From e4c3177ad4b83ba86ac1122ece8a59581e958bb1 Mon Sep 17 00:00:00 2001 From: DianePatton Date: Wed, 30 Jan 2019 13:27:24 -0500 Subject: [PATCH] Added Design and Architecture Guide, v1 Added Design and Architecture Guide, v1 --- .../kubernetes/backup_disaster_recovery.rst | 79 +++++ .../kubernetes/concepts_and_definitions.rst | 132 +++++++ docs/dag/kubernetes/deploying_trident.rst | 142 ++++++++ .../DynamicStorageProvisioningProcess.png | Bin 0 -> 51993 bytes .../kubernetes/images/MultiInfraCluster.png | Bin 0 -> 31194 bytes .../kubernetes/images/MultiMasterCluster.png | Bin 0 -> 35511 bytes .../kubernetes/images/MultiMasterCluster1.png | Bin 0 -> 32097 bytes .../kubernetes/images/MultietcdCluster.png | Bin 0 -> 31523 bytes docs/dag/kubernetes/index.rst | 19 + docs/dag/kubernetes/integrating_trident.rst | 324 ++++++++++++++++++ docs/dag/kubernetes/introduction.rst | 28 ++ ...es_cluster_architecture_considerations.rst | 153 +++++++++ .../netapp_products_integrations.rst | 47 +++ .../kubernetes/security_recommendations.rst | 50 +++ .../storage_configuration_trident.rst | 202 +++++++++++ ...age_kubernetes_infrastructure_services.rst | 146 ++++++++ docs/index.rst | 1 + .../operations/tasks/backends/ontap.rst | 6 +- 18 files changed, 1326 insertions(+), 3 deletions(-) create mode 100644 docs/dag/kubernetes/backup_disaster_recovery.rst create mode 100644 docs/dag/kubernetes/concepts_and_definitions.rst create mode 100644 docs/dag/kubernetes/deploying_trident.rst create mode 100644 docs/dag/kubernetes/images/DynamicStorageProvisioningProcess.png create mode 100644 docs/dag/kubernetes/images/MultiInfraCluster.png create mode 100644 docs/dag/kubernetes/images/MultiMasterCluster.png create mode 100644 docs/dag/kubernetes/images/MultiMasterCluster1.png create mode 100644 docs/dag/kubernetes/images/MultietcdCluster.png create mode 100644 docs/dag/kubernetes/index.rst create mode 100644 docs/dag/kubernetes/integrating_trident.rst create mode 100644 docs/dag/kubernetes/introduction.rst create mode 100644 docs/dag/kubernetes/kubernetes_cluster_architecture_considerations.rst create mode 100644 docs/dag/kubernetes/netapp_products_integrations.rst create mode 100644 docs/dag/kubernetes/security_recommendations.rst create mode 100644 docs/dag/kubernetes/storage_configuration_trident.rst create mode 100644 docs/dag/kubernetes/storage_kubernetes_infrastructure_services.rst diff --git a/docs/dag/kubernetes/backup_disaster_recovery.rst b/docs/dag/kubernetes/backup_disaster_recovery.rst new file mode 100644 index 000000000..71002a60f --- /dev/null +++ b/docs/dag/kubernetes/backup_disaster_recovery.rst @@ -0,0 +1,79 @@ +.. _backup_disaster_recovery: + +**************************** +Backup and Disaster Recovery +**************************** + +Protecting application data is one of the fundamental purposes of any storage system. Regardless of an application being cloud native, 12 factor, microservice or any other architecture, the data still needs to be protected for the application to continue to function and be valuable to the organization. + +NetApp's storage platforms provide data protection and recoverability options which vary based on recovery time and acceptable data loss requirements. Trident can provision volumes which can take advantage of some of these features, however a full data protection and recovery strategy should be evaluated for each application with a persistence requirement. + +ONTAP snapshots +=============== + +Snapshots play an important role by providing point-in-time recovery options for application data. It's important to remember, however, that snapshots are not backups by themselves. They will not protect against storage system failure or other catastrophes which result in the storage system failing. Snapshots are a convenient, quick, and easy way to recover data for most scenarios. + +Using ONTAP snapshots with containers +------------------------------------- + +A backend which has not explicitly set a snapshot policy will use the "``none``" policy. This means that ONTAP will not take any snapshots of the volume automatically. If the storage administrator takes manual snapshots or changes the snapshot policy via the ONTAP management interface, this will not affect Trident operation. + +Note that the snapshot directory is hidden by default. This is to facilitate maximum compatibility of volumes provisioned using the ontap-nas and ontap-nas-economy drivers as some applications, such as MySQL, could experience issues. + +Accessing the snapshot directory +-------------------------------- + +The ``.snapshot`` directory is a mechanism which can be enabled when using the ``ontap-nas`` and ``ontap-nas-economy`` drivers to allow applications to recover data from snapshots directly. More information about how to enable access and enable self-service data recovery can be found in `this blog post `_ on `netapp.io `_. + +Restoring the snapshots +----------------------- + +It is possible to restore a volume to a state recorded in a previously created snapshot copy to retrieve lost information using the “volume snapshot restore” ONTAP CLI command . When you restore a Snapshot copy, the restore operation overwrites the existing volume configuration. Any changes made to the data in the volume after the Snapshot copy was created are lost. + +.. code-block:: console + + cluster1::*> volume snapshot restore -vserver vs0 -volume vol3 -snapshot vol3_snap_archive + + + +SolidFire snapshots +=================== + +It is possible to backup data on a SolidFire Volume by setting a snapshot schedule to a SolidFire volume. This would make sure that the snapshots of the volume are taken at the required interval. However, it is not possible to set a snapshot schedule to a volume through the solidfire-san driver. This would have to be set manually using the Element OS Web UI or Element OS APIs. + +In the event of a data corruption, we can choose a particular snapshot and rollback the volume to the snapshot manually using the Element OS Web UI or Element OS APIs. This reverts any changes made to the volume since the snapshot was created. + + + +Etcd snapshots using ``etcdctl`` command line utility +===================================================== + + +The etcdctl command line utility offers the provision to take snapshot of an etcd cluster. It also enables us to restore the previously taken snapshot. + +etcdctl snapshot backup +----------------------- + +The etcdctl command ``etcdctl snapshot save /var/etcd/data/snapshot.db`` enables us to take a point-in-time snapshot of the etcd cluster. NetApp recommends using a script to take timely backups. This command can be deployed from within the etcd container or the command can be deployed using the ``kubectl exec`` command directly. Store the periodic snapshots under the persistent Trident NetApp volume `/var/etcd/data` so that snapshots are stored securely and can safely be recovered should the trident pod be lost. Periodically check the volume to be sure it does not run out of space. + +etcdctl snapshot restore +------------------------ + +In the event of an accidental deletion or corruption of Trident etcd data, we can choose the appropriate snapshot and restore it back using the command ``etcdctl snapshot restore snapshot.db --data-dir /var/etcd/data/etcd-test2 --name etcd1``. Take note to restore the snapshot on to a different folder [shown in the above command as /var/etcd/data/etcd-test2 which is on the mount] inside the Trident NetApp volume. + +After the restore is complete, uninstall Trident. Take note not to use the "-a" flag during uninstallation. Mount the Trident volume manually on the host and make sure that the current "member" folder under /var/etcd/data is deleted. Copy the "member" folder from the restored folder /var/etcd/data/etcd-test2 to /var/etcd/data. After the copy is complete, re-install Trident. Verify if the restore and recovery has been completed successfully by making sure all the required data is present. + +Data replication using ONTAP +============================ + +Replicating data can play an important role in protecting against data loss due to storage array failure. Snapshots are a point-in-time recovery which provide a very quick and easy method of recovering data which has been corrupted or accidentally lost as a result of human or technological error. However, they cannot protect against catastrophic failure of the storage array itself. +Trident is unable to configure replication relationships itself, however the storage administrator can use ONTAP’s SVM-DR function to automatically replicate volumes to a DR destination. If this method is used to automatically protect Trident provisioned volumes, there are some considerations to take into account. + +* A distinct backend should be created for each SVM which has SVM-DR enabled. + +* Storage classes should be crafted so as to not select the replicated backends except when desired. This is important to avoid having volumes which do not need the protection of a replication relationship be provisioned onto the backend. + +* Application administrators should understand the additional cost and complexity associated with replicating the data and a plan for recovery should be determined before they leverage replication. + +* Trident does not automatically detect SVM failures. Therefore, upon a failure, the administrator needs to run the command `tridentctl backend update` to trigger Trident's failover to the new backend. + diff --git a/docs/dag/kubernetes/concepts_and_definitions.rst b/docs/dag/kubernetes/concepts_and_definitions.rst new file mode 100644 index 000000000..7992d4581 --- /dev/null +++ b/docs/dag/kubernetes/concepts_and_definitions.rst @@ -0,0 +1,132 @@ +.. _concepts_and_definitions: + +************************ +Concepts and Definitions +************************ + +Kubernetes introduces several new concepts that storage, application and platform administrators should take into consideration. It is essential to understand the capability of each within the context of their use case. + +Kubernetes storage concepts +=========================== + +The Kubernetes storage paradigm includes several entities which are important to each stage of requesting, consuming, and managing storage for containerized applications. At a high level, Kubernetes uses three types of objects to describe storage, as described below: + +Persistent Volume claim +----------------------- + +Persistent volume claims (PVCs) are used by applications to request access to storage resources. At a minimum, this includes two key characteristics: + +* Size – The capacity desired by the application component +* Access mode – This describes the rules for accessing the storage volume. In particular, there are three access modes: + + * Read Write Once (RWO) – only one node is allowed to access the storage volume at a time for read and write access + * Read Only Many (ROX) – many nodes may access the storage volume in read-only mode + * Read Write Many (RWX) – many nodes may simultaneously read and write to the storage volume + +* Optional: Storage Class - Which storage class to request for this request. See below for storage class information. + +More information about PVCs can be found in the `Kubernetes `_ or `OpenShift `_ documentation. + +Persistent Volume +----------------- + +PVs are objects that describe, to Kubernetes, how to connect to a storage device. Kubernetes supports many different types of storage. However, this document covers only NFS and iSCSI devices since NetApp platforms and services support those protocols. +At a minimum, the PV must contain these parameters: + +* The capacity represented by the object, e.g. "5Gi" +* The access mode--same as for PVCs--however, access modes can be dependent on protocol. + + * RWO is supported by all PVs + * ROX is supported primarily by file and file-like protocols, e.g. NFS and CephFS. However, some block protocols are supported, such as iSCSI + * RWX is supported by file and file-like protocols only, such as NFS + +* The protocol, e.g. "iscsi" or "nfs", and additional information needed to access the storage. For example, an NFS PV will need the NFS server and mount path. +* A reclaim policy that describes the Kubernetes action when the PV is released. There are three options available: + + * Retain, which will mark the volume as waiting for administrator action. The volume cannot be reissued to another PVC. + * Recycle, where, after being released, Kubernetes will connect the volume to a temporary pod and issue a ``rm -rf`` command to clear the data. For our interests, this is only supported by NFS volumes. + * A policy of Delete will cause Kubernetes to delete the PV when it is released. Kubernetes does not, however, delete the storage which was referenced by the PV. + +More information about PVs can be found in the `Kubernetes `_ or `OpenShift `_ documentation. + +Storage Class +------------- + +Kubernetes uses the storage class object to describe storage with specific characteristics. An administrator may define several storage classes that each define different storage properties. They are used by the :ref:`PVC ` to provision storage. A storage class may have a provisioner associated with it that will trigger Kubernetes to wait for the volume to be provisioned by the specified provider. In the case of NetApp, the provisioner identifier used is ``netapp.io/trident``. + +A storage class object in Kubernetes has only two required fields: + +* A name +* The provisioner, a full list of provisioners can be found in `the documentation `_ + +The provisioner used may require additional attributes, which will be specific to the provisioner used. Additionally, the storage class may have a reclaim policy and mount options specified which will be applied to all volumes created for that storage class. + +More information about storage classes can be found in the `Kubernetes `_ or `OpenShift `_ documentation. + +Kubernetes Compute Concepts +=========================== + +In addition to basic storage concepts, like how to request and consume storage as described above, it's important to understand the compute concepts involved in the consumption of storage resources. Kubernetes is a container orchestrator, which means that it will dynamically assign containerized workloads to cluster members according to the resource requirements they have expressed (or defaults, if no explicit request is made). + +For more information about what containers are and why they are different, see the `Docker documentation `_. + +Pods +---- + +`A pod `_ represents one or more containers which are related to each other. Containers which are members of the same pod are co-scheduled to the same node in the cluster. They typically share network and storage resources, though not every container in the pod may access the storage or be publicly accessible via the network. + +The smallest granularity of management for Kubernetes compute resources is the pod. It is the atomic unit (smallest unit) of scale and is the consumer of other resources, such as storage. + +Services +-------- + +A Kubernetes `service `_ acts as an internal load balancer for replicated pods. It enables the scaling of pods while maintaining a consistent service IP address. There are several types of services, which may be reachable only within the cluster with a ClusterIP, or may be exposed to the outside world with a NodePort, LoadBalancer, or ExternalName. + + +Deployments +----------- + +A `deployment `_ is one or more pods which are related to each other and often represent a "service" to a larger application being deployed. The application administrator uses deployments to declare the state of their application component and request that Kubernetes ensure that the state is implemented at all times. This can include several options: + +* Pods which should be deployed, including versions, storage, network, and other resource requests +* Number of replicas of each pod instance + +The application administrator then uses the deployment as the interface for managing the application. For example, by increasing or decreasing the number of replicas desired the application can be horizontally scaled in or out. Updating the deployment with a new version of the application pod(s) will trigger Kubernetes to remove existing instances one at a time and redeploy using the new version. Conversely, rolling back to a previous version of the deployment will cause Kubernetes to revert the pods to the previously specified version and configuration. + +StatefulSets +------------ + +Deployments specify how to scale application components, but it's limited to just the pods. When a webserver (which is managed as a Kubernetes deployment) is scaled up, Kubernetes will add more instances of that pod to reach the desired count. It is possible to add PVCs to deployments but then the PVC is shared by all pod replicas. What if each pod needs unique persistent storage? + +`StatefulSets `_ are a special type of deployment where persistent storage is requested along with each replica of the pod(s). The StatefulSet definition includes a template PVC, which is used to request additional storage resources as the application is scaled out. In this case, each replica receives its own volume of storage. This is generally used for stateful applications such as databases. + +In order to accomplish the above, StatefulSets provide unique pod names and network identifiers that are persistent across pod restarts. They also allow ordered operations, including startup, scale-up, upgrades, and deletion. + +As the number of pod replicas increase, the number of PVCs do also. However, scaling down the application will not result in the PVCs being destroyed, as Kubernetes relies on the application administrator to clean up the PVCs in order to prevent inadvertent data loss. + +Connecting containers to storage +================================ + +When the application submits a PVC requesting storage, the Kubernetes engine will assign a PV which matches, or closely matches, the requirement. If no PV exists which can meet the request expressed in the PVC, then it will wait until a PV has been created which matches the request before making the assignment. If no storage class was assigned, then the Kubernetes administrator would be expected to request a storage resource and introduce a PV. However, the provisioner handles that process automatically when using storage classes. + +.. _figDynamicStorageProvisioningProcess: + +.. figure:: images/DynamicStorageProvisioningProcess.* + + Kubernetes dynamic storage provisioning process + +The storage is not connected to a Kubernetes node within a cluster until the pod has been scheduled. At that time, ``kubelet``, the `agent `_ running on each node that is responsible for managing container instances, mounts the storage to the host according to the information in the PV. When the container(s) in the pod are instantiated on the host, ``kubelet`` mounts the storage devices into the container. + +Destroying and creating pods +============================ + +It's important to understand that Kubernetes destroys and creates pods (workloads), it does not "move" them the same as live VM migration used by hypervisors. When Kubernetes scales down or needs to re-deploy a workload on a different host, the pod and the container(s) on the original host are stopped, destroyed, and the resources unmounted. The standard mount and instantiate process is then followed wherever in the cluster the same workload is re-deployed as a different pod with a different name, IP address, etc. +When the application being deployed relies on persistent storage, that storage must be accessible from any Kubernetes node deploying the workload within the cluster. Without a shared storage system available for persistence, the data would be abandoned, and usually deleted, on the source system when the workload is re-deployed elsewhere in the cluster. + +To maintain a persistent pod that will always be deployed on the same node with the same name and characteristics, a Stateful Set must be used as described above. + +Container Storage Interface +=========================== + +The Cloud Native Computing Foundation (CNCF) is actively working on a standardized Container Storage Interface (CSI). NetApp is active in the CSI Special Interest Group (SIG). The CSI is meant to be a standard mechanism used by various container orchestrators to expose storage systems to containers. Trident v19.01 with CSI is currently in alpha stage and runs with Kubernetes version <= 1.12. However, today CSI is in very early stages and does not provide the features NetApp's interface provides for Kubernetes. Therefore, NetApp recommends deploying Trident without CSI at this time and waiting until CSI is more mature. + diff --git a/docs/dag/kubernetes/deploying_trident.rst b/docs/dag/kubernetes/deploying_trident.rst new file mode 100644 index 000000000..d5446632d --- /dev/null +++ b/docs/dag/kubernetes/deploying_trident.rst @@ -0,0 +1,142 @@ +.. _deploying_trident: + +***************** +Deploying Trident +***************** + +The guidelines in this section provide recommendations for Trident installation with various Kubernetes configurations and considerations. As with all the other recommendations in this guide, each of these suggestions should be carefully considered to determine if it's appropriate and will provide benefit to your deployment. + +Supported Kubernetes cluster architectures +========================================== + +Trident is supported with the following Kubernetes architectures. In each of the Kubernetes architectures below, the installation steps remain relatively the same except for the ones which have an asterick. + + +-----------------------------------------------+-----------+---------------------+ + | Kubernetes Cluster Architectures | Supported | Normal Installation | + +===============================================+===========+=====================+ + | Single master, compute | Yes | Yes | + +-----------------------------------------------+-----------+---------------------+ + | Multiple master, compute | Yes | Yes | + +-----------------------------------------------+-----------+---------------------+ + | Master, etcd, compute | Yes* | No | + +-----------------------------------------------+-----------+---------------------+ + | Master, infrastructure, compute | Yes | Yes | + +-----------------------------------------------+-----------+---------------------+ + +The cell marked with an asterik above has an external production etcd cluster and requires different installation steps for deploying Trident. The :ref:`Trident etcd documentation ` discusses in detail how to freshly deploy Trident on an external etcd cluster. It also mentions how to migrate existing Trident deployment to an external etcd cluster as well. + +Trident installation modes +========================== + +Three ways to install Trident are discussed in this chapter. + +**Normal install mode** + +Normal installation involves running the ``tridentctl install -n trident`` command which deploys the Trident pod on the Kubernetes cluster. Trident installation is quite a straightforward process. For more information on installation and provisioning of volumes, refer to the :ref:`Deploying documentation `. + +**Offline install mode** + +In many organizations, production and development environments do not have access to public repositories for pulling and posting images as these environments are completely secured and restricted. Such environments only allow pulling images from trusted private repositories. +In such scenarios, make sure that a private registry instance is available. Then trident and etcd images should be downloaded from a bastion host with internet access and pushed on to the private registry. To install Trident in offline mode, just issue the ``tridentctl install -n trident`` command with the ``--etcd-image`` and the ``--trident-image`` parameter with the appropriate image name and location. For more information on how to install Trident in offline mode, please examine the blog on `Installing Trident for Kubernetes from a Private Registry `_. + + +**Remote install mode** + +Trident can be installed on a Kubernetes cluster from a remote machine. To do a remote install, install the appropriate version of ``kubectl`` on the remote machine from where you would be running the ``tridentctl install`` command remotely. Copy the configuration files from the Kubernetes cluster and set the KUBECONFIG environment variable on the remote machine. Initiate a ``kubectl get nodes`` command to verify you can connect to the required Kubernetes cluster. Complete the Trident deployment from the remote machine using the normal installation steps. + +Trident CSI installation +======================== +The Container Storage Interface (CSI) is a standardized API for container orchestrators to manage storage plugins. CSI still in early stages and has not yet integrated much functionality. However, using the early specs, NetApp developed a Trident CSI for Kubernetes alpha driver for the Kubernetes CSI Beta integration for testing purposes only. As of Trident 19.01, NetApp recommends not deploying CSI in production environments until CSI becomes more mature. More information regarding CSI can be found in the :ref:`Trident documentation `. + + +Recommendations for all deployments +=================================== + +Deploy Trident to a dedicated namespace +--------------------------------------- + +`Namespaces `_ provide administrative separation between different applications and are a barrier for resource sharing, for example a PVC from one namespace cannot be consumed from another. Trident provides PV resources to all namespaces in the Kubernetes cluster and consequently leverages a service account which has elevated privileges. + +Additionally, access to the Trident pod may enable a user to access storage system credentials and other sensitive information. It is important to ensure that application users and management applications do not have the ability to access the Trident object definitions or the pods themselves. + +Use quotas and range limits to control storage consumption +---------------------------------------------------------- + +Kubernetes has two features which, when combined, provide a powerful mechanism for limiting the resource consumption by applications. The `storage quota mechanism `_ allows the administrator to implement global, and storage class specific, capacity and object count consumption limits on a per-namespace basis. Further, using a `range limit `_ will ensure that the PVC requests must be within both a minimum and maximum value before the request is forwarded to the provisioner. + +These values are defined on a per-namespace basis, which means that each namespace will need to have values defined which fall in line with their resource requirements. An example of `how to leverage quotas `_ can be found on `netapp.io `_. + +Use PVC protection to protect in-use resources +---------------------------------------------- + +This feature is on by default if running Kubernetes 1.10 or greater. Follow this process only if running Kubernetes 1.09 or less. + +`Storage object in use protection `_, or simply PVC protection, is a Kubernetes feature which prevents the deletion of PVCs which are in use by a pod and PVs which are bound to a PVC. This is important as it prevents a volume from being destroyed while it's actively being used by an application, which can result in data loss. + +Implementing PVC protection is slightly different depending on your host operating system and Kubernetes distribution. Generically, the following process can be followed when using CentOS with "vanilla" Kubernetes, however be sure to follow the documentation for your particular operating system and Kubernetes version. + +.. code-block:: console + + # from each master server in the cluster, edit the api server config + vi /etc/kubernetes/manifests/kube-apiserver.yaml + + # search for the line under the "kube-apiserver" command stanza which + # starts with "- --admission-control" and append the value + # "StorageObjectInUseProtection" + + # alternatively, backup the file and use the following sed command + cp /etc/kubernetes/manifests/kube-apiserver.yaml \ + /etc/kubernetes/manifests/kube-apiserver.yaml.orig + + sed -i '/admission-control/ s/$/,StorageObjectInUseProtection/' \ + /etc/kubernetes/manifests/kube-apiserver.yaml + + # after editing, restart the kube-apiserver service + systemctl restart kube-apiserver.service + +After adding the admission controller for storage object protection you can verify it's functioning by viewing the details of a PVC and verifying the presence of the finalizer. + +.. code-block:: console + :emphasize-lines: 11 + + [root@kubemaster ~]# kubectl describe pvc pvc-protection + Name: pvc-protection + Namespace: default + StorageClass: performance + Status: Bound + Volume: default-pvc-protection-3bcc8 + Labels: + Annotations: pv.kubernetes.io/bind-completed=yes + pv.kubernetes.io/bound-by-controller=yes + volume.beta.kubernetes.io/storage-provisioner=netapp.io/trident + Finalizers: [kubernetes.io/pvc-protection] + Capacity: 3972844748800m + Access Modes: RWO + Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal ExternalProvisioning 23s (x2 over 23s) persistentvolume-controller waiting for a volume to be created, either by external provisioner "netapp.io/trident" or manually created by system administrator + Normal ProvisioningSuccess 21s netapp.io/trident Kubernetes frontend provisioned a volume and a PV for the PVC + +Deploying Trident to OpenShift +============================== + +OpenShift uses Kubernetes for the underlying container orchestrator. Consequently, the same recommendations will apply when using Trident with Kubernetes or OpenShift. However, there are some minor additions when using OpenShift which should be taken into consideration. + +Deploy Trident to infrastructure nodes +-------------------------------------- + +Trident is a core service to the OpenShift cluster, provisioning and managing the volumes used across all projects. Consideration should be given to deploying Trident to the infrastructure nodes in order to provide the same level of care and concern. + +To deploy Trident to the infrastructure nodes, the project for Trident must be created by an administrator using the `oc adm` command. This prevents the project from inheriting the default node selector, which forces the pod to execute on compute nodes. + +.. code-block:: console + + # create the project which Trident will be deployed to using + # the non-default node selector + oc adm new-project --node-selector="region=infra" + + # deploy Trident using the project name + tridentctl install -n + +The result of the above command is that any pod deployed to the project will be scheduled to nodes which have the tag "``region=infra``". This also removes the default node selector used by other projects which schedules pods to nodes which have the label "``node-role.kubernetes.io/compute=true``". diff --git a/docs/dag/kubernetes/images/DynamicStorageProvisioningProcess.png b/docs/dag/kubernetes/images/DynamicStorageProvisioningProcess.png new file mode 100644 index 0000000000000000000000000000000000000000..8d9936bcf5a1c0e075ab8274ba778674c5259a41 GIT binary patch literal 51993 zcmeFZbx>T*|1LPV1_%spNzmW~cY+2T+-)E@K?j!sf=hT4G`Kqi4IUg4+}#O*!3pkr zcz<`Rw!V9}?)_tL-Th;!qTqC&)7{gj`yosnbP7WEj;B-AmT`cOTn#|Yo7(PBT2(*-``or<$w zBCxe24d(x&2H8`mSD93iwaH<47kD{&E+i`Me^_CDU+KH|!&Hzt-S@CbVsECx$$xL9 zR7nDzF-n?%sPAP2)+Rwuhzq89mmn%Plqxud3-7HmS@;XanE$9|fnf$9L?l|PLMl^U z#Y>>B23+3n3$|2+yyhlm^ux63*STa+j=M>ldznJ5;h(@oH?{O0uXEpQw79O{Z)(Uy@>WuELE_k6%|n0W2EO-=MUX0#n5&+DQ2M! zzBFNuJU>7G`0-#v#{seUGIl=mZhueY_v`Y{4RP0y1y`XV$A&cV?}oOnQ`j( z;NT#%(OWJ6(<)p^pf^05w#A!n2IHWr>SUrxWse9QeP*GDF_W~+7c+?@wseHD8n080 zk`S+ReQ%Qxm6$d-;P>XwDayYui>2wO3~DS21~>95>YOoEv%ZI~?e3Ol9#vGZl5)P{Xkz|uDZlI4=o!z1>bk+1HUJYuekt^&cF3!1pM* zBRETv*U!Uf`Ap57%5SfrK3C^TFsjaQ0VWlzB*Kcy&Qgry5l{FhwAP@O6zGO5`UsP1o-``KOuOPl! zP{6=m{*yMgTXI$&>M>^1RnEYk(NChJ*Z1>1#?m|dPW4IPIqG2HpLJPcjn&nk#S=?? z)t1epKehLg#Jz#HiU zg=brR$*k58?na1dQFl3W!d^L4m`O~^p{Ojy?(dMdhFs^83M;}e3&WLgH#JWLpJ zf36%^@P*a<`N2$&%c~s9?^`q4>7zuplc8hs=g*%mXHU`Ti3trd$9%iCzh{0S3trFs zn<}KsD%4kNnmn)a>>tlKp=+-UveeT4v7-*Isj4Ed+kA7fZ3Y%U{&^{N5I`;dsYjhq z9#I>CVc{#x{G+f_?0hFm-n}Hs*AywB)!K5ZZcyqO%AS+8&K}mg2Iv$<|IpCT{QTEF z1Qy5wurF$Io?t7t!}B&2X)OeBRDUW*~|VVv7k#g>4&Mfv%uAUmUtAt&;)a;yWLMbs2rgkuNfhaGd40h z%Z6R4BvMEyPz6)J_e}M1y7FN;F(XShN~dg6kE@h-Ji~ZS4W-dyxVPAe`@b0e z>01SC3xv(3!4r?t0-a0J-{~!4lTFOtmB`oKiZcBFxfbDVSaWfw76&?3ypRW&cKFyK6OFR z>ban>VqeqgxCA&|pK>;T#E-`XCHVr`yntP6@wrMc6E4o)JIzpoSq`x~qZUFR+|iqx zn>MitlO2JA0Rc`2A0^>puU_ir&(y3?l7ps2&bxvBE@w)YFb*j6z!FY4U$9@Lq_o2= zDvY}Q=Z_Yaq28L~WNCx6vy;>4zfYx#{%a!-28eV`ad0TV|9gATOWRv)dumq+^0a3j zbpOpwO;qCt9JKh{4bh5SC`Vhy!W{VotZ^S?MEF-XG-Zm{QO&G_6;6|ln{ zFUB8Pzs4R#+t<{4(pARZH=&DAhLQTDnRc$^B(IKM3l7SC4gN(9X*k_O2i+=8z1zG5 zvau}|3j0Iyp1939?`h)~|MCyNP;qc@F2COzDeHJ2|IS|=M6RKeo3sMFA@yD#KKw6_ ztpyvDJMTGuqt}q-N9p|9HD&o6(^(FqUtX9uk2m#MwbE+rgyUr@f zE_63M_#R^{aO?O_2AAm>2hG^x;-Y?ZMS1xS_XlNGN=iy`6N^nXTsM;fnq^-hk(e6} z=qHPuQyCJPXX*lwb?2-0zOq{A1Z4ANAyj9@0#;6c(em=1Es^-M$jEiya&u-VjjTr9`+L zFTpT(GsfK`^X`iAD^A?X~?nN4&z3~~-f%ljo0UDz#gmS^lay~ohE z9Y3L9wD|%xt}#$H>DyFDWYz6rP;z|U5E67cQoUs|t0N|Yy3A49uTG)Wvk~K&98j}% zGKklbY|>6CHznhT999s=DaB&`57BRW{7##lQA@awad^roPB+S!G9EsDw`8~020>kp zXtF=$dxW*M_2s7?n(eCk`sseH$s&VAiIQ!L#=+&KB?oGQ57bmtA(flCpHb zP^s19y(QoH?k=4L@@d9vDBLj7E;!qapmDb;t*NeFKT_TBd`VN#FQ||%>JN60K0iDc z?Ib&^Cch_N3}zV#U(46p6N>2XA;bFwd%pRogRLHl_m-Ln0sTA^&S6LpzJ{v3LvTj? z8JcYgmWLuli}nfFOd7Ks&tK5W-zE9``0RG(6py{svukX3;f}Isw)>uWzs;Fw{Dzvf zH;%6Q&_jJWi+v+B&~d6x8s7BqUW{dLf8W8)jR*Ivtlq-Ds`{B$nsq^n@QFHc=nOx) zL2Gag_|rhrP}y@oFGLcP<-R1**4s#p*U5-2!u-7b@f~Nqu&}Tq{%dtv zzy^bT5-68f-7nh-{v)55zV%+P_`#FIt#^CE0>3@EH`%(Ct z02Yc;{mE;D>%X6qppMz3qayKAFueuE_9+lZ=D865&lTQ=$0~mHw5h5BK#bO@kl@+4)qxQaVm7ETlJZYjCaTj)0F%fpuEtaN z?s#9|n^n_fDN8%it%#Bm@>&$j%KB@klHk|#y{GJlzq>r-9GweG)18oNT$ffn*)nz+ z4Dni5P-Aca1y-kJ#+!K2r)?+W$j;HL>T}oy41>>bzo67{AOsVk#UThL%3*+AYXC z!JCd+OEfSRZOT&cu{#Pi&3n=%1_5jZ>B-+V)U9s_Q^#=Y;Xi6?e=$dylIdFr^b&cv z5sJ2*n#^UQA0yyuTcc-i4~r+AzP6xM3~iik2LbUDT`)YUdJy`MRy8H(!nk#Y?t zKZsW=`#z9a$ZfAUK?i>y19>i7Q5uTA31 ztJ5~HI7P9-4#+$9_xJ1VXY0zjL=_+H4t!`ClyS8nPMm4`w;~D>Z$b)X$i~0nxp~2k zw)VBYkZ`trEQfCs79wWJRD*NT0CN`-q~3gX>;@#ME}<3QzS+}`3=ex(oll(yeoNUa zYdF>N>N?t1?>)`)-XF8v{#+hniT@&PeMfOF^XBJ>qj3`O*fsr}fNJph^rC_tuxmuO zwc}kOcu<5_5{#@7LhI`S6XwLAm0+wLtQt$6m(fW5Ddz!~%S{uQVhwTxC?N z80o%rkNbCggb9k0X*1#I>*~4@i##!`fE~K5i1UXe;_vxyJUl$=UP80m_V@n~_SGBR zY*uHYLLiXt4l^pOk)fge`r;L$SDiPz+w_g~_4Tc-<^5cK64c6Xc6}55XvRA)?cvAM zUIvl9{gyLxmI&7ciKQRU_p0FnM9m??#e`X??j)GqAD%|YRcYzK)ag5_sYFJjEQ+-| zMm*Z&n~0C> zSaHZWs*_qC3*X{Wv8Q|k?fK_vlkL|5Z-M*2rbJ*Xvg}*vhvK5MDH0{J**7Eas?<4_ zV#Q&y<0o5#$A^fDPI&sedqn8C&p5Lp?y(2Aw*0p6<8 zI`4Z!gE9B?G~wt^1oL=y`-YOm-AK_9(sIMqs|vMm!pee6EqOKZN(QZs<<*04e%6sD zRqeVbWiFUwZ5r755W?u^8cO}CR3X81Vjq=*fVmBSAQuwp?IBDO2y_Vhm@KzUrYkRw zS{))>- zyyB|++phRg{@40_qdak8Xi2VHQcEw<NN1{L`mQtUD7_S?MwZF>RnlyT$4KI;MIpfW(w^3)8=MxO5-?U&hhgrJ^A=& zlYQBh5ap76WiXHD6;hr&`6Sul>H)5KR{2z)1!C!GtWIlu$Y}G-+S)_3*Y^x<7ml zeLJu@+Degx6f=Hwe;%DPBZn(>j~1#rsjAXw90$ZQH{fqka=m@NMClk;i|mfiW2bLB z`}+C@1{6>B@N{|CH#W?Nuxuh*T3SvhG8_m`v#lt%$&3DmoLGd=@VNN zA=1AL)pG*FB#-v@LxL13#+521Xzx$Ar7Q9rGHQ7;Mjg4Azh>Id4;%EvU027oAnLX{ zeK$u~xu0!Z-;NitpA-v57Q~w9qz@3?P<~;v70F#yXm%Q=7`Zj*a^AcS|I^)3<*lnk zR*AdHqsv({)|<)8<;`bJh)kPKCqkUAfDomiuO-& z)Mv%#E+nq`hwNAx*G2D%HAB{4=N|kW4~r7{;eK><4M(u9UYd!_*M7}FG+&#`SSyGL z3nZ(S$v<*Z>+qyBfc8zWP-8Dn{-P!5z)3>!=n79wX? zS3*^-du$$LE-n*QBCab1wXRkWZrJPusxzU?x902B^|KCVM~>keq2z}4cG~ugv26KX zy!ovGpEDI|7q!Z|;^kNh$|J(@>}`aWSvvh6@>(ZbgAbQBj;U&=>J~#5rL}OQL4R|& zZhG<=F2-5>dB@yS%NKa?{QlLeLHL>3Yg%Gqk%&=haqV7B$Q_>Ul8`@dM!P84Xd+F_ zWxy5c_K`9#OJ+X3>IOsKk>muYAzND>$3%H6+vVl&-uUcZw}Ku;_+`?PfN2Z{)7xxe zFLo8sfBcmbj6Y``LhI=85<;@!RSgDF#KxOx_Y7kCu}k^5pahPu)9VrU+LwT0kp4$u zm{B?s5-+K>BxtyooIuje1s!$le|?dN_uW_B_OlFH57VyqAiH25vqJ=_qxE*Z_`vYu zQOG<}G1o|7r_#68;SuwXq@n*n4?!%EJZo{ZPsxwlvj*m3TqR^R?pSdY01x<*Q6Z<> z^$JN#L3%VW?x6ikMoyoa>QO5x2|f@IdZPQ?E??FXO$y>D#6-TkMPRCBF$^|jLw*xAh3Tqh3IRX_@MtICTlE|x!C_0`JbReu` zDCY)>yMW>-@+!ZxSz2tS+5k(Qp?`hW3}wfh$|AY*&g$K#8{A?-9ctiun%o)O?o2!y zsP8LKFo@N?fI`+%A`Enxlmi|K>;R`_0*x7v>--uCtW@Gp`CBZ=kN2I`hzwJCAOZLk zjW-5QwdCF8K!A$A0PM5Hg#`mWyV@q~)`rImI8P zX<`kXXV1Y>(YUo16G_Bv`v-&Sv)AEdBqy(m*4@;8YmT^P3-x3y&l*}N&lfQq{`%AK53Q3%X0@J=x7b9Pw$Iq1&6Ea{S^Z|ABZ*t#+iLS*9IEJbq zbD2D~WFd$Wc7Vj?F)fDT=-?1y@U=V5v*z??!~ogfKxjND##nYVP`A=(yonAs;g{;G z-kO_=ZTKzZfsxg2sM%Q0&INr+<5OJRIa!$epT{fsZD+ed%Zh!|S^p~jBnt85seR#j zE}qn6)0si(^z`)DLNWly57YnKmi~!w!tOae*=XPsA+cZY)#VVT@4c~W4~<7Jvt(doK?A)Cpy7jMJmS-5BGq0v z4!l_PJyY+xnCb^-A&o1yW#s#LybFCU@lY*}7hdQFpiR)FDzV#*wD}Txc6T8Z@$ZjM zkw3E-%0t$}s)Xpnk*D#)BD_5UvFYEAX!0Om+wKl{Qq z)XU86BbM9SW!wW0MG^3^5V)>KGTI&!z%D!f*nTxw{qS#u*TN~?ifN@+H=Q$M;yw~M zGc4>`a$dLEV%@~M=$6ApIyFq6)#SX7EA8V-zF4$|@Bf>K<+S}q1lZ{e`@t8j6hzNw zvX!St0-xv=fKMSKQ*J(}yzC)THQMHDS|UUrP<}6MaC^d%)NaNq|MFG*P>vm!10ym+j3^9hq z_QNHF!-++^geO~95EpmIZBm`R@{)eY@_hh;m2_3Nwxwn9+GJv+s2z%Ma=OZ3Q`zsk zj)7fz@a>(AQYnT8unVJv%_Kc9cvs`5XwXN55^xotb&bfn_nvh}pQ3+45nUX%3BTu< z3uoPy+i|ZE4C68mS?0nBcGb5#^=9)%eXx_x=dh8Eo(V5Rd74~vKcR5vWSifvudjVK z4VrYte99qu(b3U9S^`;3q63;uwK{zt4`0)qS+IO?nzaUVn1s#bDM5p46absm)%fz) z$ZOlDnSD^43-n3d;8_D7=dhOECKNS8yh%m_KMUt)@oGoX%4&Q14)MI7jJk~w@7|U1 zhQWTzu`eHNBmoHV4ES<4HEwb7EmUgL;arm zNh)KcX?@XGooT*NF6R}~xN1ULKB8g$`^i4N$d9rn(&N8{iFdgxTNlI24t(C75Vqrl zzBV+}1NS|X4#zQP@kRFoJZSgA>ZqdM{>W=4b;Px2(2tj-p2ZS9N( ze#tO3FWD#OD)-FrKase96hEhptEoBP_qV=qC?9x)*793-)U6OfA{M@O@nkFNnY0J2 z>xw50J0BD3P-t%ziB|xNF4x1(@4wt=tuhN( zo+FZ)BP!9kGI4$h)s1g4_r!{K-`}T~{vA4J5*gR34RJ@4gIISgFB@km!jgo<#A2CR zye3>2+H4Ac9z3MZneI1_^Gw;=!{HLDdr{5o92}(|F{WRNW!WVZ{*{uoPYFQm56CFH z&VSq^K-b9+Ax7(a6^rCBxg4xC5&c^_TuBAkh zy9+BJxy(vX;P7Rx;ZZG6)RQ$cn$V2lG>oKWuO*5d5${#!Hj7cumv0gq8S6Cmcyms! zmU#B(yRwnkCAi`EwbzSz?;>o=`;zFRZ^d-9TRyOxKK9D@PDdqpd3|za)TZtqcSN%u z{@Q5sCuHbYPF8tmNZ`P4PEB28M=d>2z8P#V>xOBV_}n|{)!Kqh2}}164|j2k1)QhP zx%*=YSqY^-Vnwm8;d|0d<&ADeg@Kpz_e#uUVk`UQ6h!h57Cidp9kqJEmticawX{d> z6=^V@qKO2Dm63CSnn^V_1i4z=1C(|4iA?mGB2d!HK_s@(Z$#2PgHLV9weOb^pzKop z)~~eK2x%~qQ~qRl}G4KSUcAjl5r)C-i=#S?qmcP77%2D)%%_D^(ysJRQdMpuavtu`^bAq=}cpGs+HE$ot43PTMqUobhX)>cf#~JzKV9uj~^z( z#A%M={&D0Gx3yv!*jadCA0ABcY@s$75VB&^g{eRseP-evA6UsXBYDiQ;KG^?gkfnf14N#OF|mk9&o3=4 z0g4fbHLF-;Sy>tM<~H^aH=1G{cP`0P+z3m%}Zq6p?bH0g)%u<6v-7>y8D2;V?7zSyh^k&cyd-evRl&3f;ght9Z$TX zeUZ#*3JhFaxLtN3&cM925E8c`)ZgjwIB% zw*9VO%^tGNCU%3RlBHAMkh$&4OZLr96?kI?x_%Ud86z+ax8?Y~ae*@11Vgrw&W6U` zRg%+dRcm2<5~j#9Qc@Pj&s?Guc^S7bvhGQ)=c=9nG8zii(*D*Sv(`Nw_rtKeC`C}u z2R%m9o6#j<^KBODGSdY4*fv|%^2Wq6dmDpl+{wO9I=$*n=#45NWUGIi{9vglEHg}9 zg2>_zYlk}_Znupn9QJ`?Byc&kFn*2q15Q}MD{D#F2n2O!Uf*DL`sj1K5jugepar`I zV$CXB$!~%?gY_cRSE(^vY61WfVsH&auw3a8?Yl_4*ckpo8F)Rmn=waUD~!=APTL&Q zfsl^sETc~3_0>h>@bEB~k+;F3$Kop**7>3Uvt1W-wrw7%JO6%--6}u;fL=PlwC7m4 zr_-P&eSX(x`ml*&`uLX2=G(HbUdzRqU5ew`4GlSd=^3d8t9!o77{1J?WkKf1(BHo` zI^TlZJHy3caP%{7M1ODP5!MMaUmun~w0195$GY0#VK@8Y?2Xm=38zGwZ`1;x^(-qx zIqgm1wxIZMqQ*S2^tU_K>-!8Om4k}zb(&{4Jw-k~=x2$e8{!o|E{hL&pU}|FyWw-M zt=b+BO)+DcR;0>*A&qIDiLx4|HpWB)23%RVb;lvlbF8Bs3?fm8WDGQ6A*|yk3%$9| z@s*=ch9qk{uioT1`PkJm`D(N>PD9j?wL8e2ZTxnzP)J?2bCHfF&KWo-(pS%s(L2eV zQ~YW_klBnfm3W{FVX>Uqd-l=>z8VQ6B2aa|$96;d7w;e#d5?k#U>{^AN(?UV?qP-^rvP`6u|CyW6YBZrQvot$U7iHQ(=kc;nhh$H~DV;o%H+2|y2l znWadfO38=bC1=D2xw#+&)D5$Y=pec}keKcf{A_TQn}o=o5ERl?-ky}Ht~CNX_k zEZ(bh$16ShGNY)uw>nkYBeLG+d;^Ph#g*cl^jV&h&bVE_h=xYy(!oNd-qE5YQJ#d) z2s+pbl^%v1g=FA^4vW58d!E&*0hQSso0#Joqlh7ncDqpCFk2`ROyN*xY9#B49EBYo zInHO7Wa35LUR67xsKh+fWv&K=0HdY4zg}s?xjsIQgt+TcarD}-iX=u9xnjhsNGP_r zT@=x}Faj16@5l9Q>`4F=LTJm?mMA!)7MEGHOQYOkxxp-sHXE0<_BMnZi46B!0TyOa zHPZhZ|IaNh;#k)Ng#K5vk@EmmE^@E-RWakxNbNK@I{9 z%YpTroZ4>#NVe3PUqdgEKx1YyLGHcD?I{=F*mkC3RS zk%0krzrH*WeC+M*`TF{%(kqLaU|-e2D!P}JjP!~=ff-fpw2`zh)Xf<7jo@_A@9eY+ z8L?Xf?sUAw$3(Fs!M{SKcLR8Mc%mu`>8vJnYz(`?h?#@wc~L1snVtXA!2e9MQI+T- zsL;Y@+z`d3{&aU|I1SyJ!RUe_BCG-NWs+52p<_TwZaWiyln{iF0}Ddk@sYHFPJZ*R zGyWtD00ss{JxngZtzQKTl+^%$nh&U0BDX`K^qjP_T3H3`<#np+WzOaP{rmT>byvg$ zpj)z$^{mOawLw#Zw`MZQam$m0PSpWZF0a+qWe`S;7RH3G$wbAR%#i_b7L2eD02jLd z!wmxi14Fqk@WA>FM${7w{}UZpd`Et zAc?ir)QZA6ih6p3YPlW9OCZn~nM{zFh?toB@$)d>Ga%0VZ_iMvW8v77i(;4mT<(PW z8hrZnNs1K&%Hu9%cDA=4l$flqtE&SPS_Uo7&d%9b)>c-4Zi`<)Kzi@D4Uv_#wV~6b z|6w!R!%hjHrHUe5Zku)z%Nl;aV~PFLt@0G$tn1k;eOrva)%QBxtpS4G*pj=J?QRY3 zKwvG!|5|5sG#iq;Rh_(s%!u6C&HnxCx}zmm`|O^vr|dbp&k3M?)V~||KaslSnb6~k zM(%g&V6L)*)9%NS10o%0<46RueNp%0U~K2^uALq}$b!3znX9#&lhB8$DY(+rsJo!6mL8sUuK_>5CzPq%nQO_1TJ1?rOPYou_Ou@$V z6?!f=MXqjkK!AoE`=-=0b$?V?f8}-*a2k_Cu4id) zVS4YCzU#Piu19wMBtVSEB|{AA)Sdy;dNT3c+x&pml}i{KaA61Q7UR(WBDr5^G>>vqMl?=Byk4&V&{ zz5bZ$&cS&eiEPMOXa)$o>X19;VqfQZxVqLfH8lbB`p<8(tH@&^*tfiZzz=FuTEvSz zH4jH9>29n&Emz6mbvO7$gNxd^AVmAY`Bsiuq@#j?(@Yvg*Bo@%rPdE6iM)uDYH=IpCF>dv|w3K#zyIcJ^EAbM{D zQP0kz!>RCpiM>D6jtxdHeHn|~B!ZgaBNLQ({KWLL>HQk0Ga=paE>!5$15@DL`>r1^ z;b-5rBp3byq^iGuDa@g@y})K`cHLTWYCk$UD*MsWLb*r$7A%;(db>yJ&Knlg>6Mk9 znHjcjvcuKlcU{BcqqQ7sJRxPV1q>}G?dic%xiBW51EesZ!;K1U0<6KF5~x^vR` z&0qI<=B~tjt;CT!&E45{dv0@Isrb_V+7kzyiDJ~#)bWF^9jtC9@=%rn2pqVK$o=S+ z8k{69!=hM(DVE=09y~*1sBDyl%?T=V_tG9vM5~+K9cgMt3sQanfIK@alnOkbGvTYv zs9tAzcj^vDut1^TKWT7u?ZoSAZ?T)7PO(@9noC4shE!IeK{{D^d3jvUKe}=iZG^Mv z6DwOoW@Kh|GD@PP#RQ@}@^nlR%i9jaY8e28H{+2pp9xxciL)t8ai?NGb@M>9Zaa+j zsp!eudI7k;OpwhB>e!qaPBev2>+j)k(`}Pk>f>lq}FaKK1 zRu)Y5b=Glna3~7ARAf@v`|`}LjC#>~j5s{d@pGf~S@B%m>Cu6GJ@JcD>*jCDv9FIf zCUwfo%Nr}zD|@(HgmIf0q;VhK^wNgvD3N)7=6ZYHdVhGUA2?wNtd*7!<2Z#E*fJ;x z8{GOIU`>^%a2euW?UCHCEs6XdpOA?qN{rcUdx%8xiP0eQH_S<{!dy>7#7>;xREUl* zKCH7GP=bjWJ602x7&d2@OOte!W;)goZ-1Sb+u+IVY|Jc78iCqax-VSe*w)IkvmuOZ z4y01DeQL-G2BpAr@g%6m z%O~>pRSj7z7gz7*r66{8ezIo{AUL$Cl3o{TEwgjaxa0+oH##0#xVVt>l^Wt|Oe)Cm zK-yn?hkcn_jja?ZD5`k3$>qsxj8TNUY+7B?KCRL#)R2dlszCP6>&SM*_HNdZk7X}7 z_Gs<+Sj|wx4hr3tvL`L|`(;K^0@IH`_GQ_FXx}dchP}Wpr#{3hc@s*?ogb}8$^9Cy z#6E=C895W+?4k`g*nkrd;tqO)DD96wy$1f3#=bJFsV}u!C(Q}^0fe!!QeZ*yCrMfL zU?_vb+;7n*+o@e@u+C~`Ch13Kgf`#MR_V#PKOACRtay^9!q@y|C4hDF+CUS>)snx- zP^jg%V?@md<@U&t!yJwP7txBFIArc@wqQif(^-P`7u3mFH(&8}BpzCT_+hRBgzoI& zQ3$yr0?*`ic71IirV+wEYJwjVWwX9-9)E_(?kp-GWuPK z*pz|!KNYf94{2HlKNb&0{e4j_l0x4kh-0772EHcxNF4flqxn>?bcg%d-h8P->ItCqWER|;IgL? zrD(CjeP}psY@7YZ(OdTH9w#{ANxA9q3Z(p*Ea81l%pxbQ{?yB7U2js0f~9)3vBRV^ z?Z23FR4oUaD?;4G`eZVCb(KzH-)ygu^YuCu30z|t zk>&h8x!c8VJ&{qHd^#^V+X4ileVf@nAx|bfIYO4w;`mySx?(L*i&vvK_P|=O+ z#VMLPjPh9C-!B)oY3N@rixMdw|3x_ZR;;aT`5M^1tAtU&86ZGbpQU_@KM=YIpy^Zm4lQ{+-{TEwViMr^q~Q_g_=&y*;=ldvE{T zQF)uQ)LKZQK7TgJlDl}fH*nNktfB|C=nrB(N%fU2wWM{c0m}gZHP>L4JVo5v;sENN z;Gt&0LMbxx7f3asX-HaWBg8rUpwQcgDB2Fx=V&w1kdjUc;?O224w6=iX5faCE5>@h z*^szu?9<^F1g&BC%!;>!^#t3u;(|sL&P#VU|DnHfsS4FDk}hEeZn{?Svm#7dvlZN0v;o^%uAYCZq!gljK8X5uimf z`d~`%#f0SrMVTBsvvGC8?8{Hh0;@^owFa$*eoC4yqzXn!6k^`ZK6X=jvw-r^|CbCE zYXHZ_O_?L&Rq3A}+cf7I$)@Q6Plx&_P&(>v+u8$MjtSJjV)@U*&^P%qxU1B9*>l&r z@2AN)^R#;X&&ak5qbMh<7$@{FBq)1PY&VD3Z1c>^*{TLP zRHyaOoJ;d#)fb9=5FD=2J(j)G@r^H|s4en(eoe|LZR@LOn@Ye+geAo8d!}bsfFqGr z29k+8F|7>^r08SG!0E$-zTNf)l^zV5>r8-OP4RH$p5mI0R$uGuljBa0+Mp-Q`^qaG z%^S})_m_H!+o5KH+{*3LtU1A)AxwY1E{UIocSuK>h=Z|Rq2z6^b*YhH8IFiehKNj% z&prXI2>-OIW*h8nqQ?2T^eQ+?%zIOZB==dh==aAb!G}UeI0b-OPbmm#ND|3qivY(Q z_nSR7h=Zz&)r%B$Z?f;HHu1-w*7B#0JL>A!G*S1`n$bKFrCx-Q<1tcSb&_viAr1E+ zsoh=ExWE!MEL_4y%4BKMI2ic*fT^mnrG^#8E_ASAC%_miWQvDA{8D2Ju6DbW=ya1=leO^LjT$-P#x75|aoSg}LKxhD%?k+0j=Ov$y z-oh&&KES`5dJ)Nm7n@8&1Ej|}_2R96fHb>u4hX=>VncH8 zsy-UjO?F{|CWAda6ZDLYpD{hSK~X8#0w|d^s#a}2lHJha5CaVgH;dq_qA9)7IUeV<*#W6`RWb6p=fDpQW(PE zB~gFj^N$Hpp+MYN6yl4?v%Uf|YUUwDo~^`!L@hR@VgWnfaET~S4EWh-7Jfw=4rK9u zA}v&wy?0S{bNIU$IYNw}V9$25>E8Ufz4hH+!wZib#yLc5&e8Dw~x`tZtn6n&9rj%_$@(0KxSx zPx#rVgLdhj+E}q=!PN~Cc2(*-*5O>sYY8FcygN!(6QpTU!^d5cTYE=tY%SWyV@2Er zUd33GaKXq%**&!zH~$r3_Mh!<@|wLJS_+ECCAf)nH4ZYR7m71obT%vt_H;CX@tWQg z5~r$3Ba$*0ARAvpi|lWSnOVNHfB4|J5uX{Ipzl| zSEJEJ#X@pn?5Sej{8MG#0Sku8e40&0ux)vA;@^C_JX;y;D!^I|LFY8m6H?Yn`yy z3nAwFhRqaq%9oJk)X8_jAD1J}UtMrIq3ZwzlH^LBy%_$glv>Tn*AI_V)q?+$xQsKUK>`&L9}VvW zZGHqq5CHV+)vypcQ8w0y1{IxnMA~~;UAa3C=k$JwjT%@Y4~`J8M~*0e)KkZ)SL}H~3wWM_q$Q0rS!7?7gG5^Zxb56z8!o@^00M;U+5A?6%dt{;y(( z1F8t*z!57~ds1zE=zg;GCbgH&w?AJ@(C(1yXsK`z?2OjKZ<3!VR!;xz@Q*Sj%>?NCQayt?|dkTYI{334nS@j@7e?VTa92Nggc)Bgdi1jL3 zJ)1_vkB>?-4%*m@=;KoRt|lJ@&3@r%5H3z|fmiyftriNf#&!IeQXN&Aggpb2mIX~6 z!VjJiSB3^|2I|CdgxjQfb1yYScc-!+cU8151!hU&-Jp%K8Ot^ZjaG3JwJ9NNaA;>()9Pm*>eZ#e~GgKV6bu zD(?NEjaKMQOK2HafsAtHUBt#d)77v8XmxxP6z1i+nJ-5~N8=-hE*JO9mHlZYAJW@h zmJcRDQxxhi0zdn#?MaZ)|5fUB3k3+;qI@J%-2A1T_N{l_Z+od8p8tRmx|2MrMay|J z?k1r#KPZs8pJuaAfJci24NvIpIPb&phdamhVk{>Ub(iCX%d|&gwPD zxP*NcDa-A@qMOULERb-fZh|l9yNg*pet&gX;^AaqBeq?l;W!>JDA)T|yQWwRax;hA z>E|9)0>E}=`QkU*qqM8dlzUIde_K{CvN&q8R7iTMqC|}#C?&iBu6a@gbDB#jp^Cje zsTp6cP(tirYudtwVui8fv94pbne@iqwz1a=c{CPUzfF0y7#4?OiiSg6ws8^#8#=oD1-*0?pu5vSCwY%hSUrvln`CSuK4cG=QjoAl;sg%liUqy@m zqh4M9Huki|84(It0T{&WmYf*Lq^k=d>kQv1Sz$i!%u6MN10B5LD?>H!sQEvsm3~XF zT=Hlpm+~p;9<7a&MhE%XiB6plZi<&FnGG0zQEc8#3fZVE@k~2DFAUVvv?aB?rI(BP zBSwxc=b#*o#2C#?(DCko`hnR5d=(`BW4rGG*b5@M%;wI~dF0VS!N||8pRxBrumzFAZ7x95sCz?D+rVt@qb#l2Br7VH-E8ZETI z8~9ceyYQzrwwcwyXeK}Wye%x~a8W>Nkf%=uQUO*T0JH-e`v1T9-#P~oFTDWOIlj}% z6S)X{X~)CA{G>j7_dW1E52?~A)F2R<*#E)aTZUD+b?>7~6huNn79pu13X7HoiA|@l z=$2AaLQ=Xr3_wJ>LmHG2K@cziX%J~pN=iUN;*5v=zUP1b*YA8epU(Mk)^+WzuBYaj z&zNJ5Imdn91Ll2cvnhb|=xisoyR>1{jC@yt0vQ&11{FXGyMk|M_wUV&QGG_>$o%j^ z+oaJEgm1SGCP0JX6JvEGx)sbJ4244ImlmM~XWu4mrbP1ji+7Jj4#9 zM*=otNM%BlFbxlgTXTr-BmW(QLT!UBNu+-iV`$?rQ-);QNCXbeD(q%dITgPP^_EAW z7B65;rBz{1CaK~P3N_6LnNMEasS|h3ukZHmk7|Lf(PK@6kv6fLrVRgQ@r#nAf%7&X zLpri~JatBS)Dy-JWIGR3SC|7P5-K1ODtQJw&F75(^9u_DnUU0}6QsL}hUU?xI;{}- zpe|&$unu;WphTZn*r8A@!r3i0E0p5cd~z2wX;-o`?#ybjPfk1ms=)~Uwtzp>|*8U zyyeP(-39L}sDQ9*1g{#FPyR8AXuomOFvEm!Hv*gxJh&g7X?aZ61;LaP5!!v~_=9a-!$V~%M&Oi`a5fW?nOC}e8^xltB|&FN9<7HZZ)UpAag9Rs zc`Tjm6)*H2lH2qO*?#+?pBtD1YBf*-I-{VnghbHvo ze#I zqh(#<=^X`dYc138yu5?vi+cZ_R*Xe|EXRY+4P&V=sOrt7Kz>+1mOl!I+&_E)Mb!mq zAQ0(+br)nyA>a{G30JB%HZd_VHXaJP2qfH~Gnw)-f#e#E>p{k?fBWlQwPLedZkD~H zNXN?*C1{2SkCK9-HBj$Llz6SVOgM^D2CYYax@V`ntkEj^wch>}W3wLe{u;4q$^tVi z*^&-qa#oOlIBNHS<#38Eps#&>ja^2^#vbCR@g_V=s&)Z@p~bGjpym;OV!pAlG2Qk0 zLSgG3GYeE^C`$#VDl=D(`R%9FFCB5&F^mLS7rvhB%}!P!)e|(!n7xhrX!#YlvS#Q~ zr}DL&AlcAJvow)@0=oxo2`Fl?u*>OwGwu{m1`9(3lm7DtW8zv_aTRAqF*$YWn>rl7 zZGo~z85TA+3Q1w^Gp7a=f~2l5INmt530R(p$SSV}Nrd_Wp6i*?Z{p`T?=Jo`b8z6b zcs}z=1kTO%O)Hb`)+b(x8+Z>nX+)!>&=F?BLP9LW$7qb|k+v)3*H;;(s)8k@VKACd zL=TpQ?8ZV;oO*)k6{Onu+Td0~0hbXdziS&p=P-VJl^2R6n{8}|N9#4jozoU~_MkUZM-N{<20){~9gzURNU-#|8- zU4mIJ`{TuXQ-`%yUKJ%vrj`kO_9XObEvMh}*nTYJK#n2VY@sM$l$#?$*?lw335}fw zHWl$#;(UcJ(@-;_HXyweo+%W*6G!F*&;p8}!G=9!0VVmNMS93f{+p{Ot2iE1M2>{$ z{W21Xg4ibDGa~>1*pCank@4<|Mk1y}S+tOY<{!5TrPHCld>I#EWq87{wkFDMan@{s zcDZq#4s5T*6*abiXy(RGOmsu_hikegoM}#r*i5OdjqQIQd89t?{Nr;XcW(~+adObC zI{RlB2t;B8L|9xB&+uCL|_C zyxxB#7bsoNa!SQ-KDy~Yp!(?sKn=X-jRf4$_v*kwaT082{h0nbGYvUY`Ju7A+LPbq z!)5UWheIb_&CMuD#|~0lAW5-vaCAe&*WF!ORu(qQnVObX)a<|O_UMuR)&-^;^Pquc z@GK{XN$d|Lt~jvD*v~B$S@wMmMI;4!esV`$rf@&CjB%C<0!rMqwKYyoPLoFW?%**N zI{UJbu{??6Cr z+(s@iQO&hEYMeHP^xbmnmxi3)9X~T8dE{DLxEAwtD{R*)H_%kC1DTdIiv}G(0J7aH z8rU1sn%yvC#>Gn#s&XhRD`&YSw6>yRz7(3c8K)!U`POp_gO@wpY5?nbBl%pZBm;ID zxPJ(yq1{l7w0VP#;fu}+&huHJ`LJhViius;rZgEa#wSY! z*bqLMN>I|IJbDj-LLoPKdHbJl2e}C9Lb^clqhDl0fkshzaFei^sR2M7;^L*DT{3|! zTGT@&oNx0RNp1*H8o>XP&v7(C*zlMpr0LVM#L|9r0)lh-+MW9V*k4UPao!=`aG5k| zTys+IpcEQkg*m%r^AQLduoEo33we-UXrGv$8FCYk3E)klGehFn%$QLzgxKjl_+@I$ z_AXzLq-4@N*L$~_*{e<`!cy(hQ(U(iksM5A?yV)hQl~wBK|T;>5wjo{Ga1U(b30FD zuR)a1&EazCP)ESs6|TPb84xb7OcP-7k@;DUTp6*?(X1R$*W-RKTpQv{2MP+|7nYf# zrMxg^)rJu`=egn~+L~iyr7vNp$NX8jF5Ug={hAd5<=zs~`-4)ydQEspt<7BJv+PPO z1CiFcL&K+;Z!=R>I^?u~oqj3sh(GZ*IsRViA%4toajWNnQf#*52{$Zqer;|#TjK;M zQaup*v6z+CTcons*YWL}{-Q3M{?&fX3x<;#D=ZtDm&zVF6kFzq1I)v3gVJ9==O;iv zs<3Sw0DPlOzZ|3Y20Q)SG2{XP1-h1L=1!Vd&X!k-+c@dZTeB;Dkr{Of#~;^-V6 zLC6WfEK(){b_0F=zM0hqjP_r}t7(-tSzetBaK192TLKeb)N<~g)wQ(M)m59~A3yGO zU*j9niIGAE^t+8q!d2NG(S^fUQ-MM!^~Cs-pOoY{`8k76-RN~@qFM-vH?s}1TQ1UG zgfY%Rq#LYbb2^wQP2A?l&OX^IXqo5?T63(8!%^n-*}Z=p%VX?Hl}=PM;`KV*=R^a%<66({(31Mf&kZ$!Gm~&uy@N4mbB>?;50-GRvfXs{|KE;554W ztgM~lv8iI*KZ3*p)gpHMMewhoB~Lk#0fBrS9UXIT=Y@jU19U;WlWjc^@s^f~XjZHb zGUhZAqi{}kI>noSC|T{v%$8;M1uYZEiLl=o4%_eQ{Fv+_oWj3!bY}*bmaPL4sP(A) zYXr26>;2|UjQ@RpuCy}?*zi~i<5SofD~jRsqS zcZ;*!SAB*iI?>DRblD5CZt@`j+p08?XY!Bx+S3D$2<^7NMxyQ2@Xz&^75UAi7V#2W z#cfYKjZFnNGot?*s^+xJa$E&+U^mv(IYCO2gXh7OidP^*mX2riLG8_E>_#u*8q&U3 z0boZ?OIoiqDfrw7uE`?T@l1YP+Z1rZX_e56O?|uKOWv(~1h4QPM9)@pbK9ppdfjBZ zxh{C`uamPgb~77u+@vOGP?;wuS2Yo6*l=sg-6%%o+;PxW?&jiEQfTuq8`uR7p8OgFkZrYaf7gp!xnpczQMocW9;Px zE^%w}q&!~NlLTI?CkA|x%~Cs=cX272!&PZyIh&YzaBiGnb|Ap zYv=Nj*piQDC1I!IH^m;(rJr>*i{N5`#aiFZtqTNfSSyhkB6?g*vWxXoKSI{x&R5CH zao92b4hpf33XR#@JByM^=!{2^Q4Qu=^8jObe=jvYiOPz_W@7NNG;^p!u}89uTe;%! z;%XE*?uQg@yLq+Y>&9lKR@84IZ$z?Xtg2`#ry9}Gx_WVUZwQ;a8WxGykhu#?Pt=R0{L zizPPCC5Me5Y}_RGg&oGtMT(QS_;xA%K&E_fO72S*?!lhCXL|-BBllnj$5?D`rdR&k*fKjh+8bV~T75On_MbN^&2OnbeJw+9 zJXkn-$1G2-h+ZyLQ+a%nQFU>eD@}bT`De`A-DQ?3CNTip4z5u>F~3bIXEZ-OeN{zW z%*GWu>-#W-ZoXGO`@UbK!Cp;~D@Z$&BbjDzG4^TjskWuFbDwU#n}e$?R+)&IIn0P2 z9V$wf-QwyyKB|c>R9C51z4__Jo7vldAA4;j;}Z8m`26!S!&IHw=O0;XT_bSBA}LaS z;`1kW-&B4u{6%u5w41)DBH1OYme4F{8QFi~lY^O=80nfSNWUtLt|yaZOY+6`+_pg% zGHreT+C+-ikn`+8VH#vu9~BD)D7VGA$F@hcr6q3pR}JTsXAg8~$74<3>b6a!O1Y@v zN}K5Ln1g!VvC{7L_F!Pb0p-ojpwzMfy}NG~EYo$Qcc^ehc7N(WQk~Ti`aQs+TIS|L zLTi)2XrcWU?d+YKbP=2BS^Nt;i9)Q2cDZENKgDZG#@o#ekObcS)6H`4%_Wchyb5-9 z_7EFP{yL3JYgjD_uDgEgoz8iPT<&<*swwD2iVVE4dd#AJ=0)2pEfw*lKAsm$G{0w1}3ZIA(^18ELQGdlr$S)~&zg5pBV* zn%xt1m>Rg%AgrLR_8=e6q7Y;9xbSkyeHDODY9x{mGjqm4!7fi95{= zV}n@DQA{sA!-vy^4UwuCk1(PE1176$?eVoh8K9LY>p$u8^QJV;n${9~9W^sw}a zh-{$P(Ph=-d@n@9E?O7x>?JUlaIqt6>R%2jfF)cF(e+lgww-B~F3xnNtenE+@iFM% zJ7N$k9rz3-EpIlXoA z^?6m#>gSUc|E1MswgiImKmRLQy8vK!2c^;Cq`P~G@nRc)<6{a!WMBK3t=PWSA!i>a z#UWyRJ7y@Q326`RL|F1>#&d-t6BeBSY|3aCoA$*KH&RL7Z7peH=7Sf5qZtYKvx7QK z&mF_B;lwW=BlxfTC0ezu{voJfLax0F7ufndHw7le|3o^rcNb2)nQBnudwEzBweA^P zH6?c?^vgoC>S9I!sqSrew2zuA+Q86<&3XQB%FE1?2|D*77F9bmi~hL*)fe_6>Sorj z#S<|h0WInwl!qZ9iPi$Ra+{s<2ctLJ87%uu57QFZUq_3P)8|R>%}tqHIGgj_;rF8T zO>5pZ$=}hz*$>p@+o!s1g7WRHhEgXVaYb7+uwL>#T0+{qyhwXfHshPERz=7Jfhl)5 z8M#jO`+k*lyd6&;pI0c^{$C0HAIkV1V&np&D#x?+3if!tixcio|6Evz-shITlcE-L zgMX3Tf?7stiTa=**Fr6JsNvC$N~|B>&Y)>mOq8gdqcyLzrj*?eMZN`dPR-c%se~TP zlb>@L1?gV$z98qDA4^)~N@Stob|HPp{mXvgm!Fb^(r zJS1A~_^4^)pzmrpZV}r*&XG}f+#i@wvmwhJz^X}oIZ`_H*B7OB?TfjLoqR92%lMyB z-EMaW5_09)9gmpA&-dTGJS2{6=kM|=eo3*6ZC5qX*H_g26l<&K^5RNp%+jc)##;grT7 z=Cq1yB{#z`TW@ytTQkqhgrkxZjl+Y6@5mAEMOimu!w-Cjl zF^10NcOQ7mI4`oSCNTtJY{I&7x^Cj>4@q(x%-x zD8I^A>RGCFjpSTIXHm656{_${cD0#EGM@iZA+kP0Sn=rZB}RJ`o&<}ggtdRU&Qiwr zTTnOF@w_X4NlizV>k_?FQ~Bxek}*X&ZVYTl6|&c3s5Tzw$j`BoXRbmnQK#J7TO?%SFDLV>l_=COs#Z3&~6bu$(%Ulc3){&GaVLs1h5k~iT zAyONh@3^j0g!)py)G_M!!adDTypuf2TmS48&jr|V`6}8(`XP=7G5z)JUSp#wW8vRC z-j4-N4td2m8z#AQ!xl^2v8|q#u6km-_R{#ch7zfX%JGZ*sArz6?ZQF@i|anxec8sF z9v_NaO97v06rrmudk>3U$gVaSeo7ImjlTyd*;!uyZM`wQx11GQJ{_70XYOQd8`tv@ zxZd;d7@1PIA6smBCWP&&K*wm_i+*EEYF9M*-0N3r4ZB8)qC!g1&dD^gZeLZ&{j=Dk zZqPNz#&z`HWIi(2O-vkKy+N-cZ=*x4C2P^->Pxjjcl~Ekzje7WT}!BEt(GnYy&H?j z$~_JnWGQ>=q@?-T4r`P1^=QIQqu~sZ8B9x2!aKH=?st3yT6NPeB?mm5`HQRZly5%K z8?hHFJ^%94Urdzl7;992=5CfpRr_B7Ee}{$p<{(T3e&TS5&^vXlbc8BtoU~YPK^Y1 z6)k12xro2XRzI|Nst&)kq+Yv0a4sxJS2@pZe~Slchdwqu;~S88&)VzGYHVYAfG zj9@(5e-@&$WWJ}U6`o0^H3`=ioW7)_+l(kORurKyill}qXjh9Vv`pEnSGoJfsAp1W zy|V)clrBa%_=BxW`;MxYm|b5=oOCy{ZuLp{9|NhW{*>EWD)w7&OxA3>-aI-%z+ES0 zc-2BYtvzpXZ&Ua1ot2T%<|yILpk}}F#T$7C8SY_+mKLt3$XeN~^ayGrTdjThxwSDQ|dGk%DP@$l`|VY8wn?Z^%2L zQl|HYC$KVs)Pp%v#Kc|+vzN60?Cu&n=X4%)QqvWEkn<;9zsfGq@bqEM^Fm?opNPxJ z;~mVz#8sN-umQlgFK5|7rE&i}yG6x{9M@P@I)EW^>w^T!b4NPu)-FEL)$mrc;75R{ zzX@``M3G0jxjFGI-K}%Y!5pt%FAeKVDpMTN@;&N}3o2&sD!z}XpY0z}qPlrL0$PMG z;N$Ft5%LE@2|R)w3`TtX9d(@?mse~o=H)_Fc^>E#3$^`vPFG8PvDo}8EFH2tMj0Ij zhlMMuT_f`;!rOmdT+ME&GgR_;l9X8HlPWDz(l4jF$gf5d%R<7m3$kX_g(Zv#K)BRU zPZ>2}4tPr!mn~SG5i!lMPpeBwDxQt#hnOU8qboK_K}%71LnCi!C0!4&c%y~tif)R{ z*|Fw=&c;Vg>}+B3)b^CP%RD)%(MPJWS?-*6o2E9u5;?KtZVHd=m#WNVjdl-tZR4x8 z=e@=bQtDh)i}ROP!Z}wFT4mb}4fLTgq-I}{sWU^K2sVYyP)EQ2(t1}}uW!f`oB@rj z^GSFl`nP8q=#L1+f6BEp8sj~%VNT?yr=t_5C2CuU;vLKeEDE0Qknyi8Or?A`w)Dg( znq7PDCv)~yQCxB-!=>=R4pS{W?kR3NWNPT0FWu}iu&OB0u| z&SC9|D&^+r?h0dcAxVYMgNAYYMwJy*>h#K4`wVN`>)&O| z$Z*Y{mN7K%AROd6fmc<>gP$OwPr9FF;wl#xf%})_kMWPG(T?@A@jhx;Q-krc&rq$Q zZO0_y-s;_^>d(<^jqanIq&e@_tXI8G$=Lt<355Hq0ld^NTZSnSJ zvxs!x&F)iB|Iet?-RRmvmY+xrm~z&P!M59K9$jhr9I17}+2|S>jl;9!ni@VEs58N2PyZIGj0IBs+q%9u+ZK=m!4ToywY;`L^${f7Ocb>gwr9<^C;C88%h3$dgS( z2Bja2k>WBgxcI`pe~Y|-uIuf+(PZGCs`8U^*;S8~p2%2pg&xV`M|AY|(c2Ehv5*L7 ztZ9OFof$2)(azMj*5%FDwsKpu2L<%7@EZYn-@A2dM2M7dsQjK?2swy0Uy-JS^gL4M^3aVOS=V2BjZ?UhsPR^b%~BG zZEPa^*%&|uJMcfFLY8w1MGp0@4{Y>^C4xKf5+=Py9DV- z&*Wr!(AzbOa>YJsjLP+2G{M{DA@PnA#4yYFPgDFSZXebEbE#EPbZ@4NVilUs74 zbDq@Ps{LFa;ZE(}5{_xRMj<`$s;rE{-}nCQ?Q5#aQ)6R{?hMV%d*Lq$j-z(|SrjI& zUE3bJdyt$fS7ucIaR2uY?f?N#Ci$=Z>+LBnoh^f+LML~HX8bm?G%Z0`xPTjr9sBt+ z-$W*A6!N;YCFD)4PAUUYr=aQ~c`^P-s2t>#AF+jTSj0|)AT_%8BeVc-t`N|swI7$3 zY{vXSp)1&nsI62n)f#GJ=vuweOCr^Z7V&(Y;%`4bH8nDa5Gg%8JhXMstG(oy5Yvu~ zCHUBX{PfT6SU%}Xyt#ZjI=Xr+hry#*O!tOO&+@BEgQWA?g1~W$((SVQ(cnqb9h)-D z>zX5|9v%Hs^RC1r>VUO8(zAC3R0FrqZ|!A~WI6)8TmyeEZ~c&)=#nH?hq`FI&GuqN zR}QT=E2DFJEPZ2TWmXjZKnEl}wP}Yx$N?@A-911UtGqpL>miiqj&1)EC1yNgP@gT& zfj#pK19BMjKcaGm?Avcgwsns#MyT6mJN3r?6q^>dlM0VaF^k#fd+o}~lQ~G#6lkKz zq3aetky76#j?LLEZm2JKQ}eF%9m*?jx_l?QF1#*lxSt*U$vD$-%5RN0Gyvm&uq&-F zyu3qYyMQ&N5@N_JY$r{wclP%FzWJ=EZ@+kU9$dA6?Qz^2rJI!DcY$=3!xBkngk}GM z&;A2z^Y~_^6_7QY$!>i+uB5_suTH4@oqaJyC$T0tSVDWdu+-gR{P3W7cg&)y|I0@K zn!{$p9XF73O_$(2cP`8dJ%wKoT(;6T^Q0b28iOe^mn4HJGC`o@N75Y!=U(zqBOdJY zxLf5hhTDbKU4bdWKk}m(RNWl!kMqge^IVKRyjS@lf>$nZf?bw((B6=@uJcHHQ%})D zwu8>Lc+xH&gI|7@^G3$)QM)qorm4Hh2j)9<&zMrZ%b-|wQimPEKMiQr z9~TBL<~5oVs0?+OYHSx*0CBlD#CCv}JiXcm?Aw&cZ@v8PA(X}dsMGMo<~+`uH*YK~ zx*UZsy5tnDDe%~JVOaSOiiNN>xyhem9Y}}fj>tB>HTr^5?`&n((OWTY657Roeuveb zi0+}T-Ite_*S9FFMK_-xv53KGG*SXO2@gR`R@TpTaj%${<+V|fUsDb~-9H=LOW3w& zUOC&pz8Ok*CNN9EpKAljUeKIZBv}4&#r8qAWaQo86q=FY;nt0PF^cR4w#zG}oV)kN zWH_8(=RFfGjFPg8#v4$vr2W23W&PVVVNN0Xis+Cr=}=QxT-&SUbs{DM+WDov;9`&J z1QwIIWQU?%+e(+Wq4oKGRfGX&@&vDh+|W|-a@oZ>At26_ycw=8&3K=pfJjXsEK-89 zs0xIIHpVxaols-F`_~4k)f!tB<^37x$~{tV-2O&Y#W#qrS{T5m`Ni?#S!?-%2=z7y zk-vWZs&)^b1&+T1U#U~!e5sjL%y}s^z^L{DDgu!P>1TVQoHvqDL~p?34t{aQX7QlF zXIz*Fh03Q~@Y-(K{0D9DUBUlJa!KzE#-qD+ocmc*R#kio`4%a`uaZP0+NwEBQ%m@c+8`57xP_{eUt#RHdCP3!E_Y8kj{Bd>trw5 zDC+`>y9qgIsocSUsxOrLjK|HGNtj4SN5qb~j1C!a)K=tBE$BI;ct0bDqu3mOoOjA` z9PE5%qx~nLD?4lUs+UhNO5^ybWb@ROzDrZmkB`=SL-$md`mSvF&(IEAwF;qH5@u!M z9rB(82IGx*SHaA@uVCHUf(Oxm~{ zJ!A|-e~KR~-_;(!7WKR_GvX-7VSnwhwV$7O%p%rn#-N;)4NZLHKXbc;8K{V}`BZk9$4~>5ip5uE)f2x0++@JGS z1on_Cb%6p8<+=(nkRybG0E#I$Zgj7Q0xmki&IvuAY@ZAa4Al5wR?&V9bQ!SA~$-=%eJ+@qzfFmA@9c= z5l!#HG?!?~c?z~aG9Sv`Tjn<3N2>oA^wn-lNv^%cyRoJ`wLb%y%|HxO6b^r({K?Bw zdEwuhy>n4CV#8+7g6l^Ysd{wXI>8t7j75Lr$8|5ZX6-2~D#JSHT4|3jZrsT-OMURl zQ?=%IcGN`e`CP#pGkWv1gmM1Rq#Og4>p5c+dI%sM`%yx5|^ z`uhtK$TFR>A+mh_3Su5&{2pQ2KMg3&e`F_0{Q|NSKs04z)5obY&P!cRP^ zcF)_&Ibz9c@KHK-2?=CId3w&}iLA<)+HXhkb2@*4Ds(n)3ZI%N3JVG@RHBOIu9+4R z%aw1d+mYdlcs^8qi|L`9tjB73xF+)7PfVbm(=9CiOEW`-dk{xFBJ0M*`eQpm%p@Q)=$S-Xwwj%#le2Wx4(BWMU)2h)WVD^$Y>T_|YQQbXQKS3h7vax+bS zWewjTK%ZDk&v(=gA6=o)bS-XVtejkadN*|;px@`E0-(>S+ZMMjnuu-b?Yb%(2>J)U z&6!M`c2_&!94?J*}je04$$ybLg~|ipihqsdCCl0$T$C08_A2$YbLM2SfR(9K zz9jKHsdudL3y0bCp;};@YopxgjINGQjZHw151OD^V_x zGA!VsS@?V6s)#eXYR^2b;O0-57rq&tm3s-{o(csXp5{0o!nu(R=Am~}MjL7=&i!&o z-@ZmY^)%o@f3)pv1Wq8Uz&1+-6>)BGW!Y!Y2B9aP%6-JOkbyqiE=MeKJIV!e0GpYj z5h6ldKSpJ>1TRromE_s=*{Up%6&Z{1t6{&6Qn3M(nPV(=mi+tVrhf)HuL2CUUpK;Ewn(<3<+U+zezH1$YRJa{hnyX{9f>D1G+cZ}fW_|i6 zL~WTH&nAm|y-=lv)KqEN(LnQu^&suz?RB-*h)H1wC-uuIJ$W3JWl>Tr+WnqV90WRA z&`Df>T-jNo9-5dh~k*ttNCO!ndLGJq9~t7J}cnWZ4We{{$4b@r?(Xuiw!q2ZRnJ7TPKj1 za7c~tp$RC;eLnsHUc$gK#1B8Ye1H5c0}hO+f{8j$;2lbWTOY6rxqsA^mu+$mM6W#; zfP8*xR!6dK&f>_rxKp^XnTB_58tD&va#@9T$!=eEl%KJ-kr5z$Z{*S+&?5Tgg~vcdtK!W7RZWO)s+5 z*7`(9K%2QoehWQvGutN~r72h56$x#~A4Pa@>H`-RW)_f1*DO=sMsJ#M&ggl+*I40I z=>g2K0!@znZ>szc$9bBO-@kVcqfc!5+ArEDAL{T4{pCK5?ZV(J;hYTbHr?eVA|$p`D*lj{8w>0?he|`%*#7Kj%@<=9_c@6h2ad}M zXukiLxOOFWNM$yTpZ~zyhmF`p-pWTA=Y|4T@xNVyFt39oo;S5I)MIx{o(1WnSwy^r zRA3Y1*5&rfi_V}`>B;=i;#I^lkG%%-Dp~ttcW`k+j{v7}zjenTm9A)$I9Ex;vI#TC zuE{!u>THMWcWp=2O)}e@H2Mc=W{fg<>;Btp&qoTuNUY z$yn1xS8@_1Cv1$R0Gb#jnFs59QmLx~uv3T%Py%VJQWmXMOTP7`JxwnjpF5F2yrVwc1{bpPSn?BEG^zZL@|s4$Sx2` z=3vrXjUn_10nQ!}vi@%fOTf7JU+ks-{G(27FS6Oi&d#oKB2mkR35BX{@uqTOz;y@w z)JRWvPmjppz#J6C{5#sw5!Mj~S1kh}ur5AZ4AQsu1gNnHbnjYDGFNR~9hF>7kW_6Q zJsS!&h+emB@kLMGgViAIAxsX)8(EI?xHT;f`OVrSxX~{^v;PZ8YVe;{6tukk51xwU`8>+pknXu zxzz(3)7re>Mm+v2q>1d8yPuko`Xe}xs2dR4NRoB$uLB&Y#*~qAZ3)QUVd# zK-4xtF%OZk%xhz*L_h=x{j3qz)L^NKOyu~PY`{%>SHAb9$~a*Sk=dLJGe-`#oP#E- z_tZ;p9?)PP*`JVeQk@!o%oVWdz>}%qmE(@P@XQs^ubZ(!u0WYuf|1Am0iu}%Ab~7S ze&pC9iSmn%lNS)e0DRiyFeKKg1ET9sj!QiIs-^Fojs$MkT%16;>E-5>B%spGWB@Z0 zIadlpl6)U}@%hP7a@=oF4QYKwfE@%bv3qgW@}(=U5*H3B6$o}9`3@OzK9Jgn`sUjyRc z-fmKOkNe9IG?S3h>8aMiaQ#_9$L1|K^L`NnL7pC@5Xdi5pB^QEONM@&;PgBcLn|#H z2?d1u$8*|Sl0k5#Ec^(MqoQZ*?b2DUcaa32Q1a=OLh=}r!pBh5>;y`^-4muG$XkC1 zkgA!{f7=3=k{aPDT*1!#mPF2%lz|?(?nnIiRv0`*QD_?Z5;RHSTcS1G{Fr*DYHsA4 z0IjRs4oGVe!dyz2)D`J^5Wf;4IJJ#fxCs@5AIaleo2Q*2bo#86aJc3omB|)(|E;(3 zGjPg(9x2mE_8Gx6*EW5-L*?=a(Vn?Rh}^~+Pb08}J8kk&y#M*N+E;!n`w0BY*tR(1 zZ*O=t-L0Nhe*$DgNaldE4V!~1lm3YAX?keC>LU=fyr5s1fAC@9_`z$n4t+%H=;FUd zTLTtN^d82|y(My`-5*E;6e9T(|41U|LBjb$CoG7-Qpdo!@sJ`z`}!?s2#Z=i<>P20 zd@Z5O(@xR^gXt|mUJTf8RRTd?e7`VxvRj$seo@B0>1b|HWC4zLohlV_uN3I+-gv~? zzT~POaOUEaJSOmgw$4nSTBQmXn3*Fqv6Jq78^`HUEkp@+hUGkRwF)a7zJxqFNi2)V zL;+XlI{C-YK;#hj4j7g(0+C1REGeg{hiRN1E78a^^Plr~ ziPJtK*tubeq^YCjsn9#pI|yZugN3730r#QVRpiDhf^ZQoVuwkbSwwFh6TG^EaRU2v z8b9?x`J_dXnHe+vqJAW# zt{7h<*DKPRMx;=mpFt5pM&sA?bjyWzp`oF2d4J?MZV=ao*JiZQLoe0g7fDY4pA1}P zc@`!P-vXQ!?d7KgT74x~-_iq-7OFNv3KWt}kOj^8xNVaTDE~X&K-lf^Kg(Nrf;vKrpJNt2vr!T z_unOtxtPS?9cX;~M=eQ=sIls<7eUQQ(^lIpuWbBpDEVG! zX-PB4{@UqQ_1Ne`9a8;;tb~jHTG`-=C1rtW1sN{)7k@PcHT*Q~9UUEgeSJYa=k^p` z(aVcr+{_UFa%covi~J5C-C*XdD3LbXY9kp6oU!S6< zkBj^R>7x3VR7iM99wEncNiS3i^SA_Nz*ha0n#bai!hfss4}&a7LOzJl@J&O@d)uFEKXM3@-VWqP=9fwA-QkpCPWQjB;eY<7DA z->o7PW-H0W#{@Fc6CgmDbeySD3`4*G^VpvR&vtowI+ITxE(2NP&w2h-4Hp%y26(PC z;2@zpdBhDb7>*!t{i&ZJK`{}A+}+WJgYW*o1y?^Wze)dk(3y=r?XyqviPZnG1TEBH z$a*KyLW0Y9RwNc!U%w7Zf&g2b1@Uts5%gCo;%A_OS@rn&dqH{YTBc1(u^NG1u_3yI z0iR*av6@_{tEu_G(Lz-OTq36$Bp z5X?jM{oPQl*V}0X^9&*KSi~cn@Sfh*5r!7n2`HUfUG}3zCX5N_$9zx3n|}`0cmh@{ zQq+R{j<=?85QQ3m>4ZAaFu24Be$!2IP$5RX<(`1nkRnKBsG+m`CxbQd+kfX z`eC_5%In|1<0l`ja7ugw!h8TJ3@W}4JSIr>#5}%xq2}o5Xd}U>p$3RA2L6Y0(7Il)rG8k!S+~n@ z_|1hX`}@rGw~Z8(9yYdhX6#S3${}+<6E|^D3m6u7&JEVmrk$OgXV0E-cbkIq;Cu7p z#S88g0jS}Gl=t|jG>)BAZ#chi$$dYwxRdCbO(%f9Gm|8Wx>%2sN30CHzkN7o42`yCqC5Zmu z3A?r10u|9{8xL-rQ^dW)O~_3-iO%*C zbe}b~v3+C_T1z3|XLLGYTk6O2B!m^ zxj>$CM#v%l`~UVD_?2-nd-#rhZ3Fw=AQ9I*v-G>el4urjdmlQfV1&K&o_Y6M1E2!5xM%@ij^Uh6>V{US+Rh8YeoPxN9){c{^iJmT!O zH$_xQ?3+C4QW);y9SLeR-{rW*Er_Fx$#Ku(FcBX2%N?;eRYx zAG7i67rP~On2h5ev*A@@!4n}~-hr-W;wuHPazyS)P}CBkWqR)m!uT#H%j`kgfkGV> z>0{Kxl8JxaxMU4Lkt;-xS~fiqC5-L=Ucpc3e!a!zsAMDsNO_t1nyvvS+SfX^EfPn;P7{B z`QgIzw(-V4MJJxFOYtXm;wAq;1I<7P-q^^9$nj1j#0}s`dchrKDlVrG)QJ0i^}K&S zf8@GpadSxK@D}{qE}WcQke#T${t@|ch49~3zx|hH4?bJl4^REba=d-?{_f$A-lAzl zmYcz0>f?XOaRiELR*{merXP-P%f zcsY$A2E_Fd%D$d1Y`Rs~)C}&g|KpWcZcbV;I9blNK z-X>pkokWDd&41qEpfBmHIok4f+Zd4eyS19H5n11k;E$`ZfmgV4MCqb&VFxi~ox@;6au{H<>89<%5hML?wS zbmAwvGeJ{oVs#XM(a{aQz@XiqYu;}Ue}{c3nz^4rLS$`a)ma_~KDAftOfF7e_?PEg ze@$OcOiXa&+(YbuyHo+!oFMTy*eQiTg_ws!0mGf*iP=D;(ap3CC^vlp%YJxxm(J3+ z|M${Y|Ms-%KMj<>1E`EtaPx1ZQ(PyH5D#hF9X~ugL|C8ULGDE@2#O&mbBm6bAExEg zc~jsERAY*8R=*DsAG|I`e;TCbpg0ixe4#Gjg_6X*!C<>3;}+0j8`aqT?*f+1UrK0( z?}H5T<9Q;W$xeGF4IeVXYot#dhAgH+f6sFATl4W~0a90@0hx_nDLscsOzVl3sm(sL z+6UCj7k3b~^4Sj7M$86`_9@tu*r>{&y(6RwL6!^P(bA7enaCp?fTwQa(6@Od#Q;hy z{tVXHTX^gaeKU)Q-?^F(T2Q6efaJJS1k7(>7Y3cJCmy-g`c&d4?ZHpd-vhy&{{(hb zxySp*4wOZr!)7`}#l?r;t9R1P7F1PxLZI}mX+zLmS4U^?0VFYr-dI0msLZQV@MnaF zh=>6XEs55~BX}cVsTn5Jm>Vw%4xv*F!h4zzp8q%of%>rXT!*ES9)G(S#FAo*?;u+; zGxxY{a&cao0=muD_Xsk7w^!z%&nJ3s);Q&wH1LUvuEg7VX^9CeZ$*kSLAO17=(AGx zEP!)J5%*v)%jM(Y;akkyVN;(u#)+uo@q<*HF@WA$w>!CFVL+ zolIc=ykOu3M~|($yAGR?kz%(InaDpDDc_-trcoi~^Qh=Qrb+w16P|B1_hT;6Tt_jR1VT~H9rq6JB75x z$UU8$01@;}wc&viEDB+Pdi3M`-{_=68>R15KZ9mik6k{>`yXXtb5DD*xRto|oj^qz z!Y{}>!8rsmWW$^1lxx3m=wtyq`E<#Siz15G4AfRQ$wTHOn0LtvHso%0KzsN#sXD^b*?%b{|nUgEhP>I^N(Owu;9q3qK zG*)`j(O@XZrvG`OYC-UaeqMM}9hU7%7}+GCTQ`>!b}wPF9~MdacB#+ztiQHtf`ocN#yVmB8ThYs(MhzeA!!+zk zYZbbx9&xK)l`~nWQ=+SqGEr}ElQniQHHv!Xi}ksz?4mLG-C4QzJAYepsw%mahP^XA z_jkwq#KFS4yh$f9y7rLYprJ)ZCWp{EVWxJ;A!M=_c8K;x~v=OB1J8H`gZvbqWnrniP=9c$vxaAC{=L1b(mjvd`y%YE;) z9@TP&qMPF_?#i2tBFehcd&e}6yi4NF%08Fp2wZ>m%+8xC5e^-4LA|?%yU^}@Ve2&B zG|gw52cJi~IlS^L$!vAjij=IS?jp zyzd9k+E_GnuDoz(`QcE#Aow-^cH6~h?%If(@sa8MU0B)`!tL42&ip7t-N7GtuMMLp zd8Q^9G==sX>+1BnI%|JUXk#i~8kzJRAO9c4ePviw(fjR~7zj$Egs5~&H&P-gE#2J> zLra$!bW1nVF{CgcozmR{3^jD#J^t?hfA6>ZJom%Be&JDvIp^%X&%58f-u13^J$3fv zH=O=JQJ~l;p9vOoaDDi^BiYu4GKU8-qw}q92e_s6?+MD z%4+dOak)yF)q2!R-c)B;EIv2VJvly_VUBe(Rj#~Np7jE^CZp|D?`*kjd|KLo%eS%4 zx&k*+-QI8REGjeg8BAQi+7zcKlPcGqXICA?cJQ=YM9 zF$$8hHmcw`X6BHRNz5?wLBjsMH)&)d0z;c{>roVr#`GYTc};eP0^+9une(E8Uz02q z{>FOM4qEf+I2ve3KLQWeEW~Y7Zm&ZGG9Iw<>VLz1ebFbZNRWt~FN?`=5y$R$+MO!OIJ}>M|}PSzxl;Pq5X9X3p&GIpy>u^Ad0Ki7oDdU zYtz}8m`G$w{XOaQc?&X_2Vm?LJRh3+2-Stye0{V{p5IbWG_Cva$D;_zdsvOYYZDjC z3<8e$OE*_H9*CP^skSGD{0II*7Xvqz@gCy@P5U>*2Nsv|H>amJmm2YWEDBrJihiWG z7oN@HvU&gK3Xp;*WxX58dt-mVt(bL5l%U}x~icKn-$yN6@MkMFRx!uV*NZ+M)z---ns?B9cRLyxSMtRnRcCncyRk_Ph6W_ z`hs7n`^a&mG4Q>a-As=Kq`NW0dm2*fofm2qBhU@$UWYx|#b+tPp)s`M3yPS9&g z$2R@g!t8uMDx9$@ow~o%m+Yt=VQx*zFkTtS+E{ozc%hZtZMf|B(?yoZG@gtl5B4zY z_NtXe0Mh)m)AMQ;*F&^mp!%Az*y{N8LZM&+XS@7WFGf|@3?aYXzZ!@lfCOk1{d|?* z;O9x1(d~8j4h(qgZCpB3yNvIrq^1(^6%`lf1EOQKXwHC_(fRdg)uDO`Ejc#aC=G5Z zBmlkAZ5&=?3HQoDoDT*i$$-*JI?$+#UDcJ)2GVnvwl`h#!1t;(&Zq zk1d{zkYv1&<|9;cnB5gUV(?NN-XdaxU($$dB0|JIux*dWbYr+T1(wg+ zqt-E_MSd};S$v(18ZGCK&$(TEsID5`PWmEEi*cOs+n6kp6{eBgYz`l-;C82D%68KO z4U3Zmh+h#HLGJ5Ylg#~N(@c|cZKELl4|+bG@*7Xe97u8oym^VnXJe>Br&gg^G0G3m zUa!x#XTE(=Ouo>wmK>T;<-(g4n~W*Ne8kJ!?8@DPaaJ#Kgx%&J`hli6shYJ%L1IS< zx~fs{0hiemaBskFlp6wGFpCkK`6JEF&WYn&2E-lz2V zh*x@F0k<6~1gVX0uo`x3ub<9a< zs`7=4>c;ew!3-yasCYzo+|aQtJ% zH<)qu!A`TU)>SHEdQXYturOqLFFQE4O$y?L83c{In`9SKr9RJL$tp9O@`Wd#(aUttZx*u$ZuL$&=JH zu^!cO8bQFK$q~qxecJaCwa+VAubq+IuCPgPQbA|$I7(4%_y}xWJBv|bG?_G)FJH1~ zg=vvSxrnw}#ur6g82z-%Uos7Prf}-LxO(600cip+(Nd%HIV5NKW7-C<&jVYmTug&k z!j-@qTz{^7B50#vne|o*ImO-VM`&C0zV7wwZCj!1 zB;CUawD=Yu#VODN=w(d1DfD*|R6iShFZfdst!ZVxoJ)pDPR)K?p?hu8%VP0v6QQ7C zuq}^h0;jYCAXXRT|FGrLX^~1IhP}6J6xgk$3)_0bjC5u2 zzA!bjY@XeD(klHhp20x&r7K!O#oH8Nj%rKAj2^u|{prDsKGbUxv>p%~? zxuNPzZd)=f96gi=mcA`w8=jOPR+rb-Zt$lFI&*g|9iLK&MfO7qaw{+`LVrl}`j|rg z3eA~0IytR4MLZt~(6b!&U=NLp>34a3*7}mmf(m$oWchb?c4)ZPgyjb3!9^uIvqt8{ zCyRmARldbg02w~BI79b$`$SWsZ-e@~gwp2+L((mg#EmZXA0D}7vSTzKGOZZL?8rwQ zxZXjINiA)SmhLOhFd?negx@BbLPZAe7bu`;XUh^lz>Zl2AP`ZosAx{mf`E0Y-(qbP z{hEGoHMS4%z|a7irhz+{N9(@brk?v=&Og_1HEHgkkBD`Ef@3!biNBk+HLNANA{Hu` z5xf|X8MF27YP^YjgLis`?PEZA&*QHqef6~Uuq}nqLlYho}BRqGE0}U6%~(7U$EWQk5_&<1>`hm=jVYP zv7JGGxtJnr(taB)cw(MoR4F{)p4G{9*un{3KJ)|+oNoBUi_jU$W))^Dkp zb)EQ=Ei?z3h#OJYGm*zJu9s*ql2aG;Tuno0IBoUlm1{UXLOq)?zt#-9dRncq`VNHU z<(!6Zc;q6+T|>HGDQCJ@DZx$qPMk5_rp=eKk$p^usKz$<{Dq_U*ZEu9ustPT;d`@u z;#jo!pAvcZ@A27R?<8pJkAC4Jbi50fKP6Sg4*?lxIN_EtqPo9}cAunNw0?p|r+^Bi zff`{{L*JNf4&Mkm!Ig~5ogD}I4Zf5MHHj%q69GkyMV*HGgC6N_T`Pe69lPWF1!R^Z zsWuTX`leVu6p4YU{EMS0EJ%y5o8_%~j^O}3F0KbP^i4=Es?*D;SJ};n>$=#z2SIQ& z`pI5ra{BUyYKG1T;ztK_-6Y}0-+YSUzj%Mai*JO=bZ`vNrlZjifEMLUPs|sSi&JUT}hH!l@q*vF=7sg z%|nNDJBWK3@M-3#HQZe#alb%YE#U0aOEJFiD`1b}S|{#^)rQ2^Jsq>;gFx;q72n(F zL-SYMGk!+D1LTYAp?~1|e(a*l4a0US={0A&yYLaMEEQ(~P|xZHR&0x*7#~%N9p}>X zg?TJcT#x%3vQR?SH`sS9K{Hu{aEJf z<4csb8E2<@ph))j=c=LN`&tjF#A?TIf@eXR1|4?D%hECq+&((5$o3EHrZr~Q{VW#W z`uZ(T!Q z&B)F$_PnW2;$+;W| z8u;&JcYXrcZ`fNUi{K%^)CnUFbl-s@0mkOpqP%y9QWv^3fv!PJYs+!Z!fPN~51+_0 z0$uknA|aqOU~0~6zbPv>JwL!F*DrluFAms65ulWL_rC~aFtL2MA*Ex$g{y^ts@*#h zQqnW5$qewT@|@U2%tdSmzJFakx8_o~$gfcA%)leQ8?d_PY%f=Zyf5mwes8dLW2N>l zSubSI{w;WxF-PG?RS@`eL7U-*dCdQX}k z6WDcw5R-)SGCyRaAH{-#{Slguhzm$gz7}@(_du`MF1pD8K))7~e3wJ$rmd0BXaNgY zWG4cFsJgvw;928c;I`$}t(31xWMj*pFI*g|MvGaacBQO`sK#?$K0ZtH&mItARP=kl zF4V!hnVBI`FXTIP3x-V;y47iGpQ0xomil1W2b9lLj%}|;q(QUXPNvVbCy^XlZo`R_ z1ylYD?$b=^Ze>RNPhQ$KJ%emcNKCJHS&d;6)S|6BcOYNS>D zH`)@1g`Y=GI67xDIrWp4)?uk);*EAEP>ztNZ7kLqIZrb!KeMFT`Py~;wKH;`i&sfQ zwLwLQopKnz2M<>hsVZSf2CZCAB`o=ww^L;H%{4zTC!mJ1FAs|QmMq4Fjd5K5okU?A zGJ806bIs!`?87}9D=W8x2$L=C#n*Hr`u%gmZn%|jSSXA?Y|1*0xlkrfXU2m-jSsUX znrsjFov4jgZ&B^vOagSK?N$U9K(?0AHsgZzCl0Zd8JO81eF1#FCrnp>!xc}}ydQV7 z!M}j+au{UikrTihA;)2R2`{sWdiXfk%4ApG`$I!0NB`pK=>#JXH?;{(mP|}b!){xb zR*>e@1g%qVHP%MiqJ6i0U%q=lVnWIwnfTrt1+4V}Z0g9YGs8{(L&BC3ijN0o-GMd?v zCAsRQM;B**sZ39XEC(+rY^*Hn501u{c!dxf_%Q7F2v9whe2k?CPzHBUSY83nH;|m+ z-K(SUCgxMH&`it{*{NTKA+Ql&Q|&xt?A(6E+u~5mE?x5J8mwI^Z+qJ21hR+WsTEzw zgjGn}-!oABFk0K#=r!7-yYKe<@%SK5j=@|vKPT0YR1Mr~IG1+%X-_>5V~iX=fB`I` z-B$UEexgDrKfl!>7Vy$P^(HHf+1HzwR~@}lSV4vn4=CHiX6kBT<@jIB#dhmuWW1n* zoy`DEC@d*cADgJ3r{3_L#gLf;RM1+zUyl2`S3qhb+{61;dPQR_3q+=Waq*{6F`7h2 zbjzvI^)wT0lH^6X5Pw6rA|ebP{7VvS&+g7be$wzh}!7Fl#`{V@Ip z!W(F$tkPQV&v3I=LQ?V{7m=-Xr(^~jnlBv zbJSP587!?8|2okUvEO#Tk(&$e*14rh8>N_saHw6Eu98w_H9JC-{6MWjBf+4Xx&K$~ zp)yQx@|=58t^V)+W`oXv&$SQr2`>&tf~!2ip-$4UmsDC%S%gVUb3nWaa(5}n7o%=Pg(K(5cxF#faz zsXECW@&Wi^u#=>Gtv2cJJ@8^D%D4hT`7PZyx7+@Jc}(V z>FeKn zA=S>&?*!}Gcpa2s(@XioNU&xNxQ2oNyRdULY*XV0%el8jl=)i~_6_SUf>F6@YH7kz zn{~Vx8$&6!-Gfl+njToA(^_`tuPK2I!EZn6?5mNf9|ussZM4Z+HWtv&R}4tTyMW{f zHV^@z*c$_gr)U~H9pJ=!>L1$ymBW~jhdU&n|RXg<5r z=w^lJlD|Gv#!i0$EGYJaS`!k8E;$y|)zv-8)+A$q`#f0|fv$G=7nqrt1ZnmI z3L#*?Lzr^@G#zGuhGVZaZ0%d@n!(W{Yim^IpY5lnr|BCvb{7^FelxorzWH7j_~jPq zL(BD)Ly<8Md9GJF0LdmNI(+v^29kcui4N^bS$Y$&OMsd3 z5d#cditVd@Ksx+EUPLQk33X>;WOQy?VpilzwFKM2eegvBgSqWXUc%Yx5U-X8nYU!n z9LZt+&pOvy_qp$Z5C!h0zD|N+8IR(GP(C^Joxo$cGiOJnsnn0J7oba51B@UG$$9Tn zLE$%tlm6H^EzyAKOn~D-Bh$%lL>|oYfbGQd*GjfUajBa4$#S zDmfY*IL^k#2#7s_a|+;{`Rem>b3aI9#5s>|U8QKj18yT0uEYz(&Ckd5SYO~{h4^I? zi#B>mI%55bUl^&j#5NNGHM!`f9q4Lw+Rf7-Lcq+G1-0RpJ%phQqES-w(vIk(s40^9 z&Ptl-P(nojuQ#;uU6l|oRaJU+HYFpPC*3GcuLs4R;>pE#{H}1AN=ePgJ0(40WW#mB zE?-!euvU~ELa?4~DO)KB!kR|ePoqQL!ONvEG{FPFW=Wh^!>{jo5}u(T+{*58jCuye722#ZR38{?J6prY!)pp zoim$bQws}4zZG^?JivyE&_ZBKBVNlAJxMnJghgop5^3EJ3FYPC3C(Yd7Z@$$O_jz9 z7GZu>T>JydTAIsv01q{q7%~D7*g(Pq8C()Ut?OuOKV@=GQ_D-~_s zB5#S`FidLu5-o^_Xp;w?CK+IHq20*BQQlhj0TVDp=;{JD_jW000}jaP+V?OpFX%t3 zg2UlwXYQ^)s;W359RwP~kboo#wg}|69DJ4kB$Pmw8%scA2DprENlEqa3JA!;vU#<1 z){92KDMgJT+Z~u`279jy0O|_=SmoR2+2VX~^_45bIT=P8Oltn=i8>C1ys9ROxg^!R zZ}zo!1WN6*bNk?0B213Z07GPB^&aEAl*U zsGMHk|McWaqn_WF)dW3?f8R~sgoR9rVnYmFC)Q2`fbWjv*d0j6Hag-TruAfbGyVEw z`vt&H*@m-ZxDx#z`lt{*prP7jfE&hjcoDr;G^Cer$?jV);sr-4AeOpE)I zW$%!rU*+XXv64S#G+W&1lo}rJ@bWr@!&kJ4n2M6l+(%`WVhO4|6e}MTo7R7y43Z?D z&bXem$EnG#{oa2L7br?uNL6=W>w8n5oqLDK5dCu91))58&btCmAw7_bsMH{aa7Vp8wr{Qy(`QY(-X%>M}*89(A;f8FFnFMFOW-;WpnoErQ4np#?+!v{lkt32yfQo2y|H8e0*eiP0YrHYVl4(9fnc^S5m( zHrl0DRd{wrcWGo)A8S%!XyjG|E9~?L8d`YciJK4d>ZLIoSpxreR$6qTi1Qi}85#A_;K;tFgQN11iq9rjQFnN^?u*p!x)TJKqy#);~3LiDd_)Nd_mWWNtw*W00*C2t{O1KC8u>fYX4a zJPtx6y69g>1GpyOL2!9*fj%I#0p>NBP6TjA_cA?KK5K0DE<2rXb(X)^4QwgamXi~U z{-u%pAdTGFDe$kL1~7M?pgI;jvpic85e9ckjkfvX?!~0rRAda;%I^2rfw)|mDG}2k z7578R#Hbps2zqV{R43k=!sH6#QrsE1uP`FVKB7LHSlf&2Cri6V16S{k0ju6{?b@<@ z5VDZ#r=xipt?_pw*l%ioBa$&@2u#VAR|-51PMxwW6`_#A=FLRW4JSDyB3T++?_U$7 z3TQJ?J#T&mx`uvY_roJVwrpn(H#uJ#^~)E=i2&N0)PQzMV&it z!qW4BE!&j#eK(-`#rs6`vaJ?$W`NIrbVY9xVwW|i@0cLl9R~;Hgwabr;w)ZZwpG>C z+9*=v6A~tYnRrSNwFycId>BAP^`J3N?-b~Kims*i(p-N6&M|Dg0<4GOS-zp%z_6^5 z)*D#bioHJtX9hz1Y`8OM_5#-$B?ZsiR#R4H4@Bss?aA7HC=wAwfdfg6w;A0zi2ox&wL3#?lfkhTTB}8faD|n~6&qilKJ`L-E1fTl6 z6bJkSok75yMO&eK_{Yf}2>|&U1)2)2u8uZI0k3e(g%1r&AMNSq%%Mde@sE6@Om}9c zryr+CbP=L-Xgst5KK=^b0t~RWnSTx}WSQuEsiu+1$=lQ^&8A5X^@4S`VubFBMmfvW z2at`u318eaS_7FjMx@zyCXd^o+YUS-;6`x0QPAF%|IYb^t)2EN_a2zwm|?Ip0rK!S zo%<7!>{hDlKJ`zY27olNmY_E-N&-Rxudta=mhckL%OAeMPe@8a`&0?|mW?c`L6MsiOn0`?S$9kP6#(2C4)+|Dt*u>lBmi{zk$~?IH$Ojvz%ihv*9zl92JJwiP>&u5kh^x)?9^ui3idF-*%Fx7 z{Y`!xCc|OxmPx)uMa?S8+`%us=O|xgRN?%Yp)rW5!~!sMMhMo4xmx|@?h(|`P|c#> zj}ac~(PX-qiHi7PhXJQjC;~y?+?+XO4P#49*)5BdR#+c&>X)wD6A>@13s?kG_N{{# zJ096pJF{ftbhC60Aw&=IPju*wjlJwo)Bq{;52|Xp%qozKw@d7lJCfd{AXsiWz ziG|F!OFL?gLuKy8nxrSwg`uKCe_GcPM61AeXf*gaI$pdUD=B9?+Kj&^ z*%idu02yiovkEKKJ#h`CBc(Z$TTz?Y>of9fd#2N@RPlo#U~?XqcBTY!79+C>9tg2(y)SrYfn`oblH8mfb0qO(Na0 z(oQ@@+0a%yRb-AT6>4i`gACEu3c(xCMXhbK!k-eb$k~ue=wjIk6S?5m`Q@%3OJJ5e zkO`Qw!vH#*S7!tJ$kYd0w(9@G~)G&qT zBz107+QmD%;9OL@z>_TT)oZ%9Z(qGlvhg-j{Vms#(Ng4dd2tstf7n`Sc0t3^yZfpc z9MU3&$F`0f>WZe9rmn`3CJG64^6Xz4%k4eKqPmSMQZiavO%pj-P zZ#6a_U=M!orTR)$K)C{H!`q>HreTI*S9h^JtIIOu@NG+WR+&VsZuQT3Bh+kbZGcjen6PH7s@lP2&S2-x`SNOfqqFSgz z3bo_49v=q{bEf9Y8z~oexy1Y^I*5@KvSG-01=LYv@3O_0vJ~qKLCYx$ZIVKb>fDAt zk-+{4gV$lm>rOGXtL#75sPrrMD!86QXHElbL&)P3X5&YqYU)RKi8zQ3#f(u$xInS< z;{0e!jXdVX%x_T1NwPGM^t6ltd!`pqDspR4@+|!W81oB;1>{2&rUN-7&cNJLPqRpV z1P?T_+X6wH>VwU{g;dMtlWiwqKs=Sp-ve(1^Df57;yW@r(Eof4^i}jQZ0DOu8>V;u z7OKgH4_NF8{E5<2^jqMX_Z*SA(9yy%e%Cikxi+^;<_M+AYPF6}}z>N!l=i`3* zBl31QmowOct$+wS_tT7)N?T?JkPA$ZX9)Y=p?D+%!be{i`2Rg7a6P}L_XxOve=GzO zd@soZ1w9}o)1q{U?Q&lyL5KvKDup)lS7atZ=ip|0aMLMw%(RJso}0Qlg+&ahI|1Z^89upGgJgT_K})VYaNOB@sjv_{A^7N0 zOmL|^^9P1UPoXhqlCgcA)*2I7zv?4p8pWJkrwlHUx04ROT79ILyiv0yx%2hZiBF$b$;lw29W<^Ll@JXb;upV+; zxAX54x#;TFh*YeYbEq`z`)yHW@jUWRB@HiToph*R=6cTTX*Y9RPiv;@L2YYx9(V2Y z&fCZDzY~OuR}(9}-X^JM-2E7Si)-~lk{4?#TGN1qr^5>~kP*5aoLS4tj#M`kwB%18WfBN@9pclmvCe)r~d+}7umhu$#LTi_QRxsr(l zito%PVpJ}X*C7sw%nl-o$uU(-hU%7S!%}=RkCE6fw@gn4lw-FWQu>V|CZd$@?-q6^ zx&&2SneDnD*K~&%=nVN&X8GtCHJIXL|E4_hvbbjX9mjn+b++Iyo4-z7vZ61-OCo;SAY90n*=hg&K4-yIa59% zi*`#*->1yv%;2Q7*SLo*SFn9gAy~P={w4m=BkzALQ9Bm&?8)3Azd3H{b^X166=`xr zvh?XQ3&BGb!Qtp#O_%RQ(F&4ORQTzKju{{KwFoZW)2h$!W>rYbvV@beZk-m8t{N?G zy5tU-1mKytmYRjw@^$s!uMyKiZTfXgu2W*;Tuqfw4oVh(};WPL7tvrFyRy#?9vyx~kH&ckT{c zAqrKwS}q!2dvR+X%3u%g&D%jzN&XW6D7t9&_H|z+|CFGvt8HqAS&zX4=vJ7n;`4Fi z0<0#nRYfEyh;>H4BpDwM2}yOGUoY~)_~U;E#CvmMsVmLyuutJlhr=@*=Z*2WIzRLD zU-Je(7Y(vcc^FjYh*xebm)mSOy?_XR&9ti{mc*CS{jGD z7xYMj-_yem{m*L~>-qGQ{AN`s$)P9h2DwXo52&~XT$oFCmHvjqggQB6{f$JPB_4S7 zv?hIjOIUbOuyedcX7-Uf+Pvo+!!eo8CV|p;*`-DuwP2=Js8S>>&S_ouc7HND*hquD z)uMp} zFa9$jBMxWFrDs!LPpxiL^_qm<&`tB`HCb|Bdv3lDVq<$Q{fKF2q|wD6+Hwr~M0YJ= z4b81|#uXo9Iy*bhPE9LIXQ#1E#)>tO7~-WRB^k1uB{aFX-Ic~y{ycIaqDHb8ti5?f zFHWXXjASukw7YMowEWCS=o2jQFH|v=FR%(sD88h^I+@%z)VG5AuJ591IU=g9)N!o_ zDCsk)P({j&mi%SUtTU+YKSg!V(*Gq@eqA)@qVi4E(?(GBed-92(S?k0bZo{z5w`jW zxlv>@?fiRh3e`+GS**8}7bMEzlhLjb;y4d{L!S ztdpLC6)(Y!F~rP{xah~T%BTYSj22_^*}C{&{&B$CGD&tC%nfzW_s5o@-oua-x8 z6-_eXZ_UH}R@Fn^naGZ8$oYKcSumT7)+{$Rg|No)ig~W_jv_3d&xSgx6+ScY*tV+v z`=BP_G@VHP_$mFQvNa=fbFy{_lEiV;R5s<1;TS`G*|z&6BaOEL+_%+alidB)t|zkY zt}rIa%BY?yuN{NV*2mX+4L3`-f2oQ20fA6(dInbSb}#?`{{Q__z({}Uy0G#B&hg;sD1qVT%g#&&I z{9$>RA&mYRe^=op`lrliw00c?LiG;sK}#Me9Wz%0jofcY!f^31utydVJ2^YY^nqMb z30%4*7vx2H%Hn=yL&}YXB8>pZC;}U%Lc{kXZxOsh z(?<4~PEWa?k81nrS81&3>{}~2?=CI9 z+BA&olYa`hAbYgn35Zk_7EG?*d!gRnF|ANnYI5}QN?A$^h27RIpwOe720Rsf708M11wotbYU}GQEWj|HlKh`X5j~neUjAQC!vBL`ztwzo Z>_hdLPeqd6`~ZEu58`rSB_evC{|9!}c2)oY literal 0 HcmV?d00001 diff --git a/docs/dag/kubernetes/images/MultiInfraCluster.png b/docs/dag/kubernetes/images/MultiInfraCluster.png new file mode 100644 index 0000000000000000000000000000000000000000..fba611e256529e5c59e4c764b6abfd7b052edb04 GIT binary patch literal 31194 zcmeFZRb15X+BHs$gh5J6NeU9u%}946AdPe?Fofg)N=r&gDBaT14IqHNQ_Z$jEtCMpELe6Ha0T)*~k3szN4#JP*9kfQBzxU zUvnE(yHN*KYJ#5LA~DWln=ig+U1u}KH@0oRUb*9I_mS*M&s##Cl0?T>bOJw4;K;6W z*6%n_QEAX4Q@*Hu`SQSY9cfCS`<^5n^zZgqVoQo9JUY3O5QatzZ20x(c|H014p1?`WuFbK*!55eLD%SV0z&eozp;@*?EF&L^ zIFDuvzi4%O1#P8_bPFe&j;H zlRBHfdtsycw?7L=_$7pf=52%a(Qf@dUMSvgEQ{+-u^_`Q=C%;yW4;&c-{-IH?#f9~ zQLkvxJ~rXs-Q6{8+}$;W!cS3`cc55Ew60c*VK#W!U>s7cG_;+y6%_>DIM}fon>v`7 zvAWs41>=N-B;+Ol{KjLe)r&NDWakdeDs;#I(CGOy8 zM#as_#mfFv0iwP4P-+cVSB;K&i0>sgG+@F-wLQ$xtZB&OIX>N**k$}i14v<3H?3) z|99knp7>u^>io}@oV@>^EC1`rzpfNwLp0#O8uU+Z{rwhnm&kn~w*Pd!$o(9>EGr}= zD3YwiOAR;VofLFmeaX3M3lCX`y5v+vj0RaTO!5x2Z%;43J(VMh{l?{WPZX;1SORK5 za1R%J#Lapp{D+CWJyPtw3$IzsoNdFx_1a!d&FYsrF9-gC=5Aq&OCcwh{%ea{PIa8p zP9rKLWDF=03XU%l1o5w_FVq-qm{#_`zXOLqA)#Qhq5M7L-zP`DK*69T5m#>g_oe?F zK*8Mq=T857-oLu^fBWU{4Ef*r@^_W}zqLMOH+b!5Exm7#(~=8{Yni&~E*Y;3?=B}A z?Hfu9OG@^`&+KnR4%_k9;OG<^Qk?R9-i-qCg zXrlpCNLe`aWqXosj|Tm5x$~wPCu~b2{=<5j&-_kl7e(pLhI>iFDaUeG1h36_Ver)1 z>Du-2057vvG1r8lkC%i0<>lR3)1BSvf{%~WpCRdF!<#LwM(^(d{|YSW>k!90(R7Eq zyqwgnOJtwxWy&`nJkNgz_H~KgzN2|*_Ge@0g@-*=q#Y!IT2`H=dcoVnZ#(VodOcwM zJTQF-z1xGFocz$BPjJ6J=3qy-qPp6n`dL%=J2wjNqnI>4YO9fK#Z-bO9N%Ut{2wRd zx^ub9e)k@zsny=yUZo@paNfKq&??zeJ_z`JcQN48%RQm@hAY<(js$tHY(#a5YG-Hn z3=`Yb2O4#^sqDjXHt*peC!h_bn!%)sgp3ZxH~yh>T2FE9)DsjG3@6PL#}?)?ueP5P z;3a)w+zL@QFtE=rDCkqDt(*|JiZ^)QZCl>Q)4y==yR8p4p-&_~Q+Ltl z;Js`vDRPph?EdOn3<d8U6cNbf45iy~A8%j3;Qr1f z=9{ih+#vbzhF@ZI-yolGdjH9wtZ59md^|kpb~2`=|LOfOWo~{xN7~Jfh5q%UM~_74 zTJEDv$s@sO)9pu*Saiy0dA{-a+E0T`#&LNGgaatGfVMy~VQ+)#Fc9Wie zR+J+5^CRZULep}~p{GvQhg}T1#}AP)9&*6_{7{^_$X#hOk9Nujk~%_(7$)7ZNy#;5 z7A>NsmBv`l``(|r5T4ArE^t@Rxg@)TYx_j+E|fD!$XD6;7rfnDu~2Y=@HQNLp#DTL z49YIkxN14Izdw?NT|Vl*fiK+bxvnjRvbn^g(Q*BBpEM4vse+;?xZWVIzCukReamBYMU$lmia{uc4XgO|nyw)e>Cu3!m$A5j$*5@)~w+uG7uS zAYC@yU5RG!$Vu(?C%kwQHlAWkg#=HEc-q82Mq;9*kn=U)ldNOa?aM6&T=L21`o766s$P9ll8GD= z)2h_5Nb{=VU-U)wt2f3*#yH2>Q1*eg29A5k@eMxTLZ|dJVy)fy7OOF8VEMgy`$3_0 zX=`6n=YZ#Fg=qSe)(I~cdk7rLiUXyRRhPGZ^5^%sWtITNFi8ZjT1PY`jFfAOu|-m< zHkEX0^nHw$fqO^aC)>)gSN84dOs~|Y)ciBKnXElWr_Nijy%zY z;Tq0s^4c}X`qX)MJ#feOvbCpDBQuk^*f7sIAOGoB$#{)Iu8eP0&|TjEoEio;zWwg! z`J)ZPiC`vHOEH<_NwGFvA2}Pm^GAYsVt^q?|FA{+aL_i#Tyu;<#!H>PQ8XR-o|T$q zr&HUp9-4$vaNp9E+ln zCe4$wL{DyQ6=Mi^;yU|IO3=`XJcRT~5y3?p_ph187xek9?PWJeXlrbr>>1gXZ{ZA8N1m>gE<4Jh8^8Bh$ahm*?W?ji$;_=`?va z=*DE9JV~OynLle>$I|!O_!_vB@z$SWx`=J=dA_;2Ul`W=v3|p*^A5INx_CXjl}8@n z#=*X4k50X>rYQ%}_>#yIxvZiSdF+yOyRu%&B%a^;PWzU4pA;06M-4u;!%Wel=VoKW zmeo;kQ#j4|k(oywvlE9CiH>24ihT91{ZEYV94>NlUl8^wtWQq}siAXsR-BhZagTyM~R+aqHR)+Eei#mj*^j z?l783_#EG-;jNpeF(E3DDon>M-ImkSHJbR$$6Mzsd=%kxO=DuAPUG^C+eA}r?#3!7 zg|KwH=cx;NW02-m$mFLG`2`opr!KA(hAIQXXJ2}f^<^kanaoOi>|gF}Q_6#t>jN1+ zK_A7MM7^($C$on=`RJWqa?}#;1B{gy$mTL=P^Qrh$w7N9wVp_ivLWXpDPiG^p$8Wu z4q^ zrDo2k1Pm?MWnuV}kicVZOG3@q=#emn96O2Kv!0X)=SBFCBIlp&y!g(mRSFcG4N@+ z6<8-_IkA3LCK0xIpn}P9h@$GLH!J>6ndle=q7Cafsr$$OD)gYKI8aeWWu|D8f7gA8 zx{`_rK%Nzoq9}|1t|wP8L2?tylLXR;v$ApAacERB~KTKtNKapYl2|%)gDl?ijQBM2rlw{a; z8;@hq?z6qN$2ywn?NY=)Qg^Y&(|)yH#UseMk?Y--i^JN zF`v!MROQ_jDO-X-yLYG4nbU*7lvV5Bki}r*{ZEFGb;S0Q-&<_$tzK9!SPUdQ#wv_; zgko&$mzOyvToP**ZG@~91C>lSicZnevW1!>o?6Y0^49Yy@99~`zm z%CWA#7!^cuiSI^4P0Z~YDyQn*%N+^@Cd32Ls;a6^yBq2YXCD&~U3`2LYNo4OusX4( zJL}j}&H2cXd_KD>z2p89Zz=Sq#;b8%^O1Z4sog7EQRT^(RKC9E(l$H4ePgN;ZAg19 z4Gk-h8@1n?@oU&Y^#gY&xb4%)H#BzxdYnLiwictdN=1;^R85=fme=_nS;IV~KQQM78O6QW&o;|8 zZsTZLoP3$y1>v!qHXY~TO7Lsd`2C}{wiA0!e~m z^||GTt5IEIf|Wy~qo(6U`s)KFzmCdVrEr>Z;Yr04N=0$$Q1RR zlJ5lN$OhT!E0Awmr5BOuBQ;TiwW{c6Fs*V+l&yTfQPxorL@|FP_H&iPloVu__vkOKXZ4%C%~`Si>U2~@MGU4gBUaZby4bep`o)Z6 zC>l1-KR_KY2hsk-Y42Z;p#Awo)QBDdeRZF9PuKiTR+S{=>L=_BSA!<*iHI7G?4~a^ z#q`dnsl!8K+F}mSm3o00$pRsr?Vw!wpY@1A-(1zyV*3`yhiz)`eBB$RF{RQmV- zy&9oZ3D8&hw)ZTEh`Vy~j+$2X(Ij zbNi1KtK(H&o9Be+ht=2ZhS>^rg!G&{OUcPbKVdw$j98asRf(C8HY^l}(Ei|4wV+2M zdJUcuRveLjBZcMzDasHaG0QT0CfJZ$UWoNcB(=Nj7gVh8^oPdjuv*=Swlq_QSY1yX zVMY98%Fkh#Mu?vX-aGQow(HQ_vSg@-M>0OCRQMlJf2gkdHXHwBgK&|Dv~-Tu{Ye9% zy6%U1d-oNL*_%#Xl2zCZ?Jf$Ize%BuDhJMWHZ+L81Cx&z#qKohYwI_zeMURzLUZSb zZ;yifTkNDTO;e!5_M(1UIOs5ridBc&i1dDrC=z~04Jz&321*yOgv^~UNK%AV^fd6a z(dS?ged%@=`WHAG%y2Qmw<;FZx5b86^`Wh&9_ryE_=D$S@VgiJ!p_R!e0n@LtLsGb zWCy{Mr<2LDm_(X#GlnRnLVC5fc^B!$Q{+hsWP^s^T7KW$eoWb?sQT*t+X~gseR)Zl zssMuL^<&G9A@gfQ3eF93yT(Ub2D&NQ9}I#Y52i|R-w|I9VLYqnBPuT9HA@O_g{EUe zoWnC_e)*ms3>AjKwpgIMA{lPLbw~8g+gmx4@RR z!&=FS+0iZf)hnbi{`jKQ#vumpU+TL<5DYoYaUqgwkP&x z)}sw(9YISOvO!n30PuX!p4@;Wx_3Fgyj+=F(0S?NIhSmI5x?af>8kYa&7)(RG>Jc- ze~X!x4(Fhe`ou*xUgCP$XZ%{xB)(LayGV`Gyq8$rp@;3}!c+=RJHLP-DV&VAR{nWR zxCqLo!22zXe9mAv)CW^WA<{^1GI6>ThI+qBRc4)4)O+tzccWtWrH)Q139nK{$#2d} z-FT|CuCAf)_M7M3Ebph_;W8#SK@LA8>JJ)3#WhVDWMA&*&Nn&le?R+l`N8#Y7%g*^ zp~{4~ePEevXpzpYS>;A{#ZEwnA(C%+^A_pPS0^9Zmp(|=>3?|X&)WMdZgWR5x?L)E zV*`iWtY53a4$Vxj2uw2Xu1Tq19FtOux_&69Xbp#W4x+NR4cB|5>eU#D=dgndkRvZx>RRW&l7gqsdY==OenlWVno+kJX_-T7h@cR~G*8G=bp zJ$4*ls5egfqn{D)A38ldf4cg1w*VDyp=Gd`|24x1?ohEfDM{sn$=#$crh=}7@>uc7 zh2ULOQ7*|Gsx4j=>Xb{##kuH*X-bm||0*KTRjT0u+- zP5k_nG;n&MsifR9+i>d8wTwEQ0w;Z zMP5|MELrv$^Co$yS(fPjTZ)Fv3gl8=zvL%$U=(DbsLKMlgcaMS5N}AvqxgO4VK0H> zoO@~v;^+~QvzuGRJ-EAJ&MX@dZq1{(LxXuNO*!MZKfgavcBMonnqQ~E-Q8HlUVd^@ z*B@$YGZJ9j7MMKDafd2I_m*hJuCb@5$E$}7##Sn5b+69D2fGn>#W(B7&{VU8>j1|N zc?TLWH?7zA2BxT32r*Gr(=)NI)!t&$D9>qQ3d~x!Xp7DIT_RCnL*F?Z+%&WpC?Jbi zhrXkcA0vqEt)(K)!u@!l%MSs@VMCAOm!`6TM8Bi?r7(0UnQbXiM`Fk|Z9l*qmq%H? z^a<@MDl}o^Ow0)A0U2eg1@XPISYdw z8SM?C@mW~(7!DeT=xR-4eGqoalDIXUFb_$NpZOHL<4HV~D)(-iNnLf?sFgg}QY-czf#l_)AA!&kjE%xCl`h-+69(?xw?(H+jH%@TzMafT z$-IIs4Dw|XJdQ!W0pXvS9AM;sZ~Z*|5JMMxoxSVPk+(@1x&$htl#Iy8~J zsV}-UobB2B3PjlVZC|Hk<1d{kadoa+)H-Pq4@4NA_fFZ(*H6(=a4l`8mAhdvXPQBhq8n9>PbEIrkv1N(}4>Szeo-&N>YQ%*yc9 zw0P4*2yEp-JSeDeq!8gZAP=Ruc8kdgkQ!6>vUNxMxl*n=$s8s-Ht}Z(=qX|eP>g8~ z4%)DjL8-WGetUg^pkW{B9zJ7(9K|(vhLiQhD2rH801no*;r4QS4e&d>fF@1Ssd3C= zt~Qt5YrL{|8hnYq%7T6$4L*s=rRYpfDP>!MuJq&LH?3#_p)zrZ2 zu_6Hm-wnMe1dHMFVk1uS_jHkYgz)Lx@F~F5+gRJ!1kyWYq5x*_J{+(!gPxZoX`ecZ zT#NvLA0q4oIHDCoID(#E8&y|^C62eA0IoGD!fWTvno%90`Fy>*eYHTI#m!NC6W7_C zYg(d^yQ4ipu?FTlr&2nQ32g5XSuH&`aT8NIzf%}J_w16cpx!bcAPUqu23gl*k^Y2!f7 z7e_g{J;LYOM#YVn)_^r}TZFshs8lPO`88c$zIP>@{24`qzvB*2@lKq=R7I|EFTuB% zIA&(%zVF6uYV5Y4#@oygxjkQA8==hzE~=OhXUdvy4rlE-@XQ7<3PaH1 z02XgP>XorAcvZxK&!7~RQuHm)Xfq##vZi6J4g|>|xd__Kqow!mL(NWEPp@m!mArgp6(^mgLI=5zsR;^Wlmxn6jo6)P=*=)zMBs(|fwX6;=EacL z#6DnF@e{D+xwGh2^YhZf<>5J~GAgvKUm@)7z2v;MeWu+$+#BfYXl;%JKM zsWV_#5`gkTx8p}*?-)yg;;)PZH$5Q1wz^MxIAt72J`20t%pnU$DblU(=fy@)|523O zKT|{E_h8!ifJ!0O16;6wPy8hHcax6$$0a^D%=7^=9#r#|b8%_VvOb=fc8_I1iV&lK z^Td((V`MEubUeOYCDO^q@saD0_h!p`RR=jYsAwQe2AC?RIJ{m>HSKS^lVn&>k8&^K=9fdxc&Zs6P2Ee^HUVO?}b*5 z|Lbo+z~OY+(VmD>6C18P$!@Bo`!)*@5TbH~!=I{XX{}??jMh*IP_}a>?M|A->(B1U z)LX}`_ag$VAeaV@ImKm9b4Z6ys)*zAEF15fPsX5WWw z-|H3eBZ_beVFCTOvk3lz7Qu`+w}|uL4)*Jj%EpAmyBxd+TE%SE&05c|Ut!MSKovFM zG-(gA{l()Bhelwyk@MNbhr^-8xP#N!n6&RBn3RCT*m$z&40DmnfRrxO@X zj;_?$I_h-nd2F9^ao0^Q13QMDBGDnMh6hBfe+Z;18oq~N^|eB&bV158wdspwtNglO zfBY%=#tk9jmD;T_)kj&JRU}eu% zeL3yRGd!8=UNB_82^Fk8j2%La^FA6=MJj@KDa+&e*)yCa|HcN&bx`hkaYP)8$cMW@ z#N`{c{6HLxDRKjOhiZ@ktY5EIsdNSW$WM-gPhGu)CJJ@l+=4{=L*6|_#Ou963RFxE zXrkGn&`W9tUnt%Y5mji24?<4|A|XGu^mIVGddoE6yYXh-K=`U0$(}0u6Rw%O{qxhq zs8A7H#^=w=NXa{&>y>3H|30R}L6L17rCkle<-1sknG4hiW#JyqnKP{DIC#W6yI73K zj(V^$%@=pGP%3t(t#tQ+-nG!ucm4a<_VcqH@AiMdwsc zL*MjQ&#%6NC>L@w4RwC*z-a9+r;fh&o#I2vw{demRvk*AWSkzS`nW_DH~BXnJ1Gq3 zM)L9$^RloMT?7`#(=9!THb80f*ux!^`LkWpv^R=Nn<+zeIAgBe8hUO0E}PKGgo-@@ zGG3&+-fumqKzVuQFDvlnovX7maZ%+6Prdb7s`sUp(^4=)Qb9?hz`dUU(aj0w!aNdY zso8D%xj5Z_ag|pJ?`Hw3lXv+u!Dp#`F?k#LwAnG9%?6BUS5KNg8u?&qyP~4Fw5Dbi z;|rJU-vvPCCSYMfzAh5DoO#vfxf)_--qO<>xiVBBu1Xat2dyLCt=%r(6WA^+R}*%g z(sLe?TQ5lPSOsyz z*RRxTTDyzCJ~O`=IOJ^$#E$S;5$VE^Ne8|S&JXwU1W(7b#{@B%Z6MvBhE6)nyoTl*>7i?N&of~Ku4QU)AAfL7sa2A|NJk&;p1 z(>1@va6p07V(b7Tg;Lhbj1aZs;VdT=sZUR=oRbbJCk$-p6_X%r2vSi;7K(1?y{)?t zvZ|Qu?uN?zT9DWK`aFS*_d-0q*#$ON9F1)K(s4V~WoDKxE+7 zqUU+o@horu$MUDO0DL8OAjjt5O90@ier<%%7pTY(tM*M%WKI|!v7k#K|56amY*v`1 zU@vHmpc$oijjW^zK(mgzChun+YH4ZpV1hIcO*e$RE}Fk|8W1MZMSuEI0=@H>=gqbu zFHkj=f($c$Oz6An`;lWKmbfDvp@)p(x%V={pQ&dP>w8OOe11Uq{O!cagyDWR45pHh zLthF~PO@r-)Wy9H;1BSHQo#{Wja()-rBp~=O$|>FSKopYKrsNQAAm^enJ4=z3Ku1i z())+|#cF(tT)am8+CZAayyvl^s}(O$r_vx;Wwi|f4m znzZO;)La%i!JsLR5Ca|~6RRUr$32lcTY@R^vkE&09i7CK7UkJh+0w^T4%(`!zID4$ z=K6r;?=GpDr_R^+L+>k=lB*o7+FaC-|9ZY&Hq23%D;(T(e)&*}cHG`A6-TC3eInKw z10yyrj&yfCYa6K24;2o}dRU#dh}G7Ib8~o6ei@s>e;)P2W2TRb<-8tb>R{P1?4_W8 z(qOc{WRo;Vhlr(9nnZC__5@@ML;=JYV=nuWm$Rf8JhWKv|dL^h)=f zIenTkOqy!5>hciaB?fk#ssX6Wdtu0;#u77L))TCDoP|1%=e7r>6zuVgKGO1TE7pud{c`-WU{nIg`hrGQ z^tA3nHA*kz7lYx=MmUU2jE)SY+t<(Qp3rt^Xeo2Cu&})FP=ZB#B|awuk0(-xM0@|H zVFv{i!YX0oe36JSItg9vl<(CZ{bHW`IRSt!g|5%HC@q%4wiPt6nr3rz&h@MhYc!r` zS(7->&!}31LTj86%?tg$o{@@YMQ%62SnQoC6ble>N zcGlS`<+>LPd905B2}>QJ;aFPgIo;u&7w)b0KQV<4no;eOHx8G(u-&I=6J($kaJO~L zO^3}`b)|O}7<88$Ykm({-%fntcba`@Rwg*`7s&%L0>Fi3DMo~+LjzRXD>$ytI1fjT z4im3{BkYa$X?a>A0Eo4f4D*C-w#=l;RvY_WfJy!n9BmTT3??!NgWnRn04(gBHSbOM z%^bN?v!41w6ale;Pp%nomn3{~?GShv9!Ap5;3pA0DQAoYmg?ChRx{^v`W087a8X?hE@5{$B*boar+xjzGp zvQvEyR|aiAh1MLy^d2(#Afsjs2qO$tw-Pk1cK|QW!DioenMsOtLm+6;&6g+JeOLQU z4r~1>$#_MhWH6LkmxAMf$jyw5R-6tg`u& zF3Q`Syy8SlbBFR2)vJA*KkMJk#EUi9=4zNFChsyY+e*k9KS+L9Yp7n}fZ4oCzQ@KU zTa@;s`XyEO;eFaG9O8#4^6{+P0yG_*085vSWMvJ18_D7~p3P`;$i~RcfOQaP{ivim zULW8E2(YwpLk|aY*mVvTpU7@3)|(2diU;s1kJ0I42RTJa$qxhqesXkyD0P^>-k<3j z30876&euJs%Q@?sqr+M9x$GHWt7ll36cEtgZMbV~t)~ftM!Rat!Kns)P=NESG|JrW z#Wi5eXrCu7yz3%Q(Z5r_@91mPN1ARYOEgkNzC<)`v~?eL4HTbWw6Xru zAbaGt9@R|y*>_$Lvt6z2a*elXvyNf~5D-qSW#j%DnwnWsevcqWvCW3wP8JdJ^e4rs zsappBL8de)*>bjJNzw1xPUk1R)Lzv;BYSjqMY28LK)g!CZn(443hSazh+wuN^|qQT z$}sPE{ra^N8ZnA&zXk!x2k06Y5LZx!*UHySBGh_w`-YQOP5^i(g3>{ts^h!MbCb{+ z4Lvp9=wQRQNn6Z%JY>A~&YV*70+GNEE6l^m3p|~MaEX07P-$&YBhTzOyXJee_lJd5 z&O|%d4HOUC)}-YX<~rM`zJ9HH{YBArZ~A7a$l>r&%3U0u`1EUC#n6Upg%7JURuh+y z!?EJLB)c>%C(*LbZo|EyVD<`XMM@Z;pTlYZ8r9q`S}91ST71k{=(5QdW;nd zUaHC2vZOhW_Ug`$1Kj@5Xd7-RZ|cYn$nBZW-NYB*T`g5F z$+AbV4ar)DUSs;e?kG;RnJ=oW$*h19Z2n=qP-nT|b(RiyjSY2eH9^Tdk&A23lBio* z+yvyCF6K<>HBu#Y-(D@ryg@BdfF_3Qd)nawtlcy#NjCh3(K=>-XoW_ytp>%)MP;9IL8bKl#+TF_aO` z!*c-X1$eKDDE8n!;JX-+twyNJI8bP6M53>x4{WT2dkh8MrIX6ckE zJr7>m7HDBIPV0B?)4KN+Zcqv3yI_2mZ@TfIy7?rZ{Erxj+D*oj# z&RHx0JTc&6UDowEH2x6?IKnijMdnCKAASX^e0gl`QusKGAag3cnr+W`;h?(7bNOO( zo`R8>GOJS7Q|WE*QeZnTTPUa8IAE&Y;w11pWe>qxF&TbH_D^SZ3<#Ys`mY7ie0rPH zS+LCf`8#OvQk-T{yCsny}l-=Kz9QnJ`Un{?r3q;#C*fT?Ndt?+ziJeV>o_(@UA@LRGqyvgG$c@W0i zY7!NPXWNp-rGi z&f%$KkUM|u#`Cze1yJ@IWIJ5EdG04q6}d zm6-*5Oxfs15SM>&Vi(jya0o8toS!*_1;-j%`sb_ozZ(C^ebLxqX=ek=H*DFnvzp@` z$tT%kC$pO%YcB!p9h+uR5Pspn4^8V9+K$Rjvg=!xul2 zDM}-RHvP-{t-MA-=NsVHb{UycJ4_PxIQ3npCVD!$**G1dQ)lF^dw6?N;-lDoiOBe% zQra+2(%wn(LkGS)I=GHgc4AU@3?O~&9k7|kWS4YDf7GMM&sp9sM;zbO-GWU#alfRwv^;k(oL-jP} zBfoPJJL{(zigMRsqmHnP{^9d`Kg9)uNs^O!lTSaL#tvI`RfPPy&&*dS3;u-GD9bl!F0r7TQ}b!?#OXrCyNtX7!#DS12(@flYDa}<`mdX z@V}s_QBF`*BQ1sG#&qhb~fX=^mD?#SG?Q~a>g1e+D7!B z6?wwRcoH6klc{Y%F-IrcEO{O5Ki!WPfpL}63!*LI$h`j}u!sprcyyF$_m#{TCC7M? z+>)l-T70F7+Z6<_LZjf_8YFej<)@{i!*4|Vs#wp8XBq(LymN!hY!a+KUr(?FM!7o& z>xmGclf(NVhvxo{R`DeUM$Nz_$vz6P4V+r-$q@Ejzjl;YSI_| zsws1_h3_xpQh)iARo*{ZdE*22Y9u4ldp!sxm;!AAK4wifr<|!uRmv)b|FVtg$O4L* zx!{8W*x)fGu?Qv%EMEmrCX*0oN92TVKnbm}xj0%~1C;f?X55v4_&1#=cCbQyd!QFN zFyP2C4)25$`k4IdZZ%TiZWGpF2>%5MHG3y(;i$kveGWV^L?Ocu;+y9&LI(QL)>IJ_ zPw3i7CJHwl`X>2;0C+0Q6XjWJXhnkRM2~*b%<dHz=Z`aT{h!*R5UU4a0$j-EOZ_ z7@{9~bH0m!Mgs#7CRiXs$ac7e;;68DBqbTzSV~*8HsN39 zxZWj>iwm0PieonIP?&Xo{TPK_R$B|tjQkmgq>E_}nf_>SSJusB zC3BLR%Z;w3^cq)s^Xr=)9>vVYNqotV ze7gNMC+uuq-=9>CfB4y|LGoxu?`kjuInQQauB#LmG`@H6$IGIAEDv8Z0oSX(V5|eW zz=$7H->Vlq+X{6mIWk6p5)qQt4iqj?6l*?M?amkB)3AI2y6UeygF(M(W?$8BOel_nSQTITto#xODzoPSmjvZMI|NGHY9i>BMGW7%}N4#fkKZI@_HE~tlh9lX+wKh^ z=$ZT0umY{D-Kl2UcsD8Rc|@sfn`0-u(zLrH;~kZ|5tK8p=6K$s^~B zu9TZz)dta4;-}V0eaNIBd?pjC{WxbS4u`{K=f^errn*?4QRvH@^K*8l=V2UW28E(& z0^i@&UaBgd*VOrnU|KZahtr}C%Hn}4j0D*$sJ@3SU_IMVbR?zDFoAsv)|DgZT6%OH z5KLzF0SWRk4jO5_Ik@IGiWUQn<`Ybi#pV5PGp?9iv%`*pOZTa_i~FZAl4zk4qY%(7 z{|fC?kvb@^tbRFH&3t&FFBLilo0rdQ+tTgUrj~ecuD;_ODUSizatx-#ry!L6Bi4c` z`q7tg&!Hl;f1=3dyQ8%8WkzlGbg`2y2N_Rcb$-b!;?h8(S2Oq4fVG-av5!n&3PusO z(`p0=QEm8%TG~6R&q##0s%cp9@JH`lA3g2O>zTcykerIyzo}qy`SU>9QF4I{o`@5m_`64^|N3lv*Ph3`T8ig%(bf|GjlTDC)Q9S9D1@`-4lo9*$%qvLa}*od!^HEY#rqKw(hpVKSS}8-+r^wb6|No$;UeBIuV3rx&Iaj5 zdU(_c+s%73c14_(q`CC)zSn-8fT`|+vBCxyV^%0Ea$qm1KNqv56|JlwxhH>!gv4Wt z_$>f^PUI@?LtelT#jbaWew-}}Ur%@J5G|k;t_)?XG)zdXlg}L@VaOj)AcaIL3^Uka zK%3)zrTXGnb*VO{$=x5bSX`AB-mD@%+$` zeOoq9HlQyWi<>;!m5k$mY`zWu6IetLi$e`7!eVAWKgM0yyT}`!Rgk@Z7xavonRh_+ zI98|3ElQ`%R!8jS=wCZNf*6_~$_hQ&107mOt)ij5qhu11`Z$&8twI`wu&n2abqd$s zx=0%k@?j|wsT-`wrdy+VRU`V=Tie^mV$wCd1UWjPvN80!pDU&C+a0F44sEKgorfDJ zo2>RSPYIagBu~C9b5J#c?Y-5%6Uc+xT3PWL| zl05^yK0Jj~A-dyxeNe1#p_04Nqap_l$#1(I{d6R9C2TO_y${$T2jZa~3CLz8}53>DQsXBpuDO9%&sN-&5kzRfCl zgGf0C17l6Tp#RtlV3KlW@7fA z4b``p<9+){Tka>0KZx3sWfGkFdU`vM;OXhaQnjDTK>jh~@0pTSi6WiIRm~VaVrC&| z`lT&&$Qz=*IWaD^9OgRG&`%we{_k#fmiG0>t)mGL1VDWSVx6PtL_YnyEwD>qIxkTL zd)CLCcB`6UFRyehTahDhrOZ{98M8k6hBkhdO`$&R&mP`;QZnAxnx%c_zoY36k!t`A zffzhm93WO8qXUHx%7b%0*@9kYE3=CcQwNF0*65v!j&%Av^u!7%y^#;;^_Tt*@PDHB zFy7*m=nA*D0sq|V-`yPpy4z@&&i+3^9x?B!SitQ0zd!dU4+>)AJlKLf(6`o?T-P^^ z*hT4m-bR^(kmL&un;LcR{CACk^^A32z~KQtoiDUC843P``Yi(fOH;U;syLA?$P|OE zmfQ(IY-x~lnkqA6)zj70Eops}wZ89jcO|tN<9^VB-nW^PW?x*hmLy{Fm6x*fTq4zN z3DXItpDL+2KUi|=lg*&*g$iM#O4Uhfoq+Mg<^(tGk=t z^!JZaXO*yx@c4-c0J*A3LW0E%Hw2c4HDJSeGP=~o8y!l>;`qp1U0uCoSP!tz4<>Y9 zW@`oiX*&i#YM^xteq|sTh#aKhNnUH5X)h4+<>r9Q7@o(0p|WV$q0ZgR!mYXYS=~a1 z?#Z@+8Q*4RjGnOoa2!TPg{kXdr&m;20>2d`)KyK1~x*IjW~vAU)&`IQC%b7X~E5hcfY$Y@UYR z{=dHc7_RBa$s*zEySC&y;BC54tdFS!RlvK}Ku9DQ=mn|OlDxbZKvA;_S)h7Qib*>5 zAYZ(Lpq+($J3Zq277t_Nif7Jo{9c3nCx-vi-dF!s)qU#= zImR=db#`brdz5?#uu;FL+b6xiCP74xMa%~9g1to+^&{qRv z&aTb?uU5l1WhG%Lpi7y4fF#4b!vY0g`|wC_S`96$dKTH%K^t5e+xA=fj~_t69@oTv z`*R%pr+*85A_1bpw%v(bWwB3(!}T=-rxIhKl&_zLktTo1!YmX6wgpIHBwcP0V6t#y z_gD30xaInK90U@2SH2gLubnc86jlI^iu%|ZbPSZc?JJxqgIEASnolsM(KcFwTtAlV zb*pMR_V>n_Ok!HGntK3cT>OnUJau?vB+bmVwrxDRIQ*uM_-@}i7~CQNZ0saFJ&`FGypnq$;W2RnGIqCeb8{B~q#DUuk^u*WYs~{>+WuMldXKKG96*#B z2$%c`<4S`gL_YoZp3(`z-ngZNr^OY-yDqSw;p9COM&>_H>e1+#1_SeG4!b+GU3lOP z#ql)-;pHZYbhifk8y(ZVh-Z;5_X52hf~be0 zGsjIU+Of_dEou70Rt_oBvTOm;dMPF=+OEj;O=af}0V~?c$aQfg=Xtua=f154zZD?2 zvW$K&(tzT`^-X6)Ph&Wl$iNNT~Fv1q8WUO6$t;;@4ElOAtHM#?tmNa@@13@AvQE^8^< z_Pt*2W|B6%$-SMg70A7K`c0Y9CuqIn#`g3^(CBm~V#0xROWULsI@Pyrq1Bh^wjCM5#phnO{>fP+W6hLu~KnYfY*x$32Qd1 zh}V(nQBlTkxVJ&rclz))2=B8Rrg~242OHjtf*{!rt2%p408y{Bc1M08299#y$e>VR zt+FQN;^lp|H2sm=Cmte(AmvF^T9eZ^vNZJd*vOmt6&tX?O3E|by1hJ|bL_8zo>_Kl z^+y`?s~Pz)Tf^ZcXL}i4OY|SGQ|o^-0!L{H-*+9AChEijaCx?Jleq}R;IEEaHfvdF z$Fw7j6P|GUw`O+3$qgslUrFIRt4$D+vx;!_blv}K*U7+~6+vv$qvkRKK1-eo)(t_ZGZ{tgM_FwY_}?6{>Fo@`;f^t&&e? zN0Agw<}gJ2lsZdkkmz&B7xD~|frYke>cM5d@U(+~)%tZf{Nq}9Tvof71?w_C8^XIQ zTFgp0l2w`BN8bkUUX<+Q#}tHLhWr1#Ztb%<5BFI<@uQb7gk6ialzRdTL*R6YE|AIC z6s>5s@->4ckzet=8ix$uKvs!}zvf3+YB{X`$Ugt#?DS>!LsrV@))`;McE6p)+ds9! zqU`F(RrGC>wA#schsQP0@gIfBVj_H(63U{t$zeSRwgG&fyO&L|qq@@qR0Ztq?cF_a z@Y#+osNs>a2L535Un`5G5A_a9mYTS9>5`_5cl;O#Soa6lT@BEdYyv0`K1PIsz&@$r z6S=UDI3|H(d(0!3O&)yrXUj&)U?+CxAx-5{jii3RS*;43HxYV@FD~V?QurPDC!}07f9n#e+@??QGxOaml7ZfB*9N)Dr-fxv`d4t4Y)?T z)x}~=<0?#t-%Eoi%B28qj|BjJwG|#Q5m=9sw@*oYmYY=}CYUfuNPTrnfIYOeptnwz zj+mw05+T;w_O43VKbyWd>{(3*t>7M|394d9Q}dE5i16O9xLxUP z;UwLlzU9C@i|C^l&euOZ=#WOhyFtdt*b`K-vgYC@@@p*1{!i_``D} zX+@6kux$}|sIj|n$uR+nhUwrxHY8nQPW=DDUl357(M76XDS~ubxDk;k#|GWN&x>ns-p%QFa zxcp7b!&VQLhaCki>oD4NUsrip7@lT~O*=+5#{E1)X1X5bHZ;GiwG!!J-)!6n>>vAfhl6CvWL1-m$@IGdE0$)_3#w1=j{P^gm(VkQt}~^SO%vlx9oo@$ zl~NtTe+9q5heeEd-&na);HnW>J(Pv3{Lrz2QtM}>l7bVuf>L{Z3+po7J&`QdPQj=zi|yKO4|CwXY3uEz89stN;TRl@vAW8>_Net-+(sgZ#E5Xl482^O~+y9SXk4t zlx|v58XW1mHnZtQe7UZIH5zs_gL`>vd4F+cbyK}LDenGv@~Jzoy7T+~ z04A#y*t!*utjdGYu-&YOiCJv-e_-yZf%7<(VXPaHpWcRFb zswCB4F9fnoC;~U`<+LB)Rt%ejm_v z^?IR$B$2)1_G0qoZ;!5w`GmOMV+)Gw-+4u6*gwPcv`TN3sMdnku86znl@8kWeLpB@ zu>P)X0e{!4K4+IJy0i@p-uK=MtF&+T4X~pp3@aa{(d(FH%aTUCXii9JN8EslWv`G7 zq+w6u<(iw~aWwkFg*HYkI%C)0*G4RHCsP(q#xxAcCdD+3;E&;oyscz5rOk@yG9@Z@ zH`U6rT&^^&q(YWn^8Z*K7GcIzDxN!3DvDFZx-|E_#cEPEW{mVfO34Y27TB9$O{SNB z(A;btdFw;7-0z50J~uc)Q8+liR!MEK%;{1)epRK_bz^C&;;{nZ(W7USxTckbV^+vw z<}${_vGVmh9lK8|4S&AKJh5@s$)Vt#I->kk2(TSd~$};_33WM=giAow8rC ze~pVZgT=vg6;DO9Q_R=(8oXBgdPK5R(6;@@69<^F)2%h^)rEVgaj_4syDHh=wv@`L zKCZeF)V@2Ln;&V^56jV7&DU$IcY>KYI&kZ0J+FHAy`oP4=@rS{f#!Rrv2TTZj7pmE z0_a38vNV~_#yjh4=F8>3?qYQh)ZS1+;oMl;)?xM=@a)J(`Ba$-BtCqu%T4RTmJ*n zD8r`$L(ViMpEI*(m>8)CSNW zq%tpG6!{xU`zOJ9Q69i!?unBTo`?4S3C#~&hR~NGN+eJdr|fa1@7DKI2!Ec}G6mom z%ab+1-n9Zfq9hr(Z#v;<@(Iio^sG!O{w6z-*E$Ff%P?8vB=pmE87rw!p9lQo?t@lo zN-iXTh*gWK3^xAn!N=t&E)d0p!dGOVVrBu1GI&jTOb8LNfg|93Q9p2D6vN377PR9 z%`ly$rUTu0^d-p{8cq&-77ZCF4}=0+7qHuz;x;LvfplKL(ytP_kj{2KWF82T|DZCC z3yf+OLP7Zx>q%i6TjGL3sR=ENP`|O*K)*u-q6p6Wod)`Ua(;vv|$IW78OwnT>|olgX@6O``zc+B1sU?8`RT1fTFMhA>esjk{deE z42H;Pg6?-Mudwd?TP*)$?4T&czAYYP3&0c9?x439V-oS8Y4QdIc{%<{2N;P0cohhd zD@*FBfhqfn2d2*?B98uCmeim-&)#s{2Y=~-BxHV^NRJuJ9GKeHp&vlT01QYPCv&b) zU}ZE@GNkVGj6B?@)@lg0Y@1dMur_|k2ld!RZlshGq-Oc5m0zzkM^wg=}v zgYa@l^AFG)8oH8J08j&s)G7n%qgS5M0c4J!47k3^9nS)d2f&G-8%drifMqL_g#;}; z>>!-QNF(kO_-VV^m5b)zGxIS6ynn=qlm=3c_zS{phsK4809gWra0ChobNGkxpg??9 zCV2P=KkmnQQ@5a|^0>M1KmtG=TzlqMbpqH35F*hHAe_%R>Qm5-*g$SLA)l{fnv;V% z?QNhLicyL4*=LHA1W$i_$JdFEDMjpw3xEHSiyPBY4w&Wy%BwL@L%2XnT|eB}4bLY) z63kkyk=+7VeVrGH7Gp*Zv3wR{{`$uRK2B z2Jknw_UcKJ`BCZ?7U>SoQ*kXSJ$Ahl-M#K2A|g4%p=vs2@F4;b+Fnq#r8i}uTv^FJ zu4n8Ctxixor2$q%Vd0Y=S*8Y@*Rc3?5e~v@TM81=TZk=m5Gn|wk8D(G6gCS>wbjQu{buF$?nC`eGJ9Dp)BOF0#WgGX_=!#tH!fU7!hl1eyQs z?&b^R_lWtr^L0>;YOY9?&0i1&oVM(r0rKYzIyI!|bj&#bPyyE|Z2W?YZ{8r8efY-Ube)$_H%02I3G zky;KONhjb}aw*PhMnnQ;ug03DD~!B1{>^%2t~w5cWQ)sGLfg60tkVFZjLL3&?Gn) zl5SrNjU!)LS`rYp?Gx}qzqT`7=M3l;oHJC2FNo`rM9#QELGjeG`3m>XN#JeQd@NiV6#XnY_4BAnfhB zhg@_xo-btL>2JCLT>!M1QzZ{n))v%IskU}H-n#YwO^Z%#sDuL!+>tE)dU`KPk3lsZ zU5r__ zpi})RdP&T4fpe$lgrjFpk#Sed>EL|ZlVAeY>T;3_DN|f5jz~etrKNT@lqR45#&&mO z&@>DbwhGN&+63H1?k!)>6>7L9@6OAWmYWvb=+>E!gQW!p05Vrtzde^rU1I5x54dHY z1NWYe=_xVOdbLXC`1@La7l*6E^ zZ99B%AC^f6O-jx=!iB@A>gZ2sFLZhIRq{Ol*odI{=V+{vfyX};el<{K!Hi7tf#Q30rq2Z$0<+*Iwz_{S@3MUaA7vv=Y zLRRu0If!7sF$kZ>lJ#N&6jx6lGJBBIsn$mIc>@&Q#GO}CUjl5a2>9Q=X$!k*kORQBCJR+B>Kg~KTqe9 zpn^}RVJr^R=+7KaxcuV{qrUe@~e2^Zgd zHdE&yy; zf&wf#x?jxDfGRf4E;G%I@}_y*9|10ANGx%XSRC5)obke=Ajnmntv1;uO2PNV>C53s z28D)sYl9R%rJ}Fah6{Rk-A~W;ra;w)+Y36d@H2;82LC6{udPR+ZcR-$6A6L81lq<)P+*V%E8w<5R%gaQlOx~}>6E{ULoYn12C8(S ztxOl;mykWT)Yn)uCfxw*QB-Vml|@{+PdiZLXjlLbVrOq_I>|nHY96F7jZwy(m)8df zScNbfyh=#26d_LpFL;3@>t-2%V=};Xi< z{50div7~16&u}!3K20z{;CPnqG;?hpT!cSZHJ^9Z8~9%w9?UY#hwkl;S(Z-w^A|^5MBVbbZNHFZu`{T}QQr z&+_BIxPystTF@{ZY@qx{?okXF0t2SF2yoKvYEffW2mW+33ACS8mfNP*`uBLfiz;+_ z<(%W1qc;PGO%&@5pU%{82z(bM@11H~d0 zaNxK^Nk|~y-js4Nyl}^sjoGF(lC)~ZbSi0$PmOhrYZIm~xOD9RtmcUCY}NWZ5m70!+Fm z$p3n7kF=;Wg&q_TR(t1bGHE?C!qx^He_T9;h!*XB^%s^>ZMh{SeIjD6D))29fBf5N zQyCuVtHAD6@+UayzJ~m+t#iZAeEB)6= z17{iNRN2p+IEQh4{_)+IQh;~7pz9KU?u7qy_W})cCO3)DrNgWNU#B~B)=B3Z&4bJp z)M3n7dp$>8_=YO)iLV07x91lmkkZl&H~VAJMYG;#^QTa`26)R$fZ<6vgfU$PQ_V!a zs8S(9r#ow}(>op54580@fw)=?VGmY;0_PH)k zI`-@H-Vy&SDb?`Tq079mk-jYzbP|4W4<8MXj9R`|=H>nTA}G|j1EOb!E4mVs6LCjm z0SH#l{?bc)@{?5=yTtc@SMM~Ac)n!)>XRuT+f$~0wlwC)9;Sw>f@;&;9^OrF-t?L7 zorNR$t=cH{Xw@yU69Th7YVNoqH5P$d+g(TDwx4W%I&-k?so-eXxZPhdp>tppsz`61Pta9SJ*n6J z0w*n_hKhm$p2XT)(Hc%gWi5Ud4>R=e0Cabfuvdwk*Pe#imcU@JH5wuM{jOOH;d}J- zWUz#3R!!TxRR^ac4aX)jMnRu5dr&4Nbi363(VSBw};fQRXsDWj$= zfsR(d|7X)^WQh|m8ZFGiaHD{iE8r_!DpZ&j8D}Rn4?+lpV=@qg?2{IM!tDFM#e$o#_h?jDbNWUG7QPU?>;SaR;#wJLCe%|J*? zQI6D?^=bAxP1S7K?k)*t__UM`elsw+&5OakI@}UIADYcAEKSFL)Dbfhj1CuX_aq$o zfX{;&oxG-GcOh*0*U(NmyFO~B%}cv>F4LeOW1@|GlW@oji7yJ9&#A18crh_whA}!I znj|2f@PI-N0gQVO`O+%>#>@WOw^eS$1-$=H`8t4Q_QcsVUFpOETL8vVLDM3q9^$1U zXSR2Z?%!7PUpDL?lL=-34+7Z@7)oCHcOXt?5fbPB-72tC6$V)zR0m!p*`L5>xC91?d9^CtKl&$PM!dZj~v&B!v~R}i~3`%Upff-6APaYFn0G|8hB08kV#K4)09_b))u zvZGD_KNp-#CfL(<@o7VWOas`mVom{g!``)S`G!#g;Oc{rc3!=rqcy()vg{>|ux%>z z0Sm}*z4mCQ!SL!WbjB}&kHCmIjh6VFfr3)&7|DHO=#1+HKCr@`^$?I=^gv`0eUfN% zyFZ<*u{9##WYd$#rAKC~JJ`0fQdpW+Ts6_%1`(m9JR#ST5WJDfIrHV}pFiuj?ClJ0-$+;GvK*ZHeQmdU8Nkqek7eUBp(;3IY*TZH_ z*6m*2cXSHxACfwDu55g5THK_y-e|cYyjCgoXK-gHcx08|X`&+E5(%nLe~D*E2fG5? zP8FciF$Nz4TH9Zr{M7{P&3J1RdEi>wC?FSD8+xbJWNDEBsEl5qg23$pwpvq5Z77< z70Ok}jk}X&)=w;I+&=^G=ar#OQhh9M({QMyFW1yCaH|N2TbbOJC$4q&W%=slN-3Wp#I8o;yAQE~PF z02ubS=9L*=g(U`+%0**qlNxptZeoMc%3KJwq=@{(()suT2&-K17M ziQ9sF>D@-THMVf-3vxtM_W?SN89^!s2Ga6I{)t*OIP*k2+*^ron{A316UA3g=H)`S z(H@b&3EsF&Rx#tokuWB02MQ`2+%_sP$473=?3FS|J`5jA+B_94)w?Uu6v-^t9~Ch+ z%{l7|s?#EWa<*zJMOr)~fx~`DS=@RYxw$qjEY1J;g=glXIAA{_fpavu^`?pb@&!bs z*Q`?51I|vye-~|K!hE<}L&yM0rrzC0RCr7wU?}?BGEWwa$mu#juyzC+`h=2Xn$P-# zC>)7;jg+fsVttIek@#NNeRbsKhBgs{L`}tjQ*phvk^CzLhk_=6UTYl={Z_lRID>3+ z|FNpIYdi`7m8U#23;ws>idQfCJVi%mu1{9;-!(0_?Y(1d(82ncD44BqEPtyp;Bb&Z z!uN+;K98RBBV6L`6s=6Dy-Zp$XU>jtw^=E$Ba{XHIh&4QkaPs`wJPen0OX0NdbsC^ z^>z-Pi>8;A5rfTPJZ9=?jXseFaejQ^!G%7uKc}qaD&%hZ7zrpfE zzcatqApnhr%UM>_0LtII^>3{ zMV)sUWO*p_ozfqVm_a4vE2E{Bh0%3X#io_pS=rY8uW!$%KR$>|fw(ningUmyV2_Dt ztN;sZ$=-FJK)rdR6uY*k6nQaU0kM~)$}_s#gD~%VQr*?xVZGS7z#d_-#hw$uIN=Fp3Q;-(_~m=zz=yn#oe5~LjK1#))k zSknVeL)hLf1Z)%DUL_joVXVqA2iV9!?iAPEJ$nQ5;JIU`Rnu!5ZK9k_ae;uLbR=Jo zW3th|dVTiOEYP@l!f%z@=FtO{6u%D`gSLy01RoZco}C{1qvhy{d?bf^jRBW!@OBDc zw&JE~PKmZ?;F0(0(7RZq%Qr`2eXoZ(ZWdjwenNROcZ z{zNxt9>1&k^T5{}d`|1!Nx)jZ$iv y|8@`PNDXi`wy*^y{(O{XbcA2egCfG$|Cj_68TgKUGCdg%Y`YVgCntuZeO1 literal 0 HcmV?d00001 diff --git a/docs/dag/kubernetes/images/MultiMasterCluster.png b/docs/dag/kubernetes/images/MultiMasterCluster.png new file mode 100644 index 0000000000000000000000000000000000000000..ec8bf23cbe604e40bac74c3e82a09ef0ca2d939e GIT binary patch literal 35511 zcmbrm1yoeg-abs1Gz=ZmB_IM4(lDg-3`h$|BaM_aNT-t0ISk$1rAW7Qr*tFnKiqr2 z_x|7d*80}xTI%A=?0xpx=a=6(UCoqtJf5WQZ z%>f@EI%~*DA(RbM?E*ibSV$^MA|O=8Ji9YS1%AeKkk@fWK)~&O`it0a5Bq?C5dKy{ zMiSy~c+jfj0_kr(8X4+t<@OL4^$9Y}p{Ly0Zdryy$f=boedrTCQjP2jgDPw~W zvUQ#tzc7sq>?Cdj-X&bCNe^|a2u$i^e|Q4w79 z$*tJ!h~|^P@(6qi4mY?cKGAN6FE-bs-QD}sjVT}O>@;{?m0jCdTlah=TbqYi4Newm zqGPL}W*4oI3pzY6(>=lHE5A?c*p=5$^}N5mu$d{N759FaEjqgnl8*Fa!xDSAHvR0g zPPr`Tw1FWKh>kb>^QXTY6IRxT-slFt3v)|D{W|Qj=4P*(aFEB%O=)Rqqld>P2;}PO zdJL06{8lpCiJ2B%QM5!>vC*}C^`MEGgGBg^`%_O_Q6+qHWo^Imqr;2ux2=0+Mz(Fa zNIdjkN~3f%*LgPicnA(_i}Z$le&6o4H^Q+9<O4QT_s%@YO*k`kbCrc zL+cG6`7(Z>41|B#^9;%&XpBj%-Qw z{maD||Kf#tvw{(Jp|j(`T>8qq!vYV?;lTzU->V!>(r3$!V*;m%31&m{drRZeyfN>R z;J7Z|$&>8cu`K#JbaX~hLieoL%hFqKv?sES=catlt(0c8htj?2f9*F9o>Stw>=%$6 zwOJVk@baoGyO-7O7hmcbX-~SPoMIl#5oNm?W8Ffan+f2tfn0q$B z?`1X5Y|2xI2fx5`P0goVlH)AlDPl*Z#paqrN)G0-kqYKxDSuAI_yen}l9de_b4Qq} ziyTtG$`0n(X(=>is+waH1-#W!rIwwsb|SNd2z*m-9}jnzQRVYKIiz?ehZjFe%gI=Bue{1qvEV7I*50od(nOm8R>f}@V<93zVG?R$HxntaMBS=6bByb6Cb}Me1=@Rud6S+U%!vhb0x0UcFi+Ow6*w}b^d4a*f;aFMmmsOq@ z)=XRyDk{;Zs2h0H!o)N(xOjfu@HFjB=O3|jPN2*HVLGMfU$WS5ywyuF)u7OXl$4b8 z^wO?YSY9j2M|PFfak3~rC@PXNKhe9e^>Ik#_b_W^zmk%Yf`WqkzgM|K?CgGua}iUM z$@qT@Zb@GAQ-?*A!Odz&^P>^5u&`3Uf6tBrJOQeX2pKojkk&TV?!N%13>%Kl4GbuP zcEC&rOfZ95l6Rv=SPLw$hra0JT+g*0%&;^b(=Xvz&*La;Aaq0tUw&FyTB@nHa>h*~ zQ6u*(PfeLEF-0qBR+7I`FWp5o@2ldIU^)oy>m#zY7Jf3`fBfgU@{=X=&dw+!93i2G z6yu+JMd4!_+S(>#{^0`*hCo@Zv-iaBiiiF zfSs1T+xO^G%d-SNkooy}rtzj$#yE;Yf6>kY&prsDDwWZ1E=;)3; zhe!Vxm|cOn)$Sf=n~xRrylc5wCi#Vv z$?wVJ`s}j^-x%XS(}~HJ?o3k=XqNcGG|g`A19_YRb}9vUD);*0+tupDU?6&ymfqQpQ-)47ki-j}#|H+yjeN(`2=@e15pQnVOnnr;^Cu zXL|ES?`Jq$rTrd|&ZbP+5t-j6XVIAG)Z>;~fBg8-%IbH6V{SN>!%7EYf-nNGKd*o^ z$c39PxWCpC-VMK@ZgKa!27-+BZi78Y!4 z9|0p`clC3>8zca}(iRLnk;(F;PPKVa0-s+kQhjZ$r1t*)J`{prgIZQn0;w`l1j3=K z{QVpULMlZ?dN>@;UQ&4tSw&dykI^ndew)gt@YBi9)fI?-(^!#N(f;}VI@Y$feA@3D zDgG9SJ>H#JyCA*GWsf^JH~>N$KYRy+shE_9?pg-9XIB0I9hb`eXi1ceavSdlV?OSs zJCe3(*lkggzqJ}d4T&BT5Yh7YfjGqRpW=|j{p2r+dy*G??CJjTAWh&2Kpa{y976IPugpX{j{q)y%>OD$XaTr@I*9Gz(P{-mD5o zz33Kfb#rz7`Dpvqt53cl5#CYgBNT~3rzs-+1$(T1S`%aHnpg^tY&0-DJ6;ZThzIQz z?EU+rh^@_dei#L2s(E;z;%7-~>^;*Mk=t(CyABqWsh|CMeOUt|#+|`R+S_(UFAi6E zzF$&(oa&UTs#l=+>U&%0dpiU~wsqRaYZmbv1vfVV5%K$7)yk%aHPZHuslL9x!NI}I z$Gh!|i;J(!$^jNYRC`A9!cVU1O(S{8@?;+sSGyGkIzP^8RsmfRAMA7)HTQ2+ZjzDg z7WIS3p3_$;EbP7Zhkjp=qlsi}g}2u62%kk^JbyZqV}d3*Y3!YjqiNCkznB(*;j6tHsfxF-&3WB29Fn3%$3jJwi1%3vyw<2txh-Zda7%mVwjk-gMva=;+mG-h|`@0K;VAp);{AD2I zCN&OAF+=3`-}w|pg*x-{q4r+#8Y{p~QBCp%1*U$1NgA|2PG1j@oVn^IRxf4cFIIF- zaHboju&Ek7j(b)oe%ib+FjxH5dMrEgrkp0j0|L)uTk_`Jj{2o#GLceF!)wsHR0dQ| z-`Vt<+bA@bY?&s8Jw;PCM_FA0;F{ccLm~l@v<45=3Gd!~YY>yMCvNl3ZM0vj5>3~l zI4DU<*RgYQrGyvm<)PQ+9Wvi?S!-7{SJ#wP=ao%_$8-sy*S_E8=ZMk^Y3c+WUFx3gJ8lbso`w4QSG}@R(pBy*BoZ^rRBL3lQ-W-7?jnN4NkV8 z9F0pajnF@}EMoLKp9UIXz|&*ymsKJKf}I4VCG^Icpsy_xxG<6AjyNouHRVJku^ zqnWAmFczc5_r*~jpU5JtmWmKN)eLWM)U3TOUMO8hW^y=w*G0Ac+6G!^s5bAzn+ldW zc#)zK!UtDbV9jUx*9QN~2D&7br8VBGMMOk6J2_20qYE%@)9%X4$&q^GHOa26bsbFR z*{ed{UnC-dLZSB$BWsArXg}KN!#Ga)O~`#?nd4*h)(W-Vld;9y;7;BVGGS!Vd$T0vQSzaj-HF8u3(w80VzmK9+3eW0F{_=$yhX=7~oW}5?8ab@Ydst;jv zWhe}jvY34Q{6#W|4qcr~G6v2oj=3M~ob~A_Gk-W1%=~2oeG~UVgTMYbSEG>KDVW_a zU1{8n=CONq+o81F{nF#~0}~I~M4@U36}0gEkM5DI%1ZSktMq20D48|Q@gIrr7{X3= zKktz4a;kSkD)>u+Z7fDIO3#_dviU%{?;sGyM;O9ST|GTK8j;X3XcBeM41{s#N`9RP zSY(){3>B5w=XVO& zeR~LSl?P^iw2R*snb74t6w{ti0_%5F5GYhR`6V3($Fm8fZ;6TUXPrNO{n8{1xtE2>KlVK^+>H15XeW?ptCAs-a74 zM~YY>&~1G}%OK7vWMT`i9pR(>TY(0ZMePoIK1%Md5~y0*$?yM&!g5jsn-;xLQO}z= z2^$-iY~4Ll7^7rUj8u)}GWn3Uk~Gt8B}B;f6`61&+Z~tv1odAp2uLWpkAGf;9ahTG zKwVFHig;iG_DkO$T|EAr->kPD_C@W_;jv)8wOekBI>5U=u=nN202++2?deiId4v(5 z8+|;XeI&>jA0I#RKJq#i0a7|SIXQjjPrUY#$4m-_^Q;GvcC`n+y%qt|qoh6gaYn{fLJPje#SXcN;8Zkk1ci;*Y%1+49HLnfHGJ@x;hPJgX21ynD)k2xP<#~ znvf<$Kka*x+srORyIP!<^3~ZPPyN{{9iEzFkks_oIUjP$DGfY zc^4Ca*$~qupiTYq6+AyJC-{1r32Kd{2;94W9P*?};IwFeo1LxfFPX4(-f-OaK_riP zxmfGy(=lfo%_P}F{X;SafeAGKdUaVc!FPqG*f)S`-uU>&`p<-9lt)spDMDWS6BH2a z9e9KW@(#)fZ(I!T&%%0D!@h!d#}7N%&uX}QV;fZdWtuy%>F?U|DBEMKFF4p#8Oc+> z&lSj<5J8V?6Se#|6*JJ)dtgSxmWnFyu-yCcg8!;q2M zfAWi#z4YCpcK(7#Ye;onjzmpOo$bRwwN>AJd)4chvs@NYrqqpJBuMXRy;xA?!M+Jv$rGrwDWJeVgHn$?sHeebXdL^WvwQnO8_-$|_J$Pny%6 zug*fy$0bcob5X|l2^o^k-IW+)-9)N0z%1)0YV?zY@`ZO zd0Bhh)D*BffrRqk9~rQW*bGT;r?C*CVqH1nOw9G^qju0h>AaiG&vLGz<QSm&Oav&|`&*;P|ajoyY_M1NS*I%u&gs99L!B#rA6g7r4rn@H(}DGLDY zmrnR6k6P{d=JwZ`b<4M&Hig z$K6{j)FaC~m(6G!pd9JKv;Lh?rWQzH-W5zfDOB!4WqaRpkT`izTtI1r%VApu6bC+P z99N&{lt(3dCo2iRb4_ODbSD7~o4?HB%FB*MdjrY5gtz+FlEL_l73ddX!L&I}hE$1h z<4wcyi|JY|dP!H)(4xex)fBlBK09jbDb0G}a@Rm-T=s&1guYVg#g!8I`m&wH?=eHZ zMpFtldkf0j0NC`!Ny%rb`WnS`H2!zF3(!>tOp)t&l8l$46a?B>iS0#>#%3-cf)175~*2%w`+AAKwTKD>ywSCrP#2`U90!AC)miR(vv|s zRDZ@ghb+e+7LmmXEjqDBKvjK!Bw3!{76;qB!*FZ~@0?>jzB*`)PwOMF}C zb=zyCRLd7=PJJMds}n@}k9sfb6N@^=;qae5v*#%Ac2pV<3V}poD7m^`+~Tij`1k-V_8CwN!r^d;?aS#Bo!lN&2B1Xv zP3v=Q4CQ>PvYPA`n}DV?6Gzh7nYW43D(!8C2)Q=22>}NOhfLhHk-J!{R3j{)(*49F z4^tclfJ9q()AVvaJk)gAK8O}1=@fz1QBexXlIcK7?+iqrpPSRw)jj?_Imu@``_gqt z@>;UAq(mn5Wgz<_9pw)^wnCM3xbGj^2MvPEwKyZ*)OM>N6la$=!oo5I571YBa%doO z*RU)(OM4237=NO27?!7o|!6coalb9>43R5K?RA_OkNKE#q=Sr zW$RsP;|Ba`P*#yzPXdQ_7vC59Zv_DX0Z5ghK<<4;%7tBfiDU^UB#i{hmpn{fm?ubthfIU9C$?wtj-ux{@5YKsxs z)Z^Ds!<6Sft#^u%LNH+*5yEm`WNz-!ikHhsh%s7@Kl8_|I=nN*<0QfBdeR7heWeZj z`eiYc>iTDv2m9{lSC)wIaFQ4AvdV-yve?5qXB(Ya#)D`lA0K053c=W4vETbc*QES}2!3Xn1l9DpxVkE| z<63^udu+Zzcy^C#OoxgF+BXC;qAoghkd6=Ut5<`Yq-+9q3ou~a?RRYeL?KVKRFE@~ z4V@mMMuUg3}Xw&txy6u69@AcOed zoHZ8RMD61DBcgw5>K8T534Cj73Mpk}X;{(!)Dg7f?PW;@W_a!u9eqK?GzlOiMPgi0 zB{%Js#uKgaxxYQz9;pw`YHbyr%w-3GK$-<_g*?wKH8nL&P1gq!I5wF$Bz0=76XMAt z-IhGit*!-?Y-7ORgxatwuYyhS@obgE;S@3IEEKdX!AlAPcCQIm-m1h%mo ze=F%_ety0&4g0U5p`pP+Dj_FEvF+h>N@gZBr~}AkmxqAAC7Gs+c)Z$6GF3?Zkz{mUUQ{%lg-b0AIe!~)+KrXoD>eRpMcF?VVT$ws zolOYVA5E>2myVFkgtXxSlsdq>+F`{PW^rgQ$h^ly;n%6^= z#F+U}`I`7POG$%(-Fm?vi_OTWKqWm~X-kxml}4o`l+TEn-Hj>s#kU-|#B)||eEfE% z0SH9Cn~8B6iGbMZ^s6~y;d=rTn#?!^p4;s|v6vffV}#Och#>yM_qrTL+y%1!S(uFD zEhx&Po=ozuh&=ZF!bm`qIRi`+$US&wb%tDsuKcy?@siApO4wnvS0N!in40K8S>ad{ zg{4Mn;Dec*fR{NnIjK4|%j8zvS+=)BFPQ?&uKzGquQdUdwH{~opDsRCIHXs1@$xVXwnOM?q*YR*gR zmjW!hzu?3RIE~WnkW5MTAVVgTPr8pD5j4-5o>0J$Qk~X~MUMi#Ca=Sl%I{6~iwn** zu6>DA`_{u5LNVs{M=c)GVHh}&!_0@>OrJXd8QcNjNil0lqfkb6E`lhInGvE8F6aH#=jw0QkF_!e=!O_}PlTx!pno zK?dqG5()6CPNhlkMii9`MibZ-{{#WVZ!QSBn7h~?I!Fo-W?kFlm?@DzfIL)m*y3Uw z108+Xc76MOsr!4=USu#x)y9THto7 zfBBYGWclyX)kb4zVW!XR&30x83j>4nsVpvtUrSBhwC`U)so${EzqabXyfH<2ED7*G zO**c#cLx1MCT1AV~g&CELPbgs-MCp(YGgx$QM&@XBV@r}8E`Tp2?H zhQ*lZdmr;SUiw9v1@?@Q{Zq z;fnbD#roEO$`IVFJEj<9d%jlgV4k@=5zLKu&vrjDtA2!jRXAyjHlB6>fn zvyf3-Tb#1vliy~B%KFb&eGa%=RtN2%^4LB8g(Fbe9h#4heQB=cnbs)wlda|JakX8D3b zCoHagFu zAAaD6ArANLlNI(eTIMm|L6-xJNlL%o{wk#LInS#j8y4~pW7?HwgX3Gj3M(D0=G`1+ zz{R8Bk{yX8#(Q~>WL|V0ma_C4G#uISXGG1Lk|Tilh+vV?*=|?e~0Y z+7@~A?>qO=ke76!L9ZClPCUa0teGTv@-P%lvhq`s@5yWIP38BZu;}of|JR`VZx;s4 zWkGwgvpPnscBlJ@OKhuGGQc+tDo~G0n4y2Ynx!KLMGr>6jD5k}d(*Gu>b(Daweyc~ zv5DQHW`tLe1Q8US92n0+>fPY;SbBO}cJbG)cJY=S%PngYuh`ANsQyT6qij#&YA|Ue z>V>FYU7<4|B2dx4SDJ|8UR5!?f0hTGb~8)jSM}P}pL($4Fm1=h`F*<7uZ6?l;x&BN z_TEBOdb-7XeKqBNuns^30GyvF{fkyw`2W^NL4co?1m?Z_ee}CNbVB>NEgV#XzhTi4tF^MpFedlc>mIesq z{H)G2^LZ}QfD_Q$ei7QP+s}f%W8zdNXwu=Q9*_M20)-hZeA?`O=36BLUej%E3$Sa@ znAG8R>!5k(lvcKTo1`gFqvz56Mtu^Hjp*gjI|A(Skoyf)kPIAlCSdf#Yv20k;dk|h z1%dJ=4TvL52S8v7+Ffv!){k>|E0i28Uk0d|>O0w3_eiRfer$X{^-@av?oinhH%O)o zX4zX^teP<8ste4U-)tYvDntb4Rku9U(`G5L=`~4%<}~5@d>&qOX>(C6)B}Og!9&GS zPPoLa&ZZhr%BLA%8{9K#Tv28Fd%~53;7S`my{3!PvG6tD}HD$$g8x(F>|jS{;PVf5_s2xZp;OKJv}7%|-U2i&QM|lC z4Rg0^4YNmve6R?U{fJ&lFWNNQ{gH)UA=G(J7m7Mn_hX{R}{7UDupm?gL}v zs6}H`we^h1j3G;epfF(Mv#QkettQ^sB1a&7`KP_Y7t13N0i(2bFM?Wruu9u7?)_DHk~(mG15B1vnR4A*YR- zv+enXiKQhm$F&{+MRB!*!C*gzhcjN84HPJUkERjz1e)ps1VDNQP&FLdWk6Y|-{Q{0 zUhqn05DqQIr4=h--;M{`F^h}6Dg1zu5L%yi7X&BRpec?VSaK?dR*Cyj>(y{mVPm65 zR}f|yG03{&X@`-C3?LvyRj?f3x zEuht4vR4Z*#7aq(!6;ym#l;Hzd4MW^jKsLHz1=TEj4z~)j5+JtuccnBS_8#bUgq&re@$LY9T3! zSSITxfjY_q<-Gc#P7XQ?%PGM5-;LbUY&1&}FYf(u_8plN_yWs3Pekham(hdMOqoIL z;csAxK%>9piVJ9zc+J{XH zX!V)_4;b8HKm=MsO#=f_?^~DIDFDT*k6}V&-COMrfo|$o`93}XARb1Tt~!s-W{NwD zkiXG*)=yopY=oRa!my|gfDIW8i_R!-5I6?o?q3HB*hYh`87G3i!ADFm7@F4h> zx`U4FiY*3K-$eBO86mGgLYy~-r;Y^#f%n2s$~<&ud2XQ1j5v%8S19@H?Vr+n4)vFK zHRzKyu@2us9*ryDJ3)s+J`m%X$e5z?Hm?weo;T?~k28O@Q_U!m7f<=}dm=lQiFV)% z{5|e4l8@@forJdP+k+{AQb{j#PWOt-O<1sbF#_wHw}-2$USSLl46wg=@wNgi>VEt@ z8UdfM7R>LeIx5L)cxP@h=u`UAxJqKRmOt+h3J&Ewf0 z4V24sOY~0^(KRZH@+t`(cPz%31;kde@(g0ZFCgP48>|Aq%l6;uXlOJ*iuaL?qBAb= zv6cj1gtzTS3@rhT_WnYk=H_gr=^~scc6s#udU|>~&PV|2GoVoy2Y7N;7L!D7Bbwm1 z2;jvkvj}*a(x*SOh;Q)dAd|CCR;OaJOy9Y31>*?{|4&uvznhqUTCnwP?CWK6LKZ6B zC;Y(rRw5#`&%yE^jm|DIr!_@)_CH$E|1H2zao~xbt0^cbfWcrbEv=P%FLezAgVrU{ zA5cTXjLgh-%dwmrL?eHv!iXr&oE#XWbfwmOfzJN{P zba(A|5zj3kbK=BX^6V>%s@>6%cr<`!MUwNPH5FEYza%An=QM12N3nL2u5gNL=hp^R zcVzZKO(~a)qyW6RCI=8B^GD7F(P4pu4~J5CEpE?u(eY@4r0QyGSF4#2?$lNQscICZ z050WgZ1&PqnMhJFfQttOhs44_t^g5x+dJI_plL@-tsFisuWGbeVrM?*Jk~1ydQ*Pk z<+us}T|Ct&-sRkc7=+wX0dTH0byl$<0n258x&=gJp*^=bIY?auflkWc1bNeeRdl&s6-)8ztz6KH#&4Tg&P;B9vL*2N~_xIf%1_;odim0!il6=0JiV zmn`C!p#(4}7S*N)2qzALKoa~WUDYD$vf33~VQVMQiu7V{JYNYqq#vJ@6tajIB=b>y z43r4&E$O8ZBLq)<)swTv!*4HwkqMqK}OWVrci?hdCL zKLI5&DF|d-$N8?Jqx2mDSkz@F_Q^pG7s9|OQrAd_PaZM=K)e;!VrPTA;-_eg*XYnf zOaCAMxk=?-iKhF1qPtIsu43qNb|T@L8!Z1Mzx#TwgF!_obZp0-RLY-kKu!ZETK{uc zeImQj5ppFvKDM>hURPWMcXkcr;p8u1Mi-_qiMDCEyqkkdASV+z17g8KDvmyEVeoEo zXk7XFg~0Wxt)Ga9nx-a0oJ3o+0PRqm{Xv|;qpBAQ)A&t-Xc$P689$6pvX;2oNc``Y z;vD%`i>o{!LK<~bSh!|1IkKMh05&^T<|q?2a!L;DbT*2WMnr=iqFzSNsuLa&0XF5V z++q-8q=B_DJJQ1vQ+agJ-!h_k)UNqw{d^lhqfB7$!PjK>1ICZz!&5kXZjL=3iu>kk zTyi&8H21wVTWl7r7>#EXMe~GlyeHgW@fUBtin@f?2a9L1hV-@OsXmP#2!FWH7Ey{g zCG_BZa{L^&keC{`RzFy>OIkt(i_&ziF%nTzuk`Pz$zQF7+?hu*TQY`m{#m;wgeYaB zNsi<@z3PFcgN+WZ^x5lkH%M?rB*Cjh?A95aOs`;xYx?Zs(qqaJOIcHiWQ5|gy(i#; zhOnMr-s*2X$=-&=eGBzR4`;0R_1h`b0ul9C#=c!P!(qqbaRLpXwZDUeVZ-wgLZFNi zktqIUuNjphNtD*mo0IX|r8${;j?|PePu@&wNZsMqe*2G0rroiUfgwJRe*w8Q-p<<) zG072_82y+OXB19g`^6{#joLBC{!{L8w3%e&vzeg1^1I2^#>|XK#J>IhGL_$E1yH90 zqMyL+>y!1Tq67e4RWn4`JOD73gi|*tIXW8m^Kc69HUMg0qcrfn={T6L2Pmn0QG_H$ zuZ=9#QC@hAe2totDe{(yp5FXLTbiKP>hP0zIkc?4+MIVq2j7CdwV4AenwMpnFSkUf|a9y%ww`_7rrvZRVaF(K$U7nc!Tg zthgN_s&BHx9e9AMEb8y?1tld4WHe^U1eq;1xdIUE$l2MMcBw9^s)xr-Jd@Ij$HkPk z#c&$t2vFs+sH9@hhnKwt-*0Zm_XH@j^YLPCr&{VsbhN8E z&WiGT0)TI(>0;@=;S#7fa%zf5DqDktiWaAA7Ea>D{<*IKM>MVXm-E1pn)bP-izomt z{@rLZ1GEw=znkrsZ{h6jOI}BGJhA6vbK%PxBw zW62_lK*v&cVjsd=8Bw-&?b3${VSX4HbcW6ECY6SjAricgOF9Cxo{5#(?bbrp30kov^b z7vMozC&wMGH=c$=p{tXf3-As{WLrs2oak~I?NEFJJ&+2&%RO+P*V&0^o%S&tGNEPF zScT80(FEDr6E5f`H7IGt%JAu$=GfD!I%4=u=~{D+IQaPJ(-FRPPF49b z*)xX_;e~(5DH^J4EvkY70N;XE(`jmg+V5QHygl%1Cl@xum3CXpWCyL9C^VFNPsCG9 zub%VW_)lo;&tyBO&7F^G_-(No-I_$Ff7;VcJ?*e!n>L`b*SII92oGw_p2u5}3BT;B zF(Hb3y>F{VGukW{l!yOcqw4<<^v8Pz?wzF-Z!Y8$Nr>=51pqlE(W9j=|i>p0O(Vkq-0kes1{ z6$4i;`ghG-#yt(@mh2?vqI(EDqr#;^CbWzxJ?}v>o;`qso<3BE9+NSm4bD&NLyo3I zNf7wWT&D8EUz>_B(&0U5~M6;B>%h5R?Vodx@7I5}9+DIx#*0JJpx0=Uh^C9ea&e$L5ZE0q?E`BN+VYW_AjJ{x&WcH zuO~h_UVZ}kZ94+zl;{hdVZP^Sr}HCzJff^^GAzhEEKWhfzq(1EH$e?&s3ARG(VX$*~w`g`5>V$hxP+v*9)mg zKnfkbOo$mHV;$qcFme9w-#0ds3N;ehkr|`nAr9@w=HTK=#7!6m=e1SRd9x@zulfNk z^*Y|CPur=|z^zddv23WJ-jUat`LG%&mni<*8=-YQ_QRG23`F*vmF8>49U5C5>Qg#+#Rn<`RrkSJm%>gJkuEp8 zjTT4pd$fAXU%f4JHo$2KbvNo)IX7At^lm?zFR6E%t^ihN>!-wwa*6fDxT|H`RFFK? zfI25FHg<1slO*sQ$Qb`X%(?F|%)*`)|4pWYpXztDN;Ha){%ipbA@A^?A z(!;ybgK2F$gZ_hZ_1W8d(Wsb(QtxeZS#_dGr@tr5G|kt&yZc7K;ZefOR3NA?quX>W9f?oUP}QWO1POYgE=JmYep*Yp zhY%*&wMGvAEN{I8&ZT<0Y>w;*G-%GWiOik!56J;+PqsH?_jmX$*AskfK7=xESHN;^RIiFo_Ml9?frb=yqb9%Y^ib`kJ>X!zvu}?BcTEpwFO!NS*pE&H< zh)gsYzwYvqzXDrp>3BFIvChSte|^&#pD@{)z-ITsZkB7KHV?eEV9h2>&irg^INnsK z#QP0}xIyE3YJzBsv~79_i^)ZQ6bX485xm0dSdS^iyT!oNueAh-A! ztvP`M%_e&XO`)|ezE^8A+yEuzVpmIyyUWv7OY1$iaFdX`-_|D;n2%E^Q(sJ(M#{P9 zkkxFfI#O2X%L(?qcN*ILhbmTJQFx;Z>F83Q9apY|XOr_s^hAK*b#}+B&pNy8;u8;* zNWf&_pjN|9o-K{ae$_NF9$aql!}|=*#3EIHnNB%^uDdsoUF=Abe6{B>`MSD(|7EKK zjHbQJwO3DD-Iqg&5x248H%DnT2YDFBqBqeZmlXZX_|13jjaHD^O!mm4H5(ON`+7KP zmph$O{WF>p;E@ng$#=T?0Y7W2WY)6sBkJ@ktjV%De6F^FE=uvoV-m~eJgCD{WwbSB zFrlRA?XLWtfM_?vb-NOyfTE@*4sdgTO7{uY%FCKB z4=|bzAFm7c^C+hCS<}j(F1UmamtmIu%}(fj^R?1tJD*x+&sHqMl_~11XPw?3`Kw+7 zc8<~pjx;}_d$SZkJyW76yHjD`)5%@&F~X%k;^X|dkwMjl%#PD?3%!?@Hf}Il-8)i8 zK8X>f8RJK^k&V6ARK;rl+&_o4C_CH^ws(n{4oEyf!eM4I<|Wl>gp zUvg0I@azglHc&MHXX4*;;~UHv3vRWH8w30$I;b}&BsTPrMj5WSvzU95P#RIM|G9i! z^`pOi)CMc9VEL>px>r;B3!+_PlK^KMv397w*`_xF zdYy2zE3fc!ss84 z>?+_qdfXa}%D_^Z`T0#6|5d%uHD+Ybo->jb!X5|Q6UfV5;6uPw3a%rg)V+x`6C3PJG9os%%z=NmZnIU8OTM{$I)Zah=!wyy&yR&NZg|9YtO(+Yr+2US7 zq(@ll*mGXTz2VkPt)3dv#F*E`&s&ChI)u7V81BcBP1EmR2q}{!v{7s0Jj-)^XNsxTZ|a_D^nHSPni3dj5KrG+PCH zv@|>OnRFiKoRVs5xiZ4Y_RZzbKdH{5%V5;D0O!q7YZq$S3HS#_l_p%*XD$YLy1JG1 z#W`)io?h7@W+$NXHs#QL&F4ZZbk#pG<5fUKC4vF`)&tSHD)LJ$m%fC+#J0@_;>lypEM4jjync@NjlH~X8=Yp{_1SBqAH}U`pjgAG zF3IQ9%Eey@no2U>ytCl>u=(oaQM)cow*o_V4c!PxOE*Y2NOucJNQabkN$1c=3rLrgGy`HFoeC%^h~FCbyWhR{ zclK}ZbH4AK<6q+pGxI!a*1FfV?)$o~`)z4yDJXezbL8gc7KYwk`?^cVsb%xL9~&E+ znF+o8{Or-MJtizvgk@NZNXNtKtXE9tTy5BzHR#8z zsHRP=P8y@TjgL(13s|e5l&trGaVR0HbofJyLqbYbTWd!L`NA(ypgGwjx*Hu;>?D3< z#-3)%NS2hv$loS-;mAGGr1jn)Ti!~oDU(Lnbw!Q0$LH6X(~3G92`Ls5K9Dd-`0UM2 zAywr~5K&mP5(^Ein*}mCbGPjXy0Ra&T-ibJsYM!VYt^g?qF9(P`kAnO0ttlxWy)+x z_(KM7NYh8LUW7<#D=l*njlD@kRtl2S1?9x$>chd5)^e_39>QJ!$dlgr$+ zVg6#7uy@W@JTsn59YG-(1CBPBxZ&(t4YIiu>;Z)A#`#)mn<%ZsM8suz^73*~<%Y1T zDy${{qo#Lyn4QQ(#0z@pze;z-!cdg8W`a%=lyGGdzi>0@xYn^N-4xIkw>Z+1-dhaO zW_^G=&jeA6vCs;G_A?id<#ei7Rd}t7uU%^vI#|Bwp_l#f^Jh;23M03({2(B5x-H4L zr*PNeoQ=e17gJRK&e=9mW5$SWie_~rU9e&F7KGuTFX^zG7)qz0#bU>HC!4kLCCs8d zR%KN3>lVr2G4CP{grMiZ)v~x!?>TH0&;I!F16Z%Tq?Hr{6wlt;Ve+8|0YA2Y)C)2@OIH?Y?^lXT(+MJpkN{+XDhtsKibL>)u5eJSsiNJ5Z zv@w(>2yrKv5GAgN!+6H<@MClY)85{EAavO~36^WOsCQwA9>uE67AckL zPJKu}@Tf{mApvWhci9^2-xUu2eLm~Iio}ky#V=w}eG(4nHz+{VDfHin18Y(Li_u#@ zHBt)m$a$Hi1^oM1}F&>QZ8lIAKTruyR|E7YMepQ4^X%# zfkZ&uukMz`ejNLcMiYJCk_rul<|7) z-#FCU_6`mS1kO%>KgPvr@Jm%hv*mY?;II7g0#;JO@bIDG-#LS`Gxdr|w%c(Z)WI;( zEGi>rw2m?3x!IJjH>9Hm&(&;Cs-I|afO{)#BmStFBOqk@nIM|GKq~kbNW-sw{3w@+ zB_#fI2hXpMLv9#Mj;&mYfM!56P~%tH{$>?%-PL%N>ccIx=893rwW#wt7Hkb!y|+Im zwer})#1u{yGxci?WD3A%VPy8hFO`v|j=_u>3IUQEl-wh~x480ZppyQYV;5saWJ5u55&+#rV zr3Tu|#rAU0BHc^PfT1|{?a%SDEgB0}Q8A9-pW||9H6JSXe5Y@kb}`n(Rc;q!u+@Pu z>;(pFh4$z?#{guMnY|&K1Hnsnk)zYql(v59U$$64o5l6=XYYkCpM#x{BuYFw(b& zZN%)%5ZMTKtpeKL-dbBrV(ikc{@l@PtEUIPm=$@7I+S)1wrvA?@TLkE`6!U! zjU%_l$z_F>Hel^EHUJKq)?cU*k@NfsB`4qVHQaSR60SqN3$a(Tdz+v^>_b9XF&T~7 z+SWGk#K0gX8r4@f;4e1$G*_nd&n4MP%;EyVg0FTHkWTCsZUSf&Z6ICUIFtV<^bQb6 z?5FdAr`Jn4c8TrnZFhZQX|CqY=d~QWF_J+SR|ldN&g|N;S%Vz`$bOHV;)3KkJ=M`S zl4V6T5ClCp8JgST3MbUIMb1c!d%sA%`q#2Y3H~RFS^r6W3-OfGuN2z8c}C5uiv7rQ z%KK@;o@W1yqk_R-I|a>4vS9cU*)UFO!++LkHR$|#Gz`I8P-iOkao%PAvv&K>xBgo> z_rH1y+yf?l$U${w@8Lb=6Z{&@IY9Q~u8E9w0Q*kBMjR`sp|Wb^W@KgxF`8IBKOH&$ zF4K9%#lKK_c%5-`aCV-JjB2k?Ag9ybe51eI95C2#y6V0n|u(uUr80Y%IM5Spab z_&Wj1Y+_ESzWdCWH4`Wmt1{Sh}(%xKUfXL^qkGBf$b#beUy$>IMRvb zZrlv`+V^;2UDXn)>k4YxMAXw24?*h7MRO=?P%44$AifqA^ZwDnK^i$)$#^XCi84xo zh5S7V0W`xl4dLyCCr9l`9*&M-be*;pd@`zBNh!%_LPA0u?a%DOw++{kuvF_?ZLb(e z2Y@6Zj$fvm_$AomcrRVlOXXS-gqY6GPG;>Uzi%dQOmMW=GzWpyiAvPl*4~~)3ONJq z?sW6rYojKVn$ol`6c>(ndFsyOgIow6{Wtvob1v37%d5HoIF9u ztKYL|r}O}^*D#u}@<&{_;Gbz^ykF#bx!01#lz`5WlAex=Pl}>jY!)r}K<5XePIJ!J z8a=9PA2sy1w8P+(s;-sj4k5fpm}c>+w3JbAv*{hJF3lE3Rp~++R$v1vTNv7TH(8&5 zE5Y#IX932M(OmD=wS8o<1Ptpr>2FFX{!?7a$;w<5uv`@sv-yDVS89AVb+vvv8(GKC zcf|t=!)Y!eu*PR*E_rZbTdN4M*X}Of=wo)uwAXRWk_ByGM94U_R|A+jyfR26n6S^^ zl!aIS3Pv{$#ZaE>LWzJ%t4nVMZ`F(@HZ`oO#F^T@OOOL`SgnLrJItxab{z7-6VOVz zd3m3-I?e%(BT#{Ey;W65_h)%r*bV53RnNLbP8r_ z7kMT%j~iosT+|Ar>l|VG4_jinmzIczJwE8LPIKi-Aw$sr*PwCezk|klF`^v*fW~+K z3($CXoM^AR|11*ma08FTQ;Qd@jBAF_7)yzh=R(4XOeT8%^54vxP@|-hn0bWkXEUR>>G{94Z&eC3N zhoB;9<)c#Q95xN&PqiyziGak=0xS+JTuM%P6+QY)1dMAXHl0mNgQ$OJ6AAv+`jLiL zbr^%{Ku=Gv6~K2upp)g6(bZi5v{Imm!}vYCvrr$8GB*!+j@967#}Q7{TxYyEPYwtl zh@-nVa9gt|Y=1|p>=Z`@g5PPJiW7VI^s6Mjx8V``(qDWX8_pTE0LLgLyFCo6-bqU<-pN~fs|`X0tFQi; zsA&^(6ubPJrJcg<;S(cNg5>TW!omSG#EmA%DHx|FxkkG5GO{{kn$~Hn@{St7F)tMZ zLoWJ;5t4s_KZ=xUbZX@_f``-zRb;M`=AR)n(Ixqg&Z2rm$0N#}MF2DCZ-%kV*|lyA zjV*uWm@mFlc4gQew1F*x&&&>i)5|{BWNWb{j1$U?B$nEqjq{~5z?_tf@3)%dU`rIr zylGW_JvgxUW;G?T)+8jV4JA$6^ljAx=ejGcadl4;r>%TST9xWN73G8Z8A|!snf+xh zr{Su-phU_Q^5Mgvl9IY;C@RNMhZFl=UVc?hJdWa(^QJOK+qdNyQ5TYu)5C{lqw(2p zXshl8d8tUJ^DnK$khe>nOmeqm2_aCZ?|$e##^D*q7Gj(Q2}dFnn=leHE>b@3QqtI3 zWmG5|tEQz1A-AXFv99vQJBKK^Al}@PD$l-wQi1kn;_|L}D*HF|9V=pM-)^5ITV(sU zjv6YfV5a=Xsl^aQut5Um3l_sLXDbZMzF0#?4Q%l2>)BjLD8KEjWyio;U~Cc(gq29~ zJ*{jSW+nJ!*XjZwJ7+)7%uh4!W9?wu{SS8Jl2yFUWYz ze_uyD!$@A0vOP0R?T{&JUpkVQ3qIVbZ^*m(;t}l1CD7|sfqg*xKIG?koJWB~P{~hw zS6AmgxDPm4eyQJo*n9d?xo#gw3O<`GfGfN!veO7XiKL^q2hfZ|-9?pF88M)-pK_%n z-7Yf>pRD+Zy4WcBkzf9});^q03Ud81x#Yp&(zWY&$Yc}JcJSLth)l^Oj{9<=B9-^( z)y>}CL#mnKsoaR^>FMtl!v|k=qu;*u5^}_IEx~#AOl>zRdCtL$NWNwgIq?3GVxrNL zSe^A*etV*Per&!9q_$Ea=DTos##O>t{eDY=-y`9j_s5C#FNcGJrYii~pez;)B zTAo;a^>YtZaEqRZTl6O=+>ajV`jj9sknotK_c?`O>JFH*9MoJerW5sJ;I^rE^}}wT z$01Q6DClh$wRGXWe)wee_P&_|UcBx)cobmXf;~+xh{=D7alZASXZR6fl?<%q&3Ag= z_OPE~{|`$DEG&x>q5nLr|5s}-Eo1A+pUpnNJ#+6*!$pXXOO+2It$thhlEnxCX);HA z3NaY8a)^;z)3kM)&}ZOeec(-L)uufH6DnG}nE_VS)yZNRnGkR9ukzZC{WCtx}- zb6zLt1U6K9U4nzouy~DU?fJjwojd&Y#b%*y#o(7fS0tWvVPneua_L`xQL}=Hk*|bF z_T-J2jQAH!7O5!kI}zr~4w7pd8E5hYH&HfN(@F5bf1n3wT>=Yj1Z_@LRapnzu~aE= z-oo`|9Prwb;VY%Az2>+Wh`9`pD*~^LvnCRbbZ&(UfamG-xUl7wO;|8_yiP9&EWm2Vz%gI3dj?oE1LEnxv>_bDkK_TmoK7GXpP0^z$=j z5N>z}U9*!(%JYQdY z%qI9SF!E=Qb26h91vQO+*IBCwV4V~3irh^kID!FCzRNr|Ri-s~QEQZ@H@Jqm!*qx* z(h3{KP|N_&ONeabO&+S5`07u0H4p_qlR>Mw1H8yOC63|Pm|vN=bS{Yx z$%$(}%5}mY|IyfHkfOg0{#yLTlMgPkS%aiP=BPm@;@PpddOtIUaQlYzxhxbT6Snv! zYM#l~0-MUQ(e;(hr*2}33F zjDrJi**v1(s{+z$f(}4&!KVEtiHH}uIKASHjGJ41yl?S4tg0#z0*`Aab!VdmK>@VK+nZbXG*XPG}1l7FCVAmamJRzF!@ENt2T0>02fjrdgPML=fct60<2M^gXZ4r zSwZNAbFGW*4)M+n$?*8Z1W2#YIE3#Hn}$%PQ^JWSaoVR&1OZ79w}+UFOs$(M0=6`V zDc;l;*c_u8BZTf$PLI^5S^RTi+WfWnNshu^ch-8gvRS6>l~02iOBHr|)!%dPerh&c z&}#2~c6Ib)-x4x);kf05;w}PdI(plhJ@#;!Y-AE2fpTPlgs?9SGQC@wqNq?>*{|8d zI#F9Al>up4U2$m7BecXL`Ow_x<3ziP?3}F{7o#os_8`1eT*W+S1ai2x=%^61o$pUr zBdN<%xrwFs#lokl2p*Wtu+5>l4AD{78p4#AEY;kA9UmiV(*ZDS3C zJqmkWorBI~aS!cZOx9SLuust$bA8PwLEhhnNaOK{dceo6%P)@(4-YYLlm&{8ak$IcXObbXxE7^bf2Kf7x%n8`vFpTN+x$WVgBbLe(CpfSd;Wv3HS zexN)R6HOmq^qzJG?_KJ`dYXzCU04)IL&~M0!mTr!JIHG=apc(3fc(mn9EzPg#x?9Z zdlOvz!t5~$Qg}`_+Zd${{g3x?jK=f?*<4#`ny%>P4D%7~3B#x@LnDFvq8M8SdFuF2 z34J2gN8@7zcQDM%54jcki3g{AH1UVO*1S?vjS`eM8B4=Vex-wH&QJ^GdzKCjF^XiC ztInq9G7IFgRYmHwMJ|g)ONk*QX0TUfSLoL-AGq~#&xD5KkTYMXH}~$fEvm8)oJ8do zS?svY$5m~sK>5TjzopdK2{g&?o;Tp2hS6ilMdUCGtXR_%CRa1X5n{Kh6P2gxR+sZ* z>Tl(BLN%b`&r~Q{heMiH6*gWjtv6?l(`sHk4NU*O_*?~PSelU;gXY2TE1gIMqH$Ym z+`z*A$l_OOThh%qFId#$O2YicrruQs7%`lVQgZq9CZgOn7Y&`Is0lEKp&>&iEi~|; z@(lO9MRlF|82GhQjRa7(be03jI7#-n34a<#%MrokSxa^th=0N#mFEbJNTiUvn4^*- z4evP-I_sSUvI_8%rDC+GHaOctP)Y9FYmDTJC!}=egq|p?C)1lO5D$D*WNSOC=oDqY7tnSQOxy=( z{8z)D9vHH|f=B}wb$o$rAJr*~SOJIE^ewAgt5eKlN4}(1PEjrHR#-xh%-@^#5o%AS zD_i>fs-yW4jMUh!2Co||Eq-Rvfd-6?Ko*FJ{TwQd@_DfUS| zq^TxS>sB``u4MLva}x*NyIea;Z_=I=4&&;J+H^xsG1|9I4KbrExfYj*%+hmx|x z<#AVST~-s3?L9NmX|XP}w^)_=ZW^gSfn#CA7vD0U#}0Gf^J@Jp9+z@{2?l1&4+a{5 zDYI*GM}uX;J8_w!>Yk@_q^@+lQhjN$#vT@Z4t=GKj>+2!N-Js0t833 zOCPJ@dI-@Gyf-hOoy-qjt)`OiJx)XR6u!M=5yVB>l7wr%!j4%9GlMvoPjLIl)a|Dy zNDc2btcBJ(hhE}(n9;WHoW-Di7JvNQ;AXBe4&*^9Vm`i7aG1?IynOch<1@~X`#HviW@Iv0|q1Ox?aT zO*xAZk#+NnP1$$R)B6%UKI?T($#tloQ*hCxfXxN=(|YqK-z0;c`FlNQrGVPROBk*Q zR&@33oD^J6|EUIsn~1gsZ_i0MX6LU-A|$`V)=~I7;surC1OYX1V~Ob*pLh|c#LH+S zG42pe7K*@~rLt$M?!j*7rnl6TrrK-KLNo~-i^EG$++-(>ASm5lq5cALz0}jP%9;Ay z;c+XY$7a7L0UvIrk5%)Q^o9<)u0#dfuRiB}uzSA}u$MbLlzXAPBfFd9 zYqs~*+F8TPU?l{-{Z}MzsBDpm-MevS%QTsQ#`Rp_m8&efQESvU89Td9C5F)W zbcaMY+DxPQWCeaE{ZP2ihSOB4>vlIvqZ7?Y*GmLxUA=REtN?cS#F{BFX+*ofM&17f zm(iT3XDBe-Y>FE-aUvmn`l3lQUP!@M)RY%^qdv%P_czw%@hPDp>moPO?EotQxTCzL z{e87j@CSdQi2T{z#Tuo_9l^2+%YDgcqF~_C0hoc7@s(9C5gfBf!CvCVkoVlqk>I%5RF62S=KTn?qrnvw9B4@*_46deYshQ>z4xUV#>v;Q46-~EL0nD7a3}=rhu18 z@^rw=4euYm?UUUEy9OKi{?lvV*5E4ROs+TG%fJsqTMj zsOl4{h1md(bz@LOy=J*woJd*5(f6Ydr09j;lHSP4P*J)M4Md_!UD&M@tS2VBtxnJ^ zgJvuDA6ZWv1QnhO5Se;!eAD^`%s*H|xbY;)OKjzSiD36@Da_HVyYW?sU z>M${&@p-nl`GT^>>O7#^Y=%pR$SHWHr=xI_U3f6ZNhHl0J`icCV(tKX1_1Y>YWC&X z^f^+J$1hYYZryj!p!aZChR(8AmwOkU#tzR~{sNyp5uJovu%OU0d;YVBT>?yO;1P2r zD;83Kw4Qn6KE6D?Qjx?ZDgJZ&>2;f7?ZsN)<_arkrI%6D+?Y3T5{<%bJSqX}&yK~fX42QJRfJ#aR`V&2Id zdN%(fNLR#%#&s)SV|T7di)X3`5%!yJc7SE^k>hRa-PG~r!!@vQuGcRf4eEwoT#7$F zdmgFZUa4DHAx~;Me0JD*-T8>{k*EUu_^&T#mWR7+%eN3*7g>qkhua{u-=E%;C7aH@ z7!#ZAIcZBsuQ7RSq4q}UbK{>uuaMEv3$Q-gd@w=`wtpb2Z8_sgWOW`NnY)%*qRt-A zdw6*VrZNB0eq;J%yElO3pxpFtuxo`$rs4ZM`txf9kk?-t&VPGlfky{t;Zk3^@hIuI z_}>4Z$9*++cr2nb@L)BY3jfQfdjI$+2lLK-n}Rxrz$gBj0@FBw*D?p-+c$Fi9{ZkyRXl?e&e}J#9RO(cE47DA+2)%`p(Eh9ve~3NtKwA<7)~7jTh~L z4J^j~t}b1D;+OS>YkAg{`B{ArKd*U{`7PE+6W^a?yr007SZ10}9mV?d5|#%!3j#sx zw;0&x_W!tw0d{=Lll?~3m$e|eM#`ajVNe?QQ&Qgiy6L+!86uglOAi<-dJGlNe~ea7?s$F!SZ}^RrF=#{ym{ zfG{3>iIFv@qVKk{zj+om;_j+23Bby3_k5G(Pjs&wl~@YH4-vJm6eN>_fKJ4`dz+D% zR(5tjYs+8cl`WI%bjDHdt1-e4Pj@cgYCac+bsP6F|6^xn@EggK)O808<~aAS<1?cM z(C?BxVlK@8Ts_*x~cuJZp;O7%bUR`(4T@6dK!FiI$W%T(_-6W5PV%D~Y z1@{_}|6>n{8O&8HElUm5C!BY%J9Sx1JEhIavWeUvix-RHhZ|NJowHsgM7v%kxHcL= zA-9I){xyxe4^F=qQ2nxt!+uJx@QPoH&ub}0H#OYw(Yv5$q@yy-N4=_vxDxIr?Uh8n zo33r#Ru~G8&n{Zl@@Td{sJho;{You6S)79kqxEG!yC*^(>!NA zwcvEhWdhLrtt2%WneaqhF$P}VV^I7Z%GYjrL9hn0acOv(RE;pB*UPV;Jki&0bN$f# zPBhPekEGV!7I^r}aB7Exb0$G`vzeciK;4dpd z8>R&$8TkzegdSkj0`Z5B9`ym&3fWmTRci?u89paq(hMr;;?KV8nUjX{u>p4l8X;%m zUosfzMYV>nLvBysIcdbeMo1zt0Pk!*Z&2v>s%b%5S80MF<<$Vg(>?e=I+sg)%a6arG;%Q?wm{S( zh`a=bY=xQ~(4Edw3u;8`VlGk$DgD+L@dKvE;~mS3i&a&#Ae9TEEnilCmNl>4dPgu=xUjm;C%MK-p=N==*DVECHI_; z49*qtvhJ>Dr(_#-8cn2dWXTbB%cbUdXLp|m*u>8UCC z2H@DU&(AF8t{kns1SUe!qfiT9<69Zyo6BP*o1Z^^*lL};vUG_ri{pZw08_1gDQSWG zfMsD`InxGHAw7(K&_Mn4G%h1tPm<-{{v4c~O)mj!lH1j`7dZlOH9Mlv>;st@8Hz>pTmhS1g@RZegZQOp%Fb)!7M4`F zUUAO* z{jk{eJIMG$#CVSkW^JeED{QE!sF>Nl)<75F#A$?4(vzOf;XAPMC*>rFIz<0OY(PLgVor?1SMd9gISW>xRw_`K5+1QkdVH8z^Nyyu&w*q=ViDakCW{+yj{kVvQHXL zkJ}Nu8~&oL?3C2+m2ki zXl&oojOLccz|c}XXspUu^f>bo*J=}tz+A6hT~BbnF5kX{A^os|fRbKhI;n}6)nF8} zT2}GW>)u}nNi^aIhliKPYoQ`Y5?G)Q%Tqwo0c2qyCs4STicSGcGngMfnzK=L|0Mkv zaD5$!WP3IePa?o}rM{u7Tw>s0?Dn22)0#H_nT*`${mf!TG!wYO5e`qa=WC%hcPvy< zA(Kn(f_E;v>pBNEqkHe8^eMu;=cZ1C6)88=ZAO$rDwmyezk-1`*PFQ}VTU3a#t8r8 zCN`hL$XMI}wKM0`=|Y{C5{okj{PH%W@sR_bH|o5Q$p<|^*|6H-#dP)@tX0*(PqT2r z)0s1b7rIE{0ijB~5XsgVQ!!^)-4Rl)pOy`iVJcqSNH59)B=#JI;}c-G&!AiWLQ1-=4A^uM7jgm9D+qWfIbHLV13d`f89Lb60rIt#OS14F8!%NGP~CsV zP%Va@LLP>u%wm59egg0dt$2okE>y~WBgwYLx~+y?YDq?>(A!`C*dDvjaN1smf)gR6un$Pm)vsS0{@u3#WvxF+hVJpHic3w2 z&^Z-Yq2oF5Ra5GAxG6rw&6=O}46a$)t%bKnMU?Bp#e_;BrsX1M$kg!8V zA3Fv-*`O(ZsF*spn6KiHN9sY3M6e6hBtx)Z$P@3Ur!C(4)wj|Jt(zXlJ^H(m-_i*n zVUXZD8XJE=cr8Lep*RRIhlb;bHh=xm2p9AOOs_@)fDC}!eK_IgR;Pux$Gt(or9WBf z*B)>RuZqJM0BRUBKpXnl9q0?4U%e7_UaSJ%a&p9I9CKc%G>m`N&Va-R^yR6U z+`wn)7eDTfv@q!jY{SEmx_)FE>+$zuuGa>=D5)OUPl32^YGSe&nw0e5J@&Q7I$sE2 zw&qC$`~boq%RW<6Q|*Qtnc=a}`$`uvF);v1l$CkfzpT|*f(s7(;ifK2ra|??50p=H z(E!2;@aG93DWP0AG52ZW0}}i*8P5mYvAK1^7iBP*WBweR15ppaJ>*X)_88=1EVU1w z6+8VK);Kx`jxZJJLJEhL*q-yN?QT?yQaIwy5k~~gHt+6Z4TlS9`jY-#MQ-_E?t>ug zd-xSB@{z3!eG*PCxG@Qp(bJ}}i3%`EBzeu2iX{x>jwG5i)-D`mkNG}pw@>C%3(t2j`T^DPj{v$gk8y#GI;@+5*X=#Sk3M5zP(-8AL)XC z5^cM^GT#p14`9RJ3P_*;kI7<55qY*eG=>vvfNq$;)o%X9G01a?7F+V`TVW!u#(Lhw zfo#Q4p7C|vV9G4$9?*b33&+J3+<7#wta@cP9)lJv5y8g!c6bPtDtU2rEk$8B`P&8oY^Z+inu=8V*htGl~9kfEuRvT<{pzxDeD z*p?f=d#dTV6;S7rQ>#5}Bi&;8KC_TT1 z_+s_>zJ-?~&(g%n2<#H7axALO z^_ZSzp)UEmQ2`mP3dYozEae=}O6d$n{sw88aM|yMAF%<4Ou&f3N&}Du8^dIM>5N*j zn^OEU_hiuRNs9LF9X+BAI%1QHfZ`ZnZqzVB9V^sYfUxBFJUKok49i7Ow61cF#Tn?t>>Kf?ujZ=qICRph z8<+I(U3?W90bE81WuK3zO451QTUFMZKW0f>SI})8 zK^HY~D>!jG&Lo@GIu@2)4_YeAVQ)LkTZM_UxBXs(t}DGuO1!bP+|oM=UW)hRDnuBS zMnq-`lvvv97Ijx)(6>Di#wrfcLf$F>s#tj%u(PfF9^*zf(mlKj&_dw%rtfFdMUVaf zqkX`k+6Td6qza0`1=kt`dq4E+{hHQR;0nr$&{%1_60ieN2AHP;0pZxx)M8&t6sEo` zR06Rpus*iv@MP#x2=V85!pwq{(dN8V1GvV_AzGGFbErft>Q!}h8M)BAAYJ3!p-;5K zVpK+@n1X_W^lZZ8OCR(iDB0(lc{EKSW0YH?W#vbgt~f7SHY%j-)pJ^$pvrRju*vvr z%RUF)+Dmo$i0@5&4hvXwZ_3O+lfn>ZpKD@B9qyE(iBvRNZP>R#Fz+6EZOD_402|JX zkMr}4j~T)X-=zf7$wT^vnUJkD3neDalAG`oK}jHJo*rOq+Xz$3@2aUvWMK&D}b<0@;}e87;g-AKc^G|{Cupe}aT z(Oa>he8-j^yGPWj9eDwow&7ZtQ(wl55p7OpMGmJLXcr#19-kqk{--%G@FeCUO}m zc;Zg`SBF}nb}Cd%*<@W(&)z;)85_=w4|&%?;{$k0R<3*&WK>(>}CMOb)d1}<+qP7 zJ`VvH0-~)YuMid^B>Uoctq-`RLSxVsMhTe|xr`c-`~(}?NLqzPSiT~}Xn%J*Ad>RB z8hvGP-0G+y^si{hO{2*G2)6pm?Jz?8up?6~8$EZowxIn|$T=_i4-aeC-@!|Yi!DC@ z_8l2-;X@DF`>%5WIT3v67MZ+qB3G4_8Gae5_0Vt>EBS|~iPWOajg15vV1|ao0Q`Ue z8j?T8n84r!v-BsY{X3u$u(MxTv=eH}bO(UOKNz|HXVNJf;#*G)YmgYAB*mkU4RJA) zs=tr_2WraNz_A9lifC0+)YbhE4^`y}07Cy?w9ekhwLD0gx0Vg|Db4MdjFb$3DF63f zJ9Hcm=Y)VEmEkWh^f@Xbfa5>9Jt2B5(FEcP$X#q~So^1q0qwII~Bjf@igLo zt{`~>VjM^-$k4z?D2TOX47OVoYC-zlKMaGEgk(T$kY}S?-_Yb zi3?zVKgUH3rlw1m^$1SBGH~t2;Vdki#_fXEFaYJ5VA7R@}w6WS79`y7b`*yUef+ymvv)aii6$3Tvg_(n(pbwuQS4nOL9G!S>vhqeI^|KQ-D(Uy*1+Hgw=!Q%N%jd$cK| zx2Vc81_CYZjF^TXr@={!!?q;tCx37iboqTC*`Hnr&qP%VTDGV)tV)O=$cM2J;!fF~ z6r*rxBmGPpd!fXr;er#smo7a>8=eNCuV9{yD;E?uNWcjtia?xGnqVM$@{xnHA>V^W zXVA)yF5A;nIC?}@XjpZGY6T+${cAOFLKj9T&>K^)F|dGs0Hh#u_A_In!Zx&;RMJ_P z?X>tPv;@Uua{KJx=gONPFp-2cc|PZBu33>uRldb)L%93o7iA3}3xcs#R>hPf6ZI9*H(!P2Sj!TfXhgDh3B1LTN>!N+Rj4k@=BRwpDz;7;<8T~GZR6Prhi4nFaKXj z-oXB2@`j$5v0ndUE2k{Ii?U0NuGj;dX@5?p6hZP}5rWut)PC}$524&d{wm`Mf)dC_^Kf#ScKNV7$8wE{xWKtOuj6QSy*DvbRp6H}VAU+& z351X-G6N2fB3Ya^vB_1pFIB`pzjotN9%#Ns6Jne-X)74zO!p$Hq?^pjCB`7;wFJ&P)tO2RH8MSUz=H*K>1pz4O4UW26m>Hyc zu!mlfk^5CiUA3~X+CZgm8ay*xV`;ox0Ve%>sTjJDij{jR^ASP}RcsEaXP1s{GcprW zYvn3kBK`KR@`Fv5biw=wQB7#YQ+2r!mw%uhpytyqQ=|d?;J8CQ;)z(NN;pSK&hhd6D{kL_Y9wQDN4xEO0dkRB&&*qA3B5kNe|Ig06xbTfK^4j&-sCA(A1NW{tdi2Ur7 zxTqCIX`Au>n-H4rqXm4h#C~g2Dvq-LnnS&|1XDtYD<%9MIw9YCDDGO>3}6O{Y!;yECZZ} zKB(WM-xy7alVkpj#u`vo9f9ei|2Rk+O9qC zUmFaMFjUyxp;P)5a`Ej`E}e^|ZyqJ8206p6;9kB|euPw?c!J|tNbPl~~R{bc(eC{>3d5W{yTQ>+>UR{!`qktjUROVF%IM$%3&`IxTTwtl=>$ z?LWOd2To-bFW>4>4_CdhN!RdqOeh)U>JN|X?~~?Qnw?c!r_3q6kg=ka4WN}R`qYY| z-9k)B8`dChXG@<#`HhUukB>X7AIkPY*$QWpe1C2Hi*`85ld;WS_gC_X#WL?ZJotShd9vH%S_j}0{tG@$EFDN~sszIBSziOQyyd`6C9W*WX^ zg_#s6wtMS}7G3uB!&1^xRDvutqE6I;7OzMGoK{%rz0ZMYi-Zqxo(4QiBTB-IZ513u z-41Zv#X1Oju#58{kiZo3n)bfzJC;bcEIdl6Wu)K|N}cq)8Z9Y)+aqi>K865>K{ji8 zO)N4Q3pGYfw9DJcL0mGzXFCRtgb-wgi zdV)IQtM^yGQI-w(;K7{L=(fZ!I(VhwKIohAh@H*KWDpJEQhOk$86%{=iIt z$MO#IZ4#0&#r7rBJzmDR?{O7z1#ynOgez#|VcE|=mLBO!+20q!XdrGNYalR)aA<`+ z$1MB(@cvUWt9P!gZx?lIISeHoxwju~6K``lVjW|12Tima{Px}b^9t1utqI-#wm*?S z#Wh6gQ6%#n!X&H*==jeu(%-A8SToHs-6mpsk0VQ;fy)~eCvB+8!8lG-LQF%l(AC+w z*8Q;iP1ml)c-QCdq|bF+{IvV=SqglNo>An{3|S6Y^jYM?Xv1QB@%9QZ=8ou!&Y4cZ zCHAGS2Rx)GO}Ww~YSy?1*ldmN{N zd&_&POWw;JWGpz^I1g~vaSX`9S!dPmX#Zfn%jU)ILb^{%z-p|1KP!#Ji&PaSvHX*U zN}UpA#)~{TO(wy&`U(<{5Lw}@tZbZWq1yVzn#FF9@>1VrP!7jc3g{CdNQ;7x9_u}e zPw&;5&oIpO(K*cwtq*O$(aDBp8)q9Vhp`!r83<~*2isL_eM zTreNkRP7ge#dfKG8GH*J4HGS;l{yF(6!A{(9q+qDynA@TA2mP3$<@hK$whqZYIkgp zZ`W!+Rw-q|XUbzbf3h9-EvGt1e8gpB#dXwWrp;SD)g_?S1=w z{e4v2gvV)Zx5DJYCiV|kI|debn|-f5lnr_WdTe{-wL`V9wC@!r6wT`=>Q@x?6z$AJ zI{4U+PYX;n>X}vtG?-q$mNW=;h(uVYX@(J z-;pQis0v@Dk`kK|u@FgiIUAXp6&X8?+uxPWd^`Jg3>VYL%}AFkhU>D}Z32BFsQA)R z)RCixt;TBGYy1B3_igSwOdm+wU$)y3C=-0@(2Iyjd74rnVbG{%++>VloID>ouRd=v zuj=dO8|7>3+wSAwt8-R;^85mF0XsS56O6aF#B=RknD?*pH$Y*frAy;j)JwBTV<{EE z!rvp9raX8!NvlgZdj}#N_drZ0<;~rg%|5-CEm_;1G>j;&8%jSCI@ET1QMiV{(x@#N9k zso|=s3R28!q**xAe3g7(tlY5s-kg5BdXn2a7jKq}y5NAl4d9*q0 zj9`QK`Lm~P{p-s(Js3SsMLb4j7HwgMsk5ot89L=U)y2blReobFw(T3;f`bV^1dHqr z$5)D|^j90U*Svn6jUF~Tmd>g*{=96D``G81;JLYXOZe0=zc03rV)@t+Ht(~Dc|dSM zBU&?QKh?18jhee?nQrl1@#jR*R*|rOMNM6 zbJn%>$x!v(^MnMmyB(pnKlK$6oqyUoc9M2QhcvB>b@WsVxW%!bDm`tw5c#>9@(eXs zUsWurSj@~h=NHGa{Ufx|(v0VYpC%?3NGC?!`>ze{DqQ!cOgQ{RT#Q$JPBF4^A5(-- z>~lRe?uHA@)7ewPlYBf&-Ssvz*~@gcYu;A58{^e_T_y}vu_HblDNh&`r#Am|`#q}? zocNInMuk^n@05Hwb~I6u3`@qVK{yG|y=)wrtt#F8WmMA;yW=_608903&J?R{C}7Ud zE%A8i;@tytJ#gL2WsNB1%1%CXeMNJFE*WUsrT8gZQ2B`7M zF-DbR|hg@!66YCshUz$ms`7am&(1d6eJ=hFHMx2<9+O| zsCO^_n4c|WMKZonse!P_{>)-PnWuhq_U0i9iw6oVSHgO3E=IyBW*pOQ>Z_d96ml^X z{30~kTSL3#C~R}6Jkp;(G$z=F(9NORo6(Q?hd%6T_hKT)UgzLVWnx~ifdtsyT1>Qd zae1+@v{YluFolUyY2JVE=NYkec;)ZL6NTmze4k0tUG6;snMAx|S?A3rfNYa(Gh#@Wrr$&nU$+~+Tx z+}$MT=#VG+@6TV?Y4OVDpEEhS{(W2E2Dy>{;pXMy;r{Qj!LH)SZ$;H?URl`d%Gx+s zIJ$y!NQ&?Zh~I4g|N75AXZ+WmdjISxz{mUVJ^%HezxNd9M&7``Zs@Poy7?9?mn4oj z_kWjO5~q*Qn*#*}ilQj{Nb?oy)*NQs?2oCIKgadwbrY_wleOx2f#{ONwh9oY1E_-Z zS6)FV7Mu}kogQq9mcx8-m)4C(5SuaJ-ksm`4ZhVoJ~a!CW^(iSa}p*)O4pt#4MvLe zHY>v3-d@>5Us)`pA_<`=sObOt=u}U8*x_R?^S|FhTW|;!_8$G8+bRb@`MA0G=mSt7 zShWBB09#W2-!1>UfSvz$mHvMhA;mdevo%g8L#fYHB?N!tpB-*m?e`{$@SCN)<9Ky> zIB~CBe|}R_ORHj~4}_37 zcf8#etUC!K=Ztb{z8vp2uC~|P`*lk-)%hDXpJi_xlL*)7Z`~r*iDIJ>N0Zo?*jVA( zt-?t@h~X!D%Ht2-$$S<{-Fy;ZBcwL%A1GDI^qdl_s;cLv6V~33oU-xsas8nFBh>wp61_V44fnD+ zovE~;Ct-SGoj+G*gieT63q9VRbHE;uJm2~pHSang;WDZ&pWU1K@MXq*m(B-!@EzX) z7zzAfSeazcnm|C}-Hb)7(UQE>*(XESKEe6D8OH_{!y4_r{q@{bub%l=zwxHLciIb&wJ8d&JP!J(tyAS-61 z{DJ27VVu>2k~!Gfo;&d4t;U3eyXT^wd*%%nVcbonBMA$${&)B>spl(aS|T6FY&CXw zck2$MNWhmj$BV+^gGin9Yn~UsnI4-J6;+)W(V08S*DBa@*>8&}P2mzo&6~0KwmBqE zLp9>E>C$I~|C#s;e;|0$OYDT#MwU+lvJ0C`TOm7Q-ARPXdh>&nD=mGFHR+q@MaRKX z7p;yn_rJD1*}db9sG4XLEi|kfcGCLtAOMPmaS+#q9#xilb&$)tAoeWxY1Mvjk>b&q zp>-)_<=g9HIIr~}?T&9SKGl|s1UWkwSM~n+!TN71%#E^?oH>t$IRp9Q>p>ZUsneAg zZ-krWBdF)SN8saJ{@Zn{jh^)>SG8txi9Z`mF3*o^dU_?IjIU0X>*ren(SBR~X+lA- zrL&Q&d!*=pHj-+u-gLIXUZMb2KhD=gTYIH%MA*QwE<1UgJ#u=-(8Q_s=Pj|FWRLl> z5~j7v{mSc$**e!Y_e9^7c&n|cjNxItn$CoQyxY{`x>tuK{vpNuUI*4Q{&PjSJs|B3 z8dQ$$&Ji^=o|O@Pii#nL$-DVhy-_{Mk%8EtMwpVI_XetVPkS91m#mR#)Nj{s{Zk;fdPSCwkS z)WJgylPb)PP%?IVq2%0-&=vDUxQ=?sU1R4~jB=k-7w`LdLEPbY1-n>nvEacsn;Lg$lQZxV=bY<8Hb{u4$#@3B3r=XXA{FzqS&?p9tY1{MR_s9!LR zUoB@}8->YMjFOY&(+Mf#>s`V3VN#|p{-gE1*%kew%G>Z`W3jx}jH^#HUTf)&FTZX2 zog=JrLD7LZHHn;aUmyElGn@EdRtc*vSX1bztlWa>U_t^sv}~zq%|Mrq_Ulm zA9P^7Fxf8Xnq-w`v% zD-lna5#AG3TDg5R3*9%z%cQRUM8M*&_)OSfb%{U6 z2M+R24JXE*%<0Wl|1w#hzFX4jjZQd8iaJqs*nE9ia(Tsv$v?kRSrFsrUu4uU-c(;) zRNV6gcFAY8Y__tLWK`@qcU&+}mo}1PCD)tuFsyFdkU7~+qc>?VEdIP3;WF}@ex)f` z%zeXrH9nAjOS~q0TQyqb_YOk7A!^+LQpe7q4sE%kR?rGrl{ulyL9kr=2_1 ztHym~{c)Sq`3ntxUG5I< zleHBJf0job(Wc!sF)Mj5CmlS3t}j-l{^%_M4!sI(W9{SM_h5pWIih0tk^brFfPYFP zx1aQJ?wsk!<&V{#(PTkMf*m3#N?;E09TAtTxk{1K6@+xjt&N!W&`=zwl%}CTx&yJ@ zez6@=*PY0?^YBJ_&bpz3s^efLiJ+1QIj`jy9oZ6`1eC$6xbqH#3nD#T2YcS{+(ED2 zEf21r7vV7MSs#w?l78+w*X+iK*vp=oaI~mnkT7t<@BeXsDWt%PYx5H(D*88O=P8TW zDJ6+NKS*4L9#c%sDX#c)>YkV|OhvNMcw+prYoX!KjN-8|Ch5qd_5<&somzpp`d-}dmUoFuub-uK z#{O`pe|UYdkEo!C4wAtbMk7UNq|K4Iz2S2x!FsIcp+6)J1G}PPi#3vcQ`iU{~ z_%J)xm>AK%6Ln8aCbuum_{e+U_8YUE@8d6ddIR1c{g_#}zB;aKoz*sQuxRcPSmO^m zs_hG%56%8<`y=9HhqL$h$N7moqZj;Cu`6Y)<<*fWf#$fa=LlG$Lp6~{WYo5O<-Ha; zr`Iq=f}C)%?T2D{#|qT176XrNZ5GwcPy4B_K|I>$+^C!j7#o|;w;PU9LrBr=T!V;dNdVTI`r!4u5(LqKKFx^r!g^kdGZrM@~edYY<<3tIuqU#a$lT;T;(u^(@GHX=#)g zZzu};mcSn#c#ki;TUf6ZtP|T|V%x5r6;6~x+#DSAt}DGKDwY!t-YuUvqH$Hg+{d^K zz0xvz4&{Ts^ACuRSbFZZVj?!Rbc`6iNGf_Vg`aK42Hbntu{^Tu^-j6rrNnLv8usS> zmp_P(Zo}{W8H)+j0qrd<8>5oqEz_mr$hP5nz4m%*1TNhndc1M+D2*^ye1m>oiPyV1 zPLCQ&>zYxwE`)*VY@PdoR*?RsBK5lHoY1dT8v+su>yg!CV%hedU20TxLkca4uFu=B zTvW7MlO)E|?qgK@>j4k9^&&kMd}|Q%C8)XhmB07a_}dOo)Ke9U6;mW!LpokUv*$)NeKA6L&fp$WIzas{d7;kt6<(S-Nvu zh_IMR>daTg{Y@y@pDw(d%>74P;E}SfOS6Z{ic%LwtA^Q#j0oZ z%O+)s+g#nOi!rjc(PFKcMH&vD<3>k&uM|rf%aoj~Pr3Vs$Ky-qDDIF9XAPK-1hO4m zDM*<44?e=2YIU2fm_FcW1W!jGQzr~YFtVdSg(8Ew=lQ3N;&Cc!-f{Nk<(D(VPQxge zgsaiG8;YPub_?9rLx32Bcw|AqdH-HdNsYq#v1t=)tix)9${s~ENT}yEG}-bXUg;Rq z=;J}gj}=tRH)M`Dn%=8{uGW3Rb1&s}UDi0DmWA&aHn^;(nJ0A25vK+1UMw+75xHWF z+zJs5O%J#Hx-V$6xb|8Rk6dv5GCKIa%X_L1TUJu%@z!bub6p2lbSl%A%E#%Cp66tt z<=CV=k@|yXXg+;wA1npnH>|Ny&(#XPO!A(~BLDn{onUza){@+^LEZM>-$K*c(6JZ{ zKBQ3nFSYTO6-uiYhmgzr>!^PpCXk$jHqxHg3-;kZ6VDA7LYjlT`|5ky$f@F=Q|dnn zfR?wdP4WJlGNDzAgJi$ev%l8hHmcXOwY9zAFC#^zLG@j$l`IK=1HFSjPbFpS=ekt# zO^s}0P#O|^-|MU4<%FGq_0AS~pbCX9+^fo7!skbh(|b-?ebbEtCwimnrS4$9$Whw8 zsB`1b%~D6QF23<{v;|NOZSLfiOI0N$r8nFk3JuL!Py*kw=UaF-ND_B*UqE)b59o@8 z$#k_%)Yrz+F0gb1y;wg9BD^vJp~jFyrkbn9lRuiLtu0)`Wo8|X;{6~k{Yu{#d0~p?zS_QhA=N-IdI3Zz17NZKMQwti0V1gE;3}@@!w79HPK_|-G?ho(-KZYhXtLRo6xeF zn)*{7JMTxC9Lfz5kHnPqqZ4{nKX|scH#U*zaJEd!%0ENzP!BaCx0_(%jdt=4chIn# zp5l&)V~=tl8^L0@jMUXGg;cEc$JE#N`lBsdSPWOltHujErHmGq^yv;nMQN;$6vT2E z*UM_hbD8<&nP{0bw{i45f)cn{_9s|e$y-PUtdCbERyvL;Y@K@#V|$ohNc=qF;-ggxZnZt1{&IIaPOn2w_y~@MFa4d$2kRNT08UQwqrPYWj+?|h;^wm zRNwQ{i-v((Hry!mFWe?<1v*;HeRB`?}fTq?$)-cHRX|d9FaGxevF8 z=A3wY2w9v1cTbZjR-yvl235*kw z?m4X3iRC_;qscN(+v{2NfPCE*Ol-d8H~z=h^kUzE!=w0AsJK;(x#ero)7QvW@~@l< zOajU3`ht$+e=;f{0A!^baUizmkIehHIq;Rv!WNt{+*~`G+;)B zbS1@gzWJZLrd&P%?4v8G1n4HTO1RiC z62dvTcDL`%(2aBB)}BW`gm9EZIOc%qXwLgXPbPA%d1Tf%cF?_hHZe z8odE&%bD9fL|9P)DcDjcohBihR%Rd)>ci|0l7ZQn+{vWmv2!KuIR9e1i9*FWwb`WYxrUj% zHp|4U3yeyMgYcqLT#EPRj-q)2$5q;KTwS>2aXylH$#pvgA5ZmatpnFnl0?k(JoDTN zw?2!YDHF1&1==q-dCg81*$L~_*=85!^UnLbQ z9QqYaQD<4ibw$C*Xay}Js$64zt|GQKQOd-&FZNN6ra696e(&X%9vzNovK}4FZl=Q( zsmp+-d;Kt9G1r{aU!8F=7?kMKi9tzElSO-?vcoJ6^EYnS{qSQwF3OM68XGG&FS~wZ zyRftUG0A572PiUSKhq|-2|$_A40IQ)(%2!P{n93Mds4$}Z)|+rve2>&`=MZwi3vU6 zw0h#W{ZMseehcpTH#-(JSKPbLYT&Kuh$8lP;^<)9{z`5S0c9q`23yo?YFKU(R zXp26p>c_|u3+3}2OY|%D+sZ#Xa6F@W>rBAdb`M`eMprQZ4b&V%G%;F+0TeLWZb))( z=M)3_H##Wo)DKQY=;)6Ydw^;Gsci{H0l~6@Vj^Py3tDgt0D>r;i5UK0aMH&Gjl(!7Xr9TrH*I?E_L?cp%z6)$F0oai8rx??h?6a4jP<fPDbZK=zm#H0K?AJ=(iDG`7+Y5cA8r^Pa|X%0viz}9+{X(`W` z9OH4gcm~AStI>FzCjFWBeJaY25EetzZ-F|68pi)oCkr7!Duw9D-)0 za_Ew0zaUBHVRM+y zCi&nvu`zUIB+P2+N^-*Y*dwXYPcx?>`?N{D!Oc-r%IMy@51!$05y{S4cx%OSL6Px; zDiM3t{URf{{tF+9cK(^;^xF(GiCmu-Hg)N_IZrg+eRi~Ss zEm0IV@C2WRsGRgY^zo(sdb#s!pVN~!5LVu{+fh)8XK~d9w=nY*K4S#l!WBPX3nC5^ ze0BKR_+@>aYMIfdP)5x?vcxhLg;Q)dzA1m9!V2r8M*yC6L(5e_vuP?1T0`L;5I-WA z7L^Y?I}_Ebs@EsyGH$Q_R=+KC1_Dvo}d>uSG-o}S*Id)h81`{2<1S5bs4ZhwkBz3%H4aYVQTPLyEHb>0w^{cy#4}keHSVA? zsU|S|Uhot9pk-Gn+84+BY@5oXq&G=I3?by-cs%bi`5-vUh&(2~BgI)-Gha!9=zV1i z;2!C@n=f3l@V<&eu-+J${`wKZ=X0`K8NmRU+)w2CK4%-ZzIOJsm@@AT`_`@I5bz5d$?e_^U16@SfAn1g4?`vjw zIi^06W9Wrrq&L1#9uJ5IiQyMGlqo->wB3At^|ORSP!=U{5T}sWNawJ2+k4?W1rO)& zq2p5LC+x$qnWkSOi>*NxQ+)iUgug?6RP0L11MG7@{aX?OXeD8dK)b-!y3c2>@a;f` zK!U+*+z)UhWtXc}xIX~-%MtyA;stUHRQn20XMc5 za(O)Ot?KtD%w!U(w)1k<_jqnu>iRT-IUU~fYXqqfIqe|_x+n2`ZHX&*kW(NzudtI3 zUwHWsR@#g-PG4^5H1ExCCNA-7c`dpF;;gIm`S->OW8wK%nY{^u?9U|toeKtE+$8sL zJ?yq~B=N`7ha_MKWdq@T56MM&`nejm=prP~td)qo57r(4>NBc0Sxor()X!iV$J_yt z)%%`5-%=2N;SGc~L1yXWOLRN;OLWVm-Q1dhj3Tz-;NlJ_rREv-=#u6uuRS`kqShs( z#0M0*5Kwl|6``u{Yz9J?WREY+iE@abwAK(+$~h1b3iuQ101LY{KZ4tQI^xW9Y1EkOL2E- zH|2BKvwjx}-I33=jSVqP8n zqR+_q2o%(xWUqjnwp84(9i?O9E0`YTL%`_FLj(m!L=jTb4a=Id9FZV}YZYj_ECynB z1I6vR{9RnT%RIp2qd#j&UL1bJ#^*jmVA;h=2EiiDXgT@w`>_*-*V%fmFXoAUbx)xJ0BAYc@&1VB=sV?2DtdI2?U`674o%H3u!^NhHDd!qIVgaX^vt)J) zJles}kUF<@r|!!N2cX0?x5S$Gu{Lbi7l;E&mGx0p%4q#sMwmIs)gyH~^iMyp#Yw&J zuo-aS7`R_Al11I4fV9)*CsJ(EY>cE>MV2CEG;Gt1%zvjokBBSJ0(M5HVxLw?H&foF;!t~yOm|5Zk1BoytJ8eLV2gGCEGxu1b(w>FJ z_u$i7nyA-BCfeqQ`yzZZY#j2mksu@~J1x`I{2&!p17Gs<*%BW&1lpIik;4W*xakOA zR)6RF4}3^_0P&JK%*#z-i)L1Rx}I?c)Q@h!XwOFWmE%J&7+c7?UfXiv6hO|l7-A3X zQ~W}Z>detq_uih%luHli@`$RGyWXqE|CzId^h{%oV4uc|3}$|RlsKM!#`GjEl313U zf}-c*bYIxh#2zJ3ns71H{6QtL#SOa^fP=&~u zUYyzK_foWKwM3?y`PmcCsEOxy19`w=ze^{hH^zjs)mir471{Wjx%8)lMs;w|0vVz= zmt*=2qaKD}J5#`i^PTSXaEFDjLKkcE@(WEm0eQ)}G@iMo4Q>8$*fWbao7tKPW3K}` zn$KHu4qel0R73YMtqdJ5#lOclLOfKe2ZtYp=XdM#H_CowMo4ZLoIVaCpF(vx5QzlR z7vuYbu@}!tfka68Ry!x$1|wYJNEe90-o#(lCB6_y97Jw4>@*#vDu0tkmLDYeN~6U% zc=IPo#C0iG>M{>r!)wHNG-*cQ2}I9f&KJ}WFci>6J_-6(XpMESJ!i1epS)?HM@6MQ zpmw#0DYe_zA^rEAV&y=qw{w%lJjf;Ld=AHSTw{3SR21?cY*1Rt!FTDpeavZd23(*i z)dA0dEDdK=lBnAnt!OO)=$PMFce|KV--lODR#>U7gGTU>U9pJpeQCh_RfZXB?P!^q z{1hm`4kZk}s?sQd@35UC%)ig-vdcoeP>_^gPoZAL7M!3!yC{m}>BClPOVyKTz^Z8+zxzgT6usL+kfvl(w&-Sm+1iBzX4;9xkGs z`&St?z+gO$C$t&`r{Ln>q*ZI827Ut+0!O1z<_}bo!PZx9Sv5`#bxubVC)^a2!6gWK zl*-dy{BK;&Yw5w$KffKG#)vkaPya6_)U}Bi>z+w@@a*I91q{7Ghoru zA{p)6!F(-tk?q>wOBDl>6@i)IcFrKElz>MAF5dVEC2)ldFphsp#=MKTZY9Cad@${i3lLw<$BnNaHSK=GZSvH8j{;F)2D5`(wLK*&bE(U+Qr&t^ zqWQ`0&nSdbvC~4+9>}qo>s--|jW}L2bD({|5`O`zL|-?c6{cT{Iw=8p+JbkIJ|Y^m zMI?X!rmIrf^e_Je+uSv2xkStXON5^4iNMwT6dmLz`QZ6|a8b|ip*LL~&9KIdEpI#V zSUlhdBhesujJMtP)oQ=utVxXrQ+p}ErYtDV3AAax_+0$y;Ab<^lp-8$&_gdbqO$oS zT}py3O}l$IVbb$eJyX_ueQlt`|I$v8LKgoH5A;C&J~En~fEM-5URa4r8WrB*a&hwK zNXgvg@PGy}S!U)yF_oL@C+f*N0zwE2JeH3EolJx$PZv*DQz;}^@1`C|%KP?)-%2=> za+W)2vpP>7q3wud5|;1B>*qS8rm{)a@svg z?@Lg2Yh7u|uh0@Qfg9(kVsZ~@43JbU0Pq(Z|19#5vwHFyzFR3cA~S~>dJ5chOycRzV)sG!q5h;-yZ^Q~TfgH5v4A`zN) z{1vn&jd{;iDlt)e2Gg$$pdSZ7wNWJ~^|Z8r34!<7F#9n8eI*C$Bh1gpSLg$vvdB96 z>0M635b>a+*EHEt<;c_M^POfXhvm8nK2BVIq;#Qxo3;7tvP0@hovVJ0&Ss&>H_HJD zx)}f>Wb)#93uVC&ur>sY_ZFzbd%%pM7|Ug3K9un|y^uWy39ktixSfHMsOK$(ah%^z z57(*=WQsh-Otqb<<~+tfw*@4tH7=ooT*GCa1jGiTa%L0wtYn;~f(Rs8fbruF8uKeU zkWZ-SuQ}6d1lN4SF=>2C*Sup>ythTBfOBD%0ZIQsgMbO*-jj|{tT#H)p!N=GZw?0x zG1!(h!PDv)M=|eai|Hr5H?zC7HY&VC9kXT1|N0WKPsxvHtgY4E*x2CXw3Gyk7FhwL zf__bNSz3LFj*)xJ?5p1&`TVbZ7D8Q1vbhOxk&9wUq~PI{IrFl{ac-;P{$bsZ8^l(I z9(vDC#vZ99GdcsWOLwE^zAV~fU+T#a<`fnQuLFgz=D;*VoD&aCBg8mBG4#)Qnyml6 zEw>l&`s$f-p2S`>7bSj&?0QwUF_-uzrKW*|vR*f}M2;BL5(WjKAZQ%Mf!=3eUP+|T zwGHrWLB;GO(=q&Mfasv{H|&=@w;x)K{6vUVk3yhI;D!6R#0N}jF#v-pclY!>R^2|$ z#^tJQk=#&Jy;?W5B@o{YpyKFoq5`%bq`n267*`oG11_pvvO)D1zy{*ZtqMpRhh0x3 zkPJXYYdmdyl*Wi*7~3*cVWqq?4>u@h*%JE&Ih)J@z+dLz<-IQEMNyA!jxY-D@LIw# zc`yNB13OusAPX+!0m$S>QB9 zRs+C}#zzx)3wups*)O#KjHDXXvo6Z#BBQ7-PbCgDLEp0uI%-ow#-}St7@=IDbI{*O zQQ>UJtenOZdN#~eI*r(UPahr$I{PEoocqKRz4!>A?f{Pl8T|MONuas0n|VKNnhxQi z`4p)6TM8{_TSk{jpOEuaDOlZiMUV3cAP-2LgVKNK6qT22;7eUNivatbh&K(v_wz>d zgEFk`G9j^mYOM%SOkP3532H3M8Hzl@$7ul@3hR zCTTf2a()JpUv!L-DB8W$Ll8h~H@Tce(Y+>x>bivf4d zOyqz+Q>uf?!*H6`Wp}aFWx@A2WS;x!&792yaBgW8%i$y1ACSA6O`z_%036lBUeXw) zG13*y+(T|)|A{Y^63d);uy_pV4hvfyNaY4I#=z&8Q!EB7fP&;e?T_YBO+9`!rlr&M z2$O2bx0slZ2kClyqX59n1KTJ0uc4C|2ec}wDyN_Y^@P9ps>290U{9yfi9j^WGvW{T zg!?^2a5I?)iwuO%J-v{U>W&5dgEWXJ*2vmWrZ4Y7U2Q`D!{4{#d7i(%e5zmLn4An_ zX7&+oL1MwQ7K~aty+u5QKVYO3Mup3F;jKN>(4YhCLJ_{g`?;&j5P32prT7NrRk89gISWo#HWlZ ztE0s0S@{dWRN}bkN+yt+m+;dG{qXU`lk4oCKk8^YgyF# zY9TtNL=e^Ahz8LVsnYiW2B^XOd{=kHg;9fsB7Jki^|t~T`#A!^10R5C8CBcIJGF+3 zZmE|G!#GiY>sPy8&?|%K3Lh=T`N3+ z+m4BJume@%bSc{92a$Z%*7DhANlj*M4u>gn3Jri}Vmm)BA7YszgkZ@&S_D&%g_7W* zIw}|q8rI-iUOQvEKffb>qiFE)p`oG+DK3KXDrO$;J=0tf8X5{}#1)<-m=O{yX|!+T z;!Z&3#?QUK4-Or`%;R_QYKH7-LmQ|!Hp5kRI!^K4{4amWQu4ldlei?<0x4-a%NMq_ zs@{%7EtWG6tp*6R3%C-WZOj1dfBujLk&{0+x&X+5&*Hr|BZ{>lKnLxI=5}C_h){jW zmsN!4%;jH?1x>VtQS>|rzE1~c<8lbSeE5g=vd?uYs;kGfp)--Adyr|PF>VCtZm_cX z1)tfM9bMB^c8CxvJTCXr`$z^T0J;zAgHWoVH+VdRxL~ZGg5?^Nn}5gF9ZlO=oE@zDP3euxLbxJF`|J!N6Ld^hdgG7YJOMLD;q^_6K@om94#rE1-ZD!0hF zuP}$A!b1C5s?sX-KroMV_i#6Jh}Lh^EchjsK4CskYKGmr@ibwfn}C#Vb)r`Sxa{(pS8nE9H`P4z9A`fk?Y6C_ zbph4rGpOF*o%lI!-lV`nT8jei24#TtaYIK=kf)151opy{z~eU+C_Rif_+6_j=kkg3 zVS$bB+&G{Ctd7UMsl;EE8iF9q$fVws$VUQs_|8yI3wRYAlwl~qFSqJFS?(hP4oY(` z1MRI3C@V(+Uj0cTF0B|8lO6XzP)kh5nga9W-nfC&>B{rxmVqbGC~pRSu~Sau;Jge- zfukNe=2V|@x2;L_e)0V$ry#Bot3Ch$x&S6jsR4%YnXo{nNdS}wqgI|T4k4X~Jbe=S zL1;ECcq|Jo;y!S5x%>)Y?gl4G9ywDV$U=<_zsgfA`9L&kel5#kSgYm;%$}5Du);M{ z5iZ`nqQ8{Z_wPU{$sFn*B?h&GZSl22Q3~wSn0IgWl;u5dDg9JQ-=)Heex>tSc%;jc zQPBx|lxNBPPh>yQyZ0jJBh-ghabkQl;s=<6nWqoWK0kZ;Qi z29B%|;(PB4^{bQ)h^UcJ>;F710C0X_Q0oECThkq}5wx?_RDWZT7!7ZxH`180G*R(> zD8^&>?M0_DaEzYccWOWgA&vN#jlRHv?sD=oI83tt-HozL$O$Bx58B?(41jPP7cf5n zlA~lQ$hSG)V{=?ZXvUs@#^NPtYKJ}D<%C#k`}bAF5CYzUVoly|_4(^9s$M&Yv`0b1 zoR)xD0FOx)fKvMDUCn!-R=%fD*dCv%cek5@%{U;lC~CWm;m_ut6dVecB zV8DQM70Q|;3t0whT3~kgMLmGtlfj(@kO3TyqycFkk7c{!Iyod7sxKvfy05N*Y+Sow zzzcMu!vT4XMH(J}YmDS$70Q7XJr<#__fQbaQE_u~bNOIIH5N$c@*B%>;e4&R{_E_8uyZInyPE3#$h8Al+vL34aD04*2$&idsNPyveNFRmx?! zbnb6~3z{9__17c-O%nnActN17khH>;OLPGg^}B*gPjGFvm*q%7nvZIBHGLnct6FWL@vJo_R{^hm}%AQ zF0#J^4grb#xonP*?{COHNdvsdUWEU}cU+F#C-HPrXG0NN^sE;wb)Yl2%g#=?ISy{LG1e~&~lD$Alt!j*D$ z@Z>+-d4L?w5u*1}OCIdp^WLR_*QldCg9oekh&nGqLjc_Qu+wzzC==Q(dK0@?=t_Xs zRqK27{N~aR*ivBYqgFJI;0+vBTJRo7Bp4fY0rM7F&apuGajMF_qECo~ibXzX9(Z_i zNx{n=Fe0icSX(F=Yfl^!Hi9fo2VIg}KTO>i8JZ9XU<_5c zHoE{KV9GqCy^+onutiLttpF_}bf-8kugv|9lwae;*+lcx&hJQ(1Kj#swibz~x6>}4 zZ*sr1wI2FNCIuDsgo(j|jX^@A6LTp+$6E~rlbNH>` zKZ*@0)b69|FdiD;r49f@nYkNxU-xB1j18XOUF}O`M!viQpLhw#{`n1%@WXLBJaD{y zq=XD24?+s)wida}&YPQ=!uVApWZ7MmSy{iRw$pL(D~y}ZqH6!}hS#|XA;O>3ijo*N z8>f@L0$KtB9x}ar07&nso5?JN>-{Lk`s+?A*ko&Q1IVa`qR)6d$h-q5dynJ%m@flQ zwF=X)n#_& z8~>0z2Q~BhtMQzEOZ=NySi(3dp*)R1K>>@35m;0`^|V@%-`0k7<0;iWuC(Jf^TJ2P z@0^@1*}Uy$F~MCJxwqzC$s3CF3@pWx28_y zv)N-pjzPYyW&o-o2z)sI9RQ6k5b4@cU+o+jBNR{ zs<4317$-OYa_9Ia0DdKu4is^<-KXBPlU&9=wj(5(=?vxz*pB8kc>J^GQ#o7P@iWKhw|S5p z*2Z(Sv1x9+y8^o1O3D_$7!co*>cnhIjN#d47THe{#Jj59a~!H|MzqgBU(oOM`72A1 zEZGGb^bmQ`D};Ayrz|anKR^WlqfBVtg?J5&R#P`+Ir zWE}!Kz9v}|iNcsLC%yCU$RV`W0~O@Uq1Dd6V zqGVA)(vb6zl$>)KK=0Zc&-spT)vf#Q)~)+}f2i8bp5DE?S9h=Vtmj!X9%Ua4R6BvG zpB>Vo{RYSQr7V;Cbu^=jRvY0uYowub_yl@f{XhYBbzBF@!8<)J3GpScrC<%mi!U7Yz%?VD%Jo=VQeSz@sAfdaBu<&5`^U3 zHJ^pyE<8jK;Ca{elChrCP6$X&3|rpmq3SqeFucdafIh{{ejY0(H(jsW;I$eMo&>$> zjcCYLs{*POB6DPfjg75L7^ojjWd@5@z$p;q48Tq!`OV>z^^(j{`Xx@qITO>6^^JMO z?5g|yvsY`f9KBUUcm?<}{O=!b+KNK@HER|-UVtyKz`t=i3X#Uv)7dljeUB`u*6b#l z;||mhmuS1L^%xcOxdED3CX8e_s5UMoFDG5M9R*>bTC zngD;}ecuEJ_v)k}`M?-DA?!-~K?V<@>hLwqyFX~ws^%(fqQ(;%C?6S3RTL|S`R}$!Z%7K>GC8!Vd*e1zQvXeXp96 zXx=1Cg=5?TgS1owVnnesDiNdFzX%v>WuU3Rd3_+1XE&puvse0ka!8SLJ)~WnB8=Ko z?tQqVkn|PFKM7eJo+w*|+Fg3ZhpQ2_Xy}1svv~*1?=OX>OMVE^a;)X(vXfpgSl*ts za$6qLv~9V?W%H1ZXa6{M0HR~d<^xThMAE+K40O|$afXR4i4AEx|6cYwCGJQ2c?2U~MUIYlv zFDxrk>nu;~3r)=WsOxS2GpBhllcg5b6)nO9)#epMvYe$y%px>fm$3R$uGg|Snu&_q zVGBu|X9jGUhsCy!ae4TJj6pcxBPh6* zRB17{biMJ0(MLxhpbspK2#lRoDmg->SOqB=8XlrV%>Kf`$+l#tWk@^>haO;sp-q_` zlMc}rvXDL0-IRAAaVF2TfG^CwMSbv47WLM`mm_79y}fD?cM9Jb2#{RvX?lO)$LtEw zhGwiWoO~S>qL~$q5r8>pMsJ%z@G&3~?YvYQ>dN0gz7A1heoz0PyXE*3a*pRF5n(!Q zS%tQf_anZMzQ?LD=TY#@14gbJQlu?t1zRmPXiaIn%1wZgT^~srK7a21s|9nDG6fKP zU;+qrHz|_Xhz4D|(r4GDNtLq={FwY@z7z*QIcA-%x%78xh{OJRT)k0NUiT(KnsMR7oa#TnMN^@9Qo>YhE~LTbHCCNQ=WFtY z#iVl-mV;w(q&8^Q*?wrQvn95c(?n#4Jrb1E2d1Y5Ifm*kzG`24A!qqZu*udW56_R0 z9?tD{7`vK8cy8VOD|TChpp6Y;=K=bFcF7@de&iM}E;7UKuz`+deNt3odP35!D*Lge0+QZ+s^b}x=+ZQDkealIcjmCOJLEk*nfaNxt3I9P04L?CuB0PvsU94 z6~-;(4!*zN%%u2rlAXiI>pNdrY9U%32pml5(Usw6+fT z@o2Pj)G^!A+S<*hc6rqmQ}(OPwxl3Hsl~~mZAT_F=r~qsCvs~1EjoPn7%CFNSPtGZ zg4~cX(Ykr%2+19~KJg$CD%t(sEezH`LCV`-3g_65BVxn*@iqGbOF3PXqnIc%`mnqb z54X55OtaP}HF{pmyH4g_;(Oj+>7n5YqpLfdYv5ARV;IpRoFt@oL+e_Kz&dlUr-Np! zCwbNUo%%%4u)||i{A>MB50fTda*d6jKjFaHSlP!jj~i&R|5kAGSix(56bDvgz$N3gV#BET@lU zMUIB+ZJ`x;95gql#$`#k3$1KMo9C+E$}k7Y#ZMHk54u&HWGtdOn&qrEmmKX_*V&J= z!P{pSQxqO?*#RN*_}fZ~$HV*NT1N>zw$oFC@kx*E3+dNQ=Ynjl$}skyt6cV#?Y&yg zrKxNoODAs%Snt5rNQY+ZUCJ=_FA$C1l!QRwZl;VTLZ<>K$0GCD5&CF(Cjqro|8SFi z$sg()7-+T5UL*6bIByGy1iXP@TC$Yk!m)M!?;W<6R+H?69AC|4rA>O|_$Q@ZP%KVN z$TV%e#}X7YS!Ze#=G0kwt61h_q$5vmDcAa$-ZQlcU&1+Db@#a}o;A`b?qxEU^h|K} z6fAp^cFA?6!iJ|J=PcBe7p z_itxvdL6^=kalm5P3bqBq5LMjE+CYd9lkPfRkQ01Z?&zw-$o0@u3XA;%TfCst&7t5 z#lZ`y%MA$>#|nmT$Fy@#T9?H%kcM(m4fUEtC6lBZx315fm9$Z+k)0;XWP0uw#^I*r z3I$rC%j_D6vR&p~`+-!#pB=%!e;cbd|E&GBIBu9`CeOjw1NURDgSY>xo?z2ud(Xs= zPK^C)+-0U=dFFz>M$WAcgyBHii*2M2xTsXVHso&3ER8sZi8W^iE-H1kG(C}WjEQQr zA)yarQ^)oS?_)BQJ@|O*(I{7Ck$@cjrYLiRrqZ zu>ZcvmUvjNBV=B9fNp8>wC_1}acd}C-Jru~)htSGph0@77%u>tbU-ySD!wOp6i5QNNa+4bAJ z5>jVlZ+f1hn-D)jY3EL{%q}4mo^FXb@`lgEofo){^9%|{Zrg4Cg5}&Zy546K5YXUs@!E zBS+=)wP+Z=GSj_P@YL^*nZw|DL?#7k_83X2akvOeAQPQ1o8(zC@q)BJ;HUAPgv#>t zfPH}kEqt9{XZot#*~^&yF)w}{N{O5NNmGG;vtHak;>c{&DxAemNZYCjwk3UlqaD0m zJ3TQhoaft!A-O`gai`0NzE)*=_KCobbLf^175}?{uMY!8nw#Q9ZZL~XPNZ6{DEEgH zq>5O6z1W{T89lp0F~u)!MO1htDT^kwxGBjMyQ1%--D+q1RH-Y8pxW{+;A0|3V>_-5 z6O}x;KipRTyRCzUjv3Fzo%?M4$-U^g%R=70Scf}#9>t=dN)FXu0aQn4l{3~`P1a?O z5qq82IegH%#i@(u%*eRVD6WV**5jm(a6OoNq*T4m% z;!u7xxQ<}b$$D5P#aYHk!(z&<8Lq&e;(5Y^GBu$DeR>Kxz{*oGd!`V8lJ~WHk*Mr# z-&2)JwM`{V9vOY>ApgaeGI~gCp5<}iQj&?JrsQ&X$${Hq}x#ZQIj476ULrT`cdycuYo}50bz*_$_So+fj*lcGKI_~S{G(nQgZPB&oV6j3y) z5`fV|*e!WM^qWiw#70Gu>wsR#1D(k`M>Uli0j|WdAobp$^wJsq8ksrd4*HBMh0q(x z4nhon`+cY4>D>p)0FSqiSF{tQR))6iB-r6j&z8e)P+n%N7hI{6MfamX z9d#Zc=hp@3y-@JITM=?+mT3&rr~>fjJ($mznX*w3$P~ z87ObVN8TTlQc1 z7Xj?aT1(_dN5KIZ>9L}HJ?OJ3#oWaLn~-O@izV)z=%tw)OI||nqk!o#XE>9NHvd#S z7I+T;H_`jo$&>F6Sva^SIbpFVdWBF8fO93zaJnJsw^A34zJ@;3k4fi86~+WTdMIhQTqw9DQI1w`JjN|%W3col+o!MJvVeOFr2-$liS&0mq4 zDY`oRXi|dmF7!v9|2Gr0MhQsL)^E=vN=4`{Elj_F+QMP9ktc|rqw;og9r{rOplC(4 zPtDN>fC>}P+@e*MU9?*Y465Lb@D?h^AbSdP#Srds16|G3p>XBFcd82g>|ewlcv=f$ zqql_=q|moN1bsfO6AIizc%FLzDBh18_Sv0NPMFi5{7K$uNBrQbXCuk{C~C0oV20!= zA6Qt?anXS*k~V5;bS1}LBz^3!FO`xjhqiwMW`%v_MB?`D>o7J0?;tfhdoa=BJ@@Y0 z--C7NtLCGijowcRBhK`2mvG=NCJVj0%Jq6TgOEYoo6mQ`$1C5logC=};Je5&J*Lc$ zE>pmNA-|Rb)kJPw;uzgk$1+et10Kfv4x$Ox=0M_fOtxihf36ksbpSzSVX}w9eTjFc z9;r;C=aX{{ZTmf}1n)AhRCJESls$k?l;Kc=8rOeLSv;(BU*j(dAU1+d?L(GOsQ+=) z_z@lN>EPhRv*_#NV43u2w9WuC7tG~7(l-m5gS)0C4+i4Sf2ayISYr`nlNK>s+vS2B zhR+`6UC2i_@NQDLlKG^kgg#B;Aa#}WOMP4_np-;RVgD^4Wbn*p`t$Z+Q+}^c=boKq z#r#_BP3q>wqeBA1?^fc=0#&<&GKJWb6qY8w8h>}P@rX@o)OHeKKBSXBqwbA9G0mav zvF_npWK80nIWp=|DlTPxka$e$KcJ3o5iAnWnJ4D_2N44r;f$>u5g3$y+uPgg%Z5?R z3&ia^^vYyVHV9U>K?6ovnJMB(pT-z2hPgiYa($@W$wPG9?LdLFq5O+^50hN zw6yFzvo2XCned5{$}G(i$u17fk@W0jP?5V-mjYP-+SO&tP@|C;ef@u>6mLq4c}iAf zz5LMa{pq|@IYnWYQT<7-0j5mLvLeAysU@>Pis|uAY)@g3lt~SG_)#ho-L{}GtG~~Q zw1t`!YTYluo+HSDaern*9w4y&|J|EmAyHN4s6y`;o)c>}cuwevG+kil=vlCeLxiu| zn2-+#Z&h8ys&1{(CB~Nu>xrD;jTQ@->vs`Q&YIPUrV78T4OxsCY_Z+!*p_rlYYz9| z&IeQr{_mXWQL2gd4+^q;b1FSt$L$BR;;g^BfQHBC$fU z8?9(96s3dZK?$5l?wfv+O2~yYv18*xpcH3NyfE>XXY(bP&TMT?y57PNf;26V;7v$Z zmJ1v^(s-pp5soMW(j^_SQM?Il0iy*1AJN_gnx zos9v^BsTrJDMysXQtfyF&g{$HoctF;Ma`j`%AmZX3J`8zxRDD`C7en_u&t5|-lRqb z##q?nEgR;pg@r{mg|ebzx0vDpzsBkbA$x$`Sm6s(b|}@Nj4htMg7Wh}i%) z9^v7IZV7ReLyPor#G8w30%lLod=67)^d*7mKrbbey zdCb$gPT*m#$5JKU%E4j(k%7-nF>^AKk6uWyGZC5{D-<;p^-o$wzdOSbGgzP!tQnh; zC%un?CX!DN$)%UK9&4*+GQdZVsaLqVbh-o*p{o!nCP`kh!-C+HuY$y09~e68GT{-q zR4mPL3N$u+T)GW7*{$O8M$*G}CMPd8Wboiqd9F(pyfG^`$3JkudeF3$7bW(d@f636 ziwG5&hX|ts{_k>49;Ju^CuCjFz`($|${=Jcf8dkr&T^gH*up{c0XH#ERslOgA%$AN zTXcU2my4~5G*}bG^*I|nkV9J|I@WF7{ZO??*Xs-qfe~-P*A?IIwtmW_D=TW|ecKUh zO)qEARAe*B1^46{l6f%FBS~h44LC3kxzgT4Y1~zNfos9idyQXVswE-WcB)-6Njl6t z_f3eBLTa!*=Xh%Pf`btSoq!oeLEY zn6%3dNayB%*kaf3yF`wT5b?!NCU`Nv{a(8s(cgRO6U3F+=8u1hj@jRT#A1-G>xy5LmGat=mNyFJ!Uf|cawiOrPqe4z+D`RViN=@&9G=BXJv-C; zF)@*`kbiCPf)wfx5HreC^IQ@ejbqt0pQGKaq-17k>9mUBOD_*j3O!sd?Yzu6X6aM< z=|-r-KwnXgZLRKR|3nK#T7S=Y6#nlhi@^8^S( zP}+;yN-?Zd%LHGhk&=@q1U-tD$7%_y`Ig+H`R#dD+0oYwT7Fb9EiBLTXIhl%jviDk zcXp`5@;9;smb+}VVrj2GMjUP42r!r2d$|`7yYSE;?Tpy-s3T43bZ)Ww)@lc53?53G z#qh;g`iQl@;M=xaol?559&z;*J11u$ZCCoUqC8C*85!A48ZF&U)Il;%*>i!GSJ8j< zZ>vG=5}08S)aHFp-ENC_a__&}br%zd-H(>_+b%un?~j1S3ogM;+Gtb6VU^*~iN;;g_c>Qy z@~FwO-T9ZReJM^|Lxb_%yRcu^ipC{O4J({!?Pn^={5BsKrV{s_U7QUnEdvdxkd(HK zNlASCkI1Eq^UqAskxM#RvmH}BxsE%FzW5DRd5kt^x^kAe{A_Q&1+(XVipF9~2UXRC zvHD_hZvEq@n%%@Yg~Q|Qv$d{{PPZ22P9OqfFoDO!x5gSCus^PfzlrwSi}k&Of91_$ zLZ)V+Y-eX@qWV{1QtpGc#(3qIxQ==-OI+x0HklvL*m^!jn**3e`MmTKkDN#cgC|eZ z6>)xAUI~KYs#!B3gIdNz<#kQPpcBTlL6VHP*4TAl3Li09o-dd|{l{Dk`ZA0}Wr0Os z{0BqgF5H%ov9M@u{aUMh{P>zysU6=>45tkab5D!IvBFSO6Ub{C_g#s5aVkLt&$RC_ z^C_EI3=-HId$C}qc>YB;84wZ`jrZUAYeM;FBYZb)E8oX`kuF!O4VK%#)xt2Io?Wp-@zmM=#CImy?%0wG9&w=|`n>&>S4%i87Aprn~#6KZfi0m>DaavTzcZI8{M zQ5ZukvG}t?$Eoh^%d;ioIPv8&>BmPbG+>&|ys&f04A&{6Th2ix_t+G9b$^t5LdKgQ z_K0WBM-z>?|I3n}LXgf)>L>9ZjJ+`=LYK8zL%pwm%pPubVia$Fu81DgNW>Fb>4lI* zo_3_C5hT)IDle@nMpZmoh&y}DF|JtRG`mkzaPTzK(JLA1P{X-0^lHyVp1R^D0nKkTQgFE?fv7H z8!hy|Ibmd^>VS&;0|ERqV5G7T?-O@1QX^8Oe^x#v84_^*O@IG;jRPMI0I3qoL&)*`->1`1__^D%WOgLXDB2_qCxFN1pGAto~+XDGS20`fMR|7ieey8qvJxFxx)wa~05OMfF?2bg=JB zbm?HTtX+oU%JokjkP;qHL9_1BH#+7f(O=G=2_V1BcL0JXszHE)Aqu8uW>iZPUmL=B zEXpB4IH;}+6fH!Tf=X^c`Tx?g{+$ZD;WDRoxdyPh4_}=xUFO#M-o7+lAVQe9a24cg zqrjV%jj(S`l(dFI2;IU~<(o-(rO(r#$!Gp{#>N+T^|E<~CR;&%dKuv+Ty6uVghGxp zkf*FC--Xm6B}9;7H`TL=88sjxMBcmgK&YDpDvAN$N_yxim27hj%Y$EnnWEY*t8dZr z` oF78M00zWCu!s~_0rMK-GJZ@^^fJ96W*7u0{%nqF^L zn_XXBqGx+X$evGgSa*kGu>QsP^^{rXCqX0$|#2z@Et%H)gsyzu6{1vyH4>ChO|b4 z@T-~{88#0$=GctrI?$$BOnb86r-p%@|46%u-?G2BBfp?P&|m_95PelXdWoy_d(ql$;}N9J3j^(W!iCxmE)bUy7V zH0?;cqAUav?HoL24&!v_tdc8Tr#LnnYyA`Z2O^Lf$PC%Qhb@~PH~$qy23=6t?5y%4s6+t6ie?J|g3 zzD+eo2^rbJuTHS}(Ft{~y?wzJ?CrfT9dm+HpHVJGL~}-WRwOnjGsmV%Z(~pWl#4rt ze+<;R%5ETAxL+dy3b))0xqQxWg&G=fY{%+cKfc^l+wJYUtSpYsbWPO`U5Bl;%>3!@ z@N@#y=E>`>T2m6$tM>hveP|kBrSj=JD9XEs_!6-`0FMls`Vm^6K2)!0Jh zs5b>|hL#0^7L=K*ML?XKN$;}CONJl1SSqpn8Dp2x=FE!J%gJPIZ~=V5K+|z$;%LRQ znat?bL*ujsQ`FL38LE0c3iK*!6|XPc`N^r}dFOo}^SSMu+`PWK1X)Sf<_G5u zap9w&U?0s(@wa@Sv|zKb@F4k?t}_!ZQ>(04S8)>)lbZVy_^97>azKbP8nrDDGieKC zL2IdC_D2VMKgWxl`y}ML{c*4QTN0l_+}d!@lfC$@(#5{dY3lcW zrBAGNCM6}&W7{Ha*)oNXoVhaO9NckPy`UjdTxaJ?CGW0-A%Dx=SN}M58fpwbv)s82 zSk*j~4BC=pETINdL50n@EZ$p8vghvG0D940erIDl<>Pw;McE+G`XD{}=8{6BvTvEq zxWC;x`9}8|&~Z=Xu|DjG$q7Hnsg-BM1$h%6>#G&=nJd=@RoNXm zc&IBL`p*(>dDk_nj>G7xu5T>rt%K|~wBN$q-1g_1j?-ZU67eK~GXcNZ;IjbpnP*e) z>~=QP{RwOTn8Wwad$;_6RfnHC(ZFNW*zKyKc$@rNO3G#ZquCloKP>w`eor%C$h3JI z@DM)^n@be8=fOJLvvvNgT!7a0y(AD{5T zs|r~58CygMSoyoW?2(VkCbrz0=(^h7eaDBSR_64*%dFJg@8iTDzmt4K6yIEZ0(Bxh z)(}VJ&I=KARk>*lHOGms(XOtpE*9p+r`CbeS1-!#owq{p{q$G@#z18u8LzmL&Y5Po z@#E7=y1fr@IGi$Vw1e~J(mR)~v{chBuGL0~{=;dIocQMCy)U#bP%hvePL zjxmzz#g$v9yVe=9o}##AN5~?`uc%S=Yo+hGXLE|rRMGgQx?kJXOC>3>YJ+U!aksqH z)YKXzd(y^Gip@8u^#qmYX6-J+l54+@&a)!HQ(Hct3C6Llo_w)|^*{=`KK=sL(R5W?=yH#YeNdqsL`u+(3aYLrAVdDpn-R?g1`|diAl*ny9zwcPK)PGHOIo_Sq#LBW1VKW&TckUs?>>Hi^||-` zKK*?&Tj77MTf+RW$5ef_p47#+GxC#smJQWNKtS=G*u*J!LwH^46x22ev zlC+o@Sjo}e%+kgb28J%q*ua26nu%`E(9pnOaFmfA#nDYAEG$yRpsTNYw7U=d&7dEg zo%-R!`YWvUK7U;Awt;S>FRTZjMr1A?Jf?~oyr1y7tJ54csQH?&0$|-_tQ^?k;VBVg zvocjOGf_=;U>5j>Uc94*T%&Ydm%k@ZW98BOlWLc`ccYZG~$7gJB%VKC^Z)D2iZu=4VPB1V6 z?tH*cTT^F4u)D2|ofDtC;OoCf@BzP}n^|9j{~qFOE%^Gqyb@T<-q94y#lp$L_F4!9 z3m~m;Haw{GUDlI#YlZ`U3y+LjR1`->txK384tE{%7cgP*guxZo*~lSmKZV0RQPV7)}FET1Iv)PDw3CrU_t{ryATSIp z5(EYg%O3{#89;(XH!6}&h5SF;fS=vi5b(ykzeoIMhob~c0G0W!^s9fJ`p*vFIMV++ z?*GQ+|K`E}#RoL2{Qol#3Q!+I(1}N4d@m`TX4Exee zB*{F!Eqk4Gtlag%|2yfe;L;U5bw{vv?%uIj&sIp&&$pd)9vtduYpWc3_(M8z=*}vJ z=0?y>JMmfdY#Qf{P*b+16oqZC7p<#J&OKMnb9_d=h2xHvsh7uJcXYfxX}=gb|2;hF zGN(JYl$-bTe3A2<3Xdr;?tSc(!y){9`%~=E;NQ6w@)H?P#SgOfG^M~ldIj(Me7{DE zdfN?;nR?Up{3!A1$9%1E!u2u)tdGnlhNHsKwCZX7`H1}a&-cWgb+PH)z^(S^=;&O{ zi@SsBVu5?iqoboI+W~t|lFm@_hjl~+sl{f8eEWV@5SVQcWY>9X#G=QZF!&bgd9%4r;D6~#;mL?3G_*9Ns_pFoi^7>;;2+k%XmU=o76M` zkFU2YC%!w&)VbdKsyXa4Gc#u2!m!PrA8&Zr{LbLZ?d$~DJ(zmx4XW>YuHJ+?L&M>*OsrL{3nNZ$iKeF@aW%7rbON$ z?LER?adh5voV0WX-Qi7+yKe*&e2Dg(Brho~eM5dbDEZ+59UYy5x(5aBRuQO=mC@5M z%-Z#IZ@=)`uL|5?&rKKGKMZUEpMi(9>)|UdU*~yJ^(!t0o)zZ=ovE{GzsKPc3QH?1 z_O-j&rV)qlq~;jB>oBzQ7J{EI`DgqOYrm6?tdkKsj(-$S2;gygO4Pq+8kHGwc79Ozh#ulLtmPG!0VO_x@6J$dH) zih262&viXDwCsL~SS}PnMt3Ch*ov!Sj)j@h^@Fs`_!l9NjPd?LE5n3)Aq^dd#c6j7 zjlSoPvbwSyL@!^yl+O81;uMKXvOSh%J*}K7=+$V=I~_M}BkAN+hbuG9D;0AwKy1&6 zOC!gYFA>FVJP_$nN0IKbP;Z$K2UgM2vW({2r>k3WU3wcZpt$>Wn8k^bES*`J$JEqx zPXqe?VvzM;p5tknetH3kVfKL?u5F8bCD>kZFi%XS#9cVOic>7$H>$_NK zSwS9js|p$^Tq=PXa!}QmhY?t0UC171$Ei*Kye~!KecE%ZU27B^$CqkvHk$r>?Hm;r zX$u+F*0=Vg^PUEgdHPn<3)_ZP&vTDDU!lLWID4OuDn-w;bOLG5=VoQ+X@HCPF3R4! zZ}fxrp)om!{=+6gmcQfE?M}u5o?6YG@)91<0Uc#P1U#m(8%2BzPx1W%#WOHP#}6YSfQWAA#&lbcJMZnBhNx4h5>Uo| zP%*azz%K zXs+-hEHb(F3H=77t^_Cq(JiOFs2nQFUU@xmU92@W3+z1BM47jTmVS`B>V10)13dTu z(bv$Au46@VxiM=|$VWCwh)GmxG!(;!PUMof{+d!(G0MiOW9Z_i@QImZUH$W5{MmEJJrx~y1f~}8vXYx#!7TQBiwiS9AR3(lZ-~oW%137q`v8^ z{51(KkgE~S88uem3yX+qas@!+2y7<$G6pdF2%zYQRruxk4Izv=44YA$fuahHO*8;S6EC)RctGMbTgb4 z<9yl^F3)j!P@aPD=!gl6beRKbeDXI_>r;?bJi**W!@2E;fTKY&RL=di>xqOw|JiMT zJ3ia7$Td7ij9El`#axN2EJ@RBpf3N_d93i9KHuCHmO+Gu4(r9QO|pO5Ri!~-ilVe! z5Ay#T3ql)UluQ^;(HD9FCglIy)CSAJ1Qf(t$Fu`=<)1bg=yh|uk-@Qe?l0nf{@Xpn zBH^*ag5pK11kW-4(H5@ILPnkvlLF6HDg<#3tF*33upJzUPeiYV=Enex|`uY(& zS(}lEcM2DnjCzjau27}VKyFTQOSy(X&Qk@;-9b<|f z<`JcA%+BJT^3gD_$IZ&*`b*Bt4tFOOPq^_u*EMG8-usoD1(u4Dn0eo@HM!4gRpBdu zvZ=0*|GaC7*toko7%fW1&%gF5*HZlzkfefv1pDZtp&7&0_g#+NmO3fVVG<$8XfOEp zcmu3rhrpWLEA@B$;}MJD<#U;+ROQ4va^H8;ipt7SV}ga0d?* zISD#j7+70d=PZY+qjQ-4HqA5qWwbCmYjxWYjPI8Ednqlr8pB>yXWZyTG+Tb4{+j!h zdYwZ*JMd;qlgcpu(vWpi zR+KX(g^Bys$En%b?J8$CLAM)hCCM#6;*`{oE7{&p#)tuAxbpzw)|whOkdfgC{xy_f zomKPIbu=C6W~j(iH9`w_vnu+sK$^?Uec|I=>9Iq|=RxDrtVIg|?pe=OpzmlJ-)b3B ze%6n2Nr5zby7&xOo^6)j^+0mFKtw#8>37?Wr*4Vdx%%#w@OQy6-GSm@RuE2?jeH~S zWR0hb1bpJ3L3!?@qY3h!a9rA!7-OHuvXK~*V)KDWQsV*byaJAaDXMfqZF6<{^o$Jl zS4oM9>GbNVa`~h~^W)7F`50=F`xa8U;rk`ilh|karoQ*m-J{NCX_Zb!GWc#hLj>E$ zaMv78@359fKZTr~4b%8ku-(9P1*P~0_ZA7>O#mQf6(<*cm$`QJwitbvl+_zkD4-oj zYPo6TDIt#?@6Vvi4YnF(GTAEQ89U#4U<|jg>PK(USK;MyZsf3Y8@ol(IB(8?cICf> zR4Z+FW7i5tFXI1h1hYv2v5SDrGy$Og|HLB<+zRd>V^ZaDT?8hOkhnpIMfNI9k(@ps z=R7&(2m*Z1o#>|a5j)#;;bn3$Pb_5aC^kGK;e$l~fIh4g74O-8j3u{)pfHo&NrRt3 z@v*|Os}HceT>)IQ(J@iD31G0$MkLO7rj8V8!6~YP+lGq38B9PYE*&EyN0NF{o^_Xu ztn5)^$M1!e;n&MYZ8~OsZA~lsyfZg8_-0Z%cD7!bQT85qe#43nre*ckhJ1Z2ox#W< zA9ip9&P%!sGo%;&eP{7(A;PdY-fT!)Nf4Zcq1`*AMSGJ=$#K521Z8!tq}r(nzTy4# z-Ct=e0=2#ZiR*%$@ZB6DbC%e0x^4Loe1PFOgJ72#gN?cgmHzA8(%p`a5u~<2aKRVCb zE-&%pAtJ!}P>!4Ze8s>#d>%cCaEWdM2A&cIp~*u8Y!8Zey~kDy}_0l6fH zkL*quzwWU*d2G)3@tGl?ab))};QZ_7LB8E8%3Z$KjU3?t5Pjst#ehK1wyT?cF2y!F zn=YOyUP0I>*2Ez4{6(>wk+5H;Q~JJ!8;`K$KO4V4$;q^rs4PC=jIVEOQb&yPUyUA* zn=JZ2;Y4AOU-KM#-_)R^qbd?(jS{CEg3d+36QR}(M?svIwYXn|{R@7?9u*X1;N3WX ze z&%LG2C2VeeTQ^c~d&7P(Of%nJ&}BS;kvV~I*${65eTjfyyBb+iok&0w^_7s~T% zj)T!fw}W4>KVA&nGod1^&8`nl8OA$JC}n@U#Cosgn83L4f*m(XhT)e z_&epvn~xHiDS=k;4KcUP$CUR)#6F;}E|=5TYUVib0Z%xwsoHQu7=g66|(1iD2@Zw$bQS|IeKR%hPyngOVqz&q7)4*is~WHhwU7<1NDR zCBiUVN_WHwURLJXeri@hCj7ImKYm$wb1|2;2C;vAM0qpmXBZWmdK;yb+SaRu=^!qf zhMEYu+w~2=53~X5z7G|IcwF)$D6kuhHOLxZf`yVwMvbn-hn-CU6VOXzu;aB-AZY~Y zMi-i2V&g~WHvoWx5ha9J$%c#Q`}sEoFnzMjH9u(&MhL5oB~2fXp=&2G6bl>Tj^FV= zpR80a)qDzHN^UBD|D>QP(uU&|f(rBlbQo~;u>Hz0iM@6jutB|)xfoJ4fqA-4^$JCO zQ&nO_gbk?kN9mc){BHQN8!uBxfCse%UGl8j{WN;tV3m}}bkzE)JetonQirjz%vXKx zFih89$RXacPN&Q|5GKpKqz=)FMo}RmN)muX<4EHOc-m2MYsX07SZ7JPpUVwkm%f20 zvm?H?zF1Q9nN9Db&r{ROCiT{_hg9ykM@0%W>_#D)#)n{rlAhZ8-d)B|B2cX%*`Z`Y ze37ZJ(IXGU-;Y-%VBccPael}nm%iC!%Ep( z?y8=}9;!iA1gaK+&=zIf?(R#>UvSTDEW3x+Q$g62lIcInPT>WpKc+0%c7~!8<7;h2~-N*a;qe+$o25sIGqJN=NN<->(0?Ys|MuA z5)0ro(;u_UY^M2(qu;*Px_ar=jy$9$xpB_NWSZk3)|$7b5Vq-lG!G}_8gQB8U?`}! z>7ZY#f3xuB=cy7H9|wuyh^}~MtcIp1uiYo9l;wmIH#3XbPdb#|Ue}Hv?|LK&qr)YBw>ZMLh5Tvrw{?YkOCZ&l&NYK}^1(h`v)x#4t(jex_S;F8MI`Hp^G+38 zXHLy&OWhK{70C)%ed7@@7r|iAJk_G`v?7QUWRm;2GJ|AmVdKnT+@l0MRx#*$&04c= zNM=HXzZZ`sAb#@OVIo2%P#MqzZb&^#E;?O}+bpFcORi|#S8ubr3`#w&lIG-0O$&8* zxMneSqxSAd4-U^+`rs2Oy3kWC5Cbg{5s<9nBvp-yA03~53-1Ntl9-Xc*ElRHEgh;T zt8PN%t=hk<SqG4i!Luy77Eu>^3^nGEY?EW?*ZiKFU*?>P=2{@z%-8e? z-0kLX_aKrx&&jfOnAmk(X*k{O6=(b&PHA(rPTq>^H%r(H;MTKp{rZS^L z_6A5QuBH{&3_>AqclHHc*M z1`~%tUWIQ&h{m;1ccV!+g&}N$bD+Ax{5sU(@x??)JNl#Y(g4 zj%&xLg|qME_WS$$2(%pEP+*bJkOS_I+kSfQijm6{6}lSa_*_d1IRVW$9)3X1^TW<| z{gi@J+HCKY;Prf8`-#s9N9bY$o72viOWTaJ-~p}hZFmcCfl+`HMJe~+!iN(RhY2tV zgM?CF%<9;u^u61bi>HtTx4MvXw= z2a+ZXl0{3l^U#&s5ph(})8mQX4f$;_4Cp+vyEhnh<>vj`j;f*{7p0qh*JESL-F|r% zmg8v;;!>9A3U?CylSZ}P(HI=Dpr`X^K}?_#HUs#x46Us#1zKiJP0b8!N(qyKF5gGb z;+VVBKFkbRmX>c^7JJ!$`N*qTowk9GOSVn&ZreZ?J%|gZ()X|{DV$DXqSRO))dWgh zaa$8qbd=@>W7)&ukdXo0%oZOOI>`?xF~X$RKL0p6kbzYg+Px0wJcJ}wVmJq%Uows) z(yPXsms>ErZ!Jq_nXSH5fAg2J;k`es8-1zy!H}ixko}^e+GjLNIX8-#4cK{%WPvDG z3GV^0=_=e=6R({|y`^3pY$YgSkiHtxt&%2$>lXv>?8M?>{>Wnu#~%PFx(0=QSt~u+ zWTrQMfBMLm3zwz(Wy|!ST!bIeAO1t>H35at!rzMMu?f7m5KSFjEVI^sS&I&o`5-hKfznuM3j2&6e(e1@u1`O3k42R75n=0}**?N+JHkn!q+FJ)W>JdLl95nWV;%yrjXm+E#kRS#~01JUeahNA3qdKyP zD>%ZWT|c-txNpF%yC|j`v5yH=4|1X6ib2E%+sAnk17Nywt4ahS0V8Fwj%+bk4g@+U zVeQzT$wisxNhTyHhsX*{qFZ%xvG|M=zvugH;QA)_wYO*$bWRUni?9?03n5m(#|%&+CClsi!4&yH4HoqVQP&(L=W2_rLw&& zdf8Nh-}Sb42-EizUR6~!A&&3}jni_HYOdRYK~VcvkiWYcy+_U;oc z(zh`GAonBRtMx$4R@saO3(X3_o8>8iixG}DuSJw8l-hxQ@N<(LV!cUaWu@7}pR+2; z!mvW?14Tb;S@9NNIRBC{@b7XvJ6B01N}NQTg~IGPmuiPu+L{;Qa;=h2#(=g{$sI}w zRgXEw8%OQl>7dEZ$mX|qPS}Y6Ga<#};p{s{qsryuDZs2lg-xJ3Twl9#IBbg7*{$#u zOB|LPSaRTx&Kd(BZxi71RRmn#nov(jinb;GVbD_)x-Ha0nP589AgBvaG1Rmn(pt|ikBT}*~vaIlYXe@df_)n5!%cgf+_s)(G4r< zWZ<8s9FIHz(B{UZc2DI2%3Ss8YVP$|7Jo`zjW_RuC^!TdJzy?~>6(zLP+zg=_ge#! z(-6}K-`n5Yhjl*{fD9X8MEen1PL}MuRvs>kg}EfjeVl6vQqKFsx<9=@U5>m3^r{r) zePX-j9%v$xvFrC57eQ>v+GZCpf`vu;77w!%`|ayuXydqQk=&c_WL_0*iRZx8vN9W= zyAg%3($jS8TKdt5xkoGzs~vs~1mE@Gzy(VgjHYu*h~5>+XP~^f-y(#QhFg3g%Wq)G zuU84Ly!3Py=8&X~dF*7FuX^l| z=Hu?HU1Z--HN9E|lCqqOi;D>_2{`ry#QW;answNNDP=B4xid{tP%JcV2mEqgN(4$8 ze~%u;C*gt4ojhQqL~9MwWZ@RmWGO9G&L%PRfUlU@R=?)0uAUTEbp|MvrV>#^Ny9er z+@L%0?vrlIHXAe$N|gVsuM~K~OThcj$9$33ex!qTZAaS(aVV8?TLeJh3Icg-c@Fli z6lE^vs$18+uG=1`o-OTRweW;x$HmT1%$E}N9W{{{qrFg7863N1JsQi}kXPOH1fXsA zKO3Q=qdaSe2mzl=Xyj52s@l(Gpvow(p?FyXkS}219)YYhssAa6Tn$d;C*NUB-*RD4 zfgfuC)kyop`LJD2K_kI+)2n2wR|o(J4h&(ARbV?%CwN;B#NmYjbwFO!V>6s~IXX-_ zqAG)9jF)odv-#ia0y+qw$$`kM;3k!$wYREbb^u9z1kk`}-RSKB)lRMqS4yh1vXXS4 zDS-^60wmLd^>vC+kkC!b&opBD_BYgsi$Q?WuxMGFrLyckhzaMyVK!fR8Ks_aFc^at z7a@dA$IM(uL^?2{UtglQ5y6ZFCtW*Z5jpJigTA;KvlL&)sz9-=%OYaqpt@^S*F4*! zsAa#b+(<6$%MLuO8tO$J{$>K=(RQQ5F9}NZa_2f|@vL-f$jD<2vH^;DNk>uOkGh>o zTUw1WM@q>hmqcXw-y$nEwpVopc3wEieJzRQ z;jZFfX0GfHt%{-EB#9ULMEU*+cUSlvP9C06vvyDShKaWE$;C-pw+4An)-PLG<5CfWDn?Q|*5$tmSlG~- zy!q=+)%8UmKPM+6J!z0Wa+RBPdN1Hy#JHv4VYhS=1Z$L>93rLdfa)VAs@jhCtLn!1 z7}=W$^xX42E+-^cLbdqaZz+QT#XZzImJ)swCO`;lys^Y4Y7y}xD4Z(y0s_onZrUJ= zH=bf*Vw2U2Jpk6E%?ae8l#E6ba@02fQ7KjF>DtT4vb!CYHIXv|hvhB>d*mo9WL z?rm`KsHk!*G-tv5Vu(vjPDOV$dlRpJgjZK;n((`cFR=QLeD;R}Q19JclIs_S2H!0` z>po)@VCEN`uhWNspyGP*WUlhNQjfjKw{%c>ickJex^>kX)nbJx3c}B504RimC9Q|L z4c?}y+iq`QR#+S@1D=lryJbAg0Gy>6mo^!Rk{3gjtjE+2FGVNy&<&4Rg=gZTsHn~U z6s=1Mfn%wZKjLb_0dTfVY)X5zWZ>106shf&o_ta~V*N3bd?k ze~DoEG1v{jZ3_jyJ*v8!RWE*#f~qQ(K1_Tl<9VJ2STKaV&{hy#CtH#QXlJSiD~z{x=E z8?~tiR62TB0cd%nqXJ4zu$s=6ixje4j?l_33I|c8_x(}RiVJ}0TP$@+@wUsQN!-^1 z%m9VVP^1>{3V^Ys*8$Atiil%n&a|ecrbeYGKDQwEH*@p@8MR>ED)Afu-}%veKOO+b zi7SJy%2_&(eYOYSwOB4(vEiIL-w}THkUAHA9sF)RA?KlB>2?=@)Li!`U4Dk9*~=KO zV2}LOG&GX2bIkbD)6*lzV9pSE>yvG#>Du}k5di9xufQ8lk5iFFEH$WSdr<- zwXuh;Qhwj*vvDLjP@_KF;&q&W>hJ&N&MLq$@?ENbbFVl@!R`%7V@HjO*I7S7)Yyx0 z3_ZiFxXzuh*kDluz(gbw5xcawh(bNQP*gA${TU4Dy#S!u{iZ7!hX;|-0EoH1UZ1p*F_;5F#rN|o)dPu ztt`#!p9b-uSh_fx!i6Qu^Nuo?L;^p&VwZ%sv}3o7vmTQEd)#&N$pg%XJ5=rUVw@;p*`ca;_PbNd>$7C*-F>7nK`LT>2PP(ZY zmJH1H5oGo=+t!)y9DsxRP$N)_Z0+3aED>|`++a!L;Ws>1*e=!mnB154(!X@svk)D> zVM|g`?B;To?pk7Pj*DS(op}88injyAEgq1}(Qd2R^8OLwEA~7Th;DM`{wncTpR3{0 zV;^b)wC~bKB1Fq#24P6;K#w(aMXU1b{Z}dnm2%&=7bam06p}+Fs%2AkT6y!*tC+KnCfsymG^o($593PMQl#@Dei1mcj_ zjsBQt)x9t44HiwLMVsQ$VxesaSHu@D(#0@(Ik=HnJhKk^IU=c3^_qGNaoSvKM5fW8 z0#?2``du7>H(0OG;7qAakEvX#j7}6In@UqydgD?Jly51362R3Dh)x;0t&?j$NI>UbF! znXZ*8HYhC^m4Jw}sz@P$_!i|NXeAc68OU)f+!MI83MA+C(riioV{m6baVOU%p=Oma zESW3Qk=vb|lPaJkT^Us>YP$eZGZc|f0?0wwHz=e#7B|*va3hrbn1z}wGa1utJEiNP zu;p@6b`xJd~V zmGn5nTmew%O5*o$M!zt=7TCCv)a?sE>4IiJD>8bW+ry~fLf%evgu1rglh7J-QF@F- z6?kKZ!vS)Xfgp0q%xqoF=_^(VPlTO5KivqsWqs^LemhDYE@r@nRH4%})((IUvlzka z!7#o3C_Y%-wwYVe!I3l$jt4{7fKT9Du5r6sPj|b(Ky@IJ$1K1${b{Nz_lh_H1V zuy7u-5cEQYfH@ZcgA?zK2tPkuNPG&v+~^xI7rG#X_8Kh;8I43{h}CQ|^S@DHZEefs z$sV}Wq09v#k6or#tQnR@Me6c+$yN9;-0SkGu zY0bASjnh)4>Z?>M)+LG&Rgp5Z+ouNvidfXikKI3e*# zWK5qUWDqLAyI=b$xb#bP#qWNQQlWeAu%7Zd^%J#{w)S>3M_N}&O%Q=vBg%CWYw80$xdEXR(#+mQfa z;;LZv*^|vX5E&D^`9RBLEhr@~FKR#uS-Q=~^Wql{)T6zuUpq*-?vyB#%#yoaJ$4= z7j4LqflkcbOh^gzD*&iX%uLG=^6@Nze7V5^`qax<|0K9p{+X3J4$5CgjaxcPb>*Bo zWM*Zdnr#hX%$3ZBV@3RK$O76+IGTClf1#;mt!65r-L2~)7p1Z{mqkerQ)L!lwW{+S zwc=*dZ=@P|TYZEjb>8YZNCG;K@E4*nlnCY8$Ft5dt2_X}orAT!>w+mkQ`SB~=jjVd z7uHDWvB(;H+B5DC007!%)W7{K&GaBQzn5P|T3c_oH%J+?)d1k9kXU~NB#r7Som!Zx|AC_xvjT$c+Y(k*G_YK5~ge`Xg?gRKD4p<#QF2Xr3R-PHAH3jmTGD#ecE*3n-v!ghM@8!y~Ov-k-D z3d%dZ)hl_CsnTC+H(05cSS6XwY*hvCK54Xj>VI*?{E;6ZL#ArPX*9mYwh~KU zap7q1aAplJ$BMsBM$+-SEsdT$C?3Ck9b3>rCjgMjK9sqZ?pYR<2mEWd(W)n&(B_QK zKM+%hms91ISlG8+^&GX1C9>et_ErcQV!mRGehl$KXq(cpY2D9V?m-08RYtPZxcx94$N z^(e*_C39bgb^Bvh^Thd!LLGAtf*1wTD!u=Qw*hwoDR@)oCXod0E$wN>+QWd0LE$Es z-;=kSYtUFs>_l?2efwDmJtO0=hY%t=d_P01)Qh7;RfXEtopREuTI26Twl?disY^hg z0WqRt0T@>vP{Bt2^PzpJVL}ue!#p}Q&^6~3$ZG>+OuWCDlF;LxVw-F-VBu46EZ0P) zThyhOdo?lgS>Z);nI;8MDYGSa-gsl#jAakBKJ!N^W#EPZ>h`T#ldhBagUsX;utoPo>A?7}$OGxMOIwj}*Vjw6`SvzBT2k$$aI|NMc zFY`JAD-1pWV0?&mX|tT;tt%R2Wm8)K59bKri91q=()_N;U409zRy->fdY4T{O=BQ<v!Xr=&iQzlNp_Ql6vD06}JVI7oq5zE-A&{4wB%Zlyorp-$5igD&dgBUzjpyWMo{4 z)&q)J*QjZV?sj&AYyt=mnGs+>#n@TwJQdel52`o_K70(&`by=(>Q#AwZQS_rSWs0I z0ww^t)^Q}U3-Zr&^o*@GzRfc{Om)axu(h>zDbt@gw$)nUnkpka<|VeBBkpIdee{qn zX!~RN+C)zLaZuOgeb~U*AMxRl;P>EjXcH$4%N#x1*t^&vy|0TS_d(1yqAK`Yg|ydM z5ptmQfZddPl3~|6FRyg_ZWkSYn(Q_=XT{>_6*Fk3LH-G_HwyG|r;^ z+MNrl8)iCuM=ExAZLy>rb>R!3p0x~rweSKJD%jtEn1H&HcR^)CSb#u9qkJPvWnAL_m~pXmb*u2C-<*n>rK&Fwz4desnl|#eH(pUL-)(bBQAxQ- zNJA86b@(&7`1CoZ54Wd8XJCMnyQ;3ZvnlMEvb6f!L|D&AxB$+DleP)GpNDF;~!oW|`F zl4iCf={D)Pi1XsN&-oU;*{T?3dg)Xn+mcOJpsix>Om%%n(;_+gryxRGtJnGRGQE-0 zjxNDtlR+=&MES!BGtzm|uA{FbCoR9%Z_M;nuFr2*p<&K`0eFci5(`W8>cIVd?CqHp zJx<1CR<37v9(6$;rp}&5WAq^dTpC~CL3Tg|V=e$G*AjgzhAC)LkMTQ%*zRKrJAg)) z(u%V^e?-oPt$~S0$846HC)#hfGt8z-lmpYXjg9m90RZJWWKl1Vs3e0mq2zrt46@zMeW3x8uY~k^OoqF5;f#zbBla+vD4rl2= zgJikJkf2MDe%q%gV*W9;NaDHt2G$o+&5~NzO!%W3JY4o825Nu}qDVuYBMNBruc8h( z_94jAi+vV6wpI#ADHJZ8h1^{Tn^;nwm)h&dKm%?9x9G72ZKqR&N?1EC<8c-0pSGaR zSV}p=-Y|(joS!sxbp;Lj^*g;=77T>9w2C*q;?m7{IpNQ1V|bND`#=qx7pC%9(|Uyez}4F2`*X{8V%r|G2~g+G&6cKQ|+`4RG`yaCo2o z{K{fT1mTpvlkS%deX$CtLdV*z&ZR8?;`2)C?;MM@z?ak^wNA+Z_RJxR<9z1y%J0wl z%Vz-LlZOMO?CEsMHR!-#y)q}zup$j%Aw;IYk)z5b0oFt0c{Brb{K|&@;*e|ve;|z< zSgXcBMCFAwz$rsL#~26>H_&AeOCdLakDMsJ|AvsT8x9UD3^Aa}1$D>;MN6iVP(Q1U zjI&2|-o^fB3KE}A#^_Jv8@!#WBVW}cqk9wOV2-azRK^P-Ga|ij&g@gYYA`#C3b!Hq}KB4y7uHKW(r0Yi&S}p6XL%r8UWs?Jd zt1(LA(D8ufrfSSZ^V{M^dHZs!PWa&P_nA2%e~~BkTc8LW&UP53{wSF~{z^UYa#pY& z!)EozVP2@Isn&kU0nCU9i$qNRj=?vw{9a1vjkB?v0i|>F@#e2ez2iE4F1AN`m_v86 zw5M4IRiMM(UXF`pF(e1!Ko_tEVI%&XrOc= z8qcu*>D2>F;9!w;eo5MCm5wo+jt|C|IzFrTgJbs2Q8l4=$6wX>V~>wbUan0N$iaoF zEW=+rbf6pWzBe&k#&!GNBAeT8FLJ!JKk8)fP-zJz2e;5+fv!`~b@|Vk0uMKn@&4A5 zeO|_KjB^u)a@%|Q_Ge}^RN+)tl{qUw6uReQX=u6RIlGb06!d+V zNv_as8fds#K!B(ivp&!w8zi|Njk@!*6`z+^%A1>L#-`G{3L57N7IxG+h)Ix!^==KR z%9UrO*}t!&>06nZ*jgONT?JgQ0aTh>(tzj^Mpff_q+MsTpweW)x}vJPVnbU|QIpSS z7>YVOGm{oY%tMqFmVI0m;v1rl%E(Cka#)$C7B9i&V3siJG0vGH>)nDf){5 z&RSQxcq()#@$zru?YAJv{CwKs@1o zcx2KxRy$Oo-!)d&scra;OpkYgg-yTBtkTkIb)CKF!oY-pHV}eSyjWC$MF)lpf03X| zDMfL69MRTm04!k}X6<25qV@J@17nfH*^#ETF6^5lM(Rc%XK%55XLFl-8}qTLe3_#c z^o6xuXGzY=!ShSAu5HmH{%ypJY^y@P8wdStPLbS$qB@?~cSWIK-U1A7sWIknD>KU4 z9k+&#R}qkS#`6L|8WzVHZ*1pd=CvW9lXr95(bFR%(<3#Dl4y|-V!zsSRa$8KrKzk; z_CvUbHBTb<4tdE`7E#Cu2+BJg;XF7xSc{hwqus=f4L% zUdBSzW2xNAh8a>ME=v{paXyb~4o(?cYm%eY_!(Vu8;g@`USgkzFMk>u8=JA4=x(lE zy%yUal@u~x=?Nbt+i%v?^WqjAV$tcr6>6luuWRiQcs}G9ihCHDbR7lF&r&S|J}srr zoYPk*!`y=+zfpwBsRRKi%m;O6QBUti;?9^0y#mF1m%KO!<^?Yt5tmN8Nv)RA&+b^{ zM-rD&Q)^JE@G(oktLJ~5!ip8oh{DbnQNRqJ`GWyIvlh+;Px|IRZLlJA z!3?g{`}T3WgeVc&*{KmuOZYp{^$@>mf&qJ{q#3$0lhMiAHQcO0{IaO zZvR6JDgP`Qxsbp&E(eTo*C8UH^TxlCQPm~=t#{0KkQaao0Ns#RBbjf9ld0qO&d(ib zrKV>_6_Q1L%gV}_hTo1UeEK}y3=P2~ebd4}>a@R*SLqZA^)*w%IChJ?vcz7CAVd8c zz?kjQ!(vDr($hZx0~n}~Yd3&4mq!Yij=tt+rImQDZ*Wi|cL_TDjBH@DoqSu6(jluY zy^(ZG+p%S6_{sNco9wQo&9Z@dKX=+~1pW(n=-MghRgs`xIXZkM;C((|xv%Agwwe^W z2GM_j+e2i)x04=x`!`#oy?}naPwbZeliY!yc_7|UDm+xc^z`4P4m1%^!xzer0>G5< zKZgeah#0y56ZL)<2&-R^Pm`N=qi$!1Vqac$)USf#lQ=oaYVu#CX`j0GH6 zVu3HE$p|0mh0nXp(}e(_<%q5M}HO*zSsgBBsQEH%w0_asrz0eq?mhV2CpI zxc~Hbq3bvKeQuI5WVW5B!K|rJbsP9LE18Zz=&zOLB%rJNRrU4lIX~6|!q4AT#=v^o z?-t3T61~9)bu^0EHc-|9u%P@l$N=JD*&(Jx1AKX(`0Xn6Bi$@YZ0P55L zsEabE`{f-W^VtfmU%*Po-%4IAnl3I43jpai0{t5WCPd1nv7wrJ9{q=aMapcx#*k$c z%9zvWcMT1}xvT(&0Nf2ixEC_uB`F!Tz(iXUiC16yOR-Z+uyeq@Hcwxph)iYMIywYX z#n1K5_GJE__P#PK%I;fVa8$ye1OX`l=@t+M1f;tgM5P;vK{^ZsQ97klI))wr1x32M zL68RNhW~zs_x&Bub)D<_e?1=#pB`rR>{xs6wbx$jUiZVlRWuR?A#??DF6SO>)PUQM z*q>ALUtw$_-UoFjQc;pGOr3DEGD#nJWjxx=QI3N=JYo#4MyjeauWw;f9~I}EKyJEl zdG?k+G-%+TI5I-4OXex4i&%2 z1@=$cC*8W$(zbSh?elPgLMjiR0E||5LvF2x{xSG)%mPo2rym4)6RpLGL|>5u6j(7i zUGJr+Ug6z-bwdLvWp+X|X7J-(5EJo~aU@D-!5NBgItSpWsXAyAcC{<=Pt2te@(jdD;qG>>)t{gJ21u-(2)Q$} zV~@r4+HG2a-?7HyHWBBnE97%z_C-|gc2lC;+DhL{^hE(=V?av2MasqU{f zf8e(sWL0E&+0oIFWH`LAZfib*OqWigkaX>WVhZM(3FD{pF-GenQhg}kN|->dlX-1 zp0q~ip*7!%q!mljjM-W(t9&nh7R4}@qda3O9V=wWt;M-%b8Ygl5;%&C;IKU;oSlfPJ)Qp)x~xKANzb&~GDK5V6O>-#kwcLzM0>qrtFixTtB*NZe4(UaZS z6JI>hqcGjDHad<+iJb2A32&P;k4|V6={8tYv@o z=iorW@{o6Tg3-uQZ5TfPG5+2wI-ege0H%BQCID}C;Rqxp25#o7%#YkE**4b15n|~V zu*(%;DSo*}`>C8#a|6C!m2PfMCUm^%vXOKqWjq8Kw4 zwLk@qI|r;qkF0v9a{42ss~ld&AUBJjl;!$M1ogc#hoiz#-SCW0Qx$n$H^}NcbU|FJ zcQm)v9VmAWp>oaE_qUb8?W_n*&96Nl-vDs<2s^~@?_LZwEU#wOJ#4QK76FbE#ftLz&3SEjBojV3S*-_DJuO!iDfr=JFYS5EIF))?kY04RHccNy#KYup2C>Q)pt}(#js>^<19526q`bIs8zjNg>z7 zkt$9h27j|In0fTDS!aNvi~Z}~szrDkl7e(U|6@MtqzTfXC_))J4M|e2vc64ObC;xn zKY5q!rB@9}`@{A+u8{N&{F5M8L^P{1}6jm`UDpmOGVvdrg zR;@I*`!zbz92@s+`qzi^+kJ!f74-o&8-{--qAt$+hrBgWnH@-LkaC; zKfGd|YwPwyg_-idbtqn*p04QQ5y|8WMq4}ev$r&#<|8||fG1c$c`BmI^EXe+LvL_& zpJ_uPkWE?O=q>Z8T?;QsZ&&J&w30yVOpT0OZLz>d zX@q$a1~*nl=mpznP-Z?{%Ma?49wKnb|Om6nwy=1x`@Y-m)5n zimG|LH$2AheJQw}BhHT7A=Owj>f&{&)!g8v!%;H}BibSWM3e1{Q zAQJXrO#{vgt8R;oiV~nO8DrvSE;<#hNgUfLG~vO?KGE@OtJTiM%^`pHp&wJ@KHJ_- z2Y||X)AIU#cGq}hy2>h3N}0KkFPW~^7GC3DKjYiakP*ZnY?EWH`|XEJru;?$v8~)2 z<_YKhed_aP8-|>eY|c?+0f>7@%&?wyQ!Q#)_suEVc|vgGAi9Z>LzY)CK!#V48IfDq zZ<85rV{V?Pmx~w)ch4T+b688D$ah-HOmuT44+Hm`KHGO`A4JR4(}cVR>0)pO+|!SbnZH6&@5@K^G0?Qq6i$kEFc(sBlG}m3QbdCjc#} z$j{+p;={`Bi%}>{Szsh0mWItf*&3v0d`u_PhUN@U`*=W?D?SbG|f~zJwez@xzzi|UQ zd(P57*4po=_UT>8i~%$F`V3&#?{f?kuzNL^JvEF;qF2e;UMHWIT+wvab;-{7x`2{C zmFw>Psp$XiHGR~#k2haSy#S1wRU^r#HfI@6e;#Gb&y{6e2o9hBf}Nv zV#dn3j=V=kZVugChJO|#g}1HXq?X^a8hY?K4I>;FL4&pgX)du=%4-Vm$YJpPai@t< z{Bl{nfZ>U+O2r*Lwe00Cqq{1XbqOA=2A7i`^tuz1viT2@31hSA<)sNRoliuGVScP| z1~fWWs7QWW?I(Cmi2G2A4kcmtPVwNK;faT8>^b=|Q8KwAYKgu5$gHsPNik-=iWj>d z0cnr2m9$pX9|&E+e}h$%3cj`4VA=6{@Tv^M6rT>0wTw-6`_hJdl$>3>UInczd%{|R zU=-=nVVj~gzP}X*P_wx_&-#X2-%~{G+nD!9OcoekUmO`BbmfR*DTwN>xtufbdDXEm z9;<++Bz-#!kok;F$G=Kxjn)_~^KM|LbheVvs&Zhq(j&Y_8^y+j#Z%WBy=7%?m7r8g zq3HSqgwfQpgEE-B6~B$$3NoHAqA8&w)+Qc^>R-s{V&%=WnOEp~)!z^)l0yjlkm%xI z$>gIp5?-UuN0?bkzkBI;bB8FoHI*&C`ZoU)|btO>cp5JlR)(wl*F zjp9|T%u0}(@Nj@(AhF7G`ZARRvx=HF9zWOCip+}EccYE++f50~{;jrfY|{D8z5UR& zTHHF+Y(}Z<6%|tzFW84c!$1Kjch>;(=CY5ZF(_TFs-ggL-$pY6<6h*lU zZja_&Hm%COHYEz5QbQd{4Ef{@|(!OSdKp?)dg=!~Q zJuH7KO2NByoEK5lnfaQ;rzCMJvLktlt6%Walm$%%aY38TZMw>06-#T?RKZ4Wz2HLU z$cpjR$jZL3s828gw#5)`gv2D$O1tI9`toXSdO=7?aH6Ked*tmR!Hs3=;}6xuozmbq zlxmol#0(4`6lA>lgX5}JZL{$E0c?hZ>2)tZ30%~g%{ydYk>DivNb8c2^J#iWB(b)Y ztxAn5nO=gWIe&s^ntP|&suD-)`_bD{HuTp&1NJd&gR>)&+E)ae8fJN9)4EZm8KHQZ zAz~OhFRUg425DPlNXE?X@uLV6JhXS~Mh*MJH}WWcI5&jh5*;w0jT`oZ^`o8)GH&)Q{VR(G8b3a0)pW+gS7w@a}kH6O_w*_vZ{lCmT(@M`AT))Tid=6H>g zhTtk$?GctCG1Jra<6tKZq1bq*3A>F%W|Mz0((3$H-K)ph;t3oqg+9l%s7`@#aiuwMB(`(`FvOE==uHqLP~z*ZH4 z#u!D-hb*`(RsM9lVIml~Dr0#W;%HSNN06kPujHDfUI`H{CY}s^ie$ImVm2x5byymf z#eI36SEI2sjKR(Ih{iA#NM^v{=m%U=Enm0j`2KbyiKdXiVriDHu>S4)0kvP22Wgg1 z-3ZA4n}4Yr7XV>vecxz9Rh-hN^!)?|%7w4W=Kfc*@DA202%FBi2y^Z&tk4_e06XjA zd*g$9Tg2c;cy}ISE-iex{;Zeo%7s6xSsv8srpso619qVnCV|YukP02^7)Qvj=__gk zP)<8<$k6ztoiKpJr}~C}9bIWqH2AMai|q<%aSQt9(IAeSKYFAFz&F-H@74SE670G3 zB|kcZrjj2z=8-}U+M2l3faWn0C473LMU;^K5n3Jq0|1Uo1CKch(2a+f@ib6q5#9M> zkO0tPMm&yov^rycwz(nroB%y4KTLp#ReO3{3W25-0MEm_((CA!K)xSH78Fu{4!LXb zAYML#8#mF_;i-d$xC&kdLD9yypx<^?5zJ^Q&v5{7)JXxkSpxzx#1q{%J z=RM$Ed^B*??P5kfsexPfR=Fr8nB8IEB@9&5R98WdW|0O|Md{xFO`o41D8`LP6nObU zZh@dpu7Ufeko}$no+q{ONugd|@}mJUd+zUFWp9E=8$YPv<&a1wSeW1&1<>a>g<^EG z|LNS@cR(Q|=(F;2G zT+){`Tt}1t4ansMou!04>lk!sfAt+kQ0%f~_)B!hQgpy_B9d1G{7a%K)X=j8ZQgCj z!wP^|58q~{zKs4+s5$u2R{rDWo1ngN@EnBlW&%lypsPF36mG=f11!VEPP-TlH8gBk zxCOe%>q|Uz!l|#p4H2~Yju5o@aDdMg2+L6kNOnO}^eS39)LmfU7fvM6lqxU-M6Rc5 zg6JPDLfLMUJhU)KzK;lje0c;h(cWUwFtFK}dV?}`{%)TU2HL+cKJggIAjrO=rW)S= z*fmU9WyYCn=-$sld2CAMin?H_CxAv;F2ZA=)6G1fJ~u5I6Ht)R4m|%btd9iC6b#v2 zIpsStYyTS-fOo)JDVPwQ4kjl-=>!{i!431EE?6?te7@)QA-xoBJR(uJrQfYe?N!ZY8B zPU3gBH_ridYKYhG_!}QS#BslhqLuo1*V0@?P!Z(jem({+H-l4oK+{*`wgQ2JMF}2IP5(b(-|AcA&UDQu~!Q#A*CzJNyb&xw? ze$Ci#M^FAm1<+Eyj)yV$Z{e#SeTk)y$J&lct|k-i=XjW!)*RCi){E_H#2g3*O5VBE zC7;iQ06IehV(`r-a7jA4|5$JIGqVHz5&k3P$x`4rD}HYXC@W?aEViFEC#Xu z3}q7)6NCEk2Pe7isXoev$<9X%(TN+Me*N=F<6F&<0uLTi%NRC8O-;>ImlW2#o2_lg zA=QsTQl%HGE(J&lr);*F4;B9$%aqOTWZGSSO>ZFbK<{6|^wD%Jb}D z^<7GLG6El{y{n<36W2ZbtA+J5zJL7M_L@(@+i9R@-Av9C!{icDOha4&;>PRLBjxew zNuyDUo4e2nMj*Z#&cO@P5Ad8YLGZ+Ea8=hVq;?@*3yzcgBDm_dY6df%(?YU6FT^)I zet@l4HNDzU8CVO&^Cxq3V0 zaXT+L8F`}#36JBPjO#s*e|OQ{$PawA!DnTP)*$q-jzi*#^UB=EDTfS?Dw{b*k3tEH zl-DZK($eyU_Em9mM1Qj?qCgJXOt?i%#eZ$4?0Q{#A@pV<;so0mvrwq?rr&eA6jc{C zQU3cb+KwZ~z~|{=JrtiQAM={sH<{Nun(#?9tJ_d6%(RKu>xh_reD;T<@){ez2JZW&c?>crxJhoKgID+gJGf&BH+XU8fp8GcKo+4uIBPZ8RUtB~-e?Xh{U?rB|amrIH zXZJ)XozV_8QLLb?p^Yw$MA?8Z*uN@@1Uut#Va1`|u#Ue$W`n z$A&F}Yw#$a;bLZ#OVOPy?p}8N8W1vgydvtUaZM0@U!UTKAFb(Yv>mVtdzd2(r!oMi z3C%qKTFc9QTfHrgNqE;Xhrvuxt3c1vtUbYW61gy$)tKajZ)R{l;;x)XKC;@kVI-Yx z8p0sE_R9X|-E@@Qq4Up&?@_R5^JMo1R>RU^R=rX>DGjCzvkeALN|>bs7~)*;S6Og} z>Rn$ACZORnUrY57w#a;=rv4mW#+^!2%knA0{BS)cF?|vGq|jZY`hBcHAPGP2XyWI|GM~ ztg5Jx@>$ads-m3G?k^}(0`hjsygO@lhP^{d2T2o;ZO>_<>ywQ8sJt79e`woX9BfFt z3u|BHJ7j@WIWm#Kf)agSW1{!NHK&f?ex7jWAY6#fRJ{XLTU_o(TL0AiArlNL*II6nPu7XetK&O*RTZzC1qHU%KTD_^JNUgT81u8S1lLAn5hWlcni zV$OuqZvanu|Iq~?49Jq25{!3NwJVYUvxJV?h58)l@-%9RAMhVh65m%sOl&T78s>Y7 zyqJ{&h6_|aN_4qcBbQtmy>BnnG4%KsaN@s?Dp6{342_D?o^LmRm1B)rR}

pF0)N zeV}+6^7$Qa_ze>-?g(~(kW72=vqo+mq4RciSvXth;BC{R*(A2Q&(1*ub@e9%tm-S* z>V6zmsDRvyOPDjD-woAI!A*0H%a7aR@o|u8Tl=g1DRP(gcWqvhl5Zdqp(b`^M~%A^ z)iE&v0ono8`T65)&7H;yui|+-gKSE0UfbLva#YEs`*gB? zVhMIv>7}w*)OG-X2ki>pO4ypTHi1DJCzJ=19+AO(@;(X48pa9PnrHZ*k>;=OcvMIR zCSD1{wwRg~C*hge(WF0*XpXTr_&Ptkuy{w1E!nBd9|Z2#kZcCtn?BI_ z$w)Q9rImP`{e|PDYZ&BAhuZiFF1#(jT4}6-GMmD3c6N@12m}E_i8mfwb%<|5Wq@P!^B3-FFu}XM9_$FaOIbYOc-&U~jQaL$>vFCnxvG0aFDY{GxZs=sELc0?HYFD>$rnPNQX+t61blLk z?cDB8I|QEjVXbm)6SAv;5e+<7!sB=d83Kz8aw3}4Cx%7{Cjm86c*&jw?KaY^qm*K4 zk+A7stBoNvyNLzkGaw(-&{RY;sPIcN>Y2X)$wK@e0Py|J66`?0slu7(F5t>1b)jbb z$81Z&tpCSsQ!QI%yaS2)IWTtAg3IONz)2u2ny8MA(PTndO;^e2nyq94?^wc=#LL@Y zups$z%jp&p_iZ4cS$bSA_De*n`q&%gw12vJ;n6r$rru^rJa@Yv@ZXldXc#zGn8JfH z?)?2RqXgK@Z*;5yQOI8(OFjn2jig!_5xBA5(ZM_;i+Gw}x~(|ty^UPunedtloJ#S? zl|M=PelIv+fqpRZVEvi5r(PY^xo-Vmr_G@_INp4g{S&}WxU7(Zdef!4uF4Rahs-0K zq>nLyKQq|8Kdw$Zaiy&5YhAeNeq`)p4o>kLqZJ+QckFa^^uf+vr zGBH$LYeWIAXi@GL&kwNw{A1Exm9I9c_cm;Gx=RIKr(yRdd?r=W-fGl>nT45lMbx}4 zQcujRH{*|BHz|Ft^u?Qlh^}HNS#bor--`jug#&9bV=p)N**adMZ?vY~b+t-4ibQ*h z&y`xWA~O>qIwka)Z+oTA<{5rW+#>pA)bTNcxz^>|Vs2So4ZKr}v84RjZw@^o;|3yd zMF0yC@9EnN&gDP@V1?IG|EUwdV1IVtLDW67^jN$oRLspI^J{$ zBA}V4HTrUtdsgO#s(~`W*NiMpKwaNDH9Q>q?Q?&p%0NewF`&389*PeZ#0!h#Sy6Cu zihxpY-=dbE0(kIXU4GTHDjB3pB_U$!cPue!zzqaa`93-gV{er1b5zF+cRF<+*m)o9 zTp7dp<%XmE96qn^FJ|nt(O-Ob3iiucDoZ1nAfa(tG^Moq*scUaP7FFEh%mrV?|qgC zf}Sb;f!Ka;)^vUKQ8fk%Rg{f$|ZUlFl{sU2%*a7R@MeZ6c} z0&b60PlpSy2NtGUNG~y}uIIT+jxN1M!K$MZOYCBMs5AVq5%eFb$rID_wkN^GO-nQc z+oF<{P0*;?v6@h5HQ`+xms6H5V42sgbuTaHvHQuz#tFX5w6sx3s7+goH4XUZ;&lKH zm47N(yf>Xkl9@+w=v!Ki;xuHIUz#~}@D_S=mPbke61ZRZ$jUx{Ki`3%Z;2zAQqtd9 ze$r%)-^BO{g_}VCg=%pB=LOf%oCuJ`NfE6h7Pz_5_$i@q2f;zNx>wftSbcz$bXj9) zpaa__Mlf7(1ZXeuiOhyM*H&?1qIa3CobEdo>V}4i?Ipv2)O2z*mX1g6<~nTn-_GSqp1CgIfY$g zRML5r^z`+Cz4;EJ3Ih~^a$s(R3htBwFDD=zsRIYqjsX3Sb*v03tC2*X@e4!26*`J2 zJk)@r@?Z1YS9BHI;il}W5e9fQ*?%d;zkrh9hd5QV}2f|JOxX2up7RVfK34^xxdsi6mr?W`-e zJWNA^Z5CW7H;%kfc1HXAzdYIwC$>-eYxg}wetCAe-Cf$=I!h>G?L0sQAT}o1tcMCu zQHj$N_@b9EU}+@Op%UlPU>@)e2>qx;yx%#o&u326`zTk740PI0)n$&_9-kFZc=@bJ z=d$HlBL$-es_MK?+{pz00=%+cR>a+u$u8)6=M+URz;m8nr^ zpbLzAvwEL{KVrFB11d}lfLa3nE`=Z> zrhCF3dnbXv0VG;2TZtl$+caoR#BuIjt+^lOl?=5^IT1~@Qmcj8AMe$WW{TF?8aZl% z0b#V#_g@88jAbiRF&R`9m!q7QdQC*ur|LNjYn;PCW3m%9F7v&a@-4<8R3g!nwI2FY zE(YRnuZLCIPmR7P*aDzQsj{MhT+N7%Py7r;zpg;TyM(!fgD2B_d(It5XbN|(HL9)Q z8~Cj)YfZ)DS3l2AkJt7a18%kDX%}Uh6{y=vc1|z;! z_>Di97%)6=3m3Wl=bXD41Ou=nIEqc%h!^bV5`A8`9+JBaeO9GiV8QOZc4?vU&B|1L z{kA47M#RUv66CaG4CU)04L~X&@ZcpU6vbDyL@+Rf9Fn^)u;3ILR6BNF!&{(=Dm8v2 zG0dB-l<25kXi!oFUPS;miYopUHzv!sXmo&=+7&2ZG$FIjuA26Gd#3qN?(Meb^#vBe z7UR*vTlnih@`%J+3@yfjO_aj!4~+y$jGcbB%kG)aeh=)_)*VN=ZrHSso_ihd2~eqw z_hlPb|ZK3BvH2RWX4W2)!Px00s@m#crCs*NaCtsmSux(xUuuN!WGX zq=DBGw3Mt^8@i@y-k8`4%L*O?(0VG@T`B(P?(h+zSAL#&z|FmR`>g`9uqr+$ zc;IPZ@@*C^g)fn5lJA4|G+8JgnGDnF2EH1t2kW2(qyyQ+Xqgh|uM8Hf%}=0Q*A@Wt zUHIt;cyj;|tB%SepEFiCVl{NE(*FG|4z)T@w>a=}Bmuh78HRsWA{JPQJ-_t80Jt#g zTB*TYBVB08*lQ4L%>dhu z1IKQh0IF4+*n%`@OrH4vbnQC`yfT|^iBe{UT=S(S4P&1mti2d3v$};N%XyE|G zPy-Z$^Ob5!pcsOE3s;6KY(JIRjPw$_u3$Qx$A&wv4)+Y2_UCCUTMgvWzb9rRFw7`i zdEi_tdAzqq5B3WaMVY&5jk6`Lp!>St1s+mD`$gukpO zw-qfBR844RefFx-gN3SbnP6lcZ9VcQI^oa{GXu(XSg|0eVZncS2VQ6a~~0wf>dT zjpVt~a{UJv^Nuch36l$yeI9Gt1cGuG(gZ6a1*`~BhPQS!K&}4sA>Jz>` for ONTAP backends are listed below: + +* ``ontap-nas`` – each PV provisioned is a full ONTAP FlexVolume +* ``ontap-nas-economy`` – each PV provisioned is a qtree, with up to 200 qtrees per FlexVolume +* ``ontap-nas-flexgroup`` - each PV provisioned as a full ONTAP FlexGroup, and all aggregates assigned to a SVM are used. +* ``ontap-san`` – each PV provisioned is a LUN within its own FlexVolume + +Choosing between the three NFS drivers has some ramifications to the features which are made available to the application. + +Note that, in the tables below, not all of the capabilities are exposed through Trident. Some must be applied by the storage administrator after provisioning if that functionality is desired. The superscript footnotes distinguish the functionality per feature and driver. + +.. table:: ONTAP NAS driver capabilities + :align: left + + +-----------------------------+--------------+--------+--------------+---------------+--------+--------------+ + | ONTAP NFS Drivers | Snapshots | Clones | Multi-attach | QoS | Resize | Replication | + +=============================+==============+========+==============+===============+========+==============+ + | ``ontap-nas`` | Yes | Yes | Yes | Yes\ :sup:`2` | Yes | Yes\ :sup:`2`| + +-----------------------------+--------------+--------+--------------+---------------+--------+--------------+ + | ``ontap-nas-economy`` | Yes\ :sup:`1`| No | Yes | Yes\ :sup:`12`| Yes | Yes\ :sup:`2`| + +-----------------------------+--------------+--------+--------------+---------------+--------+--------------+ + | ``ontap-nas-flexgroup`` | Yes | No | Yes | Yes\ :sup:`2` | Yes | Yes\ :sup:`2`| + +-----------------------------+--------------+--------+--------------+---------------+--------+--------------+ + + +The SAN driver capabilities are shown below. + +.. table:: ONTAP SAN driver capabilities + :align: left + + + +-----------------------------+-----------+--------+--------------+---------------+---------------+---------------+ + | ONTAP SAN Driver | Snapshots | Clones | Multi-attach | QoS | Resize | Replication | + +=============================+===========+========+==============+===============+===============+===============+ + | ``ontap-san`` | Yes | Yes | No | Yes\ :sup:`2` | Yes\ :sup:`2` | Yes\ :sup:`2` | + +-----------------------------+-----------+--------+--------------+---------------+---------------+---------------+ + +| Footnote for above tables: +| Yes\ :sup:`1`: Trident managed, but not PV granular +| Yes\ :sup:`2`: Not Trident managed +| Yes\ :sup:`12`: Not Trident managed and not PV granular + + +The features that are not PV granular are applied to the entire FlexVolume and all of the PVs (i.e. qtrees) will share a common schedule for each qtree. + +As we can see in the above tables, much of the functionality between the ``ontap-nas`` and ``ontap-nas-economy`` is the same. However, since the ``ontap-nas-economy`` driver limits the ability to control the schedule at per-PV granularity, this may affect your disaster recovery and backup planning in particular. For development teams which desire to leverage PVC clone functionality on ONTAP storage, this is only possible when using the ``ontap-nas`` or ``ontap-san`` drivers (note, the ``solidfire-san`` driver is also capable of cloning PVCs). + +SolidFire Backend Driver +----------------------- +The ``solidfire-san`` driver, used with the SolidFire platform, helps the admin configure a SolidFire backend for Trident on the basis of QoS limits. If you would like to design your backend to set the specific QoS limits on the volumes provisioned by Trident, use the `Type` parameter in the backend file. The admin also can restrict the volume size that could be created on the storage using the `limitVolumeSize` parameter. Currently SolidFire storage features like volume resize and volume replication are not supported through the ``solidfire-san`` driver. These operation should be done manually through Element OS Web UI. + +.. table:: SolidFire SAN driver capabilities + :align: left + + +-------------------+-----------+--------+--------------+------+-------------------+---------------+ + | SolidFire Driver | Snapshots | Clones | Multi-attach | QoS | Resize | Replication | + +===================+===========+========+==============+======+===================+===============+ + | ``solidfire-san`` | Yes | Yes | No | Yes | Yes\ :sup:`1` | Yes\ :sup:`1` | + +-------------------+-----------+--------+--------------+------+-------------------+---------------+ + + +| Footnote: +| Yes\ :sup:`1`: Not Trident managed + +Storage Class design +==================== + +Individual Storage Classes need to be configured and applied to create a Kubernetes storage class object. This section discusses how to design a storage class for your application. + +Storage Class design For specific backend utilization +----------------------------------------------------- + +Filtering can be used within a specific storage class object to determine which storage pool or set of pools are to be used with that specific storage class. Three sets of filters can be set in the Storage Class: `storagePools`, `additionalStoragePools`, and/or `excludeStoragePools`. + +The `storagePools` parameter helps restrict storage to the set of pools that match any specified attributes. The `additionalStoragePools` parameter is used to extend the set of pools that Trident will use for provisioning along with the set of pools selected by the attributes and `storagePools` parameters. You can use either parameter alone or both together to make sure that appropriate set of storage pools are selected. + +The `excludeStoragePools` parameter is used to specifically exclude the listed set of pools that match the attributes. + +Please refer to :ref:`Trident StorageClass Objects ` on how these parameters are used. + +Storage Class design To emulate QoS policies +----------------------------------------------- + +If you would like to design Storage Classes to emulate Quality of Service policies, create a Storage Class with the `media` attribute as `hdd` or `ssd`. Based on the `media` attribute mentioned in the storage class, Trident will select the appropriate backend that serves `hdd` or `ssd` aggregates to match the media attribute and then direct the provisioning of the volumes on to the specific aggregate. Therefore we can create a storage class PREMIUM which would have `media` attribute set as `ssd` which could be classified as the PREMIUM QoS policy. We can create another storage class STANDARD which would would have the media attribute set as 'hdd' which could be classified as the STANDARD QoS policy. We could also use the “IOPS” attribute in the storage class to redirect provisioning to a SolidFire appliance which can be defined as a QoS Policy. + + +Please refer to :ref:`Trident StorageClass Objects ` on how these parameters can be used. + +Storage Class Design To utilize backend based on specific features +--------------------------------------------------------------------- + +Storage Classes can be designed to direct volume provisioning on a specific backend where features such as thin and thick provisioning, snapshots, clones and encryption are enabled. To specify which storage to use, create Storage Classes that specify the appropriate backend with the required feature enabled. + +Please refer to :ref:`Trident StorageClass Objects ` on how these parameters can be used. + + +PVC characteristics which affect storage provisioning +===================================================== + +Some parameters beyond the requested storage class may affect Trident's provisioning decision process when creating a PVC. + +Access mode +----------- + +When requesting storage via a PVC, one of the mandatory fields is the access mode. The mode desired may affect the backend selected to host the storage request. + +Trident will attempt to match the storage protocol used with the access method specified according to the following matrix. This is independent of the underlying storage platform. + +.. table:: Protocols used by access modes + :align: left + + +-------+---------------+--------------+---------------+ + | | ReadWriteOnce | ReadOnlyMany | ReadWriteMany | + +=======+===============+==============+===============+ + | iSCSI | Yes | Yes | No | + +-------+---------------+--------------+---------------+ + | NFS | Yes | Yes | Yes | + +-------+---------------+--------------+---------------+ + +A request for a ReadWriteMany PVC submitted to a Trident deployment without an NFS backend configured will result in no volume being provisioned. For this reason, the requestor should use the access mode which is appropriate for their application. + +Modifying persistent volumes +============================ + +Persistent volumes are, with two exceptions, immutable objects in Kubernetes. Once created, the reclaim policy and the size can be modified. However, this doesn't prevent some aspects of the volume from being modified outside of Kubernetes. This may be desirable in order to customize the volume for specific applications, to ensure that capacity is not accidentally consumed, or simply to move the volume to a different storage controller for any reason. + +.. note:: + Kubernetes in-tree provisioners do not support volume resize operations for NFS or iSCSI PVs at this time. Trident supports expanding NFS volumes. For a list of PV types which support volume resizing refer to the `Kubernetes documentation `_. + +The connection details of the PV cannot be modified after creation. + +Volume move operations +---------------------- + +Storage administrators have the ability to move volumes between aggregates and controllers in the ONTAP cluster non-disruptively to the storage consumer. This operation does not affect Trident or the Kubernetes cluster, so long as the destination aggregate is one which the SVM Trident is using has access to. Importantly, if the aggregate has been newly added to the SVM, the backend will need to be "refreshed" by re-adding it to Trident. This will trigger Trident to reinventory the SVM so that the new aggregate is recognized. + +However, moving volumes across backends is not supported. This includes between SVMs in the same cluster, between clusters, or onto a different storage platform (even if that storage system is one which is connected to Trident). + +Resizing volumes +---------------- +To make sure that the Persistent Volumes provisioned by Trident can be resized later, create Persistent Volume based out of a PersistentVolume Claim that utilizes a Storage Class which allow volume expansion by setting "allowVolumeExpansion” attribute as true. Whenever the Persistent Volume needs to be resized, edit the "spec.resources.requests.storage" annotation in the Persistent Volume Claim to the required volume size and Trident will automatically take care of resizing the volume on ONTAP. + +.. note:: + 1. Currently NFS PV resize is only supported by Trident and not iSCSI PV resize. + 2. Kubernetes, prior to version 1.12, does not support NFS PV resize as the admission controller may reject PVC size updates. The Trident team has changed Kubernetes to allow such changes starting with Kubernetes 1.12. While we recommend using Kubernetes 1.12, it is still possible to resize NFS PVs for earlier versions of Kubernetes that support resize. This is done by disabling the PersistentVolumeClaimResize admission plugin when the Kubernetes API server is started. + +When to manually provision a volume instead of using Trident +============================================================ + +Trident's goal is to be the provisioning engine for all storage consumed by containers. However, we understand that there are scenarios which may still need a manually provisioned PV. Generally speaking, these situations are limited to needing to customize the properties of the underlying storage device in ways which Trident does not support. + +There are two ways which the desired settings can be applied: + +#. Use the backend configuration, or PVC attributes, to customize the volume properties at provisioning time +#. After the volume is provisioned, the storage administrator applies configuration to the volume which is bound to the PVC + +Option number 1 is limited by the volume options with Trident supports, which do not encompass all of the options available. Option 2 may be the only viable solution for fully customizing storage for a particular application. Finally, you can always provision a volume manually and introduce a matching PV outside of Trident if you do not want Trident to manage it for some reason. + +If you have requirements to customize volumes in ways which Trident does not support, please let us know using resources on the :ref:`contact_us` page. + +Deploying OpenShift services using Trident +========================================== + +The OpenShift value-add cluster services provide important functionality to cluster administrators and the applications being hosted. The storage which these services use can be provisioned using the node-local resources, however this often limits the capacity, performance, recoverability, and sustainability of the service. Leveraging an enterprise storage array to provide capacity to these services can enable dramatically improved service, however, as with all applications, the OpenShift and storage administrators should work closely together to determine the best options for each. The Red Hat documentation should be leveraged heavily to determine the requirements and ensure that sizing and performance needs are met. + +Registry service +---------------- + +Deploying and managing storage for the registry has been documented on `netapp.io `_ in `this blog post `_. + +Logging service +--------------- + +Like other OpenShift services, the logging service is deployed using Ansible with configuration parameters supplied by the inventory, a.k.a. hosts, file provided to the playbook. There are two installation methods which will be covered: deploying logging during initial OpenShift install and deploying logging after OpenShift has been installed. + +.. warning:: + As of Red Hat OpenShift version 3.9, the official documentation recommends against NFS for the logging service due to concerns around data corruption. This is based on Red Hat testing of their products. ONTAP's NFS server does not have these issues, and can easily back a logging deployment. Ultimately, the choice of protocol for the logging service is up to you, just know that both will work great when using NetApp platforms and there is no reason to avoid NFS if that is your preference. + + If you choose to use NFS with the logging service, you will need to set the Ansible variable ``openshift_enable_unsupported_configurations`` to ``true`` to prevent the installer from failing. + +**Getting started** + +The logging service can, optionally, be deployed for both applications as well as for the core operations of the OpenShift cluster itself. If you choose to deploy operations logging, by specifying the variable ``openshift_logging_use_ops`` as ``true``, two instances of the service will be created. The variables which control the logging instance for operations contain "ops" in them, whereas the instance for applications do not. + +Configuring the Ansible variables according to the deployment method is important in order to ensure that the correct storage is utilized by the underlying services. Let's look at the options for each of the deployment methods + +.. note:: + The tables below only contain the variables which are relevant for storage configuration as it relates to the logging service. There are many other options found in `the documentation `_ which should be reviewed, configured, and used according to your deployment. + +The variables in the below table will result in the Ansible playbook creating a PV and PVC for the logging service using the details provided. This method is significantly less flexible than using the component installation playbook after OpenShift installation, however if you have existing volumes available, it is an option. + +.. table:: Logging variables when deploying at OpenShift install time + :align: left + + +---------------------------------------------+------------------------------------------------+ + | Variable | Details | + +=============================================+================================================+ + | ``openshift_logging_storage_kind`` | Set to ``nfs`` to have the installer create an | + | | NFS PV for the logging service. | + +---------------------------------------------+------------------------------------------------+ + | ``openshift_logging_storage_host`` | The hostname or IP address of the NFS host. | + | | This should be set to the data LIF for your | + | | virtual machine. | + +---------------------------------------------+------------------------------------------------+ + | ``openshift_logging_storage_nfs_directory`` | The mount path for the NFS export. For | + | | example, if the volume is junctioned as | + | | ``/openshift_logging``, you would use that | + | | path for this variable. | + +---------------------------------------------+------------------------------------------------+ + | ``openshift_logging_storage_volume_name`` | The name, e.g. ``pv_ose_logs``, of the PV to | + | | create. | + +---------------------------------------------+------------------------------------------------+ + | ``openshift_logging_storage_volume_size`` | The size of the NFS export, for example | + | | ``100Gi``. | + +---------------------------------------------+------------------------------------------------+ + +If your OpenShift cluster is already running, and therefore Trident has been deployed and configured, the installer can use dynamic provisioning to create the volumes. The following variables will need to be configured. + +.. table:: Logging variables when deploying after OpenShift install + :align: left + + +-----------------------------------------------------+--------------------------------------------------------------------------------------+ + | Variable | Details | + +=====================================================+======================================================================================+ + | ``openshift_logging_es_pvc_dynamic`` | Set to true to use dynamically provisioned volumes. | + +-----------------------------------------------------+--------------------------------------------------------------------------------------+ + | ``openshift_logging_es_pvc_storage_class_name`` | The name of the storage class which will be used in the PVC. | + +-----------------------------------------------------+--------------------------------------------------------------------------------------+ + | ``openshift_logging_es_pvc_size`` | The size of the volume requested in the PVC. | + +-----------------------------------------------------+--------------------------------------------------------------------------------------+ + | ``openshift_logging_es_pvc_prefix`` | A prefix for the PVCs used by the logging service. | + +-----------------------------------------------------+--------------------------------------------------------------------------------------+ + | ``openshift_logging_es_ops_pvc_dynamic`` | Set to ``true`` to use dynamically provisioned volumes for the ops logging instance. | + +-----------------------------------------------------+--------------------------------------------------------------------------------------+ + | ``openshift_logging_es_ops_pvc_storage_class_name`` | The name of the storage class for the ops logging instance. | + +-----------------------------------------------------+--------------------------------------------------------------------------------------+ + | ``openshift_logging_es_ops_pvc_size`` | The size of the volume request for the ops instance. | + +-----------------------------------------------------+--------------------------------------------------------------------------------------+ + | ``openshift_logging_es_ops_pvc_prefix`` | A prefix for the ops instance PVCs. | + +-----------------------------------------------------+--------------------------------------------------------------------------------------+ + +.. note:: + A bug exists in OpenShift 3.9 which prevents a storage class from being used when the value for ``openshift_logging_es_ops_pvc_dynamic`` is set to ``true``. However, this can be worked around by, counterintuitively, setting the variable to ``false``, which will include the storage class in the PVC. + +**Deploy the logging stack** + +If you are deploying logging as a part of the initial OpenShift install process, then you only need to follow the standard deployment process. Ansible will configure and deploy the needed services and OpenShift objects so that the service is available as soon as Ansible completes. + +However, if you are deploying after the initial installation, the component playbook will need to be used by Ansible. This process may change slightly with different versions of OpenShift, so be sure to read and follow `the documentation `_ for your version. + +Metrics service +--------------- + +The metrics service provides valuable information to the administrator regarding the status, resource utilization, and availability of the OpenShift cluster. It is also necessary for pod autoscale functionality and many organizations use data from the metrics service for their charge back and/or show back applications. + +Like with the logging service, and OpenShift as a whole, Ansible is used to deploy the metrics service. Also, like the logging service, the metrics service can be deployed during initial setup of the cluster or after its operational using the component installation method. The following tables contain the variables which are important when configuring persistent storage for the metrics service. + +.. note:: + The tables below only contain the variables which are relevant for storage configuration as it relates to the metrics service. There are many other options found in the documentation which should be reviewed, configured, and used according to your deployment. + +.. table:: Metrics variables when deploying at OpenShift install time + :align: left + + +---------------------------------------------+-----------------------------------------------------+ + | Variable | Details | + +=============================================+=====================================================+ + | ``openshift_metrics_storage_kind`` | Set to ``nfs`` to have the installer create an NFS | + | | PV for the logging service. | + +---------------------------------------------+-----------------------------------------------------+ + | ``openshift_metrics_storage_host`` | The hostname or IP address of the NFS host. This | + | | should be set to the data LIF for your SVM. | + +---------------------------------------------+-----------------------------------------------------+ + | ``openshift_metrics_storage_nfs_directory`` | The mount path for the NFS export. For example, if | + | | the volume is junctioned as ``/openshift_metrics``, | + | | you would use that path for this variable. | + +---------------------------------------------+-----------------------------------------------------+ + | ``openshift_metrics_storage_volume_name`` | The name, e.g. ``pv_ose_metrics``, of the PV to | + | | create. | + +---------------------------------------------+-----------------------------------------------------+ + | ``openshift_metrics_storage_volume_size`` | The size of the NFS export, for example ``100Gi``. | + +---------------------------------------------+-----------------------------------------------------+ + +If your OpenShift cluster is already running, and therefore Trident has been deployed and configured, the installer can use dynamic provisioning to create the volumes. The following variables will need to be configured. + +.. table:: Metrics variables when deploying after OpenShift install + :align: left + + +-------------------------------------------------------+-------------------------------------------------------------+ + | Variable | Details | + +=======================================================+=============================================================+ + | ``openshift_metrics_cassandra_pvc_prefix`` | A prefix to use for the metrics PVCs. | + +-------------------------------------------------------+-------------------------------------------------------------+ + | ``openshift_metrics_cassandra_pvc_size`` | The size of the volumes to request. | + +-------------------------------------------------------+-------------------------------------------------------------+ + | ``openshift_metrics_cassandra_storage_type`` | The type of storage to use for metrics, this must be set to | + | | dynamic for Ansible to create PVCs with the appropriate | + | | storage class. | + +-------------------------------------------------------+-------------------------------------------------------------+ + | ``openshift_metrics_cassanda_pvc_storage_class_name`` | The name of the storage class to use. | + +-------------------------------------------------------+-------------------------------------------------------------+ + +**Deploying the metrics service** + +With the appropriate Ansible variables defined in your hosts/inventory file, deploy the service using Ansible. If you are deploying at OpenShift install time, then the PV will be created and used automatically. If you're deploying using the component playbooks, after OpenShift install, then Ansible will create any PVCs which are needed and, after Trident has provisioned storage for them, deploy the service. + +The variables above, and the process for deploying, may change with each version of OpenShift. Ensure you review and follow `the deployment guide `_ for your version so that it is configured for your environment. diff --git a/docs/dag/kubernetes/introduction.rst b/docs/dag/kubernetes/introduction.rst new file mode 100644 index 000000000..e79cc3eed --- /dev/null +++ b/docs/dag/kubernetes/introduction.rst @@ -0,0 +1,28 @@ +.. _introduction: + +************ +Introduction +************ + +Containers have quickly become one of the most popular methods of packaging and deploying applications. The ecosystem surrounding the creation, deployment, and management of containerized applications has exploded, resulting in myriad solutions available to customers who simply want to deploy their applications with as little friction as possible. + +Application teams love containers due to their ability to decouple the application from the underlying operating system. The ability to create a container on their own laptop, then deploy to a teammate's laptop, their on-premises data center, hyperscalars, and anywhere else means that they can focus their efforts on the application and its code, not on how the underlying operating system and infrastructure are configured. + +At the same time, operations teams are only just now seeing the dramatic rise in popularity of containers. Containers are often approached first by developers for personal productivity purposes, which means the infrastructure teams are insulated from or unaware of their use. However, this is changing. Operations teams are now expected to deploy, maintain, and support infrastructures which host containerized applications. In addition, the rise of DevOps is pushing operations teams to understand not just the application, but the deployment method and platform at a much greater depth than ever before. + +Fortunately there are robust platforms for hosting containerized applications. Arguably the most popular of those platforms is `Kubernetes `_, an open source `Cloud Native Computing Foundation (CNCF) `_ project, which orchestrates the deployment of containers, including connecting them to network and storage resources as needed. + +Deploying an application using containers doesn't change its fundamental resource requirements. Reading, writing, accessing, and storing data doesn't change just because a container technology is now a part of the stack in addition to virtual and/or physical machines. + +To facilitate the consumption of storage resources by containerized applications, `NetApp `_ created and released an open source project known as `Trident `_. Trident is a storage orchestrator which integrates with Docker and Kubernetes, as well as platforms built on those technologies, such as `Red Hat OpenShift `_, `Rancher `_, and `IBM Cloud Private `_. The goal of Trident is to make the provisioning, connection, and consumption of storage as transparent and frictionless for applications as possible; while operating within the constraints put forth by the storage administrator. + +To achieve this goal, Trident automates the storage management tasks needed to consume storage for the storage administrator, the Kubernetes and Docker administrators, and the application consumers. Trident fills a critical role for storage administrators, who may be feeling pressure from application teams to provide storage resources in ways which have not previously been expected. Modern applications, and just as importantly modern development practices, have changed the storage consumption model, where resources are created, consumed, and destroyed quickly. According to `DataDog `_, containers have a median lifespan of just six days. This is dramatically different than storage resources for traditional applications, which commonly exist for years. Those which are deployed using container orchestrators have an even shorter lifespan of just a half day. Trident is the tool which storage administrators can rely on to safely, within the bounds given to it, provision the storage resources applications need, when they need them, and where they need them. + +Target Audience +=============== + +This document outlines the design and architecture considerations that should be evaluated when deploying containerized applications with persistence requirements within your organization. Additionally, you can find best practices for configuring Kubernetes and OpenShift with Trident. + +It is assumed that you, the reader, have a basic understanding of containers, Kubernetes, and storage prior to reading this document. We will, however, explore and explain some of the concepts which are important to integrating Trident, and through it NetApp's storage platforms and services, with Kubernetes. Unless noted, Kubernetes and OpenShift can be used interchangeably in this document. + +As with all best practices, these are suggestions based on the experience and knowledge of the NetApp team. Each should be considered according to your environment and targeted applications. diff --git a/docs/dag/kubernetes/kubernetes_cluster_architecture_considerations.rst b/docs/dag/kubernetes/kubernetes_cluster_architecture_considerations.rst new file mode 100644 index 000000000..e2fa5268e --- /dev/null +++ b/docs/dag/kubernetes/kubernetes_cluster_architecture_considerations.rst @@ -0,0 +1,153 @@ +.. _kubernetes_cluster_architecture_considerations: + +************************************************** +Kubernetes Cluster Architecture and Considerations +************************************************** + +Kubernetes is extremely flexible and is capable of being deployed in many different configurations. It supports clusters as small as a single node and as large as a `few thousand `_. It can be deployed using either physical or virtual machines on premises or in the cloud. However, single node deployments are mainly used for testing and are not suitable for production workloads. Also, hyperscalers such as AWS, Google Cloud and Azure abstract some of the initial and basic deployment tasks away. When deploying Kubernetes, there are a number of considerations and decisions to make which can affect the applications and how they consume storage resources. + +Cluster concepts and components +=============================== + +A Kubernetes cluster typically consists of two types of nodes, each responsible for different aspects of functionality: + +* Master nodes – These nodes host the control plane aspects of the cluster and are responsible for, among other things, the API endpoint which the users interact with and provide scheduling for pods across resources. Typically, these nodes are not used to schedule application workloads. +* Compute nodes – Nodes which are responsible for executing workloads for the cluster users. + +The cluster has a number of Kubernetes intrinsic services which are deployed in the cluster. Depending on the service type, each service is deployed on only one type of node (master or compute) or on a mixture of node types. Some of these services, such as etcd and DNS, are mandatory for the cluster to be functional, while other services are optional. All of these services are deployed as pods within Kubernetes. + +* etcd – etcd is a distributed key-value datastore. It is used heavily by Kubernetes to track the state and manage the resources associated with the cluster. +* DNS – Kubernetes maintains an internal DNS service to provide local resolution for the applications which have been deployed. This enables inter-pod communication to happen while referencing friendly names instead of internal IP addresses which can change as the container instances are scheduled. +* API Server - Kubernetes deploys the API server to allow interaction between kubernetes and the outside world. This is deployed on the master node(s). +* The dashboard – an optional component which provides a graphical interface to the cluster. +* Monitoring and logging – optional components which can aid with resource reporting. + +.. note:: + We have not discussed Kubernetes container networking to allow pods to communicate with each other, or to outside the cluster. The choice of using a overlay network (e.g. Flannel) or a straight layer 3 solution (e.g. Calico) is out of scope of this document and does not affect access to storage resources by the pods. + +Cluster architectures +===================== + +There are three primary Kubernetes cluster architectures. These accommodate various methods of high availablility and recoverability of the cluster, it's services, and the applications running. Trident is installed the same no matter which kubernetes architecture is chosen. + +Master nodes are critical to the operation of the cluster. If no masters are running, or the master nodes are unable to reach a quorum, then the cluster is unable to schedule and execute applications. The master nodes are the control plane for the cluster and consequentially there should be special consideration given to their `sizing `_ and quantity. + +Compute nodes are, generally speaking, much more disposable. However, extra resources must be built into the compute infrastructure to accomodate any workloads from failed nodes. Compute nodes can be added and removed from the cluster as needed quickly and easily to accommodate the scale of the applications which are being hosted. This makes it very easy to burst, and reclaim, resources based on real-time application workload. + +Single master, compute +---------------------- + +This architecture is the easiest to deploy but does not provide high availability of the core management services. In the event the master node is unavailable, no interaction can happen with the cluster until, at a minimum, the Kubernetes API server is returned to service. + +This architecture can be useful for testing, qualification, proof-of-concept, and other non-production uses, however it should never be used for production deployments. + +A single node used to host both the master service and the workloads is a variant of this architecture. Using a single node kubernetes cluster is useful when testing or experimenting with different concepts and capabilities. However, the limited scale and capacity make it unreasonable for more than very small tests. The Trident :ref: `quick start guide ` outlines the process to instantiate a single node Kubernetes cluster with Trident that provides full functionality for testing and validation. + +Multiple master, compute +------------------------ + +Having multiple master nodes ensures that services remain available should master node(s) fail. In order to facilitate availability of master services, they should be deployed with odd numbers (e.g. 3,5,7,9 etc.) so quorum (master node majority) can be maintained should one or more masters fail. In the HA scenario, Kubernetes will maintain a copy of the etcd databases on each master, but hold elections for the control plane function leaders `kube-controller-manager` and `kube-scheduler` to avoid conflicts. The worker nodes can communicate with any master's API server through a load balancer. + + Deploying with multiple masters is the minimum recommended configuration for most production clusters. + +.. _figMultiMasterCluster: + +.. figure:: images/MultiMasterCluster1.png + :align: center + :figclass: align-center + + Multiple master architecture + +Pros: + +* Provides highly available master services, ensuring that the loss of up to (n/2) – 1 master nodes will not affect cluster operations. + +Cons: + +* More complex initial setup. + +Master, etcd, compute +--------------------- + +This architecture isolates the etcd cluster from the other master server services. This removes workload from the master servers, enabling them to be sized smaller, and makes their scale out (or in) more simple. +Deploying a Kubernetes cluster using this model adds a degree of complexity, however it adds flexibility to the scale, support, and management of the etcd service used by Kubernetes, which may be desirable to some organizations. + +.. _figMultietcdCluster: + +.. figure:: images/MultietcdCluster.png + :align: center + :figclass: align-center + + Multiple master, etcd, compute architecture + + + + +Pros: + +* Provides highly available master services, ensuring that the loss of up to (n/2) – 1 master nodes will not affect cluster operations. +* Isolating etcd from the other master services reduces workload for master servers. +* Decoupling etcd from the masters makes etcd administration and protection easier. Independent management allows for different protection and scaling schemes. + +Cons: + +* More complex initial setup. + + + + + + +Red Hat OpenShift infrastructure architecture +--------------------------------------------- + +In addition to the architectures referenced above, Red Hat's OpenShift introduces the concept of `infrastructure nodes `_. These nodes host cluster services such as log aggregation, metrics collection and reporting, container registry services, and overlay network management and routing. + +`Red Hat recommends `_ a minimum of three infrastructure nodes for production deployments. This ensures that the services have resources available and are able to migrate in the event of host maintenance or failure. + +This architecture enables the services which are critical to the cluster, i.e. registry, overlay network routing, and others to be hosted on dedicated nodes. These dedicated nodes may have additional redundancy, different CPU/RAM requirements, and other low-level differences from compute nodes. This also makes adding and removing compute nodes as needed easier, without needing to worry about core services being affected by a node being evacuated. + +.. _figMultiinfraCluster: + +.. figure:: images/MultiInfraCluster.png + :align: center + :figclass: align-center + + OpenShift, Multiple master, infra, compute architecture + + + + +An additional option involves separating out the master and etcd roles into different servers in the same way as can be done in Kubernetes. This results in having master, etcd, infrastructure, and compute node roles. Further details, including examples of OpenShift node roles and potential deployment options, can be found in the `Red Hat documentation `_. + + +Choosing an architecture +======================== + +Regardless of the architecture that you choose, it's important to understand the ramifications to high availability, scalability, and serviceability of the component services. Be sure to consider the affect on the applications being hosted by the Kubernetes or OpenShift cluster. The architecture of the storage infrastructure supporting the Kubernetes/OpenShift cluster and the hosted applications can also be affected by the chosen cluster architecture, such as where etcd is hosted. + + +Persistent storage for cluster services +======================================= + +Dynamically provisioned persistent storage for the applications is provided using the storage class mechanism, with Trident acting as the interface to the NetApp portfolio. However, as you may have noted above there are several critical services hosted on the master servers and other cluster critical services which may be hosted on other node types. + +Etcd persistent storage +----------------------- + +When Kubernetes etcd is hosted by the master server it uses local storage. Instead, if you desire to leverage an enterprise storage array for etcd, you must mount a volume to the master node at the correct location prior to kubernetes deployment. This storage cannot be dynamically provisioned by Trident or any other storage class provisioner as it is needed prior to the Kubernetes cluster being operational. +This same paradigm holds true if dedicated etcd nodes are being used. Prior to deploying etcd, the volume from the storage system must be mounted to the host’s file system at the location etcd is configured to use. +Refer to your Kubernetes’ provider documentation on where to mount the volume and/or customize the etcd configuration to use non-default storage. + +Persistent storage for logging services +--------------------------------------- + +Centralized logging for applications deployed to the Kubernetes cluster is an optional service. Depending on how, and when, the service is deployed the storage class concepts may be able to dynamically provision storage for the service. +Refer to your vendor’s documentation on how to customize the storage for logging services. Additionally, this document discusses Red Hat’s OpenShift logging service best practices in a later chapter. + +Metrics and analytics services +------------------------------ + +Many third-party metrics and analytics tools are available for monitoring, reporting, and providing status of the applications and cluster. These tools may require persistent storage, often with specific performance characteristics. +Each vendor has different storage recommendations and deployment methodology. Work with your vendor to identify requirements and, if needed, provision storage from an enterprise array to meet the requirements. This document will discuss the Red Hat OpenShift metrics service in a later chapter. + diff --git a/docs/dag/kubernetes/netapp_products_integrations.rst b/docs/dag/kubernetes/netapp_products_integrations.rst new file mode 100644 index 000000000..e1f13af5e --- /dev/null +++ b/docs/dag/kubernetes/netapp_products_integrations.rst @@ -0,0 +1,47 @@ +.. _netapp_products_integrations: + +************************************************ +NetApp Products and Integrations with Kubernetes +************************************************ + +The NetApp portfolio of storage products integrates with many different aspects of a Kubernetes cluster, providing advanced storage capabilities which enhance the functionality, capability, performance, and availability of the Kubernetes deployment. + + +Trident +------- + +NetApp Trident is a dynamic storage provisioner for the containers ecosystem. It provides the ability to create storage volumes for containerized applications managed by Docker and Kubernetes. Trident is a fully supported, open source project hosted on `GitHub `_. +Trident works with the portfolio of NetApp storage platforms to deliver storage on-demand to applications according to policies defined by the administrator. When used with Kubernetes, Trident is deployed using native paradigms and provides persistent storage to all namespaces in the cluster. +For more information about Trident, visit `ThePub `_. + + +ONTAP +----- + +ONTAP is NetApp’s multiprotocol, unified storage operating system providing advanced data management capabilities for any application. ONTAP systems may have all-flash, hybrid, or all-HDD configurations and offer many different deployment models, including engineered hardware (FAS and AFF), white-box (ONTAP Select), and cloud-only (Cloud Volumes ONTAP). Trident supports all the above mentioned deployment models. + +Element OS +---------- + +Element OS enables the storage administrator to consolidate workloads by guaranteeing performance and enabling a simplified and streamlined storage footprint. Coupled with a full API to enable automation of all aspects of storage management, Element OS enables storage administrators to do more with less effort. + +Trident supports all Element OS clusters, more information can be found at `Element Software `_. + +NetApp HCI +---------- + +NetApp HCI simplifies the management and scale of the datacenter by automating routine tasks and enabling infrastructure administrators to focus on more important functions. + +NetApp HCI is fully supported by Trident, which is able to provision and manage storage devices for containerized applications directly against the underlying HCI storage platform. For more information about NetApp HCI visit `NetApp HCI `_. + +SANtricity +---------- + +The NetApp E and EF Series storage platforms, using the SANtricity operating system, provides robust storage that is highly available, performant, and capable of delivering storage services for applications at any scale. + +Trident is able to create and manage SANtricity volumes across the portfolio of products. + +For more information about SANtricity and the storage platforms which use it, see `SANtricity Software `_. + + + diff --git a/docs/dag/kubernetes/security_recommendations.rst b/docs/dag/kubernetes/security_recommendations.rst new file mode 100644 index 000000000..1b7ed242c --- /dev/null +++ b/docs/dag/kubernetes/security_recommendations.rst @@ -0,0 +1,50 @@ +.. _security_recommendations: + +************************* +Security Recommendations +************************* + +Run Trident in its own namespace +--------------------------------- + +It is important to prevent applications, application admins, users, and management applications from accessing Trident object definitions or the pods to ensure reliable storage and block potential malicious activity. To separate out the other applications and users from Trident, always install Trident in its own Kubernetes namespace. In our :ref:`Installing Trident docs ` we call this namespace `trident`. Putting Trident in its own namespace assures that only the Kubernetes administrative personnel have access to the Trident pod and the artifacts (such as backend and CHAP secrets if applicable) stored in Trident's etcd datastore. Allow only administrators access to the trident namespace and thus access to `tridentctl` application. + +etcd container +-------------- + +Trident's state is stored in etcd. Etcd contains details regarding the backends, storage classes, and volumes the Trident provisioner creates. Trident's default install method installs etcd as a container in the Trident pod. For security reasons, the etcd container located within the Trident pod is not accessible via its REST interface outside the pod, and only the trident container can access the etcd container. If you choose to use an :ref:`external etcd `, authenticate Trident with the etcd cluster using certificates. This also ensures all the communication between the Trident and etcd is encrypted. + +CHAP authentication +------------------- + +NetApp recommends deploying bi-directional CHAP to ensure authentication between a host and the SolidFire backend. Trident uses a secret object that includes two CHAP passwords per SolidFire tenant. Kubernetes manages mapping of Kubernetes tenant to SF tenant. Upon volume creation time, Trident makes an API call to the SolidFire system to retrieve the secrets if the secret for that tenant doesn’t already exist. Trident then passes the secrets on to Kubernetes. The kubelet located on each node accesses the secrets via the Kubernetes API and uses them to run/enable CHAP between each node accessing the volume and the SolidFire system where the volumes are located. + +Since Trident v18.10, SolidFire defaults to use CHAP if the Kubernetes version is >= 1.7 and a Trident access group doesn't exist. Setting `AccessGroup` or `UseCHAP` in the backend configuration file overrides this behavior. CHAP is guaranteed by setting ``UseCHAP`` to ``true`` in the backend.json file. + + +Storage backend credentials +--------------------------- + +Delete backend config files +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Deleting the backend config files helps prevent unauthorized users from accessing backend usernames, passwords and other credentials. After the backends are created using the `tridentctl create backend` command, make sure that the backend config files are deleted from the node where Trident was installed. Keep a copy of the file in a secure location if the backend file will be updated in the future (e.g. to change passwords).. + +Encrypt Trident* etcd Volume +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Since Trident stores all its backend credentials in its etcd datastore, it may be possible for unauthorized users to access this information either from etcdctl or directly from the hardware hosting the etcd volume. Therefore, as an additional security measure, enable encryption on the Trident volume. + +The appropriate encryption license must be enabled on the backends to encrypt Tridents volume. + +**ONTAP Backend** + + + Prior to Trident installation, edit the :ref:`temporary backend.json ` file to include :ref:`encryption `. When the volume is created for Tridents use, that volume will then be encrypted upon trident installation. + +Alternatively, encrypt the trident volume using the ONTAP CLI command ``volume encryption conversion start -vserver SVM_name -volume volume_name``. Verify the status of the conversion operation using the command ``volume encryption conversion show``. Please note that you cannot use `volume encryption conversion start` ONTAP CLI command to start encryption on a SnapLock or FlexGroup volume. For more information on how setup NetApp Volume Encryption, refer to the `ONTAP NetApp Encryption Power Guide `_. + +**Element Backend** + + +On the Solidfire backend, enable encryption for the cluster. diff --git a/docs/dag/kubernetes/storage_configuration_trident.rst b/docs/dag/kubernetes/storage_configuration_trident.rst new file mode 100644 index 000000000..b64cb3b62 --- /dev/null +++ b/docs/dag/kubernetes/storage_configuration_trident.rst @@ -0,0 +1,202 @@ +.. _storage_configuration_trident: + +********************************* +Storage Configuration for Trident +********************************* + +Each storage platform in NetApp's portfolio has unique capabilities that benefit applications, containerized or not. Trident works with each of the major platforms: ONTAP, Element, and E-Series. There is not one platform which is better suited for all applications and scenarios than another, however the needs of the application and the team administering the device should be taken into account when choosing a platform. + +The storage administrator(s), Kubernetes administrator(s), and the application team(s) should work with their NetApp team to ensure that the most appropriate platform is selected. + +Regardless of which NetApp storage platform you will be connecting to your Kubernetes environment, you should follow the baseline best practices for the host operating system with the protocol that you will be leveraging. Optionally, you may want to consider incorporating application best practices, when available, with backend, storage class, and PVC settings to optimize storage for specific applications. + +Some of the best practices guides are listed below, however refer to the `NetApp Library `_ for the most current versions. + +* ONTAP + + * `NFS Best Practice and Implementation Guide `_ + * `SAN Administration Guide `_ (for iSCSI) + * `iSCSI Express Configuration for RHEL `_ + +* SolidFire + + * `Configuring SolidFire for Linux `_ + +* E-Series + + * `Installing and Configuring for Linux Express Guide `_ + +Some example application best practices guides: + +* `ONTAP Best Practice Guidelines for MySQL `_ +* `MySQL Best Practices for NetApp SolidFire `_ +* `NetApp SolidFire and Cassandra `_ +* `Oracle Best Practices on NetApp SolidFire `_ +* `PostgreSQL Best Practices on NetApp SolidFire `_ + +Not all applications will have specific guidelines, it's important to work with your NetApp team and to refer to the `library `_ for the most up-to-date recommendations and guides. + +Best practices for configuring ONTAP +==================================== + +The following recommendations are guidelines for configuring ONTAP for containerized workloads which consume volumes dynamically provisioned by Trident. Each should be considered and evaluated for appropriateness in your environment. + +Use SVM(s) which are dedicated to Trident +----------------------------------------- + +Storage Virtual Machines (SVMs) provide isolation and administrative separation between tenants on an ONTAP system. Dedicating an SVM to applications enables the delegation of privileges and enables applying best practices for limiting resource consumption. + +There are several options available for the management of the SVM: + +* Provide the cluster management interface in the backend configuration, along with appropriate credentials, and specify the SVM name +* Create a dedicated management interface for the SVM +* Share the management role with an NFS data interface + +In each case, the interface should be in DNS, and the DNS name should be used when configuring Trident. This helps to facilicate some DR scenarios, for example, SVM-DR without the use of network identity retention. + +There is no preference between having a dedicated or shared management LIF for the SVM, however you should ensure that your network security policies align with the approach you choose. Regardless, the management LIF should be accessible via DNS to facilitate maximum flexibility should `SVM-DR `_ be used in conjunction with Trident. + +Limit the maximum volume count +------------------------------ + +ONTAP storage systems have a maximum volume count which varies based on the software version and hardware platform, see the `Hardware Universe `_ for your specific platform and ONTAP version to determine exact limits. When the volume count is exhausted, provisioning operations will fail not only for Trident, but for all storage requests. + +Trident's ``ontap-nas`` and ``ontap-san`` drivers provision a FlexVolume for each Kubernetes persistent volume (PV) which is created, and the ``ontap-nas-economy`` driver will create approximately one FlexVolume for every 200 PVs. To prevent Trident from consuming all available volumes on the storage system, it is recommended that a limit be placed on the SVM. This can be done from the command line: + +.. code-block:: console + + vserver modify -vserver -max-volumes + +The value for ``max-volumes`` will vary based on several criteria specific to your environment: + +* The number of existing volumes in the ONTAP cluster +* The number of volumes you expect to provision outside of Trident for other applications +* The number of persistent volumes expected to be consumed by Kubernetes applications + +The ``max-volumes`` value is total volumes provisioned across all nodes in the cluster, not to an individual node. As a result, some conditions may be encountered where a cluster node may have far more, or less, Trident provisioned volumes than another. + +For example, a 2-node ONTAP cluster has the ability to host a maximum of 2000 FlexVolumes. Having the maximum volume count set to 1250 appears very reasonable. However, if only aggregates from one node are assigned to the SVM, or the aggregates assigned from one node are unable to be provisioned against (e.g. due to capacity), then the other node will be the target for all Trident provisioned volumes. This means that the volume limit may be reached for that node before the ``max-volumes`` value is reached, resulting in impacting both Trident and other volume operations using that node. Avoid this situation by ensuring that aggregates from each node in the cluster are assigned to the SVM used by Trident in equal numbers. + +In addition to controlling the volume count at the storage array, leveraging Kubernetes capabilities should also be used as explained in the next chapter. + +Limit the maximum size of volumes created by the Trident user +------------------------------------------------------------- + +ONTAP can prevent a user from creating a volume above a maximum size, as defined by the administrator. This is implemented using the permissions system and should be applied to the user which Trident uses to authenticate, e.g. ``vsadmin``. + +.. code-block:: console + + security login role modify -vserver -role -access all -cmddirname "volume create" -query "-size <=50g" + +The above example command will prevent the user from creating volume larger than 50GiB in size. The value should be modified to what is appropriate for your applications and the expected size of volumes desired. + +.. note:: + This does not apply when using the ``ontap-nas-economy`` driver. The economy driver will create the FlexVolume with a size equal to the first PVC provisioned to that FlexVolume. Subsequent PVCs provisioned to that FlexVolume will result in the volume being resized, which is not subject to the limitation described above. + +In addition to controlling the volume size at the storage array, leveraging Kubernetes capabilities should also be used as explained in the next chapter. + +Create and use an SVM QoS policy +-------------------------------- + +Leveraging an ONTAP QoS policy, applied to the SVM, limits the number of IOPS consumable by the Trident provisioned volumes. This helps to `prevent a bully `_ or out-of-control container from affecting workloads outside of the Trident SVM. + +Creating a QoS policy for the SVM can be done in a few steps. Refer to the documentation for your version of ONTAP for the most accurate information. The example below creates a QoS policy which limits the total IOPS available to the SVM to 5000. + +.. code-block:: console + + # create the policy group for the SVM + qos policy-group create -policy-group -vserver -max-throughput 5000iops + + # assign the policy group to the SVM, note this will not work + # if volumes or files in the SVM have existing QoS policies + vserver modify -vserver -qos-policy-group + +Additionally, if your version of ONTAP supports it, you may consider using a QoS minimum in order to guarantee an amount of throughput to containerized workloads. Adaptive QoS is not compatible with an SVM level policy. + +The number of IOPS dedicated to the containerized workloads depends on many aspects. Among other things, these include: + +* Other workloads using the storage array. If there are other workloads, not related to the Kubernetes deployment, utilizing the storage resources, then care should be taken to ensure that those workloads are not accidentally adversely impacted. +* Expected workloads running in containers. If workloads which have high IOPS requirements will be running in containers, then a low QoS policy will result in a bad experience. + +It's important to remember that a QoS policy assigned at the SVM level will result in all volumes provisioned to the SVM sharing the same IOPS pool. If one, or a small number, of the containerized applications has a high IOPS requirement it could become a bully to the other containerized workloads. If this is the case, you may want to consider using external automation to assign per-volume QoS policies. + +Limit storage resource access to Kubernetes cluster members +----------------------------------------------------------- + +Limiting access to the NFS volumes and iSCSI LUNs created by Trident is a critical component of the security posture for your Kubernetes deployment. Doing so prevents hosts which are not a part of the Kubernetes cluster from accessing the volumes and potentially modifying data unexpectedly. + +It's important to understand that namespaces are the logical boundary for resources in Kubernetes. The assumption is that resources in the same namespace are able to be shared, however, importantly, there is no cross-namespace capability. This means that even though PVs are global objects, when bound to a PVC they are only accessible by pods which are in that same namespace. It's critical to ensure that namespaces are used to provide separation when appropriate. + +The primary concern for most organizations, with regard to data security in a Kubernetes context, is that a process in a container can access storage mounted to the host, but which is not intended for the container. Simply put, this is not possible. The underlying technology for containers, `namespaces `_, are designed to prevent this type of compromise. However, there is one exception: privileged containers. + +A privileged container is one that is run with substantially more host-level permissions than normal. These are not denied by default, so disabling the capability using `pod security policies `_ is very important for preventing this accidental exposure. + +For volumes where access is desired from both Kubernetes and external hosts, the storage should be managed in a traditional manner, with the PV introduced by the administrator and not managed by Trident. This ensures that the storage volume is destroyed only when both the Kubernetes and external hosts have disconnected and are no longer using the volume. Additionally, a custom export policy can be applied which enables access from the Kubernetes cluster nodes and targeted servers outside of the Kubernetes cluster. + +For deployments which have dedicated infrastructure nodes (e.g. OpenShift), or other nodes which are not schedulable for user applications, separate export policies should be used to further limit access to storage resources. This includes creating an export policy for services which are deployed to those infrastructure nodes, for example the OpenShift Metrics and Logging services, and standard applications which are deployed to non-infrastructure nodes. + +Create export policy +-------------------- + +Create appropriate export policies for the Storage Virtual Machines. Allow only Kubernetes nodes access to the NFS volumes. + +Export policies contain one or more export rules that process each node access request. Use the ``vserver export-policy create`` ONTAP CLI to create the export policy. Add rules to the export policy using the ``vserver export-policy rule create`` ONTAP CLI command. Performing the above commands enables you to restrict which nodes have access to data. + +Disable ``showmount`` for the application SVM +--------------------------------------------- + +The showmount feature enables an NFS client to query the SVM for a list of available NFS exports. A pod deployed to the Kubernetes cluster could issue the showmount -e command against the data LIF and receive a list of available mounts, including those which it does not have access to. While this isn't, by itself, dangerous or a security compromise, it does provide unnecessary information potentially aiding an unauthorized user with connecting to an NFS export. + +Disabling showmount is an SVM level command: + +.. code-block:: console + + vserver nfs modify -vserver -showmount disabled + +Use NFSv4 for Trident's etcd when possible +------------------------------------------ + +NFSv3 locks are handled by Network Lock Manager (NLM), which is a sideband mechanism not using the NFS protocol. Therefore, during a failure scenario and a server hosting the Trident pod ungracefully leaves the network (either by a hard reboot or all access being abruptly severed), the NFS lock is held indefinitely. This results in Trident failure because etcd's volume cannot be mounted from another node. + +NFSv4 has session management and locking built into the protocol and the locks are released automatically when the session times out. In a recovery situation, the trident pod will be redeployed on another node, mount, and come back up after the v4 locks are automatically released. + + +Best practices for configuring SolidFire +========================================= + +**Solidfire Account** + +Create a SolidFire account. Each SolidFire account represents a unique volume owner and receives its own set of Challenge-Handshake Authentication Protocol (CHAP) credentials. You can access volumes assigned to an account either by using the account name and the relative CHAP credentials or through a volume access group. An account can have up to two-thousand volumes assigned to it, but a volume can belong to only one account. + +**SolidFire QoS** + +Use QoS policy if you would like to create and save a standardized quality of service setting that can be applied to many volumes. + +Quality of Service parameters can be set on a per-volume basis. Performance for each volume can be assured by setting three configurable parameters that define the QoS: Min IOPS, Max IOPS, and Burst IOPS. + +The following table shows the possible minimum, maximum, and Burst IOPS values for 4Kb block Size. + + +-------------------+----------------------------------------------------+-----------+---------------+----------------+ + | IOPS Parameter | Definition | Min value | Default Value | Max Value(4Kb) | + +===================+====================================================+===========+===============+================+ + | Min IOPS | The guaranteed level of performance for a volume.| 50 | 50 | 15000 | + +-------------------+----------------------------------------------------+-----------+---------------+----------------+ + | Max IOPS | Performance will not exceed this limit. | 50 | 15000 | 200,000 | + +-------------------+----------------------------------------------------+-----------+---------------+----------------+ + | Burst IOPS | Maximum IOPS allowed in a short burst scenario. | 50 | 15000 | 200,000 | + +-------------------+----------------------------------------------------+-----------+---------------+----------------+ + +Note: Although the Max IOPS and Burst IOPS can be set as high as 200,000, real-world maximum performance of a volume is limited by cluster usage and per-node performance. + +Block size and bandwidth have a direct influence on the number of IOPS. As block sizes increase, the system increases bandwidth to a level necessary to process the larger block sizes. As bandwidth increases the number of IOPS the system is able to attain decreases. For more information on QoS and performance, refer to the `NetApp SolidFire Quality of Service (QoS) `_ Guide. + + +**SolidFire authentication** + +Element supports two methods for authentication: CHAP and Volume Access Groups (VAG). CHAP uses the CHAP protocol to authenticate the host to the backend. Volume Access groups controls access to the volumes it provisions. NetApp recommends using CHAP for authentication as it's simplier and has no scaling limits. + +CHAP authentication (verification that the initiator is the intended volume user) is supported only with account-based access control. If you are using CHAP for authentication, 2 options are available: unidirectional CHAP and bidirectional CHAP. Unidirectional CHAP authenticates volume access by using the SolidFire account name and initiator secret. The bidirectional CHAP option provides the most secure way of authenticating the volume since the volume authenticates the host through the account name and the initiator secret, and then the host authenticates the volume through the account name and the target secret. + +However, if CHAP is unable to be enabled and VAGs are required, create the access group and add the host initiators and volumes to the access group. Each IQN that you add to an access group can access each volume in the group with or without CHAP authentication. If the iSCSI initiator is configured to use CHAP authentication, account-based access control is used. If the iSCSI initiator is not configured to use CHAP authentication, then volume access group access control is used. + +For more information on how to setup Volume Access Groups and CHAP authentication, please refer the NetApp HCI Installation and setup guide. diff --git a/docs/dag/kubernetes/storage_kubernetes_infrastructure_services.rst b/docs/dag/kubernetes/storage_kubernetes_infrastructure_services.rst new file mode 100644 index 000000000..5052a4576 --- /dev/null +++ b/docs/dag/kubernetes/storage_kubernetes_infrastructure_services.rst @@ -0,0 +1,146 @@ +.. _storage_kubernetes_infrastructure_services: + +********************************************** +Storage for Kubernetes Infrastructure Services +********************************************** + +Trident focuses on providing persistence to Kubernetes applications, but before you can host those applications, you need to run a healthy, protected Kubernetes cluster. Those clusters are made up of a number of services with their own persistence requirements that need to be considered. + +**Node-local container storage, a.k.a. graph driver storage** + +One of the often overlooked components of a Kubernetes deployment is the storage which the container instances consume on the Kubernetes cluster nodes, usually referred to as `graph driver storage `_. When a container is instantiated on a node it consumes capacity and IOPS to do many of it's operations as only data which is read from or written to a persistent volume is offloaded to the external storage. If the Kubernetes nodes are expected to host dozens, hundreds, or more containers this may be a significant amount of temporary capacity and IOPS which are expected of the node-local storage. + +Even if you don't have a requirement to keep the data, the containers still need enough performance and capacity to execute their application. The Kubernetes administrator and storage administrator should work closely together to determine the requirements for graph storage and ensure adequate performance and capacity is available. + +The typical method of augmenting the graph driver storage is to use a block device mounted at the location where container instance storage is located, e.g. ``/var/lib/docker``. The host operating system being used to underpin the Kubernetes deployment will each have different methods for how to replace the graph storage with something more robust than a simple directory on the node. Refer to the documentation from Red Hat, Ubuntu, SUSE, etc. for those instructions. + +.. note:: + Block protocol is specifically recommended for graph storage due to the nature of how the graph drivers work. In particular, they create thin clones, using a variety of methods depending on the driver, of the container image. NFS does not support this functionality and results in a full copy of the container image file system for each instance, resulting in significant performance and capacity implications. + +If the Kubernetes nodes are virtualized, this could also be addressed by ensuring that the datastore they reside on meets the performance and capacity needs, however the flexibility of having a separate device, even an additional virtual disk, should be carefully considered. Using a separate device gives the ability to independently control capacity, performance, and data protection to tailor the policies according to needs. Often the capacity and performance needed for graph storage can fluctuate dramatically, however data protection is not necessary. + +Persistent storage for cluster services +======================================= + +There are several critical services hosted on the master servers and other cluster critical services which may be hosted on other node types. + +Using capacity provisioned from enterprise storage adds several benefits for each service as delineated below: + +* Performance – leveraging enterprise storage means being able to provide latency in-line with application needs and controlling performance using QoS policies. This can be used to limit performance for `bullies `_ or ensure performance for applications as needed. +* Resiliency – in the event of node failure, being able to quickly recover the data and present it to a replacement ensures that the application is minimally affected. +* Data protection – putting application data onto dedicated volumes allows the data to have its own snapshot, replication, and retention policies. +* Data security – ensuring that data is encrypted and protected all the way to the disk level is important for meeting many compliance requirements. +* Scale – using enterprise storage enables deploying fewer instances, with the instance count depending on compute resources, rather than having to increase the total count for resiliency and performance purposes. Data which is protected automatically, and provides adequate performance, means that horizontal scale out doesn't need to compensate for limited performance. + +There are some best practices which apply across all of the cluster services, or any application, which should be addressed as well. + +* Determining the amount of acceptable data loss, i.e. the `Recovery Point Objective `_ (RPO), is a critical part of deploying a production level system. Having an understanding of this will greatly simplify the decisions around other items described in this section. +* Cluster service volumes should have a snapshot policy which enables the rapid recovery of data according to your requirements, as defined by the RPO. This enables quick and easy restoration of a service to a point in time by reverting the volume or the ability to recover individual files if needed. +* Replication can provide both backup and disaster recovery capabilities, each service should be evaluated and have the recovery plan considered carefully. Using storage replication may provide rapid recovery with a higher RPO, or can provide a starting baseline which expedites restore operations without having to recover all data from other locations. + +etcd considerations +------------------- + +You should carefully consider the high availability and data protection policy for the etcd instance used by the Kubernetes master(s). This service is arguably the most critical to the overall functionality, recoverability, and serviceability of the cluster as a whole, so it's imperative that its deployment meets your goals. + +The most common method of providing high availability and resiliency to the etcd instance is to horizontally scale the application by having multiple instances across multiple nodes. A minimum of three nodes is recommended. + +Kubernetes etcd will, by default, use local storage for its persistence. This holds true whether etcd is co-located with other master services or is hosted on dedicated nodes. To use enterprise storage for etcd a volume must be provisioned and mounted to the node at the correct location prior to deployment. This storage cannot be dynamically provisioned by Trident or any other storage class provisioner as it is needed prior to the Kubernetes cluster being operational. + +Refer to your Kubernetes provider's documentation on where to mount the volume and/or customize the etcd configuration to use non-default storage. + +logging +------- + +Centralized logging for applications deployed to the Kubernetes cluster is an optional service. Using enterprise storage for logging has the same benefits as with etcd: performance, resiliency, protection, security, and scale. + +Depending on how and when the service is deployed, the storage class may define how to dynamically provision storage for the service. Refer to your vendor's documentation on how to customize the storage for logging services. Additionally, this document discusses Red Hat's OpenShift logging service best practices in a later chapter. + +metrics +------- + +There are many third-party metrics and analytics services available for monitoring and reporting of the status and health of every aspect of the cluster and application. Many of these require persistent storage, often with specific performance characteristics, for the service in order for it to function as intended. + +Architecturally, many of these function similarly where an agent exists on each node which forwards data to a centralized collector to aggregate, analyze, and display the data. Similar to the logging service, using entprise storage allows the aggregation service to move across nodes in the cluster seamlessly and ensures the data is protected in the event of node failure. + +Each vendor has different recommendations and deployment methodology. Work with your vendor to identify requirements and, if needed, provision storage from an enterprise array to meet the requirements. This document will discuss the Red Hat OpenShift metrics service in a later chapter. + +registry +-------- + +The registry is the service with which users and applications will have the most direct interaction. It can also have a dramatic affect on the perceived performance of the Kubernetes cluster as a whole, as slow image push and pull operations can result in lengthy times for tasks which directly affect the developer and application. + +Fortunately, the registry is flexible with regard to storage protocol. Keep in mind different protocols have different implications. + +* Object storage is the default recommendation and is the simplest to use for Kubernetes deployments which expect to have significant scale or where the images need to be accessed across geographic regions. +* NFS is a a good choice for many deployments as it allows a single repository for the container images while allowing many registry endpoints to front the capacity. +* Block protocols, such as iSCSI, can be used for registry storage, but they introduce a single point of failure. The block device can only be attached to a single registry node due the single-writer limitation of the supported filesystems. + +Protecting the images stored in the registry will have different priorities for each organization and each application. Registry images are, generally, either cached from upstream registries or have images pushed to them during the application build process. The RTO is important to the desired protection scheme because it will affect the recovery process. If RTO is not an issue, then the applications may be able to simply rebuild the container images and push them into a new instance of the registry. If faster RTO is desired, then a replication policy should be used which adheres to the desired recovery goal. + +Design choices and guidelines when using ONTAP +============================================== + +When using ONTAP as the backend storage for containerized applications, with storage dynamically provisioned by Trident, there are several design and implementation considerations which should be addressed prior to deployment. + +Storage Virtual Machines +------------------------ + +Storage virtual machines (SVMs) are used for administrative delegation within ONTAP. They give the storage administrator the ability to isolate a particular user, group, or application to only having access to resources which they have been specifically granted. When Trident accesses the storage system via an SVM, it is prevented from doing many system level management tasks, providing additional isolation of capabilities for storage provisioning and management tasks. + +There are several different ways which SVMs can be leveraged with Trident. Each is explained below. It's important to understand that having multiple Trident deployments, i.e. multiple Kubernetes clusters, does not change the below statements. When an SVM is shared with multiple Trident instances they simply need distinct prefixes defined in the backend configuration files. + +**SVM shared with non Trident-managed workloads** + +This configuration uses a single, or small number of, SVMs to host all of the workloads on the cluster and results in the containerized applications being hosted by the same SVM as other, non-containerized, workloads. The shared SVM model is common in organizations where there exists multiple network segments which are isolated and adding additional IP addresses is difficult or impossible. + +There is nothing inherently wrong with this configuration, however it is more challenging to apply policies which affect only the container workloads. + +**Dedicated SVM for Trident-managed workloads** + +Creating an SVM which is used solely by Trident for provisioning and deprovisioning volumes for containerized workloads is the default recommendation from NetApp. This enables the storage administrator to put controls in place to limit the amount of resources which Trident is able to consume. + +As was noted above, having multiple Kubernetes clusters connect to and consume storage from the same SVM is acceptable, the only change to the Trident configuration should be to :ref:`provide a different prefix `. + +When creating backends which connect to the same underlying SVM resources, but have differing features applied, e.g. snapshot policies, using different prefixes is recommended to aid the storage administrator with identifying volumes and ensuring that no confusion ensues as a result. + +**Multiple SVMs dedicated to Trident-managed workloads** + +You may consider using multiple SVMs with Trident for many different reasons, including isolating applications and resource domains, strict control over resources, and to facilitate multitenacy. It's also worth considering using at least two SVMs with any Kubernetes cluster to isolate persistent storage for cluster services from application storage. + +When using multiple SVMs, with one dedicated to cluster services, the goal is to isolate and control the workload in a more flexible way. This is possible because the expectation is that the Kubernetes cluster services SVM will not have dynamic provisioning happening against it in the same manner that the application SVM will. Many of the persistent storage resources needed by the Kubernetes cluster must exist prior to Trident deployment and consequentially must be manually provisioned by the storage administrator. + +Kubernetes cluster services +--------------------------- + +Even for cluster services persistent volumes created by Trident, there should be serious consideration given to using per-volume QoS policies, including QoS minimums when possible, and customizing the volume options for the application. Below are the default recommendations for the cluster services, however you should evaluate your needs and adjust policies according to your data protection, performance, and availability requirements. Despite these recommendations, you will still want to evaluate and determine what works best for your Kubernetes cluster and applications. + +**etcd** + +* The default snapshot policy is often adequate for protecting against data corruption and loss, however snapshots are not a backup strategy. Some consideration should be given to increasing the frequency, and decreasing the retention period, for etcd volumes. For example, keeping 24 hourly snapshots or 48 snapshots taken every 30 minutes, but not retaining them for more than one or two days. Since any data loss for etcd can be problematic, having more frequent snapshots makes this scenario easier to recover from. +* If the disaster recovery plan is to recover the Kubernetes cluster as-is at the destination site, then these volumes should be replicated with SnapMirror or SnapVault. +* etcd does not have significant IOPS or throughput requirements, however latency can play a critical role in the responsiveness of the Kubernetes API server. Whenever possible the lowest latency storage available should be used. +* A QoS policy should be leveraged to provide a minimum amount of IOPS to the etcd volume(s). The minimum value will depend on the number of nodes and pods which are deployed to your Kubernetes cluster. Monitoring should be used to verify that the configured policy is adequate and adjusted over time as the Kubernetes cluster expands. +* The etcd volumes should have their export policy or iGroup limited to only the nodes which are hosting, or could potentially host, etcd instances. + +**logging** + +* Volumes which are providing storage capacity for aggregated logging services need to be protected, however an average RPO is adequate in many instances since logging data is often not critical to recovery. If your application has strict compliance requirements, this may be different however. +* Using the default snapshot policy is generally adequate. Optionally, depending on the needs of the administrators, reducing the snapshot policy to one which keeps as few as seven daily snapshots may be acceptable. +* Logging volumes should be replicated to protect the historical data for use by the application and by administrators, however recovery may be deprioritized for other services. +* Logging services have widely variable IOPS requirements and read/write patterns. It's important to consider the number of nodes, pods, and other objects in the cluster. Each of these will generate data which needs to be stored, indexed, analyzed, and presented, so a larger cluster may have substantially more data than expected. +* A QoS policy may be leveraged to provide both a minimum and maximum amount of throughput available. Note that the maximum may need to be adjusted as additional pods are deployed, so close monitoring of the performance should be used to verify that logging is not being adversely affected by storage performance. +* The volumes export policy or iGroup should be limited to nodes which host the logging service. This will depend on the particular solution used and the chosen configuration. For example OpenShift's logging service is deployed to the infrastructure nodes. + +**metrics** + +* Kubernetes autoscale feature relies on metrics to provide data for when scale operations need to occur. Also, metrics data often plays a critical role in show-back and charge-back operations, so ensure that you are working to address the needs of the entire business with the RPO policy. Ensure that your RPO and RTO meet the needs of these functions. +* As the number of cluster nodes and deployed pods increases, so too does the amount of data which is collected and retained by the metrics service. It's important to understand the performance and capacity recommendations provided by the vendor for your metrics service as they can vary dramatically, particularly depending on the amount of time for which the data is retained and the number of metrics which are being monitored. +* A QoS policy can be used to limit the amount of IOPS or throughput which the metrics services uses, however it is generally not necessary to use a minimum policy. +* It is recommended to limit the export policy or iGroup to the hosts which the metrics service is executed from. Note that it's important to understand the architecture of your metrics provider. Many have agents which run on all hosts in the cluster, however those will report metrics to a centralised repository for storage and reporting. Only that group of nodes needs access. + +**registry** + +* Using a snapshot policy for the registry data may be valuable for recovering from data corruption or other issues, however it is not necessary. A basic snapshot policy is recommended, however individual container images cannot be recovered (they are stored in a hashed manner), only a full volume revert can be used to recover data. +* The workload for the registry can vary widely, however the general rule is that push operations happen infrequently, while pull operations happen frequently. If a CI/CD pipeline process is used to build, test, and deploy the application(s) this may result in a predictable workload. Alternatively, and even with a CI/CD system in use, the workload can vary based on application scaling requirements, build requirements, and even Kubernetes node add/remove operations. Close monitoring of the workload should be implemented to adjust as necessary. +* A QoS policy may be implemented to ensure that application instances are still able to pull and deploy new container images regardless of other workloads on the storage system. In the event of a disaster recovery scenario, the registry may have a heavy read workload while applications are instantiated on the destination site. The configured QoS minimum policy will prevent other disaster recovery operations from slowing application deployment. diff --git a/docs/index.rst b/docs/index.rst index 47404469d..8c9f6d457 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -19,6 +19,7 @@ Storage Orchestrator for Containers :caption: Kubernetes kubernetes/index + dag/kubernetes/index .. toctree:: :caption: Docker diff --git a/docs/kubernetes/operations/tasks/backends/ontap.rst b/docs/kubernetes/operations/tasks/backends/ontap.rst index cd5bf1f19..e4fa7f915 100644 --- a/docs/kubernetes/operations/tasks/backends/ontap.rst +++ b/docs/kubernetes/operations/tasks/backends/ontap.rst @@ -154,10 +154,10 @@ Parameter Description spaceReserve Space reservation mode; "none" (thin) or "volume" (thick) "none" snapshotPolicy Snapshot policy to use "none" snapshotReserve Percentage of volume reserved for snapshots "0" if snapshotPolicy is "none", else "" -splitOnClone Split a clone from its parent upon creation false -encryption Enable NetApp volume encryption false +splitOnClone Split a clone from its parent upon creation "false" +encryption Enable NetApp volume encryption "false" unixPermissions ontap-nas* only: mode for new volumes "777" -snapshotDir ontap-nas* only: access to the .snapshot directory false +snapshotDir ontap-nas* only: access to the .snapshot directory "false" exportPolicy ontap-nas* only: export policy to use "default" securityStyle ontap-nas* only: security style for new volumes "unix" ========================= =============================================================== ================================================