From be059a0c153a0971df12b8b8f3943063a842674d Mon Sep 17 00:00:00 2001 From: Maria Bermudez Date: Mon, 20 May 2019 18:53:05 -0700 Subject: [PATCH 1/4] Sync published with master (#8822) * Updated Windows Release that supports Kubernetes Changed from old outdated Edge release to reflect use of a stable release. Kubernetes page actually reflects this version as well (so its an error on this page only). * Interlock link fixes (#8798) * Remove outdated links/fix links * Next steps link fix * Next steps link fixes * Logging driver 920 (#8625) * Logging driver port from vnext-engine * Update json-file.md * Update json-file.md * Port changes from vnext-engine * Updates based on feedback * Added note back in * Added note back in * Added limitations per Anusha * New dual logging info * Added link to new topic Needs verification. * Changes per feedback. * Updates per feedback * Updates per feedback * Updated 20m * Added CE version * Added missing comma * Updates per feedback * Add raw tag Add TOC entry - subject to change * Add entry for local logging driver * Update config/containers/logging/configure.md Co-Authored-By: Sebastiaan van Stijn * Update config/containers/logging/configure.md Co-Authored-By: Sebastiaan van Stijn * Update config/containers/logging/configure.md Co-Authored-By: Sebastiaan van Stijn * Update config/containers/logging/configure.md Co-Authored-By: Sebastiaan van Stijn * Updates per feedback * Updates per feedback * Update zfs-driver.md (#8735) * Update zfs-driver.md * Add suggested correction * Removed HA Proxy Link * Added Azure Disk and Azure File Storage for UCP Workloads (#8774) * Added Azure Disk and Azure File I have added Azure Disk and Azure file documentation for use with UCP 3.0 or newer. * Added the Azure Disk Content * Added the Azure File Content * Updated the Toc to include Azure Disk and Azure File Signed-off-by: Olly Pomeroy * Responding to feedback, inc changing Azure File to Azure Files Following on from Steven and Deeps feedback this commit addresses those nits. Including changing `Operators` to `Platform Operators`, switching `Azure File` to `Azure Files` and many small formating changes. Signed-off-by: Olly Pomeroy * Minor style updates * Minor style updates * Final edits * Removed Ubuntu 14.04 warnings from Docker UCP install Page (#8804) We dropped support for Ubuntu 14.04 in Enterprise 2.1 / UCP 3.1, however the installation instructions still carry 14.04 warnings. Signed-off-by: Olly Pomeroy * Fix broken link (#8801) * ubuntu.md: remove old docker-ce-cli (#8665) I hit the following error when "upgrading" docker-ce 18.09 to docker-ee 17.06: > dpkg: error processing archive /var/cache/apt/archives/docker-ee_3%3a17.06.2~ee~19~3-0~ubuntu_amd64.deb (--unpack): trying to overwrite '/usr/share/fish/vendor_completions.d/docker.fish', which is also in package docker-ce-cli 5:18.09.4~2.1.rc1-0~ubuntu-xenial This commit adds `docker-ce-cli` to the list in "uninstall old packages" to fix this. * Updated UCP CLI Reference to 3.1.7 (#8805) -Updated all of the UCP 3.1.7 references. -Alphabeticalised each reference -Added very a value is expected or not after each variable. Signed-off-by: Olly Pomeroy * Fix numbering issue * Fix formatting * Added UCP Kubernetes Secure RBAC Defaults (#8810) * Added Kubernetes Secure RBAC Defaults * Style updates * Final edits --- _data/toc.yaml | 6 +- config/containers/logging/dual-logging.md | 3 +- .../configure/auto-delete-repo-events.md | 16 +- ee/ucp/admin/install/index.md | 11 - ee/ucp/authorization/index.md | 52 +++- ee/ucp/interlock/config/index.md | 1 - ee/ucp/kubernetes/storage/use-azure-disk.md | 239 +++++++++++++++++ ee/ucp/kubernetes/storage/use-azure-files.md | 246 ++++++++++++++++++ get-started/index.md | 2 +- install/linux/docker-ee/ubuntu.md | 2 +- reference/ucp/3.1/cli/backup.md | 15 +- reference/ucp/3.1/cli/dump-certs.md | 12 +- reference/ucp/3.1/cli/id.md | 6 + reference/ucp/3.1/cli/images.md | 16 +- reference/ucp/3.1/cli/index.md | 19 +- reference/ucp/3.1/cli/install.md | 83 +++--- reference/ucp/3.1/cli/restart.md | 8 +- reference/ucp/3.1/cli/restore.md | 20 +- reference/ucp/3.1/cli/stop.md | 8 +- reference/ucp/3.1/cli/support.md | 9 +- reference/ucp/3.1/cli/uninstall-ucp.md | 20 +- reference/ucp/3.1/cli/upgrade.md | 29 +-- storage/storagedriver/zfs-driver.md | 2 +- 23 files changed, 670 insertions(+), 155 deletions(-) create mode 100644 ee/ucp/kubernetes/storage/use-azure-disk.md create mode 100644 ee/ucp/kubernetes/storage/use-azure-files.md diff --git a/_data/toc.yaml b/_data/toc.yaml index e9cef0d3f1..8c7efc3bd4 100644 --- a/_data/toc.yaml +++ b/_data/toc.yaml @@ -1377,8 +1377,12 @@ manuals: path: /ee/ucp/kubernetes/kubernetes-network-encryption/ - sectiontitle: Persistent Storage section: - - title: Use NFS storage + - title: Use NFS Storage path: /ee/ucp/kubernetes/storage/use-nfs-volumes/ + - title: Use Azure Disk Storage + path: /ee/ucp/kubernetes/storage/use-azure-disk/ + - title: Use Azure Files Storage + path: /ee/ucp/kubernetes/storage/use-azure-files/ - title: Use AWS EBS Storage path: /ee/ucp/kubernetes/storage/configure-aws-storage/ - title: API reference diff --git a/config/containers/logging/dual-logging.md b/config/containers/logging/dual-logging.md index 2f3d395582..aaeda6b9b7 100644 --- a/config/containers/logging/dual-logging.md +++ b/config/containers/logging/dual-logging.md @@ -27,7 +27,8 @@ Starting with Docker Engine Enterprise 18.03.1-ee-1, you can use `docker logs` t logs regardless of the configured logging driver or plugin. This capability, sometimes referred to as dual logging, allows you to use `docker logs` to read container logs locally in a consistent format, regardless of the remote log driver used, because the engine is configured to log information to the “local” -logging driver. Refer to [Configure the default logging driver](/configure) for additional information. +logging driver. Refer to [Configure the default logging driver](/config/containers/logging/configure) for additional information. + ## Prerequisites diff --git a/ee/dtr/admin/configure/auto-delete-repo-events.md b/ee/dtr/admin/configure/auto-delete-repo-events.md index 8e7c2d6366..d613729927 100644 --- a/ee/dtr/admin/configure/auto-delete-repo-events.md +++ b/ee/dtr/admin/configure/auto-delete-repo-events.md @@ -16,18 +16,18 @@ Docker Trusted Registry has a global setting for repository event auto-deletion. 3. Scroll down to **Repository Events** and turn on ***Auto-Deletion***. -![](../../images/auto-delete-repo-events-0.png){: .img-fluid .with-border} + ![](../../images/auto-delete-repo-events-0.png){: .img-fluid .with-border} 4. Specify the conditions with which an event auto-deletion will be triggered. -![](../../images/auto-delete-repo-events-1.png){: .img-fluid .with-border} + ![](../../images/auto-delete-repo-events-1.png){: .img-fluid .with-border} -DTR allows you to set your auto-deletion conditions based on the following optional repository event attributes: + DTR allows you to set your auto-deletion conditions based on the following optional repository event attributes: -| Name | Description | Example | -|:----------------|:---------------------------------------------------| :----------------| -| Age | Lets you remove events older than your specified number of hours, days, weeks or months| `2 months` | -| Max number of events | Lets you specify the maximum number of events allowed in the repositories. | `6000` | + | Name | Description | Example | + |:----------------|:---------------------------------------------------| :----------------| + | Age | Lets you remove events older than your specified number of hours, days, weeks or months| `2 months` | + | Max number of events | Lets you specify the maximum number of events allowed in the repositories. | `6000` | If you check and specify both, events in your repositories will be removed during garbage collection if either condition is met. You should see a confirmation message right away. @@ -35,7 +35,7 @@ If you check and specify both, events in your repositories will be removed durin 6. Navigate to **System > Job Logs** to confirm that `onlinegc` has happened. -![](../../images/auto-delete-repo-events-2.png){: .img-fluid .with-border} + ![](../../images/auto-delete-repo-events-2.png){: .img-fluid .with-border} ## Where to go next diff --git a/ee/ucp/admin/install/index.md b/ee/ucp/admin/install/index.md index 2f9340829b..3070c1bf58 100644 --- a/ee/ucp/admin/install/index.md +++ b/ee/ucp/admin/install/index.md @@ -52,17 +52,6 @@ Make sure you follow the [UCP System requirements](system-requirements.md) for opening networking ports. Ensure that your hardware or software firewalls are open appropriately or disabled. -> Ubuntu 14.04 mounts -> -> For UCP to install correctly on Ubuntu 14.04, `/mnt` and other mounts -> must be shared: -> ``` -> sudo mount --make-shared /mnt -> sudo mount --make-shared / -> sudo mount --make-shared /run -> sudo mount --make-shared /dev -> ``` - To install UCP: 1. Use ssh to log in to the host where you want to install UCP. diff --git a/ee/ucp/authorization/index.md b/ee/ucp/authorization/index.md index eb239040dc..35e193ade2 100644 --- a/ee/ucp/authorization/index.md +++ b/ee/ucp/authorization/index.md @@ -23,7 +23,7 @@ For an example, see [Deploy stateless app with RBAC](deploy-stateless-app.md). ## Subjects -A subject represents a user, team, organization, or service account. A subject +A subject represents a user, team, organization, or a service account. A subject can be granted a role that defines permitted operations against one or more resource sets. @@ -34,19 +34,19 @@ resource sets. - **Organization**: A group of teams that share a specific set of permissions, defined by the roles of the organization. - **Service account**: A Kubernetes object that enables a workload to access - cluster resources that are assigned to a namespace. + cluster resources which are assigned to a namespace. Learn to [create and configure users and teams](create-users-and-teams-manually.md). ## Roles Roles define what operations can be done by whom. A role is a set of permitted -operations against a type of resource, like a container or volume, that's -assigned to a user or team with a grant. +operations against a type of resource, like a container or volume, which is +assigned to a user or a team with a grant. -For example, the built-in role, **Restricted Control**, includes permission to +For example, the built-in role, **Restricted Control**, includes permissions to view and schedule nodes but not to update nodes. A custom **DBA** role might -include permissions to `r-w-x` volumes and secrets. +include permissions to `r-w-x` (read, write, and execute) volumes and secrets. Most organizations use multiple roles to fine-tune the appropriate access. A given team or user may have different roles provided to them depending on what @@ -71,7 +71,7 @@ To control user access, cluster resources are grouped into Docker Swarm is a logical area for a Kubernetes cluster. Kubernetes comes with a `default` namespace for your cluster objects, plus two more namespaces for system and public resources. You can create custom namespaces, but unlike Swarm - collections, namespaces _can't be nested_. Resource types that users can + collections, namespaces _cannot be nested_. Resource types that users can access in a Kubernetes namespace include pods, deployments, network policies, nodes, services, secrets, and many more. @@ -80,11 +80,12 @@ Together, collections and namespaces are named *resource sets*. Learn to ## Grants -A grant is made up of *subject*, *role*, and *resource set*. +A grant is made up of a *subject*, a *role*, and a *resource set*. Grants define which users can access what resources in what way. Grants are -effectively Access Control Lists (ACLs), and when grouped together, they -provide comprehensive access policies for an entire organization. +effectively **Access Control Lists** (ACLs) which +provide comprehensive access policies for an entire organization when grouped +together. Only an administrator can manage grants, subjects, roles, and access to resources. @@ -96,6 +97,37 @@ resources. > and applies grants to users and teams. {: .important} +## Secure Kubernetes defaults + +For cluster security, only users and service accounts granted the `cluster-admin` ClusterRole for +all Kubernetes namespaces via a ClusterRoleBinding can deploy pods with privileged options. This prevents a +platform user from being able to bypass the Universal Control Plane Security Model. + +These privileged options include: + + - `PodSpec.hostIPC` - Prevents a user from deploying a pod in the host's IPC + Namespace. + - `PodSpec.hostNetwork` - Prevents a user from deploying a pod in the host's + Network Namespace. + - `PodSpec.hostPID` - Prevents a user from deploying a pod in the host's PID + Namespace. + - `SecurityContext.allowPrivilegeEscalation` - Prevents a child process + of a container from gaining more privileges than its parent. + - `SecurityContext.capabilities` - Prevents additional [Linux + Capabilities](https://docs.docker.com/engine/security/security/#linux-kernel-capabilities) + from being added to a pod. + - `SecurityContext.privileged` - Prevents a user from deploying a [Privileged + Container](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities). + - `Volume.hostPath` - Prevents a user from mounting a path from the host into + the container. This could be a file, a directory, or even the Docker Socket. + +If a user without a cluster admin role tries to deploy a pod with any of these +privileged options, an error similar to the following example is displayed: + +```bash +Error from server (Forbidden): error when creating "pod.yaml": pods "mypod" is forbidden: user "" is not an admin and does not have permissions to use privileged mode for resource +``` + ## Where to go next - [Create and configure users and teams](create-users-and-teams-manually.md) diff --git a/ee/ucp/interlock/config/index.md b/ee/ucp/interlock/config/index.md index bcb2d6613f..7c703336ad 100644 --- a/ee/ucp/interlock/config/index.md +++ b/ee/ucp/interlock/config/index.md @@ -120,7 +120,6 @@ Because Interlock passes the extension configuration directly to the extension, different configuration options available. Refer to the documentation for each extension for supported options: - [Nginx](nginx-config.md) -- [HAproxy](haproxy-config.md) #### Customize the default proxy service The default proxy service used by UCP to provide layer 7 routing is NGINX. If users try to access a route that hasn't been configured, they will see the default NGINX 404 page: diff --git a/ee/ucp/kubernetes/storage/use-azure-disk.md b/ee/ucp/kubernetes/storage/use-azure-disk.md new file mode 100644 index 0000000000..a2471925a9 --- /dev/null +++ b/ee/ucp/kubernetes/storage/use-azure-disk.md @@ -0,0 +1,239 @@ +--- +title: Configuring Azure Disk Storage for Kubernetes +description: Learn how to add persistent storage to your Docker Enterprise clusters running on Azure with Azure Disk. +keywords: Universal Control Plane, UCP, Docker EE, Kubernetes, storage, volume +redirect_from: +--- + +Platform operators can provide persistent storage for workloads running on +Docker Enterprise and Microsoft Azure by using Azure Disk. Platform +operators can either pre-provision Azure Disks to be consumed by Kubernetes +Pods, or can use the Azure Kubernetes integration to dynamically provision Azure +Disks on demand. + + +## Prerequisites + +This guide assumes you have already provisioned a UCP environment on +Microsoft Azure. The Cluster must be provisioned after meeting all of the +prerequisites listed in [Install UCP on +Azure](/ee/ucp/admin/install/install-on-azure.md). + +Additionally, this guide uses the Kubernetes Command Line tool `$ +kubectl` to provision Kubernetes objects within a UCP cluster. Therefore, this +tool must be downloaded, along with a UCP client bundle. For more +information on configuring CLI access for UCP, see [CLI Based +Access](/ee/ucp/user-access/cli/). + +## Manually provision Azure Disks + +An operator can use existing Azure Disks or manually provision new ones to +provide persistent storage for Kubernetes Pods. Azure Disks can be manually +provisioned in the Azure Portal, using ARM Templates or the Azure CLI. The +following example uses the Azure CLI to manually provision an Azure +Disk. + +```bash +$ RG=myresourcegroup + +$ az disk create \ + --resource-group $RG \ + --name k8s_volume_1 \ + --size-gb 20 \ + --query id \ + --output tsv +``` + +Using the Azure CLI command in the previous example should return the Azure ID of the Azure Disk +Object. If you are provisioning Azure resources using an alternative method, +make sure you retrieve the Azure ID of the Azure Disk, because it is needed for another step. + +``` +/subscriptions//resourceGroups//providers/Microsoft.Compute/disks/ +``` + +You can now create Kubernetes Objects that refer to this Azure Disk. The following +example uses a Kubernetes Pod. However, the same Azure Disk syntax can be +used for DaemonSets, Deployments, and StatefulSets. In the following example, the +Azure Disk Name and ID reflect the manually created Azure Disk. + +```bash +$ cat </resourceGroups//providers/Microsoft.Compute/disks/ +EOF +``` + +## Dynamically provision Azure Disks + +### Define the Azure Disk Storage Class + +Kubernetes can dynamically provision Azure Disks using the Azure Kubernetes +integration, which was configured when UCP was installed. For Kubernetes +to determine which APIs to use when provisioning storage, you must +create Kubernetes Storage Classes specific to each storage backend. For more +information on Kubernetes Storage Classes, see [Storage +Classes](https://kubernetes.io/docs/concepts/storage/storage-classes/). + +In Azure there are 2 different Azure Disk types that can be consumed by +Kubernetes: Azure Disk Standard Volumes and Azure Disk Premium Volumes. For more +information on their differences, see [Azure +Disks](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disks-types). + +Depending on your use case, you can deploy one or both of the Azure Disk storage Classes (Standard and Advanced). + +To create a Standard Storage Class: + +```bash +$ cat < + Warning FailedAttachVolume 7s (x11 over 6m) attachdetach-controller AttachVolume.Attach failed for volume "pvc-6b09dae3-6ad6-11e9-9509-0242ac11000b" : Attach volume "kubernetes-dynamic-pvc-6b09dae3-6ad6-11e9-9509-0242ac11000b" to instance "/subscriptions//resourceGroups//providers/Microsoft.Compute/virtualMachines/worker-03" failed with compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=409 -- Original Error: failed request: autorest/azure: Service returned an error. Status= Code="OperationNotAllowed" Message="The maximum number of data disks allowed to be attached to a VM of this size is 4." Target="dataDisks" +``` + +## Where to go next + +- [Deploy an Ingress Controller on + Kubernetes](/ee/ucp/kubernetes/layer-7-routing/) +- [Discover Network Encryption on + Kubernetes](/ee/ucp/kubernetes/kubernetes-network-encryption/) diff --git a/ee/ucp/kubernetes/storage/use-azure-files.md b/ee/ucp/kubernetes/storage/use-azure-files.md new file mode 100644 index 0000000000..6ba7ead84d --- /dev/null +++ b/ee/ucp/kubernetes/storage/use-azure-files.md @@ -0,0 +1,246 @@ +--- +title: Configuring Azure Files Storage for Kubernetes +description: Learn how to add persistent storage to your Docker Enterprise clusters running on Azure with Azure Files. +keywords: Universal Control Plane, UCP, Docker EE, Kubernetes, storage, volume +redirect_from: +--- + +Platform operators can provide persistent storage for workloads running on +Docker Enterprise and Microsoft Azure by using Azure Files. You can either +pre-provision Azure Files Shares to be consumed by +Kubernetes Pods or can you use the Azure Kubernetes integration to dynamically +provision Azure Files Shares on demand. + +## Prerequisites + +This guide assumes you have already provisioned a UCP environment on +Microsoft Azure. The cluster must be provisioned after meeting all +prerequisites listed in [Install UCP on +Azure](/ee/ucp/admin/install/install-on-azure.md). + +Additionally, this guide uses the Kubernetes Command Line tool `$ +kubectl` to provision Kubernetes objects within a UCP cluster. Therefore, you must download +this tool along with a UCP client bundle. For more +information on configuring CLI access to UCP, see [CLI Based +Access](/ee/ucp/user-access/cli/). + +## Manually Provisioning Azure Files + +You can use existing Azure Files Shares or manually provision new ones to +provide persistent storage for Kubernetes Pods. Azure Files Shares can be +manually provisioned in the Azure Portal using ARM Templates or using the Azure +CLI. The following example uses the Azure CLI to manually provision +Azure Files Shares. + +### Creating an Azure Storage Account + +When manually creating an Azure Files Share, first create an Azure +Storage Account for the file shares. If you have already provisioned +a Storage Account, you can skip to [Creating an Azure Files +Share](#creating-an-azure-file-share). + +> **Note**: the Azure Kubernetes Driver does not support Azure Storage Accounts +> created using Azure Premium Storage. + +```bash +$ REGION=ukwest +$ SA=mystorageaccount +$ RG=myresourcegroup + +$ az storage account create \ + --name $SA \ + --resource-group $RG \ + --location $REGION \ + --sku Standard_LRS +``` + +### Creating an Azure Files Share + +Next, provision an Azure Files Share. The size of this share can be +adjusted to fit the end user's requirements. If you have already created an +Azure Files Share, you can skip to [Configuring a Kubernetes +Secret](#configuring-a-kubernetes-secret). + +```bash +$ SA=mystorageaccount +$ RG=myresourcegroup +$ FS=myfileshare +$ SIZE=5 + +# This Azure Collection String can also be found in the Azure Portal +$ export AZURE_STORAGE_CONNECTION_STRING=`az storage account show-connection-string --name $SA --resource-group $RG -o tsv` + +$ az storage share create \ + --name $FS \ + --quota $SIZE \ + --connection-string $AZURE_STORAGE_CONNECTION_STRING +``` + +### Configuring a Kubernetes Secret + +After a File Share has been created, you must load the Azure Storage +Account Access key as a Kubernetes Secret into UCP. This provides access to +the file share when Kubernetes attempts to mount the share into a pod. This key +can be found in the Azure Portal or retrieved as shown in the following example by the Azure CLI: + +```bash +$ SA=mystorageaccount +$ RG=myresourcegroup +$ FS=myfileshare + +# The Azure Storage Account Access Key can also be found in the Azure Portal +$ STORAGE_KEY=$(az storage account keys list --resource-group $RG --account-name $SA --query "[0].value" -o tsv) + +$ kubectl create secret generic azure-secret \ + --from-literal=azurestorageaccountname=$SA \ + --from-literal=azurestorageaccountkey=$STORAGE_KEY +``` + +### Mount the Azure Files Share into a Kubernetes Pod + +The final step is to mount the Azure Files Share, using the Kubernetes Secret, into +a Kubernetes Pod. The following code creates a standalone Kubernetes pod, but you +can also use alternative Kubernetes Objects such as Deployments, DaemonSets, or +StatefulSets, with the existing Azure Files Share. + +```bash +$ FS=myfileshare + +$ cat < Today, only the Standard Storage Class is supported when using the Azure +> Kubernetes Plugin. File shares using the Premium Storage Class will fail to +> mount. + +```bash +$ cat < - [Kubernetes on Docker Desktop for Windows](/docker-for-windows/kubernetes/){: target="_blank" class="_"} is available in -[18.02 Edge (win50)](/docker-for-windows/edge-release-notes/#docker-community-edition-18020-ce-rc1-win50-2018-01-26){: target="_blank" class="_"} and higher edge channels only. +[18.06.0 CE (win70)](/docker-for-windows/release-notes/){: target="_blank" class="_"} and higher as well as edge channels. [Install Docker](/engine/installation/index.md){: class="button outline-btn"}
diff --git a/install/linux/docker-ee/ubuntu.md b/install/linux/docker-ee/ubuntu.md index 979220fc50..dae6557ba2 100644 --- a/install/linux/docker-ee/ubuntu.md +++ b/install/linux/docker-ee/ubuntu.md @@ -47,7 +47,7 @@ Older versions of Docker were called `docker` or `docker-engine`. In addition, if you are upgrading from Docker CE to Docker EE, remove the Docker CE package. ```bash -$ sudo apt-get remove docker docker-engine docker-ce docker.io +$ sudo apt-get remove docker docker-engine docker-ce docker-ce-cli docker.io ``` It's OK if `apt-get` reports that none of these packages are installed. diff --git a/reference/ucp/3.1/cli/backup.md b/reference/ucp/3.1/cli/backup.md index 97250d35a8..b67365047a 100644 --- a/reference/ucp/3.1/cli/backup.md +++ b/reference/ucp/3.1/cli/backup.md @@ -37,10 +37,11 @@ Note: ## Options -| Option | Description | -|:--------------------------|:---------------------------| -|`--debug, D`|Enable debug mode| -|`--jsonlog`|Produce json formatted output for easier parsing| -|`--interactive, i`|Run in interactive mode and prompt for configuration values| -|`--id`|The ID of the UCP instance to back up| -|`--passphrase`|Encrypt the tar file with a passphrase| +| Option | Description | +|:-----------------------|:--------------------------------------------------------------------| +| `--debug, -D` | Enable debug mode | +| `--jsonlog` | Produce json formatted output for easier parsing | +| `--interactive, -i` | Run in interactive mode and prompt for configuration values | +| `--id` *value* | The ID of the UCP instance to back up | +| `--no-passphrase` | Opt out to encrypt the tar file with a passphrase (not recommended) | +| `--passphrase` *value* | Encrypt the tar file with a passphrase | diff --git a/reference/ucp/3.1/cli/dump-certs.md b/reference/ucp/3.1/cli/dump-certs.md index 928bbbba1c..008e6cb912 100644 --- a/reference/ucp/3.1/cli/dump-certs.md +++ b/reference/ucp/3.1/cli/dump-certs.md @@ -27,9 +27,9 @@ to configure DTR. ## Options -| Option | Description | -|:--------------------------|:---------------------------| -|`--debug, D`|Enable debug mode| -|`--jsonlog`|Produce json formatted output for easier parsing| -|`--ca`|Only print the contents of the ca.pem file| -|`--cluster`|Print the internal UCP swarm root CA and cert instead of the public server cert| +| Option | Description | +|:-------------|:--------------------------------------------------------------------------------| +| `--debug, D` | Enable debug mode | +| `--jsonlog` | Produce json formatted output for easier parsing | +| `--ca` | Only print the contents of the ca.pem file | +| `--cluster` | Print the internal UCP swarm root CA and cert instead of the public server cert | diff --git a/reference/ucp/3.1/cli/id.md b/reference/ucp/3.1/cli/id.md index 0721e0e1c6..14387cd983 100644 --- a/reference/ucp/3.1/cli/id.md +++ b/reference/ucp/3.1/cli/id.md @@ -23,3 +23,9 @@ a client bundle. This ID is used by other commands as confirmation. +## Options + +| Option | Description | +|:-------------|:-------------------------------------------------| +| `--debug, D` | Enable debug mode | +| `--jsonlog` | Produce json formatted output for easier parsing | diff --git a/reference/ucp/3.1/cli/images.md b/reference/ucp/3.1/cli/images.md index 2980128ae0..9a0fb8145e 100644 --- a/reference/ucp/3.1/cli/images.md +++ b/reference/ucp/3.1/cli/images.md @@ -24,11 +24,11 @@ the ones that are missing. ## Options -| Option | Description | -|:--------------------------|:---------------------------| -|`--debug, D`|Enable debug mode| -|`--jsonlog`|Produce json formatted output for easier parsing| -|`--pull`|Pull UCP images: `always`, when `missing`, or `never`| -|`--registry-username`|Username to use when pulling images| -|`--registry-password`|Password to use when pulling images| -|`--list`|List all images used by UCP but don't pull them| +| Option | Description | +|:------------------------------|:-----------------------------------------------------| +| `--debug, D` | Enable debug mode | +| `--jsonlog` | Produce json formatted output for easier parsing | +| `--list` | List all images used by UCP but don't pull them | +| `--pull` *value* | Pull UCP images: `always`, when `missing`, or `never`| +| `--registry-password` *value* | Password to use when pulling images | +| `--registry-username` *value* | Username to use when pulling images | diff --git a/reference/ucp/3.1/cli/index.md b/reference/ucp/3.1/cli/index.md index 12e71bdcc2..f41b7283c9 100644 --- a/reference/ucp/3.1/cli/index.md +++ b/reference/ucp/3.1/cli/index.md @@ -31,15 +31,16 @@ docker container run -it --rm \ | Option | Description | |:-----------------|:----------------------------------------------------------| +| `backup` | Create a backup of a UCP manager node | +| `dump-certs` | Print the public certificates used by this UCP web server | +| `example-config` | Display an example configuration file for UCP | +| `help` | Shows a list of commands or help for one command | +| `id` | Print the ID of UCP running on this node | +| `images` | Verify the UCP images on this node | | `install` | Install UCP on this node | | `restart` | Start or restart UCP components running on this node | -| `stop` | Stop UCP components running on this node | -| `upgrade` | Upgrade the UCP cluster | -| `images` | Verify the UCP images on this node | -| `uninstall-ucp` | Uninstall UCP from this swarm | -| `dump-certs` | Print the public certificates used by this UCP web server | -| `support` | Create a support dump for this UCP node | -| `id` | Print the ID of UCP running on this node | -| `backup` | Create a backup of a UCP manager node | | `restore` | Restore a UCP cluster from a backup | -| `example-config` | Display an example configuration file for UCP | +| `stop` | Stop UCP components running on this node | +| `support` | Create a support dump for this UCP node | +| `uninstall-ucp` | Uninstall UCP from this swarm | +| `upgrade` | Upgrade the UCP cluster | diff --git a/reference/ucp/3.1/cli/install.md b/reference/ucp/3.1/cli/install.md index 4c0d06528c..f0df1ba991 100644 --- a/reference/ucp/3.1/cli/install.md +++ b/reference/ucp/3.1/cli/install.md @@ -42,44 +42,45 @@ If you are installing on Azure, see [Install UCP on Azure](/ee/ucp/admin/install ## Options -| Option | Description | -|:-------------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `--admin-password` | The UCP administrator password. Must be at least 8 characters. | -| `--admin-username` | The UCP administrator username | -| `--binpack` | Set the Docker Swarm scheduler to binpack mode. Used for backwards compatibility | -| `--cloud-provider` | The cloud provider for the cluster -| `--cni-installer-url` | Deprecated feature. A URL pointing to a Kubernetes YAML file to be used as an installer for the CNI plugin of the cluster. If specified, the default CNI plugin is not installed. If the URL uses the HTTPS scheme, no certificate verification is performed. | -| `--controller-port` | Port for the web UI and API -| `--data-path-addr` | Address or interface to use for data path traffic. Format: IP address or network interface name -| `--debug, D` | Enable debug mode | -| `--disable-tracking` | Disable anonymous tracking and analytics | -| `--disable-usage` | Disable anonymous usage reporting | -| `--dns` | Set custom DNS servers for the UCP containers | -| `--dns-opt` | Set DNS options for the UCP containers | -| `--dns-search` | Set custom DNS search domains for the UCP containers | -| `--enable-profiling` | Enable performance profiling | -| `--existing-config` | Use the latest existing UCP config during this installation. The install fails if a config is not found. | -| `--external-server-cert` | Use the certificates in the `ucp-controller-server-certs` volume instead of generating self-signed certs during installation | -| `--external-service-lb` | Set the external service load balancer reported in the UI | -| `--force-insecure-tcp` | Force install to continue even with unauthenticated Docker Engine ports | -| `--force-minimums` | Force the install/upgrade even if the system doesn't meet the minimum requirements. | -| `--host-address` | The network address to advertise to other nodes. Format: IP address or network interface name | -| `--interactive, i` | Run in interactive mode and prompt for configuration values | -| `--jsonlog` | Produce json formatted output for easier parsing | -| `--kube-apiserver-port` | Port for the Kubernetes API server (default: 6443) | -| `--kv-snapshot-count` | Number of changes between key-value store snapshots | -| `--kv-timeout` | Timeout in milliseconds for the key-value store | -| `--license` | Add a license: e.g.` --license "$(cat license.lic)" ` | -| `--pod-cidr` | Kubernetes cluster IP pool for the pods to allocated IPs from (Default: `192.168.0.0/16`) | -| `--preserve-certs` | Don't generate certificates if they already exist | -| `--pull` | Pull UCP images: `always`, when `missing`, or `never` | -| `--random` | Set the Docker Swarm scheduler to random mode. Used for backwards compatibility | -| `--registry-username` | Username to use when pulling images | -| `--registry-password` | Password to use when pulling images | -| `--san` | Add subject alternative names to certificates (e.g. --san www1.acme.com --san www2.acme.com) | -| `--skip-cloud-provider` | Disables checks that rely on detecting the cloud provider (if any) on which the cluster is currently running. | -| `--swarm-experimental` | Enable Docker Swarm experimental features. Used for backwards compatibility | -| `--swarm-port` | Port for the Docker Swarm manager. Used for backwards compatibility | -| `--swarm-grpc-port` | Port for communication between nodes | -| `--unlock-key` | The unlock key for this swarm-mode cluster, if one exists. | -| `--unmanaged-cni` |The default value of `false` indicates that Kubernetes networking is managed by UCP with its default managed CNI plugin, Calico. When set to `true`, UCP does not deploy or manage the lifecycle of the default CNI plugin - the CNI plugin is deployed and managed independently of UCP. Note that when `unmanaged-cni=true`, networking in the cluster will not function for Kubernetes until a CNI plugin is deployed. | +| Option | Description | +|:--------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `--debug, -D` | Enable debug mode | +| `--jsonlog` | Produce json formatted output for easier parsing | +| `--interactive, -i` | Run in interactive mode and prompt for configuration values | +| `--admin-password` *value* | The UCP administrator password [$UCP_ADMIN_PASSWORD] | +| `--admin-username` *value* | The UCP administrator username [$UCP_ADMIN_USER] | +| `--binpack` | Set the Docker Swarm scheduler to binpack mode. Used for backwards compatibility | +| `--cloud-provider` *value* | The cloud provider for the cluster | +| `--cni-installer-url` *value* | A URL pointing to a kubernetes YAML file to be used as an installer for the CNI plugin of the cluster. If specified, the default CNI plugin will not be installed. If the URL is using the HTTPS scheme, no certificate verification will be performed | +| `--controller-port` *value* | Port for the web UI and API (default: 443) | +| `--data-path-addr` *value* | Address or interface to use for data path traffic. Format: IP address or network interface name [$UCP_DATA_PATH_ADDR] | +| `--disable-tracking` | Disable anonymous tracking and analytics | +| `--disable-usage` | Disable anonymous usage reporting | +| `--dns-opt` *value* | Set DNS options for the UCP containers [$DNS_OPT] | +| `--dns-search` *value* | Set custom DNS search domains for the UCP containers [$DNS_SEARCH] | +| `--dns` *value* | Set custom DNS servers for the UCP containers [$DNS] | +| `--enable-profiling` | Enable performance profiling | +| `--existing-config` | Use the latest existing UCP config during this installation. The install will fail if a config is not found | +| `--external-server-cert` | Customize the certificates used by the UCP web server | +| `--external-service-lb` *value* | Set the IP address of the load balancer that published services are expected to be reachable on | +| `--force-insecure-tcp` | Force install to continue even with unauthenticated Docker Engine ports. | +| `--force-minimums` | Force the install/upgrade even if the system does not meet the minimum requirements | +| `--host-address` *value* | The network address to advertise to other nodes. Format: IP address or network interface name [$UCP_HOST_ADDRESS] | +| `--kube-apiserver-port` *value* | Port for the Kubernetes API server (default: 6443) | +| `--kv-snapshot-count` *value* | Number of changes between key-value store snapshots (default: 20000) [$KV_SNAPSHOT_COUNT] | +| `--kv-timeout` *value* | Timeout in milliseconds for the key-value store (default: 5000) [$KV_TIMEOUT] | +| `--license` *value* | Add a license: e.g. --license "$(cat license.lic)" [$UCP_LICENSE] | +| `--nodeport-range` *value* | Allowed port range for Kubernetes services of type NodePort (Default: 32768-35535) (default: "32768-35535") | +| `--pod-cidr` *value* | Kubernetes cluster IP pool for the pods to allocated IP from (Default: 192.168.0.0/16) (default: "192.168.0.0/16") | +| `--preserve-certs` | Don't generate certificates if they already exist | +| `--pull` *value* | Pull UCP images: 'always', when 'missing', or 'never' (default: "missing") | +| `--random` | Set the Docker Swarm scheduler to random mode. Used for backwards compatibility | +| `--registry-password` *value* | Password to use when pulling images [$REGISTRY_PASSWORD] | +| `--registry-username` *value* | Username to use when pulling images [$REGISTRY_USERNAME] | +| `--san` *value* | Add subject alternative names to certificates (e.g. --san www1.acme.com --san www2.acme.com) [$UCP_HOSTNAMES] | +| `--skip-cloud-provider-check` | Disables checks which rely on detecting which (if any) cloud provider the cluster is currently running on | +| `--swarm-experimental` | Enable Docker Swarm experimental features. Used for backwards compatibility | +| `--swarm-grpc-port` *value* | Port for communication between nodes (default: 2377) | +| `--swarm-port` *value* | Port for the Docker Swarm manager. Used for backwards compatibility (default: 2376) | +| `--unlock-key` *value* | The unlock key for this swarm-mode cluster, if one exists. [$UNLOCK_KEY] | +| `--unmanaged-cni` | Flag to indicate if cni provider is calico and managed by UCP (calico is the default CNI provider) | diff --git a/reference/ucp/3.1/cli/restart.md b/reference/ucp/3.1/cli/restart.md index f1824f28ed..d8e50fc9cf 100644 --- a/reference/ucp/3.1/cli/restart.md +++ b/reference/ucp/3.1/cli/restart.md @@ -18,7 +18,7 @@ docker container run --rm -it \ ## Options -| Option | Description | -|:--------------------------|:---------------------------| -|`--debug, D`|Enable debug mode| -|`--jsonlog`|Produce json formatted output for easier parsing| +| Option | Description | +|:-------------|:-------------------------------------------------| +| `--debug, D` | Enable debug mode | +| `--jsonlog` | Produce json formatted output for easier parsing | diff --git a/reference/ucp/3.1/cli/restore.md b/reference/ucp/3.1/cli/restore.md index 6552c6b4f9..dc528345e3 100644 --- a/reference/ucp/3.1/cli/restore.md +++ b/reference/ucp/3.1/cli/restore.md @@ -58,13 +58,13 @@ Notes: ## Options -| Option | Description | -|:-------------------|:----------------------------------------------------------------------------------------------| -| `--debug, D` | Enable debug mode | -| `--jsonlog` | Produce json formatted output for easier parsing | -| `--interactive, i` | Run in interactive mode and prompt for configuration values | -| `--passphrase` | Decrypt the backup tar file with the provided passphrase | -| `--san` | Add subject alternative names to certificates (e.g. --san www1.acme.com --san www2.acme.com) | -| `--host-address` | The network address to advertise to other nodes. Format: IP address or network interface name | -| `--data-path-addr` | Address or interface to use for data path traffic | -| `--unlock-key` | The unlock key for this swarm-mode cluster, if one exists. | +| Option | Description | +|:---------------------------|:----------------------------------------------------------------------------------------------| +| `--debug, D` | Enable debug mode | +| `--jsonlog` | Produce json formatted output for easier parsing | +| `--interactive, i` | Run in interactive mode and prompt for configuration values | +| `--data-path-addr` *value* | Address or interface to use for data path traffic | +| `--host-address` *value* | The network address to advertise to other nodes. Format: IP address or network interface name | +| `--passphrase` *value* | Decrypt the backup tar file with the provided passphrase | +| `--san` *value* | Add subject alternative names to certificates (e.g. --san www1.acme.com --san www2.acme.com) | +| `--unlock-key` *value* | The unlock key for this swarm-mode cluster, if one exists. | diff --git a/reference/ucp/3.1/cli/stop.md b/reference/ucp/3.1/cli/stop.md index a246cb9fdf..3e9fbe58ba 100644 --- a/reference/ucp/3.1/cli/stop.md +++ b/reference/ucp/3.1/cli/stop.md @@ -18,7 +18,7 @@ docker container run --rm -it \ ## Options -| Option | Description | -|:--------------------------|:---------------------------| -|`--debug, D`|Enable debug mode| -|`--jsonlog`|Produce json formatted output for easier parsing| +| Option | Description | +|:-------------|:-------------------------------------------------| +| `--debug, D` | Enable debug mode | +| `--jsonlog` | Produce json formatted output for easier parsing | diff --git a/reference/ucp/3.1/cli/support.md b/reference/ucp/3.1/cli/support.md index 7649e26824..32ef42d55d 100644 --- a/reference/ucp/3.1/cli/support.md +++ b/reference/ucp/3.1/cli/support.md @@ -22,8 +22,7 @@ This command creates a support dump file for the specified node(s), and prints i ## Options -| Option | Description | -|:--------------------------|:---------------------------| -|`--loglines`|Specify number of lines to grab from `journalctl`. The default is 10,000 lines.| -|`--servicedriller`|Run the swarm service driller (ssd) tool. For more information on this tool, see [Docker Swarm Service Driller (ssd)](https://github.com/docker/libnetwork/tree/master/cmd/ssd) Not run by default.| -|`--nodes`|Select specific nodes on which to produce a support dump. Comma-separated node IDs are allowed. The default selects all nodes.| +| Option | Description | +|:-------------|:-------------------------------------------------| +| `--debug, D` | Enable debug mode | +| `--jsonlog` | Produce json formatted output for easier parsing | diff --git a/reference/ucp/3.1/cli/uninstall-ucp.md b/reference/ucp/3.1/cli/uninstall-ucp.md index a1277e692c..6e6e6d10f7 100644 --- a/reference/ucp/3.1/cli/uninstall-ucp.md +++ b/reference/ucp/3.1/cli/uninstall-ucp.md @@ -30,13 +30,13 @@ UCP is installed again. ## Options -| Option | Description | -| :-------------------- | :---------------------------------------------------------- | -| `--debug, D` | Enable debug mode | -| `--jsonlog` | Produce json formatted output for easier parsing | -| `--interactive, i` | Run in interactive mode and prompt for configuration values | -| `--pull` | Pull UCP images: `always`, when `missing`, or `never` | -| `--registry-username` | Username to use when pulling images | -| `--registry-password` | Password to use when pulling images | -| `--id` | The ID of the UCP instance to uninstall | -| `--purge-config` | Remove UCP configs during uninstallation | +| Option | Description | +|:------------------------------|:----------------------------------------------------------- | +| `--debug, D` | Enable debug mode | +| `--jsonlog` | Produce json formatted output for easier parsing | +| `--interactive, i` | Run in interactive mode and prompt for configuration values | +| `--id` *value* | The ID of the UCP instance to uninstall | +| `--pull` *value* | Pull UCP images: `always`, when `missing`, or `never` | +| `--purge-config` | Remove UCP configs during uninstallation | +| `--registry-password` *value* | Password to use when pulling images | +| `--registry-username` *value* | Username to use when pulling images | diff --git a/reference/ucp/3.1/cli/upgrade.md b/reference/ucp/3.1/cli/upgrade.md index de7d72ae24..23206666c5 100644 --- a/reference/ucp/3.1/cli/upgrade.md +++ b/reference/ucp/3.1/cli/upgrade.md @@ -29,19 +29,16 @@ healthy and that all nodes have been upgraded successfully. ## Options -| Option | Description | -|:----------------------|:------------------------------------------------------------------------------------------------------| -| `--debug, D` | Enable debug mode | -| `--jsonlog` | Produce json formatted output for easier parsing | -| `--interactive, i` | Run in interactive mode and prompt for configuration values | -| `--admin-username` | The UCP administrator username | -| `--admin-password` | The UCP administrator password | -| `--pull` | Pull UCP images: `always`, when `missing`, or `never` | -| `--registry-username` | Username to use when pulling images | -| `--registry-password` | Password to use when pulling images | -| `--id` | The ID of the UCP instance to upgrade | -| `--host-address` | Override the previously configured host address with this IP or network interface | -| `--force-minimums` | Force the install/upgrade even if the system does not meet the minimum requirements | -| `--pod-cidr` | Kubernetes cluster IP pool for the pods to allocated IP. The default IP pool is `192.168.0.0/16`. | -| `--nodeport-range` | Allowed port range for Kubernetes services of type `NodePort`. The default port range is `32768-35535`. | -| `--cloud-provider` | The cloud provider for the cluster | +| Option | Description | +|:------------------------------|:------------------------------------------------------------------------------------| +| `--debug, D` | Enable debug mode | +| `--jsonlog` | Produce json formatted output for easier parsing | +| `--interactive, i` | Run in interactive mode and prompt for configuration values | +| `--admin-password` *value* | The UCP administrator password | +| `--admin-username` *value* | The UCP administrator username | +| `--force-minimums` | Force the install/upgrade even if the system does not meet the minimum requirements | +| `--host-address` *value* | Override the previously configured host address with this IP or network interface | +| `--id` | The ID of the UCP instance to upgrade | +| `--pull` | Pull UCP images: `always`, when `missing`, or `never` | +| `--registry-password` *value* | Password to use when pulling images | +| `--registry-username` *value* | Username to use when pulling images | diff --git a/storage/storagedriver/zfs-driver.md b/storage/storagedriver/zfs-driver.md index 2f3faa159a..e4fb127ded 100644 --- a/storage/storagedriver/zfs-driver.md +++ b/storage/storagedriver/zfs-driver.md @@ -263,7 +263,7 @@ There are several factors that influence the performance of Docker using the filesystems like ZFS. ZFS mitigates this by using a small block size of 128k. The ZFS intent log (ZIL) and the coalescing of writes (delayed writes) also help to reduce fragmentation. You can monitor fragmentation using - `zfs status`. However, there is no way to defragment ZFS without reformatting + `zpool status`. However, there is no way to defragment ZFS without reformatting and restoring the filesystem. - **Use the native ZFS driver for Linux**: The ZFS FUSE implementation is not From 3907e53a039b9d5591867fd517d25d41ba9d5838 Mon Sep 17 00:00:00 2001 From: Maria Bermudez Date: Mon, 20 May 2019 19:42:51 -0700 Subject: [PATCH 2/4] Sync published with master (#8823) * Updated Windows Release that supports Kubernetes Changed from old outdated Edge release to reflect use of a stable release. Kubernetes page actually reflects this version as well (so its an error on this page only). * Interlock link fixes (#8798) * Remove outdated links/fix links * Next steps link fix * Next steps link fixes * Logging driver 920 (#8625) * Logging driver port from vnext-engine * Update json-file.md * Update json-file.md * Port changes from vnext-engine * Updates based on feedback * Added note back in * Added note back in * Added limitations per Anusha * New dual logging info * Added link to new topic Needs verification. * Changes per feedback. * Updates per feedback * Updates per feedback * Updated 20m * Added CE version * Added missing comma * Updates per feedback * Add raw tag Add TOC entry - subject to change * Add entry for local logging driver * Update config/containers/logging/configure.md Co-Authored-By: Sebastiaan van Stijn * Update config/containers/logging/configure.md Co-Authored-By: Sebastiaan van Stijn * Update config/containers/logging/configure.md Co-Authored-By: Sebastiaan van Stijn * Update config/containers/logging/configure.md Co-Authored-By: Sebastiaan van Stijn * Updates per feedback * Updates per feedback * Update zfs-driver.md (#8735) * Update zfs-driver.md * Add suggested correction * Removed HA Proxy Link * Added Azure Disk and Azure File Storage for UCP Workloads (#8774) * Added Azure Disk and Azure File I have added Azure Disk and Azure file documentation for use with UCP 3.0 or newer. * Added the Azure Disk Content * Added the Azure File Content * Updated the Toc to include Azure Disk and Azure File Signed-off-by: Olly Pomeroy * Responding to feedback, inc changing Azure File to Azure Files Following on from Steven and Deeps feedback this commit addresses those nits. Including changing `Operators` to `Platform Operators`, switching `Azure File` to `Azure Files` and many small formating changes. Signed-off-by: Olly Pomeroy * Minor style updates * Minor style updates * Final edits * Removed Ubuntu 14.04 warnings from Docker UCP install Page (#8804) We dropped support for Ubuntu 14.04 in Enterprise 2.1 / UCP 3.1, however the installation instructions still carry 14.04 warnings. Signed-off-by: Olly Pomeroy * Fix broken link (#8801) * ubuntu.md: remove old docker-ce-cli (#8665) I hit the following error when "upgrading" docker-ce 18.09 to docker-ee 17.06: > dpkg: error processing archive /var/cache/apt/archives/docker-ee_3%3a17.06.2~ee~19~3-0~ubuntu_amd64.deb (--unpack): trying to overwrite '/usr/share/fish/vendor_completions.d/docker.fish', which is also in package docker-ce-cli 5:18.09.4~2.1.rc1-0~ubuntu-xenial This commit adds `docker-ce-cli` to the list in "uninstall old packages" to fix this. * Updated UCP CLI Reference to 3.1.7 (#8805) -Updated all of the UCP 3.1.7 references. -Alphabeticalised each reference -Added very a value is expected or not after each variable. Signed-off-by: Olly Pomeroy * Fix numbering issue * Fix formatting * Added UCP Kubernetes Secure RBAC Defaults (#8810) * Added Kubernetes Secure RBAC Defaults * Style updates * Final edits From e678ad3f1b89c437176ede441579d070eea0c28c Mon Sep 17 00:00:00 2001 From: Maria Bermudez Date: Tue, 21 May 2019 19:26:44 -0700 Subject: [PATCH 3/4] Sync published with master (#8829) * Add deprecation notice for Hub discovery (#8828) * Hub Swarm discovery service deprecation Document the deprecation Add warning graphic Fix formatting --- ee/ucp/admin/configure/ucp-configuration-file.md | 1 + reference/ucp/3.1/cli/install.md | 3 ++- swarm/discovery.md | 5 +++++ 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/ee/ucp/admin/configure/ucp-configuration-file.md b/ee/ucp/admin/configure/ucp-configuration-file.md index 5e38256f03..61e97e5e21 100644 --- a/ee/ucp/admin/configure/ucp-configuration-file.md +++ b/ee/ucp/admin/configure/ucp-configuration-file.md @@ -197,6 +197,7 @@ components. Assigning these values overrides the settings in a container's | `calico_mtu` | no | Set the MTU (maximum transmission unit) size for the Calico plugin. | | `ipip_mtu` | no | Set the IPIP MTU size for the calico IPIP tunnel interface. | | `azure_ip_count` | no | Set the IP count for azure allocator to allocate IPs per Azure virtual machine. | +| `service-cluster-ip-range` | yes | Sets the subnet pool from which the IP for Services should be allocated. Default is `10.96.0.0/16`. | `nodeport_range` | yes | Set the port range that for Kubernetes services of type NodePort can be exposed in. Default is `32768-35535`. | | `custom_kube_api_server_flags` | no | Set the configuration options for the Kubernetes API server. (dev) | | `custom_kube_controller_manager_flags` | no | Set the configuration options for the Kubernetes controller manager. (dev) | diff --git a/reference/ucp/3.1/cli/install.md b/reference/ucp/3.1/cli/install.md index f0df1ba991..63437e26ce 100644 --- a/reference/ucp/3.1/cli/install.md +++ b/reference/ucp/3.1/cli/install.md @@ -83,4 +83,5 @@ If you are installing on Azure, see [Install UCP on Azure](/ee/ucp/admin/install | `--swarm-grpc-port` *value* | Port for communication between nodes (default: 2377) | | `--swarm-port` *value* | Port for the Docker Swarm manager. Used for backwards compatibility (default: 2376) | | `--unlock-key` *value* | The unlock key for this swarm-mode cluster, if one exists. [$UNLOCK_KEY] | -| `--unmanaged-cni` | Flag to indicate if cni provider is calico and managed by UCP (calico is the default CNI provider) | +| `--unmanaged-cni` | Flag to indicate if cni provider is calico and managed by UCP (calico is the default CNI provider) | | + diff --git a/swarm/discovery.md b/swarm/discovery.md index 54a03de80d..20e125c983 100644 --- a/swarm/discovery.md +++ b/swarm/discovery.md @@ -168,6 +168,11 @@ Or with node discovery: ## Docker Hub as a hosted discovery service +> ### Deprecation Notice +> +> The Docker Hub Hosted Discovery Service will be removed on June 19th, 2019. Please switch to one of the other discovery mechanisms. Several brownouts of the service will take place in the weeks leading up to the removal in order for users to find places where this is still used and give them time to prepare. +{:.info} + > **Warning**: > The Docker Hub Hosted Discovery Service **is not recommended** for production use. It's intended to be used for testing/development. See the discovery backends for production use. {:.warning} From 52e081c76747322d6e0b79e369531d9e531103cc Mon Sep 17 00:00:00 2001 From: Maria Bermudez Date: Wed, 22 May 2019 18:38:13 -0700 Subject: [PATCH 4/4] Sync published with master (#8839) * updated Layer 7 UI image to have correct http port, updated deployment steps to make it clear what can be done via the UI and the alternative manualy approach Signed-off-by: Steve Richards * Propose 3 as the number of manager nodes (#8827) * Propose 3 as the number of manager nodes Propose 3 managers as the default number of manager nodes. * Minor style updates * typeo in document and small update to image (#8837) * Fix typos (#8650) * remove extra 'but' on line 40 (#8626) --- .../scan-images-for-vulnerabilities.md | 2 +- ee/ucp/admin/configure/join-nodes/index.md | 7 ++-- ee/ucp/images/interlock-install-4.png | Bin 0 -> 83676 bytes ee/ucp/interlock/deploy/index.md | 32 +++++++++------ network/macvlan.md | 37 +++++++++--------- 5 files changed, 44 insertions(+), 34 deletions(-) create mode 100644 ee/ucp/images/interlock-install-4.png diff --git a/ee/dtr/user/manage-images/scan-images-for-vulnerabilities.md b/ee/dtr/user/manage-images/scan-images-for-vulnerabilities.md index 70fa9253f8..ce01f5ee39 100644 --- a/ee/dtr/user/manage-images/scan-images-for-vulnerabilities.md +++ b/ee/dtr/user/manage-images/scan-images-for-vulnerabilities.md @@ -37,7 +37,7 @@ Vulnerability Database that is installed on your DTR instance. When this database is updated, DTR reviews the indexed components for newly discovered vulnerabilities. -DTR scans both Linux and Windows images, but but by default Docker doesn't push +DTR scans both Linux and Windows images, but by default Docker doesn't push foreign image layers for Windows images so DTR won't be able to scan them. If you want DTR to scan your Windows images, [configure Docker to always push image layers](pull-and-push-images.md), and it will scan the non-foreign layers. diff --git a/ee/ucp/admin/configure/join-nodes/index.md b/ee/ucp/admin/configure/join-nodes/index.md index 3f305d7c6f..2379a20928 100644 --- a/ee/ucp/admin/configure/join-nodes/index.md +++ b/ee/ucp/admin/configure/join-nodes/index.md @@ -28,14 +28,15 @@ your cluster. For production-grade deployments, follow these rules of thumb: +* For high availability with minimal + network overhead, the recommended number of manager nodes is 3. The recommended maximum number of manager + nodes is 5. Adding too many manager nodes to the cluster can lead to performance degradation, + because changes to configurations must be replicated across all manager nodes. * When a manager node fails, the number of failures tolerated by your cluster decreases. Don't leave that node offline for too long. * You should distribute your manager nodes across different availability zones. This way your cluster can continue working even if an entire availability zone goes down. -* Adding many manager nodes to the cluster might lead to performance - degradation, as changes to configurations need to be replicated across all - manager nodes. The maximum advisable is seven manager nodes. ## Where to go next diff --git a/ee/ucp/images/interlock-install-4.png b/ee/ucp/images/interlock-install-4.png new file mode 100644 index 0000000000000000000000000000000000000000..0097bce3dac778ee60b9ba67e9d019b1b70323bd GIT binary patch literal 83676 zcmeEu^y2q7d5)ll1ax(7d$4gf;zW(px}^&M*$|2p5QG!^9wmO`lK z&12yQWPOWC#v^!UkBHvK;>uFTLd%lK{+vaFZHtX3K36T)7n^SrPX*T`-z=7v2S$`j z^((J%ZDuuPjikg^c4kcliLc$Q!%(@X*kgA5#9qgkuk$DzoVMncD@SHPc^lIGd$s8W%;sr^YBnb01JCV ziSWJ!>*3*{Y3t#kCEV{Ec6Aqk3PtH+vHZaj6AcOq2HrwN!%;&{me0rr$Yf}2^VWpP z6=)056BLwyD<9+%XyRx{<_fg3cHnarB>y>r4|4r@o0**K=MYCrL2?bbH)NtV_9kSU zOdL!sx4Z^q2Z%gf8m!p6+T z#t0d~=-_7UXz0pl?LhHslK;#jX5wIEZ(-|bVPj49IIrPb8z)CWa`ML){rBH5K22OL z{(h6S!(YpSERgx}2{S7b3-kX(=4fI1e<6E(@{8=}x_-S*;Bhj(Hx{lYR+?fKKoe^R z2x~$-tQ-PAU-Pdge>3_UrN-ZstSnqyzmxv<=r__wR`?X`EleO%dX$9_s{r%A?)^1h zfca5SzX|S_R({@vs6_}_fcd{F7D8qPQ$|2R0idMBL{wa%cNY*1u)h(s9x=xTzIi3# zexRF65d!Z??ko~Xp6UAphFls49f!_8d-{t%inwAFIax@EzoWSOL6ayMbTs#p&Uqtc zf;W=X<&a0h++12(+8xlpc1iwduF}Y+E)pF81r7I)A3qhc$QL-{e)MF%P%uya`J?6w zfNy#7$IT~Xk?-K1sN^Qgh=~7VrpJjN31I&x0=B&5hQ+X@HT6|2ASjwN_ zhuq|T?URff3k7IsBnAfR#lJb>b2#_cK}M0IG3&JWjU8JrB=kbbj2kCts zUd#$^FqtpF{)u@e3yX}e*ZQ+wCK`o|IIMy}X;&UBLaJbH6Y{@T6{!Qm0WBG5RnZ3j zM2WKPqb|Cnl%GJozu1GC)bA`uf*{MIJak|0i&3tGyQHyYuB7m7twA4dQ3c+Kz4}dn ze$^C!OmgTc`tX*PEoCiCm?yc!kQoE|pR>W?jSb@DBoc#2*avOqJc_R#-9kN_zV?MW^MbXrny;O~PhM9IFpEOtdm zzhCzWS(=?7=dT41Ryt}TwH#3+6)#Cr>bD`3KSdLw#YY>$;=KlUC;8~Eub0p(Wmf1g zx)xlTFs73Ah$f)+-L8fkZ-=f|e!n#Z+r;hStZy`)<+(M_<-UpcN1`8MukwN7=1(Vi zNfD_AcgucMo1#{Rb0+q;3|ejaJ~bVsgPGgoQOJd56JX|QB|nvDejAd7FQmIw3Q2v6 z8lPjr5Hi0c-A1nxnozP-#JN)IRk_yE_}bnWE%upTnfIC@p6L4gRk;022Sz03Ik`56 zsW5f7oxyuX(%mHbo!k5Pmot@NK4NZJ`HeDo{&}XZDBD`uIpfbhW0W6fo6_qyXpF0R zzJ~JSAphdD+03D&{5kY*VYQwyqCWtFK)IJ&#B}vOwZ^?!u+qtw@3B@6mBobX?e|M| znY5JJNPOrA<8eS#-`+O@lp6^L@&<|PL_YJzbl*tbZBkM#Q^UtK>q7=g9UX)0 zDp_r-jK_|vc?u*;Gu(7p)>WG|6yL{tFex%JU}6(rXh5m&s7mJe>J)knRxo%CawpSeFYK@j7X+)Rg7_t~{LqFH zt_mMV%N6B{ggIn=AGPVx+~&Ed?q6WEzl}zqkVWa=3Dlf)f{>c)(R_(ga$4j0+gyKL z<>LCeBGNm`BJb@R9+d6Lfvzy@s(=R#PBSH6bYD5%hSf#m$Gif2OdI&`7mFa%e97!< z81w|WL7wnLf0D{t5KO&mlM8@HL6}b9(i^TEc;JLE6q?&5WC?>7F~Cc;wEHZwSiPNU zbwVauv905!v~6LLl18F2%TAdNN|hT&`Mwb>KAmFE^G_J|Rt38}xR~ver%l&e*Xxy5 zI~Av1(Wz+)a0qAwwAbV>{@&@nz6WqC#D&9t?0bpW8whiYM|0dKU%ezs`|^W>K52h{ zR*A1IIMA9j2zlDPkdqo>qH7jCu==cWTWkHS05#R3D|h&MTPEhCl9*?RM!8$62$ybB z^g+S-<@5VZO-(z#6ypY0X{MB|j&FVH>&AyTMLJ|vjbr4sYpDHXS?Xo)hOm1)w_^v2 zZ^TYVYv|5bX>4~sZHrP&sP5<%tYh(_Df#-WRtR$OpG0fllr_qKntC8EBl5# zK!=l&fk_v)=biPO&omJeT3jDFH=f-`O$>_hICNfPu0=lE=+g$ej6j5g1bCZ^1RJ3XV>%j{pFc4ry} ztoxziN+*35DpRgDLX=GS_B2no6H02ILY$w2VIGDcWb4XN-(vcUpX2uUNRu9((7j{W zZM{`}F@D|Ozvq%i+GT{$UD=EFA?{;!u^#Nh|Aum<$d`W0UNAt ztForZN@)x2)TKe-)R6U%nzku-D~iKq)?pN0$gC9Qp`^uv6srK9uY0&jtP z(6~*OUL#A1icYP%FqTeVKRvbXjb5F&aes*ZJR{8c9jn}|SapN>qKi^)JW^Dx7a5_v z8}E;vb4`r`7PBw9ez)_~o#Wft;h&#pX3a`|jY=+xdxJ3gaP6 z{Nd4wIwj}K^{kD4&fz1-o*dwbj&XFaIBBroz~*NlL!?sML^9nIH75(RVFOb-Dpveg!(g|vHVszWcS4decT0Zo%i#)9NCR%Yh_t6Yhb!^sVf|;wXdvCbtVLA zC7ka$_3Z^%q!%-6!3pu08`~FUJ|^w=ca=5~&Cb2e${0@Ej4z${lbJ1%9XZZ!0q(Jy zRH7b3QIWpnqdOnHLATl-pQ8O-;%~`+{=KM^>1y5^dobQpvt8nCfoQmcER3e|awP zcc6#z8>c`&C?hpIBkUPL@sXLl!x)RXP7)z)<4iV)_HvL@aIdz4A8EA9D~3OaHKMtX z2C&};dTgMfyy5AA!*z5YHA=D!-T258UBx-;apGCq6Q*2jvYHgKEyc-#!7326FylGC zEoJ$B3Vk32b2}DEvU{R0nt?1lb|_BdJoRbJD&Bx^GJe~7G?GeSGPKZB(*fFi#h_aU zj&W4bm1elk@g69A)aL7Uhx&-XN9WP=yeg{3ZCm`AUYykJo3E6b-V)53U#fCcMuBGn zpeAlr`a37J%EYv)ke1Y0(3|&y9O9rPvTvh)16JxG#0?5@BBQJO$s4cra;GvuY_$&@ zGs7)O#z-h}hc|jLSr}dRKMt2XP#x$t`eI5q!0PMnR?+=Fqp>E|5AAs$8_$f{375A< z!3m9X_xil~(fbo^@77u(%#@CV80oTmgL~>c?cf)xj7J04xDsQpGXf%0zT|LH`%VUAE$ zB%5K#FKVL~gk@{TVrORr9hYTes=>ja++nhyjS9C_o@V{YHcUNG%I<=Y<}sC~6FOR58OK<(bJ;kjgnLkx$Mjduflpbc?kGU1ED_|NURJjO zlgZ@ds;^GlAsH9@d-Tw=)T9^L;o%5+9G@^vJIiQe7;>uVNNEw7b)pP?QWH3X9c9BQ z$A?j0nI~fg26yKRyGSMFn~>w=H<1kL@eq1xzp<#V(iBtk!BWu>5clRH1m{spoK{HKA32XPSVBNWiMw{J#n7|L=}XNd$AHa-=m+-Hi1p zE8S03N*0j?k?<&FW^6A;DN3*RQ$o+SwZEr6U0~;})$<;;{LY)y{M~Dw+&wM+Zy1~dF*##wWiRhyO& zSvE5%C6EzAt)Z$un4_GQ?gyh+?0}x|JF=CE?14zL<H6?sO>_ z-Sj0;zhyD#B?jS$jc8qj>Mz|NUzLunrAw2`EV{}&Cnj-Q(~**id^OdM_8Scf0G<=U7AuP8LQw z_uh{5;9P|WF1E>iWf8s06%2lo4!aZHh}ZIOrKy(dt4xL6M8v~-mMvX6Y!L1WQxlV&FGN4WZLqc}{@U;iD<$yAXqfio5A+A1+CFWxje z3Z(G5#-8okn5~8HX;La&(pgxWo)#tx=U9kGiOB0B$M{6(N3Gv5^?YSlr_=_##wuii zjYimrSEFL?*^%?Q)melScAQ5{J7?7z1#Wy21c1XjxRZz-H=^P8u$C%UQ<&4w77y(Z z-Cpa(Ug=7M8;U5`1ZtQnh-o-^I;I#tu0Q1r$h=OOWLZ?QnrmF2a?*C$54TXxo*Fx& z7;)SU`P(o6A7H8rL!zj+3Hy1H*h;)3cX_>}?**c?^UL_HwdDeXgF?6A$r}X2EsQa+ z%^N%tO;D7^2b@IotPlqpQG$=5M48%ltkG2#C1S{mm3I z^-~x(dw3*Wz-U`s_NTu&nW}=Ib{b{g>8T=0CANMV_Fs^o;YO1I73A=gF7o~n7JChf z`v0xK{dOeC#?Bl*+hthfKf{;9i;%@MFhzWV+)F*1><_{3wq*casXZCo32WWBv}S|w zGUi(*NKKyNW$$(6^l5r$euFzBU&G(F$w}up70mw4&0klMgK%5dQG-mh1^@7vkf#8x zM;s}>oW$vGvHyx|WNAn&uf_T5GlK`ihZ9)Or7>f=Y`yv!F$NcLeu3!WT5D8ks0*%-!d_s**&V33c;u3i(mv?d{_3>4drEDg7rNrll z>USC4&0}Rx-HkAW=ZvW*)RU2a1CM`Jx63cS%$;Itc(gj%XunLz7-u?PdJTi~pqYD3 zRX`Pl`dX)p%!ayKQ#jC!M=#M1| zz@Of$9XN1qdzCLfB-g))PG?F*i#Mdu2f=?N<)`0Ue$hYUU_9}Iv(jbBTN`lnRy^aPaHs1tviV z%${kdjWtw3`TGiv6^vA=WI<(PCVLx-S+98S64xBp8ZE8DUggh8ROT7Kp~p!wl5wSHA!{ez8#WIxijmI31LP?UIRlIOpM#T8G@ibAkt8>s+nNWM@$ z8icMc#S7!9O1}PwIg&+Q!=>IV!bK>K99(^^WPbZT{4za$Fz|cv48Rd$lELIJq`FG# z^6YW~cQK6?)qwo7z))fb@=kxF>BIJG+Yu1zh5Cuiq#&aGA`64V$ zow)d0dXG|moZ-?J`^B##$*n2u|KNqP1&|*|^2+So)o`s3q#6W@eV)|D?!^JLcSu#8 z6yb16Rw7nWMw}WK;qr=eL{ZS()tDhit$;46NsUM;G`_W>8?hS4kLH?Wb~vj zN-(%YuWGUxl~{-z{&+KHzTRPG?B47SA&JZDz30QK>`na*mTsr9XVu%Wd$DI6e8Uze?X}x5Qa{Z9y_-sw>5$RH6#!k|CJwPQo zO_Lz{5vCX4!tvthJ{fppnI_Y9uM{&H<6^od}KuTfZs`CB)M$Affx8F<9pTV`eSF2p{MwcEr_0A_pQ^^gx@8k0KWO) zT9{fae6^i%YE#uEHmK6^Hsp%ra5yWZ{l`0P?~u(I!hl^mux6kALAiyR)12deIj=I? zq9lzDJo*hN_`0kL@y(T$t=YdyzQC&Pw#;W9z#v=6=;5RcvSbkc*U~ki_nx9d0>4g3 zHxgDRkFn_)56|EaRw!pS{GkWP zNf88E>0~wR^^ANkZ{3N;kPs#cM=3(IISGdR#{~@@!NH|}tP9eH_lI%3lN7N+4f-R`fr9zfL;jy>;OLdm zQ$&C7mi;6L>_Yf^dtu1%Z~ihNIWTs|#+!d}fd1Iip7xp!`xgUrw2&klzJeF~U$b>E zL7q61g8s~{d;!SFkOu$%F6V#JPNWtbF0&qyk?Pwy+*Ns@SwLo+L?refUKo=7V+;d2 zN^2MCGrX@Ys_A$57Mx4{ap35)burccG|0$i_+&01eTL_8sN?=TuhJI?lG`9(Ymsgl z#ikn`U@!YGQ>+8Qr13db;taP2#z3-}ssYW6=mUr~DWw?wX-$z~aH+n5SS66w^YUMKP^j#6eitBX$zm9k)h0_7#Rj=NsFN|J`z98l! zM~onf(Nd+C-srcevRj`hRyP@FNm+mI>6Ysn^-78>3+gX1N(#dCUq`u@!E=iIbnTlk zvmtilxes{U}_eoC=a-Y&0bBP!J8lcVnmr@Iq$7)> zYF#pAP%Zgl<{bZ*bjgUH0#{T|_Fs&sVRNDm+F=<3PGW*n`R3 zGMr%pXZe8nK1tUPd1y~DLG+au8_BWVjmLkgYGegO6N6ZG+M4V=Zj>=a#dP?FSGk(ai+EQGhuIj-e28$D|l$|n|Fx(}Nd zs4NX|JywP81BTWM;9GjYIS4ZA_IV~3_W{RmF7DatrdBsP1$FeEKa>f+N03^4KBB*G zHA*&ml!nHCzF!;u@!eEpB~|#02{HRhk24y-<}Nt>raEJzr<+^o%lbP(#M3RxG_55D zd|5KF+9s|m_LPf}0>nAr;K_Q6fZ0*ta-VaC4;L^-BAtLNE1|qQ7KviLzuw{a(t#q+ zZh_E5Bg2}SmOOj2X4cWn4Wy0eX7+=7|HQ`4!wCP%3atkxww**2T>K&9wjN9+>DTBc zrfsTI=i1}`!M!=bYPMPCb>n?{iC#<3evaGhqDz6m%)KFDVgeGDQ}5gNDvbJ_)+e`$rEhs} z?0WPqjqeZo^4wOhN3;~pBi|+>d3qkT>!eH-jWNUsMGxeQcZQgy$0AX;E>j8y`_x+D zp)kGV-Yh8PO3e*0GiCpZE2m{97y((Bblp`(##M&*Bok+;96(e#?l{k+eKL*B^7{d% zl|OonL<^arq59r5uE#lPbpDx5bh0U6#6>v8`a-$==D>XvsEYwq1E^?R^Wa9~oVAN3wNrZNF{Zu!dxyD-Lb#l2*%lux|h8RHlg zRoXnv!(F7^*F06I zve>+{`@Bmb4b(>{$08EroHtB!myEm=sh_@o8lwB@S`?NbqPBhsfyA+1yknr*nUPMb z(04#jFndDOpw(wVCOdxBbCU4nCWX6(w5HJ`g|niM^`ml@5x=aD%ZI(rEc}|Y*DVRu zl4ty+6$?_13&>+_BFc&Q%x}Lnpn!t9ZSrM$zeS>h^|Y$eD>139uRV|Xj1*n_ioYW4&1UQB zBBb!$pY~z0qjt)0S#GLb%=(5RxCs$IWCP(>;PgK)j`Uh`6WMeb5dY=QDdl`w>7zHg z7JsE29rT&pE5gZs44m62_VR z>n0|ic_Fsn$BoTX?!&d-uZZSY3)>1V%K&(-q7qLJ^8XVfO2V5X&&{H#_= zV4?f&65=~Kb>M&e1b-r};RlnqC4CZGrqh>#SKo^h#42S>a(jNM+WLSC9+*aQk13bx z3gofh4cuytnO%9i;ZNo4_3oy^`@~thB{{ASTyQz>argzCJo_=nT?{Y5iLf@gNJb%X zhBIt>j{v~yz7m@jDw^Q*`HdVORdH=>ELoVDoBPW&T(vRogAc4{3}$8|N2%Eym!nij zsLhmD$7`5-e8&^o<-K>hH#5+jXYP=8!Ow&!9Oiln;PphQREzWCQX~E0PDXB146+nm zlpjBj$42hM-D}hgIy(#>kEr9edupf^ zf~r>mydO!ntW4>V;)e!&Q#7mUOdp1gc}T);h;uZD}RZ8=RU+EOMi z>v`IG`}Jr(ryr8do>#lx6;2hWalsi^m}g5qdtR#a{{cJ!(Qr&~`X3Vg$cvk16qF2m z8XdkMkpw0)^IpT#cF!;GfNOKz9Q%#`vOnl%b=7&ULpmn? zD^9{TUEvM#Eyv~z$S8myX+DELQTLMB|h;Q&&@~rcP8ZAx@%aBA4~JR>NTN;qrzID2MvvN51k1UXBoRb2=vLOPw1 ziZm*+2Wnjo^ypMS$L`M64k57rm?$=bC2=-lyUW~>VEd}{@;{ln5cHi={;F|5Yd``C ztC5~glf9}m4)a^YtH!)VIcKQhadpdgzj{J|QTWs{(sZiz{v_qkDn;ZwQ{@Q`n}aiQ zNperSA@j=s0KP!O3g8?U;rQ@Jf-l2mFM84-9|hF1tpACsNA|*(C01l|WS0Ad71B{s zb|5fimnoDD!O=&{#M}R?#w7a+GqTAcV~er-2Ri@w=jCf(K#&a)9sJLj`}>b48KmS# z48i_Siu@}CJl6Eh7-Vn06G}+`EGz%g!7obEC+LNT(B$HOR{p-eHjqZ_WoMMqFD?8= z)QSiJfjoUBG5((aud8K3NEz8|my7+&x_+ZP^n>z4CM8pX`%4XfzwZCJ<&ce?3*LAs zW9I$6#{XVPVIMw4LPAk^i@*EnuR7*8Azq64mXQh>=A!>wd_fTL>C^rjgMI>`0R$;L zr-S?55Pk~Y^995j@WNvMZ4E+?)`0aI`QO%{|7Z^#{#QHyzZjeGvG|MsZZ`|<<;x=@`}1Aio@lD@wVs%+ z=7K$T`w1Z)9*r`cdUDMw(>U3r(atH7QU_PpI(2WsU|(Nf^SM`|qU*=&efwwl?52&T zQ?^6tg2yZ26uGwF$&cHfGP{TJLJGty~;tnANzsMb4fN8eOMpho4srB?9P zhk(E@Rg2YPL;?^(Gcxp}d&knwF5H(}{p`1fMJyJsG3pPRZ?fZxa5o{P>=fVu^!Q;L z1QyN|7uTv+8vk`>#?Kg?$NRR>BZ{h@yyMauNFNHbnRfCM6q37w!18OnGH3G2BV&D z+;x%qRA(@#m5>$4r%4}Ss9vhIUS%)(>eX6;K5lpI zlDB05&f*W}wQdZ$H)Jib4C-p<2TKQxPj?_r%uj_5QUj^#;nM$Vi~xF{d>}Xr^E?^g zJ~!aCU$Z4W9WRQZJEolXYBko9WGJOw@wlF;G&xIF)&3wRClNss*F~~J3qi)E#^r>r zJeOOci!`g=JMK(!DzW4mLJrLibE@chIaMRMub=i*yrma|#qhd0uSkKUni*?q>;!P` zm*0ced>+7KAhD3`Iwai#H!shTuQgYY;n+Q3W-m#t6d6`wuj;~b#^gZo2A;d(qQKZ>CM5k zwbSh}uB8m0dkbxYt?L@gsadC4V6IHU;0D5h;Rr7DwcGJp&+&2qn)KcE*{7bcTG~0gd%c+?gCU!JCkuiPw^VG4aSSr6|5VNUVA9#%iW!s(yEu~fI_dv z6fP=nc!fC%kM?TE22dv7^`r}eOEiuW`qKsbno|Yvm{MyMJez=H0`9QI%tN{B>B2sP z^QleW>-iS@ZZ1e8r+;XDR530Y&K9DY^5TFL8}g70oRrfecW8Fy zRk`Kou^HqAB)ln5(!ugGIiaMVl>%KW?F`KHf7~`6>BYk_FHoB90mMrAe;CZ#4!1lJ|$pvfk!@UQ% z#3_7Wu)dQZB>bAc)CY@|inw-VyCCCyx^WVYcVoJx9{#C!MJW{opP`mZSzL+gGMOyV zbYNc;SG{mAi0ia0|A>Wx{4SYw)#Jt^v#-hH0<@Fx@=A_gy{x48@gN-FGj0ekWya@X zxpnlzkAOmaSF0tzfODr&0mcs&hipqkA0P8~zj3O}fSqlW0_rBiaaMZAOkto&X3?9h zSN463WhuFwmTGf^;}GX?KzFn9t!2hZCcaJ!l><0C{sARY;@x=R3rN67x3H@i6k5m- zUUCuzTTU@Sd|^1_Toqm84uVUg8~Hx+S(PNVC{Olsyu-H*?k`kz(kwDX1TCabL%v^>~L`!41k%3ta?&lBfr)Y(Si z&ryg`%cmBmeB17Q=F}etNR7k33r7XUy#YG|!BVhl zJ5vt~KKJ$g&S$pP$!T}l@mB-fV1MvNm-Ey zc8Q03$FIroN35SSYA+hW63o6@?u{$nFmI#w5EN|7y%+1jwf0NJ?hg3cx=tU0ocCtu?(g({?rM;B9Xb7cH9;DC zrizWOb}o3&o9ZVf;bw8xw-nXCNPwrz7X-$pD~$3KGMdwi-|9>jT+gD2q$P7&;u;B= z1#AE(ei&}%?A?#lmhWiDPZ6Rt3fwu`>~Pwz$#8wiy7@L4ME&kC+u*BzzLSKY$DVX7 zt)aGuSd*fQdYjSr8M7O(S;6o=!E7Ei3rjf48#e?)7}%=WYl}W~xtj}#majr~D}j6Y zSzJeQ*ZgPw>~~hJ1=_XyAe^A8as>9&3JQsJybAEU{P;^eJyhEK`>sRTI*R zHyedE;k1B~1kaiuhCHGa5aq()6kYvzQ)`UHWBmH-B$;?szT8^qIZ!;qd3UB(|6Zd) z2_~tTVP>B0IppL?hVP;d1TE}#L^5Z{k!blr;tIiQ%;eAwn(JrmIUl9~-x}Rcc98^* zB?%p1oy2gN?l z8q=tpmg5@?_@tRBm9o#zz2_|cQn)%V6v38b+ZAijH(p*4(x+P?p;gtjsr!!LAzCsu zQjhdW>o%S-C8x~ZXOflk6dK?OgTsdq93vg?Sff(!I)c+pr`zyhA(wj-k~^|)rgT-0 zUXGQ4*W>dCtw$CGVTne#UTc1@W*V7TgdrL{h?PJ4!R!3q2rt93WL*t{EcHfF_{@V{ zB6PFdPSzdZF-~1{11Jcdk55X>CU@d1ljl!TM#(sN(QAWrswcjMCw$qd=6~Y}`DPhL z}~!?9{U{CYDZBDGZ11CHGW01FZXn?6ES!o;)TIkq4IX zz^W(yG4{xr*#O=G%Sq6XRGCwm_uL@g;v+Dm|1|cc=BOj9>(V?~vqAXe5p*?w&?n6- zh2^s<)Rh7$o3_*S`RZ-CIH96RnjLqCGl+@JdR}*U4y8ANG{LnguLjoUb7zUOZx2Co z8O{7(!)a%X?zRp{(SaVGJD*pTwq$YLoB4RM5ni5pS~t}cF^<(=O*+XW+#7Z-X;`Fe zmFqQiB6y^d$y6hERIEUf(F*R**Vy`9XrT)478+`{PE%)V#Ky1`1oroFS3k&oaoWMX zkgL0|l|*bEhveMyU_Hc-<7*Zh)wEv-$sus@vAf(#3Z%-J*GyaGVQ>ta-%R&d^!D6L zb6Ja1*8}xsc=LT*fbZxjJ{Y_wPzkX)zD)}&1{atW!|LlB(b#7C7=3D)?82{B3*aC~ z99Qx1op>g(T7DWBJ8f38@8!7D`QjQXz-}DqdD5=ndb_tYpm}=fb!)gJlx{57kVc@J~mYiI%IUb^jI{fHul+jUuiZ(!vFgH zrM5k}89v&LqbQRj1pcLiYKYjg*xBHxUmQ4f}n{N>CD*cjwGnad5 zwX4Nc_{S~^0bH1Zy|q}HZwx}zqUYGezzBYU;T#AEIrB|4Vg$)%@XoiJ;&n?j>Sn-;-&il?+d$z5|~?boeq~p_*)B|k48@9tVWFnlFwp@V;#Wx%Dr0B?agvH*F2KfL^dHX?`2Wn5Rk7-LtDBjzETmqKScs@SbQflI1HCQV7 zgp`XVAN|zpEyuP&SxR}`8gLf`PX@kG?6aCVw)XH!+mp}C5er=jMLy+SKYT>ea$_Nf z%wnTAc#5PmWqVf6Wkg!CD6A6DhI%bxx}(2^_gqx@-~tCSEl$pfE4`+yuiQr7vVWYR z1IxoArGTts*f!{L^HEHPnSn`1BOOP_gLUfSh?~3ou5~vuDc<#yfG$g$7UuG17RkATgE<3C7)_aLhEGNmm*fkI5Lp)pH?!6110d{$BAx&T8>i{sN0;m}LS5t{h~OxaM7v`=qnxjUaTZT)7i z)a1^2^J6rxiumO?J}o<_;m48V8#$Cwo+3!`xlesc&~4YrWxm*0FK8xsfQ-`{KIj~k zczSanvwMlwU^7*=Fy9qcR8nY4Fg=_k#jy=Yg2bRG{{6ak(6bRIJ||O%PWv_Ry-st| z$dwUu$D!3yxSA%)#O}yh@{iE1RvbbCe-&T?|EzuT6D`GNpEV4%zm22BYIhu1+f~-kfE&dG=Skr z;6dpKa~}fx%9UtZgLEG#q9;`!HxyJoJYHxGb7U_z>C8G(2nHC&vALyrOBf$n=$s&&+?r&c6n3ueYVKb99r)CKYbjT zcI50au!iEWn9=t+Et}UU{mjA9wLg`UqAPrs7JBYbN-&YTq`Y9YOj)6T1@!xQus{F~ z1_ovqDv6}n%66r+mU?DJIQ49B8tb~=?Zota>19*s=n)mi_D9u;&t>@dr>~V$_B^Qf zlvd_Bcom`{y0NTs-C-w%99gqQaCgX;ir5x#12G7AcU0?XyPJmxUyiGWkJ-VcYGQNL zDdxPl1c)x=;|f0r3@rdfrYuG$X$P^R2iAWiTqb$u_B|HIo`2i37W@56yW zfZ!4=xNC3-?(XjH9^5Thg1fuBOK^e&cXxMphu?Dj-p{w*Ki?|q)TwOF&Th|4%hTP@ zD6cpuLoe_Vnxz$_R~tFNf|mM{u<0Y%AKoUgd!HXxKOKHzGc*L?D?*@sl!oj17THbH z!8go2vs5=_5(skGhl;d}TePIcKbjwztrIcHS?6yB*rnaCd~Oj+0tL--LbfR@gexkd zu@=ogn~Y;k6J1K3MrAM>{9tS%?eDg*uv#_))U>TY2k~)^_qIbWD*1PRpX(#FwR&%wUeW z2HzSJ$EL?}MRpgP)#@s}A-1_n^YG?}`QmZw-QYUr4Q(8&w{YxECzYB^s82x8_GkN9 zs|lJh%mhe!Z6zizowzqHhPymB@ghT)8;dUVhV%A!*U^2)+X)Oi!|`L*t<)EJUgWHU z$TX7dlH4cP(p;7U7t@B_M(eLd!V!=lPxUg!2&4JSX)I3P$@*J@-#OO4w3PSTp{2k; z15Vie?k$QdA*VsF%!1fYb;TMg<3X^U?M3xg^Oj*&V_2m<$shGOzAmoIFm40c2bV%B zzLejwgZT$!R+6o)46I8WT&EVSnwFmH&jBaf=*`r8o%+y88%=DZ!-1Kj)A%Qjc{w5L z<(V=~b5OCeW3pqI?;4PBaCI|d3n%5}0K)N9nCVCt)JIF+lLBBfP#l~l#`t3(w)*dv ziKBv+UV~GESLCs(Le2!JOr_D80+2@8Jj!1S`oeQcC~RpnS6WQ|?sG#z zaPkxwI#?JqRL7~lEX(W{b)(lhz0*u@JBFfa{@Z;Lp|`cIR3m};A4>~n_g!yKb=g1m zx7;-58BL|8=HHIJr>Cr;YH5%h;(cFQZ#PT_PRBAKe-lyg(0!$?vSUV@CF-;gsIrxBmGxUM5%8EB8p z-mK@27jIExNuoiR%h7A7T2E)Kt~pp9;4&;yY$;kY9%+5+s52~^SL^4wHX5_wz80Ru z$G^c%?=tCe7Xlbeyohs9Ht5dNwX#aE%Uz&Gq=q3S$6a##29aqtQ&X;H;k#6K5zWZu z-Hx_M-#5BUj+uk=R~WC6wsw<*gCgXvWJMIHAC7Z*gKY9kqHvWMqWCwU;T2VN&_Xkd z9R%g3d7N_G_|c$+P43JOvY@!}M4rAtDlxp8Fh!wUQ#-mH2Vc`XP?s`lggj^HN8RuHOa?TcYlfdQ)G256_s^$J|aVHbvn=Al2k;Z zJjQXOdvvwt{6O6?K-nhBaGjd&*;tRwAlRcgYDIcK%A+m;*ptq%8^np_`FWm;h%9Im zaoAL!fZqZrCLn+^JqnW5PKVr8L19xYXidp^s}zRAtYRxHAsM#<^IoaVk$U1vKYFrY zJ*h{djd96EUH)T%iB+S==Tg$7<;79BU##vS<`fMC{_p!Mo<|ZexR&j>*ZLC1+@vY7 z;R%af#@7;S4n#>VP>Ae|o&`8HRbIPd<)IRL{E15?|!S3 z?xJefNupb**kVI~WPaPC*bhDFY}~zf@%uisdXKq57XT8;x)v9S3ko z4YU4F4q6Pnxn58@H#S%8e^PZooi{+%cXBW=_diA2c|hVXr*J^f@V{AVkriO1@tdoy z!{3qUzca)l@~>AWx3a4KJ5Y`_Anm<}dt1l-%Bh1x+k6oK;0*@ zG813T|KBT;ujGaD@xlH7ZF~6tZ+d(r_8u-jvxBXZez_l1Wp#RP9!g;#3k2KhMQp=H zPB1^XP6c3YZxkA}u9lsZ7poXV{hoo=w-C8kPdELYH#HGJur792mAmBfn}hZD$|yqv zX^V&$Jw4bmV3h{TdJk|%C~75Nrae~M$md9g9?V3a(ZEK-U?8pR?%sZnjv|*Q>5FCP zjl;&l`E=BH6BV5=J&7^LnD?)di8hh(v#Si( zLC%M3aiBGo*f(7}$8PiOUvu)C*24rhk&VPGfA1iM=;Iq0F4B{KKdaCAaw$(DGb-~5 z3}T?_Lvh#23U?pxSLu8Y{efM;FXIeIheEM;D`_!+g|UxsnW@Pd)el9#E!pgg9oQbw zRkQQ+*ZeS)K52hGY3lOBjz#r!iLo!0(pWB7-|Js%7H0C5F(+V^W!?_F(Z~! z0o*In$FKY}Oc!E>>)lz3su$)n2$p9VKK==ECME?-G30hes;y?Bk0*6`kyXr=lX&Ah zPb4y#jLMkeWPnz!|+uNxk>yBny7N(We9i7FE zM^fWMFc?JYN>p1cQI~K4suVoDZM*A6Ldt(_Z6AU6qgRBHUk>By!0jc1P%YU+06Wuv z8z0y+Ppt>|yty|Sy6a&0HU0w0fyea^31#x*_h-lF>+R3id{!lLtFxfrIT+dO9BGZ3Fdpt5 zefBt_yZnJn>P4jO#XXVgboedPR((Urc6C(u&i&qr{;5aRG5MV=Ni(Cy{!AHh8;v&p z2n@#YvM?G~;$@>kv4U(3lPD1V89bCNIl5h_TSu;qT-iYo#U**9d!2o_VMU{o;aSFD zp%|aVbQA`x2u~8Kvwjt&PV#K@?n0@Do|7Rr*gEx>F|d8FrziNko{+tomki2w?V2yT zg<7>$i)PR2=q73uzt<#=$9v!Ol;0f=c0V=wJ5ZzCV3i`HuW~u0l4=-7#bF zp>6wIX8^UzbAklp<@&*PYhQ8iwzt!EsyQ%$rvusJejs$JXdaJOChV||n6C{@D<;6f zd|=~f9%vXzv=9%B&L8fD1^+a6KS`@y@$B?adVbNNZ8!<-OQe0gSl9h)jZoO24T>iL zgoJ2t^KjbQ`?1Ni8fI@sSS*3}vvQdxsUS33m0`+f7dgknWkT!L`zQ=(!hBe@T^q0a zb$N2-#+*gN{`3P`Pr8e4DPP8L#{+V~_a9>V%EK8PI7tbAg~W6D2F~epJ^KdcltX>F z++CElFA1A49_eis3?6d+h;c;s>N@Xd*BQM} zTFpc|G#U|)cjvB4!~Hd+74BPRcUId}g<82)HP#mucPHAqZb+CFw+?-{^oOx@=c67s zB2R2Axh>JzzkXAzbU^FZx5xn4J=IljQ`wACc(LSZSUTdPN)>p+ zu(|Pp+*N$td{KveGGr4b$xsq=q;devmvBy-yZ#S-@hss>%5Ra9YB(f^GvYq<$3+TV z?e`K~#1v%Sea)q&U>s4L2<;S2uD7b^4XPJvqk<)9^_wb^9h$Rf`yrV|JN?u!gPdyk zT;A5V{1(DuH7AqYD^vI`NmgCkL^%?E8Qr*NVALTy0FJR#NGpP0IIKT60zuQz2%CH( z%_XPI)aAFv=5@-7WsbXN{X1Nk27r^E*G1TO7P2Qg>Gu@19s;}^geS<$JWHf zanBU2gzqRE>-HWN@1PCV*-r+tShjE2()!xP(WEtVcQ!edhgUaV$` z+8!HcYiyyv;0nbvAv{MUVpHs+3%M>sz++c}IH#%>+4n__SMYL9l+wDiZil9S78Ogd zih}31}3XExMEwVmSmYB~2i}AI8`gU9<2ly6$*Zw~bMmX^E*hS3Z9v zL6r|RNeLs^av-RnCs?iZ9bXM)aG2BCs=oA(gOZ&b(Wa=$BCV+!oQ46%k7G24BS|#h zoEFDbY~M8)(VQv4Pvd*HU*T6+9bxtvK0i^ZRwtnvyNWn&4$*NrJtEtBsx({0hOW6v5^T5^Gp2da-VsFyq=eIxMzxw%vjG#p>#I; zQU~l`3iK{aD)?|=Mq!EQ=6`eka=2b|04GT@*(eC3W#~!M$)7$D4^F055+99^o;-rteW}&ev9gL;&~}(S6eS^+&l}J#bR?6G*%-sZb^nS)JLX zLoj>|hWpAZU9Q(`-sQ_=H;gZizfc)}SUkf{p=za3L!^9V@-C*arpB_@v{*=`PjQ0f zFuoqa+K_b9070M@ZhG|ZmciZmyu7@@R#)#~RU)f-xkUtvY62bn341{pTJE#UJFW%c z`C3y;ZY~Qo&Bd{EkU8V8sJUWsU#h-M6Z600E?+*DkVR$eWi(!g=wQ+k{J?W5o|$2J5BMY)0>Td48YtLPbGmB`@EBV;wr_K{Vm%5&5)F(`T%YoRP84k zh9^IuZs&^!knIdY?gL(dCMU(T#;+e|IMsBt!mHNt-+_oGihG_G0eC$YLnO<7sX_S@h zgUlq=;*BBTYT@>u#&>NT$DGY8B$ zyNQErhnbuOHm4Kv70;LK781jvWio6WFFC1XRIj8-L-mGqhZ|o#&WT0DC~^Z?)Xt9 zd>4$>9zo2qHj^6rQdCZ&Z?Cg-fwQNeKqIpmw&2p;^V=Yc_Hn({3i--#3N`!9p#wL@ zqv!QV)x_n3mQI~HC#U=!P^W>muX^DXDXCtcNK=fK({PtntX*9=5N0b!w;4hY-U+PoOoZZ$m35&QR z@@44J?0gk3fFXaz89<|nK;(z$o;?>B5r50@l;%k>ZAFvz@_kO{xv6^U7LD#L%|Y9Z zT70ptvfovJ7aUuvHXgY5x*i7Q3NnY@fIvdx`}!{b zM-y7U2vB2pe0(gE@uSHtk^uaDjfp8ad{C_1;!^1k|2I&l$4;FvP034;su@HpE^P+J zWkZWE7A_4dDRyOHP2F^h`8&nbf)F8Cq%9Ee!ja5=x;$Mb8u@wdZM(uxZ)dhnCgbv= zjXcXAGIbj#$*+b9PO*F>aT)l|w+BB_ZV$z@@(b@RaoYReEAkskDtnP1aMMP5BRBb@ z2VhH4#8c|0oJWI+;9(&-Uk@r%`;}^5uL$PQj%qZz3(k{SzeB6lABBzGJzF?V&6Nr@ zYh-iiM;Wh?efxBR8>NS;sHN*%4ev{;CRs~}+>C_BoFf@628Y9y6)qdz)wwa{IAYWC z*6})_;90X+rL^u+2H!j`;NV0~@6da>#eT)vX5%$DH4H@34lZtH$7iA%r&PXGJ7Ts~ z_LumvCldtGpACDn)FSVun$w|!;Q4062Yi2J@i*}4iU&FB=e*y3`)cUN_1+9kRfws%0arkt!TYtHpL4C<{pFMS0(SB$udsY$EVO#m**zpp698eTFL++%e z{UnUz=SSyzuUgw}g?~#2-N;=vBDscT**%`#~Y33=VSUnP&ahRGbi|)Nn)8`?Tr=Lm==XK zTLcgt6@wYmMGfe;AKE?@cL!*&RwZuWRpuy4K{IK|C>7~_c)EV>@E1RC5OWU^WB@}L zIBm(eFW0K)Rdd+Q@<$vrefqVM8!<2Y_Bs^F85)%)H#z`^%Taq^ zBg}Zd9BxQP(*;+tQ3~@9KZSOe1m+rwV_Pg@_FdFo;NRg!b2y4 z9ob=k&*S^;1rK&;OGcq#=*7-fO?63WP&)(&h*{hD@zpJmNYFL%-n%!!g@7Z<-R^gN>(KY4yv`zD;)vznwa8en6!|}vI1Z@f@nIfJ z!-#NvZ;i8S%0FkgVG z;(c`f=_trWOk1i%Ua6=)!0{pOgL>T&qaCek+(iPIh&QmbCWv&NUV78Fv7Bdqmm~0b zB7!Fv6yu5(&S*N`A9l15!y^L}5SD$?MI^^NCJ^qvgGK`mmw>ia+UlU=WB=MHX)$tG z*yW$UKg7P=N;m?F#I5!zsj?lH*(~MyT|4NHg?f)GIKtjk9aHj2D>RHLDZ!_A@DmNt zIGnCTfnit<2|aK0QxzH*KattIxe0y)XpyRBq&mT#W`{l~K7r0D3e+oXCG=c`0hq0sdN zL#-+LGkqa0KX0{`A!KzWhJ6acLiBH=GFRFeNETN5q?*w=NaYW~*q-d@2ZyJSp`Pz3 zSM7=1GAe`SkBO2yX?fRCG# zC*4mKhcWul9~;@XA+$Fdos&)+DXK3dQW_w66_MZ+I8D8EK2?0*h`@z8Q=Z*v(~b%y z7`g-S_mO2CKW@iwJ=R$*lsUaiq%~|T>n@}D@oRcz`W?pbdS=~NnOfmji40=R2?PEf~BiA+RMBI(v68+Z& zx=s^#c<&1ID8YG5)N2t;R)=k@)RNC`byRhdmo6&hmQJHiR51HmUpFumRx+$02u4a5 z>boZfF&^R>tq^oH0letq;sTl5%d2`(mc9C?+vm@2&sjg3nncHmzOQudVnzL1 zWO&Vp88V2=X=FRdW}pClL}VT3eeWar29e>pLFVxbK3lUKsNe+L(&l_tmv7*%u68b zsC7AW#O{==O`+UA*WN@9YI=Ta)mr$A zYN&&zi`nXYcsfU`<8zl=x@2Q#6q?Y(Ya z_PnYsopk`je>Tfn0I*HIT#$9X2s~=H#68X640IYlN707`=A2zaUgU&!KhETesZqy- z`lOSeWr%eeov-_+qmmA5H&gXqoNgQzA}tNbyD?4zyd`10VZVc}iaR+IU{e&(tn8jAHeb~@Zj}6 z?p16LCY>`~Wt{Gxx{Z(HNoke?xDWKn1pyh?&VrvTJ ziw*?jzIL*jjy2>zx*gQ%$fj$$U}!YEE4ry=;B>r2Jv|laO(%`F-<^^!qbUCxdtof9 zaq`*rU>Lh_p{m6~UJI)?5JdJ3^o{XI+Q1ERj|vn{+>NeVNHcQ%$#QHT;k)EC_&Q4q zezjGM%EKL|uPIn6ryHJV)Y`d%L5NSSv7jz?2lz^*4~itik6OdpjU}9PVL066bXmgj zBUDkkT%L~tWlPQEq5G4gX=K$TAu;=*>V3DFPsGY~C9YT%Kb-f17|YbqO~sQm=k*+w5!>&1VL*aa8s>COsnL4nX9`_;9t zI`~w|6G@seMtWJVjM*{sDbXsQ9xl{oqXNHd^7+vq6nSawM^F)h&5(DU$HSS%>6eD3 zN-vInNd_ZG_-{jWD*)KGTLByef!3jX8m<1eaP3*aFOPBIOXm?NdUUu7ok)8-(z*Y3r{qe!X=%xc{?MV zATn&BO5`#=0$N+C{083dL?|SZo;bJ<4g6xkJZk`9-1hMjgI7gNY3u52X4#`kcjCoh zdp45I4?HwN9Q4|7tmA&-*58~*=2pT#5IqeU)?9h!f@z+|+b3S|@rR8A;x91-nlzx) z=hW|fktYhUR!E6nAvsU)MWQ}uUYGH-2I+dZscEk4 zj!6H@J;3uh1>6zATerM5TOsG_V+&{sZvVCyanq?Q^#-RG9|E!hgl)V zD@R;t7jzCvtyb4UB;D4CvFLp9fEv>rg|nk@sp2A{q-j2JdubY8vR|3m zJ#YC4VbGwLCZ1^^Kl1lTj>lpru|V0bg+-wH#VC+n#I_1MGw}eb?FB@>;D_r*K$7w~ zj~2#h#%Tzuc-p_hmfUjezv~&Hi+Mv{ z*29IKoqpT@Qg)i*oe;@rqsLi}B39v(|E@0BpSL}M$unokAhQv~EAk)S7T}rsu>;nu zV~G&f3;EpME^_)Vx;McxzLX?z5e3$+I49!7M94EpWA3djg$kVA*1bcEes^=<#-KkZ zA9=(ny>ys`kvvtEuDBxEFJ59csuV6+n(0bsZl|-T;e%C-A$|_xFY6AQk7y;<>QoMQM#x!~o1!n@3g4VZ;VM68q0ZC}E`I3UiBPrF59*4TO+x<8WWCZr z`LfU|zpqeQ!U?uos^cewzQKCmYbJlls%V%klA9>_splM>YD$(+)(oWtlIax>klAiJZOd{EUt^6KD+D3{~+1 zz8}Gi&f?J^brQLO;41^<8|Ctqh<@$(y7%yX(S+@G1~u6B37)f{V*PLfD0rR-B@eTopfd78Dtm3%7cnT8^a^KTUbc&#PbdfK>`=$j(2x~_pRfG^iwX%0c1E<`y!mBU zk8q$bUQ7o9^I`3Sis3BghfE3_+3fuY1h*TXQX$>bFJBByd>669R9N=|&qb@Z`}0Z{ z49^Dp#4gY1lb@^BSnfQ>aBGECzjFP<%#E)piUUR?bV?Z_*oOmtp=fQSDw~ zZ#XHQ?ZW+7F17LBltVTzIT@fSJiq&f@?jt*3QLuN-HfCc{7jqKnL;2oqvgX_B(jhO z|D4dV>2u@;^3^Tb()Af70`LyG?cxd)q9c2o?-q0ZJ^yv=5?(!&$1ki*JILPg-F_G= z(7?`B9|A0nXiuDEDIZme*VHK|fxx#eDCFIWNNS2e;r$qLg9YuTt7F{Ng)$eybJ!Ja zkm0a@8SWBD+RM)O5Yk+VpeKZvoruA0&vT@+*o6E^lTn&3a(J@D)D~cXr%&#-a!7Li z*bN=~(xFbDCteI5QV}}1j2rxhpPLKSMJxXAyK;E|8jkD9xEF&A6j!bQ?+XwzuD(VS zX^857gyz4g#97kzcIyWX6|sL$`S0=PDdMZagdBAd{kQ%2!>m345#8)ghur^l(I=b- zhAImJ=I~T zQjTs*Qabms;(VUs0nnS-xvHh&7zk99n_*&Qhx!qU!?p#{NjOGVkD_Yg7w| z#{z}^Tq6h^0EqIFK@a+mnTNaq!;?};dKrk1%ZCeJT3p1M&Loh_5%JkizrF3v*<;A% zy_iOdI(W1`U@lZ``+j(9?vzoKL zEck-oS=+0_TxI8-f&x&~(erbD2|I;%mR*JDA@c>_Ebg^PTfhht{A(qk0t-^5eHH)D zSyBLv`^s;ChGwJ49S}>Su4a|OO}-O`6Jc*UA);Yz&FZ2P{;62Kx)Ek?MH$z6rH0pu zT(Rnh2B)1wyx~C99J)}*xd(f_$hm=NZNC2qGH&(qwa&)=2iFh~57+%72IG-E>2Du{ zJvGWWxmFv-syvMEj9);iA9D7pYvLg|Fq3Nc@V1JlV^W)5;&43f512LGu3~{T)<;gP z@|t{WygVdCpwa;n%CV|;XuV?_q?ZlZ+JTd^aW156byoP)m@Kr(D=l8y99cq4Bav-? z!NtG}|3rpN^wK}wr~vP&>&EULa&3>pz4Bk zOG7ciWwkYE(n77%Ut2^FABDKSuYHaH>EBp;01vLwk!y2=RV@$*W;*bSb)bwFJx-b1 z`W2c??=^A@7@S9UA{a0Ct%|_ zS};18%#^LrwvbzVq}I5P20A;n-IUNBPK$VOG5>sEo>O4Dz(&4N|FQG&7Liq&bhB4` z##dR_Bpy62Pzz^ja`9r`z61F=Ffg%3%w~U(3y$n(&~9rmK;U$;6g_p|IYrRD4O>j? z+5AH+rI$R_)t$0f0p}Z#s)7RhppuL#nXBG&y?%V0C-~jmj1&$M>+Stz)F1}KE_3fs zknoU6a{1nG_-}JumxSo8#ubi;vp)Krqaj&5w>YI=?vMY>j6m$ipZgO=BftWdJ>qes zUB@3Q4k3YOA#Nx~Fk0yRJh$!kmSgHGC|9aw{mEh^O)wg=U$g>+w$k_a*8CC{34j%~xx{7>Lk(HGXxV`XZ*Xtu1*r_nWo+&BZ6SMAM zl&H2?84zhGabIU2Tyg%7&T1Kdfc-#RjOYA{Ss8bs{yAO8Pyo`WK7{z4DqG;Yo}y98 zX9|}6wJn{I=8Y~W8v@D8`YU%Hj3|4!!-dyOLSc6h>jhd+e11OFqi5dcKr)1+L@-w0 z{r4?7_dmG+Mz9WLzBYe+0Mzg10A#R>v$M#Q*aw648dW7d@N@aq9@=jx$oV7F-QfPDK@P zPg?gImdCC9fyA2olSb|jZVdi`X(a?f;@khu`D8KJ_X2q=-`_$Q`)Jb%z^nSF@^L6Dd7eE`AXd1|_Xe7yEPTi^JJ>_0MIt{Vvyvkm^GXNNt{EEt{tl2L?QF>kU|{X!!Wy76*3Xo% z^Y)W(Tx+beQRl(CclPA(fN00Y4tlm9E_V1b$2k{u_z2MG*6g+MBX(O~*xacGdqxtd z2RyY1_Y|k^eOem#{G3@PHIz$KNxvg?IqfsiP}01wz#J_u?)v^gJRDooCA-=6ieBM( zNvefB_~-GG7v2Mm`D`g~>DKGYhS5H0P7{Ey*X~GQ5#m^{cj3!y z_NPtRqI(=Z946W(UnA4d&`fOL$q*{)Sbs8cQXB$D?Y=s4588auh@X4rbM$l~Hsc|K z44zBo?gvOyaeAK~7Q2JhL@Gnr8evDeRPU7=Bte1Fh64?0tWsnl_MokgJ(t4OBZ-tOx8 zVNRM&s|BLD%VrjBQYvaa=WBd@#f@`|XT~g(91clb#NuKFxl1Q^dh56?9*M}+T7zN= zG&Cuu%uB#wH`v;&mI-`?!e<&jaJ}rCldIH4VaeEx)YUo6Xg8YtnnlbL(Or1A^J96J zd?L4ZW~Ja@Dgrc@vUfTa#6vdx)^f4a`elJ4^#O)<=lp1OO|6C}c?(Dd@CHHrqR=W# zGJ2C~I9}3lueHVry5M#iQP$b~z7XcgL9J#=UtgmuDA2Dk`%b&bMqWrNi9+Y=moUC9 zih*O61r)257U6mO6U${>XIub>8v%|?3b^#!O$LSMI4*{a8~*_TypbVCvpb*=SiACtSC^k2TtU?H=UI4N zk!FVvm!AU9PtWuh^my0Bi0m)q@9@+(nWFW*8 z3AjAQHxxsiNy8h7eKTgfD^jT3QdDEL$TLiF;^)~ZY+erOoM|u;C0f7q!zCEz;aL6q zNA|j5S(}R$udN~^1Od&R6?Uf_#ThMt`hKc-x7#Zmgg*yBn8q7L-(o8vW64X5k3Ej0 zwc+i=$S|7T>U{sekcaBo=*}WD{VA<{JC?7%sDWpb_L#k<#UCiYHgZq|!m-96&7aOUd&}IM%ooJ`r8uGy&3wW%uq%{lv_-GP zwsPf*jqb6UoZHn6qR$0<$i8Bs`=4)3EfauWY)>z|&B9s_(G3hwMetK&EL0Z{ly~m= zUK;JP-0Yyf-W_VrXh(+XQOYP_Pl5j{?>WAotF6+p4ka#rk^ipkP=~&u=F*V?S1wb+=&!|;`o6YmHkIT{4Z}O z1%NjFFH~%Eq`!IByFP?RfH$kMpyr>rKUh0P^SqdhapdR^7}47=3IOmz_;`($W$Md1 zL+lgwc6swB9nWXad*rs&xi`f#MJ-+7Xcf*qj)fJ3J<>_g`kSdDsr2AMN0?wfKu*cw zmkZ>(x;x4csr-@D2?EJ|6!H*)r8*Ix$NmSM;@f+!i3S`Q)vR9iNU$AIB$65=-qpP~ zz9M=F;+ws{GOvYru(uO{gE4ufLfCJPMNx_CRKyXC;=SKO=Lv$}m4xsxlWn z1Q>&-0a9z?9&r7_7x(Pf&)+Rl_uX|9fm{tZFoDxWESMg|&?<`G@RSASCY{ek{eSf+ zAQ3wk+Zt&f!-kknb5pW@@b&`TcP;276VncL0qVD5~P6ysTkaS zIs^kW)DQ(v))0tpgT%JP2CkR92C}v&b8S+S99t;pbHuYb;Xi3L=(!^D(9Tw$c%!nU zG(>|NghI!ci$t^4=GZJHo!?KHA35l;hey!XroI4`o0lBh5?G}i1fX@AwL`e)`wrd_ z-q>=77ztYn4SaRS^QE>j9Lz2{JK>gIPt>Xmg*&=EO`XdsRR2j+e1QYPjN!FjSuQ$I zSq;rt2!0yV(L7&;k_8dAdaE)!Ogxm$$+-))E}jly^7YHaJ}me z;%(;GS!(^&T^qT^F0`**p^$60@<&~fbe3u@tKER&fHC)4$PomgDK`OK!&3~}9RHzd zyf>FwDkbM4ZK>ZVNu8$7T$CSeI=>v4eL?endj(9W&nDHkyh1Bpg<2289T@hKCS@2kMcR z_I*uKpOH%IM@C3GojPXi0TF+UvN(|PPULVaTh28+T=j&zFh+m66a5pP_#M4k)d1Z8 zl!54M4?ZyZTxm*k)R74s_>KILx<w@hM;k&Vvp19JJb`Mk+_u!heu zXY`Ky5-n4CV~F@jmdQ-x`9KPBa^b-*@C}j;A0)5dAl!|N$(Eg0<8gv=GOBVtL zmu}VaUZ;sStFjUfM!+02c4Z4Ze0Txq&vx6hlPwI%^{%koz&Wqo3awK@r=GEBQt-6* zK<0dW!4;D|1gr<;?VJ{xA-N)ff^#Td%{%ViF`rZ=lA%Yf5k$-JT&Y5*P468Ti~9t` zdGQWgE1Q;$-mJaooWS=OJ}O|o%6*HX`VJj3nyag5X)M3jNBxybY;OP~C}e53*7j#} zvIr9bO@{&T`=A3Yri`YXDl#rhAg0fEisY@EX;n_Wyv{AZ{6VElKhnxvgyK%@C=4XC zv#JfwTINMiZ|vy!*l2-TVFw)-hX5V=qKXCQTt=rJeh~r;#u&3%oMO_H?8;0b@*Pug zGLS3DQO&oCVpnI5EzZhR#le!V&Kv?!(KA<}AqHigkK6+A5x8{!tuG)ezVV>Eedi4- zb!&8gf(gHajO`D^tBbLH4=u`JQlKZH-fK*V5N?&fZHdSMP1ORuJni=c+2p|kY2##9k9qj3?WMl~Ivz}yA`TTxexNR{ zN2l;I3lEl+pHFXi6F2Ih@-Im7_u+YT09X)m(2p1hIHmC3jC_Y;*y&wQSAy!Ge6^|< z1{#2Cx3j0xVq#TrZvA;J?lahbo}cs;H6=Zba1JIqB}e{T=qSi)b6>*Yd9DJDf-#;a z3nehY1~YLRv(xYPpDG(jc0g7y;luRTZr%_*Bvh$CbR{?B;uBh*yU_HW5$i*Kv{PQ)Y`b-C|SNoy>lWt9hjyf)b zkpu?2V+py@A#i|006ebMRGW62XB306l%|ooc7Y839zb^pFz9y|!At)wymq|yBT-nS z$3IG*d>}=1hErJ259b(6=c;m1;en^a2dMwz05sK{4m6AZD;QJ`!0p+;u^tQb{tC$h zq?z&U$l2yIWpb5z;CJT(<@R^wZB`M${~5>;jqd8{5yoV;AhTSk8@oC!+Fhs*S147R zvcLt2wCn$CK7JzTgazrmsZ9CtM6c|%o1O7*j+dgd zg~P?J_NThLy9Mh_M>ATnSZxJxxIL+8v|CZQ+t8v21jUdMe*vP&En^3$V~HdZc!JPq zG7k{teyb<^y^yYgs2%G=9HaA}HG7C5JiuWQU@n9K zFc?L~$7^f&)kZ_(I4ESNr{5^b%B){Byp6#J$%^Ik!z|{i1cAdPat78SWwV7OJwmjh zkVzQBZFDZ{DK?@0-hC!vG@}M3Gzjt5Wp{tO07m@)n%;STHAEGB=NdPrPaM51Mb}k)L&R9ka7-aUr;8> z-0QCUYlL(T5N>X6)kgb5skB5EYc0-naA;H!fWAioC#W;(vyGl+08vr^eo7|-uGMmL z;kjf>v_StGtq|#-` zCRy6+U7|IC{<)uR0EQOP_)n>d%h1&f@PBU)9-u((XF13pk`#~u1?ob^2s#0-noWS< z*Oh$?;0->Ii5N^|2#$}BS13FWm5PI^T%WHsXQKibwmTZ(`WW#=03NQu>#Fv%5rE0G zQ*bpDWQ@S^P=(&>*D+_? z=Z*CJ^bH(zA+XQp@c{*;0|AzZ@kpFxGV|U&60w*_u~O;akp!S*@Ck)NCclDXws(Tw zQ2?7Ldts%)PWT-xW)3H%%xIRN9l3m73646;D$U=*tpGCT9q%Be|47^55g_p#LlL#x zJ2}-;5^%WvKla`-tg5Yz8W!Aihkz0S(j6)tf^>H`h_ryx9n#$(UD6=k4GIWKcXxNk zJ2}ts9M5^4>w2&6*Z1fBx0Gw|z2;nV&3WJB9%J06k_Mi*zC1|9M71=fOK@Gef0GaR zW$z(xA-@lQt%2V!o<={gRdkV^ZovC{UH-L4hyV3i46g^8$$NYbR3*c?<=a4XF!))^ znB&9gr}B@;C+xWcDRI3jCBAh!qFmf3Cow!%X#Oizz9c(W3_GP5>KEhVqnC|N8S*E*b@xl`kgWIPF4LesO~osEJ+dzui} z25sN+xoj{)0xg#=gPCa6fO=K4&PEB~8uV~sO?N^JkT}wn0@0H$`eT`Zo)^p4of4}q z-druNg6#RK)n(@wS8!v~mW?HW1I?CYLeHM?I9;nsH;FL!jGZM^Y)(qxFzD!=r3h%e zz2bRw_uYLrd^OqmZ5czwQW?)bCbR(!1ctM4N}(6u&|9EgzLzv_Txm5q?Qqd=mcd)j z6_hy9y0(3?H;hBON*%qp27EUCIh3Qe<-qM4Cw;TB*i#b(t*B5?!Mkg7Ln9u6s0D9r<&uD)zXhd($?Q$#{ zn#}!Z(JdC`zy-f@hhUv+5xFULtc=^v-acw~M_rM3K~_>3cEpe>TY4DA-mg4&iEn#{ee%6>XXau*?Jv)2S+s=i82A0 ztDoTM<3$S4{JJJFcY6|T{{FVYR|S- z>6MRWOHIn(@3OX-zCvzImkg=1IqXxrudqZHYm1zjjFu%WQ>!WC+*HV?wm*DewfD36 zGol8SVsYd#5lb5l0VHVBh_58V%ZLWC?J;6pL7@=b5(V+6=w`5rYNg65Qw1%= z*rKdP%2K8-{VD(manc!dUHe{M!ar*H1RM6)Y8I)h-OKhkdgD@?NqUyC_uF07-f$eJ z!*P7Y)`ZBM$WKJ2Ea{*sn+tV*x1gQ+vvqW|V@3caHg!c{QC5ETc5IbsExqvz6)g)K zId*jeu%}DGAsc@%lX(=TZ;Qdqp1Ww1{L0BEr08Pe8e!R0j1jHknHp+F5?HEqm{}Ad z#AT$2YWNP%56u>lG%LMgL9ibxnP5D7n0nVtq8El7fHlAMDnUZyyMWbeU_xj1F)a05 zlIF6*?_OU$?M;U`5+~YkGUy_mu9&e!ANBOMGjXqppFG*x!`|Ev zHl|lC?40&00yR4^POAqi+okNjUNpG z+J!jR++lxY)UT~a4CdYOs;VzNg(FI)F&ZoJ=vPTsArFm7K ze%~64SrZRmXVb5Ezd56$+?PadqL6*xRn!c_c-($Ye0sc$9H5e5cXB-dZ@x;2_7*d- zJTWEgZk}Gzrjzxodxz>p&MVf5()a1a!B8ByReQG@x3lj26ev&W%JjRUg=p>s)_8A> zR<0)^xi^fR=z4YLhl?EzCMIjL-|ukA7Hc*acZMa#(5k+)b!ZUzel+V1C!gM@(t|`+ z*LSH`X09-cr_>WS;!2mAyF%Pm-hCnwN0ozfJhc)K78Z;@t-}_S-+_e(iC)0Ui9dS9 z8xY!fm2mV*8=lD@i#ApgpGWhD)pAFkx-QFV@E&Pb9>C!M4f+-0XX6AKN0t*Q=c1AT zr)iO${5jDHMv3*kA3QM+sx+EkMbe33x;}M4Oj1gT`B+&X(O;;xoY6z#wWl%7Zk=V6 z>4e%$iSA}OQ=8e{QsT(RFf_;LVjQ$QK-E!BGOLQIA;bWRLIbDe7tI(7P!DHu0M2UxcU|N+Pj6Ml!yx?Pq zv)oY^E3%^5aCuZo%2F$i)>-)`K<7h&5_6dKk0J|Na^+yTSi;lI8@aV1ga+dbbjBmy6r;CbiYV0bQl#-vr7Dk}=K0c>b zSnq6La5+LEASN(W)MU+-$=xDZZ`sP0pO8;XHFBOZSeg**>xrfI)>I*(;`n03T$|Cj z3gs)>?l{qA&TmbpA`zV%)3t%TpG{sZ3Y=JUx;YRf@Ml&-#8c zIXDs%7|WJe<`{ol_ndn?5-IlG-tSOxqS31Po@%^%*74T74~xKEwN3!ZOloUnbmV-t zOa6j(o=~A#SV=5~w3b0+eE^WyzrQ1%7Rlv(Sn(E0F7U6&@{a^}PaNdu^^pe6GKmjx zN(<)5e){;eB^<4-^e4UZP}+Jas#nRxhGSKQ_uj3Z4vA&wL|R5cD!GAt~W8IMQAzG^o*BRCR?Sustz9~ljDow%a5`uxMF$>jvhZC z{-m!~Fxg#qKWPuYk<)&1ip=%4@Wvtv6{a=G6|Wcx1A6t0RM)a5mdAS?nmNm+mSy$& z2SbE-4MO@uTNY$T3QTf;t52qTj~wvXS>VM%O%od)8FV}znJsH9{{apg zmBsFpSnAA=CNE=`i0$ER!gLt`+NmhuyME>4@9`tK4@W=Th>u{2V=56f%md!Xb5>RM zsP$|+9I-$Qk1wSo^wH3I#x7+bPJ1Yg4340pKz8FN(l?Yr-uD&T0pp&p>6m=lnp)o0 zr$pR^ZKf}&tr7$&Y~gWA!(C*EFXy=u=xsgbv$^thU~@%epsU1Al!%0sl&C_C`Xg&* zXX|PYl9?~>h3voOr2?SrDfBj=%(aI2fsCgPo7D&ryeOS?TgWC!J6spq(*;k(e0S$gJ3*C^ys6f zh44a|XK6TKvqayEc~X^2kPgVvSM{xOqpEu^Jkrs7bm3og%~L(3b^h3SRyTM1BY>+r zKRk%4xOfsj)3Vo2UdoZogRn|!XDHh{CeE9Aw8ZokT9_XTd7w!cX7HKg?kCQ;hlhrE zNbf2{-umjjwHFWII>q#TVzK`?@}kD)-Pj|4>RB4eXY5?Iw_d0l{BMQ92GY0s71xvd z$-WOBPg=?3WAeK9=ch$}z7tIT-r=*fAK|09m6XkCki~E!2(Zd-Q531*w<9oL(4j2ggCsJnl&aXOk&bSQkdV?JSH@2cFgQ<9 zsxo;`dlsai+6BfUNamop8TtVldxWT3RsVh^5eFLG%R`8VuBwMn&!j}VIU&=RGQg;@ zzRs?z!enK>%z$$vgG8A43~F}J&k)LzBW2~l+YjwSynmVhM~{j(2QGQ4)e-%Bo-_Pk zrW_um@wHL7&6dioW$?3q%x-;Xkk=#P)j-;1D_9KMUb@U{cUS?WKnp@?Yepn*RbQ0a zLLWTK1?`ZPT<3^GA8SAQy5q_HSWSsNAltsHK;@K2IXFE64_jk_)c*An=Zg^iofzxG zJ`QS~O$ov(PegxuYyEEdZ@dq=-2@JKTHTS(d5M%AsSoolBv8Cnkm%~-;^aF1$)0zx zg4AqvI}7%D-T?-%>LFZAb(-!hcaH^c%7}%&o?qwebf?6Lz?i~{5P$pw8!=+C#Q`mM zlf8$%(p`(F>3|H961PQ@^^6P$Bn7ihHiLzGM%Td;Hk;cV_lyb2#1|^TzIvivfY(k# z9Z4B8cU!Hrhw90;tD2?$Wcn_GuG}Jwm-8uP*A`HHoz@WikwwRA+bd3 zyX3yLA*G#RC@8o9jSy~99Ib7l#ROCW9_fL+_W_L1O^o8Q>~5REwa?(}tfB0uDN`P{ zX$N!oEIVV;C;C1AtR$5)aP^8ZvD5ys9);*CqIJht8ND-DHPL?{{{XNIL!|UvW=ci% z42ome@_lZ@KhA(zMqDIUn=#9ag>iPr5JT zX(5OCy3KI*#^=%u%|_C>A09AN*H-`5$jS< zE{tA~nbiqS##+!Hk}*8Z#BuXBTPWFmIs5Uy~qRPK#g zud8HQ(b)A&frlB?XhSqf5CHqP^RqfRjo4I|8 zZ{0E@{Ei?4`AT`1Z>el&&J9SYQh#o1sYF2S@8UENZ2t=ZUx@TbO-()Lb*2D)=&)39 z$htfm{N%U2n~O=D=qS0x_{zSmLDQU$L6RVL{$f%H>$Uo*04-|N6*otP=9cnOgt zuv^5c;beGD`2QJFkv@Q0{p|k$EkWVesuF>W-drY;iO0N(r9)GFojG%~Hjr&tD<1j6 zip24JKLXFoA301@Dc}yMzlHQbaPorr*jcR zCXuQ%XgokG2D&l4vEck#wnPa%Q?=7L&l^{)N)Cz>$ipuyVB#2bB0&2x$mZ(ao%|cn zI_Z|A0k(~2UQEv)d;e35V`N9b@c<&ZZW=NX&f9YND(Yn8^zX2Tf$2@vpu5SjkwN7(;UN9R22iAk!m^b*& za9_nD7-bk(haaxN-+AD|xV;NzQ3W!*zSY{s1Jz%d1V#vW0sT)qICTD85~YGI^6&f$ z+ZgBs8GGXB>Dl^IqisddMC&R{$cn40KXI3e#ElfGX?;B2D+sH$noJX6_?@QSkSNz= zwT2^>LYH@1vG2I}3?%(S7ES=6;OkG#yxN(q6O+%D)H|)@!F##SHDlSi2vcX8ipe#v z1m$V;Gpx6g4ZeX>y=sr{ZktcnZm!B8PO(s11Xw(g-uNNoI@n+5^>Du5$(ssJW)}k1 zaO7sAcQj*G)6v#ZIpSArAKJTvPUS2D2xB;9c|0N3Q*ZzC_-Uc;Bj751k(M`Xra&!Zyk-Fd9CYk+^H#lsntocy0v*UU#)BQRk?Nw_{?d_)9*kSO_ogX6py~ zv@jBz%q9NZi7*20*Y0rzhYBrp3enF(O{*drM}hl4f|?xQ!Y}`r<1)M}F7iT0^?B2P zR`0qN>Y~;VkAwb3nuw8srVpZxQIz;1*1Nu1BCMbA*vQ$HO%|1ab8#Ohe2vuUcwPQr z>&q91T{;uZ=1^%LgaJ62fw%YI`R-M1&m$^mm{WhdHd`*Eml9YpaK#>#oB! zBLEJnXReHEC2hrlNJ--=hy^h0V`Tf~@WkGooOT&LzCQ?EM4_n_$l}fq7B?mI$IxUR zg)S@|4d+#Z5#aF zVvW#{SD6|os5ggD{JmY1ZO(Mp$s1E z0rZ=Mw^*~-`xSV@l*GrKZ+m~8?*3mP0;f(Sq*#m7&&WIh|N9#oO5(Q=cPnZ=y_&vc zZfX5|J`c0!Ce(oRJt9eLcwhPfE_cuH;}}PGis!CXY~Fk)1-7tCmd$MMiGp)Jn0>=M zfyICpYMSQg7&)={QVWj|7X_%(=Q5b@K+Ud>(E;IsSKb&ID>V98?phOCuxOB45T0C^!W%k>kM6E=t6do}2M$Oj)*b})Sdy6t#Uz#VYV*MtO zfP#?nxZf^XyrGsS@q`z6V6|U&Oh}c$nichirg&mBw(wdg2ONlIxC6L*>}4M+FRg?C z9>$=?Y80-wiMGIZJI&zg7ZM5hQzrBokpuq8pjeSeDZM~LWE7L zggLOS#wx+QVx;Gw!k;!?=bB5v3G_hNtvjTcUJ_-$s_8zoKwby05*8I@4GRU2IzGUg z9vBl!NSnivm860Fi?w)1k__PG!^0H`z;FpZjQ&d9L_>Q`_(&yLs1YhS%ZcQ57BCJR ztd((ZO{y=pQ2!dIgDscxn7NPH@jtQKe(ZzSFvgD?c)gCUOYP~6{mHs&;19m0kVl!z zWk9OPUsMqbElMtD@z=odP$R4V#owsD51ox#pJ6f~)c6o@s81?VXJ-ZGT25tFPcVvQ z_zdQlJi9sV9~n_{D%d`eQe5u_!eXOyAL>iv)?tL6sP;0hat^#dE8x72(CDN+F_-dp zE{9PIzp$zKhZumafd)y8yRgFai1R5T>Eg%@RA_SCssfe2@j_w!+ItEh`m<TU25#Zqe*_8@oV; zfx~-$HvdW${&Rr}&yZL1_40i zo6lqk6D-DqYv@#^TO#?`-^hyrN*NZENh!TiBy&(Bt-YlD6HBi@W^UZzP6akm7R?0ng)lLcB=OrN{+>FlKszK?Om*YlE!D zTy1@=#!1t`UbD?^8~MRu;G0;uRZ-|ySRQK~J_)vl z2Qmd@#r6a-QKa<*9Bu;lMK}<((B!RZS_(dSE-?Dbvi@$>is3L{r#>4WB`1; zo=^t&Ka*W&()r7ju9ecihM5WvQ>(9f!3-NWg){JF@gcU}c-oWv@ffCRJxni{G&(qQ6u{&v@%{1CiL40r^jKbHdW zBKp@j##C$?MbUdc8D$7r0-%$zv~vNMRz@zn?QpRu3KJPbzUJx_oON`~n@Tg4Y_0lJ ziXSCSm*R)3-_25vetU_`0p3tb-e&vfgZAf#fX2GnHp1J{RTfj?$Ll|hI{YzMtQR30 zla)!cc?Ms@Nm!hY-zHyU);odziWJ4gQ0~0bjm|0v1fg4=%)mAD(MuNP9jZfd)Tg|K zhnjSX=@iuQnb7b4bSwo^Z+HKbLB77fp297{IZ$|mmg64|CEI)TTD@Qf%Z<_Q+r1NT zzE>4wcR3Fy;C7I8R@AJu5gIMhpxp0Zf4?ppeu9TZ^aQNC!5u(^dIs7*Dib~7%6`AW za>;(Ju!{WGD+H=895ezF!8`4QP#r4wQU&b^GC!o=*UYOvk8SUTe#cDgb3oq2?Q~71 z*v<<8leK}OnL@!A5Ag5F8T{ywc@j@q)ZQ7MQj52n!zRm@C-{Jrh?u8UAIt5!Ned`& zQIs;!wc2ePVte>5(r;N=2+EGrw_?t_dDn^>f{UUk&8X7K?APOhBzSrNa zaiy0rkR7Epn^uKf{W%&>O35Cp$w+0~pNhb&-r{^Ae&7LxIWnV_I(6Ij^gQ|UIIfT; zPwQ$`%Dlkwk3&w6!ed7eV;2f7K)up5&%Hc@S|;!rCw7+2N)I#|yo7hD^?VD|BZ@)k zJ#2k7KZB{uyBn)=V4#ui6E^I$4cKO1k2i+0g+rbk=al+(|5^{kP*DJ*z=A;|C57^b zGIP6;l5xG*td!3XCCR-#AW$b9SbTz?dz)cl+k> z*q;K}XiOI9|B;#aBzOR0yZ2k8S^;oFS)e8KsskY0jV*eq?XNy?qyXyg0)j^jRZ5rB zRoXWSxknnRFD)l4@({16EYvy-{@#sB?@7MEf`askCrDj-_cW?EOrCN&X)@?EQcy>d zyHX;f^AOQizqMzxx3&$+xQl0lZPQN!%$yK~TK7B8`+%XE6{-E*gKBg4lN{i%##o;@ zPoFz5l#40V8Hg{oPlx~HL@tJEF=w{)Ua~`q>Un;!Byo59P%(bOHrcyP%h6G9O5Pb3 zE%;!Ga=c*BsOki4SlHKi2AM>6M8Bzgh^fG)gMm#r>gx=xVSk&g6(e%8m&t?cHq+2) z+K>OzBDUWZcHR6$7{*38I!{hTI)%dw``bqOTK4-&PWcQQ6l%cVp}RDRA)an$I;PgC zPrrAzviwscsPvuFE{dDHH~*A2Bq#my`s~!gWHzrJyGT|@tG=$O>p~*#J2P=gq54_D zy}WQv<96^-)_t|F)SO)H^yo<=m0FEUwwg|$T{MiQ*Su08A_x2crR0<=HP2?q*A05guSy?tZ0IQoNn>U+`o)ipRaA zKT*9G<*6+Ri~WSYC@RK?jQTC1+A!TH(8U&-Z~-@KrwxV9zMt>-a79T#V$YS*9p{#`03^hpku z4(VD)+v6w#yMRA=6DJo(%dwgh<>FrkBH7LNKDWWEsWE-<>bH%cR}fC%GWkTNXgSTg z$~de|Tz|Sf)FxQVC?Wc3yevx~p`@dCNFjw9cQ2l%{0?-Us-TJh4842u7&fD(?B$2O zLR(YzI)>iAHnu+xgn3s?cqf=s-jcpDvH541{GuJ3Y+}zbZV%eOq;|kxsa9HgD}DCc zu@H_FeM1BnTz=M~Cl! zw8{QT`+o&a=cb^wGVtWo_=9Ow0iml_mW4ycLa(7&m-Ql1Wh6ym$;v9ybAnBiO4Zu9nWT*`4d6pGDIllGKG*x>Zs(fv_v!P z-5W)Q*E2Ng3%2iWck7mR;?;uG?CjjTjg4oWtKIjKn9mw)`)}5wLydms+4EUgml=*K zT3GARcKk;6{JZkK`?DX@|?8PddrURwXN1XB@sE{Md^QQe6-4OT z%;+b|%m+{3p}bm~9XL&qOk$OBdCL7G$VF4+IuNY&34O)+L?xmE`di|kJlYNIu!UsX zFgtGNZm4P{T~OIUW%(`rPw}gF!U@#M(`-2hZ+R-Gy1#nP^@#Lzb_fbh`6UG^$>J`) ze{VG>yg5=xF@paB3$lF8Bw}aw68N+xQ4@&0F<6aHwWsoCg|IJMmV61USB78M6^nJa;nZ9dk;A6Vb-FS?$nM_?e6 zPj7xZr6;SYp4;lQ*6K--H(*eAigLt+QC_DWPjW?%#*v zpG$EFl5u_o#~ylmmgC%Z3K}V3dC+!atrTMjQbPxOwKdg?ilm9to$3W(JYhZ|<%NwV zE1`MEb#JZy#mC>MU~Re?w*tR=`Dgoz_x6Ojl0k0R;fE(*(F9?|i_glpto7=ZYC_IG zAC5!${@3hU1wEjrnZ=~+_PObd z_MWAeg=qEmbWsepe|rSIZ4TQw{>y(_bb^nkKjR0$ptU{&<~s@Kuo$lHl!t!rTO`3= zCx*_~WcTo%NTm_#m;9GE!GC7a{~Wx~{^z!R82=-U^O!>S-+akqB=YaA_>aJvlpBhM zhV&ZS*5ltJ0fU+61>gHFwO0QZ9sjpjT$H#CD=mYxO$N08`!{X@zG_#{BM|W{f%f!& zxlsMTAN^y-{(qicEy>?2Rx2NQY z#wv2UO=x~Gl-&Eje2T-f#(Gh7CUK-=s&}h4;@(Yl_v(_@o)A|+oE3)X{9?mpb^3N@ z?96lMQV+pqZC48c{@wN$eI49^f8R{Y47@{)hTnt^rUMqF|Hk>%X0J3`(q)frS=lk>o+fV6}uu07kn)nkF8Tel(d( zqGET$xyh<|GNoE18Ov(@ZRBq9^GkwV3aw_sw*}ACE8eoy*xOUf)uc(!0j8wONMo3k z7*tRg=Zk#tVJf-zoI1ZFCimCGr0C$KBJCsXp0|MxBjSk!rm3`@0%^rpm+ov?>g{h9 z)1%?quTCP?iHN?K?YW7?6E^`bDv`~XR`k?Slu@a|s6#ktbI6ZLcASnQ4%%VGu(L%S z_FH5qB=6LC`y#Y*?wG{U3(E)W+q1-`LJzOJI51zRE1LYwE0Ersscqy|e#KqAJ58Sg zTyjp)2zW{9xjsbotn`SU1g@;i|IB33pME{l{V{d){l&T3FE6ma5UmD!Xhp>a`a|N;GREiN7 zwfJ=t4wm*?!4L_;0d=RqBW3Pwwh*$6%)!yo*y!UuqyDTSve|*llzzCNU=!O_iCr`s zamMTp4;Z1-GnU@Ut-Ei*IyhgAd-98eNDRv>V1!wkfm*n0{3v%Ff zCZW>zU#H(YK`>u63t45o3t}jx z{~}5<@x?X{`7w_)EnSo4lsHW+b#{5H1*8Z0?t!}oa|Onp2{Ou*(0^g39{6CZZVRCd z({gu(9-u}8VJse2EuV`{msA1?aMX$c#kWZt5_;oP^T|bM@qlsOGINvF2g+(9LFoAWFjz&O(^60P9-=C|&g9~H+G;8;{ z#&&@O0>4<9$&|F(%^GJBx`+Jy*rS5`ZWIHR3JtPQjZ?x)FLzFgpMoe_!TQ+`P{4cHMs3~tb$jyL)JpzkjWBk#8((1fdv%AMJ-hQ(Ac%77VG6yYS8Vq(L zEOp0G^(1E{*uZ!Oi3Npf8O^1)+bo~Yd5z;qs1#Yt;xqo&Jzim^3He_26FT1}LNcgf z9#lPfF%^=yiH^-`xjnwB*qkdGD+zoDC@tzvqZudde~!)X$`yzU5o+2lR0KF}4W9B` zP4SUs9hxET-@|F;U*K#s8f>v?6T@Q`M#9EXfF0N0hV0`>l`r@6oPQsl5Bhv8*_*@M_GS-ZQ(a0=ReP+h83Lk(~hU( z_WusUKp5e#3lXRi3DfmndH3&4>5o&tjSYOb?F^KI{`-6&L(hYkmBYx(N%H<57_{fU z6gWQidHA+}CwTor^Iy||ci?sY#;WeWH|+cE(B(eHa2Y^z{$EtBh(K_-M3~lbsQ!=f zz|Vo$1%B?RefHl^{T?ODBIOqn%1X3E{a;x9{~PLmV21yXPt}Lovm01^-&~!Yq*jt> zHrwx|fc~N)pofs5l#Nrc3qZMJfiAiS=+Hl{1{ESSH8nAI9$DCanZ;ivDr@4ZXJnE# z<8^nxt9}`cfH2u+b)Lo<>*MEd!y&M+P2!cUJ@dCMYu+FUKxY99SzxtY z@y|u${{xaHD;iGR1RA8O-D`on13QKCv9)ssqSqRw5l~YRN*?9l+t7XT16bH(p0LgWqaq&erfw0l~vm87RZey zE)G|Wrm8H8Hz#dRAP~sc+ncMEo|xX&!PS9OMp|XMxQJ)XxKt=@@}>Se<7M6{26UDr zAJb2c9>uykBz@SMsaN4WC(g~1Ops@J(?`75l%&jb*8UOY!#C(TH*@3uPZ8~YXuaU) zx1+Q#uJ6^s{h%IUsz7nC$H$>pCj)|ix1B1`y?Hsx=JKe*?WRs;ml7$G-;fx*35M}T zp+8BW=HSpe#?B_@lIzdfmigqb-#vbz_k~WoX;6<(^TSU!?$NS^@kcUHnj>T3n`-rL zna59g#Z%ZFP4)Psuh~CTdW`J4UcsC}d?BRxP}6rh?lVGFmNWT&O*ShuVzG2;pP60< z;Ye|FbHCS?8Nf@YIjUmSs(JT{u{e?KjFMn{p5<4=?lRG zHI)KI|7~Q0wj_`jF3LA}`5B`%J-Prs4ppp!RkS zrI9@dm#rV^h~*)Ij|wyp^T**a>wnI@i85;QL8wbo$dObEYHqm1lksOWA1AK0S&^3s z;o8{y3h;7qpf2wOZV2FgGEaDGXkRXFK#!mE4%MBU{MLEe35W}eprAR#aA7s z*J+Z}xmwQ*%Tmbg@9}z;%-h{&e7?V6+Ir@jC6%OndAjrL?&d7@%cv?@^X+8;O||CA zUKXw}cr{`QR7ym@MP?sYLJ%<5IrqJCV>5+AVteBl19Ee7D@;e!6YR!fKg(t2o5g`j zLi4aAo7HS#sK(}=TriA*libtv<#^5y`EL4QFsPSmRpuOdz-Yj-cQinjsAbsYTjZQ! zZ)}kh_vdoUnL1EOQ2;g*)+n{hVvB;k4Ik$q;%l-sb z5e>`vJ6}*W*s{iaIS)VZgGFX~QWbRyADs#?m(*MJ7g?EfM!+<->a> z^Kqt&%>uhaQ0S5X&J`o^#XYOvla6_Ot{v*k=LVj0$SGQ7 zK2aId4a#@Vhk!vw!Pd?RPZq8GAJs8X++05f`;tT;_O}n1oA?|y(H%j!1BN3X!tj_i zQ_r@>bOz$+f9^gwlYG0YqlygnJsGcq40ljy8rJ;58_ih5m+UIc6h<<0rRzEH9qa`a zNwB-gz_Vigie972{E+4BrRL+r=NFn`n4{QcW4Gyh9DQ@158<$@v0p+{%A{a3!D&p- zbq2+SgFQrab2#q%W#G`i<3;w9RR#{XHpmJ~Nkz?!>Q&eBVc#zkgs(VkSEF;Jk`S8QwS@_0>dzUN zQ<+sy=XnJiQJy>x-)q9p=xWdkgR@Z1S5(ujEHj^Axp6&av0!CHc>M(W_7=+X`kD7v zJ2Y@Oz*TKdKP%m;_J&3y;>B?|?)cX7V(TSjl~IF(NhCee^X6j+@@pcMcgz+cN!&B! zCmfqtljH8|qVuy4{f-@A!!AimHH(})@22c!wYUgs%=T_u?kuN~%TL)XXE0PN^h5Y7 zTikbEuHIGAmCDa_p>DCzeQ(ffz{zfR>V(cTa$)V)tw8#L$+E$TkZ;LXqN06)FvR?L0raC7NC;QCZ`BAAHh zvi5zjUp8N}?D?7t*6A>> zLc<`g*TsD4S->k?x<2Se;6y8?rhTZ@A56GpJv!iabGc!|HhibC*LbE~YO|hNYs@@0 zR;*>ut{mNNUt6ov=L*Vtulz1hC~d=b$IFId2X0fkj62;zWj>v2taWS7&oUE8>3nYt z+RBm1k=m-?SQ{xAGd~J+9_%aoR_}avCvY9?^M23!CSR$*e2MkLBBAZ+m$Rx1B7Vop z{i=`|CZ@e4HY@9KimuZEzTEd5BB{zveu3U1Y zjGp$xLjjVH2gT~_2Sw#pxEcV?E|%r;1(!~Z0i-G?1bC{b0H+ws(||^7A)Qy65tZF- za*{`ngmAl@e_DY^Vw4;95v#Ep4=#QC?9y}a{<&GKNh*A+CsB?C2}iw&d<8SGo8z`y^<}D6)3~8;$%);a_CDE6cDW7ohZ)8oWZRv zb%%|~jO+1aM5EM@J$1h>BT$?(G9@7a$L@&CrQqhXLT24fG`S!yqaAC(VSN#v1tJnt zy}XjXE9)N-=tA4R3)j79#IE1>q-qM22xQn!?~u$MDoysXuGS^ zol7zL{=4fV#z(_Hb$DEfLKHS;8K*O!gJntU0T_7Mf2^V`Wb%VJF0UI;#0 z z&KtT+@g7kC0i)8VFj~eBR!g?fuXJozY|IlLsDyy&Uw3(nr7U>fz%T38;&D6Rx@$K4 zIepjLVA7&{+1nSHcWb5|Zp7D7wc4`rcKgluM5Td}la$uAE5D~*VmXot$HtS>en)GJ z;lOOkB=j@BB_2Ex!IQGt`hH%6(JSN+i$^S`!>qKQmcJ>i=KxctT{|cd!FGQ~(UwQ| z2r-P%=t32w)W1p`=)n!If4sUJw4zm+iY)#7^t3%pzDD2$wOnP@GNXprs1?Gc%&Z}c zW1wPT@!@bJcXm&&PEu9;vhE&LQvEXJ7nko(FE8(LH|cW5549OFrlMg`b9r|)(C?pI zj=P_Ws?|A#gxbobX&O;0XUE!9)({p-Zw1hoMjN@T-8K>{ZMrjb-||vF;xi+I;msrE z`yO93MXgew(qvg=urkS)EjVCRfxvvZe{?N$Xq^z~biFQkmEwAWw(%2-vNtPr?Q4SV z8oAX5qSwJ(BQEy$C)PxWu_aFwg)7;N7fM=jE~-busB2U`aJy#gzrF(W=ba2{53Ay9Qv~>J!xw6l&<)AxFdQPfh^_MN5G;$)sOAvLO=wj<=tf_T zLx*UWOi8x?5`ox(VwzK%jD#Ae>`LTkMrZUlcQKRU&t=7%+Y`2zT%Av9FjuDl;b{=b z70mW~&s;`T$+-DUa_f5=2E(&=oua9{-Y%CLxj6xGZef|XXf)alHK9un zaFLAYF$z(sWPvGHNy+ylHW}KaIC_oZfsr9?!14*PiK@vODD!CVN1|0JRwO9iFdH{% z*%nS`{ETaCE>-8)eMX@vL(J66h6oq6yH05ES-UauWur*lm*^j7kWeYUbZoP!Q(Cct z={NH%o}CO3+f~UzB)R2pk>o)ZtpOYznu~ivEU#)GxtuTf$>&I_6+vvGpPoVEBp)nx zR+7)vShw4mqxPqOvbf+5=aa#kAU_mgz%#2f^S182IGa17_;zZU-0deWW)%(Bzw26o z;^~E1Mh-HmT&+4_Yn0`+PT`X0jDPkR;##GXwgoxyniI{D0V&7`Vw-+vpxGJnax0H1 zie2E9{g1TP$w$bRe5+0TH?qfgFwb~dfrHsts)q9l1}_%=OY`AfgL5L5R1>NWV9P}+ zYtGLMk8o-3!=UX`YcF{9*t<tXDsiN3h~o3F~|0PJC9Uij!eR5haxG7?Q7!qo8=2Vr|HSwmR7k z3FMKcQV6FIQqK3}6E78IZq$ByA)wY;9w~1ORyPA*S&^PN2I_lBPThA6iJs+e%efKl z6)-Jqg2JNpM6QO{rLQjG&{7~Y_SiRM*6;RqF@f#dNypyGBFVf7TJ(bxjjEVQB^oie z7s9HMkbHNCMOZVa0&c~Nf!nK+rsM99Qitu!CM=?r$uB?9Xbt38a2-b#e<2V2HhGe? zoN@_u?RwY5>D~t#w6!cebNZ=WtNA!jyR1R|_-PEr5=GCmN`I?!6RDer_0~zKHbOjN zgtH}KWKy3*X{D75FBEK6`t){sY`arZ2HaXm4!VYt5mUGkecS%|)ZrCc*^-zPCC4O z$8H5vx?}BO5f?NAJ*@&|DJ_^q>v=SpFZJ&)IERCjhCoyBJVgYg0+iLrcKeQymLX#* zhkZl)rLMH=RM*plH=cMn=zR-oscfU&{n`ThW;(DZq%YwiP3I)kd6H^$%cXdrAq&B? zmMm)H%Y+wZFA4EsjC2Vj6sc3n(mEHi-10Qco zXIHd6=YHp^Ma1;;QF$Si!g{duCUgXz(CufGbFVsyo>|qs-}vydbbX{Cw`!38 z8dg*;`$0wE4fn^@S&;^`m99*B!ymA`exHqpa=u5N<_%I+oW0afx zKDT}wJ`jBLHKM&0XIqv(UX^w9s%;ph6AogbzBZS&)Ck_rmq7$u#*=;YhwAJW z7RkC=es9E29Kf4ovZj4!4v3l#m)iDO$1INL($Epf_rT%}>ijt&rfA_bUmCv$0hhHr zEipy#xwK7zMKy7of=w9W1DlF`Dc@qj%+`F784B_STIy^xsHvm2~(V`08~JLYZZfSapsz zM`|0JVs9GzY<4c)ozidBLh@}C6E5^UEmt`8`E@*fp|L6ZA>x5jQ+DE*C&O^!XjGE7 z(=}?7m2W8yMz9!HqUeCGJg(nDT|C)T>HP~e7Ng<7k46P!;xAVizI<4_BlAS`Qf^X2 zxXG-QuN`Dr&83FMnKv6)u5)sN#U%-b8YSAxyA0-EcxX>Djn7eTJQDZ))6~FYY}ImH zy4dei_NFknhxF=I^7ZkCDjI_FqVpD*Eu=<(phy#VOF0PxL8<@_`4YZ}kKR}J=|4bX zHn4G9>(|QFYO>!`oBWyiD#+Nd%N_v-QT4s+p_rpZfG!T3gFMlog4$JATE`20Ui(#U zqaMXoS>4qT%CD-^@wo@8?*#g48XEK`51+}ry@Y4IK-zTPj?-D)Bu@GKKs+Mxh1rCc z*CfsVVehS?>e#Y2P~6?!9ReW`+(~eEcL@+IxVt-SAQ0T$-3b;vxJw|oyTdI`_vt=; zx*zViFZbnt$pEsUs#dL9Yu5a%o``D^9U7c`R0LoC-mt#PVF!iybV5l*aE}9V1n5=n zQjO>WTgWA=KfH*Y_1T7gy+7gSw=|xG#uGOT?@WhGbdiVzpKnt(=<`~FQHTphFRM+d zWsVZ}6@=V0PJwXv-VSLF;O{c7bC~urO?TsTdqxH3 z`Mz}<;q6c+3RATRI>Ek35%3Y%B}W?S%140sNO1o3K~~@K90PbXu-M4qj~yO^98rT+ zGAyXj@BvT{Dd0DrqUlYmEhq3lcC+;979m1Sv7ysp&s zQk(Xx1czQ#-}M2?j2g;{k5^)&d7kMo_oz|`a7<)msMFuueU*HB6<^{yDgvE%V(2jX zW>vxfH-qmT?mcFU_r?L|)$sDgJ&ayH94wh?**_zx&9br3Q6^+1RWUf`%A-k*+9iYnC@yH-XVDD(2@S zwa2n-weT|aS*F-J3ndFvs0}S4W}UXYVJbp!S7>k<%w5&DR@6JG;~K{HJ*p2A0e9aCqJNiq@8v$ z$PRVus$fK8YU2E?Q5hqf2GdK_wSj}!!0lkRWTcrVmoCOwA6YuyV69#6_6)qMIeP03 zPT@Y1T5n^j@wiS#xp@+IdkRT{&w&6ufFAK%01t{t2A>;|n$@yz*6F)&z7Tv-H}nd) z;hAVI4I#=g*u{`Uc!5lo_@B!U>u~wtW$9{+j1y7}9q>@RmR;DtfZ5)(Amj$)M>zdG z2=U4s{zqSpca6{F|lgl$JA_C&M7py@45sp5AbYA{-QekT3@>hQ5>yAc%`j z;5a1Y^zvP3Nhr@a$~uvZ8Se2HyA#G%7uf>A5Ls?L?vr)T=31Ic<-*FuF*yK6+wJ|k z%P9ZnfSW(PiqXLNL_}V=snl@Y!bRSf_WlOvUpY!G8t6;SSL;uoHBArp^J`Al4aw~1SRa9?5J+(2ySX>>o1CvHJwxN1Y4<^tp^R;4Nf zaBKgVBUE&gN{P7di}m1$-7+|(6jp-e@(tArV#lQ^Q~p8+#-4`C^NEkgr3fAZ1{@P#)e{v?uurLm0PxHP?S(ZvJ8vF@2!~j>+{+-ni-gdfO2q?>~Kl^%s+8=_7JvM>PKu54*8dnJ~`wh$D00oW|uJMe? zz7ntdCr$zfn?Dxt8%F;$k+K^MESTN3;pHWTw@5@>Kg?#7EA>_kbiaG4=X{Vn!huf4 zq!S)dtEAb))n{*9>DktjIN6(oZvM8;7RzQH`wgXo_q4gL^F@Z=vXS)3%l93r*X1E6 z-emO(<2H`phoe644xKanR_8an!jiLP3w1TK9kQ=pj-i2V5R~K?q3ckG#>DFut2djp zLsu_0yIc@<#$863bK_}(wz+i+!=KFUbOYkabddRBVSLW?a6Ih>P|kH z?PTP2K-3jCAK5-FDGtzngNc-5iX9Q$!&q`r6=?ZllSQ8!-qVd7E7iJJd z5#5%5*6Gk_sL-PDYH|GeG=opnW>8@m1%XT43%^k1)Vkb}>+I_`gnHxG&Xvm6G}u*R zRDw_f&l&qpiW?#s8{xG}wrxRz^KmqYimUTNLl@2!BQrNM+x6FLO<3f*mF$|*Nb=;fE0Q5pN^L;?P{ zo=26GMYMpL9-$8o@A-NOV}lT`xv0YnVIV1U@Pb?55$#aI*na$o5+6Y z`De-Y%CSNuBh^Fab-cWN5z}h4$t@=x;nq?4S@G0vWNN|Bu@xCHcz<;;ns0ETKqSN( zXi%mmybMhjTLrh;VEygQV4dNU=fcfkk|y!jM}@Jkx~64&TsBJ$@h4YHwiRe z1xV}&l>%P(QnhCKyUlJ39)vj9fJ4R4HO$%P4FQfDVi0yyq5U|4pFcdWujl22_`Q;Z zu?WnQwrKn2g~c(wu0nfO*&WLFdOX$)P1RpSvnsok+kmiS? z$>Ydq9>#jkn=>4?{Gug>5F;~H83N1g6XFkM7 z@0{T|rD|+6JPaE+z&>*F7+wR^`HiOD@$jnLL|HpXL=#+ac0cOd9v2d$cS`XJ6+`I? z7vFTuyWRpIS~@NbVAK)uIO{CFw=MDcq&Xa7mXlO=uX{4d>N5nj(0?@e90 z{Y1nx2Cc(okO;Q7mK)Klthn_{soHD>rd;Lg+ehA`3_C4)Y6J#EXqGEV*W7SKzxC8k znP?|%m=%HWFv|zDB8r3>wvPIK4fBJ0tn2dGWzvGGlo8pe14Z%l#w&U=bi2Rl~?rm7@7dBs!tc^2u-uCtj;H2vn*nPyenX4i!WJ z&+AU5F1TMq;hQ?yM+VbBo8D?V^QeiTd^g>&JFWUa?V>D2l(tFYHxriPP*p!vA~+{` zA}o59kH0Ba?3q$N$VcO6Cks~a%Z?n*x(t$O_w=qNHCG!p^!}7P*nkxm$DcNbrbgg# zeN<#|5eMh@Zb+_u(6l&R@fk6&=hsL5B1uL<~4pT9)t7i+nJL8HkJvnJ! z>A~m~A=hkX?VZ=hD+emo7Hc@;l4LdLSqI`K-|VC3#K5Xis^)t$<1DcS;>4URp_j@b zUnVFdXq>&f%6%v%-}H@=atAsXS~byHvg#$Yu-rtj*ip8E~lVTT_y z2Noe>p)3fXO76cAlocqaQxudTn?0xD&vR)~$7_s=Jts$2gBR`G%LgH>Y$4{y`Weth zYN;{|?bQmaQ7OogRX{wG-B!l70Eou2dW`2Z|6qI=a8?Dej6&PP12^%3Fc+dmw?k_Edc3xPP zrmka+aGF|dub=E^+&$(kPeL5mLd^7tuE^OP(3D!E z_Z^+zS8_x+mtAjSr!nj2-=)}5)q)eB1NM@V+SgHgO$8GceXDL&<%)kg(=3eGw6yE9Ps>V+?Lk`Lena98SfS6JtRW zcCghh@NS7D4b~5dDrFjytv+3e5HHCT%%VVChSSdh_2LB6RRQp2-g%ltphtXa1W{My z%1XKY%Igz?%8D#n%85$jcF}`=H(JuDyOOi)WA~~?;wduI;QOU;=G)u*TS%LxLlR14 zIQw60-q$aDr2%5!FO0~tKq!f>bhs{A<8ePx2ABbEY_2K!zVOh>6(ObKa`+yppW7!4 zLiEm{!7Fc+!DkZ4Pr=w$vwsz{udlu$MJIR0C;yA*CxY(UfGr$IfCDS~Kg0x7>(Q^j zJfLZu`M-YI9|Ir>`pYqe{Fk2MRfqs+Xb@b|-e0Hu4^=(|9l!;n*zNtI@jpn7|98+o zMvUzLr{O&f&Dz|kl2{Ld0yJl6@SaIW6Pp7VOSDM-3WCwaDJTxu$o&uKW86E&j0>?D*~k9RK~`q{OJ_-&l`>=2k3Rs zXvm8jp!xl6=UrGn11WCue1GN&v-{aS?F$(I^TPAe*=9*bWFdA z%&U_S0ESVM_+e3o=B%}wRW#9O`jQBu`=56wC@mH%5(tJr7VA_*vfHZ2lL&ZH4ah%J zwq76O+Oo`P;mf?3b^yG5pkKeRtmvY5w}_c9VYyVE4CwFF0IJ%0v-@O$B=wXx9{og) z*p$U9@^NVafI;s|;F*lc>^FO7PYlm6)HYEfI%?$pgL7-g`O0KpimdKrraqM`0majc z^5~ia42d6rlyz&$On=CqdN|+m?h9bpes6HZe|n*e_!6?Qxk)*Og=$9+v=nBRC61Td zX#qfgrh=fGpdk&a=sHm_#MRwhs{)3&LbI{EAa56Fa+k*xD;NA!qqv4%7w`-6N}CtB zmh2vzsQk*x7f=sx`u%#vBk#2la-NC_kfF{H!m!VIN*)So5d3QTrr27Fndf=?GdA0q z?g`3_;~Av!A}2;nt48*J1Ms}19El`gBA_pIcd1d`d~(3ZYTS<{uZnY?V}Bsy`8TIY zS5pY2g1ezzjkgqNT@-T+!05!CiNfwlcb4l|OC!L+#TpK!=hy{VD&<&O59&9>m#x)| zCPhOg6iW2%GswRgR4!?IthbP^;@gHYbx3~vkW_gms^8*z7e1|sfB|CEDh__7xC7$2 zUG~fBm(#c!$14KOHqU%4I(5x()naN++ZB$PJr|~|9Y$zG9bTRWOB-b+sNu`Y-$V6Q z=N})KmGYDn^clTpCFIii&4=BO*ASIz77Nb-6i%t2-@HZt6(3jLc{I|#oC9#@u{2&5 z%z~G)fyo+W&h+5tu?MH(V_FSt27OgVc9|`fk_UjXuhgKXo8GS3I@WTmiHMW3fwD#_ z=$&J1uYsxl)GT+8Oi2H-+w{eRP_`pr=YMTF0NANYv_cCgGaAYL zDZp#~f^@FCe>u1&E?#P@e@*=MCg7IQ#9L0Z4UUX;=D+`OYZw6Fo&m7l?i0w;{@v}Z z2egm&M;jtSieG?`k-IvrEwoJqvJR2@;87~!HrJBp?ve_;cP5uy?O^)sUh!=SJc$hg zO@Kq&Yo=-pt#*=(7Au?g5RzmZdohSv?L)_XPMG82Q@Pnp-KzPJR=4PlQ$Gvh?~uW% zJg;H1_=6{+8l$7k$pS0+qY`jNI1P?K6_@Uq3xh6@{X(X96-xUB6H5CYD{OcITiNJC-Y~4o!0gc@MR-#(2)Ky18htql~d&B;N z1CNcBF5lmTgsx7&W8B8Wn-tjvg;5&BiUk*IOe<#z-5ZF$CJCr*_N`ulFB{~wVrcKz z2ou1?k!O7V1V-YSk93a@&^!D*apghnj;7FdIhvIUSCb`>OmKI)ysBr|rPjfui6StI zAZIO7=e#TNux-x6nE~7nX6_8=!RN3vytpu!o~wt&Gf)HWcj-_oQpmos^+&}A!fzaW zRvz$V0bWJ3%PD_0#F2Y>ysCFEEnxDq{H);pbtp7Uz4J%>Ai!n5n2ncQbS0YHFW*fz z%Ssn3mxp&GQ7elrv^X>}X}7D@m=As~!7+CVP|o&rtIMI#KaQb#@E9MON9gPY?@t+> zte_`&zkku%iswQy!ru?qCzc8t;-`B>-nQ{KJ}no>b^J#F3gFu#02B~K?;r8o|Z1S4Ng8qX56aZZ@>IHH$75f zeGGwr=ddc`pc%9C?4`dq%lxS@8h7Stx46EiN1TCVzzPn;ySFAwSVDkC*ed~GFwjZl zGl^U9AS~b|OFfCwjjCnwSMNlVEO$qOFE6IhBQexKP&{+l@BS#lq4H7vcv>GbYaBJ} zpaJ)@C%+TJ!=&E~cSkC|za@6b_cjF{P#jcODz(R*I)ya7XoU97qO+IL^*b6$JLFA9 zn?ovfp0~6ePcTqPpi9W66nohoR}hYoliGnCK37I4og2X|?L7fPYVbMCQ+31>epuAO z5bhepWq}+q_&Xm@artfHD+Iyk>fIoZAJH#IiJr|43pIwE(Zc+#l3DlWRN+d#gR%oEw`n~~nuRmN=msTFoJ^!8k<>D;{ZxVu# zrNsjfJ#f{&OUyKtCuM=?kFVs-MDon-pr)x{@^it!qUQ6MW4

{)T^9yj=T(1vMIz zmJ!!H^ZUFOpw{@6-esC^pwndMM;7{q%KOoEvdt~RpxZ(BeK6qnItZe($oHDevTv^ipkA=h zt~wKoGUG+O?>8X!WtE`{Md&k>1~u6%qz-r%S=SZYK5PRzANo=;2w4HCiwBH1m~4D- zs!%q`;G`<_)1O^p$3MEn9~7^4JT2?N@_WU(*BYO?ouF*c#2{2gf?}zH_r-x?%gI-c zPJ{@4@j;<4s>$;zH5?NiD+c_I_Z{8PpI!h}7XxD00pRxUveMwAx>6zh&j=+`xvKSk z_Qd}Ja1CqY?xwV(ABIC(Yov_ocoL2=>lenOn5o7ZCBPcUgSZ;5Vb$l(JN+B#Fm)B~8#lfMJ>KXMJ_54Nr;CwAR;DGhmDl%^TITPI9EdB`B zH8V4FF~HNaEfFzNDW^#YjSnk499@ch1^~^5%KPO9kgHp&$ZURCF!H zL;?ROrU+b?SxrXO5-L*9Q$Kn$kC2buK+i9!ouSFjJwH;FM{lsKgC#2K84y}nTA}2r z7bz%i^doF=t8PoOPzdIAMi4m(TZB=@qz7!)e^Ls}vqXph2Z_Ehotw ze?n13*1M`s&*m}p3Oe;LrnB6^4FmzHI5brOg(Oth#SEMKH-lvrg<-_1V~mVJG25$g z;!>oZMcz7l)iXd!N+?Aw2m&HJ3SyAo#D<$RY!m-u|KUx7h4`bXOL`LoB$9@_49_8L zZg}q`0+i$D4Pl?+M8y@(5>f>p$E6KMLE>{_p=TbA@>3=$3;QZ+W9q?jg5RP$|+SJMO-EVZ`BB=IzPu!jR$mP9>e>j;k5RmdOv@d+>eW4m;h|@qZ0@%a`cyT&`jc5u+$5nO` z(`7d9WhGR@edRF=Y#@7kN8GOc;1}fftsp9YP(9s|AFizVJUR19jyTlEj|;mN7wV0X zf=|#SHIb@Ct64eWrcl?!KRrnCaa^PWJdTB6FXC3{<);5lg@XE>tE{K(^ztCh>V>G=)vO#%z?v zbU10s)C-hz+OepHcT6c}u;RQoN$tP@7>Q3Hdeyl+-8-eQ8V4(VH;DzrKt((@!_&pe z)PS3M{98kjg(|~<3RE?!SFx4MHx6AuOGLZ6x(e8&nXZHY%9%Zb0X%(xL*=MR_x5~i zxUjh!8;KX+j~s-wyA}wK35usI?`cy{6uEtV@@VMc5I41oRFG>`mKl2?w9FA$*!`3GYcLDO; zO*%xj<6QlU3q$u!fi3+oEYm73=tl9FRFOJENx?w)Wl1pRas!Whnk?F;(R7Om;PTjx0JMkE(OJizVF^7?{XD@6p5? zlMjZr#kV$&__gEu;Vdnb0|fmEU!}+uO@0x#{|t%$y*oM(&mpJM?D`U>=GYbVOF6%H z-sLFnu#`~!S#7WApb(>)%Jv#Ge(B>>cve2+B`a8Qlgf^lqPLY3P@N8B zXDJ|Q6ZM1oIM_ob`XN1Vv(`nGh<>J*(fwBA+xj1&%Wc@NFJRb*pD(R3yK*qJRZNM-B*!fn(V+;=fuy@u#K z>g!rmE}*y?>gDFJGQoR)t$IN-d42)YQb{tQqC4c?dkJkiNnaWpH03?%I!3Rs7tui#SufuyuwK z7Bk;OQG=J4=#qs41aYbjwrdq2n1ni0;V6Rl_3yg@wGt?YtW?%5j%^2aNXak}#H6XD zDRDT1=s<@`M(TZ=t%Rq8R8Zvm{?&&Pl#?5$_b3Xk(EP>JRB^p@Sm;-*ppUops2?IA zfsBWQMfn5`3Hny`#Xk|eLtTcq>bVLx*Pz#l4p{-lI$tTtIxI0r3*d@4xlMzYA`5oH z@~p*ChSaMZbI(k-X=#>yjWSJ%Z^fkMMXQ(Q4S(Sq47<^$NjzieWi)A-6NiZoOY-pSkjmu4b!x16kZxqID zpLjZ;l7_$;%7o2TNoG-F?=pLnzI3j{eUmCabDPDxm!~aCmK;*baSz_*U)vP$);bhbqYDx%o}S1LE5V#($xI%3Skiaab<0b{uR6WW z{@Qp{qNCIA!6lb%1Ervdw;{kyW!>~T! z%v-;A=@$j@6IiKQ2@;hxk^IU{nC0gll{Mr6O;cmZ>xIUxMM%|R3=O@@5lrQq%7z-U zyR)oJq>+iHyY zRvnk_VS4`_2qUi3V4XW9Nxd$=BPQ;tAus#=@u_EnF7M8clh&q4cTI+v&KyKgCDoP5EuQh!(j|{h9+FD58w?S#bXiRslU6#3 z@9P(+z1`t<4`F*RgFeGV#G!gXiLMXI53Dp%u(t+4p4?%|7%x35?uWBn!CA0ZO+({M zK%0T_y-hi6#AaGphP^B%@2&>6BI4<~*ZVCJL#LN%IfyL>S~oR;qlLQgloCP&G-Splp|H<}7S24Ed|ugmvL7MrsIU{H zwsgY*dqb)avxxmsP|V~5iK-ui@rA(+6k(0bx<>ne5(uF%^jJaC&og#JO3|1FkG@Pi zvTKNQQDEtkMd(bFVA+^V$|c8TsjHfwR>vdGB>bjKH(_p}?Y7iykn^R2MDYB3 zJ+vBw!f_WeEDnwSb|^U^GoL$8Pl4DUJr`dObil%-eLJH4pAHj#Z^?awz5pY$1vI`F z`N7qot6Y6cL)yFge$|c(C?j4VT}w7NFinnD;5I}gLH36FeoR(Xur)A<^#>0JpZ5FM zf=)-`4?-56%lcY{>#+saZ`zypYh`Xuy){q+8~;a$y{L@d!)6F-CN%wrRbUsl9ER(G z2q(!MuG*eS)Y5~1cnpXlf$3i^YPj`QwlBB}0cT&#U&I0?-Ow*euyk1| z9J+}o9~3}xT25KSlv93bNXsoCQawlQs1>^)w`>& zSJdkbk64)0%OK`(B1n3YOvVSPx~}>|y||nF=Ob#}&QyYuOK*u$Gizk_iGQa~iD`ze zqbjL2FRRE_E(aWHEH-xkVWbK-4#lMZ?N{@+L&85TbbL$UyAqLc!0d{>tQ5`~Ag{Bo8R6 z`nH3U_}soMR2zpxclv%QluM7dnyX+)4ue_@g7D(?er#fnAOmrQ7(wvbWbwl>3E4fF zLVNY#0gqqau<>E2g&_!wdLlas%XkR>tdeG0nlZNUrZRc9__kS+ zLEriy>os1qpnC$}L3C3mry<0m3>`sOZP>#;=J&t~&tew6Bx8c}*qIL%;$UfDCQEE( z59_OjgE2jN*jyxjU^s?`3PL<`9-9%)_o1v9L; zY193#Zo;Y6T(xz*^X1-HS6<>GUSbq^8^=dMEK6`b>fB4kGoD|{Z<izkiVW6Nf!rgsS@S0+=xb%ml1Zqv?bD>#`NdXI8|V0dJVt`JNJ4#_!1J zegpb-YYRa2g}QC#7YNW62Fo-BOUcp>oE{@Q@6MNSu0lr@+TEQ}xa@N(AbD-4%eCbP zLc4+hcjDced2A^Ed-Otb+ts!PXNR5VA2_0-<~1JGTFPYb2++A7=zyGfC9E=#VNdX$ zQYie{R&x30W1QI%g|X>GW?gsUaY(5&K-4IeEfRD!M)xC=TH1_wt_M^j-27NB4VDT$JLB#Qr&;S2)Fy?`O2Ty2p#oVrqZ$S-H&+*p5_ zfZy+nG;aD5CxnCmHTmJK9NfLVhW&2plC&HHwa6IvI9HjnuyE7^0v4>8fwd7o=bSA) zCpIH6MFu7;aib9!B#IZvp;)OSw(z)PbC}-Hy|$Ou$6l=(OJ9Wl`0fvfn7AY`oK9CITVxpvgRU=N78-O*ty)<`y#yZL zLA4z{&`@rN!<4A|A=Cl64ROasOp716bNPfi)DwS3cWVhQig8bQOFUJNTb08O&>cj! zd+9kuccrt`w7qpZLum~EIu!K%VsCLqp5JXCMo?#1@Fg0Fc|9MSz?A}39g(t%N$9OK zRFx;bu!qJvFGEP-%Z(~;=*fD~>{1ESy}>C{^e^G&hV63tO02h7PfE=$}IMP{b^qauF2SKoiXDjI_c)DS1-vdlke17v&{ zz8KvpHQ)#c<`!cWOED8E7!Y>~J`#J;lOjtMUV=pFol?5HwTenvW3l^H<5p|1AmrjU zFYh!$YUqZ;-r2lL22L#~%`pRVQlE`c_442?9hoj3mLi@$kh!p^enIiskS+}K8?0Ag z)lU2sPu(o59{(3I9G3y6L#ro#3Pn-@GyidOTRFe)V0xgYg4`e-clt-OJ+k^N@CdK# zLG9lE(!1ze{U274LV+}061?c{?%Z7ef!_YZMbeJt^_X*>)s6o;=D)u{%YMblvkQ|0 z{yP?d4EzSLQws7J#r60rxUslho4lZ7*JWR zU+WF3BQv-b)JhaO+TH;giL>kLc*JDp(#wxE27_PHkN5WI*KST2@4oCz?u5FqT7IVj z!0$wX7@Rk$Ca#?2M1prQBdKrIY5*?lZ0KwE6SdxQ zla|Fq^-W{V=WEATyT!HQB|b=6{YO)F0F`y>^xsisZEH_9 zlfb%z3Gsd)6ihL9@>DWl8}ZM|>K`s>LV2$yOnG0;P|ls;gyO*RKO{x&QOgbiGztKF z)GP8WAG)bEP0Z{dwdA#(I&{#iwFyXTwG%da=#59#Zjc6O%20P??-|uWfbx817LV1q zHx`iYSvJN=<_3o~CMS=v{Rz4{Zk4DR>_+^Z%|PZSAq1GTNxU5-+BiU`0~{+y0M)FD z?Ys;ly%u`~3p9}ZwF{UDXMSt686FaR2F>_X%q3xigM&A~j^Cc^&+zpP~}oXJmBfMIA$p6_Z8P~KNJ0u zGPh>+f1JsyHJnMRb@Yr_*DzzjD`<%3lcP6k+2D%#qw3_RVYB^#T2;Apw%rdvi}`9@ zy%TcPQ(U`4m9*H8g@ctKj+$U18NYjPTbeFh_T^yA+E3(nvgD={5+dmq3dT&$jm6mE zg2__Fi$y+^&c}c6rvIF)XeqBNZHl=dMhtOyNWYV%^hLD3bO1{yMsK17h|KTvLbEh% z=SU)3NL%I=zwD=@`=~FkRB!Jz@m8D9Dt_$b)rkkeid>H^M)e?7UMI35Gkt8hDF(Yc z-*=n1*vS;$ZB6%hY6M$SSnA;sTuKER=)`5UBIz*x^H^|AZr6{UUv}s1E#}&aM~Qp2 zXk-4q`~Xs@(2Wz)(~()eoap#X3UFE|G}0XLmy7{=Ms8a{abU5#kN%J?<%MzAJe}icK zy0X8l|4`KCtuIxHAG7YPqZj=Q&-ai0>)-$S z!N~xV8IG@+NNX1!;Hk=+qD;5ixbh*#TfBMtJ%|bTi6#TasuAr6Fz4Nt5N8aBQ)_nI6j3U z)sC=s#0mj)B=YSrg7+n>a?_eLhuhiT_4sISP9DNTYHChTL(QZSk&r+u4=B419{Hh- zEQUEEyY~8 zNEvr#=7HsZGdT=&0Zt0;gsu0vng5T_2>=$4100R8e6Us6fcU!eUk}{=&7Mt9WZYnX zF9qz-fn{F@Dt_i~7y6HH+XVcID)phQ{yo}%+UEc9lR3b@_WOGx&A+X1{}?h~#8);c zL};1+pGDPQ4W+x@ztY~2#b3*q|K7aTAzrH!FpARud0;!_*K_WPtN)+p+~f;XAk4l$ z82+cTrOvBW^_-o_oBwfCAqeJIU=p6t`%_Ib*wsm0JebPoiVhw5Gt4B)kI_37kK(%#=<)RS27P&5{&%! z=wTStDp!G~J|Z*VW)%N1MS&ZM``S$UNTwO(f!^e}6|ScA%E?Ndd6D7c=LZt~d`ySO zbOEnwvmzMG_m=bcRP9nLl}a=!kft<$p9O%)JCLOiP_>|POKx|(7SY01{*5C^g+BgZ zbDCaR0^k{C9{dKJkG480D_uR@!a_n;#KkoEx}JK*$MpemIs+u!01g^(4GEtna-^7S zPj>bPpsiXMu~7i6`NahgH$ob=pJ)3?kc>>|=dr`4C`HiUpPg0UZN-D?5eBxqKmt%^ z11WeC+KRnVm;)AyO(B4Lqm%%%vZ9nq`J1~TwfL|ppV?~490@G9A`lqk>?66Gw0bN> zVu^J3xvJ@Kv~Kr)>njD(;yRx}Upic^gq$D7lNPXAYv2QXg5#3XTNWlCQ1F>?nRRES z&`m^0?@>wVFT8av83O{8&Bvswhu&|kK0S0-e8U8Zra){l9CY9+c`bE##7HIq^+7Dd zmEeny#|_ExoZ~k5BX+ZXIN63)G6i*NboQIvnFv-X={SzWK=3iQ{qfY)ia4Ecwri`{OFh zB>bE&=G9HC+TlQ$8kIgTx8v}eo43{aF)Spm8kZ+?EYWgqWE?7pwll9&5y_bIU?Z}263Gfwl47hC$^sNVUYOzpj)+|gWSv&4u9_Q0o z9IESih^DCH?t^lkf6m+-)9%DY6@31n<1sbLdVLsXKbA*-)^ku1US~r2ru5eJ{gQ!&I0D_Q zZlV6tRvo2dp>d9x}-Tk=>{E7txlt2Yt!=2NoPXktu8kTeRBV>yTH? zm+Ilf4fBo(t_>|6BgXg-vV7_*oKa89gSZ2#b8FMi-=-f%Ikh)_$Mr0Yd6_JsHhP^9 z{&o1-1AMb`@H6~bu`nfSDH`t9edo99luPnaTl-Ei#RoR!`JZt0Vr_Dx(gjF zxclS97kw|vSZUSOOVpz}9P*ytaIAfva?cFyZ|=OZS~T8ZA-3T7AxF9*FzHPcl`CIq zsXXeksusWMSYx)<5hdM$0Zi;ahbxO73JP2H3=b&>ABtn)Q;$2|-W$?`vUX?wrC%BP zPc10#o@dYU8-0)nnw*xsPAc~ma^z3+PFng3X1sCttO>{Y9zK758v7E7Wj<1r6jUd; z-F7DCykBjJIg(FoaoFy0Rr2Eb>ALF9J>GbHjaQYul);~^wj)AO*Zm80Y-fzkK zzP4%S8Fn8Z_NjD>(1O07daAObCv22sl}o8AmLsceH@tLTJ-T2n>G@24Ty3sZ<(t{@ zsXDU9oMmUkV6rZ{2NFJkg>AUERi*0MX0|x+%!QC*Xxlb_Z0GDZ9LT`ii4kn?@V-Lk z>=T^{PF_M;EGQRWd#_fyw$56WdI!uXoU;Vp<4EaJWX`F`(CFx!t36``q#3 zd>+n+9m9pjdf1`M&lj!6$>}cPS7T#taXKKFqDd#Dl*iX*;g%$wKciflvBh`$eFn&*Cr2W4QF!xG zomeTwGVPtcVy0bsvtj$T=5*$q$FDc>o!5Wfuf<&#H*NQy%w$S;_mjNb?=@teA^*A1 zz21&gMT11Qi|rS;Gf%eYpI_ma#Qo|POsx)VKtHusYM z*Ua+;^D{$3Q(^B>ehc&0Q3RIVES%k5zdvW_pTF>v3Bo_z%nhSo_|KpGa~20?eP;px z>vaGt_fK}!YfpnhK{|NXFaWk9QZwyXdd0oj|)kua)>;?vCFUBUzC~ zN5}DM9)#`aH{4bqw@*55N604xhAj=l0-_s@sDk$uR-<2xe&u{TE8H>b{pO&ZYAW#` zvjm7D6;e3Mc-t~KMEA2^I$6UsQI&_t{Un3G)QVW|OZKUs;u0pt7h)XPV_f#9FpDnbvKqNCY6I;T5xGaaJ;dWcc7pUwC%hDcDUng*+FcdWOumHlzBq-dNkrwvUf zerwY`#E(Jzo41sxF<1n7#{DBHtd`5Su7`t#`|hvnL#kC7`Z&KJn@zj3`|{ne$HwXd zX(+$*lZ@w8Q^NkZ48M<2S?#r!{Z-Uj6k(^2l~)CTqMePh_4f@lEHzY2=?mU35VN{J z1~wcRNAvS6hS0N_b)XHTySwwrxbo{3UYZrt&7?}e@s?mBhxZk4jWL-4CQ*9PcT|>y6+oR zmyM_!@8eD==*5(O5nygTUEbAvL#_GNNBD8Qfpo@4EQ*U_cCXPHY2LHewdQ_A+2__+ zhUXzt!>fK~|K~>2R0mF@j)Q60f=d+7x&(P&M(Yv5!_&j+*}Ss+zJjr-ZaPbGw1j<>5rGfY)p>?Z8A~8qRp<+ftOb1esTf|1pJ_ zfF*0Y(D<_~^;^3zJ96aDAxDj+=Bj)*j~CSw_Xpx9dhHt%v>A~{&lU=KUR;^Qt3z?u zal5PS+Do03UNq3i(j>L|UT>ZcXa%E|yxl$cYblO&C%Cr9ycnM^4ezs*3*!^hZ@co41= zR4XaWyd6PAiW`s>{RjJkIoneBo2T zRjo(o9+-W({QCgndEA9df`x{o59s%*_( zMZ3_Rswhixcr07x%{dY~>ezc6BNUxn`jAn}W1ZK2FI*IV+BrhmU1zh6>C_i#o| zNo4(oU)hthRvvf!U1zy0wl?>#`q?)YZ(EXq&C<`--fm?#e?IP>j^qbJ?37*zhg z>2#Nk>|gwG<`=Civ)AoV@w5Fr$0F^_j$?0=Kg7-N&uYlsnh);hK~v6!H%zO~%r^gj zp8MA9+AYW26D&E;RQ~OKb*}rB!orXC|9it;hA!S+o4LQr^Y{V&yh#148M(20^j&}X z+&WX_^Yzz->1pTty3fy@z$%m3c1-vG=f_$uGiJ@rzq9*e>AUFsqrhI<#obZcHa?Md zlDdBR`cH1LBhgo%?<#+N?cqJC-t*hG=)}cc+Ufl~$G+!SX*?%VL*>F5rnC@~&zB9i ziK<<=SSR#$wthxzz3-|M=Ec5txBmy+x^Wq~@zgjq)FEKwCOgZ=afwWsH{EBQ4e*`w;)BQU*f)ERrzc<8 zVVu-{_gl~Tnxy433_rJ4yqM^&tow9F&85oIb9^s8^qs2$Zwojy9I#)}uvGs40{(mU zzt@Wc>-XOGHQ%58xZ?L;NP6A=dqMRDz>LXYxg2YJur|PeH;QN7HS|TRgmZ;puZ>msuD(P z&(3UEp!7HZDe-`#Nfp>BR{i=_4Jpn*VPFKb@Yq5$6Ig%;@M(FC1~fEwMgtlp<&CCj zl#D-GbfA=_qeTaD2|HSJj20cB(qgpLfl^3}wmMJ>iP7dAa%*+89gWhy7%e(TEIPa` zHMAHQn9g~+IEEnguSR=`DBb4KULta*cd&QI{{VMnM2D?Ze!h docker network create -d overlay interlock ``` ### Create the Interlock service + Now you can create the Interlock service. Note the requirement to constrain to a manager. The Interlock core service must have access to a Swarm manager, however the extension and proxy services are recommended to run on workers. See the [Production](./production.md) section for more information diff --git a/network/macvlan.md b/network/macvlan.md index e0f6c4013d..42b441d7e7 100644 --- a/network/macvlan.md +++ b/network/macvlan.md @@ -1,5 +1,5 @@ --- -title: Use Macvlan networks +title: Use macvlan networks description: All about using macvlan to make your containers appear like physical machines on the network keywords: network, macvlan, standalone redirect_from: @@ -13,25 +13,27 @@ this type of situation, you can use the `macvlan` network driver to assign a MAC address to each container's virtual network interface, making it appear to be a physical network interface directly connected to the physical network. In this case, you need to designate a physical interface on your Docker host to use for -the Macvlan, as well as the subnet and gateway of the Macvlan. You can even -isolate your Macvlan networks using different physical network interfaces. +the `macvlan`, as well as the subnet and gateway of the `macvlan`. You can even +isolate your `macvlan` networks using different physical network interfaces. Keep the following things in mind: - It is very easy to unintentionally damage your network due to IP address exhaustion or to "VLAN spread", which is a situation in which you have an inappropriately large number of unique MAC addresses in your network. + - Your networking equipment needs to be able to handle "promiscuous mode", where one physical interface can be assigned multiple MAC addresses. + - If your application can work using a bridge (on a single Docker host) or overlay (to communicate across multiple Docker hosts), these solutions may be better in the long term. ## Create a macvlan network -When you create a Macvlan network, it can either be in bridge mode or 802.1q +When you create a `macvlan` network, it can either be in bridge mode or 802.1q trunk bridge mode. -- In bridge mode,Macvlan traffic goes through a physical device on the host. +- In bridge mode, `macvlan` traffic goes through a physical device on the host. - In 802.1q trunk bridge mode, traffic goes through an 802.1q sub-interface which Docker creates on the fly. This allows you to control routing and @@ -39,7 +41,7 @@ trunk bridge mode. ### Bridge mode -To create a Macvlan network which bridges with a given physical network +To create a `macvlan` network which bridges with a given physical network interface, use `--driver macvlan` with the `docker network create` command. You also need to specify the `parent`, which is the interface the traffic will physically go through on the Docker host. @@ -47,18 +49,18 @@ physically go through on the Docker host. ```bash $ docker network create -d macvlan \ --subnet=172.16.86.0/24 \ - --gateway=172.16.86.1 \ + --gateway=172.16.86.1 \ -o parent=eth0 pub_net ``` -If you need to exclude IP addresses from being used in the Macvlan network, such +If you need to exclude IP addresses from being used in the `macvlan` network, such as when a given IP address is already in use, use `--aux-addresses`: ```bash -$ docker network create -d macvlan \ - --subnet=192.168.32.0/24 \ +$ docker network create -d macvlan \ + --subnet=192.168.32.0/24 \ --ip-range=192.168.32.128/25 \ - --gateway=192.168.32.254 \ + --gateway=192.168.32.254 \ --aux-address="my-router=192.168.32.129" \ -o parent=eth0 macnet32 ``` @@ -70,7 +72,7 @@ Docker interprets that as a sub-interface of `eth0` and creates the sub-interfac automatically. ```bash -$ docker network create -d macvlan \ +$ docker network create -d macvlan \ --subnet=192.168.50.0/24 \ --gateway=192.168.50.1 \ -o parent=eth0.50 macvlan50 @@ -85,26 +87,25 @@ instead, and get an L2 bridge. Specify `-o ipvlan_mode=l2`. $ docker network create -d ipvlan \ --subnet=192.168.210.0/24 \ --subnet=192.168.212.0/24 \ - --gateway=192.168.210.254 \ - --gateway=192.168.212.254 \ + --gateway=192.168.210.254 \ + --gateway=192.168.212.254 \ -o ipvlan_mode=l2 ipvlan210 ``` ## Use IPv6 If you have [configured the Docker daemon to allow IPv6](/config/daemon/ipv6.md), -you can use dual-stack IPv4/IPv6 Macvlan networks. +you can use dual-stack IPv4/IPv6 `macvlan` networks. ```bash -$ docker network create -d macvlan \ +$ docker network create -d macvlan \ --subnet=192.168.216.0/24 --subnet=192.168.218.0/24 \ - --gateway=192.168.216.1 --gateway=192.168.218.1 \ + --gateway=192.168.216.1 --gateway=192.168.218.1 \ --subnet=2001:db8:abc8::/64 --gateway=2001:db8:abc8::10 \ -o parent=eth0.218 \ -o macvlan_mode=bridge macvlan216 ``` - ## Next steps - Go through the [macvlan networking tutorial](/network/network-tutorial-macvlan.md)