uXzhsiNLM*jh)cQ;3hA?X8m~WoPUqG{yu(Zs-CWGjnokdS+*u z5Au4Cq4n>~ zzpc3hKZ;Wf&t^a11hoI{^(Xo=+2;z8V2gF8AgotSqU;!vK7CA2v)OEpMpASnO;k}{ z2B{4nJt-N(3UN=F9N6Z%@%uOS9tl9SX1zi)ynH|u2tf@XY@qgS85s!aAE)%$KUcMT z2h?jy|CxJdZ2c7 z8~O>hc+GbJr4jJEiKLm3?QW&_qGE<0a7XfIQvgJTYTM*@s|0Ix){%FXm7V#QVvzn; zU5^0*qIs`1nmHPrCq8EVvDb??E=H3p6eO%=H=s7$pcrc&;WHfg=@7OfXR8oNfi;)TB#d33_wS8WKItuF=kL z{${5%j4lU|cZY-ArQCE|$%)nM3$Q39_yo~+#w~?_UX-!W5CpkDFh4-7*9J_;BeI7C z_VA+9>@vrWLYs6fGQJyxUt(3|V06MDY_}T##ugv}J|3SR&9y{;tOQ{{1n6k?cL~z` z#-bNhZbmh&))=_8TustpX_LV51ts=RD{;X&i06i^8 z;y|*w2~-x0)Zg=Rrj=660?ZnxrG|Z<9+%tGykMi{ch9~f2-(13x?9r>x76(Y z!4XgjOx7K?!}b<}vz*~4z7Os%D$eQ!1Vdc1rn9-(L)hf6Vv;?n*)Z!XQhRTpcjt&+ zYw?YY_x~9DoW5-HmF)IgKNTqL{y*Ozt`F?txG=v-w$Aqfg?(*#`(YHP*qU<-tuH%V zv=_l8eB|yiNlkSOsC}?m6&nTd;te>hKxKcENf!V@t1+Fy<5lSBc=03}xzwjBV|45I z!AN@wzl2hG^=4v&uMWEn+k47agp!LyA|`jSHt8&k)FHs000hwTpW8XkB0sKIP!NP- z;a1wRHx956aFe1ys(>Mn@1{x!oE4@o!Yg^hsGP0ig{&MdAr8<@uP)6DASs%g+#=7` zoIsxT#B5jIecrn29$Rmsf;oYw_PdV<`aXdq;Ghx&tPcz3{t1bV!Mtp!W)BX)BNF5ZrG0cYq-zk`r>mo_tpz3^}NkNimFxwz| z<>vHRYJl!(wg@DHXRmo{=O%yS$trw%M8L(3j=3qS;{y1fHF8-!kUn^zuf<}0VKD!E z8w^7nn~cg>z8eq%4;E5_i4Ri(AFHC-ua?N6QQv=4KB={+N+0PRw%zY%eN5njf|y?d zkMOq;OG%fAzqbCaS7V4+P&Bil;csj3ySfyEa$kQ&6vUGPeE3l1yu8y<0Y+vztL>|C zhSF0bMW04_LeM%p#^O=T>xokJH6hLaS1R)=|0BLoA)M%&WCcPC8Kil~l`f~NN-_Z0 zl?`u}#xg@jsA9^Ck#MX{_^V_X>e%=s<$tDkbws;<2}SQ3pZmepG!V*8o71U9zSqs3 z>PkSzlnN0cGFi zwbWTka%#^sujlGW>8peHJcTh&jpr&CBWZn7V*3XkseM{^MZlNv2{)yGpoJ{{(+DfR zh)z!Za#p(vQk5-fQOkbNYyfShVxcEI%-+vi%r8*QUBXlY9_b+IyxhGBoH=oda5lQVie0Y( z!+XP&+5(Baw3jF##>?`-x6n5+kO9&VwqRTBN(z!0V-)7tk3V}_C!#TZJ}gM7{`2?- z1T1I)wd0EX&p7LxV~rn}$&t?0>>G<19o83?CTfa`hs?gr?Qqba!{_}@T3Z3b77W&v z)WfVIM5gF<8XIx{I{2Q?_f{5rCf?S7?izp1^1Dh_@BB#NOTGr_|0Fti>j(MlY+j&# zjVCRie-kkfR>E7qnBtts)@WuPKW5`I5|oQ6H=f@-es=Ds7_(D6L+Lf(`urD2(iPwO zXU>hOH{757EB}TEbMtR{&`=D>pmB^fLHPERAc^GZ{C~wtv2Y*$%bLcSKENydKQE}T z1GNJ5(_mpuFxFW@B+rJ>_=_KZ)hi)o2}lL4OaJ@F%TH9<69(_aL~5zg$j!W8wz$G^ z$Gd$2^N5N>F_{YGrpt!#*w9`H&R;=6+lFLX`7zNDiE~{aY=iO)II@?@DE;x!w5EAP zbn=^LI_1Q_uTwG0QCLvvyzMe<_^@M7KKz98(ZcR_9UO3k>`>C+Md2?5ih`>i)D2UU<1q4S9G1dszru zDky}QUO9CZD{Cq5))rMVRkY(+?9Ag-tO8M@2#*s~CK)sxE#xv9eM(;=M&B#KnrC## zE^-%ZSlSU14|pOVYlNy;aKO{$V=^IM38LvZ2dw0c_+le4vD13B9&MAFsGDmxp=h!X6QMC5U%f`V(;WP)9t%a8Z~ck4o~BRb zdj!X&WKR~H8A}eEQ=Jf;d(S=GFZt~oa?38Xm(vlF_T~$>uAKm+Llgd?$k!@nmJ-(g zN{A;Y8*53ey0$+5ULKF0MILty@f!KMN%3u9CLWGZ0|a(gmA_hpVX@gqjRmG#)!nOq z|SwT4DB@{7pD0dH_~A6I{d5R2XQnVAA_bEXh+}AHpJzKZYFNY^wki8#f&)eg3m1%%M~OGhSo~t zdw)W;Ln1-88R5w&!WXj34{b3CjJM1xq&OO%e`;sxMWb`x~kstP@eua}hj?fu`>fDA!bu`n5SOIR4 zAt8(6ftOeEe%L8;)WEvD}{hQ)3*b!r#At1B5byy=C| zE_;JcniSLCFC?LpyDT1y#{?&!hmJfDBR!9W8o-M~D7=eXTGcLk#7>W3G{JEo`i7mn zDhj$nb}Br=D5Qa`PqxtQOKNFXsAd;ASs6A!(9~M29&>`!g zqt8q>xrtEs#w~VU&_N|*V^baO*Mg;NwSO2K2*84kl9vg7C8kkhyoSyMlR$gjAnTOc zA57o^GhhFAEIvZ?v#TPsRQfjI+Pvgvq_ey&4@Au_^G1wr1nB4#zO~xLJ#N~e`k)5hdtm4&C#5E)Cj{XBKaeEVZOFe{uASOjQoFpd6-M3EmGSh4vBz^ zKy>!vJc`H8)R+*3(Kz~J|9!6f0aPUo?%8lp4@>f zv^P^L_@af1T-fKodx=>bK66C=guuf9>o550gty*gx5x$`AmV>CxHk#^>6Ob57EjIg z{0WbScywxW{MY2)|<{3qG-mKnTd&bBy8yks(uxetLRJLqlU6t|3xe{RP60{EWMkL%71C)clqIZ<_UYzD_Tlv~Ew{Bn73d{?Ee9 zJECjbHpfY&ehNF-cRAiy>L6%nKgc z8~ES7xL#@?pdH=d9v)pfs=c0D9m&TOkvrhphuY|Q{q3>7MLf-CcqankCKq;Ga%5c; z<7{Dqtmj2tLh)dk2QKu24l?*%LvJa#*n`*p2-Ee`AD>!?voy!me5%8%*J_WoV(9S2 zO?OK@>$kgWAR7H6h@qYuD!WCBPblP2yv(XWf2S%Jr&w`>h0CSxBt2-y!7v1};`7{xiIhLJ4ym{x_FHNr*kO z!FT=PLO~4Gt4ccgP(cD&+~n7iP>FZji5#Wne>$_OsGlyetD~{~KDL(v){i6fTqGKa z9kmmkyjTMASQ7kMK1LUyHsUTEtpLI*EXHJBQzQ?`kr$r$aoMPfWX7y?ex}#ou~T*( z78%XVT&wajF)mFapll#W_Txgt{c%&)waJOup84CestA`&xpyU+A8AM{*z(4O4aJte zEhL_Ey<{c`YkFK@AwAxZ_g~C1WVq|vWzkys-p$;&Pg0!b_IO~)GgTJR%18Y<{CImV z;*-qExRlUw;xtoGGMb> z%ZASG8zICPnB%jWT^*^Mhj$X`gZIzF9l7=>$2L8>e~qCAhaH0(xL)gE3~kC$cmdIm z!p`KkLOViPcqODB3H8wGEe?im`(iH`QMovbTDV9`T#G%`D_gIIEZi)+afDy(`zFm7 zRt~u$Zlm@NZ|4VV1IhRv)_K)a)CpOZAR5;VcRU&=lfP7`RawpaV1BPQ-~IUHWI|d{ z_0Ss05-`Pii7j(6Sa**wW7kzu%n!%$aTJZmwMOdLPZ;TRd_3~IzTt|}WIE;m*GP8` zI%n;)aJ#SVTE8H8HS^L%Z~5ET51nu)C#OdxlL-r{x4Qbq1OI%I(J=Y@0wEEl7qbI) zmXnf}&9*OF_xP$1$&oZI7OtGebJE1z)rmE}3^fQUe@9DI<;kGs&%MQtv(yv<|BqB+ zTwax1B#Wa*Wep+VnS=4iZN$~>iwzR%cAH{F$ES<6xrA-a=P|N>t1{zmNUR``VL93V zRhU+r7Qn?@_{d$0_jjswTrDwufp!>w_0no~t8?Ha-P+Bx*?r*O-KJ9t|bTet=H8^p9^zHs~c z$)oK#tn16oM$w^NtrF`pHW!ier_cALCHh$L@#=C(G|hGI{k^hH#k9wo797d8bH$LJ zj72y@XXJh7N7LS+I(X(onJX^>11ar+aK-+F%Q8U(<=iGi#Bh474{V|^mq;jzak5W! zrm?D8z6Skw*;fJCG-%|7!>qULlNPF&Qh9ZOcrb(fC_%CfgN+6*)rxTUwF$H=_sdY{ z3`M1ElVnkX;$%sMz4d2Z(5dR7ncmKfLv?a_T=~XH+G+-Bo*M-F-EqB*-3t32QlsMi z3Z*8LC1oqJSOn^NN(_AEP#Q2BF!=V~3_0XHD67Euw5dDpH1Ji$J+exp-}4;pI?gFN)IU44fn7 zm$ws-=y2gEZ^@}-nj;o>%xU3X&zOE<|HhHyc`Hk_+NN<69UZTSo#j`He852BNGA%r ziG&u5u!ubOq9_$X({ZDW%v1;`_0pM1mqloU#nir!0dkU|c2~N^+YpOoGs1Gp!HC8A znnURn!o`#&5a(WQz#`AmFu!Zfyu+gtN&XyskbuxJo9Xb6T2hAPSVn5=k87{>9uJv$ z)OiV6tcZtrxO%q4Co@6};S!oJ2sTRYVePA88U;=^6ZN)Qb0!ny49szr+)Ae>Gy@XU zU-E*?#xP3>xs4hY_*$2fUK5n053QV^9=e1|oKwQ?RKRgjXu%yYA=iM#1St|HLEF&C zvk@4Lv_#<$VKK&vucI=@jU3tF=R9q&C>EV#3iqT6i_Er0^J&5D&viElZozCj!t3b6 z8p8~btW-NwulHUr+*)&0Ki7Vk(YkUUdsp14wVeDuoyG8avVm)Z{=xEZfXi45WwuEZ zH<1%Zd)q|CnzH#mEpd8Y5G3OAZ5tMC(`v~+tv&kEj=AU0)MRPU8J?r)Q)V0Ko}Hhx zRa7Yjbvc&W(j2?5FHphm1d@?t;F92W{jlAC$0R=8!DlpbstlEKY%-E9YFNWJKXQmf zn4=PIi|nR{_%{ct`PuW8%b|yHB5iA4NH|qQTnXC;_T>*5Us^&TTt!kNs$Ee|wa%x@ zzh#{drz56a-3S&-uHqWI9FGU0hCq934UIS4>198=*!;WBgyP`pYs~1TS!`OPG4$Lu zEnR6~`RrQ$sW*Y%+Q-g-ur#eRL=Xe)UtROx)BV(d1q5PUih;qGFSAVoqns#m2Y- zk1keb~6~V|@$FJfuJsj9w$Ru;Qt?iknB;?v;Xv;HHc?q+_6Oil1fBNW|6@NVkA})&)({?P{#P{e9Iu8{dXC$6(Us92{cvXFY@-Fimn2k6<>zbfimnLUHS6U*-I-VEtg z2lY@cSs{srg*jh<_&+sFQ_=o+7T|Nv6nT>%%SdzBf}Jott^(7kT)w@8}+&iqb+0JVc-?dUpK|r$W4g+rs*v@ zFhRJQSX1%UU1O*j!MerLQF)fhA*XN;dDp6*fBB~6yf0<(NYl*R?GvPt-W|F z4JRm%an;|IWUNDS$c@6taj4tZ#C0Q0Z1(ngsmn3AQ5028EEet`6SP-SDA2owqy_%! z3))NIF698~cz`H`hN{i-RjYnm46<&hND!Gx(>XVRG(7zaf7WAusJO)(&<4L;)A%nE zl7D*^(3Pl_c;b$nnf^@bq1^sCvmBUR%~{!5Gg%9Sx&Gc{ zT5#Q<0Q8EGcc};37eRVL*T{8du=`6o1!J=P=~#(@M^)L)27YR`y|@4j{zr9}EG$m1 z$Ohn}C$v{yC{V|!DVN@h-xnK85`v`wc9vHPO$WXZe#VI79{IIp_E$WZ1iAp<__ofs zA$6^ZGPtDL{WpA>iK_ayCAa5sKjaTA<4Z(F9lq;%X#pGhb8;-V3>x#Zf!^l`;z)I0 zAg2AJOhSR0Ee!j8I?&$c0;Uw#q+z=TP0Y|yiy4fwSZJJi9<_+v2gO)AJjaqw2I^5g_KG#cQm@PcCi+t73?Bd2_U9zz z=aJBbg}vL(h*@z7!f!5L)-~VzS|O+Wjv@H4?dISW5%V$k=|0I(jZYXF7OW0HS8U+}%mvDZC3yp&wG$VGMqYeU_qhPBn#$=y| zsd60ZIH;FOY2n^{F5Y)dG|*ahUjgzpB?Xu{ip7<2A z9vwxlAGW+Nc6{jFDIHyw2KAMgwmVZs`%a4os zSk-MpUg)*vf%(h}JCnT>IX7#bRYT%hlF;!IrO;b#a#)J?Mo8isD0spI2Hz<< z7>`C|!lCU8Z^sd-J&){QJ>V5Q*~=YXF(*F&1|@Nxn0eREObCsu7PBQ_|HYpQ%qGQc z0rp5hwKWg?t`~07_Ro*rrkyv<&&YQW zzD)eWn%u_`azgBR6{LZtgHVGQE}$Udi8a&HwhJE*i{b2uu|`z)`UKGzf^^vmRrKrU z=}U5kH(sPfLM4pX+~rw4mEr_|5!sxuiq=9;KDNu*K!eU;o z^k)uZ#)$y|(jun+Fra|&lpa9oAnW)`g!__e+F4c6P0-VRWE3M$zUQHI#s9L9?BT@7 zg=NWo#Rz*#;7+`|EKhkd@?a+`kJH?TpCI{b-kzo^QQxtVC~4&s6z~LjY`JU)IRm&? z6Fm$u1JaKBIRj2ZX@XT0n0}Gv3I|0+rcA>;JjaQu932cC3>>GX^>=Tt&vL4@nmtOm z%w+8w^IeWSTMm>ncMe*rTXFESD6FvYhiwps38tbm8~n=%^-y$s*Lr>xJ+%DPZWU4_ zZM}P!{xXtbdAOc=_n%6Bos43<-nVnal^DNyCdttp!jwgvC01>L-z8&zZ5$xwhd8mk z8bTRU$Ss2{7YVUdq*k6(`@*^K>XIY(oEY*qS#v=uUez53vU+Aay<2D-`z={5R!gO1 zi;*p3L0m6__e`hkKQZCgGQ1n`Dk(KXLq!aLqwwBb<@2b9Z$iC5y+F|f%PkXjW{r2m zlH{JAB3^|!EMI@Z4*o;sgNNQ1@s6;o67MpB*$30rjGVR%`$2Z0_>?9rnfx|iYSS46adHBY<1SD#2fF(2G%B4T#oaTt+^|XU`GaH?RDi zNITydcLj+%E|IoG=fClkl_Yx?R?3;rjp!L9sbcTe?BOAo)h8If9KN9NlE z*5_361RPh&IDB-evQ#wUSGQlE1sgK&S~6H84_l`|1n4PtR9pooqFybBX z@YkA9e;qs%hUA$#)#3-md1mFN8D0LkYMn1#juOn~a|&du%e|EMviOm|68vcBf57qx zj^t7zX2g_llKGI{ODGbAbdR)fB%Gg!D7teN_gpfOw&~G8;Vw}YdhSBYsa;Xbt6K1; zFsGP|jHq84rS!TOjw?KxAzr)9L=15j-ZHq` zyN9?sH9sOy*jA7M9#h<)NHTuuEB}icCE%wch#w2uX4o6BPz_$=FhH%K=iKVL+l<4Zg(2a%WGP8g(ie6 z!ZC7}-#j!dy52ZNLZ0)b%%CxJ4P=h!_{OdHMYIjTf@nANdJh1$(8Xh3B*4A_1l08e_C&SY8(S zbs_l&f<3=(mFH!Q|L`MD!B@0+ydstQ!AsCwU{ZqA2mfAG@<;w)8(#ufwyP9_74mRi zXbf9s|8$G5PF)*KFNXtT!U#Pzfcl~BIQ(=_6sQo#TK=1Q% z$?w+)jA04-`R#i+f)}##-4Aki%&_5<7cmIb!jBJcD|$P!O-(TisqCM{GL~V*B#)w- z$W44n=y0YxiVQR(n!blGZ4BItz9x)WqFBlm7x)UJAk}{O>)h}-(W2hBqF}p0ulj#D z`^vDWzAxONM4Cam85)L`ZW*MTp*y8Zx&{y!+Ce3xl^nWDU<8o{QR!4lY3b$;zyEW; z-VgVA<^$|=&OUqXSnFNyUVEK;`3M+XhR6bmd^i8fiUBV|``SK2dk;1OaVSMDKPU|_ zbH>WSlNI8{`%OQ@NBDefI&krSxDejfO|l#{|% z#)+lN3aobSJ9==?^!ohJ*WL4=xWO64ys8Ndrqm$sN%dWSfgM1O(5Q3XdjVFzegzl4 zk)tfS&47POTk5={Jv5>mMh9(^C| z&J{|b!D%2p=--aKLws(xOfe0LB>1eoVjBf|7ys$gC&^i=e1UGm7DuT~?^Jz1ENTcRY|jUe159c*hEAg|`EP04Iqt{p7F2BH+m3}ID+*vcun@KF^Zq#T zT0Z;8fmeP(1dW2|tm#V5Do+a#`$-6xaNr%8x!Fge|(2Gk}V(l6zFh0fwvf&^v50|agRdBADrYM=GEV|E#dopRJ5)^>Rw;L} z&UM_)Mg!|@4@~j`qbk?tJ8**JYN{AE$pl#}YU_W|xMWw~R~~_*W1k(wt{D>3+5?>? zb2W7AtgSVCS<~MT0{`NMMQa^2Q(jaeBht+)zH_dtUdy;M*0_v1ch-YI{&k`48eAcG z5~h6urZ^+ti8}?7U~)(^-C>r5d5K3C0^f8z2AlPPadSPm{JI5BlS3Gnu1~x;PkOv_ zEto;~Uyr1g;Nd>`IJ=x6XXN%kMXEm!C6s{!G+>K}60ILxT{85Cq$>LfE4Z6g8guF2 z$vx7ZKpeG7ZZfq}N|b_!tsU9f3gv(rZhlWQ+Ad;q@iz?3WgdU2cvwzEG9&v8&evPWDQ{w}zrWxTd%? z>TFTP$M>7Cv#g#Kx!JnEEM^JEUnJ?o(_=_v2GnwFvfJ=S7MYR`-{a?2AhR`d*4=F& z>yJiV3B-_fNoG>7)RRasV&E3>m#?BOrB4l}Bqhm*d~)$od@$`24ihY|0blW3^27x! zrli3>kiLB2cS$|NQ;x)je}P{&iE1*H5V`uK2oY}myG@Mi_MKqZ(5|^VFM)}2Z7!BafuD561a(d=$%=6DHO_v z3z0a;5CSo4d+=Z()?o!)=FfEL;**=~)IQ%=QSANU!hvLx38aX;`p0v$CdhXm4Nv12 z)i)%xm4D+G8f@rJ>1Bx?K2NNQqQd+LacHGa+yuA|Ig>p4`s#y$^7#I(3h%(ufGsi2Kbkl_2X@z=|B{ zzesVU6s-h#&No?-pvm~Zyo|sKoKGoQG>^piX8YUU4Ep3+tl<|nP8K5NZ81Qtw$mt? zRkBgqS%J(3sI#H}V{bAsYj2NL2H>1jt3H$o0)cHsnKa#yuChTbGo>rg?G{D1n~nn6 z@f>=epv89Y#H0#zV)?nP>n)RehxXJm$NYPG(5%FjR3e46H+2d zCCObrszB}(5x-@LBov@jWfEU}a$TbzYDhxX7)`msBFIbF{^Ao-Af$gZJ<2E9#k(nh zKV4DyU_{q@3s=qyz+Lud8Y7B<=VC7c#i#(+mD|baA(hZ(N6#JSk1Eg}+!n0;;z8OA zl2uON9QT|L=sPz(mY92R-y_QA4sS}*5$PF{AkopwT?ahi990l)Qld2;{RgDIJ`;Kl z`G0sup#YSu0Lz&`F@S&hKwFz;sfh{@*G;oHO}uGTCF~B>rn|^M%>lY6L(ETJ+5S0q zVV3F~Y-dTRF(5W<21ww;$7FmSAA0Yz&9{*v_M*gL?`Lr*{voBFw(3i!8q5uLU~+-> zen)C51#7r}xJZK(>$O~0V_PJQ8RSrW`NIktNF4kHYH)0s=O+RAQq`$K0>+xbj*8G8 zoDhsad%X%#Sf!Ag&4KDv671q7`z5(4cAjq`awG~XYId=43l29o8Bwb<>mm6`qD+O{ zmi})&tE*3wD*%U{Ag-e-X1&dY4E@D2NUFpS&04O;9VDLXV}-qp z%>h?+)Rk))D1E)1?xr}Lh^*0{;)Pj8{VQt2J*tlEr*eCrL2HHylYPc>L?$`-wntPXavTQm;iqagdCS)muTt46>m zvpez3G_pf1rkmC-r5xtjZZUunMFUZ>)uuQh|BgUBsh^ z$w92l(p|0koq7BmeRr8dKaL44saGy*`9*(lo1UV*393eJCI9D;v(L*+qVE-oDt}z9^j&)%7V;^`YX8|Sf<9xR!@s1J7Hxq3NJn#K5MvOx~+y2)6 z4F8mPqOLaoS6dg^ZY9+j16_-B+}=i(zhV@(LhGQ=#H%C72s?-7r;i&<1 z?91B=NkI|`uD<=!SN<9R;G6}dBff#s_EyD22gj_!RTk<2>-uAEGpv@JBsB6p4JH2T zVD>1ec$sz9dl#x80<9)^`Zc2N!wud`06H%*Kr1TJIVcry9vcvsFc^`*10TddDWM{t zMKTCQex_T~&v`oVwtWq@iR{4B6(5X8-oYh*Gf~g0LU-)j84bW6)-`wtZPaH#;LB;uEt$#QXRrEdH?;`Y9S{ zI37VM=Jg5<7?iW6TdbZ2zafxdcTdG3Hkx|(-&#gK6Khuc-UNv2u*PJ1SCkfvg8n+V z$7~d=G`Rm3xI;eBji;%qdq;GroNgcTD!@xXxn>4NzW4N zzUaq%vVLS5i2|$hsaH~`y%*4@(gcq7Rk3WTAWyK(5(igjqlpY^zk*$}53MzWrD>Uq z|4L#9DT*97@5Gf9P#dau<)fT@8sy(7oVf|%gdyQF+#qQuW{vq*ixI8wetnB0Z{?Dn z`{lbjb$C9Fl1|XqfI36gx!j8ZHh5zF3qSv}Dio}l_%;MK0Ts>aM|7pTdub(U)Y$Y< zTK`1F^bhn##Y+W$(pWy1wD)_L;dnRNZfjZkWyrN}=fDO-WCb%2yI+in&gk}u^wysv z>O-}-+hoj$q8D6$gWNC9hX|ED$)+{Zp{hz}X{^3osobzMTf~Qzq`?K2-$J~vidLNK zj`;|-UNs46XXrw4v~lDJlshp5;zFT&crI|OFUu=#f+HK{|3M!pt7T*vks?(g7*Acr zMlD3A*D89gKG&nK{uiis@k1GATE%v7J(jYA2slq&rcyQkY;C4)IlqAyvGEK#10PfX zTWZlk^Eg0nV6n&$HSYMbkx1BpaxtejzgTk4i|ul#ZQfuAU6;`W+cpGB09g;T(UWSZ zEWvAk2C2dKm3?)Yu%tU*@8T=@t(AUYAYCbRI~`1xf7utsVuH;72)nMgop9BFk4EB_ zrx4xdS0M|^y5g#K5FV2Wkm7HJ>1oUmgmgo&ET9PU(HVNl&ce*Z$c$n|3@5h`4i6MU0XZkTa=# zn`{-37~R89hH&%c)bj))0%qxl>(76dAkAoeW290IaE20bbRo;VVXd@rAGVYoa1Oni z2fKs#d*dSI!AgOwLXpiAhW_e*?k~S>k^qn$Mv(m82*HTYn0T&sm+NHzgvE9*bKp0G z?ukV5met4+<@KOdkJW*1%P&V~s`HRe+g_PuzzULNQUuMc_qmx375M0qr#aa0^G##` zPClM|;+tsACFSCjIQYU#y(uW@=&?70pgt70to%;6bUmdnu07KZUjjvgQbFZ>{w@v- z9dE%5z@zNCt}Dz7nhV9AGmf)e#$)09EwO7~B7TC*i+J~txd@Ipm z4hf0>rNOCDzP(F|Cr^Ie^T`t8gxvO%q^y31cPWT#&omAQL~h^yr;2#A+n*?6!3Sg6 z7|H0XeDI2t*L5|srOcrsr$R~1J~)T%X83QiO8$`Bz$i;-f$k=r);4}%s%3X@!bv0E z{32arL-SYiPsSe_aQk;P!LTAp%9I<~!?(zqCy0+xEyxg^^(=<^6P|Nyx91&Ot!TPu ziNYYD3~&#fswMj=i)lbAjg$Qxpi{ZMUDqS-#22mry$6@9P?~stPJ60MhDOl|+>6ro zQFJker#*;UQP>l~mHw8jDNn=KZnpSyDt0q|{)ZGYq_emNgZTC2@&c9HhlX2vR=tj$VHTv10dBgQapk)`OkiUjJ)kS*uTORXPQZ;NH0VpL1Do z_|RR+RABCKBK+ycHs4t)i5loYsrzz;skWnEZc41n+Lln@6{xOw)n23WKtlV<(1cX= z;`0qDU8!u#hb#YFBE`DWy984UAmSiu?M$kLiqpE$_#cMxwCBm${lnTIhMMwk?F$X%zfy=OiszKK~@IkE4UY?)enxu#*(06G? z^Xr7cc+gQioDk=1FfLhbeHjX|qC_w$JE)tiP#k!1fkc(p#eg&{AawRG3Y#}=QUeKt z%s?7G&>P4)7En@1vA`eVpzy-23NFJB%6Wbk2t<5FY*er{oC|0L0RM7;VxmTrCf^_e z3gB)By1+|ANNK|0OW@^m$oSaB2dQ@%2vPIF3B|E%r?s8GaPtnMTHM1RU(fngP76I7l_l8cS@-q4()aMk%jC;>H& z48^<@kA^VE2PSWs!>59xCxP6XD}mm{%XBD3lm;5YDlp4&Z9LXA4S%e=N^TPgoO=$f z#Uw@0qRNU^bYPdLY!n8lArCo@YlLO+Eaw_CZz-fS%3~`3uW2%iB zfH^9}do%twE8HC%lrapau0Je*gfZHfW@(RIA~BBtZ!Ca)(!YGC&S~y30EI+zBg1NoBfNO+)-Dt|}(^LQH-H1}hJPIG();!sXJ7)g|-*crQka~tL)!x!hOuIv!bc#etY0n8BXCi{t4x&qom8nF&KT$soF1$ zEujo?EqAr0xk~uwY$C2{%1aErRfVJud>;?P)TBh*1McyZF8(JP#KHdY1^%kUXy%^d z=z)9W>h06il&h?M-))Z!oa}}n&B7Y^Q{AZ&8b))ba=cNZ1-~dcP&kWUl^auypuKK^Y%x#9Se)3G z`^}QlyK~uROXkIIokvN2&`7Qaa@a)TVi1-y0Tj?a3p; z$!9Zpvr%QzkvN_Ae$uBhW4FnRYJ0ji?_@T*IX3y;PGzLT6-O$ zF4IVsuJirTmd=c)Uj;1N(!G|M`d$G=Ogg-A@jU83FO%Ud7_7Kr_bT_OVbtvh+xIZPTb79}*qgX6X`fEswf04;EfQY691WUB$r z#m%YSVsL6OhsEia$(?udFmWc@;WnoG)f;JIo+7|_PJ5P0ZM{lh&znHia=>!HHgA86 zeCVF@k=xYjhfd;OFar%XOq;*G?_>h@uETDQblA_j4r_JVcZ*nOT~=zc3moX(j3~UF z4np7TdrcK_8_PvJmA!g<;&AzE?cXB0x+;r&nS!utsY`Zp)Jk{GSC6u;;hSvb7(hXf z9RARg)XtaU+T8&HuIp6cWuh*61sKjL6?xLyXMgPGpm~!=TE-pR84!|b9?f; z?IGPhgyHAnEq_-Kkt9-;uiWh;vc^Bo5Q1u-GhXMmg@5<+rgvUrr^8=OL)D|vVK5$D z+^*5rmKv;lQba)=bNWApOyA+aI(StoFI_dVr!4rU6BUT+``q)7W;ET1Q*ntB?s=h*o=&X11Cvs}<xu$v^ zE}MOQcSlK-GwqlelVslFDSr!%xC#TE(oOx!(zt(i&ahDbVp(`O$eYVPUS})gjrHan zBJ)QT^m#rpx8&;2<&$|20@tZ==k2z3!U#`^#!~R=5mx@{XBMirx?!387DK}uZsnG( z9JeHUY9j$DE_2;@DPq+FND4Rf;_}2}_n&VIzF9+Ya+{bBQku8g6+CGz(`yV#zOVx^ zb)7t^UA)EN&8XgtmL@Ta92L8j_B|2}JzA_T@SX{-JzmYE`i@jG06Ztj>#aN|X6Z2^ zs)^X9cAcqiziZ1oKlu7BFmkQ+psYS*W8Ur>fR>g9#wguf67dmI`!M|j(9?f8jazyP zD^q#c7;{9#MHN~=SfTIPe}iwYIS|b`+*^q^%#XXTX23y#h>60jYvSdMx5QDb;le@T zptNj5B`8hJspri|KO|azzS(>1v0H|eH%Q;AKM{^37~xsv)i?Q#yp#uXZH(y3 zXh8Du&=@oBXy-X`4!MJMj+(Xhl-=QRU;BM};NZxUnxGS|GYOu~VI~xjK%VMBS5o&H zv6MaMo&VR!%cDK(pu01jzk#|Wc0MWvpM;|eAbZMyn>QC9V3|`Zzkk6Sur=dV zDtz+;Z!u(;ckz0%y~@-QmA7?6Vp*0Ou_VVHmlil*OP9_`Ud6p$Ho@`z9Q8Y+PtRHh zv+!JQ=~FGzU~50S>~EuA*e?x zj^+vW`%2eNP3L3XDf4Fq2^pc!@}zsub_ab{VjEgn9ghu9CBT9X<~9U{MMx`}nLW%x zA}5R`O=w{9hD36c=yPajtlLka+=Vi=aocR;3zUQvu=HEr^NR^~FOl;!W%t$vO8U#zJN7HL#ZQb~y@$uf2RHieE8FkfXpUp@CQ{LK zx^^?Wo5AObZ5|tU%7q+@km^MCT>D`c@@L*EA1p%uojPS2an^XwpBgkZ(vEaxy;$L~ zu?xQT=8?z2*`fB{bPN0UmFvCNGThu+-aq_ML3y&q&F|s=U=d0Yk42f5`F2_4@Y@w| zjA6tWEn#Tw`bVkAO)|jdT|G6F&-PvC{qNRGd%Gb`9jcW`YLAvtcc~7v0-9`c#G)Lv z8va@DM|Oo-I&$*w7=Tt2n;{zZfy+*CJv+T8tfhe7$&wiAj zChPuk+^p4qBs1f{IFqWOVvV~QZ)Hk$+}p-O$2cA!`xW*n)BKf_)vn;5$d9_W(heAn-j zo5ExaXdIYRsJ0;ZB~db2tQ;P&SeAstxOj?_w8^)1aL)M5D&-3!ix9i*-uBU^gMfBb zm)U1w_F(1VK_JzBF9%V2nGHswGS7g-<$GDv8)r2y#MrzjcUt++K>@xJ7uO@V`G0OR zY=MsakFQ-h;Kh#`K@nFgh@DnkxjUlkV%^o9>B@dj756a}f!i;fwaF&6fV+#oL4bhy z+8e~r)HOp(3ye`RymV=4?Gm;gCnEmH3)PSlmjSFyqV<@q2%EVN?<{VA3hhw5<05)* z;{L6-ePak>m@fGP+^M@zlR@I$*pgCVDqVo?)>)qde)pb%44T$C=lcc@X4TOfnlrDi zOUkj~DQ)+Q;AN&HZm@|lcuFI={Rf}9L1zv7F>8%Q%ljPdu!MIbMt*~H(jt-5WN}^R zbgg-JJR}i5ig*RR)baTFQ{=5~(p=8tq44 z=IVp0koG-xE7NVY;_D9CqVkkIrI@D3$h}|}8DyUUv(@?8-n1o%0$_gPj%VVn zI$$%F$euaQzNRv2W2Fm__MB?4@Mu0*#sn7Gc(5ovxe%kQ;b?tK-qB=| zPs_iR@?M5vwcq?=b(t&``tfyqW3uu|38`qyVyUR?wSV1eI%oIVh`0*YxAWSibeFp7tMpaPjU&*?(3WC$aMXG2WdevA#eQ9o#+tsI}v>_hUexRX*)1 zW!rmWO@%eM_j=;)p&jgd*Kh)`Z^$>1mE)mGu~(n2^%gRA!qATY)dgwYnxWr+5J@gj zMx6d0#3Uo0i-y5IqwJBUJ(1_Et-oRyXXX#3#|w1y0>0aK0x_L^76S4EJUbIgi0D(x(`~c zM*P-&1tOVfE%+wLX?^2ob*60Q0xmz@;DA7y4Y~*F?f%k6+_+=a=L_sUb}VKBY5|{;*F3`L_!mPI_GFkcX`%E-KU>k zhVk`%Wg-DVdfh$GbEeliwsg=R={+<3`%x|FO6F!N_Q7N)U)oABbs0XLvRt}qZojze zQ(w0WJ4}oMn}15|N?YMCid_3EzB`iXb>GYMWb=3>G~W9+G&G}}6_gt`mcJPGeFU%@ z_?;LpoRndp!fG&%S{tov=N0iAUyU|5>dm6m2Fo>p0~P<}=Vkdr|*b zodj*a5N7aOC~jHh{Adm|rxjf&Ht9k;ZaZ%r0_QuR-?}^+DR?!6bHkDAB{$-{0&VOg>!;H1mg|a0W#odcvRV&P1X0$lJdcnrM@$u6&a+P-v)7P6{;u-24y;}$+ydR*G{H&<%tRF1jUHak8{-iXm-bI^n9}) z@i6!Mf^(awOoe6@+A#k}Xg9N=vH6|spDK$aguhvn%P1P%X1NKW)x~-cKj8mG{XInS zJ@A2sB53XSKWfqGp~{EC|1U1_1F}8ivky`R)WCWeUbEqyoAQ<)DaA7LOk(^iB%%ff zU4Q|-RfKqA1PnKWp;`rU)^^+KL@B_v21N6P{xK4F{*>45okY zigd!DVmtX)A9_yn|0H_@0J`AjG8l(7!d3a#(X{9gM-9LU5BQfIbe;&eHW-+bxZtD& zkU2`P9?}o~mPmaAmBDW#kA4>TxQ;HMivtr)K!0yTE?`n&RYTUxj z{#0{&Mu`+NC=d4I&2G0EWZ7uSpMv|%e@$|OqD2uq#5ts_6VLd)W@Xa^f0{B4o!Wx= zMcGHG1H1mX)58bVP-KNlsmc}F7CJ{H>-i`l3a$rZgFZSJ1`fZbPY{~5e{p2eh3QYa}%MU6yaJ!zWaYMLU* zVwk68oLj+|CHaHtjz5Yk2c0?}VLlf_-6@zCG71t0DM2~EPF0fZ;_ni=Q*QHPKSFME zB0~1+n0|YrYEj2%DsFeA@9kkf^2&WZORDIG3VN#m2|%S2^pqnbA=@5Qj>w0St=hLw8eZBZe;2TG#}Z3d5W!Ek7o$BP_R$J6o_ze1q8oaDzcncnGQMxLX6* zL{y3Gb)-UyYL^v?(1uu$+Jv|YCpGD3I|uzW-J$6VgDCT1=Ib2=j6)@prxx+7YumC6 zXM7lOSTS{`l;bHs=Ws5bnBXQ8o^D}ED{tpA4C^GkU1FMF0=aw9ZClWD_OYVu3Y{Kp zwd%ZZb8Xw#=snxNx`)siz06C)+rgBr46Fgc+bE$L2yq+)AJ;p`}F+`PCka& zmRSaN0|VZtZj6PMW^fO*`_)dS8wT<_nU!6Ppxaa__jW&d)1Bj=H4n|A1$p;C>~7-W zVJDwGCejuqR4-FD9veS{T5C9Jv>c-!e@30x4_M%omrMx{n*wZgvz1G zx7NhCaf{x$Yklg##K3v2x_bQdN|yCxQgY@Vi_W*mmkZ|gI{%2ue0<#ZUQ}@8_dZ_D z*yG)g_UGid(a~o}~)nL1EWt)(jiZ9xN!V2BKE#Gk*gA zbsErj5Qu%bOGMt$&tEY%dV8ka4t|j!X*BDOGG(+fAQ((IqOFUEyW^9_8FktkO$tA0 z-)H6S*spLnpyBK^NOeSq69bp>nLas{A`F8R}0_$9d-SPaf!k=$GS-mao6R zY+B^w!3PFo(8Ufu>aptqQVg-qat+8KrJACz$0d;=Oq4H!iM=CI`zw6gFtg71sYdJp_V`F5)M*_;B=5Qo`ifvS-b!1D{>AKDwT zH%on4yCq9XoPmqUrarr|39Xf{)Tr|0ehiAQu*1#Dtw}IHh@@BYYHv3AN+|4ei?s&*iDZ;JdG6 zsT_Zq0fTu={tnOIpP}|pdbW9_&^$JfI94EBl?uvW9oM}L2p4km=XHN+izjw;7*cHI zvAc#OIn$F?h03S6@yh@FOHjqOZ^;TWw^4U<5A8s9zlGFHXT9@t+g%eOIkt|_grZLh z`1jvsN~3dZ=#+2gV(*>yEjo7C986nBl^OaM!B23n?3v!AK-k`Q?1VyZ!3gxOlpOvw zz#};vrm{d=j_gt1-jCjR=MmRFAXDZzu@@}4N%{KFo;mEbXWB-c2kz7U{YkISzLb@L zm;rq6ZD+1W+O`Ub#e|zhDVth}{hWh^@3KkGud&@0 zkCx0h!s^9Aah>HTuAsh`%%R6cr#Nt>i9DS07=zF;TxpJlX4o2i?d=|LUW!%!>?vhe zPF0@VudLAD!v&8wmRKFB;;tJ7l<%11*fCiAiDfSx&-%^^LEKKPg|wDAE8dv3n+b7O3<(7-v&V z`0+7OH@kkB$7>g$6Sp;KYP*bn83!d{Gx2pHJ@C%z0PFFtw%+P@{M8+D-?7I75R1!np&;VRrY*p|jpgMG^?};m!EEJGArk?OeW) z@YH%CFh8w`2+6cPKswHLn)Ug6S;U3Ta??jfpg(jRC*@Wb_!IZn`z{9K0|xiEf5(^` zF-g!Hh6$YleSK#Wkmx_Kh+n~`^!Z71Ma#&xyL^(3MlO8s(1g{#c+=m;_IHOuGf}^0 z*$CBc52B0(aawvY8TO!7A>iS- zOi3yDwx1kTj6sk^&}V3KT-Swn7V|0h1FU{F-sNOYJ{nt**>=VFZ4KZ~p#QE~aN~d_ z@olVU(Qb)q*X;dzKV*55Eyx<{9*4v6ujEx8n<9VKsXO0UYO<-g4zX{khXuST&`zSo zGEqth$Gd=Vo?=(L7WQHFGrB_}ikD4`cAHe^(z0;c{Ab5;ACc(+>VKNh=3jQ$UQ+cF z(Tih={2p&)SEi9jRRdlB`x5SOtv`G_-VAsbUc|+&@u9>m`YOD>_LJYpthMZ}h9_)X~n*5Tartd8~j#cW!LFIet<;n=Z~G)R2wJL6daopFRWm%M~K z3C7p{DK%;w`m>Uc0FD&0ujDZlU%2N@rlU;}dvmCG7ptU1eZaxvnG!FH%NI6^G*=yB zpUl(EIv-9GX*Z6&pA9|b0qXqUm)e}|AH6^IXvl)e{ISoX$ElkO<5(fZB+3be zJ%&?`c*ue7Qd%tea#x`qIcOd?=-N(TBY#$Y-f&l$evMsI(v+I}nu4xFYu!zcRz%Pm z**#k~nTeE=t{G>@BFiFw2xkfx+R+4OAL;VFw{K@G{gi5)WRc1sE@{#E74JO*<+P4N zfI7PbjRAlTt4}oDL|SXkK3Dmw8-Z(gUQBn!dJ%JF(X_z;ksf}Xz}+O4LW~}T+NNrsxQzbdsQ|&F%I<}``~Rd5Wy?x=E=GHF~DaQ$~h;5 zG-C!GbK#ROf~q1ld{vXjXaCGzt%yJ^IY3I>kuVF>7=cQ@8bC%gl9;!P@>P2juB}mP z_r~pj;nacP{cA(8{uGJ2i%Naw%U-HxGv+T%Z4K;M&|=N<68THX{yU#6$L6MhX`7)6 z4G9Od|KcEw+%BJ80iomIX5gwMnvzVVEdAP&CdDPAZ`0M!RP&mC=)AhlYLMmh>kU`G zl7Xw%4sQMd%ScbQ91ET&%K#_amdxWD;(nQ?l`#m)nm2p_UURj-`NFLqL9|0L`^{Uq zp7I(YADhn-{C{HsScmSOB|6lavXD`zs4+^k(k7AB#HQ$e;d1kyB`i#ZKQ)+orMLE% z6f|+462AT^#j*#he)aQrcm#}}Waqn_y3rdGMK{&oZguz~X2r)v7SpREu1UPGxi!cx z?+X&>E&EKb#7?_0MEk2%)0?^%Vgo~xu6k>@9J8m7&#)qSOC8wl%tvo+l@967)~t-7 zE82QqY-{zcv!S>8!emzJ#RVF(DGNctL(qT@W?_BHl}3btgJ5-imqJn4vqW zMEz$N^e~)pKJ_3&U%MY}XQ^%i2E>2}dCnZ!-SFAsK_15w9h5*{5>8-c$ujodoHV>Md`j_AFn$I>@y(cHQNsd1 zLmg#r@?|9|%g;Nwo7jFP93qD8M-OG7@3Dz8^y>|RD(PaG&| z3=zY-ohHaQp+2{%P+lfO$SRp4ErNQ`PO5{KP>2)P{KqWwp-RwqbI8#%>Al`h^Fp4V zomPSsAuWW#dO$>~E#nc_8<>{zdZBJv2AnNttLrHT#x0~+<3**Osual?qZuI~DFR(k z4VOt)Hea!f>z3<}-qGgySS3`7X$~Ls+;CwtVJW~FCqpcNwixbZ7HOt+k_KBo_uhe> zB>6`C;l7|v6%$J1d;%!&)o(>NkjEWGY)h>NE7F%P)*4NPtu@~$+Kmx`rHuf%I!~WQhfFF z-g|W?Dr+!c!aVU%{&_EEdBjh6n*ZZmvns@wAvK42?4*m`C~jSea z`bNKV0vrl^tEcw+@Zh-`95X~;%Iv?f_woHKnI#%*Y?Z5dnV zOBN&gmUu28{#4!wRp^hr68jit(1MKtOFwm`sU~Fifi1H}-!7|Tt6fzC*i4mSru5b& z88N)a{;Tt&rD!%E)czi;Hr;L-|ABc^qawld0gxil2ZH7-M)W8l>vF*0nyP_H^g*x| z!>No}nf`Z}&~P!(OtLjToqe$h2l`w-u>qxKp z>Juh7?T2)YA=~S=1|t5S$x6ou$Wq7EzFGN!U0m%~7kr1Off_I8!6%Zm)KmqJ4InLj zPEWH^9FMHY=2~&YKAA9;vw);ki1R)m8%181anv!0b?M0_lJ(Z8>9$JN5r{#*)m=b} zinJN)L^GONxHHBgk;sTVg|i!nhImM6Cw99lc6*%b-{V&q*=!9u22-`YcP$ET&|7|A z%_oJthn1z`t*&7Od4i5X?1w4HadlnJyX;GxW4@DDg=kr(5-fC-_2;NG{~3(-lILtX zlYL{?-=a+{RY=tO*GMh_s;S1Rzht)mL0wHSlH~Y$2jt$7=RZqwN$ZYZ@E#$RW7i!! z>GHl5b3u7qh6*7YaTyvX+?BB^mHc&cHDy{_%9n2@*3HM!BCne3y_i~GJB5w9;qwNp zfmaRvh@C?sU4hS%HzK39*tu8|n)s>GL&4#@fVyo)3GnyKoB{}l)=N(+;8@%;nBAQXOV>W~0csOQH z879L)!Z<+$68Jg&tN4W+-l=ht^2+NF8w_vu(kf+|GGyed9)kKyRlKd-j9p|0_$ZL2 zH0z!z;lNf*jVH9_F+ctcW?JPoZ&6S&d=ZZjn;2CSx|0IU+$qpw)*is5Y_nbXeQWUv85$SONLqHGeOG2sCzDHn%YbnSzV7%2yv z00z;{Hi;2U%SA<9E?J>pa6#XN8}7Y84Z@=eQKIvO3dsmIu;cR-xqVI5GV`1}i9|^I0Sjdb_=rY_caIYC-bYh*`?$fP2zaOYa)ni57V+`15EOrSNm;umWa@E5IxY^>%R7ZCh zd?Bv{WkP{b6Uxg<=XOyB&Xx7#)Xydd9Fmvn5Xm}&$sYCRlglWV+51^mkgp4ELnQEx z>^IyC0`zC+A+1l&FphPL$5)~VdROiV!oOyaRUqig=F@is*N3|SBnEHC*Mq@{zK=Es zC@cLu%74h{PYb+dpy%!c7{uX63Do_X#T3@Win-M#w-K14swld zkcJh;vndql)r?&*Rl(N?@(hd^vZg5si-FkLCbu=%N0Cp&E<>regFKWDC!T+JO=+|I zSSNm!p^68)#j>8Y6JH2f#CSy=fcyhA4o63^G5|}yhmro^A%lxzGvN*@)7O46rBN8# zk39~kxp(OEXH-CrxUnIjB`@5tOBFU$hP8ko?ppJ)l|QE7F?h@$BX(R zoV%vKI@H$i`PW<}RZFBg^EJ0(TqCRFOnd`J$;q6=&ralr0uSr33Z5i$fW{VR)q7QA zbOlKo3bbOVIHnM*qR30J3*ky4nk+(+*ej*C+N*ze05dJ#(hQ$Gq5LVxG1&C@8guzM z^y4j2Ulraxp)a_vd$}OROV^{^+j^Hbj3R^6%OVSST@~BY80Ztl`H+#0h zU~o*3H1=C%QqyN-kIB*}4$?xO#J^U+#Csxqu(jsHB;t3F?I$l{x+$`?=$Cq3keIvk zJlgBv9zzbh=F#}!5@)iN(&62n-&?Zq`8WEyM_MM@~&e*p$ zOUQ1rRYbBk_OTOUY+(>%$!-|34aRbw`CjMzb*}UK=X71w#mxIY+h@7&`}4fdo7QJ< zF&Iubxfp(NyOw5SorShIjQjl^<*@4yGuS(hX*V^VUhzCT^=f$a98`& z8t;cCrodm{eoqFmt5SvhZR}<}YZ|XW$wMOG<~A zEpyhSU+f%SCY-f%i{r6G%1qr%PTQEmRTdK3dJWgJk^x~B!Lom=`i^1>lr4?*=KRAL z6EmZA*VyE=FGlq}T?4K7{~;OeyH$*W6}we{z~$JSy#Kd>Wp0o{n4abKfa* zATsijSEan$VsL%OUlR(_>)lMAE2M1V6@?d+!+FJ%(v=iZ8b$RF2EG_`Sk{s7SJ<`r zhZ3wR{GS)|I+jno{NWCDqPqimG4DP0QReMT0(dckE2hX&!aMf5MxPE{-;El~{IO(v zg^WnsgzFx2z{HpGR8>{2FM0ATf?>>e1$8%=0?WWTA7};DXr1ThOS_D2hqa#mgkzDP zv`*)KE04b#+~%QF>Mimc{;btHLHx3ZdpJNP!?u5+rSh9tn(>Qx`TR>}dTv53FoM|O zNhycE?8swT*_CtQPwE+RY*Y#~)>7YA+v~_HvCZ%Bw#=|I3BGOQdRXgD3?ZPCx^yRl z5|F)+wD0+R(E8QVMe!+22TM_cCvA&VYg}@9tR)Mdb5GmzCv}&+aE%LuL<-E>t#G`4 z$Oa+%4XK2R^^#d!U{Jg~k3h|{tKoy4B>a|}PM=q}lScrR3_76Y*75R~<@FkYvH&*H ziCOgdmfgNold?a*O~PBGbn8flber<9@8|!U;`PESW#6k$RK+zM#8nfdXqOiW)9PH) zumQd5ues+G*)X0|Ew?sN^m)#;S7pV%k6ocL-w28EpOT>|4u2V~!>%S?cAF~=Px!iC zBGxxbQ;40sw^{4?mG0HwsE!lX7B88R=t!<`V`}9aW_@lvB{yqg|8a(=^xbKtA5)_d zUVg*G6v+imXWY59IB=5?+^x!({{iVeoBw3Su$JVxV0Ow+!|RT&B^7NIp%snF^7b8Q z^vl;q6*J)}wDoI*(G({)h{xSwT46|Xi(6E-l`OZ(>Fp~}C)EMw@r+LfThQ;=`3XpP zU8q_vvm5ajjd}Lq6oOb#9DK5|DFHts&S^g_cwz=RyjF2DHICj1c$?=`}+F! zii(7N*8kA9Tz}o_w*-mrl160fipy=iYtAP$HiTPdMQ9{{rFjhNZpU!26wUhIP~A$U zxD*MK{TsnsZ`&Dr*?Ij>WsXj!{BW^pYI{3u!nEOaaR_Ln$gDPDp(hm;c;JyDV*0?} z-@o?_!&RT2U%yrukFXez-Zf~r-R2d9E3EfjTtqE{5BRf#4+Zt}w5_p4#*Lm!ec`zt0-M6( zQ#e#NK7)e>0x?KtzRM)|q(-t`3GNevz9}FeaQN$Hwlg&yqg`_-Wo}*`0TmmyH5aF{ zwUVDL=`txh6-;_LUF(^T9QQ$lu={r5QaP99l0X14AkV;_6}&eL-Mc1_&|Mq&{OaO0 zY0R1PYW-nLv*+|sU77@^Yo)-(y*z`-wSaQFe?M0m54n*HtD$E@LZK9}H=l`^vc{xIR5*=_vhS-v z(|L66h(I8>C@)6_z*!|wvv6sC35kE3blko(AGD96o`-wyv)4O}O5akx6~W6I_#nd?by^PW9e$1YTZtWUdenD`g+RU_PcB z>mzi9OMQ9cyHebA+P=~_@rqrjwkKriTP!if?|*r21^cTpCND)<xs>m4Xge_u!lrH_%y6tUl zZtjPKgnPTIBLz=#&WscqicO|wXZKgVoapN7gHKeww6nLrG8NZ|`(e+pva-_XjmLhu z3a>*JM`|)Qoe@Bjes}~V!g9OysBSTm!Xz@5OTlA*_T5m$bN!FfFHL4y>|Fm; zMDFZ({T>=(7=6gdqb?Syo_1O1i~tMY>uCc=D~N{%xy_rcD;BJL0s`CzK+H5k!F$1q zVML6|LWgt|dbhW>Qff(^aG$s6YMKZb#B1gE8*U~4fdc)T@(6-97~MmSZ)T{j`K2Y4 z|1NmxSqAXUz}6%|{Uh{7W3!}>JTgSBKP^`xf+G+kQ2EJ*Q9d|3ZIoT z=19ZVLZVTpAmoZJ@UXyTiVrC%ta#bn1lhH+ zwwi;*bflbT-lLCqBD0hNINXp(5hx1XdH_+&jnV^0t8j{=bPEkjgMY7%6pAnp5|ss~ zuDRB?Y|gd?^?sCs!-Xb~M+qknisqQX1{Ynbcv&kr*Pp7Fh4Z?5FJ_v<0#6Q>d_Z>+ zGcqR6`Qk8BQmDN0*hjGLROJh>zxQ=?V)H^0gUH?*t3a><5n0-C;Cg6qyoOyKlIseH z3%N(%7>xKjFv3)v7b5OH&w_u+X25^|Vx`5tjNc2C)Kwn%C4t1Mp zJ{Qufw;Kp50A}EytoZoZ=5>OyBvvA_>qMXGmL4TWm`V0pO*f{`i%4@eg#-VmvM|%F zm7X)?=%3f>aKXJgJMgv><2o-v&qa*jB(}sHKi3h15;d<&A|3E43tKj3Fo@PPj}{r* zHd7!%ZvJ=UC*a1hm?B=)--ueY48`(b4&D8?=V#wT`#!0@IwKMLc)nQ}+#pd`dEC>} zbF_x^#N>g_{6H?v<6O?P@w+p`yN014Lmhs&ao-t4Jp+#*<4D&yr9HNbiklS8)3_j` zqB*AcAE5sp6s-jk4=92X6A}V} z4}$2lfA?3m2K{1h`cktEV*0-(cZR{*zeeuTy{&#Zf$farajkqY66LJ{NhSw_UtL|| zGtow!5Qu#a>)rTUaO`hP$H=!QuOw_cZXK|UNBeCrUYRs^f$w63B~rj-t`yKd=Cgx8 zY!)I|oNk1iDm;Jwyqxi2uAXU?vvCVf<;}Ht4Zf>gXMW(63TJ|ct1j$Q8gaO2O$KeZ z#F)Xr@Q>{H2E4(Bv-6y?;@I+tr~VF^-mHbsim9xY`ZDbt91=4#Gt)9N%|n0(@1lPE zP!tl1emPMUpPuf-Kf)3TlSY%6t>{(w-)e=~6B_5N>RID`b0R;fQ9u>w)37K9U5kKq zDQ0G78?FS6>WNXwXpJBicx7W%1PO>>1~^ zN0x2lk8@}q|II>HN}?735PM&La)>WyREK@3QDC?#YS*14sEw3-qpNZ}T~ z6NbVrhNj|z#;2TE;;A$#_zB4Ix#pL^kLQ3(MtI8_XabZQ8JTQr<@oFwYofrTzhky> zU+=&Bn_AopV$9M0zc+DC!{1sKQZ0ka?j`AsRXSZoIrNKapH(?M^1N6o<~74&b$OEq zaVk+2ANAA)G*N;y=7O3|)Oq7SLLK_8W6bp01M{_x>LWxK8qMx9RLQUBP!VmLqhA&bk$vVKF7n@dBB_$;pz0t_tWNq2n z)g=>;+(FXTReznZ}|c8}|0XHG+FzMh53p5YZffY#8u>m9g@<;3h1H z7*Nke?H@mWEdTzhRi60H0S=c8I`qO8o2r9|;)tu00)!6W_UBFgLIDo&9Re7w-r2tFt#jw=kXIB36p}fH3 z-O)F3adL}n(#~UdH8szHxbzjkTtxuGGQjE3&AOu$tQkT#ZiLm>D~i@FLmtF()~esz z>#;mZh*LSKX?Iz2pX+e%S0a8$Or*YRVZq(@_QKp$z=nu06rk2Vg$+e8{BQdCj0y;X zU1uy;JwR4FYvZ1lu3wXKL`~cJH+A91hr5czNlySC!<|YSQUF(_9w;$aU==ZG zk6_}Z@ZB9TWWb*+=fwFG0&G8J3)YzI3gak;p?W{hVA902-i{Vwrsb7!g(K5+FiE8C z-9?Ai*Yv<4^0Z6c4|i53{qe4gDOe&*57(ir?f(7! zNv6t`PNQ1~OWB@a-BMQqJ!V!%OZx%6!T>x7K?l_j2Dv{T`e)@;KR!RMqX5;Be0Je0xAuL}vTltRj*oUN~%P#13X%GwB z0c7ae;Q+qVl#r6rk$rmPkdT=8eE1tv$bK7-hPL*+%ISfwbuAc2!iNucckCU&ybF$y zAXjn#*VWFDjlXK)8wL{7CNi^%*8WsRzZlUZin-6Wz5#|R3QkMI z?E#LzwO&2Vs@%Ag6;N}yS}3=eW-ALoUd`Vqp=IDYNXzu3CRCq%v~tiPj5~PW`oVj) z!EuZ-6a}3OdQxP|BF6@@<-ejE&DQU@0J`SW1nBrzA9&);)534zN}m$ZEJe&xXJe{i z1>CJ5u@(eGl+$R5WQ;h_Qt|+H2khIWdi_U_XbzadHw%Zm_)drHppF=ssV=aTY~ofF zujnpL;hWjye8K#&D+kK*s>kv%N8X8pL56y@uR3U&J!bgSj&i-RoEOdg==MTB00_X5 zD~F4n4h{|gNb`zwng^GLSv_@g&k7*O{r>%XfBN)9osT)NGzgd&5(E#~hA9cyZX@oIN5SnruNbne^xpQQYd{okUCrkpfFN zIl-EJ1qf__w;uq91)tJwFZNQ0dz(iy zcJH5%HW)VIxRpKvixdZ77uS8+Y?=tt6f2>pr$?whJ1MChOv-rGOH<_E01!bA_UGc* z6@53kJ2|9Yw1ZhS227H>{34fp5^%NcHB>)gFJn3FdfIvPT|Q>(flsP;90%?eMnAm= zvd3(%%=CMJ=me-rKaM{F;4l~RoP#aW6prQ4Xaei+Hy^KV!=;m4;rq`KWzOY? zfk=6QOWx}iXG1_M{mo5~b)MvO5E#^ijeoob5!-Xj`knjm6ZLZEamkKYF0Fi>%&wlE zxjKBw-0rAlKA@i!0Iq=?ks@r|3g8Ez9Q*)B12FO%r1I7SN-$2L#)HLcS;2?TL6rUS z>JateH{gS=HNa1T7P^xu@@q&*MxA_mOiBNRe;Vk7J4oDy(cHCy3qX%B)=m=-+r^I# zH3kK^)XbjYxa0UZjbaLz0y!&#VGT9}Al@=^nK&c0B$J? z92u9;>zEz1$6i{$b?zESBO-fLWKIT!W2`{W!OD8<45~xHUG((yy88QgiKt+J~(@X(fU8|GoAqYUX`vC zP?hpdzUv%wGqAJgd{s~70cgG+r+j#;*>dujVARR0Hw8r4cJxm`m#1t?WSJsetEYn% z03Y>)l2o7y(tuGU$?%6VZ*(j!ElqrTl4HZAKKXpQQOVH4j~|5gNbg&a01X`-I7lOB z_|nFkdbLq-jpQ$)R*_D#-l0N(pa$$89c&jbKfMlNo+i}H#fB%_h%Y-H z{`(QVR7+w3KwiU<_ut=_gy1yvDI4G>-LFglw5%mPLxe~xDd7Ohz!|;cg(PFx9WuhuqcnHefP4>l zbXYvRY8yBKW*TTfMYc@wnq=977LndTZjKC#-H6EqWwO*8k1uV?IyyQ6rMpUxJAgCBfJX5q`TDp8X6k1+4>b9I3urpjW{h(WRVb z>;w&%z{S-se~D(3u%Y?&>sL9W7VP#Iz?vm_3P1gc8?4y#*ko`z7@@Y0zd!HkYl{%1W4<{BEouV z!lqU4K}-p7aUsYMrUr4fUDbkF+XBeUA37pfNmw$%eooBa6HS?fX=X8e^wN2#n zgdD|#D3J)PFh!(pbuh!mSdSxlR}XSZCqYnF~LleX_5}l1=vUngg9u z2?(RgfFI>)BU?jGNtTwCFOuK<%R`g4?;>W3qDAW>nof^5V30a_*xyb7Kx)>jCKOdv zRC;jzp2RpHJ87tq6&h7c(GBs-H5{^aRv{qu9lvJLDVvK052S*IfDH4v!GG67i3p;z zQN6FkP`<7Mkeo1CN)td?VMu5!w#Iib5R{cBQ_pKt9a{LWe0|R;#|#x3O@rM|2N`K| z;Qqyb?JT-haQtLL6S_az+YCbY3b@FtW=tJLLnupc(K~dtsBFrI4>RgKK^2uRCsII0 z)o%(80*VxaD+6H^lw!zhv$p080Q5OmK%$K*Ut9sy*8xx$AP`NGdFYd+6Htz#;GyE7 z%tn*?Y;1}sk1j3;{k&qh2{evx3P#_HB3W*3y;C`A0rAxdUUf_ReRCa%!iXk-80G4s1=(Ox1r#mfhX9qnTbL|qQf5U7C^O(L+~?WE?-rNSIRb932#lKy5ow2{8qObO zqf2Am9U&5*K@}#-9-f*ut`cfeJ?X&!pnqImq}*BHj%2drw^rU62*!D)#XD!z9FYl9 zb`r?uKjqu+cLUVQuHYj~<}AP{KO%cQiI%nGlq$fi1=Oot7#!P&5vU1BB^v;+&@^BK z?eaypou=yj&Vw@1RiNddGi1k1A@RSvT?O7Ajo#JQ>319#kNFXyp1BP)EQb0OBm1#P71PJ|&VZg|+ zpSdK1kN&9xbkqYV(b_c`mpf2XJb_4+qcx%Q9R4!Q6yy92JxT|X?jFd2#@Wh2vS2O% z@Onhs7&Qjqlr2~ZvIYa{P?7+cO_$rMt2#}4g<~7(30W*{;%c{*$OSq$Jmu`99h_Jf za16lczF6=-2K3@bCr6+^7PS>t0FJ?65qw~OLYhAHfAHWfa$EorLgD)&B>#p4>g>RU zWgZvvu(Nl80Nen;zt7=H{tz0mp;^giZA@mL|kG^R+}trm$}BXCiG+51m^G+|#Tukwj9;Ev^H zcnDd>SxZpV(@$ap)0jhafbCfUPS=s|SAZ&)0(e@yI`=~p6Ap5X78Dj2*js}qYTS82 zHHj<}|8GsJ$QX45toD}UtmlkV`0I`PGc1VyDC1_xJ8|-)h+@_*&!oboyKpREQs%Fk zxrJR|6AvZe(48ZSKI7x#WLo~7M07wox_AKo(w$L!{Po+!M&^NGcv-r%+VCz+8;{zICP&D4|U#TE@8<`aJG&&NgwaUJP@nG!4DALU^*n>TA>WZzOL_5#!@doD=iN zM>Y@W#2LGHzf4(MzDo^Ov%fAJy~O7?ZLrzH5)T31)TL?-SEpKfI}!Ps`bt7VLcM;z zjt_`%9zfV}2mk*D^a~QNA>4-R1=^kEhk0_D5Z<4)o-X4WOL%ZRh+Dd3mM$$|7FXMi zvZ8AJGn=CRVe%y+s0`?}VCv^TK~ZmM9$LwKN=JGli1M_ZfJdyTb9pCKI*%s+C(Qsd z$^cLmOe!2z0rFwo_pfjy=m04bfLc(N`G7?J0&v`@&g;2#&lJdBIf)JCgcB)ohJ8qV z<^}=XEpm$~{#+gi+BTxj4>ftU&xR4;*k3qe+K4Q3Bv~qO9sKeJAi8KEQM?%brV4Zn zjfW2f12aHHRZou@m?fDsi?{T2bwvcP0o5@jJKIvv@u1lzSaSzXX}P|U1d8LyZ^$cF z(VEhl^7ADeOZ9D?V4vwE(2wz{A^BTr4W~Sr|HnL|h3FSey~+#Giv&1ZQyVqv7PA>8pC+iPJ6vnQAzK9@A(o8g2>z8TX`s62M2c;BafZ^t7e zo?eG)QFUD63%TUQ9~WT`gFwoGbPW6Zv!Pi+Z4Zc=)V7zRBQ&%N7>r=w6`^=aZQ3Z) zI6}au9JH%q%@a^7k2L{?uL(tQ&=h(kRj|49&hXHQL73vl05E|V;CN}Y(${;hL(ywi zG@!%m04&133q$dA^`_l_O~Z5ujdfJ_!O_c?fy@ChNI;IzotVGPAEtfqt}r1Y;^}j; zTYW#gHc<4wUyh6I8D%;6Za2D^O~R8cexw#68Q52%;VOzJa|Z=^Y5!xb8#;U|HTZU(Q;pjTU^ zFnmMIr|{gqbu!-l#MW6sIpPi=yc^dKaGD*qpJMw}TQJ3*W zC^HLKXQK^*LbO~81?T-Tj@~80$uVU{zI@9t>{qikqF*tzZk1B$EVl9FH!fsyx~}z* zIV_KGvK}_ff;C|IHb=lmflGI&K2l7x)aOq`367pyZl5}RmeX^S@=@3YLgVpW%eK!j zkx&SPUmQgPO{dDGW(lhfONQ^I+eBH?3e!%V%g>2#5Jxqok2iIH=7yqv@gHg5hV2LZ zyR#|c<|WaIr-p`#ffs6c!+nN=vkH}3Hl}Yj2UwfuuQ`}ghkDaAbqnM@+@jzDxr~N-IsgJBFkz-q4;#?)ex?l!hvccY!IGzS{g7)EnAT-ezy++h?zU=mtZL~i$ggQh9bIS4>BpIyzMJF0-3tOGZ}CxpOrE%A1gZ z^cmMmhE1u>)P}$t*XVbYKI~t#2R6tw&VV>|7;dYD@7-#l>y>J49_H6iH$CFa2y2ixoS1ghDN`+886OpYzl*RhDwJ^3_B|C-z5T>y{IL1r z>;`PfCKf@#cyXiYV&Ic*whrp_y(f#Qv;Anl_~YKN-e#%0q)nw7-;fiFiwlp;FGC8Uz~fVTO7mj?h?D^Ml(T$9H1^^kGGtv>wnfnI~dLoN`-;^cwf zXwr$JZerFRAg1qr$Ve>^MF6~Qnf$|7E1Y%u@=TY_s>wW|u*c(M)4^X^b<}^*_T8J1 z!iy9asYAAuOarpdD0>qfdOW7SKL9}$Lc(TUkJJ!w>`nU-x5Yr8Q1XDL82**nr}Ko; zw+-hiGPXgGqZx%>skt^rWyU0sA%t;OXB!m{hZWs@mKL}!i9&~_(?8H}WHtaC-r)^V zMGBP~+JnI;I!Yc~P-Xa&Y%QEN&J%X+tV#U?^`FWGX=6)jN>k^YrBG&8`RG!yb&`G( z+V#EWx2ojFqo+)PSaUp~r*%w>-%+9=@zY3wqSSd;=-C9E=h-?r=-J?#t4v30nx=*i zd{14%T?nMspw2aQGia;mswLC;6kma&!YAzb+fs;ZC-^86UzjVWW6o@_8B&xW z^Ko@uJS3zL?!(kliR5CulX5?koGgGaqZ_t5`*S{oLLhw{NjTA=*A-0j|3Yc6K|ybl zpFl5qB=$_!Ln7w-V0WDS9qKN=G^!jULL=CF$IC`jCLh_WUi57~R&x2eZe6_R;xz@$FODzt5d#yn=+z6c+&dEy$HLddd) zOMU6nPpQ+J3~E3gGv4x5*~>4HbSF}CuU~jGY8ZT$?~)mzOns7|90P)(lsM;pGp5gj zSl!l?NeXMKC4JwDSb0o_N4ZIpN;pgjAKQU1eT(D3-^&%>k}ACmgMHD}ep3nbCkWTu z%oC!}p6ko2xO5(R<-0_KGr=DPzc8x){ZXS)`|~JiAW2})=-b11;_ZrfD?VpGp?#!` z4{?R&7Y`g8G4ruZ23T#qglM-?8dxbD83IUlYiaQIrkqgnS=#EBKWvzEk79q`{yNQnImf!n8=AaQD% z#7ket7jnyXm!WlH?yRVX7~yE5*I7h0TJN)4V+|_}kJrLW`hiTV8CWpAJ?q=*PUiRZ zlc`)Z#qa6(j{Mdpwam4`!r(q>XxDJ7Ri<#4W;Hth6PwFkBgFIl=AW*%c*g~ZqvS1) z=KH{2XvNI4=)txXOL;1uHFfj*U(|b<%~+6SsWmUIj&?tLHcQH!r;{Gs(x>755};PS zNO&X>Qs_kgz*Sv~wvO3L@al26{@3T1A|f>CTYuR*v5tfHgT{X9spPx*gU9?cw|4)( z8*b6a%*xa+wqaPfk3E~MQt-!w`JX?ssxN2pvpKtmjK!R}tkcRF85QIqXd_m}Eh~R` z98-dRkEJ%xp)-PwNTtl62%^wJCW}H}g_a~4TjF*g|CW_}GHtVKtEV;m)!DlB=xY_= z6tF>zg-~8y>RILmbPm{4{-NTE;izS(2wb{8t?mI!g%6Ioaziv6&qS21MmEqLS;3dC z=o=Qi5kd5XNzGb)IWEY7wmgLrYe*T)-Is~g{){cD<^2?s$3loEA%E&~XRz-*iGw7T z=^H}Wwhv(EN#45E%OrOWws35b^NfD@73yc(Lw5u(X!-VqmSIAV- zsd6dc(?g>?0oBnjEM`5GQuU{gpDNJ~H6K-J97l(Ze&KGS%)Kh;8L&T@t+pPZI9dJC zN-ZkxY>BsG$?LJyE0GP)<2}tT8B9+!3x^MmkhZgwE@3OL7dbJxxeWhvXq&rs_JN{; zDlw??Savj>##1tw1&iVfRFwUWS)q9af5zlxN;vPD7+v7{)JXTtCBa4CmWun9Oo1zI zRxtYVUdFhPr>*}&ShVN1AMOWyP#6F3&9U}!@W*9NS;VTXno8r{Ba)<{j{+*6*62s9XJ1AaFT&-`Grs;ma?>{_YO7}y=aewrR z1%lXwG?rIw%{UMCw%Te&tf$g=PAKWO{&NZ~pxJ1UD1MCJMGP!vn3ae3^0zK%b&q%9-5 z8_cEuZ4;AydSRvnuLC%QZk)F;gl@zdNN5SWeTC`D8R7$rN9UBDmr2Vig@ z*kpjsd*DZA2SDuq|35~)C}+G2%WXzntC9?u{iC#3t$ZXN`(o(U874sK9+4^C?=)%B zwGu96>$u}K(e+=))tScM<);qqnED%}qfxqYQ9^wRpX={mW-4GND|c^tdO%_Bxz>Tl zEXShgVeIP&ci%++4A1Vt9m1cwvPq_1z1sP;xpO?a;O+2*qxMOMigGH89z#5q_D)zv z<+SpoAzf#!?T+2<-O8l=46fSTr@HUG*&xjC{=2&g@xH+55y3vM_W&Medz!Jy9;B-| zHxh41F;F=)>$UFXJNr+F5L}>5Zxx)Cn7Tw!bDvOhM9t6`ezaFEs|Lj@SyMASIhEp+s6yqUv0F#&V#@<{M4Jw1Z;3qat4>`Js

    TxTV%n5YCt*s|b<6>Qpkvn^jvN!1RW;EWG!d09(a zL@mtDb+}-r3Z)Ge_0Xv5)|qvdK>sHgafG6|?rM)>0fqHQq~+wNfw`% zY2-2m+1IF;Z#Xa;jj;~ZIeDP@@o-hk2ebf~w8BwGHG2-d*E0 z>QQZvmr>N&$9o^+3C^LNb@>y|{+*E#CmU*{mFQ~ERde&1B1%@D3^7Bx#oafBTQ1sN zsHMZb+styx%zji~gXsGhU0BBppVr)B6eh4U=z7$BY9!7qP(7ciMbgsyv11+rs^Oo| zErZ4>JoO7V<0ZUz#msAJqoSLgAF=B{nP)r&lEMY@<}@#L#@57&;=mhfziw#paEhMuzE>r@59BmHDl&yN&? z3^uFhA%n`nC6;B$QfURvo(XOPv{dI$x=FWI-5+dPbdOb@5-ZM>HM2PyB-Lv;SR$I@ zdh|G6Iw#xCe!c~)?e$N0HTBQOrK#K}*uKvdbTE&t2G?A~;iF?RmeOAmy=%mpOL+{k zrQRo~=O}MmAHgsTwaNl4*LY*D?Z>7^IyA@IpjNCc}BhFt0TN?zt6*_ zojU{7MjrGBsJ62B%O;XJ@itXU&&smwv0IV~pX~{NGCck5#+6aUHr`_t`NL}={hXXS z_t-#dX9+~8He~mm759RyfFSlHMBMaSMu^_3pYXXS>}eN2c<-;W4xW9o zO4@0auTdR&B$ZWzowIYyWq76wxF^OZ5AE8N9o%4h1NMOO`Nk#Gaa5#f2VKiX4Y0ii zLaB*MHbyb8c`7!O^04ed|Q*2)HI`cF^=w z5oc7c@}3_T4Gp%ti7mC8sR|G7IHl|Z&H2^F{*e=yJG|22+>~YR;#Dlx9dW`LSO|-Nw4Cb=-mmg%c5Gi8JASM0+Kj(#Vjg| z{iz^cV1F>%&CM&tn+vzLO8q(ux2dA!2fv_ZlKMJ^n^#su}Q;S^hN81{yjb+%K7xpmvSg~GZTs8z@5tG^~5WaeI99q4%?OhMiMP3!61U~ons^jeCRsXz%&wLn1 z$0Y5swB{TYhCtipYu0ZTDWhP|gQ(Z1uww>K&X9oUiRdRH^p_l$`vX?`BlDv1zJaY7 z9ptP1+IofNROp*&MFK5Owdu|4BPH}@JVVO)k?d%9*91wY?Ez!+*XT;0C;;$ZMiK>> zqid2g6_fA~u1lKrH>s+M@p9+$DBX*`$JqGjKc-)CH`3p)cb9cVku`v4iHA|i!(u`z z+qRB_J)cC3bXvR|5ZVDg7`WTmsqSPBnb8ninyCPf-}>R7Q{|x)S@{jV{J`T4AES@2 zM{*Ii#%DM%-Oui0rT3qW;~W}r1y{wBFlEmoz6u|1Conot=rtD6N3QGyvh4ETu_l%# z%ynrM`osdoTU{yj&}=M5B*3=t!ZcyUHSeVwh}lr%Viq~??oy(#3ULT@h7%*-Eubc0 zeum>BvzTQ=o|?lJLT{YX#C6^c>B*zkxSg@0Cdh7>>S;?hKabYj!I^sH4dF(#ofWW~ z>Dr%v*NcD1Lt5hST!k=|e0#R!8ROub?!+oYh@UzgTC|af3In1B1?Iifm|eMfS@Wo= zZx*Usllsf$w`c1c(&KZSAthJ{RZ&lBSA!I(N5D z$){m8@zLG@FN{TDkv7~qK#WH=%Nt8$4GSQDbiuVU;sD(jUMe33xB1bFl_x}g@oDV+ zxZ03v~*p(yYYn(p1t)82+RBX1t}W?e6^Z0lU5X^e2`QzQ-<1ddbd*jMj(#*3O|FsXKe zIh#qJt1^o`P4U_{CjNM{%E|2UOlp;A)D*QV*W+EIF<|6e2ExU(KrRnkNjhAJ~yYs%w*0+)= zBb0T%V)DT!M&|s`0B&9hd{*$utM^aD#vJYRey@hPp>#SdNlV95uxp~|{e-AgFHgR2 zQoHA1PZCSNfrXDzQo~p3R;Ids7JL$7W|Xnw<78|+@3BSLN>_DJVy|E?GjWs`xOX`hz`_jG4Q>u;c8`cjD7MIpb1;G3c;j&B8 z_kl?$6wgDm5w6&5*C)Qbp&Tafe}OZMg=R|dr4iO+ev5mdw2>$bu3Hi!`9Nj|Q7O(s zxBKADWMCqhV0G-8N4()kaiZP2Etgi&3fke$mLtsC2jBt^obvAOUAlPIfPI28q$JyN z@TNx1i@T+2Rj}VSDnQ7pHwWY@vt97cyYD&!9uAudOj+>XVn%C>Q(8?|+j~@(EPiIW zN8hy+@j=PdvQ#@m*2O0Nvw2~#?xz$G{|m+#Hb+4+fVkI0B-XP0MqeDJ9!~+st1i{X zCkPD%7>u0-V`^#f-p{(jIApWQ<=3zrJh#$$N;Rs>8=jeIB5A3*phs|#DcdHS5bIT9 zpFnp&-o*xlwbRFw?O|I~pn1)Rx6sRew10PB-lHU*?K11=O4zQ0u0J(KTs4L%Z^0$&<(c#rJOb!nHXc~37uHZS z>{hRw>E9H8Q2V{5(HdD`mTL%6XL3HqUnD23U8%Te!a1y%2Q#Jr^>B+d zoaVG!_tne2!gn=vT<@$#8w@emb$@8cT%BJ~^lfQ;I=rM?P=SoA2i&^E>}OvL)L361 z0ynW@nTVw^NDDm*m9J3V6p?)z$R$*u6BWuNW_sASTEOi&Srp2Um)C0cVZ@3lrDpUl zXJT5{c`+N5_1qk9BTw1hW~|gkVf=NWifpNcwbPrfctCr^P6%I8*zr9=!B8CQX^s-G z<(ui*@^K8Rd#NxTD4?He9&0m~f@;(kvU%+`{mqDmZ*>fr4;sEteVm|PQ)!v1Zz!J3 zV-mA2+c@f_M=x|rvp68+P|+|v3py$c(CPBo^$jYNj+AH(dt2l-hnM7KchBhNsk2#) zl%?N0M2l2Sl3T8|)FrGAp`(bp71n98@3Gap=jr)fb#Vk1?>B&W2krpoB5S+uZPV%C zrx$ef?uKL@`n0ZFGIcl17|C;)Wpd2(_mJt=P+>QY7dkw|$DDfHZ}cw=H8PZ^(Z~Jg z^^On5gzO-lWIov!;p<$&#p;GLYh&N2XJOd!{Zn_Uq&UI3)2>fdA?`g`A;`(wH?WZi zNoQH7_UNegOp+*6kK-V&;8yI)zzD;sIK9E|r6TccRrAV>y*S+*<@hp^P_a*yq0AZC zFFr&<&TaPK!p!S8_gL1EN-1?70@Hz(xS*U+<{)ZtiZiR+`FLOqi}HMfBR*0$7dHnd z7(bWiz6&lf%vuvZd>|^?8d`Ftpk#7u5{_yB13(+N@5jsHJxhwU#6aqg=3kWgF1}iK zY9x%I+UDMT;svXgpkZ1~*97M@<*NouZe7IBGHby8E0lKl%@^tBCii z(&vAB#gdBqf=$1P=sHP^}|lBiRK)smp+r2TJ&``HEfP#Uw!yy$)H)>pu_= zEH)+LA0CMho)y_Ap@eNOjKti}a%m4`t6C1#L;)+pKp+0F6|z`0X;B_j<=`IBdERK$ zuB~BBmf152+Ux(|?%lIlEfW?B)#Vhsm^i0{hi<5dj|YWz<<4qM`QS0Oa7NM-BKh=A zR@QCQSq#@FUS2pLL@|`DRIPPobt-*XxEBJh*B2`F-hQH?5veS)TyHgO(UsGixY6Q9 zk=@+^qv2$=F^gl7k*U$cFz_h)F8+%8vc`3s#Am9VwA3ZjC z%K@H~L7PUS+5Oq!yS<4DDB;{d*uaCS#^_s4Dp-~(BCZfM1dYPEt#>Ic|Cy)Ts@jPs~VQ?d~E3!0%@v(S`or|PLsNs0CA22@AU7F<#dX~oFiV6Go5 zcc0ECMr5|V_o&!7&c-TvGViAD!TawH=b!?M@I+z1s_Z=+z2or@slD{c!}WJ-^0BSf z>sy>-E_*)#-S+3&a z*@Q9|RzA<0wsvVj7}QTua`C( zsydUarn#~ev!#_Qth&vs=Vy-n3(0$CJ@-O(xBanaNgWCGR#8))%aR9S%OuggJ?&@C zqU2J&$JJ`$rB{xFh!0btYfii``Ns<|`NgLD?|GGTHut3$HwAp}gh}Iz+>>aYhE+a_ z?(a@POP%;EsJ-@Vdx|qsaW`*B?w#Hz#t6eClMxr)J9FFMJQ+dN@0pi%5i^p#_`pX z6;V0=Z}5%T)Z4s`gn$!lNEQDJmV?D-9=j9Ei|J=Kqo7+GjE?qusCBn=m-ap7Q!fky zq*NEkyfYoC3H{4c9*wV&V7#*H!$O!$lj*kG-UKHL_B00`neT|g<;~U}q?3VIrjQFe zCSS>wamNSXGt&^kJJ>Fp(x1D=8aa|u&wCXXsuzxA{Ir9YX3bPV!~S97FXb=xuMk3S z98}|_Zi=$YIj>{H#`-M;w=}nphG(CGFwA_Nq#T4mQp&>T)Ex7@i>y?W3D?E@hDowTu_wNehSwA;$nV{AEV)?n} z$fKn0WRh_gh}8MVObv%*F5u53Ux*oD^*53{)40&L39$~e)DL(AOPll z_JzlRH1CA14B_38GI_c>JC8$Br{cA7sTcJ~A~saeZgkRo-D$lAvpTlEUW=Csw=jA= zXzn!P(K|JorWX_rXtB>k7dm{=lR8|X5wQW|+v&Hu>*#GU^Bbc4hkLxIC&^hX2q#Bp z#svINoz|l}M-aJQkbBJH2~Y|$I{chT*F`;pPu2(9ZLbL;XR83t+-gwGJIWYWH^K07 zSbN{@yjsO{#=UxT3xfpFqIoj9r<5@x$x60K z(Dyr_!C+0?JTGQ_6t0)tq54C|_HDq2w~`KmOa~hDdMjA!>Mgq zQfM-tZxaR2Ktb!>-5)Of@2M@s4)@YY=v!yd#Pr@bE1W|vO-*4^;X~Pqowj>2I26>|ljRYwT4`g=m*qKtKc1o1~V09HNkfGKvLzBQ{Be{bjr5cLizRhOYu!d|l1v&}fl7UAh{|H}ZHbd_n)IiUoBYe$F3LGy zUsROt`G8o}5@mL;MhU4YHC`m|s5@$`0hN~~?34k-lo>7GtwA~*acR$)627#{(bdS+ zwXt4WUls@`5qL3b^DLDcI$``?n)%_KxmiE*1B=DU7~@;!zU1)fA#5LIp%EW)Y)K`t zW6Tb<*gjEVwo-PPe(kM+V`b?o&Y{v{IH%kiW9@O0Z&Byd{qtZ1NcU8>d`LZqT-TLO z9ZZpyt?&1gs!Q8D+692olcRl;X7!`*xO+Qp5%#PdA%MWQd-rlnfW-Gt6*cs=jj?dgP0Nl&&`WG@vt1XS(AEUGKcxp6wa5ssorPDrGDEc{qwN-+imqU z8InQi@%txs5k-1ceUwDRECSgSSfEw#4A5D~dZwOJ5GO2S_V>uN<2ec5e-Fs;e)}Y9 zyI3&FKR4{_e0*P|wUT$)?V&t_h*&3L@XZap38acyvR-OGYz|O_iu#!aGg#u#PjW8r zmB^C)-j+xie^Hw736!mupQP7b( zJf!j1nb@D>sFJAAq1rq_-U{nxrFl<#V`_DB&6!v>i)+VL&A|FE#Er+)wDgdJvXGA!hpEq;tHw@}0R8mc4BaWxB{{&*4MR5!@mrjI_SxUP&pz+@zJLBc zpZC8t!&-|q>v^90x#PO8>y!Si`|*dGUXSrbz3bKavw3E`8OJ!1H{NrC>)k15v+P2i zRk6I*(4H(t)$Nu8x%ylTlC9DXws++Y*$+mRmv&WZm7n-PT{g6C{k5vAOg6bl4?8#@ zb?7{G@4w9csDObPZ(T=2=)ZDP2E_3V30OX`3* zDwi9|iSg5eGP#vd`@+*KrckBhyGotPv=Sh+gMv&CNYO-$+i_Qt3tGvGE5qE@lUes} z_Xd0yw;Nn`Y4K(}Tm!a!NrjGB1rni7I8=q|6#>`7*a7Q?AIoYO62G0isxvTOJt7^r z7;VQ+{6(Wao0H03<;m}yC<1D*QZ>&qj~jCjQIc&CbAtPD`puOT>#iB(DuNeNx}3Bd zxTkB?Pu2I>^;@%235WJR8nj+6BxtbenCLLnhWLn*!M63xuV5pa{i37pxL;4Ei5f$E z+(q}qnow;1lf3Fzb@AH;`|=(Q=Yub^{iU$DDR3WK-6T32J_~6f{mF0D41scF3_PmC zfXdKHI-JS_5}XG*^`3P;Z*xZ39K#AHs|Pj@Kir}VhQOP6Da$ZIyUbDq!kT(1G-CWBYZl(=2c95MrtlRo&yJ8Us$4TFu z_-aZs@H}St*gb)Qq0%JOBf}V(9KAgNf8|ocyWIytzC^6Fd-GX?S|zwMNqdfOd(5u) zGfA?Fo#(Fh`jB3}uHOzG)$N=00*%V(@`zhr2jJMnLLZ}+BQAp9s~Vuc9ndSlW4@I8 z* z7p}?og)q6(VL~Hx+_3Fb#IqeA9`I&=i9*EXZSKTFjtixp3jKeJRsS5;D&F&Z_^c&1 zwFwd{2idmu8QdC^0^AGmVmEKp@?F}$;%$A**^7P9@Vk)hXh(%=CLfLrv)%`6XiG{*>9x}zq~V~>IQDi@b!un)Qk+8(gQY7R78 z*{^*DF}U^d9G!0#k5+_P=Ny@?HM8XQK2v(JI*S3nwqGVLHgbRd99Xf*h)-chug>MU zX>>Q??hIp{;Y7?CNMrdEdw0&07+Yo zq#r`lDm>b(^kxcsbw_qML#iE@(;!FQQj>K}6Q|_PZ(6k`bV^5xCQ~~ea~ujXt2m~X z?57+BQWqHnkHy|+yf7+ivqUPrI1I;W9(!L1 z(3)?lGd`x?Q$R5AWSYkG##{ycNHs@hx-cuRC>|SA({7~o5@S}+TR;oD2XOmB@0M8Xx-F_jwb*B8!hKd|-V!z@E%QW{)(b6Q6CFl6HfFHc5W zRHYG#-X}Qx2>v|;9FERaF$<_@)y(UN zH9!*x7r9do4j5xH{~i(WFQ5>x>r20B1;_NaU|uhO0C1lkVj{p#Rt%)9B{NVf544%D}l>>iXFk9MZVL zN(qFA!;7tbF|6yX#>hyhp~1fBRgJK{PuOjdiRz~SMkvTClgyLbqf?F1QQ%xI5H{iX zjXCif-!#Fl9%+e}q8)SM(F~R2po3J!FFty=P6Xa-dWgw2m|Zcfd)@CLUE z*T<2-*vHeA!kHmI6C5=~qcCev@;9~VF>o$s$d_P+S9l60W=T=&H}-+?Fws%H;vY?; zEdNb^9LP8%n+N*60OT%~8sC zUlIDMRla$6F~qIZ!(P!6*Biq$eNWD3twxX@wle31;Mxv76?wm80;)sD??@z7K?oG9 z%hfgP*&2w|%sNBl6ZmEU-7VnFhKg6@D46{6#WU&7r8ezm%lAlI|Gu8;K4a1*G7Eb` zNqidh66|&aR81cFtWAN}2cneMpNQlF^30>wxss)wWa6^koo+h;L3_t}W+`AQ-^VDFFC1QWF+8cM0s00@5LvL`yaV>r6Um5>gqJ>Bwc z8h-0%eUC+ww0?e|;)9+XT&dmCljy_q;yseRpTnB=yY| zKM(N$)r5;zqr`tCivIrS=>sBmgBdd&0Q6kc6B&Q1ny1|M)s{zf(3<_4!6?N-V|Thq zm+Iq2gl_?>qM+bA19Kh(3_>s9uyfdPiZ>0{V2RMRYn;RF*kRISF`QGF7R&HCIk5oE zDX?hQv(OxABux~fT-u*JZK@a3n|Cxf6z(_4sxOkf=a>BG*FBI3UXgxv_lV6Gj8=Pn1MeS7J#5rz&`=Pp(AR~4 zSF(uipmPJ}=1-f&FY!;Fz4m5}YEFtw*|mXXdMUJAl~ZLP<=i&k8i3|cv;w>?V)%WY z%D+0gI2QirNEf%8HTW7__k*D)5_@_&xh@L%#sRR?I4vsiVeEOqw*MCOg%(w5WqV9egDci#T*I!9a^!$Z$%b1#atV8GpAO+%VXJYkvksUZ`HO^&ufek#{Z4r!*%trCX8vaLbQQq5p4 zZ63!=baBHu1Q}@di->z~F7;_e0;8%tasB&e%>*Kbbs0#8ltUt21Fx?O+CWoNv8h7_ zxAVetrv{gM@N)0=*M#?7!T{N|myxO}CZ7^+KQ6qh+xnjBa;`Ig{sMFZsU9e0mrh(} zrBM>S45y7Z);d90y~XgM*#L0Jgok?MTRQ1TD>pQXpf1H<-z-GILY1X0dXDV_Tn>}# z8Gg|%0P{Zoymz3FbN879^Lb#XAt0y>BwH~c`nB6V?l^NTVlpatIT)&)t09D5_n)c_ zuhz^tWzMX?a+yn-2hD7Erj`j9Es^_=6Pq2z_tv=iyIFiB0Ieaif?wNPMY#i{_~^$f=aj5sWp3R%#}O^$AnbD% zxCbwgiLk2@nFqUA$$<WHV%+a00jaOEUOG)ZIw0~cUuW?t&EosGGLI*VW~c$vI%NbzD-3Jw0vrd;C0oLC ziWO_t1w~p?r*~Q0at(cCxR92~_D_MN5BhfM1O&Qb!l<90SP5WmX_C^-;u?3iM3GKr z<@2ni94lrmN*?2R5|<>Z)W zJRtrhHr9Nx#muMm^kYg=n3>iu4OYd7FhmQ`{;Xj?P=4&LIS;d`E(9=a&x{bv?0bxm z#57DFd$X+NV^LOn9VF8ZdCq#od9P zjh|a&EP{3`aZ`h1#2=m&RknADT`gR5SsuC?#5O9kBz7F93ftjnt+psymd>v*jv`OM zgBR|`*o!=((g|4i7(XyS5M6oUd%R<@LH?kS@4}E z9S_?dzf4rsMK_BZ>rLdE5DzImH{w+p)!%R5e`I2f2)ao~1VKT#>zm(wEOvoBIsnctyji>~3#2+; zyS8@&*MmisBJ!G{n=4iqhK-jF^^2ph7AZ4~m z4Rrt->W%$~_puhIl0FA8L|nt>o34$ml~c`@w>)5_lRN{-=^oJ-$< z)wompiqopFi~e&lYoY#QTEo_QbPvtvU~ekN5V<%ex^)+Uu7TdQ*Gct$Nt#a|420e#q-I7O(kAy^Ggi$ z-^+Y7zO4rg`>UFn00tBZ)Kv#LdhT%j^K?g;c2)d4j@|b@at5HyuJ@#?AL*&D_~3n@ zxl-!5FFzAU0YLYE zN#?nNr*jB3z3j%KrQeO)5q6mz(sGdf4rn!mL-e`=hsc0MqP}QCnAe2gY>bFCP}@-cw`q_$eOq-=l|rM+f||&i;8s!+#&2BY}KQDirCzKJp*Kb$9gi z0X_$5L}1L{S>OM|cR(5cetbX9-qWssWv~Bxy!(&)Jw&@7AKcw8`(H9vfBlKwILN5- zYXPni#(#ePzn=GRfA#wcT=;tBJ>7rvE&lTSE9gkb^p5Qf-JE~Fe7wv(M&${eKwfzq=Lw zTj0X4FN*%2sNv5K_dlkr-wX{4)2 z#ori2f%1Pj_^*h73;*9T{P&^!f6MTHOz1zqp8p>$!*F(f3e-O=w~6{fxaB!ChqauY zQwEn(h_)k$IHDXgn^s9fIE(UswR9+=kU7!hcc+q`4>fU$tKd=f+jG!;e-ts1%M*dS zqhqSo^)F$7R(AZ&)TeA9gM8(Z;7ZGJc>r^{0a{bQBNx$LyQ-fY1jBaKHYaa*Kq)>F zHAh!T)KeaD9-umvUWVvXjXk*;cFEU@;j4uc-_R8rUw4p|cHaH#cww*l6d@!OI=4zU^OiaO}{Y+u&ji3{USCISs;Wiw_MEmPI z8QWam8XMSV{lcR^Pn7>KgB<+Cp9&5C+Wr{6iw6<2Dn?7L3j9xRWdZf!SHX8G`aCmfX5-)K!_%?= zHT$|o9y?_@gT322oJ76%$j>q3D|xQ|N!jXmAGz&}NTXgf7jP}B?+icq8e9)%1mLn zq++WWjBktboZyp#cFzEK)$8CCt5epn*{)$i^Th20a@({{oThrYe1Z-eYInWmX2i=_ zh|V)c4BW|OChf+&WY;xIl@=FgkZ>7A3-tNVpTXd@K6&G)%F3mwz`d1u2T){Z`WA$5*HKS=Dt>+ zYP4N(zGN)xu{qXrGm`WK%^_})|+)uBQP8c4ozpFNFp z644Ft7U{u$(%gBfS^kmJu}MVtIQEcH%kT5mzJyQewZuH!ml)O zRxJ6XHbd`aH0$XvYe2EV!}eY#R($a4xjuCpq~LnDtKD?qQVd1o+RmRl)x+3VKL;_9 zZY#(B&Y@$^XVQ3L`7}&rjY-bC%UON_1H;C(1D*K){*NmPyZclD|SI>Z^el(*#6(LW)=`}dX zWaN0tVK*VyY?@vT4QFW#elzl@kXuj5dA66=r(4nsa^g>awyki?<$ypSW@nh2=0IO( zM%D@PozDR?-t@Jva&vlv_jo6)nFG%~*^-JXVHJlx)nvEJDdlwh>@roQO2rNO%3;a- zCp;MQf8(}>O8T*2$P)`CcPNJetOZTR{uj7eIn%+)xjZF%Z#SrS5O`FUD7d^li;btn z+3#n`xJ)PXk`CT}!ft*nGKJo6c@K;gTcjrXQYf+hfF9rI^onjR>WYGPMg$){4og;@c~6ZIu*)bx6TI+mUDR}JOxAhxy0WL{}Gv_iXRwBWjW<9@dag?DPyy_d*y3a zWhARXVh3K;Ih;`QSvyojZJ}$Pteqr&OvmK8IuGJ>nW`D}i8Sn&B#4U-4iTdG$kHLw zoeotU*e|+{9;E?KvJJMR4naZ5qZshz53xy2hJN82JQL_PlbgIfmv`gL$;M z_UbNVJ!VhmgDjR`pIGxRT-fTYjPAz^uOe|hjI63~#oh~@Z?5uW{v`zFCu!A6i1ykii~W2?Z% zvHnQmevbH(WEWY&eC^`Mq$){$n7AyVyz7ucQXv@*~V8=wik&| zs}!hAPG$7cWqBQJ;~D(24MW()7Uv@Q;awSm7)_DyS6PIc2Ib(`bV?1-3SM`)@!jVT z`TR>G=pqiC_l3PRxP2;Jv0_JzOo)k9YlH$?ta%nrMz19qgl=i2oW?9P=33dcS8h{Z zy{rC-f~PN=cy_Ru{=AKHRG;7A$u)XNC25h~wK62puV5#Cpi#ZO%X8f{vwkb`sDoPT z5Yi0ozU@aKx;hn3o2Hsv!9>g|lh%cje&*Ru!jKf4*sOtvw28gbksuCa$_^?8{uPUdg;q7J^6&G*PSTf0vcN{)-=8z^kfW>&;8 z>I9BY*i5Q3$3z*BIG5v*e6}L7OPGtgg6WCP+ArYEOh{9CY>G69$!Qj!AkzoMr}gfp zOncxtS@^^-M^~Njlsa?`&PH1KGwIXhz*5m))nhzn<8QZRprR_!gThN!poSmPi>KSM zXN%8NndKKY43ny-t(#6`2+y9`8UEpX-dOr|2&?v^l=yiJ*P6U*HD1t(XgQ;fRzRqt z5NkeOeLV0ImOU5;G!0Fg9`YcKXlVY!ioR8?A$+6BLX?7hi1+o9^;W5 zRv3yu9c0JNPj6(E1tNF7>%Q4L?$WIG%}8bB%ECVT1`sz-Nwm~X#-$LT(XH95loV;` zeAcO0t(`E_=rO)yHx)~)HC3(d$gVX~3=NJ>ER*STA#_>@z;uOI98UL`l#Xpjl~@pW zp7`XLG6EJ;n2e(-eIS1Ha?6*hUz z|qQPYF7U840hF{2npcW8cTtt}sN0C}N)vFLb^!y*Z8c zy_~+Oq3nrBd=u$r!1GbKeIi?=pRnx7f6n-YYWuO6#*bwVKS>TsEc)a~!ghd64tNiy z{f0A01;u zDagzc390Q`jVFQLmb1-U=vc+&JNna0ZnOI48PVkT0ZXB3MuIo?*R|=T%krm8dy}3q zSe;!S?e7u99#N0_=-wDCud&;;B=Q%m8*VGau^9B@UKGC!ZaCXMi8Xi5c(dq#DuQJ< zUuuApWIBfCj0!RTN3CE1m4pNOzUkEZTVJ8({C>7n6grp394O-qAB&j1#_t#vM#ScQQm#W? zP(sQ+nlfq$KH-8gt%<#XeN*0=!Y|XwZ8bCMA83-Fw}dN}@y0t_SenKCd|8t1QqXy+ zco3u|pJ#nWX$+fxaaMeJ&>>CH%QI8`gB7nP1qGvN{P2b1Kr8m!(@PA z<(Xn01+WCsOl&7s>QN6?dnec2!-(VxSx!T`p2LCm! zx*$MspOQ6h3MoF#_gY3KLz2n5Bvbh)``Z5Vp%npJ2{nHPGdmzi@Nrvzql(XDwg??r~5M=Yt2?mRN)w` zZQaya%Iz}=w|ESR%5cF(Rr207dO5c&$uC$J(Iq3k&)=5nTM`#ZYVb~^=KrJRBU~5l zSVwrq#A_@AS_f?Mu+29u--#J%^@nVk4VB{Qg;q}TFuAvz#2p-*{K8n1c%uQ=dwRRe zopKC=zzFL-c8jaW8GY{_oNw}hJ4+M0;5@q1mVZnkRIa7X@S7O3$$9Ds^p)i;I+xW}e+c~n!x#f=ek1=XVm)!ObR>SZ43r~gKS4kto7cyNr#&;b%GH)<-|66cWpI`{Q_Pva z&8+)xVUr@ZpYqES_hPr5>mie)2}K2FOmG;eiW!j79`-v zZzyWRTqTg5YJ&Po;k^3wt^siTjN&Y5R)wkY_!FK*Z8zRr8ZXZuF2TUvXJWZ%NNoI5 z==0R)**37UzQW8Cye=Wx?>+DG+Y%V~OF&TT{bk=FX}78P$~lru`W`E8&)isz0mVcA zhdj&CvHJ9|v3Qw^?aG@(0k7%}7h}e0&8YVF0F1p)r$;G0!Ge~Z$?;)gGooV<{aJD< zkL?w0dic03WQ(@q)={3ribZNZE_6p1MxXfTxXK%xAfK?gCYE@%2eY(n%X`#I_a>oT z`$fAg|(xOawe{(R~aTpaP@|BiE9{J zBtK{aMlrjF_|zO7H+M1i;#b+L(_I*-VZu7Yz?_6#32TjAwcu4K`Vk2bS=dQKGAq`u zta4AF=X>5?FARQKQ*^v4Ix~LjB=hKh6+p@P72)*Q;-36^iNpVf{j%$vx!yIpMwG$| zg#sh=F~ixcLrn5qMj7UVco6ri;#X}eupO16yh)8pmz;Q0_`xK@gr|;f2Rc))KAsbtN0ki4l(RUq7^cznZ1qDr9x|O|9*{!Eb zLwWL4XD=;%3(!l5`6Y|srSpTd5YCorb4~K|{2lm2fmzsFIE3?Mepusqi5vLA6pfnC zZF-|q6M9_znNP!JyO;mgSe{j&?%7!z&z;}V`t2Eq)7Z~a3|Nk-YElTN%@+=40@=9m zivFtGh6Kk(vKzRno?f!eRJAG)Z}#Z!fqx-Fsq}{q*n3Z%PI^~&Q1BB!xNV&|nx3); z^-EIcla{OoHZq%B(qAJ|n|Y2Hp_(jb#tCP#IR7@5-Nncrr`r+IRBo>>Pj{G|;S&SJ zfjuAo75w~W^^#kW(^c6`(T)7?AFdC9(=}qguV!5=ZifkdUhCzB+ommFn`!NI;#hf{ z@GcCZt*Udkp|B?MmBM>t7ww8V z=8_Wd8b<*uk-X=+<`nn7?^sbd)NpvfEN@IGaZ&l~B?|YDSi`_#nm7&uo9TUMm9O9p z!*0`C9z-UyyIwusw44Z`UY-;RTZV`?jHVxQnhR!`6|Snewv5sDIGw(Sg_F~G^Bs%M zu(_6lwFB3f$|}2B_^f|)1i>@KKZ{Vww32dLYEF9LXbb7e-uq-WGZLBT{tI1hi_=9I zqMultFc`(3nR&V%a9XWcjS-bFhWcY>29eS3*!WvwmF9GMCPPNjEpLxE0bQ<>C(j&W0zw1((|JV&h)(=7V8GqJ><#{{d;iT3_6$o@{e%C5(08 zquYR~KFY2X4@!k-seN0W?T)hsir_#DPbquFUfY?z-Mpm8c0@B<6C}Bw8gqto?cXdX z4L_zu>59JVEZx!iP+Y@av#v&wRzwnRnDJj@i`EA#oJihm!}AXrhUFuLW^#ye_6scn zJSKcw7BUj<^WL%a$P%-gp)mNvYu$DnGdC-Mig=`jKTTocJ$W3nU^NX0?0G)@XcoPF zfqsRoy_Q5)&J*aA*SSX!5Y~B>sHNLzUnSoYF#9un|D>-GSH#-p!Na;sLIQBUZLdIdEi)JD2tvU9 z2)E9$V0CB3dl1q8P2uy-GlpI1A1;Fr{<$8$YQNh)$3(Kd1CVkI$=BZn`~$9H-wr1s z4RmxCD^cc&343Avu3VTv@Q>54_PuTh*63Ctf6gtFa}`5WTB4f$QLw?Y5g=0MYe!+y zt+t8SK}4=3d}%C^554Ho2YY^QGR0>m?_fLy<;W?Ix+ne2@?Ob%i3C@>D36F5Hf~zgSWES{x z9};klEeZ2WfNXBeGxaifhRDquN=tF6oiy7J@QXgaVR;QUgmIRrKhzRjmiUt_+7d-= zz@;FOM&_TmkFM{&W@QuLO#K3l@1h>2ihH_>Ghr*oqQlg`hey8R6R44qktTa{UQfua z`3?!_MqXoLYWscR#PU2p$aT1t40}^ZoZD><#t#3?RVGqNafEJpSJ|a7^%LG}RMjZa zV=UAtE(aurq7p45(|R(mUYGt$hy1rHi{CS*@TwtB!fM@hYPnD{ZTS@M|O7|)7Q2zp31 z5D4A%@0x&n`ek}jeM3*nO{TbDJphVkHeakIsWiCQg7)-& z(Y8B!(EgP!kYXJGDNr$h7E+tOl>-^A!wKK?Lx}l&WS4=v(p@T+GF2BZy|yRR8K}{O zMrFR||DPq7-wR6R%*r&PUXw%0Ubb`f|KN+`0Xf$LL=sQc9>r1;zfn+#i7E7s13>uE z3TBVblubK&D}$};OSH-|(hExOD7*xA(e5X{*qxWa{r#T*vNwiUz~$Itikd{zTkU?axWkfc_+Q=&Wa<{&4NEj7o{k zl&`GY;Yx&(*hfP?n=91^#4OLNtS0Vj4c$?EgeRfu{mQ}}9@w9$+e}&2`inVJ0{{!l zD~`X)Em4NSUf&R=d(E!|-=(^T0pKH3LRrcvzsS%ksMNa5nc_~CeY(HhL&(4T=;Hmz zg_@990Kjw6@|`qkcQTPy7x0=tfBqcITv2MWGhG$QZYWxp>G00jOUwCa?K)%Xz8tVh zYY(ZD3-$8-lN~iYj;`gNfY^mx1f=a+R_W{V%-OXoTvDz{g>T5~mdfRtgygfZEX1>z zFOJq-qmUqUveEe0>32H=ga5skQ4BvC`Z@m$f?&wGXL%c1ai))g*B8r3cNd}88NbjP z875%ar2QkC^!xkpD|$dnPv1M&|kzBRY>nP zBkZ)xjK0+Td#*f`0f|eVN@Y* z`@wjU9*3MSntM>-+4iNerPN(3?CTRNzV?;!N6fY^@&jXaL#SS%obAfgLQZdhwhz6n zu@X9fOF+l0KamdbNn-lg;ZN3699>$|i{?w;z7C;eo>xerht=$rl8W)h=jcKQM~dal zL2vARG8cA$25nt${Zi%Ep;XVXNLV9Tb!%iSql%A4f*Rz)g6icwJCE1xs?EC z6pxLvq09CR<0nzXj5T67_mj;mP%Yx-an%vlzW|8iii|xykv2#2Gex{1!;6?Aa}k-Z z`|>!KX@Qzxwe38cv(q}yQRPrEPQ+tTq9V&7R zMDB=R{W4jBaUxAcSoBqh{Am-o=l6_GymciaGTZRa-~W~)p&-oD6SVc*X3f9&Ddt&j zmu8Ym#QjuylLDqOkjR^DUq(>d15y zvDmvlNeIEMORC!vC;9V>D>(@2*f8nN@?7unaNdsx>0RK;m!V`=bqh68NL{5+6M__wKff3?-;8x8;WdV* zjgQmi@kFi+`B7#liYV!G$>zsqqSmHa`bm5$`k;@rSB^2?r=w6Tqq5Q+XOKbV2^*qCtKl_U*kyZz+ zQD*Nz=kJU1x8m1tZ@>Jha%d2O60ji_X+Nk`*1mHJoj_H{I>7pEs}SE2HOUuK>n z3Xq~=mLjtN)kdVgu+;?9KFw~Gqs(meK4OCfeZT{Rpz)sXtwQJaaTo7ktpHJI()L$N zNl$ByF5SIG=>S~n#qm3sdzRZM{pt1N!w&m|i)%cW*;TKS7$wn<^ClkKOXDY?^|IX5 zgV=dzL~+K;1ZE#YR=bP4Rzb8lJ*H6xg>WN!$82UYwU2gjc6|G9<2FUbZn`DuGflkR z0J@2tL!ePx1{&nieWpq;mo9;3J6hZLK_%f`xaUF%=r=_^FIcMp zj~~_?_R*d75~COYwIcR7ywba?i!X1jmMHj%#-YP1Wj!*moF z*@+V=_tY#%*5_+!^if$fwxbUFLMf!OUZegEgH9Agl~3Sf18zA!uOi|>=+Lqqxtf4w zWFzC<-$eFXXFm>AfbVhcWXy)b2y1+#mJZ{q?JPT?4E-&OPvBA6o{NoKb*7w*;V9co z74}L6Jd9-K*>n!o~@TYes{N< zQhBa$GOE;uU!7&&PKxlUomNF!kinsc82N5CEvNPQTL$4*`d`aBpFuV)}cEjY0o~wY%RzDPn1@Quk7f#9# zNFHFzes@aFUz^vI?e)v6S-x~Y#EJQcvcKytK57{RxP#nwif?=JS#^7_>Fqnvde7k| zraFNTR`miCd4-e+J|-=WD~>8oXIWF!P*tRXEvXUF z0(v45ky)ig2cXUwD0QU!1%ZON!SQ;LFK*~zu$h+U%D3FcVt@~MHpzvMjob)eTQ`~M zX3qv1ELbPXeA812%!Dw7n{fA%sSXIfEjPF zd80bhE0|PJZ)-e%`Q*bC9my0+P!KVDRa+R)6lNSS)jXzq+X>qPrXk*(M~%g6dDoP> zEX0??J!x<_p4i3ML;{cLcS@=mYa4pK);uD5g6 z6s>?ZMNUc3{Lw;-t?o7N!nNxw6ea!5x#B`SPdE1AWjH{t<8X8WmD$nZH9d-DHAu@b zYrQ&dznQCR1{gPbMO=?#=AlL3J`Om*{((snAVWq~pu#b&{!Ie;cL$BeJ`3&X=M`WPuV`w85bw(mbast(I@Pg5h~CO?V`~42Kcu=B&zk95+y~LfA>Uaet%Kx zIsb5GWO&cL33GbXr{;EO&aGAYt@GO}33uf5H+xMaXlSq89}!u)d{=qJhzz)JG;auz zq=+82`J-*#zyGx98&L$Cy89j-YGmu#?2*g-_V%_-c>^ZF;v6{15;EXpHpjL*0&T(Jn2ep8q?AnUd-E|RS z0imqKR9;Q}H)+%4Yz-k0R44`s=$f)_?PHiw$JvXdG+JRkgXWjn2@0dmnij%GvP{2L zTYXCEIFWTZ?D~J0dh15n6Zmqhg;l}F;vkxk&N&A*D8vweOt7T^R$ImYC}>`HF5k%> zN)Rs$5*0ysVpze_30bu&&qJ3=9nb6}diwy~wAr`oF_8?8%xg9C=c2uaMMPdA2Ocef z4}Oe$fp`eLd9b_vH5p=qy6lQkB_W@3@tHKm5{z) z%wFdBbnP(E3YsZ4QLG8H!LoG^hJ_T32k+#Ic|(3iPNt81tho0G_bav6Vg6gQwP+bT zBN?wW+d}jE60cG9o|3TY=S=L}q~TO(5tx=&7_a|4FeK|>aImsZ##ma(S3N$+H69Zh zF;41;oWxvQ5e7Av=rNRCFR$cV&1lthP7YI(8_7_N8p#ytjy4*DA!T;$-~c(3c~Ma9 zH@e~18ZN;UoK9bdX8<2^+}+|$o59(`~H?FUFtXi!zqkXRF0 z^lD2vQ<*hOl!sD9EQhE9Gs`}RYy9IUONigUe|O&RAF?Eny)o&hXyDa?CT*sNc40f5 z{FZBs^Iue5g&`}+J`>TU*>Z#TRBG9h(C1EDHS0$eJ4X-T`A2=T(aG~U`);vD5i>(w z6hqdvc%dO{SWbywHY;j(P0b#)!#&=qZ%Cf2g3jCE$IpZAxf;|iKGFJI>jHl?B&rJv zNq^`8$>&T6Bph0uhmp#mXg#+eDXyJM(=T)SGSoq_v7YqlgIY*RP_e|1h!@Qh52$~$k(;=<^#HBjjkWnZ#m7&Z+Sfr7|MMSB-lk=yW4g@ zw=_=QU`kK*hYXEvVkObfU1NfpzvfS}ZYn%{xEOkzVbvZeX0N&}X2Idrl|d-*DMiF}E>P#y%^0lofSpOJ z9J>L%MS5CL-W5505R?4FPV^>so=dwlb`6)l_vYavwJHq}opy%b~fZ&U!bxGQJ1I z-Jq<)xdwA~{ko;|gT(-`Tdu^7D+!Et?UBhIW_)7NPPWjmw`JXg5=z#sFDu?Rxlhb8 zmWv?b++GV0B-JO=g`_m9G}~xPQn-c8Qv(`(hFml3^W*}P?}~AIsqZGBI1@chMvt23 z2NR3GPD)^ghSU0GIcCvKeI}|MM@@tH^-UuYvv{+KPT!AQM{F7xr!5Y~`__e&K3-~|xhb5_ zy-XLc3U4Xpo1vEsT@Z;eNu}wrM4X+~ZB+5}NaCv8bERE9D{>!~iv8Enc0QF94etdc zx^B00M}B7|Z1M|Eb@v7D0^LIT?|J8e9aTaBc%-k!socXC*1n7#f=+fIxXzn54|4Tc z_a?w4gd2z0SaCGbpToz%z6(bKu83j&`D;L~Lw#F+O{d7>?f3U(w0cV}yVEHwBs@Ny z&rHAg;@5KDKi-&5aCh2~08|-|-6ePnL|$2ry59`ZSKwc_^~MmS_yDqSue0T1l=noE zYHZZ);wGqd#d$UqzJ^}Yor|=wi2n37RuGHy{p313&AZt@<=9z=dQdw&bScJP;6;8r zo%J(zB6>lcN&WPrAs3miH{_Z6%J?8te>|HPT)4pu!U8VFI~qJYK+QJ!kDFp z%u_x60jX+P{0@GrX^E8i!db%{rWmTyCi)(V0yPq3U;$)3M}jBYdC$KY4$b2H9|rml zYt8tkHQP$2?R9p3G=qKHWows2(ks<3b;U|iviQrlo61FNky>TknH`4}_uP-D&L;1{p*jiv`G)V~>>nbY zpi>O2=NM~kzH#^Oi2VA^G$ZfY#YISH6JG$=1j)3ipY8q6kHi978?6#kuG$@`} z^(^#b64O&G&neV+{4492%ey3LM4OC+n80(ZW)m-Tzv}vA;_5HojBK(+Hc@m8#@>9V z8{V{TfQ+CiVuW^6L0*Bbx5g)i%BdP(%T=Oe;79|p%85J*1l%P+YE)X zVFk5@$ErMC#r)aPK`Ma)!qsM+hqu6t`o{~$vb&gB1YSfJg+??Vvx;@NZ~TI~+oyY8 z#28owZ)Rj{K&QC1X;nuaI|2fsc}!Rp1AgpE(!pf5V+ljf4@j8us;NP9(Uk4}dHT77 zvK(A7v$TeryZFi(t&JC0YJydw)1X=j)9 zn6MyX#^jlF882YCci$mX<5G2Jbjv6A3KqyA#GCCp-gUInQ>;1ea4@oJ2Wz%l5INQOqW$>6qOpo`{>E`PF}13`C>$I!EI5uJvP;Q`frr#{{z@M9Ny&9nQqq;T3!!eb9pS zI)qG0>Y_`O;BRa*;AL?8-3GrqME9w4sX@o?`Jtw0it$NU4dhZ|FxRlu_)MPP*2JnC z&pRkT&RqH@L{9o`rWoXx4E3m`@f&>l=GvWt`3yOqEgZ3rA$9`XQ6doxV+t&rIDOMW zm_%@SIh-14*4VMtmgkS8vK0-pKH8oAT1|5L62dzo$QzoVeNqdyBVhA@An#hff|pxx z5e8umb+`}iiD>I-N0OGm&z8o1{{OM{mQhiLjk>TPAR#TykOI;o(kb0YcL>tWFhheh zNK3;264Kq>p#nqq&@ps(p7Gt^S>M`wpPww?56?X}*K;L-{E&)KZbsHL>~BdUw$e`| zDHOQ1f4eikg$1frBYT8@F*t41{mNx9B@)lGqG*#N`SnllVmcH@=75WbEgm{{u~e{$ z*~$d;mkVv25;ES@E;>eoXTsR49K{n!!e2l)_Ue026B z9(+kvI9G`9BVCC1W43(P?}@1KtR1w51y?Rzndcd2E?jt=TfQORy9)^C(Cl;sB$0#Q zM`kSoky-nZ{FBL0wHng8LvD*A73 zlcTN*2fxv;sk`Qru-#Ug&*8omm@c_X4{5Z5lDQ5K)qd@RF5$PJw)5?MVRw=Ze_X-m zFQvGt$v06MqP~A0tDsYLs-@XcH=lo@Uu%<|i%8w;e~qx?J*pl5i+Ztt+`$)oE?2wU z;w!tnl6Kd=BrDqL{gUM#aWmh{Vub6SnaFYg{)1EhFaG?m>rEV!P;T6bY-Nc;@m1wg zKFX7Sa+2=W1h)yPLu|8r&{e-WdZe5v3zdADUa(m-{=rUt7OH^UE1@Wj8n0xUzrV2$ ztkgy*4%X{4rAb8ebuInY7|k$(Oa>e#&I z!VPAj$geU<;hN0g!rF7PU~%kPv`IP9S9WO_vK!W$Pj-;dYyUp9xHnXgP~$bX`a@Sw zKjy;w73W>F_TILqfQbPz&)h(3>uTqcH-}AZW613TD$a#-wugxtZm8qxtqxodV)C~- zJ3g?#Z$M}+`l~j=+odW28t<{_(ra4hO~FpJ=8PPeECmND`e5_G*rR- z;l+wKU$ZofF7K9nVF^g87MrPq0S%L;3o7DlUA}d#TyMK`UBSAgiU?7Ne(4igpsLue z_gZ@?_vma(uv7;5VdL1NY-yDWHWWQ&7QAQNMB>kBv8n3{{cp&F$m= z6^n0Kg0jDN*CoIEmPuk)BT2uF3j@q1s9)%zp{De(s_@ObvMIs5jzU$}jMN!Li`Tg$!p4vf+n?Vf2hkUJ&RX|bqOQx-cAb72 zYPYO#4Pg3eGG-?Fw524B4ZnSU*GaNll*JG{kQn6#{5Cas_vZW0gk~pofR+B~ZXspc zg-h$!n=Ge#^m=9Ee4IvBi%#4q(e3N5Y}LVWu1Qkh3FR$L?5}Q-qfv-2tNS*hA=lq3 zrFIfB!1?JHZF{AUK#TJl9pWuGyq}x);$5K+Hr9C?_4DS1H^OL`gP7ut7hot&Qx{W|Axt>qsxO}#p|G_#xD{6DrUh^aN3yWwo+Xzt5g zz@(VR@MP0)faEK!%qX%C>KRtq1?khJWQXZGaU8dZof@0NQ0(t^3myd}4?hZ?P5@ibq)0kCN-^Fp$d+o?FT7%r zwTHRqrAC{bF#6Y4(7uJ!dMc>R-;1=8;#c$1H8S-j5j=L3i#^41peZvFIXfC6`||?j zL{rz}j>o#^u1`VZV)xeuk&BMc$BfU4;=V=Blnu*v+X|;Hr-_NW1Y2Ac2(n}{O0Ra> zH~gOT{CQGUR7IJb?*j_wb_4AI>jyD9__)w&}>mRLPvq%r%`dVe=GkA?I< zLGIBTWafgtori0!^kcU=`CKQkMB(j0fvJq z(x^D`N$}|exd~OX3?c4-XL#6ChjUPRS*yfMT}@GJ1NGxRri0iq0mB|R{_IK=ES1s4 zoLc`LZP3rcWrSLISx)1}w;R{k+jM3*pmz@teJ}e}JW^=p4v?^U(i81ECjGr^B z>q0g5V_1nImK>3)SKPx4k>C2BP!p?(Hq(X**2tX#h)-zyk1yzt;88&RKjyPvEHPaS zmOv@kIr$txr%Hm9vOwK;^|`KId`MqP%em?nrm`x4fgwUBHNVkwbz1jxhUVEDtJ@7H zFLe@4$9*U_bp1sF3M|44`IIG;{0FhoYHtiV&Tq3U)OM^6Qr#nFLG~8-d-J-3_2em{ z&~i>AOAM^rZAu_|&XvrPX5gRvBQ5ko<3+z|$)b?+z|Zzw(ROulldtwqE(Q0`o;V%> zvGu-q_w#>FDS>r_N*n^zPB5n}z2A1kN_VcuQ5#m?hkCP*-?<>$@EtyQty}v2bfA0` zTwAzuXL4l@c!`#z>ldGGah>kLu?%xbf`2o;3)N7|cnO3hKtE1 zRNZfj0;;4S(UhiITJr0{WuL5-I-2tww(hUv?29o(vli@;@%a3idu-_Sk>qI-Q^0TL zOmV6iFSmxOiU1rLh_?<)e4cF&z`2JoJoD&>o^Jl(z9Avhbewl!TbZA%$D-xzej<<% zr=UfZjpW=HS5_(izGF7=h+)60k?eTY) zK8i|aChy?qeV-i1;j*oxsY4T8O;jc#fL$`Dc4;9LQjlVNRIEPv>9q}0sua0KcreXs zaeuDp;X>}>cLfsZ3|^-kFlXB)EtSMVYk*{!XMWN&D1Q60zHxaxW55*&3+2^oDhaIZ zVcuXa{w9kdUX{{&79RgH46L&lwMxE~4|~F&yVqh0hQx&I;1m91c|Z4`f??%Q@RXm=x*yiy}eK!CrL z`2PC$&;!h7>j}%h^ z;*Qhc3#B8o#=AMe&hks8cq;W?9qr|x?Y0jD*j_~aa^wU}7*&0nY}~ikJOTEvoX+vY z?&HS16!5LeG$qK@^zCF%$9b>w=fz1q<4+$QXO+WA2G^C*F-d0dNh>1 zB@fo5oCA|awgb*nDJ?8 zn2QA`;{DX||IIKFoa(|DNrsP@a5+uWS@>CJ%O>aVNW8HlT0J~m?BIV3LaMiU4)ko) z9|VOgZmAM>x+q>p2a$1G%1s#!=W#6~;lD@rIbt<2F26r}rDEa1+2w12-A4VIiWg#e zPHAsx$!N7~=(9<^EB=Cr)^H)tjB4^zQKf(GCAUt?=)Q0RNzG(I3a39q(&` z^7Ytm{r;eXX@O1CpXPGu(Hp{fk=AGfJ1fsXU{(_!Rl_iND{)o;Bj5=2ssP2qzV2Pk3UtpL5a9zh2B3y(EuQU8y5J*~tTz{ZUj zQOoN-O?@^`vDR-Oi+FQO70yy~S}f2^Z9CefJCDAbziTarO2O+GLartGV3+dB0u77dcaT!zl1*(q1}h z1S4+~EL0U&&4N|@dGPD-deLg{3X0=Hu`*YvE&(j=ie%&WABneiC?6c_kOtNJsEA!{ zs=s#c)Y-ytEnTZ2f1plxJ^&s{|4wI2NY&+cZsn?uiaD!xolbN3xG{u9FS6Eov|$(^ zk$K}M(K&Mh7c|(vt2sROXsa(42yKpQCgS1#B9ejMu`I+h_lq+dT;DG!qmF3-voS|2FH~1YmY(P0YZ>d;!!7O zFDai<2^VySl(UB!E8NHc{%Iclfi+P>=qzbpkK&`D0cvau_OQD?TUyw0Efn_D>%*QY zsTLEbdgfy-qGPm@ZP5m-Q5wAdCY4cn4zPdqj78z9@Fp`NSvE0YapD{aS{@D znvyn|7@iLvAuq8B2d0bNzD98C(DKsJPD-b6hSQMK*$vUcTd~ofGo$={-*3$7<`Y!$ zrC0?edMUF*XueIF{mEKtshXT6%+Cb5k%eQ@Cie-%QVBqapFU(5AIur^Nw*sxOX6{- zz3d^a)pb4j=6A6O%hqZUH9CsWc1Y6Yj?x$huU`qeyJD!Rp)DE-wu_I}J4$!c;&eEZ z`;=S)5y!;dQaMeE+wbnvuL|jQY9`ej{5%M)!A`7JreX@m zUalx7t+Chnk{{wX=|*f4I&{Pc@?QVnE`W`lrP@|mp@1lgXsMbE>fGaR0Saspr`O*5 z$~;H5jGty6P&AmPq{d?Ej;x)|*VU^FlS`DZ zxGjc@{^~w=rPa9=6WH=?i=sQk0>nOfpzZV6=0eF3gHRw}Z2sAGUnDg|!}g+W>T#X! zS+sFwk>}NY9f=Rqhy*gQKZ;Bg?1HJ{@0a^kU%C-emwdwiduca zhfsss`gf}r`TKu(nJBQ+Zr)czhNiK1zwVcHD!rPEz;gZJ#|DD{D|^?RID}FT&93E9 zg5PzD#$}y_2<3lpB6^+2cp%&yoykP2eY+#hcFB6+Dx#4D@jrmDjtq{k>l~=-Ev9wU z^I_poJb8wIYvXXu$^Yb*$Zt`ms@8t9LT=@y`|Ko@CTANzvetJiI2+_)1M?d^4e;R@ z@)#bv4FR*%ke*QrRj(P&Xh$&4sJEc1pV2w+=jw*iq#Mv?(w-a)*%+}t9^q+FS%tMt zANc4+YsmH@X$*!z6mBpQgsAQeJw>~%2Kkntp2S$RJOXqSSi^o+vWn-rw6-G-HSt(q zVJ)2P!DC?KUl*D%W^2joA*i9cikF;)-?wI>j}a>KFA|>Cfs(gm>ynV-O`&F$e*YX5L@OtE&Z}rDkPL6F)#!et~DtDhEqNvEc z{%rKaR1aJJ!)<`u#XBJ+dYTDdtorIolL&O%AAP`ZS9JbT4p7V8I@v)yr%R4SCEeP^ z2NNd1Am(GN?W2o4h8gYmM~FsWuRPyamrt(rqI0`%Vt>3Bhj@nEba|${esY%c^VOA~yOH_xVbJ##GRg+;T!s^OCwHfhI1`A;B)UF2_RL;L zMOuCgUwSdA>o<0`n9INd;8+MWFolx{lA35&8a`wYpmlqmWkjrK+`|`&rp6H*jI>L? z#k|vbF~TcrOR-zreR~s;AS%>R{QUtgSeOW_ogH_Kt;kHm(~KpegQj>G#^YC5vBbIT zcU%ytxM=9Lr3M&9d3C_F1fZW*F=r==xh=;^MT`qBb`2dTZq%Rd<;9BkaDfXh=u-q( z;aFasw+(8W=c=L~Dwx6RE%i2+Q7*!92rzv01p$U{#`0IBecIhuIc~!Wi{&U`}3vmvoY6~V=H|DiRWisGe+#Xb{HF$m0B=Sy={#+s&(iq;zhYJnbbdHqLUONs#;4yEf&VEBIXG}*Z+xeh=uM35RvAKI6<$SIAH18^T ztS9NA<#1fQnCx*LB4za6@0~`z^QV$8cWao-FA>~2!KGL4>1|_op0ds7=Z?R>1VpG? zeQrM#Vy#FWUr>v4>6jG_lx#Vw>@);b%|}op?d)7X(L9}wzQe@ERudEN@zysBXhCrH zx){8t<|X%~GoLR@waR}L|; z=deUZ2mOU+JHBU{KbQ2h!|?y8DFKVp;(b3FBik-m|NRg6A8@?!`wPVp_g1K^`h+7-bOrtENRKD3cmXW z)Z;d&%FrcfrIi8bPcT&Jd(3R1Sr;Eo7R)mc5Q&rG)H&ZAYV$*eq4~A3{gVfi6;Cy1 zbMCXls|Z;p^J@5b(f8-j^K8o6+84Lf$<`VBRac9E-drv8Bz5>dYsT)MWOi735MHHX zp-QOtd{4jP>&B|=0u>z#+ElWs&TQI;aqK$3Z5zY`EA_kTZC8%!j@oEmR$2(}ANQktsF35XJZ9fEAAOlt0?;H0WTN zs5>d1AYS8xF({s*854?$)78=H|im^)iX##$z5~s%f+Uzw#9op3Dl+Bmuv5*2rJmIx<={y_uWJ=Mm zc@nL%V?=W&o{&9#d!bT)esQv-tn2d!%}h+zY$nljPRNS-`+NziZ;JHy74Y_ z^_q_M>6hpYM;~ogq<;3edCyn<_DWVpYHTdvr5ir+-h)Nis~R(KL@?po?YWi%ajYB?{VhO%U6kv;76UhFVh}fH z71Q|YiRGVNWS|rK!pa6ntvd*pX)3eh`#QWusu4h7F-6KMtUH3|vv;=5EBfRXwf^nw zHZmzUR5_gteh$s3Ed2X%bNh6t1#w-ub0Fa>E;r9=LzVsqjetb!%tvVI-`-`$+v?-s z+H#Q-62o>Dz&ca@owvDHxX*nDD=>lXpa{JiA4UAR>O(1iq2CPiSK1eX!z_QvgpGk+ z^O4Uc1?r8In{8uw`sq=)2zASjpu)W9={43-S$qnG#G*EL1F#Cs4XrP@)p&UC{t-ZRf@(3TD6)Oi2DRdT~ozw6epM zC${!YA!zgqec#JxCSdTmF7eG5SR{XaouACerLR#~?KYoEm~r^Q_A)$U(fa4*dq03K z_2-Etd=HbHjH%VwA%#TW^d-H*YP@@wg!8fryGCKBbfB41$&u`w$T>~x3;MVT?{}lG zF8KjB4XhYb8K~D`x1e~dsrxF=&*mKdVnNg?6oGleA`2)KVv&*B1;c@=XSDxi2|ONLKA)QgiVDX_?kS?J~dl~?TvzPT*9d!M(rc~VBft^Vr6 zjETa}_F*4x)<4%(rhX}UT$Q%V^ZqkVb8^|S_Y?eoZfgrz-KEWCF)QoVI1S3zh1`(3 z2?pLiq^kp3w-g%Y6ZK-}Rs63EQ& zpuafyB9V1NHDOwJqR5@MzT`>#=4LK0n%Q8c%=X?3vLQlYQdGEgDvt8KE^Y?h4Ymzl zz0jz0{&LPyU!ftsj&)-)*Nj{2dg(dxe95PUcJy;KP7}iKsZJDdL)^2J-!r_Bz5hC; z1)>X7?Yqh-_l!*)4*W|Id-xkIZbtJk|f` ztJK`S-aPMrLbH^@D~vHd@H+;HJ`g=l*fJAe8> zpoyTq_flB`9d?LvLb+Bujy(j&aqfnn)je?HJeEC@=%Kz6c=A`Y)V8RtApr(Y=7ttEYdgCgxhjBTE@BecVVN&k?;{M;Dz_gSLP|Q2ss${Ib%b9 zBP)oI$?#xp*dDv>mG3~zriW9?e=r~n2bnIp4KVdf^?xd32$Xokhwf1_=W_s}#|m+) zEc zvDK|ixSE^4P~!FM+?;-297>CsY7!}3@c zuLQ|l&_lm&TqZ$vrnJjaqabYk{Ulq_n{t>bXc6*fAzUuOOmNIg#vGbNe$X+;SlAke zwp+XACzRGd5T3`F!_yE{X6taE^fvkAJ{UY2Omi_BX2=X>J@=^&3<;Um(~R~+240b> z03DTMeUpiLL9-?WSSqg+s>pR&0`=$7f0au{oSj+FZb!Y#%BwtYOV&+yvGbO9Ft?v% z$LTCOxB2s~<$73p%buba{t~~ASQFWh37?8TRU|{HGdbLVZ1-kJ z*(sjYN~KX!4(oBS1!PMtr7VY7lMD`<$MOIfgkX`>fGl5QVg0&4YEJFRxCwNpDO3nfMMwSwnAQ6x z;IR`%Mfcg4GLQzHk=7J&_w<5Z`F?DT9)lAdTgZKHXS;@QrwNp;Yq`p~eb`4Jhjfb& zA|_V9^x80DmETqMGWHefn48<2eGI#|_67@mDBR<1v@>35vnX8%_O`vUpC1mhpGEw? zlS{b0TRdK9(96|T3v8tgu6>FbZ0P=abOB$MFDW&6Y`gnAEetJsmr`2oDK=BT+S9VK za)?F3!SdzR-ls0UwMZ_7+ta1&mj-Z1`(YWi?be*+brTz->3 zyd5c2kzu>2xwb&9noin{uR#$#ZdgJFNIOjC=?YhGB~avctk@V5tS}#SG!of66_r?5x7D_{hdub1^F~SF z8BQj8-tD~*I?cK>ce=6H&X9Uc*7VD+`)%KWhbLAzkoMtVssm7XCi?ez2KZpdX{0Im z6qV8M@jP*PnsrOm>FzK5@KVtG3bIG&yH;DwDeNXx^X8vUl>ZR{_6k0#*{J?6tcS1x z5+cp=S^gmN(Np-NYXVo;yGKMW{;XQCdtRg;X^aet!Eb|MoLy zd$c~TK5KYTS&nq{%;R!HdxURW(ly9GQNsuI{BJa_#m}n)zlJNs%vB_7^PU^>w6JeP zOO;)|3N9pKv=&Ebq#w~RlnIc?pHH1k*(dFCjFC=Viff-mw~55ZlWcF~P8JpLh$ddj zUZzKFs>qmAk6kom^w*4|75;EMcz531W8GDu3*z)~*%XZCz?UbC?I&BGNbzw_krJBC zB*B@@h^9)260Za%*dL&EU*o`J%j08(W-4M3hj&3+!Tuh2{C1k!5#Qeu&p%toq&a<1 zF9U$rj=G(r;1&Q zZcbfVx|lk0@&PZExene43b1Li-=c-hyQx>B^V@f!I{3mE5)4CC8agF`M7!%*ksQDJQ7p-e_Nheb9cjk#1y z>BlB*u~Lg|OeY_uuiqah9ME7~o0|4}OYN6)*>>>oVY+yNIWnRLpYO?LaS4YljxH|e z=Ik0T-mIaZ%YJam0U#!B?J&jKR~A2DwSL;;)But3zhPvYkZOiCyH->Dgu{XwPNeI2 z+I}I|CHI2O%&1$>o(?8eq?{jalZ_Y<19G1bO(g2d;{3N}jZ_M30_JD2GG43i!6K9c z%zvF$1FEDXB-%2D%;g<>Etgi%Z}HQCv^*dz>O;mFVMR{7q3?=2T{%7Qs^%d?&>9bvYQNrW89S$1Q#|vM-k1n1Vs^|T<4k>?#LudHn2j8* z?{sN8tM6+x-WMO+_}qG(Z!0faab&@f?8=@eK{%CH9`lm+foGgxYgNLICvA~JxmaHl z&lGbe58;I~mo1NonpCm7j?04bDzw27wR#02zVXJ}RFFvZ$I6+S8He*ntav-Q@ck8? z7Pc%B_SCj6jvwi?+s4C{66-|#wd!HVp*&G$K4Sy z$6w@xhdXydM~6S|&io4g$5gG(5Fk|K@-5c#|Lxxi?mA>zy=9MzHD~EM@^Rh^GPPnU zBnbU&=N#WRc@2pkB-!A#t$KSWMLje+SWEHq{&`M@hjKE;droE4mOh-6RygSQE0x%c z5&`wwxd@-K;-+ylx>Sm)@pgV3!RPdTS;tpx_W2uV@s1QN5YMDZjX!T(OC(vG07M^N zjlTx-za*J8_D$R&H$kpd!Ia4Qvz50aTC;+%gKtXnLA^~N{i9UK&NbIy+?cFsiGgLxs?Xld-hK-^UE6vI?~b;0G7Yt`y4 zH+y=yJigV=?sR#+ho!SWmz)_{NHT9T&JlNJENhu%f{e`rNN2HwYfN&O^JH~)3iTrY zRXzZdTZ??u&J2MoW)|nv+Mrg9N1CIqTLVq8kUOwuo1CZy!79HV#p~b(gH8}*!!Q+% ztp1O?#P3ywTWA)xT}(SdmkAUB&Otnp40g5j+p`viIG`3tBSY3~?}361oG#LSHl@iI z1;R+{iu-ZZuM7}ETi3X%F_L>LhgB2p!>)7Q7Tk5(!9bVzvXbgA6|oL4KTvOEt7HuD z1YZ)ZWJRJ>r)u;mAbJ$OWGYcR%#j+sTL7W60+s?|o-wpRSIXSrKaMaJe3$C8Iir za$@(698u<<=On;Gr~c~sBdEnSPIAeGutQrVv0Ya<3GrZEg3nW~mUE>}%|hjD21aX( zzdU*cGax&!W3%H3yikJE4d-@WikHXLxj@W%3F5NVbt<< zDQUBz5^;fGFa3WPh?z=2UXjsi)(n!G^iP+|J*_;Jtj15&KGyaII@)FW${t&$g=OOV zpWfSabWRANa?f=1^oorB6D3OK20D4iLn2AE_SEg#%MBV!jXXpzxZ}8j>^ep_l}c^P z!=7p^MoUltJRvpV4ARqhl8j#x>oDYh8?gl+CxG&0Ae!rO>9% zl~*fGDgr%H?>+feC|r;JOO;$zLGaZ_!e15t9}wV337Hrp?3n4+=jc5{2Sv+b{1G{G zL9gE7M2Zo{A@W2bc8cR?9z_N7@UL;XAB*SunUfCJUl+EE4ir1!=lJjn%x7Ye7r3#R zeZtfUw}hUuhRHXXI}WCQ*P%Ywd0o8kX&`~30U@%K6N#*q_Hy(`Nmy7L;b3s|Y`6~^ zL$|=GD#FBZ2Im5zMj|aE;$(cJPUY_6It@x|*FFH6HceaNE6Gq20%Q`(XoF|#5>77` zu1fb{v9);U64QyK?q(Z3z9%$7XXRhj2#$g(V+P1Y% znvjf_SPqUB(CG=BQm-O2bvY?&M_UYgD za$;-P++_XvW0N2piwE1`8|cHzf;EEDN!UjiYQ^DsbQW^$3{lgm>`! zImUp?`I8W+U9A^Qvr`37qW1g+^j(fCdJ2Z?B|n0l(zyWPzkyDF1+r zJT_?syD{&R8WTg}l?HMvfVd3;z zMZelLspQNjL%Tsjuk}hnP+AF(<8Z!pbOdR%!pF6u*2sIt7Xkb9R~)?$@38mMb&qkw zH-2FH9|M41Hgy030tv*!R#wXAb$_bF#88)n|0YfqA|d}~@U^4OQv~MV@>+@49wrBb z3)~^9!qBwJ)%BLVn}J)ei>MYx1}Z{G`L;J47TxEThvcS9BqLc^m;5^sEukJUW$PZp z8;Z%5pDn1os=g}(e8=Xu+T$OEeh1?Nc|uh(g%4e%^)2fa3hOQKI5 zm~jZzSF4P(_dw{l(Vsa^hA8pMLIjA!oSi9qi@gumQO*ti(lG<(LgNN0e_pxaq-+Et z`usS4Yzi7Km5u*E{Vq8Deqv^wXs4;%fvMq9-FUFsRO+RG2%n=Yj9TPu9?Sc1!Rzy#q)|)->+Ht!%F(T!^ z>PjcISbXXkQsv1K=~I3>-n}2X!wZP4#S(&(*$J35tR*)EW@@iB*!r?}hykKEHKzrQ zH$Gm!o6JrLn2|IfnkW14mziqiH?aGdu~CU~(C36Kn;v;qT1cALoKM@Ho)K^bi3~gJ zRMCN)15s6W%lm)hre|eV-WZ#)=NPP}d8Wag9}lF=%vR^1$j0mo98fwn|Nb8(_)n7= z*`E89VTaw`M%SPr`-{l1=&_n+(uL$C)3}qW-(e z^-4`^>4koe4mpcl_Toi62wy$beYud=wP)mky1#0Mz>u8k;>GxYLU>@yFNNgK%Hq!d zx@qiy16NNkUqxRUw5u11BjrWn%J^*ZfVe3SR=-)|9R9e1oA@&$72WER7M`$gKMt2OH0$u5r%E*z-@PRHo2H~= zMNcT1cKCTj)YPnHp_WpK^eHK(@vg(ln|g0Umk}q`6DtRY_$eG>M1-l9$s)i~Ri*MT&rXXzmkUp#3873bk;e zN|tK`eKp~%+i=tA9)EDs0y9Ce&Kfv;=hBio*2;7#R7~$ZzZSr0VH006%CM|xf1d2m zwYo&${-Ze2wpeOyo%3g`#rW^{i`10I>_M+C&JEZi8rC>&`)@F)u9=}On?G|RLJYU#9fj&8R%#;q|46{U1JWKP+YN0KD z3bk;fY`hkcn|p@zzFfs{$+(L8?ra_FUcJE-i@2-{3$FN>ZfSb#0NmhD(=$c|mnoDM zYS#&pv&Bci z;Oa{2u)q24J_1od>KZZah$}xq{7R{mF$M5nIDtUSSFW-1MYEkaji&Iaigw+;^VJf? zk8^#ke8;RE4|Kl6Y&5PYXz$70=N=<@2g7~uvA(Eacc>`yAM&DjyhrPAZf~89Ctrjq z{M_JejGq!jF(6}St~;+DGR7ARc05GnzPHg0QHc||^8XIwBV5ytO*s9j=8B?LQa@+) zw64}-J2y^e-a>b16TGcu{dlcvzL5sl=>$~f@p095UaK$=@7egywVd-=vtwP(oVGXg zF|R5|kFrv#-5*6VBRT|#3%4`og;%r;f%46bxqvC((OtUc-I^hzQ}RW;*su6- z8e)rucIRjs%(_U8woZcVgsl6u1>Klz6Wa69C>tdFRn=ag}g_hLs*7_9` zE(pu&S9u~zs=orZyP zsn1V+P!g16ofAS)(L3porE|@T$p9A=YE^Pu`)A2e660>tp>jBFauHi!xb!*1t~9gs zKhCt*t7Rt9j6$u5aMtbL->KfP^*~@I)L4CN^6`?D*&=V!SuaFXTC*{pmEE`S>hN^{ z*evR$NOD}4Qx7z}5ubd|e8$4;@?=cD*US&c4$X83;d|YPP?CaWuyHOZDQ}O>c|qAS(u)oLtSHQe={l@8+qECSJ`xvjCwZvnxLC>My7K>2cZ3^& zRaR{&nGKPf#Y65Oc>jFDJVSSMRgcZg^k0^tXPf}H-3fd{#-S8WPUw$k9M@gx|Hs>z z<4dFzKuB!n;vaB_DO26xhWYE$b!XzRE|F4ttdW|U3_V|B%_lDyZC{{AHD#n=Sx&#^ zgGjWbfH`~DBA+hdq?K%$mmY4X`db(~w(V|F-4w6?J74cHT7m#`7$Jor9ifp)E7jg% zqW;2e1`Qr%Z-pyf!P-Y!n!V;jmdiS~y}Q3dpr0&Q&%{E2V@s-Nrnb)&ub**WH+5YO zQ_Gysr@1zAvme!HU}$bkG3dPHwR0ADIT@>G8j->?Q5$4zMeKP;h=;T$)LIUA{Jam$ zY8%(Cl)w)iV~cai!xrk8bHa`)Bx^PB+i1geZUZjoFENZT&v$$7weJ?uM)uL9_SFZy z_{$b3(TX=i`vaH>V1N5Gi{SovoZ9Zr>UDnys?OvWpL>NI59$yc8v`z{mjg1a`GW#J zlU5e$7KOe0Yg4@cRYkV(-cu`RO{}S5JN5T9w((3+m&7E={1?9BlL3)pug0?*3e;X* zA9yOObBCl}Q%s7$drlShY-n4g9~*^qlAcGH)r;9GGOUZTQ-Z=|-oiYYmdnv0>2WNm z04`4R@nIChm1eE>FC5gKs20oX{-6}638oYgI1}(?JOqBHT;W9Gyi}iYe@f}=@07?z zGCy5^#660&ZSJu>_<>raQSzgndvxLII!1?8iGUGbMvWc3_2CKKN@cj$>C~ITc-d@0 ze%7}sU`2NA^J^y6CY3-|_V+>WVI!YwPZ6e3D_ zvN(Kwk@e)f1zM5*8aCkG-rgeBHGQ9o}hOqYt}^Ckc@M-CYpjz&GkV)%^f?WR8mTIP#}lFlCa)lr0X zA`}2A#pHK6l%iJ9EJ+XA<>PA(kauxHOPCY;wro|*grMH&fs-Jm9SG!@}Q!kZ~PVvPH(C$Ux;uF|mVeFv!JkfgG2YV!>gX%hD zQTTP(!l>A7>fVVrGD>>w_OKQw5YR5_H*6(iRC~YPmD7t}*=N=b(bL?0`raVD`tLKc znkumQ_%vYn6%kG5&AR2v6U|*(_Q`{--wl;bOu;A{-YB8cSwgsyUK~Q^XCCGTnSHwn|%=NIa6Qs z`}gV_`9T_$5KP)vX7+#NY}1FfB#MWAmdCKU23TYENmJiXY4C}fvr^|qoWAY zv##Ilw*K24sM7jPaURHa!G`@So_V46rp}UglyH2b&)UB zqsQx8W#Lv)v&H>t9F3|_rF>uT$BjOkHjYINzu+FZGmyfNrAN7r@ORUA*7m-<)b+ML z_%ESj6U6NGh+a{mrgcRNCFNDa)NgU3)JUV%mbA=0UW|@|q)-^o4w8Im24fd7 z&x`RAa5!{Z>KqvsrLjTVL)n3~mvrqEtb&Z~|D-T3r)ghQ1-;;sdWQW77er-u&3>fU z0lNvq$*qff8(12N!?rL_fftwqCAp=k!JMCMr};LvhyKa!6Y0Dm;MT5Pduede%EKm# z=9|&l#_a90ZM*LfQ<{Y;8a9hx-KXSZtS(%zW*(TP!wuuh-r>%0svqGhxkZUlA+C!T zo45^ps)O_9#6b`?&Mg$eWX$SYcFTmv5QBW&97!nQmt%K0NFUcGLtp5=bn4lA4`9^gOXMHaCQ}a{y|rY7ooq(>Cy=EVif|Ag#C$kIKN8* zIi0KmJggm>@z!v3q#~s%PpR#Z!My810%O!DlDCviTfW)-R%*P1QxV?^gUg&AprF4(T_8buxGB9D`m`vx5(bo!_=0GyJgqXLI7f)kunBK zSDQ`(Kl`WEPvjz|Xqn(sF?<|hL$UEE<7{lb3V9U{=bqZuhmE*eauu$2(Ufo}W~?z{ z!E!{yg|i`}KBNMifT}4@IbkuV?Zk3uteAG&WY}~pafQ{|U5!tCJMGSeLASzr>$EGC zCE(DY<-eT!bnbJo0KR&5y1Y37ibApdt(y+$&s6n(NObp1l}0z!3HH!2 z8(++ci^MO7#=P5MmX8s9DyWY0_3!jK0{=v;O#moMB1YOcDv&~wJ!g?f+ZnKgri_$eNO&8jfl8VeX z{9>O7eexU$$XY<_haZz7zlUr!HyC8d;pffhz0E#s6s%Nqhay?=B^_5phwvtGJ>G1! zdrphEK86guLrSCRjM`)IB8i4LmmcPKm?P{!-mGxXDn$c|;^e~fEnR*aXLI72BVX@J z>bj5?u)`^;!8524354gU8v&b&Bb{{~o0hjnU`3Wur|(njqG0Zim}(L^hiu3|OTVaM^s!}{c-Uh-CW3CCxZEeV~+>OGq3 zqoAN5IWouBzAxe6(vw&#=AqsovBPIU2?i?i%gevfABmwV|JF^LrPpk`LwB|3SlQ&) zm7qGPhkP5W6ef5%7++~D&ivJ!!6xT()N7wc>2bC2(>+!hKAS)(0XU6TqDU-O-}(!moxTuI!Ihpwdz#=mmYEY^k7 z!@7dqSrj+8c_(fX8OFwVV&wW~XmQ2giDyKb+=VkkEkIh4Lk z>`dhDyzwyLvKxxW>`);P;(x2Z@x&Yzy)5*OGUJr~zJ7DJdheY1i5tmgB~_e=?qlAF z)U`UnZ|Bf{oI#M#?jB@CMm@Z3FLW)L(EGh@(2xK9UXv!Q0rsfSuD8o(hY|ceAN==& z#Lt1p%xRt@ir)@vK@&Gmc@ow#w`bL|eLa$R`_ikXwhdmA|Lsn2$o@|z$kO2zLi_rn z)8auZ&g#0T!Xn{^$Vdo`WmsYG z--r7zBLu!G91X@2U+`N_`=93U-xlak1N+Zg4^2S`;+iT;OOulSZ8d)BO>JQOZ^>%C z{(rs0vIhxRNgR)W4Y0qj{-5^Y ze-8~T(i;Bn*z*5wXbv2JFfN_MDoaZLs|@{$06?OG{rdbNz0`QM??PI4fL35ePhLK@ zM4M3AB9XpOsH8l>n3K5~0#FnEQ>_!>nL=a?41*?DFJGQSy=MFE?9^@|G_`V_|FBja z&&kP4`9eX){zQ_{n=;i_*A1v4tz)cgiO3l9$0K4!w{t`&=(Bx`W$rtpMPFEBN(oHv z!2xN7W!gtjbKTDY0qNrLbOkn~idm4^5{Xq(!8E!L%TJF&Hd{}kN{)l|)|**Ce;=o$ zP&*;heMZ#=SMY~wC;DVA8{fTdX`qZRkGGjk{vo{pSGN&`<2=r?cy}hBFP`3Tyz%db zK^6sAQ zcV~+EczJod4=cBZ$0p3?G3Jjhosu;V9xKX=l|oWkcmXyhoq6YUgW|VNdo`M~*E7Vs z<7*22&Lf=iwTcpaZ&^?LL;^w(H@I()L5=S%LE(9G&F5#zHG_k*TR>lod-?c5ZmAdV z`j~GO%}L*xbCxVZ9WnJ+xR}$?Ori%emh?b% zx4HXVWhRYtp=$se;UGp8JUON1c9;BW$4K5%f1yf0Xi41m#=iA2Dl9DQ1I8Y25_ETq zX* zEw$Q=jn*ON{$R`pjMon}tP$*rHfqjp{pT29hGJkJ^DK`(fA$~sBZCfN?{T|)sgQr} zIadob{yv{EIMNx9T6u3vP4U;w#76<#iynCk3mri3{Z#}0O%9H=2*biGec*7}vV0%* zETDJJXh@`i``om0!{ZtWFjaeZ@(?ZETr2c#jHPQ!=2BQqYW%cia4a8hfFQ=#zifov zZRbm0?61TAf7?4qc=*g2iFbg)V)5vc%M;XbFV$HQ z&KmkgEdz{7)|^w_d$+)lkR0EOy?irB)R`iUt?JMsmC8|ncwcn=J2-S65{Q{e#I2;=nX!DXL zlNyqKqU9l`<$e+DJQTlWJzsT6^m{{@KjwzdhyZMpaUB%hi$6a5KlnFG2*eMM%1D?` zH-_C9yuDvbHWA~X@@u@ zx>&jY@z7FfL4};*V1|HL%nLf0TDGnrRN9(a^ZEBhB!)$TgfY=&qtfK-;x;K!NQS=K zFoF%I0%EaFmLk-l-?J+-OU{0p9(NiS-iaSX{dK5vDHH!DdtKl4tV>#y@2{W#uZevC zp-SWwRAVm62Drj(2gHw&@KgDzdC*xhUkCa>ry3R#3JYoE$cqq-1_2>CP)DkCheoL? z4gtp|>+NFX-C*ZFhM;V}Hyeb{0rL{>M3JNK0caV{&>uyn(XT8OP>vbQs)S88g7Y9C zAgBu8Xx7u!GX^Ue9+C&NHwFg>ug96e@;W8eC;*!()|hZqXlczbbGBRz{hiYPV;XG- z#4D#ht&4==kG~Gu>M|kM`;vnML$M{BotwlTmhi;C=WB;c#X^;~ud;*42nZHR&p2HU zv4@g25X9fPs(9m29O(2_Y{=J1^EUDs<9+n~tpzO5i#ULV8;@BtfTmed_*>g@qdf-E zJ8vAV_MA!OU|%yuCX2-kuuP+gxx002R_iF>+<~s#gqspR2flJLv&jpAT!0deGky8| z&!XlfFW&YTX+w@%1|#vykjv`{)eGe2Y=T)UBpYs|S^?A#biKVZppj=Tc@@YLk$Pn= z(w?=@uC-(V<;j~GxO?B54lFh{WnIGGuJAc;)?ec4yUtpjf389HrsMGmu*BH&?xX@%ZQ9?HRBfIi* zdt|A;6{GR2bXg)X^t-34)+da;mZG$KpewwBOdZzn z^$vvU^?>PGwQW1ixsH(EHlp_+aM=CL>^=pJLna8NB_+@iB|@LC^BpMzh2Q;Ia ztWc37m#xDmdb5xQxE~D3&j=iwgDIV*m5YF<8oIOdDwwE~;R6bve1#s;s(8=4u1hB$ z>-S5pffl#80L1(5=kQ>$M2AwHr<>;OAGXVp7=SMK{V7xw$!u=EilsL`#8QdoQC;<1 zV;S{xk^$w^YAq2XSIkpOLr?Wd*jSUre9?Gyskkm#<)T(0lj{n`lj*B`FUFcT23Wfi z=(h(-TWGtP(vH}9R#-fRg9n7X805Pg%r3EGI6Z#Mk{dfcJ0i z4Ik`r4Q%BN1}>@~w`59&rhV?2bEy*KHx849I;+lxfv>(RvO;G)3EK*_`eOtFc|Z@G zDz_fV1O_K^yQ8_;gSth*q1~yx3wo)st4QK`9OAP$=X3YPnnC|`pPd_~Vp20zA@5e6 z9!x|;US?(WKu?4UySotc2i^}2=2O;Cx-F@pk8veht;6poy9&gQxGWl@r?7z5ykQ9p z=2^^<>cp`ca4^<8w#AY_3W==HdN1x7r(LP(x6D##eM+|n`fmF4$5NSanHKr^`N`bXm`yQ(`T4=&rH@K0VVX@_JA;9x zJS-h%%G#`HBVXYlW9vl?BoGCan`?S?ZuGwA`!G@?;o4#bQ?6&-jrj_D@ZI?5P4k86 za8z}nH$fC0w})5>Ebo)3O#DS>O4LQoQruLPZn#~pp5qCebUnY%z5;pk+76#BOUtsvJLgumT z!de)RH#f^@8tm0+Q2O`d6GXf3ems1f0Qn}6+c@Ouh9)p1Ap2Dpl+5xKTU?VhZie{1 z8}6r%z5@+z4K=wZt@i@qGPGYj7_hILv?{7aZZfm`LNr%Hhze^*Pw3Icn-saa{Chv# zn(tzZzM6UHB3UGpqIPiF?6wTpymFaiR zwC7fqC6S{E#^whMADD?AqSu92!VXyUgb`H^3cuIypMIZTuR92ZQZW%kPgEMm=RMh_ z&az|6z<_|)aH6*M_QYr>J`t=Sp*}tVxo@O|#ltYT78e;kbO)0%)0O^Mp6~CM^0L*B zgMkgrvdA4w4-)hyx;bS%rMouDBX8eJw8zQ9%caROB>1{2(0?(1WpsOw@+Ce&`uoU! z8$${RlMWlE*3rW0dT9X66m7W`G0l2+G6bD+1O+lxT<8}q`7S)UWIZ=2c%=$jdSyDo z9ztTN=`V1)QiX|m6-|rKUdG5f>e0p+8JUs5N-8bkK`IV)%_po;fGGWjnxNMG%g2eMOkUWD%cV{~)?1zJ& z-AK=b4C$A>NqsHlr!xEmi}|<%!8T#V&dL_Xn5+1TTT(KF#+H_2Bh$JFZ5J~5r|LLn zgWQjPN>1L45AGxx#^j8BL;G-kGcdE!LICd8HzYtW0UyfBF@Z?ghokp>Mtv<=!PpEc zMbcdTsWV~*3#Ri`aIlB-0&a2ZVJ`<_ZJk+QeiP=ujrO~S{%tz=1JH4)?`6R_PZ<(6 zk>N_zG3p}Ub#{=+fN@x=G#EhF2O2SG2($H#=pVqzaiy{>hw z++nSBLXweij{qHcF}++_C_Hw{JNE{wEnERXfdOsM(uI`C5*1D#t|%tQPd~=I(gp6w zv8t7k*Bj>e>5$7&{5@j$`r&TI#0fYplYdA+^t`bmob(kAhkMMhW|Qc~gP8PGp#J(L z`xV~UWwQ`zsRM4o>k1`mRE+Y}Pane_Qq)gZL&}aJBiF(+Nk%5}&tmOv<>0z?gW7QJ z`Z|Xca2k)fhMzgDY-7-J)#LZzaU8Dl4ELk-OP{@992|Dd$0p${?XMFx>YN#To+Z_F zVNE<-709YfbHH`2I%B@XM>3*80H?E|D^GqT1%9?MRgzPgl)|JQ+hY})`muL#1GtkW z6WD8+cke*#K8$(xM^O^rwYVK27SA{M;evBV?}fm@$=BW{vgxufwLcs{vb{6>V)%xD zF7O-DtFF7PcNfO;ueLNqYc{m*<7X@G(m2d*#bIXW<^u62?vC4CoE1d(n6JD129I`W2#^xRmSQ;ru^FN zrIoS$Sofkh?!lh}e>3zCe(e=Y?Q4eozWG?j(O>Hv*_?Nq)VIjUShY{T?m#0Ghp4p8 z^x%IznXISy!iz?$BWg*c4VXRB2L|1AOpbKhVYlOQ78@j}pF@r(Y4Zxke%sgXDuPg;J%*EO!s-*q zP{b%J@A1^}_Mt}jb=FhXH+hj`9Dk4&ocucR4%a7b>t9U`C@IjKa;mmBbvZ~DNCg9snKlULq* zi4Is%KLL9oYL17T#9rJkj5n;x5zxykTPr@Q3ZP%2mb&y~Qls~32Y9*{AwpybttJ|H zhx(&PVo8#bF#K3tA}ZtN8s`%A$t1xfW2mzG*s{Rhew{VGjZP+cs*qUfj`xYG(7OZ2IZb!&pJOf{?=|O#Ol=J$ocmXI{nu-D*k}n@Hf* zbJnqT&lj88zh1FHFc_ny)HHlZ2RY~ejOBXjn8SukJDoZnJ5B=uu4=RqEG{k{rO+Qs z{hD6&6qIOS#w>CT**$MP12Tb9p~-(-BBzDR^`2kv+a#EHLgdSZr1IEIpJo`kf{hDdt-=SEZ3YdNLO$2Bx7wiCB8G9 zTKx3ohN9gut5vaurr1bAj z&I9PtN;2NvxaEoYZGMqcwOLgg8roGtdmes5cc&ZCi#ydIg2PIbQ51GxD6+UK-z=*F z?8%t-&3aXY2em5I9Xuk2cOc3zjRy1aUZH)W@Mg-lgr<~fzj$>4lSOSfT`u52DI zJmayl9Cc~}It6kJ(v27Q-aqUt{sb7ynk^3o_ngah7EFiBDWy0E{wj5-!?%4RQ3T!q zjuhb|2YPPLv4;aiwyor8NB-Oj42tLaqW%zk1=3upQJ*JMuUt}FQW*GBt~z_9=&7{n z$W`ejSfz@Gyu7jaHw9P~YFI3AU9uIwP5|3hDuv5N1A^j|)RQe)9r!IhzQMXa4V_&9 zVdiNlij^*oj+R!$d`l~)N(L(k9FF5)`Anmq0tCJOI4+pp+h!HNkLJ!JEd;~Qbuzl; z$t?vYY{6kY3MOuyM~eD>?%*KC*x$tIBz}|{?($Nn|LDVwbV!6kRF4-Eg6P2RZxDWY+63&AhK6-IXz8)t$w)f0fA!6iszEsA?D)Ztt15@*41HTzK(Xg zS5?!CSuc9WQT(mA5x(m@25o1*%VZbU{D6`ho28vdM!YsoX5-MO=gS0L#!vM>J_Wx{ ze+d^cAwE#tCp=_mwSA4@L}yMQ90EE!NVTA}*KG$=kjscm`ys6R1unEz*_%*_LvE;? z2_16F6ed*<=Us*dkt=gJ{3I?5R=1M_3x>;FZllF%d<+0LOri1y-%E?Ab}f|8luw}P zD<$by>YsKJi7sRB&t-URdLij!wW^K_HgbkiMQe*J4Ntg0aKlC`+>0Sc&UW$fUs^u~ zAn6Wz_swA4Gw`>dIec-95)(JYE}koss}9GC^f)nm%_c}s4Ew6Rf%%AIbSYT>&#?FB z9RCJCzQgKOke&Xw`O3#p{&+3(s!LxqYs@J$TJ59^o~u?m)yCP+tLWjL$`$0?Ii|YFHUxIlt4wtqub?sK(L}6I+!w9rOEgW{~7YnU#HW;2Yml2 zs+<8glshqA!Utlyd#kX8MTqv(mFWJP+&!1s**;!_g5iDoEeL^_l3B_T_R7#`#it~v zlVZi-yeh4+s)GK9&5-7({Qe;SouPw$7{4IN4%Jp=V71^|bv{)o1>~YDb^BoR7lMuN z%8#qA7Ofi6Xhy@&V6)h(av<9zkVjDom?cccV35}r6b40N=brMhh0BaFm>tsfAM8j5 z@5*NzqYQkw@D=zu>c8W(zxwUo01#h?wh60f&3eu}t*hGgsIY-)^Jw14y_)^kDYtKn z+d2WU8{1rjn94kX^^kI4wzjrS3sSNun5WlG7xm<34O+7-({tpHN@8@BvJ$lXG3bpuf{L0AqLU2b`svQCym@6vckStIFq=HbiKK zJ(E~Q2i1D}`nts*DUI#kpz20cGVGd96{(E-su90=V@S+Ao&VK<+=qm_SC{CqXKnnw zj`2D8z|2ImU;Ak@i`6ATGBP)g8e$0PY$-2_X0LnGQ3AfAp<43hsJ$(pj4_Tv

    0$tn^+&am${V`pFs2 zn4-jG&yzD&WNJ|V7oxRn0nTXg4v7Yk8Nc|MIwY%&+~^o!a%5 zgnEmk=f)9r+9|0+bWX&2N9L)$XB~~l5zU_OyoF?Pyn+{t#RdldP>PICBweqpJIx5| zt1?rcs#ae8+Q#qP@2a`%FRtQ5Rgp1iyfRuAQ8VC^DVxGb94sso{)Wl9D!6sS@X_(M zb5y&M?e8S90@!X_y2*Yaud(xk#WAACBIi*BMlPfAAv%qB`;DO;W3c($u#6v%xGmGW zU2pf9w%tuVrCbY~yTQJ^2bC|&L0z7JUc7hQG0#c$6Wkq{v%1Ox4sRLLZXrs<1z(d8 z^X(4YkFqGc>lm~#rc6BaS4G2=vVX{Nqu3>J%)sjX^_xT(hbi)cveQctTa$PxY1gaR zxej5*cq-5MQM$OJRLhmtxKXB#8Q`cozIYElG=fllR#SVXsvK||alGBLe|Cg*u|t#J z2d%L%OzqjSw^{6I{wy&J0E0k4Op3GSme7?M0$)o~xp(-YyIS0*88q~$O@QccOlIuu zY3a8+EI`5^qty?kwE~UZ&hS(VmR5I;+PU~xr{7d56b!xyQV59Jc3I9w;}ss`+6g~| zGfaN&+1{?@tMoLI(@=B9GjMGb=Nz-X0LK%6z1&m3!r7ZZE(!*@Ye(Y+i(aFGd6{?X zruGu@{}yQF?m=neQCaE=D!t0y?MsDP5qZf^+cqZgnM?e|ir1dRv(Bq`Z9cnZThgjiO*J%MNWpZs4@#6RoZU&xEOWM*HbwiR=hYv)E%cp5c@k`$@%-B>Nc zxE)S8gXLcRQNsVY4EfziV|89~g@BJqCV_s=&i9&yf10F{#lvRKnhFnX-z_?y-P(e7 zZbC0_Ascrx7k&g?HuLtgGa|p=^h`T@*bn1muIY9L#-H%c-OiZE%kNhezM^r8-%JuNh)sMS1*OLPT z5;uQ(Ke+f~&F5>9Xc|vX_G5y%N9HaQ(9wWz{N}?orcolZPdwP1La^bJIGfn3;BdH? z7t^gfSMiT$k&wAMUZ(^Rvk#gShx zxr{DQNP2*g;ndV9li9`v1$Lm=nN6w{Xv zl>-1_cOtdnQp`Q^dio!_0hFIMa-TOu4DX!(_- z?(9{O&2&6B9mtn1_`|=s52qMN{(YP=TEk0Yl|8dt7m<+DR%vc{i|gNmRPpen9(@)P ziex;m8Y=`q(lYpte&e>|8wN5azyHdd^Nsw%-+Hq`*m*Md;XAipCcM^2-H$V3v&gUq z+6K%OnNPZjJZ5h?x5x6r&yN}~Z+eZm#-$eDR5ARm{4eTTY5q7=hq$Fb-147)1719D z7KOXU3;TU%t8soYmZUcU!wV$9eE1<}-+lV88*#JmKL5QDkc50uEwu8q(7$N7Pk??h zxS{uPs$J2yIeA?_YU^`1*8igtu z*Yj1#$Go_G(a@k6hb23CXgs+nCU_BZuL?no(B$_R@pY1a52MRTg1kg+U{a34<-5DjEwY-&xH>!J;Q_Or z(T;h6{;N2n^ulGWygI8i?HBDouNW;aqDol1j)-xC%cJYtb)rD^UO>(|pYF=jFL(NSD;}o(uei>XOIMs@ zq?p7}Zp6iUzw`)7wdxBDg@-$E6`~K_c|SWTAVnq5ZG{zuoZ8=k7SQr29dpy3U-2pC zY62*Y`uU?y&vE)-2597mw4D+D6+8^Z)^lyvt6E6&)v%+6_scdz$LCXzWA+WpPw3qO z_en7+qcueg!(oX_vHs3MHtK^1GMDr^z10bO7>P9YChpxolSsmMR@=D>V269D#rkLE zQ}jkR2PBj3q|0&@&e%d!Z4K`oe;RznfhbJ$*R3x7uJ?pFH?8~y>Y_!l=zxc#4v}Ke zRb=qU)@-sr#dZfxkyYKJD zOS@mj_jGSB2w3}dz*(xy=+u_H+-}8_Fj52USe=rQ5tS0s5}kBmw4%uL-Mo1wvC+D! zlxEVGa^?4HlPKwM+^LV9e0rMViu2{(dZxi5YjMd5mOk7Cz)a}0=2D}pyf z7aa|@>oYJpq6`}XOFvFjek&U0?@qu6_E)O3b7H%*hHOz)-+r#S)zdzdmw9cB#!-;2 zCXO8PaHv%IA5}J_XK7ovdG=Q1OVMYVz*T#Swy2g3N={(1(|VpZPCikMnVb@h!>1(r zxCX6iQC!v4xb@Im>0YSX&m+u}PQ862;cncHmSJ^(KF!z1aDrQl2|~=SlsV=4SrXmT z#rp-G#ZqMFF9dEZAWmh>0Gh}O=x^FWpZc?ttm%n&^D=qjH>I@dch+Sh$`e(e7B|R? zrDVw#*RDrdYufw0Cw^LfbxRmd0vI{+bMquYI>fk5VI%Jo$YAm8-nS?_R1L~WX+1fs zlA+!3Xv&Kt1{rwlV{xeXHTyMj_-#Nq8P2f2utm>CI9^n#O7fFJpOT8R$vu)evErI_ zMKRp2G4XNh)9#rR-Yb_?q;%?jEXeyg5r2=+sn85K75ofV2$989T|&v~F|hEENICw@ zxek^qB~6z`D%{Z%3{)9{)xRW*;#Ah~nLXc`-!tVZr(IyuFKje`xtO(Dc^qviZ{RLZ_QnKK18ip7T8?_z zU@r*pbEb%9^jg)v)##>f0G4AVuVTMYr&^?51H8faO*PLPtnG7k`!np$I*vJWS;$==-4TWV#Sc^iJhBz%@I{zbHnyFeb2N&RI8B-iz#( zOuhVGVkFpJbmk#S(!B?!^HVf&Ak`X+MA6PUgB~O@D>*3ln#s>i)l6%ex%-Geya~+w zY)zyjRJtShx2jtc@!m&Sziu z^Q9&|sHpmw*zPZ?ys9%{q)`G{ubZJ`Bx2K4_hV|VWLMltbKdH?`&he|4}usqND6$Vb~Te=*-c7!Wmn}$_yesxcLiU5I_5_+1%D}s$Z|Vn@*TB{)w)^UU}T& zbK3f%9Xk)@_C&2{bjDgP^)$0g0-MHc;4VSGdyYcj)PY?b2fH2jNMgSYqQ{rJ4_sVRxXHh( z=!VlLeV`GL@5$42Iu0|FH#AKf4X-H3Z2#>|XjBrW0662Tq0P2XI%W!c&fD z8K;y<$FzSv$cLA8l1~q?lDnj1rr+^k8W#TafryWXv@fj`)6-g^r}Cq1o?&#~VdRF; zzvy2a_R=4+Y}0)*yd+*O__EdpO|O-O;#ZCz#d!(eK0a;tCw^R)I)q%JnVn~VG#*&H z0ug7&PVJ4tE01l7QQWc?n;LREZnxPY?b^2yMqSjLGx|PlFEDQo=0ajdp*~l@7soCw zu$L%88gN&wh?$fwaiQZ^)|(}>8Is+W9#yG86pVHr5x>(O^Mh0SeT!d0g}{3)DYiQq zse?OwDvh1=R^LYHQz=q(9~--@$i4+!1?Z^d$nlE@XQi zGxK?0BgI5_asfY{5`(_6_CHeskcx}l)a zq@*h`MO)tAR@kvkhJ{2E;6#zCzS|8Q9?V5V_XKGom!2r{y?=-=@_*#B?= zpam=%j`3X`Q=T&^41t$695fpbYWwbKa0 z(^44QzP16KVb9K*IQ@NBB$NH=Z94|;O5am@V|et*9&t3?y<(YCcHItB4b!ZD``~32 zvvgx?*MCE(fI0=@p+V5M7I3dc+d3g#)cE%eS$pvVqnv77W``3;##`*Ii}!cDQ-Nn z*E2MXn{@3G=s2+TXYSw#{T0K}k|f)lo}Lb14ba+`WXw%LKE>ymp4#50$GQZjyh{M6 z_&%^bT;5;#TxQQ zKkdi>N;-Wuef4MLJ-)`X>1r&dH|R3MKa>VwQ0{9}F3chQS}b&e0_-)P3wYI$wipMlqK)(PwL1sgs(&l4I5PoZHCT*w7=8NxCW z2IeaU7wh5Jb<}ukp zDAb^h-IH{0u7unrA{t}LfM|_El18IOC@Hr7Tpf`l2N$_AZ(e}DV%`MrJy`a{Qg@K8 z_OLfG>`unJGl`JC>1b8ui{)#AC)!#t;?@i;)?>{R+^PP4={c0S^$=XNL-x}BBSUlP zgGy;*ZjAt(K|@(a<%>&1qnKCQ$(&c90m=tA9u(`5)i~WItr>fjFSKh?1R_eA8cLSy z`4)!H>sp+XFo(pTLDI1$lSmL!FJ3RG^cHvz4k%sXEqs5zjn$v-^X14q0SeOU3;=}rc=XHdjkEd^<8PR7j!5|TT^(4S;-^^i9^ zq#Xv*27I+~L7v}Nk{+a-ZInfiU!=dr7+;goWmMT)Mq1OCft(&$nf+cfOz++1D_Ivh z^e{iZrqT_XTfoQrv-FV5H8*ykWOTA8YCSNp@pQ}jT4)kf(o z{#lMlV$>$>Evh}AC+PZb82eE2Ej#*g>-90}9+n|twNwGlie|bxbk(VuNPL&j`hzYX zc2^w6$N{iu4i<-X2_yHon)D(m%BPhJMKsWMBG5+;ymy-vy;BVwn9V-6FT`%(>=~(2r+*XLU}+ zS`Z23?w{j8b=_=ejSiWtaQ;M+A#4@SrW~NNiWNDs$nX3VHvpSbN&giKy`Q~%PtM@h@L`f57clo?UI=V*_Eb-_Zzhf;!P6P|?lx(dKFx-yRjmIc ztx@l)zBYMxVqK)kZHY^#ylM_s9;IcfdP*B^uZ2a}CO$Zp)U}Q5zapDP+-)GZyJ=yp z(ob(3LS1HpYfV~AmZv}g*7!p($JoU3W? z;^^xjGKpJW_rHq^I5I8;61$T6 z&+CU~cFkdap;vmdySnrr-{Ri8)Nnf7n%rd<9@(Z;JAwHI%&8+h4*Gh3C1}Gj6coZh z8Ww$-pc|k=YIn3tOjHO!O+tS+z>TB#VD)*|rsvAi=x;=aY7IQNp{68Bves(u1PWIr z9m{69yw^f~;;2bG`&b{rk?7y~;YgCO|Ao@kl-LdXF#4U3$}0_$-eYJ7nf<&$RHDFj zE0GF1wuwYF77tir<`c z$$byfX(eS#FS@Z~ei;XQ(zjAE6J8)D^}P46Rc+cRJcpy{A3K@sEWPQ!oYDa~`_bq8 zD}>eO!C@(4JaMS7s~G(PvDJJj25IRJ5YqRei>SbI<$WaPy?2c{inb-NAmRh4~w#) zpbNl6U?c@h@CgfiXz}=CBt*-AU#A0i{FAO9R#sT7C2OcB_qpx1%&w1eS8BZFQ%Mi~ zEcKCLCo zgWrnW3`rhiwu)qAH6mrx_Ac8=gWeWllS(vmvU8Nh+){ItEwFq8DW~VhRsaDpSiz?$ zRjCiIQv3#Cw%bCL%xx`ruXkuLlUNj5PdHZ@Zc?^<0UW@CWk#c$SJ&B5Z!47-eo(*L zr*mHnt@tK3by_mM-{nNikAB2u5N<90e4@hh{)nP)Zvg|{>=G4tZ})a;6jp;~wkw)& zQa6Gq45Q}RhgZB{Ady)fuvL;ThUIk7%qH_u1<8?v8`mghQSmpbcNu3>$hUx~+g(ic zTW`{v0IaSVxP#}0EjylVhc0-|b?Ik0^Wv9DwSNA7`_A^Z4M`3ii~9+roZNaATbt3K_nOlqJa_b}jvWepjB8 zm&7fX2vpatjn{edHtqdtH7U$q`Wi8jWGYQR3ye^^-DaU)6AkUhyqnq@N1WS1~xDc`{S(Sw%w9P{7bh zS9D*qOi($%jn}j*aT@){mVcSC;Ty_&K5@qSmr%|?YA$o#Ml9{OL`w3K!rOdTWKH+F z>LADpDvP%?#Ve&b6je6drc7?zwwir)KMGnK{gLM1u(j7~U5f4($iwgL6liR6?%_S9 z(l>e&j`qvdbiT}sz#~^OSZ@;(i%j8k`E{q9MsMJHKI%R@yNG^zu8Z}0fgs|Zc74=@Z14usGTd< z2YXD2jZ`#pn?DPzk#ZZHuk)8@o%{_r#LlkZ8$7WzUcNQyvR-FC(x1;Ufq>m#KqXIT z++WJvd*0XQh?6~88`p6vl0I6QnPhMJTpio?i~G{0(0E)&^jyQIP=jFEV&Uh;Rd@dI zrJaanhL=9;+VmP#G+R~rIk?0vTfDzC9Y3R8aH^!KT$L$fN5U^VoOZCRig&-0rtHfJ zSuu>vWO#f!#O?1@j+H1p4tWy5x#8uYD0lMg3kwrqj3cyBE?QyQsC#Q+JDQ@a`;sxE zH7dpGkF!^_>^`eHI1` zK|o}o&3=DE7*-A``yM5v_mpoO;QIKRB6unFkDR|CQbOl-*?jz*a9eih^)CxyGFP&P zf{JIh4wqBaqO7XJqO5at>=fgn)hC9scPz3_>qGgeqoRuQMe5QTS;qasDpgnB-s+dZ zSj@Rw*d6R)3Sf+G+X*Rt%qc@+rjC32N8yAD)#_2B3>M-v-u^@y{`0Y7h5+?-+SwAg zr^+7B@s*qb-w;i+!T}p>)O^RR#IMLFlJE)*oS8rK5eN1Ug@6t^w;Xnw4`87s1}j=A z+Indxw5*-e(P_i-M>h4%e54r!F~H1+(12uHZYb-FIQuQL9J&L}-iY$!sylPY$8~z7 zHQ6}7LtDF(BafWYso+iby+`K!mJB-}4Zn`lk4?e5++G^BnOF&aRZ}%N;RcfhSzLn6 z$C=}UHax1CeP%8q1h8iECtF1P$|C(^00bHYCeJ6x1hfPo2j&l$UnjIslW%R)SedB) z{CzpW_r_dIpR-@rl$T`eoger^5%jjh;i9mkkzCk=E?bE6Ks}CK@vE|_^4&riq`nGY zYT9inW_l~e8!2&7YwsK_??SyR7wfnCjy+DxcZQC9{Z1bDm8hYInn%%6hGn3z9gUQZ z`^(lO{B{}8=hBUlQGuYYwcnqi({$(95Qxtb*igg39wTU&fg)YVZGe5b)5IP$C(Xm<5K2cBBAw_{ z;Qzzz)$Ue~Pa#j=d3m%mK*!s4;wd~dTC~~P*Ol9z^1YCWwLq(M(by1*p$Vee&KAu}6V>O2 zT;;AWRIKG&%6xBZU+<{EY^`J>4eoAb`>)9+k??%ShNyL+g=I{?o6|;Kk&TC%(VEg~ zTV9mU9ojrTDt6ifc1S|{F&--c=dR*H9EqPsZ+Ml)r`l80n|qgX9^Zv}NaGXlBFYtl zjfmKfC*{9BBQxRx`>vLVppV{6*_rbR zIU&CCW7Q4;j`i4+t$Y@XzXcZp$ETW~O|WMxR{13~ba&{&x*bg2J{6%xP+GOKA6T z-SxF>UpbRUCxvz_L7Tkr(ZxZ=HtR?(ioZPv(u9{vw=Sk;|4a8T(aiGk+LpE_RHX2F zmT4zp-f*hVdxtM~h*=MKAFlVyOc=6ZqZCpqmi<#l(V55GJ8s{1KRrd1IV$Yy5A3Ou zN_=b=0+^TcVCcQS)X1&dU_s@&yojb>!6H%l50+kg6&TeR>2#WtbqZi|1U_ettUE4O z#`=hs75PG6oB6m5uIdc*+RF}+ku;RB@-6wCvqk`x_!p-V4f4cM49At32a9QJ+D3G` zhG3Ris&-zomSXLg4Fp?`F}pq{{_14r+N;beT$n)j=U?!mMmHm6<~y0a{ZvN7P(C%1 z_YhA{Qe4b@-l9O&`8RdWJJLCy0Ei4os7lZz{C)XLdOzkvBuCd=%|?aeE%i()lLt4& zA*>_wWu0~@>I?21H7P~+Z<&!c7*?A^8mmLQc*n5@R!JUjENJEbDA33uQ_BpNvjto#+Zt-X{O{ ztqz3`i_f8<1>*U43YZv+t_#z~-}XJxE~ZD$-N(sEubi~FUd=&2IHp3wqqAhoN#=BN;I&*JWk~4u_G1aW1$oAlbvLO5eLrPof*{~ zNTr|p;lpwc=H`ewCH{Exkez5^`RF7_vC4*IjbPk=0)#{WYLEoXb@d*r7s9A<-4{=X z)}saQZ6Bb|rZQIJ&G2>*^O^vF{Q`qMc%vPhaP{yYG5SG`rTWXfpLeD24StWte$m}a z*pwpKW({-nRO&J+?1yHUvtNmP2Ljzlf2{P-!2d__mX{^%G9Q!4E;ni}yP}AT!!<38 z{K(xR_&*&*_jtj_|G|uhk})4o)3t2>6$XOc%yy(FTNCIKf0GIIrr8}jMw#px$Vyq) z(P3zGC!I3h5wghM3`fL!wmbTmc3In++{nm2%2VHZA6nygD!~xFOf%lcsKxz9rkGg0 zRJH%oc6dgz+I?j00oVgTc!1|~F2u0-b zfxeNe-5oI_tn6Fs@sr;C`asI?;^23YGVT0SW4z4Tm(I*}9ytGJ+fwLUUF>T`6}C*| z(_ovnX$^iUTG5rJXt5 zt0u7Px?u`CfT=fVjFz+2)_;B!zrLj9?iqg<4S)hAtdBH)<^13api8RPzsXUM8}OOb zb|*O(k`aDIH4vw~7;hfT+O)Ggc_8R}xN>)YB-l6UuxAimXG_8_qEs)NNOc)}Q6a!a zZ4=LvcMZ^|%qB^v`t6N3P&Jg+Nge*d%Dr2lO~CWDEM}r6JvUJumi~mkJ#c2h0lO_oEr3Wbo}-qzG3R&^Sj`D}z6Fu;XOk-?A}fXv)j>v{E^<6LL;Q zpU>2{6OBzw9@o{^i*x7rYMdm+q#c#+FW81~MS8a5A~$+a@N#&A-^r%@VT*0oxeVs~ zH4s?t^)(q8ndHe=Z7e3vIY97c(%(l5styZYas@Om|I*S>!x~PHaEI8yklitXs+6L_3C`7bOBwUmffL;{%P$s{1{(`Y*lQnb~)xtMq#ql zJtWu-s?DOnyo_m?c{{Hw_m?00JEH{HJ*nL-ZD1{L_S^*~>JXC!z&YY>YAmcq)=pb* zrD>gcC+E71-x!(y<2_`5PE!80nE$Yq#+tQXuaeaismTrFo|H$i1KUX%@={56q~8LN zEIeo?u0Ar8D^n1TiYr5u`sRC<`f`&v68KdE@-^;hSR}v-)J?L#fW%|(H7z=Ma(_;F z8Zs>Xl3JR!d*a%J@wy=Hd)0dz%lZpo!A0@BtZ+i(FYtN3f0<>@{$(-m(B2|d%pC?R z#y~HvvqoCUTGPpqXT!+RbWs~0tY{jp4jvuWzx#!HpfYh$doaAP?R^mhV@kfd*)WoO zT>qkT@Va?GR6$#wAi5|mzmsNG*}}hLsOy6hHuTWxzOhd5xZsK_&rAho8D35F9UsaZ z@-bqQFYC=1NAoqG*2db{5m46)2A_4ZNC#&NN9q79h@@64& zpRW3fW4Wj>+EUs4w#iML5(PjYMj;E+0d1Trk~(SLAdY=AJqvZvPD#(*c1e}VU2hvA91gujHwCpspur%YZKfeVRuO9#Jv3nvexG6dw2jC1 z`F?2a7yR3eCE(3t zMtQ23{PCFEODO&HDExXAPK+z?WLbC@DY7mvguXDCCA+XQ`FQ6*65i!tsv42F@tyS& z!fn1Hi_s;>i_{5#Zpl^1EphvvTh($swhsxc-82a}Z#s@_SVIQ-t>N+L#eY-$3Ju(= z!C^Ww?z*zgt)vIfe_wF5;QX0OQ>^4YQ$+TNk&dOlM~_UR;r9+5>2RViL!fVPWp7HB z+2Cb&hMj;y#(sX~0Jx4Nd_hG;pY4OuJ9o!K!I(|E@&*;$%*IS58#Tn)PE*OdBGEvN zX=f(C8EPt#uk6Cg?oKAdO67}|f%|JUFX(eBj;QHFm zgg@e8ir`DL@|{G2&j|cBOgA5f6Bm}J&0yqVZ%XGuKQZbqUE|vpf72Ap>F6VQ>T}^Q zJ+I@t@Q#}RSB2)k2VHnRI6q(umGe;}tC5@!^zHSndR3`byZ}f_1Q-9v*y3f8pMR|= zH*5w~ET)hPj%d)%erxyid)OD#SN@AW_;s*5jF9LN^eisjbUN?rbe6~-U?TT~A$UhbJ^Xv2)H&If+R!r4?kSM-LH0~s9iq`c!gnJs%S^@EEr|`(g zrQ&AR^+S-JYAn4x@wCVn!+5xU?(Zru1J+37l0lXpce6U3)ePPBU&~;MErVdTz15jP z9+=Y<2Y3(Bm+e@M*(unyKRg!c9PJ!K-@L4x;U+ZT!@wE?aGKWYsrs;ru#(0TF(1-vXcxm`ZydyrLQj^M!7Y>df8>7VEjUs)&Z0N?Xi8z*-H&hRj2)F zz1~$7MORlmYG|FAs-x<}`+C`1W9eo^f{icdV$EKXTTb!MnOtkQy&CRotXunZllkzM zL1xuf@2_B*S;bp`w!!?AsbHg5ItG2bly=8MsiXh(*~wuQAub#J0d(Q|w+VQPLTg*1 z#_dM0FMtgEt91;vqGp|rA&##})`zW$dvb3sS=*=0RFhgalWeT^fYiEC(|-g*mqlf0 zs!g0+(FU3)V>)m5&y;+WY>I2R;0toNZ7_)VY+RJHQ|+mu>M9RjrFGf07I5xhL_HKmV%c9?j{FG>CDGZ39&Qx%sey60a3=L zS9PU$!)@?I(u0?6@2KUzpl=YTbk1&AtHxd@%pAn{CV91Z`WfLFATm*)3$Y4GE8y)I zp50qkULG7xe$h}?d7%+w+WyjkMQ*V?afT#@eT9Jhij5ZR!;|iTMVSlcMIaqq6^;Xj za}BcP(z$5O?Jn7H8O&<%szhuEHDguYuEdd#A^!6 z--S(9ZafO8uT0)Mv;a!?{I^Q{+NTcpCao;|y1>D1xkQt-B3={JEw`}uvt?M!C$0uJy9tPx_&+Q5i z@_y#?j!vw!^cS1tOGKorN2a}5v0wO6c8z3haih-3=Fw;=1Hp&0=?X6;unqgl2O8~* z?zLat2TCr3_ZU`AO*#p0laCUDGPQf{CUqYc2!RcGJ2E#I|S;51qt zW=-PT2h~rz9VV}o`-evzImZhxyLgo&vLdJ)OyUh2ib+vn z;yd-LYAgrLml$5x`>Wu2%h6%=G**_Ir}SElsl^wumMP=tt>aX_GQXL|8?WV$pTDm1 zJFp$^bMWiIX=RCW5HDoOhC3wUmM$t3j?CvdwN$s5l&2)8Qjfm2EUx+C5aY_YjxZ%i z72^t5_Z&KDtPq0>b@2#;t~rcl{<%!X@wJD?6502|ORQ>8Z~vYocn`V`PK6Y!*8c=H2v0ONk89a)pUAU-rIM)vjS*O9Qe|Mgbl;p<<-} z14e4ll}W(VUvkNoqpjKynf72;3OFIJe8i#eSsHDbl!eFBD7Yz0c%oZ6@7PT1wcfsX zc6d`N!jA`QsiRwEuVq%S;Y-X5yLGn3r8wqa_pYoek(tt#eZaKPE6QONOf*+- z>JwgiQE&BLyfY8>6T}kjdj)D(P!dDJp@AQTubzcnMw0zI>!;% z;4=$XT%mJ!bxdz0qB4Dy>ki*8>4e*>yni0u z+Wch1Iz<=>?y2>W+Zjuj_IEyCk^pLBT+u4XW&&LOKQ2G>iyISt4_a<(=jG)MOpiUh zHUDY+hlbxe?LR055V_p_vxv0RPW4{RJ$^;#9~p^9Qmrs%8ST7j<(A*(>llieulF{* z@t?<^|Ii5jK-JfB?Odw^Bp^IU2VjZwOY-~IKK?_j{PXKyEQ<@BFjj0DoY?w@HMt4j ztK(&xllDqHTmHJ=EdY)w0CE<HNvRLe_xvJ1F+=;ydqwRWttO z=E0O{m*dlfx|k<_=`N=38vlMUDoVX#hBpTkHE8-*yI4n*hgzSb9DtR4wi&KUj>fsbP(HQM;oVRoGUOizHKp2>&A$dI(_l zkVLPz=Bw5HeBMuWZXNQY(u@o?j`0uUhRf^xd&!+Py&n{|g@=Aqdye&fkiS)Qk%S+o zm1FLaliZv5V2^QD4%lsCi3gJ~Bm;;8s{L7qTt#ymxa%Uky1K;>F*M^mSESEtR*Jp*VN(DGNe9;*Vz!IUp%pr>N9!b8X_1A5H3a_qiXrAJe5Wz#VFy)h^nPg{qNW&Hh z0D(a}8ETlX>R%C1v9&vU!V@JL;8ZF++`}wH5|9e8qmb|LRW*3;0OeFwc6Ux|*}u!^ zNHk>*X5V@BADqv^fWLL?Z2NLrUv(0|^V#ZzU;&?NrTx=9^V_Y*5Ma|833fN(x#1EM zX!>U_PMY=<@)8+UhqQ#00k{#Mrsh0(UE|tVRi_e5yRj)@NQ`0nn!;GhW>jBa4LqK@;2^?ph;OF&-6Q9So^Zm#q4g2~~ zl>TQtCHa$-x6~r#)+c|t;sHS~=n$T0bVqd6wu9)X6rk+OP+?w%7D@Ey z|73s8K+w$E+)7DF@fv@5`t}mu6`)2;@Rc?S=E{~?k4-8iMx z{C&*`fBqA%3fZh(#u=~DjUiuH4WWjw!J~b^MyX!Nc!p7^3b$+TZ=;e03lx-&aSu7Y zzw-r;k$HYbGz@^T7jB(2!kviSnD6t4c@}(KdKPhW|52hd_W*Qn zp5Edg(*>B-)c>-NVz3Z4-*evOkZ`&?YB^KwX>iW5{*Ai$FaZnZT=7HtI*U<452>iB zxh;tkqkC&!|Ke?EtOD60;eZwR=kdQnLEsYLH_lDNc_P36kmlbuQ}djDIll>T=l_0` zq&rCJ-%p&s_OFNkf0yT+#rcc>2Y>uOkDllDuj2ggFI}#a))W>BAfnZ2NS~~Hnql~- zdaqu%;Qb7^RXQrvq$7Bq{jG}>tnB20V=W5)zzF_->HnS@nEil110$p)?n<5IpD*+S OJyzCMDtcrU_`d*c#Da?e diff --git a/release-0.19.0/docs/pod-states.md b/release-0.19.0/docs/pod-states.md deleted file mode 100644 index b3326652e68..00000000000 --- a/release-0.19.0/docs/pod-states.md +++ /dev/null @@ -1,111 +0,0 @@ -# The life of a pod - -Updated: 4/14/2015 - -This document covers the lifecycle of a pod. It is not an exhaustive document, but an introduction to the topic. - -## Pod Phase - -As consistent with the overall [API convention](api-conventions.md#typical-status-properties), phase is a simple, high-level summary of the phase of the lifecycle of a pod. It is not intended to be a comprehensive rollup of observations of container-level or even pod-level conditions or other state, nor is it intended to be a comprehensive state machine. - -The number and meanings of `PodPhase` values are tightly guarded. Other than what is documented here, nothing should be assumed about pods with a given `PodPhase`. - -* Pending: The pod has been accepted by the system, but one or more of the container images has not been created. This includes time before being scheduled as well as time spent downloading images over the network, which could take a while. -* Running: The pod has been bound to a node, and all of the containers have been created. At least one container is still running, or is in the process of starting or restarting. -* Succeeded: All containers in the pod have terminated in success, and will not be restarted. -* Failed: All containers in the pod have terminated, at least one container has terminated in failure (exited with non-zero exit status or was terminated by the system). - -## Pod Conditions - -A pod containing containers that specify readiness probes will also report the Ready condition. Condition status values may be `True`, `False`, or `Unknown`. - -## Container Probes - -A [Probe](https://godoc.org/github.com/GoogleCloudPlatform/kubernetes/pkg/api/v1#Probe) is a diagnostic performed periodically by the kubelet on a container. Specifically the diagnostic is one of three [Handlers](https://godoc.org/github.com/GoogleCloudPlatform/kubernetes/pkg/api/v1#Handler): - -* `ExecAction`: executes a specified command inside the container expecting on success that the command exits with status code 0. -* `TCPAction`: performs a tcp check against the container's IP address on a specified port expecting on success that the port is open. -* `HTTPGetAction`: performs an HTTP Get againsts the container's IP address on a specified port and path expecting on success that the response has a status code greater than or equal to 200 and less than 400. - -Each probe will have one of three results: - -* `Success`: indicates that the container passed the diagnostic. -* `Failure`: indicates that the container failed the diagnostic. -* `Unknown`: indicates that the diagnostic failed so no action should be taken. - -Currently, the kubelet optionally performs two independent diagnostics on running containers which trigger action: - -* `LivenessProbe`: indicates whether the container is *live*, i.e. still running. The LivenessProbe hints to the kubelet when a container is unhealthy. If the LivenessProbe fails, the kubelet will kill the container and the container will be subjected to it's [RestartPolicy](#restartpolicy). The default state of Liveness before the initial delay is "Success". The state of Liveness for a container when no probe is provided is assumed to be "Success". -* `ReadinessProbe`: indicates whether the container is *ready* to service requests. If the ReadinessProbe fails, the endpoints controller will remove the pod's IP address from the endpoints of all services that match the pod. Thus, the ReadinessProbe is sometimes useful to signal to the endpoints controller that even though a pod may be running, it should not receive traffic from the proxy (e.g. the container has a long startup time before it starts listening or the container is down for maintenance). The default state of Readiness before the initial delay is "Failure". The state of Readiness for a container when no probe is provided is assumed to be "Success". - -## Container Statuses - -More detailed information about the current (and previous) container statuses can be found in `containerStatuses`. The information reported depends on the current ContainerState, which may be Waiting, Running, or Termination (sic). - -## RestartPolicy - -The possible values for RestartPolicy are `Always`, `OnFailure`, or `Never`. If RestartPolicy is not set, the default value is `Always`. RestartPolicy applies to all containers in the pod. RestartPolicy only refers to restarts of the containers by the Kubelet on the same node. As discussed in the [pods document](pods.md#durability-of-pods-or-lack-thereof), once bound to a node, a pod may never be rebound to another node. This means that some kind of controller is necessary in order for a pod to survive node failure, even if just a single pod at a time is desired. - -The only controller we have today is [`ReplicationController`](replication-controller.md). `ReplicationController` is *only* appropriate for pods with `RestartPolicy = Always`. `ReplicationController` should refuse to instantiate any pod that has a different restart policy. - -There is a legitimate need for a controller which keeps pods with other policies alive. Both of the other policies (`OnFailure` and `Never`) eventually terminate, at which point the controller should stop recreating them. Because of this fundamental distinction, let's hypothesize a new controller, called [`JobController`](https://github.com/GoogleCloudPlatform/kubernetes/issues/1624) for the sake of this document, which can implement this policy. - -## Pod lifetime - -In general, pods which are created do not disappear until someone destroys them. This might be a human or a `ReplicationController`. The only exception to this rule is that pods with a `PodPhase` of `Succeeded` or `Failed` for more than some duration (determined by the master) will expire and be automatically reaped. - -If a node dies or is disconnected from the rest of the cluster, some entity within the system (call it the NodeController for now) is responsible for applying policy (e.g. a timeout) and marking any pods on the lost node as `Failed`. - -## Examples - - * Pod is `Running`, 1 container, container exits success - * Log completion event - * If RestartPolicy is: - * Always: restart container, pod stays `Running` - * OnFailure: pod becomes `Succeeded` - * Never: pod becomes `Succeeded` - - * Pod is `Running`, 1 container, container exits failure - * Log failure event - * If RestartPolicy is: - * Always: restart container, pod stays `Running` - * OnFailure: restart container, pod stays `Running` - * Never: pod becomes `Failed` - - * Pod is `Running`, 2 containers, container 1 exits failure - * Log failure event - * If RestartPolicy is: - * Always: restart container, pod stays `Running` - * OnFailure: restart container, pod stays `Running` - * Never: pod stays `Running` - * When container 2 exits... - * Log failure event - * If RestartPolicy is: - * Always: restart container, pod stays `Running` - * OnFailure: restart container, pod stays `Running` - * Never: pod becomes `Failed` - - * Pod is `Running`, container becomes OOM - * Container terminates in failure - * Log OOM event - * If RestartPolicy is: - * Always: restart container, pod stays `Running` - * OnFailure: restart container, pod stays `Running` - * Never: log failure event, pod becomes `Failed` - - * Pod is `Running`, a disk dies - * All containers are killed - * Log appropriate event - * Pod becomes `Failed` - * If running under a controller, pod will be recreated elsewhere - - * Pod is `Running`, its node is segmented out - * NodeController waits for timeout - * NodeController marks pod `Failed` - * If running under a controller, pod will be recreated elsewhere - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/pod-states.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/pod-states.md?pixel)]() diff --git a/release-0.19.0/docs/pods.md b/release-0.19.0/docs/pods.md deleted file mode 100644 index 5a5f22918f1..00000000000 --- a/release-0.19.0/docs/pods.md +++ /dev/null @@ -1,85 +0,0 @@ -# Pods - -In Kubernetes, rather than individual application containers, _pods_ are the smallest deployable units that can be created, scheduled, and managed. - -## What is a _pod_? - -A _pod_ (as in a pod of whales or pea pod) corresponds to a colocated group of applications running with a shared context. Within that context, the applications may also have individual cgroup isolations applied. A pod models an application-specific "logical host" in a containerized environment. It may contain one or more applications which are relatively tightly coupled -- in a pre-container world, they would have executed on the same physical or virtual host. - -The context of the pod can be defined as the conjunction of several Linux namespaces: - -* PID namespace (applications within the pod can see each other's processes) -* network namespace (applications within the pod have access to the same IP and port space) -* IPC namespace (applications within the pod can use SystemV IPC or POSIX message queues to communicate) -* UTS namespace (applications within the pod share a hostname) - -Applications within a pod also have access to shared volumes, which are defined at the pod level and made available in each application's filesystem. Additionally, a pod may define top-level cgroup isolations which form an outer bound to any individual isolation applied to constituent applications. - -In terms of [Docker](https://www.docker.com/) constructs, a pod consists of a colocated group of Docker containers with shared [volumes](volumes.md). PID namespace sharing is not yet implemented with Docker. - -Like individual application containers, pods are considered to be relatively ephemeral rather than durable entities. As discussed in [life of a pod](pod-states.md), pods are scheduled to nodes and remain there until termination (according to restart policy) or deletion. When a node dies, the pods scheduled to that node are deleted. Specific pods are never rescheduled to new nodes; instead, they must be replaced (see [replication controller](replication-controller.md) for more details). (In the future, a higher-level API may support pod migration.) - -## Motivation for pods - -### Resource sharing and communication - -Pods facilitate data sharing and communication among their constituents. - -The applications in the pod all use the same network namespace/IP and port space, and can find and communicate with each other using localhost. Each pod has an IP address in a flat shared networking namespace that has full communication with other physical computers and containers across the network. The hostname is set to the pod's Name for the application containers within the pod. [More details on networking](networking.md). - -In addition to defining the application containers that run in the pod, the pod specifies a set of shared storage volumes. Volumes enable data to survive container restarts and to be shared among the applications within the pod. - -### Management - -Pods also simplify application deployment and management by providing a higher-level abstraction than the raw, low-level container interface. Pods serve as units of deployment and horizontal scaling/replication. Co-location (co-scheduling), fate sharing, coordinated replication, resource sharing, and dependency management are handled automatically. - -## Uses of pods - -Pods can be used to host vertically integrated application stacks, but their primary motivation is to support co-located, co-managed helper programs, such as: - -* content management systems, file and data loaders, local cache managers, etc. -* log and checkpoint backup, compression, rotation, snapshotting, etc. -* data change watchers, log tailers, logging and monitoring adapters, event publishers, etc. -* proxies, bridges, and adapters -* controllers, managers, configurators, and updaters - -Individual pods are not intended to run multiple instances of the same application, in general. - -## Alternatives considered - -_Why not just run multiple programs in a single (Docker) container?_ - -1. Transparency. Making the containers within the pod visible to the infrastructure enables the infrastructure to provide services to those containers, such as process management and resource monitoring. This facilitates a number of conveniences for users. -2. Decoupling software dependencies. The individual containers may be rebuilt and redeployed independently. Kubernetes may even support live updates of individual containers someday. -3. Ease of use. Users don't need to run their own process managers, worry about signal and exit-code propagation, etc. -4. Efficiency. Because the infrastructure takes on more responsibility, containers can be lighter weight. - -_Why not support affinity-based co-scheduling of containers?_ - -That approach would provide co-location, but would not provide most of the benefits of pods, such as resource sharing, IPC, guaranteed fate sharing, and simplified management. - -## Durability of pods (or lack thereof) - -Pods aren't intended to be treated as durable [pets](https://blog.engineyard.com/2014/pets-vs-cattle). They won't survive scheduling failures, node failures, or other evictions, such as due to lack of resources, or in the case of node maintenance. - -In general, users shouldn't need to create pods directly. They should almost always use controllers (e.g., [replication controller](replication-controller.md)), even for singletons. Controllers provide self-healing with a cluster scope, as well as replication and rollout management. - -The use of collective APIs as the primary user-facing primitive is relatively common among cluster scheduling systems, including [Borg](https://research.google.com/pubs/pub43438.html), [Marathon](https://mesosphere.github.io/marathon/docs/rest-api.html), [Aurora](http://aurora.apache.org/documentation/latest/configuration-reference/#job-schema), and [Tupperware](http://www.slideshare.net/Docker/aravindnarayanan-facebook140613153626phpapp02-37588997). - -Pod is exposed as a primitive in order to facilitate: - -* scheduler and controller pluggability -* support for pod-level operations without the need to "proxy" them via controller APIs -* decoupling of pod lifetime from controller lifetime, such as for bootstrapping -* decoupling of controllers and services -- the endpoint controller just watches pods -* clean composition of Kubelet-level functionality with cluster-level functionality -- Kubelet is effectively the "pod controller" -* high-availability applications, which will expect pods to be replaced in advance of their termination and certainly in advance of deletion, such as in the case of planned evictions, image prefetching, or live pod migration [#3949](https://github.com/GoogleCloudPlatform/kubernetes/issues/3949) - -The current best practice for pets is to create a replication controller with `replicas` equal to `1` and a corresponding service. If you find this cumbersome, please comment on [issue #260](https://github.com/GoogleCloudPlatform/kubernetes/issues/260). - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/pods.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/pods.md?pixel)]() diff --git a/release-0.19.0/docs/proposals/autoscaling.md b/release-0.19.0/docs/proposals/autoscaling.md deleted file mode 100644 index 5657e20222c..00000000000 --- a/release-0.19.0/docs/proposals/autoscaling.md +++ /dev/null @@ -1,260 +0,0 @@ -## Abstract -Auto-scaling is a data-driven feature that allows users to increase or decrease capacity as needed by controlling the -number of pods deployed within the system automatically. - -## Motivation - -Applications experience peaks and valleys in usage. In order to respond to increases and decreases in load, administrators -scale their applications by adding computing resources. In the cloud computing environment this can be -done automatically based on statistical analysis and thresholds. - -### Goals - -* Provide a concrete proposal for implementing auto-scaling pods within Kubernetes -* Implementation proposal should be in line with current discussions in existing issues: - * Scale verb - [1629](https://github.com/GoogleCloudPlatform/kubernetes/issues/1629) - * Config conflicts - [Config](https://github.com/GoogleCloudPlatform/kubernetes/blob/c7cb991987193d4ca33544137a5cb7d0292cf7df/docs/config.md#automated-re-configuration-processes) - * Rolling updates - [1353](https://github.com/GoogleCloudPlatform/kubernetes/issues/1353) - * Multiple scalable types - [1624](https://github.com/GoogleCloudPlatform/kubernetes/issues/1624) - -## Constraints and Assumptions - -* This proposal is for horizontal scaling only. Vertical scaling will be handled in [issue 2072](https://github.com/GoogleCloudPlatform/kubernetes/issues/2072) -* `ReplicationControllers` will not know about the auto-scaler, they are the target of the auto-scaler. The `ReplicationController` responsibilities are -constrained to only ensuring that the desired number of pods are operational per the [Replication Controller Design](http://docs.k8s.io/replication-controller.md#responsibilities-of-the-replication-controller) -* Auto-scalers will be loosely coupled with data gathering components in order to allow a wide variety of input sources -* Auto-scalable resources will support a scale verb ([1629](https://github.com/GoogleCloudPlatform/kubernetes/issues/1629)) -such that the auto-scaler does not directly manipulate the underlying resource. -* Initially, most thresholds will be set by application administrators. It should be possible for an autoscaler to be -written later that sets thresholds automatically based on past behavior (CPU used vs incoming requests). -* The auto-scaler must be aware of user defined actions so it does not override them unintentionally (for instance someone -explicitly setting the replica count to 0 should mean that the auto-scaler does not try to scale the application up) -* It should be possible to write and deploy a custom auto-scaler without modifying existing auto-scalers -* Auto-scalers must be able to monitor multiple replication controllers while only targeting a single scalable -object (for now a ReplicationController, but in the future it could be a job or any resource that implements scale) - -## Use Cases - -### Scaling based on traffic - -The current, most obvious, use case is scaling an application based on network traffic like requests per second. Most -applications will expose one or more network endpoints for clients to connect to. Many of those endpoints will be load -balanced or situated behind a proxy - the data from those proxies and load balancers can be used to estimate client to -server traffic for applications. This is the primary, but not sole, source of data for making decisions. - -Within Kubernetes a [kube proxy](http://docs.k8s.io/services.md#ips-and-vips) -running on each node directs service requests to the underlying implementation. - -While the proxy provides internal inter-pod connections, there will be L3 and L7 proxies and load balancers that manage -traffic to backends. OpenShift, for instance, adds a "route" resource for defining external to internal traffic flow. -The "routers" are HAProxy or Apache load balancers that aggregate many different services and pods and can serve as a -data source for the number of backends. - -### Scaling based on predictive analysis - -Scaling may also occur based on predictions of system state like anticipated load, historical data, etc. Hand in hand -with scaling based on traffic, predictive analysis may be used to determine anticipated system load and scale the application automatically. - -### Scaling based on arbitrary data - -Administrators may wish to scale the application based on any number of arbitrary data points such as job execution time or -duration of active sessions. There are any number of reasons an administrator may wish to increase or decrease capacity which -means the auto-scaler must be a configurable, extensible component. - -## Specification - -In order to facilitate talking about auto-scaling the following definitions are used: - -* `ReplicationController` - the first building block of auto scaling. Pods are deployed and scaled by a `ReplicationController`. -* kube proxy - The proxy handles internal inter-pod traffic, an example of a data source to drive an auto-scaler -* L3/L7 proxies - A routing layer handling outside to inside traffic requests, an example of a data source to drive an auto-scaler -* auto-scaler - scales replicas up and down by using the `scale` endpoint provided by scalable resources (`ReplicationController`) - - -### Auto-Scaler - -The Auto-Scaler is a state reconciler responsible for checking data against configured scaling thresholds -and calling the `scale` endpoint to change the number of replicas. The scaler will -use a client/cache implementation to receive watch data from the data aggregators and respond to them by -scaling the application. Auto-scalers are created and defined like other resources via REST endpoints and belong to the -namespace just as a `ReplicationController` or `Service`. - -Since an auto-scaler is a durable object it is best represented as a resource. - -```go - //The auto scaler interface - type AutoScalerInterface interface { - //ScaleApplication adjusts a resource's replica count. Calls scale endpoint. - //Args to this are based on what the endpoint - //can support. See https://github.com/GoogleCloudPlatform/kubernetes/issues/1629 - ScaleApplication(num int) error - } - - type AutoScaler struct { - //common construct - TypeMeta - //common construct - ObjectMeta - - //Spec defines the configuration options that drive the behavior for this auto-scaler - Spec AutoScalerSpec - - //Status defines the current status of this auto-scaler. - Status AutoScalerStatus - } - - type AutoScalerSpec struct { - //AutoScaleThresholds holds a collection of AutoScaleThresholds that drive the auto scaler - AutoScaleThresholds []AutoScaleThreshold - - //Enabled turns auto scaling on or off - Enabled boolean - - //MaxAutoScaleCount defines the max replicas that the auto scaler can use. - //This value must be greater than 0 and >= MinAutoScaleCount - MaxAutoScaleCount int - - //MinAutoScaleCount defines the minimum number replicas that the auto scaler can reduce to, - //0 means that the application is allowed to idle - MinAutoScaleCount int - - //TargetSelector provides the scalable target(s). Right now this is a ReplicationController - //in the future it could be a job or any resource that implements scale. - TargetSelector map[string]string - - //MonitorSelector defines a set of capacity that the auto-scaler is monitoring - //(replication controllers). Monitored objects are used by thresholds to examine - //statistics. Example: get statistic X for object Y to see if threshold is passed - MonitorSelector map[string]string - } - - type AutoScalerStatus struct { - // TODO: open for discussion on what meaningful information can be reported in the status - // The status may return the replica count here but we may want more information - // such as if the count reflects a threshold being passed - } - - - //AutoScaleThresholdInterface abstracts the data analysis from the auto-scaler - //example: scale by 1 (Increment) when RequestsPerSecond (Type) pass - //comparison (Comparison) of 50 (Value) for 30 seconds (Duration) - type AutoScaleThresholdInterface interface { - //called by the auto-scaler to determine if this threshold is met or not - ShouldScale() boolean - } - - - //AutoScaleThreshold is a single statistic used to drive the auto-scaler in scaling decisions - type AutoScaleThreshold struct { - // Type is the type of threshold being used, intention or value - Type AutoScaleThresholdType - - // ValueConfig holds the config for value based thresholds - ValueConfig AutoScaleValueThresholdConfig - - // IntentionConfig holds the config for intention based thresholds - IntentionConfig AutoScaleIntentionThresholdConfig - } - - // AutoScaleIntentionThresholdConfig holds configuration for intention based thresholds - // a intention based threshold defines no increment, the scaler will adjust by 1 accordingly - // and maintain once the intention is reached. Also, no selector is defined, the intention - // should dictate the selector used for statistics. Same for duration although we - // may want a configurable duration later so intentions are more customizable. - type AutoScaleIntentionThresholdConfig struct { - // Intent is the lexicon of what intention is requested - Intent AutoScaleIntentionType - - // Value is intention dependent in terms of above, below, equal and represents - // the value to check against - Value float - } - - // AutoScaleValueThresholdConfig holds configuration for value based thresholds - type AutoScaleValueThresholdConfig struct { - //Increment determines how the auot-scaler should scale up or down (positive number to - //scale up based on this threshold negative number to scale down by this threshold) - Increment int - //Selector represents the retrieval mechanism for a statistic value from statistics - //storage. Once statistics are better defined the retrieval mechanism may change. - //Ultimately, the selector returns a representation of a statistic that can be - //compared against the threshold value. - Selector map[string]string - //Duration is the time lapse after which this threshold is considered passed - Duration time.Duration - //Value is the number at which, after the duration is passed, this threshold is considered - //to be triggered - Value float - //Comparison component to be applied to the value. - Comparison string - } - - // AutoScaleThresholdType is either intention based or value based - type AutoScaleThresholdType string - - // AutoScaleIntentionType is a lexicon for intentions such as "cpu-utilization", - // "max-rps-per-endpoint" - type AutoScaleIntentionType string -``` - -#### Boundary Definitions -The `AutoScaleThreshold` definitions provide the boundaries for the auto-scaler. By defining comparisons that form a range -along with positive and negative increments you may define bi-directional scaling. For example the upper bound may be -specified as "when requests per second rise above 50 for 30 seconds scale the application up by 1" and a lower bound may -be specified as "when requests per second fall below 25 for 30 seconds scale the application down by 1 (implemented by using -1)". - -### Data Aggregator - -This section has intentionally been left empty. I will defer to folks who have more experience gathering and analyzing -time series statistics. - -Data aggregation is opaque to the the auto-scaler resource. The auto-scaler is configured to use `AutoScaleThresholds` -that know how to work with the underlying data in order to know if an application must be scaled up or down. Data aggregation -must feed a common data structure to ease the development of `AutoScaleThreshold`s but it does not matter to the -auto-scaler whether this occurs in a push or pull implementation, whether or not the data is stored at a granular level, -or what algorithm is used to determine the final statistics value. Ultimately, the auto-scaler only requires that a statistic -resolves to a value that can be checked against a configured threshold. - -Of note: If the statistics gathering mechanisms can be initialized with a registry other components storing statistics can -potentially piggyback on this registry. - -### Multi-target Scaling Policy -If multiple scalable targets satisfy the `TargetSelector` criteria the auto-scaler should be configurable as to which -target(s) are scaled. To begin with, if multiple targets are found the auto-scaler will scale the largest target up -or down as appropriate. In the future this may be more configurable. - -### Interactions with a deployment - -In a deployment it is likely that multiple replication controllers must be monitored. For instance, in a [rolling deployment](http://docs.k8s.io/replication-controller.md#rolling-updates) -there will be multiple replication controllers, with one scaling up and another scaling down. This means that an -auto-scaler must be aware of the entire set of capacity that backs a service so it does not fight with the deployer. `AutoScalerSpec.MonitorSelector` -is what provides this ability. By using a selector that spans the entire service the auto-scaler can monitor capacity -of multiple replication controllers and check that capacity against the `AutoScalerSpec.MaxAutoScaleCount` and -`AutoScalerSpec.MinAutoScaleCount` while still only targeting a specific set of `ReplicationController`s with `TargetSelector`. - -In the course of a deployment it is up to the deployment orchestration to decide how to manage the labels -on the replication controllers if it needs to ensure that only specific replication controllers are targeted by -the auto-scaler. By default, the auto-scaler will scale the largest replication controller that meets the target label -selector criteria. - -During deployment orchestration the auto-scaler may be making decisions to scale its target up or down. In order to prevent -the scaler from fighting with a deployment process that is scaling one replication controller up and scaling another one -down the deployment process must assume that the current replica count may be changed by objects other than itself and -account for this in the scale up or down process. Therefore, the deployment process may no longer target an exact number -of instances to be deployed. It must be satisfied that the replica count for the deployment meets or exceeds the number -of requested instances. - -Auto-scaling down in a deployment scenario is a special case. In order for the deployment to complete successfully the -deployment orchestration must ensure that the desired number of instances that are supposed to be deployed has been met. -If the auto-scaler is trying to scale the application down (due to no traffic, or other statistics) then the deployment -process and auto-scaler are fighting to increase and decrease the count of the targeted replication controller. In order -to prevent this, deployment orchestration should notify the auto-scaler that a deployment is occurring. This will -temporarily disable negative decrement thresholds until the deployment process is completed. It is more important for -an auto-scaler to be able to grow capacity during a deployment than to shrink the number of instances precisely. - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/proposals/autoscaling.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/proposals/autoscaling.md?pixel)]() diff --git a/release-0.19.0/docs/proposals/federation-high-level-arch.png b/release-0.19.0/docs/proposals/federation-high-level-arch.png deleted file mode 100644 index 8a416cc1e687aac784afb03edc6eac295f433a51..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 31793 zcmb^Y^;eYN_dbr#fD9c9(kTcA-OZqaASoc-jkMIzLyMG%(kUg<-QAti3=G{hbbf9g z@8@fM|AFsX@C&T_oPDmd_dYwW9jdJO9v_Di2LuA)%gVe{0fEp)fM04X2=JFh?*vs4 z$n!$>ounFUcDE5fKIN19K_hp9y!j7V@*iNdM-k-DgJhzEDQ#8*rKxyHI}8IN;zo0L zbGzOuW_;z>mqxC2ey}A_!4Xqld0aa}=5B&d8g&xS_*3QEH&X8-k|@|WvFW!@pK?Lr zxBH7cJE>abWvRD(*DEug_xDpS2IU)r^SU^vA560U|N2qs=hLk+LnywS zn{BCDonE)B|JBL`aglp2`&l`uuPXnW?U?PuUfM4WU8QCw!A)w(d;}hMrP*PCd(41o^qEcD{{@26jOy9 z+)$dcyToQuq|L-z`$W}z>_QVS;GPF(PMHb zLDcTp-h=Fvqbf^IM;DK;51BXMpSNnvx|P}vG02*7D|Q&CVv8EB?6)RG4qh*u7SjEs zz1Uz$vb%0Rx*f|ssL4GkRr0E;K=tLz9e7Pi#f;#a<`%h37HAC*rik3!|B_f-Vt(_k z>y%hd#Vb+4J1rvKy72-<&;sTb1eR9sX= zUuH@;ecbG{UOdbh$PBMO&tLTX{k=ptAAAj!IK1DkEEZuR$-41}$ECow|Gj$hg9$$Q z9|p$wQQ_fDA_Rl<)F!COz3k>1GlMB~CpM@878dPkW~4a(nc{t868XEVa5~_lSOB&w zT{%)V%0)3z?t_;BQcI54&*@(5E!15(!1NMI8V+aNi6; zo98EI;BG4QR_jy(GyxDo<=jf_>HXhv1I8NL%m_Ni2@bD-{2Smu|J_)fynxD)Jq)FT zQDs{(b#ryK;T7PS@-6-Uo%0K?I$-IsakjRGN&QvNjgo%v#bWUP)tRMUc+=@SUlxaB zGiPZk@)&>_IB-_ezaM3VujabS_Q>@drccAVqi&LEpo?i8H1Ceuus}H(cC(3yF~ESk+w3{`i#s2p31 zYZFu5{L}fh9Z^m<*lKjGQ^Du+9K*2oqI9w1y@Rv?C(Ep**BdnR2}w^ z9b7AJ#iU(-*=nEid1gXvt|)G@pp{LmC|p}%h%~A-)VtFk#=|4CVf!)jtGcKJ3E}QD|s{avOg5yYyg!U0Mrc zD@v|aItLBK&U*@;atDn!nb}T@bafrd(Rihv*XB_u#;w_ucYlgKz%F~s%5AWlEK#>ar?;x- zb2>X^mO&`swO)Mf!yZxJbQ&n zW(Zm4*imfVc4n^x?^}4z&XiBNamqY=wW1K$vk_O?kO>s!>I z5eyP=`}OvAnnheB^Lu#uf)eFNP=}1b7n?TwcI+co`3e~ZIy^NdYb*|i)^qVCX5*YV z7cpoO*OQ4aPf=!}N2)f?wr7|1O$qqqCHuHI{0kzK&Vc>%?x${V-yUC%jb^IunF$ay>gx0wV?>4S^Wc1K zyMcr1)?AsU`K+DCkEB+}H(5;$LXgo!B+Zjuuhl6ADym98oW;# zI|bS9pHDR*6^z7N21FDL8=#lUD}&KR-wq?5d{=ZqVWmF@pYX!Pm&9^oJMM=%T>Hg1 zsdS59&#n0wh!(exx`=Kgk7HZf^^P~(JLpWT9f}qni%M)&-xe3#|I)bCR>xd^{#!EJ zVkmXxh%xdTi*()Cee zO5&zx`-}>`ecOIsLtjL3Vbdwdna^?DW}-FZQDdD0T2NSN-(6!c%x!$SowpCN&NN2ylndfcUQ=vJ#FXOqVoh#*o0rf%tSn1jNQ+>5g@0l?%##V-S6v?gg zVHuQAl<~e-u}e)d!naJ1Nc#B9R)qV&mJe>8G~tfL#up{9QohMmO@vz&<=H=o)hv@z zt<~kW+G%ErXdpxT-ZcKytHtOOoS>OLgSwS>f6lR~bWjflL4d9Zb$*`q9%+!uGZl~BCf&F6QI;7*a&UqHgc1dliv&@A)fDs3GchQ=rD z+Bx=Q1T^r|{WK>zJh%FDgT|jo%Qe0gGr7TV3nCcMHckgSY{a~4;Sjv$OnMi^^khCt z&=g}m?-y}WbZ-EPn%}jiGhJf;Rj%|N0i0k(ceix27ahRuzFK(7pex}`u_!7Bk5{y1`t=8V+4R#TJ70!0ojxLzRJdY|JC9NKuYQ^KDhSqs$1Xnh! z=qZt(AK#~v(5qW&J2%zO=~OL^7#AJnp^1JCkM&T_t=WFLRrP#{|3F9veA4*%rjvde z4_;NXe0x_jBTUIebr{h77XnAr)>?y>-yirzVe* zaMH6=-CNUmEcTmc`%B#Q=By_7S8ksNwuQ%A$T8qKk+Xp7S>+-`(AoX0<@S~F(-ZI? zONS+3AdokK$!!w5?R-IVEutykip}373ONN2P~E1#o~Cc706TyF`*|q_?Me2l1W3BG z#37@j{_&&Plh{HZs*cxo<0{9}U6o&GNFpb2;bJzr930>dLOzrv@KTFqm4d#YoKuo; zjIc7!VmqpgutI1&4Tc=!m_?BhXeU256LbDWmy$7qM>H;n^NBZF1D*tbW({q4)$V8E zZV+@`)0Vwbpg|VR5jt&S(u> zs7Tsv<}6>Ea7mIMzm0mYHKM3wChm5uZv%a!EhqKS<^LR1m94|!5w-489J-yp-A zP2`+*@?GbE;WQp$8BGBDchPjhh_*f->M((F^-dSSGtvGsOVmsQ-knQqH%m*u&e~3f zN3lhAvJN({hSx@2^Pj~hzl4eqrecc5D@{h@l{hx-2-w8?OLo-zqjL3eY`UNgFQ{%d z!ZK|k3mKR3CKOp|s-183zNo%DdNiUU(U)3oGoo9rGFJI4kdcp*lUAABVzt(GrSejpdQVCyMe_Kq zBspXw7jzu^Z|Lv|px&9WONOS+UjThJG^3FAn+J>8e5qhQ4+ zI0vDIM2Hx>S0e9uKprU)Q|+_^{T#>52`L{cfZJHC@ES_a$ekS&97MC!47z&GQIVle$a}c; zWo+f>&EsH~Lkh*V=pKvhdhM2ay|bhZTYe>8mvLAw?sU;_k|NFle+Z5}VK7TPnnmn} zA9KgE`AC1W?v@zcte>91^4$zqcOAH_R%`t0(7jJ!XG-M*d7JtnIu`N$?adn=49kti z&G8|rxX+@!V7)vbJgpjB@G)rPcCF9DR@oKlL^o1@lxkeg@esMAHdd9mDS}Pd*v-{ zJ#ANLtrV#YtvNYcoQu8|wf8=!n?>DZSS}hJe3Z!Ub1U<#EE~u7XFB!oI~*uTPavy) zF;wmWPUJEhA{54JMh~S*Rx;DDCMD>f_sisxM{8YrQx+P;qp-r{-~%<$$C716t89=8e?GHG;x}Fi zsYZ~km@X{fk{vdd&@rTs_hz#YG6J)+%`rVQQ?~*onCLV(S;7kRT7MJ2383qrvICSq zHX(BjMDzBAgm4h(tKIwKFAoVQ5U+0&4$@FumOpEw6K&=Dmoyl*M*;1gW`l6@_^_I@ zKt&!o;kqddzL2rR>Ryg_pE5>2n@zZ`-G^;PG~XuYi=RX7!Mt5M3_CBdj2Mgz>FgCd zmI56m8pK91TB%67EOy4ez7@O}Xlf|@sQfk0+;>Q7p6I%php;r&OdVQF`hP;OvuV~G z))yI;)-RaHVi)#IS#r(pj|?a_;*ap#W({V&RVS!>67Lt1gx0}*HI9e`eXb+vSqLvJ zR>-9aaX3skZQ+JckLww!y3XE_5Xf1fTaKr+dZ;Xv6h7pzz%DMo%94+a*iE$dD8?LQ zesslo%Ake(HYiS_^z#0|Koz16uIQAalAk;IWezHPe#hLzl6;F>V(!r^3WwCJK)t@G zgb1W++Vr39{@!|RYx);h_P-LvHf1!G*p31z$&|!S8rVt@TH52f>&Q_h|9<1-DU_#- zM5d}5i&+PId;}T9OlK6Y9<+BvAL1zV63#r-eP=Q8vKu=p0%^uP6f)f6?B&f0#PC2C z3MADFrwz+ePf4cIM#B#^&+)#lgsm2m;yn|>D`5<4L0hVO$qWha)#CoOZdWQGzKNuGny&uoa&JKx4I&eF#=uSPLPVjp6_ z+pQ~V%#y51o;+KA9uzCO$wO~-=%OL|GaF)oI+DFuvnvvY+R2B zI1O|Tw7Vg4zO+Ho9z9~O@{NyX)Ey2N<^NX`1OtNhyy6PB)8%3E@P>^9mpt#jD#dEm zAG7R`pJp?S+W&&5jKjN$t&mSEP8$0E^8k8n5&7^V@J|$Hrw7hVrb35vjK6Vyl{! z33^oi@l|mgn-DRjSP_LKUZ!zsMLt$!BD{_K29IFNda_L2u<_{W4xA9+Xz zdW%Ukn6kvo6Z)%}Np-32Ql5r5k`CQR>-`suAGC)QjJ^K2#;GghmQIME4SGMcG}&~b zHm;Qx&0*moqf_c$Qu5?!J3HelOHYPZbFpnC>|p0^(GiI+;0Q~$|^kAIyEv3bEh_{*tbyff6;OHPfaP9KRq651Pq9Uj-|OVU z)JiDPED_7c(m#i?lCu6Ws<7p-4BS(9VYjZ&7e74h8Sn+<-fbcmwUwXGsG;u-E%emeOrws<&4~`GW-7ui zl}_ZiluYQT(y94KiecIXn}A{I^}%XzK$M62tDg@-eBnf-8Yjt?G+7^g{X|P{?B3S) zFO-BMR5Fmt8oq)4`Oot_lV{1>cbf?$qH-#3R$B#H<#&^p-w9@y)fG&~Eb*KhyzxeU zeG%b#Q9=rjr1`}K<@u<`$87Zr^_XQNr`q69*P*DoyTXRpW*A68?(5H zK`YD2{#QR6hJUDGf%^$@Q=jMMOGSx4Cjj%;1u7<vjp8czgDAh6iO^GgH=nQ& zd`;xgpG3D4T8?zmguS44E}h0whsWCD{RV5|;J*AM$eyWw`Ee$gF3p?#Wgi##2zXT( zs9SiZ`j2W5dvRX$atCNkb0o;2+!!N@Dcd=L$LW~ft)-_DVTOqmV^!CCKxvyvHZftc z3M~s?AFK#t9NrbJMB`;(DZwl-nGu$8BqPuUB69S~L&6R0YBMO~d5F_6?@5qT!>OCk zy&+n%(pIehI49JJn2mIHz;ImJIoSRMoC7K!&db?<#mPnj-cpBM7zv8gQ>T(?R!0AU zb8O%>&cb>1*Bt14EUErchByR*@c)#v4^)0VPqh9$LJkeF_fGC#dxRP`eD>6s?Z9Q+ zByDjwr`upGqCx94^+94jx~%tPtX_Vt&WG}hF(DH_f*4newZW8`-3twaoI@k?$N||< zKJ@g6UO{&0EKrw4OWi0qzJzApc~Zz;NOQe4U;$@{2V&V!d$cKEpV#uD7H{R0mGPaw zS1{Gd1_kGero7p+_P2w_(?VD~M8>Vc(-6TR3&Ye4$~We+?o)fzTn+6a zoKy`VN45G0?2H7jt5)wdo|kVlT&?kW8-U3MOPDwSoo=N@p$nLZBnE$bDJpM&a5rq^GpZ1jfK$G+W?a` zd6N`weeTUxgZm_^G+N5UYa3_Z16Sez^f*^fT^jmJLhS*$DhM#up< zRn?h`y&$Lk-3@vp&LA76CHH4g55oYZ&9QnLTnu+2Dq{?>Z8MVbRAxC`h{N9JCA_L6 zijyBx+3jQaW2kL69yrkjR^0w*CGa;3Z_5s9!vAlr6&QRC#;4yYb@ra0?~pW95jLB8r&m78+B$02V>lS6L=G z(j20xE`nGG$IYG#R6buWmXBDR_8D5dfEFOv9xkT-TTn!GHK`>N3Zie=P@hK^S55A} z6;SN;O zo|J_1v!MvfKapVGxOb_Ad;n1OW?oLPAMz7d`D1IlTx)3|aKV30An=dJ>+3_mWQ$n+ z?wG@8CBoi^Ac{}y3{QoLx{^lU)Pz+KE94pHUDcxZdAYTZ_pMS~?X2iInx$61`7@g;^|~#gZ1?Y>lG`VytSfhZbI9gqdFGhjx+zy!@rtxY0d}xr z=xoczGpw5+`!MaoU$kSzDCOJl{d6tlfdK=a5c`8=#z?PiscsJ6oni5V-l??uEs*1I-T*C?Kr_!AL}c%T$EU4ndKADtmzr1(Z(oiAv5whaHLM_i zQZ@5ZR1LI%39{AR^Pi8kGv+3JRqv|Q#VuZEh%~63#dPX1moJy*&fFdwg1u<$bxG$U+1&ZhrFfhj5-4u^&IGf7_sJo8QKwK= z$b0Fs4-w!b{-^a1n0oZv7&cbB!Z>a912Hr8CqJzCK!SW8QYo>R4;J~wmTkS7>Xk17 znfkqqDb#?2%1v45m$^bVgE9D9wfZq<%!lWSxZU@sIp3^5 zp`mEeH%nCN<`sq+6kauCH!64iw=Hcs#ZiMmjh6QE+#i^!dpGTo;T`vDBe9rYMAmZb7GUSMzb5$XJP5WHc*4zyq5Z&O9-366+ydVI zoVWtIEM75Jr0KFGiqgSAR58pDlMfoLqIPg~89M7eL))aVsy&B>WF}ChgiC?gfa9QT zdQ`M2q!A6Y;cDQ{Wi?@1LVh~hnPY@cahWmkkSu#w?bF}Q?)nc*1av2s5aLbqNAX>k z-6rfT3Sy782&ZXvosl&il;y~0&$NSVpREmw3wS#_H3slL8Ues%h8I;1VzWq;I<%<< zTK@nEbG{Mi87g_`Yn6^1o&0(Uhom0qHlN|!_oZL_J~#NN?bY#-f_wwaTl&wYUD&t) z`!T~nrrx-jD;G3rvTiGMYlotO0d98;qM`b3Wu#OUN%r=x_~#xI!s0w4t*B0EG$IbE zt|u`*|HU`nd`jFY&AO4@)6w9e$Jf|yk&M3g*K;4}EGxK>I;7QN{!IEXr&arb;#5qP zG-S^Ari#OC=OTZjfdedTXVTWI1hlnNC^z3{11W%@rzOaQl6>8)+IE>JQlj=wb%r15 z2sb`c2yy_e-}nN_a)PcByYY}#;bS5w-7|l}q#Rz*EJ_SH*0nKfTw*r_c}}o;f;~lhTCp7HWtq-cr>+A$K7+ z9$%gOsC=RzBG92B6A+2od@ zqjc9D7Cgnrua!i+DMJ~ zv>H9#9ebnv)OC%5WAg-dB!aY!+^It$s`x~P0BVADf8!PtG}nhrpIzT^+iHB<9qeoX zc4mx8lL2nG;OmNALrD_lrUICE$!obc*PPxFpt4vXDKu%Js0Bgwzptb1w7|~olqW|c zM&d&vPf9i8t?_K&LEVwC02a%v8!Pla!a_ z=|{6m*#uN-av^bOmd07&%^I%soodzE-=2@s+dnwQC8egJV(DEKKnuUgEurjq7KzwU zVoEb*3&R+HkyMs8G#imNl4*hYU<;B=x33n-aeArm?>25=^o3JBk&^Z*c#a*EAsfqA zZHMebt>uHlqD|C1yBW&}2cJnN{5(zjqOdq35ljZsj?j=(jE$0mo=SC(Bgnj<#)WYV zx3M=i1Fq!3xZ8Zpf?K`0==2evs=Xtjqj(_FUf1LzJm@^w(-L8KZF@nm+h6-fqOjp3mmV=}`h+uI6YXP+}ruqmQCVElfx(BU2yXAJ>ZPj;QiQM&# zI^%xOEk7$^zb+3b(Mg-y87KV+50xS)G1YonKGX+;`NTRdUNpYMw6QSare?HxT@yF2 z+Qc~3a=UUJwD@td;w+-h05A}=O?7g5Yg+VIoY(SitrlF=Jk(2_Qq*?U;A)AyuDp=R z=~?mh&I~`!sHz~ZlE~pe?-vnzave)ioW2{9U}sMoW)MyH%CSuuH4%3G{K_6HH5gvH z?@&(=W*;%^awk$nGe*_<#dE9Dulb1Qv$B-8A?-5BAF!F|{n;3ed9b05X99oExBBZm zM#>Zq1hfQkteEn?k;GGe4+c4bjKB>yp9_>!3UhD-w);?}3yVhm%g6|k5KZ&5YXl93 zMKzun-7w!EZi0~qr0BdHZ*PYCb#)<@xNUyPXDQ42c%Bs82i)|jIK&w?s`}bAF^CWl z&AJ1^z$iH!XuwmYC|nRTS1Gni?a$7m}bp!Xgx$2DB=Q-WmTug48v+53`B%!y2Q zRHiTtgOJo2;H#F;H^(CdCsq-linR^_nF##p3T4cCjrmNNh)+Hd>ua#{bh)9?tBh)X zc8!+CPU(7PQ{)ottnDXRTdQ}d$syoZ_|1#XH~c2> z)Ghg{2i6ZpjMfbzX!!cu+A=M>j&&Qm=&#brBo{3WG|P0}KppE{l^HBN)3;yI@ZQqn z48CFh3s&HRGvl@16}uJzRqk-q8Gbt&$V_x2@RugSoXj-D(mD8_C?QOceB_H<_hK_C zT+uAwk|dpNTtGy^Esf_!+D63h znpeWy()mVkcRH^Gr(wz{=W7BQFK3dQg5!2Q`48A*(9dHKIVaD-msfh!M`iq)Tu&!e zl$4;X6Tp6TUJ7q;hb&!%buO| z?P>+CjYiZr1bMtE4NLI?6WeNT-~f%HveKpAJp_N&2n8+c0N_X^zfJzt`kFyT{*s=)q$j%vfA-GmTeNPJRq&?tF3teHWcA60@|I+fM z-eM2Ul8Uv@ez5YW?cGg9wy4dcbX(A~?(~8~8h6Q3-aqcdi#>_rT^q?*SqYj_LK)fn z}B7YRN^uVgsiR~Xk@J#lvExif{%X~yQd4h8fvl0Ol|$HbcLe=Biswg~f^J?1#hN3HH7h0}Xmt$r`h^zoUiDg@v@5Y7)E| zu_uF~M6~6b6B>0jVIjXVwZXG*oOjm-@cvAaEYnahaeR-hGgx^~dn&X;n(tDlrsXXi zAmr=ZiYjs|w-1lqlf1tz!i~jE7cp%?JA~&JlG?wTTe>XZ&v-QFC|_mkGXJ7`L-$`3 zI_>NPh;y4qU-z|{2B@c218&Tw8YaM9^4%naxJ-?^s4`*dhnxK?g)g0#VI!o|jn=NN zcp^pS^sMh<^9Jp%P7q!QChnLzsemxjDBrou(VY)#<6bcFFTGqGC$P;f{JU%LXgiuE z5U~U9t&bjYP3>P{&i1oTT8@-eboX9UFr=;`kw+G<)Kya8q!FPyXFa>xOoya;o$2zw zuW+-nQzxf^MD@m)99OeYL?f2Jt~!%^V4+B0{EYSWT+E$_om>IgL&Bn!mObvwle7V^ z`hiCig<-pSt2pi_Cp9(F(_@bxHQ?EI*~)_VLB+;-&oLM8i&4pU-%YwLWQfm*#%Hf# z9jB^Zb4K}WCLnp?*0QGvF!fFwl9&=({b3!{ zFq}HE>oC!z4Pr4PZyV#l6{@TKP6I90O0K? z)ISiJD+8R?@x1dt8Rdwxaz5JfE^@Ot{pImau8Y9nh6{I(vzS+i&)xFsIStWPMO*00 zfj$oMdzCv+D-0zYrC&kma(iQxRV<|J{nfLZyLJz0)axQ7Jw<}RaG8RwjU&}hw5>)o ztGrE0+IXIgb3y~&yNHq3whJeC^z_LYsSTM@=iEFxPq`Xadn3~?6OI=}=HHQi^Z9UR zmm%ghS#z7d$73-xg0l8CX~)HT_45HnH!7agyY1rJdh}K%qx!jNQt+5YT^@D=UX}*V zzpUS37YKzwSRlZbfycabJ(@<#D2&faPmsQ|M*Pkr`fAZ-Lg|}36A%E??{#lzJvCR4 z_*^%!7}njuQkPm*#?qAbaE2Xh#$@~Vn4VH@nDpKw)dKxNRw~t&gEttsMaC+zK-Vc% zR?PH)Pf2>#TG7_fxPR4Cnb4isE3HkV8ljO)gqJh$+?7IkU07y{Ov#%Xgo+6W2rzIZ zo?*Ib^t7xjj;|5ep%U%FG3ed@@o=W8ImJa<5~G$Id8o&H8s+wm^Shx9?xPu|=u`iTmbTBE_$wTkB?N4xuPw~p18(B9N z;+#e2HiiV{I!PV2rx8E>`e8u^=}P5q!a9|-7G5!^!LD?LS)!W$Ofz~m&xTaNqg16) zpVciwNsCqX@9Qw|Sb-;djeW|lk>0iuOk}Fsu+`{#BPvo{yQ*6+hUOcSAGu!1(xQVt zEs&g^vrS$M7o06cqj~{Kct#_6JKnOA*Z(!F$50k?`}|iAru=*Re=-^&FiTvOX2^SK&XtdSU zvLWsA08&WBeI8!7nn~Jg3jzbtyW#h&LLT>5W!#KwbV;nWAGRVY)?gYvvtMX>*G6eF~&I~J@661mK z{`d7<;c&ed2dh|d#CnXrdX=ryM&!JD70a?on!{LcHom>Mgxt|J%arfmlP!_`m-7Qd zx`b1mr;aJQ98)yDakcG?O2lYohOPeRf@ZH`vgD~2)W|gQ>2UaP9ysV~8da)}yH0(y zE|tS>C7;idh3?&9rU*hkV@14%db*}F;-ECb%vk3ZSiz;ZsbE<14q!|^J_Ds3S7QK| ze8?5&{QH%1gV>x7$`x4AP|8f@3G_VvbINqsfU3J#36t2gIJfVKZ_Nu5liQgMGn8({ zvzy;CX95P-c4x-W0T)pnlz&jj?e6A^{>?@aUoR$8p2Kp)k-osMvG)=FOqw4Pem)v$ z%n9pvjj-QkRSqn5$);lL&*~4K$`=1pFv;c4d1ue%-XnJ4!aov+ZN;xlgR5> zRj-PP=f=z#0ZoT?%9->J93Id@h&J~Fg+Y%~kccCXzWP*J29ImZB#cz4>pflhiIkp} zkH96Sk~;O=#P7w#`Pirn9FuB5m4RK+HpM5#+)?lEXD-41@)>L;djm{t9q;Gl2Dmsp zj&gO$6uQcK|HW$RPWo75yjxt3x`l?|=KY@;h-5rVgey>0e;HJj` z6&3Tfi%pZr`u;T~Q`LqLr+-_;y|iz%HX;^(OZ`HU`p&Z~bo|WuO!6>5f}MUXYrQ@| z;n8)8NA=BxJ#yhNp*eMc&U^J^_f1Sv56R>LVQxX=}R` ztJM(94bkpKk3A}cTHOJ%yOSEDyz#m@)(nai(01;KzE=lXq=D*&!HK$Igcm0JAO8NARG|$@r{HoeMqw7|oL}Vd~OhXxg;z1WLJ0{eQCD zl)C=;`2AsD_&yIC4WJaP=MUvh(s^|Z)k7b_JE>5P%7hMDjVt$tgeYhtVJFDd2RlRoDWB(oi@9S&51a`(kW&i#~Im3Gh8FVpV}q$Rg8^mYxf3U#Sp z%;^(OWW@jVaY+ItaxoS50YegW22Y^*MK;h(-0r)Aq>Bx}&R(UI?ibj2SbO|Ua%{K| zT)-Nc1`Ns4%*&#@KNN!PillEP1)sn`6!m}`5&ON@#Hzd2_@RN^?lqO8BjJ05r9O4_ zgEw&Y-T9gsc?UVqrpnnefAYBK^atVH(dxwH>N`6==t{ytu-EiFS&=skwwhtyUJhAv z`F|^mH*+`|1bimRq8$xD%u!pXa4=E@m;v4ea23Jp1mkj_X73{o$Y_ZK8ZK{G<-zIC zP5pKd4KAKvlxYm9L$XQ;`>}5gY0`xBFKJEFz#~NI9A1lN3Asu4Gm$7VcXjD{7DQLl zl|yg)ym!DO9f0$F<70}@{0kt(1#c3upebo6u#ppWP%%GL**)8Nf4dQKTi4z1n!kv^ zpl?8=d~Z*qQTu~C-UZ@vj6Za<9H!-k7@0@QfBSLatnOJ-*z&BN07$>OV2=tW1u z&AYPqm(1V_;GHz$3ebBP2_&OUrP##WZ1ULKVUFW+h@9S=7QwqYZhV+sQuHX{xE|jr z_XukSad#t8z+|Aslk^1kBo`>}4y)+zo(!6KOz2`9iqF=w#$~#D zU5xo9CEdZp6YFjx%DcFiCWOAp!>x_ZgEau+M^R^UF z$?d+b4!O@7ri;_=YyUz{w9%^}9j9o{l|%%FV)JQN5oGxA#-8)7ju@rNFHIjoY;Zeu zGeJt&R1x3`PXF-N=DpmKL#TSjgcy^xmIOKAc_<@@Y@H%PrXA9B+P{Pf^ia|nztCzr zs$Qgs?d9^thm7QlUUV&lMPZmtgFJLfe9V4-BtMyAfyb(8oC#8agG;LuIPvtCwWe&~ zKETuv%Uc;ujn(US#pxUyIuBhk^H0G77>HUUz_g;Q^Fp@75HVgY3d42L-~4D#=SmjW z?4CJ4gKX*<)n;Xsb%oqpEj=+iCUCRFJE=*cT!jI2?Q<-!hgn;_I4RAB@c+Bc(VZAS zqiA;|FwxoXBVsO_HG~}@9O5Fdc=sy@&H0sDd!){)C&qnImfDW2GKvxabwu6+J?-J&TK_`FCjdcXE7-#_+I2V)y zcgQ=>Al5?~@M-|~KTmf#?J{~ATA-5XmfP_onq9)%X+D^iZSq)RM{8bc0OF}uW;OEx zDETr1z@vRD`d9SD=DzT;W$kk0^8oAOJVKZKNf7`1UTFiv%4b?JyNV0;NhW!kLWn_)|!cUYK+m z?ov$HzltN^O@yTNomY-Ew^zb|)1D)aUNa6~tpG2ri`fe01KDoB-(bG1_<&p~Q6q6SVtiXaQ%$%eTnh@NBpFzZNFOrVC=+T#u}N zVZ!q6BX9$BunfBM7LQ`gG0%Yeb_@6(paS97_kQ+cqWdSq1Glsd)@YWyK#S)OFDIv= z*|DAPdArK=%+;e%3XU8(G_6vuz)ca;Wmu*iw*3b`f6O7)z7Q3Z|c$7vGlJ2 zQxx7ZICcQ zb-kIAGTIk!n7)yANyg$A;rA5sc_&F8p2>+5b)j4A;1{$D;}TZeT8zv`fCh1;54|-i zPLVit+`A|@Z=Pxqzf)43_5r@LfJ$yik4iPs$`~#O8XL$GgzUC^qSattExsc}<`S*whQ^aXsBimspLrkbx^Css-58tsPlhgKt> z72>v}&q$|Ke>tP6V<-R}uCL;xN@u?XH4f1Te-b2WRQ+EtQqgBtWK+<_;MiWaOod)^ zxo19@c5oaW^o4N6hbwRq-nR3uu5f zQn7OTs9ldHrpuPKN$N^77zs77MmmNLr`Dwi(JO3Y$pGqKU_iCNvMH9A1r3(~seQYv zSJ#lHn|iED&|2Efe4N}yvx&~uC+nesoC(vu4-E^jG+XDFzB3X8NJEh-i&WRhUMRfe zu$)aGeodEnijGr2+ zyl^?~m=YpzHY|+|OYCV|t8mV*M`do_tFt!F!q)eD2r62X^#6R409P~1fm2HvWPpI0_b11oOB*PDJpU3SAJC;5G#&j|11x0{Vw)s#2rbMwKeoPcM9#3FzQ7<`Q>!7C^zX>L{{?dDwFPoi z-Xe*oU)-!+zv)M~S8es{c`O$Uq4TDN%C6(%2{Ox29oW%AyZhTi_#atT5l#{F;H$0h zF)J}xnI4)>p^d=mS6;qg)5vfyQ7xG_0o@urgZZTYvo`_46i8)fHVYO5|GoO6p>6&O zEG03ui59NEJUfRARJasU)wTq%_OKU;qRBi(?^0h?{e69{X5D|rbiS*hUhEDgc+%oJ z`Bj)4C^)H{Aog;;oRATwW3PZ<6uTCxV(K_ZthX$0;tL;*kfu>LA(3K580kmqG3p$@ zl;@9y&cIOL!Ta0Vq@GJr0Nd?nZ~|nl{>Ux_-ZWn6;2<|tDYkq3K5Ne2q4eIS%f?3j zsShwTgHv4Gxs(NOXkJy7iBhY?ulvNJ<<$T5wcm`?nGj6h!_ z$zXrkb|9%cA3%d15WL|1OAK5>kw@v+M_<8-X1WGg?WAOb6TiICMwDvzX_)>-8Bq0qr67VS$E9> z)?xu>59I%A?<>QiYP)dvFfeq9bO@p#(p>`#s7M-ghe&r1JxGa^O4l%`fGE-((xB9! zAl-<7G)N1aJ-qMto$v4YfBfaewf7TiuV+1L-D|CT25w%ID;T_w;-wTIjsUbmR~-ON zdP2)<2;trx0h$$4Vhp$#cV&jP=$dLsEDH^$3)qk%B}^9|%kgyklqJiOG)4%VF^ZEo zT&<@9QzMi=TlV;gr9KY}QbJC&C|?l5;bu%5cN}i#uLTc>$*_&M8ExET^GK&Vbq|SM zI)|IkTat%M!BhYR>-+ zIFqJ4avuHR7Q)X=IrP$Xf7aKY6=)hMndAe_ERW_;8et8efWKF3n=SuzF?)@7*#Ky9 zV|>lbzeM$t2~lV_Li&E%Qw)ul#WjVN4Yct(F`8#BIjJLIh%A{D#$Lb(Mvd3U66I+y z|I?p{vvsj=S!#eOL2^x689uM}H)uCyzvb?2P!nAsD@$x>b=un<_pdasvPsHSkHY%Q zR&#frT!avPJB7En>`t1j=0{2Ld1`ak`39u1{#o{$%JIx5{LX!LVOVG4*YknTiQJBh zhRQUyv9IKKe_xO5YkYfJxGX%2=^fjjZo?(Z^IW3R@#P228y|rDk9qd>op&1c5Wy`W zvmhG3*{=qv{H?|_${bXnINcj!zcj>?|Ek~Vz`kpSV4mq=Ek#tp2-%=$nN%F>%N{_n zQS3GYo}D-eo}Hxl(c)L&hArM;jq>FB!JN8v!-OkMfUE27OD4QO10Ba(aVe(sCiK&F zjPR(XSA7VO4&Zi#+tfy=j7w5`YP8m$D?*zW=31S1d|D*M<_`n;9FXghV;d!u4O8aY zU$++V2S4!Uy_i^8d$x{7dms2=uUbBRMy+IN z$xPQ<^z9>Vby|RH%N`Tur<+@>E>|(&`idwU->1T?IV*#LkL`fLwJXcBiMJ9G@Ga8) z)NX~@{Hd)g6zIN+xb~-a!BK`Ga5m`tLiWtpz_7h(nr*7LYG(c1MdL3l;biLx46*gx z!Wj5euhlbJ8gdM`!2aD4l%2N?_j&I3JI3AYFw)a3P1JVf7_-?}(dA#_3rx&hPcwb# zM&j*Eg!yqxg%~ONaLr;a&TNJq(e3`-@ocv$_yWpipj~|fSgDEw#3-JP#T%Y1z)@_z z+GT--Yjt9FX@Uobzc91Q=eOBbPEF4>-ks7kx0V~_D9{@JNY=Wy!zVoO#6vzZH@6P^ zd9`NdJgM=!J?DCgurr7kuPaIhoxf-*zT-X+0pQvs;-2XcU{deJQ37X(pJy77Kbpj- z88+vNuY%?a`Q>UItMNx6d{QA`xzc!OoAC9mqr;1`*MujC2ZrQ?r~Jg51f%uiTfVvj zL2{j%*Z!tHo1?`wKm6`V33w-YY#Y2w;4`jnevp`baTxOZw2yT-?k-P}q3_6^Vqk^z z)ejNxi80of8nlAn7~x)*AJr&%J$$D73J~NAWd3a$(p(ZTTcwEORu1Qd%V?u)S};qQ zl8YfJ`oK!lIRnSA@z__ct>}byBiNa5GuQHGvqf_yWzR;d`6gO0F4i#}_y6>~>HCE31;xMVFJgW`n?G?!VPIa|$A( z-00P~^Sm5U(`hxZGap@oL0J+$F_QW8@{wD05)t(MNE6mh<{&I{DTe)xe((A~rzrIer z>`YsG-L9uv4!2#+02eoH)1*a+3G}n^^q=iy#b&33=3l+Mz?Mizks8!R@6aW1_Z_&09kT;>LHfIQ+1gQ7m z?0bJMqzT${g2Dd)TkFL9J9DZhs!F2_y*qaa4EmkG=0pX#z@4K+b@0?Kn)`S1D9G>p z)R*7MFgL$&y(~Z_Uv@beCy*5g;`$W@V%`^wBRM-0qZfbQB|bbOK4l47cUM@Jii%@B z-*Z_0GwR*kJYafWpZaG5vZ%v;#V+2aw9v z?OmD&ebqe8tk!_$*cbQSc)=zx0JNEL2XefB04KP>B$MD> z6|W!4IHpT>DHiQ_$&D}MN_u0fk&_JT6>ZmS3)z-n027t9>|AZik@cJiiviIbULi6L zq7zT+pXVHOJG|XOs!^GpZpB7zn_*YlpwIhL-uPU44y)77W_qKcJ((T55%Igqi2Qdj@O!0QthjAObS;X@&?;6lI( z;fP|wtLFcRKWIru4sQ?F>R5((@t-P#x&P^E#TPc=Ii+%=_H4V`wZHByXSFm~AFh-V z)~Cm9-+*6h{=1atdoe$tG+FZbBsPPYpql^Wkmp18#ldVGGiPWHVB`RxWpzsqj7#yJiV#;esr=0t zZ>b=|BAiRvRH}}iVv;miIvAKSBY1;kW4%zjh7>o(Tv`*tQc!hv9_@uNDD>}_@lj$J zAE_|hUw>6%{b-2{sHY9XFKG2V4wjp7-sVHO2*SbPm(`d-C54@zX`L0B6iV9q~u@ zqR@>!j4Zxgal%IX+M*{iNEnfb$?}|!u)StRCFRO%W8tLDIa&43yt9F)rk7LFw|OcI zCxh@eDC8>`as)&Tk+{mV)0JNhRT+A{KEd6NbB*kakdx9fb^?EXJXJ9M)eelgW}I^E}4%bQa?XXw2|HfM-S zRWtxE`eXWIpLeJvGKOzcks7;;_L`5cr{n80!%IRI>+)O`PKJsJA|ZS>~D`*d{&w5fbcWhDph4kiBsGi@r1Co!2knLfb>TvjM$6 zrsFN zI1&8glp5ZOjMLV6iM1#g!@!>sTb%nHgMRe&2Y%l45f)-^;+D2fvsyg`pJ8yPacU{< zaqnDu>i3Jaw;^og*8?@YhO-$jU8Y~J55T9&5N+ePGEDVjp|niHef?4H+G3Oo3X zb%k7x+Or~DXf0?o}l0A)9f0M8qJ}Y z*FFZ6lmrwfsRz+x7T+tKw`WY)_eaX7Wrc*cONyIB&E+0fpHAOJTZ>o;jk(qZzqwO6 zK6kv34bm=9loV^zB1qNe z3%m$jRNJ0fJtxd~ zT_Tp{@n4}smj_W#90l8)Snj80anxDImr|QEd^S8={qKmdA=?I@vdNgoJ^%!@tH&j-clva zzBTVWC~j4)qUjO#koB%i@dh(IJ+sR7qxFz~wn0k=zFlrSU-uC4PH=9V%z*81kLTrP zG5G4o%U55|)x}R0J(@-p{ODsMXw3K{t z%y6sa<}+XQt@HNmaynyfoSvzIV}%wiZcnv#*-gzEwrG!^2oWMV>xX+@g9-8b-k@qc zvrV6?Ta0^!Dga)7zr)_Pe@P(fB;#nf78lSjS3tI}ntfAMt6eTc(gu z#zW&F)Jh;?hwGss!CE7*MKkb5QgujH?ya7ktDCj?mPmUIElWO#haOOR0T^-NSOuSN z2iD9P>OBP&ixi|15CQX`m(zm_RiQ@o;>ZWVO@TJJlKme0o85n?91`01zIF2jfsN$6 zGT`L|=D#i}4cC|0;EDp4)4{YJ1A4hXC#Q8=zxlA^r)x*Ky8Kah9&hpIvPv8sXA{W( zm3aEMlmAq$f{;)h43J8^#&gVa#v>(ja;7Uxuhr=RpJWWcj5kP0qB|o3@p8rUB0-md zbfW6GR;sTT3dePVwug(j29L9luKEg*1kb>~U<*!_7g$X~g3%@X=z`-1dDmmih1!%u z4TRY`?NHy>gs$Ky9DNjAn)W`ghmdYOPq+Yy@C;A3t8%CiA1U;vaUV}LxdtRyFb15r zH4K!=uyhxVAfKZl5g`X-xEs|Q%e824u5c@mY1U>`9sVbXQlVHe{6m=NX=X`K&7X+o zQ=d)$9+I`P+P@nYU56D*xRXwcZ53W&dz`7%G5;4xm~9_2Pi$bAoNM zt021!`p@ksSX${hm~2jc06!ik%a8Vqw<^GzTy(7)m`HZxl{X`2eZk5bGeYD1>|q($ z+t0g|Llyh;C_R5cCk0V|8Pv`Z1AWuQiz1EsTjE^SDIPrk*$|k^l^FvBklWkrR+f?E zD1uuQCG9Zs{Box`Mf}=v^q9SfN9A{Be$=KJPFy{tOOYOjGrbBK`*y(BkzQ*5!c|tw zkd!^G?&>5gt{cBPWJW#rKOYF(hh=H&Tc-=rTU08R+d2Gi)w9-~bEE}fgVs`tVzM1I z{4yZ)2YKqIpxzFIEem~SJ55|uNaiQZ&~ElVT7cQnyuDVS+kvCnt(F_N{I5C@4Dzd6 z5mvgHG5_s0KTm)V96>PAngsP$MCC`iAmlX1fVl%E+2m)?QUN27mU)jJ>fZKkj`NVt z!UA15j(p`(fxz|U0nWYAJXNj6fv}W*QfD)JXx83r8Go2vF>Q(HDRltJ*sbt8-fl#L zNd;=#EcvRjt*IBLFXgG<#y&nET2diL{a{xDkMSjR1@STlGTg{8>Dv?-dZQcf(2N~I)`!cZSb90Ix4U0Ht zou%|A3Oa@d3w@>R)uwV5bko=kBg~kg9Oynkmg0;p?i8bNy6H6v5!-g^MVX{fXHa(w zEEaZUvK)GCEA*-w>N_Sx`!(=t{sehq{y8rYcy3yRYA` zRDZgrVx7#PfYbQPPw^6GA~zktL>e?fB$rMj_{uLIt{G`>zJ&~D)>AhVCE48pO((HQ zstJz&J2+@q8kjKcs@iE}oiOx-YdzQ>$?`fqY^hJguJ_B;c9Hxz?x&o6;{69Leo}_u z6#t!T={_+11BiQNHAPUk@!Z>n3bU6ki?UikXFrT%=u%E(!m=}2SzKpxIL$d5Q~uW; z0xE!MB7_M!@1#Uy@f2i39@6Rqd6@c7}Fw$X*F(fUnk&R#7n>GblMo${Lf9I;{x8nOJEOC z%|<%M)i<<2{|-@AOH7|UG7jtj?ruBX2y_rh$)xUr7)bKk82$I6099681Pp!@M8ma9 z1!v}m{gs5iq=lx|vZ1=R<#F{}hGPWmeRpZY?K%(|GO`D$|B!^##D)c%r8mJY+(<}G#WTZ9U+8#WXZfXqAg-S z5-p(`#+GCcoR@Yk{UeOE!_yNBE~UmMjr=QZ zU_vR9@6(%0s;x^m0+8dh+Pw<2ms{(IqH48#8$Km)+m{ue9KoxDq#|m$v{q+i(o#9+ zq{Sa6Bt!h!q;mFyE159T#s4$JCtGE}^vmvDETo%cabCOb3&aUJ!GM9drWhh0u1`~N zPn8`7fWTDdRtstFC+K&^tGzp_iC@k~dM%f)r{s7$+0Lu)NJ|g&*M!_$i{LQf(HOmj zvlh7CGg6FhF#aGpv->s!hur=zE=g4JPhlHBhKW6px0I_r(qN#jor>Bb)s1s`u>|6~ zMgaLq%-e?R)lHmqM(!OC70{hpr^p>NI>iP zp#IU8T$Ac#^@WRNpmE`gA*b|TY5i5PBubA9UvT~)!QgELyjS@t+za8+qQ%wO)^ln0 zWMYga&kZRS6L;t)oihBoD~6+!`#e(i(jhM{gBQ@$zXW8~KH~_Mz1I&3!WUvm@K!d9 z!_s5Bbs3-94t=fI(16Iq2H7aUC^Pi^LBDXBEkVcMGEG_hpQT8$T~WjaxNYb5MPhisH|wyHCIK;3`D&kpgjLETCFKx*}d2&VpulD^g^D6bFdgmoWd zW5?@(Bn*>z{eTZ<*0@}P(iu`^Xv!Z|-{Su1mS6OEK&e*zp$G>fAlvN|{3th6IHaAyzQ;MOJl+brEP;IKNZx9W zGcY)lK!>p1Zad$JbwEMTRN%W$-w?fuwax^J!{hYF_o9|o&>8bkwMxlK8Ttu}7 z<4#{B3o}*{N`fmmxs#tknBgaF)gUCF>FF5i+rgPmmS7c=wGgBQv_8l^@BIvo(3>6B6q;6f|>&xJuh2)s11%uR8@8Z~_W@r4Lu zyW0nRLI$*3dl}IrdVY4SY&Z?=}tFkw@0i%(^aWC_qVdI7#`FABN+jryCbo_i?RumrMTs5R5tqG0~^75GISIw6Z)@n!quGi?f3@&dt6I$9iwOGMi>Q zAVY1T<|wgn+m>X82dEUON6de&6pUZ*8aP(u?HF*M?)X71*yC~VNnD=lxqEO5Zx}5* zde1{{zV1^SIpKuZP%UBLg}*r-{@^s>V2V9ESu>!=6W~4})Fz_E!2;)Yr=xrVa(jFT z1CyJoul@DdEts@1Cf& zRzaFt)jvY&zyBlvsmbx|NUMl!!=S-_5>7Aam*UORga*?043FC3tafQz16T!uy~miICt|Xbd;-oE$4YDQwheM4(=)LW1Ex zpV)oZg}&1!{G`R!y!e&S%WVR{U?H!qIQwjo9^Xu0EY+%mb7~`tr8{1CtJ`p7lT3%vJP3G)(y6%iSw{IiMHKvlmOU1ZL-!g8yl%9PU# z`vZuVFq$z~y~mBA>zfJ}Wtg2m{MHa$G9&sCU|RBcOM>?;m>U6)7wC}ymHjVmD$F~j zU9330TC2sa+$?U7q%XC+i79sja+4c-ELpspOo!s|DxGa}*>h{C4629y3Kt=*0@S|! za;535ZJu~KRmeH8-5Y6x$4Q1#2G>B?W^pfc10ij)?xJ&8r9yynQ_k zLrGw)5NJ)_O!`cxba6nraRljrE2w5<0SF2O>=D!e2YMVvDWeeK#1fLFwohvdx631( zDED{!gpAWB*ZqwQ6l@$uMm`Z0tb};-3-aKtEXaxeP!j);9>Ju0dkv@t( z*Wn)JSFGJlx~B~?JvK-z=+Yy6T~h;^@AOnj1_=bp`@E-c=|dJS%hTO-F$2Y@H4F73 z^OOh@PWEP~FyX0)%sah4l74Y)Onk*2AK2GXP8i%?$16*2V+A}gsXU2b&#sU2dOJv& zXU%MOi|oxFkl{pL)GNAYgHuqDB#{G-%@ALcU23-a5XQVGuTA+YJ9S3HpTJ#(icS9^ zl1eVJZ|c85Usj7_G_^>}KE#bjqhR$kRxkK!atPPD~! zY(@WUqch*lG-qvI1axNpaM@^_i*3bD@aj}z<0AE97U7AQi4WhguUrh&P*NIg;zL}eM8-tG1YH(3eSpC6xG=+G#QjAB$)iE`A+F=;t3iy zQ=PR~U`BQHV7_W1sN(dBgxfCy%679_TjY0Mzb4TABY?w68*g+i(PKCol-HXUt>ZR6 zMRAGkF-2;R>`eheNzBD^finy_RLgk+M#rmg zg2UIl)cIqJjVy!}km&GdZlC;w2Z4qqldiV|{!GN`4{b-u|CX}OGP;T)$f-O7nb{dA zT%JmkGn3OT&z+WLSx?bVrbhBLg88IFs2GSWzqvw5g0HeLn_Avc?Jh`=!{gdWWOQ5+ zZM;qKy=uS@8C*mN{gS(`_j`Kv>G7&1Zadnr1ut|GYmau?Ja_PF!QY>(LvykR4$x^9 zeH`8f%0EKPy~QHWq_$bR6=dy=l{mK zh~br`5^T?%fX$i`Zr?1@umBN)H8>=m0G@fs`lz*mt)0XS(HL$LmQ4t}X?-Gn7!kyX zVpygu_Q8UuoseyhOuKk-_O%C7JK<8S?X69t8sey1zI4}VZBI+tlH3#q6vuCa-@+ZY z_=b)-XS1G-i0S-ik`*&zBTKA_{%I#dRq--7&?N;Ie0P?TU^0D5$n91cRa?vV*T-U5 z1z$8)LVAI?&hN$yuObc^5Ct}Q_%GU0rPhLT>>ZkHQgY-`%kg+#Qy;1GIr=NqhT8Xx zmlQ=#FBwuV@ijVxN$+;^eyDAv_$a@ zJ<(;hWT-O<3FjJ!WC(d>yZwwam1UYf3#Iq%JceZ_J-#!Io`=_3J-dI;Atkh9A`0lQ zi{FIH(ImyG6|Ok3`%1~Tw~a~t6M^7DXV83UZ;F~(?wuGm@}OI#vYvq)!2K;l^!~&U z8i0lJI$KMleL7>M8sA6q2RE~y)UqKy4BwlL-yH%$>N1%$`f?pQip-a{S;CaQyv(a6 z1uFts^JnmrctZa88z8BAiy9*UXCC>*9TwbOsN;u=AXYv^)+7uPw}^|uzgnuvBHA$% z$H-NoZkai&af>#oWro+hesv&@97Kd={TRltX~S~uVM2s8=aX#@DT_&e#KO2%yEUSU zyrNMYAa5`1)p}TL|H0wgclTNT2&~l zJzrWz{;js0fSVB+x)v(_2Ok1WsQ9c^{Won6dI?MnRf3RrHaSu3-XY$dB2u}bUsbRo zX|@)Zba@l8N7QfEnhaN|)_4?x$gr%R!u(VnZA?T2JsRga{rdQ;W!Ng;GhB-3RFSJn z6DZL8O5aB6qSv>w&4(t8Z~GJI@9v%cBbnDN33%#t+|G{;U;c z#BicEKbbM3HGA&QIE6{HK9=RUw>@>d+u;}OU2J>hgW5ia<(y5A!McVaIb_(k0*NCRK0UTBgVds8@6G-N6boBr9f$|@cLG>2yp=p-0lnp-=TT2_h^E6^!cHY8nn z-~6!KRPkU_u#@U)&d?~F_dyDtIranf zJPdfdA}7dsp4ldI;~YZp_?X?rtcTR^7KlUF4bKJQo5wXW&U zpl(2aEKuPCX~TxX2F$g3FM7qlbQm)W5V~cO4Ebo2B!P|W3ccGy6@_&(Q} zJuEj3x!K!`L2>7#f>iK8y*9v)bTRcS51jYw+Do|eHpS|3l$fZX7s-J(P0cV<(Ix0TnCAA!qZ$wCI#%tGSl>d1k9i>2BJa}lhzur)#d3tHWT&Vx@` z>){fu_q0PsWi40>`ZYX%)ik)Mw^X1ZAbN6*Br}{*>^FZWUxB-*+zme<``LgIh$=}v zp_DbnunhH~#y17Yfs4`K)DFr_@*bL!-|cX>OF!zWXsf3qM5bim`kzpGJ4F4EbsJ0< z+YuJ$X`PQXlUn?u-Mk$c6d zBioUb*A0n!>785S?49W#_0c=<+B!_1|NLto_T}8Je2N$i(i2Lk-<&kK#kkMrO&wOX zL$asz@HxJmRjh7V=#*2c+C!40?&EA}ws~K&mt0i^tfE4welghAuQy6 zVg1q)RC0+$!W&>p3=8I;WJkYvvJ`l{_3)NX=X(F>YhbIyk2x{6KBb80(HbJaIZm%C zTI~s{>p6KhXOg5lWHynWX!Fx_7#MR4vc@5E@CWNA^gc!1 zD(1PilRZ!R)-w_fX3srO10 zJ5+lDntX z55-)29xwOJME{ewSHbUpzpR7aac43Ml(_J(kdm~@q>Y721dCp!UOI@sSU4#~Y4V}aNX)ffYtxUI`Qt>W;xB@o^?-Rs#?}Oc$oE3eHBjL*H#r_Ty&y%h zlI|GRhQv#rTb!JDG(+ve_OS4E=cqFVO)r3><(~mo#@;`CpZMNtL701Bd8Gt4C}G3d zC{YdhtexvP{4LyIu-&fIgcuWDQSC@fXl@1j?Ke8EVw0;k>io?~FVocD!io*>e(me>q_DDC9b!(`;Yu=ttho8e7TCLkHDT&Nh6eMWztqZ6k{N8>ZgSq@R@w{x z<87z6A!6Q5aZpuF-hqP@JwbVHz3_h*X^ZcuH|u4CetqS#IYLONN-Jy2utIKc1=wu=F>8PabK-R^o7=Q5%lnXJ!iVUcsB8P<+hzLa3-!Js# zTlP%*H4Mm1jlfc)y7SOAR8(DU9l3#sLk$}ZCor9SsUI1-nj_*MJz0+1!dDLX$8TWf zmml9wU6=4ycUTK?m8bk2s(6ZCuJAh%R>BnR)da8QoE`{tw>yt3t=Qwg=Z~R=mhF9Z zE!abV4D2{G8l=$&5ApB0RppXvr(Ng?2ds}nK)LzgUaH!-YLO>fC0^CL^7hF-b9MLo zM+D2|ka?Dr8Kv}$ZKhJ=w09;*z7P5g<;9Sd zhvz?nTPxnl7|bm5<<~RXYcLmHP5@>Vy~)80X7h=oBX02))^uuJwl!~EXyBJ=dQd?8 z$P^vIUK!IGVsM*a255~5MF&?0(X{O1{~01`8}2w#RL~Qmzb2dvK0jgjKhHk^TR!C8 zfTJ7!b2;GBWTpgzw%L1hmx~%HyVL`)kznt{&|C9!aHzVBLn|4f)_rPd0$EmT;jiC#O;z6;W|@qiqqsUS-qN1V4o3q>Tn@I zJt5}e!e`z5X0A~DVyW9Rmg^*Bi7xG(t%Ze!yw9t{BTb&&xuaT@Jg7BnW~_cVcvH+v z_)MCWe-SCOAe+VrrwnvO{A~)9GL{WkU~Fs+IjOehLPHX2`h5^FwnxXXQRe>h{_(An zL*p1*1Y)w8ctsH&;yih*SeSgu+pgyC0$&n_?2ZTzvg^+s0WN9XG8bAJ@7I-PuF z`s~gQ89-!5Gsxk1EsN{%)o5D)fyhMBVF46MBJ&aWnzWAt?*9;0IxPJF89+72g}Kis zzxv{z2PwwCja!SD3pB_4_eB72f{SKwf${QDC{%_Xd${^5ixyzVXd>v>YXkVv5CGy# zcV%!{()a7a_g!#>0Dk3o+CP)h4bn0E^D^E99`5CY%aLq2@#@*p^jVbPF#RNWC%+Fk z3=2ohIz_>?RSQF!K9{BII64Y~&ms`U2!t&tA^-+4brm~peJWwFrSK|xnH${ccA+lQ zd5>MntY^J$0UjX4@{P6P87Pkj_~5TO|NnpgUjqLR5;!`5RAmb3#KiKa;oefc_uy`^ IlEt(C1MeTu7XSbN diff --git a/release-0.19.0/docs/proposals/federation.md b/release-0.19.0/docs/proposals/federation.md deleted file mode 100644 index a9792e5eb21..00000000000 --- a/release-0.19.0/docs/proposals/federation.md +++ /dev/null @@ -1,437 +0,0 @@ -#Kubernetes Cluster Federation -##(a.k.a. "Ubernetes") - -## Requirements Analysis and Product Proposal - -## _by Quinton Hoole ([quinton@google.com](mailto:quinton@google.com))_ -_Initial revision: 2015-03-05_ -_Last updated: 2015-03-09_ -This doc: [tinyurl.com/ubernetes](http://tinyurl.com/ubernetes) -Slides: [tinyurl.com/ubernetes-slides](http://tinyurl.com/ubernetes-slides) - -## Introduction - -Today, each Kubernetes cluster is a relatively self-contained unit, -which typically runs in a single "on-premise" data centre or single -availability zone of a cloud provider (Google's GCE, Amazon's AWS, -etc). - -Several current and potential Kubernetes users and customers have -expressed a keen interest in tying together ("federating") multiple -clusters in some sensible way in order to enable the following kinds -of use cases (intentionally vague): - -1. _"Preferentially run my workloads in my on-premise cluster(s), but - automatically overflow to my cloud-hosted cluster(s) if I run out - of on-premise capacity"_. -1. _"Most of my workloads should run in my preferred cloud-hosted - cluster(s), but some are privacy-sensitive, and should be - automatically diverted to run in my secure, on-premise - cluster(s)"_. -1. _"I want to avoid vendor lock-in, so I want my workloads to run - across multiple cloud providers all the time. I change my set of - such cloud providers, and my pricing contracts with them, - periodically"_. -1. _"I want to be immune to any single data centre or cloud - availability zone outage, so I want to spread my service across - multiple such zones (and ideally even across multiple cloud - providers)."_ - -The above use cases are by necessity left imprecisely defined. The -rest of this document explores these use cases and their implications -in further detail, and compares a few alternative high level -approaches to addressing them. The idea of cluster federation has -informally become known as_ "Ubernetes"_. - -## Summary/TL;DR - -TBD - -## What exactly is a Kubernetes Cluster? - -A central design concept in Kubernetes is that of a _cluster_. While -loosely speaking, a cluster can be thought of as running in a single -data center, or cloud provider availability zone, a more precise -definition is that each cluster provides: - -1. a single Kubernetes API entry point, -1. a consistent, cluster-wide resource naming scheme -1. a scheduling/container placement domain -1. a service network routing domain -1. (in future) an authentication and authorization model. -1. .... - -The above in turn imply the need for a relatively performant, reliable -and cheap network within each cluster. - -There is also assumed to be some degree of failure correlation across -a cluster, i.e. whole clusters are expected to fail, at least -occasionally (due to cluster-wide power and network failures, natural -disasters etc). Clusters are often relatively homogenous in that all -compute nodes are typically provided by a single cloud provider or -hardware vendor, and connected by a common, unified network fabric. -But these are not hard requirements of Kubernetes. - -Other classes of Kubernetes deployments than the one sketched above -are technically feasible, but come with some challenges of their own, -and are not yet common or explicitly supported. - -More specifically, having a Kubernetes cluster span multiple -well-connected availability zones within a single geographical region -(e.g. US North East, UK, Japan etc) is worthy of further -consideration, in particular because it potentially addresses -some of these requirements. - -## What use cases require Cluster Federation? - -Let's name a few concrete use cases to aid the discussion: - -## 1.Capacity Overflow - -_"I want to preferentially run my workloads in my on-premise cluster(s), but automatically "overflow" to my cloud-hosted cluster(s) when I run out of on-premise capacity."_ - -This idea is known in some circles as "[cloudbursting](http://searchcloudcomputing.techtarget.com/definition/cloud-bursting)". - -**Clarifying questions:** What is the unit of overflow? Individual - pods? Probably not always. Replication controllers and their - associated sets of pods? Groups of replication controllers - (a.k.a. distributed applications)? How are persistent disks - overflowed? Can the "overflowed" pods communicate with their - brethren and sistren pods and services in the other cluster(s)? - Presumably yes, at higher cost and latency, provided that they use - external service discovery. Is "overflow" enabled only when creating - new workloads/replication controllers, or are existing workloads - dynamically migrated between clusters based on fluctuating available - capacity? If so, what is the desired behaviour, and how is it - achieved? How, if at all, does this relate to quota enforcement - (e.g. if we run out of on-premise capacity, can all or only some - quotas transfer to other, potentially more expensive off-premise - capacity?) - -It seems that most of this boils down to: - -1. **location affinity** (pods relative to each other, and to other - stateful services like persistent storage - how is this expressed - and enforced?) -1. **cross-cluster scheduling** (given location affinity constraints - and other scheduling policy, which resources are assigned to which - clusters, and by what?) -1. **cross-cluster service discovery** (how do pods in one cluster - discover and communicate with pods in another cluster?) -1. **cross-cluster migration** (how do compute and storage resources, - and the distributed applications to which they belong, move from - one cluster to another) - -## 2. Sensitive Workloads - -_"I want most of my workloads to run in my preferred cloud-hosted -cluster(s), but some are privacy-sensitive, and should be -automatically diverted to run in my secure, on-premise cluster(s). The -list of privacy-sensitive workloads changes over time, and they're -subject to external auditing."_ - -**Clarifying questions:** What kinds of rules determine which - workloads go where? Is a static mapping from container (or more - typically, replication controller) to cluster maintained and - enforced? If so, is it only enforced on startup, or are things - migrated between clusters when the mappings change? This starts to - look quite similar to "1. Capacity Overflow", and again seems to - boil down to: - -1. location affinity -1. cross-cluster scheduling -1. cross-cluster service discovery -1. cross-cluster migration -with the possible addition of: - -+ cross-cluster monitoring and auditing (which is conveniently deemed - to be outside the scope of this document, for the time being at - least) - -## 3. Vendor lock-in avoidance - -_"My CTO wants us to avoid vendor lock-in, so she wants our workloads -to run across multiple cloud providers at all times. She changes our -set of preferred cloud providers and pricing contracts with them -periodically, and doesn't want to have to communicate and manually -enforce these policy changes across the organization every time this -happens. She wants it centrally and automatically enforced, monitored -and audited."_ - -**Clarifying questions:** Again, I think that this can potentially be - reformulated as a Capacity Overflow problem - the fundamental - principles seem to be the same or substantially similar to those - above. - -## 4. "Unavailability Zones" - -_"I want to be immune to any single data centre or cloud availability -zone outage, so I want to spread my service across multiple such zones -(and ideally even across multiple cloud providers), and have my -service remain available even if one of the availability zones or -cloud providers "goes down"_. - -It seems useful to split this into two sub use cases: - -1. Multiple availability zones within a single cloud provider (across - which feature sets like private networks, load balancing, - persistent disks, data snapshots etc are typically consistent and - explicitly designed to inter-operate). -1. Multiple cloud providers (typically with inconsistent feature sets - and more limited interoperability). - -The single cloud provider case might be easier to implement (although -the multi-cloud provider implementation should just work for a single -cloud provider). Propose high-level design catering for both, with -initial implementation targeting single cloud provider only. - -**Clarifying questions:** -**How does global external service discovery work?** In the steady - state, which external clients connect to which clusters? GeoDNS or - similar? What is the tolerable failover latency if a cluster goes - down? Maybe something like (make up some numbers, notwithstanding - some buggy DNS resolvers, TTL's, caches etc) ~3 minutes for ~90% of - clients to re-issue DNS lookups and reconnect to a new cluster when - their home cluster fails is good enough for most Kubernetes users - (or at least way better than the status quo), given that these sorts - of failure only happen a small number of times a year? - -**How does dynamic load balancing across clusters work, if at all?** - One simple starting point might be "it doesn't". i.e. if a service - in a cluster is deemed to be "up", it receives as much traffic as is - generated "nearby" (even if it overloads). If the service is deemed - to "be down" in a given cluster, "all" nearby traffic is redirected - to some other cluster within some number of seconds (failover could - be automatic or manual). Failover is essentially binary. An - improvement would be to detect when a service in a cluster reaches - maximum serving capacity, and dynamically divert additional traffic - to other clusters. But how exactly does all of this work, and how - much of it is provided by Kubernetes, as opposed to something else - bolted on top (e.g. external monitoring and manipulation of GeoDNS)? - -**How does this tie in with auto-scaling of services?** More - specifically, if I run my service across _n_ clusters globally, and - one (or more) of them fail, how do I ensure that the remaining _n-1_ - clusters have enough capacity to serve the additional, failed-over - traffic? Either: - -1. I constantly over-provision all clusters by 1/n (potentially expensive), or -1. I "manually" update my replica count configurations in the - remaining clusters by 1/n when the failure occurs, and Kubernetes - takes care of the rest for me, or -1. Auto-scaling (not yet available) in the remaining clusters takes - care of it for me automagically as the additional failed-over - traffic arrives (with some latency). -1. I manually specify "additional resources to be provisioned" per - remaining cluster, possibly proportional to both the remaining functioning resources - and the unavailable resources in the failed cluster(s). - (All the benefits of over-provisioning, without expensive idle resources.) - -Doing nothing (i.e. forcing users to choose between 1 and 2 on their -own) is probably an OK starting point. Kubernetes autoscaling can get -us to 3 at some later date. - -Up to this point, this use case ("Unavailability Zones") seems materially different from all the others above. It does not require dynamic cross-cluster service migration (we assume that the service is already running in more than one cluster when the failure occurs). Nor does it necessarily involve cross-cluster service discovery or location affinity. As a result, I propose that we address this use case somewhat independently of the others (although I strongly suspect that it will become substantially easier once we've solved the others). - -All of the above (regarding "Unavailibility Zones") refers primarily -to already-running user-facing services, and minimizing the impact on -end users of those services becoming unavailable in a given cluster. -What about the people and systems that deploy Kubernetes services -(devops etc)? Should they be automatically shielded from the impact -of the cluster outage? i.e. have their new resource creation requests -automatically diverted to another cluster during the outage? While -this specific requirement seems non-critical (manual fail-over seems -relatively non-arduous, ignoring the user-facing issues above), it -smells a lot like the first three use cases listed above ("Capacity -Overflow, Sensitive Services, Vendor lock-in..."), so if we address -those, we probably get this one free of charge. - -## Core Challenges of Cluster Federation - -As we saw above, a few common challenges fall out of most of the use -cases considered above, namely: - -## Location Affinity - -Can the pods comprising a single distributed application be -partitioned across more than one cluster? More generally, how far -apart, in network terms, can a given client and server within a -distributed application reasonably be? A server need not necessarily -be a pod, but could instead be a persistent disk housing data, or some -other stateful network service. What is tolerable is typically -application-dependent, primarily influenced by network bandwidth -consumption, latency requirements and cost sensitivity. - -For simplicity, lets assume that all Kubernetes distributed -applications fall into one of three categories with respect to relative -location affinity: - -1. **"Strictly Coupled"**: Those applications that strictly cannot be - partitioned between clusters. They simply fail if they are - partitioned. When scheduled, all pods _must_ be scheduled to the - same cluster. To move them, we need to shut the whole distributed - application down (all pods) in one cluster, possibly move some - data, and then bring the up all of the pods in another cluster. To - avoid downtime, we might bring up the replacement cluster and - divert traffic there before turning down the original, but the - principle is much the same. In some cases moving the data might be - prohibitively expensive or time-consuming, in which case these - applications may be effectively _immovable_. -1. **"Strictly Decoupled"**: Those applications that can be - indefinitely partitioned across more than one cluster, to no - disadvantage. An embarrassingly parallel YouTube porn detector, - where each pod repeatedly dequeues a video URL from a remote work - queue, downloads and chews on the video for a few hours, and - arrives at a binary verdict, might be one such example. The pods - derive no benefit from being close to each other, or anything else - (other than the source of YouTube videos, which is assumed to be - equally remote from all clusters in this example). Each pod can be - scheduled independently, in any cluster, and moved at any time. -1. **"Preferentially Coupled"**: Somewhere between Coupled and Decoupled. These applications prefer to have all of their pods located in the same cluster (e.g. for failure correlation, network latency or bandwidth cost reasons), but can tolerate being partitioned for "short" periods of time (for example while migrating the application from one cluster to another). Most small to medium sized LAMP stacks with not-very-strict latency goals probably fall into this category (provided that they use sane service discovery and reconnect-on-fail, which they need to do anyway to run effectively, even in a single Kubernetes cluster). - -And then there's what I'll call _absolute_ location affinity. Some -applications are required to run in bounded geographical or network -topology locations. The reasons for this are typically -political/legislative (data privacy laws etc), or driven by network -proximity to consumers (or data providers) of the application ("most -of our users are in Western Europe, U.S. West Coast" etc). - -**Proposal:** First tackle Strictly Decoupled applications (which can - be trivially scheduled, partitioned or moved, one pod at a time). - Then tackle Preferentially Coupled applications (which must be - scheduled in totality in a single cluster, and can be moved, but - ultimately in total, and necessarily within some bounded time). - Leave strictly coupled applications to be manually moved between - clusters as required for the foreseeable future. - -## Cross-cluster service discovery - -I propose having pods use standard discovery methods used by external clients of Kubernetes applications (i.e. DNS). DNS might resolve to a public endpoint in the local or a remote cluster. Other than Strictly Coupled applications, software should be largely oblivious of which of the two occurs. -_Aside:_ How do we avoid "tromboning" through an external VIP when DNS -resolves to a public IP on the local cluster? Strictly speaking this -would be an optimization, and probably only matters to high bandwidth, -low latency communications. We could potentially eliminate the -trombone with some kube-proxy magic if necessary. More detail to be -added here, but feel free to shoot down the basic DNS idea in the mean -time. - -## Cross-cluster Scheduling - -This is closely related to location affinity above, and also discussed -there. The basic idea is that some controller, logically outside of -the basic kubernetes control plane of the clusters in question, needs -to be able to: - -1. Receive "global" resource creation requests. -1. Make policy-based decisions as to which cluster(s) should be used - to fulfill each given resource request. In a simple case, the - request is just redirected to one cluster. In a more complex case, - the request is "demultiplexed" into multiple sub-requests, each to - a different cluster. Knowledge of the (albeit approximate) - available capacity in each cluster will be required by the - controller to sanely split the request. Similarly, knowledge of - the properties of the application (Location Affinity class -- - Strictly Coupled, Strictly Decoupled etc, privacy class etc) will - be required. -1. Multiplex the responses from the individual clusters into an - aggregate response. - -## Cross-cluster Migration - -Again this is closely related to location affinity discussed above, -and is in some sense an extension of Cross-cluster Scheduling. When -certain events occur, it becomes necessary or desirable for the -cluster federation system to proactively move distributed applications -(either in part or in whole) from one cluster to another. Examples of -such events include: - -1. A low capacity event in a cluster (or a cluster failure). -1. A change of scheduling policy ("we no longer use cloud provider X"). -1. A change of resource pricing ("cloud provider Y dropped their prices - lets migrate there"). - -Strictly Decoupled applications can be trivially moved, in part or in whole, one pod at a time, to one or more clusters. -For Preferentially Decoupled applications, the federation system must first locate a single cluster with sufficient capacity to accommodate the entire application, then reserve that capacity, and incrementally move the application, one (or more) resources at a time, over to the new cluster, within some bounded time period (and possibly within a predefined "maintenance" window). -Strictly Coupled applications (with the exception of those deemed -completely immovable) require the federation system to: - -1. start up an entire replica application in the destination cluster -1. copy persistent data to the new application instance -1. switch traffic across -1. tear down the original application instance - -It is proposed that support for automated migration of Strictly Coupled applications be -deferred to a later date. - -## Other Requirements - -These are often left implicit by customers, but are worth calling out explicitly: - -1. Software failure isolation between Kubernetes clusters should be - retained as far as is practically possible. The federation system - should not materially increase the failure correlation across - clusters. For this reason the federation system should ideally be - completely independent of the Kubernetes cluster control software, - and look just like any other Kubernetes API client, with no special - treatment. If the federation system fails catastrophically, the - underlying Kubernetes clusters should remain independently usable. -1. Unified monitoring, alerting and auditing across federated Kubernetes clusters. -1. Unified authentication, authorization and quota management across - clusters (this is in direct conflict with failure isolation above, - so there are some tough trade-offs to be made here). - -## Proposed High-Level Architecture - -TBD: All very hand-wavey still, but some initial thoughts to get the conversation going... - -![image](federation-high-level-arch.png) - -## Ubernetes API - -This looks a lot like the existing Kubernetes API but is explicitly multi-cluster. - -+ Clusters become first class objects, which can be registered, listed, described, deregistered etc via the API. -+ Compute resources can be explicitly requested in specific clusters, or automatically scheduled to the "best" cluster by Ubernetes (by a pluggable Policy Engine). -+ There is a federated equivalent of a replication controller type, which is multicluster-aware, and delegates to cluster-specific replication controllers as required (e.g. a federated RC for n replicas might simply spawn multiple replication controllers in different clusters to do the hard work). -+ These federated replication controllers (and in fact all the - services comprising the Ubernetes Control Plane) have to run - somewhere. For high availability Ubernetes deployments, these - services may run in a dedicated Kubernetes cluster, not physically - co-located with any of the federated clusters. But for simpler - deployments, they may be run in one of the federated clusters (but - when that cluster goes down, Ubernetes is down, obviously). - -## Policy Engine and Migration/Replication Controllers - -The Policy Engine decides which parts of each application go into each -cluster at any point in time, and stores this desired state in the -Desired Federation State store (an etcd or -similar). Migration/Replication Controllers reconcile this against the -desired states stored in the underlying Kubernetes clusters (by -watching both, and creating or updating the underlying Replication -Controllers and related Services accordingly). - -## Authentication and Authorization - -This should ideally be delegated to some external auth system, shared -by the underlying clusters, to avoid duplication and inconsistency. -Either that, or we end up with multilevel auth. Local readonly -eventually consistent auth slaves in each cluster and in Ubernetes -could potentially cache auth, to mitigate an SPOF auth system. - -## Proposed Next Steps - -Identify concrete applications of each use case and configure a proof -of concept service that exercises the use case. For example, cluster -failure tolerance seems popular, so set up an apache frontend with -replicas in each of three availability zones with either an Amazon Elastic -Load Balancer or Google Cloud Load Balancer pointing at them? What -does the zookeeper config look like for N=3 across 3 AZs -- and how -does each replica find the other replicas and how do clients find -their primary zookeeper replica? And now how do I do a shared, highly -available redis database? - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/proposals/federation.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/proposals/federation.md?pixel)]() diff --git a/release-0.19.0/docs/proposals/high-availability.md b/release-0.19.0/docs/proposals/high-availability.md deleted file mode 100644 index 679ed9f3a74..00000000000 --- a/release-0.19.0/docs/proposals/high-availability.md +++ /dev/null @@ -1,52 +0,0 @@ -# High Availability of Scheduling and Controller Components in Kubernetes -This document serves as a proposal for high availability of the scheduler and controller components in kubernetes. This proposal is intended to provide a simple High Availability api for kubernetes components with the potential to extend to services running on kubernetes. Those services would be subject to their own constraints. - -## Design Options -For complete reference see [this](https://www.ibm.com/developerworks/community/blogs/RohitShetty/entry/high_availability_cold_warm_hot?lang=en) - -1. Hot Standby: In this scenario, data and state are shared between the two components such that an immediate failure in one component causes the the standby deamon to take over exactly where the failed component had left off. This would be an ideal solution for kubernetes, however it poses a series of challenges in the case of controllers where component-state is cached locally and not persisted in a transactional way to a storage facility. This would also introduce additional load on the apiserver, which is not desirable. As a result, we are **NOT** planning on this approach at this time. - -2. **Warm Standby**: In this scenario there is only one active component acting as the master and additional components running but not providing service or responding to requests. Data and state are not shared between the active and standby components. When a failure occurs, the standby component that becomes the master must determine the current state of the system before resuming functionality. This is the apprach that this proposal will leverage. - -3. Active-Active (Load Balanced): Clients can simply load-balance across any number of servers that are currently running. Their general availability can be continuously updated, or published, such that load balancing only occurs across active participants. This aspect of HA is outside of the scope of *this* proposal because there is already a partial implementation in the apiserver. - -## Design Discussion Notes on Leader Election -Implementation References: -* [zookeeper](http://zookeeper.apache.org/doc/trunk/recipes.html#sc_leaderElection) -* [etcd](https://groups.google.com/forum/#!topic/etcd-dev/EbAa4fjypb4) -* [initialPOC](https://github.com/rrati/etcd-ha) - -In HA, the apiserver will provide an api for sets of replicated clients to do master election: acquire the lease, renew the lease, and release the lease. This api is component agnostic, so a client will need to provide the component type and the lease duration when attemping to become master. The lease duration should be tuned per component. The apiserver will attempt to create a key in etcd based on the component type that contains the client's hostname/ip and port information. This key will be created with a ttl from the lease duration provided in the request. Failure to create this key means there is already a master of that component type, and the error from etcd will propigate to the client. Successfully creating the key means the client making the request is the master. Only the current master can renew the lease. When renewing the lease, the apiserver will update the existing key with a new ttl. The location in etcd for the HA keys is TBD. - -The first component to request leadership will become the master. All other components of that type will fail until the current leader releases the lease, or fails to renew the lease within the expiration time. On startup, all components should attempt to become master. The component that succeeds becomes the master, and should perform all functions of that component. The components that fail to become the master should not perform any tasks and sleep for their lease duration and then attempt to become the master again. A clean shutdown of the leader will cause a release of the lease and a new master will be elected. - -The component that becomes master should create a thread to manage the lease. This thread should be created with a channel that the main process can use to release the master lease. The master should release the lease in cases of an unrecoverable error and clean shutdown. Otherwise, this process will renew the lease and sleep, waiting for the next renewal time or notification to release the lease. If there is a failure to renew the lease, this process should force the entire component to exit. Daemon exit is meant to prevent potential split-brain conditions. Daemon restart is implied in this scenario, by either the init system (systemd), or possible watchdog processes. (See Design Discussion Notes) - -## Options added to components with HA functionality -Some command line options would be added to components that can do HA: - -* Lease Duration - How long a component can be master - -## Design Discussion Notes -Some components may run numerous threads in order to perform tasks in parallel. Upon losing master status, such components should exit instantly instead of attempting to gracefully shut down such threads. This is to ensure that, in the case there's some propagation delay in informing the threads they should stop, the lame-duck threads won't interfere with the new master. The component should exit with an exit code indicating that the component is not the master. Since all components will be run by systemd or some other monitoring system, this will just result in a restart. - -There is a short window after a new master acquires the lease, during which data from the old master might be committed. This is because there is currently no way to condition a write on its source being the master. Having the daemons exit shortens this window but does not eliminate it. A proper solution for this problem will be addressed at a later date. The proposed solution is: - -1. This requires transaction support in etcd (which is already planned - see [coreos/etcd#2675](https://github.com/coreos/etcd/pull/2675)) - -2. The entry in etcd that is tracking the lease for a given component (the "current master" entry) would have as its value the host:port of the lease-holder (as described earlier) and a sequence number. The sequence number is incremented whenever a new master gets the lease. - -3. Master replica is aware of the latest sequence number. - -4. Whenever master replica sends a mutating operation to the API server, it includes the sequence number. - -5. When the API server makes the corresponding write to etcd, it includes it in a transaction that does a compare-and-swap on the "current master" entry (old value == new value == host:port and sequence number from the replica that sent the mutating operation). This basically guarantees that if we elect the new master, all transactions coming from the old master will fail. You can think of this as the master attaching a "precondition" of its belief about who is the latest master. - -## Open Questions: -* Is there a desire to keep track of all nodes for a specific component type? - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/proposals/high-availability.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/proposals/high-availability.md?pixel)]() diff --git a/release-0.19.0/docs/replication-controller.md b/release-0.19.0/docs/replication-controller.md deleted file mode 100644 index 646aeab6a62..00000000000 --- a/release-0.19.0/docs/replication-controller.md +++ /dev/null @@ -1,71 +0,0 @@ -# Replication Controller - -## What is a _replication controller_? - -A _replication controller_ ensures that a specified number of pod "replicas" are running at any one time. If there are too many, it will kill some. If there are too few, it will start more. Unlike in the case where a user directly created pods, a replication controller replaces pods that are deleted or terminated for any reason, such as in the case of node failure or disruptive node maintenance, such as a kernel upgrade. For this reason, we recommend that you use a replication controller even if your application requires only a single pod. Think of it similarly to a process supervisor, only it supervises multiple pods across multiple nodes instead of individual processes on a single node. A replication controller delegates local container restarts to some agent on the node (e.g., Kubelet or Docker). - -As discussed in [life of a pod](pod-states.md), `ReplicationController` is *only* appropriate for pods with `RestartPolicy = Always` (Note: If `RestartPolicy` is not set, the default value is `Always`.). `ReplicationController` should refuse to instantiate any pod that has a different restart policy. As discussed in [issue #503](https://github.com/GoogleCloudPlatform/kubernetes/issues/503#issuecomment-50169443), we expect other types of controllers to be added to Kubernetes to handle other types of workloads, such as build/test and batch workloads, in the future. - -A replication controller will never terminate on its own, but it isn't expected to be as long-lived as services. Services may be composed of pods controlled by multiple replication controllers, and it is expected that many replication controllers may be created and destroyed over the lifetime of a service. Both services themselves and their clients should remain oblivious to the replication controllers that maintain the pods of the services. - -## How does a replication controller work? - -### Pod template - -A replication controller creates new pods from a template, which is currently inline in the `ReplicationController` object, but which we plan to extract into its own resource [#170](https://github.com/GoogleCloudPlatform/kubernetes/issues/170). - -Rather than specifying the current desired state of all replicas, pod templates are like cookie cutters. Once a cookie has been cut, the cookie has no relationship to the cutter. There is no quantum entanglement. Subsequent changes to the template or even switching to a new template has no direct effect on the pods already created. Similarly, pods created by a replication controller may subsequently be updated directly. This is in deliberate contrast to pods, which do specify the current desired state of all containers belonging to the pod. This approach radically simplifies system semantics and increases the flexibility of the primitive, as demonstrated by the use cases explained below. - -Pods created by a replication controller are intended to be fungible and semantically identical, though their configurations may become heterogeneous over time. This is an obvious fit for replicated stateless servers, but replication controllers can also be used to maintain availability of master-elected, sharded, and worker-pool applications. Such applications should use dynamic work assignment mechanisms, such as the [etcd lock module](https://coreos.com/docs/distributed-configuration/etcd-modules/) or [RabbitMQ work queues](https://www.rabbitmq.com/tutorials/tutorial-two-python.html), as opposed to static/one-time customization of the configuration of each pod, which is considered an anti-pattern. Any pod customization performed, such as vertical auto-sizing of resources (e.g., cpu or memory), should be performed by another online controller process, not unlike the replication controller itself. - -### Labels - -The population of pods that a `ReplicationController` is monitoring is defined with a [label selector](labels.md), which creates a loosely coupled relationship between the controller and the pods controlled, in contrast to pods, which are more tightly coupled. We deliberately chose not to represent the set of pods controlled using a fixed-length array of pod specifications, because our experience is that that approach increases complexity of management operations, for both clients and the system. - -The replication controller should verify that the pods created from the specified template have labels that match its label selector. Though it isn't verified yet, you should also ensure that only one replication controller controls any given pod, by ensuring that the label selectors of replication controllers do not target overlapping sets. - -Note that `ReplicationController`s may themselves have labels and would generally carry the labels their corresponding pods have in common, but these labels do not affect the behavior of the replication controllers. - -Pods may be removed from a replication controller's target set by changing their labels. This technique may be used to remove pods from service for debugging, data recovery, etc. Pods that are removed in this way will be replaced automatically (assuming that the number of replicas is not also changed). - -Similarly, deleting a replication controller does not affect the pods it created. Its `replicas` field must first be set to 0 in order to delete the pods controlled. In the future, we may provide a feature to do this and the deletion in a single client operation. - -## Responsibilities of the replication controller - -The replication controller simply ensures that the desired number of pods matches its label selector and are operational. Currently, only terminated pods are excluded from its count. In the future, [readiness](https://github.com/GoogleCloudPlatform/kubernetes/issues/620) and other information available from the system may be taken into account, we may add more controls over the replacement policy, and we plan to emit events that could be used by external clients to implement arbitrarily sophisticated replacement and/or scale-down policies. - -The replication controller is forever constrained to this narrow responsibility. It itself will not perform readiness nor liveness probes. Rather than performing auto-scaling, it is intended to be controlled by an external auto-scaler (as discussed in [#492](https://github.com/GoogleCloudPlatform/kubernetes/issues/492)), which would change its `replicas` field. We will not add scheduling policies (e.g., [spreading](https://github.com/GoogleCloudPlatform/kubernetes/issues/367#issuecomment-48428019)) to the replication controller. Nor should it verify that the pods controlled match the currently specified template, as that would obstruct auto-sizing and other automated processes. Similarly, completion deadlines, ordering dependencies, configuration expansion, and other features belong elsewhere. We even plan to factor out the mechanism for bulk pod creation ([#170](https://github.com/GoogleCloudPlatform/kubernetes/issues/170)). - -The replication controller is intended to be a composable building-block primitive. We expect higher-level APIs and/or tools to be built on top of it and other complementary primitives for user convenience in the future. The "macro" operations currently supported by kubectl (run, stop, scale, rolling-update) are proof-of-concept examples of this. For instance, we could imagine something like [Asgard](http://techblog.netflix.com/2012/06/asgard-web-based-cloud-management-and.html) managing replication controllers, auto-scalers, services, scheduling policies, canaries, etc. - -## Common usage patterns - -### Rescheduling - -As mentioned above, whether you have 1 pod you want to keep running, or 1000, a replication controller will ensure that the specified number of pods exists, even in the event of node failure or pod termination (e.g., due to an action by another control agent). - -### Scaling - -The replication controller makes it easy to scale the number of replicas up or down, either manually or by an auto-scaling control agent, by simply updating the `replicas` field. - -### Rolling updates - -The replication controller is designed to facilitate rolling updates to a service by replacing pods one-by-one. - -As explained in [#1353](https://github.com/GoogleCloudPlatform/kubernetes/issues/1353), the recommended approach is to create a new replication controller with 1 replica, scale the new (+1) and old (-1) controllers one by one, and then delete the old controller after it reaches 0 replicas. This predictably updates the set of pods regardless of unexpected failures. - -Ideally, the rolling update controller would take application readiness into account, and would ensure that a sufficient number of pods were productively serving at any given time. - -The two replication controllers would need to create pods with at least one differentiating label, such as the image tag of the primary container of the pod, since it is typically image updates that motivate rolling updates. - -### Multiple release tracks - -In addition to running multiple releases of an application while a rolling update is in progress, it's common to run multiple releases for an extended period of time, or even continuously, using multiple release tracks. The tracks would be differentiated by labels. - -For instance, a service might target all pods with `tier in (frontend), environment in (prod)`. Now say you have 10 replicated pods that make up this tier. But you want to be able to 'canary' a new version of this component. You could set up a `ReplicationController` with `replicas` set to 9 for the bulk of the replicas, with labels `tier=frontend, environment=prod, track=stable`, and another `ReplicationController` with `replicas` set to 1 for the canary, with labels `tier=frontend, environment=prod, track=canary`. Now the service is covering both the canary and non-canary pods. But you can mess with the `ReplicationController`s separately to test things out, monitor the results, etc. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/replication-controller.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/replication-controller.md?pixel)]() diff --git a/release-0.19.0/docs/resource_quota_admin.md b/release-0.19.0/docs/resource_quota_admin.md deleted file mode 100644 index 59b08dc4efe..00000000000 --- a/release-0.19.0/docs/resource_quota_admin.md +++ /dev/null @@ -1,107 +0,0 @@ -# Administering Resource Quotas - -Kubernetes can limit both the number of objects created in a namespace, and the -total amount of resources requested by pods in a namespace. This facilitates -sharing of a single Kubernetes cluster by several teams or tenants, each in -a namespace. - -## Enabling Resource Quota - -Resource Quota support is enabled by default for many kubernetes distributions. It is -enabled when the apiserver `--admission_control=` flag has `ResourceQuota` as -one of its arguments. - -Resource Quota is enforced in a particular namespace when there is a -`ResourceQuota` object in that namespace. There should be at most one -`ResourceQuota` object in a namespace. - -## Object Count Quota -The number of objects of a given type can be restricted. The following types -are supported: - -| ResourceName | Description | -| ------------ | ----------- | -| pods | Total number of pods | -| services | Total number of services | -| replicationcontrollers | Total number of replication controllers | -| resourcequotas | Total number of resource quotas | -| secrets | Total number of secrets | -| persistentvolumeclaims | Total number of persistent volume claims | - -For example, `pods` quota counts and enforces a maximum on the number of `pods` -created in a single namespace. - -## Compute Resource Quota -The total number of objects of a given type can be restricted. The following types -are supported: - -| ResourceName | Description | -| ------------ | ----------- | -| cpu | Total cpu limits of containers | -| memory | Total memory usage limits of containers -| `example.com/customresource` | Total of `resources.limits."example.com/customresource"` of containers | - -For example, `cpu` quota sums up the `resources.limits.cpu` fields of every -container of every pod in the namespace, and enforces a maximum on that sum. - -Any resource that is not part of core Kubernetes must follow the resource naming convention prescribed by Kubernetes. - -This means the resource must have a fully-qualified name (i.e. mycompany.org/shinynewresource) - -## Viewing and Setting Quotas -Kubectl supports creating, updating, and viewing quotas -``` -$ kubectl namespace myspace -$ cat < quota.json -{ - "apiVersion": "v1", - "kind": "ResourceQuota", - "metadata": { - "name": "quota", - }, - "spec": { - "hard": { - "memory": "1Gi", - "cpu": "20", - "pods": "10", - "services": "5", - "replicationcontrollers":"20", - "resourcequotas":"1", - }, - } -} -EOF -$ kubectl create -f quota.json -$ kubectl get quota -NAME -quota -$ kubectl describe quota quota -Name: quota -Resource Used Hard --------- ---- ---- -cpu 0m 20 -memory 0 1Gi -pods 5 10 -replicationcontrollers 5 20 -resourcequotas 1 1 -services 3 5 -``` - -## Quota and Cluster Capacity -Resource Quota objects are independent of the Cluster Capacity. They are -expressed in absolute units. - -Sometimes more complex policies may be desired, such as: - - proportionally divide total cluster resources among several teams. - - allow each tenant to grow resource usage as needed, but have a generous - limit to prevent accidental resource exhaustion. - -Such policies could be implemented using ResourceQuota as a building-block, by -writing a controller which watches the quota usage and adjusts the quota -hard limits of each namespace. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/resource_quota_admin.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/resource_quota_admin.md?pixel)]() diff --git a/release-0.19.0/docs/resources.md b/release-0.19.0/docs/resources.md deleted file mode 100644 index ae98d4709d2..00000000000 --- a/release-0.19.0/docs/resources.md +++ /dev/null @@ -1,214 +0,0 @@ -**Note that the model described in this document has not yet been implemented. The tracking issue for implementation of this model is [#168](https://github.com/GoogleCloudPlatform/kubernetes/issues/168). Currently, only memory and cpu limits on containers (not pods) are supported. "memory" is in bytes and "cpu" is in milli-cores.** - -# The Kubernetes resource model - -To do good pod placement, Kubernetes needs to know how big pods are, as well as the sizes of the nodes onto which they are being placed. The definition of "how big" is given by the Kubernetes resource model - the subject of this document. - -The resource model aims to be: -* simple, for common cases; -* extensible, to accommodate future growth; -* regular, with few special cases; and -* precise, to avoid misunderstandings and promote pod portability. - -## The resource model -A Kubernetes _resource_ is something that can be requested by, allocated to, or consumed by a pod or container. Examples include memory (RAM), CPU, disk-time, and network bandwidth. - -Once resources on a node have been allocated to one pod, they should not be allocated to another until that pod is removed or exits. This means that Kubernetes schedulers should ensure that the sum of the resources allocated (requested and granted) to its pods never exceeds the usable capacity of the node. Testing whether a pod will fit on a node is called _feasibility checking_. - -Note that the resource model currently prohibits over-committing resources; we will want to relax that restriction later. - -### Resource types - -All resources have a _type_ that is identified by their _typename_ (a string, e.g., "memory"). Several resource types are predefined by Kubernetes (a full list is below), although only two will be supported at first: CPU and memory. Users and system administrators can define their own resource types if they wish (e.g., Hadoop slots). - -A fully-qualified resource typename is constructed from a DNS-style _subdomain_, followed by a slash `/`, followed by a name. -* The subdomain must conform to [RFC 1123](http://www.ietf.org/rfc/rfc1123.txt) (e.g., `kubernetes.io`, `example.com`). -* The name must be not more than 63 characters, consisting of upper- or lower-case alphanumeric characters, with the `-`, `_`, and `.` characters allowed anywhere except the first or last character. -* As a shorthand, any resource typename that does not start with a subdomain and a slash will automatically be prefixed with the built-in Kubernetes _namespace_, `kubernetes.io/` in order to fully-qualify it. This namespace is reserved for code in the open source Kubernetes repository; as a result, all user typenames MUST be fully qualified, and cannot be created in this namespace. - -Some example typenames include `memory` (which will be fully-qualified as `kubernetes.io/memory`), and `example.com/Shiny_New-Resource.Type`. - -For future reference, note that some resources, such as CPU and network bandwidth, are _compressible_, which means that their usage can potentially be throttled in a relatively benign manner. All other resources are _incompressible_, which means that any attempt to throttle them is likely to cause grief. This distinction will be important if a Kubernetes implementation supports over-committing of resources. - -### Resource quantities - -Initially, all Kubernetes resource types are _quantitative_, and have an associated _unit_ for quantities of the associated resource (e.g., bytes for memory, bytes per seconds for bandwidth, instances for software licences). The units will always be a resource type's natural base units (e.g., bytes, not MB), to avoid confusion between binary and decimal multipliers and the underlying unit multiplier (e.g., is memory measured in MiB, MB, or GB?). - -Resource quantities can be added and subtracted: for example, a node has a fixed quantity of each resource type that can be allocated to pods/containers; once such an allocation has been made, the allocated resources cannot be made available to other pods/containers without over-committing the resources. - -To make life easier for people, quantities can be represented externally as unadorned integers, or as fixed-point integers with one of these SI suffices (E, P, T, G, M, K, m) or their power-of-two equivalents (Ei, Pi, Ti, Gi, Mi, Ki). For example, the following represent roughly the same value: 128974848, "129e6", "129M" , "123Mi". Small quantities can be represented directly as decimals (e.g., 0.3), or using milli-units (e.g., "300m"). - * "Externally" means in user interfaces, reports, graphs, and in JSON or YAML resource specifications that might be generated or read by people. - * Case is significant: "m" and "M" are not the same, so "k" is not a valid SI suffix. There are no power-of-two equivalents for SI suffixes that represent multipliers less than 1. - * These conventions only apply to resource quantities, not arbitrary values. - -Internally (i.e., everywhere else), Kubernetes will represent resource quantities as integers so it can avoid problems with rounding errors, and will not use strings to represent numeric values. To achieve this, quantities that naturally have fractional parts (e.g., CPU seconds/second) will be scaled to integral numbers of milli-units (e.g., milli-CPUs) as soon as they are read in. Internal APIs, data structures, and protobufs will use these scaled integer units. Raw measurement data such as usage may still need to be tracked and calculated using floating point values, but internally they should be rescaled to avoid some values being in milli-units and some not. - * Note that reading in a resource quantity and writing it out again may change the way its values are represented, and truncate precision (e.g., 1.0001 may become 1.000), so comparison and difference operations (e.g., by an updater) must be done on the internal representations. - * Avoiding milli-units in external representations has advantages for people who will use Kubernetes, but runs the risk of developers forgetting to rescale or accidentally using floating-point representations. That seems like the right choice. We will try to reduce the risk by providing libraries that automatically do the quantization for JSON/YAML inputs. - -### Resource specifications - -Both users and a number of system components, such as schedulers, (horizontal) auto-scalers, (vertical) auto-sizers, load balancers, and worker-pool managers need to reason about resource requirements of workloads, resource capacities of nodes, and resource usage. Kubernetes divides specifications of *desired state*, aka the Spec, and representations of *current state*, aka the Status. Resource requirements and total node capacity fall into the specification category, while resource usage, characterizations derived from usage (e.g., maximum usage, histograms), and other resource demand signals (e.g., CPU load) clearly fall into the status category and are discussed in the Appendix for now. - -Resource requirements for a container or pod should have the following form: -``` -resourceRequirementSpec: [ - request: [ cpu: 2.5, memory: "40Mi" ], - limit: [ cpu: 4.0, memory: "99Mi" ], -] -``` -Where: -* _request_ [optional]: the amount of resources being requested, or that were requested and have been allocated. Scheduler algorithms will use these quantities to test feasibility (whether a pod will fit onto a node). If a container (or pod) tries to use more resources than its _request_, any associated SLOs are voided - e.g., the program it is running may be throttled (compressible resource types), or the attempt may be denied. If _request_ is omitted for a container, it defaults to _limit_ if that is explicitly specified, otherwise to an implementation-defined value; this will always be 0 for a user-defined resource type. If _request_ is omitted for a pod, it defaults to the sum of the (explicit or implicit) _request_ values for the containers it encloses. - -* _limit_ [optional]: an upper bound or cap on the maximum amount of resources that will be made available to a container or pod; if a container or pod uses more resources than its _limit_, it may be terminated. The _limit_ defaults to "unbounded"; in practice, this probably means the capacity of an enclosing container, pod, or node, but may result in non-deterministic behavior, especially for memory. - -Total capacity for a node should have a similar structure: -``` -resourceCapacitySpec: [ - total: [ cpu: 12, memory: "128Gi" ] -] -``` -Where: -* _total_: the total allocatable resources of a node. Initially, the resources at a given scope will bound the resources of the sum of inner scopes. - -#### Notes - - * It is an error to specify the same resource type more than once in each list. - - * It is an error for the _request_ or _limit_ values for a pod to be less than the sum of the (explicit or defaulted) values for the containers it encloses. (We may relax this later.) - - * If multiple pods are running on the same node and attempting to use more resources than they have requested, the result is implementation-defined. For example: unallocated or unused resources might be spread equally across claimants, or the assignment might be weighted by the size of the original request, or as a function of limits, or priority, or the phase of the moon, perhaps modulated by the direction of the tide. Thus, although it's not mandatory to provide a _request_, it's probably a good idea. (Note that the _request_ could be filled in by an automated system that is observing actual usage and/or historical data.) - - * Internally, the Kubernetes master can decide the defaulting behavior and the kubelet implementation may expected an absolute specification. For example, if the master decided that "the default is unbounded" it would pass 2^64 to the kubelet. - - - -## Kubernetes-defined resource types -The following resource types are predefined ("reserved") by Kubernetes in the `kubernetes.io` namespace, and so cannot be used for user-defined resources. Note that the syntax of all resource types in the resource spec is deliberately similar, but some resource types (e.g., CPU) may receive significantly more support than simply tracking quantities in the schedulers and/or the Kubelet. - -### Processor cycles - * Name: `cpu` (or `kubernetes.io/cpu`) - * Units: Kubernetes Compute Unit seconds/second (i.e., CPU cores normalized to a canonical "Kubernetes CPU") - * Internal representation: milli-KCUs - * Compressible? yes - * Qualities: this is a placeholder for the kind of thing that may be supported in the future -- see [#147](https://github.com/GoogleCloudPlatform/kubernetes/issues/147) - * [future] `schedulingLatency`: as per lmctfy - * [future] `cpuConversionFactor`: property of a node: the speed of a CPU core on the node's processor divided by the speed of the canonical Kubernetes CPU (a floating point value; default = 1.0). - -To reduce performance portability problems for pods, and to avoid worse-case provisioning behavior, the units of CPU will be normalized to a canonical "Kubernetes Compute Unit" (KCU, pronounced ˈkoÍokoÍžo), which will roughly be equivalent to a single CPU hyperthreaded core for some recent x86 processor. The normalization may be implementation-defined, although some reasonable defaults will be provided in the open-source Kubernetes code. - -Note that requesting 2 KCU won't guarantee that precisely 2 physical cores will be allocated - control of aspects like this will be handled by resource _qualities_ (a future feature). - - -### Memory - * Name: `memory` (or `kubernetes.io/memory`) - * Units: bytes - * Compressible? no (at least initially) - -The precise meaning of what "memory" means is implementation dependent, but the basic idea is to rely on the underlying `memcg` mechanisms, support, and definitions. - -Note that most people will want to use power-of-two suffixes (Mi, Gi) for memory quantities -rather than decimal ones: "64MiB" rather than "64MB". - - -## Resource metadata -A resource type may have an associated read-only ResourceType structure, that contains metadata about the type. For example: -``` -resourceTypes: [ - "kubernetes.io/memory": [ - isCompressible: false, ... - ] - "kubernetes.io/cpu": [ - isCompressible: true, internalScaleExponent: 3, ... - ] - "kubernetes.io/disk-space": [ ... } -] -``` - -Kubernetes will provide ResourceType metadata for its predefined types. If no resource metadata can be found for a resource type, Kubernetes will assume that it is a quantified, incompressible resource that is not specified in milli-units, and has no default value. - -The defined properties are as follows: - -| field name | type | contents | -| ---------- | ---- | -------- | -| name | string, required | the typename, as a fully-qualified string (e.g., `kubernetes.io/cpu`) | -| internalScaleExponent | int, default=0 | external values are multiplied by 10 to this power for internal storage (e.g., 3 for milli-units) | -| units | string, required | format: `unit* [per unit+]` (e.g., `second`, `byte per second`). An empty unit field means "dimensionless". | -| isCompressible | bool, default=false | true if the resource type is compressible | -| defaultRequest | string, default=none | in the same format as a user-supplied value | -| _[future]_ quantization | number, default=1 | smallest granularity of allocation: requests may be rounded up to a multiple of this unit; implementation-defined unit (e.g., the page size for RAM). | - - -# Appendix: future extensions - -The following are planned future extensions to the resource model, included here to encourage comments. - -## Usage data - -Because resource usage and related metrics change continuously, need to be tracked over time (i.e., historically), can be characterized in a variety of ways, and are fairly voluminous, we will not include usage in core API objects, such as [Pods](pods.md) and Nodes, but will provide separate APIs for accessing and managing that data. See the Appendix for possible representations of usage data, but the representation we'll use is TBD. - -Singleton values for observed and predicted future usage will rapidly prove inadequate, so we will support the following structure for extended usage information: - -``` -resourceStatus: [ - usage: [ cpu: , memory: ], - maxusage: [ cpu: , memory: ], - predicted: [ cpu: , memory: ], -] -``` - -where a `` or `` structure looks like this: -``` -{ - mean: # arithmetic mean - max: # minimum value - min: # maximum value - count: # number of data points - percentiles: [ # map from %iles to values - "10": <10th-percentile-value>, - "50": , - "99": <99th-percentile-value>, - "99.9": <99.9th-percentile-value>, - ... - ] - } -``` -All parts of this structure are optional, although we strongly encourage including quantities for 50, 90, 95, 99, 99.5, and 99.9 percentiles. _[In practice, it will be important to include additional info such as the length of the time window over which the averages are calculated, the confidence level, and information-quality metrics such as the number of dropped or discarded data points.]_ -and predicted - -## Future resource types - -### _[future] Network bandwidth_ - * Name: "network-bandwidth" (or `kubernetes.io/network-bandwidth`) - * Units: bytes per second - * Compressible? yes - -### _[future] Network operations_ - * Name: "network-iops" (or `kubernetes.io/network-iops`) - * Units: operations (messages) per second - * Compressible? yes - -### _[future] Storage space_ - * Name: "storage-space" (or `kubernetes.io/storage-space`) - * Units: bytes - * Compressible? no - -The amount of secondary storage space available to a container. The main target is local disk drives and SSDs, although this could also be used to qualify remotely-mounted volumes. Specifying whether a resource is a raw disk, an SSD, a disk array, or a file system fronting any of these, is left for future work. - -### _[future] Storage time_ - * Name: storage-time (or `kubernetes.io/storage-time`) - * Units: seconds per second of disk time - * Internal representation: milli-units - * Compressible? yes - -This is the amount of time a container spends accessing disk, including actuator and transfer time. A standard disk drive provides 1.0 diskTime seconds per second. - -### _[future] Storage operations_ - * Name: "storage-iops" (or `kubernetes.io/storage-iops`) - * Units: operations per second - * Compressible? yes - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/resources.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/resources.md?pixel)]() diff --git a/release-0.19.0/docs/roadmap.md b/release-0.19.0/docs/roadmap.md deleted file mode 100644 index bb7d49634a0..00000000000 --- a/release-0.19.0/docs/roadmap.md +++ /dev/null @@ -1,97 +0,0 @@ -# Kubernetes v1 - -Updated May 28, 2015 - -This document is intended to capture the set of supported use cases, features, -docs, and patterns that we feel are required to call Kubernetes “feature -complete†for a 1.0 release candidate. - -This list does not emphasize the bug fixes and stabilization that will be required to take it all the way to -production ready. Please see the [Github issues] (https://github.com/GoogleCloudPlatform/kubernetes/issues) for a more detailed view. - -This is a living document, where suggested changes can be made via a pull request. - -## Target workloads - -Most realistic examples of production services include a load-balanced web -frontend exposed to the public Internet, with a stateful backend, such as a -clustered database or key-value store. We will target such workloads for our -1.0 release. - -## v1 APIs -For existing and future workloads, we want to provide a consistent, stable set of APIs, over which developers can build and extend Kubernetes. This includes input validation, a consistent API structure, clean semantics, and improved diagnosability of the system. -||||||| merged common ancestors -## APIs and core features -1. Consistent v1 API - - Status: DONE. [v1beta3](http://kubernetesio.blogspot.com/2015/04/introducing-kubernetes-v1beta3.html) was developed as the release candidate for the v1 API. -2. Multi-port services for apps which need more than one port on the same portal IP ([#1802](https://github.com/GoogleCloudPlatform/kubernetes/issues/1802)) - - Status: DONE. Released in 0.15.0 -3. Nominal services for applications which need one stable IP per pod instance ([#260](https://github.com/GoogleCloudPlatform/kubernetes/issues/260)) - - Status: #2585 covers some design options. -4. API input is scrubbed of status fields in favor of a new API to set status ([#4248](https://github.com/GoogleCloudPlatform/kubernetes/issues/4248)) - - Status: DONE -5. Input validation reporting versioned field names ([#3084](https://github.com/GoogleCloudPlatform/kubernetes/issues/3084)) - - Status: in progress -6. Error reporting: Report common problems in ways that users can discover - - Status: -7. Event management: Make events usable and useful - - Status: -8. Persistent storage support ([#5105](https://github.com/GoogleCloudPlatform/kubernetes/issues/5105)) - - Status: in progress -9. Allow nodes to join/leave a cluster ([#6087](https://github.com/GoogleCloudPlatform/kubernetes/issues/6087),[#3168](https://github.com/GoogleCloudPlatform/kubernetes/issues/3168)) - - Status: in progress ([#6949](https://github.com/GoogleCloudPlatform/kubernetes/pull/6949)) -10. Handle node death - - Status: mostly covered by nodes joining/leaving a cluster -11. Allow live cluster upgrades ([#6075](https://github.com/GoogleCloudPlatform/kubernetes/issues/6075),[#6079](https://github.com/GoogleCloudPlatform/kubernetes/issues/6079)) - - Status: design in progress -12. Allow kernel upgrades - - Status: mostly covered by nodes joining/leaving a cluster, need demonstration -13. Allow rolling-updates to fail gracefully ([#1353](https://github.com/GoogleCloudPlatform/kubernetes/issues/1353)) - - Status: -14. Easy .dockercfg - - Status: -15. Demonstrate cluster stability over time - - Status -16. Kubelet use the kubernetes API to fetch jobs to run (instead of etcd) on supported platforms - - Status: DONE - -## Reliability and performance - -1. Restart system components in case of crash (#2884) - - Status: in progress -2. Scale to 100 nodes (#3876) - - Status: in progress -3. Scale to 30-50 pods (1-2 containers each) per node (#4188) - - Status: -4. Scheduling throughput: 99% of scheduling decisions made in less than 1s on 100 node, 3000 pod cluster; linear time to number of nodes and pods (#3954) -5. Startup time: 99% of end-to-end pod startup time with prepulled images is less than 5s on 100 node, 3000 pod cluster; linear time to number of nodes and pods (#3952, #3954) - - Status: -6. API performance: 99% of API calls return in less than 1s; constant time to number of nodes and pods (#4521) - - Status: -7. Manage and report disk space on nodes (#4135) - - Status: in progress -8. API test coverage more than 85% in e2e tests - - Status: - -In addition, we will provide versioning and deprecation policies for the APIs. - -## Cluster Environment -Currently, a cluster is a set of nodes (VMs, machines), managed by a master, running a version of Kubernetes. This master is the cluster-level control-plane. For the purpose of running production workloads, members of the cluster must be serviceable and upgradeable. - -## Micro-services and Resources -For applications / micro-services that run on Kubernetes, we want deployments to be easy but powerful. An Operations user should be able to launch a micro-service, letting the scheduler find the right placement. That micro-service should be able to require “pet storage†resources, fulfilled by external storage and with help from the cluster. We also want to improve the tools, experience for how users can roll-out applications through patterns like canary deployments. - -## Performance and Reliability -The system should be performant, especially from the perspective of micro-service running on top of the cluster and for Operations users. As part of being production grade, the system should have a measured availability and be resilient to failures, including fatal failures due to hardware. - -In terms of performance, the objectives include: -- API call return times at 99%tile ([#4521](https://github.com/GoogleCloudPlatform/kubernetes/issues/4521)) -- scale to 100 nodes with 30-50 pods (1-2 containers) per node -- scheduling throughput at the 99%tile ([#3954](https://github.com/GoogleCloudPlatform/kubernetes/issues/3954)) -- startup time at the 99%tile ([#3552](https://github.com/GoogleCloudPlatform/kubernetes/issues/3952)) - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/roadmap.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/roadmap.md?pixel)]() diff --git a/release-0.19.0/docs/salt.md b/release-0.19.0/docs/salt.md deleted file mode 100644 index 6e4e1b5676a..00000000000 --- a/release-0.19.0/docs/salt.md +++ /dev/null @@ -1,104 +0,0 @@ -# Using Salt to configure Kubernetes - -The Kubernetes cluster can be configured using Salt. - -The Salt scripts are shared across multiple hosting providers, so it's important to understand some background information prior to making a modification to ensure your changes do not break hosting Kubernetes across multiple environments. Depending on where you host your Kubernetes cluster, you may be using different operating systems and different networking configurations. As a result, it's important to understand some background information before making Salt changes in order to minimize introducing failures for other hosting providers. - -## Salt cluster setup - -The **salt-master** service runs on the kubernetes-master node [(except on the default GCE setup)](#standalone-salt-configuration-on-gce). - -The **salt-minion** service runs on the kubernetes-master node and each kubernetes-minion node in the cluster. - -Each salt-minion service is configured to interact with the **salt-master** service hosted on the kubernetes-master via the **master.conf** file [(except on GCE)](#standalone-salt-configuration-on-gce). - -``` -[root@kubernetes-master] $ cat /etc/salt/minion.d/master.conf -master: kubernetes-master -``` -The salt-master is contacted by each salt-minion and depending upon the machine information presented, the salt-master will provision the machine as either a kubernetes-master or kubernetes-minion with all the required capabilities needed to run Kubernetes. - -If you are running the Vagrant based environment, the **salt-api** service is running on the kubernetes-master. It is configured to enable the vagrant user to introspect the salt cluster in order to find out about machines in the Vagrant environment via a REST API. - -## Standalone Salt Configuration on GCE - -On GCE, the master and nodes are all configured as [standalone minions](http://docs.saltstack.com/en/latest/topics/tutorials/standalone_minion.html). The configuration for each VM is derived from the VM's [instance metadata](https://cloud.google.com/compute/docs/metadata) and then stored in Salt grains (`/etc/salt/minion.d/grains.conf`) and pillars (`/srv/salt-overlay/pillar/cluster-params.sls`) that local Salt uses to enforce state. - -All remaining sections that refer to master/minion setups should be ignored for GCE. One fallout of the GCE setup is that the Salt mine doesn't exist - there is no sharing of configuration amongst nodes. - -## Salt security - -*(Not applicable on default GCE setup.)* - -Security is not enabled on the salt-master, and the salt-master is configured to auto-accept incoming requests from minions. It is not recommended to use this security configuration in production environments without deeper study. (In some environments this isn't as bad as it might sound if the salt master port isn't externally accessible and you trust everyone on your network.) - -``` -[root@kubernetes-master] $ cat /etc/salt/master.d/auto-accept.conf -open_mode: True -auto_accept: True -``` - -## Salt minion configuration - -Each minion in the salt cluster has an associated configuration that instructs the salt-master how to provision the required resources on the machine. - -An example file is presented below using the Vagrant based environment. - -``` -[root@kubernetes-master] $ cat /etc/salt/minion.d/grains.conf -grains: - etcd_servers: $MASTER_IP - cloud_provider: vagrant - roles: - - kubernetes-master -``` - -Each hosting environment has a slightly different grains.conf file that is used to build conditional logic where required in the Salt files. - -The following enumerates the set of defined key/value pairs that are supported today. If you add new ones, please make sure to update this list. - -Key | Value -------------- | ------------- -`api_servers` | (Optional) The IP address / host name where a kubelet can get read-only access to kube-apiserver -`cbr-cidr` | (Optional) The minion IP address range used for the docker container bridge. -`cloud` | (Optional) Which IaaS platform is used to host kubernetes, *gce*, *azure*, *aws*, *vagrant* -`etcd_servers` | (Optional) Comma-delimited list of IP addresses the kube-apiserver and kubelet use to reach etcd. Uses the IP of the first machine in the kubernetes_master role, or 127.0.0.1 on GCE. -`hostnamef` | (Optional) The full host name of the machine, i.e. uname -n -`node_ip` | (Optional) The IP address to use to address this node -`hostname_override` | (Optional) Mapped to the kubelet hostname_override -`network_mode` | (Optional) Networking model to use among nodes: *openvswitch* -`networkInterfaceName` | (Optional) Networking interface to use to bind addresses, default value *eth0* -`publicAddressOverride` | (Optional) The IP address the kube-apiserver should use to bind against for external read-only access -`roles` | (Required) 1. `kubernetes-master` means this machine is the master in the kubernetes cluster. 2. `kubernetes-pool` means this machine is a kubernetes-minion. Depending on the role, the Salt scripts will provision different resources on the machine. - -These keys may be leveraged by the Salt sls files to branch behavior. - -In addition, a cluster may be running a Debian based operating system or Red Hat based operating system (Centos, Fedora, RHEL, etc.). As a result, its important to sometimes distinguish behavior based on operating system using if branches like the following. - -``` -{% if grains['os_family'] == 'RedHat' %} -// something specific to a RedHat environment (Centos, Fedora, RHEL) where you may use yum, systemd, etc. -{% else %} -// something specific to Debian environment (apt-get, initd) -{% endif %} -``` - -## Best Practices - -1. When configuring default arguments for processes, its best to avoid the use of EnvironmentFiles (Systemd in Red Hat environments) or init.d files (Debian distributions) to hold default values that should be common across operating system environments. This helps keep our Salt template files easy to understand for editors that may not be familiar with the particulars of each distribution. - -## Future enhancements (Networking) - -Per pod IP configuration is provider specific, so when making networking changes, its important to sand-box these as all providers may not use the same mechanisms (iptables, openvswitch, etc.) - -We should define a grains.conf key that captures more specifically what network configuration environment is being used to avoid future confusion across providers. - -## Further reading - -The [cluster/saltbase](../cluster/saltbase) tree has more details on the current SaltStack configuration. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/salt.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/salt.md?pixel)]() diff --git a/release-0.19.0/docs/secrets.md b/release-0.19.0/docs/secrets.md deleted file mode 100644 index 848ecd0922a..00000000000 --- a/release-0.19.0/docs/secrets.md +++ /dev/null @@ -1,367 +0,0 @@ -# Secrets - -Objects of type `secret` are intended to hold sensitive information, such as -passwords, OAuth tokens, and ssh keys. Putting this information in a `secret` -is safer and more flexible than putting it verbatim in a `pod` definition or in -a docker image. - -### Creating and Using Secrets -To make use of secrets requires at least two steps: - 1. create a `secret` resource with secret data - 1. create a pod that has a volume of type `secret` and a container - which mounts that volume. - -This is an example of a simple secret, in json format: -```json -{ - "apiVersion": "v1", - "kind": "Secret", - "metadata" : { - "name": "mysecret", - "namespace": "myns" - }, - "data": { - "username": "dmFsdWUtMQ0K", - "password": "dmFsdWUtMg0KDQo=" - } -} -``` - -The data field is a map. -Its keys must match [DNS_SUBDOMAIN](design/identifiers.md). -The values are arbitrary data, encoded using base64. - -This is an example of a pod that uses a secret, in json format: -```json -{ - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "name": "mypod", - "namespace": "myns" - }, - "spec": { - "containers": [{ - "name": "mypod", - "image": "redis", - "volumeMounts": [{ - "name": "foo", - "mountPath": "/etc/foo", - "readOnly": true - }] - }], - "volumes": [{ - "name": "foo", - "secret": { - "secretName": "mysecret" - } - }] - } -} -``` - -### Restrictions -Secret volume sources are validated to ensure that the specified object -reference actually points to an object of type `Secret`. Therefore, a secret -needs to be created before any pods that depend on it. - -Secret API objects reside in a namespace. They can only be referenced by pods -in that same namespace. - -Individual secrets are limited to 1MB in size. This is to discourage creation -of very large secrets which would exhaust apiserver and kubelet memory. -However, creation of many smaller secrets could also exhaust memory. More -comprehensive limits on memory usage due to secrets is a planned feature. - -Kubelet only supports use of secrets for Pods it gets from the API server. -This includes any pods created using kubectl, or indirectly via a replication -controller. It does not include pods created via the kubelets -`--manifest-url` flag, its `--config` flag, or its REST API (these are -not common ways to create pods.) - -### Consuming Secret Values - -The program in a container is responsible for reading the secret(s) from the -files. Currently, if a program expects a secret to be stored in an environment -variable, then the user needs to modify the image to populate the environment -variable from the file as an step before running the main program. Future -versions of Kubernetes are expected to provide more automation for populating -environment variables from files. - - -## Changes to Secrets - -Once a pod is created, its secret volumes will not change, even if the secret -resource is modified. To change the secret used, the original pod must be -deleted, and a new pod (perhaps with an identical PodSpec) must be created. -Therefore, updating a secret follows the same workflow as deploying a new -container image. The `kubectl rolling-update` command can be used ([man -page](kubectl_rolling-update.md)). - -The resourceVersion of the secret is not specified when it is referenced. -Therefore, if a secret is updated at about the same time as pods are starting, -then it is not defined which version of the secret will be used for the pod. It -is not possible currently to check what resource version of a secret object was -used when a pod was created. It is planned that pods will report this -information, so that a controller could restart ones using a old -resourceVersion. In the interim, if this is a concern, it is recommended to not -update the data of existing secrets, but to create new ones with distinct names. - -## Use cases - -### Use-Case: Pod with ssh keys - -To create a pod that uses an ssh key stored as a secret, we first need to create a secret: - -```json -{ - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "ssh-key-secret" - }, - "data": { - "id-rsa": "dmFsdWUtMg0KDQo=", - "id-rsa.pub": "dmFsdWUtMQ0K" - } -} -``` - -**Note:** The serialized JSON and YAML values of secret data are encoded as -base64 strings. Newlines are not valid within these strings and must be -omitted. - -Now we can create a pod which references the secret with the ssh key and -consumes it in a volume: - -```json -{ - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "secret-test-pod", - "labels": { - "name": "secret-test" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "ssh-key-secret" - } - } - ], - "containers": [ - { - "name": "ssh-test-container", - "image": "mySshImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } -} -``` - -When the container's command runs, the pieces of the key will be available in: - - /etc/secret-volume/id-rsa.pub - /etc/secret-volume/id-rsa - -The container is then free to use the secret data to establish an ssh connection. - -### Use-Case: Pods with prod / test credentials - -This example illustrates a pod which consumes a secret containing prod -credentials and another pod which consumes a secret with test environment -credentials. - -The secrets: - -```json -{ - "apiVersion": "v1", - "kind": "List", - "items": - [{ - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "prod-db-secret" - }, - "data": { - "password": "dmFsdWUtMg0KDQo=", - "username": "dmFsdWUtMQ0K" - } - }, - { - "kind": "Secret", - "apiVersion": "v1", - "metadata": { - "name": "test-db-secret" - }, - "data": { - "password": "dmFsdWUtMg0KDQo=", - "username": "dmFsdWUtMQ0K" - } - }] -} -``` - -The pods: - -```json -{ - "apiVersion": "v1", - "kind": "List", - "items": - [{ - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "prod-db-client-pod", - "labels": { - "name": "prod-db-client" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "prod-db-secret" - } - } - ], - "containers": [ - { - "name": "db-client-container", - "image": "myClientImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } - }, - { - "kind": "Pod", - "apiVersion": "v1", - "metadata": { - "name": "test-db-client-pod", - "labels": { - "name": "test-db-client" - } - }, - "spec": { - "volumes": [ - { - "name": "secret-volume", - "secret": { - "secretName": "test-db-secret" - } - } - ], - "containers": [ - { - "name": "db-client-container", - "image": "myClientImage", - "volumeMounts": [ - { - "name": "secret-volume", - "readOnly": true, - "mountPath": "/etc/secret-volume" - } - ] - } - ] - } - }] -} -``` - -Both containers will have the following files present on their filesystems: -``` - /etc/secret-volume/username - /etc/secret-volume/password -``` - -Note how the specs for the two pods differ only in one field; this facilitates -creating pods with different capabilities from a common pod config template. - -### Use-case: Secret visible to one container in a pod - - -Consider a program that needs to handle HTTP requests, do some complex business -logic, and then sign some messages with an HMAC. Because it has complex -application logic, there might be an unnoticed remote file reading exploit in -the server, which could expose the private key to an attacker. - -This could be divided into two processes in two containers: a frontend container -which handles user interaction and business logic, but which cannot see the -private key; and a signer container that can see the private key, and responds -to simple signing requests from the frontend (e.g. over localhost networking). - -With this partitioned approach, an attacker now has to trick the application -server into doing something rather arbitrary, which may be harder than getting -it to read a file. - -## Security Properties - -### Protections - -Because `secret` objects can be created independently of the `pods` that use -them, there is less risk of the secret being exposed during the workflow of -creating, viewing, and editing pods. The system can also take additional -precautions with `secret` objects, such as avoiding writing them to disk where -possible. - -A secret is only sent to a node if a pod on that node requires it. It is not -written to disk. It is stored in a tmpfs. It is deleted once the pod that -depends on it is deleted. - -On most Kubernetes-project-maintained distributions, communication between user -to the apiserver, and from apiserver to the kubelets, is protected by SSL/TLS. -Secrets are protected when transmitted over these channels. - -There may be secrets for several pods on the same node. However, only the -secrets that a pod requests are potentially visible within its containers. -Therefore, one Pod does not have access to the secrets of another pod. - -There may be several containers in a pod. However, each container in a pod has -to request the secret volume in its `volumeMounts` for it to be visible within -the container. This can be used to construct useful [security partitions at the -Pod level](#use-case-two-containers). - -### Risks - - - Applications still need to protect the value of secret after reading it from the volume, - such as not accidentally logging it or transmitting it to an untrusted party. - - A user who can create a pod that uses a secret can also see the value of that secret. Even - if apiserver policy does not allow that user to read the secret object, the user could - run a pod which exposes the secret. - If multiple replicas of etcd are run, then the secrets will be shared between them. - By default, etcd does not secure peer-to-peer communication with SSL/TLS, though this can be configured. - - It is not possible currently to control which users of a kubernetes cluster can - access a secret. Support for this is planned. - - Currently, anyone with root on any node can read any secret from the apiserver, - by impersonating the kubelet. It is a planned feature to only send secrets to - nodes that actually require them, to restrict the impact of a root exploit on a - single node. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/secrets.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/secrets.md?pixel)]() diff --git a/release-0.19.0/docs/security_context.md b/release-0.19.0/docs/security_context.md deleted file mode 100644 index 6fb10065da7..00000000000 --- a/release-0.19.0/docs/security_context.md +++ /dev/null @@ -1,9 +0,0 @@ -# Security Contexts - -A security context defines the operating system security settings (uid, gid, capabilities, SELinux role, etc..) applied to a container. - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/security_context.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/security_context.md?pixel)]() diff --git a/release-0.19.0/docs/service_accounts.md b/release-0.19.0/docs/service_accounts.md deleted file mode 100644 index 470871f2324..00000000000 --- a/release-0.19.0/docs/service_accounts.md +++ /dev/null @@ -1,17 +0,0 @@ -# Service Accounts -A serviceAccount provides an identity for processes that run in a Pod. -The behavior of the the serviceAccount object is implemented via a plugin -called an [Admission Controller]( admission_controllers.md). When this plugin is active -(and it is by default on most distributions), then it does the following when a pod is created or modified: - 1. If the pod does not have a ```ServiceAccount```, it modifies the pod's ```ServiceAccount``` to "default". - 2. It ensures that the ```ServiceAccount``` referenced by a pod exists. - 3. If ```LimitSecretReferences``` is true, it rejects the pod if the pod references ```Secret``` objects which the pods -```ServiceAccount``` does not reference. - 4. If the pod does not contain any ```ImagePullSecrets```, the ```ImagePullSecrets``` of the -```ServiceAccount``` are added to the pod. - 5. If ```MountServiceAccountToken``` is true, it adds a ```VolumeMount``` with the pod's ```ServiceAccount``` API token secret to containers in the pod. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/service_accounts.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/service_accounts.md?pixel)]() diff --git a/release-0.19.0/docs/services-firewalls.md b/release-0.19.0/docs/services-firewalls.md deleted file mode 100644 index d36138d5349..00000000000 --- a/release-0.19.0/docs/services-firewalls.md +++ /dev/null @@ -1,40 +0,0 @@ -# Services and Firewalls - -Many cloud providers (e.g. Google Compute Engine) define firewalls that help keep prevent inadvertent -exposure to the internet. When exposing a service to the external world, you may need to open up -one or more ports in these firewalls to serve traffic. This document describes this process, as -well as any provider specific details that may be necessary. - - -### Google Compute Engine -Google Compute Engine firewalls are documented [elsewhere](https://cloud.google.com/compute/docs/networking#firewalls_1). - -You can add a firewall with the ```gcloud``` command line tool: - -``` -gcloud compute firewall-rules create my-rule --allow=tcp: -``` - -**Note** -There is one important security note when using firewalls on Google Compute Engine: - -Firewalls are defined per-vm, rather than per-ip address. This means that if you open a firewall for that service's ports, -anything that serves on that port on that VM's host IP address may potentially serve traffic. - -Note that this is not a problem for other Kubernetes services, as they listen on IP addresses that are different than the -host node's external IP address. - -Consider: - * You create a Service with an external load balancer (IP Address 1.2.3.4) and port 80 - * You open the firewall for port 80 for all nodes in your cluster, so that the external Service actually can deliver packets to your Service - * You start an nginx server, running on port 80 on the host virtual machine (IP Address 2.3.4.5). This nginx is **also** exposed to the internet on the VM's external IP address. - -Consequently, please be careful when opening firewalls in Google Compute Engine or Google Container Engine. You may accidentally be exposing other services to the wilds of the internet. - -### Other cloud providers -Coming soon. - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/services-firewalls.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/services-firewalls.md?pixel)]() diff --git a/release-0.19.0/docs/services.md b/release-0.19.0/docs/services.md deleted file mode 100644 index d05a61e54f8..00000000000 --- a/release-0.19.0/docs/services.md +++ /dev/null @@ -1,468 +0,0 @@ -# Services in Kubernetes - -## Overview - -Kubernetes [`Pods`](pods.md) are mortal. They are born and they die, and they -are not resurrected. [`ReplicationControllers`](replication-controller.md) in -particular create and destroy `Pods` dynamically (e.g. when scaling up or down -or when doing rolling updates). While each `Pod` gets its own IP address, even -those IP addresses cannot be relied upon to be stable over time. This leads to -a problem: if some set of `Pods` (let's call them backends) provides -functionality to other `Pods` (let's call them frontends) inside the Kubernetes -cluster, how do those frontends find out and keep track of which backends are -in that set? - -Enter `Services`. - -A Kubernetes `Service` is an abstraction which defines a logical set of `Pods` -and a policy by which to access them - sometimes called a micro-service. The -set of `Pods` targeted by a `Service` is (usually) determined by a [`Label -Selector`](labels.md) (see below for why you might want a `Service` without a -selector). - -As an example, consider an image-processing backend which is running with 3 -replicas. Those replicas are fungible - frontends do not care which backend -they use. While the actual `Pods` that compose the backend set may change, the -frontend clients should not need to be aware of that or keep track of the list -of backends themselves. The `Service` abstraction enables this decoupling. - -For Kubernetes-native applications, Kubernetes offers a simple `Endpoints` API -that is updated whenever the set of `Pods` in a `Service` changes. For -non-native applications, Kubernetes offers a virtual-IP-based bridge to Services -which redirects to the backend `Pods`. - -## Defining a service - -A `Service` in Kubernetes is a REST object, similar to a `Pod`. Like all of the -REST objects, a `Service` definition can be POSTed to the apiserver to create a -new instance. For example, suppose you have a set of `Pods` that each expose -port 9376 and carry a label "app=MyApp". - -```json -{ - "kind": "Service", - "apiVersion": "v1", - "metadata": { - "name": "my-service" - }, - "spec": { - "selector": { - "app": "MyApp" - }, - "ports": [ - { - "protocol": "TCP", - "port": 80, - "targetPort": 9376 - } - ] - } -} -``` - -This specification will create a new `Service` object named "my-service" which -targets TCP port 9376 on any `Pod` with the "app=MyApp" label. This `Service` -will also be assigned an IP address (sometimes called the "cluster IP"), which -is used by the service proxies (see below). The `Service`'s selector will be -evaluated continuously and the results will be posted in an `Endpoints` object -also named "my-service". - -Note that a `Service` can map an incoming port to any `targetPort`. By default -the `targetPort` is the same as the `port` field. Perhaps more interesting is -that `targetPort` can be a string, referring to the name of a port in the -backend `Pod`s. The actual port number assigned to that name can be different -in each backend `Pod`. This offers a lot of flexibility for deploying and -evolving your `Service`s. For example, you can change the port number that -pods expose in the next version of your backend software, without breaking -clients. - -Kubernetes `Service`s support `TCP` and `UDP` for protocols. The default -is `TCP`. - -### Services without selectors - -Services generally abstract access to Kubernetes `Pods`, but they can also -abstract other kinds of backends. For example: - - * You want to have an external database cluster in production, but in test - you use your own databases. - * You want to point your service to a service in another - [`Namespace`](namespaces.md) or on another cluster. - * You are migrating your workload to Kubernetes and some of your backends run - outside of Kubernetes. - -In any of these scenarios you can define a service without a selector: - -```json -{ - "kind": "Service", - "apiVersion": "v1", - "metadata": { - "name": "my-service" - }, - "spec": { - "ports": [ - { - "protocol": "TCP", - "port": 80, - "targetPort": 9376 - } - ] - } -} -``` - -Because this has no selector, the corresponding `Endpoints` object will not be -created. You can manually map the service to your own specific endpoints: - -```json -{ - "kind": "Endpoints", - "apiVersion": "v1", - "metadata": { - "name": "my-service" - }, - "subsets": [ - { - "addresses": [ - { "IP": "1.2.3.4" } - ], - "ports": [ - { "port": 80 } - ] - } - ] -} -``` - -Accessing a `Service` without a selector works the same as if it had selector. -The traffic will be routed to endpoints defined by the user (`1.2.3.4:80` in -this example). - -## Virtual IPs and service proxies - -Every node in a Kubernetes cluster runs a `kube-proxy`. This application -watches the Kubernetes master for the addition and removal of `Service` -and `Endpoints` objects. For each `Service` it opens a port (random) on the -local node. Any connections made to that port will be proxied to one of the -corresponding backend `Pods`. Which backend to use is decided based on the -`SessionAffinity` of the `Service`. Lastly, it installs iptables rules which -capture traffic to the `Service`'s `Port` on the `Service`'s cluster IP (which -is entirely virtual) and redirects that traffic to the previously described -port. - -The net result is that any traffic bound for the `Service` is proxied to an -appropriate backend without the clients knowing anything about Kubernetes or -`Services` or `Pods`. - -![Services overview diagram](services_overview.png) - -By default, the choice of backend is random. Client-IP based session affinity -can be selected by setting `service.spec.sessionAffinity` to `"ClientIP"` (the -default is `"None"`). - -As of Kubernetes 1.0, `Service`s are a "layer 3" (TCP/UDP over IP) construct. We do not -yet have a concept of "layer 7" (HTTP) services. - -## Multi-Port Services - -Many `Service`s need to expose more than one port. For this case, Kubernetes -supports multiple port definitions on a `Service` object. When using multiple -ports you must give all of your ports names, so that endpoints can be -disambiguated. For example: - -```json -{ - "kind": "Service", - "apiVersion": "v1", - "metadata": { - "name": "my-service" - }, - "spec": { - "selector": { - "app": "MyApp" - }, - "ports": [ - { - "name": "http", - "protocol": "TCP", - "port": 80, - "targetPort": 9376 - }, - { - "name": "https", - "protocol": "TCP", - "port": 443, - "targetPort": 9377 - } - ] - } -} -``` - -## Choosing your own IP address - -A user can specify their own cluster IP address as part of a `Service` creation -request. To do this, set the `spec.clusterIP` field. For example, if they -already have an existing DNS entry that they wish to replace, or legacy systems -that are configured for a specific IP address and difficult to re-configure. -The IP address that a user chooses must be a valid IP address and within the -service_cluster_ip_range CIDR range that is specified by flag to the API server. -If the IP address value is invalid, the apiserver returns a 422 HTTP status code -to indicate that the value is invalid. - -### Why not use round-robin DNS? - -A question that pops up every now and then is why we do all this stuff with -virtual IPs rather than just use standard round-robin DNS. There are a few -reasons: - - * There is a long history of DNS libraries not respecting DNS TTLs and - caching the results of name lookups. - * Many apps do DNS lookups once and cache the results. - * Even if apps and libraries did proper re-resolution, the load of every - client re-resolving DNS over and over would be difficult to manage. - -We try to discourage users from doing things that hurt themselves. That said, -if enough people ask for this, we may implement it as an alternative. - -## Discovering services - -Kubernetes supports 2 primary modes of finding a `Service` - environment -variables and DNS. - -### Environment variables - -When a `Pod` is run on a `Node`, the kubelet adds a set of environment variables -for each active `Service`. It supports both [Docker links -compatible](https://docs.docker.com/userguide/dockerlinks/) variables (see -[makeLinkVariables](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/pkg/kubelet/envvars/envvars.go#L49)) -and simpler `{SVCNAME}_SERVICE_HOST` and `{SVCNAME}_SERVICE_PORT` variables, -where the Service name is upper-cased and dashes are converted to underscores. - -For example, the Service "redis-master" which exposes TCP port 6379 and has been -allocated cluster IP address 10.0.0.11 produces the following environment -variables: - -``` -REDIS_MASTER_SERVICE_HOST=10.0.0.11 -REDIS_MASTER_SERVICE_PORT=6379 -REDIS_MASTER_PORT=tcp://10.0.0.11:6379 -REDIS_MASTER_PORT_6379_TCP=tcp://10.0.0.11:6379 -REDIS_MASTER_PORT_6379_TCP_PROTO=tcp -REDIS_MASTER_PORT_6379_TCP_PORT=6379 -REDIS_MASTER_PORT_6379_TCP_ADDR=10.0.0.11 -``` - -*This does imply an ordering requirement* - any `Service` that a `Pod` wants to -access must be created before the `Pod` itself, or else the environment -variables will not be populated. DNS does not have this restriction. - -### DNS - -An optional (though strongly recommended) cluster add-on is a DNS server. The -DNS server watches the Kubernetes API for new `Services` and creates a set of -DNS records for each. If DNS has been enabled throughout the cluster then all -`Pods` should be able to do name resolution of `Services` automatically. - -For example, if you have a `Service` called "my-service" in Kubernetes -`Namespace` "my-ns" a DNS record for "my-service.my-ns" is created. `Pods` -which exist in the "my-ns" `Namespace` should be able to find it by simply doing -a name lookup for "my-service". `Pods` which exist in other `Namespace`s must -qualify the name as "my-service.my-ns". The result of these name lookups is the -cluster IP. - -We will soon add DNS support for multi-port `Service`s in the form of SRV -records. - -## Headless services - -Sometimes you don't need or want load-balancing and a single service IP. In -this case, you can create "headless" services by specifying `"None"` for the -cluster IP (`spec.clusterIP`). -For such `Service`s, a cluster IP is not allocated and service-specific -environment variables for `Pod`s are not created. DNS is configured to return -multiple A records (addresses) for the `Service` name, which point directly to -the `Pod`s backing the `Service`. Additionally, the kube proxy does not handle -these services and there is no load balancing or proxying done by the platform -for them. The endpoints controller will still create `Endpoints` records in -the API. - -This option allows developers to reduce coupling to the Kubernetes system, if -they desire, but leaves them freedom to do discovery in their own way. -Applications can still use a self-registration pattern and adapters for other -discovery systems could easily be built upon this API. - -##External services - -For some parts of your application (e.g. frontends) you may want to expose a -Service onto an external (outside of your cluster, maybe public internet) IP -address. Kubernetes supports two ways of doing this: `NodePort`s and -`LoadBalancer`s. - -Every `Service` has a `Type` field which defines how the `Service` can be -accessed. Valid values for this field are: - - * `ClusterIP`: use a cluster-internal IP only - this is the default - * `NodePort`: use a cluster IP, but also expose the service on a port on each - node of the cluster (the same port on each) - * `LoadBalancer`: use a ClusterIP and a NodePort, but also ask the cloud - provider for a load balancer which forwards to the `Service` - -Note that while `NodePort`s can be TCP or UDP, `LoadBalancer`s only support TCP -as of Kubernetes 1.0. - -### Type = NodePort - -If you set the `type` field to `"NodePort"`, the Kubernetes master will -allocate you a port (from a flag-configured range) on each node for each port -exposed by your `Service`. That port will be reported in your `Service`'s -`spec.ports[*].nodePort` field. If you specify a value in that field, the -system will allocate you that port or else will fail the API transaction. - -This gives developers the freedom to set up their own load balancers, to -configure cloud environments that are not fully supported by Kubernetes, or -even to just expose one or more nodes' IPs directly. - -### Type = LoadBalancer - -On cloud providers which support external load balancers, setting the `type` -field to `"LoadBalancer"` will provision a load balancer for your `Service`. -The actual creation of the load balancer happens asynchronously, and -information about the provisioned balancer will be published in the `Service`'s -`status.loadBalancer` field. For example: - -```json -{ - "kind": "Service", - "apiVersion": "v1", - "metadata": { - "name": "my-service" - }, - "spec": { - "selector": { - "app": "MyApp" - }, - "ports": [ - { - "protocol": "TCP", - "port": 80, - "targetPort": 9376, - "nodePort": 30061 - } - ], - "clusterIP": "10.0.171.239", - "type": "LoadBalancer" - }, - "status": { - "loadBalancer": { - "ingress": [ - { - "ip": "146.148.47.155" - } - ] - } - } -} -``` - -Traffic from the external load balancer will be directed at the backend `Pods`, -though exactly how that works depends on the cloud provider. - -## Shortcomings - -We expect that using iptables and userspace proxies for VIPs will work at -small to medium scale, but may not scale to very large clusters with thousands -of Services. See [the original design proposal for -portals](https://github.com/GoogleCloudPlatform/kubernetes/issues/1107) for more -details. - -Using the kube-proxy obscures the source-IP of a packet accessing a `Service`. -This makes some kinds of firewalling impossible. - -LoadBalancers only support TCP, not UDP. - -The `Type` field is designed as nested functionality - each level adds to the -previous. This is not strictly required on all cloud providers (e.g. GCE does -not need to allocate a `NodePort` to make `LoadBalancer` work, but AWS does) -but the current API requires it. - -## Future work - -In the future we envision that the proxy policy can become more nuanced than -simple round robin balancing, for example master-elected or sharded. We also -envision that some `Services` will have "real" load balancers, in which case the -VIP will simply transport the packets there. - -There's a -[proposal](https://github.com/GoogleCloudPlatform/kubernetes/issues/3760) to -eliminate userspace proxying in favor of doing it all in iptables. This should -perform better and fix the source-IP obfuscation, though is less flexible than -arbitrary userspace code. - -We intend to have first-class support for L7 (HTTP) `Service`s. - -We intend to have more flexible ingress modes for `Service`s which encompass -the current `ClusterIP`, `NodePort`, and `LoadBalancer` modes and more. - -## The gory details of virtual IPs - -The previous information should be sufficient for many people who just want to -use `Services`. However, there is a lot going on behind the scenes that may be -worth understanding. - -### Avoiding collisions - -One of the primary philosophies of Kubernetes is that users should not be -exposed to situations that could cause their actions to fail through no fault -of their own. In this situation, we are looking at network ports - users -should not have to choose a port number if that choice might collide with -another user. That is an isolation failure. - -In order to allow users to choose a port number for their `Services`, we must -ensure that no two `Services` can collide. We do that by allocating each -`Service` its own IP address. - -To ensure each service receives a unique IP, an internal allocator atomically -updates a global allocation map in etcd prior to each service. The map object -must exist in the registry for services to get IPs, otherwise creations will -fail with a message indicating an IP could not be allocated. A background -controller is responsible for creating that map (to migrate from older versions -of Kubernetes that used in memory locking) as well as checking for invalid -assignments due to administrator intervention and cleaning up any any IPs -that were allocated but which no service currently uses. - -### IPs and VIPs - -Unlike `Pod` IP addresses, which actually route to a fixed destination, -`Service` IPs are not actually answered by a single host. Instead, we use -`iptables` (packet processing logic in Linux) to define virtual IP addresses -which are transparently redirected as needed. When clients connect to the -VIP, their traffic is automatically transported to an appropriate endpoint. -The environment variables and DNS for `Services` are actually populated in -terms of the `Service`'s VIP and port. - -As an example, consider the image processing application described above. -When the backend `Service` is created, the Kubernetes master assigns a virtual -IP address, for example 10.0.0.1. Assuming the `Service` port is 1234, the -`Service` is observed by all of the `kube-proxy` instances in the cluster. -When a proxy sees a new `Service`, it opens a new random port, establishes an -iptables redirect from the VIP to this new port, and starts accepting -connections on it. - -When a client connects to the VIP the iptables rule kicks in, and redirects -the packets to the `Service proxy`'s own port. The `Service proxy` chooses a -backend, and starts proxying traffic from the client to the backend. - -This means that `Service` owners can choose any port they want without risk of -collision. Clients can simply connect to an IP and port, without being aware -of which `Pod`s they are actually accessing. - -![Services detailed diagram](services_detail.png) - - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/services.md?pixel)]() - - -[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/release-0.19.0/docs/services.md?pixel)]() diff --git a/release-0.19.0/docs/services_detail.png b/release-0.19.0/docs/services_detail.png deleted file mode 100644 index 7ff19b8209b513668ed6aca0441179aade3b30d7..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 68514 zcmdR$byt;b*X}_C1VjZ91Vlty8l(jT=?(#D0Rd^GJ48gJr6r}iLmH(Q-5t{1o$us% z-o5|ZA7HOB9QVL=uZ!zC*Llu3j^ETzURDenlL!+D2?<+5Tv!na>6RxF67tp^H29nQ z6Sd*+pW8M<5^wLo%k|EOZ}2mQmAIM>5)#(n%^&1%o%`|dmxQ(=?`)MU4Q(BCtqqVI z92^*pElh3nb*&5-Ev=1Ww_Xt;Aw5Hq5Egvv7`G8`=lHgD#B*jUu-Zik_YT=-UOa~i z{Jh@&eteVCG)bvNRf5dE=M0P@{?$^qFuZQhku^ffR)Y&BC73{YArDw;1k*zKhEX=|HE!``&h*Ek^P4wiybA z40()a1G&$w=sbCv;VC)F=b>$HDDV@N+7@MHD57rOdPhH&yWhK&F8|8>qluSPb^iU$ zNVu9;@n20v{rvG;NM6RCsdiDw-ze`FoMPT7y{+dR(hCEhO17tKcjjhSdp5Qm_&YT)@4Vz?i3%z@x}=p+U+(M~(SNTu zooWZyvgLm|Si0?c9b-A5Yc)_VgX|UA{qvaWA+ha~Pc~T3pZ)J^#|j7UHS&L7UafZp zk?|h<_vP66;Q#r?p7=}8n$p-WiDPe!bs5QZu97R8jq&~&9fjaJ#c)ia4^(w{F5zdi zXVTOCL;REZKq<;{(cCQb#SAOGsyHs>4PqwyIsi3#g5No76cz*bq2q0ohiuMr?rCrx z#r(vx;P90PH7?k#Df17z7=jwKzHwCqhqt{~FWU}uD8T7rkoBf*?|FVO%3-ZI7hU*X z!p46fHC0%PYN?+kpfh)ceK&0hUySZEY9aFE9qz7Qi;32oO+iceX?;)BPPvWB=_#2u z4Q>4UQ}Gs4i;hQpG$$`P`_~ZgnOVm0M@vOUs}r}k)CCRH6yU-%`A^6G77gj(cr2R1 zXBM8Q@6sAoTnK5a|3%5V)-~tf;j-FDEa0j&#!&O?>tc{h5wHIgkJ7 zmCb#UX1$;C6Q^Z#RWQ>~xse`gjJ`K92v$8NJ2@iu4@wYZlcKev#xXj^b=##mCG>lX zN021n#!_bAG(Hxla#g!S%#0i=J~*kzf$1aEJ(QwRY3=xM_0vcu4Q{cRWY#mRtV-p{7{JzgR_WL7Md+48R zeOwYP%o0V~PD#qGJqfD1b2@mKi2y~DA2_7lJ|rF{d<6D-=wd2ve^Pzw`wW^o|8sru z?|0_@9vKj|T52n+|LZo>MtngPm>+QHY{cKJ<33q_US{-A%9f_PD~XHKyU7&!pyurP z{LERFpk4W6)WS%Gf~(*o6lxUtxTrs6Vb#A2-3U1g67+le9ilI$NxSHOd2&$I)Z+DY zUq0}s3|}z9u~~f#yA-kLz0UHo?EPTQwW$RTv52wYz1FK!(x{_+3kwAz;p%B}!sDgj zZ+5mcOo-*BA)C1I9r9+Um|Qh3zY0!m!Q_;YNj=O-!PZ|&ga@5M6jjb|!|{GRC1}}Y zp9y(_)3nr+I6ovH_e!xoR$5)g-kM$|XzQ-qKmGBeCqZ6*gvKntHm*(?;D}q#1_$q~ zvSI3DO)TN7qPUSOX=~WsBjIz)?&xUyP55Vwq5kH2`J~#d`O3VS<95atET~%zf2Sjs z>n4JP#qP(HeutgbZFc4JrEve^eDTRr0oQ(;%x9MXmxR=HuLHL=_Q?z9_lEQ0Lhq2g zuJfK&Kb?(4kbIa;hBI9Cjb5K=dLoX6a(t(#J(T>?vQc8~=9u7}bpjyjeeb{5Uo%h}Xrza5yUVM7N4G z!l0Q#l?aRz9FM( zmCcwVeC6c>{U<)q4 zm5F`r6~+aNg805i(UE^J-=>hcZ>TX;gDMUJ_RLf zbld{hcWX9gW{$?c(~neVwjAw9KMRXhXj`|SCQ{Im;T8ok!ud!k(qsrzdFXC<-;JFBbs+`C=&`=6E} zEP}-R(se%E(9Erq)X8w-CQTkmlY>V{W}3BDduyYq#r{otjGG#7>_oWZzsl&J`1_9? zbxn$iA`gD8%^>B-*Zx4=9Fi}BOy4F+wl~RNjGIEsgb<_3Yw7PJ;dQX&!H##9JNAc- zspl;h681#Q-T4--79ZTbmGKB_!Pc9tv$|6u@L10N{e z`R6vtfR;hTQ&{Qy?7eM>zW8#!uek2^OvXj3$TFzR3>@LaWEm3v*v)O7m`2;(CkKQ+ zzp@PC4^_hPah%)*Xcfr97Yy_k7j|Dimzd%`7;>JR>?V}*Rar=*4hh4<3jP*bkzYqP zUHdgG?1_|f7whHbTh+*$FD|Q3m4=}+tvL5Fn<;v(mimDE?1GEzmmGwY->dq>jfHpC zKjuTEa#&uL{QWZ!JgkMDNz38zMqOEO=gO|lKyic5)p*J-Ni+s32VpHPapy^Pq$ld< z|E5fD!$K1o&~-?P`&UY;n?YuhfH3ncs=d(KTD8vd_??POaJA^~R;>y0eJ9c@x;>#Xy^!9bq^;STWJ-#GT4>+h@&Qij&fB^90kL@}lckFBQWD_6&84NnD5QciqP1m<5W~ zY!ZPI1LN9+w5$hy!qH5Q(!Ja&Su7c&(7r$DT(5t95lo$4*ZnO@V1!FmSsQU=snfTj zaqC*csb~44NvBzaWMllM_^%Kfy{?Kl&1)1)AI(c5V(N58^(^)XDHS0KV*D-&PIm3h zlbEji1;HU529UmxKPvBOu!^u>t)&nD^m?{PiJDzBD;rdB`n9OQLvBPt&NNPmW49JZkLetHZN@Nb=K)+<^Aj9nWuNg% za=QBWqyC9IO@kvtLFgM7{wW?FYRh~Y4ulN{&8Ez(CH-6u?i1Tj&eoL{tjG8aJVK%; zDv=N~a=$`y2#Me*mu#*_(K2}1PT%$rudWSd%Y32pqKYvP+*nk*AA!nnL+%NIF z_o_3kHpj2d@e5mQ6th`3waEzH2da|2E(La+)+*bl{3x)qqsO=ul@&x)^zbk%pA;=j z>-23RX2M7rGA@(aiH^^f<9FXGhyUx(r{kmU{DWxsE{)EKdv{E-tJ+<-e?Ag@c`2KB zc>MVImBkew3o{F~0ADE9L{w;EXj71-PTJ7d1d}>8h`70q`V_GJqSbkO^(Xg7%S^-| z!K((Fkx^4_CG-rurNP5g7BgO5aG&_ZokJk|oPh%m^7`4U(-%ii>poBl;}q^QS!naM zA~;2Nm&T<`{*bc}1Q#EAFx~1!)Dvu?%lvJd{2AWXahvp=n6i^`7~;B+A^kqCkI&3+L$y3!`Ura_Z@LOEKo9uPts)6 zzied_ufa#6K}X)!ZY;9>=%dM)!A$3~@a@^;#Wu;RQ}y16-Qa+<>oP%^3oV{ChdZl3 zycfV=wjwak5Le5q6du++)+HqYEoa39|yOme=$LJXm09{EKYV63N~L9 zZ8PpRQ~REy;}F_e{(?!DDba*~x1`JZkvPDXItwASUqP zRBKmDcUSC2>f`(;W4XWZ_-WtuTT`KX88d?D&WO|-klFHD%{ zW=5ymT4A%(BQjdPH(d4E(8NIQItGim#9r9zbF69)Zm9z{r;x18hsEXpEc+f5o=XkI z!N>-QYXc52F&rt|6>i;o7Il1(p~&|B3R-CLA2uXr zK)31b!I;cU_sB+rTHRrFCTU$G?$%?-mX%q%;yEv%%%S4hxdWTMbc-hhLQBTs&wJh( zAD@_x7~y?Q$B&yX{gUKnI*9kWQW{aOQ}(fz5` zZWXsJo;70?hQ}$GA(dLl(m{7_4%KVpzIr#s5tqG=jf*RGMpDh0Oe1p|AGNF|9d4AQ zqw|Hdsf7y_1Nq653issYF9gcVRe?@H>{!&Hj(i~~9v@+nWHN{wqM~f=+QsSF-ycup7LmH+ zzp_HeZ2ZsC1|dZ9X!6i zrLS`>n-XYGY-2go^S%E$#G0@ZI-^f!0}0C>qiIDZkr5BtS7i{X9VJ&4e)hFu+1*aZ zL|$G+gpidRi|Vg4l#ySSd`j&xk35Cd)z#f@`S-{lW4b=*7n5s%Um8i$TY1@h<)8^I z(Qdsx7mv(wyXAju9|z3u#0t1@;mjgzg|Ba|ZHhBS6>X0k%hTYU@Uuh`Cgv#z_GyWB zF0^I$aM$h{K{N`@Pch6&U?AK0Y=UZfHphN)NSu*fa=f5AdUU8cbomq4SQ&Mq-Yudy z`ITadP$mt-->w2`w)%H7vq(kwQFnOeHne4PFC!sY;X>032Wf@yabNzicoVLK_u3kl z?Te& zmaDwPm-OH7CAhzkQql}LN?YM&DKBiUuV=-UkS(qfDd12qTVF963>T13*KzDMw*Aom zVz1xgCd=DjCTR-Y>_2*v$+rgGBVURgNDfQC{?%O{j+_qDL6etigbGneJ+Qtj$!KQ4 zv9F9_SD^bti?5Adp0zRa#~Jm#fr$LO<}UYIdvh)7nazJYtmKU6ku&iLZfb5?j=Aj7 z1*%*nGdJRe3vc+JWB^S?SdmiZ+wA0FFX7RIYqYxVpQrO)W^(qH@E2(wwCc@)`f3U|MyrfPh3so0p9E$M#lSAjBUjQys)16djA5c*TTO0*1Z zf4U0LAzGZi-gXdx0LN8yq;d28c*b`~VAkKE@wVAecjC-sgzVvZ7If?7ghE69qqap> zD9+1XcpUzE#ufujBS>BJ+Ecze{Y<{4qAKX5?}DY(edK0XOb|K@ml<@_Q^rNV!XGUT ztxxk&(@ca4k*Q96c*Zl!EK<4pO<3=1=asy^Vuq!e`u4IZ{bDmJ#TTvjQ07v6i5E*w z>6jfO&Fr43$u=W>9{TMc6T|T16m)@eeh|RkMn+^(=H`=_#@Fy<(t4Dw5c5SFg>`(; zUlpkUh{HpnCR?Fh*m3$W7eaAiO=*>~iMGU)ha@ z$?ll3nazgoDKXQr07rvXQ6qh8*?xwtdn9qGt`=H;H2I|-+0XV; zrH=HLLt2Cfle3Is73Gbp5|7t-I8co-Uh%bUAKme)_1bFZV8GcN+N9!#DIj-(V1;JG zOK@PqQvw>YawUYV7aiY`S6-T_r!3TzE|W4|RY)2OUR!a;`^t@|=R@v;j@Prl;w`z+ zQ~4i>*stA18z&SD)L3A*Wi#A1ovHAh3cBTxH`|}!0aZ7&Xzbh>jOuB_8H*IOyspr` zmcHn;aOZ=HI60Rl7<%+48s|z1ikW+#Ozsi*e*Yn)QqLO-y-xH5H{1UHR}F@zRL*Fk z(&{I?NpI2i*?!zqL5e3LDmDC{F}CUR*nD+$?TNA!qG&s1->A+YVYzVPSsTnay71mg z6X5X#tuOG5zhCbScm1IQ$Ze|}XKIi{Qe}_R0)Do8`laO!+kX*)rcaPDN+BdhlW9G- zE|eCHYUyV25<^qfix7DVXyzJDrqUcwDJru#-@Tf==Ogs1yeT)wvMp1!UJ;9^Gk;8^ zx&K$h@ca8Dd?@M;ByB?}*FRz&WbtU{tZ)o&Z@KreGcR^k-EzN(L(Fq3jD9Rew*AY7@`v400WD(>Am1Nl-m@1KO3BlHZ;%iQtPS?$3W z26i#q+ajMV&~(`+{@6X`Pmx``|7`wiu`U6~&bwi14tW)1QYE5G2vId<1^e~001afi z`z1wQ{Z%xPEAKxV`uWt-Mc%W3Y^|*SH3l9L6R*(vV_M#eGMdVb)Q?a;z;oaB^r?*< zHoZLv64cN~F>;;L&w+`rWI!t@_uz{ z4lB-E_KfIB5jw%uR3qJz-xRq+u8#+%7(~-h$Ha5!)+1amj{f9jC%;WYS{f-$gWV#m zhr#1~_KlJUY6RVXy_ms4ZmZn8B7w_Uhs$MEUG+z@AhFTXA(XJKomMN(?(F+snB8;| z+FYTfqw>;u8!`I>+SpPSQg3ooa{7WGQiOoUHVYNqX!U{CE8fFKMEe`Ny3%L9Br|oA zooV_+UfkoLE&tHa_p&z`_{~DQabk~jH=t{UbH1zkEPq7Z+xsX_L9J>%`59Z~G$DRK zS6&tkZR%M$3#|YjGE#@{MZVV^kQpEN6_#2xg2=~vUne1&M~D13bB3XwQ-;Up=3tP- zScQ3|YOl2Z4{-{W%D0scD^kH2HYdj&1i#(a1dcBD7`6Gnny~*cPHCp~951vr6Djbs z;jYnR0VO?)))SdG%I5u;m}h@RzTJpdv^uxEvbGQ$+na)2LC1VPlTL3}J6e5gen_8& z%$LI&T99`gDp_V|Cc+XEl8AnX z^E=Aj2$c~jymgl?x{C{5$t{=qS~JcUe?u_@bx>(MmI)})a9v;jhB<<vZoUY1DS`o(;AL7quJTxic;KnsMVx&C}p@9m)nW>e#kMc!Df1)@7Ap8o-bRShH5gkQBHMV^MHQ<2ek zF@cT0a~T z8uX6-AKaJ;%{x}(vah#j`udt%hWsJyr_TJIPNJ+)2T_~#sw;7{^n?(urMr2q6n)z4 zoaaPhK2<}*(AF~D81<*eEh()$y>VFPly{k;V$%MD)&SaGKkgcRm<}7&RGqNd1VSUG zku~i!v8yEwo2TmRCjLw+suD9W-brON@#fgDG?nkq##GMdy+%Hqxl=iOoK^EK1~a+H zmXtTvsDA8w!Y`H)xoyLJqaNc0Zfmp6U~vk_TH9V3K@a?zvIV&vudC3V3tFDz`W4!! z{wyenA51t(=deaVz)AZy>T(8egmxH!B!6J_<xy#)l`Kz_R zlfx1b7HRgh6)e!GFGLu$7TFw=ak3{wSOyHPG#%UxRK`!~)t?}8D>$2zXJe^!cMkr# zSdu1Rz46q^y?(f9P=VlH=I0rc^H+=3wR;X8@7#pJAoHpYuY8!{x)U`lF_ZFDT3tjv zfEA~9%6#j-G5hJLnTFHMK$SgjS-o7_uRs%If9yZKgP+G{wo_q4z#@&Ew9_Zwx@R12 zldEP}=k9!rBKK!*RPatwGtqbRki`dQ{;BHYI6`#zBb%Q?wzritkCwXGwvn~JAG zoCK(9wAuVgWRZtrLdXG?j^Y07?W!P!CGq5^73n%QkuOay%rWqGGxIpL@^N&ul6G8A_x5tm>3BKbnY26V8zn4BENiafJ)1Hk zrcTMlUhBodZgWxe^%)@0J^GACUw-H}DRhj}JS1#UHeco)Xn_~IL?ytxKa#E{4vC8>?6^$MlC zr45v`Ibzq8)l^k^HC&1CdzH`b!!LP!(phb?czGVYe2`8Fr3;C~zbJ4+JR?e|tz)Dg znP&$|Y+rU;+MLO&hcs5*&zJ)WA)`FL$jVAYMOi{n1ry`fa!mbPfGBPk@9xUMZ8rRZ z8x{NZriOn+Nydxtr|%a!5^d)9BruB=Pxd3c9PPJ)<6U?S`qw@`0l&VNlht5p`8ZKE zS1VD$@%V}CK{NTr`KFstuw`rQ8&X@_Lz?am6C910GB9pt+~>b>RYx6?%CuG=-+?X# zJR&Nd*$38@cR^QKdFA?b+^$jk;>$Oia|kuM&Fkd5TkKEJjDWoY%Zgxm!@$OXXqAn zQ?RGglS{w--FW*WU+craVXMun-`EYHkm@qg>unccMQ9ZA&4h7Gq3Ij0r%IwtO+Jp% zVAIa&^nu67(#Z_XM;TES8uJd?gql)W0qsK zqw8I=P=b38h+RK(Xrb$E_7lB%h=q{ClnBOZ1m{Wu%cDA{6WT!9ZKjl(-=1J&=AM5f zD#+u?`7r?3S153A-b$RA+xvqpjQS*5W<>BEPq`3TltNsTNdKXKfXlvEgr2QHK+H9E zhc=g}{}LTq$RbzfHl{G7 z#2jo7@6v!LcyVB%to{oF%iTggyCO0LX_!mD6^&%%-3#{e!e1k)l?Mq2#b38a3JC<# z;PGZr*2}at2%yugspJW1q~oVv2w^q7+N>-#X_pMhA6Y_do(1UjvSD!-ZSe->pW*h% zUMk0aA&$}5KNCRSIJYBH4Kn)&;1%+wwd<6ARt1%1YiYzx9ORG21n9V4MO~qdcWK zg58iZC`Pp@JOcA2cDKQQft64?Co#df0T&E7{GRuj_G>~Pak`yR(bgm0PsB3TJDDmY z16H~2N4@TD((oLtiUQ^vTVOmRhy8*U8LCz~>S6cR7#S%zu9*l+2j0UeluL_n$ahrn z#znf>?KK=#z`_mNg_9`o=R;@SdX|I(-~EtEzL3LtKQO$CeQ7~EE935R(J zt-#UIoj}9_K=RsNF<^LcV$XSL5fF{&vt3E|#ED>N|H|F?qPV4wvd>zeLThX(W1pyZ z@_}MiDA=@0d2oy0rhc^Yd}ka{Vs^ds=m)uX+0lL6_$88HDAZWD3zW>x4hX?g9vrVK z^1+sKD-|*g(Ff&TUw0d^MTrF(uKXfe4T;~v)kLT!RT>So_m2zuJjs&Ec(z6z&0Kb) z)u{*ULqFPUANV)>Y>}M(oJt72vIh$as=G9hM6!!|ZpEAu5ycDk3#_!nSU8C%;y%yws2Nq<)^5oDPvxaHA?M%r8bUz@ zSt2-l@LO&erob8l*qU!6@pb>rrbmW630J724Mp4=>Z(9st9K{zJvuzhuDdPRuPJc5&{X8k z7fADXCA?T?>A@5%o^#EnL)?%ZgDp5a)9M+w{KW^H7x>Csx2*!6`~1Koc=qw~2ay?qcMZDlbbF|Q3fAS<7ywWTa@Slqo* zQ-!VaE;(!r`2QbkywiuY5@mmUwYmPrJTcGo{b=TE7ErALbVwD|`Bn8F765`pW5ei1 z{)lp9Lii{fn$^Tl*DaUSyL+)KAA`O#}+uj`&y(x~#UXRqnXFlWheZvS7Nve)(wW|HTBUk&T(9j!D%VQP=`2D0n^BF&&?N}zNQIitqkazg!6U10*?WpZ zM#QR2&<4Jgn7VaKMo{wY9e@Ls6S1W`jVJV1+=gPHD+NJ>=Wc>Ed?*B5Bv2-^d(K+Y zq5hkuu*16Z64htS7`#Av-lYMDmsMw91M^Ej1p@Pht783gOxgV9cX0&^9*kcEgF$8M zY?yo~Dd+hbv%5*a2D(Jnyit(-xn@&uY&jWqD^tEr?R1Ie;w;dV71auA>GmFRMYk=s zMP-0nKPo_(`ex^Ktt*Ygv6i$z_})rsz-Qjy zj$+CraoL`^0||*(%jgEXxV}Wu)-0}stS6#veX?)h)&CGv$<|Z09;R^~Y<*6DC-k#`CEFr1vS>Sqri1zFXp(gws2UO>qQYBj(U!Vmpx z>3CYNlbYqV)MTAL@#7!m1G$FfS(^R%chda3(P~9k(uY}eVpq-38h|VUqCBp|KZ01v z4XS^kaqhl}V~s@~bzm!ERcd|(@$L$Ry3cZaoe1A&V}VPBDGsnHyMRu5DD{JJZ0ezh z6wcFxW%iBokhK25+@CE8J6J3LQ*VIj2v^fVDuvTisvC0jE=m=*A-kPvV9>k-+l4}&!YH}T%i4Ym|eK@GKTmS5`% z#qBQEit@mO1v>fzC`^>#IRf`I^rV6b?zQb#7oH&{Kog#owRCwG&Ns{qv_?4yO6~g# zol9vz@If)-55Q)SIS=#6*fDspb$@y$aREYnKcQ;VE>$gIXF!-f98|iu-MkaU51fZ= zUalsU!8vDv72ClR>nuD#Zti-lDnU~-h>!qNt#ZrdrpXEq3j&vJs^yhb1xpXRq^OUO zY(w{=CSS47=UluGL(1Ua|67}g&+=C>4lkgmTWT8L4p~`Y2CsO#!&rdh6>9imBaO5MYpxdZzvTCo~mqX5Rq|#DMyWw zKsfYtqgMQMC}7FK1TqrP(SOr*oPaU+moGCv@7`>z9=T)jH9-|y6LiBTC-dav_kRla zU@&D56}hzE!ess7cr;=DO<2<9^;{VioW_3O&%spk!{llT?8x{yVH3Sp1vwF@;D-=W zpc#Vh_`81Wy}QnaWZl#8%8P)Ca{b=W2f|lTJ;WPC5)k`t@Ror>V{G@ONJJ!40_==u z5e6clzvz!-lf2P6c??w?I|6M(y&G^8Fs6I}2L~@t{9G`M9pOVVBMX)!AaQzn26C|$ z-jA>5G6LN*=0D3>8+IsK|Ih;uT4<&hZ$ia9X6Hx|HYqzoXMF!Yln8{(`!LUDZ)-=klx2^U?^qDYE8WioZaxbnG8f3L`SFtybl2M1>k#cmug}pD zN1=&O*y4b(6=^36XE*gf!0aFfduFu4<)dW#0v z&uV|$4;lf?$~b76VXA?!xpMX9*2;<@_^qt0^?hm!gGIFdbUZ`x1(n(Iloo`Q2m{=d z6VvGjO}JV-*s-Dp#yGmv_JwnY|7tGI70T}A)!nG~3*X*fpi3vs_hz-FD#HMRFk_er zgNI|YkudsGs)JFL8kc+Z1qOyi!oGkl+9fIbq5(lKMQI`3hev z;3$GBS|VWNm|c9p_fB+6BGL4D*vTVmAjW2xO zQRV5Knl?%R(Fz-WXN~_0Xmkc6!Itvs(XE~_SVZ*mS%(7FW{0W}k3=f^dXkJjNNStB ziddvn@6h2c_Oa3MKxvpBkUOm7L@N>xP@0fE;r>mA>*t5f)7@@26BZTOFc_?wjX>Sj z@fWB6}z%}{O9FF$cV$zyRz$*{W*k8*QwJtEmFocKv?xAySZ?)G!G|9wph=$My_R9(F*Jslp-jf7c zZ3f5&Rv+o)eq2+fhX*niEouOQ1Z76d<9KgN|sO&gh;1wkN0L$Ss_rm|#Bh6sK6q3RcPF7mJ(fXpu`? znoT4H7UIyv0A1jiAJAT;XH1(^9(6p?ZuN{!Ip-ng#f)XQJ99~5cE@C=1HTmM@zEUh%@P`M zTuK-CF+olqe@0jke|2Ap&Si;yEW=PH$A8?O0-P?}k3&f=Qxfa>C^zW++J1u(eleiL z;G-Z;I6dB)X57oW1bT@ny9e&1>D1f9C6c zipU;PM4iq|ig~cENe;a`z`c4~%bwQl<^VcXp3F$X@WuBW%j4<`%wV*N`-4bzasi8p z4%Al0+a@hFM|tCwpn>-0_s}4H<-ca}=pw$E;e&aRyFd?sNO*IsQYKc6VotUSfMSF) z^V^gZz7=d|m=PJCZM*tbat=_8^tG*BZSDsu{PGpz7U z9=J-JFu)EQq*aA)$LU||RQM2$r{VBD7|ZE69Jt1LWEBFcIQiBdZ5iczh=_hL0tuw6 zGQL@*wB+33>sP$TO2iMrF%N{&7Suna*(n^7xZIrd!TN7TP?aIDgYkD%1OQ5G{j-yBvMcACyG zFE6{%za!8r@XD{F!Lz=}(8oIpQo1SFfQXBBUOuUm&c;vrL=D=1D3ga@f>-DZAq0$N zO{){zj(DiZZXtyeERy&2HRhZ@fJ$0(wC?WA)jSk7$eGCm&3YKH9RSP`(pAY`y8?$t zcfMbgeG~-}ZJ;z7ra z6dgaDd7MlM;&a&+50WS7qGkJfe!>j((K&LQHO_Y_m--bVif_Qin_?G1O7lnz&L0$@ z&-V?5y%&p*cYcA+3IxmV9L2X%(BwGHCn8O2+F$@6ie0Cp1y2smVxFm@CGlW)RbN`<} z_ko#IU{p_XjMnHgfP-3b(g7Oa4sTIPw{`FfOrKl9L^*5mn|I`6ZxjAh?{z`YL6Wd0 z7hY|3x-9K~&$7`hH;A`2-tN+W*nrmYVfmNs5bWG6bscpA=dUd_B?`voPbTj)Co@_c zvY~jnRFFd-eB+!&Lz7KIn_ChGYzvs3Nu|$XPkwHH+8~~pDI<|_vLsA06GOt)GSGSS z+Y}XyePFS^35%&R{H)X3R)AhFlQt3ryc;5rkYd3)24SLIeM{a{F!)vdb$$=PLp>{} zh;RQ2T@FZ53~K``NyKe*Iga` z4lT_uC>%@-=O=Ldnn3(g-FBG_gvvW^YL709MKu$|$w5TI-jC1Drx=6X(xB>Zsmu2C zJ_eSe7&jSt@z`X2_$c8J#8zmpU>hgrSbo#F-UV0d@3EhTN>%nmP5-TW`6x5qwNb`ZaA!jo;;mQi}`}et}CZH=#2O)v|aFgR;4hzKkkXUP! zBHlG=W6T-h8@ZWzIU?JhMGev0DgAQZ5 z;_F80I}o!B%Y!`U66SG|);MjHA_yOV?SPCK`6|UCD<|+-mz31ULRY9FsK_>M{W%}O zb+QnESaFkpcedDt8nZS0i+p6lKGbC9(=RuTTULTU2mm_VIt#06koU2PSdtkj6lb9k zkL^aT=7&cg-ArgBH2n|TD&8q5-ln0>xyejz*-Sf|yf-?Q0dJN0KDrzELzv&pRul)3 z)UVnV_ccS5vE&D40}&?^^9C4PltSl(nJ;CHzW%R)IRre;Xdk9ht{+I*7CIc0!B-Bs zG(tne&1nIz;XfE6H)g1~aPX%d{rO>hHM>Vq_br}rKhM;@nY$Ba?`SIX4uhNeJ@{{( zI`ZY@^AU(F_!gDj5sk4h_RQ7_6Tu+H{0-bYtl9_Ev1a?hc-?9t+Hk8!Wo+H7;iF1Ne(% za;3FJa;~>J+Y&*pvBG&N1G6eA@@+#zD#n5wAW1;8hkw8RQH?zBL_n?WMgodz-m5(q zVcy}$uq%N!mfuUY?Ww|O1IDAaFcmLK-}ldO#YyO%dChTi(w@>of66w4Vj^@851#vp zzsg+oajRp2M1@ut#FBP2- z$I=qWwlmwuuY6`NO=;VtMSB{)0rhq!zst-C`y126|gu6^|ckPQG{xvKX3owal(f+&8BZ|4*F<-5mAIjaP| z`w_9S!m>K0v&wGF2-5*whf3Et`+YBO=+#^%j+dkCDP(5a7xaAu!LtHZ&ruBP0)ZDQlt>Vh&cOy{k*dJ2I#fLSlr}6tv@8 zp2_DIOW4}34e?X(I78Npz{w>m->yZAO<=??HegvJ;i7{ z;GOwhM4T3;_Ss>G`obU-OQB9|dkG^W-CVix+fNTE!Q_gHO#1$`L&8sq8+*j3^}5Jm z=9BW!HA<@v>Cw~AZHmH8wGLcTHW|h`Hp)K@%1d+)>4*)>%`!J9$!)?Td5@oRDG9zt z#gP}}C~jRoZmrdT&N=f+_5S4TF@Nuk$dRSP5?m_Lz3YIV`Y1%*t#$C5d-YNSG9=nb>q!!WJ`X+`! z{uQKD>4sdtoqt4yDJ`AfY53b;HHhKw!~Dy*;q_0nyA+FOk5oK3LgS_CQWc`=2F=I+ zB)Ph4GYWmf>|$}eT9LJ&Xx<&=73j;q?yAcpq{T3hM8d+{llWFA&QO3xN#*hWq@qH% zdm`-!+19c*ZX@6&y?MZhRrF7_l_{|#HLcar7Ro16g?9)F(8SeV$JTL*&81Vf+E8xb z$=pI)`B{Y(&-**(o6@^p?oxO=}9s;MTJjB9HhbDf|Pq_en3q{MZoWC&h%&aXXWY z^v3L9OieQ(d9|F|JvWz;;NT3@VNqG#3(XO+wv9DcYT90R;JW^Vjyi8up!hsDBi29z z%Mn6-v2%V*=i>Q&UVOPFonKGKT(a!~YiD0exep;}XgM{6?d^i)+a9gA)AcooR=gj_ zjZPba@(A-L^}3~`N0TM;>7c76rJfTJpK6@8P%!@N^2g~B#UBk-M-%dz8z=s|pbuqc z_}H&)LM1S%uF~EAH<+OePxdWOo-9U1xh?m~jUSc9kUsM?e6^5ajx^cTl+o03K7 zlO0KE!Kv)i!C`0{{Rhp*7NaCxGifgCXAc*n@|;JTvdYTS!@1E0Uq`#K@X107_pA&4 zero~eS4v7Mtkb}txONh(p8deG5L#V?OKc^Jmd+~H;XB{qFgbh)R1g?N417z@0Lss8@JDBoLFDVDokfVR{1Hr zme{6_f%UgULw4RX0h{W%yB<464o|OT$yr;oyrp`>UH3pQ8NHGG$oJw7OZR1mal(qisD~7ZwA5#ra5~n@q{X^lHya*kg3I!c4 z@LZ780JhN9IXuz;?iFHN+88~|c9$oJAmXsKLXIfwi+&@1>a}H;$vc_-u`rZ4=*hs; zza&8#=UQKqnICzHocGky98;dxVzMK-@}y>|rnnB@iSmw>oYp21UyF1dtUSGqw-_j~FwovR`L#CDHl$BOuEpWX$ZaB4?j;(Wa_Qu_X%gAAo+qwv;p5h%W`uwi;U z2Rl^b8RvS2w7Jiy5hwJk>yyQ(4uclNce?~DSqw`DlL+KUn-K@Bs(e&uloe?^ftJY@ zlv?%u*LvJ}>vHK96k5zQw*yn`tUKcYKkj&hFio<9w)wXWY;{y_kJr9u6R7nW8(4gC z@LyKo*l!l``!NoF)$NtUU>oKRB>USTmUMmegimfu-pJm786$2FgJ{ECUcCkBI zV`WCL4MCscsypg7)j}Mu8$xrSy9=!?dC^`i%|Wcr+bttY>+m66qt5`?s~C_;Jv8o2 zLSZ(W9XE|kr4nbux-hp`cUptfdEEUY(?wj<0M$A1(D$6|NniNQ*ghFVqoR}ouq{kJ zM|qiZ5gC~j7+d6HvEeVx-#7#tLp?Gddy7io2v+E+wf>G_-8ZPYGXNN%5i&D9Z`zj% zhwot+Kr-Fi(1VyaTSyVdenBa$MdOgJvdXnhA^`X@igpWzfBM@3e%EmM*>5XLJA>CP zZz;P(#w4d?urITralT(|cGs~h~solNhw)W}d>H0fvfd233 zthn*NRVj0S8e`Sgj#MQP%pu1O**ZGVMf%vit&1E%#Gi7y{Xnc$)wm* zK0{{yMGe|daBM0?@xqG`^BmHf8%Ka1*4KMF45+9p)1|S+jSHY7Ro#o)Za4d=-yFh0 zCH7KGPh0dDhxN|BXLY%1PuWs-`i_jRc zv4J3zr0DbajLE-dd^$6HW~mKPp3Y zvp6eU>A~ChsHQb3n;zDJ)5^v7F>Sa_jkA7}6hKXxb)kq))jS}+Y*_;o^e)fW`v;qu zM)<_z;)~?XsRpO}(-xcGuZ;77h8mXW$M)|+hV@_+OHJ$^sSB)Wu{{xJ;w*7hn078} z#y2u|Q$~yV8}q2P%U2dBwl+pnWgPBl9wq9CN)2x+TN?#!vkskasz0h`Ezkev1uYBv zmD{+sMDC9}b=7kcowMcaI5GDmp5gQcwHp+UeXgIo@k6$pG}w;K8_%6|{1<#r{dTIK z3E<-a=A)W2zdN$IeYt(zo?LBPtJpc+7BDgvS86ytnKIM#OihenhCqe%>Q~M}>%WoM zXtl?sy|m^YP@FS^F9FdzGPkvTh6TPb!eR2-jc=>Lad<|nhI%)1nK_ATxjkU}Y}j*@ z8dO8?$cvC59@~U|BFLxli}oC6>MSZb+!`-=vbC02n#LoU|dk!~Mht>pkcQNbZD~r+SlHIBa(*;5R zy@PuXMARINByKzAByOXnvr#?;)M+o&UOG6@8pM73v(J&_G30K>WbLUE)T^32*xpVF z^C&3B92)%KjP?i0$$*M{vfGFCUw7j1>bTA=A$l?6z>yG;_Yrwtqw6Fh?R) ze%aYQ2s3WtWgV$vmBG*if7x-@2CJ+!tzkS=5i{s@PTiKXOVZpn9`Isb{gHg^X-K@Z7;?A-#$(K}AXC60$1N+%DY=RD=Zvf&_a&Y^AZbb#o zTc=xj;arcFeFlyIY-Z-Ft-h|uC;9UA-y;aWg0*n4%^~OUA?cplFBMojI98qR*94fw zo%Px@!Mf^FTabq<<*_r%)vqBs@=eW~@kol&EfSTnsn$N@SF}Ku&P_PyAFxj#6)M0$ zN5Co31QpvP#e%3{n2)ZUCjqf$##`H5R_>bJQn0vu_VjzMaqJHIsv5#_F)N7)NwLoM zFGb{nmF#M#Zd-Yq@k=vlg26ur8~r=ao@`^vjP z9b>%+!z^~Y*Jr;MqGYTi$<;sARZQ7VoR|niqlONNq(ml(n>jI|GZSnx8L4+LO68S( zgyJwUvvl?T`!zZUfvuf|PYB;RdNrib@w}GYiEw|WS z$~-_j@6V?Z-PijapnakIlV<<`CY+(&~-ZlwN?^R9qx00gnMqAZyS+2$mT$ zv8dJDTP7_jp)r0hBM}~A(3<>Nyv_#Qu^AsQht;D+TTarN)UJhl6{UmGZNz?eb21=L z$4}1QA4?#0vC}V4b&Bvjj$vxxynf{t8pe;`tZ7kk5CPr{RM_3={H`y_0|A^oi|x!g zX-H7sO@g9@*6@No-Q(7mPLJ|XgL%@t7+VRI7E)4Pk>RFu@WLH)qe*}w*|_x`^6=Ug zS-ejKE8LWhEnuMfaq!^0yH|YmY_NH%+6I&H?hj)1jWm3>ge?6r-^Ys5kK%BrHsw>b zYm&f~NV{uLhwF4d&XIsSL^$tJ5Ek_CfTcYxxo1;is0KX;)qUxUTUGn+!J5{&$(ss~ z3pLgkuQSvR3dVjK8cqG;01Xe7jP2psBL8gIeSrs=c6$hrl5j^?x2La-pucBe@OuZfEH1#^oT{SCdoOA@ zqghMVBG<>EBc4;fW$-@dB!h5+Z>PFZJh}v2Om}3uNY@cM?JyDgYXxGevU?X2&gYFcS7$*gch`M`v^S6Ma>RZjt?MZ!v zMq3qXJmf@mvjltrXU&U%Z-Q4vWoBx`bWiP$*_@cVx_HTZIT{XFR|KFH*xz#1xQu$V z;O?n0CxhkJKrk{fz)aXpH5@uQtidN~2Y0)xI24dR*Y}{fIOfq3{XF@^9mYNhag-H0 z6DijG^w~v%=WjdSCCUKM`h!LvqtfFg6^`U|DSlWN?u!61S!SK9e^&EFiK5nJnUy1I zwWp`S8}Q$>2Xnj2uJi7%7L*#BqL~|r{3~aI{lRn5KsCM&BPXXK2HxFz)54D*Za*%H zvjk@k>ejF_hQn_nW2yG=z>%yE8fBGbYvpa47x4j(?7vsK? zuO#IWq&yxlP#|ac-a`_y`ume5%Uj>#gDN;)-QLO{&;w&p9h0v&tXpcrSI(WYn-ksIOV{%`nWl<>cBt=_b zJsyI9SvzOpeyaU#{e)#G;Eq14R9&JvhtRIAOKp|Zg-R4~&Pj+b!!6W+#kV?Ej?u-z zsJ9ftVpn-1LW}Fm^y@ThsND9L07c`cg*kFJDDwNg>fH71zLt2tNmt9Z%fp{Gy#6`O z4@Bws8olmsC8iaUk*vBhho&3%Onvs>qVRQOC^e0{B7E{Rqb@L%qU7b&tR4WwJBv@V zuzF*CJ%a+U4bSheoHxXd?XJxu8_SV!bRLdK(}c!e8yhK?H)I;ME(6@m+X3b-w+7ko zPxo=n0h!x4zT6z`6_*xN0g4R%wOfW0$Jp7UWFR`D_2VC3(}YB|mF>m4sgE2{D^s;s z7=VvuiIj-h&tjaMDs$Y@1D48c)=M0FH&6X;h-9N$>4wnk(qc5cYcV|_q&nR~%|@M- zmXAbiyjHKy9I)%>=_fvd(PRB`^x#Z<{A97aK;h)J!vp8Qa2++q{W#iKZPd%uSWa5l zY<5)LwDw3seRkCRXO}~?B=5rEH?;;eBggF0)HjFlnt$hvW9~>_OPn`x`ijzdk->J} z@N!67-d-THh|4w&RxB1N^(?xt?J^hHFJkzarK%IMue$HfF2P-*m&=#g&b?@{=M6Ru5a44|jLY^RBZ5gTu7kKv?@6 zrhwYh2j$sqMjx-YKU^13PEf(qosDl6{+q+%E6PxlamSx_? z{mH*Rz~7MoO8HZjHN+TQ$=dET+oQni*+eJJ#OKMEjHgS{mXYz%1Bvsd(yK%;8#)_2K$*IEBT&^+vqKdh)xGZcz%wS6WC_fCeC z27GSTgiRYTIzcQDSq?{TA!DJvyCozw^~J{>a2xSJbZV}(PqPFbqCl4dM$)P~^wf;w zeZrrFIVhg<1@3xRdJ+%%z>wz@MvEwgW^9O( z(caU@z?n$sf~7Q2_rl<0CCm5ibZ2(@!fK?F;mTxF{DHfk`!Yi+XJAYe@R6cQH2!rs z)Thk3*SH+hf$-oA<=qUP2ladPv0IPsp}u8RK;uRTrmJ=F9V&P5xN{L%D?J1L-TesA z!e~^r8=ez;3UcaiOD#Lho}HXppPK*h3<&s8#Aq!ozmFqec}ok`d=WX(Oud@6o(dI;l-{&yCjSgSidonJPa3c!`Jvru3j4))vEdL1K;VFfC~+^d!))>qK&BIi zvDN_qmp#EsvTRz}y8MsZ_gXl7(C~-yOKBUfF1u9Zf8EJ$ws3>0sW6 zAo{*9vf+kXL>13fQ;W6uWCcA)XtTq*isOh>IG_OWo|IhLjhj7eXiyFpnD*YKS_R3O~ znr=%u(5Iqj6pYwjqnJWAq3lrdSITc!6xIO?SB5h8*QAqiE{QKk1v@TAG{P zfA5-P&T&pWjErk?*N`9gzK4UZWWGofTH1*IGFsU!5wb611=89{{I|>dv8_DZrW7Ug zJpDehjV}b~Wwm@xDtUHRCyS}E!d&BzwH`!l%iYxv^B19dF;7wou6umt<+k6?#6lA5 z7@~lkz3!Lpc)V9AEe;7=5CdlM)gL#naG$QzyNKCRTN|KJ(nCqOoeo`o$NX^_wvuTz z+jn1E+bAj!v;+CYjL@E7!n{zUz?YR4CKUE=H}P5gk#hq*9bDJdAD+l->-=|fK~)#|CjS6 zxr@eUfw2KfYL>UO+^F+(c)%&QbG>^7>}jB0;UVku^;>W9XQ;hYIHKUCqw$TBeg$Jb z&?wXlOt!*XnZNqNW3_uXzhsiNLM*jh)cQ;3hA?X8m~WoPUqG{yu(Zs-CWGjnokdS+*u z5Au4Cq4n>~ zzpc3hKZ;Wf&t^a11hoI{^(Xo=+2;z8V2gF8AgotSqU;!vK7CA2v)OEpMpASnO;k}{ z2B{4nJt-N(3UN=F9N6Z%@%uOS9tl9SX1zi)ynH|u2tf@XY@qgS85s!aAE)%$KUcMT z2h?jy|CxJdZ2c7 z8~O>hc+GbJr4jJEiKLm3?QW&_qGE<0a7XfIQvgJTYTM*@s|0Ix){%FXm7V#QVvzn; zU5^0*qIs`1nmHPrCq8EVvDb??E=H3p6eO%=H=s7$pcrc&;WHfg=@7OfXR8oNfi;)TB#d33_wS8WKItuF=kL z{${5%j4lU|cZY-ArQCE|$%)nM3$Q39_yo~+#w~?_UX-!W5CpkDFh4-7*9J_;BeI7C z_VA+9>@vrWLYs6fGQJyxUt(3|V06MDY_}T##ugv}J|3SR&9y{;tOQ{{1n6k?cL~z` z#-bNhZbmh&))=_8TustpX_LV51ts=RD{;X&i06i^8 z;y|*w2~-x0)Zg=Rrj=660?ZnxrG|Z<9+%tGykMi{ch9~f2-(13x?9r>x76(Y z!4XgjOx7K?!}b<}vz*~4z7Os%D$eQ!1Vdc1rn9-(L)hf6Vv;?n*)Z!XQhRTpcjt&+ zYw?YY_x~9DoW5-HmF)IgKNTqL{y*Ozt`F?txG=v-w$Aqfg?(*#`(YHP*qU<-tuH%V zv=_l8eB|yiNlkSOsC}?m6&nTd;te>hKxKcENf!V@t1+Fy<5lSBc=03}xzwjBV|45I z!AN@wzl2hG^=4v&uMWEn+k47agp!LyA|`jSHt8&k)FHs000hwTpW8XkB0sKIP!NP- z;a1wRHx956aFe1ys(>Mn@1{x!oE4@o!Yg^hsGP0ig{&MdAr8<@uP)6DASs%g+#=7` zoIsxT#B5jIecrn29$Rmsf;oYw_PdV<`aXdq;Ghx&tPcz3{t1bV!Mtp!W)BX)BNF5ZrG0cYq-zk`r>mo_tpz3^}NkNimFxwz| z<>vHRYJl!(wg@DHXRmo{=O%yS$trw%M8L(3j=3qS;{y1fHF8-!kUn^zuf<}0VKD!E z8w^7nn~cg>z8eq%4;E5_i4Ri(AFHC-ua?N6QQv=4KB={+N+0PRw%zY%eN5njf|y?d zkMOq;OG%fAzqbCaS7V4+P&Bil;csj3ySfyEa$kQ&6vUGPeE3l1yu8y<0Y+vztL>|C zhSF0bMW04_LeM%p#^O=T>xokJH6hLaS1R)=|0BLoA)M%&WCcPC8Kil~l`f~NN-_Z0 zl?`u}#xg@jsA9^Ck#MX{_^V_X>e%=s<$tDkbws;<2}SQ3pZmepG!V*8o71U9zSqs3 z>PkSzlnN0cGFi zwbWTka%#^sujlGW>8peHJcTh&jpr&CBWZn7V*3XkseM{^MZlNv2{)yGpoJ{{(+DfR zh)z!Za#p(vQk5-fQOkbNYyfShVxcEI%-+vi%r8*QUBXlY9_b+IyxhGBoH=oda5lQVie0Y( z!+XP&+5(Baw3jF##>?`-x6n5+kO9&VwqRTBN(z!0V-)7tk3V}_C!#TZJ}gM7{`2?- z1T1I)wd0EX&p7LxV~rn}$&t?0>>G<19o83?CTfa`hs?gr?Qqba!{_}@T3Z3b77W&v z)WfVIM5gF<8XIx{I{2Q?_f{5rCf?S7?izp1^1Dh_@BB#NOTGr_|0Fti>j(MlY+j&# zjVCRie-kkfR>E7qnBtts)@WuPKW5`I5|oQ6H=f@-es=Ds7_(D6L+Lf(`urD2(iPwO zXU>hOH{757EB}TEbMtR{&`=D>pmB^fLHPERAc^GZ{C~wtv2Y*$%bLcSKENydKQE}T z1GNJ5(_mpuFxFW@B+rJ>_=_KZ)hi)o2}lL4OaJ@F%TH9<69(_aL~5zg$j!W8wz$G^ z$Gd$2^N5N>F_{YGrpt!#*w9`H&R;=6+lFLX`7zNDiE~{aY=iO)II@?@DE;x!w5EAP zbn=^LI_1Q_uTwG0QCLvvyzMe<_^@M7KKz98(ZcR_9UO3k>`>C+Md2?5ih`>i)D2UU<1q4S9G1dszru zDky}QUO9CZD{Cq5))rMVRkY(+?9Ag-tO8M@2#*s~CK)sxE#xv9eM(;=M&B#KnrC## zE^-%ZSlSU14|pOVYlNy;aKO{$V=^IM38LvZ2dw0c_+le4vD13B9&MAFsGDmxp=h!X6QMC5U%f`V(;WP)9t%a8Z~ck4o~BRb zdj!X&WKR~H8A}eEQ=Jf;d(S=GFZt~oa?38Xm(vlF_T~$>uAKm+Llgd?$k!@nmJ-(g zN{A;Y8*53ey0$+5ULKF0MILty@f!KMN%3u9CLWGZ0|a(gmA_hpVX@gqjRmG#)!nOq z|SwT4DB@{7pD0dH_~A6I{d5R2XQnVAA_bEXh+}AHpJzKZYFNY^wki8#f&)eg3m1%%M~OGhSo~t zdw)W;Ln1-88R5w&!WXj34{b3CjJM1xq&OO%e`;sxMWb`x~kstP@eua}hj?fu`>fDA!bu`n5SOIR4 zAt8(6ftOeEe%L8;)WEvD}{hQ)3*b!r#At1B5byy=C| zE_;JcniSLCFC?LpyDT1y#{?&!hmJfDBR!9W8o-M~D7=eXTGcLk#7>W3G{JEo`i7mn zDhj$nb}Br=D5Qa`PqxtQOKNFXsAd;ASs6A!(9~M29&>`!g zqt8q>xrtEs#w~VU&_N|*V^baO*Mg;NwSO2K2*84kl9vg7C8kkhyoSyMlR$gjAnTOc zA57o^GhhFAEIvZ?v#TPsRQfjI+Pvgvq_ey&4@Au_^G1wr1nB4#zO~xLJ#N~e`k)5hdtm4&C#5E)Cj{XBKaeEVZOFe{uASOjQoFpd6-M3EmGSh4vBz^ zKy>!vJc`H8)R+*3(Kz~J|9!6f0aPUo?%8lp4@>f zv^P^L_@af1T-fKodx=>bK66C=guuf9>o550gty*gx5x$`AmV>CxHk#^>6Ob57EjIg z{0WbScywxW{MY2)|<{3qG-mKnTd&bBy8yks(uxetLRJLqlU6t|3xe{RP60{EWMkL%71C)clqIZ<_UYzD_Tlv~Ew{Bn73d{?Ee9 zJECjbHpfY&ehNF-cRAiy>L6%nKgc z8~ES7xL#@?pdH=d9v)pfs=c0D9m&TOkvrhphuY|Q{q3>7MLf-CcqankCKq;Ga%5c; z<7{Dqtmj2tLh)dk2QKu24l?*%LvJa#*n`*p2-Ee`AD>!?voy!me5%8%*J_WoV(9S2 zO?OK@>$kgWAR7H6h@qYuD!WCBPblP2yv(XWf2S%Jr&w`>h0CSxBt2-y!7v1};`7{xiIhLJ4ym{x_FHNr*kO z!FT=PLO~4Gt4ccgP(cD&+~n7iP>FZji5#Wne>$_OsGlyetD~{~KDL(v){i6fTqGKa z9kmmkyjTMASQ7kMK1LUyHsUTEtpLI*EXHJBQzQ?`kr$r$aoMPfWX7y?ex}#ou~T*( z78%XVT&wajF)mFapll#W_Txgt{c%&)waJOup84CestA`&xpyU+A8AM{*z(4O4aJte zEhL_Ey<{c`YkFK@AwAxZ_g~C1WVq|vWzkys-p$;&Pg0!b_IO~)GgTJR%18Y<{CImV z;*-qExRlUw;xtoGGMb> z%ZASG8zICPnB%jWT^*^Mhj$X`gZIzF9l7=>$2L8>e~qCAhaH0(xL)gE3~kC$cmdIm z!p`KkLOViPcqODB3H8wGEe?im`(iH`QMovbTDV9`T#G%`D_gIIEZi)+afDy(`zFm7 zRt~u$Zlm@NZ|4VV1IhRv)_K)a)CpOZAR5;VcRU&=lfP7`RawpaV1BPQ-~IUHWI|d{ z_0Ss05-`Pii7j(6Sa**wW7kzu%n!%$aTJZmwMOdLPZ;TRd_3~IzTt|}WIE;m*GP8` zI%n;)aJ#SVTE8H8HS^L%Z~5ET51nu)C#OdxlL-r{x4Qbq1OI%I(J=Y@0wEEl7qbI) zmXnf}&9*OF_xP$1$&oZI7OtGebJE1z)rmE}3^fQUe@9DI<;kGs&%MQtv(yv<|BqB+ zTwax1B#Wa*Wep+VnS=4iZN$~>iwzR%cAH{F$ES<6xrA-a=P|N>t1{zmNUR``VL93V zRhU+r7Qn?@_{d$0_jjswTrDwufp!>w_0no~t8?Ha-P+Bx*?r*O-KJ9t|bTet=H8^p9^zHs~c z$)oK#tn16oM$w^NtrF`pHW!ier_cALCHh$L@#=C(G|hGI{k^hH#k9wo797d8bH$LJ zj72y@XXJh7N7LS+I(X(onJX^>11ar+aK-+F%Q8U(<=iGi#Bh474{V|^mq;jzak5W! zrm?D8z6Skw*;fJCG-%|7!>qULlNPF&Qh9ZOcrb(fC_%CfgN+6*)rxTUwF$H=_sdY{ z3`M1ElVnkX;$%sMz4d2Z(5dR7ncmKfLv?a_T=~XH+G+-Bo*M-F-EqB*-3t32QlsMi z3Z*8LC1oqJSOn^NN(_AEP#Q2BF!=V~3_0XHD67Euw5dDpH1Ji$J+exp-}4;pI?gFN)IU44fn7 zm$ws-=y2gEZ^@}-nj;o>%xU3X&zOE<|HhHyc`Hk_+NN<69UZTSo#j`He852BNGA%r ziG&u5u!ubOq9_$X({ZDW%v1;`_0pM1mqloU#nir!0dkU|c2~N^+YpOoGs1Gp!HC8A znnURn!o`#&5a(WQz#`AmFu!Zfyu+gtN&XyskbuxJo9Xb6T2hAPSVn5=k87{>9uJv$ z)OiV6tcZtrxO%q4Co@6};S!oJ2sTRYVePA88U;=^6ZN)Qb0!ny49szr+)Ae>Gy@XU zU-E*?#xP3>xs4hY_*$2fUK5n053QV^9=e1|oKwQ?RKRgjXu%yYA=iM#1St|HLEF&C zvk@4Lv_#<$VKK&vucI=@jU3tF=R9q&C>EV#3iqT6i_Er0^J&5D&viElZozCj!t3b6 z8p8~btW-NwulHUr+*)&0Ki7Vk(YkUUdsp14wVeDuoyG8avVm)Z{=xEZfXi45WwuEZ zH<1%Zd)q|CnzH#mEpd8Y5G3OAZ5tMC(`v~+tv&kEj=AU0)MRPU8J?r)Q)V0Ko}Hhx zRa7Yjbvc&W(j2?5FHphm1d@?t;F92W{jlAC$0R=8!DlpbstlEKY%-E9YFNWJKXQmf zn4=PIi|nR{_%{ct`PuW8%b|yHB5iA4NH|qQTnXC;_T>*5Us^&TTt!kNs$Ee|wa%x@ zzh#{drz56a-3S&-uHqWI9FGU0hCq934UIS4>198=*!;WBgyP`pYs~1TS!`OPG4$Lu zEnR6~`RrQ$sW*Y%+Q-g-ur#eRL=Xe)UtROx)BV(d1q5PUih;qGFSAVoqns#m2Y- zk1keb~6~V|@$FJfuJsj9w$Ru;Qt?iknB;?v;Xv;HHc?q+_6Oil1fBNW|6@NVkA})&)({?P{#P{e9Iu8{dXC$6(Us92{cvXFY@-Fimn2k6<>zbfimnLUHS6U*-I-VEtg z2lY@cSs{srg*jh<_&+sFQ_=o+7T|Nv6nT>%%SdzBf}Jott^(7kT)w@8}+&iqb+0JVc-?dUpK|r$W4g+rs*v@ zFhRJQSX1%UU1O*j!MerLQF)fhA*XN;dDp6*fBB~6yf0<(NYl*R?GvPt-W|F z4JRm%an;|IWUNDS$c@6taj4tZ#C0Q0Z1(ngsmn3AQ5028EEet`6SP-SDA2owqy_%! z3))NIF698~cz`H`hN{i-RjYnm46<&hND!Gx(>XVRG(7zaf7WAusJO)(&<4L;)A%nE zl7D*^(3Pl_c;b$nnf^@bq1^sCvmBUR%~{!5Gg%9Sx&Gc{ zT5#Q<0Q8EGcc};37eRVL*T{8du=`6o1!J=P=~#(@M^)L)27YR`y|@4j{zr9}EG$m1 z$Ohn}C$v{yC{V|!DVN@h-xnK85`v`wc9vHPO$WXZe#VI79{IIp_E$WZ1iAp<__ofs zA$6^ZGPtDL{WpA>iK_ayCAa5sKjaTA<4Z(F9lq;%X#pGhb8;-V3>x#Zf!^l`;z)I0 zAg2AJOhSR0Ee!j8I?&$c0;Uw#q+z=TP0Y|yiy4fwSZJJi9<_+v2gO)AJjaqw2I^5g_KG#cQm@PcCi+t73?Bd2_U9zz z=aJBbg}vL(h*@z7!f!5L)-~VzS|O+Wjv@H4?dISW5%V$k=|0I(jZYXF7OW0HS8U+}%mvDZC3yp&wG$VGMqYeU_qhPBn#$=y| zsd60ZIH;FOY2n^{F5Y)dG|*ahUjgzpB?Xu{ip7<2A z9vwxlAGW+Nc6{jFDIHyw2KAMgwmVZs`%a4os zSk-MpUg)*vf%(h}JCnT>IX7#bRYT%hlF;!IrO;b#a#)J?Mo8isD0spI2Hz<< z7>`C|!lCU8Z^sd-J&){QJ>V5Q*~=YXF(*F&1|@Nxn0eREObCsu7PBQ_|HYpQ%qGQc z0rp5hwKWg?t`~07_Ro*rrkyv<&&YQW zzD)eWn%u_`azgBR6{LZtgHVGQE}$Udi8a&HwhJE*i{b2uu|`z)`UKGzf^^vmRrKrU z=}U5kH(sPfLM4pX+~rw4mEr_|5!sxuiq=9;KDNu*K!eU;o z^k)uZ#)$y|(jun+Fra|&lpa9oAnW)`g!__e+F4c6P0-VRWE3M$zUQHI#s9L9?BT@7 zg=NWo#Rz*#;7+`|EKhkd@?a+`kJH?TpCI{b-kzo^QQxtVC~4&s6z~LjY`JU)IRm&? z6Fm$u1JaKBIRj2ZX@XT0n0}Gv3I|0+rcA>;JjaQu932cC3>>GX^>=Tt&vL4@nmtOm z%w+8w^IeWSTMm>ncMe*rTXFESD6FvYhiwps38tbm8~n=%^-y$s*Lr>xJ+%DPZWU4_ zZM}P!{xXtbdAOc=_n%6Bos43<-nVnal^DNyCdttp!jwgvC01>L-z8&zZ5$xwhd8mk z8bTRU$Ss2{7YVUdq*k6(`@*^K>XIY(oEY*qS#v=uUez53vU+Aay<2D-`z={5R!gO1 zi;*p3L0m6__e`hkKQZCgGQ1n`Dk(KXLq!aLqwwBb<@2b9Z$iC5y+F|f%PkXjW{r2m zlH{JAB3^|!EMI@Z4*o;sgNNQ1@s6;o67MpB*$30rjGVR%`$2Z0_>?9rnfx|iYSS46adHBY<1SD#2fF(2G%B4T#oaTt+^|XU`GaH?RDi zNITydcLj+%E|IoG=fClkl_Yx?R?3;rjp!L9sbcTe?BOAo)h8If9KN9NlE z*5_361RPh&IDB-evQ#wUSGQlE1sgK&S~6H84_l`|1n4PtR9pooqFybBX z@YkA9e;qs%hUA$#)#3-md1mFN8D0LkYMn1#juOn~a|&du%e|EMviOm|68vcBf57qx zj^t7zX2g_llKGI{ODGbAbdR)fB%Gg!D7teN_gpfOw&~G8;Vw}YdhSBYsa;Xbt6K1; zFsGP|jHq84rS!TOjw?KxAzr)9L=15j-ZHq` zyN9?sH9sOy*jA7M9#h<)NHTuuEB}icCE%wch#w2uX4o6BPz_$=FhH%K=iKVL+l<4Zg(2a%WGP8g(ie6 z!ZC7}-#j!dy52ZNLZ0)b%%CxJ4P=h!_{OdHMYIjTf@nANdJh1$(8Xh3B*4A_1l08e_C&SY8(S zbs_l&f<3=(mFH!Q|L`MD!B@0+ydstQ!AsCwU{ZqA2mfAG@<;w)8(#ufwyP9_74mRi zXbf9s|8$G5PF)*KFNXtT!U#Pzfcl~BIQ(=_6sQo#TK=1Q% z$?w+)jA04-`R#i+f)}##-4Aki%&_5<7cmIb!jBJcD|$P!O-(TisqCM{GL~V*B#)w- z$W44n=y0YxiVQR(n!blGZ4BItz9x)WqFBlm7x)UJAk}{O>)h}-(W2hBqF}p0ulj#D z`^vDWzAxONM4Cam85)L`ZW*MTp*y8Zx&{y!+Ce3xl^nWDU<8o{QR!4lY3b$;zyEW; z-VgVA<^$|=&OUqXSnFNyUVEK;`3M+XhR6bmd^i8fiUBV|``SK2dk;1OaVSMDKPU|_ zbH>WSlNI8{`%OQ@NBDefI&krSxDejfO|l#{|% z#)+lN3aobSJ9==?^!ohJ*WL4=xWO64ys8Ndrqm$sN%dWSfgM1O(5Q3XdjVFzegzl4 zk)tfS&47POTk5={Jv5>mMh9(^C| z&J{|b!D%2p=--aKLws(xOfe0LB>1eoVjBf|7ys$gC&^i=e1UGm7DuT~?^Jz1ENTcRY|jUe159c*hEAg|`EP04Iqt{p7F2BH+m3}ID+*vcun@KF^Zq#T zT0Z;8fmeP(1dW2|tm#V5Do+a#`$-6xaNr%8x!Fge|(2Gk}V(l6zFh0fwvf&^v50|agRdBADrYM=GEV|E#dopRJ5)^>Rw;L} z&UM_)Mg!|@4@~j`qbk?tJ8**JYN{AE$pl#}YU_W|xMWw~R~~_*W1k(wt{D>3+5?>? zb2W7AtgSVCS<~MT0{`NMMQa^2Q(jaeBht+)zH_dtUdy;M*0_v1ch-YI{&k`48eAcG z5~h6urZ^+ti8}?7U~)(^-C>r5d5K3C0^f8z2AlPPadSPm{JI5BlS3Gnu1~x;PkOv_ zEto;~Uyr1g;Nd>`IJ=x6XXN%kMXEm!C6s{!G+>K}60ILxT{85Cq$>LfE4Z6g8guF2 z$vx7ZKpeG7ZZfq}N|b_!tsU9f3gv(rZhlWQ+Ad;q@iz?3WgdU2cvwzEG9&v8&evPWDQ{w}zrWxTd%? z>TFTP$M>7Cv#g#Kx!JnEEM^JEUnJ?o(_=_v2GnwFvfJ=S7MYR`-{a?2AhR`d*4=F& z>yJiV3B-_fNoG>7)RRasV&E3>m#?BOrB4l}Bqhm*d~)$od@$`24ihY|0blW3^27x! zrli3>kiLB2cS$|NQ;x)je}P{&iE1*H5V`uK2oY}myG@Mi_MKqZ(5|^VFM)}2Z7!BafuD561a(d=$%=6DHO_v z3z0a;5CSo4d+=Z()?o!)=FfEL;**=~)IQ%=QSANU!hvLx38aX;`p0v$CdhXm4Nv12 z)i)%xm4D+G8f@rJ>1Bx?K2NNQqQd+LacHGa+yuA|Ig>p4`s#y$^7#I(3h%(ufGsi2Kbkl_2X@z=|B{ zzesVU6s-h#&No?-pvm~Zyo|sKoKGoQG>^piX8YUU4Ep3+tl<|nP8K5NZ81Qtw$mt? zRkBgqS%J(3sI#H}V{bAsYj2NL2H>1jt3H$o0)cHsnKa#yuChTbGo>rg?G{D1n~nn6 z@f>=epv89Y#H0#zV)?nP>n)RehxXJm$NYPG(5%FjR3e46H+2d zCCObrszB}(5x-@LBov@jWfEU}a$TbzYDhxX7)`msBFIbF{^Ao-Af$gZJ<2E9#k(nh zKV4DyU_{q@3s=qyz+Lud8Y7B<=VC7c#i#(+mD|baA(hZ(N6#JSk1Eg}+!n0;;z8OA zl2uON9QT|L=sPz(mY92R-y_QA4sS}*5$PF{AkopwT?ahi990l)Qld2;{RgDIJ`;Kl z`G0sup#YSu0Lz&`F@S&hKwFz;sfh{@*G;oHO}uGTCF~B>rn|^M%>lY6L(ETJ+5S0q zVV3F~Y-dTRF(5W<21ww;$7FmSAA0Yz&9{*v_M*gL?`Lr*{voBFw(3i!8q5uLU~+-> zen)C51#7r}xJZK(>$O~0V_PJQ8RSrW`NIktNF4kHYH)0s=O+RAQq`$K0>+xbj*8G8 zoDhsad%X%#Sf!Ag&4KDv671q7`z5(4cAjq`awG~XYId=43l29o8Bwb<>mm6`qD+O{ zmi})&tE*3wD*%U{Ag-e-X1&dY4E@D2NUFpS&04O;9VDLXV}-qp z%>h?+)Rk))D1E)1?xr}Lh^*0{;)Pj8{VQt2J*tlEr*eCrL2HHylYPc>L?$`-wntPXavTQm;iqagdCS)muTt46>m zvpez3G_pf1rkmC-r5xtjZZUunMFUZ>)uuQh|BgUBsh^ z$w92l(p|0koq7BmeRr8dKaL44saGy*`9*(lo1UV*393eJCI9D;v(L*+qVE-oDt}z9^j&)%7V;^`YX8|Sf<9xR!@s1J7Hxq3NJn#K5MvOx~+y2)6 z4F8mPqOLaoS6dg^ZY9+j16_-B+}=i(zhV@(LhGQ=#H%C72s?-7r;i&<1 z?91B=NkI|`uD<=!SN<9R;G6}dBff#s_EyD22gj_!RTk<2>-uAEGpv@JBsB6p4JH2T zVD>1ec$sz9dl#x80<9)^`Zc2N!wud`06H%*Kr1TJIVcry9vcvsFc^`*10TddDWM{t zMKTCQex_T~&v`oVwtWq@iR{4B6(5X8-oYh*Gf~g0LU-)j84bW6)-`wtZPaH#;LB;uEt$#QXRrEdH?;`Y9S{ zI37VM=Jg5<7?iW6TdbZ2zafxdcTdG3Hkx|(-&#gK6Khuc-UNv2u*PJ1SCkfvg8n+V z$7~d=G`Rm3xI;eBji;%qdq;GroNgcTD!@xXxn>4NzW4N zzUaq%vVLS5i2|$hsaH~`y%*4@(gcq7Rk3WTAWyK(5(igjqlpY^zk*$}53MzWrD>Uq z|4L#9DT*97@5Gf9P#dau<)fT@8sy(7oVf|%gdyQF+#qQuW{vq*ixI8wetnB0Z{?Dn z`{lbjb$C9Fl1|XqfI36gx!j8ZHh5zF3qSv}Dio}l_%;MK0Ts>aM|7pTdub(U)Y$Y< zTK`1F^bhn##Y+W$(pWy1wD)_L;dnRNZfjZkWyrN}=fDO-WCb%2yI+in&gk}u^wysv z>O-}-+hoj$q8D6$gWNC9hX|ED$)+{Zp{hz}X{^3osobzMTf~Qzq`?K2-$J~vidLNK zj`;|-UNs46XXrw4v~lDJlshp5;zFT&crI|OFUu=#f+HK{|3M!pt7T*vks?(g7*Acr zMlD3A*D89gKG&nK{uiis@k1GATE%v7J(jYA2slq&rcyQkY;C4)IlqAyvGEK#10PfX zTWZlk^Eg0nV6n&$HSYMbkx1BpaxtejzgTk4i|ul#ZQfuAU6;`W+cpGB09g;T(UWSZ zEWvAk2C2dKm3?)Yu%tU*@8T=@t(AUYAYCbRI~`1xf7utsVuH;72)nMgop9BFk4EB_ zrx4xdS0M|^y5g#K5FV2Wkm7HJ>1oUmgmgo&ET9PU(HVNl&ce*Z$c$n|3@5h`4i6MU0XZkTa=# zn`{-37~R89hH&%c)bj))0%qxl>(76dAkAoeW290IaE20bbRo;VVXd@rAGVYoa1Oni z2fKs#d*dSI!AgOwLXpiAhW_e*?k~S>k^qn$Mv(m82*HTYn0T&sm+NHzgvE9*bKp0G z?ukV5met4+<@KOdkJW*1%P&V~s`HRe+g_PuzzULNQUuMc_qmx375M0qr#aa0^G##` zPClM|;+tsACFSCjIQYU#y(uW@=&?70pgt70to%;6bUmdnu07KZUjjvgQbFZ>{w@v- z9dE%5z@zNCt}Dz7nhV9AGmf)e#$)09EwO7~B7TC*i+J~txd@Ipm z4hf0>rNOCDzP(F|Cr^Ie^T`t8gxvO%q^y31cPWT#&omAQL~h^yr;2#A+n*?6!3Sg6 z7|H0XeDI2t*L5|srOcrsr$R~1J~)T%X83QiO8$`Bz$i;-f$k=r);4}%s%3X@!bv0E z{32arL-SYiPsSe_aQk;P!LTAp%9I<~!?(zqCy0+xEyxg^^(=<^6P|Nyx91&Ot!TPu ziNYYD3~&#fswMj=i)lbAjg$Qxpi{ZMUDqS-#22mry$6@9P?~stPJ60MhDOl|+>6ro zQFJker#*;UQP>l~mHw8jDNn=KZnpSyDt0q|{)ZGYq_emNgZTC2@&c9HhlX2vR=tj$VHTv10dBgQapk)`OkiUjJ)kS*uTORXPQZ;NH0VpL1Do z_|RR+RABCKBK+ycHs4t)i5loYsrzz;skWnEZc41n+Lln@6{xOw)n23WKtlV<(1cX= z;`0qDU8!u#hb#YFBE`DWy984UAmSiu?M$kLiqpE$_#cMxwCBm${lnTIhMMwk?F$X%zfy=OiszKK~@IkE4UY?)enxu#*(06G? z^Xr7cc+gQioDk=1FfLhbeHjX|qC_w$JE)tiP#k!1fkc(p#eg&{AawRG3Y#}=QUeKt z%s?7G&>P4)7En@1vA`eVpzy-23NFJB%6Wbk2t<5FY*er{oC|0L0RM7;VxmTrCf^_e z3gB)By1+|ANNK|0OW@^m$oSaB2dQ@%2vPIF3B|E%r?s8GaPtnMTHM1RU(fngP76I7l_l8cS@-q4()aMk%jC;>H& z48^<@kA^VE2PSWs!>59xCxP6XD}mm{%XBD3lm;5YDlp4&Z9LXA4S%e=N^TPgoO=$f z#Uw@0qRNU^bYPdLY!n8lArCo@YlLO+Eaw_CZz-fS%3~`3uW2%iB zfH^9}do%twE8HC%lrapau0Je*gfZHfW@(RIA~BBtZ!Ca)(!YGC&S~y30EI+zBg1NoBfNO+)-Dt|}(^LQH-H1}hJPIG();!sXJ7)g|-*crQka~tL)!x!hOuIv!bc#etY0n8BXCi{t4x&qom8nF&KT$soF1$ zEujo?EqAr0xk~uwY$C2{%1aErRfVJud>;?P)TBh*1McyZF8(JP#KHdY1^%kUXy%^d z=z)9W>h06il&h?M-))Z!oa}}n&B7Y^Q{AZ&8b))ba=cNZ1-~dcP&kWUl^auypuKK^Y%x#9Se)3G z`^}QlyK~uROXkIIokvN2&`7Qaa@a)TVi1-y0Tj?a3p; z$!9Zpvr%QzkvN_Ae$uBhW4FnRYJ0ji?_@T*IX3y;PGzLT6-O$ zF4IVsuJirTmd=c)Uj;1N(!G|M`d$G=Ogg-A@jU83FO%Ud7_7Kr_bT_OVbtvh+xIZPTb79}*qgX6X`fEswf04;EfQY691WUB$r z#m%YSVsL6OhsEia$(?udFmWc@;WnoG)f;JIo+7|_PJ5P0ZM{lh&znHia=>!HHgA86 zeCVF@k=xYjhfd;OFar%XOq;*G?_>h@uETDQblA_j4r_JVcZ*nOT~=zc3moX(j3~UF z4np7TdrcK_8_PvJmA!g<;&AzE?cXB0x+;r&nS!utsY`Zp)Jk{GSC6u;;hSvb7(hXf z9RARg)XtaU+T8&HuIp6cWuh*61sKjL6?xLyXMgPGpm~!=TE-pR84!|b9?f; z?IGPhgyHAnEq_-Kkt9-;uiWh;vc^Bo5Q1u-GhXMmg@5<+rgvUrr^8=OL)D|vVK5$D z+^*5rmKv;lQba)=bNWApOyA+aI(StoFI_dVr!4rU6BUT+``q)7W;ET1Q*ntB?s=h*o=&X11Cvs}<xu$v^ zE}MOQcSlK-GwqlelVslFDSr!%xC#TE(oOx!(zt(i&ahDbVp(`O$eYVPUS})gjrHan zBJ)QT^m#rpx8&;2<&$|20@tZ==k2z3!U#`^#!~R=5mx@{XBMirx?!387DK}uZsnG( z9JeHUY9j$DE_2;@DPq+FND4Rf;_}2}_n&VIzF9+Ya+{bBQku8g6+CGz(`yV#zOVx^ zb)7t^UA)EN&8XgtmL@Ta92L8j_B|2}JzA_T@SX{-JzmYE`i@jG06Ztj>#aN|X6Z2^ zs)^X9cAcqiziZ1oKlu7BFmkQ+psYS*W8Ur>fR>g9#wguf67dmI`!M|j(9?f8jazyP zD^q#c7;{9#MHN~=SfTIPe}iwYIS|b`+*^q^%#XXTX23y#h>60jYvSdMx5QDb;le@T zptNj5B`8hJspri|KO|azzS(>1v0H|eH%Q;AKM{^37~xsv)i?Q#yp#uXZH(y3 zXh8Du&=@oBXy-X`4!MJMj+(Xhl-=QRU;BM};NZxUnxGS|GYOu~VI~xjK%VMBS5o&H zv6MaMo&VR!%cDK(pu01jzk#|Wc0MWvpM;|eAbZMyn>QC9V3|`Zzkk6Sur=dV zDtz+;Z!u(;ckz0%y~@-QmA7?6Vp*0Ou_VVHmlil*OP9_`Ud6p$Ho@`z9Q8Y+PtRHh zv+!JQ=~FGzU~50S>~EuA*e?x zj^+vW`%2eNP3L3XDf4Fq2^pc!@}zsub_ab{VjEgn9ghu9CBT9X<~9U{MMx`}nLW%x zA}5R`O=w{9hD36c=yPajtlLka+=Vi=aocR;3zUQvu=HEr^NR^~FOl;!W%t$vO8U#zJN7HL#ZQb~y@$uf2RHieE8FkfXpUp@CQ{LK zx^^?Wo5AObZ5|tU%7q+@km^MCT>D`c@@L*EA1p%uojPS2an^XwpBgkZ(vEaxy;$L~ zu?xQT=8?z2*`fB{bPN0UmFvCNGThu+-aq_ML3y&q&F|s=U=d0Yk42f5`F2_4@Y@w| zjA6tWEn#Tw`bVkAO)|jdT|G6F&-PvC{qNRGd%Gb`9jcW`YLAvtcc~7v0-9`c#G)Lv z8va@DM|Oo-I&$*w7=Tt2n;{zZfy+*CJv+T8tfhe7$&wiAj zChPuk+^p4qBs1f{IFqWOVvV~QZ)Hk$+}p-O$2cA!`xW*n)BKf_)vn;5$d9_W(heAn-j zo5ExaXdIYRsJ0;ZB~db2tQ;P&SeAstxOj?_w8^)1aL)M5D&-3!ix9i*-uBU^gMfBb zm)U1w_F(1VK_JzBF9%V2nGHswGS7g-<$GDv8)r2y#MrzjcUt++K>@xJ7uO@V`G0OR zY=MsakFQ-h;Kh#`K@nFgh@DnkxjUlkV%^o9>B@dj756a}f!i;fwaF&6fV+#oL4bhy z+8e~r)HOp(3ye`RymV=4?Gm;gCnEmH3)PSlmjSFyqV<@q2%EVN?<{VA3hhw5<05)* z;{L6-ePak>m@fGP+^M@zlR@I$*pgCVDqVo?)>)qde)pb%44T$C=lcc@X4TOfnlrDi zOUkj~DQ)+Q;AN&HZm@|lcuFI={Rf}9L1zv7F>8%Q%ljPdu!MIbMt*~H(jt-5WN}^R zbgg-JJR}i5ig*RR)baTFQ{=5~(p=8tq44 z=IVp0koG-xE7NVY;_D9CqVkkIrI@D3$h}|}8DyUUv(@?8-n1o%0$_gPj%VVn zI$$%F$euaQzNRv2W2Fm__MB?4@Mu0*#sn7Gc(5ovxe%kQ;b?tK-qB=| zPs_iR@?M5vwcq?=b(t&``tfyqW3uu|38`qyVyUR?wSV1eI%oIVh`0*YxAWSibeFp7tMpaPjU&*?(3WC$aMXG2WdevA#eQ9o#+tsI}v>_hUexRX*)1 zW!rmWO@%eM_j=;)p&jgd*Kh)`Z^$>1mE)mGu~(n2^%gRA!qATY)dgwYnxWr+5J@gj zMx6d0#3Uo0i-y5IqwJBUJ(1_Et-oRyXXX#3#|w1y0>0aK0x_L^76S4EJUbIgi0D(x(`~c zM*P-&1tOVfE%+wLX?^2ob*60Q0xmz@;DA7y4Y~*F?f%k6+_+=a=L_sUb}VKBY5|{;*F3`L_!mPI_GFkcX`%E-KU>k zhVk`%Wg-DVdfh$GbEeliwsg=R={+<3`%x|FO6F!N_Q7N)U)oABbs0XLvRt}qZojze zQ(w0WJ4}oMn}15|N?YMCid_3EzB`iXb>GYMWb=3>G~W9+G&G}}6_gt`mcJPGeFU%@ z_?;LpoRndp!fG&%S{tov=N0iAUyU|5>dm6m2Fo>p0~P<}=Vkdr|*b zodj*a5N7aOC~jHh{Adm|rxjf&Ht9k;ZaZ%r0_QuR-?}^+DR?!6bHkDAB{$-{0&VOg>!;H1mg|a0W#odcvRV&P1X0$lJdcnrM@$u6&a+P-v)7P6{;u-24y;}$+ydR*G{H&<%tRF1jUHak8{-iXm-bI^n9}) z@i6!Mf^(awOoe6@+A#k}Xg9N=vH6|spDK$aguhvn%P1P%X1NKW)x~-cKj8mG{XInS zJ@A2sB53XSKWfqGp~{EC|1U1_1F}8ivky`R)WCWeUbEqyoAQ<)DaA7LOk(^iB%%ff zU4Q|-RfKqA1PnKWp;`rU)^^+KL@B_v21N6P{xK4F{*>45okY zigd!DVmtX)A9_yn|0H_@0J`AjG8l(7!d3a#(X{9gM-9LU5BQfIbe;&eHW-+bxZtD& zkU2`P9?}o~mPmaAmBDW#kA4>TxQ;HMivtr)K!0yTE?`n&RYTUxj z{#0{&Mu`+NC=d4I&2G0EWZ7uSpMv|%e@$|OqD2uq#5ts_6VLd)W@Xa^f0{B4o!Wx= zMcGHG1H1mX)58bVP-KNlsmc}F7CJ{H>-i`l3a$rZgFZSJ1`fZbPY{~5e{p2eh3QYa}%MU6yaJ!zWaYMLU* zVwk68oLj+|CHaHtjz5Yk2c0?}VLlf_-6@zCG71t0DM2~EPF0fZ;_ni=Q*QHPKSFME zB0~1+n0|YrYEj2%DsFeA@9kkf^2&WZORDIG3VN#m2|%S2^pqnbA=@5Qj>w0St=hLw8eZBZe;2TG#}Z3d5W!Ek7o$BP_R$J6o_ze1q8oaDzcncnGQMxLX6* zL{y3Gb)-UyYL^v?(1uu$+Jv|YCpGD3I|uzW-J$6VgDCT1=Ib2=j6)@prxx+7YumC6 zXM7lOSTS{`l;bHs=Ws5bnBXQ8o^D}ED{tpA4C^GkU1FMF0=aw9ZClWD_OYVu3Y{Kp zwd%ZZb8Xw#=snxNx`)siz06C)+rgBr46Fgc+bE$L2yq+)AJ;p`}F+`PCka& zmRSaN0|VZtZj6PMW^fO*`_)dS8wT<_nU!6Ppxaa__jW&d)1Bj=H4n|A1$p;C>~7-W zVJDwGCejuqR4-FD9veS{T5C9Jv>c-!e@30x4_M%omrMx{n*wZgvz1G zx7NhCaf{x$Yklg##K3v2x_bQdN|yCxQgY@Vi_W*mmkZ|gI{%2ue0<#ZUQ}@8_dZ_D z*yG)g_UGid(a~o}~)nL1EWt)(jiZ9xN!V2BKE#Gk*gA zbsErj5Qu%bOGMt$&tEY%dV8ka4t|j!X*BDOGG(+fAQ((IqOFUEyW^9_8FktkO$tA0 z-)H6S*spLnpyBK^NOeSq69bp>nLas{A`F8R}0_$9d-SPaf!k=$GS-mao6R zY+B^w!3PFo(8Ufu>aptqQVg-qat+8KrJACz$0d;=Oq4H!iM=CI`zw6gFtg71sYdJp_V`F5)M*_;B=5Qo`ifvS-b!1D{>AKDwT zH%on4yCq9XoPmqUrarr|39Xf{)Tr|0ehiAQu*1#Dtw}IHh@@BYYHv3AN+|4ei?s&*iDZ;JdG6 zsT_Zq0fTu={tnOIpP}|pdbW9_&^$JfI94EBl?uvW9oM}L2p4km=XHN+izjw;7*cHI zvAc#OIn$F?h03S6@yh@FOHjqOZ^;TWw^4U<5A8s9zlGFHXT9@t+g%eOIkt|_grZLh z`1jvsN~3dZ=#+2gV(*>yEjo7C986nBl^OaM!B23n?3v!AK-k`Q?1VyZ!3gxOlpOvw zz#};vrm{d=j_gt1-jCjR=MmRFAXDZzu@@}4N%{KFo;mEbXWB-c2kz7U{YkISzLb@L zm;rq6ZD+1W+O`Ub#e|zhDVth}{hWh^@3KkGud&@0 zkCx0h!s^9Aah>HTuAsh`%%R6cr#Nt>i9DS07=zF;TxpJlX4o2i?d=|LUW!%!>?vhe zPF0@VudLAD!v&8wmRKFB;;tJ7l<%11*fCiAiDfSx&-%^^LEKKPg|wDAE8dv3n+b7O3<(7-v&V z`0+7OH@kkB$7>g$6Sp;KYP*bn83!d{Gx2pHJ@C%z0PFFtw%+P@{M8+D-?7I75R1!np&;VRrY*p|jpgMG^?};m!EEJGArk?OeW) z@YH%CFh8w`2+6cPKswHLn)Ug6S;U3Ta??jfpg(jRC*@Wb_!IZn`z{9K0|xiEf5(^` zF-g!Hh6$YleSK#Wkmx_Kh+n~`^!Z71Ma#&xyL^(3MlO8s(1g{#c+=m;_IHOuGf}^0 z*$CBc52B0(aawvY8TO!7A>iS- zOi3yDwx1kTj6sk^&}V3KT-Swn7V|0h1FU{F-sNOYJ{nt**>=VFZ4KZ~p#QE~aN~d_ z@olVU(Qb)q*X;dzKV*55Eyx<{9*4v6ujEx8n<9VKsXO0UYO<-g4zX{khXuST&`zSo zGEqth$Gd=Vo?=(L7WQHFGrB_}ikD4`cAHe^(z0;c{Ab5;ACc(+>VKNh=3jQ$UQ+cF z(Tih={2p&)SEi9jRRdlB`x5SOtv`G_-VAsbUc|+&@u9>m`YOD>_LJYpthMZ}h9_)X~n*5Tartd8~j#cW!LFIet<;n=Z~G)R2wJL6daopFRWm%M~K z3C7p{DK%;w`m>Uc0FD&0ujDZlU%2N@rlU;}dvmCG7ptU1eZaxvnG!FH%NI6^G*=yB zpUl(EIv-9GX*Z6&pA9|b0qXqUm)e}|AH6^IXvl)e{ISoX$ElkO<5(fZB+3be zJ%&?`c*ue7Qd%tea#x`qIcOd?=-N(TBY#$Y-f&l$evMsI(v+I}nu4xFYu!zcRz%Pm z**#k~nTeE=t{G>@BFiFw2xkfx+R+4OAL;VFw{K@G{gi5)WRc1sE@{#E74JO*<+P4N zfI7PbjRAlTt4}oDL|SXkK3Dmw8-Z(gUQBn!dJ%JF(X_z;ksf}Xz}+O4LW~}T+NNrsxQzbdsQ|&F%I<}``~Rd5Wy?x=E=GHF~DaQ$~h;5 zG-C!GbK#ROf~q1ld{vXjXaCGzt%yJ^IY3I>kuVF>7=cQ@8bC%gl9;!P@>P2juB}mP z_r~pj;nacP{cA(8{uGJ2i%Naw%U-HxGv+T%Z4K;M&|=N<68THX{yU#6$L6MhX`7)6 z4G9Od|KcEw+%BJ80iomIX5gwMnvzVVEdAP&CdDPAZ`0M!RP&mC=)AhlYLMmh>kU`G zl7Xw%4sQMd%ScbQ91ET&%K#_amdxWD;(nQ?l`#m)nm2p_UURj-`NFLqL9|0L`^{Uq zp7I(YADhn-{C{HsScmSOB|6lavXD`zs4+^k(k7AB#HQ$e;d1kyB`i#ZKQ)+orMLE% z6f|+462AT^#j*#he)aQrcm#}}Waqn_y3rdGMK{&oZguz~X2r)v7SpREu1UPGxi!cx z?+X&>E&EKb#7?_0MEk2%)0?^%Vgo~xu6k>@9J8m7&#)qSOC8wl%tvo+l@967)~t-7 zE82QqY-{zcv!S>8!emzJ#RVF(DGNctL(qT@W?_BHl}3btgJ5-imqJn4vqW zMEz$N^e~)pKJ_3&U%MY}XQ^%i2E>2}dCnZ!-SFAsK_15w9h5*{5>8-c$ujodoHV>Md`j_AFn$I>@y(cHQNsd1 zLmg#r@?|9|%g;Nwo7jFP93qD8M-OG7@3Dz8^y>|RD(PaG&| z3=zY-ohHaQp+2{%P+lfO$SRp4ErNQ`PO5{KP>2)P{KqWwp-RwqbI8#%>Al`h^Fp4V zomPSsAuWW#dO$>~E#nc_8<>{zdZBJv2AnNttLrHT#x0~+<3**Osual?qZuI~DFR(k z4VOt)Hea!f>z3<}-qGgySS3`7X$~Ls+;CwtVJW~FCqpcNwixbZ7HOt+k_KBo_uhe> zB>6`C;l7|v6%$J1d;%!&)o(>NkjEWGY)h>NE7F%P)*4NPtu@~$+Kmx`rHuf%I!~WQhfFF z-g|W?Dr+!c!aVU%{&_EEdBjh6n*ZZmvns@wAvK42?4*m`C~jSea z`bNKV0vrl^tEcw+@Zh-`95X~;%Iv?f_woHKnI#%*Y?Z5dnV zOBN&gmUu28{#4!wRp^hr68jit(1MKtOFwm`sU~Fifi1H}-!7|Tt6fzC*i4mSru5b& z88N)a{;Tt&rD!%E)czi;Hr;L-|ABc^qawld0gxil2ZH7-M)W8l>vF*0nyP_H^g*x| z!>No}nf`Z}&~P!(OtLjToqe$h2l`w-u>qxKp z>Juh7?T2)YA=~S=1|t5S$x6ou$Wq7EzFGN!U0m%~7kr1Off_I8!6%Zm)KmqJ4InLj zPEWH^9FMHY=2~&YKAA9;vw);ki1R)m8%181anv!0b?M0_lJ(Z8>9$JN5r{#*)m=b} zinJN)L^GONxHHBgk;sTVg|i!nhImM6Cw99lc6*%b-{V&q*=!9u22-`YcP$ET&|7|A z%_oJthn1z`t*&7Od4i5X?1w4HadlnJyX;GxW4@DDg=kr(5-fC-_2;NG{~3(-lILtX zlYL{?-=a+{RY=tO*GMh_s;S1Rzht)mL0wHSlH~Y$2jt$7=RZqwN$ZYZ@E#$RW7i!! z>GHl5b3u7qh6*7YaTyvX+?BB^mHc&cHDy{_%9n2@*3HM!BCne3y_i~GJB5w9;qwNp zfmaRvh@C?sU4hS%HzK39*tu8|n)s>GL&4#@fVyo)3GnyKoB{}l)=N(+;8@%;nBAQXOV>W~0csOQH z879L)!Z<+$68Jg&tN4W+-l=ht^2+NF8w_vu(kf+|GGyed9)kKyRlKd-j9p|0_$ZL2 zH0z!z;lNf*jVH9_F+ctcW?JPoZ&6S&d=ZZjn;2CSx|0IU+$qpw)*is5Y_nbXeQWUv85$SONLqHGeOG2sCzDHn%YbnSzV7%2yv z00z;{Hi;2U%SA<9E?J>pa6#XN8}7Y84Z@=eQKIvO3dsmIu;cR-xqVI5GV`1}i9|^I0Sjdb_=rY_caIYC-bYh*`?$fP2zaOYa)ni57V+`15EOrSNm;umWa@E5IxY^>%R7ZCh zd?Bv{WkP{b6Uxg<=XOyB&Xx7#)Xydd9Fmvn5Xm}&$sYCRlglWV+51^mkgp4ELnQEx z>^IyC0`zC+A+1l&FphPL$5)~VdROiV!oOyaRUqig=F@is*N3|SBnEHC*Mq@{zK=Es zC@cLu%74h{PYb+dpy%!c7{uX63Do_X#T3@Win-M#w-K14swld zkcJh;vndql)r?&*Rl(N?@(hd^vZg5si-FkLCbu=%N0Cp&E<>regFKWDC!T+JO=+|I zSSNm!p^68)#j>8Y6JH2f#CSy=fcyhA4o63^G5|}yhmro^A%lxzGvN*@)7O46rBN8# zk39~kxp(OEXH-CrxUnIjB`@5tOBFU$hP8ko?ppJ)l|QE7F?h@$BX(R zoV%vKI@H$i`PW<}RZFBg^EJ0(TqCRFOnd`J$;q6=&ralr0uSr33Z5i$fW{VR)q7QA zbOlKo3bbOVIHnM*qR30J3*ky4nk+(+*ej*C+N*ze05dJ#(hQ$Gq5LVxG1&C@8guzM z^y4j2Ulraxp)a_vd$}OROV^{^+j^Hbj3R^6%OVSST@~BY80Ztl`H+#0h zU~o*3H1=C%QqyN-kIB*}4$?xO#J^U+#Csxqu(jsHB;t3F?I$l{x+$`?=$Cq3keIvk zJlgBv9zzbh=F#}!5@)iN(&62n-&?Zq`8WEyM_MM@~&e*p$ zOUQ1rRYbBk_OTOUY+(>%$!-|34aRbw`CjMzb*}UK=X71w#mxIY+h@7&`}4fdo7QJ< zF&Iubxfp(NyOw5SorShIjQjl^<*@4yGuS(hX*V^VUhzCT^=f$a98`& z8t;cCrodm{eoqFmt5SvhZR}<}YZ|XW$wMOG<~A zEpyhSU+f%SCY-f%i{r6G%1qr%PTQEmRTdK3dJWgJk^x~B!Lom=`i^1>lr4?*=KRAL z6EmZA*VyE=FGlq}T?4K7{~;OeyH$*W6}we{z~$JSy#Kd>Wp0o{n4abKfa* zATsijSEan$VsL%OUlR(_>)lMAE2M1V6@?d+!+FJ%(v=iZ8b$RF2EG_`Sk{s7SJ<`r zhZ3wR{GS)|I+jno{NWCDqPqimG4DP0QReMT0(dckE2hX&!aMf5MxPE{-;El~{IO(v zg^WnsgzFx2z{HpGR8>{2FM0ATf?>>e1$8%=0?WWTA7};DXr1ThOS_D2hqa#mgkzDP zv`*)KE04b#+~%QF>Mimc{;btHLHx3ZdpJNP!?u5+rSh9tn(>Qx`TR>}dTv53FoM|O zNhycE?8swT*_CtQPwE+RY*Y#~)>7YA+v~_HvCZ%Bw#=|I3BGOQdRXgD3?ZPCx^yRl z5|F)+wD0+R(E8QVMe!+22TM_cCvA&VYg}@9tR)Mdb5GmzCv}&+aE%LuL<-E>t#G`4 z$Oa+%4XK2R^^#d!U{Jg~k3h|{tKoy4B>a|}PM=q}lScrR3_76Y*75R~<@FkYvH&*H ziCOgdmfgNold?a*O~PBGbn8flber<9@8|!U;`PESW#6k$RK+zM#8nfdXqOiW)9PH) zumQd5ues+G*)X0|Ew?sN^m)#;S7pV%k6ocL-w28EpOT>|4u2V~!>%S?cAF~=Px!iC zBGxxbQ;40sw^{4?mG0HwsE!lX7B88R=t!<`V`}9aW_@lvB{yqg|8a(=^xbKtA5)_d zUVg*G6v+imXWY59IB=5?+^x!({{iVeoBw3Su$JVxV0Ow+!|RT&B^7NIp%snF^7b8Q z^vl;q6*J)}wDoI*(G({)h{xSwT46|Xi(6E-l`OZ(>Fp~}C)EMw@r+LfThQ;=`3XpP zU8q_vvm5ajjd}Lq6oOb#9DK5|DFHts&S^g_cwz=RyjF2DHICj1c$?=`}+F! zii(7N*8kA9Tz}o_w*-mrl160fipy=iYtAP$HiTPdMQ9{{rFjhNZpU!26wUhIP~A$U zxD*MK{TsnsZ`&Dr*?Ij>WsXj!{BW^pYI{3u!nEOaaR_Ln$gDPDp(hm;c;JyDV*0?} z-@o?_!&RT2U%yrukFXez-Zf~r-R2d9E3EfjTtqE{5BRf#4+Zt}w5_p4#*Lm!ec`zt0-M6( zQ#e#NK7)e>0x?KtzRM)|q(-t`3GNevz9}FeaQN$Hwlg&yqg`_-Wo}*`0TmmyH5aF{ zwUVDL=`txh6-;_LUF(^T9QQ$lu={r5QaP99l0X14AkV;_6}&eL-Mc1_&|Mq&{OaO0 zY0R1PYW-nLv*+|sU77@^Yo)-(y*z`-wSaQFe?M0m54n*HtD$E@LZK9}H=l`^vc{xIR5*=_vhS-v z(|L66h(I8>C@)6_z*!|wvv6sC35kE3blko(AGD96o`-wyv)4O}O5akx6~W6I_#nd?by^PW9e$1YTZtWUdenD`g+RU_PcB z>mzi9OMQ9cyHebA+P=~_@rqrjwkKriTP!if?|*r21^cTpCND)<xs>m4Xge_u!lrH_%y6tUl zZtjPKgnPTIBLz=#&WscqicO|wXZKgVoapN7gHKeww6nLrG8NZ|`(e+pva-_XjmLhu z3a>*JM`|)Qoe@Bjes}~V!g9OysBSTm!Xz@5OTlA*_T5m$bN!FfFHL4y>|Fm; zMDFZ({T>=(7=6gdqb?Syo_1O1i~tMY>uCc=D~N{%xy_rcD;BJL0s`CzK+H5k!F$1q zVML6|LWgt|dbhW>Qff(^aG$s6YMKZb#B1gE8*U~4fdc)T@(6-97~MmSZ)T{j`K2Y4 z|1NmxSqAXUz}6%|{Uh{7W3!}>JTgSBKP^`xf+G+kQ2EJ*Q9d|3ZIoT z=19ZVLZVTpAmoZJ@UXyTiVrC%ta#bn1lhH+ zwwi;*bflbT-lLCqBD0hNINXp(5hx1XdH_+&jnV^0t8j{=bPEkjgMY7%6pAnp5|ss~ zuDRB?Y|gd?^?sCs!-Xb~M+qknisqQX1{Ynbcv&kr*Pp7Fh4Z?5FJ_v<0#6Q>d_Z>+ zGcqR6`Qk8BQmDN0*hjGLROJh>zxQ=?V)H^0gUH?*t3a><5n0-C;Cg6qyoOyKlIseH z3%N(%7>xKjFv3)v7b5OH&w_u+X25^|Vx`5tjNc2C)Kwn%C4t1Mp zJ{Qufw;Kp50A}EytoZoZ=5>OyBvvA_>qMXGmL4TWm`V0pO*f{`i%4@eg#-VmvM|%F zm7X)?=%3f>aKXJgJMgv><2o-v&qa*jB(}sHKi3h15;d<&A|3E43tKj3Fo@PPj}{r* zHd7!%ZvJ=UC*a1hm?B=)--ueY48`(b4&D8?=V#wT`#!0@IwKMLc)nQ}+#pd`dEC>} zbF_x^#N>g_{6H?v<6O?P@w+p`yN014Lmhs&ao-t4Jp+#*<4D&yr9HNbiklS8)3_j` zqB*AcAE5sp6s-jk4=92X6A}V} z4}$2lfA?3m2K{1h`cktEV*0-(cZR{*zeeuTy{&#Zf$farajkqY66LJ{NhSw_UtL|| zGtow!5Qu#a>)rTUaO`hP$H=!QuOw_cZXK|UNBeCrUYRs^f$w63B~rj-t`yKd=Cgx8 zY!)I|oNk1iDm;Jwyqxi2uAXU?vvCVf<;}Ht4Zf>gXMW(63TJ|ct1j$Q8gaO2O$KeZ z#F)Xr@Q>{H2E4(Bv-6y?;@I+tr~VF^-mHbsim9xY`ZDbt91=4#Gt)9N%|n0(@1lPE zP!tl1emPMUpPuf-Kf)3TlSY%6t>{(w-)e=~6B_5N>RID`b0R;fQ9u>w)37K9U5kKq zDQ0G78?FS6>WNXwXpJBicx7W%1PO>>1~^ zN0x2lk8@}q|II>HN}?735PM&La)>WyREK@3QDC?#YS*14sEw3-qpNZ}T~ z6NbVrhNj|z#;2TE;;A$#_zB4Ix#pL^kLQ3(MtI8_XabZQ8JTQr<@oFwYofrTzhky> zU+=&Bn_AopV$9M0zc+DC!{1sKQZ0ka?j`AsRXSZoIrNKapH(?M^1N6o<~74&b$OEq zaVk+2ANAA)G*N;y=7O3|)Oq7SLLK_8W6bp01M{_x>LWxK8qMx9RLQUBP!VmLqhA&bk$vVKF7n@dBB_$;pz0t_tWNq2n z)g=>;+(FXTReznZ}|c8}|0XHG+FzMh53p5YZffY#8u>m9g@<;3h1H z7*Nke?H@mWEdTzhRi60H0S=c8I`qO8o2r9|;)tu00)!6W_UBFgLIDo&9Re7w-r2tFt#jw=kXIB36p}fH3 z-O)F3adL}n(#~UdH8szHxbzjkTtxuGGQjE3&AOu$tQkT#ZiLm>D~i@FLmtF()~esz z>#;mZh*LSKX?Iz2pX+e%S0a8$Or*YRVZq(@_QKp$z=nu06rk2Vg$+e8{BQdCj0y;X zU1uy;JwR4FYvZ1lu3wXKL`~cJH+A91hr5czNlySC!<|YSQUF(_9w;$aU==ZG zk6_}Z@ZB9TWWb*+=fwFG0&G8J3)YzI3gak;p?W{hVA902-i{Vwrsb7!g(K5+FiE8C z-9?Ai*Yv<4^0Z6c4|i53{qe4gDOe&*57(ir?f(7! zNv6t`PNQ1~OWB@a-BMQqJ!V!%OZx%6!T>x7K?l_j2Dv{T`e)@;KR!RMqX5;Be0Je0xAuL}vTltRj*oUN~%P#13X%GwB z0c7ae;Q+qVl#r6rk$rmPkdT=8eE1tv$bK7-hPL*+%ISfwbuAc2!iNucckCU&ybF$y zAXjn#*VWFDjlXK)8wL{7CNi^%*8WsRzZlUZin-6Wz5#|R3QkMI z?E#LzwO&2Vs@%Ag6;N}yS}3=eW-ALoUd`Vqp=IDYNXzu3CRCq%v~tiPj5~PW`oVj) z!EuZ-6a}3OdQxP|BF6@@<-ejE&DQU@0J`SW1nBrzA9&);)534zN}m$ZEJe&xXJe{i z1>CJ5u@(eGl+$R5WQ;h_Qt|+H2khIWdi_U_XbzadHw%Zm_)drHppF=ssV=aTY~ofF zujnpL;hWjye8K#&D+kK*s>kv%N8X8pL56y@uR3U&J!bgSj&i-RoEOdg==MTB00_X5 zD~F4n4h{|gNb`zwng^GLSv_@g&k7*O{r>%XfBN)9osT)NGzgd&5(E#~hA9cyZX@oIN5SnruNbne^xpQQYd{okUCrkpfFN zIl-EJ1qf__w;uq91)tJwFZNQ0dz(iy zcJH5%HW)VIxRpKvixdZ77uS8+Y?=tt6f2>pr$?whJ1MChOv-rGOH<_E01!bA_UGc* z6@53kJ2|9Yw1ZhS227H>{34fp5^%NcHB>)gFJn3FdfIvPT|Q>(flsP;90%?eMnAm= zvd3(%%=CMJ=me-rKaM{F;4l~RoP#aW6prQ4Xaei+Hy^KV!=;m4;rq`KWzOY? zfk=6QOWx}iXG1_M{mo5~b)MvO5E#^ijeoob5!-Xj`knjm6ZLZEamkKYF0Fi>%&wlE zxjKBw-0rAlKA@i!0Iq=?ks@r|3g8Ez9Q*)B12FO%r1I7SN-$2L#)HLcS;2?TL6rUS z>JateH{gS=HNa1T7P^xu@@q&*MxA_mOiBNRe;Vk7J4oDy(cHCy3qX%B)=m=-+r^I# zH3kK^)XbjYxa0UZjbaLz0y!&#VGT9}Al@=^nK&c0B$J? z92u9;>zEz1$6i{$b?zESBO-fLWKIT!W2`{W!OD8<45~xHUG((yy88QgiKt+J~(@X(fU8|GoAqYUX`vC zP?hpdzUv%wGqAJgd{s~70cgG+r+j#;*>dujVARR0Hw8r4cJxm`m#1t?WSJsetEYn% z03Y>)l2o7y(tuGU$?%6VZ*(j!ElqrTl4HZAKKXpQQOVH4j~|5gNbg&a01X`-I7lOB z_|nFkdbLq-jpQ$)R*_D#-l0N(pa$$89c&jbKfMlNo+i}H#fB%_h%Y-H z{`(QVR7+w3KwiU<_ut=_gy1yvDI4G>-LFglw5%mPLxe~xDd7Ohz!|;cg(PFx9WuhuqcnHefP4>l zbXYvRY8yBKW*TTfMYc@wnq=977LndTZjKC#-H6EqWwO*8k1uV?IyyQ6rMpUxJAgCBfJX5q`TDp8X6k1+4>b9I3urpjW{h(WRVb z>;w&%z{S-se~D(3u%Y?&>sL9W7VP#Iz?vm_3P1gc8?4y#*ko`z7@@Y0zd!HkYl{%1W4<{BEouV z!lqU4K}-p7aUsYMrUr4fUDbkF+XBeUA37pfNmw$%eooBa6HS?fX=X8e^wN2#n zgdD|#D3J)PFh!(pbuh!mSdSxlR}XSZCqYnF~LleX_5}l1=vUngg9u z2?(RgfFI>)BU?jGNtTwCFOuK<%R`g4?;>W3qDAW>nof^5V30a_*xyb7Kx)>jCKOdv zRC;jzp2RpHJ87tq6&h7c(GBs-H5{^aRv{qu9lvJLDVvK052S*IfDH4v!GG67i3p;z zQN6FkP`<7Mkeo1CN)td?VMu5!w#Iib5R{cBQ_pKt9a{LWe0|R;#|#x3O@rM|2N`K| z;Qqyb?JT-haQtLL6S_az+YCbY3b@FtW=tJLLnupc(K~dtsBFrI4>RgKK^2uRCsII0 z)o%(80*VxaD+6H^lw!zhv$p080Q5OmK%$K*Ut9sy*8xx$AP`NGdFYd+6Htz#;GyE7 z%tn*?Y;1}sk1j3;{k&qh2{evx3P#_HB3W*3y;C`A0rAxdUUf_ReRCa%!iXk-80G4s1=(Ox1r#mfhX9qnTbL|qQf5U7C^O(L+~?WE?-rNSIRb932#lKy5ow2{8qObO zqf2Am9U&5*K@}#-9-f*ut`cfeJ?X&!pnqImq}*BHj%2drw^rU62*!D)#XD!z9FYl9 zb`r?uKjqu+cLUVQuHYj~<}AP{KO%cQiI%nGlq$fi1=Oot7#!P&5vU1BB^v;+&@^BK z?eaypou=yj&Vw@1RiNddGi1k1A@RSvT?O7Ajo#JQ>319#kNFXyp1BP)EQb0OBm1#P71PJ|&VZg|+ zpSdK1kN&9xbkqYV(b_c`mpf2XJb_4+qcx%Q9R4!Q6yy92JxT|X?jFd2#@Wh2vS2O% z@Onhs7&Qjqlr2~ZvIYa{P?7+cO_$rMt2#}4g<~7(30W*{;%c{*$OSq$Jmu`99h_Jf za16lczF6=-2K3@bCr6+^7PS>t0FJ?65qw~OLYhAHfAHWfa$EorLgD)&B>#p4>g>RU zWgZvvu(Nl80Nen;zt7=H{tz0mp;^giZA@mL|kG^R+}trm$}BXCiG+51m^G+|#Tukwj9;Ev^H zcnDd>SxZpV(@$ap)0jhafbCfUPS=s|SAZ&)0(e@yI`=~p6Ap5X78Dj2*js}qYTS82 zHHj<}|8GsJ$QX45toD}UtmlkV`0I`PGc1VyDC1_xJ8|-)h+@_*&!oboyKpREQs%Fk zxrJR|6AvZe(48ZSKI7x#WLo~7M07wox_AKo(w$L!{Po+!M&^NGcv-r%+VCz+8;{zICP&D4|U#TE@8<`aJG&&NgwaUJP@nG!4DALU^*n>TA>WZzOL_5#!@doD=iN zM>Y@W#2LGHzf4(MzDo^Ov%fAJy~O7?ZLrzH5)T31)TL?-SEpKfI}!Ps`bt7VLcM;z zjt_`%9zfV}2mk*D^a~QNA>4-R1=^kEhk0_D5Z<4)o-X4WOL%ZRh+Dd3mM$$|7FXMi zvZ8AJGn=CRVe%y+s0`?}VCv^TK~ZmM9$LwKN=JGli1M_ZfJdyTb9pCKI*%s+C(Qsd z$^cLmOe!2z0rFwo_pfjy=m04bfLc(N`G7?J0&v`@&g;2#&lJdBIf)JCgcB)ohJ8qV z<^}=XEpm$~{#+gi+BTxj4>ftU&xR4;*k3qe+K4Q3Bv~qO9sKeJAi8KEQM?%brV4Zn zjfW2f12aHHRZou@m?fDsi?{T2bwvcP0o5@jJKIvv@u1lzSaSzXX}P|U1d8LyZ^$cF z(VEhl^7ADeOZ9D?V4vwE(2wz{A^BTr4W~Sr|HnL|h3FSey~+#Giv&1ZQyVqv7PA>8pC+iPJ6vnQAzK9@A(o8g2>z8TX`s62M2c;BafZ^t7e zo?eG)QFUD63%TUQ9~WT`gFwoGbPW6Zv!Pi+Z4Zc=)V7zRBQ&%N7>r=w6`^=aZQ3Z) zI6}au9JH%q%@a^7k2L{?uL(tQ&=h(kRj|49&hXHQL73vl05E|V;CN}Y(${;hL(ywi zG@!%m04&133q$dA^`_l_O~Z5ujdfJ_!O_c?fy@ChNI;IzotVGPAEtfqt}r1Y;^}j; zTYW#gHc<4wUyh6I8D%;6Za2D^O~R8cexw#68Q52%;VOzJa|Z=^Y5!xb8#;U|HTZU(Q;pjTU^ zFnmMIr|{gqbu!-l#MW6sIpPi=yc^dKaGD*qpJMw}TQJ3*W zC^HLKXQK^*LbO~81?T-Tj@~80$uVU{zI@9t>{qikqF*tzZk1B$EVl9FH!fsyx~}z* zIV_KGvK}_ff;C|IHb=lmflGI&K2l7x)aOq`367pyZl5}RmeX^S@=@3YLgVpW%eK!j zkx&SPUmQgPO{dDGW(lhfONQ^I+eBH?3e!%V%g>2#5Jxqok2iIH=7yqv@gHg5hV2LZ zyR#|c<|WaIr-p`#ffs6c!+nN=vkH}3Hl}Yj2UwfuuQ`}ghkDaAbqnM@+@jzDxr~N-IsgJBFkz-q4;#?)ex?l!hvccY!IGzS{g7)EnAT-ezy++h?zU=mtZL~i$ggQh9bIS4>BpIyzMJF0-3tOGZ}CxpOrE%A1gZ z^cmMmhE1u>)P}$t*XVbYKI~t#2R6tw&VV>|7;dYD@7-#l>y>J49_H6iH$CFa2y2ixoS1ghDN`+886OpYzl*RhDwJ^3_B|C-z5T>y{IL1r z>;`PfCKf@#cyXiYV&Ic*whrp_y(f#Qv;Anl_~YKN-e#%0q)nw7-;fiFiwlp;FGC8Uz~fVTO7mj?h?D^Ml(T$9H1^^kGGtv>wnfnI~dLoN`-;^cwf zXwr$JZerFRAg1qr$Ve>^MF6~Qnf$|7E1Y%u@=TY_s>wW|u*c(M)4^X^b<}^*_T8J1 z!iy9asYAAuOarpdD0>qfdOW7SKL9}$Lc(TUkJJ!w>`nU-x5Yr8Q1XDL82**nr}Ko; zw+-hiGPXgGqZx%>skt^rWyU0sA%t;OXB!m{hZWs@mKL}!i9&~_(?8H}WHtaC-r)^V zMGBP~+JnI;I!Yc~P-Xa&Y%QEN&J%X+tV#U?^`FWGX=6)jN>k^YrBG&8`RG!yb&`G( z+V#EWx2ojFqo+)PSaUp~r*%w>-%+9=@zY3wqSSd;=-C9E=h-?r=-J?#t4v30nx=*i zd{14%T?nMspw2aQGia;mswLC;6kma&!YAzb+fs;ZC-^86UzjVWW6o@_8B&xW z^Ko@uJS3zL?!(kliR5CulX5?koGgGaqZ_t5`*S{oLLhw{NjTA=*A-0j|3Yc6K|ybl zpFl5qB=$_!Ln7w-V0WDS9qKN=G^!jULL=CF$IC`jCLh_WUi57~R&x2eZe6_R;xz@$FODzt5d#yn=+z6c+&dEy$HLddd) zOMU6nPpQ+J3~E3gGv4x5*~>4HbSF}CuU~jGY8ZT$?~)mzOns7|90P)(lsM;pGp5gj zSl!l?NeXMKC4JwDSb0o_N4ZIpN;pgjAKQU1eT(D3-^&%>k}ACmgMHD}ep3nbCkWTu z%oC!}p6ko2xO5(R<-0_KGr=DPzc8x){ZXS)`|~JiAW2})=-b11;_ZrfD?VpGp?#!` z4{?R&7Y`g8G4ruZ23T#qglM-?8dxbD83IUlYiaQIrkqgnS=#EBKWvzEk79q`{yNQnImf!n8=AaQD% z#7ket7jnyXm!WlH?yRVX7~yE5*I7h0TJN)4V+|_}kJrLW`hiTV8CWpAJ?q=*PUiRZ zlc`)Z#qa6(j{Mdpwam4`!r(q>XxDJ7Ri<#4W;Hth6PwFkBgFIl=AW*%c*g~ZqvS1) z=KH{2XvNI4=)txXOL;1uHFfj*U(|b<%~+6SsWmUIj&?tLHcQH!r;{Gs(x>755};PS zNO&X>Qs_kgz*Sv~wvO3L@al26{@3T1A|f>CTYuR*v5tfHgT{X9spPx*gU9?cw|4)( z8*b6a%*xa+wqaPfk3E~MQt-!w`JX?ssxN2pvpKtmjK!R}tkcRF85QIqXd_m}Eh~R` z98-dRkEJ%xp)-PwNTtl62%^wJCW}H}g_a~4TjF*g|CW_}GHtVKtEV;m)!DlB=xY_= z6tF>zg-~8y>RILmbPm{4{-NTE;izS(2wb{8t?mI!g%6Ioaziv6&qS21MmEqLS;3dC z=o=Qi5kd5XNzGb)IWEY7wmgLrYe*T)-Is~g{){cD<^2?s$3loEA%E&~XRz-*iGw7T z=^H}Wwhv(EN#45E%OrOWws35b^NfD@73yc(Lw5u(X!-VqmSIAV- zsd6dc(?g>?0oBnjEM`5GQuU{gpDNJ~H6K-J97l(Ze&KGS%)Kh;8L&T@t+pPZI9dJC zN-ZkxY>BsG$?LJyE0GP)<2}tT8B9+!3x^MmkhZgwE@3OL7dbJxxeWhvXq&rs_JN{; zDlw??Savj>##1tw1&iVfRFwUWS)q9af5zlxN;vPD7+v7{)JXTtCBa4CmWun9Oo1zI zRxtYVUdFhPr>*}&ShVN1AMOWyP#6F3&9U}!@W*9NS;VTXno8r{Ba)<{j{+*6*62s9XJ1AaFT&-`Grs;ma?>{_YO7}y=aewrR z1%lXwG?rIw%{UMCw%Te&tf$g=PAKWO{&NZ~pxJ1UD1MCJMGP!vn3ae3^0zK%b&q%9-5 z8_cEuZ4;AydSRvnuLC%QZk)F;gl@zdNN5SWeTC`D8R7$rN9UBDmr2Vig@ z*kpjsd*DZA2SDuq|35~)C}+G2%WXzntC9?u{iC#3t$ZXN`(o(U874sK9+4^C?=)%B zwGu96>$u}K(e+=))tScM<);qqnED%}qfxqYQ9^wRpX={mW-4GND|c^tdO%_Bxz>Tl zEXShgVeIP&ci%++4A1Vt9m1cwvPq_1z1sP;xpO?a;O+2*qxMOMigGH89z#5q_D)zv z<+SpoAzf#!?T+2<-O8l=46fSTr@HUG*&xjC{=2&g@xH+55y3vM_W&Medz!Jy9;B-| zHxh41F;F=)>$UFXJNr+F5L}>5Zxx)Cn7Tw!bDvOhM9t6`ezaFEs|Lj@SyMASIhEp+s6yqUv0F#&V#@<{M4Jw1Z;3qat4>`Js